Peter M. Groen / knowledgetree

Commit b4546f07886c1f34edc11f45e4321b4112131cdd

Authored by kevin_fourie
1 parent c4456bb8

Merged in from DEV trunk... 

KTS-2699
"Add a magic file to the stack so we have something to fallback on in case we can't find one on the target operating system"
Fixed. Added magic file to config folder

Committed By: Kevin Fourie
Reviewed By: Conrad Vermeulen

KTS-3044
"MD5 support list should show relative filenames and not absolute filenames"
Fixed. Archiving wasn't working under windows correctly

Committed By: Conrad Vermeulen
Reviewed By: Kevin Fourie


git-svn-id: https://kt-dms.svn.sourceforge.net/svnroot/kt-dms/STABLE/trunk@8111 c91229c3-7414-0410-bfa2-8a42b809f60b
Inline Side-by-side
Showing 2 changed files with 13141 additions and 1 deletions
config/magic 0 → 100644
  View file @b4546f0
  1 +# Magic
  2 +# Magic data for file(1) command.
  3 +# Machine-generated from src/cmd/file/magdir/*; edit there only!
  4 +# Format is described in magic(files), where:
  5 +# files is 5 on V7 and BSD, 4 on SV, and ?? in the SVID.
  6 +
  7 +#------------------------------------------------------------------------------
  8 +# Localstuff: file(1) magic for locally observed files
  9 +#
  10 +# $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
  11 +# Add any locally observed files here. Remember:
  12 +# text if readable, executable if runnable binary, data if unreadable.
  13 +#------------------------------------------------------------------------------
  14 +# acorn: file(1) magic for files found on Acorn systems
  15 +#
  16 +
  17 +# RISC OS Chunk File Format
  18 +# From RISC OS Programmer's Reference Manual, Appendix D
  19 +# We guess the file type from the type of the first chunk.
  20 +0 lelong 0xc3cbc6c5 RISC OS Chunk data
  21 +>12 string OBJ_ \b, AOF object
  22 +>12 string LIB_ \b, ALF library
  23 +
  24 +# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
  25 +16 lelong 0xef000011 RISC OS AIF executable
  26 +
  27 +# RISC OS Draw files
  28 +# From RISC OS Programmer's Reference Manual, Appendix E
  29 +0 string Draw RISC OS Draw file data
  30 +
  31 +# RISC OS new format font files
  32 +# From RISC OS Programmer's Reference Manual, Appendix E
  33 +0 string FONT\0 RISC OS outline font data,
  34 +>5 byte x version %d
  35 +0 string FONT\1 RISC OS 1bpp font data,
  36 +>5 byte x version %d
  37 +0 string FONT\4 RISC OS 4bpp font data
  38 +>5 byte x version %d
  39 +
  40 +# RISC OS Music files
  41 +# From RISC OS Programmer's Reference Manual, Appendix E
  42 +0 string Maestro\r RISC OS music file
  43 +>8 byte x version %d
  44 +
  45 +
  46 +#------------------------------------------------------------------------------
  47 +# adi: file(1) magic for ADi's objects
  48 +# From Gregory McGarry <g.mcgarry@ieee.org>
  49 +#
  50 +0 leshort 0x521c COFF DSP21k
  51 +>18 lelong &02 executable,
  52 +>18 lelong ^02
  53 +>>18 lelong &01 static object,
  54 +>>18 lelong ^01 relocatable object,
  55 +>18 lelong &010 stripped
  56 +>18 lelong ^010 not stripped
  57 +
  58 +#------------------------------------------------------------------------------
  59 +# adventure: file(1) magic for Adventure game files
  60 +#
  61 +# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
  62 +# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
  63 +# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
  64 +#
  65 +# ALAN
  66 +# I assume there are other, lower versions, but these are the only ones I
  67 +# saw in the archive.
  68 +0 beshort 0x0206 ALAN game data
  69 +>2 byte <10 version 2.6%d
  70 +
  71 +
  72 +# Infocom (see z-machine)
  73 +#------------------------------------------------------------------------------
  74 +# Z-machine: file(1) magic for Z-machine binaries.
  75 +#
  76 +# This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which
  77 +# appears to be a version-0 Z-machine binary.
  78 +#
  79 +# The (false match) message is to correct that behavior. Perhaps it is
  80 +# not needed.
  81 +#
  82 +16 belong&0xfe00f0f0 0x3030 Infocom game data
  83 +>0 ubyte 0 (false match)
  84 +>0 ubyte >0 (Z-machine %d,
  85 +>>2 ubeshort x Release %d /
  86 +>>18 string >\0 Serial %.6s)
  87 +
  88 +#------------------------------------------------------------------------------
  89 +# Glulx: file(1) magic for Glulx binaries.
  90 +#
  91 +# I haven't checked for false matches yet.
  92 +#
  93 +0 string Glul Glulx game data
  94 +>4 beshort x (Version %d
  95 +>>6 byte x \b.%d
  96 +>>8 byte x \b.%d)
  97 +>36 string Info Compiled by Inform
  98 +
  99 +
  100 +
  101 +# For Quetzal and blorb magic see iff
  102 +
  103 +
  104 +# TADS (Text Adventure Development System)
  105 +# All files are machine-independent (games compile to byte-code) and are tagged
  106 +# with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is
  107 +# on the way).
  108 +# Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
  109 +0 string TADS2\ bin TADS
  110 +>9 belong !0x0A0D1A00 game data, CORRUPTED
  111 +>9 belong 0x0A0D1A00
  112 +>>13 string >\0 %s game data
  113 +# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
  114 +0 string TADS2\ rsc TADS
  115 +>9 belong !0x0A0D1A00 resource data, CORRUPTED
  116 +>9 belong 0x0A0D1A00
  117 +>>13 string >\0 %s resource data
  118 +# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
  119 +# 2-byte length N, the N-char name of the game file *without* a NUL (darn!),
  120 +# "TADS2 save\n\r\032\0" and the interpreter version.
  121 +0 string TADS2\ save/g TADS
  122 +>12 belong !0x0A0D1A00 saved game data, CORRUPTED
  123 +>12 belong 0x0A0D1A00
  124 +>>(16.s+32) string >\0 %s saved game data
  125 +# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
  126 +# version.
  127 +0 string TADS2\ save TADS
  128 +>10 belong !0x0A0D1A00 saved game data, CORRUPTED
  129 +>10 belong 0x0A0D1A00
  130 +>>14 string >\0 %s saved game data
  131 +
  132 +#------------------------------------------------------------------------------
  133 +# allegro: file(1) magic for Allegro datafiles
  134 +# Toby Deshane <hac@shoelace.digivill.net>
  135 +#
  136 +0 belong 0x736C6821 Allegro datafile (packed)
  137 +0 belong 0x736C682E Allegro datafile (not packed/autodetect)
  138 +0 belong 0x736C682B Allegro datafile (appended exe data)
  139 +
  140 +#------------------------------------------------------------------------------
  141 +# alliant: file(1) magic for Alliant FX series a.out files
  142 +#
  143 +# If the FX series is the one that had a processor with a 68K-derived
  144 +# instruction set, the "short" should probably become "beshort" and the
  145 +# "long" should probably become "belong".
  146 +# If it's the i860-based one, they should probably become either the
  147 +# big-endian or little-endian versions, depending on the mode they ran
  148 +# the 860 in....
  149 +#
  150 +0 short 0420 0420 Alliant virtual executable
  151 +>2 short &0x0020 common library
  152 +>16 long >0 not stripped
  153 +0 short 0421 0421 Alliant compact executable
  154 +>2 short &0x0020 common library
  155 +>16 long >0 not stripped
  156 +#------------------------------------------------------------------------------
  157 +# alpha architecture description
  158 +#
  159 +
  160 +0 leshort 0603 COFF format alpha
  161 +>22 leshort&030000 !020000 executable
  162 +>24 leshort 0410 pure
  163 +>24 leshort 0413 paged
  164 +>22 leshort&020000 !0 dynamically linked
  165 +>16 lelong !0 not stripped
  166 +>16 lelong 0 stripped
  167 +>22 leshort&030000 020000 shared library
  168 +>24 leshort 0407 object
  169 +>27 byte x - version %d
  170 +>26 byte x .%d
  171 +>28 byte x -%d
  172 +
  173 +# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
  174 +#
  175 +# The actual magic number is just "Core", followed by a 2-byte version
  176 +# number; however, treating any file that begins with "Core" as a Digital
  177 +# UNIX core dump file may produce too many false hits, so we include one
  178 +# byte of the version number as well; DU 5.0 appears only to be up to
  179 +# version 2.
  180 +#
  181 +0 string Core\001 Alpha COFF format core dump (Digital UNIX)
  182 +>24 string >\0 \b, from '%s'
  183 +0 string Core\002 Alpha COFF format core dump (Digital UNIX)
  184 +>24 string >\0 \b, from '%s'
  185 +
  186 +#------------------------------------------------------------------------------
  187 +# amanda: file(1) magic for amanda file format
  188 +#
  189 +0 string AMANDA:\ AMANDA
  190 +>8 string TAPESTART\ DATE tape header file,
  191 +>>23 string X
  192 +>>>25 string >\ Unused %s
  193 +>>23 string >\ DATE %s
  194 +>8 string FILE\ dump file,
  195 +>>13 string >\ DATE %s
  196 +#------------------------------------------------------------------------------
  197 +# amigaos: file(1) magic for AmigaOS binary formats:
  198 +
  199 +#
  200 +# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
  201 +#
  202 +0 belong 0x000003fa AmigaOS shared library
  203 +0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary
  204 +0 belong 0x000003e7 AmigaOS object/library data
  205 +#
  206 +0 beshort 0xe310 Amiga Workbench
  207 +>2 beshort 1
  208 +>>48 byte 1 disk icon
  209 +>>48 byte 2 drawer icon
  210 +>>48 byte 3 tool icon
  211 +>>48 byte 4 project icon
  212 +>>48 byte 5 garbage icon
  213 +>>48 byte 6 device icon
  214 +>>48 byte 7 kickstart icon
  215 +>>48 byte 8 workbench application icon
  216 +>2 beshort >1 icon, vers. %d
  217 +#
  218 +# various sound formats from the Amiga
  219 +# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
  220 +#
  221 +0 string FC14 Future Composer 1.4 Module sound file
  222 +0 string SMOD Future Composer 1.3 Module sound file
  223 +0 string AON4artofnoise Art Of Noise Module sound file
  224 +1 string MUGICIAN/SOFTEYES Mugician Module sound file
  225 +58 string SIDMON\ II\ -\ THE Sidmon 2.0 Module sound file
  226 +0 string Synth4.0 Synthesis Module sound file
  227 +0 string ARP. The Holy Noise Module sound file
  228 +0 string BeEp\0 JamCracker Module sound file
  229 +0 string COSO\0 Hippel-COSO Module sound file
  230 +# Too simple (short, pure ASCII, deep), MPi
  231 +#26 string V.3 Brian Postma's Soundmon Module sound file v3
  232 +#26 string BPSM Brian Postma's Soundmon Module sound file v3
  233 +#26 string V.2 Brian Postma's Soundmon Module sound file v2
  234 +
  235 +# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
  236 +0 beshort 0x0f00 AmigaOS bitmap font
  237 +0 beshort 0x0f03 AmigaOS outline font
  238 +0 belong 0x80001001 AmigaOS outline tag
  239 +0 string ##\ version catalog translation
  240 +0 string EMOD\0 Amiga E module
  241 +8 string ECXM\0 ECX module
  242 +0 string/c @database AmigaGuide file
  243 +
  244 +# Amiga disk types
  245 +#
  246 +0 string RDSK Rigid Disk Block
  247 +>160 string x on %.24s
  248 +0 string DOS\0 Amiga DOS disk
  249 +0 string DOS\1 Amiga FFS disk
  250 +0 string DOS\2 Amiga Inter DOS disk
  251 +0 string DOS\3 Amiga Inter FFS disk
  252 +0 string DOS\4 Amiga Fastdir DOS disk
  253 +0 string DOS\5 Amiga Fastdir FFS disk
  254 +0 string KICK Kickstart disk
  255 +
  256 +# From: Alex Beregszaszi <alex@fsn.hu>
  257 +0 string LZX LZX compressed archive (Amiga)
  258 +
  259 +
  260 +#------------------------------------------------------------------------------
  261 +# animation: file(1) magic for animation/movie formats
  262 +#
  263 +# animation formats
  264 +# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
  265 +# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
  266 +
  267 +# SGI and Apple formats
  268 +0 string MOVI Silicon Graphics movie file
  269 +4 string moov Apple QuickTime
  270 +>12 string mvhd \b movie (fast start)
  271 +>12 string mdra \b URL
  272 +>12 string cmov \b movie (fast start, compressed header)
  273 +>12 string rmra \b multiple URLs
  274 +4 string mdat Apple QuickTime movie (unoptimized)
  275 +4 string wide Apple QuickTime movie (unoptimized)
  276 +4 string skip Apple QuickTime movie (modified)
  277 +4 string free Apple QuickTime movie (modified)
  278 +4 string idsc Apple QuickTime image (fast start)
  279 +4 string idat Apple QuickTime image (unoptimized)
  280 +4 string pckg Apple QuickTime compressed archive
  281 +4 string/B jP JPEG 2000 image
  282 +4 string ftyp ISO Media
  283 +>8 string isom \b, MPEG v4 system, version 1
  284 +>8 string iso2 \b, MPEG v4 system, part 12 revision
  285 +>8 string mp41 \b, MPEG v4 system, version 1
  286 +>8 string mp42 \b, MPEG v4 system, version 2
  287 +>8 string mp7t \b, MPEG v4 system, MPEG v7 XML
  288 +>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML
  289 +>8 string/B jp2 \b, JPEG 2000
  290 +>8 string 3gp \b, MPEG v4 system, 3GPP
  291 +>>11 byte 4 \b v4 (H.263/AMR GSM 6.10)
  292 +>>11 byte 5 \b v5 (H.263/AMR GSM 6.10)
  293 +>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10)
  294 +>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile
  295 +>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC
  296 +>8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC
  297 +>8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted
  298 +>8 string/B M4B \b, MPEG v4 system, iTunes bookmarked
  299 +>8 string/B qt \b, Apple QuickTime movie
  300 +
  301 +# MPEG sequences
  302 +# Scans for all common MPEG header start codes
  303 +0 belong 0x00000001 JVT NAL sequence
  304 +>4 byte&0x1F 0x07 \b, H.264 video
  305 +>>5 byte 66 \b, baseline
  306 +>>5 byte 77 \b, main
  307 +>>5 byte 88 \b, extended
  308 +>>7 byte x \b @ L %u
  309 +0 belong&0xFFFFFF00 0x00000100 MPEG sequence
  310 +>3 byte 0xBA
  311 +>>4 byte &0x40 \b, v2, program multiplex
  312 +>>4 byte ^0x40 \b, v1, system multiplex
  313 +>3 byte 0xBB \b, v1/2, multiplex (missing pack header)
  314 +>3 byte&0x1F 0x07 \b, H.264 video
  315 +>>4 byte 66 \b, baseline
  316 +>>4 byte 77 \b, main
  317 +>>4 byte 88 \b, extended
  318 +>>6 byte x \b @ L %u
  319 +>3 byte 0xB0 \b, v4
  320 +>>5 belong 0x000001B5
  321 +>>>9 byte &0x80
  322 +>>>>10 byte&0xF0 16 \b, video
  323 +>>>>10 byte&0xF0 32 \b, still texture
  324 +>>>>10 byte&0xF0 48 \b, mesh
  325 +>>>>10 byte&0xF0 64 \b, face
  326 +>>>9 byte&0xF8 8 \b, video
  327 +>>>9 byte&0xF8 16 \b, still texture
  328 +>>>9 byte&0xF8 24 \b, mesh
  329 +>>>9 byte&0xF8 32 \b, face
  330 +>>4 byte 1 \b, simple @ L1
  331 +>>4 byte 2 \b, simple @ L2
  332 +>>4 byte 3 \b, simple @ L3
  333 +>>4 byte 4 \b, simple @ L0
  334 +>>4 byte 17 \b, simple scalable @ L1
  335 +>>4 byte 18 \b, simple scalable @ L2
  336 +>>4 byte 33 \b, core @ L1
  337 +>>4 byte 34 \b, core @ L2
  338 +>>4 byte 50 \b, main @ L2
  339 +>>4 byte 51 \b, main @ L3
  340 +>>4 byte 53 \b, main @ L4
  341 +>>4 byte 66 \b, n-bit @ L2
  342 +>>4 byte 81 \b, scalable texture @ L1
  343 +>>4 byte 97 \b, simple face animation @ L1
  344 +>>4 byte 98 \b, simple face animation @ L2
  345 +>>4 byte 99 \b, simple face basic animation @ L1
  346 +>>4 byte 100 \b, simple face basic animation @ L2
  347 +>>4 byte 113 \b, basic animation text @ L1
  348 +>>4 byte 114 \b, basic animation text @ L2
  349 +>>4 byte 129 \b, hybrid @ L1
  350 +>>4 byte 130 \b, hybrid @ L2
  351 +>>4 byte 145 \b, advanced RT simple @ L!
  352 +>>4 byte 146 \b, advanced RT simple @ L2
  353 +>>4 byte 147 \b, advanced RT simple @ L3
  354 +>>4 byte 148 \b, advanced RT simple @ L4
  355 +>>4 byte 161 \b, core scalable @ L1
  356 +>>4 byte 162 \b, core scalable @ L2
  357 +>>4 byte 163 \b, core scalable @ L3
  358 +>>4 byte 177 \b, advanced coding efficiency @ L1
  359 +>>4 byte 178 \b, advanced coding efficiency @ L2
  360 +>>4 byte 179 \b, advanced coding efficiency @ L3
  361 +>>4 byte 180 \b, advanced coding efficiency @ L4
  362 +>>4 byte 193 \b, advanced core @ L1
  363 +>>4 byte 194 \b, advanced core @ L2
  364 +>>4 byte 209 \b, advanced scalable texture @ L1
  365 +>>4 byte 210 \b, advanced scalable texture @ L2
  366 +>>4 byte 211 \b, advanced scalable texture @ L3
  367 +>>4 byte 225 \b, simple studio @ L1
  368 +>>4 byte 226 \b, simple studio @ L2
  369 +>>4 byte 227 \b, simple studio @ L3
  370 +>>4 byte 228 \b, simple studio @ L4
  371 +>>4 byte 229 \b, core studio @ L1
  372 +>>4 byte 230 \b, core studio @ L2
  373 +>>4 byte 231 \b, core studio @ L3
  374 +>>4 byte 232 \b, core studio @ L4
  375 +>>4 byte 240 \b, advanced simple @ L0
  376 +>>4 byte 241 \b, advanced simple @ L1
  377 +>>4 byte 242 \b, advanced simple @ L2
  378 +>>4 byte 243 \b, advanced simple @ L3
  379 +>>4 byte 244 \b, advanced simple @ L4
  380 +>>4 byte 245 \b, advanced simple @ L5
  381 +>>4 byte 247 \b, advanced simple @ L3b
  382 +>>4 byte 248 \b, FGS @ L0
  383 +>>4 byte 249 \b, FGS @ L1
  384 +>>4 byte 250 \b, FGS @ L2
  385 +>>4 byte 251 \b, FGS @ L3
  386 +>>4 byte 252 \b, FGS @ L4
  387 +>>4 byte 253 \b, FGS @ L5
  388 +>3 byte 0xB5 \b, v4
  389 +>>4 byte &0x80
  390 +>>>5 byte&0xF0 16 \b, video (missing profile header)
  391 +>>>5 byte&0xF0 32 \b, still texture (missing profile header)
  392 +>>>5 byte&0xF0 48 \b, mesh (missing profile header)
  393 +>>>5 byte&0xF0 64 \b, face (missing profile header)
  394 +>>4 byte&0xF8 8 \b, video (missing profile header)
  395 +>>4 byte&0xF8 16 \b, still texture (missing profile header)
  396 +>>4 byte&0xF8 24 \b, mesh (missing profile header)
  397 +>>4 byte&0xF8 32 \b, face (missing profile header)
  398 +>3 byte 0xB3
  399 +>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
  400 +>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
  401 +>>12 belong 0x000001B5 \b, v2,
  402 +>>>16 byte&0x0F 1 \b HP
  403 +>>>16 byte&0x0F 2 \b Spt
  404 +>>>16 byte&0x0F 3 \b SNR
  405 +>>>16 byte&0x0F 4 \b MP
  406 +>>>16 byte&0x0F 5 \b SP
  407 +>>>17 byte&0xF0 64 \b@HL
  408 +>>>17 byte&0xF0 96 \b@H-14
  409 +>>>17 byte&0xF0 128 \b@ML
  410 +>>>17 byte&0xF0 160 \b@LL
  411 +>>>17 byte &0x08 \b progressive
  412 +>>>17 byte ^0x08 \b interlaced
  413 +>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video
  414 +>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video
  415 +>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video
  416 +>>11 byte &0x02
  417 +>>>75 byte &0x01
  418 +>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
  419 +>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
  420 +>>>>140 belong 0x000001B5 \b, v2,
  421 +>>>>>144 byte&0x0F 1 \b HP
  422 +>>>>>144 byte&0x0F 2 \b Spt
  423 +>>>>>144 byte&0x0F 3 \b SNR
  424 +>>>>>144 byte&0x0F 4 \b MP
  425 +>>>>>144 byte&0x0F 5 \b SP
  426 +>>>>>145 byte&0xF0 64 \b@HL
  427 +>>>>>145 byte&0xF0 96 \b@H-14
  428 +>>>>>145 byte&0xF0 128 \b@ML
  429 +>>>>>145 byte&0xF0 160 \b@LL
  430 +>>>>>145 byte &0x08 \b progressive
  431 +>>>>>145 byte ^0x08 \b interlaced
  432 +>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video
  433 +>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video
  434 +>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video
  435 +>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
  436 +>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
  437 +>>76 belong 0x000001B5 \b, v2,
  438 +>>>80 byte&0x0F 1 \b HP
  439 +>>>80 byte&0x0F 2 \b Spt
  440 +>>>80 byte&0x0F 3 \b SNR
  441 +>>>80 byte&0x0F 4 \b MP
  442 +>>>80 byte&0x0F 5 \b SP
  443 +>>>81 byte&0xF0 64 \b@HL
  444 +>>>81 byte&0xF0 96 \b@H-14
  445 +>>>81 byte&0xF0 128 \b@ML
  446 +>>>81 byte&0xF0 160 \b@LL
  447 +>>>81 byte &0x08 \b progressive
  448 +>>>81 byte ^0x08 \b interlaced
  449 +>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video
  450 +>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video
  451 +>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video
  452 +>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P
  453 +>>>7 byte&0xF0 0x10 \b, 16:9
  454 +>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I
  455 +>>>7 byte&0xF0 0x10 \b, 16:9
  456 +>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture
  457 +>>>7 byte&0xF0 0x10 \b, 4:3
  458 +>>4 beshort&0xFFF0 0x2C00 \b, 4CIF
  459 +>>>5 beshort&0x0FFF 0x01E0 \b NTSC
  460 +>>>5 beshort&0x0FFF 0x0240 \b PAL
  461 +>>>7 byte&0xF0 0x20 \b, 4:3
  462 +>>>7 byte&0xF0 0x30 \b, 16:9
  463 +>>>7 byte&0xF0 0x40 \b, 11:5
  464 +>>>7 byte&0xF0 0x80 \b, PAL 4:3
  465 +>>>7 byte&0xF0 0xC0 \b, NTSC 4:3
  466 +>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P
  467 +>>>7 byte&0xF0 0x10 \b, 4:3
  468 +>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240
  469 +>>>7 byte&0xF0 0x10 \b, 4:3
  470 +>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160
  471 +>>>7 byte&0xF0 0x10 \b, 4:3
  472 +>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120
  473 +>>>7 byte&0xF0 0x10 \b, 4:3
  474 +>>4 beshort&0xFFF0 0x1600 \b, CIF
  475 +>>>5 beshort&0x0FFF 0x00F0 \b NTSC
  476 +>>>5 beshort&0x0FFF 0x0120 \b PAL
  477 +>>>7 byte&0xF0 0x20 \b, 4:3
  478 +>>>7 byte&0xF0 0x30 \b, 16:9
  479 +>>>7 byte&0xF0 0x40 \b, 11:5
  480 +>>>7 byte&0xF0 0x80 \b, PAL 4:3
  481 +>>>7 byte&0xF0 0xC0 \b, NTSC 4:3
  482 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625
  483 +>>>>7 byte&0xF0 0x20 \b, 4:3
  484 +>>>>7 byte&0xF0 0x30 \b, 16:9
  485 +>>>>7 byte&0xF0 0x40 \b, 11:5
  486 +>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU
  487 +>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
  488 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625
  489 +>>>7 byte&0xF0 0x20 \b, 4:3
  490 +>>>7 byte&0xF0 0x30 \b, 16:9
  491 +>>>7 byte&0xF0 0x40 \b, 11:5
  492 +>>4 beshort&0xFFF0 0x1E00 \b, SVCD
  493 +>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
  494 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625
  495 +>>>7 byte&0xF0 0x20 \b, 4:3
  496 +>>>7 byte&0xF0 0x30 \b, 16:9
  497 +>>>7 byte&0xF0 0x40 \b, 11:5
  498 +>>7 byte&0x0F 1 \b, 23.976 fps
  499 +>>7 byte&0x0F 2 \b, 24 fps
  500 +>>7 byte&0x0F 3 \b, 25 fps
  501 +>>7 byte&0x0F 4 \b, 29.97 fps
  502 +>>7 byte&0x0F 5 \b, 30 fps
  503 +>>7 byte&0x0F 6 \b, 50 fps
  504 +>>7 byte&0x0F 7 \b, 59.94 fps
  505 +>>7 byte&0x0F 8 \b, 60 fps
  506 +>>11 byte &0x04 \b, Constrained
  507 +
  508 +# MPEG ADTS Audio (*.mpx/mxa/aac)
  509 +# from dreesen@math.fu-berlin.de
  510 +# modified to fully support MPEG ADTS
  511 +
  512 +# MP3, M1A
  513 +0 beshort&0xFFFE 0xFFFA MPEG ADTS, layer III, v1
  514 +# rates
  515 +>2 byte&0xF0 0x10 \b, 32 kBits
  516 +>2 byte&0xF0 0x20 \b, 40 kBits
  517 +>2 byte&0xF0 0x30 \b, 48 kBits
  518 +>2 byte&0xF0 0x40 \b, 56 kBits
  519 +>2 byte&0xF0 0x50 \b, 64 kBits
  520 +>2 byte&0xF0 0x60 \b, 80 kBits
  521 +>2 byte&0xF0 0x70 \b, 96 kBits
  522 +>2 byte&0xF0 0x80 \b, 112 kBits
  523 +>2 byte&0xF0 0x90 \b, 128 kBits
  524 +>2 byte&0xF0 0xA0 \b, 160 kBits
  525 +>2 byte&0xF0 0xB0 \b, 192 kBits
  526 +>2 byte&0xF0 0xC0 \b, 224 kBits
  527 +>2 byte&0xF0 0xD0 \b, 256 kBits
  528 +>2 byte&0xF0 0xE0 \b, 320 kBits
  529 +# timing
  530 +>2 byte&0x0C 0x00 \b, 44.1 kHz
  531 +>2 byte&0x0C 0x04 \b, 48 kHz
  532 +>2 byte&0x0C 0x08 \b, 32 kHz
  533 +# channels/options
  534 +>3 byte&0xC0 0x00 \b, Stereo
  535 +>3 byte&0xC0 0x40 \b, JntStereo
  536 +>3 byte&0xC0 0x80 \b, 2x Monaural
  537 +>3 byte&0xC0 0xC0 \b, Monaural
  538 +#>1 byte ^0x01 \b, Data Verify
  539 +#>2 byte &0x02 \b, Packet Pad
  540 +#>2 byte &0x01 \b, Custom Flag
  541 +#>3 byte &0x08 \b, Copyrighted
  542 +#>3 byte &0x04 \b, Original Source
  543 +#>3 byte&0x03 1 \b, NR: 50/15 ms
  544 +#>3 byte&0x03 3 \b, NR: CCIT J.17
  545 +
  546 +# MP2, M1A
  547 +0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
  548 +# rates
  549 +>2 byte&0xF0 0x10 \b, 32 kBits
  550 +>2 byte&0xF0 0x20 \b, 48 kBits
  551 +>2 byte&0xF0 0x30 \b, 56 kBits
  552 +>2 byte&0xF0 0x40 \b, 64 kBits
  553 +>2 byte&0xF0 0x50 \b, 80 kBits
  554 +>2 byte&0xF0 0x60 \b, 96 kBits
  555 +>2 byte&0xF0 0x70 \b, 112 kBits
  556 +>2 byte&0xF0 0x80 \b, 128 kBits
  557 +>2 byte&0xF0 0x90 \b, 160 kBits
  558 +>2 byte&0xF0 0xA0 \b, 192 kBits
  559 +>2 byte&0xF0 0xB0 \b, 224 kBits
  560 +>2 byte&0xF0 0xC0 \b, 256 kBits
  561 +>2 byte&0xF0 0xD0 \b, 320 kBits
  562 +>2 byte&0xF0 0xE0 \b, 384 kBits
  563 +# timing
  564 +>2 byte&0x0C 0x00 \b, 44.1 kHz
  565 +>2 byte&0x0C 0x04 \b, 48 kHz
  566 +>2 byte&0x0C 0x08 \b, 32 kHz
  567 +# channels/options
  568 +>3 byte&0xC0 0x00 \b, Stereo
  569 +>3 byte&0xC0 0x40 \b, JntStereo
  570 +>3 byte&0xC0 0x80 \b, 2x Monaural
  571 +>3 byte&0xC0 0xC0 \b, Monaural
  572 +#>1 byte ^0x01 \b, Data Verify
  573 +#>2 byte &0x02 \b, Packet Pad
  574 +#>2 byte &0x01 \b, Custom Flag
  575 +#>3 byte &0x08 \b, Copyrighted
  576 +#>3 byte &0x04 \b, Original Source
  577 +#>3 byte&0x03 1 \b, NR: 50/15 ms
  578 +#>3 byte&0x03 3 \b, NR: CCIT J.17
  579 +
  580 +# MPA, M1A
  581 +# updated by Joerg Jenderek
  582 +# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
  583 +0 beshort&0xFFFE 0xFFFE
  584 +>2 ubyte&0xF0 >0x0F
  585 +>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1
  586 +# rate
  587 +>>>2 byte&0xF0 0x10 \b, 32 kBits
  588 +>>>2 byte&0xF0 0x20 \b, 64 kBits
  589 +>>>2 byte&0xF0 0x30 \b, 96 kBits
  590 +>>>2 byte&0xF0 0x40 \b, 128 kBits
  591 +>>>2 byte&0xF0 0x50 \b, 160 kBits
  592 +>>>2 byte&0xF0 0x60 \b, 192 kBits
  593 +>>>2 byte&0xF0 0x70 \b, 224 kBits
  594 +>>>2 byte&0xF0 0x80 \b, 256 kBits
  595 +>>>2 byte&0xF0 0x90 \b, 288 kBits
  596 +>>>2 byte&0xF0 0xA0 \b, 320 kBits
  597 +>>>2 byte&0xF0 0xB0 \b, 352 kBits
  598 +>>>2 byte&0xF0 0xC0 \b, 384 kBits
  599 +>>>2 byte&0xF0 0xD0 \b, 416 kBits
  600 +>>>2 byte&0xF0 0xE0 \b, 448 kBits
  601 +# timing
  602 +>>>2 byte&0x0C 0x00 \b, 44.1 kHz
  603 +>>>2 byte&0x0C 0x04 \b, 48 kHz
  604 +>>>2 byte&0x0C 0x08 \b, 32 kHz
  605 +# channels/options
  606 +>>>3 byte&0xC0 0x00 \b, Stereo
  607 +>>>3 byte&0xC0 0x40 \b, JntStereo
  608 +>>>3 byte&0xC0 0x80 \b, 2x Monaural
  609 +>>>3 byte&0xC0 0xC0 \b, Monaural
  610 +#>1 byte ^0x01 \b, Data Verify
  611 +#>2 byte &0x02 \b, Packet Pad
  612 +#>2 byte &0x01 \b, Custom Flag
  613 +#>3 byte &0x08 \b, Copyrighted
  614 +#>3 byte &0x04 \b, Original Source
  615 +#>3 byte&0x03 1 \b, NR: 50/15 ms
  616 +#>3 byte&0x03 3 \b, NR: CCIT J.17
  617 +
  618 +# MP3, M2A
  619 +0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2
  620 +# rate
  621 +>2 byte&0xF0 0x10 \b, 8 kBits
  622 +>2 byte&0xF0 0x20 \b, 16 kBits
  623 +>2 byte&0xF0 0x30 \b, 24 kBits
  624 +>2 byte&0xF0 0x40 \b, 32 kBits
  625 +>2 byte&0xF0 0x50 \b, 40 kBits
  626 +>2 byte&0xF0 0x60 \b, 48 kBits
  627 +>2 byte&0xF0 0x70 \b, 56 kBits
  628 +>2 byte&0xF0 0x80 \b, 64 kBits
  629 +>2 byte&0xF0 0x90 \b, 80 kBits
  630 +>2 byte&0xF0 0xA0 \b, 96 kBits
  631 +>2 byte&0xF0 0xB0 \b, 112 kBits
  632 +>2 byte&0xF0 0xC0 \b, 128 kBits
  633 +>2 byte&0xF0 0xD0 \b, 144 kBits
  634 +>2 byte&0xF0 0xE0 \b, 160 kBits
  635 +# timing
  636 +>2 byte&0x0C 0x00 \b, 22.05 kHz
  637 +>2 byte&0x0C 0x04 \b, 24 kHz
  638 +>2 byte&0x0C 0x08 \b, 16 kHz
  639 +# channels/options
  640 +>3 byte&0xC0 0x00 \b, Stereo
  641 +>3 byte&0xC0 0x40 \b, JntStereo
  642 +>3 byte&0xC0 0x80 \b, 2x Monaural
  643 +>3 byte&0xC0 0xC0 \b, Monaural
  644 +#>1 byte ^0x01 \b, Data Verify
  645 +#>2 byte &0x02 \b, Packet Pad
  646 +#>2 byte &0x01 \b, Custom Flag
  647 +#>3 byte &0x08 \b, Copyrighted
  648 +#>3 byte &0x04 \b, Original Source
  649 +#>3 byte&0x03 1 \b, NR: 50/15 ms
  650 +#>3 byte&0x03 3 \b, NR: CCIT J.17
  651 +
  652 +# MP2, M2A
  653 +0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
  654 +# rate
  655 +>2 byte&0xF0 0x10 \b, 8 kBits
  656 +>2 byte&0xF0 0x20 \b, 16 kBits
  657 +>2 byte&0xF0 0x30 \b, 24 kBits
  658 +>2 byte&0xF0 0x40 \b, 32 kBits
  659 +>2 byte&0xF0 0x50 \b, 40 kBits
  660 +>2 byte&0xF0 0x60 \b, 48 kBits
  661 +>2 byte&0xF0 0x70 \b, 56 kBits
  662 +>2 byte&0xF0 0x80 \b, 64 kBits
  663 +>2 byte&0xF0 0x90 \b, 80 kBits
  664 +>2 byte&0xF0 0xA0 \b, 96 kBits
  665 +>2 byte&0xF0 0xB0 \b, 112 kBits
  666 +>2 byte&0xF0 0xC0 \b, 128 kBits
  667 +>2 byte&0xF0 0xD0 \b, 144 kBits
  668 +>2 byte&0xF0 0xE0 \b, 160 kBits
  669 +# timing
  670 +>2 byte&0x0C 0x00 \b, 22.05 kHz
  671 +>2 byte&0x0C 0x04 \b, 24 kHz
  672 +>2 byte&0x0C 0x08 \b, 16 kHz
  673 +# channels/options
  674 +>3 byte&0xC0 0x00 \b, Stereo
  675 +>3 byte&0xC0 0x40 \b, JntStereo
  676 +>3 byte&0xC0 0x80 \b, 2x Monaural
  677 +>3 byte&0xC0 0xC0 \b, Monaural
  678 +#>1 byte ^0x01 \b, Data Verify
  679 +#>2 byte &0x02 \b, Packet Pad
  680 +#>2 byte &0x01 \b, Custom Flag
  681 +#>3 byte &0x08 \b, Copyrighted
  682 +#>3 byte &0x04 \b, Original Source
  683 +#>3 byte&0x03 1 \b, NR: 50/15 ms
  684 +#>3 byte&0x03 3 \b, NR: CCIT J.17
  685 +
  686 +# MPA, M2A
  687 +0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2
  688 +# rate
  689 +>2 byte&0xF0 0x10 \b, 32 kBits
  690 +>2 byte&0xF0 0x20 \b, 48 kBits
  691 +>2 byte&0xF0 0x30 \b, 56 kBits
  692 +>2 byte&0xF0 0x40 \b, 64 kBits
  693 +>2 byte&0xF0 0x50 \b, 80 kBits
  694 +>2 byte&0xF0 0x60 \b, 96 kBits
  695 +>2 byte&0xF0 0x70 \b, 112 kBits
  696 +>2 byte&0xF0 0x80 \b, 128 kBits
  697 +>2 byte&0xF0 0x90 \b, 144 kBits
  698 +>2 byte&0xF0 0xA0 \b, 160 kBits
  699 +>2 byte&0xF0 0xB0 \b, 176 kBits
  700 +>2 byte&0xF0 0xC0 \b, 192 kBits
  701 +>2 byte&0xF0 0xD0 \b, 224 kBits
  702 +>2 byte&0xF0 0xE0 \b, 256 kBits
  703 +# timing
  704 +>2 byte&0x0C 0x00 \b, 22.05 kHz
  705 +>2 byte&0x0C 0x04 \b, 24 kHz
  706 +>2 byte&0x0C 0x08 \b, 16 kHz
  707 +# channels/options
  708 +>3 byte&0xC0 0x00 \b, Stereo
  709 +>3 byte&0xC0 0x40 \b, JntStereo
  710 +>3 byte&0xC0 0x80 \b, 2x Monaural
  711 +>3 byte&0xC0 0xC0 \b, Monaural
  712 +#>1 byte ^0x01 \b, Data Verify
  713 +#>2 byte &0x02 \b, Packet Pad
  714 +#>2 byte &0x01 \b, Custom Flag
  715 +#>3 byte &0x08 \b, Copyrighted
  716 +#>3 byte &0x04 \b, Original Source
  717 +#>3 byte&0x03 1 \b, NR: 50/15 ms
  718 +#>3 byte&0x03 3 \b, NR: CCIT J.17
  719 +
  720 +# MP3, M25A
  721 +0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
  722 +# rate
  723 +>2 byte&0xF0 0x10 \b, 8 kBits
  724 +>2 byte&0xF0 0x20 \b, 16 kBits
  725 +>2 byte&0xF0 0x30 \b, 24 kBits
  726 +>2 byte&0xF0 0x40 \b, 32 kBits
  727 +>2 byte&0xF0 0x50 \b, 40 kBits
  728 +>2 byte&0xF0 0x60 \b, 48 kBits
  729 +>2 byte&0xF0 0x70 \b, 56 kBits
  730 +>2 byte&0xF0 0x80 \b, 64 kBits
  731 +>2 byte&0xF0 0x90 \b, 80 kBits
  732 +>2 byte&0xF0 0xA0 \b, 96 kBits
  733 +>2 byte&0xF0 0xB0 \b, 112 kBits
  734 +>2 byte&0xF0 0xC0 \b, 128 kBits
  735 +>2 byte&0xF0 0xD0 \b, 144 kBits
  736 +>2 byte&0xF0 0xE0 \b, 160 kBits
  737 +# timing
  738 +>2 byte&0x0C 0x00 \b, 11.025 kHz
  739 +>2 byte&0x0C 0x04 \b, 12 kHz
  740 +>2 byte&0x0C 0x08 \b, 8 kHz
  741 +# channels/options
  742 +>3 byte&0xC0 0x00 \b, Stereo
  743 +>3 byte&0xC0 0x40 \b, JntStereo
  744 +>3 byte&0xC0 0x80 \b, 2x Monaural
  745 +>3 byte&0xC0 0xC0 \b, Monaural
  746 +#>1 byte ^0x01 \b, Data Verify
  747 +#>2 byte &0x02 \b, Packet Pad
  748 +#>2 byte &0x01 \b, Custom Flag
  749 +#>3 byte &0x08 \b, Copyrighted
  750 +#>3 byte &0x04 \b, Original Source
  751 +#>3 byte&0x03 1 \b, NR: 50/15 ms
  752 +#>3 byte&0x03 3 \b, NR: CCIT J.17
  753 +
  754 +# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
  755 +
  756 +# Stored AAC streams (instead of the MP4 format)
  757 +0 string ADIF MPEG ADIF, AAC
  758 +>4 byte &0x80
  759 +>>13 byte &0x10 \b, VBR
  760 +>>13 byte ^0x10 \b, CBR
  761 +>>16 byte&0x1E 0x02 \b, single stream
  762 +>>16 byte&0x1E 0x04 \b, 2 streams
  763 +>>16 byte&0x1E 0x06 \b, 3 streams
  764 +>>16 byte &0x08 \b, 4 or more streams
  765 +>>16 byte &0x10 \b, 8 or more streams
  766 +>>4 byte &0x80 \b, Copyrighted
  767 +>>13 byte &0x40 \b, Original Source
  768 +>>13 byte &0x20 \b, Home Flag
  769 +>4 byte ^0x80
  770 +>>4 byte &0x10 \b, VBR
  771 +>>4 byte ^0x10 \b, CBR
  772 +>>7 byte&0x1E 0x02 \b, single stream
  773 +>>7 byte&0x1E 0x04 \b, 2 streams
  774 +>>7 byte&0x1E 0x06 \b, 3 streams
  775 +>>7 byte &0x08 \b, 4 or more streams
  776 +>>7 byte &0x10 \b, 8 or more streams
  777 +>>4 byte &0x40 \b, Original Stream(s)
  778 +>>4 byte &0x20 \b, Home Source
  779 +
  780 +# Live or stored single AAC stream (used with MPEG-2 systems)
  781 +0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC
  782 +>1 byte &0x08 \b, v2
  783 +>1 byte ^0x08 \b, v4
  784 +# profile
  785 +>>2 byte &0xC0 \b LTP
  786 +>2 byte&0xc0 0x00 \b Main
  787 +>2 byte&0xc0 0x40 \b LC
  788 +>2 byte&0xc0 0x80 \b SSR
  789 +# timing
  790 +>2 byte&0x3c 0x00 \b, 96 kHz
  791 +>2 byte&0x3c 0x04 \b, 88.2 kHz
  792 +>2 byte&0x3c 0x08 \b, 64 kHz
  793 +>2 byte&0x3c 0x0c \b, 48 kHz
  794 +>2 byte&0x3c 0x10 \b, 44.1 kHz
  795 +>2 byte&0x3c 0x14 \b, 32 kHz
  796 +>2 byte&0x3c 0x18 \b, 24 kHz
  797 +>2 byte&0x3c 0x1c \b, 22.05 kHz
  798 +>2 byte&0x3c 0x20 \b, 16 kHz
  799 +>2 byte&0x3c 0x24 \b, 12 kHz
  800 +>2 byte&0x3c 0x28 \b, 11.025 kHz
  801 +>2 byte&0x3c 0x2c \b, 8 kHz
  802 +# channels
  803 +>2 beshort&0x01c0 0x0040 \b, monaural
  804 +>2 beshort&0x01c0 0x0080 \b, stereo
  805 +>2 beshort&0x01c0 0x00c0 \b, stereo + center
  806 +>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE
  807 +>2 beshort&0x01c0 0x0140 \b, surround
  808 +>2 beshort&0x01c0 0x0180 \b, surround + LFE
  809 +>2 beshort &0x01C0 \b, surround + side
  810 +#>1 byte ^0x01 \b, Data Verify
  811 +#>2 byte &0x02 \b, Custom Flag
  812 +#>3 byte &0x20 \b, Original Stream
  813 +#>3 byte &0x10 \b, Home Source
  814 +#>3 byte &0x08 \b, Copyrighted
  815 +
  816 +# Live MPEG-4 audio streams (instead of RTP FlexMux)
  817 +0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
  818 +#>1 beshort&0x1FFF x \b, %u byte packet
  819 +>3 byte&0xE0 0x40
  820 +>>4 byte&0x3C 0x04 \b, single stream
  821 +>>4 byte&0x3C 0x08 \b, 2 streams
  822 +>>4 byte&0x3C 0x0C \b, 3 streams
  823 +>>4 byte &0x08 \b, 4 or more streams
  824 +>>4 byte &0x20 \b, 8 or more streams
  825 +>3 byte&0xC0 0
  826 +>>4 byte&0x78 0x08 \b, single stream
  827 +>>4 byte&0x78 0x10 \b, 2 streams
  828 +>>4 byte&0x78 0x18 \b, 3 streams
  829 +>>4 byte &0x20 \b, 4 or more streams
  830 +>>4 byte &0x40 \b, 8 or more streams
  831 +0 beshort 0x4DE1 MPEG-4 LO-EP audio stream
  832 +
  833 +# FLI animation format
  834 +4 leshort 0xAF11 FLI file
  835 +>6 leshort x - %d frames,
  836 +>8 leshort x width=%d pixels,
  837 +>10 leshort x height=%d pixels,
  838 +>12 leshort x depth=%d,
  839 +>16 leshort x ticks/frame=%d
  840 +# FLC animation format
  841 +4 leshort 0xAF12 FLC file
  842 +>6 leshort x - %d frames
  843 +>8 leshort x width=%d pixels,
  844 +>10 leshort x height=%d pixels,
  845 +>12 leshort x depth=%d,
  846 +>16 leshort x ticks/frame=%d
  847 +
  848 +# DL animation format
  849 +# XXX - collision with most `mips' magic
  850 +#
  851 +# I couldn't find a real magic number for these, however, this
  852 +# -appears- to work. Note that it might catch other files, too, so be
  853 +# careful!
  854 +#
  855 +# Note that title and author appear in the two 20-byte chunks
  856 +# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
  857 +# 255 (hex FF)! The DL format is really bad.
  858 +#
  859 +#0 byte 1 DL version 1, medium format (160x100, 4 images/screen)
  860 +#>42 byte x - %d screens,
  861 +#>43 byte x %d commands
  862 +#0 byte 2 DL version 2
  863 +#>1 byte 1 - large format (320x200,1 image/screen),
  864 +#>1 byte 2 - medium format (160x100,4 images/screen),
  865 +#>1 byte >2 - unknown format,
  866 +#>42 byte x %d screens,
  867 +#>43 byte x %d commands
  868 +# Based on empirical evidence, DL version 3 have several nulls following the
  869 +# \003. Most of them start with non-null values at hex offset 0x34 or so.
  870 +#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
  871 +
  872 +# iso 13818 transport stream
  873 +#
  874 +# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
  875 +# (the following is a little bit restrictive and works fine for a stream
  876 +# that starts with PAT properly. it won't work for stream data, that is
  877 +# cut from an input device data right in the middle, but this shouldn't
  878 +# disturb)
  879 +# syncbyte 8 bit 0x47
  880 +# error_ind 1 bit -
  881 +# payload_start 1 bit 1
  882 +# priority 1 bit -
  883 +# PID 13 bit 0x0000
  884 +# scrambling 2 bit -
  885 +# adaptfld_ctrl 2 bit 1 or 3
  886 +# conti_count 4 bit 0
  887 +0 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data
  888 +>188 byte !0x47 CORRUPTED
  889 +
  890 +# DIF digital video file format <mpruett@sgi.com>
  891 +0 belong&0xffffff00 0x1f070000 DIF
  892 +>4 byte &0x01 (DVCPRO) movie file
  893 +>4 byte ^0x01 (DV) movie file
  894 +>3 byte &0x80 (PAL)
  895 +>3 byte ^0x80 (NTSC)
  896 +
  897 +# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
  898 +0 belong 0x3026b275 Microsoft ASF
  899 +
  900 +# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
  901 +0 string \x8aMNG MNG video data,
  902 +>4 belong !0x0d0a1a0a CORRUPTED,
  903 +>4 belong 0x0d0a1a0a
  904 +>>16 belong x %ld x
  905 +>>20 belong x %ld
  906 +
  907 +# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
  908 +0 string \x8bJNG JNG video data,
  909 +>4 belong !0x0d0a1a0a CORRUPTED,
  910 +>4 belong 0x0d0a1a0a
  911 +>>16 belong x %ld x
  912 +>>20 belong x %ld
  913 +
  914 +# Vivo video (Wolfram Kleff)
  915 +3 string \x0D\x0AVersion:Vivo Vivo video data
  916 +
  917 +# VRML (Virtual Reality Modelling Language)
  918 +0 string/b #VRML\ V1.0\ ascii VRML 1 file
  919 +0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
  920 +
  921 +#---------------------------------------------------------------------------
  922 +# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
  923 +# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
  924 +#
  925 +0 string HVQM4 %s
  926 +>6 string >\0 v%s
  927 +>0 byte x GameCube movie,
  928 +>0x34 ubeshort x %d x
  929 +>0x36 ubeshort x %d,
  930 +>0x26 ubeshort x %dµs,
  931 +>0x42 ubeshort 0 no audio
  932 +>0x42 ubeshort >0 %dHz audio
  933 +
  934 +# From: "Stefan A. Haubenthal" <polluks@web.de>
  935 +0 string DVDVIDEO-VTS Video title set,
  936 +>0x21 byte x v%x
  937 +0 string DVDVIDEO-VMG Video manager,
  938 +>0x21 byte x v%x
  939 +
  940 +#------------------------------------------------------------------------------
  941 +# apl: file(1) magic for APL (see also "pdp" and "vax" for other APL
  942 +# workspaces)
  943 +#
  944 +0 long 0100554 APL workspace (Ken's original?)
  945 +
  946 +#------------------------------------------------------------------------------
  947 +# apple: file(1) magic for Apple file formats
  948 +#
  949 +0 string FiLeStArTfIlEsTaRt binscii (apple ][) text
  950 +0 string \x0aGL Binary II (apple ][) data
  951 +0 string \x76\xff Squeezed (apple ][) data
  952 +0 string NuFile NuFile archive (apple ][) data
  953 +0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
  954 +0 belong 0x00051600 AppleSingle encoded Macintosh file
  955 +0 belong 0x00051607 AppleDouble encoded Macintosh file
  956 +
  957 +# magic for Newton PDA package formats
  958 +# from Ruda Moura <ruda@helllabs.org>
  959 +0 string package0 Newton package, NOS 1.x,
  960 +>12 belong &0x80000000 AutoRemove,
  961 +>12 belong &0x40000000 CopyProtect,
  962 +>12 belong &0x10000000 NoCompression,
  963 +>12 belong &0x04000000 Relocation,
  964 +>12 belong &0x02000000 UseFasterCompression,
  965 +>16 belong x version %d
  966 +
  967 +0 string package1 Newton package, NOS 2.x,
  968 +>12 belong &0x80000000 AutoRemove,
  969 +>12 belong &0x40000000 CopyProtect,
  970 +>12 belong &0x10000000 NoCompression,
  971 +>12 belong &0x04000000 Relocation,
  972 +>12 belong &0x02000000 UseFasterCompression,
  973 +>16 belong x version %d
  974 +
  975 +0 string package4 Newton package,
  976 +>8 byte 8 NOS 1.x,
  977 +>8 byte 9 NOS 2.x,
  978 +>12 belong &0x80000000 AutoRemove,
  979 +>12 belong &0x40000000 CopyProtect,
  980 +>12 belong &0x10000000 NoCompression,
  981 +
  982 +# The following entries for the Apple II are for files that have
  983 +# been transferred as raw binary data from an Apple, without having
  984 +# been encapsulated by any of the above archivers.
  985 +#
  986 +# In general, Apple II formats are hard to identify because Apple DOS
  987 +# and especially Apple ProDOS have strong typing in the file system and
  988 +# therefore programmers never felt much need to include type information
  989 +# in the files themselves.
  990 +#
  991 +# Eric Fischer <enf@pobox.com>
  992 +
  993 +# AppleWorks word processor:
  994 +#
  995 +# This matches the standard tab stops for an AppleWorks file, but if
  996 +# a file has a tab stop set in the first four columns this will fail.
  997 +#
  998 +# The "O" is really the magic number, but that's so common that it's
  999 +# necessary to check the tab stops that follow it to avoid false positives.
  1000 +
  1001 +4 string O==== AppleWorks word processor data
  1002 +>85 byte&0x01 >0 \b, zoomed
  1003 +>90 byte&0x01 >0 \b, paginated
  1004 +>92 byte&0x01 >0 \b, with mail merge
  1005 +#>91 byte x \b, left margin %d
  1006 +
  1007 +# AppleWorks database:
  1008 +#
  1009 +# This isn't really a magic number, but it's the closest thing to one
  1010 +# that I could find. The 1 and 2 really mean "order in which you defined
  1011 +# categories" and "left to right, top to bottom," respectively; the D and R
  1012 +# mean that the cursor should move either down or right when you press Return.
  1013 +
  1014 +#30 string \x01D AppleWorks database data
  1015 +#30 string \x02D AppleWorks database data
  1016 +#30 string \x01R AppleWorks database data
  1017 +#30 string \x02R AppleWorks database data
  1018 +
  1019 +# AppleWorks spreadsheet:
  1020 +#
  1021 +# Likewise, this isn't really meant as a magic number. The R or C means
  1022 +# row- or column-order recalculation; the A or M means automatic or manual
  1023 +# recalculation.
  1024 +
  1025 +#131 string RA AppleWorks spreadsheet data
  1026 +#131 string RM AppleWorks spreadsheet data
  1027 +#131 string CA AppleWorks spreadsheet data
  1028 +#131 string CM AppleWorks spreadsheet data
  1029 +
  1030 +# Applesoft BASIC:
  1031 +#
  1032 +# This is incredibly sloppy, but will be true if the program was
  1033 +# written at its usual memory location of 2048 and its first line
  1034 +# number is less than 256. Yuck.
  1035 +
  1036 +0 belong&0xff00ff 0x80000 Applesoft BASIC program data
  1037 +#>2 leshort x \b, first line number %d
  1038 +
  1039 +# ORCA/EZ assembler:
  1040 +#
  1041 +# This will not identify ORCA/M source files, since those have
  1042 +# some sort of date code instead of the two zero bytes at 6 and 7
  1043 +# XXX Conflicts with ELF
  1044 +#4 belong&0xff00ffff 0x01000000 ORCA/EZ assembler source data
  1045 +#>5 byte x \b, build number %d
  1046 +
  1047 +# Broderbund Fantavision
  1048 +#
  1049 +# I don't know what these values really mean, but they seem to recur.
  1050 +# Will they cause too many conflicts?
  1051 +
  1052 +# Probably :-)
  1053 +#2 belong&0xFF00FF 0x040008 Fantavision movie data
  1054 +
  1055 +# Some attempts at images.
  1056 +#
  1057 +# These are actually just bit-for-bit dumps of the frame buffer, so
  1058 +# there's really no reasonably way to distinguish them except for their
  1059 +# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
  1060 +# or, occasionally, 8184.
  1061 +#
  1062 +# Nevertheless this will manage to catch a lot of images that happen
  1063 +# to have a solid-colored line at the bottom of the screen.
  1064 +
  1065 +8144 string \x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F Apple II image with white background
  1066 +8144 string \x55\x2A\x55\x2A\x55\x2A\x55\x2A Apple II image with purple background
  1067 +8144 string \x2A\x55\x2A\x55\x2A\x55\x2A\x55 Apple II image with green background
  1068 +8144 string \xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA Apple II image with blue background
  1069 +8144 string \xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5 Apple II image with orange background
  1070 +
  1071 +# Beagle Bros. Apple Mechanic fonts
  1072 +
  1073 +0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font
  1074 +
  1075 +# Apple Universal Disk Image Format (UDIF) - dmg files.
  1076 +# From Johan Gade.
  1077 +# These entries are disabled for now until we fix the following issues.
  1078 +#
  1079 +# Note there might be some problems with the "VAX COFF executable"
  1080 +# entry. Note this entry should be placed before the mac filesystem section,
  1081 +# particularly the "Apple Partition data" entry.
  1082 +#
  1083 +# The intended meaning of these tests is, that the file is only of the
  1084 +# specified type if both of the lines are correct - i.e. if the first
  1085 +# line matches and the second doesn't then it is not of that type.
  1086 +#
  1087 +#0 long 0x7801730d
  1088 +#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO)
  1089 +#
  1090 +# Note that this entry is recognized correctly by the "Apple Partition
  1091 +# data" entry - however since this entry is more specific - this
  1092 +# information seems to be more useful.
  1093 +#0 long 0x45520200
  1094 +#>0x410 string disk\ image UDIF read/write image (UDRW)
  1095 +
  1096 +# From: Toby Peterson <toby@apple.com>
  1097 +0 string bplist00 Apple binary property list
  1098 +
  1099 +# Apple binary property list (bplist)
  1100 +# Assumes version bytes are hex.
  1101 +# Provides content hints for version 0 files. Assumes that the root
  1102 +# object is the first object (true for CoreFoundation implementation).
  1103 +# From: David Remahl <dremahl@apple.com>
  1104 +0 string bplist
  1105 +>6 byte x \bCoreFoundation binary property list data, version 0x%c
  1106 +>>7 byte x \b%c
  1107 +>6 string 00 \b
  1108 +>>8 byte&0xF0 0x00 \b
  1109 +>>>8 byte&0x0F 0x00 \b, root type: null
  1110 +>>>8 byte&0x0F 0x08 \b, root type: false boolean
  1111 +>>>8 byte&0x0F 0x09 \b, root type: true boolean
  1112 +>>8 byte&0xF0 0x10 \b, root type: integer
  1113 +>>8 byte&0xF0 0x20 \b, root type: real
  1114 +>>8 byte&0xF0 0x30 \b, root type: date
  1115 +>>8 byte&0xF0 0x40 \b, root type: data
  1116 +>>8 byte&0xF0 0x50 \b, root type: ascii string
  1117 +>>8 byte&0xF0 0x60 \b, root type: unicode string
  1118 +>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT)
  1119 +>>8 byte&0xF0 0xa0 \b, root type: array
  1120 +>>8 byte&0xF0 0xd0 \b, root type: dictionary
  1121 +
  1122 +# Apple/NeXT typedstream data
  1123 +# Serialization format used by NeXT and Apple for various
  1124 +# purposes in YellowStep/Cocoa, including some nib files.
  1125 +# From: David Remahl <dremahl@apple.com>
  1126 +2 string typedstream NeXT/Apple typedstream data, big endian
  1127 +>0 byte x \b, version %hhd
  1128 +>0 byte <5 \b
  1129 +>>13 byte 0x81 \b
  1130 +>>>14 ubeshort x \b, system %hd
  1131 +2 string streamtyped NeXT/Apple typedstream data, little endian
  1132 +>0 byte x \b, version %hhd
  1133 +>0 byte <5 \b
  1134 +>>13 byte 0x81 \b
  1135 +>>>14 uleshort x \b, system %hd
  1136 +
  1137 +#------------------------------------------------------------------------------
  1138 +# applix: file(1) magic for Applixware
  1139 +# From: Peter Soos <sp@osb.hu>
  1140 +#
  1141 +0 string *BEGIN Applixware
  1142 +>7 string WORDS Words Document
  1143 +>7 string GRAPHICS Graphic
  1144 +>7 string RASTER Bitmap
  1145 +>7 string SPREADSHEETS Spreadsheet
  1146 +>7 string MACRO Macro
  1147 +>7 string BUILDER Builder Object
  1148 +
  1149 +#------------------------------------------------------------------------------
  1150 +# archive: file(1) magic for archive formats (see also "msdos" for self-
  1151 +# extracting compressed archives)
  1152 +#
  1153 +# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
  1154 +# pre-POSIX "tar" archives are handled in the C code.
  1155 +
  1156 +# POSIX tar archives
  1157 +257 string ustar\0 POSIX tar archive
  1158 +257 string ustar\040\040\0 GNU tar archive
  1159 +
  1160 +# cpio archives
  1161 +#
  1162 +# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
  1163 +# The idea is to indicate archives produced on machines with the same
  1164 +# byte order as the machine running "file" with "cpio archive", and
  1165 +# to indicate archives produced on machines with the opposite byte order
  1166 +# from the machine running "file" with "byte-swapped cpio archive".
  1167 +#
  1168 +# The SVR4 "cpio(4)" hints that there are additional formats, but they
  1169 +# are defined as "short"s; I think all the new formats are
  1170 +# character-header formats and thus are strings, not numbers.
  1171 +0 short 070707 cpio archive
  1172 +0 short 0143561 byte-swapped cpio archive
  1173 +0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
  1174 +0 string 070701 ASCII cpio archive (SVR4 with no CRC)
  1175 +0 string 070702 ASCII cpio archive (SVR4 with CRC)
  1176 +
  1177 +# Debian package (needs to go before regular portable archives)
  1178 +#
  1179 +0 string =!<arch>\ndebian
  1180 +>8 string debian-split part of multipart Debian package
  1181 +>8 string debian-binary Debian binary package
  1182 +>68 string >\0 (format %s)
  1183 +# These next two lines do not work, because a bzip2 Debian archive
  1184 +# still uses gzip for the control.tar (first in the archive). Only
  1185 +# data.tar varies, and the location of its filename varies too.
  1186 +# file/libmagic does not current have support for ascii-string based
  1187 +# (offsets) as of 2005-09-15.
  1188 +#>81 string bz2 \b, uses bzip2 compression
  1189 +#>84 string gz \b, uses gzip compression
  1190 +#>136 ledate x created: %s
  1191 +
  1192 +# other archives
  1193 +0 long 0177555 very old archive
  1194 +0 short 0177555 very old PDP-11 archive
  1195 +0 long 0177545 old archive
  1196 +0 short 0177545 old PDP-11 archive
  1197 +0 long 0100554 apl workspace
  1198 +0 string =<ar> archive
  1199 +
  1200 +# MIPS archive (needs to go before regular portable archives)
  1201 +#
  1202 +0 string =!<arch>\n__________E MIPS archive
  1203 +>20 string U with MIPS Ucode members
  1204 +>21 string L with MIPSEL members
  1205 +>21 string B with MIPSEB members
  1206 +>19 string L and an EL hash table
  1207 +>19 string B and an EB hash table
  1208 +>22 string X -- out of date
  1209 +
  1210 +0 string -h- Software Tools format archive text
  1211 +
  1212 +#
  1213 +# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
  1214 +# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
  1215 +#
  1216 +# 0 string =!<arch> current ar archive
  1217 +# 0 long 0x213c6172 archive file
  1218 +#
  1219 +# and for SVR1 archives, we have:
  1220 +#
  1221 +# 0 string \<ar> System V Release 1 ar archive
  1222 +# 0 string =<ar> archive
  1223 +#
  1224 +# XXX - did Aegis really store shared libraries, breakpointed modules,
  1225 +# and absolute code program modules in the same format as new-style
  1226 +# "ar" archives?
  1227 +#
  1228 +0 string =!<arch> current ar archive
  1229 +>8 string __.SYMDEF random library
  1230 +>0 belong =65538 - pre SR9.5
  1231 +>0 belong =65539 - post SR9.5
  1232 +>0 beshort 2 - object archive
  1233 +>0 beshort 3 - shared library module
  1234 +>0 beshort 4 - debug break-pointed module
  1235 +>0 beshort 5 - absolute code program module
  1236 +0 string \<ar> System V Release 1 ar archive
  1237 +0 string =<ar> archive
  1238 +#
  1239 +# XXX - from "vax", which appears to collect a bunch of byte-swapped
  1240 +# thingies, to help you recognize VAX files on big-endian machines;
  1241 +# with "leshort", "lelong", and "string", that's no longer necessary....
  1242 +#
  1243 +0 belong 0x65ff0000 VAX 3.0 archive
  1244 +0 belong 0x3c61723e VAX 5.0 archive
  1245 +#
  1246 +0 long 0x213c6172 archive file
  1247 +0 lelong 0177555 very old VAX archive
  1248 +0 leshort 0177555 very old PDP-11 archive
  1249 +#
  1250 +# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
  1251 +# be a random library (it said 0xff65 rather than 0177545).
  1252 +#
  1253 +0 lelong 0177545 old VAX archive
  1254 +>8 string __.SYMDEF random library
  1255 +0 leshort 0177545 old PDP-11 archive
  1256 +>8 string __.SYMDEF random library
  1257 +#
  1258 +# From "pdp" (but why a 4-byte quantity?)
  1259 +#
  1260 +0 lelong 0x39bed PDP-11 old archive
  1261 +0 lelong 0x39bee PDP-11 4.0 archive
  1262 +
  1263 +# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
  1264 +#
  1265 +# The first byte is the magic (0x1a), byte 2 is the compression type for
  1266 +# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
  1267 +# filename of the first file (null terminated). Since some types collide
  1268 +# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
  1269 +# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
  1270 +0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
  1271 +0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
  1272 +0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
  1273 +0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
  1274 +0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
  1275 +0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
  1276 +# [JW] stuff taken from idarc, obviously ARC successors:
  1277 +0 lelong&0x8080ffff 0x00000a1a PAK archive data
  1278 +0 lelong&0x8080ffff 0x0000141a ARC+ archive data
  1279 +0 lelong&0x8080ffff 0x0000481a HYP archive data
  1280 +
  1281 +# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
  1282 +# I can't create either SPARK or ArcFS archives so I have not tested this stuff
  1283 +# [GRR: the original entries collide with ARC, above; replaced with combined
  1284 +# version (not tested)]
  1285 +#0 byte 0x1a RISC OS archive (spark format)
  1286 +0 string \032archive RISC OS archive (ArcFS format)
  1287 +0 string Archive\000 RISC OS archive (ArcFS format)
  1288 +
  1289 +# All these were taken from idarc, many could not be verified. Unfortunately,
  1290 +# there were many low-quality sigs, i.e. easy to trigger false positives.
  1291 +# Please notify me of any real-world fishy/ambiguous signatures and I'll try
  1292 +# to get my hands on the actual archiver and see if I find something better. [JW]
  1293 +# probably many can be enhanced by finding some 0-byte or control char near the start
  1294 +
  1295 +# idarc calls this Crush/Uncompressed... *shrug*
  1296 +0 string CRUSH Crush archive data
  1297 +# Squeeze It (.sqz)
  1298 +0 string HLSQZ Squeeze It archive data
  1299 +# SQWEZ
  1300 +0 string SQWEZ SQWEZ archive data
  1301 +# HPack (.hpk)
  1302 +0 string HPAK HPack archive data
  1303 +# HAP
  1304 +0 string \x91\x33HF HAP archive data
  1305 +# MD/MDCD
  1306 +0 string MDmd MDCD archive data
  1307 +# LIM
  1308 +0 string LIM\x1a LIM archive data
  1309 +# SAR
  1310 +3 string LH5 SAR archive data
  1311 +# BSArc/BS2
  1312 +0 string \212\3SB \0 BSArc/BS2 archive data
  1313 +# MAR
  1314 +2 string =-ah MAR archive data
  1315 +# ACB
  1316 +0 belong&0x00f800ff 0x00800000 ACB archive data
  1317 +# CPZ
  1318 +# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
  1319 +# JRC
  1320 +0 string JRchive JRC archive data
  1321 +# Quantum
  1322 +0 string DS\0 Quantum archive data
  1323 +# ReSOF
  1324 +0 string PK\3\6 ReSOF archive data
  1325 +# QuArk
  1326 +0 string 7\4 QuArk archive data
  1327 +# YAC
  1328 +14 string YC YAC archive data
  1329 +# X1
  1330 +0 string X1 X1 archive data
  1331 +0 string XhDr X1 archive data
  1332 +# CDC Codec (.dqt)
  1333 +0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
  1334 +# AMGC
  1335 +0 string \xad6" AMGC archive data
  1336 +# NuLIB
  1337 +0 string NõFélÃ¥ NuLIB archive data
  1338 +# PakLeo
  1339 +0 string LEOLZW PAKLeo archive data
  1340 +# ChArc
  1341 +0 string SChF ChArc archive data
  1342 +# PSA
  1343 +0 string PSA PSA archive data
  1344 +# CrossePAC
  1345 +0 string DSIGDCC CrossePAC archive data
  1346 +# Freeze
  1347 +0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
  1348 +# KBoom
  1349 +0 string ¨MP¨ KBoom archive data
  1350 +# NSQ, must go after CDC Codec
  1351 +0 string \x76\xff NSQ archive data
  1352 +# DPA
  1353 +0 string Dirk\ Paehl DPA archive data
  1354 +# BA
  1355 +# TODO: idarc says "bytes 0-2 == bytes 3-5"
  1356 +# TTComp
  1357 +0 string \0\6 TTComp archive data
  1358 +# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
  1359 +0 string ESP ESP archive data
  1360 +# ZPack
  1361 +0 string \1ZPK\1 ZPack archive data
  1362 +# Sky
  1363 +0 string \xbc\x40 Sky archive data
  1364 +# UFA
  1365 +0 string UFA UFA archive data
  1366 +# Dry
  1367 +0 string =-H2O DRY archive data
  1368 +# FoxSQZ
  1369 +0 string FOXSQZ FoxSQZ archive data
  1370 +# AR7
  1371 +0 string ,AR7 AR7 archive data
  1372 +# PPMZ
  1373 +0 string PPMZ PPMZ archive data
  1374 +# MS Compress
  1375 +4 string \x88\xf0\x27 MS Compress archive data
  1376 +# updated by Joerg Jenderek
  1377 +>9 string \0
  1378 +>>0 string KWAJ
  1379 +>>>7 string \321\003 MS Compress archive data
  1380 +>>>>14 ulong >0 \b, original size: %ld bytes
  1381 +>>>>18 ubyte >0x65
  1382 +>>>>>18 string x \b, was %.8s
  1383 +>>>>>(10.b-4) string x \b.%.3s
  1384 +# MP3 (archiver, not lossy audio compression)
  1385 +0 string MP3\x1a MP3-Archiver archive data
  1386 +# ZET
  1387 +0 string OZÝ ZET archive data
  1388 +# TSComp
  1389 +0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
  1390 +# ARQ
  1391 +0 string gW\4\1 ARQ archive data
  1392 +# Squash
  1393 +3 string OctSqu Squash archive data
  1394 +# Terse
  1395 +0 string \5\1\1\0 Terse archive data
  1396 +# PUCrunch
  1397 +0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
  1398 +# UHarc
  1399 +0 string UHA UHarc archive data
  1400 +# ABComp
  1401 +0 string \2AB ABComp archive data
  1402 +0 string \3AB2 ABComp archive data
  1403 +# CMP
  1404 +0 string CO\0 CMP archive data
  1405 +# Splint
  1406 +0 string \x93\xb9\x06 Splint archive data
  1407 +# InstallShield
  1408 +0 string \x13\x5d\x65\x8c InstallShield Z archive Data
  1409 +# Gather
  1410 +1 string GTH Gather archive data
  1411 +# BOA
  1412 +0 string BOA BOA archive data
  1413 +# RAX
  1414 +0 string ULEB\xa RAX archive data
  1415 +# Xtreme
  1416 +0 string ULEB\0 Xtreme archive data
  1417 +# Pack Magic
  1418 +0 string @â\1\0 Pack Magic archive data
  1419 +# BTS
  1420 +0 belong&0xfeffffff 0x1a034465 BTS archive data
  1421 +# ELI 5750
  1422 +0 string Ora\ ELI 5750 archive data
  1423 +# QFC
  1424 +0 string \x1aFC\x1a QFC archive data
  1425 +0 string \x1aQF\x1a QFC archive data
  1426 +# PRO-PACK
  1427 +0 string RNC PRO-PACK archive data
  1428 +# 777
  1429 +0 string 777 777 archive data
  1430 +# LZS221
  1431 +0 string sTaC LZS221 archive data
  1432 +# HPA
  1433 +0 string HPA HPA archive data
  1434 +# Arhangel
  1435 +0 string LG Arhangel archive data
  1436 +# EXP1, uses bzip2
  1437 +0 string 0123456789012345BZh EXP1 archive data
  1438 +# IMP
  1439 +0 string IMP\xa IMP archive data
  1440 +# NRV
  1441 +0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
  1442 +# Squish
  1443 +0 string \x73\xb2\x90\xf4 Squish archive data
  1444 +# Par
  1445 +0 string PHILIPP Par archive data
  1446 +0 string PAR Par archive data
  1447 +# HIT
  1448 +0 string UB HIT archive data
  1449 +# SBX
  1450 +0 belong&0xfffff000 0x53423000 SBX archive data
  1451 +# NaShrink
  1452 +0 string NSK NaShrink archive data
  1453 +# SAPCAR
  1454 +0 string #\ CAR\ archive\ header SAPCAR archive data
  1455 +0 string CAR\ 2.00RG SAPCAR archive data
  1456 +# Disintegrator
  1457 +0 string DST Disintegrator archive data
  1458 +# ASD
  1459 +0 string ASD ASD archive data
  1460 +# InstallShield CAB
  1461 +0 string ISc( InstallShield CAB
  1462 +# TOP4
  1463 +0 string T4\x1a TOP4 archive data
  1464 +# BatComp left out: sig looks like COM executable
  1465 +# so TODO: get real 4dos batcomp file and find sig
  1466 +# BlakHole
  1467 +0 string BH\5\7 BlakHole archive data
  1468 +# BIX
  1469 +0 string BIX0 BIX archive data
  1470 +# ChiefLZA
  1471 +0 string ChfLZ ChiefLZA archive data
  1472 +# Blink
  1473 +0 string Blink Blink archive data
  1474 +# Logitech Compress
  1475 +0 string \xda\xfa Logitech Compress archive data
  1476 +# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
  1477 +1 string (C)\ STEPANYUK ARS-Sfx archive data
  1478 +# AKT/AKT32
  1479 +0 string AKT32 AKT32 archive data
  1480 +0 string AKT AKT archive data
  1481 +# NPack
  1482 +0 string MSTSM NPack archive data
  1483 +# PFT
  1484 +0 string \0\x50\0\x14 PFT archive data
  1485 +# SemOne
  1486 +0 string SEM SemOne archive data
  1487 +# PPMD
  1488 +0 string \x8f\xaf\xac\x84 PPMD archive data
  1489 +# FIZ
  1490 +0 string FIZ FIZ archive data
  1491 +# MSXiE
  1492 +0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
  1493 +# DeepFreezer
  1494 +0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
  1495 +# DC
  1496 +0 string =<DC- DC archive data
  1497 +# TPac
  1498 +0 string \4TPAC\3 TPac archive data
  1499 +# Ai
  1500 +0 string Ai\1\1\0 Ai archive data
  1501 +0 string Ai\1\0\0 Ai archive data
  1502 +# Ai32
  1503 +0 string Ai\2\0 Ai32 archive data
  1504 +0 string Ai\2\1 Ai32 archive data
  1505 +# SBC
  1506 +0 string SBC SBC archive data
  1507 +# Ybs
  1508 +0 string YBS Ybs archive data
  1509 +# DitPack
  1510 +0 string \x9e\0\0 DitPack archive data
  1511 +# DMS
  1512 +0 string DMS! DMS archive data
  1513 +# EPC
  1514 +0 string \x8f\xaf\xac\x8c EPC archive data
  1515 +# VSARC
  1516 +0 string VS\x1a VSARC archive data
  1517 +# PDZ
  1518 +0 string PDZ PDZ archive data
  1519 +# ReDuq
  1520 +0 string rdqx ReDuq archive data
  1521 +# GCA
  1522 +0 string GCAX GCA archive data
  1523 +# PPMN
  1524 +0 string pN PPMN archive data
  1525 +# WinImage
  1526 +3 string WINIMAGE WinImage archive data
  1527 +# Compressia
  1528 +0 string CMP0CMP Compressia archive data
  1529 +# UHBC
  1530 +0 string UHB UHBC archive data
  1531 +# WinHKI
  1532 +0 string \x61\x5C\x04\x05 WinHKI archive data
  1533 +# WWPack data file
  1534 +0 string WWP WWPack archive data
  1535 +# BSN (BSA, PTS-DOS)
  1536 +0 string \xffBSG BSN archive data
  1537 +1 string \xffBSG BSN archive data
  1538 +3 string \xffBSG BSN archive data
  1539 +1 string \0\xae\2 BSN archive data
  1540 +1 string \0\xae\3 BSN archive data
  1541 +1 string \0\xae\7 BSN archive data
  1542 +# AIN
  1543 +0 string \x33\x18 AIN archive data
  1544 +0 string \x33\x17 AIN archive data
  1545 +# XPA32
  1546 +0 string xpa\0\1 XPA32 archive data
  1547 +# SZip (TODO: doesn't catch all versions)
  1548 +0 string SZ\x0a\4 SZip archive data
  1549 +# XPack DiskImage
  1550 +0 string jm XPack DiskImage archive data
  1551 +# XPack Data
  1552 +0 string xpa XPack archive data
  1553 +# XPack Single Data
  1554 +0 string Í\ jm XPack single archive data
  1555 +
  1556 +# TODO: missing due to unknown magic/magic at end of file:
  1557 +#DWC
  1558 +#ARG
  1559 +#ZAR
  1560 +#PC/3270
  1561 +#InstallIt
  1562 +#RKive
  1563 +#RK
  1564 +#XPack Diskimage
  1565 +
  1566 +# These were inspired by idarc, but actually verified
  1567 +# Dzip archiver (.dz)
  1568 +0 string DZ Dzip archive data
  1569 +>2 byte x \b, version %i
  1570 +>3 byte x \b.%i
  1571 +# ZZip archiver (.zz)
  1572 +0 string ZZ\ \0\0 ZZip archive data
  1573 +0 string ZZ0 ZZip archive data
  1574 +# PAQ archiver (.paq)
  1575 +0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
  1576 +0 string PAQ PAQ archive data
  1577 +>3 byte&0xf0 0x30
  1578 +>>3 byte x (v%c)
  1579 +# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
  1580 +0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
  1581 +0 string JARCS JAR (ARJ Software, Inc.) archive data
  1582 +
  1583 +# ARJ archiver (jason@jarthur.Claremont.EDU)
  1584 +0 leshort 0xea60 ARJ archive data
  1585 +>5 byte x \b, v%d,
  1586 +>8 byte &0x04 multi-volume,
  1587 +>8 byte &0x10 slash-switched,
  1588 +>8 byte &0x20 backup,
  1589 +>34 string x original name: %s,
  1590 +>7 byte 0 os: MS-DOS
  1591 +>7 byte 1 os: PRIMOS
  1592 +>7 byte 2 os: Unix
  1593 +>7 byte 3 os: Amiga
  1594 +>7 byte 4 os: Macintosh
  1595 +>7 byte 5 os: OS/2
  1596 +>7 byte 6 os: Apple ][ GS
  1597 +>7 byte 7 os: Atari ST
  1598 +>7 byte 8 os: NeXT
  1599 +>7 byte 9 os: VAX/VMS
  1600 +>3 byte >0 %d]
  1601 +# [JW] idarc says this is also possible
  1602 +2 leshort 0xea60 ARJ archive data
  1603 +
  1604 +# HA archiver (Greg Roelofs, newt@uchicago.edu)
  1605 +# This is a really bad format. A file containing HAWAII will match this...
  1606 +#0 string HA HA archive data,
  1607 +#>2 leshort =1 1 file,
  1608 +#>2 leshort >1 %u files,
  1609 +#>4 byte&0x0f =0 first is type CPY
  1610 +#>4 byte&0x0f =1 first is type ASC
  1611 +#>4 byte&0x0f =2 first is type HSC
  1612 +#>4 byte&0x0f =0x0e first is type DIR
  1613 +#>4 byte&0x0f =0x0f first is type SPECIAL
  1614 +# suggestion: at least identify small archives (<1024 files)
  1615 +0 belong&0xffff00fc 0x48410000 HA archive data
  1616 +>2 leshort =1 1 file,
  1617 +>2 leshort >1 %u files,
  1618 +>4 byte&0x0f =0 first is type CPY
  1619 +>4 byte&0x0f =1 first is type ASC
  1620 +>4 byte&0x0f =2 first is type HSC
  1621 +>4 byte&0x0f =0x0e first is type DIR
  1622 +>4 byte&0x0f =0x0f first is type SPECIAL
  1623 +
  1624 +# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
  1625 +0 string HPAK HPACK archive data
  1626 +
  1627 +# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
  1628 +0 string \351,\001JAM\ JAM archive,
  1629 +>7 string >\0 version %.4s
  1630 +>0x26 byte =0x27 -
  1631 +>>0x2b string >\0 label %.11s,
  1632 +>>0x27 lelong x serial %08x,
  1633 +>>0x36 string >\0 fstype %.8s
  1634 +
  1635 +# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
  1636 +2 string -lh0- LHarc 1.x/ARX archive data [lh0]
  1637 +2 string -lh1- LHarc 1.x/ARX archive data [lh1]
  1638 +2 string -lz4- LHarc 1.x archive data [lz4]
  1639 +2 string -lz5- LHarc 1.x archive data [lz5]
  1640 +# [never seen any but the last; -lh4- reported in comp.compression:]
  1641 +2 string -lzs- LHa/LZS archive data [lzs]
  1642 +2 string -lh\40- LHa 2.x? archive data [lh ]
  1643 +2 string -lhd- LHa 2.x? archive data [lhd]
  1644 +2 string -lh2- LHa 2.x? archive data [lh2]
  1645 +2 string -lh3- LHa 2.x? archive data [lh3]
  1646 +2 string -lh4- LHa (2.x) archive data [lh4]
  1647 +2 string -lh5- LHa (2.x) archive data [lh5]
  1648 +2 string -lh6- LHa (2.x) archive data [lh6]
  1649 +2 string -lh7- LHa (2.x)/LHark archive data [lh7]
  1650 +>20 byte x - header level %d
  1651 +# taken from idarc [JW]
  1652 +2 string -lZ PUT archive data
  1653 +2 string -lz LZS archive data
  1654 +2 string -sw1- Swag archive data
  1655 +
  1656 +# RAR archiver (Greg Roelofs, newt@uchicago.edu)
  1657 +0 string Rar! RAR archive data,
  1658 +>44 byte x v%0x,
  1659 +>10 byte >0 flags:
  1660 +>>10 byte &0x01 Archive volume,
  1661 +>>10 byte &0x02 Commented,
  1662 +>>10 byte &0x04 Locked,
  1663 +>>10 byte &0x08 Solid,
  1664 +>>10 byte &0x20 Authenticated,
  1665 +>35 byte 0 os: MS-DOS
  1666 +>35 byte 1 os: OS/2
  1667 +>35 byte 2 os: Win32
  1668 +>35 byte 3 os: Unix
  1669 +# some old version? idarc says:
  1670 +0 string RE\x7e\x5e RAR archive data
  1671 +
  1672 +# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
  1673 +0 string SQSH squished archive data (Acorn RISCOS)
  1674 +
  1675 +# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
  1676 +# [JW] see exe section for self-extracting version
  1677 +0 string UC2\x1a UC2 archive data
  1678 +
  1679 +# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
  1680 +0 string PK\003\004
  1681 +>4 byte 0x09 Zip archive data, at least v0.9 to extract
  1682 +>4 byte 0x0a Zip archive data, at least v1.0 to extract
  1683 +>4 byte 0x0b Zip archive data, at least v1.1 to extract
  1684 +>4 byte 0x14
  1685 +>>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract
  1686 +>0x161 string WINZIP Zip archive data, WinZIP self-extracting
  1687 +
  1688 +
  1689 +# OpenOffice.org / KOffice / StarOffice documents
  1690 +# From: Abel Cheung <abel@oaka.org>
  1691 +# Listed here because they are basically zip files
  1692 +>>30 string mimetype
  1693 +
  1694 +# KOffice (1.2 or above) formats
  1695 +>>>50 string vnd.kde. KOffice (>=1.2)
  1696 +>>>>58 string karbon Karbon document
  1697 +>>>>58 string kchart KChart document
  1698 +>>>>58 string kformula KFormula document
  1699 +>>>>58 string kivio Kivio document
  1700 +>>>>58 string kontour Kontour document
  1701 +>>>>58 string kpresenter KPresenter document
  1702 +>>>>58 string kspread KSpread document
  1703 +>>>>58 string kword KWord document
  1704 +
  1705 +# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
  1706 +>>>50 string vnd.sun.xml. OpenOffice.org 1.x
  1707 +>>>>62 string writer Writer
  1708 +>>>>>68 byte !0x2e document
  1709 +>>>>>68 string .template template
  1710 +>>>>>68 string .global global document
  1711 +>>>>62 string calc Calc
  1712 +>>>>>66 byte !0x2e spreadsheet
  1713 +>>>>>66 string .template template
  1714 +>>>>62 string draw Draw
  1715 +>>>>>66 byte !0x2e document
  1716 +>>>>>66 string .template template
  1717 +>>>>62 string impress Impress
  1718 +>>>>>69 byte !0x2e presentation
  1719 +>>>>>69 string .template template
  1720 +>>>>62 string math Math document
  1721 +
  1722 +# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
  1723 +# http://lists.oasis-open.org/archives/office/200505/msg00006.html
  1724 +>>>50 string vnd.oasis.opendocument. OpenDocument
  1725 +>>>>73 string text
  1726 +>>>>>77 byte !0x2d Text
  1727 +>>>>>77 string -template Text Template
  1728 +>>>>>77 string -web HTML Document Template
  1729 +>>>>>77 string -master Master Document
  1730 +>>>>73 string graphics Drawing
  1731 +>>>>>81 string -template Template
  1732 +>>>>73 string presentation Presentation
  1733 +>>>>>85 string -template Template
  1734 +>>>>73 string spreadsheet Spreadsheet
  1735 +>>>>>84 string -template Template
  1736 +>>>>73 string chart Chart
  1737 +>>>>>78 string -template Template
  1738 +>>>>73 string formula Formula
  1739 +>>>>>80 string -template Template
  1740 +>>>>73 string database Database
  1741 +>>>>73 string image Image
  1742 +
  1743 +# Zoo archiver
  1744 +20 lelong 0xfdc4a7dc Zoo archive data
  1745 +>4 byte >48 \b, v%c.
  1746 +>>6 byte >47 \b%c
  1747 +>>>7 byte >47 \b%c
  1748 +>32 byte >0 \b, modify: v%d
  1749 +>>33 byte x \b.%d+
  1750 +>42 lelong 0xfdc4a7dc \b,
  1751 +>>70 byte >0 extract: v%d
  1752 +>>>71 byte x \b.%d+
  1753 +
  1754 +# Shell archives
  1755 +10 string #\ This\ is\ a\ shell\ archive shell archive text
  1756 +
  1757 +#
  1758 +# LBR. NB: May conflict with the questionable
  1759 +# "binary Computer Graphics Metafile" format.
  1760 +#
  1761 +0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
  1762 +#
  1763 +# PMA (CP/M derivative of LHA)
  1764 +#
  1765 +2 string -pm0- PMarc archive data [pm0]
  1766 +2 string -pm1- PMarc archive data [pm1]
  1767 +2 string -pm2- PMarc archive data [pm2]
  1768 +2 string -pms- PMarc SFX archive (CP/M, DOS)
  1769 +5 string -pc1- PopCom compressed executable (CP/M)
  1770 +
  1771 +# From Rafael Laboissiere <rafael@laboissiere.net>
  1772 +# The Project Revision Control System (see
  1773 +# http://prcs.sourceforge.net) generates a packaged project
  1774 +# file which is recognized by the following entry:
  1775 +0 leshort 0xeb81 PRCS packaged project
  1776 +
  1777 +# Microsoft cabinets
  1778 +# by David Necas (Yeti) <yeti@physics.muni.cz>
  1779 +#0 string MSCF\0\0\0\0 Microsoft cabinet file data,
  1780 +#>25 byte x v%d
  1781 +#>24 byte x \b.%d
  1782 +# MPi: All CABs have version 1.3, so this is pointless.
  1783 +# Better magic in debian-additions.
  1784 +
  1785 +# GTKtalog catalogs
  1786 +# by David Necas (Yeti) <yeti@physics.muni.cz>
  1787 +4 string gtktalog\ GTKtalog catalog data,
  1788 +>13 string 3 version 3
  1789 +>>14 beshort 0x677a (gzipped)
  1790 +>>14 beshort !0x677a (not gzipped)
  1791 +>13 string >3 version %s
  1792 +
  1793 +############################################################################
  1794 +# Parity archive reconstruction file, the 'par' file format now used on Usenet.
  1795 +0 string PAR\0 PARity archive data
  1796 +>48 leshort =0 - Index file
  1797 +>48 leshort >0 - file number %d
  1798 +
  1799 +# Felix von Leitner <felix-file@fefe.de>
  1800 +0 string d8:announce BitTorrent file
  1801 +
  1802 +# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
  1803 +0 beshort 0x0e0f Atari MSA archive data
  1804 +>2 beshort x \b, %d sectors per track
  1805 +>4 beshort 0 \b, 1 sided
  1806 +>4 beshort 1 \b, 2 sided
  1807 +>6 beshort x \b, starting track: %d
  1808 +>8 beshort x \b, ending track: %d
  1809 +
  1810 +# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
  1811 +0 string PK00PK\003\004 Zip archive data
  1812 +
  1813 +# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
  1814 +# by Stefan `Sec` Zehl <sec@42.org>
  1815 +7 string **ACE** ACE archive data
  1816 +>15 byte >0 version %d
  1817 +>16 byte =0x00 \b, from MS-DOS
  1818 +>16 byte =0x01 \b, from OS/2
  1819 +>16 byte =0x02 \b, from Win/32
  1820 +>16 byte =0x03 \b, from Unix
  1821 +>16 byte =0x04 \b, from MacOS
  1822 +>16 byte =0x05 \b, from WinNT
  1823 +>16 byte =0x06 \b, from Primos
  1824 +>16 byte =0x07 \b, from AppleGS
  1825 +>16 byte =0x08 \b, from Atari
  1826 +>16 byte =0x09 \b, from Vax/VMS
  1827 +>16 byte =0x0A \b, from Amiga
  1828 +>16 byte =0x0B \b, from Next
  1829 +>14 byte x \b, version %d to extract
  1830 +>5 leshort &0x0080 \b, multiple volumes,
  1831 +>>17 byte x \b (part %d),
  1832 +>5 leshort &0x0002 \b, contains comment
  1833 +>5 leshort &0x0200 \b, sfx
  1834 +>5 leshort &0x0400 \b, small dictionary
  1835 +>5 leshort &0x0800 \b, multi-volume
  1836 +>5 leshort &0x1000 \b, contains AV-String
  1837 +>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered)
  1838 +>5 leshort &0x2000 \b, with recovery record
  1839 +>5 leshort &0x4000 \b, locked
  1840 +>5 leshort &0x8000 \b, solid
  1841 +# Date in MS-DOS format (whatever that is)
  1842 +#>18 lelong x Created on
  1843 +
  1844 +# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
  1845 +# <doj@cubic.org>
  1846 +0x1A string sfArk sfArk compressed Soundfont
  1847 +>0x15 string 2
  1848 +>>0x1 string >\0 Version %s
  1849 +>>0x2A string >\0 : %s
  1850 +
  1851 +# DR-DOS 7.03 Packed File *.??_
  1852 +0 string Packed\ File\ Personal NetWare Packed File
  1853 +>12 string x \b, was "%.12s"
  1854 +
  1855 +# EET archive
  1856 +# From: Tilman Sauerbeck <tilman@code-monkey.de>
  1857 +0 belong 0x1ee7ff00 EET archive
  1858 +
  1859 +# rzip archives
  1860 +0 string RZIP rzip compressed data
  1861 +>4 byte x - version %d
  1862 +>5 byte x \b.%d
  1863 +>6 belong x (%d bytes)
  1864 +
  1865 +# From: "Robert Dale" <robdale@gmail.com>
  1866 +0 belong 123 dar archive,
  1867 +>4 belong x label "%.8x
  1868 +>>8 belong x %.8x
  1869 +>>>12 beshort x %.4x"
  1870 +>14 byte 0x54 end slice
  1871 +>14 beshort 0x4e4e multi-part
  1872 +>14 beshort 0x4e53 multi-part, with -S
  1873 +
  1874 +# Symbian installation files
  1875 +# http://www.thouky.co.uk/software/psifs/sis.html
  1876 +# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
  1877 +8 lelong 0x10000419 Symbian installation file
  1878 +>4 lelong 0x1000006D (EPOC release 3/4/5)
  1879 +>4 lelong 0x10003A12 (EPOC release 6)
  1880 +0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
  1881 +
  1882 +#------------------------------------------------------------------------------
  1883 +# asterix: file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
  1884 +# strings as "long" - we assume they're just strings:
  1885 +# From: guy@netapp.com (Guy Harris)
  1886 +#
  1887 +0 string *STA Aster*x
  1888 +>7 string WORD Words Document
  1889 +>7 string GRAP Graphic
  1890 +>7 string SPRE Spreadsheet
  1891 +>7 string MACR Macro
  1892 +0 string 2278 Aster*x Version 2
  1893 +>29 byte 0x36 Words Document
  1894 +>29 byte 0x35 Graphic
  1895 +>29 byte 0x32 Spreadsheet
  1896 +>29 byte 0x38 Macro
  1897 +
  1898 +
  1899 +#------------------------------------------------------------------------------
  1900 +# att3b: file(1) magic for AT&T 3B machines
  1901 +#
  1902 +# The `versions' should be un-commented if they work for you.
  1903 +# (Was the problem just one of endianness?)
  1904 +#
  1905 +# 3B20
  1906 +#
  1907 +# The 3B20 conflicts with SCCS.
  1908 +#0 beshort 0550 3b20 COFF executable
  1909 +#>12 belong >0 not stripped
  1910 +#>22 beshort >0 - version %ld
  1911 +#0 beshort 0551 3b20 COFF executable (TV)
  1912 +#>12 belong >0 not stripped
  1913 +#>22 beshort >0 - version %ld
  1914 +#
  1915 +# WE32K
  1916 +#
  1917 +0 beshort 0560 WE32000 COFF
  1918 +>18 beshort ^00000020 object
  1919 +>18 beshort &00000020 executable
  1920 +>12 belong >0 not stripped
  1921 +>18 beshort ^00010000 N/A on 3b2/300 w/paging
  1922 +>18 beshort &00020000 32100 required
  1923 +>18 beshort &00040000 and MAU hardware required
  1924 +>20 beshort 0407 (impure)
  1925 +>20 beshort 0410 (pure)
  1926 +>20 beshort 0413 (demand paged)
  1927 +>20 beshort 0443 (target shared library)
  1928 +>22 beshort >0 - version %ld
  1929 +0 beshort 0561 WE32000 COFF executable (TV)
  1930 +>12 belong >0 not stripped
  1931 +#>18 beshort &00020000 - 32100 required
  1932 +#>18 beshort &00040000 and MAU hardware required
  1933 +#>22 beshort >0 - version %ld
  1934 +#
  1935 +# core file for 3b2
  1936 +0 string \000\004\036\212\200 3b2 core file
  1937 +>364 string >\0 of '%s'
  1938 +
  1939 +#------------------------------------------------------------------------------
  1940 +# audio: file(1) magic for sound formats (see also "iff")
  1941 +#
  1942 +# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
  1943 +# and others
  1944 +#
  1945 +
  1946 +# Sun/NeXT audio data
  1947 +0 string .snd Sun/NeXT audio data:
  1948 +>12 belong 1 8-bit ISDN mu-law,
  1949 +>12 belong 2 8-bit linear PCM [REF-PCM],
  1950 +>12 belong 3 16-bit linear PCM,
  1951 +>12 belong 4 24-bit linear PCM,
  1952 +>12 belong 5 32-bit linear PCM,
  1953 +>12 belong 6 32-bit IEEE floating point,
  1954 +>12 belong 7 64-bit IEEE floating point,
  1955 +>12 belong 8 Fragmented sample data,
  1956 +>12 belong 10 DSP program,
  1957 +>12 belong 11 8-bit fixed point,
  1958 +>12 belong 12 16-bit fixed point,
  1959 +>12 belong 13 24-bit fixed point,
  1960 +>12 belong 14 32-bit fixed point,
  1961 +>12 belong 18 16-bit linear with emphasis,
  1962 +>12 belong 19 16-bit linear compressed,
  1963 +>12 belong 20 16-bit linear with emphasis and compression,
  1964 +>12 belong 21 Music kit DSP commands,
  1965 +>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
  1966 +>12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
  1967 +>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
  1968 +>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
  1969 +>12 belong 27 8-bit A-law (CCITT G.711),
  1970 +>20 belong 1 mono,
  1971 +>20 belong 2 stereo,
  1972 +>20 belong 4 quad,
  1973 +>16 belong >0 %d Hz
  1974 +
  1975 +# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
  1976 +# that uses little-endian encoding and has a different magic number
  1977 +0 lelong 0x0064732E DEC audio data:
  1978 +>12 lelong 1 8-bit ISDN mu-law,
  1979 +>12 lelong 2 8-bit linear PCM [REF-PCM],
  1980 +>12 lelong 3 16-bit linear PCM,
  1981 +>12 lelong 4 24-bit linear PCM,
  1982 +>12 lelong 5 32-bit linear PCM,
  1983 +>12 lelong 6 32-bit IEEE floating point,
  1984 +>12 lelong 7 64-bit IEEE floating point,
  1985 +>12 belong 8 Fragmented sample data,
  1986 +>12 belong 10 DSP program,
  1987 +>12 belong 11 8-bit fixed point,
  1988 +>12 belong 12 16-bit fixed point,
  1989 +>12 belong 13 24-bit fixed point,
  1990 +>12 belong 14 32-bit fixed point,
  1991 +>12 belong 18 16-bit linear with emphasis,
  1992 +>12 belong 19 16-bit linear compressed,
  1993 +>12 belong 20 16-bit linear with emphasis and compression,
  1994 +>12 belong 21 Music kit DSP commands,
  1995 +>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
  1996 +>12 belong 24 compressed (8-bit CCITT G.722 ADPCM)
  1997 +>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM),
  1998 +>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM),
  1999 +>12 belong 27 8-bit A-law (CCITT G.711),
  2000 +>20 lelong 1 mono,
  2001 +>20 lelong 2 stereo,
  2002 +>20 lelong 4 quad,
  2003 +>16 lelong >0 %d Hz
  2004 +
  2005 +# Creative Labs AUDIO stuff
  2006 +0 string MThd Standard MIDI data
  2007 +>8 beshort x (format %d)
  2008 +>10 beshort x using %d track
  2009 +>10 beshort >1 \bs
  2010 +>12 beshort&0x7fff x at 1/%d
  2011 +>12 beshort&0x8000 >0 SMPTE
  2012 +
  2013 +0 string CTMF Creative Music (CMF) data
  2014 +0 string SBI SoundBlaster instrument data
  2015 +0 string Creative\ Voice\ File Creative Labs voice data
  2016 +# is this next line right? it came this way...
  2017 +>19 byte 0x1A
  2018 +>23 byte >0 - version %d
  2019 +>22 byte >0 \b.%d
  2020 +
  2021 +# first entry is also the string "NTRK"
  2022 +0 belong 0x4e54524b MultiTrack sound data
  2023 +>4 belong x - version %ld
  2024 +
  2025 +# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
  2026 +# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
  2027 +0 string EMOD Extended MOD sound data,
  2028 +>4 byte&0xf0 x version %d
  2029 +>4 byte&0x0f x \b.%d,
  2030 +>45 byte x %d instruments
  2031 +>83 byte 0 (module)
  2032 +>83 byte 1 (song)
  2033 +
  2034 +# Real Audio (Magic .ra\0375)
  2035 +0 belong 0x2e7261fd RealAudio sound file
  2036 +0 string .RMF RealMedia file
  2037 +
  2038 +# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
  2039 +# Oct 31, 1995
  2040 +# fixed by <doj@cubic.org> 2003-06-24
  2041 +# Too short...
  2042 +#0 string MTM MultiTracker Module sound file
  2043 +#0 string if Composer 669 Module sound data
  2044 +#0 string JN Composer 669 Module sound data (extended format)
  2045 +0 string MAS_U ULT(imate) Module sound data
  2046 +
  2047 +#0 string FAR Module sound data
  2048 +#>4 string >\15 Title: "%s"
  2049 +
  2050 +0x2c string SCRM ScreamTracker III Module sound data
  2051 +>0 string >\0 Title: "%s"
  2052 +
  2053 +# Gravis UltraSound patches
  2054 +# From <ache@nagual.ru>
  2055 +
  2056 +0 string GF1PATCH110\0ID#000002\0 GUS patch
  2057 +0 string GF1PATCH100\0ID#000002\0 Old GUS patch
  2058 +
  2059 +#
  2060 +# Taken from loader code from mikmod version 2.14
  2061 +# by Steve McIntyre (stevem@chiark.greenend.org.uk)
  2062 +# <doj@cubic.org> added title printing on 2003-06-24
  2063 +0 string MAS_UTrack_V00
  2064 +>14 string >/0 ultratracker V1.%.1s module sound data
  2065 +
  2066 +0 string UN05 MikMod UNI format module sound data
  2067 +
  2068 +0 string Extended\ Module: Fasttracker II module sound data
  2069 +>17 string >\0 Title: "%s"
  2070 +
  2071 +21 string/c =!SCREAM! Screamtracker 2 module sound data
  2072 +21 string BMOD2STM Screamtracker 2 module sound data
  2073 +1080 string M.K. 4-channel Protracker module sound data
  2074 +>0 string >\0 Title: "%s"
  2075 +1080 string M!K! 4-channel Protracker module sound data
  2076 +>0 string >\0 Title: "%s"
  2077 +1080 string FLT4 4-channel Startracker module sound data
  2078 +>0 string >\0 Title: "%s"
  2079 +1080 string FLT8 8-channel Startracker module sound data
  2080 +>0 string >\0 Title: "%s"
  2081 +1080 string 4CHN 4-channel Fasttracker module sound data
  2082 +>0 string >\0 Title: "%s"
  2083 +1080 string 6CHN 6-channel Fasttracker module sound data
  2084 +>0 string >\0 Title: "%s"
  2085 +1080 string 8CHN 8-channel Fasttracker module sound data
  2086 +>0 string >\0 Title: "%s"
  2087 +1080 string CD81 8-channel Octalyser module sound data
  2088 +>0 string >\0 Title: "%s"
  2089 +1080 string OKTA 8-channel Oktalyzer module sound data
  2090 +>0 string >\0 Title: "%s"
  2091 +# Not good enough.
  2092 +#1082 string CH
  2093 +#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data
  2094 +1080 string 16CN 16-channel Taketracker module sound data
  2095 +>0 string >\0 Title: "%s"
  2096 +1080 string 32CN 32-channel Taketracker module sound data
  2097 +>0 string >\0 Title: "%s"
  2098 +
  2099 +# TOC sound files -Trevor Johnson <trevor@jpj.net>
  2100 +#
  2101 +0 string TOC TOC sound file
  2102 +
  2103 +# sidfiles <pooka@iki.fi>
  2104 +# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
  2105 +0 string SIDPLAY\ INFOFILE Sidplay info file
  2106 +
  2107 +0 string PSID PlaySID v2.2+ (AMIGA) sidtune
  2108 +>4 beshort >0 w/ header v%d,
  2109 +>14 beshort =1 single song,
  2110 +>14 beshort >1 %d songs,
  2111 +>16 beshort >0 default song: %d
  2112 +>0x16 string >\0 name: "%s"
  2113 +>0x36 string >\0 author: "%s"
  2114 +>0x56 string >\0 copyright: "%s"
  2115 +
  2116 +0 string RSID RSID sidtune PlaySID compatible
  2117 +>4 beshort >0 w/ header v%d,
  2118 +>14 beshort =1 single song,
  2119 +>14 beshort >1 %d songs,
  2120 +>16 beshort >0 default song: %d
  2121 +>0x16 string >\0 name: "%s"
  2122 +>0x36 string >\0 author: "%s"
  2123 +>0x56 string >\0 copyright: "%s"
  2124 +
  2125 +# IRCAM <mpruett@sgi.com>
  2126 +# VAX and MIPS files are little-endian; Sun and NeXT are big-endian
  2127 +0 belong 0x64a30100 IRCAM file (VAX)
  2128 +0 belong 0x64a30200 IRCAM file (Sun)
  2129 +0 belong 0x64a30300 IRCAM file (MIPS little-endian)
  2130 +0 belong 0x64a30400 IRCAM file (NeXT)
  2131 +
  2132 +# NIST SPHERE <mpruett@sgi.com>
  2133 +0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file
  2134 +
  2135 +# Sample Vision <mpruett@sgi.com>
  2136 +0 string SOUND\ SAMPLE\ DATA\ Sample Vision file
  2137 +
  2138 +# Audio Visual Research <tonigonenstein@users.sourceforge.net>
  2139 +0 string 2BIT Audio Visual Research file,
  2140 +>12 beshort =0 mono,
  2141 +>12 beshort =-1 stereo,
  2142 +>14 beshort x %d bits
  2143 +>16 beshort =0 unsigned,
  2144 +>16 beshort =-1 signed,
  2145 +>22 belong&0x00ffffff x %d Hz,
  2146 +>18 beshort =0 no loop,
  2147 +>18 beshort =-1 loop,
  2148 +>21 ubyte <=127 note %d,
  2149 +>22 byte =0 replay 5.485 KHz
  2150 +>22 byte =1 replay 8.084 KHz
  2151 +>22 byte =2 replay 10.971 Khz
  2152 +>22 byte =3 replay 16.168 Khz
  2153 +>22 byte =4 replay 21.942 KHz
  2154 +>22 byte =5 replay 32.336 KHz
  2155 +>22 byte =6 replay 43.885 KHz
  2156 +>22 byte =7 replay 47.261 KHz
  2157 +
  2158 +# SGI SoundTrack <mpruett@sgi.com>
  2159 +0 string _SGI_SoundTrack SGI SoundTrack project file
  2160 +# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
  2161 +0 string ID3 Audio file with ID3 version 2
  2162 +>3 ubyte <0xff \b%d.
  2163 +>4 ubyte <0xff \b%d tag
  2164 +>2584 string fLaC \b, FLAC encoding
  2165 +>>2588 byte&0x7f >0 \b, unknown version
  2166 +>>2588 byte&0x7f 0 \b
  2167 +# some common bits/sample values
  2168 +>>>2600 beshort&0x1f0 0x030 \b, 4 bit
  2169 +>>>2600 beshort&0x1f0 0x050 \b, 6 bit
  2170 +>>>2600 beshort&0x1f0 0x070 \b, 8 bit
  2171 +>>>2600 beshort&0x1f0 0x0b0 \b, 12 bit
  2172 +>>>2600 beshort&0x1f0 0x0f0 \b, 16 bit
  2173 +>>>2600 beshort&0x1f0 0x170 \b, 24 bit
  2174 +>>>2600 byte&0xe 0x0 \b, mono
  2175 +>>>2600 byte&0xe 0x2 \b, stereo
  2176 +>>>2600 byte&0xe 0x4 \b, 3 channels
  2177 +>>>2600 byte&0xe 0x6 \b, 4 channels
  2178 +>>>2600 byte&0xe 0x8 \b, 5 channels
  2179 +>>>2600 byte&0xe 0xa \b, 6 channels
  2180 +>>>2600 byte&0xe 0xc \b, 7 channels
  2181 +>>>2600 byte&0xe 0xe \b, 8 channels
  2182 +# some common sample rates
  2183 +>>>2597 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
  2184 +>>>2597 belong&0xfffff0 0x0bb800 \b, 48 kHz
  2185 +>>>2597 belong&0xfffff0 0x07d000 \b, 32 kHz
  2186 +>>>2597 belong&0xfffff0 0x056220 \b, 22.05 kHz
  2187 +>>>2597 belong&0xfffff0 0x05dc00 \b, 24 kHz
  2188 +>>>2597 belong&0xfffff0 0x03e800 \b, 16 kHz
  2189 +>>>2597 belong&0xfffff0 0x02b110 \b, 11.025 kHz
  2190 +>>>2597 belong&0xfffff0 0x02ee00 \b, 12 kHz
  2191 +>>>2597 belong&0xfffff0 0x01f400 \b, 8 kHz
  2192 +>>>2597 belong&0xfffff0 0x177000 \b, 96 kHz
  2193 +>>>2597 belong&0xfffff0 0x0fa000 \b, 64 kHz
  2194 +>>>2601 byte&0xf >0 \b, >4G samples
  2195 +>2584 string !fLaC \b, MP3 encoding
  2196 +
  2197 +# NSF (NES sound file) magic
  2198 +0 string NESM\x1a NES Sound File
  2199 +>14 string >\0 ("%s" by
  2200 +>46 string >\0 %s, copyright
  2201 +>78 string >\0 %s),
  2202 +>5 byte x version %d,
  2203 +>6 byte x %d tracks,
  2204 +>122 byte&0x2 =1 dual PAL/NTSC
  2205 +>122 byte&0x1 =1 PAL
  2206 +>122 byte&0x1 =0 NTSC
  2207 +
  2208 +# Impulse tracker module (audio/x-it)
  2209 +0 string IMPM Impulse Tracker module sound data -
  2210 +>4 string >\0 "%s"
  2211 +>40 leshort !0 compatible w/ITv%x
  2212 +>42 leshort !0 created w/ITv%x
  2213 +
  2214 +# Imago Orpheus module (audio/x-imf)
  2215 +60 string IM10 Imago Orpheus module sound data -
  2216 +>0 string >\0 "%s"
  2217 +
  2218 +# From <collver1@attbi.com>
  2219 +# These are the /etc/magic entries to decode modules, instruments, and
  2220 +# samples in Impulse Tracker's native format.
  2221 +
  2222 +0 string IMPS Impulse Tracker Sample
  2223 +>18 byte &2 16 bit
  2224 +>18 byte ^2 8 bit
  2225 +>18 byte &4 stereo
  2226 +>18 byte ^4 mono
  2227 +0 string IMPI Impulse Tracker Instrument
  2228 +>28 leshort !0 ITv%x
  2229 +>30 byte !0 %d samples
  2230 +
  2231 +# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files
  2232 +# From <collver1@attbi.com>
  2233 +0 string LM8953 Yamaha TX Wave
  2234 +>22 byte 0x49 looped
  2235 +>22 byte 0xC9 non-looped
  2236 +>23 byte 1 33kHz
  2237 +>23 byte 2 50kHz
  2238 +>23 byte 3 16kHz
  2239 +
  2240 +# scream tracker: file(1) magic for Scream Tracker sample files
  2241 +#
  2242 +# From <collver1@attbi.com>
  2243 +76 string SCRS Scream Tracker Sample
  2244 +>0 byte 1 sample
  2245 +>0 byte 2 adlib melody
  2246 +>0 byte >2 adlib drum
  2247 +>31 byte &2 stereo
  2248 +>31 byte ^2 mono
  2249 +>31 byte &4 16bit little endian
  2250 +>31 byte ^4 8bit
  2251 +>30 byte 0 unpacked
  2252 +>30 byte 1 packed
  2253 +
  2254 +# audio
  2255 +# From: Cory Dikkers <cdikkers@swbell.net>
  2256 +0 string MMD0 MED music file, version 0
  2257 +0 string MMD1 OctaMED Pro music file, version 1
  2258 +0 string MMD3 OctaMED Soundstudio music file, version 3
  2259 +0 string OctaMEDCmpr OctaMED Soundstudio compressed file
  2260 +0 string MED MED_Song
  2261 +0 string SymM Symphonie SymMOD music file
  2262 +#
  2263 +0 string THX AHX version
  2264 +>3 byte =0 1 module data
  2265 +>3 byte =1 2 module data
  2266 +#
  2267 +0 string OKTASONG Oktalyzer module data
  2268 +#
  2269 +0 string DIGI\ Booster\ module\0 %s
  2270 +>20 byte >0 %c
  2271 +>>21 byte >0 \b%c
  2272 +>>>22 byte >0 \b%c
  2273 +>>>>23 byte >0 \b%c
  2274 +>610 string >\0 \b, "%s"
  2275 +#
  2276 +0 string DBM0 DIGI Booster Pro Module
  2277 +>4 byte >0 V%X.
  2278 +>>5 byte x \b%02X
  2279 +>16 string >\0 \b, "%s"
  2280 +#
  2281 +0 string FTMN FaceTheMusic module
  2282 +>16 string >\0d \b, "%s"
  2283 +
  2284 +# From: <doj@cubic.org> 2003-06-24
  2285 +0 string AMShdr\32 Velvet Studio AMS Module v2.2
  2286 +0 string Extreme Extreme Tracker AMS Module v1.3
  2287 +0 string DDMF Xtracker DMF Module
  2288 +>4 byte x v%i
  2289 +>0xD string >\0 Title: "%s"
  2290 +>0x2B string >\0 Composer: "%s"
  2291 +0 string DSM\32 Dynamic Studio Module DSM
  2292 +0 string SONG DigiTrekker DTM Module
  2293 +0 string DMDL DigiTrakker MDL Module
  2294 +0 string PSM\32 Protracker Studio PSM Module
  2295 +44 string PTMF Poly Tracker PTM Module
  2296 +>0 string >\32 Title: "%s"
  2297 +0 string MT20 MadTracker 2.0 Module MT2
  2298 +0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
  2299 +0 string RTMM RTM Module
  2300 +0x426 string MaDoKaN96 XMS Adlib Module
  2301 +>0 string >\0 Composer: "%s"
  2302 +0 string AMF AMF Module
  2303 +>4 string >\0 Title: "%s"
  2304 +0 string MODINFO1 Open Cubic Player Module Inforation MDZ
  2305 +0 string Extended\40Instrument: Fast Tracker II Instrument
  2306 +
  2307 +# From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
  2308 +# NOA Nancy Codec file
  2309 +0 string \210NOA\015\012\032 NOA Nancy Codec Movie file
  2310 +# Yamaha SMAF format
  2311 +0 string MMMD Yamaha SMAF file
  2312 +# Sharp Jisaku Melody format for PDC
  2313 +0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody
  2314 +>20 string Ver01.00 Ver. 1.00
  2315 +>>32 byte x , %d tracks
  2316 +
  2317 +# Free lossless audio codec <http://flac.sourceforge.net>
  2318 +# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
  2319 +0 string fLaC FLAC audio bitstream data
  2320 +>4 byte&0x7f >0 \b, unknown version
  2321 +>4 byte&0x7f 0 \b
  2322 +# some common bits/sample values
  2323 +>>20 beshort&0x1f0 0x030 \b, 4 bit
  2324 +>>20 beshort&0x1f0 0x050 \b, 6 bit
  2325 +>>20 beshort&0x1f0 0x070 \b, 8 bit
  2326 +>>20 beshort&0x1f0 0x0b0 \b, 12 bit
  2327 +>>20 beshort&0x1f0 0x0f0 \b, 16 bit
  2328 +>>20 beshort&0x1f0 0x170 \b, 24 bit
  2329 +>>20 byte&0xe 0x0 \b, mono
  2330 +>>20 byte&0xe 0x2 \b, stereo
  2331 +>>20 byte&0xe 0x4 \b, 3 channels
  2332 +>>20 byte&0xe 0x6 \b, 4 channels
  2333 +>>20 byte&0xe 0x8 \b, 5 channels
  2334 +>>20 byte&0xe 0xa \b, 6 channels
  2335 +>>20 byte&0xe 0xc \b, 7 channels
  2336 +>>20 byte&0xe 0xe \b, 8 channels
  2337 +# some common sample rates
  2338 +>>17 belong&0xfffff0 0x0ac440 \b, 44.1 kHz
  2339 +>>17 belong&0xfffff0 0x0bb800 \b, 48 kHz
  2340 +>>17 belong&0xfffff0 0x07d000 \b, 32 kHz
  2341 +>>17 belong&0xfffff0 0x056220 \b, 22.05 kHz
  2342 +>>17 belong&0xfffff0 0x05dc00 \b, 24 kHz
  2343 +>>17 belong&0xfffff0 0x03e800 \b, 16 kHz
  2344 +>>17 belong&0xfffff0 0x02b110 \b, 11.025 kHz
  2345 +>>17 belong&0xfffff0 0x02ee00 \b, 12 kHz
  2346 +>>17 belong&0xfffff0 0x01f400 \b, 8 kHz
  2347 +>>17 belong&0xfffff0 0x177000 \b, 96 kHz
  2348 +>>17 belong&0xfffff0 0x0fa000 \b, 64 kHz
  2349 +>>21 byte&0xf >0 \b, >4G samples
  2350 +>>21 byte&0xf 0 \b
  2351 +>>>22 belong >0 \b, %u samples
  2352 +>>>22 belong 0 \b, length unknown
  2353 +
  2354 +# (ISDN) VBOX voice message file (Wolfram Kleff)
  2355 +0 string VBOX VBOX voice message data
  2356 +
  2357 +# ReBorn Song Files (.rbs)
  2358 +# David J. Singer <doc@deadvirgins.org.uk>
  2359 +8 string RB40 RBS Song file
  2360 +>29 string ReBorn created by ReBorn
  2361 +>37 string Propellerhead created by ReBirth
  2362 +
  2363 +# Synthesizer Generator and Kimwitu share their file format
  2364 +0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data
  2365 +# Kimwitu++ uses a slightly different magic
  2366 +0 string A#S#C#S#S#L#HUB Kimwitu++ data
  2367 +
  2368 +# From "Simon Hosie
  2369 +0 string TFMX-SONG TFMX module sound data
  2370 +
  2371 +# Monkey's Audio compressed audio format (.ape)
  2372 +# From danny.milo@gmx.net (Danny Milosavljevic)
  2373 +# New version from Abel Cheung <abel (@) oaka.org>
  2374 +0 string MAC\040 Monkey's Audio compressed format
  2375 +>4 uleshort >0x0F8B version %d
  2376 +>>(0x08.l) uleshort =1000 with fast compression
  2377 +>>(0x08.l) uleshort =2000 with normal compression
  2378 +>>(0x08.l) uleshort =3000 with high compression
  2379 +>>(0x08.l) uleshort =4000 with extra high compression
  2380 +>>(0x08.l) uleshort =5000 with insane compression
  2381 +>>(0x08.l+18) uleshort =1 \b, mono
  2382 +>>(0x08.l+18) uleshort =2 \b, stereo
  2383 +>>(0x08.l+20) ulelong x \b, sample rate %d
  2384 +>4 uleshort <0x0F8C version %d
  2385 +>>6 uleshort =1000 with fast compression
  2386 +>>6 uleshort =2000 with normal compression
  2387 +>>6 uleshort =3000 with high compression
  2388 +>>6 uleshort =4000 with extra high compression
  2389 +>>6 uleshort =5000 with insane compression
  2390 +>>10 uleshort =1 \b, mono
  2391 +>>10 uleshort =2 \b, stereo
  2392 +>>12 ulelong x \b, sample rate %d
  2393 +
  2394 +# adlib sound files
  2395 +# From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
  2396 +0 string RAWADATA RdosPlay RAW
  2397 +
  2398 +1068 string RoR AMUSIC Adlib Tracker
  2399 +
  2400 +0 string JCH EdLib
  2401 +
  2402 +0 string mpu401tr MPU-401 Trakker
  2403 +
  2404 +0 string SAdT Surprise! Adlib Tracker
  2405 +>4 byte x Version %d
  2406 +
  2407 +0 string XAD! eXotic ADlib
  2408 +
  2409 +0 string ofTAZ! eXtra Simple Music
  2410 +
  2411 +# Spectrum 128 tunes (.ay files).
  2412 +# From: Emanuel Haupt <ehaupt@critical.ch>
  2413 +0 string ZXAYEMUL Spectrum 128 tune
  2414 +
  2415 +0 string \0BONK BONK,
  2416 +#>5 byte x version %d
  2417 +>14 byte x %d channel(s),
  2418 +>15 byte =1 lossless,
  2419 +>15 byte =0 lossy,
  2420 +>16 byte x mid-side
  2421 +
  2422 +384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones)
  2423 +
  2424 +# format VQF (proprietary codec for sound)
  2425 +# some infos on the header file available at :
  2426 +# http://www.twinvq.org/english/technology_format.html
  2427 +0 string TWIN97012000 VQF data
  2428 +>27 short 0 \b, Mono
  2429 +>27 short 1 \b, Stereo
  2430 +>31 short >0 \b, %d kbit/s
  2431 +>35 short >0 \b, %d kHz
  2432 +
  2433 +# Nelson A. de Oliveira (naoliv@gmail.com)
  2434 +# .eqf
  2435 +0 string Winamp\ EQ\ library\ file %s
  2436 +# it will match only versions like v<digit>.<digit>
  2437 +# Since I saw only eqf files with version v1.1 I think that it's OK
  2438 +>23 string x \b%.4s
  2439 +# .preset
  2440 +0 string [Equalizer\ preset] XMMS equalizer preset
  2441 +# .m3u
  2442 +0 string #EXTM3U M3U playlist
  2443 +# .pls
  2444 +0 string [playlist] PLS playlist
  2445 +# licq.conf
  2446 +1 string [licq] LICQ configuration file
  2447 +
  2448 +# Atari ST audio files by Dirk Jagdmann <doj@cubic.org>
  2449 +0 string ICE! SNDH Atari ST music
  2450 +0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music
  2451 +
  2452 +# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com>
  2453 +0 string MP+ Musepack audio
  2454 +>3 byte 255 \b, SV pre8
  2455 +>3 byte&0xF 0x6 \b, SV 6
  2456 +>3 byte&0xF 0x8 \b, SV 8
  2457 +>3 byte&0xF 0x7 \b, SV 7
  2458 +>>3 byte&0xF0 0x0 \b.0
  2459 +>>3 byte&0xF0 0x10 \b.1
  2460 +>>3 byte&0xF0 240 \b.15
  2461 +>>10 byte&0xF0 0x0 \b, no profile
  2462 +>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental'
  2463 +>>10 byte&0xF0 0x50 \b, quality 0
  2464 +>>10 byte&0xF0 0x60 \b, quality 1
  2465 +>>10 byte&0xF0 0x70 \b, quality 2 (Telephone)
  2466 +>>10 byte&0xF0 0x80 \b, quality 3 (Thumb)
  2467 +>>10 byte&0xF0 0x90 \b, quality 4 (Radio)
  2468 +>>10 byte&0xF0 0xA0 \b, quality 5 (Standard)
  2469 +>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme)
  2470 +>>10 byte&0xF0 0xC0 \b, quality 7 (Insane)
  2471 +>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead)
  2472 +>>10 byte&0xF0 0xE0 \b, quality 9
  2473 +>>10 byte&0xF0 0xF0 \b, quality 10
  2474 +>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
  2475 +>>27 byte 102 \b, Beta 1.02
  2476 +>>27 byte 104 \b, Beta 1.04
  2477 +>>27 byte 105 \b, Alpha 1.05
  2478 +>>27 byte 106 \b, Beta 1.06
  2479 +>>27 byte 110 \b, Release 1.1
  2480 +>>27 byte 111 \b, Alpha 1.11
  2481 +>>27 byte 112 \b, Beta 1.12
  2482 +>>27 byte 113 \b, Alpha 1.13
  2483 +>>27 byte 114 \b, Beta 1.14
  2484 +>>27 byte 115 \b, Alpha 1.15
  2485 +
  2486 +# IMY
  2487 +# from http://filext.com/detaillist.php?extdetail=IMY
  2488 +# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
  2489 +# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
  2490 +# http://www.wx800.com/msg/download/irda/iMelody.pdf
  2491 +0 string BEGIN:IMELODY iMelody Ringtone Format
  2492 +
  2493 +# From: Matthew Flaschen <matthew.flaschen@gatech.edu>
  2494 +0 string #EXTM3U M3U playlist text
  2495 +
  2496 +#----------------------------------------------------------------
  2497 +# basis: file(1) magic for BBx/Pro5-files
  2498 +# Oliver Dammer <dammer@olida.de> 2005/11/07
  2499 +# http://www.basis.com business-basic-files.
  2500 +#
  2501 +0 string \074\074bbx\076\076 BBx
  2502 +>7 string \000 indexed file
  2503 +>7 string \001 serial file
  2504 +>7 string \002 keyed file
  2505 +>>13 short 0 (sort)
  2506 +>7 string \004 program
  2507 +>>18 byte x (LEVEL %d)
  2508 +>>>23 string >\000 psaved
  2509 +>7 string \006 mkeyed file
  2510 +>>13 short 0 (sort)
  2511 +>>8 string \000 (mkey)
  2512 +#------------------------------------------------------------------------------
  2513 +# bFLT: file(1) magic for BFLT uclinux binary files
  2514 +#
  2515 +# From Philippe De Muyter <phdm@macqel.be>
  2516 +#
  2517 +0 string bFLT BFLT executable
  2518 +>4 belong x - version %ld
  2519 +>4 belong 4
  2520 +>>36 belong&0x1 0x1 ram
  2521 +>>36 belong&0x2 0x2 gotpic
  2522 +>>36 belong&0x4 0x4 gzip
  2523 +>>36 belong&0x8 0x8 gzdata
  2524 +#------------------------------------------------------------------------------
  2525 +# blender: file(1) magic for Blender 3D data files
  2526 +#
  2527 +# Coded by Guillermo S. Romero <gsromero@alumnos.euitt.upm.es> using the
  2528 +# data from Ton Roosendaal <ton@blender.nl>. Ton or his company do not
  2529 +# support the rule, so mail GSR if problems with it. Rule version: 1.1.
  2530 +# You can get latest version with comments and details about the format
  2531 +# at http://acd.asoc.euitt.upm.es/~gsromero/3d/blender/magic.blender
  2532 +
  2533 +0 string =BLENDER Blender3D,
  2534 +>7 string =_ saved as 32-bits
  2535 +>7 string =- saved as 64-bits
  2536 +>8 string =v little endian
  2537 +>8 string =V big endian
  2538 +>9 byte x with version %c.
  2539 +>10 byte x \b%c
  2540 +>11 byte x \b%c
  2541 +
  2542 +#------------------------------------------------------------------------------
  2543 +# blit: file(1) magic for 68K Blit stuff as seen from 680x0 machine
  2544 +#
  2545 +# Note that this 0407 conflicts with several other a.out formats...
  2546 +#
  2547 +# XXX - should this be redone with "be" and "le", so that it works on
  2548 +# little-endian machines as well? If so, what's the deal with
  2549 +# "VAX-order" and "VAX-order2"?
  2550 +#
  2551 +#0 long 0407 68K Blit (standalone) executable
  2552 +#0 short 0407 VAX-order2 68K Blit (standalone) executable
  2553 +0 short 03401 VAX-order 68K Blit (standalone) executable
  2554 +0 long 0406 68k Blit mpx/mux executable
  2555 +0 short 0406 VAX-order2 68k Blit mpx/mux executable
  2556 +0 short 03001 VAX-order 68k Blit mpx/mux executable
  2557 +# Need more values for WE32 DMD executables.
  2558 +# Note that 0520 is the same as COFF
  2559 +#0 short 0520 tty630 layers executable
  2560 +#
  2561 +# i80960 b.out objects and archives
  2562 +#
  2563 +0 long 0x10d i960 b.out relocatable object
  2564 +>16 long >0 not stripped
  2565 +#
  2566 +# b.out archive (hp-rt on i960)
  2567 +0 string =!<bout> b.out archive
  2568 +>8 string __.SYMDEF random library
  2569 +#------------------------------------------------------------------------------
  2570 +# bsdi: file(1) magic for BSD/OS (from BSDI) objects
  2571 +#
  2572 +
  2573 +0 lelong 0314 386 compact demand paged pure executable
  2574 +>16 lelong >0 not stripped
  2575 +>32 byte 0x6a (uses shared libs)
  2576 +
  2577 +0 lelong 0407 386 executable
  2578 +>16 lelong >0 not stripped
  2579 +>32 byte 0x6a (uses shared libs)
  2580 +
  2581 +0 lelong 0410 386 pure executable
  2582 +>16 lelong >0 not stripped
  2583 +>32 byte 0x6a (uses shared libs)
  2584 +
  2585 +0 lelong 0413 386 demand paged pure executable
  2586 +>16 lelong >0 not stripped
  2587 +>32 byte 0x6a (uses shared libs)
  2588 +
  2589 +# same as in SunOS 4.x, except for static shared libraries
  2590 +0 belong&077777777 0600413 sparc demand paged
  2591 +>0 byte &0x80
  2592 +>>20 belong <4096 shared library
  2593 +>>20 belong =4096 dynamically linked executable
  2594 +>>20 belong >4096 dynamically linked executable
  2595 +>0 byte ^0x80 executable
  2596 +>16 belong >0 not stripped
  2597 +>36 belong 0xb4100001 (uses shared libs)
  2598 +
  2599 +0 belong&077777777 0600410 sparc pure
  2600 +>0 byte &0x80 dynamically linked executable
  2601 +>0 byte ^0x80 executable
  2602 +>16 belong >0 not stripped
  2603 +>36 belong 0xb4100001 (uses shared libs)
  2604 +
  2605 +0 belong&077777777 0600407 sparc
  2606 +>0 byte &0x80 dynamically linked executable
  2607 +>0 byte ^0x80 executable
  2608 +>16 belong >0 not stripped
  2609 +>36 belong 0xb4100001 (uses shared libs)
  2610 +#------------------------------------------------------------------------------
  2611 +# BTSnoop: file(1) magic for BTSnoop files
  2612 +#
  2613 +# From <marcel@holtmann.org>
  2614 +0 string btsnoop\0 BTSnoop
  2615 +>8 belong x version %d,
  2616 +>12 belong 1001 Unencapsulated HCI
  2617 +>12 belong 1002 HCI UART (H4)
  2618 +>12 belong 1003 HCI BCSP
  2619 +>12 belong 1004 HCI Serial (H5)
  2620 +>>12 belong x type %d
  2621 +
  2622 +#------------------------------------------------------------------------------
  2623 +# autocad: file(1) magic for cad files
  2624 +#
  2625 +
  2626 +# AutoCAD DWG versions R13/R14 (www.autodesk.com)
  2627 +# Written December 01, 2003 by Lester Hightower
  2628 +# Based on the DWG File Format Specifications at http://www.opendwg.org/
  2629 +0 string \101\103\061\060\061 AutoCAD
  2630 +>5 string \062\000\000\000\000 DWG ver. R13
  2631 +>5 string \064\000\000\000\000 DWG ver. R14
  2632 +
  2633 +# Microstation DGN/CIT Files (www.bentley.com)
  2634 +# Last updated July 29, 2005 by Lester Hightower
  2635 +# DGN is the default file extension of Microstation/Intergraph CAD files.
  2636 +# CIT is the proprietary raster format (similar to TIFF) used to attach
  2637 +# raster underlays to Microstation DGN (vector) drawings.
  2638 +#
  2639 +# http://www.wotsit.org/search.asp
  2640 +# http://filext.com/detaillist.php?extdetail=DGN
  2641 +# http://filext.com/detaillist.php?extdetail=CIT
  2642 +#
  2643 +# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
  2644 +# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
  2645 +# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
  2646 +# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
  2647 +0 string \010\011\376 Microstation
  2648 +>3 string \002
  2649 +>>30 string \026\105 DGNFile
  2650 +>>30 string \034\105 DGNFile
  2651 +>>30 string \073\107 DGNFile
  2652 +>>30 string \073\110 DGNFile
  2653 +>>30 string \106\107 DGNFile
  2654 +>>30 string \110\103 DGNFile
  2655 +>>30 string \120\104 DGNFile
  2656 +>>30 string \172\104 DGNFile
  2657 +>>30 string \172\105 DGNFile
  2658 +>>30 string \172\106 DGNFile
  2659 +>>30 string \234\106 DGNFile
  2660 +>>30 string \273\105 DGNFile
  2661 +>>30 string \306\106 DGNFile
  2662 +>>30 string \310\104 DGNFile
  2663 +>>30 string \341\104 DGNFile
  2664 +>>30 string \372\103 DGNFile
  2665 +>>30 string \372\104 DGNFile
  2666 +>>30 string \372\106 DGNFile
  2667 +>>30 string \376\103 DGNFile
  2668 +>4 string \030\000\000 CITFile
  2669 +>4 string \030\000\003 CITFile
  2670 +
  2671 +# AutoCad, from Nahuel Greco
  2672 +# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
  2673 +0 string AC1012 AutoCad (release 12)
  2674 +0 string AC1013 AutoCad (release 13)
  2675 +0 string AC1014 AutoCad (release 14)
  2676 +
  2677 +# CAD: file(1) magic for computer aided design files
  2678 +# Phillip Griffith <phillip dot griffith at gmail dot com>
  2679 +# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications.
  2680 +#
  2681 +0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library
  2682 +0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD
  2683 +0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD
  2684 +0 beshort 0x0809 Bentley/Intergraph MicroStation
  2685 +>0x02 byte 0xfe
  2686 +>>0x04 beshort 0x1800 CIT raster CAD
  2687 +0 string AC1012 AutoDesk AutoCAD R13
  2688 +0 string AC1014 AutoDesk AutoCAD R14
  2689 +0 string AC1015 AutoDesk AutoCAD R2000
  2690 +#------------------------------------------------------------------------------
  2691 +# Cafe Babes unite!
  2692 +#
  2693 +# Since Java bytecode and Mach-O fat-files have the same magic number, the test
  2694 +# must be performed in the same "magic" sequence to get both right. The long
  2695 +# at offset 4 in a mach-O fat file tells the number of architectures; the short at
  2696 +# offset 4 in a Java bytecode file is the JVM minor version and the
  2697 +# short at offset 6 is the JVM major version. Since there are only
  2698 +# only 18 labeled Mach-O architectures at current, and the first released
  2699 +# Java class format was version 43.0, we can safely choose any number
  2700 +# between 18 and 39 to test the number of architectures against
  2701 +# (and use as a hack). Let's not use 18, because the Mach-O people
  2702 +# might add another one or two as time goes by...
  2703 +#
  2704 +0 belong 0xcafebabe
  2705 +>4 belong >30 compiled Java class data,
  2706 +>>6 beshort x version %d.
  2707 +>>4 beshort x \b%d
  2708 +>4 belong 1 Mach-O fat file with 1 architecture
  2709 +>4 belong >1
  2710 +>>4 belong <20 Mach-O fat file with %ld architectures
  2711 +
  2712 +#------------------------------------------------------------------------------
  2713 +# c-lang: file(1) magic for C programs (or REXX)
  2714 +#
  2715 +
  2716 +# XPM icons (Greg Roelofs, newt@uchicago.edu)
  2717 +# if you uncomment "/*" for C/REXX below, also uncomment this entry
  2718 +#0 string /*\ XPM\ */ X pixmap image data
  2719 +
  2720 +# this first will upset you if you're a PL/1 shop...
  2721 +# in which case rm it; ascmagic will catch real C programs
  2722 +#0 string /* C or REXX program text
  2723 +#0 string // C++ program text
  2724 +
  2725 +# From: Mikhail Teterin <mi@aldan.algebra.com>
  2726 +0 string cscope cscope reference data
  2727 +>7 string x version %.2s
  2728 +# We skip the path here, because it is often long (so file will
  2729 +# truncate it) and mostly redundant.
  2730 +# The inverted index functionality was added some time betwen
  2731 +# versions 11 and 15, so look for -q if version is above 14:
  2732 +>7 string >14
  2733 +>>10 regex .+\ -q\ with inverted index
  2734 +>10 regex .+\ -c\ text (non-compressed)
  2735 +
  2736 +#------------------------------------------------------------------------------
  2737 +# c64: file(1) magic for various commodore 64 related files
  2738 +#
  2739 +# From: Dirk Jagdmann <doj@cubic.org>
  2740 +
  2741 +0x16500 belong 0x12014100 D64 Image
  2742 +0x16500 belong 0x12014180 D71 Image
  2743 +0x61800 belong 0x28034400 D81 Image
  2744 +0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image
  2745 +0 belong 0x43154164 X64 Image
  2746 +
  2747 +0 string GCR-1541 GCR Image
  2748 +>8 byte x version: %i
  2749 +>9 byte x tracks: %i
  2750 +
  2751 +9 string PSUR ARC archive (c64)
  2752 +2 string -LH1- LHA archive (c64)
  2753 +
  2754 +0 string C64File PC64 Emulator file
  2755 +>8 string >\0 "%s"
  2756 +0 string C64Image PC64 Freezer Image
  2757 +
  2758 +0 beshort 0x38CD C64 PCLink Image
  2759 +0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot
  2760 +
  2761 +0 belong 0xFF424CFF WRAptor packer (c64)
  2762 +
  2763 +0 string C64S\x20tape\x20file T64 tape Image
  2764 +>32 leshort x Version:0x%x
  2765 +>36 leshort !0 Entries:%i
  2766 +>40 string x Name:%.24s
  2767 +
  2768 +0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
  2769 +>32 leshort x Version:0x%x
  2770 +>36 leshort !0 Entries:%i
  2771 +>40 string x Name:%.24s
  2772 +
  2773 +0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image
  2774 +>32 leshort x Version:0x%x
  2775 +>36 leshort !0 Entries:%i
  2776 +>40 string x Name:%.24s
  2777 +
  2778 +#------------------------------------------------------------------------------
  2779 +# CDDB: file(1) magic for CDDB(tm) format CD text data files
  2780 +#
  2781 +# From <steve@gracenote.com>
  2782 +#
  2783 +# This is the /etc/magic entry to decode datafiles as used by
  2784 +# CDDB-enabled CD player applications.
  2785 +#
  2786 +
  2787 +0 string/b #\040xmcd CDDB(tm) format CD text data
  2788 +
  2789 +#------------------------------------------------------------------------------
  2790 +# chord: file(1) magic for Chord music sheet typesetting utility input files
  2791 +#
  2792 +# From Philippe De Muyter <phdm@macqel.be>
  2793 +# File format is actually free, but many distributed files begin with `{title'
  2794 +#
  2795 +0 string {title Chord text file
  2796 +
  2797 +#------------------------------------------------------------------------------
  2798 +# cisco: file(1) magic for cisco Systems routers
  2799 +#
  2800 +# Most cisco file-formats are covered by the generic elf code
  2801 +#
  2802 +# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
  2803 +0 belong&0xffffff00 0x85011400 cisco IOS microcode
  2804 +>7 string >\0 for '%s'
  2805 +0 belong&0xffffff00 0x8501cb00 cisco IOS experimental microcode
  2806 +>7 string >\0 for '%s'
  2807 +#------------------------------------------------------------------------------
  2808 +# citrus locale declaration
  2809 +#
  2810 +
  2811 +0 string RuneCT Citrus locale declaration for LC_CTYPE
  2812 +
  2813 +
  2814 +#------------------------------------------------------------------------------
  2815 +# claris: file(1) magic for claris
  2816 +# "H. Nanosecond" <aldomel@ix.netcom.com>
  2817 +# Claris Works a word processor, etc.
  2818 +# Version 3.0
  2819 +
  2820 +# .pct claris works clip art files
  2821 +#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
  2822 +#*
  2823 +#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
  2824 +#null to byte 1000 octal
  2825 +514 string \377\377\377\377\000 Claris clip art?
  2826 +>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
  2827 +514 string \377\377\377\377\001 Claris clip art?
  2828 +>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
  2829 +
  2830 +# Claris works files
  2831 +# .cwk
  2832 +0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
  2833 +# .plt
  2834 +0 string \020\341\000\000\010\010 Claris Works pallete files .plt
  2835 +
  2836 +# .msp a dictionary file I am not sure about this I have only one .msp file
  2837 +0 string \002\271\262\000\040\002\000\164 Claris works dictionary
  2838 +
  2839 +# .usp are user dictionary bits
  2840 +# I am not sure about a magic header:
  2841 +#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
  2842 +# soh S p f 8 U D sp ^ S cr nl p o d i
  2843 +#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
  2844 +# a t r i s t sp ^ S cr nl d i v sp #
  2845 +
  2846 +# .mth Thesaurus
  2847 +# starts with \0 but no magic header
  2848 +
  2849 +# .chy Hyphenation file
  2850 +# I am not sure: 000 210 034 000 000
  2851 +
  2852 +# other claris files
  2853 +#./windows/claris/useng.ndx: data
  2854 +#./windows/claris/xtndtran.l32: data
  2855 +#./windows/claris/xtndtran.lst: data
  2856 +#./windows/claris/clworks.lbl: data
  2857 +#./windows/claris/clworks.prf: data
  2858 +#./windows/claris/userd.spl: data
  2859 +
  2860 +#------------------------------------------------------------------------------
  2861 +# clipper: file(1) magic for Intergraph (formerly Fairchild) Clipper.
  2862 +#
  2863 +# XXX - what byte order does the Clipper use?
  2864 +#
  2865 +# XXX - what's the "!" stuff:
  2866 +#
  2867 +# >18 short !074000,000000 C1 R1
  2868 +# >18 short !074000,004000 C2 R1
  2869 +# >18 short !074000,010000 C3 R1
  2870 +# >18 short !074000,074000 TEST
  2871 +#
  2872 +# I shall assume it's ANDing the field with the first value and
  2873 +# comparing it with the second, and rewrite it as:
  2874 +#
  2875 +# >18 short&074000 000000 C1 R1
  2876 +# >18 short&074000 004000 C2 R1
  2877 +# >18 short&074000 010000 C3 R1
  2878 +# >18 short&074000 074000 TEST
  2879 +#
  2880 +# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
  2881 +# sort, nor does SunOS 4.x, so either it's something Intergraph added
  2882 +# in CLIX, or something AT&T added in SVR3.2 or later, or something
  2883 +# somebody else thought was a good idea; it's not documented in the
  2884 +# man page for this version of "magic", nor does it appear to be
  2885 +# implemented (at least not after I blew off the bogus code to turn
  2886 +# old-style "&"s into new-style "&"s, which just didn't work at all).
  2887 +#
  2888 +0 short 0575 CLIPPER COFF executable (VAX #)
  2889 +>20 short 0407 (impure)
  2890 +>20 short 0410 (5.2 compatible)
  2891 +>20 short 0411 (pure)
  2892 +>20 short 0413 (demand paged)
  2893 +>20 short 0443 (target shared library)
  2894 +>12 long >0 not stripped
  2895 +>22 short >0 - version %ld
  2896 +0 short 0577 CLIPPER COFF executable
  2897 +>18 short&074000 000000 C1 R1
  2898 +>18 short&074000 004000 C2 R1
  2899 +>18 short&074000 010000 C3 R1
  2900 +>18 short&074000 074000 TEST
  2901 +>20 short 0407 (impure)
  2902 +>20 short 0410 (pure)
  2903 +>20 short 0411 (separate I&D)
  2904 +>20 short 0413 (paged)
  2905 +>20 short 0443 (target shared library)
  2906 +>12 long >0 not stripped
  2907 +>22 short >0 - version %ld
  2908 +>48 long&01 01 alignment trap enabled
  2909 +>52 byte 1 -Ctnc
  2910 +>52 byte 2 -Ctsw
  2911 +>52 byte 3 -Ctpw
  2912 +>52 byte 4 -Ctcb
  2913 +>53 byte 1 -Cdnc
  2914 +>53 byte 2 -Cdsw
  2915 +>53 byte 3 -Cdpw
  2916 +>53 byte 4 -Cdcb
  2917 +>54 byte 1 -Csnc
  2918 +>54 byte 2 -Cssw
  2919 +>54 byte 3 -Cspw
  2920 +>54 byte 4 -Cscb
  2921 +4 string pipe CLIPPER instruction trace
  2922 +4 string prof CLIPPER instruction profile
  2923 +
  2924 +#------------------------------------------------------------------------------
  2925 +# cracklib: file (1) magic for cracklib v2.7
  2926 +
  2927 +0 lelong 0x70775631 Cracklib password index, little endian
  2928 +>4 long >0 (%i words)
  2929 +>4 long 0 ("64-bit")
  2930 +>>8 long >-1 (%i words)
  2931 +0 belong 0x70775631 Cracklib password index, big endian
  2932 +>4 belong >-1 (%i words)
  2933 +# really bellong 0x0000000070775631
  2934 +4 belong 0x70775631 Cracklib password index, big endian ("64-bit")
  2935 +>12 belong >0 (%i words)
  2936 +
  2937 +#------------------------------------------------------------------------------
  2938 +# spec: file(1) magic for SPEC raw results (*.raw, *.rsf)
  2939 +#
  2940 +# Cloyce D. Spradling <cloyce@headgear.org>
  2941 +
  2942 +0 string spec SPEC
  2943 +>4 string .cpu CPU
  2944 +>>8 string <: \b%.4s
  2945 +>>12 string . raw result text
  2946 +
  2947 +17 string version=SPECjbb SPECjbb
  2948 +>32 string <: \b%.4s
  2949 +>>37 string <: v%.4s raw result text
  2950 +
  2951 +0 string BEGIN\040SPECWEB SPECweb
  2952 +>13 string <: \b%.2s
  2953 +>>15 string _SSL \b_SSL
  2954 +>>>20 string <: v%.4s raw result text
  2955 +>>16 string <: v%.4s raw result text
  2956 +
  2957 +#------------------------------------------------------------------------------
  2958 +# commands: file(1) magic for various shells and interpreters
  2959 +#
  2960 +0 string : shell archive or script for antique kernel text
  2961 +0 string/b #!\ /bin/sh Bourne shell script text executable
  2962 +0 string/b #!\ /bin/csh C shell script text executable
  2963 +# korn shell magic, sent by George Wu, gwu@clyde.att.com
  2964 +0 string/b #!\ /bin/ksh Korn shell script text executable
  2965 +0 string/b #!\ /bin/tcsh Tenex C shell script text executable
  2966 +0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable
  2967 +0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable
  2968 +
  2969 +#
  2970 +# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
  2971 +0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable
  2972 +0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable
  2973 +0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable
  2974 +0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable
  2975 +0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable
  2976 +0 string/b #!\ /bin/nawk new awk script text executable
  2977 +0 string/b #!\ /usr/bin/nawk new awk script text executable
  2978 +0 string/b #!\ /usr/local/bin/nawk new awk script text executable
  2979 +0 string/b #!\ /bin/gawk GNU awk script text executable
  2980 +0 string/b #!\ /usr/bin/gawk GNU awk script text executable
  2981 +0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable
  2982 +#
  2983 +0 string/b #!\ /bin/awk awk script text executable
  2984 +0 string/b #!\ /usr/bin/awk awk script text executable
  2985 +# update to distinguish from *.vcf files
  2986 +0 regex BEGIN[[:space:]]*[{] awk script text
  2987 +
  2988 +# AT&T Bell Labs' Plan 9 shell
  2989 +0 string/b #!\ /bin/rc Plan 9 rc shell script text executable
  2990 +
  2991 +# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
  2992 +0 string/b #!\ /bin/bash Bourne-Again shell script text executable
  2993 +0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable
  2994 +
  2995 +# using env
  2996 +0 string #!/usr/bin/env a
  2997 +>15 string >\0 %s script text executable
  2998 +0 string #!\ /usr/bin/env a
  2999 +>16 string >\0 %s script text executable
  3000 +
  3001 +# PHP scripts
  3002 +# Ulf Harnhammar <ulfh@update.uu.se>
  3003 +0 string/c =<?php PHP script text
  3004 +0 string =<?\n PHP script text
  3005 +0 string =<?\r PHP script text
  3006 +0 string/b #!\ /usr/local/bin/php PHP script text executable
  3007 +0 string/b #!\ /usr/bin/php PHP script text executable
  3008 +
  3009 +0 string Zend\x00 PHP script Zend Optimizer data
  3010 +
  3011 +0 string $! DCL command file
  3012 +
  3013 +#----------------------------------------------------------------------------
  3014 +# communication
  3015 +
  3016 +# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
  3017 +# It is used for conformance testing of communication protocols.
  3018 +# Added by W. Borgert <debacle@debian.org>.
  3019 +0 string $Suite TTCN Abstract Test Suite
  3020 +>&1 string $SuiteId
  3021 +>>&1 string >\n %s
  3022 +>&2 string $SuiteId
  3023 +>>&1 string >\n %s
  3024 +>&3 string $SuiteId
  3025 +>>&1 string >\n %s
  3026 +
  3027 +# MSC (message sequence charts) are a formal description technique,
  3028 +# described in ITU-T Z.120, mainly used for communication protocols.
  3029 +# Added by W. Borgert <debacle@debian.org>.
  3030 +0 string mscdocument Message Sequence Chart (document)
  3031 +0 string msc Message Sequence Chart (chart)
  3032 +0 string submsc Message Sequence Chart (subchart)
  3033 +
  3034 +#------------------------------------------------------------------------------
  3035 +# compress: file(1) magic for pure-compression formats (no archives)
  3036 +#
  3037 +# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
  3038 +#
  3039 +# Formats for various forms of compressed data
  3040 +# Formats for "compress" proper have been moved into "compress.c",
  3041 +# because it tries to uncompress it to figure out what's inside.
  3042 +
  3043 +# standard unix compress
  3044 +0 string \037\235 compress'd data
  3045 +>2 byte&0x80 >0 block compressed
  3046 +>2 byte&0x1f x %d bits
  3047 +
  3048 +# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
  3049 +# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
  3050 +# * Original filename is only at offset 10 if "extra field" absent
  3051 +# * Produce shorter output - notably, only report compression methods
  3052 +# other than 8 ("deflate", the only method defined in RFC 1952).
  3053 +0 string \037\213 gzip compressed data
  3054 +>2 byte <8 \b, reserved method
  3055 +>2 byte >8 \b, unknown method
  3056 +>3 byte &0x01 \b, ASCII
  3057 +>3 byte &0x02 \b, has CRC
  3058 +>3 byte &0x04 \b, extra field
  3059 +>3 byte&0xC =0x08
  3060 +>>10 string x \b, was "%s"
  3061 +>3 byte &0x10 \b, has comment
  3062 +>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT)
  3063 +>9 byte =0x01 \b, from Amiga
  3064 +>9 byte =0x02 \b, from VMS
  3065 +>9 byte =0x03 \b, from Unix
  3066 +>9 byte =0x04 \b, from VM/CMS
  3067 +>9 byte =0x05 \b, from Atari
  3068 +>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT)
  3069 +>9 byte =0x07 \b, from MacOS
  3070 +>9 byte =0x08 \b, from Z-System
  3071 +>9 byte =0x09 \b, from CP/M
  3072 +>9 byte =0x0A \b, from TOPS/20
  3073 +>9 byte =0x0B \b, from NTFS filesystem (NT)
  3074 +>9 byte =0x0C \b, from QDOS
  3075 +>9 byte =0x0D \b, from Acorn RISCOS
  3076 +>3 byte &0x10 \b, comment
  3077 +>3 byte &0x20 \b, encrypted
  3078 +>4 ledate >0 \b, last modified: %s
  3079 +>8 byte 2 \b, max compression
  3080 +>8 byte 4 \b, max speed
  3081 +
  3082 +# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
  3083 +0 string \037\036 packed data
  3084 +>2 belong >1 \b, %d characters originally
  3085 +>2 belong =1 \b, %d character originally
  3086 +#
  3087 +# This magic number is byte-order-independent.
  3088 +0 short 0x1f1f old packed data
  3089 +
  3090 +# XXX - why *two* entries for "compacted data", one of which is
  3091 +# byte-order independent, and one of which is byte-order dependent?
  3092 +#
  3093 +0 short 0x1fff compacted data
  3094 +# This string is valid for SunOS (BE) and a matching "short" is listed
  3095 +# in the Ultrix (LE) magic file.
  3096 +0 string \377\037 compacted data
  3097 +0 short 0145405 huf output
  3098 +
  3099 +# bzip2
  3100 +0 string BZh bzip2 compressed data
  3101 +>3 byte >47 \b, block size = %c00k
  3102 +
  3103 +# squeeze and crunch
  3104 +# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
  3105 +0 beshort 0x76FF squeezed data,
  3106 +>4 string x original name %s
  3107 +0 beshort 0x76FE crunched data,
  3108 +>2 string x original name %s
  3109 +0 beshort 0x76FD LZH compressed data,
  3110 +>2 string x original name %s
  3111 +
  3112 +# Freeze
  3113 +0 string \037\237 frozen file 2.1
  3114 +0 string \037\236 frozen file 1.0 (or gzip 0.5)
  3115 +
  3116 +# SCO compress -H (LZH)
  3117 +0 string \037\240 SCO compress -H (LZH) data
  3118 +
  3119 +# European GSM 06.10 is a provisional standard for full-rate speech
  3120 +# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
  3121 +# excitation/long term prediction) coding at 13 kbit/s.
  3122 +#
  3123 +# There's only a magic nibble (4 bits); that nibble repeats every 33
  3124 +# bytes. This isn't suited for use, but maybe we can use it someday.
  3125 +#
  3126 +# This will cause very short GSM files to be declared as data and
  3127 +# mismatches to be declared as data too!
  3128 +#0 byte&0xF0 0xd0 data
  3129 +#>33 byte&0xF0 0xd0
  3130 +#>66 byte&0xF0 0xd0
  3131 +#>99 byte&0xF0 0xd0
  3132 +#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
  3133 +
  3134 +# bzip a block-sorting file compressor
  3135 +# by Julian Seward <sewardj@cs.man.ac.uk> and others
  3136 +#
  3137 +0 string BZ bzip compressed data
  3138 +>2 byte x \b, version: %c
  3139 +>3 string =1 \b, compression block size 100k
  3140 +>3 string =2 \b, compression block size 200k
  3141 +>3 string =3 \b, compression block size 300k
  3142 +>3 string =4 \b, compression block size 400k
  3143 +>3 string =5 \b, compression block size 500k
  3144 +>3 string =6 \b, compression block size 600k
  3145 +>3 string =7 \b, compression block size 700k
  3146 +>3 string =8 \b, compression block size 800k
  3147 +>3 string =9 \b, compression block size 900k
  3148 +
  3149 +# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
  3150 +0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
  3151 +>9 beshort <0x0940
  3152 +>>9 byte&0xf0 =0x00 - version 0.
  3153 +>>9 beshort&0x0fff x \b%03x,
  3154 +>>13 byte 1 LZO1X-1,
  3155 +>>13 byte 2 LZO1X-1(15),
  3156 +>>13 byte 3 LZO1X-999,
  3157 +## >>22 bedate >0 last modified: %s,
  3158 +>>14 byte =0x00 os: MS-DOS
  3159 +>>14 byte =0x01 os: Amiga
  3160 +>>14 byte =0x02 os: VMS
  3161 +>>14 byte =0x03 os: Unix
  3162 +>>14 byte =0x05 os: Atari
  3163 +>>14 byte =0x06 os: OS/2
  3164 +>>14 byte =0x07 os: MacOS
  3165 +>>14 byte =0x0A os: Tops/20
  3166 +>>14 byte =0x0B os: WinNT
  3167 +>>14 byte =0x0E os: Win32
  3168 +>9 beshort >0x0939
  3169 +>>9 byte&0xf0 =0x00 - version 0.
  3170 +>>9 byte&0xf0 =0x10 - version 1.
  3171 +>>9 byte&0xf0 =0x20 - version 2.
  3172 +>>9 beshort&0x0fff x \b%03x,
  3173 +>>15 byte 1 LZO1X-1,
  3174 +>>15 byte 2 LZO1X-1(15),
  3175 +>>15 byte 3 LZO1X-999,
  3176 +## >>25 bedate >0 last modified: %s,
  3177 +>>17 byte =0x00 os: MS-DOS
  3178 +>>17 byte =0x01 os: Amiga
  3179 +>>17 byte =0x02 os: VMS
  3180 +>>17 byte =0x03 os: Unix
  3181 +>>17 byte =0x05 os: Atari
  3182 +>>17 byte =0x06 os: OS/2
  3183 +>>17 byte =0x07 os: MacOS
  3184 +>>17 byte =0x0A os: Tops/20
  3185 +>>17 byte =0x0B os: WinNT
  3186 +>>17 byte =0x0E os: Win32
  3187 +
  3188 +# 4.3BSD-Quasijarus Strong Compression
  3189 +# http://minnie.tuhs.org/Quasijarus/compress.html
  3190 +0 string \037\241 Quasijarus strong compressed data
  3191 +
  3192 +# From: Cory Dikkers <cdikkers@swbell.net>
  3193 +0 string XPKF Amiga xpkf.library compressed data
  3194 +0 string PP11 Power Packer 1.1 compressed data
  3195 +0 string PP20 Power Packer 2.0 compressed data,
  3196 +>4 belong 0x09090909 fast compression
  3197 +>4 belong 0x090A0A0A mediocre compression
  3198 +>4 belong 0x090A0B0B good compression
  3199 +>4 belong 0x090A0C0C very good compression
  3200 +>4 belong 0x090A0C0D best compression
  3201 +
  3202 +# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
  3203 +# http://www.7-zip.org or DOC/7zFormat.txt
  3204 +#
  3205 +0 string 7z\274\257\047\034 7-zip archive data,
  3206 +>6 byte x version %d
  3207 +>7 byte x \b.%d
  3208 +
  3209 +# AFX compressed files (Wolfram Kleff)
  3210 +2 string -afx- AFX compressed file data
  3211 +
  3212 +# Supplementary magic data for the file(1) command to support
  3213 +# rzip(1). The format is described in magic(5).
  3214 +#
  3215 +# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with
  3216 +# this file.
  3217 +#
  3218 +0 string RZIP rzip compressed data
  3219 +>4 byte x - version %d
  3220 +>5 byte x \b.%d
  3221 +>6 belong x (%d bytes)
  3222 +#------------------------------------------------------------------------------
  3223 +# Console game magic
  3224 +# Toby Deshane <hac@shoelace.digivill.net>
  3225 +# ines: file(1) magic for Marat's iNES Nintendo Entertainment System
  3226 +# ROM dump format
  3227 +
  3228 +0 string NES\032 iNES ROM dump,
  3229 +>4 byte x %dx16k PRG
  3230 +>5 byte x \b, %dx8k CHR
  3231 +>6 byte&0x01 =0x1 \b, [Vert.]
  3232 +>6 byte&0x01 =0x0 \b, [Horiz.]
  3233 +>6 byte&0x02 =0x2 \b, [SRAM]
  3234 +>6 byte&0x04 =0x4 \b, [Trainer]
  3235 +>6 byte&0x04 =0x8 \b, [4-Scr]
  3236 +
  3237 +#------------------------------------------------------------------------------
  3238 +# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
  3239 +#
  3240 +0x104 belong 0xCEED6666 Gameboy ROM:
  3241 +>0x134 string >\0 "%.16s"
  3242 +>0x146 byte 0x03 \b,[SGB]
  3243 +>0x147 byte 0x00 \b, [ROM ONLY]
  3244 +>0x147 byte 0x01 \b, [ROM+MBC1]
  3245 +>0x147 byte 0x02 \b, [ROM+MBC1+RAM]
  3246 +>0x147 byte 0x03 \b, [ROM+MBC1+RAM+BATT]
  3247 +>0x147 byte 0x05 \b, [ROM+MBC2]
  3248 +>0x147 byte 0x06 \b, [ROM+MBC2+BATTERY]
  3249 +>0x147 byte 0x08 \b, [ROM+RAM]
  3250 +>0x147 byte 0x09 \b, [ROM+RAM+BATTERY]
  3251 +>0x147 byte 0x0B \b, [ROM+MMM01]
  3252 +>0x147 byte 0x0C \b, [ROM+MMM01+SRAM]
  3253 +>0x147 byte 0x0D \b, [ROM+MMM01+SRAM+BATT]
  3254 +>0x147 byte 0x0F \b, [ROM+MBC3+TIMER+BATT]
  3255 +>0x147 byte 0x10 \b, [ROM+MBC3+TIMER+RAM+BATT]
  3256 +>0x147 byte 0x11 \b, [ROM+MBC3]
  3257 +>0x147 byte 0x12 \b, [ROM+MBC3+RAM]
  3258 +>0x147 byte 0x13 \b, [ROM+MBC3+RAM+BATT]
  3259 +>0x147 byte 0x19 \b, [ROM+MBC5]
  3260 +>0x147 byte 0x1A \b, [ROM+MBC5+RAM]
  3261 +>0x147 byte 0x1B \b, [ROM+MBC5+RAM+BATT]
  3262 +>0x147 byte 0x1C \b, [ROM+MBC5+RUMBLE]
  3263 +>0x147 byte 0x1D \b, [ROM+MBC5+RUMBLE+SRAM]
  3264 +>0x147 byte 0x1E \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
  3265 +>0x147 byte 0x1F \b, [Pocket Camera]
  3266 +>0x147 byte 0xFD \b, [Bandai TAMA5]
  3267 +>0x147 byte 0xFE \b, [Hudson HuC-3]
  3268 +>0x147 byte 0xFF \b, [Hudson HuC-1]
  3269 +
  3270 +>0x148 byte 0 \b, ROM: 256Kbit
  3271 +>0x148 byte 1 \b, ROM: 512Kbit
  3272 +>0x148 byte 2 \b, ROM: 1Mbit
  3273 +>0x148 byte 3 \b, ROM: 2Mbit
  3274 +>0x148 byte 4 \b, ROM: 4Mbit
  3275 +>0x148 byte 5 \b, ROM: 8Mbit
  3276 +>0x148 byte 6 \b, ROM: 16Mbit
  3277 +>0x148 byte 0x52 \b, ROM: 9Mbit
  3278 +>0x148 byte 0x53 \b, ROM: 10Mbit
  3279 +>0x148 byte 0x54 \b, ROM: 12Mbit
  3280 +
  3281 +>0x149 byte 1 \b, RAM: 16Kbit
  3282 +>0x149 byte 2 \b, RAM: 64Kbit
  3283 +>0x149 byte 3 \b, RAM: 128Kbit
  3284 +>0x149 byte 4 \b, RAM: 1Mbit
  3285 +
  3286 +#>0x14e long x \b, CRC: %x
  3287 +
  3288 +#------------------------------------------------------------------------------
  3289 +# genesis: file(1) magic for the Sega MegaDrive/Genesis raw ROM format
  3290 +#
  3291 +0x100 string SEGA Sega MegaDrive/Genesis raw ROM dump
  3292 +>0x120 string >\0 Name: "%.16s"
  3293 +>0x110 string >\0 %.16s
  3294 +>0x1B0 string RA with SRAM
  3295 +
  3296 +#------------------------------------------------------------------------------
  3297 +# genesis: file(1) magic for the Super MegaDrive ROM dump format
  3298 +#
  3299 +0x280 string EAGN Super MagicDrive ROM dump
  3300 +>0 byte x %dx16k blocks
  3301 +>2 byte 0 \b, last in series or standalone
  3302 +>2 byte >0 \b, split ROM
  3303 +>8 byte 0xAA
  3304 +>9 byte 0xBB
  3305 +
  3306 +#------------------------------------------------------------------------------
  3307 +# genesis: file(1) alternate magic for the Super MegaDrive ROM dump format
  3308 +#
  3309 +0x280 string EAMG Super MagicDrive ROM dump
  3310 +>0 byte x %dx16k blocks
  3311 +>2 byte x \b, last in series or standalone
  3312 +>8 byte 0xAA
  3313 +>9 byte 0xBB
  3314 +
  3315 +#------------------------------------------------------------------------------
  3316 +# smsgg: file(1) magic for Sega Master System and Game Gear ROM dumps
  3317 +#
  3318 +# Does not detect all images. Very preliminary guesswork. Need more data
  3319 +# on format.
  3320 +#
  3321 +# FIXME: need a little more info...;P
  3322 +#
  3323 +#0 byte 0xF3
  3324 +#>1 byte 0xED Sega Master System/Game Gear ROM dump
  3325 +#>1 byte 0x31 Sega Master System/Game Gear ROM dump
  3326 +#>1 byte 0xDB Sega Master System/Game Gear ROM dump
  3327 +#>1 byte 0xAF Sega Master System/Game Gear ROM dump
  3328 +#>1 byte 0xC3 Sega Master System/Game Gear ROM dump
  3329 +
  3330 +#------------------------------------------------------------------------------
  3331 +# dreamcast: file(1) uncertain magic for the Sega Dreamcast VMU image format
  3332 +#
  3333 +0 belong 0x21068028 Sega Dreamcast VMU game image
  3334 +0 string LCDi Dream Animator file
  3335 +
  3336 +#------------------------------------------------------------------------------
  3337 +# v64: file(1) uncertain magic for the V64 format N64 ROM dumps
  3338 +#
  3339 +0 belong 0x37804012 V64 Nintendo 64 ROM dump
  3340 +
  3341 +#------------------------------------------------------------------------------
  3342 +# msx: file(1) magic for MSX game cartridge dumps
  3343 +# Too simple - MPi
  3344 +#0 beshort 0x4142 MSX game cartridge dump
  3345 +
  3346 +#------------------------------------------------------------------------------
  3347 +# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
  3348 +0 string PS-X\ EXE Sony Playstation executable
  3349 +# Area:
  3350 +>113 string x (%s)
  3351 +
  3352 +#------------------------------------------------------------------------------
  3353 +# Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>)
  3354 +0 string XBEH XBE, Microsoft Xbox executable
  3355 +# probabilistic checks whether signed or not
  3356 +>0x0004 ulelong =0x0
  3357 +>>&2 ulelong =0x0
  3358 +>>>&2 ulelong =0x0 \b, not signed
  3359 +>0x0004 ulelong >0
  3360 +>>&2 ulelong >0
  3361 +>>>&2 ulelong >0 \b, signed
  3362 +# expect base address of 0x10000
  3363 +>0x0104 ulelong =0x10000
  3364 +>>(0x0118-0x0FF60) ulelong&0x80000007 0x80000007 \b, all regions
  3365 +>>(0x0118-0x0FF60) ulelong&0x80000007 !0x80000007
  3366 +>>>(0x0118-0x0FF60) ulelong >0 (regions:
  3367 +>>>>(0x0118-0x0FF60) ulelong &0x00000001 NA
  3368 +>>>>(0x0118-0x0FF60) ulelong &0x00000002 Japan
  3369 +>>>>(0x0118-0x0FF60) ulelong &0x00000004 Rest_of_World
  3370 +>>>>(0x0118-0x0FF60) ulelong &0x80000000 Manufacturer
  3371 +>>>(0x0118-0x0FF60) ulelong >0 \b)
  3372 +
  3373 +# --------------------------------
  3374 +# Microsoft Xbox data file formats
  3375 +0 string XIP0 XIP, Microsoft Xbox data
  3376 +0 string XTF0 XTF, Microsoft Xbox data
  3377 +
  3378 +# Atari Lynx cartridge dump (EXE/BLL header)
  3379 +# From: "Stefan A. Haubenthal" <polluks@web.de>
  3380 +
  3381 +0 beshort 0x8008 Lynx cartridge,
  3382 +>2 beshort x RAM start $%04x
  3383 +>6 string BS93
  3384 +
  3385 +# Opera file system that is used on the 3DO console
  3386 +# From: Serge van den Boom <svdb@stack.nl>
  3387 +0 string \x01ZZZZZ\x01 3DO "Opera" file system
  3388 +
  3389 +# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
  3390 +0 string GBS Nintendo Gameboy Music/Audio Data
  3391 +12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module
  3392 +
  3393 +# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at>
  3394 +0 string PPF30 Playstation Patch File version 3.0
  3395 +>5 byte 0 \b, PPF 1.0 patch
  3396 +>5 byte 1 \b, PPF 2.0 patch
  3397 +>5 byte 2 \b, PPF 3.0 patch
  3398 +>>56 byte 0 \b, Imagetype BIN (any)
  3399 +>>56 byte 1 \b, Imagetype GI (PrimoDVD)
  3400 +>>57 byte 0 \b, Blockcheck disabled
  3401 +>>57 byte 1 \b, Blockcheck enabled
  3402 +>>58 byte 0 \b, Undo data not available
  3403 +>>58 byte 1 \b, Undo data available
  3404 +>6 string x \b, description: %s
  3405 +
  3406 +0 string PPF20 Playstation Patch File version 2.0
  3407 +>5 byte 0 \b, PPF 1.0 patch
  3408 +>5 byte 1 \b, PPF 2.0 patch
  3409 +>>56 lelong >0 \b, size of file to patch %d
  3410 +>6 string x \b, description: %s
  3411 +
  3412 +0 string PPF10 Playstation Patch File version 1.0
  3413 +>5 byte 0 \b, Simple Encoding
  3414 +>6 string x \b, description: %s
  3415 +#------------------------------------------------------------------------------
  3416 +# convex: file(1) magic for Convex boxes
  3417 +#
  3418 +# Convexes are big-endian.
  3419 +#
  3420 +# /*\
  3421 +# * Below are the magic numbers and tests added for Convex.
  3422 +# * Added at beginning, because they are expected to be used most.
  3423 +# \*/
  3424 +0 belong 0507 Convex old-style object
  3425 +>16 belong >0 not stripped
  3426 +0 belong 0513 Convex old-style demand paged executable
  3427 +>16 belong >0 not stripped
  3428 +0 belong 0515 Convex old-style pre-paged executable
  3429 +>16 belong >0 not stripped
  3430 +0 belong 0517 Convex old-style pre-paged, non-swapped executable
  3431 +>16 belong >0 not stripped
  3432 +0 belong 0x011257 Core file
  3433 +#
  3434 +# The following are a series of dump format magic numbers. Each one
  3435 +# corresponds to a drastically different dump format. The first on is
  3436 +# the original dump format on a 4.1 BSD or earlier file system. The
  3437 +# second marks the change between the 4.1 file system and the 4.2 file
  3438 +# system. The Third marks the changing of the block size from 1K
  3439 +# to 2K to be compatible with an IDC file system. The fourth indicates
  3440 +# a dump that is dependent on Convex Storage Manager, because data in
  3441 +# secondary storage is not physically contained within the dump.
  3442 +# The restore program uses these number to determine how the data is
  3443 +# to be extracted.
  3444 +#
  3445 +24 belong =60011 dump format, 4.1 BSD or earlier
  3446 +24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC
  3447 +24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
  3448 +24 belong =60014 dump format, Convex Storage Manager by-reference dump
  3449 +#
  3450 +# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
  3451 +# If there is no `=' sign, assume just checking for whether the bit is set?
  3452 +#
  3453 +0 belong 0601 Convex SOFF
  3454 +>88 belong&0x000f0000 =0x00000000 c1
  3455 +>88 belong &0x00010000 c2
  3456 +>88 belong &0x00020000 c2mp
  3457 +>88 belong &0x00040000 parallel
  3458 +>88 belong &0x00080000 intrinsic
  3459 +>88 belong &0x00000001 demand paged
  3460 +>88 belong &0x00000002 pre-paged
  3461 +>88 belong &0x00000004 non-swapped
  3462 +>88 belong &0x00000008 POSIX
  3463 +#
  3464 +>84 belong &0x80000000 executable
  3465 +>84 belong &0x40000000 object
  3466 +>84 belong&0x20000000 =0 not stripped
  3467 +>84 belong&0x18000000 =0x00000000 native fpmode
  3468 +>84 belong&0x18000000 =0x10000000 ieee fpmode
  3469 +>84 belong&0x18000000 =0x18000000 undefined fpmode
  3470 +#
  3471 +0 belong 0605 Convex SOFF core
  3472 +#
  3473 +0 belong 0607 Convex SOFF checkpoint
  3474 +>88 belong&0x000f0000 =0x00000000 c1
  3475 +>88 belong &0x00010000 c2
  3476 +>88 belong &0x00020000 c2mp
  3477 +>88 belong &0x00040000 parallel
  3478 +>88 belong &0x00080000 intrinsic
  3479 +>88 belong &0x00000008 POSIX
  3480 +#
  3481 +>84 belong&0x18000000 =0x00000000 native fpmode
  3482 +>84 belong&0x18000000 =0x10000000 ieee fpmode
  3483 +>84 belong&0x18000000 =0x18000000 undefined fpmode
  3484 +
  3485 +# ----------------------------------------------------------------------------
  3486 +# ctags: file (1) magic for Exuberant Ctags files
  3487 +# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
  3488 +0 string =!_TAG Exuberant Ctags tag file text
  3489 +
  3490 +#------------------------------------------------------------------------------
  3491 +# dact: file(1) magic for DACT compressed files
  3492 +#
  3493 +0 long 0x444354C3 DACT compressed data
  3494 +>4 byte >-1 (version %i.
  3495 +>5 byte >-1 $BS%i.
  3496 +>6 byte >-1 $BS%i)
  3497 +>7 long >0 $BS, original size: %i bytes
  3498 +>15 long >30 $BS, block size: %i bytes
  3499 +
  3500 +#------------------------------------------------------------------------------
  3501 +# database: file(1) magic for various databases
  3502 +#
  3503 +# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
  3504 +#
  3505 +#
  3506 +# GDBM magic numbers
  3507 +# Will be maintained as part of the GDBM distribution in the future.
  3508 +# <downsj@teeny.org>
  3509 +0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
  3510 +0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
  3511 +0 string GDBM GNU dbm 2.x database
  3512 +#
  3513 +# Berkeley DB
  3514 +#
  3515 +# Ian Darwin's file /etc/magic files: big/little-endian version.
  3516 +#
  3517 +# Hash 1.85/1.86 databases store metadata in network byte order.
  3518 +# Btree 1.85/1.86 databases store the metadata in host byte order.
  3519 +# Hash and Btree 2.X and later databases store the metadata in host byte order.
  3520 +
  3521 +0 long 0x00061561 Berkeley DB
  3522 +>8 belong 4321
  3523 +>>4 belong >2 1.86
  3524 +>>4 belong <3 1.85
  3525 +>>4 belong >0 (Hash, version %d, native byte-order)
  3526 +>8 belong 1234
  3527 +>>4 belong >2 1.86
  3528 +>>4 belong <3 1.85
  3529 +>>4 belong >0 (Hash, version %d, little-endian)
  3530 +
  3531 +0 belong 0x00061561 Berkeley DB
  3532 +>8 belong 4321
  3533 +>>4 belong >2 1.86
  3534 +>>4 belong <3 1.85
  3535 +>>4 belong >0 (Hash, version %d, big-endian)
  3536 +>8 belong 1234
  3537 +>>4 belong >2 1.86
  3538 +>>4 belong <3 1.85
  3539 +>>4 belong >0 (Hash, version %d, native byte-order)
  3540 +
  3541 +0 long 0x00053162 Berkeley DB 1.85/1.86
  3542 +>4 long >0 (Btree, version %d, native byte-order)
  3543 +0 belong 0x00053162 Berkeley DB 1.85/1.86
  3544 +>4 belong >0 (Btree, version %d, big-endian)
  3545 +0 lelong 0x00053162 Berkeley DB 1.85/1.86
  3546 +>4 lelong >0 (Btree, version %d, little-endian)
  3547 +
  3548 +12 long 0x00061561 Berkeley DB
  3549 +>16 long >0 (Hash, version %d, native byte-order)
  3550 +12 belong 0x00061561 Berkeley DB
  3551 +>16 belong >0 (Hash, version %d, big-endian)
  3552 +12 lelong 0x00061561 Berkeley DB
  3553 +>16 lelong >0 (Hash, version %d, little-endian)
  3554 +
  3555 +12 long 0x00053162 Berkeley DB
  3556 +>16 long >0 (Btree, version %d, native byte-order)
  3557 +12 belong 0x00053162 Berkeley DB
  3558 +>16 belong >0 (Btree, version %d, big-endian)
  3559 +12 lelong 0x00053162 Berkeley DB
  3560 +>16 lelong >0 (Btree, version %d, little-endian)
  3561 +
  3562 +12 long 0x00042253 Berkeley DB
  3563 +>16 long >0 (Queue, version %d, native byte-order)
  3564 +12 belong 0x00042253 Berkeley DB
  3565 +>16 belong >0 (Queue, version %d, big-endian)
  3566 +12 lelong 0x00042253 Berkeley DB
  3567 +>16 lelong >0 (Queue, version %d, little-endian)
  3568 +
  3569 +# From Max Bowsher.
  3570 +12 long 0x00040988 Berkeley DB
  3571 +>16 long >0 (Log, version %d, native byte-order)
  3572 +12 belong 0x00040988 Berkeley DB
  3573 +>16 belong >0 (Log, version %d, big-endian)
  3574 +12 lelong 0x00040988 Berkeley DB
  3575 +>16 lelong >0 (Log, version %d, little-endian)
  3576 +
  3577 +#
  3578 +#
  3579 +# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
  3580 +0 string RRD RRDTool DB
  3581 +>4 string x version %s
  3582 +#----------------------------------------------------------------------
  3583 +# ROOT: file(1) magic for ROOT databases
  3584 +#
  3585 +0 string root\0 ROOT file
  3586 +>4 belong x Version %d
  3587 +>33 belong x (Compression: %d)
  3588 +
  3589 +# XXX: Weak magic.
  3590 +# Alex Ott <ott@jet.msk.su>
  3591 +## Paradox file formats
  3592 +#2 leshort 0x0800 Paradox
  3593 +#>0x39 byte 3 v. 3.0
  3594 +#>0x39 byte 4 v. 3.5
  3595 +#>0x39 byte 9 v. 4.x
  3596 +#>0x39 byte 10 v. 5.x
  3597 +#>0x39 byte 11 v. 5.x
  3598 +#>0x39 byte 12 v. 7.x
  3599 +#>>0x04 byte 0 indexed .DB data file
  3600 +#>>0x04 byte 1 primary index .PX file
  3601 +#>>0x04 byte 2 non-indexed .DB data file
  3602 +#>>0x04 byte 3 non-incrementing secondary index .Xnn file
  3603 +#>>0x04 byte 4 secondary index .Ynn file
  3604 +#>>0x04 byte 5 incrementing secondary index .Xnn file
  3605 +#>>0x04 byte 6 non-incrementing secondary index .XGn file
  3606 +#>>0x04 byte 7 secondary index .YGn file
  3607 +#>>>0x04 byte 8 incrementing secondary index .XGn file
  3608 +## XBase database files
  3609 +#0 byte 0x02
  3610 +#>8 leshort >0
  3611 +#>>12 leshort 0 FoxBase
  3612 +#>>>0x04 lelong 0 (no records)
  3613 +#>>>0x04 lelong >0 (%ld records)
  3614 +#
  3615 +#0 byte 0x03
  3616 +#>8 leshort >0
  3617 +#>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo
  3618 +#>>>0x04 lelong 0 (no records)
  3619 +#>>>0x04 lelong >0 (%ld records)
  3620 +#
  3621 +#0 byte 0x04
  3622 +#>8 leshort >0
  3623 +#>>12 leshort 0 dBASE IV no memo file
  3624 +#>>>0x04 lelong 0 (no records)
  3625 +#>>>0x04 lelong >0 (%ld records)
  3626 +#
  3627 +#0 byte 0x05
  3628 +#>8 leshort >0
  3629 +#>>12 leshort 0 dBASE V no memo file
  3630 +#>>>0x04 lelong 0 (no records)
  3631 +#>>>0x04 lelong >0 (%ld records)
  3632 +#
  3633 +#0 byte 0x30
  3634 +#>8 leshort >0
  3635 +#>>12 leshort 0 Visual FoxPro
  3636 +#>>>0x04 lelong 0 (no records)
  3637 +#>>>0x04 lelong >0 (%ld records)
  3638 +#
  3639 +#0 byte 0x43
  3640 +#>8 leshort >0
  3641 +#>>12 leshort 0 FlagShip with memo var size
  3642 +#>>>0x04 lelong 0 (no records)
  3643 +#>>>0x04 lelong >0 (%ld records)
  3644 +#
  3645 +#0 byte 0x7b
  3646 +#>8 leshort >0
  3647 +#>>12 leshort 0 dBASEIV with memo
  3648 +#>>>0x04 lelong 0 (no records)
  3649 +#>>>0x04 lelong >0 (%ld records)
  3650 +#
  3651 +#0 byte 0x83
  3652 +#>8 leshort >0
  3653 +#>>12 leshort 0 FoxBase+, dBaseIII+ with memo
  3654 +#>>>0x04 lelong 0 (no records)
  3655 +#>>>0x04 lelong >0 (%ld records)
  3656 +#
  3657 +#0 byte 0x8b
  3658 +#>8 leshort >0
  3659 +#>>12 leshort 0 dBaseIV with memo
  3660 +#>>>0x04 lelong 0 (no records)
  3661 +#>>>0x04 lelong >0 (%ld records)
  3662 +#
  3663 +#0 byte 0x8e
  3664 +#>8 leshort >0
  3665 +#>>12 leshort 0 dBaseIV with SQL Table
  3666 +#>>>0x04 lelong 0 (no records)
  3667 +#>>>0x04 lelong >0 (%ld records)
  3668 +#
  3669 +#0 byte 0xb3
  3670 +#>8 leshort >0
  3671 +#>>12 leshort 0 FlagShip with .dbt memo
  3672 +#>>>0x04 lelong 0 (no records)
  3673 +#>>>0x04 lelong >0 (%ld records)
  3674 +#
  3675 +#0 byte 0xf5
  3676 +#>8 leshort >0
  3677 +#>>12 leshort 0 FoxPro with memo
  3678 +#>>>0x04 lelong 0 (no records)
  3679 +#>>>0x04 lelong >0 (%ld records)
  3680 +#
  3681 +#0 leshort 0x0006 DBase 3 index file
  3682 +
  3683 +# MS Access database
  3684 +4 string Standard\ Jet\ DB Microsoft Access Database
  3685 +
  3686 +# TDB database from Samba et al - Martin Pool <mbp@samba.org>
  3687 +0 string TDB\ file TDB database
  3688 +>32 lelong 0x2601196D version 6, little-endian
  3689 +>>36 lelong x hash size %d bytes
  3690 +
  3691 +# SE Linux policy database
  3692 +0 lelong 0xf97cff8c SE Linux policy
  3693 +>16 lelong x v%d
  3694 +>20 lelong 1 MLS
  3695 +>24 lelong x %d symbols
  3696 +>28 lelong x %d ocons
  3697 +
  3698 +# ICE authority file data (Wolfram Kleff)
  3699 +2 string ICE ICE authority data
  3700 +
  3701 +# X11 Xauthority file (Wolfram Kleff)
  3702 +10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3703 +11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3704 +12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3705 +13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3706 +14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3707 +15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3708 +16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3709 +17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3710 +18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  3711 +
  3712 +#------------------------------------------------------------------------------
  3713 +# diamond: file(1) magic for Diamond system
  3714 +#
  3715 +# ... diamond is a multi-media mail and electronic conferencing system....
  3716 +#
  3717 +# XXX - I think it was either renamed Slate, or replaced by Slate....
  3718 +#
  3719 +# The full deal is too long...
  3720 +#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
  3721 +0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document
  3722 +
  3723 +#------------------------------------------------------------------------------
  3724 +# diff: file(1) magic for diff(1) output
  3725 +#
  3726 +0 string diff\ 'diff' output text
  3727 +0 string ***\ 'diff' output text
  3728 +0 string Only\ in\ 'diff' output text
  3729 +0 string Common\ subdirectories:\ 'diff' output text
  3730 +
  3731 +0 string Index: RCS/CVS diff output text
  3732 +# Digital UNIX - Info
  3733 +#
  3734 +0 string =!<arch>\n________64E Alpha archive
  3735 +>22 string X -- out of date
  3736 +#
  3737 +# Alpha COFF Based Executables
  3738 +# The stripped stuff really needs to be an 8 byte (64 bit) compare,
  3739 +# but this works
  3740 +0 leshort 0x183 COFF format alpha
  3741 +>22 leshort&020000 &010000 sharable library,
  3742 +>22 leshort&020000 ^010000 dynamically linked,
  3743 +>24 leshort 0410 pure
  3744 +>24 leshort 0413 demand paged
  3745 +>8 lelong >0 executable or object module, not stripped
  3746 +>8 lelong 0
  3747 +>>12 lelong 0 executable or object module, stripped
  3748 +>>12 lelong >0 executable or object module, not stripped
  3749 +>27 byte >0 - version %d.
  3750 +>26 byte >0 %d-
  3751 +>28 leshort >0 %d
  3752 +#
  3753 +# The next is incomplete, we could tell more about this format,
  3754 +# but its not worth it.
  3755 +0 leshort 0x188 Alpha compressed COFF
  3756 +0 leshort 0x18f Alpha u-code object
  3757 +#
  3758 +#
  3759 +# Some other interesting Digital formats,
  3760 +0 string \377\377\177 ddis/ddif
  3761 +0 string \377\377\174 ddis/dots archive
  3762 +0 string \377\377\176 ddis/dtif table data
  3763 +0 string \033c\033 LN03 output
  3764 +0 long 04553207 X image
  3765 +#
  3766 +0 string =!<PDF>!\n profiling data file
  3767 +#
  3768 +# Locale data tables (MIPS and Alpha).
  3769 +#
  3770 +0 short 0x0501 locale data table
  3771 +>6 short 0x24 for MIPS
  3772 +>6 short 0x40 for Alpha
  3773 +# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
  3774 +# from http://www.atsc.org/standards/a_52a.pdf
  3775 +# corrections, additions, etc. are always welcome!
  3776 +#
  3777 +# syncword
  3778 +0 beshort 0x0b77 ATSC A/52 aka AC-3 aka Dolby Digital stream,
  3779 +# fscod
  3780 +>4 byte&0xc0 0x00 48 kHz,
  3781 +>4 byte&0xc0 0x40 44.1 kHz,
  3782 +>4 byte&0xc0 0x80 32 kHz,
  3783 +# is this one used for 96 kHz?
  3784 +>4 byte&0xc0 0xc0 reserved frequency,
  3785 +#
  3786 +>5 byte&7 = 0 \b, complete main (CM)
  3787 +>5 byte&7 = 1 \b, music and effects (ME)
  3788 +>5 byte&7 = 2 \b, visually impaired (VI)
  3789 +>5 byte&7 = 3 \b, hearing impaired (HI)
  3790 +>5 byte&7 = 4 \b, dialogue (D)
  3791 +>5 byte&7 = 5 \b, commentary (C)
  3792 +>5 byte&7 = 6 \b, emergency (E)
  3793 +# acmod
  3794 +>6 byte&0xe0 0x00 1+1 front,
  3795 +>6 byte&0xe0 0x20 1 front/0 rear,
  3796 +>6 byte&0xe0 0x40 2 front/0 rear,
  3797 +>6 byte&0xe0 0x60 3 front/0 rear,
  3798 +>6 byte&0xe0 0x80 2 front/1 rear,
  3799 +>6 byte&0xe0 0xa0 3 front/1 rear,
  3800 +>6 byte&0xe0 0xc0 2 front/2 rear,
  3801 +>6 byte&0xe0 0xe0 3 front/2 rear,
  3802 +# lfeon (these may be incorrect)
  3803 +>7 byte&0x40 0x00 LFE off,
  3804 +>7 byte&0x40 0x40 LFE on,
  3805 +#
  3806 +>4 byte&0x3e = 0x00 \b, 32 kbit/s
  3807 +>4 byte&0x3e = 0x02 \b, 40 kbit/s
  3808 +>4 byte&0x3e = 0x04 \b, 48 kbit/s
  3809 +>4 byte&0x3e = 0x06 \b, 56 kbit/s
  3810 +>4 byte&0x3e = 0x08 \b, 64 kbit/s
  3811 +>4 byte&0x3e = 0x0a \b, 80 kbit/s
  3812 +>4 byte&0x3e = 0x0c \b, 96 kbit/s
  3813 +>4 byte&0x3e = 0x0e \b, 112 kbit/s
  3814 +>4 byte&0x3e = 0x10 \b, 128 kbit/s
  3815 +>4 byte&0x3e = 0x12 \b, 160 kbit/s
  3816 +>4 byte&0x3e = 0x14 \b, 192 kbit/s
  3817 +>4 byte&0x3e = 0x16 \b, 224 kbit/s
  3818 +>4 byte&0x3e = 0x18 \b, 256 kbit/s
  3819 +>4 byte&0x3e = 0x1a \b, 320 kbit/s
  3820 +>4 byte&0x3e = 0x1c \b, 384 kbit/s
  3821 +>4 byte&0x3e = 0x1e \b, 448 kbit/s
  3822 +>4 byte&0x3e = 0x20 \b, 512 kbit/s
  3823 +>4 byte&0x3e = 0x22 \b, 576 kbit/s
  3824 +>4 byte&0x3e = 0x24 \b, 640 kbit/s
  3825 +# dsurmod (these may be incorrect)
  3826 +>6 beshort&0x0180 0x0000 Dolby Surround not indicated
  3827 +>6 beshort&0x0180 0x0080 not Dolby Surround encoded
  3828 +>6 beshort&0x0180 0x0100 Dolby Surround encoded
  3829 +>6 beshort&0x0180 0x0180 reserved Dolby Surround mode
  3830 +
  3831 +#------------------------------------------------------------------------------
  3832 +# dump: file(1) magic for dump file format--for new and old dump filesystems
  3833 +#
  3834 +# We specify both byte orders in order to recognize byte-swapped dumps.
  3835 +#
  3836 +24 belong 60012 new-fs dump file (big endian),
  3837 +>4 bedate x Previous dump %s,
  3838 +>8 bedate x This dump %s,
  3839 +>12 belong >0 Volume %ld,
  3840 +>692 belong 0 Level zero, type:
  3841 +>692 belong >0 Level %d, type:
  3842 +>0 belong 1 tape header,
  3843 +>0 belong 2 beginning of file record,
  3844 +>0 belong 3 map of inodes on tape,
  3845 +>0 belong 4 continuation of file record,
  3846 +>0 belong 5 end of volume,
  3847 +>0 belong 6 map of inodes deleted,
  3848 +>0 belong 7 end of medium (for floppy),
  3849 +>676 string >\0 Label %s,
  3850 +>696 string >\0 Filesystem %s,
  3851 +>760 string >\0 Device %s,
  3852 +>824 string >\0 Host %s,
  3853 +>888 belong >0 Flags %x
  3854 +
  3855 +24 belong 60011 old-fs dump file (big endian),
  3856 +#>4 bedate x Previous dump %s,
  3857 +#>8 bedate x This dump %s,
  3858 +>12 belong >0 Volume %ld,
  3859 +>692 belong 0 Level zero, type:
  3860 +>692 belong >0 Level %d, type:
  3861 +>0 belong 1 tape header,
  3862 +>0 belong 2 beginning of file record,
  3863 +>0 belong 3 map of inodes on tape,
  3864 +>0 belong 4 continuation of file record,
  3865 +>0 belong 5 end of volume,
  3866 +>0 belong 6 map of inodes deleted,
  3867 +>0 belong 7 end of medium (for floppy),
  3868 +>676 string >\0 Label %s,
  3869 +>696 string >\0 Filesystem %s,
  3870 +>760 string >\0 Device %s,
  3871 +>824 string >\0 Host %s,
  3872 +>888 belong >0 Flags %x
  3873 +
  3874 +24 lelong 60012 new-fs dump file (little endian),
  3875 +>4 ledate x This dump %s,
  3876 +>8 ledate x Previous dump %s,
  3877 +>12 lelong >0 Volume %ld,
  3878 +>692 lelong 0 Level zero, type:
  3879 +>692 lelong >0 Level %d, type:
  3880 +>0 lelong 1 tape header,
  3881 +>0 lelong 2 beginning of file record,
  3882 +>0 lelong 3 map of inodes on tape,
  3883 +>0 lelong 4 continuation of file record,
  3884 +>0 lelong 5 end of volume,
  3885 +>0 lelong 6 map of inodes deleted,
  3886 +>0 lelong 7 end of medium (for floppy),
  3887 +>676 string >\0 Label %s,
  3888 +>696 string >\0 Filesystem %s,
  3889 +>760 string >\0 Device %s,
  3890 +>824 string >\0 Host %s,
  3891 +>888 lelong >0 Flags %x
  3892 +
  3893 +24 lelong 60011 old-fs dump file (little endian),
  3894 +#>4 ledate x Previous dump %s,
  3895 +#>8 ledate x This dump %s,
  3896 +>12 lelong >0 Volume %ld,
  3897 +>692 lelong 0 Level zero, type:
  3898 +>692 lelong >0 Level %d, type:
  3899 +>0 lelong 1 tape header,
  3900 +>0 lelong 2 beginning of file record,
  3901 +>0 lelong 3 map of inodes on tape,
  3902 +>0 lelong 4 continuation of file record,
  3903 +>0 lelong 5 end of volume,
  3904 +>0 lelong 6 map of inodes deleted,
  3905 +>0 lelong 7 end of medium (for floppy),
  3906 +>676 string >\0 Label %s,
  3907 +>696 string >\0 Filesystem %s,
  3908 +>760 string >\0 Device %s,
  3909 +>824 string >\0 Host %s,
  3910 +>888 lelong >0 Flags %x
  3911 +
  3912 +18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness),
  3913 +>2 medate x Previous dump %s,
  3914 +>6 medate x This dump %s,
  3915 +>10 leshort >0 Volume %ld,
  3916 +>0 leshort 1 tape header.
  3917 +>0 leshort 2 beginning of file record.
  3918 +>0 leshort 3 map of inodes on tape.
  3919 +>0 leshort 4 continuation of file record.
  3920 +>0 leshort 5 end of volume.
  3921 +>0 leshort 6 map of inodes deleted.
  3922 +>0 leshort 7 end of medium (for floppy).
  3923 +
  3924 +#------------------------------------------------------------------------------
  3925 +# T602 editor documents
  3926 +# by David Necas <yeti@physics.muni.cz>
  3927 +0 string @CT\ T602 document data,
  3928 +>4 string 0 Kamenicky
  3929 +>4 string 1 CP 852
  3930 +>4 string 2 KOI8-CS
  3931 +>4 string >2 unknown encoding
  3932 +
  3933 +# Vi IMproved Encrypted file
  3934 +# by David Necas <yeti@physics.muni.cz>
  3935 +0 string VimCrypt~ Vim encrypted file data
  3936 +# Vi IMproved Swap file
  3937 +# by Sven Wegener <swegener@gentoo.org>
  3938 +0 string b0VIM\ Vim swap file
  3939 +>&0 string >\0 \b, version %s
  3940 +
  3941 +#------------------------------------------------------------------------------
  3942 +# elf: file(1) magic for ELF executables
  3943 +#
  3944 +# We have to check the byte order flag to see what byte order all the
  3945 +# other stuff in the header is in.
  3946 +#
  3947 +# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
  3948 +#
  3949 +# updated by Daniel Quinlan (quinlan@yggdrasil.com)
  3950 +0 string \177ELF ELF
  3951 +>4 byte 0 invalid class
  3952 +>4 byte 1 32-bit
  3953 +>4 byte 2 64-bit
  3954 +>5 byte 0 invalid byte order
  3955 +>5 byte 1 LSB
  3956 +>>16 leshort 0 no file type,
  3957 +>>16 leshort 1 relocatable,
  3958 +>>16 leshort 2 executable,
  3959 +>>16 leshort 3 shared object,
  3960 +# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
  3961 +# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
  3962 +>>16 leshort 4 core file
  3963 +# Core file detection is not reliable.
  3964 +#>>>(0x38+0xcc) string >\0 of '%s'
  3965 +#>>>(0x38+0x10) lelong >0 (signal %d),
  3966 +>>16 leshort &0xff00 processor-specific,
  3967 +>>18 leshort 0 no machine,
  3968 +>>18 leshort 1 AT&T WE32100 - invalid byte order,
  3969 +>>18 leshort 2 SPARC - invalid byte order,
  3970 +>>18 leshort 3 Intel 80386,
  3971 +>>18 leshort 4 Motorola
  3972 +>>>36 lelong &0x01000000 68000 - invalid byte order,
  3973 +>>>36 lelong &0x00810000 CPU32 - invalid byte order,
  3974 +>>>36 lelong 0 68020 - invalid byte order,
  3975 +>>18 leshort 5 Motorola 88000 - invalid byte order,
  3976 +>>18 leshort 6 Intel 80486,
  3977 +>>18 leshort 7 Intel 80860,
  3978 +# The official e_machine number for MIPS is now #8, regardless of endianness.
  3979 +# The second number (#10) will be deprecated later. For now, we still
  3980 +# say something if #10 is encountered, but only gory details for #8.
  3981 +>>18 leshort 8 MIPS,
  3982 +>>>36 lelong &0x20 N32
  3983 +>>18 leshort 10 MIPS,
  3984 +>>>36 lelong &0x20 N32
  3985 +>>18 leshort 8
  3986 +# only for 32-bit
  3987 +>>>4 byte 1
  3988 +>>>>36 lelong&0xf0000000 0x00000000 MIPS-I
  3989 +>>>>36 lelong&0xf0000000 0x10000000 MIPS-II
  3990 +>>>>36 lelong&0xf0000000 0x20000000 MIPS-III
  3991 +>>>>36 lelong&0xf0000000 0x30000000 MIPS-IV
  3992 +>>>>36 lelong&0xf0000000 0x40000000 MIPS-V
  3993 +>>>>36 lelong&0xf0000000 0x60000000 MIPS32
  3994 +>>>>36 lelong&0xf0000000 0x70000000 MIPS64
  3995 +>>>>36 lelong&0xf0000000 0x80000000 MIPS32 rel2
  3996 +>>>>36 lelong&0xf0000000 0x90000000 MIPS64 rel2
  3997 +# only for 64-bit
  3998 +>>>4 byte 2
  3999 +>>>>48 lelong&0xf0000000 0x00000000 MIPS-I
  4000 +>>>>48 lelong&0xf0000000 0x10000000 MIPS-II
  4001 +>>>>48 lelong&0xf0000000 0x20000000 MIPS-III
  4002 +>>>>48 lelong&0xf0000000 0x30000000 MIPS-IV
  4003 +>>>>48 lelong&0xf0000000 0x40000000 MIPS-V
  4004 +>>>>48 lelong&0xf0000000 0x60000000 MIPS32
  4005 +>>>>48 lelong&0xf0000000 0x70000000 MIPS64
  4006 +>>>>48 lelong&0xf0000000 0x80000000 MIPS32 rel2
  4007 +>>>>48 lelong&0xf0000000 0x90000000 MIPS64 rel2
  4008 +>>18 leshort 9 Amdahl - invalid byte order,
  4009 +>>18 leshort 10 MIPS (deprecated),
  4010 +>>18 leshort 11 RS6000 - invalid byte order,
  4011 +>>18 leshort 15 PA-RISC - invalid byte order,
  4012 +>>>50 leshort 0x0214 2.0
  4013 +>>>48 leshort &0x0008 (LP64),
  4014 +>>18 leshort 16 nCUBE,
  4015 +>>18 leshort 17 Fujitsu VPP500,
  4016 +>>18 leshort 18 SPARC32PLUS,
  4017 +>>18 leshort 20 PowerPC,
  4018 +>>18 leshort 22 IBM S/390,
  4019 +>>18 leshort 36 NEC V800,
  4020 +>>18 leshort 37 Fujitsu FR20,
  4021 +>>18 leshort 38 TRW RH-32,
  4022 +>>18 leshort 39 Motorola RCE,
  4023 +>>18 leshort 40 ARM,
  4024 +>>18 leshort 41 Alpha,
  4025 +>>18 leshort 0xa390 IBM S/390 (obsolete),
  4026 +>>18 leshort 42 Renesas SH,
  4027 +>>18 leshort 43 SPARC V9 - invalid byte order,
  4028 +>>18 leshort 44 Siemens Tricore Embedded Processor,
  4029 +>>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
  4030 +>>18 leshort 46 Renesas H8/300,
  4031 +>>18 leshort 47 Renesas H8/300H,
  4032 +>>18 leshort 48 Renesas H8S,
  4033 +>>18 leshort 49 Renesas H8/500,
  4034 +>>18 leshort 50 IA-64,
  4035 +>>18 leshort 51 Stanford MIPS-X,
  4036 +>>18 leshort 52 Motorola Coldfire,
  4037 +>>18 leshort 53 Motorola M68HC12,
  4038 +>>18 leshort 62 x86-64,
  4039 +>>18 leshort 75 Digital VAX,
  4040 +>>18 leshort 88 Renesas M32R,
  4041 +>>18 leshort 94 Tensilica Xtensa,
  4042 +>>18 leshort 97 NatSemi 32k,
  4043 +>>18 leshort 106 Analog Devices Blackfin,
  4044 +>>18 leshort 0x9026 Alpha (unofficial),
  4045 +>>20 lelong 0 invalid version
  4046 +>>20 lelong 1 version 1
  4047 +>>36 lelong 1 MathCoPro/FPU/MAU Required
  4048 +>5 byte 2 MSB
  4049 +>>16 beshort 0 no file type,
  4050 +>>16 beshort 1 relocatable,
  4051 +>>16 beshort 2 executable,
  4052 +>>16 beshort 3 shared object,
  4053 +>>16 beshort 4 core file,
  4054 +#>>>(0x38+0xcc) string >\0 of '%s'
  4055 +#>>>(0x38+0x10) belong >0 (signal %d),
  4056 +>>16 beshort &0xff00 processor-specific,
  4057 +>>18 beshort 0 no machine,
  4058 +>>18 beshort 1 AT&T WE32100,
  4059 +>>18 beshort 2 SPARC,
  4060 +>>18 beshort 3 Intel 80386 - invalid byte order,
  4061 +>>18 beshort 4 Motorola
  4062 +>>>36 belong &0x01000000 68000,
  4063 +>>>36 belong &0x00810000 CPU32,
  4064 +>>>36 belong 0 68020,
  4065 +>>18 beshort 5 Motorola 88000,
  4066 +>>18 beshort 6 Intel 80486 - invalid byte order,
  4067 +>>18 beshort 7 Intel 80860,
  4068 +# only for MIPS - see comment in little-endian section above.
  4069 +>>18 beshort 8 MIPS,
  4070 +>>>36 belong &0x20 N32
  4071 +>>18 beshort 10 MIPS,
  4072 +>>>36 belong &0x20 N32
  4073 +>>18 beshort 8
  4074 +# only for 32-bit
  4075 +>>>4 byte 1
  4076 +>>>>36 belong&0xf0000000 0x00000000 MIPS-I
  4077 +>>>>36 belong&0xf0000000 0x10000000 MIPS-II
  4078 +>>>>36 belong&0xf0000000 0x20000000 MIPS-III
  4079 +>>>>36 belong&0xf0000000 0x30000000 MIPS-IV
  4080 +>>>>36 belong&0xf0000000 0x40000000 MIPS-V
  4081 +>>>>36 belong&0xf0000000 0x60000000 MIPS32
  4082 +>>>>36 belong&0xf0000000 0x70000000 MIPS64
  4083 +>>>>36 belong&0xf0000000 0x80000000 MIPS32 rel2
  4084 +>>>>36 belong&0xf0000000 0x90000000 MIPS64 rel2
  4085 +# only for 64-bit
  4086 +>>>4 byte 2
  4087 +>>>>48 belong&0xf0000000 0x00000000 MIPS-I
  4088 +>>>>48 belong&0xf0000000 0x10000000 MIPS-II
  4089 +>>>>48 belong&0xf0000000 0x20000000 MIPS-III
  4090 +>>>>48 belong&0xf0000000 0x30000000 MIPS-IV
  4091 +>>>>48 belong&0xf0000000 0x40000000 MIPS-V
  4092 +>>>>48 belong&0xf0000000 0x60000000 MIPS32
  4093 +>>>>48 belong&0xf0000000 0x70000000 MIPS64
  4094 +>>>>48 belong&0xf0000000 0x80000000 MIPS32 rel2
  4095 +>>>>48 belong&0xf0000000 0x90000000 MIPS64 rel2
  4096 +>>18 beshort 9 Amdahl,
  4097 +>>18 beshort 10 MIPS (deprecated),
  4098 +>>18 beshort 11 RS6000,
  4099 +>>18 beshort 15 PA-RISC
  4100 +>>>50 beshort 0x0214 2.0
  4101 +>>>48 beshort &0x0008 (LP64)
  4102 +>>18 beshort 16 nCUBE,
  4103 +>>18 beshort 17 Fujitsu VPP500,
  4104 +>>18 beshort 18 SPARC32PLUS,
  4105 +>>>36 belong&0xffff00 &0x000100 V8+ Required,
  4106 +>>>36 belong&0xffff00 &0x000200 Sun UltraSPARC1 Extensions Required,
  4107 +>>>36 belong&0xffff00 &0x000400 HaL R1 Extensions Required,
  4108 +>>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required,
  4109 +>>18 beshort 20 PowerPC or cisco 4500,
  4110 +>>18 beshort 21 64-bit PowerPC or cisco 7500,
  4111 +>>18 beshort 22 IBM S/390,
  4112 +>>18 beshort 23 Cell SPU,
  4113 +>>18 beshort 24 cisco SVIP,
  4114 +>>18 beshort 25 cisco 7200,
  4115 +>>18 beshort 36 NEC V800 or cisco 12000,
  4116 +>>18 beshort 37 Fujitsu FR20,
  4117 +>>18 beshort 38 TRW RH-32,
  4118 +>>18 beshort 39 Motorola RCE,
  4119 +>>18 beshort 40 ARM,
  4120 +>>18 beshort 41 Alpha,
  4121 +>>18 beshort 42 Renesas SH,
  4122 +>>18 beshort 43 SPARC V9,
  4123 +>>18 beshort 44 Siemens Tricore Embedded Processor,
  4124 +>>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc.,
  4125 +>>18 beshort 46 Renesas H8/300,
  4126 +>>18 beshort 47 Renesas H8/300H,
  4127 +>>18 beshort 48 Renesas H8S,
  4128 +>>18 beshort 49 Renesas H8/500,
  4129 +>>18 beshort 50 IA-64,
  4130 +>>18 beshort 51 Stanford MIPS-X,
  4131 +>>18 beshort 52 Motorola Coldfire,
  4132 +>>18 beshort 53 Motorola M68HC12,
  4133 +>>18 beshort 73 Cray NV1,
  4134 +>>18 beshort 75 Digital VAX,
  4135 +>>18 beshort 88 Renesas M32R,
  4136 +>>18 beshort 94 Tensilica Xtensa,
  4137 +>>18 beshort 97 NatSemi 32k,
  4138 +>>18 beshort 0x9026 Alpha (unofficial),
  4139 +>>18 beshort 0xa390 IBM S/390 (obsolete),
  4140 +>>20 belong 0 invalid version
  4141 +>>20 belong 1 version 1
  4142 +>>36 belong 1 MathCoPro/FPU/MAU Required
  4143 +# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
  4144 +# like proper ELF, but extracting the string had bad results.
  4145 +>4 byte <0x80
  4146 +>>8 string >\0 (%s)
  4147 +>8 string \0
  4148 +>>7 byte 0 (SYSV)
  4149 +>>7 byte 1 (HP-UX)
  4150 +>>7 byte 2 (NetBSD)
  4151 +>>7 byte 3 (GNU/Linux)
  4152 +>>7 byte 4 (GNU/Hurd)
  4153 +>>7 byte 5 (86Open)
  4154 +>>7 byte 6 (Solaris)
  4155 +>>7 byte 7 (Monterey)
  4156 +>>7 byte 8 (IRIX)
  4157 +>>7 byte 9 (FreeBSD)
  4158 +>>7 byte 10 (Tru64)
  4159 +>>7 byte 11 (Novell Modesto)
  4160 +>>7 byte 12 (OpenBSD)
  4161 +# VMS Itanium added by gerardo.cacciari@gmail.com
  4162 +>8 string \2
  4163 +>>7 byte 13 (OpenVMS)
  4164 +>>7 byte 97 (ARM)
  4165 +>>7 byte 255 (embedded)
  4166 +
  4167 +#------------------------------------------------------------------------------
  4168 +# encore: file(1) magic for Encore machines
  4169 +#
  4170 +# XXX - needs to have the byte order specified (NS32K was little-endian,
  4171 +# dunno whether they run the 88K in little-endian mode or not).
  4172 +#
  4173 +0 short 0x154 Encore
  4174 +>20 short 0x107 executable
  4175 +>20 short 0x108 pure executable
  4176 +>20 short 0x10b demand-paged executable
  4177 +>20 short 0x10f unsupported executable
  4178 +>12 long >0 not stripped
  4179 +>22 short >0 - version %ld
  4180 +>22 short 0 -
  4181 +#>4 date x stamp %s
  4182 +0 short 0x155 Encore unsupported executable
  4183 +>12 long >0 not stripped
  4184 +>22 short >0 - version %ld
  4185 +>22 short 0 -
  4186 +#>4 date x stamp %s
  4187 +
  4188 +#------------------------------------------------------------------------------
  4189 +# Epoc 32 : file(1) magic for Epoc Documents [psion/osaris
  4190 +# Stefan Praszalowicz (hpicollo@worldnet.fr)
  4191 +#0 lelong 0x10000037 Epoc32
  4192 +>4 lelong 0x1000006D
  4193 +>>8 lelong 0x1000007F Word
  4194 +>>8 lelong 0x10000088 Sheet
  4195 +>>8 lelong 0x1000007D Sketch
  4196 +>>8 lelong 0x10000085 TextEd
  4197 +
  4198 +#------------------------------------------------------------------------------
  4199 +# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
  4200 +# Based on info from
  4201 +# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
  4202 +0 belong 9994 ESRI Shapefile
  4203 +>4 belong =0
  4204 +>8 belong =0
  4205 +>12 belong =0
  4206 +>16 belong =0
  4207 +>20 belong =0
  4208 +>28 lelong x version %d
  4209 +>24 belong x length %d
  4210 +>32 lelong =0 type Null Shape
  4211 +>32 lelong =1 type Point
  4212 +>32 lelong =3 type PolyLine
  4213 +>32 lelong =5 type Polygon
  4214 +>32 lelong =8 type MultiPoint
  4215 +>32 lelong =11 type PointZ
  4216 +>32 lelong =13 type PolyLineZ
  4217 +>32 lelong =15 type PolygonZ
  4218 +>32 lelong =18 type MultiPointZ
  4219 +>32 lelong =21 type PointM
  4220 +>32 lelong =23 type PolyLineM
  4221 +>32 lelong =25 type PolygonM
  4222 +>32 lelong =28 type MultiPointM
  4223 +>32 lelong =31 type MultiPatch
  4224 +
  4225 +#------------------------------------------------------------------------------
  4226 +# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
  4227 +# From Roger Leigh <roger@whinlatter.uklinux.net>
  4228 +0 string FCS1.0 Flow Cytometry Standard (FCS) data, version 1.0
  4229 +0 string FCS2.0 Flow Cytometry Standard (FCS) data, version 2.0
  4230 +0 string FCS3.0 Flow Cytometry Standard (FCS) data, version 3.0
  4231 +
  4232 +
  4233 +#------------------------------------------------------------------------------
  4234 +# filesystems: file(1) magic for different filesystems
  4235 +#
  4236 +0 string \366\366\366\366 PC formatted floppy with no filesystem
  4237 +# Sun disk labels
  4238 +# From /usr/include/sun/dklabel.h:
  4239 +0774 beshort 0xdabe
  4240 +# modified by Joerg Jenderek, because original test
  4241 +# succeeds for Cabinet archive dao360.dl_ with negative blocks
  4242 +>0770 long >0 Sun disk label
  4243 +>>0 string x '%s
  4244 +>>>31 string >\0 \b%s
  4245 +>>>>63 string >\0 \b%s
  4246 +>>>>>95 string >\0 \b%s
  4247 +>>0 string x \b'
  4248 +>>0734 short >0 %d rpm,
  4249 +>>0736 short >0 %d phys cys,
  4250 +>>0740 short >0 %d alts/cyl,
  4251 +>>0746 short >0 %d interleave,
  4252 +>>0750 short >0 %d data cyls,
  4253 +>>0752 short >0 %d alt cyls,
  4254 +>>0754 short >0 %d heads/partition,
  4255 +>>0756 short >0 %d sectors/track,
  4256 +>>0764 long >0 start cyl %ld,
  4257 +>>0770 long x %ld blocks
  4258 +# Is there a boot block written 1 sector in?
  4259 +>512 belong&077777777 0600407 \b, boot block present
  4260 +# Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc
  4261 +# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
  4262 +0 string SBMBAKUP_ Smart Boot Manager backup file
  4263 +>9 string x \b, version %-5.5s
  4264 +>>14 string =_
  4265 +>>>15 string x %-.1s
  4266 +>>>>16 string =_ \b.
  4267 +>>>>>17 string x \b%-.1s
  4268 +>>>>>>18 string =_ \b.
  4269 +>>>>>>>19 string x \b%-.1s
  4270 +>>>22 ubyte 0
  4271 +>>>>21 ubyte x \b, from drive 0x%x
  4272 +>>>22 ubyte >0
  4273 +>>>>21 string x \b, from drive %s
  4274 +
  4275 +# Joerg Jenderek
  4276 +# DOS Emulator image is 128 byte, null right padded header + harddisc image
  4277 +0 string DOSEMU\0
  4278 +>0x27E leshort 0xAA55
  4279 +#offset is 128
  4280 +>>19 ubyte 128
  4281 +>>>(19.b-1) ubyte 0x0 DOS Emulator image
  4282 +>>>>7 ulelong >0 \b, %u heads
  4283 +>>>>11 ulelong >0 \b, %d sectors/track
  4284 +>>>>15 ulelong >0 \b, %d cylinders
  4285 +
  4286 +0x1FE leshort 0xAA55 x86 boot sector
  4287 +>2 string OSBS \b, OS/BS MBR
  4288 +# J\xf6rg Jenderek <joerg dot jenderek at web dot de>
  4289 +>0x8C string Invalid\ partition\ table \b, MS-DOS MBR
  4290 +# dr-dos with some upper-, lowercase variants
  4291 +>0x9D string Invalid\ partition\ table$
  4292 +>>181 string No\ Operating\ System$
  4293 +>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  4294 +>0x9D string Invalid\ partition\ table$
  4295 +>>181 string No\ operating\ system$
  4296 +>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03
  4297 +>342 string Invalid\ partition\ table$
  4298 +>>366 string No\ operating\ system$
  4299 +>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03
  4300 +>295 string NEWLDR\0
  4301 +>>302 string Bad\ PT\ $
  4302 +>>>310 string No\ OS\ $
  4303 +>>>>317 string OS\ load\ err$
  4304 +>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r
  4305 +>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$
  4306 +>>>>>>>387 string Copyright\ (c)\ 1984,1998
  4307 +>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR)
  4308 +>0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
  4309 +>>0x1B8 ubelong >0 \b, Serial 0x%-.4x
  4310 +>0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950
  4311 +>271 string Invalid\ partition\ table\0
  4312 +>>295 string Error\ loading\ operating\ system\0
  4313 +>>>326 string Missing\ operating\ system\0 \b, mbr
  4314 +#
  4315 +>139 string Invalid\ partition\ table\0
  4316 +>>163 string Error\ loading\ operating\ system\0
  4317 +>>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr
  4318 +# http://www.heise.de/ct/05/09/006/ page 184
  4319 +#HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes
  4320 +>>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x
  4321 +>300 string Invalid\ partition\ table\0
  4322 +>>324 string Error\ loading\ operating\ system\0
  4323 +>>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR
  4324 +#??>>>389 string Invalid\ system\ disk
  4325 +>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
  4326 +>300 string Ung\201ltige\ Partitionstabelle
  4327 +#split string to avoid error: String too long
  4328 +>>328 string Fehler\ beim\ Laden\
  4329 +>>>346 string des\ Betriebssystems
  4330 +>>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german)
  4331 +>>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x
  4332 +>0x145 string Default:\ F \b, FREE-DOS MBR
  4333 +>64 string no\ active\ partition\ found
  4334 +>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR
  4335 +>271 string Operating\ system\ loading
  4336 +>>296 string error\r \b, SYSLINUX MBR (2.10)
  4337 +# http://www.acronis.de/
  4338 +>362 string MBR\ Error\ \0\r
  4339 +>>376 string ress\ any\ key\ to\
  4340 +>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR
  4341 +# added by Joerg Jenderek
  4342 +# http://www.visopsys.org/
  4343 +# http://partitionlogic.org.uk/
  4344 +>309 string No\ bootable\ partition\ found\r
  4345 +>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR
  4346 +>349 string No\ bootable\ partition\ found\r
  4347 +>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR
  4348 +# bootloader, bootmanager
  4349 +>0x40 string SBML
  4350 +# label with 11 characters of FAT 12 bit filesystem
  4351 +>>43 string SMART\ BTMGR
  4352 +>>>430 string SBMK\ Bad!\r
  4353 +>>>>3 string SBM \b, Smart Boot Manager
  4354 +>>>>>6 string >\0 \b, version %s
  4355 +>382 string XOSLLOADXCF \b, eXtended Operating System Loader
  4356 +>6 string LILO \b, LInux i386 boot LOader
  4357 +>>120 string LILO \b, version 22.3.4 SuSe
  4358 +>>172 string LILO \b, version 22.5.8 Debian
  4359 +# updated by Joerg Jenderek
  4360 +# variables according to grub-0.97/stage1/stage1.S or
  4361 +# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  4362 +# usual values are marked with comments to get only informations of strange GRUB loaders
  4363 +>0 ulelong 0x009048EB
  4364 +>>0x41 ubyte <2
  4365 +>>>0x3E ubyte >2 \b; GRand Unified Bootloader
  4366 +# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
  4367 +>>>>0x3E ubyte x \b, stage1 version 0x%x
  4368 +#If it is 0xFF, use a drive passed by BIOS
  4369 +>>>>0x40 ubyte <0xFF \b, boot drive 0x%x
  4370 +# in most case 0,1,0x2e for GRUB 0.5.95
  4371 +>>>>0x41 ubyte >0 \b, LBA flag 0x%x
  4372 +>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x
  4373 +#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual)
  4374 +>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x
  4375 +#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default)
  4376 +>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x
  4377 +>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x
  4378 +#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual)
  4379 +>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x
  4380 +>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4381 +>>>>>394 string stage1 \b, GRUB version 0.5.95
  4382 +>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4383 +>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94
  4384 +>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4385 +>>>>>377 string GRUB\ \0 \b, GRUB version 0.94
  4386 +>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4387 +>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96
  4388 +>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4389 +>>>>>385 string GRUB\ \0 \b, GRUB version 0.97
  4390 +#unkown version
  4391 +>>>343 string Geom\0Read\0\ Error\0
  4392 +>>>>321 string Loading\ stage1.5 \b, GRUB version x.y
  4393 +>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0
  4394 +>>>>374 string GRUB\ \0 \b, GRUB version n.m
  4395 +# http://syslinux.zytor.com/
  4396 +>478 string Boot\ failed\r
  4397 +>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62)
  4398 +>480 string Boot\ failed\r
  4399 +>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11)
  4400 +>484 string Boot\ error\r \b, SYSLINUX bootloader (3.11)
  4401 +>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader
  4402 +# http://www.bcdwb.de/bcdw/index_e.htm
  4403 +>3 string BCDL
  4404 +>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z)
  4405 +# mbr partion table entries
  4406 +# OEM-ID not Microsoft,SYSLINUX,or MTOOLs
  4407 +>3 string !MS
  4408 +>>3 string !SYSLINUX
  4409 +>>>3 string !MTOOL
  4410 +# not FAT (32 bit)
  4411 +>>>>82 string !FAT32
  4412 +#not IO.SYS
  4413 +>>>>>472 string !IO\ \ \ \ \ \ SYS
  4414 +#not Linux kernel
  4415 +>>>>>>514 string !HdrS
  4416 +# active flag 0 or 0x80 and type > 0
  4417 +>>>>>>>446 ubyte <0x81
  4418 +>>>>>>>>446 ubyte&0x7F 0
  4419 +>>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x
  4420 +>>>>>>>>>>446 ubyte 0x80 \b, active
  4421 +>>>>>>>>>>447 ubyte x \b, starthead %u
  4422 +#>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x
  4423 +#>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d
  4424 +>>>>>>>>>>454 ulelong x \b, startsector %u
  4425 +>>>>>>>>>>458 ulelong x \b, %u sectors
  4426 +#
  4427 +>>>>>>>462 ubyte <0x81
  4428 +>>>>>>>>462 ubyte&0x7F 0
  4429 +>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x
  4430 +>>>>>>>>>>462 ubyte 0x80 \b, active
  4431 +>>>>>>>>>>463 ubyte x \b, starthead %u
  4432 +#>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x
  4433 +#>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d
  4434 +>>>>>>>>>>470 ulelong x \b, startsector %u
  4435 +>>>>>>>>>>474 ulelong x \b, %u sectors
  4436 +#
  4437 +>>>>>>>478 ubyte <0x81
  4438 +>>>>>>>>478 ubyte&0x7F 0
  4439 +>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x
  4440 +>>>>>>>>>>478 ubyte 0x80 \b, active
  4441 +>>>>>>>>>>479 ubyte x \b, starthead %u
  4442 +#>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x
  4443 +#>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x
  4444 +#>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d
  4445 +>>>>>>>>>>486 ulelong x \b, startsector %u
  4446 +>>>>>>>>>>490 ulelong x \b, %u sectors
  4447 +#
  4448 +>>>>>>>494 ubyte <0x81
  4449 +>>>>>>>>494 ubyte&0x7F 0
  4450 +>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x
  4451 +>>>>>>>>>>494 ubyte 0x80 \b, active
  4452 +>>>>>>>>>>495 ubyte x \b, starthead %u
  4453 +#>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x
  4454 +#>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d
  4455 +>>>>>>>>>>502 ulelong x \b, startsector %u
  4456 +>>>>>>>>>>506 ulelong x \b, %u sectors
  4457 +# mbr partion table entries end
  4458 +# http://www.acronis.de/
  4459 +#FAT label=ACRONIS\ SZ
  4460 +#OEM-ID=BOOTWIZ0
  4461 +>442 string Non-system\ disk,\
  4462 +>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader
  4463 +# DOS names like F11.SYS are 8 right space padded bytes+3 bytes
  4464 +>>>477 ubyte&0xDF >0
  4465 +>>>>477 string x \b %-.3s
  4466 +>>>>>480 ubyte&0xDF >0
  4467 +>>>>>>480 string x \b%-.5s
  4468 +>>>>485 ubyte&0xDF >0
  4469 +>>>>>485 string x \b.%-.3s
  4470 +#
  4471 +>185 string FDBOOT\ Version\
  4472 +>>204 string \rNo\ Systemdisk.\
  4473 +>>>220 string Booting\ from\ harddisk.\n\r
  4474 +>>>245 string Cannot\ load\ from\ harddisk.\n\r
  4475 +>>>>273 string Insert\ Systemdisk\
  4476 +>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader
  4477 +>>>>>>200 string >\0 \b, version %-3s
  4478 +>242 string Bootsector\ from\ C.H.\ Hochst\204
  4479 +>>278 string No\ Systemdisk.\
  4480 +>>>293 string Booting\ from\ harddisk.\n\r
  4481 +>>>441 string Cannot\ load\ from\ harddisk.\n\r
  4482 +>>>>469 string Insert\ Systemdisk\
  4483 +>>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader
  4484 +>>>>>>209 string >\0 \b, version %-4.4s
  4485 +>(1.b+2) ubyte 0xe
  4486 +>>(1.b+3) ubyte 0x1f
  4487 +>>>(1.b+4) ubyte 0xbe
  4488 +>>>>(1.b+5) ubyte 0x77
  4489 +>>>>(1.b+6) ubyte 0x7c
  4490 +>>>>>(1.b+7) ubyte 0xac
  4491 +>>>>>>(1.b+8) ubyte 0x22
  4492 +>>>>>>>(1.b+9) ubyte 0xc0
  4493 +>>>>>>>>(1.b+10) ubyte 0x74
  4494 +>>>>>>>>>(1.b+11) ubyte 0xb
  4495 +>>>>>>>>>>(1.b+12) ubyte 0x56
  4496 +>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display
  4497 +>103 string This\ is\ not\ a\ bootable\ disk.\
  4498 +>>132 string Please\ insert\ a\ bootable\
  4499 +>>>157 string floppy\ and\r\n
  4500 +>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display
  4501 +#
  4502 +>66 string Solaris\ Boot\ Sector
  4503 +>>99 string Incomplete\ MDBoot\ load.
  4504 +>>>89 string Version \b, Sun Solaris Bootloader
  4505 +>>>>97 byte x version %c
  4506 +#
  4507 +>408 string OS/2\ !!\ SYS01475\r\0
  4508 +>>429 string OS/2\ !!\ SYS02025\r\0
  4509 +>>>450 string OS/2\ !!\ SYS02027\r\0
  4510 +>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader
  4511 +#
  4512 +>409 string OS/2\ !!\ SYS01475\r\0
  4513 +>>430 string OS/2\ !!\ SYS02025\r\0
  4514 +>>>451 string OS/2\ !!\ SYS02027\r\0
  4515 +>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader
  4516 +>112 string This\ disk\ is\ not\ bootable\r
  4517 +>>142 string If\ you\ wish\ to\ make\ it\ bootable
  4518 +>>>176 string run\ the\ DOS\ program\ SYS\
  4519 +>>>200 string after\ the\r
  4520 +>>>>216 string system\ has\ been\ loaded\r\n
  4521 +>>>>>242 string Please\ insert\ a\ DOS\ diskette\
  4522 +>>>>>271 string into\r\n\ the\ drive\ and\
  4523 +>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display
  4524 +# XP
  4525 +>430 string NTLDR\ is\ missing\xFF\r\n
  4526 +>>449 string Disk\ error\xFF\r\n
  4527 +>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader
  4528 +# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
  4529 +>>>>417 ubyte&0xDF >0
  4530 +>>>>>417 string x %-.5s
  4531 +>>>>>>422 ubyte&0xDF >0
  4532 +>>>>>>>422 string x \b%-.3s
  4533 +>>>>>425 ubyte&0xDF >0
  4534 +>>>>>>425 string >\ \b.%-.3s
  4535 +#
  4536 +>>>>371 ubyte >0x20
  4537 +>>>>>368 ubyte&0xDF >0
  4538 +>>>>>>368 string x %-.5s
  4539 +>>>>>>>373 ubyte&0xDF >0
  4540 +>>>>>>>>373 string x \b%-.3s
  4541 +>>>>>>376 ubyte&0xDF >0
  4542 +>>>>>>>376 string x \b.%-.3s
  4543 +#
  4544 +>430 string NTLDR\ nicht\ gefunden\xFF\r\n
  4545 +>>453 string Datentr\204gerfehler\xFF\r\n
  4546 +>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german)
  4547 +>>>>417 ubyte&0xDF >0
  4548 +>>>>>417 string x %-.5s
  4549 +>>>>>>422 ubyte&0xDF >0
  4550 +>>>>>>>422 string x \b%-.3s
  4551 +>>>>>425 ubyte&0xDF >0
  4552 +>>>>>>425 string >\ \b.%-.3s
  4553 +# offset variant
  4554 +>>>>379 string \0
  4555 +>>>>>368 ubyte&0xDF >0
  4556 +>>>>>>368 string x %-.5s
  4557 +>>>>>>>373 ubyte&0xDF >0
  4558 +>>>>>>>>373 string x \b%-.3s
  4559 +#
  4560 +>430 string NTLDR\ fehlt\xFF\r\n
  4561 +>>444 string Datentr\204gerfehler\xFF\r\n
  4562 +>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german)
  4563 +>>>>417 ubyte&0xDF >0
  4564 +>>>>>417 string x %-.5s
  4565 +>>>>>>422 ubyte&0xDF >0
  4566 +>>>>>>>422 string x \b%-.3s
  4567 +>>>>>425 ubyte&0xDF >0
  4568 +>>>>>>425 string >\ \b.%-.3s
  4569 +# variant
  4570 +>>>>371 ubyte >0x20
  4571 +>>>>>368 ubyte&0xDF >0
  4572 +>>>>>>368 string x %-.5s
  4573 +>>>>>>>373 ubyte&0xDF >0
  4574 +>>>>>>>>373 string x \b%-.3s
  4575 +>>>>>>376 ubyte&0xDF >0
  4576 +>>>>>>>376 string x \b.%-.3s
  4577 +#
  4578 +>430 string NTLDR\ fehlt\xFF\r\n
  4579 +>>444 string Medienfehler\xFF\r\n
  4580 +>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german)
  4581 +>>>>371 ubyte >0x20
  4582 +>>>>>368 ubyte&0xDF >0
  4583 +>>>>>>368 string x %-.5s
  4584 +>>>>>>>373 ubyte&0xDF >0
  4585 +>>>>>>>>373 string x \b%-.3s
  4586 +>>>>>>376 ubyte&0xDF >0
  4587 +>>>>>>>376 string x \b.%-.3s
  4588 +# variant
  4589 +>>>>417 ubyte&0xDF >0
  4590 +>>>>>417 string x %-.5s
  4591 +>>>>>>422 ubyte&0xDF >0
  4592 +>>>>>>>422 string x \b%-.3s
  4593 +>>>>>425 ubyte&0xDF >0
  4594 +>>>>>>425 string >\ \b.%-.3s
  4595 +#
  4596 +>430 string Datentr\204ger\ entfernen\xFF\r\n
  4597 +>>454 string Medienfehler\xFF\r\n
  4598 +>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german)
  4599 +>>>>368 ubyte&0xDF >0
  4600 +>>>>>368 string x %-.5s
  4601 +>>>>>>373 ubyte&0xDF >0
  4602 +>>>>>>>373 string x \b%-.3s
  4603 +>>>>>376 ubyte&0xDF >0
  4604 +>>>>>>376 string x \b.%-.3s
  4605 +#>3 string NTFS\ \ \ \
  4606 +>389 string Fehler\ beim\ Lesen\
  4607 +>>407 string des\ Datentr\204gers
  4608 +>>>426 string NTLDR\ fehlt
  4609 +>>>>440 string NTLDR\ ist\ komprimiert
  4610 +>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german)
  4611 +#>3 string NTFS\ \ \ \
  4612 +>313 string A\ disk\ read\ error\ occurred.\r
  4613 +>>345 string A\ kernel\ file\ is\ missing\
  4614 +>>>370 string from\ the\ disk.\r
  4615 +>>>>484 string NTLDR\ is\ compressed
  4616 +>>>>>429 string Insert\ a\ system\ diskette\
  4617 +>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS
  4618 +# DOS loader variants different languages,offsets
  4619 +>472 ubyte&0xDF >0
  4620 +>>389 string Invalid\ system\ disk\xFF\r\n
  4621 +>>>411 string Disk\ I/O\ error
  4622 +>>>>428 string Replace\ the\ disk,\ and\
  4623 +>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader
  4624 +#IO.SYS
  4625 +>>>>>>472 ubyte&0xDF >0
  4626 +>>>>>>>472 string x \b %-.2s
  4627 +>>>>>>>>474 ubyte&0xDF >0
  4628 +>>>>>>>>>474 string x \b%-.5s
  4629 +>>>>>>>>>>479 ubyte&0xDF >0
  4630 +>>>>>>>>>>>479 string x \b%-.1s
  4631 +>>>>>>>480 ubyte&0xDF >0
  4632 +>>>>>>>>480 string x \b.%-.3s
  4633 +#MSDOS.SYS
  4634 +>>>>>>>483 ubyte&0xDF >0 \b+
  4635 +>>>>>>>>483 string x \b%-.5s
  4636 +>>>>>>>>>488 ubyte&0xDF >0
  4637 +>>>>>>>>>>488 string x \b%-.3s
  4638 +>>>>>>>>491 ubyte&0xDF >0
  4639 +>>>>>>>>>491 string x \b.%-.3s
  4640 +#
  4641 +>>390 string Invalid\ system\ disk\xFF\r\n
  4642 +>>>412 string Disk\ I/O\ error\xFF\r\n
  4643 +>>>>429 string Replace\ the\ disk,\ and\
  4644 +>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader
  4645 +>>388 string Ungueltiges\ System\ \xFF\r\n
  4646 +>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n
  4647 +>>>>427 string Datentraeger\ wechseln\ und\
  4648 +>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german)
  4649 +#WINBOOT.SYS only not spaces (0xDF)
  4650 +>>>>>>497 ubyte&0xDF >0
  4651 +>>>>>>>497 string x %-.5s
  4652 +>>>>>>>>502 ubyte&0xDF >0
  4653 +>>>>>>>>>502 string x \b%-.1s
  4654 +>>>>>>>>>>503 ubyte&0xDF >0
  4655 +>>>>>>>>>>>503 string x \b%-.1s
  4656 +>>>>>>>>>>>>504 ubyte&0xDF >0
  4657 +>>>>>>>>>>>>>504 string x \b%-.1s
  4658 +>>>>>>505 ubyte&0xDF >0
  4659 +>>>>>>>505 string x \b.%-.3s
  4660 +#IO.SYS
  4661 +>>>>>>472 ubyte&0xDF >0 or
  4662 +>>>>>>>472 string x \b %-.2s
  4663 +>>>>>>>>474 ubyte&0xDF >0
  4664 +>>>>>>>>>474 string x \b%-.5s
  4665 +>>>>>>>>>>479 ubyte&0xDF >0
  4666 +>>>>>>>>>>>479 string x \b%-.1s
  4667 +>>>>>>>480 ubyte&0xDF >0
  4668 +>>>>>>>>480 string x \b.%-.3s
  4669 +#MSDOS.SYS
  4670 +>>>>>>>483 ubyte&0xDF >0 \b+
  4671 +>>>>>>>>483 string x \b%-.5s
  4672 +>>>>>>>>>488 ubyte&0xDF >0
  4673 +>>>>>>>>>>488 string x \b%-.3s
  4674 +>>>>>>>>491 ubyte&0xDF >0
  4675 +>>>>>>>>>491 string x \b.%-.3s
  4676 +#
  4677 +>>390 string Ungueltiges\ System\ \xFF\r\n
  4678 +>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n
  4679 +>>>>429 string Datentraeger\ wechseln\ und\
  4680 +>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German)
  4681 +#WINBOOT.SYS only not spaces (0xDF)
  4682 +>>>>>>497 ubyte&0xDF >0
  4683 +>>>>>>>497 string x %-.7s
  4684 +>>>>>>>>504 ubyte&0xDF >0
  4685 +>>>>>>>>>504 string x \b%-.1s
  4686 +>>>>>>505 ubyte&0xDF >0
  4687 +>>>>>>>505 string x \b.%-.3s
  4688 +#IO.SYS
  4689 +>>>>>>472 ubyte&0xDF >0 or
  4690 +>>>>>>>472 string x \b %-.2s
  4691 +>>>>>>>>474 ubyte&0xDF >0
  4692 +>>>>>>>>>474 string x \b%-.6s
  4693 +>>>>>>>480 ubyte&0xDF >0
  4694 +>>>>>>>>480 string x \b.%-.3s
  4695 +#MSDOS.SYS
  4696 +>>>>>>>483 ubyte&0xDF >0 \b+
  4697 +>>>>>>>>483 string x \b%-.5s
  4698 +>>>>>>>>>488 ubyte&0xDF >0
  4699 +>>>>>>>>>>488 string x \b%-.3s
  4700 +>>>>>>>>491 ubyte&0xDF >0
  4701 +>>>>>>>>>491 string x \b.%-.3s
  4702 +#
  4703 +>>389 string Ungueltiges\ System\ \xFF\r\n
  4704 +>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n
  4705 +>>>>428 string Datentraeger\ wechseln\ und\
  4706 +>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
  4707 +# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
  4708 +>>>>>>472 string x %-.2s
  4709 +>>>>>>>474 ubyte&0xDF >0
  4710 +>>>>>>>>474 string x \b%-.5s
  4711 +>>>>>>>>479 ubyte&0xDF >0
  4712 +>>>>>>>>>479 string x \b%-.1s
  4713 +>>>>>>480 ubyte&0xDF >0
  4714 +>>>>>>>480 string x \b.%-.3s
  4715 +>>>>>>483 ubyte&0xDF >0 \b+
  4716 +>>>>>>>483 string x \b%-.5s
  4717 +>>>>>>>488 ubyte&0xDF >0
  4718 +>>>>>>>>488 string x \b%-.2s
  4719 +>>>>>>>>490 ubyte&0xDF >0
  4720 +>>>>>>>>>490 string x \b%-.1s
  4721 +>>>>>>>491 ubyte&0xDF >0
  4722 +>>>>>>>>491 string x \b.%-.3s
  4723 +>479 ubyte&0xDF >0
  4724 +>>416 string Kein\ System\ oder\
  4725 +>>>433 string Laufwerksfehler
  4726 +>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german)
  4727 +#IO.SYS
  4728 +>>>>>479 string x \b %-.2s
  4729 +>>>>>>481 ubyte&0xDF >0
  4730 +>>>>>>>481 string x \b%-.6s
  4731 +>>>>>487 ubyte&0xDF >0
  4732 +>>>>>>487 string x \b.%-.3s
  4733 +#MSDOS.SYS
  4734 +>>>>>>490 ubyte&0xDF >0 \b+
  4735 +>>>>>>>490 string x \b%-.5s
  4736 +>>>>>>>>495 ubyte&0xDF >0
  4737 +>>>>>>>>>495 string x \b%-.3s
  4738 +>>>>>>>498 ubyte&0xDF >0
  4739 +>>>>>>>>498 string x \b.%-.3s
  4740 +#
  4741 +>486 ubyte&0xDF >0
  4742 +>>416 string Non-System\ disk\ or\
  4743 +>>>435 string disk\ error\r
  4744 +>>>>447 string Replace\ and\ press\ any\ key\
  4745 +>>>>>473 string when\ ready\r \b, Microsoft DOS Bootloader
  4746 +>480 ubyte&0xDF >0
  4747 +>>393 string Non-System\ disk\ or\
  4748 +>>>412 string disk\ error\r
  4749 +>>>>424 string Replace\ and\ press\ any\ key\
  4750 +>>>>>450 string when\ ready\r \b, Microsoft DOS bootloader
  4751 +#IO.SYS
  4752 +>>>>>480 string x \b %-.2s
  4753 +>>>>>>482 ubyte&0xDF >0
  4754 +>>>>>>>48 string x \b%-.6s
  4755 +>>>>>488 ubyte&0xDF >0
  4756 +>>>>>>488 string x \b.%-.3s
  4757 +#MSDOS.SYS
  4758 +>>>>>>491 ubyte&0xDF >0 \b+
  4759 +>>>>>>>491 string x \b%-.5s
  4760 +>>>>>>>>496 ubyte&0xDF >0
  4761 +>>>>>>>>>496 string x \b%-.3s
  4762 +>>>>>>>499 ubyte&0xDF >0
  4763 +>>>>>>>>499 string x \b.%-.3s
  4764 +#>43 string \224R-LOADER\ \ SYS =label
  4765 +>54 string SYS
  4766 +>>324 string VASKK
  4767 +>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS)
  4768 +#
  4769 +>70 string IBMBIO\ \ COM
  4770 +>>472 string Cannot\ load\ DOS!\
  4771 +>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader
  4772 +>>471 string Cannot\ load\ DOS\
  4773 +>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader
  4774 +>444 string KERNEL\ \ SYS
  4775 +>>314 string BOOT\ error! \b, FREE-DOS Bootloader
  4776 +>499 string KERNEL\ \ SYS
  4777 +>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader
  4778 +>449 string KERNEL\ \ SYS
  4779 +>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader
  4780 +>125 string Loading\ FreeDOS...\r
  4781 +>>311 string BOOT\ error!\r \b, FREE-DOS bootloader
  4782 +>>>441 ubyte&0xDF >0
  4783 +>>>>441 string x \b %-.6s
  4784 +>>>>>447 ubyte&0xDF >0
  4785 +>>>>>>447 string x \b%-.1s
  4786 +>>>>>>>448 ubyte&0xDF >0
  4787 +>>>>>>>>448 string x \b%-.1s
  4788 +>>>>449 ubyte&0xDF >0
  4789 +>>>>>449 string x \b.%-.3s
  4790 +>124 string FreeDOS\0
  4791 +>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader
  4792 +# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
  4793 +>>>497 ubyte&0xDF >0
  4794 +>>>>497 string x \b %-.6s
  4795 +>>>>>503 ubyte&0xDF >0
  4796 +>>>>>>503 string x \b%-.1s
  4797 +>>>>>>>504 ubyte&0xDF >0
  4798 +>>>>>>>>504 string x \b%-.1s
  4799 +>>>>505 ubyte&0xDF >0
  4800 +>>>>>505 string x \b.%-.3s
  4801 +>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader
  4802 +>>>497 ubyte&0xDF >0
  4803 +>>>>497 string x \b %-.6s
  4804 +>>>>>503 ubyte&0xDF >0
  4805 +>>>>>>503 string x \b%-.1s
  4806 +>>>>>>>504 ubyte&0xDF >0
  4807 +>>>>>>>>504 string x \b%-.1s
  4808 +>>>>505 ubyte&0xDF >0
  4809 +>>>>>505 string x \b.%-.3s
  4810 +>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader
  4811 +>>>497 ubyte&0xDF >0
  4812 +>>>>497 string x \b %-.6s
  4813 +>>>>>503 ubyte&0xDF >0
  4814 +>>>>>>503 string x \b%-.1s
  4815 +>>>>>>>504 ubyte&0xDF >0
  4816 +>>>>>>>>504 string x \b%-.1s
  4817 +>>>>505 ubyte&0xDF >0
  4818 +>>>>>505 string x \b.%-.3s
  4819 +>336 string Error!\
  4820 +>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader
  4821 +>>>497 ubyte&0xDF >0
  4822 +>>>>497 string x \b %-.6s
  4823 +>>>>>503 ubyte&0xDF >0
  4824 +>>>>>>503 string x \b%-.1s
  4825 +>>>>>>>504 ubyte&0xDF >0
  4826 +>>>>>>>>504 string x \b%-.1s
  4827 +>>>>505 ubyte&0xDF >0
  4828 +>>>>>505 string x \b.%-.3s
  4829 +# added by Joerg Jenderek
  4830 +# http://www.visopsys.org/
  4831 +# http://partitionlogic.org.uk/
  4832 +# OEM-ID=Visopsys
  4833 +>478 ulelong 0
  4834 +>>(1.b+326) string I/O\ Error\ reading\
  4835 +>>>(1.b+344) string Visopsys\ loader\r
  4836 +>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader
  4837 +# http://alexfru.chat.ru/epm.html#bootprog
  4838 +>494 ubyte >0x4D
  4839 +>>495 string >E
  4840 +>>>495 string <S
  4841 +#OEM-ID is not reliable
  4842 +>>>>3 string BootProg
  4843 +# It just looks for a program file name at the root directory
  4844 +# and loads corresponding file with following execution.
  4845 +# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
  4846 +>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
  4847 +>>>>>499 string x \b %-.1s
  4848 +>>>>>>500 ubyte&0xDF >0
  4849 +>>>>>>>500 string x \b%-.1s
  4850 +>>>>>>>>501 ubyte&0xDF >0
  4851 +>>>>>>>>>501 string x \b%-.1s
  4852 +>>>>>>>>>>502 ubyte&0xDF >0
  4853 +>>>>>>>>>>>502 string x \b%-.1s
  4854 +>>>>>>>>>>>>503 ubyte&0xDF >0
  4855 +>>>>>>>>>>>>>503 string x \b%-.1s
  4856 +>>>>>>>>>>>>>>504 ubyte&0xDF >0
  4857 +>>>>>>>>>>>>>>>504 string x \b%-.1s
  4858 +>>>>>>>>>>>>>>>>505 ubyte&0xDF >0
  4859 +>>>>>>>>>>>>>>>>>505 string x \b%-.1s
  4860 +>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
  4861 +>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
  4862 +#name extension
  4863 +>>>>>507 ubyte&0xDF >0 \b.
  4864 +>>>>>>507 string x \b%-.1s
  4865 +>>>>>>>508 ubyte&0xDF >0
  4866 +>>>>>>>>508 string x \b%-.1s
  4867 +>>>>>>>>>509 ubyte&0xDF >0
  4868 +>>>>>>>>>>509 string x \b%-.1s
  4869 +#If the boot sector fails to read any other sector,
  4870 +#it prints a very short message ("RE") to the screen and hangs the computer.
  4871 +#If the boot sector fails to find needed program in the root directory,
  4872 +#it also hangs with another message ("NF").
  4873 +>>>>>492 string RENF \b, FAT (12 bit)
  4874 +>>>>>495 string RENF \b, FAT (16 bit)
  4875 +# http://alexfru.chat.ru/epm.html#bootprog
  4876 +>494 ubyte >0x4D
  4877 +>>495 string >E
  4878 +>>>495 string <S
  4879 +#OEM-ID is not reliable
  4880 +>>>>3 string BootProg
  4881 +# It just looks for a program file name at the root directory
  4882 +# and loads corresponding file with following execution.
  4883 +# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
  4884 +>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader
  4885 +>>>>>499 string x \b %-.1s
  4886 +>>>>>>500 ubyte&0xDF >0
  4887 +>>>>>>>500 string x \b%-.1s
  4888 +>>>>>>>>501 ubyte&0xDF >0
  4889 +>>>>>>>>>501 string x \b%-.1s
  4890 +>>>>>>>>>>502 ubyte&0xDF >0
  4891 +>>>>>>>>>>>502 string x \b%-.1s
  4892 +>>>>>>>>>>>>503 ubyte&0xDF >0
  4893 +>>>>>>>>>>>>>503 string x \b%-.1s
  4894 +>>>>>>>>>>>>>>504 ubyte&0xDF >0
  4895 +>>>>>>>>>>>>>>>504 string x \b%-.1s
  4896 +>>>>>>>>>>>>>>>>505 ubyte&0xDF >0
  4897 +>>>>>>>>>>>>>>>>>505 string x \b%-.1s
  4898 +>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0
  4899 +>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s
  4900 +#name extension
  4901 +>>>>>507 ubyte&0xDF >0 \b.
  4902 +>>>>>>507 string x \b%-.1s
  4903 +>>>>>>>508 ubyte&0xDF >0
  4904 +>>>>>>>>508 string x \b%-.1s
  4905 +>>>>>>>>>509 ubyte&0xDF >0
  4906 +>>>>>>>>>>509 string x \b%-.1s
  4907 +#If the boot sector fails to read any other sector,
  4908 +#it prints a very short message ("RE") to the screen and hangs the computer.
  4909 +#If the boot sector fails to find needed program in the root directory,
  4910 +#it also hangs with another message ("NF").
  4911 +>>>>>492 string RENF \b, FAT (12 bit)
  4912 +>>>>>495 string RENF \b, FAT (16 bit)
  4913 +# loader end
  4914 +# Joerg Jenderek
  4915 +>446 ubyte 0
  4916 +>>450 ubyte >0
  4917 +>>>482 ubyte 0
  4918 +>>>>498 ubyte 0
  4919 +>>>>466 ubyte 0x05 \b, extended partition table
  4920 +>>>>466 ubyte 0x0F \b, extended partition table (LBA)
  4921 +>>>>466 ubyte 0x0 \b, extended partition table (last)
  4922 +# JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90
  4923 +# older drives may use E9 xx xx
  4924 +>0 lelong&0x009000EB 0x009000EB
  4925 +>0 lelong&0x000000E9 0x000000E9
  4926 +>>1 ubyte >37 \b, code offset 0x%x
  4927 +# mtools-3.9.8/msdos.h
  4928 +# usual values are marked with comments to get only informations of strange FAT systems
  4929 +# valid sectorsize are from 32 to 2048
  4930 +>>>11 uleshort <2049
  4931 +>>>>11 uleshort >31
  4932 +>>>>>3 string >\0 \b, OEM-ID "%8.8s"
  4933 +>>>>>11 uleshort >512 \b, Bytes/sector %u
  4934 +#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual)
  4935 +>>>>>11 uleshort <512 \b, Bytes/sector %u
  4936 +>>>>>13 ubyte >1 \b, sectors/cluster %u
  4937 +#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
  4938 +>>>>>14 uleshort >32 \b, reserved sectors %u
  4939 +#>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
  4940 +#>>>>>14 uleshort >1 \b, reserved sectors %u
  4941 +#>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
  4942 +>>>>>14 uleshort <1 \b, reserved sectors %u
  4943 +>>>>>16 ubyte >2 \b, FATs %u
  4944 +#>>>>>16 ubyte =2 \b, FATs %u (usual)
  4945 +>>>>>16 ubyte =1 \b, FAT %u
  4946 +>>>>>16 ubyte >0
  4947 +>>>>>17 uleshort >0 \b, root entries %u
  4948 +#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32)
  4949 +>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB)
  4950 +#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32)
  4951 +>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x
  4952 +#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy)
  4953 +>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x
  4954 +>>>>>22 uleshort >0 \b, sectors/FAT %u
  4955 +#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32)
  4956 +>>>>>26 ubyte >2 \b, heads %u
  4957 +#>>>>>26 ubyte =2 \b, heads %u (usual floppy)
  4958 +>>>>>26 ubyte =1 \b, heads %u
  4959 +>>>>>28 ulelong >0 \b, hidden sectors %u
  4960 +#>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
  4961 +>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
  4962 +#>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
  4963 +# FAT<32 specific
  4964 +# NOT le FAT3=NOT 3TAF=0xCCABBEB9
  4965 +>>>>>82 ulelong&0xCCABBEB9 >0
  4966 +>>>>>>36 ubyte >0x80 \b, physical drive 0x%x
  4967 +#>>>>>>36 ubyte =0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
  4968 +>>>>>>36 ubyte&0x7F >0 \b, physical drive 0x%x
  4969 +#>>>>>>36 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
  4970 +>>>>>>37 ubyte >0 \b, reserved 0x%x
  4971 +#>>>>>>37 ubyte =0 \b, reserved 0x%x
  4972 +>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
  4973 +>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
  4974 +>>>>>>38 ubyte =0x29
  4975 +>>>>>>>39 ulelong x \b, serial number 0x%x
  4976 +>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
  4977 +>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
  4978 +>>>>>>>43 string =NO\ NAME \b, unlabeled
  4979 +>>>>>>54 string FAT \b, FAT
  4980 +>>>>>>>54 string FAT12 \b (12 bit)
  4981 +>>>>>>>54 string FAT16 \b (16 bit)
  4982 +# FAT32 specific
  4983 +>>>>>82 string FAT32 \b, FAT (32 bit)
  4984 +>>>>>>36 ulelong x \b, sectors/FAT %u
  4985 +>>>>>>40 uleshort >0 \b, extension flags %u
  4986 +#>>>>>>40 uleshort =0 \b, extension flags %u
  4987 +>>>>>>42 uleshort >0 \b, fsVersion %u
  4988 +#>>>>>>42 uleshort =0 \b, fsVersion %u (usual)
  4989 +>>>>>>44 ulelong >2 \b, rootdir cluster %u
  4990 +#>>>>>>44 ulelong =2 \b, rootdir cluster %u
  4991 +#>>>>>>44 ulelong =1 \b, rootdir cluster %u
  4992 +>>>>>>48 uleshort >1 \b, infoSector %u
  4993 +#>>>>>>48 uleshort =1 \b, infoSector %u (usual)
  4994 +>>>>>>48 uleshort <1 \b, infoSector %u
  4995 +>>>>>>50 uleshort >6 \b, Backup boot sector %u
  4996 +#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
  4997 +>>>>>>50 uleshort <6 \b, Backup boot sector %u
  4998 +>>>>>>54 ulelong >0 \b, reserved1 0x%x
  4999 +>>>>>>58 ulelong >0 \b, reserved2 0x%x
  5000 +>>>>>>62 ulelong >0 \b, reserved3 0x%x
  5001 +# same structure as FAT1X
  5002 +>>>>>>64 ubyte >0x80 \b, physical drive 0x%x
  5003 +#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk)
  5004 +>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x
  5005 +#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy)
  5006 +>>>>>>65 ubyte >0 \b, reserved 0x%x
  5007 +>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x)
  5008 +>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x)
  5009 +>>>>>>66 ubyte =0x29
  5010 +>>>>>>>67 ulelong x \b, serial number 0x%x
  5011 +>>>>>>>71 string <NO\ NAME \b, label: "%11.11s"
  5012 +>>>>>>71 string >NO\ NAME \b, label: "%11.11s"
  5013 +>>>>>>71 string =NO\ NAME \b, unlabeled
  5014 +### FATs end
  5015 +>0x200 lelong 0x82564557 \b, BSD disklabel
  5016 +# FATX
  5017 +0 string FATX FATX filesystem data
  5018 +
  5019 +
  5020 +# Minix filesystems - Juan Cespedes <cespedes@debian.org>
  5021 +0x410 leshort 0x137f Minix filesystem
  5022 +0x410 beshort 0x137f Minix filesystem (big endian),
  5023 +>0x402 beshort !0 \b, %d zones
  5024 +>0x1e string minix \b, bootable
  5025 +0x410 leshort 0x138f Minix filesystem, 30 char names
  5026 +0x410 leshort 0x2468 Minix filesystem, version 2
  5027 +0x410 leshort 0x2478 Minix filesystem, version 2, 30 char names
  5028 +
  5029 +# romfs filesystems - Juan Cespedes <cespedes@debian.org>
  5030 +0 string -rom1fs-\0 romfs filesystem, version 1
  5031 +>8 belong x %d bytes,
  5032 +>16 string x named %s.
  5033 +
  5034 +# netboot image - Juan Cespedes <cespedes@debian.org>
  5035 +0 lelong 0x1b031336L Netboot image,
  5036 +>4 lelong&0xFFFFFF00 0
  5037 +>>4 lelong&0x100 0x000 mode 2
  5038 +>>4 lelong&0x100 0x100 mode 3
  5039 +>4 lelong&0xFFFFFF00 !0 unknown mode
  5040 +
  5041 +0x18b string OS/2 OS/2 Boot Manager
  5042 +
  5043 +# added by Joerg Jenderek
  5044 +# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
  5045 +# grub-1.94/kern/i386/pc/startup.S
  5046 +# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
  5047 +# usual values are marked with comments to get only informations of strange GRUB loaders
  5048 +0x200 uleshort 0x70EA
  5049 +# found only version 3.{1,2}
  5050 +>0x206 ubeshort >0x0300
  5051 +# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00"
  5052 +>>0x212 ubyte >0x29
  5053 +>>>0x213 ubyte >0x29
  5054 +# not iso9660_stage1_5
  5055 +#>>>0 ulelong&0x00BE5652 0x00BE5652
  5056 +>>>>0x213 ubyte >0x29 GRand Unified Bootloader
  5057 +# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2"
  5058 +>>>>0x217 ubyte 0xFF stage1_5
  5059 +>>>>0x217 ubyte <0xFF stage2
  5060 +>>>>0x206 ubyte x \b version %u
  5061 +>>>>0x207 ubyte x \b.%u
  5062 +# module_size for 1.94
  5063 +>>>>0x208 ulelong <0xffffff \b, installed partition %u
  5064 +#>>>>0x208 ulelong =0xffffff \b, %u (default)
  5065 +>>>>0x208 ulelong >0xffffff \b, installed partition %u
  5066 +# GRUB 0.5.95 unofficial
  5067 +>>>>0x20C ulelong&0x2E300000 0x2E300000
  5068 +# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs
  5069 +>>>>>0x20C ubyte x \b, identifier 0x%x
  5070 +#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default)
  5071 +>>>>>0x20D ubyte >0 \b, LBA flag 0x%x
  5072 +# GRUB version as string
  5073 +>>>>>0x20E string >\0 \b, GRUB version %-s
  5074 +# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  5075 +>>>>>>0x215 ulong 0xffffffff
  5076 +>>>>>>>0x219 string >\0 \b, configuration file %-s
  5077 +>>>>>>0x215 ulong !0xffffffff
  5078 +>>>>>>>0x215 string >\0 \b, configuration file %-s
  5079 +# newer GRUB versions
  5080 +>>>>0x20C ulelong&0x2E300000 !0x2E300000
  5081 +##>>>>>0x20C ulelong =0 \b, saved entry %d (usual)
  5082 +>>>>>0x20C ulelong >0 \b, saved entry %d
  5083 +# for 1.94 contains kernel image size
  5084 +# for 0.93,0.94,0.96,0.97
  5085 +# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2
  5086 +>>>>>0x210 ubyte x \b, identifier 0x%x
  5087 +# The flag for LBA forcing is in most cases 0
  5088 +#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default)
  5089 +>>>>>0x211 ubyte >0 \b, LBA flag 0x%x
  5090 +# GRUB version as string
  5091 +>>>>>0x212 string >\0 \b, GRUB version %-s
  5092 +# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default
  5093 +>>>>>0x217 ulong 0xffffffff
  5094 +>>>>>>0x21b string >\0 \b, configuration file %-s
  5095 +>>>>>0x217 ulong !0xffffffff
  5096 +>>>>>>0x217 string >\0 \b, configuration file %-s
  5097 +
  5098 +9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
  5099 +>8404 string x last mounted on %s,
  5100 +#>9504 ledate x last checked at %s,
  5101 +>8224 ledate x last written at %s,
  5102 +>8401 byte x clean flag %d,
  5103 +>8228 lelong x number of blocks %d,
  5104 +>8232 lelong x number of data blocks %d,
  5105 +>8236 lelong x number of cylinder groups %d,
  5106 +>8240 lelong x block size %d,
  5107 +>8244 lelong x fragment size %d,
  5108 +>8252 lelong x minimum percentage of free blocks %d,
  5109 +>8256 lelong x rotational delay %dms,
  5110 +>8260 lelong x disk rotational speed %drps,
  5111 +>8320 lelong 0 TIME optimization
  5112 +>8320 lelong 1 SPACE optimization
  5113 +
  5114 +42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  5115 +>&-1164 string x last mounted on %s,
  5116 +>&-696 string >\0 volume name %s,
  5117 +>&-304 leqldate x last written at %s,
  5118 +>&-1167 byte x clean flag %d,
  5119 +>&-1168 byte x readonly flag %d,
  5120 +>&-296 lequad x number of blocks %lld,
  5121 +>&-288 lequad x number of data blocks %lld,
  5122 +>&-1332 lelong x number of cylinder groups %d,
  5123 +>&-1328 lelong x block size %d,
  5124 +>&-1324 lelong x fragment size %d,
  5125 +>&-180 lelong x average file size %d,
  5126 +>&-176 lelong x average number of files in dir %d,
  5127 +>&-272 lequad x pending blocks to free %lld,
  5128 +>&-264 lelong x pending inodes to free %ld,
  5129 +>&-664 lequad x system-wide uuid %0llx,
  5130 +>&-1316 lelong x minimum percentage of free blocks %d,
  5131 +>&-1248 lelong 0 TIME optimization
  5132 +>&-1248 lelong 1 SPACE optimization
  5133 +
  5134 +66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  5135 +>&-1164 string x last mounted on %s,
  5136 +>&-696 string >\0 volume name %s,
  5137 +>&-304 leqldate x last written at %s,
  5138 +>&-1167 byte x clean flag %d,
  5139 +>&-1168 byte x readonly flag %d,
  5140 +>&-296 lequad x number of blocks %lld,
  5141 +>&-288 lequad x number of data blocks %lld,
  5142 +>&-1332 lelong x number of cylinder groups %d,
  5143 +>&-1328 lelong x block size %d,
  5144 +>&-1324 lelong x fragment size %d,
  5145 +>&-180 lelong x average file size %d,
  5146 +>&-176 lelong x average number of files in dir %d,
  5147 +>&-272 lequad x pending blocks to free %lld,
  5148 +>&-264 lelong x pending inodes to free %ld,
  5149 +>&-664 lequad x system-wide uuid %0llx,
  5150 +>&-1316 lelong x minimum percentage of free blocks %d,
  5151 +>&-1248 lelong 0 TIME optimization
  5152 +>&-1248 lelong 1 SPACE optimization
  5153 +
  5154 +9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
  5155 +>7168 belong 0x4c41424c Apple UFS Volume
  5156 +>>7186 string x named %s,
  5157 +>>7176 belong x volume label version %d,
  5158 +>>7180 bedate x created on %s,
  5159 +>8404 string x last mounted on %s,
  5160 +#>9504 bedate x last checked at %s,
  5161 +>8224 bedate x last written at %s,
  5162 +>8401 byte x clean flag %d,
  5163 +>8228 belong x number of blocks %d,
  5164 +>8232 belong x number of data blocks %d,
  5165 +>8236 belong x number of cylinder groups %d,
  5166 +>8240 belong x block size %d,
  5167 +>8244 belong x fragment size %d,
  5168 +>8252 belong x minimum percentage of free blocks %d,
  5169 +>8256 belong x rotational delay %dms,
  5170 +>8260 belong x disk rotational speed %drps,
  5171 +>8320 belong 0 TIME optimization
  5172 +>8320 belong 1 SPACE optimization
  5173 +
  5174 +42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  5175 +>&-1164 string x last mounted on %s,
  5176 +>&-696 string >\0 volume name %s,
  5177 +>&-304 beqldate x last written at %s,
  5178 +>&-1167 byte x clean flag %d,
  5179 +>&-1168 byte x readonly flag %d,
  5180 +>&-296 bequad x number of blocks %lld,
  5181 +>&-288 bequad x number of data blocks %lld,
  5182 +>&-1332 belong x number of cylinder groups %d,
  5183 +>&-1328 belong x block size %d,
  5184 +>&-1324 belong x fragment size %d,
  5185 +>&-180 belong x average file size %d,
  5186 +>&-176 belong x average number of files in dir %d,
  5187 +>&-272 bequad x pending blocks to free %lld,
  5188 +>&-264 belong x pending inodes to free %ld,
  5189 +>&-664 bequad x system-wide uuid %0llx,
  5190 +>&-1316 belong x minimum percentage of free blocks %d,
  5191 +>&-1248 belong 0 TIME optimization
  5192 +>&-1248 belong 1 SPACE optimization
  5193 +
  5194 +66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  5195 +>&-1164 string x last mounted on %s,
  5196 +>&-696 string >\0 volume name %s,
  5197 +>&-304 beqldate x last written at %s,
  5198 +>&-1167 byte x clean flag %d,
  5199 +>&-1168 byte x readonly flag %d,
  5200 +>&-296 bequad x number of blocks %lld,
  5201 +>&-288 bequad x number of data blocks %lld,
  5202 +>&-1332 belong x number of cylinder groups %d,
  5203 +>&-1328 belong x block size %d,
  5204 +>&-1324 belong x fragment size %d,
  5205 +>&-180 belong x average file size %d,
  5206 +>&-176 belong x average number of files in dir %d,
  5207 +>&-272 bequad x pending blocks to free %lld,
  5208 +>&-264 belong x pending inodes to free %ld,
  5209 +>&-664 bequad x system-wide uuid %0llx,
  5210 +>&-1316 belong x minimum percentage of free blocks %d,
  5211 +>&-1248 belong 0 TIME optimization
  5212 +>&-1248 belong 1 SPACE optimization
  5213 +
  5214 +# ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com>
  5215 +0x438 leshort 0xEF53 Linux
  5216 +>0x44c lelong x rev %d
  5217 +>0x43e leshort x \b.%d
  5218 +>0x45c lelong ^0x0000004 ext2 filesystem data
  5219 +>>0x43a leshort ^0x0000001 (mounted or unclean)
  5220 +>0x45c lelong &0x0000004 ext3 filesystem data
  5221 +>>0x460 lelong &0x0000004 (needs journal recovery)
  5222 +>0x43a leshort &0x0000002 (errors)
  5223 +>0x460 lelong &0x0000001 (compressed)
  5224 +#>0x460 lelong &0x0000002 (filetype)
  5225 +#>0x464 lelong &0x0000001 (sparse_super)
  5226 +>0x464 lelong &0x0000002 (large files)
  5227 +
  5228 +# SGI disk labels - Nathan Scott <nathans@debian.org>
  5229 +0 belong 0x0BE5A941 SGI disk label (volume header)
  5230 +
  5231 +# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
  5232 +0 belong 0x58465342 SGI XFS filesystem data
  5233 +>0x4 belong x (blksz %d,
  5234 +>0x68 beshort x inosz %d,
  5235 +>0x64 beshort ^0x2004 v1 dirs)
  5236 +>0x64 beshort &0x2004 v2 dirs)
  5237 +
  5238 +############################################################################
  5239 +# Minix-ST kernel floppy
  5240 +0x800 belong 0x46fc2700 Atari-ST Minix kernel image
  5241 +>19 string \240\5\371\5\0\011\0\2\0 \b, 720k floppy
  5242 +>19 string \320\2\370\5\0\011\0\1\0 \b, 360k floppy
  5243 +
  5244 +############################################################################
  5245 +# Hmmm, is this a better way of detecting _standard_ floppy images ?
  5246 +19 string \320\2\360\3\0\011\0\1\0 DOS floppy 360k
  5247 +>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  5248 +19 string \240\5\371\3\0\011\0\2\0 DOS floppy 720k
  5249 +>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  5250 +19 string \100\013\360\011\0\022\0\2\0 DOS floppy 1440k
  5251 +>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  5252 +
  5253 +19 string \240\5\371\5\0\011\0\2\0 DOS floppy 720k, IBM
  5254 +>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  5255 +19 string \100\013\371\5\0\011\0\2\0 DOS floppy 1440k, mkdosfs
  5256 +>0x1FE leshort 0xAA55 \b, x86 hard disk boot sector
  5257 +
  5258 +19 string \320\2\370\5\0\011\0\1\0 Atari-ST floppy 360k
  5259 +19 string \240\5\371\5\0\011\0\2\0 Atari-ST floppy 720k
  5260 +
  5261 +# Valid media descriptor bytes for MS-DOS:
  5262 +#
  5263 +# Byte Capacity Media Size and Type
  5264 +# -------------------------------------------------
  5265 +#
  5266 +# F0 2.88 MB 3.5-inch, 2-sided, 36-sector
  5267 +# F0 1.44 MB 3.5-inch, 2-sided, 18-sector
  5268 +# F9 720K 3.5-inch, 2-sided, 9-sector
  5269 +# F9 1.2 MB 5.25-inch, 2-sided, 15-sector
  5270 +# FD 360K 5.25-inch, 2-sided, 9-sector
  5271 +# FF 320K 5.25-inch, 2-sided, 8-sector
  5272 +# FC 180K 5.25-inch, 1-sided, 9-sector
  5273 +# FE 160K 5.25-inch, 1-sided, 8-sector
  5274 +# FE 250K 8-inch, 1-sided, single-density
  5275 +# FD 500K 8-inch, 2-sided, single-density
  5276 +# FE 1.2 MB 8-inch, 2-sided, double-density
  5277 +# F8 ----- Fixed disk
  5278 +#
  5279 +# FC xxxK Apricot 70x1x9 boot disk.
  5280 +#
  5281 +# Originally a bitmap:
  5282 +# xxxxxxx0 Not two sided
  5283 +# xxxxxxx1 Double sided
  5284 +# xxxxxx0x Not 8 SPT
  5285 +# xxxxxx1x 8 SPT
  5286 +# xxxxx0xx Not Removable drive
  5287 +# xxxxx1xx Removable drive
  5288 +# 11111xxx Must be one.
  5289 +#
  5290 +# But now it's rather random:
  5291 +# 111111xx Low density disk
  5292 +# 00 SS, Not 8 SPT
  5293 +# 01 DS, Not 8 SPT
  5294 +# 10 SS, 8 SPT
  5295 +# 11 DS, 8 SPT
  5296 +#
  5297 +# 11111001 Double density 3½ floppy disk, high density 5¼
  5298 +# 11110000 High density 3½ floppy disk
  5299 +# 11111000 Hard disk any format
  5300 +#
  5301 +
  5302 +# CDROM Filesystems
  5303 +# Modified for UDF by gerardo.cacciari@gmail.com
  5304 +32769 string CD001
  5305 +>38913 string !NSR0 ISO 9660 CD-ROM filesystem data
  5306 +>38913 string NSR01 UDF filesystem data (version 1.0)
  5307 +>38913 string NSR02 UDF filesystem data (version 1.5)
  5308 +>38913 string NSR03 UDF filesystem data (version 2.0)
  5309 +>38913 string >NSR03 UDF filesystem data (unknown version,
  5310 +>>38917 byte x id 'NSR0%c')
  5311 +>38913 string <NSR01 UDF filesystem data (unknown version,
  5312 +>>38917 byte x id 'NSR0%c')
  5313 +# "application id" which appears to be used as a volume label
  5314 +>32808 string >\0 '%s'
  5315 +>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable)
  5316 +37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
  5317 +32776 string CDROM High Sierra CD-ROM filesystem data
  5318 +
  5319 +# cramfs filesystem - russell@coker.com.au
  5320 +0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian
  5321 +>4 lelong x size %d
  5322 +>8 lelong &1 version #2
  5323 +>8 lelong &2 sorted_dirs
  5324 +>8 lelong &4 hole_support
  5325 +>32 lelong x CRC 0x%x,
  5326 +>36 lelong x edition %d,
  5327 +>40 lelong x %d blocks,
  5328 +>44 lelong x %d files
  5329 +
  5330 +0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian
  5331 +>4 belong x size %d
  5332 +>8 belong &1 version #2
  5333 +>8 belong &2 sorted_dirs
  5334 +>8 belong &4 hole_support
  5335 +>32 belong x CRC 0x%x,
  5336 +>36 belong x edition %d,
  5337 +>40 belong x %d blocks,
  5338 +>44 belong x %d files
  5339 +
  5340 +# reiserfs - russell@coker.com.au
  5341 +0x10034 string ReIsErFs ReiserFS V3.5
  5342 +0x10034 string ReIsEr2Fs ReiserFS V3.6
  5343 +>0x1002c leshort x block size %d
  5344 +>0x10032 leshort &2 (mounted or unclean)
  5345 +>0x10000 lelong x num blocks %d
  5346 +>0x10040 lelong 1 tea hash
  5347 +>0x10040 lelong 2 yura hash
  5348 +>0x10040 lelong 3 r5 hash
  5349 +
  5350 +# JFFS - russell@coker.com.au
  5351 +0 lelong 0x34383931 Linux Journalled Flash File system, little endian
  5352 +0 belong 0x34383931 Linux Journalled Flash File system, big endian
  5353 +
  5354 +# EST flat binary format (which isn't, but anyway)
  5355 +# From: Mark Brown <broonie@sirena.org.uk>
  5356 +0 string ESTFBINR EST flat binary
  5357 +
  5358 +# Aculab VoIP firmware
  5359 +# From: Mark Brown <broonie@sirena.org.uk>
  5360 +0 string VoIP\ Startup\ and Aculab VoIP firmware
  5361 +>35 string x format %s
  5362 +
  5363 +# u-boot/PPCBoot image file
  5364 +# From: Mark Brown <broonie@sirena.org.uk>
  5365 +0 belong 0x27051956 u-boot/PPCBoot image
  5366 +>4 string PPCBoot
  5367 +>>12 string x version %s
  5368 +
  5369 +# JFFS2 file system
  5370 +0 leshort 0x1984 Linux old jffs2 filesystem data little endian
  5371 +0 leshort 0x1985 Linux jffs2 filesystem data little endian
  5372 +
  5373 +# Squashfs
  5374 +0 string sqsh Squashfs filesystem, big endian,
  5375 +>28 beshort x version %d.
  5376 +>30 beshort x \b%d,
  5377 +>28 beshort <3
  5378 +>>8 belong x %d bytes,
  5379 +>28 beshort >2
  5380 +>>63 bequad x %lld bytes,
  5381 +#>>67 belong x %d bytes,
  5382 +>4 belong x %d inodes,
  5383 +>28 beshort <2
  5384 +>>32 beshort x blocksize: %d bytes,
  5385 +>28 beshort >1
  5386 +>>51 belong x blocksize: %d bytes,
  5387 +>39 bedate x created: %s
  5388 +0 string hsqs Squashfs filesystem, little endian,
  5389 +>28 leshort x version %d.
  5390 +>30 leshort x \b%d,
  5391 +>28 leshort <3
  5392 +>>8 lelong x %d bytes,
  5393 +>28 leshort >2
  5394 +>>63 lequad x %lld bytes,
  5395 +#>>63 lelong x %d bytes,
  5396 +>4 lelong x %d inodes,
  5397 +>28 leshort <2
  5398 +>>32 leshort x blocksize: %d bytes,
  5399 +>28 leshort >1
  5400 +>>51 lelong x blocksize: %d bytes,
  5401 +>39 ledate x created: %s
  5402 +
  5403 +0 string td\000 floppy image data (TeleDisk)
  5404 +
  5405 +# AFS Dump Magic
  5406 +# From: Ty Sarna <tsarna@sarna.org>
  5407 +0 string \x01\xb3\xa1\x13\x22 AFS Dump
  5408 +>&0 belong x (v%d)
  5409 +>>&0 byte 0x76
  5410 +>>>&0 belong x Vol %d,
  5411 +>>>>&0 byte 0x6e
  5412 +>>>>>&0 string x %s
  5413 +>>>>>>&1 byte 0x74
  5414 +>>>>>>>&0 beshort 2
  5415 +>>>>>>>>&4 bedate x on: %s
  5416 +>>>>>>>>&0 bedate =0 full dump
  5417 +>>>>>>>>&0 bedate !0 incremental since: %s
  5418 +
  5419 +#----------------------------------------------------------
  5420 +# VMS backup savesets - gerardo.cacciari@gmail.com
  5421 +#
  5422 +4 string \x01\x00\x01\x00\x01\x00
  5423 +>(0.s+16) string \x01\x01
  5424 +>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data
  5425 +>>>40 lelong x (block size %d,
  5426 +>>>49 string >\0 original name '%s',
  5427 +>>>2 short 1024 VAX generated)
  5428 +>>>2 short 2048 AXP generated)
  5429 +>>>2 short 4096 I64 generated)
  5430 +
  5431 +# Compaq/HP RILOE floppy image
  5432 +# From: Dirk Jagdmann <doj@cubic.org>
  5433 +0 string CPQRFBLO Compaq/HP RILOE floppy image
  5434 +
  5435 +#------------------------------------------------------------------------------
  5436 +# Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@gmail.com
  5437 +# These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is
  5438 +# mapped to VBN 2 of [000000]INDEXF.SYS;1
  5439 +#
  5440 +1008 string DECFILE11B Files-11 On-Disk Structure
  5441 +>525 byte x Level %d
  5442 +>525 byte x (ODS-%d OpenVMS file system),
  5443 +>984 string x volume label is '%-12.12s'
  5444 +
  5445 +#------------------------------------------------------------------------------
  5446 +# flash: file(1) magic for Macromedia Flash file format
  5447 +#
  5448 +# See
  5449 +#
  5450 +# http://www.macromedia.com/software/flash/open/
  5451 +#
  5452 +0 string FWS Macromedia Flash data,
  5453 +>3 byte x version %d
  5454 +0 string CWS Macromedia Flash data (compressed),
  5455 +>3 byte x version %d
  5456 +# From: Cal Peake <cp@absolutedigital.net>
  5457 +0 string FLV Macromedia Flash Video
  5458 +
  5459 +#
  5460 +# From Dave Wilson
  5461 +0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document
  5462 +
  5463 +#------------------------------------------------------------------------------
  5464 +# fonts: file(1) magic for font data
  5465 +#
  5466 +0 string FONT ASCII vfont text
  5467 +0 short 0436 Berkeley vfont data
  5468 +0 short 017001 byte-swapped Berkeley vfont data
  5469 +
  5470 +# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
  5471 +0 string %!PS-AdobeFont-1. PostScript Type 1 font text
  5472 +>20 string >\0 (%s)
  5473 +6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
  5474 +
  5475 +# X11 font files in SNF (Server Natural Format) format
  5476 +0 belong 00000004 X11 SNF font data, MSB first
  5477 +0 lelong 00000004 X11 SNF font data, LSB first
  5478 +
  5479 +# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
  5480 +0 string STARTFONT\040 X11 BDF font text
  5481 +
  5482 +# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
  5483 +# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
  5484 +0 string \001fcp X11 Portable Compiled Font data
  5485 +>12 byte 0x02 \b, LSB first
  5486 +>12 byte 0x0a \b, MSB first
  5487 +0 string D1.0\015 X11 Speedo font data
  5488 +
  5489 +#------------------------------------------------------------------------------
  5490 +# FIGlet fonts and controlfiles
  5491 +# From figmagic supplied with Figlet version 2.2
  5492 +# "David E. O'Brien" <obrien@FreeBSD.ORG>
  5493 +0 string flf FIGlet font
  5494 +>3 string >2a version %-2.2s
  5495 +0 string flc FIGlet controlfile
  5496 +>3 string >2a version %-2.2s
  5497 +
  5498 +# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
  5499 +# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
  5500 +0 belong 0x14025919 libGrx font data,
  5501 +>8 leshort x %dx
  5502 +>10 leshort x \b%d
  5503 +>40 string x %s
  5504 +# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
  5505 +0 belong 0xff464f4e DOS code page font data collection
  5506 +7 belong 0x00454741 DOS code page font data
  5507 +7 belong 0x00564944 DOS code page font data (from Linux?)
  5508 +4098 string DOSFONT DOSFONT2 encrypted font data
  5509 +
  5510 +# downloadable fonts for browser (prints type) anthon@mnt.org
  5511 +0 string PFR1 PFR1 font
  5512 +>102 string >0 \b: %s
  5513 +
  5514 +# True Type fonts
  5515 +0 string \000\001\000\000\000 TrueType font data
  5516 +
  5517 +0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
  5518 +0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
  5519 +
  5520 +# Opentype font data from Avi Bercovich
  5521 +0 string OTTO OpenType font data
  5522 +
  5523 +# Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
  5524 +0 string SplineFontDB: Spline Font Database
  5525 +>14 string x version %s
  5526 +
  5527 +#------------------------------------------------------------------------------
  5528 +# frame: file(1) magic for FrameMaker files
  5529 +#
  5530 +# This stuff came on a FrameMaker demo tape, most of which is
  5531 +# copyright, but this file is "published" as witness the following:
  5532 +#
  5533 +0 string \<MakerFile FrameMaker document
  5534 +>11 string 5.5 (5.5
  5535 +>11 string 5.0 (5.0
  5536 +>11 string 4.0 (4.0
  5537 +>11 string 3.0 (3.0
  5538 +>11 string 2.0 (2.0
  5539 +>11 string 1.0 (1.0
  5540 +>14 byte x %c)
  5541 +0 string \<MIFFile FrameMaker MIF (ASCII) file
  5542 +>9 string 4.0 (4.0)
  5543 +>9 string 3.0 (3.0)
  5544 +>9 string 2.0 (2.0)
  5545 +>9 string 1.0 (1.x)
  5546 +0 string \<MakerDictionary FrameMaker Dictionary text
  5547 +>17 string 3.0 (3.0)
  5548 +>17 string 2.0 (2.0)
  5549 +>17 string 1.0 (1.x)
  5550 +0 string \<MakerScreenFont FrameMaker Font file
  5551 +>17 string 1.01 (%s)
  5552 +0 string \<MML FrameMaker MML file
  5553 +0 string \<BookFile FrameMaker Book file
  5554 +>10 string 3.0 (3.0
  5555 +>10 string 2.0 (2.0
  5556 +>10 string 1.0 (1.0
  5557 +>13 byte x %c)
  5558 +# XXX - this book entry should be verified, if you find one, uncomment this
  5559 +#0 string \<Book\ FrameMaker Book (ASCII) file
  5560 +#>6 string 3.0 (3.0)
  5561 +#>6 string 2.0 (2.0)
  5562 +#>6 string 1.0 (1.0)
  5563 +0 string \<Maker Intermediate Print File FrameMaker IPL file
  5564 +
  5565 +#------------------------------------------------------------------------------
  5566 +# freebsd: file(1) magic for FreeBSD objects
  5567 +#
  5568 +# All new-style FreeBSD magic numbers are in host byte order (i.e.,
  5569 +# little-endian on x86).
  5570 +#
  5571 +# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
  5572 +# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
  5573 +# schemes for distinguishing between executable images, shared libraries,
  5574 +# and object files.
  5575 +#
  5576 +# FreeBSD says:
  5577 +#
  5578 +# Regardless of whether it's pure, demand-paged, or none of the
  5579 +# above:
  5580 +#
  5581 +# if the entry point is < 4096, then it's a shared library if
  5582 +# the "has run-time loader information" bit is set, and is
  5583 +# position-independent if the "is position-independent" bit
  5584 +# is set;
  5585 +#
  5586 +# if the entry point is >= 4096 (or >4095, same thing), then it's
  5587 +# an executable, and is dynamically-linked if the "has run-time
  5588 +# loader information" bit is set.
  5589 +#
  5590 +# On x86, NetBSD says:
  5591 +#
  5592 +# If it's neither pure nor demand-paged:
  5593 +#
  5594 +# if it has the "has run-time loader information" bit set, it's
  5595 +# a dynamically-linked executable;
  5596 +#
  5597 +# if it doesn't have that bit set, then:
  5598 +#
  5599 +# if it has the "is position-independent" bit set, it's
  5600 +# position-independent;
  5601 +#
  5602 +# if the entry point is non-zero, it's an executable, otherwise
  5603 +# it's an object file.
  5604 +#
  5605 +# If it's pure:
  5606 +#
  5607 +# if it has the "has run-time loader information" bit set, it's
  5608 +# a dynamically-linked executable, otherwise it's just an
  5609 +# executable.
  5610 +#
  5611 +# If it's demand-paged:
  5612 +#
  5613 +# if it has the "has run-time loader information" bit set,
  5614 +# then:
  5615 +#
  5616 +# if the entry point is < 4096, it's a shared library;
  5617 +#
  5618 +# if the entry point is = 4096 or > 4096 (i.e., >= 4096),
  5619 +# it's a dynamically-linked executable);
  5620 +#
  5621 +# if it doesn't have the "has run-time loader information" bit
  5622 +# set, then it's just an executable.
  5623 +#
  5624 +# (On non-x86, NetBSD does much the same thing, except that it uses
  5625 +# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
  5626 +# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
  5627 +# had 8K pages; dunno about MIPS.)
  5628 +#
  5629 +# I suspect the two will differ only in perverse and uninteresting cases
  5630 +# ("shared" libraries that aren't demand-paged and whose pages probably
  5631 +# won't actually be shared, executables with entry points <4096).
  5632 +#
  5633 +# I leave it to those more familiar with FreeBSD and NetBSD to figure out
  5634 +# what the right answer is (although using ">4095", FreeBSD-style, is
  5635 +# probably better than separately checking for "=4096" and ">4096",
  5636 +# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
  5637 +# executables using the NetBSD technique.)
  5638 +#
  5639 +0 lelong&0377777777 041400407 FreeBSD/i386
  5640 +>20 lelong <4096
  5641 +>>3 byte&0xC0 &0x80 shared library
  5642 +>>3 byte&0xC0 0x40 PIC object
  5643 +>>3 byte&0xC0 0x00 object
  5644 +>20 lelong >4095
  5645 +>>3 byte&0x80 0x80 dynamically linked executable
  5646 +>>3 byte&0x80 0x00 executable
  5647 +>16 lelong >0 not stripped
  5648 +
  5649 +0 lelong&0377777777 041400410 FreeBSD/i386 pure
  5650 +>20 lelong <4096
  5651 +>>3 byte&0xC0 &0x80 shared library
  5652 +>>3 byte&0xC0 0x40 PIC object
  5653 +>>3 byte&0xC0 0x00 object
  5654 +>20 lelong >4095
  5655 +>>3 byte&0x80 0x80 dynamically linked executable
  5656 +>>3 byte&0x80 0x00 executable
  5657 +>16 lelong >0 not stripped
  5658 +
  5659 +0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
  5660 +>20 lelong <4096
  5661 +>>3 byte&0xC0 &0x80 shared library
  5662 +>>3 byte&0xC0 0x40 PIC object
  5663 +>>3 byte&0xC0 0x00 object
  5664 +>20 lelong >4095
  5665 +>>3 byte&0x80 0x80 dynamically linked executable
  5666 +>>3 byte&0x80 0x00 executable
  5667 +>16 lelong >0 not stripped
  5668 +
  5669 +0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
  5670 +>20 lelong <4096
  5671 +>>3 byte&0xC0 &0x80 shared library
  5672 +>>3 byte&0xC0 0x40 PIC object
  5673 +>>3 byte&0xC0 0x00 object
  5674 +>20 lelong >4095
  5675 +>>3 byte&0x80 0x80 dynamically linked executable
  5676 +>>3 byte&0x80 0x00 executable
  5677 +>16 lelong >0 not stripped
  5678 +
  5679 +# XXX gross hack to identify core files
  5680 +# cores start with a struct tss; we take advantage of the following:
  5681 +# byte 7: highest byte of the kernel stack pointer, always 0xfe
  5682 +# 8/9: kernel (ring 0) ss value, always 0x0010
  5683 +# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
  5684 +# 28: low order byte of the current PTD entry, always 0 since the
  5685 +# PTD is page-aligned
  5686 +#
  5687 +7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
  5688 +>1039 string >\0 from '%s'
  5689 +
  5690 +# /var/run/ld.so.hints
  5691 +# What are you laughing about?
  5692 +0 lelong 011421044151 ld.so hints file (Little Endian
  5693 +>4 lelong >0 \b, version %d)
  5694 +>4 belong <=0 \b)
  5695 +0 belong 011421044151 ld.so hints file (Big Endian
  5696 +>4 belong >0 \b, version %d)
  5697 +>4 belong <=0 \b)
  5698 +
  5699 +#
  5700 +# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
  5701 +#
  5702 +0 string SCRSHOT_ scrshot(1) screenshot,
  5703 +>8 byte x version %d,
  5704 +>9 byte 2 %d bytes in header,
  5705 +>>10 byte x %d chars wide by
  5706 +>>11 byte x %d chars high
  5707 +
  5708 +#------------------------------------------------------------------------------
  5709 +# fsav: file(1) magic for datafellows fsav virus definition files
  5710 +# Anthon van der Neut (anthon@mnt.org)
  5711 +
  5712 +# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
  5713 +0 beshort 0x1575 fsav macro virus signatures
  5714 +>8 leshort >0 (%d-
  5715 +>11 byte >0 \b%02d-
  5716 +>10 byte >0 \b%02d)
  5717 +# ftp://ftp.f-prot.com/pub/sign.zip
  5718 +#10 ubyte <12
  5719 +#>9 ubyte <32
  5720 +#>>8 ubyte 0x0a
  5721 +#>>>12 ubyte 0x07
  5722 +#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d-
  5723 +#>>>>10 byte 0 \b01-
  5724 +#>>>>10 byte 1 \b02-
  5725 +#>>>>10 byte 2 \b03-
  5726 +#>>>>10 byte 3 \b04-
  5727 +#>>>>10 byte 4 \b05-
  5728 +#>>>>10 byte 5 \b06-
  5729 +#>>>>10 byte 6 \b07-
  5730 +#>>>>10 byte 7 \b08-
  5731 +#>>>>10 byte 8 \b09-
  5732 +#>>>>10 byte 9 \b10-
  5733 +#>>>>10 byte 10 \b11-
  5734 +#>>>>10 byte 11 \b12-
  5735 +#>>>>9 ubyte >0 \b%02d)
  5736 +# ftp://ftp.f-prot.com/pub/sign2.zip
  5737 +#0 ubyte 0x62
  5738 +#>1 ubyte 0xF5
  5739 +#>>2 ubyte 0x1
  5740 +#>>>3 ubyte 0x1
  5741 +#>>>>4 ubyte 0x0e
  5742 +#>>>>>13 ubyte >0 fsav virus signatures
  5743 +#>>>>>>11 ubyte x size 0x%02x
  5744 +#>>>>>>12 ubyte x \b%02x
  5745 +#>>>>>>13 ubyte x \b%02x bytes
  5746 +
  5747 +# Joerg Jenderek: joerg dot jenderek at web dot de
  5748 +# http://www.clamav.net/doc/latest/html/node45.html
  5749 +# .cvd files start with a 512 bytes colon separated header
  5750 +# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
  5751 +# + gzipped tarball files
  5752 +0 string ClamAV-VDB:
  5753 +>11 string >\0 Clam AntiVirus database %-.23s
  5754 +>>34 string :
  5755 +>>>35 regex [^:]+ \b, version
  5756 +>>>>35 string x \b%-.1s
  5757 +>>>>>36 string !:
  5758 +>>>>>>36 string x \b%-.1s
  5759 +>>>>>>>37 string !:
  5760 +>>>>>>>>37 string x \b%-.1s
  5761 +>>>>>>>>>38 string !:
  5762 +>>>>>>>>>>38 string x \b%-.1s
  5763 +>>>>512 string \037\213 \b, gzipped
  5764 +>>>>769 string ustar\0 \b, tared
  5765 +>512 string \037\213 \b, gzipped
  5766 +>769 string ustar\0 \b, tared
  5767 +#------------------------------------------------------------------------------
  5768 +# games: file(1) for games
  5769 +
  5770 +# Thomas M. Ott (ThMO)
  5771 +1 string =WAD DOOM data,
  5772 +>0 string =I main wad
  5773 +>0 string =P patch wad
  5774 +>0 byte x unknown junk
  5775 +
  5776 +# Fabio Bonelli <fabiobonelli@libero.it>
  5777 +# Quake II - III data files
  5778 +0 string IDP2 Quake II 3D Model file,
  5779 +>20 long x %lu skin(s),
  5780 +>8 long x (%lu x
  5781 +>12 long x %lu),
  5782 +>40 long x %lu frame(s),
  5783 +>16 long x Frame size %lu bytes,
  5784 +>24 long x %lu vertices/frame,
  5785 +>28 long x %lu texture coordinates,
  5786 +>32 long x %lu triangles/frame
  5787 +
  5788 +0 string IBSP Quake
  5789 +>4 long 0x26 II Map file (BSP)
  5790 +>4 long 0x2E III Map file (BSP)
  5791 +
  5792 +0 string IDS2 Quake II SP2 sprite file
  5793 +
  5794 +#---------------------------------------------------------------------------
  5795 +# Doom and Quake
  5796 +# submitted by Nicolas Patrois
  5797 +
  5798 +# DOOM
  5799 +
  5800 +0 string IWAD DOOM or DOOM ][ world
  5801 +0 string PWAD DOOM or DOOM ][ extension world
  5802 +
  5803 +0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo
  5804 +# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
  5805 +
  5806 +24 string LxD\ 203 Linuxdoom save
  5807 +>0 string x , name=%s
  5808 +>44 string x , world=%s
  5809 +
  5810 +# Quake
  5811 +
  5812 +0 string PACK Quake I or II world or extension
  5813 +
  5814 +#0 string -1\x0a Quake I demo
  5815 +#>30 string x version %.4s
  5816 +#>61 string x level %s
  5817 +
  5818 +#0 string 5\x0a Quake I save
  5819 +
  5820 +# The levels
  5821 +
  5822 +# Quake 1
  5823 +
  5824 +0 string 5\x0aIntroduction Quake I save: start Introduction
  5825 +0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex
  5826 +0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned
  5827 +0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis
  5828 +0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto
  5829 +0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret)
  5830 +0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep
  5831 +0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon
  5832 +0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon
  5833 +0 string 5\x0athe_Installation Quake I save: e2m1 The installation
  5834 +0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel
  5835 +0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!)
  5836 +0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret)
  5837 +0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress
  5838 +0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse
  5839 +0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette
  5840 +0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central
  5841 +0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin
  5842 +0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror
  5843 +0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight
  5844 +0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret)
  5845 +0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels
  5846 +0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment
  5847 +0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system
  5848 +0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair
  5849 +0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine
  5850 +0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate
  5851 +0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium
  5852 +0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret)
  5853 +0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze
  5854 +0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony
  5855 +0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit
  5856 +
  5857 +# Quake DeathMatch levels
  5858 +
  5859 +0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths
  5860 +0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis
  5861 +0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base
  5862 +0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place
  5863 +0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern
  5864 +0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone
  5865 +
  5866 +# Scourge of Armagon
  5867 +
  5868 +0 string 5\x0aCommand_HQ Quake I save: start Command HQ
  5869 +0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station
  5870 +0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility
  5871 +0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret)
  5872 +0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine
  5873 +0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility
  5874 +0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms
  5875 +0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret)
  5876 +0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral
  5877 +0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs
  5878 +0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt
  5879 +0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep
  5880 +0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment
  5881 +0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium
  5882 +0 string 5\x0aLimbo Quake I save: hip3m3 Limbo
  5883 +0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret)
  5884 +0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet
  5885 +0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair
  5886 +
  5887 +# Malice
  5888 +
  5889 +0 string 5\x0aThe_Academy Quake I save: start The academy
  5890 +0 string 5\x0aThe_Lab Quake I save: d1 The lab
  5891 +0 string 5\x0aArea_33 Quake I save: d1b Area 33
  5892 +0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions
  5893 +0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret)
  5894 +0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
  5895 +0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice
  5896 +0 string 5\x0aArea44 Quake I save: d1c Area 44
  5897 +0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers
  5898 +0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life
  5899 +0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood
  5900 +0 string 5\x0aThe_Flood Quake I save: d5 The flood
  5901 +0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant
  5902 +0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant
  5903 +0 string 5\x0aThe_Foundry Quake I save: d7b The foundry
  5904 +0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base
  5905 +0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base
  5906 +0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories
  5907 +0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive
  5908 +0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ
  5909 +0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown!
  5910 +
  5911 +# Malice DeathMatch levels
  5912 +
  5913 +0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct
  5914 +0 string 5\x0aSub_Station Quake I save: ddm2 Sub station
  5915 +0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights!
  5916 +0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa
  5917 +0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse
  5918 +0 string 5\x0aDOMINO Quake I save: ddm6 Domino
  5919 +0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder
  5920 +
  5921 +
  5922 +0 string MComprHD MAME CHD compressed hard disk image,
  5923 +>12 belong x version %lu
  5924 +
  5925 +#------------------------------------------------------------------------------
  5926 +# GEOS files (Vidar Madsen, vidar@gimp.org)
  5927 +# semi-commonly used in embedded and handheld systems.
  5928 +0 belong 0xc745c153 GEOS
  5929 +>40 byte 1 executable
  5930 +>40 byte 2 VMFile
  5931 +>40 byte 3 binary
  5932 +>40 byte 4 directory label
  5933 +>40 byte <1 unknown
  5934 +>40 byte >4 unknown
  5935 +>4 string >\0 \b, name "%s"
  5936 +#>44 short x \b, version %d
  5937 +#>46 short x \b.%d
  5938 +#>48 short x \b, rev %d
  5939 +#>50 short x \b.%d
  5940 +#>52 short x \b, proto %d
  5941 +#>54 short x \br%d
  5942 +#>168 string >\0 \b, copyright "%s"
  5943 +
  5944 +#------------------------------------------------------------------------------
  5945 +# gcc: file(1) magic for GCC special files
  5946 +#
  5947 +0 string gpch GCC precompiled header
  5948 +
  5949 +# The version field is annoying. It's 3 characters, not zero-terminated.
  5950 +>5 byte x (version %c
  5951 +>6 byte x \b%c
  5952 +>7 byte x \b%c)
  5953 +
  5954 +# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
  5955 +>4 byte 67 for C
  5956 +>4 byte 111 for Objective C
  5957 +>4 byte 43 for C++
  5958 +>4 byte 79 for Objective C++
  5959 +#------------------------------------------------------------------------------
  5960 +# GIMP Gradient: file(1) magic for the GIMP's gradient data files
  5961 +# by Federico Mena <federico@nuclecu.unam.mx>
  5962 +
  5963 +0 string GIMP\ Gradient GIMP gradient data
  5964 +
  5965 +#------------------------------------------------------------------------------
  5966 +# XCF: file(1) magic for the XCF image format used in the GIMP developed
  5967 +# by Spencer Kimball and Peter Mattis
  5968 +# ('Bucky' LaDieu, nega@vt.edu)
  5969 +
  5970 +0 string gimp\ xcf GIMP XCF image data,
  5971 +>9 string file version 0,
  5972 +>9 string v version
  5973 +>>10 string >\0 %s,
  5974 +>14 belong x %lu x
  5975 +>18 belong x %lu,
  5976 +>22 belong 0 RGB Color
  5977 +>22 belong 1 Greyscale
  5978 +>22 belong 2 Indexed Color
  5979 +>22 belong >2 Unknown Image Type.
  5980 +
  5981 +#------------------------------------------------------------------------------
  5982 +# XCF: file(1) magic for the patterns used in the GIMP, developed
  5983 +# by Spencer Kimball and Peter Mattis
  5984 +# ('Bucky' LaDieu, nega@vt.edu)
  5985 +
  5986 +20 string GPAT GIMP pattern data,
  5987 +>24 string x %s
  5988 +
  5989 +#------------------------------------------------------------------------------
  5990 +# XCF: file(1) magic for the brushes used in the GIMP, developed
  5991 +# by Spencer Kimball and Peter Mattis
  5992 +# ('Bucky' LaDieu, nega@vt.edu)
  5993 +
  5994 +20 string GIMP GIMP brush data
  5995 +#------------------------------------------------------------------------------
  5996 +# gnu: file(1) magic for various GNU tools
  5997 +#
  5998 +# GNU nlsutils message catalog file format
  5999 +#
  6000 +0 string \336\22\4\225 GNU message catalog (little endian),
  6001 +>4 lelong x revision %d,
  6002 +>8 lelong x %d messages
  6003 +0 string \225\4\22\336 GNU message catalog (big endian),
  6004 +>4 belong x revision %d,
  6005 +>8 belong x %d messages
  6006 +# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
  6007 +0 string *nazgul* Nazgul style compiled message catalog
  6008 +>8 lelong >0 \b, version %ld
  6009 +
  6010 +# GnuPG
  6011 +# The format is very similar to pgp
  6012 +0 string \001gpg GPG key trust database
  6013 +>4 byte x version %d
  6014 +0 beshort 0x8502 GPG encrypted data
  6015 +# This magic is not particularly good, as the keyrings don't have true
  6016 +# magic. Nevertheless, it covers many keyrings.
  6017 +0 beshort 0x9901 GPG key public ring
  6018 +
  6019 +# Gnumeric spreadsheet
  6020 +# This entry is only semi-helpful, as Gnumeric compresses its files, so
  6021 +# they will ordinarily reported as "compressed", but at least -z helps
  6022 +39 string =<gmr:Workbook Gnumeric spreadsheet
  6023 +
  6024 +# From: James Youngman <jay@gnu.org>
  6025 +# gnu find magic
  6026 +0 string \0LOCATE GNU findutils locate database data
  6027 +>7 string >\0 \b, format %s
  6028 +>7 string 02 \b (frcode)
  6029 +
  6030 +#------------------------------------------------------------------------------
  6031 +# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
  6032 +#
  6033 +# ACE/gr binary
  6034 +0 string \000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003 old ACE/gr binary file
  6035 +>39 byte >0 - version %c
  6036 +# ACE/gr ascii
  6037 +0 string #\ xvgr\ parameter\ file ACE/gr ascii file
  6038 +0 string #\ xmgr\ parameter\ file ACE/gr ascii file
  6039 +0 string #\ ACE/gr\ parameter\ file ACE/gr ascii file
  6040 +# Grace projects
  6041 +0 string #\ Grace\ project\ file Grace project file
  6042 +>23 string @version\ (version
  6043 +>>32 byte >0 %c
  6044 +>>33 string >\0 \b.%.2s
  6045 +>>35 string >\0 \b.%.2s)
  6046 +# ACE/gr fit description files
  6047 +0 string #\ ACE/gr\ fit\ description\ ACE/gr fit description file
  6048 +# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
  6049 +
  6050 +#------------------------------------------------------------------------------
  6051 +# gringotts: file(1) magic for Gringotts
  6052 +# http://devel.pluto.linux.it/projects/Gringotts/
  6053 +# author: Germano Rizzo <mano@pluto.linux.it>
  6054 +#GRG3????Y
  6055 +0 string GRG Gringotts data file
  6056 +#file format 1
  6057 +>3 string 1 v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
  6058 +#file format 2
  6059 +>3 string 2 v.2, MCRYPT S2K,
  6060 +>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
  6061 +>>8 byte&0x70 0x10 SERPENT crypt,
  6062 +>>8 byte&0x70 0x20 TWOFISH crypt,
  6063 +>>8 byte&0x70 0x30 CAST-256 crypt,
  6064 +>>8 byte&0x70 0x40 SAFER+ crypt,
  6065 +>>8 byte&0x70 0x50 LOKI97 crypt,
  6066 +>>8 byte&0x70 0x60 3DES crypt,
  6067 +>>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
  6068 +>>8 byte&0x08 0x00 SHA1 hash,
  6069 +>>8 byte&0x08 0x08 RIPEMD-160 hash,
  6070 +>>8 byte&0x04 0x00 ZLib
  6071 +>>8 byte&0x04 0x04 BZip2
  6072 +>>8 byte&0x03 0x00 lvl.0
  6073 +>>8 byte&0x03 0x01 lvl.3
  6074 +>>8 byte&0x03 0x02 lvl.6
  6075 +>>8 byte&0x03 0x03 lvl.9
  6076 +#file format 3
  6077 +>3 string 3 v.3, OpenPGP S2K,
  6078 +>>8 byte&0x70 0x00 RIJNDAEL-128 crypt,
  6079 +>>8 byte&0x70 0x10 SERPENT crypt,
  6080 +>>8 byte&0x70 0x20 TWOFISH crypt,
  6081 +>>8 byte&0x70 0x30 CAST-256 crypt,
  6082 +>>8 byte&0x70 0x40 SAFER+ crypt,
  6083 +>>8 byte&0x70 0x50 LOKI97 crypt,
  6084 +>>8 byte&0x70 0x60 3DES crypt,
  6085 +>>8 byte&0x70 0x70 RIJNDAEL-256 crypt,
  6086 +>>8 byte&0x08 0x00 SHA1 hash,
  6087 +>>8 byte&0x08 0x08 RIPEMD-160 hash,
  6088 +>>8 byte&0x04 0x00 ZLib
  6089 +>>8 byte&0x04 0x04 BZip2
  6090 +>>8 byte&0x03 0x00 lvl.0
  6091 +>>8 byte&0x03 0x01 lvl.3
  6092 +>>8 byte&0x03 0x02 lvl.6
  6093 +>>8 byte&0x03 0x03 lvl.9
  6094 +#file format >3
  6095 +>3 string >3 v.%.1s (unknown details)
  6096 +
  6097 +#------------------------------------------------------------------------------
  6098 +# hitach-sh: file(1) magic for Hitachi Super-H
  6099 +#
  6100 +# Super-H COFF
  6101 +#
  6102 +0 beshort 0x0500 Hitachi SH big-endian COFF
  6103 +>18 beshort&0x0002 =0x0000 object
  6104 +>18 beshort&0x0002 =0x0002 executable
  6105 +>18 beshort&0x0008 =0x0008 \b, stripped
  6106 +>18 beshort&0x0008 =0x0000 \b, not stripped
  6107 +#
  6108 +0 leshort 0x0550 Hitachi SH little-endian COFF
  6109 +>18 leshort&0x0002 =0x0000 object
  6110 +>18 leshort&0x0002 =0x0002 executable
  6111 +>18 leshort&0x0008 =0x0008 \b, stripped
  6112 +>18 leshort&0x0008 =0x0000 \b, not stripped
  6113 +
  6114 +
  6115 +#------------------------------------------------------------------------------
  6116 +# hp: file(1) magic for Hewlett Packard machines (see also "printer")
  6117 +#
  6118 +# XXX - somebody should figure out whether any byte order needs to be
  6119 +# applied to the "TML" stuff; I'm assuming the Apollo stuff is
  6120 +# big-endian as it was mostly 68K-based.
  6121 +#
  6122 +# I think the 500 series was the old stack-based machines, running a
  6123 +# UNIX environment atop the "SUN kernel"; dunno whether it was
  6124 +# big-endian or little-endian.
  6125 +#
  6126 +# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
  6127 +# hp300 are 68020+68881 based; hp400 are also 68k. The following basic
  6128 +# HP magic is useful for reference, but using "long" magic is a better
  6129 +# practice in order to avoid collisions.
  6130 +#
  6131 +# Guy Harris (guy@netapp.com): some additions to this list came from
  6132 +# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
  6133 +# 1.2, and 2.0). The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
  6134 +# "/etc/magic", though, except for the "archive file relocatable library"
  6135 +# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
  6136 +# used in executables, or have they just not yet updated "/etc/magic"
  6137 +# completely?
  6138 +#
  6139 +# 0 beshort 200 hp200 (68010) BSD binary
  6140 +# 0 beshort 300 hp300 (68020+68881) BSD binary
  6141 +# 0 beshort 0x20c hp200/300 HP-UX binary
  6142 +# 0 beshort 0x20d hp400 (68030) HP-UX binary
  6143 +# 0 beshort 0x20e hp400 (68040?) HP-UX binary
  6144 +# 0 beshort 0x20b PA-RISC1.0 HP-UX binary
  6145 +# 0 beshort 0x210 PA-RISC1.1 HP-UX binary
  6146 +# 0 beshort 0x211 PA-RISC1.2 HP-UX binary
  6147 +# 0 beshort 0x214 PA-RISC2.0 HP-UX binary
  6148 +
  6149 +#
  6150 +# The "misc" stuff needs a byte order; the archives look suspiciously
  6151 +# like the old 177545 archives (0xff65 = 0177545).
  6152 +#
  6153 +#### Old Apollo stuff
  6154 +0 beshort 0627 Apollo m68k COFF executable
  6155 +>18 beshort ^040000 not stripped
  6156 +>22 beshort >0 - version %ld
  6157 +0 beshort 0624 apollo a88k COFF executable
  6158 +>18 beshort ^040000 not stripped
  6159 +>22 beshort >0 - version %ld
  6160 +0 long 01203604016 TML 0123 byte-order format
  6161 +0 long 01702407010 TML 1032 byte-order format
  6162 +0 long 01003405017 TML 2301 byte-order format
  6163 +0 long 01602007412 TML 3210 byte-order format
  6164 +#### PA-RISC 1.1
  6165 +0 belong 0x02100106 PA-RISC1.1 relocatable object
  6166 +0 belong 0x02100107 PA-RISC1.1 executable
  6167 +>168 belong &0x00000004 dynamically linked
  6168 +>(144) belong 0x054ef630 dynamically linked
  6169 +>96 belong >0 - not stripped
  6170 +
  6171 +0 belong 0x02100108 PA-RISC1.1 shared executable
  6172 +>168 belong&0x4 0x4 dynamically linked
  6173 +>(144) belong 0x054ef630 dynamically linked
  6174 +>96 belong >0 - not stripped
  6175 +
  6176 +0 belong 0x0210010b PA-RISC1.1 demand-load executable
  6177 +>168 belong&0x4 0x4 dynamically linked
  6178 +>(144) belong 0x054ef630 dynamically linked
  6179 +>96 belong >0 - not stripped
  6180 +
  6181 +0 belong 0x0210010e PA-RISC1.1 shared library
  6182 +>96 belong >0 - not stripped
  6183 +
  6184 +0 belong 0x0210010d PA-RISC1.1 dynamic load library
  6185 +>96 belong >0 - not stripped
  6186 +
  6187 +#### PA-RISC 2.0
  6188 +0 belong 0x02140106 PA-RISC2.0 relocatable object
  6189 +
  6190 +0 belong 0x02140107 PA-RISC2.0 executable
  6191 +>168 belong &0x00000004 dynamically linked
  6192 +>(144) belong 0x054ef630 dynamically linked
  6193 +>96 belong >0 - not stripped
  6194 +
  6195 +0 belong 0x02140108 PA-RISC2.0 shared executable
  6196 +>168 belong &0x00000004 dynamically linked
  6197 +>(144) belong 0x054ef630 dynamically linked
  6198 +>96 belong >0 - not stripped
  6199 +
  6200 +0 belong 0x0214010b PA-RISC2.0 demand-load executable
  6201 +>168 belong &0x00000004 dynamically linked
  6202 +>(144) belong 0x054ef630 dynamically linked
  6203 +>96 belong >0 - not stripped
  6204 +
  6205 +0 belong 0x0214010e PA-RISC2.0 shared library
  6206 +>96 belong >0 - not stripped
  6207 +
  6208 +0 belong 0x0214010d PA-RISC2.0 dynamic load library
  6209 +>96 belong >0 - not stripped
  6210 +
  6211 +#### 800
  6212 +0 belong 0x020b0106 PA-RISC1.0 relocatable object
  6213 +
  6214 +0 belong 0x020b0107 PA-RISC1.0 executable
  6215 +>168 belong&0x4 0x4 dynamically linked
  6216 +>(144) belong 0x054ef630 dynamically linked
  6217 +>96 belong >0 - not stripped
  6218 +
  6219 +0 belong 0x020b0108 PA-RISC1.0 shared executable
  6220 +>168 belong&0x4 0x4 dynamically linked
  6221 +>(144) belong 0x054ef630 dynamically linked
  6222 +>96 belong >0 - not stripped
  6223 +
  6224 +0 belong 0x020b010b PA-RISC1.0 demand-load executable
  6225 +>168 belong&0x4 0x4 dynamically linked
  6226 +>(144) belong 0x054ef630 dynamically linked
  6227 +>96 belong >0 - not stripped
  6228 +
  6229 +0 belong 0x020b010e PA-RISC1.0 shared library
  6230 +>96 belong >0 - not stripped
  6231 +
  6232 +0 belong 0x020b010d PA-RISC1.0 dynamic load library
  6233 +>96 belong >0 - not stripped
  6234 +
  6235 +0 belong 0x213c6172 archive file
  6236 +>68 belong 0x020b0619 - PA-RISC1.0 relocatable library
  6237 +>68 belong 0x02100619 - PA-RISC1.1 relocatable library
  6238 +>68 belong 0x02110619 - PA-RISC1.2 relocatable library
  6239 +>68 belong 0x02140619 - PA-RISC2.0 relocatable library
  6240 +
  6241 +#### 500
  6242 +0 long 0x02080106 HP s500 relocatable executable
  6243 +>16 long >0 - version %ld
  6244 +
  6245 +0 long 0x02080107 HP s500 executable
  6246 +>16 long >0 - version %ld
  6247 +
  6248 +0 long 0x02080108 HP s500 pure executable
  6249 +>16 long >0 - version %ld
  6250 +
  6251 +#### 200
  6252 +0 belong 0x020c0108 HP s200 pure executable
  6253 +>4 beshort >0 - version %ld
  6254 +>8 belong &0x80000000 save fp regs
  6255 +>8 belong &0x40000000 dynamically linked
  6256 +>8 belong &0x20000000 debuggable
  6257 +>36 belong >0 not stripped
  6258 +
  6259 +0 belong 0x020c0107 HP s200 executable
  6260 +>4 beshort >0 - version %ld
  6261 +>8 belong &0x80000000 save fp regs
  6262 +>8 belong &0x40000000 dynamically linked
  6263 +>8 belong &0x20000000 debuggable
  6264 +>36 belong >0 not stripped
  6265 +
  6266 +0 belong 0x020c010b HP s200 demand-load executable
  6267 +>4 beshort >0 - version %ld
  6268 +>8 belong &0x80000000 save fp regs
  6269 +>8 belong &0x40000000 dynamically linked
  6270 +>8 belong &0x20000000 debuggable
  6271 +>36 belong >0 not stripped
  6272 +
  6273 +0 belong 0x020c0106 HP s200 relocatable executable
  6274 +>4 beshort >0 - version %ld
  6275 +>6 beshort >0 - highwater %d
  6276 +>8 belong &0x80000000 save fp regs
  6277 +>8 belong &0x20000000 debuggable
  6278 +>8 belong &0x10000000 PIC
  6279 +
  6280 +0 belong 0x020a0108 HP s200 (2.x release) pure executable
  6281 +>4 beshort >0 - version %ld
  6282 +>36 belong >0 not stripped
  6283 +
  6284 +0 belong 0x020a0107 HP s200 (2.x release) executable
  6285 +>4 beshort >0 - version %ld
  6286 +>36 belong >0 not stripped
  6287 +
  6288 +0 belong 0x020c010e HP s200 shared library
  6289 +>4 beshort >0 - version %ld
  6290 +>6 beshort >0 - highwater %d
  6291 +>36 belong >0 not stripped
  6292 +
  6293 +0 belong 0x020c010d HP s200 dynamic load library
  6294 +>4 beshort >0 - version %ld
  6295 +>6 beshort >0 - highwater %d
  6296 +>36 belong >0 not stripped
  6297 +
  6298 +#### MISC
  6299 +0 long 0x0000ff65 HP old archive
  6300 +0 long 0x020aff65 HP s200 old archive
  6301 +0 long 0x020cff65 HP s200 old archive
  6302 +0 long 0x0208ff65 HP s500 old archive
  6303 +
  6304 +0 long 0x015821a6 HP core file
  6305 +
  6306 +0 long 0x4da7eee8 HP-WINDOWS font
  6307 +>8 byte >0 - version %ld
  6308 +0 string Bitmapfile HP Bitmapfile
  6309 +
  6310 +0 string IMGfile CIS compimg HP Bitmapfile
  6311 +# XXX - see "lif"
  6312 +#0 short 0x8000 lif file
  6313 +0 long 0x020c010c compiled Lisp
  6314 +
  6315 +0 string msgcat01 HP NLS message catalog,
  6316 +>8 long >0 %d messages
  6317 +
  6318 +# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
  6319 +0 string HPHP48- HP48 binary
  6320 +>7 byte >0 - Rev %c
  6321 +>8 beshort 0x1129 (ADR)
  6322 +>8 beshort 0x3329 (REAL)
  6323 +>8 beshort 0x5529 (LREAL)
  6324 +>8 beshort 0x7729 (COMPLX)
  6325 +>8 beshort 0x9d29 (LCOMPLX)
  6326 +>8 beshort 0xbf29 (CHAR)
  6327 +>8 beshort 0xe829 (ARRAY)
  6328 +>8 beshort 0x0a2a (LNKARRAY)
  6329 +>8 beshort 0x2c2a (STRING)
  6330 +>8 beshort 0x4e2a (HXS)
  6331 +>8 beshort 0x742a (LIST)
  6332 +>8 beshort 0x962a (DIR)
  6333 +>8 beshort 0xb82a (ALG)
  6334 +>8 beshort 0xda2a (UNIT)
  6335 +>8 beshort 0xfc2a (TAGGED)
  6336 +>8 beshort 0x1e2b (GROB)
  6337 +>8 beshort 0x402b (LIB)
  6338 +>8 beshort 0x622b (BACKUP)
  6339 +>8 beshort 0x882b (LIBDATA)
  6340 +>8 beshort 0x9d2d (PROG)
  6341 +>8 beshort 0xcc2d (CODE)
  6342 +>8 beshort 0x482e (GNAME)
  6343 +>8 beshort 0x6d2e (LNAME)
  6344 +>8 beshort 0x922e (XLIB)
  6345 +0 string %%HP: HP48 text
  6346 +>6 string T(0) - T(0)
  6347 +>6 string T(1) - T(1)
  6348 +>6 string T(2) - T(2)
  6349 +>6 string T(3) - T(3)
  6350 +>10 string A(D) A(D)
  6351 +>10 string A(R) A(R)
  6352 +>10 string A(G) A(G)
  6353 +>14 string F(.) F(.);
  6354 +>14 string F(,) F(,);
  6355 +
  6356 +# hpBSD magic numbers
  6357 +0 beshort 200 hp200 (68010) BSD
  6358 +>2 beshort 0407 impure binary
  6359 +>2 beshort 0410 read-only binary
  6360 +>2 beshort 0413 demand paged binary
  6361 +0 beshort 300 hp300 (68020+68881) BSD
  6362 +>2 beshort 0407 impure binary
  6363 +>2 beshort 0410 read-only binary
  6364 +>2 beshort 0413 demand paged binary
  6365 +#
  6366 +# From David Gero <dgero@nortelnetworks.com>
  6367 +# HP-UX 10.20 core file format from /usr/include/sys/core.h
  6368 +# Unfortunately, HP-UX uses corehead blocks without specifying the order
  6369 +# There are four we care about:
  6370 +# CORE_KERNEL, which starts with the string "HP-UX"
  6371 +# CORE_EXEC, which contains the name of the command
  6372 +# CORE_PROC, which contains the signal number that caused the core dump
  6373 +# CORE_FORMAT, which contains the version of the core file format (== 1)
  6374 +# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
  6375 +# but we include all 6 variations of the order of the first 3, and
  6376 +# assume that PROC will always be last
  6377 +# Order 1: KERNEL, EXEC, FORMAT, PROC
  6378 +0x10 string HP-UX
  6379 +>0 belong 2
  6380 +>>0xC belong 0x3C
  6381 +>>>0x4C belong 0x100
  6382 +>>>>0x58 belong 0x44
  6383 +>>>>>0xA0 belong 1
  6384 +>>>>>>0xAC belong 4
  6385 +>>>>>>>0xB0 belong 1
  6386 +>>>>>>>>0xB4 belong 4 core file
  6387 +>>>>>>>>>0x90 string >\0 from '%s'
  6388 +>>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6389 +>>>>>>>>>0xC4 belong 4 - received SIGILL
  6390 +>>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6391 +>>>>>>>>>0xC4 belong 6 - received SIGABRT
  6392 +>>>>>>>>>0xC4 belong 7 - received SIGEMT
  6393 +>>>>>>>>>0xC4 belong 8 - received SIGFPE
  6394 +>>>>>>>>>0xC4 belong 10 - received SIGBUS
  6395 +>>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6396 +>>>>>>>>>0xC4 belong 12 - received SIGSYS
  6397 +>>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6398 +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6399 +# Order 2: KERNEL, FORMAT, EXEC, PROC
  6400 +>>>0x4C belong 1
  6401 +>>>>0x58 belong 4
  6402 +>>>>>0x5C belong 1
  6403 +>>>>>>0x60 belong 0x100
  6404 +>>>>>>>0x6C belong 0x44
  6405 +>>>>>>>>0xB4 belong 4 core file
  6406 +>>>>>>>>>0xA4 string >\0 from '%s'
  6407 +>>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6408 +>>>>>>>>>0xC4 belong 4 - received SIGILL
  6409 +>>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6410 +>>>>>>>>>0xC4 belong 6 - received SIGABRT
  6411 +>>>>>>>>>0xC4 belong 7 - received SIGEMT
  6412 +>>>>>>>>>0xC4 belong 8 - received SIGFPE
  6413 +>>>>>>>>>0xC4 belong 10 - received SIGBUS
  6414 +>>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6415 +>>>>>>>>>0xC4 belong 12 - received SIGSYS
  6416 +>>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6417 +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6418 +# Order 3: FORMAT, KERNEL, EXEC, PROC
  6419 +0x24 string HP-UX
  6420 +>0 belong 1
  6421 +>>0xC belong 4
  6422 +>>>0x10 belong 1
  6423 +>>>>0x14 belong 2
  6424 +>>>>>0x20 belong 0x3C
  6425 +>>>>>>0x60 belong 0x100
  6426 +>>>>>>>0x6C belong 0x44
  6427 +>>>>>>>>0xB4 belong 4 core file
  6428 +>>>>>>>>>0xA4 string >\0 from '%s'
  6429 +>>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6430 +>>>>>>>>>0xC4 belong 4 - received SIGILL
  6431 +>>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6432 +>>>>>>>>>0xC4 belong 6 - received SIGABRT
  6433 +>>>>>>>>>0xC4 belong 7 - received SIGEMT
  6434 +>>>>>>>>>0xC4 belong 8 - received SIGFPE
  6435 +>>>>>>>>>0xC4 belong 10 - received SIGBUS
  6436 +>>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6437 +>>>>>>>>>0xC4 belong 12 - received SIGSYS
  6438 +>>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6439 +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6440 +# Order 4: EXEC, KERNEL, FORMAT, PROC
  6441 +0x64 string HP-UX
  6442 +>0 belong 0x100
  6443 +>>0xC belong 0x44
  6444 +>>>0x54 belong 2
  6445 +>>>>0x60 belong 0x3C
  6446 +>>>>>0xA0 belong 1
  6447 +>>>>>>0xAC belong 4
  6448 +>>>>>>>0xB0 belong 1
  6449 +>>>>>>>>0xB4 belong 4 core file
  6450 +>>>>>>>>>0x44 string >\0 from '%s'
  6451 +>>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6452 +>>>>>>>>>0xC4 belong 4 - received SIGILL
  6453 +>>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6454 +>>>>>>>>>0xC4 belong 6 - received SIGABRT
  6455 +>>>>>>>>>0xC4 belong 7 - received SIGEMT
  6456 +>>>>>>>>>0xC4 belong 8 - received SIGFPE
  6457 +>>>>>>>>>0xC4 belong 10 - received SIGBUS
  6458 +>>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6459 +>>>>>>>>>0xC4 belong 12 - received SIGSYS
  6460 +>>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6461 +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6462 +# Order 5: FORMAT, EXEC, KERNEL, PROC
  6463 +0x78 string HP-UX
  6464 +>0 belong 1
  6465 +>>0xC belong 4
  6466 +>>>0x10 belong 1
  6467 +>>>>0x14 belong 0x100
  6468 +>>>>>0x20 belong 0x44
  6469 +>>>>>>0x68 belong 2
  6470 +>>>>>>>0x74 belong 0x3C
  6471 +>>>>>>>>0xB4 belong 4 core file
  6472 +>>>>>>>>>0x58 string >\0 from '%s'
  6473 +>>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6474 +>>>>>>>>>0xC4 belong 4 - received SIGILL
  6475 +>>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6476 +>>>>>>>>>0xC4 belong 6 - received SIGABRT
  6477 +>>>>>>>>>0xC4 belong 7 - received SIGEMT
  6478 +>>>>>>>>>0xC4 belong 8 - received SIGFPE
  6479 +>>>>>>>>>0xC4 belong 10 - received SIGBUS
  6480 +>>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6481 +>>>>>>>>>0xC4 belong 12 - received SIGSYS
  6482 +>>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6483 +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6484 +# Order 6: EXEC, FORMAT, KERNEL, PROC
  6485 +>0 belong 0x100
  6486 +>>0xC belong 0x44
  6487 +>>>0x54 belong 1
  6488 +>>>>0x60 belong 4
  6489 +>>>>>0x64 belong 1
  6490 +>>>>>>0x68 belong 2
  6491 +>>>>>>>0x74 belong 0x2C
  6492 +>>>>>>>>0xB4 belong 4 core file
  6493 +>>>>>>>>>0x44 string >\0 from '%s'
  6494 +>>>>>>>>>0xC4 belong 3 - received SIGQUIT
  6495 +>>>>>>>>>0xC4 belong 4 - received SIGILL
  6496 +>>>>>>>>>0xC4 belong 5 - received SIGTRAP
  6497 +>>>>>>>>>0xC4 belong 6 - received SIGABRT
  6498 +>>>>>>>>>0xC4 belong 7 - received SIGEMT
  6499 +>>>>>>>>>0xC4 belong 8 - received SIGFPE
  6500 +>>>>>>>>>0xC4 belong 10 - received SIGBUS
  6501 +>>>>>>>>>0xC4 belong 11 - received SIGSEGV
  6502 +>>>>>>>>>0xC4 belong 12 - received SIGSYS
  6503 +>>>>>>>>>0xC4 belong 33 - received SIGXCPU
  6504 +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ
  6505 +
  6506 +# From: AMAKAWA Shuhei <sa264@cam.ac.uk>
  6507 +0 string HPHP49- HP49 binary
  6508 +
  6509 +
  6510 +#------------------------------------------------------------------------------
  6511 +# human68k: file(1) magic for Human68k (X680x0 DOS) binary formats
  6512 +# Magic too short!
  6513 +#0 string HU Human68k
  6514 +#>68 string LZX LZX compressed
  6515 +#>>72 string >\0 (version %s)
  6516 +#>(8.L+74) string LZX LZX compressed
  6517 +#>>(8.L+78) string >\0 (version %s)
  6518 +#>60 belong >0 binded
  6519 +#>(8.L+66) string #HUPAIR hupair
  6520 +#>0 string HU X executable
  6521 +#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1
  6522 +#>4 belong >0 - base address 0x%x
  6523 +#>28 belong >0 not stripped
  6524 +#>32 belong >0 with debug information
  6525 +#0 beshort 0x601a Human68k Z executable
  6526 +#0 beshort 0x6000 Human68k object file
  6527 +#0 belong 0xd1000000 Human68k ar binary archive
  6528 +#0 belong 0xd1010000 Human68k ar ascii archive
  6529 +#0 beshort 0x0068 Human68k lib archive
  6530 +#4 string LZX Human68k LZX compressed
  6531 +#>8 string >\0 (version %s)
  6532 +#>4 string LZX R executable
  6533 +#2 string #HUPAIR Human68k hupair R executable
  6534 +
  6535 +#------------------------------------------------------------------------------
  6536 +# ibm370: file(1) magic for IBM 370 and compatibles.
  6537 +#
  6538 +# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
  6539 +# What the heck *is* "USS/370"?
  6540 +# AIX 4.1's "/etc/magic" has
  6541 +#
  6542 +# 0 short 0535 370 sysV executable
  6543 +# >12 long >0 not stripped
  6544 +# >22 short >0 - version %d
  6545 +# >30 long >0 - 5.2 format
  6546 +# 0 short 0530 370 sysV pure executable
  6547 +# >12 long >0 not stripped
  6548 +# >22 short >0 - version %d
  6549 +# >30 long >0 - 5.2 format
  6550 +#
  6551 +# instead of the "USS/370" versions of the same magic numbers.
  6552 +#
  6553 +0 beshort 0537 370 XA sysV executable
  6554 +>12 belong >0 not stripped
  6555 +>22 beshort >0 - version %d
  6556 +>30 belong >0 - 5.2 format
  6557 +0 beshort 0532 370 XA sysV pure executable
  6558 +>12 belong >0 not stripped
  6559 +>22 beshort >0 - version %d
  6560 +>30 belong >0 - 5.2 format
  6561 +0 beshort 054001 370 sysV pure executable
  6562 +>12 belong >0 not stripped
  6563 +0 beshort 055001 370 XA sysV pure executable
  6564 +>12 belong >0 not stripped
  6565 +0 beshort 056401 370 sysV executable
  6566 +>12 belong >0 not stripped
  6567 +0 beshort 057401 370 XA sysV executable
  6568 +>12 belong >0 not stripped
  6569 +0 beshort 0531 SVR2 executable (Amdahl-UTS)
  6570 +>12 belong >0 not stripped
  6571 +>24 belong >0 - version %ld
  6572 +0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
  6573 +>12 belong >0 not stripped
  6574 +>24 belong >0 - version %ld
  6575 +0 beshort 0530 SVR2 pure executable (USS/370)
  6576 +>12 belong >0 not stripped
  6577 +>24 belong >0 - version %ld
  6578 +0 beshort 0535 SVR2 executable (USS/370)
  6579 +>12 belong >0 not stripped
  6580 +>24 belong >0 - version %ld
  6581 +
  6582 +#------------------------------------------------------------------------------
  6583 +# ibm6000: file(1) magic for RS/6000 and the RT PC.
  6584 +#
  6585 +0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
  6586 +>12 belong >0 not stripped
  6587 +# Breaks sun4 statically linked execs.
  6588 +#0 beshort 0x0103 executable (RT Version 2) or obj module
  6589 +#>2 byte 0x50 pure
  6590 +#>28 belong >0 not stripped
  6591 +#>6 beshort >0 - version %ld
  6592 +0 beshort 0x0104 shared library
  6593 +0 beshort 0x0105 ctab data
  6594 +0 beshort 0xfe04 structured file
  6595 +0 string 0xabcdef AIX message catalog
  6596 +0 belong 0x000001f9 AIX compiled message catalog
  6597 +0 string \<aiaff> archive
  6598 +0 string \<bigaf> archive (big format)
  6599 +
  6600 +
  6601 +#------------------------------------------------------------------------------
  6602 +# iff: file(1) magic for Interchange File Format (see also "audio" & "images")
  6603 +#
  6604 +# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
  6605 +# Arts for file interchange. It has also been used by Apple, SGI, and
  6606 +# especially Commodore-Amiga.
  6607 +#
  6608 +# IFF files begin with an 8 byte FORM header, followed by a 4 character
  6609 +# FORM type, which is followed by the first chunk in the FORM.
  6610 +
  6611 +0 string FORM IFF data
  6612 +#>4 belong x \b, FORM is %d bytes long
  6613 +# audio formats
  6614 +>8 string AIFF \b, AIFF audio
  6615 +>8 string AIFC \b, AIFF-C compressed audio
  6616 +>8 string 8SVX \b, 8SVX 8-bit sampled sound voice
  6617 +>8 string 16SV \b, 16SV 16-bit sampled sound voice
  6618 +>8 string SAMP \b, SAMP sampled audio
  6619 +>8 string MAUD \b, MAUD MacroSystem audio
  6620 +>8 string SMUS \b, SMUS simple music
  6621 +>8 string CMUS \b, CMUS complex music
  6622 +# image formats
  6623 +>8 string ILBMBMHD \b, ILBM interleaved image
  6624 +>>20 beshort x \b, %d x
  6625 +>>22 beshort x %d
  6626 +>8 string RGBN \b, RGBN 12-bit RGB image
  6627 +>8 string RGB8 \b, RGB8 24-bit RGB image
  6628 +>8 string DEEP \b, DEEP TVPaint/XiPaint image
  6629 +>8 string DR2D \b, DR2D 2-D object
  6630 +>8 string TDDD \b, TDDD 3-D rendering
  6631 +>8 string LWOB \b, LWOB 3-D object
  6632 +>8 string LWO2 \b, LWO2 3-D object, v2
  6633 +>8 string LWLO \b, LWLO 3-D layered object
  6634 +>8 string REAL \b, REAL Real3D rendering
  6635 +>8 string MC4D \b, MC4D MaxonCinema4D rendering
  6636 +>8 string ANIM \b, ANIM animation
  6637 +>8 string YAFA \b, YAFA animation
  6638 +>8 string SSA\ \b, SSA super smooth animation
  6639 +>8 string ACBM \b, ACBM continuous image
  6640 +>8 string FAXX \b, FAXX fax image
  6641 +# other formats
  6642 +>8 string FTXT \b, FTXT formatted text
  6643 +>8 string CTLG \b, CTLG message catalog
  6644 +>8 string PREF \b, PREF preferences
  6645 +>8 string DTYP \b, DTYP datatype description
  6646 +>8 string PTCH \b, PTCH binary patch
  6647 +>8 string AMFF \b, AMFF AmigaMetaFile format
  6648 +>8 string WZRD \b, WZRD StormWIZARD resource
  6649 +>8 string DOC\ \b, DOC desktop publishing document
  6650 +
  6651 +# These go at the end of the iff rules
  6652 +#
  6653 +# I don't see why these might collide with anything else.
  6654 +#
  6655 +# Interactive Fiction related formats
  6656 +#
  6657 +>8 string IFRS \b, Blorb Interactive Fiction
  6658 +>>24 string Exec with executable chunk
  6659 +>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal)
  6660 +
  6661 +#------------------------------------------------------------------------------
  6662 +# images: file(1) magic for image formats (see also "iff")
  6663 +#
  6664 +# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
  6665 +# additions by janl@ifi.uio.no as well as others. Jan also suggested
  6666 +# merging several one- and two-line files into here.
  6667 +#
  6668 +# little magic: PCX (first byte is 0x0a)
  6669 +
  6670 +# Targa - matches `povray', `ppmtotga' and `xv' outputs
  6671 +# by Philippe De Muyter <phdm@macqel.be>
  6672 +# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
  6673 +# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
  6674 +# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
  6675 +# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
  6676 +# `tgatoppm' recognizes a superset (Index may be anything)
  6677 +1 belong&0xfff7ffff 0x01010000 Targa image data - Map
  6678 +>2 byte&8 8 - RLE
  6679 +>12 leshort >0 %hd x
  6680 +>14 leshort >0 %hd
  6681 +1 belong&0xfff7ffff 0x00020000 Targa image data - RGB
  6682 +>2 byte&8 8 - RLE
  6683 +>12 leshort >0 %hd x
  6684 +>14 leshort >0 %hd
  6685 +1 belong&0xfff7ffff 0x00030000 Targa image data - Mono
  6686 +>2 byte&8 8 - RLE
  6687 +>12 leshort >0 %hd x
  6688 +>14 leshort >0 %hd
  6689 +
  6690 +# PBMPLUS images
  6691 +# The next byte following the magic is always whitespace.
  6692 +0 string P1 Netpbm PBM image text
  6693 +0 string P2 Netpbm PGM image text
  6694 +0 string P3 Netpbm PPM image text
  6695 +0 string P4 Netpbm PBM "rawbits" image data
  6696 +0 string P5 Netpbm PGM "rawbits" image data
  6697 +0 string P6 Netpbm PPM "rawbits" image data
  6698 +0 string P7 Netpbm PAM image file
  6699 +
  6700 +# From: bryanh@giraffe-data.com (Bryan Henderson)
  6701 +0 string \117\072 Solitaire Image Recorder format
  6702 +>4 string \013 MGI Type 11
  6703 +>4 string \021 MGI Type 17
  6704 +0 string .MDA MicroDesign data
  6705 +>21 byte 48 version 2
  6706 +>21 byte 51 version 3
  6707 +0 string .MDP MicroDesign page data
  6708 +>21 byte 48 version 2
  6709 +>21 byte 51 version 3
  6710 +
  6711 +# NIFF (Navy Interchange File Format, a modification of TIFF) images
  6712 +0 string IIN1 NIFF image data
  6713 +
  6714 +# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
  6715 +# The second word of TIFF files is the TIFF version number, 42, which has
  6716 +# never changed. The TIFF specification recommends testing for it.
  6717 +0 string MM\x00\x2a TIFF image data, big-endian
  6718 +0 string II\x2a\x00 TIFF image data, little-endian
  6719 +
  6720 +# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
  6721 +# (Greg Roelofs, newt@uchicago.edu)
  6722 +# (Albert Cahalan, acahalan@cs.uml.edu)
  6723 +#
  6724 +# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
  6725 +#
  6726 +0 string \x89PNG PNG image data,
  6727 +>4 belong !0x0d0a1a0a CORRUPTED,
  6728 +>4 belong 0x0d0a1a0a
  6729 +>>16 belong x %ld x
  6730 +>>20 belong x %ld,
  6731 +>>24 byte x %d-bit
  6732 +>>25 byte 0 grayscale,
  6733 +>>25 byte 2 \b/color RGB,
  6734 +>>25 byte 3 colormap,
  6735 +>>25 byte 4 gray+alpha,
  6736 +>>25 byte 6 \b/color RGBA,
  6737 +#>>26 byte 0 deflate/32K,
  6738 +>>28 byte 0 non-interlaced
  6739 +>>28 byte 1 interlaced
  6740 +1 string PNG PNG image data, CORRUPTED
  6741 +
  6742 +# GIF
  6743 +0 string GIF8 GIF image data
  6744 +>4 string 7a \b, version 8%s,
  6745 +>4 string 9a \b, version 8%s,
  6746 +>6 leshort >0 %hd x
  6747 +>8 leshort >0 %hd
  6748 +#>10 byte &0x80 color mapped,
  6749 +#>10 byte&0x07 =0x00 2 colors
  6750 +#>10 byte&0x07 =0x01 4 colors
  6751 +#>10 byte&0x07 =0x02 8 colors
  6752 +#>10 byte&0x07 =0x03 16 colors
  6753 +#>10 byte&0x07 =0x04 32 colors
  6754 +#>10 byte&0x07 =0x05 64 colors
  6755 +#>10 byte&0x07 =0x06 128 colors
  6756 +#>10 byte&0x07 =0x07 256 colors
  6757 +
  6758 +# ITC (CMU WM) raster files. It is essentially a byte-reversed Sun raster,
  6759 +# 1 plane, no encoding.
  6760 +0 string \361\0\100\273 CMU window manager raster image data
  6761 +>4 lelong >0 %d x
  6762 +>8 lelong >0 %d,
  6763 +>12 lelong >0 %d-bit
  6764 +
  6765 +# Magick Image File Format
  6766 +0 string id=ImageMagick MIFF image data
  6767 +
  6768 +# Artisan
  6769 +0 long 1123028772 Artisan image data
  6770 +>4 long 1 \b, rectangular 24-bit
  6771 +>4 long 2 \b, rectangular 8-bit with colormap
  6772 +>4 long 3 \b, rectangular 32-bit (24-bit with matte)
  6773 +
  6774 +# FIG (Facility for Interactive Generation of figures), an object-based format
  6775 +0 string #FIG FIG image text
  6776 +>5 string x \b, version %.3s
  6777 +
  6778 +# PHIGS
  6779 +0 string ARF_BEGARF PHIGS clear text archive
  6780 +0 string @(#)SunPHIGS SunPHIGS
  6781 +# version number follows, in the form m.n
  6782 +>40 string SunBin binary
  6783 +>32 string archive archive
  6784 +
  6785 +# GKS (Graphics Kernel System)
  6786 +0 string GKSM GKS Metafile
  6787 +>24 string SunGKS \b, SunGKS
  6788 +
  6789 +# CGM image files
  6790 +0 string BEGMF clear text Computer Graphics Metafile
  6791 +# XXX - questionable magic
  6792 +0 beshort&0xffe0 0x0020 binary Computer Graphics Metafile
  6793 +0 beshort 0x3020 character Computer Graphics Metafile
  6794 +
  6795 +# MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
  6796 +0 string yz MGR bitmap, modern format, 8-bit aligned
  6797 +0 string zz MGR bitmap, old format, 1-bit deep, 16-bit aligned
  6798 +0 string xz MGR bitmap, old format, 1-bit deep, 32-bit aligned
  6799 +0 string yx MGR bitmap, modern format, squeezed
  6800 +
  6801 +# Fuzzy Bitmap (FBM) images
  6802 +0 string %bitmap\0 FBM image data
  6803 +>30 long 0x31 \b, mono
  6804 +>30 long 0x33 \b, color
  6805 +
  6806 +# facsimile data
  6807 +1 string PC\ Research,\ Inc group 3 fax data
  6808 +>29 byte 0 \b, normal resolution (204x98 DPI)
  6809 +>29 byte 1 \b, fine resolution (204x196 DPI)
  6810 +# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
  6811 +0 string Sfff structured fax file
  6812 +
  6813 +
  6814 +# PC bitmaps (OS/2, Windoze BMP files) (Greg Roelofs, newt@uchicago.edu)
  6815 +0 string BM PC bitmap data
  6816 +>14 leshort 12 \b, OS/2 1.x format
  6817 +>>18 leshort x \b, %d x
  6818 +>>20 leshort x %d
  6819 +>14 leshort 64 \b, OS/2 2.x format
  6820 +>>18 leshort x \b, %d x
  6821 +>>20 leshort x %d
  6822 +>14 leshort 40 \b, Windows 3.x format
  6823 +>>18 lelong x \b, %d x
  6824 +>>22 lelong x %d x
  6825 +>>28 leshort x %d
  6826 +# Too simple - MPi
  6827 +#0 string IC PC icon data
  6828 +#0 string PI PC pointer image data
  6829 +#0 string CI PC color icon data
  6830 +#0 string CP PC color pointer image data
  6831 +# Conflicts with other entries [BABYL]
  6832 +#0 string BA PC bitmap array data
  6833 +
  6834 +# XPM icons (Greg Roelofs, newt@uchicago.edu)
  6835 +# note possible collision with C/REXX entry in c-lang; currently commented out
  6836 +0 string /*\ XPM\ */ X pixmap image text
  6837 +
  6838 +# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
  6839 +0 leshort 0xcc52 RLE image data,
  6840 +>6 leshort x %d x
  6841 +>8 leshort x %d
  6842 +>2 leshort >0 \b, lower left corner: %d
  6843 +>4 leshort >0 \b, lower right corner: %d
  6844 +>10 byte&0x1 =0x1 \b, clear first
  6845 +>10 byte&0x2 =0x2 \b, no background
  6846 +>10 byte&0x4 =0x4 \b, alpha channel
  6847 +>10 byte&0x8 =0x8 \b, comment
  6848 +>11 byte >0 \b, %d color channels
  6849 +>12 byte >0 \b, %d bits per pixel
  6850 +>13 byte >0 \b, %d color map channels
  6851 +
  6852 +# image file format (Robert Potter, potter@cs.rochester.edu)
  6853 +0 string Imagefile\ version- iff image data
  6854 +# this adds the whole header (inc. version number), informative but longish
  6855 +>10 string >\0 %s
  6856 +
  6857 +# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
  6858 +0 belong 0x59a66a95 Sun raster image data
  6859 +>4 belong >0 \b, %d x
  6860 +>8 belong >0 %d,
  6861 +>12 belong >0 %d-bit,
  6862 +#>16 belong >0 %d bytes long,
  6863 +>20 belong 0 old format,
  6864 +#>20 belong 1 standard,
  6865 +>20 belong 2 compressed,
  6866 +>20 belong 3 RGB,
  6867 +>20 belong 4 TIFF,
  6868 +>20 belong 5 IFF,
  6869 +>20 belong 0xffff reserved for testing,
  6870 +>24 belong 0 no colormap
  6871 +>24 belong 1 RGB colormap
  6872 +>24 belong 2 raw colormap
  6873 +#>28 belong >0 colormap is %d bytes long
  6874 +
  6875 +# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
  6876 +#
  6877 +# See
  6878 +# http://reality.sgi.com/grafica/sgiimage.html
  6879 +#
  6880 +0 beshort 474 SGI image data
  6881 +#>2 byte 0 \b, verbatim
  6882 +>2 byte 1 \b, RLE
  6883 +#>3 byte 1 \b, normal precision
  6884 +>3 byte 2 \b, high precision
  6885 +>4 beshort x \b, %d-D
  6886 +>6 beshort x \b, %d x
  6887 +>8 beshort x %d
  6888 +>10 beshort x \b, %d channel
  6889 +>10 beshort !1 \bs
  6890 +>80 string >0 \b, "%s"
  6891 +
  6892 +0 string IT01 FIT image data
  6893 +>4 belong x \b, %d x
  6894 +>8 belong x %d x
  6895 +>12 belong x %d
  6896 +#
  6897 +0 string IT02 FIT image data
  6898 +>4 belong x \b, %d x
  6899 +>8 belong x %d x
  6900 +>12 belong x %d
  6901 +#
  6902 +2048 string PCD_IPI Kodak Photo CD image pack file
  6903 +>0xe02 byte&0x03 0x00 , landscape mode
  6904 +>0xe02 byte&0x03 0x01 , portrait mode
  6905 +>0xe02 byte&0x03 0x02 , landscape mode
  6906 +>0xe02 byte&0x03 0x03 , portrait mode
  6907 +0 string PCD_OPA Kodak Photo CD overview pack file
  6908 +
  6909 +# FITS format. Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
  6910 +# FITS is the Flexible Image Transport System, the de facto standard for
  6911 +# data and image transfer, storage, etc., for the astronomical community.
  6912 +# (FITS floating point formats are big-endian.)
  6913 +0 string SIMPLE\ \ = FITS image data
  6914 +>109 string 8 \b, 8-bit, character or unsigned binary integer
  6915 +>108 string 16 \b, 16-bit, two's complement binary integer
  6916 +>107 string \ 32 \b, 32-bit, two's complement binary integer
  6917 +>107 string -32 \b, 32-bit, floating point, single precision
  6918 +>107 string -64 \b, 64-bit, floating point, double precision
  6919 +
  6920 +# other images
  6921 +0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file
  6922 +0 string =!! Bennet Yee's "face" format
  6923 +
  6924 +# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
  6925 +# stuff.
  6926 +#
  6927 +0 beshort 0x1010 PEX Binary Archive
  6928 +
  6929 +# DICOM medical imaging data
  6930 +128 string DICM DICOM medical imaging data
  6931 +
  6932 +# XWD - X Window Dump file.
  6933 +# As described in /usr/X11R6/include/X11/XWDFile.h
  6934 +# used by the xwd program.
  6935 +# Bradford Castalia, idaeim, 1/01
  6936 +4 belong 7 XWD X Window Dump image data
  6937 +>100 string >\0 \b, "%s"
  6938 +>16 belong x \b, %dx
  6939 +>20 belong x \b%dx
  6940 +>12 belong x \b%d
  6941 +
  6942 +# PDS - Planetary Data System
  6943 +# These files use Parameter Value Language in the header section.
  6944 +# Unfortunately, there is no certain magic, but the following
  6945 +# strings have been found to be most likely.
  6946 +0 string NJPL1I00 PDS (JPL) image data
  6947 +2 string NJPL1I PDS (JPL) image data
  6948 +0 string CCSD3ZF PDS (CCSD) image data
  6949 +2 string CCSD3Z PDS (CCSD) image data
  6950 +0 string PDS_ PDS image data
  6951 +0 string LBLSIZE= PDS (VICAR) image data
  6952 +
  6953 +# pM8x: ATARI STAD compressed bitmap format
  6954 +#
  6955 +# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
  6956 +# p M 8 5/6 xx yy zz data...
  6957 +# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
  6958 +# bytes either run horizontally (pM85) or vertically (pM86). yy is the
  6959 +# most frequent byte, xx and zz are runlength escape codes, where xx is
  6960 +# used for runs of yy.
  6961 +#
  6962 +0 string pM85 Atari ST STAD bitmap image data (hor)
  6963 +>5 byte 0x00 (white background)
  6964 +>5 byte 0xFF (black background)
  6965 +0 string pM86 Atari ST STAD bitmap image data (vert)
  6966 +>5 byte 0x00 (white background)
  6967 +>5 byte 0xFF (black background)
  6968 +
  6969 +# Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
  6970 +# http://www.atarimax.com/jindroush.atari.org/afmtatr.html
  6971 +0 leshort 0x0296 Atari ATR image
  6972 +
  6973 +# XXX:
  6974 +# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
  6975 +# magic.
  6976 +# SGI RICE image file <mpruett@sgi.com>
  6977 +#0 beshort 0x5249 RICE image
  6978 +#>2 beshort x v%d
  6979 +#>4 beshort x (%d x
  6980 +#>6 beshort x %d)
  6981 +#>8 beshort 0 8 bit
  6982 +#>8 beshort 1 10 bit
  6983 +#>8 beshort 2 12 bit
  6984 +#>8 beshort 3 13 bit
  6985 +#>10 beshort 0 4:2:2
  6986 +#>10 beshort 1 4:2:2:4
  6987 +#>10 beshort 2 4:4:4
  6988 +#>10 beshort 3 4:4:4:4
  6989 +#>12 beshort 1 RGB
  6990 +#>12 beshort 2 CCIR601
  6991 +#>12 beshort 3 RP175
  6992 +#>12 beshort 4 YUV
  6993 +
  6994 +#------------------------------------------------------------------------------
  6995 +#
  6996 +# Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image file format
  6997 +# for the EPOC operating system, which is used with PDAs like those from Psion
  6998 +#
  6999 +# see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description
  7000 +# of various EPOC file formats
  7001 +
  7002 +0 string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file
  7003 +
  7004 +# PCX image files
  7005 +# From: Dan Fandrich <dan@coneharvesters.com>
  7006 +0 beshort 0x0a00 PCX ver. 2.5 image data
  7007 +0 beshort 0x0a02 PCX ver. 2.8 image data, with palette
  7008 +0 beshort 0x0a03 PCX ver. 2.8 image data, without palette
  7009 +0 beshort 0x0a04 PCX for Windows image data
  7010 +0 beshort 0x0a05 PCX ver. 3.0 image data
  7011 +>4 leshort x bounding box [%hd,
  7012 +>6 leshort x %hd] -
  7013 +>8 leshort x [%hd,
  7014 +>10 leshort x %hd],
  7015 +>65 byte >1 %d planes each of
  7016 +>3 byte x %hhd-bit
  7017 +>68 byte 0 image,
  7018 +>68 byte 1 colour,
  7019 +>68 byte 2 grayscale,
  7020 +>68 byte >2 image,
  7021 +>68 byte <0 image,
  7022 +>12 leshort >0 %hd x
  7023 +>>14 leshort x %hd dpi,
  7024 +>2 byte 0 uncompressed
  7025 +>2 byte 1 RLE compressed
  7026 +
  7027 +# Adobe Photoshop
  7028 +0 string 8BPS Adobe Photoshop Image
  7029 +
  7030 +# XV thumbnail indicator (ThMO)
  7031 +0 string P7\ 332 XV thumbnail image data
  7032 +
  7033 +# NITF is defined by United States MIL-STD-2500A
  7034 +0 string NITF National Imagery Transmission Format
  7035 +>25 string >\0 dated %.14s
  7036 +
  7037 +# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
  7038 +0 belong 0x00010008 GEM Image data
  7039 +>12 beshort x %d x
  7040 +>14 beshort x %d,
  7041 +>4 beshort x %d planes,
  7042 +>8 beshort x %d x
  7043 +>10 beshort x %d pixelsize
  7044 +
  7045 +# GEM Metafile (Wolfram Kleff)
  7046 +0 lelong 0x0018FFFF GEM Metafile data
  7047 +>4 leshort x version %d
  7048 +
  7049 +#
  7050 +# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
  7051 +# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
  7052 +#
  7053 +0 string \0\nSMJPEG SMJPEG
  7054 +>8 belong x %d.x data
  7055 +# According to the specification you could find any number of _TXT
  7056 +# headers here, but I can't think of any way of handling that. None of
  7057 +# the SMJPEG files I tried it on used this feature. Even if such a
  7058 +# file is encountered the output should still be reasonable.
  7059 +>16 string _SND \b,
  7060 +>>24 beshort >0 %d Hz
  7061 +>>26 byte 8 8-bit
  7062 +>>26 byte 16 16-bit
  7063 +>>28 string NONE uncompressed
  7064 +# >>28 string APCM ADPCM compressed
  7065 +>>27 byte 1 mono
  7066 +>>28 byte 2 stereo
  7067 +# Help! Isn't there any way to avoid writing this part twice?
  7068 +>>32 string _VID \b,
  7069 +# >>>48 string JFIF JPEG
  7070 +>>>40 belong >0 %d frames
  7071 +>>>44 beshort >0 (%d x
  7072 +>>>46 beshort >0 %d)
  7073 +>16 string _VID \b,
  7074 +# >>32 string JFIF JPEG
  7075 +>>24 belong >0 %d frames
  7076 +>>28 beshort >0 (%d x
  7077 +>>30 beshort >0 %d)
  7078 +
  7079 +0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File
  7080 +
  7081 +# "thumbnail file" (icon)
  7082 +# descended from "xv", but in use by other applications as well (Wolfram Kleff)
  7083 +0 string P7\ 332 XV "thumbnail file" (icon) data
  7084 +
  7085 +# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
  7086 +0 string KiSS KISS/GS
  7087 +>4 byte 16 color
  7088 +>>5 byte x %d bit
  7089 +>>8 leshort x %d colors
  7090 +>>10 leshort x %d groups
  7091 +>4 byte 32 cell
  7092 +>>5 byte x %d bit
  7093 +>>8 leshort x %d x
  7094 +>>10 leshort x %d
  7095 +>>12 leshort x +%d
  7096 +>>14 leshort x +%d
  7097 +
  7098 +# Webshots (www.webshots.com), by John Harrison
  7099 +0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file
  7100 +
  7101 +# Hercules DASD image files
  7102 +# From Jan Jaeger <jj@septa.nl>
  7103 +0 string CKD_P370 Hercules CKD DASD image file
  7104 +>8 long x \b, %d heads per cylinder
  7105 +>12 long x \b, track size %d bytes
  7106 +>16 byte x \b, device type 33%2.2X
  7107 +
  7108 +0 string CKD_C370 Hercules compressed CKD DASD image file
  7109 +>8 long x \b, %d heads per cylinder
  7110 +>12 long x \b, track size %d bytes
  7111 +>16 byte x \b, device type 33%2.2X
  7112 +
  7113 +0 string CKD_S370 Hercules CKD DASD shadow file
  7114 +>8 long x \b, %d heads per cylinder
  7115 +>12 long x \b, track size %d bytes
  7116 +>16 byte x \b, device type 33%2.2X
  7117 +
  7118 +# Squeak images and - etoffi@softhome.net
  7119 +0 string \146\031\0\0 Squeak image data
  7120 +0 string 'From\040Squeak Squeak program text
  7121 +
  7122 +# partimage: file(1) magic for PartImage files (experimental, incomplete)
  7123 +# Author: Hans-Joachim Baader <hjb@pro-linux.de>
  7124 +0 string PaRtImAgE-VoLuMe PartImage
  7125 +>0x0020 string 0.6.1 file version %s
  7126 +>>0x0060 lelong >-1 volume %ld
  7127 +#>>0x0064 8 byte identifier
  7128 +#>>0x007c reserved
  7129 +>>0x0200 string >\0 type %s
  7130 +>>0x1400 string >\0 device %s,
  7131 +>>0x1600 string >\0 original filename %s,
  7132 +# Some fields omitted
  7133 +>>0x2744 lelong 0 not compressed
  7134 +>>0x2744 lelong 1 gzip compressed
  7135 +>>0x2744 lelong 2 bzip2 compressed
  7136 +>>0x2744 lelong >2 compressed with unknown algorithm
  7137 +>0x0020 string >0.6.1 file version %s
  7138 +>0x0020 string <0.6.1 file version %s
  7139 +
  7140 +# DCX is multi-page PCX, using a simple header of up to 1024
  7141 +# offsets for the respective PCX components.
  7142 +# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
  7143 +0 lelong 987654321 DCX multi-page PCX image data
  7144 +
  7145 +# Simon Walton <simonw@matteworld.com>
  7146 +# Kodak Cineon format for scanned negatives
  7147 +# http://www.kodak.com/US/en/motion/support/dlad/
  7148 +0 lelong 0xd75f2a80 Cineon image data
  7149 +>200 belong >0 \b, %ld x
  7150 +>204 belong >0 %ld
  7151 +
  7152 +
  7153 +# Bio-Rad .PIC is an image format used by microscope control systems
  7154 +# and related image processing software used by biologists.
  7155 +# From: Vebjorn Ljosa <vebjorn@ljosa.com>
  7156 +54 leshort 12345 Bio-Rad .PIC Image File
  7157 +>0 leshort >0 %hd x
  7158 +>2 leshort >0 %hd,
  7159 +>4 leshort =1 1 image in file
  7160 +>4 leshort >1 %hd images in file
  7161 +
  7162 +# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
  7163 +# The description of *.mrw format can be found at
  7164 +# http://www.dalibor.cz/minolta/raw_file_format.htm
  7165 +0 string \000MRM Minolta Dimage camera raw image data
  7166 +
  7167 +# From: stephane.loeuillet@tiscali.f
  7168 +# http://www.djvuzone.org/
  7169 +0 string AT&TFORM DjVu Image file
  7170 +
  7171 +# From: Jason Bacon <bacon@smithers.neuro.mcw.edu>
  7172 +0 beshort 0x3020 character Computer Graphics Metafile
  7173 +
  7174 +# From Marc Espie
  7175 +0 lelong 20000630 OpenEXR image data
  7176 +
  7177 +# From: Tom Hilinski <tom.hilinski@comcast.net>
  7178 +# http://www.unidata.ucar.edu/packages/netcdf/
  7179 +0 string CDF\001 NetCDF Data Format data
  7180 +
  7181 +#-----------------------------------------------------------------------
  7182 +# Hierarchical Data Format, used to facilitate scientific data exchange
  7183 +# specifications at http://hdf.ncsa.uiuc.edu/
  7184 +0 belong 0x0e031301 Hierarchical Data Format (version 4) data
  7185 +0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data
  7186 +
  7187 +# From: Tobias Burnus <burnus@net-b.de>
  7188 +# Xara (for a while: Corel Xara) is a graphic package, see
  7189 +# http://www.xara.com/ for Windows and as GPL application for
  7190 +0 string XARA\243\243 Xara graphics file
  7191 +
  7192 +#------------------------------------------------------------------------------
  7193 +# intel: file(1) magic for x86 Unix
  7194 +#
  7195 +# Various flavors of x86 UNIX executable/object (other than Xenix, which
  7196 +# is in "microsoft"). DOS is in "msdos"; the ambitious soul can do
  7197 +# Windows as well.
  7198 +#
  7199 +# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
  7200 +# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere
  7201 +# as well, if, as, and when IBM makes it portable.
  7202 +#
  7203 +# The `versions' should be un-commented if they work for you.
  7204 +# (Was the problem just one of endianness?)
  7205 +#
  7206 +0 leshort 0502 basic-16 executable
  7207 +>12 lelong >0 not stripped
  7208 +#>22 leshort >0 - version %ld
  7209 +0 leshort 0503 basic-16 executable (TV)
  7210 +>12 lelong >0 not stripped
  7211 +#>22 leshort >0 - version %ld
  7212 +0 leshort 0510 x86 executable
  7213 +>12 lelong >0 not stripped
  7214 +0 leshort 0511 x86 executable (TV)
  7215 +>12 lelong >0 not stripped
  7216 +0 leshort =0512 iAPX 286 executable small model (COFF)
  7217 +>12 lelong >0 not stripped
  7218 +#>22 leshort >0 - version %ld
  7219 +0 leshort =0522 iAPX 286 executable large model (COFF)
  7220 +>12 lelong >0 not stripped
  7221 +#>22 leshort >0 - version %ld
  7222 +# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
  7223 +0 leshort =0514 80386 COFF executable
  7224 +>12 lelong >0 not stripped
  7225 +>22 leshort >0 - version %ld
  7226 +
  7227 +# rom: file(1) magic for BIOS ROM Extensions found in intel machines
  7228 +# mapped into memory between 0xC0000 and 0xFFFFF
  7229 +# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
  7230 +0 beshort 0x55AA BIOS (ia32) ROM Ext.
  7231 +>5 string USB USB
  7232 +>7 string LDR UNDI image
  7233 +>30 string IBM IBM comp. Video
  7234 +>26 string Adaptec Adaptec
  7235 +>28 string Adaptec Adaptec
  7236 +>42 string PROMISE Promise
  7237 +>2 byte x (%d*512)
  7238 +
  7239 +#------------------------------------------------------------------------------
  7240 +# interleaf: file(1) magic for InterLeaf TPS:
  7241 +#
  7242 +0 string =\210OPS Interleaf saved data
  7243 +0 string =<!OPS Interleaf document text
  7244 +>5 string ,\ Version\ = \b, version
  7245 +>>17 string >\0 %.3s
  7246 +
  7247 +#------------------------------------------------------------------------------
  7248 +# island: file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
  7249 +# "/etc/magic":
  7250 +# From: guy@netapp.com (Guy Harris)
  7251 +#
  7252 +4 string pgscriptver IslandWrite document
  7253 +13 string DrawFile IslandDraw document
  7254 +
  7255 +
  7256 +#------------------------------------------------------------------------------
  7257 +# ispell: file(1) magic for ispell
  7258 +#
  7259 +# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602. This magic
  7260 +# will match 0x9600 through 0x9603 in *both* little endian and big endian.
  7261 +# (No other current magic entries collide.)
  7262 +#
  7263 +# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
  7264 +#
  7265 +0 leshort&0xFFFC 0x9600 little endian ispell
  7266 +>0 byte 0 hash file (?),
  7267 +>0 byte 1 3.0 hash file,
  7268 +>0 byte 2 3.1 hash file,
  7269 +>0 byte 3 hash file (?),
  7270 +>2 leshort 0x00 8-bit, no capitalization, 26 flags
  7271 +>2 leshort 0x01 7-bit, no capitalization, 26 flags
  7272 +>2 leshort 0x02 8-bit, capitalization, 26 flags
  7273 +>2 leshort 0x03 7-bit, capitalization, 26 flags
  7274 +>2 leshort 0x04 8-bit, no capitalization, 52 flags
  7275 +>2 leshort 0x05 7-bit, no capitalization, 52 flags
  7276 +>2 leshort 0x06 8-bit, capitalization, 52 flags
  7277 +>2 leshort 0x07 7-bit, capitalization, 52 flags
  7278 +>2 leshort 0x08 8-bit, no capitalization, 128 flags
  7279 +>2 leshort 0x09 7-bit, no capitalization, 128 flags
  7280 +>2 leshort 0x0A 8-bit, capitalization, 128 flags
  7281 +>2 leshort 0x0B 7-bit, capitalization, 128 flags
  7282 +>2 leshort 0x0C 8-bit, no capitalization, 256 flags
  7283 +>2 leshort 0x0D 7-bit, no capitalization, 256 flags
  7284 +>2 leshort 0x0E 8-bit, capitalization, 256 flags
  7285 +>2 leshort 0x0F 7-bit, capitalization, 256 flags
  7286 +>4 leshort >0 and %d string characters
  7287 +0 beshort&0xFFFC 0x9600 big endian ispell
  7288 +>1 byte 0 hash file (?),
  7289 +>1 byte 1 3.0 hash file,
  7290 +>1 byte 2 3.1 hash file,
  7291 +>1 byte 3 hash file (?),
  7292 +>2 beshort 0x00 8-bit, no capitalization, 26 flags
  7293 +>2 beshort 0x01 7-bit, no capitalization, 26 flags
  7294 +>2 beshort 0x02 8-bit, capitalization, 26 flags
  7295 +>2 beshort 0x03 7-bit, capitalization, 26 flags
  7296 +>2 beshort 0x04 8-bit, no capitalization, 52 flags
  7297 +>2 beshort 0x05 7-bit, no capitalization, 52 flags
  7298 +>2 beshort 0x06 8-bit, capitalization, 52 flags
  7299 +>2 beshort 0x07 7-bit, capitalization, 52 flags
  7300 +>2 beshort 0x08 8-bit, no capitalization, 128 flags
  7301 +>2 beshort 0x09 7-bit, no capitalization, 128 flags
  7302 +>2 beshort 0x0A 8-bit, capitalization, 128 flags
  7303 +>2 beshort 0x0B 7-bit, capitalization, 128 flags
  7304 +>2 beshort 0x0C 8-bit, no capitalization, 256 flags
  7305 +>2 beshort 0x0D 7-bit, no capitalization, 256 flags
  7306 +>2 beshort 0x0E 8-bit, capitalization, 256 flags
  7307 +>2 beshort 0x0F 7-bit, capitalization, 256 flags
  7308 +>4 beshort >0 and %d string characters
  7309 +# ispell 4.0 hash files kromJx <kromJx@crosswinds.net>
  7310 +# Ispell 4.0
  7311 +0 string ISPL ispell
  7312 +>4 long x hash file version %d,
  7313 +>8 long x lexletters %d,
  7314 +>12 long x lexsize %d,
  7315 +>16 long x hashsize %d,
  7316 +>20 long x stblsize %d
  7317 +#------------------------------------------------------------
  7318 +# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
  7319 +# same magic number, 0xcafebabe, so they are both handled
  7320 +# in the entry called "cafebabe".
  7321 +#------------------------------------------------------------
  7322 +# Java serialization
  7323 +# From Martin Pool (m.pool@pharos.com.au)
  7324 +0 beshort 0xaced Java serialization data
  7325 +>2 beshort >0x0004 \b, version %d
  7326 +
  7327 +#------------------------------------------------------------------------------
  7328 +# JPEG images
  7329 +# SunOS 5.5.1 had
  7330 +#
  7331 +# 0 string \377\330\377\340 JPEG file
  7332 +# 0 string \377\330\377\356 JPG file
  7333 +#
  7334 +# both of which turn into "JPEG image data" here.
  7335 +#
  7336 +0 beshort 0xffd8 JPEG image data
  7337 +>6 string JFIF \b, JFIF standard
  7338 +# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
  7339 +# in a vain attempt to add image size reporting for JFIF. Note that these
  7340 +# tests are not fool-proof since some perfectly valid JPEGs are currently
  7341 +# impossible to specify in magic(4) format.
  7342 +# First, a little JFIF version info:
  7343 +>>11 byte x \b %d.
  7344 +>>12 byte x \b%02d
  7345 +# Next, the resolution or aspect ratio of the image:
  7346 +#>>13 byte 0 \b, aspect ratio
  7347 +#>>13 byte 1 \b, resolution (DPI)
  7348 +#>>13 byte 2 \b, resolution (DPCM)
  7349 +#>>4 beshort x \b, segment length %d
  7350 +# Next, show thumbnail info, if it exists:
  7351 +>>18 byte !0 \b, thumbnail %dx
  7352 +>>>19 byte x \b%d
  7353 +
  7354 +# EXIF moved down here to avoid reporting a bogus version number,
  7355 +# and EXIF version number printing added.
  7356 +# - Patrik R=E5dman <patrik+file-magic@iki.fi>
  7357 +>6 string Exif \b, EXIF standard
  7358 +# Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD.
  7359 +# All possible combinations of entries have to be enumerated, since no looping
  7360 +# is possible. And both endians are possible...
  7361 +# The combinations included below are from real-world JPEGs.
  7362 +# Little-endian
  7363 +>>12 string II
  7364 +# IFD 0 Entry #5:
  7365 +>>>70 leshort 0x8769
  7366 +# EXIF IFD Entry #1:
  7367 +>>>>(78.l+14) leshort 0x9000
  7368 +>>>>>(78.l+23) byte x %c
  7369 +>>>>>(78.l+24) byte x \b.%c
  7370 +>>>>>(78.l+25) byte !0x30 \b%c
  7371 +# IFD 0 Entry #9:
  7372 +>>>118 leshort 0x8769
  7373 +# EXIF IFD Entry #3:
  7374 +>>>>(126.l+38) leshort 0x9000
  7375 +>>>>>(126.l+47) byte x %c
  7376 +>>>>>(126.l+48) byte x \b.%c
  7377 +>>>>>(126.l+49) byte !0x30 \b%c
  7378 +# IFD 0 Entry #10
  7379 +>>>130 leshort 0x8769
  7380 +# EXIF IFD Entry #3:
  7381 +>>>>(138.l+38) leshort 0x9000
  7382 +>>>>>(138.l+47) byte x %c
  7383 +>>>>>(138.l+48) byte x \b.%c
  7384 +>>>>>(138.l+49) byte !0x30 \b%c
  7385 +# EXIF IFD Entry #4:
  7386 +>>>>(138.l+50) leshort 0x9000
  7387 +>>>>>(138.l+59) byte x %c
  7388 +>>>>>(138.l+60) byte x \b.%c
  7389 +>>>>>(138.l+61) byte !0x30 \b%c
  7390 +# EXIF IFD Entry #5:
  7391 +>>>>(138.l+62) leshort 0x9000
  7392 +>>>>>(138.l+71) byte x %c
  7393 +>>>>>(138.l+72) byte x \b.%c
  7394 +>>>>>(138.l+73) byte !0x30 \b%c
  7395 +# IFD 0 Entry #11
  7396 +>>>142 leshort 0x8769
  7397 +# EXIF IFD Entry #3:
  7398 +>>>>(150.l+38) leshort 0x9000
  7399 +>>>>>(150.l+47) byte x %c
  7400 +>>>>>(150.l+48) byte x \b.%c
  7401 +>>>>>(150.l+49) byte !0x30 \b%c
  7402 +# EXIF IFD Entry #4:
  7403 +>>>>(150.l+50) leshort 0x9000
  7404 +>>>>>(150.l+59) byte x %c
  7405 +>>>>>(150.l+60) byte x \b.%c
  7406 +>>>>>(150.l+61) byte !0x30 \b%c
  7407 +# EXIF IFD Entry #5:
  7408 +>>>>(150.l+62) leshort 0x9000
  7409 +>>>>>(150.l+71) byte x %c
  7410 +>>>>>(150.l+72) byte x \b.%c
  7411 +>>>>>(150.l+73) byte !0x30 \b%c
  7412 +# Big-endian
  7413 +>>12 string MM
  7414 +# IFD 0 Entry #9:
  7415 +>>>118 beshort 0x8769
  7416 +# EXIF IFD Entry #1:
  7417 +>>>>(126.L+14) beshort 0x9000
  7418 +>>>>>(126.L+23) byte x %c
  7419 +>>>>>(126.L+24) byte x \b.%c
  7420 +>>>>>(126.L+25) byte !0x30 \b%c
  7421 +# EXIF IFD Entry #3:
  7422 +>>>>(126.L+38) beshort 0x9000
  7423 +>>>>>(126.L+47) byte x %c
  7424 +>>>>>(126.L+48) byte x \b.%c
  7425 +>>>>>(126.L+49) byte !0x30 \b%c
  7426 +# IFD 0 Entry #10
  7427 +>>>130 beshort 0x8769
  7428 +# EXIF IFD Entry #3:
  7429 +>>>>(138.L+38) beshort 0x9000
  7430 +>>>>>(138.L+47) byte x %c
  7431 +>>>>>(138.L+48) byte x \b.%c
  7432 +>>>>>(138.L+49) byte !0x30 \b%c
  7433 +# EXIF IFD Entry #5:
  7434 +>>>>(138.L+62) beshort 0x9000
  7435 +>>>>>(138.L+71) byte x %c
  7436 +>>>>>(138.L+72) byte x \b.%c
  7437 +>>>>>(138.L+73) byte !0x30 \b%c
  7438 +# IFD 0 Entry #11
  7439 +>>>142 beshort 0x8769
  7440 +# EXIF IFD Entry #4:
  7441 +>>>>(150.L+50) beshort 0x9000
  7442 +>>>>>(150.L+59) byte x %c
  7443 +>>>>>(150.L+60) byte x \b.%c
  7444 +>>>>>(150.L+61) byte !0x30 \b%c
  7445 +# Here things get sticky. We can do ONE MORE marker segment with
  7446 +# indirect addressing, and that's all. It would be great if we could
  7447 +# do pointer arithemetic like in an assembler language. Christos?
  7448 +# And if there was some sort of looping construct to do searches, plus a few
  7449 +# named accumulators, it would be even more effective...
  7450 +# At least we can show a comment if no other segments got inserted before:
  7451 +>(4.S+5) byte 0xFE
  7452 +>>(4.S+8) string >\0 \b, comment: "%s"
  7453 +#>(4.S+5) byte 0xFE \b, comment
  7454 +#>>(4.S+6) beshort x \b length=%d
  7455 +#>>(4.S+8) string >\0 \b, "%s"
  7456 +# Or, we can show the encoding type (I've included only the three most common)
  7457 +# and image dimensions if we are lucky and the SOFn (image segment) is here:
  7458 +>(4.S+5) byte 0xC0 \b, baseline
  7459 +>>(4.S+6) byte x \b, precision %d
  7460 +>>(4.S+7) beshort x \b, %dx
  7461 +>>(4.S+9) beshort x \b%d
  7462 +>(4.S+5) byte 0xC1 \b, extended sequential
  7463 +>>(4.S+6) byte x \b, precision %d
  7464 +>>(4.S+7) beshort x \b, %dx
  7465 +>>(4.S+9) beshort x \b%d
  7466 +>(4.S+5) byte 0xC2 \b, progressive
  7467 +>>(4.S+6) byte x \b, precision %d
  7468 +>>(4.S+7) beshort x \b, %dx
  7469 +>>(4.S+9) beshort x \b%d
  7470 +# I've commented-out quantisation table reporting. I doubt anyone cares yet.
  7471 +#>(4.S+5) byte 0xDB \b, quantisation table
  7472 +#>>(4.S+6) beshort x \b length=%d
  7473 +#>14 beshort x \b, %d x
  7474 +#>16 beshort x \b %d
  7475 +
  7476 +# HSI is Handmade Software's proprietary JPEG encoding scheme
  7477 +0 string hsi1 JPEG image data, HSI proprietary
  7478 +
  7479 +# From: David Santinoli <david@santinoli.com>
  7480 +0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000 image data
  7481 +
  7482 +#------------------------------------------------------------------------------
  7483 +# karma: file(1) magic for Karma data files
  7484 +#
  7485 +# From <rgooch@atnf.csiro.au>
  7486 +
  7487 +0 string KarmaRHD Version Karma Data Structure Version
  7488 +>16 belong x %lu
  7489 +#------------------------------------------------------------------------------
  7490 +# DEC SRC Virtual Paper: Lectern files
  7491 +# Karl M. Hegbloom <karlheg@inetarena.com>
  7492 +0 string lect DEC SRC Virtual Paper Lectern file
  7493 +
  7494 +#------------------------------------------------------------------------------
  7495 +# lex: file(1) magic for lex
  7496 +#
  7497 +# derived empirically, your offsets may vary!
  7498 +53 string yyprevious C program text (from lex)
  7499 +>3 string >\0 for %s
  7500 +# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
  7501 +21 string generated\ by\ flex C program text (from flex)
  7502 +# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
  7503 +0 string %{ lex description text
  7504 +
  7505 +#------------------------------------------------------------------------------
  7506 +# lif: file(1) magic for lif
  7507 +#
  7508 +# (Daniel Quinlan <quinlan@yggdrasil.com>)
  7509 +#
  7510 +0 beshort 0x8000 lif file
  7511 +
  7512 +#------------------------------------------------------------------------------
  7513 +# linux: file(1) magic for Linux files
  7514 +#
  7515 +# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
  7516 +# The following basic Linux magic is useful for reference, but using
  7517 +# "long" magic is a better practice in order to avoid collisions.
  7518 +#
  7519 +# 2 leshort 100 Linux/i386
  7520 +# >0 leshort 0407 impure executable (OMAGIC)
  7521 +# >0 leshort 0410 pure executable (NMAGIC)
  7522 +# >0 leshort 0413 demand-paged executable (ZMAGIC)
  7523 +# >0 leshort 0314 demand-paged executable (QMAGIC)
  7524 +#
  7525 +0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)
  7526 +>16 lelong 0 \b, stripped
  7527 +0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)
  7528 +>16 lelong 0 \b, stripped
  7529 +0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)
  7530 +>16 lelong 0 \b, stripped
  7531 +0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)
  7532 +>16 lelong 0 \b, stripped
  7533 +#
  7534 +0 string \007\001\000 Linux/i386 object file
  7535 +>20 lelong >0x1020 \b, DLL library
  7536 +# Linux-8086 stuff:
  7537 +0 string \01\03\020\04 Linux-8086 impure executable
  7538 +>28 long !0 not stripped
  7539 +0 string \01\03\040\04 Linux-8086 executable
  7540 +>28 long !0 not stripped
  7541 +#
  7542 +0 string \243\206\001\0 Linux-8086 object file
  7543 +#
  7544 +0 string \01\03\020\20 Minix-386 impure executable
  7545 +>28 long !0 not stripped
  7546 +0 string \01\03\040\20 Minix-386 executable
  7547 +>28 long !0 not stripped
  7548 +# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
  7549 +216 lelong 0421 Linux/i386 core file
  7550 +>220 string >\0 of '%s'
  7551 +>200 lelong >0 (signal %d)
  7552 +#
  7553 +# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
  7554 +# this can be overridden by the DOS executable (COM) entry
  7555 +2 string LILO Linux/i386 LILO boot/chain loader
  7556 +#
  7557 +# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
  7558 +0 leshort 0x0436 Linux/i386 PC Screen Font data,
  7559 +>2 byte 0 256 characters, no directory,
  7560 +>2 byte 1 512 characters, no directory,
  7561 +>2 byte 2 256 characters, Unicode directory,
  7562 +>2 byte 3 512 characters, Unicode directory,
  7563 +>3 byte >0 8x%d
  7564 +# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
  7565 +4086 string SWAP-SPACE Linux/i386 swap file
  7566 +# From: Jeff Bailey <jbailey@ubuntu.com>
  7567 +# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
  7568 +4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image
  7569 +# according to man page of mkswap (8) March 1999
  7570 +4086 string SWAPSPACE2 Linux/i386 swap file (new style)
  7571 +>0x400 long x %d (4K pages)
  7572 +>0x404 long x size %d pages
  7573 +>>4086 string SWAPSPACE2
  7574 +>>>1052 string >\0 Label %s
  7575 +# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
  7576 +#
  7577 +# from Erik Troan (ewt@redhat.com) examining od dumps, so this
  7578 +# could be wrong
  7579 +# updated by David Mosberger (davidm@azstarnet.com) based on
  7580 +# GNU BFD and MIPS info found below.
  7581 +#
  7582 +0 leshort 0x0183 ECOFF alpha
  7583 +>24 leshort 0407 executable
  7584 +>24 leshort 0410 pure
  7585 +>24 leshort 0413 demand paged
  7586 +>8 long >0 not stripped
  7587 +>8 long 0 stripped
  7588 +>23 leshort >0 - version %ld.
  7589 +#
  7590 +# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
  7591 +# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
  7592 +# and Nicolás Lichtmaier <nick@debian.org>
  7593 +# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
  7594 +# Linux kernel boot images (i386 arch) (Wolfram Kleff)
  7595 +514 string HdrS Linux kernel
  7596 +>510 leshort 0xAA55 x86 boot executable
  7597 +>>518 leshort >=0x200
  7598 +>>529 byte 0 zImage,
  7599 +>>>529 byte 1 bzImage,
  7600 +>>>(526.s+0x200) string >\0 version %s,
  7601 +>>498 leshort 1 RO-rootFS,
  7602 +>>498 leshort 0 RW-rootFS,
  7603 +>>508 leshort >0 root_dev 0x%X,
  7604 +>>502 leshort >0 swap_dev 0x%X,
  7605 +>>504 leshort >0 RAMdisksize %u KB,
  7606 +>>506 leshort 0xFFFF Normal VGA
  7607 +>>506 leshort 0xFFFE Extended VGA
  7608 +>>506 leshort 0xFFFD Prompt for Videomode
  7609 +>>506 leshort >0 Video mode %d
  7610 +# This also matches new kernels, which were caught above by "HdrS".
  7611 +0 belong 0xb8c0078e Linux kernel
  7612 +>0x1e3 string Loading version 1.3.79 or older
  7613 +>0x1e9 string Loading from prehistoric times
  7614 +
  7615 +# System.map files - Nicolás Lichtmaier <nick@debian.org>
  7616 +8 string \ A\ _text Linux kernel symbol map text
  7617 +
  7618 +# LSM entries - Nicolás Lichtmaier <nick@debian.org>
  7619 +0 string Begin3 Linux Software Map entry text
  7620 +0 string Begin4 Linux Software Map entry text (new format)
  7621 +
  7622 +# From Matt Zimmerman
  7623 +0 belong 0x4f4f4f4d User-mode Linux COW file
  7624 +>4 belong x \b, version %d
  7625 +>8 string >\0 \b, backing file %s
  7626 +
  7627 +############################################################################
  7628 +# Linux kernel versions
  7629 +
  7630 +0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux
  7631 +>497 leshort 0 x86 boot sector
  7632 +>>514 belong 0x8e of a kernel from the dawn of time!
  7633 +>>514 belong 0x908ed8b4 version 0.99-1.1.42
  7634 +>>514 belong 0x908ed8b8 for memtest86
  7635 +
  7636 +>497 leshort !0 x86 kernel
  7637 +>>504 leshort >0 RAMdisksize=%u KB
  7638 +>>502 leshort >0 swap=0x%X
  7639 +>>508 leshort >0 root=0x%X
  7640 +>>>498 leshort 1 \b-ro
  7641 +>>>498 leshort 0 \b-rw
  7642 +>>506 leshort 0xFFFF vga=normal
  7643 +>>506 leshort 0xFFFE vga=extended
  7644 +>>506 leshort 0xFFFD vga=ask
  7645 +>>506 leshort >0 vga=%d
  7646 +>>514 belong 0x908ed881 version 1.1.43-1.1.45
  7647 +>>514 belong 0x15b281cd
  7648 +>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0
  7649 +>>>0xa99 belong 0x55AA5a5a version 1.3.1,2
  7650 +>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30
  7651 +>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41
  7652 +>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45
  7653 +>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72
  7654 +>>514 string HdrS
  7655 +>>>518 leshort >0x1FF
  7656 +>>>>529 byte 0 \b, zImage
  7657 +>>>>529 byte 1 \b, bzImage
  7658 +>>>>(526.s+0x200) string >\0 \b, version %s
  7659 +
  7660 +# Linux boot sector thefts.
  7661 +0 belong 0xb8c0078e Linux
  7662 +>0x1e6 belong 0x454c4b53 ELKS Kernel
  7663 +>0x1e6 belong !0x454c4b53 style boot sector
  7664 +
  7665 +############################################################################
  7666 +# Linux 8086 executable
  7667 +0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
  7668 +>5 string .
  7669 +>>4 string >\0 \b, libc version %s
  7670 +
  7671 +0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable
  7672 +>2 byte&0x01 !0 \b, unmapped zero page
  7673 +>2 byte&0x20 0 \b, impure
  7674 +>2 byte&0x20 !0
  7675 +>>2 byte&0x10 !0 \b, A_EXEC
  7676 +>2 byte&0x02 !0 \b, A_PAL
  7677 +>2 byte&0x04 !0 \b, A_NSYM
  7678 +>2 byte&0x08 !0 \b, A_STAND
  7679 +>2 byte&0x40 !0 \b, A_PURE
  7680 +>2 byte&0x80 !0 \b, A_TOVLY
  7681 +>28 long !0 \b, not stripped
  7682 +>37 string .
  7683 +>>36 string >\0 \b, libc version %s
  7684 +
  7685 +# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable
  7686 +# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable
  7687 +# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable
  7688 +# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable
  7689 +
  7690 +# SYSLINUX boot logo files (from 'ppmtolss16' sources)
  7691 +# http://syslinux.zytor.com/
  7692 +#
  7693 +0 lelong =0x1413f33d SYSLINUX' LSS16 image data
  7694 +>4 leshort x \b, width %d
  7695 +>6 leshort x \b, height %d
  7696 +
  7697 +0 string OOOM User-Mode-Linux's Copy-On-Write disk image
  7698 +>4 belong x version %d
  7699 +
  7700 +# SE Linux policy database
  7701 +# From: Mike Frysinger <vapier@gentoo.org>
  7702 +0 lelong 0xf97cff8c SE Linux policy
  7703 +>16 lelong x v%d
  7704 +>20 lelong 1 MLS
  7705 +>24 lelong x %d symbols
  7706 +>28 lelong x %d ocons
  7707 +
  7708 +# Linux Logical Volume Manager (LVM)
  7709 +# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
  7710 +#
  7711 +# System ID, UUID and volume group name are 128 bytes long
  7712 +# but they should never be full and initialized with zeros...
  7713 +#
  7714 +# LVM1
  7715 +#
  7716 +0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1
  7717 +>0x12c string >\0 , System ID: %s
  7718 +
  7719 +0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2
  7720 +>0x12c string >\0 , System ID: %s
  7721 +
  7722 +# LVM2
  7723 +#
  7724 +# It seems that the label header can be in one the four first sector
  7725 +# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
  7726 +#
  7727 +# 0x200 seems to be the common case
  7728 +
  7729 +0x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
  7730 +# read the offset to add to the start of the header, and the header
  7731 +# start in 0x200
  7732 +>(0x214.l+0x200) string >\0 , UUID: %s
  7733 +
  7734 +0x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
  7735 +>(0x014.l) string >\0 , UUID: %s
  7736 +
  7737 +0x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
  7738 +>(0x414.l+0x400) string >\0 , UUID: %s
  7739 +
  7740 +0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager)
  7741 +>(0x614.l+0x600) string >\0 , UUID: %s
  7742 +
  7743 +# SE Linux policy database
  7744 +0 lelong 0xf97cff8c SE Linux policy
  7745 +>16 lelong x v%d
  7746 +>20 lelong 1 MLS
  7747 +>24 lelong x %d symbols
  7748 +>28 lelong x %d ocons
  7749 +
  7750 +# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
  7751 +# Anthon van der Neut (anthon@mnt.org)
  7752 +0 string LUKS\xba\xbe LUKS encrypted file,
  7753 +>6 beshort x ver %d
  7754 +>8 string x [%s,
  7755 +>40 string x %s,
  7756 +>72 string x %s]
  7757 +>168 string x UUID: %s
  7758 +
  7759 +
  7760 +#------------------------------------------------------------------------------
  7761 +# lisp: file(1) magic for lisp programs
  7762 +#
  7763 +# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
  7764 +
  7765 +# updated by Joerg Jenderek
  7766 +0 string ;;
  7767 +# windows INF files often begin with semicolon and use CRLF as line end
  7768 +# lisp files are mainly created on unix system with LF as line end
  7769 +>2 search/2048 !\r Lisp/Scheme program text
  7770 +>2 search/2048 \r Windows INF file
  7771 +
  7772 +0 search/256 (if\ Lisp/Scheme program text
  7773 +0 search/256 (setq\ Lisp/Scheme program text
  7774 +0 search/256 (defvar\ Lisp/Scheme program text
  7775 +0 search/256 (defparam\ Lisp/Scheme program text
  7776 +0 search/256 (defun\ Lisp/Scheme program text
  7777 +0 search/256 (autoload\ Lisp/Scheme program text
  7778 +0 search/256 (custom-set-variables\ Lisp/Scheme program text
  7779 +
  7780 +# Emacs 18 - this is always correct, but not very magical.
  7781 +0 string \012( Emacs v18 byte-compiled Lisp data
  7782 +# Emacs 19+ - ver. recognition added by Ian Springer
  7783 +# Also applies to XEmacs 19+ .elc files; could tell them apart if we had regexp
  7784 +# support or similar - Chris Chittleborough <cchittleborough@yahoo.com.au>
  7785 +0 string ;ELC
  7786 +>4 byte >19
  7787 +>4 byte <32 Emacs/XEmacs v%d byte-compiled Lisp data
  7788 +
  7789 +# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
  7790 +0 string (SYSTEM::VERSION\040' CLISP byte-compiled Lisp program text
  7791 +0 long 0x70768BD2 CLISP memory image data
  7792 +0 long 0xD28B7670 CLISP memory image data, other endian
  7793 +
  7794 +# Files produced by GNU gettext
  7795 +0 long 0xDE120495 GNU-format message catalog data
  7796 +0 long 0x950412DE GNU-format message catalog data
  7797 +
  7798 +#.com and .bin for MIT scheme
  7799 +0 string \372\372\372\372 MIT scheme (library?)
  7800 +
  7801 +# From: David Allouche <david@allouche.net>
  7802 +0 string \<TeXmacs| TeXmacs document text
  7803 +#------------------------------------------------------------
  7804 +# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
  7805 +# Unfortunately the first, cafebabe, is shared with
  7806 +# Java ByteCode, so they are both handled in the file "cafebabe".
  7807 +# The "feedface" ones are handled herein.
  7808 +#------------------------------------------------------------
  7809 +0 lelong&0xfeffffff 0xfeedface Mach-O
  7810 +>0 byte 0xcf 64-bit
  7811 +>12 lelong 1 object
  7812 +>12 lelong 2 executable
  7813 +>12 lelong 3 fixed virtual memory shared library
  7814 +>12 lelong 4 core
  7815 +>12 lelong 5 preload executable
  7816 +>12 lelong 6 dynamically linked shared library
  7817 +>12 lelong 7 dynamic linker
  7818 +>12 lelong 8 bundle
  7819 +>12 lelong 9 dynamically linked shared library stub
  7820 +>12 lelong >9
  7821 +>>12 lelong x filetype=%ld
  7822 +>4 lelong <0
  7823 +>>4 lelong x architecture=%ld
  7824 +>4 lelong 1 vax
  7825 +>4 lelong 2 romp
  7826 +>4 lelong 3 architecture=3
  7827 +>4 lelong 4 ns32032
  7828 +>4 lelong 5 ns32332
  7829 +>4 lelong 6 m68k
  7830 +>4 lelong 7 i386
  7831 +>4 lelong 8 mips
  7832 +>4 lelong 9 ns32532
  7833 +>4 lelong 10 architecture=10
  7834 +>4 lelong 11 hppa
  7835 +>4 lelong 12 acorn
  7836 +>4 lelong 13 m88k
  7837 +>4 lelong 14 sparc
  7838 +>4 lelong 15 i860-big
  7839 +>4 lelong 16 i860
  7840 +>4 lelong 17 rs6000
  7841 +>4 lelong 18 ppc
  7842 +>4 lelong 16777234 ppc64
  7843 +>4 lelong >16777234
  7844 +>>4 lelong x architecture=%ld
  7845 +#
  7846 +0 belong&0xfffffffe 0xfeedface Mach-O
  7847 +>3 byte 0xcf 64-bit
  7848 +>12 belong 1 object
  7849 +>12 belong 2 executable
  7850 +>12 belong 3 fixed virtual memory shared library
  7851 +>12 belong 4 core
  7852 +>12 belong 5 preload executable
  7853 +>12 belong 6 dynamically linked shared library
  7854 +>12 belong 7 dynamic linker
  7855 +>12 belong 8 bundle
  7856 +>12 belong 9 dynamically linked shared library stub
  7857 +>12 belong >9
  7858 +>>12 belong x filetype=%ld
  7859 +>4 belong <0
  7860 +>>4 belong x architecture=%ld
  7861 +>4 belong 1 vax
  7862 +>4 belong 2 romp
  7863 +>4 belong 3 architecture=3
  7864 +>4 belong 4 ns32032
  7865 +>4 belong 5 ns32332
  7866 +>4 belong 6 for m68k architecture
  7867 +# from NeXTstep 3.0 <mach/machine.h>
  7868 +# i.e. mc680x0_all, ignore
  7869 +# >>8 belong 1 (mc68030)
  7870 +>>8 belong 2 (mc68040)
  7871 +>>8 belong 3 (mc68030 only)
  7872 +>4 belong 7 i386
  7873 +>4 belong 8 mips
  7874 +>4 belong 9 ns32532
  7875 +>4 belong 10 architecture=10
  7876 +>4 belong 11 hppa
  7877 +>4 belong 12 acorn
  7878 +>4 belong 13 m88k
  7879 +>4 belong 14 sparc
  7880 +>4 belong 15 i860-big
  7881 +>4 belong 16 i860
  7882 +>4 belong 17 rs6000
  7883 +>4 belong 18 ppc
  7884 +>4 belong 16777234 ppc64
  7885 +>4 belong >16777234
  7886 +>>4 belong x architecture=%ld
  7887 +
  7888 +#------------------------------------------------------------------------------
  7889 +# macintosh description
  7890 +#
  7891 +# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
  7892 +# Daniel Quinlan, quinlan@yggdrasil.com
  7893 +11 string must\ be\ converted\ with\ BinHex BinHex binary text
  7894 +>41 string x \b, version %.3s
  7895 +
  7896 +# Stuffit archives are the de facto standard of compression for Macintosh
  7897 +# files obtained from most archives. (franklsm@tuns.ca)
  7898 +0 string SIT! StuffIt Archive (data)
  7899 +>2 string x : %s
  7900 +0 string SITD StuffIt Deluxe (data)
  7901 +>2 string x : %s
  7902 +0 string Seg StuffIt Deluxe Segment (data)
  7903 +>2 string x : %s
  7904 +
  7905 +# Newer StuffIt archives (grant@netbsd.org)
  7906 +0 string StuffIt StuffIt Archive
  7907 +#>162 string >0 : %s
  7908 +
  7909 +# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
  7910 +0 string APPL Macintosh Application (data)
  7911 +>2 string x \b: %s
  7912 +
  7913 +# Macintosh System files (franklsm@tuns.ca)
  7914 +0 string zsys Macintosh System File (data)
  7915 +0 string FNDR Macintosh Finder (data)
  7916 +0 string libr Macintosh Library (data)
  7917 +>2 string x : %s
  7918 +0 string shlb Macintosh Shared Library (data)
  7919 +>2 string x : %s
  7920 +0 string cdev Macintosh Control Panel (data)
  7921 +>2 string x : %s
  7922 +0 string INIT Macintosh Extension (data)
  7923 +>2 string x : %s
  7924 +0 string FFIL Macintosh Truetype Font (data)
  7925 +>2 string x : %s
  7926 +0 string LWFN Macintosh Postscript Font (data)
  7927 +>2 string x : %s
  7928 +
  7929 +# Additional Macintosh Files (franklsm@tuns.ca)
  7930 +0 string PACT Macintosh Compact Pro Archive (data)
  7931 +>2 string x : %s
  7932 +0 string ttro Macintosh TeachText File (data)
  7933 +>2 string x : %s
  7934 +0 string TEXT Macintosh TeachText File (data)
  7935 +>2 string x : %s
  7936 +0 string PDF Macintosh PDF File (data)
  7937 +>2 string x : %s
  7938 +
  7939 +# MacBinary format (Eric Fischer, enf@pobox.com)
  7940 +#
  7941 +# Unfortunately MacBinary doesn't really have a magic number prior
  7942 +# to the MacBinary III format. The checksum is really the way to
  7943 +# do it, but the magic file format isn't up to the challenge.
  7944 +#
  7945 +# 0 byte 0
  7946 +# 1 byte # filename length
  7947 +# 2 string # filename
  7948 +# 65 string # file type
  7949 +# 69 string # file creator
  7950 +# 73 byte # Finder flags
  7951 +# 74 byte 0
  7952 +# 75 beshort # vertical posn in window
  7953 +# 77 beshort # horiz posn in window
  7954 +# 79 beshort # window or folder ID
  7955 +# 81 byte # protected?
  7956 +# 82 byte 0
  7957 +# 83 belong # length of data segment
  7958 +# 87 belong # length of resource segment
  7959 +# 91 belong # file creation date
  7960 +# 95 belong # file modification date
  7961 +# 99 beshort # length of comment after resource
  7962 +# 101 byte # new Finder flags
  7963 +# 102 string mBIN # (only in MacBinary III)
  7964 +# 106 byte # char. code of file name
  7965 +# 107 byte # still more Finder flags
  7966 +# 116 belong # total file length
  7967 +# 120 beshort # length of add'l header
  7968 +# 122 byte 129 # for MacBinary II
  7969 +# 122 byte 130 # for MacBinary III
  7970 +# 123 byte 129 # minimum version that can read fmt
  7971 +# 124 beshort # checksum
  7972 +#
  7973 +# This attempts to use the version numbers as a magic number, requiring
  7974 +# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
  7975 +# be 0x81. This works for the files I have, but maybe not for everyone's.
  7976 +
  7977 +# Unfortunately, this magic is quite weak - MPi
  7978 +#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
  7979 +
  7980 +# MacBinary I doesn't have the version number field at all, but MacBinary II
  7981 +# has been in use since 1987 so I hope there aren't many really old files
  7982 +# floating around that this will miss. The original spec calls for using
  7983 +# the nulls in 0, 74, and 82 as the magic number.
  7984 +#
  7985 +# Another possibility, that would also work for MacBinary I, is to use
  7986 +# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
  7987 +# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
  7988 +# and that 74 will be 0. So something like
  7989 +#
  7990 +# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
  7991 +#
  7992 +# >73 byte&0x01 0x01 \b, inited
  7993 +# >73 byte&0x02 0x02 \b, changed
  7994 +# >73 byte&0x04 0x04 \b, busy
  7995 +# >73 byte&0x08 0x08 \b, bozo
  7996 +# >73 byte&0x10 0x10 \b, system
  7997 +# >73 byte&0x10 0x20 \b, bundle
  7998 +# >73 byte&0x10 0x40 \b, invisible
  7999 +# >73 byte&0x10 0x80 \b, locked
  8000 +
  8001 +#>65 string x \b, type "%4.4s"
  8002 +
  8003 +#>65 string 8BIM (PhotoShop)
  8004 +#>65 string ALB3 (PageMaker 3)
  8005 +#>65 string ALB4 (PageMaker 4)
  8006 +#>65 string ALT3 (PageMaker 3)
  8007 +#>65 string APPL (application)
  8008 +#>65 string AWWP (AppleWorks word processor)
  8009 +#>65 string CIRC (simulated circuit)
  8010 +#>65 string DRWG (MacDraw)
  8011 +#>65 string EPSF (Encapsulated PostScript)
  8012 +#>65 string FFIL (font suitcase)
  8013 +#>65 string FKEY (function key)
  8014 +#>65 string FNDR (Macintosh Finder)
  8015 +#>65 string GIFf (GIF image)
  8016 +#>65 string Gzip (GNU gzip)
  8017 +#>65 string INIT (system extension)
  8018 +#>65 string LIB\ (library)
  8019 +#>65 string LWFN (PostScript font)
  8020 +#>65 string MSBC (Microsoft BASIC)
  8021 +#>65 string PACT (Compact Pro archive)
  8022 +#>65 string PDF\ (Portable Document Format)
  8023 +#>65 string PICT (picture)
  8024 +#>65 string PNTG (MacPaint picture)
  8025 +#>65 string PREF (preferences)
  8026 +#>65 string PROJ (Think C project)
  8027 +#>65 string QPRJ (Think Pascal project)
  8028 +#>65 string SCFL (Defender scores)
  8029 +#>65 string SCRN (startup screen)
  8030 +#>65 string SITD (StuffIt Deluxe)
  8031 +#>65 string SPn3 (SuperPaint)
  8032 +#>65 string STAK (HyperCard stack)
  8033 +#>65 string Seg\ (StuffIt segment)
  8034 +#>65 string TARF (Unix tar archive)
  8035 +#>65 string TEXT (ASCII)
  8036 +#>65 string TIFF (TIFF image)
  8037 +#>65 string TOVF (Eudora table of contents)
  8038 +#>65 string WDBN (Microsoft Word word processor)
  8039 +#>65 string WORD (MacWrite word processor)
  8040 +#>65 string XLS\ (Microsoft Excel)
  8041 +#>65 string ZIVM (compress (.Z))
  8042 +#>65 string ZSYS (Pre-System 7 system file)
  8043 +#>65 string acf3 (Aldus FreeHand)
  8044 +#>65 string cdev (control panel)
  8045 +#>65 string dfil (Desk Acessory suitcase)
  8046 +#>65 string libr (library)
  8047 +#>65 string nX^d (WriteNow word processor)
  8048 +#>65 string nX^w (WriteNow dictionary)
  8049 +#>65 string rsrc (resource)
  8050 +#>65 string scbk (Scrapbook)
  8051 +#>65 string shlb (shared library)
  8052 +#>65 string ttro (SimpleText read-only)
  8053 +#>65 string zsys (system file)
  8054 +
  8055 +#>69 string x \b, creator "%4.4s"
  8056 +
  8057 +# Somewhere, Apple has a repository of registered Creator IDs. These are
  8058 +# just the ones that I happened to have files from and was able to identify.
  8059 +
  8060 +#>69 string 8BIM (Adobe Photoshop)
  8061 +#>69 string ALD3 (PageMaker 3)
  8062 +#>69 string ALD4 (PageMaker 4)
  8063 +#>69 string ALFA (Alpha editor)
  8064 +#>69 string APLS (Apple Scanner)
  8065 +#>69 string APSC (Apple Scanner)
  8066 +#>69 string BRKL (Brickles)
  8067 +#>69 string BTFT (BitFont)
  8068 +#>69 string CCL2 (Common Lisp 2)
  8069 +#>69 string CCL\ (Common Lisp)
  8070 +#>69 string CDmo (The Talking Moose)
  8071 +#>69 string CPCT (Compact Pro)
  8072 +#>69 string CSOm (Eudora)
  8073 +#>69 string DMOV (Font/DA Mover)
  8074 +#>69 string DSIM (DigSim)
  8075 +#>69 string EDIT (Macintosh Edit)
  8076 +#>69 string ERIK (Macintosh Finder)
  8077 +#>69 string EXTR (self-extracting archive)
  8078 +#>69 string Gzip (GNU gzip)
  8079 +#>69 string KAHL (Think C)
  8080 +#>69 string LWFU (LaserWriter Utility)
  8081 +#>69 string LZIV (compress)
  8082 +#>69 string MACA (MacWrite)
  8083 +#>69 string MACS (Macintosh operating system)
  8084 +#>69 string MAcK (MacKnowledge terminal emulator)
  8085 +#>69 string MLND (Defender)
  8086 +#>69 string MPNT (MacPaint)
  8087 +#>69 string MSBB (Microsoft BASIC (binary))
  8088 +#>69 string MSWD (Microsoft Word)
  8089 +#>69 string NCSA (NCSA Telnet)
  8090 +#>69 string PJMM (Think Pascal)
  8091 +#>69 string PSAL (Hunt the Wumpus)
  8092 +#>69 string PSI2 (Apple File Exchange)
  8093 +#>69 string R*ch (BBEdit)
  8094 +#>69 string RMKR (Resource Maker)
  8095 +#>69 string RSED (Resource Editor)
  8096 +#>69 string Rich (BBEdit)
  8097 +#>69 string SIT! (StuffIt)
  8098 +#>69 string SPNT (SuperPaint)
  8099 +#>69 string Unix (NeXT Mac filesystem)
  8100 +#>69 string VIM! (Vim editor)
  8101 +#>69 string WILD (HyperCard)
  8102 +#>69 string XCEL (Microsoft Excel)
  8103 +#>69 string aCa2 (Fontographer)
  8104 +#>69 string aca3 (Aldus FreeHand)
  8105 +#>69 string dosa (Macintosh MS-DOS file system)
  8106 +#>69 string movr (Font/DA Mover)
  8107 +#>69 string nX^n (WriteNow)
  8108 +#>69 string pdos (Apple ProDOS file system)
  8109 +#>69 string scbk (Scrapbook)
  8110 +#>69 string ttxt (SimpleText)
  8111 +#>69 string ufox (Foreign File Access)
  8112 +
  8113 +# Just in case...
  8114 +
  8115 +102 string mBIN MacBinary III data with surprising version number
  8116 +
  8117 +# sas magic from Bruce Foster (bef@nwu.edu)
  8118 +#
  8119 +#0 string SAS SAS
  8120 +#>8 string x %s
  8121 +0 string SAS SAS
  8122 +>24 string DATA data file
  8123 +>24 string CATALOG catalog
  8124 +>24 string INDEX data file index
  8125 +>24 string VIEW data view
  8126 +# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
  8127 +#
  8128 +0x54 string SAS SAS 7+
  8129 +>0x9C string DATA data file
  8130 +>0x9C string CATALOG catalog
  8131 +>0x9C string INDEX data file index
  8132 +>0x9C string VIEW data view
  8133 +
  8134 +# spss magic for SPSS system and portable files,
  8135 +# from Bruce Foster (bef@nwu.edu).
  8136 +
  8137 +0 long 0xc1e2c3c9 SPSS Portable File
  8138 +>40 string x %s
  8139 +
  8140 +0 string $FL2 SPSS System File
  8141 +>24 string x %s
  8142 +
  8143 +# Macintosh filesystem data
  8144 +# From "Tom N Harris" <telliamed@mac.com>
  8145 +# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
  8146 +# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
  8147 +# entries depend on the data arithmetic added after v.35
  8148 +# There's also some Pascal strings in here, ditto...
  8149 +
  8150 +# The boot block signature, according to IM:Files, is
  8151 +# "for HFS volumes, this field always contains the value 0x4C4B."
  8152 +# But if this is true for MFS or HFS+ volumes, I don't know.
  8153 +# Alternatively, the boot block is supposed to be zeroed if it's
  8154 +# unused, so a simply >0 should suffice.
  8155 +
  8156 +0x400 beshort 0xD2D7 Macintosh MFS data
  8157 +>0 beshort 0x4C4B (bootable)
  8158 +>0x40a beshort &0x8000 (locked)
  8159 +>0x402 beldate-0x7C25B080 x created: %s,
  8160 +>0x406 beldate-0x7C25B080 >0 last backup: %s,
  8161 +>0x414 belong x block size: %d,
  8162 +>0x412 beshort x number of blocks: %d,
  8163 +>0x424 pstring x volume name: %s
  8164 +
  8165 +# "BD" is has many false positives
  8166 +#0x400 beshort 0x4244 Macintosh HFS data
  8167 +#>0 beshort 0x4C4B (bootable)
  8168 +#>0x40a beshort &0x8000 (locked)
  8169 +#>0x40a beshort ^0x0100 (mounted)
  8170 +#>0x40a beshort &0x0200 (spared blocks)
  8171 +#>0x40a beshort &0x0800 (unclean)
  8172 +#>0x47C beshort 0x482B (Embedded HFS+ Volume)
  8173 +#>0x402 beldate-0x7C25B080 x created: %s,
  8174 +#>0x406 beldate-0x7C25B080 x last modified: %s,
  8175 +#>0x440 beldate-0x7C25B080 >0 last backup: %s,
  8176 +#>0x414 belong x block size: %d,
  8177 +#>0x412 beshort x number of blocks: %d,
  8178 +#>0x424 pstring x volume name: %s
  8179 +
  8180 +0x400 beshort 0x482B Macintosh HFS Extended
  8181 +>&0 beshort x version %d data
  8182 +>0 beshort 0x4C4B (bootable)
  8183 +>0x404 belong ^0x00000100 (mounted)
  8184 +>&2 belong &0x00000200 (spared blocks)
  8185 +>&2 belong &0x00000800 (unclean)
  8186 +>&2 belong &0x00008000 (locked)
  8187 +>&6 string x last mounted by: '%.4s',
  8188 +# really, that should be treated as a belong and we print a string
  8189 +# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
  8190 +>&14 beldate-0x7C25B080 x created: %s,
  8191 +# only the creation date is local time, all other timestamps in HFS+ are UTC.
  8192 +>&18 bedate-0x7C25B080 x last modified: %s,
  8193 +>&22 bedate-0x7C25B080 >0 last backup: %s,
  8194 +>&26 bedate-0x7C25B080 >0 last checked: %s,
  8195 +>&38 belong x block size: %d,
  8196 +>&42 belong x number of blocks: %d,
  8197 +>&46 belong x free blocks: %d
  8198 +
  8199 +# I don't think this is really necessary since it doesn't do much and
  8200 +# anything with a valid driver descriptor will also have a valid
  8201 +# partition map
  8202 +#0 beshort 0x4552 Apple Device Driver data
  8203 +#>&24 beshort =1 \b, MacOS
  8204 +
  8205 +# Is that the partition type a cstring or a pstring? Well, IM says "strings
  8206 +# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
  8207 +# cstring. Of course, partitions can contain more than four entries, but
  8208 +# what're you gonna do?
  8209 +0x200 beshort 0x504D Apple Partition data
  8210 +>0x2 beshort x block size: %d,
  8211 +>0x230 string x first type: %s,
  8212 +>0x210 string x name: %s,
  8213 +>0x254 belong x number of blocks: %d,
  8214 +>0x400 beshort 0x504D
  8215 +>>0x430 string x second type: %s,
  8216 +>>0x410 string x name: %s,
  8217 +>>0x454 belong x number of blocks: %d,
  8218 +>>0x800 beshort 0x504D
  8219 +>>>0x830 string x third type: %s,
  8220 +>>>0x810 string x name: %s,
  8221 +>>>0x854 belong x number of blocks: %d,
  8222 +>>>0xa00 beshort 0x504D
  8223 +>>>>0xa30 string x fourth type: %s,
  8224 +>>>>0xa10 string x name: %s,
  8225 +>>>>0xa54 belong x number of blocks: %d
  8226 +# AFAIK, only the signature is different
  8227 +0x200 beshort 0x5453 Apple Old Partition data
  8228 +>0x2 beshort x block size: %d,
  8229 +>0x230 string x first type: %s,
  8230 +>0x210 string x name: %s,
  8231 +>0x254 belong x number of blocks: %d,
  8232 +>0x400 beshort 0x504D
  8233 +>>0x430 string x second type: %s,
  8234 +>>0x410 string x name: %s,
  8235 +>>0x454 belong x number of blocks: %d,
  8236 +>>0x800 beshort 0x504D
  8237 +>>>0x830 string x third type: %s,
  8238 +>>>0x810 string x name: %s,
  8239 +>>>0x854 belong x number of blocks: %d,
  8240 +>>>0xa00 beshort 0x504D
  8241 +>>>>0xa30 string x fourth type: %s,
  8242 +>>>>0xa10 string x name: %s,
  8243 +>>>>0xa54 belong x number of blocks: %d
  8244 +
  8245 +# From: Remi Mommsen <mommsen@slac.stanford.edu>
  8246 +0 string BOMStore Mac OS X bill of materials (BOM) fil
  8247 +
  8248 +#------------------------------------------------------------------------------
  8249 +# magic: file(1) magic for magic files
  8250 +#
  8251 +0 string #\ Magic magic text file for file(1) cmd
  8252 +0 lelong 0xF11E041C magic binary file for file(1) cmd
  8253 +>4 lelong x (version %d) (little endian)
  8254 +0 belong 0xF11E041C magic binary file for file(1) cmd
  8255 +>4 belong x (version %d) (big endian)
  8256 +
  8257 +#------------------------------------------------------------------------------
  8258 +# mail.news: file(1) magic for mail and news
  8259 +#
  8260 +# Unfortunately, saved netnews also has From line added in some news software.
  8261 +#0 string From mail text
  8262 +# There are tests to ascmagic.c to cope with mail and news.
  8263 +0 string Relay-Version: old news text
  8264 +0 string #!\ rnews batched news text
  8265 +0 string N#!\ rnews mailed, batched news text
  8266 +0 string Forward\ to mail forwarding text
  8267 +0 string Pipe\ to mail piping text
  8268 +0 string Return-Path: smtp mail text
  8269 +0 string Path: news text
  8270 +0 string Xref: news text
  8271 +0 string From: news or mail text
  8272 +0 string Article saved news text
  8273 +0 string BABYL Emacs RMAIL text
  8274 +0 string Received: RFC 822 mail text
  8275 +0 string MIME-Version: MIME entity text
  8276 +#0 string Content- MIME entity text
  8277 +
  8278 +# TNEF files...
  8279 +0 lelong 0x223E9F78 Transport Neutral Encapsulation Format
  8280 +
  8281 +# From: Kevin Sullivan <ksulliva@psc.edu>
  8282 +0 string *mbx* MBX mail folder
  8283 +
  8284 +# From: Simon Matter <simon.matter@invoca.ch>
  8285 +0 string \241\002\213\015skiplist\ file\0\0\0 Cyrus skiplist DB
  8286 +
  8287 +# JAM(mbp) Fidonet message area databases
  8288 +# JHR file
  8289 +0 string JAM\0 JAM message area header file
  8290 +>12 leshort >0 (%d messages)
  8291 +
  8292 +# Squish Fidonet message area databases
  8293 +# SQD file (requires at least one message in the area)
  8294 +# XXX: Weak magic
  8295 +#256 leshort 0xAFAE4453 Squish message area data file
  8296 +#>4 leshort >0 (%d messages)
  8297 +
  8298 +#------------------------------------------------------------------------------
  8299 +# maple: file(1) magic for maple files
  8300 +# "H. Nanosecond" <aldomel@ix.netcom.com>
  8301 +# Maple V release 4, a multi-purpose math program
  8302 +#
  8303 +
  8304 +# maple library .lib
  8305 +0 string \000MVR4\nI MapleVr4 library
  8306 +
  8307 +# .ind
  8308 +# no magic for these :-(
  8309 +# they are compiled indexes for maple files
  8310 +
  8311 +# .hdb
  8312 +0 string \000\004\000\000 Maple help database
  8313 +
  8314 +# .mhp
  8315 +# this has the form <PACKAGE=name>
  8316 +0 string \<PACKAGE= Maple help file
  8317 +0 string \<HELP\ NAME= Maple help file
  8318 +0 string \n\<HELP\ NAME= Maple help file with extra carriage return at start (yuck)
  8319 +#0 string #\ Newton Maple help file, old style
  8320 +0 string #\ daub Maple help file, old style
  8321 +#0 string #=========== Maple help file, old style
  8322 +
  8323 +# .mws
  8324 +0 string \000\000\001\044\000\221 Maple worksheet
  8325 +#this is anomalous
  8326 +0 string WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000 Maple worksheet, but weird
  8327 +# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
  8328 +# that is {VERSION major_version miunor_version computer_type version_string}
  8329 +0 string {VERSION\ Maple worksheet
  8330 +>9 string >\0 version %.1s.
  8331 +>>>11 string >\0 %.1s
  8332 +
  8333 +# .mps
  8334 +0 string \0\0\001$ Maple something
  8335 +# from byte 4 it is either 'nul E' or 'soh R'
  8336 +# I think 'nul E' means a file that was saved as a different name
  8337 +# a sort of revision marking
  8338 +# 'soh R' means new
  8339 +>4 string \000\105 An old revision
  8340 +>4 string \001\122 The latest save
  8341 +
  8342 +# .mpl
  8343 +# some of these are the same as .mps above
  8344 +#0000000 000 000 001 044 000 105 same as .mps
  8345 +#0000000 000 000 001 044 001 122 same as .mps
  8346 +
  8347 +0 string #\n##\ <SHAREFILE= Maple something
  8348 +0 string \n#\n##\ <SHAREFILE= Maple something
  8349 +0 string ##\ <SHAREFILE= Maple something
  8350 +0 string #\r##\ <SHAREFILE= Maple something
  8351 +0 string \r#\r##\ <SHAREFILE= Maple something
  8352 +0 string #\ \r##\ <DESCRIBE> Maple something anomalous.
  8353 +
  8354 +#------------------------------------------------------------------------------
  8355 +# mathematica: file(1) magic for mathematica files
  8356 +# "H. Nanosecond" <aldomel@ix.netcom.com>
  8357 +# Mathematica a multi-purpose math program
  8358 +# versions 2.2 and 3.0
  8359 +
  8360 +#mathematica .mb
  8361 +0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook
  8362 +0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook
  8363 +
  8364 +# .ma
  8365 +# multiple possibilites:
  8366 +
  8367 +0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
  8368 +#>41 string >\0 %s
  8369 +
  8370 +#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x
  8371 +
  8372 +#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x
  8373 +#>675 string >\0 %s #doesn't work well
  8374 +
  8375 +# there may be 'cr' instread of 'nl' in some does this matter?
  8376 +
  8377 +# generic:
  8378 +0 string (*^\r\r::[\011 Mathematica notebook version 2.x
  8379 +0 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x
  8380 +0 string (*^\015 Mathematica notebook version 2.x
  8381 +0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x
  8382 +0 string (*^\r::[\011 Mathematica notebook version 2.x
  8383 +0 string (*^\r\n::[\011 Mathematica notebook version 2.x
  8384 +0 string (*^\n\n::[\011 Mathematica notebook version 2.x
  8385 +0 string (*^\n::[\011 Mathematica notebook version 2.x
  8386 +
  8387 +
  8388 +# Mathematica .mx files
  8389 +
  8390 +#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
  8391 +0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
  8392 +#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
  8393 +# >71... is optional
  8394 +>88 string >\0 from %s
  8395 +
  8396 +
  8397 +# Mathematica files PBF:
  8398 +# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
  8399 +0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
  8400 +
  8401 +# .ml files These are menu resources I think
  8402 +# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
  8403 +# how to put that into a magic rule?
  8404 +4 string \ A~ MAthematica .ml file
  8405 +
  8406 +# .nb files
  8407 +#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook
  8408 +0 string (*********************** Mathematica 3.0 notebook
  8409 +
  8410 +# other (* matches it is a comment start in these langs
  8411 +0 string (* Mathematica, or Pascal, Modula-2 or 3 code text
  8412 +
  8413 +#########################
  8414 +# MatLab v5
  8415 +0 string MATLAB Matlab v5 mat-file
  8416 +>126 short 0x494d (big endian)
  8417 +>>124 beshort x version 0x%04x
  8418 +>126 short 0x4d49 (little endian)
  8419 +>>124 leshort x version 0x%04x
  8420 +
  8421 +
  8422 +#------------------------------------------------------------------------------
  8423 +# matroska: file(1) magic for Matroska files
  8424 +#
  8425 +# See http://www.matroska.org/
  8426 +#
  8427 +
  8428 +# EBML id:
  8429 +0 belong 0x1a45dfa3
  8430 +# DocType id:
  8431 +>5 beshort 0x4282
  8432 +# DocType contents:
  8433 +>>8 string matroska Matroska data
  8434 +
  8435 +#------------------------------------------------------------------------------
  8436 +# Mavroyanopoulos Nikos <nmav@hellug.gr>
  8437 +# mcrypt: file(1) magic for mcrypt 2.2.x;
  8438 +0 string \0m\3 mcrypt 2.5 encrypted data,
  8439 +>4 string >\0 algorithm: %s,
  8440 +>>&1 leshort >0 keysize: %d bytes,
  8441 +>>>&0 string >\0 mode: %s,
  8442 +
  8443 +0 string \0m\2 mcrypt 2.2 encrypted data,
  8444 +>3 byte 0 algorithm: blowfish-448,
  8445 +>3 byte 1 algorithm: DES,
  8446 +>3 byte 2 algorithm: 3DES,
  8447 +>3 byte 3 algorithm: 3-WAY,
  8448 +>3 byte 4 algorithm: GOST,
  8449 +>3 byte 6 algorithm: SAFER-SK64,
  8450 +>3 byte 7 algorithm: SAFER-SK128,
  8451 +>3 byte 8 algorithm: CAST-128,
  8452 +>3 byte 9 algorithm: xTEA,
  8453 +>3 byte 10 algorithm: TWOFISH-128,
  8454 +>3 byte 11 algorithm: RC2,
  8455 +>3 byte 12 algorithm: TWOFISH-192,
  8456 +>3 byte 13 algorithm: TWOFISH-256,
  8457 +>3 byte 14 algorithm: blowfish-128,
  8458 +>3 byte 15 algorithm: blowfish-192,
  8459 +>3 byte 16 algorithm: blowfish-256,
  8460 +>3 byte 100 algorithm: RC6,
  8461 +>3 byte 101 algorithm: IDEA,
  8462 +>4 byte 0 mode: CBC,
  8463 +>4 byte 1 mode: ECB,
  8464 +>4 byte 2 mode: CFB,
  8465 +>4 byte 3 mode: OFB,
  8466 +>4 byte 4 mode: nOFB,
  8467 +>5 byte 0 keymode: 8bit
  8468 +>5 byte 1 keymode: 4bit
  8469 +>5 byte 2 keymode: SHA-1 hash
  8470 +>5 byte 3 keymode: MD5 hash
  8471 +#------------------------------------------------------------------------------
  8472 +# mime: file(1) magic for MIME encoded files
  8473 +#
  8474 +0 string Content-Type:\
  8475 +>14 string >\0 %s
  8476 +0 string Content-Type:
  8477 +>13 string >\0 %s
  8478 +
  8479 +#------------------------------------------------------------------------------
  8480 +# mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
  8481 +# Dec Ultrix (MIPS)
  8482 +# all of SGI's *current* machines and OSes run in big-endian mode on the
  8483 +# MIPS machines, as far as I know.
  8484 +#
  8485 +# XXX - what is the blank "-" line?
  8486 +#
  8487 +# kbd file definitions
  8488 +0 string kbd!map kbd map file
  8489 +>8 byte >0 Ver %d:
  8490 +>10 short >0 with %d table(s)
  8491 +0 belong 0407 old SGI 68020 executable
  8492 +0 belong 0410 old SGI 68020 pure executable
  8493 +0 beshort 0x8765 disk quotas file
  8494 +0 beshort 0x0506 IRIS Showcase file
  8495 +>2 byte 0x49 -
  8496 +>3 byte x - version %ld
  8497 +0 beshort 0x0226 IRIS Showcase template
  8498 +>2 byte 0x63 -
  8499 +>3 byte x - version %ld
  8500 +0 belong 0x5343464d IRIS Showcase file
  8501 +>4 byte x - version %ld
  8502 +0 belong 0x5443464d IRIS Showcase template
  8503 +>4 byte x - version %ld
  8504 +0 belong 0xdeadbabe IRIX Parallel Arena
  8505 +>8 belong >0 - version %ld
  8506 +#
  8507 +0 beshort 0x0160 MIPSEB ECOFF executable
  8508 +>20 beshort 0407 (impure)
  8509 +>20 beshort 0410 (swapped)
  8510 +>20 beshort 0413 (paged)
  8511 +>8 belong >0 not stripped
  8512 +>8 belong 0 stripped
  8513 +>22 byte x - version %ld
  8514 +>23 byte x .%ld
  8515 +#
  8516 +0 beshort 0x0162 MIPSEL-BE ECOFF executable
  8517 +>20 beshort 0407 (impure)
  8518 +>20 beshort 0410 (swapped)
  8519 +>20 beshort 0413 (paged)
  8520 +>8 belong >0 not stripped
  8521 +>8 belong 0 stripped
  8522 +>23 byte x - version %d
  8523 +>22 byte x .%ld
  8524 +#
  8525 +0 beshort 0x6001 MIPSEB-LE ECOFF executable
  8526 +>20 beshort 03401 (impure)
  8527 +>20 beshort 04001 (swapped)
  8528 +>20 beshort 05401 (paged)
  8529 +>8 belong >0 not stripped
  8530 +>8 belong 0 stripped
  8531 +>23 byte x - version %d
  8532 +>22 byte x .%ld
  8533 +#
  8534 +0 beshort 0x6201 MIPSEL ECOFF executable
  8535 +>20 beshort 03401 (impure)
  8536 +>20 beshort 04001 (swapped)
  8537 +>20 beshort 05401 (paged)
  8538 +>8 belong >0 not stripped
  8539 +>8 belong 0 stripped
  8540 +>23 byte x - version %ld
  8541 +>22 byte x .%ld
  8542 +#
  8543 +# MIPS 2 additions
  8544 +#
  8545 +0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable
  8546 +>20 beshort 0407 (impure)
  8547 +>20 beshort 0410 (swapped)
  8548 +>20 beshort 0413 (paged)
  8549 +>8 belong >0 not stripped
  8550 +>8 belong 0 stripped
  8551 +>22 byte x - version %ld
  8552 +>23 byte x .%ld
  8553 +#
  8554 +0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable
  8555 +>20 beshort 0407 (impure)
  8556 +>20 beshort 0410 (swapped)
  8557 +>20 beshort 0413 (paged)
  8558 +>8 belong >0 not stripped
  8559 +>8 belong 0 stripped
  8560 +>22 byte x - version %ld
  8561 +>23 byte x .%ld
  8562 +#
  8563 +0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable
  8564 +>20 beshort 03401 (impure)
  8565 +>20 beshort 04001 (swapped)
  8566 +>20 beshort 05401 (paged)
  8567 +>8 belong >0 not stripped
  8568 +>8 belong 0 stripped
  8569 +>23 byte x - version %ld
  8570 +>22 byte x .%ld
  8571 +#
  8572 +0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable
  8573 +>20 beshort 03401 (impure)
  8574 +>20 beshort 04001 (swapped)
  8575 +>20 beshort 05401 (paged)
  8576 +>8 belong >0 not stripped
  8577 +>8 belong 0 stripped
  8578 +>23 byte x - version %ld
  8579 +>22 byte x .%ld
  8580 +#
  8581 +# MIPS 3 additions
  8582 +#
  8583 +0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable
  8584 +>20 beshort 0407 (impure)
  8585 +>20 beshort 0410 (swapped)
  8586 +>20 beshort 0413 (paged)
  8587 +>8 belong >0 not stripped
  8588 +>8 belong 0 stripped
  8589 +>22 byte x - version %ld
  8590 +>23 byte x .%ld
  8591 +#
  8592 +0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable
  8593 +>20 beshort 0407 (impure)
  8594 +>20 beshort 0410 (swapped)
  8595 +>20 beshort 0413 (paged)
  8596 +>8 belong >0 not stripped
  8597 +>8 belong 0 stripped
  8598 +>22 byte x - version %ld
  8599 +>23 byte x .%ld
  8600 +#
  8601 +0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable
  8602 +>20 beshort 03401 (impure)
  8603 +>20 beshort 04001 (swapped)
  8604 +>20 beshort 05401 (paged)
  8605 +>8 belong >0 not stripped
  8606 +>8 belong 0 stripped
  8607 +>23 byte x - version %ld
  8608 +>22 byte x .%ld
  8609 +#
  8610 +0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable
  8611 +>20 beshort 03401 (impure)
  8612 +>20 beshort 04001 (swapped)
  8613 +>20 beshort 05401 (paged)
  8614 +>8 belong >0 not stripped
  8615 +>8 belong 0 stripped
  8616 +>23 byte x - version %ld
  8617 +>22 byte x .%ld
  8618 +#
  8619 +0 beshort 0x180 MIPSEB Ucode
  8620 +0 beshort 0x182 MIPSEL-BE Ucode
  8621 +# 32bit core file
  8622 +0 belong 0xdeadadb0 IRIX core dump
  8623 +>4 belong 1 of
  8624 +>16 string >\0 '%s'
  8625 +# 64bit core file
  8626 +0 belong 0xdeadad40 IRIX 64-bit core dump
  8627 +>4 belong 1 of
  8628 +>16 string >\0 '%s'
  8629 +# N32bit core file
  8630 +0 belong 0xbabec0bb IRIX N32 core dump
  8631 +>4 belong 1 of
  8632 +>16 string >\0 '%s'
  8633 +# New style crash dump file
  8634 +0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
  8635 +>36 string >\0 '%s'
  8636 +# Trusted IRIX info
  8637 +0 string SGIAUDIT SGI Audit file
  8638 +>8 byte x - version %d
  8639 +>9 byte x .%ld
  8640 +#
  8641 +0 string WNGZWZSC Wingz compiled script
  8642 +0 string WNGZWZSS Wingz spreadsheet
  8643 +0 string WNGZWZHP Wingz help file
  8644 +#
  8645 +0 string #Inventor V IRIS Inventor 1.0 file
  8646 +0 string #Inventor V2 Open Inventor 2.0 file
  8647 +# GLF is OpenGL stream encoding
  8648 +0 string glfHeadMagic(); GLF_TEXT
  8649 +4 belong 0x7d000000 GLF_BINARY_LSB_FIRST
  8650 +4 belong 0x0000007d GLF_BINARY_MSB_FIRST
  8651 +# GLS is OpenGL stream encoding; GLS is the successor of GLF
  8652 +0 string glsBeginGLS( GLS_TEXT
  8653 +4 belong 0x10000000 GLS_BINARY_LSB_FIRST
  8654 +4 belong 0x00000010 GLS_BINARY_MSB_FIRST
  8655 +
  8656 +#------------------------------------------------------------------------------
  8657 +# mirage: file(1) magic for Mirage executables
  8658 +#
  8659 +# XXX - byte order?
  8660 +#
  8661 +0 long 31415 Mirage Assembler m.out executable
  8662 +#-----------------------------------------------------------------------------
  8663 +# misctools: file(1) magic for miscelanous UNIX tools.
  8664 +#
  8665 +0 string %%!! X-Post-It-Note text
  8666 +0 string/c BEGIN:VCALENDAR vCalendar calendar file
  8667 +0 string/c BEGIN:VCARD vCard visiting card
  8668 +
  8669 +# From: Alex Beregszaszi <alex@fsn.hu>
  8670 +4 string gtktalog GNOME Catalogue (gtktalog)
  8671 +>13 string >\0 version %s
  8672 +
  8673 +# From: Tomasz Trojanowski <tomek@uninet.com.pl>
  8674 +0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file
  8675 +
  8676 +#------------------------------------------------------------------------------
  8677 +# mkid: file(1) magic for mkid(1) databases
  8678 +#
  8679 +# ID is the binary tags database produced by mkid(1).
  8680 +#
  8681 +# XXX - byte order?
  8682 +#
  8683 +0 string \311\304 ID tags data
  8684 +>2 short >0 version %d
  8685 +
  8686 +#------------------------------------------------------------------------------
  8687 +# mlssa: file(1) magic for MLSSA datafiles
  8688 +#
  8689 +0 lelong 0xffffabcd MLSSA datafile,
  8690 +>4 leshort x algorithm %d,
  8691 +>10 lelong x %d samples
  8692 +
  8693 +#------------------------------------------------------------------------------
  8694 +# mmdf: file(1) magic for MMDF mail files
  8695 +#
  8696 +0 string \001\001\001\001 MMDF mailbox
  8697 +#------------------------------------------------------------------------------
  8698 +# modem: file(1) magic for modem programs
  8699 +#
  8700 +# From: Florian La Roche <florian@knorke.saar.de>
  8701 +4 string Research, Digifax-G3-File
  8702 +>29 byte 1 , fine resolution
  8703 +>29 byte 0 , normal resolution
  8704 +
  8705 +0 short 0x0100 raw G3 data, byte-padded
  8706 +0 short 0x1400 raw G3 data
  8707 +#
  8708 +# Magic data for vgetty voice formats
  8709 +# (Martin Seine & Marc Eberhard)
  8710 +
  8711 +#
  8712 +# raw modem data version 1
  8713 +#
  8714 +0 string RMD1 raw modem data
  8715 +>4 string >\0 (%s /
  8716 +>20 short >0 compression type 0x%04x)
  8717 +
  8718 +#
  8719 +# portable voice format 1
  8720 +#
  8721 +0 string PVF1\n portable voice format
  8722 +>5 string >\0 (binary %s)
  8723 +
  8724 +#
  8725 +# portable voice format 2
  8726 +#
  8727 +0 string PVF2\n portable voice format
  8728 +>5 string >\0 (ascii %s)
  8729 +
  8730 +
  8731 +#------------------------------------------------------------------------------
  8732 +# motorola: file(1) magic for Motorola 68K and 88K binaries
  8733 +#
  8734 +# 68K
  8735 +#
  8736 +0 beshort 0520 mc68k COFF
  8737 +>18 beshort ^00000020 object
  8738 +>18 beshort &00000020 executable
  8739 +>12 belong >0 not stripped
  8740 +>168 string .lowmem Apple toolbox
  8741 +>20 beshort 0407 (impure)
  8742 +>20 beshort 0410 (pure)
  8743 +>20 beshort 0413 (demand paged)
  8744 +>20 beshort 0421 (standalone)
  8745 +0 beshort 0521 mc68k executable (shared)
  8746 +>12 belong >0 not stripped
  8747 +0 beshort 0522 mc68k executable (shared demand paged)
  8748 +>12 belong >0 not stripped
  8749 +#
  8750 +# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
  8751 +#
  8752 +0 beshort 0554 68K BCS executable
  8753 +#
  8754 +# 88K
  8755 +#
  8756 +# Motorola/88Open BCS
  8757 +#
  8758 +0 beshort 0555 88K BCS executable
  8759 +#
  8760 +# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
  8761 +0 string S0 Motorola S-Record; binary data in text format
  8762 +
  8763 +# ATARI ST relocatable PRG
  8764 +#
  8765 +# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
  8766 +# (according to Roland Waldi, Oct 21, 1987)
  8767 +# besides the magic 0x601a, the text segment size is checked to be
  8768 +# not larger than 1 MB (which is a lot on ST).
  8769 +# The additional 0x601b distinction I took from Doug Lee's magic.
  8770 +0 belong&0xFFFFFFF0 0x601A0000 Atari ST M68K contiguous executable
  8771 +>2 belong x (txt=%ld,
  8772 +>6 belong x dat=%ld,
  8773 +>10 belong x bss=%ld,
  8774 +>14 belong x sym=%ld)
  8775 +0 belong&0xFFFFFFF0 0x601B0000 Atari ST M68K non-contig executable
  8776 +>2 belong x (txt=%ld,
  8777 +>6 belong x dat=%ld,
  8778 +>10 belong x bss=%ld,
  8779 +>14 belong x sym=%ld)
  8780 +
  8781 +# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
  8782 +0 beshort 0x601A Atari 68xxx executable,
  8783 +>2 belong x text len %lu,
  8784 +>6 belong x data len %lu,
  8785 +>10 belong x BSS len %lu,
  8786 +>14 belong x symboltab len %lu,
  8787 +>18 belong 0
  8788 +>22 belong &0x01 fastload flag,
  8789 +>22 belong &0x02 may be loaded to alternate RAM,
  8790 +>22 belong &0x04 malloc may be from alternate RAM,
  8791 +>22 belong x flags: 0x%lX,
  8792 +>26 beshort 0 no relocation tab
  8793 +>26 beshort !0 + relocation tab
  8794 +>30 string SFX [Self-Extracting LZH SFX archive]
  8795 +>38 string SFX [Self-Extracting LZH SFX archive]
  8796 +>44 string ZIP! [Self-Extracting ZIP SFX archive]
  8797 +
  8798 +0 beshort 0x0064 Atari 68xxx CPX file
  8799 +>8 beshort x (version %04lx)
  8800 +
  8801 +#------------------------------------------------------------------------------
  8802 +# msdos: file(1) magic for MS-DOS files
  8803 +#
  8804 +
  8805 +# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
  8806 +# updated by Joerg Jenderek
  8807 +0 string @
  8808 +>1 string/cB \ echo\ off MS-DOS batch file text
  8809 +>1 string/cB echo\ off MS-DOS batch file text
  8810 +>1 string/cB rem\ MS-DOS batch file text
  8811 +>1 string/cB set\ MS-DOS batch file text
  8812 +
  8813 +
  8814 +# OS/2 batch files are REXX. the second regex is a bit generic, oh well
  8815 +# the matched commands seem to be common in REXX and uncommon elsewhere
  8816 +100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text
  8817 +100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text
  8818 +
  8819 +0 leshort 0x14c MS Windows COFF Intel 80386 object file
  8820 +#>4 ledate x stamp %s
  8821 +0 leshort 0x166 MS Windows COFF MIPS R4000 object file
  8822 +#>4 ledate x stamp %s
  8823 +0 leshort 0x184 MS Windows COFF Alpha object file
  8824 +#>4 ledate x stamp %s
  8825 +0 leshort 0x268 MS Windows COFF Motorola 68000 object file
  8826 +#>4 ledate x stamp %s
  8827 +0 leshort 0x1f0 MS Windows COFF PowerPC object file
  8828 +#>4 ledate x stamp %s
  8829 +0 leshort 0x290 MS Windows COFF PA-RISC object file
  8830 +#>4 ledate x stamp %s
  8831 +
  8832 +# XXX - according to Microsoft's spec, at an offset of 0x3c in a
  8833 +# PE-format executable is the offset in the file of the PE header;
  8834 +# unfortunately, that's a little-endian offset, and there's no way
  8835 +# to specify an indirect offset with a specified byte order.
  8836 +# So, for now, we assume the standard MS-DOS stub, which puts the
  8837 +# PE header at 0x80 = 128.
  8838 +#
  8839 +# Required OS version and subsystem version were 4.0 on some NT 3.51
  8840 +# executables built with Visual C++ 4.0, so it's not clear that
  8841 +# they're interesting. The user version was 0.0, but there's
  8842 +# probably some linker directive to set it. The linker version was
  8843 +# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
  8844 +#
  8845 +# many of the compressed formats were extraced from IDARC 1.23 source code
  8846 +#
  8847 +0 string MZ MS-DOS executable
  8848 +>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows
  8849 +>>&18 leshort&0x2000 >0 (DLL)
  8850 +>>&88 leshort 0 (unknown subsystem)
  8851 +>>&88 leshort 1 (native)
  8852 +>>&88 leshort 2 (GUI)
  8853 +>>&88 leshort 3 (console)
  8854 +>>&88 leshort 7 (POSIX)
  8855 +>>&0 leshort 0x0 unknown processor
  8856 +>>&0 leshort 0x14c Intel 80386
  8857 +>>&0 leshort 0x166 MIPS R4000
  8858 +>>&0 leshort 0x184 Alpha
  8859 +>>&0 leshort 0x268 Motorola 68000
  8860 +>>&0 leshort 0x1f0 PowerPC
  8861 +>>&0 leshort 0x290 PA-RISC
  8862 +>>&18 leshort&0x0100 >0 32-bit
  8863 +>>&18 leshort&0x1000 >0 system file
  8864 +>>&0xf4 search/0x140 \x0\x40\x1\x0
  8865 +>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
  8866 +
  8867 +>0x18 leshort >0x3f
  8868 +>>(0x3c.l) string PE\0\0 PE
  8869 +# hooray, there's a DOS extender using the PE format, with a valid PE
  8870 +# executable inside (which just prints a message and exits if run in win)
  8871 +>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender
  8872 +>>>(8.s*16) string !32STUB for MS Windows
  8873 +>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
  8874 +>>>>(0x3c.l+92) leshort 0 (unknown subsystem)
  8875 +>>>>(0x3c.l+92) leshort 1 (native)
  8876 +>>>>(0x3c.l+92) leshort 2 (GUI)
  8877 +>>>>(0x3c.l+92) leshort 3 (console)
  8878 +>>>>(0x3c.l+92) leshort 7 (POSIX)
  8879 +>>>>(0x3c.l+4) leshort 0x0 unknown processor
  8880 +>>>>(0x3c.l+4) leshort 0x14c Intel 80386
  8881 +>>>>(0x3c.l+4) leshort 0x166 MIPS R4000
  8882 +>>>>(0x3c.l+4) leshort 0x184 Alpha
  8883 +>>>>(0x3c.l+4) leshort 0x268 Motorola 68000
  8884 +>>>>(0x3c.l+4) leshort 0x1f0 PowerPC
  8885 +>>>>(0x3c.l+4) leshort 0x290 PA-RISC
  8886 +>>>>(0x3c.l+22) leshort&0x0100 >0 32-bit
  8887 +>>>>(0x3c.l+22) leshort&0x1000 >0 system file
  8888 +>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly
  8889 +
  8890 +>>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
  8891 +>>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
  8892 +>>>>(0x3c.l+0xf8) search/0x140 UPX2
  8893 +>>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
  8894 +>>>>(0x3c.l+0xf8) search/0x140 .idata
  8895 +>>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
  8896 +>>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive
  8897 +>>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive
  8898 +>>>>(0x3c.l+0xf8) search/0x140 .rsrc
  8899 +>>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive
  8900 +>>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive
  8901 +>>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive
  8902 +>>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive
  8903 +>>>>(0x3c.l+0xf8) search/0x140 .data
  8904 +>>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive
  8905 +>>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed
  8906 +>>>>>(0x3c.l+0xf7) byte x
  8907 +>>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive
  8908 +>>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive
  8909 +>>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive
  8910 +>>>>(0x3c.l+0xf8) search/0x140 .reloc
  8911 +>>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip)
  8912 +
  8913 +>>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
  8914 +>>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
  8915 +>>>>0x30 string Inno \b, InnoSetup self-extracting archive
  8916 +
  8917 +>>(0x3c.l) string NE \b, NE
  8918 +>>>(0x3c.l+0x36) byte 0 (unknown OS)
  8919 +>>>(0x3c.l+0x36) byte 1 for OS/2 1.x
  8920 +>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x
  8921 +>>>(0x3c.l+0x36) byte 3 for MS-DOS
  8922 +>>>(0x3c.l+0x36) byte >3 (unknown OS)
  8923 +>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender
  8924 +>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL)
  8925 +>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver)
  8926 +>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive
  8927 +>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
  8928 +
  8929 +>>(0x3c.l) string LX\0\0 \b, LX
  8930 +>>>(0x3c.l+0x0a) leshort <1 (unknown OS)
  8931 +>>>(0x3c.l+0x0a) leshort 1 for OS/2
  8932 +>>>(0x3c.l+0x0a) leshort 2 for MS Windows
  8933 +>>>(0x3c.l+0x0a) leshort 3 for DOS
  8934 +>>>(0x3c.l+0x0a) leshort >3 (unknown OS)
  8935 +>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL)
  8936 +>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver)
  8937 +>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI)
  8938 +>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console)
  8939 +>>>(0x3c.l+0x08) leshort 1 i80286
  8940 +>>>(0x3c.l+0x08) leshort 2 i80386
  8941 +>>>(0x3c.l+0x08) leshort 3 i80486
  8942 +>>>(8.s*16) string emx \b, emx
  8943 +>>>>&1 string x %s
  8944 +>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive
  8945 +
  8946 +# MS Windows system file, supposedly a collection of LE executables
  8947 +>>(0x3c.l) string W3 \b, W3 for MS Windows
  8948 +
  8949 +>>(0x3c.l) string LE\0\0 \b, LE executable
  8950 +>>>(0x3c.l+0x0a) leshort 1
  8951 +# some DOS extenders use LE files with OS/2 header
  8952 +>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
  8953 +>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
  8954 +>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
  8955 +>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender
  8956 +>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
  8957 +>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
  8958 +>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
  8959 +# this is a wild guess; hopefully it is a specific signature
  8960 +>>>>&0x24 lelong <0x50
  8961 +>>>>>(&0x4c.l) string \xfc\xb8WATCOM
  8962 +>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed
  8963 +# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
  8964 +#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2
  8965 +# fails with DOS-Extenders.
  8966 +>>>(0x3c.l+0x0a) leshort 2 for MS Windows
  8967 +>>>(0x3c.l+0x0a) leshort 3 for DOS
  8968 +>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD)
  8969 +>>>(&0x7c.l+0x26) string UPX \b, UPX compressed
  8970 +>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
  8971 +
  8972 +# looks like ASCII, probably some embedded copyright message.
  8973 +# and definitely not NE/LE/LX/PE
  8974 +>>0x3c lelong >0x20000000
  8975 +>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
  8976 +# header data too small for extended executable
  8977 +>2 long !0
  8978 +>>0x18 leshort <0x40
  8979 +>>>(4.s*512) leshort !0x014c
  8980 +
  8981 +>>>>&(2.s-514) string !LE
  8982 +>>>>>&-2 string !BW \b, MZ for MS-DOS
  8983 +>>>>&(2.s-514) string LE \b, LE
  8984 +>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
  8985 +# educated guess since indirection is still not capable enough for complex offset
  8986 +# calculations (next embedded executable would be at &(&2*512+&0-2)
  8987 +# I suspect there are only LE executables in these multi-exe files
  8988 +>>>>&(2.s-514) string BW
  8989 +>>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded)
  8990 +>>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS
  8991 +
  8992 +# This sequence skips to the first COFF segment, usually .text
  8993 +>(4.s*512) leshort 0x014c \b, COFF
  8994 +>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender
  8995 +>>(8.s*16) string emx
  8996 +>>>&1 string x for DOS, Win or OS/2, emx %s
  8997 +>>&(&0x42.l-3) byte x
  8998 +>>>&0x26 string UPX \b, UPX compressed
  8999 +# and yet another guess: small .text, and after large .data is unusal, could be 32lite
  9000 +>>&0x2c search/0xa0 .text
  9001 +>>>&0x0b lelong <0x2000
  9002 +>>>>&0 lelong >0x6000 \b, 32lite compressed
  9003 +
  9004 +>(8.s*16) string $WdX \b, WDos/X DOS extender
  9005 +
  9006 +# .EXE formats (Greg Roelofs, newt@uchicago.edu)
  9007 +#
  9008 +>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
  9009 +>0xe7 string LH/2\ Self-Extract \b, %s
  9010 +>0x1c string diet \b, diet compressed
  9011 +>0x1c string LZ09 \b, LZEXE v0.90 compressed
  9012 +>0x1c string LZ91 \b, LZEXE v0.91 compressed
  9013 +>0x1c string tz \b, TinyProg compressed
  9014 +>0x1e string PKLITE \b, %s compressed
  9015 +>0x64 string W\ Collis\0\0 \b, Compack compressed
  9016 +>0x24 string LHa's\ SFX \b, LHa self-extracting archive
  9017 +>0x24 string LHA's\ SFX \b, LHa self-extracting archive
  9018 +>0x24 string \ $ARX \b, ARX self-extracting archive
  9019 +>0x24 string \ $LHarc \b, LHarc self-extracting archive
  9020 +>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
  9021 +>1638 string -lh5- \b, LHa self-extracting archive v2.13S
  9022 +>0x17888 string Rar! \b, RAR self-extracting archive
  9023 +>0x40 string aPKG \b, aPackage self-extracting archive
  9024 +
  9025 +>32 string AIN
  9026 +>>35 string 2 \b, AIN 2.x compressed
  9027 +>>35 string <2 \b, AIN 1.x compressed
  9028 +>>35 string >2 \b, AIN 1.x compressed
  9029 +>28 string UC2X \b, UCEXE compressed
  9030 +>28 string WWP\ \b, WWPACK compressed
  9031 +
  9032 +# skip to the end of the exe
  9033 +>(4.s*512) long x
  9034 +>>&(2.s-517) byte x
  9035 +>>>&0 string PK\3\4 \b, ZIP self-extracting archive
  9036 +>>>&0 string Rar! \b, RAR self-extracting archive
  9037 +>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive
  9038 +>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive
  9039 +>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive
  9040 +>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive
  9041 +>>>&7 search/400 **ACE** \b, ACE self-extracting archive
  9042 +>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive
  9043 +
  9044 +>0x1c string RJSX \b, ARJ self-extracting archive
  9045 +# winarj stores a message in the stub instead of the sig in the MZ header
  9046 +>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive
  9047 +
  9048 +# a few unknown ZIP sfxes, no idea if they are needed or if they are
  9049 +# already captured by the generic patterns above
  9050 +>122 string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive
  9051 +>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP)
  9052 +# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
  9053 +#
  9054 +
  9055 +# TELVOX Teleinformatica CODEC self-extractor for OS/2:
  9056 +>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
  9057 +>>49824 leshort =1 \b, 1 file
  9058 +>>49824 leshort >1 \b, %u files
  9059 +
  9060 +# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
  9061 +# Uncommenting only the first two lines will cover about 2/3 of COM files,
  9062 +# but it isn't feasible to match all COM files since there must be at least
  9063 +# two dozen different one-byte "magics".
  9064 +0 byte 0xe9 DOS executable (COM)
  9065 +>0x1FE leshort 0xAA55 \b, boot code
  9066 +>6 string SFX\ of\ LHarc (%s)
  9067 +0 belong 0xffffffff DOS executable (device driver)
  9068 +#CMD640X2.SYS
  9069 +>10 string >\x23
  9070 +>>10 string !\x2e
  9071 +>>>17 string <\x5B
  9072 +>>>>10 string x \b, name: %.8s
  9073 +#UDMA.SYS KEYB.SYS CMD640X2.SYS
  9074 +>10 string <\x41
  9075 +>>12 string >\x40
  9076 +>>>10 string !$
  9077 +>>>>12 string x \b, name: %.8s
  9078 +#BTCDROM.SYS ASPICD.SYS
  9079 +>22 string >\x40
  9080 +>>22 string <\x5B
  9081 +>>>23 string <\x5B
  9082 +>>>>22 string x \b, name: %.8s
  9083 +#ATAPICD.SYS
  9084 +>76 string \0
  9085 +>>77 string >\x40
  9086 +>>>77 string <\x5B
  9087 +>>>>77 string x \b, name: %.8s
  9088 +0 byte 0x8c DOS executable (COM)
  9089 +# 0xeb conflicts with "sequent" magic
  9090 +0 byte 0xeb DOS executable (COM)
  9091 +>0x1FE leshort 0xAA55 \b, boot code
  9092 +>85 string UPX \b, UPX compressed
  9093 +>4 string \ $ARX \b, ARX self-extracting archive
  9094 +>4 string \ $LHarc \b, LHarc self-extracting archive
  9095 +>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
  9096 +0 byte 0xb8 COM executable
  9097 +# modified by Joerg Jenderek
  9098 +>1 lelong !0x21cd4cff for DOS
  9099 +# http://syslinux.zytor.com/comboot.php
  9100 +# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
  9101 +# start with assembler instructions mov eax,21cd4cffh
  9102 +>1 lelong 0x21cd4cff (32-bit COMBOOT)
  9103 +0 string \x81\xfc
  9104 +>4 string \x77\x02\xcd\x20\xb9
  9105 +>>36 string UPX! FREE-DOS executable (COM), UPX compressed
  9106 +252 string Must\ have\ DOS\ version DR-DOS executable (COM)
  9107 +# GRR search is not working
  9108 +#2 search/28 \xcd\x21 COM executable for MS-DOS
  9109 +#WHICHFAT.cOM
  9110 +2 string \xcd\x21 COM executable for DOS
  9111 +#DELTREE.cOM DELTREE2.cOM
  9112 +4 string \xcd\x21 COM executable for DOS
  9113 +#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
  9114 +5 string \xcd\x21 COM executable for DOS
  9115 +#DELTMP.COm HASFAT32.cOM
  9116 +7 string \xcd\x21
  9117 +>0 byte !0xb8 COM executable for DOS
  9118 +#COMP.cOM MORE.COm
  9119 +10 string \xcd\x21
  9120 +>5 string !\xcd\x21 COM executable for DOS
  9121 +#comecho.com
  9122 +13 string \xcd\x21 COM executable for DOS
  9123 +#HELP.COm EDIT.coM
  9124 +18 string \xcd\x21 COM executable for MS-DOS
  9125 +#NWRPLTRM.COm
  9126 +23 string \xcd\x21 COM executable for MS-DOS
  9127 +#LOADFIX.cOm LOADFIX.cOm
  9128 +30 string \xcd\x21 COM executable for MS-DOS
  9129 +#syslinux.com 3.11
  9130 +70 string \xcd\x21 COM executable for DOS
  9131 +# many compressed/converted COMs start with a copy loop instead of a jump
  9132 +0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
  9133 +0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS
  9134 +>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed
  9135 +0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed
  9136 +# FIXME: missing diet .com compression
  9137 +
  9138 +# miscellaneous formats
  9139 +0 string LZ MS-DOS executable (built-in)
  9140 +#0 byte 0xf0 MS-DOS program library data
  9141 +#
  9142 +
  9143 +#
  9144 +# Windows Registry files.
  9145 +# updated by Joerg Jenderek
  9146 +0 string regf Windows NT/XP registry file
  9147 +0 string CREG Windows 95/98/ME registry file
  9148 +0 string SHCC3 Windows 3.1 registry file
  9149 +
  9150 +
  9151 +# AAF files:
  9152 +# <stuartc@rd.bbc.co.uk> Stuart Cunningham
  9153 +0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
  9154 +>30 byte 9 (512B sectors)
  9155 +>30 byte 12 (4kB sectors)
  9156 +0 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage
  9157 +>30 byte 9 (512B sectors)
  9158 +>30 byte 12 (4kB sectors)
  9159 +
  9160 +# Popular applications
  9161 +# False positive with PPT
  9162 +#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer
  9163 +2080 string Microsoft\ Word\ 6.0\ Document %s
  9164 +2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
  9165 +# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
  9166 +2112 string MSWordDoc Microsoft Word document data
  9167 +#
  9168 +0 belong 0x31be0000 Microsoft Word Document
  9169 +#
  9170 +0 string PO^Q` Microsoft Word 6.0 Document
  9171 +#
  9172 +0 string \376\067\0\043 Microsoft Office Document
  9173 +0 string \333\245-\0\0\0 Microsoft Office Document
  9174 +#
  9175 +2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
  9176 +2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
  9177 +#
  9178 +# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
  9179 +2114 string Biff5 Microsoft Excel 5.0 Worksheet
  9180 +# Italian MS-Excel
  9181 +2121 string Biff5 Microsoft Excel 5.0 Worksheet
  9182 +0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
  9183 +#
  9184 +0 belong 0x00001a00 Lotus 1-2-3
  9185 +>4 belong 0x00100400 wk3 document data
  9186 +>4 belong 0x02100400 wk4 document data
  9187 +>4 belong 0x07800100 fm3 or fmb document data
  9188 +>4 belong 0x07800000 fm3 or fmb document data
  9189 +#
  9190 +0 belong 0x00000200 Lotus 1-2-3
  9191 +>4 belong 0x06040600 wk1 document data
  9192 +>4 belong 0x06800200 fmt document data
  9193 +
  9194 +# Help files
  9195 +0 string ?_\3\0 MS Windows Help Data
  9196 +
  9197 +# DeIsL1.isu what this is I don't know
  9198 +0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is
  9199 +
  9200 +# Winamp .avs
  9201 +#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
  9202 +0 string Nullsoft\ AVS\ Preset\ Winamp plug in
  9203 +
  9204 +# Hyper terminal:
  9205 +0 string HyperTerminal\ hyperterm
  9206 +>15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal
  9207 +
  9208 +# Windows Metafont .WMF
  9209 +0 string \327\315\306\232 ms-windows metafont .wmf
  9210 +0 string \002\000\011\000 ms-windows metafont .wmf
  9211 +0 string \001\000\011\000 ms-windows metafont .wmf
  9212 +
  9213 +#tz3 files whatever that is (MS Works files)
  9214 +0 string \003\001\001\004\070\001\000\000 tz3 ms-works file
  9215 +0 string \003\002\001\004\070\001\000\000 tz3 ms-works file
  9216 +0 string \003\003\001\004\070\001\000\000 tz3 ms-works file
  9217 +
  9218 +# PGP sig files .sig
  9219 +#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig
  9220 +0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
  9221 +0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
  9222 +0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
  9223 +0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
  9224 +0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
  9225 +0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
  9226 +
  9227 +# windows zips files .dmf
  9228 +0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
  9229 +
  9230 +
  9231 +# Windows help file FTG FTS
  9232 +0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
  9233 +
  9234 +# grp old windows 3.1 group files
  9235 +0 string \120\115\103\103 MS Windows 3.1 group files
  9236 +
  9237 +
  9238 +# lnk files windows symlinks
  9239 +0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 MS Windows shortcut
  9240 +
  9241 +#ico files
  9242 +0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
  9243 +
  9244 +# Windows icons (Ian Springer <ips@fpk.hp.com>)
  9245 +0 string \000\000\001\000 MS Windows icon resource
  9246 +>4 byte 1 - 1 icon
  9247 +>4 byte >1 - %d icons
  9248 +>>6 byte >0 \b, %dx
  9249 +>>>7 byte >0 \b%d
  9250 +>>8 byte 0 \b, 256-colors
  9251 +>>8 byte >0 \b, %d-colors
  9252 +
  9253 +
  9254 +# .chr files
  9255 +0 string PK\010\010BGI Borland font
  9256 +>4 string >\0 %s
  9257 +# then there is a copyright notice
  9258 +
  9259 +
  9260 +# .bgi files
  9261 +0 string pk\010\010BGI Borland device
  9262 +>4 string >\0 %s
  9263 +# then there is a copyright notice
  9264 +
  9265 +
  9266 +# recycled/info the windows trash bin index
  9267 +9 string \000\000\000\030\001\000\000\000 MS Windows recycled bin info
  9268 +
  9269 +
  9270 +##### put in Either Magic/font or Magic/news
  9271 +# Acroread or something files wrongly identified as G3 .pfm
  9272 +# these have the form \000 \001 any? \002 \000 \000
  9273 +# or \000 \001 any? \022 \000 \000
  9274 +#0 string \000\001 pfm?
  9275 +#>3 string \022\000\000Copyright\ yes
  9276 +#>3 string \002\000\000Copyright\ yes
  9277 +#>3 string >\0 oops, not a font file. Cancel that.
  9278 +#it clashes with ttf files so put it lower down.
  9279 +
  9280 +# From Doug Lee via a FreeBSD pr
  9281 +9 string GERBILDOC First Choice document
  9282 +9 string GERBILDB First Choice database
  9283 +9 string GERBILCLIP First Choice database
  9284 +0 string GERBIL First Choice device file
  9285 +9 string RABBITGRAPH RabbitGraph file
  9286 +0 string DCU1 Borland Delphi .DCU file
  9287 +0 string =!<spell> MKS Spell hash list (old format)
  9288 +0 string =!<spell2> MKS Spell hash list
  9289 +# Too simple - MPi
  9290 +#0 string AH Halo(TM) bitmapped font file
  9291 +0 lelong 0x08086b70 TurboC BGI file
  9292 +0 lelong 0x08084b50 TurboC Font file
  9293 +
  9294 +# WARNING: below line conflicts with Infocom game data Z-machine 3
  9295 +0 byte 0x03 DBase 3 data file
  9296 +>0x04 lelong 0 (no records)
  9297 +>0x04 lelong >0 (%ld records)
  9298 +0 byte 0x83 DBase 3 data file with memo(s)
  9299 +>0x04 lelong 0 (no records)
  9300 +>0x04 lelong >0 (%ld records)
  9301 +0 leshort 0x0006 DBase 3 index file
  9302 +0 string PMCC Windows 3.x .GRP file
  9303 +1 string RDC-meg MegaDots
  9304 +>8 byte >0x2F version %c
  9305 +>9 byte >0x2F \b.%c file
  9306 +0 lelong 0x4C
  9307 +>4 lelong 0x00021401 Windows shortcut file
  9308 +
  9309 +# DOS EPS Binary File Header
  9310 +# From: Ed Sznyter <ews@Black.Market.NET>
  9311 +0 belong 0xC5D0D3C6 DOS EPS Binary File
  9312 +>4 long >0 Postscript starts at byte %d
  9313 +>>8 long >0 length %d
  9314 +>>>12 long >0 Metafile starts at byte %d
  9315 +>>>>16 long >0 length %d
  9316 +>>>20 long >0 TIFF starts at byte %d
  9317 +>>>>24 long >0 length %d
  9318 +
  9319 +# TNEF magic From "Joomy" <joomy@se-ed.net>
  9320 +0 leshort 0x223e9f78 TNEF
  9321 +
  9322 +# HtmlHelp files (.chm)
  9323 +0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
  9324 +
  9325 +# GFA-BASIC (Wolfram Kleff)
  9326 +2 string GFA-BASIC3 GFA-BASIC 3 data
  9327 +
  9328 +#------------------------------------------------------------------------------
  9329 +# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
  9330 +# Microsoft Cabinet files
  9331 +0 string MSCF\0\0\0\0 Microsoft Cabinet archive data
  9332 +>8 lelong x \b, %u bytes
  9333 +>28 leshort 1 \b, 1 file
  9334 +>28 leshort >1 \b, %u files
  9335 +
  9336 +# InstallShield Cabinet files
  9337 +0 string ISc( InstallShield Cabinet archive data
  9338 +>5 byte&0xf0 =0x60 version 6,
  9339 +>5 byte&0xf0 !0x60 version 4/5,
  9340 +>(12.l+40) lelong x %u files
  9341 +
  9342 +# Windows CE package files
  9343 +0 string MSCE\0\0\0\0 Microsoft WinCE install header
  9344 +>20 lelong 0 \b, architecture-independent
  9345 +>20 lelong 103 \b, Hitachi SH3
  9346 +>20 lelong 104 \b, Hitachi SH4
  9347 +>20 lelong 0xA11 \b, StrongARM
  9348 +>20 lelong 4000 \b, MIPS R4000
  9349 +>20 lelong 10003 \b, Hitachi SH3
  9350 +>20 lelong 10004 \b, Hitachi SH3E
  9351 +>20 lelong 10005 \b, Hitachi SH4
  9352 +>20 lelong 70001 \b, ARM 7TDMI
  9353 +>52 leshort 1 \b, 1 file
  9354 +>52 leshort >1 \b, %u files
  9355 +>56 leshort 1 \b, 1 registry entry
  9356 +>56 leshort >1 \b, %u registry entries
  9357 +
  9358 +# Outlook Personal Folders
  9359 +0 lelong 0x4E444221 Microsoft Outlook binary email folder
  9360 +>10 leshort 0x0e (Outlook <=2002)
  9361 +>10 leshort 0x17 (Outlook >=2003)
  9362 +
  9363 +
  9364 +# From: Dirk Jagdmann <doj@cubic.org>
  9365 +0 lelong 0x00035f3f Windows 3.x help file
  9366 +
  9367 +# Christophe Monniez
  9368 +0 string Client\ UrlCache\ MMF Microsoft Internet Explorer Cache File
  9369 +>20 string >\0 Version %s
  9370 +0 string \xCF\xAD\x12\xFE Microsoft Outlook Express DBX File
  9371 +>4 byte =0xC5 Message database
  9372 +>4 byte =0xC6 Folder database
  9373 +>4 byte =0xC7 Accounts informations
  9374 +>4 byte =0x30 Offline database
  9375 +
  9376 +
  9377 +# Windows Enhanced Metafile (EMF)
  9378 +# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
  9379 +# for further information. Note that "0 lelong 1" should be true i.e.
  9380 +# the first double word in the file should be 1. With the extended
  9381 +# syntax available by some file commands you could write:
  9382 +# 0 lelong 1
  9383 +# &40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data
  9384 +40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data
  9385 +>44 ulelong x version 0x%x.
  9386 +# If the description has a length greater than zero, it exists and is
  9387 +# found at offset (*64).
  9388 +>64 ulelong >0 Description available at offset 0x%x
  9389 +>>60 ulelong >0 (length 0x%x)
  9390 +# Note it would be better to print out the description, which is found
  9391 +# as below. Unfortunately the following only prints out the first couple
  9392 +# of characters instead of all the "description length"
  9393 +# number of characters -- indicated by the ulelong at offset 60.
  9394 +>>(64.l) lestring16 >0 Description: %15.15s
  9395 +
  9396 +# From: Alex Beregszaszi <alex@fsn.hu>
  9397 +0 string COWD VMWare3
  9398 +>4 byte 3 disk image
  9399 +>>32 lelong x (%d/
  9400 +>>36 lelong x \b%d/
  9401 +>>40 lelong x \b%d)
  9402 +>4 byte 2 undoable disk image
  9403 +>>32 string >\0 (%s)
  9404 +
  9405 +0 string VMDK VMware4 disk image
  9406 +0 string KDMV VMware4 disk image
  9407 +
  9408 +0 belong 0x514649fb QEMU Copy-On-Write disk image
  9409 +>4 belong x version %d,
  9410 +>24 belong x size %d +
  9411 +>28 belong x %d
  9412 +
  9413 +0 string QEVM QEMU's suspend to disk image
  9414 +
  9415 +0 string Bochs\ Virtual\ HD\ Image Bochs disk image,
  9416 +>32 string x type %s,
  9417 +>48 string x subtype %s
  9418 +
  9419 +0 lelong 0x02468ace Bochs Sparse disk image
  9420 +
  9421 +# from http://filext.com by Derek M Jones <derek@knosof.co.uk>
  9422 +0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer
  9423 +0 string \320\317\021\340\241\261\032\341 Microsoft Office Document
  9424 +
  9425 +#------------------------------------------------------------------------------
  9426 +# msvc: file(1) magic for msvc
  9427 +# "H. Nanosecond" <aldomel@ix.netcom.com>
  9428 +# Microsoft visual C
  9429 +#
  9430 +# I have version 1.0
  9431 +
  9432 +# .aps
  9433 +0 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file
  9434 +
  9435 +# .ide
  9436 +#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide
  9437 +0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide
  9438 +
  9439 +# .res
  9440 +0 string \000\000\000\000\040\000\000\000\377 MSVC .res
  9441 +0 string \377\003\000\377\001\000\020\020\350 MSVC .res
  9442 +0 string \377\003\000\377\001\000\060\020\350 MSVC .res
  9443 +
  9444 +#.lib
  9445 +0 string \360\015\000\000 Microsoft Visual C library
  9446 +0 string \360\075\000\000 Microsoft Visual C library
  9447 +0 string \360\175\000\000 Microsoft Visual C library
  9448 +
  9449 +#.pch
  9450 +0 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch
  9451 +
  9452 +# .pdb
  9453 +# too long 0 string Microsoft\ C/C++\ program\ database\
  9454 +0 string Microsoft\ C/C++\ MSVC program database
  9455 +>18 string program\ database\
  9456 +>33 string >\0 ver %s
  9457 +
  9458 +#.sbr
  9459 +0 string \000\002\000\007\000 MSVC .sbr
  9460 +>5 string >\0 %s
  9461 +
  9462 +#.bsc
  9463 +0 string \002\000\002\001 MSVC .bsc
  9464 +
  9465 +#.wsp
  9466 +0 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000
  9467 +# these seem to start with the version and contain menus
  9468 +# ------------------------------------------------------------------------
  9469 +# mup: file(1) magic for Mup (Music Publisher) input file.
  9470 +#
  9471 +# From: Abel Cheung <abel (@) oaka.org>
  9472 +#
  9473 +# NOTE: This header is mainly proposed in the Arkkra mailing list,
  9474 +# and is not a mandatory header because of old mup input file
  9475 +# compatibility. Noteedit also use mup format, but is not forcing
  9476 +# user to use any header as well.
  9477 +#
  9478 +0 string //!Mup Mup music publication program input text
  9479 +>6 string -Arkkra (Arkkra)
  9480 +>>13 string -
  9481 +>>>16 string .
  9482 +>>>>14 string x \b, need V%.4s
  9483 +>>>15 string .
  9484 +>>>>14 string x \b, need V%.3s
  9485 +>6 string -
  9486 +>>9 string .
  9487 +>>>7 string x \b, need V%.4s
  9488 +>>8 string .
  9489 +>>>7 string x \b, need V%.3s
  9490 +
  9491 +#-----------------------------------------------------------------------------
  9492 +# natinst: file(1) magic for National Instruments Code Files
  9493 +
  9494 +#
  9495 +# From <egamez@fcfm.buap.mx> Enrique Gámez-Flores
  9496 +# version 1
  9497 +# Many formats still missing, we use, for the moment LabVIEW
  9498 +# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
  9499 +#
  9500 +0 string RSRC National Instruments,
  9501 +# Check if it's a LabVIEW File
  9502 +>8 string LV LabVIEW File,
  9503 +# Check wich kind of file is
  9504 +>>10 string SB Code Resource File, data
  9505 +>>10 string IN Virtual Instrument Program, data
  9506 +>>10 string AR VI Library, data
  9507 +# This is for Menu Libraries
  9508 +>8 string LMNULBVW Portable File Names, data
  9509 +# This is for General Resources
  9510 +>8 string rsc Resources File, data
  9511 +# This is for VXI Package
  9512 +0 string VMAP National Instruments, VXI File, data
  9513 +
  9514 +#------------------------------------------------------------------------------
  9515 +# ncr: file(1) magic for NCR Tower objects
  9516 +#
  9517 +# contributed by
  9518 +# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
  9519 +# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
  9520 +#
  9521 +0 beshort 000610 Tower/XP rel 2 object
  9522 +>12 belong >0 not stripped
  9523 +>20 beshort 0407 executable
  9524 +>20 beshort 0410 pure executable
  9525 +>22 beshort >0 - version %ld
  9526 +0 beshort 000615 Tower/XP rel 2 object
  9527 +>12 belong >0 not stripped
  9528 +>20 beshort 0407 executable
  9529 +>20 beshort 0410 pure executable
  9530 +>22 beshort >0 - version %ld
  9531 +0 beshort 000620 Tower/XP rel 3 object
  9532 +>12 belong >0 not stripped
  9533 +>20 beshort 0407 executable
  9534 +>20 beshort 0410 pure executable
  9535 +>22 beshort >0 - version %ld
  9536 +0 beshort 000625 Tower/XP rel 3 object
  9537 +>12 belong >0 not stripped
  9538 +>20 beshort 0407 executable
  9539 +>20 beshort 0410 pure executable
  9540 +>22 beshort >0 - version %ld
  9541 +0 beshort 000630 Tower32/600/400 68020 object
  9542 +>12 belong >0 not stripped
  9543 +>20 beshort 0407 executable
  9544 +>20 beshort 0410 pure executable
  9545 +>22 beshort >0 - version %ld
  9546 +0 beshort 000640 Tower32/800 68020
  9547 +>18 beshort &020000 w/68881 object
  9548 +>18 beshort &040000 compatible object
  9549 +>18 beshort &060000 object
  9550 +>20 beshort 0407 executable
  9551 +>20 beshort 0413 pure executable
  9552 +>12 belong >0 not stripped
  9553 +>22 beshort >0 - version %ld
  9554 +0 beshort 000645 Tower32/800 68010
  9555 +>18 beshort &040000 compatible object
  9556 +>18 beshort &060000 object
  9557 +>20 beshort 0407 executable
  9558 +>20 beshort 0413 pure executable
  9559 +>12 belong >0 not stripped
  9560 +>22 beshort >0 - version %ld
  9561 +
  9562 +#------------------------------------------------------------------------------
  9563 +# netbsd: file(1) magic for NetBSD objects
  9564 +#
  9565 +# All new-style magic numbers are in network byte order.
  9566 +#
  9567 +
  9568 +0 lelong 000000407 a.out NetBSD little-endian object file
  9569 +>16 lelong >0 not stripped
  9570 +0 belong 000000407 a.out NetBSD big-endian object file
  9571 +>16 belong >0 not stripped
  9572 +
  9573 +0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged
  9574 +>0 byte &0x80
  9575 +>>20 lelong <4096 shared library
  9576 +>>20 lelong =4096 dynamically linked executable
  9577 +>>20 lelong >4096 dynamically linked executable
  9578 +>0 byte ^0x80 executable
  9579 +>16 lelong >0 not stripped
  9580 +0 belong&0377777777 041400410 a.out NetBSD/i386 pure
  9581 +>0 byte &0x80 dynamically linked executable
  9582 +>0 byte ^0x80 executable
  9583 +>16 lelong >0 not stripped
  9584 +0 belong&0377777777 041400407 a.out NetBSD/i386
  9585 +>0 byte &0x80 dynamically linked executable
  9586 +>0 byte ^0x80
  9587 +>>0 byte &0x40 position independent
  9588 +>>20 lelong !0 executable
  9589 +>>20 lelong =0 object file
  9590 +>16 lelong >0 not stripped
  9591 +0 belong&0377777777 041400507 a.out NetBSD/i386 core
  9592 +>12 string >\0 from '%s'
  9593 +>32 lelong !0 (signal %d)
  9594 +
  9595 +0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged
  9596 +>0 byte &0x80
  9597 +>>20 belong <8192 shared library
  9598 +>>20 belong =8192 dynamically linked executable
  9599 +>>20 belong >8192 dynamically linked executable
  9600 +>0 byte ^0x80 executable
  9601 +>16 belong >0 not stripped
  9602 +0 belong&0377777777 041600410 a.out NetBSD/m68k pure
  9603 +>0 byte &0x80 dynamically linked executable
  9604 +>0 byte ^0x80 executable
  9605 +>16 belong >0 not stripped
  9606 +0 belong&0377777777 041600407 a.out NetBSD/m68k
  9607 +>0 byte &0x80 dynamically linked executable
  9608 +>0 byte ^0x80
  9609 +>>0 byte &0x40 position independent
  9610 +>>20 belong !0 executable
  9611 +>>20 belong =0 object file
  9612 +>16 belong >0 not stripped
  9613 +0 belong&0377777777 041600507 a.out NetBSD/m68k core
  9614 +>12 string >\0 from '%s'
  9615 +>32 belong !0 (signal %d)
  9616 +
  9617 +0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged
  9618 +>0 byte &0x80
  9619 +>>20 belong <4096 shared library
  9620 +>>20 belong =4096 dynamically linked executable
  9621 +>>20 belong >4096 dynamically linked executable
  9622 +>0 byte ^0x80 executable
  9623 +>16 belong >0 not stripped
  9624 +0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure
  9625 +>0 byte &0x80 dynamically linked executable
  9626 +>0 byte ^0x80 executable
  9627 +>16 belong >0 not stripped
  9628 +0 belong&0377777777 042000407 a.out NetBSD/m68k4k
  9629 +>0 byte &0x80 dynamically linked executable
  9630 +>0 byte ^0x80
  9631 +>>0 byte &0x40 position independent
  9632 +>>20 belong !0 executable
  9633 +>>20 belong =0 object file
  9634 +>16 belong >0 not stripped
  9635 +0 belong&0377777777 042000507 a.out NetBSD/m68k4k core
  9636 +>12 string >\0 from '%s'
  9637 +>32 belong !0 (signal %d)
  9638 +
  9639 +0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged
  9640 +>0 byte &0x80
  9641 +>>20 lelong <4096 shared library
  9642 +>>20 lelong =4096 dynamically linked executable
  9643 +>>20 lelong >4096 dynamically linked executable
  9644 +>0 byte ^0x80 executable
  9645 +>16 lelong >0 not stripped
  9646 +0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure
  9647 +>0 byte &0x80 dynamically linked executable
  9648 +>0 byte ^0x80 executable
  9649 +>16 lelong >0 not stripped
  9650 +0 belong&0377777777 042200407 a.out NetBSD/ns32532
  9651 +>0 byte &0x80 dynamically linked executable
  9652 +>0 byte ^0x80
  9653 +>>0 byte &0x40 position independent
  9654 +>>20 lelong !0 executable
  9655 +>>20 lelong =0 object file
  9656 +>16 lelong >0 not stripped
  9657 +0 belong&0377777777 042200507 a.out NetBSD/ns32532 core
  9658 +>12 string >\0 from '%s'
  9659 +>32 lelong !0 (signal %d)
  9660 +
  9661 +0 belong&0377777777 045200507 a.out NetBSD/powerpc core
  9662 +>12 string >\0 from '%s'
  9663 +
  9664 +0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged
  9665 +>0 byte &0x80
  9666 +>>20 belong <8192 shared library
  9667 +>>20 belong =8192 dynamically linked executable
  9668 +>>20 belong >8192 dynamically linked executable
  9669 +>0 byte ^0x80 executable
  9670 +>16 belong >0 not stripped
  9671 +0 belong&0377777777 042400410 a.out NetBSD/sparc pure
  9672 +>0 byte &0x80 dynamically linked executable
  9673 +>0 byte ^0x80 executable
  9674 +>16 belong >0 not stripped
  9675 +0 belong&0377777777 042400407 a.out NetBSD/sparc
  9676 +>0 byte &0x80 dynamically linked executable
  9677 +>0 byte ^0x80
  9678 +>>0 byte &0x40 position independent
  9679 +>>20 belong !0 executable
  9680 +>>20 belong =0 object file
  9681 +>16 belong >0 not stripped
  9682 +0 belong&0377777777 042400507 a.out NetBSD/sparc core
  9683 +>12 string >\0 from '%s'
  9684 +>32 belong !0 (signal %d)
  9685 +
  9686 +0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged
  9687 +>0 byte &0x80
  9688 +>>20 lelong <4096 shared library
  9689 +>>20 lelong =4096 dynamically linked executable
  9690 +>>20 lelong >4096 dynamically linked executable
  9691 +>0 byte ^0x80 executable
  9692 +>16 lelong >0 not stripped
  9693 +0 belong&0377777777 042600410 a.out NetBSD/pmax pure
  9694 +>0 byte &0x80 dynamically linked executable
  9695 +>0 byte ^0x80 executable
  9696 +>16 lelong >0 not stripped
  9697 +0 belong&0377777777 042600407 a.out NetBSD/pmax
  9698 +>0 byte &0x80 dynamically linked executable
  9699 +>0 byte ^0x80
  9700 +>>0 byte &0x40 position independent
  9701 +>>20 lelong !0 executable
  9702 +>>20 lelong =0 object file
  9703 +>16 lelong >0 not stripped
  9704 +0 belong&0377777777 042600507 a.out NetBSD/pmax core
  9705 +>12 string >\0 from '%s'
  9706 +>32 lelong !0 (signal %d)
  9707 +
  9708 +0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged
  9709 +>0 byte &0x80
  9710 +>>20 lelong <4096 shared library
  9711 +>>20 lelong =4096 dynamically linked executable
  9712 +>>20 lelong >4096 dynamically linked executable
  9713 +>0 byte ^0x80 executable
  9714 +>16 lelong >0 not stripped
  9715 +0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure
  9716 +>0 byte &0x80 dynamically linked executable
  9717 +>0 byte ^0x80 executable
  9718 +>16 lelong >0 not stripped
  9719 +0 belong&0377777777 043000407 a.out NetBSD/vax 1k
  9720 +>0 byte &0x80 dynamically linked executable
  9721 +>0 byte ^0x80
  9722 +>>0 byte &0x40 position independent
  9723 +>>20 lelong !0 executable
  9724 +>>20 lelong =0 object file
  9725 +>16 lelong >0 not stripped
  9726 +0 belong&0377777777 043000507 a.out NetBSD/vax 1k core
  9727 +>12 string >\0 from '%s'
  9728 +>32 lelong !0 (signal %d)
  9729 +
  9730 +0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged
  9731 +>0 byte &0x80
  9732 +>>20 lelong <4096 shared library
  9733 +>>20 lelong =4096 dynamically linked executable
  9734 +>>20 lelong >4096 dynamically linked executable
  9735 +>0 byte ^0x80 executable
  9736 +>16 lelong >0 not stripped
  9737 +0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure
  9738 +>0 byte &0x80 dynamically linked executable
  9739 +>0 byte ^0x80 executable
  9740 +>16 lelong >0 not stripped
  9741 +0 belong&0377777777 045400407 a.out NetBSD/vax 4k
  9742 +>0 byte &0x80 dynamically linked executable
  9743 +>0 byte ^0x80
  9744 +>>0 byte &0x40 position independent
  9745 +>>20 lelong !0 executable
  9746 +>>20 lelong =0 object file
  9747 +>16 lelong >0 not stripped
  9748 +0 belong&0377777777 045400507 a.out NetBSD/vax 4k core
  9749 +>12 string >\0 from '%s'
  9750 +>32 lelong !0 (signal %d)
  9751 +
  9752 +# NetBSD/alpha does not support (and has never supported) a.out objects,
  9753 +# so no rules are provided for them. NetBSD/alpha ELF objects are
  9754 +# dealt with in "elf".
  9755 +0 lelong 0x00070185 ECOFF NetBSD/alpha binary
  9756 +>10 leshort 0x0001 not stripped
  9757 +>10 leshort 0x0000 stripped
  9758 +0 belong&0377777777 043200507 a.out NetBSD/alpha core
  9759 +>12 string >\0 from '%s'
  9760 +>32 lelong !0 (signal %d)
  9761 +
  9762 +0 belong&0377777777 043400413 a.out NetBSD/mips demand paged
  9763 +>0 byte &0x80
  9764 +>>20 belong <8192 shared library
  9765 +>>20 belong =8192 dynamically linked executable
  9766 +>>20 belong >8192 dynamically linked executable
  9767 +>0 byte ^0x80 executable
  9768 +>16 belong >0 not stripped
  9769 +0 belong&0377777777 043400410 a.out NetBSD/mips pure
  9770 +>0 byte &0x80 dynamically linked executable
  9771 +>0 byte ^0x80 executable
  9772 +>16 belong >0 not stripped
  9773 +0 belong&0377777777 043400407 a.out NetBSD/mips
  9774 +>0 byte &0x80 dynamically linked executable
  9775 +>0 byte ^0x80
  9776 +>>0 byte &0x40 position independent
  9777 +>>20 belong !0 executable
  9778 +>>20 belong =0 object file
  9779 +>16 belong >0 not stripped
  9780 +0 belong&0377777777 043400507 a.out NetBSD/mips core
  9781 +>12 string >\0 from '%s'
  9782 +>32 belong !0 (signal %d)
  9783 +
  9784 +0 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged
  9785 +>0 byte &0x80
  9786 +>>20 lelong <4096 shared library
  9787 +>>20 lelong =4096 dynamically linked executable
  9788 +>>20 lelong >4096 dynamically linked executable
  9789 +>0 byte ^0x80 executable
  9790 +>16 lelong >0 not stripped
  9791 +0 belong&0377777777 043600410 a.out NetBSD/arm32 pure
  9792 +>0 byte &0x80 dynamically linked executable
  9793 +>0 byte ^0x80 executable
  9794 +>16 lelong >0 not stripped
  9795 +0 belong&0377777777 043600407 a.out NetBSD/arm32
  9796 +>0 byte &0x80 dynamically linked executable
  9797 +>0 byte ^0x80
  9798 +>>0 byte &0x40 position independent
  9799 +>>20 lelong !0 executable
  9800 +>>20 lelong =0 object file
  9801 +>16 lelong >0 not stripped
  9802 +# NetBSD/arm26 has always used ELF objects, but it shares a core file
  9803 +# format with NetBSD/arm32.
  9804 +0 belong&0377777777 043600507 a.out NetBSD/arm core
  9805 +>12 string >\0 from '%s'
  9806 +>32 lelong !0 (signal %d)
  9807 +
  9808 +#------------------------------------------------------------------------------
  9809 +# netscape: file(1) magic for Netscape files
  9810 +# "H. Nanosecond" <aldomel@ix.netcom.com>
  9811 +# version 3 and 4 I think
  9812 +#
  9813 +
  9814 +# Netscape Address book .nab
  9815 +0 string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
  9816 +
  9817 +# Netscape Communicator address book
  9818 +0 string \000\017\102\111 Netscape Communicator address book
  9819 +
  9820 +# .snm Caches
  9821 +0 string #\ Netscape\ folder\ cache Netscape folder cache
  9822 +0 string \000\036\204\220\000 Netscape folder cache
  9823 +# .n2p
  9824 +# Net 2 Phone
  9825 +#0 string 123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
  9826 +0 string SX961999 Net2phone
  9827 +
  9828 +#
  9829 +#This is files ending in .art, FIXME add more rules
  9830 +0 string JG\004\016\0\0\0\0 ART
  9831 +
  9832 +#------------------------------------------------------------------------------
  9833 +# news: file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
  9834 +#
  9835 +0 string StartFontMetrics ASCII font metrics
  9836 +0 string StartFont ASCII font bits
  9837 +0 belong 0x137A2944 NeWS bitmap font
  9838 +0 belong 0x137A2947 NeWS font family
  9839 +0 belong 0x137A2950 scalable OpenFont binary
  9840 +0 belong 0x137A2951 encrypted scalable OpenFont binary
  9841 +8 belong 0x137A2B45 X11/NeWS bitmap font
  9842 +8 belong 0x137A2B48 X11/NeWS font family
  9843 +#------------------------------------------------------------------------------
  9844 +# nitpicker: file(1) magic for Flowfiles.
  9845 +# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
  9846 +0 string NPFF NItpicker Flow File
  9847 +>4 byte x V%d.
  9848 +>5 byte x %d
  9849 +>6 bedate x started: %s
  9850 +>10 bedate x stopped: %s
  9851 +>14 belong x Bytes: %u
  9852 +>18 belong x Bytes1: %u
  9853 +>22 belong x Flows: %u
  9854 +>26 belong x Pkts: %u
  9855 +
  9856 +#------------------------------------------------------------------------------
  9857 +# ocaml: file(1) magic for Objective Caml files.
  9858 +0 string Caml1999 Objective caml
  9859 +>8 string X exec file
  9860 +>8 string I interface file (.cmi)
  9861 +>8 string O object file (.cmo)
  9862 +>8 string A library file (.cma)
  9863 +>8 string Y native object file (.cmx)
  9864 +>8 string Z native library file (.cmxa)
  9865 +>8 string M abstract syntax tree implementation file
  9866 +>8 string N abstract syntax tree interface file
  9867 +>9 string >\0 (Version %3.3s).
  9868 +#------------------------------------------------------------------------------
  9869 +# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
  9870 +0 string Octave-1-L Octave binary data (little endian)
  9871 +0 string Octave-1-B Octave binary data (big endian)
  9872 +
  9873 +#------------------------------------------------------------------------------
  9874 +# olf: file(1) magic for OLF executables
  9875 +#
  9876 +# We have to check the byte order flag to see what byte order all the
  9877 +# other stuff in the header is in.
  9878 +#
  9879 +# MIPS R3000 may also be for MIPS R2000.
  9880 +# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
  9881 +#
  9882 +# Created by Erik Theisen <etheisen@openbsd.org>
  9883 +# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
  9884 +0 string \177OLF OLF
  9885 +>4 byte 0 invalid class
  9886 +>4 byte 1 32-bit
  9887 +>4 byte 2 64-bit
  9888 +>7 byte 0 invalid os
  9889 +>7 byte 1 OpenBSD
  9890 +>7 byte 2 NetBSD
  9891 +>7 byte 3 FreeBSD
  9892 +>7 byte 4 4.4BSD
  9893 +>7 byte 5 Linux
  9894 +>7 byte 6 SVR4
  9895 +>7 byte 7 esix
  9896 +>7 byte 8 Solaris
  9897 +>7 byte 9 Irix
  9898 +>7 byte 10 SCO
  9899 +>7 byte 11 Dell
  9900 +>7 byte 12 NCR
  9901 +>5 byte 0 invalid byte order
  9902 +>5 byte 1 LSB
  9903 +>>16 leshort 0 no file type,
  9904 +>>16 leshort 1 relocatable,
  9905 +>>16 leshort 2 executable,
  9906 +>>16 leshort 3 shared object,
  9907 +# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
  9908 +# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
  9909 +>>16 leshort 4 core file
  9910 +>>>(0x38+0xcc) string >\0 of '%s'
  9911 +>>>(0x38+0x10) lelong >0 (signal %d),
  9912 +>>16 leshort &0xff00 processor-specific,
  9913 +>>18 leshort 0 no machine,
  9914 +>>18 leshort 1 AT&T WE32100 - invalid byte order,
  9915 +>>18 leshort 2 SPARC - invalid byte order,
  9916 +>>18 leshort 3 Intel 80386,
  9917 +>>18 leshort 4 Motorola 68000 - invalid byte order,
  9918 +>>18 leshort 5 Motorola 88000 - invalid byte order,
  9919 +>>18 leshort 6 Intel 80486,
  9920 +>>18 leshort 7 Intel 80860,
  9921 +>>18 leshort 8 MIPS R3000_BE - invalid byte order,
  9922 +>>18 leshort 9 Amdahl - invalid byte order,
  9923 +>>18 leshort 10 MIPS R3000_LE,
  9924 +>>18 leshort 11 RS6000 - invalid byte order,
  9925 +>>18 leshort 15 PA-RISC - invalid byte order,
  9926 +>>18 leshort 16 nCUBE,
  9927 +>>18 leshort 17 VPP500,
  9928 +>>18 leshort 18 SPARC32PLUS,
  9929 +>>18 leshort 20 PowerPC,
  9930 +>>18 leshort 0x9026 Alpha,
  9931 +>>20 lelong 0 invalid version
  9932 +>>20 lelong 1 version 1
  9933 +>>36 lelong 1 MathCoPro/FPU/MAU Required
  9934 +>8 string >\0 (%s)
  9935 +>5 byte 2 MSB
  9936 +>>16 beshort 0 no file type,
  9937 +>>16 beshort 1 relocatable,
  9938 +>>16 beshort 2 executable,
  9939 +>>16 beshort 3 shared object,
  9940 +>>16 beshort 4 core file,
  9941 +>>>(0x38+0xcc) string >\0 of '%s'
  9942 +>>>(0x38+0x10) belong >0 (signal %d),
  9943 +>>16 beshort &0xff00 processor-specific,
  9944 +>>18 beshort 0 no machine,
  9945 +>>18 beshort 1 AT&T WE32100,
  9946 +>>18 beshort 2 SPARC,
  9947 +>>18 beshort 3 Intel 80386 - invalid byte order,
  9948 +>>18 beshort 4 Motorola 68000,
  9949 +>>18 beshort 5 Motorola 88000,
  9950 +>>18 beshort 6 Intel 80486 - invalid byte order,
  9951 +>>18 beshort 7 Intel 80860,
  9952 +>>18 beshort 8 MIPS R3000_BE,
  9953 +>>18 beshort 9 Amdahl,
  9954 +>>18 beshort 10 MIPS R3000_LE - invalid byte order,
  9955 +>>18 beshort 11 RS6000,
  9956 +>>18 beshort 15 PA-RISC,
  9957 +>>18 beshort 16 nCUBE,
  9958 +>>18 beshort 17 VPP500,
  9959 +>>18 beshort 18 SPARC32PLUS,
  9960 +>>18 beshort 20 PowerPC or cisco 4500,
  9961 +>>18 beshort 21 cisco 7500,
  9962 +>>18 beshort 24 cisco SVIP,
  9963 +>>18 beshort 25 cisco 7200,
  9964 +>>18 beshort 36 cisco 12000,
  9965 +>>18 beshort 0x9026 Alpha,
  9966 +>>20 belong 0 invalid version
  9967 +>>20 belong 1 version 1
  9968 +>>36 belong 1 MathCoPro/FPU/MAU Required
  9969 +
  9970 +#------------------------------------------------------------------------------
  9971 +# os2: file(1) magic for OS/2 files
  9972 +#
  9973 +
  9974 +# Provided 1998/08/22 by
  9975 +# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
  9976 +1 string InternetShortcut MS Windows 95 Internet shortcut text
  9977 +>24 string >\ (URL=<%s>)
  9978 +
  9979 +# OS/2 URL objects
  9980 +# Provided 1998/08/22 by
  9981 +# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
  9982 +#0 string http: OS/2 URL object text
  9983 +#>5 string >\ (WWW) <http:%s>
  9984 +#0 string mailto: OS/2 URL object text
  9985 +#>7 string >\ (email) <%s>
  9986 +#0 string news: OS/2 URL object text
  9987 +#>5 string >\ (Usenet) <%s>
  9988 +#0 string ftp: OS/2 URL object text
  9989 +#>4 string >\ (FTP) <ftp:%s>
  9990 +#0 string file: OS/2 URL object text
  9991 +#>5 string >\ (Local file) <%s>
  9992 +
  9993 +# >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com)
  9994 +# Carl Hauser (chauser.parc@xerox.com) and
  9995 +# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
  9996 +# list the following header format in inf02a.doc:
  9997 +#
  9998 +# int16 ID; // ID magic word (5348h = "HS")
  9999 +# int8 unknown1; // unknown purpose, could be third letter of ID
  10000 +# int8 flags; // probably a flag word...
  10001 +# // bit 0: set if INF style file
  10002 +# // bit 4: set if HLP style file
  10003 +# // patching this byte allows reading HLP files
  10004 +# // using the VIEW command, while help files
  10005 +# // seem to work with INF settings here as well.
  10006 +# int16 hdrsize; // total size of header
  10007 +# int16 unknown2; // unknown purpose
  10008 +#
  10009 +0 string HSP\x01\x9b\x00 OS/2 INF
  10010 +>107 string >0 (%s)
  10011 +0 string HSP\x10\x9b\x00 OS/2 HLP
  10012 +>107 string >0 (%s)
  10013 +
  10014 +# OS/2 INI (this is a guess)
  10015 +0 string \xff\xff\xff\xff\x14\0\0\0 OS/2 INI
  10016 +#------------------------------------------------------------------------------
  10017 +# os400: file(1) magic for IBM OS/400 files
  10018 +#
  10019 +# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
  10020 +# In spite of its quite variable format (due to internal memory page
  10021 +# length differences between CISC and RISC versions of the OS) the
  10022 +# SAVF structure hasn't suitable offsets to identify the catalog
  10023 +# header in the first descriptor where there are some useful infos,
  10024 +# so we must search in a somewhat large area for a particular string
  10025 +# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore
  10026 +# descriptor space) preceded by a two byte constant.
  10027 +#
  10028 +1090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
  10029 +>&212 byte 0x01 \b, created with SAVOBJ
  10030 +>&212 byte 0x02 \b, created with SAVLIB
  10031 +>&212 byte 0x07 \b, created with SAVCFG
  10032 +>&212 byte 0x08 \b, created with SAVSECDTA
  10033 +>&212 byte 0x0A \b, created with SAVSECDTA
  10034 +>&212 byte 0x0B \b, created with SAVDLO
  10035 +>&212 byte 0x0D \b, created with SAVLICPGM
  10036 +>&212 byte 0x11 \b, created with SAVCHGOBJ
  10037 +>&213 byte 0x44 \b, at least V5R4 to open
  10038 +>&213 byte 0x43 \b, at least V5R3 to open
  10039 +>&213 byte 0x42 \b, at least V5R2 to open
  10040 +>&213 byte 0x41 \b, at least V5R1 to open
  10041 +>&213 byte 0x40 \b, at least V4R5 to open
  10042 +>&213 byte 0x3F \b, at least V4R4 to open
  10043 +>&213 byte 0x3E \b, at least V4R3 to open
  10044 +>&213 byte 0x3C \b, at least V4R2 to open
  10045 +>&213 byte 0x3D \b, at least V4R1M4 to open
  10046 +>&213 byte 0x3B \b, at least V4R1 to open
  10047 +>&213 byte 0x3A \b, at least V3R7 to open
  10048 +>&213 byte 0x35 \b, at least V3R6 to open
  10049 +>&213 byte 0x36 \b, at least V3R2 to open
  10050 +>&213 byte 0x34 \b, at least V3R1 to open
  10051 +>&213 byte 0x31 \b, at least V3R0M5 to open
  10052 +>&213 byte 0x30 \b, at least V2R3 to open
  10053 +#
  10054 +# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
  10055 +#
  10056 +# Redistribution and use in source and binary forms, with or without
  10057 +# modification, are permitted provided that the following conditions
  10058 +# are met:
  10059 +# 1. Redistributions of source code must retain the above copyright
  10060 +# notice, this list of conditions and the following disclaimer.
  10061 +# 2. Redistributions in binary form must reproduce the above copyright
  10062 +# notice, this list of conditions and the following disclaimer in the
  10063 +# documentation and/or other materials provided with the distribution.
  10064 +# 3. All advertising materials mentioning features or use of this software
  10065 +# must display the following acknowledgement:
  10066 +# This product includes software developed by Ignatios Souvatzis for
  10067 +# the NetBSD project.
  10068 +# 4. The name of the author may not be used to endorse or promote products
  10069 +# derived from this software without specific prior written permission.
  10070 +#
  10071 +#
  10072 +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  10073 +# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  10074 +# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  10075 +# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  10076 +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  10077 +# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
  10078 +# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  10079 +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  10080 +# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  10081 +# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  10082 +#
  10083 +#
  10084 +#
  10085 +# OS9/6809 module descriptions:
  10086 +#
  10087 +0 beshort 0x87CD OS9/6809 module:
  10088 +#
  10089 +>6 byte&0x0f 0x00 non-executable
  10090 +>6 byte&0x0f 0x01 machine language
  10091 +>6 byte&0x0f 0x02 BASIC I-code
  10092 +>6 byte&0x0f 0x03 Pascal P-code
  10093 +>6 byte&0x0f 0x04 C I-code
  10094 +>6 byte&0x0f 0x05 COBOL I-code
  10095 +>6 byte&0x0f 0x06 Fortran I-code
  10096 +#
  10097 +>6 byte&0xf0 0x10 program executable
  10098 +>6 byte&0xf0 0x20 subroutine
  10099 +>6 byte&0xf0 0x30 multi-module
  10100 +>6 byte&0xf0 0x40 data module
  10101 +#
  10102 +>6 byte&0xf0 0xC0 system module
  10103 +>6 byte&0xf0 0xD0 file manager
  10104 +>6 byte&0xf0 0xE0 device driver
  10105 +>6 byte&0xf0 0xF0 device descriptor
  10106 +#
  10107 +# OS9/m68k stuff (to be continued)
  10108 +#
  10109 +0 beshort 0x4AFC OS9/68K module:
  10110 +#
  10111 +# attr
  10112 +>0x14 byte&0x80 0x80 re-entrant
  10113 +>0x14 byte&0x40 0x40 ghost
  10114 +>0x14 byte&0x20 0x20 system-state
  10115 +#
  10116 +# lang:
  10117 +#
  10118 +>0x13 byte 1 machine language
  10119 +>0x13 byte 2 BASIC I-code
  10120 +>0x13 byte 3 Pascal P-code
  10121 +>0x13 byte 4 C I-code
  10122 +>0x13 byte 5 COBOL I-code
  10123 +>0x13 byte 6 Fortran I-code
  10124 +#
  10125 +#
  10126 +# type:
  10127 +#
  10128 +>0x12 byte 1 program executable
  10129 +>0x12 byte 2 subroutine
  10130 +>0x12 byte 3 multi-module
  10131 +>0x12 byte 4 data module
  10132 +>0x12 byte 11 trap library
  10133 +>0x12 byte 12 system module
  10134 +>0x12 byte 13 file manager
  10135 +>0x12 byte 14 device driver
  10136 +>0x12 byte 15 device descriptor
  10137 +#
  10138 +# Mach magic number info
  10139 +#
  10140 +0 long 0xefbe OSF/Rose object
  10141 +# I386 magic number info
  10142 +#
  10143 +0 short 0565 i386 COFF object
  10144 +
  10145 +#------------------------------------------------------------------------------
  10146 +# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
  10147 +#
  10148 +# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
  10149 +
  10150 +# appl
  10151 +60 belong 0x6170706c PalmOS application
  10152 +>0 string >\0 "%s"
  10153 +# TEXt
  10154 +60 belong 0x54455874 AportisDoc file
  10155 +>0 string >\0 "%s"
  10156 +# HACK
  10157 +60 belong 0x4841434b HackMaster hack
  10158 +>0 string >\0 "%s"
  10159 +
  10160 +# Variety of PalmOS document types
  10161 +# Michael-John Turner <mj@debian.org>
  10162 +# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
  10163 +60 string BVokBDIC BDicty PalmOS document
  10164 +>0 string >\0 "%s"
  10165 +60 string DB99DBOS DB PalmOS document
  10166 +>0 string >\0 "%s"
  10167 +60 string vIMGView FireViewer/ImageViewer PalmOS document
  10168 +>0 string >\0 "%s"
  10169 +60 string PmDBPmDB HanDBase PalmOS document
  10170 +>0 string >\0 "%s"
  10171 +60 string InfoINDB InfoView PalmOS document
  10172 +>0 string >\0 "%s"
  10173 +60 string ToGoToGo iSilo PalmOS document
  10174 +>0 string >\0 "%s"
  10175 +60 string JfDbJBas JFile PalmOS document
  10176 +>0 string >\0 "%s"
  10177 +60 string JfDbJFil JFile Pro PalmOS document
  10178 +>0 string >\0 "%s"
  10179 +60 string DATALSdb List PalmOS document
  10180 +>0 string >\0 "%s"
  10181 +60 string Mdb1Mdb1 MobileDB PalmOS document
  10182 +>0 string >\0 "%s"
  10183 +60 string PNRdPPrs PeanutPress PalmOS document
  10184 +>0 string >\0 "%s"
  10185 +60 string DataPlkr Plucker PalmOS document
  10186 +>0 string >\0 "%s"
  10187 +60 string DataSprd QuickSheet PalmOS document
  10188 +>0 string >\0 "%s"
  10189 +60 string SM01SMem SuperMemo PalmOS document
  10190 +>0 string >\0 "%s"
  10191 +60 string DataTlPt TealDoc PalmOS document
  10192 +>0 string >\0 "%s"
  10193 +60 string InfoTlIf TealInfo PalmOS document
  10194 +>0 string >\0 "%s"
  10195 +60 string DataTlMl TealMeal PalmOS document
  10196 +>0 string >\0 "%s"
  10197 +60 string DataTlPt TealPaint PalmOS document
  10198 +>0 string >\0 "%s"
  10199 +60 string dataTDBP ThinkDB PalmOS document
  10200 +>0 string >\0 "%s"
  10201 +60 string TdatTide Tides PalmOS document
  10202 +>0 string >\0 "%s"
  10203 +60 string ToRaTRPW TomeRaider PalmOS document
  10204 +>0 string >\0 "%s"
  10205 +
  10206 +# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
  10207 +# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
  10208 +# annotations.
  10209 +# For other versions, just outputs version.
  10210 +#
  10211 +60 string zTXT A GutenPalm zTXT e-book
  10212 +>0 string >\0 "%s"
  10213 +>(0x4E.L) byte 0
  10214 +>>(0x4E.L+1) byte x (v0.%02d)
  10215 +>(0x4E.L) byte 1
  10216 +>>(0x4E.L+1) byte x (v1.%02d)
  10217 +>>>(0x4E.L+10) beshort >0
  10218 +>>>>(0x4E.L+10) beshort <2 - 1 bookmark
  10219 +>>>>(0x4E.L+10) beshort >1 - %d bookmarks
  10220 +>>>(0x4E.L+14) beshort >0
  10221 +>>>>(0x4E.L+14) beshort <2 - 1 annotation
  10222 +>>>>(0x4E.L+14) beshort >1 - %d annotations
  10223 +>(0x4E.L) byte >1 (v%d.
  10224 +>>(0x4E.L+1) byte x %02d)
  10225 +
  10226 +# Palm OS .prc file types
  10227 +60 string libr Palm OS dynamic library data
  10228 +>0 string >\0 "%s"
  10229 +60 string ptch Palm OS operating system patch data
  10230 +>0 string >\0 "%s"
  10231 +
  10232 +# Mobipocket (www.mobipocket.com), donated by Carl Witty
  10233 +60 string BOOKMOBI Mobipocket E-book
  10234 +>0 string >\0 "%s"
  10235 +
  10236 +#------------------------------------------------------------------------------
  10237 +#
  10238 +# Parix COFF executables
  10239 +# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
  10240 +#
  10241 +0 beshort&0xfff 0xACE PARIX
  10242 +>0 byte&0xf0 0x80 T800
  10243 +>0 byte&0xf0 0x90 T9000
  10244 +>19 byte&0x02 0x02 executable
  10245 +>19 byte&0x02 0x00 object
  10246 +>19 byte&0x0c 0x00 not stripped
  10247 +
  10248 +#------------------------------------------------------------------------------
  10249 +# pbm: file(1) magic for Portable Bitmap files
  10250 +#
  10251 +# XXX - byte order?
  10252 +#
  10253 +0 short 0x2a17 "compact bitmap" format (Poskanzer)
  10254 +#------------------------------------------------------------------------------
  10255 +# pdf: file(1) magic for Portable Document Format
  10256 +#
  10257 +
  10258 +0 string %PDF- PDF document
  10259 +>5 byte x \b, version %c
  10260 +>7 byte x \b.%c
  10261 +
  10262 +#------------------------------------------------------------------------------
  10263 +# pdp: file(1) magic for PDP-11 executable/object and APL workspace
  10264 +#
  10265 +0 lelong 0101555 PDP-11 single precision APL workspace
  10266 +0 lelong 0101554 PDP-11 double precision APL workspace
  10267 +#
  10268 +# PDP-11 a.out
  10269 +#
  10270 +0 leshort 0407 PDP-11 executable
  10271 +>8 leshort >0 not stripped
  10272 +>15 byte >0 - version %ld
  10273 +
  10274 +0 leshort 0401 PDP-11 UNIX/RT ldp
  10275 +0 leshort 0405 PDP-11 old overlay
  10276 +
  10277 +0 leshort 0410 PDP-11 pure executable
  10278 +>8 leshort >0 not stripped
  10279 +>15 byte >0 - version %ld
  10280 +
  10281 +0 leshort 0411 PDP-11 separate I&D executable
  10282 +>8 leshort >0 not stripped
  10283 +>15 byte >0 - version %ld
  10284 +
  10285 +0 leshort 0437 PDP-11 kernel overlay
  10286 +
  10287 +# These last three are derived from 2.11BSD file(1)
  10288 +0 leshort 0413 PDP-11 demand-paged pure executable
  10289 +>8 leshort >0 not stripped
  10290 +
  10291 +0 leshort 0430 PDP-11 overlaid pure executable
  10292 +>8 leshort >0 not stripped
  10293 +
  10294 +0 leshort 0431 PDP-11 overlaid separate executable
  10295 +>8 leshort >0 not stripped
  10296 +
  10297 +#------------------------------------------------------------------------------
  10298 +# perl: file(1) magic for Larry Wall's perl language.
  10299 +#
  10300 +# The ``eval'' line recognizes an outrageously clever hack for USG systems.
  10301 +# Keith Waclena <keith@cerberus.uchicago.edu>
  10302 +# Send additions to <perl5-porters@perl.org>
  10303 +0 string/b #!\ /bin/perl perl script text executable
  10304 +0 string eval\ "exec\ /bin/perl perl script text
  10305 +0 string/b #!\ /usr/bin/perl perl script text executable
  10306 +0 string eval\ "exec\ /usr/bin/perl perl script text
  10307 +0 string/b #!\ /usr/local/bin/perl perl script text
  10308 +0 string eval\ "exec\ /usr/local/bin/perl perl script text executable
  10309 +0 string eval\ '(exit\ $?0)'\ &&\ eval\ 'exec perl script text
  10310 +
  10311 +
  10312 +# by Dmitry V. Levin and Alexey Tourbin
  10313 +# check the first line
  10314 +0 string package
  10315 +>1 regex \^package[\ \t]+[A-Za-z_]
  10316 +>>1 regex \^package[\ \t]+[0-9A-Za-z_:]*\ *; Perl5 module source text
  10317 +# not 'p', check other lines
  10318 +0 byte !0x70
  10319 +>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
  10320 +>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
  10321 +
  10322 +
  10323 +
  10324 +# Perl POD documents
  10325 +# From: Tom Hukins <tom@eborcom.com>
  10326 +0 string/B \=pod\n Perl POD document
  10327 +0 string/B \n\=pod\n Perl POD document
  10328 +0 string/B \=head1\ Perl POD document
  10329 +0 string/B \n\=head1\ Perl POD document
  10330 +0 string/B \=head2\ Perl POD document
  10331 +0 string/B \n\=head2\ Perl POD document
  10332 +
  10333 +# Perl Storable data files.
  10334 +0 string perl-store perl Storable(v0.6) data
  10335 +>4 byte >0 (net-order %d)
  10336 +>>4 byte &01 (network-ordered)
  10337 +>>4 byte =3 (major 1)
  10338 +>>4 byte =2 (major 1)
  10339 +
  10340 +0 string pst0 perl Storable(v0.7) data
  10341 +>4 byte >0
  10342 +>>4 byte &01 (network-ordered)
  10343 +>>4 byte =5 (major 2)
  10344 +>>4 byte =4 (major 2)
  10345 +>>5 byte >0 (minor %d)
  10346 +
  10347 +#------------------------------------------------------------------------------
  10348 +# pgp: file(1) magic for Pretty Good Privacy
  10349 +#
  10350 +0 beshort 0x9900 PGP key public ring
  10351 +0 beshort 0x9501 PGP key security ring
  10352 +0 beshort 0x9500 PGP key security ring
  10353 +0 beshort 0xa600 PGP encrypted data
  10354 +0 string -----BEGIN\040PGP PGP armored data
  10355 +>15 string PUBLIC\040KEY\040BLOCK- public key block
  10356 +>15 string MESSAGE- message
  10357 +>15 string SIGNED\040MESSAGE- signed message
  10358 +>15 string PGP\040SIGNATURE- signature
  10359 +
  10360 +#------------------------------------------------------------------------------
  10361 +# pkgadd: file(1) magic for SysV R4 PKG Datastreams
  10362 +#
  10363 +0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)
  10364 +
  10365 +#------------------------------------------------------------------------------
  10366 +# plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables
  10367 +# From: "Stefan A. Haubenthal" <polluks@web.de>
  10368 +#
  10369 +0 belong 0x00000107 Plan 9 executable, Motorola 68k
  10370 +0 belong 0x000001EB Plan 9 executable, Intel 386
  10371 +0 belong 0x00000247 Plan 9 executable, Intel 960
  10372 +0 belong 0x000002AB Plan 9 executable, SPARC
  10373 +0 belong 0x00000407 Plan 9 executable, MIPS R3000
  10374 +0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210
  10375 +0 belong 0x00000517 Plan 9 executable, MIPS R4000 BE
  10376 +0 belong 0x000005AB Plan 9 executable, AMD 29000
  10377 +0 belong 0x00000647 Plan 9 executable, ARM 7-something
  10378 +0 belong 0x000006EB Plan 9 executable, PowerPC
  10379 +0 belong 0x00000797 Plan 9 executable, MIPS R4000 LE
  10380 +0 belong 0x0000084B Plan 9 executable, DEC Alpha
  10381 +
  10382 +#------------------------------------------------------------------------------
  10383 +# plus5: file(1) magic for Plus Five's UNIX MUMPS
  10384 +#
  10385 +# XXX - byte order? Paging Hokey....
  10386 +#
  10387 +0 short 0x259 mumps avl global
  10388 +>2 byte >0 (V%d)
  10389 +>6 byte >0 with %d byte name
  10390 +>7 byte >0 and %d byte data cells
  10391 +0 short 0x25a mumps blt global
  10392 +>2 byte >0 (V%d)
  10393 +>8 short >0 - %d byte blocks
  10394 +>15 byte 0x00 - P/D format
  10395 +>15 byte 0x01 - P/K/D format
  10396 +>15 byte 0x02 - K/D format
  10397 +>15 byte >0x02 - Bad Flags
  10398 +
  10399 +#------------------------------------------------------------------------------
  10400 +# printer: file(1) magic for printer-formatted files
  10401 +#
  10402 +
  10403 +# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
  10404 +0 string %! PostScript document text
  10405 +>2 string PS-Adobe- conforming
  10406 +>>11 string >\0 at level %.3s
  10407 +>>>15 string EPS - type %s
  10408 +>>>15 string Query - type %s
  10409 +>>>15 string ExitServer - type %s
  10410 +# Some PCs have the annoying habit of adding a ^D as a document separator
  10411 +0 string \004%! PostScript document text
  10412 +>3 string PS-Adobe- conforming
  10413 +>>12 string >\0 at level %.3s
  10414 +>>>16 string EPS - type %s
  10415 +>>>16 string Query - type %s
  10416 +>>>16 string ExitServer - type %s
  10417 +0 string \033%-12345X%!PS PostScript document
  10418 +
  10419 +
  10420 +# DOS EPS Binary File Header
  10421 +# From: Ed Sznyter <ews@Black.Market.NET>
  10422 +0 belong 0xC5D0D3C6 DOS EPS Binary File
  10423 +>4 long >0 Postscript starts at byte %d
  10424 +>>8 long >0 length %d
  10425 +>>>12 long >0 Metafile starts at byte %d
  10426 +>>>>16 long >0 length %d
  10427 +>>>20 long >0 TIFF starts at byte %d
  10428 +>>>>24 long >0 length %d
  10429 +
  10430 +# Adobe's PostScript Printer Description (PPD) files
  10431 +# Yves Arrouye <arrouye@marin.fdn.fr>
  10432 +#
  10433 +0 string *PPD-Adobe: PPD file
  10434 +>13 string x \b, ve
  10435 +
  10436 +# HP Printer Job Language
  10437 +0 string \033%-12345X@PJL HP Printer Job Language data
  10438 +# HP Printer Job Language
  10439 +# The header found on Win95 HP plot files is the "Silliest Thing possible"
  10440 +# (TM)
  10441 +# Every driver puts the language at some random position, with random case
  10442 +# (LANGUAGE and Language)
  10443 +# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
  10444 +# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
  10445 +#
  10446 +0 string \033%-12345X@PJL HP Printer Job Language data
  10447 +>&0 string >\0 %s
  10448 +>>&0 string >\0 %s
  10449 +>>>&0 string >\0 %s
  10450 +>>>>&0 string >\0 %s
  10451 +#>15 string \ ENTER\ LANGUAGE\ =
  10452 +#>31 string PostScript PostScript
  10453 +
  10454 +# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
  10455 +0 string \033E\033 HP PCL printer data
  10456 +>3 string \&l0A - default page size
  10457 +>3 string \&l1A - US executive page size
  10458 +>3 string \&l2A - US letter page size
  10459 +>3 string \&l3A - US legal page size
  10460 +>3 string \&l26A - A4 page size
  10461 +>3 string \&l80A - Monarch envelope size
  10462 +>3 string \&l81A - No. 10 envelope size
  10463 +>3 string \&l90A - Intl. DL envelope size
  10464 +>3 string \&l91A - Intl. C5 envelope size
  10465 +>3 string \&l100A - Intl. B5 envelope size
  10466 +>3 string \&l-81A - No. 10 envelope size (landscape)
  10467 +>3 string \&l-90A - Intl. DL envelope size (landscape)
  10468 +
  10469 +# IMAGEN printer-ready files:
  10470 +0 string @document( Imagen printer
  10471 +# this only works if "language xxx" is first item in Imagen header.
  10472 +>10 string language\ impress (imPRESS data)
  10473 +>10 string language\ daisy (daisywheel text)
  10474 +>10 string language\ diablo (daisywheel text)
  10475 +>10 string language\ printer (line printer emulation)
  10476 +>10 string language\ tektronix (Tektronix 4014 emulation)
  10477 +# Add any other languages that your Imagen uses - remember
  10478 +# to keep the word `text' if the file is human-readable.
  10479 +# [GRR 950115: missing "postscript" or "ultrascript" (whatever it was called)]
  10480 +#
  10481 +# Now magic for IMAGEN font files...
  10482 +0 string Rast RST-format raster font data
  10483 +>45 string >0 face %s
  10484 +# From Jukka Ukkonen
  10485 +0 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data
  10486 +
  10487 +# From <mike@flyn.org>
  10488 +# These are the /etc/magic entries to decode data sent to an Epson printer.
  10489 +0 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data
  10490 +
  10491 +
  10492 +#------------------------------------------------------------------------------
  10493 +# zenographics: file(1) magic for Zenographics ZjStream printer data
  10494 +# Rick Richardson rickr@mn.rr.com
  10495 +0 string JZJZ
  10496 +>0x12 string ZZ Zenographics ZjStream printer data (big-endian)
  10497 +0 string ZJZJ
  10498 +>0x12 string ZZ Zenographics ZjStream printer data (little-endian)
  10499 +
  10500 +
  10501 +#------------------------------------------------------------------------------
  10502 +# Oak Technologies printer stream
  10503 +# Rick Richardson <rickr@mn.rr.com>
  10504 +0 string OAK
  10505 +>0x07 byte 0
  10506 +>0x0b byte 0 Oak Technologies printer stream
  10507 +
  10508 +# This would otherwise be recognized as PostScript - nick@debian.org
  10509 +0 string %!VMF SunClock's Vector Map Format data
  10510 +
  10511 +#------------------------------------------------------------------------------
  10512 +# HP LaserJet 1000 series downloadable firmware file
  10513 +0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware
  10514 +
  10515 +# From: Paolo <oopla@users.sf.net>
  10516 +# Epson ESC/Page, ESC/PageColor
  10517 +0 string \x1b\x01@EJL Epson ESC/Page language printer data
  10518 +
  10519 +#------------------------------------------------------------------------------
  10520 +# project: file(1) magic for Project management
  10521 +#
  10522 +# Magic strings for ftnchek project files. Alexander Mai
  10523 +0 string FTNCHEK_\ P project file for ftnchek
  10524 +>10 string 1 version 2.7
  10525 +>10 string 2 version 2.8 to 2.10
  10526 +>10 string 3 version 2.11 or later
  10527 +
  10528 +#------------------------------------------------------------------------------
  10529 +# psdbms: file(1) magic for psdatabase
  10530 +#
  10531 +0 belong&0xff00ffff 0x56000000 ps database
  10532 +>1 string >\0 version %s
  10533 +>4 string >\0 from kernel %s
  10534 +
  10535 +#------------------------------------------------------------------------------
  10536 +# psion: file(1) magic for Psion handhelds data
  10537 +# from: Peter Breitenlohner <peb@mppmu.mpg.de>
  10538 +#
  10539 +0 lelong 0x10000037 Psion Series 5
  10540 +>4 lelong 0x10000039 font file
  10541 +>4 lelong 0x1000003A printer driver
  10542 +>4 lelong 0x1000003B clipboard
  10543 +>4 lelong 0x10000042 multi-bitmap image
  10544 +>4 lelong 0x1000006A application information file
  10545 +>4 lelong 0x1000006D
  10546 +>>8 lelong 0x1000007D sketch image
  10547 +>>8 lelong 0x1000007E voice note
  10548 +>>8 lelong 0x1000007F word file
  10549 +>>8 lelong 0x10000085 OPL program
  10550 +>>8 lelong 0x10000088 sheet file
  10551 +>>8 lelong 0x100001C4 EasyFax initialisation file
  10552 +>4 lelong 0x10000073 OPO module
  10553 +>4 lelong 0x10000074 OPL application
  10554 +>4 lelong 0x1000008A exported multi-bitmap image
  10555 +
  10556 +0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image
  10557 +
  10558 +0 lelong 0x10000050 Psion Series 5
  10559 +>4 lelong 0x1000006D database
  10560 +>4 lelong 0x100000E4 ini file
  10561 +
  10562 +0 lelong 0x10000079 Psion Series 5 binary:
  10563 +>4 lelong 0x00000000 DLL
  10564 +>4 lelong 0x10000049 comms hardware library
  10565 +>4 lelong 0x1000004A comms protocol library
  10566 +>4 lelong 0x1000005D OPX
  10567 +>4 lelong 0x1000006C application
  10568 +>4 lelong 0x1000008D DLL
  10569 +>4 lelong 0x100000AC logical device driver
  10570 +>4 lelong 0x100000AD physical device driver
  10571 +>4 lelong 0x100000E5 file transfer protocol
  10572 +>4 lelong 0x100000E5 file transfer protocol
  10573 +>4 lelong 0x10000140 printer definition
  10574 +>4 lelong 0x10000141 printer definition
  10575 +
  10576 +0 lelong 0x1000007A Psion Series 5 executable
  10577 +
  10578 +#------------------------------------------------------------------------------
  10579 +# pulsar: file(1) magic for Pulsar POP3 daemon binary files
  10580 +#
  10581 +# http://pulsar.sourceforge.net
  10582 +# mailto:rok.papez@lugos.si
  10583 +#
  10584 +
  10585 +0 belong 0x1ee7f11e Pulsar POP3 daemon mailbox cache file.
  10586 +>4 ubelong x Version: %d.
  10587 +>8 ubelong x \b%d
  10588 +
  10589 +
  10590 +#------------------------------------------------------------------------------
  10591 +# pyramid: file(1) magic for Pyramids
  10592 +#
  10593 +# XXX - byte order?
  10594 +#
  10595 +0 long 0x50900107 Pyramid 90x family executable
  10596 +0 long 0x50900108 Pyramid 90x family pure executable
  10597 +>16 long >0 not stripped
  10598 +0 long 0x5090010b Pyramid 90x family demand paged pure executable
  10599 +>16 long >0 not stripped
  10600 +
  10601 +#------------------------------------------------------------------------------
  10602 +# python: file(1) magic for python
  10603 +#
  10604 +# From: David Necas <yeti@physics.muni.cz>
  10605 +# often the module starts with a multiline string
  10606 +0 string """ a python script text executable
  10607 +# MAGIC as specified in Python/import.c (1.5 to 2.3.0a)
  10608 +# 20121 ( YEAR - 1995 ) + MONTH + DAY (little endian followed by "\r\n"
  10609 +0 belong 0x994e0d0a python 1.5/1.6 byte-compiled
  10610 +0 belong 0x87c60d0a python 2.0 byte-compiled
  10611 +0 belong 0x2aeb0d0a python 2.1 byte-compiled
  10612 +0 belong 0x2ded0d0a python 2.2 byte-compiled
  10613 +0 belong 0x3bf20d0a python 2.3 byte-compiled
  10614 +0 belong 0x6df20d0a python 2.4 byte-compiled
  10615 +0 belong 0xb3f20d0a python 2.5 byte-compiled
  10616 +
  10617 +0 string/b #!\ /usr/bin/python python script text executable
  10618 +
  10619 +
  10620 +#------------------------------------------------------------------------------
  10621 +# file(1) magic for revision control files
  10622 +# From Hendrik Scholz <hendrik@scholz.net>
  10623 +0 string /1\ :pserver: cvs password text file
  10624 +
  10625 +# Conary changesets
  10626 +# From: Jonathan Smith <smithj@rpath.com>
  10627 +0 belong 0xea3f81bb Conary changeset data
  10628 +
  10629 +#------------------------------------------------------------------------------
  10630 +# riff: file(1) magic for RIFF format
  10631 +# See
  10632 +#
  10633 +# http://www.seanet.com/users/matts/riffmci/riffmci.htm
  10634 +#
  10635 +# AVI section extended by Patrik Rådman <patrik+file-magic@iki.fi>
  10636 +#
  10637 +0 string RIFF RIFF (little-endian) data
  10638 +# RIFF Palette format
  10639 +>8 string PAL \b, palette
  10640 +>>16 leshort x \b, version %d
  10641 +>>18 leshort x \b, %d entries
  10642 +# RIFF Device Independent Bitmap format
  10643 +>8 string RDIB \b, device-independent bitmap
  10644 +>>16 string BM
  10645 +>>>30 leshort 12 \b, OS/2 1.x format
  10646 +>>>>34 leshort x \b, %d x
  10647 +>>>>36 leshort x %d
  10648 +>>>30 leshort 64 \b, OS/2 2.x format
  10649 +>>>>34 leshort x \b, %d x
  10650 +>>>>36 leshort x %d
  10651 +>>>30 leshort 40 \b, Windows 3.x format
  10652 +>>>>34 lelong x \b, %d x
  10653 +>>>>38 lelong x %d x
  10654 +>>>>44 leshort x %d
  10655 +# RIFF MIDI format
  10656 +>8 string RMID \b, MIDI
  10657 +# RIFF Multimedia Movie File format
  10658 +>8 string RMMP \b, multimedia movie
  10659 +# RIFF wrapper for MP3
  10660 +>8 string RMP3 \b, MPEG Layer 3 audio
  10661 +# Microsoft WAVE format (*.wav)
  10662 +>8 string WAVE \b, WAVE audio
  10663 +>>20 leshort 1 \b, Microsoft PCM
  10664 +>>>34 leshort >0 \b, %d bit
  10665 +>>20 leshort 2 \b, Microsoft ADPCM
  10666 +>>20 leshort 6 \b, ITU G.711 A-law
  10667 +>>20 leshort 7 \b, ITU G.711 mu-law
  10668 +>>20 leshort 17 \b, IMA ADPCM
  10669 +>>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha)
  10670 +>>20 leshort 49 \b, GSM 6.10
  10671 +>>20 leshort 64 \b, ITU G.721 ADPCM
  10672 +>>20 leshort 80 \b, MPEG
  10673 +>>20 leshort 85 \b, MPEG Layer 3
  10674 +>>22 leshort =1 \b, mono
  10675 +>>22 leshort =2 \b, stereo
  10676 +>>22 leshort >2 \b, %d channels
  10677 +>>24 lelong >0 %d Hz
  10678 +# Corel Draw Picture
  10679 +>8 string CDRA \b, Corel Draw Picture
  10680 +# AVI == Audio Video Interleave
  10681 +>8 string AVI\040 \b, AVI
  10682 +>>12 string LIST
  10683 +>>>20 string hdrlavih
  10684 +>>>>&36 lelong x \b, %lu x
  10685 +>>>>&40 lelong x %lu,
  10686 +>>>>&4 lelong >1000000 <1 fps,
  10687 +>>>>&4 lelong 1000000 1.00 fps,
  10688 +>>>>&4 lelong 500000 2.00 fps,
  10689 +>>>>&4 lelong 333333 3.00 fps,
  10690 +>>>>&4 lelong 250000 4.00 fps,
  10691 +>>>>&4 lelong 200000 5.00 fps,
  10692 +>>>>&4 lelong 166667 6.00 fps,
  10693 +>>>>&4 lelong 142857 7.00 fps,
  10694 +>>>>&4 lelong 125000 8.00 fps,
  10695 +>>>>&4 lelong 111111 9.00 fps,
  10696 +>>>>&4 lelong 100000 10.00 fps,
  10697 +# ]9.9,10.1[
  10698 +>>>>&4 lelong <101010
  10699 +>>>>>&-4 lelong >99010
  10700 +>>>>>>&-4 lelong !100000 ~10 fps,
  10701 +>>>>&4 lelong 83333 12.00 fps,
  10702 +# ]11.9,12.1[
  10703 +>>>>&4 lelong <84034
  10704 +>>>>>&-4 lelong >82645
  10705 +>>>>>>&-4 lelong !83333 ~12 fps,
  10706 +>>>>&4 lelong 66667 15.00 fps,
  10707 +# ]14.9,15.1[
  10708 +>>>>&4 lelong <67114
  10709 +>>>>>&-4 lelong >66225
  10710 +>>>>>>&-4 lelong !66667 ~15 fps,
  10711 +>>>>&4 lelong 50000 20.00 fps,
  10712 +>>>>&4 lelong 41708 23.98 fps,
  10713 +>>>>&4 lelong 41667 24.00 fps,
  10714 +# ]23.9,24.1[
  10715 +>>>>&4 lelong <41841
  10716 +>>>>>&-4 lelong >41494
  10717 +>>>>>>&-4 lelong !41708
  10718 +>>>>>>>&-4 lelong !41667 ~24 fps,
  10719 +>>>>&4 lelong 40000 25.00 fps,
  10720 +# ]24.9,25.1[
  10721 +>>>>&4 lelong <40161
  10722 +>>>>>&-4 lelong >39841
  10723 +>>>>>>&-4 lelong !40000 ~25 fps,
  10724 +>>>>&4 lelong 33367 29.97 fps,
  10725 +>>>>&4 lelong 33333 30.00 fps,
  10726 +# ]29.9,30.1[
  10727 +>>>>&4 lelong <33445
  10728 +>>>>>&-4 lelong >33223
  10729 +>>>>>>&-4 lelong !33367
  10730 +>>>>>>>&-4 lelong !33333 ~30 fps,
  10731 +>>>>&4 lelong <32224 >30 fps,
  10732 +##>>>>&4 lelong x (%lu)
  10733 +##>>>>&20 lelong x %lu frames,
  10734 +# Note: The tests below assume that the AVI has 1 or 2 streams,
  10735 +# "vids" optionally followed by "auds".
  10736 +# (Should cover 99.9% of all AVIs.)
  10737 +# assuming avih length = 56
  10738 +>>>88 string LIST
  10739 +>>>>96 string strlstrh
  10740 +>>>>>108 string vids video:
  10741 +>>>>>>&0 lelong 0 uncompressed
  10742 +# skip past vids strh
  10743 +>>>>>>(104.l+108) string strf
  10744 +>>>>>>>(104.l+132) lelong 1 RLE 8bpp
  10745 +>>>>>>>(104.l+132) string/c cvid Cinepak
  10746 +>>>>>>>(104.l+132) string/c i263 Intel I.263
  10747 +>>>>>>>(104.l+132) string/c iv32 Indeo 3.2
  10748 +>>>>>>>(104.l+132) string/c iv41 Indeo 4.1
  10749 +>>>>>>>(104.l+132) string/c iv50 Indeo 5.0
  10750 +>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2
  10751 +>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3
  10752 +>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4
  10753 +>>>>>>>(104.l+132) string/c mjpg Motion JPEG
  10754 +>>>>>>>(104.l+132) string/c div3 DivX 3
  10755 +>>>>>>>>112 string/c div3 Low-Motion
  10756 +>>>>>>>>112 string/c div4 Fast-Motion
  10757 +>>>>>>>(104.l+132) string/c divx DivX 4
  10758 +>>>>>>>(104.l+132) string/c dx50 DivX 5
  10759 +>>>>>>>(104.l+132) string/c xvid XviD
  10760 +>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9
  10761 +>>>>>>>(104.l+132) string/c h264 X.264
  10762 +>>>>>>>(104.l+132) lelong 0
  10763 +##>>>>>>>(104.l+132) string x (%.4s)
  10764 +# skip past first (video) LIST
  10765 +>>>>(92.l+96) string LIST
  10766 +>>>>>(92.l+104) string strlstrh
  10767 +>>>>>>(92.l+116) string auds \b, audio:
  10768 +# auds strh length = 56:
  10769 +>>>>>>>(92.l+172) string strf
  10770 +>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM
  10771 +>>>>>>>>(92.l+180) leshort 0x0002 ADPCM
  10772 +>>>>>>>>(92.l+180) leshort 0x0006 aLaw
  10773 +>>>>>>>>(92.l+180) leshort 0x0007 uLaw
  10774 +>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2
  10775 +>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3
  10776 +>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3
  10777 +>>>>>>>>(92.l+180) leshort 0x0161 DivX
  10778 +##>>>>>>>>(92.l+180) leshort x (0x%.4x)
  10779 +>>>>>>>>(92.l+182) leshort 1 (mono,
  10780 +>>>>>>>>(92.l+182) leshort 2 (stereo,
  10781 +>>>>>>>>(92.l+182) leshort >2 (%d channels,
  10782 +>>>>>>>>(92.l+184) lelong x %d Hz)
  10783 +# auds strh length = 64:
  10784 +>>>>>>>(92.l+180) string strf
  10785 +>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM
  10786 +>>>>>>>>(92.l+188) leshort 0x0002 ADPCM
  10787 +>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3
  10788 +>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3
  10789 +>>>>>>>>(92.l+188) leshort 0x0161 DivX
  10790 +##>>>>>>>>(92.l+188) leshort x (0x%.4x)
  10791 +>>>>>>>>(92.l+190) leshort 1 (mono,
  10792 +>>>>>>>>(92.l+190) leshort 2 (stereo,
  10793 +>>>>>>>>(92.l+190) leshort >2 (%d channels,
  10794 +>>>>>>>>(92.l+192) lelong x %d Hz)
  10795 +# Animated Cursor format
  10796 +>8 string ACON \b, animated cursor
  10797 +# SoundFont 2 <mpruett@sgi.com>
  10798 +>8 string sfbk SoundFont/Bank
  10799 +# MPEG-1 wrapped in a RIFF, apparently
  10800 +>8 string CDXA \b, wrapped MPEG-1 (CDXA)
  10801 +>8 string 4XMV \b, 4X Movie file
  10802 +
  10803 +#
  10804 +# XXX - some of the below may only appear in little-endian form.
  10805 +#
  10806 +# Also "MV93" appears to be for one form of Macromedia Director
  10807 +# files, and "GDMF" appears to be another multimedia format.
  10808 +#
  10809 +0 string RIFX RIFF (big-endian) data
  10810 +# RIFF Palette format
  10811 +>8 string PAL \b, palette
  10812 +>>16 beshort x \b, version %d
  10813 +>>18 beshort x \b, %d entries
  10814 +# RIFF Device Independent Bitmap format
  10815 +>8 string RDIB \b, device-independent bitmap
  10816 +>>16 string BM
  10817 +>>>30 beshort 12 \b, OS/2 1.x format
  10818 +>>>>34 beshort x \b, %d x
  10819 +>>>>36 beshort x %d
  10820 +>>>30 beshort 64 \b, OS/2 2.x format
  10821 +>>>>34 beshort x \b, %d x
  10822 +>>>>36 beshort x %d
  10823 +>>>30 beshort 40 \b, Windows 3.x format
  10824 +>>>>34 belong x \b, %d x
  10825 +>>>>38 belong x %d x
  10826 +>>>>44 beshort x %d
  10827 +# RIFF MIDI format
  10828 +>8 string RMID \b, MIDI
  10829 +# RIFF Multimedia Movie File format
  10830 +>8 string RMMP \b, multimedia movie
  10831 +# Microsoft WAVE format (*.wav)
  10832 +>8 string WAVE \b, WAVE audio
  10833 +>>20 leshort 1 \b, Microsoft PCM
  10834 +>>>34 leshort >0 \b, %d bit
  10835 +>>22 beshort =1 \b, mono
  10836 +>>22 beshort =2 \b, stereo
  10837 +>>22 beshort >2 \b, %d channels
  10838 +>>24 belong >0 %d Hz
  10839 +# Corel Draw Picture
  10840 +>8 string CDRA \b, Corel Draw Picture
  10841 +# AVI == Audio Video Interleave
  10842 +>8 string AVI\040 \b, AVI
  10843 +# Animated Cursor format
  10844 +>8 string ACON \b, animated cursor
  10845 +# Notation Interchange File Format (big-endian only)
  10846 +>8 string NIFF \b, Notation Interchange File Format
  10847 +# SoundFont 2 <mpruett@sgi.com>
  10848 +>8 string sfbk SoundFont/Bank
  10849 +#------------------------------------------------------------------------------
  10850 +#
  10851 +# RPM: file(1) magic for Red Hat Packages Erik Troan (ewt@redhat.com)
  10852 +#
  10853 +0 beshort 0xedab
  10854 +>2 beshort 0xeedb RPM
  10855 +>>4 byte x v%d
  10856 +>>6 beshort 0 bin
  10857 +>>6 beshort 1 src
  10858 +>>8 beshort 1 i386
  10859 +>>8 beshort 2 Alpha
  10860 +>>8 beshort 3 Sparc
  10861 +>>8 beshort 4 MIPS
  10862 +>>8 beshort 5 PowerPC
  10863 +>>8 beshort 6 68000
  10864 +>>8 beshort 7 SGI
  10865 +>>8 beshort 8 RS6000
  10866 +>>8 beshort 9 IA64
  10867 +>>8 beshort 10 Sparc64
  10868 +>>8 beshort 11 MIPSel
  10869 +>>8 beshort 12 ARM
  10870 +>>10 string x %s
  10871 +
  10872 +#------------------------------------------------------------------------------
  10873 +# rtf: file(1) magic for Rich Text Format (RTF)
  10874 +#
  10875 +# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
  10876 +#
  10877 +0 string {\\rtf Rich Text Format data,
  10878 +>5 byte x version %c,
  10879 +>6 string \\ansi ANSI
  10880 +>6 string \\mac Apple Macintosh
  10881 +>6 string \\pc IBM PC, code page 437
  10882 +>6 string \\pca IBM PS/2, code page 850
  10883 +
  10884 +#------------------------------------------------------------------------------
  10885 +# sc: file(1) magic for "sc" spreadsheet
  10886 +#
  10887 +38 string Spreadsheet sc spreadsheet file
  10888 +
  10889 +#------------------------------------------------------------------------------
  10890 +# sccs: file(1) magic for SCCS archives
  10891 +#
  10892 +# SCCS archive structure:
  10893 +# \001h01207
  10894 +# \001s 00276/00000/00000
  10895 +# \001d D 1.1 87/09/23 08:09:20 ian 1 0
  10896 +# \001c date and time created 87/09/23 08:09:20 by ian
  10897 +# \001e
  10898 +# \001u
  10899 +# \001U
  10900 +# ... etc.
  10901 +# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
  10902 +# *Sigh*. And these both came from various parts of the USG.
  10903 +# Maybe we should just switch everybody from SCCS to RCS!
  10904 +# Further, you can't just say '\001h0', because the five-digit number
  10905 +# is a checksum that could (presumably) have any leading digit,
  10906 +# and we don't have regular expression matching yet.
  10907 +# Hence the following official kludge:
  10908 +8 string \001s\ SCCS archive data
  10909 +
  10910 +#------------------------------------------------------------------------------
  10911 +# sendmail: file(1) magic for sendmail config files
  10912 +#
  10913 +# XXX - byte order?
  10914 +#
  10915 +0 byte 046 Sendmail frozen configuration
  10916 +>16 string >\0 - version %s
  10917 +0 short 0x271c Sendmail frozen configuration
  10918 +>16 string >\0 - version %s
  10919 +
  10920 +#------------------------------------------------------------------------------
  10921 +# sendmail: file(1) magic for sendmail m4(1) files
  10922 +#
  10923 +# From Hendrik Scholz <hendrik@scholz.net>
  10924 +# i.e. files in /usr/share/sendmail/cf/
  10925 +#
  10926 +0 string divert(-1)\n sendmail m4 text file
  10927 +
  10928 +
  10929 +#------------------------------------------------------------------------------
  10930 +# sequent: file(1) magic for Sequent machines
  10931 +#
  10932 +# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
  10933 +# For Sequent's multiprocessor systems (incomplete).
  10934 +0 lelong 0x00ea BALANCE NS32000 .o
  10935 +>16 lelong >0 not stripped
  10936 +>124 lelong >0 version %ld
  10937 +0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)
  10938 +>16 lelong >0 not stripped
  10939 +>124 lelong >0 version %ld
  10940 +0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)
  10941 +>16 lelong >0 not stripped
  10942 +>124 lelong >0 version %ld
  10943 +0 lelong 0x30ea BALANCE NS32000 standalone executable
  10944 +>16 lelong >0 not stripped
  10945 +>124 lelong >0 version %ld
  10946 +#
  10947 +# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
  10948 +# Symmetry magic nums will not be reached if DOS COM comes before them;
  10949 +# byte 0xeb is matched before these get a chance.
  10950 +0 leshort 0x12eb SYMMETRY i386 .o
  10951 +>16 lelong >0 not stripped
  10952 +>124 lelong >0 version %ld
  10953 +0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)
  10954 +>16 lelong >0 not stripped
  10955 +>124 lelong >0 version %ld
  10956 +0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)
  10957 +>16 lelong >0 not stripped
  10958 +>124 lelong >0 version %ld
  10959 +0 leshort 0x42eb SYMMETRY i386 standalone executable
  10960 +>16 lelong >0 not stripped
  10961 +>124 lelong >0 version %ld
  10962 +
  10963 +#------------------------------------------------------------------------------
  10964 +# sgi: file(1) magic for Silicon Graphics applications
  10965 +
  10966 +#
  10967 +#
  10968 +# Performance Co-Pilot file types
  10969 +0 string PmNs PCP compiled namespace (V.0)
  10970 +0 string PmN PCP compiled namespace
  10971 +>3 string >\0 (V.%1.1s)
  10972 +3 lelong 0x84500526 PCP archive
  10973 +>7 byte x (V.%d)
  10974 +>20 lelong -2 temporal index
  10975 +>20 lelong -1 metadata
  10976 +>20 lelong 0 log volume #0
  10977 +>20 lelong >0 log volume #%ld
  10978 +>24 string >\0 host: %s
  10979 +0 string PCPFolio PCP
  10980 +>9 string Version: Archive Folio
  10981 +>18 string >\0 (V.%s)
  10982 +0 string #pmchart PCP pmchart view
  10983 +>9 string Version
  10984 +>17 string >\0 (V%-3.3s)
  10985 +0 string pmview PCP pmview config
  10986 +>7 string Version
  10987 +>15 string >\0 (V%-3.3s)
  10988 +0 string #pmlogger PCP pmlogger config
  10989 +>10 string Version
  10990 +>18 string >\0 (V%1.1s)
  10991 +0 string PcPh PCP Help
  10992 +>4 string 1 Index
  10993 +>4 string 2 Text
  10994 +>5 string >\0 (V.%1.1s)
  10995 +0 string #pmieconf-rules PCP pmieconf rules
  10996 +>16 string >\0 (V.%1.1s)
  10997 +3 string pmieconf-pmie PCP pmie config
  10998 +>17 string >\0 (V.%1.1s)
  10999 +
  11000 +# SpeedShop data files
  11001 +0 lelong 0x13130303 SpeedShop data file
  11002 +
  11003 +# mdbm files
  11004 +0 lelong 0x01023962 mdbm file, version 0 (obsolete)
  11005 +0 string mdbm mdbm file,
  11006 +>5 byte x version %d,
  11007 +>6 byte x 2^%d pages,
  11008 +>7 byte x pagesize 2^%d,
  11009 +>17 byte x hash %d,
  11010 +>11 byte x dataformat %d
  11011 +
  11012 +# Alias Maya files
  11013 +0 string //Maya ASCII Alias Maya Ascii File,
  11014 +>13 string >\0 version %s
  11015 +8 string MAYAFOR4 Alias Maya Binary File,
  11016 +>32 string >\0 version %s scene
  11017 +8 string MayaFOR4 Alias Maya Binary File,
  11018 +>32 string >\0 version %s scene
  11019 +8 string CIMG Alias Maya Image File
  11020 +8 string DEEP Alias Maya Image File
  11021 +
  11022 +#------------------------------------------------------------------------------
  11023 +# sgml: file(1) magic for Standard Generalized Markup Language
  11024 +# HyperText Markup Language (HTML) is an SGML document type,
  11025 +# from Daniel Quinlan (quinlan@yggdrasil.com)
  11026 +# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
  11027 +0 string/cB \<!DOCTYPE\ html HTML document text
  11028 +0 string/cb \<head HTML document text
  11029 +0 string/cb \<title HTML document text
  11030 +0 string/cb \<html HTML document text
  11031 +
  11032 +# Extensible markup language (XML), a subset of SGML
  11033 +# from Marc Prud'hommeaux (marc@apocalypse.org)
  11034 +0 string/cb \<?xml XML document text
  11035 +0 string \<?xml\ version\ " XML
  11036 +0 string \<?xml\ version=" XML
  11037 +0 string \<?xml\ version=' XML
  11038 +>15 string >\0 %.3s document text
  11039 +>>23 string \<xsl:stylesheet (XSL stylesheet)
  11040 +>>24 string \<xsl:stylesheet (XSL stylesheet)
  11041 +0 string/b \<?xml XML document text
  11042 +0 string/cb \<?xml broken XML document text
  11043 +
  11044 +
  11045 +# SGML, mostly from rph@sq
  11046 +0 string/cb \<!doctype exported SGML document text
  11047 +0 string/cb \<!subdoc exported SGML subdocument text
  11048 +0 string/cb \<!-- exported SGML document text
  11049 +
  11050 +# Web browser cookie files
  11051 +# (Mozilla, Galeon, Netscape 4, Konqueror..)
  11052 +# Ulf Harnhammar <ulfh@update.uu.se>
  11053 +0 string #\ HTTP\ Cookie\ File Web browser cookie text
  11054 +0 string #\ Netscape\ HTTP\ Cookie\ File Netscape cookie text
  11055 +0 string #\ KDE\ Cookie\ File Konqueror cookie text
  11056 +
  11057 +#------------------------------------------------------------------------
  11058 +# file(1) magic for sharc files
  11059 +#
  11060 +# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
  11061 +# FutureGroove Music (dsp@futuregroove.de)
  11062 +
  11063 +#------------------------------------------------------------------------
  11064 +0 string Draw RiscOS Drawfile
  11065 +0 string PACK RiscOS PackdDir archive
  11066 +
  11067 +#------------------------------------------------------------------------
  11068 +# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
  11069 +
  11070 +0 string =! Assembler source
  11071 +0 string Analog ADi asm listing file
  11072 +0 string .SYSTEM SHARC architecture file
  11073 +0 string .system SHARC architecture file
  11074 +
  11075 +0 leshort 0x521C SHARC COFF binary
  11076 +>2 leshort >1 , %hd sections
  11077 +>>12 lelong >0 , not stripped
  11078 +
  11079 +#------------------------------------------------------------------------------
  11080 +# sinclair: file(1) sinclair QL
  11081 +
  11082 +# additions to /etc/magic by Thomas M. Ott (ThMO)
  11083 +
  11084 +# Sinclair QL floppy disk formats (ThMO)
  11085 +0 string =QL5 QL disk dump data,
  11086 +>3 string =A 720 KB,
  11087 +>3 string =B 1.44 MB,
  11088 +>3 string =C 3.2 MB,
  11089 +>4 string >\0 label:%.10s
  11090 +
  11091 +# Sinclair QL OS dump (ThMO)
  11092 +# (NOTE: if `file' would be able to use indirect references in a endian format
  11093 +# differing from the natural host format, this could be written more
  11094 +# reliably and faster...)
  11095 +#
  11096 +# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
  11097 +# than the first 8K of a file... #-(
  11098 +#
  11099 +#0 belong =0x30000
  11100 +#>49124 belong <47104
  11101 +#>>49128 belong <47104
  11102 +#>>>49132 belong <47104
  11103 +#>>>>49136 belong <47104 QL OS dump data,
  11104 +#>>>>>49148 string >\0 type %.3s,
  11105 +#>>>>>49142 string >\0 version %.4s
  11106 +
  11107 +# Sinclair QL firmware executables (ThMO)
  11108 +0 string NqNqNq`\004 QL firmware executable (BCPL)
  11109 +
  11110 +# Sinclair QL libraries (was ThMO)
  11111 +0 beshort 0xFB01 QDOS object
  11112 +>2 pstring x '%s'
  11113 +
  11114 +# Sinclair QL executables (was ThMO)
  11115 +4 belong 0x4AFB QDOS executable
  11116 +>9 pstring x '%s'
  11117 +
  11118 +# Sinclair QL ROM (ThMO)
  11119 +0 belong =0x4AFB0001 QL plugin-ROM data,
  11120 +>9 pstring =\0 un-named
  11121 +>9 pstring >\0 named: %s
  11122 +
  11123 +#------------------------------------------------------------------------------
  11124 +# Sketch Drawings: http://sketch.sourceforge.net/
  11125 +# From: Edwin Mons <e@ik.nu>
  11126 +0 string ##Sketch Sketch document text
  11127 +
  11128 +#-----------------------------------------------
  11129 +# GNU Smalltalk image, starting at version 1.6.2
  11130 +# From: catull_us@yahoo.com
  11131 +#
  11132 +0 string GSTIm\0\0 GNU SmallTalk
  11133 +# little-endian
  11134 +>7 byte&1 =0 LE image version
  11135 +>>10 byte x %d.
  11136 +>>9 byte x \b%d.
  11137 +>>8 byte x \b%d
  11138 +#>>12 lelong x , data: %ld
  11139 +#>>16 lelong x , table: %ld
  11140 +#>>20 lelong x , memory: %ld
  11141 +# big-endian
  11142 +>7 byte&1 =1 BE image version
  11143 +>>8 byte x %d.
  11144 +>>9 byte x \b%d.
  11145 +>>10 byte x \b%d
  11146 +#>>12 belong x , data: %ld
  11147 +#>>16 belong x , table: %ld
  11148 +#>>20 belong x , memory: %ld
  11149 +
  11150 +
  11151 +
  11152 +#------------------------------------------------------------------------------
  11153 +# sniffer: file(1) magic for packet capture files
  11154 +#
  11155 +# From: guy@alum.mit.edu (Guy Harris)
  11156 +#
  11157 +
  11158 +#
  11159 +# Microsoft Network Monitor 1.x capture files.
  11160 +#
  11161 +0 string RTSS NetMon capture file
  11162 +>5 byte x - version %d
  11163 +>4 byte x \b.%d
  11164 +>6 leshort 0 (Unknown)
  11165 +>6 leshort 1 (Ethernet)
  11166 +>6 leshort 2 (Token Ring)
  11167 +>6 leshort 3 (FDDI)
  11168 +>6 leshort 4 (ATM)
  11169 +
  11170 +#
  11171 +# Microsoft Network Monitor 2.x capture files.
  11172 +#
  11173 +0 string GMBU NetMon capture file
  11174 +>5 byte x - version %d
  11175 +>4 byte x \b.%d
  11176 +>6 leshort 0 (Unknown)
  11177 +>6 leshort 1 (Ethernet)
  11178 +>6 leshort 2 (Token Ring)
  11179 +>6 leshort 3 (FDDI)
  11180 +>6 leshort 4 (ATM)
  11181 +
  11182 +#
  11183 +# Network General Sniffer capture files.
  11184 +# Sorry, make that "Network Associates Sniffer capture files."
  11185 +# Sorry, make that "Network General old DOS Sniffer capture files."
  11186 +#
  11187 +0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file
  11188 +>33 byte 2 (compressed)
  11189 +>23 leshort x - version %d
  11190 +>25 leshort x \b.%d
  11191 +>32 byte 0 (Token Ring)
  11192 +>32 byte 1 (Ethernet)
  11193 +>32 byte 2 (ARCNET)
  11194 +>32 byte 3 (StarLAN)
  11195 +>32 byte 4 (PC Network broadband)
  11196 +>32 byte 5 (LocalTalk)
  11197 +>32 byte 6 (Znet)
  11198 +>32 byte 7 (Internetwork Analyzer)
  11199 +>32 byte 9 (FDDI)
  11200 +>32 byte 10 (ATM)
  11201 +
  11202 +#
  11203 +# Cinco Networks NetXRay capture files.
  11204 +# Sorry, make that "Network General Sniffer Basic capture files."
  11205 +# Sorry, make that "Network Associates Sniffer Basic capture files."
  11206 +# Sorry, make that "Network Associates Sniffer Basic, and Windows
  11207 +# Sniffer Pro", capture files."
  11208 +# Sorry, make that "Network General Sniffer capture files."
  11209 +#
  11210 +0 string XCP\0 NetXRay capture file
  11211 +>4 string >\0 - version %s
  11212 +>44 leshort 0 (Ethernet)
  11213 +>44 leshort 1 (Token Ring)
  11214 +>44 leshort 2 (FDDI)
  11215 +>44 leshort 3 (WAN)
  11216 +>44 leshort 8 (ATM)
  11217 +>44 leshort 9 (802.11)
  11218 +
  11219 +#
  11220 +# "libpcap" capture files.
  11221 +# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
  11222 +# the main program that uses that format, but there are other programs
  11223 +# that use "libpcap", or that use the same capture file format.)
  11224 +#
  11225 +0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
  11226 +>4 beshort x - version %d
  11227 +>6 beshort x \b.%d
  11228 +>20 belong 0 (No link-layer encapsulation
  11229 +>20 belong 1 (Ethernet
  11230 +>20 belong 2 (3Mb Ethernet
  11231 +>20 belong 3 (AX.25
  11232 +>20 belong 4 (ProNET
  11233 +>20 belong 5 (CHAOS
  11234 +>20 belong 6 (Token Ring
  11235 +>20 belong 7 (BSD ARCNET
  11236 +>20 belong 8 (SLIP
  11237 +>20 belong 9 (PPP
  11238 +>20 belong 10 (FDDI
  11239 +>20 belong 11 (RFC 1483 ATM
  11240 +>20 belong 12 (raw IP
  11241 +>20 belong 13 (BSD/OS SLIP
  11242 +>20 belong 14 (BSD/OS PPP
  11243 +>20 belong 19 (Linux ATM Classical IP
  11244 +>20 belong 50 (PPP or Cisco HDLC
  11245 +>20 belong 51 (PPP-over-Ethernet
  11246 +>20 belong 99 (Symantec Enterprise Firewall
  11247 +>20 belong 100 (RFC 1483 ATM
  11248 +>20 belong 101 (raw IP
  11249 +>20 belong 102 (BSD/OS SLIP
  11250 +>20 belong 103 (BSD/OS PPP
  11251 +>20 belong 104 (BSD/OS Cisco HDLC
  11252 +>20 belong 105 (802.11
  11253 +>20 belong 106 (Linux Classical IP over ATM
  11254 +>20 belong 107 (Frame Relay
  11255 +>20 belong 108 (OpenBSD loopback
  11256 +>20 belong 109 (OpenBSD IPsec encrypted
  11257 +>20 belong 112 (Cisco HDLC
  11258 +>20 belong 113 (Linux "cooked"
  11259 +>20 belong 114 (LocalTalk
  11260 +>20 belong 117 (OpenBSD PFLOG
  11261 +>20 belong 119 (802.11 with Prism header
  11262 +>20 belong 122 (RFC 2625 IP over Fibre Channel
  11263 +>20 belong 123 (SunATM
  11264 +>20 belong 127 (802.11 with radiotap header
  11265 +>20 belong 129 (Linux ARCNET
  11266 +>20 belong 138 (Apple IP over IEEE 1394
  11267 +>20 belong 140 (MTP2
  11268 +>20 belong 141 (MTP3
  11269 +>20 belong 143 (DOCSIS
  11270 +>20 belong 144 (IrDA
  11271 +>20 belong 147 (Private use 0
  11272 +>20 belong 148 (Private use 1
  11273 +>20 belong 149 (Private use 2
  11274 +>20 belong 150 (Private use 3
  11275 +>20 belong 151 (Private use 4
  11276 +>20 belong 152 (Private use 5
  11277 +>20 belong 153 (Private use 6
  11278 +>20 belong 154 (Private use 7
  11279 +>20 belong 155 (Private use 8
  11280 +>20 belong 156 (Private use 9
  11281 +>20 belong 157 (Private use 10
  11282 +>20 belong 158 (Private use 11
  11283 +>20 belong 159 (Private use 12
  11284 +>20 belong 160 (Private use 13
  11285 +>20 belong 161 (Private use 14
  11286 +>20 belong 162 (Private use 15
  11287 +>20 belong 163 (802.11 with AVS header
  11288 +>16 belong x \b, capture length %d)
  11289 +0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
  11290 +>4 leshort x - version %d
  11291 +>6 leshort x \b.%d
  11292 +>20 lelong 0 (No link-layer encapsulation
  11293 +>20 lelong 1 (Ethernet
  11294 +>20 lelong 2 (3Mb Ethernet
  11295 +>20 lelong 3 (AX.25
  11296 +>20 lelong 4 (ProNET
  11297 +>20 lelong 5 (CHAOS
  11298 +>20 lelong 6 (Token Ring
  11299 +>20 lelong 7 (ARCNET
  11300 +>20 lelong 8 (SLIP
  11301 +>20 lelong 9 (PPP
  11302 +>20 lelong 10 (FDDI
  11303 +>20 lelong 11 (RFC 1483 ATM
  11304 +>20 lelong 12 (raw IP
  11305 +>20 lelong 13 (BSD/OS SLIP
  11306 +>20 lelong 14 (BSD/OS PPP
  11307 +>20 lelong 19 (Linux ATM Classical IP
  11308 +>20 lelong 50 (PPP or Cisco HDLC
  11309 +>20 lelong 51 (PPP-over-Ethernet
  11310 +>20 lelong 99 (Symantec Enterprise Firewall
  11311 +>20 lelong 100 (RFC 1483 ATM
  11312 +>20 lelong 101 (raw IP
  11313 +>20 lelong 102 (BSD/OS SLIP
  11314 +>20 lelong 103 (BSD/OS PPP
  11315 +>20 lelong 104 (BSD/OS Cisco HDLC
  11316 +>20 lelong 105 (802.11
  11317 +>20 lelong 106 (Linux Classical IP over ATM
  11318 +>20 lelong 107 (Frame Relay
  11319 +>20 lelong 108 (OpenBSD loopback
  11320 +>20 lelong 109 (OpenBSD IPsec encrypted
  11321 +>20 lelong 112 (Cisco HDLC
  11322 +>20 lelong 113 (Linux "cooked"
  11323 +>20 lelong 114 (LocalTalk
  11324 +>20 lelong 117 (OpenBSD PFLOG
  11325 +>20 lelong 119 (802.11 with Prism header
  11326 +>20 lelong 122 (RFC 2625 IP over Fibre Channel
  11327 +>20 lelong 123 (SunATM
  11328 +>20 lelong 127 (802.11 with radiotap header
  11329 +>20 lelong 129 (Linux ARCNET
  11330 +>20 lelong 138 (Apple IP over IEEE 1394
  11331 +>20 lelong 140 (MTP2
  11332 +>20 lelong 141 (MTP3
  11333 +>20 lelong 143 (DOCSIS
  11334 +>20 lelong 144 (IrDA
  11335 +>20 lelong 147 (Private use 0
  11336 +>20 lelong 148 (Private use 1
  11337 +>20 lelong 149 (Private use 2
  11338 +>20 lelong 150 (Private use 3
  11339 +>20 lelong 151 (Private use 4
  11340 +>20 lelong 152 (Private use 5
  11341 +>20 lelong 153 (Private use 6
  11342 +>20 lelong 154 (Private use 7
  11343 +>20 lelong 155 (Private use 8
  11344 +>20 lelong 156 (Private use 9
  11345 +>20 lelong 157 (Private use 10
  11346 +>20 lelong 158 (Private use 11
  11347 +>20 lelong 159 (Private use 12
  11348 +>20 lelong 160 (Private use 13
  11349 +>20 lelong 161 (Private use 14
  11350 +>20 lelong 162 (Private use 15
  11351 +>20 lelong 163 (802.11 with AVS header
  11352 +>16 lelong x \b, capture length %d)
  11353 +
  11354 +#
  11355 +# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
  11356 +# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
  11357 +# the main program that uses that format, but there are other programs
  11358 +# that use "libpcap", or that use the same capture file format.)
  11359 +#
  11360 +0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian)
  11361 +>4 beshort x - version %d
  11362 +>6 beshort x \b.%d
  11363 +>20 belong 0 (No link-layer encapsulation
  11364 +>20 belong 1 (Ethernet
  11365 +>20 belong 2 (3Mb Ethernet
  11366 +>20 belong 3 (AX.25
  11367 +>20 belong 4 (ProNET
  11368 +>20 belong 5 (CHAOS
  11369 +>20 belong 6 (Token Ring
  11370 +>20 belong 7 (ARCNET
  11371 +>20 belong 8 (SLIP
  11372 +>20 belong 9 (PPP
  11373 +>20 belong 10 (FDDI
  11374 +>20 belong 11 (RFC 1483 ATM
  11375 +>20 belong 12 (raw IP
  11376 +>20 belong 13 (BSD/OS SLIP
  11377 +>20 belong 14 (BSD/OS PPP
  11378 +>16 belong x \b, capture length %d)
  11379 +0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian)
  11380 +>4 leshort x - version %d
  11381 +>6 leshort x \b.%d
  11382 +>20 lelong 0 (No link-layer encapsulation
  11383 +>20 lelong 1 (Ethernet
  11384 +>20 lelong 2 (3Mb Ethernet
  11385 +>20 lelong 3 (AX.25
  11386 +>20 lelong 4 (ProNET
  11387 +>20 lelong 5 (CHAOS
  11388 +>20 lelong 6 (Token Ring
  11389 +>20 lelong 7 (ARCNET
  11390 +>20 lelong 8 (SLIP
  11391 +>20 lelong 9 (PPP
  11392 +>20 lelong 10 (FDDI
  11393 +>20 lelong 11 (RFC 1483 ATM
  11394 +>20 lelong 12 (raw IP
  11395 +>20 lelong 13 (BSD/OS SLIP
  11396 +>20 lelong 14 (BSD/OS PPP
  11397 +>16 lelong x \b, capture length %d)
  11398 +
  11399 +#
  11400 +# AIX "iptrace" capture files.
  11401 +#
  11402 +0 string iptrace\ 1.0 "iptrace" capture file
  11403 +0 string iptrace\ 2.0 "iptrace" capture file
  11404 +
  11405 +#
  11406 +# Novell LANalyzer capture files.
  11407 +#
  11408 +0 leshort 0x1001 LANalyzer capture file
  11409 +0 leshort 0x1007 LANalyzer capture file
  11410 +
  11411 +#
  11412 +# HP-UX "nettl" capture files.
  11413 +#
  11414 +0 string \x54\x52\x00\x64\x00 "nettl" capture file
  11415 +
  11416 +#
  11417 +# RADCOM WAN/LAN Analyzer capture files.
  11418 +#
  11419 +0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file
  11420 +
  11421 +#
  11422 +# NetStumbler log files. Not really packets, per se, but about as
  11423 +# close as you can get. These are log files from NetStumbler, a
  11424 +# Windows program, that scans for 802.11b networks.
  11425 +#
  11426 +0 string NetS NetStumbler log file
  11427 +>8 lelong x \b, %d stations found
  11428 +
  11429 +#
  11430 +# EtherPeek/AiroPeek "version 9" capture files.
  11431 +#
  11432 +0 string \177ver EtherPeek/AiroPeek capture file
  11433 +
  11434 +#
  11435 +# Visual Networks traffic capture files.
  11436 +#
  11437 +0 string \x05VNF Visual Networks traffic capture file
  11438 +
  11439 +#
  11440 +# Network Instruments Observer capture files.
  11441 +#
  11442 +0 string ObserverPktBuffe Network Instruments Observer capture file
  11443 +
  11444 +#
  11445 +# Files from Accellent Group's 5View products.
  11446 +#
  11447 +0 string \xaa\xaa\xaa\xaa 5View capture file
  11448 +
  11449 +#------------------------------------------------------------------------------
  11450 +# Dyadic: file(1) magic for Dyalog APL.
  11451 +#
  11452 +0 byte 0xaa
  11453 +>1 byte <4 Dyalog APL
  11454 +>>1 byte 0x00 incomplete workspace
  11455 +>>1 byte 0x01 component file
  11456 +>>1 byte 0x02 external variable
  11457 +>>1 byte 0x03 workspace
  11458 +>>2 byte x version %d
  11459 +>>3 byte x .%d
  11460 +
  11461 +#------------------------------------------------------------------------------
  11462 +# scientific: file(1) magic for scientific formats
  11463 +#
  11464 +# From: Joe Krahn <krahn@niehs.nih.gov>
  11465 +
  11466 +########################################################
  11467 +# CCP4 data and plot files:
  11468 +0 string MTZ\040 MTZ reflection file
  11469 +
  11470 +92 string PLOT%%84 Plot84 plotting file
  11471 +>52 byte 1 , Little-endian
  11472 +>55 byte 1 , Big-endian
  11473 +
  11474 +########################################################
  11475 +# Electron density MAP/MASK formats
  11476 +
  11477 +0 string EZD_MAP NEWEZD Electron Density Map
  11478 +109 string MAP\040( Old EZD Electron Density Map
  11479 +
  11480 +0 string/c :-)\040Origin BRIX Electron Density Map
  11481 +>170 string >0 , Sigma:%.12s
  11482 +#>4 string >0 %.178s
  11483 +#>4 addr x %.178s
  11484 +
  11485 +7 string 18\040!NTITLE XPLOR ASCII Electron Density Map
  11486 +9 string \040!NTITLE\012\040REMARK CNS ASCII electron density map
  11487 +
  11488 +208 string MAP\040 CCP4 Electron Density Map
  11489 +# Assumes same stamp for float and double (normal case)
  11490 +>212 byte 17 \b, Big-endian
  11491 +>212 byte 34 \b, VAX format
  11492 +>212 byte 68 \b, Little-endian
  11493 +>212 byte 85 \b, Convex native
  11494 +
  11495 +############################################################
  11496 +# X-Ray Area Detector images
  11497 +0 string R-AXIS4\ \ \ R-Axis Area Detector Image:
  11498 +>796 lelong <20 Little-endian, IP #%d,
  11499 +>>768 lelong >0 Size=%dx
  11500 +>>772 lelong >0 \b%d
  11501 +>796 belong <20 Big-endian, IP #%d,
  11502 +>>768 belong >0 Size=%dx
  11503 +>>772 belong >0 \b%d
  11504 +
  11505 +0 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32:
  11506 +>796 lelong <20 Little-endian, IP #%d,
  11507 +>>768 lelong >0 Size=%dx
  11508 +>>772 lelong >0 \b%d
  11509 +>796 belong <20 Big-endian, IP #%d,
  11510 +>>768 belong >0 Size=%dx
  11511 +>>772 belong >0 \b%d
  11512 +
  11513 +
  11514 +1028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image,
  11515 +>1072 ulong >1 Compressed(%d),
  11516 +>1100 ulong >1 %d headers,
  11517 +>1104 ulong >0 %d x
  11518 +>1108 ulong >0 %d,
  11519 +>1120 ulong >0 %d bits/pixel
  11520 +
  11521 +#------------------------------------------------------------------------------
  11522 +# softquad: file(1) magic for SoftQuad Publishing Software
  11523 +#
  11524 +# Author/Editor and RulesBuilder
  11525 +#
  11526 +# XXX - byte order?
  11527 +#
  11528 +0 string \<!SQ\ DTD> Compiled SGML rules file
  11529 +>9 string >\0 Type %s
  11530 +0 string \<!SQ\ A/E> A/E SGML Document binary
  11531 +>9 string >\0 Type %s
  11532 +0 string \<!SQ\ STS> A/E SGML binary styles file
  11533 +>9 string >\0 Type %s
  11534 +0 short 0xc0de Compiled PSI (v1) data
  11535 +0 short 0xc0da Compiled PSI (v2) data
  11536 +>3 string >\0 (%s)
  11537 +# Binary sqtroff font/desc files...
  11538 +0 short 0125252 SoftQuad DESC or font file binary
  11539 +>2 short >0 - version %d
  11540 +# Bitmaps...
  11541 +0 string SQ\ BITMAP1 SoftQuad Raster Format text
  11542 +#0 string SQ\ BITMAP2 SoftQuad Raster Format data
  11543 +# sqtroff intermediate language (replacement for ditroff int. lang.)
  11544 +0 string X\ SoftQuad troff Context intermediate
  11545 +>2 string 495 for AT&T 495 laser printer
  11546 +>2 string hp for Hewlett-Packard LaserJet
  11547 +>2 string impr for IMAGEN imPRESS
  11548 +>2 string ps for PostScript
  11549 +
  11550 +#------------------------------------------------------------------------------
  11551 +# spectrum: file(1) magic for Spectrum emulator files.
  11552 +#
  11553 +# John Elliott <jce@seasip.demon.co.uk>
  11554 +
  11555 +#
  11556 +# Spectrum +3DOS header
  11557 +#
  11558 +0 string PLUS3DOS\032 Spectrum +3 data
  11559 +>15 byte 0 - BASIC program
  11560 +>15 byte 1 - number array
  11561 +>15 byte 2 - character array
  11562 +>15 byte 3 - memory block
  11563 +>>16 belong 0x001B0040 (screen)
  11564 +>15 byte 4 - Tasword document
  11565 +>15 string TAPEFILE - ZXT tapefile
  11566 +#
  11567 +# Tape file. This assumes the .TAP starts with a Spectrum-format header,
  11568 +# which nearly all will.
  11569 +#
  11570 +0 string \023\000\000 Spectrum .TAP data
  11571 +>4 string x "%-10.10s"
  11572 +>3 byte 0 - BASIC program
  11573 +>3 byte 1 - number array
  11574 +>3 byte 2 - character array
  11575 +>3 byte 3 - memory block
  11576 +>>14 belong 0x001B0040 (screen)
  11577 +
  11578 +# The following three blocks are from pak21-spectrum@srcf.ucam.org
  11579 +# TZX tape images
  11580 +0 string ZXTape!\x1a Spectrum .TZX data
  11581 +>8 byte x version %d
  11582 +>9 byte x .%d
  11583 +
  11584 +# RZX input recording files
  11585 +0 string RZX! Spectrum .RZX data
  11586 +>4 byte x version %d
  11587 +>5 byte x .%d
  11588 +
  11589 +# And three sorts of disk image
  11590 +0 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
  11591 +0 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
  11592 +0 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
  11593 +
  11594 +#------------------------------------------------------------------------------
  11595 +# sql: file(1) magic for SQL files
  11596 +#
  11597 +# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
  11598 +# Recognize some MySQL files.
  11599 +#
  11600 +0 beshort 0xfe01 MySQL table definition file
  11601 +>2 byte x Version %d
  11602 +0 belong&0xffffff00 0xfefe0300 MySQL MISAM index file
  11603 +>3 byte x Version %d
  11604 +0 belong&0xffffff00 0xfefe0700 MySQL MISAM compressed data file
  11605 +>3 byte x Version %d
  11606 +0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
  11607 +>3 byte x Version %d
  11608 +0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
  11609 +>3 byte x Version %d
  11610 +0 string \376bin MySQL replication log
  11611 +
  11612 +#------------------------------------------------------------------------------
  11613 +# iRiver H Series database file
  11614 +# From Ken Guest <ken@linux.ie>
  11615 +# As observed from iRivNavi.iDB and unencoded firmware
  11616 +#
  11617 +0 string iRivDB iRiver Database file
  11618 +>11 string >\0 Version %s
  11619 +>39 string iHP-100 [H Series]
  11620 +
  11621 +#------------------------------------------------------------------------------
  11622 +# SQLite database files
  11623 +# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
  11624 +#
  11625 +# Version 1 used GDBM internally; its files cannot be distinguished
  11626 +# from other GDBM files.
  11627 +#
  11628 +# Version 2 used this format:
  11629 +0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database
  11630 +
  11631 +# Version 3 of SQLite allows applications to embed their own "user version"
  11632 +# number in the database. Detect this and distinguish those files.
  11633 +
  11634 +0 string SQLite\ format\ 3
  11635 +>60 string _MTN Monotone source repository
  11636 +>60 belong !0 SQLite 3.x database, user version %u
  11637 +>60 belong 0 SQLite 3.x database
  11638 +
  11639 +#------------------------------------------------------------------------------
  11640 +# sun: file(1) magic for Sun machines
  11641 +#
  11642 +# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
  11643 +# releases. (5.x uses ELF.)
  11644 +#
  11645 +0 belong&077777777 0600413 sparc demand paged
  11646 +>0 byte &0x80
  11647 +>>20 belong <4096 shared library
  11648 +>>20 belong =4096 dynamically linked executable
  11649 +>>20 belong >4096 dynamically linked executable
  11650 +>0 byte ^0x80 executable
  11651 +>16 belong >0 not stripped
  11652 +
  11653 +0 belong&077777777 0600410 sparc pure
  11654 +>0 byte &0x80 dynamically linked executable
  11655 +>0 byte ^0x80 executable
  11656 +>16 belong >0 not stripped
  11657 +
  11658 +0 belong&077777777 0600407 sparc
  11659 +>0 byte &0x80 dynamically linked executable
  11660 +>0 byte ^0x80 executable
  11661 +>16 belong >0 not stripped
  11662 +
  11663 +0 belong&077777777 0400413 mc68020 demand paged
  11664 +>0 byte &0x80
  11665 +>>20 belong <4096 shared library
  11666 +>>20 belong =4096 dynamically linked executable
  11667 +>>20 belong >4096 dynamically linked executable
  11668 +>0 byte ^0x80 executable
  11669 +>16 belong >0 not stripped
  11670 +
  11671 +0 belong&077777777 0400410 mc68020 pure
  11672 +>0 byte &0x80 dynamically linked executable
  11673 +>0 byte ^0x80 executable
  11674 +>16 belong >0 not stripped
  11675 +
  11676 +0 belong&077777777 0400407 mc68020
  11677 +>0 byte &0x80 dynamically linked executable
  11678 +>0 byte ^0x80 executable
  11679 +>16 belong >0 not stripped
  11680 +
  11681 +0 belong&077777777 0200413 mc68010 demand paged
  11682 +>0 byte &0x80
  11683 +>>20 belong <4096 shared library
  11684 +>>20 belong =4096 dynamically linked executable
  11685 +>>20 belong >4096 dynamically linked executable
  11686 +>0 byte ^0x80 executable
  11687 +>16 belong >0 not stripped
  11688 +
  11689 +0 belong&077777777 0200410 mc68010 pure
  11690 +>0 byte &0x80 dynamically linked executable
  11691 +>0 byte ^0x80 executable
  11692 +>16 belong >0 not stripped
  11693 +
  11694 +0 belong&077777777 0200407 mc68010
  11695 +>0 byte &0x80 dynamically linked executable
  11696 +>0 byte ^0x80 executable
  11697 +>16 belong >0 not stripped
  11698 +
  11699 +# reworked these to avoid anything beginning with zero becoming "old sun-2"
  11700 +0 belong 0407 old sun-2 executable
  11701 +>16 belong >0 not stripped
  11702 +0 belong 0410 old sun-2 pure executable
  11703 +>16 belong >0 not stripped
  11704 +0 belong 0413 old sun-2 demand paged executable
  11705 +>16 belong >0 not stripped
  11706 +
  11707 +#
  11708 +# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
  11709 +# binary executed in compatibility mode under SunOS 5.x".
  11710 +#
  11711 +0 belong 0x080456 SunOS core file
  11712 +>4 belong 432 (SPARC)
  11713 +>>132 string >\0 from '%s'
  11714 +>>116 belong =3 (quit)
  11715 +>>116 belong =4 (illegal instruction)
  11716 +>>116 belong =5 (trace trap)
  11717 +>>116 belong =6 (abort)
  11718 +>>116 belong =7 (emulator trap)
  11719 +>>116 belong =8 (arithmetic exception)
  11720 +>>116 belong =9 (kill)
  11721 +>>116 belong =10 (bus error)
  11722 +>>116 belong =11 (segmentation violation)
  11723 +>>116 belong =12 (bad argument to system call)
  11724 +>>116 belong =29 (resource lost)
  11725 +>>120 belong x (T=%dK,
  11726 +>>124 belong x D=%dK,
  11727 +>>128 belong x S=%dK)
  11728 +>4 belong 826 (68K)
  11729 +>>128 string >\0 from '%s'
  11730 +>4 belong 456 (SPARC 4.x BCP)
  11731 +>>152 string >\0 from '%s'
  11732 +# Sun SunPC
  11733 +0 long 0xfa33c08e SunPC 4.0 Hard Disk
  11734 +0 string #SUNPC_CONFIG SunPC 4.0 Properties Values
  11735 +# Sun snoop (see RFC 1761, which describes the capture file format).
  11736 +#
  11737 +0 string snoop Snoop capture file
  11738 +>8 belong >0 - version %ld
  11739 +>12 belong 0 (IEEE 802.3)
  11740 +>12 belong 1 (IEEE 802.4)
  11741 +>12 belong 2 (IEEE 802.5)
  11742 +>12 belong 3 (IEEE 802.6)
  11743 +>12 belong 4 (Ethernet)
  11744 +>12 belong 5 (HDLC)
  11745 +>12 belong 6 (Character synchronous)
  11746 +>12 belong 7 (IBM channel-to-channel adapter)
  11747 +>12 belong 8 (FDDI)
  11748 +>12 belong 9 (Unknown)
  11749 +
  11750 +# Microsoft ICM color profile
  11751 +36 string acspMSFT Microsoft ICM Color Profile
  11752 +# Sun KCMS
  11753 +36 string acsp Kodak Color Management System, ICC Profile
  11754 +
  11755 +#---------------------------------------------------------------------------
  11756 +# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
  11757 +# lead Sun/Cobalt developer) who agrees that they are good and worthy of
  11758 +# inclusion.
  11759 +
  11760 +# Boot ROM images for Sun/Cobalt Linux server appliances
  11761 +0 string Cobalt\ Networks\ Inc.\nFirmware\ v Paged COBALT boot rom
  11762 +>38 string x V%.4s
  11763 +
  11764 +# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
  11765 +# at the very end where file(1) can't get it.
  11766 +0 string CRfs COBALT boot rom data (Flat boot rom or file system)
  11767 +
  11768 +
  11769 +#------------------------------------------------------------------------
  11770 +# sysex: file(1) magic for MIDI sysex files
  11771 +#
  11772 +#
  11773 +0 byte 0xF0 SysEx File -
  11774 +
  11775 +# North American Group
  11776 +>1 byte 0x01 Sequential
  11777 +>1 byte 0x02 IDP
  11778 +>1 byte 0x03 OctavePlateau
  11779 +>1 byte 0x04 Moog
  11780 +>1 byte 0x05 Passport
  11781 +>1 byte 0x06 Lexicon
  11782 +>1 byte 0x07 Kurzweil/Future Retro
  11783 +>>3 byte 0x77 777
  11784 +>>4 byte 0x00 Bank
  11785 +>>4 byte 0x01 Song
  11786 +>>5 byte 0x0f 16
  11787 +>>5 byte 0x0e 15
  11788 +>>5 byte 0x0d 14
  11789 +>>5 byte 0x0c 13
  11790 +>>5 byte 0x0b 12
  11791 +>>5 byte 0x0a 11
  11792 +>>5 byte 0x09 10
  11793 +>>5 byte 0x08 9
  11794 +>>5 byte 0x07 8
  11795 +>>5 byte 0x06 7
  11796 +>>5 byte 0x05 6
  11797 +>>5 byte 0x04 5
  11798 +>>5 byte 0x03 4
  11799 +>>5 byte 0x02 3
  11800 +>>5 byte 0x01 2
  11801 +>>5 byte 0x00 1
  11802 +>>5 byte 0x10 (ALL)
  11803 +>>2 byte x \b, Channel %d
  11804 +>1 byte 0x08 Fender
  11805 +>1 byte 0x09 Gulbransen
  11806 +>1 byte 0x0a AKG
  11807 +>1 byte 0x0b Voyce
  11808 +>1 byte 0x0c Waveframe
  11809 +>1 byte 0x0d ADA
  11810 +>1 byte 0x0e Garfield
  11811 +>1 byte 0x0f Ensoniq
  11812 +>1 byte 0x10 Oberheim
  11813 +>>2 byte 0x06 Matrix 6 series
  11814 +>>3 byte 0x0A Dump (All)
  11815 +>>3 byte 0x01 Dump (Bank)
  11816 +>>4 belong 0x0002040E Matrix 1000
  11817 +>>>11 byte <2 User bank %d
  11818 +>>>11 byte >1 Preset bank %d
  11819 +>1 byte 0x11 Apple
  11820 +>1 byte 0x12 GreyMatter
  11821 +>1 byte 0x14 PalmTree
  11822 +>1 byte 0x15 JLCooper
  11823 +>1 byte 0x16 Lowrey
  11824 +>1 byte 0x17 AdamsSmith
  11825 +>1 byte 0x18 E-mu
  11826 +>1 byte 0x19 Harmony
  11827 +>1 byte 0x1a ART
  11828 +>1 byte 0x1b Baldwin
  11829 +>1 byte 0x1c Eventide
  11830 +>1 byte 0x1d Inventronics
  11831 +>1 byte 0x1f Clarity
  11832 +
  11833 +# European Group
  11834 +>1 byte 0x21 SIEL
  11835 +>1 byte 0x22 Synthaxe
  11836 +>1 byte 0x24 Hohner
  11837 +>1 byte 0x25 Twister
  11838 +>1 byte 0x26 Solton
  11839 +>1 byte 0x27 Jellinghaus
  11840 +>1 byte 0x28 Southworth
  11841 +>1 byte 0x29 PPG
  11842 +>1 byte 0x2a JEN
  11843 +>1 byte 0x2b SSL
  11844 +>1 byte 0x2c AudioVertrieb
  11845 +
  11846 +>1 byte 0x2f ELKA
  11847 +>>3 byte 0x09 EK-44
  11848 +
  11849 +>1 byte 0x30 Dynacord
  11850 +>1 byte 0x31 Jomox
  11851 +>1 byte 0x33 Clavia
  11852 +>1 byte 0x39 Soundcraft
  11853 +# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
  11854 +>1 byte 0x3e Waldorf
  11855 +>>2 byte 0x00 microWave
  11856 +>>2 byte 0x0E microwave2 / XT
  11857 +>>2 byte 0x0F Q / Q+
  11858 +>>3 byte =0 (default id)
  11859 +>>3 byte >0 (
  11860 +>>>3 byte <0x7F \bdevice %d)
  11861 +>>>3 byte =0x7F \bbroadcast id)
  11862 +>>3 byte 0x7f Microwave I
  11863 +>>>4 byte 0x00 SNDR (Sound Request)
  11864 +>>>4 byte 0x10 SNDD (Sound Dump)
  11865 +>>>4 byte 0x20 SNDP (Sound Parameter Change)
  11866 +>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
  11867 +>>>4 byte 0x70 BOOT (Sound Reserved)
  11868 +>>>4 byte 0x01 MULR (Multi Request)
  11869 +>>>4 byte 0x11 MULD (Multi Dump)
  11870 +>>>4 byte 0x21 MULP (Multi Parameter Change)
  11871 +>>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
  11872 +>>>4 byte 0x71 OS (Multi Reserved)
  11873 +>>>4 byte 0x02 DRMR (Drum Map Request)
  11874 +>>>4 byte 0x12 DRMD (Drum Map Dump)
  11875 +>>>4 byte 0x22 DRMP (Drum Map Parameter Change)
  11876 +>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
  11877 +>>>4 byte 0x72 BIN (Drum Map Reserved)
  11878 +>>>4 byte 0x03 PATR (Sequencer Pattern Request)
  11879 +>>>4 byte 0x13 PATD (Sequencer Pattern Dump)
  11880 +>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change)
  11881 +>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry)
  11882 +>>>4 byte 0x73 AFM (Sequencer Pattern Reserved)
  11883 +>>>4 byte 0x04 GLBR (Global Parameter Request)
  11884 +>>>4 byte 0x14 GLBD (Global Parameter Dump)
  11885 +>>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
  11886 +>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
  11887 +>>>4 byte 0x07 MODR (Mode Parameter Request)
  11888 +>>>4 byte 0x17 MODD (Mode Parameter Dump)
  11889 +>>>4 byte 0x27 MODP (Mode Parameter Parameter Change)
  11890 +>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry)
  11891 +>>2 byte 0x10 microQ
  11892 +>>>4 byte 0x00 SNDR (Sound Request)
  11893 +>>>4 byte 0x10 SNDD (Sound Dump)
  11894 +>>>4 byte 0x20 SNDP (Sound Parameter Change)
  11895 +>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry)
  11896 +>>>4 byte 0x70 (Sound Reserved)
  11897 +>>>4 byte 0x01 MULR (Multi Request)
  11898 +>>>4 byte 0x11 MULD (Multi Dump)
  11899 +>>>4 byte 0x21 MULP (Multi Parameter Change)
  11900 +>>>4 byte 0x31 MULQ (Multi Parameter Inquiry)
  11901 +>>>4 byte 0x71 OS (Multi Reserved)
  11902 +>>>4 byte 0x02 DRMR (Drum Map Request)
  11903 +>>>4 byte 0x12 DRMD (Drum Map Dump)
  11904 +>>>4 byte 0x22 DRMP (Drum Map Parameter Change)
  11905 +>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry)
  11906 +>>>4 byte 0x72 BIN (Drum Map Reserved)
  11907 +>>>4 byte 0x04 GLBR (Global Parameter Request)
  11908 +>>>4 byte 0x14 GLBD (Global Parameter Dump)
  11909 +>>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
  11910 +>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
  11911 +>>2 byte 0x11 rackAttack
  11912 +>>>4 byte 0x00 SNDR (Sound Parameter Request)
  11913 +>>>4 byte 0x10 SNDD (Sound Parameter Dump)
  11914 +>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change)
  11915 +>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry)
  11916 +>>>4 byte 0x01 PRGR (Program Parameter Request)
  11917 +>>>4 byte 0x11 PRGD (Program Parameter Dump)
  11918 +>>>4 byte 0x21 PRGP (Program Parameter Parameter Change)
  11919 +>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry)
  11920 +>>>4 byte 0x71 OS (Program Parameter Reserved)
  11921 +>>>4 byte 0x03 PATR (Pattern Parameter Request)
  11922 +>>>4 byte 0x13 PATD (Pattern Parameter Dump)
  11923 +>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change)
  11924 +>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry)
  11925 +>>>4 byte 0x04 GLBR (Global Parameter Request)
  11926 +>>>4 byte 0x14 GLBD (Global Parameter Dump)
  11927 +>>>4 byte 0x24 GLBP (Global Parameter Parameter Change)
  11928 +>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry)
  11929 +>>>4 byte 0x05 EFXR (FX Parameter Request)
  11930 +>>>4 byte 0x15 EFXD (FX Parameter Dump)
  11931 +>>>4 byte 0x25 EFXP (FX Parameter Parameter Change)
  11932 +>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry)
  11933 +>>>4 byte 0x07 MODR (Mode Command Request)
  11934 +>>>4 byte 0x17 MODD (Mode Command Dump)
  11935 +>>>4 byte 0x27 MODP (Mode Command Parameter Change)
  11936 +>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry)
  11937 +>>2 byte 0x03 Wave
  11938 +>>>4 byte 0x00 SBPR (Soundprogram)
  11939 +>>>4 byte 0x01 SAPR (Performance)
  11940 +>>>4 byte 0x02 SWAVE (Wave)
  11941 +>>>4 byte 0x03 SWTBL (Wave control table)
  11942 +>>>4 byte 0x04 SVT (Velocity Curve)
  11943 +>>>4 byte 0x05 STT (Tuning Table)
  11944 +>>>4 byte 0x06 SGLB (Global Parameters)
  11945 +>>>4 byte 0x07 SARRMAP (Performance Program Change Map)
  11946 +>>>4 byte 0x08 SBPRMAP (Sound Program Change Map)
  11947 +>>>4 byte 0x09 SBPRPAR (Sound Parameter)
  11948 +>>>4 byte 0x0A SARRPAR (Performance Parameter)
  11949 +>>>4 byte 0x0B SINSPAR (Instrument/External Parameter)
  11950 +>>>4 byte 0x0F SBULK (Bulk Switch on/off)
  11951 +
  11952 +# Japanese Group
  11953 +>1 byte 0x40 Kawai
  11954 +>>3 byte 0x20 K1
  11955 +>>3 byte 0x22 K4
  11956 +
  11957 +>1 byte 0x41 Roland
  11958 +>>3 byte 0x14 D-50
  11959 +>>3 byte 0x2b U-220
  11960 +>>3 byte 0x02 TR-707
  11961 +
  11962 +>1 byte 0x42 Korg
  11963 +>>3 byte 0x19 M1
  11964 +
  11965 +>1 byte 0x43 Yamaha
  11966 +>1 byte 0x44 Casio
  11967 +>1 byte 0x46 Kamiya
  11968 +>1 byte 0x47 Akai
  11969 +>1 byte 0x48 Victor
  11970 +>1 byte 0x49 Mesosha
  11971 +>1 byte 0x4b Fujitsu
  11972 +>1 byte 0x4c Sony
  11973 +>1 byte 0x4e Teac
  11974 +>1 byte 0x50 Matsushita
  11975 +>1 byte 0x51 Fostex
  11976 +>1 byte 0x52 Zoom
  11977 +>1 byte 0x54 Matsushita
  11978 +>1 byte 0x57 Acoustic tech. lab.
  11979 +
  11980 +>1 belong&0xffffff00 0x00007400 Ta Horng
  11981 +>1 belong&0xffffff00 0x00007500 e-Tek
  11982 +>1 belong&0xffffff00 0x00007600 E-Voice
  11983 +>1 belong&0xffffff00 0x00007700 Midisoft
  11984 +>1 belong&0xffffff00 0x00007800 Q-Sound
  11985 +>1 belong&0xffffff00 0x00007900 Westrex
  11986 +>1 belong&0xffffff00 0x00007a00 Nvidia*
  11987 +>1 belong&0xffffff00 0x00007b00 ESS
  11988 +>1 belong&0xffffff00 0x00007c00 Mediatrix
  11989 +>1 belong&0xffffff00 0x00007d00 Brooktree
  11990 +>1 belong&0xffffff00 0x00007e00 Otari
  11991 +>1 belong&0xffffff00 0x00007f00 Key Electronics
  11992 +>1 belong&0xffffff00 0x00010000 Shure
  11993 +>1 belong&0xffffff00 0x00010100 AuraSound
  11994 +>1 belong&0xffffff00 0x00010200 Crystal
  11995 +>1 belong&0xffffff00 0x00010300 Rockwell
  11996 +>1 belong&0xffffff00 0x00010400 Silicon Graphics
  11997 +>1 belong&0xffffff00 0x00010500 Midiman
  11998 +>1 belong&0xffffff00 0x00010600 PreSonus
  11999 +>1 belong&0xffffff00 0x00010800 Topaz
  12000 +>1 belong&0xffffff00 0x00010900 Cast Lightning
  12001 +>1 belong&0xffffff00 0x00010a00 Microsoft
  12002 +>1 belong&0xffffff00 0x00010b00 Sonic Foundry
  12003 +>1 belong&0xffffff00 0x00010c00 Line 6
  12004 +>1 belong&0xffffff00 0x00010d00 Beatnik Inc.
  12005 +>1 belong&0xffffff00 0x00010e00 Van Koerving
  12006 +>1 belong&0xffffff00 0x00010f00 Altech Systems
  12007 +>1 belong&0xffffff00 0x00011000 S & S Research
  12008 +>1 belong&0xffffff00 0x00011100 VLSI Technology
  12009 +>1 belong&0xffffff00 0x00011200 Chromatic
  12010 +>1 belong&0xffffff00 0x00011300 Sapphire
  12011 +>1 belong&0xffffff00 0x00011400 IDRC
  12012 +>1 belong&0xffffff00 0x00011500 Justonic Tuning
  12013 +>1 belong&0xffffff00 0x00011600 TorComp
  12014 +>1 belong&0xffffff00 0x00011700 Newtek Inc.
  12015 +>1 belong&0xffffff00 0x00011800 Sound Sculpture
  12016 +>1 belong&0xffffff00 0x00011900 Walker Technical
  12017 +>1 belong&0xffffff00 0x00011a00 Digital Harmony
  12018 +>1 belong&0xffffff00 0x00011b00 InVision
  12019 +>1 belong&0xffffff00 0x00011c00 T-Square
  12020 +>1 belong&0xffffff00 0x00011d00 Nemesys
  12021 +>1 belong&0xffffff00 0x00011e00 DBX
  12022 +>1 belong&0xffffff00 0x00011f00 Syndyne
  12023 +>1 belong&0xffffff00 0x00012000 Bitheadz
  12024 +>1 belong&0xffffff00 0x00012100 Cakewalk
  12025 +>1 belong&0xffffff00 0x00012200 Staccato
  12026 +>1 belong&0xffffff00 0x00012300 National Semicon.
  12027 +>1 belong&0xffffff00 0x00012400 Boom Theory
  12028 +>1 belong&0xffffff00 0x00012500 Virtual DSP Corp
  12029 +>1 belong&0xffffff00 0x00012600 Antares
  12030 +>1 belong&0xffffff00 0x00012700 Angel Software
  12031 +>1 belong&0xffffff00 0x00012800 St Louis Music
  12032 +>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX
  12033 +>1 belong&0xffffff00 0x00012a00 Ashley Audio
  12034 +>1 belong&0xffffff00 0x00012b00 Vari-Lite
  12035 +>1 belong&0xffffff00 0x00012c00 Summit Audio
  12036 +>1 belong&0xffffff00 0x00012d00 Aureal Semicon.
  12037 +>1 belong&0xffffff00 0x00012e00 SeaSound
  12038 +>1 belong&0xffffff00 0x00012f00 U.S. Robotics
  12039 +>1 belong&0xffffff00 0x00013000 Aurisis
  12040 +>1 belong&0xffffff00 0x00013100 Nearfield Multimedia
  12041 +>1 belong&0xffffff00 0x00013200 FM7 Inc.
  12042 +>1 belong&0xffffff00 0x00013300 Swivel Systems
  12043 +>1 belong&0xffffff00 0x00013400 Hyperactive
  12044 +>1 belong&0xffffff00 0x00013500 MidiLite
  12045 +>1 belong&0xffffff00 0x00013600 Radical
  12046 +>1 belong&0xffffff00 0x00013700 Roger Linn
  12047 +>1 belong&0xffffff00 0x00013800 Helicon
  12048 +>1 belong&0xffffff00 0x00013900 Event
  12049 +>1 belong&0xffffff00 0x00013a00 Sonic Network
  12050 +>1 belong&0xffffff00 0x00013b00 Realtime Music
  12051 +>1 belong&0xffffff00 0x00013c00 Apogee Digital
  12052 +
  12053 +>1 belong&0xffffff00 0x00202b00 Medeli Electronics
  12054 +>1 belong&0xffffff00 0x00202c00 Charlie Lab
  12055 +>1 belong&0xffffff00 0x00202d00 Blue Chip Music
  12056 +>1 belong&0xffffff00 0x00202e00 BEE OH Corp
  12057 +>1 belong&0xffffff00 0x00202f00 LG Semicon America
  12058 +>1 belong&0xffffff00 0x00203000 TESI
  12059 +>1 belong&0xffffff00 0x00203100 EMAGIC
  12060 +>1 belong&0xffffff00 0x00203200 Behringer
  12061 +>1 belong&0xffffff00 0x00203300 Access Music
  12062 +>1 belong&0xffffff00 0x00203400 Synoptic
  12063 +>1 belong&0xffffff00 0x00203500 Hanmesoft Corp
  12064 +>1 belong&0xffffff00 0x00203600 Terratec
  12065 +>1 belong&0xffffff00 0x00203700 Proel SpA
  12066 +>1 belong&0xffffff00 0x00203800 IBK MIDI
  12067 +>1 belong&0xffffff00 0x00203900 IRCAM
  12068 +>1 belong&0xffffff00 0x00203a00 Propellerhead Software
  12069 +>1 belong&0xffffff00 0x00203b00 Red Sound Systems
  12070 +>1 belong&0xffffff00 0x00203c00 Electron ESI AB
  12071 +>1 belong&0xffffff00 0x00203d00 Sintefex Audio
  12072 +>1 belong&0xffffff00 0x00203e00 Music and More
  12073 +>1 belong&0xffffff00 0x00203f00 Amsaro
  12074 +>1 belong&0xffffff00 0x00204000 CDS Advanced Technology
  12075 +>1 belong&0xffffff00 0x00204100 Touched by Sound
  12076 +>1 belong&0xffffff00 0x00204200 DSP Arts
  12077 +>1 belong&0xffffff00 0x00204300 Phil Rees Music
  12078 +>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH
  12079 +>1 belong&0xffffff00 0x00204500 Soundart
  12080 +>1 belong&0xffffff00 0x00204600 C-Mexx Software
  12081 +>1 belong&0xffffff00 0x00204700 Klavis Tech.
  12082 +>1 belong&0xffffff00 0x00204800 Noteheads AB
  12083 +
  12084 +0 string T707 Roland TR-707 Data
  12085 +#------------------------------------------------------------------------------
  12086 +# teapot: file(1) magic for "teapot" spreadsheet
  12087 +#
  12088 +0 string #!teapot\012xdr teapot work sheet (XDR format)
  12089 +
  12090 +#------------------------------------------------------------------------------
  12091 +# terminfo: file(1) magic for terminfo
  12092 +#
  12093 +# XXX - byte order for screen images?
  12094 +#
  12095 +0 string \032\001 Compiled terminfo entry
  12096 +0 short 0433 Curses screen image
  12097 +0 short 0434 Curses screen image
  12098 +
  12099 +#------------------------------------------------------------------------------
  12100 +# tex: file(1) magic for TeX files
  12101 +#
  12102 +# From <conklin@talisman.kaleida.com>
  12103 +
  12104 +# Although we may know the offset of certain text fields in TeX DVI
  12105 +# and font files, we can't use them reliably because they are not
  12106 +# zero terminated. [but we do anyway, christos]
  12107 +0 string \367\002 TeX DVI file
  12108 +>16 string >\0 (%s)
  12109 +0 string \367\203 TeX generic font data
  12110 +0 string \367\131 TeX packed font data
  12111 +>3 string >\0 (%s)
  12112 +0 string \367\312 TeX virtual font data
  12113 +0 string This\ is\ TeX, TeX transcript text
  12114 +0 string This\ is\ METAFONT, METAFONT transcript text
  12115 +
  12116 +# There is no way to detect TeX Font Metric (*.tfm) files without
  12117 +# breaking them apart and reading the data. The following patterns
  12118 +# match most *.tfm files generated by METAFONT or afm2tfm.
  12119 +2 string \000\021 TeX font metric data
  12120 +>33 string >\0 (%s)
  12121 +2 string \000\022 TeX font metric data
  12122 +>33 string >\0 (%s)
  12123 +
  12124 +# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
  12125 +0 string \\input\ texinfo Texinfo source text
  12126 +0 string This\ is\ Info\ file GNU Info text
  12127 +
  12128 +# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
  12129 +0 search/400 \\input TeX document text
  12130 +0 search/400 \\section LaTeX document text
  12131 +0 search/400 \\setlength LaTeX document text
  12132 +0 search/400 \\documentstyle LaTeX document text
  12133 +0 search/400 \\chapter LaTeX document text
  12134 +0 search/400 \\documentclass LaTeX 2e document text
  12135 +0 search/400 \\relax LaTeX auxiliary file
  12136 +0 search/400 \\contentsline LaTeX table of contents
  12137 +0 search/400 %\ -*-latex-*- LaTeX document text
  12138 +
  12139 +# Tex document, from Hendrik Scholz <hendrik@scholz.net>
  12140 +0 string \\ifx TeX document text
  12141 +
  12142 +# Index and glossary files
  12143 +0 search/400 \\indexentry LaTeX raw index file
  12144 +0 search/400 \\begin{theindex} LaTeX sorted index
  12145 +0 search/400 \\glossaryentry LaTeX raw glossary
  12146 +0 search/400 \\begin{theglossary} LaTeX sorted glossary
  12147 +0 search/400 This\ is\ makeindex Makeindex log file
  12148 +
  12149 +# End of TeX
  12150 +
  12151 +#------------------------------------------------------------------------------
  12152 +# file(1) magic for BibTex text files
  12153 +# From Hendrik Scholz <hendrik@scholz.net>
  12154 +
  12155 +0 string/c @article{ BibTeX text file
  12156 +0 string/c @book{ BibTeX text file
  12157 +0 string/c @inbook{ BibTeX text file
  12158 +0 string/c @incollection{ BibTeX text file
  12159 +0 string/c @inproceedings{ BibTeX text file
  12160 +0 string/c @manual{ BibTeX text file
  12161 +0 string/c @misc{ BibTeX text file
  12162 +0 string/c @preamble{ BibTeX text file
  12163 +0 string/c @phdthesis{ BibTeX text file
  12164 +0 string/c @techreport{ BibTeX text file
  12165 +0 string/c @unpublished{ BibTeX text file
  12166 +
  12167 +73 string %%%\ \ BibTeX-file{ BibTex text file (with full header)
  12168 +
  12169 +73 string %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header)
  12170 +
  12171 +0 string %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file
  12172 +
  12173 +0 string %\ BibTeX\ ` BibTeX custom bibliography style text file
  12174 +
  12175 +0 string @c\ @mapfile{ TeX font aliases text file
  12176 +
  12177 +#------------------------------------------------------------------------------
  12178 +# file(1) magic for tgif(1) files
  12179 +# From Hendrik Scholz <hendrik@scholz.net>
  12180 +
  12181 +0 string %TGIF\ x Tgif file version %s
  12182 +
  12183 +# ------------------------------------------------------------------------
  12184 +# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
  12185 +#
  12186 +# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
  12187 +#
  12188 +# Update: Romain Lievin (roms@lpg.ticalc.org).
  12189 +#
  12190 +# NOTE: This list is not complete.
  12191 +# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
  12192 +# program/group magic numbers in here because I cannot find any.
  12193 +0 string **TI80** TI-80 Graphing Calculator File.
  12194 +0 string **TI81** TI-81 Graphing Calculator File.
  12195 +#
  12196 +# Magic Numbers for the TI-73
  12197 +#
  12198 +0 string **TI73** TI-73 Graphing Calculator
  12199 +>0x00003B byte 0x00 (real number)
  12200 +>0x00003B byte 0x01 (list)
  12201 +>0x00003B byte 0x02 (matrix)
  12202 +>0x00003B byte 0x03 (equation)
  12203 +>0x00003B byte 0x04 (string)
  12204 +>0x00003B byte 0x05 (program)
  12205 +>0x00003B byte 0x06 (assembly program)
  12206 +>0x00003B byte 0x07 (picture)
  12207 +>0x00003B byte 0x08 (gdb)
  12208 +>0x00003B byte 0x0C (complex number)
  12209 +>0x00003B byte 0x0F (window settings)
  12210 +>0x00003B byte 0x10 (zoom)
  12211 +>0x00003B byte 0x11 (table setup)
  12212 +>0x00003B byte 0x13 (backup)
  12213 +
  12214 +# Magic Numbers for the TI-82
  12215 +#
  12216 +0 string **TI82** TI-82 Graphing Calculator
  12217 +>0x00003B byte 0x00 (real)
  12218 +>0x00003B byte 0x01 (list)
  12219 +>0x00003B byte 0x02 (matrix)
  12220 +>0x00003B byte 0x03 (Y-variable)
  12221 +>0x00003B byte 0x05 (program)
  12222 +>0x00003B byte 0x06 (protected prgm)
  12223 +>0x00003B byte 0x07 (picture)
  12224 +>0x00003B byte 0x08 (gdb)
  12225 +>0x00003B byte 0x0B (window settings)
  12226 +>0x00003B byte 0x0C (window settings)
  12227 +>0x00003B byte 0x0D (table setup)
  12228 +>0x00003B byte 0x0E (screenshot)
  12229 +>0x00003B byte 0x0F (backup)
  12230 +#
  12231 +# Magic Numbers for the TI-83
  12232 +#
  12233 +0 string **TI83** TI-83 Graphing Calculator
  12234 +>0x00003B byte 0x00 (real)
  12235 +>0x00003B byte 0x01 (list)
  12236 +>0x00003B byte 0x02 (matrix)
  12237 +>0x00003B byte 0x03 (Y-variable)
  12238 +>0x00003B byte 0x04 (string)
  12239 +>0x00003B byte 0x05 (program)
  12240 +>0x00003B byte 0x06 (protected prgm)
  12241 +>0x00003B byte 0x07 (picture)
  12242 +>0x00003B byte 0x08 (gdb)
  12243 +>0x00003B byte 0x0B (window settings)
  12244 +>0x00003B byte 0x0C (window settings)
  12245 +>0x00003B byte 0x0D (table setup)
  12246 +>0x00003B byte 0x0E (screenshot)
  12247 +>0x00003B byte 0x13 (backup)
  12248 +#
  12249 +# Magic Numbers for the TI-83+
  12250 +#
  12251 +0 string **TI83F* TI-83+ Graphing Calculator
  12252 +>0x00003B byte 0x00 (real number)
  12253 +>0x00003B byte 0x01 (list)
  12254 +>0x00003B byte 0x02 (matrix)
  12255 +>0x00003B byte 0x03 (equation)
  12256 +>0x00003B byte 0x04 (string)
  12257 +>0x00003B byte 0x05 (program)
  12258 +>0x00003B byte 0x06 (assembly program)
  12259 +>0x00003B byte 0x07 (picture)
  12260 +>0x00003B byte 0x08 (gdb)
  12261 +>0x00003B byte 0x0C (complex number)
  12262 +>0x00003B byte 0x0F (window settings)
  12263 +>0x00003B byte 0x10 (zoom)
  12264 +>0x00003B byte 0x11 (table setup)
  12265 +>0x00003B byte 0x13 (backup)
  12266 +>0x00003B byte 0x15 (application variable)
  12267 +>0x00003B byte 0x17 (group of variable)
  12268 +
  12269 +#
  12270 +# Magic Numbers for the TI-85
  12271 +#
  12272 +0 string **TI85** TI-85 Graphing Calculator
  12273 +>0x00003B byte 0x00 (real number)
  12274 +>0x00003B byte 0x01 (complex number)
  12275 +>0x00003B byte 0x02 (real vector)
  12276 +>0x00003B byte 0x03 (complex vector)
  12277 +>0x00003B byte 0x04 (real list)
  12278 +>0x00003B byte 0x05 (complex list)
  12279 +>0x00003B byte 0x06 (real matrix)
  12280 +>0x00003B byte 0x07 (complex matrix)
  12281 +>0x00003B byte 0x08 (real constant)
  12282 +>0x00003B byte 0x09 (complex constant)
  12283 +>0x00003B byte 0x0A (equation)
  12284 +>0x00003B byte 0x0C (string)
  12285 +>0x00003B byte 0x0D (function GDB)
  12286 +>0x00003B byte 0x0E (polar GDB)
  12287 +>0x00003B byte 0x0F (parametric GDB)
  12288 +>0x00003B byte 0x10 (diffeq GDB)
  12289 +>0x00003B byte 0x11 (picture)
  12290 +>0x00003B byte 0x12 (program)
  12291 +>0x00003B byte 0x13 (range)
  12292 +>0x00003B byte 0x17 (window settings)
  12293 +>0x00003B byte 0x18 (window settings)
  12294 +>0x00003B byte 0x19 (window settings)
  12295 +>0x00003B byte 0x1A (window settings)
  12296 +>0x00003B byte 0x1B (zoom)
  12297 +>0x00003B byte 0x1D (backup)
  12298 +>0x00003B byte 0x1E (unknown)
  12299 +>0x00003B byte 0x2A (equation)
  12300 +>0x000032 string ZS4 - ZShell Version 4 File.
  12301 +>0x000032 string ZS3 - ZShell Version 3 File.
  12302 +#
  12303 +# Magic Numbers for the TI-86
  12304 +#
  12305 +0 string **TI86** TI-86 Graphing Calculator
  12306 +>0x00003B byte 0x00 (real number)
  12307 +>0x00003B byte 0x01 (complex number)
  12308 +>0x00003B byte 0x02 (real vector)
  12309 +>0x00003B byte 0x03 (complex vector)
  12310 +>0x00003B byte 0x04 (real list)
  12311 +>0x00003B byte 0x05 (complex list)
  12312 +>0x00003B byte 0x06 (real matrix)
  12313 +>0x00003B byte 0x07 (complex matrix)
  12314 +>0x00003B byte 0x08 (real constant)
  12315 +>0x00003B byte 0x09 (complex constant)
  12316 +>0x00003B byte 0x0A (equation)
  12317 +>0x00003B byte 0x0C (string)
  12318 +>0x00003B byte 0x0D (function GDB)
  12319 +>0x00003B byte 0x0E (polar GDB)
  12320 +>0x00003B byte 0x0F (parametric GDB)
  12321 +>0x00003B byte 0x10 (diffeq GDB)
  12322 +>0x00003B byte 0x11 (picture)
  12323 +>0x00003B byte 0x12 (program)
  12324 +>0x00003B byte 0x13 (range)
  12325 +>0x00003B byte 0x17 (window settings)
  12326 +>0x00003B byte 0x18 (window settings)
  12327 +>0x00003B byte 0x19 (window settings)
  12328 +>0x00003B byte 0x1A (window settings)
  12329 +>0x00003B byte 0x1B (zoom)
  12330 +>0x00003B byte 0x1D (backup)
  12331 +>0x00003B byte 0x1E (unknown)
  12332 +>0x00003B byte 0x2A (equation)
  12333 +#
  12334 +# Magic Numbers for the TI-89
  12335 +#
  12336 +0 string **TI89** TI-89 Graphing Calculator
  12337 +>0x000048 byte 0x00 (expression)
  12338 +>0x000048 byte 0x04 (list)
  12339 +>0x000048 byte 0x06 (matrix)
  12340 +>0x000048 byte 0x0A (data)
  12341 +>0x000048 byte 0x0B (text)
  12342 +>0x000048 byte 0x0C (string)
  12343 +>0x000048 byte 0x0D (graphic data base)
  12344 +>0x000048 byte 0x0E (figure)
  12345 +>0x000048 byte 0x10 (picture)
  12346 +>0x000048 byte 0x12 (program)
  12347 +>0x000048 byte 0x13 (function)
  12348 +>0x000048 byte 0x14 (macro)
  12349 +>0x000048 byte 0x1C (zipped)
  12350 +>0x000048 byte 0x21 (assembler)
  12351 +#
  12352 +# Magic Numbers for the TI-92
  12353 +#
  12354 +0 string **TI92** TI-92 Graphing Calculator
  12355 +>0x000048 byte 0x00 (expression)
  12356 +>0x000048 byte 0x04 (list)
  12357 +>0x000048 byte 0x06 (matrix)
  12358 +>0x000048 byte 0x0A (data)
  12359 +>0x000048 byte 0x0B (text)
  12360 +>0x000048 byte 0x0C (string)
  12361 +>0x000048 byte 0x0D (graphic data base)
  12362 +>0x000048 byte 0x0E (figure)
  12363 +>0x000048 byte 0x10 (picture)
  12364 +>0x000048 byte 0x12 (program)
  12365 +>0x000048 byte 0x13 (function)
  12366 +>0x000048 byte 0x14 (macro)
  12367 +>0x000048 byte 0x1D (backup)
  12368 +#
  12369 +# Magic Numbers for the TI-92+/V200
  12370 +#
  12371 +0 string **TI92P* TI-92+/V200 Graphing Calculator
  12372 +>0x000048 byte 0x00 (expression)
  12373 +>0x000048 byte 0x04 (list)
  12374 +>0x000048 byte 0x06 (matrix)
  12375 +>0x000048 byte 0x0A (data)
  12376 +>0x000048 byte 0x0B (text)
  12377 +>0x000048 byte 0x0C (string)
  12378 +>0x000048 byte 0x0D (graphic data base)
  12379 +>0x000048 byte 0x0E (figure)
  12380 +>0x000048 byte 0x10 (picture)
  12381 +>0x000048 byte 0x12 (program)
  12382 +>0x000048 byte 0x13 (function)
  12383 +>0x000048 byte 0x14 (macro)
  12384 +>0x000048 byte 0x1C (zipped)
  12385 +>0x000048 byte 0x21 (assembler)
  12386 +#
  12387 +# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
  12388 +#
  12389 +0x0000016 string Advanced TI-XX Graphing Calculator (FLASH)
  12390 +0 string **TIFL** TI-XX Graphing Calculator (FLASH)
  12391 +>8 byte >0 - Revision %d
  12392 +>>9 byte x \b.%d,
  12393 +>12 byte >0 Revision date %02x
  12394 +>>13 byte x \b/%02x
  12395 +>>14 beshort x \b/%04x,
  12396 +>17 string >/0 name: '%s',
  12397 +>48 byte 0x74 device: TI-73,
  12398 +>48 byte 0x73 device: TI-83+,
  12399 +>48 byte 0x98 device: TI-89,
  12400 +>48 byte 0x88 device: TI-92+,
  12401 +>49 byte 0x23 type: OS upgrade,
  12402 +>49 byte 0x24 type: application,
  12403 +>49 byte 0x25 type: certificate,
  12404 +>49 byte 0x3e type: license,
  12405 +>74 lelong >0 size: %ld bytes
  12406 +
  12407 +# VTi & TiEmu skins (TI Graphing Calculators).
  12408 +# From: Romain Lievin (roms@lpg.ticalc.org).
  12409 +# Magic Numbers for the VTi skins
  12410 +0 string VTI Virtual TI skin
  12411 +>3 string v - Version
  12412 +>>4 byte >0 \b %c
  12413 +>>6 byte x \b.%c
  12414 +# Magic Numbers for the TiEmu skins
  12415 +0 string TiEmu TiEmu skin
  12416 +>6 string v - Version
  12417 +>>7 byte >0 \b %c
  12418 +>>9 byte x \b.%c
  12419 +>>10 byte x \b%c
  12420 +
  12421 +#------------------------------------------------------------------------------
  12422 +# timezone: file(1) magic for timezone data
  12423 +#
  12424 +# from Daniel Quinlan (quinlan@yggdrasil.com)
  12425 +# this should work on Linux, SunOS, and maybe others
  12426 +# Added new official magic number for recent versions of the Olson code
  12427 +0 string TZif timezone data
  12428 +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0 old timezone data
  12429 +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0 old timezone data
  12430 +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0 old timezone data
  12431 +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0 old timezone data
  12432 +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0 old timezone data
  12433 +0 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 old timezone data
  12434 +
  12435 +#------------------------------------------------------------------------------
  12436 +# troff: file(1) magic for *roff
  12437 +#
  12438 +# updated by Daniel Quinlan (quinlan@yggdrasil.com)
  12439 +
  12440 +# troff input
  12441 +0 string .\\" troff or preprocessor input text
  12442 +0 string '\\" troff or preprocessor input text
  12443 +0 string '.\\" troff or preprocessor input text
  12444 +0 string \\" troff or preprocessor input text
  12445 +0 string ''' troff or preprocessor input text
  12446 +
  12447 +# ditroff intermediate output text
  12448 +0 string x\ T ditroff output text
  12449 +>4 string cat for the C/A/T phototypesetter
  12450 +>4 string ps for PostScript
  12451 +>4 string dvi for DVI
  12452 +>4 string ascii for ASCII
  12453 +>4 string lj4 for LaserJet 4
  12454 +>4 string latin1 for ISO 8859-1 (Latin 1)
  12455 +>4 string X75 for xditview at 75dpi
  12456 +>>7 string -12 (12pt)
  12457 +>4 string X100 for xditview at 100dpi
  12458 +>>8 string -12 (12pt)
  12459 +
  12460 +# output data formats
  12461 +0 string \100\357 very old (C/A/T) troff output data
  12462 +#
  12463 +#------------------------------------------------------------------------------
  12464 +# tuxedo: file(1) magic for BEA TUXEDO data files
  12465 +#
  12466 +# from Ian Springer <ispringer@hotmail.com>
  12467 +#
  12468 +0 string \0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0 BEA TUXEDO DES mask data
  12469 +
  12470 +#------------------------------------------------------------------------------
  12471 +# typeset: file(1) magic for other typesetting
  12472 +#
  12473 +0 string Interpress/Xerox Xerox InterPress data
  12474 +>16 string / (version
  12475 +>>17 string >\0 %s)
  12476 +
  12477 +#------------------------------------------------------------------------------
  12478 +# unknown: file(1) magic for unknown machines
  12479 +#
  12480 +# XXX - this probably should be pruned, as it'll match PDP-11 and
  12481 +# VAX image formats.
  12482 +#
  12483 +# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
  12484 +# respectively).
  12485 +#
  12486 +# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
  12487 +# have the "version %ld", which may be a bogus COFFism (I don't think
  12488 +# there ever was COFF for the PDP-11).
  12489 +#
  12490 +# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
  12491 +# long, as it would be on a VAX.
  12492 +#
  12493 +# 0x10C is 0414 and 0x10E is 416; those *are* unknown.
  12494 +#
  12495 +0 short 0x107 unknown machine executable
  12496 +>8 short >0 not stripped
  12497 +>15 byte >0 - version %ld
  12498 +0 short 0x108 unknown pure executable
  12499 +>8 short >0 not stripped
  12500 +>15 byte >0 - version %ld
  12501 +0 short 0x109 PDP-11 separate I&D
  12502 +>8 short >0 not stripped
  12503 +>15 byte >0 - version %ld
  12504 +0 short 0x10b unknown pure executable
  12505 +>8 short >0 not stripped
  12506 +>15 byte >0 - version %ld
  12507 +0 long 0x10c unknown demand paged pure executable
  12508 +>16 long >0 not stripped
  12509 +0 long 0x10e unknown readable demand paged pure executable
  12510 +
  12511 +#---------------------------------------------------------------------------
  12512 +# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp>
  12513 +#
  12514 +0 string +/v8 Unicode text, UTF-7
  12515 +0 string +/v9 Unicode text, UTF-7
  12516 +0 string +/v+ Unicode text, UTF-7
  12517 +0 string +/v/ Unicode text, UTF-7
  12518 +0 string \357\273\277 Unicode text, UTF-8
  12519 +0 string \335\163\146\163 Unicode text, UTF-8-EBCDIC
  12520 +0 string \376\377\000\000 Unicode text, UTF-32, big-endian
  12521 +0 string \377\376\000\000 Unicode text, UTF-32, little-endian
  12522 +0 string \376\377 Unicode text, UTF-16, big-endian
  12523 +0 string \377\376 Unicode text, UTF-16, little-endian
  12524 +0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode)
  12525 +
  12526 +#------------------------------------------------------------------------------
  12527 +# uuencode: file(1) magic for ASCII-encoded files
  12528 +#
  12529 +
  12530 +# GRR: the first line of xxencoded files is identical to that in uuencoded
  12531 +# files, but the first character in most subsequent lines is 'h' instead of
  12532 +# 'M'. (xxencoding uses lowercase letters in place of most of uuencode's
  12533 +# punctuation and survives BITNET gateways better.) If regular expressions
  12534 +# were supported, this entry could possibly be split into two with
  12535 +# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
  12536 +0 string begin\040 uuencoded or xxencoded text
  12537 +
  12538 +# btoa(1) is an alternative to uuencode that requires less space.
  12539 +0 string xbtoa\ Begin btoa'd text
  12540 +
  12541 +# ship(1) is another, much cooler alternative to uuencode.
  12542 +# Greg Roelofs, newt@uchicago.edu
  12543 +0 string $\012ship ship'd binary text
  12544 +
  12545 +# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
  12546 +# Greg Roelofs, newt@uchicago.edu
  12547 +0 string Decode\ the\ following\ with\ bdeco bencoded News text
  12548 +
  12549 +# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
  12550 +# Daniel Quinlan, quinlan@yggdrasil.com
  12551 +11 string must\ be\ converted\ with\ BinHex BinHex binary text
  12552 +>41 string x \b, version %.3s
  12553 +
  12554 +# GRR: is MIME BASE64 encoding handled somewhere?
  12555 +
  12556 +#------------------------------------------------------------------------------
  12557 +# varied.out: file(1) magic for various USG systems
  12558 +#
  12559 +# Herewith many of the object file formats used by USG systems.
  12560 +# Most have been moved to files for a particular processor,
  12561 +# and deleted if they duplicate other entries.
  12562 +#
  12563 +0 short 0610 Perkin-Elmer executable
  12564 +# AMD 29K
  12565 +0 beshort 0572 amd 29k coff noprebar executable
  12566 +0 beshort 01572 amd 29k coff prebar executable
  12567 +0 beshort 0160007 amd 29k coff archive
  12568 +# Cray
  12569 +6 beshort 0407 unicos (cray) executable
  12570 +# Ultrix 4.3
  12571 +596 string \130\337\377\377 Ultrix core file
  12572 +>600 string >\0 from '%s'
  12573 +# BeOS and MAcOS PEF executables
  12574 +# From: hplus@zilker.net (Jon Watte)
  12575 +0 string Joy!peffpwpc header for PowerPC PEF executable
  12576 +#
  12577 +# ava assembler/linker Uros Platise <uros.platise@ijs.si>
  12578 +0 string avaobj AVR assembler object code
  12579 +>7 string >\0 version '%s'
  12580 +# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
  12581 +0 string gmon GNU prof performance data
  12582 +>4 long x - version %ld
  12583 +# From: Dave Pearson <davep@davep.org>
  12584 +# Harbour <URL:http://www.harbour-project.org/> HRB files.
  12585 +0 string \xc0HRB Harbour HRB file
  12586 +>4 short x version %d
  12587 +
  12588 +# From: Alex Beregszaszi <alex@fsn.hu>
  12589 +# 0 string exec BugOS executable
  12590 +# 0 string pack BugOS archive
  12591 +
  12592 +# From: Jason Spence <jspence@lightconsulting.com>
  12593 +# Generated by the "examples" in STM's ST40 devkit, and derived code.
  12594 +0 lelong 0x13a9f17e ST40 component image format
  12595 +>4 string >\0 \b, name '%s'
  12596 +
  12597 +#------------------------------------------------------------------------------
  12598 +# varied.script: file(1) magic for various interpreter scripts
  12599 +
  12600 +0 string #!\ / a
  12601 +>3 string >\0 %s script text executable
  12602 +0 string #!\t/ a
  12603 +>3 string >\0 %s script text executable
  12604 +0 string #!/ a
  12605 +>2 string >\0 %s script text executable
  12606 +0 string #!\ script text executable
  12607 +>3 string >\0 for %s
  12608 +
  12609 +
  12610 +#------------------------------------------------------------------------------
  12611 +# vax: file(1) magic for VAX executable/object and APL workspace
  12612 +#
  12613 +0 lelong 0101557 VAX single precision APL workspace
  12614 +0 lelong 0101556 VAX double precision APL workspace
  12615 +
  12616 +#
  12617 +# VAX a.out (32V, BSD)
  12618 +#
  12619 +0 lelong 0407 VAX executable
  12620 +>16 lelong >0 not stripped
  12621 +
  12622 +0 lelong 0410 VAX pure executable
  12623 +>16 lelong >0 not stripped
  12624 +
  12625 +0 lelong 0413 VAX demand paged pure executable
  12626 +>16 lelong >0 not stripped
  12627 +
  12628 +0 lelong 0420 VAX demand paged (first page unmapped) pure executable
  12629 +>16 lelong >0 not stripped
  12630 +
  12631 +#
  12632 +# VAX COFF
  12633 +#
  12634 +# The `versions' should be un-commented if they work for you.
  12635 +# (Was the problem just one of endianness?)
  12636 +#
  12637 +0 leshort 0570 VAX COFF executable
  12638 +>12 lelong >0 not stripped
  12639 +>22 leshort >0 - version %ld
  12640 +0 leshort 0575 VAX COFF pure executable
  12641 +>12 lelong >0 not stripped
  12642 +>22 leshort >0 - version %ld
  12643 +
  12644 +#------------------------------------------------------------------------------
  12645 +# vicar: file(1) magic for VICAR files.
  12646 +#
  12647 +# From: Ossama Othman <othman@astrosun.tn.cornell.edu
  12648 +# VICAR is JPL's in-house spacecraft image processing program
  12649 +# VICAR image
  12650 +0 string LBLSIZE= VICAR image data
  12651 +>32 string BYTE \b, 8 bits = VAX byte
  12652 +>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2
  12653 +>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4
  12654 +>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4
  12655 +>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8
  12656 +>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8
  12657 +# VICAR label file
  12658 +43 string SFDU_LABEL VICAR label file
  12659 +#------------------------------------------------------------------------------
  12660 +# Virtutech Compressed Random Access File Format
  12661 +#
  12662 +# From <gustav@virtutech.com>
  12663 +0 string \211\277\036\203 Virtutech CRAFF
  12664 +>4 belong x v%d
  12665 +>20 belong 0 uncompressed
  12666 +>20 belong 1 bzipp2ed
  12667 +>20 belong 2 gzipped
  12668 +>24 belong 0 not clean
  12669 +
  12670 +#------------------------------------------------------------------------------
  12671 +# visx: file(1) magic for Visx format files
  12672 +#
  12673 +0 short 0x5555 VISX image file
  12674 +>2 byte 0 (zero)
  12675 +>2 byte 1 (unsigned char)
  12676 +>2 byte 2 (short integer)
  12677 +>2 byte 3 (float 32)
  12678 +>2 byte 4 (float 64)
  12679 +>2 byte 5 (signed char)
  12680 +>2 byte 6 (bit-plane)
  12681 +>2 byte 7 (classes)
  12682 +>2 byte 8 (statistics)
  12683 +>2 byte 10 (ascii text)
  12684 +>2 byte 15 (image segments)
  12685 +>2 byte 100 (image set)
  12686 +>2 byte 101 (unsigned char vector)
  12687 +>2 byte 102 (short integer vector)
  12688 +>2 byte 103 (float 32 vector)
  12689 +>2 byte 104 (float 64 vector)
  12690 +>2 byte 105 (signed char vector)
  12691 +>2 byte 106 (bit plane vector)
  12692 +>2 byte 121 (feature vector)
  12693 +>2 byte 122 (feature vector library)
  12694 +>2 byte 124 (chain code)
  12695 +>2 byte 126 (bit vector)
  12696 +>2 byte 130 (graph)
  12697 +>2 byte 131 (adjacency graph)
  12698 +>2 byte 132 (adjacency graph library)
  12699 +>2 string .VISIX (ascii text)
  12700 +
  12701 +#------------------------------------------------------------------------------
  12702 +# vms: file(1) magic for VMS executables (experimental)
  12703 +#
  12704 +# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
  12705 +
  12706 +# GRR 950122: I'm just guessing on these, based on inspection of the headers
  12707 +# of three executables each for Alpha and VAX architectures. The VAX files
  12708 +# all had headers similar to this:
  12709 +#
  12710 +# 00000 b0 00 30 00 44 00 60 00 00 00 00 00 30 32 30 35 ..0.D.`.....0205
  12711 +# 00010 01 01 00 00 ff ff ff ff ff ff ff ff 00 00 00 00 ................
  12712 +#
  12713 +0 string \xb0\0\x30\0 VMS VAX executable
  12714 +>44032 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
  12715 +#
  12716 +# The AXP files all looked like this, except that the byte at offset 0x22
  12717 +# was 06 in some of them and 07 in others:
  12718 +#
  12719 +# 00000 03 00 00 00 00 00 00 00 ec 02 00 00 10 01 00 00 ................
  12720 +# 00010 68 00 00 00 98 00 00 00 b8 00 00 00 00 00 00 00 h...............
  12721 +# 00020 00 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  12722 +# 00030 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
  12723 +# 00040 00 00 00 00 ff ff ff ff ff ff ff ff 02 00 00 00 ................
  12724 +#
  12725 +0 belong 0x03000000 VMS Alpha executable
  12726 +>75264 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
  12727 +
  12728 +# -----------------------------------------------------------
  12729 +# VMware specific files (deducted from version 1.1 and log file entries)
  12730 +# Anthon van der Neut (anthon@mnt.org)
  12731 +0 belong 0x4d52564e VMware nvram
  12732 +
  12733 +#------------------------------------------------------------------------------
  12734 +# vorbis: file(1) magic for Ogg/Vorbis files
  12735 +#
  12736 +# From Felix von Leitner <leitner@fefe.de>
  12737 +# Extended by Beni Cherniavsky <cben@crosswinds.net>
  12738 +# Further extended by Greg Wooledge <greg@wooledge.org>
  12739 +#
  12740 +# Most (everything but the number of channels and bitrate) is commented
  12741 +# out with `##' as it's not interesting to the average user. The most
  12742 +# probable things advanced users would want to uncomment are probably
  12743 +# the number of comments and the encoder version.
  12744 +#
  12745 +# --- Ogg Framing ---
  12746 +0 string OggS Ogg data
  12747 +>4 byte !0 UNKNOWN REVISION %u
  12748 +##>4 byte 0 revision 0
  12749 +>4 byte 0
  12750 +##>>14 lelong x (Serial %lX)
  12751 +# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
  12752 +>>28 string fLaC \b, FLAC audio
  12753 +# non-Vorbis content: Theora
  12754 +>>28 string \x80theora \b, Theora video
  12755 +# non-Vorbis content: Speex
  12756 +>>28 string Speex\ \ \ \b, Speex audio
  12757 +# non-Vorbis content: OGM
  12758 +>>28 string \x01video\0\0\0 \b, OGM video
  12759 +>>>37 string/c div3 (DivX 3)
  12760 +>>>37 string/c divx (DivX 4)
  12761 +>>>37 string/c dx50 (DivX 5)
  12762 +>>>37 string/c xvid (XviD)
  12763 +# --- First vorbis packet - general header ---
  12764 +>>28 string \x01vorbis \b, Vorbis audio,
  12765 +>>>35 lelong !0 UNKNOWN VERSION %lu,
  12766 +##>>>35 lelong 0 version 0,
  12767 +>>>35 lelong 0
  12768 +>>>>39 ubyte 1 mono,
  12769 +>>>>39 ubyte 2 stereo,
  12770 +>>>>39 ubyte >2 %u channels,
  12771 +>>>>40 lelong x %lu Hz
  12772 +# Minimal, nominal and maximal bitrates specified when encoding
  12773 +>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b,
  12774 +# The above tests if at least one of these is specified:
  12775 +>>>>>52 lelong !-1
  12776 +# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
  12777 +# instead of -1.
  12778 +# Vorbis 1.0 uses 0 instead of -1.
  12779 +>>>>>>52 lelong !0
  12780 +>>>>>>>52 lelong !-1000
  12781 +>>>>>>>>52 lelong x <%lu
  12782 +>>>>>48 lelong !-1
  12783 +>>>>>>48 lelong x ~%lu
  12784 +>>>>>44 lelong !-1
  12785 +>>>>>>44 lelong !-1000
  12786 +>>>>>>>44 lelong !0
  12787 +>>>>>>>>44 lelong x >%lu
  12788 +>>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps
  12789 +# -- Second vorbis header packet - the comments
  12790 +# A kludge to read the vendor string. It's a counted string, not a
  12791 +# zero-terminated one, so file(1) can't read it in a generic way.
  12792 +# libVorbis is the only one existing currently, so I detect specifically
  12793 +# it. The interesting value is the cvs date (8 digits decimal).
  12794 +# Post-RC1 Ogg files have the second header packet (and thus the version)
  12795 +# in a different place, so we must use an indirect offset.
  12796 +>>>(84.b+85) string \x03vorbis
  12797 +>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I
  12798 +>>>>>(84.b+120) string >00000000
  12799 +# Map to beta version numbers:
  12800 +>>>>>>(84.b+120) string <20000508 (<beta1, prepublic)
  12801 +>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2)
  12802 +>>>>>>(84.b+120) string >20000508
  12803 +>>>>>>>(84.b+120) string <20001031 (beta2-3)
  12804 +>>>>>>(84.b+120) string 20001031 (1.0 beta 3)
  12805 +>>>>>>(84.b+120) string >20001031
  12806 +>>>>>>>(84.b+120) string <20010225 (beta3-4)
  12807 +>>>>>>(84.b+120) string 20010225 (1.0 beta 4)
  12808 +>>>>>>(84.b+120) string >20010225
  12809 +>>>>>>>(84.b+120) string <20010615 (beta4-RC1)
  12810 +>>>>>>(84.b+120) string 20010615 (1.0 RC1)
  12811 +>>>>>>(84.b+120) string 20010813 (1.0 RC2)
  12812 +>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1)
  12813 +>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2)
  12814 +>>>>>>(84.b+120) string 20011217 (1.0 RC3)
  12815 +>>>>>>(84.b+120) string 20011231 (1.0 RC3)
  12816 +# Some pre-1.0 CVS snapshots still had "Xiphphorus"...
  12817 +>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS)
  12818 +# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
  12819 +>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I
  12820 +>>>>>(84.b+117) string >00000000
  12821 +>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS)
  12822 +>>>>>>(84.b+117) string 20020717 (1.0)
  12823 +>>>>>>(84.b+117) string 20030909 (1.0.1)
  12824 +>>>>>>(84.b+117) string 20040629 (1.1.0 RC1)
  12825 +
  12826 +#------------------------------------------------------------------------------
  12827 +# VXL: file(1) magic for VXL binary IO data files
  12828 +#
  12829 +# from Ian Scott <scottim@sf.net>
  12830 +#
  12831 +# VXL is a collection of C++ libraries for Computer Vision.
  12832 +# See the vsl chapter in the VXL Book for more info
  12833 +# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
  12834 +# http:/vxl.sf.net
  12835 +
  12836 +2 lelong 0x472b2c4e VXL data file,
  12837 +>0 leshort >0 schema version no %d
  12838 +
  12839 +#------------------------------------------------------------------------------
  12840 +# wordprocessors: file(1) magic fo word processors.
  12841 +#
  12842 +####### PWP file format used on Smith Corona Personal Word Processors:
  12843 +2 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP
  12844 +>24 byte 2 \b, single spaced
  12845 +>24 byte 3 \b, 1.5 spaced
  12846 +>24 byte 4 \b, double spaced
  12847 +>25 byte 0x42 \b, letter
  12848 +>25 byte 0x54 \b, legal
  12849 +>26 byte 0x46 \b, A4
  12850 +
  12851 +#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
  12852 +0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable text
  12853 +>15 byte 0 Optimized for Intel
  12854 +>15 byte 1 Optimized for Non-Intel
  12855 +1 string WPC (Corel/WP)
  12856 +>8 short 257 WordPerfect macro
  12857 +>8 short 258 WordPerfect help file
  12858 +>8 short 259 WordPerfect keyboard file
  12859 +>8 short 266 WordPerfect document
  12860 +>8 short 267 WordPerfect dictionary
  12861 +>8 short 268 WordPerfect thesaurus
  12862 +>8 short 269 WordPerfect block
  12863 +>8 short 270 WordPerfect rectangular block
  12864 +>8 short 271 WordPerfect column block
  12865 +>8 short 272 WordPerfect printer data
  12866 +>8 short 275 WordPerfect printer data
  12867 +>8 short 276 WordPerfect driver resource data
  12868 +>8 short 279 WordPerfect hyphenation code
  12869 +>8 short 280 WordPerfect hyphenation data
  12870 +>8 short 281 WordPerfect macro resource data
  12871 +>8 short 283 WordPerfect hyphenation lex
  12872 +>8 short 285 WordPerfect wordlist
  12873 +>8 short 286 WordPerfect equation resource data
  12874 +>8 short 289 WordPerfect spell rules
  12875 +>8 short 290 WordPerfect dictionary rules
  12876 +>8 short 295 WordPerfect spell rules (Microlytics)
  12877 +>8 short 299 WordPerfect settings file
  12878 +>8 short 301 WordPerfect 4.2 document
  12879 +>8 short 325 WordPerfect dialog file
  12880 +>8 short 332 WordPerfect button bar
  12881 +>8 short 513 Shell macro
  12882 +>8 short 522 Shell definition
  12883 +>8 short 769 Notebook macro
  12884 +>8 short 770 Notebook help file
  12885 +>8 short 771 Notebook keyboard file
  12886 +>8 short 778 Notebook definition
  12887 +>8 short 1026 Calculator help file
  12888 +>8 short 1538 Calendar help file
  12889 +>8 short 1546 Calendar data file
  12890 +>8 short 1793 Editor macro
  12891 +>8 short 1794 Editor help file
  12892 +>8 short 1795 Editor keyboard file
  12893 +>8 short 1817 Editor macro resource file
  12894 +>8 short 2049 Macro editor macro
  12895 +>8 short 2050 Macro editor help file
  12896 +>8 short 2051 Macro editor keyboard file
  12897 +>8 short 2305 PlanPerfect macro
  12898 +>8 short 2306 PlanPerfect help file
  12899 +>8 short 2307 PlanPerfect keyboard file
  12900 +>8 short 2314 PlanPerfect worksheet
  12901 +>8 short 2319 PlanPerfect printer definition
  12902 +>8 short 2322 PlanPerfect graphic definition
  12903 +>8 short 2323 PlanPerfect data
  12904 +>8 short 2324 PlanPerfect temporary printer
  12905 +>8 short 2329 PlanPerfect macro resource data
  12906 +>8 byte 11 Mail
  12907 +>8 short 2818 help file
  12908 +>8 short 2821 distribution list
  12909 +>8 short 2826 out box
  12910 +>8 short 2827 in box
  12911 +>8 short 2836 users archived mailbox
  12912 +>8 short 2837 archived message database
  12913 +>8 short 2838 archived attachments
  12914 +>8 short 3083 Printer temporary file
  12915 +>8 short 3330 Scheduler help file
  12916 +>8 short 3338 Scheduler in file
  12917 +>8 short 3339 Scheduler out file
  12918 +>8 short 3594 GroupWise settings file
  12919 +>8 short 3601 GroupWise directory services
  12920 +>8 short 3627 GroupWise settings file
  12921 +>8 short 4362 Terminal resource data
  12922 +>8 short 4363 Terminal resource data
  12923 +>8 short 4395 Terminal resource data
  12924 +>8 short 4619 GUI loadable text
  12925 +>8 short 4620 graphics resource data
  12926 +>8 short 4621 printer settings file
  12927 +>8 short 4622 port definition file
  12928 +>8 short 4623 print queue parameters
  12929 +>8 short 4624 compressed file
  12930 +>8 short 5130 Network service msg file
  12931 +>8 short 5131 Network service msg file
  12932 +>8 short 5132 Async gateway login msg
  12933 +>8 short 5134 GroupWise message file
  12934 +>8 short 7956 GroupWise admin domain database
  12935 +>8 short 7957 GroupWise admin host database
  12936 +>8 short 7959 GroupWise admin remote host database
  12937 +>8 short 7960 GroupWise admin ADS deferment data file
  12938 +>8 short 8458 IntelliTAG (SGML) compiled DTD
  12939 +>8 long 18219264 WordPerfect graphic image (1.0)
  12940 +>8 long 18219520 WordPerfect graphic image (2.0)
  12941 +#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
  12942 +
  12943 +# Hangul (Korean) Word Processor File
  12944 +0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0
  12945 +# From: Won-Kyu Park <wkpark@kldp.org>
  12946 +512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000
  12947 +
  12948 +# CosmicBook, from Benoît Rouits
  12949 +0 string CSBK Ted Neslson's CosmicBook hypertext file
  12950 +
  12951 +2 string EYWR AmigaWriter file
  12952 +
  12953 +# chi: file(1) magic for ChiWriter files
  12954 +0 string \\1cw\ ChiWriter file
  12955 +>5 string >\0 version %s
  12956 +0 string \\1cw ChiWriter file
  12957 +
  12958 +# Quark Express from http://www.garykessler.net/library/file_sigs.html
  12959 +2 string IIXPR3 Intel Quark Express Document (English)
  12960 +2 string IIXPRa Intel Quark Express Document (Korean)
  12961 +2 string MMXPR3 Motorola Quark Express Document (English)
  12962 +2 string MMXPRa Motorola Quark Express Document (Korean)
  12963 +
  12964 +# adobe indesign (document, whatever...) from querkan
  12965 +0 belong 0x0606edf5 Adobe InDesign
  12966 +>16 string DOCUMENT Document
  12967 +
  12968 +# From: Michael Piefel <piefel@debian.org>
  12969 +# sqtroff intermediate language (replacement for ditroff int. lang.)
  12970 +0 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer
  12971 +0 string X\ hp SoftQuad troff Context intermediate for HP LaserJet
  12972 +0 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS
  12973 +0 string X\ ps SoftQuad troff Context intermediate for PostScript
  12974 +
  12975 +#------------------------------------------------------------------------------
  12976 +# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU>
  12977 +#
  12978 +0 string %XDELTA% XDelta binary patch file 0.14
  12979 +0 string %XDZ000% XDelta binary patch file 0.18
  12980 +0 string %XDZ001% XDelta binary patch file 0.20
  12981 +0 string %XDZ002% XDelta binary patch file 1.0
  12982 +0 string %XDZ003% XDelta binary patch file 1.0.4
  12983 +0 string %XDZ004% XDelta binary patch file 1.1
  12984 +
  12985 +#------------------------------------------------------------------------------
  12986 +# xenix: file(1) magic for Microsoft Xenix
  12987 +#
  12988 +# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
  12989 +# model" lifted from "magic.xenix", with comment "derived empirically;
  12990 +# treat as folklore until proven"
  12991 +#
  12992 +# "small model", "large model", "huge model" stuff lifted from XXX
  12993 +#
  12994 +# XXX - "x.out" collides with PDP-11 archives
  12995 +#
  12996 +0 string core core file (Xenix)
  12997 +0 byte 0x80 8086 relocatable (Microsoft)
  12998 +0 leshort 0xff65 x.out
  12999 +>2 string __.SYMDEF randomized
  13000 +>0 byte x archive
  13001 +0 leshort 0x206 Microsoft a.out
  13002 +>8 leshort 1 Middle model
  13003 +>0x1e leshort &0x10 overlay
  13004 +>0x1e leshort &0x2 separate
  13005 +>0x1e leshort &0x4 pure
  13006 +>0x1e leshort &0x800 segmented
  13007 +>0x1e leshort &0x400 standalone
  13008 +>0x1e leshort &0x8 fixed-stack
  13009 +>0x1c byte &0x80 byte-swapped
  13010 +>0x1c byte &0x40 word-swapped
  13011 +>0x10 lelong >0 not-stripped
  13012 +>0x1e leshort ^0xc000 pre-SysV
  13013 +>0x1e leshort &0x4000 V2.3
  13014 +>0x1e leshort &0x8000 V3.0
  13015 +>0x1c byte &0x4 86
  13016 +>0x1c byte &0xb 186
  13017 +>0x1c byte &0x9 286
  13018 +>0x1c byte &0xa 386
  13019 +>0x1f byte <0x040 small model
  13020 +>0x1f byte =0x048 large model
  13021 +>0x1f byte =0x049 huge model
  13022 +>0x1e leshort &0x1 executable
  13023 +>0x1e leshort ^0x1 object file
  13024 +>0x1e leshort &0x40 Large Text
  13025 +>0x1e leshort &0x20 Large Data
  13026 +>0x1e leshort &0x120 Huge Objects Enabled
  13027 +>0x10 lelong >0 not stripped
  13028 +
  13029 +0 leshort 0x140 old Microsoft 8086 x.out
  13030 +>0x3 byte &0x4 separate
  13031 +>0x3 byte &0x2 pure
  13032 +>0 byte &0x1 executable
  13033 +>0 byte ^0x1 relocatable
  13034 +>0x14 lelong >0 not stripped
  13035 +
  13036 +0 lelong 0x206 b.out
  13037 +>0x1e leshort &0x10 overlay
  13038 +>0x1e leshort &0x2 separate
  13039 +>0x1e leshort &0x4 pure
  13040 +>0x1e leshort &0x800 segmented
  13041 +>0x1e leshort &0x400 standalone
  13042 +>0x1e leshort &0x1 executable
  13043 +>0x1e leshort ^0x1 object file
  13044 +>0x1e leshort &0x4000 V2.3
  13045 +>0x1e leshort &0x8000 V3.0
  13046 +>0x1c byte &0x4 86
  13047 +>0x1c byte &0xb 186
  13048 +>0x1c byte &0x9 286
  13049 +>0x1c byte &0x29 286
  13050 +>0x1c byte &0xa 386
  13051 +>0x1e leshort &0x4 Large Text
  13052 +>0x1e leshort &0x2 Large Data
  13053 +>0x1e leshort &0x102 Huge Objects Enabled
  13054 +
  13055 +0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
  13056 +
  13057 +#------------------------------------------------------------------------------
  13058 +# xo65 object files
  13059 +# From: "Ullrich von Bassewitz" <uz@cc65.org>
  13060 +#
  13061 +0 string \x55\x7A\x6E\x61 xo65 object,
  13062 +>4 leshort x version %d,
  13063 +>6 leshort&0x0001 =0x0001 with debug info
  13064 +>6 leshort&0x0001 =0x0000 no debug info
  13065 +
  13066 +# xo65 library files
  13067 +0 string \x6E\x61\x55\x7A xo65 library,
  13068 +>4 leshort x version %d
  13069 +
  13070 +# o65 object files
  13071 +0 string \x01\x00\x6F\x36\x35 o65
  13072 +>6 leshort&0x1000 =0x0000 executable,
  13073 +>6 leshort&0x1000 =0x1000 object,
  13074 +>5 byte x version %d,
  13075 +>6 leshort&0x8000 =0x8000 65816,
  13076 +>6 leshort&0x8000 =0x0000 6502,
  13077 +>6 leshort&0x2000 =0x2000 32 bit,
  13078 +>6 leshort&0x2000 =0x0000 16 bit,
  13079 +>6 leshort&0x4000 =0x4000 page reloc,
  13080 +>6 leshort&0x4000 =0x0000 byte reloc,
  13081 +>6 leshort&0x0003 =0x0000 alignment 1
  13082 +>6 leshort&0x0003 =0x0001 alignment 2
  13083 +>6 leshort&0x0003 =0x0002 alignment 4
  13084 +>6 leshort&0x0003 =0x0003 alignment 256
  13085 +
  13086 +#------------------------------------------------------------------------------
  13087 +# xwindows: file(1) magic for various X/Window system file formats.
  13088 +
  13089 +# Compiled X Keymap
  13090 +# XKM (compiled X keymap) files (including version and byte ordering)
  13091 +1 string mkx Compiled XKB Keymap: lsb,
  13092 +>0 byte >0 version %d
  13093 +>0 byte =0 obsolete
  13094 +0 string xkm Compiled XKB Keymap: msb,
  13095 +>3 byte >0 version %d
  13096 +>0 byte =0 obsolete
  13097 +
  13098 +# xfsdump archive
  13099 +0 string xFSdump0 xfsdump archive
  13100 +>8 belong x (version %d)
  13101 +
  13102 +# Jaleo XFS files
  13103 +0 long 395726 Jaleo XFS file
  13104 +>4 long x - version %ld
  13105 +>8 long x - [%ld -
  13106 +>20 long x %ldx
  13107 +>24 long x %ldx
  13108 +>28 long 1008 YUV422]
  13109 +>28 long 1000 RGB24]
  13110 +
  13111 +#------------------------------------------------------------------------------
  13112 +# zilog: file(1) magic for Zilog Z8000.
  13113 +#
  13114 +# Was it big-endian or little-endian? My Product Specification doesn't
  13115 +# say.
  13116 +#
  13117 +0 long 0xe807 object file (z8000 a.out)
  13118 +0 long 0xe808 pure object file (z8000 a.out)
  13119 +0 long 0xe809 separate object file (z8000 a.out)
  13120 +0 long 0xe805 overlay object file (z8000 a.out)
  13121 +
  13122 +#------------------------------------------------------------------------------
  13123 +# zyxel: file(1) magic for ZyXEL modems
  13124 +#
  13125 +# From <rob@pe1chl.ampr.org>
  13126 +# These are the /etc/magic entries to decode datafiles as used for the
  13127 +# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
  13128 +# ZyXEL-defined standard)
  13129 +
  13130 +0 string ZyXEL\002 ZyXEL voice data
  13131 +>10 byte 0 - CELP encoding
  13132 +>10 byte&0x0B 1 - ADPCM2 encoding
  13133 +>10 byte&0x0B 2 - ADPCM3 encoding
  13134 +>10 byte&0x0B 3 - ADPCM4 encoding
  13135 +>10 byte&0x0B 8 - New ADPCM3 encoding
  13136 +>10 byte&0x04 4 with resync
lib/util/support.inc.php
  View file @b4546f0
@@ -339,7 +339,7 @@ class SupportUtil @@ -339,7 +339,7 @@ class SupportUtil
339 chdir(dirname($this->path)); 339 chdir(dirname($this->path));
340 $subdir = basename($this->path); 340 $subdir = basename($this->path);
341 $archivename = $this->path . '.zip'; 341 $archivename = $this->path . '.zip';
342 - $cmd = "'$zip' -r '$archivename' '$subdir'"; 342 + $cmd = "\"$zip\" -r \"$archivename\" \"$subdir\"";
343 343
344 KTUtil::pexec($cmd); 344 KTUtil::pexec($cmd);
345 345
@@ -737,6 +737,10 @@ class SupportUtil @@ -737,6 +737,10 @@ class SupportUtil
737 737
738 private function get_index_contents($title, $path, $relative = true) 738 private function get_index_contents($title, $path, $relative = true)
739 { 739 {
  740 + if (!is_dir($path))
  741 + {
  742 + return '';
  743 + }
740 $contents = array(); 744 $contents = array();
741 $dh = opendir($path); 745 $dh = opendir($path);
742 while (($filename = readdir($dh)) !== false) 746 while (($filename = readdir($dh)) !== false)