diff options
119 files changed, 9929 insertions, 2904 deletions
diff --git a/usr.bin/file/LEGAL.NOTICE b/usr.bin/file/LEGAL.NOTICE index db4f26a92d9..630960a1411 100644 --- a/usr.bin/file/LEGAL.NOTICE +++ b/usr.bin/file/LEGAL.NOTICE @@ -1,7 +1,7 @@ -$OpenBSD: LEGAL.NOTICE,v 1.7 2006/07/18 15:01:57 ian Exp $ +$OpenBSD: LEGAL.NOTICE,v 1.8 2008/05/08 01:40:56 chl Exp $ Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995. Software written by Ian F. Darwin and others; -maintained 1994-2004 Christos Zoulas. +maintained 1994- Christos Zoulas. This software is not subject to any export provision of the United States Department of Commerce, and may be exported to any country or planet. diff --git a/usr.bin/file/MAINT b/usr.bin/file/MAINT index f7889af8e99..5749949e828 100644 --- a/usr.bin/file/MAINT +++ b/usr.bin/file/MAINT @@ -1,20 +1,10 @@ -$OpenBSD: MAINT,v 1.3 2006/07/18 15:03:25 ian Exp $ +$OpenBSD: MAINT,v 1.4 2008/05/08 01:40:56 chl Exp $ Maintenance notes: I am continuing to maintain the file command. I welcome your help, but to make my life easier I'd like to request the following: -- Don't change the version numbers! - -If your changes are extensive, I will have to work hard to -integrate them into my version. If you check it into SCCS locally, -the version numbers will likely be kept. IF you check it into RCS -or CVS locally, please use -k to keep the version numbers, and -please use branch deltas (1.21.1, 1.21.2, ...). If you don't do -this, I will likely be unable to use your changes; life's just too -short. - - Do not distribute changed versions. People trying to be helpful occasionally put up their hacked versions @@ -48,8 +38,8 @@ is_tar.c file_is_tar() softmagic.c file_softmagic() match() - looks for match against main magic database ascmagic.c file_ascmagic() - "unknown" readelf.c file_tryelf() + "unknown" Christos Zoulas christos@astron.com diff --git a/usr.bin/file/README b/usr.bin/file/README index 4c78a02faab..e26ac69101f 100644 --- a/usr.bin/file/README +++ b/usr.bin/file/README @@ -1,4 +1,4 @@ -@(#) $OpenBSD: README,v 1.3 2006/07/18 15:08:27 ian Exp $ +@(#) $OpenBSD: README,v 1.4 2008/05/08 01:40:56 chl Exp $ ** README for file(1) Command ** This is Release 4.x of Ian Darwin's (copyright but distributable) @@ -89,9 +89,15 @@ E-mail: christos@astron.com Phone: Do not even think of telephoning me about this program. Send cash first! -Parts of this software were developed at the University of Toronto Computing Services -and at SoftQuad Inc., developers of SGML/HTML/XML publishing software, in Toronto, Canada. -SoftQuad was swallowed up by Corel in 2002 and does not exist any longer. +Parts of this software were developed at SoftQuad Inc., developers +of SGML/HTML/XML publishing software, in Toronto, Canada. +SoftQuad was swallowed up by Corel in 2002 +and does not exist any longer. -Kees Zeelenberg reports that an MS-Windows (Win32) port of file(1) -is available from http://gnuwin32.sourceforge.net/ +From: Kees Zeelenberg + +An MS-Windows (Win32) port of File-4.17 is available from +http://gnuwin32.sourceforge.net/ + +File is an implementation of the Unix File(1) command. +It knows the 'magic number' of several thousands of file types. diff --git a/usr.bin/file/apprentice.c b/usr.bin/file/apprentice.c index 73fdab7f1cf..fb5ff000544 100644 --- a/usr.bin/file/apprentice.c +++ b/usr.bin/file/apprentice.c @@ -1,4 +1,4 @@ -/* $OpenBSD: apprentice.c,v 1.24 2007/10/05 14:29:46 chl Exp $ */ +/* $OpenBSD: apprentice.c,v 1.25 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Ian F. Darwin 1986-1995. * Software written by Ian F. Darwin and others; @@ -37,6 +37,7 @@ #include <unistd.h> #endif #include <string.h> +#include <assert.h> #include <ctype.h> #include <fcntl.h> #include <sys/stat.h> @@ -46,7 +47,7 @@ #endif #ifndef lint -FILE_RCSID("@(#)$Id: apprentice.c,v 1.24 2007/10/05 14:29:46 chl Exp $") +FILE_RCSID("@(#)$Id: apprentice.c,v 1.25 2008/05/08 01:40:56 chl Exp $") #endif /* lint */ #define EATAB {while (isascii((unsigned char) *l) && \ @@ -75,31 +76,47 @@ FILE_RCSID("@(#)$Id: apprentice.c,v 1.24 2007/10/05 14:29:46 chl Exp $") #define MAXPATHLEN 1024 #endif -private int getvalue(struct magic_set *ms, struct magic *, char **); +struct magic_entry { + struct magic *mp; + uint32_t cont_count; + uint32_t max_count; +}; + +int file_formats[FILE_NAMES_SIZE]; +const size_t file_nformats = FILE_NAMES_SIZE; +const char *file_names[FILE_NAMES_SIZE]; +const size_t file_nnames = FILE_NAMES_SIZE; + +private int getvalue(struct magic_set *ms, struct magic *, const char **, int); private int hextoint(int); -private char *getstr(struct magic_set *, char *, char *, int, int *); -private int parse(struct magic_set *, struct magic **, uint32_t *, char *, int); -private void eatsize(char **); +private const char *getstr(struct magic_set *, const char *, char *, int, + int *, int); +private int parse(struct magic_set *, struct magic_entry **, uint32_t *, + const char *, size_t, int); +private void eatsize(const char **); private int apprentice_1(struct magic_set *, const char *, int, struct mlist *); +private size_t apprentice_magic_strength(const struct magic *); +private int apprentice_sort(const void *, const void *); private int apprentice_file(struct magic_set *, struct magic **, uint32_t *, const char *, int); private void byteswap(struct magic *, uint32_t); private void bs1(struct magic *); private uint16_t swap2(uint16_t); private uint32_t swap4(uint32_t); -private char *mkdbname(const char *, char *, size_t); +private uint64_t swap8(uint64_t); +private char *mkdbname(const char *, char *, size_t, int); private int apprentice_map(struct magic_set *, struct magic **, uint32_t *, const char *); private int apprentice_compile(struct magic_set *, struct magic **, uint32_t *, const char *); +private int check_format_type(const char *, int); +private int check_format(struct magic_set *, struct magic *); private size_t maxmagic = 0; private size_t magicsize = sizeof(struct magic); + #ifdef COMPILE_ONLY -const char *magicfile; -char *progname; -int lineno; int main(int, char *[]); @@ -107,6 +124,8 @@ int main(int argc, char *argv[]) { int ret; + struct magic_set *ms; + char *progname; if ((progname = strrchr(argv[0], '/')) != NULL) progname++; @@ -114,15 +133,98 @@ main(int argc, char *argv[]) progname = argv[0]; if (argc != 2) { - (void)fprintf(stderr, "usage: %s file\n", progname); - exit(1); + (void)fprintf(stderr, "Usage: %s file\n", progname); + return 1; } - magicfile = argv[1]; - exit(file_apprentice(magicfile, COMPILE, MAGIC_CHECK) == -1 ? 1 : 0); + if ((ms = magic_open(MAGIC_CHECK)) == NULL) { + (void)fprintf(stderr, "%s: %s\n", progname, strerror(errno)); + return 1; + } + ret = magic_compile(ms, argv[1]) == -1 ? 1 : 0; + if (ret == 1) + (void)fprintf(stderr, "%s: %s\n", progname, magic_error(ms)); + magic_close(ms); + return ret; } #endif /* COMPILE_ONLY */ +static const struct type_tbl_s { + const char *name; + const size_t len; + const int type; + const int format; +} type_tbl[] = { +# define XX(s) s, (sizeof(s) - 1) +# define XX_NULL NULL, 0 + { XX("byte"), FILE_BYTE, FILE_FMT_NUM }, + { XX("short"), FILE_SHORT, FILE_FMT_NUM }, + { XX("default"), FILE_DEFAULT, FILE_FMT_STR }, + { XX("long"), FILE_LONG, FILE_FMT_NUM }, + { XX("string"), FILE_STRING, FILE_FMT_STR }, + { XX("date"), FILE_DATE, FILE_FMT_STR }, + { XX("beshort"), FILE_BESHORT, FILE_FMT_NUM }, + { XX("belong"), FILE_BELONG, FILE_FMT_NUM }, + { XX("bedate"), FILE_BEDATE, FILE_FMT_STR }, + { XX("leshort"), FILE_LESHORT, FILE_FMT_NUM }, + { XX("lelong"), FILE_LELONG, FILE_FMT_NUM }, + { XX("ledate"), FILE_LEDATE, FILE_FMT_STR }, + { XX("pstring"), FILE_PSTRING, FILE_FMT_STR }, + { XX("ldate"), FILE_LDATE, FILE_FMT_STR }, + { XX("beldate"), FILE_BELDATE, FILE_FMT_STR }, + { XX("leldate"), FILE_LELDATE, FILE_FMT_STR }, + { XX("regex"), FILE_REGEX, FILE_FMT_STR }, + { XX("bestring16"), FILE_BESTRING16, FILE_FMT_STR }, + { XX("lestring16"), FILE_LESTRING16, FILE_FMT_STR }, + { XX("search"), FILE_SEARCH, FILE_FMT_STR }, + { XX("medate"), FILE_MEDATE, FILE_FMT_STR }, + { XX("meldate"), FILE_MELDATE, FILE_FMT_STR }, + { XX("melong"), FILE_MELONG, FILE_FMT_NUM }, + { XX("quad"), FILE_QUAD, FILE_FMT_QUAD }, + { XX("lequad"), FILE_LEQUAD, FILE_FMT_QUAD }, + { XX("bequad"), FILE_BEQUAD, FILE_FMT_QUAD }, + { XX("qdate"), FILE_QDATE, FILE_FMT_STR }, + { XX("leqdate"), FILE_LEQDATE, FILE_FMT_STR }, + { XX("beqdate"), FILE_BEQDATE, FILE_FMT_STR }, + { XX("qldate"), FILE_QLDATE, FILE_FMT_STR }, + { XX("leqldate"), FILE_LEQLDATE, FILE_FMT_STR }, + { XX("beqldate"), FILE_BEQLDATE, FILE_FMT_STR }, + { XX_NULL, FILE_INVALID, FILE_FMT_NONE }, +# undef XX +# undef XX_NULL +}; + +private int +get_type(const char *l, const char **t) +{ + const struct type_tbl_s *p; + + for (p = type_tbl; p->name; p++) { + if (strncmp(l, p->name, p->len) == 0) { + if (t) + *t = l + p->len; + break; + } + } + return p->type; +} + +private void +init_file_tables(void) +{ + static int done = 0; + const struct type_tbl_s *p; + + if (done) + return; + done++; + + for (p = type_tbl; p->name; p++) { + assert(p->type < FILE_NAMES_SIZE); + file_names[p->type] = p->name; + file_formats[p->type] = p->format; + } +} /* * Handle one file. @@ -152,18 +254,16 @@ apprentice_1(struct magic_set *ms, const char *fn, int action, free(magic); return rv; } + #ifndef COMPILE_ONLY if ((rv = apprentice_map(ms, &magic, &nmagic, fn)) == -1) { if (ms->flags & MAGIC_CHECK) - file_magwarn("using regular magic file `%s'", fn); + file_magwarn(ms, "using regular magic file `%s'", fn); rv = apprentice_file(ms, &magic, &nmagic, fn, action); if (rv != 0) return -1; - mapped = 0; } - if (rv == -1) - return rv; mapped = rv; if (magic == NULL || nmagic == 0) { @@ -173,7 +273,7 @@ apprentice_1(struct magic_set *ms, const char *fn, int action, if ((ml = malloc(sizeof(*ml))) == NULL) { file_delmagic(magic, mapped, nmagic); - file_oomem(ms); + file_oomem(ms, sizeof(*ml)); return -1; } @@ -196,12 +296,15 @@ file_delmagic(struct magic *p, int type, size_t entries) if (p == NULL) return; switch (type) { +#ifdef QUICK case 2: p--; (void)munmap((void *)p, sizeof(*p) * (entries + 1)); break; +#endif case 1: p--; + /*FALLTHROUGH*/ case 0: free(p); break; @@ -210,7 +313,6 @@ file_delmagic(struct magic *p, int type, size_t entries) } } - /* const char *fn: list of magic files */ protected struct mlist * file_apprentice(struct magic_set *ms, const char *fn, int action) @@ -218,20 +320,24 @@ file_apprentice(struct magic_set *ms, const char *fn, int action) char *p, *mfn, *afn = NULL; int file_err, errs = -1; struct mlist *mlist; + static const char mime[] = ".mime"; + + init_file_tables(); if (fn == NULL) fn = getenv("MAGIC"); if (fn == NULL) fn = MAGIC; - if ((fn = mfn = strdup(fn)) == NULL) { - file_oomem(ms); + if ((mfn = strdup(fn)) == NULL) { + file_oomem(ms, strlen(fn)); return NULL; } + fn = mfn; if ((mlist = malloc(sizeof(*mlist))) == NULL) { free(mfn); - file_oomem(ms); + file_oomem(ms, sizeof(*mlist)); return NULL; } mlist->next = mlist->prev = mlist; @@ -243,11 +349,11 @@ file_apprentice(struct magic_set *ms, const char *fn, int action) if (*fn == '\0') break; if (ms->flags & MAGIC_MIME) { - size_t len = strlen(fn) + 5 + 1; + size_t len = strlen(fn) + sizeof(mime); if ((afn = malloc(len)) == NULL) { free(mfn); free(mlist); - file_oomem(ms); + file_oomem(ms, len); return NULL; } (void)strlcpy(afn, fn, len); @@ -275,6 +381,129 @@ file_apprentice(struct magic_set *ms, const char *fn, int action) } /* + * Get weight of this magic entry, for sorting purposes. + */ +private size_t +apprentice_magic_strength(const struct magic *m) +{ +#define MULT 10 + size_t val = 2 * MULT; /* baseline strength */ + + switch (m->type) { + case FILE_DEFAULT: /* make sure this sorts last */ + return 0; + + case FILE_BYTE: + val += 1 * MULT; + break; + + case FILE_SHORT: + case FILE_LESHORT: + case FILE_BESHORT: + val += 2 * MULT; + break; + + case FILE_LONG: + case FILE_LELONG: + case FILE_BELONG: + case FILE_MELONG: + val += 4 * MULT; + break; + + case FILE_PSTRING: + case FILE_STRING: + val += m->vallen * MULT; + break; + + case FILE_BESTRING16: + case FILE_LESTRING16: + val += m->vallen * MULT / 2; + break; + + case FILE_SEARCH: + case FILE_REGEX: + val += m->vallen; + break; + + case FILE_DATE: + case FILE_LEDATE: + case FILE_BEDATE: + case FILE_MEDATE: + case FILE_LDATE: + case FILE_LELDATE: + case FILE_BELDATE: + case FILE_MELDATE: + val += 4 * MULT; + break; + + case FILE_QUAD: + case FILE_BEQUAD: + case FILE_LEQUAD: + case FILE_QDATE: + case FILE_LEQDATE: + case FILE_BEQDATE: + case FILE_QLDATE: + case FILE_LEQLDATE: + case FILE_BEQLDATE: + val += 8 * MULT; + break; + + default: + val = 0; + (void)fprintf(stderr, "Bad type %d\n", m->type); + abort(); + } + + switch (m->reln) { + case 'x': /* matches anything penalize */ + val = 0; + break; + + case '!': + case '=': /* Exact match, prefer */ + val += MULT; + break; + + case '>': + case '<': /* comparison match reduce strength */ + val -= 2 * MULT; + break; + + case '^': + case '&': /* masking bits, we could count them too */ + val -= MULT; + break; + + default: + (void)fprintf(stderr, "Bad relation %c\n", m->reln); + abort(); + } + + if (val == 0) /* ensure we only return 0 for FILE_DEFAULT */ + val = 1; + + return val; +} + +/* + * Sort callback for sorting entries by "strength" (basically length) + */ +private int +apprentice_sort(const void *a, const void *b) +{ + const struct magic_entry *ma = a; + const struct magic_entry *mb = b; + size_t sa = apprentice_magic_strength(ma->mp); + size_t sb = apprentice_magic_strength(mb->mp); + if (sa == sb) + return 0; + else if (sa > sb) + return -1; + else + return 1; +} + +/* * parse from a file * const char *fn: name of magic file */ @@ -286,10 +515,14 @@ apprentice_file(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, "cont\toffset\ttype\topcode\tmask\tvalue\tdesc"; FILE *f; char line[BUFSIZ]; - int lineno; int errs = 0; + struct magic_entry *marray; + uint32_t marraycount, i, mentrycount = 0; + size_t lineno = 0; - f = fopen(fn, "r"); + ms->flags |= MAGIC_CHECK; /* Enable checks for parsed files */ + + f = fopen(ms->file = fn, "r"); if (f == NULL) { if (errno != ENOENT) file_error(ms, errno, "cannot read magic file `%s'", @@ -298,45 +531,97 @@ apprentice_file(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, } maxmagic = MAXMAGIS; - *magicp = (struct magic *) calloc(maxmagic, sizeof(struct magic)); - if (*magicp == NULL) { + if ((marray = calloc(maxmagic, sizeof(*marray))) == NULL) { (void)fclose(f); - file_oomem(ms); + file_oomem(ms, maxmagic * sizeof(*marray)); return -1; } + marraycount = 0; /* print silly verbose header for USG compat. */ if (action == FILE_CHECK) (void)fprintf(stderr, "%s\n", hdr); - /* parse it */ - for (lineno = 1; fgets(line, sizeof(line), f) != NULL; lineno++) { - if (line[0]=='#') /* comment, do not parse */ + /* read and parse this file */ + for (ms->line = 1; fgets(line, sizeof(line), f) != NULL; ms->line++) { + size_t len; + len = strlen(line); + if (len == 0) /* null line, garbage, etc */ + continue; + if (line[len - 1] == '\n') { + lineno++; + line[len - 1] = '\0'; /* delete newline */ + } + if (line[0] == '\0') /* empty, do not parse */ continue; - /* delete newline */ - line[strcspn(line, "\n")] = '\0'; - if (line[0] == '\0') + if (line[0] == '#') /* comment, do not parse */ continue; - if (parse(ms, magicp, nmagicp, line, action) != 0) - errs = 1; + if (parse(ms, &marray, &marraycount, line, lineno, action) != 0) + errs++; } (void)fclose(f); + if (errs) + goto out; + +#ifndef NOORDER + qsort(marray, marraycount, sizeof(*marray), apprentice_sort); + /* + * Make sure that any level 0 "default" line is last (if one exists). + */ + for (i = 0; i < marraycount; i++) { + if (marray[i].mp->cont_level == 0 && + marray[i].mp->type == FILE_DEFAULT) { + while (++i < marraycount) + if (marray[i].mp->cont_level == 0) + break; + if (i != marraycount) { + ms->line = marray[i].mp->lineno; /* XXX - Ugh! */ + file_magwarn(ms, + "level 0 \"default\" did not sort last"); + } + break; + } + } +#endif + + for (i = 0; i < marraycount; i++) + mentrycount += marray[i].cont_count; + + if ((*magicp = malloc(sizeof(**magicp) * mentrycount)) == NULL) { + file_oomem(ms, sizeof(**magicp) * mentrycount); + errs++; + goto out; + } + + mentrycount = 0; + for (i = 0; i < marraycount; i++) { + (void)memcpy(*magicp + mentrycount, marray[i].mp, + marray[i].cont_count * sizeof(**magicp)); + mentrycount += marray[i].cont_count; + } +out: + for (i = 0; i < marraycount; i++) + free(marray[i].mp); + free(marray); if (errs) { - free(*magicp); *magicp = NULL; *nmagicp = 0; + return errs; + } else { + *nmagicp = mentrycount; + return 0; } - return errs; + } /* * extend the sign bit if the comparison is to be signed */ -protected uint32_t -file_signextend(struct magic_set *ms, struct magic *m, uint32_t v) +protected uint64_t +file_signextend(struct magic_set *ms, struct magic *m, uint64_t v) { - if (!(m->flag & UNSIGNED)) + if (!(m->flag & UNSIGNED)) { switch(m->type) { /* * Do not remove the casts below. They are @@ -354,77 +639,294 @@ file_signextend(struct magic_set *ms, struct magic *m, uint32_t v) case FILE_DATE: case FILE_BEDATE: case FILE_LEDATE: + case FILE_MEDATE: case FILE_LDATE: case FILE_BELDATE: case FILE_LELDATE: + case FILE_MELDATE: case FILE_LONG: case FILE_BELONG: case FILE_LELONG: + case FILE_MELONG: v = (int32_t) v; break; + case FILE_QUAD: + case FILE_BEQUAD: + case FILE_LEQUAD: + case FILE_QDATE: + case FILE_QLDATE: + case FILE_BEQDATE: + case FILE_BEQLDATE: + case FILE_LEQDATE: + case FILE_LEQLDATE: + v = (int64_t) v; + break; case FILE_STRING: case FILE_PSTRING: - break; + case FILE_BESTRING16: + case FILE_LESTRING16: case FILE_REGEX: + case FILE_SEARCH: + case FILE_DEFAULT: break; default: if (ms->flags & MAGIC_CHECK) - file_magwarn("cannot happen: m->type=%d\n", + file_magwarn(ms, "cannot happen: m->type=%d\n", m->type); return ~0U; } + } return v; } +private int +string_modifier_check(struct magic_set *ms, struct magic const *m) +{ + if ((ms->flags & MAGIC_CHECK) == 0) + return 0; + + switch (m->type) { + case FILE_BESTRING16: + case FILE_LESTRING16: + if (m->str_flags != 0) { + file_magwarn(ms, "no modifiers allowed for 16-bit strings\n"); + return -1; + } + break; + case FILE_STRING: + case FILE_PSTRING: + if ((m->str_flags & REGEX_OFFSET_START) != 0) { + file_magwarn(ms, "'/%c' only allowed on regex and search\n", + CHAR_REGEX_OFFSET_START); + return -1; + } + break; + case FILE_SEARCH: + break; + case FILE_REGEX: + if ((m->str_flags & STRING_COMPACT_BLANK) != 0) { + file_magwarn(ms, "'/%c' not allowed on regex\n", + CHAR_COMPACT_BLANK); + return -1; + } + if ((m->str_flags & STRING_COMPACT_OPTIONAL_BLANK) != 0) { + file_magwarn(ms, "'/%c' not allowed on regex\n", + CHAR_COMPACT_OPTIONAL_BLANK); + return -1; + } + break; + default: + file_magwarn(ms, "coding error: m->type=%d\n", + m->type); + return -1; + } + return 0; +} + +private int +get_op(char c) +{ + switch (c) { + case '&': + return FILE_OPAND; + case '|': + return FILE_OPOR; + case '^': + return FILE_OPXOR; + case '+': + return FILE_OPADD; + case '-': + return FILE_OPMINUS; + case '*': + return FILE_OPMULTIPLY; + case '/': + return FILE_OPDIVIDE; + case '%': + return FILE_OPMODULO; + default: + return -1; + } +} + +#ifdef ENABLE_CONDITIONALS +private int +get_cond(const char *l, const char **t) +{ + static struct cond_tbl_s { + const char *name; + const size_t len; + const int cond; + } cond_tbl[] = { + { "if", 2, COND_IF }, + { "elif", 4, COND_ELIF }, + { "else", 4, COND_ELSE }, + { NULL, 0, COND_NONE }, + }; + struct cond_tbl_s *p; + + for (p = cond_tbl; p->name; p++) { + if (strncmp(l, p->name, p->len) == 0 && + isspace((unsigned char)l[p->len])) { + if (t) + *t = l + p->len; + break; + } + } + return p->cond; +} + +private int +check_cond(struct magic_set *ms, int cond, uint32_t cont_level) +{ + int last_cond; + last_cond = ms->c.li[cont_level].last_cond; + + switch (cond) { + case COND_IF: + if (last_cond != COND_NONE && last_cond != COND_ELIF) { + if (ms->flags & MAGIC_CHECK) + file_magwarn(ms, "syntax error: `if'"); + return -1; + } + last_cond = COND_IF; + break; + + case COND_ELIF: + if (last_cond != COND_IF && last_cond != COND_ELIF) { + if (ms->flags & MAGIC_CHECK) + file_magwarn(ms, "syntax error: `elif'"); + return -1; + } + last_cond = COND_ELIF; + break; + + case COND_ELSE: + if (last_cond != COND_IF && last_cond != COND_ELIF) { + if (ms->flags & MAGIC_CHECK) + file_magwarn(ms, "syntax error: `else'"); + return -1; + } + last_cond = COND_NONE; + break; + + case COND_NONE: + last_cond = COND_NONE; + break; + } + + ms->c.li[cont_level].last_cond = last_cond; + return 0; +} +#endif /* ENABLE_CONDITIONALS */ + /* * parse one line from magic file, put into magic[index++] if valid */ private int -parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l, - int action) +parse(struct magic_set *ms, struct magic_entry **mentryp, uint32_t *nmentryp, + const char *line, size_t lineno, int action) { +#ifdef ENABLE_CONDITIONALS + static uint32_t last_cont_level = 0; +#endif + size_t i; + struct magic_entry *me; struct magic *m; + const char *l = line; char *t; - private const char *fops = FILE_OPS; - uint32_t val; - -#define ALLOC_INCR 200 - if (*nmagicp + 1 >= maxmagic){ - maxmagic += ALLOC_INCR; - if ((m = (struct magic *) realloc(*magicp, - sizeof(struct magic) * maxmagic)) == NULL) { - file_oomem(ms); - if (*magicp) - free(*magicp); - return -1; - } - *magicp = m; - memset(&(*magicp)[*nmagicp], 0, sizeof(struct magic) - * ALLOC_INCR); - } - m = &(*magicp)[*nmagicp]; - m->flag = 0; - m->cont_level = 0; + int op; + uint32_t cont_level; + + cont_level = 0; while (*l == '>') { ++l; /* step over */ - m->cont_level++; + cont_level++; } +#ifdef ENABLE_CONDITIONALS + if (cont_level == 0 || cont_level > last_cont_level) + if (file_check_mem(ms, cont_level) == -1) + return -1; + last_cont_level = cont_level; +#endif - if (m->cont_level != 0 && *l == '(') { - ++l; /* step over */ - m->flag |= INDIR; +#define ALLOC_CHUNK (size_t)10 +#define ALLOC_INCR (size_t)200 + + if (cont_level != 0) { + if (*nmentryp == 0) { + file_error(ms, 0, "No current entry for continuation"); + return -1; + } + me = &(*mentryp)[*nmentryp - 1]; + if (me->cont_count == me->max_count) { + struct magic *nm; + size_t cnt = me->max_count + ALLOC_CHUNK; + if ((nm = realloc(me->mp, sizeof(*nm) * cnt)) == NULL) { + file_oomem(ms, sizeof(*nm) * cnt); + return -1; + } + me->mp = m = nm; + me->max_count = cnt; + } + m = &me->mp[me->cont_count++]; + (void)memset(m, 0, sizeof(*m)); + m->cont_level = cont_level; + } else { + if (*nmentryp == maxmagic) { + struct magic_entry *mp; + + maxmagic += ALLOC_INCR; + if ((mp = realloc(*mentryp, sizeof(*mp) * maxmagic)) == + NULL) { + file_oomem(ms, sizeof(*mp) * maxmagic); + return -1; + } + (void)memset(&mp[*nmentryp], 0, sizeof(*mp) * + ALLOC_INCR); + *mentryp = mp; + } + me = &(*mentryp)[*nmentryp]; + if (me->mp == NULL) { + if ((m = malloc(sizeof(*m) * ALLOC_CHUNK)) == NULL) { + file_oomem(ms, sizeof(*m) * ALLOC_CHUNK); + return -1; + } + me->mp = m; + me->max_count = ALLOC_CHUNK; + } else + m = me->mp; + (void)memset(m, 0, sizeof(*m)); + m->cont_level = 0; + me->cont_count = 1; } - if (m->cont_level != 0 && *l == '&') { + m->lineno = lineno; + + if (*l == '&') { /* m->cont_level == 0 checked below. */ ++l; /* step over */ m->flag |= OFFADD; } + if (*l == '(') { + ++l; /* step over */ + m->flag |= INDIR; + if (m->flag & OFFADD) + m->flag = (m->flag & ~OFFADD) | INDIROFFADD; + + if (*l == '&') { /* m->cont_level == 0 checked below */ + ++l; /* step over */ + m->flag |= OFFADD; + } + } + /* Indirect offsets are not valid at level 0. */ + if (m->cont_level == 0 && (m->flag & (OFFADD | INDIROFFADD))) + if (ms->flags & MAGIC_CHECK) + file_magwarn(ms, "relative offset at level 0"); /* get offset, then skip over it */ m->offset = (uint32_t)strtoul(l, &t, 0); if (l == t) if (ms->flags & MAGIC_CHECK) - file_magwarn("offset %s invalid", l); + file_magwarn(ms, "offset `%s' invalid", l); l = t; if (m->flag & INDIR) { @@ -442,6 +944,9 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l, case 'L': m->in_type = FILE_BELONG; break; + case 'm': + m->in_type = FILE_MELONG; + break; case 'h': case 's': m->in_type = FILE_LESHORT; @@ -458,183 +963,138 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l, break; default: if (ms->flags & MAGIC_CHECK) - file_magwarn( - "indirect offset type %c invalid", + file_magwarn(ms, + "indirect offset type `%c' invalid", *l); break; } l++; } + + m->in_op = 0; if (*l == '~') { - m->in_op = FILE_OPINVERSE; + m->in_op |= FILE_OPINVERSE; l++; } - switch (*l) { - case '&': - m->in_op |= FILE_OPAND; - l++; - break; - case '|': - m->in_op |= FILE_OPOR; - l++; - break; - case '^': - m->in_op |= FILE_OPXOR; + if ((op = get_op(*l)) != -1) { + m->in_op |= op; l++; - break; - case '+': - m->in_op |= FILE_OPADD; - l++; - break; - case '-': - m->in_op |= FILE_OPMINUS; - l++; - break; - case '*': - m->in_op |= FILE_OPMULTIPLY; - l++; - break; - case '/': - m->in_op |= FILE_OPDIVIDE; - l++; - break; - case '%': - m->in_op |= FILE_OPMODULO; + } + if (*l == '(') { + m->in_op |= FILE_OPINDIRECT; l++; - break; } - if (isdigit((unsigned char)*l)) - m->in_offset = (uint32_t)strtoul(l, &t, 0); - else - t = l; - if (*t++ != ')') + if (isdigit((unsigned char)*l) || *l == '-') { + m->in_offset = (int32_t)strtol(l, &t, 0); + if (l == t) + if (ms->flags & MAGIC_CHECK) + file_magwarn(ms, + "in_offset `%s' invalid", l); + l = t; + } + if (*l++ != ')' || + ((m->in_op & FILE_OPINDIRECT) && *l++ != ')')) if (ms->flags & MAGIC_CHECK) - file_magwarn("missing ')' in indirect offset"); - l = t; + file_magwarn(ms, + "missing ')' in indirect offset"); } + EATAB; +#ifdef ENABLE_CONDITIONALS + m->cond = get_cond(l, &l); + if (check_cond(ms, m->cond, cont_level) == -1) + return -1; - while (isascii((unsigned char)*l) && isdigit((unsigned char)*l)) - ++l; EATAB; - -#define NBYTE 4 -#define NSHORT 5 -#define NLONG 4 -#define NSTRING 6 -#define NDATE 4 -#define NBESHORT 7 -#define NBELONG 6 -#define NBEDATE 6 -#define NLESHORT 7 -#define NLELONG 6 -#define NLEDATE 6 -#define NPSTRING 7 -#define NLDATE 5 -#define NBELDATE 7 -#define NLELDATE 7 -#define NREGEX 5 +#endif if (*l == 'u') { ++l; m->flag |= UNSIGNED; } - /* get type, skip it */ - if (strncmp(l, "char", NBYTE)==0) { /* HP/UX compat */ - m->type = FILE_BYTE; - l += NBYTE; - } else if (strncmp(l, "byte", NBYTE)==0) { - m->type = FILE_BYTE; - l += NBYTE; - } else if (strncmp(l, "short", NSHORT)==0) { - m->type = FILE_SHORT; - l += NSHORT; - } else if (strncmp(l, "long", NLONG)==0) { - m->type = FILE_LONG; - l += NLONG; - } else if (strncmp(l, "string", NSTRING)==0) { - m->type = FILE_STRING; - l += NSTRING; - } else if (strncmp(l, "date", NDATE)==0) { - m->type = FILE_DATE; - l += NDATE; - } else if (strncmp(l, "beshort", NBESHORT)==0) { - m->type = FILE_BESHORT; - l += NBESHORT; - } else if (strncmp(l, "belong", NBELONG)==0) { - m->type = FILE_BELONG; - l += NBELONG; - } else if (strncmp(l, "bedate", NBEDATE)==0) { - m->type = FILE_BEDATE; - l += NBEDATE; - } else if (strncmp(l, "leshort", NLESHORT)==0) { - m->type = FILE_LESHORT; - l += NLESHORT; - } else if (strncmp(l, "lelong", NLELONG)==0) { - m->type = FILE_LELONG; - l += NLELONG; - } else if (strncmp(l, "ledate", NLEDATE)==0) { - m->type = FILE_LEDATE; - l += NLEDATE; - } else if (strncmp(l, "pstring", NPSTRING)==0) { - m->type = FILE_PSTRING; - l += NPSTRING; - } else if (strncmp(l, "ldate", NLDATE)==0) { - m->type = FILE_LDATE; - l += NLDATE; - } else if (strncmp(l, "beldate", NBELDATE)==0) { - m->type = FILE_BELDATE; - l += NBELDATE; - } else if (strncmp(l, "leldate", NLELDATE)==0) { - m->type = FILE_LELDATE; - l += NLELDATE; - } else if (strncmp(l, "regex", NREGEX)==0) { - m->type = FILE_REGEX; - l += sizeof("regex"); - } else { + m->type = get_type(l, &l); + if (m->type == FILE_INVALID) { if (ms->flags & MAGIC_CHECK) - file_magwarn("type %s invalid", l); + file_magwarn(ms, "type `%s' invalid", l); return -1; } + /* New-style anding: "0 byte&0x80 =0x80 dynamically linked" */ /* New and improved: ~ & | ^ + - * / % -- exciting, isn't it? */ + + m->mask_op = 0; if (*l == '~') { - if (FILE_STRING != m->type && FILE_PSTRING != m->type) - m->mask_op = FILE_OPINVERSE; + if (!IS_STRING(m->type)) + m->mask_op |= FILE_OPINVERSE; + else if (ms->flags & MAGIC_CHECK) + file_magwarn(ms, "'~' invalid for string types"); ++l; } - if ((t = strchr(fops, *l)) != NULL) { - uint32_t op = (uint32_t)(t - fops); - if (op != FILE_OPDIVIDE || - (FILE_STRING != m->type && FILE_PSTRING != m->type)) { + m->str_count = 0; + m->str_flags = 0; + m->num_mask = 0; + if ((op = get_op(*l)) != -1) { + if (!IS_STRING(m->type)) { + uint64_t val; ++l; m->mask_op |= op; - val = (uint32_t)strtoul(l, &l, 0); - m->mask = file_signextend(ms, m, val); + val = (uint64_t)strtoull(l, &t, 0); + l = t; + m->num_mask = file_signextend(ms, m, val); eatsize(&l); - } else { - m->mask = 0L; + } + else if (op == FILE_OPDIVIDE) { + int have_count = 0; while (!isspace((unsigned char)*++l)) { switch (*l) { - case CHAR_IGNORE_LOWERCASE: - m->mask |= STRING_IGNORE_LOWERCASE; + /* for portability avoid "case '0' ... '9':" */ + case '0': case '1': case '2': + case '3': case '4': case '5': + case '6': case '7': case '8': + case '9': { + if (have_count && ms->flags & MAGIC_CHECK) + file_magwarn(ms, + "multiple counts"); + have_count = 1; + m->str_count = strtoul(l, &t, 0); + l = t - 1; break; + } case CHAR_COMPACT_BLANK: - m->mask |= STRING_COMPACT_BLANK; + m->str_flags |= STRING_COMPACT_BLANK; break; case CHAR_COMPACT_OPTIONAL_BLANK: - m->mask |= + m->str_flags |= STRING_COMPACT_OPTIONAL_BLANK; break; + case CHAR_IGNORE_LOWERCASE: + m->str_flags |= STRING_IGNORE_LOWERCASE; + break; + case CHAR_IGNORE_UPPERCASE: + m->str_flags |= STRING_IGNORE_UPPERCASE; + break; + case CHAR_REGEX_OFFSET_START: + m->str_flags |= REGEX_OFFSET_START; + break; default: if (ms->flags & MAGIC_CHECK) - file_magwarn( - "string extension %c invalid", + file_magwarn(ms, + "string extension `%c' invalid", *l); return -1; } + /* allow multiple '/' for readability */ + if (l[1] == '/' && !isspace((unsigned char)l[2])) + l++; } + if (string_modifier_check(ms, m) == -1) + return -1; + } + else { + if (ms->flags & MAGIC_CHECK) + file_magwarn(ms, "invalid string op: %c", *t); + return -1; } } /* @@ -658,26 +1118,24 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l, } break; case '!': - if (m->type != FILE_STRING && m->type != FILE_PSTRING) { - m->reln = *l; - ++l; - break; - } - /*FALLTHROUGH*/ + m->reln = *l; + ++l; + break; default: - if (*l == 'x' && isascii((unsigned char)l[1]) && - isspace((unsigned char)l[1])) { + m->reln = '='; /* the default relation */ + if (*l == 'x' && ((isascii((unsigned char)l[1]) && + isspace((unsigned char)l[1])) || !l[1])) { m->reln = *l; ++l; - goto GetDesc; /* Bill The Cat */ } - m->reln = '='; break; } - EATAB; - - if (getvalue(ms, m, &l)) + /* + * Grab the value part, except for an 'x' reln. + */ + if (m->reln != 'x' && getvalue(ms, m, &l, action)) return -1; + /* * TODO finish this macro and start using it! * #define offsetcheck {if (offset > HOWMANY-1) @@ -685,9 +1143,8 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l, */ /* - * now get last part - the description + * Now get last part - the description */ -GetDesc: EATAB; if (l[0] == '\b') { ++l; @@ -698,15 +1155,183 @@ GetDesc: m->nospflag = 1; } else m->nospflag = 0; + for (i = 0; (m->desc[i++] = *l++) != '\0' && i < sizeof(m->desc); ) + continue; + if (i == sizeof(m->desc)) { + m->desc[sizeof(m->desc) - 1] = '\0'; + if (ms->flags & MAGIC_CHECK) + file_magwarn(ms, "description `%s' truncated", m->desc); + } - strlcpy(m->desc, l, sizeof(m->desc)); - + /* + * We only do this check while compiling, or if any of the magic + * files were not compiled. + */ + if (ms->flags & MAGIC_CHECK) { + if (check_format(ms, m) == -1) + return -1; + } #ifndef COMPILE_ONLY if (action == FILE_CHECK) { file_mdump(m); } #endif - ++(*nmagicp); /* make room for next */ + if (m->cont_level == 0) + ++(*nmentryp); /* make room for next */ + return 0; +} + +private int +check_format_type(const char *ptr, int type) +{ + int quad = 0; + if (*ptr == '\0') { + /* Missing format string; bad */ + return -1; + } + + switch (type) { + case FILE_FMT_QUAD: + quad = 1; + /*FALLTHROUGH*/ + case FILE_FMT_NUM: + if (*ptr == '-') + ptr++; + if (*ptr == '.') + ptr++; + while (isdigit((unsigned char)*ptr)) ptr++; + if (*ptr == '.') + ptr++; + while (isdigit((unsigned char)*ptr)) ptr++; + if (quad) { + if (*ptr++ != 'l') + return -1; + if (*ptr++ != 'l') + return -1; + } + + switch (*ptr++) { + case 'l': + switch (*ptr++) { + case 'i': + case 'd': + case 'u': + case 'x': + case 'X': + return 0; + default: + return -1; + } + + case 'h': + switch (*ptr++) { + case 'h': + switch (*ptr++) { + case 'i': + case 'd': + case 'u': + case 'x': + case 'X': + return 0; + default: + return -1; + } + case 'd': + return 0; + default: + return -1; + } + + case 'i': + case 'c': + case 'd': + case 'u': + case 'x': + case 'X': + return 0; + + default: + return -1; + } + + case FILE_FMT_STR: + if (*ptr == '-') + ptr++; + while (isdigit((unsigned char )*ptr)) + ptr++; + if (*ptr == '.') { + ptr++; + while (isdigit((unsigned char )*ptr)) + ptr++; + } + + switch (*ptr++) { + case 's': + return 0; + default: + return -1; + } + + default: + /* internal error */ + abort(); + } + /*NOTREACHED*/ + return -1; +} + +/* + * Check that the optional printf format in description matches + * the type of the magic. + */ +private int +check_format(struct magic_set *ms, struct magic *m) +{ + char *ptr; + + for (ptr = m->desc; *ptr; ptr++) + if (*ptr == '%') + break; + if (*ptr == '\0') { + /* No format string; ok */ + return 1; + } + + assert(file_nformats == file_nnames); + + if (m->type >= file_nformats) { + file_error(ms, 0, "Internal error inconsistency between " + "m->type and format strings"); + return -1; + } + if (file_formats[m->type] == FILE_FMT_NONE) { + file_error(ms, 0, "No format string for `%s' with description " + "`%s'", m->desc, file_names[m->type]); + return -1; + } + + ptr++; + if (check_format_type(ptr, file_formats[m->type]) == -1) { + /* + * TODO: this error message is unhelpful if the format + * string is not one character long + */ + file_error(ms, 0, "Printf format `%c' is not valid for type " + " `%s' in description `%s'", + ptr && *ptr ? *ptr : '?', + file_names[m->type], m->desc); + return -1; + } + + for (; *ptr; ptr++) { + if (*ptr == '%') { + file_error(ms, 0, + "Too many format strings (should have at most one) " + "for `%s' with description `%s'", + file_names[m->type], m->desc); + return -1; + } + } return 0; } @@ -716,18 +1341,21 @@ GetDesc: * just after the number read. Return 0 for success, non-zero for failure. */ private int -getvalue(struct magic_set *ms, struct magic *m, char **p) +getvalue(struct magic_set *ms, struct magic *m, const char **p, int action) { int slen; switch (m->type) { + case FILE_BESTRING16: + case FILE_LESTRING16: case FILE_STRING: case FILE_PSTRING: case FILE_REGEX: - *p = getstr(ms, *p, m->value.s, sizeof(m->value.s), &slen); + case FILE_SEARCH: + *p = getstr(ms, *p, m->value.s, sizeof(m->value.s), &slen, action); if (*p == NULL) { if (ms->flags & MAGIC_CHECK) - file_magwarn("cannot get string from `%s'", + file_magwarn(ms, "cannot get string from `%s'", m->value.s); return -1; } @@ -735,8 +1363,10 @@ getvalue(struct magic_set *ms, struct magic *m, char **p) return 0; default: if (m->reln != 'x') { - m->value.l = file_signextend(ms, m, - (uint32_t)strtoul(*p, p, 0)); + char *ep; + m->value.q = file_signextend(ms, m, + (uint64_t)strtoull(*p, &ep, 0)); + *p = ep; eatsize(p); } return 0; @@ -749,10 +1379,11 @@ getvalue(struct magic_set *ms, struct magic *m, char **p) * Copy the converted version to "p", returning its length in *slen. * Return updated scan pointer as function result. */ -private char * -getstr(struct magic_set *ms, char *s, char *p, int plen, int *slen) +private const char * +getstr(struct magic_set *ms, const char *s, char *p, int plen, int *slen, int action) { - char *origs = s, *origp = p; + const char *origs = s; + char *origp = p; char *pmax = p + plen - 1; int c; int val; @@ -764,16 +1395,66 @@ getstr(struct magic_set *ms, char *s, char *p, int plen, int *slen) file_error(ms, 0, "string too long: `%s'", origs); return NULL; } - if(c == '\\') { + if (c == '\\') { switch(c = *s++) { case '\0': + if (action == FILE_COMPILE) + file_magwarn(ms, "incomplete escape"); goto out; + case '\t': + if (action == FILE_COMPILE) { + file_magwarn(ms, + "escaped tab found, use \\t instead"); + action++; + } + /*FALLTHROUGH*/ default: + if (action == FILE_COMPILE) { + if (isprint((unsigned char)c)) + file_magwarn(ms, + "no need to escape `%c'", c); + else + file_magwarn(ms, + "unknown escape sequence: \\%03o", c); + } + /*FALLTHROUGH*/ + /* space, perhaps force people to use \040? */ + case ' ': +#if 0 + /* + * Other things people escape, but shouldn't need to, + * so we disallow them + */ + case '\'': + case '"': + case '?': +#endif + /* Relations */ + case '>': + case '<': + case '&': + case '^': + case '=': + case '!': + /* and baskslash itself */ + case '\\': *p++ = (char) c; break; + case 'a': + *p++ = '\a'; + break; + + case 'b': + *p++ = '\b'; + break; + + case 'f': + *p++ = '\f'; + break; + case 'n': *p++ = '\n'; break; @@ -782,18 +1463,10 @@ getstr(struct magic_set *ms, char *s, char *p, int plen, int *slen) *p++ = '\r'; break; - case 'b': - *p++ = '\b'; - break; - case 't': *p++ = '\t'; break; - case 'f': - *p++ = '\f'; - break; - case 'v': *p++ = '\v'; break; @@ -809,11 +1482,11 @@ getstr(struct magic_set *ms, char *s, char *p, int plen, int *slen) case '7': val = c - '0'; c = *s++; /* try for 2 */ - if(c >= '0' && c <= '7') { - val = (val<<3) | (c - '0'); + if (c >= '0' && c <= '7') { + val = (val << 3) | (c - '0'); c = *s++; /* try for 3 */ - if(c >= '0' && c <= '7') - val = (val<<3) | (c-'0'); + if (c >= '0' && c <= '7') + val = (val << 3) | (c-'0'); else --s; } @@ -856,9 +1529,9 @@ hextoint(int c) return -1; if (isdigit((unsigned char) c)) return c - '0'; - if ((c >= 'a')&&(c <= 'f')) + if ((c >= 'a') && (c <= 'f')) return c + 10 - 'a'; - if (( c>= 'A')&&(c <= 'F')) + if (( c>= 'A') && (c <= 'F')) return c + 10 - 'A'; return -1; } @@ -882,12 +1555,23 @@ file_showstr(FILE *fp, const char *s, size_t len) if (len-- == 0) break; } - if(c >= 040 && c <= 0176) /* TODO isprint && !iscntrl */ + if (c >= 040 && c <= 0176) /* TODO isprint && !iscntrl */ (void) fputc(c, fp); else { (void) fputc('\\', fp); switch (c) { - + case '\a': + (void) fputc('a', fp); + break; + + case '\b': + (void) fputc('b', fp); + break; + + case '\f': + (void) fputc('f', fp); + break; + case '\n': (void) fputc('n', fp); break; @@ -896,18 +1580,10 @@ file_showstr(FILE *fp, const char *s, size_t len) (void) fputc('r', fp); break; - case '\b': - (void) fputc('b', fp); - break; - case '\t': (void) fputc('t', fp); break; - case '\f': - (void) fputc('f', fp); - break; - case '\v': (void) fputc('v', fp); break; @@ -924,9 +1600,9 @@ file_showstr(FILE *fp, const char *s, size_t len) * eatsize(): Eat the size spec from a number [eg. 10UL] */ private void -eatsize(char **p) +eatsize(const char **p) { - char *l = *p; + const char *l = *p; if (LOWCASE(*l) == 'u') l++; @@ -959,13 +1635,13 @@ apprentice_map(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, uint32_t version; int needsbyteswap; char buf[MAXPATHLEN]; - char *dbname = mkdbname(fn, buf, sizeof(buf)); + char *dbname = mkdbname(fn, buf, sizeof(buf), 0); void *mm = NULL; if (dbname == NULL) return -1; - if ((fd = open(dbname, O_RDONLY)) == -1) + if ((fd = open(dbname, O_RDONLY|O_BINARY)) == -1) return -1; if (fstat(fd, &st) == -1) { @@ -986,7 +1662,7 @@ apprentice_map(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, #define RET 2 #else if ((mm = malloc((size_t)st.st_size)) == NULL) { - file_oomem(ms); + file_oomem(ms, (size_t)st.st_size); goto error; } if (read(fd, mm, (size_t)st.st_size) != (size_t)st.st_size) { @@ -1050,12 +1726,12 @@ apprentice_compile(struct magic_set *ms, struct magic **magicp, { int fd; char buf[MAXPATHLEN]; - char *dbname = mkdbname(fn, buf, sizeof(buf)); + char *dbname = mkdbname(fn, buf, sizeof(buf), 1); if (dbname == NULL) return -1; - if ((fd = open(dbname, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1) { + if ((fd = open(dbname, O_WRONLY|O_CREAT|O_TRUNC|O_BINARY, 0644)) == -1) { file_error(ms, errno, "cannot open `%s'", dbname); return -1; } @@ -1086,13 +1762,14 @@ private const char ext[] = ".mgc"; * make a dbname */ private char * -mkdbname(const char *fn, char *buf, size_t bufsiz) +mkdbname(const char *fn, char *buf, size_t bufsiz, int strip) { -#ifdef notdef - const char *p; - if ((p = strrchr(fn, '/')) != NULL) - fn = ++p; -#endif + if (strip) { + const char *p; + if ((p = strrchr(fn, '/')) != NULL) + fn = ++p; + } + (void)snprintf(buf, bufsiz, "%s%s", fn, ext); return buf; } @@ -1139,6 +1816,26 @@ swap4(uint32_t sv) } /* + * swap a quad + */ +private uint64_t +swap8(uint64_t sv) +{ + uint32_t rv; + uint8_t *s = (uint8_t *)(void *)&sv; + uint8_t *d = (uint8_t *)(void *)&rv; + d[0] = s[3]; + d[1] = s[2]; + d[2] = s[1]; + d[3] = s[0]; + d[4] = s[7]; + d[5] = s[6]; + d[6] = s[5]; + d[7] = s[4]; + return rv; +} + +/* * byteswap a single magic entry */ private void @@ -1147,7 +1844,13 @@ bs1(struct magic *m) m->cont_level = swap2(m->cont_level); m->offset = swap4((uint32_t)m->offset); m->in_offset = swap4((uint32_t)m->in_offset); - if (m->type != FILE_STRING) - m->value.l = swap4(m->value.l); - m->mask = swap4(m->mask); + m->lineno = swap4((uint32_t)m->lineno); + if (IS_STRING(m->type)) { + m->str_count = swap4(m->str_count); + m->str_flags = swap4(m->str_flags); + } + else { + m->value.q = swap8(m->value.q); + m->num_mask = swap8(m->num_mask); + } } diff --git a/usr.bin/file/ascmagic.c b/usr.bin/file/ascmagic.c index 23542545e7f..b5cc8b991d6 100644 --- a/usr.bin/file/ascmagic.c +++ b/usr.bin/file/ascmagic.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ascmagic.c,v 1.8 2004/05/19 02:32:35 tedu Exp $ */ +/* $OpenBSD: ascmagic.c,v 1.9 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Ian F. Darwin 1986-1995. * Software written by Ian F. Darwin and others; @@ -50,7 +50,7 @@ #include "names.h" #ifndef lint -FILE_RCSID("@(#)$Id: ascmagic.c,v 1.8 2004/05/19 02:32:35 tedu Exp $") +FILE_RCSID("@(#)$Id: ascmagic.c,v 1.9 2008/05/08 01:40:56 chl Exp $") #endif /* lint */ typedef unsigned long unichar; @@ -72,10 +72,11 @@ protected int file_ascmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes) { size_t i; - unsigned char nbuf[HOWMANY+1]; /* one extra for terminating '\0' */ - unichar ubuf[HOWMANY+1]; /* one extra for terminating '\0' */ + unsigned char *nbuf = NULL; + unichar *ubuf = NULL; size_t ulen; struct names *p; + int rv = -1; const char *code = NULL; const char *code_mime = NULL; @@ -85,26 +86,27 @@ file_ascmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes) int has_escapes = 0; int has_backspace = 0; + int seen_cr = 0; int n_crlf = 0; int n_lf = 0; int n_cr = 0; int n_nel = 0; - int last_line_end = -1; + size_t last_line_end = (size_t)-1; int has_long_lines = 0; /* * Undo the NUL-termination kindly provided by process() * but leave at least one byte to look at */ - while (nbytes > 1 && buf[nbytes - 1] == '\0') nbytes--; - /* nbuf and ubuf relies on this */ - if (nbytes > HOWMANY) - nbytes = HOWMANY; + if ((nbuf = calloc(1, (nbytes + 1) * sizeof(nbuf[0]))) == NULL) + goto done; + if ((ubuf = calloc(1, (nbytes + 1) * sizeof(ubuf[0]))) == NULL) + goto done; /* * Then try to determine whether it's any character code we can @@ -148,10 +150,16 @@ file_ascmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes) type = "character data"; code_mime = "ebcdic"; } else { - return 0; /* doesn't look like text at all */ + rv = 0; + goto done; /* doesn't look like text at all */ } } + if (nbytes <= 1) { + rv = 0; + goto done; + } + /* * for troff, look for . + letter + letter or .\"; * this must be done to disambiguate tar archives' ./file @@ -160,7 +168,7 @@ file_ascmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes) * I believe Plan 9 troff allows non-ASCII characters in the names * of macros, so this test might possibly fail on such a file. */ - if (*ubuf == '.') { + if ((ms->flags & MAGIC_NO_CHECK_TROFF) == 0 && *ubuf == '.') { unichar *tp = ubuf + 1; while (ISSPC(*tp)) @@ -177,7 +185,8 @@ file_ascmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes) } } - if ((*buf == 'c' || *buf == 'C') && ISSPC(buf[1])) { + if ((ms->flags & MAGIC_NO_CHECK_FORTRAN) == 0 && + (*buf == 'c' || *buf == 'C') && ISSPC(buf[1])) { subtype_mime = "text/fortran"; subtype = "fortran program"; goto subtype_identified; @@ -185,6 +194,9 @@ file_ascmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes) /* look for tokens from names.h - this is expensive! */ + if ((ms->flags & MAGIC_NO_CHECK_TOKENS) != 0) + goto subtype_identified; + i = 0; while (i < ulen) { size_t end; @@ -225,66 +237,75 @@ subtype_identified: * Now try to discover other details about the file. */ for (i = 0; i < ulen; i++) { - if (i > last_line_end + MAXLINELEN) - has_long_lines = 1; - - if (ubuf[i] == '\033') - has_escapes = 1; - if (ubuf[i] == '\b') - has_backspace = 1; - - if (ubuf[i] == '\r' && (i + 1 < ulen && ubuf[i + 1] == '\n')) { - n_crlf++; + if (ubuf[i] == '\n') { + if (seen_cr) + n_crlf++; + else + n_lf++; last_line_end = i; - } - if (ubuf[i] == '\r' && (i + 1 >= ulen || ubuf[i + 1] != '\n')) { + } else if (seen_cr) n_cr++; + + seen_cr = (ubuf[i] == '\r'); + if (seen_cr) last_line_end = i; - } - if (ubuf[i] == '\n' && ((int)i - 1 < 0 || ubuf[i - 1] != '\r')){ - n_lf++; - last_line_end = i; - } + if (ubuf[i] == 0x85) { /* X3.64/ECMA-43 "next line" character */ n_nel++; last_line_end = i; } + + /* If this line is _longer_ than MAXLINELEN, remember it. */ + if (i > last_line_end + MAXLINELEN) + has_long_lines = 1; + + if (ubuf[i] == '\033') + has_escapes = 1; + if (ubuf[i] == '\b') + has_backspace = 1; } + /* Beware, if the data has been truncated, the final CR could have + been followed by a LF. If we have HOWMANY bytes, it indicates + that the data might have been truncated, probably even before + this function was called. */ + if (seen_cr && nbytes < HOWMANY) + n_cr++; + if ((ms->flags & MAGIC_MIME)) { if (subtype_mime) { if (file_printf(ms, subtype_mime) == -1) - return -1; + goto done; } else { if (file_printf(ms, "text/plain") == -1) - return -1; + goto done; } if (code_mime) { if (file_printf(ms, "; charset=") == -1) - return -1; + goto done; if (file_printf(ms, code_mime) == -1) - return -1; + goto done; } } else { if (file_printf(ms, code) == -1) - return -1; + goto done; if (subtype) { if (file_printf(ms, " ") == -1) - return -1; + goto done; if (file_printf(ms, subtype) == -1) - return -1; + goto done; } if (file_printf(ms, " ") == -1) - return -1; + goto done; if (file_printf(ms, type) == -1) - return -1; + goto done; if (has_long_lines) if (file_printf(ms, ", with very long lines") == -1) - return -1; + goto done; /* * Only report line terminators if we find one other than LF, @@ -293,51 +314,57 @@ subtype_identified: if ((n_crlf == 0 && n_cr == 0 && n_nel == 0 && n_lf == 0) || (n_crlf != 0 || n_cr != 0 || n_nel != 0)) { if (file_printf(ms, ", with") == -1) - return -1; + goto done; if (n_crlf == 0 && n_cr == 0 && n_nel == 0 && n_lf == 0) { if (file_printf(ms, " no") == -1) - return -1; + goto done; } else { if (n_crlf) { if (file_printf(ms, " CRLF") == -1) - return -1; + goto done; if (n_cr || n_lf || n_nel) if (file_printf(ms, ",") == -1) - return -1; + goto done; } if (n_cr) { if (file_printf(ms, " CR") == -1) - return -1; + goto done; if (n_lf || n_nel) if (file_printf(ms, ",") == -1) - return -1; + goto done; } if (n_lf) { if (file_printf(ms, " LF") == -1) - return -1; + goto done; if (n_nel) if (file_printf(ms, ",") == -1) - return -1; + goto done; } if (n_nel) if (file_printf(ms, " NEL") == -1) - return -1; + goto done; } if (file_printf(ms, " line terminators") == -1) - return -1; + goto done; } if (has_escapes) if (file_printf(ms, ", with escape sequences") == -1) - return -1; + goto done; if (has_backspace) if (file_printf(ms, ", with overstriking") == -1) - return -1; + goto done; } + rv = 1; +done: + if (nbuf) + free(nbuf); + if (ubuf) + free(ubuf); - return 1; + return rv; } private int @@ -439,7 +466,7 @@ private int looks_ascii(const unsigned char *buf, size_t nbytes, unichar *ubuf, size_t *ulen) { - int i; + size_t i; *ulen = 0; @@ -458,7 +485,7 @@ looks_ascii(const unsigned char *buf, size_t nbytes, unichar *ubuf, private int looks_latin1(const unsigned char *buf, size_t nbytes, unichar *ubuf, size_t *ulen) { - int i; + size_t i; *ulen = 0; @@ -478,7 +505,7 @@ private int looks_extended(const unsigned char *buf, size_t nbytes, unichar *ubuf, size_t *ulen) { - int i; + size_t i; *ulen = 0; @@ -497,7 +524,8 @@ looks_extended(const unsigned char *buf, size_t nbytes, unichar *ubuf, private int looks_utf8(const unsigned char *buf, size_t nbytes, unichar *ubuf, size_t *ulen) { - int i, n; + size_t i; + int n; unichar c; int gotone = 0; @@ -561,7 +589,7 @@ looks_unicode(const unsigned char *buf, size_t nbytes, unichar *ubuf, size_t *ulen) { int bigend; - int i; + size_t i; if (nbytes < 2) return 0; @@ -680,7 +708,7 @@ private unsigned char ebcdic_1047_to_8859[] = { private void from_ebcdic(const unsigned char *buf, size_t nbytes, unsigned char *out) { - int i; + size_t i; for (i = 0; i < nbytes; i++) { out[i] = ebcdic_to_ascii[buf[i]]; diff --git a/usr.bin/file/compress.c b/usr.bin/file/compress.c index 1c70d56bb5b..a17a1d32861 100644 --- a/usr.bin/file/compress.c +++ b/usr.bin/file/compress.c @@ -1,4 +1,4 @@ -/* $OpenBSD: compress.c,v 1.11 2004/05/19 02:32:35 tedu Exp $ */ +/* $OpenBSD: compress.c,v 1.12 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Ian F. Darwin 1986-1995. * Software written by Ian F. Darwin and others; @@ -43,19 +43,22 @@ #include <string.h> #include <errno.h> #include <sys/types.h> +#include <sys/ioctl.h> #ifdef HAVE_SYS_WAIT_H #include <sys/wait.h> #endif -#undef HAVE_LIBZ +#if defined(HAVE_SYS_TIME_H) +#include <sys/time.h> +#endif #ifdef HAVE_LIBZ #include <zlib.h> #endif + #ifndef lint -FILE_RCSID("@(#)$Id: compress.c,v 1.11 2004/05/19 02:32:35 tedu Exp $") +FILE_RCSID("@(#)$Id: compress.c,v 1.12 2008/05/08 01:40:56 chl Exp $") #endif - private struct { const char *magic; size_t maglen; @@ -71,23 +74,27 @@ private struct { { "\037\240", 2, { "gzip", "-cdq", NULL }, 1 }, /* SCO LZH */ /* the standard pack utilities do not accept standard input */ { "\037\036", 2, { "gzip", "-cdq", NULL }, 0 }, /* packed */ + { "PK\3\4", 4, { "gzip", "-cdq", NULL }, 1 }, /* pkzipped, */ + /* ...only first file examined */ { "BZh", 3, { "bzip2", "-cd", NULL }, 1 }, /* bzip2-ed */ }; -private int ncompr = sizeof(compr) / sizeof(compr[0]); +private size_t ncompr = sizeof(compr) / sizeof(compr[0]); + +#define NODATA ((size_t)~0) private ssize_t swrite(int, const void *, size_t); -private ssize_t sread(int, void *, size_t); -private size_t uncompressbuf(struct magic_set *, size_t, const unsigned char *, - unsigned char **, size_t); +private size_t uncompressbuf(struct magic_set *, int, size_t, + const unsigned char *, unsigned char **, size_t); #ifdef HAVE_LIBZ private size_t uncompressgzipped(struct magic_set *, const unsigned char *, unsigned char **, size_t); #endif protected int -file_zmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes) +file_zmagic(struct magic_set *ms, int fd, const char *name, + const unsigned char *buf, size_t nbytes) { unsigned char *newbuf = NULL; size_t i, nsz; @@ -100,14 +107,15 @@ file_zmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes) if (nbytes < compr[i].maglen) continue; if (memcmp(buf, compr[i].magic, compr[i].maglen) == 0 && - (nsz = uncompressbuf(ms, i, buf, &newbuf, nbytes)) != 0) { + (nsz = uncompressbuf(ms, fd, i, buf, &newbuf, + nbytes)) != NODATA) { ms->flags &= ~MAGIC_COMPRESS; rv = -1; - if (file_buffer(ms, newbuf, nsz) == -1) + if (file_buffer(ms, -1, name, newbuf, nsz) == -1) goto error; if (file_printf(ms, " (") == -1) goto error; - if (file_buffer(ms, buf, nbytes) == -1) + if (file_buffer(ms, -1, NULL, buf, nbytes) == -1) goto error; if (file_printf(ms, ")") == -1) goto error; @@ -150,14 +158,55 @@ swrite(int fd, const void *buf, size_t n) /* * `safe' read for sockets and pipes. */ -private ssize_t -sread(int fd, void *buf, size_t n) +protected ssize_t +sread(int fd, void *buf, size_t n, int canbepipe) { - int rv; + int rv, cnt; +#ifdef FIONREAD + int t = 0; +#endif size_t rn = n; + if (fd == STDIN_FILENO) + goto nocheck; + +#ifdef FIONREAD + if ((canbepipe && (ioctl(fd, FIONREAD, &t) == -1)) || (t == 0)) { +#ifdef FD_ZERO + for (cnt = 0;; cnt++) { + fd_set check; + struct timeval tout = {0, 100 * 1000}; + int selrv; + + FD_ZERO(&check); + FD_SET(fd, &check); + + /* + * Avoid soft deadlock: do not read if there + * is nothing to read from sockets and pipes. + */ + selrv = select(fd + 1, &check, NULL, NULL, &tout); + if (selrv == -1) { + if (errno == EINTR || errno == EAGAIN) + continue; + } else if (selrv == 0 && cnt >= 5) { + return 0; + } else + break; + } +#endif + (void)ioctl(fd, FIONREAD, &t); + } + + if (t > 0 && (size_t)t < n) { + n = t; + rn = n; + } +#endif + +nocheck: do - switch (rv = read(fd, buf, n)) { + switch ((rv = read(fd, buf, n))) { case -1: if (errno == EINTR) continue; @@ -204,7 +253,7 @@ file_pipe2file(struct magic_set *ms, int fd, const void *startbuf, if (swrite(tfd, startbuf, nbytes) != (ssize_t)nbytes) r = 1; else { - while ((r = sread(fd, buf, sizeof(buf))) > 0) + while ((r = sread(fd, buf, sizeof(buf), 1)) > 0) if (swrite(tfd, buf, (size_t)r) != r) break; } @@ -300,82 +349,116 @@ uncompressgzipped(struct magic_set *ms, const unsigned char *old, } n = (size_t)z.total_out; - inflateEnd(&z); + (void)inflateEnd(&z); /* let's keep the nul-terminate tradition */ - (*newch)[n++] = '\0'; + (*newch)[n] = '\0'; return n; } #endif private size_t -uncompressbuf(struct magic_set *ms, size_t method, const unsigned char *old, - unsigned char **newch, size_t n) +uncompressbuf(struct magic_set *ms, int fd, size_t method, + const unsigned char *old, unsigned char **newch, size_t n) { int fdin[2], fdout[2]; int r; - /* The buffer is NUL terminated, and we don't need that. */ - n--; - #ifdef HAVE_LIBZ if (method == 2) return uncompressgzipped(ms, old, newch, n); #endif + (void)fflush(stdout); + (void)fflush(stderr); - if (pipe(fdin) == -1 || pipe(fdout) == -1) { + if ((fd != -1 && pipe(fdin) == -1) || pipe(fdout) == -1) { file_error(ms, errno, "cannot create pipe"); - return 0; + return NODATA; } switch (fork()) { case 0: /* child */ (void) close(0); - (void) dup(fdin[0]); - (void) close(fdin[0]); - (void) close(fdin[1]); + if (fd != -1) { + (void) dup(fd); + (void) lseek(0, (off_t)0, SEEK_SET); + } else { + (void) dup(fdin[0]); + (void) close(fdin[0]); + (void) close(fdin[1]); + } (void) close(1); (void) dup(fdout[1]); (void) close(fdout[0]); (void) close(fdout[1]); +#ifndef DEBUG if (compr[method].silent) - (void) close(2); + (void)close(2); +#endif - execvp(compr[method].argv[0], - (char *const *)compr[method].argv); + (void)execvp(compr[method].argv[0], + (char *const *)(intptr_t)compr[method].argv); +#ifdef DEBUG + (void)fprintf(stderr, "exec `%s' failed (%s)\n", + compr[method].argv[0], strerror(errno)); +#endif exit(1); /*NOTREACHED*/ case -1: file_error(ms, errno, "could not fork"); - return 0; + return NODATA; default: /* parent */ - (void) close(fdin[0]); (void) close(fdout[1]); - /* fork again, to avoid blocking because both pipes filled */ - switch (fork()) { - case 0: /* child */ - (void)close(fdout[0]); - if (swrite(fdin[1], old, n) != n) + if (fd == -1) { + (void) close(fdin[0]); + /* + * fork again, to avoid blocking because both + * pipes filled + */ + switch (fork()) { + case 0: /* child */ + (void)close(fdout[0]); + if (swrite(fdin[1], old, n) != (ssize_t)n) { +#ifdef DEBUG + (void)fprintf(stderr, + "Write failed (%s)\n", + strerror(errno)); +#endif + exit(1); + } + exit(0); + /*NOTREACHED*/ + + case -1: +#ifdef DEBUG + (void)fprintf(stderr, "Fork failed (%s)\n", + strerror(errno)); +#endif exit(1); - exit(0); - /*NOTREACHED*/ + /*NOTREACHED*/ - case -1: - exit(1); - /*NOTREACHED*/ - - default: /* parent */ - break; + default: /* parent */ + break; + } + (void) close(fdin[1]); + fdin[1] = -1; } - (void) close(fdin[1]); - fdin[1] = -1; + if ((*newch = (unsigned char *) malloc(HOWMANY + 1)) == NULL) { +#ifdef DEBUG + (void)fprintf(stderr, "Malloc failed (%s)\n", + strerror(errno)); +#endif n = 0; goto err; } - if ((r = sread(fdout[0], *newch, HOWMANY)) <= 0) { + if ((r = sread(fdout[0], *newch, HOWMANY, 0)) <= 0) { +#ifdef DEBUG + (void)fprintf(stderr, "Read failed (%s)\n", + strerror(errno)); +#endif free(*newch); n = 0; newch[0] = '\0'; @@ -384,7 +467,7 @@ uncompressbuf(struct magic_set *ms, size_t method, const unsigned char *old, n = r; } /* NUL terminate, as every buffer is handled here. */ - (*newch)[n++] = '\0'; + (*newch)[n] = '\0'; err: if (fdin[1] != -1) (void) close(fdin[1]); diff --git a/usr.bin/file/config.h b/usr.bin/file/config.h index 138a23f1237..242650c2d31 100644 --- a/usr.bin/file/config.h +++ b/usr.bin/file/config.h @@ -4,7 +4,7 @@ * but can still carefully import stuff from Christos' version. * * This file is in the public domain. Original Author Ian F. Darwin. - * $OpenBSD: config.h,v 1.2 2004/05/19 02:32:35 tedu Exp $ + * $OpenBSD: config.h,v 1.3 2008/05/08 01:40:56 chl Exp $ */ /* header file issues. */ @@ -15,8 +15,14 @@ #define HAVE_SYS_STAT_H 1 #define HAVE_INTTYPES_H 1 #define HAVE_GETOPT_H 1 +#define HAVE_LIMITS_H 1 /* #define HAVE_LIBZ 1 DO NOT ENABLE YET -- ian */ +#define HAVE_STRTOUL +#define HAVE_STRERROR +#define HAVE_VSNPRINTF +#define HAVE_SNPRINTF + /* Compiler issues */ #define HAVE_LONG_LONG 1 #define SIZEOF_UINT8_T 1 diff --git a/usr.bin/file/file.c b/usr.bin/file/file.c index cd1169b3ea0..8c06ffa732f 100644 --- a/usr.bin/file/file.c +++ b/usr.bin/file/file.c @@ -1,4 +1,4 @@ -/* $OpenBSD: file.c,v 1.17 2007/02/19 13:02:08 tom Exp $ */ +/* $OpenBSD: file.c,v 1.18 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Ian F. Darwin 1986-1995. * Software written by Ian F. Darwin and others; @@ -40,7 +40,6 @@ #include <sys/types.h> #include <sys/param.h> /* for MAXPATHLEN */ #include <sys/stat.h> -#include <fcntl.h> /* for open() */ #ifdef RESTORE_TIME # if (__COHERENT__ >= 0x420) # include <sys/utime.h> @@ -73,18 +72,18 @@ #include "patchlevel.h" #ifndef lint -FILE_RCSID("@(#)$Id: file.c,v 1.17 2007/02/19 13:02:08 tom Exp $") +FILE_RCSID("@(#)$Id: file.c,v 1.18 2008/05/08 01:40:56 chl Exp $") #endif /* lint */ #ifdef S_IFLNK -#define SYMLINKFLAG "L" +#define SYMLINKFLAG "Lh" #else #define SYMLINKFLAG "" #endif -#define USAGE "Usage: %s [-bck" SYMLINKFLAG "Nnrsvz] [-F separator] [-f namefile] [-m magicfiles] file ...\n" \ - " %s [-m magicfiles] -C\n" +# define USAGE "Usage: %s [-bck" SYMLINKFLAG "nNrsvz0] [-e test] [-f namefile] [-F separator] [-m magicfiles] file...\n" \ + " %s [-m magicfiles] -C\n" #ifndef MAXPATHLEN #define MAXPATHLEN 512 @@ -93,15 +92,15 @@ FILE_RCSID("@(#)$Id: file.c,v 1.17 2007/02/19 13:02:08 tom Exp $") private int /* Global command-line options */ bflag = 0, /* brief output format */ nopad = 0, /* Don't pad output */ - nobuffer = 0; /* Do not buffer stdout */ + nobuffer = 0, /* Do not buffer stdout */ + nulsep = 0; /* Append '\0' to the separator */ private const char *magicfile = 0; /* where the magic is */ private const char *default_magicfile = MAGIC; -private char *separator = ":"; /* Default field separator */ - -private char *progname; /* used throughout */ +private const char *separator = ":"; /* Default field separator */ private struct magic_set *magic; +extern char *__progname; private void unwrap(char *); private void usage(void); @@ -124,26 +123,29 @@ private void load(const char *, int); int main(int argc, char *argv[]) { - int c; + int c, i; int action = 0, didsomefiles = 0, errflg = 0; int flags = 0; char *home, *usermagic; struct stat sb; -#define OPTSTRING "bcCdf:F:kLm:nNprsvz" + static const char hmagic[] = "/.magic"; +#define OPTSTRING "bcCde:f:F:hkLm:nNprsvz0" #ifdef HAVE_GETOPT_LONG int longindex; - private struct option long_options[] = + static const struct option long_options[] = { {"version", 0, 0, 'v'}, {"help", 0, 0, 0}, {"brief", 0, 0, 'b'}, {"checking-printout", 0, 0, 'c'}, {"debug", 0, 0, 'd'}, + {"exclude", 1, 0, 'e' }, {"files-from", 1, 0, 'f'}, {"separator", 1, 0, 'F'}, {"keep-going", 0, 0, 'k'}, #ifdef S_IFLNK {"dereference", 0, 0, 'L'}, + {"no-dereference", 0, 0, 'h'}, #endif {"magic-file", 1, 0, 'm'}, #if defined(HAVE_UTIME) || defined(HAVE_UTIMES) @@ -155,12 +157,29 @@ main(int argc, char *argv[]) {"no-pad", 0, 0, 'N'}, {"special-files", 0, 0, 's'}, {"compile", 0, 0, 'C'}, + {"print0", 0, 0, '0'}, {0, 0, 0, 0}, }; #endif + static const struct { + const char *name; + int value; + } nv[] = { + { "apptype", MAGIC_NO_CHECK_APPTYPE }, + { "ascii", MAGIC_NO_CHECK_ASCII }, + { "compress", MAGIC_NO_CHECK_COMPRESS }, + { "elf", MAGIC_NO_CHECK_ELF }, + { "fortran", MAGIC_NO_CHECK_FORTRAN }, + { "soft", MAGIC_NO_CHECK_SOFT }, + { "tar", MAGIC_NO_CHECK_TAR }, + { "tokens", MAGIC_NO_CHECK_TOKENS }, + { "troff", MAGIC_NO_CHECK_TROFF }, + }; + #ifdef LC_CTYPE - setlocale(LC_CTYPE, ""); /* makes islower etc work for other langs */ + /* makes islower etc work for other langs */ + (void)setlocale(LC_CTYPE, ""); #endif #ifdef __EMX__ @@ -168,20 +187,15 @@ main(int argc, char *argv[]) _wildcard(&argc, &argv); #endif - if ((progname = strrchr(argv[0], '/')) != NULL) - progname++; - else - progname = argv[0]; - magicfile = default_magicfile; if ((usermagic = getenv("MAGIC")) != NULL) magicfile = usermagic; else if ((home = getenv("HOME")) != NULL) { - size_t len = strlen(home) + 8; + size_t len = strlen(home) + sizeof(hmagic); if ((usermagic = malloc(len)) != NULL) { (void)strlcpy(usermagic, home, len); - (void)strlcat(usermagic, "/.magic", len); + (void)strlcat(usermagic, hmagic, len); if (stat(usermagic, &sb)<0) free(usermagic); else @@ -189,6 +203,9 @@ main(int argc, char *argv[]) } } +#ifdef S_IFLNK + flags |= getenv("POSIXLY_CORRECT") ? MAGIC_SYMLINK : 0; +#endif #ifndef HAVE_GETOPT_LONG while ((c = getopt(argc, argv, OPTSTRING)) != -1) #else @@ -202,6 +219,9 @@ main(int argc, char *argv[]) help(); break; #endif + case '0': + nulsep = 1; + break; case 'b': ++bflag; break; @@ -214,6 +234,17 @@ main(int argc, char *argv[]) case 'd': flags |= MAGIC_DEBUG|MAGIC_CHECK; break; + case 'e': + for (i = 0; i < sizeof(nv) / sizeof(nv[0]); i++) + if (strcmp(nv[i].name, optarg) == 0) + break; + + if (i == sizeof(nv) / sizeof(nv[0])) + errflg++; + else + flags |= nv[i].value; + break; + case 'f': if(action) usage(); @@ -248,9 +279,9 @@ main(int argc, char *argv[]) flags |= MAGIC_DEVICES; break; case 'v': - (void) fprintf(stdout, "%s-%d.%.2d\n", progname, + (void)fprintf(stdout, "%s-%d.%.2d\n", __progname, FILE_VERSION_MAJOR, patchlevel); - (void) fprintf(stdout, "magic file from %s\n", + (void)fprintf(stdout, "magic file from %s\n", magicfile); return 1; case 'z': @@ -260,6 +291,9 @@ main(int argc, char *argv[]) case 'L': flags |= MAGIC_SYMLINK; break; + case 'h': + flags &= ~MAGIC_SYMLINK; + break; #endif case '?': default: @@ -276,14 +310,14 @@ main(int argc, char *argv[]) case FILE_COMPILE: magic = magic_open(flags|MAGIC_CHECK); if (magic == NULL) { - (void)fprintf(stderr, "%s: %s\n", progname, + (void)fprintf(stderr, "%s: %s\n", __progname, strerror(errno)); return 1; } c = action == FILE_CHECK ? magic_check(magic, magicfile) : magic_compile(magic, magicfile); if (c == -1) { - (void)fprintf(stderr, "%s: %s\n", progname, + (void)fprintf(stderr, "%s: %s\n", __progname, magic_error(magic)); return -1; } @@ -309,23 +343,25 @@ main(int argc, char *argv[]) process(argv[optind], wid); } + magic_close(magic); return 0; } private void +/*ARGSUSED*/ load(const char *m, int flags) { - if (magic) + if (magic || m == NULL) return; magic = magic_open(flags); if (magic == NULL) { - (void)fprintf(stderr, "%s: %s\n", progname, strerror(errno)); + (void)fprintf(stderr, "%s: %s\n", __progname, strerror(errno)); exit(1); } if (magic_load(magic, magicfile) == -1) { (void)fprintf(stderr, "%s: %s\n", - progname, magic_error(magic)); + __progname, magic_error(magic)); exit(1); } } @@ -346,12 +382,13 @@ unwrap(char *fn) } else { if ((f = fopen(fn, "r")) == NULL) { (void)fprintf(stderr, "%s: Cannot open `%s' (%s).\n", - progname, fn, strerror(errno)); + __progname, fn, strerror(errno)); exit(1); } while (fgets(buf, sizeof(buf), f) != NULL) { - cwid = file_mbswidth(buf) - 1; + buf[strcspn(buf, "\n")] = '\0'; + cwid = file_mbswidth(buf); if (cwid > wid) wid = cwid; } @@ -360,30 +397,39 @@ unwrap(char *fn) } while (fgets(buf, sizeof(buf), f) != NULL) { - buf[file_mbswidth(buf)-1] = '\0'; + buf[strcspn(buf, "\n")] = '\0'; process(buf, wid); if(nobuffer) - (void) fflush(stdout); + (void)fflush(stdout); } - (void) fclose(f); + (void)fclose(f); } +/* + * Called for each input file on the command line (or in a list of files) + */ private void process(const char *inname, int wid) { const char *type; int std_in = strcmp(inname, "-") == 0; - if (wid > 0 && !bflag) - (void) printf("%s%s%*s ", std_in ? "/dev/stdin" : inname, - separator, (int) (nopad ? 0 : (wid - file_mbswidth(inname))), ""); + if (wid > 0 && !bflag) { + (void)printf("%s", std_in ? "/dev/stdin" : inname); + if (nulsep) + (void)putc('\0', stdout); + else + (void)printf("%s", separator); + (void)printf("%*s ", + (int) (nopad ? 0 : (wid - file_mbswidth(inname))), ""); + } type = magic_file(magic, std_in ? NULL : inname); if (type == NULL) - printf("ERROR: %s\n", magic_error(magic)); + (void)printf("ERROR: %s\n", magic_error(magic)); else - printf("%s\n", type); + (void)printf("%s\n", type); } @@ -447,7 +493,7 @@ byteconv2(int from, int same, int big_endian) size_t file_mbswidth(const char *s) { -#ifdef HAVE_WCHAR_H +#if defined(HAVE_WCHAR_H) && defined(HAVE_MBRTOWC) && defined(HAVE_WCWIDTH) size_t bytesconsumed, old_n, n, width = 0; mbstate_t state; wchar_t nextchar; @@ -481,7 +527,7 @@ file_mbswidth(const char *s) private void usage(void) { - (void)fprintf(stderr, USAGE, progname, progname); + (void)fprintf(stderr, USAGE, __progname, __progname); #ifdef HAVE_GETOPT_LONG (void)fputs("Try `file --help' for more information.\n", stderr); #endif @@ -492,7 +538,7 @@ usage(void) private void help(void) { - puts( + (void)puts( "Usage: file [OPTION]... [FILE]...\n" "Determine file type of FILEs.\n" "\n" @@ -503,6 +549,9 @@ help(void) " -c, --checking-printout print the parsed form of the magic file, use in\n" " conjunction with -m to debug a new magic file\n" " before installing it\n" +" -e, --exclude exclude test from the list of test to be\n" +" performed for file. Valid tests are:\n" +" ascii, apptype, elf, compress, soft, tar\n" " -f, --files-from FILE read the filenames to be examined from FILE\n" " -F, --separator string use string as separator instead of `:'\n" " -k, --keep-going don't stop at the first match\n" @@ -513,8 +562,12 @@ help(void) " -r, --raw don't translate unprintable chars to \\ooo\n" " -s, --special-files treat special (block/char devices) files as\n" " ordinary ones\n" +"or\n" " --help display this help and exit\n" +"or\n" " --version output version information and exit\n" +"or\n" +" -C, --compile compile file specified by -m\n" ); exit(0); } diff --git a/usr.bin/file/file.h b/usr.bin/file/file.h index 820039cfa11..d6022fc5887 100644 --- a/usr.bin/file/file.h +++ b/usr.bin/file/file.h @@ -1,4 +1,4 @@ -/* $OpenBSD: file.h,v 1.18 2007/11/26 09:28:34 martynas Exp $ */ +/* $OpenBSD: file.h,v 1.19 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Ian F. Darwin 1986-1995. * Software written by Ian F. Darwin and others; @@ -28,7 +28,7 @@ */ /* * file.h - definitions for file(1) program - * @(#)$Id: file.h,v 1.18 2007/11/26 09:28:34 martynas Exp $ + * @(#)$Id: file.h,v 1.19 2008/05/08 01:40:56 chl Exp $ */ #ifndef __file_h__ @@ -40,15 +40,20 @@ #include <stdio.h> /* Include that here, to make sure __P gets defined */ #include <errno.h> +#include <fcntl.h> /* For open and flags */ #ifdef HAVE_STDINT_H #include <stdint.h> #endif #ifdef HAVE_INTTYPES_H #include <inttypes.h> #endif +#include <regex.h> +#include <sys/types.h> /* Do this here and now, because struct stat gets re-defined on solaris */ #include <sys/stat.h> +#define ENABLE_CONDITIONALS + #ifndef MAGIC #define MAGIC "/etc/magic" #endif @@ -65,15 +70,29 @@ #endif #define public +#ifndef __GNUC_PREREQ__ +#ifdef __GNUC__ +#define __GNUC_PREREQ__(x, y) \ + ((__GNUC__ == (x) && __GNUC_MINOR__ >= (y)) || \ + (__GNUC__ > (x))) +#else +#define __GNUC_PREREQ__(x, y) 0 +#endif +#endif + +#ifndef MIN +#define MIN(a,b) (((a) < (b)) ? (a) : (b)) +#endif + #ifndef HOWMANY -# define HOWMANY 65536 /* how much of the file to look at */ +# define HOWMANY (256 * 1024) /* how much of the file to look at */ #endif -#define MAXMAGIS 4096 /* max entries in /etc/magic */ +#define MAXMAGIS 8192 /* max entries in /etc/magic */ #define MAXDESC 64 /* max leng of text description */ #define MAXstring 32 /* max leng of "string" types */ #define MAGICNO 0xF11E041C -#define VERSIONNO 2 +#define VERSIONNO 4 #define FILE_MAGICSIZE (32 * 4) #define FILE_LOAD 0 @@ -85,16 +104,20 @@ struct magic { uint16_t cont_level; /* level of ">" */ uint8_t nospflag; /* suppress space character */ uint8_t flag; -#define INDIR 1 /* if '>(...)' appears, */ -#define UNSIGNED 2 /* comparison is unsigned */ -#define OFFADD 4 /* if '>&' appears, */ +#define INDIR 1 /* if '(...)' appears */ +#define OFFADD 2 /* if '>&' or '>...(&' appears */ +#define INDIROFFADD 4 /* if '>&(' appears */ +#define UNSIGNED 8 /* comparison is unsigned */ + /* Word 2 */ uint8_t reln; /* relation (0=eq, '>'=gt, etc) */ uint8_t vallen; /* length of string value, if any */ uint8_t type; /* int, short, long or string. */ uint8_t in_type; /* type of indirrection */ +#define FILE_INVALID 0 #define FILE_BYTE 1 #define FILE_SHORT 2 +#define FILE_DEFAULT 3 #define FILE_LONG 4 #define FILE_STRING 5 #define FILE_DATE 6 @@ -109,11 +132,48 @@ struct magic { #define FILE_BELDATE 15 #define FILE_LELDATE 16 #define FILE_REGEX 17 +#define FILE_BESTRING16 18 +#define FILE_LESTRING16 19 +#define FILE_SEARCH 20 +#define FILE_MEDATE 21 +#define FILE_MELDATE 22 +#define FILE_MELONG 23 +#define FILE_QUAD 24 +#define FILE_LEQUAD 25 +#define FILE_BEQUAD 26 +#define FILE_QDATE 27 +#define FILE_LEQDATE 28 +#define FILE_BEQDATE 29 +#define FILE_QLDATE 30 +#define FILE_LEQLDATE 31 +#define FILE_BEQLDATE 32 +#define FILE_NAMES_SIZE 33/* size of array to contain all names */ + +#define IS_STRING(t) \ + ((t) == FILE_STRING || \ + (t) == FILE_PSTRING || \ + (t) == FILE_BESTRING16 || \ + (t) == FILE_LESTRING16 || \ + (t) == FILE_REGEX || \ + (t) == FILE_SEARCH || \ + (t) == FILE_DEFAULT) + +#define FILE_FMT_NONE 0 +#define FILE_FMT_NUM 1 /* "cduxXi" */ +#define FILE_FMT_STR 2 /* "s" */ +#define FILE_FMT_QUAD 3 /* "ll" */ + /* Word 3 */ uint8_t in_op; /* operator for indirection */ uint8_t mask_op; /* operator for mask */ +#ifdef ENABLE_CONDITIONALS + uint8_t cond; /* conditional type */ + uint8_t dummy1; +#else uint8_t dummy1; uint8_t dummy2; +#endif + #define FILE_OPS "&|^+-*/%" #define FILE_OPAND 0 #define FILE_OPOR 1 @@ -123,38 +183,65 @@ struct magic { #define FILE_OPMULTIPLY 5 #define FILE_OPDIVIDE 6 #define FILE_OPMODULO 7 -#define FILE_OPINVERSE 0x80 +#define FILE_OPS_MASK 0x07 /* mask for above ops */ +#define FILE_UNUSED_1 0x08 +#define FILE_UNUSED_2 0x10 +#define FILE_UNUSED_3 0x20 +#define FILE_OPINVERSE 0x40 +#define FILE_OPINDIRECT 0x80 + +#ifdef ENABLE_CONDITIONALS +#define COND_NONE 0 +#define COND_IF 1 +#define COND_ELIF 2 +#define COND_ELSE 3 +#endif /* ENABLE_CONDITIONALS */ + /* Word 4 */ uint32_t offset; /* offset to magic number */ /* Word 5 */ - uint32_t in_offset; /* offset from indirection */ + int32_t in_offset; /* offset from indirection */ /* Word 6 */ - uint32_t mask; /* mask before comparison with value */ - /* Word 7 */ - uint32_t dummy3; - /* Word 8 */ - uint32_t dummp4; + uint32_t lineno; /* line number in magic file */ + /* Word 7,8 */ + union { + uint64_t _mask; /* for use with numeric and date types */ + struct { + uint32_t _count; /* repeat/line count */ + uint32_t _flags; /* modifier flags */ + } _s; /* for use with string types */ + } _u; +#define num_mask _u._mask +#define str_count _u._s._count +#define str_flags _u._s._flags + /* Words 9-16 */ union VALUETYPE { uint8_t b; uint16_t h; uint32_t l; - char s[MAXstring]; - char *buf; + uint64_t q; uint8_t hs[2]; /* 2 bytes of a fixed-endian "short" */ uint8_t hl[4]; /* 4 bytes of a fixed-endian "long" */ + uint8_t hq[8]; /* 8 bytes of a fixed-endian "quad" */ + char s[MAXstring]; /* the search string or regex pattern */ } value; /* either number or string */ /* Words 17..31 */ char desc[MAXDESC]; /* description */ }; #define BIT(A) (1 << (A)) -#define STRING_IGNORE_LOWERCASE BIT(0) -#define STRING_COMPACT_BLANK BIT(1) -#define STRING_COMPACT_OPTIONAL_BLANK BIT(2) -#define CHAR_IGNORE_LOWERCASE 'c' +#define STRING_COMPACT_BLANK BIT(0) +#define STRING_COMPACT_OPTIONAL_BLANK BIT(1) +#define STRING_IGNORE_LOWERCASE BIT(2) +#define STRING_IGNORE_UPPERCASE BIT(3) +#define REGEX_OFFSET_START BIT(4) #define CHAR_COMPACT_BLANK 'B' #define CHAR_COMPACT_OPTIONAL_BLANK 'b' +#define CHAR_IGNORE_LOWERCASE 'c' +#define CHAR_IGNORE_UPPERCASE 'C' +#define CHAR_REGEX_OFFSET_START 's' +#define STRING_IGNORE_CASE (STRING_IGNORE_LOWERCASE|STRING_IGNORE_UPPERCASE) /* list of magic entries */ @@ -168,59 +255,109 @@ struct mlist { }; struct magic_set { - struct mlist *mlist; - struct cont { - size_t len; - int32_t *off; - } c; - struct out { - /* Accumulation buffer */ - char *buf; - char *ptr; - size_t left; - size_t size; - /* Printable buffer */ - char *pbuf; - size_t psize; - } o; - int error; - int flags; - int haderr; + struct mlist *mlist; + struct cont { + size_t len; + struct level_info { + int32_t off; + int got_match; +#ifdef ENABLE_CONDITIONALS + int last_match; + int last_cond; /* used for error checking by parse() */ +#endif + } *li; + } c; + struct out { + /* Accumulation buffer */ + char *buf; + char *ptr; + size_t left; + size_t size; + /* Printable buffer */ + char *pbuf; + size_t psize; + } o; + uint32_t offset; + int error; + int flags; + int haderr; + const char *file; + size_t line; /* current magic line number */ + + /* data for searches */ + struct { + const char *s; /* start of search in original source */ + size_t s_len; /* length of search region */ + size_t offset; /* starting offset in source: XXX - should this be off_t? */ + size_t rm_len; /* match length */ + } search; + + union VALUETYPE ms_value; /* either number or string */ }; struct stat; -protected char *file_fmttime(uint32_t, int); -protected int file_buffer(struct magic_set *, const void *, size_t); +protected const char *file_fmttime(uint32_t, int); +protected int file_buffer(struct magic_set *, int, const char *, const void *, + size_t); protected int file_fsmagic(struct magic_set *, const char *, struct stat *); protected int file_pipe2file(struct magic_set *, int, const void *, size_t); protected int file_printf(struct magic_set *, const char *, ...); protected int file_reset(struct magic_set *); -protected int file_tryelf(struct magic_set *, int, const unsigned char *, size_t); -protected int file_zmagic(struct magic_set *, const unsigned char *, size_t); +protected int file_tryelf(struct magic_set *, int, const unsigned char *, + size_t); +protected int file_zmagic(struct magic_set *, int, const char *, + const unsigned char *, size_t); protected int file_ascmagic(struct magic_set *, const unsigned char *, size_t); protected int file_is_tar(struct magic_set *, const unsigned char *, size_t); protected int file_softmagic(struct magic_set *, const unsigned char *, size_t); protected struct mlist *file_apprentice(struct magic_set *, const char *, int); -protected uint32_t file_signextend(struct magic_set *, struct magic *, uint32_t); +protected uint64_t file_signextend(struct magic_set *, struct magic *, + uint64_t); protected void file_delmagic(struct magic *, int type, size_t entries); protected void file_badread(struct magic_set *); protected void file_badseek(struct magic_set *); -protected void file_oomem(struct magic_set *); +protected void file_oomem(struct magic_set *, size_t); protected void file_error(struct magic_set *, int, const char *, ...); -protected void file_magwarn(const char *, ...); +protected void file_magerror(struct magic_set *, const char *, ...); +protected void file_magwarn(struct magic_set *, const char *, ...); protected void file_mdump(struct magic *); protected void file_showstr(FILE *, const char *, size_t); protected size_t file_mbswidth(const char *); protected const char *file_getbuffer(struct magic_set *); +protected ssize_t sread(int, void *, size_t, int); +protected int file_check_mem(struct magic_set *, unsigned int); + +#ifndef COMPILE_ONLY +extern const char *file_names[]; +extern const size_t file_nnames; +#endif + +#ifndef HAVE_STRERROR +extern int sys_nerr; +extern char *sys_errlist[]; +#define strerror(e) \ + (((e) >= 0 && (e) < sys_nerr) ? sys_errlist[(e)] : "Unknown error") +#endif + +#ifndef HAVE_STRTOUL +#define strtoul(a, b, c) strtol(a, b, c) +#endif + +#ifndef HAVE_SNPRINTF +int snprintf(char *, size_t, const char *, ...); +#endif #if defined(HAVE_MMAP) && defined(HAVE_SYS_MMAN_H) && !defined(QUICK) #define QUICK #endif +#ifndef O_BINARY +#define O_BINARY 0 +#endif + #define FILE_RCSID(id) \ static const char *rcsid(const char *p) { \ return rcsid(p = id); \ } -#else #endif /* __file_h__ */ diff --git a/usr.bin/file/fsmagic.c b/usr.bin/file/fsmagic.c index 53dd082eb22..c62428b6b6a 100644 --- a/usr.bin/file/fsmagic.c +++ b/usr.bin/file/fsmagic.c @@ -1,4 +1,4 @@ -/* $OpenBSD: fsmagic.c,v 1.11 2005/05/18 03:11:18 jaredy Exp $ */ +/* $OpenBSD: fsmagic.c,v 1.12 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Ian F. Darwin 1986-1995. * Software written by Ian F. Darwin and others; @@ -58,7 +58,7 @@ #undef HAVE_MAJOR #ifndef lint -FILE_RCSID("@(#)$Id: fsmagic.c,v 1.11 2005/05/18 03:11:18 jaredy Exp $") +FILE_RCSID("@(#)$Id: fsmagic.c,v 1.12 2008/05/08 01:40:56 chl Exp $") #endif /* lint */ protected int @@ -90,8 +90,8 @@ file_fsmagic(struct magic_set *ms, const char *fn, struct stat *sb) file_error(ms, errno, "cannot stat `%s'", fn); return -1; } - if (file_printf(ms, "cannot open (%s)", - strerror(errno)) == -1) + if (file_printf(ms, "cannot open `%s' (%s)", + fn, strerror(errno)) == -1) return -1; return 1; } @@ -182,6 +182,8 @@ file_fsmagic(struct magic_set *ms, const char *fn, struct stat *sb) /* TODO add code to handle V7 MUX and Blit MUX files */ #ifdef S_IFIFO case S_IFIFO: + if((ms->flags & MAGIC_DEVICES) != 0) + break; if (file_printf(ms, "fifo (named pipe)") == -1) return -1; return 1; diff --git a/usr.bin/file/funcs.c b/usr.bin/file/funcs.c index 0a37f4a97fc..7b8fdb182fa 100644 --- a/usr.bin/file/funcs.c +++ b/usr.bin/file/funcs.c @@ -1,4 +1,4 @@ -/* $OpenBSD: funcs.c,v 1.4 2007/07/09 16:39:48 dim Exp $ */ +/* $OpenBSD: funcs.c,v 1.5 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Christos Zoulas 2003. * All Rights Reserved. @@ -12,8 +12,6 @@ * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. - * 3. The name of the author may not be used to endorse or promote products - * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE @@ -29,16 +27,35 @@ */ #include "file.h" #include "magic.h" -#include <limits.h> #include <stdarg.h> -#include <stddef.h> #include <stdlib.h> #include <string.h> #include <ctype.h> +#if defined(HAVE_WCHAR_H) +#include <wchar.h> +#endif +#if defined(HAVE_WCTYPE_H) +#include <wctype.h> +#endif +#if defined(HAVE_LIMITS_H) +#include <limits.h> +#endif +#ifndef SIZE_T_MAX +#ifdef __LP64__ +#define SIZE_T_MAX (size_t)0xfffffffffffffffffU +#else +#define SIZE_T_MAX (size_t)0xffffffffU +#endif +#endif #ifndef lint -FILE_RCSID("@(#)$Id: funcs.c,v 1.4 2007/07/09 16:39:48 dim Exp $") +FILE_RCSID("@(#)$Id: funcs.c,v 1.5 2008/05/08 01:40:56 chl Exp $") #endif /* lint */ + +#ifndef HAVE_VSNPRINTF +int vsnprintf(char *, size_t, const char *, va_list); +#endif + /* * Like printf, only we print to a buffer and advance it. */ @@ -46,10 +63,8 @@ protected int file_printf(struct magic_set *ms, const char *fmt, ...) { va_list ap; - int len; - size_t size; + size_t len, size; char *buf; - ptrdiff_t diff; va_start(ap, fmt); @@ -58,10 +73,12 @@ file_printf(struct magic_set *ms, const char *fmt, ...) file_error(ms, errno, "vsnprintf failed"); return -1; } else if (len >= ms->o.left) { + long diff; /* XXX: really ptrdiff_t */ + va_end(ap); size = (ms->o.size - ms->o.left) + len + 1024; if ((buf = realloc(ms->o.buf, size)) == NULL) { - file_oomem(ms); + file_oomem(ms, size); return -1; } diff = ms->o.ptr - ms->o.buf; @@ -77,9 +94,9 @@ file_printf(struct magic_set *ms, const char *fmt, ...) return -1; } } + va_end(ap); ms->o.ptr += len; ms->o.left -= len; - va_end(ap); return 0; } @@ -87,18 +104,22 @@ file_printf(struct magic_set *ms, const char *fmt, ...) * error - print best error message possible */ /*VARARGS*/ -protected void -file_error(struct magic_set *ms, int error, const char *f, ...) +private void +file_error_core(struct magic_set *ms, int error, const char *f, va_list va, + uint32_t lineno) { - va_list va; + size_t len; /* Only the first error is ok */ if (ms->haderr) return; - va_start(va, f); - (void)vsnprintf(ms->o.buf, ms->o.size, f, va); - va_end(va); + len = 0; + if (lineno != 0) { + (void)snprintf(ms->o.buf, ms->o.size, "line %u: ", lineno); + len = strlen(ms->o.buf); + } + (void)vsnprintf(ms->o.buf + len, ms->o.size - len, f, va); if (error > 0) { - size_t len = strlen(ms->o.buf); + len = strlen(ms->o.buf); (void)snprintf(ms->o.buf + len, ms->o.size - len, " (%s)", strerror(error)); } @@ -106,11 +127,33 @@ file_error(struct magic_set *ms, int error, const char *f, ...) ms->error = error; } +/*VARARGS*/ +protected void +file_error(struct magic_set *ms, int error, const char *f, ...) +{ + va_list va; + va_start(va, f); + file_error_core(ms, error, f, va, 0); + va_end(va); +} + +/* + * Print an error with magic line number. + */ +/*VARARGS*/ +protected void +file_magerror(struct magic_set *ms, const char *f, ...) +{ + va_list va; + va_start(va, f); + file_error_core(ms, 0, f, va, ms->line); + va_end(va); +} protected void -file_oomem(struct magic_set *ms) +file_oomem(struct magic_set *ms, size_t len) { - file_error(ms, errno, "cannot allocate memory"); + file_error(ms, errno, "cannot allocate %zu bytes", len); } protected void @@ -125,29 +168,66 @@ file_badread(struct magic_set *ms) file_error(ms, errno, "error reading"); } +#ifndef COMPILE_ONLY protected int -file_buffer(struct magic_set *ms, const void *buf, size_t nb) +file_buffer(struct magic_set *ms, int fd, const char *inname, const void *buf, + size_t nb) { int m; + +#ifdef __EMX__ + if ((ms->flags & MAGIC_NO_CHECK_APPTYPE) == 0 && inname) { + switch (file_os2_apptype(ms, inname, buf, nb)) { + case -1: + return -1; + case 0: + break; + default: + return 1; + } + } +#endif + /* try compression stuff */ - if ((m = file_zmagic(ms, buf, nb)) == 0) { + if ((ms->flags & MAGIC_NO_CHECK_COMPRESS) != 0 || + (m = file_zmagic(ms, fd, inname, buf, nb)) == 0) { /* Check if we have a tar file */ - if ((m = file_is_tar(ms, buf, nb)) == 0) { + if ((ms->flags & MAGIC_NO_CHECK_TAR) != 0 || + (m = file_is_tar(ms, buf, nb)) == 0) { /* try tests in /etc/magic (or surrogate magic file) */ - if ((m = file_softmagic(ms, buf, nb)) == 0) { + if ((ms->flags & MAGIC_NO_CHECK_SOFT) != 0 || + (m = file_softmagic(ms, buf, nb)) == 0) { /* try known keywords, check whether it is ASCII */ - if ((m = file_ascmagic(ms, buf, nb)) == 0) { + if ((ms->flags & MAGIC_NO_CHECK_ASCII) != 0 || + (m = file_ascmagic(ms, buf, nb)) == 0) { /* abandon hope, all ye who remain here */ if (file_printf(ms, ms->flags & MAGIC_MIME ? - "application/octet-stream" : "data") == -1) + (nb ? "application/octet-stream" : + "application/empty") : + (nb ? "data" : + "empty")) == -1) return -1; m = 1; } } } } +#ifdef BUILTIN_ELF + if ((ms->flags & MAGIC_NO_CHECK_ELF) == 0 && m == 1 && nb > 5 && fd != -1) { + /* + * We matched something in the file, so this *might* + * be an ELF file, and the file is at least 5 bytes + * long, so if it's an ELF file it has at least one + * byte past the ELF magic number - try extracting + * information from the ELF headers that cannot easily + * be extracted with rules in the magic file. + */ + (void)file_tryelf(ms, fd, buf, nb); + } +#endif return m; } +#endif protected int file_reset(struct magic_set *ms) @@ -157,11 +237,20 @@ file_reset(struct magic_set *ms) return -1; } ms->o.ptr = ms->o.buf; + ms->o.left = ms->o.size; ms->haderr = 0; ms->error = -1; return 0; } +#define OCTALIFY(n, o) \ + /*LINTED*/ \ + (void)(*(n)++ = '\\', \ + *(n)++ = (((uint32_t)*(o) >> 6) & 3) + '0', \ + *(n)++ = (((uint32_t)*(o) >> 3) & 7) + '0', \ + *(n)++ = (((uint32_t)*(o) >> 0) & 7) + '0', \ + (o)++) + protected const char * file_getbuffer(struct magic_set *ms) { @@ -175,31 +264,114 @@ file_getbuffer(struct magic_set *ms) return ms->o.buf; len = ms->o.size - ms->o.left; + /* * 4 is for octal representation, + 1 is for NUL */ if (len > (SIZE_T_MAX - 1) / 4) { - file_oomem(ms); + file_oomem(ms, len); return NULL; } - /* * 4 is for octal representation, + 1 is for NUL */ psize = len * 4 + 1; if (ms->o.psize < psize) { if ((pbuf = realloc(ms->o.pbuf, psize)) == NULL) { - file_oomem(ms); + file_oomem(ms, psize); return NULL; } ms->o.psize = psize; ms->o.pbuf = pbuf; } +#if defined(HAVE_WCHAR_H) && defined(HAVE_MBRTOWC) && defined(HAVE_WCWIDTH) + { + mbstate_t state; + wchar_t nextchar; + int mb_conv = 1; + size_t bytesconsumed; + char *eop; + (void)memset(&state, 0, sizeof(mbstate_t)); + + np = ms->o.pbuf; + op = ms->o.buf; + eop = op + strlen(ms->o.buf); + + while (op < eop) { + bytesconsumed = mbrtowc(&nextchar, op, + (size_t)(eop - op), &state); + if (bytesconsumed == (size_t)(-1) || + bytesconsumed == (size_t)(-2)) { + mb_conv = 0; + break; + } + + if (iswprint(nextchar)) { + (void)memcpy(np, op, bytesconsumed); + op += bytesconsumed; + np += bytesconsumed; + } else { + while (bytesconsumed-- > 0) + OCTALIFY(np, op); + } + } + *np = '\0'; + + /* Parsing succeeded as a multi-byte sequence */ + if (mb_conv != 0) + return ms->o.pbuf; + } +#endif + for (np = ms->o.pbuf, op = ms->o.buf; *op; op++) { if (isprint((unsigned char)*op)) { *np++ = *op; } else { - *np++ = '\\'; - *np++ = ((*op >> 6) & 3) + '0'; - *np++ = ((*op >> 3) & 7) + '0'; - *np++ = ((*op >> 0) & 7) + '0'; + OCTALIFY(np, op); } } *np = '\0'; return ms->o.pbuf; } + +protected int +file_check_mem(struct magic_set *ms, unsigned int level) +{ + size_t len; + + if (level >= ms->c.len) { + len = (ms->c.len += 20) * sizeof(*ms->c.li); + ms->c.li = (ms->c.li == NULL) ? malloc(len) : + realloc(ms->c.li, len); + if (ms->c.li == NULL) { + file_oomem(ms, len); + return -1; + } + } + ms->c.li[level].got_match = 0; +#ifdef ENABLE_CONDITIONALS + ms->c.li[level].last_match = 0; + ms->c.li[level].last_cond = COND_NONE; +#endif /* ENABLE_CONDITIONALS */ + return 0; +} +/* + * Yes these wrappers suffer from buffer overflows, but if your OS does not + * have the real functions, maybe you should consider replacing your OS? + */ +#ifndef HAVE_VSNPRINTF +int +vsnprintf(char *buf, size_t len, const char *fmt, va_list ap) +{ + return vsprintf(buf, fmt, ap); +} +#endif + +#ifndef HAVE_SNPRINTF +/*ARGSUSED*/ +int +snprintf(char *buf, size_t len, const char *fmt, ...) +{ + int rv; + va_list ap; + va_start(ap, fmt); + rv = vsprintf(buf, fmt, ap); + va_end(ap); + return rv; +} +#endif diff --git a/usr.bin/file/is_tar.c b/usr.bin/file/is_tar.c index 6422fd9e978..cff746c55a4 100644 --- a/usr.bin/file/is_tar.c +++ b/usr.bin/file/is_tar.c @@ -1,4 +1,4 @@ -/* $OpenBSD: is_tar.c,v 1.7 2004/05/19 02:32:35 tedu Exp $ */ +/* $OpenBSD: is_tar.c,v 1.8 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Ian F. Darwin 1986-1995. * Software written by Ian F. Darwin and others; @@ -46,7 +46,7 @@ #include "tar.h" #ifndef lint -FILE_RCSID("@(#)$Id: is_tar.c,v 1.7 2004/05/19 02:32:35 tedu Exp $") +FILE_RCSID("@(#)$Id: is_tar.c,v 1.8 2008/05/08 01:40:56 chl Exp $") #endif #define isodigit(c) ( ((c) >= '0') && ((c) <= '7') ) @@ -72,6 +72,12 @@ file_is_tar(struct magic_set *ms, const unsigned char *buf, size_t nbytes) "application/x-tar, POSIX" : "POSIX tar archive") == -1) return -1; return 1; + case 3: + if (file_printf(ms, (ms->flags & MAGIC_MIME) ? + "application/x-tar, POSIX (GNU)" : + "POSIX tar archive (GNU)") == -1) + return -1; + return 1; default: return 0; } @@ -114,7 +120,9 @@ is_tar(const unsigned char *buf, size_t nbytes) if (sum != recsum) return 0; /* Not a tar archive */ - if (0==strcmp(header->header.magic, TMAGIC)) + if (strcmp(header->header.magic, GNUTMAGIC) == 0) + return 3; /* GNU Unix Standard tar archive */ + if (strcmp(header->header.magic, TMAGIC) == 0) return 2; /* Unix Standard tar archive */ return 1; /* Old fashioned tar archive */ diff --git a/usr.bin/file/magdir/Header b/usr.bin/file/magdir/Header index 7b1f60ba9c5..4ab8befd85e 100644 --- a/usr.bin/file/magdir/Header +++ b/usr.bin/file/magdir/Header @@ -1,7 +1,7 @@ # Magic -# $OpenBSD: Header,v 1.5 1997/04/03 17:39:38 kstailey Exp $ +# $OpenBSD: Header,v 1.6 2008/05/08 01:40:56 chl Exp $ # Magic data for file(1) command. -# Machine-genererated from src/usr.bin/file/magdir/*; edit there only! +# Machine-generated from src/usr.bin/file/magdir/*; edit there only! # Format is described in magic(files), where: -# files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID. +# files is 5 on V7 and BSD, 4 on SV, and ?? in the SVID. diff --git a/usr.bin/file/magdir/Localstuff b/usr.bin/file/magdir/Localstuff index b6960eb7295..63dc18e097e 100644 --- a/usr.bin/file/magdir/Localstuff +++ b/usr.bin/file/magdir/Localstuff @@ -1,6 +1,7 @@ + #------------------------------------------------------------------------------ # Localstuff: file(1) magic for locally observed files # -# $OpenBSD: Localstuff,v 1.4 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: Localstuff,v 1.5 2008/05/08 01:40:57 chl Exp $ # Add any locally observed files here. Remember: # text if readable, executable if runnable binary, data if unreadable. diff --git a/usr.bin/file/magdir/adventure b/usr.bin/file/magdir/adventure new file mode 100644 index 00000000000..9d8c985df6e --- /dev/null +++ b/usr.bin/file/magdir/adventure @@ -0,0 +1,76 @@ +# $OpenBSD: adventure,v 1.1 2008/05/08 01:40:57 chl Exp $ + +#------------------------------------------------------------------------------ +# adventure: file(1) magic for Adventure game files +# +# from Allen Garvin <earendil@faeryland.tamu-commerce.edu> +# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998 +# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002 +# +# ALAN +# I assume there are other, lower versions, but these are the only ones I +# saw in the archive. +0 beshort 0x0206 ALAN game data +>2 byte <10 version 2.6%d + + +# Infocom (see z-machine) +#------------------------------------------------------------------------------ +# Z-machine: file(1) magic for Z-machine binaries. +# +# This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which +# appears to be a version-0 Z-machine binary. +# +# The (false match) message is to correct that behavior. Perhaps it is +# not needed. +# +16 belong&0xfe00f0f0 0x3030 Infocom game data +>0 ubyte 0 (false match) +>0 ubyte >0 (Z-machine %d, +>>2 ubeshort x Release %d / +>>18 string >\0 Serial %.6s) + +#------------------------------------------------------------------------------ +# Glulx: file(1) magic for Glulx binaries. +# +# I haven't checked for false matches yet. +# +0 string Glul Glulx game data +>4 beshort x (Version %d +>>6 byte x \b.%d +>>8 byte x \b.%d) +>36 string Info Compiled by Inform + + + +# For Quetzal and blorb magic see iff + + +# TADS (Text Adventure Development System) +# All files are machine-independent (games compile to byte-code) and are tagged +# with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is +# on the way). +# Game files start with "TADS2 bin\n\r\032\0" then the compiler version. +0 string TADS2\ bin TADS +>9 belong !0x0A0D1A00 game data, CORRUPTED +>9 belong 0x0A0D1A00 +>>13 string >\0 %s game data +# Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version. +0 string TADS2\ rsc TADS +>9 belong !0x0A0D1A00 resource data, CORRUPTED +>9 belong 0x0A0D1A00 +>>13 string >\0 %s resource data +# Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian +# 2-byte length N, the N-char name of the game file *without* a NUL (darn!), +# "TADS2 save\n\r\032\0" and the interpreter version. +0 string TADS2\ save/g TADS +>12 belong !0x0A0D1A00 saved game data, CORRUPTED +>12 belong 0x0A0D1A00 +>>(16.s+32) string >\0 %s saved game data +# Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter +# version. +0 string TADS2\ save TADS +>10 belong !0x0A0D1A00 saved game data, CORRUPTED +>10 belong 0x0A0D1A00 +>>14 string >\0 %s saved game data + diff --git a/usr.bin/file/magdir/alpha b/usr.bin/file/magdir/alpha index 27f2efd82bb..c0191fb931e 100644 --- a/usr.bin/file/magdir/alpha +++ b/usr.bin/file/magdir/alpha @@ -1,5 +1,3 @@ -# $OpenBSD: alpha,v 1.3 2004/06/03 03:14:19 tedu Exp $ - #------------------------------------------------------------------------------ # alpha architecture description # @@ -19,5 +17,14 @@ # Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk> # +# The actual magic number is just "Core", followed by a 2-byte version +# number; however, treating any file that begins with "Core" as a Digital +# UNIX core dump file may produce too many false hits, so we include one +# byte of the version number as well; DU 5.0 appears only to be up to +# version 2. +# 0 string Core\001 Alpha COFF format core dump (Digital UNIX) >24 string >\0 \b, from '%s' +0 string Core\002 Alpha COFF format core dump (Digital UNIX) +>24 string >\0 \b, from '%s' + diff --git a/usr.bin/file/magdir/amigaos b/usr.bin/file/magdir/amigaos index 572843bf97d..cd2f84c6a2c 100644 --- a/usr.bin/file/magdir/amigaos +++ b/usr.bin/file/magdir/amigaos @@ -1,13 +1,12 @@ -# $OpenBSD: amigaos,v 1.4 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: amigaos,v 1.5 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # amigaos: file(1) magic for AmigaOS binary formats: # # From ignatios@cs.uni-bonn.de (Ignatios Souvatzis) -# Some formats are still missing: AmigaOS special IFF's, e.g.: FORM....CTLG -# (the others should be separate, anyway) # +0 belong 0x000003fa AmigaOS shared library 0 belong 0x000003f3 AmigaOS loadseg()ble executable/binary 0 belong 0x000003e7 AmigaOS object/library data # @@ -45,19 +44,9 @@ 0 beshort 0x0f03 AmigaOS outline font 0 belong 0x80001001 AmigaOS outline tag 0 string ##\ version catalog translation - -0 string FORM IFF data ->8 string CTLG \b, CTLG message catalog ->8 string PREF \b, PREF preferences - -0 string Rar! RAR archive data, ->44 byte x v%0x, ->35 byte 0 os: MS-DOS ->35 byte 1 os: OS/2 ->35 byte 2 os: Win32 ->35 byte 3 os: Unix - -0 belong 0x000003fa AmigaOS shared library +0 string EMOD\0 Amiga E module +8 string ECXM\0 ECX module +0 string/c @database AmigaGuide file # Amiga disk types # @@ -70,3 +59,7 @@ 0 string DOS\4 Amiga Fastdir DOS disk 0 string DOS\5 Amiga Fastdir FFS disk 0 string KICK Kickstart disk + +# From: Alex Beregszaszi <alex@fsn.hu> +0 string LZX LZX compressed archive (Amiga) + diff --git a/usr.bin/file/magdir/animation b/usr.bin/file/magdir/animation index b0af39fbd70..e525bd137c3 100644 --- a/usr.bin/file/magdir/animation +++ b/usr.bin/file/magdir/animation @@ -1,4 +1,4 @@ -# $OpenBSD: animation,v 1.3 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: animation,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # animation: file(1) magic for animation/movie formats @@ -7,123 +7,571 @@ # MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8) # FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com) -# MPEG animation format -0 belong 0x000001b3 MPEG video stream data -#>4 beshort&0xfff0 x (%d x -#>5 beshort&0x0fff x %d) -0 belong 0x000001ba MPEG system stream data +# SGI and Apple formats +0 string MOVI Silicon Graphics movie file +4 string moov Apple QuickTime +>12 string mvhd \b movie (fast start) +>12 string mdra \b URL +>12 string cmov \b movie (fast start, compressed header) +>12 string rmra \b multiple URLs +4 string mdat Apple QuickTime movie (unoptimized) +4 string wide Apple QuickTime movie (unoptimized) +4 string skip Apple QuickTime movie (modified) +4 string free Apple QuickTime movie (modified) +4 string idsc Apple QuickTime image (fast start) +4 string idat Apple QuickTime image (unoptimized) +4 string pckg Apple QuickTime compressed archive +4 string/B jP JPEG 2000 image +4 string ftyp ISO Media +>8 string isom \b, MPEG v4 system, version 1 +>8 string iso2 \b, MPEG v4 system, part 12 revision +>8 string mp41 \b, MPEG v4 system, version 1 +>8 string mp42 \b, MPEG v4 system, version 2 +>8 string mp7t \b, MPEG v4 system, MPEG v7 XML +>8 string mp7b \b, MPEG v4 system, MPEG v7 binary XML +>8 string/B jp2 \b, JPEG 2000 +>8 string 3gp \b, MPEG v4 system, 3GPP +>>11 byte 4 \b v4 (H.263/AMR GSM 6.10) +>>11 byte 5 \b v5 (H.263/AMR GSM 6.10) +>>11 byte 6 \b v6 (ITU H.264/AMR GSM 6.10) +>8 string mmp4 \b, MPEG v4 system, 3GPP Mobile +>8 string avc1 \b, MPEG v4 system, 3GPP JVT AVC +>8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC +>8 string/B M4P \b, MPEG v4 system, iTunes AES encrypted +>8 string/B M4B \b, MPEG v4 system, iTunes bookmarked +>8 string/B qt \b, Apple QuickTime movie + +# MPEG sequences +# Scans for all common MPEG header start codes +0 belong 0x00000001 JVT NAL sequence +>4 byte&0x1F 0x07 \b, H.264 video +>>5 byte 66 \b, baseline +>>5 byte 77 \b, main +>>5 byte 88 \b, extended +>>7 byte x \b @ L %u +0 belong&0xFFFFFF00 0x00000100 MPEG sequence +>3 byte 0xBA +>>4 byte &0x40 \b, v2, program multiplex +>>4 byte ^0x40 \b, v1, system multiplex +>3 byte 0xBB \b, v1/2, multiplex (missing pack header) +>3 byte&0x1F 0x07 \b, H.264 video +>>4 byte 66 \b, baseline +>>4 byte 77 \b, main +>>4 byte 88 \b, extended +>>6 byte x \b @ L %u +>3 byte 0xB0 \b, v4 +>>5 belong 0x000001B5 +>>>9 byte &0x80 +>>>>10 byte&0xF0 16 \b, video +>>>>10 byte&0xF0 32 \b, still texture +>>>>10 byte&0xF0 48 \b, mesh +>>>>10 byte&0xF0 64 \b, face +>>>9 byte&0xF8 8 \b, video +>>>9 byte&0xF8 16 \b, still texture +>>>9 byte&0xF8 24 \b, mesh +>>>9 byte&0xF8 32 \b, face +>>4 byte 1 \b, simple @ L1 +>>4 byte 2 \b, simple @ L2 +>>4 byte 3 \b, simple @ L3 +>>4 byte 4 \b, simple @ L0 +>>4 byte 17 \b, simple scalable @ L1 +>>4 byte 18 \b, simple scalable @ L2 +>>4 byte 33 \b, core @ L1 +>>4 byte 34 \b, core @ L2 +>>4 byte 50 \b, main @ L2 +>>4 byte 51 \b, main @ L3 +>>4 byte 53 \b, main @ L4 +>>4 byte 66 \b, n-bit @ L2 +>>4 byte 81 \b, scalable texture @ L1 +>>4 byte 97 \b, simple face animation @ L1 +>>4 byte 98 \b, simple face animation @ L2 +>>4 byte 99 \b, simple face basic animation @ L1 +>>4 byte 100 \b, simple face basic animation @ L2 +>>4 byte 113 \b, basic animation text @ L1 +>>4 byte 114 \b, basic animation text @ L2 +>>4 byte 129 \b, hybrid @ L1 +>>4 byte 130 \b, hybrid @ L2 +>>4 byte 145 \b, advanced RT simple @ L! +>>4 byte 146 \b, advanced RT simple @ L2 +>>4 byte 147 \b, advanced RT simple @ L3 +>>4 byte 148 \b, advanced RT simple @ L4 +>>4 byte 161 \b, core scalable @ L1 +>>4 byte 162 \b, core scalable @ L2 +>>4 byte 163 \b, core scalable @ L3 +>>4 byte 177 \b, advanced coding efficiency @ L1 +>>4 byte 178 \b, advanced coding efficiency @ L2 +>>4 byte 179 \b, advanced coding efficiency @ L3 +>>4 byte 180 \b, advanced coding efficiency @ L4 +>>4 byte 193 \b, advanced core @ L1 +>>4 byte 194 \b, advanced core @ L2 +>>4 byte 209 \b, advanced scalable texture @ L1 +>>4 byte 210 \b, advanced scalable texture @ L2 +>>4 byte 211 \b, advanced scalable texture @ L3 +>>4 byte 225 \b, simple studio @ L1 +>>4 byte 226 \b, simple studio @ L2 +>>4 byte 227 \b, simple studio @ L3 +>>4 byte 228 \b, simple studio @ L4 +>>4 byte 229 \b, core studio @ L1 +>>4 byte 230 \b, core studio @ L2 +>>4 byte 231 \b, core studio @ L3 +>>4 byte 232 \b, core studio @ L4 +>>4 byte 240 \b, advanced simple @ L0 +>>4 byte 241 \b, advanced simple @ L1 +>>4 byte 242 \b, advanced simple @ L2 +>>4 byte 243 \b, advanced simple @ L3 +>>4 byte 244 \b, advanced simple @ L4 +>>4 byte 245 \b, advanced simple @ L5 +>>4 byte 247 \b, advanced simple @ L3b +>>4 byte 248 \b, FGS @ L0 +>>4 byte 249 \b, FGS @ L1 +>>4 byte 250 \b, FGS @ L2 +>>4 byte 251 \b, FGS @ L3 +>>4 byte 252 \b, FGS @ L4 +>>4 byte 253 \b, FGS @ L5 +>3 byte 0xB5 \b, v4 +>>4 byte &0x80 +>>>5 byte&0xF0 16 \b, video (missing profile header) +>>>5 byte&0xF0 32 \b, still texture (missing profile header) +>>>5 byte&0xF0 48 \b, mesh (missing profile header) +>>>5 byte&0xF0 64 \b, face (missing profile header) +>>4 byte&0xF8 8 \b, video (missing profile header) +>>4 byte&0xF8 16 \b, still texture (missing profile header) +>>4 byte&0xF8 24 \b, mesh (missing profile header) +>>4 byte&0xF8 32 \b, face (missing profile header) +>3 byte 0xB3 +>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video +>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video +>>12 belong 0x000001B5 \b, v2, +>>>16 byte&0x0F 1 \b HP +>>>16 byte&0x0F 2 \b Spt +>>>16 byte&0x0F 3 \b SNR +>>>16 byte&0x0F 4 \b MP +>>>16 byte&0x0F 5 \b SP +>>>17 byte&0xF0 64 \b@HL +>>>17 byte&0xF0 96 \b@H-14 +>>>17 byte&0xF0 128 \b@ML +>>>17 byte&0xF0 160 \b@LL +>>>17 byte &0x08 \b progressive +>>>17 byte ^0x08 \b interlaced +>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video +>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video +>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video +>>11 byte &0x02 +>>>75 byte &0x01 +>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video +>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video +>>>>140 belong 0x000001B5 \b, v2, +>>>>>144 byte&0x0F 1 \b HP +>>>>>144 byte&0x0F 2 \b Spt +>>>>>144 byte&0x0F 3 \b SNR +>>>>>144 byte&0x0F 4 \b MP +>>>>>144 byte&0x0F 5 \b SP +>>>>>145 byte&0xF0 64 \b@HL +>>>>>145 byte&0xF0 96 \b@H-14 +>>>>>145 byte&0xF0 128 \b@ML +>>>>>145 byte&0xF0 160 \b@LL +>>>>>145 byte &0x08 \b progressive +>>>>>145 byte ^0x08 \b interlaced +>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video +>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video +>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video +>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video +>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video +>>76 belong 0x000001B5 \b, v2, +>>>80 byte&0x0F 1 \b HP +>>>80 byte&0x0F 2 \b Spt +>>>80 byte&0x0F 3 \b SNR +>>>80 byte&0x0F 4 \b MP +>>>80 byte&0x0F 5 \b SP +>>>81 byte&0xF0 64 \b@HL +>>>81 byte&0xF0 96 \b@H-14 +>>>81 byte&0xF0 128 \b@ML +>>>81 byte&0xF0 160 \b@LL +>>>81 byte &0x08 \b progressive +>>>81 byte ^0x08 \b interlaced +>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video +>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video +>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video +>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P +>>>7 byte&0xF0 0x10 \b, 16:9 +>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I +>>>7 byte&0xF0 0x10 \b, 16:9 +>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 beshort&0xFFF0 0x2C00 \b, 4CIF +>>>5 beshort&0x0FFF 0x01E0 \b NTSC +>>>5 beshort&0x0FFF 0x0240 \b PAL +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>>7 byte&0xF0 0x80 \b, PAL 4:3 +>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 +>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240 +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160 +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120 +>>>7 byte&0xF0 0x10 \b, 4:3 +>>4 beshort&0xFFF0 0x1600 \b, CIF +>>>5 beshort&0x0FFF 0x00F0 \b NTSC +>>>5 beshort&0x0FFF 0x0120 \b PAL +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>>7 byte&0xF0 0x80 \b, PAL 4:3 +>>>7 byte&0xF0 0xC0 \b, NTSC 4:3 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625 +>>>>7 byte&0xF0 0x20 \b, 4:3 +>>>>7 byte&0xF0 0x30 \b, 16:9 +>>>>7 byte&0xF0 0x40 \b, 11:5 +>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU +>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625 +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>4 beshort&0xFFF0 0x1E00 \b, SVCD +>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525 +>>>5 beshort&0x0FFF 0x0240 \b PAL 625 +>>>7 byte&0xF0 0x20 \b, 4:3 +>>>7 byte&0xF0 0x30 \b, 16:9 +>>>7 byte&0xF0 0x40 \b, 11:5 +>>7 byte&0x0F 1 \b, 23.976 fps +>>7 byte&0x0F 2 \b, 24 fps +>>7 byte&0x0F 3 \b, 25 fps +>>7 byte&0x0F 4 \b, 29.97 fps +>>7 byte&0x0F 5 \b, 30 fps +>>7 byte&0x0F 6 \b, 50 fps +>>7 byte&0x0F 7 \b, 59.94 fps +>>7 byte&0x0F 8 \b, 60 fps +>>11 byte &0x04 \b, Constrained -# MPEG Audio (*.mpx) +# MPEG ADTS Audio (*.mpx/mxa/aac) # from dreesen@math.fu-berlin.de +# modified to fully support MPEG ADTS + +# MP3, M1A +0 beshort&0xFFFE 0xFFFA MPEG ADTS, layer III, v1 +# rates +>2 byte&0xF0 0x10 \b, 32 kBits +>2 byte&0xF0 0x20 \b, 40 kBits +>2 byte&0xF0 0x30 \b, 48 kBits +>2 byte&0xF0 0x40 \b, 56 kBits +>2 byte&0xF0 0x50 \b, 64 kBits +>2 byte&0xF0 0x60 \b, 80 kBits +>2 byte&0xF0 0x70 \b, 96 kBits +>2 byte&0xF0 0x80 \b, 112 kBits +>2 byte&0xF0 0x90 \b, 128 kBits +>2 byte&0xF0 0xA0 \b, 160 kBits +>2 byte&0xF0 0xB0 \b, 192 kBits +>2 byte&0xF0 0xC0 \b, 224 kBits +>2 byte&0xF0 0xD0 \b, 256 kBits +>2 byte&0xF0 0xE0 \b, 320 kBits +# timing +>2 byte&0x0C 0x00 \b, 44.1 kHz +>2 byte&0x0C 0x04 \b, 48 kHz +>2 byte&0x0C 0x08 \b, 32 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MP2, M1A +0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 +# rates +>2 byte&0xF0 0x10 \b, 32 kBits +>2 byte&0xF0 0x20 \b, 48 kBits +>2 byte&0xF0 0x30 \b, 56 kBits +>2 byte&0xF0 0x40 \b, 64 kBits +>2 byte&0xF0 0x50 \b, 80 kBits +>2 byte&0xF0 0x60 \b, 96 kBits +>2 byte&0xF0 0x70 \b, 112 kBits +>2 byte&0xF0 0x80 \b, 128 kBits +>2 byte&0xF0 0x90 \b, 160 kBits +>2 byte&0xF0 0xA0 \b, 192 kBits +>2 byte&0xF0 0xB0 \b, 224 kBits +>2 byte&0xF0 0xC0 \b, 256 kBits +>2 byte&0xF0 0xD0 \b, 320 kBits +>2 byte&0xF0 0xE0 \b, 384 kBits +# timing +>2 byte&0x0C 0x00 \b, 44.1 kHz +>2 byte&0x0C 0x04 \b, 48 kHz +>2 byte&0x0C 0x08 \b, 32 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MPA, M1A +# updated by Joerg Jenderek +# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 +0 beshort&0xFFFE 0xFFFE +>2 ubyte&0xF0 >0x0F +>>2 ubyte&0xF0 <0xE1 MPEG ADTS, layer I, v1 +# rate +>>>2 byte&0xF0 0x10 \b, 32 kBits +>>>2 byte&0xF0 0x20 \b, 64 kBits +>>>2 byte&0xF0 0x30 \b, 96 kBits +>>>2 byte&0xF0 0x40 \b, 128 kBits +>>>2 byte&0xF0 0x50 \b, 160 kBits +>>>2 byte&0xF0 0x60 \b, 192 kBits +>>>2 byte&0xF0 0x70 \b, 224 kBits +>>>2 byte&0xF0 0x80 \b, 256 kBits +>>>2 byte&0xF0 0x90 \b, 288 kBits +>>>2 byte&0xF0 0xA0 \b, 320 kBits +>>>2 byte&0xF0 0xB0 \b, 352 kBits +>>>2 byte&0xF0 0xC0 \b, 384 kBits +>>>2 byte&0xF0 0xD0 \b, 416 kBits +>>>2 byte&0xF0 0xE0 \b, 448 kBits +# timing +>>>2 byte&0x0C 0x00 \b, 44.1 kHz +>>>2 byte&0x0C 0x04 \b, 48 kHz +>>>2 byte&0x0C 0x08 \b, 32 kHz +# channels/options +>>>3 byte&0xC0 0x00 \b, Stereo +>>>3 byte&0xC0 0x40 \b, JntStereo +>>>3 byte&0xC0 0x80 \b, 2x Monaural +>>>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MP3, M2A +0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 +# rate +>2 byte&0xF0 0x10 \b, 8 kBits +>2 byte&0xF0 0x20 \b, 16 kBits +>2 byte&0xF0 0x30 \b, 24 kBits +>2 byte&0xF0 0x40 \b, 32 kBits +>2 byte&0xF0 0x50 \b, 40 kBits +>2 byte&0xF0 0x60 \b, 48 kBits +>2 byte&0xF0 0x70 \b, 56 kBits +>2 byte&0xF0 0x80 \b, 64 kBits +>2 byte&0xF0 0x90 \b, 80 kBits +>2 byte&0xF0 0xA0 \b, 96 kBits +>2 byte&0xF0 0xB0 \b, 112 kBits +>2 byte&0xF0 0xC0 \b, 128 kBits +>2 byte&0xF0 0xD0 \b, 144 kBits +>2 byte&0xF0 0xE0 \b, 160 kBits +# timing +>2 byte&0x0C 0x00 \b, 22.05 kHz +>2 byte&0x0C 0x04 \b, 24 kHz +>2 byte&0x0C 0x08 \b, 16 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MP2, M2A +0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2 +# rate +>2 byte&0xF0 0x10 \b, 8 kBits +>2 byte&0xF0 0x20 \b, 16 kBits +>2 byte&0xF0 0x30 \b, 24 kBits +>2 byte&0xF0 0x40 \b, 32 kBits +>2 byte&0xF0 0x50 \b, 40 kBits +>2 byte&0xF0 0x60 \b, 48 kBits +>2 byte&0xF0 0x70 \b, 56 kBits +>2 byte&0xF0 0x80 \b, 64 kBits +>2 byte&0xF0 0x90 \b, 80 kBits +>2 byte&0xF0 0xA0 \b, 96 kBits +>2 byte&0xF0 0xB0 \b, 112 kBits +>2 byte&0xF0 0xC0 \b, 128 kBits +>2 byte&0xF0 0xD0 \b, 144 kBits +>2 byte&0xF0 0xE0 \b, 160 kBits +# timing +>2 byte&0x0C 0x00 \b, 22.05 kHz +>2 byte&0x0C 0x04 \b, 24 kHz +>2 byte&0x0C 0x08 \b, 16 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 + +# MPA, M2A +0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2 +# rate +>2 byte&0xF0 0x10 \b, 32 kBits +>2 byte&0xF0 0x20 \b, 48 kBits +>2 byte&0xF0 0x30 \b, 56 kBits +>2 byte&0xF0 0x40 \b, 64 kBits +>2 byte&0xF0 0x50 \b, 80 kBits +>2 byte&0xF0 0x60 \b, 96 kBits +>2 byte&0xF0 0x70 \b, 112 kBits +>2 byte&0xF0 0x80 \b, 128 kBits +>2 byte&0xF0 0x90 \b, 144 kBits +>2 byte&0xF0 0xA0 \b, 160 kBits +>2 byte&0xF0 0xB0 \b, 176 kBits +>2 byte&0xF0 0xC0 \b, 192 kBits +>2 byte&0xF0 0xD0 \b, 224 kBits +>2 byte&0xF0 0xE0 \b, 256 kBits +# timing +>2 byte&0x0C 0x00 \b, 22.05 kHz +>2 byte&0x0C 0x04 \b, 24 kHz +>2 byte&0x0C 0x08 \b, 16 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 -# MPEG 1.0 Layer 3 -0 beshort&0xfffe =0xfffa \bMP3 ->2 byte&0xf0 =0x10 \b, 32 kBits ->2 byte&0xf0 =0x20 \b, 40 kBits ->2 byte&0xf0 =0x30 \b, 48 kBits ->2 byte&0xf0 =0x40 \b, 56 kBits ->2 byte&0xf0 =0x50 \b, 64 kBits ->2 byte&0xf0 =0x60 \b, 80 kBits ->2 byte&0xf0 =0x70 \b, 96 kBits ->2 byte&0xf0 =0x80 \b, 112 kBits ->2 byte&0xf0 =0x90 \b, 128 kBits ->2 byte&0xf0 =0xA0 \b, 160 kBits ->2 byte&0xf0 =0xB0 \b, 192 kBits ->2 byte&0xf0 =0xC0 \b, 224 kBits ->2 byte&0xf0 =0xD0 \b, 256 kBits ->2 byte&0xf0 =0xE0 \b, 320 kBits -# freq ->2 byte&0x0C =0x00 \b, 44.1 kHz ->2 byte&0x0C =0x04 \b, 48 kHz ->2 byte&0x0C =0x08 \b, 32 kHz -# misc ->3 byte&0xC0 =0x00 \b, Stereo ->3 byte&0xC0 =0x40 \b, JStereo ->3 byte&0xC0 =0x80 \b, Dual-Ch ->3 byte&0xC0 =0xC0 \b, Mono -#>1 byte&0x01 =0x00 \b, Error Protection -#>2 byte&0x02 =0x02 \b, Padding -#>2 byte&0x01 =0x01 \b, Private -#>3 byte&0x08 =0x08 \b, Copyright -#>3 byte&0x04 =0x04 \b, Original -#>3 byte&0x03 1 \b, Emphasis 5 -#>3 byte&0x03 3 \b, Emphasis c - -# MPEG 1.0 Layer 2 -0 beshort&0xfffe =0xfffc \bMP2 ->2 byte&0xf0 =0x10 \b, 32 kBits ->2 byte&0xf0 =0x20 \b, 48 kBits ->2 byte&0xf0 =0x30 \b, 56 kBits ->2 byte&0xf0 =0x40 \b, 64 kBits ->2 byte&0xf0 =0x50 \b, 80 kBits ->2 byte&0xf0 =0x60 \b, 96 kBits ->2 byte&0xf0 =0x70 \b, 112 kBits ->2 byte&0xf0 =0x80 \b, 128 kBits ->2 byte&0xf0 =0x90 \b, 160 kBits ->2 byte&0xf0 =0xA0 \b, 192 kBits ->2 byte&0xf0 =0xB0 \b, 224 kBits ->2 byte&0xf0 =0xC0 \b, 256 kBits ->2 byte&0xf0 =0xD0 \b, 320 kBits ->2 byte&0xf0 =0xE0 \b, 384 kBits -# freq ->2 byte&0x0C =0x00 \b, 44.1 kHz ->2 byte&0x0C =0x04 \b, 48 kHz ->2 byte&0x0C =0x08 \b, 32 kHz -# misc ->3 byte&0xC0 =0x00 \b, Stereo ->3 byte&0xC0 =0x40 \b, JStereo ->3 byte&0xC0 =0x80 \b, Dual-Ch ->3 byte&0xC0 =0xC0 \b, Mono -#>1 byte&0x01 =0x00 \b, Error Protection -#>2 byte&0x02 =0x02 \b, Padding -#>2 byte&0x01 =0x01 \b, Private -#>3 byte&0x08 =0x08 \b, Copyright -#>3 byte&0x04 =0x04 \b, Original -#>3 byte&0x03 1 \b, Emphasis 5 -#>3 byte&0x03 3 \b, Emphasis c - -# MPEG 2.0 -0 beshort&0xfff8 =0xfff0 MP -# Layer 3 ->1 byte &0x02 \b3 -# Layer 2 ->1 byte &0x04 \b2 ->2 byte&0xf0 =0x10 \b, 8 kBits ->2 byte&0xf0 =0x20 \b, 16 kBits ->2 byte&0xf0 =0x30 \b, 24 kBits ->2 byte&0xf0 =0x40 \b, 32 kBits ->2 byte&0xf0 =0x50 \b, 40 kBits ->2 byte&0xf0 =0x60 \b, 48 kBits ->2 byte&0xf0 =0x70 \b, 56 kBits ->2 byte&0xf0 =0x80 \b, 64 kBits ->2 byte&0xf0 =0x90 \b, 80 kBits ->2 byte&0xf0 =0xA0 \b, 96 kBits ->2 byte&0xf0 =0xB0 \b, 112 kBits ->2 byte&0xf0 =0xC0 \b, 128 kBits ->2 byte&0xf0 =0xD0 \b, 144 kBits ->2 byte&0xf0 =0xE0 \b, 160 kBits -# freq ->2 byte&0x0C =0x00 \b, 22.05 kHz ->2 byte&0x0C =0x04 \b, 24 kHz ->2 byte&0x0C =0x08 \b, 16 kHz -# misc ->3 byte&0xC0 =0x00 \b, Stereo ->3 byte&0xC0 =0x40 \b, JStereo ->3 byte&0xC0 =0x80 \b, Dual-Ch ->3 byte&0xC0 =0xC0 \b, Mono -#>1 byte&0x01 =0x00 \b, Error Protection -#>2 byte&0x02 =0x02 \b, Padding -#>2 byte&0x01 =0x01 \b, Private -#>3 byte&0x08 =0x08 \b, Copyright -#>3 byte&0x04 =0x04 \b, Original -#>3 byte&0x03 1 \b, Emphasis 5 -#>3 byte&0x03 3 \b, Emphasis c - -#From: Johan Gade <jgade@diku.dk> - -# MPEG-4 Advanced Audio Coding (AAC) file (perhaps also MPEG-2 ACC?) -16 string M4A MPEG-4 Advanced Audio Coding file (AAC) +# MP3, M25A +0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5 +# rate +>2 byte&0xF0 0x10 \b, 8 kBits +>2 byte&0xF0 0x20 \b, 16 kBits +>2 byte&0xF0 0x30 \b, 24 kBits +>2 byte&0xF0 0x40 \b, 32 kBits +>2 byte&0xF0 0x50 \b, 40 kBits +>2 byte&0xF0 0x60 \b, 48 kBits +>2 byte&0xF0 0x70 \b, 56 kBits +>2 byte&0xF0 0x80 \b, 64 kBits +>2 byte&0xF0 0x90 \b, 80 kBits +>2 byte&0xF0 0xA0 \b, 96 kBits +>2 byte&0xF0 0xB0 \b, 112 kBits +>2 byte&0xF0 0xC0 \b, 128 kBits +>2 byte&0xF0 0xD0 \b, 144 kBits +>2 byte&0xF0 0xE0 \b, 160 kBits +# timing +>2 byte&0x0C 0x00 \b, 11.025 kHz +>2 byte&0x0C 0x04 \b, 12 kHz +>2 byte&0x0C 0x08 \b, 8 kHz +# channels/options +>3 byte&0xC0 0x00 \b, Stereo +>3 byte&0xC0 0x40 \b, JntStereo +>3 byte&0xC0 0x80 \b, 2x Monaural +>3 byte&0xC0 0xC0 \b, Monaural +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Packet Pad +#>2 byte &0x01 \b, Custom Flag +#>3 byte &0x08 \b, Copyrighted +#>3 byte &0x04 \b, Original Source +#>3 byte&0x03 1 \b, NR: 50/15 ms +#>3 byte&0x03 3 \b, NR: CCIT J.17 +# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio + +# Stored AAC streams (instead of the MP4 format) +0 string ADIF MPEG ADIF, AAC +>4 byte &0x80 +>>13 byte &0x10 \b, VBR +>>13 byte ^0x10 \b, CBR +>>16 byte&0x1E 0x02 \b, single stream +>>16 byte&0x1E 0x04 \b, 2 streams +>>16 byte&0x1E 0x06 \b, 3 streams +>>16 byte &0x08 \b, 4 or more streams +>>16 byte &0x10 \b, 8 or more streams +>>4 byte &0x80 \b, Copyrighted +>>13 byte &0x40 \b, Original Source +>>13 byte &0x20 \b, Home Flag +>4 byte ^0x80 +>>4 byte &0x10 \b, VBR +>>4 byte ^0x10 \b, CBR +>>7 byte&0x1E 0x02 \b, single stream +>>7 byte&0x1E 0x04 \b, 2 streams +>>7 byte&0x1E 0x06 \b, 3 streams +>>7 byte &0x08 \b, 4 or more streams +>>7 byte &0x10 \b, 8 or more streams +>>4 byte &0x40 \b, Original Stream(s) +>>4 byte &0x20 \b, Home Source + +# Live or stored single AAC stream (used with MPEG-2 systems) +0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC +>1 byte &0x08 \b, v2 +>1 byte ^0x08 \b, v4 +# profile +>>2 byte &0xC0 \b LTP +>2 byte&0xc0 0x00 \b Main +>2 byte&0xc0 0x40 \b LC +>2 byte&0xc0 0x80 \b SSR +# timing +>2 byte&0x3c 0x00 \b, 96 kHz +>2 byte&0x3c 0x04 \b, 88.2 kHz +>2 byte&0x3c 0x08 \b, 64 kHz +>2 byte&0x3c 0x0c \b, 48 kHz +>2 byte&0x3c 0x10 \b, 44.1 kHz +>2 byte&0x3c 0x14 \b, 32 kHz +>2 byte&0x3c 0x18 \b, 24 kHz +>2 byte&0x3c 0x1c \b, 22.05 kHz +>2 byte&0x3c 0x20 \b, 16 kHz +>2 byte&0x3c 0x24 \b, 12 kHz +>2 byte&0x3c 0x28 \b, 11.025 kHz +>2 byte&0x3c 0x2c \b, 8 kHz +# channels +>2 beshort&0x01c0 0x0040 \b, monaural +>2 beshort&0x01c0 0x0080 \b, stereo +>2 beshort&0x01c0 0x00c0 \b, stereo + center +>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE +>2 beshort&0x01c0 0x0140 \b, surround +>2 beshort&0x01c0 0x0180 \b, surround + LFE +>2 beshort &0x01C0 \b, surround + side +#>1 byte ^0x01 \b, Data Verify +#>2 byte &0x02 \b, Custom Flag +#>3 byte &0x20 \b, Original Stream +#>3 byte &0x10 \b, Home Source +#>3 byte &0x08 \b, Copyrighted + +# Live MPEG-4 audio streams (instead of RTP FlexMux) +0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS +#>1 beshort&0x1FFF x \b, %u byte packet +>3 byte&0xE0 0x40 +>>4 byte&0x3C 0x04 \b, single stream +>>4 byte&0x3C 0x08 \b, 2 streams +>>4 byte&0x3C 0x0C \b, 3 streams +>>4 byte &0x08 \b, 4 or more streams +>>4 byte &0x20 \b, 8 or more streams +>3 byte&0xC0 0 +>>4 byte&0x78 0x08 \b, single stream +>>4 byte&0x78 0x10 \b, 2 streams +>>4 byte&0x78 0x18 \b, 3 streams +>>4 byte &0x20 \b, 4 or more streams +>>4 byte &0x40 \b, 8 or more streams +0 beshort 0x4DE1 MPEG-4 LO-EP audio stream # FLI animation format 4 leshort 0xAF11 FLI file @@ -164,20 +612,6 @@ # \003. Most of them start with non-null values at hex offset 0x34 or so. #0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3 -# SGI formats -0 string MOVI Silicon Graphics movie file - -# Apple Quicktime: Scan for all known top-level QT atom markers -4 string moov Apple QuickTime movie file (moov) -4 string mdat Apple QuickTime movie file (mdat) -4 string ftyp Apple QuickTime movie file (ftyp) -4 string free Apple QuickTime movie file (free) -4 string junk Apple QuickTime movie file (junk) -4 string pnot Apple QuickTime movie file (pnot) -4 string skip Apple QuickTime movie file (skip) -4 string wide Apple QuickTime movie file (wide) -4 string pict Apple QuickTime movie file (pict) - # iso 13818 transport stream # # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1) @@ -239,3 +673,9 @@ >0x26 ubeshort x %dµs, >0x42 ubeshort 0 no audio >0x42 ubeshort >0 %dHz audio + +# From: "Stefan A. Haubenthal" <polluks@web.de> +0 string DVDVIDEO-VTS Video title set, +>0x21 byte x v%x +0 string DVDVIDEO-VMG Video manager, +>0x21 byte x v%x diff --git a/usr.bin/file/magdir/apple b/usr.bin/file/magdir/apple index 7758b4a4f95..381a59657f8 100644 --- a/usr.bin/file/magdir/apple +++ b/usr.bin/file/magdir/apple @@ -1,4 +1,4 @@ -# $OpenBSD: apple,v 1.4 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: apple,v 1.5 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # apple: file(1) magic for Apple file formats @@ -128,3 +128,65 @@ # Beagle Bros. Apple Mechanic fonts 0 belong&0xFF00FFFF 0x6400D000 Apple Mechanic font + +# Apple Universal Disk Image Format (UDIF) - dmg files. +# From Johan Gade. +# These entries are disabled for now until we fix the following issues. +# +# Note there might be some problems with the "VAX COFF executable" +# entry. Note this entry should be placed before the mac filesystem section, +# particularly the "Apple Partition data" entry. +# +# The intended meaning of these tests is, that the file is only of the +# specified type if both of the lines are correct - i.e. if the first +# line matches and the second doesn't then it is not of that type. +# +#0 long 0x7801730d +#>4 long 0x62626060 UDIF read-only zlib-compressed image (UDZO) +# +# Note that this entry is recognized correctly by the "Apple Partition +# data" entry - however since this entry is more specific - this +# information seems to be more useful. +#0 long 0x45520200 +#>0x410 string disk\ image UDIF read/write image (UDRW) + +# From: Toby Peterson <toby@apple.com> +0 string bplist00 Apple binary property list + +# Apple binary property list (bplist) +# Assumes version bytes are hex. +# Provides content hints for version 0 files. Assumes that the root +# object is the first object (true for CoreFoundation implementation). +# From: David Remahl <dremahl@apple.com> +0 string bplist +>6 byte x \bCoreFoundation binary property list data, version 0x%c +>>7 byte x \b%c +>6 string 00 \b +>>8 byte&0xF0 0x00 \b +>>>8 byte&0x0F 0x00 \b, root type: null +>>>8 byte&0x0F 0x08 \b, root type: false boolean +>>>8 byte&0x0F 0x09 \b, root type: true boolean +>>8 byte&0xF0 0x10 \b, root type: integer +>>8 byte&0xF0 0x20 \b, root type: real +>>8 byte&0xF0 0x30 \b, root type: date +>>8 byte&0xF0 0x40 \b, root type: data +>>8 byte&0xF0 0x50 \b, root type: ascii string +>>8 byte&0xF0 0x60 \b, root type: unicode string +>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) +>>8 byte&0xF0 0xa0 \b, root type: array +>>8 byte&0xF0 0xd0 \b, root type: dictionary + +# Apple/NeXT typedstream data +# Serialization format used by NeXT and Apple for various +# purposes in YellowStep/Cocoa, including some nib files. +# From: David Remahl <dremahl@apple.com> +2 string typedstream NeXT/Apple typedstream data, big endian +>0 byte x \b, version %hhd +>0 byte <5 \b +>>13 byte 0x81 \b +>>>14 ubeshort x \b, system %hd +2 string streamtyped NeXT/Apple typedstream data, little endian +>0 byte x \b, version %hhd +>0 byte <5 \b +>>13 byte 0x81 \b +>>>14 uleshort x \b, system %hd diff --git a/usr.bin/file/magdir/archive b/usr.bin/file/magdir/archive index 95fec013ef8..6c9351b516f 100644 --- a/usr.bin/file/magdir/archive +++ b/usr.bin/file/magdir/archive @@ -1,4 +1,4 @@ -# $OpenBSD: archive,v 1.4 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: archive,v 1.5 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # archive: file(1) magic for archive formats (see also "msdos" for self- @@ -30,12 +30,17 @@ # Debian package (needs to go before regular portable archives) # -0 string !<arch>\ndebian +0 string =!<arch>\ndebian >8 string debian-split part of multipart Debian package >8 string debian-binary Debian binary package >68 string >\0 (format %s) ->81 string bz2 \b, uses bzip2 compression ->84 string gz \b, uses gzip compression +# These next two lines do not work, because a bzip2 Debian archive +# still uses gzip for the control.tar (first in the archive). Only +# data.tar varies, and the location of its filename varies too. +# file/libmagic does not current have support for ascii-string based +# (offsets) as of 2005-09-15. +#>81 string bz2 \b, uses bzip2 compression +#>84 string gz \b, uses gzip compression #>136 ledate x created: %s # other archives @@ -48,7 +53,7 @@ # MIPS archive (needs to go before regular portable archives) # -0 string !<arch>\n__________E MIPS archive +0 string =!<arch>\n__________E MIPS archive >20 string U with MIPS Ucode members >21 string L with MIPSEL members >21 string B with MIPSEB members @@ -62,7 +67,7 @@ # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have: # -# 0 string !<arch> current ar archive +# 0 string =!<arch> current ar archive # 0 long 0x213c6172 archive file # # and for SVR1 archives, we have: @@ -74,7 +79,7 @@ # and absolute code program modules in the same format as new-style # "ar" archives? # -0 string !<arch> current ar archive +0 string =!<arch> current ar archive >8 string __.SYMDEF random library >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 @@ -122,14 +127,312 @@ 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched +# [JW] stuff taken from idarc, obviously ARC successors: +0 lelong&0x8080ffff 0x00000a1a PAK archive data +0 lelong&0x8080ffff 0x0000141a ARC+ archive data +0 lelong&0x8080ffff 0x0000481a HYP archive data # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk) # I can't create either SPARK or ArcFS archives so I have not tested this stuff # [GRR: the original entries collide with ARC, above; replaced with combined # version (not tested)] -#0 byte 0x1a RISC OS archive -#>1 string archive (ArcFS format) +#0 byte 0x1a RISC OS archive (spark format) 0 string \032archive RISC OS archive (ArcFS format) +0 string Archive\000 RISC OS archive (ArcFS format) + +# All these were taken from idarc, many could not be verified. Unfortunately, +# there were many low-quality sigs, i.e. easy to trigger false positives. +# Please notify me of any real-world fishy/ambiguous signatures and I'll try +# to get my hands on the actual archiver and see if I find something better. [JW] +# probably many can be enhanced by finding some 0-byte or control char near the start + +# idarc calls this Crush/Uncompressed... *shrug* +0 string CRUSH Crush archive data +# Squeeze It (.sqz) +0 string HLSQZ Squeeze It archive data +# SQWEZ +0 string SQWEZ SQWEZ archive data +# HPack (.hpk) +0 string HPAK HPack archive data +# HAP +0 string \x91\x33HF HAP archive data +# MD/MDCD +0 string MDmd MDCD archive data +# LIM +0 string LIM\x1a LIM archive data +# SAR +3 string LH5 SAR archive data +# BSArc/BS2 +0 string \212\3SB \0 BSArc/BS2 archive data +# MAR +2 string =-ah MAR archive data +# ACB +0 belong&0x00f800ff 0x00800000 ACB archive data +# CPZ +# TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data +# JRC +0 string JRchive JRC archive data +# Quantum +0 string DS\0 Quantum archive data +# ReSOF +0 string PK\3\6 ReSOF archive data +# QuArk +0 string 7\4 QuArk archive data +# YAC +14 string YC YAC archive data +# X1 +0 string X1 X1 archive data +0 string XhDr X1 archive data +# CDC Codec (.dqt) +0 belong&0xffffe000 0x76ff2000 CDC Codec archive data +# AMGC +0 string \xad6" AMGC archive data +# NuLIB +0 string NõFélÃ¥ NuLIB archive data +# PakLeo +0 string LEOLZW PAKLeo archive data +# ChArc +0 string SChF ChArc archive data +# PSA +0 string PSA PSA archive data +# CrossePAC +0 string DSIGDCC CrossePAC archive data +# Freeze +0 string \x1f\x9f\x4a\x10\x0a Freeze archive data +# KBoom +0 string ¨MP¨ KBoom archive data +# NSQ, must go after CDC Codec +0 string \x76\xff NSQ archive data +# DPA +0 string Dirk\ Paehl DPA archive data +# BA +# TODO: idarc says "bytes 0-2 == bytes 3-5" +# TTComp +0 string \0\6 TTComp archive data +# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? +0 string ESP ESP archive data +# ZPack +0 string \1ZPK\1 ZPack archive data +# Sky +0 string \xbc\x40 Sky archive data +# UFA +0 string UFA UFA archive data +# Dry +0 string =-H2O DRY archive data +# FoxSQZ +0 string FOXSQZ FoxSQZ archive data +# AR7 +0 string ,AR7 AR7 archive data +# PPMZ +0 string PPMZ PPMZ archive data +# MS Compress +4 string \x88\xf0\x27 MS Compress archive data +# updated by Joerg Jenderek +>9 string \0 +>>0 string KWAJ +>>>7 string \321\003 MS Compress archive data +>>>>14 ulong >0 \b, original size: %ld bytes +>>>>18 ubyte >0x65 +>>>>>18 string x \b, was %.8s +>>>>>(10.b-4) string x \b.%.3s +# MP3 (archiver, not lossy audio compression) +0 string MP3\x1a MP3-Archiver archive data +# ZET +0 string OZà ZET archive data +# TSComp +0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data +# ARQ +0 string gW\4\1 ARQ archive data +# Squash +3 string OctSqu Squash archive data +# Terse +0 string \5\1\1\0 Terse archive data +# PUCrunch +0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data +# UHarc +0 string UHA UHarc archive data +# ABComp +0 string \2AB ABComp archive data +0 string \3AB2 ABComp archive data +# CMP +0 string CO\0 CMP archive data +# Splint +0 string \x93\xb9\x06 Splint archive data +# InstallShield +0 string \x13\x5d\x65\x8c InstallShield Z archive Data +# Gather +1 string GTH Gather archive data +# BOA +0 string BOA BOA archive data +# RAX +0 string ULEB\xa RAX archive data +# Xtreme +0 string ULEB\0 Xtreme archive data +# Pack Magic +0 string @â\1\0 Pack Magic archive data +# BTS +0 belong&0xfeffffff 0x1a034465 BTS archive data +# ELI 5750 +0 string Ora\ ELI 5750 archive data +# QFC +0 string \x1aFC\x1a QFC archive data +0 string \x1aQF\x1a QFC archive data +# PRO-PACK +0 string RNC PRO-PACK archive data +# 777 +0 string 777 777 archive data +# LZS221 +0 string sTaC LZS221 archive data +# HPA +0 string HPA HPA archive data +# Arhangel +0 string LG Arhangel archive data +# EXP1, uses bzip2 +0 string 0123456789012345BZh EXP1 archive data +# IMP +0 string IMP\xa IMP archive data +# NRV +0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data +# Squish +0 string \x73\xb2\x90\xf4 Squish archive data +# Par +0 string PHILIPP Par archive data +0 string PAR Par archive data +# HIT +0 string UB HIT archive data +# SBX +0 belong&0xfffff000 0x53423000 SBX archive data +# NaShrink +0 string NSK NaShrink archive data +# SAPCAR +0 string #\ CAR\ archive\ header SAPCAR archive data +0 string CAR\ 2.00RG SAPCAR archive data +# Disintegrator +0 string DST Disintegrator archive data +# ASD +0 string ASD ASD archive data +# InstallShield CAB +0 string ISc( InstallShield CAB +# TOP4 +0 string T4\x1a TOP4 archive data +# BatComp left out: sig looks like COM executable +# so TODO: get real 4dos batcomp file and find sig +# BlakHole +0 string BH\5\7 BlakHole archive data +# BIX +0 string BIX0 BIX archive data +# ChiefLZA +0 string ChfLZ ChiefLZA archive data +# Blink +0 string Blink Blink archive data +# Logitech Compress +0 string \xda\xfa Logitech Compress archive data +# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) +1 string (C)\ STEPANYUK ARS-Sfx archive data +# AKT/AKT32 +0 string AKT32 AKT32 archive data +0 string AKT AKT archive data +# NPack +0 string MSTSM NPack archive data +# PFT +0 string \0\x50\0\x14 PFT archive data +# SemOne +0 string SEM SemOne archive data +# PPMD +0 string \x8f\xaf\xac\x84 PPMD archive data +# FIZ +0 string FIZ FIZ archive data +# MSXiE +0 belong&0xfffff0f0 0x4d530000 MSXiE archive data +# DeepFreezer +0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data +# DC +0 string =<DC- DC archive data +# TPac +0 string \4TPAC\3 TPac archive data +# Ai +0 string Ai\1\1\0 Ai archive data +0 string Ai\1\0\0 Ai archive data +# Ai32 +0 string Ai\2\0 Ai32 archive data +0 string Ai\2\1 Ai32 archive data +# SBC +0 string SBC SBC archive data +# Ybs +0 string YBS Ybs archive data +# DitPack +0 string \x9e\0\0 DitPack archive data +# DMS +0 string DMS! DMS archive data +# EPC +0 string \x8f\xaf\xac\x8c EPC archive data +# VSARC +0 string VS\x1a VSARC archive data +# PDZ +0 string PDZ PDZ archive data +# ReDuq +0 string rdqx ReDuq archive data +# GCA +0 string GCAX GCA archive data +# PPMN +0 string pN PPMN archive data +# WinImage +3 string WINIMAGE WinImage archive data +# Compressia +0 string CMP0CMP Compressia archive data +# UHBC +0 string UHB UHBC archive data +# WinHKI +0 string \x61\x5C\x04\x05 WinHKI archive data +# WWPack data file +0 string WWP WWPack archive data +# BSN (BSA, PTS-DOS) +0 string \xffBSG BSN archive data +1 string \xffBSG BSN archive data +3 string \xffBSG BSN archive data +1 string \0\xae\2 BSN archive data +1 string \0\xae\3 BSN archive data +1 string \0\xae\7 BSN archive data +# AIN +0 string \x33\x18 AIN archive data +0 string \x33\x17 AIN archive data +# XPA32 +0 string xpa\0\1 XPA32 archive data +# SZip (TODO: doesn't catch all versions) +0 string SZ\x0a\4 SZip archive data +# XPack DiskImage +0 string jm XPack DiskImage archive data +# XPack Data +0 string xpa XPack archive data +# XPack Single Data +0 string Ã\ jm XPack single archive data + +# TODO: missing due to unknown magic/magic at end of file: +#DWC +#ARG +#ZAR +#PC/3270 +#InstallIt +#RKive +#RK +#XPack Diskimage + +# These were inspired by idarc, but actually verified +# Dzip archiver (.dz) +0 string DZ Dzip archive data +>2 byte x \b, version %i +>3 byte x \b.%i +# ZZip archiver (.zz) +0 string ZZ\ \0\0 ZZip archive data +0 string ZZ0 ZZip archive data +# PAQ archiver (.paq) +0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data +0 string PAQ PAQ archive data +>3 byte&0xf0 0x30 +>>3 byte x (v%c) +# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) +0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data +0 string JARCS JAR (ARJ Software, Inc.) archive data # ARJ archiver (jason@jarthur.Claremont.EDU) 0 leshort 0xea60 ARJ archive data @@ -149,6 +452,8 @@ >7 byte 8 os: NeXT >7 byte 9 os: VAX/VMS >3 byte >0 %d] +# [JW] idarc says this is also possible +2 leshort 0xea60 ARJ archive data # HA archiver (Greg Roelofs, newt@uchicago.edu) # This is a really bad format. A file containing HAWAII will match this... @@ -160,12 +465,21 @@ #>4 byte&0x0f =2 first is type HSC #>4 byte&0x0f =0x0e first is type DIR #>4 byte&0x0f =0x0f first is type SPECIAL +# suggestion: at least identify small archives (<1024 files) +0 belong&0xffff00fc 0x48410000 HA archive data +>2 leshort =1 1 file, +>2 leshort >1 %u files, +>4 byte&0x0f =0 first is type CPY +>4 byte&0x0f =1 first is type ASC +>4 byte&0x0f =2 first is type HSC +>4 byte&0x0f =0x0e first is type DIR +>4 byte&0x0f =0x0f first is type SPECIAL # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz) 0 string HPAK HPACK archive data # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net -0 string \351,\001JAM\ JAM archive, +0 string \351,\001JAM\ JAM archive, >7 string >\0 version %.4s >0x26 byte =0x27 - >>0x2b string >\0 label %.11s, @@ -173,12 +487,12 @@ >>0x36 string >\0 fstype %.8s # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu) -2 string -lh0- LHarc 1.x archive data [lh0] -2 string -lh1- LHarc 1.x archive data [lh1] +2 string -lh0- LHarc 1.x/ARX archive data [lh0] +2 string -lh1- LHarc 1.x/ARX archive data [lh1] 2 string -lz4- LHarc 1.x archive data [lz4] 2 string -lz5- LHarc 1.x archive data [lz5] # [never seen any but the last; -lh4- reported in comp.compression:] -2 string -lzs- LHa 2.x? archive data [lzs] +2 string -lzs- LHa/LZS archive data [lzs] 2 string -lh\40- LHa 2.x? archive data [lh ] 2 string -lhd- LHa 2.x? archive data [lhd] 2 string -lh2- LHa 2.x? archive data [lh2] @@ -186,25 +500,99 @@ 2 string -lh4- LHa (2.x) archive data [lh4] 2 string -lh5- LHa (2.x) archive data [lh5] 2 string -lh6- LHa (2.x) archive data [lh6] -2 string -lh7- LHa (2.x) archive data [lh7] +2 string -lh7- LHa (2.x)/LHark archive data [lh7] >20 byte x - header level %d +# taken from idarc [JW] +2 string -lZ PUT archive data +2 string -lz LZS archive data +2 string -sw1- Swag archive data # RAR archiver (Greg Roelofs, newt@uchicago.edu) -0 string Rar! RAR archive data +0 string Rar! RAR archive data, +>44 byte x v%0x, +>10 byte >0 flags: +>>10 byte &0x01 Archive volume, +>>10 byte &0x02 Commented, +>>10 byte &0x04 Locked, +>>10 byte &0x08 Solid, +>>10 byte &0x20 Authenticated, +>35 byte 0 os: MS-DOS +>35 byte 1 os: OS/2 +>35 byte 2 os: Win32 +>35 byte 3 os: Unix +# some old version? idarc says: +0 string RE\x7e\x5e RAR archive data # SQUISH archiver (Greg Roelofs, newt@uchicago.edu) 0 string SQSH squished archive data (Acorn RISCOS) # UC2 archiver (Greg Roelofs, newt@uchicago.edu) -# I can't figure out the self-extracting form of these buggers... +# [JW] see exe section for self-extracting version 0 string UC2\x1a UC2 archive data # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) -0 string PK\003\004 Zip archive data ->4 byte 0x09 \b, at least v0.9 to extract ->4 byte 0x0a \b, at least v1.0 to extract ->4 byte 0x0b \b, at least v1.1 to extract ->4 byte 0x14 \b, at least v2.0 to extract +0 string PK\003\004 +>4 byte 0x09 Zip archive data, at least v0.9 to extract +>4 byte 0x0a Zip archive data, at least v1.0 to extract +>4 byte 0x0b Zip archive data, at least v1.1 to extract +>4 byte 0x14 +>>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract +>0x161 string WINZIP Zip archive data, WinZIP self-extracting + + +# OpenOffice.org / KOffice / StarOffice documents +# From: Abel Cheung <abel@oaka.org> +# Listed here because they are basically zip files +>>30 string mimetype + +# KOffice (1.2 or above) formats +>>>50 string vnd.kde. KOffice (>=1.2) +>>>>58 string karbon Karbon document +>>>>58 string kchart KChart document +>>>>58 string kformula KFormula document +>>>>58 string kivio Kivio document +>>>>58 string kontour Kontour document +>>>>58 string kpresenter KPresenter document +>>>>58 string kspread KSpread document +>>>>58 string kword KWord document + +# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) +>>>50 string vnd.sun.xml. OpenOffice.org 1.x +>>>>62 string writer Writer +>>>>>68 byte !0x2e document +>>>>>68 string .template template +>>>>>68 string .global global document +>>>>62 string calc Calc +>>>>>66 byte !0x2e spreadsheet +>>>>>66 string .template template +>>>>62 string draw Draw +>>>>>66 byte !0x2e document +>>>>>66 string .template template +>>>>62 string impress Impress +>>>>>69 byte !0x2e presentation +>>>>>69 string .template template +>>>>62 string math Math document + +# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) +# http://lists.oasis-open.org/archives/office/200505/msg00006.html +>>>50 string vnd.oasis.opendocument. OpenDocument +>>>>73 string text +>>>>>77 byte !0x2d Text +>>>>>77 string -template Text Template +>>>>>77 string -web HTML Document Template +>>>>>77 string -master Master Document +>>>>73 string graphics Drawing +>>>>>81 string -template Template +>>>>73 string presentation Presentation +>>>>>85 string -template Template +>>>>73 string spreadsheet Spreadsheet +>>>>>84 string -template Template +>>>>73 string chart Chart +>>>>>78 string -template Template +>>>>73 string formula Formula +>>>>>80 string -template Template +>>>>73 string database Database +>>>>73 string image Image # Zoo archiver 20 lelong 0xfdc4a7dc Zoo archive data @@ -278,7 +666,7 @@ # ACE archive (from http://www.wotsit.org/download.asp?f=ace) # by Stefan `Sec` Zehl <sec@42.org> -7 string **ACE** ACE compressed archive +7 string **ACE** ACE archive data >15 byte >0 version %d >16 byte =0x00 \b, from MS-DOS >16 byte =0x01 \b, from OS/2 @@ -300,9 +688,47 @@ >5 leshort &0x0400 \b, small dictionary >5 leshort &0x0800 \b, multi-volume >5 leshort &0x1000 \b, contains AV-String ->>30 string\x16*UNREGISTERED\x20VERSION* (unregistered) +>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) >5 leshort &0x2000 \b, with recovery record >5 leshort &0x4000 \b, locked >5 leshort &0x8000 \b, solid # Date in MS-DOS format (whatever that is) #>18 lelong x Created on + +# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann +# <doj@cubic.org> +0x1A string sfArk sfArk compressed Soundfont +>0x15 string 2 +>>0x1 string >\0 Version %s +>>0x2A string >\0 : %s + +# DR-DOS 7.03 Packed File *.??_ +0 string Packed\ File\ Personal NetWare Packed File +>12 string x \b, was "%.12s" + +# EET archive +# From: Tilman Sauerbeck <tilman@code-monkey.de> +0 belong 0x1ee7ff00 EET archive + +# rzip archives +0 string RZIP rzip compressed data +>4 byte x - version %d +>5 byte x \b.%d +>6 belong x (%d bytes) + +# From: "Robert Dale" <robdale@gmail.com> +0 belong 123 dar archive, +>4 belong x label "%.8x +>>8 belong x %.8x +>>>12 beshort x %.4x" +>14 byte 0x54 end slice +>14 beshort 0x4e4e multi-part +>14 beshort 0x4e53 multi-part, with -S + +# Symbian installation files +# http://www.thouky.co.uk/software/psifs/sis.html +# http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf +8 lelong 0x10000419 Symbian installation file +>4 lelong 0x1000006D (EPOC release 3/4/5) +>4 lelong 0x10003A12 (EPOC release 6) +0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) diff --git a/usr.bin/file/magdir/audio b/usr.bin/file/magdir/audio index b3f513c686d..d668d13329e 100644 --- a/usr.bin/file/magdir/audio +++ b/usr.bin/file/magdir/audio @@ -1,4 +1,4 @@ -# $OpenBSD: audio,v 1.9 2007/04/08 06:11:39 sturm Exp $ +# $OpenBSD: audio,v 1.10 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # audio: file(1) magic for sound formats (see also "iff") @@ -9,18 +9,28 @@ # Sun/NeXT audio data 0 string .snd Sun/NeXT audio data: ->12 belong 1 8-bit ISDN u-law, +>12 belong 1 8-bit ISDN mu-law, >12 belong 2 8-bit linear PCM [REF-PCM], >12 belong 3 16-bit linear PCM, >12 belong 4 24-bit linear PCM, >12 belong 5 32-bit linear PCM, >12 belong 6 32-bit IEEE floating point, >12 belong 7 64-bit IEEE floating point, ->12 belong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding), ->12 belong 24 compressed (8-bit G.722 ADPCM) ->12 belong 25 compressed (3-bit G.723 ADPCM), ->12 belong 26 compressed (5-bit G.723 ADPCM), ->12 belong 27 8-bit A-law, +>12 belong 8 Fragmented sample data, +>12 belong 10 DSP program, +>12 belong 11 8-bit fixed point, +>12 belong 12 16-bit fixed point, +>12 belong 13 24-bit fixed point, +>12 belong 14 32-bit fixed point, +>12 belong 18 16-bit linear with emphasis, +>12 belong 19 16-bit linear compressed, +>12 belong 20 16-bit linear with emphasis and compression, +>12 belong 21 Music kit DSP commands, +>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), +>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) +>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), +>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), +>12 belong 27 8-bit A-law (CCITT G.711), >20 belong 1 mono, >20 belong 2 stereo, >20 belong 4 quad, @@ -29,14 +39,28 @@ # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format # that uses little-endian encoding and has a different magic number 0 lelong 0x0064732E DEC audio data: ->12 lelong 1 8-bit ISDN u-law, +>12 lelong 1 8-bit ISDN mu-law, >12 lelong 2 8-bit linear PCM [REF-PCM], >12 lelong 3 16-bit linear PCM, >12 lelong 4 24-bit linear PCM, >12 lelong 5 32-bit linear PCM, >12 lelong 6 32-bit IEEE floating point, >12 lelong 7 64-bit IEEE floating point, ->12 lelong 23 8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding), +>12 belong 8 Fragmented sample data, +>12 belong 10 DSP program, +>12 belong 11 8-bit fixed point, +>12 belong 12 16-bit fixed point, +>12 belong 13 24-bit fixed point, +>12 belong 14 32-bit fixed point, +>12 belong 18 16-bit linear with emphasis, +>12 belong 19 16-bit linear compressed, +>12 belong 20 16-bit linear with emphasis and compression, +>12 belong 21 Music kit DSP commands, +>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), +>12 belong 24 compressed (8-bit CCITT G.722 ADPCM) +>12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), +>12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), +>12 belong 27 8-bit A-law (CCITT G.711), >20 lelong 1 mono, >20 lelong 2 stereo, >20 lelong 4 quad, @@ -44,8 +68,12 @@ # Creative Labs AUDIO stuff 0 string MThd Standard MIDI data ->9 byte >0 (format %d) ->11 byte >1 using %d channels +>8 beshort x (format %d) +>10 beshort x using %d track +>10 beshort >1 \bs +>12 beshort&0x7fff x at 1/%d +>12 beshort&0x8000 >0 SMPTE + 0 string CTMF Creative Music (CMF) data 0 string SBI SoundBlaster instrument data 0 string Creative\ Voice\ File Creative Labs voice data @@ -58,17 +86,6 @@ 0 belong 0x4e54524b MultiTrack sound data >4 belong x - version %ld -# Microsoft WAVE format (*.wav) -0 string RIFF Microsoft RIFF ->8 string WAVE \b, WAVE audio data ->>34 leshort >0 \b, %d bit ->>22 leshort =1 \b, mono ->>22 leshort =2 \b, stereo ->>22 leshort >2 \b, %d channels ->>24 lelong >0 %d Hz -# AVI == Audio Video Interleave ->8 string AVI\ \b, AVI data - # Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED # [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi] 0 string EMOD Extended MOD sound data, @@ -79,153 +96,287 @@ >83 byte 1 (song) # Real Audio (Magic .ra\0375) -0 belong 0x2e7261fd realaudio sound file +0 belong 0x2e7261fd RealAudio sound file +0 string .RMF RealMedia file # MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net] # Oct 31, 1995 +# fixed by <doj@cubic.org> 2003-06-24 +# Too short... #0 string MTM MultiTracker Module sound file #0 string if Composer 669 Module sound data +#0 string JN Composer 669 Module sound data (extended format) +0 string MAS_U ULT(imate) Module sound data + #0 string FAR Module sound data -#0 string MAS_U ULT(imate) Module sound data -#0x2c string SCRM ScreamTracker III Module sound data -#0 string Extended Module Extended Module sound data +#>4 string >\15 Title: "%s" + +0x2c string SCRM ScreamTracker III Module sound data +>0 string >\0 Title: "%s" + +# Gravis UltraSound patches +# From <ache@nagual.ru> + +0 string GF1PATCH110\0ID#000002\0 GUS patch +0 string GF1PATCH100\0ID#000002\0 Old GUS patch + +# +# Taken from loader code from mikmod version 2.14 +# by Steve McIntyre (stevem@chiark.greenend.org.uk) +# <doj@cubic.org> added title printing on 2003-06-24 +0 string MAS_UTrack_V00 +>14 string >/0 ultratracker V1.%.1s module sound data + +0 string UN05 MikMod UNI format module sound data + +0 string Extended\ Module: Fasttracker II module sound data +>17 string >\0 Title: "%s" + +21 string/c =!SCREAM! Screamtracker 2 module sound data +21 string BMOD2STM Screamtracker 2 module sound data +1080 string M.K. 4-channel Protracker module sound data +>0 string >\0 Title: "%s" +1080 string M!K! 4-channel Protracker module sound data +>0 string >\0 Title: "%s" +1080 string FLT4 4-channel Startracker module sound data +>0 string >\0 Title: "%s" +1080 string FLT8 8-channel Startracker module sound data +>0 string >\0 Title: "%s" +1080 string 4CHN 4-channel Fasttracker module sound data +>0 string >\0 Title: "%s" +1080 string 6CHN 6-channel Fasttracker module sound data +>0 string >\0 Title: "%s" +1080 string 8CHN 8-channel Fasttracker module sound data +>0 string >\0 Title: "%s" +1080 string CD81 8-channel Octalyser module sound data +>0 string >\0 Title: "%s" +1080 string OKTA 8-channel Oktalyzer module sound data +>0 string >\0 Title: "%s" +# Not good enough. +#1082 string CH +#>1080 string >/0 %.2s-channel Fasttracker "oktalyzer" module sound data +1080 string 16CN 16-channel Taketracker module sound data +>0 string >\0 Title: "%s" +1080 string 32CN 32-channel Taketracker module sound data +>0 string >\0 Title: "%s" + +# TOC sound files -Trevor Johnson <trevor@jpj.net> +# +0 string TOC TOC sound file + +# sidfiles <pooka@iki.fi> +# added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24 +0 string SIDPLAY\ INFOFILE Sidplay info file + +0 string PSID PlaySID v2.2+ (AMIGA) sidtune +>4 beshort >0 w/ header v%d, +>14 beshort =1 single song, +>14 beshort >1 %d songs, +>16 beshort >0 default song: %d +>0x16 string >\0 name: "%s" +>0x36 string >\0 author: "%s" +>0x56 string >\0 copyright: "%s" + +0 string RSID RSID sidtune PlaySID compatible +>4 beshort >0 w/ header v%d, +>14 beshort =1 single song, +>14 beshort >1 %d songs, +>16 beshort >0 default song: %d +>0x16 string >\0 name: "%s" +>0x36 string >\0 author: "%s" +>0x56 string >\0 copyright: "%s" + +# IRCAM <mpruett@sgi.com> +# VAX and MIPS files are little-endian; Sun and NeXT are big-endian +0 belong 0x64a30100 IRCAM file (VAX) +0 belong 0x64a30200 IRCAM file (Sun) +0 belong 0x64a30300 IRCAM file (MIPS little-endian) +0 belong 0x64a30400 IRCAM file (NeXT) + +# NIST SPHERE <mpruett@sgi.com> +0 string NIST_1A\n\ \ \ 1024\n NIST SPHERE file + +# Sample Vision <mpruett@sgi.com> +0 string SOUND\ SAMPLE\ DATA\ Sample Vision file + +# Audio Visual Research <tonigonenstein@users.sourceforge.net> +0 string 2BIT Audio Visual Research file, +>12 beshort =0 mono, +>12 beshort =-1 stereo, +>14 beshort x %d bits +>16 beshort =0 unsigned, +>16 beshort =-1 signed, +>22 belong&0x00ffffff x %d Hz, +>18 beshort =0 no loop, +>18 beshort =-1 loop, +>21 ubyte <=127 note %d, +>22 byte =0 replay 5.485 KHz +>22 byte =1 replay 8.084 KHz +>22 byte =2 replay 10.971 Khz +>22 byte =3 replay 16.168 Khz +>22 byte =4 replay 21.942 KHz +>22 byte =5 replay 32.336 KHz +>22 byte =6 replay 43.885 KHz +>22 byte =7 replay 47.261 KHz + +# SGI SoundTrack <mpruett@sgi.com> +0 string _SGI_SoundTrack SGI SoundTrack project file +# ID3 version 2 tags <waschk@informatik.uni-rostock.de> +0 string ID3 Audio file with ID3 version 2 +>3 ubyte <0xff \b%d. +>4 ubyte <0xff \b%d tag +>2584 string fLaC \b, FLAC encoding +>>2588 byte&0x7f >0 \b, unknown version +>>2588 byte&0x7f 0 \b +# some common bits/sample values +>>>2600 beshort&0x1f0 0x030 \b, 4 bit +>>>2600 beshort&0x1f0 0x050 \b, 6 bit +>>>2600 beshort&0x1f0 0x070 \b, 8 bit +>>>2600 beshort&0x1f0 0x0b0 \b, 12 bit +>>>2600 beshort&0x1f0 0x0f0 \b, 16 bit +>>>2600 beshort&0x1f0 0x170 \b, 24 bit +>>>2600 byte&0xe 0x0 \b, mono +>>>2600 byte&0xe 0x2 \b, stereo +>>>2600 byte&0xe 0x4 \b, 3 channels +>>>2600 byte&0xe 0x6 \b, 4 channels +>>>2600 byte&0xe 0x8 \b, 5 channels +>>>2600 byte&0xe 0xa \b, 6 channels +>>>2600 byte&0xe 0xc \b, 7 channels +>>>2600 byte&0xe 0xe \b, 8 channels +# some common sample rates +>>>2597 belong&0xfffff0 0x0ac440 \b, 44.1 kHz +>>>2597 belong&0xfffff0 0x0bb800 \b, 48 kHz +>>>2597 belong&0xfffff0 0x07d000 \b, 32 kHz +>>>2597 belong&0xfffff0 0x056220 \b, 22.05 kHz +>>>2597 belong&0xfffff0 0x05dc00 \b, 24 kHz +>>>2597 belong&0xfffff0 0x03e800 \b, 16 kHz +>>>2597 belong&0xfffff0 0x02b110 \b, 11.025 kHz +>>>2597 belong&0xfffff0 0x02ee00 \b, 12 kHz +>>>2597 belong&0xfffff0 0x01f400 \b, 8 kHz +>>>2597 belong&0xfffff0 0x177000 \b, 96 kHz +>>>2597 belong&0xfffff0 0x0fa000 \b, 64 kHz +>>>2601 byte&0xf >0 \b, >4G samples +>2584 string !fLaC \b, MP3 encoding + +# NSF (NES sound file) magic +0 string NESM\x1a NES Sound File +>14 string >\0 ("%s" by +>46 string >\0 %s, copyright +>78 string >\0 %s), +>5 byte x version %d, +>6 byte x %d tracks, +>122 byte&0x2 =1 dual PAL/NTSC +>122 byte&0x1 =1 PAL +>122 byte&0x1 =0 NTSC + +# Impulse tracker module (audio/x-it) +0 string IMPM Impulse Tracker module sound data - +>4 string >\0 "%s" +>40 leshort !0 compatible w/ITv%x +>42 leshort !0 created w/ITv%x + +# Imago Orpheus module (audio/x-imf) +60 string IM10 Imago Orpheus module sound data - +>0 string >\0 "%s" + +# From <collver1@attbi.com> +# These are the /etc/magic entries to decode modules, instruments, and +# samples in Impulse Tracker's native format. + +0 string IMPS Impulse Tracker Sample +>18 byte &2 16 bit +>18 byte ^2 8 bit +>18 byte &4 stereo +>18 byte ^4 mono +0 string IMPI Impulse Tracker Instrument +>28 leshort !0 ITv%x +>30 byte !0 %d samples -#------------------------ -# MPEG: file(1) magic for MPEG audio. +# Yamaha TX Wave: file(1) magic for Yamaha TX Wave audio files +# From <collver1@attbi.com> +0 string LM8953 Yamaha TX Wave +>22 byte 0x49 looped +>22 byte 0xC9 non-looped +>23 byte 1 33kHz +>23 byte 2 50kHz +>23 byte 3 16kHz + +# scream tracker: file(1) magic for Scream Tracker sample files +# +# From <collver1@attbi.com> +76 string SCRS Scream Tracker Sample +>0 byte 1 sample +>0 byte 2 adlib melody +>0 byte >2 adlib drum +>31 byte &2 stereo +>31 byte ^2 mono +>31 byte &4 16bit little endian +>31 byte ^4 8bit +>30 byte 0 unpacked +>30 byte 1 packed + +# audio +# From: Cory Dikkers <cdikkers@swbell.net> +0 string MMD0 MED music file, version 0 +0 string MMD1 OctaMED Pro music file, version 1 +0 string MMD3 OctaMED Soundstudio music file, version 3 +0 string OctaMEDCmpr OctaMED Soundstudio compressed file +0 string MED MED_Song +0 string SymM Symphonie SymMOD music file +# +0 string THX AHX version +>3 byte =0 1 module data +>3 byte =1 2 module data # -# From <ckane@best.com> -# Show MPEG level, layer, kbit/s, hz, stereo/mono for an MPG audio file. -# This section is lengthy because the kbit/s rate depends on the -# level and layer, and file(1) doesn't allow math on the values. +0 string OKTASONG Oktalyzer module data # +0 string DIGI\ Booster\ module\0 %s +>20 byte >0 %c +>>21 byte >0 \b%c +>>>22 byte >0 \b%c +>>>>23 byte >0 \b%c +>610 string >\0 \b, "%s" +# +0 string DBM0 DIGI Booster Pro Module +>4 byte >0 V%X. +>>5 byte x \b%02X +>16 string >\0 \b, "%s" +# +0 string FTMN FaceTheMusic module +>16 string >\0d \b, "%s" -####### MPEG begins with three hex 'f' nibbles. -0 beshort&0xfff0 0xfff0 MPEG -####### Level 2 ->1 byte&0x08 0x00 2.0 ->>1 byte&0x06 0x00 Layer Unknown, -####### Level 2, Layers I, II, and III ->>1 byte&0x06 0x02 Layer III, ->>>2 byte&0xf0 0x00 0 kbit/s, ->>>2 byte&0xf0 0x10 8 kbit/s, ->>>2 byte&0xf0 0x20 16 kbit/s, ->>>2 byte&0xf0 0x30 24 kbit/s, ->>>2 byte&0xf0 0x40 32 kbit/s, ->>>2 byte&0xf0 0x50 40 kbit/s, ->>>2 byte&0xf0 0x60 48 kbit/s, ->>>2 byte&0xf0 0x70 56 kbit/s, ->>>2 byte&0xf0 0x80 64 kbit/s, ->>>2 byte&0xf0 0x90 80 kbit/s, ->>>2 byte&0xf0 0xa0 96 kbit/s, ->>>2 byte&0xf0 0xb0 112 kbit/s, ->>>2 byte&0xf0 0xc0 128 kbit/s, ->>>2 byte&0xf0 0xd0 144 kbit/s, ->>>2 byte&0xf0 0xe0 160 kbit/s, ->>>2 byte&0xf0 0xf0 ? kbit/s, ->>1 byte&0x06 0x04 Layer II, ->>>2 byte&0xf0 0x00 0 kbit/s, ->>>2 byte&0xf0 0x10 8 kbit/s, ->>>2 byte&0xf0 0x20 16 kbit/s, ->>>2 byte&0xf0 0x30 24 kbit/s, ->>>2 byte&0xf0 0x40 32 kbit/s, ->>>2 byte&0xf0 0x50 40 kbit/s, ->>>2 byte&0xf0 0x60 48 kbit/s, ->>>2 byte&0xf0 0x70 56 kbit/s, ->>>2 byte&0xf0 0x80 64 kbit/s, ->>>2 byte&0xf0 0x90 80 kbit/s, ->>>2 byte&0xf0 0xa0 96 kbit/s, ->>>2 byte&0xf0 0xb0 112 kbit/s, ->>>2 byte&0xf0 0xc0 128 kbit/s, ->>>2 byte&0xf0 0xd0 144 kbit/s, ->>>2 byte&0xf0 0xe0 160 kbit/s, ->>>2 byte&0xf0 0xf0 ? kbit/s, ->>1 byte&0x06 0x06 Layer I, ->>>2 byte&0xf0 0x00 0 kbit/s, ->>>2 byte&0xf0 0x10 32 kbit/s, ->>>2 byte&0xf0 0x20 48 kbit/s, ->>>2 byte&0xf0 0x30 56 kbit/s, ->>>2 byte&0xf0 0x40 64 kbit/s, ->>>2 byte&0xf0 0x50 80 kbit/s, ->>>2 byte&0xf0 0x60 96 kbit/s, ->>>2 byte&0xf0 0x70 112 kbit/s, ->>>2 byte&0xf0 0x80 128 kbit/s, ->>>2 byte&0xf0 0x90 144 kbit/s, ->>>2 byte&0xf0 0xa0 160 kbit/s, ->>>2 byte&0xf0 0xb0 176 kbit/s, ->>>2 byte&0xf0 0xc0 192 kbit/s, ->>>2 byte&0xf0 0xd0 224 kbit/s, ->>>2 byte&0xf0 0xe0 256 kbit/s, ->>>2 byte&0xf0 0xf0 ? kbit/s, -####### Level 2, Hz ->>2 byte&0x0c 0x00 22050 Hz ->>2 byte&0x0c 0x04 24000 Hz ->>2 byte&0x0c 0x08 16000 Hz ->>2 byte&0x0c 0x0c ? Hz -####### Level 1 decoding ->1 byte&0x08 0x08 1.0 ->>1 byte&0x06 0x00 Layer Unknown. -####### Level 1, Layers I, II, and III ->>1 byte&0x06 0x02 Layer III, ->>>2 byte&0xf0 0x00 0 kbit/s, ->>>2 byte&0xf0 0x10 32 kbit/s, ->>>2 byte&0xf0 0x20 40 kbit/s, ->>>2 byte&0xf0 0x30 48 kbit/s, ->>>2 byte&0xf0 0x40 56 kbit/s, ->>>2 byte&0xf0 0x50 64 kbit/s, ->>>2 byte&0xf0 0x60 80 kbit/s, ->>>2 byte&0xf0 0x70 96 kbit/s, ->>>2 byte&0xf0 0x80 112 kbit/s, ->>>2 byte&0xf0 0x90 128 kbit/s, ->>>2 byte&0xf0 0xa0 160 kbit/s, ->>>2 byte&0xf0 0xb0 192 kbit/s, ->>>2 byte&0xf0 0xc0 224 kbit/s, ->>>2 byte&0xf0 0xd0 256 kbit/s, ->>>2 byte&0xf0 0xe0 320 kbit/s, ->>>2 byte&0xf0 0xf0 ? kbit/s, ->>1 byte&0x06 0x04 Layer II, ->>>2 byte&0xf0 0x00 0 kbit/s, ->>>2 byte&0xf0 0x10 32 kbit/s, ->>>2 byte&0xf0 0x20 48 kbit/s, ->>>2 byte&0xf0 0x30 56 kbit/s, ->>>2 byte&0xf0 0x40 64 kbit/s, ->>>2 byte&0xf0 0x50 80 kbit/s, ->>>2 byte&0xf0 0x60 96 kbit/s, ->>>2 byte&0xf0 0x70 112 kbit/s, ->>>2 byte&0xf0 0x80 128 kbit/s, ->>>2 byte&0xf0 0x90 160 kbit/s, ->>>2 byte&0xf0 0xa0 192 kbit/s, ->>>2 byte&0xf0 0xb0 224 kbit/s, ->>>2 byte&0xf0 0xc0 256 kbit/s, ->>>2 byte&0xf0 0xd0 320 kbit/s, ->>>2 byte&0xf0 0xe0 384 kbit/s, ->>>2 byte&0xf0 0xf0 ? kbit/s, ->>1 byte&0x06 0x06 Layer I, ->>>2 byte&0xf0 0x00 0 kbit/s, ->>>2 byte&0xf0 0x10 32 kbit/s, ->>>2 byte&0xf0 0x20 64 kbit/s, ->>>2 byte&0xf0 0x30 96 kbit/s, ->>>2 byte&0xf0 0x40 128 kbit/s, ->>>2 byte&0xf0 0x50 160 kbit/s, ->>>2 byte&0xf0 0x60 192 kbit/s, ->>>2 byte&0xf0 0x70 224 kbit/s, ->>>2 byte&0xf0 0x80 256 kbit/s, ->>>2 byte&0xf0 0x90 288 kbit/s, ->>>2 byte&0xf0 0xa0 320 kbit/s, ->>>2 byte&0xf0 0xb0 352 kbit/s, ->>>2 byte&0xf0 0xc0 384 kbit/s, ->>>2 byte&0xf0 0xd0 416 kbit/s, ->>>2 byte&0xf0 0xe0 448 kbit/s, ->>>2 byte&0xf0 0xf0 ? kbit/s, -####### Level 2, Hz ->>2 byte&0x0c 0x00 44100 Hz ->>2 byte&0x0c 0x04 48000 Hz ->>2 byte&0x0c 0x08 32000 Hz ->>2 byte&0x0c 0x0c ? Hz -####### Stereo or Mono ->3 byte&0xc0 0x00 stereo ->3 byte&0xc0 0x40 joint-stereo ->3 byte&0xc0 0x80 dual-channel ->3 byte&0xc0 0xc0 mono +# From: <doj@cubic.org> 2003-06-24 +0 string AMShdr\32 Velvet Studio AMS Module v2.2 +0 string Extreme Extreme Tracker AMS Module v1.3 +0 string DDMF Xtracker DMF Module +>4 byte x v%i +>0xD string >\0 Title: "%s" +>0x2B string >\0 Composer: "%s" +0 string DSM\32 Dynamic Studio Module DSM +0 string SONG DigiTrekker DTM Module +0 string DMDL DigiTrakker MDL Module +0 string PSM\32 Protracker Studio PSM Module +44 string PTMF Poly Tracker PTM Module +>0 string >\32 Title: "%s" +0 string MT20 MadTracker 2.0 Module MT2 +0 string RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD +0 string RTMM RTM Module +0x426 string MaDoKaN96 XMS Adlib Module +>0 string >\0 Composer: "%s" +0 string AMF AMF Module +>4 string >\0 Title: "%s" +0 string MODINFO1 Open Cubic Player Module Inforation MDZ +0 string Extended\40Instrument: Fast Tracker II Instrument + +# From: Takeshi Hamasaki <hma@syd.odn.ne.jp> +# NOA Nancy Codec file +0 string \210NOA\015\012\032 NOA Nancy Codec Movie file +# Yamaha SMAF format +0 string MMMD Yamaha SMAF file +# Sharp Jisaku Melody format for PDC +0 string \001Sharp\040JisakuMelody SHARP Cell-Phone ringing Melody +>20 string Ver01.00 Ver. 1.00 +>>32 byte x , %d tracks # Free lossless audio codec <http://flac.sourceforge.net> # From: Przemyslaw Augustyniak <silvathraec@rpg.pl> @@ -264,7 +415,145 @@ >>>22 belong >0 \b, %u samples >>>22 belong 0 \b, length unknown -# ID3 version 2 tags <waschk@informatik.uni-rostock.de> -0 string ID3 MP3 file with ID3 version 2. ->3 ubyte <0xff \b%d. ->4 ubyte <0xff \b%d tag +# (ISDN) VBOX voice message file (Wolfram Kleff) +0 string VBOX VBOX voice message data + +# ReBorn Song Files (.rbs) +# David J. Singer <doc@deadvirgins.org.uk> +8 string RB40 RBS Song file +>29 string ReBorn created by ReBorn +>37 string Propellerhead created by ReBirth + +# Synthesizer Generator and Kimwitu share their file format +0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data +# Kimwitu++ uses a slightly different magic +0 string A#S#C#S#S#L#HUB Kimwitu++ data + +# From "Simon Hosie +0 string TFMX-SONG TFMX module sound data + +# Monkey's Audio compressed audio format (.ape) +# From danny.milo@gmx.net (Danny Milosavljevic) +# New version from Abel Cheung <abel (@) oaka.org> +0 string MAC\040 Monkey's Audio compressed format +>4 uleshort >0x0F8B version %d +>>(0x08.l) uleshort =1000 with fast compression +>>(0x08.l) uleshort =2000 with normal compression +>>(0x08.l) uleshort =3000 with high compression +>>(0x08.l) uleshort =4000 with extra high compression +>>(0x08.l) uleshort =5000 with insane compression +>>(0x08.l+18) uleshort =1 \b, mono +>>(0x08.l+18) uleshort =2 \b, stereo +>>(0x08.l+20) ulelong x \b, sample rate %d +>4 uleshort <0x0F8C version %d +>>6 uleshort =1000 with fast compression +>>6 uleshort =2000 with normal compression +>>6 uleshort =3000 with high compression +>>6 uleshort =4000 with extra high compression +>>6 uleshort =5000 with insane compression +>>10 uleshort =1 \b, mono +>>10 uleshort =2 \b, stereo +>>12 ulelong x \b, sample rate %d + +# adlib sound files +# From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu +0 string RAWADATA RdosPlay RAW + +1068 string RoR AMUSIC Adlib Tracker + +0 string JCH EdLib + +0 string mpu401tr MPU-401 Trakker + +0 string SAdT Surprise! Adlib Tracker +>4 byte x Version %d + +0 string XAD! eXotic ADlib + +0 string ofTAZ! eXtra Simple Music + +# Spectrum 128 tunes (.ay files). +# From: Emanuel Haupt <ehaupt@critical.ch> +0 string ZXAYEMUL Spectrum 128 tune + +0 string \0BONK BONK, +#>5 byte x version %d +>14 byte x %d channel(s), +>15 byte =1 lossless, +>15 byte =0 lossy, +>16 byte x mid-side + +384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) + +# format VQF (proprietary codec for sound) +# some infos on the header file available at : +# http://www.twinvq.org/english/technology_format.html +0 string TWIN97012000 VQF data +>27 short 0 \b, Mono +>27 short 1 \b, Stereo +>31 short >0 \b, %d kbit/s +>35 short >0 \b, %d kHz + +# Nelson A. de Oliveira (naoliv@gmail.com) +# .eqf +0 string Winamp\ EQ\ library\ file %s +# it will match only versions like v<digit>.<digit> +# Since I saw only eqf files with version v1.1 I think that it's OK +>23 string x \b%.4s +# .preset +0 string [Equalizer\ preset] XMMS equalizer preset +# .m3u +0 string #EXTM3U M3U playlist +# .pls +0 string [playlist] PLS playlist +# licq.conf +1 string [licq] LICQ configuration file + +# Atari ST audio files by Dirk Jagdmann <doj@cubic.org> +0 string ICE! SNDH Atari ST music +0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music + +# musepak support From: "Jiri Pejchal" <jiri.pejchal@gmail.com> +0 string MP+ Musepack audio +>3 byte 255 \b, SV pre8 +>3 byte&0xF 0x6 \b, SV 6 +>3 byte&0xF 0x8 \b, SV 8 +>3 byte&0xF 0x7 \b, SV 7 +>>3 byte&0xF0 0x0 \b.0 +>>3 byte&0xF0 0x10 \b.1 +>>3 byte&0xF0 240 \b.15 +>>10 byte&0xF0 0x0 \b, no profile +>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' +>>10 byte&0xF0 0x50 \b, quality 0 +>>10 byte&0xF0 0x60 \b, quality 1 +>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) +>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) +>>10 byte&0xF0 0x90 \b, quality 4 (Radio) +>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) +>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) +>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) +>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) +>>10 byte&0xF0 0xE0 \b, quality 9 +>>10 byte&0xF0 0xF0 \b, quality 10 +>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 +>>27 byte 102 \b, Beta 1.02 +>>27 byte 104 \b, Beta 1.04 +>>27 byte 105 \b, Alpha 1.05 +>>27 byte 106 \b, Beta 1.06 +>>27 byte 110 \b, Release 1.1 +>>27 byte 111 \b, Alpha 1.11 +>>27 byte 112 \b, Beta 1.12 +>>27 byte 113 \b, Alpha 1.13 +>>27 byte 114 \b, Beta 1.14 +>>27 byte 115 \b, Alpha 1.15 + +# IMY +# from http://filext.com/detaillist.php?extdetail=IMY +# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm +# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html +# http://www.wx800.com/msg/download/irda/iMelody.pdf +0 string BEGIN:IMELODY iMelody Ringtone Format + +# From: Matthew Flaschen <matthew.flaschen@gatech.edu> +0 string #EXTM3U M3U playlist text + diff --git a/usr.bin/file/magdir/basis b/usr.bin/file/magdir/basis new file mode 100644 index 00000000000..1813c0e0f0a --- /dev/null +++ b/usr.bin/file/magdir/basis @@ -0,0 +1,16 @@ +#---------------------------------------------------------------- +# basis: file(1) magic for BBx/Pro5-files +# Oliver Dammer <dammer@olida.de> 2005/11/07 +# http://www.basis.com business-basic-files. +# +0 string \074\074bbx\076\076 BBx +>7 string \000 indexed file +>7 string \001 serial file +>7 string \002 keyed file +>>13 short 0 (sort) +>7 string \004 program +>>18 byte x (LEVEL %d) +>>>23 string >\000 psaved +>7 string \006 mkeyed file +>>13 short 0 (sort) +>>8 string \000 (mkey) diff --git a/usr.bin/file/magdir/bFLT b/usr.bin/file/magdir/bflt index 19f6d50099b..5e288d130b0 100644 --- a/usr.bin/file/magdir/bFLT +++ b/usr.bin/file/magdir/bflt @@ -1,5 +1,3 @@ -# $OpenBSD: bFLT,v 1.1 2004/06/03 03:14:19 tedu Exp $ - #------------------------------------------------------------------------------ # bFLT: file(1) magic for BFLT uclinux binary files # diff --git a/usr.bin/file/magdir/bout b/usr.bin/file/magdir/bout index 67e579f818a..80652d98def 100644 --- a/usr.bin/file/magdir/bout +++ b/usr.bin/file/magdir/bout @@ -1,4 +1,4 @@ -# $OpenBSD: bout,v 1.2 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: bout,v 1.3 2008/05/08 01:40:57 chl Exp $ # # i80960 b.out objects and archives @@ -7,5 +7,5 @@ >16 long >0 not stripped # # b.out archive (hp-rt on i960) -0 string !<bout> b.out archive +0 string =!<bout> b.out archive >8 string __.SYMDEF random library diff --git a/usr.bin/file/magdir/btsnoop b/usr.bin/file/magdir/btsnoop new file mode 100644 index 00000000000..85d867a446d --- /dev/null +++ b/usr.bin/file/magdir/btsnoop @@ -0,0 +1,11 @@ +#------------------------------------------------------------------------------ +# BTSnoop: file(1) magic for BTSnoop files +# +# From <marcel@holtmann.org> +0 string btsnoop\0 BTSnoop +>8 belong x version %d, +>12 belong 1001 Unencapsulated HCI +>12 belong 1002 HCI UART (H4) +>12 belong 1003 HCI BCSP +>12 belong 1004 HCI Serial (H5) +>>12 belong x type %d diff --git a/usr.bin/file/magdir/c-lang b/usr.bin/file/magdir/c-lang index fcfa862180f..c3c1a2188f1 100644 --- a/usr.bin/file/magdir/c-lang +++ b/usr.bin/file/magdir/c-lang @@ -1,4 +1,4 @@ -# $OpenBSD: c-lang,v 1.3 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: c-lang,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # c-lang: file(1) magic for C programs (or REXX) @@ -21,5 +21,5 @@ # The inverted index functionality was added some time betwen # versions 11 and 15, so look for -q if version is above 14: >7 string >14 ->>10 regex .+\ -q\ with inverted index ->10 regex .+\ -c\ text (non-compressed) +>>10 regex .+\ -q\ with inverted index +>10 regex .+\ -c\ text (non-compressed) diff --git a/usr.bin/file/magdir/c64 b/usr.bin/file/magdir/c64 index ba9e57e1c9e..a33c9942920 100644 --- a/usr.bin/file/magdir/c64 +++ b/usr.bin/file/magdir/c64 @@ -1,9 +1,9 @@ -# $OpenBSD: c64,v 1.1 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: c64,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # c64: file(1) magic for various commodore 64 related files # -# From <doj@cubic.org> +# From: Dirk Jagdmann <doj@cubic.org> 0x16500 belong 0x12014100 D64 Image 0x16500 belong 0x12014180 D71 Image @@ -12,7 +12,7 @@ 0 belong 0x43154164 X64 Image 0 string GCR-1541 GCR Image ->8 byte x version: $i +>8 byte x version: %i >9 byte x tracks: %i 9 string PSUR ARC archive (c64) @@ -26,3 +26,18 @@ 0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 0 belong 0xFF424CFF WRAptor packer (c64) + +0 string C64S\x20tape\x20file T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s + +0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s + +0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s diff --git a/usr.bin/file/magdir/cad b/usr.bin/file/magdir/cad index e56a4d7d9b6..5b65ffc3bce 100644 --- a/usr.bin/file/magdir/cad +++ b/usr.bin/file/magdir/cad @@ -1,4 +1,4 @@ -# $OpenBSD: cad,v 1.1 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: cad,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # autocad: file(1) magic for cad files @@ -12,7 +12,7 @@ >5 string \064\000\000\000\000 DWG ver. R14 # Microstation DGN/CIT Files (www.bentley.com) -# Written October 30, 2003 by Lester Hightower +# Last updated July 29, 2005 by Lester Hightower # DGN is the default file extension of Microstation/Intergraph CAD files. # CIT is the proprietary raster format (similar to TIFF) used to attach # raster underlays to Microstation DGN (vector) drawings. @@ -25,13 +25,46 @@ # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 # http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F -0 string \010\011\376 Microstation ->3 string \002 ->>30 string \372\104 DGN File ->>30 string \172\104 DGN File ->>30 string \026\105 DGN File ->4 string \030\000\000 CIT File +0 string \010\011\376 Microstation +>3 string \002 +>>30 string \026\105 DGNFile +>>30 string \034\105 DGNFile +>>30 string \073\107 DGNFile +>>30 string \073\110 DGNFile +>>30 string \106\107 DGNFile +>>30 string \110\103 DGNFile +>>30 string \120\104 DGNFile +>>30 string \172\104 DGNFile +>>30 string \172\105 DGNFile +>>30 string \172\106 DGNFile +>>30 string \234\106 DGNFile +>>30 string \273\105 DGNFile +>>30 string \306\106 DGNFile +>>30 string \310\104 DGNFile +>>30 string \341\104 DGNFile +>>30 string \372\103 DGNFile +>>30 string \372\104 DGNFile +>>30 string \372\106 DGNFile +>>30 string \376\103 DGNFile +>4 string \030\000\000 CITFile +>4 string \030\000\003 CITFile # AutoCad, from Nahuel Greco +# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 0 string AC1012 AutoCad (release 12) +0 string AC1013 AutoCad (release 13) 0 string AC1014 AutoCad (release 14) + +# CAD: file(1) magic for computer aided design files +# Phillip Griffith <phillip dot griffith at gmail dot com> +# AutoCAD magic taken from the Open Design Alliance's OpenDWG specifications. +# +0 belong 0x08051700 Bentley/Intergraph MicroStation DGN cell library +0 belong 0x0809fe02 Bentley/Intergraph MicroStation DGN vector CAD +0 belong 0xc809fe02 Bentley/Intergraph MicroStation DGN vector CAD +0 beshort 0x0809 Bentley/Intergraph MicroStation +>0x02 byte 0xfe +>>0x04 beshort 0x1800 CIT raster CAD +0 string AC1012 AutoDesk AutoCAD R13 +0 string AC1014 AutoDesk AutoCAD R14 +0 string AC1015 AutoDesk AutoCAD R2000 diff --git a/usr.bin/file/magdir/cafebabe b/usr.bin/file/magdir/cafebabe new file mode 100644 index 00000000000..233411c8043 --- /dev/null +++ b/usr.bin/file/magdir/cafebabe @@ -0,0 +1,21 @@ +#------------------------------------------------------------------------------ +# Cafe Babes unite! +# +# Since Java bytecode and Mach-O fat-files have the same magic number, the test +# must be performed in the same "magic" sequence to get both right. The long +# at offset 4 in a mach-O fat file tells the number of architectures; the short at +# offset 4 in a Java bytecode file is the JVM minor version and the +# short at offset 6 is the JVM major version. Since there are only +# only 18 labeled Mach-O architectures at current, and the first released +# Java class format was version 43.0, we can safely choose any number +# between 18 and 39 to test the number of architectures against +# (and use as a hack). Let's not use 18, because the Mach-O people +# might add another one or two as time goes by... +# +0 belong 0xcafebabe +>4 belong >30 compiled Java class data, +>>6 beshort x version %d. +>>4 beshort x \b%d +>4 belong 1 Mach-O fat file with 1 architecture +>4 belong >1 +>>4 belong <20 Mach-O fat file with %ld architectures diff --git a/usr.bin/file/magdir/chi b/usr.bin/file/magdir/chi deleted file mode 100644 index 6b91cf42865..00000000000 --- a/usr.bin/file/magdir/chi +++ /dev/null @@ -1,8 +0,0 @@ -# $OpenBSD: chi,v 1.2 2004/06/03 03:14:19 tedu Exp $ - -#------------------------------------------------------------------------------ -# chi: file(1) magic for ChiWriter files -# -0 string \\1cw\ ChiWriter file ->5 string >\0 version %s -0 string \\1cw ChiWriter file diff --git a/usr.bin/file/magdir/claris b/usr.bin/file/magdir/claris new file mode 100644 index 00000000000..368b473260e --- /dev/null +++ b/usr.bin/file/magdir/claris @@ -0,0 +1,46 @@ + +#------------------------------------------------------------------------------ +# claris: file(1) magic for claris +# "H. Nanosecond" <aldomel@ix.netcom.com> +# Claris Works a word processor, etc. +# Version 3.0 + +# .pct claris works clip art files +#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 +#* +#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000 +#null to byte 1000 octal +514 string \377\377\377\377\000 Claris clip art? +>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes. +514 string \377\377\377\377\001 Claris clip art? +>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes. + +# Claris works files +# .cwk +0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document +# .plt +0 string \020\341\000\000\010\010 Claris Works pallete files .plt + +# .msp a dictionary file I am not sure about this I have only one .msp file +0 string \002\271\262\000\040\002\000\164 Claris works dictionary + +# .usp are user dictionary bits +# I am not sure about a magic header: +#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151 +# soh S p f 8 U D sp ^ S cr nl p o d i +#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043 +# a t r i s t sp ^ S cr nl d i v sp # + +# .mth Thesaurus +# starts with \0 but no magic header + +# .chy Hyphenation file +# I am not sure: 000 210 034 000 000 + +# other claris files +#./windows/claris/useng.ndx: data +#./windows/claris/xtndtran.l32: data +#./windows/claris/xtndtran.lst: data +#./windows/claris/clworks.lbl: data +#./windows/claris/clworks.prf: data +#./windows/claris/userd.spl: data diff --git a/usr.bin/file/magdir/commands b/usr.bin/file/magdir/commands index f9d86514bb5..e03324b7f00 100644 --- a/usr.bin/file/magdir/commands +++ b/usr.bin/file/magdir/commands @@ -1,76 +1,57 @@ -# $OpenBSD: commands,v 1.3 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: commands,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # commands: file(1) magic for various shells and interpreters # -0 string :\ shell archive or commands for antique kernel text -0 string #!/bin/sh Bourne shell script text -0 string #!\ /bin/sh Bourne shell script text -0 string #!/bin/csh C shell script text -0 string #!\ /bin/csh C shell script text +0 string : shell archive or script for antique kernel text +0 string/b #!\ /bin/sh Bourne shell script text executable +0 string/b #!\ /bin/csh C shell script text executable # korn shell magic, sent by George Wu, gwu@clyde.att.com -0 string #!/bin/ksh Korn shell script text -0 string #!\ /bin/ksh Korn shell script text -0 string #!/bin/tcsh Tenex C shell script text -0 string #!\ /bin/tcsh Tenex C shell script text -0 string #!/usr/local/tcsh Tenex C shell script text -0 string #!\ /usr/local/tcsh Tenex C shell script text -0 string #!/usr/local/bin/tcsh Tenex C shell script text -0 string #!\ /usr/local/bin/tcsh Tenex C shell script text +0 string/b #!\ /bin/ksh Korn shell script text executable +0 string/b #!\ /bin/tcsh Tenex C shell script text executable +0 string/b #!\ /usr/local/tcsh Tenex C shell script text executable +0 string/b #!\ /usr/local/bin/tcsh Tenex C shell script text executable + # # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson) -0 string #!/usr/local/bin/zsh Paul Falstad's zsh -0 string #!\ /usr/local/bin/zsh Paul Falstad's zsh -0 string #!/usr/local/bin/ash Neil Brown's ash -0 string #!\ /usr/local/bin/ash Neil Brown's ash -0 string #!/usr/local/bin/ae Neil Brown's ae -0 string #!\ /usr/local/bin/ae Neil Brown's ae -0 string #!/bin/nawk new awk script text -0 string #!\ /bin/nawk new awk script text -0 string #!/usr/bin/nawk new awk script text -0 string #!\ /usr/bin/nawk new awk script text -0 string #!/usr/local/bin/nawk new awk script text -0 string #!\ /usr/local/bin/nawk new awk script text -0 string #!/bin/gawk GNU awk script text -0 string #!\ /bin/gawk GNU awk script text -0 string #!/usr/bin/gawk GNU awk script text -0 string #!\ /usr/bin/gawk GNU awk script text -0 string #!/usr/local/bin/gawk GNU awk script text -0 string #!\ /usr/local/bin/gawk GNU awk script text +0 string/b #!\ /bin/zsh Paul Falstad's zsh script text executable +0 string/b #!\ /usr/bin/zsh Paul Falstad's zsh script text executable +0 string/b #!\ /usr/local/bin/zsh Paul Falstad's zsh script text executable +0 string/b #!\ /usr/local/bin/ash Neil Brown's ash script text executable +0 string/b #!\ /usr/local/bin/ae Neil Brown's ae script text executable +0 string/b #!\ /bin/nawk new awk script text executable +0 string/b #!\ /usr/bin/nawk new awk script text executable +0 string/b #!\ /usr/local/bin/nawk new awk script text executable +0 string/b #!\ /bin/gawk GNU awk script text executable +0 string/b #!\ /usr/bin/gawk GNU awk script text executable +0 string/b #!\ /usr/local/bin/gawk GNU awk script text executable # -0 string #!/bin/awk awk commands text -0 string #!\ /bin/awk awk commands text -0 string #!/usr/bin/awk awk commands text -0 string #!\ /usr/bin/awk awk commands text -0 string BEGIN awk commands text - -# For Larry Wall's perl language. The ``eval'' line recognizes an -# outrageously clever hack for USG systems. -# Keith Waclena <keith@cerberus.uchicago.edu> -0 string #!/bin/perl perl commands text -0 string #!\ /bin/perl perl commands text -0 string eval\ "exec\ /bin/perl perl commands text -0 string #!/usr/bin/perl perl commands text -0 string #!\ /usr/bin/perl perl commands text -0 string eval\ "exec\ /usr/bin/perl perl commands text -0 string #!/usr/local/bin/perl perl commands text -0 string #!\ /usr/local/bin/perl perl commands text -0 string eval\ "exec\ /usr/local/bin/perl perl commands text +0 string/b #!\ /bin/awk awk script text executable +0 string/b #!\ /usr/bin/awk awk script text executable +# update to distinguish from *.vcf files +0 regex BEGIN[[:space:]]*[{] awk script text # AT&T Bell Labs' Plan 9 shell -0 string #!/bin/rc Plan 9 rc shell script text -0 string #!\ /bin/rc Plan 9 rc shell script text +0 string/b #!\ /bin/rc Plan 9 rc shell script text executable # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) -0 string #!/bin/bash Bourne-Again shell script text -0 string #!\ /bin/bash Bourne-Again shell script text -0 string #!/usr/local/bin/bash Bourne-Again shell script text -0 string #!\ /usr/local/bin/bash Bourne-Again shell script text +0 string/b #!\ /bin/bash Bourne-Again shell script text executable +0 string/b #!\ /usr/local/bin/bash Bourne-Again shell script text executable + +# using env +0 string #!/usr/bin/env a +>15 string >\0 %s script text executable +0 string #!\ /usr/bin/env a +>16 string >\0 %s script text executable + +# PHP scripts +# Ulf Harnhammar <ulfh@update.uu.se> +0 string/c =<?php PHP script text +0 string =<?\n PHP script text +0 string =<?\r PHP script text +0 string/b #!\ /usr/local/bin/php PHP script text executable +0 string/b #!\ /usr/bin/php PHP script text executable + +0 string Zend\x00 PHP script Zend Optimizer data -# generic shell magic -0 string #!\ / a ->3 string >\0 %s script text -0 string #!/ a ->2 string >\0 %s script text -0 string #!\ commands text ->3 string >\0 for %s +0 string $! DCL command file diff --git a/usr.bin/file/magdir/communications b/usr.bin/file/magdir/communications new file mode 100644 index 00000000000..81417ec0837 --- /dev/null +++ b/usr.bin/file/magdir/communications @@ -0,0 +1,21 @@ + +#---------------------------------------------------------------------------- +# communication + +# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. +# It is used for conformance testing of communication protocols. +# Added by W. Borgert <debacle@debian.org>. +0 string $Suite TTCN Abstract Test Suite +>&1 string $SuiteId +>>&1 string >\n %s +>&2 string $SuiteId +>>&1 string >\n %s +>&3 string $SuiteId +>>&1 string >\n %s + +# MSC (message sequence charts) are a formal description technique, +# described in ITU-T Z.120, mainly used for communication protocols. +# Added by W. Borgert <debacle@debian.org>. +0 string mscdocument Message Sequence Chart (document) +0 string msc Message Sequence Chart (chart) +0 string submsc Message Sequence Chart (subchart) diff --git a/usr.bin/file/magdir/compress b/usr.bin/file/magdir/compress index 7b85ed9346b..2a6809409ec 100644 --- a/usr.bin/file/magdir/compress +++ b/usr.bin/file/magdir/compress @@ -1,4 +1,4 @@ -# $OpenBSD: compress,v 1.4 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: compress,v 1.5 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # compress: file(1) magic for pure-compression formats (no archives) @@ -23,22 +23,28 @@ >2 byte <8 \b, reserved method >2 byte >8 \b, unknown method >3 byte &0x01 \b, ASCII ->3 byte &0x02 \b, continuation +>3 byte &0x02 \b, has CRC >3 byte &0x04 \b, extra field >3 byte&0xC =0x08 >>10 string x \b, was "%s" ->9 byte =0x00 \b, from MS-DOS +>3 byte &0x10 \b, has comment +>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) >9 byte =0x01 \b, from Amiga >9 byte =0x02 \b, from VMS >9 byte =0x03 \b, from Unix +>9 byte =0x04 \b, from VM/CMS >9 byte =0x05 \b, from Atari ->9 byte =0x06 \b, from OS/2 +>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) >9 byte =0x07 \b, from MacOS ->9 byte =0x0A \b, from Tops/20 ->9 byte =0x0B \b, from Win/32 +>9 byte =0x08 \b, from Z-System +>9 byte =0x09 \b, from CP/M +>9 byte =0x0A \b, from TOPS/20 +>9 byte =0x0B \b, from NTFS filesystem (NT) +>9 byte =0x0C \b, from QDOS +>9 byte =0x0D \b, from Acorn RISCOS >3 byte &0x10 \b, comment >3 byte &0x20 \b, encrypted -### >4 ledate x last modified: %s, +>4 ledate >0 \b, last modified: %s >8 byte 2 \b, max compression >8 byte 4 \b, max speed @@ -162,12 +168,23 @@ >4 belong 0x090A0C0C very good compression >4 belong 0x090A0C0D best compression -# 7z archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) +# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at) # http://www.7-zip.org or DOC/7zFormat.txt # -0 string 7z\274\257\047\034 7z archive data, +0 string 7z\274\257\047\034 7-zip archive data, >6 byte x version %d >7 byte x \b.%d # AFX compressed files (Wolfram Kleff) 2 string -afx- AFX compressed file data + +# Supplementary magic data for the file(1) command to support +# rzip(1). The format is described in magic(5). +# +# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with +# this file. +# +0 string RZIP rzip compressed data +>4 byte x - version %d +>5 byte x \b.%d +>6 belong x (%d bytes) diff --git a/usr.bin/file/magdir/console b/usr.bin/file/magdir/console index 07bf9527cb6..c413d64dcce 100644 --- a/usr.bin/file/magdir/console +++ b/usr.bin/file/magdir/console @@ -1,4 +1,4 @@ -# $OpenBSD: console,v 1.1 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: console,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # Console game magic @@ -155,3 +155,41 @@ # Microsoft Xbox data file formats 0 string XIP0 XIP, Microsoft Xbox data 0 string XTF0 XTF, Microsoft Xbox data + +# Atari Lynx cartridge dump (EXE/BLL header) +# From: "Stefan A. Haubenthal" <polluks@web.de> + +0 beshort 0x8008 Lynx cartridge, +>2 beshort x RAM start $%04x +>6 string BS93 + +# Opera file system that is used on the 3DO console +# From: Serge van den Boom <svdb@stack.nl> +0 string \x01ZZZZZ\x01 3DO "Opera" file system + +# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu +0 string GBS Nintendo Gameboy Music/Audio Data +12 string GameBoy\ Music\ Module Nintendo Gameboy Music Module + +# Playstations Patch Files from: From: Thomas Klausner <tk@giga.or.at> +0 string PPF30 Playstation Patch File version 3.0 +>5 byte 0 \b, PPF 1.0 patch +>5 byte 1 \b, PPF 2.0 patch +>5 byte 2 \b, PPF 3.0 patch +>>56 byte 0 \b, Imagetype BIN (any) +>>56 byte 1 \b, Imagetype GI (PrimoDVD) +>>57 byte 0 \b, Blockcheck disabled +>>57 byte 1 \b, Blockcheck enabled +>>58 byte 0 \b, Undo data not available +>>58 byte 1 \b, Undo data available +>6 string x \b, description: %s + +0 string PPF20 Playstation Patch File version 2.0 +>5 byte 0 \b, PPF 1.0 patch +>5 byte 1 \b, PPF 2.0 patch +>>56 lelong >0 \b, size of file to patch %d +>6 string x \b, description: %s + +0 string PPF10 Playstation Patch File version 1.0 +>5 byte 0 \b, Simple Encoding +>6 string x \b, description: %s diff --git a/usr.bin/file/magdir/cracklib b/usr.bin/file/magdir/cracklib new file mode 100644 index 00000000000..8f7e0d460e5 --- /dev/null +++ b/usr.bin/file/magdir/cracklib @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# cracklib: file (1) magic for cracklib v2.7 + +0 lelong 0x70775631 Cracklib password index, little endian +>4 long >0 (%i words) +>4 long 0 ("64-bit") +>>8 long >-1 (%i words) +0 belong 0x70775631 Cracklib password index, big endian +>4 belong >-1 (%i words) +# really bellong 0x0000000070775631 +4 belong 0x70775631 Cracklib password index, big endian ("64-bit") +>12 belong >0 (%i words) diff --git a/usr.bin/file/magdir/ctags b/usr.bin/file/magdir/ctags index f32a3e420ae..3b64f023ef3 100644 --- a/usr.bin/file/magdir/ctags +++ b/usr.bin/file/magdir/ctags @@ -1,6 +1,6 @@ -# $OpenBSD: ctags,v 1.1 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: ctags,v 1.2 2008/05/08 01:40:57 chl Exp $ # ---------------------------------------------------------------------------- # ctags: file (1) magic for Exuberant Ctags files # From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de> -0 string !_TAG Exuberant Ctags tag file text +0 string =!_TAG Exuberant Ctags tag file text diff --git a/usr.bin/file/magdir/database b/usr.bin/file/magdir/database index f5545ece640..2faf6badb33 100644 --- a/usr.bin/file/magdir/database +++ b/usr.bin/file/magdir/database @@ -1,4 +1,4 @@ -# $OpenBSD: database,v 1.4 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: database,v 1.5 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # database: file(1) magic for various databases @@ -68,6 +68,15 @@ >16 belong >0 (Queue, version %d, big-endian) 12 lelong 0x00042253 Berkeley DB >16 lelong >0 (Queue, version %d, little-endian) + +# From Max Bowsher. +12 long 0x00040988 Berkeley DB +>16 long >0 (Log, version %d, native byte-order) +12 belong 0x00040988 Berkeley DB +>16 belong >0 (Log, version %d, big-endian) +12 lelong 0x00040988 Berkeley DB +>16 lelong >0 (Log, version %d, little-endian) + # # # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> diff --git a/usr.bin/file/magdir/diff b/usr.bin/file/magdir/diff index 61c4359ce95..7e951a1b2a3 100644 --- a/usr.bin/file/magdir/diff +++ b/usr.bin/file/magdir/diff @@ -1,4 +1,4 @@ -# $OpenBSD: diff,v 1.2 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: diff,v 1.3 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # diff: file(1) magic for diff(1) output @@ -7,3 +7,5 @@ 0 string ***\ 'diff' output text 0 string Only\ in\ 'diff' output text 0 string Common\ subdirectories:\ 'diff' output text + +0 string Index: RCS/CVS diff output text diff --git a/usr.bin/file/magdir/digital b/usr.bin/file/magdir/digital index 3686aaf163d..5e885719df6 100644 --- a/usr.bin/file/magdir/digital +++ b/usr.bin/file/magdir/digital @@ -1,8 +1,8 @@ -# $OpenBSD: digital,v 1.3 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: digital,v 1.4 2008/05/08 01:40:57 chl Exp $ # Digital UNIX - Info # -0 string !<arch>\n________64E Alpha archive +0 string =!<arch>\n________64E Alpha archive >22 string X -- out of date # # Alpha COFF Based Executables @@ -34,7 +34,7 @@ 0 string \033c\033 LN03 output 0 long 04553207 X image # -0 string !<PDF>!\n profiling data file +0 string =!<PDF>!\n profiling data file # # Locale data tables (MIPS and Alpha). # diff --git a/usr.bin/file/magdir/dump b/usr.bin/file/magdir/dump index 763007c4551..57af29eb764 100644 --- a/usr.bin/file/magdir/dump +++ b/usr.bin/file/magdir/dump @@ -1,4 +1,4 @@ -# $OpenBSD: dump,v 1.3 2004/06/03 03:14:19 tedu Exp $ +# $OpenBSD: dump,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # dump: file(1) magic for dump file format--for new and old dump filesystems @@ -80,3 +80,15 @@ >760 string >\0 Device %s, >824 string >\0 Host %s, >888 lelong >0 Flags %x + +18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), +>2 medate x Previous dump %s, +>6 medate x This dump %s, +>10 leshort >0 Volume %ld, +>0 leshort 1 tape header. +>0 leshort 2 beginning of file record. +>0 leshort 3 map of inodes on tape. +>0 leshort 4 continuation of file record. +>0 leshort 5 end of volume. +>0 leshort 6 map of inodes deleted. +>0 leshort 7 end of medium (for floppy). diff --git a/usr.bin/file/magdir/editors b/usr.bin/file/magdir/editors index 21b23f09204..116e0ccc5b0 100644 --- a/usr.bin/file/magdir/editors +++ b/usr.bin/file/magdir/editors @@ -1,4 +1,4 @@ -# $OpenBSD: editors,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: editors,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # T602 editor documents @@ -12,3 +12,7 @@ # Vi IMproved Encrypted file # by David Necas <yeti@physics.muni.cz> 0 string VimCrypt~ Vim encrypted file data +# Vi IMproved Swap file +# by Sven Wegener <swegener@gentoo.org> +0 string b0VIM\ Vim swap file +>&0 string >\0 \b, version %s diff --git a/usr.bin/file/magdir/elf b/usr.bin/file/magdir/elf index 6783a3e4921..304d27a85ac 100644 --- a/usr.bin/file/magdir/elf +++ b/usr.bin/file/magdir/elf @@ -1,4 +1,4 @@ -# $OpenBSD: elf,v 1.15 2006/10/12 03:32:32 drahn Exp $ +# $OpenBSD: elf,v 1.16 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # elf: file(1) magic for ELF executables @@ -6,7 +6,6 @@ # We have to check the byte order flag to see what byte order all the # other stuff in the header is in. # -# MIPS RS3000 may also be for MIPS RS2000. # What're the correct byte orders for the nCUBE and the Fujitsu VPP500? # # updated by Daniel Quinlan (quinlan@yggdrasil.com) @@ -20,57 +19,91 @@ >>16 leshort 1 relocatable, >>16 leshort 2 executable, >>16 leshort 3 shared object, -# only for MIPS ->>18 leshort 8 -# only for 32-bit ->>>4 byte 1 ->>>>36 lelong&0xf0000000 0x00000000 MIPS-I, ->>>>36 lelong&0xf0000000 0x10000000 MIPS-II, ->>>>36 lelong&0xf0000000 0x20000000 MIPS-III, ->>>>36 lelong&0xf0000000 0x30000000 MIPS-IV, ->>>>36 lelong&0xf0000000 0x40000000 MIPS-V, ->>>>36 lelong&0xf0000000 0x60000000 MIPS32, ->>>>36 lelong&0xf0000000 0x70000000 MIPS64, ->>>>36 lelong&0xf0000000 0x80000000 MIPS32 rel2, ->>>>36 lelong&0xf0000000 0x90000000 MIPS64 rel2, -# only for 64-bit ->>>4 byte 2 ->>>>48 lelong&0xf0000000 0x00000000 MIPS-I, ->>>>48 lelong&0xf0000000 0x10000000 MIPS-II, ->>>>48 lelong&0xf0000000 0x20000000 MIPS-III, ->>>>48 lelong&0xf0000000 0x30000000 MIPS-IV, ->>>>48 lelong&0xf0000000 0x40000000 MIPS-V, ->>>>48 lelong&0xf0000000 0x60000000 MIPS32, ->>>>48 lelong&0xf0000000 0x70000000 MIPS64 , ->>>>48 lelong&0xf0000000 0x80000000 MIPS32 rel2, ->>>>48 lelong&0xf0000000 0x90000000 MIPS64 rel2, # Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> +# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> >>16 leshort 4 core file ->>>400 lelong >0 (signal %d), +# Core file detection is not reliable. +#>>>(0x38+0xcc) string >\0 of '%s' +#>>>(0x38+0x10) lelong >0 (signal %d), >>16 leshort &0xff00 processor-specific, >>18 leshort 0 no machine, >>18 leshort 1 AT&T WE32100 - invalid byte order, >>18 leshort 2 SPARC - invalid byte order, >>18 leshort 3 Intel 80386, ->>18 leshort 4 Motorola 68000 - invalid byte order, +>>18 leshort 4 Motorola +>>>36 lelong &0x01000000 68000 - invalid byte order, +>>>36 lelong &0x00810000 CPU32 - invalid byte order, +>>>36 lelong 0 68020 - invalid byte order, >>18 leshort 5 Motorola 88000 - invalid byte order, >>18 leshort 6 Intel 80486, >>18 leshort 7 Intel 80860, -# >>18 leshort 8 MIPS, +# The official e_machine number for MIPS is now #8, regardless of endianness. +# The second number (#10) will be deprecated later. For now, we still +# say something if #10 is encountered, but only gory details for #8. +>>18 leshort 8 MIPS, +>>>36 lelong &0x20 N32 +>>18 leshort 10 MIPS, +>>>36 lelong &0x20 N32 +>>18 leshort 8 +# only for 32-bit +>>>4 byte 1 +>>>>36 lelong&0xf0000000 0x00000000 MIPS-I +>>>>36 lelong&0xf0000000 0x10000000 MIPS-II +>>>>36 lelong&0xf0000000 0x20000000 MIPS-III +>>>>36 lelong&0xf0000000 0x30000000 MIPS-IV +>>>>36 lelong&0xf0000000 0x40000000 MIPS-V +>>>>36 lelong&0xf0000000 0x60000000 MIPS32 +>>>>36 lelong&0xf0000000 0x70000000 MIPS64 +>>>>36 lelong&0xf0000000 0x80000000 MIPS32 rel2 +>>>>36 lelong&0xf0000000 0x90000000 MIPS64 rel2 +# only for 64-bit +>>>4 byte 2 +>>>>48 lelong&0xf0000000 0x00000000 MIPS-I +>>>>48 lelong&0xf0000000 0x10000000 MIPS-II +>>>>48 lelong&0xf0000000 0x20000000 MIPS-III +>>>>48 lelong&0xf0000000 0x30000000 MIPS-IV +>>>>48 lelong&0xf0000000 0x40000000 MIPS-V +>>>>48 lelong&0xf0000000 0x60000000 MIPS32 +>>>>48 lelong&0xf0000000 0x70000000 MIPS64 +>>>>48 lelong&0xf0000000 0x80000000 MIPS32 rel2 +>>>>48 lelong&0xf0000000 0x90000000 MIPS64 rel2 >>18 leshort 9 Amdahl - invalid byte order, >>18 leshort 10 MIPS (deprecated), >>18 leshort 11 RS6000 - invalid byte order, >>18 leshort 15 PA-RISC - invalid byte order, +>>>50 leshort 0x0214 2.0 +>>>48 leshort &0x0008 (LP64), >>18 leshort 16 nCUBE, ->>18 leshort 17 VPP500, +>>18 leshort 17 Fujitsu VPP500, >>18 leshort 18 SPARC32PLUS, >>18 leshort 20 PowerPC, +>>18 leshort 22 IBM S/390, +>>18 leshort 36 NEC V800, +>>18 leshort 37 Fujitsu FR20, +>>18 leshort 38 TRW RH-32, +>>18 leshort 39 Motorola RCE, >>18 leshort 40 ARM, ->>18 leshort 42 SH ->>18 leshort 43 SPARC64 - invalid byte order, ->>18 leshort 62 AMD64, ->>18 leshort 75 VAX, ->>18 leshort 0x9026 Alpha, +>>18 leshort 41 Alpha, +>>18 leshort 0xa390 IBM S/390 (obsolete), +>>18 leshort 42 Renesas SH, +>>18 leshort 43 SPARC V9 - invalid byte order, +>>18 leshort 44 Siemens Tricore Embedded Processor, +>>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., +>>18 leshort 46 Renesas H8/300, +>>18 leshort 47 Renesas H8/300H, +>>18 leshort 48 Renesas H8S, +>>18 leshort 49 Renesas H8/500, +>>18 leshort 50 IA-64, +>>18 leshort 51 Stanford MIPS-X, +>>18 leshort 52 Motorola Coldfire, +>>18 leshort 53 Motorola M68HC12, +>>18 leshort 62 x86-64, +>>18 leshort 75 Digital VAX, +>>18 leshort 88 Renesas M32R, +>>18 leshort 94 Tensilica Xtensa, +>>18 leshort 97 NatSemi 32k, +>>18 leshort 106 Analog Devices Blackfin, +>>18 leshort 0x9026 Alpha (unofficial), >>20 lelong 0 invalid version >>20 lelong 1 version 1 >>36 lelong 1 MathCoPro/FPU/MAU Required @@ -79,56 +112,93 @@ >>16 beshort 1 relocatable, >>16 beshort 2 executable, >>16 beshort 3 shared object, -# only for MIPS ->>18 beshort 8 -# only for 32-bit ->>>4 byte 1 ->>>>36 belong&0xf0000000 0x00000000 MIPS-I, ->>>>36 belong&0xf0000000 0x10000000 MIPS-II, ->>>>36 belong&0xf0000000 0x20000000 MIPS-III, ->>>>36 belong&0xf0000000 0x30000000 MIPS-IV, ->>>>36 belong&0xf0000000 0x40000000 MIPS-V, ->>>>36 belong&0xf0000000 0x60000000 MIPS32, ->>>>36 belong&0xf0000000 0x70000000 MIPS64, ->>>>36 belong&0xf0000000 0x80000000 MIPS32 rel2, ->>>>36 belong&0xf0000000 0x90000000 MIPS64 rel2, -# only for 64-bit ->>>4 byte 2 ->>>>48 belong&0xf0000000 0x00000000 MIPS-I, ->>>>48 belong&0xf0000000 0x10000000 MIPS-II, ->>>>48 belong&0xf0000000 0x20000000 MIPS-III, ->>>>48 belong&0xf0000000 0x30000000 MIPS-IV, ->>>>48 belong&0xf0000000 0x40000000 MIPS-V, ->>>>48 belong&0xf0000000 0x60000000 MIPS32, ->>>>48 belong&0xf0000000 0x70000000 MIPS64 , ->>>>48 belong&0xf0000000 0x80000000 MIPS32 rel2, ->>>>48 belong&0xf0000000 0x90000000 MIPS64 rel2, >>16 beshort 4 core file, ->>>400 lelong >0 (signal %d), +#>>>(0x38+0xcc) string >\0 of '%s' +#>>>(0x38+0x10) belong >0 (signal %d), >>16 beshort &0xff00 processor-specific, >>18 beshort 0 no machine, >>18 beshort 1 AT&T WE32100, >>18 beshort 2 SPARC, >>18 beshort 3 Intel 80386 - invalid byte order, ->>18 beshort 4 Motorola 68000, +>>18 beshort 4 Motorola +>>>36 belong &0x01000000 68000, +>>>36 belong &0x00810000 CPU32, +>>>36 belong 0 68020, >>18 beshort 5 Motorola 88000, >>18 beshort 6 Intel 80486 - invalid byte order, >>18 beshort 7 Intel 80860, -# >>18 beshort 8 MIPS, +# only for MIPS - see comment in little-endian section above. +>>18 beshort 8 MIPS, +>>>36 belong &0x20 N32 +>>18 beshort 10 MIPS, +>>>36 belong &0x20 N32 +>>18 beshort 8 +# only for 32-bit +>>>4 byte 1 +>>>>36 belong&0xf0000000 0x00000000 MIPS-I +>>>>36 belong&0xf0000000 0x10000000 MIPS-II +>>>>36 belong&0xf0000000 0x20000000 MIPS-III +>>>>36 belong&0xf0000000 0x30000000 MIPS-IV +>>>>36 belong&0xf0000000 0x40000000 MIPS-V +>>>>36 belong&0xf0000000 0x60000000 MIPS32 +>>>>36 belong&0xf0000000 0x70000000 MIPS64 +>>>>36 belong&0xf0000000 0x80000000 MIPS32 rel2 +>>>>36 belong&0xf0000000 0x90000000 MIPS64 rel2 +# only for 64-bit +>>>4 byte 2 +>>>>48 belong&0xf0000000 0x00000000 MIPS-I +>>>>48 belong&0xf0000000 0x10000000 MIPS-II +>>>>48 belong&0xf0000000 0x20000000 MIPS-III +>>>>48 belong&0xf0000000 0x30000000 MIPS-IV +>>>>48 belong&0xf0000000 0x40000000 MIPS-V +>>>>48 belong&0xf0000000 0x60000000 MIPS32 +>>>>48 belong&0xf0000000 0x70000000 MIPS64 +>>>>48 belong&0xf0000000 0x80000000 MIPS32 rel2 +>>>>48 belong&0xf0000000 0x90000000 MIPS64 rel2 >>18 beshort 9 Amdahl, >>18 beshort 10 MIPS (deprecated), >>18 beshort 11 RS6000, ->>18 beshort 15 PA-RISC, +>>18 beshort 15 PA-RISC +>>>50 beshort 0x0214 2.0 +>>>48 beshort &0x0008 (LP64) >>18 beshort 16 nCUBE, ->>18 beshort 17 VPP500, +>>18 beshort 17 Fujitsu VPP500, >>18 beshort 18 SPARC32PLUS, ->>18 beshort 20 PowerPC, +>>>36 belong&0xffff00 &0x000100 V8+ Required, +>>>36 belong&0xffff00 &0x000200 Sun UltraSPARC1 Extensions Required, +>>>36 belong&0xffff00 &0x000400 HaL R1 Extensions Required, +>>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required, +>>18 beshort 20 PowerPC or cisco 4500, +>>18 beshort 21 64-bit PowerPC or cisco 7500, +>>18 beshort 22 IBM S/390, +>>18 beshort 23 Cell SPU, +>>18 beshort 24 cisco SVIP, +>>18 beshort 25 cisco 7200, +>>18 beshort 36 NEC V800 or cisco 12000, +>>18 beshort 37 Fujitsu FR20, +>>18 beshort 38 TRW RH-32, +>>18 beshort 39 Motorola RCE, >>18 beshort 40 ARM, ->>18 beshort 42 SH - invalid byte order, ->>18 beshort 43 SPARC64, ->>18 beshort 62 AMD64 - invalid byte order, ->>18 beshort 75 VAX - invalid byte order, ->>18 beshort 0x9026 Alpha, +>>18 beshort 41 Alpha, +>>18 beshort 42 Renesas SH, +>>18 beshort 43 SPARC V9, +>>18 beshort 44 Siemens Tricore Embedded Processor, +>>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc., +>>18 beshort 46 Renesas H8/300, +>>18 beshort 47 Renesas H8/300H, +>>18 beshort 48 Renesas H8S, +>>18 beshort 49 Renesas H8/500, +>>18 beshort 50 IA-64, +>>18 beshort 51 Stanford MIPS-X, +>>18 beshort 52 Motorola Coldfire, +>>18 beshort 53 Motorola M68HC12, +>>18 beshort 73 Cray NV1, +>>18 beshort 75 Digital VAX, +>>18 beshort 88 Renesas M32R, +>>18 beshort 94 Tensilica Xtensa, +>>18 beshort 97 NatSemi 32k, +>>18 beshort 0x9026 Alpha (unofficial), +>>18 beshort 0xa390 IBM S/390 (obsolete), >>20 belong 0 invalid version >>20 belong 1 version 1 >>36 belong 1 MathCoPro/FPU/MAU Required diff --git a/usr.bin/file/magdir/esri b/usr.bin/file/magdir/esri new file mode 100644 index 00000000000..35c34923e05 --- /dev/null +++ b/usr.bin/file/magdir/esri @@ -0,0 +1,27 @@ + +#------------------------------------------------------------------------------ +# ESRI Shapefile format (.shp .shx .dbf=DBaseIII) +# Based on info from +# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf> +0 belong 9994 ESRI Shapefile +>4 belong =0 +>8 belong =0 +>12 belong =0 +>16 belong =0 +>20 belong =0 +>28 lelong x version %d +>24 belong x length %d +>32 lelong =0 type Null Shape +>32 lelong =1 type Point +>32 lelong =3 type PolyLine +>32 lelong =5 type Polygon +>32 lelong =8 type MultiPoint +>32 lelong =11 type PointZ +>32 lelong =13 type PolyLineZ +>32 lelong =15 type PolygonZ +>32 lelong =18 type MultiPointZ +>32 lelong =21 type PointM +>32 lelong =23 type PolyLineM +>32 lelong =25 type PolygonM +>32 lelong =28 type MultiPointM +>32 lelong =31 type MultiPatch diff --git a/usr.bin/file/magdir/filesystems b/usr.bin/file/magdir/filesystems index 41ecbb09100..59318f5b92e 100644 --- a/usr.bin/file/magdir/filesystems +++ b/usr.bin/file/magdir/filesystems @@ -1,4 +1,4 @@ -# $OpenBSD: filesystems,v 1.2 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: filesystems,v 1.3 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # filesystems: file(1) magic for different filesystems @@ -6,33 +6,689 @@ 0 string \366\366\366\366 PC formatted floppy with no filesystem # Sun disk labels # From /usr/include/sun/dklabel.h: -0774 beshort 0xdabe Sun disk label ->0 string x '%s ->>31 string >\0 \b%s ->>>63 string >\0 \b%s ->>>>95 string >\0 \b%s ->0 string x \b' ->0734 short >0 %d rpm, ->0736 short >0 %d phys cys, ->0740 short >0 %d alts/cyl, ->0746 short >0 %d interleave, ->0750 short >0 %d data cyls, ->0752 short >0 %d alt cyls, ->0754 short >0 %d heads/partition, ->0756 short >0 %d sectors/track, ->0764 long >0 start cyl %ld, ->0770 long x %ld blocks +0774 beshort 0xdabe +# modified by Joerg Jenderek, because original test +# succeeds for Cabinet archive dao360.dl_ with negative blocks +>0770 long >0 Sun disk label +>>0 string x '%s +>>>31 string >\0 \b%s +>>>>63 string >\0 \b%s +>>>>>95 string >\0 \b%s +>>0 string x \b' +>>0734 short >0 %d rpm, +>>0736 short >0 %d phys cys, +>>0740 short >0 %d alts/cyl, +>>0746 short >0 %d interleave, +>>0750 short >0 %d data cyls, +>>0752 short >0 %d alt cyls, +>>0754 short >0 %d heads/partition, +>>0756 short >0 %d sectors/track, +>>0764 long >0 start cyl %ld, +>>0770 long x %ld blocks # Is there a boot block written 1 sector in? >512 belong&077777777 0600407 \b, boot block present +# Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc +# (http://btmgr.sourceforge.net/docs/user-guide-3.html) +0 string SBMBAKUP_ Smart Boot Manager backup file +>9 string x \b, version %-5.5s +>>14 string =_ +>>>15 string x %-.1s +>>>>16 string =_ \b. +>>>>>17 string x \b%-.1s +>>>>>>18 string =_ \b. +>>>>>>>19 string x \b%-.1s +>>>22 ubyte 0 +>>>>21 ubyte x \b, from drive 0x%x +>>>22 ubyte >0 +>>>>21 string x \b, from drive %s + +# Joerg Jenderek +# DOS Emulator image is 128 byte, null right padded header + harddisc image +0 string DOSEMU\0 +>0x27E leshort 0xAA55 +#offset is 128 +>>19 ubyte 128 +>>>(19.b-1) ubyte 0x0 DOS Emulator image +>>>>7 ulelong >0 \b, %u heads +>>>>11 ulelong >0 \b, %d sectors/track +>>>>15 ulelong >0 \b, %d cylinders + 0x1FE leshort 0xAA55 x86 boot sector >2 string OSBS \b, OS/BS MBR -# J\xf6rg Jenderek <joerg.jenderek@gmx.net> +# J\xf6rg Jenderek <joerg dot jenderek at web dot de> >0x8C string Invalid\ partition\ table \b, MS-DOS MBR ->0x9D string Invalid\ partition\ table \b, DR-DOS MBR, version 7.01 to 7.03 +# dr-dos with some upper-, lowercase variants +>0x9D string Invalid\ partition\ table$ +>>181 string No\ Operating\ System$ +>>>201 string Operating\ System\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 +>0x9D string Invalid\ partition\ table$ +>>181 string No\ operating\ system$ +>>>201 string Operating\ system\ load\ error$ \b, DR-DOS MBR, Version 7.01 to 7.03 +>342 string Invalid\ partition\ table$ +>>366 string No\ operating\ system$ +>>>386 string Operating\ system\ load\ error$ \b, DR-DOS MBR, version 7.01 to 7.03 +>295 string NEWLDR\0 +>>302 string Bad\ PT\ $ +>>>310 string No\ OS\ $ +>>>>317 string OS\ load\ err$ +>>>>>329 string Moved\ or\ missing\ IBMBIO.LDR\n\r +>>>>>>358 string Press\ any\ key\ to\ continue.\n\r$ +>>>>>>>387 string Copyright\ (c)\ 1984,1998 +>>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222 +>>0x1B8 ubelong >0 \b, Serial 0x%-.4x >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 ->0x145 string Default:\ F \b, FREE-DOS MBR ->0 string \0\0\0\0 \b, extended partition table +>271 string Invalid\ partition\ table\0 +>>295 string Error\ loading\ operating\ system\0 +>>>326 string Missing\ operating\ system\0 \b, mbr +# +>139 string Invalid\ partition\ table\0 +>>163 string Error\ loading\ operating\ system\0 +>>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr +# http://www.heise.de/ct/05/09/006/ page 184 +#HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes +>>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x +>300 string Invalid\ partition\ table\0 +>>324 string Error\ loading\ operating\ system\0 +>>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR +#??>>>389 string Invalid\ system\ disk +>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x +>300 string Ung\201ltige\ Partitionstabelle +#split string to avoid error: String too long +>>328 string Fehler\ beim\ Laden\ +>>>346 string des\ Betriebssystems +>>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german) +>>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x +>0x145 string Default:\ F \b, FREE-DOS MBR +>64 string no\ active\ partition\ found +>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR +>271 string Operating\ system\ loading +>>296 string error\r \b, SYSLINUX MBR (2.10) +# http://www.acronis.de/ +>362 string MBR\ Error\ \0\r +>>376 string ress\ any\ key\ to\ +>>>392 string boot\ from\ floppy...\0 \b, Acronis MBR +# added by Joerg Jenderek +# http://www.visopsys.org/ +# http://partitionlogic.org.uk/ +>309 string No\ bootable\ partition\ found\r +>>339 string I/O\ Error\ reading\ boot\ sector\r \b, Visopsys MBR +>349 string No\ bootable\ partition\ found\r +>>379 string I/O\ Error\ reading\ boot\ sector\r \b, simple Visopsys MBR +# bootloader, bootmanager +>0x40 string SBML +# label with 11 characters of FAT 12 bit filesystem +>>43 string SMART\ BTMGR +>>>430 string SBMK\ Bad!\r +>>>>3 string SBM \b, Smart Boot Manager +>>>>>6 string >\0 \b, version %s +>382 string XOSLLOADXCF \b, eXtended Operating System Loader +>6 string LILO \b, LInux i386 boot LOader +>>120 string LILO \b, version 22.3.4 SuSe +>>172 string LILO \b, version 22.5.8 Debian +# updated by Joerg Jenderek +# variables according to grub-0.97/stage1/stage1.S or +# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data +# usual values are marked with comments to get only informations of strange GRUB loaders +>0 ulelong 0x009048EB +>>0x41 ubyte <2 +>>>0x3E ubyte >2 \b; GRand Unified Bootloader +# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 +>>>>0x3E ubyte x \b, stage1 version 0x%x +#If it is 0xFF, use a drive passed by BIOS +>>>>0x40 ubyte <0xFF \b, boot drive 0x%x +# in most case 0,1,0x2e for GRUB 0.5.95 +>>>>0x41 ubyte >0 \b, LBA flag 0x%x +>>>>0x42 uleshort <0x8000 \b, stage2 address 0x%x +#>>>>0x42 uleshort =0x8000 \b, stage2 address 0x%x (usual) +>>>>0x42 uleshort >0x8000 \b, stage2 address 0x%x +#>>>>0x44 ulelong =1 \b, 1st sector stage2 0x%x (default) +>>>>0x44 ulelong >1 \b, 1st sector stage2 0x%x +>>>>0x48 uleshort <0x800 \b, stage2 segment 0x%x +#>>>>0x48 uleshort =0x800 \b, stage2 segment 0x%x (usual) +>>>>0x48 uleshort >0x800 \b, stage2 segment 0x%x +>>>>402 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>>394 string stage1 \b, GRUB version 0.5.95 +>>>>382 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>>376 string GRUB\ \0 \b, GRUB version 0.93 or 1.94 +>>>>383 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>>377 string GRUB\ \0 \b, GRUB version 0.94 +>>>>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>>379 string GRUB\ \0 \b, GRUB version 0.95 or 0.96 +>>>>391 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>>385 string GRUB\ \0 \b, GRUB version 0.97 +#unkown version +>>>343 string Geom\0Read\0\ Error\0 +>>>>321 string Loading\ stage1.5 \b, GRUB version x.y +>>>380 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>>>374 string GRUB\ \0 \b, GRUB version n.m +# http://syslinux.zytor.com/ +>478 string Boot\ failed\r +>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (1.62) +>480 string Boot\ failed\r +>>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06 or 2.11) +>484 string Boot\ error\r \b, SYSLINUX bootloader (3.11) +>395 string chksum\0\ ERROR!\0 \b, Gujin bootloader +# http://www.bcdwb.de/bcdw/index_e.htm +>3 string BCDL +>>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) +# mbr partion table entries +# OEM-ID not Microsoft,SYSLINUX,or MTOOLs +>3 string !MS +>>3 string !SYSLINUX +>>>3 string !MTOOL +# not FAT (32 bit) +>>>>82 string !FAT32 +#not IO.SYS +>>>>>472 string !IO\ \ \ \ \ \ SYS +#not Linux kernel +>>>>>>514 string !HdrS +# active flag 0 or 0x80 and type > 0 +>>>>>>>446 ubyte <0x81 +>>>>>>>>446 ubyte&0x7F 0 +>>>>>>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x +>>>>>>>>>>446 ubyte 0x80 \b, active +>>>>>>>>>>447 ubyte x \b, starthead %u +#>>>>>>>>>>448 ubyte x \b, start C_S: 0x%x +#>>>>>>>>>>448 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>>>>454 ulelong x \b, startsector %u +>>>>>>>>>>458 ulelong x \b, %u sectors +# +>>>>>>>462 ubyte <0x81 +>>>>>>>>462 ubyte&0x7F 0 +>>>>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x +>>>>>>>>>>462 ubyte 0x80 \b, active +>>>>>>>>>>463 ubyte x \b, starthead %u +#>>>>>>>>>>464 ubyte x \b, start C_S: 0x%x +#>>>>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>>>>470 ulelong x \b, startsector %u +>>>>>>>>>>474 ulelong x \b, %u sectors +# +>>>>>>>478 ubyte <0x81 +>>>>>>>>478 ubyte&0x7F 0 +>>>>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x +>>>>>>>>>>478 ubyte 0x80 \b, active +>>>>>>>>>>479 ubyte x \b, starthead %u +#>>>>>>>>>>480 ubyte x \b, start C_S: 0x%x +#>>>>>>>>>>481 ubyte x \b, start C2S: 0x%x +#>>>>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>>>>486 ulelong x \b, startsector %u +>>>>>>>>>>490 ulelong x \b, %u sectors +# +>>>>>>>494 ubyte <0x81 +>>>>>>>>494 ubyte&0x7F 0 +>>>>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x +>>>>>>>>>>494 ubyte 0x80 \b, active +>>>>>>>>>>495 ubyte x \b, starthead %u +#>>>>>>>>>>496 ubyte x \b, start C_S: 0x%x +#>>>>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>>>>502 ulelong x \b, startsector %u +>>>>>>>>>>506 ulelong x \b, %u sectors +# mbr partion table entries end +# http://www.acronis.de/ +#FAT label=ACRONIS\ SZ +#OEM-ID=BOOTWIZ0 +>442 string Non-system\ disk,\ +>>459 string press\ any\ key...\x7\0 \b, Acronis Startup Recovery Loader +# DOS names like F11.SYS are 8 right space padded bytes+3 bytes +>>>477 ubyte&0xDF >0 +>>>>477 string x \b %-.3s +>>>>>480 ubyte&0xDF >0 +>>>>>>480 string x \b%-.5s +>>>>485 ubyte&0xDF >0 +>>>>>485 string x \b.%-.3s +# +>185 string FDBOOT\ Version\ +>>204 string \rNo\ Systemdisk.\ +>>>220 string Booting\ from\ harddisk.\n\r +>>>245 string Cannot\ load\ from\ harddisk.\n\r +>>>>273 string Insert\ Systemdisk\ +>>>>>291 string and\ press\ any\ key.\n\r \b, FDBOOT harddisk Bootloader +>>>>>>200 string >\0 \b, version %-3s +>242 string Bootsector\ from\ C.H.\ Hochst\204 +>>278 string No\ Systemdisk.\ +>>>293 string Booting\ from\ harddisk.\n\r +>>>441 string Cannot\ load\ from\ harddisk.\n\r +>>>>469 string Insert\ Systemdisk\ +>>>>>487 string and\ press\ any\ key.\n\r \b, WinImage harddisk Bootloader +>>>>>>209 string >\0 \b, version %-4.4s +>(1.b+2) ubyte 0xe +>>(1.b+3) ubyte 0x1f +>>>(1.b+4) ubyte 0xbe +>>>>(1.b+5) ubyte 0x77 +>>>>(1.b+6) ubyte 0x7c +>>>>>(1.b+7) ubyte 0xac +>>>>>>(1.b+8) ubyte 0x22 +>>>>>>>(1.b+9) ubyte 0xc0 +>>>>>>>>(1.b+10) ubyte 0x74 +>>>>>>>>>(1.b+11) ubyte 0xb +>>>>>>>>>>(1.b+12) ubyte 0x56 +>>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display +>103 string This\ is\ not\ a\ bootable\ disk.\ +>>132 string Please\ insert\ a\ bootable\ +>>>157 string floppy\ and\r\n +>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display +# +>66 string Solaris\ Boot\ Sector +>>99 string Incomplete\ MDBoot\ load. +>>>89 string Version \b, Sun Solaris Bootloader +>>>>97 byte x version %c +# +>408 string OS/2\ !!\ SYS01475\r\0 +>>429 string OS/2\ !!\ SYS02025\r\0 +>>>450 string OS/2\ !!\ SYS02027\r\0 +>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader +# +>409 string OS/2\ !!\ SYS01475\r\0 +>>430 string OS/2\ !!\ SYS02025\r\0 +>>>451 string OS/2\ !!\ SYS02027\r\0 +>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader +>112 string This\ disk\ is\ not\ bootable\r +>>142 string If\ you\ wish\ to\ make\ it\ bootable +>>>176 string run\ the\ DOS\ program\ SYS\ +>>>200 string after\ the\r +>>>>216 string system\ has\ been\ loaded\r\n +>>>>>242 string Please\ insert\ a\ DOS\ diskette\ +>>>>>271 string into\r\n\ the\ drive\ and\ +>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display +# XP +>430 string NTLDR\ is\ missing\xFF\r\n +>>449 string Disk\ error\xFF\r\n +>>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader +# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# +>430 string NTLDR\ nicht\ gefunden\xFF\r\n +>>453 string Datentr\204gerfehler\xFF\r\n +>>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# offset variant +>>>>379 string \0 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +# +>430 string NTLDR\ fehlt\xFF\r\n +>>444 string Datentr\204gerfehler\xFF\r\n +>>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# variant +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# +>430 string NTLDR\ fehlt\xFF\r\n +>>444 string Medienfehler\xFF\r\n +>>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# variant +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# +>430 string Datentr\204ger\ entfernen\xFF\r\n +>>454 string Medienfehler\xFF\r\n +>>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) +>>>>368 ubyte&0xDF >0 +>>>>>368 string x %-.5s +>>>>>>373 ubyte&0xDF >0 +>>>>>>>373 string x \b%-.3s +>>>>>376 ubyte&0xDF >0 +>>>>>>376 string x \b.%-.3s +#>3 string NTFS\ \ \ \ +>389 string Fehler\ beim\ Lesen\ +>>407 string des\ Datentr\204gers +>>>426 string NTLDR\ fehlt +>>>>440 string NTLDR\ ist\ komprimiert +>>>>>464 string Neustart\ mit\ Strg+Alt+Entf\r \b, Microsoft Windows XP Bootloader NTFS (german) +#>3 string NTFS\ \ \ \ +>313 string A\ disk\ read\ error\ occurred.\r +>>345 string A\ kernel\ file\ is\ missing\ +>>>370 string from\ the\ disk.\r +>>>>484 string NTLDR\ is\ compressed +>>>>>429 string Insert\ a\ system\ diskette\ +>>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS +# DOS loader variants different languages,offsets +>472 ubyte&0xDF >0 +>>389 string Invalid\ system\ disk\xFF\r\n +>>>411 string Disk\ I/O\ error +>>>>428 string Replace\ the\ disk,\ and\ +>>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader +#IO.SYS +>>>>>>472 ubyte&0xDF >0 +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.5s +>>>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>>>479 string x \b%-.1s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s +# +>>390 string Invalid\ system\ disk\xFF\r\n +>>>412 string Disk\ I/O\ error\xFF\r\n +>>>>429 string Replace\ the\ disk,\ and\ +>>>>>451 string then\ press\ any\ key\r \b, Microsoft Windows 98 Bootloader +>>388 string Ungueltiges\ System\ \xFF\r\n +>>>410 string E/A-Fehler\ \ \ \ \xFF\r\n +>>>>427 string Datentraeger\ wechseln\ und\ +>>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) +#WINBOOT.SYS only not spaces (0xDF) +>>>>>>497 ubyte&0xDF >0 +>>>>>>>497 string x %-.5s +>>>>>>>>502 ubyte&0xDF >0 +>>>>>>>>>502 string x \b%-.1s +>>>>>>>>>>503 ubyte&0xDF >0 +>>>>>>>>>>>503 string x \b%-.1s +>>>>>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>>>>>504 string x \b%-.1s +>>>>>>505 ubyte&0xDF >0 +>>>>>>>505 string x \b.%-.3s +#IO.SYS +>>>>>>472 ubyte&0xDF >0 or +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.5s +>>>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>>>479 string x \b%-.1s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s +# +>>390 string Ungueltiges\ System\ \xFF\r\n +>>>412 string E/A-Fehler\ \ \ \ \xFF\r\n +>>>>429 string Datentraeger\ wechseln\ und\ +>>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) +#WINBOOT.SYS only not spaces (0xDF) +>>>>>>497 ubyte&0xDF >0 +>>>>>>>497 string x %-.7s +>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>504 string x \b%-.1s +>>>>>>505 ubyte&0xDF >0 +>>>>>>>505 string x \b.%-.3s +#IO.SYS +>>>>>>472 ubyte&0xDF >0 or +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.6s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s +# +>>389 string Ungueltiges\ System\ \xFF\r\n +>>>411 string E/A-Fehler\ \ \ \ \xFF\r\n +>>>>428 string Datentraeger\ wechseln\ und\ +>>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) +# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes +>>>>>>472 string x %-.2s +>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>474 string x \b%-.5s +>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>479 string x \b%-.1s +>>>>>>480 ubyte&0xDF >0 +>>>>>>>480 string x \b.%-.3s +>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>483 string x \b%-.5s +>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>488 string x \b%-.2s +>>>>>>>>490 ubyte&0xDF >0 +>>>>>>>>>490 string x \b%-.1s +>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>491 string x \b.%-.3s +>479 ubyte&0xDF >0 +>>416 string Kein\ System\ oder\ +>>>433 string Laufwerksfehler +>>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) +#IO.SYS +>>>>>479 string x \b %-.2s +>>>>>>481 ubyte&0xDF >0 +>>>>>>>481 string x \b%-.6s +>>>>>487 ubyte&0xDF >0 +>>>>>>487 string x \b.%-.3s +#MSDOS.SYS +>>>>>>490 ubyte&0xDF >0 \b+ +>>>>>>>490 string x \b%-.5s +>>>>>>>>495 ubyte&0xDF >0 +>>>>>>>>>495 string x \b%-.3s +>>>>>>>498 ubyte&0xDF >0 +>>>>>>>>498 string x \b.%-.3s +# +>486 ubyte&0xDF >0 +>>416 string Non-System\ disk\ or\ +>>>435 string disk\ error\r +>>>>447 string Replace\ and\ press\ any\ key\ +>>>>>473 string when\ ready\r \b, Microsoft DOS Bootloader +>480 ubyte&0xDF >0 +>>393 string Non-System\ disk\ or\ +>>>412 string disk\ error\r +>>>>424 string Replace\ and\ press\ any\ key\ +>>>>>450 string when\ ready\r \b, Microsoft DOS bootloader +#IO.SYS +>>>>>480 string x \b %-.2s +>>>>>>482 ubyte&0xDF >0 +>>>>>>>48 string x \b%-.6s +>>>>>488 ubyte&0xDF >0 +>>>>>>488 string x \b.%-.3s +#MSDOS.SYS +>>>>>>491 ubyte&0xDF >0 \b+ +>>>>>>>491 string x \b%-.5s +>>>>>>>>496 ubyte&0xDF >0 +>>>>>>>>>496 string x \b%-.3s +>>>>>>>499 ubyte&0xDF >0 +>>>>>>>>499 string x \b.%-.3s +#>43 string \224R-LOADER\ \ SYS =label +>54 string SYS +>>324 string VASKK +>>>495 string NEWLDR\0 \b, DR-DOS Bootloader (LOADER.SYS) +# +>70 string IBMBIO\ \ COM +>>472 string Cannot\ load\ DOS!\ +>>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader +>>471 string Cannot\ load\ DOS\ +>>487 string press\ key\ to\ retry \b, Open-DOS Bootloader +>444 string KERNEL\ \ SYS +>>314 string BOOT\ error! \b, FREE-DOS Bootloader +>499 string KERNEL\ \ SYS +>>305 string BOOT\ err!\0 \b, Free-DOS Bootloader +>449 string KERNEL\ \ SYS +>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader +>125 string Loading\ FreeDOS...\r +>>311 string BOOT\ error!\r \b, FREE-DOS bootloader +>>>441 ubyte&0xDF >0 +>>>>441 string x \b %-.6s +>>>>>447 ubyte&0xDF >0 +>>>>>>447 string x \b%-.1s +>>>>>>>448 ubyte&0xDF >0 +>>>>>>>>448 string x \b%-.1s +>>>>449 ubyte&0xDF >0 +>>>>>449 string x \b.%-.3s +>124 string FreeDOS\0 +>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader +# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>336 string Error!\ +>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +# added by Joerg Jenderek +# http://www.visopsys.org/ +# http://partitionlogic.org.uk/ +# OEM-ID=Visopsys +>478 ulelong 0 +>>(1.b+326) string I/O\ Error\ reading\ +>>>(1.b+344) string Visopsys\ loader\r +>>>>(1.b+361) string Press\ any\ key\ to\ continue.\r \b, Visopsys loader +# http://alexfru.chat.ru/epm.html#bootprog +>494 ubyte >0x4D +>>495 string >E +>>>495 string <S +#OEM-ID is not reliable +>>>>3 string BootProg +# It just looks for a program file name at the root directory +# and loads corresponding file with following execution. +# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes +>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader +>>>>>499 string x \b %-.1s +>>>>>>500 ubyte&0xDF >0 +>>>>>>>500 string x \b%-.1s +>>>>>>>>501 ubyte&0xDF >0 +>>>>>>>>>501 string x \b%-.1s +>>>>>>>>>>502 ubyte&0xDF >0 +>>>>>>>>>>>502 string x \b%-.1s +>>>>>>>>>>>>503 ubyte&0xDF >0 +>>>>>>>>>>>>>503 string x \b%-.1s +>>>>>>>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>>>>>>>504 string x \b%-.1s +>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 +>>>>>>>>>>>>>>>>>505 string x \b%-.1s +>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 +>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s +#name extension +>>>>>507 ubyte&0xDF >0 \b. +>>>>>>507 string x \b%-.1s +>>>>>>>508 ubyte&0xDF >0 +>>>>>>>>508 string x \b%-.1s +>>>>>>>>>509 ubyte&0xDF >0 +>>>>>>>>>>509 string x \b%-.1s +#If the boot sector fails to read any other sector, +#it prints a very short message ("RE") to the screen and hangs the computer. +#If the boot sector fails to find needed program in the root directory, +#it also hangs with another message ("NF"). +>>>>>492 string RENF \b, FAT (12 bit) +>>>>>495 string RENF \b, FAT (16 bit) +# http://alexfru.chat.ru/epm.html#bootprog +>494 ubyte >0x4D +>>495 string >E +>>>495 string <S +#OEM-ID is not reliable +>>>>3 string BootProg +# It just looks for a program file name at the root directory +# and loads corresponding file with following execution. +# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes +>>>>499 ubyte&0xDF >0 \b, COM/EXE Bootloader +>>>>>499 string x \b %-.1s +>>>>>>500 ubyte&0xDF >0 +>>>>>>>500 string x \b%-.1s +>>>>>>>>501 ubyte&0xDF >0 +>>>>>>>>>501 string x \b%-.1s +>>>>>>>>>>502 ubyte&0xDF >0 +>>>>>>>>>>>502 string x \b%-.1s +>>>>>>>>>>>>503 ubyte&0xDF >0 +>>>>>>>>>>>>>503 string x \b%-.1s +>>>>>>>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>>>>>>>504 string x \b%-.1s +>>>>>>>>>>>>>>>>505 ubyte&0xDF >0 +>>>>>>>>>>>>>>>>>505 string x \b%-.1s +>>>>>>>>>>>>>>>>>>506 ubyte&0xDF >0 +>>>>>>>>>>>>>>>>>>>506 string x \b%-.1s +#name extension +>>>>>507 ubyte&0xDF >0 \b. +>>>>>>507 string x \b%-.1s +>>>>>>>508 ubyte&0xDF >0 +>>>>>>>>508 string x \b%-.1s +>>>>>>>>>509 ubyte&0xDF >0 +>>>>>>>>>>509 string x \b%-.1s +#If the boot sector fails to read any other sector, +#it prints a very short message ("RE") to the screen and hangs the computer. +#If the boot sector fails to find needed program in the root directory, +#it also hangs with another message ("NF"). +>>>>>492 string RENF \b, FAT (12 bit) +>>>>>495 string RENF \b, FAT (16 bit) +# loader end +# Joerg Jenderek +>446 ubyte 0 +>>450 ubyte >0 +>>>482 ubyte 0 +>>>>498 ubyte 0 +>>>>466 ubyte 0x05 \b, extended partition table +>>>>466 ubyte 0x0F \b, extended partition table (LBA) +>>>>466 ubyte 0x0 \b, extended partition table (last) # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # older drives may use E9 xx xx >0 lelong&0x009000EB 0x009000EB @@ -90,7 +746,7 @@ >>>>>>>43 string <NO\ NAME \b, label: "%11.11s" >>>>>>>43 string >NO\ NAME \b, label: "%11.11s" >>>>>>>43 string =NO\ NAME \b, unlabeled ->>>>>>54 string FAT1 \b, FAT +>>>>>>54 string FAT \b, FAT >>>>>>>54 string FAT12 \b (12 bit) >>>>>>>54 string FAT16 \b (16 bit) # FAT32 specific @@ -127,6 +783,9 @@ >>>>>>71 string =NO\ NAME \b, unlabeled ### FATs end >0x200 lelong 0x82564557 \b, BSD disklabel +# FATX +0 string FATX FATX filesystem data + # Minix filesystems - Juan Cespedes <cespedes@debian.org> 0x410 leshort 0x137f Minix filesystem @@ -151,7 +810,62 @@ 0x18b string OS/2 OS/2 Boot Manager -9564 lelong 0x00011954 Unix Fast File system (little-endian), +# added by Joerg Jenderek +# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or +# grub-1.94/kern/i386/pc/startup.S +# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data +# usual values are marked with comments to get only informations of strange GRUB loaders +0x200 uleshort 0x70EA +# found only version 3.{1,2} +>0x206 ubeshort >0x0300 +# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 > "00" +>>0x212 ubyte >0x29 +>>>0x213 ubyte >0x29 +# not iso9660_stage1_5 +#>>>0 ulelong&0x00BE5652 0x00BE5652 +>>>>0x213 ubyte >0x29 GRand Unified Bootloader +# config_file for stage1_5 is 0xffffffff + default "/boot/grub/stage2" +>>>>0x217 ubyte 0xFF stage1_5 +>>>>0x217 ubyte <0xFF stage2 +>>>>0x206 ubyte x \b version %u +>>>>0x207 ubyte x \b.%u +# module_size for 1.94 +>>>>0x208 ulelong <0xffffff \b, installed partition %u +#>>>>0x208 ulelong =0xffffff \b, %u (default) +>>>>0x208 ulelong >0xffffff \b, installed partition %u +# GRUB 0.5.95 unofficial +>>>>0x20C ulelong&0x2E300000 0x2E300000 +# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs +>>>>>0x20C ubyte x \b, identifier 0x%x +#>>>>>0x20D ubyte =0 \b, LBA flag 0x%x (default) +>>>>>0x20D ubyte >0 \b, LBA flag 0x%x +# GRUB version as string +>>>>>0x20E string >\0 \b, GRUB version %-s +# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default +>>>>>>0x215 ulong 0xffffffff +>>>>>>>0x219 string >\0 \b, configuration file %-s +>>>>>>0x215 ulong !0xffffffff +>>>>>>>0x215 string >\0 \b, configuration file %-s +# newer GRUB versions +>>>>0x20C ulelong&0x2E300000 !0x2E300000 +##>>>>>0x20C ulelong =0 \b, saved entry %d (usual) +>>>>>0x20C ulelong >0 \b, saved entry %d +# for 1.94 contains kernel image size +# for 0.93,0.94,0.96,0.97 +# 0=stage2 1=ffs 2=e2fs 3=fat 4=minix 5=reiserfs 6=vstafs 7=jfs 8=xfs 9=iso9660 a=ufs2 +>>>>>0x210 ubyte x \b, identifier 0x%x +# The flag for LBA forcing is in most cases 0 +#>>>>>0x211 ubyte =0 \b, LBA flag 0x%x (default) +>>>>>0x211 ubyte >0 \b, LBA flag 0x%x +# GRUB version as string +>>>>>0x212 string >\0 \b, GRUB version %-s +# for stage1_5 is 0xffffffff + config_file "/boot/grub/stage2" default +>>>>>0x217 ulong 0xffffffff +>>>>>>0x21b string >\0 \b, configuration file %-s +>>>>>0x217 ulong !0xffffffff +>>>>>>0x217 string >\0 \b, configuration file %-s + +9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), >8404 string x last mounted on %s, #>9504 ledate x last checked at %s, >8224 ledate x last written at %s, @@ -167,8 +881,48 @@ >8320 lelong 0 TIME optimization >8320 lelong 1 SPACE optimization -9564 belong 0x00011954 Unix Fast File system (big-endian), ->7168 long 0x4c41424c Apple UFS Volume +42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 leqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 lequad x number of blocks %lld, +>&-288 lequad x number of data blocks %lld, +>&-1332 lelong x number of cylinder groups %d, +>&-1328 lelong x block size %d, +>&-1324 lelong x fragment size %d, +>&-180 lelong x average file size %d, +>&-176 lelong x average number of files in dir %d, +>&-272 lequad x pending blocks to free %lld, +>&-264 lelong x pending inodes to free %ld, +>&-664 lequad x system-wide uuid %0llx, +>&-1316 lelong x minimum percentage of free blocks %d, +>&-1248 lelong 0 TIME optimization +>&-1248 lelong 1 SPACE optimization + +66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 leqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 lequad x number of blocks %lld, +>&-288 lequad x number of data blocks %lld, +>&-1332 lelong x number of cylinder groups %d, +>&-1328 lelong x block size %d, +>&-1324 lelong x fragment size %d, +>&-180 lelong x average file size %d, +>&-176 lelong x average number of files in dir %d, +>&-272 lequad x pending blocks to free %lld, +>&-264 lelong x pending inodes to free %ld, +>&-664 lequad x system-wide uuid %0llx, +>&-1316 lelong x minimum percentage of free blocks %d, +>&-1248 lelong 0 TIME optimization +>&-1248 lelong 1 SPACE optimization + +9564 belong 0x00011954 Unix Fast File system [v1] (big-endian), +>7168 belong 0x4c41424c Apple UFS Volume >>7186 string x named %s, >>7176 belong x volume label version %d, >>7180 bedate x created on %s, @@ -187,6 +941,46 @@ >8320 belong 0 TIME optimization >8320 belong 1 SPACE optimization +42332 belong 0x19540119 Unix Fast File system [v2] (big-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 beqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 bequad x number of blocks %lld, +>&-288 bequad x number of data blocks %lld, +>&-1332 belong x number of cylinder groups %d, +>&-1328 belong x block size %d, +>&-1324 belong x fragment size %d, +>&-180 belong x average file size %d, +>&-176 belong x average number of files in dir %d, +>&-272 bequad x pending blocks to free %lld, +>&-264 belong x pending inodes to free %ld, +>&-664 bequad x system-wide uuid %0llx, +>&-1316 belong x minimum percentage of free blocks %d, +>&-1248 belong 0 TIME optimization +>&-1248 belong 1 SPACE optimization + +66908 belong 0x19540119 Unix Fast File system [v2] (big-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 beqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 bequad x number of blocks %lld, +>&-288 bequad x number of data blocks %lld, +>&-1332 belong x number of cylinder groups %d, +>&-1328 belong x block size %d, +>&-1324 belong x fragment size %d, +>&-180 belong x average file size %d, +>&-176 belong x average number of files in dir %d, +>&-272 bequad x pending blocks to free %lld, +>&-264 belong x pending inodes to free %ld, +>&-664 bequad x system-wide uuid %0llx, +>&-1316 belong x minimum percentage of free blocks %d, +>&-1248 belong 0 TIME optimization +>&-1248 belong 1 SPACE optimization + # ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com> 0x438 leshort 0xEF53 Linux >0x44c lelong x rev %d @@ -276,7 +1070,16 @@ # # CDROM Filesystems -32769 string CD001 ISO 9660 CD-ROM filesystem data +# Modified for UDF by gerardo.cacciari@gmail.com +32769 string CD001 +>38913 string !NSR0 ISO 9660 CD-ROM filesystem data +>38913 string NSR01 UDF filesystem data (version 1.0) +>38913 string NSR02 UDF filesystem data (version 1.5) +>38913 string NSR03 UDF filesystem data (version 2.0) +>38913 string >NSR03 UDF filesystem data (unknown version, +>>38917 byte x id 'NSR0%c') +>38913 string <NSR01 UDF filesystem data (unknown version, +>>38917 byte x id 'NSR0%c') # "application id" which appears to be used as a volume label >32808 string >\0 '%s' >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) @@ -327,12 +1130,84 @@ 0 string VoIP\ Startup\ and Aculab VoIP firmware >35 string x format %s -# PPCBoot image file +# u-boot/PPCBoot image file # From: Mark Brown <broonie@sirena.org.uk> -0 belong 0x27051956 PPCBoot image +0 belong 0x27051956 u-boot/PPCBoot image >4 string PPCBoot >>12 string x version %s # JFFS2 file system -0 leshort 0x1984 Linux old jffs2 filesystem data little endian -0 lelong 0xe0011985 Linux jffs2 filesystem data little endian +0 leshort 0x1984 Linux old jffs2 filesystem data little endian +0 leshort 0x1985 Linux jffs2 filesystem data little endian + +# Squashfs +0 string sqsh Squashfs filesystem, big endian, +>28 beshort x version %d. +>30 beshort x \b%d, +>28 beshort <3 +>>8 belong x %d bytes, +>28 beshort >2 +>>63 bequad x %lld bytes, +#>>67 belong x %d bytes, +>4 belong x %d inodes, +>28 beshort <2 +>>32 beshort x blocksize: %d bytes, +>28 beshort >1 +>>51 belong x blocksize: %d bytes, +>39 bedate x created: %s +0 string hsqs Squashfs filesystem, little endian, +>28 leshort x version %d. +>30 leshort x \b%d, +>28 leshort <3 +>>8 lelong x %d bytes, +>28 leshort >2 +>>63 lequad x %lld bytes, +#>>63 lelong x %d bytes, +>4 lelong x %d inodes, +>28 leshort <2 +>>32 leshort x blocksize: %d bytes, +>28 leshort >1 +>>51 lelong x blocksize: %d bytes, +>39 ledate x created: %s + +0 string td\000 floppy image data (TeleDisk) + +# AFS Dump Magic +# From: Ty Sarna <tsarna@sarna.org> +0 string \x01\xb3\xa1\x13\x22 AFS Dump +>&0 belong x (v%d) +>>&0 byte 0x76 +>>>&0 belong x Vol %d, +>>>>&0 byte 0x6e +>>>>>&0 string x %s +>>>>>>&1 byte 0x74 +>>>>>>>&0 beshort 2 +>>>>>>>>&4 bedate x on: %s +>>>>>>>>&0 bedate =0 full dump +>>>>>>>>&0 bedate !0 incremental since: %s + +#---------------------------------------------------------- +# VMS backup savesets - gerardo.cacciari@gmail.com +# +4 string \x01\x00\x01\x00\x01\x00 +>(0.s+16) string \x01\x01 +>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data +>>>40 lelong x (block size %d, +>>>49 string >\0 original name '%s', +>>>2 short 1024 VAX generated) +>>>2 short 2048 AXP generated) +>>>2 short 4096 I64 generated) + +# Compaq/HP RILOE floppy image +# From: Dirk Jagdmann <doj@cubic.org> +0 string CPQRFBLO Compaq/HP RILOE floppy image + +#------------------------------------------------------------------------------ +# Files-11 On-Disk Structure (OpenVMS file system) - gerardo.cacciari@gmail.com +# These bits come from LBN 1 (home block) of ODS-2 and ODS-5 volumes, which is +# mapped to VBN 2 of [000000]INDEXF.SYS;1 +# +1008 string DECFILE11B Files-11 On-Disk Structure +>525 byte x Level %d +>525 byte x (ODS-%d OpenVMS file system), +>984 string x volume label is '%-12.12s' diff --git a/usr.bin/file/magdir/flash b/usr.bin/file/magdir/flash index 7d76df55110..7d3d86aa10b 100644 --- a/usr.bin/file/magdir/flash +++ b/usr.bin/file/magdir/flash @@ -1,4 +1,4 @@ -# $OpenBSD: flash,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: flash,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # flash: file(1) magic for Macromedia Flash file format @@ -11,6 +11,9 @@ >3 byte x version %d 0 string CWS Macromedia Flash data (compressed), >3 byte x version %d +# From: Cal Peake <cp@absolutedigital.net> +0 string FLV Macromedia Flash Video + # # From Dave Wilson 0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document diff --git a/usr.bin/file/magdir/fonts b/usr.bin/file/magdir/fonts index f38e5f93ccf..c3d32ab56b6 100644 --- a/usr.bin/file/magdir/fonts +++ b/usr.bin/file/magdir/fonts @@ -1,4 +1,4 @@ -# $OpenBSD: fonts,v 1.3 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: fonts,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # fonts: file(1) magic for font data @@ -60,3 +60,6 @@ # Opentype font data from Avi Bercovich 0 string OTTO OpenType font data +# Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu +0 string SplineFontDB: Spline Font Database +>14 string x version %s diff --git a/usr.bin/file/magdir/fsav b/usr.bin/file/magdir/fsav index 92eb5e078e1..799e19872d7 100644 --- a/usr.bin/file/magdir/fsav +++ b/usr.bin/file/magdir/fsav @@ -1,28 +1,61 @@ -# $OpenBSD: fsav,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: fsav,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # fsav: file(1) magic for datafellows fsav virus definition files # Anthon van der Neut (anthon@mnt.org) -0 beshort 0x1575 fsav (linux) macro virus + +# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} +0 beshort 0x1575 fsav macro virus signatures >8 leshort >0 (%d- >11 byte >0 \b%02d- >10 byte >0 \b%02d) +# ftp://ftp.f-prot.com/pub/sign.zip +#10 ubyte <12 +#>9 ubyte <32 +#>>8 ubyte 0x0a +#>>>12 ubyte 0x07 +#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- +#>>>>10 byte 0 \b01- +#>>>>10 byte 1 \b02- +#>>>>10 byte 2 \b03- +#>>>>10 byte 3 \b04- +#>>>>10 byte 4 \b05- +#>>>>10 byte 5 \b06- +#>>>>10 byte 6 \b07- +#>>>>10 byte 7 \b08- +#>>>>10 byte 8 \b09- +#>>>>10 byte 9 \b10- +#>>>>10 byte 10 \b11- +#>>>>10 byte 11 \b12- +#>>>>9 ubyte >0 \b%02d) +# ftp://ftp.f-prot.com/pub/sign2.zip +#0 ubyte 0x62 +#>1 ubyte 0xF5 +#>>2 ubyte 0x1 +#>>>3 ubyte 0x1 +#>>>>4 ubyte 0x0e +#>>>>>13 ubyte >0 fsav virus signatures +#>>>>>>11 ubyte x size 0x%02x +#>>>>>>12 ubyte x \b%02x +#>>>>>>13 ubyte x \b%02x bytes -# comment this out for now because it regognizes every file where -# the eighth character is \n -#8 byte 0x0a -#>12 byte 0x07 -#>11 leshort >0 fsav (linux) virus (%d- -#>10 byte 0 \b01- -#>10 byte 1 \b02- -#>10 byte 2 \b03- -#>10 byte 3 \b04- -#>10 byte 4 \b05- -#>10 byte 5 \b06- -#>10 byte 6 \b07- -#>10 byte 7 \b08- -#>10 byte 8 \b08- -#>10 byte 9 \b10- -#>10 byte 10 \b11- -#>10 byte 11 \b12- -#>9 byte >0 \b%02d) +# Joerg Jenderek: joerg dot jenderek at web dot de +# http://www.clamav.net/doc/latest/html/node45.html +# .cvd files start with a 512 bytes colon separated header +# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime +# + gzipped tarball files +0 string ClamAV-VDB: +>11 string >\0 Clam AntiVirus database %-.23s +>>34 string : +>>>35 regex [^:]+ \b, version +>>>>35 string x \b%-.1s +>>>>>36 string !: +>>>>>>36 string x \b%-.1s +>>>>>>>37 string !: +>>>>>>>>37 string x \b%-.1s +>>>>>>>>>38 string !: +>>>>>>>>>>38 string x \b%-.1s +>>>>512 string \037\213 \b, gzipped +>>>>769 string ustar\0 \b, tared +>512 string \037\213 \b, gzipped +>769 string ustar\0 \b, tared diff --git a/usr.bin/file/magdir/geos b/usr.bin/file/magdir/geos new file mode 100644 index 00000000000..af1df7b7194 --- /dev/null +++ b/usr.bin/file/magdir/geos @@ -0,0 +1,19 @@ + +#------------------------------------------------------------------------------ +# GEOS files (Vidar Madsen, vidar@gimp.org) +# semi-commonly used in embedded and handheld systems. +0 belong 0xc745c153 GEOS +>40 byte 1 executable +>40 byte 2 VMFile +>40 byte 3 binary +>40 byte 4 directory label +>40 byte <1 unknown +>40 byte >4 unknown +>4 string >\0 \b, name "%s" +#>44 short x \b, version %d +#>46 short x \b.%d +#>48 short x \b, rev %d +#>50 short x \b.%d +#>52 short x \b, proto %d +#>54 short x \br%d +#>168 string >\0 \b, copyright "%s" diff --git a/usr.bin/file/magdir/gnu b/usr.bin/file/magdir/gnu index e7a19e3101c..baa9f4c03ac 100644 --- a/usr.bin/file/magdir/gnu +++ b/usr.bin/file/magdir/gnu @@ -1,5 +1,7 @@ -# $OpenBSD: gnu,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: gnu,v 1.2 2008/05/08 01:40:57 chl Exp $ +#------------------------------------------------------------------------------ +# gnu: file(1) magic for various GNU tools # # GNU nlsutils message catalog file format # @@ -12,33 +14,23 @@ # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk> 0 string *nazgul* Nazgul style compiled message catalog >8 lelong >0 \b, version %ld + # GnuPG # The format is very similar to pgp 0 string \001gpg GPG key trust database >4 byte x version %d -0 beshort 0x9901 GPG key public ring +0 beshort 0x8502 GPG encrypted data # This magic is not particularly good, as the keyrings don't have true # magic. Nevertheless, it covers many keyrings. +0 beshort 0x9901 GPG key public ring # Gnumeric spreadsheet # This entry is only semi-helpful, as Gnumeric compresses its files, so # they will ordinarily reported as "compressed", but at least -z helps 39 string =<gmr:Workbook Gnumeric spreadsheet -#------------------------------------------------------------------------------ -# gcc: file(1) magic for GCC special files -# -0 string gpch GCC precompiled header - -# The version field is annoying. It's 3 characters, not zero-terminated. ->5 byte x (version %c ->6 byte x \b%c ->7 byte x \b%c) - -# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O' ->4 byte 67 for C ->4 byte 111 for Objective C ->4 byte 43 for C++ ->4 byte 79 for Objective C++ - - +# From: James Youngman <jay@gnu.org> +# gnu find magic +0 string \0LOCATE GNU findutils locate database data +>7 string >\0 \b, format %s +>7 string 02 \b (frcode) diff --git a/usr.bin/file/magdir/hdf b/usr.bin/file/magdir/hdf deleted file mode 100644 index d93cdf4296b..00000000000 --- a/usr.bin/file/magdir/hdf +++ /dev/null @@ -1,8 +0,0 @@ -# $OpenBSD: hdf,v 1.1 2004/06/03 03:14:20 tedu Exp $ - -#------------------------------------------------------------------------------ -# Hierarchical Data Format, used to facilitate scientific data exchange -# specifications at http://hdf.ncsa.uiuc.edu/ - -0 belong 0x0e031301 Hierarchical Data Format (version 4) data -0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data diff --git a/usr.bin/file/magdir/hp b/usr.bin/file/magdir/hp index d5ab72db6a6..ed131ba3e3f 100644 --- a/usr.bin/file/magdir/hp +++ b/usr.bin/file/magdir/hp @@ -1,4 +1,4 @@ -# $OpenBSD: hp,v 1.5 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: hp,v 1.6 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # hp: file(1) magic for Hewlett Packard machines (see also "printer") @@ -49,10 +49,10 @@ 0 long 01702407010 TML 1032 byte-order format 0 long 01003405017 TML 2301 byte-order format 0 long 01602007412 TML 3210 byte-order format -#### PA-RISC +#### PA-RISC 1.1 0 belong 0x02100106 PA-RISC1.1 relocatable object 0 belong 0x02100107 PA-RISC1.1 executable ->168 belong &=0x00000004 dynamically linked +>168 belong &0x00000004 dynamically linked >(144) belong 0x054ef630 dynamically linked >96 belong >0 - not stripped @@ -72,6 +72,30 @@ 0 belong 0x0210010d PA-RISC1.1 dynamic load library >96 belong >0 - not stripped +#### PA-RISC 2.0 +0 belong 0x02140106 PA-RISC2.0 relocatable object + +0 belong 0x02140107 PA-RISC2.0 executable +>168 belong &0x00000004 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x02140108 PA-RISC2.0 shared executable +>168 belong &0x00000004 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x0214010b PA-RISC2.0 demand-load executable +>168 belong &0x00000004 dynamically linked +>(144) belong 0x054ef630 dynamically linked +>96 belong >0 - not stripped + +0 belong 0x0214010e PA-RISC2.0 shared library +>96 belong >0 - not stripped + +0 belong 0x0214010d PA-RISC2.0 dynamic load library +>96 belong >0 - not stripped + #### 800 0 belong 0x020b0106 PA-RISC1.0 relocatable object @@ -173,7 +197,7 @@ 0 string IMGfile CIS compimg HP Bitmapfile # XXX - see "lif" -#0 beshort 0x8000 lif file +#0 short 0x8000 lif file 0 long 0x020c010c compiled Lisp 0 string msgcat01 HP NLS message catalog, @@ -182,30 +206,30 @@ # addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92 0 string HPHP48- HP48 binary >7 byte >0 - Rev %c ->8 short 0x1129 (ADR) ->8 short 0x3329 (REAL) ->8 short 0x5529 (LREAL) ->8 short 0x7729 (COMPLX) ->8 short 0x9d29 (LCOMPLX) ->8 short 0xbf29 (CHAR) ->8 short 0xe829 (ARRAY) ->8 short 0x0a2a (LNKARRAY) ->8 short 0x2c2a (STRING) ->8 short 0x4e2a (HXS) ->8 short 0x742a (LIST) ->8 short 0x962a (DIR) ->8 short 0xb82a (ALG) ->8 short 0xda2a (UNIT) ->8 short 0xfc2a (TAGGED) ->8 short 0x1e2b (GROB) ->8 short 0x402b (LIB) ->8 short 0x622b (BACKUP) ->8 short 0x882b (LIBDATA) ->8 short 0x9d2d (PROG) ->8 short 0xcc2d (CODE) ->8 short 0x482e (GNAME) ->8 short 0x6d2e (LNAME) ->8 short 0x922e (XLIB) +>8 beshort 0x1129 (ADR) +>8 beshort 0x3329 (REAL) +>8 beshort 0x5529 (LREAL) +>8 beshort 0x7729 (COMPLX) +>8 beshort 0x9d29 (LCOMPLX) +>8 beshort 0xbf29 (CHAR) +>8 beshort 0xe829 (ARRAY) +>8 beshort 0x0a2a (LNKARRAY) +>8 beshort 0x2c2a (STRING) +>8 beshort 0x4e2a (HXS) +>8 beshort 0x742a (LIST) +>8 beshort 0x962a (DIR) +>8 beshort 0xb82a (ALG) +>8 beshort 0xda2a (UNIT) +>8 beshort 0xfc2a (TAGGED) +>8 beshort 0x1e2b (GROB) +>8 beshort 0x402b (LIB) +>8 beshort 0x622b (BACKUP) +>8 beshort 0x882b (LIBDATA) +>8 beshort 0x9d2d (PROG) +>8 beshort 0xcc2d (CODE) +>8 beshort 0x482e (GNAME) +>8 beshort 0x6d2e (LNAME) +>8 beshort 0x922e (XLIB) 0 string %%HP: HP48 text >6 string T(0) - T(0) >6 string T(1) - T(1) @@ -226,4 +250,147 @@ >2 beshort 0407 impure binary >2 beshort 0410 read-only binary >2 beshort 0413 demand paged binary +# +# From David Gero <dgero@nortelnetworks.com> +# HP-UX 10.20 core file format from /usr/include/sys/core.h +# Unfortunately, HP-UX uses corehead blocks without specifying the order +# There are four we care about: +# CORE_KERNEL, which starts with the string "HP-UX" +# CORE_EXEC, which contains the name of the command +# CORE_PROC, which contains the signal number that caused the core dump +# CORE_FORMAT, which contains the version of the core file format (== 1) +# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC +# but we include all 6 variations of the order of the first 3, and +# assume that PROC will always be last +# Order 1: KERNEL, EXEC, FORMAT, PROC +0x10 string HP-UX +>0 belong 2 +>>0xC belong 0x3C +>>>0x4C belong 0x100 +>>>>0x58 belong 0x44 +>>>>>0xA0 belong 1 +>>>>>>0xAC belong 4 +>>>>>>>0xB0 belong 1 +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0x90 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ +# Order 2: KERNEL, FORMAT, EXEC, PROC +>>>0x4C belong 1 +>>>>0x58 belong 4 +>>>>>0x5C belong 1 +>>>>>>0x60 belong 0x100 +>>>>>>>0x6C belong 0x44 +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0xA4 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ +# Order 3: FORMAT, KERNEL, EXEC, PROC +0x24 string HP-UX +>0 belong 1 +>>0xC belong 4 +>>>0x10 belong 1 +>>>>0x14 belong 2 +>>>>>0x20 belong 0x3C +>>>>>>0x60 belong 0x100 +>>>>>>>0x6C belong 0x44 +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0xA4 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ +# Order 4: EXEC, KERNEL, FORMAT, PROC +0x64 string HP-UX +>0 belong 0x100 +>>0xC belong 0x44 +>>>0x54 belong 2 +>>>>0x60 belong 0x3C +>>>>>0xA0 belong 1 +>>>>>>0xAC belong 4 +>>>>>>>0xB0 belong 1 +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0x44 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ +# Order 5: FORMAT, EXEC, KERNEL, PROC +0x78 string HP-UX +>0 belong 1 +>>0xC belong 4 +>>>0x10 belong 1 +>>>>0x14 belong 0x100 +>>>>>0x20 belong 0x44 +>>>>>>0x68 belong 2 +>>>>>>>0x74 belong 0x3C +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0x58 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ +# Order 6: EXEC, FORMAT, KERNEL, PROC +>0 belong 0x100 +>>0xC belong 0x44 +>>>0x54 belong 1 +>>>>0x60 belong 4 +>>>>>0x64 belong 1 +>>>>>>0x68 belong 2 +>>>>>>>0x74 belong 0x2C +>>>>>>>>0xB4 belong 4 core file +>>>>>>>>>0x44 string >\0 from '%s' +>>>>>>>>>0xC4 belong 3 - received SIGQUIT +>>>>>>>>>0xC4 belong 4 - received SIGILL +>>>>>>>>>0xC4 belong 5 - received SIGTRAP +>>>>>>>>>0xC4 belong 6 - received SIGABRT +>>>>>>>>>0xC4 belong 7 - received SIGEMT +>>>>>>>>>0xC4 belong 8 - received SIGFPE +>>>>>>>>>0xC4 belong 10 - received SIGBUS +>>>>>>>>>0xC4 belong 11 - received SIGSEGV +>>>>>>>>>0xC4 belong 12 - received SIGSYS +>>>>>>>>>0xC4 belong 33 - received SIGXCPU +>>>>>>>>>0xC4 belong 34 - received SIGXFSZ + +# From: AMAKAWA Shuhei <sa264@cam.ac.uk> +0 string HPHP49- HP49 binary diff --git a/usr.bin/file/magdir/iff b/usr.bin/file/magdir/iff index ec9f60c8f4f..ca0b18a55bf 100644 --- a/usr.bin/file/magdir/iff +++ b/usr.bin/file/magdir/iff @@ -1,4 +1,4 @@ -# $OpenBSD: iff,v 1.2 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: iff,v 1.3 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # iff: file(1) magic for Interchange File Format (see also "audio" & "images") @@ -16,16 +16,46 @@ >8 string AIFF \b, AIFF audio >8 string AIFC \b, AIFF-C compressed audio >8 string 8SVX \b, 8SVX 8-bit sampled sound voice +>8 string 16SV \b, 16SV 16-bit sampled sound voice >8 string SAMP \b, SAMP sampled audio ->8 string DTYP \b, DTYP datatype description ->8 string PTCH \b, PTCH binary patch +>8 string MAUD \b, MAUD MacroSystem audio +>8 string SMUS \b, SMUS simple music +>8 string CMUS \b, CMUS complex music # image formats >8 string ILBMBMHD \b, ILBM interleaved image >>20 beshort x \b, %d x >>22 beshort x %d >8 string RGBN \b, RGBN 12-bit RGB image >8 string RGB8 \b, RGB8 24-bit RGB image +>8 string DEEP \b, DEEP TVPaint/XiPaint image >8 string DR2D \b, DR2D 2-D object >8 string TDDD \b, TDDD 3-D rendering +>8 string LWOB \b, LWOB 3-D object +>8 string LWO2 \b, LWO2 3-D object, v2 +>8 string LWLO \b, LWLO 3-D layered object +>8 string REAL \b, REAL Real3D rendering +>8 string MC4D \b, MC4D MaxonCinema4D rendering +>8 string ANIM \b, ANIM animation +>8 string YAFA \b, YAFA animation +>8 string SSA\ \b, SSA super smooth animation +>8 string ACBM \b, ACBM continuous image +>8 string FAXX \b, FAXX fax image # other formats >8 string FTXT \b, FTXT formatted text +>8 string CTLG \b, CTLG message catalog +>8 string PREF \b, PREF preferences +>8 string DTYP \b, DTYP datatype description +>8 string PTCH \b, PTCH binary patch +>8 string AMFF \b, AMFF AmigaMetaFile format +>8 string WZRD \b, WZRD StormWIZARD resource +>8 string DOC\ \b, DOC desktop publishing document + +# These go at the end of the iff rules +# +# I don't see why these might collide with anything else. +# +# Interactive Fiction related formats +# +>8 string IFRS \b, Blorb Interactive Fiction +>>24 string Exec with executable chunk +>8 string IFZS \b, Z-machine or Glulx saved game file (Quetzal) diff --git a/usr.bin/file/magdir/images b/usr.bin/file/magdir/images index fd097b6fcc8..343e1ff23d8 100644 --- a/usr.bin/file/magdir/images +++ b/usr.bin/file/magdir/images @@ -1,4 +1,4 @@ -# $OpenBSD: images,v 1.8 2005/01/31 17:21:13 espie Exp $ +# $OpenBSD: images,v 1.9 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # images: file(1) magic for image formats (see also "iff") @@ -261,19 +261,13 @@ # other images 0 string This\ is\ a\ BitMap\ file Lisp Machine bit-array-file -0 string !! Bennet Yee's "face" format +0 string =!! Bennet Yee's "face" format # From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image # stuff. # 0 beshort 0x1010 PEX Binary Archive -# Visio drawings -03000 string Visio\ (TM)\ Drawing %s - -# Tgif files -0 string \%TGIF\ x Tgif file version %s - # DICOM medical imaging data 128 string DICM DICOM medical imaging data @@ -314,6 +308,10 @@ >5 byte 0x00 (white background) >5 byte 0xFF (black background) +# Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu +# http://www.atarimax.com/jindroush.atari.org/afmtatr.html +0 leshort 0x0296 Atari ATR image + # XXX: # This is bad magic 0x5249 == 'RI' conflicts with RIFF and other # magic. @@ -515,4 +513,20 @@ # From: Jason Bacon <bacon@smithers.neuro.mcw.edu> 0 beshort 0x3020 character Computer Graphics Metafile +# From Marc Espie 0 lelong 20000630 OpenEXR image data + +# From: Tom Hilinski <tom.hilinski@comcast.net> +# http://www.unidata.ucar.edu/packages/netcdf/ +0 string CDF\001 NetCDF Data Format data + +#----------------------------------------------------------------------- +# Hierarchical Data Format, used to facilitate scientific data exchange +# specifications at http://hdf.ncsa.uiuc.edu/ +0 belong 0x0e031301 Hierarchical Data Format (version 4) data +0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data + +# From: Tobias Burnus <burnus@net-b.de> +# Xara (for a while: Corel Xara) is a graphic package, see +# http://www.xara.com/ for Windows and as GPL application for +0 string XARA\243\243 Xara graphics file diff --git a/usr.bin/file/magdir/java b/usr.bin/file/magdir/java index 125754196ba..cdde1df7b0c 100644 --- a/usr.bin/file/magdir/java +++ b/usr.bin/file/magdir/java @@ -1,11 +1,9 @@ -# $OpenBSD: java,v 1.3 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: java,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------ -# Java ByteCode -# From Larry Schwimmer (schwim@cs.stanford.edu) -0 belong 0xcafebabe compiled Java class data, ->6 beshort x version %d. ->4 beshort x \b%d +# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the +# same magic number, 0xcafebabe, so they are both handled +# in the entry called "cafebabe". #------------------------------------------------------------ # Java serialization # From Martin Pool (m.pool@pharos.com.au) diff --git a/usr.bin/file/magdir/jpeg b/usr.bin/file/magdir/jpeg index b4ce7676bb2..5f40f0c8140 100644 --- a/usr.bin/file/magdir/jpeg +++ b/usr.bin/file/magdir/jpeg @@ -1,4 +1,4 @@ -# $OpenBSD: jpeg,v 1.2 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: jpeg,v 1.3 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # JPEG images @@ -11,22 +11,113 @@ # 0 beshort 0xffd8 JPEG image data >6 string JFIF \b, JFIF standard ->6 string Exif \b, EXIF standard # The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 # in a vain attempt to add image size reporting for JFIF. Note that these # tests are not fool-proof since some perfectly valid JPEGs are currently # impossible to specify in magic(4) format. # First, a little JFIF version info: ->11 byte x \b %d. ->12 byte x \b%02d +>>11 byte x \b %d. +>>12 byte x \b%02d # Next, the resolution or aspect ratio of the image: -#>13 byte 0 \b, aspect ratio -#>13 byte 1 \b, resolution (DPI) -#>13 byte 2 \b, resolution (DPCM) -#>4 beshort x \b, segment length %d +#>>13 byte 0 \b, aspect ratio +#>>13 byte 1 \b, resolution (DPI) +#>>13 byte 2 \b, resolution (DPCM) +#>>4 beshort x \b, segment length %d # Next, show thumbnail info, if it exists: ->18 byte !0 \b, thumbnail %dx ->>19 byte x \b%d +>>18 byte !0 \b, thumbnail %dx +>>>19 byte x \b%d + +# EXIF moved down here to avoid reporting a bogus version number, +# and EXIF version number printing added. +# - Patrik R=E5dman <patrik+file-magic@iki.fi> +>6 string Exif \b, EXIF standard +# Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD. +# All possible combinations of entries have to be enumerated, since no looping +# is possible. And both endians are possible... +# The combinations included below are from real-world JPEGs. +# Little-endian +>>12 string II +# IFD 0 Entry #5: +>>>70 leshort 0x8769 +# EXIF IFD Entry #1: +>>>>(78.l+14) leshort 0x9000 +>>>>>(78.l+23) byte x %c +>>>>>(78.l+24) byte x \b.%c +>>>>>(78.l+25) byte !0x30 \b%c +# IFD 0 Entry #9: +>>>118 leshort 0x8769 +# EXIF IFD Entry #3: +>>>>(126.l+38) leshort 0x9000 +>>>>>(126.l+47) byte x %c +>>>>>(126.l+48) byte x \b.%c +>>>>>(126.l+49) byte !0x30 \b%c +# IFD 0 Entry #10 +>>>130 leshort 0x8769 +# EXIF IFD Entry #3: +>>>>(138.l+38) leshort 0x9000 +>>>>>(138.l+47) byte x %c +>>>>>(138.l+48) byte x \b.%c +>>>>>(138.l+49) byte !0x30 \b%c +# EXIF IFD Entry #4: +>>>>(138.l+50) leshort 0x9000 +>>>>>(138.l+59) byte x %c +>>>>>(138.l+60) byte x \b.%c +>>>>>(138.l+61) byte !0x30 \b%c +# EXIF IFD Entry #5: +>>>>(138.l+62) leshort 0x9000 +>>>>>(138.l+71) byte x %c +>>>>>(138.l+72) byte x \b.%c +>>>>>(138.l+73) byte !0x30 \b%c +# IFD 0 Entry #11 +>>>142 leshort 0x8769 +# EXIF IFD Entry #3: +>>>>(150.l+38) leshort 0x9000 +>>>>>(150.l+47) byte x %c +>>>>>(150.l+48) byte x \b.%c +>>>>>(150.l+49) byte !0x30 \b%c +# EXIF IFD Entry #4: +>>>>(150.l+50) leshort 0x9000 +>>>>>(150.l+59) byte x %c +>>>>>(150.l+60) byte x \b.%c +>>>>>(150.l+61) byte !0x30 \b%c +# EXIF IFD Entry #5: +>>>>(150.l+62) leshort 0x9000 +>>>>>(150.l+71) byte x %c +>>>>>(150.l+72) byte x \b.%c +>>>>>(150.l+73) byte !0x30 \b%c +# Big-endian +>>12 string MM +# IFD 0 Entry #9: +>>>118 beshort 0x8769 +# EXIF IFD Entry #1: +>>>>(126.L+14) beshort 0x9000 +>>>>>(126.L+23) byte x %c +>>>>>(126.L+24) byte x \b.%c +>>>>>(126.L+25) byte !0x30 \b%c +# EXIF IFD Entry #3: +>>>>(126.L+38) beshort 0x9000 +>>>>>(126.L+47) byte x %c +>>>>>(126.L+48) byte x \b.%c +>>>>>(126.L+49) byte !0x30 \b%c +# IFD 0 Entry #10 +>>>130 beshort 0x8769 +# EXIF IFD Entry #3: +>>>>(138.L+38) beshort 0x9000 +>>>>>(138.L+47) byte x %c +>>>>>(138.L+48) byte x \b.%c +>>>>>(138.L+49) byte !0x30 \b%c +# EXIF IFD Entry #5: +>>>>(138.L+62) beshort 0x9000 +>>>>>(138.L+71) byte x %c +>>>>>(138.L+72) byte x \b.%c +>>>>>(138.L+73) byte !0x30 \b%c +# IFD 0 Entry #11 +>>>142 beshort 0x8769 +# EXIF IFD Entry #4: +>>>>(150.L+50) beshort 0x9000 +>>>>>(150.L+59) byte x %c +>>>>>(150.L+60) byte x \b.%c +>>>>>(150.L+61) byte !0x30 \b%c # Here things get sticky. We can do ONE MORE marker segment with # indirect addressing, and that's all. It would be great if we could # do pointer arithemetic like in an assembler language. Christos? @@ -34,7 +125,7 @@ # named accumulators, it would be even more effective... # At least we can show a comment if no other segments got inserted before: >(4.S+5) byte 0xFE ->>(4.S+8) string >\0 \b, "%s" +>>(4.S+8) string >\0 \b, comment: "%s" #>(4.S+5) byte 0xFE \b, comment #>>(4.S+6) beshort x \b length=%d #>>(4.S+8) string >\0 \b, "%s" diff --git a/usr.bin/file/magdir/linux b/usr.bin/file/magdir/linux index c69a9cce985..6d78266de78 100644 --- a/usr.bin/file/magdir/linux +++ b/usr.bin/file/magdir/linux @@ -1,4 +1,4 @@ -# $OpenBSD: linux,v 1.4 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: linux,v 1.5 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # linux: file(1) magic for Linux files @@ -54,10 +54,15 @@ >3 byte >0 8x%d # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 4086 string SWAP-SPACE Linux/i386 swap file +# From: Jeff Bailey <jbailey@ubuntu.com> +# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> +4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image # according to man page of mkswap (8) March 1999 4086 string SWAPSPACE2 Linux/i386 swap file (new style) >0x400 long x %d (4K pages) >0x404 long x size %d pages +>>4086 string SWAPSPACE2 +>>>1052 string >\0 Label %s # ECOFF magic for OSF/1 and Linux (only tested under Linux though) # # from Erik Troan (ewt@redhat.com) examining od dumps, so this @@ -80,7 +85,7 @@ # Linux kernel boot images (i386 arch) (Wolfram Kleff) 514 string HdrS Linux kernel >510 leshort 0xAA55 x86 boot executable ->>518 leshort >=3D0x200 +>>518 leshort >=0x200 >>529 byte 0 zImage, >>>529 byte 1 bzImage, >>>(526.s+0x200) string >\0 version %s, @@ -173,3 +178,72 @@ # 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable # 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable +# SYSLINUX boot logo files (from 'ppmtolss16' sources) +# http://syslinux.zytor.com/ +# +0 lelong =0x1413f33d SYSLINUX' LSS16 image data +>4 leshort x \b, width %d +>6 leshort x \b, height %d + +0 string OOOM User-Mode-Linux's Copy-On-Write disk image +>4 belong x version %d + +# SE Linux policy database +# From: Mike Frysinger <vapier@gentoo.org> +0 lelong 0xf97cff8c SE Linux policy +>16 lelong x v%d +>20 lelong 1 MLS +>24 lelong x %d symbols +>28 lelong x %d ocons + +# Linux Logical Volume Manager (LVM) +# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> +# +# System ID, UUID and volume group name are 128 bytes long +# but they should never be full and initialized with zeros... +# +# LVM1 +# +0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 +>0x12c string >\0 , System ID: %s + +0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 +>0x12c string >\0 , System ID: %s + +# LVM2 +# +# It seems that the label header can be in one the four first sector +# of the disk... (from _find_labeller in lib/label/label.c of LVM2) +# +# 0x200 seems to be the common case + +0x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +# read the offset to add to the start of the header, and the header +# start in 0x200 +>(0x214.l+0x200) string >\0 , UUID: %s + +0x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +>(0x014.l) string >\0 , UUID: %s + +0x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +>(0x414.l+0x400) string >\0 , UUID: %s + +0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +>(0x614.l+0x600) string >\0 , UUID: %s + +# SE Linux policy database +0 lelong 0xf97cff8c SE Linux policy +>16 lelong x v%d +>20 lelong 1 MLS +>24 lelong x %d symbols +>28 lelong x %d ocons + +# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec +# Anthon van der Neut (anthon@mnt.org) +0 string LUKS\xba\xbe LUKS encrypted file, +>6 beshort x ver %d +>8 string x [%s, +>40 string x %s, +>72 string x %s] +>168 string x UUID: %s + diff --git a/usr.bin/file/magdir/lisp b/usr.bin/file/magdir/lisp index e4eb5805cfb..10f127265f0 100644 --- a/usr.bin/file/magdir/lisp +++ b/usr.bin/file/magdir/lisp @@ -1,12 +1,24 @@ -# $OpenBSD: lisp,v 1.3 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: lisp,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # lisp: file(1) magic for lisp programs # # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) -# This is a guess, but a good one. -0 string ;; Lisp/Scheme program text +# updated by Joerg Jenderek +0 string ;; +# windows INF files often begin with semicolon and use CRLF as line end +# lisp files are mainly created on unix system with LF as line end +>2 search/2048 !\r Lisp/Scheme program text +>2 search/2048 \r Windows INF file + +0 search/256 (if\ Lisp/Scheme program text +0 search/256 (setq\ Lisp/Scheme program text +0 search/256 (defvar\ Lisp/Scheme program text +0 search/256 (defparam\ Lisp/Scheme program text +0 search/256 (defun\ Lisp/Scheme program text +0 search/256 (autoload\ Lisp/Scheme program text +0 search/256 (custom-set-variables\ Lisp/Scheme program text # Emacs 18 - this is always correct, but not very magical. 0 string \012( Emacs v18 byte-compiled Lisp data diff --git a/usr.bin/file/magdir/mach b/usr.bin/file/magdir/mach index 2d671c0570c..61eda177728 100644 --- a/usr.bin/file/magdir/mach +++ b/usr.bin/file/magdir/mach @@ -1,23 +1,60 @@ -# $OpenBSD: mach,v 1.3 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: mach,v 1.4 2008/05/08 01:40:57 chl Exp $ -#------------------------------------------------------------------------------ -# mach file description +#------------------------------------------------------------ +# Mach has two magic numbers, 0xcafebabe and 0xfeedface. +# Unfortunately the first, cafebabe, is shared with +# Java ByteCode, so they are both handled in the file "cafebabe". +# The "feedface" ones are handled herein. +#------------------------------------------------------------ +0 lelong&0xfeffffff 0xfeedface Mach-O +>0 byte 0xcf 64-bit +>12 lelong 1 object +>12 lelong 2 executable +>12 lelong 3 fixed virtual memory shared library +>12 lelong 4 core +>12 lelong 5 preload executable +>12 lelong 6 dynamically linked shared library +>12 lelong 7 dynamic linker +>12 lelong 8 bundle +>12 lelong 9 dynamically linked shared library stub +>12 lelong >9 +>>12 lelong x filetype=%ld +>4 lelong <0 +>>4 lelong x architecture=%ld +>4 lelong 1 vax +>4 lelong 2 romp +>4 lelong 3 architecture=3 +>4 lelong 4 ns32032 +>4 lelong 5 ns32332 +>4 lelong 6 m68k +>4 lelong 7 i386 +>4 lelong 8 mips +>4 lelong 9 ns32532 +>4 lelong 10 architecture=10 +>4 lelong 11 hppa +>4 lelong 12 acorn +>4 lelong 13 m88k +>4 lelong 14 sparc +>4 lelong 15 i860-big +>4 lelong 16 i860 +>4 lelong 17 rs6000 +>4 lelong 18 ppc +>4 lelong 16777234 ppc64 +>4 lelong >16777234 +>>4 lelong x architecture=%ld # -0 belong 0xcafebabe Mach-O fat file ->4 belong 1 with 1 architecture ->4 belong >1 ->>4 belong x with %ld architectures -# -0 belong 0xfeedface Mach-O +0 belong&0xfffffffe 0xfeedface Mach-O +>3 byte 0xcf 64-bit >12 belong 1 object >12 belong 2 executable ->12 belong 3 shared library +>12 belong 3 fixed virtual memory shared library >12 belong 4 core >12 belong 5 preload executable >12 belong 6 dynamically linked shared library >12 belong 7 dynamic linker >12 belong 8 bundle ->12 belong >8 +>12 belong 9 dynamically linked shared library stub +>12 belong >9 >>12 belong x filetype=%ld >4 belong <0 >>4 belong x architecture=%ld @@ -36,7 +73,7 @@ >4 belong 8 mips >4 belong 9 ns32532 >4 belong 10 architecture=10 ->4 belong 11 hp pa-risc +>4 belong 11 hppa >4 belong 12 acorn >4 belong 13 m88k >4 belong 14 sparc @@ -44,5 +81,6 @@ >4 belong 16 i860 >4 belong 17 rs6000 >4 belong 18 ppc ->4 belong >18 +>4 belong 16777234 ppc64 +>4 belong >16777234 >>4 belong x architecture=%ld diff --git a/usr.bin/file/magdir/macintosh b/usr.bin/file/magdir/macintosh index e021398d791..c7dbea573a7 100644 --- a/usr.bin/file/magdir/macintosh +++ b/usr.bin/file/magdir/macintosh @@ -1,73 +1,361 @@ -# $OpenBSD: macintosh,v 1.2 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: macintosh,v 1.3 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ -# macintosh: file(1) magic for Apple Macintosh file formats +# macintosh description +# +# BinHex is the Macintosh ASCII-encoded file format (see also "apple") +# Daniel Quinlan, quinlan@yggdrasil.com +11 string must\ be\ converted\ with\ BinHex BinHex binary text +>41 string x \b, version %.3s # Stuffit archives are the de facto standard of compression for Macintosh # files obtained from most archives. (franklsm@tuns.ca) 0 string SIT! StuffIt Archive (data) >2 string x : %s -65 string SIT! StuffIt Archive (rsrc + data) ->2 string x : %s 0 string SITD StuffIt Deluxe (data) >2 string x : %s -65 string SITD StuffIt Deluxe (rsrc + data) ->2 string x : %s 0 string Seg StuffIt Deluxe Segment (data) >2 string x : %s -65 string Seg StuffIt Deluxe Segment (rsrc + data) ->2 string x : %s + +# Newer StuffIt archives (grant@netbsd.org) +0 string StuffIt StuffIt Archive +#>162 string >0 : %s # Macintosh Applications and Installation binaries (franklsm@tuns.ca) 0 string APPL Macintosh Application (data) ->2 string x : %s -65 string APPL Macintosh Application (rsrc + data) ->2 string x : %s +>2 string x \b: %s # Macintosh System files (franklsm@tuns.ca) 0 string zsys Macintosh System File (data) -65 string zsys Macintosh System File(rsrc + data) 0 string FNDR Macintosh Finder (data) -65 string FNDR Macintosh Finder(rsrc + data) 0 string libr Macintosh Library (data) >2 string x : %s -65 string libr Macintosh Library(rsrc + data) ->2 string x : %s 0 string shlb Macintosh Shared Library (data) >2 string x : %s -65 string shlb Macintosh Shared Library(rsrc + data) ->2 string x : %s 0 string cdev Macintosh Control Panel (data) >2 string x : %s -65 string cdev Macintosh Control Panel(rsrc + data) ->2 string x : %s 0 string INIT Macintosh Extension (data) >2 string x : %s -65 string INIT Macintosh Extension(rsrc + data) ->2 string x : %s 0 string FFIL Macintosh Truetype Font (data) >2 string x : %s -65 string FFIL Macintosh Truetype Font(rsrc + data) ->2 string x : %s 0 string LWFN Macintosh Postscript Font (data) >2 string x : %s -65 string LWFN Macintosh Postscript Font(rsrc + data) ->2 string x : %s # Additional Macintosh Files (franklsm@tuns.ca) 0 string PACT Macintosh Compact Pro Archive (data) >2 string x : %s -65 string PACT Macintosh Compact Pro Archive(rsrc + data) ->2 string x : %s 0 string ttro Macintosh TeachText File (data) >2 string x : %s -65 string ttro Macintosh TeachText File(rsrc + data) ->2 string x : %s 0 string TEXT Macintosh TeachText File (data) >2 string x : %s -65 string TEXT Macintosh TeachText File(rsrc + data) ->2 string x : %s 0 string PDF Macintosh PDF File (data) >2 string x : %s -65 string PDF Macintosh PDF File(rsrc + data) ->2 string x : %s + +# MacBinary format (Eric Fischer, enf@pobox.com) +# +# Unfortunately MacBinary doesn't really have a magic number prior +# to the MacBinary III format. The checksum is really the way to +# do it, but the magic file format isn't up to the challenge. +# +# 0 byte 0 +# 1 byte # filename length +# 2 string # filename +# 65 string # file type +# 69 string # file creator +# 73 byte # Finder flags +# 74 byte 0 +# 75 beshort # vertical posn in window +# 77 beshort # horiz posn in window +# 79 beshort # window or folder ID +# 81 byte # protected? +# 82 byte 0 +# 83 belong # length of data segment +# 87 belong # length of resource segment +# 91 belong # file creation date +# 95 belong # file modification date +# 99 beshort # length of comment after resource +# 101 byte # new Finder flags +# 102 string mBIN # (only in MacBinary III) +# 106 byte # char. code of file name +# 107 byte # still more Finder flags +# 116 belong # total file length +# 120 beshort # length of add'l header +# 122 byte 129 # for MacBinary II +# 122 byte 130 # for MacBinary III +# 123 byte 129 # minimum version that can read fmt +# 124 beshort # checksum +# +# This attempts to use the version numbers as a magic number, requiring +# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second +# be 0x81. This works for the files I have, but maybe not for everyone's. + +# Unfortunately, this magic is quite weak - MPi +#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data + +# MacBinary I doesn't have the version number field at all, but MacBinary II +# has been in use since 1987 so I hope there aren't many really old files +# floating around that this will miss. The original spec calls for using +# the nulls in 0, 74, and 82 as the magic number. +# +# Another possibility, that would also work for MacBinary I, is to use +# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will +# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset, +# and that 74 will be 0. So something like +# +# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data +# +# >73 byte&0x01 0x01 \b, inited +# >73 byte&0x02 0x02 \b, changed +# >73 byte&0x04 0x04 \b, busy +# >73 byte&0x08 0x08 \b, bozo +# >73 byte&0x10 0x10 \b, system +# >73 byte&0x10 0x20 \b, bundle +# >73 byte&0x10 0x40 \b, invisible +# >73 byte&0x10 0x80 \b, locked + +#>65 string x \b, type "%4.4s" + +#>65 string 8BIM (PhotoShop) +#>65 string ALB3 (PageMaker 3) +#>65 string ALB4 (PageMaker 4) +#>65 string ALT3 (PageMaker 3) +#>65 string APPL (application) +#>65 string AWWP (AppleWorks word processor) +#>65 string CIRC (simulated circuit) +#>65 string DRWG (MacDraw) +#>65 string EPSF (Encapsulated PostScript) +#>65 string FFIL (font suitcase) +#>65 string FKEY (function key) +#>65 string FNDR (Macintosh Finder) +#>65 string GIFf (GIF image) +#>65 string Gzip (GNU gzip) +#>65 string INIT (system extension) +#>65 string LIB\ (library) +#>65 string LWFN (PostScript font) +#>65 string MSBC (Microsoft BASIC) +#>65 string PACT (Compact Pro archive) +#>65 string PDF\ (Portable Document Format) +#>65 string PICT (picture) +#>65 string PNTG (MacPaint picture) +#>65 string PREF (preferences) +#>65 string PROJ (Think C project) +#>65 string QPRJ (Think Pascal project) +#>65 string SCFL (Defender scores) +#>65 string SCRN (startup screen) +#>65 string SITD (StuffIt Deluxe) +#>65 string SPn3 (SuperPaint) +#>65 string STAK (HyperCard stack) +#>65 string Seg\ (StuffIt segment) +#>65 string TARF (Unix tar archive) +#>65 string TEXT (ASCII) +#>65 string TIFF (TIFF image) +#>65 string TOVF (Eudora table of contents) +#>65 string WDBN (Microsoft Word word processor) +#>65 string WORD (MacWrite word processor) +#>65 string XLS\ (Microsoft Excel) +#>65 string ZIVM (compress (.Z)) +#>65 string ZSYS (Pre-System 7 system file) +#>65 string acf3 (Aldus FreeHand) +#>65 string cdev (control panel) +#>65 string dfil (Desk Acessory suitcase) +#>65 string libr (library) +#>65 string nX^d (WriteNow word processor) +#>65 string nX^w (WriteNow dictionary) +#>65 string rsrc (resource) +#>65 string scbk (Scrapbook) +#>65 string shlb (shared library) +#>65 string ttro (SimpleText read-only) +#>65 string zsys (system file) + +#>69 string x \b, creator "%4.4s" + +# Somewhere, Apple has a repository of registered Creator IDs. These are +# just the ones that I happened to have files from and was able to identify. + +#>69 string 8BIM (Adobe Photoshop) +#>69 string ALD3 (PageMaker 3) +#>69 string ALD4 (PageMaker 4) +#>69 string ALFA (Alpha editor) +#>69 string APLS (Apple Scanner) +#>69 string APSC (Apple Scanner) +#>69 string BRKL (Brickles) +#>69 string BTFT (BitFont) +#>69 string CCL2 (Common Lisp 2) +#>69 string CCL\ (Common Lisp) +#>69 string CDmo (The Talking Moose) +#>69 string CPCT (Compact Pro) +#>69 string CSOm (Eudora) +#>69 string DMOV (Font/DA Mover) +#>69 string DSIM (DigSim) +#>69 string EDIT (Macintosh Edit) +#>69 string ERIK (Macintosh Finder) +#>69 string EXTR (self-extracting archive) +#>69 string Gzip (GNU gzip) +#>69 string KAHL (Think C) +#>69 string LWFU (LaserWriter Utility) +#>69 string LZIV (compress) +#>69 string MACA (MacWrite) +#>69 string MACS (Macintosh operating system) +#>69 string MAcK (MacKnowledge terminal emulator) +#>69 string MLND (Defender) +#>69 string MPNT (MacPaint) +#>69 string MSBB (Microsoft BASIC (binary)) +#>69 string MSWD (Microsoft Word) +#>69 string NCSA (NCSA Telnet) +#>69 string PJMM (Think Pascal) +#>69 string PSAL (Hunt the Wumpus) +#>69 string PSI2 (Apple File Exchange) +#>69 string R*ch (BBEdit) +#>69 string RMKR (Resource Maker) +#>69 string RSED (Resource Editor) +#>69 string Rich (BBEdit) +#>69 string SIT! (StuffIt) +#>69 string SPNT (SuperPaint) +#>69 string Unix (NeXT Mac filesystem) +#>69 string VIM! (Vim editor) +#>69 string WILD (HyperCard) +#>69 string XCEL (Microsoft Excel) +#>69 string aCa2 (Fontographer) +#>69 string aca3 (Aldus FreeHand) +#>69 string dosa (Macintosh MS-DOS file system) +#>69 string movr (Font/DA Mover) +#>69 string nX^n (WriteNow) +#>69 string pdos (Apple ProDOS file system) +#>69 string scbk (Scrapbook) +#>69 string ttxt (SimpleText) +#>69 string ufox (Foreign File Access) + +# Just in case... + +102 string mBIN MacBinary III data with surprising version number + +# sas magic from Bruce Foster (bef@nwu.edu) +# +#0 string SAS SAS +#>8 string x %s +0 string SAS SAS +>24 string DATA data file +>24 string CATALOG catalog +>24 string INDEX data file index +>24 string VIEW data view +# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com) +# +0x54 string SAS SAS 7+ +>0x9C string DATA data file +>0x9C string CATALOG catalog +>0x9C string INDEX data file index +>0x9C string VIEW data view + +# spss magic for SPSS system and portable files, +# from Bruce Foster (bef@nwu.edu). + +0 long 0xc1e2c3c9 SPSS Portable File +>40 string x %s + +0 string $FL2 SPSS System File +>24 string x %s + +# Macintosh filesystem data +# From "Tom N Harris" <telliamed@mac.com> +# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net> +# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these +# entries depend on the data arithmetic added after v.35 +# There's also some Pascal strings in here, ditto... + +# The boot block signature, according to IM:Files, is +# "for HFS volumes, this field always contains the value 0x4C4B." +# But if this is true for MFS or HFS+ volumes, I don't know. +# Alternatively, the boot block is supposed to be zeroed if it's +# unused, so a simply >0 should suffice. + +0x400 beshort 0xD2D7 Macintosh MFS data +>0 beshort 0x4C4B (bootable) +>0x40a beshort &0x8000 (locked) +>0x402 beldate-0x7C25B080 x created: %s, +>0x406 beldate-0x7C25B080 >0 last backup: %s, +>0x414 belong x block size: %d, +>0x412 beshort x number of blocks: %d, +>0x424 pstring x volume name: %s + +# "BD" is has many false positives +#0x400 beshort 0x4244 Macintosh HFS data +#>0 beshort 0x4C4B (bootable) +#>0x40a beshort &0x8000 (locked) +#>0x40a beshort ^0x0100 (mounted) +#>0x40a beshort &0x0200 (spared blocks) +#>0x40a beshort &0x0800 (unclean) +#>0x47C beshort 0x482B (Embedded HFS+ Volume) +#>0x402 beldate-0x7C25B080 x created: %s, +#>0x406 beldate-0x7C25B080 x last modified: %s, +#>0x440 beldate-0x7C25B080 >0 last backup: %s, +#>0x414 belong x block size: %d, +#>0x412 beshort x number of blocks: %d, +#>0x424 pstring x volume name: %s + +0x400 beshort 0x482B Macintosh HFS Extended +>&0 beshort x version %d data +>0 beshort 0x4C4B (bootable) +>0x404 belong ^0x00000100 (mounted) +>&2 belong &0x00000200 (spared blocks) +>&2 belong &0x00000800 (unclean) +>&2 belong &0x00008000 (locked) +>&6 string x last mounted by: '%.4s', +# really, that should be treated as a belong and we print a string +# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1" +>&14 beldate-0x7C25B080 x created: %s, +# only the creation date is local time, all other timestamps in HFS+ are UTC. +>&18 bedate-0x7C25B080 x last modified: %s, +>&22 bedate-0x7C25B080 >0 last backup: %s, +>&26 bedate-0x7C25B080 >0 last checked: %s, +>&38 belong x block size: %d, +>&42 belong x number of blocks: %d, +>&46 belong x free blocks: %d + +# I don't think this is really necessary since it doesn't do much and +# anything with a valid driver descriptor will also have a valid +# partition map +#0 beshort 0x4552 Apple Device Driver data +#>&24 beshort =1 \b, MacOS + +# Is that the partition type a cstring or a pstring? Well, IM says "strings +# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a +# cstring. Of course, partitions can contain more than four entries, but +# what're you gonna do? +0x200 beshort 0x504D Apple Partition data +>0x2 beshort x block size: %d, +>0x230 string x first type: %s, +>0x210 string x name: %s, +>0x254 belong x number of blocks: %d, +>0x400 beshort 0x504D +>>0x430 string x second type: %s, +>>0x410 string x name: %s, +>>0x454 belong x number of blocks: %d, +>>0x800 beshort 0x504D +>>>0x830 string x third type: %s, +>>>0x810 string x name: %s, +>>>0x854 belong x number of blocks: %d, +>>>0xa00 beshort 0x504D +>>>>0xa30 string x fourth type: %s, +>>>>0xa10 string x name: %s, +>>>>0xa54 belong x number of blocks: %d +# AFAIK, only the signature is different +0x200 beshort 0x5453 Apple Old Partition data +>0x2 beshort x block size: %d, +>0x230 string x first type: %s, +>0x210 string x name: %s, +>0x254 belong x number of blocks: %d, +>0x400 beshort 0x504D +>>0x430 string x second type: %s, +>>0x410 string x name: %s, +>>0x454 belong x number of blocks: %d, +>>0x800 beshort 0x504D +>>>0x830 string x third type: %s, +>>>0x810 string x name: %s, +>>>0x854 belong x number of blocks: %d, +>>>0xa00 beshort 0x504D +>>>>0xa30 string x fourth type: %s, +>>>>0xa10 string x name: %s, +>>>>0xa54 belong x number of blocks: %d + +# From: Remi Mommsen <mommsen@slac.stanford.edu> +0 string BOMStore Mac OS X bill of materials (BOM) fil diff --git a/usr.bin/file/magdir/magic b/usr.bin/file/magdir/magic index 9818e522b9a..3d7b3651c59 100644 --- a/usr.bin/file/magdir/magic +++ b/usr.bin/file/magdir/magic @@ -1,6 +1,10 @@ -# $OpenBSD: magic,v 1.2 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: magic,v 1.3 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # magic: file(1) magic for magic files # 0 string #\ Magic magic text file for file(1) cmd +0 lelong 0xF11E041C magic binary file for file(1) cmd +>4 lelong x (version %d) (little endian) +0 belong 0xF11E041C magic binary file for file(1) cmd +>4 belong x (version %d) (big endian) diff --git a/usr.bin/file/magdir/mail.news b/usr.bin/file/magdir/mail.news index 8ac7cbfff69..66b35309085 100644 --- a/usr.bin/file/magdir/mail.news +++ b/usr.bin/file/magdir/mail.news @@ -1,4 +1,4 @@ -# $OpenBSD: mail.news,v 1.4 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: mail.news,v 1.5 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # mail.news: file(1) magic for mail and news @@ -37,5 +37,6 @@ # Squish Fidonet message area databases # SQD file (requires at least one message in the area) -256 leshort 0xAFAE4453 Squish message area data file ->4 leshort >0 (%d messages) +# XXX: Weak magic +#256 leshort 0xAFAE4453 Squish message area data file +#>4 leshort >0 (%d messages) diff --git a/usr.bin/file/magdir/maple b/usr.bin/file/magdir/maple index 7290c27035f..4f5bc2f6d83 100644 --- a/usr.bin/file/magdir/maple +++ b/usr.bin/file/magdir/maple @@ -1,4 +1,4 @@ -# $OpenBSD: maple,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: maple,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # maple: file(1) magic for maple files @@ -33,7 +33,6 @@ # that is {VERSION major_version miunor_version computer_type version_string} 0 string {VERSION\ Maple worksheet >9 string >\0 version %.1s. ->>10 string >>>11 string >\0 %.1s # .mps diff --git a/usr.bin/file/magdir/mathematica b/usr.bin/file/magdir/mathematica index 8cf58d2cfff..0738918d1e4 100644 --- a/usr.bin/file/magdir/mathematica +++ b/usr.bin/file/magdir/mathematica @@ -1,4 +1,4 @@ -# $OpenBSD: mathematica,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: mathematica,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # mathematica: file(1) magic for mathematica files @@ -25,7 +25,7 @@ # generic: 0 string (*^\r\r::[\011 Mathematica notebook version 2.x -0 string \(\*\^\r\n\r\n\:\:\[\011 Mathematica notebook version 2.x +0 string (*^\r\n\r\n::[\011 Mathematica notebook version 2.x 0 string (*^\015 Mathematica notebook version 2.x 0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x 0 string (*^\r::[\011 Mathematica notebook version 2.x diff --git a/usr.bin/file/magdir/matroska b/usr.bin/file/magdir/matroska new file mode 100644 index 00000000000..ca00db4b206 --- /dev/null +++ b/usr.bin/file/magdir/matroska @@ -0,0 +1,14 @@ + +#------------------------------------------------------------------------------ +# matroska: file(1) magic for Matroska files +# +# See http://www.matroska.org/ +# + +# EBML id: +0 belong 0x1a45dfa3 +# DocType id: +>5 beshort 0x4282 +# DocType contents: +>>8 string matroska Matroska data + diff --git a/usr.bin/file/magdir/mime b/usr.bin/file/magdir/mime index 3a082c4e052..534e1247e6c 100644 --- a/usr.bin/file/magdir/mime +++ b/usr.bin/file/magdir/mime @@ -1,9 +1,9 @@ -# $OpenBSD: mime,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: mime,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # mime: file(1) magic for MIME encoded files # -0 string Content-Type:\ +0 string Content-Type:\ >14 string >\0 %s 0 string Content-Type: >13 string >\0 %s diff --git a/usr.bin/file/magdir/mips b/usr.bin/file/magdir/mips new file mode 100644 index 00000000000..634eff4106b --- /dev/null +++ b/usr.bin/file/magdir/mips @@ -0,0 +1,177 @@ + +#------------------------------------------------------------------------------ +# mips: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.) +# Dec Ultrix (MIPS) +# all of SGI's *current* machines and OSes run in big-endian mode on the +# MIPS machines, as far as I know. +# +# XXX - what is the blank "-" line? +# +# kbd file definitions +0 string kbd!map kbd map file +>8 byte >0 Ver %d: +>10 short >0 with %d table(s) +0 belong 0407 old SGI 68020 executable +0 belong 0410 old SGI 68020 pure executable +0 beshort 0x8765 disk quotas file +0 beshort 0x0506 IRIS Showcase file +>2 byte 0x49 - +>3 byte x - version %ld +0 beshort 0x0226 IRIS Showcase template +>2 byte 0x63 - +>3 byte x - version %ld +0 belong 0x5343464d IRIS Showcase file +>4 byte x - version %ld +0 belong 0x5443464d IRIS Showcase template +>4 byte x - version %ld +0 belong 0xdeadbabe IRIX Parallel Arena +>8 belong >0 - version %ld +# +0 beshort 0x0160 MIPSEB ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x0162 MIPSEL-BE ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %d +>22 byte x .%ld +# +0 beshort 0x6001 MIPSEB-LE ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %d +>22 byte x .%ld +# +0 beshort 0x6201 MIPSEL ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>22 byte x .%ld +# +# MIPS 2 additions +# +0 beshort 0x0163 MIPSEB MIPS-II ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x0166 MIPSEL-BE MIPS-II ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x6301 MIPSEB-LE MIPS-II ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>22 byte x .%ld +# +0 beshort 0x6601 MIPSEL MIPS-II ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>22 byte x .%ld +# +# MIPS 3 additions +# +0 beshort 0x0140 MIPSEB MIPS-III ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x0142 MIPSEL-BE MIPS-III ECOFF executable +>20 beshort 0407 (impure) +>20 beshort 0410 (swapped) +>20 beshort 0413 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>22 byte x - version %ld +>23 byte x .%ld +# +0 beshort 0x4001 MIPSEB-LE MIPS-III ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>22 byte x .%ld +# +0 beshort 0x4201 MIPSEL MIPS-III ECOFF executable +>20 beshort 03401 (impure) +>20 beshort 04001 (swapped) +>20 beshort 05401 (paged) +>8 belong >0 not stripped +>8 belong 0 stripped +>23 byte x - version %ld +>22 byte x .%ld +# +0 beshort 0x180 MIPSEB Ucode +0 beshort 0x182 MIPSEL-BE Ucode +# 32bit core file +0 belong 0xdeadadb0 IRIX core dump +>4 belong 1 of +>16 string >\0 '%s' +# 64bit core file +0 belong 0xdeadad40 IRIX 64-bit core dump +>4 belong 1 of +>16 string >\0 '%s' +# N32bit core file +0 belong 0xbabec0bb IRIX N32 core dump +>4 belong 1 of +>16 string >\0 '%s' +# New style crash dump file +0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of +>36 string >\0 '%s' +# Trusted IRIX info +0 string SGIAUDIT SGI Audit file +>8 byte x - version %d +>9 byte x .%ld +# +0 string WNGZWZSC Wingz compiled script +0 string WNGZWZSS Wingz spreadsheet +0 string WNGZWZHP Wingz help file +# +0 string #Inventor V IRIS Inventor 1.0 file +0 string #Inventor V2 Open Inventor 2.0 file +# GLF is OpenGL stream encoding +0 string glfHeadMagic(); GLF_TEXT +4 belong 0x7d000000 GLF_BINARY_LSB_FIRST +4 belong 0x0000007d GLF_BINARY_MSB_FIRST +# GLS is OpenGL stream encoding; GLS is the successor of GLF +0 string glsBeginGLS( GLS_TEXT +4 belong 0x10000000 GLS_BINARY_LSB_FIRST +4 belong 0x00000010 GLS_BINARY_MSB_FIRST diff --git a/usr.bin/file/magdir/misctools b/usr.bin/file/magdir/misctools index f72ed5cf768..9715119e4cc 100644 --- a/usr.bin/file/magdir/misctools +++ b/usr.bin/file/magdir/misctools @@ -1,7 +1,15 @@ -# $OpenBSD: misctools,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: misctools,v 1.2 2008/05/08 01:40:57 chl Exp $ #----------------------------------------------------------------------------- # misctools: file(1) magic for miscelanous UNIX tools. # -0 string %%!! X-Post-It-Note text -0 string BEGIN:VCALENDAR vCalendar calendar file +0 string %%!! X-Post-It-Note text +0 string/c BEGIN:VCALENDAR vCalendar calendar file +0 string/c BEGIN:VCARD vCard visiting card + +# From: Alex Beregszaszi <alex@fsn.hu> +4 string gtktalog GNOME Catalogue (gtktalog) +>13 string >\0 version %s + +# From: Tomasz Trojanowski <tomek@uninet.com.pl> +0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file diff --git a/usr.bin/file/magdir/modules b/usr.bin/file/magdir/modules deleted file mode 100644 index d0c825a50f5..00000000000 --- a/usr.bin/file/magdir/modules +++ /dev/null @@ -1,120 +0,0 @@ -# $OpenBSD: modules,v 1.2 2001/01/29 01:57:57 niklas Exp $ - -# Magic file entries for several module formats -# by Claudio Matsuoka <claudio@pos.inf.ufpr.br> -# -# 4, 6 and 8 channel Protracker/Noisetracker/Fasttracker modules -# -1080 string M.K. Protracker module ->0 string >\0 - "%.20s" -1080 string M!K! Protracker 2.3 module ->0 string >\0 - "%.20s" -1080 string M&K! Noisetracker module ->0 string >\0 - "%.20s" -1080 string EMW3 UNIC-Tracker module ->0 string >\0 - "%.20s" -1080 string FLT4 Startrekker 4 channel module ->0 string >\0 - "%.20s" -1080 string FLT8 Startrekker 8 channel module ->0 string >\0 - "%.20s" -1080 string 6CHN Fasttracker 6 channel module ->0 string >\0 - "%.20s" -1080 string 8CHN Fasttracker 8 channel module ->0 string >\0 - "%.20s" -1081 string CHN TakeTracker ->1080 string x "%-1.1s channel module" ->0 string >\0 - "%.20s" -# -# Scream Tracker 2 modules -# -20 string !Scream! Scream Tracker ->30 byte 1 ->>31 byte x 1.%02d module ->30 byte 2 ->>31 byte x 2.%d module ->0 string >\0 - "%.20s" -# -# Scream Tracker 3 modules -# -44 string SCRM Scream Tracker ->41 byte 0x13 ->>40 byte x 3.%02x module ->0 string >\0 - "%.28s" -# -# Poly Tracker modules -# -44 string PTMF Poly Tracker ->30 byte 0 ->>29 byte x 1.%02d module ->30 byte 2 ->>29 byte x 2.%02d module ->0 string >\0 - "%.28s" -# -# Fast Tracker II extended modules -# -0 string Extended\040Module:\040 Fasttracker II module ->59 byte 0 ->>58 byte x v0.%02d ->59 byte 1 ->>58 byte x v1.%02d ->59 byte 2 ->>58 byte x v2.%02d ->17 string >\0 - "%.20s" -# -# Real Tracker modules -# -0 string RTMM Real Tracker module -5 string ?\0 - "%.32s" -# -# Oktalyzer modules -# -0 string OKTASONG Oktalyzer module -# -# Farandole Composer modules -# -0 string FAR\xfe ->4 string >\0 Farandole Composer module - "%.40s" -# -# Impulse Tracker modules -# -0 string IMPM Impulse Tracker module ->43 byte 0 ->>42 byte x v0.%02d ->43 byte 1 ->>42 byte x v1.%02d ->43 byte 2 ->>42 byte x v2.%02d ->4 string >\0 - "%.26s" ->44 byte ^0x04 (sample mode) ->44 byte &0x04 (instrument mode) -# -# Powerpacked modules -# -0 string PP20 Powerpacked module -# -# Aley Keptr's ALM module format -# -0 string ALEY\040MOD Aley's module version 1.0 -0 string ALEYMOD Aley's module version 1.1 or 1.2 -# -# Amusic Adlib tracker module -# -1068 string RoR Amusic Adlib module ->0 string >\0 - "%.24s" -# -# Reality Adlib Tracker module -# -0 string RAD Reality Adlib Tracker module -# -# Multitracker modules -# -0 string MTM ->4 string >\0 Multitracker module - "%.20s" -# -# Composer 669 modules -# -0 string if ->240 byte 0xff Composer 669 module -0 string JN ->240 byte 0xff UNIS 669 module - diff --git a/usr.bin/file/magdir/msdos b/usr.bin/file/magdir/msdos index 9f57979e958..fe537ac4b88 100644 --- a/usr.bin/file/magdir/msdos +++ b/usr.bin/file/magdir/msdos @@ -1,41 +1,263 @@ -# $OpenBSD: msdos,v 1.3 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: msdos,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # msdos: file(1) magic for MS-DOS files # # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) -0 string @echo\ off MS-DOS batch file text +# updated by Joerg Jenderek +0 string @ +>1 string/cB \ echo\ off MS-DOS batch file text +>1 string/cB echo\ off MS-DOS batch file text +>1 string/cB rem\ MS-DOS batch file text +>1 string/cB set\ MS-DOS batch file text -# .EXE formats (Greg Roelofs, newt@uchicago.edu) + +# OS/2 batch files are REXX. the second regex is a bit generic, oh well +# the matched commands seem to be common in REXX and uncommon elsewhere +100 regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc OS/2 REXX batch file text +100 regex/c =^[\ \t]{0,10}say\ ['"] OS/2 REXX batch file text + + +100 regex/c =^\\s*call\\s+rxfuncadd.*sysloadfu OS/2 REXX batch file text +100 regex/c =^\\s*say\ ['"] OS/2 REXX batch file text + +0 leshort 0x14c MS Windows COFF Intel 80386 object file +#>4 ledate x stamp %s +0 leshort 0x166 MS Windows COFF MIPS R4000 object file +#>4 ledate x stamp %s +0 leshort 0x184 MS Windows COFF Alpha object file +#>4 ledate x stamp %s +0 leshort 0x268 MS Windows COFF Motorola 68000 object file +#>4 ledate x stamp %s +0 leshort 0x1f0 MS Windows COFF PowerPC object file +#>4 ledate x stamp %s +0 leshort 0x290 MS Windows COFF PA-RISC object file +#>4 ledate x stamp %s + +# XXX - according to Microsoft's spec, at an offset of 0x3c in a +# PE-format executable is the offset in the file of the PE header; +# unfortunately, that's a little-endian offset, and there's no way +# to specify an indirect offset with a specified byte order. +# So, for now, we assume the standard MS-DOS stub, which puts the +# PE header at 0x80 = 128. # -0 string MZ MS-DOS executable (EXE) ->24 string @ \b, OS/2 or Windows ->1638 string -lh5- \b, LHa SFX archive v2.13S ->7195 string Rar! \b, RAR self-extracting archive +# Required OS version and subsystem version were 4.0 on some NT 3.51 +# executables built with Visual C++ 4.0, so it's not clear that +# they're interesting. The user version was 0.0, but there's +# probably some linker directive to set it. The linker version was +# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!). # -# [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than -# 8161 bytes are ignored. To make the following entries work, increase -# HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2, -# NT/Win32 and VMS.] -# [GRR: some company sells a self-extractor/displayer for image data(!)] +# many of the compressed formats were extraced from IDARC 1.23 source code # ->11696 string PK\003\004 \b, PKZIP SFX archive v1.1 ->13297 string PK\003\004 \b, PKZIP SFX archive v1.93a ->15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09 ->15770 string PK\003\004 \b, PKZIP SFX archive v2.04g ->28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02 +0 string MZ MS-DOS executable +>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows +>>&18 leshort&0x2000 >0 (DLL) +>>&88 leshort 0 (unknown subsystem) +>>&88 leshort 1 (native) +>>&88 leshort 2 (GUI) +>>&88 leshort 3 (console) +>>&88 leshort 7 (POSIX) +>>&0 leshort 0x0 unknown processor +>>&0 leshort 0x14c Intel 80386 +>>&0 leshort 0x166 MIPS R4000 +>>&0 leshort 0x184 Alpha +>>&0 leshort 0x268 Motorola 68000 +>>&0 leshort 0x1f0 PowerPC +>>&0 leshort 0x290 PA-RISC +>>&18 leshort&0x0100 >0 32-bit +>>&18 leshort&0x1000 >0 system file +>>&0xf4 search/0x140 \x0\x40\x1\x0 +>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive + +>0x18 leshort >0x3f +>>(0x3c.l) string PE\0\0 PE +# hooray, there's a DOS extender using the PE format, with a valid PE +# executable inside (which just prints a message and exits if run in win) +>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender +>>>(8.s*16) string !32STUB for MS Windows +>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL) +>>>>(0x3c.l+92) leshort 0 (unknown subsystem) +>>>>(0x3c.l+92) leshort 1 (native) +>>>>(0x3c.l+92) leshort 2 (GUI) +>>>>(0x3c.l+92) leshort 3 (console) +>>>>(0x3c.l+92) leshort 7 (POSIX) +>>>>(0x3c.l+4) leshort 0x0 unknown processor +>>>>(0x3c.l+4) leshort 0x14c Intel 80386 +>>>>(0x3c.l+4) leshort 0x166 MIPS R4000 +>>>>(0x3c.l+4) leshort 0x184 Alpha +>>>>(0x3c.l+4) leshort 0x268 Motorola 68000 +>>>>(0x3c.l+4) leshort 0x1f0 PowerPC +>>>>(0x3c.l+4) leshort 0x290 PA-RISC +>>>>(0x3c.l+22) leshort&0x0100 >0 32-bit +>>>>(0x3c.l+22) leshort&0x1000 >0 system file +>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly + +>>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed +>>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed +>>>>(0x3c.l+0xf8) search/0x140 UPX2 +>>>>>(&0x10.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) +>>>>(0x3c.l+0xf8) search/0x140 .idata +>>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (Info-Zip) +>>>>>(&0xe.l+(-4)) string ZZ0 \b, ZZip self-extracting archive +>>>>>(&0xe.l+(-4)) string ZZ1 \b, ZZip self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .rsrc +>>>>>(&0x0f.l+(-4)) string a\\\4\5 \b, WinHKI self-extracting archive +>>>>>(&0x0f.l+(-4)) string Rar! \b, RAR self-extracting archive +>>>>>(&0x0f.l+(-4)) search/0x3000 MSCF \b, InstallShield self-extracting archive +>>>>>(&0x0f.l+(-4)) search/32 Nullsoft \b, Nullsoft Installer self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .data +>>>>>(&0x0f.l) string WEXTRACT \b, MS CAB-Installer self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .petite\0 \b, Petite compressed +>>>>>(0x3c.l+0xf7) byte x +>>>>>>(&0x104.l+(-4)) string =!sfx! \b, ACE self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .WISE \b, WISE installer self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .dz\0\0\0 \b, Dzip self-extracting archive +>>>>(0x3c.l+0xf8) search/0x140 .reloc +>>>>>(&0xe.l+(-4)) search/0x180 PK\3\4 \b, ZIP self-extracting archive (WinZip) + +>>>>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip) +>>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive +>>>>0x30 string Inno \b, InnoSetup self-extracting archive + +>>(0x3c.l) string NE \b, NE +>>>(0x3c.l+0x36) byte 0 (unknown OS) +>>>(0x3c.l+0x36) byte 1 for OS/2 1.x +>>>(0x3c.l+0x36) byte 2 for MS Windows 3.x +>>>(0x3c.l+0x36) byte 3 for MS-DOS +>>>(0x3c.l+0x36) byte >3 (unknown OS) +>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender +>>>(0x3c.l+0x0c) leshort&0x8003 0x8002 (DLL) +>>>(0x3c.l+0x0c) leshort&0x8003 0x8001 (driver) +>>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive +>>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) + +>>(0x3c.l) string LX\0\0 \b, LX +>>>(0x3c.l+0x0a) leshort <1 (unknown OS) +>>>(0x3c.l+0x0a) leshort 1 for OS/2 +>>>(0x3c.l+0x0a) leshort 2 for MS Windows +>>>(0x3c.l+0x0a) leshort 3 for DOS +>>>(0x3c.l+0x0a) leshort >3 (unknown OS) +>>>(0x3c.l+0x10) lelong&0x28000 =0x8000 (DLL) +>>>(0x3c.l+0x10) lelong&0x20000 >0 (device driver) +>>>(0x3c.l+0x10) lelong&0x300 0x300 (GUI) +>>>(0x3c.l+0x10) lelong&0x28300 <0x300 (console) +>>>(0x3c.l+0x08) leshort 1 i80286 +>>>(0x3c.l+0x08) leshort 2 i80386 +>>>(0x3c.l+0x08) leshort 3 i80486 +>>>(8.s*16) string emx \b, emx +>>>>&1 string x %s +>>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive + +# MS Windows system file, supposedly a collection of LE executables +>>(0x3c.l) string W3 \b, W3 for MS Windows + +>>(0x3c.l) string LE\0\0 \b, LE executable +>>>(0x3c.l+0x0a) leshort 1 +# some DOS extenders use LE files with OS/2 header +>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender +>>>>0x240 search/0x200 WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender +>>>>0x440 search/0x100 CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender +>>>>0x40 search/0x40 PMODE/W for MS-DOS, PMODE/W DOS extender +>>>>0x40 search/0x40 STUB/32A for MS-DOS, DOS/32A DOS extender (stub) +>>>>0x40 search/0x80 STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub) +>>>>0x40 search/0x80 DOS/32A for MS-DOS, DOS/32A DOS extender (embedded) +# this is a wild guess; hopefully it is a specific signature +>>>>&0x24 lelong <0x50 +>>>>>(&0x4c.l) string \xfc\xb8WATCOM +>>>>>>&0 search/8 3\xdbf\xb9 \b, 32Lite compressed +# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP +#>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 +# fails with DOS-Extenders. +>>>(0x3c.l+0x0a) leshort 2 for MS Windows +>>>(0x3c.l+0x0a) leshort 3 for DOS +>>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) +>>>(&0x7c.l+0x26) string UPX \b, UPX compressed +>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive + +# looks like ASCII, probably some embedded copyright message. +# and definitely not NE/LE/LX/PE +>>0x3c lelong >0x20000000 +>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS +# header data too small for extended executable +>2 long !0 +>>0x18 leshort <0x40 +>>>(4.s*512) leshort !0x014c + +>>>>&(2.s-514) string !LE +>>>>>&-2 string !BW \b, MZ for MS-DOS +>>>>&(2.s-514) string LE \b, LE +>>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender +# educated guess since indirection is still not capable enough for complex offset +# calculations (next embedded executable would be at &(&2*512+&0-2) +# I suspect there are only LE executables in these multi-exe files +>>>>&(2.s-514) string BW +>>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded) +>>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS + +# This sequence skips to the first COFF segment, usually .text +>(4.s*512) leshort 0x014c \b, COFF +>>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender +>>(8.s*16) string emx +>>>&1 string x for DOS, Win or OS/2, emx %s +>>&(&0x42.l-3) byte x +>>>&0x26 string UPX \b, UPX compressed +# and yet another guess: small .text, and after large .data is unusal, could be 32lite +>>&0x2c search/0xa0 .text +>>>&0x0b lelong <0x2000 +>>>>&0 lelong >0x6000 \b, 32lite compressed + +>(8.s*16) string $WdX \b, WDos/X DOS extender + +# .EXE formats (Greg Roelofs, newt@uchicago.edu) # -# Info-ZIP self-extractors -# these are the DOS versions: ->25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12 ->26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption -# these are the OS/2 versions (OS/2 is flagged above): ->47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12 ->49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption -# this is the NT/Win32 version: ->69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption +>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed +>0xe7 string LH/2\ Self-Extract \b, %s +>0x1c string diet \b, diet compressed +>0x1c string LZ09 \b, LZEXE v0.90 compressed +>0x1c string LZ91 \b, LZEXE v0.91 compressed +>0x1c string tz \b, TinyProg compressed +>0x1e string PKLITE \b, %s compressed +>0x64 string W\ Collis\0\0 \b, Compack compressed +>0x24 string LHa's\ SFX \b, LHa self-extracting archive +>0x24 string LHA's\ SFX \b, LHa self-extracting archive +>0x24 string \ $ARX \b, ARX self-extracting archive +>0x24 string \ $LHarc \b, LHarc self-extracting archive +>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive +>1638 string -lh5- \b, LHa self-extracting archive v2.13S +>0x17888 string Rar! \b, RAR self-extracting archive +>0x40 string aPKG \b, aPackage self-extracting archive + +>32 string AIN +>>35 string 2 \b, AIN 2.x compressed +>>35 string <2 \b, AIN 1.x compressed +>>35 string >2 \b, AIN 1.x compressed +>28 string UC2X \b, UCEXE compressed +>28 string WWP\ \b, WWPACK compressed + +# skip to the end of the exe +>(4.s*512) long x +>>&(2.s-517) byte x +>>>&0 string PK\3\4 \b, ZIP self-extracting archive +>>>&0 string Rar! \b, RAR self-extracting archive +>>>&0 string =!\x11 \b, AIN 2.x self-extracting archive +>>>&0 string =!\x12 \b, AIN 2.x self-extracting archive +>>>&0 string =!\x17 \b, AIN 1.x self-extracting archive +>>>&0 string =!\x18 \b, AIN 1.x self-extracting archive +>>>&7 search/400 **ACE** \b, ACE self-extracting archive +>>>&0 search/0x480 UC2SFX\ Header \b, UC2 self-extracting archive + +>0x1c string RJSX \b, ARJ self-extracting archive +# winarj stores a message in the stub instead of the sig in the MZ header +>0x20 search/0xe0 aRJsfX \b, ARJ self-extracting archive + +# a few unknown ZIP sfxes, no idea if they are needed or if they are +# already captured by the generic patterns above +>122 string Windows\ self-extracting\ ZIP \b, ZIP self-extracting archive +>(8.s*16) search/0x20 PKSFX \b, ZIP self-extracting archive (PKZIP) +# TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive # + # TELVOX Teleinformatica CODEC self-extractor for OS/2: >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21 >>49824 leshort =1 \b, 1 file @@ -45,30 +267,363 @@ # Uncommenting only the first two lines will cover about 2/3 of COM files, # but it isn't feasible to match all COM files since there must be at least # two dozen different one-byte "magics". -#0 byte 0xe9 MS-DOS executable (COM) -#0 byte 0x8c MS-DOS executable (COM) +0 byte 0xe9 DOS executable (COM) +>0x1FE leshort 0xAA55 \b, boot code +>6 string SFX\ of\ LHarc (%s) +0 belong 0xffffffff DOS executable (device driver) +#CMD640X2.SYS +>10 string >\x23 +>>10 string !\x2e +>>>17 string <\x5B +>>>>10 string x \b, name: %.8s +#UDMA.SYS KEYB.SYS CMD640X2.SYS +>10 string <\x41 +>>12 string >\x40 +>>>10 string !$ +>>>>12 string x \b, name: %.8s +#BTCDROM.SYS ASPICD.SYS +>22 string >\x40 +>>22 string <\x5B +>>>23 string <\x5B +>>>>22 string x \b, name: %.8s +#ATAPICD.SYS +>76 string \0 +>>77 string >\x40 +>>>77 string <\x5B +>>>>77 string x \b, name: %.8s +0 byte 0x8c DOS executable (COM) # 0xeb conflicts with "sequent" magic -#0 byte 0xeb MS-DOS executable (COM) -#0 byte 0xb8 MS-DOS executable (COM) +0 byte 0xeb DOS executable (COM) +>0x1FE leshort 0xAA55 \b, boot code +>85 string UPX \b, UPX compressed +>4 string \ $ARX \b, ARX self-extracting archive +>4 string \ $LHarc \b, LHarc self-extracting archive +>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive +0 byte 0xb8 COM executable +# modified by Joerg Jenderek +>1 lelong !0x21cd4cff for DOS +# http://syslinux.zytor.com/comboot.php +# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode +# start with assembler instructions mov eax,21cd4cffh +>1 lelong 0x21cd4cff (32-bit COMBOOT) +0 string \x81\xfc +>4 string \x77\x02\xcd\x20\xb9 +>>36 string UPX! FREE-DOS executable (COM), UPX compressed +252 string Must\ have\ DOS\ version DR-DOS executable (COM) +# GRR search is not working +#2 search/28 \xcd\x21 COM executable for MS-DOS +#WHICHFAT.cOM +2 string \xcd\x21 COM executable for DOS +#DELTREE.cOM DELTREE2.cOM +4 string \xcd\x21 COM executable for DOS +#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM +5 string \xcd\x21 COM executable for DOS +#DELTMP.COm HASFAT32.cOM +7 string \xcd\x21 +>0 byte !0xb8 COM executable for DOS +#COMP.cOM MORE.COm +10 string \xcd\x21 +>5 string !\xcd\x21 COM executable for DOS +#comecho.com +13 string \xcd\x21 COM executable for DOS +#HELP.COm EDIT.coM +18 string \xcd\x21 COM executable for MS-DOS +#NWRPLTRM.COm +23 string \xcd\x21 COM executable for MS-DOS +#LOADFIX.cOm LOADFIX.cOm +30 string \xcd\x21 COM executable for MS-DOS +#syslinux.com 3.11 +70 string \xcd\x21 COM executable for DOS +# many compressed/converted COMs start with a copy loop instead of a jump +0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS +0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS +>0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed +0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed +# FIXME: missing diet .com compression # miscellaneous formats 0 string LZ MS-DOS executable (built-in) #0 byte 0xf0 MS-DOS program library data # +# +# Windows Registry files. +# updated by Joerg Jenderek +0 string regf Windows NT/XP registry file +0 string CREG Windows 95/98/ME registry file +0 string SHCC3 Windows 3.1 registry file + + +# AAF files: +# <stuartc@rd.bbc.co.uk> Stuart Cunningham +0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage +>30 byte 9 (512B sectors) +>30 byte 12 (4kB sectors) +0 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage +>30 byte 9 (512B sectors) +>30 byte 12 (4kB sectors) + # Popular applications +# False positive with PPT +#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer 2080 string Microsoft\ Word\ 6.0\ Document %s +2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data +# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word) +2112 string MSWordDoc Microsoft Word document data +# +0 belong 0x31be0000 Microsoft Word Document +# +0 string PO^Q` Microsoft Word 6.0 Document # -0 belong 0x31be0000 Microsoft Word Document +0 string \376\067\0\043 Microsoft Office Document +0 string \333\245-\0\0\0 Microsoft Office Document # 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s +2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s +# +# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel) +2114 string Biff5 Microsoft Excel 5.0 Worksheet +# Italian MS-Excel +2121 string Biff5 Microsoft Excel 5.0 Worksheet +0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet # 0 belong 0x00001a00 Lotus 1-2-3 ->4 belong 0x00100400 wk3 document ->4 belong 0x02100400 wk4 document ->4 belong 0x07800100 fm3 or fmb document ->4 belong 0x07800000 fm3 or fmb document +>4 belong 0x00100400 wk3 document data +>4 belong 0x02100400 wk4 document data +>4 belong 0x07800100 fm3 or fmb document data +>4 belong 0x07800000 fm3 or fmb document data # 0 belong 0x00000200 Lotus 1-2-3 ->4 belong 0x06040600 wk1 document ->4 belong 0x06800200 fmt document +>4 belong 0x06040600 wk1 document data +>4 belong 0x06800200 fmt document data + +# Help files +0 string ?_\3\0 MS Windows Help Data + +# DeIsL1.isu what this is I don't know +0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is + +# Winamp .avs +#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player +0 string Nullsoft\ AVS\ Preset\ Winamp plug in + +# Hyper terminal: +0 string HyperTerminal\ hyperterm +>15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal + +# Windows Metafont .WMF +0 string \327\315\306\232 ms-windows metafont .wmf +0 string \002\000\011\000 ms-windows metafont .wmf +0 string \001\000\011\000 ms-windows metafont .wmf + +#tz3 files whatever that is (MS Works files) +0 string \003\001\001\004\070\001\000\000 tz3 ms-works file +0 string \003\002\001\004\070\001\000\000 tz3 ms-works file +0 string \003\003\001\004\070\001\000\000 tz3 ms-works file + +# PGP sig files .sig +#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig +0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig + +# windows zips files .dmf +0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file + + +# Windows help file FTG FTS +0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache + +# grp old windows 3.1 group files +0 string \120\115\103\103 MS Windows 3.1 group files + + +# lnk files windows symlinks +0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 MS Windows shortcut + +#ico files +0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows + +# Windows icons (Ian Springer <ips@fpk.hp.com>) +0 string \000\000\001\000 MS Windows icon resource +>4 byte 1 - 1 icon +>4 byte >1 - %d icons +>>6 byte >0 \b, %dx +>>>7 byte >0 \b%d +>>8 byte 0 \b, 256-colors +>>8 byte >0 \b, %d-colors + + +# .chr files +0 string PK\010\010BGI Borland font +>4 string >\0 %s +# then there is a copyright notice + + +# .bgi files +0 string pk\010\010BGI Borland device +>4 string >\0 %s +# then there is a copyright notice + + +# recycled/info the windows trash bin index +9 string \000\000\000\030\001\000\000\000 MS Windows recycled bin info + + +##### put in Either Magic/font or Magic/news +# Acroread or something files wrongly identified as G3 .pfm +# these have the form \000 \001 any? \002 \000 \000 +# or \000 \001 any? \022 \000 \000 +#0 string \000\001 pfm? +#>3 string \022\000\000Copyright\ yes +#>3 string \002\000\000Copyright\ yes +#>3 string >\0 oops, not a font file. Cancel that. +#it clashes with ttf files so put it lower down. + +# From Doug Lee via a FreeBSD pr +9 string GERBILDOC First Choice document +9 string GERBILDB First Choice database +9 string GERBILCLIP First Choice database +0 string GERBIL First Choice device file +9 string RABBITGRAPH RabbitGraph file +0 string DCU1 Borland Delphi .DCU file +0 string =!<spell> MKS Spell hash list (old format) +0 string =!<spell2> MKS Spell hash list +# Too simple - MPi +#0 string AH Halo(TM) bitmapped font file +0 lelong 0x08086b70 TurboC BGI file +0 lelong 0x08084b50 TurboC Font file + +# WARNING: below line conflicts with Infocom game data Z-machine 3 +0 byte 0x03 DBase 3 data file +>0x04 lelong 0 (no records) +>0x04 lelong >0 (%ld records) +0 byte 0x83 DBase 3 data file with memo(s) +>0x04 lelong 0 (no records) +>0x04 lelong >0 (%ld records) +0 leshort 0x0006 DBase 3 index file +0 string PMCC Windows 3.x .GRP file +1 string RDC-meg MegaDots +>8 byte >0x2F version %c +>9 byte >0x2F \b.%c file +0 lelong 0x4C +>4 lelong 0x00021401 Windows shortcut file + +# DOS EPS Binary File Header +# From: Ed Sznyter <ews@Black.Market.NET> +0 belong 0xC5D0D3C6 DOS EPS Binary File +>4 long >0 Postscript starts at byte %d +>>8 long >0 length %d +>>>12 long >0 Metafile starts at byte %d +>>>>16 long >0 length %d +>>>20 long >0 TIFF starts at byte %d +>>>>24 long >0 length %d + +# TNEF magic From "Joomy" <joomy@se-ed.net> +0 leshort 0x223e9f78 TNEF + +# HtmlHelp files (.chm) +0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data + +# GFA-BASIC (Wolfram Kleff) +2 string GFA-BASIC3 GFA-BASIC 3 data + +#------------------------------------------------------------------------------ +# From Stuart Caie <kyzer@4u.net> (developer of cabextract) +# Microsoft Cabinet files +0 string MSCF\0\0\0\0 Microsoft Cabinet archive data +>8 lelong x \b, %u bytes +>28 leshort 1 \b, 1 file +>28 leshort >1 \b, %u files + +# InstallShield Cabinet files +0 string ISc( InstallShield Cabinet archive data +>5 byte&0xf0 =0x60 version 6, +>5 byte&0xf0 !0x60 version 4/5, +>(12.l+40) lelong x %u files + +# Windows CE package files +0 string MSCE\0\0\0\0 Microsoft WinCE install header +>20 lelong 0 \b, architecture-independent +>20 lelong 103 \b, Hitachi SH3 +>20 lelong 104 \b, Hitachi SH4 +>20 lelong 0xA11 \b, StrongARM +>20 lelong 4000 \b, MIPS R4000 +>20 lelong 10003 \b, Hitachi SH3 +>20 lelong 10004 \b, Hitachi SH3E +>20 lelong 10005 \b, Hitachi SH4 +>20 lelong 70001 \b, ARM 7TDMI +>52 leshort 1 \b, 1 file +>52 leshort >1 \b, %u files +>56 leshort 1 \b, 1 registry entry +>56 leshort >1 \b, %u registry entries + +# Outlook Personal Folders +0 lelong 0x4E444221 Microsoft Outlook binary email folder +>10 leshort 0x0e (Outlook <=2002) +>10 leshort 0x17 (Outlook >=2003) + + +# From: Dirk Jagdmann <doj@cubic.org> +0 lelong 0x00035f3f Windows 3.x help file + +# Christophe Monniez +0 string Client\ UrlCache\ MMF Microsoft Internet Explorer Cache File +>20 string >\0 Version %s +0 string \xCF\xAD\x12\xFE Microsoft Outlook Express DBX File +>4 byte =0xC5 Message database +>4 byte =0xC6 Folder database +>4 byte =0xC7 Accounts informations +>4 byte =0x30 Offline database + + +# Windows Enhanced Metafile (EMF) +# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp +# for further information. Note that "0 lelong 1" should be true i.e. +# the first double word in the file should be 1. With the extended +# syntax available by some file commands you could write: +# 0 lelong 1 +# &40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data +40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data +>44 ulelong x version 0x%x. +# If the description has a length greater than zero, it exists and is +# found at offset (*64). +>64 ulelong >0 Description available at offset 0x%x +>>60 ulelong >0 (length 0x%x) +# Note it would be better to print out the description, which is found +# as below. Unfortunately the following only prints out the first couple +# of characters instead of all the "description length" +# number of characters -- indicated by the ulelong at offset 60. +>>(64.l) lestring16 >0 Description: %15.15s + +# From: Alex Beregszaszi <alex@fsn.hu> +0 string COWD VMWare3 +>4 byte 3 disk image +>>32 lelong x (%d/ +>>36 lelong x \b%d/ +>>40 lelong x \b%d) +>4 byte 2 undoable disk image +>>32 string >\0 (%s) + +0 string VMDK VMware4 disk image +0 string KDMV VMware4 disk image + +0 belong 0x514649fb QEMU Copy-On-Write disk image +>4 belong x version %d, +>24 belong x size %d + +>28 belong x %d + +0 string QEVM QEMU's suspend to disk image + +0 string Bochs\ Virtual\ HD\ Image Bochs disk image, +>32 string x type %s, +>48 string x subtype %s + +0 lelong 0x02468ace Bochs Sparse disk image + +# from http://filext.com by Derek M Jones <derek@knosof.co.uk> +0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer +0 string \320\317\021\340\241\261\032\341 Microsoft Office Document diff --git a/usr.bin/file/magdir/mup b/usr.bin/file/magdir/mup new file mode 100644 index 00000000000..fd9a7b1353b --- /dev/null +++ b/usr.bin/file/magdir/mup @@ -0,0 +1,22 @@ +# ------------------------------------------------------------------------ +# mup: file(1) magic for Mup (Music Publisher) input file. +# +# From: Abel Cheung <abel (@) oaka.org> +# +# NOTE: This header is mainly proposed in the Arkkra mailing list, +# and is not a mandatory header because of old mup input file +# compatibility. Noteedit also use mup format, but is not forcing +# user to use any header as well. +# +0 string //!Mup Mup music publication program input text +>6 string -Arkkra (Arkkra) +>>13 string - +>>>16 string . +>>>>14 string x \b, need V%.4s +>>>15 string . +>>>>14 string x \b, need V%.3s +>6 string - +>>9 string . +>>>7 string x \b, need V%.4s +>>8 string . +>>>7 string x \b, need V%.3s diff --git a/usr.bin/file/magdir/ncr b/usr.bin/file/magdir/ncr index 1c2117a03af..076968c86f8 100644 --- a/usr.bin/file/magdir/ncr +++ b/usr.bin/file/magdir/ncr @@ -1,4 +1,4 @@ -# $OpenBSD: ncr,v 1.2 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: ncr,v 1.3 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # ncr: file(1) magic for NCR Tower objects @@ -35,14 +35,14 @@ 0 beshort 000640 Tower32/800 68020 >18 beshort &020000 w/68881 object >18 beshort &040000 compatible object ->18 beshort &~060000 object +>18 beshort &060000 object >20 beshort 0407 executable >20 beshort 0413 pure executable >12 belong >0 not stripped >22 beshort >0 - version %ld 0 beshort 000645 Tower32/800 68010 >18 beshort &040000 compatible object ->18 beshort &~060000 object +>18 beshort &060000 object >20 beshort 0407 executable >20 beshort 0413 pure executable >12 belong >0 not stripped diff --git a/usr.bin/file/magdir/netbsd b/usr.bin/file/magdir/netbsd new file mode 100644 index 00000000000..b6aae1ac623 --- /dev/null +++ b/usr.bin/file/magdir/netbsd @@ -0,0 +1,246 @@ + +#------------------------------------------------------------------------------ +# netbsd: file(1) magic for NetBSD objects +# +# All new-style magic numbers are in network byte order. +# + +0 lelong 000000407 a.out NetBSD little-endian object file +>16 lelong >0 not stripped +0 belong 000000407 a.out NetBSD big-endian object file +>16 belong >0 not stripped + +0 belong&0377777777 041400413 a.out NetBSD/i386 demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 041400410 a.out NetBSD/i386 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 041400407 a.out NetBSD/i386 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 041400507 a.out NetBSD/i386 core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +0 belong&0377777777 041600413 a.out NetBSD/m68k demand paged +>0 byte &0x80 +>>20 belong <8192 shared library +>>20 belong =8192 dynamically linked executable +>>20 belong >8192 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 041600410 a.out NetBSD/m68k pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 041600407 a.out NetBSD/m68k +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 041600507 a.out NetBSD/m68k core +>12 string >\0 from '%s' +>32 belong !0 (signal %d) + +0 belong&0377777777 042000413 a.out NetBSD/m68k4k demand paged +>0 byte &0x80 +>>20 belong <4096 shared library +>>20 belong =4096 dynamically linked executable +>>20 belong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042000410 a.out NetBSD/m68k4k pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042000407 a.out NetBSD/m68k4k +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 042000507 a.out NetBSD/m68k4k core +>12 string >\0 from '%s' +>32 belong !0 (signal %d) + +0 belong&0377777777 042200413 a.out NetBSD/ns32532 demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042200410 a.out NetBSD/ns32532 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042200407 a.out NetBSD/ns32532 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 042200507 a.out NetBSD/ns32532 core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +0 belong&0377777777 045200507 a.out NetBSD/powerpc core +>12 string >\0 from '%s' + +0 belong&0377777777 042400413 a.out NetBSD/sparc demand paged +>0 byte &0x80 +>>20 belong <8192 shared library +>>20 belong =8192 dynamically linked executable +>>20 belong >8192 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042400410 a.out NetBSD/sparc pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 042400407 a.out NetBSD/sparc +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 042400507 a.out NetBSD/sparc core +>12 string >\0 from '%s' +>32 belong !0 (signal %d) + +0 belong&0377777777 042600413 a.out NetBSD/pmax demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042600410 a.out NetBSD/pmax pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 042600407 a.out NetBSD/pmax +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 042600507 a.out NetBSD/pmax core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +0 belong&0377777777 043000413 a.out NetBSD/vax 1k demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043000410 a.out NetBSD/vax 1k pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043000407 a.out NetBSD/vax 1k +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 043000507 a.out NetBSD/vax 1k core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +0 belong&0377777777 045400413 a.out NetBSD/vax 4k demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 045400410 a.out NetBSD/vax 4k pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 045400407 a.out NetBSD/vax 4k +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +0 belong&0377777777 045400507 a.out NetBSD/vax 4k core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +# NetBSD/alpha does not support (and has never supported) a.out objects, +# so no rules are provided for them. NetBSD/alpha ELF objects are +# dealt with in "elf". +0 lelong 0x00070185 ECOFF NetBSD/alpha binary +>10 leshort 0x0001 not stripped +>10 leshort 0x0000 stripped +0 belong&0377777777 043200507 a.out NetBSD/alpha core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) + +0 belong&0377777777 043400413 a.out NetBSD/mips demand paged +>0 byte &0x80 +>>20 belong <8192 shared library +>>20 belong =8192 dynamically linked executable +>>20 belong >8192 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 043400410 a.out NetBSD/mips pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 belong >0 not stripped +0 belong&0377777777 043400407 a.out NetBSD/mips +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 belong !0 executable +>>20 belong =0 object file +>16 belong >0 not stripped +0 belong&0377777777 043400507 a.out NetBSD/mips core +>12 string >\0 from '%s' +>32 belong !0 (signal %d) + +0 belong&0377777777 043600413 a.out NetBSD/arm32 demand paged +>0 byte &0x80 +>>20 lelong <4096 shared library +>>20 lelong =4096 dynamically linked executable +>>20 lelong >4096 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043600410 a.out NetBSD/arm32 pure +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 executable +>16 lelong >0 not stripped +0 belong&0377777777 043600407 a.out NetBSD/arm32 +>0 byte &0x80 dynamically linked executable +>0 byte ^0x80 +>>0 byte &0x40 position independent +>>20 lelong !0 executable +>>20 lelong =0 object file +>16 lelong >0 not stripped +# NetBSD/arm26 has always used ELF objects, but it shares a core file +# format with NetBSD/arm32. +0 belong&0377777777 043600507 a.out NetBSD/arm core +>12 string >\0 from '%s' +>32 lelong !0 (signal %d) diff --git a/usr.bin/file/magdir/olf b/usr.bin/file/magdir/olf index b691ff3c38e..20c5e59040c 100644 --- a/usr.bin/file/magdir/olf +++ b/usr.bin/file/magdir/olf @@ -1,4 +1,4 @@ -# $OpenBSD: olf,v 1.6 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: olf,v 1.7 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # olf: file(1) magic for OLF executables @@ -6,8 +6,8 @@ # We have to check the byte order flag to see what byte order all the # other stuff in the header is in. # -# Byte order is probably big-endian for MIPS R3000 and Amdahl. # MIPS R3000 may also be for MIPS R2000. +# What're the correct byte orders for the nCUBE and the Fujitsu VPP500? # # Created by Erik Theisen <etheisen@openbsd.org> # Based on elf from Daniel Quinlan <quinlan@yggdrasil.com> @@ -28,15 +28,17 @@ >7 byte 10 SCO >7 byte 11 Dell >7 byte 12 NCR ->8 byte 1 dynamically linked ->9 byte 1 unstripped >5 byte 0 invalid byte order >5 byte 1 LSB >>16 leshort 0 no file type, >>16 leshort 1 relocatable, >>16 leshort 2 executable, >>16 leshort 3 shared object, ->>16 leshort 4 core file, +# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de> +# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de> +>>16 leshort 4 core file +>>>(0x38+0xcc) string >\0 of '%s' +>>>(0x38+0x10) lelong >0 (signal %d), >>16 leshort &0xff00 processor-specific, >>18 leshort 0 no machine, >>18 leshort 1 AT&T WE32100 - invalid byte order, @@ -46,18 +48,28 @@ >>18 leshort 5 Motorola 88000 - invalid byte order, >>18 leshort 6 Intel 80486, >>18 leshort 7 Intel 80860, ->>18 leshort 8 MIPS R3000, ->>18 leshort 9 Amdahl, ->>18 leshort 75 VAX, +>>18 leshort 8 MIPS R3000_BE - invalid byte order, +>>18 leshort 9 Amdahl - invalid byte order, +>>18 leshort 10 MIPS R3000_LE, +>>18 leshort 11 RS6000 - invalid byte order, +>>18 leshort 15 PA-RISC - invalid byte order, +>>18 leshort 16 nCUBE, +>>18 leshort 17 VPP500, +>>18 leshort 18 SPARC32PLUS, +>>18 leshort 20 PowerPC, +>>18 leshort 0x9026 Alpha, >>20 lelong 0 invalid version >>20 lelong 1 version 1 >>36 lelong 1 MathCoPro/FPU/MAU Required +>8 string >\0 (%s) >5 byte 2 MSB >>16 beshort 0 no file type, >>16 beshort 1 relocatable, >>16 beshort 2 executable, >>16 beshort 3 shared object, >>16 beshort 4 core file, +>>>(0x38+0xcc) string >\0 of '%s' +>>>(0x38+0x10) belong >0 (signal %d), >>16 beshort &0xff00 processor-specific, >>18 beshort 0 no machine, >>18 beshort 1 AT&T WE32100, @@ -67,9 +79,20 @@ >>18 beshort 5 Motorola 88000, >>18 beshort 6 Intel 80486 - invalid byte order, >>18 beshort 7 Intel 80860, ->>18 beshort 8 MIPS R3000, ->>18 beshort 75 VAX - invalid byte order, ->>18 leshort 9 Amdahl, +>>18 beshort 8 MIPS R3000_BE, +>>18 beshort 9 Amdahl, +>>18 beshort 10 MIPS R3000_LE - invalid byte order, +>>18 beshort 11 RS6000, +>>18 beshort 15 PA-RISC, +>>18 beshort 16 nCUBE, +>>18 beshort 17 VPP500, +>>18 beshort 18 SPARC32PLUS, +>>18 beshort 20 PowerPC or cisco 4500, +>>18 beshort 21 cisco 7500, +>>18 beshort 24 cisco SVIP, +>>18 beshort 25 cisco 7200, +>>18 beshort 36 cisco 12000, +>>18 beshort 0x9026 Alpha, >>20 belong 0 invalid version >>20 belong 1 version 1 >>36 belong 1 MathCoPro/FPU/MAU Required diff --git a/usr.bin/file/magdir/os2 b/usr.bin/file/magdir/os2 index f2a269050c1..91506ec9394 100644 --- a/usr.bin/file/magdir/os2 +++ b/usr.bin/file/magdir/os2 @@ -1,4 +1,4 @@ -# $OpenBSD: os2,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: os2,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # os2: file(1) magic for OS/2 files @@ -7,7 +7,7 @@ # Provided 1998/08/22 by # David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net> 1 string InternetShortcut MS Windows 95 Internet shortcut text ->24 string >\ (URL=<%s>) +>24 string >\ (URL=<%s>) # OS/2 URL objects # Provided 1998/08/22 by diff --git a/usr.bin/file/magdir/os400 b/usr.bin/file/magdir/os400 new file mode 100644 index 00000000000..3dc05bf906e --- /dev/null +++ b/usr.bin/file/magdir/os400 @@ -0,0 +1,37 @@ +#------------------------------------------------------------------------------ +# os400: file(1) magic for IBM OS/400 files +# +# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com +# In spite of its quite variable format (due to internal memory page +# length differences between CISC and RISC versions of the OS) the +# SAVF structure hasn't suitable offsets to identify the catalog +# header in the first descriptor where there are some useful infos, +# so we must search in a somewhat large area for a particular string +# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore +# descriptor space) preceded by a two byte constant. +# +1090 search/7393 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data +>&212 byte 0x01 \b, created with SAVOBJ +>&212 byte 0x02 \b, created with SAVLIB +>&212 byte 0x07 \b, created with SAVCFG +>&212 byte 0x08 \b, created with SAVSECDTA +>&212 byte 0x0A \b, created with SAVSECDTA +>&212 byte 0x0B \b, created with SAVDLO +>&212 byte 0x0D \b, created with SAVLICPGM +>&212 byte 0x11 \b, created with SAVCHGOBJ +>&213 byte 0x44 \b, at least V5R4 to open +>&213 byte 0x43 \b, at least V5R3 to open +>&213 byte 0x42 \b, at least V5R2 to open +>&213 byte 0x41 \b, at least V5R1 to open +>&213 byte 0x40 \b, at least V4R5 to open +>&213 byte 0x3F \b, at least V4R4 to open +>&213 byte 0x3E \b, at least V4R3 to open +>&213 byte 0x3C \b, at least V4R2 to open +>&213 byte 0x3D \b, at least V4R1M4 to open +>&213 byte 0x3B \b, at least V4R1 to open +>&213 byte 0x3A \b, at least V3R7 to open +>&213 byte 0x35 \b, at least V3R6 to open +>&213 byte 0x36 \b, at least V3R2 to open +>&213 byte 0x34 \b, at least V3R1 to open +>&213 byte 0x31 \b, at least V3R0M5 to open +>&213 byte 0x30 \b, at least V2R3 to open diff --git a/usr.bin/file/magdir/os9 b/usr.bin/file/magdir/os9 index 8522babcfc9..c55568b8c84 100644 --- a/usr.bin/file/magdir/os9 +++ b/usr.bin/file/magdir/os9 @@ -1,4 +1,4 @@ -# $OpenBSD: os9,v 1.3 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: os9,v 1.4 2008/05/08 01:40:57 chl Exp $ # $NetBSD: os9,v 1.1 1996/05/06 18:24:01 is Exp $ # @@ -40,10 +40,10 @@ >6 byte&0x0f 0x00 non-executable >6 byte&0x0f 0x01 machine language >6 byte&0x0f 0x02 BASIC I-code ->6 byte&0x0f 0x03 P-code +>6 byte&0x0f 0x03 Pascal P-code >6 byte&0x0f 0x04 C I-code >6 byte&0x0f 0x05 COBOL I-code ->6 byte&0x0f 0x06 FORTRAN I-code +>6 byte&0x0f 0x06 Fortran I-code # >6 byte&0xf0 0x10 program executable >6 byte&0xf0 0x20 subroutine @@ -60,28 +60,28 @@ 0 beshort 0x4AFC OS9/68K module: # # attr ->14 byte&0x80 0x80 re-entrant ->14 byte&0x40 0x40 ghost ->14 byte&0x20 0x20 system-state +>0x14 byte&0x80 0x80 re-entrant +>0x14 byte&0x40 0x40 ghost +>0x14 byte&0x20 0x20 system-state # # lang: # ->13 byte 1 machine language ->13 byte 2 BASIC I-code ->13 byte 3 P-code ->13 byte 4 C I-code ->13 byte 5 COBOL I-code ->13 byte 6 Fortran I-code +>0x13 byte 1 machine language +>0x13 byte 2 BASIC I-code +>0x13 byte 3 Pascal P-code +>0x13 byte 4 C I-code +>0x13 byte 5 COBOL I-code +>0x13 byte 6 Fortran I-code # # # type: # ->12 byte 1 program executable ->12 byte 2 subroutine ->12 byte 3 multi-module ->12 byte 4 data module ->12 byte 11 trap library ->12 byte 12 system module ->12 byte 13 file manager ->12 byte 14 device driver ->12 byte 15 device descriptor +>0x12 byte 1 program executable +>0x12 byte 2 subroutine +>0x12 byte 3 multi-module +>0x12 byte 4 data module +>0x12 byte 11 trap library +>0x12 byte 12 system module +>0x12 byte 13 file manager +>0x12 byte 14 device driver +>0x12 byte 15 device descriptor diff --git a/usr.bin/file/magdir/palm b/usr.bin/file/magdir/palm new file mode 100644 index 00000000000..79af1f00c36 --- /dev/null +++ b/usr.bin/file/magdir/palm @@ -0,0 +1,91 @@ + +#------------------------------------------------------------------------------ +# palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks +# +# Brian Lalor <blalor@hcirisc.cs.binghamton.edu> + +# appl +60 belong 0x6170706c PalmOS application +>0 string >\0 "%s" +# TEXt +60 belong 0x54455874 AportisDoc file +>0 string >\0 "%s" +# HACK +60 belong 0x4841434b HackMaster hack +>0 string >\0 "%s" + +# Variety of PalmOS document types +# Michael-John Turner <mj@debian.org> +# Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType +60 string BVokBDIC BDicty PalmOS document +>0 string >\0 "%s" +60 string DB99DBOS DB PalmOS document +>0 string >\0 "%s" +60 string vIMGView FireViewer/ImageViewer PalmOS document +>0 string >\0 "%s" +60 string PmDBPmDB HanDBase PalmOS document +>0 string >\0 "%s" +60 string InfoINDB InfoView PalmOS document +>0 string >\0 "%s" +60 string ToGoToGo iSilo PalmOS document +>0 string >\0 "%s" +60 string JfDbJBas JFile PalmOS document +>0 string >\0 "%s" +60 string JfDbJFil JFile Pro PalmOS document +>0 string >\0 "%s" +60 string DATALSdb List PalmOS document +>0 string >\0 "%s" +60 string Mdb1Mdb1 MobileDB PalmOS document +>0 string >\0 "%s" +60 string PNRdPPrs PeanutPress PalmOS document +>0 string >\0 "%s" +60 string DataPlkr Plucker PalmOS document +>0 string >\0 "%s" +60 string DataSprd QuickSheet PalmOS document +>0 string >\0 "%s" +60 string SM01SMem SuperMemo PalmOS document +>0 string >\0 "%s" +60 string DataTlPt TealDoc PalmOS document +>0 string >\0 "%s" +60 string InfoTlIf TealInfo PalmOS document +>0 string >\0 "%s" +60 string DataTlMl TealMeal PalmOS document +>0 string >\0 "%s" +60 string DataTlPt TealPaint PalmOS document +>0 string >\0 "%s" +60 string dataTDBP ThinkDB PalmOS document +>0 string >\0 "%s" +60 string TdatTide Tides PalmOS document +>0 string >\0 "%s" +60 string ToRaTRPW TomeRaider PalmOS document +>0 string >\0 "%s" + +# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) +# For version 1.xx zTXTs, outputs version and numbers of bookmarks and +# annotations. +# For other versions, just outputs version. +# +60 string zTXT A GutenPalm zTXT e-book +>0 string >\0 "%s" +>(0x4E.L) byte 0 +>>(0x4E.L+1) byte x (v0.%02d) +>(0x4E.L) byte 1 +>>(0x4E.L+1) byte x (v1.%02d) +>>>(0x4E.L+10) beshort >0 +>>>>(0x4E.L+10) beshort <2 - 1 bookmark +>>>>(0x4E.L+10) beshort >1 - %d bookmarks +>>>(0x4E.L+14) beshort >0 +>>>>(0x4E.L+14) beshort <2 - 1 annotation +>>>>(0x4E.L+14) beshort >1 - %d annotations +>(0x4E.L) byte >1 (v%d. +>>(0x4E.L+1) byte x %02d) + +# Palm OS .prc file types +60 string libr Palm OS dynamic library data +>0 string >\0 "%s" +60 string ptch Palm OS operating system patch data +>0 string >\0 "%s" + +# Mobipocket (www.mobipocket.com), donated by Carl Witty +60 string BOOKMOBI Mobipocket E-book +>0 string >\0 "%s" diff --git a/usr.bin/file/magdir/perl b/usr.bin/file/magdir/perl new file mode 100644 index 00000000000..a8daee4c647 --- /dev/null +++ b/usr.bin/file/magdir/perl @@ -0,0 +1,50 @@ + +#------------------------------------------------------------------------------ +# perl: file(1) magic for Larry Wall's perl language. +# +# The ``eval'' line recognizes an outrageously clever hack for USG systems. +# Keith Waclena <keith@cerberus.uchicago.edu> +# Send additions to <perl5-porters@perl.org> +0 string/b #!\ /bin/perl perl script text executable +0 string eval\ "exec\ /bin/perl perl script text +0 string/b #!\ /usr/bin/perl perl script text executable +0 string eval\ "exec\ /usr/bin/perl perl script text +0 string/b #!\ /usr/local/bin/perl perl script text +0 string eval\ "exec\ /usr/local/bin/perl perl script text executable +0 string eval\ '(exit\ $?0)'\ &&\ eval\ 'exec perl script text + + +# by Dmitry V. Levin and Alexey Tourbin +# check the first line +0 string package +>1 regex \^package[\ \t]+[A-Za-z_] +>>1 regex \^package[\ \t]+[0-9A-Za-z_:]*\ *; Perl5 module source text +# not 'p', check other lines +0 byte !0x70 +>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; +>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text + + + +# Perl POD documents +# From: Tom Hukins <tom@eborcom.com> +0 string/B \=pod\n Perl POD document +0 string/B \n\=pod\n Perl POD document +0 string/B \=head1\ Perl POD document +0 string/B \n\=head1\ Perl POD document +0 string/B \=head2\ Perl POD document +0 string/B \n\=head2\ Perl POD document + +# Perl Storable data files. +0 string perl-store perl Storable(v0.6) data +>4 byte >0 (net-order %d) +>>4 byte &01 (network-ordered) +>>4 byte =3 (major 1) +>>4 byte =2 (major 1) + +0 string pst0 perl Storable(v0.7) data +>4 byte >0 +>>4 byte &01 (network-ordered) +>>4 byte =5 (major 2) +>>4 byte =4 (major 2) +>>5 byte >0 (minor %d) diff --git a/usr.bin/file/magdir/plan9 b/usr.bin/file/magdir/plan9 index e77e9389593..893ac595f5d 100644 --- a/usr.bin/file/magdir/plan9 +++ b/usr.bin/file/magdir/plan9 @@ -1,6 +1,18 @@ -# $OpenBSD: plan9,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: plan9,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # plan9: file(1) magic for AT&T Bell Labs' Plan 9 executables +# From: "Stefan A. Haubenthal" <polluks@web.de> # -0 belong 0x000001EB Plan 9 executable +0 belong 0x00000107 Plan 9 executable, Motorola 68k +0 belong 0x000001EB Plan 9 executable, Intel 386 +0 belong 0x00000247 Plan 9 executable, Intel 960 +0 belong 0x000002AB Plan 9 executable, SPARC +0 belong 0x00000407 Plan 9 executable, MIPS R3000 +0 belong 0x0000048B Plan 9 executable, AT&T DSP 3210 +0 belong 0x00000517 Plan 9 executable, MIPS R4000 BE +0 belong 0x000005AB Plan 9 executable, AMD 29000 +0 belong 0x00000647 Plan 9 executable, ARM 7-something +0 belong 0x000006EB Plan 9 executable, PowerPC +0 belong 0x00000797 Plan 9 executable, MIPS R4000 LE +0 belong 0x0000084B Plan 9 executable, DEC Alpha diff --git a/usr.bin/file/magdir/printer b/usr.bin/file/magdir/printer index 9d5b51c63dc..fb1fe62b890 100644 --- a/usr.bin/file/magdir/printer +++ b/usr.bin/file/magdir/printer @@ -1,4 +1,4 @@ -# $OpenBSD: printer,v 1.5 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: printer,v 1.6 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # printer: file(1) magic for printer-formatted files @@ -18,11 +18,42 @@ >>>16 string EPS - type %s >>>16 string Query - type %s >>>16 string ExitServer - type %s +0 string \033%-12345X%!PS PostScript document + + +# DOS EPS Binary File Header +# From: Ed Sznyter <ews@Black.Market.NET> +0 belong 0xC5D0D3C6 DOS EPS Binary File +>4 long >0 Postscript starts at byte %d +>>8 long >0 length %d +>>>12 long >0 Metafile starts at byte %d +>>>>16 long >0 length %d +>>>20 long >0 TIFF starts at byte %d +>>>>24 long >0 length %d + +# Adobe's PostScript Printer Description (PPD) files +# Yves Arrouye <arrouye@marin.fdn.fr> +# +0 string *PPD-Adobe: PPD file +>13 string x \b, ve # HP Printer Job Language 0 string \033%-12345X@PJL HP Printer Job Language data ->15 string \ ENTER\ LANGUAGE\ = ->31 string PostScript PostScript +# HP Printer Job Language +# The header found on Win95 HP plot files is the "Silliest Thing possible" +# (TM) +# Every driver puts the language at some random position, with random case +# (LANGUAGE and Language) +# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10 +# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de> +# +0 string \033%-12345X@PJL HP Printer Job Language data +>&0 string >\0 %s +>>&0 string >\0 %s +>>>&0 string >\0 %s +>>>>&0 string >\0 %s +#>15 string \ ENTER\ LANGUAGE\ = +#>31 string PostScript PostScript # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 0 string \033E\033 HP PCL printer data @@ -39,10 +70,6 @@ >3 string \&l-81A - No. 10 envelope size (landscape) >3 string \&l-90A - Intl. DL envelope size (landscape) -# HPGL2 - Graphics for HP printers. Pavel Lisy <pali@tmapy.cz>, edited. -0 string \033%OB; HP HPGL printer data -# be nice to get the other parameters that can follow, as per PCL? - # IMAGEN printer-ready files: 0 string @document( Imagen printer # this only works if "language xxx" is first item in Imagen header. @@ -57,4 +84,38 @@ # # Now magic for IMAGEN font files... 0 string Rast RST-format raster font data ->45 string >0 face % +>45 string >0 face %s +# From Jukka Ukkonen +0 string \033[K\002\0\0\017\033(a\001\0\001\033(g Canon Bubble Jet BJC formatted data + +# From <mike@flyn.org> +# These are the /etc/magic entries to decode data sent to an Epson printer. +0 string \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P Epson Stylus Color 460 data + + +#------------------------------------------------------------------------------ +# zenographics: file(1) magic for Zenographics ZjStream printer data +# Rick Richardson rickr@mn.rr.com +0 string JZJZ +>0x12 string ZZ Zenographics ZjStream printer data (big-endian) +0 string ZJZJ +>0x12 string ZZ Zenographics ZjStream printer data (little-endian) + + +#------------------------------------------------------------------------------ +# Oak Technologies printer stream +# Rick Richardson <rickr@mn.rr.com> +0 string OAK +>0x07 byte 0 +>0x0b byte 0 Oak Technologies printer stream + +# This would otherwise be recognized as PostScript - nick@debian.org +0 string %!VMF SunClock's Vector Map Format data + +#------------------------------------------------------------------------------ +# HP LaserJet 1000 series downloadable firmware file +0 string \xbe\xefABCDEFGH HP LaserJet 1000 series downloadable firmware + +# From: Paolo <oopla@users.sf.net> +# Epson ESC/Page, ESC/PageColor +0 string \x1b\x01@EJL Epson ESC/Page language printer data diff --git a/usr.bin/file/magdir/python b/usr.bin/file/magdir/python index 129309a4ef2..6f5d2fa3bc3 100644 --- a/usr.bin/file/magdir/python +++ b/usr.bin/file/magdir/python @@ -1,4 +1,4 @@ -# $OpenBSD: python,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: python,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # python: file(1) magic for python @@ -13,3 +13,8 @@ 0 belong 0x2aeb0d0a python 2.1 byte-compiled 0 belong 0x2ded0d0a python 2.2 byte-compiled 0 belong 0x3bf20d0a python 2.3 byte-compiled +0 belong 0x6df20d0a python 2.4 byte-compiled +0 belong 0xb3f20d0a python 2.5 byte-compiled + +0 string/b #!\ /usr/bin/python python script text executable + diff --git a/usr.bin/file/magdir/revision b/usr.bin/file/magdir/revision index 0333c8ef7ab..9ce0073cb41 100644 --- a/usr.bin/file/magdir/revision +++ b/usr.bin/file/magdir/revision @@ -1,6 +1,10 @@ -# $OpenBSD: revision,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: revision,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # file(1) magic for revision control files # From Hendrik Scholz <hendrik@scholz.net> -0 string /1\ :pserver: cvs password text file +0 string /1\ :pserver: cvs password text file + +# Conary changesets +# From: Jonathan Smith <smithj@rpath.com> +0 belong 0xea3f81bb Conary changeset data diff --git a/usr.bin/file/magdir/riff b/usr.bin/file/magdir/riff new file mode 100644 index 00000000000..5aa9d109388 --- /dev/null +++ b/usr.bin/file/magdir/riff @@ -0,0 +1,221 @@ + +#------------------------------------------------------------------------------ +# riff: file(1) magic for RIFF format +# See +# +# http://www.seanet.com/users/matts/riffmci/riffmci.htm +# +# AVI section extended by Patrik Rådman <patrik+file-magic@iki.fi> +# +0 string RIFF RIFF (little-endian) data +# RIFF Palette format +>8 string PAL \b, palette +>>16 leshort x \b, version %d +>>18 leshort x \b, %d entries +# RIFF Device Independent Bitmap format +>8 string RDIB \b, device-independent bitmap +>>16 string BM +>>>30 leshort 12 \b, OS/2 1.x format +>>>>34 leshort x \b, %d x +>>>>36 leshort x %d +>>>30 leshort 64 \b, OS/2 2.x format +>>>>34 leshort x \b, %d x +>>>>36 leshort x %d +>>>30 leshort 40 \b, Windows 3.x format +>>>>34 lelong x \b, %d x +>>>>38 lelong x %d x +>>>>44 leshort x %d +# RIFF MIDI format +>8 string RMID \b, MIDI +# RIFF Multimedia Movie File format +>8 string RMMP \b, multimedia movie +# RIFF wrapper for MP3 +>8 string RMP3 \b, MPEG Layer 3 audio +# Microsoft WAVE format (*.wav) +>8 string WAVE \b, WAVE audio +>>20 leshort 1 \b, Microsoft PCM +>>>34 leshort >0 \b, %d bit +>>20 leshort 2 \b, Microsoft ADPCM +>>20 leshort 6 \b, ITU G.711 A-law +>>20 leshort 7 \b, ITU G.711 mu-law +>>20 leshort 17 \b, IMA ADPCM +>>20 leshort 20 \b, ITU G.723 ADPCM (Yamaha) +>>20 leshort 49 \b, GSM 6.10 +>>20 leshort 64 \b, ITU G.721 ADPCM +>>20 leshort 80 \b, MPEG +>>20 leshort 85 \b, MPEG Layer 3 +>>22 leshort =1 \b, mono +>>22 leshort =2 \b, stereo +>>22 leshort >2 \b, %d channels +>>24 lelong >0 %d Hz +# Corel Draw Picture +>8 string CDRA \b, Corel Draw Picture +# AVI == Audio Video Interleave +>8 string AVI\040 \b, AVI +>>12 string LIST +>>>20 string hdrlavih +>>>>&36 lelong x \b, %lu x +>>>>&40 lelong x %lu, +>>>>&4 lelong >1000000 <1 fps, +>>>>&4 lelong 1000000 1.00 fps, +>>>>&4 lelong 500000 2.00 fps, +>>>>&4 lelong 333333 3.00 fps, +>>>>&4 lelong 250000 4.00 fps, +>>>>&4 lelong 200000 5.00 fps, +>>>>&4 lelong 166667 6.00 fps, +>>>>&4 lelong 142857 7.00 fps, +>>>>&4 lelong 125000 8.00 fps, +>>>>&4 lelong 111111 9.00 fps, +>>>>&4 lelong 100000 10.00 fps, +# ]9.9,10.1[ +>>>>&4 lelong <101010 +>>>>>&-4 lelong >99010 +>>>>>>&-4 lelong !100000 ~10 fps, +>>>>&4 lelong 83333 12.00 fps, +# ]11.9,12.1[ +>>>>&4 lelong <84034 +>>>>>&-4 lelong >82645 +>>>>>>&-4 lelong !83333 ~12 fps, +>>>>&4 lelong 66667 15.00 fps, +# ]14.9,15.1[ +>>>>&4 lelong <67114 +>>>>>&-4 lelong >66225 +>>>>>>&-4 lelong !66667 ~15 fps, +>>>>&4 lelong 50000 20.00 fps, +>>>>&4 lelong 41708 23.98 fps, +>>>>&4 lelong 41667 24.00 fps, +# ]23.9,24.1[ +>>>>&4 lelong <41841 +>>>>>&-4 lelong >41494 +>>>>>>&-4 lelong !41708 +>>>>>>>&-4 lelong !41667 ~24 fps, +>>>>&4 lelong 40000 25.00 fps, +# ]24.9,25.1[ +>>>>&4 lelong <40161 +>>>>>&-4 lelong >39841 +>>>>>>&-4 lelong !40000 ~25 fps, +>>>>&4 lelong 33367 29.97 fps, +>>>>&4 lelong 33333 30.00 fps, +# ]29.9,30.1[ +>>>>&4 lelong <33445 +>>>>>&-4 lelong >33223 +>>>>>>&-4 lelong !33367 +>>>>>>>&-4 lelong !33333 ~30 fps, +>>>>&4 lelong <32224 >30 fps, +##>>>>&4 lelong x (%lu) +##>>>>&20 lelong x %lu frames, +# Note: The tests below assume that the AVI has 1 or 2 streams, +# "vids" optionally followed by "auds". +# (Should cover 99.9% of all AVIs.) +# assuming avih length = 56 +>>>88 string LIST +>>>>96 string strlstrh +>>>>>108 string vids video: +>>>>>>&0 lelong 0 uncompressed +# skip past vids strh +>>>>>>(104.l+108) string strf +>>>>>>>(104.l+132) lelong 1 RLE 8bpp +>>>>>>>(104.l+132) string/c cvid Cinepak +>>>>>>>(104.l+132) string/c i263 Intel I.263 +>>>>>>>(104.l+132) string/c iv32 Indeo 3.2 +>>>>>>>(104.l+132) string/c iv41 Indeo 4.1 +>>>>>>>(104.l+132) string/c iv50 Indeo 5.0 +>>>>>>>(104.l+132) string/c mp42 Microsoft MPEG-4 v2 +>>>>>>>(104.l+132) string/c mp43 Microsoft MPEG-4 v3 +>>>>>>>(104.l+132) string/c fmp4 FFMpeg MPEG-4 +>>>>>>>(104.l+132) string/c mjpg Motion JPEG +>>>>>>>(104.l+132) string/c div3 DivX 3 +>>>>>>>>112 string/c div3 Low-Motion +>>>>>>>>112 string/c div4 Fast-Motion +>>>>>>>(104.l+132) string/c divx DivX 4 +>>>>>>>(104.l+132) string/c dx50 DivX 5 +>>>>>>>(104.l+132) string/c xvid XviD +>>>>>>>(104.l+132) string/c wmv3 Windows Media Video 9 +>>>>>>>(104.l+132) string/c h264 X.264 +>>>>>>>(104.l+132) lelong 0 +##>>>>>>>(104.l+132) string x (%.4s) +# skip past first (video) LIST +>>>>(92.l+96) string LIST +>>>>>(92.l+104) string strlstrh +>>>>>>(92.l+116) string auds \b, audio: +# auds strh length = 56: +>>>>>>>(92.l+172) string strf +>>>>>>>>(92.l+180) leshort 0x0001 uncompressed PCM +>>>>>>>>(92.l+180) leshort 0x0002 ADPCM +>>>>>>>>(92.l+180) leshort 0x0006 aLaw +>>>>>>>>(92.l+180) leshort 0x0007 uLaw +>>>>>>>>(92.l+180) leshort 0x0050 MPEG-1 Layer 1 or 2 +>>>>>>>>(92.l+180) leshort 0x0055 MPEG-1 Layer 3 +>>>>>>>>(92.l+180) leshort 0x2000 Dolby AC3 +>>>>>>>>(92.l+180) leshort 0x0161 DivX +##>>>>>>>>(92.l+180) leshort x (0x%.4x) +>>>>>>>>(92.l+182) leshort 1 (mono, +>>>>>>>>(92.l+182) leshort 2 (stereo, +>>>>>>>>(92.l+182) leshort >2 (%d channels, +>>>>>>>>(92.l+184) lelong x %d Hz) +# auds strh length = 64: +>>>>>>>(92.l+180) string strf +>>>>>>>>(92.l+188) leshort 0x0001 uncompressed PCM +>>>>>>>>(92.l+188) leshort 0x0002 ADPCM +>>>>>>>>(92.l+188) leshort 0x0055 MPEG-1 Layer 3 +>>>>>>>>(92.l+188) leshort 0x2000 Dolby AC3 +>>>>>>>>(92.l+188) leshort 0x0161 DivX +##>>>>>>>>(92.l+188) leshort x (0x%.4x) +>>>>>>>>(92.l+190) leshort 1 (mono, +>>>>>>>>(92.l+190) leshort 2 (stereo, +>>>>>>>>(92.l+190) leshort >2 (%d channels, +>>>>>>>>(92.l+192) lelong x %d Hz) +# Animated Cursor format +>8 string ACON \b, animated cursor +# SoundFont 2 <mpruett@sgi.com> +>8 string sfbk SoundFont/Bank +# MPEG-1 wrapped in a RIFF, apparently +>8 string CDXA \b, wrapped MPEG-1 (CDXA) +>8 string 4XMV \b, 4X Movie file + +# +# XXX - some of the below may only appear in little-endian form. +# +# Also "MV93" appears to be for one form of Macromedia Director +# files, and "GDMF" appears to be another multimedia format. +# +0 string RIFX RIFF (big-endian) data +# RIFF Palette format +>8 string PAL \b, palette +>>16 beshort x \b, version %d +>>18 beshort x \b, %d entries +# RIFF Device Independent Bitmap format +>8 string RDIB \b, device-independent bitmap +>>16 string BM +>>>30 beshort 12 \b, OS/2 1.x format +>>>>34 beshort x \b, %d x +>>>>36 beshort x %d +>>>30 beshort 64 \b, OS/2 2.x format +>>>>34 beshort x \b, %d x +>>>>36 beshort x %d +>>>30 beshort 40 \b, Windows 3.x format +>>>>34 belong x \b, %d x +>>>>38 belong x %d x +>>>>44 beshort x %d +# RIFF MIDI format +>8 string RMID \b, MIDI +# RIFF Multimedia Movie File format +>8 string RMMP \b, multimedia movie +# Microsoft WAVE format (*.wav) +>8 string WAVE \b, WAVE audio +>>20 leshort 1 \b, Microsoft PCM +>>>34 leshort >0 \b, %d bit +>>22 beshort =1 \b, mono +>>22 beshort =2 \b, stereo +>>22 beshort >2 \b, %d channels +>>24 belong >0 %d Hz +# Corel Draw Picture +>8 string CDRA \b, Corel Draw Picture +# AVI == Audio Video Interleave +>8 string AVI\040 \b, AVI +# Animated Cursor format +>8 string ACON \b, animated cursor +# Notation Interchange File Format (big-endian only) +>8 string NIFF \b, Notation Interchange File Format +# SoundFont 2 <mpruett@sgi.com> +>8 string sfbk SoundFont/Bank diff --git a/usr.bin/file/magdir/scientific b/usr.bin/file/magdir/scientific new file mode 100644 index 00000000000..81beac12060 --- /dev/null +++ b/usr.bin/file/magdir/scientific @@ -0,0 +1,60 @@ + +#------------------------------------------------------------------------------ +# scientific: file(1) magic for scientific formats +# +# From: Joe Krahn <krahn@niehs.nih.gov> + +######################################################## +# CCP4 data and plot files: +0 string MTZ\040 MTZ reflection file + +92 string PLOT%%84 Plot84 plotting file +>52 byte 1 , Little-endian +>55 byte 1 , Big-endian + +######################################################## +# Electron density MAP/MASK formats + +0 string EZD_MAP NEWEZD Electron Density Map +109 string MAP\040( Old EZD Electron Density Map + +0 string/c :-)\040Origin BRIX Electron Density Map +>170 string >0 , Sigma:%.12s +#>4 string >0 %.178s +#>4 addr x %.178s + +7 string 18\040!NTITLE XPLOR ASCII Electron Density Map +9 string \040!NTITLE\012\040REMARK CNS ASCII electron density map + +208 string MAP\040 CCP4 Electron Density Map +# Assumes same stamp for float and double (normal case) +>212 byte 17 \b, Big-endian +>212 byte 34 \b, VAX format +>212 byte 68 \b, Little-endian +>212 byte 85 \b, Convex native + +############################################################ +# X-Ray Area Detector images +0 string R-AXIS4\ \ \ R-Axis Area Detector Image: +>796 lelong <20 Little-endian, IP #%d, +>>768 lelong >0 Size=%dx +>>772 lelong >0 \b%d +>796 belong <20 Big-endian, IP #%d, +>>768 belong >0 Size=%dx +>>772 belong >0 \b%d + +0 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: +>796 lelong <20 Little-endian, IP #%d, +>>768 lelong >0 Size=%dx +>>772 lelong >0 \b%d +>796 belong <20 Big-endian, IP #%d, +>>768 belong >0 Size=%dx +>>772 belong >0 \b%d + + +1028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, +>1072 ulong >1 Compressed(%d), +>1100 ulong >1 %d headers, +>1104 ulong >0 %d x +>1108 ulong >0 %d, +>1120 ulong >0 %d bits/pixel diff --git a/usr.bin/file/magdir/sgi b/usr.bin/file/magdir/sgi index 2d7780e7063..dddb9f08fbd 100644 --- a/usr.bin/file/magdir/sgi +++ b/usr.bin/file/magdir/sgi @@ -1,171 +1,60 @@ -# $OpenBSD: sgi,v 1.3 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: sgi,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ -# sgi: file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.) -# Dec Ultrix (MIPS) -# all of SGI's *current* machines and OSes run in big-endian mode on the -# MIPS machines, as far as I know. -# -# XXX - what is the blank "-" line? -# -# kbd file definitions -0 string kbd!map kbd map file ->8 byte >0 Ver %d: ->10 short >0 with %d table(s) -0 belong 0407 old SGI 68020 executable -0 belong 0410 old SGI 68020 pure executable -0 beshort 0x8765 disk quotas file -0 beshort 0x0506 IRIS Showcase file ->2 byte 0x49 - ->3 byte x - version %ld -0 beshort 0x0226 IRIS Showcase template ->2 byte 0x63 - ->3 byte x - version %ld -0 belong 0x5343464d IRIS Showcase file ->4 byte x - version %ld -0 belong 0x5443464d IRIS Showcase template ->4 byte x - version %ld -0 belong 0xdeadbabe IRIX Parallel Arena ->8 belong >0 - version %ld -# -0 beshort 0x0160 MIPSEB COFF executable ->20 beshort 0407 (impure) ->20 beshort 0410 (swapped) ->20 beshort 0413 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->22 byte x - version %ld ->23 byte x .%ld -# -0 beshort 0x0162 MIPSEL COFF executable ->20 beshort 0407 (impure) ->20 beshort 0410 (swapped) ->20 beshort 0413 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->23 byte x - version %d ->22 byte x .%ld -# -0 beshort 0x6001 MIPSEB-LE COFF executable ->20 beshort 03401 (impure) ->20 beshort 04001 (swapped) ->20 beshort 05401 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->23 byte x - version %d ->22 byte x .%ld -# -0 beshort 0x6201 MIPSEL-LE COFF executable ->20 beshort 03401 (impure) ->20 beshort 04001 (swapped) ->20 beshort 05401 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->23 byte x - version %ld ->22 byte x .%ld -# -# MIPS 2 additions -# -0 beshort 0x0163 MIPSEB MIPS-II COFF executable ->20 beshort 0407 (impure) ->20 beshort 0410 (swapped) ->20 beshort 0413 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->22 byte x - version %ld ->23 byte x .%ld -# -0 beshort 0x0166 MIPSEL MIPS-II COFF executable ->20 beshort 0407 (impure) ->20 beshort 0410 (swapped) ->20 beshort 0413 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->22 byte x - version %ld ->23 byte x .%ld -# -0 beshort 0x6301 MIPSEB-LE MIPS-II COFF executable ->20 beshort 03401 (impure) ->20 beshort 04001 (swapped) ->20 beshort 05401 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->23 byte x - version %ld ->22 byte x .%ld -# -0 beshort 0x6601 MIPSEL-LE MIPS-II COFF executable ->20 beshort 03401 (impure) ->20 beshort 04001 (swapped) ->20 beshort 05401 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->23 byte x - version %ld ->22 byte x .%ld -# -# MIPS 3 additions -# -0 beshort 0x0140 MIPSEB MIPS-III COFF executable ->20 beshort 0407 (impure) ->20 beshort 0410 (swapped) ->20 beshort 0413 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->22 byte x - version %ld ->23 byte x .%ld -# -0 beshort 0x0142 MIPSEL MIPS-III COFF executable ->20 beshort 0407 (impure) ->20 beshort 0410 (swapped) ->20 beshort 0413 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->22 byte x - version %ld ->23 byte x .%ld -# -0 beshort 0x4001 MIPSEB-LE MIPS-III COFF executable ->20 beshort 03401 (impure) ->20 beshort 04001 (swapped) ->20 beshort 05401 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->23 byte x - version %ld ->22 byte x .%ld -# -0 beshort 0x4201 MIPSEL-LE MIPS-III COFF executable ->20 beshort 03401 (impure) ->20 beshort 04001 (swapped) ->20 beshort 05401 (paged) ->8 belong >0 not stripped ->8 belong 0 stripped ->23 byte x - version %ld ->22 byte x .%ld +# sgi: file(1) magic for Silicon Graphics applications + # -0 beshort 0x180 MIPSEB Ucode -0 beshort 0x182 MIPSEL Ucode -# 32bit core file -0 belong 0xdeadadb0 IRIX core dump ->4 belong 1 of ->16 string >\0 '%s' -# 64bit core file -0 belong 0xdeadad40 IRIX 64-bit core dump ->4 belong 1 of ->16 string >\0 '%s' -# New style crash dump file -0 string \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of ->36 string >\0 '%s' -# Trusted IRIX info -0 string SGIAUDIT SGI Audit file ->8 byte x - version %d ->9 byte x .%ld -# Are these three SGI-based file types or general ones? -0 string WNGZWZSC Wingz compiled script -0 string WNGZWZSS Wingz spreadsheet -0 string WNGZWZHP Wingz help file # -0 string \#Inventor V IRIS Inventor 1.0 file -0 string \#Inventor V2 Open Inventor 2.0 file -# XXX - I don't know what next thing is! It is likely to be an image -# (or movie) format -0 string glfHeadMagic(); GLF_TEXT -4 belong 0x41010000 GLF_BINARY_LSB_FIRST -4 belong 0x00000141 GLF_BINARY_MSB_FIRST +# Performance Co-Pilot file types +0 string PmNs PCP compiled namespace (V.0) +0 string PmN PCP compiled namespace +>3 string >\0 (V.%1.1s) +3 lelong 0x84500526 PCP archive +>7 byte x (V.%d) +>20 lelong -2 temporal index +>20 lelong -1 metadata +>20 lelong 0 log volume #0 +>20 lelong >0 log volume #%ld +>24 string >\0 host: %s +0 string PCPFolio PCP +>9 string Version: Archive Folio +>18 string >\0 (V.%s) +0 string #pmchart PCP pmchart view +>9 string Version +>17 string >\0 (V%-3.3s) +0 string pmview PCP pmview config +>7 string Version +>15 string >\0 (V%-3.3s) +0 string #pmlogger PCP pmlogger config +>10 string Version +>18 string >\0 (V%1.1s) +0 string PcPh PCP Help +>4 string 1 Index +>4 string 2 Text +>5 string >\0 (V.%1.1s) +0 string #pmieconf-rules PCP pmieconf rules +>16 string >\0 (V.%1.1s) +3 string pmieconf-pmie PCP pmie config +>17 string >\0 (V.%1.1s) + +# SpeedShop data files +0 lelong 0x13130303 SpeedShop data file + +# mdbm files +0 lelong 0x01023962 mdbm file, version 0 (obsolete) +0 string mdbm mdbm file, +>5 byte x version %d, +>6 byte x 2^%d pages, +>7 byte x pagesize 2^%d, +>17 byte x hash %d, +>11 byte x dataformat %d + +# Alias Maya files +0 string //Maya ASCII Alias Maya Ascii File, +>13 string >\0 version %s +8 string MAYAFOR4 Alias Maya Binary File, +>32 string >\0 version %s scene +8 string MayaFOR4 Alias Maya Binary File, +>32 string >\0 version %s scene +8 string CIMG Alias Maya Image File +8 string DEEP Alias Maya Image File diff --git a/usr.bin/file/magdir/sgml b/usr.bin/file/magdir/sgml index de91e2ec1fb..0a891744bfe 100644 --- a/usr.bin/file/magdir/sgml +++ b/usr.bin/file/magdir/sgml @@ -1,4 +1,4 @@ -# $OpenBSD: sgml,v 1.3 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: sgml,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # sgml: file(1) magic for Standard Generalized Markup Language @@ -13,8 +13,9 @@ # Extensible markup language (XML), a subset of SGML # from Marc Prud'hommeaux (marc@apocalypse.org) 0 string/cb \<?xml XML document text -0 string \<?xml\ version " XML +0 string \<?xml\ version\ " XML 0 string \<?xml\ version=" XML +0 string \<?xml\ version=' XML >15 string >\0 %.3s document text >>23 string \<xsl:stylesheet (XSL stylesheet) >>24 string \<xsl:stylesheet (XSL stylesheet) diff --git a/usr.bin/file/magdir/sharc b/usr.bin/file/magdir/sharc index 6ffe807a553..6ac4b61a9d6 100644 --- a/usr.bin/file/magdir/sharc +++ b/usr.bin/file/magdir/sharc @@ -1,4 +1,4 @@ -# $OpenBSD: sharc,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: sharc,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------ # file(1) magic for sharc files @@ -13,7 +13,7 @@ #------------------------------------------------------------------------ # SHARC DSP stuff (based on the FGM SHARC DSP SDK) -0 string ! Assembler source +0 string =! Assembler source 0 string Analog ADi asm listing file 0 string .SYSTEM SHARC architecture file 0 string .system SHARC architecture file diff --git a/usr.bin/file/magdir/sidfiles b/usr.bin/file/magdir/sidfiles deleted file mode 100644 index 45926eb8429..00000000000 --- a/usr.bin/file/magdir/sidfiles +++ /dev/null @@ -1,9 +0,0 @@ -# $OpenBSD: sidfiles,v 1.3 2001/01/29 01:57:58 niklas Exp $ - -# sidfiles -0 string SIDPLAY\ INFOFILE Sidplay info file -0 string PSID PlaySID v2.2+ (AMIGA) sidtune, ->4 beshort >0 w/ header v%d, ->14 beshort =1 single song, ->14 beshort >1 %d songs, ->16 beshort >0 default song: %d diff --git a/usr.bin/file/magdir/sinclair b/usr.bin/file/magdir/sinclair index 6eb92e0b8ef..bbc8181441e 100644 --- a/usr.bin/file/magdir/sinclair +++ b/usr.bin/file/magdir/sinclair @@ -1,4 +1,4 @@ -# $OpenBSD: sinclair,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: sinclair,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # sinclair: file(1) sinclair QL @@ -31,97 +31,15 @@ # Sinclair QL firmware executables (ThMO) 0 string NqNqNq`\004 QL firmware executable (BCPL) -# Sinclair QL libraries (ThMO) -0 beshort =0xFB01 QL library archive data +# Sinclair QL libraries (was ThMO) +0 beshort 0xFB01 QDOS object +>2 pstring x '%s' -# Sinclair QL executbables (ThMO) -6 beshort =0x4AFB QL executable, ->10 string =\0 un-named ->8 beshort =1 ->>10 string >\0 named: %.1s ->8 beshort =2 ->>10 string >\0 named: %.2s ->8 beshort =3 ->>10 string >\0 named: %.3s ->8 beshort =4 ->>10 string >\0 named: %.4s ->8 beshort =5 ->>10 string >\0 named: %.5s ->8 beshort =6 ->>10 string >\0 named: %.6s ->8 beshort =7 ->>10 string >\0 named: %.7s ->8 beshort =8 ->>10 string >\0 named: %.8s ->8 beshort =9 ->>10 string >\0 named: %.9s ->8 beshort =10 ->>10 string >\0 named: %.10s ->8 beshort =11 ->>10 string >\0 named: %.11s ->8 beshort =12 ->>10 string >\0 named: %.12s ->8 beshort =13 ->>10 string >\0 named: %.13s ->8 beshort =14 ->>10 string >\0 named: %.14s ->8 beshort =15 ->>10 string >\0 named: %.15s ->8 beshort =16 ->>10 string >\0 named: %.16s ->8 beshort =17 ->>10 string >\0 named: %.17s ->8 beshort =18 ->>10 string >\0 named: %.18s ->8 beshort =19 ->>10 string >\0 named: %.19s ->8 beshort =20 ->>10 string >\0 named: %.20s ->8 beshort >20 ->>10 string >\0 (truncated) named: %.20s +# Sinclair QL executables (was ThMO) +4 belong 0x4AFB QDOS executable +>9 pstring x '%s' -# Sinclair QL rom (ThMO) +# Sinclair QL ROM (ThMO) 0 belong =0x4AFB0001 QL plugin-ROM data, ->10 string =\0 un-named ->8 beshort =1 ->>10 string >\0 named: %.1s ->8 beshort =2 ->>10 string >\0 named: %.2s ->8 beshort =3 ->>10 string >\0 named: %.3s ->8 beshort =4 ->>10 string >\0 named: %.4s ->8 beshort =5 ->>10 string >\0 named: %.5s ->8 beshort =6 ->>10 string >\0 named: %.6s ->8 beshort =7 ->>10 string >\0 named: %.7s ->8 beshort =8 ->>10 string >\0 named: %.8s ->8 beshort =9 ->>10 string >\0 named: %.9s ->8 beshort =10 ->>10 string >\0 named: %.10s ->8 beshort =11 ->>10 string >\0 named: %.11s ->8 beshort =12 ->>10 string >\0 named: %.12s ->8 beshort =13 ->>10 string >\0 named: %.13s ->8 beshort =14 ->>10 string >\0 named: %.14s ->8 beshort =15 ->>10 string >\0 named: %.15s ->8 beshort =16 ->>10 string >\0 named: %.16s ->8 beshort =17 ->>10 string >\0 named: %.17s ->8 beshort =18 ->>10 string >\0 named: %.18s ->8 beshort =19 ->>10 string >\0 named: %.19s ->8 beshort =20 ->>10 string >\0 named: %.20s ->8 beshort >20 ->>10 string >\0 (truncated) named: %.20s +>9 pstring =\0 un-named +>9 pstring >\0 named: %s diff --git a/usr.bin/file/magdir/sniffer b/usr.bin/file/magdir/sniffer index cf0ae7a867b..19f0ac5a490 100644 --- a/usr.bin/file/magdir/sniffer +++ b/usr.bin/file/magdir/sniffer @@ -1,4 +1,4 @@ -# $OpenBSD: sniffer,v 1.4 2004/06/03 03:36:46 tedu Exp $ +# $OpenBSD: sniffer,v 1.5 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # sniffer: file(1) magic for packet capture files @@ -33,6 +33,7 @@ # # Network General Sniffer capture files. # Sorry, make that "Network Associates Sniffer capture files." +# Sorry, make that "Network General old DOS Sniffer capture files." # 0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file >33 byte 2 (compressed) @@ -55,6 +56,7 @@ # Sorry, make that "Network Associates Sniffer Basic capture files." # Sorry, make that "Network Associates Sniffer Basic, and Windows # Sniffer Pro", capture files." +# Sorry, make that "Network General Sniffer capture files." # 0 string XCP\0 NetXRay capture file >4 string >\0 - version %s @@ -86,15 +88,13 @@ >20 belong 9 (PPP >20 belong 10 (FDDI >20 belong 11 (RFC 1483 ATM ->20 belong 12 (Loopback ->20 belong 13 (IPSec Enc ->20 belong 14 (Raw IP ->20 belong 15 (BSD/OS SLIP ->20 belong 16 (BSD/OS PPP ->20 belong 17 (Old PF Log ->20 belong 18 (PFSync +>20 belong 12 (raw IP +>20 belong 13 (BSD/OS SLIP +>20 belong 14 (BSD/OS PPP +>20 belong 19 (Linux ATM Classical IP >20 belong 50 (PPP or Cisco HDLC >20 belong 51 (PPP-over-Ethernet +>20 belong 99 (Symantec Enterprise Firewall >20 belong 100 (RFC 1483 ATM >20 belong 101 (raw IP >20 belong 102 (BSD/OS SLIP @@ -110,13 +110,32 @@ >20 belong 114 (LocalTalk >20 belong 117 (OpenBSD PFLOG >20 belong 119 (802.11 with Prism header +>20 belong 122 (RFC 2625 IP over Fibre Channel >20 belong 123 (SunATM >20 belong 127 (802.11 with radiotap header >20 belong 129 (Linux ARCNET +>20 belong 138 (Apple IP over IEEE 1394 >20 belong 140 (MTP2 >20 belong 141 (MTP3 >20 belong 143 (DOCSIS >20 belong 144 (IrDA +>20 belong 147 (Private use 0 +>20 belong 148 (Private use 1 +>20 belong 149 (Private use 2 +>20 belong 150 (Private use 3 +>20 belong 151 (Private use 4 +>20 belong 152 (Private use 5 +>20 belong 153 (Private use 6 +>20 belong 154 (Private use 7 +>20 belong 155 (Private use 8 +>20 belong 156 (Private use 9 +>20 belong 157 (Private use 10 +>20 belong 158 (Private use 11 +>20 belong 159 (Private use 12 +>20 belong 160 (Private use 13 +>20 belong 161 (Private use 14 +>20 belong 162 (Private use 15 +>20 belong 163 (802.11 with AVS header >16 belong x \b, capture length %d) 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian) >4 leshort x - version %d @@ -133,15 +152,13 @@ >20 lelong 9 (PPP >20 lelong 10 (FDDI >20 lelong 11 (RFC 1483 ATM ->20 lelong 12 (Loopback ->20 lelong 13 (IPSec Enc ->20 lelong 14 (Raw IP ->20 lelong 15 (BSD/OS SLIP ->20 lelong 16 (BSD/OS PPP ->20 lelong 17 (Old PF Log ->20 lelong 18 (PFSync +>20 lelong 12 (raw IP +>20 lelong 13 (BSD/OS SLIP +>20 lelong 14 (BSD/OS PPP +>20 lelong 19 (Linux ATM Classical IP >20 lelong 50 (PPP or Cisco HDLC >20 lelong 51 (PPP-over-Ethernet +>20 lelong 99 (Symantec Enterprise Firewall >20 lelong 100 (RFC 1483 ATM >20 lelong 101 (raw IP >20 lelong 102 (BSD/OS SLIP @@ -151,19 +168,38 @@ >20 lelong 106 (Linux Classical IP over ATM >20 lelong 107 (Frame Relay >20 lelong 108 (OpenBSD loopback ->20 lelong 109 (OpenBSD IPSEC encrypted +>20 lelong 109 (OpenBSD IPsec encrypted >20 lelong 112 (Cisco HDLC >20 lelong 113 (Linux "cooked" >20 lelong 114 (LocalTalk >20 lelong 117 (OpenBSD PFLOG >20 lelong 119 (802.11 with Prism header +>20 lelong 122 (RFC 2625 IP over Fibre Channel >20 lelong 123 (SunATM >20 lelong 127 (802.11 with radiotap header >20 lelong 129 (Linux ARCNET +>20 lelong 138 (Apple IP over IEEE 1394 >20 lelong 140 (MTP2 >20 lelong 141 (MTP3 >20 lelong 143 (DOCSIS >20 lelong 144 (IrDA +>20 lelong 147 (Private use 0 +>20 lelong 148 (Private use 1 +>20 lelong 149 (Private use 2 +>20 lelong 150 (Private use 3 +>20 lelong 151 (Private use 4 +>20 lelong 152 (Private use 5 +>20 lelong 153 (Private use 6 +>20 lelong 154 (Private use 7 +>20 lelong 155 (Private use 8 +>20 lelong 156 (Private use 9 +>20 lelong 157 (Private use 10 +>20 lelong 158 (Private use 11 +>20 lelong 159 (Private use 12 +>20 lelong 160 (Private use 13 +>20 lelong 161 (Private use 14 +>20 lelong 162 (Private use 15 +>20 lelong 163 (802.11 with AVS header >16 lelong x \b, capture length %d) # @@ -240,3 +276,23 @@ # 0 string NetS NetStumbler log file >8 lelong x \b, %d stations found + +# +# EtherPeek/AiroPeek "version 9" capture files. +# +0 string \177ver EtherPeek/AiroPeek capture file + +# +# Visual Networks traffic capture files. +# +0 string \x05VNF Visual Networks traffic capture file + +# +# Network Instruments Observer capture files. +# +0 string ObserverPktBuffe Network Instruments Observer capture file + +# +# Files from Accellent Group's 5View products. +# +0 string \xaa\xaa\xaa\xaa 5View capture file diff --git a/usr.bin/file/magdir/spec b/usr.bin/file/magdir/spec new file mode 100644 index 00000000000..bfda30642c7 --- /dev/null +++ b/usr.bin/file/magdir/spec @@ -0,0 +1,20 @@ + +#------------------------------------------------------------------------------ +# spec: file(1) magic for SPEC raw results (*.raw, *.rsf) +# +# Cloyce D. Spradling <cloyce@headgear.org> + +0 string spec SPEC +>4 string .cpu CPU +>>8 string <: \b%.4s +>>12 string . raw result text + +17 string version=SPECjbb SPECjbb +>32 string <: \b%.4s +>>37 string <: v%.4s raw result text + +0 string BEGIN\040SPECWEB SPECweb +>13 string <: \b%.2s +>>15 string _SSL \b_SSL +>>>20 string <: v%.4s raw result text +>>16 string <: v%.4s raw result text diff --git a/usr.bin/file/magdir/sql b/usr.bin/file/magdir/sql index 39126705895..bb337663eab 100644 --- a/usr.bin/file/magdir/sql +++ b/usr.bin/file/magdir/sql @@ -1,4 +1,4 @@ -# $OpenBSD: sql,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: sql,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # sql: file(1) magic for SQL files @@ -17,3 +17,30 @@ 0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file >3 byte x Version %d 0 string \376bin MySQL replication log + +#------------------------------------------------------------------------------ +# iRiver H Series database file +# From Ken Guest <ken@linux.ie> +# As observed from iRivNavi.iDB and unencoded firmware +# +0 string iRivDB iRiver Database file +>11 string >\0 Version %s +>39 string iHP-100 [H Series] + +#------------------------------------------------------------------------------ +# SQLite database files +# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg +# +# Version 1 used GDBM internally; its files cannot be distinguished +# from other GDBM files. +# +# Version 2 used this format: +0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database + +# Version 3 of SQLite allows applications to embed their own "user version" +# number in the database. Detect this and distinguish those files. + +0 string SQLite\ format\ 3 +>60 string _MTN Monotone source repository +>60 belong !0 SQLite 3.x database, user version %u +>60 belong 0 SQLite 3.x database diff --git a/usr.bin/file/magdir/sun b/usr.bin/file/magdir/sun index 1e4b36c8fbd..b0f0d9781ff 100644 --- a/usr.bin/file/magdir/sun +++ b/usr.bin/file/magdir/sun @@ -1,4 +1,4 @@ -# $OpenBSD: sun,v 1.3 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: sun,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # sun: file(1) magic for Sun machines @@ -13,10 +13,12 @@ >>20 belong >4096 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0600410 sparc pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0600407 sparc >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable @@ -27,11 +29,14 @@ >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable +>0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0400410 mc68020 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0400407 mc68020 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable @@ -42,11 +47,14 @@ >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable +>0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0200410 mc68010 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0200407 mc68010 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable diff --git a/usr.bin/file/magdir/sysex b/usr.bin/file/magdir/sysex index 27afebe38e1..5601528e1fa 100644 --- a/usr.bin/file/magdir/sysex +++ b/usr.bin/file/magdir/sysex @@ -1,4 +1,4 @@ -# $OpenBSD: sysex,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: sysex,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------ # sysex: file(1) magic for MIDI sysex files @@ -13,7 +13,28 @@ >1 byte 0x04 Moog >1 byte 0x05 Passport >1 byte 0x06 Lexicon ->1 byte 0x07 Kurzweil +>1 byte 0x07 Kurzweil/Future Retro +>>3 byte 0x77 777 +>>4 byte 0x00 Bank +>>4 byte 0x01 Song +>>5 byte 0x0f 16 +>>5 byte 0x0e 15 +>>5 byte 0x0d 14 +>>5 byte 0x0c 13 +>>5 byte 0x0b 12 +>>5 byte 0x0a 11 +>>5 byte 0x09 10 +>>5 byte 0x08 9 +>>5 byte 0x07 8 +>>5 byte 0x06 7 +>>5 byte 0x05 6 +>>5 byte 0x04 5 +>>5 byte 0x03 4 +>>5 byte 0x02 3 +>>5 byte 0x01 2 +>>5 byte 0x00 1 +>>5 byte 0x10 (ALL) +>>2 byte x \b, Channel %d >1 byte 0x08 Fender >1 byte 0x09 Gulbransen >1 byte 0x0a AKG @@ -23,6 +44,12 @@ >1 byte 0x0e Garfield >1 byte 0x0f Ensoniq >1 byte 0x10 Oberheim +>>2 byte 0x06 Matrix 6 series +>>3 byte 0x0A Dump (All) +>>3 byte 0x01 Dump (Bank) +>>4 belong 0x0002040E Matrix 1000 +>>>11 byte <2 User bank %d +>>>11 byte >1 Preset bank %d >1 byte 0x11 Apple >1 byte 0x12 GreyMatter >1 byte 0x14 PalmTree @@ -54,11 +81,107 @@ >>3 byte 0x09 EK-44 >1 byte 0x30 Dynacord +>1 byte 0x31 Jomox >1 byte 0x33 Clavia >1 byte 0x39 Soundcraft - +# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs >1 byte 0x3e Waldorf +>>2 byte 0x00 microWave +>>2 byte 0x0E microwave2 / XT +>>2 byte 0x0F Q / Q+ +>>3 byte =0 (default id) +>>3 byte >0 ( +>>>3 byte <0x7F \bdevice %d) +>>>3 byte =0x7F \bbroadcast id) >>3 byte 0x7f Microwave I +>>>4 byte 0x00 SNDR (Sound Request) +>>>4 byte 0x10 SNDD (Sound Dump) +>>>4 byte 0x20 SNDP (Sound Parameter Change) +>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) +>>>4 byte 0x70 BOOT (Sound Reserved) +>>>4 byte 0x01 MULR (Multi Request) +>>>4 byte 0x11 MULD (Multi Dump) +>>>4 byte 0x21 MULP (Multi Parameter Change) +>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) +>>>4 byte 0x71 OS (Multi Reserved) +>>>4 byte 0x02 DRMR (Drum Map Request) +>>>4 byte 0x12 DRMD (Drum Map Dump) +>>>4 byte 0x22 DRMP (Drum Map Parameter Change) +>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) +>>>4 byte 0x72 BIN (Drum Map Reserved) +>>>4 byte 0x03 PATR (Sequencer Pattern Request) +>>>4 byte 0x13 PATD (Sequencer Pattern Dump) +>>>4 byte 0x23 PATP (Sequencer Pattern Parameter Change) +>>>4 byte 0x33 PATQ (Sequencer Pattern Parameter Inquiry) +>>>4 byte 0x73 AFM (Sequencer Pattern Reserved) +>>>4 byte 0x04 GLBR (Global Parameter Request) +>>>4 byte 0x14 GLBD (Global Parameter Dump) +>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) +>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) +>>>4 byte 0x07 MODR (Mode Parameter Request) +>>>4 byte 0x17 MODD (Mode Parameter Dump) +>>>4 byte 0x27 MODP (Mode Parameter Parameter Change) +>>>4 byte 0x37 MODQ (Mode Parameter Parameter Inquiry) +>>2 byte 0x10 microQ +>>>4 byte 0x00 SNDR (Sound Request) +>>>4 byte 0x10 SNDD (Sound Dump) +>>>4 byte 0x20 SNDP (Sound Parameter Change) +>>>4 byte 0x30 SNDQ (Sound Parameter Inquiry) +>>>4 byte 0x70 (Sound Reserved) +>>>4 byte 0x01 MULR (Multi Request) +>>>4 byte 0x11 MULD (Multi Dump) +>>>4 byte 0x21 MULP (Multi Parameter Change) +>>>4 byte 0x31 MULQ (Multi Parameter Inquiry) +>>>4 byte 0x71 OS (Multi Reserved) +>>>4 byte 0x02 DRMR (Drum Map Request) +>>>4 byte 0x12 DRMD (Drum Map Dump) +>>>4 byte 0x22 DRMP (Drum Map Parameter Change) +>>>4 byte 0x32 DRMQ (Drum Map Parameter Inquiry) +>>>4 byte 0x72 BIN (Drum Map Reserved) +>>>4 byte 0x04 GLBR (Global Parameter Request) +>>>4 byte 0x14 GLBD (Global Parameter Dump) +>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) +>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) +>>2 byte 0x11 rackAttack +>>>4 byte 0x00 SNDR (Sound Parameter Request) +>>>4 byte 0x10 SNDD (Sound Parameter Dump) +>>>4 byte 0x20 SNDP (Sound Parameter Parameter Change) +>>>4 byte 0x30 SNDQ (Sound Parameter Parameter Inquiry) +>>>4 byte 0x01 PRGR (Program Parameter Request) +>>>4 byte 0x11 PRGD (Program Parameter Dump) +>>>4 byte 0x21 PRGP (Program Parameter Parameter Change) +>>>4 byte 0x31 PRGQ (Program Parameter Parameter Inquiry) +>>>4 byte 0x71 OS (Program Parameter Reserved) +>>>4 byte 0x03 PATR (Pattern Parameter Request) +>>>4 byte 0x13 PATD (Pattern Parameter Dump) +>>>4 byte 0x23 PATP (Pattern Parameter Parameter Change) +>>>4 byte 0x33 PATQ (Pattern Parameter Parameter Inquiry) +>>>4 byte 0x04 GLBR (Global Parameter Request) +>>>4 byte 0x14 GLBD (Global Parameter Dump) +>>>4 byte 0x24 GLBP (Global Parameter Parameter Change) +>>>4 byte 0x34 GLBQ (Global Parameter Parameter Inquiry) +>>>4 byte 0x05 EFXR (FX Parameter Request) +>>>4 byte 0x15 EFXD (FX Parameter Dump) +>>>4 byte 0x25 EFXP (FX Parameter Parameter Change) +>>>4 byte 0x35 EFXQ (FX Parameter Parameter Inquiry) +>>>4 byte 0x07 MODR (Mode Command Request) +>>>4 byte 0x17 MODD (Mode Command Dump) +>>>4 byte 0x27 MODP (Mode Command Parameter Change) +>>>4 byte 0x37 MODQ (Mode Command Parameter Inquiry) +>>2 byte 0x03 Wave +>>>4 byte 0x00 SBPR (Soundprogram) +>>>4 byte 0x01 SAPR (Performance) +>>>4 byte 0x02 SWAVE (Wave) +>>>4 byte 0x03 SWTBL (Wave control table) +>>>4 byte 0x04 SVT (Velocity Curve) +>>>4 byte 0x05 STT (Tuning Table) +>>>4 byte 0x06 SGLB (Global Parameters) +>>>4 byte 0x07 SARRMAP (Performance Program Change Map) +>>>4 byte 0x08 SBPRMAP (Sound Program Change Map) +>>>4 byte 0x09 SBPRPAR (Sound Parameter) +>>>4 byte 0x0A SARRPAR (Performance Parameter) +>>>4 byte 0x0B SINSPAR (Instrument/External Parameter) +>>>4 byte 0x0F SBULK (Bulk Switch on/off) # Japanese Group >1 byte 0x40 Kawai diff --git a/usr.bin/file/magdir/tex b/usr.bin/file/magdir/tex index c5af1069b5b..1a0633d48ba 100644 --- a/usr.bin/file/magdir/tex +++ b/usr.bin/file/magdir/tex @@ -1,4 +1,4 @@ -# $OpenBSD: tex,v 1.3 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: tex,v 1.4 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # tex: file(1) magic for TeX files @@ -30,25 +30,25 @@ 0 string This\ is\ Info\ file GNU Info text # TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com) -0 string \\input TeX document text -0 string \\section LaTeX document text -0 string \\setlength LaTeX document text -0 string \\documentstyle LaTeX document text -0 string \\chapter LaTeX document text -0 string \\documentclass LaTeX 2e document text -0 string \\relax LaTeX auxiliary file -0 string \\contentsline LaTeX table of contents -0 string %\ -*-latex-*- LaTeX document text +0 search/400 \\input TeX document text +0 search/400 \\section LaTeX document text +0 search/400 \\setlength LaTeX document text +0 search/400 \\documentstyle LaTeX document text +0 search/400 \\chapter LaTeX document text +0 search/400 \\documentclass LaTeX 2e document text +0 search/400 \\relax LaTeX auxiliary file +0 search/400 \\contentsline LaTeX table of contents +0 search/400 %\ -*-latex-*- LaTeX document text # Tex document, from Hendrik Scholz <hendrik@scholz.net> 0 string \\ifx TeX document text # Index and glossary files -0 string \\indexentry LaTeX raw index file -0 string \\begin{theindex} LaTeX sorted index -0 string \\glossaryentry LaTeX raw glossary -0 string \\begin{theglossary} LaTeX sorted glossary -0 string This\ is\ makeindex Makeindex log file +0 search/400 \\indexentry LaTeX raw index file +0 search/400 \\begin{theindex} LaTeX sorted index +0 search/400 \\glossaryentry LaTeX raw glossary +0 search/400 \\begin{theglossary} LaTeX sorted glossary +0 search/400 This\ is\ makeindex Makeindex log file # End of TeX @@ -56,41 +56,17 @@ # file(1) magic for BibTex text files # From Hendrik Scholz <hendrik@scholz.net> -0 string @article{ BibTex text file -0 string @book{ BibTex text file -0 string @inbook{ BibTex text file -0 string @incollection{ BibTex text file -0 string @inproceedings{ BibTex text file -0 string @manual{ BibTex text file -0 string @misc{ BibTex text file -0 string @preamble{ BibTex text file -0 string @phdthesis{ BibTex text file -0 string @techreport{ BibTex text file -0 string @unpublished{ BibTex text file - -0 string @Article{ BibTex text file -0 string @Book{ BibTex text file -0 string @Inbook{ BibTex text file -0 string @Incollection{ BibTex text file -0 string @Inproceedings{ BibTex text file -0 string @Manual{ BibTex text file -0 string @Misc{ BibTex text file -0 string @Preamble{ BibTex text file -0 string @Phdthesis{ BibTex text file -0 string @Techreport{ BibTex text file -0 string @Unpublished{ BibTex text file - -0 string @ARTICLE{ BibTex text file -0 string @BOOK{ BibTex text file -0 string @INBOOK{ BibTex text file -0 string @INCOLLECTION{ BibTex text file -0 string @INPROCEEDINGS{ BibTex text file -0 string @MANUAL{ BibTex text file -0 string @MISC{ BibTex text file -0 string @PREAMBLE{ BibTex text file -0 string @PHDTHESIS{ BibTex text file -0 string @TECHREPORT{ BibTex text file -0 string @UNPUBLISHED{ BibTex text file +0 string/c @article{ BibTeX text file +0 string/c @book{ BibTeX text file +0 string/c @inbook{ BibTeX text file +0 string/c @incollection{ BibTeX text file +0 string/c @inproceedings{ BibTeX text file +0 string/c @manual{ BibTeX text file +0 string/c @misc{ BibTeX text file +0 string/c @preamble{ BibTeX text file +0 string/c @phdthesis{ BibTeX text file +0 string/c @techreport{ BibTeX text file +0 string/c @unpublished{ BibTeX text file 73 string %%%\ \ BibTeX-file{ BibTex text file (with full header) diff --git a/usr.bin/file/magdir/tgif b/usr.bin/file/magdir/tgif new file mode 100644 index 00000000000..779883ac848 --- /dev/null +++ b/usr.bin/file/magdir/tgif @@ -0,0 +1,6 @@ +#------------------------------------------------------------------------------ +# file(1) magic for tgif(1) files +# From Hendrik Scholz <hendrik@scholz.net> + +0 string %TGIF\ x Tgif file version %s + diff --git a/usr.bin/file/magdir/troff b/usr.bin/file/magdir/troff index ddab8345c5d..9f6a87c874b 100644 --- a/usr.bin/file/magdir/troff +++ b/usr.bin/file/magdir/troff @@ -1,4 +1,4 @@ -# $OpenBSD: troff,v 1.2 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: troff,v 1.3 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # troff: file(1) magic for *roff @@ -10,9 +10,10 @@ 0 string '\\" troff or preprocessor input text 0 string '.\\" troff or preprocessor input text 0 string \\" troff or preprocessor input text +0 string ''' troff or preprocessor input text # ditroff intermediate output text -0 string x\ T ditroff text +0 string x\ T ditroff output text >4 string cat for the C/A/T phototypesetter >4 string ps for PostScript >4 string dvi for DVI diff --git a/usr.bin/file/magdir/tuxedo b/usr.bin/file/magdir/tuxedo index 9d039925411..2078c1a7290 100644 --- a/usr.bin/file/magdir/tuxedo +++ b/usr.bin/file/magdir/tuxedo @@ -1,5 +1,6 @@ -# $OpenBSD: tuxedo,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: tuxedo,v 1.2 2008/05/08 01:40:57 chl Exp $ +# #------------------------------------------------------------------------------ # tuxedo: file(1) magic for BEA TUXEDO data files # diff --git a/usr.bin/file/magdir/unicode b/usr.bin/file/magdir/unicode new file mode 100644 index 00000000000..45a32d4536b --- /dev/null +++ b/usr.bin/file/magdir/unicode @@ -0,0 +1,15 @@ + +#--------------------------------------------------------------------------- +# Unicode: BOM prefixed text files - Adrian Havill <havill@turbolinux.co.jp> +# +0 string +/v8 Unicode text, UTF-7 +0 string +/v9 Unicode text, UTF-7 +0 string +/v+ Unicode text, UTF-7 +0 string +/v/ Unicode text, UTF-7 +0 string \357\273\277 Unicode text, UTF-8 +0 string \335\163\146\163 Unicode text, UTF-8-EBCDIC +0 string \376\377\000\000 Unicode text, UTF-32, big-endian +0 string \377\376\000\000 Unicode text, UTF-32, little-endian +0 string \376\377 Unicode text, UTF-16, big-endian +0 string \377\376 Unicode text, UTF-16, little-endian +0 string \016\376\377 Unicode text, SCSU (Standard Compression Scheme for Unicode) diff --git a/usr.bin/file/magdir/varied.out b/usr.bin/file/magdir/varied.out index 14c74eeca38..98a44f8fda8 100644 --- a/usr.bin/file/magdir/varied.out +++ b/usr.bin/file/magdir/varied.out @@ -1,4 +1,4 @@ -# $OpenBSD: varied.out,v 1.4 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: varied.out,v 1.5 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # varied.out: file(1) magic for various USG systems @@ -32,5 +32,12 @@ 0 string \xc0HRB Harbour HRB file >4 short x version %d -# From: "Stefan A. Haubenthal" <polluks@web.de> -0 belong 0x000001EB Plan 9 executable +# From: Alex Beregszaszi <alex@fsn.hu> +# 0 string exec BugOS executable +# 0 string pack BugOS archive + +# From: Jason Spence <jspence@lightconsulting.com> +# Generated by the "examples" in STM's ST40 devkit, and derived code. +0 lelong 0x13a9f17e ST40 component image format +>4 string >\0 \b, name '%s' + diff --git a/usr.bin/file/magdir/varied.script b/usr.bin/file/magdir/varied.script new file mode 100644 index 00000000000..ab5becef2d6 --- /dev/null +++ b/usr.bin/file/magdir/varied.script @@ -0,0 +1,12 @@ +#------------------------------------------------------------------------------ +# varied.script: file(1) magic for various interpreter scripts + +0 string #!\ / a +>3 string >\0 %s script text executable +0 string #!\t/ a +>3 string >\0 %s script text executable +0 string #!/ a +>2 string >\0 %s script text executable +0 string #!\ script text executable +>3 string >\0 for %s + diff --git a/usr.bin/file/magdir/vicar b/usr.bin/file/magdir/vicar new file mode 100644 index 00000000000..ab216eeea81 --- /dev/null +++ b/usr.bin/file/magdir/vicar @@ -0,0 +1,16 @@ + +#------------------------------------------------------------------------------ +# vicar: file(1) magic for VICAR files. +# +# From: Ossama Othman <othman@astrosun.tn.cornell.edu +# VICAR is JPL's in-house spacecraft image processing program +# VICAR image +0 string LBLSIZE= VICAR image data +>32 string BYTE \b, 8 bits = VAX byte +>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2 +>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4 +>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4 +>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8 +>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8 +# VICAR label file +43 string SFDU_LABEL VICAR label file diff --git a/usr.bin/file/magdir/virtutech b/usr.bin/file/magdir/virtutech new file mode 100644 index 00000000000..cea8443b2e6 --- /dev/null +++ b/usr.bin/file/magdir/virtutech @@ -0,0 +1,10 @@ +#------------------------------------------------------------------------------ +# Virtutech Compressed Random Access File Format +# +# From <gustav@virtutech.com> +0 string \211\277\036\203 Virtutech CRAFF +>4 belong x v%d +>20 belong 0 uncompressed +>20 belong 1 bzipp2ed +>20 belong 2 gzipped +>24 belong 0 not clean diff --git a/usr.bin/file/magdir/vmware b/usr.bin/file/magdir/vmware index 72ec38ebfaa..257b17b715a 100644 --- a/usr.bin/file/magdir/vmware +++ b/usr.bin/file/magdir/vmware @@ -1,13 +1,6 @@ -# $OpenBSD: vmware,v 1.1 2004/06/03 03:14:20 tedu Exp $ +# $OpenBSD: vmware,v 1.2 2008/05/08 01:40:57 chl Exp $ # ----------------------------------------------------------- # VMware specific files (deducted from version 1.1 and log file entries) # Anthon van der Neut (anthon@mnt.org) 0 belong 0x4d52564e VMware nvram -0 belong 0x434f5744 VMware ->4 byte 3 virtual disk ->>32 lelong x (%d/ ->>36 lelong x \b%d/ ->>40 lelong x \b%d) ->4 byte 2 undoable disk ->>32 string >\0 (%s) diff --git a/usr.bin/file/magdir/vorbis b/usr.bin/file/magdir/vorbis index ef795fc658f..b7b6d47ceac 100644 --- a/usr.bin/file/magdir/vorbis +++ b/usr.bin/file/magdir/vorbis @@ -1,4 +1,4 @@ -# $OpenBSD: vorbis,v 1.1 2004/06/03 03:15:24 tedu Exp $ +# $OpenBSD: vorbis,v 1.2 2008/05/08 01:40:57 chl Exp $ #------------------------------------------------------------------------------ # vorbis: file(1) magic for Ogg/Vorbis files @@ -18,6 +18,18 @@ ##>4 byte 0 revision 0 >4 byte 0 ##>>14 lelong x (Serial %lX) +# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net) +>>28 string fLaC \b, FLAC audio +# non-Vorbis content: Theora +>>28 string \x80theora \b, Theora video +# non-Vorbis content: Speex +>>28 string Speex\ \ \ \b, Speex audio +# non-Vorbis content: OGM +>>28 string \x01video\0\0\0 \b, OGM video +>>>37 string/c div3 (DivX 3) +>>>37 string/c divx (DivX 4) +>>>37 string/c dx50 (DivX 5) +>>>37 string/c xvid (XviD) # --- First vorbis packet - general header --- >>28 string \x01vorbis \b, Vorbis audio, >>>35 lelong !0 UNKNOWN VERSION %lu, @@ -30,19 +42,19 @@ # Minimal, nominal and maximal bitrates specified when encoding >>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff \b, # The above tests if at least one of these is specified: ->>>>>44 lelong !-1 +>>>>>52 lelong !-1 # Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields # instead of -1. # Vorbis 1.0 uses 0 instead of -1. ->>>>>>44 lelong !-1000 ->>>>>>>44 lelong !0 ->>>>>>>>44 lelong x >%lu ->>>>>48 lelong !-1 ->>>>>>48 lelong x ~%lu ->>>>>52 lelong !-1 >>>>>>52 lelong !0 >>>>>>>52 lelong !-1000 >>>>>>>>52 lelong x <%lu +>>>>>48 lelong !-1 +>>>>>>48 lelong x ~%lu +>>>>>44 lelong !-1 +>>>>>>44 lelong !-1000 +>>>>>>>44 lelong !0 +>>>>>>>>44 lelong x >%lu >>>>>48 string <\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff bps # -- Second vorbis header packet - the comments # A kludge to read the vendor string. It's a counted string, not a @@ -51,30 +63,32 @@ # it. The interesting value is the cvs date (8 digits decimal). # Post-RC1 Ogg files have the second header packet (and thus the version) # in a different place, so we must use an indirect offset. -#>>>(84.b+85) string \x03vorbis -#>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I -#>>>>>(84.b+120) string >00000000 %.8s +>>>(84.b+85) string \x03vorbis +>>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I +>>>>>(84.b+120) string >00000000 # Map to beta version numbers: -#>>>>>>(84.b+120) string <20000508 (<beta1 - prepublic) -#>>>>>>(84.b+120) string 20000508 (beta1/2) -#>>>>>>(84.b+120) string >20000508 -#>>>>>>>(84.b+120) string <20001031 (beta2-3) -#>>>>>>(84.b+120) string 20001031 (beta3) -#>>>>>>(84.b+120) string >20001031 -#>>>>>>>(84.b+120) string <20010225 (beta3-4) -#>>>>>>(84.b+120) string 20010225 (beta4) -#>>>>>>(84.b+120) string >20010225 -#>>>>>>>(84.b+120) string <20010615 (beta4-RC1) -#>>>>>>(84.b+120) string 20010615 (RC1) -#>>>>>>(84.b+120) string 20010813 (RC2) -#>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) -#>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) -#>>>>>>(84.b+120) string 20011217 (pre-RC3 CVS) -#>>>>>>(84.b+120) string 20011231 (RC3) +>>>>>>(84.b+120) string <20000508 (<beta1, prepublic) +>>>>>>(84.b+120) string 20000508 (1.0 beta 1 or beta 2) +>>>>>>(84.b+120) string >20000508 +>>>>>>>(84.b+120) string <20001031 (beta2-3) +>>>>>>(84.b+120) string 20001031 (1.0 beta 3) +>>>>>>(84.b+120) string >20001031 +>>>>>>>(84.b+120) string <20010225 (beta3-4) +>>>>>>(84.b+120) string 20010225 (1.0 beta 4) +>>>>>>(84.b+120) string >20010225 +>>>>>>>(84.b+120) string <20010615 (beta4-RC1) +>>>>>>(84.b+120) string 20010615 (1.0 RC1) +>>>>>>(84.b+120) string 20010813 (1.0 RC2) +>>>>>>(84.b+120) string 20010816 (RC2 - Garf tuned v1) +>>>>>>(84.b+120) string 20011014 (RC2 - Garf tuned v2) +>>>>>>(84.b+120) string 20011217 (1.0 RC3) +>>>>>>(84.b+120) string 20011231 (1.0 RC3) # Some pre-1.0 CVS snapshots still had "Xiphphorus"... -#>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) +>>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) # For the 1.0 release, Xiphophorus is replaced by Xiph.Org -#>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I -#>>>>>(84.b+117) string >00000000 %.8s -#>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) -#>>>>>>(84.b+117) string 20020717 (1.0) +>>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I +>>>>>(84.b+117) string >00000000 +>>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) +>>>>>>(84.b+117) string 20020717 (1.0) +>>>>>>(84.b+117) string 20030909 (1.0.1) +>>>>>>(84.b+117) string 20040629 (1.1.0 RC1) diff --git a/usr.bin/file/magdir/wordperfect b/usr.bin/file/magdir/wordperfect deleted file mode 100644 index 1d3f7b7134b..00000000000 --- a/usr.bin/file/magdir/wordperfect +++ /dev/null @@ -1,93 +0,0 @@ -# $OpenBSD: wordperfect,v 1.3 2001/01/29 01:57:58 niklas Exp $ - -#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE -0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable text ->15 byte 0 Optimized for Intel ->15 byte 1 Optimized for Non-Intel -1 string WPC (Corel/WP) ->8 beshort 257 WordPerfect macro ->8 beshort 258 WordPerfect help file ->8 beshort 259 WordPerfect keyboard file ->8 beshort 266 WordPerfect document ->8 beshort 267 WordPerfect dictionary ->8 beshort 268 WordPerfect thesaurus ->8 beshort 269 WordPerfect block ->8 beshort 270 WordPerfect rectangular block ->8 beshort 271 WordPerfect column block ->8 beshort 272 WordPerfect printer data ->8 beshort 275 WordPerfect printer data ->8 beshort 276 WordPerfect driver resource data ->8 beshort 279 WordPerfect hyphenation code ->8 beshort 280 WordPerfect hyphenation data ->8 beshort 281 WordPerfect macro resource data ->8 beshort 283 WordPerfect hyphenation lex ->8 beshort 285 WordPerfect wordlist ->8 beshort 286 WordPerfect equation resource data ->8 beshort 289 WordPerfect spell rules ->8 beshort 290 WordPerfect dictionary rules ->8 beshort 295 WordPerfect spell rules (Microlytics) ->8 beshort 299 WordPerfect settings file ->8 beshort 301 WordPerfect 4.2 document ->8 beshort 325 WordPerfect dialog file ->8 beshort 332 WordPerfect button bar ->8 beshort 513 Shell macro ->8 beshort 522 Shell definition ->8 beshort 769 Notebook macro ->8 beshort 770 Notebook help file ->8 beshort 771 Notebook keyboard file ->8 beshort 778 Notebook definition ->8 beshort 1026 Calculator help file ->8 beshort 1538 Calendar help file ->8 beshort 1546 Calendar data file ->8 beshort 1793 Editor macro ->8 beshort 1794 Editor help file ->8 beshort 1795 Editor keyboard file ->8 beshort 1817 Editor macro resource file ->8 beshort 2049 Macro editor macro ->8 beshort 2050 Macro editor help file ->8 beshort 2051 Macro editor keyboard file ->8 beshort 2305 PlanPerfect macro ->8 beshort 2306 PlanPerfect help file ->8 beshort 2307 PlanPerfect keyboard file ->8 beshort 2314 PlanPerfect worksheet ->8 beshort 2319 PlanPerfect printer definition ->8 beshort 2322 PlanPerfect graphic definition ->8 beshort 2323 PlanPerfect data ->8 beshort 2324 PlanPerfect temporary printer ->8 beshort 2329 PlanPerfect macro resource data ->8 byte 11 Mail ->8 beshort 2818 help file ->8 beshort 2821 distribution list ->8 beshort 2826 out box ->8 beshort 2827 in box ->8 beshort 2836 users archived mailbox ->8 beshort 2837 archived message database ->8 beshort 2838 archived attachments ->8 beshort 3083 Printer temporary file ->8 beshort 3330 Scheduler help file ->8 beshort 3338 Scheduler in file ->8 beshort 3339 Scheduler out file ->8 beshort 3594 GroupWise settings file ->8 beshort 3601 GroupWise directory services ->8 beshort 3627 GroupWise settings file ->8 beshort 4362 Terminal resource data ->8 beshort 4363 Terminal resource data ->8 beshort 4395 Terminal resource data ->8 beshort 4619 GUI loadable text ->8 beshort 4620 graphics resource data ->8 beshort 4621 printer settings file ->8 beshort 4622 port definition file ->8 beshort 4623 print queue parameters ->8 beshort 4624 compressed file ->8 beshort 5130 Network service msg file ->8 beshort 5131 Network service msg file ->8 beshort 5132 Async gateway login msg ->8 beshort 5134 GroupWise message file ->8 beshort 7956 GroupWise admin domain database ->8 beshort 7957 GroupWise admin host database ->8 beshort 7959 GroupWise admin remote host database ->8 beshort 7960 GroupWise admin ADS deferment data file ->8 beshort 8458 IntelliTAG (SGML) compiled DTD ->8 belong 18219264 WordPerfect graphic image (1.0) ->8 belong 18219520 WordPerfect graphic image (2.0) -#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE diff --git a/usr.bin/file/magdir/wordprocessors b/usr.bin/file/magdir/wordprocessors new file mode 100644 index 00000000000..546d2616d96 --- /dev/null +++ b/usr.bin/file/magdir/wordprocessors @@ -0,0 +1,136 @@ + +#------------------------------------------------------------------------------ +# wordprocessors: file(1) magic fo word processors. +# +####### PWP file format used on Smith Corona Personal Word Processors: +2 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040'92 Smith Corona PWP +>24 byte 2 \b, single spaced +>24 byte 3 \b, 1.5 spaced +>24 byte 4 \b, double spaced +>25 byte 0x42 \b, letter +>25 byte 0x54 \b, legal +>26 byte 0x46 \b, A4 + +#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE +0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable text +>15 byte 0 Optimized for Intel +>15 byte 1 Optimized for Non-Intel +1 string WPC (Corel/WP) +>8 short 257 WordPerfect macro +>8 short 258 WordPerfect help file +>8 short 259 WordPerfect keyboard file +>8 short 266 WordPerfect document +>8 short 267 WordPerfect dictionary +>8 short 268 WordPerfect thesaurus +>8 short 269 WordPerfect block +>8 short 270 WordPerfect rectangular block +>8 short 271 WordPerfect column block +>8 short 272 WordPerfect printer data +>8 short 275 WordPerfect printer data +>8 short 276 WordPerfect driver resource data +>8 short 279 WordPerfect hyphenation code +>8 short 280 WordPerfect hyphenation data +>8 short 281 WordPerfect macro resource data +>8 short 283 WordPerfect hyphenation lex +>8 short 285 WordPerfect wordlist +>8 short 286 WordPerfect equation resource data +>8 short 289 WordPerfect spell rules +>8 short 290 WordPerfect dictionary rules +>8 short 295 WordPerfect spell rules (Microlytics) +>8 short 299 WordPerfect settings file +>8 short 301 WordPerfect 4.2 document +>8 short 325 WordPerfect dialog file +>8 short 332 WordPerfect button bar +>8 short 513 Shell macro +>8 short 522 Shell definition +>8 short 769 Notebook macro +>8 short 770 Notebook help file +>8 short 771 Notebook keyboard file +>8 short 778 Notebook definition +>8 short 1026 Calculator help file +>8 short 1538 Calendar help file +>8 short 1546 Calendar data file +>8 short 1793 Editor macro +>8 short 1794 Editor help file +>8 short 1795 Editor keyboard file +>8 short 1817 Editor macro resource file +>8 short 2049 Macro editor macro +>8 short 2050 Macro editor help file +>8 short 2051 Macro editor keyboard file +>8 short 2305 PlanPerfect macro +>8 short 2306 PlanPerfect help file +>8 short 2307 PlanPerfect keyboard file +>8 short 2314 PlanPerfect worksheet +>8 short 2319 PlanPerfect printer definition +>8 short 2322 PlanPerfect graphic definition +>8 short 2323 PlanPerfect data +>8 short 2324 PlanPerfect temporary printer +>8 short 2329 PlanPerfect macro resource data +>8 byte 11 Mail +>8 short 2818 help file +>8 short 2821 distribution list +>8 short 2826 out box +>8 short 2827 in box +>8 short 2836 users archived mailbox +>8 short 2837 archived message database +>8 short 2838 archived attachments +>8 short 3083 Printer temporary file +>8 short 3330 Scheduler help file +>8 short 3338 Scheduler in file +>8 short 3339 Scheduler out file +>8 short 3594 GroupWise settings file +>8 short 3601 GroupWise directory services +>8 short 3627 GroupWise settings file +>8 short 4362 Terminal resource data +>8 short 4363 Terminal resource data +>8 short 4395 Terminal resource data +>8 short 4619 GUI loadable text +>8 short 4620 graphics resource data +>8 short 4621 printer settings file +>8 short 4622 port definition file +>8 short 4623 print queue parameters +>8 short 4624 compressed file +>8 short 5130 Network service msg file +>8 short 5131 Network service msg file +>8 short 5132 Async gateway login msg +>8 short 5134 GroupWise message file +>8 short 7956 GroupWise admin domain database +>8 short 7957 GroupWise admin host database +>8 short 7959 GroupWise admin remote host database +>8 short 7960 GroupWise admin ADS deferment data file +>8 short 8458 IntelliTAG (SGML) compiled DTD +>8 long 18219264 WordPerfect graphic image (1.0) +>8 long 18219520 WordPerfect graphic image (2.0) +#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE + +# Hangul (Korean) Word Processor File +0 string HWP\ Document\ File Hangul (Korean) Word Processor File 3.0 +# From: Won-Kyu Park <wkpark@kldp.org> +512 string R\0o\0o\0t\0 Hangul (Korean) Word Processor File 2000 + +# CosmicBook, from Benoît Rouits +0 string CSBK Ted Neslson's CosmicBook hypertext file + +2 string EYWR AmigaWriter file + +# chi: file(1) magic for ChiWriter files +0 string \\1cw\ ChiWriter file +>5 string >\0 version %s +0 string \\1cw ChiWriter file + +# Quark Express from http://www.garykessler.net/library/file_sigs.html +2 string IIXPR3 Intel Quark Express Document (English) +2 string IIXPRa Intel Quark Express Document (Korean) +2 string MMXPR3 Motorola Quark Express Document (English) +2 string MMXPRa Motorola Quark Express Document (Korean) + +# adobe indesign (document, whatever...) from querkan +0 belong 0x0606edf5 Adobe InDesign +>16 string DOCUMENT Document + +# From: Michael Piefel <piefel@debian.org> +# sqtroff intermediate language (replacement for ditroff int. lang.) +0 string X\ 495 SoftQuad troff Context intermediate for AT&T 495 laser printer +0 string X\ hp SoftQuad troff Context intermediate for HP LaserJet +0 string X\ impr SoftQuad troff Context intermediate for IMAGEN imPRESS +0 string X\ ps SoftQuad troff Context intermediate for PostScript diff --git a/usr.bin/file/magdir/xo65 b/usr.bin/file/magdir/xo65 new file mode 100644 index 00000000000..1020cee58c7 --- /dev/null +++ b/usr.bin/file/magdir/xo65 @@ -0,0 +1,29 @@ + +#------------------------------------------------------------------------------ +# xo65 object files +# From: "Ullrich von Bassewitz" <uz@cc65.org> +# +0 string \x55\x7A\x6E\x61 xo65 object, +>4 leshort x version %d, +>6 leshort&0x0001 =0x0001 with debug info +>6 leshort&0x0001 =0x0000 no debug info + +# xo65 library files +0 string \x6E\x61\x55\x7A xo65 library, +>4 leshort x version %d + +# o65 object files +0 string \x01\x00\x6F\x36\x35 o65 +>6 leshort&0x1000 =0x0000 executable, +>6 leshort&0x1000 =0x1000 object, +>5 byte x version %d, +>6 leshort&0x8000 =0x8000 65816, +>6 leshort&0x8000 =0x0000 6502, +>6 leshort&0x2000 =0x2000 32 bit, +>6 leshort&0x2000 =0x0000 16 bit, +>6 leshort&0x4000 =0x4000 page reloc, +>6 leshort&0x4000 =0x0000 byte reloc, +>6 leshort&0x0003 =0x0000 alignment 1 +>6 leshort&0x0003 =0x0001 alignment 2 +>6 leshort&0x0003 =0x0002 alignment 4 +>6 leshort&0x0003 =0x0003 alignment 256 diff --git a/usr.bin/file/magdir/xwindows b/usr.bin/file/magdir/xwindows index aae84e9ce33..57f3b083f3b 100644 --- a/usr.bin/file/magdir/xwindows +++ b/usr.bin/file/magdir/xwindows @@ -1,4 +1,3 @@ -# $OpenBSD: xwindows,v 1.1 2004/06/03 03:14:20 tedu Exp $ #------------------------------------------------------------------------------ # xwindows: file(1) magic for various X/Window system file formats. @@ -14,7 +13,7 @@ # xfsdump archive 0 string xFSdump0 xfsdump archive ->8 long x (version %d) +>8 belong x (version %d) # Jaleo XFS files 0 long 395726 Jaleo XFS file diff --git a/usr.bin/file/magic.c b/usr.bin/file/magic.c index 6640ed5cad4..a09b987a182 100644 --- a/usr.bin/file/magic.c +++ b/usr.bin/file/magic.c @@ -1,4 +1,4 @@ -/* $OpenBSD: magic.c,v 1.4 2007/09/02 15:19:32 deraadt Exp $ */ +/* $OpenBSD: magic.c,v 1.5 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Christos Zoulas 2003. * All Rights Reserved. @@ -12,8 +12,6 @@ * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. - * 3. The name of the author may not be used to endorse or promote products - * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE @@ -38,19 +36,19 @@ #include <sys/types.h> #include <sys/param.h> /* for MAXPATHLEN */ #include <sys/stat.h> -#include <fcntl.h> /* for open() */ #ifdef QUICK #include <sys/mman.h> #endif +#include <limits.h> /* for PIPE_BUF */ -#if defined(HAVE_UTIME) +#if defined(HAVE_UTIMES) +# include <sys/time.h> +#elif defined(HAVE_UTIME) # if defined(HAVE_SYS_UTIME_H) # include <sys/utime.h> # elif defined(HAVE_UTIME_H) # include <utime.h> # endif -#elif defined(HAVE_UTIMES) -# include <sys/time.h> #endif #ifdef HAVE_UNISTD_H @@ -66,7 +64,7 @@ #include "patchlevel.h" #ifndef lint -FILE_RCSID("@(#)$Id: magic.c,v 1.4 2007/09/02 15:19:32 deraadt Exp $") +FILE_RCSID("@(#)$Id: magic.c,v 1.5 2008/05/08 01:40:56 chl Exp $") #endif /* lint */ #ifdef __EMX__ @@ -78,44 +76,50 @@ protected int file_os2_apptype(struct magic_set *ms, const char *fn, private void free_mlist(struct mlist *); private void close_and_restore(const struct magic_set *, const char *, int, const struct stat *); +private int info_from_stat(struct magic_set *, mode_t); + +#ifndef STDIN_FILENO +#define STDIN_FILENO 0 +#endif public struct magic_set * magic_open(int flags) { struct magic_set *ms; - if ((ms = malloc(sizeof(struct magic_set))) == NULL) + if ((ms = calloc((size_t)1, sizeof(struct magic_set))) == NULL) return NULL; if (magic_setflags(ms, flags) == -1) { - free(ms); errno = EINVAL; - return NULL; + goto free1; } ms->o.ptr = ms->o.buf = malloc(ms->o.left = ms->o.size = 1024); - if (ms->o.buf == NULL) { - free(ms); - return NULL; - } + if (ms->o.buf == NULL) + goto free1; + ms->o.pbuf = malloc(ms->o.psize = 1024); - if (ms->o.pbuf == NULL) { - free(ms->o.buf); - free(ms); - return NULL; - } - ms->c.len = 10; - ms->c.off = calloc(ms->c.len, sizeof(*ms->c.off)); - if (ms->c.off == NULL) { - free(ms->o.pbuf); - free(ms->o.buf); - free(ms); - return NULL; - } + if (ms->o.pbuf == NULL) + goto free2; + + ms->c.li = malloc((ms->c.len = 10) * sizeof(*ms->c.li)); + if (ms->c.li == NULL) + goto free3; + ms->haderr = 0; ms->error = -1; ms->mlist = NULL; + ms->file = "unknown"; + ms->line = 0; return ms; +free3: + free(ms->o.pbuf); +free2: + free(ms->o.buf); +free1: + free(ms); + return NULL; } private void @@ -136,13 +140,31 @@ free_mlist(struct mlist *mlist) free(ml); } +private int +info_from_stat(struct magic_set *ms, mode_t md) +{ + /* We cannot open it, but we were able to stat it. */ + if (md & 0222) + if (file_printf(ms, "writable, ") == -1) + return -1; + if (md & 0111) + if (file_printf(ms, "executable, ") == -1) + return -1; + if (S_ISREG(md)) + if (file_printf(ms, "regular file, ") == -1) + return -1; + if (file_printf(ms, "no read permission") == -1) + return -1; + return 0; +} + public void -magic_close(ms) - struct magic_set *ms; +magic_close(struct magic_set *ms) { free_mlist(ms->mlist); + free(ms->o.pbuf); free(ms->o.buf); - free(ms->c.off); + free(ms->c.li); free(ms); } @@ -181,8 +203,11 @@ private void close_and_restore(const struct magic_set *ms, const char *name, int fd, const struct stat *sb) { + if (fd == STDIN_FILENO) + return; (void) close(fd); - if (fd != STDIN_FILENO && (ms->flags & MAGIC_PRESERVE_ATIME) != 0) { + + if ((ms->flags & MAGIC_PRESERVE_ATIME) != 0) { /* * Try to restore access, modification times if read it. * This is really *bad* because it will modify the status @@ -205,6 +230,7 @@ close_and_restore(const struct magic_set *ms, const char *name, int fd, } } +#ifndef COMPILE_ONLY /* * find type of named file */ @@ -212,94 +238,112 @@ public const char * magic_file(struct magic_set *ms, const char *inname) { int fd = 0; - unsigned char buf[HOWMANY+1]; /* one extra for terminating '\0' */ + int rv = -1; + unsigned char *buf; struct stat sb; ssize_t nbytes = 0; /* number of bytes read from a datafile */ + int ispipe = 0; - if (file_reset(ms) == -1) + /* + * one extra for terminating '\0', and + * some overlapping space for matches near EOF + */ +#define SLOP (1 + sizeof(union VALUETYPE)) + if ((buf = malloc(HOWMANY + SLOP)) == NULL) return NULL; + if (file_reset(ms) == -1) + goto done; + switch (file_fsmagic(ms, inname, &sb)) { - case -1: - return NULL; - case 0: + case -1: /* error */ + goto done; + case 0: /* nothing found */ break; - default: - return file_getbuffer(ms); + default: /* matched it and printed type */ + rv = 0; + goto done; } -#ifndef STDIN_FILENO -#define STDIN_FILENO 0 -#endif - if (inname == NULL) + if (inname == NULL) { fd = STDIN_FILENO; - else if ((fd = open(inname, O_RDONLY)) < 0) { - /* We cannot open it, but we were able to stat it. */ - if (sb.st_mode & 0222) - if (file_printf(ms, "writable, ") == -1) - return NULL; - if (sb.st_mode & 0111) - if (file_printf(ms, "executable, ") == -1) - return NULL; - if (S_ISREG(sb.st_mode)) - if (file_printf(ms, "regular file, ") == -1) - return NULL; - if (file_printf(ms, "no read permission") == -1) - return NULL; - return file_getbuffer(ms); + if (fstat(fd, &sb) == 0 && S_ISFIFO(sb.st_mode)) + ispipe = 1; + } else { + int flags = O_RDONLY|O_BINARY; + + if (stat(inname, &sb) == 0 && S_ISFIFO(sb.st_mode)) { + flags |= O_NONBLOCK; + ispipe = 1; + } + + errno = 0; + if ((fd = open(inname, flags)) < 0) { +#ifdef __CYGWIN__ + char *tmp = alloca(strlen(inname) + 5); + (void)strcat(strcpy(tmp, inname), ".exe"); + if ((fd = open(tmp, flags)) < 0) { +#endif + if (info_from_stat(ms, sb.st_mode) == -1) + goto done; + rv = 0; + goto done; +#ifdef __CYGWIN__ + } +#endif + } +#ifdef O_NONBLOCK + if ((flags = fcntl(fd, F_GETFL)) != -1) { + flags &= ~O_NONBLOCK; + (void)fcntl(fd, F_SETFL, flags); + } +#endif } /* * try looking at the first HOWMANY bytes */ - if ((nbytes = read(fd, (char *)buf, HOWMANY)) == -1) { - file_error(ms, errno, "cannot read `%s'", inname); - goto done; + if (ispipe) { + ssize_t r = 0; + + while ((r = sread(fd, (void *)&buf[nbytes], + (size_t)(HOWMANY - nbytes), 1)) > 0) { + nbytes += r; + if (r < PIPE_BUF) break; + } + + if (nbytes == 0) { + /* We can not read it, but we were able to stat it. */ + if (info_from_stat(ms, sb.st_mode) == -1) + goto done; + rv = 0; + goto done; + } + + } else { + if ((nbytes = read(fd, (char *)buf, HOWMANY)) == -1) { + file_error(ms, errno, "cannot read `%s'", inname); + goto done; + } } if (nbytes == 0) { if (file_printf(ms, (ms->flags & MAGIC_MIME) ? "application/x-empty" : "empty") == -1) goto done; - goto gotit; } else if (nbytes == 1) { if (file_printf(ms, "very short file (no magic)") == -1) goto done; - goto gotit; } else { - buf[nbytes] = '\0'; /* null-terminate it */ -#ifdef __EMX__ - switch (file_os2_apptype(ms, inname, buf, nbytes)) { - case -1: - goto done; - case 0: - break; - default: - goto gotit; - } -#endif - if (file_buffer(ms, buf, (size_t)nbytes) == -1) + (void)memset(buf + nbytes, 0, SLOP); /* NUL terminate */ + if (file_buffer(ms, fd, inname, buf, (size_t)nbytes) == -1) goto done; -#ifdef BUILTIN_ELF - if (nbytes > 5) { - /* - * We matched something in the file, so this *might* - * be an ELF file, and the file is at least 5 bytes - * long, so if it's an ELF file it has at least one - * byte past the ELF magic number - try extracting - * information from the ELF headers that cannot easily - * be extracted with rules in the magic file. - */ - file_tryelf(ms, fd, buf, (size_t)nbytes); - } -#endif } -gotit: - close_and_restore(ms, inname, fd, &sb); - return file_getbuffer(ms); + rv = 0; done: + free(buf); close_and_restore(ms, inname, fd, &sb); - return NULL; + return rv == 0 ? file_getbuffer(ms) : NULL; } @@ -312,11 +356,12 @@ magic_buffer(struct magic_set *ms, const void *buf, size_t nb) * The main work is done here! * We have the file name and/or the data buffer to be identified. */ - if (file_buffer(ms, buf, nb) == -1) { + if (file_buffer(ms, -1, NULL, buf, nb) == -1) { return NULL; } return file_getbuffer(ms); } +#endif public const char * magic_error(struct magic_set *ms) diff --git a/usr.bin/file/magic.h b/usr.bin/file/magic.h index a483010cfe1..1731bffbcb6 100644 --- a/usr.bin/file/magic.h +++ b/usr.bin/file/magic.h @@ -1,4 +1,4 @@ -/* $OpenBSD: magic.h,v 1.2 2004/05/19 02:36:26 tedu Exp $ */ +/* $OpenBSD: magic.h,v 1.3 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Christos Zoulas 2003. * All Rights Reserved. @@ -12,8 +12,6 @@ * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. - * 3. The name of the author may not be used to endorse or promote products - * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE @@ -32,17 +30,26 @@ #include <sys/types.h> -#define MAGIC_NONE 0x000 /* No flags */ -#define MAGIC_DEBUG 0x001 /* Turn on debugging */ -#define MAGIC_SYMLINK 0x002 /* Follow symlinks */ -#define MAGIC_COMPRESS 0x004 /* Check inside compressed files */ -#define MAGIC_DEVICES 0x008 /* Look at the contents of devices */ -#define MAGIC_MIME 0x010 /* Return a mime string */ -#define MAGIC_CONTINUE 0x020 /* Return all matches */ -#define MAGIC_CHECK 0x040 /* Print warnings to stderr */ -#define MAGIC_PRESERVE_ATIME 0x080 /* Restore access time on exit */ -#define MAGIC_RAW 0x100 /* Don't translate unprintable chars */ -#define MAGIC_ERROR 0x200 /* Handle ENOENT etc as real errors */ +#define MAGIC_NONE 0x000000 /* No flags */ +#define MAGIC_DEBUG 0x000001 /* Turn on debugging */ +#define MAGIC_SYMLINK 0x000002 /* Follow symlinks */ +#define MAGIC_COMPRESS 0x000004 /* Check inside compressed files */ +#define MAGIC_DEVICES 0x000008 /* Look at the contents of devices */ +#define MAGIC_MIME 0x000010 /* Return a mime string */ +#define MAGIC_CONTINUE 0x000020 /* Return all matches */ +#define MAGIC_CHECK 0x000040 /* Print warnings to stderr */ +#define MAGIC_PRESERVE_ATIME 0x000080 /* Restore access time on exit */ +#define MAGIC_RAW 0x000100 /* Don't translate unprintable chars */ +#define MAGIC_ERROR 0x000200 /* Handle ENOENT etc as real errors */ +#define MAGIC_NO_CHECK_COMPRESS 0x001000 /* Don't check for compressed files */ +#define MAGIC_NO_CHECK_TAR 0x002000 /* Don't check for tar files */ +#define MAGIC_NO_CHECK_SOFT 0x004000 /* Don't check magic entries */ +#define MAGIC_NO_CHECK_APPTYPE 0x008000 /* Don't check application type */ +#define MAGIC_NO_CHECK_ELF 0x010000 /* Don't check for elf details */ +#define MAGIC_NO_CHECK_ASCII 0x020000 /* Don't check for ascii files */ +#define MAGIC_NO_CHECK_TROFF 0x040000 /* Don't check ascii/troff */ +#define MAGIC_NO_CHECK_FORTRAN 0x080000 /* Don't check ascii/fortran */ +#define MAGIC_NO_CHECK_TOKENS 0x100000 /* Don't check ascii/tokens */ #ifdef __cplusplus extern "C" { diff --git a/usr.bin/file/names.h b/usr.bin/file/names.h index 3367cfe1294..afc018d0c41 100644 --- a/usr.bin/file/names.h +++ b/usr.bin/file/names.h @@ -1,4 +1,4 @@ -/* $OpenBSD: names.h,v 1.6 2004/05/19 02:32:35 tedu Exp $ */ +/* $OpenBSD: names.h,v 1.7 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Ian F. Darwin 1986-1995. * Software written by Ian F. Darwin and others; @@ -33,7 +33,7 @@ * appear at fixed offsets into the file. Don't make HOWMANY * too high unless you have a very fast CPU. * - * $Id: names.h,v 1.6 2004/05/19 02:32:35 tedu Exp $ + * $Id: names.h,v 1.7 2008/05/08 01:40:56 chl Exp $ */ /* @@ -168,6 +168,8 @@ static struct names { {".text", L_MACH}, {"clr", L_MACH}, {"(input,", L_PAS}, + {"program", L_PAS}, + {"record", L_PAS}, {"dcl", L_PLI}, {"Received:", L_MAIL}, {">From", L_MAIL}, diff --git a/usr.bin/file/patchlevel.h b/usr.bin/file/patchlevel.h index 5e68ffcfd16..103cde05235 100644 --- a/usr.bin/file/patchlevel.h +++ b/usr.bin/file/patchlevel.h @@ -1,34 +1,334 @@ -/* $OpenBSD: patchlevel.h,v 1.7 2004/05/19 02:32:35 tedu Exp $ */ +/* $OpenBSD: patchlevel.h,v 1.8 2008/05/08 01:40:56 chl Exp $ */ #define FILE_VERSION_MAJOR 4 -#define patchlevel 9 +#define patchlevel 21 /* - * Patchlevel file for Ian Darwin's file(1) command. + * Patchlevel file for Ian Darwin's MAGIC command. + * $File: patchlevel.h,v 1.65 2007/05/24 17:22:27 christos Exp $ * - * Copyright (c) Ian F. Darwin 1986-1995. - * Software written by Ian F. Darwin and others; - * maintained 1995-present by Christos Zoulas and others. + * $Log: patchlevel.h,v $ + * Revision 1.8 2008/05/08 01:40:56 chl + * Update file to 4.21. + * + * tested by ian@ sthen@ + * + * OK ian@, "move ahead with it" deraadt@ + * + * Revision 1.65 2007/05/24 17:22:27 christos + * Welcome to 4.21 + * + * Revision 1.64 2007/03/01 22:14:55 christos + * welcome to 4.20 + * + * Revision 1.63 2007/01/12 17:38:28 christos + * Use File id. + * + * Revision 1.62 2006/12/11 21:49:58 christos + * time for 4.19 + * + * Revision 1.61 2006/10/31 21:18:09 christos + * bump + * + * Revision 1.60 2006/03/02 22:15:12 christos + * welcome to 4.17 + * + * Revision 1.59 2005/10/17 17:15:21 christos + * welcome to 4.16 + * + * Revision 1.58 2005/08/18 15:52:56 christos + * welcome to 4.15 + * + * Revision 1.57 2005/06/25 15:52:14 christos + * Welcome to 4.14 + * + * Revision 1.56 2005/02/09 19:25:13 christos + * Welcome to 4.13 + * + * Revision 1.55 2004/11/24 18:57:47 christos + * Re-do the autoconf stuff once more; passes make dist now. + * + * Revision 1.54 2004/11/21 05:52:05 christos + * ready for 4.11 + * + * Revision 1.53 2004/07/24 20:40:46 christos + * welcome to 4.10 + * + * Revision 1.52 2004/04/07 00:32:25 christos + * welcome to 4.09 + * + * Revision 1.51 2004/03/22 21:17:11 christos + * welcome to 4.08. + * + * Revision 1.50 2003/12/23 17:34:04 christos + * 4.07 + * + * Revision 1.49 2003/10/15 02:08:27 christos + * welcome to 4.06 + * + * Revision 1.48 2003/09/12 19:41:14 christos + * this is 4.04 + * + * Revision 1.47 2003/05/23 21:38:21 christos + * welcome to 4.03 + * + * Revision 1.46 2003/04/02 18:57:43 christos + * prepare for 4.02 + * + * Revision 1.45 2003/03/26 15:37:25 christos + * - Pass lint + * - make NULL in magic_file mean stdin + * - Fix "-" argument to file to pass NULL to magic_file + * - avoid pointer casts by using memcpy + * - rename magic_buf -> magic_buffer + * - keep only the first error + * - manual page: new sentence, new line + * - fix typo in api function (magic_buf -> magic_buffer) + * + * Revision 1.44 2003/03/23 22:23:31 christos + * finish librarification. + * + * Revision 1.43 2003/03/23 21:16:26 christos + * update copyrights. + * + * Revision 1.42 2003/03/23 04:06:05 christos + * Library re-organization + * + * Revision 1.41 2003/02/27 20:53:45 christos + * - fix memory allocation problem (Jeff Johnson) + * - fix stack overflow corruption (David Endler) + * - fixes from NetBSD source (Antti Kantee) + * - magic fixes + * + * Revision 1.40 2003/02/08 18:33:53 christos + * - detect inttypes.h too (Dave Love <d.love@dl.ac.uk>) + * - eliminate unsigned char warnings (Petter Reinholdtsen <pere@hungry.com>) + * - better elf PT_NOTE handling (Nalin Dahyabhai <nalin@redhat.com>) + * - add options to format the output differently + * - much more magic. + * + * Revision 1.39 2002/07/03 18:57:52 christos + * - ansify/c99ize + * - more magic + * - better COMPILE_ONLY support. + * - new magic files. + * - fix solaris compilation problems. + * + * Revision 1.38 2002/05/16 18:45:56 christos + * - pt_note elf additions from NetBSD + * - EMX os specific changes (Alexander Mai) + * - stdint.h detection, acconfig.h fixes (Maciej W. Rozycki, Franz Korntner) + * - regex file additions (Kim Cromie) + * - getopt_long support and misc cleanups (Michael Piefel) + * - many magic fixes and additions + * + * Revision 1.37 2001/09/03 14:44:22 christos + * daylight/tm_isdst detection + * magic fixes + * don't eat the whole file if it has only nulls + * + * Revision 1.36 2001/07/22 21:04:15 christos + * - magic fixes + * - add new operators, pascal strings, UTC date printing, $HOME/.magic + * [from "Tom N Harris" <telliamed@mac.com>] + * + * Revision 1.35 2001/04/24 14:40:25 christos + * - rename magic file sgi to mips and fix it + * - add support for building magic.mgc + * - portability fixes for mmap() + * - try gzip before uncompress, because uncompress sometimes hangs + * - be more conservative about pipe reads and writes + * - many magic fixes + * + * Revision 1.34 2001/03/12 05:05:57 christos + * - new compiled magic format + * - lots of magic additions + * + * Revision 1.33 2000/11/13 00:30:50 christos + * - wordperfect magic fix: freebsd pr 9388 + * - more msdos fixes from freebsd pr's 20131 and 20812 + * - sas and spss magic [Bruce Foster] + * - mkinstalldirs [John Fremlin] + * - sgi opengl fixes [Michael Pruett] + * - netbsd magic fixes [Ignatios Souvatzis] + * - audio additions [Michael Pruett] + * - fix problem with non ansi RCSID [Andreas Ley] + * - oggs magic [Felix von Leitner] + * - gmon magic [Eugen Dedu] + * - TNEF magic [Joomy] + * - netpbm magic and misc other image stuff [Bryan Henderson] + * + * Revision 1.32 2000/08/05 18:24:18 christos + * Correct indianness detection in elf (Charles Hannum) + * FreeBSD elf core support (Guy Harris) + * Use gzip in systems that don't have uncompress (Anthon van der Neut) + * Internationalization/EBCDIC support (Eric Fisher) + * Many many magic changes + * + * Revision 1.31 2000/05/14 17:58:36 christos + * - new magic for claris files + * - new magic for mathematica and maple files + * - new magic for msvc files + * - new -k flag to keep going matching all possible entries + * - add the word executable on #! magic files, and fix the usage of + * the word script + * - lots of other magic fixes + * - fix typo test -> text + * + * Revision 1.30 2000/04/11 02:41:17 christos + * - add support for mime output (-i) + * - make sure we free memory in case realloc fails + * - magic fixes + * + * Revision 1.29 1999/11/28 20:02:29 christos + * new string/[Bcb] magic from anthon, and adjustments to the magic files to + * use it. + * + * Revision 1.28 1999/10/31 22:11:48 christos + * - add "char" type for compatibility with HP/UX + * - recognize HP/UX syntax &=n etc. + * - include errno.h for CYGWIN + * - conditionalize the S_IS* macros + * - revert the SHT_DYNSYM test that broke the linux stripped binaries test + * - lots of Magdir changes + * + * Revision 1.27 1999/02/14 17:21:41 christos + * Automake support and misc cleanups from Rainer Orth + * Enable reading character and block special files from Dale R. Worley + * + * Revision 1.26 1998/09/12 13:19:39 christos + * - add support for bi-endian indirect offsets (Richard Verhoeven) + * - add recognition for bcpl (Joseph Myers) + * - remove non magic files from Magdir to avoid difficulties building + * on os2 where files are case independent + * - magic fixes. + * + * Revision 1.25 1998/06/27 14:04:04 christos + * OLF patch Guy Harris + * Recognize java/html (debian linux) + * Const poisoning (debian linux) + * More magic! + * + * Revision 1.24 1998/02/15 23:20:38 christos + * Autoconf patch: Felix von Leitner <leitner@math.fu-berlin.de> + * More magic fixes + * Elf64 fixes + * + * Revision 1.23 1997/11/05 16:03:37 christos + * - correct elf prps offset for SunOS-2.5.1 [guy@netapp.com] + * - handle 64 bit time_t's correctly [ewt@redhat.com] + * - new mime style magic [clarosse@netvista.net] + * - new TI calculator magic [rmcguire@freenet.columbus.oh.us] + * - new figlet fonts [obrien@freebsd.org] + * - new cisco magic, and elf fixes [jhawk@bbnplanet.com] + * - -b flag addition, and x86 filesystem magic [vax@linkhead.paranoia.com] + * - s/Mpeg/MPEG, header and elf typo fixes [guy@netapp.com] + * - Windows/NT registry files, audio code [guy@netapp.com] + * - libGrx graphics lib fonts [guy@netapp.com] + * - PNG fixes [guy@netapp.com] + * - more m$ document magic [guy@netapp.com] + * - PPD files [guy@netapp.com] + * - archive magic cleanup [guy@netapp.com] + * - linux kernel magic cleanup [guy@netapp.com] + * - lecter magic [guy@netapp.com] + * - vgetty magic [guy@netapp.com] + * - sniffer additions [guy@netapp.com] + * + * Revision 1.22 1997/01/15 17:23:24 christos + * - add support for elf core files: find the program name under SVR4 [Ken Pizzini] + * - print strings only up to the first carriage return [various] + * - freebsd international ascii support [J Wunsch] + * - magic fixes and additions [Guy Harris] + * - 64 bit fixes [Larry Schwimmer] + * - support for both utime and utimes, but don't restore file access times + * by default [various] + * - \xXX only takes 2 hex digits, not 3. + * - re-implement support for core files [Guy Harris] + * + * Revision 1.21 1996/10/05 18:15:29 christos + * Segregate elf stuff and conditionally enable it with -DBUILTIN_ELF + * More magic fixes + * + * Revision 1.20 1996/06/22 22:15:52 christos + * - support relative offsets of the form >& + * - fix bug with truncating magic strings that contain \n + * - file -f - did not read from stdin as documented + * - support elf file parsing using our own elf support. + * - as always magdir fixes and additions. + * + * Revision 1.19 1995/10/27 23:14:46 christos + * Ability to parse colon separated list of magic files + * New LEGAL.NOTICE + * Various magic file changes + * + * Revision 1.18 1995/05/20 22:09:21 christos + * Passed incorrect argument to eatsize(). + * Use %ld and %lx where appropriate. + * Remove unused variables + * ELF support for both big and little endian + * Fixes for small files again. + * + * Revision 1.17 1995/04/28 17:29:13 christos + * - Incorrect nroff detection fix from der Mouse + * - Lost and incorrect magic entries. + * - Added ELF stripped binary detection [in C; ugh] + * - Look for $MAGIC to find the magic file. + * - Eat trailing size specifications from numbers i.e. ignore 10L + * - More fixes for very short files + * + * Revision 1.16 1995/03/25 22:06:45 christos + * - use strtoul() where it exists. + * - fix sign-extend bug + * - try to detect tar archives before nroff files, otherwise + * tar files where the first file starts with a . will not work + * + * Revision 1.15 1995/01/21 21:03:35 christos + * Added CSECTION for the file man page + * Added version flag -v + * Fixed bug with -f input flag (from iorio@violet.berkeley.edu) + * Lots of magic fixes and reorganization... + * + * Revision 1.14 1994/05/03 17:58:23 christos + * changes from mycroft@gnu.ai.mit.edu (Charles Hannum) for unsigned + * + * Revision 1.13 1994/01/21 01:27:01 christos + * Fixed null termination bug from Don Seeley at BSDI in ascmagic.c + * + * Revision 1.12 1993/10/27 20:59:05 christos + * Changed -z flag to understand gzip format too. + * Moved builtin compression detection to a table, and move + * the compress magic entry out of the source. + * Made printing of numbers unsigned, and added the mask to it. + * Changed the buffer size to 8k, because gzip will refuse to + * unzip just a few bytes. + * + * Revision 1.11 1993/09/24 18:49:06 christos + * Fixed small bug in softmagic.c introduced by + * copying the data to be examined out of the input + * buffer. Changed the Makefile to use sed to create + * the correct man pages. + * + * Revision 1.10 1993/09/23 21:56:23 christos + * Passed purify. Fixed indirections. Fixed byte order printing. + * Fixed segmentation faults caused by referencing past the end + * of the magic buffer. Fixed bus errors caused by referencing + * unaligned shorts or longs. + * + * Revision 1.9 1993/03/24 14:23:40 ian + * Batch of minor changes from several contributors. + * + * Revision 1.8 93/02/19 15:01:26 ian + * Numerous changes from Guy Harris too numerous to mention but including + * byte-order independance, fixing "old-style masking", etc. etc. A bugfix + * for broken symlinks from martin@@d255s004.zfe.siemens.de. + * + * Revision 1.7 93/01/05 14:57:27 ian + * Couple of nits picked by Christos (again, thanks). + * + * Revision 1.6 93/01/05 13:51:09 ian + * Lotsa work on the Magic directory. + * + * Revision 1.5 92/09/14 14:54:51 ian + * Fix a tiny null-pointer bug in previous fix for tar archive + uncompress. * - * Redistribution and use in source and binary forms, with or without - * modification, are permitted provided that the following conditions - * are met: - * 1. Redistributions of source code must retain the above copyright - * notice immediately at the beginning of the file, without modification, - * this list of conditions, and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR - * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. */ diff --git a/usr.bin/file/print.c b/usr.bin/file/print.c index 11bd3781bf6..438aaa00712 100644 --- a/usr.bin/file/print.c +++ b/usr.bin/file/print.c @@ -1,4 +1,4 @@ -/* $OpenBSD: print.c,v 1.13 2007/09/14 14:29:20 chl Exp $ */ +/* $OpenBSD: print.c,v 1.14 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Ian F. Darwin 1986-1995. * Software written by Ian F. Darwin and others; @@ -42,7 +42,7 @@ #include <time.h> #ifndef lint -FILE_RCSID("@(#)$Id: print.c,v 1.13 2007/09/14 14:29:20 chl Exp $") +FILE_RCSID("@(#)$Id: print.c,v 1.14 2008/05/08 01:40:56 chl Exp $") #endif /* lint */ #define SZOF(a) (sizeof(a) / sizeof(a[0])) @@ -51,52 +51,59 @@ FILE_RCSID("@(#)$Id: print.c,v 1.13 2007/09/14 14:29:20 chl Exp $") protected void file_mdump(struct magic *m) { - private const char *typ[] = { "invalid", "byte", "short", "invalid", - "long", "string", "date", "beshort", - "belong", "bedate", "leshort", "lelong", - "ledate", "pstring", "ldate", "beldate", - "leldate", "regex" }; - private const char optyp[] = { '@', '&', '|', '^', '+', '-', - '*', '/', '%' }; - (void) fputc('[', stderr); - (void) fprintf(stderr, ">>>>>>>> %d" + 8 - (m->cont_level & 7), + private const char optyp[] = { FILE_OPS }; + + (void) fprintf(stderr, "[%u", m->lineno); + (void) fprintf(stderr, ">>>>>>>> %u" + 8 - (m->cont_level & 7), m->offset); if (m->flag & INDIR) { (void) fprintf(stderr, "(%s,", /* Note: type is unsigned */ - (m->in_type < SZOF(typ)) ? - typ[m->in_type] : "*bad*"); + (m->in_type < file_nnames) ? + file_names[m->in_type] : "*bad*"); if (m->in_op & FILE_OPINVERSE) (void) fputc('~', stderr); - (void) fprintf(stderr, "%c%d),", - ((m->in_op&0x7F) < SZOF(optyp)) ? - optyp[m->in_op&0x7F] : '?', + (void) fprintf(stderr, "%c%u),", + ((m->in_op & FILE_OPS_MASK) < SZOF(optyp)) ? + optyp[m->in_op & FILE_OPS_MASK] : '?', m->in_offset); } (void) fprintf(stderr, " %s%s", (m->flag & UNSIGNED) ? "u" : "", /* Note: type is unsigned */ - (m->type < SZOF(typ)) ? typ[m->type] : "*bad*"); + (m->type < file_nnames) ? file_names[m->type] : "*bad*"); if (m->mask_op & FILE_OPINVERSE) (void) fputc('~', stderr); - if (m->mask) { - if ((m->mask_op & 0x7F) < SZOF(optyp)) - fputc(optyp[m->mask_op&0x7F], stderr); - else - fputc('?', stderr); - if(FILE_STRING != m->type || FILE_PSTRING != m->type) - (void) fprintf(stderr, "%.8x", m->mask); - else { - if (m->mask & STRING_IGNORE_LOWERCASE) - (void) fputc(CHAR_IGNORE_LOWERCASE, stderr); - if (m->mask & STRING_COMPACT_BLANK) + + if (IS_STRING(m->type)) { + if (m->str_flags) { + (void) fputc('/', stderr); + if (m->str_flags & STRING_COMPACT_BLANK) (void) fputc(CHAR_COMPACT_BLANK, stderr); - if (m->mask & STRING_COMPACT_OPTIONAL_BLANK) + if (m->str_flags & STRING_COMPACT_OPTIONAL_BLANK) (void) fputc(CHAR_COMPACT_OPTIONAL_BLANK, - stderr); + stderr); + if (m->str_flags & STRING_IGNORE_LOWERCASE) + (void) fputc(CHAR_IGNORE_LOWERCASE, stderr); + if (m->str_flags & STRING_IGNORE_UPPERCASE) + (void) fputc(CHAR_IGNORE_UPPERCASE, stderr); + if (m->str_flags & REGEX_OFFSET_START) + (void) fputc(CHAR_REGEX_OFFSET_START, stderr); + } + if (m->str_count) + (void) fprintf(stderr, "/%u", m->str_count); + } + else { + if ((m->mask_op & FILE_OPS_MASK) < SZOF(optyp)) + (void) fputc(optyp[m->mask_op & FILE_OPS_MASK], stderr); + else + (void) fputc('?', stderr); + + if (m->num_mask) { + (void) fprintf(stderr, "%.8llx", + (unsigned long long)m->num_mask); } } - (void) fprintf(stderr, ",%c", m->reln); if (m->reln != 'x') { @@ -106,27 +113,54 @@ file_mdump(struct magic *m) case FILE_LONG: case FILE_LESHORT: case FILE_LELONG: + case FILE_MELONG: case FILE_BESHORT: case FILE_BELONG: (void) fprintf(stderr, "%d", m->value.l); break; - case FILE_STRING: + case FILE_BEQUAD: + case FILE_LEQUAD: + case FILE_QUAD: + (void) fprintf(stderr, "%lld", + (unsigned long long)m->value.q); + break; case FILE_PSTRING: + case FILE_STRING: case FILE_REGEX: - file_showstr(stderr, m->value.s, ~0U); + case FILE_BESTRING16: + case FILE_LESTRING16: + case FILE_SEARCH: + file_showstr(stderr, m->value.s, (size_t)m->vallen); break; case FILE_DATE: case FILE_LEDATE: case FILE_BEDATE: + case FILE_MEDATE: (void)fprintf(stderr, "%s,", file_fmttime(m->value.l, 1)); break; case FILE_LDATE: case FILE_LELDATE: case FILE_BELDATE: + case FILE_MELDATE: (void)fprintf(stderr, "%s,", file_fmttime(m->value.l, 0)); break; + case FILE_QDATE: + case FILE_LEQDATE: + case FILE_BEQDATE: + (void)fprintf(stderr, "%s,", + file_fmttime((uint32_t)m->value.q, 1)); + break; + case FILE_QLDATE: + case FILE_LEQLDATE: + case FILE_BEQLDATE: + (void)fprintf(stderr, "%s,", + file_fmttime((uint32_t)m->value.q, 0)); + break; + case FILE_DEFAULT: + /* XXX - do anything here? */ + break; default: (void) fputs("*bad*", stderr); break; @@ -138,7 +172,7 @@ file_mdump(struct magic *m) /*VARARGS*/ protected void -file_magwarn(const char *f, ...) +file_magwarn(struct magic_set *ms, const char *f, ...) { va_list va; va_start(va, f); @@ -146,13 +180,14 @@ file_magwarn(const char *f, ...) /* cuz we use stdout for most, stderr here */ (void) fflush(stdout); - (void) fprintf(stderr, "WARNING: "); + (void) fprintf(stderr, "%s, %lu: Warning ", ms->file, + (unsigned long)ms->line); (void) vfprintf(stderr, f, va); va_end(va); - fputc('\n', stderr); + (void) fputc('\n', stderr); } -protected char * +protected const char * file_fmttime(uint32_t v, int local) { char *pp; @@ -171,6 +206,8 @@ file_fmttime(uint32_t v, int local) struct tm *tm1; (void)time(&now); tm1 = localtime(&now); + if (tm1 == NULL) + return "*Invalid time*"; daylight = tm1->tm_isdst; } #endif /* HAVE_TM_ISDST */ @@ -178,6 +215,8 @@ file_fmttime(uint32_t v, int local) if (daylight) t += 3600; tm = gmtime(&t); + if (tm == NULL) + return "*Invalid time*"; pp = asctime(tm); } diff --git a/usr.bin/file/readelf.c b/usr.bin/file/readelf.c index fe3ee69aac5..da2d53ad4b5 100644 --- a/usr.bin/file/readelf.c +++ b/usr.bin/file/readelf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: readelf.c,v 1.8 2004/05/19 02:32:35 tedu Exp $ */ +/* $OpenBSD: readelf.c,v 1.9 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Christos Zoulas 2003. * All Rights Reserved. @@ -12,8 +12,6 @@ * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. - * 3. The name of the author may not be used to endorse or promote products - * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE @@ -40,19 +38,23 @@ #include "readelf.h" #ifndef lint -FILE_RCSID("@(#)$Id: readelf.c,v 1.8 2004/05/19 02:32:35 tedu Exp $") +FILE_RCSID("@(#)$Id: readelf.c,v 1.9 2008/05/08 01:40:56 chl Exp $") #endif #ifdef ELFCORE -private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t); +private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t, + off_t, int *); #endif -private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t); -private int doshn(struct magic_set *, int, int, int, off_t, int, size_t); +private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t, + off_t, int *); +private int doshn(struct magic_set *, int, int, int, off_t, int, size_t, int *); private size_t donote(struct magic_set *, unsigned char *, size_t, size_t, int, - int, size_t); + int, size_t, int *); #define ELF_ALIGN(a) ((((a) + align - 1) / align) * align) +#define isquote(c) (strchr("'\"`", (c)) != NULL) + private uint16_t getu16(int, uint16_t); private uint32_t getu32(int, uint32_t); private uint64_t getu64(int, uint64_t); @@ -122,42 +124,65 @@ getu64(int swap, uint64_t value) return value; } -#define sh_addr (class == ELFCLASS32 \ +#ifdef USE_ARRAY_FOR_64BIT_TYPES +# define elf_getu64(swap, array) \ + ((swap ? ((uint64_t)getu32(swap, array[0])) << 32 : getu32(swap, array[0])) + \ + (swap ? getu32(swap, array[1]) : ((uint64_t)getu32(swap, array[1]) << 32))) +#else +# define elf_getu64(swap, value) getu64(swap, value) +#endif + +#define xsh_addr (class == ELFCLASS32 \ ? (void *) &sh32 \ : (void *) &sh64) -#define sh_size (class == ELFCLASS32 \ +#define xsh_sizeof (class == ELFCLASS32 \ ? sizeof sh32 \ : sizeof sh64) -#define shs_type (class == ELFCLASS32 \ +#define xsh_size (class == ELFCLASS32 \ + ? getu32(swap, sh32.sh_size) \ + : getu64(swap, sh64.sh_size)) +#define xsh_offset (class == ELFCLASS32 \ + ? getu32(swap, sh32.sh_offset) \ + : getu64(swap, sh64.sh_offset)) +#define xsh_type (class == ELFCLASS32 \ ? getu32(swap, sh32.sh_type) \ : getu32(swap, sh64.sh_type)) -#define ph_addr (class == ELFCLASS32 \ +#define xph_addr (class == ELFCLASS32 \ ? (void *) &ph32 \ : (void *) &ph64) -#define ph_size (class == ELFCLASS32 \ +#define xph_sizeof (class == ELFCLASS32 \ ? sizeof ph32 \ : sizeof ph64) -#define ph_type (class == ELFCLASS32 \ +#define xph_type (class == ELFCLASS32 \ ? getu32(swap, ph32.p_type) \ : getu32(swap, ph64.p_type)) -#define ph_offset (class == ELFCLASS32 \ +#define xph_offset (off_t)(class == ELFCLASS32 \ ? getu32(swap, ph32.p_offset) \ : getu64(swap, ph64.p_offset)) -#define ph_align (size_t)((class == ELFCLASS32 \ +#define xph_align (size_t)((class == ELFCLASS32 \ ? (off_t) (ph32.p_align ? \ getu32(swap, ph32.p_align) : 4) \ : (off_t) (ph64.p_align ? \ getu64(swap, ph64.p_align) : 4))) -#define nh_size (class == ELFCLASS32 \ +#define xph_filesz (size_t)((class == ELFCLASS32 \ + ? getu32(swap, ph32.p_filesz) \ + : getu64(swap, ph64.p_filesz))) +#define xnh_addr (class == ELFCLASS32 \ + ? (void *) &nh32 \ + : (void *) &nh64) +#define xph_memsz (size_t)((class == ELFCLASS32 \ + ? getu32(swap, ph32.p_memsz) \ + : getu64(swap, ph64.p_memsz))) +#define xnh_sizeof (class == ELFCLASS32 \ ? sizeof nh32 \ : sizeof nh64) -#define nh_type (class == ELFCLASS32 \ +#define xnh_type (class == ELFCLASS32 \ ? getu32(swap, nh32.n_type) \ : getu32(swap, nh64.n_type)) -#define nh_namesz (class == ELFCLASS32 \ +#define xnh_namesz (class == ELFCLASS32 \ ? getu32(swap, nh32.n_namesz) \ : getu32(swap, nh64.n_namesz)) -#define nh_descsz (class == ELFCLASS32 \ +#define xnh_descsz (class == ELFCLASS32 \ ? getu32(swap, nh32.n_descsz) \ : getu32(swap, nh64.n_descsz)) #define prpsoffsets(i) (class == ELFCLASS32 \ @@ -167,13 +192,16 @@ getu64(int swap, uint64_t value) #ifdef ELFCORE size_t prpsoffsets32[] = { 8, /* FreeBSD */ - 28, /* Linux 2.0.36 */ - 32, /* Linux (I forget which kernel version) */ + 28, /* Linux 2.0.36 (short name) */ + 44, /* Linux (path name) */ 84, /* SunOS 5.x */ }; size_t prpsoffsets64[] = { - 120, /* SunOS 5.x, 64-bit */ + 16, /* FreeBSD, 64-bit */ + 40, /* Linux (tested on core from 2.4.x, short name) */ + 56, /* Linux (path name) */ + 120, /* SunOS 5.x, 64-bit */ }; #define NOFFSETS32 (sizeof prpsoffsets32 / sizeof prpsoffsets32[0]) @@ -212,46 +240,66 @@ private const char *os_style_names[] = { "NetBSD", }; +#define FLAGS_DID_CORE 1 +#define FLAGS_DID_NOTE 2 + private int dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off, - int num, size_t size) + int num, size_t size, off_t fsize, int *flags) { Elf32_Phdr ph32; Elf64_Phdr ph64; size_t offset; unsigned char nbuf[BUFSIZ]; ssize_t bufsize; + off_t savedoffset; + struct stat st; - if (size != ph_size) { + if (fstat(fd, &st) < 0) { + file_badread(ms); + return -1; + } + + if (size != xph_sizeof) { if (file_printf(ms, ", corrupted program header size") == -1) return -1; return 0; } + /* * Loop through all the program headers. */ for ( ; num; num--) { - if (lseek(fd, off, SEEK_SET) == (off_t)-1) { + if ((savedoffset = lseek(fd, off, SEEK_SET)) == (off_t)-1) { file_badseek(ms); return -1; } - if (read(fd, ph_addr, ph_size) == -1) { + if (read(fd, xph_addr, xph_sizeof) == -1) { file_badread(ms); return -1; } + if (xph_offset > fsize) { + if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) { + file_badseek(ms); + return -1; + } + continue; + } + off += size; - if (ph_type != PT_NOTE) + if (xph_type != PT_NOTE) continue; /* * This is a PT_NOTE section; loop through all the notes * in the section. */ - if (lseek(fd, (off_t) ph_offset, SEEK_SET) == (off_t)-1) { + if (lseek(fd, xph_offset, SEEK_SET) == (off_t)-1) { file_badseek(ms); return -1; } - bufsize = read(fd, nbuf, BUFSIZ); + bufsize = read(fd, nbuf, + ((xph_filesz < sizeof(nbuf)) ? xph_filesz : sizeof(nbuf))); if (bufsize == -1) { file_badread(ms); return -1; @@ -261,7 +309,7 @@ dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off, if (offset >= (size_t)bufsize) break; offset = donote(ms, nbuf, offset, (size_t)bufsize, - class, swap, 4); + class, swap, 4, flags); if (offset == 0) break; @@ -273,7 +321,7 @@ dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off, private size_t donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, - int class, int swap, size_t align) + int class, int swap, size_t align, int *flags) { Elf32_Nhdr nh32; Elf64_Nhdr nh64; @@ -283,19 +331,16 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, #endif uint32_t namesz, descsz; - if (class == ELFCLASS32) - memcpy(&nh32, &nbuf[offset], sizeof(nh32)); - else - memcpy(&nh64, &nbuf[offset], sizeof(nh64)); - offset += nh_size; + (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof); + offset += xnh_sizeof; - namesz = nh_namesz; - descsz = nh_descsz; + namesz = xnh_namesz; + descsz = xnh_descsz; if ((namesz == 0) && (descsz == 0)) { /* * We're out of note headers. */ - return offset; + return (offset >= size) ? offset : size; } if (namesz & 0x80000000) { @@ -314,7 +359,7 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, noff = offset; doff = ELF_ALIGN(offset + namesz); - if (offset + namesz >= size) { + if (offset + namesz > size) { /* * We're past the end of the buffer. */ @@ -322,12 +367,18 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, } offset = ELF_ALIGN(doff + descsz); - if (offset + descsz >= size) { - return offset; + if (doff + descsz > size) { + /* + * We're past the end of the buffer. + */ + return (offset >= size) ? offset : size; } + if (*flags & FLAGS_DID_NOTE) + goto core; + if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 && - nh_type == NT_GNU_VERSION && descsz == 16) { + xnh_type == NT_GNU_VERSION && descsz == 16) { uint32_t desc[4]; (void)memcpy(desc, &nbuf[doff], sizeof(desc)); @@ -353,11 +404,12 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, if (file_printf(ms, " %d.%d.%d", getu32(swap, desc[1]), getu32(swap, desc[2]), getu32(swap, desc[3])) == -1) return size; + *flags |= FLAGS_DID_NOTE; return size; } if (namesz == 7 && strcmp((char *)&nbuf[noff], "NetBSD") == 0 && - nh_type == NT_NETBSD_VERSION && descsz == 4) { + xnh_type == NT_NETBSD_VERSION && descsz == 4) { uint32_t desc; (void)memcpy(&desc, &nbuf[doff], sizeof(desc)); desc = getu32(swap, desc); @@ -377,10 +429,10 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, * p = patchlevel */ if (desc > 100000000U) { - u_int ver_patch = (desc / 100) % 100; - u_int ver_rel = (desc / 10000) % 100; - u_int ver_min = (desc / 1000000) % 100; - u_int ver_maj = desc / 100000000; + uint32_t ver_patch = (desc / 100) % 100; + uint32_t ver_rel = (desc / 10000) % 100; + uint32_t ver_min = (desc / 1000000) % 100; + uint32_t ver_maj = desc / 100000000; if (file_printf(ms, " %u.%u", ver_maj, ver_min) == -1) return size; @@ -389,17 +441,21 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, return size; } else if (ver_rel != 0) { while (ver_rel > 26) { - file_printf(ms, "Z"); + if (file_printf(ms, "Z") == -1) + return size; ver_rel -= 26; } - file_printf(ms, "%c", 'A' + ver_rel - 1); + if (file_printf(ms, "%c", 'A' + ver_rel - 1) + == -1) + return size; } } + *flags |= FLAGS_DID_NOTE; return size; } if (namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0 && - nh_type == NT_FREEBSD_VERSION && descsz == 4) { + xnh_type == NT_FREEBSD_VERSION && descsz == 4) { uint32_t desc; (void)memcpy(&desc, &nbuf[doff], sizeof(desc)); desc = getu32(swap, desc); @@ -408,13 +464,34 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, /* * Contents is __FreeBSD_version, whose relation to OS - * versions is defined by a huge table in the Porters' - * Handbook. For up to 5.x, the first three digits are - * the version number. For 5.x and higher, the scheme - * is: <major><two digit minor> <0 if release branch, - * otherwise 1>xx + * versions is defined by a huge table in the Porter's + * Handbook. This is the general scheme: + * + * Releases: + * Mmp000 (before 4.10) + * Mmi0p0 (before 5.0) + * Mmm0p0 + * + * Development branches: + * Mmpxxx (before 4.6) + * Mmp1xx (before 4.10) + * Mmi1xx (before 5.0) + * M000xx (pre-M.0) + * Mmm1xx + * + * M = major version + * m = minor version + * i = minor version increment (491000 -> 4.10) + * p = patchlevel + * x = revision + * + * The first release of FreeBSD to use ELF by default + * was version 3.0. */ - if (desc / 100000 < 5) { + if (desc == 460002) { + if (file_printf(ms, " 4.6.2") == -1) + return size; + } else if (desc < 460100) { if (file_printf(ms, " %d.%d", desc / 100000, desc / 10000 % 10) == -1) return size; @@ -422,31 +499,63 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, if (file_printf(ms, ".%d", desc / 1000 % 10) == -1) return size; + if ((desc % 1000 > 0) || (desc % 100000 == 0)) + if (file_printf(ms, " (%d)", desc) == -1) + return size; + } else if (desc < 500000) { + if (file_printf(ms, " %d.%d", desc / 100000, + desc / 10000 % 10 + desc / 1000 % 10) == -1) + return size; + if (desc / 100 % 10 > 0) { + if (file_printf(ms, " (%d)", desc) == -1) + return size; + } else if (desc / 10 % 10 > 0) { + if (file_printf(ms, ".%d", desc / 10 % 10) + == -1) + return size; + } } else { if (file_printf(ms, " %d.%d", desc / 100000, desc / 1000 % 100) == -1) return size; - desc %= 1000; - if (desc > 100) { - if (file_printf(ms, "-CURRENT (rev %d)", - desc % 100) == -1) + if ((desc / 100 % 10 > 0) || + (desc % 100000 / 100 == 0)) { + if (file_printf(ms, " (%d)", desc) == -1) return size; - } else if (desc != 0) { - if (file_printf(ms, ".%d", desc / 10) == -1) + } else if (desc / 10 % 10 > 0) { + if (file_printf(ms, ".%d", desc / 10 % 10) + == -1) return size; } } + *flags |= FLAGS_DID_NOTE; return size; } if (namesz == 8 && strcmp((char *)&nbuf[noff], "OpenBSD") == 0 && - nh_type == NT_OPENBSD_VERSION && descsz == 4) { + xnh_type == NT_OPENBSD_VERSION && descsz == 4) { if (file_printf(ms, ", for OpenBSD") == -1) return size; /* Content of note is always 0 */ + *flags |= FLAGS_DID_NOTE; return size; } + if (namesz == 10 && strcmp((char *)&nbuf[noff], "DragonFly") == 0 && + xnh_type == NT_DRAGONFLY_VERSION && descsz == 4) { + uint32_t desc; + if (file_printf(ms, ", for DragonFly") == -1) + return size; + (void)memcpy(&desc, &nbuf[doff], sizeof(desc)); + desc = getu32(swap, desc); + if (file_printf(ms, " %d.%d.%d", desc / 100000, + desc / 10000 % 10, desc % 10000) == -1) + return size; + *flags |= FLAGS_DID_NOTE; + return size; + } + +core: /* * Sigh. The 2.0.36 kernel in Debian 2.1, at * least, doesn't correctly implement name @@ -476,113 +585,130 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, } #ifdef ELFCORE - if (os_style != -1) - if (file_printf(ms, ", %s-style", os_style_names[os_style]) == -1) - return size; + if ((*flags & FLAGS_DID_CORE) != 0) + return size; - if (os_style == OS_STYLE_NETBSD && nh_type == NT_NETBSD_CORE_PROCINFO) { - uint32_t signo; - /* - * Extract the program name. It is at - * offset 0x7c, and is up to 32-bytes, - * including the terminating NUL. - */ - if (file_printf(ms, ", from '%.31s'", &nbuf[doff + 0x7c]) == -1) - return size; - - /* - * Extract the signal number. It is at - * offset 0x08. - */ - memcpy(&signo, &nbuf[doff + 0x08], - sizeof(signo)); - if (file_printf(ms, " (signal %u)", getu32(swap, signo)) == -1) + if (os_style != -1) { + if (file_printf(ms, ", %s-style", os_style_names[os_style]) + == -1) return size; - return size; - } else if (os_style != OS_STYLE_NETBSD && nh_type == NT_PRPSINFO) { - size_t i, j; - unsigned char c; - /* - * Extract the program name. We assume - * it to be 16 characters (that's what it - * is in SunOS 5.x and Linux). - * - * Unfortunately, it's at a different offset - * in varous OSes, so try multiple offsets. - * If the characters aren't all printable, - * reject it. - */ - for (i = 0; i < NOFFSETS; i++) { - size_t reloffset = prpsoffsets(i); - size_t noffset = doff + reloffset; - for (j = 0; j < 16; j++, noffset++, reloffset++) { - /* - * Make sure we're not past - * the end of the buffer; if - * we are, just give up. - */ - if (noffset >= size) - goto tryanother; + } - /* - * Make sure we're not past - * the end of the contents; - * if we are, this obviously - * isn't the right offset. - */ - if (reloffset >= descsz) - goto tryanother; + switch (os_style) { + case OS_STYLE_NETBSD: + if (xnh_type == NT_NETBSD_CORE_PROCINFO) { + uint32_t signo; + /* + * Extract the program name. It is at + * offset 0x7c, and is up to 32-bytes, + * including the terminating NUL. + */ + if (file_printf(ms, ", from '%.31s'", + &nbuf[doff + 0x7c]) == -1) + return size; + + /* + * Extract the signal number. It is at + * offset 0x08. + */ + (void)memcpy(&signo, &nbuf[doff + 0x08], + sizeof(signo)); + if (file_printf(ms, " (signal %u)", + getu32(swap, signo)) == -1) + return size; + return size; + } + break; - c = nbuf[noffset]; - if (c == '\0') { + default: + if (xnh_type == NT_PRPSINFO) { + size_t i, j; + unsigned char c; + /* + * Extract the program name. We assume + * it to be 16 characters (that's what it + * is in SunOS 5.x and Linux). + * + * Unfortunately, it's at a different offset + * in various OSes, so try multiple offsets. + * If the characters aren't all printable, + * reject it. + */ + for (i = 0; i < NOFFSETS; i++) { + size_t reloffset = prpsoffsets(i); + size_t noffset = doff + reloffset; + for (j = 0; j < 16; j++, noffset++, + reloffset++) { /* - * A '\0' at the - * beginning is - * obviously wrong. - * Any other '\0' - * means we're done. + * Make sure we're not past + * the end of the buffer; if + * we are, just give up. */ - if (j == 0) + if (noffset >= size) goto tryanother; - else - break; - } else { + /* - * A nonprintable - * character is also - * wrong. + * Make sure we're not past + * the end of the contents; + * if we are, this obviously + * isn't the right offset. */ -#define isquote(c) (strchr("'\"`", (c)) != NULL) - if (!isprint(c) || isquote(c)) + if (reloffset >= descsz) goto tryanother; - } - } - /* - * Well, that worked. - */ - if (file_printf(ms, ", from '%.16s'", - &nbuf[doff + prpsoffsets(i)]) == -1) + c = nbuf[noffset]; + if (c == '\0') { + /* + * A '\0' at the + * beginning is + * obviously wrong. + * Any other '\0' + * means we're done. + */ + if (j == 0) + goto tryanother; + else + break; + } else { + /* + * A nonprintable + * character is also + * wrong. + */ + if (!isprint(c) || isquote(c)) + goto tryanother; + } + } + /* + * Well, that worked. + */ + if (file_printf(ms, ", from '%.16s'", + &nbuf[doff + prpsoffsets(i)]) == -1) + return size; return size; - return size; - tryanother: - ; + tryanother: + ; + } } - return offset; + break; } #endif + *flags |= FLAGS_DID_CORE; return offset; } private int doshn(struct magic_set *ms, int class, int swap, int fd, off_t off, int num, - size_t size) + size_t size, int *flags) { Elf32_Shdr sh32; Elf64_Shdr sh64; + int stripped = 1; + void *nbuf; + off_t noff; - if (size != sh_size) { + if (size != xsh_sizeof) { if (file_printf(ms, ", corrupted section header size") == -1) return -1; return 0; @@ -594,17 +720,61 @@ doshn(struct magic_set *ms, int class, int swap, int fd, off_t off, int num, } for ( ; num; num--) { - if (read(fd, sh_addr, sh_size) == -1) { + if (read(fd, xsh_addr, xsh_sizeof) == -1) { file_badread(ms); return -1; } - if (shs_type == SHT_SYMTAB /* || shs_type == SHT_DYNSYM */) { - if (file_printf(ms, ", not stripped") == -1) + switch (xsh_type) { + case SHT_SYMTAB: +#if 0 + case SHT_DYNSYM: +#endif + stripped = 0; + break; + case SHT_NOTE: + if ((off = lseek(fd, (off_t)0, SEEK_CUR)) == + (off_t)-1) { + file_badread(ms); return -1; - return 0; + } + if ((nbuf = malloc((size_t)xsh_size)) == NULL) { + file_error(ms, errno, "Cannot allocate memory" + " for note"); + return -1; + } + if ((noff = lseek(fd, (off_t)xsh_offset, SEEK_SET)) == + (off_t)-1) { + file_badread(ms); + free(nbuf); + return -1; + } + if (read(fd, nbuf, (size_t)xsh_size) != + (ssize_t)xsh_size) { + free(nbuf); + file_badread(ms); + return -1; + } + + noff = 0; + for (;;) { + if (noff >= (size_t)xsh_size) + break; + noff = donote(ms, nbuf, (size_t)noff, + (size_t)xsh_size, class, swap, 4, + flags); + if (noff == 0) + break; + } + if ((lseek(fd, off, SEEK_SET)) == (off_t)-1) { + free(nbuf); + file_badread(ms); + return -1; + } + free(nbuf); + break; } } - if (file_printf(ms, ", stripped") == -1) + if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1) return -1; return 0; } @@ -616,7 +786,7 @@ doshn(struct magic_set *ms, int class, int swap, int fd, off_t off, int num, */ private int dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off, - int num, size_t size) + int num, size_t size, off_t fsize, int *flags) { Elf32_Phdr ph32; Elf64_Phdr ph64; @@ -625,29 +795,52 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off, unsigned char nbuf[BUFSIZ]; int bufsize; size_t offset, align; - off_t savedoffset; + off_t savedoffset = (off_t)-1; + struct stat st; - if (size != ph_size) { + if (fstat(fd, &st) < 0) { + file_badread(ms); + return -1; + } + + if (size != xph_sizeof) { if (file_printf(ms, ", corrupted program header size") == -1) return -1; return 0; } + if (lseek(fd, off, SEEK_SET) == (off_t)-1) { file_badseek(ms); return -1; } for ( ; num; num--) { - if (read(fd, ph_addr, ph_size) == -1) { + if (read(fd, xph_addr, xph_sizeof) == -1) { file_badread(ms); return -1; } + if (xph_offset > st.st_size && savedoffset != (off_t)-1) { + if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) { + file_badseek(ms); + return -1; + } + continue; + } + if ((savedoffset = lseek(fd, (off_t)0, SEEK_CUR)) == (off_t)-1) { file_badseek(ms); return -1; } - switch (ph_type) { + if (xph_offset > fsize) { + if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) { + file_badseek(ms); + return -1; + } + continue; + } + + switch (xph_type) { case PT_DYNAMIC: linking_style = "dynamically"; break; @@ -655,7 +848,7 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off, shared_libraries = " (uses shared libs)"; break; case PT_NOTE: - if ((align = ph_align) & 0x80000000) { + if ((align = xph_align) & 0x80000000) { if (file_printf(ms, ", invalid note alignment 0x%lx", (unsigned long)align) == -1) @@ -666,12 +859,13 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off, * This is a PT_NOTE section; loop through all the notes * in the section. */ - if (lseek(fd, (off_t) ph_offset, SEEK_SET) + if (lseek(fd, xph_offset, SEEK_SET) == (off_t)-1) { file_badseek(ms); return -1; } - bufsize = read(fd, nbuf, sizeof(nbuf)); + bufsize = read(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ? + xph_filesz : sizeof(nbuf))); if (bufsize == -1) { file_badread(ms); return -1; @@ -681,12 +875,12 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off, if (offset >= (size_t)bufsize) break; offset = donote(ms, nbuf, offset, - (size_t)bufsize, class, swap, align); + (size_t)bufsize, class, swap, align, + flags); if (offset == 0) break; } - if (lseek(fd, savedoffset + offset, SEEK_SET) - == (off_t)-1) { + if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) { file_badseek(ms); return -1; } @@ -710,6 +904,9 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, } u; int class; int swap; + struct stat st; + off_t fsize; + int flags = 0; /* * If we cannot seek, it must be a pipe, socket or fifo. @@ -717,6 +914,12 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE)) fd = file_pipe2file(ms, fd, buf, nbytes); + if (fstat(fd, &st) == -1) { + file_badread(ms); + return -1; + } + fsize = st.st_size; + /* * ELF executables have multiple section headers in arbitrary * file locations and thus file(1) cannot determine it from easily. @@ -729,7 +932,7 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, return 0; - class = buf[4]; + class = buf[EI_CLASS]; if (class == ELFCLASS32) { Elf32_Ehdr elfhdr; @@ -739,14 +942,15 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, u.l = 1; (void) memcpy(&elfhdr, buf, sizeof elfhdr); - swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[5]; + swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[EI_DATA]; if (getu16(swap, elfhdr.e_type) == ET_CORE) { #ifdef ELFCORE if (dophn_core(ms, class, swap, fd, (off_t)getu32(swap, elfhdr.e_phoff), getu16(swap, elfhdr.e_phnum), - (size_t)getu16(swap, elfhdr.e_phentsize)) == -1) + (size_t)getu16(swap, elfhdr.e_phentsize), + fsize, &flags) == -1) return -1; #else ; @@ -756,14 +960,16 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, if (dophn_exec(ms, class, swap, fd, (off_t)getu32(swap, elfhdr.e_phoff), getu16(swap, elfhdr.e_phnum), - (size_t)getu16(swap, elfhdr.e_phentsize)) + (size_t)getu16(swap, elfhdr.e_phentsize), + fsize, &flags) == -1) return -1; } if (doshn(ms, class, swap, fd, (off_t)getu32(swap, elfhdr.e_shoff), getu16(swap, elfhdr.e_shnum), - (size_t)getu16(swap, elfhdr.e_shentsize)) == -1) + (size_t)getu16(swap, elfhdr.e_shentsize), + &flags) == -1) return -1; } return 1; @@ -777,18 +983,15 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, u.l = 1; (void) memcpy(&elfhdr, buf, sizeof elfhdr); - swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[5]; + swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[EI_DATA]; if (getu16(swap, elfhdr.e_type) == ET_CORE) { #ifdef ELFCORE if (dophn_core(ms, class, swap, fd, -#ifdef USE_ARRAY_FOR_64BIT_TYPES - (off_t)getu32(swap, elfhdr.e_phoff[1]), -#else - (off_t)getu64(swap, elfhdr.e_phoff), -#endif + (off_t)elf_getu64(swap, elfhdr.e_phoff), getu16(swap, elfhdr.e_phnum), - (size_t)getu16(swap, elfhdr.e_phentsize)) == -1) + (size_t)getu16(swap, elfhdr.e_phentsize), + fsize, &flags) == -1) return -1; #else ; @@ -796,24 +999,17 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, } else { if (getu16(swap, elfhdr.e_type) == ET_EXEC) { if (dophn_exec(ms, class, swap, fd, -#ifdef USE_ARRAY_FOR_64BIT_TYPES - (off_t)getu32(swap, elfhdr.e_phoff[1]), -#else - (off_t)getu64(swap, elfhdr.e_phoff), -#endif + (off_t)elf_getu64(swap, elfhdr.e_phoff), getu16(swap, elfhdr.e_phnum), - (size_t)getu16(swap, elfhdr.e_phentsize)) - == -1) + (size_t)getu16(swap, elfhdr.e_phentsize), + fsize, &flags) == -1) return -1; } if (doshn(ms, class, swap, fd, -#ifdef USE_ARRAY_FOR_64BIT_TYPES - (off_t)getu32(swap, elfhdr.e_shoff[1]), -#else - (off_t)getu64(swap, elfhdr.e_shoff), -#endif + (off_t)elf_getu64(swap, elfhdr.e_shoff), getu16(swap, elfhdr.e_shnum), - (size_t)getu16(swap, elfhdr.e_shentsize)) == -1) + (size_t)getu16(swap, elfhdr.e_shentsize), &flags) + == -1) return -1; } return 1; diff --git a/usr.bin/file/readelf.h b/usr.bin/file/readelf.h index 46edbaf12e7..1ffab5a97a7 100644 --- a/usr.bin/file/readelf.h +++ b/usr.bin/file/readelf.h @@ -1,4 +1,4 @@ -/* $OpenBSD: readelf.h,v 1.5 2004/05/19 02:32:36 tedu Exp $ */ +/* $OpenBSD: readelf.h,v 1.6 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Christos Zoulas 2003. * All Rights Reserved. @@ -12,8 +12,6 @@ * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. - * 3. The name of the author may not be used to endorse or promote products - * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE @@ -53,6 +51,7 @@ typedef uint32_t Elf64_Addr[2]; typedef uint32_t Elf64_Off[2]; typedef uint32_t Elf64_Xword[2]; #else +#undef USE_ARRAY_FOR_64BIT_TYPES typedef uint64_t Elf64_Addr; typedef uint64_t Elf64_Off; typedef uint64_t Elf64_Xword; @@ -226,6 +225,7 @@ typedef struct { #define NT_NETBSD_EMULATION 2 #define NT_FREEBSD_VERSION 1 #define NT_OPENBSD_VERSION 1 +#define NT_DRAGONFLY_VERSION 1 /* GNU executables (name = "GNU") */ #define NT_GNU_VERSION 1 diff --git a/usr.bin/file/softmagic.c b/usr.bin/file/softmagic.c index 4c9ecc9a09b..701ebe41646 100644 --- a/usr.bin/file/softmagic.c +++ b/usr.bin/file/softmagic.c @@ -1,4 +1,4 @@ -/* $OpenBSD: softmagic.c,v 1.12 2007/09/11 15:47:17 gilles Exp $ */ +/* $OpenBSD: softmagic.c,v 1.13 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Ian F. Darwin 1986-1995. * Software written by Ian F. Darwin and others; @@ -36,26 +36,30 @@ #include <ctype.h> #include <stdlib.h> #include <time.h> -#include <regex.h> #ifndef lint -FILE_RCSID("@(#)$Id: softmagic.c,v 1.12 2007/09/11 15:47:17 gilles Exp $") +FILE_RCSID("@(#)$Id: softmagic.c,v 1.13 2008/05/08 01:40:56 chl Exp $") #endif /* lint */ private int match(struct magic_set *, struct magic *, uint32_t, const unsigned char *, size_t); -private int mget(struct magic_set *, union VALUETYPE *, const unsigned char *, - struct magic *, size_t); -private int mcheck(struct magic_set *, union VALUETYPE *, struct magic *); -private int32_t mprint(struct magic_set *, union VALUETYPE *, struct magic *); +private int mget(struct magic_set *, const unsigned char *, + struct magic *, size_t, unsigned int); +private int magiccheck(struct magic_set *, struct magic *); +private int32_t mprint(struct magic_set *, struct magic *); private void mdebug(uint32_t, const char *, size_t); -private int mconvert(struct magic_set *, union VALUETYPE *, struct magic *); -private int check_mem(struct magic_set *, unsigned int); +private int mcopy(struct magic_set *, union VALUETYPE *, int, int, + const unsigned char *, uint32_t, size_t, size_t); +private int mconvert(struct magic_set *, struct magic *); +private int print_sep(struct magic_set *, int); +private void cvt_8(union VALUETYPE *, const struct magic *); +private void cvt_16(union VALUETYPE *, const struct magic *); +private void cvt_32(union VALUETYPE *, const struct magic *); +private void cvt_64(union VALUETYPE *, const struct magic *); /* - * softmagic - lookup one file in database - * (already read from MAGIC by apprentice.c). + * softmagic - lookup one file in parsed, in-memory copy of database * Passed the name and FILE * of one file to be typed. */ /*ARGSUSED1*/ /* nbytes passed for regularity, maybe need later */ @@ -63,9 +67,10 @@ protected int file_softmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes) { struct mlist *ml; + int rv; for (ml = ms->mlist->next; ml != ms->mlist; ml = ml->next) - if (match(ms, ml->magic, ml->nmagic, buf, nbytes)) - return 1; + if ((rv = match(ms, ml->magic, ml->nmagic, buf, nbytes)) != 0) + return rv; return 0; } @@ -104,25 +109,34 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, uint32_t magindex = 0; unsigned int cont_level = 0; int need_separator = 0; - union VALUETYPE p; - int32_t oldoff = 0; int returnval = 0; /* if a match is found it is set to 1*/ int firstline = 1; /* a flag to print X\n X\n- X */ + int printed_something = 0; - if (check_mem(ms, cont_level) == -1) + if (file_check_mem(ms, cont_level) == -1) return -1; for (magindex = 0; magindex < nmagic; magindex++) { + int flush; + + ms->offset = magic[magindex].offset; + ms->line = magic[magindex].lineno; + /* if main entry matches, print it... */ - int flush = !mget(ms, &p, s, &magic[magindex], nbytes); - switch (mcheck(ms, &p, &magic[magindex])) { - case -1: - return -1; - case 0: - flush++; - break; - default: - break; + flush = !mget(ms, s, &magic[magindex], nbytes, cont_level); + if (flush) { + if (magic[magindex].reln == '!') + flush = 0; + } else { + switch (magiccheck(ms, &magic[magindex])) { + case -1: + return -1; + case 0: + flush++; + break; + default: + break; + } } if (flush) { /* @@ -130,32 +144,34 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, * flush its continuations */ while (magindex < nmagic - 1 && - magic[magindex + 1].cont_level != 0) - magindex++; + magic[magindex + 1].cont_level != 0) + magindex++; continue; } - if (!firstline) { /* we found another match */ - /* put a newline and '-' to do some simple formatting*/ - if (file_printf(ms, "\n- ") == -1) + /* + * If we are going to print something, we'll need to print + * a blank before we print something else. + */ + if (magic[magindex].desc[0]) { + need_separator = 1; + printed_something = 1; + if (print_sep(ms, firstline) == -1) return -1; } - if ((ms->c.off[cont_level] = mprint(ms, &p, &magic[magindex])) + if ((ms->c.li[cont_level].off = mprint(ms, &magic[magindex])) == -1) return -1; - /* - * If we printed something, we'll need to print - * a blank before we print something else. - */ - if (magic[magindex].desc[0]) - need_separator = 1; + /* and any continuations that match */ - if (check_mem(ms, ++cont_level) == -1) + if (file_check_mem(ms, ++cont_level) == -1) return -1; - while (magic[magindex+1].cont_level != 0 && - ++magindex < nmagic) { + while (magic[magindex+1].cont_level != 0 && + ++magindex < nmagic) { + ms->line = magic[magindex].lineno; /* for messages */ + if (cont_level < magic[magindex].cont_level) continue; if (cont_level > magic[magindex].cont_level) { @@ -165,36 +181,66 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, */ cont_level = magic[magindex].cont_level; } + ms->offset = magic[magindex].offset; if (magic[magindex].flag & OFFADD) { - oldoff=magic[magindex].offset; - magic[magindex].offset += ms->c.off[cont_level-1]; + ms->offset += + ms->c.li[cont_level - 1].off; } - if (!mget(ms, &p, s, &magic[magindex], nbytes)) - goto done; + +#ifdef ENABLE_CONDITIONALS + if (magic[magindex].cond == COND_ELSE || + magic[magindex].cond == COND_ELIF) { + if (ms->c.li[cont_level].last_match == 1) + continue; + } +#endif + flush = !mget(ms, s, &magic[magindex], nbytes, + cont_level); + if (flush && magic[magindex].reln != '!') + continue; - switch (mcheck(ms, &p, &magic[magindex])) { + switch (flush ? 1 : magiccheck(ms, &magic[magindex])) { case -1: return -1; case 0: +#ifdef ENABLE_CONDITIONALS + ms->c.li[cont_level].last_match = 0; +#endif break; default: +#ifdef ENABLE_CONDITIONALS + ms->c.li[cont_level].last_match = 1; +#endif + if (magic[magindex].type != FILE_DEFAULT) + ms->c.li[cont_level].got_match = 1; + else if (ms->c.li[cont_level].got_match) { + ms->c.li[cont_level].got_match = 0; + break; + } /* - * This continuation matched. - * Print its message, with - * a blank before it if - * the previous item printed - * and this item isn't empty. + * If we are going to print something, + * make sure that we have a separator first. + */ + if (magic[magindex].desc[0]) { + printed_something = 1; + if (print_sep(ms, firstline) == -1) + return -1; + } + /* + * This continuation matched. Print + * its message, with a blank before it + * if the previous item printed and + * this item isn't empty. */ /* space if previous printed */ if (need_separator && (magic[magindex].nospflag == 0) - && (magic[magindex].desc[0] != '\0')) { + && (magic[magindex].desc[0] != '\0')) { if (file_printf(ms, " ") == -1) return -1; need_separator = 0; } - if ((ms->c.off[cont_level] = mprint(ms, &p, - &magic[magindex])) == -1) + if ((ms->c.li[cont_level].off = mprint(ms, &magic[magindex])) == -1) return -1; if (magic[magindex].desc[0]) need_separator = 1; @@ -204,17 +250,15 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, * at a higher level, * process them. */ - if (check_mem(ms, ++cont_level) == -1) + if (file_check_mem(ms, ++cont_level) == -1) return -1; - } -done: - if (magic[magindex].flag & OFFADD) { - magic[magindex].offset = oldoff; + break; } } firstline = 0; - returnval = 1; - if ((ms->flags & MAGIC_CONTINUE) == 0) { + if (printed_something) + returnval = 1; + if ((ms->flags & MAGIC_CONTINUE) == 0 && printed_something) { return 1; /* don't keep searching */ } } @@ -222,365 +266,388 @@ done: } private int -check_mem(struct magic_set *ms, unsigned int level) +check_fmt(struct magic_set *ms, struct magic *m) { - size_t len; + regex_t rx; + int rc; - if (level < ms->c.len) + if (strchr(m->desc, '%') == NULL) return 0; - len = (ms->c.len += 20) * sizeof(*ms->c.off); - ms->c.off = (ms->c.off == NULL) ? malloc(len) : realloc(ms->c.off, len); - if (ms->c.off != NULL) - return 0; - file_oomem(ms); - return -1; + rc = regcomp(&rx, "%[-0-9\\.]*s", REG_EXTENDED|REG_NOSUB); + if (rc) { + char errmsg[512]; + (void)regerror(rc, &rx, errmsg, sizeof(errmsg)); + file_magerror(ms, "regex error %d, (%s)", rc, errmsg); + return -1; + } else { + rc = regexec(&rx, m->desc, 0, 0, 0); + regfree(&rx); + return !rc; + } } -private int32_t -mprint(struct magic_set *ms, union VALUETYPE *p, struct magic *m) +#ifndef HAVE_STRNDUP +char * strndup(const char *, size_t); + +char * +strndup(const char *str, size_t n) { - uint32_t v; - int32_t t=0 ; + size_t len; + char *copy; + + len = strlen(str); + if (len > n) + len = n; + if (!(copy = malloc(len + 1))) + return (NULL); + (void) memcpy(copy, str, len + 1); + copy[len] = '\0'; + return (copy); +} +#endif /* HAVE_STRNDUP */ +private int32_t +mprint(struct magic_set *ms, struct magic *m) +{ + uint64_t v; + int64_t t = 0; + char buf[512]; + union VALUETYPE *p = &ms->ms_value; switch (m->type) { case FILE_BYTE: - v = file_signextend(ms, m, (size_t)p->b); - if (file_printf(ms, m->desc, (unsigned char) v) == -1) + v = file_signextend(ms, m, (uint64_t)p->b); + switch (check_fmt(ms, m)) { + case -1: return -1; - t = m->offset + sizeof(char); + case 1: + if (snprintf(buf, sizeof(buf), "%c", + (unsigned char)v) < 0) + return -1; + if (file_printf(ms, m->desc, buf) == -1) + return -1; + break; + default: + if (file_printf(ms, m->desc, (unsigned char) v) == -1) + return -1; + break; + } + t = ms->offset + sizeof(char); break; case FILE_SHORT: case FILE_BESHORT: case FILE_LESHORT: - v = file_signextend(ms, m, (size_t)p->h); - if (file_printf(ms, m->desc, (unsigned short) v) == -1) + v = file_signextend(ms, m, (uint64_t)p->h); + switch (check_fmt(ms, m)) { + case -1: return -1; - t = m->offset + sizeof(short); + case 1: + if (snprintf(buf, sizeof(buf), "%hu", + (unsigned short)v) < 0) + return -1; + if (file_printf(ms, m->desc, buf) == -1) + return -1; + break; + default: + if (file_printf(ms, m->desc, (unsigned short) v) == -1) + return -1; + break; + } + t = ms->offset + sizeof(short); break; case FILE_LONG: case FILE_BELONG: case FILE_LELONG: - v = file_signextend(ms, m, p->l); - if (file_printf(ms, m->desc, (uint32_t) v) == -1) + case FILE_MELONG: + v = file_signextend(ms, m, (uint64_t)p->l); + switch (check_fmt(ms, m)) { + case -1: + return -1; + case 1: + if (snprintf(buf, sizeof(buf), "%u", (uint32_t)v) < 0) + return -1; + if (file_printf(ms, m->desc, buf) == -1) + return -1; + break; + default: + if (file_printf(ms, m->desc, (uint32_t) v) == -1) + return -1; + break; + } + t = ms->offset + sizeof(int32_t); + break; + + case FILE_QUAD: + case FILE_BEQUAD: + case FILE_LEQUAD: + v = file_signextend(ms, m, p->q); + if (file_printf(ms, m->desc, (uint64_t) v) == -1) return -1; - t = m->offset + sizeof(int32_t); + t = ms->offset + sizeof(int64_t); break; case FILE_STRING: case FILE_PSTRING: - if (m->reln == '=') { + case FILE_BESTRING16: + case FILE_LESTRING16: + if (m->reln == '=' || m->reln == '!') { if (file_printf(ms, m->desc, m->value.s) == -1) return -1; - t = m->offset + strlen(m->value.s); + t = ms->offset + m->vallen; } else { if (*m->value.s == '\0') p->s[strcspn(p->s, "\n")] = '\0'; if (file_printf(ms, m->desc, p->s) == -1) return -1; - t = m->offset + strlen(p->s); + t = ms->offset + strlen(p->s); } break; case FILE_DATE: case FILE_BEDATE: case FILE_LEDATE: + case FILE_MEDATE: if (file_printf(ms, m->desc, file_fmttime(p->l, 1)) == -1) return -1; - t = m->offset + sizeof(time_t); + t = ms->offset + sizeof(time_t); break; case FILE_LDATE: case FILE_BELDATE: case FILE_LELDATE: + case FILE_MELDATE: if (file_printf(ms, m->desc, file_fmttime(p->l, 0)) == -1) return -1; - t = m->offset + sizeof(time_t); + t = ms->offset + sizeof(time_t); break; - case FILE_REGEX: - if (file_printf(ms, m->desc, p->s) == -1) + + case FILE_QDATE: + case FILE_BEQDATE: + case FILE_LEQDATE: + if (file_printf(ms, m->desc, file_fmttime((uint32_t)p->q, 1)) + == -1) return -1; - t = m->offset + strlen(p->s); + t = ms->offset + sizeof(uint64_t); + break; + + case FILE_QLDATE: + case FILE_BEQLDATE: + case FILE_LEQLDATE: + if (file_printf(ms, m->desc, file_fmttime((uint32_t)p->q, 0)) + == -1) + return -1; + t = ms->offset + sizeof(uint64_t); + break; + + case FILE_REGEX: { + char *cp; + int rval; + + cp = strndup((const char *)ms->search.s, ms->search.rm_len); + if (cp == NULL) { + file_oomem(ms, ms->search.rm_len); + return -1; + } + rval = file_printf(ms, m->desc, cp); + free(cp); + + if (rval == -1) + return -1; + + if ((m->str_flags & REGEX_OFFSET_START)) + t = ms->search.offset; + else + t = ms->search.offset + ms->search.rm_len; + break; + } + + case FILE_SEARCH: + if (file_printf(ms, m->desc, m->value.s) == -1) + return -1; + if ((m->str_flags & REGEX_OFFSET_START)) + t = ms->search.offset; + else + t = ms->search.offset + m->vallen; + break; + + case FILE_DEFAULT: + if (file_printf(ms, m->desc, m->value.s) == -1) + return -1; + t = ms->offset; break; default: - file_error(ms, 0, "invalid m->type (%d) in mprint()", m->type); + file_magerror(ms, "invalid m->type (%d) in mprint()", m->type); return -1; } return(t); } + +#define DO_CVT(fld, cast) \ + if (m->num_mask) \ + switch (m->mask_op & FILE_OPS_MASK) { \ + case FILE_OPAND: \ + p->fld &= cast m->num_mask; \ + break; \ + case FILE_OPOR: \ + p->fld |= cast m->num_mask; \ + break; \ + case FILE_OPXOR: \ + p->fld ^= cast m->num_mask; \ + break; \ + case FILE_OPADD: \ + p->fld += cast m->num_mask; \ + break; \ + case FILE_OPMINUS: \ + p->fld -= cast m->num_mask; \ + break; \ + case FILE_OPMULTIPLY: \ + p->fld *= cast m->num_mask; \ + break; \ + case FILE_OPDIVIDE: \ + p->fld /= cast m->num_mask; \ + break; \ + case FILE_OPMODULO: \ + p->fld %= cast m->num_mask; \ + break; \ + } \ + if (m->mask_op & FILE_OPINVERSE) \ + p->fld = ~p->fld \ + +private void +cvt_8(union VALUETYPE *p, const struct magic *m) +{ + DO_CVT(b, (uint8_t)); +} + +private void +cvt_16(union VALUETYPE *p, const struct magic *m) +{ + DO_CVT(h, (uint16_t)); +} + +private void +cvt_32(union VALUETYPE *p, const struct magic *m) +{ + DO_CVT(l, (uint32_t)); +} + +private void +cvt_64(union VALUETYPE *p, const struct magic *m) +{ + DO_CVT(q, (uint64_t)); +} + /* * Convert the byte order of the data we are looking at * While we're here, let's apply the mask operation * (unless you have a better idea) */ private int -mconvert(struct magic_set *ms, union VALUETYPE *p, struct magic *m) +mconvert(struct magic_set *ms, struct magic *m) { + union VALUETYPE *p = &ms->ms_value; + switch (m->type) { case FILE_BYTE: - if (m->mask) - switch (m->mask_op&0x7F) { - case FILE_OPAND: - p->b &= m->mask; - break; - case FILE_OPOR: - p->b |= m->mask; - break; - case FILE_OPXOR: - p->b ^= m->mask; - break; - case FILE_OPADD: - p->b += m->mask; - break; - case FILE_OPMINUS: - p->b -= m->mask; - break; - case FILE_OPMULTIPLY: - p->b *= m->mask; - break; - case FILE_OPDIVIDE: - p->b /= m->mask; - break; - case FILE_OPMODULO: - p->b %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->b = ~p->b; + cvt_8(p, m); return 1; case FILE_SHORT: - if (m->mask) - switch (m->mask_op&0x7F) { - case FILE_OPAND: - p->h &= m->mask; - break; - case FILE_OPOR: - p->h |= m->mask; - break; - case FILE_OPXOR: - p->h ^= m->mask; - break; - case FILE_OPADD: - p->h += m->mask; - break; - case FILE_OPMINUS: - p->h -= m->mask; - break; - case FILE_OPMULTIPLY: - p->h *= m->mask; - break; - case FILE_OPDIVIDE: - p->h /= m->mask; - break; - case FILE_OPMODULO: - p->h %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->h = ~p->h; + cvt_16(p, m); return 1; case FILE_LONG: case FILE_DATE: case FILE_LDATE: - if (m->mask) - switch (m->mask_op&0x7F) { - case FILE_OPAND: - p->l &= m->mask; - break; - case FILE_OPOR: - p->l |= m->mask; - break; - case FILE_OPXOR: - p->l ^= m->mask; - break; - case FILE_OPADD: - p->l += m->mask; - break; - case FILE_OPMINUS: - p->l -= m->mask; - break; - case FILE_OPMULTIPLY: - p->l *= m->mask; - break; - case FILE_OPDIVIDE: - p->l /= m->mask; - break; - case FILE_OPMODULO: - p->l %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->l = ~p->l; + cvt_32(p, m); + return 1; + case FILE_QUAD: + case FILE_QDATE: + case FILE_QLDATE: + cvt_64(p, m); return 1; case FILE_STRING: - { - int n; - - /* Null terminate and eat *trailing* return */ - p->s[sizeof(p->s) - 1] = '\0'; - n = strlen(p->s) - 1; - if (p->s[n] == '\n') - p->s[n] = '\0'; - return 1; - } - case FILE_PSTRING: - { - char *ptr1 = p->s, *ptr2 = ptr1 + 1; - unsigned int n = *p->s; - if (n >= sizeof(p->s)) - n = sizeof(p->s) - 1; - while (n--) - *ptr1++ = *ptr2++; - *ptr1 = '\0'; - n = strlen(p->s) - 1; - if (p->s[n] == '\n') - p->s[n] = '\0'; - return 1; - } + case FILE_BESTRING16: + case FILE_LESTRING16: { + size_t len; + + /* Null terminate and eat *trailing* return */ + p->s[sizeof(p->s) - 1] = '\0'; + len = strlen(p->s); + if (len-- && p->s[len] == '\n') + p->s[len] = '\0'; + return 1; + } + case FILE_PSTRING: { + char *ptr1 = p->s, *ptr2 = ptr1 + 1; + size_t len = *p->s; + if (len >= sizeof(p->s)) + len = sizeof(p->s) - 1; + while (len--) + *ptr1++ = *ptr2++; + *ptr1 = '\0'; + len = strlen(p->s); + if (len-- && p->s[len] == '\n') + p->s[len] = '\0'; + return 1; + } case FILE_BESHORT: p->h = (short)((p->hs[0]<<8)|(p->hs[1])); - if (m->mask) - switch (m->mask_op&0x7F) { - case FILE_OPAND: - p->h &= m->mask; - break; - case FILE_OPOR: - p->h |= m->mask; - break; - case FILE_OPXOR: - p->h ^= m->mask; - break; - case FILE_OPADD: - p->h += m->mask; - break; - case FILE_OPMINUS: - p->h -= m->mask; - break; - case FILE_OPMULTIPLY: - p->h *= m->mask; - break; - case FILE_OPDIVIDE: - p->h /= m->mask; - break; - case FILE_OPMODULO: - p->h %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->h = ~p->h; + cvt_16(p, m); return 1; case FILE_BELONG: case FILE_BEDATE: case FILE_BELDATE: p->l = (int32_t) ((p->hl[0]<<24)|(p->hl[1]<<16)|(p->hl[2]<<8)|(p->hl[3])); - if (m->mask) - switch (m->mask_op&0x7F) { - case FILE_OPAND: - p->l &= m->mask; - break; - case FILE_OPOR: - p->l |= m->mask; - break; - case FILE_OPXOR: - p->l ^= m->mask; - break; - case FILE_OPADD: - p->l += m->mask; - break; - case FILE_OPMINUS: - p->l -= m->mask; - break; - case FILE_OPMULTIPLY: - p->l *= m->mask; - break; - case FILE_OPDIVIDE: - p->l /= m->mask; - break; - case FILE_OPMODULO: - p->l %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->l = ~p->l; + cvt_32(p, m); + return 1; + case FILE_BEQUAD: + case FILE_BEQDATE: + case FILE_BEQLDATE: + p->q = (int64_t) + (((int64_t)p->hq[0]<<56)|((int64_t)p->hq[1]<<48)| + ((int64_t)p->hq[2]<<40)|((int64_t)p->hq[3]<<32)| + (p->hq[4]<<24)|(p->hq[5]<<16)|(p->hq[6]<<8)|(p->hq[7])); + cvt_64(p, m); return 1; case FILE_LESHORT: p->h = (short)((p->hs[1]<<8)|(p->hs[0])); - if (m->mask) - switch (m->mask_op&0x7F) { - case FILE_OPAND: - p->h &= m->mask; - break; - case FILE_OPOR: - p->h |= m->mask; - break; - case FILE_OPXOR: - p->h ^= m->mask; - break; - case FILE_OPADD: - p->h += m->mask; - break; - case FILE_OPMINUS: - p->h -= m->mask; - break; - case FILE_OPMULTIPLY: - p->h *= m->mask; - break; - case FILE_OPDIVIDE: - p->h /= m->mask; - break; - case FILE_OPMODULO: - p->h %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->h = ~p->h; + cvt_16(p, m); return 1; case FILE_LELONG: case FILE_LEDATE: case FILE_LELDATE: p->l = (int32_t) ((p->hl[3]<<24)|(p->hl[2]<<16)|(p->hl[1]<<8)|(p->hl[0])); - if (m->mask) - switch (m->mask_op&0x7F) { - case FILE_OPAND: - p->l &= m->mask; - break; - case FILE_OPOR: - p->l |= m->mask; - break; - case FILE_OPXOR: - p->l ^= m->mask; - break; - case FILE_OPADD: - p->l += m->mask; - break; - case FILE_OPMINUS: - p->l -= m->mask; - break; - case FILE_OPMULTIPLY: - p->l *= m->mask; - break; - case FILE_OPDIVIDE: - p->l /= m->mask; - break; - case FILE_OPMODULO: - p->l %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->l = ~p->l; + cvt_32(p, m); + return 1; + case FILE_LEQUAD: + case FILE_LEQDATE: + case FILE_LEQLDATE: + p->q = (int64_t) + (((int64_t)p->hq[7]<<56)|((int64_t)p->hq[6]<<48)| + ((int64_t)p->hq[5]<<40)|((int64_t)p->hq[4]<<32)| + (p->hq[3]<<24)|(p->hq[2]<<16)|(p->hq[1]<<8)|(p->hq[0])); + cvt_64(p, m); + return 1; + case FILE_MELONG: + case FILE_MEDATE: + case FILE_MELDATE: + p->l = (int32_t) + ((p->hl[1]<<24)|(p->hl[0]<<16)|(p->hl[3]<<8)|(p->hl[2])); + cvt_32(p, m); return 1; case FILE_REGEX: + case FILE_SEARCH: + case FILE_DEFAULT: return 1; default: - file_error(ms, 0, "invalid type %d in mconvert()", m->type); + file_magerror(ms, "invalid type %d in mconvert()", m->type); return 0; } } @@ -596,72 +663,120 @@ mdebug(uint32_t offset, const char *str, size_t len) } private int -mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s, - struct magic *m, size_t nbytes) +mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir, + const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt) { - uint32_t offset = m->offset; + /* + * Note: FILE_SEARCH and FILE_REGEX do not actually copy + * anything, but setup pointers into the source + */ + if (indir == 0) { + switch (type) { + case FILE_SEARCH: + ms->search.s = (const char *)s + offset; + ms->search.s_len = nbytes - offset; + return 0; - if (m->type == FILE_REGEX) { - /* - * offset is interpreted as last line to search, - * (starting at 1), not as bytes-from start-of-file - */ - unsigned char *b, *last = NULL; - if ((p->buf = strdup((const char *)s)) == NULL) { - file_oomem(ms); - return -1; - } - for (b = (unsigned char *)p->buf; offset && - (b = (unsigned char *)strchr((char *)b, '\n')) != NULL; - offset--, s++) - last = b; - if (last != NULL) - *last = '\0'; - } else if (offset + sizeof(union VALUETYPE) <= nbytes) - memcpy(p, s + offset, sizeof(union VALUETYPE)); - else { - /* - * the usefulness of padding with zeroes eludes me, it - * might even cause problems - */ - memset(p, 0, sizeof(union VALUETYPE)); - if (offset < nbytes) - memcpy(p, s + offset, nbytes - offset); - } + case FILE_REGEX: { + /* + * offset is interpreted as last line to search, + * (starting at 1), not as bytes-from start-of-file + */ + const char *b; + const char *c; + const char *last; /* end of search region */ + const char *buf; /* start of search region */ + size_t lines; - /* Verify we have enough data to match magic type */ - switch (m->type) { - case FILE_BYTE: - if (nbytes < (offset + 1)) /* should alway be true */ + if (s == NULL) { + ms->search.s_len = 0; + ms->search.s = NULL; return 0; + } + buf = (const char *)s + offset; + last = (const char *)s + nbytes; + /* mget() guarantees buf <= last */ + for (lines = linecnt, b = buf; + lines && ((b = strchr(c = b, '\n')) || (b = strchr(c, '\r'))); + lines--, b++) { + last = b; + if (b[0] == '\r' && b[1] == '\n') + b++; + } + if (lines) + last = (const char *)s + nbytes; + + ms->search.s = buf; + ms->search.s_len = last - buf; + ms->search.offset = offset; + ms->search.rm_len = 0; + return 0; + } + case FILE_BESTRING16: + case FILE_LESTRING16: { + const unsigned char *src = s + offset; + const unsigned char *esrc = s + nbytes; + char *dst = p->s; + char *edst = &p->s[sizeof(p->s) - 1]; + + if (type == FILE_BESTRING16) + src++; + + /* check for pointer overflow */ + if (src < s) { + file_magerror(ms, "invalid offset %zu in mcopy()", + offset); + return -1; + } + for (/*EMPTY*/; src < esrc; src++, dst++) { + if (dst < edst) + *dst = *src++; + else + break; + if (*dst == '\0') + *dst = ' '; + } + *edst = '\0'; + return 0; + } + case FILE_STRING: /* XXX - these two should not need */ + case FILE_PSTRING: /* to copy anything, but do anyway. */ + default: break; + } + } - case FILE_SHORT: - case FILE_BESHORT: - case FILE_LESHORT: - if (nbytes < (offset + 2)) - return 0; - break; + if (offset >= nbytes) { + (void)memset(p, '\0', sizeof(*p)); + return 0; + } + if (nbytes - offset < sizeof(*p)) + nbytes = nbytes - offset; + else + nbytes = sizeof(*p); - case FILE_LONG: - case FILE_BELONG: - case FILE_LELONG: - case FILE_DATE: - case FILE_BEDATE: - case FILE_LEDATE: - case FILE_LDATE: - case FILE_BELDATE: - case FILE_LELDATE: - if (nbytes < (offset + 4)) - return 0; - break; + (void)memcpy(p, s + offset, nbytes); - case FILE_STRING: - case FILE_PSTRING: - if (nbytes < (offset + m->vallen)) - return 0; - break; - } + /* + * the usefulness of padding with zeroes eludes me, it + * might even cause problems + */ + if (nbytes < sizeof(*p)) + (void)memset(((char *)(void *)p) + nbytes, '\0', + sizeof(*p) - nbytes); + return 0; +} + +private int +mget(struct magic_set *ms, const unsigned char *s, + struct magic *m, size_t nbytes, unsigned int cont_level) +{ + uint32_t offset = ms->offset; + uint32_t count = m->str_count; + union VALUETYPE *p = &ms->ms_value; + + if (mcopy(ms, p, m->type, m->flag & INDIR, s, offset, nbytes, count) == -1) + return -1; if ((ms->flags & MAGIC_DEBUG) != 0) { mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE)); @@ -669,315 +784,454 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s, } if (m->flag & INDIR) { + int off = m->in_offset; + if (m->in_op & FILE_OPINDIRECT) { + const union VALUETYPE *q = + ((const void *)(s + offset + off)); + switch (m->in_type) { + case FILE_BYTE: + off = q->b; + break; + case FILE_SHORT: + off = q->h; + break; + case FILE_BESHORT: + off = (short)((q->hs[0]<<8)|(q->hs[1])); + break; + case FILE_LESHORT: + off = (short)((q->hs[1]<<8)|(q->hs[0])); + break; + case FILE_LONG: + off = q->l; + break; + case FILE_BELONG: + off = (int32_t)((q->hl[0]<<24)|(q->hl[1]<<16)| + (q->hl[2]<<8)|(q->hl[3])); + break; + case FILE_LELONG: + off = (int32_t)((q->hl[3]<<24)|(q->hl[2]<<16)| + (q->hl[1]<<8)|(q->hl[0])); + break; + case FILE_MELONG: + off = (int32_t)((q->hl[1]<<24)|(q->hl[0]<<16)| + (q->hl[3]<<8)|(q->hl[2])); + break; + } + } switch (m->in_type) { case FILE_BYTE: - if (m->in_offset) - switch (m->in_op&0x7F) { + if (nbytes < (offset + 1)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { case FILE_OPAND: - offset = p->b & m->in_offset; + offset = p->b & off; break; case FILE_OPOR: - offset = p->b | m->in_offset; + offset = p->b | off; break; case FILE_OPXOR: - offset = p->b ^ m->in_offset; + offset = p->b ^ off; break; case FILE_OPADD: - offset = p->b + m->in_offset; + offset = p->b + off; break; case FILE_OPMINUS: - offset = p->b - m->in_offset; + offset = p->b - off; break; case FILE_OPMULTIPLY: - offset = p->b * m->in_offset; + offset = p->b * off; break; case FILE_OPDIVIDE: - offset = p->b / m->in_offset; + offset = p->b / off; break; case FILE_OPMODULO: - offset = p->b % m->in_offset; + offset = p->b % off; break; } + } else + offset = p->b; if (m->in_op & FILE_OPINVERSE) offset = ~offset; break; case FILE_BESHORT: - if (m->in_offset) - switch (m->in_op&0x7F) { + if (nbytes < (offset + 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { case FILE_OPAND: offset = (short)((p->hs[0]<<8)| (p->hs[1])) & - m->in_offset; + off; break; case FILE_OPOR: offset = (short)((p->hs[0]<<8)| (p->hs[1])) | - m->in_offset; + off; break; case FILE_OPXOR: offset = (short)((p->hs[0]<<8)| (p->hs[1])) ^ - m->in_offset; + off; break; case FILE_OPADD: offset = (short)((p->hs[0]<<8)| (p->hs[1])) + - m->in_offset; + off; break; case FILE_OPMINUS: offset = (short)((p->hs[0]<<8)| (p->hs[1])) - - m->in_offset; + off; break; case FILE_OPMULTIPLY: offset = (short)((p->hs[0]<<8)| (p->hs[1])) * - m->in_offset; + off; break; case FILE_OPDIVIDE: offset = (short)((p->hs[0]<<8)| (p->hs[1])) / - m->in_offset; + off; break; case FILE_OPMODULO: offset = (short)((p->hs[0]<<8)| (p->hs[1])) % - m->in_offset; + off; break; } + } else + offset = (short)((p->hs[0]<<8)| + (p->hs[1])); if (m->in_op & FILE_OPINVERSE) offset = ~offset; break; case FILE_LESHORT: - if (m->in_offset) - switch (m->in_op&0x7F) { + if (nbytes < (offset + 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { case FILE_OPAND: offset = (short)((p->hs[1]<<8)| (p->hs[0])) & - m->in_offset; + off; break; case FILE_OPOR: offset = (short)((p->hs[1]<<8)| (p->hs[0])) | - m->in_offset; + off; break; case FILE_OPXOR: offset = (short)((p->hs[1]<<8)| (p->hs[0])) ^ - m->in_offset; + off; break; case FILE_OPADD: offset = (short)((p->hs[1]<<8)| (p->hs[0])) + - m->in_offset; + off; break; case FILE_OPMINUS: offset = (short)((p->hs[1]<<8)| (p->hs[0])) - - m->in_offset; + off; break; case FILE_OPMULTIPLY: offset = (short)((p->hs[1]<<8)| (p->hs[0])) * - m->in_offset; + off; break; case FILE_OPDIVIDE: offset = (short)((p->hs[1]<<8)| (p->hs[0])) / - m->in_offset; + off; break; case FILE_OPMODULO: offset = (short)((p->hs[1]<<8)| (p->hs[0])) % - m->in_offset; + off; break; } + } else + offset = (short)((p->hs[1]<<8)| + (p->hs[0])); if (m->in_op & FILE_OPINVERSE) offset = ~offset; break; case FILE_SHORT: - if (m->in_offset) - switch (m->in_op&0x7F) { + if (nbytes < (offset + 2)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { case FILE_OPAND: - offset = p->h & m->in_offset; + offset = p->h & off; break; case FILE_OPOR: - offset = p->h | m->in_offset; + offset = p->h | off; break; case FILE_OPXOR: - offset = p->h ^ m->in_offset; + offset = p->h ^ off; break; case FILE_OPADD: - offset = p->h + m->in_offset; + offset = p->h + off; break; case FILE_OPMINUS: - offset = p->h - m->in_offset; + offset = p->h - off; break; case FILE_OPMULTIPLY: - offset = p->h * m->in_offset; + offset = p->h * off; break; case FILE_OPDIVIDE: - offset = p->h / m->in_offset; + offset = p->h / off; break; case FILE_OPMODULO: - offset = p->h % m->in_offset; + offset = p->h % off; break; } + } + else + offset = p->h; if (m->in_op & FILE_OPINVERSE) offset = ~offset; break; case FILE_BELONG: - if (m->in_offset) - switch (m->in_op&0x7F) { + if (nbytes < (offset + 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { case FILE_OPAND: offset = (int32_t)((p->hl[0]<<24)| (p->hl[1]<<16)| (p->hl[2]<<8)| (p->hl[3])) & - m->in_offset; + off; break; case FILE_OPOR: offset = (int32_t)((p->hl[0]<<24)| (p->hl[1]<<16)| (p->hl[2]<<8)| (p->hl[3])) | - m->in_offset; + off; break; case FILE_OPXOR: offset = (int32_t)((p->hl[0]<<24)| (p->hl[1]<<16)| (p->hl[2]<<8)| (p->hl[3])) ^ - m->in_offset; + off; break; case FILE_OPADD: offset = (int32_t)((p->hl[0]<<24)| (p->hl[1]<<16)| (p->hl[2]<<8)| (p->hl[3])) + - m->in_offset; + off; break; case FILE_OPMINUS: offset = (int32_t)((p->hl[0]<<24)| (p->hl[1]<<16)| (p->hl[2]<<8)| (p->hl[3])) - - m->in_offset; + off; break; case FILE_OPMULTIPLY: offset = (int32_t)((p->hl[0]<<24)| (p->hl[1]<<16)| (p->hl[2]<<8)| (p->hl[3])) * - m->in_offset; + off; break; case FILE_OPDIVIDE: offset = (int32_t)((p->hl[0]<<24)| (p->hl[1]<<16)| (p->hl[2]<<8)| (p->hl[3])) / - m->in_offset; + off; break; case FILE_OPMODULO: offset = (int32_t)((p->hl[0]<<24)| (p->hl[1]<<16)| (p->hl[2]<<8)| (p->hl[3])) % - m->in_offset; + off; break; } + } else + offset = (int32_t)((p->hl[0]<<24)| + (p->hl[1]<<16)| + (p->hl[2]<<8)| + (p->hl[3])); if (m->in_op & FILE_OPINVERSE) offset = ~offset; break; case FILE_LELONG: - if (m->in_offset) - switch (m->in_op&0x7F) { + if (nbytes < (offset + 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { case FILE_OPAND: offset = (int32_t)((p->hl[3]<<24)| (p->hl[2]<<16)| (p->hl[1]<<8)| (p->hl[0])) & - m->in_offset; + off; break; case FILE_OPOR: offset = (int32_t)((p->hl[3]<<24)| (p->hl[2]<<16)| (p->hl[1]<<8)| (p->hl[0])) | - m->in_offset; + off; break; case FILE_OPXOR: offset = (int32_t)((p->hl[3]<<24)| (p->hl[2]<<16)| (p->hl[1]<<8)| (p->hl[0])) ^ - m->in_offset; + off; break; case FILE_OPADD: offset = (int32_t)((p->hl[3]<<24)| (p->hl[2]<<16)| (p->hl[1]<<8)| (p->hl[0])) + - m->in_offset; + off; break; case FILE_OPMINUS: offset = (int32_t)((p->hl[3]<<24)| (p->hl[2]<<16)| (p->hl[1]<<8)| (p->hl[0])) - - m->in_offset; + off; break; case FILE_OPMULTIPLY: offset = (int32_t)((p->hl[3]<<24)| (p->hl[2]<<16)| (p->hl[1]<<8)| (p->hl[0])) * - m->in_offset; + off; break; case FILE_OPDIVIDE: offset = (int32_t)((p->hl[3]<<24)| (p->hl[2]<<16)| (p->hl[1]<<8)| (p->hl[0])) / - m->in_offset; + off; break; case FILE_OPMODULO: offset = (int32_t)((p->hl[3]<<24)| (p->hl[2]<<16)| (p->hl[1]<<8)| (p->hl[0])) % - m->in_offset; + off; + break; + } + } else + offset = (int32_t)((p->hl[3]<<24)| + (p->hl[2]<<16)| + (p->hl[1]<<8)| + (p->hl[0])); + if (m->in_op & FILE_OPINVERSE) + offset = ~offset; + break; + case FILE_MELONG: + if (nbytes < (offset + 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { + case FILE_OPAND: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) & + off; + break; + case FILE_OPOR: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) | + off; + break; + case FILE_OPXOR: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) ^ + off; + break; + case FILE_OPADD: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) + + off; + break; + case FILE_OPMINUS: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) - + off; + break; + case FILE_OPMULTIPLY: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) * + off; + break; + case FILE_OPDIVIDE: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) / + off; + break; + case FILE_OPMODULO: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) % + off; break; } + } else + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])); if (m->in_op & FILE_OPINVERSE) offset = ~offset; break; case FILE_LONG: - if (m->in_offset) - switch (m->in_op&0x7F) { + if (nbytes < (offset + 4)) + return 0; + if (off) { + switch (m->in_op & FILE_OPS_MASK) { case FILE_OPAND: - offset = p->l & m->in_offset; + offset = p->l & off; break; case FILE_OPOR: - offset = p->l | m->in_offset; + offset = p->l | off; break; case FILE_OPXOR: - offset = p->l ^ m->in_offset; + offset = p->l ^ off; break; case FILE_OPADD: - offset = p->l + m->in_offset; + offset = p->l + off; break; case FILE_OPMINUS: - offset = p->l - m->in_offset; + offset = p->l - off; break; case FILE_OPMULTIPLY: - offset = p->l * m->in_offset; + offset = p->l * off; break; case FILE_OPDIVIDE: - offset = p->l / m->in_offset; + offset = p->l / off; break; case FILE_OPMODULO: - offset = p->l % m->in_offset; + offset = p->l % off; break; /* case TOOMANYSWITCHBLOCKS: * ugh = p->eye % m->strain; @@ -987,16 +1241,18 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s, * sleep; */ } + } else + offset = p->l; if (m->in_op & FILE_OPINVERSE) offset = ~offset; break; } - if (nbytes < sizeof(union VALUETYPE) || - nbytes - sizeof(union VALUETYPE) < offset) - return 0; - - memcpy(p, s + offset, sizeof(union VALUETYPE)); + if (m->flag & INDIROFFADD) + offset += ms->c.li[cont_level-1].off; + if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1) + return -1; + ms->offset = offset; if ((ms->flags & MAGIC_DEBUG) != 0) { mdebug(offset, (char *)(void *)p, @@ -1004,22 +1260,141 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s, file_mdump(m); } } - if (!mconvert(ms, p, m)) - return 0; + + /* Verify we have enough data to match magic type */ + switch (m->type) { + case FILE_BYTE: + if (nbytes < (offset + 1)) /* should alway be true */ + return 0; + break; + + case FILE_SHORT: + case FILE_BESHORT: + case FILE_LESHORT: + if (nbytes < (offset + 2)) + return 0; + break; + + case FILE_LONG: + case FILE_BELONG: + case FILE_LELONG: + case FILE_MELONG: + case FILE_DATE: + case FILE_BEDATE: + case FILE_LEDATE: + case FILE_MEDATE: + case FILE_LDATE: + case FILE_BELDATE: + case FILE_LELDATE: + case FILE_MELDATE: + if (nbytes < (offset + 4)) + return 0; + break; + + case FILE_STRING: + case FILE_PSTRING: + case FILE_SEARCH: + if (nbytes < (offset + m->vallen)) + return 0; + break; + + case FILE_REGEX: + if (nbytes < offset) + return 0; + break; + + case FILE_DEFAULT: /* nothing to check */ + default: + break; + } + if (!mconvert(ms, m)) + return 0; return 1; } -private int -mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) +private uint64_t +file_strncmp(const char *s1, const char *s2, size_t len, uint32_t flags) { - uint32_t l = m->value.l; - uint32_t v; - int matched; + /* + * Convert the source args to unsigned here so that (1) the + * compare will be unsigned as it is in strncmp() and (2) so + * the ctype functions will work correctly without extra + * casting. + */ + const unsigned char *a = (const unsigned char *)s1; + const unsigned char *b = (const unsigned char *)s2; + uint64_t v; - if ( (m->value.s[0] == 'x') && (m->value.s[1] == '\0') ) { - return 1; + /* + * What we want here is: + * v = strncmp(m->value.s, p->s, m->vallen); + * but ignoring any nulls. bcmp doesn't give -/+/0 + * and isn't universally available anyway. + */ + v = 0; + if (0L == flags) { /* normal string: do it fast */ + while (len-- > 0) + if ((v = *b++ - *a++) != '\0') + break; } + else { /* combine the others */ + while (len-- > 0) { + if ((flags & STRING_IGNORE_LOWERCASE) && + islower(*a)) { + if ((v = tolower(*b++) - *a++) != '\0') + break; + } + else if ((flags & STRING_IGNORE_UPPERCASE) && + isupper(*a)) { + if ((v = toupper(*b++) - *a++) != '\0') + break; + } + else if ((flags & STRING_COMPACT_BLANK) && + isspace(*a)) { + a++; + if (isspace(*b++)) { + while (isspace(*b)) + b++; + } + else { + v = 1; + break; + } + } + else if ((flags & STRING_COMPACT_OPTIONAL_BLANK) && + isspace(*a)) { + a++; + while (isspace(*b)) + b++; + } + else { + if ((v = *b++ - *a++) != '\0') + break; + } + } + } + return v; +} +private uint64_t +file_strncmp16(const char *a, const char *b, size_t len, uint32_t flags) +{ + /* + * XXX - The 16-bit string compare probably needs to be done + * differently, especially if the flags are to be supported. + * At the moment, I am unsure. + */ + flags = 0; + return file_strncmp(a, b, len, flags); +} + +private int +magiccheck(struct magic_set *ms, struct magic *m) +{ + uint64_t l = m->value.q; + uint64_t v; + int matched; + union VALUETYPE *p = &ms->ms_value; switch (m->type) { case FILE_BYTE: @@ -1035,122 +1410,175 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) case FILE_LONG: case FILE_BELONG: case FILE_LELONG: + case FILE_MELONG: case FILE_DATE: case FILE_BEDATE: case FILE_LEDATE: + case FILE_MEDATE: case FILE_LDATE: case FILE_BELDATE: case FILE_LELDATE: + case FILE_MELDATE: v = p->l; break; + case FILE_QUAD: + case FILE_LEQUAD: + case FILE_BEQUAD: + case FILE_QDATE: + case FILE_BEQDATE: + case FILE_LEQDATE: + case FILE_QLDATE: + case FILE_BEQLDATE: + case FILE_LEQLDATE: + v = p->q; + break; + + case FILE_DEFAULT: + l = 0; + v = 0; + break; + case FILE_STRING: case FILE_PSTRING: - { - /* - * What we want here is: - * v = strncmp(m->value.s, p->s, m->vallen); - * but ignoring any nulls. bcmp doesn't give -/+/0 - * and isn't universally available anyway. - */ - unsigned char *a = (unsigned char*)m->value.s; - unsigned char *b = (unsigned char*)p->s; - int len = m->vallen; + l = 0; + v = file_strncmp(m->value.s, p->s, (size_t)m->vallen, m->str_flags); + break; + + case FILE_BESTRING16: + case FILE_LESTRING16: + l = 0; + v = file_strncmp16(m->value.s, p->s, (size_t)m->vallen, m->str_flags); + break; + + case FILE_SEARCH: { /* search ms->search.s for the string m->value.s */ + size_t slen; + size_t idx; + + if (ms->search.s == NULL) + return 0; + + slen = MIN(m->vallen, sizeof(m->value.s)); l = 0; v = 0; - if (0L == m->mask) { /* normal string: do it fast */ - while (--len >= 0) - if ((v = *b++ - *a++) != '\0') - break; - } else { /* combine the others */ - while (--len >= 0) { - if ((m->mask & STRING_IGNORE_LOWERCASE) && - islower(*a)) { - if ((v = tolower(*b++) - *a++) != '\0') - break; - } else if ((m->mask & STRING_COMPACT_BLANK) && - isspace(*a)) { - a++; - if (isspace(*b++)) { - while (isspace(*b)) - b++; - } else { - v = 1; - break; - } - } else if (isspace(*a) && - (m->mask & STRING_COMPACT_OPTIONAL_BLANK)) { - a++; - while (isspace(*b)) - b++; - } else { - if ((v = *b++ - *a++) != '\0') - break; - } + ms->search.offset = m->offset; + + for (idx = 0; m->str_count == 0 || idx < m->str_count; idx++) { + if (slen + idx > ms->search.s_len) + break; + + v = file_strncmp(m->value.s, ms->search.s + idx, slen, m->str_flags); + if (v == 0) { /* found match */ + ms->search.offset = m->offset + idx; + break; } } break; } - case FILE_REGEX: - { + case FILE_REGEX: { int rc; regex_t rx; char errmsg[512]; - rc = regcomp(&rx, m->value.s, REG_EXTENDED|REG_NOSUB); + if (ms->search.s == NULL) + return 0; + + l = 0; + rc = regcomp(&rx, m->value.s, + REG_EXTENDED|REG_NEWLINE| + ((m->str_flags & STRING_IGNORE_CASE) ? REG_ICASE : 0)); if (rc) { - free(p->buf); - regerror(rc, &rx, errmsg, sizeof(errmsg)); - file_error(ms, 0, "regex error %d, (%s)", rc, errmsg); - return -1; - } else { - rc = regexec(&rx, p->buf, 0, 0, 0); + (void)regerror(rc, &rx, errmsg, sizeof(errmsg)); + file_magerror(ms, "regex error %d, (%s)", + rc, errmsg); + v = (uint64_t)-1; + } + else { + regmatch_t pmatch[1]; +#ifndef REG_STARTEND +#define REG_STARTEND 0 + size_t l = ms->search.s_len - 1; + char c = ms->search.s[l]; + ((char *)(intptr_t)ms->search.s)[l] = '\0'; +#else + pmatch[0].rm_so = 0; + pmatch[0].rm_eo = ms->search.s_len; +#endif + rc = regexec(&rx, (const char *)ms->search.s, + 1, pmatch, REG_STARTEND); +#if REG_STARTEND == 0 + ((char *)(intptr_t)ms->search.s)[l] = c; +#endif + switch (rc) { + case 0: + ms->search.s += (int)pmatch[0].rm_so; + ms->search.offset += (size_t)pmatch[0].rm_so; + ms->search.rm_len = + (size_t)(pmatch[0].rm_eo - pmatch[0].rm_so); + v = 0; + break; + + case REG_NOMATCH: + v = 1; + break; + + default: + (void)regerror(rc, &rx, errmsg, sizeof(errmsg)); + file_magerror(ms, "regexec error %d, (%s)", + rc, errmsg); + v = (uint64_t)-1; + break; + } regfree(&rx); - free(p->buf); - return !rc; } + if (v == (uint64_t)-1) + return -1; + break; } default: - file_error(ms, 0, "invalid type %d in mcheck()", m->type); + file_magerror(ms, "invalid type %d in magiccheck()", m->type); return -1; } - if (m->type != FILE_STRING && m->type != FILE_PSTRING) - v = file_signextend(ms, m, v); + v = file_signextend(ms, m, v); switch (m->reln) { case 'x': if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%u == *any* = 1\n", v); + (void) fprintf(stderr, "%llu == *any* = 1\n", + (unsigned long long)v); matched = 1; break; case '!': matched = v != l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%u != %u = %d\n", - v, l, matched); + (void) fprintf(stderr, "%llu != %llu = %d\n", + (unsigned long long)v, (unsigned long long)l, + matched); break; case '=': matched = v == l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%u == %u = %d\n", - v, l, matched); + (void) fprintf(stderr, "%llu == %llu = %d\n", + (unsigned long long)v, (unsigned long long)l, + matched); break; case '>': if (m->flag & UNSIGNED) { matched = v > l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%u > %u = %d\n", - v, l, matched); + (void) fprintf(stderr, "%llu > %llu = %d\n", + (unsigned long long)v, + (unsigned long long)l, matched); } else { - matched = (int32_t) v > (int32_t) l; + matched = (int64_t) v > (int64_t) l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%d > %d = %d\n", - v, l, matched); + (void) fprintf(stderr, "%lld > %lld = %d\n", + (long long)v, (long long)l, matched); } break; @@ -1158,37 +1586,52 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) if (m->flag & UNSIGNED) { matched = v < l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%u < %u = %d\n", - v, l, matched); + (void) fprintf(stderr, "%llu < %llu = %d\n", + (unsigned long long)v, + (unsigned long long)l, matched); } else { - matched = (int32_t) v < (int32_t) l; + matched = (int64_t) v < (int64_t) l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%d < %d = %d\n", - v, l, matched); + (void) fprintf(stderr, "%lld < %lld = %d\n", + (long long)v, (long long)l, matched); } break; case '&': matched = (v & l) == l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "((%x & %x) == %x) = %d\n", - v, l, l, matched); + (void) fprintf(stderr, "((%llx & %llx) == %llx) = %d\n", + (unsigned long long)v, (unsigned long long)l, + (unsigned long long)l, matched); break; case '^': matched = (v & l) != l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "((%x & %x) != %x) = %d\n", - v, l, l, matched); + (void) fprintf(stderr, "((%llx & %llx) != %llx) = %d\n", + (unsigned long long)v, (unsigned long long)l, + (unsigned long long)l, matched); break; default: matched = 0; - file_error(ms, 0, "cannot happen: invalid relation `%c'", + file_magerror(ms, "cannot happen: invalid relation `%c'", m->reln); return -1; } return matched; } + +private int +print_sep(struct magic_set *ms, int firstline) +{ + if (firstline) + return 0; + /* + * we found another match + * put a newline and '-' to do some simple formatting + */ + return file_printf(ms, "\n- "); +} diff --git a/usr.bin/file/tar.h b/usr.bin/file/tar.h index 07ccf64fc2b..0a10238695b 100644 --- a/usr.bin/file/tar.h +++ b/usr.bin/file/tar.h @@ -1,4 +1,4 @@ -/* $OpenBSD: tar.h,v 1.5 2004/05/19 02:32:36 tedu Exp $ */ +/* $OpenBSD: tar.h,v 1.6 2008/05/08 01:40:56 chl Exp $ */ /* * Copyright (c) Ian F. Darwin 1986-1995. * Software written by Ian F. Darwin and others; @@ -33,7 +33,7 @@ * * Created 25 August 1985 by John Gilmore, ihnp4!hoptoad!gnu. * - * $Id: tar.h,v 1.5 2004/05/19 02:32:36 tedu Exp $ # checkin only + * $Id: tar.h,v 1.6 2008/05/08 01:40:56 chl Exp $ # checkin only */ /* @@ -83,7 +83,8 @@ union record { #define CHKBLANKS " " /* 8 blanks, no null */ /* The magic field is filled with this if uname and gname are valid. */ -#define TMAGIC "ustar " /* 7 chars and a null */ +#define TMAGIC "ustar" /* 5 chars and a null */ +#define GNUTMAGIC "ustar " /* 7 chars and a null */ /* The linkflag defines the type of file */ #define LF_OLDNORMAL '\0' /* Normal disk file, Unix compat */ @@ -106,52 +107,6 @@ union record { #define EX_BADARCH 3 /* bad archive */ #define EX_SYSTEM 4 /* system gave unexpected error */ - -/* - * Global variables - */ -TAR_EXTERN union record *ar_block; /* Start of block of archive */ -TAR_EXTERN union record *ar_record; /* Current record of archive */ -TAR_EXTERN union record *ar_last; /* Last+1 record of archive block */ -TAR_EXTERN char ar_reading; /* 0 writing, !0 reading archive */ -TAR_EXTERN int blocking; /* Size of each block, in records */ -TAR_EXTERN int blocksize; /* Size of each block, in bytes */ -TAR_EXTERN char *ar_file; /* File containing archive */ -TAR_EXTERN char *name_file; /* File containing names to work on */ -TAR_EXTERN char *tar; /* Name of this program */ - -/* - * Flags from the command line - */ -TAR_EXTERN char f_reblock; /* -B */ -TAR_EXTERN char f_create; /* -c */ -TAR_EXTERN char f_debug; /* -d */ -TAR_EXTERN char f_sayblock; /* -D */ -TAR_EXTERN char f_follow_links; /* -h */ -TAR_EXTERN char f_ignorez; /* -i */ -TAR_EXTERN char f_keep; /* -k */ -TAR_EXTERN char f_modified; /* -m */ -TAR_EXTERN char f_oldarch; /* -o */ -TAR_EXTERN char f_use_protection; /* -p */ -TAR_EXTERN char f_sorted_names; /* -s */ -TAR_EXTERN char f_list; /* -t */ -TAR_EXTERN char f_namefile; /* -T */ -TAR_EXTERN char f_verbose; /* -v */ -TAR_EXTERN char f_extract; /* -x */ -TAR_EXTERN char f_compress; /* -z */ - -/* - * We now default to Unix Standard format rather than 4.2BSD tar format. - * The code can actually produce all three: - * f_standard ANSI standard - * f_oldarch V7 - * neither 4.2BSD - * but we don't bother, since 4.2BSD can read ANSI standard format anyway. - * The only advantage to the "neither" option is that we can cmp(1) our - * output to the output of 4.2BSD tar, for debugging. - */ -#define f_standard (!f_oldarch) - /* * Structure for keeping track of filenames and lists thereof. */ @@ -162,12 +117,6 @@ struct name { char name[NAMSIZ+1]; }; -TAR_EXTERN struct name *namelist; /* Points to first name in list */ -TAR_EXTERN struct name *namelast; /* Points to last name in list */ - -TAR_EXTERN int archive; /* File descriptor for archive file */ -TAR_EXTERN int errors; /* # of files in error */ - /* * * Due to the next struct declaration, each routine that includes @@ -185,21 +134,3 @@ struct link { short linkcount; char name[NAMSIZ+1]; }; - -TAR_EXTERN struct link *linklist; /* Points to first link in list */ - - -/* - * Error recovery stuff - */ -TAR_EXTERN char read_error_flag; - - -#if 0 -/* - * Declarations of functions available to the world. - */ -/*LINTLIBRARY*/ -#define annorec(stream, msg) anno(stream, msg, 0) /* Cur rec */ -#define annofile(stream, msg) anno(stream, msg, 1) /* Saved rec */ -#endif |