2c2 < # @(#)magic 1.15 90/08/27 SMI; from S5R3.1 1.25 --- > # @(#)magic 1.14 90/06/09 SMI; from S5R3.1 1.25 16,19c16,18 < # CODE CHANGED: < # 8/27/90 < # - added specifications for File Manager to replace < # install_filemgr. --- > # Local mods: > # Extra entries for many more image, archive, binary and graphics > # formats have been added. 20a20,26 > # WARNING > # Don't try to use this file unless you have a fixed /usr/bin/file > # that has a bug corrected that lets it core dump on big magic files. > # No kidding -- stolcke 4/1/92 > # > # $Header: /etc/RCS/magic,v 1.22 1994/08/10 00:32:49 stolcke Exp $ > # 32a39,40 > >2 long >1 - %d characters originally > >2 long 1 - %d character originally 41c49,62 < 0 string !\n__.SYMDEF archive random library --- > # > # Archives - This handles MIPS archive subtypes > # > 0 string !\n__.SYMDEF archive > >17 string \ SORTED sorted > >17 string \ random library > 0 string !\n__________E MIPS archive > >20 string U with mipsucode members > >21 string L with mipsel members > >21 string B with mipseb members > >19 string L and a EL hash table > >19 string B and a EB hash table > >22 string X -- out of date > 0 string !\n/\ COFF archive 49a71,76 > 0 string %!PS-Adobe- PostScript > >11 byte x version %c > >13 byte x .%c document > >15 string EPS type %s > >15 string Query type %s > >15 string ExitServer type %s 54c81 < 0 string StartFontMetrics ASCII font metrics --- > #0 string StartFontMetrics ASCII font metrics 85d111 < # the following five are for the use of FileManager 90a117,777 > # > # Font formats > # > 0 string %!PS-AdobeFont- PostScript > >15 byte x type %c > >17 byte x .%c font > 0 string StartFontMetrics ASCII font metrics > >17 byte x version %c > >19 byte x .%c > 0 string STARTFONT BDF font > >10 byte x version %c > >12 byte x .%c > # needs to come before of mipsel check (first 2 bytes the same) > 1 string fcp PCF font > >0 byte >0 version %d > # > # ELF binaries (from SVR4 /etc/magic) > # > 0 string ELF ELF > >4 byte 1 32-bit > >5 byte 1 LSB > >5 byte 2 MSB > >16 short 0 unknown type > >16 short 1 relocatable > >16 short 2 executable > >16 short 3 dynamic lib > >16 short 4 core file > >18 short 0 unknown machine > >18 short 1 WE32100 > >18 short 2 SPARC > >18 short 3 80386 > >18 short 4 M68000 > >18 short 5 M88000 > >18 short 8 MIPS > >20 long 1 Version 1 > >36 long 1 MAU Required > # > # IRIX core format version 1 (from /usr/include/core.out.h) > # > 0 long 0xdeadadb0 IRIX core dump > >4 long 1 of > >16 byte x '%c > >17 byte x %c > >18 byte x %c > >19 byte x %c > >20 byte x %c > >21 byte x %c > >22 byte x %c > >23 byte x %c > >24 byte x %c' > >176 long x (killed by signal %d) > # > # BSD/386 binaries > # (from BSDI /usr/share/misc/magic) > # Note: some of these are identical to the VAX magic numbers below. > # Since VAXen are almost extinct we give precedence to the 386. > 0 long 0xcc000000 386 compact demand paged pure executable > >16 long >0 not stripped > >16 long <0 not stripped > 0 long 0x07010000 386 executable > >16 long >0 not stripped > >16 long <0 not stripped > 0 long 0x08010000 386 pure executable > >16 long >0 not stripped > >16 long <0 not stripped > 0 long 0x0b010000 386 pure executable > >16 long >0 not stripped > >16 long <0 not stripped > # > # VAX binaries > # > 0 short 03401 VAX executable > >8 short >0 not stripped > 0 long 04001 VAX pure executable > >16 long >0 not stripped > 0 short 05401 VAX demand paged pure > >2 short 0x200 POSIX > >2 short 0x100 SVID > >2 short x executable > >16 long >0 not stripped > # > # MIPS binaries > # > 0 short 0x0160 mipseb > >20 short 0407 407 > >20 short 0410 pure > >20 short 0413 demand paged > >20 short x executable > >8 long <0 not stripped > >8 long >0 not stripped > >22 byte x - version %ld. > >23 byte x %ld > 0 short 0x0162 mipsel > >20 short 0407 407 > >20 short 0410 pure > >20 short 0413 demand paged > >20 short x executable > >8 long <0 not stripped > >8 long >0 not stripped > >22 byte x - version %ld. > >23 byte x %ld > 0 short 0x6001 swapped mipseb > >20 short 03401 407 > >20 short 04001 pure > >20 short 05401 demand paged > >20 short x executable > >8 long <0 not stripped > >8 long >0 not stripped > >23 byte x - version %ld. > >22 byte x %ld > 0 short 0x6201 swapped mipsel > >20 short 03401 407 > >20 short 04001 pure > >20 short 05401 demand paged > >20 short x executable > >8 long <0 not stripped > >8 long >0 not stripped > >23 byte x - version %ld. > >22 byte x %ld > 0 short 0x180 mipseb ucode > 0 short 0x182 mipsel ucode > 0 short 0x0163 mipseb mips2 > >20 short 0407 407 > >20 short 0410 pure > >20 short 0413 demand paged > >20 short x executable > >8 long <0 not stripped > >8 long >0 not stripped > >22 byte x - version %ld. > >23 byte x %ld > 0 short 0x0166 mipsel mips2 > >20 short 0407 407 > >20 short 0410 pure > >20 short 0413 demand paged > >20 short x executable > >8 long <0 not stripped > >8 long >0 not stripped > >22 byte x - version %ld. > >23 byte x %ld > 0 short 0x6301 swapped mipseb mips2 > >20 short 03401 407 > >20 short 04001 pure > >20 short 05401 demand paged > >20 short x executable > >8 long <0 not stripped > >8 long >0 not stripped > >23 byte x - version %ld. > >22 byte x %ld > 0 short 0x6601 swapped mipsel > >20 short 03401 407 > >20 short 04001 pure > >20 short 05401 demand paged > >20 short x executable > >8 long <0 not stripped > >8 long >0 not stripped > >23 byte x - version %ld. > >22 byte x %ld > # > # OSF/Alpha binaries > # > 0 short 0x8301 alpha COFF > >22 short&0x00f0 0x0030 dynamically linked, > >24 short 03401 407 > >24 short 04001 pure > >24 short 05401 demand paged > >24 short x executable > >16 long >0 not stripped > >16 long <0 not stripped > # these are in reverse, since swapped order > >27 byte x - version %ld. > >26 byte x %ld > >28 byte x -%ld > # > # Sun i386 and DOS binaries > # > 0 short 0x4c01 i386 COFF > >16 short 0 executable > >20 short 0x801 pure > >20 short 0xd01 demand paged > >22 short 0 pre BL6 or system 5 executable > >22 short 0x0100 dynamically linked executable > >22 short 0x147a executable > >22 short 0x157a dynamically linked executable > >22 short 0x167a shared library > >12 stripped > 0 string MZ DOS executable (EXE) > 0 string LZ DOS executable (built-in) > # > # Mach binaries > # (from /usr/include/sys/loader.h and /usr/include/sys/machine.h) > # > 0 long 0xfeedface Mach-O > # cputype > >4 long 0 vax > >4 long 1 romp > >4 long 4 ns32032 > >4 long 5 ns32332 > >4 long 6 mc68000 > >4 long 7 i386 > >4 long 8 mips > >4 long 9 ns32532 > >4 long 11 hppa > >4 long 12 arm > >4 long 13 mc88000 > >4 long 14 sparc > # cpu subtype (for VAX) -- skip > #>8 long 1 780 > #>8 long 2 785 > #>8 long 3 750 > #>8 long 4 730 > #>8 long 5 uvaxI > #>8 long 6 uvaxII > #>8 long 7 8200 > #>8 long 8 8500 > #>8 long 9 8600 > #>8 long 10 8650 > #>8 long 11 8800 > #>8 long 12 umaxIII > # file type > >12 long 1 relocatable object > >12 long 2 demand paged executable > >12 long 3 fixed VM shared library > >12 long 4 core file > >12 long 5 preloaded executable > # > # TMS320C30 binaries > # > 0 short 0x0093 TMS320C30 COFF > >18 short&0x02 0 object > >18 short&0x02 >0 executable > >18 short&0x01 0 not stripped > >18 short&0x04 >0 with line numbers stripped > >18 short&0x10 >0 with local symbols stripped > #>18 short&0x40 >0 (little endian) > #>16 short 0 object > #>16 short 28 executable > # (moved to archive section above) > #0 string !\n/\ TMS320C30 archive > # > # HP binary formats > # (from HP-UX /etc/magic) > # > 0 long 0x020cff65 HP s200 old archive > 0 short 0x020c HP s200 > >2 short 0x0106 relocatable executable > >2 short 0x0107 executable > >2 short 0x0108 pure executable > >2 short 0x010b demand-load executable > >4 short >0 -version %ld > >6 short >0 -highwater %d > >8 long&0x80000000 >0 save fp regs > >8 long&0x40000000 >0 dynamically linked > >8 long&0x20000000 >0 debuggable > >8 long&0x10000000 >2 PIC > >36 long >0 not stripped > 0 long 0x020aff65 HP s200 old archive > 0 short 0x020a HP s200 (2.x release) > >2 short 0x0107 executable > >2 short 0x0108 pure executable > >2 short 0x010d dynamic load library > >2 short 0x010e shared library > >4 short >0 -version %ld > >6 short >0 -highwater %d > >36 long >0 not stripped > 0 long 0x0208ff65 HP s500 old archive > 0 short 0x0208 HP s500 > >2 short 0x0106 relocatable executable > >2 short 0x0107 executable > >2 short 0x0108 pure executable > >16 long >0 -version %ld > 0 short 0x020b HP s800 > >2 short 0x0106 relocatable object > >2 short 0x0107 executable > >2 short 0x0108 shared executable > >2 short 0x010b demand-load executable > >2 short 0x010d dynamic load library > >2 short 0x010e shared library > >2 short 0x0619 relocatable library > #>(144) long 0x054ef630 dynamically linked > >96 long >0 not stripped > 0 short 0x0210 HPPA-RISC1.1 > >2 short 0x0106 relocatable object > >2 short 0x0107 executable > >2 short 0x0108 shared executable > >2 short 0x010b demand-load executable > >2 short 0x010d dynamic load library > >2 short 0x010e shared library > #>(144) long 0x054ef630 dynamically linked > >96 long >0 not stripped > 0 short 0x8000 lif file > 0 long 0x020c010c compiled Lisp > 0 long 0x4da7eee8 HP-WINDOWS font > >8 byte >0 -version %ld > # > # some old archive formats > # (also from HP-UX /etc/magic) > # > 0 long 0x0000ff65 old archive > 0 long 0x39bed PDP-11 old archive > 0 long 0x39bee PDP-11 4.0 archive > 0 long 0x65ff0000 VAX 3.0 archive > 0 long 0x3c61723e VAX 5.0 archive > # > # Compiled Lisp > # > 0 short 0xf32a Allegro CL > >12 byte x %c > >14 byte x .%c fasl file > 0 short 0xf3ae Allegro CL > >16 byte x %c > >18 byte x .%c fasl file > 0 string FASL\ FILE CMU CL fasl file > 0 string CORE\0 CMU CL core file > # > # encoded binary files > # > 0 string begin\ uuencoded file > 0 string xbtoa\ Begin btoa encoded file > 0 short 0x1f8b gzip compressed data > >2 byte 8 - deflate method > >3 byte&0x1 >0 , ascii > >3 byte&0x2 >0 , continuation > >3 byte&0x4 >0 , extra field > >3 byte&0x8 >0 , original file name > >3 byte&0x10 >0 , comment > >3 byte&0x20 >0 , encrypted > 0 short 0x1f9e freeze version 1.x compressed data > 0 short 0x1f9f freeze compressed data > 0 long 0x504b0304 PKZIP > >4 byte x version %d archive > 0 string ZOO\ ZOO version > >4 byte x %c > >6 byte x .%c > >7 byte x %c archive > 0 byte 0x1a ARC > >1 byte 0 empty > >1 byte 1 obsolete unpacked > >1 byte 2 unpacked > >1 byte 3 packed > >1 byte 4 squeezed > >1 byte 5 obsolete crunched > >1 byte 6 obsolete packed crunched > >1 byte 7 obsolete packed crunched > >1 byte 8 packed crunched > >2 byte x archive > 0 string head\t RCS file > 0 string \#\ This\ is\ a\ shell\ archive shell archive > 10 string \#\ This\ is\ a\ shell\ archive shell archive > 11 string \#\ This\ is\ a\ shell\ archive shell archive > # > # Pixmap formats > # > 0 string P1 PBM file > 0 string P2 PGM file > 0 string P3 PPM file > 0 string P4 PBM "rawbits" file > 0 string P5 PGM "rawbits" file > 0 string P6 PPM "rawbits" file > 0 string \361\0\100\273 CMU window manager bitmap > #0 string \131\246\152\225 Sun rasterfile > 0 string yz MGR bitmap > 0 string \115\115 TIFF file, big-endian > 0 string \111\111 TIFF file, little-endian > 0 string GIF87a GIF file > 0 string GIF89a GIF file > 8 string ILBM IFF ILBM file > 0 string This\040is\040a\040BitMap\040file Lisp Machine bit-array-file > #0 string \012 PC Paintbrush .pcx file > 0 string !! Bennet Yee's "face" format > 0 string Imagefile version-1: Version 1 IFF file > 0 string Imagefile version-2: Version 2 IFF file > 0 short 0xffd8 JPEG image > # > # Movie formats > # > 4 long 0x6D646174 Quicktime movie > 0 long 0x000001B3 MPEG movie > # > # TeX and METAFONT formats > # > 0 string \\documentstyle LaTeX document > 0 string \\input\ texinfo texinfo document > 0 short 0xF702 TeX82 device independent (.dvi) file > >12 short x magnification %d > 0 short 0xF703 TeX82 right-left device independent (.ivd) file > >12 short x magnification %d > 0 short 0xF704 TeX82 future device independent (.dvi) file > 0 byte 0xF7 METAFONT84 > >1 byte 0x83 general font (.gf) file > >1 byte 0x59 packed font (.pk) file > >1 byte 0xCA virtual font (.vf) file > 0 long 0xE9030000 old METAFONT pixel font (.pxl) file > # > # Editor formats > # > 0 string .PS pic input > 0 string #FIG\ Fig format > >5 byte x %c > >7 byte x .%c figure > 38 string Spreadsheet sc spreadsheet > 0 string %Doc- doc > >5 byte x %c > >7 byte x .%c document > 0 string %I\ Idraw idraw figure > # > # Solaris 2.x /etc/magic appended below -- contains some harmless duplication > # > #ident "@(#)magic 1.17 93/06/09 SMI" /* SVr4.0 1.30 */ > > # file cmd's magic file > # > # > # Basically, the fields of this file are as follows: > # byte offset, value type, optional operator (= by default), value > # to match (numeric or string), and string to be printed. Numeric > # values may be decimal, octal, or hex. Also note that the last > # string may have 1 printf format spec. > # The '>' in occassional column 1's is magic: it forces file to > # continue scanning and matching additional lines. The first line > # afterwards not so marked terminates the search. > # > 0 string ELF ELF > >4 byte 1 32-bit > >5 byte 1 LSB > >5 byte 2 MSB > >16 short 0 unknown type > >16 short 1 relocatable > >16 short 2 executable > >16 short 3 dynamic lib > >16 short 4 core file > >18 short 0 unknown machine > >18 short 1 WE32100 > >18 short 2 SPARC > >18 short 3 80386 > >18 short 4 M68000 > >18 short 5 M88000 > >20 long 1 Version 1 > >36 long 1 MAU Required > 0 short 070701 cpio archive > 0 string 070701 ASCII cpio archive > 0 short 070702 cpio archive - CRC header > 0 string 070702 ASCII cpio archive - CRC header > 0 short 070707 cpio archive - CHR (-c) header > 0 string 070707 ASCII cpio archive - CHR (-c) header > 0 long 0177555 obsolete ar archive > 0 short 0177545 pdp11/pre System V ar archive > 0 long 0100554 apl workspace > 0 short 017037 packed data > 0 string System V Release 1 ar archive > 0 string ! current ar archive > 0 short 0407 pdp11/pre System V vax executable > >8 short >0 not stripped > >15 byte >0 - version %ld > 0 short 0401 unix-rt ldp > 0 short 0405 pdp11 overlay > 0 short 0410 pdp11/pre System V vax pure executable > >8 short >0 not stripped > >15 byte >0 - version %ld > 0 short 0411 pdp11 separate I&D > >8 short >0 not stripped > >15 byte >0 - version %ld > 0 short 015001 Compiled Terminfo Entry > 0 short 0433 Curses screen image > 0 short 0434 Curses screen image > 0 short 0437 pdp11 kernel overlay > 0 short 0570 vax executable > >12 long >0 not stripped > >22 short >0 - version %ld > 0 short 0575 vax pure executable > >12 long >0 not stripped > >22 short >0 - version %ld > 0 short 0502 basic-16 executable > >12 long >0 not stripped > >22 short >0 - version %ld > 0 short 0503 basic-16 executable (TV) > >12 long >0 not stripped > >22 short >0 - version %ld > 0 short 0510 x86 executable > >12 long >0 not stripped > 0 short 0511 x86 executable (TV) > >12 long >0 not stripped > 0 short 0550 3b20 executable > >12 long >0 not stripped > >22 short >0 - version %ld > 0 short 0551 3b20 executable (TV) > >12 long >0 not stripped > >22 short >0 - version %ld > 0 short 0560 WE32000 executable > >12 long >0 not stripped > >18 short ^00010000 - N/A on 3b2/300 w/paging > >18 short &00020000 - 32100 required > >18 short &00040000 and mau hardware required > >20 short 0443 (target shared library) > >20 short 0410 (swapped) > >20 short 0413 (paged) > >22 short >0 - version %ld > 0 short 0561 WE32000 executable (TV) > >12 long >0 not stripped > >18 short &00020000 - 32100 required > >18 short &00040000 and mau hardware required > >22 short >0 - version %ld > 0 short =0512 iAPX 286 executable small model (COFF) > >12 long >0 not stripped > >22 short >0 - version %ld > 0 short =0522 iAPX 286 executable large model (COFF) > >12 long >0 not stripped > >22 short >0 - version %ld > 0 short 0514 iAPX 386 executable (COFF) (deprecated) > >12 long >0 not stripped > >22 short >0 - version %ld > 0 short 0520 mc68k executable > >12 long >0 not stripped > 0 short 0521 mc68k executable (shared) > >12 long >0 not stripped > 0 short 0522 mc68k executable (shared demand paged) > >12 long >0 not stripped > 2 short 0410 pure > >1 byte 0 sun2 executable > >1 byte 1 mc68010 executable > >1 byte 2 mc68020 executable > >1 byte 3 SPARC executable > >0 byte >077 dynamically linked > 2 short 0407 impure > >1 byte 0 sun2 executable > >1 byte 1 mc68010 executable > >1 byte 2 mc68020 executable > >1 byte 3 SPARC executable > >0 byte >077 dynamically linked > 2 short 0413 Sun demand paged > >1 byte 0 sun2 executable > >1 byte 1 mc68010 executable > >1 byte 2 mc68020 executable > >1 byte 3 SPARC executable > >0 byte >077 dynamically linked > 0 byte 0x80 8086 relocatable (Microsoft) > 0 byte 0xf0 MS-DOS library > 0 short 0xff65 x.out > >2 string __.SYMDEF randomized > >0 byte x archive > 0 short 0x206 Microsoft a.out > >0x1e short &0x10 overlay > >0x1e short &0x2 separate > >0x1e short &0x4 pure > >0x1e short &0x800 segmented > >0x1e short &0x400 standalone > >0x1e short &0x8 fixed-stack > >0x1c byte &0x80 byte-swapped > >0x1c byte &0x40 word-swapped > >0x10 long >0 not-stripped > >0x1e short ^0xc000 pre-SysV > >0x1c byte &0x4 86 > >0x1c byte &0x9 286 > >0x1c byte &0xa 386 > >0x1e short &0x1 executable > >0x1e short ^0x1 object file > >0x1e short &0x40 Large Text > >0x1e short &0x20 Large Data > >0x1e short &0x120 Huge Objects Enabled > 0 short 0x10b VAX demand load format a.out object file > >0x10 long >0 not stripped > 0 short 0x140 old Microsoft 8086 x.out > >0x3 byte &0x4 separate > >0x3 byte &0x2 pure > >0 byte &0x1 executable > >0 byte ^0x1 relocatable > >0x14 long >0 not stripped > 0 long 0x10b VAX demand load format a.out object file > >0x10 long >0 not stripped > 0 long 0x140 old Microsoft 8086 x.out > >0x3 byte &0x4 separate > >0x3 byte &0x2 pure > >0 byte &0x1 executable > >0 byte ^0x1 relocatable > >0x14 long >0 not stripped > 0 long 0xe807 object file (z8000 a.out) > 0 long 0xe808 pure object file (z8000 a.out) > 0 long 0xe809 separate object file (z8000 a.out) > 0 long 0xe805 overlay object file (z8000 a.out) > 0 long 0x178 Bell 5.0 executable > 2 short 0410 Sun read-only text executable > >2 short 0407 Sun old executable > >1 char 3 (SPARC) > >1 char 2 (68020) > >1 char 1 (68010) > >1 char 0 (Sun2) > # The following are from SunOS 4.1 > 0 short 0143561 byte-swapped cpio archive > 0 long 0101555 PDP-11 single precision APL workspace > 0 long 0101554 PDP-11 double precision APL workspace > 0 long 0101557 VAX single precision APL workspace > 0 long 0101556 VAX double precision APL workspace > 0 short 017437 old packed data > 0 string \037\036 packed data > 0 string \377\037 compacted data > 0 string \037\235 compressed data > >2 byte&0x80 >0 block compressed > >2 byte&0x1f x %d bits > 0 string !\n__.SYMDEF archive random library > 0 long 0x1010101 MMDF mailbox > 0 string 24 string SunGKS SunGKS > # version number follows, in the form m.n > >0 string GKSM Metafile > 0 string GKSM GKS Metafile > # version number follows, in the form > 0 string %! PostScript document > # version ID follows, in the form PS-Adobe-nn > 0 string Interpress/Xerox Interpress document > # version ID follows, in the form /n.n > 0 string StartFontMetrics ASCII font metrics > 0 string StartFont ASCII font bits > 0 long 0x137A2944 NeWS bitmap font > 0 long 0x137A2947 NeWS font family > 8 long 0x137A2B45 X11/NeWS bitmap font > 8 long 0x137A2B48 X11/NeWS font family > 0 string snoop Snoop capture file > >8 long >0 - version %ld > 0 short 0436 vfont definition > 0 string 0 string 0 string 0 string .snd audio data: > >12 long 1 8-bit u-law, > >12 long 2 8-bit linear PCM, > >12 long 3 16-bit linear PCM, > >12 long 4 24-bit linear PCM, > >12 long 5 32-bit linear PCM, > >12 long 6 32-bit floating point, > >12 long 7 64-bit floating point, > >12 long 23 compressed (4-bit G.721 ADPCM), > >12 long 24 compressed (8-bit G.722 ADPCM), > >12 long 25 compressed (3-bit G.723 ADPCM), > >12 long 26 compressed (5-bit G.723 ADPCM), > >12 long 27 8-bit A-law, > >20 long 1 mono, > >20 long 2 stereo, > >20 long 4 quad, > >16 long x %d Hz > 0 short 0x1010 PEX Binary Archive > 0 long 0x59a66a95 rasterfile, > >4 long >0 %ld x > >8 long >0 %ld x > >12 long >0 %ld > >20 long 0 old format image > >20 long 1 standard format image > >20 long 2 run-length byte encoded image > >20 long 3 client defined format type 3 image > >20 long 4 client defined format type 4 image > >20 long 5 client defined format type 5 image > >20 long 0xffff experimental format image > 0 long 0x884f5053 Interleaf fast-saved document > 0 long 0x2a535441 Aster*x > >7 long 0x574f5244 Words Document > >7 long 0x47524150 Graphic > >7 long 0x53505245 Spreadsheet > >7 long 0x4d414352 Macro > 0 long 0x32323738 Aster*x Version 2 > >29 byte 0x36 Words Document > >29 byte 0x35 Graphic > >29 byte 0x32 Spreadsheet > >29 byte 0x38 Macro