# Magic file created Mon Oct 16 13:57:01 CDT 1995 by fuzzy!root tty3 Oct 16 11:20
#! file
# Magic data for file(1) command.
# Machine-genererated from src/cmd/file/magdir/*; edit there only!
# Format is described in magic(files), where:
# files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID.
# $Id: magic,v 1.1.1.1 1997/11/27 04:10:46 wuebben Exp $
# Add any locally-observed files here. Remember:
# text if readable, executable if runnable binary, data if unreadable.
#
# Alliant FX series a.out files:
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".
# If it's the i860-based one, they should probably become either the
# big-endian or little-endian versions, depending on the mode they ran
# the 860 in....
#
0 short 0420 0420 Alliant virtual executable
>2 short &0x0020 common library
>16 long >0 not stripped
0 short 0421 0421 Alliant compact executable
>2 short &0x0020 common library
>16 long >0 not stripped
#
# magic.apl:
#
0 long 0100554 APL workspace (Ken's original?)
#
# Apple II file formats
#
0 string FiLeStArTfIlEsTaRt binscii (apple ][) text
0 string \x0aGL Binary II (apple ][) data
0 string \x76\xff Squeezed (apple ][) data
0 string SIT! StuffIt (macintosh) text
0 string NuFile NuFile archive (apple ][) data
0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data
#
# "ar", for all kinds of archives.
#
# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0 string !<arch> current ar archive
# 0 long 0x213c6172 archive file
#
# and for SVR3.1 archives, we have:
#
# 0 string \<ar> System V Release 1 ar archive
# 0 string =<ar> archive
# 0 string =<ar> archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0 string !<arch> current ar archive
>8 string __.SYMDEF random library
>0 belong =65538 - pre SR9.5
>0 belong =65539 - post SR9.5
>0 beshort 2 - object archive
>0 beshort 3 - shared library module
>0 beshort 4 - debug break-pointed module
>0 beshort 5 - absolute code program module
0 string \<ar> System V Release 1 ar archive
0 string =<ar> archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
# 0 long 0x3c61723e VAX 5.0 archive
#
0 long 0x213c6172 archive file
0 lelong 0177555 very old VAX archive
0 leshort 0177555 very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0 lelong 0177545 old VAX archive
>8 string __.SYMDEF random library
0 leshort 0177545 old PDP-11 archive
>8 string __.SYMDEF random library
#
0 string =<ar> archive
#
# From "pdp":
#
0 lelong 0x39bed PDP-11 old archive
0 lelong 0x39bee PDP-11 4.0 archive
#
0 string -h- Software Tools format archive text
# "arc" archiver
0 byte 26 'arc' archive
>1 byte 0 (empty)
>1 byte 1 (old format)
# Rahul Dhesi's zoo archive format, from keith@cerberus.uchicago.edu.
20 string \xdc\xa7\xc4\xfd Rahul Dhesi's "zoo" archive
>0 string >\0 (%s)
# ZIP archiver
0 string PK zip archive file
>4 byte x - version
>4 byte 10 1.0
>4 byte 20 2.0
2 string -lh LHarc archive data
>6 byte x type %c
>20 byte x - header level %d
# From: <u31b3hs@pool.informatik.rwth-aachen.de> (Michael Haardt)
2 string -lh0- Lharc 1.x archive
2 string -lh1- Lharc 1.x archive
2 string -lz4- Lharc 1.x archive
2 string -lz5- Lharc 1.x archive
2 string -lzs- LHa 2.x? archive [lzs]
2 string -lh - LHa 2.x? archive [lh ]
2 string -lhd- LHa 2.x? archive [lhd]
2 string -lh2- LHa 2.x? archive [lh2]
2 string -lh3- LHa 2.x? archive [lh3]
2 string -lh4- LHa 2.x? archive [lh4]
2 string -lh5- LHa (2.x) archive
# ARJ archive data from jason@jarthur.Claremont.EDU
0 leshort 0xea60 ARJ archive data
>5 byte x - version %d,
>8 byte >0 flags:
>>8 byte &0x04 multi-volume,
>>8 byte &0x10 slash switched,
>>8 byte &0x20 backup,
>34 string x original name: %s,
>7 byte 0 os: MS/DOS
>7 byte 1 os: PRIMOS
>7 byte 2 os: UNIX
>7 byte 3 os: Amiga
>7 byte 4 os: Macintosh
>7 byte 5 os: OS/2
>7 byte 6 os: Apple ][ GS
>7 byte 7 os: Atari ST
>7 byte 8 os: NeXT
>7 byte 9 os: VAX/VMS
>3 byte >0 %d]
#
# "ar", for all kinds of archives.
#
# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0 string !<arch> current ar archive
# 0 long 0x213c6172 archive file
#
# and for SVR3.1 archives, we have:
#
# 0 string \<ar> System V Release 1 ar archive
# 0 string =<ar> archive
# 0 string =<ar> archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0 string !<arch> current ar archive
>8 string __.SYMDEF random library
>0 belong =65538 - pre SR9.5
>0 belong =65539 - post SR9.5
>0 beshort 2 - object archive
>0 beshort 3 - shared library module
>0 beshort 4 - debug break-pointed module
>0 beshort 5 - absolute code program module
0 string \<ar> System V Release 1 ar archive
0 string =<ar> archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
# 0 long 0x3c61723e VAX 5.0 archive
#
0 long 0x213c6172 archive file
0 lelong 0177555 very old VAX archive
0 leshort 0177555 very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0 lelong 0177545 old VAX archive
>8 string __.SYMDEF random library
0 leshort 0177545 old PDP-11 archive
>8 string __.SYMDEF random library
#
0 string =<ar> archive
#
# From "pdp":
#
0 lelong 0x39bed PDP-11 old archive
0 lelong 0x39bee PDP-11 4.0 archive
#
0 string -h- Software Tools format archive text
# "arc" archiver
0 byte 26 'arc' archive
>1 byte 0 (empty)
>1 byte 1 (old format)
# Rahul Dhesi's zoo archive format, from keith@cerberus.uchicago.edu.
20 long 0xdca7c4fd Rahul Dhesi's "zoo" archive
# ZIP archiver
0 string PK zip archive file
>4 byte x - version
>4 byte 10 1.0
>4 byte 20 2.0
2 string -lh LHarc archive data
>6 byte x type %c
>20 byte x - header level %d
# From: <u31b3hs@pool.informatik.rwth-aachen.de> (Michael Haardt)
2 string -lh0- Lharc 1.x archive
2 string -lh1- Lharc 1.x archive
2 string -lz4- Lharc 1.x archive
2 string -lz5- Lharc 1.x archive
2 string -lzs- LHa 2.x? archive [lzs]
2 string -lh - LHa 2.x? archive [lh ]
2 string -lhd- LHa 2.x? archive [lhd]
2 string -lh2- LHa 2.x? archive [lh2]
2 string -lh3- LHa 2.x? archive [lh3]
2 string -lh4- LHa 2.x? archive [lh4]
2 string -lh5- LHa (2.x) archive
# ARJ archive data from jason@jarthur.Claremont.EDU
0 leshort 0xea60 ARJ archive data
>5 byte x - version %d,
>8 byte >0 flags:
>>8 byte &0x04 multi-volume,
>>8 byte &0x10 slash switched,
>>8 byte &0x20 backup,
>34 string x original name: %s,
>7 byte 0 os: MS/DOS
>7 byte 1 os: PRIMOS
>7 byte 2 os: UNIX
>7 byte 3 os: Amiga
>7 byte 4 os: Macintosh
>7 byte 5 os: OS/2
>7 byte 6 os: Apple ][ GS
>7 byte 7 os: Atari ST
>7 byte 8 os: NeXT
>7 byte 9 os: VAX/VMS
>3 byte >0 %d]
0 byte 26 'arc' archive
>1 byte 0 (empty)
>1 byte 1 (old format)
# A collection of various "ar" and "cpio" archive formats.
# "Tar" archives are handled in the C code.
0 short 070707 cpio archive
0 string 070707 ASCII cpio archive
0 long 0177555 very old archive
0 short 0177555 very old PDP-11 archive
0 long 0177545 old archive
0 short 0177545 old PDP-11 archive
0 long 0100554 apl workspace
0 string =<ar> archive
0 string !<arch> archive
>8 string __.SYMDEF random library
0 string -h- Software Tools format archive text
# A collection of various "ar" and "cpio" archive formats.
# "Tar" archives are handled in the C code.
0 short 070707 cpio archive
0 string 070707 ASCII cpio archive
0 long 0177555 very old archive
0 short 0177555 very old PDP-11 archive
0 long 0177545 old archive
0 short 0177545 old PDP-11 archive
0 long 0100554 apl workspace
0 string =<ar> archive
0 string !<arch> archive
>8 string __.SYMDEF random library
0 string -h- Software Tools format archive text
# Rahul Dhesi's zoo archive format, from keith@cerberus.uchicago.edu.
20 long 0xdca7c4fd Rahul Dhesi's "zoo" archive
#
# AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
# 3B20
#
0 beshort 0550 3b20 COFF executable
>12 belong >0 not stripped
#>22 beshort >0 - version %ld
0 beshort 0551 3b20 COFF executable (TV)
>12 belong >0 not stripped
#>22 beshort >0 - version %ld
#
# WE32K
#
0 beshort 0560 WE32000 COFF
>18 beshort ^00000020 object
>18 beshort &00000020 executable
>12 belong >0 not stripped
>18 beshort ^00010000 N/A on 3b2/300 w/paging
>18 beshort &00020000 32100 required
>18 beshort &00040000 and mau hardware required
>20 beshort 0407 (impure)
>20 beshort 0410 (pure)
>20 beshort 0413 (demand paged)
>20 beshort 0443 (target shared library)
>22 beshort >0 - version %ld
0 beshort 0561 WE32000 COFF executable (TV)
>12 belong >0 not stripped
#>18 beshort &00020000 - 32100 required
#>18 beshort &00040000 and mau hardware required
#>22 beshort >0 - version %ld
#
# core file for 3b2
0 string \000\004\036\212\200 3b2 core file
>364 string >\0 of '%s'
#
# Sound formats, from Jan Nicolai Langfeldt <janl@ifi.uio.no>,
#
# Sun/NeXT audio data
0 string .snd audio data:
>12 belong 1 8-bit u-law,
>12 belong 2 8-bit linear PCM,
>12 belong 3 16-bit linear PCM,
>12 belong 4 24-bit linear PCM,
>12 belong 5 32-bit linear PCM,
>12 belong 6 32-bit floating point,
>12 belong 7 64-bit floating point,
>12 belong 23 compressed (G.721 ADPCM),
>20 belong 1 mono,
>20 belong 2 stereo,
>20 belong 4 quad,
>16 belong x %d Hz
# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
# (0x0064732E in little-endian encoding).
0 lelong 0x0064732E DEC audio data:
>12 lelong 1 8-bit u-law,
>12 lelong 2 8-bit linear PCM,
>12 lelong 3 16-bit linear PCM,
>12 lelong 4 24-bit linear PCM,
>12 lelong 5 32-bit linear PCM,
>12 lelong 6 32-bit floating point,
>12 lelong 7 64-bit floating point,
>12 lelong 23 compressed (G.721 ADPCM),
>20 lelong 1 mono,
>20 lelong 2 stereo,
>20 lelong 4 quad,
>16 lelong x %d Hz
# Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM"
8 string AIFF AIFF audio data
8 string AIFC AIFF-C audio data
8 string 8SVX IFF/8SVX audio data
# Creative Labs AUDIO stuff
0 string MThd Standard MIDI data
>9 byte >0 (format %d)
>11 byte >1 using %d channels
0 string CTMF Creative Music (CMF) data
0 string SBI SoundBlaster instrument data
0 string Creative\ Voice\ File Creative Labs voice data
# is this next line right? it came this way...
>19 byte 0x1A
>23 byte >0 - version %d
>22 byte >0 \b.%d
# Microsoft WAVE format
0 string RIFF Microsoft RIFF
>8 string WAVE - WAVE format
>34 short >0 %d bit
>22 short =1 Mono
>22 short =2 Stereo
>22 short >2 %d Channels
>24 long >0 %d Hz
#
# Sound formats, from Jan Nicolai Langfeldt <janl@ifi.uio.no>,
#
# Sun/NeXT audio data
0 string .snd audio data:
>12 belong 1 8-bit u-law,
>12 belong 2 8-bit linear PCM,
>12 belong 3 16-bit linear PCM,
>12 belong 4 24-bit linear PCM,
>12 belong 5 32-bit linear PCM,
>12 belong 6 32-bit floating point,
>12 belong 7 64-bit floating point,
>12 belong 23 compressed (G.721 ADPCM),
>20 belong 1 mono,
>20 belong 2 stereo,
>20 belong 4 quad,
>16 belong x %d Hz
# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
# (0x0064732E in little-endian encoding).
0 lelong 0x0064732E DEC audio data:
>12 lelong 1 8-bit u-law,
>12 lelong 2 8-bit linear PCM,
>12 lelong 3 16-bit linear PCM,
>12 lelong 4 24-bit linear PCM,
>12 lelong 5 32-bit linear PCM,
>12 lelong 6 32-bit floating point,
>12 lelong 7 64-bit floating point,
>12 lelong 23 compressed (G.721 ADPCM),
>20 lelong 1 mono,
>20 lelong 2 stereo,
>20 lelong 4 quad,
>16 lelong x %d Hz
# Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM"
8 string AIFF AIFF audio data
8 string AIFC AIFF-C audio data
8 string 8SVX IFF/8SVX audio data
# Bytes 0-3 of Waveform (*.wav) audio files are "RIFF"
8 string WAVE Waveform audio data
0 string Creative\ Voice\ File Soundblaster audio data
0 long 0x4e54524b MultiTrack sound data file
>4 long x - version %ld
# 68K Blit stuff as seen from 680x0 machine
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on
# little-endian machines as well? If so, what's the deal with
# "VAX-order" and "VAX-order2"?
#
#0 long 0407 68K Blit (standalone) executable
#0 short 0407 VAX-order2 68K Blit (standalone) executable
0 short 03401 VAX-order 68K Blit (standalone) executable
0 long 0406 68k Blit mpx/mux executable
0 short 0406 VAX-order2 68k Blit mpx/mux executable
0 short 03001 VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0 short 0520 tty630 layers executable
# BSDI BSD/386
0 long 0314 BSD/386 demand paged (first page unmapped) pure executable
# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
0 string /* c program text
0 string // c++ program text
# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
0 string /* c program text
# ChiWriter files
0 string \\1cw\ ChiWriter file
>5 string >\0 version %s
0 string \\1cw ChiWriter file
#
# Intergraph, formerly Fairchild, Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
# >18 short !074000,000000 C1 R1
# >18 short !074000,004000 C2 R1
# >18 short !074000,010000 C3 R1
# >18 short !074000,074000 TEST
#
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# >18 short&074000 000000 C1 R1
# >18 short&074000 004000 C2 R1
# >18 short&074000 010000 C3 R1
# >18 short&074000 074000 TEST
#
# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
# sort, nor does SunOS 4.x, so either it's something Intergraph added
# in CLIX, or something AT&T added in SVR3.2 or later, or something
# somebody else thought was a good idea; it's not documented in the
# man page for this version of "magic", nor does it appear to be
# implemented (at least not after I blew off the bogus code to turn
# old-style "&"s into new-style "&"s, which just didn't work at all).
#
0 short 0575 CLIPPER COFF executable (VAX #)
>20 short 0407 (impure)
>20 short 0410 (5.2 compatible)
>20 short 0411 (pure)
>20 short 0413 (demand paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
>22 short >0 - version %ld
0 short 0577 CLIPPER COFF executable
>18 short&074000 000000 C1 R1
>18 short&074000 004000 C2 R1
>18 short&074000 010000 C3 R1
>18 short&074000 074000 TEST
>20 short 0407 (impure)
>20 short 0410 (pure)
>20 short 0411 (separate I&D)
>20 short 0413 (paged)
>20 short 0443 (target shared library)
>12 long >0 not stripped
>22 short >0 - version %ld
>48 long&01 01 alignment trap enabled
>52 byte 1 -Ctnc
>52 byte 2 -Ctsw
>52 byte 3 -Ctpw
>52 byte 4 -Ctcb
>53 byte 1 -Cdnc
>53 byte 2 -Cdsw
>53 byte 3 -Cdpw
>53 byte 4 -Cdcb
>54 byte 1 -Csnc
>54 byte 2 -Cssw
>54 byte 3 -Cspw
>54 byte 4 -Cscb
4 string pipe CLIPPER instruction trace
4 string prof CLIPPER instruction profile
#
# "Commands": stuff for various shells and interpreters.
#
0 string :\ shell archive or commands for antique kernel text
0 string #!/bin/sh Bourne Shell script text
0 string #!\ /bin/sh Bourne Shell script text
0 string #!/bin/csh C Shell script text
0 string #!\ /bin/csh C Shell script text
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0 string #!/bin/ksh Korn Shell script text
0 string #!\ /bin/ksh Korn Shell script text
0 string #!/bin/tcsh Tenex C Shell script text
0 string #!\ /bin/tcsh Tenex C Shell script text
0 string #!/usr/local/tcsh Tenex C Shell script text
0 string #!\ /usr/local/tcsh Tenex C Shell script text
0 string #!/usr/local/bin/tcsh Tenex C Shell script text
0 string #!\ /usr/local/bin/tcsh Tenex C Shell script text
0 string #!/bin/awk Awk Commands text
0 string #!\ /bin/awk Awk Commands text
# For Larry Wall's perl language. The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
# Keith Waclena <keith@cerberus.uchicago.edu>
0 string #!/bin/perl perl commands text
0 string #!\ /bin/perl perl commands text
0 string eval\ "exec\ /bin/perl perl commands text
0 string #!/usr/bin/perl perl commands text
0 string #!\ /usr/bin/perl perl commands text
0 string eval\ "exec\ /usr/bin/perl perl commands text
0 string #!/usr/local/bin/perl perl commands text
0 string #!\ /usr/local/bin/perl perl commands text
0 string eval\ "exec\ /usr/local/bin/perl perl commands text
# Plan 9 rc shell
0 string #!/bin/rc Plan 9 rc Shell script text
0 string #!\ /bin/rc Plan 9 rc Shell script text
# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0 string #!/bin/bash Bourne-Again Shell script text
0 string #!\ /bin/bash Bourne-Again Shell script text
0 string #!/usr/local/bin/bash Bourne-Again Shell script text
0 string #!\ /usr/local/bin/bash Bourne-Again Shell script text
# general script detection
0 string #!\ / a
>3 string >\0 %s script text
0 string #!/ a
>2 string >\0 %s script text
0 string #!\ commands text
>3 string >\0 for %s
#
# "Commands": stuff for various shells and interpreters.
#
0 string :\ shell archive or commands for antique kernel text
0 string #!/bin/sh Bourne Shell script text
0 string #!\ /bin/sh Bourne Shell script text
0 string #!/bin/csh C Shell script text
0 string #!\ /bin/csh C Shell script text
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0 string #!/bin/ksh Korn Shell script text
0 string #!\ /bin/ksh Korn Shell script text
0 string #!/bin/tcsh Tenex C Shell script text
0 string #!\ /bin/tcsh Tenex C Shell script text
0 string #!/usr/local/tcsh Tenex C Shell script text
0 string #!\ /usr/local/tcsh Tenex C Shell script text
0 string #!/usr/local/bin/tcsh Tenex C Shell script text
0 string #!\ /usr/local/bin/tcsh Tenex C Shell script text
0 string #!/bin/awk Awk Commands text
0 string #!\ /bin/awk Awk Commands text
0 string #!\ / a
>3 string >\0 %s script text
0 string #!/ a
>2 string >\0 %s script text
0 string #!\ commands text
>3 string >\0 for %s
# For Larry Wall's perl language. The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
# Keith Waclena <keith@cerberus.uchicago.edu>
0 string #!/bin/perl perl commands text
0 string #!\ /bin/perl perl commands text
0 string eval\ "exec\ /bin/perl perl commands text
0 string #!/usr/bin/perl perl commands text
0 string #!\ /usr/bin/perl perl commands text
0 string eval\ "exec\ /usr/bin/perl perl commands text
0 string #!/usr/local/bin/perl perl commands text
0 string #!\ /usr/local/bin/perl perl commands text
0 string eval\ "exec\ /usr/local/bin/perl perl commands text
0 string #!/bin/rc Plan 9 rc Shell script text
0 string #!\ /bin/rc Plan 9 rc Shell script text
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.
# According to gzip.h, this is the correct byte order for packed data.
#
0 string \037\036 packed data
#
# This magic number is byte-order-independent.
#
0 short 017437 old packed data
#
# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0 short 0x1fff compacted data
0 string \377\037 compacted data
0 short 0145405 huf output
#
# Squeeze and Crunch...
# These numbers were gleaned from the Unix versions of the programs to
# handle these formats. Note that I can only uncrunch, not crunch, and
# I didn't have a crunched file handy, so the crunch number is untested.
# Keith Waclena <keith@cerberus.uchicago.edu>
0 leshort 0x76FF squeezed data (CP/M, DOS)
0 leshort 0x76FE crunched data (CP/M, DOS)
# Freeze
0 string \037\237 Frozen file 2.1
0 string \037\236 Frozen file 1.0 (or gzip 0.5)
#
# Standard unix compress
#
0 string \037\235 compressed data
>2 byte&0x80 >0 block compressed
>2 byte&0x1f x %d bits
0 string \037\240 LZH compressed data
#
# XXX - what byte order does a Convex use?
#
0 long 0513 Convex executable
#
# Yes, the two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats, and thus are strings not numbers.
#
0 short 070707 cpio archive
0 short 0143561 byte-swapped cpio archive
0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
0 string 070701 ASCII cpio archive (SVR4 with no CRC)
0 string 070702 ASCII cpio archive (SVR4 with CRC)
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
# XXX - I think it was either renamed Slate, or replaced by Slate....
#
# The full deal is too long...
#0 string <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
0 string =<list>\n<protocol\ bbn-m Diamond Multimedia Document
#
# magic file lines for output from "diff"...
0 string diff\ 'diff' output text
0 string ***\ 'diff' output text
0 string Only\ in\ 'diff' output text
0 string Common\ subdirectories:\ 'diff' output text
# Magic numbers for ditroff intermediate language
0 string x\ T\ cat titroff output for the C/A/T text
0 string x\ T\ ps titroff output for PostScript
0 string x\ T titroff output text
#
# magic.dump, dump file format. For new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
24 belong 60012 new-fs dump file (big endian),
>4 bedate x Previous dump %s,
>8 bedate x This dump %s,
>12 belong >0 Volume %ld,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
>0 belong 2 beginning of file record,
>0 belong 3 map of inodes on tape,
>0 belong 4 continuation of file record,
>0 belong 5 end of volume,
>0 belong 6 map of inodes deleted,
>0 belong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 belong >0 Flags %x
24 belong 60011 old-fs dump file (big endian),
#>4 bedate x Previous dump %s,
#>8 bedate x This dump %s,
>12 belong >0 Volume %ld,
>692 belong 0 Level zero, type:
>692 belong >0 Level %d, type:
>0 belong 1 tape header,
>0 belong 2 beginning of file record,
>0 belong 3 map of inodes on tape,
>0 belong 4 continuation of file record,
>0 belong 5 end of volume,
>0 belong 6 map of inodes deleted,
>0 belong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 belong >0 Flags %x
24 lelong 60012 new-fs dump file (little endian),
>4 ledate x Previous dump %s,
>8 ledate x This dump %s,
>12 lelong >0 Volume %ld,
>692 lelong 0 Level zero, type:
>692 lelong >0 Level %d, type:
>0 lelong 1 tape header,
>0 lelong 2 beginning of file record,
>0 lelong 3 map of inodes on tape,
>0 lelong 4 continuation of file record,
>0 lelong 5 end of volume,
>0 lelong 6 map of inodes deleted,
>0 lelong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 lelong >0 Flags %x
24 lelong 60011 old-fs dump file (little endian),
#>4 ledate x Previous dump %s,
#>8 ledate x This dump %s,
>12 lelong >0 Volume %ld,
>692 lelong 0 Level zero, type:
>692 lelong >0 Level %d, type:
>0 lelong 1 tape header,
>0 lelong 2 beginning of file record,
>0 lelong 3 map of inodes on tape,
>0 lelong 4 continuation of file record,
>0 lelong 5 end of volume,
>0 lelong 6 map of inodes deleted,
>0 lelong 7 end of medium (for floppy),
>676 string >\0 Label %s,
>696 string >\0 Filesystem %s,
>760 string >\0 Device %s,
>824 string >\0 Host %s,
>888 lelong >0 Flags %x
#
# ELF
# Missing MIPS image type and flags
#
# Question marks on processor types flag "should not happen because the
# byte order is wrong". We have to check the byte order flag to see what
# byte order all the other stuff in the header is in.
#
0 string \177ELF ELF
>4 byte 0 invalid class
>4 byte 1 32-bit
>4 byte 2 64-bit
>5 byte 0 invalid byte order
>5 byte 1 LSB
>>16 leshort 0 unknown type
>>16 leshort 1 relocatable
>>16 leshort 2 executable
>>16 leshort 3 dynamic lib
>>16 leshort 4 core file
>>18 leshort 0 unknown machine
>>18 leshort 1 WE32100 and up
>>18 leshort 2 SPARC?
>>18 leshort 3 i386 (386 and up)
>>18 leshort 4 M68000?
>>18 leshort 5 M88000?
>>18 leshort 7 i860
>>20 lelong 1 Version 1
>>36 lelong 1 MathCoPro/FPU/MAU Required
>5 byte 2 MSB
>>16 beshort 0 unknown type
>>16 beshort 1 relocatable
>>16 beshort 2 executable
>>16 beshort 3 dynamic lib
>>16 beshort 4 core file
>>18 beshort 0 unknown machine
>>18 beshort 1 WE32100 and up
>>18 beshort 2 SPARC
>>18 beshort 3 i386 (386 and up)?
>>18 beshort 4 M68000
>>18 beshort 5 M88000
>>18 beshort 7 i860
>>20 belong 1 Version 1
>>36 belong 1 MathCoPro/FPU/MAU Required
#
# magic.encore: Recognize encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
#
0 short 0x154 Encore
>20 short 0x107 executable
>20 short 0x108 pure executable
>20 short 0x10b demand-paged executable
>20 short 0x10f unsupported executable
>12 long >0 not stripped
>22 short >0 - version %ld
>22 short 0 -
#>4 date x stamp %s
0 short 0x155 Encore unsupported executable
>12 long >0 not stripped
>22 short >0 - version %ld
>22 short 0 -
#>4 date x stamp %s
0 string \366\366\366\366 Formatted floppy w/ no filesystem data
0 string FONT ASCII vfont text
0 short 0436 Berkeley vfont data
0 short 017001 byte-swapped Berkeley vfont data
# PostScript fonts (must precede PostScript entry), quinlan@yggdrasil.com
0 string %!PS-AdobeFont-1.0 PostScript Type 1 font text
>20 string >\0 (%s)
6 string %!PS-AdobeFont-1.0 PostScript Type 1 font program data
0 string FONT ASCII vfont text
0 short 0436 Berkeley vfont data
0 short 017001 byte-swapped Berkeley vfont data
#
# Magic number for FrameMaker files
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0 string \<MakerFile FrameMaker document
>11 string 3.0 (3.0
>11 string 2.0 (2.0
>11 string 1.0 (1.0
>14 byte x %c)
0 string \<MIFFile FrameMaker MIF file
>9 string 3.0 (3.0)
>9 string 2.0 (2.0)
>9 string 1.0 (1.x)
0 string \<MakerDictionary FraneMaker Dictionary text
>17 string 3.0 (3.0)
>17 string 2.0 (2.0)
>17 string 1.0 (1.x)
0 string \<MakerScreenFon FrameMaker Font file
>17 string 1.01 (%s)
0 string \<MML FrameMaker MML file
0 string \<Book FrameMaker Book file
>10 string 3.0 (3.0
>10 string 2.0 (2.0
>10 string 1.0 (1.0
>13 byte x %c)
0 string \<Maker Intermediate Print File FrameMaker IPL file
0 string \<MakerDictionary FraneMaker Dictionary text
# the following are for 386BSD/FreeBSD
0 lelong 0410 pure executable
0 lelong 0413 demand paged executable
0 lelong&077777777 041400314 FreeBSD/i386 demand paged
>3 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>3 byte ^0x80 executable
>16 lelong >0 not stripped
# This covers object files, and is better than "PDP-11 executable"
0 lelong 000000407 impure format
>16 lelong >0 not stripped
0 string \037\213 gzip compressed data
>2 byte <8 - reserved method
>2 byte 8 - deflate method
>3 byte &0x01 , ascii
>3 byte &0x02 , continuation
>3 byte &0x04 , extra field
>3 byte &0x08 , original file name
>3 byte &0x10 , comment
>3 byte &0x20 , encrypted
>4 ledate x , last modified: %s
>8 byte 2 , max compression
>8 byte 4 , max speed
>9 byte =0x00 os: MS/DOS
>9 byte =0x01 os: Amiga
>9 byte =0x02 os: VMS
>9 byte =0x03 os: Unix
>9 byte =0x05 os: Atari
>9 byte =0x06 os: OS/2
>9 byte =0x07 os: MacOS
>9 byte =0x0A os: Tops/20
>9 byte =0x0B os: Win/32
#
# magic.hp: Hewlett Packard Magic
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
# big-endian as it was mostly 68K-based.
#
# HP-PA is big-endian, so it (and "800", which is *also* HP-PA-based; I
# assume "HPPA-RISC1.1" really means "HP-PA Version 1.1", which first
# showed up in the 700 series, although later 800 series machines are,
# I think, based on the PA7100 which implements HP-PA 1.1) are flagged
# as big-endian.
#
# I think the 500 series was the old stack-based machines, running a
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# I'm guessing that the 200 series was 68K-based; the 300 and 400 series
# are.
#
# The "misc" stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0 beshort 0627 Apollo m68k COFF executable
>18 beshort ^040000 not stripped
>22 beshort >0 - version %ld
0 beshort 0624 apollo a88k COFF executable
>18 beshort ^040000 not stripped
>22 beshort >0 - version %ld
0 long 01203604016 TML 0123 byte-order format
0 long 01702407010 TML 1032 byte-order format
0 long 01003405017 TML 2301 byte-order format
0 long 01602007412 TML 3210 byte-order format
#### HPPA
0 belong 0x02100106 HPPA-RISC1.1 relocatable object
0 belong 0x02100107 HPPA-RISC1.1 executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
0 belong 0x02100108 HPPA-RISC1.1 shared executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
0 belong 0x0210010b HPPA-RISC1.1 demand-load executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
0 belong 0x0210010e HPPA-RISC1.1 shared library
>96 belong >0 -not stripped
0 belong 0x0210010d HPPA-RISC1.1 dynamic load library
>96 belong >0 -not stripped
#### 800
0 belong 0x020b0106 HP s800 relocatable object
0 belong 0x020b0107 HP s800 executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
0 belong 0x020b0108 HP s800 shared executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
0 belong 0x020b010b HP s800 demand-load executable
>(144) belong 0x054ef630 dynamically linked
>96 belong >0 -not stripped
0 belong 0x020b010e HP s800 shared library
>96 belong >0 -not stripped
0 belong 0x020b010d HP s800 dynamic load library
>96 belong >0 -not stripped
0 belong 0x213c6172 archive file
>68 belong 0x020b0619 -HP s800 relocatable library
#### 500
0 long 0x02080106 HP s500 relocatable executable
>16 long >0 -version %ld
0 long 0x02080107 HP s500 executable
>16 long >0 -version %ld
0 long 0x02080108 HP s500 pure executable
>16 long >0 -version %ld
#### 200
0 belong 0x020c0108 HP s200 pure executable
>4 beshort >0 -version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c0107 HP s200 executable
>4 beshort >0 -version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c010b HP s200 demand-load executable
>4 beshort >0 -version %ld
>8 belong &0x80000000 save fp regs
>8 belong &0x40000000 dynamically linked
>8 belong &0x20000000 debuggable
>36 belong >0 not stripped
0 belong 0x020c0106 HP s200 relocatable executable
>4 beshort >0 -version %ld
>6 beshort >0 -highwater %d
>8 belong &0x80000000 save fp regs
>8 belong &0x20000000 debuggable
>8 belong &0x10000000 PIC
0 belong 0x020a0108 HP s200 (2.x release) pure executable
>4 beshort >0 -version %ld
>36 belong >0 not stripped
0 belong 0x020a0107 HP s200 (2.x release) executable
>4 beshort >0 -version %ld
>36 belong >0 not stripped
0 belong 0x020c010e HP s200 shared library
>4 beshort >0 -version %ld
>6 beshort >0 -highwater %d
>36 belong >0 not stripped
0 belong 0x020c010d HP s200 dynamic load library
>4 beshort >0 -version %ld
>6 beshort >0 -highwater %d
>36 belong >0 not stripped
#### MISC
0 long 0x0000ff65 HP old archive
0 long 0x020aff65 HP s200 old archive
0 long 0x020cff65 HP s200 old archive
0 long 0x0208ff65 HP s500 old archive
0 long 0x015821a6 HP core file
0 long 0x4da7eee8 HP-WINDOWS font
>8 byte >0 -version %ld
0 string Bitmapfile HP Bitmapfile
0 string IMGfile CIS compimg HP Bitmapfile
0 short 0x8000 lif file
0 long 0x020c010c compiled Lisp
0 string msgcat01 HP NLS message catalog,
>8 long >0 %d messages
# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
0 string HPHP48- HP48 binary
>7 byte >0 - Rev %c
>8 short 0x1129 (ADR)
>8 short 0x3329 (REAL)
>8 short 0x5529 (LREAL)
>8 short 0x7729 (COMPLX)
>8 short 0x9d29 (LCOMPLX)
>8 short 0xbf29 (CHAR)
>8 short 0xe829 (ARRAY)
>8 short 0x0a2a (LNKARRAY)
>8 short 0x2c2a (STRING)
>8 short 0x4e2a (HXS)
>8 short 0x742a (LIST)
>8 short 0x962a (DIR)
>8 short 0xb82a (ALG)
>8 short 0xda2a (UNIT)
>8 short 0xfc2a (TAGGED)
>8 short 0x1e2b (GROB)
>8 short 0x402b (LIB)
>8 short 0x622b (BACKUP)
>8 short 0x882b (LIBDATA)
>8 short 0x9d2d (PROG)
>8 short 0xcc2d (CODE)
>8 short 0x482e (GNAME)
>8 short 0x6d2e (LNAME)
>8 short 0x922e (XLIB)
0 string %%HP: HP48 text
>6 string T(0) - T(0)
>6 string T(1) - T(1)
>6 string T(2) - T(2)
>6 string T(3) - T(3)
>10 string A(D) A(D)
>10 string A(R) A(R)
>10 string A(G) A(G)
>14 string F(.) F(.);
>14 string F(,) F(,);
#
# HTML magic, from Daniel Quinlan <quinlan@yggdrasil.com>
#
0 string \<HEAD\> HTML document text
0 string \<head\> HTML document text
0 string \<TITLE\> HTML document text
0 string \<title\> HTML document text
0 string \<h1\> Untitled HTML document text
0 string \<H1\> Untitled HTML document text
#
# IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
#
0 beshort 0531 SVR2 executable (Amdahl-UTS)
>12 belong >0 not stripped
>24 belong >0 - version %ld
0 beshort 0534 SVR2 pure executable (Amdahl-UTS)
>12 belong >0 not stripped
>24 belong >0 - version %ld
0 beshort 0530 SVR2 pure executable (USS/370)
>12 belong >0 not stripped
>24 belong >0 - version %ld
0 beshort 0535 SVR2 executable (USS/370)
>12 belong >0 not stripped
>24 belong >0 - version %ld
#
# magic.rs6000:
#
# RS/6000 and the RT PC.
#
0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module
>12 belong >0 not stripped
# Breaks sun4 statically linked execs.
#0 beshort 0x0103 executable (RT Version 2) or obj module
#>2 byte 0x50 pure
#>28 belong >0 not stripped
#>6 beshort >0 - version %ld
0 beshort 0x0104 shared library
0 beshort 0x0105 ctab data
0 beshort 0xfe04 structured file
0 string 0xabcdef message catalog
#0 string <aiaff> archive
# image file format
# From Robert Potter, potter@cs.rochester.edu
0 string Imagefile\ version- iff image data
# this adds the whole header (inc. version number), informative but longish
>10 string >\0 %s
# Tell file about magic for IMAGEN printer-ready files:
0 string @document( Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10 string language\ impress (imPRESS data)
>10 string language\ daisy (daisywheel text)
>10 string language\ diablo (daisywheel text)
>10 string language\ printer (line printer emulation)
>10 string language\ tektronix (Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
#
# Now magic for IMAGEN font files...
0 string Rast RST-format raster font data
>45 string >0 face %
# image formats, originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# XXX - byte order for GIF and TIFF fields?
#
0 string xbtoa btoa'd file
# PBMPLUS
0 string P1 PBM file
0 string P2 PGM file
0 string P3 PPM file
0 string P4 PBM "rawbits" file
0 string P5 PGM "rawbits" file
0 string P6 PPM "rawbits" file
# TIFF and friends
0 string \115\115 TIFF file, big-endian
>2 short >0 version %d
0 string \111\111 TIFF file, little-endian
>2 short >0 version %d
#
# NIFF (Navy Interchange File Format, a modification of TIFF)
0 string IIN1 NIFF raster data
# GIF
0 string GIF GIF picture
>3 string 87a - version %s
>3 string 89a - version %s
>6 leshort >0 %hd x
>8 leshort >0 %hd,
>10 byte &0x40 interlaced,
>10 byte&0x07 =0x00 2 colors
>10 byte&0x07 =0x01 4 colors
>10 byte&0x07 =0x02 8 colors
>10 byte&0x07 =0x03 16 colors
>10 byte&0x07 =0x04 32 colors
>10 byte&0x07 =0x05 64 colors
>10 byte&0x07 =0x06 128 colors
>10 byte&0x07 =0x07 256 colors
# Miscellany
0 long 1123028772 Artisan image file
>4 long 1 rectangular 24-bit image
>4 long 2 rectangular 8-bit image with colormap
>4 long 3 rectangular 32-bit image (24-bit with matte)
0 string \361\0\100\273 CMU window manager bitmap
0 string #FIG FIG graphics savefile text
>6 string 2.1 Version 2.1
>6 string 2.0 Version 2.0
0 string GKSM GKS Metafile
8 string ILBM IFF ILBM file
6 string JFIF JPEG picture
0 string ARF_BEGARF PHIGS clear text archive
# From: <u31b3hs@pool.informatik.rwth-aachen.de> (Michael Haardt)
0 string yz MGR bitmap, modern format, 8 bit aligned
0 string zz MGR bitmap, old format, 1 bit deep, 16 bit aligned
0 string xz MGR bitmap, old format, 1 bit deep, 32 bit aligned
0 string yx MGR bitmap, modern format, squeezed
0 string %bitmap FBM pixmap
>30 long 0x31 (mono)
>30 long 0x33 (color)
4 string Research, Digifax-G3-File
>29 byte 1 , fine resolution
>29 byte 0 , normal resolution
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# is in "microsoft"). DOS is in "ms-dos"; the ambitious soul can do
# Windows as well.
#
# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
# whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere
# as well, if, as, and when IBM makes it portable.
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0 leshort 0502 basic-16 executable
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
0 leshort 0503 basic-16 executable (TV)
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
0 leshort 0510 x86 executable
>12 lelong >0 not stripped
0 leshort 0511 x86 executable (TV)
>12 lelong >0 not stripped
0 leshort =0512 iAPX 286 executable small model (COFF)
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
0 leshort =0522 iAPX 286 executable large model (COFF)
>12 lelong >0 not stripped
#>22 leshort >0 - version %ld
0 leshort =0514 80386 COFF executable
>12 lelong >0 not stripped
>22 leshort >0 - version %ld
#
# magic for InterLeaf TPS:
0 string =\210OPS Interleaf saved data
0 string =<!OPS Interleaf document text
>5 string ,\ Version\ (version
>>14 string >\0 %s)
#
# magic.iris: Magic for mips from an iris4d
#
# Dunno what byte-order munging is needed; all of SGI's *current*
# machines and OSes run in big-endian mode on the MIPS machines,
# as far as I know, but they do have the MIPSEB and MIPSEL stuff
# here....
#
0 short 0x0160 mipseb
>20 short 0407 executable
>20 short 0410 pure
>20 short 0413 demand paged
>8 long >0 not stripped
>8 long 0 stripped
>22 byte >0 - version %ld.
>23 byte >0 %ld
0 short 0x0162 mipsel
>20 short 0407 executable
>20 short 0410 pure
>20 short 0413 demand paged
>8 long >0 not stripped
>8 long 0 stripped
>23 byte >0 - version %ld.
>22 byte >0 %ld
0 short 0x6001 swapped mipseb
>20 short 03401 executable
>20 short 04001 pure
>20 short 05401 demand paged
>8 long >0 not stripped
>8 long 0 stripped
>22 byte >0 - version %ld.
>23 byte >0 %ld
0 short 0x6201 swapped mipsel
>20 short 03401 executable
>20 short 04001 pure
>20 short 05401 demand paged
>8 long >0 not stripped
>8 long 0 stripped
>22 byte >0 - version %ld.
>23 byte >0 %ld
0 short 0x180 mipseb ucode
0 short 0x182 mipsel ucode
#
# IRIX core format version 1 (from /usr/include/core.out.h)
0 long 0xdeadadb0 IRIX core dump
>4 long 1 of
>16 string >\0 '%s'
#
# Archives - This handles archive subtypes
#
0 string !<arch>\n__________E MIPS archive
>20 string U with mipsucode members
>21 string L with mipsel members
>21 string B with mipseb members
>19 string L and a EL hash table
>19 string B and a EB hash table
>22 string X -- out of date
#
# magic.ispell
#
# XXX - byte order?
#
0 short 0xffff9601 ispell hash file
>2 short 0x00 - 8-bit, no capitalization, 26 flags
>2 short 0x01 - 7-bit, no capitalization, 26 flags
>2 short 0x02 - 8-bit, capitalization, 26 flags
>2 short 0x03 - 7-bit, capitalization, 26 flags
>2 short 0x04 - 8-bit, no capitalization, 52 flags
>2 short 0x05 - 7-bit, no capitalization, 52 flags
>2 short 0x06 - 8-bit, capitalization, 52 flags
>2 short 0x07 - 7-bit, capitalization, 52 flags
>2 short 0x08 - 8-bit, no capitalization, 128 flags
>2 short 0x09 - 7-bit, no capitalization, 128 flags
>2 short 0x0A - 8-bit, capitalization, 128 flags
>2 short 0x0B - 7-bit, capitalization, 128 flags
>2 short 0x0C - 8-bit, no capitalization, 256 flags
>2 short 0x0D - 7-bit, no capitalization, 256 flags
>2 short 0x0E - 8-bit, capitalization, 256 flags
>2 short 0x0F - 7-bit, capitalization, 256 flags
>4 short >0 and %d string characters
# derived empirically, your offsets may vary!
53 string yyprevious c program text (from lex)
>3 string >\0 for %s
# c program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
21 string generated\ by\ flex c program text (from flex)
# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
0 string %{ lex description text
# derived empirically, your offsets may vary!
53 string yyprevious c program text (from lex)
>3 string >\0 for %s
#
# magic.lif:
#
# XXX - byte order?
#
0 short 0x8000 lif file
#
# magic.linux
#
# Values for Linux/i386 binaries, from Rik Faith <faith@cs.unc.edu>,
# Peter Tobias <tobias@server.et-inf.fho-emden.de>, and Daniel Quinlan
# <quinlan@yggdrasil.com>
2 leshort 100 Linux/i386
>0 leshort 0407 executable or impure executable (OMAGIC)
>0 leshort 0410 pure executable (NMAGIC)
>0 leshort 0413 demand-paged executable (ZMAGIC)
>0 leshort 0314 demand-paged executable (QMAGIC)
>16 lelong >0 not stripped
>0 string Jump jump
0 leshort 0407 object file or impure executable (OMAGIC)
>20 long >0x1020 DLL library
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0 string *nazgul* compiled message catalog
>8 long >0 - version %ld
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
216 lelong 0421 core file (Linux)
>220 string >\0 - core dump of '%s'
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
# this can be overrided by the DOS executable (COM) entry
2 string LILO LILO boot/chain loader
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
0 string 0.9
>8 byte 0x0a Debian Binary Package -
>>3 byte >0 created by dpkg 0.9%c
>>4 byte >0 pl%c
#
# PSF fonts, from Daniel Quinlan <quinlan@yggdrasil.com>
0 leshort 0x0436 PSF font data
#
# magic.linux
#
# Values for Linux/i386 binaries, from Rik Faith <faith@cs.unc.edu>,
# Peter Tobias <tobias@server.et-inf.fho-emden.de>, and Daniel Quinlan
# <quinlan@yggdrasil.com>
2 leshort 100 Linux/i386
>0 leshort 0410 pure executable (NMAGIC)
>0 leshort 0413 demand-paged executable (ZMAGIC)
>0 leshort 0314 demand-paged executable (QMAGIC)
>16 lelong >0 not stripped
>0 string Jump jump
0 leshort 0407 object file or impure executable (OMAGIC)
>20 long >0x1020 DLL library
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0 string *nazgul* compiled message catalog
>8 long >0 - version %ld
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
216 lelong 0421 core file (Linux)
>220 string >\0 - core dump of '%s'
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
# this can be overrided by the DOS executable (COM) entry
2 string LILO LILO boot/chain loader
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
0 string 0.9
>8 byte 0x0a Debian Binary Package -
>>3 byte >0 created by dpkg 0.9%c
>>4 byte >0 pl%c
#
# PSF fonts, from Daniel Quinlan <quinlan@yggdrasil.com>
0 leshort 0x0436 PSF font data
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string ;; Lisp/Scheme program text
# Emacs 18 - this is always correct, but not very magical.
0 string \012( byte-compiled Emacs-Lisp program data
# Emacs 19
0 string ;ELC\023\000\000\000 byte-compiled Emacs-Lisp program data
0 string #\ Magic magic text file for file(1) cmd
# Unfortunately, saved netnews also has From line added in some news software.
#0 string From mail text
# There are tests to ascmagic.c to cope with mail and news.
0 string Relay-Version: old news text
0 string #!\ rnews batched news text
0 string N#!\ rnews mailed, batched news text
0 string Forward\ to mail forwarding text
0 string Pipe\ to mail piping text
0 string Return-Path: smtp mail text
0 string Path: news text
0 string Xref: news text
0 string From: news or mail text
0 string Article saved news text
#
# Microsoft (Xenix, not DOS)
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
# model" lifted from "magic.xenix", with comment "derived empirically;
# treat as folklore until proven"
#
# "small model", "large model", "huge model" stuff lifted from XXX
#
# XXX - "x.out" collides with PDP-11 archives....
#
0 string core core file (Xenix)
0 byte 0x80 8086 relocatable (Microsoft)
0 leshort 0xff65 x.out
>2 string __.SYMDEF randomized
>0 byte x archive
0 leshort 0x206 Microsoft a.out
>8 leshort 1 Middle model
>0x1e leshort &0x10 overlay
>0x1e leshort &0x2 separate
>0x1e leshort &0x4 pure
>0x1e leshort &0x800 segmented
>0x1e leshort &0x400 standalone
>0x1e leshort &0x8 fixed-stack
>0x1c byte &0x80 byte-swapped
>0x1c byte &0x40 word-swapped
>0x10 lelong >0 not-stripped
>0x1e leshort ^0xc000 pre-SysV
>0x1c byte &0x4 86
>0x1c byte &0x9 286
>0x1c byte &0xa 386
>0x1f byte <0x040 small model
>0x1f byte =0x048 large model
>0x1f byte =0x049 huge model
>0x1e leshort &0x1 executable
>0x1e leshort ^0x1 object file
>0x1e leshort &0x40 Large Text
>0x1e leshort &0x20 Large Data
>0x1e leshort &0x120 Huge Objects Enabled
>0x10 lelong >0 not stripped
0 leshort 0x140 old Microsoft 8086 x.out
>0x3 byte &0x4 separate
>0x3 byte &0x2 pure
>0 byte &0x1 executable
>0 byte ^0x1 relocatable
>0x14 lelong >0 not stripped
0 lelong 0x206 b.out
>0x1e leshort &0x10 overlay
>0x1e leshort &0x2 separate
>0x1e leshort &0x4 pure
>0x1e leshort &0x800 segmented
>0x1e leshort &0x400 standalone
>0x1e leshort &0x1 executable
>0x1e leshort ^0x1 object file
>0x1e leshort &0x4000 V2.3
>0x1e leshort &0x8000 V3.0
>0x1c byte &0x4 86
>0x1c byte &0xb 186
>0x1c byte &0x9 286
>0x1c byte &0x29 286
>0x1c byte &0xa 386
>0x1e leshort &0x4 Large Text
>0x1e leshort &0x2 Large Data
>0x1e leshort &0x102 Huge Objects Enabled
0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
#
# RISC MIPS decstation
# Should this be "leshort", given that DEC ran the DECstations in
# little-endian mode?
#
# Where is the non-SGI, non-DEC MIPS stuff?
#
0 short 0x6201 MIPS executable
#
# XXX - byte order?
#
0 long 31415 Mirage Assembler m.out executable
#
# ID is the binary tags database produced by mkid(1).
#
# XXX - byte order?
#
0 string \311\304 ID tags data
>2 short >0 version %d
0 string \001\001\001\001 MMDF mailbox
#
# Motorola
#
# 68K
#
0 beshort 0520 mc68k COFF
>18 beshort ^00000020 object
>18 beshort &00000020 executable
>12 belong >0 not stripped
>168 string .lowmem Apple toolbox
>20 beshort 0407 (impure)
>20 beshort 0410 (pure)
>20 beshort 0413 (demand paged)
>20 beshort 0421 (standalone)
0 beshort 0521 mc68k executable (shared)
>12 belong >0 not stripped
0 beshort 0522 mc68k executable (shared demand paged)
>12 belong >0 not stripped
#
# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
#
0 beshort 0554 68K BCS executable
#
# 88K
#
# Motorola/88Open BCS
#
0 beshort 0555 88K BCS executable
#
# Various MS-DOS magic numbers
#
0 string MZ DOS executable (EXE)
0 string LZ DOS executable (built-in)
0 byte 0xe9 DOS executable (COM)
0 byte 0xeb DOS executable (COM)
0 byte 0xf0 MS-DOS program library
#
# magic.tower:
#
# NCR Tower objects, contributed by
# Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa
# uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP
#
0 beshort 000610 Tower/XP rel 2 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
>22 beshort >0 - version %ld
0 beshort 000615 Tower/XP rel 2 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
>22 beshort >0 - version %ld
0 beshort 000620 Tower/XP rel 3 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
>22 beshort >0 - version %ld
0 beshort 000625 Tower/XP rel 3 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
>22 beshort >0 - version %ld
0 beshort 000630 Tower32/600/400 68020 object
>12 belong >0 not stripped
>20 beshort 0407 executable
>20 beshort 0410 pure executable
>22 beshort >0 - version %ld
0 beshort 000640 Tower32/800 68020
>18 beshort &020000 w/68881 object
>18 beshort &040000 compatible object
>18 beshort &~060000 object
>20 beshort 0407 executable
>20 beshort 0413 pure executable
>12 belong >0 not stripped
>22 beshort >0 - version %ld
0 beshort 000645 Tower32/800 68010
>18 beshort &040000 compatible object
>18 beshort &~060000 object
>20 beshort 0407 executable
>20 beshort 0413 pure executable
>12 belong >0 not stripped
>22 beshort >0 - version %ld
#
# All new-style magic numbers are in network byte order.
#
0 lelong 000000413 386BSD demand paged executable
>16 lelong >0 not stripped
0 lelong 000000314 BSDI demand paged executable
>16 lelong >0 not stripped
0 lelong 000000407 NetBSD little-endian object file
>16 lelong >0 not stripped
0 belong 000000407 NetBSD big-endian object file
>16 belong >0 not stripped
0 belong&0377777777 041400413 NetBSD/i386 demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 041400410 NetBSD/i386 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 041400407 NetBSD/i386
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
0 belong&0377777777 041600413 NetBSD/m68k demand paged
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 041600410 NetBSD/m68k pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 041600407 NetBSD/m68k
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
0 belong&0377777777 042000413 NetBSD/m68k4k demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 042000410 NetBSD/m68k4k pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 042000407 NetBSD/m68k4k
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
0 belong&0377777777 042200413 NetBSD/ns32532 demand paged
>0 byte &0x80
>>20 lelong <4096 shared library
>>20 lelong =4096 dynamically linked executable
>>20 lelong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 042200410 NetBSD/ns32532 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 lelong >0 not stripped
0 belong&0377777777 042200407 NetBSD/ns32532
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>20 lelong !0 executable
>>20 lelong =0 object file
>16 lelong >0 not stripped
0 belong&0377777777 042400413 NetBSD/sparc demand paged
>0 byte &0x80
>>20 belong <8192 shared library
>>20 belong =8192 dynamically linked executable
>>20 belong >8192 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 042400410 NetBSD/sparc pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&0377777777 042400407 NetBSD/sparc
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80
>>20 belong !0 executable
>>20 belong =0 object file
>16 belong >0 not stripped
0 belong&0377777777 041400507 NetBSD/i386 core
>12 string >\0 from '%s'
0 belong&0377777777 041600507 NetBSD/m68k core
>12 string >\0 from '%s'
0 belong&0377777777 042000507 NetBSD/m68k4k core
>12 string >\0 from '%s'
0 belong&0377777777 042200507 NetBSD/ns32532 core
>12 string >\0 from '%s'
0 belong&0377777777 042400507 NetBSD/sparc core
>12 string >\0 from '%s'
# NeWS, not "news" as in "netnews"
0 string StartFontMetrics ASCII font metrics
0 string StartFont ASCII font bits
0 long 0x137A2944 NeWS bitmap font
0 long 0x137A2947 NeWS font family
#
# XXX - byte order?
#
0 short 0x2a17 "compact bitmap" format (Poskanzer)
#
# magic.pdp: PDP-11 executable/object and APL workspace
#
0 lelong 0101555 PDP-11 single precision APL workspace
0 lelong 0101554 PDP-11 double precision APL workspace
#
# PDP-11 a.out
#
0 leshort 0407 PDP-11 executable
>8 leshort >0 not stripped
0 leshort 0401 PDP-11 UNIX/RT ldp
0 leshort 0405 PDP-11 old overlay
0 leshort 0410 PDP-11 pure executable
>8 leshort >0 not stripped
0 leshort 0411 PDP-11 separate I&D executable
>8 leshort >0 not stripped
0 leshort 0437 PDP-11 kernel overlay
#
# pgp (pretty good protection)
0 beshort 0x9900 pgp key public ring
0 beshort 0x9501 pgp key security ring
0 beshort 0x9500 pgp key security ring
0 string -----BEGIN\040PGP pgp armored data
>15 string PUBLIC\040KEY\040BLOCK- public key blocK
>15 string MESSAGE- message
>15 string SIGNED\040MESSAGE- signed message
>15 string PGP\040SIGNATURE- signature
#
# SysV R4 PKG Datastreams:
#
0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4)
#
#/etc/magic entries for Plus Five's UNIX MUMPS
#
# XXX - byte order? Paging Hokey....
#
0 short 0x259 mumps avl global
>2 byte >0 (V%d)
>6 byte >0 with %d byte name
>7 byte >0 and %d byte data cells
0 short 0x25a mumps blt global
>2 byte >0 (V%d)
>8 short >0 - %d byte blocks
>15 byte 0x00 - P/D format
>15 byte 0x01 - P/K/D format
>15 byte 0x02 - K/D format
>15 byte >0x02 - Bad Flags
#
# magic.postscript: Magic for postscript files
#
# XXX - should we match only versions 1.0 and 2.0, or should we wildcard
# it?
#
0 string %! PostScript document
>2 string PS-Adobe- conforming
>>11 string 1.0 at level %s
>>11 string 2.0 at level %s
>>11 string 3.0 at level %s
# Some pc's have the annoying habit of adding a ^D
0 string \004%! PostScript document
>3 string PS-Adobe- conforming
>>12 string 1.0 at level %s
>>12 string 2.0 at level %s
>>12 string 3.0 at level %s
# PostScript
0 string %! PostScript document
>2 string PS-Adobe- conforming
>>11 string >\0 at level %s
# Some pc's have the annoying habit of adding a ^D
0 string \004%! PostScript document
>3 string PS-Adobe- conforming
>>12 string >\0 at level %s
# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
0 string \033E\033 HP PCL printer data
>3 string \&l0A - default page size
>3 string \&l1A - US executive page size
>3 string \&l2A - US letter page size
>3 string \&l3A - US legal page size
>3 string \&l26A - A4 page size
>3 string \&l80A - Monarch envelope size
>3 string \&l81A - No. 10 envelope size
>3 string \&l90A - Intl. DL envelope size
>3 string \&l91A - Intl. C5 envelope size
>3 string \&l100A - Intl. B5 envelope size
>3 string \&l-81A - No. 10 envelope size (landscape)
>3 string \&l-90A - Intl. DL envelope size (landscape)
# HP Printer Job Language, Bernd Wuebben (wuebben@math.cornell.edu)
0 string \033%-12345X HP PJL printer commands
# Tell file about magic for IMAGEN printer-ready files:
0 string @document( Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10 string language\ impress (imPRESS data)
>10 string language\ daisy (daisywheel text)
>10 string language\ diablo (daisywheel text)
>10 string language\ printer (line printer emulation)
>10 string language\ tektronix (Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
#
# Now magic for IMAGEN font files...
0 string Rast RST-format raster font data
>45 string >0 face %
#
# magic.ps: psdatabase magic
#
0 belong&0xff00ffff 0x56000000 ps database
>1 string >\0 version %s
>4 string >\0 from kernel %s
#
# magic.pyramid: Magic for pyramids
#
# XXX - byte order?
#
0 long 0x50900107 Pyramid 90x family executable
0 long 0x50900108 Pyramid 90x family pure executable
>16 long >0 not stripped
0 long 0x5090010b Pyramid 90x family demand paged pure executable
>16 long >0 not stripped
# From <janl@ifi.uio.no>
# I made this with the help of the man page for rle(5). Ihey missing
# from the magic numbers I have:
#
# rle
#
0 short 0xcc52 Utah Raster Toolkit RLE
>2 short >0 lower left corner: %d
>4 short >0 lower right corner: %d
>6 short >0 %d x
>8 short >0 %d
>10 byte&0x1 =0x1 CLEARFIRST
>10 byte&0x2 =0x2 NO_BACKGROUND
>10 byte&0x4 =0x4 ALPHA
>10 byte&0x8 =0x8 COMMENT
>11 byte >0 %d colour channels
>12 byte >0 %d bits pr. pixel
>13 byte >0 %d colour map channels
# for SC
38 string Spreadsheet sc file
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
# \001c date and time created 87/09/23 08:09:20 by ian
# \001e
# \001u
# \001U
# ... etc.
# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
# *Sigh*. And these both came from various parts of the USG.
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
# and we don't have regular expression matching yet.
# Hence the following official kludge:
8 string \001s\ SCCS archive.
#
# magic.sendmail:
#
# XXX - byte order?
#
0 byte 046 Sendmail frozen configuration
>16 string >\0 - version %s
0 short 0x271c Sendmail frozen configuration
>16 string >\0 - version %s
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# For Sequent's multiprocessor systems (incomplete).
0 lelong 0x00ea BALANCE NS32000 .o
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0)
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0)
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 lelong 0x30ea BALANCE NS32000 standalone executable
>16 lelong >0 not stripped
>124 lelong >0 version %ld
#
# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
# Symmetry magic nums will not be reached if DOS COM comes before them;
# byte 0xeb is matched before these get a chance.
0 leshort 0x12eb SYMMETRY i386 .o
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0)
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0)
>16 lelong >0 not stripped
>124 lelong >0 version %ld
0 leshort 0x42eb SYMMETRY i386 standalone executable
>16 lelong >0 not stripped
>124 lelong >0 version %ld
# $Id: magic,v 1.1.1.1 1997/11/27 04:10:46 wuebben Exp $
# SGML goop, mostly from rph@sq.
0 string \<!DOCTYPE Exported SGML document
0 string \<!doctype Exported SGML document
0 string \<!SUBDOC Exported SGML subdocument
0 string \<!subdoc Exported SGML subdocument
# SoftQuad Publishing Software magic numbers
# $Id: magic,v 1.1.1.1 1997/11/27 04:10:46 wuebben Exp $
# Author/Editor and RulesBuilder
#
# XXX - byte order?
#
0 string \<!SQ\ DTD> Compiled SGML rules file
>9 string >\0 Type %s
0 string \<!SQ\ A/E> A/E SGML Document binary
>9 string >\0 Type %s
0 string \<!SQ\ STS> A/E SGML binary styles file
>9 string >\0 Type %s
0 short 0xc0de Compiled PSI (v1) data
0 short 0xc0da Compiled PSI (v2) data
>3 string >\0 (%s)
# Binary sqtroff font/desc files...
0 short 0125252 SoftQuad DESC or font file binary
>2 short >0 - version %d
# Bitmaps...
0 string SQ\ BITMAP1 SoftQuad Raster Format text
#0 string SQ\ BITMAP2 SoftQuad Raster Format data
# sqtroff intermediate language (replacement for ditroff int. lang.)
0 string X\ SoftQuad troff Context intermediate
>2 string 495 for AT&T 495 laser printer
>2 string hp for Hewlett-Packard LaserJet
>2 string impr for IMAGEN imPRESS
>2 string ps for PostScript
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
# releases.
# (5.x uses ELF.)
#
0 belong&077777777 0600413 sparc demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0600410 sparc pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0600407 sparc
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0400413 mc68020 demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>16 belong >0 not stripped
0 belong&077777777 0400410 mc68020 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0400407 mc68020
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0200413 mc68010 demand paged
>0 byte &0x80
>>20 belong <4096 shared library
>>20 belong =4096 dynamically linked executable
>>20 belong >4096 dynamically linked executable
>16 belong >0 not stripped
0 belong&077777777 0200410 mc68010 pure
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
0 belong&077777777 0200407 mc68010
>0 byte &0x80 dynamically linked executable
>0 byte ^0x80 executable
>16 belong >0 not stripped
# reworked these to avoid anything beginning with zero becoming "old sun-2"
0 belong 0407 old sun-2 executable
>16 belong >0 not stripped
0 belong 0410 old sun-2 pure executable
>16 belong >0 not stripped
0 belong 0413 old sun-2 demand paged executable
>16 belong >0 not stripped
#
# Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
# binary executed in compatibility mode under SunOS 5.x".
#
0 belong 0x080456 SunOS core file
>4 belong 432 (SPARC)
>>132 string >\0 from '%s'
>>116 belong =3 (quit)
>>116 belong =4 (illegal instruction)
>>116 belong =5 (trace trap)
>>116 belong =6 (abort)
>>116 belong =7 (emulator trap)
>>116 belong =8 (arithmetic exception)
>>116 belong =9 (kill)
>>116 belong =10 (bus error)
>>116 belong =11 (segmentation violation)
>>116 belong =12 (bad argument to system call)
>>116 belong =29 (resource lost)
>>120 belong x (T=%dK,
>>124 belong x D=%dK,
>>128 belong x S=%dK)
>4 belong 826 (68K)
>>128 string >\0 from '%s'
>4 belong 456 (SPARC 4.x BCP)
>>152 string >\0 from '%s'
#
# Sun rasterfiles
#
# XXX - byte order? What about the 386i?
#
0 string \x59\xa6\x6a\x95 rasterfile
>4 belong >0 %d
>8 belong >0 x %d
>12 belong >0 x %d
>20 belong 0 old format
>20 belong 2 compressed
>24 belong 1 with color map
#
# Terminfo
#
# XXX - byte order for screen images?
#
0 string \032\001 Compiled terminfo entry
0 short 0433 Curses screen image
0 short 0434 Curses screen image
#
# magic.tex:
#
# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
#
# From <conklin@talisman.kaleida.com>
# Although we may know the offset of certain text fields in TeX DVI
# and font files, we can't use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0 leshort 0x02f7 TeX DVI file data
>16 string >\0 (%s)
0 string \367\203 TeX generic font data
0 string \367\131 TeX packed font data
>3 string >\0 (%s)
0 string \367\312 TeX virtual font data
0 string This\ is\ TeX, TeX transcript text
0 string This\ is\ METAFONT, METAFONT transcript text
# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data. The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2 string \000\021 TeX font metric data
2 string \000\022 TeX font metric data
>34 string >\0 (%s)
# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \\input\ texinfo Texinfo source text
0 string This\ is\ Info\ file GNU Info text
#
# correct TeX magic for Linux (and maybe more)
# from Peter Tobias (tobias@server.et-inf.fho-emden.de)
#
0 short 0x02f7 TeX DVI File
>16 string >\0 (%s)
0 short 0x59f7 TeX packed font data
>3 string >\0 (%s)
2 string \000\022 TeX font metric data
>33 string >\0 (%s)
# TeX document additions from Daniel Quinlan, quinlan@yggdrasil.com
0 string \\input TeX or derivative document text
0 string \\chapter TeX or derivative document text
0 string \\documentstyle TeX or derivative document text
0 string \\section TeX or derivative document text
0 string \\setlength TeX or derivative document text
#
# magic.tex:
#
# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
#
# From <conklin@talisman.kaleida.com>
# Although we may know the offset of certain text fields in TeX DVI
# and font files, we can't use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0 string \367\002 TeX DVI file
>16 string >\0 (%s)
0 string \367\203 TeX generic font data
0 string \367\131 TeX packed font data
>4 string >\0 (%s)
0 string \367\312 TeX virtual font data
0 string This\ is\ TeX, TeX transcript text
0 string This\ is\ METAFONT, METAFONT transcript text
# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data. The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2 string \000\021 TeX font metric data
2 string \000\022 TeX font metric data
>34 string >\0 (%s)
#
# time zone data, from Daniel Quinlan (quinlan@yggdrasil.com)
# this will work on Linux, SunOS, and others
27 byte 1 time zone data
27 byte 2 time zone data
#
# magic.troff
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
# troff input
0 string .\\" troff or preprocessor input text
0 string '\\" troff or preprocessor input text
0 string '.\\" troff or preprocessor input text
0 string \\" troff or preprocessor input text
# ditroff intermediate output text
0 string x\ T ditroff text
>4 string cat for the C/A/T phototypesetter
>4 string ps for PostScript
>4 string dvi for DVI
>4 string ascii for ASCII
>4 string lj4 for LaserJet 4
>4 string latin1 for ISO 8859-1 (Latin 1)
>4 string X75 for xditview at 75dpi
>>7 string -12 (12pt)
>4 string X100 for xditview at 100dpi
>>8 string -12 (12pt)
# output data formats
0 string \100\357 very old (C/A/T) troff output data
#
# magic.troff:
#
0 string \100\357 very old (C/A/T) troff output data
0 string ' [nt]roff, tbl, or eqn input text
# other typesetting magic
0 string Interpress/Xerox Xerox InterPress data
>16 string / (version
>>17 string >\0 %s)
# other typesetting magic
0 string \100\357 very old (C/A/T) troff output data
0 string Interpress/Xerox Xerox InterPress data
>16 string / (version
>>17 string >\0 %s)
#
# magic.unknown: Unknown machine magic
#
# XXX - this probably should be pruned, as it'll match PDP-11 and
# VAX image formats.
#
# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
# respectively).
#
# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
# have the "version %ld", which may be a bogus COFFism (I don't think
# there ever was COFF for the PDP-11).
#
# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
# long, as it would be on a VAX.
#
# 0x10C is 0414, 0x10D is 0415, and 0x10E is 416; those *are* unknown.
#
0 short 0x107 unknown machine executable
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 0x108 unknown pure executable
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 0x109 PDP-11 separate I&D
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 0x10b unknown pure executable
>8 short >0 not stripped
>15 byte >0 - version %ld
0 long 0x10c unknown demand paged pure executable
>16 long >0 not stripped
0 long 0x10d unknown demand paged pure executable
>16 long >0 not stripped
0 long 0x10e unknown readable demand paged pure executable
0 string begin uuencoded mail text
# Btoa(1) is an alternative to uuencode that requires less space.
0 string xbtoa\ Begin btoa'd text
# Herewith many of the object file formats used by USG systems.
# Most have been moved to files for a particular processor,
# and deleted if they duplicate other entries.
#
0 short 0610 Perkin-Elmer executable
#
# magic.pdp: VAX executable/object and APL workspace
#
0 lelong 0101557 VAX single precision APL workspace
0 lelong 0101556 VAX double precision APL workspace
#
# VAX a.out (32V, BSD)
#
0 lelong 0407 VAX executable
>16 lelong >0 not stripped
0 lelong 0410 VAX pure executable
>16 lelong >0 not stripped
0 lelong 0413 VAX demand paged pure executable
>16 lelong >0 not stripped
0 lelong 0420 VAX demand paged (first page unmapped) pure executable
>16 lelong >0 not stripped
#
# VAX COFF
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0 leshort 0570 VAX COFF executable
>12 lelong >0 not stripped
>22 leshort >0 - version %ld
0 leshort 0575 VAX COFF pure executable
>12 lelong >0 not stripped
>22 leshort >0 - version %ld
#
# magic.visx: Visx format file
#
0 short 0x5555 VISX image file
>2 byte 0 (zero)
>2 byte 1 (unsigned char)
>2 byte 2 (short integer)
>2 byte 3 (float 32)
>2 byte 4 (float 64)
>2 byte 5 (signed char)
>2 byte 6 (bit-plane)
>2 byte 7 (classes)
>2 byte 8 (statistics)
>2 byte 10 (ascii text)
>2 byte 15 (image segments)
>2 byte 100 (image set)
>2 byte 101 (unsigned char vector)
>2 byte 102 (short integer vector)
>2 byte 103 (float 32 vector)
>2 byte 104 (float 64 vector)
>2 byte 105 (signed char vector)
>2 byte 106 (bit plane vector)
>2 byte 121 (feature vector)
>2 byte 122 (feature vector library)
>2 byte 124 (chain code)
>2 byte 126 (bit vector)
>2 byte 130 (graph)
>2 byte 131 (adjacency graph)
>2 byte 132 (adjacency graph library)
>2 string .VISIX (ascii text)
#
# magic.x11
#
# I think this is byte-order-dependent; if so, it should become:
#
# 0 belong 00000004 X11 big-endian snf font
# 0 lelong 00000004 X11 little-endian snf font
#
0 long 00000004 X11 snf font
# some X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \001fcp X11 font data
0 string D1.0\015\012\000\000 X11 Speedo font data
#
# magic.x11
#
# I think this is byte-order-dependent; if so, it should become:
#
# 0 belong 00000004 X11 big-endian snf font
# 0 lelong 00000004 X11 little-endian snf font
#
0 long 00000004 X11 snf font
#
# Zilog Z8000.
#
# Was it big-endian or little-endian? My Product Specification doesn't
# say.
#
0 long 0xe807 object file (z8000 a.out)
0 long 0xe808 pure object file (z8000 a.out)
0 long 0xe809 separate object file (z8000 a.out)
0 long 0xe805 overlay object file (z8000 a.out)
# From <rob@pe1chl.ampr.org>
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
# ZyXEL-defined standard)
0 string ZyXEL\002 ZyXEL voice data
>10 byte 0 - CELP encoding
>10 byte 1 - ADPCM2 encoding
>10 byte 2 - ADPCM3 encoding
