# Magic file created Mon Oct 16 13:57:01 CDT 1995 by fuzzy!root tty3 Oct 16 11:20 #! file # Magic data for file(1) command. # Machine-genererated from src/cmd/file/magdir/*; edit there only! # Format is described in magic(files), where: # files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID. # $Id: magic,v 1.1.1.1 1997/11/27 04:10:46 wuebben Exp $ # Add any locally-observed files here. Remember: # text if readable, executable if runnable binary, data if unreadable. # # Alliant FX series a.out files: # If the FX series is the one that had a processor with a 68K-derived # instruction set, the "short" should probably become "beshort" and the # "long" should probably become "belong". # If it's the i860-based one, they should probably become either the # big-endian or little-endian versions, depending on the mode they ran # the 860 in.... # 0 short 0420 0420 Alliant virtual executable >2 short &0x0020 common library >16 long >0 not stripped 0 short 0421 0421 Alliant compact executable >2 short &0x0020 common library >16 long >0 not stripped # # magic.apl: # 0 long 0100554 APL workspace (Ken's original?) # # Apple II file formats # 0 string FiLeStArTfIlEsTaRt binscii (apple ][) text 0 string \x0aGL Binary II (apple ][) data 0 string \x76\xff Squeezed (apple ][) data 0 string SIT! StuffIt (macintosh) text 0 string NuFile NuFile archive (apple ][) data 0 string N\xf5F\xe9l\xe5 NuFile archive (apple ][) data # # "ar", for all kinds of archives. # # XXX - why are there multiple thingies? Note that 0x213c6172 is # "! current ar archive # 0 long 0x213c6172 archive file # # and for SVR3.1 archives, we have: # # 0 string \ System V Release 1 ar archive # 0 string = archive # 0 string = archive # # XXX - did Aegis really store shared libraries, breakpointed modules, # and absolute code program modules in the same format as new-style # "ar" archives? # 0 string ! current ar archive >8 string __.SYMDEF random library >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 >0 beshort 2 - object archive >0 beshort 3 - shared library module >0 beshort 4 - debug break-pointed module >0 beshort 5 - absolute code program module 0 string \ System V Release 1 ar archive 0 string = archive # # XXX - from "vax", which appears to collect a bunch of byte-swapped # thingies, to help you recognize VAX files on big-endian machines; # with "leshort", "lelong", and "string", that's no longer necessary.... # # 0 long 0x3c61723e VAX 5.0 archive # 0 long 0x213c6172 archive file 0 lelong 0177555 very old VAX archive 0 leshort 0177555 very old PDP-11 archive # # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus # be a random library (it said 0xff65 rather than 0177545). # 0 lelong 0177545 old VAX archive >8 string __.SYMDEF random library 0 leshort 0177545 old PDP-11 archive >8 string __.SYMDEF random library # 0 string = archive # # From "pdp": # 0 lelong 0x39bed PDP-11 old archive 0 lelong 0x39bee PDP-11 4.0 archive # 0 string -h- Software Tools format archive text # "arc" archiver 0 byte 26 'arc' archive >1 byte 0 (empty) >1 byte 1 (old format) # Rahul Dhesi's zoo archive format, from keith@cerberus.uchicago.edu. 20 string \xdc\xa7\xc4\xfd Rahul Dhesi's "zoo" archive >0 string >\0 (%s) # ZIP archiver 0 string PK zip archive file >4 byte x - version >4 byte 10 1.0 >4 byte 20 2.0 2 string -lh LHarc archive data >6 byte x type %c >20 byte x - header level %d # From: (Michael Haardt) 2 string -lh0- Lharc 1.x archive 2 string -lh1- Lharc 1.x archive 2 string -lz4- Lharc 1.x archive 2 string -lz5- Lharc 1.x archive 2 string -lzs- LHa 2.x? archive [lzs] 2 string -lh - LHa 2.x? archive [lh ] 2 string -lhd- LHa 2.x? archive [lhd] 2 string -lh2- LHa 2.x? archive [lh2] 2 string -lh3- LHa 2.x? archive [lh3] 2 string -lh4- LHa 2.x? archive [lh4] 2 string -lh5- LHa (2.x) archive # ARJ archive data from jason@jarthur.Claremont.EDU 0 leshort 0xea60 ARJ archive data >5 byte x - version %d, >8 byte >0 flags: >>8 byte &0x04 multi-volume, >>8 byte &0x10 slash switched, >>8 byte &0x20 backup, >34 string x original name: %s, >7 byte 0 os: MS/DOS >7 byte 1 os: PRIMOS >7 byte 2 os: UNIX >7 byte 3 os: Amiga >7 byte 4 os: Macintosh >7 byte 5 os: OS/2 >7 byte 6 os: Apple ][ GS >7 byte 7 os: Atari ST >7 byte 8 os: NeXT >7 byte 9 os: VAX/VMS >3 byte >0 %d] # # "ar", for all kinds of archives. # # XXX - why are there multiple thingies? Note that 0x213c6172 is # "! current ar archive # 0 long 0x213c6172 archive file # # and for SVR3.1 archives, we have: # # 0 string \ System V Release 1 ar archive # 0 string = archive # 0 string = archive # # XXX - did Aegis really store shared libraries, breakpointed modules, # and absolute code program modules in the same format as new-style # "ar" archives? # 0 string ! current ar archive >8 string __.SYMDEF random library >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 >0 beshort 2 - object archive >0 beshort 3 - shared library module >0 beshort 4 - debug break-pointed module >0 beshort 5 - absolute code program module 0 string \ System V Release 1 ar archive 0 string = archive # # XXX - from "vax", which appears to collect a bunch of byte-swapped # thingies, to help you recognize VAX files on big-endian machines; # with "leshort", "lelong", and "string", that's no longer necessary.... # # 0 long 0x3c61723e VAX 5.0 archive # 0 long 0x213c6172 archive file 0 lelong 0177555 very old VAX archive 0 leshort 0177555 very old PDP-11 archive # # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus # be a random library (it said 0xff65 rather than 0177545). # 0 lelong 0177545 old VAX archive >8 string __.SYMDEF random library 0 leshort 0177545 old PDP-11 archive >8 string __.SYMDEF random library # 0 string = archive # # From "pdp": # 0 lelong 0x39bed PDP-11 old archive 0 lelong 0x39bee PDP-11 4.0 archive # 0 string -h- Software Tools format archive text # "arc" archiver 0 byte 26 'arc' archive >1 byte 0 (empty) >1 byte 1 (old format) # Rahul Dhesi's zoo archive format, from keith@cerberus.uchicago.edu. 20 long 0xdca7c4fd Rahul Dhesi's "zoo" archive # ZIP archiver 0 string PK zip archive file >4 byte x - version >4 byte 10 1.0 >4 byte 20 2.0 2 string -lh LHarc archive data >6 byte x type %c >20 byte x - header level %d # From: (Michael Haardt) 2 string -lh0- Lharc 1.x archive 2 string -lh1- Lharc 1.x archive 2 string -lz4- Lharc 1.x archive 2 string -lz5- Lharc 1.x archive 2 string -lzs- LHa 2.x? archive [lzs] 2 string -lh - LHa 2.x? archive [lh ] 2 string -lhd- LHa 2.x? archive [lhd] 2 string -lh2- LHa 2.x? archive [lh2] 2 string -lh3- LHa 2.x? archive [lh3] 2 string -lh4- LHa 2.x? archive [lh4] 2 string -lh5- LHa (2.x) archive # ARJ archive data from jason@jarthur.Claremont.EDU 0 leshort 0xea60 ARJ archive data >5 byte x - version %d, >8 byte >0 flags: >>8 byte &0x04 multi-volume, >>8 byte &0x10 slash switched, >>8 byte &0x20 backup, >34 string x original name: %s, >7 byte 0 os: MS/DOS >7 byte 1 os: PRIMOS >7 byte 2 os: UNIX >7 byte 3 os: Amiga >7 byte 4 os: Macintosh >7 byte 5 os: OS/2 >7 byte 6 os: Apple ][ GS >7 byte 7 os: Atari ST >7 byte 8 os: NeXT >7 byte 9 os: VAX/VMS >3 byte >0 %d] 0 byte 26 'arc' archive >1 byte 0 (empty) >1 byte 1 (old format) # A collection of various "ar" and "cpio" archive formats. # "Tar" archives are handled in the C code. 0 short 070707 cpio archive 0 string 070707 ASCII cpio archive 0 long 0177555 very old archive 0 short 0177555 very old PDP-11 archive 0 long 0177545 old archive 0 short 0177545 old PDP-11 archive 0 long 0100554 apl workspace 0 string = archive 0 string ! archive >8 string __.SYMDEF random library 0 string -h- Software Tools format archive text # A collection of various "ar" and "cpio" archive formats. # "Tar" archives are handled in the C code. 0 short 070707 cpio archive 0 string 070707 ASCII cpio archive 0 long 0177555 very old archive 0 short 0177555 very old PDP-11 archive 0 long 0177545 old archive 0 short 0177545 old PDP-11 archive 0 long 0100554 apl workspace 0 string = archive 0 string ! archive >8 string __.SYMDEF random library 0 string -h- Software Tools format archive text # Rahul Dhesi's zoo archive format, from keith@cerberus.uchicago.edu. 20 long 0xdca7c4fd Rahul Dhesi's "zoo" archive # # AT&T 3B machines # # The `versions' should be un-commented if they work for you. # (Was the problem just one of endianness?) # # 3B20 # 0 beshort 0550 3b20 COFF executable >12 belong >0 not stripped #>22 beshort >0 - version %ld 0 beshort 0551 3b20 COFF executable (TV) >12 belong >0 not stripped #>22 beshort >0 - version %ld # # WE32K # 0 beshort 0560 WE32000 COFF >18 beshort ^00000020 object >18 beshort &00000020 executable >12 belong >0 not stripped >18 beshort ^00010000 N/A on 3b2/300 w/paging >18 beshort &00020000 32100 required >18 beshort &00040000 and mau hardware required >20 beshort 0407 (impure) >20 beshort 0410 (pure) >20 beshort 0413 (demand paged) >20 beshort 0443 (target shared library) >22 beshort >0 - version %ld 0 beshort 0561 WE32000 COFF executable (TV) >12 belong >0 not stripped #>18 beshort &00020000 - 32100 required #>18 beshort &00040000 and mau hardware required #>22 beshort >0 - version %ld # # core file for 3b2 0 string \000\004\036\212\200 3b2 core file >364 string >\0 of '%s' # # Sound formats, from Jan Nicolai Langfeldt , # # Sun/NeXT audio data 0 string .snd audio data: >12 belong 1 8-bit u-law, >12 belong 2 8-bit linear PCM, >12 belong 3 16-bit linear PCM, >12 belong 4 24-bit linear PCM, >12 belong 5 32-bit linear PCM, >12 belong 6 32-bit floating point, >12 belong 7 64-bit floating point, >12 belong 23 compressed (G.721 ADPCM), >20 belong 1 mono, >20 belong 2 stereo, >20 belong 4 quad, >16 belong x %d Hz # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format # that uses little-endian encoding and has a different magic number # (0x0064732E in little-endian encoding). 0 lelong 0x0064732E DEC audio data: >12 lelong 1 8-bit u-law, >12 lelong 2 8-bit linear PCM, >12 lelong 3 16-bit linear PCM, >12 lelong 4 24-bit linear PCM, >12 lelong 5 32-bit linear PCM, >12 lelong 6 32-bit floating point, >12 lelong 7 64-bit floating point, >12 lelong 23 compressed (G.721 ADPCM), >20 lelong 1 mono, >20 lelong 2 stereo, >20 lelong 4 quad, >16 lelong x %d Hz # Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM" 8 string AIFF AIFF audio data 8 string AIFC AIFF-C audio data 8 string 8SVX IFF/8SVX audio data # Creative Labs AUDIO stuff 0 string MThd Standard MIDI data >9 byte >0 (format %d) >11 byte >1 using %d channels 0 string CTMF Creative Music (CMF) data 0 string SBI SoundBlaster instrument data 0 string Creative\ Voice\ File Creative Labs voice data # is this next line right? it came this way... >19 byte 0x1A >23 byte >0 - version %d >22 byte >0 \b.%d # Microsoft WAVE format 0 string RIFF Microsoft RIFF >8 string WAVE - WAVE format >34 short >0 %d bit >22 short =1 Mono >22 short =2 Stereo >22 short >2 %d Channels >24 long >0 %d Hz # # Sound formats, from Jan Nicolai Langfeldt , # # Sun/NeXT audio data 0 string .snd audio data: >12 belong 1 8-bit u-law, >12 belong 2 8-bit linear PCM, >12 belong 3 16-bit linear PCM, >12 belong 4 24-bit linear PCM, >12 belong 5 32-bit linear PCM, >12 belong 6 32-bit floating point, >12 belong 7 64-bit floating point, >12 belong 23 compressed (G.721 ADPCM), >20 belong 1 mono, >20 belong 2 stereo, >20 belong 4 quad, >16 belong x %d Hz # DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format # that uses little-endian encoding and has a different magic number # (0x0064732E in little-endian encoding). 0 lelong 0x0064732E DEC audio data: >12 lelong 1 8-bit u-law, >12 lelong 2 8-bit linear PCM, >12 lelong 3 16-bit linear PCM, >12 lelong 4 24-bit linear PCM, >12 lelong 5 32-bit linear PCM, >12 lelong 6 32-bit floating point, >12 lelong 7 64-bit floating point, >12 lelong 23 compressed (G.721 ADPCM), >20 lelong 1 mono, >20 lelong 2 stereo, >20 lelong 4 quad, >16 lelong x %d Hz # Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM" 8 string AIFF AIFF audio data 8 string AIFC AIFF-C audio data 8 string 8SVX IFF/8SVX audio data # Bytes 0-3 of Waveform (*.wav) audio files are "RIFF" 8 string WAVE Waveform audio data 0 string Creative\ Voice\ File Soundblaster audio data 0 long 0x4e54524b MultiTrack sound data file >4 long x - version %ld # 68K Blit stuff as seen from 680x0 machine # Note that this 0407 conflicts with several other a.out formats... # # XXX - should this be redone with "be" and "le", so that it works on # little-endian machines as well? If so, what's the deal with # "VAX-order" and "VAX-order2"? # #0 long 0407 68K Blit (standalone) executable #0 short 0407 VAX-order2 68K Blit (standalone) executable 0 short 03401 VAX-order 68K Blit (standalone) executable 0 long 0406 68k Blit mpx/mux executable 0 short 0406 VAX-order2 68k Blit mpx/mux executable 0 short 03001 VAX-order 68k Blit mpx/mux executable # Need more values for WE32 DMD executables. # Note that 0520 is the same as COFF #0 short 0520 tty630 layers executable # BSDI BSD/386 0 long 0314 BSD/386 demand paged (first page unmapped) pure executable # this first will upset you if you're a PL/1 shop... # in which case rm it; ascmagic will catch real C programs 0 string /* c program text 0 string // c++ program text # this first will upset you if you're a PL/1 shop... # in which case rm it; ascmagic will catch real C programs 0 string /* c program text # ChiWriter files 0 string \\1cw\ ChiWriter file >5 string >\0 version %s 0 string \\1cw ChiWriter file # # Intergraph, formerly Fairchild, Clipper. # # XXX - what byte order does the Clipper use? # # XXX - what's the "!" stuff: # # >18 short !074000,000000 C1 R1 # >18 short !074000,004000 C2 R1 # >18 short !074000,010000 C3 R1 # >18 short !074000,074000 TEST # # I shall assume it's ANDing the field with the first value and # comparing it with the second, and rewrite it as: # # >18 short&074000 000000 C1 R1 # >18 short&074000 004000 C2 R1 # >18 short&074000 010000 C3 R1 # >18 short&074000 074000 TEST # # as SVR3.1's "file" doesn't support anything of the "!074000,000000" # sort, nor does SunOS 4.x, so either it's something Intergraph added # in CLIX, or something AT&T added in SVR3.2 or later, or something # somebody else thought was a good idea; it's not documented in the # man page for this version of "magic", nor does it appear to be # implemented (at least not after I blew off the bogus code to turn # old-style "&"s into new-style "&"s, which just didn't work at all). # 0 short 0575 CLIPPER COFF executable (VAX #) >20 short 0407 (impure) >20 short 0410 (5.2 compatible) >20 short 0411 (pure) >20 short 0413 (demand paged) >20 short 0443 (target shared library) >12 long >0 not stripped >22 short >0 - version %ld 0 short 0577 CLIPPER COFF executable >18 short&074000 000000 C1 R1 >18 short&074000 004000 C2 R1 >18 short&074000 010000 C3 R1 >18 short&074000 074000 TEST >20 short 0407 (impure) >20 short 0410 (pure) >20 short 0411 (separate I&D) >20 short 0413 (paged) >20 short 0443 (target shared library) >12 long >0 not stripped >22 short >0 - version %ld >48 long&01 01 alignment trap enabled >52 byte 1 -Ctnc >52 byte 2 -Ctsw >52 byte 3 -Ctpw >52 byte 4 -Ctcb >53 byte 1 -Cdnc >53 byte 2 -Cdsw >53 byte 3 -Cdpw >53 byte 4 -Cdcb >54 byte 1 -Csnc >54 byte 2 -Cssw >54 byte 3 -Cspw >54 byte 4 -Cscb 4 string pipe CLIPPER instruction trace 4 string prof CLIPPER instruction profile # # "Commands": stuff for various shells and interpreters. # 0 string :\ shell archive or commands for antique kernel text 0 string #!/bin/sh Bourne Shell script text 0 string #!\ /bin/sh Bourne Shell script text 0 string #!/bin/csh C Shell script text 0 string #!\ /bin/csh C Shell script text # korn shell magic, sent by George Wu, gwu@clyde.att.com 0 string #!/bin/ksh Korn Shell script text 0 string #!\ /bin/ksh Korn Shell script text 0 string #!/bin/tcsh Tenex C Shell script text 0 string #!\ /bin/tcsh Tenex C Shell script text 0 string #!/usr/local/tcsh Tenex C Shell script text 0 string #!\ /usr/local/tcsh Tenex C Shell script text 0 string #!/usr/local/bin/tcsh Tenex C Shell script text 0 string #!\ /usr/local/bin/tcsh Tenex C Shell script text 0 string #!/bin/awk Awk Commands text 0 string #!\ /bin/awk Awk Commands text # For Larry Wall's perl language. The ``eval'' line recognizes an # outrageously clever hack for USG systems. # Keith Waclena 0 string #!/bin/perl perl commands text 0 string #!\ /bin/perl perl commands text 0 string eval\ "exec\ /bin/perl perl commands text 0 string #!/usr/bin/perl perl commands text 0 string #!\ /usr/bin/perl perl commands text 0 string eval\ "exec\ /usr/bin/perl perl commands text 0 string #!/usr/local/bin/perl perl commands text 0 string #!\ /usr/local/bin/perl perl commands text 0 string eval\ "exec\ /usr/local/bin/perl perl commands text # Plan 9 rc shell 0 string #!/bin/rc Plan 9 rc Shell script text 0 string #!\ /bin/rc Plan 9 rc Shell script text # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de) 0 string #!/bin/bash Bourne-Again Shell script text 0 string #!\ /bin/bash Bourne-Again Shell script text 0 string #!/usr/local/bin/bash Bourne-Again Shell script text 0 string #!\ /usr/local/bin/bash Bourne-Again Shell script text # general script detection 0 string #!\ / a >3 string >\0 %s script text 0 string #!/ a >2 string >\0 %s script text 0 string #!\ commands text >3 string >\0 for %s # # "Commands": stuff for various shells and interpreters. # 0 string :\ shell archive or commands for antique kernel text 0 string #!/bin/sh Bourne Shell script text 0 string #!\ /bin/sh Bourne Shell script text 0 string #!/bin/csh C Shell script text 0 string #!\ /bin/csh C Shell script text # korn shell magic, sent by George Wu, gwu@clyde.att.com 0 string #!/bin/ksh Korn Shell script text 0 string #!\ /bin/ksh Korn Shell script text 0 string #!/bin/tcsh Tenex C Shell script text 0 string #!\ /bin/tcsh Tenex C Shell script text 0 string #!/usr/local/tcsh Tenex C Shell script text 0 string #!\ /usr/local/tcsh Tenex C Shell script text 0 string #!/usr/local/bin/tcsh Tenex C Shell script text 0 string #!\ /usr/local/bin/tcsh Tenex C Shell script text 0 string #!/bin/awk Awk Commands text 0 string #!\ /bin/awk Awk Commands text 0 string #!\ / a >3 string >\0 %s script text 0 string #!/ a >2 string >\0 %s script text 0 string #!\ commands text >3 string >\0 for %s # For Larry Wall's perl language. The ``eval'' line recognizes an # outrageously clever hack for USG systems. # Keith Waclena 0 string #!/bin/perl perl commands text 0 string #!\ /bin/perl perl commands text 0 string eval\ "exec\ /bin/perl perl commands text 0 string #!/usr/bin/perl perl commands text 0 string #!\ /usr/bin/perl perl commands text 0 string eval\ "exec\ /usr/bin/perl perl commands text 0 string #!/usr/local/bin/perl perl commands text 0 string #!\ /usr/local/bin/perl perl commands text 0 string eval\ "exec\ /usr/local/bin/perl perl commands text 0 string #!/bin/rc Plan 9 rc Shell script text 0 string #!\ /bin/rc Plan 9 rc Shell script text # # Formats for various forms of compressed data # Formats for "compress" proper have been moved into "compress.c", # because it tries to uncompress it to figure out what's inside. # According to gzip.h, this is the correct byte order for packed data. # 0 string \037\036 packed data # # This magic number is byte-order-independent. # 0 short 017437 old packed data # # XXX - why *two* entries for "compacted data", one of which is # byte-order independent, and one of which is byte-order dependent? # 0 short 0x1fff compacted data 0 string \377\037 compacted data 0 short 0145405 huf output # # Squeeze and Crunch... # These numbers were gleaned from the Unix versions of the programs to # handle these formats. Note that I can only uncrunch, not crunch, and # I didn't have a crunched file handy, so the crunch number is untested. # Keith Waclena 0 leshort 0x76FF squeezed data (CP/M, DOS) 0 leshort 0x76FE crunched data (CP/M, DOS) # Freeze 0 string \037\237 Frozen file 2.1 0 string \037\236 Frozen file 1.0 (or gzip 0.5) # # Standard unix compress # 0 string \037\235 compressed data >2 byte&0x80 >0 block compressed >2 byte&0x1f x %d bits 0 string \037\240 LZH compressed data # # XXX - what byte order does a Convex use? # 0 long 0513 Convex executable # # Yes, the two "cpio archive" formats *are* supposed to just be "short". # The idea is to indicate archives produced on machines with the same # byte order as the machine running "file" with "cpio archive", and # to indicate archives produced on machines with the opposite byte order # from the machine running "file" with "byte-swapped cpio archive". # # The SVR4 "cpio(4)" hints that there are additional formats, but they # are defined as "short"s; I think all the new formats are # character-header formats, and thus are strings not numbers. # 0 short 070707 cpio archive 0 short 0143561 byte-swapped cpio archive 0 string 070707 ASCII cpio archive (pre-SVR4 or odc) 0 string 070701 ASCII cpio archive (SVR4 with no CRC) 0 string 070702 ASCII cpio archive (SVR4 with CRC) # # ... diamond is a multi-media mail and electronic conferencing system.... # # XXX - I think it was either renamed Slate, or replaced by Slate.... # # The full deal is too long... #0 string \n Diamond Multimedia Document 0 string =\n4 bedate x Previous dump %s, >8 bedate x This dump %s, >12 belong >0 Volume %ld, >692 belong 0 Level zero, type: >692 belong >0 Level %d, type: >0 belong 1 tape header, >0 belong 2 beginning of file record, >0 belong 3 map of inodes on tape, >0 belong 4 continuation of file record, >0 belong 5 end of volume, >0 belong 6 map of inodes deleted, >0 belong 7 end of medium (for floppy), >676 string >\0 Label %s, >696 string >\0 Filesystem %s, >760 string >\0 Device %s, >824 string >\0 Host %s, >888 belong >0 Flags %x 24 belong 60011 old-fs dump file (big endian), #>4 bedate x Previous dump %s, #>8 bedate x This dump %s, >12 belong >0 Volume %ld, >692 belong 0 Level zero, type: >692 belong >0 Level %d, type: >0 belong 1 tape header, >0 belong 2 beginning of file record, >0 belong 3 map of inodes on tape, >0 belong 4 continuation of file record, >0 belong 5 end of volume, >0 belong 6 map of inodes deleted, >0 belong 7 end of medium (for floppy), >676 string >\0 Label %s, >696 string >\0 Filesystem %s, >760 string >\0 Device %s, >824 string >\0 Host %s, >888 belong >0 Flags %x 24 lelong 60012 new-fs dump file (little endian), >4 ledate x Previous dump %s, >8 ledate x This dump %s, >12 lelong >0 Volume %ld, >692 lelong 0 Level zero, type: >692 lelong >0 Level %d, type: >0 lelong 1 tape header, >0 lelong 2 beginning of file record, >0 lelong 3 map of inodes on tape, >0 lelong 4 continuation of file record, >0 lelong 5 end of volume, >0 lelong 6 map of inodes deleted, >0 lelong 7 end of medium (for floppy), >676 string >\0 Label %s, >696 string >\0 Filesystem %s, >760 string >\0 Device %s, >824 string >\0 Host %s, >888 lelong >0 Flags %x 24 lelong 60011 old-fs dump file (little endian), #>4 ledate x Previous dump %s, #>8 ledate x This dump %s, >12 lelong >0 Volume %ld, >692 lelong 0 Level zero, type: >692 lelong >0 Level %d, type: >0 lelong 1 tape header, >0 lelong 2 beginning of file record, >0 lelong 3 map of inodes on tape, >0 lelong 4 continuation of file record, >0 lelong 5 end of volume, >0 lelong 6 map of inodes deleted, >0 lelong 7 end of medium (for floppy), >676 string >\0 Label %s, >696 string >\0 Filesystem %s, >760 string >\0 Device %s, >824 string >\0 Host %s, >888 lelong >0 Flags %x # # ELF # Missing MIPS image type and flags # # Question marks on processor types flag "should not happen because the # byte order is wrong". We have to check the byte order flag to see what # byte order all the other stuff in the header is in. # 0 string \177ELF ELF >4 byte 0 invalid class >4 byte 1 32-bit >4 byte 2 64-bit >5 byte 0 invalid byte order >5 byte 1 LSB >>16 leshort 0 unknown type >>16 leshort 1 relocatable >>16 leshort 2 executable >>16 leshort 3 dynamic lib >>16 leshort 4 core file >>18 leshort 0 unknown machine >>18 leshort 1 WE32100 and up >>18 leshort 2 SPARC? >>18 leshort 3 i386 (386 and up) >>18 leshort 4 M68000? >>18 leshort 5 M88000? >>18 leshort 7 i860 >>20 lelong 1 Version 1 >>36 lelong 1 MathCoPro/FPU/MAU Required >5 byte 2 MSB >>16 beshort 0 unknown type >>16 beshort 1 relocatable >>16 beshort 2 executable >>16 beshort 3 dynamic lib >>16 beshort 4 core file >>18 beshort 0 unknown machine >>18 beshort 1 WE32100 and up >>18 beshort 2 SPARC >>18 beshort 3 i386 (386 and up)? >>18 beshort 4 M68000 >>18 beshort 5 M88000 >>18 beshort 7 i860 >>20 belong 1 Version 1 >>36 belong 1 MathCoPro/FPU/MAU Required # # magic.encore: Recognize encore machines # # XXX - needs to have the byte order specified (NS32K was little-endian, # dunno whether they run the 88K in little-endian mode or not). # 0 short 0x154 Encore >20 short 0x107 executable >20 short 0x108 pure executable >20 short 0x10b demand-paged executable >20 short 0x10f unsupported executable >12 long >0 not stripped >22 short >0 - version %ld >22 short 0 - #>4 date x stamp %s 0 short 0x155 Encore unsupported executable >12 long >0 not stripped >22 short >0 - version %ld >22 short 0 - #>4 date x stamp %s 0 string \366\366\366\366 Formatted floppy w/ no filesystem data 0 string FONT ASCII vfont text 0 short 0436 Berkeley vfont data 0 short 017001 byte-swapped Berkeley vfont data # PostScript fonts (must precede PostScript entry), quinlan@yggdrasil.com 0 string %!PS-AdobeFont-1.0 PostScript Type 1 font text >20 string >\0 (%s) 6 string %!PS-AdobeFont-1.0 PostScript Type 1 font program data 0 string FONT ASCII vfont text 0 short 0436 Berkeley vfont data 0 short 017001 byte-swapped Berkeley vfont data # # Magic number for FrameMaker files # This stuff came on a FrameMaker demo tape, most of which is # copyright, but this file is "published" as witness the following: # 0 string \11 string 3.0 (3.0 >11 string 2.0 (2.0 >11 string 1.0 (1.0 >14 byte x %c) 0 string \9 string 3.0 (3.0) >9 string 2.0 (2.0) >9 string 1.0 (1.x) 0 string \17 string 3.0 (3.0) >17 string 2.0 (2.0) >17 string 1.0 (1.x) 0 string \17 string 1.01 (%s) 0 string \10 string 3.0 (3.0 >10 string 2.0 (2.0 >10 string 1.0 (1.0 >13 byte x %c) 0 string \3 byte &0x80 >>20 lelong <4096 shared library >>20 lelong =4096 dynamically linked executable >>20 lelong >4096 dynamically linked executable >3 byte ^0x80 executable >16 lelong >0 not stripped # This covers object files, and is better than "PDP-11 executable" 0 lelong 000000407 impure format >16 lelong >0 not stripped 0 string \037\213 gzip compressed data >2 byte <8 - reserved method >2 byte 8 - deflate method >3 byte &0x01 , ascii >3 byte &0x02 , continuation >3 byte &0x04 , extra field >3 byte &0x08 , original file name >3 byte &0x10 , comment >3 byte &0x20 , encrypted >4 ledate x , last modified: %s >8 byte 2 , max compression >8 byte 4 , max speed >9 byte =0x00 os: MS/DOS >9 byte =0x01 os: Amiga >9 byte =0x02 os: VMS >9 byte =0x03 os: Unix >9 byte =0x05 os: Atari >9 byte =0x06 os: OS/2 >9 byte =0x07 os: MacOS >9 byte =0x0A os: Tops/20 >9 byte =0x0B os: Win/32 # # magic.hp: Hewlett Packard Magic # # XXX - somebody should figure out whether any byte order needs to be # applied to the "TML" stuff; I'm assuming the Apollo stuff is # big-endian as it was mostly 68K-based. # # HP-PA is big-endian, so it (and "800", which is *also* HP-PA-based; I # assume "HPPA-RISC1.1" really means "HP-PA Version 1.1", which first # showed up in the 700 series, although later 800 series machines are, # I think, based on the PA7100 which implements HP-PA 1.1) are flagged # as big-endian. # # I think the 500 series was the old stack-based machines, running a # UNIX environment atop the "SUN kernel"; dunno whether it was # big-endian or little-endian. # # I'm guessing that the 200 series was 68K-based; the 300 and 400 series # are. # # The "misc" stuff needs a byte order; the archives look suspiciously # like the old 177545 archives (0xff65 = 0177545). # #### Old Apollo stuff 0 beshort 0627 Apollo m68k COFF executable >18 beshort ^040000 not stripped >22 beshort >0 - version %ld 0 beshort 0624 apollo a88k COFF executable >18 beshort ^040000 not stripped >22 beshort >0 - version %ld 0 long 01203604016 TML 0123 byte-order format 0 long 01702407010 TML 1032 byte-order format 0 long 01003405017 TML 2301 byte-order format 0 long 01602007412 TML 3210 byte-order format #### HPPA 0 belong 0x02100106 HPPA-RISC1.1 relocatable object 0 belong 0x02100107 HPPA-RISC1.1 executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x02100108 HPPA-RISC1.1 shared executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x0210010b HPPA-RISC1.1 demand-load executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x0210010e HPPA-RISC1.1 shared library >96 belong >0 -not stripped 0 belong 0x0210010d HPPA-RISC1.1 dynamic load library >96 belong >0 -not stripped #### 800 0 belong 0x020b0106 HP s800 relocatable object 0 belong 0x020b0107 HP s800 executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x020b0108 HP s800 shared executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x020b010b HP s800 demand-load executable >(144) belong 0x054ef630 dynamically linked >96 belong >0 -not stripped 0 belong 0x020b010e HP s800 shared library >96 belong >0 -not stripped 0 belong 0x020b010d HP s800 dynamic load library >96 belong >0 -not stripped 0 belong 0x213c6172 archive file >68 belong 0x020b0619 -HP s800 relocatable library #### 500 0 long 0x02080106 HP s500 relocatable executable >16 long >0 -version %ld 0 long 0x02080107 HP s500 executable >16 long >0 -version %ld 0 long 0x02080108 HP s500 pure executable >16 long >0 -version %ld #### 200 0 belong 0x020c0108 HP s200 pure executable >4 beshort >0 -version %ld >8 belong &0x80000000 save fp regs >8 belong &0x40000000 dynamically linked >8 belong &0x20000000 debuggable >36 belong >0 not stripped 0 belong 0x020c0107 HP s200 executable >4 beshort >0 -version %ld >8 belong &0x80000000 save fp regs >8 belong &0x40000000 dynamically linked >8 belong &0x20000000 debuggable >36 belong >0 not stripped 0 belong 0x020c010b HP s200 demand-load executable >4 beshort >0 -version %ld >8 belong &0x80000000 save fp regs >8 belong &0x40000000 dynamically linked >8 belong &0x20000000 debuggable >36 belong >0 not stripped 0 belong 0x020c0106 HP s200 relocatable executable >4 beshort >0 -version %ld >6 beshort >0 -highwater %d >8 belong &0x80000000 save fp regs >8 belong &0x20000000 debuggable >8 belong &0x10000000 PIC 0 belong 0x020a0108 HP s200 (2.x release) pure executable >4 beshort >0 -version %ld >36 belong >0 not stripped 0 belong 0x020a0107 HP s200 (2.x release) executable >4 beshort >0 -version %ld >36 belong >0 not stripped 0 belong 0x020c010e HP s200 shared library >4 beshort >0 -version %ld >6 beshort >0 -highwater %d >36 belong >0 not stripped 0 belong 0x020c010d HP s200 dynamic load library >4 beshort >0 -version %ld >6 beshort >0 -highwater %d >36 belong >0 not stripped #### MISC 0 long 0x0000ff65 HP old archive 0 long 0x020aff65 HP s200 old archive 0 long 0x020cff65 HP s200 old archive 0 long 0x0208ff65 HP s500 old archive 0 long 0x015821a6 HP core file 0 long 0x4da7eee8 HP-WINDOWS font >8 byte >0 -version %ld 0 string Bitmapfile HP Bitmapfile 0 string IMGfile CIS compimg HP Bitmapfile 0 short 0x8000 lif file 0 long 0x020c010c compiled Lisp 0 string msgcat01 HP NLS message catalog, >8 long >0 %d messages # addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92 0 string HPHP48- HP48 binary >7 byte >0 - Rev %c >8 short 0x1129 (ADR) >8 short 0x3329 (REAL) >8 short 0x5529 (LREAL) >8 short 0x7729 (COMPLX) >8 short 0x9d29 (LCOMPLX) >8 short 0xbf29 (CHAR) >8 short 0xe829 (ARRAY) >8 short 0x0a2a (LNKARRAY) >8 short 0x2c2a (STRING) >8 short 0x4e2a (HXS) >8 short 0x742a (LIST) >8 short 0x962a (DIR) >8 short 0xb82a (ALG) >8 short 0xda2a (UNIT) >8 short 0xfc2a (TAGGED) >8 short 0x1e2b (GROB) >8 short 0x402b (LIB) >8 short 0x622b (BACKUP) >8 short 0x882b (LIBDATA) >8 short 0x9d2d (PROG) >8 short 0xcc2d (CODE) >8 short 0x482e (GNAME) >8 short 0x6d2e (LNAME) >8 short 0x922e (XLIB) 0 string %%HP: HP48 text >6 string T(0) - T(0) >6 string T(1) - T(1) >6 string T(2) - T(2) >6 string T(3) - T(3) >10 string A(D) A(D) >10 string A(R) A(R) >10 string A(G) A(G) >14 string F(.) F(.); >14 string F(,) F(,); # # HTML magic, from Daniel Quinlan # 0 string \ HTML document text 0 string \ HTML document text 0 string \ HTML document text 0 string \ HTML document text 0 string \ Untitled HTML document text 0 string \ Untitled HTML document text # # IBM 370 and compatibles. # # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable". # What the heck *is* "USS/370"? # 0 beshort 0531 SVR2 executable (Amdahl-UTS) >12 belong >0 not stripped >24 belong >0 - version %ld 0 beshort 0534 SVR2 pure executable (Amdahl-UTS) >12 belong >0 not stripped >24 belong >0 - version %ld 0 beshort 0530 SVR2 pure executable (USS/370) >12 belong >0 not stripped >24 belong >0 - version %ld 0 beshort 0535 SVR2 executable (USS/370) >12 belong >0 not stripped >24 belong >0 - version %ld # # magic.rs6000: # # RS/6000 and the RT PC. # 0 beshort 0x01df executable (RISC System/6000 V3.1) or obj module >12 belong >0 not stripped # Breaks sun4 statically linked execs. #0 beshort 0x0103 executable (RT Version 2) or obj module #>2 byte 0x50 pure #>28 belong >0 not stripped #>6 beshort >0 - version %ld 0 beshort 0x0104 shared library 0 beshort 0x0105 ctab data 0 beshort 0xfe04 structured file 0 string 0xabcdef message catalog #0 string archive # image file format # From Robert Potter, potter@cs.rochester.edu 0 string Imagefile\ version- iff image data # this adds the whole header (inc. version number), informative but longish >10 string >\0 %s # Tell file about magic for IMAGEN printer-ready files: 0 string @document( Imagen printer # this only works if "language xxx" is first item in Imagen header. >10 string language\ impress (imPRESS data) >10 string language\ daisy (daisywheel text) >10 string language\ diablo (daisywheel text) >10 string language\ printer (line printer emulation) >10 string language\ tektronix (Tektronix 4014 emulation) # Add any other languages that your Imagen uses - remember # to keep the word `text' if the file is human-readable. # # Now magic for IMAGEN font files... 0 string Rast RST-format raster font data >45 string >0 face % # image formats, originally from jef@helios.ee.lbl.gov (Jef Poskanzer), # additions by janl@ifi.uio.no as well as others. Jan also suggested # merging several one- and two-line files into here. # # XXX - byte order for GIF and TIFF fields? # 0 string xbtoa btoa'd file # PBMPLUS 0 string P1 PBM file 0 string P2 PGM file 0 string P3 PPM file 0 string P4 PBM "rawbits" file 0 string P5 PGM "rawbits" file 0 string P6 PPM "rawbits" file # TIFF and friends 0 string \115\115 TIFF file, big-endian >2 short >0 version %d 0 string \111\111 TIFF file, little-endian >2 short >0 version %d # # NIFF (Navy Interchange File Format, a modification of TIFF) 0 string IIN1 NIFF raster data # GIF 0 string GIF GIF picture >3 string 87a - version %s >3 string 89a - version %s >6 leshort >0 %hd x >8 leshort >0 %hd, >10 byte &0x40 interlaced, >10 byte&0x07 =0x00 2 colors >10 byte&0x07 =0x01 4 colors >10 byte&0x07 =0x02 8 colors >10 byte&0x07 =0x03 16 colors >10 byte&0x07 =0x04 32 colors >10 byte&0x07 =0x05 64 colors >10 byte&0x07 =0x06 128 colors >10 byte&0x07 =0x07 256 colors # Miscellany 0 long 1123028772 Artisan image file >4 long 1 rectangular 24-bit image >4 long 2 rectangular 8-bit image with colormap >4 long 3 rectangular 32-bit image (24-bit with matte) 0 string \361\0\100\273 CMU window manager bitmap 0 string #FIG FIG graphics savefile text >6 string 2.1 Version 2.1 >6 string 2.0 Version 2.0 0 string GKSM GKS Metafile 8 string ILBM IFF ILBM file 6 string JFIF JPEG picture 0 string ARF_BEGARF PHIGS clear text archive # From: (Michael Haardt) 0 string yz MGR bitmap, modern format, 8 bit aligned 0 string zz MGR bitmap, old format, 1 bit deep, 16 bit aligned 0 string xz MGR bitmap, old format, 1 bit deep, 32 bit aligned 0 string yx MGR bitmap, modern format, squeezed 0 string %bitmap FBM pixmap >30 long 0x31 (mono) >30 long 0x33 (color) 4 string Research, Digifax-G3-File >29 byte 1 , fine resolution >29 byte 0 , normal resolution # # Various flavors of x86 UNIX executable/object (other than Xenix, which # is in "microsoft"). DOS is in "ms-dos"; the ambitious soul can do # Windows as well. # # Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and # whatever comes next (HP-PA Hummingbird?). OS/2 may also go elsewhere # as well, if, as, and when IBM makes it portable. # # The `versions' should be un-commented if they work for you. # (Was the problem just one of endianness?) # 0 leshort 0502 basic-16 executable >12 lelong >0 not stripped #>22 leshort >0 - version %ld 0 leshort 0503 basic-16 executable (TV) >12 lelong >0 not stripped #>22 leshort >0 - version %ld 0 leshort 0510 x86 executable >12 lelong >0 not stripped 0 leshort 0511 x86 executable (TV) >12 lelong >0 not stripped 0 leshort =0512 iAPX 286 executable small model (COFF) >12 lelong >0 not stripped #>22 leshort >0 - version %ld 0 leshort =0522 iAPX 286 executable large model (COFF) >12 lelong >0 not stripped #>22 leshort >0 - version %ld 0 leshort =0514 80386 COFF executable >12 lelong >0 not stripped >22 leshort >0 - version %ld # # magic for InterLeaf TPS: 0 string =\210OPS Interleaf saved data 0 string =5 string ,\ Version\ (version >>14 string >\0 %s) # # magic.iris: Magic for mips from an iris4d # # Dunno what byte-order munging is needed; all of SGI's *current* # machines and OSes run in big-endian mode on the MIPS machines, # as far as I know, but they do have the MIPSEB and MIPSEL stuff # here.... # 0 short 0x0160 mipseb >20 short 0407 executable >20 short 0410 pure >20 short 0413 demand paged >8 long >0 not stripped >8 long 0 stripped >22 byte >0 - version %ld. >23 byte >0 %ld 0 short 0x0162 mipsel >20 short 0407 executable >20 short 0410 pure >20 short 0413 demand paged >8 long >0 not stripped >8 long 0 stripped >23 byte >0 - version %ld. >22 byte >0 %ld 0 short 0x6001 swapped mipseb >20 short 03401 executable >20 short 04001 pure >20 short 05401 demand paged >8 long >0 not stripped >8 long 0 stripped >22 byte >0 - version %ld. >23 byte >0 %ld 0 short 0x6201 swapped mipsel >20 short 03401 executable >20 short 04001 pure >20 short 05401 demand paged >8 long >0 not stripped >8 long 0 stripped >22 byte >0 - version %ld. >23 byte >0 %ld 0 short 0x180 mipseb ucode 0 short 0x182 mipsel ucode # # IRIX core format version 1 (from /usr/include/core.out.h) 0 long 0xdeadadb0 IRIX core dump >4 long 1 of >16 string >\0 '%s' # # Archives - This handles archive subtypes # 0 string !\n__________E MIPS archive >20 string U with mipsucode members >21 string L with mipsel members >21 string B with mipseb members >19 string L and a EL hash table >19 string B and a EB hash table >22 string X -- out of date # # magic.ispell # # XXX - byte order? # 0 short 0xffff9601 ispell hash file >2 short 0x00 - 8-bit, no capitalization, 26 flags >2 short 0x01 - 7-bit, no capitalization, 26 flags >2 short 0x02 - 8-bit, capitalization, 26 flags >2 short 0x03 - 7-bit, capitalization, 26 flags >2 short 0x04 - 8-bit, no capitalization, 52 flags >2 short 0x05 - 7-bit, no capitalization, 52 flags >2 short 0x06 - 8-bit, capitalization, 52 flags >2 short 0x07 - 7-bit, capitalization, 52 flags >2 short 0x08 - 8-bit, no capitalization, 128 flags >2 short 0x09 - 7-bit, no capitalization, 128 flags >2 short 0x0A - 8-bit, capitalization, 128 flags >2 short 0x0B - 7-bit, capitalization, 128 flags >2 short 0x0C - 8-bit, no capitalization, 256 flags >2 short 0x0D - 7-bit, no capitalization, 256 flags >2 short 0x0E - 8-bit, capitalization, 256 flags >2 short 0x0F - 7-bit, capitalization, 256 flags >4 short >0 and %d string characters # derived empirically, your offsets may vary! 53 string yyprevious c program text (from lex) >3 string >\0 for %s # c program text from GNU flex, from Daniel Quinlan 21 string generated\ by\ flex c program text (from flex) # lex description file, from Daniel Quinlan 0 string %{ lex description text # derived empirically, your offsets may vary! 53 string yyprevious c program text (from lex) >3 string >\0 for %s # # magic.lif: # # XXX - byte order? # 0 short 0x8000 lif file # # magic.linux # # Values for Linux/i386 binaries, from Rik Faith , # Peter Tobias , and Daniel Quinlan # 2 leshort 100 Linux/i386 >0 leshort 0407 executable or impure executable (OMAGIC) >0 leshort 0410 pure executable (NMAGIC) >0 leshort 0413 demand-paged executable (ZMAGIC) >0 leshort 0314 demand-paged executable (QMAGIC) >16 lelong >0 not stripped >0 string Jump jump 0 leshort 0407 object file or impure executable (OMAGIC) >20 long >0x1020 DLL library # message catalogs, from Mitchum DSouza 0 string *nazgul* compiled message catalog >8 long >0 - version %ld # core dump file, from Bill Reynolds 216 lelong 0421 core file (Linux) >220 string >\0 - core dump of '%s' # # LILO boot/chain loaders, from Daniel Quinlan # this can be overrided by the DOS executable (COM) entry 2 string LILO LILO boot/chain loader # # Debian Packages, from Peter Tobias 0 string 0.9 >8 byte 0x0a Debian Binary Package - >>3 byte >0 created by dpkg 0.9%c >>4 byte >0 pl%c # # PSF fonts, from Daniel Quinlan 0 leshort 0x0436 PSF font data # # magic.linux # # Values for Linux/i386 binaries, from Rik Faith , # Peter Tobias , and Daniel Quinlan # 2 leshort 100 Linux/i386 >0 leshort 0410 pure executable (NMAGIC) >0 leshort 0413 demand-paged executable (ZMAGIC) >0 leshort 0314 demand-paged executable (QMAGIC) >16 lelong >0 not stripped >0 string Jump jump 0 leshort 0407 object file or impure executable (OMAGIC) >20 long >0x1020 DLL library # message catalogs, from Mitchum DSouza 0 string *nazgul* compiled message catalog >8 long >0 - version %ld # core dump file, from Bill Reynolds 216 lelong 0421 core file (Linux) >220 string >\0 - core dump of '%s' # # LILO boot/chain loaders, from Daniel Quinlan # this can be overrided by the DOS executable (COM) entry 2 string LILO LILO boot/chain loader # # Debian Packages, from Peter Tobias 0 string 0.9 >8 byte 0x0a Debian Binary Package - >>3 byte >0 created by dpkg 0.9%c >>4 byte >0 pl%c # # PSF fonts, from Daniel Quinlan 0 leshort 0x0436 PSF font data # # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) 0 string ;; Lisp/Scheme program text # Emacs 18 - this is always correct, but not very magical. 0 string \012( byte-compiled Emacs-Lisp program data # Emacs 19 0 string ;ELC\023\000\000\000 byte-compiled Emacs-Lisp program data 0 string #\ Magic magic text file for file(1) cmd # Unfortunately, saved netnews also has From line added in some news software. #0 string From mail text # There are tests to ascmagic.c to cope with mail and news. 0 string Relay-Version: old news text 0 string #!\ rnews batched news text 0 string N#!\ rnews mailed, batched news text 0 string Forward\ to mail forwarding text 0 string Pipe\ to mail piping text 0 string Return-Path: smtp mail text 0 string Path: news text 0 string Xref: news text 0 string From: news or mail text 0 string Article saved news text # # Microsoft (Xenix, not DOS) # # "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small # model" lifted from "magic.xenix", with comment "derived empirically; # treat as folklore until proven" # # "small model", "large model", "huge model" stuff lifted from XXX # # XXX - "x.out" collides with PDP-11 archives.... # 0 string core core file (Xenix) 0 byte 0x80 8086 relocatable (Microsoft) 0 leshort 0xff65 x.out >2 string __.SYMDEF randomized >0 byte x archive 0 leshort 0x206 Microsoft a.out >8 leshort 1 Middle model >0x1e leshort &0x10 overlay >0x1e leshort &0x2 separate >0x1e leshort &0x4 pure >0x1e leshort &0x800 segmented >0x1e leshort &0x400 standalone >0x1e leshort &0x8 fixed-stack >0x1c byte &0x80 byte-swapped >0x1c byte &0x40 word-swapped >0x10 lelong >0 not-stripped >0x1e leshort ^0xc000 pre-SysV >0x1c byte &0x4 86 >0x1c byte &0x9 286 >0x1c byte &0xa 386 >0x1f byte <0x040 small model >0x1f byte =0x048 large model >0x1f byte =0x049 huge model >0x1e leshort &0x1 executable >0x1e leshort ^0x1 object file >0x1e leshort &0x40 Large Text >0x1e leshort &0x20 Large Data >0x1e leshort &0x120 Huge Objects Enabled >0x10 lelong >0 not stripped 0 leshort 0x140 old Microsoft 8086 x.out >0x3 byte &0x4 separate >0x3 byte &0x2 pure >0 byte &0x1 executable >0 byte ^0x1 relocatable >0x14 lelong >0 not stripped 0 lelong 0x206 b.out >0x1e leshort &0x10 overlay >0x1e leshort &0x2 separate >0x1e leshort &0x4 pure >0x1e leshort &0x800 segmented >0x1e leshort &0x400 standalone >0x1e leshort &0x1 executable >0x1e leshort ^0x1 object file >0x1e leshort &0x4000 V2.3 >0x1e leshort &0x8000 V3.0 >0x1c byte &0x4 86 >0x1c byte &0xb 186 >0x1c byte &0x9 286 >0x1c byte &0x29 286 >0x1c byte &0xa 386 >0x1e leshort &0x4 Large Text >0x1e leshort &0x2 Large Data >0x1e leshort &0x102 Huge Objects Enabled 0 leshort 0x580 XENIX 8086 relocatable or 80286 small model # # RISC MIPS decstation # Should this be "leshort", given that DEC ran the DECstations in # little-endian mode? # # Where is the non-SGI, non-DEC MIPS stuff? # 0 short 0x6201 MIPS executable # # XXX - byte order? # 0 long 31415 Mirage Assembler m.out executable # # ID is the binary tags database produced by mkid(1). # # XXX - byte order? # 0 string \311\304 ID tags data >2 short >0 version %d 0 string \001\001\001\001 MMDF mailbox # # Motorola # # 68K # 0 beshort 0520 mc68k COFF >18 beshort ^00000020 object >18 beshort &00000020 executable >12 belong >0 not stripped >168 string .lowmem Apple toolbox >20 beshort 0407 (impure) >20 beshort 0410 (pure) >20 beshort 0413 (demand paged) >20 beshort 0421 (standalone) 0 beshort 0521 mc68k executable (shared) >12 belong >0 not stripped 0 beshort 0522 mc68k executable (shared demand paged) >12 belong >0 not stripped # # Motorola/UniSoft 68K Binary Compatibility Standard (BCS) # 0 beshort 0554 68K BCS executable # # 88K # # Motorola/88Open BCS # 0 beshort 0555 88K BCS executable # # Various MS-DOS magic numbers # 0 string MZ DOS executable (EXE) 0 string LZ DOS executable (built-in) 0 byte 0xe9 DOS executable (COM) 0 byte 0xeb DOS executable (COM) 0 byte 0xf0 MS-DOS program library # # magic.tower: # # NCR Tower objects, contributed by # Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa # uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP # 0 beshort 000610 Tower/XP rel 2 object >12 belong >0 not stripped >20 beshort 0407 executable >20 beshort 0410 pure executable >22 beshort >0 - version %ld 0 beshort 000615 Tower/XP rel 2 object >12 belong >0 not stripped >20 beshort 0407 executable >20 beshort 0410 pure executable >22 beshort >0 - version %ld 0 beshort 000620 Tower/XP rel 3 object >12 belong >0 not stripped >20 beshort 0407 executable >20 beshort 0410 pure executable >22 beshort >0 - version %ld 0 beshort 000625 Tower/XP rel 3 object >12 belong >0 not stripped >20 beshort 0407 executable >20 beshort 0410 pure executable >22 beshort >0 - version %ld 0 beshort 000630 Tower32/600/400 68020 object >12 belong >0 not stripped >20 beshort 0407 executable >20 beshort 0410 pure executable >22 beshort >0 - version %ld 0 beshort 000640 Tower32/800 68020 >18 beshort &020000 w/68881 object >18 beshort &040000 compatible object >18 beshort &~060000 object >20 beshort 0407 executable >20 beshort 0413 pure executable >12 belong >0 not stripped >22 beshort >0 - version %ld 0 beshort 000645 Tower32/800 68010 >18 beshort &040000 compatible object >18 beshort &~060000 object >20 beshort 0407 executable >20 beshort 0413 pure executable >12 belong >0 not stripped >22 beshort >0 - version %ld # # All new-style magic numbers are in network byte order. # 0 lelong 000000413 386BSD demand paged executable >16 lelong >0 not stripped 0 lelong 000000314 BSDI demand paged executable >16 lelong >0 not stripped 0 lelong 000000407 NetBSD little-endian object file >16 lelong >0 not stripped 0 belong 000000407 NetBSD big-endian object file >16 belong >0 not stripped 0 belong&0377777777 041400413 NetBSD/i386 demand paged >0 byte &0x80 >>20 lelong <4096 shared library >>20 lelong =4096 dynamically linked executable >>20 lelong >4096 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 041400410 NetBSD/i386 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 041400407 NetBSD/i386 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>20 lelong !0 executable >>20 lelong =0 object file >16 lelong >0 not stripped 0 belong&0377777777 041600413 NetBSD/m68k demand paged >0 byte &0x80 >>20 belong <8192 shared library >>20 belong =8192 dynamically linked executable >>20 belong >8192 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 041600410 NetBSD/m68k pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 041600407 NetBSD/m68k >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>20 belong !0 executable >>20 belong =0 object file >16 belong >0 not stripped 0 belong&0377777777 042000413 NetBSD/m68k4k demand paged >0 byte &0x80 >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 042000410 NetBSD/m68k4k pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 042000407 NetBSD/m68k4k >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>20 belong !0 executable >>20 belong =0 object file >16 belong >0 not stripped 0 belong&0377777777 042200413 NetBSD/ns32532 demand paged >0 byte &0x80 >>20 lelong <4096 shared library >>20 lelong =4096 dynamically linked executable >>20 lelong >4096 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 042200410 NetBSD/ns32532 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 lelong >0 not stripped 0 belong&0377777777 042200407 NetBSD/ns32532 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>20 lelong !0 executable >>20 lelong =0 object file >16 lelong >0 not stripped 0 belong&0377777777 042400413 NetBSD/sparc demand paged >0 byte &0x80 >>20 belong <8192 shared library >>20 belong =8192 dynamically linked executable >>20 belong >8192 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 042400410 NetBSD/sparc pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&0377777777 042400407 NetBSD/sparc >0 byte &0x80 dynamically linked executable >0 byte ^0x80 >>20 belong !0 executable >>20 belong =0 object file >16 belong >0 not stripped 0 belong&0377777777 041400507 NetBSD/i386 core >12 string >\0 from '%s' 0 belong&0377777777 041600507 NetBSD/m68k core >12 string >\0 from '%s' 0 belong&0377777777 042000507 NetBSD/m68k4k core >12 string >\0 from '%s' 0 belong&0377777777 042200507 NetBSD/ns32532 core >12 string >\0 from '%s' 0 belong&0377777777 042400507 NetBSD/sparc core >12 string >\0 from '%s' # NeWS, not "news" as in "netnews" 0 string StartFontMetrics ASCII font metrics 0 string StartFont ASCII font bits 0 long 0x137A2944 NeWS bitmap font 0 long 0x137A2947 NeWS font family # # XXX - byte order? # 0 short 0x2a17 "compact bitmap" format (Poskanzer) # # magic.pdp: PDP-11 executable/object and APL workspace # 0 lelong 0101555 PDP-11 single precision APL workspace 0 lelong 0101554 PDP-11 double precision APL workspace # # PDP-11 a.out # 0 leshort 0407 PDP-11 executable >8 leshort >0 not stripped 0 leshort 0401 PDP-11 UNIX/RT ldp 0 leshort 0405 PDP-11 old overlay 0 leshort 0410 PDP-11 pure executable >8 leshort >0 not stripped 0 leshort 0411 PDP-11 separate I&D executable >8 leshort >0 not stripped 0 leshort 0437 PDP-11 kernel overlay # # pgp (pretty good protection) 0 beshort 0x9900 pgp key public ring 0 beshort 0x9501 pgp key security ring 0 beshort 0x9500 pgp key security ring 0 string -----BEGIN\040PGP pgp armored data >15 string PUBLIC\040KEY\040BLOCK- public key blocK >15 string MESSAGE- message >15 string SIGNED\040MESSAGE- signed message >15 string PGP\040SIGNATURE- signature # # SysV R4 PKG Datastreams: # 0 string #\ PaCkAgE\ DaTaStReAm pkg Datastream (SVR4) # #/etc/magic entries for Plus Five's UNIX MUMPS # # XXX - byte order? Paging Hokey.... # 0 short 0x259 mumps avl global >2 byte >0 (V%d) >6 byte >0 with %d byte name >7 byte >0 and %d byte data cells 0 short 0x25a mumps blt global >2 byte >0 (V%d) >8 short >0 - %d byte blocks >15 byte 0x00 - P/D format >15 byte 0x01 - P/K/D format >15 byte 0x02 - K/D format >15 byte >0x02 - Bad Flags # # magic.postscript: Magic for postscript files # # XXX - should we match only versions 1.0 and 2.0, or should we wildcard # it? # 0 string %! PostScript document >2 string PS-Adobe- conforming >>11 string 1.0 at level %s >>11 string 2.0 at level %s >>11 string 3.0 at level %s # Some pc's have the annoying habit of adding a ^D 0 string \004%! PostScript document >3 string PS-Adobe- conforming >>12 string 1.0 at level %s >>12 string 2.0 at level %s >>12 string 3.0 at level %s # PostScript 0 string %! PostScript document >2 string PS-Adobe- conforming >>11 string >\0 at level %s # Some pc's have the annoying habit of adding a ^D 0 string \004%! PostScript document >3 string PS-Adobe- conforming >>12 string >\0 at level %s # HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com) 0 string \033E\033 HP PCL printer data >3 string \&l0A - default page size >3 string \&l1A - US executive page size >3 string \&l2A - US letter page size >3 string \&l3A - US legal page size >3 string \&l26A - A4 page size >3 string \&l80A - Monarch envelope size >3 string \&l81A - No. 10 envelope size >3 string \&l90A - Intl. DL envelope size >3 string \&l91A - Intl. C5 envelope size >3 string \&l100A - Intl. B5 envelope size >3 string \&l-81A - No. 10 envelope size (landscape) >3 string \&l-90A - Intl. DL envelope size (landscape) # HP Printer Job Language, Bernd Wuebben (wuebben@math.cornell.edu) 0 string \033%-12345X HP PJL printer commands # Tell file about magic for IMAGEN printer-ready files: 0 string @document( Imagen printer # this only works if "language xxx" is first item in Imagen header. >10 string language\ impress (imPRESS data) >10 string language\ daisy (daisywheel text) >10 string language\ diablo (daisywheel text) >10 string language\ printer (line printer emulation) >10 string language\ tektronix (Tektronix 4014 emulation) # Add any other languages that your Imagen uses - remember # to keep the word `text' if the file is human-readable. # # Now magic for IMAGEN font files... 0 string Rast RST-format raster font data >45 string >0 face % # # magic.ps: psdatabase magic # 0 belong&0xff00ffff 0x56000000 ps database >1 string >\0 version %s >4 string >\0 from kernel %s # # magic.pyramid: Magic for pyramids # # XXX - byte order? # 0 long 0x50900107 Pyramid 90x family executable 0 long 0x50900108 Pyramid 90x family pure executable >16 long >0 not stripped 0 long 0x5090010b Pyramid 90x family demand paged pure executable >16 long >0 not stripped # From # I made this with the help of the man page for rle(5). Ihey missing # from the magic numbers I have: # # rle # 0 short 0xcc52 Utah Raster Toolkit RLE >2 short >0 lower left corner: %d >4 short >0 lower right corner: %d >6 short >0 %d x >8 short >0 %d >10 byte&0x1 =0x1 CLEARFIRST >10 byte&0x2 =0x2 NO_BACKGROUND >10 byte&0x4 =0x4 ALPHA >10 byte&0x8 =0x8 COMMENT >11 byte >0 %d colour channels >12 byte >0 %d bits pr. pixel >13 byte >0 %d colour map channels # for SC 38 string Spreadsheet sc file # SCCS archive structure: # \001h01207 # \001s 00276/00000/00000 # \001d D 1.1 87/09/23 08:09:20 ian 1 0 # \001c date and time created 87/09/23 08:09:20 by ian # \001e # \001u # \001U # ... etc. # Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). # *Sigh*. And these both came from various parts of the USG. # Maybe we should just switch everybody from SCCS to RCS! # Further, you can't just say '\001h0', because the five-digit number # is a checksum that could (presumably) have any leading digit, # and we don't have regular expression matching yet. # Hence the following official kludge: 8 string \001s\ SCCS archive. # # magic.sendmail: # # XXX - byte order? # 0 byte 046 Sendmail frozen configuration >16 string >\0 - version %s 0 short 0x271c Sendmail frozen configuration >16 string >\0 - version %s # Sequent information updated by Don Dwiggins . # For Sequent's multiprocessor systems (incomplete). 0 lelong 0x00ea BALANCE NS32000 .o >16 lelong >0 not stripped >124 lelong >0 version %ld 0 lelong 0x10ea BALANCE NS32000 executable (0 @ 0) >16 lelong >0 not stripped >124 lelong >0 version %ld 0 lelong 0x20ea BALANCE NS32000 executable (invalid @ 0) >16 lelong >0 not stripped >124 lelong >0 version %ld 0 lelong 0x30ea BALANCE NS32000 standalone executable >16 lelong >0 not stripped >124 lelong >0 version %ld # # Symmetry information added by Jason Merrill . # Symmetry magic nums will not be reached if DOS COM comes before them; # byte 0xeb is matched before these get a chance. 0 leshort 0x12eb SYMMETRY i386 .o >16 lelong >0 not stripped >124 lelong >0 version %ld 0 leshort 0x22eb SYMMETRY i386 executable (0 @ 0) >16 lelong >0 not stripped >124 lelong >0 version %ld 0 leshort 0x32eb SYMMETRY i386 executable (invalid @ 0) >16 lelong >0 not stripped >124 lelong >0 version %ld 0 leshort 0x42eb SYMMETRY i386 standalone executable >16 lelong >0 not stripped >124 lelong >0 version %ld # $Id: magic,v 1.1.1.1 1997/11/27 04:10:46 wuebben Exp $ # SGML goop, mostly from rph@sq. 0 string \ Compiled SGML rules file >9 string >\0 Type %s 0 string \ A/E SGML Document binary >9 string >\0 Type %s 0 string \ A/E SGML binary styles file >9 string >\0 Type %s 0 short 0xc0de Compiled PSI (v1) data 0 short 0xc0da Compiled PSI (v2) data >3 string >\0 (%s) # Binary sqtroff font/desc files... 0 short 0125252 SoftQuad DESC or font file binary >2 short >0 - version %d # Bitmaps... 0 string SQ\ BITMAP1 SoftQuad Raster Format text #0 string SQ\ BITMAP2 SoftQuad Raster Format data # sqtroff intermediate language (replacement for ditroff int. lang.) 0 string X\ SoftQuad troff Context intermediate >2 string 495 for AT&T 495 laser printer >2 string hp for Hewlett-Packard LaserJet >2 string impr for IMAGEN imPRESS >2 string ps for PostScript # # Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x # releases. # (5.x uses ELF.) # 0 belong&077777777 0600413 sparc demand paged >0 byte &0x80 >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0600410 sparc pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0600407 sparc >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0400413 mc68020 demand paged >0 byte &0x80 >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable >16 belong >0 not stripped 0 belong&077777777 0400410 mc68020 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0400407 mc68020 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0200413 mc68010 demand paged >0 byte &0x80 >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable >16 belong >0 not stripped 0 belong&077777777 0200410 mc68010 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped 0 belong&077777777 0200407 mc68010 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped # reworked these to avoid anything beginning with zero becoming "old sun-2" 0 belong 0407 old sun-2 executable >16 belong >0 not stripped 0 belong 0410 old sun-2 pure executable >16 belong >0 not stripped 0 belong 0413 old sun-2 demand paged executable >16 belong >0 not stripped # # Core files. "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC # binary executed in compatibility mode under SunOS 5.x". # 0 belong 0x080456 SunOS core file >4 belong 432 (SPARC) >>132 string >\0 from '%s' >>116 belong =3 (quit) >>116 belong =4 (illegal instruction) >>116 belong =5 (trace trap) >>116 belong =6 (abort) >>116 belong =7 (emulator trap) >>116 belong =8 (arithmetic exception) >>116 belong =9 (kill) >>116 belong =10 (bus error) >>116 belong =11 (segmentation violation) >>116 belong =12 (bad argument to system call) >>116 belong =29 (resource lost) >>120 belong x (T=%dK, >>124 belong x D=%dK, >>128 belong x S=%dK) >4 belong 826 (68K) >>128 string >\0 from '%s' >4 belong 456 (SPARC 4.x BCP) >>152 string >\0 from '%s' # # Sun rasterfiles # # XXX - byte order? What about the 386i? # 0 string \x59\xa6\x6a\x95 rasterfile >4 belong >0 %d >8 belong >0 x %d >12 belong >0 x %d >20 belong 0 old format >20 belong 2 compressed >24 belong 1 with color map # # Terminfo # # XXX - byte order for screen images? # 0 string \032\001 Compiled terminfo entry 0 short 0433 Curses screen image 0 short 0434 Curses screen image # # magic.tex: # # XXX - needs byte-endian stuff (big-endian and little-endian DVI?) # # From # Although we may know the offset of certain text fields in TeX DVI # and font files, we can't use them reliably because they are not # zero terminated. [but we do anyway, christos] 0 leshort 0x02f7 TeX DVI file data >16 string >\0 (%s) 0 string \367\203 TeX generic font data 0 string \367\131 TeX packed font data >3 string >\0 (%s) 0 string \367\312 TeX virtual font data 0 string This\ is\ TeX, TeX transcript text 0 string This\ is\ METAFONT, METAFONT transcript text # There is no way to detect TeX Font Metric (*.tfm) files without # breaking them apart and reading the data. The following patterns # match most *.tfm files generated by METAFONT or afm2tfm. 2 string \000\021 TeX font metric data 2 string \000\022 TeX font metric data >34 string >\0 (%s) # Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com) 0 string \\input\ texinfo Texinfo source text 0 string This\ is\ Info\ file GNU Info text # # correct TeX magic for Linux (and maybe more) # from Peter Tobias (tobias@server.et-inf.fho-emden.de) # 0 short 0x02f7 TeX DVI File >16 string >\0 (%s) 0 short 0x59f7 TeX packed font data >3 string >\0 (%s) 2 string \000\022 TeX font metric data >33 string >\0 (%s) # TeX document additions from Daniel Quinlan, quinlan@yggdrasil.com 0 string \\input TeX or derivative document text 0 string \\chapter TeX or derivative document text 0 string \\documentstyle TeX or derivative document text 0 string \\section TeX or derivative document text 0 string \\setlength TeX or derivative document text # # magic.tex: # # XXX - needs byte-endian stuff (big-endian and little-endian DVI?) # # From # Although we may know the offset of certain text fields in TeX DVI # and font files, we can't use them reliably because they are not # zero terminated. [but we do anyway, christos] 0 string \367\002 TeX DVI file >16 string >\0 (%s) 0 string \367\203 TeX generic font data 0 string \367\131 TeX packed font data >4 string >\0 (%s) 0 string \367\312 TeX virtual font data 0 string This\ is\ TeX, TeX transcript text 0 string This\ is\ METAFONT, METAFONT transcript text # There is no way to detect TeX Font Metric (*.tfm) files without # breaking them apart and reading the data. The following patterns # match most *.tfm files generated by METAFONT or afm2tfm. 2 string \000\021 TeX font metric data 2 string \000\022 TeX font metric data >34 string >\0 (%s) # # time zone data, from Daniel Quinlan (quinlan@yggdrasil.com) # this will work on Linux, SunOS, and others 27 byte 1 time zone data 27 byte 2 time zone data # # magic.troff # updated by Daniel Quinlan (quinlan@yggdrasil.com) # troff input 0 string .\\" troff or preprocessor input text 0 string '\\" troff or preprocessor input text 0 string '.\\" troff or preprocessor input text 0 string \\" troff or preprocessor input text # ditroff intermediate output text 0 string x\ T ditroff text >4 string cat for the C/A/T phototypesetter >4 string ps for PostScript >4 string dvi for DVI >4 string ascii for ASCII >4 string lj4 for LaserJet 4 >4 string latin1 for ISO 8859-1 (Latin 1) >4 string X75 for xditview at 75dpi >>7 string -12 (12pt) >4 string X100 for xditview at 100dpi >>8 string -12 (12pt) # output data formats 0 string \100\357 very old (C/A/T) troff output data # # magic.troff: # 0 string \100\357 very old (C/A/T) troff output data 0 string ' [nt]roff, tbl, or eqn input text # other typesetting magic 0 string Interpress/Xerox Xerox InterPress data >16 string / (version >>17 string >\0 %s) # other typesetting magic 0 string \100\357 very old (C/A/T) troff output data 0 string Interpress/Xerox Xerox InterPress data >16 string / (version >>17 string >\0 %s) # # magic.unknown: Unknown machine magic # # XXX - this probably should be pruned, as it'll match PDP-11 and # VAX image formats. # # 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure, # respectively). # # 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't # have the "version %ld", which may be a bogus COFFism (I don't think # there ever was COFF for the PDP-11). # # 0x10B is 0413; that's VAX demand-paged, but this is a short, not a # long, as it would be on a VAX. # # 0x10C is 0414, 0x10D is 0415, and 0x10E is 416; those *are* unknown. # 0 short 0x107 unknown machine executable >8 short >0 not stripped >15 byte >0 - version %ld 0 short 0x108 unknown pure executable >8 short >0 not stripped >15 byte >0 - version %ld 0 short 0x109 PDP-11 separate I&D >8 short >0 not stripped >15 byte >0 - version %ld 0 short 0x10b unknown pure executable >8 short >0 not stripped >15 byte >0 - version %ld 0 long 0x10c unknown demand paged pure executable >16 long >0 not stripped 0 long 0x10d unknown demand paged pure executable >16 long >0 not stripped 0 long 0x10e unknown readable demand paged pure executable 0 string begin uuencoded mail text # Btoa(1) is an alternative to uuencode that requires less space. 0 string xbtoa\ Begin btoa'd text # Herewith many of the object file formats used by USG systems. # Most have been moved to files for a particular processor, # and deleted if they duplicate other entries. # 0 short 0610 Perkin-Elmer executable # # magic.pdp: VAX executable/object and APL workspace # 0 lelong 0101557 VAX single precision APL workspace 0 lelong 0101556 VAX double precision APL workspace # # VAX a.out (32V, BSD) # 0 lelong 0407 VAX executable >16 lelong >0 not stripped 0 lelong 0410 VAX pure executable >16 lelong >0 not stripped 0 lelong 0413 VAX demand paged pure executable >16 lelong >0 not stripped 0 lelong 0420 VAX demand paged (first page unmapped) pure executable >16 lelong >0 not stripped # # VAX COFF # # The `versions' should be un-commented if they work for you. # (Was the problem just one of endianness?) # 0 leshort 0570 VAX COFF executable >12 lelong >0 not stripped >22 leshort >0 - version %ld 0 leshort 0575 VAX COFF pure executable >12 lelong >0 not stripped >22 leshort >0 - version %ld # # magic.visx: Visx format file # 0 short 0x5555 VISX image file >2 byte 0 (zero) >2 byte 1 (unsigned char) >2 byte 2 (short integer) >2 byte 3 (float 32) >2 byte 4 (float 64) >2 byte 5 (signed char) >2 byte 6 (bit-plane) >2 byte 7 (classes) >2 byte 8 (statistics) >2 byte 10 (ascii text) >2 byte 15 (image segments) >2 byte 100 (image set) >2 byte 101 (unsigned char vector) >2 byte 102 (short integer vector) >2 byte 103 (float 32 vector) >2 byte 104 (float 64 vector) >2 byte 105 (signed char vector) >2 byte 106 (bit plane vector) >2 byte 121 (feature vector) >2 byte 122 (feature vector library) >2 byte 124 (chain code) >2 byte 126 (bit vector) >2 byte 130 (graph) >2 byte 131 (adjacency graph) >2 byte 132 (adjacency graph library) >2 string .VISIX (ascii text) # # magic.x11 # # I think this is byte-order-dependent; if so, it should become: # # 0 belong 00000004 X11 big-endian snf font # 0 lelong 00000004 X11 little-endian snf font # 0 long 00000004 X11 snf font # some X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) 0 string \001fcp X11 font data 0 string D1.0\015\012\000\000 X11 Speedo font data # # magic.x11 # # I think this is byte-order-dependent; if so, it should become: # # 0 belong 00000004 X11 big-endian snf font # 0 lelong 00000004 X11 little-endian snf font # 0 long 00000004 X11 snf font # # Zilog Z8000. # # Was it big-endian or little-endian? My Product Specification doesn't # say. # 0 long 0xe807 object file (z8000 a.out) 0 long 0xe808 pure object file (z8000 a.out) 0 long 0xe809 separate object file (z8000 a.out) 0 long 0xe805 overlay object file (z8000 a.out) # From # These are the /etc/magic entries to decode datafiles as used for the # ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a # ZyXEL-defined standard) 0 string ZyXEL\002 ZyXEL voice data >10 byte 0 - CELP encoding >10 byte 1 - ADPCM2 encoding >10 byte 2 - ADPCM3 encoding