magic(F)

magic -- database of file type headers

Format

# comment
offset type [operator]value description
[>offset type [operator]value description]
.
.
.

Description

A ``magic'' number within a file encodes the use of that file. Although it is referred to as a magic number, it can also be a string of ASCII characters.

Many files in the UNIX system have standard headers that contain a magic number. For example, the magic number may indicate that it is executable only on a particular machine architecture, or that it is a file archive. The exec system call, debuggers such as dbXtra, object library archivers such as ar, and file archivers such as cpio look for a valid header in files presented to them for processing. Programs that can handle several different file formats can switch how they deal with a file depending on its magic number.

The file /etc/magic is a database of magic numbers used by file (and utilities such as more) to help it to determine the probable use to which a regular file is put. If none of the magic numbers in /etc/magic matches, file applies other heuristic tests on the first 512 bytes of the file. For example, /etc/magic does not define magic numbers for data files, ASCII or English text files, and assembler, C, or shell programs.

/etc/magic contains four fields separated by tab characters:

offset

The number of bytes into the file where the magic number may be found. file stops when it finds a listed magic number value that matches the contents of the file at the specified offset, and prints its description.

A ``>'' character preceding offset indicates a continuation of the definition of the magic number characteristics of a header format. After finding a match, file tries each continuation line in succession, and prints its description if it also matches. The continuation lines are terminated by the occurrence of a line not preceded by ``>''.

offset's value is specified in decimal, octal (with a leading 0), or hexadecimal (with a leading 0x).

type

The length of the magic number expressed as one of the following types:

byte: 1 byte (8 bits)
long: long word (4 bytes)
short: short word (2 bytes)
string: any length; must not be quoted and cannot contain tabs or newlines

value

The value of the magic number in decimal, octal, or hexadecimal. The following operators modify the interpretation of value for types byte, long, and short only:

=: exact match required (default)
>: match for greater than value
<: match for less than value
x: match any value
&: match if all bits defined by value are set
^: match if none or only some of the bits defined by value are set

The type string always requires an exact match.

description

The type of file indicated by its magic value. This field may contain a single format specification in the style of the printf system call such as %s for type string, and %ld, %lo, or %lx for the other types. (Internally, the numeric types are converted to signed longs.) file uses the format specification to print the magic number that it finds.

All comment lines in /etc/magic begin with a number sign ``#''.

Empty lines are ignored.

You can create your own magic file as described in ``Examples''.

Examples

Some example entries from /etc/magic:

   0x61	long		0x20000000	tar archive
   0x61	long		0x30000000	tar archive
   0x61	long		0x31000000	tar archive
   0	short		070707		cpio archive
   0	short		0xa01f		LZH-compressed data
   0	string		MZ		DOS executable (EXE)
   0	short 		=0514		iAPX 386 executable

The /etc/magic entries for tar archives could be modified to display the magic number value found. In this example, the values would be printed in decimal, octal, and hexadecimal respectively for the three archive types:

   0x61	long		0x20000000	tar archive - dec magic %ld
   0x61	long		0x30000000	tar archive - oct magic %lo
   0x61	long		0x31000000	tar archive - hex magic %lx

The following entry from /etc/magic demonstrates the use of continuation lines to extract more information from a file:

   0	short 		=0514		iAPX 386 executable
   >12	long 		>0		not stripped
   >22	short		>0		- version %ld

If file(C) identifies a file as an iAPX 386 executable (in COFF or Common Object File Format), it looks at the values of the long and short words at offsets of 12 and 22 bytes. If the long word is greater than zero, file reports that the executable has not been stripped of its symbol table and line number information. A non-zero value in the short word is interpreted as a version number placed in the file by an assembler or by a linker.

The file utility does not recognize PostScript headers. To allow it to do so, you can create your own magic file by copying /etc/magic and adding the following line to it:

   0	string		%!		PostScript text

file will now identify PostScript files if you tell it to use your magic file:

file -m my_magic are_you_PS are_you_PS_2

Files

/etc/magic full pathname of system magic file

magic(F)

Format

Description

Examples

Files

See also