Improve flash detection (Christoph Biedl)

file · Feb 7, 2017 · 5b7e2a9 · 5b7e2a9
1 parent 781a535
commit 5b7e2a9
Showing 1 changed file with 37 additions and 15 deletions.
diff --git a/magic/Magdir/flash b/magic/Magdir/flash
@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: flash,v 1.10 2014/03/06 16:07:24 christos Exp $
+# $File: flash,v 1.11 2014/05/02 00:26:49 christos Exp $
 # flash:	file(1) magic for Macromedia Flash file format
 #
 # See
@@ -11,22 +11,44 @@
 #
 
 0   name        swf-details
->0	string		F		Macromedia Flash data
-!:mime	application/x-shockwave-flash
->0	string		C		Macromedia Flash data (compressed)
-!:mime	application/x-shockwave-flash
->0	string		Z		Macromedia Flash data (lzma compressed)
-!:mime	application/x-shockwave-flash
->3   byte        x      \b, version %d
 
-1   string      WS
->4  lelong      !0
->>3 byte        255 Suspicious
->>>0    use     swf-details
+>0      string      F
+>>8     byte&0xfd   0x08    Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+>>8     byte&0xfe   0x10    Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+>>8     byte        0x18    Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+>>8     beshort&ff87 0x2000 Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+>>8     beshort&ffe0 0x3000 Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+>>8     byte&0x7    0
+>>>8    ubyte       >0x2f
+>>>>9   ubyte       <0x20   Macromedia Flash data
+!:mime  application/x-shockwave-flash
+>>>>>3  byte        x       \b, version %d
+
+>0      string      C
+>>8     byte        0x78    Macromedia Flash data (compressed)
+!:mime  application/x-shockwave-flash
+>>>3    byte        x       \b, version %d
+
+>0      string      Z
+>>8     byte        0x5d    Macromedia Flash data (lzma compressed)
+!:mime  application/x-shockwave-flash
+>>>3    byte        x      \b, version %d
 
->>3 ubyte       <32
->>>3 ubyte      !0
->>>>0   use     swf-details
+
+1   string      WS
+>4  ulelong     >14
+>>3 ubyte       !0
+>>>0   use      swf-details
 
 # From: Cal Peake <cp@absolutedigital.net>
 0	string		FLV\x01		Macromedia Flash Video