Skip to content

Commit

Permalink
MFV r273688:
Browse files Browse the repository at this point in the history 
Update filesystems magic.  This fixes a regression introduced by
libmagic 5.19 which prevents file(1) to show more verbose information
about a MBR.

Submitted by:	madpilot
MFC after:	2 weeks
  • Loading branch information
@delphij
delphij committed Oct 26, 2014
1 parent 7e13094 commit ed6a185
Showing 1 changed file with 101 additions and 43 deletions.
144 changes: 101 additions & 43 deletions contrib/file/magic/Magdir/filesystems
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#------------------------------------------------------------------------------
# $File: filesystems,v 1.95 2014/06/03 19:17:27 christos Exp $
# $File: filesystems,v 1.106 2014/10/23 17:17:09 christos Exp $
# filesystems: file(1) magic for different filesystems
#
0 name partid
Expand Down Expand Up @@ -254,19 +254,13 @@
30 search/481 \x55\xAA
# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
# DOS BPB information (70) and after DOS floppy (120) like in previous file version
!:strength +72
!:strength +65
# for sector sizes < 512 Bytes
>11 uleshort <512
>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector
# for sector sizes with 512 or more Bytes
>0x1FE leshort 0xAA55 DOS/MBR boot sector
# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
# only for sector sizes with 512 or more Bytes
0x1FE leshort 0xAA55
#
# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
!:strength +21
>2 string OSBS \b, OS/BS MBR
>2 string OSBS OS/BS MBR
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
# and http://en.wikipedia.org/wiki/Master_Boot_Record
# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
Expand Down Expand Up @@ -538,6 +532,8 @@
>>>514 string !HdrS
# not BeOS
>>>>422 string !Be\ Boot\ Loader
>>>>>32769 string CD001
>>>>>>0 use cdrom
# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
>>>>>0 ubelong&0xFD000000 =0xE9000000
# AdvanceMAME mbr
Expand Down Expand Up @@ -1043,7 +1039,7 @@
>>>>>>466 ubyte <0x10
>>>>>>>466 ubyte 0x05 \b, extended partition table
>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
>>>>>>>466 ubyte 0x0 \b, extended partition table (last)
>>>>>>>466 ubyte 0x0 \b, extended partition table (last)

# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011

Expand Down Expand Up @@ -1236,6 +1232,7 @@
>>>>>181 search/166 Error\ \0
# "a: disk" , "Fn: diskn" or "NetBSD MBR boot"
>>>>>>&3 string x \b,"%s"
>>>446 use partition-table
# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
# assembler instructions: jmp short 0x58;nop;ASCII
Expand Down Expand Up @@ -1353,18 +1350,19 @@
# minimal short forward jump found 0x29 for bootloaders or 0x0
# maximal short forward jump is 0x7f
# OEM-ID is empty or contain readable bytes
0 ulelong&0x804000E9 0x000000E9
0 ulelong&0x804000E9 0x000000E9
!:strength +60
# mtools-3.9.8/msdos.h
# usual values are marked with comments to get only informations of strange FAT systems
# valid sectorsize must be a power of 2 from 32 to 32768
>11 uleshort&0xf001f 0
>11 uleshort&0x001f 0
>>11 uleshort <32769
>>>11 uleshort >31
>>>>21 ubyte&0xf0 0xF0
>>>>>0 ubyte 0xEB
>>>>>0 ubyte 0xEB DOS/MBR boot sector
>>>>>>1 ubyte x \b, code offset 0x%x+2
>>>>>0 ubyte 0xE9
>>>>>>1 uleshort x \b, code offset 0x%x+2
>>>>>>1 uleshort x \b, code offset 0x%x+3
>>>>>3 string >\0 \b, OEM-ID "%-.8s"
#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
>>>>>>8 string IHC \b cached by Windows 9M
Expand All @@ -1373,10 +1371,11 @@
>>>>>11 uleshort <512 \b, Bytes/sector %u
>>>>>13 ubyte >1 \b, sectors/cluster %u
#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies)
>>>>>82 string FAT32
# for lazy FAT32 implementation like Transcend digital photo frame PF830
>>>>>82 string/c fat32
>>>>>>14 uleshort !32 \b, reserved sectors %u
#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32)
>>>>>82 string !FAT32
>>>>>82 string/c !fat32
>>>>>>14 uleshort >1 \b, reserved sectors %u
#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16)
#>>>>>>14 uleshort 0 \b, reserved sectors %u (usual NTFS)
Expand All @@ -1399,24 +1398,29 @@
>>>>>26 ubyte =1 \b, heads %u
# valid only for sector sizes with more then 32 Bytes
>>>>>11 uleshort >32
# skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk
>>>>>>38 ubyte !0x70
# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
# skip for values 2,2Ah,70h,73h,DFh
# and continue for extended boot signature values 0,28h,29h,80h
>>>>>>38 ubyte&0x56 =0
>>>>>>>28 ulelong >0 \b, hidden sectors %u
#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy)
>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB)
#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB)
# FAT<32 bit specific
>>>>>>>82 string !FAT32
>>>>>>>82 string/c !fat32
#>>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk)
#>>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy)
>>>>>>>>36 ubyte !0x80
>>>>>>>>>36 ubyte !0 \b, physical drive 0x%x
# VGA-copy CRC or
# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
>>>>>>>>37 ubyte >0 \b, reserved 0x%x
#>>>>>>>>37 ubyte =0 \b, reserved 0x%x
# value is 0x80 for NTFS
# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
>>>>>>>>38 ubyte !0x29 \b, dos < 4.0 BootSector (0x%x)
>>>>>>>>38 ubyte =0x29
>>>>>>>>38 ubyte&0xFE =0x28
>>>>>>>>>39 ulelong x \b, serial number 0x%x
>>>>>>>>38 ubyte =0x29
>>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s"
>>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s"
>>>>>>>>>43 string =NO\ NAME \b, unlabeled
Expand All @@ -1426,11 +1430,35 @@
# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
# otherwise FAT is 16 bit.
# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
>>>>>>54 string FAT \b, FAT
>>>>>>>54 string FAT12 \b (12 bit)
>>>>>>>54 string FAT16 \b (16 bit)
>>>>>82 string/c !fat32
>>>>>>54 string FAT12 \b, FAT (12 bit)
>>>>>>54 string FAT16 \b, FAT (16 bit)
>>>>>>54 default x
# determinate FAT bit size by media descriptor
# small floppies implies FAT12
>>>>>>>21 ubyte <0xF0 \b, FAT (12 bit by descriptor)
# with media descriptor F0h floppy or maybe superfloppy with FAT16
>>>>>>>21 ubyte =0xF0
# superfloppy (many sectors) implies FAT16
>>>>>>>>32 ulelong >0xFFFF \b, FAT (16 bit by descriptor+sectors)
# no superfloppy with media descriptor F0h implies FAT12
>>>>>>>>32 default x \b, FAT (12 bit by descriptor+sectors)
# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
>>>>>>>21 ubyte =0xF8
# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
>>>>>>>>19 ubequad 0xd002f80300090001 \b, FAT (12 bit by descriptor+geometry)
# hard disc with FAT12 or FAT16
>>>>>>>>19 default x \b, FAT (1Y bit by descriptor)
# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
>>>>>>>21 ubyte =0xFA
# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
>>>>>>>>19 ubequad 0x8002fa0200080001 \b, FAT (12 bit by descriptor+geometry)
# RAM disc with FAT12 or FAT16 or Tandy hard disc
>>>>>>>>19 default x \b, FAT (1Y bit by descriptor)
# others are floppy
>>>>>>>21 default x \b, FAT (12 bit by descriptor)
# FAT32 bit specific
>>>>>82 string FAT32 \b, FAT (32 bit)
>>>>>82 string/c fat32 \b, FAT (32 bit)
>>>>>>36 ulelong x \b, sectors/FAT %u
# http://technet.microsoft.com/en-us/library/cc977221.aspx
>>>>>>40 uleshort >0 \b, extension flags 0x%x
Expand All @@ -1443,9 +1471,12 @@
>>>>>>48 uleshort >1 \b, infoSector %u
#>>>>>>48 uleshort =1 \b, infoSector %u (usual)
>>>>>>48 uleshort <1 \b, infoSector %u
>>>>>>50 uleshort >6 \b, Backup boot sector %u
# 0 or 0xFFFF instead of usual 6 means no backup sector
>>>>>>50 uleshort =0xFFFF \b, no Backup boot sector
>>>>>>50 uleshort =0 \b, no Backup boot sector
#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual)
>>>>>>50 uleshort <6 \b, Backup boot sector %u
>>>>>>50 default x
>>>>>>>50 uleshort x \b, Backup boot sector %u
# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
>>>>>>52 ulelong >0 \b, reserved1 0x%x
>>>>>>56 ulelong >0 \b, reserved2 0x%x
Expand Down Expand Up @@ -1880,12 +1911,11 @@
# defect IO.SYS+MSDOS.SYS ?
#>>>>>0x162 use 2xDOS-filename

# CDROM Filesystems
# Modified for UDF by gerardo.cacciari@gmail.com
32769 string CD001 #
!:mime application/x-iso9660-image
0 name cdrom
>38913 string !NSR0 ISO 9660 CD-ROM filesystem data
!:mime application/x-iso9660-image
>38913 string NSR0 UDF filesystem data
!:mime application/x-iso9660-image
>>38917 string 1 (version 1.0)
>>38917 string 2 (version 1.5)
>>38917 string 3 (version 2.0)
Expand All @@ -1898,6 +1928,18 @@
!:mime application/x-iso9660-image
32777 string CDROM High Sierra CD-ROM filesystem data

# CDROM Filesystems
# https://en.wikipedia.org/wiki/ISO_9660
# Modified for UDF by gerardo.cacciari@gmail.com
32769 string CD001
# mime line at that position does not work
# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
!:strength -11
# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
# does not work
#!:strength +33
>0 use cdrom

# .cso files
0 string CISO Compressed ISO CD image

Expand Down Expand Up @@ -2131,7 +2173,6 @@
# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
#
1008 string DECFILE11 Files-11 On-Disk Structure
>525 byte x Level %d
>525 byte x (ODS-%d);
>1017 string A RSX-11, VAX/VMS or OpenVMS VAX file system;
>1017 string B
Expand Down Expand Up @@ -2266,14 +2307,31 @@

# UBIfs
# Linux kernel sources: fs/ubifs/ubifs-media.h
0 belong 0x31181006
>0x16 short 0 UBIfs image
>0x08 lequad x \b, sequence number %llu
>0x10 leshort x \b, length %u
>0x04 lelong x \b, CRC 0x%08x

0 belong 0x55424923
>0x04 short <2
>0x05 string \0\0\0
>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
>0x04 short x UBI image, version %u
0 lelong 0x06101831
>0x16 leshort 0 UBIfs image
>0x08 lequad x \b, sequence number %llu
>0x10 leshort x \b, length %u
>0x04 lelong x \b, CRC 0x%08x

0 lelong 0x23494255
>0x04 leshort <2
>0x05 string \0\0\0
>0x1c string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
>0x04 leshort x UBI image, version %u

# NEC PC-88 2D disk image
# From Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
0x20 ulelong&0xFFFFFEFF 0x2A0
>0x10 string \0\0\0\0\0\0\0\0\0\0
>>0x280 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
>>>0x1A ubyte&0xEF 0
>>>>0x1B ubyte&0x8F 0
>>>>>0x1B ubyte&70 <0x40
>>>>>>0x1C ulelong >0x21
>>>>>>>0 regex [[:print:]]* NEC PC-88 disk image, name=%s
>>>>>>>>0x1B ubyte 0 \b, media=2D
>>>>>>>>0x1B ubyte 0x10 \b, media=2DD
>>>>>>>>0x1B ubyte 0x20 \b, media=2HD
>>>>>>>>0x1B ubyte 0x30 \b, media=1D
>>>>>>>>0x1B ubyte 0x40 \b, media=1DD
>>>>>>>>0x1A ubyte 0x10 \b, write-protected

0 comments on commit ed6a185

Please sign in to comment.