Skip to content
Fetching contributors…
Cannot retrieve contributors at this time
10811 lines (9927 sloc) 380 KB
# Magic
# Magic data for file(1) command.
# Machine-generated from src/cmd/file/magdir/*; edit there only!
# Format is described in magic(files), where:
# files is 5 on V7 and BSD, 4 on SV, and ?? in the SVID.
#------------------------------------------------------------------------------
# Localstuff: file(1) magic for locally observed files
#
# $Id: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
# Add any locally observed files here. Remember:
# text if readable, executable if runnable binary, data if unreadable.
#------------------------------------------------------------------------------
# zyxel: file(1) magic for ZyXEL modems
#
# From <rob@pe1chl.ampr.org>
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
# ZyXEL-defined standard)
0 string ZyXEL\002 ZyXEL voice data
>10 byte 0 - CELP encoding
>10 byte&0x0B 1 - ADPCM2 encoding
>10 byte&0x0B 2 - ADPCM3 encoding
>10 byte&0x0B 3 - ADPCM4 encoding
>10 byte&0x0B 8 - New ADPCM3 encoding
>10 byte&0x04 4 with resync
#------------------------------------------------------------------------------
# file(1) magic(5) data for xdelta Josh MacDonald <jmacd@CS.Berkeley.EDU>
#
0 string %XDELTA% XDelta binary patch file 0.14
0 string %XDZ000% XDelta binary patch file 0.18
0 string %XDZ001% XDelta binary patch file 0.20
0 string %XDZ002% XDelta binary patch file 1.0
0 string %XDZ003% XDelta binary patch file 1.0.4
0 string %XDZ004% XDelta binary patch file 1.1
#------------------------------------------------------------------------
# sysex: file(1) magic for MIDI sysex files
#
#
0 byte 0xF0 SysEx File -
# North American Group
>1 byte 0x01 Sequential
>1 byte 0x02 IDP
>1 byte 0x03 OctavePlateau
>1 byte 0x04 Moog
>1 byte 0x05 Passport
>1 byte 0x06 Lexicon
>1 byte 0x07 Kurzweil
>1 byte 0x08 Fender
>1 byte 0x09 Gulbransen
>1 byte 0x0a AKG
>1 byte 0x0b Voyce
>1 byte 0x0c Waveframe
>1 byte 0x0d ADA
>1 byte 0x0e Garfield
>1 byte 0x0f Ensoniq
>1 byte 0x10 Oberheim
>1 byte 0x11 Apple
>1 byte 0x12 GreyMatter
>1 byte 0x14 PalmTree
>1 byte 0x15 JLCooper
>1 byte 0x16 Lowrey
>1 byte 0x17 AdamsSmith
>1 byte 0x18 E-mu
>1 byte 0x19 Harmony
>1 byte 0x1a ART
>1 byte 0x1b Baldwin
>1 byte 0x1c Eventide
>1 byte 0x1d Inventronics
>1 byte 0x1f Clarity
# European Group
>1 byte 0x21 SIEL
>1 byte 0x22 Synthaxe
>1 byte 0x24 Hohner
>1 byte 0x25 Twister
>1 byte 0x26 Solton
>1 byte 0x27 Jellinghaus
>1 byte 0x28 Southworth
>1 byte 0x29 PPG
>1 byte 0x2a JEN
>1 byte 0x2b SSL
>1 byte 0x2c AudioVertrieb
>1 byte 0x2f ELKA
>>3 byte 0x09 EK-44
>1 byte 0x30 Dynacord
>1 byte 0x33 Clavia
>1 byte 0x39 Soundcraft
>1 byte 0x3e Waldorf
>>3 byte 0x7f Microwave I
# Japanese Group
>1 byte 0x40 Kawai
>>3 byte 0x20 K1
>>3 byte 0x22 K4
>1 byte 0x41 Roland
>>3 byte 0x14 D-50
>>3 byte 0x2b U-220
>>3 byte 0x02 TR-707
>1 byte 0x42 Korg
>>3 byte 0x19 M1
>1 byte 0x43 Yamaha
>1 byte 0x44 Casio
>1 byte 0x46 Kamiya
>1 byte 0x47 Akai
>1 byte 0x48 Victor
>1 byte 0x49 Mesosha
>1 byte 0x4b Fujitsu
>1 byte 0x4c Sony
>1 byte 0x4e Teac
>1 byte 0x50 Matsushita
>1 byte 0x51 Fostex
>1 byte 0x52 Zoom
>1 byte 0x54 Matsushita
>1 byte 0x57 Acoustic tech. lab.
>1 belong&0xffffff00 0x00007400 Ta Horng
>1 belong&0xffffff00 0x00007500 e-Tek
>1 belong&0xffffff00 0x00007600 E-Voice
>1 belong&0xffffff00 0x00007700 Midisoft
>1 belong&0xffffff00 0x00007800 Q-Sound
>1 belong&0xffffff00 0x00007900 Westrex
>1 belong&0xffffff00 0x00007a00 Nvidia*
>1 belong&0xffffff00 0x00007b00 ESS
>1 belong&0xffffff00 0x00007c00 Mediatrix
>1 belong&0xffffff00 0x00007d00 Brooktree
>1 belong&0xffffff00 0x00007e00 Otari
>1 belong&0xffffff00 0x00007f00 Key Electronics
>1 belong&0xffffff00 0x00010000 Shure
>1 belong&0xffffff00 0x00010100 AuraSound
>1 belong&0xffffff00 0x00010200 Crystal
>1 belong&0xffffff00 0x00010300 Rockwell
>1 belong&0xffffff00 0x00010400 Silicon Graphics
>1 belong&0xffffff00 0x00010500 Midiman
>1 belong&0xffffff00 0x00010600 PreSonus
>1 belong&0xffffff00 0x00010800 Topaz
>1 belong&0xffffff00 0x00010900 Cast Lightning
>1 belong&0xffffff00 0x00010a00 Microsoft
>1 belong&0xffffff00 0x00010b00 Sonic Foundry
>1 belong&0xffffff00 0x00010c00 Line 6
>1 belong&0xffffff00 0x00010d00 Beatnik Inc.
>1 belong&0xffffff00 0x00010e00 Van Koerving
>1 belong&0xffffff00 0x00010f00 Altech Systems
>1 belong&0xffffff00 0x00011000 S & S Research
>1 belong&0xffffff00 0x00011100 VLSI Technology
>1 belong&0xffffff00 0x00011200 Chromatic
>1 belong&0xffffff00 0x00011300 Sapphire
>1 belong&0xffffff00 0x00011400 IDRC
>1 belong&0xffffff00 0x00011500 Justonic Tuning
>1 belong&0xffffff00 0x00011600 TorComp
>1 belong&0xffffff00 0x00011700 Newtek Inc.
>1 belong&0xffffff00 0x00011800 Sound Sculpture
>1 belong&0xffffff00 0x00011900 Walker Technical
>1 belong&0xffffff00 0x00011a00 Digital Harmony
>1 belong&0xffffff00 0x00011b00 InVision
>1 belong&0xffffff00 0x00011c00 T-Square
>1 belong&0xffffff00 0x00011d00 Nemesys
>1 belong&0xffffff00 0x00011e00 DBX
>1 belong&0xffffff00 0x00011f00 Syndyne
>1 belong&0xffffff00 0x00012000 Bitheadz
>1 belong&0xffffff00 0x00012100 Cakewalk
>1 belong&0xffffff00 0x00012200 Staccato
>1 belong&0xffffff00 0x00012300 National Semicon.
>1 belong&0xffffff00 0x00012400 Boom Theory
>1 belong&0xffffff00 0x00012500 Virtual DSP Corp
>1 belong&0xffffff00 0x00012600 Antares
>1 belong&0xffffff00 0x00012700 Angel Software
>1 belong&0xffffff00 0x00012800 St Louis Music
>1 belong&0xffffff00 0x00012900 Lyrrus dba G-VOX
>1 belong&0xffffff00 0x00012a00 Ashley Audio
>1 belong&0xffffff00 0x00012b00 Vari-Lite
>1 belong&0xffffff00 0x00012c00 Summit Audio
>1 belong&0xffffff00 0x00012d00 Aureal Semicon.
>1 belong&0xffffff00 0x00012e00 SeaSound
>1 belong&0xffffff00 0x00012f00 U.S. Robotics
>1 belong&0xffffff00 0x00013000 Aurisis
>1 belong&0xffffff00 0x00013100 Nearfield Multimedia
>1 belong&0xffffff00 0x00013200 FM7 Inc.
>1 belong&0xffffff00 0x00013300 Swivel Systems
>1 belong&0xffffff00 0x00013400 Hyperactive
>1 belong&0xffffff00 0x00013500 MidiLite
>1 belong&0xffffff00 0x00013600 Radical
>1 belong&0xffffff00 0x00013700 Roger Linn
>1 belong&0xffffff00 0x00013800 Helicon
>1 belong&0xffffff00 0x00013900 Event
>1 belong&0xffffff00 0x00013a00 Sonic Network
>1 belong&0xffffff00 0x00013b00 Realtime Music
>1 belong&0xffffff00 0x00013c00 Apogee Digital
>1 belong&0xffffff00 0x00202b00 Medeli Electronics
>1 belong&0xffffff00 0x00202c00 Charlie Lab
>1 belong&0xffffff00 0x00202d00 Blue Chip Music
>1 belong&0xffffff00 0x00202e00 BEE OH Corp
>1 belong&0xffffff00 0x00202f00 LG Semicon America
>1 belong&0xffffff00 0x00203000 TESI
>1 belong&0xffffff00 0x00203100 EMAGIC
>1 belong&0xffffff00 0x00203200 Behringer
>1 belong&0xffffff00 0x00203300 Access Music
>1 belong&0xffffff00 0x00203400 Synoptic
>1 belong&0xffffff00 0x00203500 Hanmesoft Corp
>1 belong&0xffffff00 0x00203600 Terratec
>1 belong&0xffffff00 0x00203700 Proel SpA
>1 belong&0xffffff00 0x00203800 IBK MIDI
>1 belong&0xffffff00 0x00203900 IRCAM
>1 belong&0xffffff00 0x00203a00 Propellerhead Software
>1 belong&0xffffff00 0x00203b00 Red Sound Systems
>1 belong&0xffffff00 0x00203c00 Electron ESI AB
>1 belong&0xffffff00 0x00203d00 Sintefex Audio
>1 belong&0xffffff00 0x00203e00 Music and More
>1 belong&0xffffff00 0x00203f00 Amsaro
>1 belong&0xffffff00 0x00204000 CDS Advanced Technology
>1 belong&0xffffff00 0x00204100 Touched by Sound
>1 belong&0xffffff00 0x00204200 DSP Arts
>1 belong&0xffffff00 0x00204300 Phil Rees Music
>1 belong&0xffffff00 0x00204400 Stamer Musikanlagen GmbH
>1 belong&0xffffff00 0x00204500 Soundart
>1 belong&0xffffff00 0x00204600 C-Mexx Software
>1 belong&0xffffff00 0x00204700 Klavis Tech.
>1 belong&0xffffff00 0x00204800 Noteheads AB
0 string T707 Roland TR-707 Data
#------------------------------------------------------------------------------
# sccs: file(1) magic for SCCS archives
#
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
# \001c date and time created 87/09/23 08:09:20 by ian
# \001e
# \001u
# \001U
# ... etc.
# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
# *Sigh*. And these both came from various parts of the USG.
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
# and we don't have regular expression matching yet.
# Hence the following official kludge:
8 string \001s\ SCCS archive data
#------------------------------------------------------------------------------
# allegro: file(1) magic for Allegro datafiles
# Toby Deshane <hac@shoelace.digivill.net>
#
0 belong 0x736C6821 Allegro datafile (packed)
0 belong 0x736C682E Allegro datafile (not packed/autodetect)
0 belong 0x736C682B Allegro datafile (appended exe data)
#------------------------------------------------------------------------------
# file(1) magic for cvs(1) files
# From Hendrik Scholz <hendrik@scholz.net>
0 string /1\ :pserver: cvs password text file
#------------------------------------------------------------------------------
# vicar: file(1) magic for VICAR files.
#
# From: Ossama Othman <othman@astrosun.tn.cornell.edu
# VICAR is JPL's in-house spacecraft image processing program
# VICAR image
0 string LBLSIZE= VICAR image data
>32 string BYTE \b, 8 bits = VAX byte
>32 string HALF \b, 16 bits = VAX word = Fortran INTEGER*2
>32 string FULL \b, 32 bits = VAX longword = Fortran INTEGER*4
>32 string REAL \b, 32 bits = VAX longword = Fortran REAL*4
>32 string DOUB \b, 64 bits = VAX quadword = Fortran REAL*8
>32 string COMPLEX \b, 64 bits = VAX quadword = Fortran COMPLEX*8
# VICAR label file
43 string SFDU_LABEL VICAR label file
#------------------------------------------------------------------------------
# varied.out: file(1) magic for various USG systems
#
# Herewith many of the object file formats used by USG systems.
# Most have been moved to files for a particular processor,
# and deleted if they duplicate other entries.
#
0 short 0610 Perkin-Elmer executable
# AMD 29K
0 beshort 0572 amd 29k coff noprebar executable
0 beshort 01572 amd 29k coff prebar executable
0 beshort 0160007 amd 29k coff archive
# Cray
6 beshort 0407 unicos (cray) executable
# Ultrix 4.3
596 string \130\337\377\377 Ultrix core file
>600 string >\0 from '%s'
# BeOS and MAcOS PEF executables
# From: hplus@zilker.net (Jon Watte)
0 string Joy!peffpwpc header for PowerPC PEF executable
#
# ava assembler/linker Uros Platise <uros.platise@ijs.si>
0 string avaobj AVR assembler object code
>7 string >\0 version '%s'
# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
0 string gmon GNU prof performance data
>4 long x - version %ld
# From: Dave Pearson <davep@davep.org>
# Harbour <URL:http://www.harbour-project.org/> HRB files.
0 string \xc0HRB Harbour HRB file
>4 short x version %d
# From: "Stefan A. Haubenthal" <polluks@web.de>
0 belong 0x000001EB Plan 9 executable
#------------------------------------------------------------------------------
# c64: file(1) magic for various commodore 64 related files
#
# From <doj@cubic.org>
0x16500 belong 0x12014100 D64 Image
0x16500 belong 0x12014180 D71 Image
0x61800 belong 0x28034400 D81 Image
0 string C64\40CARTRIDGE CCS C64 Emultar Cartridge Image
0 belong 0x43154164 X64 Image
0 string GCR-1541 GCR Image
>8 byte x version: $i
>9 byte x tracks: %i
9 string PSUR ARC archive (c64)
2 string -LH1- LHA archive (c64)
0 string C64File PC64 Emulator file
>8 string >\0 "%s"
0 string C64Image PC64 Freezer Image
0 beshort 0x38CD C64 PCLink Image
0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot
0 belong 0xFF424CFF WRAptor packer (c64)
#------------------------------------------------------------------------------
# games: file(1) for games
# Thomas M. Ott (ThMO)
1 string =WAD DOOM data,
>0 string =I main wad
>0 string =P patch wad
>0 byte x unknown junk
# Fabio Bonelli <fabiobonelli@libero.it>
# Quake II - III data files
0 string IDP2 Quake II 3D Model file,
>20 long x %lu skin(s),
>8 long x (%lu x
>12 long x %lu),
>40 long x %lu frame(s),
>16 long x Frame size %lu bytes,
>24 long x %lu vertices/frame,
>28 long x %lu texture coordinates,
>32 long x %lu triangles/frame
0 string IBSP Quake
>4 long 0x26 II Map file (BSP)
>4 long 0x2E III Map file (BSP)
0 string IDS2 Quake II SP2 sprite file
#---------------------------------------------------------------------------
# Doom and Quake
# submitted by Nicolas Patrois
# DOOM
0 string IWAD DOOM or DOOM ][ world
0 string PWAD DOOM or DOOM ][ extension world
0 string \xcb\x1dBoom\xe6\xff\x03\x01 Boom or linuxdoom demo
# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
24 string LxD\ 203 Linuxdoom save
>0 string x , name=%s
>44 string x , world=%s
# Quake
0 string PACK Quake I or II world or extension
#0 string -1\x0a Quake I demo
#>30 string x version %.4s
#>61 string x level %s
#0 string 5\x0a Quake I save
# The levels
# Quake 1
0 string 5\x0aIntroduction Quake I save: start Introduction
0 string 5\x0athe_Slipgate_Complex Quake I save: e1m1 The slipgate complex
0 string 5\x0aCastle_of_the_Damned Quake I save: e1m2 Castle of the damned
0 string 5\x0athe_Necropolis Quake I save: e1m3 The necropolis
0 string 5\x0athe_Grisly_Grotto Quake I save: e1m4 The grisly grotto
0 string 5\x0aZiggurat_Vertigo Quake I save: e1m8 Ziggurat vertigo (secret)
0 string 5\x0aGloom_Keep Quake I save: e1m5 Gloom keep
0 string 5\x0aThe_Door_To_Chthon Quake I save: e1m6 The door to Chthon
0 string 5\x0aThe_House_of_Chthon Quake I save: e1m7 The house of Chthon
0 string 5\x0athe_Installation Quake I save: e2m1 The installation
0 string 5\x0athe_Ogre_Citadel Quake I save: e2m2 The ogre citadel
0 string 5\x0athe_Crypt_of_Decay Quake I save: e2m3 The crypt of decay (dopefish lives!)
0 string 5\x0aUnderearth Quake I save: e2m7 Underearth (secret)
0 string 5\x0athe_Ebon_Fortress Quake I save: e2m4 The ebon fortress
0 string 5\x0athe_Wizard's_Manse Quake I save: e2m5 The wizard's manse
0 string 5\x0athe_Dismal_Oubliette Quake I save: e2m6 The dismal oubliette
0 string 5\x0aTermination_Central Quake I save: e3m1 Termination central
0 string 5\x0aVaults_of_Zin Quake I save: e3m2 Vaults of Zin
0 string 5\x0athe_Tomb_of_Terror Quake I save: e3m3 The tomb of terror
0 string 5\x0aSatan's_Dark_Delight Quake I save: e3m4 Satan's dark delight
0 string 5\x0athe_Haunted_Halls Quake I save: e3m7 The haunted halls (secret)
0 string 5\x0aWind_Tunnels Quake I save: e3m5 Wind tunnels
0 string 5\x0aChambers_of_Torment Quake I save: e3m6 Chambers of torment
0 string 5\x0athe_Sewage_System Quake I save: e4m1 The sewage system
0 string 5\x0aThe_Tower_of_Despair Quake I save: e4m2 The tower of despair
0 string 5\x0aThe_Elder_God_Shrine Quake I save: e4m3 The elder god shrine
0 string 5\x0athe_Palace_of_Hate Quake I save: e4m4 The palace of hate
0 string 5\x0aHell's_Atrium Quake I save: e4m5 Hell's atrium
0 string 5\x0athe_Nameless_City Quake I save: e4m8 The nameless city (secret)
0 string 5\x0aThe_Pain_Maze Quake I save: e4m6 The pain maze
0 string 5\x0aAzure_Agony Quake I save: e4m7 Azure agony
0 string 5\x0aShub-Niggurath's_Pit Quake I save: end Shub-Niggurath's pit
# Quake DeathMatch levels
0 string 5\x0aPlace_of_Two_Deaths Quake I save: dm1 Place of two deaths
0 string 5\x0aClaustrophobopolis Quake I save: dm2 Claustrophobopolis
0 string 5\x0aThe_Abandoned_Base Quake I save: dm3 The abandoned base
0 string 5\x0aThe_Bad_Place Quake I save: dm4 The bad place
0 string 5\x0aThe_Cistern Quake I save: dm5 The cistern
0 string 5\x0aThe_Dark_Zone Quake I save: dm6 The dark zone
# Scourge of Armagon
0 string 5\x0aCommand_HQ Quake I save: start Command HQ
0 string 5\x0aThe_Pumping_Station Quake I save: hip1m1 The pumping station
0 string 5\x0aStorage_Facility Quake I save: hip1m2 Storage facility
0 string 5\x0aMilitary_Complex Quake I save: hip1m5 Military complex (secret)
0 string 5\x0athe_Lost_Mine Quake I save: hip1m3 The lost mine
0 string 5\x0aResearch_Facility Quake I save: hip1m4 Research facility
0 string 5\x0aAncient_Realms Quake I save: hip2m1 Ancient realms
0 string 5\x0aThe_Gremlin's_Domain Quake I save: hip2m6 The gremlin's domain (secret)
0 string 5\x0aThe_Black_Cathedral Quake I save: hip2m2 The black cathedral
0 string 5\x0aThe_Catacombs Quake I save: hip2m3 The catacombs
0 string 5\x0athe_Crypt__ Quake I save: hip2m4 The crypt
0 string 5\x0aMortum's_Keep Quake I save: hip2m5 Mortum's keep
0 string 5\x0aTur_Torment Quake I save: hip3m1 Tur torment
0 string 5\x0aPandemonium Quake I save: hip3m2 Pandemonium
0 string 5\x0aLimbo Quake I save: hip3m3 Limbo
0 string 5\x0athe_Edge_of_Oblivion Quake I save: hipdm1 The edge of oblivion (secret)
0 string 5\x0aThe_Gauntlet Quake I save: hip3m4 The gauntlet
0 string 5\x0aArmagon's_Lair Quake I save: hipend Armagon's lair
# Malice
0 string 5\x0aThe_Academy Quake I save: start The academy
0 string 5\x0aThe_Lab Quake I save: d1 The lab
0 string 5\x0aArea_33 Quake I save: d1b Area 33
0 string 5\x0aSECRET_MISSIONS Quake I save: d3b Secret missions
0 string 5\x0aThe_Hospital Quake I save: d10 The hospital (secret)
0 string 5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
0 string 5\x0aBACK_2_MALICE Quake I save: d4b Back to Malice
0 string 5\x0aArea44 Quake I save: d1c Area 44
0 string 5\x0aTakahiro_Towers Quake I save: d2 Takahiro towers
0 string 5\x0aA_Rat's_Life Quake I save: d3 A rat's life
0 string 5\x0aInto_The_Flood Quake I save: d4 Into the flood
0 string 5\x0aThe_Flood Quake I save: d5 The flood
0 string 5\x0aNuclear_Plant Quake I save: d6 Nuclear plant
0 string 5\x0aThe_Incinerator_Plant Quake I save: d7 The incinerator plant
0 string 5\x0aThe_Foundry Quake I save: d7b The foundry
0 string 5\x0aThe_Underwater_Base Quake I save: d8 The underwater base
0 string 5\x0aTakahiro_Base Quake I save: d9 Takahiro base
0 string 5\x0aTakahiro_Laboratories Quake I save: d12 Takahiro laboratories
0 string 5\x0aStayin'_Alive Quake I save: d13 Stayin' alive
0 string 5\x0aB.O.S.S._HQ Quake I save: d14 B.O.S.S. HQ
0 string 5\x0aSHOWDOWN! Quake I save: d15 Showdown!
# Malice DeathMatch levels
0 string 5\x0aThe_Seventh_Precinct Quake I save: ddm1 The seventh precinct
0 string 5\x0aSub_Station Quake I save: ddm2 Sub station
0 string 5\x0aCrazy_Eights! Quake I save: ddm3 Crazy eights!
0 string 5\x0aEast_Side_Invertationa Quake I save: ddm4 East side invertationa
0 string 5\x0aSlaughterhouse Quake I save: ddm5 Slaughterhouse
0 string 5\x0aDOMINO Quake I save: ddm6 Domino
0 string 5\x0aSANDRA'S_LADDER Quake I save: ddm7 Sandra's ladder
0 string MComprHD MAME CHD compressed hard disk image,
>12 belong x version %lu
#------------------------------------------------------------------------------
# Mavroyanopoulos Nikos <nmav@hellug.gr>
# mcrypt: file(1) magic for mcrypt 2.2.x;
0 string \0m\3 mcrypt 2.5 encrypted data,
>4 string >\0 algorithm: %s,
>>&1 leshort >0 keysize: %d bytes,
>>>&0 string >\0 mode: %s,
0 string \0m\2 mcrypt 2.2 encrypted data,
>3 byte 0 algorithm: blowfish-448,
>3 byte 1 algorithm: DES,
>3 byte 2 algorithm: 3DES,
>3 byte 3 algorithm: 3-WAY,
>3 byte 4 algorithm: GOST,
>3 byte 6 algorithm: SAFER-SK64,
>3 byte 7 algorithm: SAFER-SK128,
>3 byte 8 algorithm: CAST-128,
>3 byte 9 algorithm: xTEA,
>3 byte 10 algorithm: TWOFISH-128,
>3 byte 11 algorithm: RC2,
>3 byte 12 algorithm: TWOFISH-192,
>3 byte 13 algorithm: TWOFISH-256,
>3 byte 14 algorithm: blowfish-128,
>3 byte 15 algorithm: blowfish-192,
>3 byte 16 algorithm: blowfish-256,
>3 byte 100 algorithm: RC6,
>3 byte 101 algorithm: IDEA,
>4 byte 0 mode: CBC,
>4 byte 1 mode: ECB,
>4 byte 2 mode: CFB,
>4 byte 3 mode: OFB,
>4 byte 4 mode: nOFB,
>5 byte 0 keymode: 8bit
>5 byte 1 keymode: 4bit
>5 byte 2 keymode: SHA-1 hash
>5 byte 3 keymode: MD5 hash
#------------------------------------------------------------------------------
# archive: file(1) magic for archive formats (see also "msdos" for self-
# extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are handled in the C code.
# POSIX tar archives
257 string ustar\0 POSIX tar archive
257 string ustar\040\040\0 GNU tar archive
# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0 short 070707 cpio archive
0 short 0143561 byte-swapped cpio archive
0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
0 string 070701 ASCII cpio archive (SVR4 with no CRC)
0 string 070702 ASCII cpio archive (SVR4 with CRC)
# Debian package (needs to go before regular portable archives)
#
0 string !<arch>\ndebian
>8 string debian-split part of multipart Debian package
>8 string debian-binary Debian binary package
>68 string >\0 (format %s)
>81 string bz2 \b, uses bzip2 compression
>84 string gz \b, uses gzip compression
#>136 ledate x created: %s
# other archives
0 long 0177555 very old archive
0 short 0177555 very old PDP-11 archive
0 long 0177545 old archive
0 short 0177545 old PDP-11 archive
0 long 0100554 apl workspace
0 string =<ar> archive
# MIPS archive (needs to go before regular portable archives)
#
0 string !<arch>\n__________E MIPS archive
>20 string U with MIPS Ucode members
>21 string L with MIPSEL members
>21 string B with MIPSEB members
>19 string L and an EL hash table
>19 string B and an EB hash table
>22 string X -- out of date
0 string -h- Software Tools format archive text
#
# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0 string !<arch> current ar archive
# 0 long 0x213c6172 archive file
#
# and for SVR1 archives, we have:
#
# 0 string \<ar> System V Release 1 ar archive
# 0 string =<ar> archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0 string !<arch> current ar archive
>8 string __.SYMDEF random library
>0 belong =65538 - pre SR9.5
>0 belong =65539 - post SR9.5
>0 beshort 2 - object archive
>0 beshort 3 - shared library module
>0 beshort 4 - debug break-pointed module
>0 beshort 5 - absolute code program module
0 string \<ar> System V Release 1 ar archive
0 string =<ar> archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
0 belong 0x65ff0000 VAX 3.0 archive
0 belong 0x3c61723e VAX 5.0 archive
#
0 long 0x213c6172 archive file
0 lelong 0177555 very old VAX archive
0 leshort 0177555 very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0 lelong 0177545 old VAX archive
>8 string __.SYMDEF random library
0 leshort 0177545 old PDP-11 archive
>8 string __.SYMDEF random library
#
# From "pdp" (but why a 4-byte quantity?)
#
0 lelong 0x39bed PDP-11 old archive
0 lelong 0x39bee PDP-11 4.0 archive
# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated). Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR: the original entries collide with ARC, above; replaced with combined
# version (not tested)]
#0 byte 0x1a RISC OS archive
#>1 string archive (ArcFS format)
#0 string \032archive RISC OS archive (ArcFS format)
0 string \032 RISC OS archive (spark format)
0 string Archive\000 RISC OS archive (ArcFS format)
# ARJ archiver (jason@jarthur.Claremont.EDU)
0 leshort 0xea60 ARJ archive data
>5 byte x \b, v%d,
>8 byte &0x04 multi-volume,
>8 byte &0x10 slash-switched,
>8 byte &0x20 backup,
>34 string x original name: %s,
>7 byte 0 os: MS-DOS
>7 byte 1 os: PRIMOS
>7 byte 2 os: Unix
>7 byte 3 os: Amiga
>7 byte 4 os: Macintosh
>7 byte 5 os: OS/2
>7 byte 6 os: Apple ][ GS
>7 byte 7 os: Atari ST
>7 byte 8 os: NeXT
>7 byte 9 os: VAX/VMS
>3 byte >0 %d]
# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0 string HA HA archive data,
#>2 leshort =1 1 file,
#>2 leshort >1 %u files,
#>4 byte&0x0f =0 first is type CPY
#>4 byte&0x0f =1 first is type ASC
#>4 byte&0x0f =2 first is type HSC
#>4 byte&0x0f =0x0e first is type DIR
#>4 byte&0x0f =0x0f first is type SPECIAL
# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0 string HPAK HPACK archive data
# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0 string \351,\001JAM\ JAM archive,
>7 string >\0 version %.4s
>0x26 byte =0x27 -
>>0x2b string >\0 label %.11s,
>>0x27 lelong x serial %08x,
>>0x36 string >\0 fstype %.8s
# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2 string -lh0- LHarc 1.x archive data [lh0]
2 string -lh1- LHarc 1.x archive data [lh1]
2 string -lz4- LHarc 1.x archive data [lz4]
2 string -lz5- LHarc 1.x archive data [lz5]
# [never seen any but the last; -lh4- reported in comp.compression:]
2 string -lzs- LHa 2.x? archive data [lzs]
2 string -lh\40- LHa 2.x? archive data [lh ]
2 string -lhd- LHa 2.x? archive data [lhd]
2 string -lh2- LHa 2.x? archive data [lh2]
2 string -lh3- LHa 2.x? archive data [lh3]
2 string -lh4- LHa (2.x) archive data [lh4]
2 string -lh5- LHa (2.x) archive data [lh5]
2 string -lh6- LHa (2.x) archive data [lh6]
2 string -lh7- LHa (2.x) archive data [lh7]
>20 byte x - header level %d
# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0 string Rar! RAR archive data,
>44 byte x v%0x,
>35 byte 0 os: MS-DOS
>35 byte 1 os: OS/2
>35 byte 2 os: Win32
>35 byte 3 os: Unix
# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0 string SQSH squished archive data (Acorn RISCOS)
# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# I can't figure out the self-extracting form of these buggers...
0 string UC2\x1a UC2 archive data
# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0 string PK\003\004 Zip archive data
>4 byte 0x09 \b, at least v0.9 to extract
>4 byte 0x0a \b, at least v1.0 to extract
>4 byte 0x0b \b, at least v1.1 to extract
>4 byte 0x14 \b, at least v2.0 to extract
# Zoo archiver
20 lelong 0xfdc4a7dc Zoo archive data
>4 byte >48 \b, v%c.
>>6 byte >47 \b%c
>>>7 byte >47 \b%c
>32 byte >0 \b, modify: v%d
>>33 byte x \b.%d+
>42 lelong 0xfdc4a7dc \b,
>>70 byte >0 extract: v%d
>>>71 byte x \b.%d+
# Shell archives
10 string #\ This\ is\ a\ shell\ archive shell archive text
#
# LBR. NB: May conflict with the questionable
# "binary Computer Graphics Metafile" format.
#
0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
#
# PMA (CP/M derivative of LHA)
#
2 string -pm0- PMarc archive data [pm0]
2 string -pm1- PMarc archive data [pm1]
2 string -pm2- PMarc archive data [pm2]
2 string -pms- PMarc SFX archive (CP/M, DOS)
5 string -pc1- PopCom compressed executable (CP/M)
# From Rafael Laboissiere <rafael@laboissiere.net>
# The Project Revision Control System (see
# http://prcs.sourceforge.net) generates a packaged project
# file which is recognized by the following entry:
0 leshort 0xeb81 PRCS packaged project
# Microsoft cabinets
# by David Necas (Yeti) <yeti@physics.muni.cz>
#0 string MSCF\0\0\0\0 Microsoft cabinet file data,
#>25 byte x v%d
#>24 byte x \b.%d
# MPi: All CABs have version 1.3, so this is pointless.
# Better magic in debian-additions.
# GTKtalog catalogs
# by David Necas (Yeti) <yeti@physics.muni.cz>
4 string gtktalog\ GTKtalog catalog data,
>13 string 3 version 3
>>14 beshort 0x677a (gzipped)
>>14 beshort !0x677a (not gzipped)
>13 string >3 version %s
############################################################################
# Parity archive reconstruction file, the 'par' file format now used on Usenet.
0 string PAR\0 PARity archive data
>48 leshort =0 - Index file
>48 leshort >0 - file number %d
# Felix von Leitner <felix-file@fefe.de>
0 string d8:announce BitTorrent file
# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
0 beshort 0x0e0f Atari MSA archive data
>2 beshort x \b, %d sectors per track
>4 beshort 0 \b, 1 sided
>4 beshort 1 \b, 2 sided
>6 beshort x \b, starting track: %d
>8 beshort x \b, ending track: %d
# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
0 string PK00PK\003\004 Zip archive data
# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
# by Stefan `Sec` Zehl <sec@42.org>
7 string **ACE** ACE compressed archive
>15 byte >0 version %d
>16 byte =0x00 \b, from MS-DOS
>16 byte =0x01 \b, from OS/2
>16 byte =0x02 \b, from Win/32
>16 byte =0x03 \b, from Unix
>16 byte =0x04 \b, from MacOS
>16 byte =0x05 \b, from WinNT
>16 byte =0x06 \b, from Primos
>16 byte =0x07 \b, from AppleGS
>16 byte =0x08 \b, from Atari
>16 byte =0x09 \b, from Vax/VMS
>16 byte =0x0A \b, from Amiga
>16 byte =0x0B \b, from Next
>14 byte x \b, version %d to extract
>5 leshort &0x0080 \b, multiple volumes,
>>17 byte x \b (part %d),
>5 leshort &0x0002 \b, contains comment
>5 leshort &0x0200 \b, sfx
>5 leshort &0x0400 \b, small dictionary
>5 leshort &0x0800 \b, multi-volume
>5 leshort &0x1000 \b, contains AV-String
>>30 string\x16*UNREGISTERED\x20VERSION* (unregistered)
>5 leshort &0x2000 \b, with recovery record
>5 leshort &0x4000 \b, locked
>5 leshort &0x8000 \b, solid
# Date in MS-DOS format (whatever that is)
#>18 lelong x Created on
# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
# <doj@cubic.org>
0x1A string sfArk sfArk compressed Soundfont
>0x15 string 2
>>0x1 string >\0 Version %s
>>0x2A string >\0 : %s
#------------------------------------------------------------------------------
# citrus locale declaration
#
0 string RuneCT Citrus locale declaration for LC_CTYPE
#------------------------------------------------------------------------------
# compress: file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.
# standard unix compress
0 string \037\235 compress'd data
>2 byte&0x80 >0 block compressed
>2 byte&0x1f x %d bits
# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
# Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
# * Original filename is only at offset 10 if "extra field" absent
# * Produce shorter output - notably, only report compression methods
# other than 8 ("deflate", the only method defined in RFC 1952).
0 string \037\213 gzip compressed data
>2 byte <8 \b, reserved method
>2 byte >8 \b, unknown method
>3 byte &0x01 \b, ASCII
>3 byte &0x02 \b, continuation
>3 byte &0x04 \b, extra field
>3 byte&0xC =0x08
>>10 string x \b, was "%s"
>9 byte =0x00 \b, from MS-DOS
>9 byte =0x01 \b, from Amiga
>9 byte =0x02 \b, from VMS
>9 byte =0x03 \b, from Unix
>9 byte =0x05 \b, from Atari
>9 byte =0x06 \b, from OS/2
>9 byte =0x07 \b, from MacOS
>9 byte =0x0A \b, from Tops/20
>9 byte =0x0B \b, from Win/32
>3 byte &0x10 \b, comment
>3 byte &0x20 \b, encrypted
### >4 ledate x last modified: %s,
>8 byte 2 \b, max compression
>8 byte 4 \b, max speed
# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0 string \037\036 packed data
>2 belong >1 \b, %d characters originally
>2 belong =1 \b, %d character originally
#
# This magic number is byte-order-independent.
0 short 0x1f1f old packed data
# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0 short 0x1fff compacted data
# This string is valid for SunOS (BE) and a matching "short" is listed
# in the Ultrix (LE) magic file.
0 string \377\037 compacted data
0 short 0145405 huf output
# bzip2
0 string BZh bzip2 compressed data
>3 byte >47 \b, block size = %c00k
# squeeze and crunch
# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
0 beshort 0x76FF squeezed data,
>4 string x original name %s
0 beshort 0x76FE crunched data,
>2 string x original name %s
0 beshort 0x76FD LZH compressed data,
>2 string x original name %s
# Freeze
0 string \037\237 frozen file 2.1
0 string \037\236 frozen file 1.0 (or gzip 0.5)
# SCO compress -H (LZH)
0 string \037\240 SCO compress -H (LZH) data
# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# There's only a magic nibble (4 bits); that nibble repeats every 33
# bytes. This isn't suited for use, but maybe we can use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0 byte&0xF0 0xd0 data
#>33 byte&0xF0 0xd0
#>66 byte&0xF0 0xd0
#>99 byte&0xF0 0xd0
#>132 byte&0xF0 0xd0 GSM 06.10 compressed audio
# bzip a block-sorting file compressor
# by Julian Seward <sewardj@cs.man.ac.uk> and others
#
0 string BZ bzip compressed data
>2 byte x \b, version: %c
>3 string =1 \b, compression block size 100k
>3 string =2 \b, compression block size 200k
>3 string =3 \b, compression block size 300k
>3 string =4 \b, compression block size 400k
>3 string =5 \b, compression block size 500k
>3 string =6 \b, compression block size 600k
>3 string =7 \b, compression block size 700k
>3 string =8 \b, compression block size 800k
>3 string =9 \b, compression block size 900k
# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
>9 beshort <0x0940
>>9 byte&0xf0 =0x00 - version 0.
>>9 beshort&0x0fff x \b%03x,
>>13 byte 1 LZO1X-1,
>>13 byte 2 LZO1X-1(15),
>>13 byte 3 LZO1X-999,
## >>22 bedate >0 last modified: %s,
>>14 byte =0x00 os: MS-DOS
>>14 byte =0x01 os: Amiga
>>14 byte =0x02 os: VMS
>>14 byte =0x03 os: Unix
>>14 byte =0x05 os: Atari
>>14 byte =0x06 os: OS/2
>>14 byte =0x07 os: MacOS
>>14 byte =0x0A os: Tops/20
>>14 byte =0x0B os: WinNT
>>14 byte =0x0E os: Win32
>9 beshort >0x0939
>>9 byte&0xf0 =0x00 - version 0.
>>9 byte&0xf0 =0x10 - version 1.
>>9 byte&0xf0 =0x20 - version 2.
>>9 beshort&0x0fff x \b%03x,
>>15 byte 1 LZO1X-1,
>>15 byte 2 LZO1X-1(15),
>>15 byte 3 LZO1X-999,
## >>25 bedate >0 last modified: %s,
>>17 byte =0x00 os: MS-DOS
>>17 byte =0x01 os: Amiga
>>17 byte =0x02 os: VMS
>>17 byte =0x03 os: Unix
>>17 byte =0x05 os: Atari
>>17 byte =0x06 os: OS/2
>>17 byte =0x07 os: MacOS
>>17 byte =0x0A os: Tops/20
>>17 byte =0x0B os: WinNT
>>17 byte =0x0E os: Win32
# 4.3BSD-Quasijarus Strong Compression
# http://minnie.tuhs.org/Quasijarus/compress.html
0 string \037\241 Quasijarus strong compressed data
# From: Cory Dikkers <cdikkers@swbell.net>
0 string XPKF Amiga xpkf.library compressed data
0 string PP11 Power Packer 1.1 compressed data
0 string PP20 Power Packer 2.0 compressed data,
>4 belong 0x09090909 fast compression
>4 belong 0x090A0A0A mediocre compression
>4 belong 0x090A0B0B good compression
>4 belong 0x090A0C0C very good compression
>4 belong 0x090A0C0D best compression
# 7z archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
# http://www.7-zip.org or DOC/7zFormat.txt
#
0 string 7z\274\257\047\034 7z archive data,
>6 byte x version %d
>7 byte x \b.%d
# AFX compressed files (Wolfram Kleff)
2 string -afx- AFX compressed file data
#------------------------------------------------------------------------------
# fsav: file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)
0 beshort 0x1575 fsav (linux) macro virus
>8 leshort >0 (%d-
>11 byte >0 \b%02d-
>10 byte >0 \b%02d)
# comment this out for now because it regognizes every file where
# the eighth character is \n
#8 byte 0x0a
#>12 byte 0x07
#>11 leshort >0 fsav (linux) virus (%d-
#>10 byte 0 \b01-
#>10 byte 1 \b02-
#>10 byte 2 \b03-
#>10 byte 3 \b04-
#>10 byte 4 \b05-
#>10 byte 5 \b06-
#>10 byte 6 \b07-
#>10 byte 7 \b08-
#>10 byte 8 \b08-
#>10 byte 9 \b10-
#>10 byte 10 \b11-
#>10 byte 11 \b12-
#>9 byte >0 \b%02d)
#------------------------------------------------------------------------------
# GEOS files (Vidar Madsen, vidar@gimp.org)
# semi-commonly used in embedded and handheld systems.
0 belong 0xc745c153 GEOS
>40 byte 1 executable
>40 byte 2 VMFile
>40 byte 3 binary
>40 byte 4 directory label
>40 byte <1 unknown
>40 byte >4 unknown
>4 string >\0 \b, name "%s"
#>44 short x \b, version %d
#>46 short x \b.%d
#>48 short x \b, rev %d
#>50 short x \b.%d
#>52 short x \b, proto %d
#>54 short x \br%d
#>168 string >\0 \b, copyright "%s"
#------------------------------------------------------------
# Java ByteCode
# From Larry Schwimmer (schwim@cs.stanford.edu)
0 belong 0xcafebabe compiled Java class data,
>6 beshort x version %d.
>4 beshort x \b%d
#------------------------------------------------------------
# Java serialization
# From Martin Pool (m.pool@pharos.com.au)
0 beshort 0xaced Java serialization data
>2 beshort >0x0004 \b, version %d
#------------------------------------------------------------------------------
# mlssa: file(1) magic for MLSSA datafiles
#
0 lelong 0xffffabcd MLSSA datafile,
>4 leshort x algorithm %d,
>10 lelong x %d samples
#------------------------------------------------------------------------------
# mmdf: file(1) magic for MMDF mail files
#
0 string \001\001\001\001 MMDF mailbox
#------------------------------------------------------------------------------
# msdos: file(1) magic for MS-DOS files
#
# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
0 string/c @echo\ off MS-DOS batch file text
# XXX - according to Microsoft's spec, at an offset of 0x3c in a
# PE-format executable is the offset in the file of the PE header;
# unfortunately, that's a little-endian offset, and there's no way
# to specify an indirect offset with a specified byte order.
# So, for now, we assume the standard MS-DOS stub, which puts the
# PE header at 0x80 = 128.
#
# Required OS version and subsystem version were 4.0 on some NT 3.51
# executables built with Visual C++ 4.0, so it's not clear that
# they're interesting. The user version was 0.0, but there's
# probably some linker directive to set it. The linker version was
# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
#
128 string PE\0\0 MS Windows PE
>150 leshort&0x0100 >0 32-bit
>132 leshort 0x0 unknown processor
>132 leshort 0x14c Intel 80386
>132 leshort 0x166 MIPS R4000
>132 leshort 0x184 Alpha
>132 leshort 0x268 Motorola 68000
>132 leshort 0x1f0 PowerPC
>132 leshort 0x290 PA-RISC
>148 leshort >27
>>220 leshort 0 unknown subsystem
>>220 leshort 1 native
>>220 leshort 2 GUI
>>220 leshort 3 console
>>220 leshort 7 POSIX
>150 leshort&0x2000 =0 executable
#>>136 ledate x stamp %s,
>>150 leshort&0x0001 >0 not relocatable
#>>150 leshort&0x0004 =0 with line numbers,
#>>150 leshort&0x0008 =0 with local symbols,
#>>150 leshort&0x0200 =0 with debug symbols,
>>150 leshort&0x1000 >0 system file
#>>148 leshort >0
#>>>154 byte x linker %d
#>>>155 byte x \b.%d,
#>>148 leshort >27
#>>>192 leshort x requires OS %d
#>>>194 leshort x \b.%d,
#>>>196 leshort x user version %d
#>>>198 leshort x \b.%d,
#>>>200 leshort x subsystem version %d
#>>>202 leshort x \b.%d,
>150 leshort&0x2000 >0 DLL
#>>136 ledate x stamp %s,
>>150 leshort&0x0001 >0 not relocatable
#>>150 leshort&0x0004 =0 with line numbers,
#>>150 leshort&0x0008 =0 with local symbols,
#>>150 leshort&0x0200 =0 with debug symbols,
>>150 leshort&0x1000 >0 system file
#>>148 leshort >0
#>>>154 byte x linker %d
#>>>155 byte x \b.%d,
#>>148 leshort >27
#>>>192 leshort x requires OS %d
#>>>194 leshort x \b.%d,
#>>>196 leshort x user version %d
#>>>198 leshort x \b.%d,
#>>>200 leshort x subsystem version %d
#>>>202 leshort x \b.%d,
0 leshort 0x14c MS Windows COFF Intel 80386 object file
#>4 ledate x stamp %s
0 leshort 0x166 MS Windows COFF MIPS R4000 object file
#>4 ledate x stamp %s
0 leshort 0x184 MS Windows COFF Alpha object file
#>4 ledate x stamp %s
0 leshort 0x268 MS Windows COFF Motorola 68000 object file
#>4 ledate x stamp %s
0 leshort 0x1f0 MS Windows COFF PowerPC object file
#>4 ledate x stamp %s
0 leshort 0x290 MS Windows COFF PA-RISC object file
#>4 ledate x stamp %s
# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
0 string MZ MS-DOS executable (EXE)
>24 string @ \b, OS/2 or MS Windows
>>0xe7 string LH/2\ Self-Extract \b, %s
>>0xe9 string PKSFX2 \b, %s
>>122 string Windows\ self-extracting\ ZIP \b, %s
>0x1c string RJSX\xff\xff \b, ARJ SFX
>0x1c string diet\xf9\x9c \b, diet compressed
>0x1c string LZ09 \b, LZEXE v0.90 compressed
>0x1c string LZ91 \b, LZEXE v0.91 compressed
>0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, PKSFX
# JM: 0x1e "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved\7\0\0\0"
>0x1e string PKLITE\ Copr. \b, %.6s compressed
>0x24 string LHa's\ SFX \b, %.15s
>0x24 string LHA's\ SFX \b, %.15s
>1638 string -lh5- \b, LHa SFX archive v2.13S
>7195 string Rar! \b, RAR self-extracting archive
#
# [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than
# 8161 bytes are ignored. To make the following entries work, increase
# HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
# NT/Win32 and VMS.]
# [GRR: some company sells a self-extractor/displayer for image data(!)]
#
>11696 string PK\003\004 \b, PKZIP SFX archive v1.1
>13297 string PK\003\004 \b, PKZIP SFX archive v1.93a
>15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09
>15770 string PK\003\004 \b, PKZIP SFX archive v2.04g
>28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02
#
# Info-ZIP self-extractors
# these are the DOS versions:
>25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12
>26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
# these are the OS/2 versions (OS/2 is flagged above):
>47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12
>49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
# this is the NT/Win32 version:
>69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption
#
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
>>49824 leshort =1 \b, 1 file
>>49824 leshort >1 \b, %u files
# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
# Uncommenting only the first two lines will cover about 2/3 of COM files,
# but it isn't feasible to match all COM files since there must be at least
# two dozen different one-byte "magics".
#0 byte 0xe9 MS-DOS executable (COM)
#>6 string SFX\ of\ LHarc (%s)
#0 byte 0x8c MS-DOS executable (COM)
# 0xeb conflicts with "sequent" magic
#0 byte 0xeb MS-DOS executable (COM)
#0 byte 0xb8 MS-DOS executable (COM)
# miscellaneous formats
0 string LZ MS-DOS executable (built-in)
#0 byte 0xf0 MS-DOS program library data
#
#
# Windows Registry files.
#
0 string regf Windows NT registry file
0 string CREG Windows 95 registry file
# AAF files:
# <stuartc@rd.bbc.co.uk> Stuart Cunningham
0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
>30 byte 9 (512B sectors)
>30 byte 12 (4kB sectors)
0 string \320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001 AAF file using MS Structured Storage
>30 byte 9 (512B sectors)
>30 byte 12 (4kB sectors)
# Popular applications
2080 string Microsoft\ Word\ 6.0\ Document %s
2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
2112 string MSWordDoc Microsoft Word document data
#
0 belong 0x31be0000 Microsoft Word Document
#
0 string PO^Q` Microsoft Word 6.0 Document
#
0 string \376\067\0\043 Microsoft Office Document
0 string \320\317\021\340\241\261\032\341 Microsoft Office Document
0 string \333\245-\0\0\0 Microsoft Office Document
#
2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
2080 string Foglio\ di\ lavoro\ Microsoft\ Exce %s
#
# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
2114 string Biff5 Microsoft Excel 5.0 Worksheet
# Italian MS-Excel
2121 string Biff5 Microsoft Excel 5.0 Worksheet
0 string \x09\x04\x06\x00\x00\x00\x10\x00 Microsoft Excel Worksheet
#
0 belong 0x00001a00 Lotus 1-2-3
>4 belong 0x00100400 wk3 document data
>4 belong 0x02100400 wk4 document data
>4 belong 0x07800100 fm3 or fmb document data
>4 belong 0x07800000 fm3 or fmb document data
#
0 belong 0x00000200 Lotus 1-2-3
>4 belong 0x06040600 wk1 document data
>4 belong 0x06800200 fmt document data
# Help files
0 string ?_\3\0 MS Windows Help Data
# DeIsL1.isu what this is I don't know
0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is
# Winamp .avs
#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
0 string Nullsoft\ AVS\ Preset\ Winamp plug in
# Hyper terminal:
0 string HyperTerminal\ hyperterm
>15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal
# Windows Metafont .WMF
0 string \327\315\306\232\000\000\000\000\000\000 ms-windows metafont .wmf
#tz3 files whatever that is (MS Works files)
0 string \003\001\001\004\070\001\000\000 tz3 ms-works file
0 string \003\002\001\004\070\001\000\000 tz3 ms-works file
0 string \003\003\001\004\070\001\000\000 tz3 ms-works file
# PGP sig files .sig
#0 string \211\000\077\003\005\000\063\237\127 065 to \027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
# windows zips files .dmf
0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 Ms-windows special zipped file
# Windows help file FTG FTS
0 string \164\146\115\122\012\000\000\000\001\000\000\000 ms-windows help cache
# grp old windows 3.1 group files
0 string \120\115\103\103 Ms-windows 3.1 group files
# lnk files windows symlinks
0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 ms-Windows shortcut
#ico files
0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for ms-windows
# Windows icons (Ian Springer <ips@fpk.hp.com>)
0 string \000\000\001\000 ms-windows icon resource
>4 byte 1 - 1 icon
>4 byte >1 - %d icons
>>6 byte >0 \b, %dx
>>>7 byte >0 \b%d
>>8 byte 0 \b, 256-colors
>>8 byte >0 \b, %d-colors
# .chr files
0 string PK\010\010BGI Borland font
>4 string >\0 %s
# then there is a copyright notice
# .bgi files
0 string pk\010\010BGI Borland device
>4 string >\0 %s
# then there is a copyright notice
# recycled/info the windows trash bin index
9 string \000\000\000\030\001\000\000\000 ms-windows recycled bin info
##### put in Either Magic/font or Magic/news
# Acroread or something files wrongly identified as G3 .pfm
# these have the form \000 \001 any? \002 \000 \000
# or \000 \001 any? \022 \000 \000
#0 string \000\001 pfm?
#>3 string \022\000\000Copyright\ yes
#>3 string \002\000\000Copyright\ yes
#>3 string >\0 oops, not a font file. Cancel that.
#it clashes with ttf files so put it lower down.
# From Doug Lee via a FreeBSD pr
9 string GERBILDOC First Choice document
9 string GERBILDB First Choice database
9 string GERBILCLIP First Choice database
0 string GERBIL First Choice device file
9 string RABBITGRAPH RabbitGraph file
0 string DCU1 Borland Delphi .DCU file
0 string !<spell> MKS Spell hash list (old format)
0 string !<spell2> MKS Spell hash list
# Too simple - MPi
#0 string AH Halo(TM) bitmapped font file
0 lelong 0x08086b70 TurboC BGI file
0 lelong 0x08084b50 TurboC Font file
# WARNING: below line conflicts with Infocom game data Z-machine 3
0 byte 0x03 DBase 3 data file
>0x04 lelong 0 (no records)
>0x04 lelong >0 (%ld records)
0 byte 0x83 DBase 3 data file with memo(s)
>0x04 lelong 0 (no records)
>0x04 lelong >0 (%ld records)
0 leshort 0x0006 DBase 3 index file
0 string PMCC Windows 3.x .GRP file
1 string RDC-meg MegaDots
>8 byte >0x2F version %c
>9 byte >0x2F \b.%c file
0 lelong 0x4C
>4 lelong 0x00021401 Windows shortcut file
# DOS EPS Binary File Header
# From: Ed Sznyter <ews@Black.Market.NET>
0 belong 0xC5D0D3C6 DOS EPS Binary File
>4 long >0 Postscript starts at byte %d
>>8 long >0 length %d
>>>12 long >0 Metafile starts at byte %d
>>>>16 long >0 length %d
>>>20 long >0 TIFF starts at byte %d
>>>>24 long >0 length %d
# TNEF magic From "Joomy" <joomy@se-ed.net>
0 leshort 0x223e9f78 TNEF
# HtmlHelp files (.chm)
0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
# GFA-BASIC (Wolfram Kleff)
2 string GFA-BASIC3 GFA-BASIC 3 data
# DJGPP compiled files
# v >2, uses DPMI & small(2k) stub (Robert vd Boon, rjvdboon@europe.com)
0x200 string go32stub DOS-executable compiled w/DJGPP
>0x20c string >0 (stub v%.4s)
>>0x8b2 string djp [compressed w/%s
>>>&1 string >\0 %.4s]
>>0x8ad string UPX [compressed w/%s
>>>&1 string >\0 %.4s]
>>0x1c string pmodedj stubbed with %s
# QDOS
4 belong 0x4AFB QDOS executable
>9 pstring x '%s'
0 beshort 0xFB01 QDOS object
>2 pstring x '%s'
#------------------------------------------------------------------------------
# From Stuart Caie <kyzer@4u.net> (developer of cabextract)
# Microsoft Cabinet files
0 string MSCF\0\0\0\0 Microsoft Cabinet file
>8 lelong x \b, %u bytes
>28 leshort 1 \b, 1 file
>28 leshort >1 \b, %u files
# InstallShield Cabinet files
0 string ISc( InstallShield Cabinet file
>5 byte&0xf0 =0x60 version 6,
>5 byte&0xf0 !0x60 version 4/5,
>(12.l+40) lelong x %u files
# Windows CE package files
0 string MSCE\0\0\0\0 Microsoft WinCE install header
>20 lelong 0 \b, architecture-independent
>20 lelong 103 \b, Hitachi SH3
>20 lelong 104 \b, Hitachi SH4
>20 lelong 0xA11 \b, StrongARM
>20 lelong 4000 \b, MIPS R4000
>20 lelong 10003 \b, Hitachi SH3
>20 lelong 10004 \b, Hitachi SH3E
>20 lelong 10005 \b, Hitachi SH4
>20 lelong 70001 \b, ARM 7TDMI
>52 leshort 1 \b, 1 file
>52 leshort >1 \b, %u files
>56 leshort 1 \b, 1 registry entry
>56 leshort >1 \b, %u registry entries
# Outlook Personal Folders
0 lelong 0x4E444221 Microsoft Outlook binary email folder
# From: Dirk Jagdmann <doj@cubic.org>
0 lelong 0x00035f3f Windows 3.x help file
# Christophe Monniez
0 string Client\ UrlCache\ MMF Microsoft Internet Explorer Cache File
>20 string >\0 Version %s
0 string \xCF\xAD\x12\xFE Microsoft Outlook Express DBX File
>4 byte =0xC5 Message database
>4 byte =0xC6 Folder database
>4 byte =0xC7 Accounts informations
>4 byte =0x30 Offline database
# Windows Enhanced Metafile (EMF)
# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
# for further information. Note that "0 lelong 1" should be true i.e.
# the first double word in the file should be 1. With the extended
# syntax available by some file commands you could write:
# 0 lelong 1
# &40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data
40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data
>44 ulelong x version 0x%x.
# If the description has a length greater than zero, it exists and is
# found at offset (*64).
>64 ulelong >0 Description available at offset 0x%x
>>60 ulelong >0 (length 0x%x)
# Note it would be better to print out the description, which is found
# as below. Unfortunately the following only prints out the first couple
# of characters instead of all the "description length"
# number of characters -- indicated by the ulelong at offset 60.
>>(64.l) lestring16 >0 Description: %15.15s
#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
0 string \377WPC\020\000\000\000\022\012\001\001\000\000\000\000 (WP) loadable text
>15 byte 0 Optimized for Intel
>15 byte 1 Optimized for Non-Intel
1 string WPC (Corel/WP)
>8 short 257 WordPerfect macro
>8 short 258 WordPerfect help file
>8 short 259 WordPerfect keyboard file
>8 short 266 WordPerfect document
>8 short 267 WordPerfect dictionary
>8 short 268 WordPerfect thesaurus
>8 short 269 WordPerfect block
>8 short 270 WordPerfect rectangular block
>8 short 271 WordPerfect column block
>8 short 272 WordPerfect printer data
>8 short 275 WordPerfect printer data
>8 short 276 WordPerfect driver resource data
>8 short 279 WordPerfect hyphenation code
>8 short 280 WordPerfect hyphenation data
>8 short 281 WordPerfect macro resource data
>8 short 283 WordPerfect hyphenation lex
>8 short 285 WordPerfect wordlist
>8 short 286 WordPerfect equation resource data
>8 short 289 WordPerfect spell rules
>8 short 290 WordPerfect dictionary rules
>8 short 295 WordPerfect spell rules (Microlytics)
>8 short 299 WordPerfect settings file
>8 short 301 WordPerfect 4.2 document
>8 short 325 WordPerfect dialog file
>8 short 332 WordPerfect button bar
>8 short 513 Shell macro
>8 short 522 Shell definition
>8 short 769 Notebook macro
>8 short 770 Notebook help file
>8 short 771 Notebook keyboard file
>8 short 778 Notebook definition
>8 short 1026 Calculator help file
>8 short 1538 Calendar help file
>8 short 1546 Calendar data file
>8 short 1793 Editor macro
>8 short 1794 Editor help file
>8 short 1795 Editor keyboard file
>8 short 1817 Editor macro resource file
>8 short 2049 Macro editor macro
>8 short 2050 Macro editor help file
>8 short 2051 Macro editor keyboard file
>8 short 2305 PlanPerfect macro
>8 short 2306 PlanPerfect help file
>8 short 2307 PlanPerfect keyboard file
>8 short 2314 PlanPerfect worksheet
>8 short 2319 PlanPerfect printer definition
>8 short 2322 PlanPerfect graphic definition
>8 short 2323 PlanPerfect data
>8 short 2324 PlanPerfect temporary printer
>8 short 2329 PlanPerfect macro resource data
>8 byte 11 Mail
>8 short 2818 help file
>8 short 2821 distribution list
>8 short 2826 out box
>8 short 2827 in box
>8 short 2836 users archived mailbox
>8 short 2837 archived message database
>8 short 2838 archived attachments
>8 short 3083 Printer temporary file
>8 short 3330 Scheduler help file
>8 short 3338 Scheduler in file
>8 short 3339 Scheduler out file
>8 short 3594 GroupWise settings file
>8 short 3601 GroupWise directory services
>8 short 3627 GroupWise settings file
>8 short 4362 Terminal resource data
>8 short 4363 Terminal resource data
>8 short 4395 Terminal resource data
>8 short 4619 GUI loadable text
>8 short 4620 graphics resource data
>8 short 4621 printer settings file
>8 short 4622 port definition file
>8 short 4623 print queue parameters
>8 short 4624 compressed file
>8 short 5130 Network service msg file
>8 short 5131 Network service msg file
>8 short 5132 Async gateway login msg
>8 short 5134 GroupWise message file
>8 short 7956 GroupWise admin domain database
>8 short 7957 GroupWise admin host database
>8 short 7959 GroupWise admin remote host database
>8 short 7960 GroupWise admin ADS deferment data file
>8 short 8458 IntelliTAG (SGML) compiled DTD
>8 long 18219264 WordPerfect graphic image (1.0)
>8 long 18219520 WordPerfect graphic image (2.0)
#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
#------------------------------------------------------------------------------
# rtf: file(1) magic for Rich Text Format (RTF)
#
# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
#
0 string {\\rtf Rich Text Format data,
>5 byte x version %c,
>6 string \\ansi ANSI
>6 string \\mac Apple Macintosh
>6 string \\pc IBM PC, code page 437
>6 string \\pca IBM PS/2, code page 850
#------------------------------------------------------------------------------
# animation: file(1) magic for animation/movie formats
#
# animation formats
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
# MPEG sequences
# Scans for all common MPEG header start codes
0 belong&0xFFFFFF00 0x00000100 MPEG sequence
>3 byte 0xBA
>>4 byte &0x40 \b, v2, program multiplex
>>4 byte ^0x40 \b, v1, system multiplex
>3 byte 0xBB \b, v1/2, multiplex (missing pack header)
>3 byte 0xB0 \b, v4
>>5 belong 0x000001B5
>>>9 byte &0x80
>>>>10 byte&0xF0 16 \b, video
>>>>10 byte&0xF0 32 \b, still texture
>>>>10 byte&0xF0 48 \b, mesh
>>>>10 byte&0xF0 64 \b, face
>>>9 byte ^0x80
>>>>9 byte&0xF8 8 \b, video
>>>>9 byte&0xF8 16 \b, still texture
>>>>9 byte&0xF8 24 \b, mesh
>>>>9 byte&0xF8 32 \b, face
>>4 byte 1 \b, simple @ L1
>>4 byte 2 \b, simple @ L2
>>4 byte 3 \b, simple @ L3
>>4 byte 4 \b, simple @ L0
>>4 byte 17 \b, simple scalable @ L1
>>4 byte 18 \b, simple scalable @ L2
>>4 byte 33 \b, core @ L1
>>4 byte 34 \b, core @ L2
>>4 byte 50 \b, main @ L2
>>4 byte 51 \b, main @ L3
>>4 byte 53 \b, main @ L4
>>4 byte 66 \b, n-bit @ L2
>>4 byte 81 \b, scalable texture @ L1
>>4 byte 97 \b, simple face animation @ L1
>>4 byte 98 \b, simple face animation @ L2
>>4 byte 99 \b, simple face basic animation @ L1
>>4 byte 100 \b, simple face basic animation @ L2
>>4 byte 113 \b, basic animation text @ L1
>>4 byte 114 \b, basic animation text @ L2
>>4 byte 129 \b, hybrid @ L1
>>4 byte 130 \b, hybrid @ L2
>>4 byte 145 \b, advanced RT simple @ L!
>>4 byte 146 \b, advanced RT simple @ L2
>>4 byte 147 \b, advanced RT simple @ L3
>>4 byte 148 \b, advanced RT simple @ L4
>>4 byte 161 \b, core scalable @ L1
>>4 byte 162 \b, core scalable @ L2
>>4 byte 163 \b, core scalable @ L3
>>4 byte 177 \b, advanced coding efficiency @ L1
>>4 byte 178 \b, advanced coding efficiency @ L2
>>4 byte 179 \b, advanced coding efficiency @ L3
>>4 byte 180 \b, advanced coding efficiency @ L4
>>4 byte 193 \b, advanced core @ L1
>>4 byte 194 \b, advanced core @ L2
>>4 byte 209 \b, advanced scalable texture @ L1
>>4 byte 210 \b, advanced scalable texture @ L2
>>4 byte 211 \b, advanced scalable texture @ L3
>>4 byte 225 \b, simple studio @ L1
>>4 byte 226 \b, simple studio @ L2
>>4 byte 227 \b, simple studio @ L3
>>4 byte 228 \b, simple studio @ L4
>>4 byte 229 \b, core studio @ L1
>>4 byte 230 \b, core studio @ L2
>>4 byte 231 \b, core studio @ L3
>>4 byte 232 \b, core studio @ L4
>>4 byte 240 \b, advanced simple @ L0
>>4 byte 241 \b, advanced simple @ L1
>>4 byte 242 \b, advanced simple @ L2
>>4 byte 243 \b, advanced simple @ L3
>>4 byte 244 \b, advanced simple @ L4
>>4 byte 245 \b, advanced simple @ L5
>>4 byte 247 \b, advanced simple @ L3b
>>4 byte 248 \b, FGS @ L0
>>4 byte 249 \b, FGS @ L1
>>4 byte 250 \b, FGS @ L2
>>4 byte 251 \b, FGS @ L3
>>4 byte 252 \b, FGS @ L4
>>4 byte 253 \b, FGS @ L5
>3 byte 0xB5 \b, v4
>>4 byte &0x80
>>>5 byte&0xF0 16 \b, video (missing profile header)
>>>5 byte&0xF0 32 \b, still texture (missing profile header)
>>>5 byte&0xF0 48 \b, mesh (missing profile header)
>>>5 byte&0xF0 64 \b, face (missing profile header)
>>4 byte ^0x80
>>>4 byte&0xF8 8 \b, video (missing profile header)
>>>4 byte&0xF8 16 \b, still texture (missing profile header)
>>>4 byte&0xF8 24 \b, mesh (missing profile header)
>>>4 byte&0xF8 32 \b, face (missing profile header)
>3 byte 0xB3
>>12 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
>>12 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
>>12 belong 0x000001B5 \b, v2,
>>>16 byte&0x0F 1 \b HP
>>>16 byte&0x0F 2 \b Spt
>>>16 byte&0x0F 3 \b SNR
>>>16 byte&0x0F 4 \b MP
>>>16 byte&0x0F 5 \b SP
>>>17 byte&0xF0 64 \b@HL
>>>17 byte&0xF0 96 \b@H-14
>>>17 byte&0xF0 128 \b@ML
>>>17 byte&0xF0 160 \b@LL
>>>17 byte &0x08 \b progressive
>>>17 byte ^0x08 \b interlaced
>>>17 byte&0x06 2 \b Y'CbCr 4:2:0 video
>>>17 byte&0x06 4 \b Y'CbCr 4:2:2 video
>>>17 byte&0x06 6 \b Y'CbCr 4:4:4 video
>>11 byte &0x02
>>>75 byte &0x01
>>>>140 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
>>>>140 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
>>>>140 belong 0x000001B5 \b, v2,
>>>>>144 byte&0x0F 1 \b HP
>>>>>144 byte&0x0F 2 \b Spt
>>>>>144 byte&0x0F 3 \b SNR
>>>>>144 byte&0x0F 4 \b MP
>>>>>144 byte&0x0F 5 \b SP
>>>>>145 byte&0xF0 64 \b@HL
>>>>>145 byte&0xF0 96 \b@H-14
>>>>>145 byte&0xF0 128 \b@ML
>>>>>145 byte&0xF0 160 \b@LL
>>>>>145 byte &0x08 \b progressive
>>>>>145 byte ^0x08 \b interlaced
>>>>>145 byte&0x06 2 \b Y'CbCr 4:2:0 video
>>>>>145 byte&0x06 4 \b Y'CbCr 4:2:2 video
>>>>>145 byte&0x06 6 \b Y'CbCr 4:4:4 video
>>>76 belong 0x000001B8 \b, v1, progressive Y'CbCr 4:2:0 video
>>>76 belong 0x000001B2 \b, v1, progressive Y'CbCr 4:2:0 video
>>>76 belong 0x000001B5 \b, v2,
>>>80 byte&0x0F 1 \b HP
>>>80 byte&0x0F 2 \b Spt
>>>80 byte&0x0F 3 \b SNR
>>>80 byte&0x0F 4 \b MP
>>>80 byte&0x0F 5 \b SP
>>>81 byte&0xF0 64 \b@HL
>>>81 byte&0xF0 96 \b@H-14
>>>81 byte&0xF0 128 \b@ML
>>>81 byte&0xF0 160 \b@LL
>>>81 byte &0x08 \b progressive
>>>81 byte ^0x08 \b interlaced
>>>81 byte&0x06 2 \b Y'CbCr 4:2:0 video
>>>81 byte&0x06 4 \b Y'CbCr 4:2:2 video
>>>81 byte&0x06 6 \b Y'CbCr 4:4:4 video
>>4 belong&0xFFFFFF00 0x78043800 \b, HD-TV 1920P
>>>7 byte&0xF0 0x10 \b, 16:9
>>4 belong&0xFFFFFF00 0x50002D00 \b, SD-TV 1280I
>>>7 byte&0xF0 0x10 \b, 16:9
>>4 belong&0xFFFFFF00 0x30024000 \b, PAL Capture
>>>7 byte&0xF0 0x10 \b, 4:3
>>4 beshort&0xFFF0 0x2C00 \b, 4CIF
>>>5 beshort&0x0FFF 0x01E0 \b NTSC
>>>5 beshort&0x0FFF 0x0240 \b PAL
>>>7 byte&0xF0 0x20 \b, 4:3
>>>7 byte&0xF0 0x30 \b, 16:9
>>>7 byte&0xF0 0x40 \b, 11:5
>>>7 byte&0xF0 0x80 \b, PAL 4:3
>>>7 byte&0xF0 0xC0 \b, NTSC 4:3
>>4 belong&0xFFFFFF00 0x2801E000 \b, LD-TV 640P
>>>7 byte&0xF0 0x10 \b, 4:3
>>4 belong&0xFFFFFF00 0x1400F000 \b, 320x240
>>>7 byte&0xF0 0x10 \b, 4:3
>>4 belong&0xFFFFFF00 0x0F00A000 \b, 240x160
>>>7 byte&0xF0 0x10 \b, 4:3
>>4 belong&0xFFFFFF00 0x0A007800 \b, 160x120
>>>7 byte&0xF0 0x10 \b, 4:3
>>4 beshort&0xFFF0 0x1600 \b, CIF
>>>5 beshort&0x0FFF 0x00F0 \b NTSC
>>>5 beshort&0x0FFF 0x0120 \b PAL
>>>7 byte&0xF0 0x20 \b, 4:3
>>>7 byte&0xF0 0x30 \b, 16:9
>>>7 byte&0xF0 0x40 \b, 11:5
>>>7 byte&0xF0 0x80 \b, PAL 4:3
>>>7 byte&0xF0 0xC0 \b, NTSC 4:3
>>>5 beshort&0x0FFF 0x0240 \b PAL 625
>>>>7 byte&0xF0 0x20 \b, 4:3
>>>>7 byte&0xF0 0x30 \b, 16:9
>>>>7 byte&0xF0 0x40 \b, 11:5
>>4 beshort&0xFFF0 0x2D00 \b, CCIR/ITU
>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
>>>5 beshort&0x0FFF 0x0240 \b PAL 625
>>>7 byte&0xF0 0x20 \b, 4:3
>>>7 byte&0xF0 0x30 \b, 16:9
>>>7 byte&0xF0 0x40 \b, 11:5
>>4 beshort&0xFFF0 0x1E00 \b, SVCD
>>>5 beshort&0x0FFF 0x01E0 \b NTSC 525
>>>5 beshort&0x0FFF 0x0240 \b PAL 625
>>>7 byte&0xF0 0x20 \b, 4:3
>>>7 byte&0xF0 0x30 \b, 16:9
>>>7 byte&0xF0 0x40 \b, 11:5
>>7 byte&0x0F 1 \b, 23.976 fps
>>7 byte&0x0F 2 \b, 24 fps
>>7 byte&0x0F 3 \b, 25 fps
>>7 byte&0x0F 4 \b, 29.97 fps
>>7 byte&0x0F 5 \b, 30 fps
>>7 byte&0x0F 6 \b, 50 fps
>>7 byte&0x0F 7 \b, 59.94 fps
>>7 byte&0x0F 8 \b, 60 fps
>>11 byte &0x04 \b, Constrained
# MPEG ADTS Audio (*.mpx/mxa/aac)
# from dreesen@math.fu-berlin.de
# modified to fully support MPEG ADTS
# MP3, M1A
0 beshort&0xFFFE 0xFFFA MPEG ADTS, layer III, v1
# rates
>2 byte&0xF0 0x10 \b, 32 kBits
>2 byte&0xF0 0x20 \b, 40 kBits
>2 byte&0xF0 0x30 \b, 48 kBits
>2 byte&0xF0 0x40 \b, 56 kBits
>2 byte&0xF0 0x50 \b, 64 kBits
>2 byte&0xF0 0x60 \b, 80 kBits
>2 byte&0xF0 0x70 \b, 96 kBits
>2 byte&0xF0 0x80 \b, 112 kBits
>2 byte&0xF0 0x90 \b, 128 kBits
>2 byte&0xF0 0xA0 \b, 160 kBits
>2 byte&0xF0 0xB0 \b, 192 kBits
>2 byte&0xF0 0xC0 \b, 224 kBits
>2 byte&0xF0 0xD0 \b, 256 kBits
>2 byte&0xF0 0xE0 \b, 320 kBits
# timing
>2 byte&0x0C 0x00 \b, 44.1 kHz
>2 byte&0x0C 0x04 \b, 48 kHz
>2 byte&0x0C 0x08 \b, 32 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP2, M1A
0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1
# rates
>2 byte&0xF0 0x10 \b, 32 kBits
>2 byte&0xF0 0x20 \b, 48 kBits
>2 byte&0xF0 0x30 \b, 56 kBits
>2 byte&0xF0 0x40 \b, 64 kBits
>2 byte&0xF0 0x50 \b, 80 kBits
>2 byte&0xF0 0x60 \b, 96 kBits
>2 byte&0xF0 0x70 \b, 112 kBits
>2 byte&0xF0 0x80 \b, 128 kBits
>2 byte&0xF0 0x90 \b, 160 kBits
>2 byte&0xF0 0xA0 \b, 192 kBits
>2 byte&0xF0 0xB0 \b, 224 kBits
>2 byte&0xF0 0xC0 \b, 256 kBits
>2 byte&0xF0 0xD0 \b, 320 kBits
>2 byte&0xF0 0xE0 \b, 384 kBits
# timing
>2 byte&0x0C 0x00 \b, 44.1 kHz
>2 byte&0x0C 0x04 \b, 48 kHz
>2 byte&0x0C 0x08 \b, 32 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MPA, M1A
0 beshort&0xFFFE 0xFFFE MPEG ADTS, layer I, v1
# rate
>2 byte&0xF0 0x10 \b, 32 kBits
>2 byte&0xF0 0x20 \b, 64 kBits
>2 byte&0xF0 0x30 \b, 96 kBits
>2 byte&0xF0 0x40 \b, 128 kBits
>2 byte&0xF0 0x50 \b, 160 kBits
>2 byte&0xF0 0x60 \b, 192 kBits
>2 byte&0xF0 0x70 \b, 224 kBits
>2 byte&0xF0 0x80 \b, 256 kBits
>2 byte&0xF0 0x90 \b, 288 kBits
>2 byte&0xF0 0xA0 \b, 320 kBits
>2 byte&0xF0 0xB0 \b, 352 kBits
>2 byte&0xF0 0xC0 \b, 384 kBits
>2 byte&0xF0 0xD0 \b, 416 kBits
>2 byte&0xF0 0xE0 \b, 448 kBits
# timing
>2 byte&0x0C 0x00 \b, 44.1 kHz
>2 byte&0x0C 0x04 \b, 48 kHz
>2 byte&0x0C 0x08 \b, 32 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP3, M2A
0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2
# rate
>2 byte&0xF0 0x10 \b, 8 kBits
>2 byte&0xF0 0x20 \b, 16 kBits
>2 byte&0xF0 0x30 \b, 24 kBits
>2 byte&0xF0 0x40 \b, 32 kBits
>2 byte&0xF0 0x50 \b, 40 kBits
>2 byte&0xF0 0x60 \b, 48 kBits
>2 byte&0xF0 0x70 \b, 56 kBits
>2 byte&0xF0 0x80 \b, 64 kBits
>2 byte&0xF0 0x90 \b, 80 kBits
>2 byte&0xF0 0xA0 \b, 96 kBits
>2 byte&0xF0 0xB0 \b, 112 kBits
>2 byte&0xF0 0xC0 \b, 128 kBits
>2 byte&0xF0 0xD0 \b, 144 kBits
>2 byte&0xF0 0xE0 \b, 160 kBits
# timing
>2 byte&0x0C 0x00 \b, 22.05 kHz
>2 byte&0x0C 0x04 \b, 24 kHz
>2 byte&0x0C 0x08 \b, 16 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP2, M2A
0 beshort&0xFFFE 0xFFF4 MPEG ADTS, layer II, v2
# rate
>2 byte&0xF0 0x10 \b, 8 kBits
>2 byte&0xF0 0x20 \b, 16 kBits
>2 byte&0xF0 0x30 \b, 24 kBits
>2 byte&0xF0 0x40 \b, 32 kBits
>2 byte&0xF0 0x50 \b, 40 kBits
>2 byte&0xF0 0x60 \b, 48 kBits
>2 byte&0xF0 0x70 \b, 56 kBits
>2 byte&0xF0 0x80 \b, 64 kBits
>2 byte&0xF0 0x90 \b, 80 kBits
>2 byte&0xF0 0xA0 \b, 96 kBits
>2 byte&0xF0 0xB0 \b, 112 kBits
>2 byte&0xF0 0xC0 \b, 128 kBits
>2 byte&0xF0 0xD0 \b, 144 kBits
>2 byte&0xF0 0xE0 \b, 160 kBits
# timing
>2 byte&0x0C 0x00 \b, 22.05 kHz
>2 byte&0x0C 0x04 \b, 24 kHz
>2 byte&0x0C 0x08 \b, 16 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MPA, M2A
0 beshort&0xFFFE 0xFFF6 MPEG ADTS, layer I, v2
# rate
>2 byte&0xF0 0x10 \b, 32 kBits
>2 byte&0xF0 0x20 \b, 48 kBits
>2 byte&0xF0 0x30 \b, 56 kBits
>2 byte&0xF0 0x40 \b, 64 kBits
>2 byte&0xF0 0x50 \b, 80 kBits
>2 byte&0xF0 0x60 \b, 96 kBits
>2 byte&0xF0 0x70 \b, 112 kBits
>2 byte&0xF0 0x80 \b, 128 kBits
>2 byte&0xF0 0x90 \b, 144 kBits
>2 byte&0xF0 0xA0 \b, 160 kBits
>2 byte&0xF0 0xB0 \b, 176 kBits
>2 byte&0xF0 0xC0 \b, 192 kBits
>2 byte&0xF0 0xD0 \b, 224 kBits
>2 byte&0xF0 0xE0 \b, 256 kBits
# timing
>2 byte&0x0C 0x00 \b, 22.05 kHz
>2 byte&0x0C 0x04 \b, 24 kHz
>2 byte&0x0C 0x08 \b, 16 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# MP3, M25A
0 beshort&0xFFFE 0xFFE2 MPEG ADTS, layer III, v2.5
# rate
>2 byte&0xF0 0x10 \b, 8 kBits
>2 byte&0xF0 0x20 \b, 16 kBits
>2 byte&0xF0 0x30 \b, 24 kBits
>2 byte&0xF0 0x40 \b, 32 kBits
>2 byte&0xF0 0x50 \b, 40 kBits
>2 byte&0xF0 0x60 \b, 48 kBits
>2 byte&0xF0 0x70 \b, 56 kBits
>2 byte&0xF0 0x80 \b, 64 kBits
>2 byte&0xF0 0x90 \b, 80 kBits
>2 byte&0xF0 0xA0 \b, 96 kBits
>2 byte&0xF0 0xB0 \b, 112 kBits
>2 byte&0xF0 0xC0 \b, 128 kBits
>2 byte&0xF0 0xD0 \b, 144 kBits
>2 byte&0xF0 0xE0 \b, 160 kBits
# timing
>2 byte&0x0C 0x00 \b, 11.025 kHz
>2 byte&0x0C 0x04 \b, 12 kHz
>2 byte&0x0C 0x08 \b, 8 kHz
# channels/options
>3 byte&0xC0 0x00 \b, Stereo
>3 byte&0xC0 0x40 \b, JntStereo
>3 byte&0xC0 0x80 \b, 2x Monaural
>3 byte&0xC0 0xC0 \b, Monaural
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Packet Pad
#>2 byte &0x01 \b, Custom Flag
#>3 byte &0x08 \b, Copyrighted
#>3 byte &0x04 \b, Original Source
#>3 byte&0x03 1 \b, NR: 50/15 ms
#>3 byte&0x03 3 \b, NR: CCIT J.17
# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
# Stored AAC streams (instead of the MP4 format)
0 string ADIF MPEG ADIF, AAC
>4 byte &0x80
>>13 byte &0x10 \b, VBR
>>13 byte ^0x10 \b, CBR
>>16 byte&0x1E 0x02 \b, single stream
>>16 byte&0x1E 0x04 \b, 2 streams
>>16 byte&0x1E 0x06 \b, 3 streams
>>16 byte &0x08 \b, 4 or more streams
>>16 byte &0x10 \b, 8 or more streams
>>4 byte &0x80 \b, Copyrighted
>>13 byte &0x40 \b, Original Source
>>13 byte &0x20 \b, Home Flag
>4 byte ^0x80
>>4 byte &0x10 \b, VBR
>>4 byte ^0x10 \b, CBR
>>7 byte&0x1E 0x02 \b, single stream
>>7 byte&0x1E 0x04 \b, 2 streams
>>7 byte&0x1E 0x06 \b, 3 streams
>>7 byte &0x08 \b, 4 or more streams
>>7 byte &0x10 \b, 8 or more streams
>>4 byte &0x40 \b, Original Stream(s)
>>4 byte &0x20 \b, Home Source
# Live or stored single AAC stream (used with MPEG-2 systems)
0 beshort&0xFFF6 0xFFF0 MPEG ADTS, AAC
>1 byte ^0x08 \b, v2
>1 byte &0x08 \b, v4
# profile
>>2 byte &0xC0 \b LTP
>2 byte&0xc0 0x00 \b, Main
>2 byte&0xc0 0x40 \b, LC
>2 byte&0xc0 0x80 \b, SSR
# timing
>2 byte&0x3c 0x00 \b, 96 kHz
>2 byte&0x3c 0x04 \b, 88.2 kHz
>2 byte&0x3c 0x08 \b, 64 kHz
>2 byte&0x3c 0x0c \b, 48 kHz
>2 byte&0x3c 0x10 \b, 44.1 kHz
>2 byte&0x3c 0x14 \b, 32 kHz
>2 byte&0x3c 0x18 \b, 24 kHz
>2 byte&0x3c 0x1c \b, 22.05 kHz
>2 byte&0x3c 0x20 \b, 16 kHz
>2 byte&0x3c 0x24 \b, 12 kHz
>2 byte&0x3c 0x28 \b, 11.025 kHz
>2 byte&0x3c 0x2c \b, 8 kHz
# channels/options
>2 beshort&0x01c0 0x0040 \b, monaural
>2 beshort&0x01c0 0x0080 \b, stereo
>2 beshort&0x01c0 0x00c0 \b, stereo + center
>2 beshort&0x01c0 0x0100 \b, stereo+center+LFE
>2 beshort&0x01c0 0x0140 \b, surround
>2 beshort&0x01c0 0x0180 \b, surround + LFE
>2 beshort &0x01C0 \b, surround + side
#>1 byte ^0x01 \b, Data Verify
#>2 byte &0x02 \b, Custom Flag
#>3 byte &0x20 \b, Original Stream
#>3 byte &0x10 \b, Home Source
#>3 byte &0x08 \b, Copyrighted
# Live MPEG-4 audio streams (instead of RTP FlexMux)
0 beshort&0xFFE0 0x56E0 MPEG-4 LOAS
#>1 beshort&0x1FFF x \b, %u byte packet
>3 byte&0xE0 0x40
>>4 byte&0x3C 0x04 \b, single stream
>>4 byte&0x3C 0x08 \b, 2 streams
>>4 byte&0x3C 0x0C \b, 3 streams
>>4 byte &0x08 \b, 4 or more streams
>>4 byte &0x20 \b, 8 or more streams
>3 byte&0xC0 0
>>4 byte&0x78 0x08 \b, single stream
>>4 byte&0x78 0x10 \b, 2 streams
>>4 byte&0x78 0x18 \b, 3 streams
>>4 byte &0x20 \b, 4 or more streams
>>4 byte &0x40 \b, 8 or more streams
0 beshort 0x4DE1 MPEG-4 LO-EP audio stream
# FLI animation format
4 leshort 0xAF11 FLI file
>6 leshort x - %d frames,
>8 leshort x width=%d pixels,
>10 leshort x height=%d pixels,
>12 leshort x depth=%d,
>16 leshort x ticks/frame=%d
# FLC animation format
4 leshort 0xAF12 FLC file
>6 leshort x - %d frames
>8 leshort x width=%d pixels,
>10 leshort x height=%d pixels,
>12 leshort x depth=%d,
>16 leshort x ticks/frame=%d
# DL animation format
# XXX - collision with most `mips' magic
#
# I couldn't find a real magic number for these, however, this
# -appears- to work. Note that it might catch other files, too, so be
# careful!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)! The DL format is really bad.
#
#0 byte 1 DL version 1, medium format (160x100, 4 images/screen)
#>42 byte x - %d screens,
#>43 byte x %d commands
#0 byte 2 DL version 2
#>1 byte 1 - large format (320x200,1 image/screen),
#>1 byte 2 - medium format (160x100,4 images/screen),
#>1 byte >2 - unknown format,
#>42 byte x %d screens,
#>43 byte x %d commands
# Based on empirical evidence, DL version 3 have several nulls following the
# \003. Most of them start with non-null values at hex offset 0x34 or so.
#0 string \3\0\0\0\0\0\0\0\0\0\0\0 DL version 3
# SGI formats
0 string MOVI Silicon Graphics movie file
# Apple Quicktime and ISO types
4 string moov Apple QuickTime
>12 string mvhd \b movie (fast start)
>12 string mdra \b URL
>12 string cmov \b movie (fast start, compressed header)
>12 string rmra \b multiple URLs
4 string mdat Apple QuickTime movie (unoptimized)
4 string wide Apple QuickTime movie (unoptimized)
4 string skip Apple QuickTime movie (modified)
4 string free Apple QuickTime movie (modified)
4 string idsc Apple QuickTime image (fast start)
4 string idat Apple QuickTime image (unoptimized)
4 string pckg Apple QuickTime compressed archive
4 string/B jP JPEG 2000 image
4 string ftyp ISO Media
>8 string isom \b, MPEG v4 system
>8 string mp41 \b, MPEG v4 system, version 1
>8 string mp42 \b, MPEG v4 system, version 2
>8 string/B jp2 \b, JPEG 2000 image
>8 string 3gp \b, MPEG v4 system, 3GPP (H.263/AMR)
>8 string mmp4 \b, MPEG v4 system, Mobile
>8 string/B M4A \b, MPEG v4 system, iTunes AAC-LC
>8 string/B M4P \b, MPEG v4 system, ISMA encrypted AAC-LC
>8 string/B M4B \b, MPEG v4 system, iTunes AAC-LC/AMR
>8 string/B qt \b, Apple QuickTime movie
# iso 13818 transport stream
#
# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
# (the following is a little bit restrictive and works fine for a stream
# that starts with PAT properly. it won't work for stream data, that is
# cut from an input device data right in the middle, but this shouldn't
# disturb)
# syncbyte 8 bit 0x47
# error_ind 1 bit -
# payload_start 1 bit 1
# priority 1 bit -
# PID 13 bit 0x0000
# scrambling 2 bit -
# adaptfld_ctrl 2 bit 1 or 3
# conti_count 4 bit 0
0 belong&0xFF5FFF1F 0x47400010 MPEG transport stream data
>188 byte !0x47 CORRUPTED
# DIF digital video file format <mpruett@sgi.com>
0 belong&0xffffff00 0x1f070000 DIF
>4 byte &0x01 (DVCPRO) movie file
>4 byte ^0x01 (DV) movie file
>3 byte &0x80 (PAL)
>3 byte ^0x80 (NTSC)
# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
0 belong 0x3026b275 Microsoft ASF
# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
0 string \x8aMNG MNG video data,
>4 belong !0x0d0a1a0a CORRUPTED,
>4 belong 0x0d0a1a0a
>>16 belong x %ld x
>>20 belong x %ld
# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
0 string \x8bJNG JNG video data,
>4 belong !0x0d0a1a0a CORRUPTED,
>4 belong 0x0d0a1a0a
>>16 belong x %ld x
>>20 belong x %ld
# Vivo video (Wolfram Kleff)
3 string \x0D\x0AVersion:Vivo Vivo video data
# VRML (Virtual Reality Modelling Language)
0 string/b #VRML\ V1.0\ ascii VRML 1 file
0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file
#---------------------------------------------------------------------------
# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
#
0 string HVQM4 %s
>6 string >\0 v%s
>0 byte x GameCube movie,
>0x34 ubeshort x %d x
>0x36 ubeshort x %d,
>0x26 ubeshort x %dµs,
>0x42 ubeshort 0 no audio
>0x42 ubeshort >0 %dHz audio
#------------------------------------------------------------------------------
# chi: file(1) magic for ChiWriter files
#
0 string \\1cw\ ChiWriter file
>5 string >\0 version %s
0 string \\1cw ChiWriter file
#------------------------------------------------------------------------------
# claris: file(1) magic for claris
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Claris Works a word processor, etc.
# Version 3.0
# .pct claris works clip art files
#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
#*
#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
#null to byte 1000 octal
514 string \377\377\377\377\000 Claris clip art?
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
514 string \377\377\377\377\001 Claris clip art?
>0 string \0\0\0\0\0\0\0\0\0\0\0\0\0 yes.
# Claris works files
# .cwk
0 string \002\000\210\003\102\117\102\117\000\001\206 Claris works document
# .plt
0 string \020\341\000\000\010\010 Claris Works pallete files .plt
# .msp a dictionary file I am not sure about this I have only one .msp file
0 string \002\271\262\000\040\002\000\164 Claris works dictionary
# .usp are user dictionary bits
# I am not sure about a magic header:
#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
# soh S p f 8 U D sp ^ S cr nl p o d i
#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
# a t r i s t sp ^ S cr nl d i v sp #
# .mth Thesaurus
# starts with \0 but no magic header
# .chy Hyphenation file
# I am not sure: 000 210 034 000 000
# other claris files
#./windows/claris/useng.ndx: data
#./windows/claris/xtndtran.l32: data
#./windows/claris/xtndtran.lst: data
#./windows/claris/clworks.lbl: data
#./windows/claris/clworks.prf: data
#./windows/claris/userd.spl: data
#------------------------------------------------------------------------------
# fonts: file(1) magic for font data
#
0 string FONT ASCII vfont text
0 short 0436 Berkeley vfont data
0 short 017001 byte-swapped Berkeley vfont data
# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
0 string %!PS-AdobeFont-1. PostScript Type 1 font text
>20 string >\0 (%s)
6 string %!PS-AdobeFont-1. PostScript Type 1 font program data
# X11 font files in SNF (Server Natural Format) format
0 belong 00000004 X11 SNF font data, MSB first
0 lelong 00000004 X11 SNF font data, LSB first
# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string STARTFONT\040 X11 BDF font text
# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
0 string \001fcp X11 Portable Compiled Font data
>12 byte 0x02 \b, LSB first
>12 byte 0x0a \b, MSB first
0 string D1.0\015 X11 Speedo font data
#------------------------------------------------------------------------------
# FIGlet fonts and controlfiles
# From figmagic supplied with Figlet version 2.2
# "David E. O'Brien" <obrien@FreeBSD.ORG>
0 string flf FIGlet font
>3 string >2a version %-2.2s
0 string flc FIGlet controlfile
>3 string >2a version %-2.2s
# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
0 belong 0x14025919 libGrx font data,
>8 leshort x %dx
>10 leshort x \b%d
>40 string x %s
# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
0 belong 0xff464f4e DOS code page font data collection
7 belong 0x00454741 DOS code page font data
7 belong 0x00564944 DOS code page font data (from Linux?)
4098 string DOSFONT DOSFONT2 encrypted font data
# downloadable fonts for browser (prints type) anthon@mnt.org
0 string PFR1 PFR1 font
>102 string >0 \b: %s
# True Type fonts
0 string \000\001\000\000\000 TrueType font data
0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font
# Opentype font data from Avi Bercovich
0 string OTTO OpenType font data
#------------------------------------------------------------------------------
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@yggdrasil.com
11 string must\ be\ converted\ with\ BinHex BinHex binary text
>41 string x \b, version %.3s
# Stuffit archives are the de facto standard of compression for Macintosh
# files obtained from most archives. (franklsm@tuns.ca)
0 string SIT! StuffIt Archive (data)
>2 string x : %s
0 string SITD StuffIt Deluxe (data)
>2 string x : %s
0 string Seg StuffIt Deluxe Segment (data)
>2 string x : %s
# Newer StuffIt archives (grant@netbsd.org)
0 string StuffIt StuffIt Archive
>162 string >0 : %s
# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
0 string APPL Macintosh Application (data)
>2 string x \b: %s
# Macintosh System files (franklsm@tuns.ca)
0 string zsys Macintosh System File (data)
0 string FNDR Macintosh Finder (data)
0 string libr Macintosh Library (data)
>2 string x : %s
0 string shlb Macintosh Shared Library (data)
>2 string x : %s
0 string cdev Macintosh Control Panel (data)
>2 string x : %s
0 string INIT Macintosh Extension (data)
>2 string x : %s
0 string FFIL Macintosh Truetype Font (data)
>2 string x : %s
0 string LWFN Macintosh Postscript Font (data)
>2 string x : %s
# Additional Macintosh Files (franklsm@tuns.ca)
0 string PACT Macintosh Compact Pro Archive (data)
>2 string x : %s
0 string ttro Macintosh TeachText File (data)
>2 string x : %s
0 string TEXT Macintosh TeachText File (data)
>2 string x : %s
0 string PDF Macintosh PDF File (data)
>2 string x : %s
# MacBinary format (Eric Fischer, enf@pobox.com)
#
# Unfortunately MacBinary doesn't really have a magic number prior
# to the MacBinary III format. The checksum is really the way to
# do it, but the magic file format isn't up to the challenge.
#
# 0 byte 0
# 1 byte # filename length
# 2 string # filename
# 65 string # file type
# 69 string # file creator
# 73 byte # Finder flags
# 74 byte 0
# 75 beshort # vertical posn in window
# 77 beshort # horiz posn in window
# 79 beshort # window or folder ID
# 81 byte # protected?
# 82 byte 0
# 83 belong # length of data segment
# 87 belong # length of resource segment
# 91 belong # file creation date
# 95 belong # file modification date
# 99 beshort # length of comment after resource
# 101 byte # new Finder flags
# 102 string mBIN # (only in MacBinary III)
# 106 byte # char. code of file name
# 107 byte # still more Finder flags
# 116 belong # total file length
# 120 beshort # length of add'l header
# 122 byte 129 # for MacBinary II
# 122 byte 130 # for MacBinary III
# 123 byte 129 # minimum version that can read fmt
# 124 beshort # checksum
#
# This attempts to use the version numbers as a magic number, requiring
# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
# be 0x81. This works for the files I have, but maybe not for everyone's.
# Unfortunately, this magic is quite weak - MPi
#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data
# MacBinary I doesn't have the version number field at all, but MacBinary II
# has been in use since 1987 so I hope there aren't many really old files
# floating around that this will miss. The original spec calls for using
# the nulls in 0, 74, and 82 as the magic number.
#
# Another possibility, that would also work for MacBinary I, is to use
# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
# and that 74 will be 0. So something like
#
# 71 belong&0x80804EFF 0x00000000 Macintosh MacBinary data
#
# >73 byte&0x01 0x01 \b, inited
# >73 byte&0x02 0x02 \b, changed
# >73 byte&0x04 0x04 \b, busy
# >73 byte&0x08 0x08 \b, bozo
# >73 byte&0x10 0x10 \b, system
# >73 byte&0x10 0x20 \b, bundle
# >73 byte&0x10 0x40 \b, invisible
# >73 byte&0x10 0x80 \b, locked
#>65 string x \b, type "%4.4s"
#>65 string 8BIM (PhotoShop)
#>65 string ALB3 (PageMaker 3)
#>65 string ALB4 (PageMaker 4)
#>65 string ALT3 (PageMaker 3)
#>65 string APPL (application)
#>65 string AWWP (AppleWorks word processor)
#>65 string CIRC (simulated circuit)
#>65 string DRWG (MacDraw)
#>65 string EPSF (Encapsulated PostScript)
#>65 string FFIL (font suitcase)
#>65 string FKEY (function key)
#>65 string FNDR (Macintosh Finder)
#>65 string GIFf (GIF image)
#>65 string Gzip (GNU gzip)
#>65 string INIT (system extension)
#>65 string LIB\ (library)
#>65 string LWFN (PostScript font)
#>65 string MSBC (Microsoft BASIC)
#>65 string PACT (Compact Pro archive)
#>65 string PDF\ (Portable Document Format)
#>65 string PICT (picture)
#>65 string PNTG (MacPaint picture)
#>65 string PREF (preferences)
#>65 string PROJ (Think C project)
#>65 string QPRJ (Think Pascal project)
#>65 string SCFL (Defender scores)
#>65 string SCRN (startup screen)
#>65 string SITD (StuffIt Deluxe)
#>65 string SPn3 (SuperPaint)
#>65 string STAK (HyperCard stack)
#>65 string Seg\ (StuffIt segment)
#>65 string TARF (Unix tar archive)
#>65 string TEXT (ASCII)
#>65 string TIFF (TIFF image)
#>65 string TOVF (Eudora table of contents)
#>65 string WDBN (Microsoft Word word processor)
#>65 string WORD (MacWrite word processor)
#>65 string XLS\ (Microsoft Excel)
#>65 string ZIVM (compress (.Z))
#>65 string ZSYS (Pre-System 7 system file)
#>65 string acf3 (Aldus FreeHand)
#>65 string cdev (control panel)
#>65 string dfil (Desk Acessory suitcase)
#>65 string libr (library)
#>65 string nX^d (WriteNow word processor)
#>65 string nX^w (WriteNow dictionary)
#>65 string rsrc (resource)
#>65 string scbk (Scrapbook)
#>65 string shlb (shared library)
#>65 string ttro (SimpleText read-only)
#>65 string zsys (system file)
#>69 string x \b, creator "%4.4s"
# Somewhere, Apple has a repository of registered Creator IDs. These are
# just the ones that I happened to have files from and was able to identify.
#>69 string 8BIM (Adobe Photoshop)
#>69 string ALD3 (PageMaker 3)
#>69 string ALD4 (PageMaker 4)
#>69 string ALFA (Alpha editor)
#>69 string APLS (Apple Scanner)
#>69 string APSC (Apple Scanner)
#>69 string BRKL (Brickles)
#>69 string BTFT (BitFont)
#>69 string CCL2 (Common Lisp 2)
#>69 string CCL\ (Common Lisp)
#>69 string CDmo (The Talking Moose)
#>69 string CPCT (Compact Pro)
#>69 string CSOm (Eudora)
#>69 string DMOV (Font/DA Mover)
#>69 string DSIM (DigSim)
#>69 string EDIT (Macintosh Edit)
#>69 string ERIK (Macintosh Finder)
#>69 string EXTR (self-extracting archive)
#>69 string Gzip (GNU gzip)
#>69 string KAHL (Think C)
#>69 string LWFU (LaserWriter Utility)
#>69 string LZIV (compress)
#>69 string MACA (MacWrite)
#>69 string MACS (Macintosh operating system)
#>69 string MAcK (MacKnowledge terminal emulator)
#>69 string MLND (Defender)
#>69 string MPNT (MacPaint)
#>69 string MSBB (Microsoft BASIC (binary))
#>69 string MSWD (Microsoft Word)
#>69 string NCSA (NCSA Telnet)
#>69 string PJMM (Think Pascal)
#>69 string PSAL (Hunt the Wumpus)
#>69 string PSI2 (Apple File Exchange)
#>69 string R*ch (BBEdit)
#>69 string RMKR (Resource Maker)
#>69 string RSED (Resource Editor)
#>69 string Rich (BBEdit)
#>69 string SIT! (StuffIt)
#>69 string SPNT (SuperPaint)
#>69 string Unix (NeXT Mac filesystem)
#>69 string VIM! (Vim editor)
#>69 string WILD (HyperCard)
#>69 string XCEL (Microsoft Excel)
#>69 string aCa2 (Fontographer)
#>69 string aca3 (Aldus FreeHand)
#>69 string dosa (Macintosh MS-DOS file system)
#>69 string movr (Font/DA Mover)
#>69 string nX^n (WriteNow)
#>69 string pdos (Apple ProDOS file system)
#>69 string scbk (Scrapbook)
#>69 string ttxt (SimpleText)
#>69 string ufox (Foreign File Access)
# Just in case...
102 string mBIN MacBinary III data with surprising version number
# sas magic from Bruce Foster (bef@nwu.edu)
#
#0 string SAS SAS
#>8 string x %s
0 string SAS SAS
>24 string DATA data file
>24 string CATALOG catalog
>24 string INDEX data file index
>24 string VIEW data view
# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
#
0x54 string SAS SAS 7+
>0x9C string DATA data file
>0x9C string CATALOG catalog
>0x9C string INDEX data file index
>0x9C string VIEW data view
# spss magic for SPSS system and portable files,
# from Bruce Foster (bef@nwu.edu).
0 long 0xc1e2c3c9 SPSS Portable File
>40 string x %s
0 string $FL2 SPSS System File
>24 string x %s
# Macintosh filesystem data
# From "Tom N Harris" <telliamed@mac.com>
# Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
# entries depend on the data arithmetic added after v.35
# There's also some Pascal strings in here, ditto...
# The boot block signature, according to IM:Files, is
# "for HFS volumes, this field always contains the value 0x4C4B."
# But if this is true for MFS or HFS+ volumes, I don't know.
# Alternatively, the boot block is supposed to be zeroed if it's
# unused, so a simply >0 should suffice.
0x400 beshort 0xD2D7 Macintosh MFS data
>0 beshort 0x4C4B (bootable)
>0x40a beshort &0x8000 (locked)
>0x402 beldate-0x7C25B080 x created: %s,
>0x406 beldate-0x7C25B080 >0 last backup: %s,
>0x414 belong x block size: %d,
>0x412 beshort x number of blocks: %d,
>0x424 pstring x volume name: %s
# "BD" is has many false positives
#0x400 beshort 0x4244 Macintosh HFS data
#>0 beshort 0x4C4B (bootable)
#>0x40a beshort &0x8000 (locked)
#>0x40a beshort ^0x0100 (mounted)
#>0x40a beshort &0x0200 (spared blocks)
#>0x40a beshort &0x0800 (unclean)
#>0x47C beshort 0x482B (Embedded HFS+ Volume)
#>0x402 beldate-0x7C25B080 x created: %s,
#>0x406 beldate-0x7C25B080 x last modified: %s,
#>0x440 beldate-0x7C25B080 >0 last backup: %s,
#>0x414 belong x block size: %d,
#>0x412 beshort x number of blocks: %d,
#>0x424 pstring x volume name: %s
0x400 beshort 0x482B Macintosh HFS Extended
>&0 beshort x version %d data
>0 beshort 0x4C4B (bootable)
>0x404 belong ^0x00000100 (mounted)
>&2 belong &0x00000200 (spared blocks)
>&2 belong &0x00000800 (unclean)
>&2 belong &0x00008000 (locked)
>&6 string x last mounted by: '%.4s',
# really, that should be treated as a belong and we print a string
# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
>&14 beldate-0x7C25B080 x created: %s,
# only the creation date is local time, all other timestamps in HFS+ are UTC.
>&18 bedate-0x7C25B080 x last modified: %s,
>&22 bedate-0x7C25B080 >0 last backup: %s,
>&26 bedate-0x7C25B080 >0 last checked: %s,
>&38 belong x block size: %d,
>&42 belong x number of blocks: %d,
>&46 belong x free blocks: %d
# I don't think this is really necessary since it doesn't do much and
# anything with a valid driver descriptor will also have a valid
# partition map
#0 beshort 0x4552 Apple Device Driver data
#>&24 beshort =1 \b, MacOS
# Is that the partition type a cstring or a pstring? Well, IM says "strings
# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a
# cstring. Of course, partitions can contain more than four entries, but
# what're you gonna do?
0x200 beshort 0x504D Apple Partition data
>0x2 beshort x block size: %d,
>0x230 string x first type: %s,
>0x210 string x name: %s,
>0x254 belong x number of blocks: %d,
>0x400 beshort 0x504D
>>0x430 string x second type: %s,
>>0x410 string x name: %s,
>>0x454 belong x number of blocks: %d,
>>0x800 beshort 0x504D
>>>0x830 string x third type: %s,
>>>0x810 string x name: %s,
>>>0x854 belong x number of blocks: %d,
>>>0xa00 beshort 0x504D
>>>>0xa30 string x fourth type: %s,
>>>>0xa10 string x name: %s,
>>>>0xa54 belong x number of blocks: %d
# AFAIK, only the signature is different
0x200 beshort 0x5453 Apple Old Partition data
>0x2 beshort x block size: %d,
>0x230 string x first type: %s,
>0x210 string x name: %s,
>0x254 belong x number of blocks: %d,
>0x400 beshort 0x504D
>>0x430 string x second type: %s,
>>0x410 string x name: %s,
>>0x454 belong x number of blocks: %d,
>>0x800 beshort 0x504D
>>>0x830 string x third type: %s,
>>>0x810 string x name: %s,
>>>0x854 belong x number of blocks: %d,
>>>0xa00 beshort 0x504D
>>>>0xa30 string x fourth type: %s,
>>>>0xa10 string x name: %s,
>>>>0xa54 belong x number of blocks: %d
# From: Remi Mommsen <mommsen@slac.stanford.edu>
0 string BOMStore Mac OS X bill of materials (BOM) fil
#------------------------------------------------------------------------------
# mathematica: file(1) magic for mathematica files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Mathematica a multi-purpose math program
# versions 2.2 and 3.0
#mathematica .mb
0 string \064\024\012\000\035\000\000\000 Mathematica version 2 notebook
0 string \064\024\011\000\035\000\000\000 Mathematica version 2 notebook
# .ma
# multiple possibilites:
0 string (*^\n\n::[\011frontEndVersion\ =\ Mathematica notebook
#>41 string >\0 %s
#0 string (*^\n\n::[\011palette Mathematica notebook version 2.x
#0 string (*^\n\n::[\011Information Mathematica notebook version 2.x
#>675 string >\0 %s #doesn't work well
# there may be 'cr' instread of 'nl' in some does this matter?
# generic:
0 string (*^\r\r::[\011 Mathematica notebook version 2.x
0 string \(\*\^\r\n\r\n\:\:\[\011 Mathematica notebook version 2.x
0 string (*^\015 Mathematica notebook version 2.x
0 string (*^\n\r\n\r::[\011 Mathematica notebook version 2.x
0 string (*^\r::[\011 Mathematica notebook version 2.x
0 string (*^\r\n::[\011 Mathematica notebook version 2.x
0 string (*^\n\n::[\011 Mathematica notebook version 2.x
0 string (*^\n::[\011 Mathematica notebook version 2.x
# Mathematica .mx files
#0 string (*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*) Mathematica binary file
0 string (*This\ is\ a\ Mathematica\ binary\ Mathematica binary file
#>71 string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
# >71... is optional
>88 string >\0 from %s
# Mathematica files PBF:
# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
0 string MMAPBF\000\001\000\000\000\203\000\001\000 Mathematica PBF (fonts I think)
# .ml files These are menu resources I think
# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
# how to put that into a magic rule?
4 string \ A~ MAthematica .ml file
# .nb files
#too long 0 string (***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook Mathematica 3.0 notebook
0 string (*********************** Mathematica 3.0 notebook
# other (* matches it is a comment start in these langs
0 string (* Mathematica, or Pascal, Modula-2 or 3 code text
#########################
# MatLab v5
0 string MATLAB Matlab v5 mat-file
>126 short 0x494d (big endian)
>>124 beshort x version 0x%04x
>126 short 0x4d49 (little endian)
>>124 leshort x version 0x%04x
#------------------------------------------------------------------------------
# teapot: file(1) magic for "teapot" spreadsheet
#
0 string #!teapot\012xdr teapot work sheet (XDR format)
#------------------------------------------------------------------------------
# psion: file(1) magic for Psion handhelds data
# from: Peter Breitenlohner <peb@mppmu.mpg.de>
#
0 lelong 0x10000037 Psion Series 5
>4 lelong 0x10000039 font file
>4 lelong 0x1000003A printer driver
>4 lelong 0x1000003B clipboard
>4 lelong 0x10000042 multi-bitmap image
>4 lelong 0x1000006A application infomation file
>4 lelong 0x1000006D
>>8 lelong 0x1000007D sketch image
>>8 lelong 0x1000007E voice note
>>8 lelong 0x1000007F word file
>>8 lelong 0x10000085 OPL program
>>8 lelong 0x10000088 sheet file
>>8 lelong 0x100001C4 EasyFax initialisation file
>4 lelong 0x10000073 OPO module
>4 lelong 0x10000074 OPL application
>4 lelong 0x1000008A exported multi-bitmap image
0 lelong 0x10000041 Psion Series 5 ROM multi-bitmap image
0 lelong 0x10000050 Psion Series 5
>4 lelong 0x1000006D database
>4 lelong 0x100000E4 ini file
0 lelong 0x10000079 Psion Series 5 binary:
>4 lelong 0x00000000 DLL
>4 lelong 0x10000049 comms hardware library
>4 lelong 0x1000004A comms protocol library
>4 lelong 0x1000005D OPX
>4 lelong 0x1000006C application
>4 lelong 0x1000008D DLL
>4 lelong 0x100000AC logical device driver
>4 lelong 0x100000AD physical device driver
>4 lelong 0x100000E5 file transfer protocol
>4 lelong 0x100000E5 file transfer protocol
>4 lelong 0x10000140 printer defintion
>4 lelong 0x10000141 printer defintion
0 lelong 0x1000007A Psion Series 5 executable
#------------------------------------------------------------------------------
# diff: file(1) magic for diff(1) output
#
0 string diff\ 'diff' output text
0 string ***\ 'diff' output text
0 string Only\ in\ 'diff' output text
0 string Common\ subdirectories:\ 'diff' output text
#------------------------------------------------------------------------------
# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
# Based on info from
# <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
0 belong 9994 ESRI Shapefile
>4 belong =0
>8 belong =0
>12 belong =0
>16 belong =0
>20 belong =0
>28 lelong x version %d
>24 belong x length %d
>32 lelong =0 type Null Shape
>32 lelong =1 type Point
>32 lelong =3 type PolyLine
>32 lelong =5 type Polygon
>32 lelong =8 type MultiPoint
>32 lelong =11 type PointZ
>32 lelong =13 type PolyLineZ
>32 lelong =15 type PolygonZ
>32 lelong =18 type MultiPointZ
>32 lelong =21 type PointM
>32 lelong =23 type PolyLineM
>32 lelong =25 type PolygonM
>32 lelong =28 type MultiPointM
>32 lelong =31 type MultiPatch
#------------------------------------------------------------------------------
# GIMP Gradient: file(1) magic for the GIMP's gradient data files
# by Federico Mena <federico@nuclecu.unam.mx>
0 string GIMP\ Gradient GIMP gradient data
#------------------------------------------------------------------------------
# XCF: file(1) magic for the XCF image format used in the GIMP developed
# by Spencer Kimball and Peter Mattis
# ('Bucky' LaDieu, nega@vt.edu)
0 string gimp\ xcf GIMP XCF image data,
>9 string file version 0,
>9 string v version
>>10 string >\0 %s,
>14 belong x %lu x
>18 belong x %lu,
>22 belong 0 RGB Color
>22 belong 1 Greyscale
>22 belong 2 Indexed Color
>22 belong >2 Unknown Image Type.
#------------------------------------------------------------------------------
# XCF: file(1) magic for the patterns used in the GIMP, developed
# by Spencer Kimball and Peter Mattis
# ('Bucky' LaDieu, nega@vt.edu)
20 string GPAT GIMP pattern data,
>24 string x %s
#------------------------------------------------------------------------------
# XCF: file(1) magic for the brushes used in the GIMP, developed
# by Spencer Kimball and Peter Mattis
# ('Bucky' LaDieu, nega@vt.edu)
20 string GIMP GIMP brush data
#------------------------------------------------------------------------------
# adi: file(1) magic for ADi's objects
# From Gregory McGarry <g.mcgarry@ieee.org>
#
0 leshort 0x521c COFF DSP21k
>18 lelong &02 executable,
>18 lelong ^02
>>18 lelong &01 static object,
>>18 lelong ^01 relocatable object,
>18 lelong &010 stripped
>18 lelong ^010 not stripped
#------------------------------------------------------------------------------
# autocad: file(1) magic for cad files
#
# AutoCAD DWG versions R13/R14 (www.autodesk.com)
# Written December 01, 2003 by Lester Hightower
# Based on the DWG File Format Specifications at http://www.opendwg.org/
0 string \101\103\061\060\061 AutoCAD
>5 string \062\000\000\000\000 DWG ver. R13
>5 string \064\000\000\000\000 DWG ver. R14
# Microstation DGN/CIT Files (www.bentley.com)
# Written October 30, 2003 by Lester Hightower
# DGN is the default file extension of Microstation/Intergraph CAD files.
# CIT is the proprietary raster format (similar to TIFF) used to attach
# raster underlays to Microstation DGN (vector) drawings.
#
# http://www.wotsit.org/search.asp
# http://filext.com/detaillist.php?extdetail=DGN
# http://filext.com/detaillist.php?extdetail=CIT
#
# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
0 string \010\011\376 Microstation
>3 string \002
>>30 string \372\104 DGN File
>>30 string \172\104 DGN File
>>30 string \026\105 DGN File
>4 string \030\000\000 CIT File
# AutoCad, from Nahuel Greco
0 string AC1012 AutoCad (release 12)
0 string AC1014 AutoCad (release 14)
#------------------------------------------------------------------------------
# T602 editor documents
# by David Necas <yeti@physics.muni.cz>
0 string @CT\ T602 document data,
>4 string 0 Kamenicky
>4 string 1 CP 852
>4 string 2 KOI8-CS
>4 string >2 unknown encoding
# Vi IMproved Encrypted file
# by David Necas <yeti@physics.muni.cz>
0 string VimCrypt~ Vim encrypted file data
#------------------------------------------------------------------------------
# tex: file(1) magic for TeX files
#
# From <conklin@talisman.kaleida.com>
# Although we may know the offset of certain text fields in TeX DVI
# and font files, we can't use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0 string \367\002 TeX DVI file
>16 string >\0 (%s)
0 string \367\203 TeX generic font data
0 string \367\131 TeX packed font data
>3 string >\0 (%s)
0 string \367\312 TeX virtual font data
0 string This\ is\ TeX, TeX transcript text
0 string This\ is\ METAFONT, METAFONT transcript text
# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data. The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2 string \000\021 TeX font metric data
>33 string >\0 (%s)
2 string \000\022 TeX font metric data
>33 string >\0 (%s)
# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \\input\ texinfo Texinfo source text
0 string This\ is\ Info\ file GNU Info text
# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
0 string \\input TeX document text
0 string \\section LaTeX document text
0 string \\setlength LaTeX document text
0 string \\documentstyle LaTeX document text
0 string \\chapter LaTeX document text
0 string \\documentclass LaTeX 2e document text
0 string \\relax LaTeX auxiliary file
0 string \\contentsline LaTeX table of contents
0 string %\ -*-latex-*- LaTeX document text
# Tex document, from Hendrik Scholz <hendrik@scholz.net>
0 string \\ifx TeX document text
# Index and glossary files
0 string \\indexentry LaTeX raw index file
0 string \\begin{theindex} LaTeX sorted index
0 string \\glossaryentry LaTeX raw glossary
0 string \\begin{theglossary} LaTeX sorted glossary
0 string This\ is\ makeindex Makeindex log file
# End of TeX
#------------------------------------------------------------------------------
# file(1) magic for BibTex text files
# From Hendrik Scholz <hendrik@scholz.net>
0 string/c @article{ BibTeX text file
0 string/c @book{ BibTeX text file
0 string/c @inbook{ BibTeX text file
0 string/c @incollection{ BibTeX text file
0 string/c @inproceedings{ BibTeX text file
0 string/c @manual{ BibTeX text file
0 string/c @misc{ BibTeX text file
0 string/c @preamble{ BibTeX text file
0 string/c @phdthesis{ BibTeX text file
0 string/c @techreport{ BibTeX text file
0 string/c @unpublished{ BibTeX text file
73 string %%%\ \ BibTeX-file{ BibTex text file (with full header)
73 string %%%\ \ @BibTeX-style-file{ BibTeX style text file (with full header)
0 string %\ BibTeX\ standard\ bibliography\ BibTeX standard bibliography style text file
0 string %\ BibTeX\ ` BibTeX custom bibliography style text file
0 string @c\ @mapfile{ TeX font aliases text file
#------------------------------------------------------------------------------
# psdbms: file(1) magic for psdatabase
#
0 belong&0xff00ffff 0x56000000 ps database
>1 string >\0 version %s
>4 string >\0 from kernel %s
#------------------------------------------------------------------------------
# convex: file(1) magic for Convex boxes
#
# Convexes are big-endian.
#
# /*\
# * Below are the magic numbers and tests added for Convex.
# * Added at beginning, because they are expected to be used most.
# \*/
0 belong 0507 Convex old-style object
>16 belong >0 not stripped
0 belong 0513 Convex old-style demand paged executable
>16 belong >0 not stripped
0 belong 0515 Convex old-style pre-paged executable
>16 belong >0 not stripped
0 belong 0517 Convex old-style pre-paged, non-swapped executable
>16 belong >0 not stripped
0 belong 0x011257 Core file
#
# The following are a series of dump format magic numbers. Each one
# corresponds to a drastically different dump format. The first on is
# the original dump format on a 4.1 BSD or earlier file system. The
# second marks the change between the 4.1 file system and the 4.2 file
# system. The Third marks the changing of the block size from 1K
# to 2K to be compatible with an IDC file system. The fourth indicates
# a dump that is dependent on Convex Storage Manager, because data in
# secondary storage is not physically contained within the dump.
# The restore program uses these number to determine how the data is
# to be extracted.
#
24 belong =60011 dump format, 4.1 BSD or earlier
24 belong =60012 dump format, 4.2 or 4.3 BSD without IDC
24 belong =60013 dump format, 4.2 or 4.3 BSD (IDC compatible)
24 belong =60014 dump format, Convex Storage Manager by-reference dump
#
# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
# If there is no `=' sign, assume just checking for whether the bit is set?
#
0 belong 0601 Convex SOFF
>88 belong&0x000f0000 =0x00000000 c1
>88 belong &0x00010000 c2
>88 belong &0x00020000 c2mp
>88 belong &0x00040000 parallel
>88 belong &0x00080000 intrinsic
>88 belong &0x00000001 demand paged
>88 belong &0x00000002 pre-paged
>88 belong &0x00000004 non-swapped
>88 belong &0x00000008 POSIX
#
>84 belong &0x80000000 executable
>84 belong &0x40000000 object
>84 belong&0x20000000 =0 not stripped
>84 belong&0x18000000 =0x00000000 native fpmode
>84 belong&0x18000000 =0x10000000 ieee fpmode
>84 belong&0x18000000 =0x18000000 undefined fpmode
#
0 belong 0605 Convex SOFF core
#
0 belong 0607 Convex SOFF checkpoint
>88 belong&0x000f0000 =0x00000000 c1
>88 belong &0x00010000 c2
>88 belong &0x00020000 c2mp
>88 belong &0x00040000 parallel
>88 belong &0x00080000 intrinsic
>88 belong &0x00000008 POSIX
#
>84 belong&0x18000000 =0x00000000 native fpmode
>84 belong&0x18000000 =0x10000000 ieee fpmode
>84 belong&0x18000000 =0x18000000 undefined fpmode
#------------------------------------------------------------------------------
# freebsd: file(1) magic for FreeBSD objects
#
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
# little-endian on x86).
#
# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
# schemes for distinguishing between executable images, shared libraries,
# and object files.
#
# FreeBSD says:
#
# Regardless of whether it's pure, demand-paged, or none of the
# above:
#
# if the entry point is < 4096, then it's a shared library if
# the "has run-time loader information" bit is set, and is
# position-independent if the "is position-independent" bit
# is set;
#
# if the entry point is >= 4096 (or >4095, same thing), then it's
# an executable, and is dynamically-linked if the "has run-time
# loader information" bit is set.
#
# On x86, NetBSD says:
#
# If it's neither pure nor demand-paged:
#
# if it has the "has run-time loader information" bit set, it's
# a dynamically-linked executable;
#
# if it doesn't have that bit set, then:
#