--- ./Magdir/elf.orig 2003-02-27 12:47:46.000000000 -0800 +++ ./Magdir/elf 2003-03-05 00:07:34.000000000 -0800 @@ -77,6 +77,7 @@ >>18 leshort 17 Fujitsu VPP500, >>18 leshort 18 SPARC32PLUS, >>18 leshort 20 PowerPC, +>>18 leshort 22 IBM S/390, >>18 leshort 36 NEC V800, >>18 leshort 37 Fujitsu FR20, >>18 leshort 38 TRW RH-32, @@ -99,6 +100,7 @@ >>18 leshort 75 Digital VAX, >>18 leshort 97 NatSemi 32k, >>18 leshort 0x9026 Alpha (unofficial), +>>18 leshort 0xa390 IBM S/390 (obsolete), >>20 lelong 0 invalid version >>20 lelong 1 version 1 >>36 lelong 1 MathCoPro/FPU/MAU Required @@ -162,6 +164,7 @@ >>>36 belong&0xffff00 &0x000800 Sun UltraSPARC3 Extensions Required, >>18 beshort 20 PowerPC or cisco 4500, >>18 beshort 21 cisco 7500, +>>18 beshort 22 IBM S/390, >>18 beshort 24 cisco SVIP, >>18 beshort 25 cisco 7200, >>18 beshort 36 NEC V800 or cisco 12000, @@ -186,10 +189,14 @@ >>18 beshort 75 Digital VAX, >>18 beshort 97 NatSemi 32k, >>18 beshort 0x9026 Alpha (unofficial), +>>18 beshort 0xa390 IBM S/390 (obsolete), >>20 belong 0 invalid version >>20 belong 1 version 1 >>36 belong 1 MathCoPro/FPU/MAU Required ->8 string >\0 (%s) +# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed +# like proper ELF, but extracting the string had bad results. +>4 byte <0x80 +>>8 string >\0 (%s) >8 string \0 >>7 byte 0 (SYSV) >>7 byte 1 (HP-UX) --- ./Magdir/palm.orig 1999-01-14 07:54:33.000000000 -0800 +++ ./Magdir/palm 2003-03-05 00:07:34.000000000 -0800 @@ -2,8 +2,8 @@ #------------------------------------------------------------------------------ # palm: file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks # -# Brian Lalor +# Brian Lalor # appl 60 belong 0x6170706c PalmOS application >0 string >\0 "%s" --- ./Magdir/human68k.orig 2002-05-21 08:32:29.000000000 -0700 +++ ./Magdir/human68k 2003-03-05 00:07:34.000000000 -0800 @@ -2,18 +2,19 @@ #------------------------------------------------------------------------------ # human68k: file(1) magic for Human68k (X680x0 DOS) binary formats -0 string HU Human68k ->68 string LZX LZX compressed ->>72 string >\0 (version %s) ->(8.L+74) string LZX LZX compressed ->>(8.L+78) string >\0 (version %s) ->60 belong >0 binded ->(8.L+66) string #HUPAIR hupair ->0 string HU X executable ->(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 ->4 belong >0 - base address 0x%x ->28 belong >0 not stripped ->32 belong >0 with debug information +# Too simple - MPi +#0 string HU Human68k +#>68 string LZX LZX compressed +#>>72 string >\0 (version %s) +#>(8.L+74) string LZX LZX compressed +#>>(8.L+78) string >\0 (version %s) +#>60 belong >0 binded +#>(8.L+66) string #HUPAIR hupair +#>0 string HU X executable +#>(8.L+74) string #LIBCV1 - linked PD LIBC ver 1 +#>4 belong >0 - base address 0x%x +#>28 belong >0 not stripped +#>32 belong >0 with debug information 0 beshort 0x601a Human68k Z executable 0 beshort 0x6000 Human68k object file 0 belong 0xd1000000 Human68k ar binary archive --- ./Magdir/pgp.orig 1996-03-17 12:52:31.000000000 -0800 +++ ./Magdir/pgp 2003-03-05 00:07:34.000000000 -0800 @@ -6,7 +6,7 @@ 0 beshort 0x9501 PGP key security ring 0 beshort 0x9500 PGP key security ring 0 beshort 0xa600 PGP encrypted data -0 string -----BEGIN\040PGP PGP armored data +0 string -----BEGIN\040PGP PGP armored text >15 string PUBLIC\040KEY\040BLOCK- public key block >15 string MESSAGE- message >15 string SIGNED\040MESSAGE- signed message --- ./Magdir/macintosh.orig 2003-02-27 12:47:46.000000000 -0800 +++ ./Magdir/macintosh 2003-03-05 00:07:34.000000000 -0800 @@ -88,7 +88,8 @@ # that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second # be 0x81. This works for the files I have, but maybe not for everyone's. -122 beshort&0xFCFF 0x8081 Macintosh MacBinary data +# Unfortunately, this magic is quite weak - MPi +#122 beshort&0xFCFF 0x8081 Macintosh MacBinary data # MacBinary I doesn't have the version number field at all, but MacBinary II # has been in use since 1987 so I hope there aren't many really old files @@ -110,118 +111,118 @@ # >73 byte&0x10 0x20 \b, bundle # >73 byte&0x10 0x40 \b, invisible # >73 byte&0x10 0x80 \b, locked - ->65 string x \b, type "%4.4s" - ->65 string 8BIM (PhotoShop) ->65 string ALB3 (PageMaker 3) ->65 string ALB4 (PageMaker 4) ->65 string ALT3 (PageMaker 3) ->65 string APPL (application) ->65 string AWWP (AppleWorks word processor) ->65 string CIRC (simulated circuit) ->65 string DRWG (MacDraw) ->65 string EPSF (Encapsulated PostScript) ->65 string FFIL (font suitcase) ->65 string FKEY (function key) ->65 string FNDR (Macintosh Finder) ->65 string GIFf (GIF image) ->65 string Gzip (GNU gzip) ->65 string INIT (system extension) ->65 string LIB\ (library) ->65 string LWFN (PostScript font) ->65 string MSBC (Microsoft BASIC) ->65 string PACT (Compact Pro archive) ->65 string PDF\ (Portable Document Format) ->65 string PICT (picture) ->65 string PNTG (MacPaint picture) ->65 string PREF (preferences) ->65 string PROJ (Think C project) ->65 string QPRJ (Think Pascal project) ->65 string SCFL (Defender scores) ->65 string SCRN (startup screen) ->65 string SITD (StuffIt Deluxe) ->65 string SPn3 (SuperPaint) ->65 string STAK (HyperCard stack) ->65 string Seg\ (StuffIt segment) ->65 string TARF (Unix tar archive) ->65 string TEXT (ASCII) ->65 string TIFF (TIFF image) ->65 string TOVF (Eudora table of contents) ->65 string WDBN (Microsoft Word word processor) ->65 string WORD (MacWrite word processor) ->65 string XLS\ (Microsoft Excel) ->65 string ZIVM (compress (.Z)) ->65 string ZSYS (Pre-System 7 system file) ->65 string acf3 (Aldus FreeHand) ->65 string cdev (control panel) ->65 string dfil (Desk Acessory suitcase) ->65 string libr (library) ->65 string nX^d (WriteNow word processor) ->65 string nX^w (WriteNow dictionary) ->65 string rsrc (resource) ->65 string scbk (Scrapbook) ->65 string shlb (shared library) ->65 string ttro (SimpleText read-only) ->65 string zsys (system file) - ->69 string x \b, creator "%4.4s" - -# Somewhere, Apple has a repository of registered Creator IDs. These are -# just the ones that I happened to have files from and was able to identify. - ->69 string 8BIM (Adobe Photoshop) ->69 string ALD3 (PageMaker 3) ->69 string ALD4 (PageMaker 4) ->69 string ALFA (Alpha editor) ->69 string APLS (Apple Scanner) ->69 string APSC (Apple Scanner) ->69 string BRKL (Brickles) ->69 string BTFT (BitFont) ->69 string CCL2 (Common Lisp 2) ->69 string CCL\ (Common Lisp) ->69 string CDmo (The Talking Moose) ->69 string CPCT (Compact Pro) ->69 string CSOm (Eudora) ->69 string DMOV (Font/DA Mover) ->69 string DSIM (DigSim) ->69 string EDIT (Macintosh Edit) ->69 string ERIK (Macintosh Finder) ->69 string EXTR (self-extracting archive) ->69 string Gzip (GNU gzip) ->69 string KAHL (Think C) ->69 string LWFU (LaserWriter Utility) ->69 string LZIV (compress) ->69 string MACA (MacWrite) ->69 string MACS (Macintosh operating system) ->69 string MAcK (MacKnowledge terminal emulator) ->69 string MLND (Defender) ->69 string MPNT (MacPaint) ->69 string MSBB (Microsoft BASIC (binary)) ->69 string MSWD (Microsoft Word) ->69 string NCSA (NCSA Telnet) ->69 string PJMM (Think Pascal) ->69 string PSAL (Hunt the Wumpus) ->69 string PSI2 (Apple File Exchange) ->69 string R*ch (BBEdit) ->69 string RMKR (Resource Maker) ->69 string RSED (Resource Editor) ->69 string Rich (BBEdit) ->69 string SIT! (StuffIt) ->69 string SPNT (SuperPaint) ->69 string Unix (NeXT Mac filesystem) ->69 string VIM! (Vim editor) ->69 string WILD (HyperCard) ->69 string XCEL (Microsoft Excel) ->69 string aCa2 (Fontographer) ->69 string aca3 (Aldus FreeHand) ->69 string dosa (Macintosh MS-DOS file system) ->69 string movr (Font/DA Mover) ->69 string nX^n (WriteNow) ->69 string pdos (Apple ProDOS file system) ->69 string scbk (Scrapbook) ->69 string ttxt (SimpleText) ->69 string ufox (Foreign File Access) +# +# >65 string x \b, type "%4.4s" +# +# >65 string 8BIM (PhotoShop) +# >65 string ALB3 (PageMaker 3) +# >65 string ALB4 (PageMaker 4) +# >65 string ALT3 (PageMaker 3) +# >65 string APPL (application) +# >65 string AWWP (AppleWorks word processor) +# >65 string CIRC (simulated circuit) +# >65 string DRWG (MacDraw) +# >65 string EPSF (Encapsulated PostScript) +# >65 string FFIL (font suitcase) +# >65 string FKEY (function key) +# >65 string FNDR (Macintosh Finder) +# >65 string GIFf (GIF image) +# >65 string Gzip (GNU gzip) +# >65 string INIT (system extension) +# >65 string LIB\ (library) +# >65 string LWFN (PostScript font) +# >65 string MSBC (Microsoft BASIC) +# >65 string PACT (Compact Pro archive) +# >65 string PDF\ (Portable Document Format) +# >65 string PICT (picture) +# >65 string PNTG (MacPaint picture) +# >65 string PREF (preferences) +# >65 string PROJ (Think C project) +# >65 string QPRJ (Think Pascal project) +# >65 string SCFL (Defender scores) +# >65 string SCRN (startup screen) +# >65 string SITD (StuffIt Deluxe) +# >65 string SPn3 (SuperPaint) +# >65 string STAK (HyperCard stack) +# >65 string Seg\ (StuffIt segment) +# >65 string TARF (Unix tar archive) +# >65 string TEXT (ASCII) +# >65 string TIFF (TIFF image) +# >65 string TOVF (Eudora table of contents) +# >65 string WDBN (Microsoft Word word processor) +# >65 string WORD (MacWrite word processor) +# >65 string XLS\ (Microsoft Excel) +# >65 string ZIVM (compress (.Z)) +# >65 string ZSYS (Pre-System 7 system file) +# >65 string acf3 (Aldus FreeHand) +# >65 string cdev (control panel) +# >65 string dfil (Desk Acessory suitcase) +# >65 string libr (library) +# >65 string nX^d (WriteNow word processor) +# >65 string nX^w (WriteNow dictionary) +# >65 string rsrc (resource) +# >65 string scbk (Scrapbook) +# >65 string shlb (shared library) +# >65 string ttro (SimpleText read-only) +# >65 string zsys (system file) +# +# >69 string x \b, creator "%4.4s" +# +# # Somewhere, Apple has a repository of registered Creator IDs. These are +# # just the ones that I happened to have files from and was able to identify. +# +# >69 string 8BIM (Adobe Photoshop) +# >69 string ALD3 (PageMaker 3) +# >69 string ALD4 (PageMaker 4) +# >69 string ALFA (Alpha editor) +# >69 string APLS (Apple Scanner) +# >69 string APSC (Apple Scanner) +# >69 string BRKL (Brickles) +# >69 string BTFT (BitFont) +# >69 string CCL2 (Common Lisp 2) +# >69 string CCL\ (Common Lisp) +# >69 string CDmo (The Talking Moose) +# >69 string CPCT (Compact Pro) +# >69 string CSOm (Eudora) +# >69 string DMOV (Font/DA Mover) +# >69 string DSIM (DigSim) +# >69 string EDIT (Macintosh Edit) +# >69 string ERIK (Macintosh Finder) +# >69 string EXTR (self-extracting archive) +# >69 string Gzip (GNU gzip) +# >69 string KAHL (Think C) +# >69 string LWFU (LaserWriter Utility) +# >69 string LZIV (compress) +# >69 string MACA (MacWrite) +# >69 string MACS (Macintosh operating system) +# >69 string MAcK (MacKnowledge terminal emulator) +# >69 string MLND (Defender) +# >69 string MPNT (MacPaint) +# >69 string MSBB (Microsoft BASIC (binary)) +# >69 string MSWD (Microsoft Word) +# >69 string NCSA (NCSA Telnet) +# >69 string PJMM (Think Pascal) +# >69 string PSAL (Hunt the Wumpus) +# >69 string PSI2 (Apple File Exchange) +# >69 string R*ch (BBEdit) +# >69 string RMKR (Resource Maker) +# >69 string RSED (Resource Editor) +# >69 string Rich (BBEdit) +# >69 string SIT! (StuffIt) +# >69 string SPNT (SuperPaint) +# >69 string Unix (NeXT Mac filesystem) +# >69 string VIM! (Vim editor) +# >69 string WILD (HyperCard) +# >69 string XCEL (Microsoft Excel) +# >69 string aCa2 (Fontographer) +# >69 string aca3 (Aldus FreeHand) +# >69 string dosa (Macintosh MS-DOS file system) +# >69 string movr (Font/DA Mover) +# >69 string nX^n (WriteNow) +# >69 string pdos (Apple ProDOS file system) +# >69 string scbk (Scrapbook) +# >69 string ttxt (SimpleText) +# >69 string ufox (Foreign File Access) # Just in case... --- ./Magdir/fonts.orig 1999-11-28 12:02:30.000000000 -0800 +++ ./Magdir/fonts 2003-03-05 00:07:34.000000000 -0800 @@ -7,9 +7,9 @@ 0 short 017001 byte-swapped Berkeley vfont data # PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com -0 string %!PS-AdobeFont-1.0 PostScript Type 1 font text +0 string %!PS-AdobeFont-1. PostScript Type 1 font text >20 string >\0 (%s) -6 string %!PS-AdobeFont-1.0 PostScript Type 1 font program data +6 string %!PS-AdobeFont-1. PostScript Type 1 font program data # X11 font files in SNF (Server Natural Format) format 0 belong 00000004 X11 SNF font data, MSB first @@ -49,3 +49,7 @@ # downloadable fonts for browser (prints type) anthon@mnt.org 0 string PFR1 PFR1 font >102 string >0 \b: %s + +# True Type fonts +0 string \000\001\000\000\000 TrueType font data + --- ./Magdir/images.orig 2003-02-08 10:30:39.000000000 -0800 +++ ./Magdir/images 2003-03-05 00:07:34.000000000 -0800 @@ -17,10 +17,16 @@ # `tgatoppm' recognizes a superset (Index may be anything) 1 belong&0xfff7ffff 0x01010000 Targa image data - Map >2 byte&8 8 - RLE +>12 leshort >0 %hd x +>14 leshort >0 %hd 1 belong&0xfff7ffff 0x00020000 Targa image data - RGB >2 byte&8 8 - RLE +>12 leshort >0 %hd x +>14 leshort >0 %hd 1 belong&0xfff7ffff 0x00030000 Targa image data - Mono >2 byte&8 8 - RLE +>12 leshort >0 %hd x +>14 leshort >0 %hd # PBMPLUS images # The next byte following the magic is always whitespace. @@ -158,10 +164,11 @@ >>18 lelong x \b, %d x >>22 lelong x %d x >>28 leshort x %d -0 string IC PC icon data -0 string PI PC pointer image data -0 string CI PC color icon data -0 string CP PC color pointer image data +# Too simple - MPi +#0 string IC PC icon data +#0 string PI PC pointer image data +#0 string CI PC color icon data +#0 string CP PC color pointer image data # Conflicts with other entries [BABYL] #0 string BA PC bitmap array data --- ./Magdir/debian-additions.orig 2003-03-05 00:07:34.000000000 -0800 +++ ./Magdir/debian-additions 2003-03-05 00:07:34.000000000 -0800 @@ -0,0 +1,520 @@ +0 string BEGIN:VCALENDAR vCalendar calendar file + +# VRML: file(1) magic for VRML files +# VRML (Virtual Reality Modelling Language) +0 string/b #VRML\ V1.0\ ascii VRML 1 file +0 string/b #VRML\ V2.0\ utf8 ISO/IEC 14772 VRML 97 file + +################################ +# communcation +################################ + +# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3. +# It is used for conformance testing of communication protocols. +# Added by W. Borgert . +0 string $Suite TTCN Abstract Test Suite +>&1 string $SuiteId +>>&1 string >\n %s +>&2 string $SuiteId +>>&1 string >\n %s +>&3 string $SuiteId +>>&1 string >\n %s + +# MSC (message sequence charts) are a formal description technique, +# described in ITU-T Z.120, mainly used for communication protocols. +# Added by W. Borgert . +0 string mscdocument Message Sequence Chart (document) +0 string msc Message Sequence Chart (chart) +0 string submsc Message Sequence Chart (subchart) + +################################ +# misc tools +################################ + +#----------------------------------------------------------------------------- +# misctools: file(1) magic for miscelanous UNIX tools. +# + +0 string %%!! X-Post-It-Note text + +################################ +# wordprocessors +################################ + +#------------------------------------------------------------------------------ +# wordprocessors: file(1) magic fo word processors. +# + +####### PWP file format used on Smith Corona Personal Word Processors: +2 string \040\040\040\040\040\040\040\040\040\040\040ML4D\040\'92 Smith Corona PWP +>24 byte 2 \b, single spaced +>24 byte 3 \b, 1.5 spaced +>24 byte 4 \b, double spaced +>25 byte 0x42 \b, letter +>25 byte 0x54 \b, legal +>26 byte 0x46 \b, A4 + +################################ +# kimwitu +################################ + +#------------------------------------------------------------------------------ +# kimwitu: file(1) magic for Kimwitu and related tools + +# Synthesizer Generator and Kimwitu share their file format +0 string A#S#C#S#S#L#V#3 Synthesizer Generator or Kimwitu data +# Kimwitu++ uses a slightly different magic +0 string A#S#C#S#S#L#HUB Kimwitu++ data + +################################ +# X11 +################################ + +# ICE authority file data (Wolfram Kleff) +2 string ICE ICE authority data + +# X11 Xauthority file (Wolfram Kleff) +14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data + +################################ +# filesystems +################################ + +# cramfs filesystem - russell@coker.com.au +0 lelong 0x28cd3d45 Linux Compressed ROM File System data, little endian +>4 lelong x size %d +>8 lelong &1 version #2 +>8 lelong &2 sorted_dirs +>8 lelong &4 hole_support +>32 lelong x CRC 0x%x, +>36 lelong x edition %d, +>40 lelong x %d blocks, +>44 lelong x %d files + +0 belong 0x28cd3d45 Linux Compressed ROM File System data, big endian +>4 belong x size %d +>8 belong &1 version #2 +>8 belong &2 sorted_dirs +>8 belong &4 hole_support +>32 belong x CRC 0x%x, +>36 belong x edition %d, +>40 belong x %d blocks, +>44 belong x %d files + +# reiserfs - russell@coker.com.au +0x10034 string ReIsErFs ReiserFS V3.5 +0x10034 string ReIsEr2Fs ReiserFS V3.6 +>0x1002c leshort x block size %d +>0x10032 leshort &2 (mounted or unclean) +>0x10000 lelong x num blocks %d +>0x10040 lelong =1 tea hash +>0x10040 lelong =2 yura hash +>0x10040 lelong =3 r5 hash + +# JFFS - russell@coker.com.au +0 lelong 0x34383931 Linux Journalled Flash File system, little endian +0 belong 0x34383931 Linux Journalled Flash File system, big endian + +# EST flat binary format (which isn't, but anyway) +# From: Mark Brown +0 string ESTFBINR EST flat binary + +# Aculab VoIP firmware +# From: Mark Brown +0 string VoIP\ Startup\ and Aculab VoIP firmware +>35 string x format %s + +# PPCBoot image file +# From: Mark Brown +0 belong 0x27051956 PPCBoot image +>4 string PPCBoot +>>12 string x version %s + +################################ +# database +################################ + +# TDB database from Samba et al - Martin Pool +0 string TDB\ file TDB database +>32 lelong =0x2601196D version 6, little-endian +>>36 lelong x hash size %d bytes + +################################ +# animation +################################ + +# Vivo video (Wolfram Kleff) +3 string \x0D\x0AVersion:Vivo Vivo video data + +################################ +# apple +################################ + +0 string package4 Newton package, +>8 byte 8 NOS 1.x, +>8 byte 9 NOS 2.x, +>12 belong &0x80000000 AutoRemove, +>12 belong &0x40000000 CopyProtect, +>12 belong &0x10000000 NoCompression, + +################################ +# archive +################################ + +# Atari MSA archive - Teemu Hukkanen +0 beshort 0x0e0f Atari MSA archive data +>2 beshort x \b, %d sectors per track +>4 beshort 0 \b, 1 sided +>4 beshort 1 \b, 2 sided +>6 beshort x \b, starting track: %d +>8 beshort x \b, ending track: %d + +# Alternate ZIP string (amc@arwen.cs.berkeley.edu) +0 string PK00PK\003\004 Zip archive data + +################################ +# audio +################################ + +# From Matt Zimmerman +0 string fLaC FLAC compressed audio stream data + +# (ISDN) VBOX voice message file (Wolfram Kleff) +0 string VBOX VBOX voice message data + +################################ +# compress +################################ + +# AFX compressed files (Wolfram Kleff) +2 string -afx- AFX compressed file data + +################################ +# console +################################ + +#----------------------------------------------------------------------------- +# Sony Playstation executables (Adam Sjoegren ) : +0 string PS-X\ EXE Sony Playstation executable +# Area: +>113 string x (%s) + +################################ +# fonts +################################ + +0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font +0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font + +################################ +# images +################################ + +# NITF is defined by United States MIL-STD-2500A +0 string NITF National Imagery Transmission Format +>25 string >\0 dated %.14s + +# PSD (Adobe Photoshop bitmap) (Wolfram Kleff) +0 string 8BPS PSD image data (Adobe Photoshop bitmap) + +# PCX (should be reliable with a 2 byte header - Wolfram Kleff) +0 beshort 0x0A00 PCX image data, version 2.5 +0 beshort 0x0A02 PCX image data, version 2.8 with palette +0 beshort 0x0A03 PCX image data, version 2.8 without palette +0 beshort 0x0A04 PCX image data, version 3.0 (Windows) +0 beshort 0x0A05 PCX image data, version 3.0 + +# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff) +0 belong 0x00010008 GEM Image data +>12 beshort x %d x +>14 beshort x %d, +>4 beshort x %d planes, +>8 beshort x %d x +>10 beshort x %d pixelsize + +# GEM Metafile (Wolfram Kleff) +0 lelong 0x0018FFFF GEM Metafile data +>4 leshort x version %d + +# A Sketch drawing (Michael Loßin). +# +0 string \#\#Sketch Sketch drawing text + +# +# SMJPEG. A custom Motion JPEG format used by Loki Entertainment +# Software Torbjorn Andersson . +# +0 string \0\nSMJPEG SMJPEG +>8 belong x %d.x data +# According to the specification you could find any number of _TXT +# headers here, but I can't think of any way of handling that. None of +# the SMJPEG files I tried it on used this feature. Even if such a +# file is encountered the output should still be reasonable. +>16 string _SND \b, +>>24 beshort >0 %d Hz +>>26 byte 8 8-bit +>>26 byte 16 16-bit +>>28 string NONE uncompressed +# >>28 string APCM ADPCM compressed +>>27 byte 1 mono +>>28 byte 2 stereo +# Help! Isn't there any way to avoid writing this part twice? +>>32 string _VID \b, +# >>>48 string JFIF JPEG +>>>40 belong >0 %d frames +>>>44 beshort >0 (%d x +>>>46 beshort >0 %d) +>16 string _VID \b, +# >>32 string JFIF JPEG +>>24 belong >0 %d frames +>>28 beshort >0 (%d x +>>30 beshort >0 %d) + +0 string Paint\ Shop\ Pro\ Image\ File Paint Shop Pro Image File + +# "thumbnail file" (icon) +# descended from "xv", but in use by other applications as well (Wolfram Kleff) +0 string P7\ 332 XV "thumbnail file" (icon) data + +# taken from fkiss: ( ?) +0 string KiSS KISS/GS +>4 byte 16 color +>>5 byte x %d bit +>>8 leshort x %d colors +>>10 leshort x %d groups +>4 byte 32 cell +>>5 byte x %d bit +>>8 leshort x %d x +>>10 leshort x %d +>>12 leshort x +%d +>>14 leshort x +%d + +# Webshots (www.webshots.com), by John Harrison +0 string C\253\221g\230\0\0\0 Webshots Desktop .wbz file + +# Hercules DASD image files +# From Jan Jaeger +0 string CKD_P370 Hercules CKD DASD image file +>8 long x \b, %d heads per cylinder +>12 long x \b, track size %d bytes +>16 byte x \b, device type 33%2.2X + +0 string CKD_C370 Hercules compressed CKD DASD image file +>8 long x \b, %d heads per cylinder +>12 long x \b, track size %d bytes +>16 byte x \b, device type 33%2.2X + +0 string CKD_S370 Hercules CKD DASD shadow file +>8 long x \b, %d heads per cylinder +>12 long x \b, track size %d bytes +>16 byte x \b, device type 33%2.2X + +# Squeak images and - etoffi@softhome.net +0 string \146\031\0\0 Squeak image data +0 string 'From\040Squeak Squeak program text + +# JNG Image Format, +0 string \x8aJNG MNG image data, +>4 belong !0x0d0a1a0a CORRUPTED, +>4 belong 0x0d0a1a0a + +################################ +# macintosh +################################ + +# Apparently an alternate form (Mathieu Petit-Clair ) +0 string StuffIt StuffIt Archive (data) +>0 string x : %s + +################################ +# mail.news +################################ + +# JAM(mbp) Fidonet message area databases +# JHR file +0 string JAM\0 JAM message area header file +>12 leshort >0 (%d messages) + +# Squish Fidonet message area databases +# SQD file (requires at least one message in the area) +256 leshort 0xAFAE4453 Squish message area data file +>4 leshort >0 (%d messages) + +################################ +# mathematica +################################ + +######################### +# MatLab v5 +0 string MATLAB Matlab v5 mat-file +>126 short 0x494d (big endian) +>>124 beshort x version 0x%04x +>126 short 0x4d49 (little endian) +>>124 leshort x version 0x%04x + +################################ +# motorola +################################ + +# Atari ST/TT... program format (sent by Wolfram Kleff ) +0 beshort 0x601A Atari 68xxx executable, +>2 belong x text len %lu, +>6 belong x data len %lu, +>10 belong x BSS len %lu, +>14 belong x symboltab len %lu, +>18 belong 0 +>22 belong &0x01 fastload flag, +>22 belong &0x02 may be loaded to alternate RAM, +>22 belong &0x04 malloc may be from alternate RAM, +>22 belong x flags: 0x%lX, +>26 beshort 0 no relocation tab +>26 beshort !0 + relocation tab +>30 string SFX [Self-Extracting LZH SFX archive] +>38 string SFX [Self-Extracting LZH SFX archive] +>44 string ZIP! [Self-Extracting ZIP SFX archive] + +0 beshort 0x0064 Atari 68xxx CPX file +>8 beshort x (version %04lx) + +################################ +# msdos +################################ + +# HtmlHelp files (.chm) +0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data + +# GFA-BASIC (Wolfram Kleff) +2 string GFA-BASIC3 GFA-BASIC 3 data + +# DJGPP compiled files +# v >2, uses DPMI & small(2k) stub (Robert vd Boon, rjvdboon@europe.com) +0x200 string go32stub DOS-executable compiled w/DJGPP +>0x20c string >0 (stub v%.4s) +>>0x8b2 string djp [compressed w/%s +>>>&1 string >\0 %.4s] +>>0x8ad string UPX [compressed w/%s +>>>&1 string >\0 %.4s] +>>0x1c string pmodedj stubbed with %s + +################################ +# printer +################################ + +# This would otherwise be recognized as PostScript - nick@debian.org +0 string %!VMF SunClock's Vector Map Format data + +################################ +# palm +################################ + +# Variety of PalmOS document types +# Michael-John Turner +# Thanks to Hasan Umit Ezerce for his DocType +60 string BVokBDIC BDicty PalmOS document +>0 string >\0 "%s" + +60 string DB99DBOS DB PalmOS document +>0 string >\0 "%s" + +60 string vIMGView FireViewer/ImageViewer PalmOS document +>0 string >\0 "%s" + +60 string PmDBPmDB HanDBase PalmOS document +>0 string >\0 "%s" + +60 string InfoINDB InfoView PalmOS document +>0 string >\0 "%s" + +60 string ToGoToGo iSilo PalmOS document +>0 string >\0 "%s" + +60 string JfDbJBas JFile PalmOS document +>0 string >\0 "%s" + +60 string JfDbJFil JFile Pro PalmOS document +>0 string >\0 "%s" + +60 string DATALSdb List PalmOS document +>0 string >\0 "%s" + +60 string Mdb1Mdb1 MobileDB PalmOS document +>0 string >\0 "%s" + +60 string PNRdPPrs PeanutPress PalmOS document +>0 string >\0 "%s" + +60 string DataPlkr Plucker PalmOS document +>0 string >\0 "%s" + +60 string DataSprd QuickSheet PalmOS document +>0 string >\0 "%s" + +60 string SM01SMem SuperMemo PalmOS document +>0 string >\0 "%s" + +60 string DataTlPt TealDoc PalmOS document +>0 string >\0 "%s" + +60 string InfoTlIf TealInfo PalmOS document +>0 string >\0 "%s" + +60 string DataTlMl TealMeal PalmOS document +>0 string >\0 "%s" + +60 string DataTlPt TealPaint PalmOS document +>0 string >\0 "%s" + +60 string dataTDBP ThinkDB PalmOS document +>0 string >\0 "%s" + +60 string TdatTide Tides PalmOS document +>0 string >\0 "%s" + +60 string ToRaTRPW TomeRaider PalmOS document +>0 string >\0 "%s" + +# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net) +# For version 1.xx zTXTs, outputs version and numbers of bookmarks and +# annotations. +# For other versions, just outputs version. +# +0x3C string zTXT A GutenPalm zTXT e-book +>0 string >\0 "%s" +>(0x4E.L) byte 0 +>>(0x4E.L+1) byte x (v0.%02d) +>(0x4E.L) byte 1 +>>(0x4E.L+1) byte x (v1.%02d) +>>>(0x4E.L+10) beshort >0 +>>>>(0x4E.L+10) beshort <2 - 1 bookmark +>>>>(0x4E.L+10) beshort >1 - %d bookmarks +>>>(0x4E.L+14) beshort >0 +>>>>(0x4E.L+14) beshort <2 - 1 annotation +>>>>(0x4E.L+14) beshort >1 - %d annotations +>(0x4E.L) byte >1 (v%d. +>>(0x4E.L+1) byte x %02d) + +# Palm OS .prc file types +0x3C string libr Palm OS dynamic library data +>0 string >\0 "%s" +0x3C string ptch Palm OS operating system patch data +>0 string >\0 "%s" + +################################ +# spectrum +################################ + +# The following three blocks are from pak21-spectrum@srcf.ucam.org +# TZX tape images +0 string ZXTape!\x1a Spectrum .TZX data +>8 byte x version %d +>9 byte x .%d + +# RZX input recording files +0 string RZX! Spectrum .RZX data +>4 byte x version %d +>5 byte x .%d + +# And three sorts of disk image +0 string MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data +0 string MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data +0 string EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data --- ./Magdir/perl.orig 2002-05-16 11:53:11.000000000 -0700 +++ ./Magdir/perl 2003-03-05 00:07:34.000000000 -0800 @@ -11,6 +11,7 @@ 0 string eval\ "exec\ /usr/bin/perl perl script text 0 string/b #!\ /usr/local/bin/perl perl script text 0 string eval\ "exec\ /usr/local/bin/perl perl script text executable +0 string eval\ '(exit\ $?0)'\ &&\ eval\ 'exec perl script text # a couple more, by me # XXX: christos matches --- ./Magdir/os2.orig 1999-01-14 07:54:05.000000000 -0800 +++ ./Magdir/os2 2003-03-05 00:07:34.000000000 -0800 @@ -11,16 +11,16 @@ # OS/2 URL objects # Provided 1998/08/22 by # David Mediavilla -0 string http: OS/2 URL object text ->5 string >\ (WWW) -0 string mailto: OS/2 URL object text ->7 string >\ (email) <%s> -0 string news: OS/2 URL object text ->5 string >\ (Usenet) <%s> -0 string ftp: OS/2 URL object text ->4 string >\ (FTP) -0 string file: OS/2 URL object text ->5 string >\ (Local file) <%s> +#0 string http: OS/2 URL object text +#>5 string >\ (WWW) +#0 string mailto: OS/2 URL object text +#>7 string >\ (email) <%s> +#0 string news: OS/2 URL object text +#>5 string >\ (Usenet) <%s> +#0 string ftp: OS/2 URL object text +#>4 string >\ (FTP) +#0 string file: OS/2 URL object text +#>5 string >\ (Local file) <%s> # >>>>> OS/2 INF/HLP <<<<< (source: Daniel Dissett ddissett@netcom.com) # Carl Hauser (chauser.parc@xerox.com) and --- ./Magdir/c-lang.orig 1995-05-20 15:13:41.000000000 -0700 +++ ./Magdir/c-lang 2003-03-05 00:07:34.000000000 -0800 @@ -10,4 +10,4 @@ # this first will upset you if you're a PL/1 shop... # in which case rm it; ascmagic will catch real C programs #0 string /* C or REXX program text -0 string // C++ program text +#0 string // C++ program text --- ./Magdir/archive.orig 2003-02-08 10:30:39.000000000 -0800 +++ ./Magdir/archive 2003-03-05 00:07:34.000000000 -0800 @@ -32,8 +32,10 @@ 0 string !\ndebian >8 string debian-split part of multipart Debian package >8 string debian-binary Debian binary package ->68 string >\n (format %s) ->136 ledate x created: %s +>68 string >\0 (format %s) +>81 string bz2 \b, uses bzip2 compression +>84 string gz \b, uses gzip compression +#>>136 ledate x \b, created: %s # other archives 0 long 0177555 very old archive --- ./Magdir/sgml.orig 2003-02-08 10:30:39.000000000 -0800 +++ ./Magdir/sgml 2003-03-05 00:07:34.000000000 -0800 @@ -4,14 +4,23 @@ # HyperText Markup Language (HTML) is an SGML document type, # from Daniel Quinlan (quinlan@yggdrasil.com) # adapted to string extenstions by Anthon van der Neut 32808 string >\0 '%s' +>34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) 37633 string CD001 ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) 32776 string CDROM High Sierra CD-ROM filesystem data --- ./Magdir/ti-8x.orig 1997-11-05 07:52:11.000000000 -0800 +++ ./Magdir/ti-8x 2003-03-05 00:07:34.000000000 -0800 @@ -1,36 +1,219 @@ -# ------------------------------------------------------------------------ -# ti-8x: file(1) magic for the TI-8x and TI-92 Graphing Calculators. +# ti-xx: file(1) magic for the TI-8x and TI-9x Graphing Calculators. # # From: Ryan McGuire (rmcguire@freenet.columbus.oh.us). +# Update: Romain Lievin (roms@lpg.ticalc.org). # -# NOTE: This list is not complete. +# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the +# program/group magic numbers in here because I cannot find any. +0 string **TI80** TI-80 Graphing Calculator File. +0 string **TI81** TI-81 Graphing Calculator File. +# +# Magic Numbers for the TI-73 +# +0 string **TI73** TI-73 Graphing Calculator +>0x00003B byte 0x00 (real number) +>0x00003B byte 0x01 (list) +>0x00003B byte 0x02 (matrix) +>0x00003B byte 0x03 (equation) +>0x00003B byte 0x04 (string) +>0x00003B byte 0x05 (program) +>0x00003B byte 0x06 (assembly program) +>0x00003B byte 0x07 (picture) +>0x00003B byte 0x08 (gdb) +>0x00003B byte 0x0C (complex number) +>0x00003B byte 0x0F (window settings) +>0x00003B byte 0x10 (zoom) +>0x00003B byte 0x11 (table setup) +>0x00003B byte 0x13 (backup) # # Magic Numbers for the TI-82 # -0 string **TI82** TI-82 Graphing Calculator ->0x000037 byte 0x0B TI-BASIC Group/Program File. +0 string **TI82** TI-82 Graphing Calculator +>0x00003B byte 0x00 (real) +>0x00003B byte 0x01 (list) +>0x00003B byte 0x02 (matrix) +>0x00003B byte 0x03 (Y-variable) +>0x00003B byte 0x05 (program) +>0x00003B byte 0x06 (protected prgm) +>0x00003B byte 0x07 (picture) +>0x00003B byte 0x08 (gdb) +>0x00003B byte 0x0B (window settings) +>0x00003B byte 0x0C (window settings) +>0x00003B byte 0x0D (table setup) +>0x00003B byte 0x0E (screenshot) +>0x00003B byte 0x0F (backup) # # Magic Numbers for the TI-83 # -0 string **TI83** TI-83 Graphing Calculator ->0x000037 byte 0x0B TI-BASIC Group/Program File. +0 string **TI83** TI-83 Graphing Calculator +>0x00003B byte 0x00 (real) +>0x00003B byte 0x01 (list) +>0x00003B byte 0x02 (matrix) +>0x00003B byte 0x03 (Y-variable) +>0x00003B byte 0x04 (string) +>0x00003B byte 0x05 (program) +>0x00003B byte 0x06 (protected prgm) +>0x00003B byte 0x07 (picture) +>0x00003B byte 0x08 (gdb) +>0x00003B byte 0x0B (window settings) +>0x00003B byte 0x0C (window settings) +>0x00003B byte 0x0D (table setup) +>0x00003B byte 0x0E (screenshot) +>0x00003B byte 0x13 (backup) +# +# Magic Numbers for the TI-83+ +# +0 string **TI83F* TI-83+ Graphing Calculator +>0x00003B byte 0x00 (real number) +>0x00003B byte 0x01 (list) +>0x00003B byte 0x02 (matrix) +>0x00003B byte 0x03 (equation) +>0x00003B byte 0x04 (string) +>0x00003B byte 0x05 (program) +>0x00003B byte 0x06 (assembly program) +>0x00003B byte 0x07 (picture) +>0x00003B byte 0x08 (gdb) +>0x00003B byte 0x0C (complex number) +>0x00003B byte 0x0F (window settings) +>0x00003B byte 0x10 (zoom) +>0x00003B byte 0x11 (table setup) +>0x00003B byte 0x13 (backup) +>0x00003B byte 0x15 (application variable) +>0x00003B byte 0x17 (group of variable) # # Magic Numbers for the TI-85 # -0 string **TI85** TI-85 Graphing Calculator ->11 string Backup Backup File. ->0x000032 string ZS4 - ZShell Version 4 File. ->0x000032 string ZS3 - ZShell Version 3 File. ->0x00000B string GDatabase Graphics Database. ->0x00003B byte 0x12 TI-BASIC Group/Program File. +0 string **TI85** TI-85 Graphing Calculator +>0x00003B byte 0x00 (real number) +>0x00003B byte 0x01 (complex number) +>0x00003B byte 0x02 (real vector) +>0x00003B byte 0x03 (complex vector) +>0x00003B byte 0x04 (real list) +>0x00003B byte 0x05 (complex list) +>0x00003B byte 0x06 (real matrix) +>0x00003B byte 0x07 (complex matrix) +>0x00003B byte 0x08 (real constant) +>0x00003B byte 0x09 (complex constant) +>0x00003B byte 0x0A (equation) +>0x00003B byte 0x0C (string) +>0x00003B byte 0x0D (function GDB) +>0x00003B byte 0x0E (polar GDB) +>0x00003B byte 0x0F (parametric GDB) +>0x00003B byte 0x10 (diffeq GDB) +>0x00003B byte 0x11 (picture) +>0x00003B byte 0x12 (program) +>0x00003B byte 0x13 (range) +>0x00003B byte 0x17 (window settings) +>0x00003B byte 0x18 (window settings) +>0x00003B byte 0x19 (window settings) +>0x00003B byte 0x1A (window settings) +>0x00003B byte 0x1B (zoom) +>0x00003B byte 0x1D (backup) +>0x00003B byte 0x1E (unknown) +>0x00003B byte 0x2A (equation) +>0x000032 string ZS4 - ZShell Version 4 File. +>0x000032 string ZS3 - ZShell Version 3 File. +# +# Magic Numbers for the TI-86 +# +0 string **TI86** TI-86 Graphing Calculator +>0x00003B byte 0x00 (real number) +>0x00003B byte 0x01 (complex number) +>0x00003B byte 0x02 (real vector) +>0x00003B byte 0x03 (complex vector) +>0x00003B byte 0x04 (real list) +>0x00003B byte 0x05 (complex list) +>0x00003B byte 0x06 (real matrix) +>0x00003B byte 0x07 (complex matrix) +>0x00003B byte 0x08 (real constant) +>0x00003B byte 0x09 (complex constant) +>0x00003B byte 0x0A (equation) +>0x00003B byte 0x0C (string) +>0x00003B byte 0x0D (function GDB) +>0x00003B byte 0x0E (polar GDB) +>0x00003B byte 0x0F (parametric GDB) +>0x00003B byte 0x10 (diffeq GDB) +>0x00003B byte 0x11 (picture) +>0x00003B byte 0x12 (program) +>0x00003B byte 0x13 (range) +>0x00003B byte 0x17 (window settings) +>0x00003B byte 0x18 (window settings) +>0x00003B byte 0x19 (window settings) +>0x00003B byte 0x1A (window settings) +>0x00003B byte 0x1B (zoom) +>0x00003B byte 0x1D (backup) +>0x00003B byte 0x1E (unknown) +>0x00003B byte 0x2A (equation) +# +# Magic Numbers for the TI-89 +# +0 string **TI89** TI-89 Graphing Calculator +>0x000048 byte 0x00 (expression) +>0x000048 byte 0x04 (list) +>0x000048 byte 0x06 (matrix) +>0x000048 byte 0x0A (data) +>0x000048 byte 0x0B (text) +>0x000048 byte 0x0C (string) +>0x000048 byte 0x0D (graphic data base) +>0x000048 byte 0x0E (figure) +>0x000048 byte 0x10 (picture) +>0x000048 byte 0x12 (program) +>0x000048 byte 0x13 (function) +>0x000048 byte 0x14 (macro) +>0x000048 byte 0x1C (zipped) +>0x000048 byte 0x21 (assembler) # # Magic Numbers for the TI-92 # -0 string **TI92** TI-92 Graphing Calculator ->0x000058 byte 0x12 TI-BASIC Group File. ->0x000012 string Function Function. ->0x000048 byte 0x12 TI-BASIC Program. -# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the -# program/group magic numbers in here because I cannot find any. -0 string **TI80** TI-80 Graphing Calculator File. -0 string **TI81** TI-81 Graphing Calculator File. +0 string **TI92** TI-92 Graphing Calculator +>0x000048 byte 0x00 (expression) +>0x000048 byte 0x04 (list) +>0x000048 byte 0x06 (matrix) +>0x000048 byte 0x0A (data) +>0x000048 byte 0x0B (text) +>0x000048 byte 0x0C (string) +>0x000048 byte 0x0D (graphic data base) +>0x000048 byte 0x0E (figure) +>0x000048 byte 0x10 (picture) +>0x000048 byte 0x12 (program) +>0x000048 byte 0x13 (function) +>0x000048 byte 0x14 (macro) +>0x000048 byte 0x1D (backup) +# +# Magic Numbers for the TI-92+/V200 +# +0 string **TI92P* TI-92+/V200 Graphing Calculator +>0x000048 byte 0x00 (expression) +>0x000048 byte 0x04 (list) +>0x000048 byte 0x06 (matrix) +>0x000048 byte 0x0A (data) +>0x000048 byte 0x0B (text) +>0x000048 byte 0x0C (string) +>0x000048 byte 0x0D (graphic data base) +>0x000048 byte 0x0E (figure) +>0x000048 byte 0x10 (picture) +>0x000048 byte 0x12 (program) +>0x000048 byte 0x13 (function) +>0x000048 byte 0x14 (macro) +>0x000048 byte 0x1C (zipped) +>0x000048 byte 0x21 (assembler) +# +# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades +# +0x0000016 string Advanced TI-XX Graphing Calculator (FLASH) +0 string **TIFL** TI-XX Graphing Calculator (FLASH) +>8 byte >0 - Revision %d +>>9 byte x \b.%d, +>12 byte >0 Revision date %02x +>>13 byte x \b/%02x +>>14 beshort x \b/%04x, +>17 string >/0 name: '%s', +>48 byte 0x74 device: TI-73, +>48 byte 0x73 device: TI-83+, +>48 byte 0x98 device: TI-89, +>48 byte 0x88 device: TI-92+, +>49 byte 0x23 type: OS upgrade, +>49 byte 0x24 type: application, +>49 byte 0x25 type: certificate, +>49 byte 0x3e type: license, +>74 lelong >0 size: %ld bytes --- ./Magdir/linux.orig 2002-07-03 11:54:13.000000000 -0700 +++ ./Magdir/linux 2003-03-05 00:07:34.000000000 -0800 @@ -43,12 +43,6 @@ # LILO boot/chain loaders, from Daniel Quinlan # this can be overridden by the DOS executable (COM) entry 2 string LILO Linux/i386 LILO boot/chain loader -# -# Debian Packages, from Peter Tobias -0 string 0.9 ->8 byte 0x0a old Debian Binary Package ->>3 byte >0 \b, created by dpkg 0.9%c ->>4 byte >0 pl%c # PSF fonts, from H. Peter Anvin 0 leshort 0x0436 Linux/i386 PC Screen Font data, >2 byte 0 256 characters, no directory, @@ -60,6 +54,8 @@ 4086 string SWAP-SPACE Linux/i386 swap file # according to man page of mkswap (8) March 1999 4086 string SWAPSPACE2 Linux/i386 swap file (new style) +>0x400 long x %d (4K pages) +>0x404 long x size %d pages # ECOFF magic for OSF/1 and Linux (only tested under Linux though) # # from Erik Troan (ewt@redhat.com) examining od dumps, so this @@ -74,33 +70,39 @@ >8 long >0 not stripped >8 long 0 stripped >23 leshort >0 - version %ld. -# -# Linux kernel boot images, from Albert Cahalan -# and others such as Axel Kohlmeyer -# and Nicolás Lichtmaier -# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 -514 string HdrS Linux kernel ->518 leshort >0 ->>529 byte 0 zImage data, ->>529 byte 1 bzImage data, ->0x048c byte 0x31 ->>0x048c string x version %s ->0x0493 byte 0x31 ->>0x0493 string x version %s ->0x048c byte 0x32 ->>0x048c string x version %s ->0x0493 byte 0x32 ->>0x0493 string x version %s ->0x04df byte 0x32 ->>0x04df string x version %s ->0x04fb byte 0x32 ->>0x04fb string x version %s + +# Linux kernel boot images (i386 arch) (Wolfram Kleff) +514 string HdrS Linux kernel +>510 leshort 0xAA55 x86 boot executable +>>518 leshort >=0x200 +>>>529 byte 0 zImage, +>>>529 byte 1 bzImage, +>>>(526.s+0x200) string >\0 version %s, +>>498 leshort 1 RO-rootFS, +>>498 leshort 0 RW-rootFS, +>>508 leshort >0 root_dev=0x%X, +>>502 leshort >0 swap_dev=0x%X, +>>504 leshort >0 RAMdisksize=%u KB, +>>506 leshort 0xFFFF Normal VGA +>>506 leshort 0xFFFE Extended VGA +>>506 leshort 0xFFFD Prompt for Videomode +>>506 leshort >0 Video mode=%d # This also matches new kernels, which were caught above by "HdrS". 0 belong 0xb8c0078e Linux kernel >0x1e3 string Loading version 1.3.79 or older >0x1e9 string Loading from prehistoric times -# LSM entries - Nicolás Lichtmaier + +# System.map files - Nicolás Lichtmaier +8 string \ A\ _text Linux kernel symbol map text + +# LSM entries - Nicolás Lichtmaier 0 string Begin3 Linux Software Map entry text +0 string Begin4 Linux Software Map entry text (new format) + +# From Matt Zimmerman +0 belong 0x4f4f4f4d User-mode Linux COW file +>4 belong x \b, version %d +>8 string >\0 \b, backing file %s ############################################################################ # Linux kernel versions --- ./Magdir/vorbis.orig 2003-02-08 10:30:40.000000000 -0800 +++ ./Magdir/vorbis 2003-03-05 00:07:34.000000000 -0800 @@ -52,7 +52,7 @@ # in a different place, so we must use an indirect offset. >>>(84.b+85) string \x03vorbis >>>>(84.b+96) string/c Xiphophorus\ libVorbis\ I \b, created by: Xiphophorus libVorbis I ->>>>>(84.b+120) string >00000000 %.8s +>>>>>(84.b+120) string >00000000 # Map to beta version numbers: >>>>>>(84.b+120) string <20000508 (>>>>>(84.b+120) string 20000508 (beta1/2) @@ -74,6 +74,7 @@ >>>>>>(84.b+120) string >20011231 (pre-1.0 CVS) # For the 1.0 release, Xiphophorus is replaced by Xiph.Org >>>>(84.b+96) string/c Xiph.Org\ libVorbis\ I \b, created by: Xiph.Org libVorbis I ->>>>>(84.b+117) string >00000000 %.8s +>>>>>(84.b+117) string >00000000 >>>>>>(84.b+117) string <20020717 (pre-1.0 CVS) >>>>>>(84.b+117) string 20020717 (1.0) +>>>>>>(84.b+117) string >20020717 (>1.0) --- ./Magdir/msdos.orig 2003-02-08 10:30:39.000000000 -0800 +++ ./Magdir/msdos 2003-03-05 00:07:34.000000000 -0800 @@ -5,6 +5,7 @@ # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) 0 string @echo\ off MS-DOS batch file text +0 string @ECHO\ OFF MS-DOS batch file text # XXX - according to Microsoft's spec, at an offset of 0x3c in a # PE-format executable is the offset in the file of the PE header; @@ -144,9 +145,10 @@ # # -# Windows NT Registry files. +# Windows Registry files. # -0 string regf Windows NT Registry file +0 string regf Windows NT registry file +0 string CREG Windows 95 registry file # Popular applications 2080 string Microsoft\ Word\ 6.0\ Document %s @@ -157,9 +159,13 @@ 0 belong 0x31be0000 Microsoft Word Document # 0 string PO^Q` Microsoft Word 6.0 Document -# + +# I guess this is the one that works: +# Microsoft Office Document (e.g.: doc,xls) (Wolfram Kleff) +0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1 Microsoft Office document data + 0 string \376\067\0\043 Microsoft Office Document -0 string \320\317\021\340\241\261 Microsoft Office Document +#0 string \320\317\021\340\241\261 Microsoft Office Document 0 string \333\245-\0\0\0 Microsoft Office Document # 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s @@ -238,11 +244,6 @@ >>8 byte >0 \b, %d-colors -# True Type fonts currently misidentified as raw G3 data - -0 string \000\001\000\000\000 MS-Windows true type font .ttf - - # .chr files 0 string PK\010\010BGI Borland font >4 string >\0 %s @@ -278,7 +279,8 @@ 0 string DCU1 Borland Delphi .DCU file 0 string ! MKS Spell hash list (old format) 0 string ! MKS Spell hash list -0 string AH Halo(TM) bitmapped font file +# Too simple - MPi +#0 string AH Halo(TM) bitmapped font file 0 lelong 0x08086b70 TurboC BGI file 0 lelong 0x08084b50 TurboC Font file --- ./Magdir/console.orig 2000-04-22 21:41:38.000000000 -0700 +++ ./Magdir/console 2003-03-05 00:07:34.000000000 -0800 @@ -119,4 +119,5 @@ #------------------------------------------------------------------------------ # msx: file(1) magic for MSX game cartridge dumps -0 beshort 0x4142 MSX game cartridge dump +# Too simple - MPi +#0 beshort 0x4142 MSX game cartridge dump --- ./Magdir/audio.orig 2003-02-08 10:30:39.000000000 -0800 +++ ./Magdir/audio 2003-03-05 00:07:34.000000000 -0800 @@ -93,14 +93,15 @@ >14 string >/0 ultratracker V1.%.1s module sound data 0 string UN05 MikMod UNI format module sound data 0 string Extended\ Module: Fasttracker II module sound data -21 string !SCREAM! Screamtracker 2 module sound data +21 string/c !Scream! Screamtracker 2 module sound data +21 string BMOD2STM Screamtracker 2 module sound data 1080 string M.K. 4-channel Protracker module sound data 1080 string M!K! 4-channel Protracker module sound data 1080 string FLT4 4-channel Startracker module sound data 1080 string 4CHN 4-channel Fasttracker module sound data 1080 string 6CHN 6-channel Fasttracker module sound data 1080 string 8CHN 8-channel Fasttracker module sound data -1080 string CD81 8-channel Oktalyzer module sound data +1080 string CD81 8-channel Octalyser module sound data 1080 string OKTA 8-channel Oktalyzer module sound data # Not good enough. #1082 string CH --- ./Magdir/zisofs.orig 2003-03-05 00:10:06.000000000 -0800 +++ ./Magdir/zisofs 2003-03-05 00:10:06.000000000 -0800 @@ -0,0 +1,8 @@ + +#------------------------------------------------------------------------------ +# zisofs: file(1) magic for zisofs/RockRidge compressed files +# +# from H. Peter Anvin May 4, 2001 +# +0 string \x37\xE4\x53\x96\xC9\xDB\xD6\x07 zisofs/Rockridge compressed file +>8 lelong x - %d bytes