1 2#------------------------------------------------------------------------------ 3# $File: database,v 1.33 2013/03/09 22:36:00 christos Exp $ 4# database: file(1) magic for various databases 5# 6# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 7# 8# 9# GDBM magic numbers 10# Will be maintained as part of the GDBM distribution in the future. 11# <downsj@teeny.org> 120 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian 13!:mime application/x-gdbm 140 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian 15!:mime application/x-gdbm 160 string GDBM GNU dbm 2.x database 17!:mime application/x-gdbm 18# 19# Berkeley DB 20# 21# Ian Darwin's file /etc/magic files: big/little-endian version. 22# 23# Hash 1.85/1.86 databases store metadata in network byte order. 24# Btree 1.85/1.86 databases store the metadata in host byte order. 25# Hash and Btree 2.X and later databases store the metadata in host byte order. 26 270 long 0x00061561 Berkeley DB 28!:mime application/x-dbm 29>8 belong 4321 30>>4 belong >2 1.86 31>>4 belong <3 1.85 32>>4 belong >0 (Hash, version %d, native byte-order) 33>8 belong 1234 34>>4 belong >2 1.86 35>>4 belong <3 1.85 36>>4 belong >0 (Hash, version %d, little-endian) 37 380 belong 0x00061561 Berkeley DB 39>8 belong 4321 40>>4 belong >2 1.86 41>>4 belong <3 1.85 42>>4 belong >0 (Hash, version %d, big-endian) 43>8 belong 1234 44>>4 belong >2 1.86 45>>4 belong <3 1.85 46>>4 belong >0 (Hash, version %d, native byte-order) 47 480 long 0x00053162 Berkeley DB 1.85/1.86 49>4 long >0 (Btree, version %d, native byte-order) 500 belong 0x00053162 Berkeley DB 1.85/1.86 51>4 belong >0 (Btree, version %d, big-endian) 520 lelong 0x00053162 Berkeley DB 1.85/1.86 53>4 lelong >0 (Btree, version %d, little-endian) 54 5512 long 0x00061561 Berkeley DB 56>16 long >0 (Hash, version %d, native byte-order) 5712 belong 0x00061561 Berkeley DB 58>16 belong >0 (Hash, version %d, big-endian) 5912 lelong 0x00061561 Berkeley DB 60>16 lelong >0 (Hash, version %d, little-endian) 61 6212 long 0x00053162 Berkeley DB 63>16 long >0 (Btree, version %d, native byte-order) 6412 belong 0x00053162 Berkeley DB 65>16 belong >0 (Btree, version %d, big-endian) 6612 lelong 0x00053162 Berkeley DB 67>16 lelong >0 (Btree, version %d, little-endian) 68 6912 long 0x00042253 Berkeley DB 70>16 long >0 (Queue, version %d, native byte-order) 7112 belong 0x00042253 Berkeley DB 72>16 belong >0 (Queue, version %d, big-endian) 7312 lelong 0x00042253 Berkeley DB 74>16 lelong >0 (Queue, version %d, little-endian) 75 76# From Max Bowsher. 7712 long 0x00040988 Berkeley DB 78>16 long >0 (Log, version %d, native byte-order) 7912 belong 0x00040988 Berkeley DB 80>16 belong >0 (Log, version %d, big-endian) 8112 lelong 0x00040988 Berkeley DB 82>16 lelong >0 (Log, version %d, little-endian) 83 84# 85# 86# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 870 string RRD RRDTool DB 88>4 string x version %s 89#---------------------------------------------------------------------- 90# ROOT: file(1) magic for ROOT databases 91# 920 string root\0 ROOT file 93>4 belong x Version %d 94>33 belong x (Compression: %d) 95 96# XXX: Weak magic. 97# Alex Ott <ott@jet.msk.su> 98## Paradox file formats 99#2 leshort 0x0800 Paradox 100#>0x39 byte 3 v. 3.0 101#>0x39 byte 4 v. 3.5 102#>0x39 byte 9 v. 4.x 103#>0x39 byte 10 v. 5.x 104#>0x39 byte 11 v. 5.x 105#>0x39 byte 12 v. 7.x 106#>>0x04 byte 0 indexed .DB data file 107#>>0x04 byte 1 primary index .PX file 108#>>0x04 byte 2 non-indexed .DB data file 109#>>0x04 byte 3 non-incrementing secondary index .Xnn file 110#>>0x04 byte 4 secondary index .Ynn file 111#>>0x04 byte 5 incrementing secondary index .Xnn file 112#>>0x04 byte 6 non-incrementing secondary index .XGn file 113#>>0x04 byte 7 secondary index .YGn file 114#>>>0x04 byte 8 incrementing secondary index .XGn file 115 116## XBase database files 117# updated by Joerg Jenderek at Feb 2013 118# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 119# http://www.clicketyclick.dk/databases/xbase/format/dbf.html 120# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm 121# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 1220 ubelong&0x0000FFFF <0x00000C20 123# skip Infocom game Z-machine 124>2 ubyte >0 125# skip Androids *.xml 126>>3 ubyte >0 127>>>3 ubyte <32 128# 1 < version VV 129>>>>0 ubyte >1 130# skip HELP.CA3 by test for reserved byte ( NULL ) 131>>>>>27 ubyte 0 132# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 133#>>>>>30 ubeshort x 30NULL?%x 134# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 135>>>>>>24 ubelong&0xffFFFFff >0x01302000 136# .DBF or .MDX 137>>>>>>24 ubelong&0xffFFFFff <0x01302001 138# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 139>>>>>>>24 ubelong&0xffFFFFff =0 140# test for 2 reserved NULL bytes,transaction and encryption byte flag 141>>>>>>>>12 ubelong&0xFFFFfEfE 0 142# test for MDX flag 143>>>>>>>>>28 ubyte x 144>>>>>>>>>28 ubyte&0xf8 0 145# header size >= 32 146>>>>>>>>>>8 uleshort >31 147# skip PIC15736.PCX by test for language driver name or field name 148>>>>>>>>>>>32 ubyte >0 149!:mime application/x-dbf 150#!:mime application/x-dbf; charset=unknown-8bit ?? 151#!:mime application/x-dbase 152>>>>>>>>>>>>0 use xbase-type 153# database file 154>>>>>>>>>>>>0 ubyte x \b DBF 155>>>>>>>>>>>>4 lelong 0 \b, no records 156>>>>>>>>>>>>4 lelong >0 \b, %ld record 157# plural s appended 158>>>>>>>>>>>>>4 lelong >1 \bs 159# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 160# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 161>>>>>>>>>>>>10 uleshort x * %d 162# file size = records * record size + header size 163>>>>>>>>>>>>1 ubyte x \b, update-date 164>>>>>>>>>>>>1 use xbase-date 165# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 166#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 167# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 168>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 169#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 170>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 171>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 172>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 173# 1st record offset + 1 = header size 174>>>>>>>>>>>>8 uleshort >0 175>>>>>>>>>>>>(8.s+1) ubyte >0 176>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 177>>>>>>>>>>>>>(8.s+1) ubyte >0 178>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 179# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) 180>>>>>>>24 ubelong&0x0133f7ff >0 181# test for reserved NULL byte 182>>>>>>>>47 ubyte x 183# test for valid TAG key format (0x10 or 0) 184>>>>>>>>>559 ubyte&0xeF 0 185# test MM <= 12 186>>>>>>>>>45 ubeshort <0x0C20 187>>>>>>>>>>45 ubyte >0 188>>>>>>>>>>>46 ubyte <32 189>>>>>>>>>>>>46 ubyte >0 190#!:mime application/x-mdx 191>>>>>>>>>>>>>0 use xbase-type 192>>>>>>>>>>>>>0 ubyte x \b MDX 193>>>>>>>>>>>>>1 ubyte x \b, creation-date 194>>>>>>>>>>>>>1 use xbase-date 195>>>>>>>>>>>>>44 ubyte x \b, update-date 196>>>>>>>>>>>>>44 use xbase-date 197# No.of tags in use (1,2,5,12) 198>>>>>>>>>>>>>28 uleshort x \b, %d 199# No. of entries in tag (0x30) 200>>>>>>>>>>>>>25 ubyte x \b/%d tags 201# Length of tag 202>>>>>>>>>>>>>26 ubyte x * %d 203# 1st tag name_ 204>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 205# 2nd tag name 206#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 207# 208# Print the xBase names of different version variants 2090 name xbase-type 210>0 ubyte <2 211# 1 < version 212>0 ubyte >1 213>>0 ubyte 0x02 FoxBase 214# FoxBase+/dBaseIII+, no memo 215>>0 ubyte 0x03 FoxBase+/dBase III 216# dBASE IV no memo file 217>>0 ubyte 0x04 dBase IV 218# dBASE V no memo file 219>>0 ubyte 0x05 dBase V 220>>0 ubyte 0x30 Visual FoxPro 221>>0 ubyte 0x31 Visual FoxPro, autoincrement 222# Visual FoxPro, with field type Varchar or Varbinary 223>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 224# dBASE IV SQL, no memo;dbv memo var size (Flagship) 225>>0 ubyte 0x43 dBase IV, with SQL table 226# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 227#>>0 ubyte 0x62 dBase IV, with SQL table 228# dBASE IV, with memo!! 229>>0 ubyte 0x7b dBase IV, with memo 230# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 231#>>0 ubyte 0x82 dBase IV, with SQL system 232# FoxBase+/dBaseIII+ with memo .DBT! 233>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 234# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 235>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 236# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 237#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 238# dBASE IV with memo! 239>>0 ubyte 0x8B dBase IV, with memo .DBT 240# dBase IV with SQL Table,no memo? 241>>0 ubyte 0x8E dBase IV, with SQL table 242# .dbv and .dbt memo (Flagship)? 243>>0 ubyte 0xB3 Flagship 244# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 245#>>0 ubyte 0xCA dBase IV with memo .DBT 246# dBASE IV with SQL table, with memo .DBT 247>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 248# HiPer-Six format;Clipper SIX, with SMT memo file 249>>0 ubyte 0xE5 Clipper SIX with memo 250# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 251#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 252>>0 ubyte 0xF5 FoxPro with memo 253# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 254#>>0 ubyte 0xFA FoxPro 2.x, with memo 255# unkown version (should not happen) 256>>0 default x xBase 257>>>0 ubyte x (0x%x) 258# flags in version byte 259# DBT flag (with dBASE III memo .DBT)!! 260# >>0 ubyte&0x80 >0 DBT_FLAG=%x 261# memo flag ?? 262# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 263# SQL flag ?? 264# >>0 ubyte&0x70 >0 SQL_FLAG=%x 265# test and print the date of xBase .DBF .MDX 2660 name xbase-date 267# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 268>0 ubelong x 269>1 ubyte <13 270>>1 ubyte >0 271>>>2 ubyte >0 272>>>>2 ubyte <32 273>>>>>0 ubyte x 274# YY is interpreted as 20YY or 19YY 275>>>>>>0 ubyte <100 \b %.2d 276# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 277>>>>>>0 ubyte >99 \b %d 278>>>>>1 ubyte x \b-%d 279>>>>>2 ubyte x \b-%d 280 281# dBase memo files .DBT or .FPT 282# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 28316 ubyte <4 284>16 ubyte !2 285>>16 ubyte !1 286# next free block index is positive 287>>>0 ulelong >0 288# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 289>>>>17 ubelong&0xFFfdFE00 0x00000000 290# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 291>>>>>20 ubelong&0xFF01209B 0x00000000 292# dBASE III 293>>>>>>16 ubyte 3 294# dBASE III DBT 295>>>>>>>0 use xbase-memo-print 296# dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage 297>>>>>>16 ubyte 0 298# dBASE IV DBT with DBF name or DBF garbage 299>>>>>>>8 ubelong >0x40000000 300# skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block 301>>>>>>>>0 ulelong <0x01010002 302>>>>>>>>>0 use xbase-memo-print 303>>>>>>>8 ubelong 0 304# skip MM*DD*.bin by test for for reserved NULL byte 305>>>>>>>>508 ubelong 0 306>>>>>>>>>0 use xbase-memo-print 307# garbage PCX , ZIP , JAR , XPI 308>>>>>>>8 default x 309 310# Print the information of dBase DBT or FoxPro FPT memo files 3110 name xbase-memo-print 312>0 ubyte x 313# test version 314# memo file 315>>16 ubyte 3 dBase III DBT 316>>16 ubyte 0 317>>>512 ubelong <0x00000003 FoxPro FPT 318# Size of blocks for FoxPro 319>>>>6 ubeshort x \b, blocks size %lu 320# Number of next available block for appending data for FoxPro 321>>>>0 ubelong =0 \b, next free block index %lu 322>>>>0 ubelong !0 \b, next free block index %lu 323>>>512 default x dBase IV DBT 324# DBF file name without extention 325>>>>8 string >\0 \b of %-.8s.DBF 326# size of blocks ; not reliable 0x2020204C 327#>>>>4 ulelong =0 \b, blocks size %lu 328>>>>4 ulelong !0 \b, blocks size %lu 329# Block length found 0 , 512 330#>>>>20 uleshort =0 \b, block length %u 331>>>>20 uleshort !0 \b, block length %u 332# Number of next available block for appending data 333>>>>0 ulelong =0 \b, next free block index %lu 334>>>>0 ulelong !0 \b, next free block index %lu 335>>512 ubelong x 336>>>512 ubelong =0xFFFF0800 337>>>>520 string >\0 \b, 1st used item "%s" 338# FoxPro 339>>>512 ubelong <3 340# FoxPro memo 341>>>>512 ubelong =1 342>>>>520 string >\0 \b, 1st used item "%s" 343>>>512 default x 344# may be deleted memo field 345>>>>512 string >\0 \b, 1st item "%s" 346 347# TODO: 348# DBASE index file *.NDX 349# DBASE Compound Index file *.CDX 350# dBASE IV Printer Driver *.PRF 351## End of XBase database stuff 352 353# MS Access database 3544 string Standard\ Jet\ DB Microsoft Access Database 355!:mime application/x-msaccess 3564 string Standard\ ACE\ DB Microsoft Access Database 357!:mime application/x-msaccess 358 359# TDB database from Samba et al - Martin Pool <mbp@samba.org> 3600 string TDB\ file TDB database 361>32 lelong 0x2601196D version 6, little-endian 362>>36 lelong x hash size %d bytes 363 364# SE Linux policy database 3650 lelong 0xf97cff8c SE Linux policy 366>16 lelong x v%d 367>20 lelong 1 MLS 368>24 lelong x %d symbols 369>28 lelong x %d ocons 370 371# ICE authority file data (Wolfram Kleff) 3722 string ICE ICE authority data 373 374# X11 Xauthority file (Wolfram Kleff) 37510 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 37611 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 37712 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 37813 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 37914 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 38015 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 38116 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 38217 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 38318 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 384 385# From: Maxime Henrion <mux@FreeBSD.org> 386# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 3870 string PGDMP PostgreSQL custom database dump 388>5 byte x - v%d 389>6 byte x \b.%d 390>5 beshort <0x101 \b-0 391>5 beshort >0x100 392>>7 byte x \b-%d 393 394# Type: Advanced Data Format (ADF) database 395# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ 396# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 3970 string @(#)ADF\ Database CGNS Advanced Data Format 398 399# Tokyo Cabinet magic data 400# http://tokyocabinet.sourceforge.net/index.html 4010 string ToKyO\ CaBiNeT\n Tokyo Cabinet 402>14 string x \b (%s) 403>32 byte 0 \b, Hash 404!:mime application/x-tokyocabinet-hash 405>32 byte 1 \b, B+ tree 406!:mime application/x-tokyocabinet-btree 407>32 byte 2 \b, Fixed-length 408!:mime application/x-tokyocabinet-fixed 409>32 byte 3 \b, Table 410!:mime application/x-tokyocabinet-table 411>33 byte &1 \b, [open] 412>33 byte &2 \b, [fatal] 413>34 byte x \b, apow=%d 414>35 byte x \b, fpow=%d 415>36 byte &0x01 \b, [large] 416>36 byte &0x02 \b, [deflate] 417>36 byte &0x04 \b, [bzip] 418>36 byte &0x08 \b, [tcbs] 419>36 byte &0x10 \b, [excodec] 420>40 lequad x \b, bnum=%lld 421>48 lequad x \b, rnum=%lld 422>56 lequad x \b, fsiz=%lld 423 424# Type: QDBM Quick Database Manager 425# From: Benoit Sibaud <bsibaud@april.org> 4260 string \\[depot\\]\n\f Quick Database Manager, little endian 4270 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 428 429# Type: TokyoCabinet database 430# URL: http://tokyocabinet.sourceforge.net/ 431# From: Benoit Sibaud <bsibaud@april.org> 4320 string ToKyO\ CaBiNeT\n TokyoCabinet database 433>14 string x (version %s) 434 435# From: Stephane Blondon http://www.yaal.fr 436# Database file for Zope (done by FileStorage) 4370 string FS21 Zope Object Database File Storage (data) 438# Cache file for the database of Zope (done by ClientStorage) 4390 string ZEC3 Zope Object Database Client Cache File (data) 440 441# IDA (Interactive Disassembler) database 4420 string IDA1 IDA (Interactive Disassembler) database 443