1 2#------------------------------------------------------------ 3# $File: java,v 1.14 2013/02/08 16:54:45 christos Exp $ 4# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 5# same magic number, 0xcafebabe, so they are both handled 6# in the entry called "cafebabe". 7#------------------------------------------------------------ 8# Java serialization 9# From Martin Pool (m.pool@pharos.com.au) 100 beshort 0xaced Java serialization data 11>2 beshort >0x0004 \b, version %d 12 130 belong 0xfeedfeed Java KeyStore 14!:mime application/x-java-keystore 150 belong 0xcececece Java JCE KeyStore 16!:mime application/x-java-jce-keystore 17 18# Dalvik .dex format. http://retrodev.com/android/dexformat.html 19# From <mkf@google.com> "Mike Fleming" 200 string dex\n 21>0 regex dex\n[0-9][0-9][0-9]\0 Dalvik dex file 22>4 string >000 version %s 230 string dey\n 24>0 regex dey\n[0-9][0-9][0-9]\0 Dalvik dex file (optimized for host) 25>4 string >000 version %s 26 27# Java source 280 regex ^import.*;$ Java source 29!:mime text/x-java 30 31# http://android.stackexchange.com/questions/23357/\ 32# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\ 33# 23608#23608 340 string ANDROID\040BACKUP\n Android Backup 35>15 string 1\n \b, version 1 36>17 string 0\n \b, uncompressed 37>17 string 1\n \b, compressed 38>19 string none\n \b, unencrypted 39>19 string AES-256\n \b, encrypted AES-256 40