1 2#------------------------------------------------------------------------------ 3# $File: database,v 1.42 2014/08/19 14:18:04 christos Exp $ 4# database: file(1) magic for various databases 5# 6# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 7# 8# 9# GDBM magic numbers 10# Will be maintained as part of the GDBM distribution in the future. 11# <downsj@teeny.org> 120 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit 13!:mime application/x-gdbm 140 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old 15!:mime application/x-gdbm 160 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit 17!:mime application/x-gdbm 180 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit 19!:mime application/x-gdbm 200 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old 21!:mime application/x-gdbm 220 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit 23!:mime application/x-gdbm 240 string GDBM GNU dbm 2.x database 25!:mime application/x-gdbm 26# 27# Berkeley DB 28# 29# Ian Darwin's file /etc/magic files: big/little-endian version. 30# 31# Hash 1.85/1.86 databases store metadata in network byte order. 32# Btree 1.85/1.86 databases store the metadata in host byte order. 33# Hash and Btree 2.X and later databases store the metadata in host byte order. 34 350 long 0x00061561 Berkeley DB 36!:mime application/x-dbm 37>8 belong 4321 38>>4 belong >2 1.86 39>>4 belong <3 1.85 40>>4 belong >0 (Hash, version %d, native byte-order) 41>8 belong 1234 42>>4 belong >2 1.86 43>>4 belong <3 1.85 44>>4 belong >0 (Hash, version %d, little-endian) 45 460 belong 0x00061561 Berkeley DB 47>8 belong 4321 48>>4 belong >2 1.86 49>>4 belong <3 1.85 50>>4 belong >0 (Hash, version %d, big-endian) 51>8 belong 1234 52>>4 belong >2 1.86 53>>4 belong <3 1.85 54>>4 belong >0 (Hash, version %d, native byte-order) 55 560 long 0x00053162 Berkeley DB 1.85/1.86 57>4 long >0 (Btree, version %d, native byte-order) 580 belong 0x00053162 Berkeley DB 1.85/1.86 59>4 belong >0 (Btree, version %d, big-endian) 600 lelong 0x00053162 Berkeley DB 1.85/1.86 61>4 lelong >0 (Btree, version %d, little-endian) 62 6312 long 0x00061561 Berkeley DB 64>16 long >0 (Hash, version %d, native byte-order) 6512 belong 0x00061561 Berkeley DB 66>16 belong >0 (Hash, version %d, big-endian) 6712 lelong 0x00061561 Berkeley DB 68>16 lelong >0 (Hash, version %d, little-endian) 69 7012 long 0x00053162 Berkeley DB 71>16 long >0 (Btree, version %d, native byte-order) 7212 belong 0x00053162 Berkeley DB 73>16 belong >0 (Btree, version %d, big-endian) 7412 lelong 0x00053162 Berkeley DB 75>16 lelong >0 (Btree, version %d, little-endian) 76 7712 long 0x00042253 Berkeley DB 78>16 long >0 (Queue, version %d, native byte-order) 7912 belong 0x00042253 Berkeley DB 80>16 belong >0 (Queue, version %d, big-endian) 8112 lelong 0x00042253 Berkeley DB 82>16 lelong >0 (Queue, version %d, little-endian) 83 84# From Max Bowsher. 8512 long 0x00040988 Berkeley DB 86>16 long >0 (Log, version %d, native byte-order) 8712 belong 0x00040988 Berkeley DB 88>16 belong >0 (Log, version %d, big-endian) 8912 lelong 0x00040988 Berkeley DB 90>16 lelong >0 (Log, version %d, little-endian) 91 92# 93# 94# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 950 string/b RRD\0 RRDTool DB 96>4 string/b x version %s 97 98>>10 short !0 16bit aligned 99>>>10 bedouble 8.642135e+130 big-endian 100>>>>18 short x 32bit long (m68k) 101 102>>10 short 0 103>>>12 long !0 32bit aligned 104>>>>12 bedouble 8.642135e+130 big-endian 105>>>>>20 long 0 64bit long 106>>>>>20 long !0 32bit long 107>>>>12 ledouble 8.642135e+130 little-endian 108>>>>>24 long 0 64bit long 109>>>>>24 long !0 32bit long (i386) 110>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 111>>>>>24 short !0 32bit long (arm) 112 113>>8 quad 0 64bit aligned 114>>>16 bedouble 8.642135e+130 big-endian 115>>>>24 long 0 64bit long (s390x) 116>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) 117>>>16 ledouble 8.642135e+130 little-endian 118>>>>28 long 0 64bit long (alpha/amd64/ia64) 119>>>>28 long !0 32bit long (armel/mipsel) 120 121#---------------------------------------------------------------------- 122# ROOT: file(1) magic for ROOT databases 123# 1240 string root\0 ROOT file 125>4 belong x Version %d 126>33 belong x (Compression: %d) 127 128# XXX: Weak magic. 129# Alex Ott <ott@jet.msk.su> 130## Paradox file formats 131#2 leshort 0x0800 Paradox 132#>0x39 byte 3 v. 3.0 133#>0x39 byte 4 v. 3.5 134#>0x39 byte 9 v. 4.x 135#>0x39 byte 10 v. 5.x 136#>0x39 byte 11 v. 5.x 137#>0x39 byte 12 v. 7.x 138#>>0x04 byte 0 indexed .DB data file 139#>>0x04 byte 1 primary index .PX file 140#>>0x04 byte 2 non-indexed .DB data file 141#>>0x04 byte 3 non-incrementing secondary index .Xnn file 142#>>0x04 byte 4 secondary index .Ynn file 143#>>0x04 byte 5 incrementing secondary index .Xnn file 144#>>0x04 byte 6 non-incrementing secondary index .XGn file 145#>>0x04 byte 7 secondary index .YGn file 146#>>>0x04 byte 8 incrementing secondary index .XGn file 147 148## XBase database files 149# updated by Joerg Jenderek at Feb 2013 150# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 151# http://www.clicketyclick.dk/databases/xbase/format/dbf.html 152# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm 153# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 1540 ubelong&0x0000FFFF <0x00000C20 155# skip Infocom game Z-machine 156>2 ubyte >0 157# skip Androids *.xml 158>>3 ubyte >0 159>>>3 ubyte <32 160# 1 < version VV 161>>>>0 ubyte >1 162# skip HELP.CA3 by test for reserved byte ( NULL ) 163>>>>>27 ubyte 0 164# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 165#>>>>>30 ubeshort x 30NULL?%x 166# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 167>>>>>>24 ubelong&0xffFFFFff >0x01302000 168# .DBF or .MDX 169>>>>>>24 ubelong&0xffFFFFff <0x01302001 170# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 171>>>>>>>24 ubelong&0xffFFFFff =0 172# test for 2 reserved NULL bytes,transaction and encryption byte flag 173>>>>>>>>12 ubelong&0xFFFFfEfE 0 174# test for MDX flag 175>>>>>>>>>28 ubyte x 176>>>>>>>>>28 ubyte&0xf8 0 177# header size >= 32 178>>>>>>>>>>8 uleshort >31 179# skip PIC15736.PCX by test for language driver name or field name 180>>>>>>>>>>>32 ubyte >0 181#!:mime application/x-dbf; charset=unknown-8bit ?? 182#!:mime application/x-dbase 183>>>>>>>>>>>>0 use xbase-type 184# database file 185>>>>>>>>>>>>0 ubyte x \b DBF 186>>>>>>>>>>>>4 lelong 0 \b, no records 187>>>>>>>>>>>>4 lelong >0 \b, %d record 188# plural s appended 189>>>>>>>>>>>>>4 lelong >1 \bs 190# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 191# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 192>>>>>>>>>>>>10 uleshort x * %d 193# file size = records * record size + header size 194>>>>>>>>>>>>1 ubyte x \b, update-date 195>>>>>>>>>>>>1 use xbase-date 196# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 197#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 198# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 199>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 200#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 201>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 202>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 203>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 204# 1st record offset + 1 = header size 205>>>>>>>>>>>>8 uleshort >0 206>>>>>>>>>>>>(8.s+1) ubyte >0 207>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 208>>>>>>>>>>>>>(8.s+1) ubyte >0 209>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 210# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) 211>>>>>>>24 ubelong&0x0133f7ff >0 212# test for reserved NULL byte 213>>>>>>>>47 ubyte x 214# test for valid TAG key format (0x10 or 0) 215>>>>>>>>>559 ubyte&0xeF 0 216# test MM <= 12 217>>>>>>>>>45 ubeshort <0x0C20 218>>>>>>>>>>45 ubyte >0 219>>>>>>>>>>>46 ubyte <32 220>>>>>>>>>>>>46 ubyte >0 221#!:mime application/x-mdx 222>>>>>>>>>>>>>0 use xbase-type 223>>>>>>>>>>>>>0 ubyte x \b MDX 224>>>>>>>>>>>>>1 ubyte x \b, creation-date 225>>>>>>>>>>>>>1 use xbase-date 226>>>>>>>>>>>>>44 ubyte x \b, update-date 227>>>>>>>>>>>>>44 use xbase-date 228# No.of tags in use (1,2,5,12) 229>>>>>>>>>>>>>28 uleshort x \b, %d 230# No. of entries in tag (0x30) 231>>>>>>>>>>>>>25 ubyte x \b/%d tags 232# Length of tag 233>>>>>>>>>>>>>26 ubyte x * %d 234# 1st tag name_ 235>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 236# 2nd tag name 237#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 238# 239# Print the xBase names of different version variants 2400 name xbase-type 241>0 ubyte <2 242# 1 < version 243>0 ubyte >1 244>>0 ubyte 0x02 FoxBase 245# FoxBase+/dBaseIII+, no memo 246>>0 ubyte 0x03 FoxBase+/dBase III 247!:mime application/x-dbf 248# dBASE IV no memo file 249>>0 ubyte 0x04 dBase IV 250!:mime application/x-dbf 251# dBASE V no memo file 252>>0 ubyte 0x05 dBase V 253!:mime application/x-dbf 254>>0 ubyte 0x30 Visual FoxPro 255!:mime application/x-dbf 256>>0 ubyte 0x31 Visual FoxPro, autoincrement 257!:mime application/x-dbf 258# Visual FoxPro, with field type Varchar or Varbinary 259>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 260!:mime application/x-dbf 261# dBASE IV SQL, no memo;dbv memo var size (Flagship) 262>>0 ubyte 0x43 dBase IV, with SQL table 263!:mime application/x-dbf 264# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 265#>>0 ubyte 0x62 dBase IV, with SQL table 266#!:mime application/x-dbf 267# dBASE IV, with memo!! 268>>0 ubyte 0x7b dBase IV, with memo 269!:mime application/x-dbf 270# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 271#>>0 ubyte 0x82 dBase IV, with SQL system 272#!:mime application/x-dbf 273# FoxBase+/dBaseIII+ with memo .DBT! 274>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 275!:mime application/x-dbf 276# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 277>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 278!:mime application/x-dbf 279# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 280#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 281#!:mime application/x-dbf 282# dBASE IV with memo! 283>>0 ubyte 0x8B dBase IV, with memo .DBT 284!:mime application/x-dbf 285# dBase IV with SQL Table,no memo? 286>>0 ubyte 0x8E dBase IV, with SQL table 287!:mime application/x-dbf 288# .dbv and .dbt memo (Flagship)? 289>>0 ubyte 0xB3 Flagship 290# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 291#>>0 ubyte 0xCA dBase IV with memo .DBT 292#!:mime application/x-dbf 293# dBASE IV with SQL table, with memo .DBT 294>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 295!:mime application/x-dbf 296# HiPer-Six format;Clipper SIX, with SMT memo file 297>>0 ubyte 0xE5 Clipper SIX with memo 298!:mime application/x-dbf 299# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 300#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 301#!:mime application/x-dbf 302>>0 ubyte 0xF5 FoxPro with memo 303!:mime application/x-dbf 304# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 305#>>0 ubyte 0xFA FoxPro 2.x, with memo 306#!:mime application/x-dbf 307# unknown version (should not happen) 308>>0 default x xBase 309!:mime application/x-dbf 310>>>0 ubyte x (0x%x) 311# flags in version byte 312# DBT flag (with dBASE III memo .DBT)!! 313# >>0 ubyte&0x80 >0 DBT_FLAG=%x 314# memo flag ?? 315# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 316# SQL flag ?? 317# >>0 ubyte&0x70 >0 SQL_FLAG=%x 318# test and print the date of xBase .DBF .MDX 3190 name xbase-date 320# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 321>0 ubelong x 322>1 ubyte <13 323>>1 ubyte >0 324>>>2 ubyte >0 325>>>>2 ubyte <32 326>>>>>0 ubyte x 327# YY is interpreted as 20YY or 19YY 328>>>>>>0 ubyte <100 \b %.2d 329# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 330>>>>>>0 ubyte >99 \b %d 331>>>>>1 ubyte x \b-%d 332>>>>>2 ubyte x \b-%d 333 334# dBase memo files .DBT or .FPT 335# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 33616 ubyte <4 337>16 ubyte !2 338>>16 ubyte !1 339# next free block index is positive 340>>>0 ulelong >0 341# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 342>>>>17 ubelong&0xFFfdFE00 0x00000000 343# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 344>>>>>20 ubelong&0xFF01209B 0x00000000 345# dBASE III 346>>>>>>16 ubyte 3 347# dBASE III DBT 348>>>>>>>0 use xbase-memo-print 349# dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage 350>>>>>>16 ubyte 0 351# dBASE IV DBT with DBF name or DBF garbage 352>>>>>>>8 ubelong >0x40000000 353# skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block 354>>>>>>>>0 ulelong <0x01010002 355>>>>>>>>>0 use xbase-memo-print 356>>>>>>>8 ubelong 0 357# skip MM*DD*.bin by test for for reserved NULL byte 358>>>>>>>>508 ubelong 0 359# real memo files should contain text here 360>>>>>>>>>520 ubelong >0x20202019 361>>>>>>>>>>520 ubelong <0xFEFEFEFF 362>>>>>>>>>>>0 use xbase-memo-print 363# garbage PCX , ZIP , JAR , XPI 364>>>>>>>8 default x 365 366# Print the information of dBase DBT or FoxPro FPT memo files 3670 name xbase-memo-print 368>0 ubyte x 369# test version 370# memo file 371>>16 ubyte 3 dBase III DBT 372>>16 ubyte 0 373>>>512 ubelong <0x00000003 FoxPro FPT 374# Size of blocks for FoxPro 375>>>>6 ubeshort x \b, blocks size %u 376# Number of next available block for appending data for FoxPro 377>>>>0 ubelong =0 \b, next free block index %u 378>>>>0 ubelong !0 \b, next free block index %u 379>>>512 default x dBase IV DBT 380# DBF file name without extension 381>>>>8 string >\0 \b of %-.8s.DBF 382# size of blocks ; not reliable 0x2020204C 383#>>>>4 ulelong =0 \b, blocks size %u 384>>>>4 ulelong !0 \b, blocks size %u 385# Block length found 0 , 512 386#>>>>20 uleshort =0 \b, block length %u 387>>>>20 uleshort !0 \b, block length %u 388# Number of next available block for appending data 389>>>>0 ulelong =0 \b, next free block index %u 390>>>>0 ulelong !0 \b, next free block index %u 391>>512 ubelong x 392>>>512 ubelong =0xFFFF0800 393>>>>520 string >\0 \b, 1st used item "%s" 394# FoxPro 395>>>512 ubelong <3 396# FoxPro memo 397>>>>512 ubelong =1 398>>>>520 string >\0 \b, 1st used item "%s" 399>>>512 default x 400# may be deleted memo field 401>>>>512 string >\0 \b, 1st item "%s" 402 403# TODO: 404# DBASE index file *.NDX 405# DBASE Compound Index file *.CDX 406# dBASE IV Printer Driver *.PRF 407## End of XBase database stuff 408 409# MS Access database 4104 string Standard\ Jet\ DB Microsoft Access Database 411!:mime application/x-msaccess 4124 string Standard\ ACE\ DB Microsoft Access Database 413!:mime application/x-msaccess 414 415# TDB database from Samba et al - Martin Pool <mbp@samba.org> 4160 string TDB\ file TDB database 417>32 lelong 0x2601196D version 6, little-endian 418>>36 lelong x hash size %d bytes 419 420# SE Linux policy database 4210 lelong 0xf97cff8c SE Linux policy 422>16 lelong x v%d 423>20 lelong 1 MLS 424>24 lelong x %d symbols 425>28 lelong x %d ocons 426 427# ICE authority file data (Wolfram Kleff) 4282 string ICE ICE authority data 429 430# X11 Xauthority file (Wolfram Kleff) 43110 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 43211 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 43312 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 43413 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 43514 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 43615 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 43716 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 43817 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 43918 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 440 441# From: Maxime Henrion <mux@FreeBSD.org> 442# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 4430 string PGDMP PostgreSQL custom database dump 444>5 byte x - v%d 445>6 byte x \b.%d 446>5 beshort <0x101 \b-0 447>5 beshort >0x100 448>>7 byte x \b-%d 449 450# Type: Advanced Data Format (ADF) database 451# URL: http://www.grc.nasa.gov/WWW/cgns/adf/ 452# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 4530 string @(#)ADF\ Database CGNS Advanced Data Format 454 455# Tokyo Cabinet magic data 456# http://tokyocabinet.sourceforge.net/index.html 4570 string ToKyO\ CaBiNeT\n Tokyo Cabinet 458>14 string x \b (%s) 459>32 byte 0 \b, Hash 460!:mime application/x-tokyocabinet-hash 461>32 byte 1 \b, B+ tree 462!:mime application/x-tokyocabinet-btree 463>32 byte 2 \b, Fixed-length 464!:mime application/x-tokyocabinet-fixed 465>32 byte 3 \b, Table 466!:mime application/x-tokyocabinet-table 467>33 byte &1 \b, [open] 468>33 byte &2 \b, [fatal] 469>34 byte x \b, apow=%d 470>35 byte x \b, fpow=%d 471>36 byte &0x01 \b, [large] 472>36 byte &0x02 \b, [deflate] 473>36 byte &0x04 \b, [bzip] 474>36 byte &0x08 \b, [tcbs] 475>36 byte &0x10 \b, [excodec] 476>40 lequad x \b, bnum=%lld 477>48 lequad x \b, rnum=%lld 478>56 lequad x \b, fsiz=%lld 479 480# Type: QDBM Quick Database Manager 481# From: Benoit Sibaud <bsibaud@april.org> 4820 string \\[depot\\]\n\f Quick Database Manager, little endian 4830 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 484 485# Type: TokyoCabinet database 486# URL: http://tokyocabinet.sourceforge.net/ 487# From: Benoit Sibaud <bsibaud@april.org> 4880 string ToKyO\ CaBiNeT\n TokyoCabinet database 489>14 string x (version %s) 490 491# From: Stephane Blondon http://www.yaal.fr 492# Database file for Zope (done by FileStorage) 4930 string FS21 Zope Object Database File Storage (data) 494# Cache file for the database of Zope (done by ClientStorage) 4950 string ZEC3 Zope Object Database Client Cache File (data) 496 497# IDA (Interactive Disassembler) database 4980 string IDA1 IDA (Interactive Disassembler) database 499