xref: /onnv-gate/usr/src/cmd/file/magic (revision 437:76c202dd62bf)

#
# Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# CDDL HEADER START
#
# The contents of this file are subject to the terms of the
# Common Development and Distribution License, Version 1.0 only
# (the "License").  You may not use this file except in compliance
# with the License.
#
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
# or http://www.opensolaris.org/os/licensing.
# See the License for the specific language governing permissions
# and limitations under the License.
#
# When distributing Covered Code, include this CDDL HEADER in each
# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
# If applicable, add the following below this CDDL HEADER, with the
# fields enclosed by brackets "[]" replaced with your own identifying
# information: Portions Copyright [yyyy] [name of copyright owner]
#
# CDDL HEADER END
#
#ident	"%Z%%M%	%I%	%E% SMI"
#
# This file contains the dictionary of file format identifiers (magic strings)
# used by file(1).  The fields of this file are as follows:
#
# (1) byte offset
# (2) value type
# (3) optional operator (= by default)
# (4) value to match (numeric or string)
# (5) string to be printed
#
# Numeric values may be decimal, octal, or hex.  Also note that the last string
# may have one printf format specifier.  The '>' in occassional column 1's is
# magic: it forces file(1) to continue scanning and matching additional lines.
# The first line afterwards not so marked terminates the search.
#
# The entries for ELF are not needed anymore, as file(1) now uses the elf(3ELF)
# routines to look at ELF files.  They remain, commented out, for reference.
#
#0	string		\177ELF		ELF
#>4	byte		1		32-bit
#>5	byte		1		LSB
#>5	byte		2		MSB
#>16	short		0		unknown type
#>16	short		1		relocatable
#>16	short		2		executable
#>16	short		3		dynamic lib
#>16	short		4		core file
#>18	short		0		unknown machine
#>18	short		1		WE32100
#>18	short		2		SPARC
#>18	short		3		80386
#>18	short		4		M68000
#>18	short		5		M88000
#>18	short		6		i80486
#>18	short		7		i860
#>18	short		8		RS3000_BE
#>18	short		9		UNKNOWN
#>18	short		10		RS3000_LE
#>18	short		11		RS6000
#>18	short		12		UNKNOWN
#>18	short		13		UNKNOWN
#>18	short		14		UNKNOWN
#>18	short		15		PA_RISC
#>18	short		16		nCUBE
#>18	short		17		VPP500
#>18	short		18		SPARC32PLUS
#>18	short		19		UNKNOWN
#>18	short		20		PowerPC
#>20	long		1		Version 1
#>36	long		1		MAU Required
257	string		ustar		USTAR tar archive
>156	byte		88		extended format
0	short		070701		cpio archive
0	string		070701		ASCII cpio archive
0	short		070702		cpio archive - CRC header
0	string		070702		ASCII cpio archive - CRC header
0	short		070707		cpio archive - CHR (-c) header
0	string		070707		ASCII cpio archive - CHR (-c) header
0	long		0177555		obsolete ar archive
0	short		0177545		pdp11/pre System V ar archive
0	long		0100554		apl workspace
0	short		017037		packed data
0	string		<ar>		System V Release 1 ar archive
0	string		!<arch>		current ar archive
0	short		0407		pdp11/pre System V vax executable
>8	ushort		>0		not stripped
>15	ubyte		>0		- version %ld
0	short		0401		unix-rt ldp
0	short		0405		pdp11 overlay
0	short		0410		pdp11/pre System V vax pure executable
>8	ushort		>0		not stripped
>15	ubyte		>0		- version %ld
0	short		0411		pdp11 separate I&D
>8	ushort		>0		not stripped
>15	ubyte		>0		- version %ld
0	short		015001		Compiled Terminfo Entry
# little-endian entry
0	short		0432		Compiled Terminfo Entry
0	short		0433		Curses screen image
0	short		0434		Curses screen image
0	short		0437		pdp11 kernel overlay
0	short		0570		vax executable
>12	long		>0		not stripped
>22	ushort		>0		- version %ld
0	short		0575		vax pure executable
>12	long		>0		not stripped
>22	ushort		>0		- version %ld
0	short		0502		basic-16 executable
>12	long		>0		not stripped
>22	ushort		>0		- version %ld
0	short		0503		basic-16 executable (TV)
>12	long		>0		not stripped
>22	ushort		>0		- version %ld
0	short		0510		x86 executable
>12	long		>0		not stripped
0	short		0511		x86 executable (TV)
>12	long		>0		not stripped
0	short		0550		3b20 executable
>12	long		>0		not stripped
>22	ushort		>0		- version %ld
0	short		0551		3b20 executable (TV)
>12	long		>0		not stripped
>22	ushort		>0		- version %ld
0	short		0560		WE32000 executable
>12	long		>0		not stripped
>18	short		^00010000	- N/A on 3b2/300 w/paging
>18	short		&00020000	- 32100 required
>18	short		&00040000	and mau hardware required
>20	short		0443		(target shared library)
>20	short		0410		(swapped)
>20	short		0413		(paged)
>22	ushort		>0		- version %ld
0	short		0561		WE32000 executable (TV)
>12	long		>0		not stripped
>18	short		&00020000	- 32100 required
>18	short		&00040000	and mau hardware required
>22	ushort		>0		- version %ld
0	short		=0512		iAPX 286 executable small model (COFF)
>12	long		>0		not stripped
>22	ushort		>0		- version %ld
0	short		=0522		iAPX 286 executable large model (COFF)
>12	long		>0		not stripped
>22	ushort		>0		- version %ld
0	short		0514		iAPX 386 executable (COFF) (deprecated)
>12	long		>0		not stripped
>22	ushort		>0		- version %ld
0	short		0520		mc68k executable
>12	long		>0		not stripped
0	short		0521		mc68k executable (shared)
>12	long		>0		not stripped
0	short		0522		mc68k executable (shared demand paged)
>12	long		>0		not stripped
# big-endian entries for pure executables
2	short		0410		pure
>1	byte		0		sun2 executable
>1	byte		1		mc68010 executable
>1	byte		2		mc68020 executable
>1	byte		3		SPARC executable
>0	ubyte		>077		dynamically linked
# little-endian entries for pure executables
2	short		04001		pure
>1	byte		0		sun2 executable
>1	byte		1		mc68010 executable
>1	byte		2		mc68020 executable
>1	byte		3		SPARC executable
>0	ubyte		>077		dynamically linked
# big-endian entries for impure executables
2	short		0407		impure
>1	byte		0		sun2 executable
>1	byte		1		mc68010 executable
>1	byte		2		mc68020 executable
>1	byte		3		SPARC executable
>0	ubyte		>077		dynamically linked
# little-endian entries for impure executables
2	short		03401		impure
>1	byte		0		sun2 executable
>1	byte		1		mc68010 executable
>1	byte		2		mc68020 executable
>1	byte		3		SPARC executable
>0	ubyte		>077		dynamically linked
# big-endian entries for Sun demand paged executables
2	short		0413		Sun demand paged
>1	byte		0		sun2 executable
>1	byte		1		mc68010 executable
>1	byte		2		mc68020 executable
>1	byte		3		SPARC executable
>0	ubyte		>077		dynamically linked
# little-endian entries for Sun demand paged executables
2	short		05401		Sun demand paged
>1	byte		0		sun2 executable
>1	byte		1		mc68010 executable
>1	byte		2		mc68020 executable
>1	byte		3		SPARC executable
>0	ubyte		>077		dynamically linked
0	short		0x8001		Adobe PostScript Type 1 binary font (PFB)
0	short		0x0180		Adobe PostScript Type 1 binary font (PFB)
0	long		0x00010000	TrueType font file version 1.0 (TTF)
0	long		0x00000100	TrueType font file version 1.0 (TTF)
0	long		0xf00000ff	extended accounting file
# little-endian entry
0	long		0xff0000f0	extended accounting file
0	byte		0x80		8086 relocatable (Microsoft)
0	byte		0xf0		MS-DOS library
0	short		0xff65		x.out
>2	string		__.SYMDEF	randomized
>0	byte		x		archive
0	short		0x206		Microsoft a.out
>0x1e	short		&0x10		overlay
>0x1e	short		&0x2		separate
>0x1e	short		&0x4		pure
>0x1e	short		&0x800		segmented
>0x1e	short		&0x400		standalone
>0x1e	short		&0x8		fixed-stack
>0x1c	byte		&0x80		byte-swapped
>0x1c	byte		&0x40		word-swapped
>0x10	long		>0		not-stripped
>0x1e	short		^0xc000		pre-SysV
>0x1c	byte		&0x4		86
>0x1c	byte		&0x9		286
>0x1c	byte		&0xa		386
>0x1e	short		&0x1		executable
>0x1e	short		^0x1		object file
>0x1e	short		&0x40		Large Text
>0x1e	short		&0x20		Large Data
>0x1e	short		&0x120		Huge Objects Enabled
0	short		0x10b		VAX demand load format a.out object file
>0x10	long		>0		not stripped
0	short		0x140		old Microsoft 8086 x.out
>0x3	byte		&0x4		separate
>0x3	byte		&0x2		pure
>0	byte		&0x1		executable
>0	byte		^0x1		relocatable
>0x14	long		>0		not stripped
0	long		0x10b		VAX demand load format a.out object file
>0x10	long		>0		not stripped
0	long		0x140		old Microsoft 8086 x.out
>0x3	byte		&0x4		separate
>0x3	byte		&0x2		pure
>0	byte		&0x1		executable
>0	byte		^0x1		relocatable
>0x14	long		>0		not stripped
0	long		0xe807		object file (z8000 a.out)
0	long		0xe808		pure object file (z8000 a.out)
0	long		0xe809		separate object file (z8000 a.out)
0	long		0xe805		overlay object file (z8000 a.out)
0	long		0x178		Bell 5.0 executable
2	short		0410		Sun read-only text executable
>2	short		0407		Sun old executable
>1	byte		3		(SPARC)
>1	byte		2		(68020)
>1	byte		1		(68010)
>1	byte		0		(Sun2)
0	short		0143561		byte-swapped cpio archive
0	long		0101555		PDP-11 single precision APL workspace
0	long		0101554		PDP-11 double precision APL workspace
0	long		0101557		VAX single precision APL workspace
0	long		0101556		VAX double precision APL workspace
0	short		017437		old packed data
0	string		\037\036	packed data
0	string		\377\037	compacted data
0	string		\037\235	compressed data
>2	byte&0x80	>0		block compressed
>2	byte&0x1f	x		%d bits
0	string		\037\213	gzip compressed data
>2	byte		8		- deflate method
>3	byte		&0x1		, ascii
>3	byte		&0x2		, continuation
>3	byte		&0x4		, extra field
>3	byte		&0x8		, original file name
>3	byte		&0x10		, comment
>3	byte		&0x20		, encrypted
>8	byte		2		, max compression
>8	byte		4		, max speed
0	string		!<arch>\n__.SYMDEF	archive random library
0	long		0x1010101	MMDF mailbox
0	string		<!OPS		Interleaf ASCII document
24	string		SunGKS		SunGKS
# version number follows, in the form m.n
>0	string		GKSM		Metafile
0	string		GKSM		GKS Metafile
# version number follows, in the form <!OPS, Version n.n>
0	string		%!PS-AdobeFont	Adobe PostScript ASCII font (PFA)
0	string		%!		PostScript document
>2	string		PS-Adobe	 conforming to level
>10	string		-1.0		 1.0
>10	string		-2.0		 2.0
>10	string		-3.0		 3.0
# version ID follows, in the form PS-Adobe-nn
0	string		Interpress/Xerox	Interpress document
# version ID follows, in the form /n.n
0	string		StartFontMetrics	Adobe font metrics
0	string		StartFont	Adobe font bits
0	long		0x137A2944	NeWS bitmap font
0	long		0x137A2947	NeWS font family
8	long		0x137A2B45	X11/NeWS bitmap font
8	long		0x137A2B48	X11/NeWS font family
# snoop files are always big-endian
# big-endian entries, with ullong equivalent of string "snoop"
0	ullong		0x736e6f6f70000000	Snoop capture file
>8	long		>0		- version %ld
# little-endian entries, with ullong equivalent of string "snoop"
0	ullong		0x000000706f6f6e73	Snoop capture file
>11	long		>0		- version %ld
0	short		0436		vfont definition
0	string		<MakerFile	Frame Maker document
0	string		<MIFFile	Frame Maker MIF file
0	string		<MML		Frame Maker MML file
0	string		<BookFile	Frame Maker book file
# Audio files are always big-endian so there are two sets of tables here.
# The CPU endian architecture is determined via the ordering of the first 4 bytes
# (the string ".snd"). The tables below have this value represented as a single
# 4 byte long. If the architecture is big-endian the %d token can be used for
# interpreting the sampling rate.
# Since %d can't be done on the data for little endian machines the limitation
# is that sampling rates not included in the x86 entries will not be recognized.
#
# big-endian entries
#
0	long		0x2e736e64	audio data:
>12	long		1		8-bit u-law,
>12	long		2		8-bit linear PCM,
>12	long		3		16-bit linear PCM,
>12	long		4		24-bit linear PCM,
>12	long		5		32-bit linear PCM,
>12	long		6		32-bit floating point,
>12	long		7		64-bit floating point,
>12	long		23		compressed (4-bit G.721 ADPCM),
>12	long		24		compressed (8-bit G.722 ADPCM),
>12	long		25		compressed (3-bit G.723 ADPCM),
>12	long		26		compressed (5-bit G.723 ADPCM),
>12	long		27		8-bit A-law,
>20	long		1		mono,
>20	long		2		stereo,
>20	long		4		quad,
>16	long		x		%d Hz
#
# little-endian entries
#
0	long		0x646e732e	audio data:
>12	long		0x01000000	8-bit u-law,
>12	long		0x02000000	8-bit linear PCM,
>12	long		0x03000000	16-bit linear PCM,
>12	long		0x04000000	24-bit linear PCM,
>12	long		0x05000000	32-bit linear PCM,
>12	long		0x06000000	32-bit floating point,
>12	long		0x07000000	64-bit floating point,
>12	long		0x17000000	compressed (4-bit G.721 ADPCM),
>12	long		0x18000000	compressed (8-bit G.722 ADPCM),
>12	long		0x19000000	compressed (3-bit G.723 ADPCM),
>12	long		0x1a000000	compressed (5-bit G.723 ADPCM),
>12	long		0x1b000000	8-bit A-law,
>20	long		0x01000000	mono,
>20	long		0x02000000	stereo,
>20	long		0x04000000	quad,
>16	long		0x401f0000	8000 Hz
>16	long		0x80250000	9600 Hz
>16	long		0x112b0000	11025 Hz
>16	long		0x803e0000	16000 Hz
>16	long		0xd4490000	18900 Hz
>16	long		0x22560000	22050 Hz
>16	long		0x007d0000	32000 Hz
>16	long		0xa8930000	37800 Hz
>16	long		0x44ac0000	44100 Hz
>16	long		0x80bb0000	48000 Hz
# .wav files are always little-endian
# .wav big-endian entries, starting with long value for the string "RIFF"
0	long		0x52494646	audio data:
>34	short		0x0800		8-bit
>34	short		0x1000		16-bit
>20	short		0x0100		linear PCM,
>20	short		0x0200		MS ADPCM,
>20	short		0x0600		A-law,
>20	short		0x0700		u-law,
>20	short		0x1100		DVI ADPCM,
>22	short		0x0100		mono
>22	short		0x0200		stereo
# .wav little-endian entries, starting with long value for the string "RIFF"
0	long		0x46464952	audio data:
>34	short		0x0008		8-bit
>34	short		0x0010		16-bit
>20	short		0x0001		linear PCM,
>20	short		0x0002		MS ADPCM,
>20	short		0x0006		A-law,
>20	short		0x0007		u-law,
>20	short		0x0011		DVI ADPCM,
>22	short		0x0001		mono
>22	short		0x0002		stereo
# .aiff files are always big-endian
# .aiff big-endian entries, starting with long value for the string "FORM"
0	long		0x464f524d	audio data:
>26	short		0x0008		8-bit linear PCM,
>26	short		0x0010		16-bit linear PCM,
>20	short		0x0001		mono
>20	short		0x0002		stereo
# .aiff little-endian entries, starting with long value for the string "FORM"
0	long		0x4d524f46	audio data:
>26	short		0x0800		8-bit linear PCM,
>26	short		0x1000		16-bit linear PCM,
>20	short		0x0100		mono
>20	short		0x0200		stereo
# .mid files are always big-endian
# .mid big-endian entries, starting with long value for the string "MThd"
0	long		0x4d546864	MIDI data:
>8	short		x		type %u,
>10	short		x		%u track(s)
# .mid little-endian entry (the string "MThd")
# can't translate big-endian type and track information
0	long		0x6468544d	MIDI data
#
0	short		0x1010		PEX Binary Archive
# rasterfiles are big-endian
# big-endian rasterfile entries
0	long		0x59a66a95	rasterfile,
>4	long		>0		%ld x
>8	long		>0		%ld x
>12	long		>0		%ld
>20	long		0		old format image
>20	long		1		standard format image
>20	long		2		run-length byte encoded image
>20	long		3		XRGB or RGB format image
>20	long		4		tiff format image
>20	long		5		iff (TAAC format) image
>20	long		0xffff		experimental format image
# little-endian rasterfile entries
# cannot translate resolution stored as big-endian longs
0	long		0x956aa659	rasterfile,
>23	long		0		old format image
>23	long		1		standard format image
>23	long		2		run-length byte encoded image
>23	long		3		XRGB or RGB format image
>23	long		4		tiff format image
>23	long		5		iff (TAAC format) image
>20	long		0xffff		experimental format image
0	long		0x884f5053	Interleaf fast-saved document
0	long		0x2a535441	Aster*x
>7	long		0x574f5244		Words Document
>7	long		0x47524150		Graphic
>7	long		0x53505245		Spreadsheet
>7	long		0x4d414352		Macro
0	long		0x32323738	Aster*x Version 2
>29	byte		0x36			Words Document
>29	byte		0x35			Graphic
>29	byte		0x32			Spreadsheet
>29	byte		0x38			Macro
4	string		pgscriptver	IslandWrite document
13	string		DrawFile	IslandDraw document
0	string		P1		PBM ascii file
0	string		P2		PGM ascii file
0	string		P3		PPM ascii file
0	string		P4		PBM raw file
0	string		P5		PGM raw file
0	string		P6		PPM raw file
0	string		\115\115	TIFF file, big-endian
0	string		\111\111	TIFF file, little-endian
0	string		GIF87a		GIF file, v87
0	string		GIF89a		GIF file, v89
0	string		\377\330\377\340	JPEG file
0	string		\377\330\377\341	JPEG file
0	string		\377\330\377\356	JPG file
8	string		ILBM		IFF ILBM file
0	string		\312\376\272\276	java class file
36	string		acsp	Kodak Color Management System, ICC Profile
0	string		%PDF		Adobe Portable Document Format (PDF)
>4	string		-1.0		v1.0
>4	string		-1.1		v1.1
>4	string		-1.2		v1.2
>4	string		-1.3		v1.3
>4	string		-1.4		v1.4
>4	string		-1.5		v1.5
0	string		<html		html document
0	string		<HTML		html document
0	string		<Html		html document
0	string		<!doctype HTML	html document
0	string		<!doctype Html	html document
0	string		<!doctype html	html document
0	string		<!DOCTYPE HTML	html document
0	string		<!DOCTYPE Html	html document
0	string		<!DOCTYPE html	html document
0	string		<!Doctype HTML	html document
0	string		<!Doctype Html	html document
0	string		<!Doctype html	html document
0	string		<head		html document
0	string		<HEAD		html document
0	string		<Head		html document
0	string		<title		html document
0	string		<TITLE		html document
0	string		<Title		html document
0	string		<?xml		XML document
0	string		<?XML		XML document
0	string		<?Xml		XML document
0	string		\0211PNG	PNG image data
0	string		.RMF		RealMedia file
0	string		FlAsH-aRcHiVe	Flash Archive
>13	string		-1.0		 1.0
>13	string		-2.0		 2.0
38	string		application/vnd.sun.xml.writer	StarOffice 7 Text Document
38	string		application/vnd.sun.xml.calc	StarOffice 7 Spreadsheet
38	string		application/vnd.sun.xml.draw	StarOffice 7 Drawing
38	string		application/vnd.sun.xml.impress	StarOffice 7 Presentation
38	string		application/vnd.sun.xml.math	StarOffice 7 Formula
38	string		application/vnd.oasis.opendocument.chart	OpenDocument Chart
38	string		application/vnd.oasis.opendocument.database	OpenDocument Database
38	string		application/vnd.sun.xml.base			OpenDocument Database
38	string		application/vnd.oasis.opendocument.formula	OpenDocument Formula
38	string		application/vnd.oasis.opendocument.image	OpenDocument Image
38	string		application/vnd.oasis.opendocument.text-web	HTML Document Template
38	string		application/vnd.oasis.opendocument.text-	OpenDocument
>78	string		template						Text Template
>78	string		master							Master Document
38	string		application/vnd.oasis.opendocument.text		OpenDocument Text
38	string		application/vnd.oasis.opendocument.graphics	OpenDocument Drawing
>81	string		-template						Template
38	string		application/vnd.oasis.opendocument.presentation	OpenDocument Presentation
>85	string		-template						Template
38	string		application/vnd.oasis.opendocument.spreadsheet	OpenDocument Spreadsheet
>84	string		-template						Template
0	string		PK\003\004	ZIP archive
0	string		MZ		DOS executable (EXE)
0	string		LZ		DOS built-in
0	byte		0xe9		DOS executable (COM)
0	byte		0xeb		DOS executable (COM)
24	long		60012		ufsdump archive file
0	string		TZif		zoneinfo timezone data file
0	string		BZh		bzip2 compressed data
>3	byte		>47		, block size = %c00k
0	string		SUNWcpch	Sun C compiler precompiled header
0	string		SUNWCpch	Sun C++ compiler precompiled header
0	string		\043\040PaCkAgE\040DaTaStReAm	package datastream
0	short		0xcff1		CTF data file
0	string		\177DOF		DTrace DOF data file
0	string		\177FCF		fmd(1M) checkpoint file
0	string		EFT\0		Fault tree file,
>4	ushort		x		v%u
>6	ushort		x		rev %u,
>8	ushort		x		from esc v%u
>10	ushort		x		rev %u
0	string		_SM_		DMTF SMBIOS image
>6	byte		x		version %u
>7	byte		x		.%u