head 1.9; access; symbols perseant-exfatfs-base-20250801:1.9 perseant-exfatfs-base-20240630:1.9 perseant-exfatfs:1.9.0.22 perseant-exfatfs-base:1.9 cjep_sun2x:1.9.0.20 cjep_sun2x-base:1.9 cjep_staticlib_x-base1:1.9 cjep_staticlib_x:1.9.0.18 cjep_staticlib_x-base:1.9 phil-wifi-20200421:1.9 phil-wifi-20200411:1.9 phil-wifi-20200406:1.9 pgoyette-compat-merge-20190127:1.9 pgoyette-compat-20190127:1.9 pgoyette-compat-20190118:1.9 pgoyette-compat-1226:1.9 pgoyette-compat-1126:1.9 pgoyette-compat-1020:1.9 pgoyette-compat-0930:1.9 pgoyette-compat-0906:1.9 pgoyette-compat-0728:1.9 pgoyette-compat-0625:1.9 pgoyette-compat-0521:1.9 pgoyette-compat-0502:1.9 pgoyette-compat-0422:1.9 pgoyette-compat-0415:1.9 pgoyette-compat-0407:1.9 pgoyette-compat-0330:1.9 pgoyette-compat-0322:1.9 pgoyette-compat-0315:1.9 pgoyette-compat:1.9.0.16 pgoyette-compat-base:1.9 prg-localcount2-base3:1.9 prg-localcount2-base2:1.9 prg-localcount2-base1:1.9 prg-localcount2:1.9.0.14 prg-localcount2-base:1.9 pgoyette-localcount-20170426:1.9 bouyer-socketcan-base1:1.9 pgoyette-localcount-20170320:1.9 bouyer-socketcan:1.9.0.12 bouyer-socketcan-base:1.9 pgoyette-localcount-20170107:1.9 pgoyette-localcount-20161104:1.9 localcount-20160914:1.9 pgoyette-localcount-20160806:1.9 pgoyette-localcount-20160726:1.9 pgoyette-localcount:1.9.0.10 pgoyette-localcount-base:1.9 netbsd-5-2-3-RELEASE:1.8 netbsd-5-1-5-RELEASE:1.8 yamt-pagecache-base9:1.9 yamt-pagecache-tag8:1.9 tls-earlyentropy:1.9.0.6 tls-earlyentropy-base:1.9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.9 riastradh-drm2-base3:1.9 netbsd-5-2-2-RELEASE:1.8 netbsd-5-1-4-RELEASE:1.8 netbsd-5-2-1-RELEASE:1.8 netbsd-5-1-3-RELEASE:1.8 agc-symver:1.9.0.8 agc-symver-base:1.9 tls-maxphys-base:1.9 yamt-pagecache-base8:1.9 netbsd-5-2:1.8.0.2 yamt-pagecache-base7:1.9 netbsd-5-2-RELEASE:1.8 netbsd-5-2-RC1:1.8 yamt-pagecache-base6:1.9 yamt-pagecache-base5:1.9 yamt-pagecache-base4:1.9 netbsd-5-1-2-RELEASE:1.8 netbsd-5-1-1-RELEASE:1.8 yamt-pagecache-base3:1.9 yamt-pagecache-base2:1.9 yamt-pagecache:1.9.0.4 yamt-pagecache-base:1.9 bouyer-quota2-nbase:1.9 bouyer-quota2:1.9.0.2 bouyer-quota2-base:1.9 matt-nb5-mips64-premerge-20101231:1.8 matt-nb5-pq3:1.8.0.14 matt-nb5-pq3-base:1.8 netbsd-5-1:1.8.0.12 netbsd-5-1-RELEASE:1.8 netbsd-5-1-RC4:1.8 matt-nb5-mips64-k15:1.8 netbsd-5-1-RC3:1.8 netbsd-5-1-RC2:1.8 netbsd-5-1-RC1:1.8 netbsd-5-0-2-RELEASE:1.8 matt-nb5-mips64-premerge-20091211:1.8 matt-nb5-mips64-u2-k2-k4-k7-k8-k9:1.8 matt-nb4-mips64-k7-u2a-k9b:1.8 matt-nb5-mips64-u1-k1-k5:1.8 matt-nb5-mips64:1.8.0.10 netbsd-5-0-1-RELEASE:1.8 jym-xensuspend-nbase:1.8 netbsd-5-0:1.8.0.8 netbsd-5-0-RELEASE:1.8 netbsd-5-0-RC4:1.8 netbsd-5-0-RC3:1.8 netbsd-5-0-RC2:1.8 jym-xensuspend:1.8.0.6 jym-xensuspend-base:1.8 netbsd-5-0-RC1:1.8 netbsd-5:1.8.0.4 netbsd-5-base:1.8 matt-mips64-base2:1.8 matt-mips64:1.7.0.14 netbsd-4-0-1-RELEASE:1.5.2.1 wrstuden-revivesa-base-3:1.8 wrstuden-revivesa-base-2:1.8 wrstuden-fixsa-newbase:1.5.2.1 FILE4_26:1.1.1.12 wrstuden-revivesa-base-1:1.7 yamt-pf42-base4:1.7 yamt-pf42-base3:1.7 hpcarm-cleanup-nbase:1.7 yamt-pf42-baseX:1.7 yamt-pf42-base2:1.7 wrstuden-revivesa:1.7.0.12 wrstuden-revivesa-base:1.7 yamt-pf42:1.7.0.10 yamt-pf42-base:1.7 keiichi-mipv6:1.7.0.8 keiichi-mipv6-base:1.7 matt-armv6-nbase:1.7 matt-armv6-prevmlocking:1.7 wrstuden-fixsa-base-1:1.5.2.1 netbsd-4-0:1.5.2.1.0.2 netbsd-4-0-RELEASE:1.5.2.1 cube-autoconf:1.7.0.6 cube-autoconf-base:1.7 netbsd-4-0-RC5:1.5.2.1 netbsd-4-0-RC4:1.5.2.1 netbsd-4-0-RC3:1.5.2.1 netbsd-4-0-RC2:1.5.2.1 netbsd-4-0-RC1:1.5.2.1 matt-armv6:1.7.0.4 matt-armv6-base:1.7 matt-mips64-base:1.7 hpcarm-cleanup:1.7.0.2 hpcarm-cleanup-base:1.7 netbsd-3-1-1-RELEASE:1.1.1.7.6.1 netbsd-3-0-3-RELEASE:1.1.1.7.4.1 FILE4_21:1.1.1.11 wrstuden-fixsa:1.5.0.4 wrstuden-fixsa-base:1.5.2.1 FILE4_20:1.1.1.10 abandoned-netbsd-4-base:1.3 abandoned-netbsd-4:1.3.0.2 FILE4_18:1.1.1.9 netbsd-3-1:1.1.1.7.0.6 netbsd-3-1-RELEASE:1.1.1.7 netbsd-3-0-2-RELEASE:1.1.1.7 netbsd-3-1-RC4:1.1.1.7 netbsd-3-1-RC3:1.1.1.7 netbsd-3-1-RC2:1.1.1.7 netbsd-3-1-RC1:1.1.1.7 netbsd-4:1.5.0.2 netbsd-4-base:1.5 netbsd-3-0-1-RELEASE:1.1.1.7 netbsd-3-0:1.1.1.7.0.4 netbsd-3-0-RELEASE:1.1.1.7 netbsd-3-0-RC6:1.1.1.7 netbsd-3-0-RC5:1.1.1.7 netbsd-3-0-RC4:1.1.1.7 netbsd-3-0-RC3:1.1.1.7 netbsd-3-0-RC2:1.1.1.7 netbsd-3-0-RC1:1.1.1.7 netbsd-2-0-3-RELEASE:1.1.1.4 netbsd-2-1:1.1.1.4.0.6 netbsd-2-1-RELEASE:1.1.1.4 FILE4_16:1.1.1.8 netbsd-2-1-RC6:1.1.1.4 netbsd-2-1-RC5:1.1.1.4 netbsd-2-1-RC4:1.1.1.4 netbsd-2-1-RC3:1.1.1.4 netbsd-2-1-RC2:1.1.1.4 netbsd-2-1-RC1:1.1.1.4 netbsd-2-0-2-RELEASE:1.1.1.4 netbsd-3:1.1.1.7.0.2 netbsd-3-base:1.1.1.7 FILE4_13:1.1.1.7 FILE413-BEFOREIMPORT:1.1.1.6 netbsd-2-0-1-RELEASE:1.1.1.4 netbsd-2:1.1.1.4.0.4 netbsd-2-base:1.1.1.4 FILE4_12:1.1.1.6 netbsd-2-0-RELEASE:1.1.1.4 netbsd-2-0-RC5:1.1.1.4 netbsd-2-0-RC4:1.1.1.4 netbsd-2-0-RC3:1.1.1.4 netbsd-2-0-RC2:1.1.1.4 netbsd-2-0-RC1:1.1.1.4 FILE4_10:1.1.1.5 FILE4_09:1.1.1.4 netbsd-2-0:1.1.1.4.0.2 netbsd-2-0-base:1.1.1.4 FILE4_08:1.1.1.4 FILE4_06:1.1.1.3 FILE4_04:1.1.1.3 FILE4_03:1.1.1.2 FILE4_00:1.1.1.1 CHRISTOS:1.1.1; locks; strict; comment @# @; 1.9 date 2009.10.17.23.05.34; author snj; state dead; branches; next 1.8; 1.8 date 2008.08.30.12.16.52; author christos; state Exp; branches; next 1.7; 1.7 date 2007.06.07.11.32.46; author pooka; state Exp; branches 1.7.12.1; next 1.6; 1.6 date 2007.03.04.15.22.09; author pooka; state Exp; branches; next 1.5; 1.5 date 2006.10.31.21.47.24; author pooka; state Exp; branches 1.5.2.1 1.5.4.1; next 1.4; 1.4 date 2006.10.31.21.16.23; author pooka; state Exp; branches; next 1.3; 1.3 date 2006.02.13.22.57.55; author pooka; state Exp; branches; next 1.2; 1.2 date 2005.12.07.03.20.45; author grant; state Exp; branches; next 1.1; 1.1 date 2003.03.25.22.30.25; author pooka; state Exp; branches 1.1.1.1; next ; 1.7.12.1 date 2008.09.18.04.44.39; author wrstuden; state Exp; branches; next ; 1.5.2.1 date 2007.06.15.16.14.42; author liamjfoy; state Exp; branches; next ; 1.5.4.1 date 2007.09.03.06.53.22; author wrstuden; state Exp; branches; next ; 1.1.1.1 date 2003.03.25.22.30.25; author pooka; state Exp; branches; next 1.1.1.2; 1.1.1.2 date 2003.05.25.21.28.19; author pooka; state Exp; branches; next 1.1.1.3; 1.1.1.3 date 2003.09.25.17.59.17; author pooka; state Exp; branches; next 1.1.1.4; 1.1.1.4 date 2004.03.23.08.31.47; author pooka; state Exp; branches; next 1.1.1.5; 1.1.1.5 date 2004.09.16.13.43.49; author pooka; state Exp; branches; next 1.1.1.6; 1.1.1.6 date 2004.12.13.10.24.58; author pooka; state Exp; branches; next 1.1.1.7; 1.1.1.7 date 2005.02.21.14.33.24; author pooka; state Exp; branches 1.1.1.7.2.1 1.1.1.7.4.1 1.1.1.7.6.1; next 1.1.1.8; 1.1.1.8 date 2005.10.17.17.48.30; author pooka; state Exp; branches; next 1.1.1.9; 1.1.1.9 date 2006.10.31.20.34.55; author pooka; state Exp; branches; next 1.1.1.10; 1.1.1.10 date 2007.03.04.14.54.55; author pooka; state Exp; branches; next 1.1.1.11; 1.1.1.11 date 2007.06.07.11.24.39; author pooka; state Exp; branches; next 1.1.1.12; 1.1.1.12 date 2008.08.30.11.20.56; author christos; state Exp; branches; next ; 1.1.1.7.2.1 date 2007.06.24.19.41.51; author ghen; state Exp; branches; next ; 1.1.1.7.4.1 date 2007.06.24.19.43.18; author ghen; state Exp; branches; next ; 1.1.1.7.6.1 date 2007.06.24.19.45.13; author ghen; state Exp; branches; next ; desc @@ 1.9 log @This hasn't been used in a while. Long live external/bsd/file! @ text @#------------------------------------------------------------------------------ # archive: file(1) magic for archive formats (see also "msdos" for self- # extracting compressed archives) # # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc. # pre-POSIX "tar" archives are handled in the C code. # POSIX tar archives 257 string ustar\0 POSIX tar archive !:mime application/x-tar # encoding: posix 257 string ustar\040\040\0 GNU tar archive !:mime application/x-tar # encoding: gnu # cpio archives # # Yes, the top two "cpio archive" formats *are* supposed to just be "short". # The idea is to indicate archives produced on machines with the same # byte order as the machine running "file" with "cpio archive", and # to indicate archives produced on machines with the opposite byte order # from the machine running "file" with "byte-swapped cpio archive". # # The SVR4 "cpio(4)" hints that there are additional formats, but they # are defined as "short"s; I think all the new formats are # character-header formats and thus are strings, not numbers. 0 short 070707 cpio archive !:mime application/x-cpio 0 short 0143561 byte-swapped cpio archive !:mime application/x-cpio # encoding: swapped 0 string 070707 ASCII cpio archive (pre-SVR4 or odc) 0 string 070701 ASCII cpio archive (SVR4 with no CRC) 0 string 070702 ASCII cpio archive (SVR4 with CRC) # Debian package (needs to go before regular portable archives) # 0 string =!\ndebian !:mime application/x-debian-package >8 string debian-split part of multipart Debian package >8 string debian-binary Debian binary package >8 string !debian >68 string >\0 (format %s) # These next two lines do not work, because a bzip2 Debian archive # still uses gzip for the control.tar (first in the archive). Only # data.tar varies, and the location of its filename varies too. # file/libmagic does not current have support for ascii-string based # (offsets) as of 2005-09-15. #>81 string bz2 \b, uses bzip2 compression #>84 string gz \b, uses gzip compression #>136 ledate x created: %s # other archives 0 long 0177555 very old archive 0 short 0177555 very old PDP-11 archive 0 long 0177545 old archive 0 short 0177545 old PDP-11 archive 0 long 0100554 apl workspace 0 string = archive !:mime application/x-archive # MIPS archive (needs to go before regular portable archives) # 0 string =!\n__________E MIPS archive >20 string U with MIPS Ucode members >21 string L with MIPSEL members >21 string B with MIPSEB members >19 string L and an EL hash table >19 string B and an EB hash table >22 string X -- out of date 0 search/1 -h- Software Tools format archive text # # XXX - why are there multiple thingies? Note that 0x213c6172 is # "! current ar archive # 0 long 0x213c6172 archive file # # and for SVR1 archives, we have: # # 0 string \ System V Release 1 ar archive # 0 string = archive # # XXX - did Aegis really store shared libraries, breakpointed modules, # and absolute code program modules in the same format as new-style # "ar" archives? # 0 string =! current ar archive !:mime application/x-archive >8 string __.SYMDEF random library >0 belong =65538 - pre SR9.5 >0 belong =65539 - post SR9.5 >0 beshort 2 - object archive >0 beshort 3 - shared library module >0 beshort 4 - debug break-pointed module >0 beshort 5 - absolute code program module 0 string \ System V Release 1 ar archive 0 string = archive # # XXX - from "vax", which appears to collect a bunch of byte-swapped # thingies, to help you recognize VAX files on big-endian machines; # with "leshort", "lelong", and "string", that's no longer necessary.... # 0 belong 0x65ff0000 VAX 3.0 archive 0 belong 0x3c61723e VAX 5.0 archive # 0 long 0x213c6172 archive file 0 lelong 0177555 very old VAX archive 0 leshort 0177555 very old PDP-11 archive # # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus # be a random library (it said 0xff65 rather than 0177545). # 0 lelong 0177545 old VAX archive >8 string __.SYMDEF random library 0 leshort 0177545 old PDP-11 archive >8 string __.SYMDEF random library # # From "pdp" (but why a 4-byte quantity?) # 0 lelong 0x39bed PDP-11 old archive 0 lelong 0x39bee PDP-11 4.0 archive # ARC archiver, from Daniel Quinlan (quinlan@@yggdrasil.com) # # The first byte is the magic (0x1a), byte 2 is the compression type for # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS # filename of the first file (null terminated). Since some types collide # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%), # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo. 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW !:mime application/x-arc 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed !:mime application/x-arc 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed !:mime application/x-arc 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed !:mime application/x-arc 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed !:mime application/x-arc 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched !:mime application/x-arc # [JW] stuff taken from idarc, obviously ARC successors: 0 lelong&0x8080ffff 0x00000a1a PAK archive data !:mime application/x-arc 0 lelong&0x8080ffff 0x0000141a ARC+ archive data !:mime application/x-arc 0 lelong&0x8080ffff 0x0000481a HYP archive data !:mime application/x-arc # Acorn archive formats (Disaster prone simpleton, m91dps@@ecs.ox.ac.uk) # I can't create either SPARK or ArcFS archives so I have not tested this stuff # [GRR: the original entries collide with ARC, above; replaced with combined # version (not tested)] #0 byte 0x1a RISC OS archive (spark format) 0 string \032archive RISC OS archive (ArcFS format) 0 string Archive\000 RISC OS archive (ArcFS format) # All these were taken from idarc, many could not be verified. Unfortunately, # there were many low-quality sigs, i.e. easy to trigger false positives. # Please notify me of any real-world fishy/ambiguous signatures and I'll try # to get my hands on the actual archiver and see if I find something better. [JW] # probably many can be enhanced by finding some 0-byte or control char near the start # idarc calls this Crush/Uncompressed... *shrug* 0 string CRUSH Crush archive data # Squeeze It (.sqz) 0 string HLSQZ Squeeze It archive data # SQWEZ 0 string SQWEZ SQWEZ archive data # HPack (.hpk) 0 string HPAK HPack archive data # HAP 0 string \x91\x33HF HAP archive data # MD/MDCD 0 string MDmd MDCD archive data # LIM 0 string LIM\x1a LIM archive data # SAR 3 string LH5 SAR archive data # BSArc/BS2 0 string \212\3SB \0 BSArc/BS2 archive data # MAR 2 string =-ah MAR archive data # ACB 0 belong&0x00f800ff 0x00800000 ACB archive data # CPZ # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data # JRC 0 string JRchive JRC archive data # Quantum 0 string DS\0 Quantum archive data # ReSOF 0 string PK\3\6 ReSOF archive data # QuArk 0 string 7\4 QuArk archive data # YAC 14 string YC YAC archive data # X1 0 string X1 X1 archive data 0 string XhDr X1 archive data # CDC Codec (.dqt) 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data # AMGC 0 string \xad6" AMGC archive data # NuLIB 0 string NõFélå NuLIB archive data # PakLeo 0 string LEOLZW PAKLeo archive data # ChArc 0 string SChF ChArc archive data # PSA 0 string PSA PSA archive data # CrossePAC 0 string DSIGDCC CrossePAC archive data # Freeze 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data # KBoom 0 string ¨MP¨ KBoom archive data # NSQ, must go after CDC Codec 0 string \x76\xff NSQ archive data # DPA 0 string Dirk\ Paehl DPA archive data # BA # TODO: idarc says "bytes 0-2 == bytes 3-5" # TTComp 0 string \0\6 TTComp archive data # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 0 string ESP ESP archive data # ZPack 0 string \1ZPK\1 ZPack archive data # Sky 0 string \xbc\x40 Sky archive data # UFA 0 string UFA UFA archive data # Dry 0 string =-H2O DRY archive data # FoxSQZ 0 string FOXSQZ FoxSQZ archive data # AR7 0 string ,AR7 AR7 archive data # PPMZ 0 string PPMZ PPMZ archive data # MS Compress 4 string \x88\xf0\x27 MS Compress archive data # updated by Joerg Jenderek >9 string \0 >>0 string KWAJ >>>7 string \321\003 MS Compress archive data >>>>14 ulong >0 \b, original size: %ld bytes >>>>18 ubyte >0x65 >>>>>18 string x \b, was %.8s >>>>>(10.b-4) string x \b.%.3s # MP3 (archiver, not lossy audio compression) 0 string MP3\x1a MP3-Archiver archive data # ZET 0 string OZÝ ZET archive data # TSComp 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data # ARQ 0 string gW\4\1 ARQ archive data # Squash 3 string OctSqu Squash archive data # Terse 0 string \5\1\1\0 Terse archive data # PUCrunch 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data # UHarc 0 string UHA UHarc archive data # ABComp 0 string \2AB ABComp archive data 0 string \3AB2 ABComp archive data # CMP 0 string CO\0 CMP archive data # Splint 0 string \x93\xb9\x06 Splint archive data # InstallShield 0 string \x13\x5d\x65\x8c InstallShield Z archive Data # Gather 1 string GTH Gather archive data # BOA 0 string BOA BOA archive data # RAX 0 string ULEB\xa RAX archive data # Xtreme 0 string ULEB\0 Xtreme archive data # Pack Magic 0 string @@â\1\0 Pack Magic archive data # BTS 0 belong&0xfeffffff 0x1a034465 BTS archive data # ELI 5750 0 string Ora\ ELI 5750 archive data # QFC 0 string \x1aFC\x1a QFC archive data 0 string \x1aQF\x1a QFC archive data # PRO-PACK 0 string RNC PRO-PACK archive data # 777 0 string 777 777 archive data # LZS221 0 string sTaC LZS221 archive data # HPA 0 string HPA HPA archive data # Arhangel 0 string LG Arhangel archive data # EXP1, uses bzip2 0 string 0123456789012345BZh EXP1 archive data # IMP 0 string IMP\xa IMP archive data # NRV 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data # Squish 0 string \x73\xb2\x90\xf4 Squish archive data # Par 0 string PHILIPP Par archive data 0 string PAR Par archive data # HIT 0 string UB HIT archive data # SBX 0 belong&0xfffff000 0x53423000 SBX archive data # NaShrink 0 string NSK NaShrink archive data # SAPCAR 0 string #\ CAR\ archive\ header SAPCAR archive data 0 string CAR\ 2.00RG SAPCAR archive data # Disintegrator 0 string DST Disintegrator archive data # ASD 0 string ASD ASD archive data # InstallShield CAB 0 string ISc( InstallShield CAB # TOP4 0 string T4\x1a TOP4 archive data # BatComp left out: sig looks like COM executable # so TODO: get real 4dos batcomp file and find sig # BlakHole 0 string BH\5\7 BlakHole archive data # BIX 0 string BIX0 BIX archive data # ChiefLZA 0 string ChfLZ ChiefLZA archive data # Blink 0 string Blink Blink archive data # Logitech Compress 0 string \xda\xfa Logitech Compress archive data # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 1 string (C)\ STEPANYUK ARS-Sfx archive data # AKT/AKT32 0 string AKT32 AKT32 archive data 0 string AKT AKT archive data # NPack 0 string MSTSM NPack archive data # PFT 0 string \0\x50\0\x14 PFT archive data # SemOne 0 string SEM SemOne archive data # PPMD 0 string \x8f\xaf\xac\x84 PPMD archive data # FIZ 0 string FIZ FIZ archive data # MSXiE 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data # DeepFreezer 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data # DC 0 string =2 byte x \b, version %i >3 byte x \b.%i # ZZip archiver (.zz) 0 string ZZ\ \0\0 ZZip archive data 0 string ZZ0 ZZip archive data # PAQ archiver (.paq) 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 0 string PAQ PAQ archive data >3 byte&0xf0 0x30 >>3 byte x (v%c) # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 0 string JARCS JAR (ARJ Software, Inc.) archive data # ARJ archiver (jason@@jarthur.Claremont.EDU) 0 leshort 0xea60 ARJ archive data !:mime application/x-arj >5 byte x \b, v%d, >8 byte &0x04 multi-volume, >8 byte &0x10 slash-switched, >8 byte &0x20 backup, >34 string x original name: %s, >7 byte 0 os: MS-DOS >7 byte 1 os: PRIMOS >7 byte 2 os: Unix >7 byte 3 os: Amiga >7 byte 4 os: Macintosh >7 byte 5 os: OS/2 >7 byte 6 os: Apple ][ GS >7 byte 7 os: Atari ST >7 byte 8 os: NeXT >7 byte 9 os: VAX/VMS >3 byte >0 %d] # [JW] idarc says this is also possible 2 leshort 0xea60 ARJ archive data # HA archiver (Greg Roelofs, newt@@uchicago.edu) # This is a really bad format. A file containing HAWAII will match this... #0 string HA HA archive data, #>2 leshort =1 1 file, #>2 leshort >1 %u files, #>4 byte&0x0f =0 first is type CPY #>4 byte&0x0f =1 first is type ASC #>4 byte&0x0f =2 first is type HSC #>4 byte&0x0f =0x0e first is type DIR #>4 byte&0x0f =0x0f first is type SPECIAL # suggestion: at least identify small archives (<1024 files) 0 belong&0xffff00fc 0x48410000 HA archive data >2 leshort =1 1 file, >2 leshort >1 %u files, >4 byte&0x0f =0 first is type CPY >4 byte&0x0f =1 first is type ASC >4 byte&0x0f =2 first is type HSC >4 byte&0x0f =0x0e first is type DIR >4 byte&0x0f =0x0f first is type SPECIAL # HPACK archiver (Peter Gutmann, pgut1@@cs.aukuni.ac.nz) 0 string HPAK HPACK archive data # JAM Archive volume format, by Dmitry.Kohmanyuk@@UA.net 0 string \351,\001JAM\ JAM archive, >7 string >\0 version %.4s >0x26 byte =0x27 - >>0x2b string >\0 label %.11s, >>0x27 lelong x serial %08x, >>0x36 string >\0 fstype %.8s # LHARC/LHA archiver (Greg Roelofs, newt@@uchicago.edu) 2 string -lh0- LHarc 1.x/ARX archive data [lh0] !:mime application/x-lharc 2 string -lh1- LHarc 1.x/ARX archive data [lh1] !:mime application/x-lharc 2 string -lz4- LHarc 1.x archive data [lz4] !:mime application/x-lharc 2 string -lz5- LHarc 1.x archive data [lz5] !:mime application/x-lharc # [never seen any but the last; -lh4- reported in comp.compression:] 2 string -lzs- LHa/LZS archive data [lzs] !:mime application/x-lha 2 string -lh\40- LHa 2.x? archive data [lh ] !:mime application/x-lha 2 string -lhd- LHa 2.x? archive data [lhd] !:mime application/x-lha 2 string -lh2- LHa 2.x? archive data [lh2] !:mime application/x-lha 2 string -lh3- LHa 2.x? archive data [lh3] !:mime application/x-lha 2 string -lh4- LHa (2.x) archive data [lh4] !:mime application/x-lha 2 string -lh5- LHa (2.x) archive data [lh5] !:mime application/x-lha 2 string -lh6- LHa (2.x) archive data [lh6] !:mime application/x-lha 2 string -lh7- LHa (2.x)/LHark archive data [lh7] !:mime application/x-lha >20 byte x - header level %d # taken from idarc [JW] 2 string -lZ PUT archive data 2 string -lz LZS archive data 2 string -sw1- Swag archive data # RAR archiver (Greg Roelofs, newt@@uchicago.edu) 0 string Rar! RAR archive data, !:mime application/x-rar >44 byte x v%0x, >10 byte >0 flags: >>10 byte &0x01 Archive volume, >>10 byte &0x02 Commented, >>10 byte &0x04 Locked, >>10 byte &0x08 Solid, >>10 byte &0x20 Authenticated, >35 byte 0 os: MS-DOS >35 byte 1 os: OS/2 >35 byte 2 os: Win32 >35 byte 3 os: Unix # some old version? idarc says: 0 string RE\x7e\x5e RAR archive data # SQUISH archiver (Greg Roelofs, newt@@uchicago.edu) 0 string SQSH squished archive data (Acorn RISCOS) # UC2 archiver (Greg Roelofs, newt@@uchicago.edu) # [JW] see exe section for self-extracting version 0 string UC2\x1a UC2 archive data # ZIP archives (Greg Roelofs, c/o zip-bugs@@wkuvx1.wku.edu) 0 string PK\003\004 >4 byte 0x00 Zip archive data !:mime application/zip >4 byte 0x09 Zip archive data, at least v0.9 to extract !:mime application/zip >4 byte 0x0a Zip archive data, at least v1.0 to extract !:mime application/zip >4 byte 0x0b Zip archive data, at least v1.1 to extract !:mime application/zip >0x161 string WINZIP Zip archive data, WinZIP self-extracting !:mime application/zip >4 byte 0x14 >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract >0x161 string WINZIP Zip archive data, WinZIP self-extracting !:mime application/zip # OpenOffice.org / KOffice / StarOffice documents # Listed here because they ARE zip files # # From: Abel Cheung >4 byte 0x14 >>30 string mimetype # KOffice (1.2 or above) formats >>>50 string vnd.kde. KOffice (>=1.2) >>>>58 string karbon Karbon document >>>>58 string kchart KChart document >>>>58 string kformula KFormula document >>>>58 string kivio Kivio document >>>>58 string kontour Kontour document >>>>58 string kpresenter KPresenter document >>>>58 string kspread KSpread document >>>>58 string kword KWord document # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) >>>50 string vnd.sun.xml. OpenOffice.org 1.x >>>>62 string writer Writer >>>>>68 byte !0x2e document >>>>>68 string .template template >>>>>68 string .global global document >>>>62 string calc Calc >>>>>66 byte !0x2e spreadsheet >>>>>66 string .template template >>>>62 string draw Draw >>>>>66 byte !0x2e document >>>>>66 string .template template >>>>62 string impress Impress >>>>>69 byte !0x2e presentation >>>>>69 string .template template >>>>62 string math Math document >>>>62 string base Database file # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) # http://lists.oasis-open.org/archives/office/200505/msg00006.html >>>50 string vnd.oasis.opendocument. OpenDocument >>>>73 string text >>>>>77 byte !0x2d Text !:mime application/vnd.oasis.opendocument.text >>>>>77 string -template Text Template >>>>>77 string -web HTML Document Template >>>>>77 string -master Master Document >>>>73 string graphics Drawing >>>>>81 string -template Template >>>>73 string presentation Presentation >>>>>85 string -template Template >>>>73 string spreadsheet Spreadsheet >>>>>84 string -template Template >>>>73 string chart Chart >>>>>78 string -template Template >>>>73 string formula Formula >>>>>80 string -template Template >>>>73 string database Database >>>>73 string image Image # Zoo archiver 20 lelong 0xfdc4a7dc Zoo archive data !:mime application/x-zoo >4 byte >48 \b, v%c. >>6 byte >47 \b%c >>>7 byte >47 \b%c >32 byte >0 \b, modify: v%d >>33 byte x \b.%d+ >42 lelong 0xfdc4a7dc \b, >>70 byte >0 extract: v%d >>>71 byte x \b.%d+ # Shell archives 10 string #\ This\ is\ a\ shell\ archive shell archive text !:mime application/octet-stream # # LBR. NB: May conflict with the questionable # "binary Computer Graphics Metafile" format. # 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data # # PMA (CP/M derivative of LHA) # 2 string -pm0- PMarc archive data [pm0] 2 string -pm1- PMarc archive data [pm1] 2 string -pm2- PMarc archive data [pm2] 2 string -pms- PMarc SFX archive (CP/M, DOS) 5 string -pc1- PopCom compressed executable (CP/M) # From Rafael Laboissiere # The Project Revision Control System (see # http://prcs.sourceforge.net) generates a packaged project # file which is recognized by the following entry: 0 leshort 0xeb81 PRCS packaged project # Microsoft cabinets # by David Necas (Yeti) #0 string MSCF\0\0\0\0 Microsoft cabinet file data, #>25 byte x v%d #>24 byte x \b.%d # MPi: All CABs have version 1.3, so this is pointless. # Better magic in debian-additions. # GTKtalog catalogs # by David Necas (Yeti) 4 string gtktalog\ GTKtalog catalog data, >13 string 3 version 3 >>14 beshort 0x677a (gzipped) >>14 beshort !0x677a (not gzipped) >13 string >3 version %s ############################################################################ # Parity archive reconstruction file, the 'par' file format now used on Usenet. 0 string PAR\0 PARity archive data >48 leshort =0 - Index file >48 leshort >0 - file number %d # Felix von Leitner 0 string d8:announce BitTorrent file !:mime application/x-bittorrent # Atari MSA archive - Teemu Hukkanen 0 beshort 0x0e0f Atari MSA archive data >2 beshort x \b, %d sectors per track >4 beshort 0 \b, 1 sided >4 beshort 1 \b, 2 sided >6 beshort x \b, starting track: %d >8 beshort x \b, ending track: %d # Alternate ZIP string (amc@@arwen.cs.berkeley.edu) 0 string PK00PK\003\004 Zip archive data # ACE archive (from http://www.wotsit.org/download.asp?f=ace) # by Stefan `Sec` Zehl 7 string **ACE** ACE archive data >15 byte >0 version %d >16 byte =0x00 \b, from MS-DOS >16 byte =0x01 \b, from OS/2 >16 byte =0x02 \b, from Win/32 >16 byte =0x03 \b, from Unix >16 byte =0x04 \b, from MacOS >16 byte =0x05 \b, from WinNT >16 byte =0x06 \b, from Primos >16 byte =0x07 \b, from AppleGS >16 byte =0x08 \b, from Atari >16 byte =0x09 \b, from Vax/VMS >16 byte =0x0A \b, from Amiga >16 byte =0x0B \b, from Next >14 byte x \b, version %d to extract >5 leshort &0x0080 \b, multiple volumes, >>17 byte x \b (part %d), >5 leshort &0x0002 \b, contains comment >5 leshort &0x0200 \b, sfx >5 leshort &0x0400 \b, small dictionary >5 leshort &0x0800 \b, multi-volume >5 leshort &0x1000 \b, contains AV-String >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) >5 leshort &0x2000 \b, with recovery record >5 leshort &0x4000 \b, locked >5 leshort &0x8000 \b, solid # Date in MS-DOS format (whatever that is) #>18 lelong x Created on # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann # 0x1A string sfArk sfArk compressed Soundfont >0x15 string 2 >>0x1 string >\0 Version %s >>0x2A string >\0 : %s # DR-DOS 7.03 Packed File *.??_ 0 string Packed\ File\ Personal NetWare Packed File >12 string x \b, was "%.12s" # EET archive # From: Tilman Sauerbeck 0 belong 0x1ee7ff00 EET archive !:mime application/x-eet # rzip archives 0 string RZIP rzip compressed data >4 byte x - version %d >5 byte x \b.%d >6 belong x (%d bytes) # From: "Robert Dale" 0 belong 123 dar archive, >4 belong x label "%.8x >>8 belong x %.8x >>>12 beshort x %.4x" >14 byte 0x54 end slice >14 beshort 0x4e4e multi-part >14 beshort 0x4e53 multi-part, with -S # Symbian installation files # http://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file !:mime application/vnd.symbian.install >4 lelong 0x1000006D (EPOC release 3/4/5) >4 lelong 0x10003A12 (EPOC release 6) 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) !:mime x-epoc/x-sisx-app # From "Nelson A. de Oliveira" 0 string MPQ\032 MoPaQ (MPQ) archive # From: Dirk Jagdmann # xar archive format: http://code.google.com/p/xar/ 0 string xar! xar archive >6 beshort x - version %ld # From: "Nelson A. de Oliveira" # .kgb 0 string KGB_arch KGB Archiver file >10 string x with compression level %.1s # xar (eXtensible ARchiver) archive # From: "David Remahl" 0 string xar! xar archive #>4 beshort x header size %d >6 beshort x version %d, #>8 quad x compressed TOC: %d, #>16 quad x uncompressed TOC: %d, >24 belong 0 no checksum >24 belong 1 SHA-1 checksum >24 belong 2 MD5 checksum @ 1.8 log @resolve conflicts, fix build. @ text @@ 1.7 log @crunch cornflakes @ text @a0 1 d10 1 d12 1 d26 1 d28 1 d36 1 d39 1 d57 1 d69 1 a69 1 0 string -h- Software Tools format archive text d88 1 d131 1 d133 1 d135 1 d137 1 d139 1 d141 1 d144 1 d146 1 d148 1 d454 1 d507 1 d509 1 d511 1 d513 1 d516 1 d518 1 d520 1 d522 1 d524 1 d526 1 d528 1 d530 1 d532 1 d541 1 d565 2 d568 1 d570 1 d572 3 d578 1 d581 2 d584 1 a584 1 # Listed here because they are basically zip files d614 1 d621 1 d640 1 d652 1 d698 1 d756 1 d777 1 d781 26 @ 1.7.12.1 log @Sync with wrstuden-revivesa-base-2. @ text @d1 1 a10 1 !:mime application/x-tar # encoding: posix a11 1 !:mime application/x-tar # encoding: gnu a24 1 !:mime application/x-cpio a25 1 !:mime application/x-cpio # encoding: swapped a32 1 !:mime application/x-debian-package a34 1 >8 string !debian a51 1 !:mime application/x-archive d63 1 a63 1 0 search/1 -h- Software Tools format archive text a81 1 !:mime application/x-archive a123 1 !:mime application/x-arc a124 1 !:mime application/x-arc a125 1 !:mime application/x-arc a126 1 !:mime application/x-arc a127 1 !:mime application/x-arc a128 1 !:mime application/x-arc a130 1 !:mime application/x-arc a131 1 !:mime application/x-arc a132 1 !:mime application/x-arc a437 1 !:mime application/x-arj a489 1 !:mime application/x-lharc a490 1 !:mime application/x-lharc a491 1 !:mime application/x-lharc a492 1 !:mime application/x-lharc a494 1 !:mime application/x-lha a495 1 !:mime application/x-lha a496 1 !:mime application/x-lha a497 1 !:mime application/x-lha a498 1 !:mime application/x-lha a499 1 !:mime application/x-lha a500 1 !:mime application/x-lha a501 1 !:mime application/x-lha a502 1 !:mime application/x-lha a510 1 !:mime application/x-rar a533 2 >4 byte 0x00 Zip archive data !:mime application/zip a534 1 !:mime application/zip a535 1 !:mime application/zip a536 3 !:mime application/zip >0x161 string WINZIP Zip archive data, WinZIP self-extracting !:mime application/zip a539 1 !:mime application/zip a541 2 # Listed here because they ARE zip files # d543 1 a543 1 >4 byte 0x14 a572 1 >>>>62 string base Database file a578 1 !:mime application/vnd.oasis.opendocument.text a596 1 !:mime application/x-zoo a607 1 !:mime application/octet-stream a652 1 !:mime application/x-bittorrent a709 1 !:mime application/x-eet a729 1 !:mime application/vnd.symbian.install a732 26 !:mime x-epoc/x-sisx-app # From "Nelson A. de Oliveira" 0 string MPQ\032 MoPaQ (MPQ) archive # From: Dirk Jagdmann # xar archive format: http://code.google.com/p/xar/ 0 string xar! xar archive >6 beshort x - version %ld # From: "Nelson A. de Oliveira" # .kgb 0 string KGB_arch KGB Archiver file >10 string x with compression level %.1s # xar (eXtensible ARchiver) archive # From: "David Remahl" 0 string xar! xar archive #>4 beshort x header size %d >6 beshort x version %d, #>8 quad x compressed TOC: %d, #>16 quad x uncompressed TOC: %d, >24 belong 0 no checksum >24 belong 1 SHA-1 checksum >24 belong 2 MD5 checksum @ 1.6 log @apply conflict therapy for 4.20 import @ text @d725 8 @ 1.5 log @readd winzip @ text @d481 1 a481 1 0 string \351,\001JAM\ JAM archive, @ 1.5.4.1 log @Sync w/ NetBSD-4-RC_1 @ text @d481 1 a481 1 0 string \351,\001JAM\ JAM archive, a724 8 # Symbian installation files # http://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file >4 lelong 0x1000006D (EPOC release 3/4/5) >4 lelong 0x10003A12 (EPOC release 6) 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) @ 1.5.2.1 log @Pull up following (requested by pooka in ticket #724): bring file(1) to 4.21 @ text @d481 1 a481 1 0 string \351,\001JAM\ JAM archive, a724 8 # Symbian installation files # http://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file >4 lelong 0x1000006D (EPOC release 3/4/5) >4 lelong 0x10003A12 (EPOC release 6) 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) @ 1.4 log @welcome to file 4.18. have a nice day. @ text @d539 1 @ 1.3 log @some new signatures provided by Sergey Svishchev in private email @ text @d229 8 d533 60 a592 6 0 string PK\003\004 Zip archive data >4 byte 0x09 \b, at least v0.9 to extract >4 byte 0x0a \b, at least v1.0 to extract >4 byte 0x0b \b, at least v1.1 to extract >4 byte 0x14 \b, at least v2.0 to extract >0x161 string WINZIP \b, WinZIP self-extracting d688 1 a688 1 >>30 string\x16*UNREGISTERED\x20VERSION* (unregistered) d715 9 @ 1.2 log @add magic for rzip archives. @ text @d504 6 d530 1 @ 1.1 log @Initial revision @ text @d32 1 a32 1 0 string !\ndebian d35 9 a43 2 >68 string >\n (format %s) >136 ledate x created: %s d55 1 a55 1 0 string !\n__________E MIPS archive d69 1 a69 1 # 0 string ! current ar archive d81 1 a81 1 0 string ! current ar archive d129 4 d138 1 a138 2 #0 byte 0x1a RISC OS archive #>1 string archive (ArcFS format) d140 287 d446 2 d459 9 d481 2 a482 2 2 string -lh0- LHarc 1.x archive data [lh0] 2 string -lh1- LHarc 1.x archive data [lh1] d486 1 a486 1 2 string -lzs- LHa 2.x? archive data [lzs] d494 1 a494 1 2 string -lh7- LHa (2.x) archive data [lh7] d496 4 d502 8 a509 1 0 string Rar! RAR archive data d515 1 a515 1 # I can't figure out the self-extracting form of these buggers... d561 5 a565 3 0 string MSCF\0\0\0\0 Microsoft cabinet file data, >25 byte x v%d >24 byte x \b.%d d580 66 @ 1.1.1.1 log @file 4.00 @ text @@ 1.1.1.2 log @file 4.03 small changes & fixes @ text @d35 1 a35 3 >68 string >\0 (format %s) >81 string bz2 \b, uses bzip2 compression >84 string gz \b, uses gzip compression a258 17 # Felix von Leitner 0 string d8:announce BitTorrent file # ACE archive (Nikolay Petrov, nik@@techlab.office1.bg) 7 string **ACE** Winace archive data # Atari MSA archive - Teemu Hukkanen 0 beshort 0x0e0f Atari MSA archive data >2 beshort x \b, %d sectors per track >4 beshort 0 \b, 1 sided >4 beshort 1 \b, 2 sided >6 beshort x \b, starting track: %d >8 beshort x \b, ending track: %d # Alternate ZIP string (amc@@arwen.cs.berkeley.edu) 0 string PK00PK\003\004 Zip archive data @ 1.1.1.3 log @file 4.04 fixes, patches and more magic @ text @d265 3 d270 5 a274 5 >2 beshort x \b, %d sectors per track >4 beshort 0 \b, 1 sided >4 beshort 1 \b, 2 sided >6 beshort x \b, starting track: %d >8 beshort x \b, ending track: %d d277 1 a277 32 0 string PK00PK\003\004 Zip archive data # ACE archive (from http://www.wotsit.org/download.asp?f=ace) # by Stefan `Sec` Zehl 7 string **ACE** ACE compressed archive >15 byte >0 version %d >16 byte =0x00 \b, from MS-DOS >16 byte =0x01 \b, from OS/2 >16 byte =0x02 \b, from Win/32 >16 byte =0x03 \b, from Unix >16 byte =0x04 \b, from MacOS >16 byte =0x05 \b, from WinNT >16 byte =0x06 \b, from Primos >16 byte =0x07 \b, from AppleGS >16 byte =0x08 \b, from Atari >16 byte =0x09 \b, from Vax/VMS >16 byte =0x0A \b, from Amiga >16 byte =0x0B \b, from Next >14 byte x \b, version %d to extract >5 leshort &0x0080 \b, multiple volumes, >>17 byte x \b (part %d), >5 leshort &0x0002 \b, contains comment >5 leshort &0x0200 \b, sfx >5 leshort &0x0400 \b, small dictionary >5 leshort &0x0800 \b, multi-volume >5 leshort &0x1000 \b, contains AV-String >>30 string\x16*UNREGISTERED\x20VERSION* (unregistered) >5 leshort &0x2000 \b, with recovery record >5 leshort &0x4000 \b, locked >5 leshort &0x8000 \b, solid # Date in MS-DOS format (whatever that is) #>18 lelong x Created on @ 1.1.1.4 log @file 4.08: bugfixes 'n more magic 'n stuff @ text @d38 1 a38 1 #>136 ledate x created: %s d244 3 a246 5 #0 string MSCF\0\0\0\0 Microsoft cabinet file data, #>25 byte x v%d #>24 byte x \b.%d # MPi: All CABs have version 1.3, so this is pointless. # Better magic in debian-additions. @ 1.1.1.5 log @file 4.10 minor fixes and improvements @ text @d192 1 a192 6 0 string Rar! RAR archive data, >44 byte x v%0x, >35 byte 0 os: MS-DOS >35 byte 1 os: OS/2 >35 byte 2 os: Win32 >35 byte 3 os: Unix a307 8 # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann # 0x1A string sfArk sfArk compressed Soundfont >0x15 string 2 >>0x1 string >\0 Version %s >>0x2A string >\0 : %s @ 1.1.1.6 log @file 4.12 + assorted bug fixes + switch to 2-clause license @ text @d131 1 a131 3 #0 string \032archive RISC OS archive (ArcFS format) 0 string \032 RISC OS archive (spark format) 0 string Archive\000 RISC OS archive (ArcFS format) @ 1.1.1.7 log @file 4.13 Just the usual bugfixes and magic additions, nothing major. @ text @a322 3 # DR-DOS 7.03 Packed File *.??_ 0 string Packed\ File\ Personal NetWare Packed File >12 string x \b, was "%.12s" @ 1.1.1.7.6.1 log @Pull up following revision(s) (requested by pooka in ticket #1804): dist/file/: synced with HEAD on 20070615 distrib/sets/lists/base/shl.elf: revision 1.222 distrib/sets/lists/base/shl.mi: revision 1.375 via patch lib/Makefile: revision 1.108 via patch lib/libmagic/Makefile: revision 1.5 lib/libmagic/config.h: patch lib/libmagic/shlib_version: revision 1.3-1.4 tools/file/Makefile: revision 1.4 usr.bin/file/Makefile: revision 1.51-1.53 Update file(1) to version 4.21, including security fixes (CVE-2007-1536 and CVE-2007-2799). @ text @d32 1 a32 1 0 string =!\ndebian d36 2 a37 7 # These next two lines do not work, because a bzip2 Debian archive # still uses gzip for the control.tar (first in the archive). Only # data.tar varies, and the location of its filename varies too. # file/libmagic does not current have support for ascii-string based # (offsets) as of 2005-09-15. #>81 string bz2 \b, uses bzip2 compression #>84 string gz \b, uses gzip compression d50 1 a50 1 0 string =!\n__________E MIPS archive d64 1 a64 1 # 0 string =! current ar archive d76 1 a76 1 0 string =! current ar archive a123 4 # [JW] stuff taken from idarc, obviously ARC successors: 0 lelong&0x8080ffff 0x00000a1a PAK archive data 0 lelong&0x8080ffff 0x0000141a ARC+ archive data 0 lelong&0x8080ffff 0x0000481a HYP archive data d129 4 a132 2 #0 byte 0x1a RISC OS archive (spark format) 0 string \032archive RISC OS archive (ArcFS format) a134 294 # All these were taken from idarc, many could not be verified. Unfortunately, # there were many low-quality sigs, i.e. easy to trigger false positives. # Please notify me of any real-world fishy/ambiguous signatures and I'll try # to get my hands on the actual archiver and see if I find something better. [JW] # probably many can be enhanced by finding some 0-byte or control char near the start # idarc calls this Crush/Uncompressed... *shrug* 0 string CRUSH Crush archive data # Squeeze It (.sqz) 0 string HLSQZ Squeeze It archive data # SQWEZ 0 string SQWEZ SQWEZ archive data # HPack (.hpk) 0 string HPAK HPack archive data # HAP 0 string \x91\x33HF HAP archive data # MD/MDCD 0 string MDmd MDCD archive data # LIM 0 string LIM\x1a LIM archive data # SAR 3 string LH5 SAR archive data # BSArc/BS2 0 string \212\3SB \0 BSArc/BS2 archive data # MAR 2 string =-ah MAR archive data # ACB 0 belong&0x00f800ff 0x00800000 ACB archive data # CPZ # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data # JRC 0 string JRchive JRC archive data # Quantum 0 string DS\0 Quantum archive data # ReSOF 0 string PK\3\6 ReSOF archive data # QuArk 0 string 7\4 QuArk archive data # YAC 14 string YC YAC archive data # X1 0 string X1 X1 archive data 0 string XhDr X1 archive data # CDC Codec (.dqt) 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data # AMGC 0 string \xad6" AMGC archive data # NuLIB 0 string NõFélå NuLIB archive data # PakLeo 0 string LEOLZW PAKLeo archive data # ChArc 0 string SChF ChArc archive data # PSA 0 string PSA PSA archive data # CrossePAC 0 string DSIGDCC CrossePAC archive data # Freeze 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data # KBoom 0 string ¨MP¨ KBoom archive data # NSQ, must go after CDC Codec 0 string \x76\xff NSQ archive data # DPA 0 string Dirk\ Paehl DPA archive data # BA # TODO: idarc says "bytes 0-2 == bytes 3-5" # TTComp 0 string \0\6 TTComp archive data # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 0 string ESP ESP archive data # ZPack 0 string \1ZPK\1 ZPack archive data # Sky 0 string \xbc\x40 Sky archive data # UFA 0 string UFA UFA archive data # Dry 0 string =-H2O DRY archive data # FoxSQZ 0 string FOXSQZ FoxSQZ archive data # AR7 0 string ,AR7 AR7 archive data # PPMZ 0 string PPMZ PPMZ archive data # MS Compress 4 string \x88\xf0\x27 MS Compress archive data # updated by Joerg Jenderek >9 string \0 >>0 string KWAJ >>>7 string \321\003 MS Compress archive data >>>>14 ulong >0 \b, original size: %ld bytes >>>>18 ubyte >0x65 >>>>>18 string x \b, was %.8s >>>>>(10.b-4) string x \b.%.3s # MP3 (archiver, not lossy audio compression) 0 string MP3\x1a MP3-Archiver archive data # ZET 0 string OZÝ ZET archive data # TSComp 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data # ARQ 0 string gW\4\1 ARQ archive data # Squash 3 string OctSqu Squash archive data # Terse 0 string \5\1\1\0 Terse archive data # PUCrunch 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data # UHarc 0 string UHA UHarc archive data # ABComp 0 string \2AB ABComp archive data 0 string \3AB2 ABComp archive data # CMP 0 string CO\0 CMP archive data # Splint 0 string \x93\xb9\x06 Splint archive data # InstallShield 0 string \x13\x5d\x65\x8c InstallShield Z archive Data # Gather 1 string GTH Gather archive data # BOA 0 string BOA BOA archive data # RAX 0 string ULEB\xa RAX archive data # Xtreme 0 string ULEB\0 Xtreme archive data # Pack Magic 0 string @@â\1\0 Pack Magic archive data # BTS 0 belong&0xfeffffff 0x1a034465 BTS archive data # ELI 5750 0 string Ora\ ELI 5750 archive data # QFC 0 string \x1aFC\x1a QFC archive data 0 string \x1aQF\x1a QFC archive data # PRO-PACK 0 string RNC PRO-PACK archive data # 777 0 string 777 777 archive data # LZS221 0 string sTaC LZS221 archive data # HPA 0 string HPA HPA archive data # Arhangel 0 string LG Arhangel archive data # EXP1, uses bzip2 0 string 0123456789012345BZh EXP1 archive data # IMP 0 string IMP\xa IMP archive data # NRV 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data # Squish 0 string \x73\xb2\x90\xf4 Squish archive data # Par 0 string PHILIPP Par archive data 0 string PAR Par archive data # HIT 0 string UB HIT archive data # SBX 0 belong&0xfffff000 0x53423000 SBX archive data # NaShrink 0 string NSK NaShrink archive data # SAPCAR 0 string #\ CAR\ archive\ header SAPCAR archive data 0 string CAR\ 2.00RG SAPCAR archive data # Disintegrator 0 string DST Disintegrator archive data # ASD 0 string ASD ASD archive data # InstallShield CAB 0 string ISc( InstallShield CAB # TOP4 0 string T4\x1a TOP4 archive data # BatComp left out: sig looks like COM executable # so TODO: get real 4dos batcomp file and find sig # BlakHole 0 string BH\5\7 BlakHole archive data # BIX 0 string BIX0 BIX archive data # ChiefLZA 0 string ChfLZ ChiefLZA archive data # Blink 0 string Blink Blink archive data # Logitech Compress 0 string \xda\xfa Logitech Compress archive data # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 1 string (C)\ STEPANYUK ARS-Sfx archive data # AKT/AKT32 0 string AKT32 AKT32 archive data 0 string AKT AKT archive data # NPack 0 string MSTSM NPack archive data # PFT 0 string \0\x50\0\x14 PFT archive data # SemOne 0 string SEM SemOne archive data # PPMD 0 string \x8f\xaf\xac\x84 PPMD archive data # FIZ 0 string FIZ FIZ archive data # MSXiE 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data # DeepFreezer 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data # DC 0 string =2 byte x \b, version %i >3 byte x \b.%i # ZZip archiver (.zz) 0 string ZZ\ \0\0 ZZip archive data 0 string ZZ0 ZZip archive data # PAQ archiver (.paq) 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 0 string PAQ PAQ archive data >3 byte&0xf0 0x30 >>3 byte x (v%c) # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 0 string JARCS JAR (ARJ Software, Inc.) archive data a152 2 # [JW] idarc says this is also possible 2 leshort 0xea60 ARJ archive data a163 9 # suggestion: at least identify small archives (<1024 files) 0 belong&0xffff00fc 0x48410000 HA archive data >2 leshort =1 1 file, >2 leshort >1 %u files, >4 byte&0x0f =0 first is type CPY >4 byte&0x0f =1 first is type ASC >4 byte&0x0f =2 first is type HSC >4 byte&0x0f =0x0e first is type DIR >4 byte&0x0f =0x0f first is type SPECIAL d169 1 a169 1 0 string \351,\001JAM\ JAM archive, d177 2 a178 2 2 string -lh0- LHarc 1.x/ARX archive data [lh0] 2 string -lh1- LHarc 1.x/ARX archive data [lh1] d182 1 a182 1 2 string -lzs- LHa/LZS archive data [lzs] d190 1 a190 1 2 string -lh7- LHa (2.x)/LHark archive data [lh7] a191 4 # taken from idarc [JW] 2 string -lZ PUT archive data 2 string -lz LZS archive data 2 string -sw1- Swag archive data a195 6 >10 byte >0 flags: >>10 byte &0x01 Archive volume, >>10 byte &0x02 Commented, >>10 byte &0x04 Locked, >>10 byte &0x08 Solid, >>10 byte &0x20 Authenticated, a199 2 # some old version? idarc says: 0 string RE\x7e\x5e RAR archive data d205 1 a205 1 # [JW] see exe section for self-extracting version d209 5 a213 61 0 string PK\003\004 >4 byte 0x09 Zip archive data, at least v0.9 to extract >4 byte 0x0a Zip archive data, at least v1.0 to extract >4 byte 0x0b Zip archive data, at least v1.1 to extract >4 byte 0x14 >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract >0x161 string WINZIP Zip archive data, WinZIP self-extracting # OpenOffice.org / KOffice / StarOffice documents # From: Abel Cheung # Listed here because they are basically zip files >>30 string mimetype # KOffice (1.2 or above) formats >>>50 string vnd.kde. KOffice (>=1.2) >>>>58 string karbon Karbon document >>>>58 string kchart KChart document >>>>58 string kformula KFormula document >>>>58 string kivio Kivio document >>>>58 string kontour Kontour document >>>>58 string kpresenter KPresenter document >>>>58 string kspread KSpread document >>>>58 string kword KWord document # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) >>>50 string vnd.sun.xml. OpenOffice.org 1.x >>>>62 string writer Writer >>>>>68 byte !0x2e document >>>>>68 string .template template >>>>>68 string .global global document >>>>62 string calc Calc >>>>>66 byte !0x2e spreadsheet >>>>>66 string .template template >>>>62 string draw Draw >>>>>66 byte !0x2e document >>>>>66 string .template template >>>>62 string impress Impress >>>>>69 byte !0x2e presentation >>>>>69 string .template template >>>>62 string math Math document # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) # http://lists.oasis-open.org/archives/office/200505/msg00006.html >>>50 string vnd.oasis.opendocument. OpenDocument >>>>73 string text >>>>>77 byte !0x2d Text >>>>>77 string -template Text Template >>>>>77 string -web HTML Document Template >>>>>77 string -master Master Document >>>>73 string graphics Drawing >>>>>81 string -template Template >>>>73 string presentation Presentation >>>>>85 string -template Template >>>>73 string spreadsheet Spreadsheet >>>>>84 string -template Template >>>>73 string chart Chart >>>>>78 string -template Template >>>>73 string formula Formula >>>>>80 string -template Template >>>>73 string database Database >>>>73 string image Image d287 1 a287 1 7 string **ACE** ACE archive data d309 1 a309 1 >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) d324 2 a325 29 0 string Packed\ File\ Personal NetWare Packed File >12 string x \b, was "%.12s" # EET archive # From: Tilman Sauerbeck 0 belong 0x1ee7ff00 EET archive # rzip archives 0 string RZIP rzip compressed data >4 byte x - version %d >5 byte x \b.%d >6 belong x (%d bytes) # From: "Robert Dale" 0 belong 123 dar archive, >4 belong x label "%.8x >>8 belong x %.8x >>>12 beshort x %.4x" >14 byte 0x54 end slice >14 beshort 0x4e4e multi-part >14 beshort 0x4e53 multi-part, with -S # Symbian installation files # http://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file >4 lelong 0x1000006D (EPOC release 3/4/5) >4 lelong 0x10003A12 (EPOC release 6) 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) @ 1.1.1.7.4.1 log @Pull up following revision(s) (requested by pooka in ticket #1804): dist/file/: synced with HEAD on 20070615 distrib/sets/lists/base/shl.elf: revision 1.222 distrib/sets/lists/base/shl.mi: revision 1.375 via patch lib/Makefile: revision 1.108 via patch lib/libmagic/Makefile: revision 1.5 lib/libmagic/config.h: patch lib/libmagic/shlib_version: revision 1.3-1.4 tools/file/Makefile: revision 1.4 usr.bin/file/Makefile: revision 1.51-1.53 Update file(1) to version 4.21, including security fixes (CVE-2007-1536 and CVE-2007-2799). @ text @d32 1 a32 1 0 string =!\ndebian d36 2 a37 7 # These next two lines do not work, because a bzip2 Debian archive # still uses gzip for the control.tar (first in the archive). Only # data.tar varies, and the location of its filename varies too. # file/libmagic does not current have support for ascii-string based # (offsets) as of 2005-09-15. #>81 string bz2 \b, uses bzip2 compression #>84 string gz \b, uses gzip compression d50 1 a50 1 0 string =!\n__________E MIPS archive d64 1 a64 1 # 0 string =! current ar archive d76 1 a76 1 0 string =! current ar archive a123 4 # [JW] stuff taken from idarc, obviously ARC successors: 0 lelong&0x8080ffff 0x00000a1a PAK archive data 0 lelong&0x8080ffff 0x0000141a ARC+ archive data 0 lelong&0x8080ffff 0x0000481a HYP archive data d129 4 a132 2 #0 byte 0x1a RISC OS archive (spark format) 0 string \032archive RISC OS archive (ArcFS format) a134 294 # All these were taken from idarc, many could not be verified. Unfortunately, # there were many low-quality sigs, i.e. easy to trigger false positives. # Please notify me of any real-world fishy/ambiguous signatures and I'll try # to get my hands on the actual archiver and see if I find something better. [JW] # probably many can be enhanced by finding some 0-byte or control char near the start # idarc calls this Crush/Uncompressed... *shrug* 0 string CRUSH Crush archive data # Squeeze It (.sqz) 0 string HLSQZ Squeeze It archive data # SQWEZ 0 string SQWEZ SQWEZ archive data # HPack (.hpk) 0 string HPAK HPack archive data # HAP 0 string \x91\x33HF HAP archive data # MD/MDCD 0 string MDmd MDCD archive data # LIM 0 string LIM\x1a LIM archive data # SAR 3 string LH5 SAR archive data # BSArc/BS2 0 string \212\3SB \0 BSArc/BS2 archive data # MAR 2 string =-ah MAR archive data # ACB 0 belong&0x00f800ff 0x00800000 ACB archive data # CPZ # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data # JRC 0 string JRchive JRC archive data # Quantum 0 string DS\0 Quantum archive data # ReSOF 0 string PK\3\6 ReSOF archive data # QuArk 0 string 7\4 QuArk archive data # YAC 14 string YC YAC archive data # X1 0 string X1 X1 archive data 0 string XhDr X1 archive data # CDC Codec (.dqt) 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data # AMGC 0 string \xad6" AMGC archive data # NuLIB 0 string NõFélå NuLIB archive data # PakLeo 0 string LEOLZW PAKLeo archive data # ChArc 0 string SChF ChArc archive data # PSA 0 string PSA PSA archive data # CrossePAC 0 string DSIGDCC CrossePAC archive data # Freeze 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data # KBoom 0 string ¨MP¨ KBoom archive data # NSQ, must go after CDC Codec 0 string \x76\xff NSQ archive data # DPA 0 string Dirk\ Paehl DPA archive data # BA # TODO: idarc says "bytes 0-2 == bytes 3-5" # TTComp 0 string \0\6 TTComp archive data # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 0 string ESP ESP archive data # ZPack 0 string \1ZPK\1 ZPack archive data # Sky 0 string \xbc\x40 Sky archive data # UFA 0 string UFA UFA archive data # Dry 0 string =-H2O DRY archive data # FoxSQZ 0 string FOXSQZ FoxSQZ archive data # AR7 0 string ,AR7 AR7 archive data # PPMZ 0 string PPMZ PPMZ archive data # MS Compress 4 string \x88\xf0\x27 MS Compress archive data # updated by Joerg Jenderek >9 string \0 >>0 string KWAJ >>>7 string \321\003 MS Compress archive data >>>>14 ulong >0 \b, original size: %ld bytes >>>>18 ubyte >0x65 >>>>>18 string x \b, was %.8s >>>>>(10.b-4) string x \b.%.3s # MP3 (archiver, not lossy audio compression) 0 string MP3\x1a MP3-Archiver archive data # ZET 0 string OZÝ ZET archive data # TSComp 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data # ARQ 0 string gW\4\1 ARQ archive data # Squash 3 string OctSqu Squash archive data # Terse 0 string \5\1\1\0 Terse archive data # PUCrunch 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data # UHarc 0 string UHA UHarc archive data # ABComp 0 string \2AB ABComp archive data 0 string \3AB2 ABComp archive data # CMP 0 string CO\0 CMP archive data # Splint 0 string \x93\xb9\x06 Splint archive data # InstallShield 0 string \x13\x5d\x65\x8c InstallShield Z archive Data # Gather 1 string GTH Gather archive data # BOA 0 string BOA BOA archive data # RAX 0 string ULEB\xa RAX archive data # Xtreme 0 string ULEB\0 Xtreme archive data # Pack Magic 0 string @@â\1\0 Pack Magic archive data # BTS 0 belong&0xfeffffff 0x1a034465 BTS archive data # ELI 5750 0 string Ora\ ELI 5750 archive data # QFC 0 string \x1aFC\x1a QFC archive data 0 string \x1aQF\x1a QFC archive data # PRO-PACK 0 string RNC PRO-PACK archive data # 777 0 string 777 777 archive data # LZS221 0 string sTaC LZS221 archive data # HPA 0 string HPA HPA archive data # Arhangel 0 string LG Arhangel archive data # EXP1, uses bzip2 0 string 0123456789012345BZh EXP1 archive data # IMP 0 string IMP\xa IMP archive data # NRV 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data # Squish 0 string \x73\xb2\x90\xf4 Squish archive data # Par 0 string PHILIPP Par archive data 0 string PAR Par archive data # HIT 0 string UB HIT archive data # SBX 0 belong&0xfffff000 0x53423000 SBX archive data # NaShrink 0 string NSK NaShrink archive data # SAPCAR 0 string #\ CAR\ archive\ header SAPCAR archive data 0 string CAR\ 2.00RG SAPCAR archive data # Disintegrator 0 string DST Disintegrator archive data # ASD 0 string ASD ASD archive data # InstallShield CAB 0 string ISc( InstallShield CAB # TOP4 0 string T4\x1a TOP4 archive data # BatComp left out: sig looks like COM executable # so TODO: get real 4dos batcomp file and find sig # BlakHole 0 string BH\5\7 BlakHole archive data # BIX 0 string BIX0 BIX archive data # ChiefLZA 0 string ChfLZ ChiefLZA archive data # Blink 0 string Blink Blink archive data # Logitech Compress 0 string \xda\xfa Logitech Compress archive data # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 1 string (C)\ STEPANYUK ARS-Sfx archive data # AKT/AKT32 0 string AKT32 AKT32 archive data 0 string AKT AKT archive data # NPack 0 string MSTSM NPack archive data # PFT 0 string \0\x50\0\x14 PFT archive data # SemOne 0 string SEM SemOne archive data # PPMD 0 string \x8f\xaf\xac\x84 PPMD archive data # FIZ 0 string FIZ FIZ archive data # MSXiE 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data # DeepFreezer 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data # DC 0 string =2 byte x \b, version %i >3 byte x \b.%i # ZZip archiver (.zz) 0 string ZZ\ \0\0 ZZip archive data 0 string ZZ0 ZZip archive data # PAQ archiver (.paq) 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 0 string PAQ PAQ archive data >3 byte&0xf0 0x30 >>3 byte x (v%c) # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 0 string JARCS JAR (ARJ Software, Inc.) archive data a152 2 # [JW] idarc says this is also possible 2 leshort 0xea60 ARJ archive data a163 9 # suggestion: at least identify small archives (<1024 files) 0 belong&0xffff00fc 0x48410000 HA archive data >2 leshort =1 1 file, >2 leshort >1 %u files, >4 byte&0x0f =0 first is type CPY >4 byte&0x0f =1 first is type ASC >4 byte&0x0f =2 first is type HSC >4 byte&0x0f =0x0e first is type DIR >4 byte&0x0f =0x0f first is type SPECIAL d169 1 a169 1 0 string \351,\001JAM\ JAM archive, d177 2 a178 2 2 string -lh0- LHarc 1.x/ARX archive data [lh0] 2 string -lh1- LHarc 1.x/ARX archive data [lh1] d182 1 a182 1 2 string -lzs- LHa/LZS archive data [lzs] d190 1 a190 1 2 string -lh7- LHa (2.x)/LHark archive data [lh7] a191 4 # taken from idarc [JW] 2 string -lZ PUT archive data 2 string -lz LZS archive data 2 string -sw1- Swag archive data a195 6 >10 byte >0 flags: >>10 byte &0x01 Archive volume, >>10 byte &0x02 Commented, >>10 byte &0x04 Locked, >>10 byte &0x08 Solid, >>10 byte &0x20 Authenticated, a199 2 # some old version? idarc says: 0 string RE\x7e\x5e RAR archive data d205 1 a205 1 # [JW] see exe section for self-extracting version d209 5 a213 61 0 string PK\003\004 >4 byte 0x09 Zip archive data, at least v0.9 to extract >4 byte 0x0a Zip archive data, at least v1.0 to extract >4 byte 0x0b Zip archive data, at least v1.1 to extract >4 byte 0x14 >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract >0x161 string WINZIP Zip archive data, WinZIP self-extracting # OpenOffice.org / KOffice / StarOffice documents # From: Abel Cheung # Listed here because they are basically zip files >>30 string mimetype # KOffice (1.2 or above) formats >>>50 string vnd.kde. KOffice (>=1.2) >>>>58 string karbon Karbon document >>>>58 string kchart KChart document >>>>58 string kformula KFormula document >>>>58 string kivio Kivio document >>>>58 string kontour Kontour document >>>>58 string kpresenter KPresenter document >>>>58 string kspread KSpread document >>>>58 string kword KWord document # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) >>>50 string vnd.sun.xml. OpenOffice.org 1.x >>>>62 string writer Writer >>>>>68 byte !0x2e document >>>>>68 string .template template >>>>>68 string .global global document >>>>62 string calc Calc >>>>>66 byte !0x2e spreadsheet >>>>>66 string .template template >>>>62 string draw Draw >>>>>66 byte !0x2e document >>>>>66 string .template template >>>>62 string impress Impress >>>>>69 byte !0x2e presentation >>>>>69 string .template template >>>>62 string math Math document # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) # http://lists.oasis-open.org/archives/office/200505/msg00006.html >>>50 string vnd.oasis.opendocument. OpenDocument >>>>73 string text >>>>>77 byte !0x2d Text >>>>>77 string -template Text Template >>>>>77 string -web HTML Document Template >>>>>77 string -master Master Document >>>>73 string graphics Drawing >>>>>81 string -template Template >>>>73 string presentation Presentation >>>>>85 string -template Template >>>>73 string spreadsheet Spreadsheet >>>>>84 string -template Template >>>>73 string chart Chart >>>>>78 string -template Template >>>>73 string formula Formula >>>>>80 string -template Template >>>>73 string database Database >>>>73 string image Image d287 1 a287 1 7 string **ACE** ACE archive data d309 1 a309 1 >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) d324 2 a325 29 0 string Packed\ File\ Personal NetWare Packed File >12 string x \b, was "%.12s" # EET archive # From: Tilman Sauerbeck 0 belong 0x1ee7ff00 EET archive # rzip archives 0 string RZIP rzip compressed data >4 byte x - version %d >5 byte x \b.%d >6 belong x (%d bytes) # From: "Robert Dale" 0 belong 123 dar archive, >4 belong x label "%.8x >>8 belong x %.8x >>>12 beshort x %.4x" >14 byte 0x54 end slice >14 beshort 0x4e4e multi-part >14 beshort 0x4e53 multi-part, with -S # Symbian installation files # http://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file >4 lelong 0x1000006D (EPOC release 3/4/5) >4 lelong 0x10003A12 (EPOC release 6) 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) @ 1.1.1.7.2.1 log @Pull up following revision(s) (requested by pooka in ticket #1804): dist/file/: synced with HEAD on 20070615 distrib/sets/lists/base/shl.elf: revision 1.222 distrib/sets/lists/base/shl.mi: revision 1.375 via patch lib/Makefile: revision 1.108 via patch lib/libmagic/Makefile: revision 1.5 lib/libmagic/config.h: patch lib/libmagic/shlib_version: revision 1.3-1.4 tools/file/Makefile: revision 1.4 usr.bin/file/Makefile: revision 1.51-1.53 Update file(1) to version 4.21, including security fixes (CVE-2007-1536 and CVE-2007-2799). @ text @d32 1 a32 1 0 string =!\ndebian d36 2 a37 7 # These next two lines do not work, because a bzip2 Debian archive # still uses gzip for the control.tar (first in the archive). Only # data.tar varies, and the location of its filename varies too. # file/libmagic does not current have support for ascii-string based # (offsets) as of 2005-09-15. #>81 string bz2 \b, uses bzip2 compression #>84 string gz \b, uses gzip compression d50 1 a50 1 0 string =!\n__________E MIPS archive d64 1 a64 1 # 0 string =! current ar archive d76 1 a76 1 0 string =! current ar archive a123 4 # [JW] stuff taken from idarc, obviously ARC successors: 0 lelong&0x8080ffff 0x00000a1a PAK archive data 0 lelong&0x8080ffff 0x0000141a ARC+ archive data 0 lelong&0x8080ffff 0x0000481a HYP archive data d129 4 a132 2 #0 byte 0x1a RISC OS archive (spark format) 0 string \032archive RISC OS archive (ArcFS format) a134 294 # All these were taken from idarc, many could not be verified. Unfortunately, # there were many low-quality sigs, i.e. easy to trigger false positives. # Please notify me of any real-world fishy/ambiguous signatures and I'll try # to get my hands on the actual archiver and see if I find something better. [JW] # probably many can be enhanced by finding some 0-byte or control char near the start # idarc calls this Crush/Uncompressed... *shrug* 0 string CRUSH Crush archive data # Squeeze It (.sqz) 0 string HLSQZ Squeeze It archive data # SQWEZ 0 string SQWEZ SQWEZ archive data # HPack (.hpk) 0 string HPAK HPack archive data # HAP 0 string \x91\x33HF HAP archive data # MD/MDCD 0 string MDmd MDCD archive data # LIM 0 string LIM\x1a LIM archive data # SAR 3 string LH5 SAR archive data # BSArc/BS2 0 string \212\3SB \0 BSArc/BS2 archive data # MAR 2 string =-ah MAR archive data # ACB 0 belong&0x00f800ff 0x00800000 ACB archive data # CPZ # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data # JRC 0 string JRchive JRC archive data # Quantum 0 string DS\0 Quantum archive data # ReSOF 0 string PK\3\6 ReSOF archive data # QuArk 0 string 7\4 QuArk archive data # YAC 14 string YC YAC archive data # X1 0 string X1 X1 archive data 0 string XhDr X1 archive data # CDC Codec (.dqt) 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data # AMGC 0 string \xad6" AMGC archive data # NuLIB 0 string NõFélå NuLIB archive data # PakLeo 0 string LEOLZW PAKLeo archive data # ChArc 0 string SChF ChArc archive data # PSA 0 string PSA PSA archive data # CrossePAC 0 string DSIGDCC CrossePAC archive data # Freeze 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data # KBoom 0 string ¨MP¨ KBoom archive data # NSQ, must go after CDC Codec 0 string \x76\xff NSQ archive data # DPA 0 string Dirk\ Paehl DPA archive data # BA # TODO: idarc says "bytes 0-2 == bytes 3-5" # TTComp 0 string \0\6 TTComp archive data # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 0 string ESP ESP archive data # ZPack 0 string \1ZPK\1 ZPack archive data # Sky 0 string \xbc\x40 Sky archive data # UFA 0 string UFA UFA archive data # Dry 0 string =-H2O DRY archive data # FoxSQZ 0 string FOXSQZ FoxSQZ archive data # AR7 0 string ,AR7 AR7 archive data # PPMZ 0 string PPMZ PPMZ archive data # MS Compress 4 string \x88\xf0\x27 MS Compress archive data # updated by Joerg Jenderek >9 string \0 >>0 string KWAJ >>>7 string \321\003 MS Compress archive data >>>>14 ulong >0 \b, original size: %ld bytes >>>>18 ubyte >0x65 >>>>>18 string x \b, was %.8s >>>>>(10.b-4) string x \b.%.3s # MP3 (archiver, not lossy audio compression) 0 string MP3\x1a MP3-Archiver archive data # ZET 0 string OZÝ ZET archive data # TSComp 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data # ARQ 0 string gW\4\1 ARQ archive data # Squash 3 string OctSqu Squash archive data # Terse 0 string \5\1\1\0 Terse archive data # PUCrunch 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data # UHarc 0 string UHA UHarc archive data # ABComp 0 string \2AB ABComp archive data 0 string \3AB2 ABComp archive data # CMP 0 string CO\0 CMP archive data # Splint 0 string \x93\xb9\x06 Splint archive data # InstallShield 0 string \x13\x5d\x65\x8c InstallShield Z archive Data # Gather 1 string GTH Gather archive data # BOA 0 string BOA BOA archive data # RAX 0 string ULEB\xa RAX archive data # Xtreme 0 string ULEB\0 Xtreme archive data # Pack Magic 0 string @@â\1\0 Pack Magic archive data # BTS 0 belong&0xfeffffff 0x1a034465 BTS archive data # ELI 5750 0 string Ora\ ELI 5750 archive data # QFC 0 string \x1aFC\x1a QFC archive data 0 string \x1aQF\x1a QFC archive data # PRO-PACK 0 string RNC PRO-PACK archive data # 777 0 string 777 777 archive data # LZS221 0 string sTaC LZS221 archive data # HPA 0 string HPA HPA archive data # Arhangel 0 string LG Arhangel archive data # EXP1, uses bzip2 0 string 0123456789012345BZh EXP1 archive data # IMP 0 string IMP\xa IMP archive data # NRV 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data # Squish 0 string \x73\xb2\x90\xf4 Squish archive data # Par 0 string PHILIPP Par archive data 0 string PAR Par archive data # HIT 0 string UB HIT archive data # SBX 0 belong&0xfffff000 0x53423000 SBX archive data # NaShrink 0 string NSK NaShrink archive data # SAPCAR 0 string #\ CAR\ archive\ header SAPCAR archive data 0 string CAR\ 2.00RG SAPCAR archive data # Disintegrator 0 string DST Disintegrator archive data # ASD 0 string ASD ASD archive data # InstallShield CAB 0 string ISc( InstallShield CAB # TOP4 0 string T4\x1a TOP4 archive data # BatComp left out: sig looks like COM executable # so TODO: get real 4dos batcomp file and find sig # BlakHole 0 string BH\5\7 BlakHole archive data # BIX 0 string BIX0 BIX archive data # ChiefLZA 0 string ChfLZ ChiefLZA archive data # Blink 0 string Blink Blink archive data # Logitech Compress 0 string \xda\xfa Logitech Compress archive data # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 1 string (C)\ STEPANYUK ARS-Sfx archive data # AKT/AKT32 0 string AKT32 AKT32 archive data 0 string AKT AKT archive data # NPack 0 string MSTSM NPack archive data # PFT 0 string \0\x50\0\x14 PFT archive data # SemOne 0 string SEM SemOne archive data # PPMD 0 string \x8f\xaf\xac\x84 PPMD archive data # FIZ 0 string FIZ FIZ archive data # MSXiE 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data # DeepFreezer 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data # DC 0 string =2 byte x \b, version %i >3 byte x \b.%i # ZZip archiver (.zz) 0 string ZZ\ \0\0 ZZip archive data 0 string ZZ0 ZZip archive data # PAQ archiver (.paq) 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 0 string PAQ PAQ archive data >3 byte&0xf0 0x30 >>3 byte x (v%c) # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 0 string JARCS JAR (ARJ Software, Inc.) archive data a152 2 # [JW] idarc says this is also possible 2 leshort 0xea60 ARJ archive data a163 9 # suggestion: at least identify small archives (<1024 files) 0 belong&0xffff00fc 0x48410000 HA archive data >2 leshort =1 1 file, >2 leshort >1 %u files, >4 byte&0x0f =0 first is type CPY >4 byte&0x0f =1 first is type ASC >4 byte&0x0f =2 first is type HSC >4 byte&0x0f =0x0e first is type DIR >4 byte&0x0f =0x0f first is type SPECIAL d169 1 a169 1 0 string \351,\001JAM\ JAM archive, d177 2 a178 2 2 string -lh0- LHarc 1.x/ARX archive data [lh0] 2 string -lh1- LHarc 1.x/ARX archive data [lh1] d182 1 a182 1 2 string -lzs- LHa/LZS archive data [lzs] d190 1 a190 1 2 string -lh7- LHa (2.x)/LHark archive data [lh7] a191 4 # taken from idarc [JW] 2 string -lZ PUT archive data 2 string -lz LZS archive data 2 string -sw1- Swag archive data a195 6 >10 byte >0 flags: >>10 byte &0x01 Archive volume, >>10 byte &0x02 Commented, >>10 byte &0x04 Locked, >>10 byte &0x08 Solid, >>10 byte &0x20 Authenticated, a199 2 # some old version? idarc says: 0 string RE\x7e\x5e RAR archive data d205 1 a205 1 # [JW] see exe section for self-extracting version d209 5 a213 61 0 string PK\003\004 >4 byte 0x09 Zip archive data, at least v0.9 to extract >4 byte 0x0a Zip archive data, at least v1.0 to extract >4 byte 0x0b Zip archive data, at least v1.1 to extract >4 byte 0x14 >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract >0x161 string WINZIP Zip archive data, WinZIP self-extracting # OpenOffice.org / KOffice / StarOffice documents # From: Abel Cheung # Listed here because they are basically zip files >>30 string mimetype # KOffice (1.2 or above) formats >>>50 string vnd.kde. KOffice (>=1.2) >>>>58 string karbon Karbon document >>>>58 string kchart KChart document >>>>58 string kformula KFormula document >>>>58 string kivio Kivio document >>>>58 string kontour Kontour document >>>>58 string kpresenter KPresenter document >>>>58 string kspread KSpread document >>>>58 string kword KWord document # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) >>>50 string vnd.sun.xml. OpenOffice.org 1.x >>>>62 string writer Writer >>>>>68 byte !0x2e document >>>>>68 string .template template >>>>>68 string .global global document >>>>62 string calc Calc >>>>>66 byte !0x2e spreadsheet >>>>>66 string .template template >>>>62 string draw Draw >>>>>66 byte !0x2e document >>>>>66 string .template template >>>>62 string impress Impress >>>>>69 byte !0x2e presentation >>>>>69 string .template template >>>>62 string math Math document # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) # http://lists.oasis-open.org/archives/office/200505/msg00006.html >>>50 string vnd.oasis.opendocument. OpenDocument >>>>73 string text >>>>>77 byte !0x2d Text >>>>>77 string -template Text Template >>>>>77 string -web HTML Document Template >>>>>77 string -master Master Document >>>>73 string graphics Drawing >>>>>81 string -template Template >>>>73 string presentation Presentation >>>>>85 string -template Template >>>>73 string spreadsheet Spreadsheet >>>>>84 string -template Template >>>>73 string chart Chart >>>>>78 string -template Template >>>>73 string formula Formula >>>>>80 string -template Template >>>>73 string database Database >>>>73 string image Image d287 1 a287 1 7 string **ACE** ACE archive data d309 1 a309 1 >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) d324 2 a325 29 0 string Packed\ File\ Personal NetWare Packed File >12 string x \b, was "%.12s" # EET archive # From: Tilman Sauerbeck 0 belong 0x1ee7ff00 EET archive # rzip archives 0 string RZIP rzip compressed data >4 byte x - version %d >5 byte x \b.%d >6 belong x (%d bytes) # From: "Robert Dale" 0 belong 123 dar archive, >4 belong x label "%.8x >>8 belong x %.8x >>>12 beshort x %.4x" >14 byte 0x54 end slice >14 beshort 0x4e4e multi-part >14 beshort 0x4e53 multi-part, with -S # Symbian installation files # http://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file >4 lelong 0x1000006D (EPOC release 3/4/5) >4 lelong 0x10003A12 (EPOC release 6) 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) @ 1.1.1.8 log @file 4.16 Changes since 4.13: * DragonFly ELF note support * read buffer dynamically allocated * Add -h flag and dereference symlinks if POSIXLY_CORRECT * Avoid search and regex buffer overflows * cross-compilation fixes * don't close stdin in the library. * search for elf notes in shared libraries too. Now with more magic than ever before! @ text @d32 1 a32 1 0 string =!\ndebian d36 2 a37 7 # These next two lines do not work, because a bzip2 Debian archive # still uses gzip for the control.tar (first in the archive). Only # data.tar varies, and the location of its filename varies too. # file/libmagic does not current have support for ascii-string based # (offsets) as of 2005-09-15. #>81 string bz2 \b, uses bzip2 compression #>84 string gz \b, uses gzip compression d50 1 a50 1 0 string =!\n__________E MIPS archive d64 1 a64 1 # 0 string =! current ar archive d76 1 a76 1 0 string =! current ar archive a123 4 # [JW] stuff taken from idarc, obviously ARC successors: 0 lelong&0x8080ffff 0x00000a1a PAK archive data 0 lelong&0x8080ffff 0x0000141a ARC+ archive data 0 lelong&0x8080ffff 0x0000481a HYP archive data d129 4 a132 2 #0 byte 0x1a RISC OS archive (spark format) 0 string \032archive RISC OS archive (ArcFS format) a134 286 # All these were taken from idarc, many could not be verified. Unfortunately, # there were many low-quality sigs, i.e. easy to trigger false positives. # Please notify me of any real-world fishy/ambiguous signatures and I'll try # to get my hands on the actual archiver and see if I find something better. [JW] # probably many can be enhanced by finding some 0-byte or control char near the start # idarc calls this Crush/Uncompressed... *shrug* 0 string CRUSH Crush archive data # Squeeze It (.sqz) 0 string HLSQZ Squeeze It archive data # SQWEZ 0 string SQWEZ SQWEZ archive data # HPack (.hpk) 0 string HPAK HPack archive data # HAP 0 string \x91\x33HF HAP archive data # MD/MDCD 0 string MDmd MDCD archive data # LIM 0 string LIM\x1a LIM archive data # SAR 3 string LH5 SAR archive data # BSArc/BS2 0 string \212\3SB \0 BSArc/BS2 archive data # MAR 2 string =-ah MAR archive data # ACB 0 belong&0x00f800ff 0x00800000 ACB archive data # CPZ # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data # JRC 0 string JRchive JRC archive data # Quantum 0 string DS\0 Quantum archive data # ReSOF 0 string PK\3\6 ReSOF archive data # QuArk 0 string 7\4 QuArk archive data # YAC 14 string YC YAC archive data # X1 0 string X1 X1 archive data 0 string XhDr X1 archive data # CDC Codec (.dqt) 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data # AMGC 0 string \xad6" AMGC archive data # NuLIB 0 string NõFélå NuLIB archive data # PakLeo 0 string LEOLZW PAKLeo archive data # ChArc 0 string SChF ChArc archive data # PSA 0 string PSA PSA archive data # CrossePAC 0 string DSIGDCC CrossePAC archive data # Freeze 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data # KBoom 0 string ¨MP¨ KBoom archive data # NSQ, must go after CDC Codec 0 string \x76\xff NSQ archive data # DPA 0 string Dirk\ Paehl DPA archive data # BA # TODO: idarc says "bytes 0-2 == bytes 3-5" # TTComp 0 string \0\6 TTComp archive data # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation? 0 string ESP ESP archive data # ZPack 0 string \1ZPK\1 ZPack archive data # Sky 0 string \xbc\x40 Sky archive data # UFA 0 string UFA UFA archive data # Dry 0 string =-H2O DRY archive data # FoxSQZ 0 string FOXSQZ FoxSQZ archive data # AR7 0 string ,AR7 AR7 archive data # PPMZ 0 string PPMZ PPMZ archive data # MS Compress 4 string \x88\xf0\x27 MS Compress archive data # MP3 (archiver, not lossy audio compression) 0 string MP3\x1a MP3-Archiver archive data # ZET 0 string OZÝ ZET archive data # TSComp 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data # ARQ 0 string gW\4\1 ARQ archive data # Squash 3 string OctSqu Squash archive data # Terse 0 string \5\1\1\0 Terse archive data # PUCrunch 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data # UHarc 0 string UHA UHarc archive data # ABComp 0 string \2AB ABComp archive data 0 string \3AB2 ABComp archive data # CMP 0 string CO\0 CMP archive data # Splint 0 string \x93\xb9\x06 Splint archive data # InstallShield 0 string \x13\x5d\x65\x8c InstallShield Z archive Data # Gather 1 string GTH Gather archive data # BOA 0 string BOA BOA archive data # RAX 0 string ULEB\xa RAX archive data # Xtreme 0 string ULEB\0 Xtreme archive data # Pack Magic 0 string @@â\1\0 Pack Magic archive data # BTS 0 belong&0xfeffffff 0x1a034465 BTS archive data # ELI 5750 0 string Ora\ ELI 5750 archive data # QFC 0 string \x1aFC\x1a QFC archive data 0 string \x1aQF\x1a QFC archive data # PRO-PACK 0 string RNC PRO-PACK archive data # 777 0 string 777 777 archive data # LZS221 0 string sTaC LZS221 archive data # HPA 0 string HPA HPA archive data # Arhangel 0 string LG Arhangel archive data # EXP1, uses bzip2 0 string 0123456789012345BZh EXP1 archive data # IMP 0 string IMP\xa IMP archive data # NRV 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data # Squish 0 string \x73\xb2\x90\xf4 Squish archive data # Par 0 string PHILIPP Par archive data 0 string PAR Par archive data # HIT 0 string UB HIT archive data # SBX 0 belong&0xfffff000 0x53423000 SBX archive data # NaShrink 0 string NSK NaShrink archive data # SAPCAR 0 string #\ CAR\ archive\ header SAPCAR archive data 0 string CAR\ 2.00RG SAPCAR archive data # Disintegrator 0 string DST Disintegrator archive data # ASD 0 string ASD ASD archive data # InstallShield CAB 0 string ISc( InstallShield CAB # TOP4 0 string T4\x1a TOP4 archive data # BatComp left out: sig looks like COM executable # so TODO: get real 4dos batcomp file and find sig # BlakHole 0 string BH\5\7 BlakHole archive data # BIX 0 string BIX0 BIX archive data # ChiefLZA 0 string ChfLZ ChiefLZA archive data # Blink 0 string Blink Blink archive data # Logitech Compress 0 string \xda\xfa Logitech Compress archive data # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE) 1 string (C)\ STEPANYUK ARS-Sfx archive data # AKT/AKT32 0 string AKT32 AKT32 archive data 0 string AKT AKT archive data # NPack 0 string MSTSM NPack archive data # PFT 0 string \0\x50\0\x14 PFT archive data # SemOne 0 string SEM SemOne archive data # PPMD 0 string \x8f\xaf\xac\x84 PPMD archive data # FIZ 0 string FIZ FIZ archive data # MSXiE 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data # DeepFreezer 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data # DC 0 string =2 byte x \b, version %i >3 byte x \b.%i # ZZip archiver (.zz) 0 string ZZ\ \0\0 ZZip archive data 0 string ZZ0 ZZip archive data # PAQ archiver (.paq) 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data 0 string PAQ PAQ archive data >3 byte&0xf0 0x30 >>3 byte x (v%c) # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP) 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data 0 string JARCS JAR (ARJ Software, Inc.) archive data a152 2 # [JW] idarc says this is also possible 2 leshort 0xea60 ARJ archive data a163 9 # suggestion: at least identify small archives (<1024 files) 0 belong&0xffff00fc 0x48410000 HA archive data >2 leshort =1 1 file, >2 leshort >1 %u files, >4 byte&0x0f =0 first is type CPY >4 byte&0x0f =1 first is type ASC >4 byte&0x0f =2 first is type HSC >4 byte&0x0f =0x0e first is type DIR >4 byte&0x0f =0x0f first is type SPECIAL d177 2 a178 2 2 string -lh0- LHarc 1.x/ARX archive data [lh0] 2 string -lh1- LHarc 1.x/ARX archive data [lh1] d182 1 a182 1 2 string -lzs- LHa/LZS archive data [lzs] d190 1 a190 1 2 string -lh7- LHa (2.x)/LHark archive data [lh7] a191 4 # taken from idarc [JW] 2 string -lZ PUT archive data 2 string -lz LZS archive data 2 string -sw1- Swag archive data a199 2 # some old version? idarc says: 0 string RE\x7e\x5e RAR archive data d205 1 a205 1 # [JW] see exe section for self-extracting version d287 1 a287 1 7 string **ACE** ACE archive data d324 2 a325 6 0 string Packed\ File\ Personal NetWare Packed File >12 string x \b, was "%.12s" # EET archive # From: Tilman Sauerbeck 0 belong 0x1ee7ff00 EET archive @ 1.1.1.9 log @file 4.18 changes since 4.16: bugfixes, magic improvements, other minor improvements @ text @a228 8 # updated by Joerg Jenderek >9 string \0 >>0 string KWAJ >>>7 string \321\003 MS Compress archive data >>>>14 ulong >0 \b, original size: %ld bytes >>>>18 ubyte >0x65 >>>>>18 string x \b, was %.8s >>>>>(10.b-4) string x \b.%.3s d519 5 a523 60 0 string PK\003\004 >4 byte 0x09 Zip archive data, at least v0.9 to extract >4 byte 0x0a Zip archive data, at least v1.0 to extract >4 byte 0x0b Zip archive data, at least v1.1 to extract >4 byte 0x14 >>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract # OpenOffice.org / KOffice / StarOffice documents # From: Abel Cheung # Listed here because they are basically zip files >>30 string mimetype # KOffice (1.2 or above) formats >>>50 string vnd.kde. KOffice (>=1.2) >>>>58 string karbon Karbon document >>>>58 string kchart KChart document >>>>58 string kformula KFormula document >>>>58 string kivio Kivio document >>>>58 string kontour Kontour document >>>>58 string kpresenter KPresenter document >>>>58 string kspread KSpread document >>>>58 string kword KWord document # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) >>>50 string vnd.sun.xml. OpenOffice.org 1.x >>>>62 string writer Writer >>>>>68 byte !0x2e document >>>>>68 string .template template >>>>>68 string .global global document >>>>62 string calc Calc >>>>>66 byte !0x2e spreadsheet >>>>>66 string .template template >>>>62 string draw Draw >>>>>66 byte !0x2e document >>>>>66 string .template template >>>>62 string impress Impress >>>>>69 byte !0x2e presentation >>>>>69 string .template template >>>>62 string math Math document # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) # http://lists.oasis-open.org/archives/office/200505/msg00006.html >>>50 string vnd.oasis.opendocument. OpenDocument >>>>73 string text >>>>>77 byte !0x2d Text >>>>>77 string -template Text Template >>>>>77 string -web HTML Document Template >>>>>77 string -master Master Document >>>>73 string graphics Drawing >>>>>81 string -template Template >>>>73 string presentation Presentation >>>>>85 string -template Template >>>>73 string spreadsheet Spreadsheet >>>>>84 string -template Template >>>>73 string chart Chart >>>>>78 string -template Template >>>>73 string formula Formula >>>>>80 string -template Template >>>>73 string database Database >>>>73 string image Image d619 1 a619 1 >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) a639 9 # From: "Robert Dale" 0 belong 123 dar archive, >4 belong x label "%.8x >>8 belong x %.8x >>>12 beshort x %.4x" >14 byte 0x54 end slice >14 beshort 0x4e4e multi-part >14 beshort 0x4e53 multi-part, with -S @ 1.1.1.10 log @file 4.20, contains fixes to the magic parser, new syntax and a buffer overflow fix @ text @d481 1 a481 1 0 string \351,\001JAM\ JAM archive, a511 6 >10 byte >0 flags: >>10 byte &0x01 Archive volume, >>10 byte &0x02 Commented, >>10 byte &0x04 Locked, >>10 byte &0x08 Solid, >>10 byte &0x20 Authenticated, a532 2 >0x161 string WINZIP Zip archive data, WinZIP self-extracting a703 6 # rzip archives 0 string RZIP rzip compressed data >4 byte x - version %d >5 byte x \b.%d >6 belong x (%d bytes) @ 1.1.1.11 log @file 4.21. bugfixes @ text @a725 8 # Symbian installation files # http://www.thouky.co.uk/software/psifs/sis.html # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf 8 lelong 0x10000419 Symbian installation file >4 lelong 0x1000006D (EPOC release 3/4/5) >4 lelong 0x10003A12 (EPOC release 6) 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x) @ 1.1.1.12 log @try-again for file-4.26 @ text @d1 1 a10 1 !:mime application/x-tar # encoding: posix a11 1 !:mime application/x-tar # encoding: gnu a24 1 !:mime application/x-cpio a25 1 !:mime application/x-cpio # encoding: swapped a32 1 !:mime application/x-debian-package a34 1 >8 string !debian a51 1 !:mime application/x-archive d63 1 a63 1 0 search/1 -h- Software Tools format archive text a81 1 !:mime application/x-archive a123 1 !:mime application/x-arc a124 1 !:mime application/x-arc a125 1 !:mime application/x-arc a126 1 !:mime application/x-arc a127 1 !:mime application/x-arc a128 1 !:mime application/x-arc a130 1 !:mime application/x-arc a131 1 !:mime application/x-arc a132 1 !:mime application/x-arc a437 1 !:mime application/x-arj a489 1 !:mime application/x-lharc a490 1 !:mime application/x-lharc a491 1 !:mime application/x-lharc a492 1 !:mime application/x-lharc a494 1 !:mime application/x-lha a495 1 !:mime application/x-lha a496 1 !:mime application/x-lha a497 1 !:mime application/x-lha a498 1 !:mime application/x-lha a499 1 !:mime application/x-lha a500 1 !:mime application/x-lha a501 1 !:mime application/x-lha a502 1 !:mime application/x-lha a510 1 !:mime application/x-rar a533 2 >4 byte 0x00 Zip archive data !:mime application/zip a534 1 !:mime application/zip a535 1 !:mime application/zip a536 3 !:mime application/zip >0x161 string WINZIP Zip archive data, WinZIP self-extracting !:mime application/zip d539 2 a540 1 !:mime application/zip a542 2 # Listed here because they ARE zip files # d544 1 a544 1 >4 byte 0x14 a573 1 >>>>62 string base Database file a579 1 !:mime application/vnd.oasis.opendocument.text a597 1 !:mime application/x-zoo a608 1 !:mime application/octet-stream a653 1 !:mime application/x-bittorrent a710 1 !:mime application/x-eet a730 1 !:mime application/vnd.symbian.install a733 26 !:mime x-epoc/x-sisx-app # From "Nelson A. de Oliveira" 0 string MPQ\032 MoPaQ (MPQ) archive # From: Dirk Jagdmann # xar archive format: http://code.google.com/p/xar/ 0 string xar! xar archive >6 beshort x - version %ld # From: "Nelson A. de Oliveira" # .kgb 0 string KGB_arch KGB Archiver file >10 string x with compression level %.1s # xar (eXtensible ARchiver) archive # From: "David Remahl" 0 string xar! xar archive #>4 beshort x header size %d >6 beshort x version %d, #>8 quad x compressed TOC: %d, #>16 quad x uncompressed TOC: %d, >24 belong 0 no checksum >24 belong 1 SHA-1 checksum >24 belong 2 MD5 checksum @