head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC4:1.1.1.19 netbsd-11-0-RC3:1.1.1.19 netbsd-11-0-RC2:1.1.1.19 netbsd-11-0-RC1:1.1.1.19 perseant-exfatfs-base-20250801:1.1.1.19 netbsd-11:1.1.1.19.0.4 netbsd-11-base:1.1.1.19 netbsd-10-1-RELEASE:1.1.1.18 perseant-exfatfs-base-20240630:1.1.1.19 perseant-exfatfs:1.1.1.19.0.2 perseant-exfatfs-base:1.1.1.19 netbsd-8-3-RELEASE:1.1.1.11 netbsd-9-4-RELEASE:1.1.1.14 netbsd-10-0-RELEASE:1.1.1.18 netbsd-10-0-RC6:1.1.1.18 netbsd-10-0-RC5:1.1.1.18 netbsd-10-0-RC4:1.1.1.18 netbsd-10-0-RC3:1.1.1.18 netbsd-10-0-RC2:1.1.1.18 netbsd-10-0-RC1:1.1.1.18 FILE5_45:1.1.1.19 netbsd-10:1.1.1.18.0.2 netbsd-10-base:1.1.1.18 FILE5_43:1.1.1.18 netbsd-9-3-RELEASE:1.1.1.14 cjep_sun2x-base1:1.1.1.17 cjep_sun2x:1.1.1.17.0.4 cjep_sun2x-base:1.1.1.17 cjep_staticlib_x-base1:1.1.1.17 netbsd-9-2-RELEASE:1.1.1.14 cjep_staticlib_x:1.1.1.17.0.2 cjep_staticlib_x-base:1.1.1.17 FILE5_40:1.1.1.17 netbsd-9-1-RELEASE:1.1.1.14 FILE5_39:1.1.1.16 phil-wifi-20200421:1.1.1.15 phil-wifi-20200411:1.1.1.15 is-mlppp:1.1.1.15.0.2 is-mlppp-base:1.1.1.15 phil-wifi-20200406:1.1.1.15 netbsd-8-2-RELEASE:1.1.1.11 netbsd-9-0-RELEASE:1.1.1.14 netbsd-9-0-RC2:1.1.1.14 FILE5_38:1.1.1.15 netbsd-9-0-RC1:1.1.1.14 phil-wifi-20191119:1.1.1.14 netbsd-9:1.1.1.14.0.2 netbsd-9-base:1.1.1.14 phil-wifi-20190609:1.1.1.14 netbsd-8-1-RELEASE:1.1.1.11 FILE5_37:1.1.1.14 netbsd-8-1-RC1:1.1.1.11 pgoyette-compat-merge-20190127:1.1.1.12.2.1 pgoyette-compat-20190127:1.1.1.13 pgoyette-compat-20190118:1.1.1.13 pgoyette-compat-1226:1.1.1.13 pgoyette-compat-1126:1.1.1.13 pgoyette-compat-1020:1.1.1.13 FILE5_35:1.1.1.13 pgoyette-compat-0930:1.1.1.12 pgoyette-compat-0906:1.1.1.12 netbsd-7-2-RELEASE:1.1.1.7 pgoyette-compat-0728:1.1.1.12 netbsd-8-0-RELEASE:1.1.1.11 phil-wifi:1.1.1.12.0.4 phil-wifi-base:1.1.1.12 pgoyette-compat-0625:1.1.1.12 netbsd-8-0-RC2:1.1.1.11 pgoyette-compat-0521:1.1.1.12 pgoyette-compat-0502:1.1.1.12 pgoyette-compat-0422:1.1.1.12 netbsd-8-0-RC1:1.1.1.11 FILE5_33:1.1.1.12 pgoyette-compat-0415:1.1.1.12 pgoyette-compat-0407:1.1.1.12 pgoyette-compat-0330:1.1.1.12 pgoyette-compat-0322:1.1.1.12 pgoyette-compat-0315:1.1.1.12 netbsd-7-1-2-RELEASE:1.1.1.7 pgoyette-compat:1.1.1.12.0.2 pgoyette-compat-base:1.1.1.12 netbsd-7-1-1-RELEASE:1.1.1.7 matt-nb8-mediatek:1.1.1.11.0.6 matt-nb8-mediatek-base:1.1.1.11 FILE5_32:1.1.1.12 perseant-stdc-iso10646:1.1.1.11.0.4 perseant-stdc-iso10646-base:1.1.1.11 netbsd-8:1.1.1.11.0.2 netbsd-8-base:1.1.1.11 FILE5_31:1.1.1.11 prg-localcount2-base3:1.1.1.10 prg-localcount2-base2:1.1.1.10 prg-localcount2-base1:1.1.1.10 prg-localcount2:1.1.1.10.0.2 prg-localcount2-base:1.1.1.10 pgoyette-localcount-20170426:1.1.1.10 bouyer-socketcan-base1:1.1.1.10 pgoyette-localcount-20170320:1.1.1.10 netbsd-7-1:1.1.1.7.0.8 netbsd-7-1-RELEASE:1.1.1.7 netbsd-7-1-RC2:1.1.1.7 FILE5_30:1.1.1.10 netbsd-7-nhusb-base-20170116:1.1.1.7 bouyer-socketcan:1.1.1.9.0.4 bouyer-socketcan-base:1.1.1.9 pgoyette-localcount-20170107:1.1.1.9 netbsd-7-1-RC1:1.1.1.7 pgoyette-localcount-20161104:1.1.1.9 netbsd-7-0-2-RELEASE:1.1.1.7 localcount-20160914:1.1.1.9 netbsd-7-nhusb:1.1.1.7.0.6 netbsd-7-nhusb-base:1.1.1.7 pgoyette-localcount-20160806:1.1.1.9 pgoyette-localcount-20160726:1.1.1.9 pgoyette-localcount:1.1.1.9.0.2 pgoyette-localcount-base:1.1.1.9 netbsd-7-0-1-RELEASE:1.1.1.7 netbsd-7-0:1.1.1.7.0.4 netbsd-7-0-RELEASE:1.1.1.7 netbsd-7-0-RC3:1.1.1.7 netbsd-7-0-RC2:1.1.1.7 netbsd-7-0-RC1:1.1.1.7 FILE5_22:1.1.1.9 FILE5_20:1.1.1.8 netbsd-6-0-6-RELEASE:1.1.1.3 netbsd-6-1-5-RELEASE:1.1.1.3 netbsd-7:1.1.1.7.0.2 netbsd-7-base:1.1.1.7 FILE5_19:1.1.1.7 yamt-pagecache-base9:1.1.1.6 yamt-pagecache-tag8:1.1.1.3.2.1 netbsd-6-1-4-RELEASE:1.1.1.3 netbsd-6-0-5-RELEASE:1.1.1.3 tls-earlyentropy:1.1.1.6.0.2 tls-earlyentropy-base:1.1.1.7 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.6 riastradh-drm2-base3:1.1.1.6 netbsd-6-1-3-RELEASE:1.1.1.3 netbsd-6-0-4-RELEASE:1.1.1.3 FILE5_16:1.1.1.6 netbsd-6-1-2-RELEASE:1.1.1.3 netbsd-6-0-3-RELEASE:1.1.1.3 netbsd-6-1-1-RELEASE:1.1.1.3 riastradh-drm2-base2:1.1.1.5 riastradh-drm2-base1:1.1.1.5 riastradh-drm2:1.1.1.5.0.6 riastradh-drm2-base:1.1.1.5 netbsd-6-1:1.1.1.3.0.12 netbsd-6-0-2-RELEASE:1.1.1.3 netbsd-6-1-RELEASE:1.1.1.3 khorben-n900:1.1.1.5.0.4 netbsd-6-1-RC4:1.1.1.3 netbsd-6-1-RC3:1.1.1.3 agc-symver:1.1.1.5.0.2 agc-symver-base:1.1.1.5 FILE5_14:1.1.1.5 netbsd-6-1-RC2:1.1.1.3 netbsd-6-1-RC1:1.1.1.3 yamt-pagecache-base8:1.1.1.4 FILE_5_12:1.1.1.4 netbsd-6-0-1-RELEASE:1.1.1.3 yamt-pagecache-base7:1.1.1.3 matt-nb6-plus-nbase:1.1.1.3 yamt-pagecache-base6:1.1.1.3 netbsd-6-0:1.1.1.3.0.10 netbsd-6-0-RELEASE:1.1.1.3 netbsd-6-0-RC2:1.1.1.3 tls-maxphys:1.1.1.3.0.8 tls-maxphys-base:1.1.1.7 matt-nb6-plus:1.1.1.3.0.6 matt-nb6-plus-base:1.1.1.3 netbsd-6-0-RC1:1.1.1.3 yamt-pagecache-base5:1.1.1.3 yamt-pagecache-base4:1.1.1.3 FILE5_11:1.1.1.3 netbsd-6:1.1.1.3.0.4 netbsd-6-base:1.1.1.3 yamt-pagecache-base3:1.1.1.3 yamt-pagecache-base2:1.1.1.3 yamt-pagecache:1.1.1.3.0.2 yamt-pagecache-base:1.1.1.3 FILE5_09:1.1.1.3 cherry-xenmp:1.1.1.2.0.2 cherry-xenmp-base:1.1.1.2 FILE5_07:1.1.1.2 bouyer-quota2-nbase:1.1.1.1 bouyer-quota2:1.1.1.1.0.4 bouyer-quota2-base:1.1.1.1 matt-mips64-premerge-20101231:1.1.1.1 matt-premerge-20091211:1.1.1.1 jym-xensuspend-base:1.1.1.1 jym-xensuspend:1.1.1.1.0.2 jym-xensuspend-nbase:1.1.1.1 FILE5_03:1.1.1.1 CHRISTOS:1.1.1; locks; strict; comment @# @; 1.1 date 2009.05.08.16.35.08; author christos; state Exp; branches 1.1.1.1; next ; 1.1.1.1 date 2009.05.08.16.35.08; author christos; state Exp; branches 1.1.1.1.2.1; next 1.1.1.2; 1.1.1.2 date 2011.05.12.20.46.59; author christos; state Exp; branches; next 1.1.1.3; 1.1.1.3 date 2011.09.16.20.37.44; author christos; state Exp; branches 1.1.1.3.2.1 1.1.1.3.8.1; next 1.1.1.4; 1.1.1.4 date 2013.01.03.16.27.54; author christos; state Exp; branches; next 1.1.1.5; 1.1.1.5 date 2013.03.23.15.49.17; author christos; state Exp; branches; next 1.1.1.6; 1.1.1.6 date 2013.12.01.19.28.18; author christos; state Exp; branches 1.1.1.6.2.1; next 1.1.1.7; commitid RVQIxe3FpM3lSsfx; 1.1.1.7 date 2014.06.13.01.48.24; author christos; state Exp; branches; next 1.1.1.8; commitid jtTYsE5FmJU6MiEx; 1.1.1.8 date 2014.10.10.20.08.21; author christos; state Exp; branches; next 1.1.1.9; commitid pfOzhE33qnut2HTx; 1.1.1.9 date 2015.01.02.20.34.28; author christos; state Exp; branches 1.1.1.9.2.1 1.1.1.9.4.1; next 1.1.1.10; commitid VjK78yRsQNs8uu4y; 1.1.1.10 date 2017.02.10.17.42.57; author christos; state Exp; branches; next 1.1.1.11; commitid HAP3kn9Hn6ovMqFz; 1.1.1.11 date 2017.05.24.23.59.57; author christos; state Exp; branches; next 1.1.1.12; commitid WbyOU2LBE5qOyHSz; 1.1.1.12 date 2017.09.08.13.22.43; author christos; state Exp; branches 1.1.1.12.2.1 1.1.1.12.4.1; next 1.1.1.13; commitid Hp7DmePhD4aVAo6A; 1.1.1.13 date 2018.10.18.23.54.09; author christos; state Exp; branches; next 1.1.1.14; commitid e8WctwerBeEm4vWA; 1.1.1.14 date 2019.05.22.17.19.57; author christos; state Exp; branches; next 1.1.1.15; commitid VXeNRYYruN1MWdoB; 1.1.1.15 date 2019.12.17.02.23.53; author christos; state Exp; branches; next 1.1.1.16; commitid vqYTz60fS9PNg0PB; 1.1.1.16 date 2020.06.15.00.18.48; author christos; state Exp; branches; next 1.1.1.17; commitid HMbuXSjPojU5LfcC; 1.1.1.17 date 2021.04.09.18.58.01; author christos; state Exp; branches; next 1.1.1.18; commitid W9ddLLbSkHHinEOC; 1.1.1.18 date 2022.09.24.20.07.54; author christos; state Exp; branches; next 1.1.1.19; commitid Nf6F9kcpc0EPC9VD; 1.1.1.19 date 2023.08.18.18.36.50; author christos; state Exp; branches; next ; commitid IX26ghc1E2S0AiBE; 1.1.1.1.2.1 date 2009.05.08.16.35.08; author jym; state dead; branches; next 1.1.1.1.2.2; 1.1.1.1.2.2 date 2009.05.13.18.51.55; author jym; state Exp; branches; next ; 1.1.1.3.2.1 date 2013.01.23.00.04.35; author yamt; state Exp; branches; next 1.1.1.3.2.2; 1.1.1.3.2.2 date 2014.05.22.15.44.59; author yamt; state Exp; branches; next ; commitid tYJXbWAuFvTh7yBx; 1.1.1.3.8.1 date 2013.02.25.00.26.06; author tls; state Exp; branches; next 1.1.1.3.8.2; 1.1.1.3.8.2 date 2013.06.23.06.26.32; author tls; state Exp; branches; next 1.1.1.3.8.3; commitid OnlO1cBgtQRcIHUw; 1.1.1.3.8.3 date 2014.08.19.23.46.47; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.1.1.6.2.1 date 2014.08.10.07.07.10; author tls; state Exp; branches; next ; commitid b1wUlsZGswrdGMLx; 1.1.1.9.2.1 date 2017.03.20.06.52.19; author pgoyette; state Exp; branches; next ; commitid jjw7cAwgyKq7RfKz; 1.1.1.9.4.1 date 2017.04.21.16.51.24; author bouyer; state Exp; branches; next ; commitid dUG7nkTKALCadqOz; 1.1.1.12.2.1 date 2018.10.20.06.58.20; author pgoyette; state Exp; branches; next ; commitid mTSoqZEZ4arHnFWA; 1.1.1.12.4.1 date 2019.06.10.21.44.46; author christos; state Exp; branches; next 1.1.1.12.4.2; commitid jtc8rnCzWiEEHGqB; 1.1.1.12.4.2 date 2020.04.08.14.04.04; author martin; state Exp; branches; next ; commitid Qli2aW9E74UFuA3C; desc @@ 1.1 log @Initial revision @ text @ #------------------------------------------------------------------------------ # database: file(1) magic for various databases # # extracted from header/code files by Graeme Wilford (eep2gw@@ee.surrey.ac.uk) # # # GDBM magic numbers # Will be maintained as part of the GDBM distribution in the future. # 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian !:mime application/x-gdbm 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian !:mime application/x-gdbm 0 string GDBM GNU dbm 2.x database !:mime application/x-gdbm # # Berkeley DB # # Ian Darwin's file /etc/magic files: big/little-endian version. # # Hash 1.85/1.86 databases store metadata in network byte order. # Btree 1.85/1.86 databases store the metadata in host byte order. # Hash and Btree 2.X and later databases store the metadata in host byte order. 0 long 0x00061561 Berkeley DB !:mime application/x-dbm >8 belong 4321 >>4 belong >2 1.86 >>4 belong <3 1.85 >>4 belong >0 (Hash, version %d, native byte-order) >8 belong 1234 >>4 belong >2 1.86 >>4 belong <3 1.85 >>4 belong >0 (Hash, version %d, little-endian) 0 belong 0x00061561 Berkeley DB >8 belong 4321 >>4 belong >2 1.86 >>4 belong <3 1.85 >>4 belong >0 (Hash, version %d, big-endian) >8 belong 1234 >>4 belong >2 1.86 >>4 belong <3 1.85 >>4 belong >0 (Hash, version %d, native byte-order) 0 long 0x00053162 Berkeley DB 1.85/1.86 >4 long >0 (Btree, version %d, native byte-order) 0 belong 0x00053162 Berkeley DB 1.85/1.86 >4 belong >0 (Btree, version %d, big-endian) 0 lelong 0x00053162 Berkeley DB 1.85/1.86 >4 lelong >0 (Btree, version %d, little-endian) 12 long 0x00061561 Berkeley DB >16 long >0 (Hash, version %d, native byte-order) 12 belong 0x00061561 Berkeley DB >16 belong >0 (Hash, version %d, big-endian) 12 lelong 0x00061561 Berkeley DB >16 lelong >0 (Hash, version %d, little-endian) 12 long 0x00053162 Berkeley DB >16 long >0 (Btree, version %d, native byte-order) 12 belong 0x00053162 Berkeley DB >16 belong >0 (Btree, version %d, big-endian) 12 lelong 0x00053162 Berkeley DB >16 lelong >0 (Btree, version %d, little-endian) 12 long 0x00042253 Berkeley DB >16 long >0 (Queue, version %d, native byte-order) 12 belong 0x00042253 Berkeley DB >16 belong >0 (Queue, version %d, big-endian) 12 lelong 0x00042253 Berkeley DB >16 lelong >0 (Queue, version %d, little-endian) # From Max Bowsher. 12 long 0x00040988 Berkeley DB >16 long >0 (Log, version %d, native byte-order) 12 belong 0x00040988 Berkeley DB >16 belong >0 (Log, version %d, big-endian) 12 lelong 0x00040988 Berkeley DB >16 lelong >0 (Log, version %d, little-endian) # # # Round Robin Database Tool by Tobias Oetiker 0 string RRD RRDTool DB >4 string x version %s #---------------------------------------------------------------------- # ROOT: file(1) magic for ROOT databases # 0 string root\0 ROOT file >4 belong x Version %d >33 belong x (Compression: %d) # XXX: Weak magic. # Alex Ott ## Paradox file formats #2 leshort 0x0800 Paradox #>0x39 byte 3 v. 3.0 #>0x39 byte 4 v. 3.5 #>0x39 byte 9 v. 4.x #>0x39 byte 10 v. 5.x #>0x39 byte 11 v. 5.x #>0x39 byte 12 v. 7.x #>>0x04 byte 0 indexed .DB data file #>>0x04 byte 1 primary index .PX file #>>0x04 byte 2 non-indexed .DB data file #>>0x04 byte 3 non-incrementing secondary index .Xnn file #>>0x04 byte 4 secondary index .Ynn file #>>0x04 byte 5 incrementing secondary index .Xnn file #>>0x04 byte 6 non-incrementing secondary index .XGn file #>>0x04 byte 7 secondary index .YGn file #>>>0x04 byte 8 incrementing secondary index .XGn file ## XBase database files #0 byte 0x02 #>8 leshort >0 #>>12 leshort 0 FoxBase #!:mime application/x-dbf #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x03 #!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x04 #!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASE IV no memo file #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x05 #!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASE V no memo file #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x30 #!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 Visual FoxPro #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x43 #!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FlagShip with memo var size #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x7b #!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBASEIV with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x83 #!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxBase+, dBaseIII+ with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x8b #!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBaseIV with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0x8e #!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 dBaseIV with SQL Table #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0xb3 #!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FlagShip with .dbt memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 byte 0xf5 #!:mime application/x-dbf #>8 leshort >0 #>>12 leshort 0 FoxPro with memo #>>>0x04 lelong 0 (no records) #>>>0x04 lelong >0 (%ld records) # #0 leshort 0x0006 DBase 3 index file # MS Access database 4 string Standard\ Jet\ DB Microsoft Access Database !:mime application/x-msaccess # TDB database from Samba et al - Martin Pool 0 string TDB\ file TDB database >32 lelong 0x2601196D version 6, little-endian >>36 lelong x hash size %d bytes # SE Linux policy database 0 lelong 0xf97cff8c SE Linux policy >16 lelong x v%d >20 lelong 1 MLS >24 lelong x %d symbols >28 lelong x %d ocons # ICE authority file data (Wolfram Kleff) 2 string ICE ICE authority data # X11 Xauthority file (Wolfram Kleff) 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data # From: Maxime Henrion # PostgreSQL's custom dump format, Maxime Henrion 0 string PGDMP PostgreSQL custom database dump >5 byte x - v%d >6 byte x \b.%d >5 beshort <0x101 \b-0 >5 beshort >0x100 >>7 byte x \b-%d # Type: Advanced Data Format (ADF) database # URL: http://www.grc.nasa.gov/WWW/cgns/adf/ # From: Nicolas Chauvat 0 string @@(#)ADF\ Database CGNS Advanced Data Format # Tokyo Cabinet magic data # http://tokyocabinet.sourceforge.net/index.html 0 string ToKyO\ CaBiNeT\n Tokyo Cabinet >14 string x \b (%s) >32 byte 0 \b, Hash !:mime application/x-tokyocabinet-hash >32 byte 1 \b, B+ tree !:mime application/x-tokyocabinet-btree >32 byte 2 \b, Fixed-length !:mime application/x-tokyocabinet-fixed >32 byte 3 \b, Table !:mime application/x-tokyocabinet-table >33 byte &1 \b, [open] >33 byte &2 \b, [fatal] >34 byte x \b, apow=%d >35 byte x \b, fpow=%d >36 byte &0x01 \b, [large] >36 byte &0x02 \b, [deflate] >36 byte &0x04 \b, [bzip] >36 byte &0x08 \b, [tcbs] >36 byte &0x10 \b, [excodec] >40 lequad x \b, bnum=%lld >48 lequad x \b, rnum=%lld >56 lequad x \b, fsiz=%lld @ 1.1.1.1 log @from ftp.astron.com @ text @@ 1.1.1.2 log @from ftp.astron.com. - many security related fixes - no MAXPATHLEN limits - fixed missing text specification on ascii magic - new ``pascal'' style string formats - whitespace comparison fix - more magic @ text @a2 1 # $File: database,v 1.26 2010/12/26 23:10:59 christos Exp $ a269 19 # G-IR database made by gobject-introspect toolset, # http://live.gnome.org/GObjectIntrospection 0 string GOBJ\nMETADATA\r\n\032 G-IR binary database >16 byte x \b, v%d >17 byte x \b.%d >20 leshort x \b, %d entries >22 leshort x \b/%d local # Type: QDBM Quick Database Manager # From: Benoit Sibaud 0 string \\[depot\\]\n\f Quick Database Manager, little endian 0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian # Type: TokyoCabinet database # URL: http://tokyocabinet.sourceforge.net/ # From: Benoit Sibaud 0 string ToKyO\ CaBiNeT\n TokyoCabinet database >14 string x (version %s) @ 1.1.1.3 log @from ftp.astron.com: - elf seeking fixes - improvements in cdf parsing - waitpid only for our child - magic fixes and additions @ text @d3 1 a3 1 # $File: database,v 1.28 2011/09/16 19:40:40 christos Exp $ a289 6 # From: Stéphane Blondon http://www.yaal.fr # Database file for Zope (done by FileStorage) 0 string FS21 Zope Object Database File Storage (data) # Cache file for the database of Zope (done by ClientStorage) 0 string ZEC3 Zope Object Database Client Cache File (data) @ 1.1.1.3.8.1 log @resync with head @ text @d3 1 a3 1 # $File: database,v 1.30 2012/08/26 10:23:30 christos Exp $ a205 2 4 string Standard\ ACE\ DB Microsoft Access Database !:mime application/x-msaccess a295 3 # IDA (Interactive Disassembler) database 0 string IDA1 IDA (Interactive Disassembler) database @ 1.1.1.3.8.2 log @resync from head @ text @d3 1 a3 1 # $File: database,v 1.33 2013/03/09 22:36:00 christos Exp $ d117 85 a201 235 # updated by Joerg Jenderek at Feb 2013 # http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm # http://www.clicketyclick.dk/databases/xbase/format/dbf.html # http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 0 ubelong&0x0000FFFF <0x00000C20 # skip Infocom game Z-machine >2 ubyte >0 # skip Androids *.xml >>3 ubyte >0 >>>3 ubyte <32 # 1 < version VV >>>>0 ubyte >1 # skip HELP.CA3 by test for reserved byte ( NULL ) >>>>>27 ubyte 0 # reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) #>>>>>30 ubeshort x 30NULL?%x # possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) >>>>>>24 ubelong&0xffFFFFff >0x01302000 # .DBF or .MDX >>>>>>24 ubelong&0xffFFFFff <0x01302001 # for Xbase Database file (*.DBF) reserved (NULL) for multi-user >>>>>>>24 ubelong&0xffFFFFff =0 # test for 2 reserved NULL bytes,transaction and encryption byte flag >>>>>>>>12 ubelong&0xFFFFfEfE 0 # test for MDX flag >>>>>>>>>28 ubyte x >>>>>>>>>28 ubyte&0xf8 0 # header size >= 32 >>>>>>>>>>8 uleshort >31 # skip PIC15736.PCX by test for language driver name or field name >>>>>>>>>>>32 ubyte >0 !:mime application/x-dbf #!:mime application/x-dbf; charset=unknown-8bit ?? #!:mime application/x-dbase >>>>>>>>>>>>0 use xbase-type # database file >>>>>>>>>>>>0 ubyte x \b DBF >>>>>>>>>>>>4 lelong 0 \b, no records >>>>>>>>>>>>4 lelong >0 \b, %ld record # plural s appended >>>>>>>>>>>>>4 lelong >1 \bs # http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF # 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) >>>>>>>>>>>>10 uleshort x * %d # file size = records * record size + header size >>>>>>>>>>>>1 ubyte x \b, update-date >>>>>>>>>>>>1 use xbase-date # http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx #>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x # 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? >>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x #>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file >>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX >>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT >>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer # 1st record offset + 1 = header size >>>>>>>>>>>>8 uleshort >0 >>>>>>>>>>>>(8.s+1) ubyte >0 >>>>>>>>>>>>>8 uleshort >0 \b, at offset %d >>>>>>>>>>>>>(8.s+1) ubyte >0 >>>>>>>>>>>>>>&-1 string >\0 1st record "%s" # for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) >>>>>>>24 ubelong&0x0133f7ff >0 # test for reserved NULL byte >>>>>>>>47 ubyte x # test for valid TAG key format (0x10 or 0) >>>>>>>>>559 ubyte&0xeF 0 # test MM <= 12 >>>>>>>>>45 ubeshort <0x0C20 >>>>>>>>>>45 ubyte >0 >>>>>>>>>>>46 ubyte <32 >>>>>>>>>>>>46 ubyte >0 #!:mime application/x-mdx >>>>>>>>>>>>>0 use xbase-type >>>>>>>>>>>>>0 ubyte x \b MDX >>>>>>>>>>>>>1 ubyte x \b, creation-date >>>>>>>>>>>>>1 use xbase-date >>>>>>>>>>>>>44 ubyte x \b, update-date >>>>>>>>>>>>>44 use xbase-date # No.of tags in use (1,2,5,12) >>>>>>>>>>>>>28 uleshort x \b, %d # No. of entries in tag (0x30) >>>>>>>>>>>>>25 ubyte x \b/%d tags # Length of tag >>>>>>>>>>>>>26 ubyte x * %d # 1st tag name_ >>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" # 2nd tag name #>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" # # Print the xBase names of different version variants 0 name xbase-type >0 ubyte <2 # 1 < version >0 ubyte >1 >>0 ubyte 0x02 FoxBase # FoxBase+/dBaseIII+, no memo >>0 ubyte 0x03 FoxBase+/dBase III # dBASE IV no memo file >>0 ubyte 0x04 dBase IV # dBASE V no memo file >>0 ubyte 0x05 dBase V >>0 ubyte 0x30 Visual FoxPro >>0 ubyte 0x31 Visual FoxPro, autoincrement # Visual FoxPro, with field type Varchar or Varbinary >>0 ubyte 0x32 Visual FoxPro, with field type Varchar # dBASE IV SQL, no memo;dbv memo var size (Flagship) >>0 ubyte 0x43 dBase IV, with SQL table # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x62 dBase IV, with SQL table # dBASE IV, with memo!! >>0 ubyte 0x7b dBase IV, with memo # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x82 dBase IV, with SQL system # FoxBase+/dBaseIII+ with memo .DBT! >>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT # VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file >>0 ubyte 0x87 VISUAL OBJECTS, with memo file # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT # dBASE IV with memo! >>0 ubyte 0x8B dBase IV, with memo .DBT # dBase IV with SQL Table,no memo? >>0 ubyte 0x8E dBase IV, with SQL table # .dbv and .dbt memo (Flagship)? >>0 ubyte 0xB3 Flagship # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xCA dBase IV with memo .DBT # dBASE IV with SQL table, with memo .DBT >>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT # HiPer-Six format;Clipper SIX, with SMT memo file >>0 ubyte 0xE5 Clipper SIX with memo # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xF4 dBase IV, with SQL table, with memo >>0 ubyte 0xF5 FoxPro with memo # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xFA FoxPro 2.x, with memo # unkown version (should not happen) >>0 default x xBase >>>0 ubyte x (0x%x) # flags in version byte # DBT flag (with dBASE III memo .DBT)!! # >>0 ubyte&0x80 >0 DBT_FLAG=%x # memo flag ?? # >>0 ubyte&0x08 >0 MEMO_FLAG=%x # SQL flag ?? # >>0 ubyte&0x70 >0 SQL_FLAG=%x # test and print the date of xBase .DBF .MDX 0 name xbase-date # inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 >0 ubelong x >1 ubyte <13 >>1 ubyte >0 >>>2 ubyte >0 >>>>2 ubyte <32 >>>>>0 ubyte x # YY is interpreted as 20YY or 19YY >>>>>>0 ubyte <100 \b %.2d # YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY >>>>>>0 ubyte >99 \b %d >>>>>1 ubyte x \b-%d >>>>>2 ubyte x \b-%d # dBase memo files .DBT or .FPT # http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 16 ubyte <4 >16 ubyte !2 >>16 ubyte !1 # next free block index is positive >>>0 ulelong >0 # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size >>>>17 ubelong&0xFFfdFE00 0x00000000 # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h >>>>>20 ubelong&0xFF01209B 0x00000000 # dBASE III >>>>>>16 ubyte 3 # dBASE III DBT >>>>>>>0 use xbase-memo-print # dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage >>>>>>16 ubyte 0 # dBASE IV DBT with DBF name or DBF garbage >>>>>>>8 ubelong >0x40000000 # skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block >>>>>>>>0 ulelong <0x01010002 >>>>>>>>>0 use xbase-memo-print >>>>>>>8 ubelong 0 # skip MM*DD*.bin by test for for reserved NULL byte >>>>>>>>508 ubelong 0 >>>>>>>>>0 use xbase-memo-print # garbage PCX , ZIP , JAR , XPI >>>>>>>8 default x # Print the information of dBase DBT or FoxPro FPT memo files 0 name xbase-memo-print >0 ubyte x # test version # memo file >>16 ubyte 3 dBase III DBT >>16 ubyte 0 >>>512 ubelong <0x00000003 FoxPro FPT # Size of blocks for FoxPro >>>>6 ubeshort x \b, blocks size %lu # Number of next available block for appending data for FoxPro >>>>0 ubelong =0 \b, next free block index %lu >>>>0 ubelong !0 \b, next free block index %lu >>>512 default x dBase IV DBT # DBF file name without extention >>>>8 string >\0 \b of %-.8s.DBF # size of blocks ; not reliable 0x2020204C #>>>>4 ulelong =0 \b, blocks size %lu >>>>4 ulelong !0 \b, blocks size %lu # Block length found 0 , 512 #>>>>20 uleshort =0 \b, block length %u >>>>20 uleshort !0 \b, block length %u # Number of next available block for appending data >>>>0 ulelong =0 \b, next free block index %lu >>>>0 ulelong !0 \b, next free block index %lu >>512 ubelong x >>>512 ubelong =0xFFFF0800 >>>>520 string >\0 \b, 1st used item "%s" # FoxPro >>>512 ubelong <3 # FoxPro memo >>>>512 ubelong =1 >>>>520 string >\0 \b, 1st used item "%s" >>>512 default x # may be deleted memo field >>>>512 string >\0 \b, 1st item "%s" # TODO: # DBASE index file *.NDX # DBASE Compound Index file *.CDX # dBASE IV Printer Driver *.PRF ## End of XBase database stuff d274 8 d293 1 a293 1 # From: Stephane Blondon http://www.yaal.fr @ 1.1.1.3.8.3 log @Rebase to HEAD as of a few days ago. @ text @d3 1 a3 1 # $File: database,v 1.41 2014/06/03 19:17:27 christos Exp $ d87 2 a88 26 0 string/b RRD\0 RRDTool DB >4 string/b x version %s >>10 short !0 16bit aligned >>>10 bedouble 8.642135e+130 big-endian >>>>18 short x 32bit long (m68k) >>10 short 0 >>>12 long !0 32bit aligned >>>>12 bedouble 8.642135e+130 big-endian >>>>>20 long 0 64bit long >>>>>20 long !0 32bit long >>>>12 ledouble 8.642135e+130 little-endian >>>>>24 long 0 64bit long >>>>>24 long !0 32bit long (i386) >>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian >>>>>24 short !0 32bit long (arm) >>8 quad 0 64bit aligned >>>16 bedouble 8.642135e+130 big-endian >>>>24 long 0 64bit long (s390x) >>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) >>>16 ledouble 8.642135e+130 little-endian >>>>28 long 0 64bit long (alpha/amd64/ia64) >>>>28 long !0 32bit long (armel/mipsel) d149 1 d156 1 a156 1 >>>>>>>>>>>>4 lelong >0 \b, %d record a215 1 !:mime application/x-dbf a217 1 !:mime application/x-dbf a219 1 !:mime application/x-dbf a220 1 !:mime application/x-dbf a221 1 !:mime application/x-dbf a223 1 !:mime application/x-dbf a225 1 !:mime application/x-dbf a227 1 #!:mime application/x-dbf a229 1 !:mime application/x-dbf a231 1 #!:mime application/x-dbf a233 1 !:mime application/x-dbf a235 1 !:mime application/x-dbf a237 1 #!:mime application/x-dbf a239 1 !:mime application/x-dbf a241 1 !:mime application/x-dbf a245 1 #!:mime application/x-dbf a247 1 !:mime application/x-dbf a249 1 !:mime application/x-dbf a251 1 #!:mime application/x-dbf a252 1 !:mime application/x-dbf d255 1 a255 2 #!:mime application/x-dbf # unknown version (should not happen) a256 1 !:mime application/x-dbf d306 1 a306 4 # real memo files should contain text here >>>>>>>>>520 ubelong >0x20202019 >>>>>>>>>>520 ubelong <0xFEFEFEFF >>>>>>>>>>>0 use xbase-memo-print d319 1 a319 1 >>>>6 ubeshort x \b, blocks size %u d321 2 a322 2 >>>>0 ubelong =0 \b, next free block index %u >>>>0 ubelong !0 \b, next free block index %u d324 1 a324 1 # DBF file name without extension d327 2 a328 2 #>>>>4 ulelong =0 \b, blocks size %u >>>>4 ulelong !0 \b, blocks size %u d333 2 a334 2 >>>>0 ulelong =0 \b, next free block index %u >>>>0 ulelong !0 \b, next free block index %u @ 1.1.1.3.2.1 log @sync with head @ text @d3 1 a3 1 # $File: database,v 1.30 2012/08/26 10:23:30 christos Exp $ a205 2 4 string Standard\ ACE\ DB Microsoft Access Database !:mime application/x-msaccess a295 3 # IDA (Interactive Disassembler) database 0 string IDA1 IDA (Interactive Disassembler) database @ 1.1.1.3.2.2 log @sync with head. for a reference, the tree before this commit was tagged as yamt-pagecache-tag8. this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments") @ text @d3 1 a3 1 # $File: database,v 1.35 2013/11/20 00:00:14 christos Exp $ d87 2 a88 2 0 string/b RRD\0 RRDTool DB >4 string/b x version %s d117 85 a201 238 # updated by Joerg Jenderek at Feb 2013 # http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm # http://www.clicketyclick.dk/databases/xbase/format/dbf.html # http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 0 ubelong&0x0000FFFF <0x00000C20 # skip Infocom game Z-machine >2 ubyte >0 # skip Androids *.xml >>3 ubyte >0 >>>3 ubyte <32 # 1 < version VV >>>>0 ubyte >1 # skip HELP.CA3 by test for reserved byte ( NULL ) >>>>>27 ubyte 0 # reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) #>>>>>30 ubeshort x 30NULL?%x # possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) >>>>>>24 ubelong&0xffFFFFff >0x01302000 # .DBF or .MDX >>>>>>24 ubelong&0xffFFFFff <0x01302001 # for Xbase Database file (*.DBF) reserved (NULL) for multi-user >>>>>>>24 ubelong&0xffFFFFff =0 # test for 2 reserved NULL bytes,transaction and encryption byte flag >>>>>>>>12 ubelong&0xFFFFfEfE 0 # test for MDX flag >>>>>>>>>28 ubyte x >>>>>>>>>28 ubyte&0xf8 0 # header size >= 32 >>>>>>>>>>8 uleshort >31 # skip PIC15736.PCX by test for language driver name or field name >>>>>>>>>>>32 ubyte >0 !:mime application/x-dbf #!:mime application/x-dbf; charset=unknown-8bit ?? #!:mime application/x-dbase >>>>>>>>>>>>0 use xbase-type # database file >>>>>>>>>>>>0 ubyte x \b DBF >>>>>>>>>>>>4 lelong 0 \b, no records >>>>>>>>>>>>4 lelong >0 \b, %ld record # plural s appended >>>>>>>>>>>>>4 lelong >1 \bs # http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF # 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) >>>>>>>>>>>>10 uleshort x * %d # file size = records * record size + header size >>>>>>>>>>>>1 ubyte x \b, update-date >>>>>>>>>>>>1 use xbase-date # http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx #>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x # 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? >>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x #>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file >>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX >>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT >>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer # 1st record offset + 1 = header size >>>>>>>>>>>>8 uleshort >0 >>>>>>>>>>>>(8.s+1) ubyte >0 >>>>>>>>>>>>>8 uleshort >0 \b, at offset %d >>>>>>>>>>>>>(8.s+1) ubyte >0 >>>>>>>>>>>>>>&-1 string >\0 1st record "%s" # for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) >>>>>>>24 ubelong&0x0133f7ff >0 # test for reserved NULL byte >>>>>>>>47 ubyte x # test for valid TAG key format (0x10 or 0) >>>>>>>>>559 ubyte&0xeF 0 # test MM <= 12 >>>>>>>>>45 ubeshort <0x0C20 >>>>>>>>>>45 ubyte >0 >>>>>>>>>>>46 ubyte <32 >>>>>>>>>>>>46 ubyte >0 #!:mime application/x-mdx >>>>>>>>>>>>>0 use xbase-type >>>>>>>>>>>>>0 ubyte x \b MDX >>>>>>>>>>>>>1 ubyte x \b, creation-date >>>>>>>>>>>>>1 use xbase-date >>>>>>>>>>>>>44 ubyte x \b, update-date >>>>>>>>>>>>>44 use xbase-date # No.of tags in use (1,2,5,12) >>>>>>>>>>>>>28 uleshort x \b, %d # No. of entries in tag (0x30) >>>>>>>>>>>>>25 ubyte x \b/%d tags # Length of tag >>>>>>>>>>>>>26 ubyte x * %d # 1st tag name_ >>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" # 2nd tag name #>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" # # Print the xBase names of different version variants 0 name xbase-type >0 ubyte <2 # 1 < version >0 ubyte >1 >>0 ubyte 0x02 FoxBase # FoxBase+/dBaseIII+, no memo >>0 ubyte 0x03 FoxBase+/dBase III # dBASE IV no memo file >>0 ubyte 0x04 dBase IV # dBASE V no memo file >>0 ubyte 0x05 dBase V >>0 ubyte 0x30 Visual FoxPro >>0 ubyte 0x31 Visual FoxPro, autoincrement # Visual FoxPro, with field type Varchar or Varbinary >>0 ubyte 0x32 Visual FoxPro, with field type Varchar # dBASE IV SQL, no memo;dbv memo var size (Flagship) >>0 ubyte 0x43 dBase IV, with SQL table # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x62 dBase IV, with SQL table # dBASE IV, with memo!! >>0 ubyte 0x7b dBase IV, with memo # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x82 dBase IV, with SQL system # FoxBase+/dBaseIII+ with memo .DBT! >>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT # VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file >>0 ubyte 0x87 VISUAL OBJECTS, with memo file # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT # dBASE IV with memo! >>0 ubyte 0x8B dBase IV, with memo .DBT # dBase IV with SQL Table,no memo? >>0 ubyte 0x8E dBase IV, with SQL table # .dbv and .dbt memo (Flagship)? >>0 ubyte 0xB3 Flagship # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xCA dBase IV with memo .DBT # dBASE IV with SQL table, with memo .DBT >>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT # HiPer-Six format;Clipper SIX, with SMT memo file >>0 ubyte 0xE5 Clipper SIX with memo # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xF4 dBase IV, with SQL table, with memo >>0 ubyte 0xF5 FoxPro with memo # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xFA FoxPro 2.x, with memo # unkown version (should not happen) >>0 default x xBase >>>0 ubyte x (0x%x) # flags in version byte # DBT flag (with dBASE III memo .DBT)!! # >>0 ubyte&0x80 >0 DBT_FLAG=%x # memo flag ?? # >>0 ubyte&0x08 >0 MEMO_FLAG=%x # SQL flag ?? # >>0 ubyte&0x70 >0 SQL_FLAG=%x # test and print the date of xBase .DBF .MDX 0 name xbase-date # inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 >0 ubelong x >1 ubyte <13 >>1 ubyte >0 >>>2 ubyte >0 >>>>2 ubyte <32 >>>>>0 ubyte x # YY is interpreted as 20YY or 19YY >>>>>>0 ubyte <100 \b %.2d # YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY >>>>>>0 ubyte >99 \b %d >>>>>1 ubyte x \b-%d >>>>>2 ubyte x \b-%d # dBase memo files .DBT or .FPT # http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 16 ubyte <4 >16 ubyte !2 >>16 ubyte !1 # next free block index is positive >>>0 ulelong >0 # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size >>>>17 ubelong&0xFFfdFE00 0x00000000 # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h >>>>>20 ubelong&0xFF01209B 0x00000000 # dBASE III >>>>>>16 ubyte 3 # dBASE III DBT >>>>>>>0 use xbase-memo-print # dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage >>>>>>16 ubyte 0 # dBASE IV DBT with DBF name or DBF garbage >>>>>>>8 ubelong >0x40000000 # skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block >>>>>>>>0 ulelong <0x01010002 >>>>>>>>>0 use xbase-memo-print >>>>>>>8 ubelong 0 # skip MM*DD*.bin by test for for reserved NULL byte >>>>>>>>508 ubelong 0 # real memo files should contain text here >>>>>>>>>520 ubelong >0x20202019 >>>>>>>>>>520 ubelong <0xFEFEFEFF >>>>>>>>>>>0 use xbase-memo-print # garbage PCX , ZIP , JAR , XPI >>>>>>>8 default x # Print the information of dBase DBT or FoxPro FPT memo files 0 name xbase-memo-print >0 ubyte x # test version # memo file >>16 ubyte 3 dBase III DBT >>16 ubyte 0 >>>512 ubelong <0x00000003 FoxPro FPT # Size of blocks for FoxPro >>>>6 ubeshort x \b, blocks size %lu # Number of next available block for appending data for FoxPro >>>>0 ubelong =0 \b, next free block index %lu >>>>0 ubelong !0 \b, next free block index %lu >>>512 default x dBase IV DBT # DBF file name without extention >>>>8 string >\0 \b of %-.8s.DBF # size of blocks ; not reliable 0x2020204C #>>>>4 ulelong =0 \b, blocks size %lu >>>>4 ulelong !0 \b, blocks size %lu # Block length found 0 , 512 #>>>>20 uleshort =0 \b, block length %u >>>>20 uleshort !0 \b, block length %u # Number of next available block for appending data >>>>0 ulelong =0 \b, next free block index %lu >>>>0 ulelong !0 \b, next free block index %lu >>512 ubelong x >>>512 ubelong =0xFFFF0800 >>>>520 string >\0 \b, 1st used item "%s" # FoxPro >>>512 ubelong <3 # FoxPro memo >>>>512 ubelong =1 >>>>520 string >\0 \b, 1st used item "%s" >>>512 default x # may be deleted memo field >>>>512 string >\0 \b, 1st item "%s" # TODO: # DBASE index file *.NDX # DBASE Compound Index file *.CDX # dBASE IV Printer Driver *.PRF ## End of XBase database stuff d274 8 d293 1 a293 1 # From: Stephane Blondon http://www.yaal.fr @ 1.1.1.4 log @from ftp.astron.com @ text @d3 1 a3 1 # $File: database,v 1.30 2012/08/26 10:23:30 christos Exp $ a205 2 4 string Standard\ ACE\ DB Microsoft Access Database !:mime application/x-msaccess a295 3 # IDA (Interactive Disassembler) database 0 string IDA1 IDA (Interactive Disassembler) database @ 1.1.1.5 log @import file-5.14 changes are "name" + "use" keyword features, bug fixes @ text @d3 1 a3 1 # $File: database,v 1.33 2013/03/09 22:36:00 christos Exp $ d117 85 a201 235 # updated by Joerg Jenderek at Feb 2013 # http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm # http://www.clicketyclick.dk/databases/xbase/format/dbf.html # http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 0 ubelong&0x0000FFFF <0x00000C20 # skip Infocom game Z-machine >2 ubyte >0 # skip Androids *.xml >>3 ubyte >0 >>>3 ubyte <32 # 1 < version VV >>>>0 ubyte >1 # skip HELP.CA3 by test for reserved byte ( NULL ) >>>>>27 ubyte 0 # reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) #>>>>>30 ubeshort x 30NULL?%x # possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) >>>>>>24 ubelong&0xffFFFFff >0x01302000 # .DBF or .MDX >>>>>>24 ubelong&0xffFFFFff <0x01302001 # for Xbase Database file (*.DBF) reserved (NULL) for multi-user >>>>>>>24 ubelong&0xffFFFFff =0 # test for 2 reserved NULL bytes,transaction and encryption byte flag >>>>>>>>12 ubelong&0xFFFFfEfE 0 # test for MDX flag >>>>>>>>>28 ubyte x >>>>>>>>>28 ubyte&0xf8 0 # header size >= 32 >>>>>>>>>>8 uleshort >31 # skip PIC15736.PCX by test for language driver name or field name >>>>>>>>>>>32 ubyte >0 !:mime application/x-dbf #!:mime application/x-dbf; charset=unknown-8bit ?? #!:mime application/x-dbase >>>>>>>>>>>>0 use xbase-type # database file >>>>>>>>>>>>0 ubyte x \b DBF >>>>>>>>>>>>4 lelong 0 \b, no records >>>>>>>>>>>>4 lelong >0 \b, %ld record # plural s appended >>>>>>>>>>>>>4 lelong >1 \bs # http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF # 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) >>>>>>>>>>>>10 uleshort x * %d # file size = records * record size + header size >>>>>>>>>>>>1 ubyte x \b, update-date >>>>>>>>>>>>1 use xbase-date # http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx #>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x # 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? >>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x #>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file >>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX >>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT >>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer # 1st record offset + 1 = header size >>>>>>>>>>>>8 uleshort >0 >>>>>>>>>>>>(8.s+1) ubyte >0 >>>>>>>>>>>>>8 uleshort >0 \b, at offset %d >>>>>>>>>>>>>(8.s+1) ubyte >0 >>>>>>>>>>>>>>&-1 string >\0 1st record "%s" # for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) >>>>>>>24 ubelong&0x0133f7ff >0 # test for reserved NULL byte >>>>>>>>47 ubyte x # test for valid TAG key format (0x10 or 0) >>>>>>>>>559 ubyte&0xeF 0 # test MM <= 12 >>>>>>>>>45 ubeshort <0x0C20 >>>>>>>>>>45 ubyte >0 >>>>>>>>>>>46 ubyte <32 >>>>>>>>>>>>46 ubyte >0 #!:mime application/x-mdx >>>>>>>>>>>>>0 use xbase-type >>>>>>>>>>>>>0 ubyte x \b MDX >>>>>>>>>>>>>1 ubyte x \b, creation-date >>>>>>>>>>>>>1 use xbase-date >>>>>>>>>>>>>44 ubyte x \b, update-date >>>>>>>>>>>>>44 use xbase-date # No.of tags in use (1,2,5,12) >>>>>>>>>>>>>28 uleshort x \b, %d # No. of entries in tag (0x30) >>>>>>>>>>>>>25 ubyte x \b/%d tags # Length of tag >>>>>>>>>>>>>26 ubyte x * %d # 1st tag name_ >>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" # 2nd tag name #>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" # # Print the xBase names of different version variants 0 name xbase-type >0 ubyte <2 # 1 < version >0 ubyte >1 >>0 ubyte 0x02 FoxBase # FoxBase+/dBaseIII+, no memo >>0 ubyte 0x03 FoxBase+/dBase III # dBASE IV no memo file >>0 ubyte 0x04 dBase IV # dBASE V no memo file >>0 ubyte 0x05 dBase V >>0 ubyte 0x30 Visual FoxPro >>0 ubyte 0x31 Visual FoxPro, autoincrement # Visual FoxPro, with field type Varchar or Varbinary >>0 ubyte 0x32 Visual FoxPro, with field type Varchar # dBASE IV SQL, no memo;dbv memo var size (Flagship) >>0 ubyte 0x43 dBase IV, with SQL table # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x62 dBase IV, with SQL table # dBASE IV, with memo!! >>0 ubyte 0x7b dBase IV, with memo # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x82 dBase IV, with SQL system # FoxBase+/dBaseIII+ with memo .DBT! >>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT # VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file >>0 ubyte 0x87 VISUAL OBJECTS, with memo file # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT # dBASE IV with memo! >>0 ubyte 0x8B dBase IV, with memo .DBT # dBase IV with SQL Table,no memo? >>0 ubyte 0x8E dBase IV, with SQL table # .dbv and .dbt memo (Flagship)? >>0 ubyte 0xB3 Flagship # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xCA dBase IV with memo .DBT # dBASE IV with SQL table, with memo .DBT >>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT # HiPer-Six format;Clipper SIX, with SMT memo file >>0 ubyte 0xE5 Clipper SIX with memo # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xF4 dBase IV, with SQL table, with memo >>0 ubyte 0xF5 FoxPro with memo # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx #>>0 ubyte 0xFA FoxPro 2.x, with memo # unkown version (should not happen) >>0 default x xBase >>>0 ubyte x (0x%x) # flags in version byte # DBT flag (with dBASE III memo .DBT)!! # >>0 ubyte&0x80 >0 DBT_FLAG=%x # memo flag ?? # >>0 ubyte&0x08 >0 MEMO_FLAG=%x # SQL flag ?? # >>0 ubyte&0x70 >0 SQL_FLAG=%x # test and print the date of xBase .DBF .MDX 0 name xbase-date # inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 >0 ubelong x >1 ubyte <13 >>1 ubyte >0 >>>2 ubyte >0 >>>>2 ubyte <32 >>>>>0 ubyte x # YY is interpreted as 20YY or 19YY >>>>>>0 ubyte <100 \b %.2d # YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY >>>>>>0 ubyte >99 \b %d >>>>>1 ubyte x \b-%d >>>>>2 ubyte x \b-%d # dBase memo files .DBT or .FPT # http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 16 ubyte <4 >16 ubyte !2 >>16 ubyte !1 # next free block index is positive >>>0 ulelong >0 # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size >>>>17 ubelong&0xFFfdFE00 0x00000000 # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h >>>>>20 ubelong&0xFF01209B 0x00000000 # dBASE III >>>>>>16 ubyte 3 # dBASE III DBT >>>>>>>0 use xbase-memo-print # dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage >>>>>>16 ubyte 0 # dBASE IV DBT with DBF name or DBF garbage >>>>>>>8 ubelong >0x40000000 # skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block >>>>>>>>0 ulelong <0x01010002 >>>>>>>>>0 use xbase-memo-print >>>>>>>8 ubelong 0 # skip MM*DD*.bin by test for for reserved NULL byte >>>>>>>>508 ubelong 0 >>>>>>>>>0 use xbase-memo-print # garbage PCX , ZIP , JAR , XPI >>>>>>>8 default x # Print the information of dBase DBT or FoxPro FPT memo files 0 name xbase-memo-print >0 ubyte x # test version # memo file >>16 ubyte 3 dBase III DBT >>16 ubyte 0 >>>512 ubelong <0x00000003 FoxPro FPT # Size of blocks for FoxPro >>>>6 ubeshort x \b, blocks size %lu # Number of next available block for appending data for FoxPro >>>>0 ubelong =0 \b, next free block index %lu >>>>0 ubelong !0 \b, next free block index %lu >>>512 default x dBase IV DBT # DBF file name without extention >>>>8 string >\0 \b of %-.8s.DBF # size of blocks ; not reliable 0x2020204C #>>>>4 ulelong =0 \b, blocks size %lu >>>>4 ulelong !0 \b, blocks size %lu # Block length found 0 , 512 #>>>>20 uleshort =0 \b, block length %u >>>>20 uleshort !0 \b, block length %u # Number of next available block for appending data >>>>0 ulelong =0 \b, next free block index %lu >>>>0 ulelong !0 \b, next free block index %lu >>512 ubelong x >>>512 ubelong =0xFFFF0800 >>>>520 string >\0 \b, 1st used item "%s" # FoxPro >>>512 ubelong <3 # FoxPro memo >>>>512 ubelong =1 >>>>520 string >\0 \b, 1st used item "%s" >>>512 default x # may be deleted memo field >>>>512 string >\0 \b, 1st item "%s" # TODO: # DBASE index file *.NDX # DBASE Compound Index file *.CDX # dBASE IV Printer Driver *.PRF ## End of XBase database stuff d274 8 d293 1 a293 1 # From: Stephane Blondon http://www.yaal.fr @ 1.1.1.6 log @from ftp.astron.com, this is a bug fix release: * always leave magic file loaded, don't unload for magic_check, etc. * fix default encoding to binary instead of unknown which broke recently * handle empty and one byte files, less specially so that --mime-encoding does not break completely. * fix erroneous non-zero exit code from non-existant file and message * add CDF MSI file detection (Guy Helmer) @ text @d3 1 a3 1 # $File: database,v 1.35 2013/11/20 00:00:14 christos Exp $ d87 2 a88 2 0 string/b RRD\0 RRDTool DB >4 string/b x version %s d306 1 a306 4 # real memo files should contain text here >>>>>>>>>520 ubelong >0x20202019 >>>>>>>>>>520 ubelong <0xFEFEFEFF >>>>>>>>>>>0 use xbase-memo-print @ 1.1.1.6.2.1 log @Rebase. @ text @d3 1 a3 1 # $File: database,v 1.41 2014/06/03 19:17:27 christos Exp $ a88 24 >>10 short !0 16bit aligned >>>10 bedouble 8.642135e+130 big-endian >>>>18 short x 32bit long (m68k) >>10 short 0 >>>12 long !0 32bit aligned >>>>12 bedouble 8.642135e+130 big-endian >>>>>20 long 0 64bit long >>>>>20 long !0 32bit long >>>>12 ledouble 8.642135e+130 little-endian >>>>>24 long 0 64bit long >>>>>24 long !0 32bit long (i386) >>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian >>>>>24 short !0 32bit long (arm) >>8 quad 0 64bit aligned >>>16 bedouble 8.642135e+130 big-endian >>>>24 long 0 64bit long (s390x) >>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) >>>16 ledouble 8.642135e+130 little-endian >>>>28 long 0 64bit long (alpha/amd64/ia64) >>>>28 long !0 32bit long (armel/mipsel) d149 1 d156 1 a156 1 >>>>>>>>>>>>4 lelong >0 \b, %d record a215 1 !:mime application/x-dbf a217 1 !:mime application/x-dbf a219 1 !:mime application/x-dbf a220 1 !:mime application/x-dbf a221 1 !:mime application/x-dbf a223 1 !:mime application/x-dbf a225 1 !:mime application/x-dbf a227 1 #!:mime application/x-dbf a229 1 !:mime application/x-dbf a231 1 #!:mime application/x-dbf a233 1 !:mime application/x-dbf a235 1 !:mime application/x-dbf a237 1 #!:mime application/x-dbf a239 1 !:mime application/x-dbf a241 1 !:mime application/x-dbf a245 1 #!:mime application/x-dbf a247 1 !:mime application/x-dbf a249 1 !:mime application/x-dbf a251 1 #!:mime application/x-dbf a252 1 !:mime application/x-dbf d255 1 a255 2 #!:mime application/x-dbf # unknown version (should not happen) a256 1 !:mime application/x-dbf d322 1 a322 1 >>>>6 ubeshort x \b, blocks size %u d324 2 a325 2 >>>>0 ubelong =0 \b, next free block index %u >>>>0 ubelong !0 \b, next free block index %u d327 1 a327 1 # DBF file name without extension d330 2 a331 2 #>>>>4 ulelong =0 \b, blocks size %u >>>>4 ulelong !0 \b, blocks size %u d336 2 a337 2 >>>>0 ulelong =0 \b, next free block index %u >>>>0 ulelong !0 \b, next free block index %u @ 1.1.1.7 log @import file-5.19 2014-06-09 9:04 Christos Zoulas * Misc buffer overruns and missing buffer size tests in cdf parsing (Francisco Alonso, Jan Kaluza) 2014-06-02 14:50 Christos Zoulas * Enforce limit of 8K on regex searches that have no limits * Allow the l modifier for regex to mean line count. Default to byte count. If line count is specified, assume a max of 80 characters per line to limit the byte count. * Don't allow conversions to be used for dates, allowing the mask field to be used as an offset. 2014-05-30 12:51 Christos Zoulas * Make the range operator limit the length of the regex search. 2014-05-14 19:23 Christos Zoulas * PR/347: Windows fixes * PR/352: Hangul word processor recognition * PR/354: Encoding irregularities in text files 2014-05-06 6:12 Christos Zoulas * Fix uninitialized title in CDF files (Jan Kaluza) 2014-05-04 14:55 Christos Zoulas * PR/351: Fix compilation of empty files 2014-04-30 17:39 Christos Zoulas * Fix integer formats: We don't specify 'l' or 'h' and 'hh' specifiers anymore, only 'll' for quads and nothing for the rest. This is so that magic writing is simpler. 2014-04-01 15:25 Christos Zoulas * PR/341: Jan Kaluza, fix memory leak * PR/342: Jan Kaluza, fix out of bounds read 2014-03-28 15:25 Christos Zoulas * Fix issue with long formats not matching fmtcheck @ text @d3 1 a3 1 # $File: database,v 1.41 2014/06/03 19:17:27 christos Exp $ a88 24 >>10 short !0 16bit aligned >>>10 bedouble 8.642135e+130 big-endian >>>>18 short x 32bit long (m68k) >>10 short 0 >>>12 long !0 32bit aligned >>>>12 bedouble 8.642135e+130 big-endian >>>>>20 long 0 64bit long >>>>>20 long !0 32bit long >>>>12 ledouble 8.642135e+130 little-endian >>>>>24 long 0 64bit long >>>>>24 long !0 32bit long (i386) >>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian >>>>>24 short !0 32bit long (arm) >>8 quad 0 64bit aligned >>>16 bedouble 8.642135e+130 big-endian >>>>24 long 0 64bit long (s390x) >>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) >>>16 ledouble 8.642135e+130 little-endian >>>>28 long 0 64bit long (alpha/amd64/ia64) >>>>28 long !0 32bit long (armel/mipsel) d149 1 d156 1 a156 1 >>>>>>>>>>>>4 lelong >0 \b, %d record a215 1 !:mime application/x-dbf a217 1 !:mime application/x-dbf a219 1 !:mime application/x-dbf a220 1 !:mime application/x-dbf a221 1 !:mime application/x-dbf a223 1 !:mime application/x-dbf a225 1 !:mime application/x-dbf a227 1 #!:mime application/x-dbf a229 1 !:mime application/x-dbf a231 1 #!:mime application/x-dbf a233 1 !:mime application/x-dbf a235 1 !:mime application/x-dbf a237 1 #!:mime application/x-dbf a239 1 !:mime application/x-dbf a241 1 !:mime application/x-dbf a245 1 #!:mime application/x-dbf a247 1 !:mime application/x-dbf a249 1 !:mime application/x-dbf a251 1 #!:mime application/x-dbf a252 1 !:mime application/x-dbf d255 1 a255 2 #!:mime application/x-dbf # unknown version (should not happen) a256 1 !:mime application/x-dbf d322 1 a322 1 >>>>6 ubeshort x \b, blocks size %u d324 2 a325 2 >>>>0 ubelong =0 \b, next free block index %u >>>>0 ubelong !0 \b, next free block index %u d327 1 a327 1 # DBF file name without extension d330 2 a331 2 #>>>>4 ulelong =0 \b, blocks size %u >>>>4 ulelong !0 \b, blocks size %u d336 2 a337 2 >>>>0 ulelong =0 \b, next free block index %u >>>>0 ulelong !0 \b, next free block index %u @ 1.1.1.8 log @import file-5.20; bug fixes and better image magic descriptions. @ text @d3 1 a3 1 # $File: database,v 1.42 2014/08/19 14:18:04 christos Exp $ d12 1 a12 1 0 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit d14 1 a14 9 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old !:mime application/x-gdbm 0 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit !:mime application/x-gdbm 0 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit !:mime application/x-gdbm 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old !:mime application/x-gdbm 0 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit @ 1.1.1.9 log @Import file-5.22 @ text @d3 1 a3 1 # $File: database,v 1.43 2014/10/28 15:47:39 christos Exp $ d213 1 a213 1 >>>>>>>>47 ubyte 0 d217 4 a220 4 >>>>>>>>>>45 ubeshort <0x0C20 >>>>>>>>>>>45 ubyte >0 >>>>>>>>>>>>46 ubyte <32 >>>>>>>>>>>>>46 ubyte >0 d222 6 a227 6 >>>>>>>>>>>>>>0 use xbase-type >>>>>>>>>>>>>>0 ubyte x \b MDX >>>>>>>>>>>>>>1 ubyte x \b, creation-date >>>>>>>>>>>>>>1 use xbase-date >>>>>>>>>>>>>>44 ubyte x \b, update-date >>>>>>>>>>>>>>44 use xbase-date d229 1 a229 1 >>>>>>>>>>>>>>28 uleshort x \b, %d d231 1 a231 1 >>>>>>>>>>>>>>25 ubyte x \b/%d tags d233 1 a233 1 >>>>>>>>>>>>>>26 ubyte x * %d d348 2 a349 2 >>>>>>>0 use dbase3-memo-print # dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage d351 6 a356 10 # unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF >>>>>>>20 uleshort 0 # FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage >>>>>>>>8 ulong =0 >>>>>>>>>6 ubeshort >0 # skip emacs.PIF >>>>>>>>>>4 ushort 0 >>>>>>>>>>>0 use foxpro-memo-print # dBASE III DBT , garbage >>>>>>>>>6 ubeshort 0 d358 30 a387 25 >>>>>>>>>>510 ubeshort 0 # skip TK-DOS11.img image by looking for memo text >>>>>>>>>>>512 ubelong <0xfeffff03 # skip EFI executables by looking for memo text >>>>>>>>>>>>512 ubelong >0x1F202020 >>>>>>>>>>>>>513 ubyte >0 # unusual dBASE III DBT like adressen.dbt >>>>>>>>>>>>>>0 use dbase3-memo-print # dBASE III DBT like angest.dbt, or garbage PCX DBF >>>>>>>>8 ubelong !0 # skip PCX and some DBF by test for for reserved NULL bytes >>>>>>>>>510 ubeshort 0 # skip some DBF by test of invalid version >>>>>>>>>>0 ubyte >5 >>>>>>>>>>>0 ubyte <48 >>>>>>>>>>>>0 use dbase3-memo-print # dBASE IV DBT with positive block size >>>>>>>20 uleshort >0 >>>>>>>>0 use dbase4-memo-print # Print the information of dBase III DBT memo file 0 name dbase3-memo-print >0 ubyte x dBase III DBT # instead 3 as version number 0 for unusual examples like biblio.dbt >16 ubyte !3 \b, version number %u d389 13 a401 57 #>0 lelong =0 \b, next free block index %u >0 lelong !0 \b, next free block index %u # no positiv block length #>20 uleshort =0 \b, block length %u >20 uleshort !0 \b, block length %u # dBase III memo field terminated by \032\032 >512 string >\0 \b, 1st item "%s" # Print the information of dBase IV DBT memo file 0 name dbase4-memo-print >0 lelong x dBase IV DBT # 8 character shorted main name of coresponding dBASE IV DBF file >8 ubelong >0x20000000 # skip unusual like for angest.dbt >>20 uleshort >0 >>>8 string >\0 \b of %-.8s.DBF # value 0 implies 512 as size #>4 ulelong =0 \b, blocks size %u # size of blocks not reliable like 0x2020204C in angest.dbt >4 ulelong !0 >>4 ulelong&0x0000003f 0 \b, blocks size %u # dBase IV DBT with positive block length (found 512 , 1024) >20 uleshort >0 \b, block length %u # next available block #>0 lelong =0 \b, next free block index %u >0 lelong !0 \b, next free block index %u >20 uleshort >0 >>(20.s) ubelong x >>>&-4 use dbase4-memofield-print # unusual dBase IV DBT without block length (implies 512 as length) >20 uleshort =0 >>512 ubelong x >>>&-4 use dbase4-memofield-print # Print the information of dBase IV memo field 0 name dbase4-memofield-print # free dBase IV memo field >0 ubelong !0xFFFF0800 >>0 lelong x \b, next free block %u >>4 lelong x \b, next used block %u # used dBase IV memo field >0 ubelong =0xFFFF0800 # length of memo field >>4 lelong x \b, field length %d >>>8 string >\0 \b, 1st used item "%s" # Print the information of FoxPro FPT memo file 0 name foxpro-memo-print >0 belong x FoxPro FPT # Size of blocks for FoxPro ( 64,256 ) >6 ubeshort x \b, blocks size %u # next available block #>0 belong =0 \b, next free block index %u >0 belong !0 \b, next free block index %u # field type ( 0~picture, 1~memo, 2~object ) >512 ubelong <3 \b, field type %u # length of memo field >512 ubelong 1 >>516 belong >0 \b, field length %d >>>520 string >\0 \b, 1st item "%s" @ 1.1.1.9.4.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: database,v 1.49 2016/06/11 17:01:51 christos Exp $ d380 1 a380 4 # dBASE IV DBT with valid block length like 512, 1024 # multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero >>>>>>>>20 uleshort&0x800f 0 >>>>>>>>>0 use dbase4-memo-print a397 2 !:mime application/x-dbt !:ext dbt a457 46 # From: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine # Reference: https://github.com/libyal/libesedb/archive/master.zip # libesedb-master/documentation/ # Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc # Note: also known as "JET Blue". Used by numerous Windows components such as # Windows Search, Mail, Exchange and Active Directory. 4 ubelong 0xefcdab89 # unknown1 >132 ubelong 0 Extensible storage engine !:mime application/x-ms-ese # file_type 0~database 1~stream >>12 ulelong 0 DataBase # Security DataBase (sdb) !:ext edb/sdb >>12 ulelong 1 STreaMing !:ext stm # format_version 620h >>8 uleshort x \b, version 0x%x >>10 uleshort >0 revision 0x%4.4x >>0 ubelong x \b, checksum 0x%8.8x # Page size 4096 8192 32768 >>236 ulequad x \b, page size %lld # database_state >>52 ulelong 1 \b, JustCreated >>52 ulelong 2 \b, DirtyShutdown #>>52 ulelong 3 \b, CleanShutdown >>52 ulelong 4 \b, BeingConverted >>52 ulelong 5 \b, ForceDetach # Windows NT major version when the databases indexes were updated. >>216 ulelong x \b, Windows version %d # Windows NT minor version >>220 ulelong x \b.%d # From: Joerg Jenderek # URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility # Note: files contain application compatibility fixes, application compatibility modes and application help messages. 8 string sdbf >7 ubyte 0 # TAG_TYPE_LIST+TAG_INDEXES >>12 uleshort 0x7802 Windows application compatibility Shim DataBase # version? 2 3 #>>>0 ulelong x \b, version %d !:mime application/x-ms-sdb !:ext sdb d536 1 a536 3 0 string FS21 Zope Object Database File Storage v3 (data) 0 string FS30 Zope Object Database File Storage v4 (data) a541 30 # Hopper (reverse engineering tool) http://www.hopperapp.com/ 0 string hopperdb Hopper database # URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) # Reference: http://www.provue.com/Panorama/ # From: Joerg Jenderek # NOTE: test only versions 4 and 6.0 with Windows # length of Panorama database name 5 ubyte >0 # look after database name for "some" null bits >(5.B+7) ubelong&0xF3ffF000 0 # look for first keyword >>&1 search/2 DESIGN Panorama database #!:mime application/x-panorama-database !:apple KASXZEPD !:ext pan # database name >>>5 pstring x \b, "%s" # # # askSam Database by Stefan A. Haubenthal 0 string askw40\0 askSam DB # # # MUIbase Database Tool by Stefan A. Haubenthal 0 string MBSTV\040 MUIbase DB >6 string x version %s @ 1.1.1.9.2.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: database,v 1.49 2016/06/11 17:01:51 christos Exp $ d380 1 a380 4 # dBASE IV DBT with valid block length like 512, 1024 # multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero >>>>>>>>20 uleshort&0x800f 0 >>>>>>>>>0 use dbase4-memo-print a397 2 !:mime application/x-dbt !:ext dbt a457 46 # From: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine # Reference: https://github.com/libyal/libesedb/archive/master.zip # libesedb-master/documentation/ # Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc # Note: also known as "JET Blue". Used by numerous Windows components such as # Windows Search, Mail, Exchange and Active Directory. 4 ubelong 0xefcdab89 # unknown1 >132 ubelong 0 Extensible storage engine !:mime application/x-ms-ese # file_type 0~database 1~stream >>12 ulelong 0 DataBase # Security DataBase (sdb) !:ext edb/sdb >>12 ulelong 1 STreaMing !:ext stm # format_version 620h >>8 uleshort x \b, version 0x%x >>10 uleshort >0 revision 0x%4.4x >>0 ubelong x \b, checksum 0x%8.8x # Page size 4096 8192 32768 >>236 ulequad x \b, page size %lld # database_state >>52 ulelong 1 \b, JustCreated >>52 ulelong 2 \b, DirtyShutdown #>>52 ulelong 3 \b, CleanShutdown >>52 ulelong 4 \b, BeingConverted >>52 ulelong 5 \b, ForceDetach # Windows NT major version when the databases indexes were updated. >>216 ulelong x \b, Windows version %d # Windows NT minor version >>220 ulelong x \b.%d # From: Joerg Jenderek # URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility # Note: files contain application compatibility fixes, application compatibility modes and application help messages. 8 string sdbf >7 ubyte 0 # TAG_TYPE_LIST+TAG_INDEXES >>12 uleshort 0x7802 Windows application compatibility Shim DataBase # version? 2 3 #>>>0 ulelong x \b, version %d !:mime application/x-ms-sdb !:ext sdb d536 1 a536 3 0 string FS21 Zope Object Database File Storage v3 (data) 0 string FS30 Zope Object Database File Storage v4 (data) a541 30 # Hopper (reverse engineering tool) http://www.hopperapp.com/ 0 string hopperdb Hopper database # URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) # Reference: http://www.provue.com/Panorama/ # From: Joerg Jenderek # NOTE: test only versions 4 and 6.0 with Windows # length of Panorama database name 5 ubyte >0 # look after database name for "some" null bits >(5.B+7) ubelong&0xF3ffF000 0 # look for first keyword >>&1 search/2 DESIGN Panorama database #!:mime application/x-panorama-database !:apple KASXZEPD !:ext pan # database name >>>5 pstring x \b, "%s" # # # askSam Database by Stefan A. Haubenthal 0 string askw40\0 askSam DB # # # MUIbase Database Tool by Stefan A. Haubenthal 0 string MBSTV\040 MUIbase DB >6 string x version %s @ 1.1.1.10 log @2017-02-10 12:24 Christos Zoulas * release 5.30 2017-02-07 23:27 Christos Zoulas * If we exceeded the offset in a search return no match (Christoph Biedl) * Be more lenient on corrupt CDF files (Christoph Biedl) 2017-02-04 16:46 Christos Zoulas * pacify ubsan sign extension (oss-fuzz/524) 2017-02-01 12:42 Christos Zoulas * off by one in cdf parsing (PR/593) * report debugging sections in elf (PR/591) 2016-11-06 10:52 Christos Zoulas * Allow @@@@@@ in extensions * Add missing overflow check in der magic (Jonas Wagner) 2016-10-25 10:40 Christos Zoulas * release 5.29 2016-10-24 11:20 Christos Zoulas * der getlength overflow (Jonas Wagner) * multiple magic file load failure (Christoph Biedl) 2016-10-17 11:26 Christos Zoulas * CDF parsing improvements (Guy Helmer) 2016-07-20 7:26 Christos Zoulas * Add support for signed indirect offsets 2016-07-18 7:41 Christos Zoulas * cat /dev/null | file - should print empty (Christoph Biedl) 2016-07-05 15:20 Christos Zoulas * Bump string size from 64 to 96. 2016-06-13 20:20 Christos Zoulas * PR/556: Fix separators on annotations. 2016-06-13 19:40 Christos Zoulas * release 5.28 * fix leak on allocation failure 2016-06-01 1:20 Christos Zoulas * PR/555: Avoid overflow for offset > nbytes * PR/550: Segv on DER parsing: - use the correct variable for length - set offset to 0 on failure. 2016-05-13 12:00 Christos Zoulas * release 5.27 2016-04-18 9:35 Christos Zoulas * Errors comparing DER entries or computing offsets are just indications of malformed non-DER files. Don't print them. * Offset comparison was off-by-one. * Fix compression code (Werner Fink) * Put new bytes constant in the right file (not the generated one) 2016-04-16 18:34 Christos Zoulas * release 5.26 2016-03-31 13:50 Christos Zoulas * make the number of bytes read from files configurable. 2016-03-21 13:40 Christos Zoulas * Add bounds checks for DER code (discovered by Thomas Jarosch) * Change indirect recursion limit to indirect use count and bump from 15 to 50 to prevent abuse. 2016-03-13 20:39 Christos Zoulas * Add -00 which prints filename\0description\0 2016-03-01 13:28 Christos Zoulas * Fix ID3 indirect parsing 2016-01-19 10:18 Christos Zoulas * add DER parsing capability 2015-11-13 10:35 Christos Zoulas * provide dprintf(3) for the OS's that don't have it. 2015-11-11 16:25 Christos Zoulas * redo the compression code report decompression errors 2015-11-10 23:25 Christos Zoulas * REG_STARTEND code is not working as expected, delete it. 2015-11-09 16:05 Christos Zoulas * Add zlib support if we have it. 2015-11-05 11:22 Christos Zoulas * PR/492: compression forking was broken with magic_buffer. 2015-09-16 9:50 Christos Zoulas * release 5.25 2015-09-11 13:25 Christos Zoulas * add a limit to the length of regex searches 2015-09-08 9:50 Christos Zoulas * fix problems with --parameter (Christoph Biedl) 2015-07-11 10:35 Christos Zoulas * Windows fixes PR/466 (Jason Hood) 2015-07-09 10:35 Christos Zoulas * release 5.24 2015-06-11 8:52 Christos Zoulas * redo long option encoding to fix off-by-one in 5.23 2015-06-10 13:50 Christos Zoulas * release 5.23 2015-06-09 16:10 Christos Zoulas * Fix issue with regex range for magic with offset * Always return true from mget with USE (success to mget not match indication). Fixes mime evaluation after USE magic * PR/459: Don't insert magic entries to the list if there are parsing errors for them. 2015-06-03 16:00 Christos Zoulas * PR/455: Add utf-7 encoding 2015-06-03 14:30 Christos Zoulas * PR/455: Implement -Z, look inside, but don't report on compression * PR/454: Fix allocation error on bad magic. 2015-05-29 10:30 Christos Zoulas * handle MAGIC_CONTINUE everywhere, not just in softmagic 2015-05-21 14:30 Christos Zoulas * don't print descriptions for NAME types when mime. 2015-04-09 15:59 Christos Zoulas * Add --extension to list the known extensions for this file type Idea by Andrew J Roazen 2015-02-14 12:23 Christos Zoulas * Bump file search buffer size to 1M. 2015-01-09 14:35 Christos Zoulas * Fix multiple issues with date formats reported by Christoph Biedl: - T_LOCAL meaning was reversed - Arithmetic did not work Also stop adjusting daylight savings for gmt printing. 2015-01-05 13:00 Christos Zoulas * PR/411: Fix memory corruption from corrupt cdf file. @ text @d3 1 a3 1 # $File: database,v 1.49 2016/06/11 17:01:51 christos Exp $ d380 1 a380 4 # dBASE IV DBT with valid block length like 512, 1024 # multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero >>>>>>>>20 uleshort&0x800f 0 >>>>>>>>>0 use dbase4-memo-print a397 2 !:mime application/x-dbt !:ext dbt a457 46 # From: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine # Reference: https://github.com/libyal/libesedb/archive/master.zip # libesedb-master/documentation/ # Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc # Note: also known as "JET Blue". Used by numerous Windows components such as # Windows Search, Mail, Exchange and Active Directory. 4 ubelong 0xefcdab89 # unknown1 >132 ubelong 0 Extensible storage engine !:mime application/x-ms-ese # file_type 0~database 1~stream >>12 ulelong 0 DataBase # Security DataBase (sdb) !:ext edb/sdb >>12 ulelong 1 STreaMing !:ext stm # format_version 620h >>8 uleshort x \b, version 0x%x >>10 uleshort >0 revision 0x%4.4x >>0 ubelong x \b, checksum 0x%8.8x # Page size 4096 8192 32768 >>236 ulequad x \b, page size %lld # database_state >>52 ulelong 1 \b, JustCreated >>52 ulelong 2 \b, DirtyShutdown #>>52 ulelong 3 \b, CleanShutdown >>52 ulelong 4 \b, BeingConverted >>52 ulelong 5 \b, ForceDetach # Windows NT major version when the databases indexes were updated. >>216 ulelong x \b, Windows version %d # Windows NT minor version >>220 ulelong x \b.%d # From: Joerg Jenderek # URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility # Note: files contain application compatibility fixes, application compatibility modes and application help messages. 8 string sdbf >7 ubyte 0 # TAG_TYPE_LIST+TAG_INDEXES >>12 uleshort 0x7802 Windows application compatibility Shim DataBase # version? 2 3 #>>>0 ulelong x \b, version %d !:mime application/x-ms-sdb !:ext sdb d536 1 a536 3 0 string FS21 Zope Object Database File Storage v3 (data) 0 string FS30 Zope Object Database File Storage v4 (data) a541 30 # Hopper (reverse engineering tool) http://www.hopperapp.com/ 0 string hopperdb Hopper database # URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) # Reference: http://www.provue.com/Panorama/ # From: Joerg Jenderek # NOTE: test only versions 4 and 6.0 with Windows # length of Panorama database name 5 ubyte >0 # look after database name for "some" null bits >(5.B+7) ubelong&0xF3ffF000 0 # look for first keyword >>&1 search/2 DESIGN Panorama database #!:mime application/x-panorama-database !:apple KASXZEPD !:ext pan # database name >>>5 pstring x \b, "%s" # # # askSam Database by Stefan A. Haubenthal 0 string askw40\0 askSam DB # # # MUIbase Database Tool by Stefan A. Haubenthal 0 string MBSTV\040 MUIbase DB >6 string x version %s @ 1.1.1.11 log @Import file-5.31; mostly oss-fuzz found bugs. @ text @d3 1 a3 1 # $File: database,v 1.51 2017/04/28 16:28:16 christos Exp $ d87 1 a87 1 12 belong 0x00040988 Berkeley DB d106 1 a106 1 >>>>>20 long !0 32bit long d131 16 a146 16 #2 leshort 0x0800 Paradox #>0x39 byte 3 v. 3.0 #>0x39 byte 4 v. 3.5 #>0x39 byte 9 v. 4.x #>0x39 byte 10 v. 5.x #>0x39 byte 11 v. 5.x #>0x39 byte 12 v. 7.x #>>0x04 byte 0 indexed .DB data file #>>0x04 byte 1 primary index .PX file #>>0x04 byte 2 non-indexed .DB data file #>>0x04 byte 3 non-incrementing secondary index .Xnn file #>>0x04 byte 4 secondary index .Ynn file #>>0x04 byte 5 incrementing secondary index .Xnn file #>>0x04 byte 6 non-incrementing secondary index .XGn file #>>0x04 byte 7 secondary index .YGn file #>>>0x04 byte 8 incrementing secondary index .XGn file d154 1 a154 1 0 ubelong&0x0000FFFF <0x00000C20 d156 1 a156 1 >2 ubyte >0 d158 2 a159 2 >>3 ubyte >0 >>>3 ubyte <32 d161 1 a161 1 >>>>0 ubyte >1 d163 1 a163 1 >>>>>27 ubyte 0 d166 2 a167 2 # possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) >>>>>>24 ubelong&0xffFFFFff >0x01302000 d169 1 a169 1 >>>>>>24 ubelong&0xffFFFFff <0x01302001 d171 1 a171 1 >>>>>>>24 ubelong&0xffFFFFff =0 d173 1 a173 1 >>>>>>>>12 ubelong&0xFFFFfEfE 0 d175 2 a176 2 >>>>>>>>>28 ubyte x >>>>>>>>>28 ubyte&0xf8 0 d178 1 a178 1 >>>>>>>>>>8 uleshort >31 d180 1 a180 1 >>>>>>>>>>>32 ubyte >0 d205 2 a206 2 >>>>>>>>>>>>8 uleshort >0 >>>>>>>>>>>>(8.s+1) ubyte >0 d208 1 a208 1 >>>>>>>>>>>>>(8.s+1) ubyte >0 d210 2 a211 2 # for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) >>>>>>>24 ubelong&0x0133f7ff >0 d213 1 a213 1 >>>>>>>>47 ubyte 0 d215 1 a215 1 >>>>>>>>>559 ubyte&0xeF 0 d217 4 a220 4 >>>>>>>>>>45 ubeshort <0x0C20 >>>>>>>>>>>45 ubyte >0 >>>>>>>>>>>>46 ubyte <32 >>>>>>>>>>>>>46 ubyte >0 d239 1 a239 1 # Print the xBase names of different version variants d241 1 a241 1 >0 ubyte <2 d243 1 a243 1 >0 ubyte >1 d296 1 a296 1 # HiPer-Six format;Clipper SIX, with SMT memo file d321 6 a326 6 >0 ubelong x >1 ubyte <13 >>1 ubyte >0 >>>2 ubyte >0 >>>>2 ubyte <32 >>>>>0 ubyte x d336 3 a338 3 16 ubyte <4 >16 ubyte !2 >>16 ubyte !1 d340 1 a340 1 >>>0 ulelong >0 d342 1 a342 1 >>>>17 ubelong&0xFFfdFE00 0x00000000 d344 1 a344 1 >>>>>20 ubelong&0xFF01209B 0x00000000 d346 1 a346 1 >>>>>>16 ubyte 3 d350 1 a350 1 >>>>>>16 ubyte 0 d352 1 a352 1 >>>>>>>20 uleshort 0 d354 2 a355 2 >>>>>>>>8 ulong =0 >>>>>>>>>6 ubeshort >0 d357 1 a357 1 >>>>>>>>>>4 ushort 0 d360 1 a360 1 >>>>>>>>>6 ubeshort 0 d362 1 a362 1 >>>>>>>>>>510 ubeshort 0 d364 1 a364 1 >>>>>>>>>>>512 ubelong <0xfeffff03 d366 2 a367 2 >>>>>>>>>>>>512 ubelong >0x1F202020 >>>>>>>>>>>>>513 ubyte >0 d371 1 a371 1 >>>>>>>>8 ubelong !0 d373 1 a373 1 >>>>>>>>>510 ubeshort 0 d375 2 a376 2 >>>>>>>>>>0 ubyte >5 >>>>>>>>>>>0 ubyte <48 d379 2 a380 2 >>>>>>>20 uleshort >0 # dBASE IV DBT with valid block length like 512, 1024 d382 1 a382 1 >>>>>>>>20 uleshort&0x800f 0 d385 1 a385 1 # Print the information of dBase III DBT memo file d398 1 a398 1 # Print the information of dBase IV DBT memo file d404 1 a404 1 >8 ubelong >0x20000000 d406 1 a406 1 >>20 uleshort >0 d411 1 a411 1 >4 ulelong !0 d418 2 a419 2 >20 uleshort >0 >>(20.s) ubelong x d422 2 a423 2 >20 uleshort =0 >>512 ubelong x d425 1 a425 1 # Print the information of dBase IV memo field d428 1 a428 1 >0 ubelong !0xFFFF0800 d432 1 a432 1 >0 ubelong =0xFFFF0800 d436 1 a436 1 # Print the information of FoxPro FPT memo file d444 1 a444 1 # field type ( 0~picture, 1~memo, 2~object ) d447 1 a447 1 >512 ubelong 1 d451 1 a451 1 # TODO: d468 1 a468 1 # Note: also known as "JET Blue". Used by numerous Windows components such as d470 1 a470 1 4 ubelong 0xefcdab89 d500 2 a501 2 8 string sdbf >7 ubyte 0 d603 2 a604 2 # length of Panorama database name 5 ubyte >0 d606 1 a606 1 >(5.B+7) ubelong&0xF3ffF000 0 a624 10 # # CDB database 0 string NBCDB\012 NetBSD Constant Database >7 byte x \b, version %d >8 string x \b, for '%s' >24 lelong x \b, datasize %d >28 lelong x \b, entries %d >32 lelong x \b, index %d >36 lelong x \b, seed %#x @ 1.1.1.12 log @2017-09-02 11:53 Christos Zoulas * release 5.32 2017-08-28 16:37 Christos Zoulas * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski) 2017-08-27 03:55 Christos Zoulas * Fix always true condition (Thomas Jarosch) 2017-05-24 17:30 Christos Zoulas * pickier parsing of numeric values in magic files. 2017-05-23 17:55 Christos Zoulas * PR/615 add magic_getflags() 2017-05-23 13:55 Christos Zoulas * release 5.31 2017-03-17 20:32 Christos Zoulas * remove trailing spaces from magic files * refactor is_tar * better bounds checks for cdf @ text @d3 1 a3 1 # $File: database,v 1.52 2017/08/13 00:21:47 christos Exp $ d210 1 a210 1 # for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) @ 1.1.1.12.4.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: database,v 1.55 2019/04/19 00:42:27 christos Exp $ d150 2 a151 2 # https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm # https://www.clicketyclick.dk/databases/xbase/format/dbf.html d190 1 a190 1 # https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF d196 1 a196 1 # https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx d264 1 a264 1 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx d270 1 a270 1 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx d279 1 a279 1 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx d290 1 a290 1 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx d299 1 a299 1 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx d304 1 a304 1 # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx d335 1 a335 1 # https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx d498 1 a498 1 # URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility d545 1 a545 1 # URL: https://www.grc.nasa.gov/WWW/cgns/adf/ d585 1 a585 1 # From: Stephane Blondon https://www.yaal.fr d596 1 a596 1 # Hopper (reverse engineering tool) https://www.hopperapp.com/ a634 12 # # Redis RDB - https://redis.io/topics/persistence 0 string REDIS Redis RDB file, >5 regex [0-9][0-9][0-9][0-9] version %s # Mork database. # Used by older versions of Mozilla Suite and Firefox, # and current versions of Thunderbird. # From: David Korth 0 string //\