head 1.1; branch 1.1.1; access; symbols perseant-exfatfs:1.1.1.1.0.2 perseant-exfatfs-base-20261102:1.1.1.1 FILE5_48:1.1.1.1 CHRISTOS:1.1.1; locks; strict; comment @# @; 1.1 date 2026.06.10.15.59.14; author christos; state Exp; branches 1.1.1.1; next ; commitid 3UWc0DrzTz7bHgJG; 1.1.1.1 date 2026.06.10.15.59.14; author christos; state Exp; branches 1.1.1.1.2.1; next ; commitid 3UWc0DrzTz7bHgJG; 1.1.1.1.2.1 date 2026.06.10.15.59.14; author perseant; state dead; branches; next 1.1.1.1.2.2; commitid 3QTNojfCEH9lUb2H; 1.1.1.1.2.2 date 2026.11.04.22.37.43; author perseant; state Exp; branches; next ; commitid 3QTNojfCEH9lUb2H; desc @@ 1.1 log @Initial revision @ text @#------------------------------------------------------------------------------ # $File: pack,v 1.1 2024/08/30 17:29:28 christos Exp $ # file(1) magic for things that have PACK as magic 0 string PACK # Type: Git pack # From: Adam Buchbinder # Update: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/Git # reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt # The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, # those have a little-endian offset immediately following the magic 'PACK', # the first byte of which is never 0, while the first byte of the Git pack # version, since it's a tiny number stored in big-endian format, is always 0. # GRR: line above is too general as it matches also PackDir archive ./acorn # test for major version. Git 2017 accepts version number 2 or 3 >4 ubelong <9 # Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc # or SystemDevice::foobar >>9 search/13 :: # but in git binary >>9 default x Git pack !:mime application/x-git !:ext pack # 4 GB limit implies unsigned integer >>>4 ubelong x \b, version %u >>>8 ubelong x \b, %u objects # From: Joerg Jenderek # URL: https://www.kyzer.me.uk/pack/xad/#PackDir # reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c # GRR: line below is too general as it matches also "Git pack" in ./revision # check for valid compression method 0-4 >5 ulelong <5 # https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems # To skip "Git pack" version 0 test for root directory object like # ADFS::RPC.$.websitezip.FONTFIX >>9 string >ADFS\ PackDir archive (RISC OS) # TrID labels above as "Acorn PackDir compressed Archive" # compression mode y (0 - 4) for GIF LZW with a maximum n bits # (y~n,0~12,1~13,2~14,3~15,4~16) >>>5 ulelong+12 x \b, LZW %u-bits compression # https://www.filebase.org.uk/filetypes # !Packdir compressed archive has three hexadecimal digits code 68E !:mime application/x-acorn-68E !:ext pkd/bin # null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo >>>9 string x \b, root "%s" # load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time >>>>&1 ulelong x \b, load address %#x # execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC >>>>&5 ulelong x \b, exec address %#x # attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write) >>>>&9 ulelong x \b, attributes %#x # number of entries in this directory. for root dir 0 #>>>&13 ulelong x \b, entries %#x # the entries start here with object name >>>>&17 string x \b, 1st object "%s" # Update: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/PAK # reference: https://quakewiki.org/wiki/.pak # GRR: line below is too general as it matches also Acorn PackDir compressed Archive # real Quake examples like pak0.pak have only some hundreds like 150 files # So test for few files >8 ulelong <0x01000000 # in file version 5.32 test for null terminator is only true for # offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h # look for null terminator of 1st entry name >>(4.l+55) ubyte 0 Quake I or II world or extension !:mime application/x-dzip !:ext pak #>>>8 ulelong x \b, table size %u # dividing this by entry size (64) gives number of files >>>8 ulelong/64 x \b, %u files # offset to the beginning of the file table >>>4 ulelong x \b, offset %#x # 1st file entry >>>(4.l) use pak-entry # 2nd file entry #>>>4 ulelong+64 x \b, offset %#x #>>>(4.l+64) use pak-entry # # display file table entry of Quake PAK archive 0 name pak-entry # normally entry start after header which implies offset 12 or higher >56 ulelong >11 # the offset from the beginning of pak to beginning of this entry file contents >>56 ulelong x at %#x # the size of file for this entry >>60 ulelong x %u bytes # 56 byte null-terminated entry name string includes path like maps/e1m1.bsp >>0 string x '%-.56s' # inspect entry content by jumping to entry offset >>(56) indirect x \b: #0 string -1\x0a Quake I demo #>30 string x version %.4s #>61 string x level %s #0 string 5\x0a Quake I save @ 1.1.1.1 log @Import file-5.48 (previous was file-5.45) 2026-05-07 11:32 Christos Zoulas * release 5.48 2026-05-11 15:55 Christos Zoulas * add landlock support (valoq) 2026-04-19 15:55 Christos Zoulas * add BE/LE GUID 2026-04-17 11:05 Christos Zoulas * multiple fixes to prevent integer overflow in 32 bits (kerwin) 2026-04-15 12:40 Christos Zoulas * PR/745: streamout: Don't flush when trying to set negative offsets on pipes, just continue, fixes 'cat file.zip | file -' * PR/753: vmihalko: Fix race is magic_getpath() 2026-03-11 15:14 Christos Zoulas * PR/728: Anton Monroe: Reinstate regex/c 2026-02-26 11:32 Christos Zoulas * release 5.47 2026-02-04 09:54 Christos Zoulas * Better multi-compound document identification by following the order of the directories entries. (Thomas Ledoux) 2026-01-19 14:00 Christos Zoulas * if stat fails, don't attempt to restore times (Steven Grubb) 2025-05-28 15:20 Christos Zoulas * PR/622: Odd_Bloke: Handle negative offsets in file_buffer(), when fd is not available. 2025-05-28 12:50 Christos Zoulas * PR/655: jsummers: Obey str_flags in strings like we do for search and regex * PR/659: Pitzl: Apply MAGIC_CONTINUE to annotations; i.e. print only the first, unless -k is specified. 2024-12-19 14:44 Christos Zoulas * PR/592: allow + in format strings * PR/592: signed operations should be done in signed context 2024-12-05 13:50 Christos Zoulas * PR/578: jsummers: Don't crash on cygwin when tm_mon == -1 * PR/579: net147: Fix stack overrun. 2024-11-27 14:44 Christos Zoulas * release 5.46 * Add OFFPOSITIVE 2024-11-25 13:56 Christos Zoulas * avoid leaking symbols in libmagic 2024-11-10 13:56 Christos Zoulas * PR/562: jsummers: Search/regex offsets are absolute to the beginning of the file, so adjust them by subtracting the offset that the "use" starts so that we don't double-count it. 2024-11-09 19:30 Christos Zoulas * PR/543: matshch: bump nbuf so we can get the flags into the buffer. 2024-11-02 14:34 Christos Zoulas * Add Android elf notes (enh) 2023-12-29 12:55 Christos Zoulas * Add limit for number of magic warnings allowed 2023-07-29 12:55 Christos Zoulas * check regex bounds (found by clusterfuzz) @ text @@ 1.1.1.1.2.1 log @file pack was added on branch perseant-exfatfs on 2026-11-04 22:37:43 +0000 @ text @d1 101 @ 1.1.1.1.2.2 log @Sync with HEAD @ text @a0 101 #------------------------------------------------------------------------------ # $File: pack,v 1.1 2024/08/30 17:29:28 christos Exp $ # file(1) magic for things that have PACK as magic 0 string PACK # Type: Git pack # From: Adam Buchbinder # Update: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/Git # reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt # The actual magic is 'PACK', but that clashes with Doom/Quake packs. However, # those have a little-endian offset immediately following the magic 'PACK', # the first byte of which is never 0, while the first byte of the Git pack # version, since it's a tiny number stored in big-endian format, is always 0. # GRR: line above is too general as it matches also PackDir archive ./acorn # test for major version. Git 2017 accepts version number 2 or 3 >4 ubelong <9 # Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc # or SystemDevice::foobar >>9 search/13 :: # but in git binary >>9 default x Git pack !:mime application/x-git !:ext pack # 4 GB limit implies unsigned integer >>>4 ubelong x \b, version %u >>>8 ubelong x \b, %u objects # From: Joerg Jenderek # URL: https://www.kyzer.me.uk/pack/xad/#PackDir # reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c # GRR: line below is too general as it matches also "Git pack" in ./revision # check for valid compression method 0-4 >5 ulelong <5 # https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems # To skip "Git pack" version 0 test for root directory object like # ADFS::RPC.$.websitezip.FONTFIX >>9 string >ADFS\ PackDir archive (RISC OS) # TrID labels above as "Acorn PackDir compressed Archive" # compression mode y (0 - 4) for GIF LZW with a maximum n bits # (y~n,0~12,1~13,2~14,3~15,4~16) >>>5 ulelong+12 x \b, LZW %u-bits compression # https://www.filebase.org.uk/filetypes # !Packdir compressed archive has three hexadecimal digits code 68E !:mime application/x-acorn-68E !:ext pkd/bin # null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo >>>9 string x \b, root "%s" # load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time >>>>&1 ulelong x \b, load address %#x # execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC >>>>&5 ulelong x \b, exec address %#x # attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write) >>>>&9 ulelong x \b, attributes %#x # number of entries in this directory. for root dir 0 #>>>&13 ulelong x \b, entries %#x # the entries start here with object name >>>>&17 string x \b, 1st object "%s" # Update: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/PAK # reference: https://quakewiki.org/wiki/.pak # GRR: line below is too general as it matches also Acorn PackDir compressed Archive # real Quake examples like pak0.pak have only some hundreds like 150 files # So test for few files >8 ulelong <0x01000000 # in file version 5.32 test for null terminator is only true for # offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h # look for null terminator of 1st entry name >>(4.l+55) ubyte 0 Quake I or II world or extension !:mime application/x-dzip !:ext pak #>>>8 ulelong x \b, table size %u # dividing this by entry size (64) gives number of files >>>8 ulelong/64 x \b, %u files # offset to the beginning of the file table >>>4 ulelong x \b, offset %#x # 1st file entry >>>(4.l) use pak-entry # 2nd file entry #>>>4 ulelong+64 x \b, offset %#x #>>>(4.l+64) use pak-entry # # display file table entry of Quake PAK archive 0 name pak-entry # normally entry start after header which implies offset 12 or higher >56 ulelong >11 # the offset from the beginning of pak to beginning of this entry file contents >>56 ulelong x at %#x # the size of file for this entry >>60 ulelong x %u bytes # 56 byte null-terminated entry name string includes path like maps/e1m1.bsp >>0 string x '%-.56s' # inspect entry content by jumping to entry offset >>(56) indirect x \b: #0 string -1\x0a Quake I demo #>30 string x version %.4s #>61 string x level %s #0 string 5\x0a Quake I save @