head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC4:1.1.1.7 netbsd-11-0-RC3:1.1.1.7 netbsd-11-0-RC2:1.1.1.7 netbsd-11-0-RC1:1.1.1.7 perseant-exfatfs-base-20250801:1.1.1.7 netbsd-11:1.1.1.7.0.6 netbsd-11-base:1.1.1.7 netbsd-10-1-RELEASE:1.1.1.7 perseant-exfatfs-base-20240630:1.1.1.7 perseant-exfatfs:1.1.1.7.0.4 perseant-exfatfs-base:1.1.1.7 netbsd-8-3-RELEASE:1.1.1.3 netbsd-9-4-RELEASE:1.1.1.4 netbsd-10-0-RELEASE:1.1.1.7 netbsd-10-0-RC6:1.1.1.7 netbsd-10-0-RC5:1.1.1.7 netbsd-10-0-RC4:1.1.1.7 netbsd-10-0-RC3:1.1.1.7 netbsd-10-0-RC2:1.1.1.7 netbsd-10-0-RC1:1.1.1.7 FILE5_45:1.1.1.7 netbsd-10:1.1.1.7.0.2 netbsd-10-base:1.1.1.7 FILE5_43:1.1.1.7 netbsd-9-3-RELEASE:1.1.1.4 cjep_sun2x-base1:1.1.1.6 cjep_sun2x:1.1.1.6.0.4 cjep_sun2x-base:1.1.1.6 cjep_staticlib_x-base1:1.1.1.6 netbsd-9-2-RELEASE:1.1.1.4 cjep_staticlib_x:1.1.1.6.0.2 cjep_staticlib_x-base:1.1.1.6 FILE5_40:1.1.1.6 netbsd-9-1-RELEASE:1.1.1.4 FILE5_39:1.1.1.5 phil-wifi-20200421:1.1.1.4 phil-wifi-20200411:1.1.1.4 is-mlppp:1.1.1.4.0.4 is-mlppp-base:1.1.1.4 phil-wifi-20200406:1.1.1.4 netbsd-8-2-RELEASE:1.1.1.3 netbsd-9-0-RELEASE:1.1.1.4 netbsd-9-0-RC2:1.1.1.4 FILE5_38:1.1.1.4 netbsd-9-0-RC1:1.1.1.4 phil-wifi-20191119:1.1.1.4 netbsd-9:1.1.1.4.0.2 netbsd-9-base:1.1.1.4 phil-wifi-20190609:1.1.1.4 netbsd-8-1-RELEASE:1.1.1.3 FILE5_37:1.1.1.4 netbsd-8-1-RC1:1.1.1.3 pgoyette-compat-merge-20190127:1.1.1.3 pgoyette-compat-20190127:1.1.1.3 pgoyette-compat-20190118:1.1.1.3 pgoyette-compat-1226:1.1.1.3 pgoyette-compat-1126:1.1.1.3 pgoyette-compat-1020:1.1.1.3 FILE5_35:1.1.1.3 pgoyette-compat-0930:1.1.1.3 pgoyette-compat-0906:1.1.1.3 netbsd-7-2-RELEASE:1.1.1.3 pgoyette-compat-0728:1.1.1.3 netbsd-8-0-RELEASE:1.1.1.3 phil-wifi:1.1.1.3.0.24 phil-wifi-base:1.1.1.3 pgoyette-compat-0625:1.1.1.3 netbsd-8-0-RC2:1.1.1.3 pgoyette-compat-0521:1.1.1.3 pgoyette-compat-0502:1.1.1.3 pgoyette-compat-0422:1.1.1.3 netbsd-8-0-RC1:1.1.1.3 FILE5_33:1.1.1.3 pgoyette-compat-0415:1.1.1.3 pgoyette-compat-0407:1.1.1.3 pgoyette-compat-0330:1.1.1.3 pgoyette-compat-0322:1.1.1.3 pgoyette-compat-0315:1.1.1.3 netbsd-7-1-2-RELEASE:1.1.1.3 pgoyette-compat:1.1.1.3.0.22 pgoyette-compat-base:1.1.1.3 netbsd-7-1-1-RELEASE:1.1.1.3 matt-nb8-mediatek:1.1.1.3.0.20 matt-nb8-mediatek-base:1.1.1.3 FILE5_32:1.1.1.3 perseant-stdc-iso10646:1.1.1.3.0.18 perseant-stdc-iso10646-base:1.1.1.3 netbsd-8:1.1.1.3.0.16 netbsd-8-base:1.1.1.3 FILE5_31:1.1.1.3 prg-localcount2-base3:1.1.1.3 prg-localcount2-base2:1.1.1.3 prg-localcount2-base1:1.1.1.3 prg-localcount2:1.1.1.3.0.14 prg-localcount2-base:1.1.1.3 pgoyette-localcount-20170426:1.1.1.3 bouyer-socketcan-base1:1.1.1.3 pgoyette-localcount-20170320:1.1.1.3 netbsd-7-1:1.1.1.3.0.12 netbsd-7-1-RELEASE:1.1.1.3 netbsd-7-1-RC2:1.1.1.3 FILE5_30:1.1.1.3 netbsd-7-nhusb-base-20170116:1.1.1.3 bouyer-socketcan:1.1.1.3.0.10 bouyer-socketcan-base:1.1.1.3 pgoyette-localcount-20170107:1.1.1.3 netbsd-7-1-RC1:1.1.1.3 pgoyette-localcount-20161104:1.1.1.3 netbsd-7-0-2-RELEASE:1.1.1.3 localcount-20160914:1.1.1.3 netbsd-7-nhusb:1.1.1.3.0.8 netbsd-7-nhusb-base:1.1.1.3 pgoyette-localcount-20160806:1.1.1.3 pgoyette-localcount-20160726:1.1.1.3 pgoyette-localcount:1.1.1.3.0.6 pgoyette-localcount-base:1.1.1.3 netbsd-7-0-1-RELEASE:1.1.1.3 netbsd-7-0:1.1.1.3.0.4 netbsd-7-0-RELEASE:1.1.1.3 netbsd-7-0-RC3:1.1.1.3 netbsd-7-0-RC2:1.1.1.3 netbsd-7-0-RC1:1.1.1.3 FILE5_22:1.1.1.3 FILE5_20:1.1.1.3 netbsd-6-0-6-RELEASE:1.1.1.1.6.1 netbsd-6-1-5-RELEASE:1.1.1.1.6.1 netbsd-7:1.1.1.3.0.2 netbsd-7-base:1.1.1.3 FILE5_19:1.1.1.3 yamt-pagecache-base9:1.1.1.2 yamt-pagecache-tag8:1.1.1.1.4.1 netbsd-6-1-4-RELEASE:1.1.1.1.6.1 netbsd-6-0-5-RELEASE:1.1.1.1.6.1 tls-earlyentropy:1.1.1.2.0.10 tls-earlyentropy-base:1.1.1.3 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.2 riastradh-drm2-base3:1.1.1.2 netbsd-6-1-3-RELEASE:1.1.1.1.6.1 netbsd-6-0-4-RELEASE:1.1.1.1.6.1 FILE5_16:1.1.1.2 netbsd-6-1-2-RELEASE:1.1.1.1.6.1 netbsd-6-0-3-RELEASE:1.1.1.1.6.1 netbsd-6-1-1-RELEASE:1.1.1.1.6.1 riastradh-drm2-base2:1.1.1.2 riastradh-drm2-base1:1.1.1.2 riastradh-drm2:1.1.1.2.0.4 riastradh-drm2-base:1.1.1.2 netbsd-6-1:1.1.1.1.6.1.0.6 netbsd-6-0-2-RELEASE:1.1.1.1.6.1 netbsd-6-1-RELEASE:1.1.1.1.6.1 khorben-n900:1.1.1.2.0.8 netbsd-6-1-RC4:1.1.1.1.6.1 netbsd-6-1-RC3:1.1.1.1.6.1 agc-symver:1.1.1.2.0.6 agc-symver-base:1.1.1.2 FILE5_14:1.1.1.2 netbsd-6-1-RC2:1.1.1.1.6.1 netbsd-6-1-RC1:1.1.1.1.6.1 yamt-pagecache-base8:1.1.1.2 FILE_5_12:1.1.1.2 netbsd-6-0-1-RELEASE:1.1.1.1.6.1 yamt-pagecache-base7:1.1.1.2 matt-nb6-plus-nbase:1.1.1.1.6.1 yamt-pagecache-base6:1.1.1.2 netbsd-6-0:1.1.1.1.6.1.0.4 netbsd-6-0-RELEASE:1.1.1.1.6.1 netbsd-6-0-RC2:1.1.1.1.6.1 tls-maxphys:1.1.1.2.0.2 tls-maxphys-base:1.1.1.3 matt-nb6-plus:1.1.1.1.6.1.0.2 matt-nb6-plus-base:1.1.1.1.6.1 netbsd-6-0-RC1:1.1.1.1.6.1 yamt-pagecache-base5:1.1.1.2 yamt-pagecache-base4:1.1.1.2 FILE5_11:1.1.1.2 netbsd-6:1.1.1.1.0.6 netbsd-6-base:1.1.1.1 yamt-pagecache-base3:1.1.1.1 yamt-pagecache-base2:1.1.1.1 yamt-pagecache:1.1.1.1.0.4 yamt-pagecache-base:1.1.1.1 FILE5_09:1.1.1.1 cherry-xenmp:1.1.1.1.0.2 cherry-xenmp-base:1.1.1.1 FILE5_07:1.1.1.1 CHRISTOS:1.1.1; locks; strict; comment @# @; 1.1 date 2011.05.12.20.47.06; author christos; state Exp; branches 1.1.1.1; next ; 1.1.1.1 date 2011.05.12.20.47.06; author christos; state Exp; branches 1.1.1.1.4.1 1.1.1.1.6.1; next 1.1.1.2; 1.1.1.2 date 2012.02.22.17.48.41; author christos; state Exp; branches 1.1.1.2.2.1 1.1.1.2.10.1; next 1.1.1.3; 1.1.1.3 date 2014.06.13.01.48.26; author christos; state Exp; branches 1.1.1.3.24.1; next 1.1.1.4; commitid jtTYsE5FmJU6MiEx; 1.1.1.4 date 2019.05.22.17.19.57; author christos; state Exp; branches; next 1.1.1.5; commitid VXeNRYYruN1MWdoB; 1.1.1.5 date 2020.06.15.00.18.49; author christos; state Exp; branches; next 1.1.1.6; commitid HMbuXSjPojU5LfcC; 1.1.1.6 date 2021.04.09.18.58.02; author christos; state Exp; branches; next 1.1.1.7; commitid W9ddLLbSkHHinEOC; 1.1.1.7 date 2022.09.24.20.07.54; author christos; state Exp; branches; next ; commitid Nf6F9kcpc0EPC9VD; 1.1.1.1.4.1 date 2012.04.17.00.03.08; author yamt; state Exp; branches; next ; 1.1.1.1.6.1 date 2012.03.07.23.18.27; author riz; state Exp; branches; next ; 1.1.1.2.2.1 date 2014.08.19.23.46.47; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.1.1.2.10.1 date 2014.08.10.07.07.11; author tls; state Exp; branches; next ; commitid b1wUlsZGswrdGMLx; 1.1.1.3.24.1 date 2019.06.10.21.44.46; author christos; state Exp; branches; next ; commitid jtc8rnCzWiEEHGqB; desc @@ 1.1 log @Initial revision @ text @ #------------------------------------------------------------------------------ # $File: virtual,v 1.1 2009/12/25 16:04:30 christos Exp $ # From: James Nobis # Microsoft hard disk images for: # Virtual Server # Virtual PC # http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx # .vhd 0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC # Sun xVM VirtualBox Disk Image # string <<< Sun xVM VirtualBox Disk Image >>> # .vdi 0 string \<\<\<\ Sun\ xVM\ VirtualBox\ Disk Sun xVM VirtualBox Disk Image @ 1.1.1.1 log @from ftp.astron.com. - many security related fixes - no MAXPATHLEN limits - fixed missing text specification on ascii magic - new ``pascal'' style string formats - whitespace comparison fix - more magic @ text @@ 1.1.1.1.4.1 log @sync with head @ text @d3 1 a3 1 # $File: virtual,v 1.2 2011/11/22 13:30:05 christos Exp $ d13 5 a17 5 # From: Richard W.M. Jones # VirtualBox Disk Image 0x40 ulelong 0xbeda107f VirtualBox Disk Image >0x44 uleshort >0 \b, major %u >0x46 uleshort >0 \b, minor %u @ 1.1.1.1.6.1 log @Pull up following revision(s) (requested by christos in ticket #30): Update file to 5.11 (CDF security fixes) @ text @d3 1 a3 1 # $File: virtual,v 1.2 2011/11/22 13:30:05 christos Exp $ d13 5 a17 5 # From: Richard W.M. Jones # VirtualBox Disk Image 0x40 ulelong 0xbeda107f VirtualBox Disk Image >0x44 uleshort >0 \b, major %u >0x46 uleshort >0 \b, minor %u @ 1.1.1.2 log @from ftp.astron.com, CDF security fixes @ text @d3 1 a3 1 # $File: virtual,v 1.2 2011/11/22 13:30:05 christos Exp $ d13 5 a17 5 # From: Richard W.M. Jones # VirtualBox Disk Image 0x40 ulelong 0xbeda107f VirtualBox Disk Image >0x44 uleshort >0 \b, major %u >0x46 uleshort >0 \b, minor %u @ 1.1.1.2.2.1 log @Rebase to HEAD as of a few days ago. @ text @d3 1 a3 1 # $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $ a11 97 # libvirt # From: Philipp Hahn 0 string LibvirtQemudSave Libvirt QEMU Suspend Image >0x10 lelong x \b, version %u >0x14 lelong x \b, XML length %u >0x18 lelong 1 \b, running >0x1c lelong 1 \b, compressed 0 string LibvirtQemudPart Libvirt QEMU partial Suspend Image # From: Alex Beregszaszi 0 string/b COWD VMWare3 >4 byte 3 disk image >>32 lelong x (%d/ >>36 lelong x \b%d/ >>40 lelong x \b%d) >4 byte 2 undoable disk image >>32 string >\0 (%s) 0 string/b VMDK VMware4 disk image 0 string/b KDMV VMware4 disk image #-------------------------------------------------------------------- # Qemu Emulator Images # Lines written by Friedrich Schwittay (f.schwittay@@yousable.de) # Updated by Adam Buchbinder (adam.buchbinder@@gmail.com) # Made by reading sources, reading documentation, and doing trial and error # on existing QCOW files 0 string/b QFI\xFB QEMU QCOW Image # Uncomment the following line to display Magic (only used for debugging # this magic number) #>0 string/b x , Magic: %s # There are currently 2 Versions: "1" and "2". # http://www.gnome.org/~markmc/qcow-image-format-version-1.html >4 belong 1 (v1) # Using the existence of the Backing File Offset to determine whether # to read Backing File Information >>12 belong >0 \b, has backing file ( # Note that this isn't a null-terminated string; the length is actually # (16.L). Assuming a null-terminated string happens to work usually, but it # may spew junk until it reaches a \0 in some cases. >>>(12.L) string >\0 \bpath %s # Modification time of the Backing File # Really useful if you want to know if your backing # file is still usable together with this image >>>>20 bedate >0 \b, mtime %s) >>>>20 default x \b) # Size is stored in bytes in a big-endian u64. >>24 bequad x \b, %lld bytes # 1 for AES encryption, 0 for none. >>36 belong 1 \b, AES-encrypted # http://www.gnome.org/~markmc/qcow-image-format.html >4 belong 2 (v2) # Using the existence of the Backing File Offset to determine whether # to read Backing File Information >>8 bequad >0 \b, has backing file # Note that this isn't a null-terminated string; the length is actually # (16.L). Assuming a null-terminated string happens to work usually, but it # may spew junk until it reaches a \0 in some cases. Also, since there's no # .Q modifier, we just use the bottom four bytes as an offset. Note that if # the file is over 4G, and the backing file path is stored after the first 4G, # the wrong filename will be printed. (This should be (8.Q), when that syntax # is introduced.) >>>(12.L) string >\0 (path %s) >>24 bequad x \b, %lld bytes >>32 belong 1 \b, AES-encrypted >4 belong 3 (v3) # Using the existence of the Backing File Offset to determine whether # to read Backing File Information >>8 bequad >0 \b, has backing file # Note that this isn't a null-terminated string; the length is actually # (16.L). Assuming a null-terminated string happens to work usually, but it # may spew junk until it reaches a \0 in some cases. Also, since there's no # .Q modifier, we just use the bottom four bytes as an offset. Note that if # the file is over 4G, and the backing file path is stored after the first 4G, # the wrong filename will be printed. (This should be (8.Q), when that syntax # is introduced.) >>>(12.L) string >\0 (path %s) >>24 bequad x \b, %lld bytes >>32 belong 1 \b, AES-encrypted >4 default x (unknown version) 0 string/b QEVM QEMU suspend to disk image # QEMU QED Image # http://wiki.qemu.org/Features/QED/Specification 0 string/b QED\0 QEMU QED Image # VDI Image a17 9 >0 string >\0 (%s) >368 lequad x \b, %lld bytes 0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, >32 string x type %s, >48 string x subtype %s 0 lelong 0x02468ace Bochs Sparse disk image @ 1.1.1.2.10.1 log @Rebase. @ text @d3 1 a3 1 # $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $ a11 97 # libvirt # From: Philipp Hahn 0 string LibvirtQemudSave Libvirt QEMU Suspend Image >0x10 lelong x \b, version %u >0x14 lelong x \b, XML length %u >0x18 lelong 1 \b, running >0x1c lelong 1 \b, compressed 0 string LibvirtQemudPart Libvirt QEMU partial Suspend Image # From: Alex Beregszaszi 0 string/b COWD VMWare3 >4 byte 3 disk image >>32 lelong x (%d/ >>36 lelong x \b%d/ >>40 lelong x \b%d) >4 byte 2 undoable disk image >>32 string >\0 (%s) 0 string/b VMDK VMware4 disk image 0 string/b KDMV VMware4 disk image #-------------------------------------------------------------------- # Qemu Emulator Images # Lines written by Friedrich Schwittay (f.schwittay@@yousable.de) # Updated by Adam Buchbinder (adam.buchbinder@@gmail.com) # Made by reading sources, reading documentation, and doing trial and error # on existing QCOW files 0 string/b QFI\xFB QEMU QCOW Image # Uncomment the following line to display Magic (only used for debugging # this magic number) #>0 string/b x , Magic: %s # There are currently 2 Versions: "1" and "2". # http://www.gnome.org/~markmc/qcow-image-format-version-1.html >4 belong 1 (v1) # Using the existence of the Backing File Offset to determine whether # to read Backing File Information >>12 belong >0 \b, has backing file ( # Note that this isn't a null-terminated string; the length is actually # (16.L). Assuming a null-terminated string happens to work usually, but it # may spew junk until it reaches a \0 in some cases. >>>(12.L) string >\0 \bpath %s # Modification time of the Backing File # Really useful if you want to know if your backing # file is still usable together with this image >>>>20 bedate >0 \b, mtime %s) >>>>20 default x \b) # Size is stored in bytes in a big-endian u64. >>24 bequad x \b, %lld bytes # 1 for AES encryption, 0 for none. >>36 belong 1 \b, AES-encrypted # http://www.gnome.org/~markmc/qcow-image-format.html >4 belong 2 (v2) # Using the existence of the Backing File Offset to determine whether # to read Backing File Information >>8 bequad >0 \b, has backing file # Note that this isn't a null-terminated string; the length is actually # (16.L). Assuming a null-terminated string happens to work usually, but it # may spew junk until it reaches a \0 in some cases. Also, since there's no # .Q modifier, we just use the bottom four bytes as an offset. Note that if # the file is over 4G, and the backing file path is stored after the first 4G, # the wrong filename will be printed. (This should be (8.Q), when that syntax # is introduced.) >>>(12.L) string >\0 (path %s) >>24 bequad x \b, %lld bytes >>32 belong 1 \b, AES-encrypted >4 belong 3 (v3) # Using the existence of the Backing File Offset to determine whether # to read Backing File Information >>8 bequad >0 \b, has backing file # Note that this isn't a null-terminated string; the length is actually # (16.L). Assuming a null-terminated string happens to work usually, but it # may spew junk until it reaches a \0 in some cases. Also, since there's no # .Q modifier, we just use the bottom four bytes as an offset. Note that if # the file is over 4G, and the backing file path is stored after the first 4G, # the wrong filename will be printed. (This should be (8.Q), when that syntax # is introduced.) >>>(12.L) string >\0 (path %s) >>24 bequad x \b, %lld bytes >>32 belong 1 \b, AES-encrypted >4 default x (unknown version) 0 string/b QEVM QEMU suspend to disk image # QEMU QED Image # http://wiki.qemu.org/Features/QED/Specification 0 string/b QED\0 QEMU QED Image # VDI Image a17 9 >0 string >\0 (%s) >368 lequad x \b, %lld bytes 0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, >32 string x type %s, >48 string x subtype %s 0 lelong 0x02468ace Bochs Sparse disk image @ 1.1.1.3 log @import file-5.19 2014-06-09 9:04 Christos Zoulas * Misc buffer overruns and missing buffer size tests in cdf parsing (Francisco Alonso, Jan Kaluza) 2014-06-02 14:50 Christos Zoulas * Enforce limit of 8K on regex searches that have no limits * Allow the l modifier for regex to mean line count. Default to byte count. If line count is specified, assume a max of 80 characters per line to limit the byte count. * Don't allow conversions to be used for dates, allowing the mask field to be used as an offset. 2014-05-30 12:51 Christos Zoulas * Make the range operator limit the length of the regex search. 2014-05-14 19:23 Christos Zoulas * PR/347: Windows fixes * PR/352: Hangul word processor recognition * PR/354: Encoding irregularities in text files 2014-05-06 6:12 Christos Zoulas * Fix uninitialized title in CDF files (Jan Kaluza) 2014-05-04 14:55 Christos Zoulas * PR/351: Fix compilation of empty files 2014-04-30 17:39 Christos Zoulas * Fix integer formats: We don't specify 'l' or 'h' and 'hh' specifiers anymore, only 'll' for quads and nothing for the rest. This is so that magic writing is simpler. 2014-04-01 15:25 Christos Zoulas * PR/341: Jan Kaluza, fix memory leak * PR/342: Jan Kaluza, fix out of bounds read 2014-03-28 15:25 Christos Zoulas * Fix issue with long formats not matching fmtcheck @ text @d3 1 a3 1 # $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $ a11 97 # libvirt # From: Philipp Hahn 0 string LibvirtQemudSave Libvirt QEMU Suspend Image >0x10 lelong x \b, version %u >0x14 lelong x \b, XML length %u >0x18 lelong 1 \b, running >0x1c lelong 1 \b, compressed 0 string LibvirtQemudPart Libvirt QEMU partial Suspend Image # From: Alex Beregszaszi 0 string/b COWD VMWare3 >4 byte 3 disk image >>32 lelong x (%d/ >>36 lelong x \b%d/ >>40 lelong x \b%d) >4 byte 2 undoable disk image >>32 string >\0 (%s) 0 string/b VMDK VMware4 disk image 0 string/b KDMV VMware4 disk image #-------------------------------------------------------------------- # Qemu Emulator Images # Lines written by Friedrich Schwittay (f.schwittay@@yousable.de) # Updated by Adam Buchbinder (adam.buchbinder@@gmail.com) # Made by reading sources, reading documentation, and doing trial and error # on existing QCOW files 0 string/b QFI\xFB QEMU QCOW Image # Uncomment the following line to display Magic (only used for debugging # this magic number) #>0 string/b x , Magic: %s # There are currently 2 Versions: "1" and "2". # http://www.gnome.org/~markmc/qcow-image-format-version-1.html >4 belong 1 (v1) # Using the existence of the Backing File Offset to determine whether # to read Backing File Information >>12 belong >0 \b, has backing file ( # Note that this isn't a null-terminated string; the length is actually # (16.L). Assuming a null-terminated string happens to work usually, but it # may spew junk until it reaches a \0 in some cases. >>>(12.L) string >\0 \bpath %s # Modification time of the Backing File # Really useful if you want to know if your backing # file is still usable together with this image >>>>20 bedate >0 \b, mtime %s) >>>>20 default x \b) # Size is stored in bytes in a big-endian u64. >>24 bequad x \b, %lld bytes # 1 for AES encryption, 0 for none. >>36 belong 1 \b, AES-encrypted # http://www.gnome.org/~markmc/qcow-image-format.html >4 belong 2 (v2) # Using the existence of the Backing File Offset to determine whether # to read Backing File Information >>8 bequad >0 \b, has backing file # Note that this isn't a null-terminated string; the length is actually # (16.L). Assuming a null-terminated string happens to work usually, but it # may spew junk until it reaches a \0 in some cases. Also, since there's no # .Q modifier, we just use the bottom four bytes as an offset. Note that if # the file is over 4G, and the backing file path is stored after the first 4G, # the wrong filename will be printed. (This should be (8.Q), when that syntax # is introduced.) >>>(12.L) string >\0 (path %s) >>24 bequad x \b, %lld bytes >>32 belong 1 \b, AES-encrypted >4 belong 3 (v3) # Using the existence of the Backing File Offset to determine whether # to read Backing File Information >>8 bequad >0 \b, has backing file # Note that this isn't a null-terminated string; the length is actually # (16.L). Assuming a null-terminated string happens to work usually, but it # may spew junk until it reaches a \0 in some cases. Also, since there's no # .Q modifier, we just use the bottom four bytes as an offset. Note that if # the file is over 4G, and the backing file path is stored after the first 4G, # the wrong filename will be printed. (This should be (8.Q), when that syntax # is introduced.) >>>(12.L) string >\0 (path %s) >>24 bequad x \b, %lld bytes >>32 belong 1 \b, AES-encrypted >4 default x (unknown version) 0 string/b QEVM QEMU suspend to disk image # QEMU QED Image # http://wiki.qemu.org/Features/QED/Specification 0 string/b QED\0 QEMU QED Image # VDI Image a17 9 >0 string >\0 (%s) >368 lequad x \b, %lld bytes 0 string/b Bochs\ Virtual\ HD\ Image Bochs disk image, >32 string x type %s, >48 string x subtype %s 0 lelong 0x02468ace Bochs Sparse disk image @ 1.1.1.3.24.1 log @Sync with HEAD @ text @d3 1 a3 1 # $File: virtual,v 1.10 2019/04/19 00:42:27 christos Exp $ d8 2 a9 4 # VirtualBox # URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk) # Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/ # Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc d11 1 a11 182 # alternative shorter names #0 string conectix Microsoft Virtual Hard Disk image #0 string conectix Microsoft Virtual HD image !:mime application/x-virtualbox-vhd !:ext vhd # Features is a bit field used to indicate specific feature support #>8 ubelong !0x00000002 \b, Features 0x%x # Reserved. This bit must always be set to 1. #>8 ubelong &0x00000002 \b, Reserved 0x%x # File Format Version for the current specification 0x00010000 #>12 ubelong !0x00010000 \b, Version 0x%8.8x # Data Offset only found 0x200 #>16 ubequad !0x200 \b, Data Offset 0x%llx #>16 ubequad x \b, at 0x%llx # Dynamic Disk Header cookie like cxsparse #>(16.Q) string x "%-.8s" # This field contains a Unicode string (UTF-16) of the parent hard disk filename #>(16.Q+64) ubequad x \b, parent name 0x%llx # Creator Application # vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd >28 string x \b, Creator %-4.4s # Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004 # holds the major/minor version of the application that created the image >32 ubeshort x %x >34 ubeshort x \b.%x #>32 ubelong x \b, Version 0x%8.8x # Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac) >36 ubelong x ( >>36 ubelong 0x5769326B \bW2k >>36 ubelong 0x4D616320 \bMac >>36 default x \b0x >>>36 ubelong x \b%8.8x # creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch >24 bedate+946684800 x \b) %s # Original Size #>40 ubequad x \b, o.-Size 0x%llx # Current Size is same as original size, but change when disk is expanded #>48 ubequad x \b, Size 0x%llx >48 ubequad x \b, %llu bytes # Disk Geometry: cylinder, heads, and sectors/track for hard disk #>56 ubeshort x \b, Cylinder 0x%x >56 ubeshort x \b, CHS %u # Heads #>58 ubyte x \b, Heads 0x%x >58 ubyte x \b/%u # Sectors per track #>59 ubyte x \b, Sectors 0x%x >59 ubyte x \b/%u # Disk Type: 3~Dynamic hard disk >60 ubelong !0x3 \b, type 0x%x # Checksum #>64 ubelong x \b, cksum 0x%x # universally unique identifier (UUID) to associate a parent with its differencing image #>68 ubequad x \b, id 0x%16.16llx #>76 ubequad x \b-%16.16llx # Saved State: 1~Saved State >84 ubyte !0 \b, State 0x%x # Reserved 427 bytes with nils #>85 ubequad !0 \b, Reserved 0x%16.16llx # From: Joerg Jenderek # URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx # Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/ # MS-VHDX/[MS-VHDX].pdf # Note: extends the VHD format with new capabilities, such as a 16TB maximum size # TODO: find and display values like virtual size, disk size, cluster_size, etc # display id in GUID format # # VHDX_FILE_IDENTIFIER signature 0x656C696678646876 0 string vhdxfile # VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB >0x10000 string head Microsoft Disk Image eXtended #>0x20000 string head \b, 2nd header #!:mime application/x-virtualbox-vhdx !:ext vhdx # Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512" >>8 lestring16 x \b, by %.256s # The Checksum field is a CRC-32C hash over the entire 4 KB structure #>>0x10004 ulelong x \b, CRC 0x%x # SequenceNumber >>0x10008 ulequad x \b, sequence 0x%llx # FileWriteGuid #>>0x10010 ubequad x \b, file id 0x%llx #>>>0x10018 ubequad x \b-%llx # DataWriteGuid #>>0x10020 ubequad x \b, data id 0x%llx #>>>0x10028 ubequad x \b-%llx # LogGuid. If this field is zero, then the log is empty or has no valid entries >>0x10030 ubequad >0 \b, log id 0x%llx >>>0x10038 ubequad x \b-%llx # LogVersion. If not 0 there is a log to replay >>0x10040 uleshort >0 \b, LogVersion 0x%x # Version. This field must be set to 1 >>0x10042 uleshort !1 \b, Version 0x%x # LogLength must be multiples of 1 MB >>0x10044 ulelong/1048576 >1 \b, LogLength %u MB # LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB >>0x10048 ulequad !0x100000 \b, LogOffset 0x%llx # Log Entry Signature must be 0x65676F6C~loge >>(0x10048.q) ulelong !0x65676F6C \b, NO Log Signature >>(0x10048.q) ulelong =0x65676F6C \b; LOG # Log Entry Checksum #>>>(0x10048.q+4) ulelong x \b, Log CRC 0x%x # Log Entry Length must be a multiple of 4 KB >>>(0x10048.q+8) ulelong/1024 >4 \b, EntryLength %u KB # Log Entry Tail must be a multiple of 4 KB #>>>(0x10048.q+12) ulelong x \b, Tail 0x%x # Log Entry SequenceNumber #>>>(0x10048.q+16) ulequad x \b, # 0x%llx # Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8 #>>>(0x10048.q+24) ulelong x \b, DescriptorCount 0x%llx # Log Entry Reserved must be set to 0 >>>(0x10048.q+28) ulelong !0 \b, Reserved 0x%x # Log Entry LogGuid #>>>(0x10048.q+32) ubequad x \b, Log id 0x%llx #>>>(0x10048.q+40) ubequad x \b-%llx # Log Entry FlushedFileOffset should VHDX size when entry is written. #>>>(0x10048.q+48) ulequad x \b, FlushedFileOffset %llu # Log Entry LastFileOffset #>>>(0x10048.q+56) ulequad x \b, LastFileOffset %llu # filling #>>>(0x10048.q+64) ulequad >0 \b, filling %llx # Reserved[4016] #>>0x10050 ulequad >0 \b, Reserved 0x%llx # VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB >0x30000 ulelong !0x69676572 \b, 1st region INVALID >0x30000 ulelong =0x69676572 \b; region # region Checksum. CRC-32C hash over the entire 64-KB table #>>0x30004 ulelong x \b, CRC 0x%x # The EntryCount specifies number of valid entries; Found 2; This must be =< 2047. >>0x30008 ulelong x \b, %u entries # reserved must be zero #>>0x3000C ulelong !0 \b, RESERVED 0x%x # Region Table Entry starts with identifier for the object. often BAT id >>0x30010 use vhdx-id # FileOffset >>0x30020 ulequad x \b, at 0x%llx # Length. Specifies the length of the object within the file #>>0x30028 ulelong x \b, Length 0x%x # 1 means region entry is required. if region not recognized, then REFUSE to load VHDX >>0x3002C ulelong x \b, Required %u # 2nd region entry often metadata id >>0x30030 use vhdx-id # 2nd entry FileOffset >>0x30040 ulequad x \b, at 0x%llx # 1 means region entry is required. if region not recognized, then REFUSE to load VHDX >>0x3004C ulelong x \b, Required %u # 2nd region >>0x40000 ulelong !0x69676572 \b, 2nd region INVALID # check in vhdx images for known id and show names instead hexadecimal 0 name vhdx-id # https://www.windowstricks.in/online-windows-guid-converter # 2DC27766-F623-4200-9D64-115E9BFD4A08 BAT GUID # 6677C22D23F600429D64115E9BFD4A08 BAT ID >0 ubequad =0x6677C22D23F60042 >>8 ubequad =0x9D64115E9BFD4A08 \b, id BAT # no BAT id >>8 default x >>>0 use vhdx-id-hex # 8B7CA206-4790-4B9A-B8FE-575F050F886E Metadata region GUID # 06A27C8B90479A4BB8FE575F050F886E Metadata region ID >0 ubequad =0x06A27C8B90479A4B >>8 ubequad =0xB8FE575F050F886E \b, id Metadata # no Metadata id >>8 default x >>>0 use vhdx-id-hex # 2FA54224-CD1B-4876-B211-5DBED83BF4B8 Virtual Disk Size GUID # 2442A52F1BCD7648B2115DBED83BF4B8 Virtual Disk Size ID # value "virtual size" can be verified by command `qemu-img info ` >0 ubequad =0x2442A52F1BCD7648 >>8 ubequad =0xB2115DBED83BF4B8 \b, id vsize # no Virtual Disk Size ID >>8 default x >>>0 use vhdx-id-hex # other ids >0 default x >>0 use vhdx-id-hex # in vhdx images show id as hexadecimal 0 name vhdx-id-hex >0 ubequad x \b, ID 0x%16.16llx >8 ubequad x \b-%16.16llx # d39 1 a39 1 0 string/b QFI\xFB d46 2 a47 3 # https://www.gnome.org/~markmc/qcow-image-format-version-1.html >4 belong !1 QEMU QCOW2 Image >4 belong 1 QEMU QCOW Image (v1) d69 1 a69 1 # https://www.gnome.org/~markmc/qcow-image-format.html d105 1 a105 1 # https://wiki.qemu.org/Features/QED/Specification @ 1.1.1.4 log @2019-05-14 22:26 Christos Zoulas * release 5.37 2019-05-09 22:27 Christos Zoulas * Make sure that continuation separators are printed with -k within softmagic 2019-05-06 22:27 Christos Zoulas * Change SIGPIPE saving and restoring during compression to use sigaction(2) instead of signal(3) and cache it. (Denys Vlasenko) * Cache stat(2) calls more to reduce number of calls (Denys Vlasenko) 2019-05-06 17:25 Christos Zoulas * PR/77: Handle --mime-type and -k correctly. 2019-05-03 15:26 Christos Zoulas * Switch decompression code to use vfork() because tools like rpmdiff and rpmbuild call libmagic with large process footprints (Denys Vlasenko) 2019-04-07 14:05 Christos Zoulas * PR/75: --enable-zlib, did not work. 2019-02-27 11:54 Christos Zoulas * Improve regex efficiency (Michael Schroeder) by: 1. Prefixing regex searches with regular search for keywords where possible 2. Using memmem(3) where available @ text @d3 1 a3 1 # $File: virtual,v 1.10 2019/04/19 00:42:27 christos Exp $ d8 2 a9 4 # VirtualBox # URL: http://fileformats.archiveteam.org/wiki/VHD_(Virtual_Hard_Disk) # Reference: https://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/ # Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc d11 1 a11 182 # alternative shorter names #0 string conectix Microsoft Virtual Hard Disk image #0 string conectix Microsoft Virtual HD image !:mime application/x-virtualbox-vhd !:ext vhd # Features is a bit field used to indicate specific feature support #>8 ubelong !0x00000002 \b, Features 0x%x # Reserved. This bit must always be set to 1. #>8 ubelong &0x00000002 \b, Reserved 0x%x # File Format Version for the current specification 0x00010000 #>12 ubelong !0x00010000 \b, Version 0x%8.8x # Data Offset only found 0x200 #>16 ubequad !0x200 \b, Data Offset 0x%llx #>16 ubequad x \b, at 0x%llx # Dynamic Disk Header cookie like cxsparse #>(16.Q) string x "%-.8s" # This field contains a Unicode string (UTF-16) of the parent hard disk filename #>(16.Q+64) ubequad x \b, parent name 0x%llx # Creator Application # vpc~Microsoft Virtual PC, vs~Microsoft Virtual Server, vbox~VirtualBox, d2v~disk2vhd >28 string x \b, Creator %-4.4s # Creator Version: 0x00010000~Virtual Server 2004, 0x00050000~Virtual PC 2004 # holds the major/minor version of the application that created the image >32 ubeshort x %x >34 ubeshort x \b.%x #>32 ubelong x \b, Version 0x%8.8x # Creator Host OS: 0x5769326B~Windows (Wi2k), 0x4D616320~Macintosh (Mac) >36 ubelong x ( >>36 ubelong 0x5769326B \bW2k >>36 ubelong 0x4D616320 \bMac >>36 default x \b0x >>>36 ubelong x \b%8.8x # creation Time in seconds since 1 Jan 2000 UTC~946684800 sec. since Unix Epoch >24 bedate+946684800 x \b) %s # Original Size #>40 ubequad x \b, o.-Size 0x%llx # Current Size is same as original size, but change when disk is expanded #>48 ubequad x \b, Size 0x%llx >48 ubequad x \b, %llu bytes # Disk Geometry: cylinder, heads, and sectors/track for hard disk #>56 ubeshort x \b, Cylinder 0x%x >56 ubeshort x \b, CHS %u # Heads #>58 ubyte x \b, Heads 0x%x >58 ubyte x \b/%u # Sectors per track #>59 ubyte x \b, Sectors 0x%x >59 ubyte x \b/%u # Disk Type: 3~Dynamic hard disk >60 ubelong !0x3 \b, type 0x%x # Checksum #>64 ubelong x \b, cksum 0x%x # universally unique identifier (UUID) to associate a parent with its differencing image #>68 ubequad x \b, id 0x%16.16llx #>76 ubequad x \b-%16.16llx # Saved State: 1~Saved State >84 ubyte !0 \b, State 0x%x # Reserved 427 bytes with nils #>85 ubequad !0 \b, Reserved 0x%16.16llx # From: Joerg Jenderek # URL: https://msdn.microsoft.com/en-us/library/mt740058.aspx # Reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/ # MS-VHDX/[MS-VHDX].pdf # Note: extends the VHD format with new capabilities, such as a 16TB maximum size # TODO: find and display values like virtual size, disk size, cluster_size, etc # display id in GUID format # # VHDX_FILE_IDENTIFIER signature 0x656C696678646876 0 string vhdxfile # VHDX_HEADER signature. 1 header is stored at offset 64KB and the other at 128KB >0x10000 string head Microsoft Disk Image eXtended #>0x20000 string head \b, 2nd header #!:mime application/x-virtualbox-vhdx !:ext vhdx # Creator[256] like "QEMU v3.0.0", "Microsoft Windows 6.3.9600.18512" >>8 lestring16 x \b, by %.256s # The Checksum field is a CRC-32C hash over the entire 4 KB structure #>>0x10004 ulelong x \b, CRC 0x%x # SequenceNumber >>0x10008 ulequad x \b, sequence 0x%llx # FileWriteGuid #>>0x10010 ubequad x \b, file id 0x%llx #>>>0x10018 ubequad x \b-%llx # DataWriteGuid #>>0x10020 ubequad x \b, data id 0x%llx #>>>0x10028 ubequad x \b-%llx # LogGuid. If this field is zero, then the log is empty or has no valid entries >>0x10030 ubequad >0 \b, log id 0x%llx >>>0x10038 ubequad x \b-%llx # LogVersion. If not 0 there is a log to replay >>0x10040 uleshort >0 \b, LogVersion 0x%x # Version. This field must be set to 1 >>0x10042 uleshort !1 \b, Version 0x%x # LogLength must be multiples of 1 MB >>0x10044 ulelong/1048576 >1 \b, LogLength %u MB # LogOffset (normally 0x100000 when log direct after header); multiples of 1 MB >>0x10048 ulequad !0x100000 \b, LogOffset 0x%llx # Log Entry Signature must be 0x65676F6C~loge >>(0x10048.q) ulelong !0x65676F6C \b, NO Log Signature >>(0x10048.q) ulelong =0x65676F6C \b; LOG # Log Entry Checksum #>>>(0x10048.q+4) ulelong x \b, Log CRC 0x%x # Log Entry Length must be a multiple of 4 KB >>>(0x10048.q+8) ulelong/1024 >4 \b, EntryLength %u KB # Log Entry Tail must be a multiple of 4 KB #>>>(0x10048.q+12) ulelong x \b, Tail 0x%x # Log Entry SequenceNumber #>>>(0x10048.q+16) ulequad x \b, # 0x%llx # Log Entry DescriptorCount may be zero. only 4 bytes in other docs instead 8 #>>>(0x10048.q+24) ulelong x \b, DescriptorCount 0x%llx # Log Entry Reserved must be set to 0 >>>(0x10048.q+28) ulelong !0 \b, Reserved 0x%x # Log Entry LogGuid #>>>(0x10048.q+32) ubequad x \b, Log id 0x%llx #>>>(0x10048.q+40) ubequad x \b-%llx # Log Entry FlushedFileOffset should VHDX size when entry is written. #>>>(0x10048.q+48) ulequad x \b, FlushedFileOffset %llu # Log Entry LastFileOffset #>>>(0x10048.q+56) ulequad x \b, LastFileOffset %llu # filling #>>>(0x10048.q+64) ulequad >0 \b, filling %llx # Reserved[4016] #>>0x10050 ulequad >0 \b, Reserved 0x%llx # VHDX_REGION_TABLE_HEADER Signature 0x69676572~regi at offset 192 KB and 256 KB >0x30000 ulelong !0x69676572 \b, 1st region INVALID >0x30000 ulelong =0x69676572 \b; region # region Checksum. CRC-32C hash over the entire 64-KB table #>>0x30004 ulelong x \b, CRC 0x%x # The EntryCount specifies number of valid entries; Found 2; This must be =< 2047. >>0x30008 ulelong x \b, %u entries # reserved must be zero #>>0x3000C ulelong !0 \b, RESERVED 0x%x # Region Table Entry starts with identifier for the object. often BAT id >>0x30010 use vhdx-id # FileOffset >>0x30020 ulequad x \b, at 0x%llx # Length. Specifies the length of the object within the file #>>0x30028 ulelong x \b, Length 0x%x # 1 means region entry is required. if region not recognized, then REFUSE to load VHDX >>0x3002C ulelong x \b, Required %u # 2nd region entry often metadata id >>0x30030 use vhdx-id # 2nd entry FileOffset >>0x30040 ulequad x \b, at 0x%llx # 1 means region entry is required. if region not recognized, then REFUSE to load VHDX >>0x3004C ulelong x \b, Required %u # 2nd region >>0x40000 ulelong !0x69676572 \b, 2nd region INVALID # check in vhdx images for known id and show names instead hexadecimal 0 name vhdx-id # https://www.windowstricks.in/online-windows-guid-converter # 2DC27766-F623-4200-9D64-115E9BFD4A08 BAT GUID # 6677C22D23F600429D64115E9BFD4A08 BAT ID >0 ubequad =0x6677C22D23F60042 >>8 ubequad =0x9D64115E9BFD4A08 \b, id BAT # no BAT id >>8 default x >>>0 use vhdx-id-hex # 8B7CA206-4790-4B9A-B8FE-575F050F886E Metadata region GUID # 06A27C8B90479A4BB8FE575F050F886E Metadata region ID >0 ubequad =0x06A27C8B90479A4B >>8 ubequad =0xB8FE575F050F886E \b, id Metadata # no Metadata id >>8 default x >>>0 use vhdx-id-hex # 2FA54224-CD1B-4876-B211-5DBED83BF4B8 Virtual Disk Size GUID # 2442A52F1BCD7648B2115DBED83BF4B8 Virtual Disk Size ID # value "virtual size" can be verified by command `qemu-img info ` >0 ubequad =0x2442A52F1BCD7648 >>8 ubequad =0xB2115DBED83BF4B8 \b, id vsize # no Virtual Disk Size ID >>8 default x >>>0 use vhdx-id-hex # other ids >0 default x >>0 use vhdx-id-hex # in vhdx images show id as hexadecimal 0 name vhdx-id-hex >0 ubequad x \b, ID 0x%16.16llx >8 ubequad x \b-%16.16llx # d39 1 a39 1 0 string/b QFI\xFB d46 2 a47 3 # https://www.gnome.org/~markmc/qcow-image-format-version-1.html >4 belong !1 QEMU QCOW2 Image >4 belong 1 QEMU QCOW Image (v1) d69 1 a69 1 # https://www.gnome.org/~markmc/qcow-image-format.html d105 1 a105 1 # https://wiki.qemu.org/Features/QED/Specification @ 1.1.1.5 log @Import 5.39: * Remove unused subtype_mime (Steve Grubb) * Remove unused check in okstat (Steve Grubb) * Fix mime-type in elf binaries by making sure $x is set * Fix indirect negative offsets broken by OFFNEGATIVE * Fix GUID equality check * PR/165: Handle empty array and strings in JSON * PR/162: Add --exclude-quiet * Fix memory leak in ascmagic (Steve Grubb) * Fix string comparison length with ignore whitespace * Fix mingwin 64 compilation * PR/159: whitelist getpid needed for file_pipe2file() * Indicate negative offsets with a flag OFFNEGATIVE so that -0 works. * Introduce "offset" magic type that can be used to detect the file size, and bail on short files. * document DER better in the magic man page. * fix memory leaks (SonarQube) * rewrite confusing loops (SonarQube) * fix bogus test (SonarQube) * pass a sized buffer to file_fmttime() (SonarQube) * Don't allow * in printf formats, or the code itself (Christoph Biedl) * Introduce a printf output size checker to avoid DoS attacks * Avoid memory leak on error (oss-fuzz) * Check length of string on DER before derefercing and add new types * Add missing DER string (oss-fuzz) * Add missing DER types, and debugging * PR/140: Avoid abort with hand-crafted magic file (gockelhahn) * PR/139: Avoid DoS in printf with hand-crafted magic file (gockelhahn) * PR/138: Avoid crash with hand-crafted magic file (gockelhahn) * PR/136: Fix static build by adding a libmagic.pc (Fabrice Fontaine) * add guid support native support via the "guid" type. @ text @d3 1 a3 1 # $File: virtual,v 1.12 2020/02/15 01:20:15 christos Exp $ @ 1.1.1.6 log @2021-03-30 20:21 Christos Zoulas * release 5.40 2021-02-05 16:31 Christos Zoulas * PR/234: Add limit to the number of bytes to scan for encoding * PR/230: Fix /T (trim flag) for regex 2021-02-01 12:31 Christos Zoulas * PR/77: Trim trailing separator. 2020-12-17 15:44 Christos Zoulas * PR/211: Convert system read errors from corrupt ELF files into human readable error messages 2020-12-08 16:24 Christos Zoulas * fix multithreaded decompression file descriptor issue by using close-on-exec (Denys Vlasenko) 2020-06-27 11:58 Christos Zoulas * Exclude surrogate pairs from utf-8 detection (Michael Liu) 2020-06-25 12:53 Christos Zoulas * Include # to the list of ignored format chars (Werner Fink) @ text @d3 1 a3 1 # $File: virtual,v 1.13 2021/02/23 00:51:10 christos Exp $ d12 1 a12 1 0 string connectix Microsoft Disk Image, Virtual Server or Virtual PC d14 2 a15 2 #0 string connectix Microsoft Virtual Hard Disk image #0 string connectix Microsoft Virtual HD image @ 1.1.1.7 log @Import file-5.43+; last was file-5.40 2022-09-20 17:12 Christos Zoulas * fixed various clustefuzz issues 2022-09-19 15:54 Christos Zoulas * Fix error detection for decompression code (Vincent Mihalkovic) 2022-09-15 13:50 Christos Zoulas * Add MAGIC_NO_COMPRESS_FORK and use it to produce a more meaningful error message if we are sandboxing. 2022-09-15 10:45 Christos Zoulas * Add built-in lzip decompression support (Michal Gorny) 2022-09-14 10:35 Christos Zoulas * Add built-in zstd decompression support (Martin Rodriguez Reboredo) 2022-09-13 14:55 Christos Zoulas * release 5.43 2022-09-10 9:17 Christos Zoulas * Add octal indirect magic (Michal Gorny) 2022-08-17 11:43 Christos Zoulas * PR/374: avoid infinite loop in non-wide code (piru) * PR/373: Obey MAGIC_CONTINUE with multiple magic files (vismarli) 2022-07-26 11:10 Christos Zoulas * Fix bug with large flist (Florian Weimer) 2022-07-07 13:21 Christos Zoulas * PR/364: Detect non-nul-terminated core filenames from QEMU (mam-ableton) 2022-07-04 15:45 Christos Zoulas * PR/359: Add support for http://ndjson.org/ (darose) * PR/362: Fix wide printing (ro-ee) * PR/358: Fix width for -f - (jpalus) * PR/356: Fix JSON constant parsing (davewhite) 2022-06-10 9:40 Christos Zoulas * release 5.42 2022-05-31 14:50 Christos Zoulas * PR/348: add missing cases to prevent file from aborting on random magic files. 2022-05-27 21:05 Christos Zoulas * PR/351: octalify filenames when not raw before printing. 2022-04-18 17:51 Christos Zoulas * fix regex cacheing bug (Dirk Mueller) * merge file_regcomp and file_regerror() to simplify the code and reduce memory requirements for storing regexes (Dirk Mueller) 2022-03-19 12:56 Christos Zoulas * cache regex (Dirk Mueller) * detect filesystem full by flushing output (Dirk Mueller) 2021-11-19 12:36 Christos Zoulas * implement running decompressor programs using posix_spawnp(2) instead of vfork(2) 2021-10-24 11:51 Christos Zoulas * Add support for msdos dates and times 2021-10-20 9:55 Christos Zoulas * use the system byte swapping functions if available (Werner Fink) 2021-10-18 11:57 Christos Zoulas * release 5.41 2021-09-23 03:51 Christos Zoulas * Avinash Sonawane: Fix tzname detection 2021-09-03 09:17 Christos Zoulas * Fix relationship tests with "search" magic, don't short circuit logic 2021-07-13 01:06 Christos Zoulas * Fix memory leak in compile mode 2021-07-01 03:51 Christos Zoulas * PR/272: kiefermat: Only set returnval = 1 when we printed something (in all cases print or !print). This simplifies the logic and fixes the issue in the PR with -k and --mime-type there was no continuation printed before the default case. 2021-06-30 13:07 Christos Zoulas * PR/270: Don't translate unprintable characters in %s magic formats when -r * PR/269: Avoid undefined behavior with clang (adding offset to NULL) 2021-05-09 18:38 Christos Zoulas * Add a new flag (f) that requires that the match is a full word, not a partial word match. * Add varint types (unused) 2021-04-19 17:17 Christos Zoulas * PR/256: mutableVoid: If the file is less than 3 bytes, use the file length to determine type * PR/259: aleksandr.v.novichkov: mime printing through indirect magic is not taken into account, use match directly so that it does. 2021-04-04 17:02 Christos Zoulas * count the total bytes found not the total byte positions in order to determine encoding (Anatol Belski) @ text @d3 1 a3 1 # $File: virtual,v 1.17 2022/08/23 08:00:54 christos Exp $ d12 1 a12 1 0 string conectix Microsoft Disk Image, Virtual Server or Virtual PC d14 2 a15 2 #0 string conectix Microsoft Virtual Hard Disk image #0 string conectix Microsoft Virtual HD image d19 1 a19 1 #>8 ubelong !0x00000002 \b, Features %#x d21 1 a21 1 #>8 ubelong &0x00000002 \b, Reserved %#x d23 1 a23 1 #>12 ubelong !0x00010000 \b, Version %#8.8x d25 2 a26 2 #>16 ubequad !0x200 \b, Data Offset %#llx #>16 ubequad x \b, at %#llx d30 1 a30 1 #>(16.Q+64) ubequad x \b, parent name %#llx d38 1 a38 1 #>32 ubelong x \b, Version %#8.8x d48 1 a48 1 #>40 ubequad x \b, o.-Size %#llx d50 1 a50 1 #>48 ubequad x \b, Size %#llx d53 1 a53 1 #>56 ubeshort x \b, Cylinder %#x d56 1 a56 1 #>58 ubyte x \b, Heads %#x d59 1 a59 1 #>59 ubyte x \b, Sectors %#x d62 1 a62 1 >60 ubelong !0x3 \b, type %#x d64 1 a64 1 #>64 ubelong x \b, cksum %#x d66 1 a66 1 #>68 ubequad x \b, id %#16.16llx d69 1 a69 1 >84 ubyte !0 \b, State %#x d71 1 a71 1 #>85 ubequad !0 \b, Reserved %#16.16llx d91 1 a91 1 #>>0x10004 ulelong x \b, CRC %#x d93 1 a93 1 >>0x10008 ulequad x \b, sequence %#llx d95 1 a95 1 #>>0x10010 ubequad x \b, file id %#llx d98 1 a98 1 #>>0x10020 ubequad x \b, data id %#llx d101 1 a101 1 >>0x10030 ubequad >0 \b, log id %#llx d104 1 a104 1 >>0x10040 uleshort >0 \b, LogVersion %#x d106 1 a106 1 >>0x10042 uleshort !1 \b, Version %#x d110 1 a110 1 >>0x10048 ulequad !0x100000 \b, LogOffset %#llx d115 1 a115 1 #>>>(0x10048.q+4) ulelong x \b, Log CRC %#x d119 1 a119 1 #>>>(0x10048.q+12) ulelong x \b, Tail %#x d121 1 a121 1 #>>>(0x10048.q+16) ulequad x \b, # %#llx d123 1 a123 1 #>>>(0x10048.q+24) ulelong x \b, DescriptorCount %#llx d125 1 a125 1 >>>(0x10048.q+28) ulelong !0 \b, Reserved %#x d127 1 a127 1 #>>>(0x10048.q+32) ubequad x \b, Log id %#llx d136 1 a136 1 #>>0x10050 ulequad >0 \b, Reserved %#llx d141 1 a141 1 #>>0x30004 ulelong x \b, CRC %#x d145 1 a145 1 #>>0x3000C ulelong !0 \b, RESERVED %#x d149 1 a149 1 >>0x30020 ulequad x \b, at %#llx d151 1 a151 1 #>>0x30028 ulelong x \b, Length %#x d157 1 a157 1 >>0x30040 ulequad x \b, at %#llx d192 1 a192 1 >0 ubequad x \b, ID %#16.16llx d222 1 a222 2 0 string/b QFI\xFB QEMU QCOW Image !:mime application/x-qemu-disk d230 2 a231 1 >4 belong x (v%d) @