# Magic data for file(1) command.
# Format is described in magic(5).
# Don't edit this file, edit /etc/magic or send your suggested inclusions to
# this file to submit@bugs.debian.org with `Package: file' as the first line
# in the body of the message.

#------------------------------------------------------------------------------
# adventure: file(1) magic for Adventure game files
#
# from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
# Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
#
# ALAN
# I assume there are other, lower versions, but these are the only ones I
# saw in the archive.
0	beshort	0x0206	ALAN text adventure code data
>2	byte	<10	version 2.6%d

# Conflicts with too much other stuff!
# Infocom
# (Note: to avoid false matches Z-machine version 1 and 2 are not
# recognized since only the oldest Zork I and II used them.  Similarly
# there are 4 Infocom games that use verion 4 that are not recognized.)
#0	byte	3	Infocom game data (Z-machine 3,
#>2	beshort	<0x7fff	Release %3d,
#>26	beshort >0	Size %d*2
#>18	string	>\0	Serial %.6s)
#0	byte	5	Infocom game data (Z-machine 5,
#>2	beshort	<0x7fff	Release %3d,
#>26	beshort >0	Size %d*4
#>18	string	>\0	Serial %.6s)
#0	byte	6	Infocom game data (Z-machine 6,
#>2	beshort	<0x7fff	Release %3d,
#>26	beshort >0	Size %d*8
#>18	string	>\0	Serial %.6s)
#0	byte	8	Infocom game data (Z-machine 8,
#>2	beshort	<0x7fff	Release %3d,
#>26	beshort >0	Size %d*8
#>18	string	>\0	Serial %.6s)

# TADS (Text Adventure Development System)
0	string	TADS	TADS game data
>13	string	>\0	(ver. %.6s,
>22	string	>\0	date %s)

#------------------------------------------------------------------------------
# alliant:  file(1) magic for Alliant FX series a.out files
#
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".
# If it's the i860-based one, they should probably become either the
# big-endian or little-endian versions, depending on the mode they ran
# the 860 in....
#
0	short		0420		0420 Alliant virtual executable
>2	short		&0x0020		common library
>16	long		>0		not stripped
0	short		0421		0421 Alliant compact executable
>2	short		&0x0020		common library
>16	long		>0		not stripped
#------------------------------------------------------------------------------
# alpha architecture description
#

0	leshort		0603		COFF format alpha
>22	leshort&030000	!020000		executable
>24	leshort		0410		pure
>24	leshort		0413		paged
>22	leshort&020000	!0		dynamically linked
>16	lelong		!0		not stripped
>16	lelong		0		stripped
>22	leshort&030000	020000		shared library
>24	leshort		0407		object
>27	byte		x		- version %d
>26	byte		x		.%d
>28	byte		x		-%d

# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
#
0	string		Core\001	Alpha COFF format core dump (Digital UNIX)
>24	string		>\0		\b, from '%s'
#------------------------------------------------------------------------------
# amanda:  file(1) magic for amanda file format
#
0	string	AMANDA:\ 		AMANDA 
>8	string	TAPESTART\ DATE		tape header file,
>>23	string	X
>>>25	string	>\ 			Unused %s
>>23	string	>\ 			DATE %s
>8	string	FILE\ 			dump file,
>>13	string	>\ 			DATE %s
#------------------------------------------------------------------------------
# amigaos:  file(1) magic for AmigaOS binary formats:

#
# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
# Some formats are still missing: AmigaOS special IFF's, e.g.: FORM....CTLG
# (the others should be seperate, anyway)
#
0	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
0	belong		0x000003e7	AmigaOS object/library data

#------------------------------------------------------------------------------
# animation:  file(1) magic for animation/movie formats
#
# animation formats
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)

# MPEG animation format
0	belong		0x000001b3		MPEG video stream data
#>4	beshort&0xfff0	x			(%d x
#>5	beshort&0x0fff  x			%d)
0	belong		0x000001ba		MPEG system stream data
# MPEG Audio (*.mpx)
# from dreesen@math.fu-berlin.de
0	beshort		&0xffe0		MPEG
# MPEG 1.0
>1	byte&0x08	=0x08		\b 1.0
# Layer 3
>>1	byte		&0x02		\b layer 3 audio stream data
>>>2	byte&0xf0	=0x10		\b,  32 kBit/s
>>>2	byte&0xf0	=0x20		\b,  40 kBit/s
>>>2	byte&0xf0	=0x30		\b,  48 kBit/s
>>>2	byte&0xf0	=0x40		\b,  56 kBit/s
>>>2	byte&0xf0	=0x50		\b,  64 kBit/s
>>>2	byte&0xf0	=0x60		\b,  80 kBit/s
>>>2	byte&0xf0	=0x70		\b,  96 kBit/s
>>>2	byte&0xf0	=0x80		\b, 112 kBit/s
>>>2	byte&0xf0	=0x90		\b, 128 kBit/s
>>>2	byte&0xf0	=0xA0		\b, 160 kBit/s
>>>2	byte&0xf0	=0xB0		\b, 192 kBit/s
>>>2	byte&0xf0	=0xC0		\b, 224 kBit/s
>>>2	byte&0xf0	=0xD0		\b, 256 kBit/s
>>>2	byte&0xf0	=0xE0		\b, 320 kBit/s
# Layer 2
>>1	byte		&0x04		\b layer 2 audio stream data
>>>2	byte&0xf0	=0x10		\b,  32 kBit/s
>>>2	byte&0xf0	=0x20		\b,  48 kBit/s
>>>2	byte&0xf0	=0x30		\b,  56 kBit/s
>>>2	byte&0xf0	=0x40		\b,  64 kBit/s
>>>2	byte&0xf0	=0x50		\b,  80 kBit/s
>>>2	byte&0xf0	=0x60		\b,  96 kBit/s
>>>2	byte&0xf0	=0x70		\b, 112 kBit/s
>>>2	byte&0xf0	=0x80		\b, 128 kBit/s
>>>2	byte&0xf0	=0x90		\b, 160 kBit/s
>>>2	byte&0xf0	=0xA0		\b, 192 kBit/s
>>>2	byte&0xf0	=0xB0		\b, 224 kBit/s
>>>2	byte&0xf0	=0xC0		\b, 256 kBit/s
>>>2	byte&0xf0	=0xD0		\b, 320 kBit/s
>>>2	byte&0xf0	=0xE0		\b, 384 kBit/s
# freq
>>2	byte&0x0C	=0x00		\b, 44.1 kHz
>>2	byte&0x0C	=0x04		\b, 48 kHz
>>2	byte&0x0C	=0x08		\b, 32 kHz
# MPEG 2.5
>1	byte&0x18	=0x00		\b 2.5
# Layer 3
>>1	byte		&0x02		\b layer 3 audio stream data
# Layer 2
>>1	byte		&0x04		\b layer 2 audio stream data
# MPEG 2.0
>1	byte&0x18	=0x10		\b 2.0
# Layer 3
>>1	byte		&0x02		\b layer 3 audio stream data
# Layer 2
>>1	byte		&0x04		\b layer 2 audio stream data
>>2	byte&0xf0	=0x10		\b,  8 kBit/s
>>2	byte&0xf0	=0x20		\b,  16 kBit/s
>>2	byte&0xf0	=0x30		\b,  24 kBit/s
>>2	byte&0xf0	=0x40		\b,  32 kBit/s
>>2	byte&0xf0	=0x50		\b,  40 kBit/s
>>2	byte&0xf0	=0x60		\b,  48 kBit/s
>>2	byte&0xf0	=0x70		\b,  56 kBit/s
>>2	byte&0xf0	=0x80		\b,  64 kBit/s
>>2	byte&0xf0	=0x90		\b,  80 kBit/s
>>2	byte&0xf0	=0xA0		\b,  96 kBit/s
>>2	byte&0xf0	=0xB0		\b, 112 kBit/s
>>2	byte&0xf0	=0xC0		\b, 128 kBit/s
>>2	byte&0xf0	=0xD0		\b, 144 kBit/s
>>2	byte&0xf0	=0xE0		\b, 160 kBit/s
# freq
>>2	byte&0x0C	=0x00		\b, 22.05 kHz
>>2	byte&0x0C	=0x04		\b, 24 kHz
>>2	byte&0x0C	=0x08		\b, 16 kHz
# misc
>3	byte&0xC0	=0x00		\b, stereo
>3	byte&0xC0	=0x40		\b, jstereo
>3	byte&0xC0	=0x80		\b, dual-ch
>3	byte&0xC0	=0xC0		\b, mono
#>1	byte&0x01	=0x00		\b, Error Protection
#>2	byte&0x02	=0x02		\b, Padding
#>2	byte&0x01	=0x01		\b, Private
#>3	byte&0x08	=0x08		\b, Copyright
#>3	byte&0x04	=0x04		\b, Original
#>3	byte&0x03	1		\b, Emphasis 5
#>3	byte&0x03	3		\b, Emphasis c

# FLI animation format
4	leshort		0xAF11			FLI file
>6	leshort		x			- %d frames,
>8	leshort		x			width=%d pixels,
>10	leshort		x			height=%d pixels,
>12	leshort		x			depth=%d,
>16	leshort		x			ticks/frame=%d
# FLC animation format
4	leshort		0xAF12			FLC file
>6	leshort		x			- %d frames
>8	leshort		x			width=%d pixels,
>10	leshort		x			height=%d pixels,
>12	leshort		x			depth=%d,
>16	leshort		x			ticks/frame=%d

# DL animation format
# XXX - collision with most `mips' magic
#
# I couldn't find a real magic number for these, however, this
# -appears- to work.  Note that it might catch other files, too, so be
# careful!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)!  The DL format is really bad.
#
#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
#>42	byte	x	- %d screens,
#>43	byte	x	%d commands
#0	byte	2	DL version 2
#>1	byte	1	- large format (320x200,1 image/screen),
#>1	byte	2	- medium format (160x100,4 images/screen),
#>1	byte	>2	- unknown format,
#>42	byte	x	%d screens,
#>43	byte	x	%d commands
# Based on empirical evidence, DL version 3 have several nulls following the
# \003.  Most of them start with non-null values at hex offset 0x34 or so.
#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3

# SGI and Apple formats
0	string		MOVI		Silicon Graphics movie file
4	string		moov		Apple QuickTime movie file (moov)
4	string		mdat		Apple QuickTime movie file (mdat)

#------------------------------------------------------------------------------
# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
#       workspaces)
#
0	long		0100554		APL workspace (Ken's original?)

#------------------------------------------------------------------------------
# apple:  file(1) magic for Apple file formats
#
0	string		FiLeStArTfIlEsTaRt	binscii (apple ][) text
0	string		\x0aGL			Binary II (apple ][) data
0	string		NuFile			NuFile archive (apple ][) data
0	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
0	belong		0x00051600		AppleSingle encoded Macintosh file
0	belong		0x00051607		AppleDouble encoded Macintosh file


#------------------------------------------------------------------------------
# applix:  file(1) magic for Applixware
# From: Peter Soos <sp@osb.hu>
#
0	string		*BEGIN		Applixware
>7	string		WORDS			Words Document
>7	string		GRAPHICS		Graphic
>7	string		RASTER			Bitmap
>7	string		SPREADSHEETS		Spreadsheet
>7	string		MACRO			Macro
>7	string		BUILDER			Builder Object

#------------------------------------------------------------------------------
# archive:  file(1) magic for archive formats (see also "msdos" for self-
#           extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are handled in the C code.

# POSIX tar archives
257	string		ustar\0		POSIX tar archive
257	string		ustar\040\040\0	GNU tar archive

# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0	short		070707		cpio archive
0	short		0143561		byte-swapped cpio archive
0	string		070707		ASCII cpio archive (pre-SVR4 or odc)
0	string		070701		ASCII cpio archive (SVR4 with no CRC)
0	string		070702		ASCII cpio archive (SVR4 with CRC)

# Debian package (needs to go before regular portable archives)
#
0	string		!<arch>\ndebian
>8	string		debian-split	part of multipart Debian package
>8	string		debian-binary	Debian binary package
>68	string		>\n		(format %s)
>136	ledate		x		created: %s

# other archives
0	long		0177555		very old archive
0	short		0177555		very old PDP-11 archive
0	long		0177545		old archive
0	short		0177545		old PDP-11 archive
0	long		0100554		apl workspace
0	string		=<ar>		archive

# MIPS archive (needs to go before regular portable archives)
#
0	string	!<arch>\n__________E	MIPS archive
>20	string	U			with MIPS Ucode members
>21	string	L			with MIPSEL members
>21	string	B			with MIPSEB members
>19	string	L			and an EL hash table
>19	string	B			and an EB hash table
>22	string	X			-- out of date

0	string		-h-		Software Tools format archive text

#
# XXX - why are there multiple <ar> thingies?  Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0	string		!<arch>		current ar archive
# 0	long		0x213c6172	archive file
#
# and for SVR1 archives, we have:
#
# 0	string		\<ar>		System V Release 1 ar archive
# 0	string		=<ar>		archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0	string		!<arch>		current ar archive
>8	string		__.SYMDEF	random library
>0	belong		=65538		- pre SR9.5
>0	belong		=65539		- post SR9.5
>0	beshort		2		- object archive
>0	beshort		3		- shared library module
>0	beshort		4		- debug break-pointed module
>0	beshort		5		- absolute code program module
0	string		\<ar>		System V Release 1 ar archive
0	string		=<ar>		archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
0	belong		0x65ff0000	VAX 3.0 archive
0	belong		0x3c61723e	VAX 5.0 archive
#
0	long		0x213c6172	archive file
0	lelong		0177555		very old VAX archive
0	leshort		0177555		very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0	lelong		0177545		old VAX archive
>8	string		__.SYMDEF	random library
0	leshort		0177545		old PDP-11 archive
>8	string		__.SYMDEF	random library
#
# From "pdp" (but why a 4-byte quantity?)
#
0	lelong		0x39bed		PDP-11 old archive
0	lelong		0x39bee		PDP-11 4.0 archive

# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated).  Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
0	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
0	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
0	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
0	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
0	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
0	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched

# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR:  the original entries collide with ARC, above; replaced with combined
#  version (not tested)]
#0	byte		0x1a		RISC OS archive
#>1	string		archive		(ArcFS format)
0	string		\032archive	RISC OS archive (ArcFS format)

# ARJ archiver (jason@jarthur.Claremont.EDU)
0	leshort		0xea60		ARJ archive data
>5	byte		x		\b, v%d,
>8	byte		&0x04		multi-volume,
>8	byte		&0x10		slash-switched,
>8	byte		&0x20		backup,
>34	string		x		original name: %s,
>7	byte		0		os: MS-DOS
>7	byte		1		os: PRIMOS
>7	byte		2		os: Unix
>7	byte		3		os: Amiga
>7	byte		4		os: Macintosh
>7	byte		5		os: OS/2
>7	byte		6		os: Apple ][ GS
>7	byte		7		os: Atari ST
>7	byte		8		os: NeXT
>7	byte		9		os: VAX/VMS
>3	byte		>0		%d]

# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0	string		HA		HA archive data,
#>2	leshort		=1		1 file,
#>2	leshort		>1		%u files,
#>4	byte&0x0f	=0		first is type CPY
#>4	byte&0x0f	=1		first is type ASC
#>4	byte&0x0f	=2		first is type HSC
#>4	byte&0x0f	=0x0e		first is type DIR
#>4	byte&0x0f	=0x0f		first is type SPECIAL

# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0	string		HPAK		HPACK archive data

# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0	string		\351,\001JAM\		JAM archive,
>7	string		>\0			version %.4s
>0x26	byte		=0x27			-
>>0x2b	string          >\0			label %.11s,
>>0x27	lelong		x			serial %08x,
>>0x36	string		>\0			fstype %.8s

# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2	string		-lh0-		LHarc 1.x archive data [lh0]
2	string		-lh1-		LHarc 1.x archive data [lh1]
2	string		-lz4-		LHarc 1.x archive data [lz4]
2	string		-lz5-		LHarc 1.x archive data [lz5]
#	[never seen any but the last; -lh4- reported in comp.compression:]
2	string		-lzs-		LHa 2.x? archive data [lzs]
2	string		-lh\40-		LHa 2.x? archive data [lh ]
2	string		-lhd-		LHa 2.x? archive data [lhd]
2	string		-lh2-		LHa 2.x? archive data [lh2]
2	string		-lh3-		LHa 2.x? archive data [lh3]
2	string		-lh4-		LHa (2.x) archive data [lh4]
2	string		-lh5-		LHa (2.x) archive data [lh5]
>20	byte		x		- header level %d

# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0	string		Rar!		RAR archive data

# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0	string		SQSH		squished archive data (Acorn RISCOS)

# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# I can't figure out the self-extracting form of these buggers...
0	string		UC2\x1a		UC2 archive data

# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0	string		PK\003\004	Zip archive data
>4	byte		0x09		\b, at least v0.9 to extract
>4	byte		0x0a		\b, at least v1.0 to extract
>4	byte		0x0b		\b, at least v1.1 to extract
>4	byte		0x14		\b, at least v2.0 to extract

# Zoo archiver
20	lelong		0xfdc4a7dc	Zoo archive data
>4	byte		>48		\b, v%c.
>>6	byte		>47		\b%c
>>>7	byte		>47		\b%c
>32	byte		>0		\b, modify: v%d
>>33	byte		x		\b.%d+
>42	lelong		0xfdc4a7dc	\b,
>>70	byte		>0		extract: v%d
>>>71	byte		x		\b.%d+

# Shell archives
10	string		#\ This\ is\ a\ shell\ archive	shell archive text

#
# LBR. NB: May conflict with the questionable 
#          "binary Computer Graphics Metafile" format.
#
0       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
#
# PMA (CP/M derivative of LHA)
#
2       string          -pm0-           PMarc archive data [pm0]
2       string          -pm1-           PMarc archive data [pm1]
2       string          -pm2-           PMarc archive data [pm2]
2       string          -pms-           PMarc SFX archive (CP/M, DOS)
5       string          -pc1-           PopCom compressed executable (CP/M)

#------------------------------------------------------------------------------
# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
# strings as "long" - we assume they're just strings:
# From: guy@netapp.com (Guy Harris)
#
0	string		*STA		Aster*x
>7	string		WORD			Words Document
>7	string		GRAP			Graphic
>7	string		SPRE			Spreadsheet
>7	string		MACR			Macro
0	string		2278		Aster*x Version 2
>29	byte		0x36			Words Document
>29	byte		0x35			Graphic
>29	byte		0x32			Spreadsheet
>29	byte		0x38			Macro


#------------------------------------------------------------------------------
# att3b:  file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
# 3B20
#
# The 3B20 conflicts with SCCS.
#0	beshort		0550		3b20 COFF executable
#>12	belong		>0		not stripped
#>22	beshort		>0		- version %ld
#0	beshort		0551		3b20 COFF executable (TV)
#>12	belong		>0		not stripped
#>22	beshort		>0		- version %ld
#
# WE32K
#
0	beshort		0560		WE32000 COFF
>18	beshort		^00000020	object
>18	beshort		&00000020	executable
>12	belong		>0		not stripped
>18	beshort		^00010000	N/A on 3b2/300 w/paging
>18	beshort		&00020000	32100 required
>18	beshort		&00040000	and MAU hardware required
>20	beshort		0407		(impure)
>20	beshort		0410		(pure)
>20	beshort		0413		(demand paged)
>20	beshort		0443		(target shared library)
>22	beshort		>0		- version %ld
0	beshort		0561		WE32000 COFF executable (TV)
>12	belong		>0		not stripped
#>18	beshort		&00020000	- 32100 required
#>18	beshort		&00040000	and MAU hardware required
#>22	beshort		>0		- version %ld
#
# core file for 3b2 
0	string		\000\004\036\212\200	3b2 core file
>364	string		>\0		of '%s'

#------------------------------------------------------------------------------
# audio:  file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
# and others
#

# Sun/NeXT audio data
0	string		.snd		Sun/NeXT audio data:
>12	belong		1		8-bit ISDN u-law,
>12	belong		2		8-bit linear PCM [REF-PCM],
>12	belong		3		16-bit linear PCM,
>12	belong		4		24-bit linear PCM,
>12	belong		5		32-bit linear PCM,
>12	belong		6		32-bit IEEE floating point,
>12	belong		7		64-bit IEEE floating point,
>12	belong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>12	belong		24		compressed (8-bit G.722 ADPCM)
>12	belong		25		compressed (3-bit G.723 ADPCM),
>12	belong		26		compressed (5-bit G.723 ADPCM),
>12	belong		27		8-bit A-law,
>20	belong		1		mono,
>20	belong		2		stereo,
>20	belong		4		quad,
>16	belong		>0		%d Hz

# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
0	lelong		0x0064732E	DEC audio data:
>12	lelong		1		8-bit ISDN u-law,
>12	lelong		2		8-bit linear PCM [REF-PCM],
>12	lelong		3		16-bit linear PCM,
>12	lelong		4		24-bit linear PCM,
>12	lelong		5		32-bit linear PCM,
>12	lelong		6		32-bit IEEE floating point,
>12	lelong		7		64-bit IEEE floating point,
>12	lelong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>20	lelong		1		mono,
>20	lelong		2		stereo,
>20	lelong		4		quad,
>16	lelong		>0		%d Hz

# Creative Labs AUDIO stuff
0	string	MThd			Standard MIDI data
>9 	byte	>0			(format %d)
>11	byte	>1			using %d tracks
0	string	CTMF			Creative Music (CMF) data
0	string	SBI			SoundBlaster instrument data
0	string	Creative\ Voice\ File	Creative Labs voice data
# is this next line right?  it came this way...
>19	byte	0x1A
>23	byte	>0			- version %d
>22	byte	>0			\b.%d

# first entry is also the string "NTRK"
0	belong		0x4e54524b	MultiTrack sound data
>4	belong		x		- version %ld

# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
0	string		EMOD		Extended MOD sound data,
>4	byte&0xf0	x		version %d
>4	byte&0x0f	x		\b.%d,
>45	byte		x		%d instruments
>83	byte		0		(module)
>83	byte		1		(song)

# Real Audio (Magic .ra\0375)
0	belong		0x2e7261fd	RealAudio sound file
0	string		.RMF		RealMedia file

# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
# Oct 31, 1995
0	string		MTM		MultiTracker Module sound file
#0	string		if		Composer 669 Module sound data
0	string		FAR		Module sound data
0	string		MAS_U		ULT(imate) Module sound data
0x2c	string		SCRM		ScreamTracker III Module sound data
0	string		Extended Module	Extended Module sound data

# Gravis UltraSound patches
# From <ache@nagual.ru>

0	string		GF1PATCH110\0ID#000002\0	GUS patch
0	string		GF1PATCH100\0ID#000002\0	Old GUS	patch

#
# Taken from loader code from mikmod version 2.14
# by Steve McIntyre (stevem@chiark.greenend.org.uk)
0	string	JN		extended 669 module data
0	string	MAS_UTrack_V00
>14	string	>/0		ultratracker V1.%.1s module sound data
0	string	UN05		MikMod UNI format module sound data
0	string	Extended\ Module: Fasttracker II module sound data
21	string	!SCREAM!	Screamtracker 2 module sound data
1080	string	M.K.		4-channel Protracker module sound data
1080	string	M!K!		4-channel Protracker module sound data
1080	string	FLT4		4-channel Startracker module sound data
1080	string	4CHN		4-channel Fasttracker module sound data
1080	string	6CHN		6-channel Fasttracker module sound data
1080	string	8CHN		8-channel Fasttracker module sound data
1080	string	CD81		8-channel Oktalyzer module sound data
1080	string	OKTA		8-channel Oktalyzer module sound data
#1082	string	CH
#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
1080	string	16CN		16-channel Taketracker module sound data
1080	string	32CN		32-channel Taketracker module sound data

# TOC sound files -Trevor Johnson <trevor@jpj.net>
#
0       string          TOC             TOC sound file

# sidfiles <pooka@iki.fi>
0	string		SIDPLAY\ INFOFILE	Sidplay info file
0	string		PSID			PlaySID v2.2+ (AMIGA) sidtune
>4	beshort		>0			w/ header v%d,
>14	beshort		=1			single song,
>14	beshort		>1			%d songs,
>16	beshort		>0			default song: %d

#------------------------------------------------------------------------------
# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on
# little-endian machines as well?  If so, what's the deal with
# "VAX-order" and "VAX-order2"?
#
#0	long		0407		68K Blit (standalone) executable
#0	short		0407		VAX-order2 68K Blit (standalone) executable
0	short		03401		VAX-order 68K Blit (standalone) executable
0	long		0406		68k Blit mpx/mux executable
0	short		0406		VAX-order2 68k Blit mpx/mux executable
0	short		03001		VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0	short		0520		tty630 layers executable
#------------------------------------------------------------------------------
# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
#

0	lelong		0314		386 compact demand paged pure executable
>16	lelong		>0		not stripped
>32	byte		0x6a		(uses shared libs)

0	lelong		0407		386 executable
>16	lelong		>0		not stripped
>32	byte		0x6a		(uses shared libs)

0	lelong		0410		386 pure executable
>16	lelong		>0		not stripped
>32	byte		0x6a		(uses shared libs)

0	lelong		0413		386 demand paged pure executable
>16	lelong		>0		not stripped
>32	byte		0x6a		(uses shared libs)

# same as in SunOS 4.x, except for static shared libraries
0	belong&077777777	0600413		sparc demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
>36	belong		0xb4100001	(uses shared libs)

0	belong&077777777	0600410		sparc pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
>36	belong		0xb4100001	(uses shared libs)

0	belong&077777777	0600407		sparc
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
>36	belong		0xb4100001	(uses shared libs)
#------------------------------------------------------------------------------
# c-lang:  file(1) magic for C programs (or REXX)
#

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# if you uncomment "/*" for C/REXX below, also uncomment this entry
#0	string		/*\ XPM\ */	X pixmap image data

# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
#0	string		/*		C or REXX program text
#0	string		//		C++ program text

#------------------------------------------------------------------------------
# chi:  file(1) magic for ChiWriter files
#
0       string          \\1cw\          ChiWriter file
>5      string          >\0             version %s
0       string          \\1cw           ChiWriter file
#------------------------------------------------------------------------------
# cisco:  file(1) magic for cisco Systems routers
#
# Most cisco file-formats are covered by the generic elf code
#
# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
0	belong&0xffffff00	0x85011400  cisco IOS microcode
>7	string		>\0		    for '%s'
0	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
>7	string		>\0		    for '%s'

#------------------------------------------------------------------------------
# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
# >18	short		!074000,000000	C1 R1 
# >18	short		!074000,004000	C2 R1
# >18	short		!074000,010000	C3 R1
# >18	short		!074000,074000	TEST
#
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# >18	short&074000	000000		C1 R1 
# >18	short&074000	004000		C2 R1
# >18	short&074000	010000		C3 R1
# >18	short&074000	074000		TEST
#
# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
# sort, nor does SunOS 4.x, so either it's something Intergraph added
# in CLIX, or something AT&T added in SVR3.2 or later, or something
# somebody else thought was a good idea; it's not documented in the
# man page for this version of "magic", nor does it appear to be
# implemented (at least not after I blew off the bogus code to turn
# old-style "&"s into new-style "&"s, which just didn't work at all).
#
0	short		0575		CLIPPER COFF executable (VAX #)
>20	short		0407		(impure)
>20	short		0410		(5.2 compatible)
>20	short		0411		(pure)
>20	short		0413		(demand paged)
>20	short		0443		(target shared library)
>12	long		>0		not stripped
>22	short		>0		- version %ld
0	short		0577		CLIPPER COFF executable
>18	short&074000	000000		C1 R1 
>18	short&074000	004000		C2 R1
>18	short&074000	010000		C3 R1
>18	short&074000	074000		TEST
>20	short		0407		(impure)
>20	short		0410		(pure)
>20	short		0411		(separate I&D)
>20	short		0413		(paged)
>20	short		0443		(target shared library)
>12	long		>0		not stripped
>22	short		>0		- version %ld
>48	long&01		01		alignment trap enabled
>52	byte		1		-Ctnc
>52	byte		2		-Ctsw
>52	byte		3		-Ctpw
>52	byte		4		-Ctcb
>53	byte		1		-Cdnc
>53	byte		2		-Cdsw
>53	byte		3		-Cdpw
>53	byte		4		-Cdcb
>54	byte		1		-Csnc
>54	byte		2		-Cssw
>54	byte		3		-Cspw
>54	byte		4		-Cscb
4	string		pipe		CLIPPER instruction trace
4	string		prof		CLIPPER instruction profile

#------------------------------------------------------------------------------
# commands:  file(1) magic for various shells and interpreters
#
0	string		:\ shell archive or commands for antique kernel text
0	string		#!/bin/sh		Bourne shell script text
0	string		#!\ /bin/sh		Bourne shell script text
0	string		#!\	/bin/sh		Bourne shell script text
0	string		#!/bin/csh		C shell script text
0	string		#!\ /bin/csh		C shell script text
0	string		#!\	/bin/csh	C shell script text
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0	string		#!/bin/ksh		Korn shell script text
0	string		#!\ /bin/ksh		Korn shell script text
0	string		#!\	/bin/ksh	Korn shell script text
0	string	 	#!/bin/tcsh		Tenex C shell script text
0	string	 	#!\ /bin/tcsh		Tenex C shell script text
0	string	 	#!\	/bin/tcsh	Tenex C shell script text
0	string		#!/usr/local/tcsh	Tenex C shell script text
0	string	 	#!\ /usr/local/tcsh	Tenex C shell script text
0	string		#!/usr/local/bin/tcsh	Tenex C shell script text
0	string		#!\ /usr/local/bin/tcsh	Tenex C shell script text
0	string		#!\	/usr/local/bin/tcsh	Tenex C shell script text
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0	string		#!/usr/local/bin/zsh	Paul Falstad's zsh
0	string		#!\ /usr/local/bin/zsh	Paul Falstad's zsh
0	string		#!\	/usr/local/bin/zsh	Paul Falstad's zsh
0	string		#!/usr/local/bin/ash	Neil Brown's ash
0	string		#!\ /usr/local/bin/ash	Neil Brown's ash
0	string		#!\	/usr/local/bin/ash	Neil Brown's ash
0	string		#!/usr/local/bin/ae	Neil Brown's ae
0	string		#!\ /usr/local/bin/ae	Neil Brown's ae
0	string		#!\	/usr/local/bin/ae	Neil Brown's ae
0	string		#!/bin/nawk		new awk script text
0	string		#!\ /bin/nawk		new awk script text
0	string		#!\	/bin/nawk		new awk script text
0	string		#!/usr/bin/nawk		new awk script text
0	string		#!\ /usr/bin/nawk	new awk script text
0	string		#!\	/usr/bin/nawk	new awk script text
0	string		#!/usr/local/bin/nawk	new awk script text
0	string		#!\ /usr/local/bin/nawk	new awk script text
0	string		#!\	/usr/local/bin/nawk	new awk script text
0	string		#!/bin/gawk		GNU awk script text
0	string		#!\ /bin/gawk		GNU awk script text
0	string		#!\	/bin/gawk		GNU awk script text
0	string		#!/usr/bin/gawk		GNU awk script text
0	string		#!\ /usr/bin/gawk	GNU awk script text
0	string		#!\	/usr/bin/gawk	GNU awk script text
0	string		#!/usr/local/bin/gawk	GNU awk script text
0	string		#!\ /usr/local/bin/gawk	GNU awk script text
0	string		#!\	/usr/local/bin/gawk	GNU awk script text
#
0	string		#!/bin/awk		awk script text
0	string		#!\ /bin/awk		awk script text
0	string		#!\	/bin/awk		awk script text
0	string		#!/usr/bin/awk		awk script text
0	string		#!\ /usr/bin/awk	awk script text
0	string		#!\	/usr/bin/awk	awk script text
0	string		BEGIN			awk script text

# For Larry Wall's perl language.  The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
#				Keith Waclena <keith@cerberus.uchicago.edu>
0	string		#!/bin/perl			perl script text
0	string		#!\ /bin/perl			perl script text
0	string		#!\	/bin/perl		perl script text
0	string		eval\ "exec\ /bin/perl		perl script text
0	string		#!/usr/bin/perl			perl script text
0	string		#!\ /usr/bin/perl		perl script text
0	string		#!\	/usr/bin/perl		perl script text
0	string		eval\ "exec\ /usr/bin/perl	perl script text
0	string		#!/usr/local/bin/perl		perl script text
0	string		#!\ /usr/local/bin/perl		perl script text
0	string		#!\	/usr/local/bin/perl	perl script text
0	string		eval\ "exec\ /usr/local/bin/perl	perl script text

# AT&T Bell Labs' Plan 9 shell
0	string		#!/bin/rc	Plan 9 rc shell script text
0	string		#!\ /bin/rc	Plan 9 rc shell script text
0	string		#!\	/bin/rc	Plan 9 rc shell script text

# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0	string		#!/bin/bash	Bourne-Again shell script text
0	string		#!\ /bin/bash	Bourne-Again shell script text
0	string		#!\	/bin/bash	Bourne-Again shell script text
0	string		#!/usr/local/bin/bash	Bourne-Again shell script text
0	string		#!\ /usr/local/bin/bash	Bourne-Again shell script text
0	string		#!\	/usr/local/bin/bash	Bourne-Again shell script text

# generic shell magic
0	string		#!\ /			a
>3	string		>\n			%s script text
0	string		#!\	/		a
>3	string		>\n			%s script text
0	string		#!/			a
>2	string		>\n			%s script text
0	string		#!\ 			script text
>3	string		>\0			for %s

#------------------------------------------------------------------------------
# compress:  file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.

# standard unix compress
0	string		\037\235	compress'd data
>2	byte&0x80	>0		block compressed
>2	byte&0x1f	x		%d bits

# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
0       string          \037\213        gzip compressed data
>2      byte            <8              \b, reserved method,
>2      byte            8               \b, deflated,
>3	byte		&0x01		ASCII,
>3	byte		&0x02		continuation,
>3	byte		&0x04		extra field,
>3	byte		&0x08		original filename,
>3	byte		&0x10		comment,
>3	byte		&0x20		encrypted,
>4	ledate		x		last modified: %s,
>8	byte		2		max compression,
>8	byte		4		max speed,
>9	byte		=0x00		os: MS-DOS
>9	byte		=0x01		os: Amiga
>9	byte		=0x02		os: VMS
>9	byte		=0x03		os: Unix
>9	byte		=0x05		os: Atari
>9	byte		=0x06		os: OS/2
>9	byte		=0x07		os: MacOS
>9	byte		=0x0A		os: Tops/20
>9	byte		=0x0B		os: Win/32

# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0	string		\037\036	packed data
>2	belong		>1		\b, %d characters originally
>2	belong		=1		\b, %d character originally
#
# This magic number is byte-order-independent.  XXX - Does that mean this
# is big-endian, little-endian, either, or that you can't tell?
# this short is valid for SunOS
0	short		017437		old packed data

# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0	short		0x1fff		compacted data
# This string is valid for SunOS (BE) and a matching "short" is listed
# in the Ultrix (LE) magic file.
0	string		\377\037	compacted data
0	short		0145405		huf output

# bzip2
0	string		BZh		bzip2 compressed data
>3	byte		>47		\b, block size = %c00k

# squeeze and crunch
# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
0	beshort		0x76FF		squeezed data,
>4	string		x		original name %s
0	beshort		0x76FE		crunched data,
>2	string		x		original name %s
0	beshort		0x76FD		LZH compressed data,
>2	string		x		original name %s

# Freeze
0	string		\037\237	frozen file 2.1
0	string		\037\236	frozen file 1.0 (or gzip 0.5)

# SCO compress -H (LZH)
0	string		\037\240	SCO compress -H (LZH) data

# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# There's only a magic nibble (4 bits); that nibble repeats every 33
# bytes.  This isn't suited for use, but maybe we can use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0	byte&0xF0	0xd0		data
#>33	byte&0xF0	0xd0
#>66	byte&0xF0	0xd0
#>99	byte&0xF0	0xd0
#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio

# bzip	a block-sorting file compressor
#	by Julian Seward <sewardj@cs.man.ac.uk> and others
#
0	string		BZ		bzip compressed	data
>2	byte		x		\b, version: %c
>3	string		=1		\b, compression block size 100k
>3	string		=2		\b, compression block size 200k
>3	string		=3		\b, compression block size 300k
>3	string		=4		\b, compression block size 400k
>3	string		=5		\b, compression block size 500k
>3	string		=6		\b, compression block size 600k
>3	string		=7		\b, compression block size 700k
>3	string		=8		\b, compression block size 800k
>3	string		=9		\b, compression block size 900k

# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
0	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
>9	beshort		<0x0940
>>9	byte&0xf0	=0x00		- version 0.
>>9	beshort&0x0fff	x		\b%03x,
>>13	byte		1		LZO1X-1,
>>13	byte		2		LZO1X-1(15),
>>13	byte		3		LZO1X-999,
## >>22	bedate		>0		last modified: %s,
>>14	byte		=0x00		os: MS-DOS
>>14	byte		=0x01		os: Amiga
>>14	byte		=0x02		os: VMS
>>14	byte		=0x03		os: Unix
>>14	byte		=0x05		os: Atari
>>14	byte		=0x06		os: OS/2
>>14	byte		=0x07		os: MacOS
>>14	byte		=0x0A		os: Tops/20
>>14	byte		=0x0B		os: WinNT
>>14	byte		=0x0E		os: Win32
>9	beshort		>0x0939
>>9	byte&0xf0	=0x00		- version 0.
>>9	byte&0xf0	=0x10		- version 1.
>>9	byte&0xf0	=0x20		- version 2.
>>9	beshort&0x0fff	x		\b%03x,
>>15	byte		1		LZO1X-1,
>>15	byte		2		LZO1X-1(15),
>>15	byte		3		LZO1X-999,
## >>25	bedate		>0		last modified: %s,
>>17	byte		=0x00		os: MS-DOS
>>17	byte		=0x01		os: Amiga
>>17	byte		=0x02		os: VMS
>>17	byte		=0x03		os: Unix
>>17	byte		=0x05		os: Atari
>>17	byte		=0x06		os: OS/2
>>17	byte		=0x07		os: MacOS
>>17	byte		=0x0A		os: Tops/20
>>17	byte		=0x0B		os: WinNT
>>17	byte		=0x0E		os: Win32
#------------------------------------------------------------------------------
# convex:  file(1) magic for Convex boxes
#
# Convexes are big-endian.
#
# /*\
#  * Below are the magic numbers and tests added for Convex.
#  * Added at beginning, because they are expected to be used most.
# \*/
0	belong	0507	Convex old-style object
>16	belong	>0	not stripped
0	belong	0513	Convex old-style demand paged executable
>16	belong	>0	not stripped
0	belong	0515	Convex old-style pre-paged executable
>16	belong	>0	not stripped
0	belong	0517	Convex old-style pre-paged, non-swapped executable
>16	belong	>0	not stripped
0	belong	0x011257	Core file
#
# The following are a series of dump format magic numbers.  Each one
# corresponds to a drastically different dump format.  The first on is
# the original dump format on a 4.1 BSD or earlier file system.  The
# second marks the change between the 4.1 file system and the 4.2 file
# system.  The Third marks the changing of the block size from 1K
# to 2K to be compatible with an IDC file system.  The fourth indicates
# a dump that is dependent on Convex Storage Manager, because data in
# secondary storage is not physically contained within the dump.
# The restore program uses these number to determine how the data is
# to be extracted.
#
24	belong	=60011	dump format, 4.1 BSD or earlier
24	belong	=60012	dump format, 4.2 or 4.3 BSD without IDC
24	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
24	belong	=60014	dump format, Convex Storage Manager by-reference dump
#
# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
# If there is no `=' sign, assume just checking for whether the bit is set?
#
0	belong	0601		Convex SOFF
>88	belong&0x000f0000	=0x00000000	c1
>88	belong			&0x00010000	c2
>88	belong			&0x00020000	c2mp
>88	belong			&0x00040000	parallel
>88	belong			&0x00080000	intrinsic
>88	belong			&0x00000001	demand paged
>88	belong			&0x00000002	pre-paged
>88	belong			&0x00000004	non-swapped
>88	belong			&0x00000008	POSIX
#
>84	belong			&0x80000000	executable
>84	belong			&0x40000000	object
>84	belong&0x20000000	=0		not stripped
>84	belong&0x18000000	=0x00000000	native fpmode
>84	belong&0x18000000	=0x10000000	ieee fpmode
>84	belong&0x18000000	=0x18000000	undefined fpmode
#
0	belong			0605		Convex SOFF core
#
0	belong			0607		Convex SOFF checkpoint
>88	belong&0x000f0000	=0x00000000	c1
>88	belong			&0x00010000	c2
>88	belong			&0x00020000	c2mp
>88	belong			&0x00040000	parallel
>88	belong			&0x00080000	intrinsic
>88	belong			&0x00000008	POSIX
#
>84	belong&0x18000000	=0x00000000	native fpmode
>84	belong&0x18000000	=0x10000000	ieee fpmode
>84	belong&0x18000000	=0x18000000	undefined fpmode

#------------------------------------------------------------------------------
# database:  file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
#
# GDBM magic numbers
#  Will be maintained as part of the GDBM distribution in the future.
#  <downsj@teeny.org>
0	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian
0	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian
0	string	GDBM		GNU dbm 2.x database
#
0	belong	0x061561	Berkeley DB
>4	belong	>2		1.86
>4	belong	<3		1.85
>8	belong	4321		Hash/Big Endian
>8	belong	1234		Hash/Little Endian
>4	belong	>0		(Version %d,
>12	belong	x		Bucket Size %d,
>16	belong	x		Bucket Shift %d,
>20	belong	x		Directory Size %d,
>24	belong	x		Segment Size %d,
>28	belong	x		Segment Shift %d,
>32	belong	x		Overflow Point %d,
>36	belong	x		Last Freed %d,
>40	belong	x		Max Bucket %d,
>44	belong	x		High Mask 0x%x,
>48	belong	x		Low Mask 0x%x,
>52	belong	x		Fill Factor %d,
>56	belong	x		Number of Keys %d)
#
#
0	belong	0x053162	Berkeley DB 1.85/1.86 Btree/Big Endian
>4	belong	>0		(Version %d,
>8	belong	x		Page Size %d,
>12	belong	x		Free Page %d,
>16	belong	x		Number of Records %d,
>20	belong	x		Flags 0x%x)
0	lelong	0x053162	Berkeley DB 1.85/1.86 Btree/Little Endian
>4	lelong	>0		(Version %d,
>8	lelong	x		Page Size %d,
>12	lelong	x		Free Page %d,
>16	lelong	x		Number of Records %d,
>20	lelong	x		Flags 0x%x)
#
#
12	belong	0x061561	Berkeley DB 2.X Hash/Big Endian
>16	belong	>0		(Version %d,
>0	belong  x		Logical sequence number: file - %d,
>4	belong  x		offset - %d,
>20	belong	x		Bucket Size %d,
>24	belong	x		Overflow Point %d,
>28	belong	x		Last Freed %d,
>32	belong	x		Max Bucket %d,
>36	belong	x		High Mask 0x%x,
>40	belong	x		Low Mask 0x%x,
>44	belong	x		Fill Factor %d,
>48	belong	x		Number of Keys %d)
#
# DB2.X formats from Khimenko Victor <khim@sch57.msk.ru>
#
12	lelong	0x061561	Berkeley DB 2.X Hash/Little Endian
>16	lelong	>0		(Version %d,
>0	lelong  x		Logical sequence number: file - %d,
>4	lelong  x		offset - %d,
>20	lelong	x		Bucket Size %d,
>24	lelong	x		Overflow Point %d,
>28	lelong	x		Last Freed %d,
>32	lelong	x		Max Bucket %d,
>36	lelong	x		High Mask 0x%x,
>40	lelong	x		Low Mask 0x%x,
>44	lelong	x		Fill Factor %d,
>48	lelong	x		Number of Keys %d)
#
#
12	belong	0x053162	Berkeley DB 2.X Btree/Big Endian
>16	belong	>0		(Version %d, 
>0	belong  x		Logical sequence number: file - %d,
>4	belong  x		offset - %d,
>20	belong	x		Page Size %d,
>24	belong	x		Maxkey %d,
>28	belong	x		Minkey %d,
>32	belong	x		Free Page %d)
#
#
12	lelong	0x053162	Berkeley DB 2.X Btree/Little Endian
>16	lelong	>0		(Version %d,
>0	lelong  x		Logical sequence number: file - %d,
>4	lelong  x		offset - %d,
>20	lelong	x		Page Size %d,
>24	lelong	x		Maxkey %d,
>28	lelong	x		Minkey %d,
>32	lelong	x		Free Page %d)

#------------------------------------------------------------------------------
# diamond:  file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
# XXX - I think it was either renamed Slate, or replaced by Slate....
#
#	The full deal is too long...
#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
0	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document

#------------------------------------------------------------------------------
# diff:  file(1) magic for diff(1) output
#
0	string		diff\ 	'diff' output text
0	string		***\ 		'diff' output text
0	string		Only\ in\ 	'diff' output text
0	string		Common\ subdirectories:\ 	'diff' output text

# xdelta is like diff(1) for binary files (works for text, too).
# Available from: ftp://ftp.xcf.berkeley.edu/pub/xdelta/
0       string          %XDZ            xdelta diff file
>4      string          >%              version %.3s
#  Digital UNIX - Info
#
0	string	!<arch>\n________64E	Alpha archive
>22	string	X			-- out of date
#
# Alpha COFF Based Executables
# The stripped stuff really needs to be an 8 byte (64 bit) compare,
# but this works
0	leshort		0x183		COFF format alpha
>22	leshort&020000	&010000		sharable library,
>22	leshort&020000	^010000		dynamically linked,
>24	leshort		0410		pure
>24	leshort		0413		demand paged
>8	lelong		>0		executable or object module, not stripped
>8	lelong		0
>>12	lelong		0		executable or object module, stripped
>>12	lelong		>0		executable or object module, not stripped
>27     byte            >0              - version %d.
>26     byte            >0              %d-
>28     leshort         >0              %d
#
# The next is incomplete, we could tell more about this format,
# but its not worth it.
0	leshort		0x188	Alpha compressed COFF
0	leshort		0x18f	Alpha u-code object
#
#
# Some other interesting Digital formats,
0	string	\377\377\177		ddis/ddif
0	string	\377\377\174		ddis/dots archive
0	string	\377\377\176		ddis/dtif table data
0	string	\033c\033		LN03 output
0	long	04553207		X image
#
0	string	!<PDF>!\n		profiling data file
#
# Locale data tables (MIPS and Alpha).
#
0	short		0x0501		locale data table
>6	short		0x24		for MIPS
>6	short		0x40		for Alpha

#------------------------------------------------------------------------------
# dump:  file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
24	belong	60012		new-fs dump file (big endian),
>4	bedate	x		Previous dump %s,
>8	bedate	x		This dump %s,
>12	belong	>0		Volume %ld,
>692	belong	0		Level zero, type:
>692	belong	>0		Level %d, type:
>0	belong	1		tape header,
>0	belong	2		beginning of file record,
>0	belong	3		map of inodes on tape,
>0	belong	4		continuation of file record,
>0	belong	5		end of volume,
>0	belong	6		map of inodes deleted,
>0	belong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	belong	>0		Flags %x

24	belong	60011		old-fs dump file (big endian),
#>4	bedate	x		Previous dump %s,
#>8	bedate	x		This dump %s,
>12	belong	>0		Volume %ld,
>692	belong	0		Level zero, type:
>692	belong	>0		Level %d, type:
>0	belong	1		tape header,
>0	belong	2		beginning of file record,
>0	belong	3		map of inodes on tape,
>0	belong	4		continuation of file record,
>0	belong	5		end of volume,
>0	belong	6		map of inodes deleted,
>0	belong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	belong	>0		Flags %x

24	lelong	60012		new-fs dump file (little endian),
>4	ledate	x		This dump %s,
>8	ledate	x		Previous dump %s,
>12	lelong	>0		Volume %ld,
>692	lelong	0		Level zero, type:
>692	lelong	>0		Level %d, type:
>0	lelong	1		tape header,
>0	lelong	2		beginning of file record,
>0	lelong	3		map of inodes on tape,
>0	lelong	4		continuation of file record,
>0	lelong	5		end of volume,
>0	lelong	6		map of inodes deleted,
>0	lelong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	lelong	>0		Flags %x

24	lelong	60011		old-fs dump file (little endian),
#>4	ledate	x		Previous dump %s,
#>8	ledate	x		This dump %s,
>12	lelong	>0		Volume %ld,
>692	lelong	0		Level zero, type:
>692	lelong	>0		Level %d, type:
>0	lelong	1		tape header,
>0	lelong	2		beginning of file record,
>0	lelong	3		map of inodes on tape,
>0	lelong	4		continuation of file record,
>0	lelong	5		end of volume,
>0	lelong	6		map of inodes deleted,
>0	lelong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	lelong	>0		Flags %x

#------------------------------------------------------------------------------
# elf:  file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# MIPS R3000 may also be for MIPS R2000.
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\177ELF		ELF
>4	byte		0		invalid class
>4	byte		1		32-bit
# only for MIPS R3000_BE
>>18	beshort		8
>>>36   belong          &0x20           N32
>4	byte		2		64-bit
>5	byte		0		invalid byte order
>5	byte		1		LSB
>>16	leshort		0		no file type,
>>16	leshort		1		relocatable,
>>16	leshort		2		executable,
>>16	leshort		3		shared object,
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
>>16	leshort		4		core file
>>>(0x38+0xcc) string	>\0		of '%s'
>>>(0x38+0x10) lelong	>0		(signal %d),
>>16	leshort		&0xff00		processor-specific,
>>18	leshort		0		no machine,
>>18	leshort		1		AT&T WE32100 - invalid byte order,
>>18	leshort		2		SPARC - invalid byte order,
>>18	leshort		3		Intel 80386,
>>18	leshort		4		Motorola 68000 - invalid byte order,
>>18	leshort		5		Motorola 88000 - invalid byte order,
>>18	leshort		6		Intel 80486,
>>18	leshort		7		Intel 80860,
>>18	leshort		8		MIPS R3000_BE - invalid byte order,
>>18	leshort		9		Amdahl - invalid byte order,
>>18	leshort		10		MIPS R3000_LE,
>>18	leshort		11		RS6000 - invalid byte order,
>>18	leshort		15		PA-RISC - invalid byte order,
>>18	leshort		16		nCUBE,
>>18	leshort		17		Fujitsu VPP500,
>>18	leshort		18		SPARC32PLUS,
>>18	leshort		20		PowerPC,
>>18	leshort		36		NEC V800,
>>18	leshort		37		Fujitsu FR20,
>>18	leshort		38		TRW RH-32,
>>18	leshort		39		Motorola RCE,
>>18	leshort		40		Advanced RISC Machines ARM,
>>18	leshort		41		Alpha,
>>18	leshort		42		Hitachi SH,
>>18	leshort		43		SPARC V9 - invalid byte order,
>>18	leshort		44		Siemens Tricore Embedded Processor,
>>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
>>18	leshort		46		Hitachi H8/300,
>>18	leshort		47		Hitachi H8/300H,
>>18	leshort		48		Hitachi H8S,
>>18	leshort		49		Hitachi H8/500,
>>18	leshort		50		IA-64 (Intel 64 bit architecture)
>>18	leshort		51		Stanford MIPS-X,
>>18	leshort		52		Motorola Coldfire,
>>18	leshort		53		Motorola M68HC12,
>>18	leshort		0x9026		Alpha (unofficial),
>>20	lelong		0		invalid version
>>20	lelong		1		version 1
>>36	lelong		1		MathCoPro/FPU/MAU Required
>8	string		>\0		(%s)
>5	byte		2		MSB
# only for MIPS R3000_BE
>>18    beshort		8
# only for 32-bit
>>>4	byte		1
>>>>36  belong&0xf0000000       0x00000000      mips-1
>>>>36  belong&0xf0000000       0x10000000      mips-2
>>>>36  belong&0xf0000000       0x20000000      mips-3
>>>>36  belong&0xf0000000       0x30000000      mips-4
>>>>36  belong&0xf0000000       0x40000000      mips-5
>>>>36  belong&0xf0000000       0x50000000      mips-6
# only for 64-bit
>>>4	byte		2
>>>>48  belong&0xf0000000       0x00000000      mips-1
>>>>48  belong&0xf0000000       0x10000000      mips-2
>>>>48  belong&0xf0000000       0x20000000      mips-3
>>>>48  belong&0xf0000000       0x30000000      mips-4
>>>>48  belong&0xf0000000       0x40000000      mips-5
>>>>48  belong&0xf0000000       0x50000000      mips-6
>>16	beshort		0		no file type,
>>16	beshort		1		relocatable,
>>16	beshort		2		executable,
>>16	beshort		3		shared object,
>>16	beshort		4		core file,
>>>(0x38+0xcc) string	>\0		of '%s'
>>>(0x38+0x10) belong	>0		(signal %d),
>>16	beshort		&0xff00		processor-specific,
>>18	beshort		0		no machine,
>>18	beshort		1		AT&T WE32100,
>>18	beshort		2		SPARC,
>>18	beshort		3		Intel 80386 - invalid byte order,
>>18	beshort		4		Motorola 68000,
>>18	beshort		5		Motorola 88000,
>>18	beshort		6		Intel 80486 - invalid byte order,
>>18	beshort		7		Intel 80860,
>>18	beshort		8		MIPS R3000_BE,
>>18	beshort		9		Amdahl,
>>18	beshort		10		MIPS R3000_LE - invalid byte order,
>>18	beshort		11		RS6000,
>>18	beshort		15		PA-RISC,
>>18	beshort		16		nCUBE,
>>18	beshort		17		Fujitsu VPP500,
>>18	beshort		18		SPARC32PLUS,
>>>36	belong&0xffff00	&0x000100	V8+ Required,
>>>36	belong&0xffff00	&0x000200	Sun UltraSPARC1 Extensions Required,
>>>36	belong&0xffff00	&0x000400	HaL R1 Extensions Required,
>>>36	belong&0xffff00	&0x000800	Sun UltraSPARC3 Extensions Required,
>>18	beshort		20		PowerPC or cisco 4500,
>>18	beshort		21		cisco 7500,
>>18	beshort		24		cisco SVIP,
>>18	beshort		25		cisco 7200,
>>18	beshort		36		NEC V800 or cisco 12000,
>>18	beshort		37		Fujitsu FR20,
>>18	beshort		38		TRW RH-32,
>>18	beshort		39		Motorola RCE,
>>18	beshort		40		Advanced RISC Machines ARM,
>>18	beshort		41		Alpha,
>>18	beshort		42		Hitachi SH,
>>18	beshort		43		SPARC V9,
>>18	beshort		44		Siemens Tricore Embedded Processor,
>>18	beshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
>>18	beshort		46		Hitachi H8/300,
>>18	beshort		47		Hitachi H8/300H,
>>18	beshort		48		Hitachi H8S,
>>18	beshort		49		Hitachi H8/500,
>>18	beshort		50		Intel Merced Processor,
>>18	beshort		51		Stanford MIPS-X,
>>18	beshort		52		Motorola Coldfire,
>>18	beshort		53		Motorola M68HC12,
>>18	beshort		0x9026		Alpha (unofficial),
>>20	belong		0		invalid version
>>20	belong		1		version 1
>>36	belong		1		MathCoPro/FPU/MAU Required

#------------------------------------------------------------------------------
# encore:  file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
#
0	short		0x154		Encore
>20	short		0x107		executable
>20	short		0x108		pure executable
>20	short		0x10b		demand-paged executable
>20	short		0x10f		unsupported executable
>12	long		>0		not stripped
>22	short		>0		- version %ld
>22	short		0		-
#>4	date		x		stamp %s
0	short		0x155		Encore unsupported executable
>12	long		>0		not stripped
>22	short		>0		- version %ld
>22	short		0		-
#>4	date		x		stamp %s

#------------------------------------------------------------------------------
# filesystems:  file(1) magic for different filesystems
#
0x438	leshort	0xEF53			Linux/i386 ext2 filesystem
0	string	\366\366\366\366	PC formatted floppy with no filesystem
# Sun disk labels
# From /usr/include/sun/dklabel.h:
0774	beshort		0xdabe		Sun disk label
>0	string		x		'%s
>>31  	string		>\0		\b%s
>>>63  	string		>\0		\b%s
>>>>95 	string		>\0		\b%s
>0	string		x		\b'
>0734	short		>0		%d rpm,
>0736	short		>0		%d phys cys,
>0740	short		>0		%d alts/cyl,
>0746	short		>0		%d interleave,
>0750	short		>0		%d data cyls,
>0752	short		>0		%d alt cyls,
>0754	short		>0		%d heads/partition,
>0756	short		>0		%d sectors/track,
>0764	long		>0		start cyl %ld,
>0770	long		x		%ld blocks
# Is there a boot block written 1 sector in?
>512    belong&077777777	0600407	\b, boot block present

# Moved to linux.
#0x1FE	leshort	0xAA55			x86 boot sector
#>2	string	OSBS			\b, OS/BS MBR
#>0x8C	string	Invalid\ partition\ table	\b, MS-DOS MBR
#>0	string	\0\0\0\0		\b, extended partition table
#>0	leshort 0x3CEB			\b, system
#>>3	string	>\0			%s
#>>0x36	string	FAT			\b, %s
#>>>0x39	string	12			(%s bit)
#>>>0x39	string	16			(%s bit)
#>0x52	string	FAT32			\b, FAT (32 bit)
#>>>43	string		>NO\ NAME	label: %.11s,
#>>>43	string		<NO\ NAME	label: %.11s,
#>>>43	string		NO\ NAME	unlabeled,
#>>>19	leshort		>0		%d sectors
#>>>19	leshort		0		
#>>>>32	lelong		x		%d sectors
#>0x200	lelong	0x82564557		\b, BSD disklabel

# Minix filesystems - Juan Cspedes <cespedes@debian.org>
0x410	leshort		0x137f		Minix filesystem
0x410	leshort		0x138f		Minix filesystem, 30 char names
0x410	leshort		0x2468		Minix filesystem, version 2
0x410	leshort		0x2478		Minix filesystem, version 2, 30 char names

# romfs filesystems - Juan Cspedes <cespedes@debian.org>
0	string		-rom1fs-\0	romfs filesystem, version 1
>8	belong	x			%d bytes,
>16	string	x			named %s.

# netboot image - Juan Cspedes <cespedes@debian.org>
0	lelong		0x1b031336L	Netboot image,
>4	lelong&0xFFFFFF00	0
>>4	lelong&0x100	0x000		mode 2
>>4	lelong&0x100	0x100		mode 3
>4	lelong&0xFFFFFF00	!0	unknown mode

0x18b	string	OS/2	OS/2 Boot Manager

9564	lelong		0x00011954	Unix Fast File system,
>8404	string		x		last mounted on %s,
>9504	ledate		x		last checkd at %s,
>8224	ledate		x		last writen at %s,
>8228	lelong		x		number of blocks %d,
>8232	lelong		x		number of data blocks %d,
>8236	lelong		x		number of cylinder groups %d,
>8240	lelong		x		number of basic blocks %d,
>8244	lelong		x		number of fragment blocks %d,
>8248	lelong		x		minimum percentage of free blocks %d,
>8252	lelong		x		rotational delay %dms,
>8256	lelong		x		disk rotational speed %drps,
>8320	lelong		0		TIME optimization
>8320	lelong		1		SPACE optimization

#------------------------------------------------------------------------------
# flash:	file(1) magic for Macromedia Flash file format
#
# See
#
#	http://www.macromedia.com/software/flash/open/
#
0	string		FWS		Macromedia Flash data,
>3	byte		x		version %d

#------------------------------------------------------------------------------
# fonts:  file(1) magic for font data
#
0	string		FONT		ASCII vfont text
0	short		0436		Berkeley vfont data
0	short		017001		byte-swapped Berkeley vfont data

# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
0	string		%!PS-AdobeFont-1.0	PostScript Type 1 font text
>20	string		>\0			(%s)
6	string		%!PS-AdobeFont-1.0	PostScript Type 1 font program data

# X11 font files in SNF (Server Natural Format) format
0	belong		00000004		X11 SNF font data, MSB first
0	lelong		00000004		X11 SNF font data, LSB first

# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		STARTFONT\040		X11 BDF font text

# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
0	string		\001fcp			X11 Portable Compiled Font data
>12	byte		0x02			\b, LSB first
>12	byte		0x0a			\b, MSB first
0	string		D1.0\015		X11 Speedo font data

#------------------------------------------------------------------------------
# FIGlet fonts and controlfiles
# From figmagic supplied with Figlet version 2.2
# "David E. O'Brien" <obrien@FreeBSD.ORG>
0	string		flf		FIGlet font
>3	string		>2a		version %-2.2s
0	string		flc		FIGlet controlfile
>3	string		>2a		version %-2.2s

# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
0	belong		0x14025919	libGrx font data,
>8	leshort		x		%dx
>10	leshort		x		\b%d
>40	string		x		%s
# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
0	belong		0xff464f4e	DOS code page font data collection
7	belong		0x00454741	DOS code page font data
7	belong		0x00564944	DOS code page font data (from Linux?)
4098	string		DOSFONT		DOSFONT2 encrypted font data

# Windows fonts
0	belong		0x00010000	MS Windows true type font

#------------------------------------------------------------------------------
# frame:  file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0	string		\<MakerFile	FrameMaker document
>11	string		5.5		 (5.5
>11	string		5.0		 (5.0
>11	string		4.0		 (4.0
>11	string		3.0		 (3.0
>11	string		2.0		 (2.0
>11	string		1.0		 (1.0
>14	byte		x		  %c)
0	string		\<MIFFile	FrameMaker MIF (ASCII) file
>9	string		4.0		 (4.0)
>9	string		3.0		 (3.0)
>9	string		2.0		 (2.0)
>9	string		1.0		 (1.x)
0	string		\<MakerDictionary	FrameMaker Dictionary text
>17	string		3.0		 (3.0)
>17	string		2.0		 (2.0)
>17	string		1.0		 (1.x)
0	string		\<MakerScreenFont	FrameMaker Font file
>17	string		1.01		 (%s)
0	string		\<MML		FrameMaker MML file
0	string		\<BookFile	FrameMaker Book file
>10	string		3.0		 (3.0
>10	string		2.0		 (2.0
>10	string		1.0		 (1.0
>13	byte		x		  %c)
# XXX - this book entry should be verified, if you find one, uncomment this
#0	string		\<Book\ 	FrameMaker Book (ASCII) file
#>6	string		3.0		 (3.0)
#>6	string		2.0		 (2.0)
#>6	string		1.0		 (1.0)
0	string		\<Maker	Intermediate Print File	FrameMaker IPL file

#------------------------------------------------------------------------------
# freebsd:  file(1) magic for FreeBSD objects
#
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
# little-endian on x86).
#
# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
# schemes for distinguishing between executable images, shared libraries,
# and object files.
#
# FreeBSD says:
#
#    Regardless of whether it's pure, demand-paged, or none of the
#    above:
#
#	if the entry point is < 4096, then it's a shared library if
#	the "has run-time loader information" bit is set, and is
#	position-independent if the "is position-independent" bit
#	is set;
#
#	if the entry point is >= 4096 (or >4095, same thing), then it's
#	an executable, and is dynamically-linked if the "has run-time
#	loader information" bit is set.
#
# On x86, NetBSD says:
#
#    If it's neither pure nor demand-paged:
#
#	if it has the "has run-time loader information" bit set, it's
#	a dynamically-linked executable;
#
#	if it doesn't have that bit set, then:
#
#	    if it has the "is position-independent" bit set, it's
#	    position-independent;
#
#	    if the entry point is non-zero, it's an executable, otherwise
#	    it's an object file.
#
#    If it's pure:
#
#	if it has the "has run-time loader information" bit set, it's
#	a dynamically-linked executable, otherwise it's just an
#	executable.
#
#    If it's demand-paged:
#
#	if it has the "has run-time loader information" bit set,
#	then:
#
#	    if the entry point is < 4096, it's a shared library;
#
#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
#	    it's a dynamically-linked executable);
#
#	if it doesn't have the "has run-time loader information" bit
#	set, then it's just an executable.
#
# (On non-x86, NetBSD does much the same thing, except that it uses
# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
# had 8K pages; dunno about MIPS.)
#
# I suspect the two will differ only in perverse and uninteresting cases
# ("shared" libraries that aren't demand-paged and whose pages probably
# won't actually be shared, executables with entry points <4096).
#
# I leave it to those more familiar with FreeBSD and NetBSD to figure out
# what the right answer is (although using ">4095", FreeBSD-style, is
# probably better than separately checking for "=4096" and ">4096",
# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
# executables using the NetBSD technique.)
#
0	lelong&0377777777	041400407	FreeBSD/i386
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400410	FreeBSD/i386 pure
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400413	FreeBSD/i386 demand paged
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

# XXX gross hack to identify core files
# cores start with a struct tss; we take advantage of the following:
# byte 7:     highest byte of the kernel stack pointer, always 0xfe
#      8/9:   kernel (ring 0) ss value, always 0x0010
#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
#      28:    low order byte of the current PTD entry, always 0 since the
#             PTD is page-aligned
#
7	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
>1039	string	>\0	from '%s'

# /var/run/ld.so.hints
# What are you laughing about?
0	lelong			011421044151	ld.so hints file
>4	lelong			>0		(version %d)
#------------------------------------------------------------------------------
# GIMP Gradient: file(1) magic for the GIMP's gradient data files
# by Federico Mena <federico@nuclecu.unam.mx>

0       string          GIMP\ Gradient  GIMP gradient data

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the XCF image format used in the GIMP developed
#       by Spencer Kimball and Peter Mattis
#       ('Bucky' LaDieu, nega@vt.edu)

0	string		gimp\ xcf	GIMP XCF image data,
>9	string		file		version 0,
>9	string		v		version
>>10	string		>\0		%s,
>14	belong		x		%lu x
>18	belong		x		%lu,
>22     belong          0               RGB Color
>22     belong          1               Greyscale
>22     belong          2               Indexed Color
>22	belong		>2		Unknown Image Type.

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the patterns used in the GIMP, developed
#       by Spencer Kimball and Peter Mattis
#       ('Bucky' LaDieu, nega@vt.edu)

20      string          GPAT            GIMP pattern data,
>24     string          x               %s

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the brushes used in the GIMP, developed
#       by Spencer Kimball and Peter Mattis
#       ('Bucky' LaDieu, nega@vt.edu)

20      string          GIMP            GIMP brush data

#
# GNU nlsutils message catalog file format
#
0	string		\336\22\4\225	GNU message catalog (little endian),
>4	lelong		x		revision %d,
>8	lelong		x		%d messages
0	string		\225\4\22\336	GNU message catalog (big endian),
>4	belong		x		revision %d,
>8	belong		x		%d messages

#------------------------------------------------------------------------------
# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
# big-endian as it was mostly 68K-based.
#
# I think the 500 series was the old stack-based machines, running a
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
# HP magic is useful for reference, but using "long" magic is a better
# practice in order to avoid collisions.
#
# Guy Harris (guy@netapp.com): some additions to this list came from
# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
# "/etc/magic", though, except for the "archive file relocatable library"
# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
# used in executables, or have they just not yet updated "/etc/magic"
# completely?
#
# 0	beshort		200		hp200 (68010) BSD binary
# 0	beshort		300		hp300 (68020+68881) BSD binary
# 0	beshort		0x20c		hp200/300 HP-UX binary
# 0	beshort		0x20d		hp400 (68030) HP-UX binary
# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
# 0	beshort		0x214		PA-RISC2.0 HP-UX binary

#
# The "misc" stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0	beshort		0627		Apollo m68k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0	beshort		0624		apollo a88k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0       long            01203604016     TML 0123 byte-order format
0       long            01702407010     TML 1032 byte-order format
0       long            01003405017     TML 2301 byte-order format
0       long            01602007412     TML 3210 byte-order format
#### PA-RISC 1.1
0	belong 		0x02100106	PA-RISC1.1 relocatable object
0	belong 		0x02100107	PA-RISC1.1 executable
>168	belong		&0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x02100108	PA-RISC1.1 shared executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x0210010b	PA-RISC1.1 demand-load executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x0210010e	PA-RISC1.1 shared library
>96	belong		>0		- not stripped

0	belong 		0x0210010d	PA-RISC1.1 dynamic load library
>96	belong		>0		- not stripped

#### PA-RISC 2.0
0	belong		0x02140106	PA-RISC2.0 relocatable object

0       belong		0x02140107	PA-RISC2.0 executable
>168	belong		&0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0       belong		0x02140108	PA-RISC2.0 shared executable
>168	belong		&0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0       belong		0x0214010b	PA-RISC2.0 demand-load executable
>168	belong		&0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0       belong		0x0214010e	PA-RISC2.0 shared library
>96	belong		>0		- not stripped

0       belong		0x0214010d	PA-RISC2.0 dynamic load library
>96	belong		>0		- not stripped

#### 800
0	belong 		0x020b0106	PA-RISC1.0 relocatable object

0	belong 		0x020b0107	PA-RISC1.0 executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b0108	PA-RISC1.0 shared executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b010b	PA-RISC1.0 demand-load executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b010e	PA-RISC1.0 shared library
>96	belong		>0		- not stripped

0	belong 		0x020b010d	PA-RISC1.0 dynamic load library
>96	belong		>0		- not stripped

0	belong		0x213c6172	archive file
>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
>68	belong 		0x02140619	- PA-RISC2.0 relocatable library

#### 500
0	long		0x02080106	HP s500 relocatable executable
>16	long		>0		- version %ld

0	long		0x02080107	HP s500 executable
>16	long		>0		- version %ld

0	long		0x02080108	HP s500 pure executable
>16	long		>0		- version %ld

#### 200
0	belong 		0x020c0108	HP s200 pure executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0107	HP s200 executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c010b	HP s200 demand-load executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0106	HP s200 relocatable executable
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>8	belong		&0x80000000	save fp regs
>8	belong		&0x20000000	debuggable
>8	belong		&0x10000000	PIC

0	belong 		0x020a0108	HP s200 (2.x release) pure executable
>4	beshort		>0		- version %ld
>36	belong		>0		not stripped

0	belong		0x020a0107	HP s200 (2.x release) executable
>4	beshort		>0		- version %ld
>36	belong		>0		not stripped

0	belong		0x020c010e	HP s200 shared library
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>36	belong		>0		not stripped

0	belong		0x020c010d	HP s200 dynamic load library
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>36	belong		>0		not stripped

#### MISC
0	long		0x0000ff65	HP old archive
0	long		0x020aff65	HP s200 old archive
0	long		0x020cff65	HP s200 old archive
0	long		0x0208ff65	HP s500 old archive

0	long		0x015821a6	HP core file

0	long		0x4da7eee8	HP-WINDOWS font
>8	byte		>0		- version %ld
0	string		Bitmapfile	HP Bitmapfile

0	string		IMGfile	CIS 	compimg HP Bitmapfile
# XXX - see "lif"
#0	short		0x8000		lif file
0	long		0x020c010c	compiled Lisp

0	string		msgcat01	HP NLS message catalog,
>8	long		>0		%d messages

# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
0	string		HPHP48-		HP48 binary
>7	byte		>0		- Rev %c
>8	beshort		0x1129		(ADR)
>8	beshort		0x3329		(REAL)
>8	beshort		0x5529		(LREAL)
>8	beshort		0x7729		(COMPLX)
>8	beshort		0x9d29		(LCOMPLX)
>8	beshort		0xbf29		(CHAR)
>8	beshort		0xe829		(ARRAY)
>8	beshort		0x0a2a		(LNKARRAY)
>8	beshort		0x2c2a		(STRING)
>8	beshort		0x4e2a		(HXS)
>8	beshort		0x742a		(LIST)
>8	beshort		0x962a		(DIR)
>8	beshort		0xb82a		(ALG)
>8	beshort		0xda2a		(UNIT)
>8	beshort		0xfc2a		(TAGGED)
>8	beshort		0x1e2b		(GROB)
>8	beshort		0x402b		(LIB)
>8	beshort		0x622b		(BACKUP)
>8	beshort		0x882b		(LIBDATA)
>8	beshort		0x9d2d		(PROG)
>8	beshort		0xcc2d		(CODE)
>8	beshort		0x482e		(GNAME)
>8	beshort		0x6d2e		(LNAME)
>8	beshort		0x922e		(XLIB)
0	string		%%HP:		HP48 text
>6	string		T(0)		- T(0)
>6	string		T(1)		- T(1)
>6	string		T(2)		- T(2)
>6	string		T(3)		- T(3)
>10	string		A(D)		A(D)
>10	string		A(R)		A(R)
>10	string		A(G)		A(G)
>14	string		F(.)		F(.);
>14	string		F(,)		F(,);

# hpBSD magic numbers
0	beshort		200		hp200 (68010) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary
0	beshort		300		hp300 (68020+68881) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary

#------------------------------------------------------------------------------
# ibm370:  file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
# AIX 4.1's "/etc/magic" has
#
#	0	short		0535		370 sysV executable 
#	>12	long		>0		not stripped
#	>22	short		>0		- version %d
#	>30	long		>0		- 5.2 format
#	0	short		0530		370 sysV pure executable 
#	>12	long		>0		not stripped
#	>22	short		>0		- version %d
#	>30	long		>0		- 5.2 format
#
# instead of the "USS/370" versions of the same magic numbers.
#
0	beshort		0537		370 XA sysV executable 
>12	belong		>0		not stripped
>22	beshort		>0		- version %d
>30	belong		>0		- 5.2 format
0	beshort		0532		370 XA sysV pure executable 
>12	belong		>0		not stripped
>22	beshort		>0		- version %d
>30	belong		>0		- 5.2 format
0	beshort		054001		370 sysV pure executable
>12	belong		>0		not stripped
0	beshort		055001		370 XA sysV pure executable
>12	belong		>0		not stripped
0	beshort		056401		370 sysV executable
>12	belong		>0		not stripped
0	beshort		057401		370 XA sysV executable
>12	belong		>0		not stripped
0       beshort		0531		SVR2 executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24     belong		>0		- version %ld
0	beshort		0534		SVR2 pure executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0530		SVR2 pure executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0535		SVR2 executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld

#------------------------------------------------------------------------------
# ibm6000:  file(1) magic for RS/6000 and the RT PC.
#
0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
>12	belong		>0		not stripped
# Breaks sun4 statically linked execs.
#0      beshort		0x0103		executable (RT Version 2) or obj module
#>2	byte		0x50		pure
#>28	belong		>0		not stripped
#>6	beshort		>0		- version %ld
0	beshort		0x0104		shared library
0	beshort		0x0105		ctab data
0	beshort		0xfe04		structured file
0	string		0xabcdef	AIX message catalog
0	belong		0x000001f9	AIX compiled message catalog
0	string		\<aiaff>	archive

#------------------------------------------------------------------------------
# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
# Arts for file interchange.  It has also been used by Apple, SGI, and
# especially Commodore-Amiga.
#
# IFF files begin with an 8 byte FORM header, followed by a 4 character
# FORM type, which is followed by the first chunk in the FORM.

0	string		FORM		IFF data
#>4	belong		x		\b, FORM is %d bytes long
# audio formats
>8	string		AIFF		\b, AIFF audio
>8	string		AIFC		\b, AIFF-C compressed audio
>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
>8	string		SAMP		\b, SAMP sampled audio
# image formats
>8	string		ILBMBMHD	\b, ILBM interleaved image
>>20	beshort		x		\b, %d x
>>22	beshort		x		%d
>8	string		RGBN		\b, RGBN 12-bit RGB image
>8	string		RGB8		\b, RGB8 24-bit RGB image
>8	string		DR2D		\b, DR2D 2-D object
>8	string		TDDD		\b, TDDD 3-D rendering
# other formats
>8	string		FTXT		\b, FTXT formatted text

#------------------------------------------------------------------------------
# images:  file(1) magic for image formats (see also "iff")
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#

# Targa - matches `povray', `ppmtotga' and `xv' outputs
# by Philippe De Muyter <phdm@macqel.be>
# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
# `tgatoppm' recognizes a superset (Index may be anything)
1	belong&0xfff7ffff	0x01010000	Targa image data - Map
>2	byte&8			8		- RLE
1	belong&0xfff7ffff	0x00020000	Targa image data - RGB
>2	byte&8			8		- RLE
1	belong&0xfff7ffff	0x00030000	Targa image data - Mono
>2	byte&8			8		- RLE

# PBMPLUS images
# The next byte following the magic is always whitespace.
0	string		P1		PBM image text
0	string		P2		PGM image text
0	string		P3		PPM image text
0	string		P4		PBM "rawbits" image data
0	string		P5		PGM "rawbits" image data
0	string		P6		PPM "rawbits" image data

# NITF is defined by United States MIL-STD-2500A
0	string	NITF	National Imagery Transmission Format
>25	string	>\0	dated %.14s

# NIFF (Navy Interchange File Format, a modification of TIFF) images
0	string		IIN1		NIFF image data

# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
# The second word of TIFF files is the TIFF version number, 42, which has
# never changed.  The TIFF specification recommends testing for it.
0	string		MM\x00\x2a	TIFF image data, big-endian
0	string		II\x2a\x00	TIFF image data, little-endian

# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt@uchicago.edu)
# (Albert Cahalan, acahalan@cs.uml.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
#
0	string		\x89PNG		PNG image data,
>4	belong		!0x0d0a1a0a	CORRUPTED,
>4	belong		0x0d0a1a0a
>>16	belong		x		%ld x
>>20	belong		x		%ld,
>>24	byte		x		%d-bit
>>25	byte		0		grayscale,
>>25	byte		2		\b/color RGB,
>>25	byte		3		colormap,
>>25	byte		4		gray+alpha,
>>25	byte		6		\b/color RGBA,
#>>26	byte		0		deflate/32K,
>>28	byte		0		non-interlaced
>>28	byte		1		interlaced
1	string		PNG		PNG image data, CORRUPTED

# GIF
0	string		GIF8		GIF image data
>4	string		7a		\b, version 8%s,
>4	string		9a		\b, version 8%s,
>6	leshort		>0		%hd x
>8	leshort		>0		%hd
#>10	byte		&0x80		color mapped,
#>10	byte&0x07	=0x00		2 colors
#>10	byte&0x07	=0x01		4 colors
#>10	byte&0x07	=0x02		8 colors
#>10	byte&0x07	=0x03		16 colors
#>10	byte&0x07	=0x04		32 colors
#>10	byte&0x07	=0x05		64 colors
#>10	byte&0x07	=0x06		128 colors
#>10	byte&0x07	=0x07		256 colors

# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
# 1 plane, no encoding.
0	string		\361\0\100\273	CMU window manager raster image data
>4	lelong		>0		%d x
>8	lelong		>0		%d,
>12	lelong		>0		%d-bit

# Magick Image File Format
0	string		id=ImageMagick	MIFF image data

# Artisan
0	long		1123028772	Artisan image data
>4	long		1		\b, rectangular 24-bit
>4	long		2		\b, rectangular 8-bit with colormap
>4	long		3		\b, rectangular 32-bit (24-bit with matte)

# FIG (Facility for Interactive Generation of figures), an object-based format
0	string		#FIG		FIG image text
>5	string		x		\b, version %.3s

# PHIGS
0	string		ARF_BEGARF		PHIGS clear text archive
0	string		@(#)SunPHIGS		SunPHIGS
# version number follows, in the form m.n
>40	string		SunBin			binary
>32	string		archive			archive

# GKS (Graphics Kernel System)
0	string		GKSM		GKS Metafile
>24	string		SunGKS		\b, SunGKS

# CGM image files
0	string		BEGMF		clear text Computer Graphics Metafile
# XXX - questionable magic
0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
0	beshort		0x3020		character Computer Graphics Metafile

# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
0	string	yz	MGR bitmap, modern format, 8-bit aligned
0	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
0	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
0	string	yx	MGR bitmap, modern format, squeezed

# Fuzzy Bitmap (FBM) images
0	string		%bitmap\0	FBM image data
>30	long		0x31		\b, mono
>30	long		0x33		\b, color

# facsimile data
1	string		PC\ Research,\ Inc	group 3 fax data
>29	byte		0		\b, normal resolution (204x98 DPI)
>29	byte		1		\b, fine resolution (204x196 DPI)

# PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
0	string		BM		PC bitmap data
>14	leshort		12		\b, OS/2 1.x format
>>18	leshort		x		\b, %d x
>>20	leshort		x		%d
>14	leshort		64		\b, OS/2 2.x format
>>18	leshort		x		\b, %d x
>>20	leshort		x		%d
>14	leshort		40		\b, Windows 3.x format
>>18	lelong		x		\b, %d x
>>22	lelong		x		%d x
>>28	leshort		x		%d
0	string		IC		PC icon data
0	string		PI		PC pointer image data
0	string		CI		PC color icon data
0	string		CP		PC color pointer image data
# Conflicts with other entries [BABYL]
#0	string		BA		PC bitmap array data

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# note possible collision with C/REXX entry in c-lang; currently commented out
0	string		/*\ XPM\ */	X pixmap image text

# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
0	leshort		0xcc52		RLE image data,
>6	leshort		x		%d x
>8	leshort		x		%d
>2	leshort		>0		\b, lower left corner: %d
>4	leshort		>0		\b, lower right corner: %d
>10	byte&0x1	=0x1		\b, clear first
>10	byte&0x2	=0x2		\b, no background
>10	byte&0x4	=0x4		\b, alpha channel
>10	byte&0x8	=0x8		\b, comment
>11	byte		>0		\b, %d color channels
>12	byte		>0		\b, %d bits per pixel
>13	byte		>0		\b, %d color map channels

# image file format (Robert Potter, potter@cs.rochester.edu)
0	string		Imagefile\ version-	iff image data
# this adds the whole header (inc. version number), informative but longish
>10	string		>\0		%s

# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
0	belong		0x59a66a95	Sun raster image data
>4	belong		>0		\b, %d x
>8	belong		>0		%d,
>12	belong		>0		%d-bit,
#>16	belong		>0		%d bytes long,
>20	belong		0		old format,
#>20	belong		1		standard,
>20	belong		2		compressed,
>20	belong		3		RGB,
>20	belong		4		TIFF,
>20	belong		5		IFF,
>20	belong		0xffff		reserved for testing,
>24	belong		0		no colormap
>24	belong		1		RGB colormap
>24	belong		2		raw colormap
#>28	belong		>0		colormap is %d bytes long

# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# See
#	http://reality.sgi.com/grafica/sgiimage.html
#
0	beshort		474		SGI image data
#>2	byte		0		\b, verbatim
>2	byte		1		\b, RLE
#>3	byte		1		\b, normal precision
>3	byte		2		\b, high precision
>4	beshort		x		\b, %d-D
>6	beshort		x		\b, %d x
>8	beshort		x		%d
>10	beshort		x		\b, %d channel
>10	beshort		!1		\bs
>80	string		>0		\b, "%s"

0	string		IT01		FIT image data
>4	belong		x		\b, %d x
>8	belong		x		%d x
>12	belong		x		%d
#
0	string		IT02		FIT image data
>4	belong		x		\b, %d x
>8	belong		x		%d x
>12	belong		x		%d
#
2048	string		PCD_IPI		Kodak Photo CD image pack file
0	string		PCD_OPA		Kodak Photo CD overview pack file

# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
# FITS is the Flexible Image Transport System, the de facto standard for
# data and image transfer, storage, etc., for the astronomical community.
# (FITS floating point formats are big-endian.)
0	string	SIMPLE\ \ =	FITS image data
>109	string	8		\b, 8-bit, character or unsigned binary integer
>108	string	16		\b, 16-bit, two's complement binary integer
>107	string	\ 32		\b, 32-bit, two's complement binary integer
>107	string	-32		\b, 32-bit, floating point, single precision
>107	string	-64		\b, 64-bit, floating point, double precision

# other images
0	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
0	string		!!		Bennet Yee's "face" format

# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
# stuff.
#
0	beshort		0x1010		PEX Binary Archive

# Visio drawings
03000	string	Visio\ (TM)\ Drawing			%s

# PSD (Adobe Photoshop bitmap) (Wolfram Kleff)
0	string		8BPS	PSD image data (Adobe Photoshop bitmap)

# PCX (should be reliable with a 2 byte header - Wolfram Kleff)
0	beshort		0x0A00	PCX image data, version 2.5
0	beshort		0x0A02	PCX image data, version 2.8 with palette
0	beshort		0x0A03	PCX image data, version 2.8 without palette
0	beshort		0x0A05	PCX image data, version 3.0

#------------------------------------------------------------------------------
# intel:  file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
# Windows as well.
#
# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
# as well, if, as, and when IBM makes it portable.
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0	leshort		0502		basic-16 executable
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		0503		basic-16 executable (TV)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		0510		x86 executable
>12	lelong		>0		not stripped
0	leshort		0511		x86 executable (TV)
>12	lelong		>0		not stripped
0	leshort		=0512		iAPX 286 executable small model (COFF)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		=0522		iAPX 286 executable large model (COFF)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0	leshort		=0514		80386 COFF executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld

#------------------------------------------------------------------------------
# interleaf:  file(1) magic for InterLeaf TPS:
#
0	string		=\210OPS	Interleaf saved data
0	string		=<!OPS		Interleaf document text
>5	string		,\ Version\ =	\b, version
>>17	string		>\0		%.3s

#------------------------------------------------------------------------------
# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
# "/etc/magic":
# From: guy@netapp.com (Guy Harris)
#
4	string		pgscriptver	IslandWrite document
13	string		DrawFile	IslandDraw document


#------------------------------------------------------------------------------
# ispell:  file(1) magic for ispell
#
# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
# will match 0x9600 through 0x9603 in *both* little endian and big endian.
# (No other current magic entries collide.)
#
# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
#
0	leshort&0xFFFC	0x9600		little endian ispell
>0	byte		0		hash file (?),
>0	byte		1		3.0 hash file,
>0	byte		2		3.1 hash file,
>0	byte		3		hash file (?),
>2	leshort		0x00		8-bit, no capitalization, 26 flags
>2	leshort		0x01		7-bit, no capitalization, 26 flags
>2	leshort		0x02		8-bit, capitalization, 26 flags
>2	leshort		0x03		7-bit, capitalization, 26 flags
>2	leshort		0x04		8-bit, no capitalization, 52 flags
>2	leshort		0x05		7-bit, no capitalization, 52 flags
>2	leshort		0x06		8-bit, capitalization, 52 flags
>2	leshort		0x07		7-bit, capitalization, 52 flags
>2	leshort		0x08		8-bit, no capitalization, 128 flags
>2	leshort		0x09		7-bit, no capitalization, 128 flags
>2	leshort		0x0A		8-bit, capitalization, 128 flags
>2	leshort		0x0B		7-bit, capitalization, 128 flags
>2	leshort		0x0C		8-bit, no capitalization, 256 flags
>2	leshort		0x0D		7-bit, no capitalization, 256 flags
>2	leshort		0x0E		8-bit, capitalization, 256 flags
>2	leshort		0x0F		7-bit, capitalization, 256 flags
>4	leshort		>0		and %d string characters
0	beshort&0xFFFC	0x9600		big endian ispell
>1	byte		0		hash file (?),
>1	byte		1		3.0 hash file,
>1	byte		2		3.1 hash file,
>1	byte		3		hash file (?),
>2	beshort		0x00		8-bit, no capitalization, 26 flags
>2	beshort		0x01		7-bit, no capitalization, 26 flags
>2	beshort		0x02		8-bit, capitalization, 26 flags
>2	beshort		0x03		7-bit, capitalization, 26 flags
>2	beshort		0x04		8-bit, no capitalization, 52 flags
>2	beshort		0x05		7-bit, no capitalization, 52 flags
>2	beshort		0x06		8-bit, capitalization, 52 flags
>2	beshort		0x07		7-bit, capitalization, 52 flags
>2	beshort		0x08		8-bit, no capitalization, 128 flags
>2	beshort		0x09		7-bit, no capitalization, 128 flags
>2	beshort		0x0A		8-bit, capitalization, 128 flags
>2	beshort		0x0B		7-bit, capitalization, 128 flags
>2	beshort		0x0C		8-bit, no capitalization, 256 flags
>2	beshort		0x0D		7-bit, no capitalization, 256 flags
>2	beshort		0x0E		8-bit, capitalization, 256 flags
>2	beshort		0x0F		7-bit, capitalization, 256 flags
>4	beshort		>0		and %d string characters

#------------------------------------------------------------
# Java ByteCode
# From Larry Schwimmer (schwim@cs.stanford.edu)
0	belong		0xcafebabe	compiled Java class data,
>6	beshort x	version %d.
>4	beshort x	\b%d
#------------------------------------------------------------
# Java serialization
# From Martin Pool (m.pool@pharos.com.au)
0	beshort		0xaced		Java serialization data
>2	beshort		>0x0004		\b, version %d

#------------------------------------------------------------------------------
# karma:  file(1) magic for Karma data files
#
# From <rgooch@atnf.csiro.au>

0	string		KarmaRHD Version	Karma Data Structure Version
>16	belong		x		%lu
#------------------------------------------------------------------------------
# DEC SRC Virtual Paper: Lectern files
# Karl M. Hegbloom <karlheg@inetarena.com>
0	string	lect	DEC SRC Virtual Paper Lectern file

#------------------------------------------------------------------------------
# lex:  file(1) magic for lex
#
#	derived empirically, your offsets may vary!
53	string		yyprevious	C program text (from lex)
>3	string		>\0		 for %s
# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
21	string		generated\ by\ flex	C program text (from flex)
# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
0	string		%{		lex description text

#------------------------------------------------------------------------------
# lif:  file(1) magic for lif
#
# XXX - byte order?  (Probably beshort, Daniel Quinlan <quinlan@yggdrasil.com>)
#
0	short		0x8000		lif file

#------------------------------------------------------------------------------
# linux:  file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
# The following basic Linux magic is useful for reference, but using
# "long" magic is a better practice in order to avoid collisions.
#
# 2	leshort		100		Linux/i386
# >0	leshort		0407		impure executable (OMAGIC)
# >0	leshort		0410		pure executable (NMAGIC)
# >0	leshort		0413		demand-paged executable (ZMAGIC)
# >0	leshort		0314		demand-paged executable (QMAGIC)
#
0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
>16	lelong		0		\b, stripped
#
0	string		\007\001\000	Linux/i386 object file
>20	lelong		>0x1020		\b, DLL library
# Linux-8086 stuff:
0	string		\01\03\020\04	Linux-8086 impure executable
>28	long		!0		not stripped
0	string		\01\03\040\04	Linux-8086 executable
>28	long		!0		not stripped
#
0	string		\243\206\001\0	Linux-8086 object file
#
0	string		\01\03\020\20	Minix-386 impure executable
>28	long		!0		not stripped
0	string		\01\03\040\20	Minix-386 executable
>28	long		!0		not stripped
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0	string		*nazgul*	Linux compiled message catalog
>8	lelong		>0		\b, version %ld
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
216	lelong		0421		Linux/i386 core file
>220	string		>\0		of '%s'
>200	lelong		>0		(signal %d)
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
# this can be overridden by the DOS executable (COM) entry
2	string		LILO		Linux/i386 LILO boot/chain loader
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
#0	string		0.9
#>8	byte		0x0a		old Debian Binary Package
#>>3	byte		>0		\b, created by dpkg 0.9%c
#>>4	byte		>0		pl%c
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
0	leshort		0x0436		Linux/i386 PC Screen Font data,
>2	byte		0		256 characters, no directory,
>2	byte		1		512 characters, no directory,
>2	byte		2		256 characters, Unicode directory,
>2	byte		3		512 characters, Unicode directory,
>3	byte		>0		8x%d
# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
4086	string		SWAP-SPACE	Linux/i386 swap file
# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
#
#	from Erik Troan (ewt@redhat.com) examining od dumps, so this
#		could be wrong
#      updated by David Mosberger (davidm@azstarnet.com) based on
#      GNU BFD and MIPS info found below.
#
0	leshort		0x0183		ECOFF alpha
>24	leshort		0407		executable
>24	leshort		0410		pure
>24	leshort		0413		demand paged
>8	long		>0		not stripped
>8	long		0		stripped
>23	leshort		>0		- version %ld.

# Linux kernel boot images (i386 arch) (Wolfram Kleff)
514	string		HdrS		Linux kernel
>510	leshort		0xAA55		x86 boot executable
>>518	leshort		0x201
>>>529	byte		0		zImage,
>>>529	byte		1		bzImage,
>>>(526.s+0x200) string	>\0		version %s,
>>498	leshort		1		RO-rootFS,
>>498	leshort		0		RW-rootFS,
>>508	leshort		>0		root_dev=0x%X,
>>502	leshort		>0		swap_dev=0x%X,
>>504	leshort		>0		RAMdisksize=%u KB,
>>506	leshort		0xFFFF		Normal VGA
>>506	leshort		0xFFFE		Extended VGA
>>506	leshort		0xFFFD		Prompt for Videomode
>>506	leshort		>0		Video mode=%d

# This also matches new kernels, which were caught above by "HdrS".
0		belong	0xb8c0078e	Linux kernel
>0x1e3		string	Loading		version 1.3.79 or older
>0x1e9		string	Loading		from prehistoric times

# System.map files - Nicols Lichtmaier <nick@debian.org>
8	string	\ A\ _text	Linux kernel symbol map text

# LSM entries - Nicols Lichtmaier <nick@debian.org>
0	string	Begin3	Linux Software Map entry text
0	string	Begin4	Linux Software Map entry text (new format)

# Moved from filesistems to be able to detect linux kernels.
0x1FE	leshort	0xAA55			x86 boot sector
>2	string	OSBS			\b, OS/BS MBR
>0x8C	string	Invalid\ partition\ table	\b, MS-DOS MBR
>0	string	\0\0\0\0		\b, extended partition table
>0	leshort 0x3CEB			\b, system
>>3	string	>\0			%s
>>0x36	string	FAT			\b, %s
>>>0x39	string	12			(%s bit)
>>>0x39	string	16			(%s bit)
>0x52	string	FAT32			\b, FAT (32 bit)
>>>43	string		>NO\ NAME	label: %.11s,
>>>43	string		<NO\ NAME	label: %.11s,
>>>43	string		NO\ NAME	unlabeled,
>>>19	leshort		>0		%d sectors
>>>19	leshort		0		
>>>>32	lelong		x		%d sectors
>0x200	lelong	0x82564557		\b, BSD disklabel

#------------------------------------------------------------------------------
# lisp:  file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string	;;			Lisp/Scheme program text
# Emacs 18 - this is always correct, but not very magical.
0	string	\012(			byte-compiled Emacs-Lisp program data
# Emacs 19
0	string	;ELC\023\000\000\000	byte-compiled Emacs-Lisp program data
#
# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
0	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program text
0	long	0x70768BD2		CLISP memory image data
0	long	0xD28B7670		CLISP memory image data, other endian
# Files produced by GNU gettext
0	long	0xDE120495		GNU-format message catalog data
0	long	0x950412DE		GNU-format message catalog data
#------------------------------------------------------------------------------
# mach file description
#
0	belong		0xcafebabe	Mach-O fat file
>4	belong		1		with 1 architecture
>4	belong		>1
>>4	belong		x		with %ld architectures		
#
0	belong		0xfeedface	Mach-O
>12	belong		1		object
>12	belong		2		executable
>12	belong		3		shared library
>12	belong		4		core
>12	belong		5		preload executable
>12	belong		>5
>>12	belong		x		filetype=%ld
>4	belong		<0
>>4	belong		x		architecture=%ld
>4	belong		1		vax
>4	belong		2		romp
>4	belong		3		architecture=3
>4	belong		4		ns32032
>4	belong		5		ns32332
>4	belong		6		for m68k architecture
# from NeXTstep 3.0 <mach/machine.h>
# i.e. mc680x0_all, ignore
# >>8	belong		1		(mc68030)
>>8	belong		2		(mc68040)
>>8	belong		3		(mc68030 only)
>4	belong		7		i386
>4	belong		8		mips
>4	belong		9		ns32532
>4	belong		10		architecture=10
>4	belong		11		hp pa-risc
>4	belong		12		acorn
>4	belong		13		m88k
>4	belong		14		sparc
>4	belong		15		i860-big
>4	belong		16		i860
>4	belong		17		rs6000
>4	belong		18		powerPC
>4	belong		>18
>>4	belong		x		architecture=%ld

#------------------------------------------------------------------------------
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@yggdrasil.com
11	string	must\ be\ converted\ with\ BinHex	BinHex binary text
>41	string	x					\b, version %.3s

# Stuffit archives are the de facto standard of compression for Macintosh
# files obtained from most archives. (franklsm@tuns.ca)
0	string		SIT!			StuffIt Archive (data)
>2	string		x			: %s
65	string		SIT!			StuffIt Archive (rsrc + data)
>2	string		x			: %s
0	string		SITD			StuffIt Deluxe (data)
>2	string		x			: %s
65	string		SITD			StuffIt Deluxe (rsrc + data)
>2	string		x			: %s
0	string		Seg			StuffIt Deluxe Segment (data)
>2	string		x			: %s
65	string		Seg			StuffIt Deluxe Segment (rsrc + data)
>2	string		x			: %s

# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
0	string		APPL			Macintosh Application (data)
>2	string		x			: %s
65	string		APPL			Macintosh Application (rsrc + data)
>2	string		x			: %s

# Macintosh System files (franklsm@tuns.ca)
0	string		zsys			Macintosh System File (data)
65	string		zsys			Macintosh System File(rsrc + data)
0	string		FNDR			Macintosh Finder (data)
65	string		FNDR			Macintosh Finder(rsrc + data)
0	string		libr			Macintosh Library (data)
>2	string		x			: %s
65	string		libr			Macintosh Library(rsrc + data)
>2	string		x			: %s
0	string		shlb			Macintosh Shared Library (data)
>2	string		x			: %s
65	string		shlb			Macintosh Shared Library(rsrc + data)
>2	string		x			: %s
0	string		cdev			Macintosh Control Panel (data)
>2	string		x			: %s
65	string		cdev			Macintosh Control Panel(rsrc + data)
>2	string		x			: %s
0	string		INIT			Macintosh Extension (data)
>2	string		x			: %s
65	string		INIT			Macintosh Extension(rsrc + data)
>2	string		x			: %s
0	string		FFIL			Macintosh Truetype Font (data)
>2	string		x			: %s
65	string		FFIL			Macintosh Truetype Font(rsrc + data)
>2	string		x			: %s
0	string		LWFN			Macintosh Postscript Font (data)
>2	string		x			: %s
65	string		LWFN			Macintosh Postscript Font(rsrc + data)
>2	string		x			: %s

# Additional Macintosh Files (franklsm@tuns.ca)

0	string		PACT			Macintosh Compact Pro Archive (data)
>2	string		x			: %s
65	string		PACT			Macintosh Compact Pro Archive(rsrc + data)
>2	string		x			: %s
0	string		ttro			Macintosh TeachText File (data)
>2	string		x			: %s
65	string		ttro			Macintosh TeachText File(rsrc + data)
>2	string		x			: %s
0	string		TEXT			Macintosh TeachText File (data)
>2	string		x			: %s
65	string		TEXT			Macintosh TeachText File(rsrc + data)
>2	string		x			: %s
0	string		PDF			Macintosh PDF File (data)
>2	string		x			: %s
65	string		PDF			Macintosh PDF File(rsrc + data)
>2	string		x			: %s


#------------------------------------------------------------------------------
# magic:  file(1) magic for magic files
#
0	string		#\ Magic	magic text file for file(1) cmd

#------------------------------------------------------------------------------
# mail.news:  file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
#0	string		From 		mail text
# There are tests to ascmagic.c to cope with mail and news.
0	string		Relay-Version: 	old news text
0	string		#!\ rnews	batched news text
0	string		N#!\ rnews	mailed, batched news text
0	string		Forward\ to 	mail forwarding text
0	string		Pipe\ to 	mail piping text
0	string		Return-Path:	smtp mail text
0	string		Path:		news text
0	string		Xref:		news text
0	string		From:		news or mail text
0	string		Article 	saved news text
0	string		BABYL		Emacs RMAIL text
0	string		Received:	RFC 822 mail text
0	string		MIME-Version:	MIME entity text
#0	string		Content-	MIME entity text
#------------------------------------------------------------------------------
# mime:  file(1) magic for MIME encoded files
#
0	string		Content-Type:\
>14	string		>\0		%s
0	string		Content-Type:
>13	string		>\0		%s

#------------------------------------------------------------------------------
# mirage:  file(1) magic for Mirage executables
#
# XXX - byte order?
#
0	long	31415		Mirage Assembler m.out executable

#------------------------------------------------------------------------------
# mkid:  file(1) magic for mkid(1) databases
#
# ID is the binary tags database produced by mkid(1).
#
# XXX - byte order?
#
0	string		\311\304	ID tags data
>2	short		>0		version %d

#------------------------------------------------------------------------------
# mmdf:  file(1) magic for MMDF mail files
#
0	string	\001\001\001\001	MMDF mailbox
#------------------------------------------------------------------------------
# modem:  file(1) magic for modem programs
#
# From: Florian La Roche <florian@knorke.saar.de>
4	string		Research,	Digifax-G3-File
>29	byte		1		, fine resolution
>29	byte		0		, normal resolution

0	short		0x0100		raw G3 data, byte-padded
0	short		0x1400		raw G3 data
#
# Magic data for vgetty voice formats
# (Martin Seine & Marc Eberhard)

#
# raw modem data version 1
#
0    string    RMD1      raw modem data
>4   string    >\0       (%s /
>20  short     >0        compression type 0x%04x)

#
# portable voice format 1
#
0    string    PVF1\n         portable voice format
>5   string    >\0       (binary %s)

#
# portable voice format 2
#
0    string    PVF2\n         portable voice format
>5   string >\0          (ascii %s)


#------------------------------------------------------------------------------
# motorola:  file(1) magic for Motorola 68K and 88K binaries
#
# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
0       beshort         0x601A          Atari 68xxx executable,
>2      belong          x               text len %lu,
>6      belong          x               data len %lu,
>10     belong          x               BSS len %lu,
>14     belong          x               symboltab len %lu,
>18     belong          0
>22     belong          &0x01           fastload flag,
>22     belong          &0x02           may be loaded to alternate RAM,
>22     belong          &0x04           malloc may be from alternate RAM,
>22     belong          x               flags: 0x%lX,
>26     beshort         0               no relocation tab
>26     beshort         !0              + relocation tab
>30     string          SFX             [Self-Extracting LZH SFX archive]
>38     string          SFX             [Self-Extracting LZH SFX archive]
>44     string          ZIP!            [Self-Extracting ZIP SFX archive]

0       beshort         0x0064          Atari 68xxx CPX file
>8      beshort         x               (version %04lx)

# 68K
#
0	beshort		0520		mc68k COFF
>18	beshort		^00000020	object
>18	beshort		&00000020	executable
>12	belong		>0		not stripped
>168	string		.lowmem		Apple toolbox
>20	beshort		0407		(impure)
>20	beshort		0410		(pure)
>20	beshort		0413		(demand paged)
>20	beshort		0421		(standalone)
0	beshort		0521		mc68k executable (shared)
>12	belong		>0		not stripped
0	beshort		0522		mc68k executable (shared demand paged)
>12	belong		>0		not stripped
#
# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
#
0	beshort		0554		68K BCS executable
#
# 88K
#
# Motorola/88Open BCS
#
0	beshort		0555		88K BCS executable
#
# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
0   string      S0          Motorola S-Record; binary data in text format

#------------------------------------------------------------------------------
# msdos:  file(1) magic for MS-DOS files
#

# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
0	string	@echo\ off	MS-DOS batch file text
0	string	@ECHO\ OFF	MS-DOS batch file text

# XXX - according to Microsoft's spec, at an offset of 0x3c in a
# PE-format executable is the offset in the file of the PE header;
# unfortunately, that's a little-endian offset, and there's no way
# to specify an indirect offset with a specified byte order.
# So, for now, we assume the standard MS-DOS stub, which puts the
# PE header at 0x80 = 128.
#
# Required OS version and subsystem version were 4.0 on some NT 3.51
# executables built with Visual C++ 4.0, so it's not clear that
# they're interesting.  The user version was 0.0, but there's
# probably some linker directive to set it.  The linker version was
# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
#
128	string		PE\0\0	MS Windows PE
>150	leshort&0x0100	>0	32-bit
>132	leshort		0x0	unknown processor
>132	leshort		0x14c	Intel 80386
>132	leshort		0x166	MIPS R4000
>132	leshort		0x184	Alpha
>132	leshort		0x268	Motorola 68000
>132	leshort		0x1f0	PowerPC
>132	leshort		0x290	PA-RISC
>148	leshort		>27
>>220	leshort		0	unknown subsystem
>>220	leshort		1	native
>>220	leshort		2	GUI
>>220	leshort		3	console
>>220	leshort		7	POSIX
>150	leshort&0x2000	=0	executable
#>>136	ledate		x	stamp %s,
>>150	leshort&0x0001	>0	not relocatable
#>>150	leshort&0x0004	=0	with line numbers,
#>>150	leshort&0x0008	=0	with local symbols,
#>>150	leshort&0x0200	=0	with debug symbols,
>>150	leshort&0x1000	>0	system file
#>>148	leshort		>0
#>>>154	byte		x	linker %d
#>>>155	byte		x	\b.%d,
#>>148	leshort		>27
#>>>192	leshort		x	requires OS %d
#>>>194	leshort		x	\b.%d,
#>>>196	leshort		x	user version %d
#>>>198	leshort		x	\b.%d,
#>>>200	leshort		x	subsystem version %d
#>>>202	leshort		x	\b.%d,
>150	leshort&0x2000	>0	DLL
#>>136	ledate		x	stamp %s,
>>150	leshort&0x0001	>0	not relocatable
#>>150	leshort&0x0004	=0	with line numbers,
#>>150	leshort&0x0008	=0	with local symbols,
#>>150	leshort&0x0200	=0	with debug symbols,
>>150	leshort&0x1000	>0	system file
#>>148	leshort		>0
#>>>154	byte		x	linker %d
#>>>155	byte		x	\b.%d,
#>>148	leshort		>27
#>>>192	leshort		x	requires OS %d
#>>>194	leshort		x	\b.%d,
#>>>196	leshort		x	user version %d
#>>>198	leshort		x	\b.%d,
#>>>200	leshort		x	subsystem version %d
#>>>202	leshort		x	\b.%d,
0	leshort		0x14c	MS Windows COFF Intel 80386 object file
#>4	ledate		x	stamp %s
0	leshort		0x166	MS Windows COFF MIPS R4000 object file
#>4	ledate		x	stamp %s
0	leshort		0x184	MS Windows COFF Alpha object file
#>4	ledate		x	stamp %s
0	leshort		0x268	MS Windows COFF Motorola 68000 object file
#>4	ledate		x	stamp %s
0	leshort		0x1f0	MS Windows COFF PowerPC object file
#>4	ledate		x	stamp %s
0	leshort		0x290	MS Windows COFF PA-RISC object file
#>4	ledate		x	stamp %s

# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
0	string	MZ		MS-DOS executable (EXE)
>24	string	@		\b, OS/2 or MS Windows
>>0xe7	string	LH/2\ Self-Extract	\b, %s
>>0xe9	string	PKSFX2		\b, %s
>>122	string	Windows\ self-extracting\ ZIP	\b, %s
>0x1c	string	RJSX\xff\xff	\b, ARJ SFX
>0x1c	string	diet\xf9\x9c	\b, diet compressed
>0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	\b, PKSFX
# JM: 0x1e "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved\7\0\0\0"
>0x1e	string	PKLITE\ Copr.	\b, %.6s compressed
>0x24	string	LHa's\ SFX	\b, %.15s
>0x24	string	LHA's\ SFX	\b, %.15s
>1638	string	-lh5-		\b, LHa SFX archive v2.13S
>7195	string	Rar!		\b, RAR self-extracting archive
#
# [GRR 950118:  file 3.15 has a buffer-size limitation; offsets bigger than
#   8161 bytes are ignored.  To make the following entries work, increase
#   HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
#   NT/Win32 and VMS.]
# [GRR:  some company sells a self-extractor/displayer for image data(!)]
#
>11696	string	PK\003\004	\b, PKZIP SFX archive v1.1
>13297	string	PK\003\004	\b, PKZIP SFX archive v1.93a
>15588	string	PK\003\004	\b, PKZIP2 SFX archive v1.09
>15770	string	PK\003\004	\b, PKZIP SFX archive v2.04g
>28374	string	PK\003\004	\b, PKZIP2 SFX archive v1.02
#
# Info-ZIP self-extractors
#    these are the DOS versions:
>25115	string	PK\003\004	\b, Info-ZIP SFX archive v5.12
>26331	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#    these are the OS/2 versions (OS/2 is flagged above):
>47031	string	PK\003\004	\b, Info-ZIP SFX archive v5.12
>49845	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#    this is the NT/Win32 version:
>69120	string	PK\003\004	\b, Info-ZIP NT SFX archive v5.12 w/decryption
#
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
>>49824	leshort		=1			\b, 1 file
>>49824	leshort		>1			\b, %u files

# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
# Uncommenting only the first two lines will cover about 2/3 of COM files,
# but it isn't feasible to match all COM files since there must be at least
# two dozen different one-byte "magics".
#0	byte		0xe9		MS-DOS executable (COM)
#>6	string	SFX\ of\ LHarc	(%s)
#0	byte		0x8c		MS-DOS executable (COM)
# 0xeb conflicts with "sequent" magic
#0	byte		0xeb		MS-DOS executable (COM)
#0	byte		0xb8		MS-DOS executable (COM)

# miscellaneous formats
0	string		LZ		MS-DOS executable (built-in)
#0	byte		0xf0		MS-DOS program library data
#

#
# Windows Registry files.
#
0	string		regf		Windows NT registry file
0	string		CREG		Windows 95 registry file

# Popular applications
2080	string	Microsoft\ Word\ 6.0\ Document	%s
2080	string	Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
2112	string	MSWordDoc			Microsoft Word document data
#
0	belong	0x31be0000			Microsoft Word Document
#
0       string  PO^Q`				Microsoft Word 6.0 Document

# I guess this is the one that works:
# MS-Word Document (Wolfram Kleff)
0	string	\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1	Microsoft Word document data

0	string	\376\067\0\043			Microsoft Office Document
0	string	\320\317\021\340\241\261	Microsoft Office Document
0	string	\333\245-\0\0\0			Microsoft Office Document
#
2080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
#
# Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
2114	string	Biff5		Microsoft Excel 5.0 Worksheet
#
0	belong	0x00001a00	Lotus 1-2-3
>4	belong	0x00100400	wk3 document data
>4	belong	0x02100400	wk4 document data
>4	belong	0x07800100	fm3 or fmb document data
>4	belong	0x07800000	fm3 or fmb document data
#
0	belong	0x00000200 	Lotus 1-2-3
>4	belong	0x06040600	wk1 document data
>4	belong	0x06800200	fmt document data

# WordPerfect documents - Trevor Johnson <trevor@jpj.net>
#
1	string	WPC		WordPerfect document

# Help files
0	string	?_\3\0		MS Windows Help Data

# Microsoft CAB distribution format  Dale Worley <root@dworley.ny.mediaone.net>
0	string		MSCF\000\000\000\000	Microsoft CAB file

#------------------------------------------------------------------------------
# ncr:  file(1) magic for NCR Tower objects
#
# contributed by
# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
#
0	beshort		000610	Tower/XP rel 2 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000615	Tower/XP rel 2 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000620	Tower/XP rel 3 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000625	Tower/XP rel 3 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000630	Tower32/600/400 68020 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000640	Tower32/800 68020
>18	   beshort		&020000	w/68881 object
>18	   beshort		&040000	compatible object
>18	   beshort		&~060000	object
>20	   beshort		0407	executable
>20	   beshort		0413	pure executable
>12	   belong		>0	not stripped
>22	   beshort		>0	- version %ld
0	beshort		000645	Tower32/800 68010
>18	   beshort		&040000	compatible object
>18	   beshort		&~060000 object
>20	   beshort		0407	executable
>20	   beshort		0413	pure executable
>12	   belong		>0	not stripped
>22	   beshort		>0	- version %ld

#------------------------------------------------------------------------------
# netbsd:  file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
#

0	lelong			000000407	NetBSD little-endian object file
>16	lelong			>0		not stripped
0	belong			000000407	NetBSD big-endian object file
>16	belong			>0		not stripped

0	belong&0377777777	041400413	NetBSD/i386 demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	041400410	NetBSD/i386 pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	041400407	NetBSD/i386
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	041400507	NetBSD/i386 core
>12	string			>\0		from '%s'

0	belong&0377777777	041600413	NetBSD/m68k demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	041600410	NetBSD/m68k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	041600407	NetBSD/m68k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	041600507	NetBSD/m68k core
>12	string			>\0		from '%s'

0	belong&0377777777	042000413	NetBSD/m68k4k demand paged
>0	byte			&0x80		
>>20	belong			<4096		shared library
>>20	belong			=4096		dynamically linked executable
>>20	belong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042000410	NetBSD/m68k4k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042000407	NetBSD/m68k4k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	042000507	NetBSD/m68k4k core
>12	string			>\0		from '%s'

0	belong&0377777777	042200413	NetBSD/ns32532 demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042200410	NetBSD/ns32532 pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042200407	NetBSD/ns32532
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	042200507	NetBSD/ns32532 core
>12	string			>\0		from '%s'

0	belong&0377777777	042400413	NetBSD/sparc demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042400410	NetBSD/sparc pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042400407	NetBSD/sparc
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	042400507	NetBSD/sparc core
>12	string			>\0		from '%s'

0	belong&0377777777	042600413	NetBSD/pmax demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042600410	NetBSD/pmax pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042600407	NetBSD/pmax
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	042600507	NetBSD/pmax core
>12	string			>\0		from '%s'

0	belong&0377777777	043000413	NetBSD/vax 1k demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043000410	NetBSD/vax 1k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043000407	NetBSD/vax 1k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	043000507	NetBSD/vax 1k core
>12	string			>\0		from '%s'

0	belong&0377777777	045400413	NetBSD/vax 4k demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	045400410	NetBSD/vax 4k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	045400407	NetBSD/vax 4k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	045400507	NetBSD/vax 4k core
>12	string			>\0		from '%s'

# NetBSD/alpha does not support (and has never supported) a.out objects,
# so no rules are provided for them.  NetBSD/alpha ELF objects are 
# dealt with in "elf".
0	lelong		0x00070185		ECOFF NetBSD/alpha binary
>10	leshort		0x0001			not stripped
>10	leshort		0x0000			stripped
0	belong&0377777777	043200507	NetBSD/alpha core
>12	string			>\0		from '%s'

0	belong&0377777777	043400413	NetBSD/mips demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	043400410	NetBSD/mips pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	043400407	NetBSD/mips
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	043400507	NetBSD/mips core
>12	string			>\0		from '%s'

0	belong&0377777777	043600413	NetBSD/arm32 demand paged
>0	byte			&0x80
>>20	lelong			<8192		shared library
>>20	lelong			=8192		dynamically linked executable
>>20	lelong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043600410	NetBSD/arm32 pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043600407	NetBSD/arm32
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	043600507	NetBSD/arm32 core
>12	string			>\0		from '%s'

#------------------------------------------------------------------------------
# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
#
0	string		StartFontMetrics	ASCII font metrics
0	string		StartFont	ASCII font bits
0	belong		0x137A2944	NeWS bitmap font
0	belong		0x137A2947	NeWS font family
0	belong		0x137A2950	scalable OpenFont binary
0	belong		0x137A2951	encrypted scalable OpenFont binary
8	belong		0x137A2B45	X11/NeWS bitmap font
8	belong		0x137A2B48	X11/NeWS font family

#------------------------------------------------------------------------------
# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
0	string		Octave-1-L	Octave binary data (little endian)
0	string		Octave-1-B	Octave binary data (big endian)

#------------------------------------------------------------------------------
# olf:  file(1) magic for OLF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# MIPS R3000 may also be for MIPS R2000.
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# Created by Erik Theisen <etheisen@openbsd.org>
# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
0	string		\177OLF		OLF
>4	byte		0		invalid class
>4	byte		1		32-bit
>4	byte		2		64-bit
>7	byte		0		invalid os
>7	byte		1		OpenBSD
>7	byte		2		NetBSD
>7	byte		3		FreeBSD
>7	byte		4		4.4BSD
>7	byte		5		Linux
>7	byte		6		SVR4
>7	byte		7		esix
>7	byte		8		Solaris
>7	byte		9		Irix
>7	byte		10		SCO
>7	byte		11		Dell
>7	byte		12		NCR
>5	byte		0		invalid byte order
>5	byte		1		LSB
>>16	leshort		0		no file type,
>>16	leshort		1		relocatable,
>>16	leshort		2		executable,
>>16	leshort		3		shared object,
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
>>16	leshort		4		core file
>>>(0x38+0xcc) string	>\0		of '%s'
>>>(0x38+0x10) lelong	>0		(signal %d),
>>16	leshort		&0xff00		processor-specific,
>>18	leshort		0		no machine,
>>18	leshort		1		AT&T WE32100 - invalid byte order,
>>18	leshort		2		SPARC - invalid byte order,
>>18	leshort		3		Intel 80386,
>>18	leshort		4		Motorola 68000 - invalid byte order,
>>18	leshort		5		Motorola 88000 - invalid byte order,
>>18	leshort		6		Intel 80486,
>>18	leshort		7		Intel 80860,
>>18	leshort		8		MIPS R3000_BE - invalid byte order,
>>18	leshort		9		Amdahl - invalid byte order,
>>18	leshort		10		MIPS R3000_LE,
>>18	leshort		11		RS6000 - invalid byte order,
>>18	leshort		15		PA-RISC - invalid byte order,
>>18	leshort		16		nCUBE,
>>18	leshort		17		VPP500,
>>18	leshort		18		SPARC32PLUS,
>>18	leshort		20		PowerPC,
>>18	leshort		0x9026		Alpha,
>>20	lelong		0		invalid version
>>20	lelong		1		version 1
>>36	lelong		1		MathCoPro/FPU/MAU Required
>8	string		>\0		(%s)
>5	byte		2		MSB
>>16	beshort		0		no file type,
>>16	beshort		1		relocatable,
>>16	beshort		2		executable,
>>16	beshort		3		shared object,
>>16	beshort		4		core file,
>>>(0x38+0xcc) string	>\0		of '%s'
>>>(0x38+0x10) belong	>0		(signal %d),
>>16	beshort		&0xff00		processor-specific,
>>18	beshort		0		no machine,
>>18	beshort		1		AT&T WE32100,
>>18	beshort		2		SPARC,
>>18	beshort		3		Intel 80386 - invalid byte order,
>>18	beshort		4		Motorola 68000,
>>18	beshort		5		Motorola 88000,
>>18	beshort		6		Intel 80486 - invalid byte order,
>>18	beshort		7		Intel 80860,
>>18	beshort		8		MIPS R3000_BE,
>>18	beshort		9		Amdahl,
>>18	beshort		10		MIPS R3000_LE - invalid byte order,
>>18	beshort		11		RS6000,
>>18	beshort		15		PA-RISC,
>>18	beshort		16		nCUBE,
>>18	beshort		17		VPP500,
>>18	beshort		18		SPARC32PLUS,
>>18	beshort		20		PowerPC or cisco 4500,
>>18	beshort		21		cisco 7500,
>>18	beshort		24		cisco SVIP,
>>18	beshort		25		cisco 7200,
>>18	beshort		36		cisco 12000,
>>18	beshort		0x9026		Alpha,
>>20	belong		0		invalid version
>>20	belong		1		version 1
>>36	belong		1		MathCoPro/FPU/MAU Required

#------------------------------------------------------------------------------
# os2:  file(1) magic for OS/2 files
#

# Provided 1998/08/22 by
# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
1	string	InternetShortcut	MS Windows 95 Internet shortcut text
>24	string	>\			(URL=<%s>)

# OS/2 URL objects
# Provided 1998/08/22 by
# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
#0	string	http:			OS/2 URL object text
#>5	string	>\			(WWW) <http:%s>
#0	string	mailto:			OS/2 URL object text
#>7	string	>\			(email) <%s>
#0	string	news:			OS/2 URL object text
#>5	string	>\			(Usenet) <%s>
#0	string	ftp:			OS/2 URL object text
#>4	string	>\			(FTP) <ftp:%s>
#0	string	file:			OS/2 URL object text
#>5	string	>\			(Local file) <%s>

# >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett ddissett@netcom.com)
# Carl Hauser (chauser.parc@xerox.com) and 
# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
# list the following header format in inf02a.doc:
#
#  int16 ID;           // ID magic word (5348h = "HS")
#  int8  unknown1;     // unknown purpose, could be third letter of ID
#  int8  flags;        // probably a flag word...
#                      //  bit 0: set if INF style file
#                      //  bit 4: set if HLP style file
#                      // patching this byte allows reading HLP files
#                      // using the VIEW command, while help files 
#                      // seem to work with INF settings here as well.
#  int16 hdrsize;      // total size of header
#  int16 unknown2;     // unknown purpose
# 
0   string  HSP\x01\x9b\x00 OS/2 INF
>107 string >0                      (%s)
0   string  HSP\x10\x9b\x00     OS/2 HLP
>107 string >0                      (%s)

# OS/2 INI (this is a guess)
0  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI
#
#	$NetBSD: os9,v 1.2 1997/01/09 20:19:04 tls Exp $
#
# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
# 3. All advertising materials mentioning features or use of this software
#    must display the following acknowledgement:
#      This product includes software developed by Ignatios Souvatzis for
#      the NetBSD project.
# 4. The name of the author may not be used to endorse or promote products
#    derived from this software without specific prior written permission.
#
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  
# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
#
# OS9/6809 module descriptions:
#
0	beshort		0x87CD	OS9/6809 module:
#
>6	byte&0x0f	0x00	non-executable
>6	byte&0x0f	0x01	machine language
>6	byte&0x0f	0x02	BASIC I-code
>6	byte&0x0f	0x03	P-code
>6	byte&0x0f	0x04	C I-code
>6	byte&0x0f	0x05	COBOL I-code
>6	byte&0x0f	0x06	FORTRAN I-code
#
>6	byte&0xf0	0x10	program executable
>6	byte&0xf0	0x20	subroutine
>6	byte&0xf0	0x30	multi-module
>6	byte&0xf0	0x40	data module
#
>6	byte&0xf0	0xC0	system module
>6	byte&0xf0	0xD0	file manager
>6	byte&0xf0	0xE0	device driver
>6	byte&0xf0	0xF0	device descriptor
#
# OS9/m68k stuff (to be continued)
#
0	beshort		0x4AFC	OS9/68K module:
#
# attr
>14	byte&0x80	0x80	re-entrant
>14	byte&0x40	0x40	ghost
>14	byte&0x20	0x20	system-state
#
# lang:
#
>13	byte		1	machine language
>13	byte		2	BASIC I-code
>13	byte		3	P-code
>13	byte		4	C I-code
>13	byte		5	COBOL I-code
>13	byte		6	Fortran I-code
#
#
# type:
#
>12	byte		1	program executable
>12	byte		2	subroutine
>12	byte		3	multi-module
>12	byte		4	data module
>12	byte		11	trap library
>12	byte		12	system module
>12	byte		13	file manager
>12	byte		14	device driver
>12	byte		15	device descriptor
#
# Mach magic number info
#
0	long		0xefbe	OSF/Rose object
# I386 magic number info
#
0	short		0565	i386 COFF object

#------------------------------------------------------------------------------
# pbm:  file(1) magic for Portable Bitmap files
#
# XXX - byte order?
#
0	short	0x2a17	"compact bitmap" format (Poskanzer)
#------------------------------------------------------------------------------
# pdf:  file(1) magic for Portable Document Format
#

0	string		%PDF-		PDF document
>5	byte		x		\b, version %c
>7	byte		x		\b.%c

#------------------------------------------------------------------------------
# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
#
0	lelong		0101555		PDP-11 single precision APL workspace
0	lelong		0101554		PDP-11 double precision APL workspace
#
# PDP-11 a.out
#
0	leshort		0407		PDP-11 executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0401		PDP-11 UNIX/RT ldp
0	leshort		0405		PDP-11 old overlay

0	leshort		0410		PDP-11 pure executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0411		PDP-11 separate I&D executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0437		PDP-11 kernel overlay

# These last three are derived from 2.11BSD file(1)
0	leshort		0413		PDP-11 demand-paged pure executable
>8	leshort		>0		not stripped

0	leshort		0430		PDP-11 overlaid pure executable
>8	leshort		>0		not stripped

0	leshort		0431		PDP-11 overlaid separate executable
>8	leshort		>0		not stripped

#------------------------------------------------------------------------------
# pgp:  file(1) magic for Pretty Good Privacy
#
0       beshort         0x9900                  PGP key public ring
0       beshort         0x9501                  PGP key security ring
0       beshort         0x9500                  PGP key security ring
0	beshort		0xa600			PGP encrypted data
0       string          -----BEGIN\040PGP       PGP armored data
>15     string          PUBLIC\040KEY\040BLOCK- public key block
>15     string          MESSAGE-                message
>15     string          SIGNED\040MESSAGE-      signed message
>15     string          PGP\040SIGNATURE-       signature

#------------------------------------------------------------------------------
# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
#
0       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)

#------------------------------------------------------------------------------
# plus5:  file(1) magic for Plus Five's UNIX MUMPS
#
# XXX - byte order?  Paging Hokey....
#
0	short		0x259		mumps avl global
>2	byte		>0		(V%d)
>6	byte		>0		with %d byte name
>7	byte		>0		and %d byte data cells
0	short		0x25a		mumps blt global
>2	byte		>0		(V%d)
>8	short		>0		- %d byte blocks
>15	byte		0x00		- P/D format
>15	byte		0x01		- P/K/D format
>15	byte		0x02		- K/D format
>15	byte		>0x02		- Bad Flags

#------------------------------------------------------------------------------
# printer:  file(1) magic for printer-formatted files
#

# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
0	string		%!		PostScript document text
>2	string		PS-Adobe-	conforming
>>11	string		>\0		at level %.3s
>>>15	string		EPS		- type %s
>>>15	string		Query		- type %s
>>>15	string		ExitServer	- type %s
# Some PCs have the annoying habit of adding a ^D as a document separator
0	string		\004%!		PostScript document text
>3	string		PS-Adobe-	conforming
>>12	string		>\0		at level %.3s
>>>16	string		EPS		- type %s
>>>16	string		Query		- type %s
>>>16	string		ExitServer	- type %s
0	string		\033%-12345X%!PS	PostScript document


# DOS EPS Binary File Header
# From: Ed Sznyter <ews@Black.Market.NET>
0       belong          0xC5D0D3C6      DOS EPS Binary File
>4      long            >0              Postscript starts at byte %d
>>8     long            >0              length %d
>>>12   long            >0              Metafile starts at byte %d
>>>>16  long            >0              length %d
>>>20   long            >0              TIFF starts at byte %d
>>>>24  long            >0              length %d

# Adobe's PostScript Printer Description (PPD) files
#       Yves Arrouye <arrouye@marin.fdn.fr>
#
0      string          *PPD-Adobe:    PPD file
>13    string          x              \b, ve

# HP Printer Job Language
0	string		\033%-12345X@PJL	HP Printer Job Language data
# HP Printer Job Language
# The header found on Win95 HP plot files is the "Silliest Thing possible" 
# (TM)
# Every driver puts the language at some random position, with random case
# (LANGUAGE and Language)
# For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
# From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
# 
0	string		\033%-12345X@PJL	HP Printer Job Language data
>&0	string		>\0			%s			
>>&0	string		>\0			%s			
>>>&0	string		>\0			%s		
>>>>&0	string		>\0			%s		
#>15	string		\ ENTER\ LANGUAGE\ =
#>31	string		PostScript		PostScript

# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\033E\033	HP PCL printer data
>3	string		\&l0A		- default page size
>3	string		\&l1A		- US executive page size
>3	string		\&l2A		- US letter page size
>3	string		\&l3A		- US legal page size
>3	string		\&l26A		- A4 page size
>3	string		\&l80A		- Monarch envelope size
>3	string		\&l81A		- No. 10 envelope size
>3	string		\&l90A		- Intl. DL envelope size
>3	string		\&l91A		- Intl. C5 envelope size
>3	string		\&l100A		- Intl. B5 envelope size
>3	string		\&l-81A		- No. 10 envelope size (landscape)
>3	string		\&l-90A		- Intl. DL envelope size (landscape)

# IMAGEN printer-ready files:
0	string	@document(		Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10	string	language\ impress	(imPRESS data)
>10	string	language\ daisy		(daisywheel text)
>10	string	language\ diablo	(daisywheel text)
>10	string	language\ printer	(line printer emulation)
>10	string	language\ tektronix	(Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
#
# Now magic for IMAGEN font files...
0	string		Rast		RST-format raster font data
>45	string		>0		face %

#------------------------------------------------------------------------------
# psdbms:  file(1) magic for psdatabase
#
0	belong&0xff00ffff	0x56000000	ps database
>1	string	>\0	version %s
>4	string	>\0	from kernel %s

#------------------------------------------------------------------------------
# pyramid:  file(1) magic for Pyramids
#
# XXX - byte order?
#
0	long		0x50900107	Pyramid 90x family executable
0	long		0x50900108	Pyramid 90x family pure executable
>16	long		>0		not stripped
0	long		0x5090010b	Pyramid 90x family demand paged pure executable
>16	long		>0		not stripped

#------------------------------------------------------------------------------
# riff:  file(1) magic for RIFF format
# See
#
#	http://www.seanet.com/users/matts/riffmci/riffmci.htm
#
# and
#
#	http://www.ora.com/centers/gff/formats/micriff/index.htm
#
# and
#
#	http://www.jtauber.com/music/encoding/niff/spec/
#
0	string		RIFF		RIFF (little-endian) data
# RIFF Palette format
>8	string		PAL		\b, palette
>>16	leshort		x		\b, version %d
>>18	leshort		x		\b, %d entries
# RIFF Device Independent Bitmap format
>8	string		RDIB		\b, device-independent bitmap
>>16	string		BM		
>>>30	leshort		12		\b, OS/2 1.x format
>>>>34	leshort		x		\b, %d x
>>>>36	leshort		x		%d
>>>30	leshort		64		\b, OS/2 2.x format
>>>>34	leshort		x		\b, %d x
>>>>36	leshort		x		%d
>>>30	leshort		40		\b, Windows 3.x format
>>>>34	lelong		x		\b, %d x
>>>>38	lelong		x		%d x
>>>>44	leshort		x		%d
# RIFF MIDI format
>8	string		RMID		\b, MIDI
# RIFF Multimedia Movie File format
>8	string		RMMP		\b, multimedia movie
# Microsoft WAVE format (*.wav)
>8	string		WAVE		\b, WAVE audio
>>20	leshort		1		\b, Microsoft PCM
>>>34	leshort		>0		\b, %d bit
>>22	leshort		=1		\b, mono
>>22	leshort		=2		\b, stereo
>>22	leshort		>2		\b, %d channels
>>24	lelong		>0		%d Hz
# AVI == Audio Video Interleave
>8      string          AVI\            \b, AVI
# Animated Cursor format
>8	string		ACON		\b, animated cursor

#
# XXX - some of the below may only appear in little-endian form.
#
# Also "MV93" appears to be for one form of Macromedia Director
# files, and "GDMF" appears to be another multimedia format.
#
0	string		RIFX		RIFF (big-endian) data
# RIFF Palette format
>8	string		PAL		\b, palette
>>16	beshort		x		\b, version %d
>>18	beshort		x		\b, %d entries
# RIFF Device Independent Bitmap format
>8	string		RDIB		\b, device-independent bitmap
>>16	string		BM		
>>>30	beshort		12		\b, OS/2 1.x format
>>>>34	beshort		x		\b, %d x
>>>>36	beshort		x		%d
>>>30	beshort		64		\b, OS/2 2.x format
>>>>34	beshort		x		\b, %d x
>>>>36	beshort		x		%d
>>>30	beshort		40		\b, Windows 3.x format
>>>>34	belong		x		\b, %d x
>>>>38	belong		x		%d x
>>>>44	beshort		x		%d
# RIFF MIDI format
>8	string		RMID		\b, MIDI
# RIFF Multimedia Movie File format
>8	string		RMMP		\b, multimedia movie
# Microsoft WAVE format (*.wav)
>8	string		WAVE		\b, WAVE audio
>>20	leshort		1		\b, Microsoft PCM
>>>34	leshort		>0		\b, %d bit
>>22	beshort		=1		\b, mono
>>22	beshort		=2		\b, stereo
>>22	beshort		>2		\b, %d channels
>>24	belong		>0		%d Hz
# AVI == Audio Video Interleave
>8      string          AVI\            \b, AVI
# Animated Cursor format
>8	string		ACON		\b, animated cursor
# Notation Interchange File Format (big-endian only)
>8	string		NIFF		\b, Notation Interchange File Format

#------------------------------------------------------------------------------
#
# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
#
0	beshort		0xedab    	
>2	beshort		0xeedb		RPM
>>4	byte		x		v%d
>>6	beshort		0		bin
>>6	beshort		1		src
>>8	beshort		1		i386
>>8	beshort		2		Alpha
>>8	beshort		3		Sparc
>>8	beshort		4		MIPS
>>8	beshort		5		PowerPC
>>8	beshort		6		68000
>>8     beshort         7               SGI
>>10	string		x		%s

#------------------------------------------------------------------------------
# rtf:	file(1) magic for Rich Text Format (RTF)
#
# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
#
0	string		{\\rtf		Rich Text Format data,
>5	byte		x		version %c,
>6	string		\\ansi		ANSI
>6	string		\\mac		Apple Macintosh
>6	string		\\pc		IBM PC, code page 437
>6	string		\\pca		IBM PS/2, code page 850

#------------------------------------------------------------------------------
# sc:  file(1) magic for "sc" spreadsheet
#
38	string		Spreadsheet	sc spreadsheet file

#------------------------------------------------------------------------------
# sccs:  file(1) magic for SCCS archives
#
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
# \001c date and time created 87/09/23 08:09:20 by ian
# \001e
# \001u
# \001U
# ... etc.
# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
# *Sigh*. And these both came from various parts of the USG.
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
# and we don't have regular expression matching yet. 
# Hence the following official kludge:
8	string		\001s\ 			SCCS archive data

#------------------------------------------------------------------------------
# sendmail:  file(1) magic for sendmail config files
#
# XXX - byte order?
#
0	byte	046	  Sendmail frozen configuration 
>16	string	>\0	  - version %s
0	short	0x271c	  Sendmail frozen configuration
>16	string	>\0	  - version %s

#------------------------------------------------------------------------------
# sequent:  file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# For Sequent's multiprocessor systems (incomplete).
0	lelong	0x00ea        	BALANCE NS32000 .o
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
>16	lelong  >0            	not stripped
>124	lelong	>0		version %ld
0	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
>16	lelong  >0            	not stripped
>124	lelong	>0		version %ld
0	lelong	0x30ea        	BALANCE NS32000 standalone executable
>16	lelong  >0          	not stripped
>124	lelong	>0		version %ld
#
# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
# Symmetry magic nums will not be reached if DOS COM comes before them;
# byte 0xeb is matched before these get a chance.
0	leshort	0x12eb		SYMMETRY i386 .o
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x42eb		SYMMETRY i386 standalone executable
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld

#------------------------------------------------------------------------------
# sgi:  file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
#                         Dec Ultrix (MIPS)
# all of SGI's *current* machines and OSes run in big-endian mode on the
# MIPS machines, as far as I know.
#
# XXX - what is the blank "-" line?
#
# kbd file definitions
0	string	kbd!map		kbd map file
>8	byte	>0		Ver %d:
>10	short	>0		with %d table(s)
0	belong	0407		old SGI 68020 executable
0	belong	0410		old SGI 68020 pure executable
0	beshort	0x8765		disk quotas file
0	beshort	0x0506		IRIS Showcase file
>2	byte	0x49		-
>3	byte	x		- version %ld
0	beshort	0x0226		IRIS Showcase template
>2	byte	0x63		-
>3	byte	x		- version %ld
0	belong	0x5343464d	IRIS Showcase file
>4	byte	x		- version %ld
0	belong	0x5443464d	IRIS Showcase template
>4	byte	x		- version %ld
0	belong	0xdeadbabe	IRIX Parallel Arena
>8	belong	>0		- version %ld
#
0	beshort	0x0160		MIPSEB COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0162		MIPSEL COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %d
>22	byte	x		.%ld
#
0	beshort	0x6001		MIPSEB-LE COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %d
>22	byte	x		.%ld
#
0	beshort	0x6201		MIPSEL-LE COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
# MIPS 2 additions
#
0	beshort	0x0163		MIPSEB MIPS-II COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0166		MIPSEL MIPS-II COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x6301		MIPSEB-LE MIPS-II COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
0	beshort	0x6601		MIPSEL-LE MIPS-II COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
# MIPS 3 additions
#
0	beshort	0x0140		MIPSEB MIPS-III COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0142		MIPSEL MIPS-III COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x4001		MIPSEB-LE MIPS-III COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
0	beshort	0x4201		MIPSEL-LE MIPS-III COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
0	beshort	0x180		MIPSEB Ucode
0	beshort	0x182		MIPSEL Ucode
# 32bit core file
0	belong	0xdeadadb0	IRIX core dump
>4	belong	1		of
>16	string	>\0		'%s'
# 64bit core file
0	belong	0xdeadad40	IRIX 64-bit core dump
>4	belong	1		of
>16	string	>\0		'%s'
# N32bit core file
0       belong	0xbabec0bb	IRIX N32 core dump
>4      belong	1               of
>16     string	>\0             '%s'
# New style crash dump file
0	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
>36	string	>\0					'%s'
# Trusted IRIX info
0	string	SGIAUDIT	SGI Audit file
>8	byte	x		- version %d
>9	byte	x		.%ld
#
0	string	WNGZWZSC	Wingz compiled script
0	string	WNGZWZSS	Wingz spreadsheet
0	string	WNGZWZHP	Wingz help file
#
0	string	\#Inventor V	IRIS Inventor 1.0 file
0	string	\#Inventor V2	Open Inventor 2.0 file
# XXX - I don't know what next thing is!  It is likely to be an image
# (or movie) format
0	string	glfHeadMagic();		GLF_TEXT
4	belong	0x41010000		GLF_BINARY_LSB_FIRST
4	belong	0x00000141		GLF_BINARY_MSB_FIRST

#------------------------------------------------------------------------------
# sgml:  file(1) magic for Standard Generalized Markup Language
# HyperText Markup Language (HTML) is an SGML document type,
# from Daniel Quinlan (quinlan@yggdrasil.com)
0   string      \<!DOCTYPE\ HTML    HTML document text
0   string      \<!doctype\ html    HTML document text
0   string	\<!DOCTYPE\ html    HTML document text
0   string      \<HEAD      HTML document text
0   string      \<head      HTML document text
0   string      \<TITLE     HTML document text
0   string      \<title     HTML document text
0   string      \<html      HTML document text
0   string      \<HTML      HTML document text

# Extensible markup language (XML), a subset of SGML
# from Marc Prud'hommeaux (marc@apocalypse.org)
0	string		\<?xml\ version="	XML
>15	string		>\0		%.3s document text
>>23	string		\<xsl:stylesheet (XSL stylesheet)
>>24	string		\<xsl:stylesheet (XSL stylesheet)
0       string          \<?xml          XML document text
>23	string		\<xsl:stylesheet XSL stylesheet text
>24	string		\<xsl:stylesheet XSL stylesheet text
0       string          \<?XML          broken XML document text
0       string          \<?Xml          broken XML document text

# SGML, mostly from rph@sq
0   string      \<!DOCTYPE  exported SGML document text
0   string      \<!doctype  exported SGML document text
0   string      \<!SUBDOC   exported SGML subdocument text
0   string      \<!subdoc   exported SGML subdocument text
0   string      \<!--       exported SGML document text



#------------------------------------------------------------------------------
# sniffer:  file(1) magic for packet capture files
#
# From: guy@netapp.com (Guy Harris)
#
# Microsoft Network Monitor capture files.
#
0	string		RTSS		NetMon capture file
>4	byte		x		- version %d
>5	byte		x		\b.%d
>6	leshort		0		(Unknown)
>6	leshort		1		(Ethernet)
>6	leshort		2		(Token Ring)
>6	leshort		3		(FDDI)

#
# Network General Sniffer capture files.
# Sorry, make that "Network Associates Sniffer capture files."
#
0	string		TRSNIFF\ data\ \ \ \ \032	Sniffer capture file
>33	byte		2		(compressed)
>23	leshort		x		- version %d
>25	leshort		x		\b.%d
>32	byte		0		(Token Ring)
>32	byte		1		(Ethernet)
>32	byte		2		(ARCNET)
>32	byte		3		(StarLAN)
>32	byte		4		(PC Network broadband)
>32	byte		5		(LocalTalk)
>32	byte		6		(Znet)
>32	byte		7		(Internetwork Analyzer)
>32	byte		9		(FDDI)
>32	byte		10		(ATM)
#
# Cinco Networks NetXRay capture files.
# Sorry, make that "Network General Sniffer Basic capture files."
# Sorry, make that "Network Associates Sniffer Basic capture files."
#
0	string		XCP\0		NetXRay capture file
>4	string		>\0		- version %s
#
# "libpcap" capture files.
# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
# the main program that uses that format, but there are other programs
# that use "libpcap", or that use the same capture file format.)
#
0	ubelong		0xa1b2c3d4	tcpdump capture file (big-endian)
>4	beshort		x		- version %d
>6	beshort		x		\b.%d
>20	belong		0		(No link-layer encapsulation
>20	belong		1		(Ethernet
>20	belong		2		(3Mb Ethernet
>20	belong		3		(AX.25
>20	belong		4		(ProNET
>20	belong		5		(CHAOS
>20	belong		6		(IEEE 802.x network
>20	belong		7		(ARCNET
>20	belong		8		(SLIP
>20	belong		9		(PPP
>20	belong		10		(FDDI
>20	belong		11		(RFC 1483 ATM
>20	belong		12		(raw IP
>20	belong		13		(BSD/OS SLIP
>20	belong		14		(BSD/OS PPP
>16	belong		x		\b, capture length %d)
0	ulelong		0xa1b2c3d4	tcpdump capture file (little-endian)
>4	leshort		x		- version %d
>6	leshort		x		\b.%d
>20	lelong		0		(No link-layer encapsulation
>20	lelong		1		(Ethernet
>20	lelong		2		(3Mb Ethernet
>20	lelong		3		(AX.25
>20	lelong		4		(ProNET
>20	lelong		5		(CHAOS
>20	lelong		6		(IEEE 802.x network
>20	lelong		7		(ARCNET
>20	lelong		8		(SLIP
>20	lelong		9		(PPP
>20	lelong		10		(FDDI
>20	lelong		11		(RFC 1483 ATM
>20	lelong		12		(raw IP
>20	lelong		13		(BSD/OS SLIP
>20	lelong		14		(BSD/OS PPP
>16	lelong		x		\b, capture length %d)

#------------------------------------------------------------------------------
# softquad:  file(1) magic for SoftQuad Publishing Software
#
# $Id$
# Author/Editor and RulesBuilder
#
# XXX - byte order?
#
0	string		\<!SQ\ DTD>	Compiled SGML rules file
>9	string		>\0		 Type %s
0	string		\<!SQ\ A/E>	A/E SGML Document binary
>9	string		>\0		 Type %s
0	string		\<!SQ\ STS>	A/E SGML binary styles file
>9	string		>\0		 Type %s
0	short		0xc0de		Compiled PSI (v1) data
0	short		0xc0da		Compiled PSI (v2) data
>3	string		>\0		(%s)
# Binary sqtroff font/desc files...
0	short		0125252		SoftQuad DESC or font file binary
>2	short		>0		- version %d
# Bitmaps...
0	string		SQ\ BITMAP1	SoftQuad Raster Format text
#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
# sqtroff intermediate language (replacement for ditroff int. lang.)
0	string		X\ 		SoftQuad troff Context intermediate
>2	string		495		for AT&T 495 laser printer
>2	string		hp		for Hewlett-Packard LaserJet
>2	string		impr		for IMAGEN imPRESS
>2	string		ps		for PostScript

#------------------------------------------------------------------------------
# sun:  file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
# releases.  (5.x uses ELF.)
#
0	belong&077777777	0600413		sparc demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0600410		sparc pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0600407		sparc
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

0	belong&077777777	0400413		mc68020 demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>16	belong		>0		not stripped
0	belong&077777777	0400410		mc68020 pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0400407		mc68020
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

0	belong&077777777	0200413		mc68010 demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>16	belong		>0		not stripped
0	belong&077777777	0200410		mc68010 pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0200407		mc68010
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

# reworked these to avoid anything beginning with zero becoming "old sun-2"
0	belong		0407		old sun-2 executable
>16	belong		>0		not stripped
0	belong		0410		old sun-2 pure executable
>16	belong		>0		not stripped
0	belong		0413		old sun-2 demand paged executable
>16	belong		>0		not stripped

#
# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
# binary executed in compatibility mode under SunOS 5.x".
#
0	belong		0x080456	SunOS core file
>4	belong		432		(SPARC)
>>132	string		>\0		from '%s'
>>116	belong		=3		(quit)
>>116	belong		=4		(illegal instruction)
>>116	belong		=5		(trace trap)
>>116	belong		=6		(abort)
>>116	belong		=7		(emulator trap)
>>116	belong		=8		(arithmetic exception)
>>116	belong		=9		(kill)
>>116	belong		=10		(bus error)
>>116	belong		=11		(segmentation violation)
>>116	belong		=12		(bad argument to system call)
>>116	belong		=29		(resource lost)
>>120	belong		x		(T=%dK,
>>124	belong		x		D=%dK,
>>128	belong		x		S=%dK)
>4	belong		826		(68K)
>>128	string		>\0		from '%s'
>4	belong		456		(SPARC 4.x BCP)
>>152	string		>\0		from '%s'
# Sun SunPC
0	long		0xfa33c08e	SunPC 4.0 Hard Disk
0	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
# Sun snoop (see RFC 1761, which describes the capture file format).
#
0	string		snoop		Snoop capture file
>8	belong		>0		- version %ld
>12	belong		0		(IEEE 802.3)
>12	belong		1		(IEEE 802.4)
>12	belong		2		(IEEE 802.5)
>12	belong		3		(IEEE 802.6)
>12	belong		4		(Ethernet)
>12	belong		5		(HDLC)
>12	belong		6		(Character synchronous)
>12	belong		7		(IBM channel-to-channel adapter)
>12	belong		8		(FDDI)
>12	belong		9		(Unknown)
# Sun KCMS
36	string		acsp		Kodak Color Management System, ICC Profile


#------------------------------------------------------------------------------
# teapot:  file(1) magic for "teapot" spreadsheet
#
0       string          #!teapot\012xdr      teapot work sheet (XDR format)

#------------------------------------------------------------------------------
# terminfo:  file(1) magic for terminfo
#
# XXX - byte order for screen images?
#
0	string		\032\001	Compiled terminfo entry
0	short		0433		Curses screen image
0	short		0434		Curses screen image

#------------------------------------------------------------------------------
# tex:  file(1) magic for TeX files
#
# From <conklin@talisman.kaleida.com>

# Although we may know the offset of certain text fields in TeX DVI
# and font files, we can't use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0	string		\367\002	TeX DVI file
>16	string		>\0		(%s)
0	string		\367\203	TeX generic font data
0	string		\367\131	TeX packed font data
>3	string		>\0		(%s)
0	string		\367\312	TeX virtual font data
0	string		This\ is\ TeX,	TeX transcript text
0	string		This\ is\ METAFONT,	METAFONT transcript text

# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data.  The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2	string		\000\021	TeX font metric data
>33	string		>\0		(%s)
2	string		\000\022	TeX font metric data
>33	string		>\0		(%s)

# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\\input\ texinfo	Texinfo source text
0	string		This\ is\ Info\ file	GNU Info text

# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\\input		TeX document text
0	string		\\section	LaTeX document text
0	string		\\setlength	LaTeX document text
0	string		\\documentstyle	LaTeX document text
0	string		\\chapter	LaTeX document text
0	string		\\documentclass	LaTeX 2e document text
0	string		\\relax		LaTeX auxiliary file
0	string		\\contentsline	LaTeX  table of contents

# Index and glossary files
0	string		\\indexentry	LaTeX raw index file
0	string		\\begin{theindex}	LaTeX sorted index
0	string		\\glossaryentry	LaTeX raw glossary
0	string		\\begin{theglossary}	LaTeX sorted glossary
0	string		This\ is\ makeindex	Makeindex log file
# End of TeX

# ------------------------------------------------------------------------
# ti-8x: file(1) magic for the TI-8x and TI-92 Graphing Calculators.
#
# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
#
# NOTE: This list is not complete.
#
# Magic Numbers for the TI-82
#
0               string          **TI82**        TI-82 Graphing Calculator
>0x000037       byte            0x0B            TI-BASIC Group/Program File.
#
# Magic Numbers for the TI-83
#
0               string          **TI83**        TI-83 Graphing Calculator
>0x000037       byte            0x0B            TI-BASIC Group/Program File.
#
# Magic Numbers for the TI-85
#
0               string          **TI85**        TI-85 Graphing Calculator
>11             string          Backup          Backup File.
>0x000032       string          ZS4             - ZShell Version 4 File.
>0x000032       string          ZS3             - ZShell Version 3 File.
>0x00000B       string          GDatabase       Graphics Database.
>0x00003B       byte            0x12            TI-BASIC Group/Program File.
#
# Magic Numbers for the TI-92
#
0               string          **TI92**        TI-92 Graphing Calculator
>0x000058       byte            0x12            TI-BASIC Group File.
>0x000012       string          Function        Function.
>0x000048       byte            0x12            TI-BASIC Program.
# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
# program/group magic numbers in here because I cannot find any.
0               string          **TI80**        TI-80 Graphing Calculator File.
0               string          **TI81**        TI-81 Graphing Calculator File.

#------------------------------------------------------------------------------
# timezone:  file(1) magic for timezone data
#
# from Daniel Quinlan (quinlan@yggdrasil.com)
# this should work on Linux, SunOS, and maybe others
# Added new official magic number for recent versions of the Olson code
0	string	TZif	timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
0	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data

#------------------------------------------------------------------------------
# troff:  file(1) magic for *roff
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)

# troff input
0	string		.\\"		troff or preprocessor input text
0	string		'\\"		troff or preprocessor input text
0	string		'.\\"		troff or preprocessor input text
0	string		\\"		troff or preprocessor input text

# ditroff intermediate output text
0	string		x\ T		ditroff text
>4	string		cat		for the C/A/T phototypesetter
>4	string		ps		for PostScript
>4	string		dvi		for DVI
>4	string		ascii		for ASCII
>4	string		lj4		for LaserJet 4
>4	string		latin1		for ISO 8859-1 (Latin 1)
>4	string		X75		for xditview at 75dpi
>>7	string		-12		(12pt)
>4	string		X100		for xditview at 100dpi
>>8	string		-12		(12pt)

# output data formats
0	string		\100\357	very old (C/A/T) troff output data

#------------------------------------------------------------------------------
# typeset:  file(1) magic for other typesetting
#
0	string		Interpress/Xerox	Xerox InterPress data
>16	string		/			(version
>>17	string		>\0			%s)

#------------------------------------------------------------------------------
# unknown:  file(1) magic for unknown machines
#
# XXX - this probably should be pruned, as it'll match PDP-11 and
# VAX image formats.
#
# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
# respectively).
#
# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
# have the "version %ld", which may be a bogus COFFism (I don't think
# there ever was COFF for the PDP-11).
#
# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
# long, as it would be on a VAX.
#
# 0x10C is 0414, 0x10D is 0415, and 0x10E is 416; those *are* unknown.
#
0	short		0x107		unknown machine executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x108		unknown pure executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x109		PDP-11 separate I&D
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x10b		unknown pure executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	long		0x10c		unknown demand paged pure executable
>16	long		>0		not stripped
0	long		0x10d		unknown demand paged pure executable
>16	long		>0		not stripped
0	long		0x10e		unknown readable demand paged pure executable

#------------------------------------------------------------------------------
# uuencode:  file(1) magic for ASCII-encoded files
#

# GRR:  the first line of xxencoded files is identical to that in uuencoded
# files, but the first character in most subsequent lines is 'h' instead of
# 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
# punctuation and survives BITNET gateways better.)  If regular expressions
# were supported, this entry could possibly be split into two with
# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
0	string		begin\040	uuencoded or xxencoded text

# btoa(1) is an alternative to uuencode that requires less space.
0	string		xbtoa\ Begin	btoa'd text

# ship(1) is another, much cooler alternative to uuencode.
# Greg Roelofs, newt@uchicago.edu
0	string		$\012ship	ship'd binary text

# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
# Greg Roelofs, newt@uchicago.edu
0	string	Decode\ the\ following\ with\ bdeco	bencoded News text

# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@yggdrasil.com
11	string	must\ be\ converted\ with\ BinHex	BinHex binary text
>41	string	x					\b, version %.3s

# GRR:  is MIME BASE64 encoding handled somewhere?

#------------------------------------------------------------------------------
# varied.out:  file(1) magic for various USG systems
#
#	Herewith many of the object file formats used by USG systems.
#	Most have been moved to files for a particular processor,
#	and deleted if they duplicate other entries.
#
0	short		0610		Perkin-Elmer executable
# AMD 29K
0	beshort		0572		amd 29k coff noprebar executable
0	beshort		01572		amd 29k coff prebar executable
0	beshort		0160007		amd 29k coff archive
# Cray
6	beshort		0407		unicos (cray) executable
# Ultrix 4.3
596	string		\130\337\377\377	Ultrix core file
>600	string		>\0		from '%s'
# BeOS and MAcOS PEF executables
# From: hplus@zilker.net (Jon Watte)
0	string		Joy!peffpwpc	header for PowerPC PEF executable
#
# ava assembler/linker Uros Platise <uros.platise@ijs.si>
0       string          avaobj  AVR assembler object code
>7      string          >\0     version '%s'

#------------------------------------------------------------------------------
# vax:  file(1) magic for VAX executable/object and APL workspace
#
0	lelong		0101557		VAX single precision APL workspace
0	lelong		0101556		VAX double precision APL workspace

#
# VAX a.out (32V, BSD)
#
0	lelong		0407		VAX executable
>16	lelong		>0		not stripped

0	lelong		0410		VAX pure executable
>16	lelong		>0		not stripped

0	lelong		0413		VAX demand paged pure executable
>16	lelong		>0		not stripped

0	lelong		0420		VAX demand paged (first page unmapped) pure executable
>16	lelong		>0		not stripped

#
# VAX COFF
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0	leshort		0570		VAX COFF executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld
0	leshort		0575		VAX COFF pure executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld

#------------------------------------------------------------------------------
# vicar:  file(1) magic for VICAR files.
#
# From: Ossama Othman <othman@astrosun.tn.cornell.edu
# VICAR is JPL's in-house spacecraft image processing program
# VICAR image
0	string	LBLSIZE=	VICAR image data
>32	string	BYTE		\b, 8 bits  = VAX byte
>32	string	HALF		\b, 16 bits = VAX word     = Fortran INTEGER*2
>32	string	FULL		\b, 32 bits = VAX longword = Fortran INTEGER*4
>32	string	REAL		\b, 32 bits = VAX longword = Fortran REAL*4
>32	string	DOUB		\b, 64 bits = VAX quadword = Fortran REAL*8
>32	string	COMPLEX		\b, 64 bits = VAX quadword = Fortran COMPLEX*8
# VICAR label file
43	string	SFDU_LABEL	VICAR label file

#------------------------------------------------------------------------------
# visx:  file(1) magic for Visx format files
#
0	short		0x5555		VISX image file
>2	byte		0		(zero)
>2	byte		1		(unsigned char)
>2	byte		2		(short integer)
>2	byte		3		(float 32)
>2	byte		4		(float 64)
>2	byte		5		(signed char)
>2	byte		6		(bit-plane)
>2	byte		7		(classes)
>2	byte		8		(statistics)
>2	byte		10		(ascii text)
>2	byte		15		(image segments)
>2	byte		100		(image set)
>2	byte		101		(unsigned char vector)
>2	byte		102		(short integer vector)
>2	byte		103		(float 32 vector)
>2	byte		104		(float 64 vector)
>2	byte		105		(signed char vector)
>2	byte		106		(bit plane vector)
>2	byte		121		(feature vector)
>2	byte		122		(feature vector library)
>2	byte		124		(chain code)
>2	byte		126		(bit vector)
>2	byte		130		(graph)
>2	byte		131		(adjacency graph)
>2	byte		132		(adjacency graph library)
>2	string		.VISIX		(ascii text)

#------------------------------------------------------------------------------
# vms:  file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)

# GRR 950122:  I'm just guessing on these, based on inspection of the headers
# of three executables each for Alpha and VAX architectures.  The VAX files
# all had headers similar to this:
#
#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
#
0	string	\xb0\0\x30\0	VMS VAX executable
>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#
# The AXP files all looked like this, except that the byte at offset 0x22
# was 06 in some of them and 07 in others:
#
#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
#
0	belong	0x03000000	VMS Alpha executable
>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
0	string	\377WPC\020\000\000\000\022\012\001\001\000\000\000\000	(WP) loadable text
>15	byte	0	Optimized for Intel
>15	byte	1	Optimized for Non-Intel
1	string	WPC	(Corel/WP)
>8	short	257	WordPerfect macro
>8	short	258	WordPerfect help file
>8	short	259	WordPerfect keyboard file
>8	short	266	WordPerfect document
>8	short	267	WordPerfect dictionary
>8	short	268	WordPerfect thesaurus
>8	short	269	WordPerfect block
>8	short	270	WordPerfect rectangular block
>8	short	271	WordPerfect column block
>8	short	272	WordPerfect printer data
>8	short	275	WordPerfect printer data
>8	short	276	WordPerfect driver resource data
>8	short	279	WordPerfect hyphenation code
>8	short	280	WordPerfect hyphenation data
>8	short	281	WordPerfect macro resource data
>8	short	283	WordPerfect hyphenation lex
>8	short	285	WordPerfect wordlist
>8	short	286	WordPerfect equation resource data
>8	short	289	WordPerfect spell rules
>8	short	290	WordPerfect dictionary rules
>8	short	295	WordPerfect spell rules (Microlytics)
>8	short	299	WordPerfect settings file
>8	short	301	WordPerfect 4.2 document
>8	short	325	WordPerfect dialog file
>8	short	332	WordPerfect button bar
>8	short	513	Shell macro
>8	short	522	Shell definition
>8	short	769	Notebook macro
>8	short	770	Notebook help file
>8	short	771	Notebook keyboard file
>8	short	778	Notebook definition
>8	short	1026	Calculator help file
>8	short 	1538	Calendar help file
>8	short 	1546	Calendar data file
>8	short	1793	Editor macro
>8	short	1794	Editor help file
>8	short	1795	Editor keyboard file
>8	short	1817	Editor macro resource file
>8	short 	2049	Macro editor macro
>8	short 	2050	Macro editor help file
>8	short	2051	Macro editor keyboard file
>8	short	2305	PlanPerfect macro
>8	short	2306	PlanPerfect help file
>8	short	2307	PlanPerfect keyboard file
>8	short	2314	PlanPerfect worksheet
>8	short	2319	PlanPerfect printer definition
>8	short	2322	PlanPerfect graphic definition
>8	short	2323	PlanPerfect data
>8	short	2324	PlanPerfect temporary printer
>8	short	2329	PlanPerfect macro resource data
>8	byte	11	Mail
>8	short	2818	help file
>8	short	2821	distribution list
>8	short	2826	out box
>8	short	2827	in box
>8	short	2836	users archived mailbox
>8	short	2837	archived message database
>8	short	2838	archived attachments
>8	short	3083	Printer temporary file
>8	short	3330	Scheduler help file
>8	short	3338	Scheduler in file
>8	short	3339	Scheduler out file
>8	short	3594	GroupWise settings file
>8	short	3601	GroupWise directory services
>8	short	3627	GroupWise settings file
>8	short	4362	Terminal resource data
>8	short	4363	Terminal resource data
>8	short	4395	Terminal resource data
>8	short	4619	GUI loadable text
>8	short	4620	graphics resource data
>8	short	4621	printer settings file
>8	short	4622	port definition file
>8	short	4623	print queue parameters
>8	short	4624	compressed file
>8	short	5130	Network service msg file
>8	short	5131	Network service msg file
>8	short	5132	Async gateway login msg
>8	short	5134	GroupWise message file
>8	short	7956	GroupWise admin domain database
>8	short	7957	GroupWise admin host database
>8	short	7959	GroupWise admin remote host database
>8	short	7960	GroupWise admin ADS deferment data file
>8	short	8458	IntelliTAG (SGML) compiled DTD
>8	long	18219264	WordPerfect graphic image (1.0)
>8	long	18219520	WordPerfect graphic image (2.0)
#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE

#------------------------------------------------------------------------------
# xenix:  file(1) magic for Microsoft Xenix
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
# model" lifted from "magic.xenix", with comment "derived empirically;
# treat as folklore until proven"
#
# "small model", "large model", "huge model" stuff lifted from XXX
#
# XXX - "x.out" collides with PDP-11 archives
#
0	string		core		core file (Xenix)
0	byte		0x80		8086 relocatable (Microsoft)
0	leshort		0xff65		x.out
>2	string		__.SYMDEF	 randomized
>0	byte		x		archive
0	leshort		0x206		Microsoft a.out
>8	leshort		1		Middle model
>0x1e	leshort		&0x10		overlay
>0x1e	leshort		&0x2		separate
>0x1e	leshort		&0x4		pure
>0x1e	leshort		&0x800		segmented
>0x1e	leshort		&0x400		standalone
>0x1e	leshort		&0x8		fixed-stack
>0x1c	byte		&0x80		byte-swapped
>0x1c	byte		&0x40		word-swapped
>0x10	lelong		>0		not-stripped
>0x1e	leshort		^0xc000		pre-SysV
>0x1e	leshort		&0x4000		V2.3
>0x1e	leshort		&0x8000		V3.0
>0x1c	byte		&0x4		86
>0x1c	byte		&0xb		186
>0x1c	byte		&0x9		286
>0x1c	byte		&0xa		386
>0x1f	byte		<0x040		small model
>0x1f	byte		=0x048		large model	
>0x1f	byte		=0x049		huge model 
>0x1e	leshort		&0x1		executable
>0x1e	leshort		^0x1		object file
>0x1e	leshort		&0x40		Large Text
>0x1e	leshort		&0x20		Large Data
>0x1e	leshort		&0x120		Huge Objects Enabled
>0x10	lelong		>0		not stripped

0	leshort		0x140		old Microsoft 8086 x.out
>0x3	byte		&0x4		separate
>0x3	byte		&0x2		pure
>0	byte		&0x1		executable
>0	byte		^0x1		relocatable
>0x14	lelong		>0		not stripped

0	lelong		0x206		b.out
>0x1e	leshort		&0x10		overlay
>0x1e	leshort		&0x2		separate
>0x1e	leshort		&0x4		pure
>0x1e	leshort		&0x800		segmented
>0x1e	leshort		&0x400		standalone
>0x1e	leshort		&0x1		executable
>0x1e	leshort		^0x1		object file
>0x1e	leshort		&0x4000		V2.3
>0x1e	leshort		&0x8000		V3.0
>0x1c	byte		&0x4		86
>0x1c	byte		&0xb		186
>0x1c	byte		&0x9		286
>0x1c	byte		&0x29		286
>0x1c	byte		&0xa		386
>0x1e	leshort		&0x4		Large Text
>0x1e	leshort		&0x2		Large Data
>0x1e	leshort		&0x102		Huge Objects Enabled

0	leshort		0x580		XENIX 8086 relocatable or 80286 small model

#------------------------------------------------------------------------------
# zilog:  file(1) magic for Zilog Z8000.
#
# Was it big-endian or little-endian?  My Product Specification doesn't
# say.
#
0	long		0xe807		object file (z8000 a.out)
0	long		0xe808		pure object file (z8000 a.out)
0	long		0xe809		separate object file (z8000 a.out)
0	long		0xe805		overlay object file (z8000 a.out)

#------------------------------------------------------------------------------
# zyxel:  file(1) magic for ZyXEL modems
#
# From <rob@pe1chl.ampr.org>
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
# ZyXEL-defined standard)

0	string		ZyXEL\002	ZyXEL voice data
>10	byte		0		- CELP encoding
>10	byte&0x0B	1		- ADPCM2 encoding
>10	byte&0x0B	2		- ADPCM3 encoding
>10	byte&0x0B	3		- ADPCM4 encoding
>10	byte&0x0B	8		- New ADPCM3 encoding
>10	byte&0x04	4		with resync

# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
# It is used for conformance testing of communication protocols.
# Added by W. Borgert <debacle@debian.org>.
0	string		$Suite			TTCN Abstract Test Suite
>&1	string		$SuiteId
>>&1	string		>\n			%s
>&2	string		$SuiteId
>>&1	string		>\n			%s
>&3	string		$SuiteId
>>&1	string		>\n			%s

# MSC (message sequence charts) are a formal description technique,
# described in ITU-T Z.120, mainly used for communication protocols.
# Added by W. Borgert <debacle@debian.org>.
0	string		mscdocument	Message Sequence Chart (document)
0	string		msc		Message Sequence Chart (chart)
0	string		submsc		Message Sequence Chart (subchart)

#-----------------------------------------------------------------------------
# misctools:  file(1) magic for miscelanous UNIX tools.
#

0	string		%%!!		X-Post-It-Note text

#------------------------------------------------------------------------------
# wordprocessors:  file(1) magic fo word processors.
#

####### PWP file format used on Smith Corona Personal Word Processors:
2	string	\040\040\040\040\040\040\040\040\040\040\040ML4D\040\'92	Smith Corona PWP
>24	byte	2	\b, single spaced
>24	byte	3	\b, 1.5 spaced
>24	byte	4	\b, double spaced
>25	byte	0x42	\b, letter
>25	byte	0x54	\b, legal
>26	byte	0x46	\b, A4

#------------------------------------------------------------------------------
# JPEG images
# SunOS 5.5.1 had
#
#	0	string		\377\330\377\340	JPEG file
#	0	string		\377\330\377\356	JPG file
#
# both of which turn into "JPEG image data" here.
#
0	beshort		0xffd8		JPEG image data
>6	string		JFIF		\b, JFIF standard

# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
# in a vain attempt to add image size reporting for JFIF.  Note that these
# tests are not fool-proof since some perfectly valid JPEGs are currently
# impossible to specify in magic(4) format.
# First, a little JFIF version info:
>11	byte		x		\b %d.
>12	byte		x		\b%02d
# Next, the resolution or aspect ratio of the image:
>13	byte		0		\b, aspect ratio
>13	byte		1		\b, resolution (DPI)
>13	byte		2		\b, resolution (DPCM)
>14	beshort		x		\b X%d:
>16	beshort		x		\bY%d
#>4	beshort		x		\b, segment length %d
# Next, show thumbnail info, if it exists:
>18	byte		!0		\b, thumbnail %dx
>>19	byte		x		\b%d
# Here things get sticky.  We can do ONE MORE marker segment with
# indirect addressing, and that's all.  It would be great if we could
# do pointer arithemetic like in an assembler language.  Christos?
# And if there was some sort of looping construct to do searches, plus a few
# named accumulators, it would be even more effective...
# At least we can show a comment if no other segments got inserted before:
>(4.S+5)	byte		0xFE
>>(4.S+8)	string		>\0		\b, "%s"
#>(4.S+5)	byte		0xFE		\b, comment
#>>(4.S+6)	beshort		x		\b length=%d
#>>(4.S+8)	string		>\0		\b, "%s"
# Or, we can show the encoding type (I've included only the three most common)
# and image dimensions if we are lucky and the SOFn (image segment) is here:
>(4.S+5)	byte		0xC0		\b, baseline
>>(4.S+6)	byte		x		\b, precision %d
>>(4.S+7)	beshort		x		\b, %dx
>>(4.S+9)	beshort		x		\b%d
>(4.S+5)	byte		0xC1		\b, extended sequential
>>(4.S+6)	byte		x		\b, precision %d
>>(4.S+7)	beshort		x		\b, %dx
>>(4.S+9)	beshort		x		\b%d
>(4.S+5)	byte		0xC2		\b, progressive
>>(4.S+6)	byte		x		\b, precision %d
>>(4.S+7)	beshort		x		\b, %dx
>>(4.S+9)	beshort		x		\b%d
# I've commented-out quantisation table reporting.  I doubt anyone cares yet.
#>(4.S+5)	byte		0xDB		\b, quantisation table
#>>(4.S+6)	beshort		x		\b length=%d

# HSI is Handmade Software's proprietary JPEG encoding scheme
0	string		hsi1		JPEG image data, HSI proprietary

#------------------------------------------------------------------------------
# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
#
# ACE/gr binary
0	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
>39	byte	>0			- version %c
# ACE/gr ascii
0	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
0	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
0	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
# Grace projects
0	string	#\ Grace\ project\ file		Grace project file
>23	string	@version\  			(version
>>32	byte	>0 				%c
>>33	string	>\0 				\b.%.2s
>>35	string	>\0 				\b.%.2s)
# ACE/gr fit description files
0	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
#------------------------------------------------------------------------------
# Mavroyanopoulos Nikos <nmav@hellug.gr>
# mcrypt:   file(1) magic for mcrypt 2.2.x;
0      string          \0m\2           mcrypt 2.2 encrypted data,
>3     byte            0               algorithm: blowfish-448,
>3     byte            1               algorithm: DES,
>3     byte            2               algorithm: 3DES,
>3     byte            3               algorithm: 3-WAY,
>3     byte            4               algorithm: GOST,
>3     byte            6               algorithm: SAFER-SK64,
>3     byte            7               algorithm: SAFER-SK128,
>3     byte            8               algorithm: CAST-128,
>3     byte            9               algorithm: xTEA,
>3     byte            10              algorithm: TWOFISH-128,
>3     byte            11              algorithm: RC2,
>3     byte            12              algorithm: TWOFISH-192,
>3     byte            13              algorithm: TWOFISH-256,
>3     byte            14              algorithm: blowfish-128,
>3     byte            15              algorithm: blowfish-192,
>3     byte            16              algorithm: blowfish-256,
>3     byte            100             algorithm: RC6,
>3     byte            101             algorithm: IDEA,
>4     byte            0               mode: CBC,
>4     byte            1               mode: ECB,
>4     byte            2               mode: CFB,
>4     byte            3               mode: OFB,
>4     byte            4               mode: nOFB,
>5     byte            0               keymode: 8bit
>5     byte            1               keymode: 4bit
>5     byte            2               keymode: SHA-1 hash
>5     byte            3               keymode: MD5 hash

#------------------------------------------------------------------------------
# palm:  file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
#
# Brian Lalor <blalor@hcirisc.cs.binghamton.edu>

# appl
60      belong                  0x6170706c      PalmOS application
>0      string                  >\0             "%s"
# TEXt
60      belong                  0x54455874      AportisDoc file
>0      string                  >\0             "%s"
# HACK
60      belong                  0x4841434b      HackMaster hack
>0      string                  >\0             "%s"

#------------------------------------------------------------------------------
# spectrum:  file(1) magic for Spectrum emulator files.
#
# John Elliott <jce@seasip.demon.co.uk>

#
# Spectrum +3DOS header
#
0       string          PLUS3DOS\032    Spectrum +3 data
>15     byte            0               - BASIC program
>15     byte            1               - number array
>15     byte            2               - character array
>15     byte            3               - memory block
>>16    belong          0x001B0040      (screen)
>15     byte            4               - Tasword document
>15     string          TAPEFILE        - ZXT tapefile
#
# Tape file. This assumes the .TAP starts with a Spectrum-format header,
# which nearly all will.
#
0       string          \023\000\000    Spectrum .TAP data
>4      string          x               "%-10.10s"
>3      byte            0               - BASIC program
>3      byte            1               - number array
>3      byte            2               - character array
>3      byte            3               - memory block
>>14    belong          0x001B0040      (screen)
