# Magic
#	$OpenBSD: Header,v 1.5 1997/04/03 17:39:38 kstailey Exp $

# Magic data for file(1) command.
# Machine-genererated from src/usr.bin/file/magdir/*; edit there only!
# Format is described in magic(files), where:
# files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID.
#------------------------------------------------------------------------------
# Localstuff:  file(1) magic for locally observed files
#
# $OpenBSD: Localstuff,v 1.3 1997/02/09 23:58:40 millert Exp $
# Add any locally observed files here.  Remember:
# text if readable, executable if runnable binary, data if unreadable.

#------------------------------------------------------------------------------
# OpenBSD:  file(1) magic for OpenBSD objects
#
# All new-style magic numbers are in network byte order.
#

0	lelong			000000407	OpenBSD little-endian object file
>16	lelong			>0		not stripped
0	belong			000000407	OpenBSD big-endian object file
>16	belong			>0		not stripped

0	belong&0377777777	041400413	OpenBSD/i386 demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	041400410	OpenBSD/i386 pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	041400407	OpenBSD/i386
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	041400507	OpenBSD/i386 core
>12	string			>\0		from '%s'

0	belong&0377777777	041600413	OpenBSD/m68k demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	041600410	OpenBSD/m68k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	041600407	OpenBSD/m68k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	041600507	OpenBSD/m68k core
>12	string			>\0		from '%s'

0	belong&0377777777	042000413	OpenBSD/m68k4k demand paged
>0	byte			&0x80		
>>20	belong			<4096		shared library
>>20	belong			=4096		dynamically linked executable
>>20	belong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042000410	OpenBSD/m68k4k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042000407	OpenBSD/m68k4k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	042000507	OpenBSD/m68k4k core
>12	string			>\0		from '%s'

0	belong&0377777777	042200413	OpenBSD/ns32532 demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042200410	OpenBSD/ns32532 pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042200407	OpenBSD/ns32532
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	042200507	OpenBSD/ns32532 core
>12	string			>\0		from '%s'

0	belong&0377777777	042400413	OpenBSD/sparc demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042400410	OpenBSD/sparc pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042400407	OpenBSD/sparc
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	042400507	OpenBSD/sparc core
>12	string			>\0		from '%s'

0	belong&0377777777	042600413	OpenBSD/pmax demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042600410	OpenBSD/pmax pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042600407	OpenBSD/pmax
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	042600507	OpenBSD/pmax core
>12	string			>\0		from '%s'

0	belong&0377777777	043000413	OpenBSD/vax demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043000410	OpenBSD/vax pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043000407	OpenBSD/vax
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	043000507	OpenBSD/vax core
>12	string			>\0		from '%s'

# OpenBSD/alpha does not support (and has never supported) a.out objects,
# so no rules are provided for them.  OpenBSD/alpha ELF objects are 
# dealt with in "elf".
0	leshort		0x00070185		ECOFF OpenBSD/alpha binary
>10	leshort		0x0001			not stripped
>10	leshort		0x0000			stripped
0	belong&0377777777	043200507	OpenBSD/alpha core
>12	string			>\0		from '%s'

0	belong&0377777777	043400413	OpenBSD/mips demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	043400410	OpenBSD/mips pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	043400407	OpenBSD/mips
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	043400507	OpenBSD/mips core
>12	string			>\0		from '%s'

0	belong&0377777777	043600413	OpenBSD/arm32 demand paged
>0	byte			&0x80
>>20	lelong			<8192		shared library
>>20	lelong			=8192		dynamically linked executable
>>20	lelong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043600410	OpenBSD/arm32 pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043600407	OpenBSD/arm32
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	043600507	OpenBSD/arm32 core
>12	string			>\0		from '%s'

#------------------------------------------------------------------------------
# 386bsd:  file(1) magic for 386BSD objects
#
0	lelong			000000413	386BSD demand paged executable
>16	lelong			>0		not stripped

#------------------------------------------------------------------------------
# alliant:  file(1) magic for Alliant FX series a.out files
#
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".
# If it's the i860-based one, they should probably become either the
# big-endian or little-endian versions, depending on the mode they ran
# the 860 in....
#
0	short		0420		0420 Alliant virtual executable
>2	short		&0x0020		common library
>16	long		>0		not stripped
0	short		0421		0421 Alliant compact executable
>2	short		&0x0020		common library
>16	long		>0		not stripped
#	$OpenBSD: alpha,v 1.2 2001/01/29 01:57:56 niklas Exp $

#------------------------------------------------------------------------------
# alpha architecture description
#

0	leshort		0603		COFF format alpha
>22	leshort&030000	!020000		executable
>24	leshort		0410		pure
>24	leshort		0413		paged
>22	leshort&020000	!0		dynamically linked
>16	lelong		!0		not stripped
>16	lelong		0		stripped
>22	leshort&030000	020000		shared library
>24	leshort		0407		object
>27	byte		x		- version %d
>26	byte		x		.%d
>28	byte		x		-%d

# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
#
0	string		Core\001	Alpha COFF format core dump (Digital UNIX)
>24	string		>\0		\b, from '%s'
#	$OpenBSD: amanda,v 1.3 2001/01/29 01:57:57 niklas Exp $

#------------------------------------------------------------------------------
# amanda:  file(1) magic for amanda file format
#
0	string	AMANDA:\ 		AMANDA 
>8	string	TAPESTART\ DATE		tape header file,
>>23	string	X
>>>25	string	>\ 			Unused %s
>>23	string	>\ 			DATE %s
>8	string	FILE\ 			dump file,
>>13	string	>\ 			DATE %s
#	$OpenBSD: amigaos,v 1.2 2001/01/29 01:57:57 niklas Exp $

#------------------------------------------------------------------------------
# amigaos:  file(1) magic for AmigaOS binary formats:

#
# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
# Some formats are still missing: AmigaOS special IFF's, e.g.: FORM....CTLG
# (the others should be seperate, anyway)
#
0	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
0	belong		0x000003e7	AmigaOS object/library data

#------------------------------------------------------------------------------
# animation:  file(1) magic for animation/movie formats
#
# animation formats
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)

# MPEG animation format
0	string		\000\000\001\263	MPEG file

# FLI animation format
4	leshort		0xAF11			FLI file
>6	leshort		x			- %d frames,
>8	leshort		x			width=%d pixels,
>10	leshort		x			height=%d pixels,
>12	leshort		x			depth=%d,
>16	leshort		x			ticks/frame=%d
# FLC animation format
4	leshort		0xAF12			FLC file
>6	leshort		x			- %d frames
>8	leshort		x			width=%d pixels,
>10	leshort		x			height=%d pixels,
>12	leshort		x			depth=%d,
>16	leshort		x			ticks/frame=%d

# DL animation format
# XXX - collision with most `mips' magic
#
# I couldn't find a real magic number for these, however, this
# -appears- to work.  Note that it might catch other files, too, so be
# careful!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)!  The DL format is really bad.
#
#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
#>42	byte	x	- %d screens,
#>43	byte	x	%d commands
#0	byte	2	DL version 2
#>1	byte	1	- large format (320x200,1 image/screen),
#>1	byte	2	- medium format (160x100,4 images/screen),
#>1	byte	>2	- unknown format,
#>42	byte	x	%d screens,
#>43	byte	x	%d commands
# Based on empirical evidence, DL version 3 have several nulls following the
# \003.  Most of them start with non-null values at hex offset 0x34 or so.
#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3

# SGI and Apple formats
0	string		MOVI		Silicon Graphics movie file
4	string		moov		Apple QuickTime movie file (moov)
4	string		mdat		Apple QuickTime movie file (mdat)

#------------------------------------------------------------------------------
# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
#       workspaces)
#
0	long		0100554		APL workspace (Ken's original?)

#------------------------------------------------------------------------------
# apple:  file(1) magic for Apple II file formats
#
0	string		FiLeStArTfIlEsTaRt	binscii (apple ][) text
0	string		\x0aGL			Binary II (apple ][) data
0	string		\x76\xff		Squeezed (apple ][) data
0	string		N\365F\351l\345		NuFile archive (apple ][) data

#------------------------------------------------------------------------------
# archive:  file(1) magic for archive formats (see also "msdos" for self-
#           extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are handled in the C code.

# POSIX tar archives
257	string		ustar\0		POSIX tar archive
257	string		ustar\040\040\0	GNU tar archive

# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0	short		070707		cpio archive
0	short		0143561		byte-swapped cpio archive
0	string		070707		ASCII cpio archive (pre-SVR4 or odc)
0	string		070701		ASCII cpio archive (SVR4 with no CRC)
0	string		070702		ASCII cpio archive (SVR4 with CRC)

# other archives
0	long		0177555		very old archive
0	short		0177555		very old PDP-11 archive
0	long		0177545		old archive
0	short		0177545		old PDP-11 archive
0	long		0100554		apl workspace
0	string		=<ar>		archive

# MIPS archive (needs to go first)
#
0	string	!<arch>\n__________E	MIPS archive
>20	string	U			with MIPS Ucode members
>21	string	L			with MIPSEL members
>21	string	B			with MIPSEB members
>19	string	L			and an EL hash table
>19	string	B			and an EB hash table
>22	string	X			-- out of date

0	string		-h-		Software Tools format archive text

#
# XXX - why are there multiple <ar> thingies?  Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0	string		!<arch>		current ar archive
# 0	long		0x213c6172	archive file
#
# and for SVR1 archives, we have:
#
# 0	string		\<ar>		System V Release 1 ar archive
# 0	string		=<ar>		archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0	string		!<arch>		current ar archive
>8	string		__.SYMDEF	random library
>8	string		debian-split	part of multipart Debian package
>8	string		debian-binary	Debian binary package
>0	belong		=65538		- pre SR9.5
>0	belong		=65539		- post SR9.5
>0	beshort		2		- object archive
>0	beshort		3		- shared library module
>0	beshort		4		- debug break-pointed module
>0	beshort		5		- absolute code program module
0	string		\<ar>		System V Release 1 ar archive
0	string		=<ar>		archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
0	belong		0x65ff0000	VAX 3.0 archive
0	belong		0x3c61723e	VAX 5.0 archive
#
0	long		0x213c6172	archive file
0	lelong		0177555		very old VAX archive
0	leshort		0177555		very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0	lelong		0177545		old VAX archive
>8	string		__.SYMDEF	random library
0	leshort		0177545		old PDP-11 archive
>8	string		__.SYMDEF	random library
#
# From "pdp" (but why a 4-byte quantity?)
#
0	lelong		0x39bed		PDP-11 old archive
0	lelong		0x39bee		PDP-11 4.0 archive

# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated).  Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
0	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
0	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
0	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
0	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
0	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
0	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched

# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR:  the original entries collide with ARC, above; replaced with combined
#  version (not tested)]
#0	byte		0x1a		RISC OS archive
#>1	string		archive		(ArcFS format)
0	string		\032archive	RISC OS archive (ArcFS format)

# ARJ archiver (jason@jarthur.Claremont.EDU)
0	leshort		0xea60		ARJ archive data
>5	byte		x		\b, v%d,
>8	byte		&0x04		multi-volume,
>8	byte		&0x10		slash-switched,
>8	byte		&0x20		backup,
>34	string		x		original name: %s,
>7	byte		0		os: MS-DOS
>7	byte		1		os: PRIMOS
>7	byte		2		os: Unix
>7	byte		3		os: Amiga
>7	byte		4		os: Macintosh
>7	byte		5		os: OS/2
>7	byte		6		os: Apple ][ GS
>7	byte		7		os: Atari ST
>7	byte		8		os: NeXT
>7	byte		9		os: VAX/VMS
>3	byte		>0		%d]

# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0	string		HA		HA archive data,
#>2	leshort		=1		1 file,
#>2	leshort		>1		%u files,
#>4	byte&0x0f	=0		first is type CPY
#>4	byte&0x0f	=1		first is type ASC
#>4	byte&0x0f	=2		first is type HSC
#>4	byte&0x0f	=0x0e		first is type DIR
#>4	byte&0x0f	=0x0f		first is type SPECIAL

# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0	string		HPAK		HPACK archive data

# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0	string		\351,\001JAM\		JAM archive,
>7	string		>\0			version %.4s
>0x26	byte		=0x27			-
>>0x2b	string          >\0			label %.11s,
>>0x27	lelong		x			serial %08x,
>>0x36	string		>\0			fstype %.8s

# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2	string		-lh0-		LHarc 1.x archive data [lh0]
2	string		-lh1-		LHarc 1.x archive data [lh1]
2	string		-lz4-		LHarc 1.x archive data [lz4]
2	string		-lz5-		LHarc 1.x archive data [lz5]
#	[never seen any but the last; -lh4- reported in comp.compression:]
2	string		-lzs-		LHa 2.x? archive data [lzs]
2	string		-lh -		LHa 2.x? archive data [lh ]
2	string		-lhd-		LHa 2.x? archive data [lhd]
2	string		-lh2-		LHa 2.x? archive data [lh2]
2	string		-lh3-		LHa 2.x? archive data [lh3]
2	string		-lh4-		LHa (2.x) archive data [lh4]
2	string		-lh5-		LHa (2.x) archive data [lh5]
>20	byte		x		- header level %d

# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0	string		Rar!		RAR archive data

# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0	string		SQSH		squished archive data (Acorn RISCOS)

# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# I can't figure out the self-extracting form of these buggers...
0	string		UC2\x1a		UC2 archive data

# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0	string		PK\003\004	Zip archive data
>4	byte		0x09		\b, at least v0.9 to extract
>4	byte		0x0a		\b, at least v1.0 to extract
>4	byte		0x0b		\b, at least v1.1 to extract
>4	byte		0x14		\b, at least v2.0 to extract

# Zoo archiver
20	lelong		0xfdc4a7dc	Zoo archive data
>4	byte		>48		\b, v%c.
>>6	byte		>47		\b%c
>>>7	byte		>47		\b%c
>32	byte		>0		\b, modify: v%d
>>33	byte		x		\b.%d+
>42	lelong		0xfdc4a7dc	\b,
>>70	byte		>0		extract: v%d
>>>71	byte		x		\b.%d+

# Shell archives
10	string		#\ This\ is\ a\ shell\ archive	shell archive text

#------------------------------------------------------------------------------
# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
# strings as "long" - we assume they're just strings:
# From: guy@netapp.com (Guy Harris)
#
0	string		*STA		Aster*x
>7	string		WORD			Words Document
>7	string		GRAP			Graphic
>7	string		SPRE			Spreadsheet
>7	string		MACR			Macro
0	string		2278		Aster*x Version 2
>29	byte		0x36			Words Document
>29	byte		0x35			Graphic
>29	byte		0x32			Spreadsheet
>29	byte		0x38			Macro


#------------------------------------------------------------------------------
# att3b:  file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
# 3B20
#
0	beshort		0550		3b20 COFF executable
>12	belong		>0		not stripped
#>22	beshort		>0		- version %ld
0	beshort		0551		3b20 COFF executable (TV)
>12	belong		>0		not stripped
#>22	beshort		>0		- version %ld
#
# WE32K
#
0	beshort		0560		WE32000 COFF
>18	beshort		^00000020	object
>18	beshort		&00000020	executable
>12	belong		>0		not stripped
>18	beshort		^00010000	N/A on 3b2/300 w/paging
>18	beshort		&00020000	32100 required
>18	beshort		&00040000	and MAU hardware required
>20	beshort		0407		(impure)
>20	beshort		0410		(pure)
>20	beshort		0413		(demand paged)
>20	beshort		0443		(target shared library)
>22	beshort		>0		- version %ld
0	beshort		0561		WE32000 COFF executable (TV)
>12	belong		>0		not stripped
#>18	beshort		&00020000	- 32100 required
#>18	beshort		&00040000	and MAU hardware required
#>22	beshort		>0		- version %ld
#
# core file for 3b2 
0	string		\000\004\036\212\200	3b2 core file
>364	string		>\0		of '%s'

#------------------------------------------------------------------------------
# audio:  file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
# and others
#

# Sun/NeXT audio data
0	string		.snd		Sun/NeXT audio data:
>12	belong		1		8-bit ISDN u-law,
>12	belong		2		8-bit linear PCM [REF-PCM],
>12	belong		3		16-bit linear PCM,
>12	belong		4		24-bit linear PCM,
>12	belong		5		32-bit linear PCM,
>12	belong		6		32-bit IEEE floating point,
>12	belong		7		64-bit IEEE floating point,
>12	belong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>12	belong		24		compressed (8-bit G.722 ADPCM)
>12	belong		25		compressed (3-bit G.723 ADPCM),
>12	belong		26		compressed (5-bit G.723 ADPCM),
>12	belong		27		8-bit A-law,
>20	belong		1		mono,
>20	belong		2		stereo,
>20	belong		4		quad,
>16	belong		>0		%d Hz

# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
0	lelong		0x0064732E	DEC audio data:
>12	lelong		1		8-bit ISDN u-law,
>12	lelong		2		8-bit linear PCM [REF-PCM],
>12	lelong		3		16-bit linear PCM,
>12	lelong		4		24-bit linear PCM,
>12	lelong		5		32-bit linear PCM,
>12	lelong		6		32-bit IEEE floating point,
>12	lelong		7		64-bit IEEE floating point,
>12	lelong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>20	lelong		1		mono,
>20	lelong		2		stereo,
>20	lelong		4		quad,
>16	lelong		>0		%d Hz

# Creative Labs AUDIO stuff
0	string	MThd			Standard MIDI data
>9 	byte	>0			(format %d)
>11	byte	>1			using %d channels
0	string	CTMF			Creative Music (CMF) data
0	string	SBI			SoundBlaster instrument data
0	string	Creative\ Voice\ File	Creative Labs voice data
# is this next line right?  it came this way...
>19	byte	0x1A
>23	byte	>0			- version %d
>22	byte	>0			\b.%d

# first entry is also the string "NTRK"
0	belong		0x4e54524b	MultiTrack sound data
>4	belong		x		- version %ld

# Microsoft WAVE format (*.wav)
0	string		RIFF		Microsoft RIFF
>8	string		WAVE		\b, WAVE audio data
>>34	leshort		>0		\b, %d bit
>>22	leshort		=1		\b, mono
>>22	leshort		=2		\b, stereo
>>22	leshort		>2		\b, %d channels
>>24	lelong		>0		%d Hz
# AVI == Audio Video Interleave
>8	string		AVI\		\b, AVI data

# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
0	string		EMOD		Extended MOD sound data,
>4	byte&0xf0	x		version %d
>4	byte&0x0f	x		\b.%d,
>45	byte		x		%d instruments
>83	byte		0		(module)
>83	byte		1		(song)

# Real Audio (Magic .ra\0375)
0	belong		0x2e7261fd	realaudio sound file

# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
# Oct 31, 1995
#0	string		MTM		MultiTracker Module sound file
#0	string		if		Composer 669 Module sound data
#0	string		FAR		Module sound data
#0	string		MAS_U		ULT(imate) Module sound data
#0x2c	string		SCRM		ScreamTracker III Module sound data
#0	string		Extended Module	Extended Module sound data

#------------------------
# MPEG:  file(1) magic for MPEG audio.
#
# From <ckane@best.com>
# Show MPEG level, layer, kbit/s, hz, stereo/mono for an MPG audio file.
# This section is lengthy because the kbit/s rate depends on the
# level and layer, and file(1) doesn't allow math on the values.
#

####### MPEG begins with three hex 'f' nibbles.
0	beshort&0xfff0	0xfff0		MPEG
####### Level 2
>1	byte&0x08	0x00		2.0
>>1	byte&0x06	0x00		Layer Unknown,
####### Level 2, Layers I, II, and III
>>1	byte&0x06	0x02		Layer III,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		8 kbit/s,
>>>2	byte&0xf0	0x20		16 kbit/s,
>>>2	byte&0xf0	0x30		24 kbit/s,
>>>2	byte&0xf0	0x40		32 kbit/s,
>>>2	byte&0xf0	0x50		40 kbit/s,
>>>2	byte&0xf0	0x60		48 kbit/s,
>>>2	byte&0xf0	0x70		56 kbit/s,
>>>2	byte&0xf0	0x80		64 kbit/s,
>>>2	byte&0xf0	0x90		80 kbit/s,
>>>2	byte&0xf0	0xa0		96 kbit/s,
>>>2	byte&0xf0	0xb0		112 kbit/s,
>>>2	byte&0xf0	0xc0		128 kbit/s,
>>>2	byte&0xf0	0xd0		144 kbit/s,
>>>2	byte&0xf0	0xe0		160 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
>>1	byte&0x06	0x04		Layer II,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		8 kbit/s,
>>>2	byte&0xf0	0x20		16 kbit/s,
>>>2	byte&0xf0	0x30		24 kbit/s,
>>>2	byte&0xf0	0x40		32 kbit/s,
>>>2	byte&0xf0	0x50		40 kbit/s,
>>>2	byte&0xf0	0x60		48 kbit/s,
>>>2	byte&0xf0	0x70		56 kbit/s,
>>>2	byte&0xf0	0x80		64 kbit/s,
>>>2	byte&0xf0	0x90		80 kbit/s,
>>>2	byte&0xf0	0xa0		96 kbit/s,
>>>2	byte&0xf0	0xb0		112 kbit/s,
>>>2	byte&0xf0	0xc0		128 kbit/s,
>>>2	byte&0xf0	0xd0		144 kbit/s,
>>>2	byte&0xf0	0xe0		160 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
>>1	byte&0x06	0x06		Layer I,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		32 kbit/s,
>>>2	byte&0xf0	0x20		48 kbit/s,
>>>2	byte&0xf0	0x30		56 kbit/s,
>>>2	byte&0xf0	0x40		64 kbit/s,
>>>2	byte&0xf0	0x50		80 kbit/s,
>>>2	byte&0xf0	0x60		96 kbit/s,
>>>2	byte&0xf0	0x70		112 kbit/s,
>>>2	byte&0xf0	0x80		128 kbit/s,
>>>2	byte&0xf0	0x90		144 kbit/s,
>>>2	byte&0xf0	0xa0		160 kbit/s,
>>>2	byte&0xf0	0xb0		176 kbit/s,
>>>2	byte&0xf0	0xc0		192 kbit/s,
>>>2	byte&0xf0	0xd0		224 kbit/s,
>>>2	byte&0xf0	0xe0		256 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
####### Level 2, Hz
>>2	byte&0x0c	0x00		22050 Hz
>>2	byte&0x0c	0x04		24000 Hz
>>2	byte&0x0c	0x08		16000 Hz
>>2	byte&0x0c	0x0c		? Hz
####### Level 1 decoding
>1	byte&0x08	0x08		1.0
>>1	byte&0x06	0x00		Layer Unknown.
####### Level 1, Layers I, II, and III
>>1	byte&0x06	0x02		Layer III,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		32 kbit/s,
>>>2	byte&0xf0	0x20		40 kbit/s,
>>>2	byte&0xf0	0x30		48 kbit/s,
>>>2	byte&0xf0	0x40		56 kbit/s,
>>>2	byte&0xf0	0x50		64 kbit/s,
>>>2	byte&0xf0	0x60		80 kbit/s,
>>>2	byte&0xf0	0x70		96 kbit/s,
>>>2	byte&0xf0	0x80		112 kbit/s,
>>>2	byte&0xf0	0x90		128 kbit/s,
>>>2	byte&0xf0	0xa0		160 kbit/s,
>>>2	byte&0xf0	0xb0		192 kbit/s,
>>>2	byte&0xf0	0xc0		224 kbit/s,
>>>2	byte&0xf0	0xd0		256 kbit/s,
>>>2	byte&0xf0	0xe0		320 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
>>1	byte&0x06	0x04		Layer II,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		32 kbit/s,
>>>2	byte&0xf0	0x20		48 kbit/s,
>>>2	byte&0xf0	0x30		56 kbit/s,
>>>2	byte&0xf0	0x40		64 kbit/s,
>>>2	byte&0xf0	0x50		80 kbit/s,
>>>2	byte&0xf0	0x60		96 kbit/s,
>>>2	byte&0xf0	0x70		112 kbit/s,
>>>2	byte&0xf0	0x80		128 kbit/s,
>>>2	byte&0xf0	0x90		160 kbit/s,
>>>2	byte&0xf0	0xa0		192 kbit/s,
>>>2	byte&0xf0	0xb0		224 kbit/s,
>>>2	byte&0xf0	0xc0		256 kbit/s,
>>>2	byte&0xf0	0xd0		320 kbit/s,
>>>2	byte&0xf0	0xe0		384 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
>>1	byte&0x06	0x06		Layer I,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		32 kbit/s,
>>>2	byte&0xf0	0x20		64 kbit/s,
>>>2	byte&0xf0	0x30		96 kbit/s,
>>>2	byte&0xf0	0x40		128 kbit/s,
>>>2	byte&0xf0	0x50		160 kbit/s,
>>>2	byte&0xf0	0x60		192 kbit/s,
>>>2	byte&0xf0	0x70		224 kbit/s,
>>>2	byte&0xf0	0x80		256 kbit/s,
>>>2	byte&0xf0	0x90		288 kbit/s,
>>>2	byte&0xf0	0xa0		320 kbit/s,
>>>2	byte&0xf0	0xb0		352 kbit/s,
>>>2	byte&0xf0	0xc0		384 kbit/s,
>>>2	byte&0xf0	0xd0		416 kbit/s,
>>>2	byte&0xf0	0xe0		448 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
####### Level 2, Hz
>>2	byte&0x0c	0x00		44100 Hz
>>2	byte&0x0c	0x04		48000 Hz
>>2	byte&0x0c	0x08		32000 Hz
>>2	byte&0x0c	0x0c		? Hz
####### Stereo or Mono
>3	byte&0xc0	0x00		stereo
>3	byte&0xc0	0x40		joint-stereo
>3	byte&0xc0	0x80		dual-channel
>3	byte&0xc0	0xc0		mono

#------------------------------------------------------------------------------
# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on
# little-endian machines as well?  If so, what's the deal with
# "VAX-order" and "VAX-order2"?
#
#0	long		0407		68K Blit (standalone) executable
#0	short		0407		VAX-order2 68K Blit (standalone) executable
0	short		03401		VAX-order 68K Blit (standalone) executable
0	long		0406		68k Blit mpx/mux executable
0	short		0406		VAX-order2 68k Blit mpx/mux executable
0	short		03001		VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0	short		0520		tty630 layers executable

#------------------------------------------------------------------------------
# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
#
0	lelong			000000314	BSD/OS i386 compact demand paged executable
>16	lelong			>0		not stripped
>32	byte			0x6a		(uses shared libs)

#------------------------------------------------------------------------------
# c-lang:  file(1) magic for C programs (or REXX)
#

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# if you uncomment "/*" for C/REXX below, also uncomment this entry
#0	string		/*\ XPM\ */	X pixmap image data

# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
#0	string		/*		C or REXX program text
0	string		//		C++ program text

#------------------------------------------------------------------------------
# chi:  file(1) magic for ChiWriter files
#
0       string          \\1cw\          ChiWriter file
>5      string          >\0             version %s
0       string          \\1cw           ChiWriter file

#------------------------------------------------------------------------------
# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
# >18	short		!074000,000000	C1 R1 
# >18	short		!074000,004000	C2 R1
# >18	short		!074000,010000	C3 R1
# >18	short		!074000,074000	TEST
#
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# >18	short&074000	000000		C1 R1 
# >18	short&074000	004000		C2 R1
# >18	short&074000	010000		C3 R1
# >18	short&074000	074000		TEST
#
# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
# sort, nor does SunOS 4.x, so either it's something Intergraph added
# in CLIX, or something AT&T added in SVR3.2 or later, or something
# somebody else thought was a good idea; it's not documented in the
# man page for this version of "magic", nor does it appear to be
# implemented (at least not after I blew off the bogus code to turn
# old-style "&"s into new-style "&"s, which just didn't work at all).
#
0	short		0575		CLIPPER COFF executable (VAX #)
>20	short		0407		(impure)
>20	short		0410		(5.2 compatible)
>20	short		0411		(pure)
>20	short		0413		(demand paged)
>20	short		0443		(target shared library)
>12	long		>0		not stripped
>22	short		>0		- version %ld
0	short		0577		CLIPPER COFF executable
>18	short&074000	000000		C1 R1 
>18	short&074000	004000		C2 R1
>18	short&074000	010000		C3 R1
>18	short&074000	074000		TEST
>20	short		0407		(impure)
>20	short		0410		(pure)
>20	short		0411		(separate I&D)
>20	short		0413		(paged)
>20	short		0443		(target shared library)
>12	long		>0		not stripped
>22	short		>0		- version %ld
>48	long&01		01		alignment trap enabled
>52	byte		1		-Ctnc
>52	byte		2		-Ctsw
>52	byte		3		-Ctpw
>52	byte		4		-Ctcb
>53	byte		1		-Cdnc
>53	byte		2		-Cdsw
>53	byte		3		-Cdpw
>53	byte		4		-Cdcb
>54	byte		1		-Csnc
>54	byte		2		-Cssw
>54	byte		3		-Cspw
>54	byte		4		-Cscb
4	string		pipe		CLIPPER instruction trace
4	string		prof		CLIPPER instruction profile

#------------------------------------------------------------------------------
# commands:  file(1) magic for various shells and interpreters
#
0	string		:\ shell archive or commands for antique kernel text
0	string		#!/bin/sh		Bourne shell script text
0	string		#!\ /bin/sh		Bourne shell script text
0	string		#!/bin/csh		C shell script text
0	string		#!\ /bin/csh		C shell script text
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0	string		#!/bin/ksh		Korn shell script text
0	string		#!\ /bin/ksh		Korn shell script text
0	string	 	#!/bin/tcsh		Tenex C shell script text
0	string	 	#!\ /bin/tcsh		Tenex C shell script text
0	string		#!/usr/local/tcsh	Tenex C shell script text
0	string	 	#!\ /usr/local/tcsh	Tenex C shell script text
0	string		#!/usr/local/bin/tcsh	Tenex C shell script text
0	string		#!\ /usr/local/bin/tcsh	Tenex C shell script text
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0	string		#!/usr/local/bin/zsh	Paul Falstad's zsh
0	string		#!\ /usr/local/bin/zsh	Paul Falstad's zsh
0	string		#!/usr/local/bin/ash	Neil Brown's ash
0	string		#!\ /usr/local/bin/ash	Neil Brown's ash
0	string		#!/usr/local/bin/ae	Neil Brown's ae
0	string		#!\ /usr/local/bin/ae	Neil Brown's ae
0	string		#!/bin/nawk		new awk script text
0	string		#!\ /bin/nawk		new awk script text
0	string		#!/usr/bin/nawk		new awk script text
0	string		#!\ /usr/bin/nawk	new awk script text
0	string		#!/usr/local/bin/nawk	new awk script text
0	string		#!\ /usr/local/bin/nawk	new awk script text
0	string		#!/bin/gawk		GNU awk script text
0	string		#!\ /bin/gawk		GNU awk script text
0	string		#!/usr/bin/gawk		GNU awk script text
0	string		#!\ /usr/bin/gawk	GNU awk script text
0	string		#!/usr/local/bin/gawk	GNU awk script text
0	string		#!\ /usr/local/bin/gawk	GNU awk script text
#
0	string		#!/bin/awk		awk commands text
0	string		#!\ /bin/awk		awk commands text
0	string		#!/usr/bin/awk		awk commands text
0	string		#!\ /usr/bin/awk	awk commands text
0	string		BEGIN			awk commands text

# For Larry Wall's perl language.  The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
#				Keith Waclena <keith@cerberus.uchicago.edu>
0	string		#!/bin/perl			perl commands text
0	string		#!\ /bin/perl			perl commands text
0	string		eval\ "exec\ /bin/perl		perl commands text
0	string		#!/usr/bin/perl			perl commands text
0	string		#!\ /usr/bin/perl		perl commands text
0	string		eval\ "exec\ /usr/bin/perl	perl commands text
0	string		#!/usr/local/bin/perl		perl commands text
0	string		#!\ /usr/local/bin/perl		perl commands text
0	string		eval\ "exec\ /usr/local/bin/perl	perl commands text

# AT&T Bell Labs' Plan 9 shell
0	string		#!/bin/rc	Plan 9 rc shell script text
0	string		#!\ /bin/rc	Plan 9 rc shell script text

# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0	string		#!/bin/bash	Bourne-Again shell script text
0	string		#!\ /bin/bash	Bourne-Again shell script text
0	string		#!/usr/local/bin/bash	Bourne-Again shell script text
0	string		#!\ /usr/local/bin/bash	Bourne-Again shell script text

# generic shell magic
0	string		#!\ /			a
>3	string		>\0			%s script text
0	string		#!/			a
>2	string		>\0			%s script text
0	string		#!\ 			commands text
>3	string		>\0			for %s

#------------------------------------------------------------------------------
# compress:  file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.

# standard unix compress
0	string		\037\235	compress'd data
>2	byte&0x80	>0		block compressed
>2	byte&0x1f	x		%d bits

# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
0       string          \037\213        gzip compressed data
>2      byte            <8              \b, reserved method,
>2      byte            8               \b, deflated,
>3	byte		&0x01		ASCII,
>3	byte		&0x02		continuation,
>3	byte		&0x04		extra field,
>3	byte		&0x08		original filename,
>3	byte		&0x10		comment,
>3	byte		&0x20		encrypted,
>4	ledate		x		last modified: %s,
>8	byte		2		max compression,
>8	byte		4		max speed,
>9	byte		=0x00		os: MS-DOS
>9	byte		=0x01		os: Amiga
>9	byte		=0x02		os: VMS
>9	byte		=0x03		os: Unix
>9	byte		=0x05		os: Atari
>9	byte		=0x06		os: OS/2
>9	byte		=0x07		os: MacOS
>9	byte		=0x0A		os: Tops/20
>9	byte		=0x0B		os: Win/32

# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0	string		\037\036	packed data
>2	belong		>1		\b, %d characters originally
>2	belong		=1		\b, %d character originally
#
# This magic number is byte-order-independent.  XXX - Does that mean this
# is big-endian, little-endian, either, or that you can't tell?
# this short is valid for SunOS
0	short		017437		old packed data

# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0	short		0x1fff		compacted data
# This string is valid for SunOS (BE) and a matching "short" is listed
# in the Ultrix (LE) magic file.
0	string		\377\037	compacted data
0	short		0145405		huf output

# Squeeze and Crunch...
# These numbers were gleaned from the Unix versions of the programs to
# handle these formats.  Note that I can only uncrunch, not crunch, and
# I didn't have a crunched file handy, so the crunch number is untested.
#				Keith Waclena <keith@cerberus.uchicago.edu>
0	leshort		0x76FF		squeezed data (CP/M, DOS)
0	leshort		0x76FE		crunched data (CP/M, DOS)

# Freeze
0	string		\037\237	frozen file 2.1
0	string		\037\236	frozen file 1.0 (or gzip 0.5)

# SCO compress -H (LZH)
0	string		\037\240	SCO compress -H (LZH) data

# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# There's only a magic nibble (4 bits); that nibble repeats every 33
# bytes.  This isn't suited for use, but maybe we can use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0	byte&0xF0	0xd0		data
#>33	byte&0xF0	0xd0
#>66	byte&0xF0	0xd0
#>99	byte&0xF0	0xd0
#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio

# Bzip from ulmo@Q.Net
0	string		BZ		bzip compressed	data,
>2	byte		x		format v. %c,
>3	byte		x		block size indicator %c

#	$OpenBSD: convex,v 1.3 2001/01/29 01:57:57 niklas Exp $

#------------------------------------------------------------------------------
# convex:  file(1) magic for Convex boxes
#
# Convexes are big-endian.
#
# /*\
#  * Below are the magic numbers and tests added for Convex.
#  * Added at beginning, because they are expected to be used most.
# \*/
0	belong	0507	Convex old-style object
>16	belong	>0	not stripped
0	belong	0513	Convex old-style demand paged executable
>16	belong	>0	not stripped
0	belong	0515	Convex old-style pre-paged executable
>16	belong	>0	not stripped
0	belong	0517	Convex old-style pre-paged, non-swapped executable
>16	belong	>0	not stripped
0	belong	0x011257	Core file
#
# The following are a series of dump format magic numbers.  Each one
# corresponds to a drastically different dump format.  The first on is
# the original dump format on a 4.1 BSD or earlier file system.  The
# second marks the change between the 4.1 file system and the 4.2 file
# system.  The Third marks the changing of the block size from 1K
# to 2K to be compatible with an IDC file system.  The fourth indicates
# a dump that is dependent on Convex Storage Manager, because data in
# secondary storage is not physically contained within the dump.
# The restore program uses these number to determine how the data is
# to be extracted.
#
24	belong	=60011	dump format, 4.1 BSD or earlier
24	belong	=60012	dump format, 4.2 or 4.3 BSD without IDC
24	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
24	belong	=60014	dump format, Convex Storage Manager by-reference dump
#
# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
# If there is no `=' sign, assume just checking for whether the bit is set?
#
0	belong	0601		Convex SOFF
>88	belong&0x000f0000	=0x00000000	c1
>88	belong			&0x00010000	c2
>88	belong			&0x00020000	c2mp
>88	belong			&0x00040000	parallel
>88	belong			&0x00080000	intrinsic
>88	belong			&0x00000001	demand paged
>88	belong			&0x00000002	pre-paged
>88	belong			&0x00000004	non-swapped
>88	belong			&0x00000008	POSIX
#
>84	belong			&0x80000000	executable
>84	belong			&0x40000000	object
>84	belong&0x20000000	=0		not stripped
>84	belong&0x18000000	=0x00000000	native fpmode
>84	belong&0x18000000	=0x10000000	ieee fpmode
>84	belong&0x18000000	=0x18000000	undefined fpmode
#
0	belong			0605		Convex SOFF core
#
0	belong			0607		Convex SOFF checkpoint
>88	belong&0x000f0000	=0x00000000	c1
>88	belong			&0x00010000	c2
>88	belong			&0x00020000	c2mp
>88	belong			&0x00040000	parallel
>88	belong			&0x00080000	intrinsic
>88	belong			&0x00000008	POSIX
#
>84	belong&0x18000000	=0x00000000	native fpmode
>84	belong&0x18000000	=0x10000000	ieee fpmode
>84	belong&0x18000000	=0x18000000	undefined fpmode

#------------------------------------------------------------------------------
# database:  file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
#
# GDBM magic numbers
#  Will be maintained as part of the GDBM distribution in the future.
#  <downsj@teeny.org>
0	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian
0	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian
0	string	GDBM		GNU dbm 2.x database
#
0	belong	0x061561	Berkeley DB Hash file
>4	belong	>0		(Version %d,
>8	belong	1234		Little Endian,
>8	belong	4321		Big Endian,
>12	belong	x		Bucket Size %d,
>16	belong	x		Bucket Shift %d,
>20	belong	x		Directory Size %d,
>24	belong	x		Segment Size %d,
>28	belong	x		Segment Shift %d,
>32	belong	x		Overflow Point %d,
>36	belong	x		Last Freed %d,
>40	belong	x		Max Bucket %d,
>44	belong	x		High Mask 0x%x,
>48	belong	x		Low Mask 0x%x,
>52	belong	x		Fill Factor %d,
>56	belong	x		Number of Keys %d)
#
#
0	belong	0x053162	Berkeley DB Btree file
>4	belong	>0		(Version %d,
>8	belong	x		Page Size %d,
>12	belong	x		Free Page %d,
>16	belong	x		Number of Records %d,
>20	belong	x		Flags 0x%x)

#------------------------------------------------------------------------------
# diamond:  file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
# XXX - I think it was either renamed Slate, or replaced by Slate....
#
#	The full deal is too long...
#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
0	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document

#------------------------------------------------------------------------------
# diff:  file(1) magic for diff(1) output
#
0	string		diff\ 	'diff' output text
0	string		***\ 		'diff' output text
0	string		Only\ in\ 	'diff' output text
0	string		Common\ subdirectories:\ 	'diff' output text
#	$OpenBSD: digital,v 1.2 2001/01/29 01:57:57 niklas Exp $

#  Digital UNIX - Info
#
0	string	!<arch>\n________64E	Alpha archive
>22	string	X			-- out of date
#
# Alpha COFF Based Executables
# The stripped stuff really needs to be an 8 byte (64 bit) compare,
# but this works
0	leshort		0x183		COFF format alpha
>22	leshort&020000	&010000		sharable library,
>22	leshort&020000	^010000		dynamically linked,
>24	leshort		0410		pure
>24	leshort		0413		demand paged
>8	lelong		>0		executable or object module, not stripped
>8	lelong		0
>>12	lelong		0		executable or object module, stripped
>>12	lelong		>0		executable or object module, not stripped
>27     byte            >0              - version %d.
>26     byte            >0              %d-
>28     leshort         >0              %d
#
# The next is incomplete, we could tell more about this format,
# but its not worth it.
0	leshort		0x188	Alpha compressed COFF
0	leshort		0x18f	Alpha u-code object
#
#
# Some other interesting Digital formats,
0	string	\377\377\177		ddis/ddif
0	string	\377\377\174		ddis/dots archive
0	string	\377\377\176		ddis/dtif table data
0	string	\033c\033		LN03 output
0	long	04553207		X image
#
0	string	!<PDF>!\n		profiling data file
#
# Locale data tables (MIPS and Alpha).
#
0	short		0x0501		locale data table
>6	short		0x24		for MIPS
>6	short		0x40		for Alpha

#------------------------------------------------------------------------------
# dump:  file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
24	belong	60012		new-fs dump file (big endian),
>4	bedate	x		Previous dump %s,
>8	bedate	x		This dump %s,
>12	belong	>0		Volume %ld,
>692	belong	0		Level zero, type:
>692	belong	>0		Level %d, type:
>0	belong	1		tape header,
>0	belong	2		beginning of file record,
>0	belong	3		map of inodes on tape,
>0	belong	4		continuation of file record,
>0	belong	5		end of volume,
>0	belong	6		map of inodes deleted,
>0	belong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	belong	>0		Flags %x

24	belong	60011		old-fs dump file (big endian),
#>4	bedate	x		Previous dump %s,
#>8	bedate	x		This dump %s,
>12	belong	>0		Volume %ld,
>692	belong	0		Level zero, type:
>692	belong	>0		Level %d, type:
>0	belong	1		tape header,
>0	belong	2		beginning of file record,
>0	belong	3		map of inodes on tape,
>0	belong	4		continuation of file record,
>0	belong	5		end of volume,
>0	belong	6		map of inodes deleted,
>0	belong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	belong	>0		Flags %x

24	lelong	60012		new-fs dump file (little endian),
>4	ledate	x		This dump %s,
>8	ledate	x		Previous dump %s,
>12	lelong	>0		Volume %ld,
>692	lelong	0		Level zero, type:
>692	lelong	>0		Level %d, type:
>0	lelong	1		tape header,
>0	lelong	2		beginning of file record,
>0	lelong	3		map of inodes on tape,
>0	lelong	4		continuation of file record,
>0	lelong	5		end of volume,
>0	lelong	6		map of inodes deleted,
>0	lelong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	lelong	>0		Flags %x

24	lelong	60011		old-fs dump file (little endian),
#>4	ledate	x		Previous dump %s,
#>8	ledate	x		This dump %s,
>12	lelong	>0		Volume %ld,
>692	lelong	0		Level zero, type:
>692	lelong	>0		Level %d, type:
>0	lelong	1		tape header,
>0	lelong	2		beginning of file record,
>0	lelong	3		map of inodes on tape,
>0	lelong	4		continuation of file record,
>0	lelong	5		end of volume,
>0	lelong	6		map of inodes deleted,
>0	lelong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	lelong	>0		Flags %x

#------------------------------------------------------------------------------
# elf:  file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# MIPS RS3000 may also be for MIPS RS2000.
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\177ELF		ELF
>4	byte		0		invalid class
>4	byte		1		32-bit
>4	byte		2		64-bit
>5	byte		0		invalid byte order
>5	byte		1		LSB
>>16	leshort		0		no file type,
>>16	leshort		1		relocatable,
>>16	leshort		2		executable,
>>16	leshort		3		shared object,
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
>>16	leshort		4		core file
>>>400  lelong          >0              (signal %d),
>>16	leshort		&0xff00		processor-specific,
>>18	leshort		0		no machine,
>>18	leshort		1		AT&T WE32100 - invalid byte order,
>>18	leshort		2		SPARC - invalid byte order,
>>18	leshort		3		Intel 80386,
>>18	leshort		4		Motorola 68000 - invalid byte order,
>>18	leshort		5		Motorola 88000 - invalid byte order,
>>18	leshort		6		Intel 80486,
>>18	leshort		7		Intel 80860,
>>18	leshort		8		MIPS RS3000_BE - invalid byte order,
>>18	leshort		9		Amdahl - invalid byte order,
>>18	leshort		10		MIPS RS3000_LE,
>>18	leshort		11		RS6000 - invalid byte order,
>>18	leshort		15		PA-RISC - invalid byte order,
>>18	leshort		16		nCUBE,
>>18	leshort		17		VPP500,
>>18	leshort		18		SPARC32PLUS,
>>18	leshort		20		PowerPC,
>>18	leshort		75		VAX,
>>18	leshort		0x9026		Alpha,
>>20	lelong		0		invalid version
>>20	lelong		1		version 1
>>36	lelong		1		MathCoPro/FPU/MAU Required
>5	byte		2		MSB
>>16	beshort		0		no file type,
>>16	beshort		1		relocatable,
>>16	beshort		2		executable,
>>16	beshort		3		shared object,
>>16	beshort		4		core file,
>>>400	lelong		>0		(signal %d),
>>16	beshort		&0xff00		processor-specific,
>>18	beshort		0		no machine,
>>18	beshort		1		AT&T WE32100,
>>18	beshort		2		SPARC,
>>18	beshort		3		Intel 80386 - invalid byte order,
>>18	beshort		4		Motorola 68000,
>>18	beshort		5		Motorola 88000,
>>18	beshort		6		Intel 80486 - invalid byte order,
>>18	beshort		7		Intel 80860,
>>18	beshort		8		MIPS RS3000_BE,
>>18	beshort		9		Amdahl,
>>18	beshort		10		MIPS RS3000_LE - invalid byte order,
>>18	beshort		11		RS6000,
>>18	beshort		15		PA-RISC,
>>18	beshort		16		nCUBE,
>>18	beshort		17		VPP500,
>>18	beshort		18		SPARC32PLUS,
>>18	beshort		20		PowerPC,
>>18	beshort		75		VAX - invalid byte order,
>>18	beshort		0x9026		Alpha,
>>20	belong		0		invalid version
>>20	belong		1		version 1
>>36	belong		1		MathCoPro/FPU/MAU Required

#------------------------------------------------------------------------------
# encore:  file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
#
0	short		0x154		Encore
>20	short		0x107		executable
>20	short		0x108		pure executable
>20	short		0x10b		demand-paged executable
>20	short		0x10f		unsupported executable
>12	long		>0		not stripped
>22	short		>0		- version %ld
>22	short		0		-
#>4	date		x		stamp %s
0	short		0x155		Encore unsupported executable
>12	long		>0		not stripped
>22	short		>0		- version %ld
>22	short		0		-
#>4	date		x		stamp %s

#------------------------------------------------------------------------------
# filesystems:  file(1) magic for different filesystems
#
0x438	leshort	0xEF53			Linux/i386 ext2 filesystem
0	string	\366\366\366\366	PC formatted floppy with no filesystem

#------------------------------------------------------------------------------
# fonts:  file(1) magic for font data
#
0	string		FONT		ASCII vfont text
0	short		0436		Berkeley vfont data
0	short		017001		byte-swapped Berkeley vfont data

# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
0	string		%!PS-AdobeFont-1.0	PostScript Type 1 font text
>20	string		>\0			(%s)
6	string		%!PS-AdobeFont-1.0	PostScript Type 1 font program data

# X11 font files in SNF (Server Natural Format) format
0	belong		00000004		X11 SNF font data, MSB first
0	lelong		00000004		X11 SNF font data, LSB first

# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		STARTFONT\040		X11 BDF font text

# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
0	string		\001fcp			X11 Portable Compiled Font data
>12	byte		0x02			\b, LSB first
>12	byte		0x0a			\b, MSB first
0	string		D1.0\015		X11 Speedo font data

#------------------------------------------------------------------------------
# frame:  file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0	string		\<MakerFile	FrameMaker document
>11	string		4.0		 (4.0
>11	string		3.0		 (3.0
>11	string		2.0		 (2.0
>11	string		1.0		 (1.0
>14	byte		x		  %c)
0	string		\<MIFFile	FrameMaker MIF (ASCII) file
>9	string		4.0		 (4.0)
>9	string		3.0		 (3.0)
>9	string		2.0		 (2.0)
>9	string		1.0		 (1.x)
0	string		\<MakerDictionary	FrameMaker Dictionary text
>17	string		3.0		 (3.0)
>17	string		2.0		 (2.0)
>17	string		1.0		 (1.x)
0	string		\<MakerScreenFont	FrameMaker Font file
>17	string		1.01		 (%s)
0	string		\<MML		FrameMaker MML file
0	string		\<BookFile	FrameMaker Book file
>10	string		3.0		 (3.0
>10	string		2.0		 (2.0
>10	string		1.0		 (1.0
>13	byte		x		  %c)
# XXX - this book entry should be verified, if you find one, uncomment this
#0	string		\<Book\ 	FrameMaker Book (ASCII) file
#>6	string		3.0		 (3.0)
#>6	string		2.0		 (2.0)
#>6	string		1.0		 (1.0)
0	string		\<Maker	Intermediate Print File	FrameMaker IPL file

#------------------------------------------------------------------------------
# freebsd:  file(1) magic for FreeBSD objects
#
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
# little-endian on x86).
#
# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
# schemes for distinguishing between executable images, shared libraries,
# and object files.
#
# FreeBSD says:
#
#    Regardless of whether it's pure, demand-paged, or none of the
#    above:
#
#	if the entry point is < 4096, then it's a shared library if
#	the "has run-time loader information" bit is set, and is
#	position-independent if the "is position-independent" bit
#	is set;
#
#	if the entry point is >= 4096 (or >4095, same thing), then it's
#	an executable, and is dynamically-linked if the "has run-time
#	loader information" bit is set.
#
# On x86, NetBSD says:
#
#    If it's neither pure nor demand-paged:
#
#	if it has the "has run-time loader information" bit set, it's
#	a dynamically-linked executable;
#
#	if it doesn't have that bit set, then:
#
#	    if it has the "is position-independent" bit set, it's
#	    position-independent;
#
#	    if the entry point is non-zero, it's an executable, otherwise
#	    it's an object file.
#
#    If it's pure:
#
#	if it has the "has run-time loader information" bit set, it's
#	a dynamically-linked executable, otherwise it's just an
#	executable.
#
#    If it's demand-paged:
#
#	if it has the "has run-time loader information" bit set,
#	then:
#
#	    if the entry point is < 4096, it's a shared library;
#
#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
#	    it's a dynamically-linked executable);
#
#	if it doesn't have the "has run-time loader information" bit
#	set, then it's just an executable.
#
# (On non-x86, NetBSD does much the same thing, except that it uses
# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
# had 8K pages; dunno about MIPS.)
#
# I suspect the two will differ only in perverse and uninteresting cases
# ("shared" libraries that aren't demand-paged and whose pages probably
# won't actually be shared, executables with entry points <4096).
#
# I leave it to those more familiar with FreeBSD and NetBSD to figure out
# what the right answer is (although using ">4095", FreeBSD-style, is
# probably better than separately checking for "=4096" and ">4096",
# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
# executables using the NetBSD technique.)
#
0	lelong&0377777777	041400407	FreeBSD/i386
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400410	FreeBSD/i386 pure
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400413	FreeBSD/i386 demand paged
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

# XXX gross hack to identify core files
# cores start with a struct tss; we take advantage of the following:
# byte 7:     highest byte of the kernel stack pointer, always 0xfe
#      8/9:   kernel (ring 0) ss value, always 0x0010
#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
#      28:    low order byte of the current PTD entry, always 0 since the
#             PTD is page-aligned
#
7	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
>1039	string	>\0	from '%s'

# /var/run/ld.so.hints
# What are you laughing about?
0	lelong			011421044151	ld.so hints file
>4	lelong			>0		(version %d)

#------------------------------------------------------------------------------
# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
# big-endian as it was mostly 68K-based.
#
# I think the 500 series was the old stack-based machines, running a
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
# HP magic is useful for reference, but using "long" magic is a better
# practice in order to avoid collisions.
#
# Guy Harris (guy@netapp.com): some additions to this list came from
# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
# "/etc/magic", though, except for the "archive file relocatable library"
# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
# used in executables, or have they just not yet updated "/etc/magic"
# completely?
#
# 0	beshort		200		hp200 (68010) BSD binary
# 0	beshort		300		hp300 (68020+68881) BSD binary
# 0	beshort		0x20c		hp200/300 HP-UX binary
# 0	beshort		0x20d		hp400 (68030) HP-UX binary
# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
# 0	beshort		0x214		PA-RISC2.0 HP-UX binary

#
# The "misc" stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0	beshort		0627		Apollo m68k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0	beshort		0624		apollo a88k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0       long            01203604016     TML 0123 byte-order format
0       long            01702407010     TML 1032 byte-order format
0       long            01003405017     TML 2301 byte-order format
0       long            01602007412     TML 3210 byte-order format
#### PA-RISC
0	belong 		0x02100106	PA-RISC1.1 relocatable object
0	belong 		0x02100107	PA-RISC1.1 executable
>168	belong		&=0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x02100108	PA-RISC1.1 shared executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x0210010b	PA-RISC1.1 demand-load executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x0210010e	PA-RISC1.1 shared library
>96	belong		>0		- not stripped

0	belong 		0x0210010d	PA-RISC1.1 dynamic load library
>96	belong		>0		- not stripped

#### 800
0	belong 		0x020b0106	PA-RISC1.0 relocatable object

0	belong 		0x020b0107	PA-RISC1.0 executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b0108	PA-RISC1.0 shared executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b010b	PA-RISC1.0 demand-load executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b010e	PA-RISC1.0 shared library
>96	belong		>0		- not stripped

0	belong 		0x020b010d	PA-RISC1.0 dynamic load library
>96	belong		>0		- not stripped

0	belong		0x213c6172	archive file
>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
>68	belong 		0x02140619	- PA-RISC2.0 relocatable library

#### 500
0	long		0x02080106	HP s500 relocatable executable
>16	long		>0		- version %ld

0	long		0x02080107	HP s500 executable
>16	long		>0		- version %ld

0	long		0x02080108	HP s500 pure executable
>16	long		>0		- version %ld

#### 200
0	belong 		0x020c0108	HP s200 pure executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0107	HP s200 executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c010b	HP s200 demand-load executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0106	HP s200 relocatable executable
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>8	belong		&0x80000000	save fp regs
>8	belong		&0x20000000	debuggable
>8	belong		&0x10000000	PIC

0	belong 		0x020a0108	HP s200 (2.x release) pure executable
>4	beshort		>0		- version %ld
>36	belong		>0		not stripped

0	belong		0x020a0107	HP s200 (2.x release) executable
>4	beshort		>0		- version %ld
>36	belong		>0		not stripped

0	belong		0x020c010e	HP s200 shared library
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>36	belong		>0		not stripped

0	belong		0x020c010d	HP s200 dynamic load library
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>36	belong		>0		not stripped

#### MISC
0	long		0x0000ff65	HP old archive
0	long		0x020aff65	HP s200 old archive
0	long		0x020cff65	HP s200 old archive
0	long		0x0208ff65	HP s500 old archive

0	long		0x015821a6	HP core file

0	long		0x4da7eee8	HP-WINDOWS font
>8	byte		>0		- version %ld
0	string		Bitmapfile	HP Bitmapfile

0	string		IMGfile	CIS 	compimg HP Bitmapfile
# XXX - see "lif"
#0	beshort		0x8000		lif file
0	long		0x020c010c	compiled Lisp

0	string		msgcat01	HP NLS message catalog,
>8	long		>0		%d messages

# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
0	string		HPHP48-		HP48 binary
>7	byte		>0		- Rev %c
>8	short		0x1129		(ADR)
>8	short		0x3329		(REAL)
>8	short		0x5529		(LREAL)
>8	short		0x7729		(COMPLX)
>8	short		0x9d29		(LCOMPLX)
>8	short		0xbf29		(CHAR)
>8	short		0xe829		(ARRAY)
>8	short		0x0a2a		(LNKARRAY)
>8	short		0x2c2a		(STRING)
>8	short		0x4e2a		(HXS)
>8	short		0x742a		(LIST)
>8	short		0x962a		(DIR)
>8	short		0xb82a		(ALG)
>8	short		0xda2a		(UNIT)
>8	short		0xfc2a		(TAGGED)
>8	short		0x1e2b		(GROB)
>8	short		0x402b		(LIB)
>8	short		0x622b		(BACKUP)
>8	short		0x882b		(LIBDATA)
>8	short		0x9d2d		(PROG)
>8	short		0xcc2d		(CODE)
>8	short		0x482e		(GNAME)
>8	short		0x6d2e		(LNAME)
>8	short		0x922e		(XLIB)
0	string		%%HP:		HP48 text
>6	string		T(0)		- T(0)
>6	string		T(1)		- T(1)
>6	string		T(2)		- T(2)
>6	string		T(3)		- T(3)
>10	string		A(D)		A(D)
>10	string		A(R)		A(R)
>10	string		A(G)		A(G)
>14	string		F(.)		F(.);
>14	string		F(,)		F(,);

# hpBSD magic numbers
0	beshort		200		hp200 (68010) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary
0	beshort		300		hp300 (68020+68881) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary


#------------------------------------------------------------------------------
# ibm370:  file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
# AIX 4.1's "/etc/magic" has
#
#	0	short		0535		370 sysV executable 
#	>12	long		>0		not stripped
#	>22	short		>0		- version %d
#	>30	long		>0		- 5.2 format
#	0	short		0530		370 sysV pure executable 
#	>12	long		>0		not stripped
#	>22	short		>0		- version %d
#	>30	long		>0		- 5.2 format
#
# instead of the "USS/370" versions of the same magic numbers.
#
0	beshort		0537		370 XA sysV executable 
>12	belong		>0		not stripped
>22	beshort		>0		- version %d
>30	belong		>0		- 5.2 format
0	beshort		0532		370 XA sysV pure executable 
>12	belong		>0		not stripped
>22	beshort		>0		- version %d
>30	belong		>0		- 5.2 format
0	beshort		054001		370 sysV pure executable
>12	belong		>0		not stripped
0	beshort		055001		370 XA sysV pure executable
>12	belong		>0		not stripped
0	beshort		056401		370 sysV executable
>12	belong		>0		not stripped
0	beshort		057401		370 XA sysV executable
>12	belong		>0		not stripped
0       beshort		0531		SVR2 executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24     belong		>0		- version %ld
0	beshort		0534		SVR2 pure executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0530		SVR2 pure executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0535		SVR2 executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld

#------------------------------------------------------------------------------
# ibm6000:  file(1) magic for RS/6000 and the RT PC.
#
0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
>12	belong		>0		not stripped
# Breaks sun4 statically linked execs.
#0      beshort		0x0103		executable (RT Version 2) or obj module
#>2	byte		0x50		pure
#>28	belong		>0		not stripped
#>6	beshort		>0		- version %ld
0	beshort		0x0104		shared library
0	beshort		0x0105		ctab data
0	beshort		0xfe04		structured file
0	string		0xabcdef	AIX message catalog
0	belong		0x000001f9	AIX compiled message catalog
0	string		\<aiaff>	archive

#------------------------------------------------------------------------------
# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
# Arts for file interchange.  It has also been used by Apple, SGI, and
# especially Commodore-Amiga.
#
# IFF files begin with an 8 byte FORM header, followed by a 4 character
# FORM type, which is followed by the first chunk in the FORM.

0	string		FORM		IFF data
#>4	belong		x		\b, FORM is %d bytes long
# audio formats
>8	string		AIFF		\b, AIFF audio
>8	string		AIFC		\b, AIFF-C compressed audio
>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
>8	string		SAMP		\b, SAMP sampled audio
# image formats
>8	string		ILBMBMHD	\b, ILBM interleaved image
>>20	beshort		x		\b, %d x
>>22	beshort		x		%d
>8	string		RGBN		\b, RGBN 12-bit RGB image
>8	string		RGB8		\b, RGB8 24-bit RGB image
>8	string		DR2D		\b, DR2D 2-D object
>8	string		TDDD		\b, TDDD 3-D rendering
# other formats
>8	string		FTXT		\b, FTXT formatted text

#------------------------------------------------------------------------------
# images:  file(1) magic for image formats (see also "iff")
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# little magic: PCX (first byte is 0x0a)
# no magic: Targa

# PBMPLUS images
# The next byte following the magic is always whitespace.
0	string		P1		PBM image text
0	string		P2		PGM image text
0	string		P3		PPM image text
0	string		P4		PBM "rawbits" image data
0	string		P5		PGM "rawbits" image data
0	string		P6		PPM "rawbits" image data

# NIFF (Navy Interchange File Format, a modification of TIFF) images
0	string		IIN1		NIFF image data

# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
# The second word of TIFF files is the TIFF version number, 42, which has
# never changed.  The TIFF specification recommends testing for it.
0	string		MM\x00\x2a	TIFF image data, big-endian
0	string		II\x2a\x00	TIFF image data, little-endian

# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt@uchicago.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
#
0	string		\x89PNG		PNG image data,
>4	belong		!0x0d0a1a0a	CORRUPTED,
>16	belong		x		%ld x
>20	belong		x		%ld,
>24	byte		x		%d-bit
>25	byte		0		grayscale,
>25	byte		2		\b/color RGB,
>25	byte		3		colormap,
>25	byte		4		gray+alpha,
>25	byte		6		\b/color RGBA,
#>26	byte		0		deflate/32K,
>28	byte		0		non-interlaced
>28	byte		1		interlaced

# GIF
0	string		GIF8		GIF image data
>4	string		7a		\b, version 8%s,
>4	string		9a		\b, version 8%s,
>6	leshort		>0		%hd x
>8	leshort		>0		%hd,
#>10	byte		&0x80		color mapped,
#>10	byte&0x07	=0x00		2 colors
#>10	byte&0x07	=0x01		4 colors
#>10	byte&0x07	=0x02		8 colors
#>10	byte&0x07	=0x03		16 colors
#>10	byte&0x07	=0x04		32 colors
#>10	byte&0x07	=0x05		64 colors
#>10	byte&0x07	=0x06		128 colors
#>10	byte&0x07	=0x07		256 colors

# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
# 1 plane, no encoding.
0	string		\361\0\100\273	CMU window manager raster image data
>4	lelong		>0		%d x
>8	lelong		>0		%d,
>12	lelong		>0		%d-bit

# Magick Image File Format
0	string		id=ImageMagick	MIFF image data

# Artisan
0	long		1123028772	Artisan image data
>4	long		1		\b, rectangular 24-bit
>4	long		2		\b, rectangular 8-bit with colormap
>4	long		3		\b, rectangular 32-bit (24-bit with matte)

# FIG (Facility for Interactive Generation of figures), an object-based format
0	string		#FIG		FIG image text
>5	string		x		\b, version %.3s

# PHIGS
0	string		ARF_BEGARF		PHIGS clear text archive
0	string		@(#)SunPHIGS		SunPHIGS
# version number follows, in the form m.n
>40	string		SunBin			binary
>32	string		archive			archive

# GKS (Graphics Kernel System)
0	string		GKSM		GKS Metafile
>24	string		SunGKS		\b, SunGKS

# CGM image files
0	string		BEGMF		clear text Computer Graphics Metafile
# XXX - questionable magic
0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
0	beshort		0x3020		character Computer Graphics Metafile

# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
0	string	yz	MGR bitmap, modern format, 8-bit aligned
0	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
0	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
0	string	yx	MGR bitmap, modern format, squeezed

# Fuzzy Bitmap (FBM) images
0	string		%bitmap\0	FBM image data
>30	long		0x31		\b, mono
>30	long		0x33		\b, color

# facsimile data
1	string		PC\ Research,\ Inc	group 3 fax data
>29	byte		0		\b, normal resolution (204x98 DPI)
>29	byte		1		\b, fine resolution (204x196 DPI)

# JPEG images
# SunOS 5.5.1 had
#
#	0	string		\377\330\377\340	JPEG file
#	0	string		\377\330\377\356	JPG file
#
# both of which turn into "JPEG image data" here.
#
0	beshort		0xffd8		JPEG image data
>6	string		JFIF		\b, JFIF standard
# Contributed by wizdumb@leet.org
>24	string	Photoshop	\b, Made in Adobe Photoshop

# HSI is Handmade Software's proprietary JPEG encoding scheme
0	string		hsi1		JPEG image data, HSI proprietary

# PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
0	string		BM		PC bitmap data
>14	leshort		12		\b, OS/2 1.x format
>>18	leshort		x		\b, %d x
>>20	leshort		x		%d
>14	leshort		64		\b, OS/2 2.x format
>>18	leshort		x		\b, %d x
>>20	leshort		x		%d
>14	leshort		40		\b, Windows 3.x format
>>18	lelong		x		\b, %d x
>>22	lelong		x		%d x
>>28	leshort		x		%d
0	string		IC		PC icon data
0	string		PI		PC pointer image data
0	string		CI		PC color icon data
0	string		CP		PC color pointer image data
# Conflicts with other entries [BABYL]
#0	string		BA		PC bitmap array data

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# note possible collision with C/REXX entry in c-lang; currently commented out
0	string		/*\ XPM\ */	X pixmap image text

# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
0	leshort		0xcc52		RLE image data,
>6	leshort		x		%d x
>8	leshort		x		%d
>2	leshort		>0		\b, lower left corner: %d
>4	leshort		>0		\b, lower right corner: %d
>10	byte&0x1	=0x1		\b, clear first
>10	byte&0x2	=0x2		\b, no background
>10	byte&0x4	=0x4		\b, alpha channel
>10	byte&0x8	=0x8		\b, comment
>11	byte		>0		\b, %d color channels
>12	byte		>0		\b, %d bits per pixel
>13	byte		>0		\b, %d color map channels

# image file format (Robert Potter, potter@cs.rochester.edu)
0	string		Imagefile\ version-	iff image data
# this adds the whole header (inc. version number), informative but longish
>10	string		>\0		%s

# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
0	belong		0x59a66a95	Sun raster image data
>4	belong		>0		\b, %d x
>8	belong		>0		%d,
>12	belong		>0		%d-bit,
#>16	belong		>0		%d bytes long,
>20	belong		0		old format,
#>20	belong		1		standard,
>20	belong		2		compressed,
>20	belong		3		RGB,
>20	belong		4		TIFF,
>20	belong		5		IFF,
>20	belong		0xffff		reserved for testing,
>24	belong		0		no colormap
>24	belong		1		RGB colormap
>24	belong		2		raw colormap
#>28	belong		>0		colormap is %d bytes long

# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
# file://sgi.com/graphics/SGIIMAGESPEC
0	beshort		474		SGI image data
#>2	byte		0		\b, verbatim
>2	byte		1		\b, RLE
#>3	byte		1		\b, normal precision
>3	byte		2		\b, high precision
>4	beshort		x		\b, %d-D
>6	beshort		x		\b, %d x
>8	beshort		x		%d
>10	beshort		x		\b, %d channel
>10	beshort		!1		\bs
>80	string		>0		\b, "%s"

0	string		IT01		FIT image data
>4	belong		x		\b, %d x
>8	belong		x		%d x
>12	belong		x		%d
#
0	string		IT02		FIT image data
>4	belong		x		\b, %d x
>8	belong		x		%d x
>12	belong		x		%d
#
2048	string		PCD_IPI		Kodak Photo CD image pack file
0	string		PCD_OPA		Kodak Photo CD overview pack file

# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
# FITS is the Flexible Image Transport System, the de facto standard for
# data and image transfer, storage, etc., for the astronomical community.
# (FITS floating point formats are big-endian.)
0	string	SIMPLE\ \ =	FITS image data
>109	string	8		\b, 8-bit, character or unsigned binary integer
>108	string	16		\b, 16-bit, two's complement binary integer
>107	string	\ 32		\b, 32-bit, two's complement binary integer
>107	string	-32		\b, 32-bit, floating point, single precision
>107	string	-64		\b, 64-bit, floating point, double precision

# other images
0	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
0	string		!!		Bennet Yee's "face" format

# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
# stuff.
#
0	beshort		0x1010		PEX Binary Archive

#------------------------------------------------------------------------------
# intel:  file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
# Windows as well.
#
# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
# as well, if, as, and when IBM makes it portable.
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0	leshort		0502		basic-16 executable
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		0503		basic-16 executable (TV)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		0510		x86 executable
>12	lelong		>0		not stripped
0	leshort		0511		x86 executable (TV)
>12	lelong		>0		not stripped
0	leshort		=0512		iAPX 286 executable small model (COFF)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		=0522		iAPX 286 executable large model (COFF)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0	leshort		=0514		80386 COFF executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld

#------------------------------------------------------------------------------
# interleaf:  file(1) magic for InterLeaf TPS:
#
0	string		=\210OPS	Interleaf saved data
0	string		=<!OPS		Interleaf document text
>5	string		,\ Version\ =	\b, version
>>17	string		>\0		%.3s

#------------------------------------------------------------------------------
# ispell:  file(1) magic for ispell
#
# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
# will match 0x9600 through 0x9603 in *both* little endian and big endian.
# (No other current magic entries collide.)
#
# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
#
0	leshort&0xFFFC	0x9600		little endian ispell
>0	byte		0		hash file (?),
>0	byte		1		3.0 hash file,
>0	byte		2		3.1 hash file,
>0	byte		3		hash file (?),
>2	leshort		0x00		8-bit, no capitalization, 26 flags
>2	leshort		0x01		7-bit, no capitalization, 26 flags
>2	leshort		0x02		8-bit, capitalization, 26 flags
>2	leshort		0x03		7-bit, capitalization, 26 flags
>2	leshort		0x04		8-bit, no capitalization, 52 flags
>2	leshort		0x05		7-bit, no capitalization, 52 flags
>2	leshort		0x06		8-bit, capitalization, 52 flags
>2	leshort		0x07		7-bit, capitalization, 52 flags
>2	leshort		0x08		8-bit, no capitalization, 128 flags
>2	leshort		0x09		7-bit, no capitalization, 128 flags
>2	leshort		0x0A		8-bit, capitalization, 128 flags
>2	leshort		0x0B		7-bit, capitalization, 128 flags
>2	leshort		0x0C		8-bit, no capitalization, 256 flags
>2	leshort		0x0D		7-bit, no capitalization, 256 flags
>2	leshort		0x0E		8-bit, capitalization, 256 flags
>2	leshort		0x0F		7-bit, capitalization, 256 flags
>4	leshort		>0		and %d string characters
0	beshort&0xFFFC	0x9600		big endian ispell
>1	byte		0		hash file (?),
>1	byte		1		3.0 hash file,
>1	byte		2		3.1 hash file,
>1	byte		3		hash file (?),
>2	beshort		0x00		8-bit, no capitalization, 26 flags
>2	beshort		0x01		7-bit, no capitalization, 26 flags
>2	beshort		0x02		8-bit, capitalization, 26 flags
>2	beshort		0x03		7-bit, capitalization, 26 flags
>2	beshort		0x04		8-bit, no capitalization, 52 flags
>2	beshort		0x05		7-bit, no capitalization, 52 flags
>2	beshort		0x06		8-bit, capitalization, 52 flags
>2	beshort		0x07		7-bit, capitalization, 52 flags
>2	beshort		0x08		8-bit, no capitalization, 128 flags
>2	beshort		0x09		7-bit, no capitalization, 128 flags
>2	beshort		0x0A		8-bit, capitalization, 128 flags
>2	beshort		0x0B		7-bit, capitalization, 128 flags
>2	beshort		0x0C		8-bit, no capitalization, 256 flags
>2	beshort		0x0D		7-bit, no capitalization, 256 flags
>2	beshort		0x0E		8-bit, capitalization, 256 flags
>2	beshort		0x0F		7-bit, capitalization, 256 flags
>4	beshort		>0		and %d string characters
#	$OpenBSD: java,v 1.2 2001/01/29 01:57:57 niklas Exp $

#------------------------------------------------------------
# Java ByteCode
# From Larry Schwimmer (schwim@cs.stanford.edu)
0	belong		0xcafebabe
>4	belong		0x0003002d	Java bytecode

#------------------------------------------------------------------------------
# karma:  file(1) magic for Karma data files
#
# From <rgooch@atnf.csiro.au>

0	string		KarmaRHD Version	Karma Data Structure Version
>16	long		x		%lu

#------------------------------------------------------------------------------
# lex:  file(1) magic for lex
#
#	derived empirically, your offsets may vary!
53	string		yyprevious	C program text (from lex)
>3	string		>\0		 for %s
# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
21	string		generated\ by\ flex	C program text (from flex)
# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
0	string		%{		lex description text

#------------------------------------------------------------------------------
# lif:  file(1) magic for lif
#
# XXX - byte order?  (Probably beshort, Daniel Quinlan <quinlan@yggdrasil.com>)
#
0	beshort		0x8000		lif file

#------------------------------------------------------------------------------
# linux:  file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
# The following basic Linux magic is useful for reference, but using
# "long" magic is a better practice in order to avoid collisions.
#
# 2	leshort		100		Linux/i386
# >0	leshort		0407		impure executable (OMAGIC)
# >0	leshort		0410		pure executable (NMAGIC)
# >0	leshort		0413		demand-paged executable (ZMAGIC)
# >0	leshort		0314		demand-paged executable (QMAGIC)
#
0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
>16	lelong		0		\b, stripped
#
0	string		\007\001\000	Linux/i386 object file
>20	lelong		>0x1020		\b, DLL library
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0	string		*nazgul*	Linux compiled message catalog
>8	lelong		>0		\b, version %ld
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
216	lelong		0421		Linux/i386 core file
>220	string		>\0		of '%s'
>200	lelong		>0		(signal %d)
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
# this can be overridden by the DOS executable (COM) entry
2	string		LILO		Linux/i386 LILO boot/chain loader
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
0	string		0.9
>8	byte		0x0a		Debian Binary Package
>>3	byte		>0		\b, created by dpkg 0.9%c
>>4	byte		>0		pl%c
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
0	leshort		0x0436		Linux/i386 PC Screen Font data,
>2	byte		0		256 characters, no directory,
>2	byte		1		512 characters, no directory,
>2	byte		2		256 characters, Unicode directory,
>2	byte		3		512 characters, Unicode directory,
>3	byte		>0		8x%d
# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
4086	string		SWAP-SPACE	Linux/i386 swap file
# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
#
#	from Erik Troan (ewt@redhat.com) examining od dumps, so this
#		could be wrong
#      updated by David Mosberger (davidm@azstarnet.com) based on
#      GNU BFD and MIPS info found below.
#
0	leshort		0x0183		ECOFF alpha
>24	leshort		0407		executable
>24	leshort		0410		pure
>24	leshort		0413		demand paged
>8	long		>0		not stripped
>8	long		0		stripped
>23	leshort		>0		- version %ld.
# linux Kernel images version 1.3.80 - ?
# from Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
0       belong          0xb8c0078e      Linux/x86 kernel image,
>0x048c byte            0x31
>>0x048c string         x               version %s
>0x0493 byte            0x31
>>0x0493 string         x               version %s
#

#------------------------------------------------------------------------------
# lisp:  file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string	;;			Lisp/Scheme program text
# Emacs 18 - this is always correct, but not very magical.
0	string	\012(			byte-compiled Emacs-Lisp program data
# Emacs 19
0	string	;ELC\023\000\000\000	byte-compiled Emacs-Lisp program data
# clisp types, from Jim Wise (jimw@fornost.turner.com)
0	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program text
0	long	0x70768BD2		CLISP memory image data
0	long	0xD28B7670		CLISP memory image data, other
#	$OpenBSD: mach,v 1.2 2001/01/29 01:57:57 niklas Exp $

#------------------------------------------------------------------------------
# mach file description
#
0	belong		0xcafebabe	mach-o fat file
>4	belong		1		with 1 architecture
>4	belong		>1
>>4	belong		x		with %ld architectures		
#
0	belong		0xfeedface	mach-o
>12	belong		1		object
>12	belong		2		executable
>12	belong		3		shared library
>12	belong		4		core
>12	belong		5		preload executable
>12	belong		>5
>>12	belong		x		filetype=%ld
>4	belong		<0
>>4	belong		x		architecture=%ld
>4	belong		1		vax
>4	belong		2		romp
>4	belong		3		architecture=3
>4	belong		4		ns32032
>4	belong		5		ns32332
>4	belong		6		for m68k architecture
>4	belong		7		i386
>4	belong		8		mips
>4	belong		9		ns32532
>4	belong		10		architecture=10
>4	belong		11		hp pa-risc
>4	belong		12		acorn
>4	belong		13		m88k
>4	belong		14		sparc
>4	belong		15		i860-big
>4	belong		16		i860
>4	belong		17		rs6000
>4	belong		18		powerPC
>4	belong		>18
>>4	belong		x		architecture=%ld

#------------------------------------------------------------------------------
# macintosh:  file(1) magic for Apple Macintosh file formats

# Stuffit archives are the de facto standard of compression for Macintosh
# files obtained from most archives. (franklsm@tuns.ca)
0	string		SIT!			StuffIt Archive (data)
>2	string		x			: %s
65	string		SIT!			StuffIt Archive (rsrc + data)
>2	string		x			: %s
0	string		SITD			StuffIt Deluxe (data)
>2	string		x			: %s
65	string		SITD			StuffIt Deluxe (rsrc + data)
>2	string		x			: %s
0	string		Seg			StuffIt Deluxe Segment (data)
>2	string		x			: %s
65	string		Seg			StuffIt Deluxe Segment (rsrc + data)
>2	string		x			: %s

# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
0	string		APPL			Macintosh Application (data)
>2	string		x			: %s
65	string		APPL			Macintosh Application (rsrc + data)
>2	string		x			: %s

# Macintosh System files (franklsm@tuns.ca)
0	string		zsys			Macintosh System File (data)
65	string		zsys			Macintosh System File(rsrc + data)
0	string		FNDR			Macintosh Finder (data)
65	string		FNDR			Macintosh Finder(rsrc + data)
0	string		libr			Macintosh Library (data)
>2	string		x			: %s
65	string		libr			Macintosh Library(rsrc + data)
>2	string		x			: %s
0	string		shlb			Macintosh Shared Library (data)
>2	string		x			: %s
65	string		shlb			Macintosh Shared Library(rsrc + data)
>2	string		x			: %s
0	string		cdev			Macintosh Control Panel (data)
>2	string		x			: %s
65	string		cdev			Macintosh Control Panel(rsrc + data)
>2	string		x			: %s
0	string		INIT			Macintosh Extension (data)
>2	string		x			: %s
65	string		INIT			Macintosh Extension(rsrc + data)
>2	string		x			: %s
0	string		FFIL			Macintosh Truetype Font (data)
>2	string		x			: %s
65	string		FFIL			Macintosh Truetype Font(rsrc + data)
>2	string		x			: %s
0	string		LWFN			Macintosh Postscript Font (data)
>2	string		x			: %s
65	string		LWFN			Macintosh Postscript Font(rsrc + data)
>2	string		x			: %s

# Additional Macintosh Files (franklsm@tuns.ca)
0	string		PACT			Macintosh Compact Pro Archive (data)
>2	string		x			: %s
65	string		PACT			Macintosh Compact Pro Archive(rsrc + data)
>2	string		x			: %s
0	string		ttro			Macintosh TeachText File (data)
>2	string		x			: %s
65	string		ttro			Macintosh TeachText File(rsrc + data)
>2	string		x			: %s
0	string		TEXT			Macintosh TeachText File (data)
>2	string		x			: %s
65	string		TEXT			Macintosh TeachText File(rsrc + data)
>2	string		x			: %s
0	string		PDF			Macintosh PDF File (data)
>2	string		x			: %s
65	string		PDF			Macintosh PDF File(rsrc + data)
>2	string		x			: %s

#------------------------------------------------------------------------------
# magic:  file(1) magic for magic files
#
0	string		#\ Magic	magic text file for file(1) cmd

#------------------------------------------------------------------------------
# mail.news:  file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
#0	string		From 		mail text
# There are tests to ascmagic.c to cope with mail and news.
0	string		Relay-Version: 	old news text
0	string		#!\ rnews	batched news text
0	string		N#!\ rnews	mailed, batched news text
0	string		Forward\ to 	mail forwarding text
0	string		Pipe\ to 	mail piping text
0	string		Return-Path:	smtp mail text
0	string		Path:		news text
0	string		Xref:		news text
0	string		From:		news or mail text
0	string		Article 	saved news text
0	string		BABYL		Emacs RMAIL text
0	string		Received:	RFC 822 mail text
0	string		MIME-Version:	MIME entity text
0	string		Content-	MIME entity text

#------------------------------------------------------------------------------
# mirage:  file(1) magic for Mirage executables
#
# XXX - byte order?
#
0	long	31415		Mirage Assembler m.out executable

#------------------------------------------------------------------------------
# mkid:  file(1) magic for mkid(1) databases
#
# ID is the binary tags database produced by mkid(1).
#
# XXX - byte order?
#
0	string		\311\304	ID tags data
>2	short		>0		version %d

#------------------------------------------------------------------------------
# mmdf:  file(1) magic for MMDF mail files
#
0	string	\001\001\001\001	MMDF mailbox
#	$OpenBSD: modules,v 1.2 2001/01/29 01:57:57 niklas Exp $

# Magic file entries for several module formats
# by Claudio Matsuoka <claudio@pos.inf.ufpr.br>
#
# 4, 6 and 8 channel Protracker/Noisetracker/Fasttracker modules
#
1080	string		M.K.		Protracker module
>0	string		>\0		- "%.20s"
1080	string		M!K!		Protracker 2.3 module
>0	string		>\0		- "%.20s"
1080	string		M&K!		Noisetracker module
>0	string		>\0		- "%.20s"
1080	string		EMW3		UNIC-Tracker module
>0	string		>\0		- "%.20s"
1080	string		FLT4		Startrekker 4 channel module
>0	string		>\0		- "%.20s"
1080	string		FLT8		Startrekker 8 channel module
>0	string		>\0		- "%.20s"
1080	string		6CHN		Fasttracker 6 channel module
>0	string		>\0		- "%.20s"
1080	string		8CHN		Fasttracker 8 channel module
>0	string		>\0		- "%.20s"
1081	string		CHN		TakeTracker
>1080	string		x		"%-1.1s channel module"
>0	string		>\0		- "%.20s"
#
# Scream Tracker 2 modules
#
20	string		!Scream!	Scream Tracker
>30	byte		1		
>>31	byte		x		1.%02d module
>30	byte		2
>>31	byte		x		2.%d module
>0	string		>\0		- "%.20s"
#
# Scream Tracker 3 modules
#
44	string		SCRM		Scream Tracker
>41	byte		0x13
>>40	byte		x		3.%02x module
>0	string		>\0		- "%.28s"
#
# Poly Tracker modules
#
44	string		PTMF		Poly Tracker
>30	byte		0
>>29	byte		x		1.%02d module
>30	byte		2
>>29	byte		x		2.%02d module
>0	string		>\0		- "%.28s"
#
# Fast Tracker II extended modules
#
0	string		Extended\040Module:\040	Fasttracker II module
>59	byte		0
>>58	byte		x		v0.%02d
>59	byte		1
>>58	byte		x		v1.%02d
>59	byte		2
>>58	byte		x		v2.%02d
>17	string		>\0		- "%.20s"
#
# Real Tracker modules
#
0	string		RTMM		Real Tracker module
5	string		?\0		- "%.32s"
#
# Oktalyzer modules
#
0	string		OKTASONG	Oktalyzer module
#
# Farandole Composer modules
#
0	string		FAR\xfe
>4	string		>\0		Farandole Composer module - "%.40s"
#
# Impulse Tracker modules
#
0	string		IMPM		Impulse Tracker module
>43	byte		0		
>>42	byte		x		v0.%02d
>43	byte		1
>>42	byte		x		v1.%02d
>43	byte		2
>>42	byte		x		v2.%02d
>4	string		>\0		- "%.26s"
>44	byte		^0x04		(sample mode)
>44	byte		&0x04		(instrument mode)
#
# Powerpacked modules
#
0	string		PP20		Powerpacked module
#
# Aley Keptr's ALM module format
#
0	string		ALEY\040MOD	Aley's module version 1.0
0	string		ALEYMOD		Aley's module version 1.1 or 1.2
#
# Amusic Adlib tracker module
#
1068	string		RoR		Amusic Adlib module
>0	string		>\0		- "%.24s"
#
# Reality Adlib Tracker module
#
0	string		RAD		Reality Adlib Tracker module
#
# Multitracker modules
#
0	string		MTM
>4	string		>\0		Multitracker module - "%.20s"
#
# Composer 669 modules
#
0	string		if
>240	byte		0xff		Composer 669 module
0	string		JN
>240	byte		0xff		UNIS 669 module


#------------------------------------------------------------------------------
# motorola:  file(1) magic for Motorola 68K and 88K binaries
#
# 68K
#
0	beshort		0520		mc68k COFF
>18	beshort		^00000020	object
>18	beshort		&00000020	executable
>12	belong		>0		not stripped
>168	string		.lowmem		Apple toolbox
>20	beshort		0407		(impure)
>20	beshort		0410		(pure)
>20	beshort		0413		(demand paged)
>20	beshort		0421		(standalone)
0	beshort		0521		mc68k executable (shared)
>12	belong		>0		not stripped
0	beshort		0522		mc68k executable (shared demand paged)
>12	belong		>0		not stripped
#
# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
#
0	beshort		0554		68K BCS executable
#
# 88K
#
# Motorola/88Open BCS
#
0	beshort		0555		88K BCS executable
#
# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
0   string      S0          Motorola S-Record; binary data in text format

#------------------------------------------------------------------------------
# msdos:  file(1) magic for MS-DOS files
#

# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
0	string	@echo\ off	MS-DOS batch file text

# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
0	string	MZ		MS-DOS executable (EXE)
>24	string	@		\b, OS/2 or Windows
>1638	string	-lh5-		\b, LHa SFX archive v2.13S
>7195	string	Rar!		\b, RAR self-extracting archive
#
# [GRR 950118:  file 3.15 has a buffer-size limitation; offsets bigger than
#   8161 bytes are ignored.  To make the following entries work, increase
#   HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
#   NT/Win32 and VMS.]
# [GRR:  some company sells a self-extractor/displayer for image data(!)]
#
>11696	string	PK\003\004	\b, PKZIP SFX archive v1.1
>13297	string	PK\003\004	\b, PKZIP SFX archive v1.93a
>15588	string	PK\003\004	\b, PKZIP2 SFX archive v1.09
>15770	string	PK\003\004	\b, PKZIP SFX archive v2.04g
>28374	string	PK\003\004	\b, PKZIP2 SFX archive v1.02
#
# Info-ZIP self-extractors
#    these are the DOS versions:
>25115	string	PK\003\004	\b, Info-ZIP SFX archive v5.12
>26331	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#    these are the OS/2 versions (OS/2 is flagged above):
>47031	string	PK\003\004	\b, Info-ZIP SFX archive v5.12
>49845	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#    this is the NT/Win32 version:
>69120	string	PK\003\004	\b, Info-ZIP NT SFX archive v5.12 w/decryption
#
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
>>49824	leshort		=1			\b, 1 file
>>49824	leshort		>1			\b, %u files

# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
# Uncommenting only the first two lines will cover about 2/3 of COM files,
# but it isn't feasible to match all COM files since there must be at least
# two dozen different one-byte "magics".
#0	byte		0xe9		MS-DOS executable (COM)
#0	byte		0x8c		MS-DOS executable (COM)
# 0xeb conflicts with "sequent" magic
#0	byte		0xeb		MS-DOS executable (COM)
#0	byte		0xb8		MS-DOS executable (COM)

# miscellaneous formats
0	string		LZ		MS-DOS executable (built-in)
#0	byte		0xf0		MS-DOS program library data
#

# Popular applications
2080	string	Microsoft\ Word\ 6.0\ Document	%s
#
0	belong	0x31be0000	Microsoft Word Document
#
2080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
#
0	belong	0x00001a00	Lotus 1-2-3
>4	belong	0x00100400	wk3 document
>4	belong	0x02100400	wk4 document
>4	belong	0x07800100	fm3 or fmb document
>4	belong	0x07800000	fm3 or fmb document
#
0	belong	0x00000200 	Lotus 1-2-3
>4	belong	0x06040600	wk1 document
>4	belong	0x06800200	fmt document

#------------------------------------------------------------------------------
# ncr:  file(1) magic for NCR Tower objects
#
# contributed by
# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
#
0	beshort		000610	Tower/XP rel 2 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000615	Tower/XP rel 2 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000620	Tower/XP rel 3 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000625	Tower/XP rel 3 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000630	Tower32/600/400 68020 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000640	Tower32/800 68020
>18	   beshort		&020000	w/68881 object
>18	   beshort		&040000	compatible object
>18	   beshort		&~060000	object
>20	   beshort		0407	executable
>20	   beshort		0413	pure executable
>12	   belong		>0	not stripped
>22	   beshort		>0	- version %ld
0	beshort		000645	Tower32/800 68010
>18	   beshort		&040000	compatible object
>18	   beshort		&~060000 object
>20	   beshort		0407	executable
>20	   beshort		0413	pure executable
>12	   belong		>0	not stripped
>22	   beshort		>0	- version %ld

#------------------------------------------------------------------------------
# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
#
0	string		StartFontMetrics	ASCII font metrics
0	string		StartFont	ASCII font bits
0	belong		0x137A2944	NeWS bitmap font
0	belong		0x137A2947	NeWS font family
0	belong		0x137A2950	scalable OpenFont binary
0	belong		0x137A2951	encrypted scalable OpenFont binary
8	belong		0x137A2B45	X11/NeWS bitmap font
8	belong		0x137A2B48	X11/NeWS font family

#------------------------------------------------------------------------------
# olf:  file(1) magic for OLF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# Byte order is probably big-endian for MIPS R3000 and Amdahl.
# MIPS R3000 may also be for MIPS R2000.
#
# Created by Erik Theisen <etheisen@openbsd.org>
# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
0	string		\177OLF		OLF
>4	byte		0		invalid class
>4	byte		1		32-bit
>4	byte		2		64-bit
>7	byte		0		invalid os
>7	byte		1		OpenBSD
>7	byte		2		NetBSD
>7	byte		3		FreeBSD
>7	byte		4		4.4BSD
>7	byte		5		Linux
>7	byte		6		SVR4
>7	byte		7		esix
>7	byte		8		Solaris
>7	byte		9		Irix
>7	byte		10		SCO
>7	byte		11		Dell
>7	byte		12		NCR
>8	byte		1		dynamically linked
>9	byte		1		unstripped
>5	byte		0		invalid byte order
>5	byte		1		LSB
>>16	leshort		0		no file type,
>>16	leshort		1		relocatable,
>>16	leshort		2		executable,
>>16	leshort		3		shared object,
>>16	leshort		4		core file,
>>16	leshort		&0xff00		processor-specific,
>>18	leshort		0		no machine,
>>18	leshort		1		AT&T WE32100 - invalid byte order,
>>18	leshort		2		SPARC - invalid byte order,
>>18	leshort		3		Intel 80386,
>>18	leshort		4		Motorola 68000 - invalid byte order,
>>18	leshort		5		Motorola 88000 - invalid byte order,
>>18	leshort		6		Intel 80486,
>>18	leshort		7		Intel 80860,
>>18	leshort		8		MIPS R3000,
>>18	leshort		9		Amdahl,
>>18	leshort		75		VAX,
>>20	lelong		0		invalid version
>>20	lelong		1		version 1
>>36	lelong		1		MathCoPro/FPU/MAU Required
>5	byte		2		MSB
>>16	beshort		0		no file type,
>>16	beshort		1		relocatable,
>>16	beshort		2		executable,
>>16	beshort		3		shared object,
>>16	beshort		4		core file,
>>16	beshort		&0xff00		processor-specific,
>>18	beshort		0		no machine,
>>18	beshort		1		AT&T WE32100,
>>18	beshort		2		SPARC,
>>18	beshort		3		Intel 80386 - invalid byte order,
>>18	beshort		4		Motorola 68000,
>>18	beshort		5		Motorola 88000,
>>18	beshort		6		Intel 80486 - invalid byte order,
>>18	beshort		7		Intel 80860,
>>18	beshort		8		MIPS R3000,
>>18	beshort		75		VAX - invalid byte order,
>>18	leshort		9		Amdahl,
>>20	belong		0		invalid version
>>20	belong		1		version 1
>>36	belong		1		MathCoPro/FPU/MAU Required
#
# $OpenBSD: os9,v 1.2 1996/06/26 05:33:04 deraadt Exp $
# $NetBSD: os9,v 1.1 1996/05/06 18:24:01 is Exp $
#
# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
# 3. All advertising materials mentioning features or use of this software
#    must display the following acknowledgement:
#      This product includes software developed by Ignatios Souvatzis for
#      the NetBSD project.
# 4. The name of the author may not be used to endorse or promote products
#    derived from this software without specific prior written permission.
#
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  
# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
#
# OS9/6809 module descriptions:
#
0	beshort		0x87CD	OS9/6809 module:
#
>6	byte&0x0f	0x00	non-executable
>6	byte&0x0f	0x01	machine language
>6	byte&0x0f	0x02	BASIC I-code
>6	byte&0x0f	0x03	P-code
>6	byte&0x0f	0x04	C I-code
>6	byte&0x0f	0x05	COBOL I-code
>6	byte&0x0f	0x06	FORTRAN I-code
#
>6	byte&0xf0	0x10	program executable
>6	byte&0xf0	0x20	subroutine
>6	byte&0xf0	0x30	multi-module
>6	byte&0xf0	0x40	data module
#
>6	byte&0xf0	0xC0	system module
>6	byte&0xf0	0xD0	file manager
>6	byte&0xf0	0xE0	device driver
>6	byte&0xf0	0xF0	device descriptor
#
# OS9/m68k stuff (to be continued)
#
0	beshort		0x4AFC	OS9/68K module:
#
# attr
>14	byte&0x80	0x80	re-entrant
>14	byte&0x40	0x40	ghost
>14	byte&0x20	0x20	system-state
#
# lang:
#
>13	byte		1	machine language
>13	byte		2	BASIC I-code
>13	byte		3	P-code
>13	byte		4	C I-code
>13	byte		5	COBOL I-code
>13	byte		6	Fortran I-code
#
#
# type:
#
>12	byte		1	program executable
>12	byte		2	subroutine
>12	byte		3	multi-module
>12	byte		4	data module
>12	byte		11	trap library
>12	byte		12	system module
>12	byte		13	file manager
>12	byte		14	device driver
>12	byte		15	device descriptor
#	$OpenBSD: osf1,v 1.2 2001/01/29 01:57:57 niklas Exp $

#
# Mach magic number info
#
0	long		0xefbe	OSF/Rose object
# I386 magic number info
#
0	short		0565	i386 COFF object
#	$OpenBSD: palmpilot,v 1.3 2001/01/29 01:57:57 niklas Exp $

# start kpilot.magic
# This must go at the end of $(kde_mimedir)/magic
# PalmPilot Files
>0x20   beshort&0xffe7   0              palmpilot/database
>0x20   beshort&0xffe7   1      
>>0x3c  string           appl           palmpilot/application
>>0x3c  string           HACK           palmpilot/hack
>>0x3c  string           libr           palmpilot/library  
>>0x3c  string           >\0            palmpilot/database
# stop kpilot.magic

#------------------------------------------------------------------------------
# pbm:  file(1) magic for Portable Bitmap files
#
# XXX - byte order?
#
0	short	0x2a17	"compact bitmap" format (Poskanzer)
#	$OpenBSD: pdf,v 1.3 2001/01/29 01:57:57 niklas Exp $

#------------------------------------------------------------------------------
# pdf:  file(1) magic for Portable Document Format
#

0	string		%PDF-		PDF document
>5	byte		x		\b, version %c
>7	byte		x		\b.%c

#------------------------------------------------------------------------------
# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
#
0	lelong		0101555		PDP-11 single precision APL workspace
0	lelong		0101554		PDP-11 double precision APL workspace
#
# PDP-11 a.out
#
0	leshort		0407		PDP-11 executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0401		PDP-11 UNIX/RT ldp
0	leshort		0405		PDP-11 old overlay

0	leshort		0410		PDP-11 pure executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0411		PDP-11 separate I&D executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0437		PDP-11 kernel overlay

#------------------------------------------------------------------------------
# pgp:  file(1) magic for Pretty Good Privacy
#
0       beshort         0x9900                  PGP key public ring
0       beshort         0x9501                  PGP key security ring
0       beshort         0x9500                  PGP key security ring
0	beshort		0xa600			PGP encrypted data
0       string          -----BEGIN\040PGP       PGP armored data
>15     string          PUBLIC\040KEY\040BLOCK- public key block
>15     string          MESSAGE-                message
>15     string          SIGNED\040MESSAGE-      signed message
>15     string          PGP\040SIGNATURE-       signature

#------------------------------------------------------------------------------
# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
#
0       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)

#------------------------------------------------------------------------------
# plus5:  file(1) magic for Plus Five's UNIX MUMPS
#
# XXX - byte order?  Paging Hokey....
#
0	short		0x259		mumps avl global
>2	byte		>0		(V%d)
>6	byte		>0		with %d byte name
>7	byte		>0		and %d byte data cells
0	short		0x25a		mumps blt global
>2	byte		>0		(V%d)
>8	short		>0		- %d byte blocks
>15	byte		0x00		- P/D format
>15	byte		0x01		- P/K/D format
>15	byte		0x02		- K/D format
>15	byte		>0x02		- Bad Flags

#------------------------------------------------------------------------------
# printer:  file(1) magic for printer-formatted files
#

# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
0	string		%!		PostScript document text
>2	string		PS-Adobe-	conforming
>>11	string		>\0		at level %.3s
>>>15	string		EPS		- type %s
>>>15	string		Query		- type %s
>>>15	string		ExitServer	- type %s
# Some PCs have the annoying habit of adding a ^D as a document separator
0	string		\004%!		PostScript document text
>3	string		PS-Adobe-	conforming
>>12	string		>\0		at level %.3s
>>>16	string		EPS		- type %s
>>>16	string		Query		- type %s
>>>16	string		ExitServer	- type %s

# HP Printer Job Language
0	string		\033%-12345X@PJL	HP Printer Job Language data
>15	string		\ ENTER\ LANGUAGE\ =
>31	string		PostScript		PostScript

# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\033E\033	HP PCL printer data
>3	string		\&l0A		- default page size
>3	string		\&l1A		- US executive page size
>3	string		\&l2A		- US letter page size
>3	string		\&l3A		- US legal page size
>3	string		\&l26A		- A4 page size
>3	string		\&l80A		- Monarch envelope size
>3	string		\&l81A		- No. 10 envelope size
>3	string		\&l90A		- Intl. DL envelope size
>3	string		\&l91A		- Intl. C5 envelope size
>3	string		\&l100A		- Intl. B5 envelope size
>3	string		\&l-81A		- No. 10 envelope size (landscape)
>3	string		\&l-90A		- Intl. DL envelope size (landscape)

# HPGL2 - Graphics for HP printers. Pavel Lisy <pali@tmapy.cz>, edited.
0	string		\033%OB;	HP HPGL printer data
# 	be nice to get the other parameters that can follow, as per PCL?

# IMAGEN printer-ready files:
0	string	@document(		Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10	string	language\ impress	(imPRESS data)
>10	string	language\ daisy		(daisywheel text)
>10	string	language\ diablo	(daisywheel text)
>10	string	language\ printer	(line printer emulation)
>10	string	language\ tektronix	(Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
#
# Now magic for IMAGEN font files...
0	string		Rast		RST-format raster font data
>45	string		>0		face %

#------------------------------------------------------------------------------
# psdbms:  file(1) magic for psdatabase
#
0	belong&0xff00ffff	0x56000000	ps database
>1	string	>\0	version %s
>4	string	>\0	from kernel %s

#------------------------------------------------------------------------------
# pyramid:  file(1) magic for Pyramids
#
# XXX - byte order?
#
0	long		0x50900107	Pyramid 90x family executable
0	long		0x50900108	Pyramid 90x family pure executable
>16	long		>0		not stripped
0	long		0x5090010b	Pyramid 90x family demand paged pure executable
>16	long		>0		not stripped
#	$OpenBSD: rpm,v 1.4 2001/01/29 01:57:58 niklas Exp $

#------------------------------------------------------------------------------
#
# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
#
0	beshort		0xedab    	
>2	beshort		0xeedb		RPM
>>4	byte		x		v%d
>>6	beshort		0		bin
>>6	beshort		1		src
>>8	beshort		1		i386
>>8	beshort		2		Alpha
>>8	beshort		3		Sparc
>>8	beshort		4		MIPS
>>8	beshort		5		PowerPC
>>8	beshort		6		68000
>>8     beshort         7               SGI
>>10	string		x		%s

#------------------------------------------------------------------------------
# rtf:	file(1) magic for Rich Text Format (RTF)
#
# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
#
0	string		{\\rtf		Rich Text Format data,
>5	byte		x		version %c,
>6	string		\\ansi		ANSI
>6	string		\\mac		Apple Macintosh
>6	string		\\pc		IBM PC, code page 437
>6	string		\\pca		IBM PS/2, code page 850

#------------------------------------------------------------------------------
# sc:  file(1) magic for "sc" spreadsheet
#
38	string		Spreadsheet	sc spreadsheet file

#------------------------------------------------------------------------------
# sccs:  file(1) magic for SCCS archives
#
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
# \001c date and time created 87/09/23 08:09:20 by ian
# \001e
# \001u
# \001U
# ... etc.
# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
# *Sigh*. And these both came from various parts of the USG.
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
# and we don't have regular expression matching yet. 
# Hence the following official kludge:
8	string		\001s\ 			SCCS archive data

#------------------------------------------------------------------------------
# sendmail:  file(1) magic for sendmail config files
#
# XXX - byte order?
#
0	byte	046	  Sendmail frozen configuration 
>16	string	>\0	  - version %s
0	short	0x271c	  Sendmail frozen configuration
>16	string	>\0	  - version %s

#------------------------------------------------------------------------------
# sequent:  file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# For Sequent's multiprocessor systems (incomplete).
0	lelong	0x00ea        	BALANCE NS32000 .o
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
>16	lelong  >0            	not stripped
>124	lelong	>0		version %ld
0	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
>16	lelong  >0            	not stripped
>124	lelong	>0		version %ld
0	lelong	0x30ea        	BALANCE NS32000 standalone executable
>16	lelong  >0          	not stripped
>124	lelong	>0		version %ld
#
# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
# Symmetry magic nums will not be reached if DOS COM comes before them;
# byte 0xeb is matched before these get a chance.
0	leshort	0x12eb		SYMMETRY i386 .o
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x42eb		SYMMETRY i386 standalone executable
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld

#------------------------------------------------------------------------------
# sgi:  file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
#                         Dec Ultrix (MIPS)
# all of SGI's *current* machines and OSes run in big-endian mode on the
# MIPS machines, as far as I know.
#
# XXX - what is the blank "-" line?
#
# kbd file definitions
0	string	kbd!map		kbd map file
>8	byte	>0		Ver %d:
>10	short	>0		with %d table(s)
0	belong	0407		old SGI 68020 executable
0	belong	0410		old SGI 68020 pure executable
0	beshort	0x8765		disk quotas file
0	beshort	0x0506		IRIS Showcase file
>2	byte	0x49		-
>3	byte	x		- version %ld
0	beshort	0x0226		IRIS Showcase template
>2	byte	0x63		-
>3	byte	x		- version %ld
0	belong	0x5343464d	IRIS Showcase file
>4	byte	x		- version %ld
0	belong	0x5443464d	IRIS Showcase template
>4	byte	x		- version %ld
0	belong	0xdeadbabe	IRIX Parallel Arena
>8	belong	>0		- version %ld
#
0	beshort	0x0160		MIPSEB COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0162		MIPSEL COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %d
>22	byte	x		.%ld
#
0	beshort	0x6001		MIPSEB-LE COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %d
>22	byte	x		.%ld
#
0	beshort	0x6201		MIPSEL-LE COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
# MIPS 2 additions
#
0	beshort	0x0163		MIPSEB MIPS-II COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0166		MIPSEL MIPS-II COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x6301		MIPSEB-LE MIPS-II COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
0	beshort	0x6601		MIPSEL-LE MIPS-II COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
# MIPS 3 additions
#
0	beshort	0x0140		MIPSEB MIPS-III COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0142		MIPSEL MIPS-III COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x4001		MIPSEB-LE MIPS-III COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
0	beshort	0x4201		MIPSEL-LE MIPS-III COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
0	beshort	0x180		MIPSEB Ucode
0	beshort	0x182		MIPSEL Ucode
# 32bit core file
0	belong	0xdeadadb0	IRIX core dump
>4	belong	1		of
>16	string	>\0		'%s'
# 64bit core file
0	belong	0xdeadad40	IRIX 64-bit core dump
>4	belong	1		of
>16	string	>\0		'%s'
# New style crash dump file
0	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
>36	string	>\0					'%s'
# Trusted IRIX info
0	string	SGIAUDIT	SGI Audit file
>8	byte	x		- version %d
>9	byte	x		.%ld
# Are these three SGI-based file types or general ones?
0	string	WNGZWZSC	Wingz compiled script
0	string	WNGZWZSS	Wingz spreadsheet
0	string	WNGZWZHP	Wingz help file
#
0	string	\#Inventor V	IRIS Inventor 1.0 file
0	string	\#Inventor V2	Open Inventor 2.0 file
# XXX - I don't know what next thing is!  It is likely to be an image
# (or movie) format
0	string	glfHeadMagic();		GLF_TEXT
4	belong	0x41010000		GLF_BINARY_LSB_FIRST
4	belong	0x00000141		GLF_BINARY_MSB_FIRST

#------------------------------------------------------------------------------
# sgml:  file(1) magic for Standard Generalized Markup Language

# HyperText Markup Language (HTML) is an SGML document type,
# from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\<!DOCTYPE\ HTML	HTML document text
0	string		\<!doctype\ html	HTML document text
0	string		\<HEAD		HTML document text
0	string		\<head		HTML document text
0	string		\<TITLE		HTML document text
0	string		\<title		HTML document text
0	string		\<html		HTML document text
0	string		\<HTML		HTML document text

# SGML, mostly from rph@sq
0	string		\<!DOCTYPE	exported SGML document text
0	string		\<!doctype	exported SGML document text
0	string		\<!SUBDOC	exported SGML subdocument text
0	string		\<!subdoc	exported SGML subdocument text
0	string		\<!--		exported SGML document text
#	$OpenBSD: sidfiles,v 1.3 2001/01/29 01:57:58 niklas Exp $

# sidfiles
0	string		SIDPLAY\ INFOFILE	Sidplay info file
0       string          PSID      		PlaySID v2.2+ (AMIGA) sidtune,
>4      beshort         >0                      w/ header v%d,
>14     beshort         =1              	single song,
>14     beshort         >1              	%d songs,
>16     beshort         >0              	default song: %d

#------------------------------------------------------------------------------
# sniffer:  file(1) magic for packet captured files
#
# From: guy@netapp.com (Guy Harris)
#
# Microsoft NetMon (packet capture/display program) capture files.
#
0	string		RTSS		NetMon capture file
>4	byte		x		- version %d
>5	byte		x		\b.%d
#
# Network General Sniffer capture files.
#
0	string		TRSNIFF\ data\ \ \ \ \032	Sniffer capture file
>23	leshort		x		- version %d
>25	leshort		x		\b.%d
>33	byte		x		(Format %d,
>32	byte		0		Token ring)
>32	byte		1		Ethernet)
>32	byte		2		ARCnet)
>32	byte		3		StarLAN)
>32	byte		4		PC Network broadband)
>32	byte		5		LocalTalk)
>32	byte		6		Znet)
#
# "libpcap" capture files.
# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
# the main program that uses that format, but there's also "tcpview",
# and there may be others in the future.)
#
0	ubelong		0xa1b2c3d4	tcpdump capture file (big-endian)
>4	beshort		x		- version %d
>6	beshort		x		\b.%d
>20	belong		0		(No link-layer encapsulation
>20	belong		1		(Ethernet
>20	belong		2		(3Mb Ethernet
>20	belong		3		(AX.25
>20	belong		4		(ProNet
>20	belong		5		(Chaos
>20	belong		6		(IEEE 802.x network
>20	belong		7		(ARCnet
>20	belong		8		(SLIP
>20	belong		9		(PPP
>20	belong		10		(FDDI
>20	belong		11		(RFC 1483 ATM
>16	belong		x		\b, capture length %d)
0	ulelong		0xa1b2c3d4	tcpdump capture file (little-endian)
>4	leshort		x		- version %d
>6	leshort		x		\b.%d
>20	lelong		0		(No link-layer encapsulation
>20	lelong		1		(Ethernet
>20	lelong		2		(3Mb Ethernet
>20	lelong		3		(AX.25
>20	lelong		4		(ProNet
>20	lelong		5		(Chaos
>20	lelong		6		(IEEE 802.x network
>20	lelong		7		(ARCnet
>20	lelong		8		(SLIP
>20	lelong		9		(PPP
>20	lelong		10		(FDDI
>20	lelong		11		(RFC 1483 ATM
>16	lelong		x		\b, capture length %d)
# $OpenBSD: softquad,v 1.3 1996/06/26 05:33:05 deraadt Exp $

#------------------------------------------------------------------------------
# softquad:  file(1) magic for SoftQuad Publishing Software
#
# Author/Editor and RulesBuilder
#
# XXX - byte order?
#
0	string		\<!SQ\ DTD>	Compiled SGML rules file
>9	string		>\0		 Type %s
0	string		\<!SQ\ A/E>	A/E SGML Document binary
>9	string		>\0		 Type %s
0	string		\<!SQ\ STS>	A/E SGML binary styles file
>9	string		>\0		 Type %s
0	short		0xc0de		Compiled PSI (v1) data
0	short		0xc0da		Compiled PSI (v2) data
>3	string		>\0		(%s)
# Binary sqtroff font/desc files...
0	short		0125252		SoftQuad DESC or font file binary
>2	short		>0		- version %d
# Bitmaps...
0	string		SQ\ BITMAP1	SoftQuad Raster Format text
#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
# sqtroff intermediate language (replacement for ditroff int. lang.)
0	string		X\ 		SoftQuad troff Context intermediate
>2	string		495		for AT&T 495 laser printer
>2	string		hp		for Hewlett-Packard LaserJet
>2	string		impr		for IMAGEN imPRESS
>2	string		ps		for PostScript

#------------------------------------------------------------------------------
# sun:  file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
# releases.  (5.x uses ELF.)
#
0	belong&077777777	0600413		sparc demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0600410		sparc pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0600407		sparc
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

0	belong&077777777	0400413		mc68020 demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>16	belong		>0		not stripped
0	belong&077777777	0400410		mc68020 pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0400407		mc68020
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

0	belong&077777777	0200413		mc68010 demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>16	belong		>0		not stripped
0	belong&077777777	0200410		mc68010 pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0200407		mc68010
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

# reworked these to avoid anything beginning with zero becoming "old sun-2"
0	belong		0407		old sun-2 executable
>16	belong		>0		not stripped
0	belong		0410		old sun-2 pure executable
>16	belong		>0		not stripped
0	belong		0413		old sun-2 demand paged executable
>16	belong		>0		not stripped

#
# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
# binary executed in compatibility mode under SunOS 5.x".
#
0	belong		0x080456	SunOS core file
>4	belong		432		(SPARC)
>>132	string		>\0		from '%s'
>>116	belong		=3		(quit)
>>116	belong		=4		(illegal instruction)
>>116	belong		=5		(trace trap)
>>116	belong		=6		(abort)
>>116	belong		=7		(emulator trap)
>>116	belong		=8		(arithmetic exception)
>>116	belong		=9		(kill)
>>116	belong		=10		(bus error)
>>116	belong		=11		(segmentation violation)
>>116	belong		=12		(bad argument to system call)
>>116	belong		=29		(resource lost)
>>120	belong		x		(T=%dK,
>>124	belong		x		D=%dK,
>>128	belong		x		S=%dK)
>4	belong		826		(68K)
>>128	string		>\0		from '%s'
>4	belong		456		(SPARC 4.x BCP)
>>152	string		>\0		from '%s'
# Sun SunPC
0	long		0xfa33c08e	SunPC 4.0 Hard Disk
0	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
# Sun snoop
#
# XXX - are numbers stored in big-endian format, or in host byte order?
# They're the same on SPARC, but not the same on x86.
#
0	string		snoop		Snoop capture file
>8	long		>0		- version %ld
>12	long		0		(IEEE 802.3)
>12	long		1		(IEEE 802.4)
>12	long		2		(IEEE 802.5)
>12	long		3		(IEEE 802.6)
>12	long		4		(Ethernet)
>12	long		5		(HDLC)
>12	long		6		(Character synchronous)
>12	long		7		(IBM channel-to-channel adapter)
>12	long		8		(FDDI)
>12	long		9		(Unknown)
# Sun KCMS
36	string		acsp		Kodak Color Management System, ICC Profile



#------------------------------------------------------------------------------
# terminfo:  file(1) magic for terminfo
#
# XXX - byte order for screen images?
#
0	string		\032\001	Compiled terminfo entry
0	short		0433		Curses screen image
0	short		0434		Curses screen image

#------------------------------------------------------------------------------
# tex:  file(1) magic for TeX files
#
# From <conklin@talisman.kaleida.com>

# Although we may know the offset of certain text fields in TeX DVI
# and font files, we can't use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0	string		\367\002	TeX DVI file
>16	string		>\0		(%s)
0	string		\367\203	TeX generic font data
0	string		\367\131	TeX packed font data
>3	string		>\0		(%s)
0	string		\367\312	TeX virtual font data
0	string		This\ is\ TeX,	TeX transcript text
0	string		This\ is\ METAFONT,	METAFONT transcript text

# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data.  The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2	string		\000\021	TeX font metric data
>33	string		>\0		(%s)
2	string		\000\022	TeX font metric data
>33	string		>\0		(%s)

# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\\input\ texinfo	Texinfo source text
0	string		This\ is\ Info\ file	GNU Info text

# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\\input		TeX document text
0	string		\\section	LaTeX document text
0	string		\\setlength	LaTeX document text
0	string		\\documentstyle	LaTeX document text
0	string		\\chapter	LaTeX document text

#------------------------------------------------------------------------------
# timezone:  file(1) magic for timezone data
#
# zic
0	string	TZif	timezone information file
# from Daniel Quinlan (quinlan@yggdrasil.com)
# this should work on Linux, SunOS, and maybe others
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	timezone data
0	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	timezone data

#------------------------------------------------------------------------------
# troff:  file(1) magic for *roff
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)

# troff input
0	string		.\\"		troff or preprocessor input text
0	string		'\\"		troff or preprocessor input text
0	string		'.\\"		troff or preprocessor input text
0	string		\\"		troff or preprocessor input text

# ditroff intermediate output text
0	string		x\ T		ditroff text
>4	string		cat		for the C/A/T phototypesetter
>4	string		ps		for PostScript
>4	string		dvi		for DVI
>4	string		ascii		for ASCII
>4	string		lj4		for LaserJet 4
>4	string		latin1		for ISO 8859-1 (Latin 1)
>4	string		X75		for xditview at 75dpi
>>7	string		-12		(12pt)
>4	string		X100		for xditview at 100dpi
>>8	string		-12		(12pt)

# output data formats
0	string		\100\357	very old (C/A/T) troff output data

#------------------------------------------------------------------------------
# typeset:  file(1) magic for other typesetting
#
0	string		Interpress/Xerox	Xerox InterPress data
>16	string		/			(version
>>17	string		>\0			%s)

#------------------------------------------------------------------------------
# unknown:  file(1) magic for unknown machines
#
# XXX - this probably should be pruned, as it'll match PDP-11 and
# VAX image formats.
#
# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
# respectively).
#
# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
# have the "version %ld", which may be a bogus COFFism (I don't think
# there ever was COFF for the PDP-11).
#
# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
# long, as it would be on a VAX.
#
# 0x10C is 0414, 0x10D is 0415, and 0x10E is 416; those *are* unknown.
#
0	short		0x107		unknown machine executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x108		unknown pure executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x109		PDP-11 separate I&D
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x10b		unknown pure executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	long		0x10c		unknown demand paged pure executable
>16	long		>0		not stripped
0	long		0x10d		unknown demand paged pure executable
>16	long		>0		not stripped
0	long		0x10e		unknown readable demand paged pure executable

#------------------------------------------------------------------------------
# uuencode:  file(1) magic for ASCII-encoded files
#

# GRR:  the first line of xxencoded files is identical to that in uuencoded
# files, but the first character in most subsequent lines is 'h' instead of
# 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
# punctuation and survives BITNET gateways better.)  If regular expressions
# were supported, this entry could possibly be split into two with
# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
0	string		begin\040	uuencoded or xxencoded text

# btoa(1) is an alternative to uuencode that requires less space.
0	string		xbtoa\ Begin	btoa'd text

# ship(1) is another, much cooler alternative to uuencode.
# Greg Roelofs, newt@uchicago.edu
0	string		$\012ship	ship'd binary text

# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
# Greg Roelofs, newt@uchicago.edu
0	string	Decode\ the\ following\ with\ bdeco	bencoded News text

# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@yggdrasil.com
11	string	must\ be\ converted\ with\ BinHex	BinHex binary text
>41	string	x					\b, version %.3s

# GRR:  is MIME BASE64 encoding handled somewhere?

#------------------------------------------------------------------------------
# varied.out:  file(1) magic for various USG systems
#
#	Herewith many of the object file formats used by USG systems.
#	Most have been moved to files for a particular processor,
#	and deleted if they duplicate other entries.
#
0	short		0610		Perkin-Elmer executable
# AMD 29K
0	beshort		0572		amd 29k coff noprebar executable
0	beshort		01572		amd 29k coff prebar executable
0	beshort		0160007		amd 29k coff archive
# Cray
6	beshort		0407		unicos (cray) executable
# Ultrix 4.3
596	string		\130\337\377\377	Ultrix core file
>600	string		>\0	'%s'

#------------------------------------------------------------------------------
# vax:  file(1) magic for VAX executable/object and APL workspace
#
0	lelong		0101557		VAX single precision APL workspace
0	lelong		0101556		VAX double precision APL workspace

#
# VAX a.out (32V, BSD)
#
0	lelong		0407		VAX executable
>16	lelong		>0		not stripped

0	lelong		0410		VAX pure executable
>16	lelong		>0		not stripped

0	lelong		0413		VAX demand paged pure executable
>16	lelong		>0		not stripped

0	lelong		0420		VAX demand paged (first page unmapped) pure executable
>16	lelong		>0		not stripped

#
# VAX COFF
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0	leshort		0570		VAX COFF executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld
0	leshort		0575		VAX COFF pure executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld

#------------------------------------------------------------------------------
# visx:  file(1) magic for Visx format files
#
0	short		0x5555		VISX image file
>2	byte		0		(zero)
>2	byte		1		(unsigned char)
>2	byte		2		(short integer)
>2	byte		3		(float 32)
>2	byte		4		(float 64)
>2	byte		5		(signed char)
>2	byte		6		(bit-plane)
>2	byte		7		(classes)
>2	byte		8		(statistics)
>2	byte		10		(ascii text)
>2	byte		15		(image segments)
>2	byte		100		(image set)
>2	byte		101		(unsigned char vector)
>2	byte		102		(short integer vector)
>2	byte		103		(float 32 vector)
>2	byte		104		(float 64 vector)
>2	byte		105		(signed char vector)
>2	byte		106		(bit plane vector)
>2	byte		121		(feature vector)
>2	byte		122		(feature vector library)
>2	byte		124		(chain code)
>2	byte		126		(bit vector)
>2	byte		130		(graph)
>2	byte		131		(adjacency graph)
>2	byte		132		(adjacency graph library)
>2	string		.VISIX		(ascii text)

#------------------------------------------------------------------------------
# vms:  file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)

# GRR 950122:  I'm just guessing on these, based on inspection of the headers
# of three executables each for Alpha and VAX architectures.  The VAX files
# all had headers similar to this:
#
#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
#
0	string	\xb0\0\x30\0	VMS VAX executable
>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#
# The AXP files all looked like this, except that the byte at offset 0x22
# was 06 in some of them and 07 in others:
#
#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
#
0	belong	0x03000000	VMS Alpha executable
>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#	$OpenBSD: wordperfect,v 1.3 2001/01/29 01:57:58 niklas Exp $

#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
0	string	\377WPC\020\000\000\000\022\012\001\001\000\000\000\000	(WP) loadable text
>15	byte		0		Optimized for Intel
>15	byte		1		Optimized for Non-Intel
1	string		WPC		(Corel/WP)
>8	beshort		257		WordPerfect macro
>8	beshort		258		WordPerfect help file
>8	beshort		259		WordPerfect keyboard file
>8	beshort		266		WordPerfect document
>8	beshort		267		WordPerfect dictionary
>8	beshort		268		WordPerfect thesaurus
>8	beshort		269		WordPerfect block
>8	beshort		270		WordPerfect rectangular block
>8	beshort		271		WordPerfect column block
>8	beshort		272		WordPerfect printer data
>8	beshort		275		WordPerfect printer data
>8	beshort		276		WordPerfect driver resource data
>8	beshort		279		WordPerfect hyphenation code
>8	beshort		280		WordPerfect hyphenation data
>8	beshort		281		WordPerfect macro resource data
>8	beshort		283		WordPerfect hyphenation lex
>8	beshort		285		WordPerfect wordlist
>8	beshort		286		WordPerfect equation resource data
>8	beshort		289		WordPerfect spell rules
>8	beshort		290		WordPerfect dictionary rules
>8	beshort		295		WordPerfect spell rules (Microlytics)
>8	beshort		299		WordPerfect settings file
>8	beshort		301		WordPerfect 4.2 document
>8	beshort		325		WordPerfect dialog file
>8	beshort		332		WordPerfect button bar
>8	beshort		513		Shell macro
>8	beshort		522		Shell definition
>8	beshort		769		Notebook macro
>8	beshort		770		Notebook help file
>8	beshort		771		Notebook keyboard file
>8	beshort		778		Notebook definition
>8	beshort		1026	Calculator help file
>8	beshort 		1538	Calendar help file
>8	beshort 		1546	Calendar data file
>8	beshort		1793	Editor macro
>8	beshort		1794	Editor help file
>8	beshort		1795	Editor keyboard file
>8	beshort		1817	Editor macro resource file
>8	beshort 		2049	Macro editor macro
>8	beshort 		2050	Macro editor help file
>8	beshort		2051	Macro editor keyboard file
>8	beshort		2305	PlanPerfect macro
>8	beshort		2306	PlanPerfect help file
>8	beshort		2307	PlanPerfect keyboard file
>8	beshort		2314	PlanPerfect worksheet
>8	beshort		2319	PlanPerfect printer definition
>8	beshort		2322	PlanPerfect graphic definition
>8	beshort		2323	PlanPerfect data
>8	beshort		2324	PlanPerfect temporary printer
>8	beshort		2329	PlanPerfect macro resource data
>8	byte		11		Mail
>8	beshort		2818	help file
>8	beshort		2821	distribution list
>8	beshort		2826	out box
>8	beshort		2827	in box
>8	beshort		2836	users archived mailbox
>8	beshort		2837	archived message database
>8	beshort		2838	archived attachments
>8	beshort		3083	Printer temporary file
>8	beshort		3330	Scheduler help file
>8	beshort		3338	Scheduler in file
>8	beshort		3339	Scheduler out file
>8	beshort		3594	GroupWise settings file
>8	beshort		3601	GroupWise directory services
>8	beshort		3627	GroupWise settings file
>8	beshort		4362	Terminal resource data
>8	beshort		4363	Terminal resource data
>8	beshort		4395	Terminal resource data
>8	beshort		4619	GUI loadable text
>8	beshort		4620	graphics resource data
>8	beshort		4621	printer settings file
>8	beshort		4622	port definition file
>8	beshort		4623	print queue parameters
>8	beshort		4624	compressed file
>8	beshort		5130	Network service msg file
>8	beshort		5131	Network service msg file
>8	beshort		5132	Async gateway login msg
>8	beshort		5134	GroupWise message file
>8	beshort		7956	GroupWise admin domain database
>8	beshort		7957	GroupWise admin host database
>8	beshort		7959	GroupWise admin remote host database
>8	beshort		7960	GroupWise admin ADS deferment data file
>8	beshort		8458	IntelliTAG (SGML) compiled DTD
>8	belong	18219264	WordPerfect graphic image (1.0)
>8	belong	18219520	WordPerfect graphic image (2.0)
#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE

#------------------------------------------------------------------------------
# xenix:  file(1) magic for Microsoft Xenix
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
# model" lifted from "magic.xenix", with comment "derived empirically;
# treat as folklore until proven"
#
# "small model", "large model", "huge model" stuff lifted from XXX
#
# XXX - "x.out" collides with PDP-11 archives
#
0	string		core		core file (Xenix)
0	byte		0x80		8086 relocatable (Microsoft)
0	leshort		0xff65		x.out
>2	string		__.SYMDEF	 randomized
>0	byte		x		archive
0	leshort		0x206		Microsoft a.out
>8	leshort		1		Middle model
>0x1e	leshort		&0x10		overlay
>0x1e	leshort		&0x2		separate
>0x1e	leshort		&0x4		pure
>0x1e	leshort		&0x800		segmented
>0x1e	leshort		&0x400		standalone
>0x1e	leshort		&0x8		fixed-stack
>0x1c	byte		&0x80		byte-swapped
>0x1c	byte		&0x40		word-swapped
>0x10	lelong		>0		not-stripped
>0x1e	leshort		^0xc000		pre-SysV
>0x1e	leshort		&0x4000		V2.3
>0x1e	leshort		&0x8000		V3.0
>0x1c	byte		&0x4		86
>0x1c	byte		&0xb		186
>0x1c	byte		&0x9		286
>0x1c	byte		&0xa		386
>0x1f	byte		<0x040		small model
>0x1f	byte		=0x048		large model	
>0x1f	byte		=0x049		huge model 
>0x1e	leshort		&0x1		executable
>0x1e	leshort		^0x1		object file
>0x1e	leshort		&0x40		Large Text
>0x1e	leshort		&0x20		Large Data
>0x1e	leshort		&0x120		Huge Objects Enabled
>0x10	lelong		>0		not stripped

0	leshort		0x140		old Microsoft 8086 x.out
>0x3	byte		&0x4		separate
>0x3	byte		&0x2		pure
>0	byte		&0x1		executable
>0	byte		^0x1		relocatable
>0x14	lelong		>0		not stripped

0	lelong		0x206		b.out
>0x1e	leshort		&0x10		overlay
>0x1e	leshort		&0x2		separate
>0x1e	leshort		&0x4		pure
>0x1e	leshort		&0x800		segmented
>0x1e	leshort		&0x400		standalone
>0x1e	leshort		&0x1		executable
>0x1e	leshort		^0x1		object file
>0x1e	leshort		&0x4000		V2.3
>0x1e	leshort		&0x8000		V3.0
>0x1c	byte		&0x4		86
>0x1c	byte		&0xb		186
>0x1c	byte		&0x9		286
>0x1c	byte		&0x29		286
>0x1c	byte		&0xa		386
>0x1e	leshort		&0x4		Large Text
>0x1e	leshort		&0x2		Large Data
>0x1e	leshort		&0x102		Huge Objects Enabled

0	leshort		0x580		XENIX 8086 relocatable or 80286 small model

#------------------------------------------------------------------------------
# zilog:  file(1) magic for Zilog Z8000.
#
# Was it big-endian or little-endian?  My Product Specification doesn't
# say.
#
0	long		0xe807		object file (z8000 a.out)
0	long		0xe808		pure object file (z8000 a.out)
0	long		0xe809		separate object file (z8000 a.out)
0	long		0xe805		overlay object file (z8000 a.out)

#------------------------------------------------------------------------------
# zyxel:  file(1) magic for ZyXEL modems
#
# From <rob@pe1chl.ampr.org>
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
# ZyXEL-defined standard)

0	string		ZyXEL\002	ZyXEL voice data
>10	byte		0		- CELP encoding
>10	byte&0x0B	1		- ADPCM2 encoding
>10	byte&0x0B	2		- ADPCM3 encoding
>10	byte&0x0B	3		- ADPCM4 encoding
>10	byte&0x0B	8		- New ADPCM3 encoding
>10	byte&0x04	4		with resync
