Commit | Line | Data |
---|---|---|
66a734b3 WJ |
1 | ..TH MAGIC FILES "Public Domain" |
2 | ..\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems. | |
3 | ..SH NAME | |
4 | magic \- file command's magic number file | |
5 | ..SH DESCRIPTION | |
6 | The | |
7 | ..IR file (1) | |
8 | command identifies the type of a file using, | |
9 | among other tests, | |
10 | a test for whether the file begins with a certain | |
11 | ..IR "magic number" . | |
12 | The file | |
13 | ..B /etc/magic | |
14 | specifies what magic numbers are to be tested for, | |
15 | what message to print if a particular magic number is found, | |
16 | and additional information to extract from the file. | |
17 | ..PP | |
18 | Each line of the file specifies a test to be performed. | |
19 | A test compares the data starting at a particular offset | |
20 | in the file with a 1-byte, 2-byte, or 4-byte numeric value or | |
21 | a string. If the test succeeds, a message is printed. | |
22 | The line consists of the following fields: | |
23 | ..IP offset \w'message'u+2n | |
24 | A number specifying the offset, in bytes, into the file of the data | |
25 | which is to be tested. | |
26 | ..IP type | |
27 | The type of the data to be tested. The possible values are: | |
28 | ..RS | |
29 | ..IP byte \w'message'u+2n | |
30 | A one-byte value. | |
31 | ..IP short | |
32 | A two-byte value (on most systems). | |
33 | ..IP long | |
34 | A four-byte value (on most systems). | |
35 | ..IP string | |
36 | A string of bytes. | |
37 | ..RE | |
38 | ..IP test | |
39 | The value to be compared with the value from the file. If the type is | |
40 | numeric, this value | |
41 | is specified in C form; if it is a string, it is specified as a C string | |
42 | with the usual escapes permitted (e.g. \en for new-line). | |
43 | ..IP | |
44 | Numeric values | |
45 | may be preceded by a character indicating the operation to be performed. | |
46 | It may be | |
47 | ..BR = , | |
48 | to specify that the value from the file must equal the specified value, | |
49 | ..BR < , | |
50 | to specify that the value from the file must be less than the specified | |
51 | value, | |
52 | ..BR > , | |
53 | to specify that the value from the file must be greater than the specified | |
54 | value, | |
55 | or | |
56 | ..BR & , | |
57 | to specify that the value is to be AND'ed with the | |
58 | numeric value before any comparisons are done. | |
59 | Numeric values are specified in C form; e.g. | |
60 | ..B 13 | |
61 | is decimal, | |
62 | ..B 013 | |
63 | is octal, and | |
64 | ..B 0x13 | |
65 | is hexadecimal. | |
66 | to specify that any value will match. If the character | |
67 | is omitted, it is assumed to be | |
68 | ..BR = . | |
69 | ..IP | |
70 | For string values, the byte string from the | |
71 | file must match the specified byte string. | |
72 | The operators =, < and > (but not &) can be applied to strings. | |
73 | The length used for matching is that of the string argument | |
74 | in the magic file. | |
75 | ..IP message | |
76 | The message to be printed if the comparison succeeds. If the string | |
77 | contains a | |
78 | ..IR printf (3S) | |
79 | format specification, the value from the file (with any specified masking | |
80 | performed) is printed using the message as the format string. | |
81 | ..PP | |
82 | Some file formats contain additional information which is to be printed | |
83 | along with the file type. A line which begins with the character | |
84 | ..B > | |
85 | indicates additional tests and messages to be printed. If the test on the | |
86 | line preceding the first line with a | |
87 | ..B > | |
88 | succeeds, the tests specified in all the subsequent lines beginning with | |
89 | ..B > | |
90 | are performed, and the messages printed if the tests succeed. The next | |
91 | line which does not begin with a | |
92 | ..B > | |
93 | terminates this. | |
94 | ..SH BUGS | |
95 | The formats | |
96 | ..I long | |
97 | and | |
98 | ..I short | |
99 | are system-dependant; perhaps they should be specified as a number | |
100 | of bytes (2B, 4B, etc), | |
101 | since the files being recognized typically come from | |
102 | a system on which the lengths are invariant. | |
103 | ..PP | |
104 | There should be more than one level of subtests, | |
105 | with the level possibly indicated by | |
106 | the number of | |
107 | ..B > | |
108 | at the beginning of the line. | |
109 | ..SH SEE ALSO | |
110 | ..IR file (1) | |
111 | \- the command that reads this file. | |
112 | ..\" | |
113 | ..\" From: guy@sun.uucp (Guy Harris) | |
114 | ..\" Newsgroups: net.bugs.usg | |
115 | ..\" Subject: /etc/magic's format isn't well documented | |
116 | ..\" Message-ID: <2752@sun.uucp> | |
117 | ..\" Date: 3 Sep 85 08:19:07 GMT | |
118 | ..\" Organization: Sun Microsystems, Inc. | |
119 | ..\" Lines: 136 | |
120 | ..\" | |
121 | ..\" Here's a manual page for the format accepted by the "file" made by adding | |
122 | ..\" the changes I posted to the S5R2 version. | |
123 | ..\" | |
124 | ..\" Modified for Ian Darwin's version of the file command. | |
125 | ..\" @(#)$Header: magic.4,v 1.5 87/11/06 20:54:31 ian Exp $ |