Commit | Line | Data |
---|---|---|
ed554bc5 C |
1 | .TH MAGIC __SECTION__ "Public Domain" |
2 | .\" install as magic.4 on USG, magic.5 on V7 or Berkeley systems. | |
3 | .SH NAME | |
4 | magic \- file command's magic number file | |
5 | .SH DESCRIPTION | |
6 | The | |
7 | .IR file (1) | |
8 | command identifies the type of a file using, | |
9 | among other tests, | |
10 | a test for whether the file begins with a certain | |
11 | .IR "magic number" . | |
12 | The file | |
13 | .B __MAGIC__ | |
14 | specifies what magic numbers are to be tested for, | |
15 | what message to print if a particular magic number is found, | |
16 | and additional information to extract from the file. | |
17 | .PP | |
18 | Each line of the file specifies a test to be performed. | |
19 | A test compares the data starting at a particular offset | |
20 | in the file with a 1-byte, 2-byte, or 4-byte numeric value or | |
21 | a string. If the test succeeds, a message is printed. | |
22 | The line consists of the following fields: | |
23 | .IP offset \w'message'u+2n | |
24 | A number specifying the offset, in bytes, into the file of the data | |
25 | which is to be tested. | |
26 | .IP type | |
27 | The type of the data to be tested. The possible values are: | |
28 | .RS | |
29 | .IP byte \w'message'u+2n | |
30 | A one-byte value. | |
31 | .IP short | |
32 | A two-byte value (on most systems) in this machine's native byte order. | |
33 | .IP long | |
34 | A four-byte value (on most systems) in this machine's native byte order. | |
35 | .IP string | |
36 | A string of bytes. | |
37 | .IP date | |
38 | A four-byte value interpreted as a unix date. | |
39 | .IP beshort | |
40 | A two-byte value (on most systems) in big-endian byte order. | |
41 | .IP belong | |
42 | A four-byte value (on most systems) in big-endian byte order. | |
43 | .IP bedate | |
44 | A four-byte value (on most systems) in big-endian byte order, | |
45 | interpreted as a unix date. | |
46 | .IP leshort | |
47 | A two-byte value (on most systems) in little-endian byte order. | |
48 | .IP lelong | |
49 | A four-byte value (on most systems) in little-endian byte order. | |
50 | .IP ledate | |
51 | A four-byte value (on most systems) in little-endian byte order, | |
52 | interpreted as a unix date. | |
53 | .RE | |
54 | The numeric types may optionally be followed by | |
55 | .B & | |
56 | and a numeric value, | |
57 | to specify that the value is to be AND'ed with the | |
58 | numeric value before any comparisons are done. | |
59 | .IP test | |
60 | The value to be compared with the value from the file. If the type is | |
61 | numeric, this value | |
62 | is specified in C form; if it is a string, it is specified as a C string | |
63 | with the usual escapes permitted (e.g. \en for new-line). | |
64 | .IP | |
65 | Numeric values | |
66 | may be preceded by a character indicating the operation to be performed. | |
67 | It may be | |
68 | .BR = , | |
69 | to specify that the value from the file must equal the specified value, | |
70 | .BR < , | |
71 | to specify that the value from the file must be less than the specified | |
72 | value, | |
73 | .BR > , | |
74 | to specify that the value from the file must be greater than the specified | |
75 | value, | |
76 | .BR & , | |
77 | to specify that the value from the file must have set all of the bits | |
78 | that are set in the specified value, | |
79 | or | |
80 | .BR ^ , | |
81 | to specify that the value from the file must have clear any of the bits | |
82 | that are set in the specified value. | |
83 | .IP | |
84 | Numeric values are specified in C form; e.g. | |
85 | .B 13 | |
86 | is decimal, | |
87 | .B 013 | |
88 | is octal, and | |
89 | .B 0x13 | |
90 | is hexadecimal. | |
91 | to specify that any value will match. If the character | |
92 | is omitted, it is assumed to be | |
93 | .BR = . | |
94 | .IP | |
95 | For string values, the byte string from the | |
96 | file must match the specified byte string. | |
97 | The operators | |
98 | .BR = , | |
99 | .B < | |
100 | and | |
101 | .B > | |
102 | (but not | |
103 | .BR & ) | |
104 | can be applied to strings. | |
105 | The length used for matching is that of the string argument | |
106 | in the magic file. This means that a line can match any string, and | |
107 | then presumably print that string, by doing | |
108 | .B >\e0 | |
109 | (because all strings are greater than the null string). | |
110 | .IP message | |
111 | The message to be printed if the comparison succeeds. If the string | |
112 | contains a | |
113 | .IR printf (3S) | |
114 | format specification, the value from the file (with any specified masking | |
115 | performed) is printed using the message as the format string. | |
116 | .PP | |
117 | Some file formats contain additional information which is to be printed | |
118 | along with the file type. A line which begins with the character | |
119 | .B > | |
120 | indicates additional tests and messages to be printed. The number of | |
121 | .B > | |
122 | on the line indicates the level of the test; a line with no | |
123 | .B > | |
124 | at the beginning is considered to be at level 0. | |
125 | Each line at level | |
126 | .IB n \(pl1 | |
127 | is under the control of the line at level | |
128 | .IB n | |
129 | most closely preceding it in the magic file. | |
130 | If the test on a line at level | |
131 | .I n | |
132 | succeeds, the tests specified in all the subsequent lines at level | |
133 | .IB n \(pl1 | |
134 | are performed, and the messages printed if the tests succeed. The next | |
135 | line at level | |
136 | .I n | |
137 | terminates this. | |
138 | If the first character following the last | |
139 | .B > | |
140 | is a | |
141 | .B ( | |
142 | then the string after the parenthesis is interpreted as an indirect offset. | |
143 | That means that the number after the parenthesis is used as a offset in | |
144 | the file. The value at that offset is read, and is used again as an offset | |
145 | in the file. Indirect offsets are of the form: | |
146 | .BI (( x [.[bsl]][+-][ y ]). | |
147 | The value of | |
148 | .I x | |
149 | is used as an offset in the file. A byte, short or long is read at that offset | |
150 | depending on the | |
151 | .B [bsl] | |
152 | type specifier. To that number the value of | |
153 | .I y | |
154 | is added and the result is used as an offset in the file. The default type | |
155 | if one is not specified is long. | |
156 | .SH BUGS | |
157 | The formats | |
158 | .IR long , | |
159 | .IR belong , | |
160 | .IR lelong , | |
161 | .IR short , | |
162 | .IR beshort , | |
163 | .IR leshort , | |
164 | .IR date , | |
165 | .IR bedate , | |
166 | and | |
167 | .I ledate | |
168 | are system-dependant; perhaps they should be specified as a number | |
169 | of bytes (2B, 4B, etc), | |
170 | since the files being recognized typically come from | |
171 | a system on which the lengths are invariant. | |
172 | .PP | |
173 | There is (currently) no support for specified-endian data to be used in | |
174 | indirect offsets. | |
175 | .SH SEE ALSO | |
176 | .IR file (1) | |
177 | \- the command that reads this file. | |
178 | .\" | |
179 | .\" From: guy@sun.uucp (Guy Harris) | |
180 | .\" Newsgroups: net.bugs.usg | |
181 | .\" Subject: /etc/magic's format isn't well documented | |
182 | .\" Message-ID: <2752@sun.uucp> | |
183 | .\" Date: 3 Sep 85 08:19:07 GMT | |
184 | .\" Organization: Sun Microsystems, Inc. | |
185 | .\" Lines: 136 | |
186 | .\" | |
187 | .\" Here's a manual page for the format accepted by the "file" made by adding | |
188 | .\" the changes I posted to the S5R2 version. | |
189 | .\" | |
190 | .\" Modified for Ian Darwin's version of the file command. | |
191 | .\" @(#)$Id: magic.4,v 1.10 1993/02/19 14:22:46 ian Exp $ |