#! file # Magic data for file(1) command. # Machine-genererated from src/cmd/file/magdir/*; edit there only! # Format is described in magic(files), where: # files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID. # Add any locally-observed files here. Remember: # text if readable, executable if runnable binary, data if unreadable. 22 short 023000 core dump data 0 byte 26 'arc' archive >1 byte 0 (empty) >1 byte 1 (old format) 0 short 070707 cpio archive 0 string 070707 ASCII cpio archive 0 long 0177555 very old archive 0 short 0177555 very old PDP-11 archive 0 long 0177545 old archive 0 short 0177545 old PDP-11 archive 0 long 0100554 apl workspace 0 string = archive 0 string ! archive >8 string __.SYMDEF random library 0 string -h- archive (Software Tools format) text # this first will upset you if you're a PL/1 shop... # in which case rm it; ascmagic will catch real C programs 0 string /* c program text # check for various C program generators... # offsets derived empirically, your offsets may vary! # (this obviously belongs in ascmagic.c/names.h!). 53 string yyprevious c program text (from lex) 0 string #!\ /bin/sh commands text 0 string #!/bin/sh commands text 0 string #!\ /bin/csh C shell commands text 0 string #!/bin/csh C shell commands text 0 string #!\ /bin/awk awk commands text 0 string #!/bin/awk awk commands text 0 string #!\ / some kinda commands text 0 string #!/ some kinda commands text 0 string #!\ commands text >3 string >\0 for %s # An "antique" kernel is either unmodified early V7, # without DMR's 1979 mod for #!, or any kernel # derived from a pre-v7 kernel (i.e., System V) 0 string :\ shell archive or commands for antique kernel text 0 short 017037 packed data # CPL - added pack to /etc/magic 0 short 017436 packed data 0 short 0145405 huf output 0 string \037\235 compressed data # non block compressed >2 byte 12 - with 12 bits >2 byte 13 - with 13 bits >2 byte 14 - with 14 bits >2 byte 15 - with 15 bits >2 byte 16 - with 16 bits # block compressed >2 byte 140 - with 12 bits >2 byte 141 - with 13 bits >2 byte 142 - with 14 bits >2 byte 143 - with 15 bits >2 byte 144 - with 16 bits 0 long 0513 Convex executable # # magic file lines for output from "diff"... 0 string diff\ 'diff' output text 0 string ***\ 'diff' output text 0 string Only\ in\ 'diff' output text 0 string Common\ subdirectories:\ 'diff' output text # Magic numbers for ditroff intermediate language 0 string x\ T\ cat titroff output for the C/A/T text 0 string x\ T\ ps titroff output for PostScript 0 string x\ T titroff output text 0 string FONT ASCII vfont text 0 short 0436 Berkeley vfont data 0 short 017001 byte-swapped Berkeley vfont data # Magic number for FrameMaker files # Thanks to Berry Kercheval # 0 string \10 string language\ impress (imPRESS data) >10 string language\ daisy (daisywheel text) >10 string language\ diablo (daisywheel text) >10 string language\ printer (line printer emulation) >10 string language\ tektronix (Tektronix 4014 emulation) # Add any other languages that your Imagen uses - remember # to keep the word `text' if the file is human-readable. # # Now magic for IMAGEN font files... 0 string Rast RST-format raster font data >45 string >0 face % # various intel-CPU magic numbers 0 short 01006 80286 executable (STL) >31 byte <0x040 small model >31 byte =0x048 large model >31 byte =0x049 huge model >16 long >0 not stripped 0 string MZ DOS executable (EXE) 0 string LZ DOS executable (built-in) 0 byte 0xe9 DOS executable (COM) 0 byte 0xeb DOS executable (COM) 0 short =0512 80286 executable small model (COFF) >12 long >0 not stripped >22 short >0 - version %ld 0 short =0522 80286 executable large model (COFF) >12 long >0 not stripped >22 short >0 - version %ld 0 short =0514 80386 executable >12 long >0 not stripped >22 short >0 - version %ld 0 string #magic magic text file for file(1) cmd # Unfortunately, saved netnews also has From line added in some news software. #0 string From mail text # There are tests to ascmagic.c to cope with mail and news. 0 string Relay-Version: old news text 0 string #!\ rnews batched news text 0 string N#!\ rnews mailed, batched news text 0 string Forward\ to mail forwarding text 0 string Pipe\ to mail piping text 0 string Return-Path: smtp mail text 0 string Path: news text 0 string Xref: news text 0 string From: news or mail text 0 string Article saved news text 0 long 31415 Mirage Assembler m.out executable 0 string begin uuencoded mail text # derived empirically, your offsets may vary! 53 string yyprevious c program text (from lex) 0 long 0407 executable >16 long >0 not stripped #>2 short >0 - version %ld 0 short 0407 PDP-11 executable >8 short >0 not stripped 0 short 0401 unix-rt ldp 0 short 0405 old overlay 0 long 0410 pure executable >16 long >0 not stripped #>2 short >0 - version %ld 0 short 0410 PDP-11 pure executable >8 short >0 not stripped #>2 short >0 - version %ld 0 short 0411 PDP-11 separate I&D executable >8 short >0 not stripped #>2 short >0 - version %ld 0 long 0413 demand paged pure executable >16 long >0 not stripped #>2 short >0 - version %ld 0 long 0420 demand paged (first page unmapped) pure executable >16 long >0 not stripped #>2 short >0 - version %ld 0 short 0437 pdp11 kernel overlay # # Let us not forget PostScript 0 string %! PostScript text >2 string PS-Adobe- conforming >11 string 1.0 at level %s # Sun rasterfiles 0 string \x59\xa6\x6a\x95 rasterfile >4 long >0 %d >8 long >0 x %d >12 long >0 x %d >20 long 0 old format >20 long 2 compressed >24 long 1 with color map # SCCS archive structure: # \001h01207 # \001s 00276/00000/00000 # \001d D 1.1 87/09/23 08:09:20 ian 1 0 # \001c date and time created 87/09/23 08:09:20 by ian # \001e # \001u # \001U # ... etc. # Now '\001h' happens to be the same as the 3B20's a.out magic number (0550). # *Sigh*. And these both came from various parts of the USG. # Maybe we should just switch everybody from SCCS to RCS! # Further, you can't just say '\001h0', because the five-digit number # is a checksum that could (presumably) have any leading digit, # and we don't have regular expression matching yet. # Hence the following official kludge: 8 string \001s\ SCCS archive. # For Sequent's multiprocessor systems (incomplete). 0 long 000352 BALANCE NS32000 .o 0 long 010352 BALANCE NS32000 executable (0 @ 0) >16 long >0 not stripped 0 long 020352 BALANCE NS32000 executable (invalid @ 0) >16 long >0 not stripped 0 long 030352 BALANCE NS32000 standalone executable >16 long >0 not stripped # Also need info on Sequent "Symmetry" series... # SoftQuad troff magic numbers # SoftQuad @(#)magic 1.2 86/09/15 0 short 0125252 SoftQuad DESC or font file binary >2 short >0 - version %d # Values for Sun MC680x0 binaries 0 short 2 mc68020 >2 short 0407 executable >2 short 0410 pure executable >2 short 0413 demand paged executable >16 long >0 not stripped 0 short 1 mc68010 >2 short 0407 executable >2 short 0410 pure executable >2 short 0413 demand paged executable >16 long >0 not stripped 0 short 0 old sun-2 >2 short 0407 executable >2 short 0410 pure executable >2 short 0413 demand paged executable >16 long >0 not stripped 0 long 0x080456 core file >128 string >0 from '%s' # 0 short 05401 byte-swapped demand paged executable 0 short 010001 byte-swapped demand paged executable # NCR Tower objects, contributed by # Michael R. Wayne *** TMC & Associates *** INTERNET: wayne@ford-vax.arpa # uucp: {philabs | pyramid} !fmsrl7!wayne OR wayne@fmsrl7.UUCP # 0 short 000610 Tower/XP rel 2 object >12 long >0 not stripped >20 short 0407 executable >20 short 0410 pure executable >22 short >0 -version %ld 0 short 000615 Tower/XP rel 2 object >12 long >0 not stripped >20 short 0407 executable >20 short 0410 pure executable >22 short >0 -version %ld 0 short 000620 Tower/XP rel 3 object >12 long >0 not stripped >20 short 0407 executable >20 short 0410 pure executable >22 short >0 -version %ld 0 short 000625 Tower/XP rel 3 object >12 long >0 not stripped >20 short 0407 executable >20 short 0410 pure executable >22 short >0 -version %ld 0 short 000630 Tower32/600/400 68020 object >12 long >0 not stripped >20 short 0407 executable >20 short 0410 pure executable >22 short >0 -version %ld 0 short 000640 Tower32/800 68020 >18 short &020000 w/68881 object >18 short &040000 compatible object >18 short &~060000 object >20 short 0407 executable >20 short 0413 pure executable >12 long >0 not stripped >22 short >0 -version %ld 0 short 000645 Tower32/800 68010 >18 short &040000 compatible object >18 short &~060000 object >20 short 0407 executable >20 short 0413 pure executable >12 long >0 not stripped >22 short >0 -version %ld # other typesetting magic 0 string \100\357 very old (C/A/T) troff output data 0 string Interpress/Xerox Xerox InterPress data # Herewith many of the object file formats used by USG systems. # The `versions' should be un-commented if they work for you. 0 short 0570 SysV executable >12 long >0 not stripped #>22 short >0 - version %ld 0 short 0575 SysV pure executable >12 long >0 not stripped #>22 short >0 - version %ld 0 short 0502 basic-16 executable >12 long >0 not stripped 0 short 0503 basic-16 executable (TV) >12 long >0 not stripped 0 short 0510 x86 executable >12 long >0 not stripped 0 short 0511 x86 executable (TV) >12 long >0 not stripped 0 short 0550 3b20 executable >12 long >0 not stripped 0 short 0551 3b20 executable (TV) >12 long >0 not stripped 0 short 0560 WE32000 executable >12 long >0 not stripped 0 short 0561 WE32000 executable (TV) >12 long >0 not stripped 0 short 0610 Perkin-Elmer executable # Byte-swapped VAXen # From: dupuy@amsterdam.columbia.edu (Alexander Dupuy) # # Here are a few lines you can add to /etc/magic on your sun workstations in # order to recognize VAX executables and objects.... you could do something # similar (in reverse) for your vaxen, but since 4.3+NFS' file(1) doesn't look # for /etc/magic, I've never bothered. It really should be built in to file(1) # so you would see the state of setuid/setgid/sticky bits. Or actually, there # should be support for checking that sort of thing in /etc/magic. # 0 long 00700200000 VAX executable >16 long &0x7fffffff not stripped 0 long 01000200000 VAX pure executable >16 long &0x7fffffff not stripped 0 long 01300200000 VAX demand-paged pure executable >16 long &0x7fffffff not stripped 0 long 01100200000 PDP-11 executable # XENIX executable formats: derived empirically; treat as folklore until proven0 short 01006 XENIX (x.out) executable >8 short 1 Middle model >16 short >0 not stripped 0 short 02600 XENIX 8086 relocatable or 80286 small model