From: Peter Avalos Date: Sat, 11 Nov 2006 22:04:52 +0000 (+0000) Subject: Upgrade to file-4.18. X-Git-Tag: v2.0.1~4139^2 X-Git-Url: https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff_plain/9b22a626d0e4860ebfd3c7f67c3e6d2a4f375d68 Upgrade to file-4.18. --- diff --git a/contrib/file-4/ChangeLog b/contrib/file-4/ChangeLog index 7feae405e4..0117dcb417 100644 --- a/contrib/file-4/ChangeLog +++ b/contrib/file-4/ChangeLog @@ -1,3 +1,108 @@ +2006-10-31 15:14 Christos Zoulas + + * Check offset before copying (Mike Frysinger) + + * merge duplicated code + + * add quad date support + + * make sure that we nul terminate desc (Ryoji Kanai) + + * don't process elf notes multiple times + + * allow -z to report empty compressed files + + * use calloc to initialize the ascii buffers (Jos van den Oever) + +2006-06-08 11:11 Christos Zoulas + + * QNX fixes (Mike Gorchak) + + * Add quad support. + + * FIFO checks (Dr. Werner Fink) + + * Linux ELF fixes (Dr. Werner Fink) + + * Magic format checks (Dr. Werner Fink) + + * Magic format function improvent (Karl Chen) + +2006-05-03 11:11 Christos Zoulas + + * Pick up some elf changes and some constant fixes from SUSE + + * Identify gnu tar vs. posix tar + + * When keep going, don't print spurious newlines (Radek Vokál) + +2006-04-01 12:02 Christos Zoulas + + * Use calloc instead of malloc (Mike Frysinger) + + * Fix configure script to detect wctypes.h (Mike Frysinger) + +2006-03-02 16:06 Christos Zoulas + + * Print empty if the file is (Mike Frysinger) + + * Don't try to read past the end of the buffer (Mike Frysinger) + + * Sort magic entries by strength [experimental] + +2005-11-29 13:26 Christos Zoulas + + * Use iswprint() to convert the output string. + (Bastien Nocera) + +2005-10-31 8:54 Christos Zoulas + + * Fix regression where the core info was not completely processed + (Radek Vokál) + +2005-10-20 11:15 Christos Zoulas + + * Middle Endian magic (Diomidis Spinellis) + +2005-10-17 11:15 Christos Zoulas + + * Open with O_BINARY for CYGWIN (Corinna Vinschen) + + * Don't close stdin (Arkadiusz Miskiewicz) + + * Look for note sections in non executables. + +2005-09-20 13:33 Christos Zoulas + + * Don't print SVR4 Style in core files multiple times + (Radek Vokál) + +2005-08-27 04:09 Christos Zoulas + + * Cygwin changes Corinna Vinschen + +2005-08-18 09:53 Christos Zoulas + + * Remove erroreous mention of /etc/magic in the file man page + This is gentoo bug 101639. (Mike Frysinger) + + * Cross-compile support and detection (Mike Frysinger) + +2005-08-12 10:17 Christos Zoulas + + * Add -h flag and dereference symlinks if POSIXLY_CORRECT + is set. + +2005-07-29 13:57 Christos Zoulas + + * Avoid search and regex buffer overflows (Kelledin) + +2005-07-12 11:48 Christos Zoulas + + * Provide stub implementations for {v,}nsprintf() for older + OS's that don't have them. + * Change mbstate_t autoconf detection macro from AC_MBSTATE_T + to AC_TYPE_MBSTATE_T. 2005-06-25 11:48 Christos Zoulas diff --git a/contrib/file-4/LEGAL.NOTICE b/contrib/file-4/LEGAL.NOTICE index 0c2c719260..d1ea55641b 100644 --- a/contrib/file-4/LEGAL.NOTICE +++ b/contrib/file-4/LEGAL.NOTICE @@ -1,7 +1,7 @@ -$Id: LEGAL.NOTICE,v 1.14 2004/09/11 19:15:56 christos Exp $ +$Id: LEGAL.NOTICE,v 1.15 2006/05/03 18:48:33 christos Exp $ Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995. Software written by Ian F. Darwin and others; -maintained 1994-2004 Christos Zoulas. +maintained 1994- Christos Zoulas. This software is not subject to any export provision of the United States Department of Commerce, and may be exported to any country or planet. diff --git a/contrib/file-4/MAINT b/contrib/file-4/MAINT index c711117fb9..2a51470ddb 100644 --- a/contrib/file-4/MAINT +++ b/contrib/file-4/MAINT @@ -1,4 +1,4 @@ -$Id: MAINT,v 1.5 2003/03/23 04:36:37 christos Exp $ +$Id: MAINT,v 1.7 2006/06/01 18:19:41 ian Exp $ Maintenance notes: @@ -18,16 +18,38 @@ short. - Do not distribute changed versions. People trying to be helpful occasionally put up their hacked versions -of the file command for FTP, then the "archie" server finds and publishes -the hacked version, and people all over the world get copies of it. -Within a day or two I am getting email from around the world -asking me why "my" file command won't compile!!! Needless to say this -detracts from the limited time I have available to work on the actual -software. Therefore I ask you again to please NOT distribute -your changed version. - +of the file command for anonymous FTP, and people all over the +world get copies of the hacked versions. Within a day or two I am +getting email from around the world asking me why "my" file command +won't compile!!! Needless to say this detracts from the limited +time I have available to work on the actual software. Therefore I +ask you again to please NOT distribute your changed version. If +you need to make changes, please add a patch file next to the +distribution tar, and a README file that clearly explains what you +are trying to fix. Thank you for your assistance and cooperation. +Code Overview + +This is a rough idea of the control flow from the main program: + +file.c main() +file.c process (called for each file) + printf file name +magic.c magic_file() +fsmagic.c file_fsmagic() + (handles statbuf modes for DEV) + (handles statbuf modes for executable &c. + reads data from file. +funcs.c: file_buffer() +compress.c file_zmagic() +is_tar.c file_is_tar() +softmagic.c file_softmagic() + match() - looks for match against main magic database +ascmagic.c file_ascmagic() +readelf.c file_tryelf() + "unknown" + Christos Zoulas christos@astron.com diff --git a/contrib/file-4/README b/contrib/file-4/README index 0e97732c07..b4223f4b9c 100644 --- a/contrib/file-4/README +++ b/contrib/file-4/README @@ -1,5 +1,5 @@ ** README for file(1) Command ** -@(#) $Id: README,v 1.33 2003/05/23 21:31:56 christos Exp $ +@(#) $Id: README,v 1.34 2006/05/03 18:48:33 christos Exp $ This is Release 4.x of Ian Darwin's (copyright but distributable) file(1) command. This version is the standard "file" command for Linux, @@ -96,7 +96,8 @@ and does not exist any longer. From: Kees Zeelenberg -An MS-Windows (Win32) port of File-3.36 is available from +An MS-Windows (Win32) port of File-4.17 is available from http://gnuwin32.sourceforge.net/ + File is an implementation of the Unix File(1) command. It knows the 'magic number' of several thousands of file types. diff --git a/contrib/file-4/magic/Magdir/amigaos b/contrib/file-4/magic/Magdir/amigaos index ba2366c7ed..bb98299d89 100644 --- a/contrib/file-4/magic/Magdir/amigaos +++ b/contrib/file-4/magic/Magdir/amigaos @@ -42,6 +42,9 @@ 0 beshort 0x0f03 AmigaOS outline font 0 belong 0x80001001 AmigaOS outline tag 0 string ##\ version catalog translation +0 string EMOD\0 Amiga E module +8 string ECXM\0 ECX module +0 string/c @database AmigaGuide file # Amiga disk types # @@ -54,3 +57,7 @@ 0 string DOS\4 Amiga Fastdir DOS disk 0 string DOS\5 Amiga Fastdir FFS disk 0 string KICK Kickstart disk + +# From: Alex Beregszaszi +0 string LZX LZX compressed archive (Amiga) + diff --git a/contrib/file-4/magic/Magdir/animation b/contrib/file-4/magic/Magdir/animation index c6698306df..95c842ebea 100644 --- a/contrib/file-4/magic/Magdir/animation +++ b/contrib/file-4/magic/Magdir/animation @@ -320,31 +320,35 @@ #>3 byte&0x03 3 \b, NR: CCIT J.17 # MPA, M1A -0 beshort&0xFFFE 0xFFFE MPEG ADTS, layer I, v1 +# modified by Joerg Jenderek +# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448 +0 beshort&0xFFFE 0xFFFE +>2 byte&0xF0 >0x0F +>>2 byte&0xF0 <0xE1 MPEG ADTS, layer I, v1 # rate ->2 byte&0xF0 0x10 \b, 32 kBits ->2 byte&0xF0 0x20 \b, 64 kBits ->2 byte&0xF0 0x30 \b, 96 kBits ->2 byte&0xF0 0x40 \b, 128 kBits ->2 byte&0xF0 0x50 \b, 160 kBits ->2 byte&0xF0 0x60 \b, 192 kBits ->2 byte&0xF0 0x70 \b, 224 kBits ->2 byte&0xF0 0x80 \b, 256 kBits ->2 byte&0xF0 0x90 \b, 288 kBits ->2 byte&0xF0 0xA0 \b, 320 kBits ->2 byte&0xF0 0xB0 \b, 352 kBits ->2 byte&0xF0 0xC0 \b, 384 kBits ->2 byte&0xF0 0xD0 \b, 416 kBits ->2 byte&0xF0 0xE0 \b, 448 kBits +>>>2 byte&0xF0 0x10 \b, 32 kBits +>>>2 byte&0xF0 0x20 \b, 64 kBits +>>>2 byte&0xF0 0x30 \b, 96 kBits +>>>2 byte&0xF0 0x40 \b, 128 kBits +>>>2 byte&0xF0 0x50 \b, 160 kBits +>>>2 byte&0xF0 0x60 \b, 192 kBits +>>>2 byte&0xF0 0x70 \b, 224 kBits +>>>2 byte&0xF0 0x80 \b, 256 kBits +>>>2 byte&0xF0 0x90 \b, 288 kBits +>>>2 byte&0xF0 0xA0 \b, 320 kBits +>>>2 byte&0xF0 0xB0 \b, 352 kBits +>>>2 byte&0xF0 0xC0 \b, 384 kBits +>>>2 byte&0xF0 0xD0 \b, 416 kBits +>>>2 byte&0xF0 0xE0 \b, 448 kBits # timing ->2 byte&0x0C 0x00 \b, 44.1 kHz ->2 byte&0x0C 0x04 \b, 48 kHz ->2 byte&0x0C 0x08 \b, 32 kHz +>>>2 byte&0x0C 0x00 \b, 44.1 kHz +>>>2 byte&0x0C 0x04 \b, 48 kHz +>>>2 byte&0x0C 0x08 \b, 32 kHz # channels/options ->3 byte&0xC0 0x00 \b, Stereo ->3 byte&0xC0 0x40 \b, JntStereo ->3 byte&0xC0 0x80 \b, 2x Monaural ->3 byte&0xC0 0xC0 \b, Monaural +>>>3 byte&0xC0 0x00 \b, Stereo +>>>3 byte&0xC0 0x40 \b, JntStereo +>>>3 byte&0xC0 0x80 \b, 2x Monaural +>>>3 byte&0xC0 0xC0 \b, Monaural #>1 byte ^0x01 \b, Data Verify #>2 byte &0x02 \b, Packet Pad #>2 byte &0x01 \b, Custom Flag diff --git a/contrib/file-4/magic/Magdir/apple b/contrib/file-4/magic/Magdir/apple index ccbd155a6e..6d2a07b7b1 100644 --- a/contrib/file-4/magic/Magdir/apple +++ b/contrib/file-4/magic/Magdir/apple @@ -151,3 +151,41 @@ # From: Toby Peterson 0 string bplist00 Apple binary property list + +# Apple binary property list (bplist) +# Assumes version bytes are hex. +# Provides content hints for version 0 files. Assumes that the root +# object is the first object (true for CoreFoundation implementation). +# From: David Remahl +0 string bplist +>6 byte x \bCoreFoundation binary property list data, version 0x%c +>>7 byte x \b%c +>6 string 00 \b +>>8 byte&0xF0 0x00 \b +>>>8 byte&0x0F 0x00 \b, root type: null +>>>8 byte&0x0F 0x08 \b, root type: false boolean +>>>8 byte&0x0F 0x09 \b, root type: true boolean +>>8 byte&0xF0 0x10 \b, root type: integer +>>8 byte&0xF0 0x20 \b, root type: real +>>8 byte&0xF0 0x30 \b, root type: date +>>8 byte&0xF0 0x40 \b, root type: data +>>8 byte&0xF0 0x50 \b, root type: ascii string +>>8 byte&0xF0 0x60 \b, root type: unicode string +>>8 byte&0xF0 0x80 \b, root type: uid (CORRUPT) +>>8 byte&0xF0 0xa0 \b, root type: array +>>8 byte&0xF0 0xd0 \b, root type: dictionary + +# Apple/NeXT typedstream data +# Serialization format used by NeXT and Apple for various +# purposes in YellowStep/Cocoa, including some nib files. +# From: David Remahl +2 string typedstream NeXT/Apple typedstream data, big endian +>0 byte x \b, version %hhd +>0 byte <5 \b +>>13 byte 0x81 \b +>>>14 ubeshort x \b, system %hd +2 string streamtyped NeXT/Apple typedstream data, little endian +>0 byte x \b, version %hhd +>0 byte <5 \b +>>13 byte 0x81 \b +>>>14 uleshort x \b, system %hd diff --git a/contrib/file-4/magic/Magdir/archive b/contrib/file-4/magic/Magdir/archive index 7442072c9d..87c2f95cc9 100644 --- a/contrib/file-4/magic/Magdir/archive +++ b/contrib/file-4/magic/Magdir/archive @@ -33,8 +33,13 @@ >8 string debian-split part of multipart Debian package >8 string debian-binary Debian binary package >68 string >\0 (format %s) ->81 string bz2 \b, uses bzip2 compression ->84 string gz \b, uses gzip compression +# These next two lines do not work, because a bzip2 Debian archive +# still uses gzip for the control.tar (first in the archive). Only +# data.tar varies, and the location of its filename varies too. +# file/libmagic does not current have support for ascii-string based +# (offsets) as of 2005-09-15. +#>81 string bz2 \b, uses bzip2 compression +#>84 string gz \b, uses gzip compression #>136 ledate x created: %s # other archives @@ -130,10 +135,8 @@ # I can't create either SPARK or ArcFS archives so I have not tested this stuff # [GRR: the original entries collide with ARC, above; replaced with combined # version (not tested)] -#0 byte 0x1a RISC OS archive -#>1 string archive (ArcFS format) -#0 string \032archive RISC OS archive (ArcFS format) -0 string \032 RISC OS archive (spark format) +#0 byte 0x1a RISC OS archive (spark format) +0 string \032archive RISC OS archive (ArcFS format) 0 string Archive\000 RISC OS archive (ArcFS format) # All these were taken from idarc, many could not be verified. Unfortunately, @@ -223,6 +226,14 @@ 0 string PPMZ PPMZ archive data # MS Compress 4 string \x88\xf0\x27 MS Compress archive data +# updated by Joerg Jenderek +>9 string \0 +>>0 string KWAJ +>>>7 string \321\003 MS Compress archive data +>>>>14 ulong >0 \b, original size: %ld bytes +>>>>18 ubyte >0x65 +>>>>>18 string x \b, was %.8s +>>>>>(10.b-4) string x \b.%.3s # MP3 (archiver, not lossy audio compression) 0 string MP3\x1a MP3-Archiver archive data # ZET @@ -513,11 +524,68 @@ 0 string UC2\x1a UC2 archive data # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu) -0 string PK\003\004 Zip archive data ->4 byte 0x09 \b, at least v0.9 to extract ->4 byte 0x0a \b, at least v1.0 to extract ->4 byte 0x0b \b, at least v1.1 to extract ->4 byte 0x14 \b, at least v2.0 to extract +0 string PK\003\004 +>4 byte 0x09 Zip archive data, at least v0.9 to extract +>4 byte 0x0a Zip archive data, at least v1.0 to extract +>4 byte 0x0b Zip archive data, at least v1.1 to extract +>4 byte 0x14 +>>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract +>0x161 string WINZIP Zip archive data, WinZIP self-extracting + + +# OpenOffice.org / KOffice / StarOffice documents +# From: Abel Cheung +# Listed here because they are basically zip files +>>30 string mimetype + +# KOffice (1.2 or above) formats +>>>50 string vnd.kde. KOffice (>=1.2) +>>>>58 string karbon Karbon document +>>>>58 string kchart KChart document +>>>>58 string kformula KFormula document +>>>>58 string kivio Kivio document +>>>>58 string kontour Kontour document +>>>>58 string kpresenter KPresenter document +>>>>58 string kspread KSpread document +>>>>58 string kword KWord document + +# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7) +>>>50 string vnd.sun.xml. OpenOffice.org 1.x +>>>>62 string writer Writer +>>>>>68 byte !0x2e document +>>>>>68 string .template template +>>>>>68 string .global global document +>>>>62 string calc Calc +>>>>>66 byte !0x2e spreadsheet +>>>>>66 string .template template +>>>>62 string draw Draw +>>>>>66 byte !0x2e document +>>>>>66 string .template template +>>>>62 string impress Impress +>>>>>69 byte !0x2e presentation +>>>>>69 string .template template +>>>>62 string math Math document + +# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8) +# http://lists.oasis-open.org/archives/office/200505/msg00006.html +>>>50 string vnd.oasis.opendocument. OpenDocument +>>>>73 string text +>>>>>77 byte !0x2d Text +>>>>>77 string -template Text Template +>>>>>77 string -web HTML Document Template +>>>>>77 string -master Master Document +>>>>73 string graphics Drawing +>>>>>81 string -template Template +>>>>73 string presentation Presentation +>>>>>85 string -template Template +>>>>73 string spreadsheet Spreadsheet +>>>>>84 string -template Template +>>>>73 string chart Chart +>>>>>78 string -template Template +>>>>73 string formula Formula +>>>>>80 string -template Template +>>>>73 string database Database +>>>>73 string image Image # Zoo archiver 20 lelong 0xfdc4a7dc Zoo archive data @@ -613,7 +681,7 @@ >5 leshort &0x0400 \b, small dictionary >5 leshort &0x0800 \b, multi-volume >5 leshort &0x1000 \b, contains AV-String ->>30 string\x16*UNREGISTERED\x20VERSION* (unregistered) +>>30 string \x16*UNREGISTERED\x20VERSION* (unregistered) >5 leshort &0x2000 \b, with recovery record >5 leshort &0x4000 \b, locked >5 leshort &0x8000 \b, solid @@ -628,9 +696,18 @@ >>0x2A string >\0 : %s # DR-DOS 7.03 Packed File *.??_ -0 string Packed\ File\ Personal NetWare Packed File ->12 string x \b, was "%.12s" +0 string Packed\ File\ Personal NetWare Packed File +>12 string x \b, was "%.12s" # EET archive # From: Tilman Sauerbeck 0 belong 0x1ee7ff00 EET archive + +# From: "Robert Dale" +0 belong 123 dar archive, +>4 belong x label "%.8x +>>8 belong x %.8x +>>>12 beshort x %.4x" +>14 byte 0x54 end slice +>14 beshort 0x4e4e multi-part +>14 beshort 0x4e53 multi-part, with -S diff --git a/contrib/file-4/magic/Magdir/audio b/contrib/file-4/magic/Magdir/audio index 33f1230cf7..829c946065 100644 --- a/contrib/file-4/magic/Magdir/audio +++ b/contrib/file-4/magic/Magdir/audio @@ -25,7 +25,7 @@ >12 belong 19 16-bit linear compressed, >12 belong 20 16-bit linear with emphasis and compression, >12 belong 21 Music kit DSP commands, ->12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice data encoding), +>12 belong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), >12 belong 24 compressed (8-bit CCITT G.722 ADPCM) >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), @@ -55,7 +55,7 @@ >12 belong 19 16-bit linear compressed, >12 belong 20 16-bit linear with emphasis and compression, >12 belong 21 Music kit DSP commands, ->12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice data encoding), +>12 lelong 23 8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.), >12 belong 24 compressed (8-bit CCITT G.722 ADPCM) >12 belong 25 compressed (3-bit CCITT G.723.3 ADPCM), >12 belong 26 compressed (5-bit CCITT G.723.5 ADPCM), @@ -221,9 +221,41 @@ # SGI SoundTrack 0 string _SGI_SoundTrack SGI SoundTrack project file # ID3 version 2 tags -0 string ID3 MP3 file with ID3 version 2. +0 string ID3 Audio file with ID3 version 2 >3 ubyte <0xff \b%d. >4 ubyte <0xff \b%d tag +>2584 string fLaC \b, FLAC encoding +>>2588 byte&0x7f >0 \b, unknown version +>>2588 byte&0x7f 0 \b +# some common bits/sample values +>>>2600 beshort&0x1f0 0x030 \b, 4 bit +>>>2600 beshort&0x1f0 0x050 \b, 6 bit +>>>2600 beshort&0x1f0 0x070 \b, 8 bit +>>>2600 beshort&0x1f0 0x0b0 \b, 12 bit +>>>2600 beshort&0x1f0 0x0f0 \b, 16 bit +>>>2600 beshort&0x1f0 0x170 \b, 24 bit +>>>2600 byte&0xe 0x0 \b, mono +>>>2600 byte&0xe 0x2 \b, stereo +>>>2600 byte&0xe 0x4 \b, 3 channels +>>>2600 byte&0xe 0x6 \b, 4 channels +>>>2600 byte&0xe 0x8 \b, 5 channels +>>>2600 byte&0xe 0xa \b, 6 channels +>>>2600 byte&0xe 0xc \b, 7 channels +>>>2600 byte&0xe 0xe \b, 8 channels +# some common sample rates +>>>2597 belong&0xfffff0 0x0ac440 \b, 44.1 kHz +>>>2597 belong&0xfffff0 0x0bb800 \b, 48 kHz +>>>2597 belong&0xfffff0 0x07d000 \b, 32 kHz +>>>2597 belong&0xfffff0 0x056220 \b, 22.05 kHz +>>>2597 belong&0xfffff0 0x05dc00 \b, 24 kHz +>>>2597 belong&0xfffff0 0x03e800 \b, 16 kHz +>>>2597 belong&0xfffff0 0x02b110 \b, 11.025 kHz +>>>2597 belong&0xfffff0 0x02ee00 \b, 12 kHz +>>>2597 belong&0xfffff0 0x01f400 \b, 8 kHz +>>>2597 belong&0xfffff0 0x177000 \b, 96 kHz +>>>2597 belong&0xfffff0 0x0fa000 \b, 64 kHz +>>>2601 byte&0xf >0 \b, >4G samples +>2584 string !fLaC \b, MP3 encoding # NSF (NES sound file) magic 0 string NESM\x1a NES Sound File @@ -236,7 +268,7 @@ >122 byte&0x1 =1 PAL >122 byte&0x1 =0 NTSC -# Impuse tracker module (audio/x-it) +# Impulse tracker module (audio/x-it) 0 string IMPM Impulse Tracker module sound data - >4 string >\0 "%s" >40 leshort !0 compatible w/ITv%x @@ -399,15 +431,28 @@ # From "Simon Hosie 0 string TFMX-SONG TFMX module sound data +# Monkey's Audio compressed audio format (.ape) # From danny.milo@gmx.net (Danny Milosavljevic) -# monkeysaudio for magic.mime -0 string MAC\ X/Monkey audio, ->4 leshort >0 version %d, ->6 leshort >0 compression level %d, ->8 leshort >0 flags %x, ->10 leshort >0 channels %d, ->12 lelong >0 samplerate %d, ->24 lelong >0 frames %d +# New version from Abel Cheung +0 string MAC\040 Monkey's Audio compressed format +>4 uleshort >0x0F8B version %d +>>(0x08.l) uleshort =1000 with fast compression +>>(0x08.l) uleshort =2000 with normal compression +>>(0x08.l) uleshort =3000 with high compression +>>(0x08.l) uleshort =4000 with extra high compression +>>(0x08.l) uleshort =5000 with insane compression +>>(0x08.l+18) uleshort =1 \b, mono +>>(0x08.l+18) uleshort =2 \b, stereo +>>(0x08.l+20) ulelong x \b, sample rate %d +>4 uleshort <0x0F8C version %d +>>6 uleshort =1000 with fast compression +>>6 uleshort =2000 with normal compression +>>6 uleshort =3000 with high compression +>>6 uleshort =4000 with extra high compression +>>6 uleshort =5000 with insane compression +>>10 uleshort =1 \b, mono +>>10 uleshort =2 \b, stereo +>>12 ulelong x \b, sample rate %d # adlib sound files # From Gürkan Sengün , http://www.linuks.mine.nu @@ -425,3 +470,82 @@ 0 string XAD! eXotic ADlib 0 string ofTAZ! eXtra Simple Music + +# Spectrum 128 tunes (.ay files). +# From: Emanuel Haupt +0 string ZXAYEMUL Spectrum 128 tune + +# From: Alex Beregszaszi +0 string MP+ Musepack +>3 byte&0x0f x SV%d + +0 string \0BONK BONK, +#>5 byte x version %d +>14 byte x %d channel(s), +>15 byte =1 lossless, +>15 byte =0 lossy, +>16 byte x mid-side + +384 string LockStream LockStream Embedded file (mostly MP3 on old Nokia phones) + +# format VQF (proprietary codec for sound) +# some infos on the header file available at : +# http://www.twinvq.org/english/technology_format.html +0 string TWIN97012000 VQF data +>27 short 0 \b, Mono +>27 short 1 \b, Stereo +>31 short >0 \b, %d kbit/s +>35 short >0 \b, %d kHz + +# Nelson A. de Oliveira (naoliv@gmail.com) +# .eqf +0 string Winamp\ EQ\ library\ file %s +# it will match only versions like v. +# Since I saw only eqf files with version v1.1 I think that it's OK +>23 string x \b%.4s +# .preset +0 string \[Equalizer\ preset\] XMMS equalizer preset +# .m3u +0 string \#EXTM3U M3U playlist +# .pls +0 string \[playlist\] PLS playlist +# licq.conf +1 string \[licq\] LICQ configuration file + +# Atari ST audio files by Dirk Jagdmann +0 string ICE! SNDH Atari ST music +0 string SC68\ Music-file\ /\ (c)\ (BeN)jami sc68 Atari ST music + +# musepak support From: "Jiri Pejchal" +0 string MP+ Musepack audio +>3 byte 255 \b, SV pre8 +>3 byte&0xF 0x6 \b, SV 6 +>3 byte&0xF 0x8 \b, SV 8 +>3 byte&0xF 0x7 \b, SV 7 +>>3 byte&0xF0 0x0 \b.0 +>>3 byte&0xF0 0x10 \b.1 +>>3 byte&0xF0 240 \b.15 +>>10 byte&0xF0 0x0 \b, no profile +>>10 byte&0xF0 0x10 \b, profile 'Unstable/Experimental' +>>10 byte&0xF0 0x50 \b, quality 0 +>>10 byte&0xF0 0x60 \b, quality 1 +>>10 byte&0xF0 0x70 \b, quality 2 (Telephone) +>>10 byte&0xF0 0x80 \b, quality 3 (Thumb) +>>10 byte&0xF0 0x90 \b, quality 4 (Radio) +>>10 byte&0xF0 0xA0 \b, quality 5 (Standard) +>>10 byte&0xF0 0xB0 \b, quality 6 (Xtreme) +>>10 byte&0xF0 0xC0 \b, quality 7 (Insane) +>>10 byte&0xF0 0xD0 \b, quality 8 (BrainDead) +>>10 byte&0xF0 0xE0 \b, quality 9 +>>10 byte&0xF0 0xF0 \b, quality 10 +>>27 byte 0x0 \b, Buschmann 1.7.0-9, Klemm 0.90-1.05 +>>27 byte 102 \b, Beta 1.02 +>>27 byte 104 \b, Beta 1.04 +>>27 byte 105 \b, Alpha 1.05 +>>27 byte 106 \b, Beta 1.06 +>>27 byte 110 \b, Release 1.1 +>>27 byte 111 \b, Alpha 1.11 +>>27 byte 112 \b, Beta 1.12 +>>27 byte 113 \b, Alpha 1.13 +>>27 byte 114 \b, Beta 1.14 +>>27 byte 115 \b, Alpha 1.15 diff --git a/contrib/file-4/magic/Magdir/basis b/contrib/file-4/magic/Magdir/basis new file mode 100644 index 0000000000..1813c0e0f0 --- /dev/null +++ b/contrib/file-4/magic/Magdir/basis @@ -0,0 +1,16 @@ +#---------------------------------------------------------------- +# basis: file(1) magic for BBx/Pro5-files +# Oliver Dammer 2005/11/07 +# http://www.basis.com business-basic-files. +# +0 string \074\074bbx\076\076 BBx +>7 string \000 indexed file +>7 string \001 serial file +>7 string \002 keyed file +>>13 short 0 (sort) +>7 string \004 program +>>18 byte x (LEVEL %d) +>>>23 string >\000 psaved +>7 string \006 mkeyed file +>>13 short 0 (sort) +>>8 string \000 (mkey) diff --git a/contrib/file-4/magic/Magdir/bflt b/contrib/file-4/magic/Magdir/bflt new file mode 100644 index 0000000000..5e288d130b --- /dev/null +++ b/contrib/file-4/magic/Magdir/bflt @@ -0,0 +1,12 @@ +#------------------------------------------------------------------------------ +# bFLT: file(1) magic for BFLT uclinux binary files +# +# From Philippe De Muyter +# +0 string bFLT BFLT executable +>4 belong x - version %ld +>4 belong 4 +>>36 belong&0x1 0x1 ram +>>36 belong&0x2 0x2 gotpic +>>36 belong&0x4 0x4 gzip +>>36 belong&0x8 0x8 gzdata diff --git a/contrib/file-4/magic/Magdir/btsnoop b/contrib/file-4/magic/Magdir/btsnoop new file mode 100644 index 0000000000..85d867a446 --- /dev/null +++ b/contrib/file-4/magic/Magdir/btsnoop @@ -0,0 +1,11 @@ +#------------------------------------------------------------------------------ +# BTSnoop: file(1) magic for BTSnoop files +# +# From +0 string btsnoop\0 BTSnoop +>8 belong x version %d, +>12 belong 1001 Unencapsulated HCI +>12 belong 1002 HCI UART (H4) +>12 belong 1003 HCI BCSP +>12 belong 1004 HCI Serial (H5) +>>12 belong x type %d diff --git a/contrib/file-4/magic/Magdir/c64 b/contrib/file-4/magic/Magdir/c64 index 4ca143fbf9..a224b21634 100644 --- a/contrib/file-4/magic/Magdir/c64 +++ b/contrib/file-4/magic/Magdir/c64 @@ -2,7 +2,7 @@ #------------------------------------------------------------------------------ # c64: file(1) magic for various commodore 64 related files # -# From +# From: Dirk Jagdmann 0x16500 belong 0x12014100 D64 Image 0x16500 belong 0x12014180 D71 Image @@ -11,7 +11,7 @@ 0 belong 0x43154164 X64 Image 0 string GCR-1541 GCR Image ->8 byte x version: $i +>8 byte x version: %i >9 byte x tracks: %i 9 string PSUR ARC archive (c64) @@ -25,3 +25,18 @@ 0 string CBM\144\0\0 Power 64 C64 Emulator Snapshot 0 belong 0xFF424CFF WRAptor packer (c64) + +0 string C64S\x20tape\x20file T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s + +0 string C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s + +0 string C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0 T64 tape Image +>32 leshort x Version:0x%x +>36 leshort !0 Entries:%i +>40 string x Name:%.24s diff --git a/contrib/file-4/magic/Magdir/cad b/contrib/file-4/magic/Magdir/cad index 92aa837e8a..03263401c7 100644 --- a/contrib/file-4/magic/Magdir/cad +++ b/contrib/file-4/magic/Magdir/cad @@ -11,7 +11,7 @@ >5 string \064\000\000\000\000 DWG ver. R14 # Microstation DGN/CIT Files (www.bentley.com) -# Written October 30, 2003 by Lester Hightower +# Last updated July 29, 2005 by Lester Hightower # DGN is the default file extension of Microstation/Intergraph CAD files. # CIT is the proprietary raster format (similar to TIFF) used to attach # raster underlays to Microstation DGN (vector) drawings. @@ -24,13 +24,31 @@ # 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928 # http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682 # 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F -0 string \010\011\376 Microstation ->3 string \002 ->>30 string \372\104 DGN File ->>30 string \172\104 DGN File ->>30 string \026\105 DGN File ->4 string \030\000\000 CIT File +0 string \010\011\376 Microstation +>3 string \002 +>>30 string \026\105 DGNFile +>>30 string \034\105 DGNFile +>>30 string \073\107 DGNFile +>>30 string \073\110 DGNFile +>>30 string \106\107 DGNFile +>>30 string \110\103 DGNFile +>>30 string \120\104 DGNFile +>>30 string \172\104 DGNFile +>>30 string \172\105 DGNFile +>>30 string \234\106 DGNFile +>>30 string \273\105 DGNFile +>>30 string \306\106 DGNFile +>>30 string \310\104 DGNFile +>>30 string \341\104 DGNFile +>>30 string \372\103 DGNFile +>>30 string \372\104 DGNFile +>>30 string \372\106 DGNFile +>>30 string \376\103 DGNFile +>4 string \030\000\000 CITFile +>4 string \030\000\003 CITFile # AutoCad, from Nahuel Greco +# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com) 0 string AC1012 AutoCad (release 12) +0 string AC1013 AutoCad (release 13) 0 string AC1014 AutoCad (release 14) diff --git a/contrib/file-4/magic/Magdir/cafebabe b/contrib/file-4/magic/Magdir/cafebabe new file mode 100644 index 0000000000..233411c804 --- /dev/null +++ b/contrib/file-4/magic/Magdir/cafebabe @@ -0,0 +1,21 @@ +#------------------------------------------------------------------------------ +# Cafe Babes unite! +# +# Since Java bytecode and Mach-O fat-files have the same magic number, the test +# must be performed in the same "magic" sequence to get both right. The long +# at offset 4 in a mach-O fat file tells the number of architectures; the short at +# offset 4 in a Java bytecode file is the JVM minor version and the +# short at offset 6 is the JVM major version. Since there are only +# only 18 labeled Mach-O architectures at current, and the first released +# Java class format was version 43.0, we can safely choose any number +# between 18 and 39 to test the number of architectures against +# (and use as a hack). Let's not use 18, because the Mach-O people +# might add another one or two as time goes by... +# +0 belong 0xcafebabe +>4 belong >30 compiled Java class data, +>>6 beshort x version %d. +>>4 beshort x \b%d +>4 belong 1 Mach-O fat file with 1 architecture +>4 belong >1 +>>4 belong <20 Mach-O fat file with %ld architectures diff --git a/contrib/file-4/magic/Magdir/commands b/contrib/file-4/magic/Magdir/commands index 93244b8cdd..24649844b1 100644 --- a/contrib/file-4/magic/Magdir/commands +++ b/contrib/file-4/magic/Magdir/commands @@ -27,7 +27,8 @@ # 0 string/b #!\ /bin/awk awk script text executable 0 string/b #!\ /usr/bin/awk awk script text executable -0 string BEGIN awk script text +# update to distinguish from *.vcf files +0 regex BEGIN[[:space:]]*[{] awk script text # AT&T Bell Labs' Plan 9 shell 0 string/b #!\ /bin/rc Plan 9 rc shell script text executable diff --git a/contrib/file-4/magic/Magdir/compress b/contrib/file-4/magic/Magdir/compress index 39a3d1107b..e9be46b76c 100644 --- a/contrib/file-4/magic/Magdir/compress +++ b/contrib/file-4/magic/Magdir/compress @@ -22,22 +22,28 @@ >2 byte <8 \b, reserved method >2 byte >8 \b, unknown method >3 byte &0x01 \b, ASCII ->3 byte &0x02 \b, continuation +>3 byte &0x02 \b, has CRC >3 byte &0x04 \b, extra field >3 byte&0xC =0x08 >>10 string x \b, was "%s" ->9 byte =0x00 \b, from MS-DOS +>3 byte &0x10 \b, has comment +>9 byte =0x00 \b, from FAT filesystem (MS-DOS, OS/2, NT) >9 byte =0x01 \b, from Amiga >9 byte =0x02 \b, from VMS >9 byte =0x03 \b, from Unix +>9 byte =0x04 \b, from VM/CMS >9 byte =0x05 \b, from Atari ->9 byte =0x06 \b, from OS/2 +>9 byte =0x06 \b, from HPFS filesystem (OS/2, NT) >9 byte =0x07 \b, from MacOS ->9 byte =0x0A \b, from Tops/20 ->9 byte =0x0B \b, from Win/32 +>9 byte =0x08 \b, from Z-System +>9 byte =0x09 \b, from CP/M +>9 byte =0x0A \b, from TOPS/20 +>9 byte =0x0B \b, from NTFS filesystem (NT) +>9 byte =0x0C \b, from QDOS +>9 byte =0x0D \b, from Acorn RISCOS >3 byte &0x10 \b, comment >3 byte &0x20 \b, encrypted -### >4 ledate x last modified: %s, +>4 ledate >0 \b, last modified: %s >8 byte 2 \b, max compression >8 byte 4 \b, max speed @@ -170,3 +176,14 @@ # AFX compressed files (Wolfram Kleff) 2 string -afx- AFX compressed file data + +# Supplementary magic data for the file(1) command to support +# rzip(1). The format is described in magic(5). +# +# Copyright (C) 2003 by Andrew Tridgell. You may do whatever you want with +# this file. +# +0 string RZIP rzip compressed data +>4 byte x - version %d +>5 byte x \b.%d +>6 belong x (%d bytes) diff --git a/contrib/file-4/magic/Magdir/console b/contrib/file-4/magic/Magdir/console index ccade69dd4..65fe32723e 100644 --- a/contrib/file-4/magic/Magdir/console +++ b/contrib/file-4/magic/Magdir/console @@ -161,6 +161,7 @@ >2 beshort x RAM start $%04x >6 string BS93 - - +# Opera file system that is used on the 3DO console +# From: Serge van den Boom +0 string \x01ZZZZZ\x01 3DO "Opera" file system diff --git a/contrib/file-4/magic/Magdir/cracklib b/contrib/file-4/magic/Magdir/cracklib new file mode 100644 index 0000000000..8f7e0d460e --- /dev/null +++ b/contrib/file-4/magic/Magdir/cracklib @@ -0,0 +1,13 @@ + +#------------------------------------------------------------------------------ +# cracklib: file (1) magic for cracklib v2.7 + +0 lelong 0x70775631 Cracklib password index, little endian +>4 long >0 (%i words) +>4 long 0 ("64-bit") +>>8 long >-1 (%i words) +0 belong 0x70775631 Cracklib password index, big endian +>4 belong >-1 (%i words) +# really bellong 0x0000000070775631 +4 belong 0x70775631 Cracklib password index, big endian ("64-bit") +>12 belong >0 (%i words) diff --git a/contrib/file-4/magic/Magdir/database b/contrib/file-4/magic/Magdir/database index aef8469cc1..b2f68d98a7 100644 --- a/contrib/file-4/magic/Magdir/database +++ b/contrib/file-4/magic/Magdir/database @@ -210,3 +210,7 @@ 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data + +# SQLite (Ty Sarna) +0 string **\ This\ file\ contains\ an\ SQLite SQLite Database +>&1 regex [^\ ]+ Version %s diff --git a/contrib/file-4/magic/Magdir/diff b/contrib/file-4/magic/Magdir/diff index 9e651465ef..187e892a6d 100644 --- a/contrib/file-4/magic/Magdir/diff +++ b/contrib/file-4/magic/Magdir/diff @@ -6,3 +6,5 @@ 0 string ***\ 'diff' output text 0 string Only\ in\ 'diff' output text 0 string Common\ subdirectories:\ 'diff' output text + +0 string Index: RCS/CVS diff output text diff --git a/contrib/file-4/magic/Magdir/dump b/contrib/file-4/magic/Magdir/dump index 628ead86c6..addd9549cc 100644 --- a/contrib/file-4/magic/Magdir/dump +++ b/contrib/file-4/magic/Magdir/dump @@ -79,3 +79,15 @@ >760 string >\0 Device %s, >824 string >\0 Host %s, >888 lelong >0 Flags %x + +18 leshort 60011 old-fs dump file (16-bit, assuming PDP-11 endianness), +>2 medate x Previous dump %s, +>6 medate x This dump %s, +>10 leshort >0 Volume %ld, +>0 leshort 1 tape header. +>0 leshort 2 beginning of file record. +>0 leshort 3 map of inodes on tape. +>0 leshort 4 continuation of file record. +>0 leshort 5 end of volume. +>0 leshort 6 map of inodes deleted. +>0 leshort 7 end of medium (for floppy). diff --git a/contrib/file-4/magic/Magdir/elf b/contrib/file-4/magic/Magdir/elf index 1dee0bd8f3..b2eb247362 100644 --- a/contrib/file-4/magic/Magdir/elf +++ b/contrib/file-4/magic/Magdir/elf @@ -11,22 +11,39 @@ 0 string \177ELF ELF >4 byte 0 invalid class >4 byte 1 32-bit -# only for MIPS - in the future, the ABI field of e_flags should be used. ->>18 leshort 8 ->>>36 lelong &0x20 N32 ->>18 leshort 10 ->>>36 lelong &0x20 N32 ->>18 beshort 8 ->>>36 belong &0x20 N32 ->>18 beshort 10 ->>>36 belong &0x20 N32 >4 byte 2 64-bit >5 byte 0 invalid byte order >5 byte 1 LSB +>>16 leshort 0 no file type, +>>16 leshort 1 relocatable, +>>16 leshort 2 executable, +>>16 leshort 3 shared object, +# Core handling from Peter Tobias +# corrections by Christian 'Dr. Disk' Hechelmann +>>16 leshort 4 core file +# Core file detection is not reliable. +#>>>(0x38+0xcc) string >\0 of '%s' +#>>>(0x38+0x10) lelong >0 (signal %d), +>>16 leshort &0xff00 processor-specific, +>>18 leshort 0 no machine, +>>18 leshort 1 AT&T WE32100 - invalid byte order, +>>18 leshort 2 SPARC - invalid byte order, +>>18 leshort 3 Intel 80386, +>>18 leshort 4 Motorola +>>>36 lelong &0x01000000 68000 - invalid byte order, +>>>36 lelong &0x00810000 CPU32 - invalid byte order, +>>>36 lelong 0 68020 - invalid byte order, +>>18 leshort 5 Motorola 88000 - invalid byte order, +>>18 leshort 6 Intel 80486, +>>18 leshort 7 Intel 80860, # The official e_machine number for MIPS is now #8, regardless of endianness. # The second number (#10) will be deprecated later. For now, we still # say something if #10 is encountered, but only gory details for #8. ->>18 leshort 8 +>>18 leshort 8 MIPS, +>>>36 lelong &0x20 N32 +>>18 leshort 10 MIPS, +>>>36 lelong &0x20 N32 +>>18 leshort 8 # only for 32-bit >>>4 byte 1 >>>>36 lelong&0xf0000000 0x00000000 MIPS-I @@ -49,29 +66,6 @@ >>>>48 lelong&0xf0000000 0x70000000 MIPS64 >>>>48 lelong&0xf0000000 0x80000000 MIPS32 rel2 >>>>48 lelong&0xf0000000 0x90000000 MIPS64 rel2 ->>16 leshort 0 no file type, ->>16 leshort 1 relocatable, ->>16 leshort 2 executable, ->>16 leshort 3 shared object, -# Core handling from Peter Tobias -# corrections by Christian 'Dr. Disk' Hechelmann ->>16 leshort 4 core file -# Core file detection is not reliable. -#>>>(0x38+0xcc) string >\0 of '%s' -#>>>(0x38+0x10) lelong >0 (signal %d), ->>16 leshort &0xff00 processor-specific, ->>18 leshort 0 no machine, ->>18 leshort 1 AT&T WE32100 - invalid byte order, ->>18 leshort 2 SPARC - invalid byte order, ->>18 leshort 3 Intel 80386, ->>18 leshort 4 Motorola ->>>36 lelong &0x01000000 68000 - invalid byte order, ->>>36 lelong &0x00810000 CPU32 - invalid byte order, ->>>36 lelong 0 68020 - invalid byte order, ->>18 leshort 5 Motorola 88000 - invalid byte order, ->>18 leshort 6 Intel 80486, ->>18 leshort 7 Intel 80860, ->>18 leshort 8 MIPS, >>18 leshort 9 Amdahl - invalid byte order, >>18 leshort 10 MIPS (deprecated), >>18 leshort 11 RS6000 - invalid byte order, @@ -90,15 +84,15 @@ >>18 leshort 40 ARM, >>18 leshort 41 Alpha, >>18 leshort 0xa390 IBM S/390 (obsolete), ->>18 leshort 42 Hitachi SH, +>>18 leshort 42 Renesas SH, >>18 leshort 43 SPARC V9 - invalid byte order, >>18 leshort 44 Siemens Tricore Embedded Processor, >>18 leshort 45 Argonaut RISC Core, Argonaut Technologies Inc., ->>18 leshort 46 Hitachi H8/300, ->>18 leshort 47 Hitachi H8/300H, ->>18 leshort 48 Hitachi H8S, ->>18 leshort 49 Hitachi H8/500, ->>18 leshort 50 IA-64 (Intel 64 bit architecture) +>>18 leshort 46 Renesas H8/300, +>>18 leshort 47 Renesas H8/300H, +>>18 leshort 48 Renesas H8S, +>>18 leshort 49 Renesas H8/500, +>>18 leshort 50 IA-64, >>18 leshort 51 Stanford MIPS-X, >>18 leshort 52 Motorola Coldfire, >>18 leshort 53 Motorola M68HC12, @@ -111,8 +105,31 @@ >>20 lelong 1 version 1 >>36 lelong 1 MathCoPro/FPU/MAU Required >5 byte 2 MSB +>>16 beshort 0 no file type, +>>16 beshort 1 relocatable, +>>16 beshort 2 executable, +>>16 beshort 3 shared object, +>>16 beshort 4 core file, +#>>>(0x38+0xcc) string >\0 of '%s' +#>>>(0x38+0x10) belong >0 (signal %d), +>>16 beshort &0xff00 processor-specific, +>>18 beshort 0 no machine, +>>18 beshort 1 AT&T WE32100, +>>18 beshort 2 SPARC, +>>18 beshort 3 Intel 80386 - invalid byte order, +>>18 beshort 4 Motorola +>>>36 belong &0x01000000 68000, +>>>36 belong &0x00810000 CPU32, +>>>36 belong 0 68020, +>>18 beshort 5 Motorola 88000, +>>18 beshort 6 Intel 80486 - invalid byte order, +>>18 beshort 7 Intel 80860, # only for MIPS - see comment in little-endian section above. ->>18 beshort 8 +>>18 beshort 8 MIPS, +>>>36 belong &0x20 N32 +>>18 beshort 10 MIPS, +>>>36 belong &0x20 N32 +>>18 beshort 8 # only for 32-bit >>>4 byte 1 >>>>36 belong&0xf0000000 0x00000000 MIPS-I @@ -135,26 +152,6 @@ >>>>48 belong&0xf0000000 0x70000000 MIPS64 >>>>48 belong&0xf0000000 0x80000000 MIPS32 rel2 >>>>48 belong&0xf0000000 0x90000000 MIPS64 rel2 ->>16 beshort 0 no file type, ->>16 beshort 1 relocatable, ->>16 beshort 2 executable, ->>16 beshort 3 shared object, ->>16 beshort 4 core file, -#>>>(0x38+0xcc) string >\0 of '%s' -#>>>(0x38+0x10) belong >0 (signal %d), ->>16 beshort &0xff00 processor-specific, ->>18 beshort 0 no machine, ->>18 beshort 1 AT&T WE32100, ->>18 beshort 2 SPARC, ->>18 beshort 3 Intel 80386 - invalid byte order, ->>18 beshort 4 Motorola ->>>36 belong &0x01000000 68000, ->>>36 belong &0x00810000 CPU32, ->>>36 belong 0 68020, ->>18 beshort 5 Motorola 88000, ->>18 beshort 6 Intel 80486 - invalid byte order, ->>18 beshort 7 Intel 80860, ->>18 beshort 8 MIPS, >>18 beshort 9 Amdahl, >>18 beshort 10 MIPS (deprecated), >>18 beshort 11 RS6000, @@ -179,15 +176,15 @@ >>18 beshort 39 Motorola RCE, >>18 beshort 40 ARM, >>18 beshort 41 Alpha, ->>18 beshort 42 Hitachi SH, +>>18 beshort 42 Renesas SH, >>18 beshort 43 SPARC V9, >>18 beshort 44 Siemens Tricore Embedded Processor, >>18 beshort 45 Argonaut RISC Core, Argonaut Technologies Inc., ->>18 beshort 46 Hitachi H8/300, ->>18 beshort 47 Hitachi H8/300H, ->>18 beshort 48 Hitachi H8S, ->>18 beshort 49 Hitachi H8/500, ->>18 beshort 50 Intel Merced Processor, +>>18 beshort 46 Renesas H8/300, +>>18 beshort 47 Renesas H8/300H, +>>18 beshort 48 Renesas H8S, +>>18 beshort 49 Renesas H8/500, +>>18 beshort 50 IA-64, >>18 beshort 51 Stanford MIPS-X, >>18 beshort 52 Motorola Coldfire, >>18 beshort 53 Motorola M68HC12, @@ -218,5 +215,8 @@ >>7 byte 10 (Tru64) >>7 byte 11 (Novell Modesto) >>7 byte 12 (OpenBSD) +# VMS Itanium added by gerardo.cacciari@gmail.com +>8 string \2 +>>7 byte 13 (OpenVMS) >>7 byte 97 (ARM) >>7 byte 255 (embedded) diff --git a/contrib/file-4/magic/Magdir/filesystems b/contrib/file-4/magic/Magdir/filesystems index 41fdc2627b..5fa3df65c5 100644 --- a/contrib/file-4/magic/Magdir/filesystems +++ b/contrib/file-4/magic/Magdir/filesystems @@ -23,12 +23,35 @@ >0770 long x %ld blocks # Is there a boot block written 1 sector in? >512 belong&077777777 0600407 \b, boot block present -# DOS Emulator image is 128 byte header + harddisc image +# Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc +# (http://btmgr.sourceforge.net/docs/user-guide-3.html) +0 string SBMBAKUP_ Smart Boot Manager backup file +>9 string x \b, version %-5.5s +>>14 string =_ +>>>15 string x %-.1s +>>>>16 string =_ \b. +>>>>>17 string x \b%-.1s +>>>>>>18 string =_ \b. +>>>>>>>19 string x \b%-.1s +>>>22 ubyte 0 +>>>>21 ubyte x \b, from drive 0x%x +>>>22 ubyte >0 +>>>>21 string x \b, from drive %s + +# Joerg Jenderek +# DOS Emulator image is 128 byte, null right padded header + harddisc image 0 string DOSEMU\0 ->0x27E leshort 0xAA55 DOS Emulator image +>0x27E leshort 0xAA55 +#offset is 128 +>>19 ubyte 128 +>>>(19.b-1) ubyte 0x0 DOS Emulator image +>>>>7 ulelong >0 \b, %u heads +>>>>11 ulelong >0 \b, %d sectors/track +>>>>15 ulelong >0 \b, %d cylinders + 0x1FE leshort 0xAA55 x86 boot sector >2 string OSBS \b, OS/BS MBR -# J\xf6rg Jenderek +# J\xf6rg Jenderek >0x8C string Invalid\ partition\ table \b, MS-DOS MBR # dr-dos with some upper-, lowercase variants >0x9D string Invalid\ partition\ table$ @@ -49,39 +72,103 @@ >>>>>>>387 string Copyright\ (c)\ 1984,1998 >>>>>>>>411 string Caldera\ Inc.\0 \b, DR-DOS MBR (IBMBIO.LDR) >0x10F string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 4.10.1998, 4.10.2222 +>>0x1B8 ubelong >0 \b, Serial 0x%-.4x >0x8B string Ung\201ltige\ Partitionstabelle \b, MS-DOS MBR, german version 5.00 to 4.00.950 +>271 string Invalid\ partition\ table\0 +>>295 string Error\ loading\ operating\ system\0 +>>>326 string Missing\ operating\ system\0 \b, mbr +# +>139 string Invalid\ partition\ table\0 +>>163 string Error\ loading\ operating\ system\0 +>>>194 string Missing\ operating\ system\0 \b, Microsoft Windows XP mbr +# http://www.heise.de/ct/05/09/006/ page 184 +#HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes +>>>>0x1B8 ulelong >0 \b,Serial 0x%-.4x >300 string Invalid\ partition\ table\0 >>324 string Error\ loading\ operating\ system\0 >>>355 string Missing\ operating\ system\0 \b, Microsoft Windows XP MBR #??>>>389 string Invalid\ system\ disk +>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x >300 string Ung\201ltige\ Partitionstabelle #split string to avoid error: String too long >>328 string Fehler\ beim\ Laden\ >>>346 string des\ Betriebssystems >>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german) +>>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x >0x145 string Default:\ F \b, FREE-DOS MBR >64 string no\ active\ partition\ found ->>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta9 MBR +>>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR +>271 string Operating\ system\ loading +>>296 string error\r \b, SYSLINUX MBR (2.10) # bootloader, bootmanager >43 string SMART\ BTMGRFAT12\ \ \ >>430 string SBMK\ Bad!\r >>>3 string SBM \b, Smart Boot Manager >>>>6 string >\0 \b, version %s ->382 string XOSLLOADXCF \b, EXtended Operating System Loader +>382 string XOSLLOADXCF \b, eXtended Operating System Loader >6 string LILO \b, LInux i386 boot LOader >>120 string LILO \b, version 22.3.4 SuSe >>172 string LILO \b, version 22.5.8 Debian >402 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>394 string stage1 \b, GRand Unified Bootloader (0.5.95) +>343 string Geom\0Read\0\ Error\0 +>>321 string Loading\ stage1.5 \b, Grand Unified Bootloader >380 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>374 string GRUB\ \0 \b, GRand Unified Bootloader >382 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>376 string GRUB\ \0 \b, GRand Unified Bootloader (0.93) >383 string Geom\0Hard\ Disk\0Read\0\ Error\0 >>377 string GRUB\ \0 \b, GRand Unified Bootloader (0.94) +>385 string Geom\0Hard\ Disk\0Read\0\ Error\0 +>>379 string GRUB\ \0 \b, GRand Unified Bootloader (0.95) >480 string Boot\ failed\r >>495 string LDLINUX\ SYS \b, SYSLINUX bootloader (2.06) >395 string chksum\0\ ERROR!\0 \b, Gujin bootloader +# mbr partion table entries, if not fat boot secor, activ flag 0 or 0x80 and type > 0 +>3 string !MS +>>3 string !SYSLINUX +>>>82 string !FAT32 +>>>>446 ubyte <0x81 +>>>>>446 ubyte&0x7F 0 +>>>>>>450 ubyte >0 \b; partition 1: ID=0x%x +>>>>>>>446 ubyte 0x80 \b, active +>>>>>>>447 ubyte x \b, starthead %u +#>>>>>>>448 ubyte x \b, start C_S: 0x%x +#>>>>>>448 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>454 ulelong x \b, startsector %u +>>>>>>>458 ulelong x \b, %u sectors +# +>>>>462 ubyte <0x81 +>>>>>462 ubyte&0x7F 0 +>>>>>>466 ubyte >0 \b; partition 2: ID=0x%x +>>>>>>>462 ubyte 0x80 \b, active +>>>>>>>463 ubyte x \b, starthead %u +#>>>>>>>464 ubyte x \b, start C_S: 0x%x +#>>>>>>>464 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>470 ulelong x \b, startsector %u +>>>>>>>474 ulelong x \b, %u sectors +# +>>>>478 ubyte <0x81 +>>>>>478 ubyte&0x7F 0 +>>>>>>482 ubyte >0 \b; partition 3: ID=0x%x +>>>>>>>478 ubyte 0x80 \b, active +>>>>>>>479 ubyte x \b, starthead %u +#>>>>>>>480 ubyte x \b, start C_S: 0x%x +#>>>>>>>481 ubyte x \b, start C2S: 0x%x +#>>>>>>>480 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>486 ulelong x \b, startsector %u +>>>>>>>490 ulelong x \b, %u sectors +# +>>>>494 ubyte <0x81 +>>>>>494 ubyte&0x7F 0 +>>>>>>498 ubyte >0 \b; partition 4: ID=0x%x +>>>>>>>494 ubyte 0x80 \b, active +>>>>>>>495 ubyte x \b, starthead %u +#>>>>>>>496 ubyte x \b, start C_S: 0x%x +#>>>>>>>496 ubeshort&1023 x \b, startcylinder? %d +>>>>>>>502 ulelong x \b, startsector %u +>>>>>>>506 ulelong x \b, %u sectors +# mbr partion table entries end >185 string FDBOOT\ Version\ >>204 string \rNo\ Systemdisk.\ >>>220 string Booting\ from\ harddisk.\n\r @@ -108,69 +195,115 @@ >>>>>>>>>(1.b+11) ubyte 0xb >>>>>>>>>>(1.b+12) ubyte 0x56 >>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display +>103 string This\ is\ not\ a\ bootable\ disk.\ +>>132 string Please\ insert\ a\ bootable\ +>>>157 string floppy\ and\r\n +>>>>169 string press\ any\ key\ to\ try\ again...\r \b, FREE-DOS message display +# +>66 string Solaris\ Boot\ Sector +>>99 string Incomplete\ MDBoot\ load. +>>>89 string Version \b, Sun Solaris Bootloader +>>>>97 byte x version %c +# +>408 string OS/2\ !!\ SYS01475\r\0 +>>429 string OS/2\ !!\ SYS02025\r\0 +>>>450 string OS/2\ !!\ SYS02027\r\0 +>>>469 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp bootloader +# +>409 string OS/2\ !!\ SYS01475\r\0 +>>430 string OS/2\ !!\ SYS02025\r\0 +>>>451 string OS/2\ !!\ SYS02027\r\0 +>>>470 string OS2BOOT\ \ \ \ \b, IBM OS/2 Warp Bootloader +>112 string This\ disk\ is\ not\ bootable\r +>>142 string If\ you\ wish\ to\ make\ it\ bootable +>>>176 string run\ the\ DOS\ program\ SYS\ +>>>200 string after\ the\r +>>>>216 string system\ has\ been\ loaded\r\n +>>>>>242 string Please\ insert\ a\ DOS\ diskette\ +>>>>>271 string into\r\n\ the\ drive\ and\ +>>>>>>292 string strike\ any\ key...\0 \b, IBM OS/2 Warp message display # XP >430 string NTLDR\ is\ missing\xFF\r\n >>449 string Disk\ error\xFF\r\n >>>462 string Press\ any\ key\ to\ restart\r \b, Microsoft Windows XP Bootloader # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes ->>>>417 ubyte <0x7E ->>>>>417 string >\ %-.5s ->>>>>>422 ubyte <0x7E ->>>>>>>422 string >\ \b%-.3s +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # ->>>>368 ubyte <0x7E ->>>>>368 string >\ %-.5s ->>>>>>373 ubyte <0x7E ->>>>>>>373 string >\ \b%-.3s ->>>>>>376 string >\ \b.%-.3s +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s # >430 string NTLDR\ nicht\ gefunden\xFF\r\n >>453 string Datentr\204gerfehler\xFF\r\n >>>473 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (german) ->>>>417 ubyte <0x7E ->>>>>417 string >\ %-.5s ->>>>>>422 ubyte <0x7E ->>>>>>>422 string >\ \b%-.3s +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # ->>>>368 ubyte <0x7E ->>>>>368 string >\ %-.5s ->>>>>>373 ubyte <0x7E ->>>>>>>373 string >\ \b%-.3s ->>>>>>376 string >\ \b.%-.3s +>>>>368 ubyte&0xDF >0 +>>>>>368 string x %-.5s +>>>>>>373 ubyte&0xDF >0 +>>>>>>>373 string x \b%-.3s +>>>>>376 ubyte&0xDF >0 +>>>>>>376 string x \b.%-.3s # >430 string NTLDR\ fehlt\xFF\r\n >>444 string Datentr\204gerfehler\xFF\r\n >>>464 string Neustart\ mit\ beliebiger\ Taste\r \b, Microsoft Windows XP Bootloader (2.german) ->>>>417 ubyte <0x7E ->>>>>417 string >\ %-.5s ->>>>>>422 ubyte <0x7E ->>>>>>>422 string >\ \b%-.3s +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s +# variant +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s # >430 string NTLDR\ fehlt\xFF\r\n >>444 string Medienfehler\xFF\r\n >>>459 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (3.german) ->>>>368 ubyte <0x7E ->>>>>368 string >\ %-.5s ->>>>>>373 ubyte <0x7E ->>>>>>>373 string >\ \b%-.3s ->>>>>>376 string >\ \b.%-.3s ->>>>417 ubyte <0x7E ->>>>>417 string >\ %-.5s ->>>>>>422 ubyte <0x7E ->>>>>>>422 string >\ \b%-.3s +>>>>371 ubyte >0x20 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# variant +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 >>>>>>425 string >\ \b.%-.3s # >430 string Datentr\204ger\ entfernen\xFF\r\n >>454 string Medienfehler\xFF\r\n >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) ->>>>368 ubyte <0x7E ->>>>>368 string >\ %-.5s ->>>>>>373 ubyte <0x7E ->>>>>>>373 string >\ \b%-.3s ->>>>>>376 string >\ \b.%-.3s +>>>>368 ubyte&0xDF >0 +>>>>>368 string x %-.5s +>>>>>>373 ubyte&0xDF >0 +>>>>>>>373 string x \b%-.3s +>>>>>376 ubyte&0xDF >0 +>>>>>>376 string x \b.%-.3s #>3 string NTFS\ \ \ \ >389 string Fehler\ beim\ Lesen\ >>407 string des\ Datentr\204gers @@ -185,12 +318,27 @@ >>>>>429 string Insert\ a\ system\ diskette\ >>>>>>454 string and\ restart\r\nthe\ system.\r \b, Microsoft Windows XP Bootloader NTFS # DOS loader variants different languages,offsets ->472 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS ->>497 string WINBOOT\ SYS +>472 ubyte&0xDF >0 >>389 string Invalid\ system\ disk\xFF\r\n >>>411 string Disk\ I/O\ error >>>>428 string Replace\ the\ disk,\ and\ >>>>>455 string press\ any\ key \b, Microsoft Windows 98 Bootloader +#IO.SYS +>>>>>>472 ubyte&0xDF >0 +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.5s +>>>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>>>479 string x \b%-.1s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s # >>390 string Invalid\ system\ disk\xFF\r\n >>>412 string Disk\ I/O\ error\xFF\r\n @@ -200,30 +348,121 @@ >>>410 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>427 string Datentraeger\ wechseln\ und\ >>>>>453 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (german) +#WINBOOT.SYS only not spaces (0xDF) +>>>>>>497 ubyte&0xDF >0 +>>>>>>>497 string x %-.5s +>>>>>>>>502 ubyte&0xDF >0 +>>>>>>>>>502 string x \b%-.1s +>>>>>>>>>>503 ubyte&0xDF >0 +>>>>>>>>>>>503 string x \b%-.1s +>>>>>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>>>>>504 string x \b%-.1s +>>>>>>505 ubyte&0xDF >0 +>>>>>>>505 string x \b.%-.3s +#IO.SYS +>>>>>>472 ubyte&0xDF >0 or +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.5s +>>>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>>>479 string x \b%-.1s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s # >>390 string Ungueltiges\ System\ \xFF\r\n >>>412 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>429 string Datentraeger\ wechseln\ und\ >>>>>455 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (German) +#WINBOOT.SYS only not spaces (0xDF) +>>>>>>497 ubyte&0xDF >0 +>>>>>>>497 string x %-.7s +>>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>>504 string x \b%-.1s +>>>>>>505 ubyte&0xDF >0 +>>>>>>>505 string x \b.%-.3s +#IO.SYS +>>>>>>472 ubyte&0xDF >0 or +>>>>>>>472 string x \b %-.2s +>>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>>474 string x \b%-.6s +>>>>>>>480 ubyte&0xDF >0 +>>>>>>>>480 string x \b.%-.3s +#MSDOS.SYS +>>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>>483 string x \b%-.5s +>>>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>>>488 string x \b%-.3s +>>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>>491 string x \b.%-.3s # >>389 string Ungueltiges\ System\ \xFF\r\n >>>411 string E/A-Fehler\ \ \ \ \xFF\r\n >>>>428 string Datentraeger\ wechseln\ und\ >>>>>454 string Taste\ druecken\r \b, Microsoft Windows 95/98/ME Bootloader (GERMAN) ->479 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS +# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes +>>>>>>472 string x %-.2s +>>>>>>>474 ubyte&0xDF >0 +>>>>>>>>474 string x \b%-.5s +>>>>>>>>479 ubyte&0xDF >0 +>>>>>>>>>479 string x \b%-.1s +>>>>>>480 ubyte&0xDF >0 +>>>>>>>480 string x \b.%-.3s +>>>>>>483 ubyte&0xDF >0 \b+ +>>>>>>>483 string x \b%-.5s +>>>>>>>488 ubyte&0xDF >0 +>>>>>>>>488 string x \b%-.2s +>>>>>>>>490 ubyte&0xDF >0 +>>>>>>>>>490 string x \b%-.1s +>>>>>>>491 ubyte&0xDF >0 +>>>>>>>>491 string x \b.%-.3s +>479 ubyte&0xDF >0 >>416 string Kein\ System\ oder\ >>>433 string Laufwerksfehler >>>>450 string Wechseln\ und\ Taste\ dr\201cken \b, Microsoft DOS Bootloader (german) ->486 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS +#IO.SYS +>>>>>479 string x \b %-.2s +>>>>>>481 ubyte&0xDF >0 +>>>>>>>481 string x \b%-.6s +>>>>>487 ubyte&0xDF >0 +>>>>>>487 string x \b.%-.3s +#MSDOS.SYS +>>>>>>490 ubyte&0xDF >0 \b+ +>>>>>>>490 string x \b%-.5s +>>>>>>>>495 ubyte&0xDF >0 +>>>>>>>>>495 string x \b%-.3s +>>>>>>>498 ubyte&0xDF >0 +>>>>>>>>498 string x \b.%-.3s +# +>486 ubyte&0xDF >0 >>416 string Non-System\ disk\ or\ >>>435 string disk\ error\r >>>>447 string Replace\ and\ press\ any\ key\ >>>>>473 string when\ ready\r \b, Microsoft DOS Bootloader ->480 string IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS +>480 ubyte&0xDF >0 >>393 string Non-System\ disk\ or\ >>>412 string disk\ error\r >>>>424 string Replace\ and\ press\ any\ key\ >>>>>450 string when\ ready\r \b, Microsoft DOS bootloader +#IO.SYS +>>>>>480 string x \b %-.2s +>>>>>>482 ubyte&0xDF >0 +>>>>>>>48 string x \b%-.6s +>>>>>488 ubyte&0xDF >0 +>>>>>>488 string x \b.%-.3s +#MSDOS.SYS +>>>>>>491 ubyte&0xDF >0 \b+ +>>>>>>>491 string x \b%-.5s +>>>>>>>>496 ubyte&0xDF >0 +>>>>>>>>>496 string x \b%-.3s +>>>>>>>499 ubyte&0xDF >0 +>>>>>>>>499 string x \b.%-.3s #>43 string \224R-LOADER\ \ SYS =label >54 string SYS >>324 string VASKK @@ -239,26 +478,65 @@ >499 string KERNEL\ \ SYS >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader >449 string KERNEL\ \ SYS ->>319 string BOOT\ error! \b, FREE-DOS 5.0 Bootloader +>>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader +>125 string Loading\ FreeDOS...\r +>>311 string BOOT\ error!\r \b, FREE-DOS bootloader +>>>441 ubyte&0xDF >0 +>>>>441 string x \b %-.6s +>>>>>447 ubyte&0xDF >0 +>>>>>>447 string x \b%-.1s +>>>>>>>448 ubyte&0xDF >0 +>>>>>>>>448 string x \b%-.1s +>>>>449 ubyte&0xDF >0 +>>>>>449 string x \b.%-.3s >124 string FreeDOS\0 ->>331 string \ err\0 \b, FREE-DOS BETa 9 Bootloader +>>331 string \ err\0 \b, FREE-DOS BETa 0.9 Bootloader # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes ->>>497 string >\ %-.6s ->>>>503 string >\ \b%-.1s ->>>>504 string >\ \b%-.1s ->>>505 string >\ \b.%-.3s ->>333 string \ err\0 \b, FREE-DOS BEta 9 Bootloader ->>>497 string >\ %-.6s ->>>>503 string >\ \b%-.1s ->>>>504 string >\ \b%-.1s ->>>505 string >\ \b.%-.3s ->>334 string \ err\0 \b, FREE-DOS Beta 9 Bootloader ->>>497 string >\ %-.6s ->>>>503 string >\ \b%-.1s ->>>>504 string >\ \b%-.1s ->>>505 string >\ \b.%-.3s +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>>333 string \ err\0 \b, FREE-DOS BEta 0.9 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>>334 string \ err\0 \b, FREE-DOS Beta 0.9 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +>336 string Error!\ +>>343 string Hit\ a\ key\ to\ reboot. \b, FREE-DOS Beta 0.9sr1 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s # loader end ->0 string \0\0\0\0 \b, extended partition table +# Joerg Jenderek +>446 ubyte 0 +>>450 ubyte >0 +>>>482 ubyte 0 +>>>>498 ubyte 0 +>>>>466 ubyte 0x05 \b, extended partition table +>>>>466 ubyte 0x0F \b, extended partition table (LBA) +>>>>466 ubyte 0x0 \b, extended partition table (last) # JuMP short bootcodeoffset NOP assembler instructions will usually be EB xx 90 # older drives may use E9 xx xx >0 lelong&0x009000EB 0x009000EB @@ -316,7 +594,7 @@ >>>>>>>43 string >>>>>>43 string >NO\ NAME \b, label: "%11.11s" >>>>>>>43 string =NO\ NAME \b, unlabeled ->>>>>>54 string FAT1 \b, FAT +>>>>>>54 string FAT \b, FAT >>>>>>>54 string FAT12 \b (12 bit) >>>>>>>54 string FAT16 \b (16 bit) # FAT32 specific @@ -380,7 +658,7 @@ 0x18b string OS/2 OS/2 Boot Manager -9564 lelong 0x00011954 Unix Fast File system (little-endian), +9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian), >8404 string x last mounted on %s, #>9504 ledate x last checked at %s, >8224 ledate x last written at %s, @@ -396,8 +674,48 @@ >8320 lelong 0 TIME optimization >8320 lelong 1 SPACE optimization -9564 belong 0x00011954 Unix Fast File system (big-endian), ->7168 long 0x4c41424c Apple UFS Volume +42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 leqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 lequad x number of blocks %lld, +>&-288 lequad x number of data blocks %lld, +>&-1332 lelong x number of cylinder groups %d, +>&-1328 lelong x block size %d, +>&-1324 lelong x fragment size %d, +>&-180 lelong x average file size %d, +>&-176 lelong x average number of files in dir %d, +>&-272 lequad x pending blocks to free %lld, +>&-264 lelong x pending inodes to free %ld, +>&-664 lequad x system-wide uuid %0llx, +>&-1316 lelong x minimum percentage of free blocks %d, +>&-1248 lelong 0 TIME optimization +>&-1248 lelong 1 SPACE optimization + +66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 leqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 lequad x number of blocks %lld, +>&-288 lequad x number of data blocks %lld, +>&-1332 lelong x number of cylinder groups %d, +>&-1328 lelong x block size %d, +>&-1324 lelong x fragment size %d, +>&-180 lelong x average file size %d, +>&-176 lelong x average number of files in dir %d, +>&-272 lequad x pending blocks to free %lld, +>&-264 lelong x pending inodes to free %ld, +>&-664 lequad x system-wide uuid %0llx, +>&-1316 lelong x minimum percentage of free blocks %d, +>&-1248 lelong 0 TIME optimization +>&-1248 lelong 1 SPACE optimization + +9564 belong 0x00011954 Unix Fast File system [v1] (big-endian), +>7168 belong 0x4c41424c Apple UFS Volume >>7186 string x named %s, >>7176 belong x volume label version %d, >>7180 bedate x created on %s, @@ -416,6 +734,46 @@ >8320 belong 0 TIME optimization >8320 belong 1 SPACE optimization +42332 belong 0x19540119 Unix Fast File system [v2] (big-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 beqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 bequad x number of blocks %lld, +>&-288 bequad x number of data blocks %lld, +>&-1332 belong x number of cylinder groups %d, +>&-1328 belong x block size %d, +>&-1324 belong x fragment size %d, +>&-180 belong x average file size %d, +>&-176 belong x average number of files in dir %d, +>&-272 bequad x pending blocks to free %lld, +>&-264 belong x pending inodes to free %ld, +>&-664 bequad x system-wide uuid %0llx, +>&-1316 belong x minimum percentage of free blocks %d, +>&-1248 belong 0 TIME optimization +>&-1248 belong 1 SPACE optimization + +66908 belong 0x19540119 Unix Fast File system [v2] (big-endian) +>&-1164 string x last mounted on %s, +>&-696 string >\0 volume name %s, +>&-304 beqldate x last written at %s, +>&-1167 byte x clean flag %d, +>&-1168 byte x readonly flag %d, +>&-296 bequad x number of blocks %lld, +>&-288 bequad x number of data blocks %lld, +>&-1332 belong x number of cylinder groups %d, +>&-1328 belong x block size %d, +>&-1324 belong x fragment size %d, +>&-180 belong x average file size %d, +>&-176 belong x average number of files in dir %d, +>&-272 bequad x pending blocks to free %lld, +>&-264 belong x pending inodes to free %ld, +>&-664 bequad x system-wide uuid %0llx, +>&-1316 belong x minimum percentage of free blocks %d, +>&-1248 belong 0 TIME optimization +>&-1248 belong 1 SPACE optimization + # ext2/ext3 filesystems - Andreas Dilger 0x438 leshort 0xEF53 Linux >0x44c lelong x rev %d @@ -505,7 +863,16 @@ # # CDROM Filesystems -32769 string CD001 ISO 9660 CD-ROM filesystem data +# Modified for UDF by gerardo.cacciari@gmail.com +32769 string CD001 +>38913 string !NSR0 ISO 9660 CD-ROM filesystem data +>38913 string NSR01 UDF filesystem data (version 1.0) +>38913 string NSR02 UDF filesystem data (version 1.5) +>38913 string NSR03 UDF filesystem data (version 2.0) +>38913 string >NSR03 UDF filesystem data (unknown version, +>>38917 byte x id 'NSR0%c') +>38913 string >38917 byte x id 'NSR0%c') # "application id" which appears to be used as a volume label >32808 string >\0 '%s' >34816 string \000CD001\001EL\ TORITO\ SPECIFICATION (bootable) @@ -570,7 +937,11 @@ 0 string sqsh Squashfs filesystem, big endian, >28 beshort x version %d. >30 beshort x \b%d, ->8 belong x %d bytes, +>28 beshort <3 +>>8 belong x %d bytes, +>28 beshort >2 +>>63 bequad x %lld bytes, +#>>67 belong x %d bytes, >4 belong x %d inodes, >28 beshort <2 >>32 beshort x blocksize: %d bytes, @@ -580,10 +951,36 @@ 0 string hsqs Squashfs filesystem, little endian, >28 leshort x version %d. >30 leshort x \b%d, ->8 lelong x %d bytes, +>28 leshort <3 +>>8 lelong x %d bytes, +>28 leshort >2 +>>63 lequad x %lld bytes, +#>>63 lelong x %d bytes, >4 lelong x %d inodes, >28 leshort <2 >>32 leshort x blocksize: %d bytes, >28 leshort >1 >>51 lelong x blocksize: %d bytes, >39 ledate x created: %s + +# AFS Dump Magic +# From: Ty Sarna +0 string \x01\xb3\xa1\x13\x22 AFS Dump +>&0 belong x (v%d) +>>&0 byte 0x76 +>>>&0 belong x Vol %d, +>>>>&0 byte 0x6e +>>>>>&0 string x %s +>>>>>>&1 byte 0x74 +>>>>>>>&0 beshort 2 +>>>>>>>>&4 bedate x on: %s +>>>>>>>>&0 bedate =0 full dump +>>>>>>>>&0 bedate !0 incremental since: %s + +# VMS backup savesets - gerardo.cacciari@gmail.com +# had to comment out GEM Image and G3 raw data entries due to conflict +#0 byte x +#>(0.s+16) string \x01\x01 +#>>&(&0.b+8) byte 0x42 OpenVMS backup saveset data +#>>>40 lelong x (block size %d +#>>>49 string >\0 original name '%s') diff --git a/contrib/file-4/magic/Magdir/flash b/contrib/file-4/magic/Magdir/flash index 2f343d8c31..f14b460c70 100644 --- a/contrib/file-4/magic/Magdir/flash +++ b/contrib/file-4/magic/Magdir/flash @@ -10,6 +10,9 @@ >3 byte x version %d 0 string CWS Macromedia Flash data (compressed), >3 byte x version %d +# From: Cal Peake +0 string FLV Macromedia Flash Video + # # From Dave Wilson 0 string AGD4\xbe\xb8\xbb\xcb\x00 Macromedia Freehand 9 Document diff --git a/contrib/file-4/magic/Magdir/fsav b/contrib/file-4/magic/Magdir/fsav index 4218936e48..4d61bebaa2 100644 --- a/contrib/file-4/magic/Magdir/fsav +++ b/contrib/file-4/magic/Magdir/fsav @@ -2,26 +2,59 @@ #------------------------------------------------------------------------------ # fsav: file(1) magic for datafellows fsav virus definition files # Anthon van der Neut (anthon@mnt.org) -0 beshort 0x1575 fsav (linux) macro virus + +# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def} +0 beshort 0x1575 fsav macro virus signatures >8 leshort >0 (%d- >11 byte >0 \b%02d- >10 byte >0 \b%02d) +# ftp://ftp.f-prot.com/pub/sign.zip +#10 ubyte <12 +#>9 ubyte <32 +#>>8 ubyte 0x0a +#>>>12 ubyte 0x07 +#>>>>11 uleshort >0 fsav DOS/Windows virus signatures (%d- +#>>>>10 byte 0 \b01- +#>>>>10 byte 1 \b02- +#>>>>10 byte 2 \b03- +#>>>>10 byte 3 \b04- +#>>>>10 byte 4 \b05- +#>>>>10 byte 5 \b06- +#>>>>10 byte 6 \b07- +#>>>>10 byte 7 \b08- +#>>>>10 byte 8 \b09- +#>>>>10 byte 9 \b10- +#>>>>10 byte 10 \b11- +#>>>>10 byte 11 \b12- +#>>>>9 ubyte >0 \b%02d) +# ftp://ftp.f-prot.com/pub/sign2.zip +#0 ubyte 0x62 +#>1 ubyte 0xF5 +#>>2 ubyte 0x1 +#>>>3 ubyte 0x1 +#>>>>4 ubyte 0x0e +#>>>>>13 ubyte >0 fsav virus signatures +#>>>>>>11 ubyte x size 0x%02x +#>>>>>>12 ubyte x \b%02x +#>>>>>>13 ubyte x \b%02x bytes -# comment this out for now because it regognizes every file where -# the eighth character is \n -#8 byte 0x0a -#>12 byte 0x07 -#>11 leshort >0 fsav (linux) virus (%d- -#>10 byte 0 \b01- -#>10 byte 1 \b02- -#>10 byte 2 \b03- -#>10 byte 3 \b04- -#>10 byte 4 \b05- -#>10 byte 5 \b06- -#>10 byte 6 \b07- -#>10 byte 7 \b08- -#>10 byte 8 \b08- -#>10 byte 9 \b10- -#>10 byte 10 \b11- -#>10 byte 11 \b12- -#>9 byte >0 \b%02d) +# Joerg Jenderek: joerg dot jenderek at web dot de +# http://www.clamav.net/doc/latest/html/node45.html +# .cvd files start with a 512 bytes colon separated header +# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime +# + gzipped tarball files +0 string ClamAV-VDB: +>11 string >\0 Clam AntiVirus database %-.23s +>>34 string : +>>>35 regex [^:]+ \b, version +>>>>35 string x \b%-.1s +>>>>>36 string !: +>>>>>>36 string x \b%-.1s +>>>>>>>37 string !: +>>>>>>>>37 string x \b%-.1s +>>>>>>>>>38 string !: +>>>>>>>>>>38 string x \b%-.1s +>>>>512 string \037\213 \b, gzipped +>>>>769 string ustar\0 \b, tared +>512 string \037\213 \b, gzipped +>769 string ustar\0 \b, tared diff --git a/contrib/file-4/magic/Magdir/iff b/contrib/file-4/magic/Magdir/iff index 62cef0dadc..3c88f9039c 100644 --- a/contrib/file-4/magic/Magdir/iff +++ b/contrib/file-4/magic/Magdir/iff @@ -15,21 +15,39 @@ >8 string AIFF \b, AIFF audio >8 string AIFC \b, AIFF-C compressed audio >8 string 8SVX \b, 8SVX 8-bit sampled sound voice +>8 string 16SV \b, 16SV 16-bit sampled sound voice >8 string SAMP \b, SAMP sampled audio ->8 string DTYP \b, DTYP datatype description ->8 string PTCH \b, PTCH binary patch +>8 string MAUD \b, MAUD MacroSystem audio +>8 string SMUS \b, SMUS simple music +>8 string CMUS \b, CMUS complex music # image formats >8 string ILBMBMHD \b, ILBM interleaved image >>20 beshort x \b, %d x >>22 beshort x %d >8 string RGBN \b, RGBN 12-bit RGB image >8 string RGB8 \b, RGB8 24-bit RGB image +>8 string DEEP \b, DEEP TVPaint/XiPaint image >8 string DR2D \b, DR2D 2-D object >8 string TDDD \b, TDDD 3-D rendering +>8 string LWOB \b, LWOB 3-D object +>8 string LWO2 \b, LWO2 3-D object, v2 +>8 string LWLO \b, LWLO 3-D layered object +>8 string REAL \b, REAL Real3D rendering +>8 string MC4D \b, MC4D MaxonCinema4D rendering +>8 string ANIM \b, ANIM animation +>8 string YAFA \b, YAFA animation +>8 string SSA\ \b, SSA super smooth animation +>8 string ACBM \b, ACBM continuous image +>8 string FAXX \b, FAXX fax image # other formats >8 string FTXT \b, FTXT formatted text >8 string CTLG \b, CTLG message catalog >8 string PREF \b, PREF preferences +>8 string DTYP \b, DTYP datatype description +>8 string PTCH \b, PTCH binary patch +>8 string AMFF \b, AMFF AmigaMetaFile format +>8 string WZRD \b, WZRD StormWIZARD resource +>8 string DOC\ \b, DOC desktop publishing document # These go at the end of the iff rules # diff --git a/contrib/file-4/magic/Magdir/images b/contrib/file-4/magic/Magdir/images index 70fd84c294..155e99efba 100644 --- a/contrib/file-4/magic/Magdir/images +++ b/contrib/file-4/magic/Magdir/images @@ -267,9 +267,6 @@ # 0 beshort 0x1010 PEX Binary Archive -# Visio drawings -03000 string Visio\ (TM)\ Drawing %s - # Tgif files 0 string \%TGIF\ x Tgif file version %s @@ -526,3 +523,8 @@ # specifications at http://hdf.ncsa.uiuc.edu/ 0 belong 0x0e031301 Hierarchical Data Format (version 4) data 0 string \211HDF\r\n\032 Hierarchical Data Format (version 5) data + +# From: Tobias Burnus +# Xara (for a while: Corel Xara) is a graphic package, see +# http://www.xara.com/ for Windows and as GPL application for +0 string XARA\243\243 Xara graphics file diff --git a/contrib/file-4/magic/Magdir/java b/contrib/file-4/magic/Magdir/java index f9b70915f6..7aa22a6adb 100644 --- a/contrib/file-4/magic/Magdir/java +++ b/contrib/file-4/magic/Magdir/java @@ -1,10 +1,7 @@ #------------------------------------------------------------ -# Java ByteCode -# From Larry Schwimmer (schwim@cs.stanford.edu) -# Handled in Mach now -#0 belong 0xcafebabe compiled Java class data, -#>6 beshort x version %d. -#>4 beshort x \b%d +# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the +# same magic number, 0xcafebabe, so they are both handled +# in the entry called "cafebabe". #------------------------------------------------------------ # Java serialization # From Martin Pool (m.pool@pharos.com.au) diff --git a/contrib/file-4/magic/Magdir/linux b/contrib/file-4/magic/Magdir/linux index 0294a06a98..36cc24fc2f 100644 --- a/contrib/file-4/magic/Magdir/linux +++ b/contrib/file-4/magic/Magdir/linux @@ -60,6 +60,8 @@ 4086 string SWAPSPACE2 Linux/i386 swap file (new style) >0x400 long x %d (4K pages) >0x404 long x size %d pages +>>4086 string SWAPSPACE2 +>>>1052 string >\0 Label %s # ECOFF magic for OSF/1 and Linux (only tested under Linux though) # # from Erik Troan (ewt@redhat.com) examining od dumps, so this @@ -82,7 +84,7 @@ # Linux kernel boot images (i386 arch) (Wolfram Kleff) 514 string HdrS Linux kernel >510 leshort 0xAA55 x86 boot executable ->>518 leshort >=3D0x200 +>>518 leshort >=0x200 >>529 byte 0 zImage, >>>529 byte 1 bzImage, >>>(526.s+0x200) string >\0 version %s, @@ -181,3 +183,49 @@ 0 lelong =0x1413f33d SYSLINUX' LSS16 image data >4 leshort x \b, width %d >6 leshort x \b, height %d + +0 string OOOM User-Mode-Linux's Copy-On-Write disk image +>4 belong x version %d + +# SE Linux policy database +# From: Mike Frysinger +0 lelong 0xf97cff8c SE Linux policy +>16 lelong x v%d +>20 lelong 1 MLS +>24 lelong x %d symbols +>28 lelong x %d ocons + +# Linux Logical Volume Manager (LVM) +# Emmanuel VARAGNAT +# +# System ID, UUID and volume group name are 128 bytes long +# but they should never be full and initialized with zeros... +# +# LVM1 +# +0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 +>0x12c string >\0 , System ID: %s + +0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 +>0x12c string >\0 , System ID: %s + +# LVM2 +# +# It seems that the label header can be in one the four first sector +# of the disk... (from _find_labeller in lib/label/label.c of LVM2) +# +# 0x200 seems to be the common case + +0x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +# read the offset to add to the start of the header, and the header +# start in 0x200 +>(0x214.l+0x200) string >\0 , UUID: %s + +0x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +>(0x014.l) string >\0 , UUID: %s + +0x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +>(0x414.l+0x400) string >\0 , UUID: %s + +0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) +>(0x614.l+0x600) string >\0 , UUID: %s diff --git a/contrib/file-4/magic/Magdir/lisp b/contrib/file-4/magic/Magdir/lisp index 42698c0088..c72b06cba6 100644 --- a/contrib/file-4/magic/Magdir/lisp +++ b/contrib/file-4/magic/Magdir/lisp @@ -4,8 +4,18 @@ # # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com) -# This is a guess, but a good one. -0 string ;; Lisp/Scheme program text +# updated by Joerg Jenderek +0 string ;; +# windows INF files often begin with semicolon and use CRLF as line end +# lisp files are mainly created on unix system with LF as line end +>2 search/2048 !\r Lisp/Scheme program text +>2 search/2048 \r Windows INF file +0 string ( +>1 string if\ Lisp/Scheme program text +>1 string setq\ Lisp/Scheme program text +>1 string defvar\ Lisp/Scheme program text +>1 string autoload\ Lisp/Scheme program text +>1 string custom-set-variables Lisp/Scheme program text # Emacs 18 - this is always correct, but not very magical. 0 string \012( Emacs v18 byte-compiled Lisp data diff --git a/contrib/file-4/magic/Magdir/mach b/contrib/file-4/magic/Magdir/mach index 6289a2da8a..cced3a5873 100644 --- a/contrib/file-4/magic/Magdir/mach +++ b/contrib/file-4/magic/Magdir/mach @@ -1,26 +1,9 @@ -#------------------------------------------------------------------------------ -# mach file description -# -# Since Java bytecode and Mach-O fat-files have the same magic number the test -# must be preformed in the same "magic" sequence to get both right. The long -# at offset 4 in a fat file tells the number of architectures. The short at -# offset 4 in a Java bytecode file is the compiler minor version and the -# short at offset 6 is the compiler major version. Since there are only -# only 18 labeled Mach-O architectures at current, and the first released -# Java class format was version 43.0, we can safely choose any number -# between 18 and 39 to test the number of architectures against -# (and use as a hack). -# -0 belong 0xcafebabe ->4 belong >19 compiled Java class data, ->>6 beshort x version %d. ->>4 beshort x \b%d ->4 belong 1 Mach-O fat file with 1 architecture ->4 belong >1 -# The following is necessary to support java class files. ->>4 belong <20 Mach-O fat file with %ld architectures -#>>4 belong <0xffff Mach-O fat file with %ld architectures -# +#------------------------------------------------------------ +# Mach has two magic numbers, 0xcafebabe and 0xfeedface. +# Unfortunately the first, cafebabe, is shared with +# Java ByteCode, so they are both handled in the file "cafebabe". +# The "feedface" ones are handled herein. +#------------------------------------------------------------ 0 lelong&0xfeffffff 0xfeedface Mach-O >0 byte 0xcf 64-bit >12 lelong 1 object diff --git a/contrib/file-4/magic/Magdir/maple b/contrib/file-4/magic/Magdir/maple index eea4794536..6bc75628fc 100644 --- a/contrib/file-4/magic/Magdir/maple +++ b/contrib/file-4/magic/Magdir/maple @@ -32,7 +32,6 @@ # that is {VERSION major_version miunor_version computer_type version_string} 0 string {VERSION\ Maple worksheet >9 string >\0 version %.1s. ->>10 string >>>11 string >\0 %.1s # .mps diff --git a/contrib/file-4/magic/Magdir/misctools b/contrib/file-4/magic/Magdir/misctools index c32d52c268..488779c56c 100644 --- a/contrib/file-4/magic/Magdir/misctools +++ b/contrib/file-4/magic/Magdir/misctools @@ -1,5 +1,13 @@ #----------------------------------------------------------------------------- # misctools: file(1) magic for miscelanous UNIX tools. # -0 string %%!! X-Post-It-Note text -0 string BEGIN:VCALENDAR vCalendar calendar file +0 string %%!! X-Post-It-Note text +0 string BEGIN:VCALENDAR vCalendar calendar file +0 string BEGIN:VCARD vCard visiting card + +# From: Alex Beregszaszi +4 string gtktalog GNOME Catalogue (gtktalog) +>13 string >\0 version %s + +# From: Tomasz Trojanowski +0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file diff --git a/contrib/file-4/magic/Magdir/msdos b/contrib/file-4/magic/Magdir/msdos index b3e91d9488..0eeb33d2fa 100644 --- a/contrib/file-4/magic/Magdir/msdos +++ b/contrib/file-4/magic/Magdir/msdos @@ -4,7 +4,13 @@ # # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) -0 string/c @echo\ off MS-DOS batch file text +# updated by Joerg Jenderek +0 string @ +>1 string/cB \ echo\ off MS-DOS batch file text +>1 string/cB echo\ off MS-DOS batch file text +>1 string/cB rem\ MS-DOS batch file text +>1 string/cB set\ MS-DOS batch file text + # OS/2 batch files are REXX. the second regex is a bit generic, oh well # the matched commands seem to be common in REXX and uncommon elsewhere @@ -39,8 +45,8 @@ # # many of the compressed formats were extraced from IDARC 1.23 source code # -0 string MZ ->0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 PE executable for MS Windows +0 string MZ MS-DOS executable +>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows >>&18 leshort&0x2000 >0 (DLL) >>&88 leshort 0 (unknown subsystem) >>&88 leshort 1 (native) @@ -60,7 +66,7 @@ >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive >0x18 leshort >0x3f ->>(0x3c.l) string PE\0\0 PE executable +>>(0x3c.l) string PE\0\0 PE # hooray, there's a DOS extender using the PE format, with a valid PE # executable inside (which just prints a message and exits if run in win) >>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender @@ -80,6 +86,7 @@ >>>>(0x3c.l+4) leshort 0x290 PA-RISC >>>>(0x3c.l+22) leshort&0x0100 >0 32-bit >>>>(0x3c.l+22) leshort&0x1000 >0 system file +>>>>(0x3c.l+232) lelong >0 Mono/.Net assembly >>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed >>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed @@ -108,7 +115,7 @@ >>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive >>>>0x30 string Inno \b, InnoSetup self-extracting archive ->>(0x3c.l) string NE NE executable +>>(0x3c.l) string NE \b, NE >>>(0x3c.l+0x36) byte 0 (unknown OS) >>>(0x3c.l+0x36) byte 1 for OS/2 1.x >>>(0x3c.l+0x36) byte 2 for MS Windows 3.x @@ -120,7 +127,7 @@ >>>&(&0x24.s-1) string ARJSFX \b, ARJ self-extracting archive >>>(0x3c.l+0x70) search/0x80 WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip) ->>(0x3c.l) string LX\0\0 LX executable +>>(0x3c.l) string LX\0\0 \b, LX >>>(0x3c.l+0x0a) leshort <1 (unknown OS) >>>(0x3c.l+0x0a) leshort 1 for OS/2 >>>(0x3c.l+0x0a) leshort 2 for MS Windows @@ -138,9 +145,9 @@ >>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive # MS Windows system file, supposedly a collection of LE executables ->>(0x3c.l) string W3 W3 executable for MS Windows +>>(0x3c.l) string W3 \b, W3 for MS Windows ->>(0x3c.l) string LE\0\0 LE executable +>>(0x3c.l) string LE\0\0 \b, LE executable >>>(0x3c.l+0x0a) leshort 1 # some DOS extenders use LE files with OS/2 header >>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender @@ -158,7 +165,7 @@ #>>>>(0x3c.l+0x1c) lelong >0x10000 for OS/2 # fails with DOS-Extenders. >>>(0x3c.l+0x0a) leshort 2 for MS Windows ->>>(0x3c.l+0x0a) leshort 3 for MS-DOS +>>>(0x3c.l+0x0a) leshort 3 for DOS >>>(0x3c.l+0x0a) leshort 4 for MS Windows (VxD) >>>(&0x7c.l+0x26) string UPX \b, UPX compressed >>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive @@ -166,25 +173,25 @@ # looks like ASCII, probably some embedded copyright message. # and definitely not NE/LE/LX/PE >>0x3c lelong >0x20000000 ->>>(4.s*512) leshort !0x014c MZ executable for MS-DOS +>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS # header data too small for extended executable >2 long !0 >>0x18 leshort <0x40 >>>(4.s*512) leshort !0x014c >>>>&(2.s-514) string !LE ->>>>>&-2 string !BW MZ executable for MS-DOS ->>>>&(2.s-514) string LE LE executable +>>>>>&-2 string !BW \b, MZ for MS-DOS +>>>>&(2.s-514) string LE \b, LE >>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender # educated guess since indirection is still not capable enough for complex offset # calculations (next embedded executable would be at &(&2*512+&0-2) # I suspect there are only LE executables in these multi-exe files >>>>&(2.s-514) string BW ->>>>>0x240 search/0x100 DOS/4G LE executable for MS-DOS, DOS4GW DOS extender (embedded) ->>>>>0x240 search/0x100 !DOS/4G BW executable collection for MS-DOS +>>>>>0x240 search/0x100 DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded) +>>>>>0x240 search/0x100 !DOS/4G ,\b BW collection for MS-DOS # This sequence skips to the first COFF segment, usually .text ->(4.s*512) leshort 0x014c COFF executable +>(4.s*512) leshort 0x014c \b, COFF >>(8.s*16) string go32stub for MS-DOS, DJGPP go32 DOS extender >>(8.s*16) string emx >>>&1 string x for DOS, Win or OS/2, emx %s @@ -255,18 +262,76 @@ # Uncommenting only the first two lines will cover about 2/3 of COM files, # but it isn't feasible to match all COM files since there must be at least # two dozen different one-byte "magics". -0 byte 0xe9 MS-DOS executable (COM) +0 byte 0xe9 DOS executable (COM) +>0x1FE leshort 0xAA55 \b, boot code >6 string SFX\ of\ LHarc (%s) -0 byte 0x8c MS-DOS executable (COM) +0 belong 0xffffffff DOS executable (device driver) +#CMD640X2.SYS +>10 string >\x23 +>>10 string !\x2e +>>>17 string <\x5B +>>>>10 string x \b, name: %.8s +#UDMA.SYS KEYB.SYS CMD640X2.SYS +>10 string <\x41 +>>12 string >\x40 +>>>10 string !$ +>>>>12 string x \b, name: %.8s +#BTCDROM.SYS ASPICD.SYS +>22 string >\x40 +>>22 string <\x5B +>>>23 string <\x5B +>>>>22 string x \b, name: %.8s +#ATAPICD.SYS +>76 string \0 +>>77 string >\x40 +>>>77 string <\x5B +>>>>77 string x \b, name: %.8s +0 byte 0x8c DOS executable (COM) # 0xeb conflicts with "sequent" magic -0 byte 0xeb MS-DOS executable (COM) +0 byte 0xeb DOS executable (COM) +>0x1FE leshort 0xAA55 \b, boot code +>85 string UPX \b, UPX compressed >4 string \ $ARX \b, ARX self-extracting archive >4 string \ $LHarc \b, LHarc self-extracting archive >0x20e string SFX\ by\ LARC \b, LARC self-extracting archive -0 byte 0xb8 COM executable for MS-DOS +0 byte 0xb8 COM executable +# modified by Joerg Jenderek +>1 lelong !0x21cd4cff for DOS +# http://syslinux.zytor.com/comboot.php +# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode +# start with assembler instructions mov eax,21cd4cffh +>1 lelong 0x21cd4cff (32-bit COMBOOT) +0 string \x81\xfc +>4 string \x77\x02\xcd\x20\xb9 +>>36 string UPX! FREE-DOS executable (COM), UPX compressed +252 string Must\ have\ DOS\ version DR-DOS executable (COM) +# GRR search is not working +#2 search/28 \xcd\x21 COM executable for MS-DOS +#WHICHFAT.cOM +2 string \xcd\x21 COM executable for DOS +#DELTREE.cOM DELTREE2.cOM +4 string \xcd\x21 COM executable for DOS +#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM +5 string \xcd\x21 COM executable for DOS +#DELTMP.COm HASFAT32.cOM +7 string \xcd\x21 +>0 byte !0xb8 COM executable for DOS +#COMP.cOM MORE.COm +10 string \xcd\x21 +>5 string !\xcd\x21 COM executable for DOS +#comecho.com +13 string \xcd\x21 COM executable for DOS +#HELP.COm EDIT.coM +18 string \xcd\x21 COM executable for MS-DOS +#NWRPLTRM.COm +23 string \xcd\x21 COM executable for MS-DOS +#LOADFIX.cOm LOADFIX.cOm +30 string \xcd\x21 COM executable for MS-DOS +#syslinux.com 3.11 +70 string \xcd\x21 COM executable for DOS # many compressed/converted COMs start with a copy loop instead of a jump 0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS -0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for MS-DOS +0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS >0x18 search/0x10 \x50\xa4\xff\xd5\x73 \b, aPack compressed 0x3c string W\ Collis\0\0 COM executable for MS-DOS, Compack compressed # FIXME: missing diet .com compression @@ -278,9 +343,10 @@ # # Windows Registry files. -# -0 string regf Windows NT registry file -0 string CREG Windows 95 registry file +# updated by Joerg Jenderek +0 string regf Windows NT/XP registry file +0 string CREG Windows 95/98/ME registry file +0 string SHCC3 Windows 3.1 registry file # AAF files: @@ -293,6 +359,8 @@ >30 byte 12 (4kB sectors) # Popular applications +# False positive with PPT +#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer 2080 string Microsoft\ Word\ 6.0\ Document %s 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data # Pawel Wiecek (for polish Word) @@ -303,7 +371,6 @@ 0 string PO^Q` Microsoft Word 6.0 Document # 0 string \376\067\0\043 Microsoft Office Document -0 string \320\317\021\340\241\261\032\341 Microsoft Office Document 0 string \333\245-\0\0\0 Microsoft Office Document # 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s @@ -340,7 +407,9 @@ >15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal # Windows Metafont .WMF -0 string \327\315\306\232\000\000\000\000\000\000 ms-windows metafont .wmf +0 string \327\315\306\232 ms-windows metafont .wmf +0 string \002\000\011\000 ms-windows metafont .wmf +0 string \001\000\011\000 ms-windows metafont .wmf #tz3 files whatever that is (MS Works files) 0 string \003\001\001\004\070\001\000\000 tz3 ms-works file @@ -521,3 +590,26 @@ # of characters instead of all the "description length" # number of characters -- indicated by the ulelong at offset 60. >>(64.l) lestring16 >0 Description: %15.15s + +# From: Alex Beregszaszi +0 string COWD VMWare3 disk image +>12 belong x %d bytes + +0 string VMDK VMware4 disk image + +0 belong 0x514649fb QEMU Copy-On-Write disk image +>4 belong x version %d, +>24 belong x size %d + +>28 belong x %d + +0 string QEVM QEMU's suspend to disk image + +0 string Bochs\ Virtual\ HD\ Image Bochs disk image, +>32 string x type %s, +>48 string x subtype %s + +0 lelong 0x02468ace Bochs Sparse disk image + +# from http://filext.com by Derek M Jones +0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer +0 string \320\317\021\340\241\261\032\341 Microsoft Office Document diff --git a/contrib/file-4/magic/Magdir/mup b/contrib/file-4/magic/Magdir/mup new file mode 100644 index 0000000000..fd9a7b1353 --- /dev/null +++ b/contrib/file-4/magic/Magdir/mup @@ -0,0 +1,22 @@ +# ------------------------------------------------------------------------ +# mup: file(1) magic for Mup (Music Publisher) input file. +# +# From: Abel Cheung +# +# NOTE: This header is mainly proposed in the Arkkra mailing list, +# and is not a mandatory header because of old mup input file +# compatibility. Noteedit also use mup format, but is not forcing +# user to use any header as well. +# +0 string //!Mup Mup music publication program input text +>6 string -Arkkra (Arkkra) +>>13 string - +>>>16 string . +>>>>14 string x \b, need V%.4s +>>>15 string . +>>>>14 string x \b, need V%.3s +>6 string - +>>9 string . +>>>7 string x \b, need V%.4s +>>8 string . +>>>7 string x \b, need V%.3s diff --git a/contrib/file-4/magic/Magdir/ncr b/contrib/file-4/magic/Magdir/ncr index 987c94e4a8..2faf98ada7 100644 --- a/contrib/file-4/magic/Magdir/ncr +++ b/contrib/file-4/magic/Magdir/ncr @@ -34,14 +34,14 @@ 0 beshort 000640 Tower32/800 68020 >18 beshort &020000 w/68881 object >18 beshort &040000 compatible object ->18 beshort &~060000 object +>18 beshort &060000 object >20 beshort 0407 executable >20 beshort 0413 pure executable >12 belong >0 not stripped >22 beshort >0 - version %ld 0 beshort 000645 Tower32/800 68010 >18 beshort &040000 compatible object ->18 beshort &~060000 object +>18 beshort &060000 object >20 beshort 0407 executable >20 beshort 0413 pure executable >12 belong >0 not stripped diff --git a/contrib/file-4/magic/Magdir/os400 b/contrib/file-4/magic/Magdir/os400 new file mode 100644 index 0000000000..bee3660651 --- /dev/null +++ b/contrib/file-4/magic/Magdir/os400 @@ -0,0 +1,32 @@ +#------------------------------------------------------------------------------ +# os400: file(1) magic for IBM OS/400 files + +# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com +# In spite of its quite variable format (due to internal memory page +# length differences between CISC and RISC versions of the OS) the +# SAVF structure hasn't suitable offsets to identify the catalog +# header in the first descriptor where there are some useful infos, +# so we must search in a somewhat large area for a particular string +# that represents the EBCDIC encoding of 'QSRDSSPC' (save/restore +# descriptor space) preceded by a two byte constant. +40 string @@@@@@@@ +>1089 search/7394 \x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data +>>&212 byte 0x01 \b, created with SAVOBJ +>>&212 byte 0x02 \b, created with SAVLIB +>>&212 byte 0x07 \b, created with SAVCFG +>>&212 byte 0x0B \b, created with SAVDLO +>>&213 byte 0x43 \b, at least V5R3 to open +>>&213 byte 0x42 \b, at least V5R2 to open +>>&213 byte 0x41 \b, at least V5R1 to open +>>&213 byte 0x40 \b, at least V4R5 to open +>>&213 byte 0x3F \b, at least V4R4 to open +>>&213 byte 0x3E \b, at least V4R3 to open +>>&213 byte 0x3C \b, at least V4R2 to open +>>&213 byte 0x3D \b, at least V4R1M4 to open +>>&213 byte 0x3B \b, at least V4R1 to open +>>&213 byte 0x3A \b, at least V3R7 to open +>>&213 byte 0x35 \b, at least V3R6 to open +>>&213 byte 0x36 \b, at least V3R2 to open +>>&213 byte 0x34 \b, at least V3R1 to open +>>&213 byte 0x31 \b, at least V3R0M5 to open +>>&213 byte 0x30 \b, at least V2R3 to open diff --git a/contrib/file-4/magic/Magdir/perl b/contrib/file-4/magic/Magdir/perl index 417220e80a..a00c642c7a 100644 --- a/contrib/file-4/magic/Magdir/perl +++ b/contrib/file-4/magic/Magdir/perl @@ -18,6 +18,15 @@ #0 regex package Perl5 module source text (via regex) 0 string package Perl5 module source text +# Perl POD documents +# From: Tom Hukins +0 string/B \=pod\n Perl POD document +0 string/B \n\=pod\n Perl POD document +0 string/B \=head1\ Perl POD document +0 string/B \n\=head1\ Perl POD document +0 string/B \=head2\ Perl POD document +0 string/B \n\=head2\ Perl POD document + # Perl Storable data files. 0 string perl-store perl Storable(v0.6) data >4 byte >0 (net-order %d) diff --git a/contrib/file-4/magic/Magdir/psion b/contrib/file-4/magic/Magdir/psion index 5e6ab1aa9e..578ea5906d 100644 --- a/contrib/file-4/magic/Magdir/psion +++ b/contrib/file-4/magic/Magdir/psion @@ -8,7 +8,7 @@ >4 lelong 0x1000003A printer driver >4 lelong 0x1000003B clipboard >4 lelong 0x10000042 multi-bitmap image ->4 lelong 0x1000006A application infomation file +>4 lelong 0x1000006A application information file >4 lelong 0x1000006D >>8 lelong 0x1000007D sketch image >>8 lelong 0x1000007E voice note @@ -37,7 +37,7 @@ >4 lelong 0x100000AD physical device driver >4 lelong 0x100000E5 file transfer protocol >4 lelong 0x100000E5 file transfer protocol ->4 lelong 0x10000140 printer defintion ->4 lelong 0x10000141 printer defintion +>4 lelong 0x10000140 printer definition +>4 lelong 0x10000141 printer definition 0 lelong 0x1000007A Psion Series 5 executable diff --git a/contrib/file-4/magic/Magdir/python b/contrib/file-4/magic/Magdir/python index ec4c121606..5aea137f28 100644 --- a/contrib/file-4/magic/Magdir/python +++ b/contrib/file-4/magic/Magdir/python @@ -12,3 +12,7 @@ 0 belong 0x2aeb0d0a python 2.1 byte-compiled 0 belong 0x2ded0d0a python 2.2 byte-compiled 0 belong 0x3bf20d0a python 2.3 byte-compiled +0 belong 0x6df20d0a python 2.4 byte-compiled + +0 string/b #!\ /usr/bin/python python script text executable + diff --git a/contrib/file-4/magic/Magdir/scientific b/contrib/file-4/magic/Magdir/scientific new file mode 100644 index 0000000000..81beac1206 --- /dev/null +++ b/contrib/file-4/magic/Magdir/scientific @@ -0,0 +1,60 @@ + +#------------------------------------------------------------------------------ +# scientific: file(1) magic for scientific formats +# +# From: Joe Krahn + +######################################################## +# CCP4 data and plot files: +0 string MTZ\040 MTZ reflection file + +92 string PLOT%%84 Plot84 plotting file +>52 byte 1 , Little-endian +>55 byte 1 , Big-endian + +######################################################## +# Electron density MAP/MASK formats + +0 string EZD_MAP NEWEZD Electron Density Map +109 string MAP\040( Old EZD Electron Density Map + +0 string/c :-)\040Origin BRIX Electron Density Map +>170 string >0 , Sigma:%.12s +#>4 string >0 %.178s +#>4 addr x %.178s + +7 string 18\040!NTITLE XPLOR ASCII Electron Density Map +9 string \040!NTITLE\012\040REMARK CNS ASCII electron density map + +208 string MAP\040 CCP4 Electron Density Map +# Assumes same stamp for float and double (normal case) +>212 byte 17 \b, Big-endian +>212 byte 34 \b, VAX format +>212 byte 68 \b, Little-endian +>212 byte 85 \b, Convex native + +############################################################ +# X-Ray Area Detector images +0 string R-AXIS4\ \ \ R-Axis Area Detector Image: +>796 lelong <20 Little-endian, IP #%d, +>>768 lelong >0 Size=%dx +>>772 lelong >0 \b%d +>796 belong <20 Big-endian, IP #%d, +>>768 belong >0 Size=%dx +>>772 belong >0 \b%d + +0 string RAXIS\ \ \ \ \ R-Axis Area Detector Image, Win32: +>796 lelong <20 Little-endian, IP #%d, +>>768 lelong >0 Size=%dx +>>772 lelong >0 \b%d +>796 belong <20 Big-endian, IP #%d, +>>768 belong >0 Size=%dx +>>772 belong >0 \b%d + + +1028 string MMX\000\000\000\000\000\000\000\000\000\000\000\000\000 MAR Area Detector Image, +>1072 ulong >1 Compressed(%d), +>1100 ulong >1 %d headers, +>1104 ulong >0 %d x +>1108 ulong >0 %d, +>1120 ulong >0 %d bits/pixel diff --git a/contrib/file-4/magic/Magdir/sun b/contrib/file-4/magic/Magdir/sun index 4c43b27a79..871071e999 100644 --- a/contrib/file-4/magic/Magdir/sun +++ b/contrib/file-4/magic/Magdir/sun @@ -12,10 +12,12 @@ >>20 belong >4096 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0600410 sparc pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0600407 sparc >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable @@ -26,11 +28,14 @@ >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable +>0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0400410 mc68020 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0400407 mc68020 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable @@ -41,11 +46,14 @@ >>20 belong <4096 shared library >>20 belong =4096 dynamically linked executable >>20 belong >4096 dynamically linked executable +>0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0200410 mc68010 pure >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable >16 belong >0 not stripped + 0 belong&077777777 0200407 mc68010 >0 byte &0x80 dynamically linked executable >0 byte ^0x80 executable diff --git a/contrib/file-4/magic/Magdir/varied.out b/contrib/file-4/magic/Magdir/varied.out index 791c9419d4..6126f363bc 100644 --- a/contrib/file-4/magic/Magdir/varied.out +++ b/contrib/file-4/magic/Magdir/varied.out @@ -30,3 +30,7 @@ # Harbour HRB files. 0 string \xc0HRB Harbour HRB file >4 short x version %d + +# From: Alex Beregszaszi +# 0 string exec BugOS executable +# 0 string pack BugOS archive diff --git a/contrib/file-4/magic/Magdir/wordprocessors b/contrib/file-4/magic/Magdir/wordprocessors index 9b122c1487..0ac97baafa 100644 --- a/contrib/file-4/magic/Magdir/wordprocessors +++ b/contrib/file-4/magic/Magdir/wordprocessors @@ -106,6 +106,18 @@ # Hangul (Korean) Word Processor File 0 string HWP\ Document\ File Hangul (Korean) Word Processor File -# CosmicBook, from Benoît Rouits +# CosmicBook, from Benoît Rouits 0 string CSBK Ted Neslson's CosmicBook hypertext file +2 string EYWR AmigaWriter file + +# chi: file(1) magic for ChiWriter files +0 string \\1cw\ ChiWriter file +>5 string >\0 version %s +0 string \\1cw ChiWriter file + +# Quark Express from http://www.garykessler.net/library/file_sigs.html +2 string IIXPR3 Intel Quark Express Document (English) +2 string IIXPRa Intel Quark Express Document (Korean) +2 string MMXPR3 Motorola Quark Express Document (English) +2 string MMXPRa Motorola Quark Express Document (Korean) diff --git a/contrib/file-4/magic/magic.mime b/contrib/file-4/magic/magic.mime index 15e300c88d..7815286216 100644 --- a/contrib/file-4/magic/magic.mime +++ b/contrib/file-4/magic/magic.mime @@ -44,7 +44,7 @@ #audio/x-tracker-module ##>17 string >\0 Title: "%s" -21 string/c !SCREAM! audio/x-mod +21 string/c \!SCREAM! audio/x-mod #audio/x-screamtracker-module 21 string BMOD2STM audio/x-mod #audio/x-screamtracker-module @@ -189,10 +189,10 @@ >8 string CDRA image/x-coreldraw # AAC (aka MPEG-2 NBC) -0 beshort&FFF6 0xFFF0 audio/X-HX-AAC-ADTS +0 beshort&0xfff6 0xfff0 audio/X-HX-AAC-ADTS 0 string ADIF audio/X-HX-AAC-ADIF -0 beshort&0xFFE0 0x56E0 audio/MP4A-LATM -0 beshort 0x4DE1 audio/MP4A-LATM +0 beshort&0xffe0 0x56e0 audio/MP4A-LATM +0 beshort 0x4De1 audio/MP4A-LATM # MPEG Layer 3 sound files 0 beshort &0xffe0 audio/mpeg @@ -209,8 +209,8 @@ # ideally should go into "images", but entries below would tag XPM as C source 0 string /*\ XPM image/x-xpmi 7bit -# 3DS (3d Studio files) -16 beshort 0x3d3d image/x-3ds +# 3DS (3d Studio files) Conflicts with diff output 0x3d '=' +#16 beshort 0x3d3d image/x-3ds # this first will upset you if you're a PL/1 shop... (are there any left?) # in which case rm it; ascmagic will catch real C programs @@ -269,7 +269,8 @@ 0 string #!\ /bin/awk application/x-awk 0 string #!/usr/bin/awk application/x-awk 0 string #!\ /usr/bin/awk application/x-awk -0 string BEGIN application/x-awk +# update to distinguish from *.vcf files by Joerg Jenderek: joerg dot jenderek at web dot de +0 regex BEGIN[[:space:]]*[{] application/x-awk # For Larry Wall's perl language. The ``eval'' line recognizes an # outrageously clever hack for USG systems. @@ -342,7 +343,7 @@ 0 short 0143561 application/x-cpio swapped 0 string = application/x-archive -0 string ! application/x-archive +0 string \! application/x-archive >8 string debian application/x-debian-package #------------------------------------------------------------------------------ @@ -919,3 +920,7 @@ # EET archive # From: Tilman Sauerbeck 0 belong 0x1ee7ff00 application/x-eet + +# From: Denis Knauf, via gentoo. +0 string fLaC audio/x-flac +0 string CWS application/x-shockwave-flash diff --git a/contrib/file-4/magic/magic2mime b/contrib/file-4/magic/magic2mime index c83ee595cd..f3fbe2675a 100644 --- a/contrib/file-4/magic/magic2mime +++ b/contrib/file-4/magic/magic2mime @@ -1,6 +1,6 @@ -#! /usr/local/bin/perl +#! /usr/bin/env perl # -*- PERL -*- -# $Id: magic2mime,v 1.2 2003/03/23 04:17:27 christos Exp $ +# $Id: magic2mime,v 1.3 2006/03/02 22:10:26 christos Exp $ # Copyright (c) 1996, 1997 vax@linkdead.paranoia.com (VaX#n8) # # Usage: echo 'your-file-output-here' | file_to_ctype.pl diff --git a/contrib/file-4/src/apprentice.c b/contrib/file-4/src/apprentice.c index f93ed361cf..9f801dbb23 100644 --- a/contrib/file-4/src/apprentice.c +++ b/contrib/file-4/src/apprentice.c @@ -36,6 +36,7 @@ #include #endif #include +#include #include #include #include @@ -45,7 +46,7 @@ #endif #ifndef lint -FILE_RCSID("@(#)$Id: apprentice.c,v 1.84 2005/03/25 18:03:18 christos Exp $") +FILE_RCSID("@(#)$Id: apprentice.c,v 1.98 2006/10/31 19:37:17 christos Exp $") #endif /* lint */ #define EATAB {while (isascii((unsigned char) *l) && \ @@ -80,28 +81,46 @@ FILE_RCSID("@(#)$Id: apprentice.c,v 1.84 2005/03/25 18:03:18 christos Exp $") #define IS_STRING(t) (IS_PLAINSTRING(t) || (t) == FILE_REGEX || \ (t) == FILE_SEARCH) -private int getvalue(struct magic_set *ms, struct magic *, char **); +struct magic_entry { + struct magic *mp; + uint32_t cont_count; + uint32_t max_count; +}; + +const int file_formats[] = { FILE_FORMAT_STRING }; +const size_t file_nformats = sizeof(file_formats) / sizeof(file_formats[0]); +const char *file_names[] = { FILE_FORMAT_NAME }; +const size_t file_nnames = sizeof(file_names) / sizeof(file_names[0]); + +private int getvalue(struct magic_set *ms, struct magic *, const char **); private int hextoint(int); -private char *getstr(struct magic_set *, char *, char *, int, int *); -private int parse(struct magic_set *, struct magic **, uint32_t *, char *, int); -private void eatsize(char **); +private const char *getstr(struct magic_set *, const char *, char *, int, + int *); +private int parse(struct magic_set *, struct magic_entry **, uint32_t *, + const char *, int); +private void eatsize(const char **); private int apprentice_1(struct magic_set *, const char *, int, struct mlist *); +private size_t apprentice_magic_strength(const struct magic *); +private int apprentice_sort(const void *, const void *); private int apprentice_file(struct magic_set *, struct magic **, uint32_t *, const char *, int); private void byteswap(struct magic *, uint32_t); private void bs1(struct magic *); private uint16_t swap2(uint16_t); private uint32_t swap4(uint32_t); +private uint64_t swap8(uint64_t); private char *mkdbname(const char *, char *, size_t, int); private int apprentice_map(struct magic_set *, struct magic **, uint32_t *, const char *); private int apprentice_compile(struct magic_set *, struct magic **, uint32_t *, const char *); +private int check_format_type(const char *, int); private int check_format(struct magic_set *, struct magic *); private size_t maxmagic = 0; private size_t magicsize = sizeof(struct magic); + #ifdef COMPILE_ONLY int main(int, char *[]); @@ -164,6 +183,7 @@ apprentice_1(struct magic_set *ms, const char *fn, int action, free(magic); return rv; } + #ifndef COMPILE_ONLY if ((rv = apprentice_map(ms, &magic, &nmagic, fn)) == -1) { if (ms->flags & MAGIC_CHECK) @@ -174,8 +194,6 @@ apprentice_1(struct magic_set *ms, const char *fn, int action, mapped = 0; } - if (rv == -1) - return rv; mapped = rv; if (magic == NULL || nmagic == 0) { @@ -231,6 +249,7 @@ file_apprentice(struct magic_set *ms, const char *fn, int action) char *p, *mfn, *afn = NULL; int file_err, errs = -1; struct mlist *mlist; + static const char mime[] = ".mime"; if (fn == NULL) fn = getenv("MAGIC"); @@ -256,14 +275,14 @@ file_apprentice(struct magic_set *ms, const char *fn, int action) if (*fn == '\0') break; if (ms->flags & MAGIC_MIME) { - if ((afn = malloc(strlen(fn) + 5 + 1)) == NULL) { + if ((afn = malloc(strlen(fn) + sizeof(mime))) == NULL) { free(mfn); free(mlist); file_oomem(ms); return NULL; } (void)strcpy(afn, fn); - (void)strcat(afn, ".mime"); + (void)strcat(afn, mime); fn = afn; } file_err = apprentice_1(ms, fn, action, mlist); @@ -286,6 +305,82 @@ file_apprentice(struct magic_set *ms, const char *fn, int action) return mlist; } +/* + * Get weight of this magic entry, for sorting purposes. + */ +private size_t +apprentice_magic_strength(const struct magic *m) +{ +#define MULT 10 + + switch (m->type) { + case FILE_BYTE: + return 1 * MULT; + + case FILE_SHORT: + case FILE_LESHORT: + case FILE_BESHORT: + return 2 * MULT; + + case FILE_LONG: + case FILE_LELONG: + case FILE_BELONG: + case FILE_MELONG: + return 4 * MULT; + + case FILE_PSTRING: + case FILE_STRING: + return m->vallen * MULT; + + case FILE_BESTRING16: + case FILE_LESTRING16: + return m->vallen * MULT / 2; + + case FILE_SEARCH: + case FILE_REGEX: + return m->vallen; + + case FILE_DATE: + case FILE_LEDATE: + case FILE_BEDATE: + case FILE_MEDATE: + case FILE_LDATE: + case FILE_LELDATE: + case FILE_BELDATE: + case FILE_MELDATE: + return 4 * MULT; + + case FILE_QDATE: + case FILE_LEQDATE: + case FILE_BEQDATE: + case FILE_QLDATE: + case FILE_LEQLDATE: + case FILE_BEQLDATE: + return 8 * MULT; + + default: + return 0; + } +} + +/* + * Sort callback for sorting entries by "strength" (basically length) + */ +private int +apprentice_sort(const void *a, const void *b) +{ + const struct magic_entry *ma = a; + const struct magic_entry *mb = b; + size_t sa = apprentice_magic_strength(ma->mp); + size_t sb = apprentice_magic_strength(mb->mp); + if (sa == sb) + return 0; + else if (sa > sb) + return -1; + else + return 1; +} + /* * parse from a file * const char *fn: name of magic file @@ -299,6 +394,10 @@ apprentice_file(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, FILE *f; char line[BUFSIZ+1]; int errs = 0; + struct magic_entry *marray; + uint32_t marraycount, i, mentrycount = 0; + + ms->flags |= MAGIC_CHECK; /* Enable checks for parsed files */ f = fopen(ms->file = fn, "r"); if (f == NULL) { @@ -309,44 +408,74 @@ apprentice_file(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, } maxmagic = MAXMAGIS; - *magicp = (struct magic *) calloc(maxmagic, sizeof(struct magic)); - if (*magicp == NULL) { + if ((marray = calloc(maxmagic, sizeof(*marray))) == NULL) { (void)fclose(f); file_oomem(ms); return -1; } + marraycount = 0; /* print silly verbose header for USG compat. */ if (action == FILE_CHECK) (void)fprintf(stderr, "%s\n", hdr); - /* parse it */ + /* read and parse this file */ for (ms->line = 1; fgets(line, BUFSIZ, f) != NULL; ms->line++) { size_t len; - if (line[0]=='#') /* comment, do not parse */ + if (line[0] == '#') /* comment, do not parse */ continue; len = strlen(line); if (len < 2) /* null line, garbage, etc */ continue; - line[len - 1] = '\0'; /* delete newline */ - if (parse(ms, magicp, nmagicp, line, action) != 0) - errs = 1; + if (line[len - 1] == '\n') + line[len - 1] = '\0'; /* delete newline */ + if (parse(ms, &marray, &marraycount, line, action) != 0) + errs++; } (void)fclose(f); + if (errs) + goto out; + +#ifndef NOORDER + qsort(marray, marraycount, sizeof(*marray), apprentice_sort); +#endif + + for (i = 0; i < marraycount; i++) + mentrycount += marray[i].cont_count; + + if ((*magicp = malloc(sizeof(**magicp) * mentrycount)) == NULL) { + file_oomem(ms); + errs++; + goto out; + } + + mentrycount = 0; + for (i = 0; i < marraycount; i++) { + (void)memcpy(*magicp + mentrycount, marray[i].mp, + marray[i].cont_count * sizeof(**magicp)); + mentrycount += marray[i].cont_count; + } +out: + for (i = 0; i < marraycount; i++) + free(marray[i].mp); + free(marray); if (errs) { - free(*magicp); *magicp = NULL; *nmagicp = 0; + return errs; + } else { + *nmagicp = mentrycount; + return 0; } - return errs; + } /* * extend the sign bit if the comparison is to be signed */ -protected uint32_t -file_signextend(struct magic_set *ms, struct magic *m, uint32_t v) +protected uint64_t +file_signextend(struct magic_set *ms, struct magic *m, uint64_t v) { if (!(m->flag & UNSIGNED)) switch(m->type) { @@ -366,14 +495,28 @@ file_signextend(struct magic_set *ms, struct magic *m, uint32_t v) case FILE_DATE: case FILE_BEDATE: case FILE_LEDATE: + case FILE_MEDATE: case FILE_LDATE: case FILE_BELDATE: case FILE_LELDATE: + case FILE_MELDATE: case FILE_LONG: case FILE_BELONG: case FILE_LELONG: + case FILE_MELONG: v = (int32_t) v; break; + case FILE_QUAD: + case FILE_BEQUAD: + case FILE_LEQUAD: + case FILE_QDATE: + case FILE_QLDATE: + case FILE_BEQDATE: + case FILE_BEQLDATE: + case FILE_LEQDATE: + case FILE_LEQLDATE: + v = (int64_t) v; + break; case FILE_STRING: case FILE_PSTRING: case FILE_BESTRING16: @@ -394,36 +537,74 @@ file_signextend(struct magic_set *ms, struct magic *m, uint32_t v) * parse one line from magic file, put into magic[index++] if valid */ private int -parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l, - int action) +parse(struct magic_set *ms, struct magic_entry **mentryp, uint32_t *nmentryp, + const char *line, int action) { - int i = 0; + size_t i; + struct magic_entry *me; struct magic *m; + const char *l = line; char *t; private const char *fops = FILE_OPS; - uint32_t val; - -#define ALLOC_INCR 200 - if (*nmagicp + 1 >= maxmagic){ - maxmagic += ALLOC_INCR; - if ((m = (struct magic *) realloc(*magicp, - sizeof(struct magic) * maxmagic)) == NULL) { - file_oomem(ms); - if (*magicp) - free(*magicp); - return -1; - } - *magicp = m; - memset(&(*magicp)[*nmagicp], 0, sizeof(struct magic) - * ALLOC_INCR); - } - m = &(*magicp)[*nmagicp]; - m->flag = 0; - m->cont_level = 0; + uint64_t val; + uint32_t cont_level; + + cont_level = 0; while (*l == '>') { ++l; /* step over */ - m->cont_level++; + cont_level++; + } + +#define ALLOC_CHUNK (size_t)10 +#define ALLOC_INCR (size_t)200 + + if (cont_level != 0) { + if (*nmentryp == 0) { + file_error(ms, 0, "No current entry for continuation"); + return -1; + } + me = &(*mentryp)[*nmentryp - 1]; + if (me->cont_count == me->max_count) { + struct magic *nm; + size_t cnt = me->max_count + ALLOC_CHUNK; + if ((nm = realloc(me->mp, sizeof(*nm) * cnt)) == NULL) { + file_oomem(ms); + return -1; + } + me->mp = m = nm; + me->max_count = cnt; + } + m = &me->mp[me->cont_count++]; + memset(m, 0, sizeof(*m)); + m->cont_level = cont_level; + } else { + if (*nmentryp == maxmagic) { + struct magic_entry *mp; + + maxmagic += ALLOC_INCR; + if ((mp = realloc(*mentryp, sizeof(*mp) * maxmagic)) == + NULL) { + file_oomem(ms); + return -1; + } + (void)memset(&mp[*nmentryp], 0, sizeof(*mp) * + ALLOC_INCR); + *mentryp = mp; + } + me = &(*mentryp)[*nmentryp]; + if (me->mp == NULL) { + if ((m = malloc(sizeof(*m) * ALLOC_CHUNK)) == NULL) { + file_oomem(ms); + return -1; + } + me->mp = m; + me->max_count = ALLOC_CHUNK; + } else + m = me->mp; + memset(m, 0, sizeof(*m)); + m->cont_level = 0; + me->cont_count = 1; } if (m->cont_level != 0 && *l == '&') { @@ -463,6 +644,9 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l, case 'L': m->in_type = FILE_BELONG; break; + case 'm': + m->in_type = FILE_MELONG; + break; case 'h': case 's': m->in_type = FILE_LESHORT; @@ -528,16 +712,15 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l, m->in_op |= FILE_OPINDIRECT; l++; } - if (isdigit((unsigned char)*l) || *l == '-') + if (isdigit((unsigned char)*l) || *l == '-') { m->in_offset = (int32_t)strtol(l, &t, 0); - else - t = l; - if (*t++ != ')' || - ((m->in_op & FILE_OPINDIRECT) && *t++ != ')')) + l = t; + } + if (*l++ != ')' || + ((m->in_op & FILE_OPINDIRECT) && *l++ != ')')) if (ms->flags & MAGIC_CHECK) file_magwarn(ms, "missing ')' in indirect offset"); - l = t; } @@ -545,93 +728,21 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l, ++l; EATAB; -#define NBYTE 4 -#define NSHORT 5 -#define NLONG 4 -#define NSTRING 6 -#define NDATE 4 -#define NBESHORT 7 -#define NBELONG 6 -#define NBEDATE 6 -#define NLESHORT 7 -#define NLELONG 6 -#define NLEDATE 6 -#define NPSTRING 7 -#define NLDATE 5 -#define NBELDATE 7 -#define NLELDATE 7 -#define NREGEX 5 -#define NBESTRING16 10 -#define NLESTRING16 10 -#define NSEARCH 6 - if (*l == 'u') { ++l; m->flag |= UNSIGNED; } /* get type, skip it */ - if (strncmp(l, "char", NBYTE)==0) { /* HP/UX compat */ - m->type = FILE_BYTE; - l += NBYTE; - } else if (strncmp(l, "byte", NBYTE)==0) { - m->type = FILE_BYTE; - l += NBYTE; - } else if (strncmp(l, "short", NSHORT)==0) { - m->type = FILE_SHORT; - l += NSHORT; - } else if (strncmp(l, "long", NLONG)==0) { - m->type = FILE_LONG; - l += NLONG; - } else if (strncmp(l, "string", NSTRING)==0) { - m->type = FILE_STRING; - l += NSTRING; - } else if (strncmp(l, "date", NDATE)==0) { - m->type = FILE_DATE; - l += NDATE; - } else if (strncmp(l, "beshort", NBESHORT)==0) { - m->type = FILE_BESHORT; - l += NBESHORT; - } else if (strncmp(l, "belong", NBELONG)==0) { - m->type = FILE_BELONG; - l += NBELONG; - } else if (strncmp(l, "bedate", NBEDATE)==0) { - m->type = FILE_BEDATE; - l += NBEDATE; - } else if (strncmp(l, "leshort", NLESHORT)==0) { - m->type = FILE_LESHORT; - l += NLESHORT; - } else if (strncmp(l, "lelong", NLELONG)==0) { - m->type = FILE_LELONG; - l += NLELONG; - } else if (strncmp(l, "ledate", NLEDATE)==0) { - m->type = FILE_LEDATE; - l += NLEDATE; - } else if (strncmp(l, "pstring", NPSTRING)==0) { - m->type = FILE_PSTRING; - l += NPSTRING; - } else if (strncmp(l, "ldate", NLDATE)==0) { - m->type = FILE_LDATE; - l += NLDATE; - } else if (strncmp(l, "beldate", NBELDATE)==0) { - m->type = FILE_BELDATE; - l += NBELDATE; - } else if (strncmp(l, "leldate", NLELDATE)==0) { - m->type = FILE_LELDATE; - l += NLELDATE; - } else if (strncmp(l, "regex", NREGEX)==0) { - m->type = FILE_REGEX; - l += NREGEX; - } else if (strncmp(l, "bestring16", NBESTRING16)==0) { - m->type = FILE_BESTRING16; - l += NBESTRING16; - } else if (strncmp(l, "lestring16", NLESTRING16)==0) { - m->type = FILE_LESTRING16; - l += NLESTRING16; - } else if (strncmp(l, "search", NSEARCH)==0) { - m->type = FILE_SEARCH; - l += NSEARCH; - } else { + for (i = 0; i < file_nnames; i++) { + size_t len = strlen(file_names[i]); + if (strncmp(l, file_names[i], len) == 0) { + m->type = i; + l+= len; + break; + } + } + if (i == file_nnames) { if (ms->flags & MAGIC_CHECK) file_magwarn(ms, "type `%s' invalid", l); return -1; @@ -648,7 +759,8 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l, if (op != FILE_OPDIVIDE || !IS_PLAINSTRING(m->type)) { ++l; m->mask_op |= op; - val = (uint32_t)strtoul(l, &l, 0); + val = (uint64_t)strtoull(l, &t, 0); + l = t; m->mask = file_signextend(ms, m, val); eatsize(&l); } else { @@ -734,11 +846,20 @@ GetDesc: m->nospflag = 1; } else m->nospflag = 0; - while ((m->desc[i++] = *l++) != '\0' && i < MAXDESC) - /* NULLBODY */; + for (i = 0; (m->desc[i++] = *l++) != '\0' && i < sizeof(m->desc); ) + continue; + if (i == sizeof(m->desc)) { + m->desc[sizeof(m->desc) - 1] = '\0'; + if (ms->flags & MAGIC_CHECK) + file_magwarn(ms, "description `%s' truncated", m->desc); + } - if (ms->flags & MAGIC_CHECK) { - if (!check_format(ms, m)) + /* + * We only do this check while compiling, or if any of the magic + * files were not compiled. + */ + if (ms->flags & MAGIC_CHECK) { + if (check_format(ms, m) == -1) return -1; } #ifndef COMPILE_ONLY @@ -746,10 +867,110 @@ GetDesc: file_mdump(m); } #endif - ++(*nmagicp); /* make room for next */ + if (m->cont_level == 0) + ++(*nmentryp); /* make room for next */ return 0; } +private int +check_format_type(const char *ptr, int type) +{ + int quad = 0; + if (*ptr == '\0') { + /* Missing format string; bad */ + return -1; + } + + switch (type) { + case FILE_FMT_QUAD: + quad = 1; + /*FALLTHROUGH*/ + case FILE_FMT_NUM: + if (*ptr == '-') + ptr++; + if (*ptr == '.') + ptr++; + while (isdigit((unsigned char)*ptr)) ptr++; + if (*ptr == '.') + ptr++; + while (isdigit((unsigned char)*ptr)) ptr++; + if (quad) { + if (*ptr++ != 'l') + return -1; + if (*ptr++ != 'l') + return -1; + } + + switch (*ptr++) { + case 'l': + switch (*ptr++) { + case 'i': + case 'd': + case 'u': + case 'x': + case 'X': + return 0; + default: + return -1; + } + + case 'h': + switch (*ptr++) { + case 'h': + switch (*ptr++) { + case 'i': + case 'd': + case 'u': + case 'x': + case 'X': + return 0; + default: + return -1; + } + case 'd': + return 0; + default: + return -1; + } + + case 'i': + case 'c': + case 'd': + case 'u': + case 'x': + case 'X': + return 0; + + default: + return -1; + } + + case FILE_FMT_STR: + if (*ptr == '-') + ptr++; + while (isdigit((unsigned char )*ptr)) + ptr++; + if (*ptr == '.') { + ptr++; + while (isdigit((unsigned char )*ptr)) + ptr++; + } + + switch (*ptr++) { + case 's': + return 0; + default: + return -1; + } + + default: + /* internal error */ + abort(); + } + /*NOTREACHED*/ + return -1; +} + /* * Check that the optional printf format in description matches * the type of the magic. @@ -757,8 +978,6 @@ GetDesc: private int check_format(struct magic_set *ms, struct magic *m) { - static const char *formats[] = { FILE_FORMAT_STRING }; - static const char *names[] = { FILE_FORMAT_NAME }; char *ptr; for (ptr = m->desc; *ptr; ptr++) @@ -768,37 +987,42 @@ check_format(struct magic_set *ms, struct magic *m) /* No format string; ok */ return 1; } - if (m->type >= sizeof(formats)/sizeof(formats[0])) { - file_magwarn(ms, "Internal error inconsistency between m->type" - " and format strings"); - return 0; + + assert(file_nformats == file_nnames); + + if (m->type >= file_nformats) { + file_error(ms, 0, "Internal error inconsistency between " + "m->type and format strings"); + return -1; } - if (formats[m->type] == NULL) { - file_magwarn(ms, "No format string for `%s' with description " - "`%s'", m->desc, names[m->type]); - return 0; + if (file_formats[m->type] == FILE_FMT_NONE) { + file_error(ms, 0, "No format string for `%s' with description " + "`%s'", m->desc, file_names[m->type]); + return -1; } + + ptr++; + if (check_format_type(ptr, file_formats[m->type]) == -1) { + /* + * TODO: this error message is unhelpful if the format + * string is not one character long + */ + file_error(ms, 0, "Printf format `%c' is not valid for type " + " `%s' in description `%s'", *ptr, + file_names[m->type], m->desc); + return -1; + } + for (; *ptr; ptr++) { - if (*ptr == 'l' || *ptr == 'h') { - /* XXX: we should really fix this one day */ - continue; + if (*ptr == '%') { + file_error(ms, 0, + "Too many format strings (should have at most one) " + "for `%s' with description `%s'", + file_names[m->type], m->desc); + return -1; } - if (islower((unsigned char)*ptr) || *ptr == 'X') - break; - } - if (*ptr == '\0') { - /* Missing format string; bad */ - file_magwarn(ms, "Invalid format `%s' for type `%s'", - m->desc, names[m->type]); - return 0; } - if (strchr(formats[m->type], *ptr) == NULL) { - file_magwarn(ms, "Printf format `%c' is not valid for type `%s'" - " in description `%s'", - *ptr, names[m->type], m->desc); - return 0; - } - return 1; + return 0; } /* @@ -807,7 +1031,7 @@ check_format(struct magic_set *ms, struct magic *m) * just after the number read. Return 0 for success, non-zero for failure. */ private int -getvalue(struct magic_set *ms, struct magic *m, char **p) +getvalue(struct magic_set *ms, struct magic *m, const char **p) { int slen; @@ -829,8 +1053,10 @@ getvalue(struct magic_set *ms, struct magic *m, char **p) return 0; default: if (m->reln != 'x') { - m->value.l = file_signextend(ms, m, - (uint32_t)strtoul(*p, p, 0)); + char *ep; + m->value.q = file_signextend(ms, m, + (uint64_t)strtoull(*p, &ep, 0)); + *p = ep; eatsize(p); } return 0; @@ -843,10 +1069,11 @@ getvalue(struct magic_set *ms, struct magic *m, char **p) * Copy the converted version to "p", returning its length in *slen. * Return updated scan pointer as function result. */ -private char * -getstr(struct magic_set *ms, char *s, char *p, int plen, int *slen) +private const char * +getstr(struct magic_set *ms, const char *s, char *p, int plen, int *slen) { - char *origs = s, *origp = p; + const char *origs = s; + char *origp = p; char *pmax = p + plen - 1; int c; int val; @@ -1018,9 +1245,9 @@ file_showstr(FILE *fp, const char *s, size_t len) * eatsize(): Eat the size spec from a number [eg. 10UL] */ private void -eatsize(char **p) +eatsize(const char **p) { - char *l = *p; + const char *l = *p; if (LOWCASE(*l) == 'u') l++; @@ -1059,7 +1286,7 @@ apprentice_map(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, if (dbname == NULL) return -1; - if ((fd = open(dbname, O_RDONLY)) == -1) + if ((fd = open(dbname, O_RDONLY|O_BINARY)) == -1) return -1; if (fstat(fd, &st) == -1) { @@ -1149,7 +1376,7 @@ apprentice_compile(struct magic_set *ms, struct magic **magicp, if (dbname == NULL) return -1; - if ((fd = open(dbname, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1) { + if ((fd = open(dbname, O_WRONLY|O_CREAT|O_TRUNC|O_BINARY, 0644)) == -1) { file_error(ms, errno, "cannot open `%s'", dbname); return -1; } @@ -1233,6 +1460,26 @@ swap4(uint32_t sv) return rv; } +/* + * swap a quad + */ +private uint64_t +swap8(uint64_t sv) +{ + uint32_t rv; + uint8_t *s = (uint8_t *)(void *)&sv; + uint8_t *d = (uint8_t *)(void *)&rv; + d[0] = s[7]; + d[1] = s[6]; + d[2] = s[5]; + d[3] = s[4]; + d[4] = s[3]; + d[5] = s[2]; + d[6] = s[1]; + d[7] = s[0]; + return rv; +} + /* * byteswap a single magic entry */ @@ -1243,6 +1490,6 @@ bs1(struct magic *m) m->offset = swap4((uint32_t)m->offset); m->in_offset = swap4((uint32_t)m->in_offset); if (!IS_STRING(m->type)) - m->value.l = swap4(m->value.l); - m->mask = swap4(m->mask); + m->value.q = swap8(m->value.q); + m->mask = swap8(m->mask); } diff --git a/contrib/file-4/src/ascmagic.c b/contrib/file-4/src/ascmagic.c index 4fced4be9e..81525c893b 100644 --- a/contrib/file-4/src/ascmagic.c +++ b/contrib/file-4/src/ascmagic.c @@ -49,7 +49,7 @@ #include "names.h" #ifndef lint -FILE_RCSID("@(#)$Id: ascmagic.c,v 1.43 2005/06/25 15:52:14 christos Exp $") +FILE_RCSID("@(#)$Id: ascmagic.c,v 1.46 2006/10/20 21:04:15 christos Exp $") #endif /* lint */ typedef unsigned long unichar; @@ -102,9 +102,9 @@ file_ascmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes) while (nbytes > 1 && buf[nbytes - 1] == '\0') nbytes--; - if ((nbuf = malloc((nbytes + 1) * sizeof(nbuf[0]))) == NULL) + if ((nbuf = calloc(1, (nbytes + 1) * sizeof(nbuf[0]))) == NULL) goto done; - if ((ubuf = malloc((nbytes + 1) * sizeof(ubuf[0]))) == NULL) + if ((ubuf = calloc(1, (nbytes + 1) * sizeof(ubuf[0]))) == NULL) goto done; /* @@ -154,6 +154,11 @@ file_ascmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes) } } + if (nbytes <= 1) { + rv = 0; + goto done; + } + /* * for troff, look for . + letter + letter or .\"; * this must be done to disambiguate tar archives' ./file diff --git a/contrib/file-4/src/compress.c b/contrib/file-4/src/compress.c index a33c7e9331..5989eb2950 100644 --- a/contrib/file-4/src/compress.c +++ b/contrib/file-4/src/compress.c @@ -42,6 +42,7 @@ #include #include #include +#include #ifdef HAVE_SYS_WAIT_H #include #endif @@ -50,10 +51,9 @@ #endif #ifndef lint -FILE_RCSID("@(#)$Id: compress.c,v 1.42 2005/03/06 05:58:22 christos Exp $") +FILE_RCSID("@(#)$Id: compress.c,v 1.45 2006/10/31 19:37:17 christos Exp $") #endif - private struct { const char *magic; size_t maglen; @@ -76,9 +76,10 @@ private struct { private int ncompr = sizeof(compr) / sizeof(compr[0]); +#define NODATA ((size_t)~0) + private ssize_t swrite(int, const void *, size_t); -private ssize_t sread(int, void *, size_t); private size_t uncompressbuf(struct magic_set *, int, size_t, const unsigned char *, unsigned char **, size_t); #ifdef HAVE_LIBZ @@ -102,7 +103,7 @@ file_zmagic(struct magic_set *ms, int fd, const unsigned char *buf, continue; if (memcmp(buf, compr[i].magic, compr[i].maglen) == 0 && (nsz = uncompressbuf(ms, fd, i, buf, &newbuf, - nbytes)) != 0) { + nbytes)) != NODATA) { ms->flags &= ~MAGIC_COMPRESS; rv = -1; if (file_buffer(ms, -1, newbuf, nsz) == -1) @@ -152,14 +153,52 @@ swrite(int fd, const void *buf, size_t n) /* * `safe' read for sockets and pipes. */ -private ssize_t +protected ssize_t sread(int fd, void *buf, size_t n) { int rv; +#ifdef FIONREAD + int t = 0; +#endif size_t rn = n; + if (fd == STDIN_FILENO) + goto nocheck; + +#ifdef FIONREAD + if ((ioctl(fd, FIONREAD, &t) < 0) || (t == 0)) { +#ifdef FD_ZERO + for (;;) { + fd_set check; + struct timeval tout = {0, 100 * 1000}; + + FD_ZERO(&check); + FD_SET(fd, &check); + + /* + * Avoid soft deadlock: do not read if there + * is nothing to read from sockets and pipes. + */ + if (select(fd + 1, &check, NULL, NULL, &tout) <= 0) { + if (errno == EINTR || errno == EAGAIN) + continue; + return 0; + } + break; + } +#endif + (void)ioctl(fd, FIONREAD, &t); + } + + if (t > 0 && (size_t)t < n) { + n = t; + rn = n; + } +#endif + +nocheck: do - switch (rv = read(fd, buf, n)) { + switch ((rv = read(fd, buf, n))) { case -1: if (errno == EINTR) continue; @@ -305,7 +344,7 @@ uncompressgzipped(struct magic_set *ms, const unsigned char *old, inflateEnd(&z); /* let's keep the nul-terminate tradition */ - (*newch)[n++] = '\0'; + (*newch)[n] = '\0'; return n; } @@ -327,7 +366,7 @@ uncompressbuf(struct magic_set *ms, int fd, size_t method, if ((fd != -1 && pipe(fdin) == -1) || pipe(fdout) == -1) { file_error(ms, errno, "cannot create pipe"); - return 0; + return NODATA; } switch (fork()) { case 0: /* child */ @@ -360,7 +399,7 @@ uncompressbuf(struct magic_set *ms, int fd, size_t method, /*NOTREACHED*/ case -1: file_error(ms, errno, "could not fork"); - return 0; + return NODATA; default: /* parent */ (void) close(fdout[1]); @@ -420,7 +459,7 @@ uncompressbuf(struct magic_set *ms, int fd, size_t method, n = r; } /* NUL terminate, as every buffer is handled here. */ - (*newch)[n++] = '\0'; + (*newch)[n] = '\0'; err: if (fdin[1] != -1) (void) close(fdin[1]); diff --git a/contrib/file-4/src/file.c b/contrib/file-4/src/file.c index bace25793c..30e04fa60a 100644 --- a/contrib/file-4/src/file.c +++ b/contrib/file-4/src/file.c @@ -39,7 +39,6 @@ #include #include /* for MAXPATHLEN */ #include -#include /* for open() */ #ifdef RESTORE_TIME # if (__COHERENT__ >= 0x420) # include @@ -72,17 +71,17 @@ #include "patchlevel.h" #ifndef lint -FILE_RCSID("@(#)$Id: file.c,v 1.96 2005/03/06 05:58:22 christos Exp $") +FILE_RCSID("@(#)$Id: file.c,v 1.102 2006/06/02 00:07:58 ian Exp $") #endif /* lint */ #ifdef S_IFLNK -#define SYMLINKFLAG "L" +#define SYMLINKFLAG "Lh" #else #define SYMLINKFLAG "" #endif -# define USAGE "Usage: %s [-bcik" SYMLINKFLAG "nNsvz] [-f namefile] [-F separator] [-m magicfiles] file...\n %s -C -m magicfiles\n" +# define USAGE "Usage: %s [-bcik" SYMLINKFLAG "nNrsvz] [-f namefile] [-F separator] [-m magicfiles] file...\n %s -C -m magicfiles\n" #ifndef MAXPATHLEN #define MAXPATHLEN 512 @@ -127,10 +126,11 @@ main(int argc, char *argv[]) int flags = 0; char *home, *usermagic; struct stat sb; -#define OPTSTRING "bcCdf:F:ikLm:nNprsvz" + static const char hmagic[] = "/.magic"; +#define OPTSTRING "bcCdf:F:hikLm:nNprsvz" #ifdef HAVE_GETOPT_LONG int longindex; - private struct option long_options[] = + static const struct option long_options[] = { {"version", 0, 0, 'v'}, {"help", 0, 0, 0}, @@ -143,6 +143,7 @@ main(int argc, char *argv[]) {"keep-going", 0, 0, 'k'}, #ifdef S_IFLNK {"dereference", 0, 0, 'L'}, + {"no-dereference", 0, 0, 'h'}, #endif {"magic-file", 1, 0, 'm'}, #if defined(HAVE_UTIME) || defined(HAVE_UTIMES) @@ -159,7 +160,8 @@ main(int argc, char *argv[]) #endif #ifdef LC_CTYPE - setlocale(LC_CTYPE, ""); /* makes islower etc work for other langs */ + /* makes islower etc work for other langs */ + (void)setlocale(LC_CTYPE, ""); #endif #ifdef __EMX__ @@ -177,9 +179,10 @@ main(int argc, char *argv[]) magicfile = usermagic; else if ((home = getenv("HOME")) != NULL) { - if ((usermagic = malloc(strlen(home) + 8)) != NULL) { + if ((usermagic = malloc(strlen(home) + + sizeof(hmagic))) != NULL) { (void)strcpy(usermagic, home); - (void)strcat(usermagic, "/.magic"); + (void)strcat(usermagic, hmagic); if (stat(usermagic, &sb)<0) free(usermagic); else @@ -187,6 +190,9 @@ main(int argc, char *argv[]) } } +#ifdef S_IFLNK + flags |= getenv("POSIXLY_CORRECT") ? MAGIC_SYMLINK : 0; +#endif #ifndef HAVE_GETOPT_LONG while ((c = getopt(argc, argv, OPTSTRING)) != -1) #else @@ -249,9 +255,9 @@ main(int argc, char *argv[]) flags |= MAGIC_DEVICES; break; case 'v': - (void) fprintf(stdout, "%s-%d.%.2d\n", progname, + (void)fprintf(stdout, "%s-%d.%.2d\n", progname, FILE_VERSION_MAJOR, patchlevel); - (void) fprintf(stdout, "magic file from %s\n", + (void)fprintf(stdout, "magic file from %s\n", magicfile); return 1; case 'z': @@ -261,6 +267,9 @@ main(int argc, char *argv[]) case 'L': flags |= MAGIC_SYMLINK; break; + case 'h': + flags &= ~MAGIC_SYMLINK; + break; #endif case '?': default: @@ -316,6 +325,7 @@ main(int argc, char *argv[]) private void +/*ARGSUSED*/ load(const char *m, int flags) { if (magic) @@ -341,6 +351,7 @@ unwrap(char *fn) char buf[MAXPATHLEN]; FILE *f; int wid = 0, cwid; + size_t len; if (strcmp("-", fn) == 0) { f = stdin; @@ -353,7 +364,10 @@ unwrap(char *fn) } while (fgets(buf, MAXPATHLEN, f) != NULL) { - cwid = file_mbswidth(buf) - 1; + len = strlen(buf); + if (len > 0 && buf[len - 1] == '\n') + buf[len - 1] = '\0'; + cwid = file_mbswidth(buf); if (cwid > wid) wid = cwid; } @@ -362,15 +376,20 @@ unwrap(char *fn) } while (fgets(buf, MAXPATHLEN, f) != NULL) { - buf[file_mbswidth(buf)-1] = '\0'; + len = strlen(buf); + if (len > 0 && buf[len - 1] == '\n') + buf[len - 1] = '\0'; process(buf, wid); if(nobuffer) - (void) fflush(stdout); + (void)fflush(stdout); } - (void) fclose(f); + (void)fclose(f); } +/* + * Called for each input file on the command line (or in a list of files) + */ private void process(const char *inname, int wid) { @@ -378,14 +397,14 @@ process(const char *inname, int wid) int std_in = strcmp(inname, "-") == 0; if (wid > 0 && !bflag) - (void) printf("%s%s%*s ", std_in ? "/dev/stdin" : inname, + (void)printf("%s%s%*s ", std_in ? "/dev/stdin" : inname, separator, (int) (nopad ? 0 : (wid - file_mbswidth(inname))), ""); type = magic_file(magic, std_in ? NULL : inname); if (type == NULL) - printf("ERROR: %s\n", magic_error(magic)); + (void)printf("ERROR: %s\n", magic_error(magic)); else - printf("%s\n", type); + (void)printf("%s\n", type); } @@ -494,7 +513,7 @@ usage(void) private void help(void) { - puts( + (void)puts( "Usage: file [OPTION]... [FILE]...\n" "Determine file type of FILEs.\n" "\n" diff --git a/contrib/file-4/src/file.h b/contrib/file-4/src/file.h index 9712e42f05..1723ec7b44 100644 --- a/contrib/file-4/src/file.h +++ b/contrib/file-4/src/file.h @@ -27,7 +27,7 @@ */ /* * file.h - definitions for file(1) program - * @(#)$Id: file.h,v 1.68 2005/06/25 15:52:14 christos Exp $ + * @(#)$Id: file.h,v 1.80 2006/10/31 20:57:45 christos Exp $ */ #ifndef __file_h__ @@ -39,12 +39,14 @@ #include /* Include that here, to make sure __P gets defined */ #include +#include /* For open and flags */ #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_INTTYPES_H #include #endif +#include /* Do this here and now, because struct stat gets re-defined on solaris */ #include @@ -72,7 +74,7 @@ #define MAXstring 32 /* max leng of "string" types */ #define MAGICNO 0xF11E041C -#define VERSIONNO 2 +#define VERSIONNO 3 #define FILE_MAGICSIZE (32 * 4) #define FILE_LOAD 0 @@ -112,6 +114,18 @@ struct magic { #define FILE_BESTRING16 18 #define FILE_LESTRING16 19 #define FILE_SEARCH 20 +#define FILE_MEDATE 21 +#define FILE_MELDATE 22 +#define FILE_MELONG 23 +#define FILE_QUAD 24 +#define FILE_LEQUAD 25 +#define FILE_BEQUAD 26 +#define FILE_QDATE 27 +#define FILE_LEQDATE 28 +#define FILE_BEQDATE 29 +#define FILE_QLDATE 30 +#define FILE_LEQLDATE 31 +#define FILE_BEQLDATE 32 #define FILE_FORMAT_NAME \ /* 0 */ "invalid 0", \ @@ -134,16 +148,31 @@ struct magic { /* 17 */ "regex", \ /* 18 */ "bestring16", \ /* 19 */ "lestring16", \ -/* 20 */ "search", +/* 20 */ "search", \ +/* 21 */ "medate", \ +/* 22 */ "meldate", \ +/* 23 */ "melong", \ +/* 24 */ "quad", \ +/* 25 */ "lequad", \ +/* 26 */ "bequad", \ +/* 27 */ "qdate", \ +/* 28 */ "leqdate", \ +/* 29 */ "beqdate", \ +/* 30 */ "qldate", \ +/* 31 */ "leqldate", \ +/* 32 */ "beqldate", -#define FILE_FMT_NUM "cduxXi" -#define FILE_FMT_STR "s" + +#define FILE_FMT_NONE 0 +#define FILE_FMT_NUM 1 /* "cduxXi" */ +#define FILE_FMT_STR 2 /* "s" */ +#define FILE_FMT_QUAD 3 /* "ll" */ #define FILE_FORMAT_STRING \ -/* 0 */ NULL, \ +/* 0 */ FILE_FMT_NONE, \ /* 1 */ FILE_FMT_NUM, \ /* 2 */ FILE_FMT_NUM, \ -/* 3 */ NULL, \ +/* 3 */ FILE_FMT_NONE, \ /* 4 */ FILE_FMT_NUM, \ /* 5 */ FILE_FMT_STR, \ /* 6 */ FILE_FMT_STR, \ @@ -160,7 +189,20 @@ struct magic { /* 17 */ FILE_FMT_STR, \ /* 18 */ FILE_FMT_STR, \ /* 19 */ FILE_FMT_STR, \ -/* 20 */ FILE_FMT_STR, +/* 20 */ FILE_FMT_STR, \ +/* 21 */ FILE_FMT_STR, \ +/* 22 */ FILE_FMT_STR, \ +/* 23 */ FILE_FMT_NUM, \ +/* 24 */ FILE_FMT_QUAD, \ +/* 25 */ FILE_FMT_QUAD, \ +/* 26 */ FILE_FMT_QUAD, \ +/* 27 */ FILE_FMT_STR, \ +/* 28 */ FILE_FMT_STR, \ +/* 29 */ FILE_FMT_STR, \ +/* 30 */ FILE_FMT_STR, \ +/* 31 */ FILE_FMT_STR, \ +/* 32 */ FILE_FMT_STR, + /* Word 3 */ uint8_t in_op; /* operator for indirection */ @@ -183,20 +225,23 @@ struct magic { /* Word 5 */ int32_t in_offset; /* offset from indirection */ /* Word 6 */ - uint32_t mask; /* mask before comparison with value */ - /* Word 7 */ - uint32_t dummy3; - /* Word 8 */ - uint32_t dummp4; + uint32_t dummy4; + /* Word 7,8 */ + uint64_t mask; /* mask before comparison with value */ /* Words 9-16 */ union VALUETYPE { uint8_t b; uint16_t h; uint32_t l; + uint64_t q; char s[MAXstring]; - char *buf; + struct { + char *buf; + size_t buflen; + } search; uint8_t hs[2]; /* 2 bytes of a fixed-endian "short" */ uint8_t hl[4]; /* 4 bytes of a fixed-endian "long" */ + uint8_t hq[8]; /* 8 bytes of a fixed-endian "quad" */ } value; /* either number or string */ /* Words 17..31 */ char desc[MAXDESC]; /* description */ @@ -257,7 +302,7 @@ protected int file_ascmagic(struct magic_set *, const unsigned char *, size_t); protected int file_is_tar(struct magic_set *, const unsigned char *, size_t); protected int file_softmagic(struct magic_set *, const unsigned char *, size_t); protected struct mlist *file_apprentice(struct magic_set *, const char *, int); -protected uint32_t file_signextend(struct magic_set *, struct magic *, uint32_t); +protected uint64_t file_signextend(struct magic_set *, struct magic *, uint64_t); protected void file_delmagic(struct magic *, int type, size_t entries); protected void file_badread(struct magic_set *); protected void file_badseek(struct magic_set *); @@ -268,6 +313,12 @@ protected void file_mdump(struct magic *); protected void file_showstr(FILE *, const char *, size_t); protected size_t file_mbswidth(const char *); protected const char *file_getbuffer(struct magic_set *); +protected ssize_t sread(int, void *, size_t); + +#ifndef COMPILE_ONLY +extern const char *file_names[]; +extern const size_t file_nnames; +#endif #ifndef HAVE_STRERROR extern int sys_nerr; @@ -280,14 +331,21 @@ extern char *sys_errlist[]; #define strtoul(a, b, c) strtol(a, b, c) #endif +#ifndef HAVE_SNPRINTF +int snprintf(char *, size_t, const char *, ...); +#endif + #if defined(HAVE_MMAP) && defined(HAVE_SYS_MMAN_H) && !defined(QUICK) #define QUICK #endif +#ifndef O_BINARY +#define O_BINARY 0 +#endif + #define FILE_RCSID(id) \ static const char *rcsid(const char *p) { \ return rcsid(p = id); \ } -#else #endif /* __file_h__ */ diff --git a/contrib/file-4/src/funcs.c b/contrib/file-4/src/funcs.c index a2ceff7f8e..ea0a54c6ae 100644 --- a/contrib/file-4/src/funcs.c +++ b/contrib/file-4/src/funcs.c @@ -30,10 +30,21 @@ #include #include #include +#if defined(HAVE_WCHAR_H) +#include +#endif +#if defined(HAVE_WCTYPE_H) +#include +#endif #ifndef lint -FILE_RCSID("@(#)$Id: funcs.c,v 1.14 2005/01/07 19:17:27 christos Exp $") +FILE_RCSID("@(#)$Id: funcs.c,v 1.22 2006/10/31 19:37:17 christos Exp $") #endif /* lint */ + +#ifndef HAVE_VSNPRINTF +int vsnprintf(char *, size_t, const char *, va_list); +#endif + /* * Like printf, only we print to a buffer and advance it. */ @@ -123,7 +134,10 @@ file_buffer(struct magic_set *ms, int fd, const void *buf, size_t nb) if ((m = file_ascmagic(ms, buf, nb)) == 0) { /* abandon hope, all ye who remain here */ if (file_printf(ms, ms->flags & MAGIC_MIME ? - "application/octet-stream" : "data") == -1) + (nb ? "application/octet-stream" : + "application/empty") : + (nb ? "data" : + "empty")) == -1) return -1; m = 1; } @@ -147,6 +161,14 @@ file_reset(struct magic_set *ms) return 0; } +#define OCTALIFY(n, o) \ + /*LINTED*/ \ + (void)(*(n)++ = '\\', \ + *(n)++ = (((uint32_t)*(o) >> 6) & 3) + '0', \ + *(n)++ = (((uint32_t)*(o) >> 3) & 7) + '0', \ + *(n)++ = (((uint32_t)*(o) >> 0) & 7) + '0', \ + (o)++) + protected const char * file_getbuffer(struct magic_set *ms) { @@ -169,16 +191,78 @@ file_getbuffer(struct magic_set *ms) ms->o.pbuf = nbuf; } +#if defined(HAVE_WCHAR_H) && defined(HAVE_MBRTOWC) && defined(HAVE_WCWIDTH) + { + mbstate_t state; + wchar_t nextchar; + int mb_conv = 1; + size_t bytesconsumed; + char *eop; + (void)memset(&state, 0, sizeof(mbstate_t)); + + np = ms->o.pbuf; + op = ms->o.buf; + eop = op + strlen(ms->o.buf); + + while (op < eop) { + bytesconsumed = mbrtowc(&nextchar, op, + (size_t)(eop - op), &state); + if (bytesconsumed == (size_t)(-1) || + bytesconsumed == (size_t)(-2)) { + mb_conv = 0; + break; + } + + if (iswprint(nextchar)) { + (void)memcpy(np, op, bytesconsumed); + op += bytesconsumed; + np += bytesconsumed; + } else { + while (bytesconsumed-- > 0) + OCTALIFY(np, op); + } + } + *np = '\0'; + + /* Parsing succeeded as a multi-byte sequence */ + if (mb_conv != 0) + return ms->o.pbuf; + } +#endif + for (np = ms->o.pbuf, op = ms->o.buf; *op; op++) { if (isprint((unsigned char)*op)) { *np++ = *op; } else { - *np++ = '\\'; - *np++ = ((*op >> 6) & 3) + '0'; - *np++ = ((*op >> 3) & 7) + '0'; - *np++ = ((*op >> 0) & 7) + '0'; + OCTALIFY(np, op); } } *np = '\0'; return ms->o.pbuf; } + +/* + * Yes these wrappers suffer from buffer overflows, but if your OS does not have + * the real functions, maybe you should consider replacing your OS? + */ +#ifndef HAVE_VSNPRINTF +int +vsnprintf(char *buf, size_t len, const char *fmt, va_list ap) +{ + return vsprintf(buf, fmt, ap); +} +#endif + +#ifndef HAVE_SNPRINTF +/*ARGSUSED*/ +int +snprintf(char *buf, size_t len, const char *fmt, ...) +{ + int rv; + va_list ap; + va_start(ap, fmt); + rv = vsprintf(buf, fmt, ap); + va_end(ap); + return rv; +} +#endif diff --git a/contrib/file-4/src/is_tar.c b/contrib/file-4/src/is_tar.c index b6ad2e3c1b..646172474a 100644 --- a/contrib/file-4/src/is_tar.c +++ b/contrib/file-4/src/is_tar.c @@ -45,7 +45,7 @@ #include "tar.h" #ifndef lint -FILE_RCSID("@(#)$Id: is_tar.c,v 1.25 2004/09/11 19:15:57 christos Exp $") +FILE_RCSID("@(#)$Id: is_tar.c,v 1.26 2006/05/03 15:19:25 christos Exp $") #endif #define isodigit(c) ( ((c) >= '0') && ((c) <= '7') ) @@ -71,6 +71,12 @@ file_is_tar(struct magic_set *ms, const unsigned char *buf, size_t nbytes) "application/x-tar, POSIX" : "POSIX tar archive") == -1) return -1; return 1; + case 3: + if (file_printf(ms, (ms->flags & MAGIC_MIME) ? + "application/x-tar, POSIX (GNU)" : + "POSIX tar archive (GNU)") == -1) + return -1; + return 1; default: return 0; } @@ -113,7 +119,9 @@ is_tar(const unsigned char *buf, size_t nbytes) if (sum != recsum) return 0; /* Not a tar archive */ - if (0==strcmp(header->header.magic, TMAGIC)) + if (strcmp(header->header.magic, GNUTMAGIC) == 0) + return 3; /* GNU Unix Standard tar archive */ + if (strcmp(header->header.magic, TMAGIC) == 0) return 2; /* Unix Standard tar archive */ return 1; /* Old fashioned tar archive */ diff --git a/contrib/file-4/src/magic.c b/contrib/file-4/src/magic.c index de2c618c47..3f24075b1e 100644 --- a/contrib/file-4/src/magic.c +++ b/contrib/file-4/src/magic.c @@ -35,10 +35,10 @@ #include #include /* for MAXPATHLEN */ #include -#include /* for open() */ #ifdef QUICK #include #endif +#include /* for PIPE_BUF */ #if defined(HAVE_UTIMES) # include @@ -63,7 +63,7 @@ #include "patchlevel.h" #ifndef lint -FILE_RCSID("@(#)$Id: magic.c,v 1.28 2005/06/25 15:52:14 christos Exp $") +FILE_RCSID("@(#)$Id: magic.c,v 1.35 2006/10/31 19:37:17 christos Exp $") #endif /* lint */ #ifdef __EMX__ @@ -75,6 +75,11 @@ protected int file_os2_apptype(struct magic_set *ms, const char *fn, private void free_mlist(struct mlist *); private void close_and_restore(const struct magic_set *, const char *, int, const struct stat *); +private int info_from_stat(struct magic_set *, mode_t); + +#ifndef STDIN_FILENO +#define STDIN_FILENO 0 +#endif public struct magic_set * magic_open(int flags) @@ -133,9 +138,26 @@ free_mlist(struct mlist *mlist) free(ml); } +private int +info_from_stat(struct magic_set *ms, mode_t md) +{ + /* We cannot open it, but we were able to stat it. */ + if (md & 0222) + if (file_printf(ms, "writable, ") == -1) + return -1; + if (md & 0111) + if (file_printf(ms, "executable, ") == -1) + return -1; + if (S_ISREG(md)) + if (file_printf(ms, "regular file, ") == -1) + return -1; + if (file_printf(ms, "no read permission") == -1) + return -1; + return 0; +} + public void -magic_close(ms) - struct magic_set *ms; +magic_close(struct magic_set *ms) { free_mlist(ms->mlist); free(ms->o.pbuf); @@ -179,8 +201,11 @@ private void close_and_restore(const struct magic_set *ms, const char *name, int fd, const struct stat *sb) { + if (fd == STDIN_FILENO) + return; (void) close(fd); - if (fd != STDIN_FILENO && (ms->flags & MAGIC_PRESERVE_ATIME) != 0) { + + if ((ms->flags & MAGIC_PRESERVE_ATIME) != 0) { /* * Try to restore access, modification times if read it. * This is really *bad* because it will modify the status @@ -215,6 +240,7 @@ magic_file(struct magic_set *ms, const char *inname) unsigned char *buf; struct stat sb; ssize_t nbytes = 0; /* number of bytes read from a datafile */ + int ispipe = 0; /* * one extra for terminating '\0', and @@ -228,43 +254,75 @@ magic_file(struct magic_set *ms, const char *inname) goto done; switch (file_fsmagic(ms, inname, &sb)) { - case -1: + case -1: /* error */ goto done; - case 0: + case 0: /* nothing found */ break; - default: + default: /* matched it and printed type */ rv = 0; goto done; } -#ifndef STDIN_FILENO -#define STDIN_FILENO 0 -#endif - if (inname == NULL) + if (inname == NULL) { fd = STDIN_FILENO; - else if ((fd = open(inname, O_RDONLY)) < 0) { - /* We cannot open it, but we were able to stat it. */ - if (sb.st_mode & 0222) - if (file_printf(ms, "writable, ") == -1) - goto done; - if (sb.st_mode & 0111) - if (file_printf(ms, "executable, ") == -1) - goto done; - if (S_ISREG(sb.st_mode)) - if (file_printf(ms, "regular file, ") == -1) - goto done; - if (file_printf(ms, "no read permission") == -1) + if (fstat(fd, &sb) == 0 && S_ISFIFO(sb.st_mode)) + ispipe = 1; + } else { + int flags = O_RDONLY|O_BINARY; + + if (stat(inname, &sb) == 0 && S_ISFIFO(sb.st_mode)) { + flags |= O_NONBLOCK; + ispipe = 1; + } + + errno = 0; + if ((fd = open(inname, flags)) < 0) { +#ifdef __CYGWIN__ + char *tmp = alloca(strlen(inname) + 5); + (void)strcat(strcpy(tmp, inname), ".exe"); + if ((fd = open(tmp, flags)) < 0) { +#endif + if (info_from_stat(ms, sb.st_mode) == -1) + goto done; + rv = 0; goto done; - rv = 0; - goto done; +#ifdef __CYGWIN__ + } +#endif + } +#ifdef O_NONBLOCK + if ((flags = fcntl(fd, F_GETFL)) != -1) { + flags &= ~O_NONBLOCK; + (void)fcntl(fd, F_SETFL, flags); + } +#endif } /* * try looking at the first HOWMANY bytes */ - if ((nbytes = read(fd, (char *)buf, HOWMANY)) == -1) { - file_error(ms, errno, "cannot read `%s'", inname); - goto done; + if (ispipe) { + ssize_t r = 0; + + while ((r = sread(fd, (void *)&buf[nbytes], + (size_t)(HOWMANY - nbytes))) > 0) { + nbytes += r; + if (r < PIPE_BUF) break; + } + + if (nbytes == 0) { + /* We can not read it, but we were able to stat it. */ + if (info_from_stat(ms, sb.st_mode) == -1) + goto done; + rv = 0; + goto done; + } + + } else { + if ((nbytes = read(fd, (char *)buf, HOWMANY)) == -1) { + file_error(ms, errno, "cannot read `%s'", inname); + goto done; + } } if (nbytes == 0) { diff --git a/contrib/file-4/src/patchlevel.h b/contrib/file-4/src/patchlevel.h index ad28fee32d..f7a8c12cee 100644 --- a/contrib/file-4/src/patchlevel.h +++ b/contrib/file-4/src/patchlevel.h @@ -1,11 +1,23 @@ #define FILE_VERSION_MAJOR 4 -#define patchlevel 14 +#define patchlevel 18 /* * Patchlevel file for Ian Darwin's MAGIC command. - * $Id: patchlevel.h,v 1.57 2005/06/25 15:52:14 christos Exp $ + * $Id: patchlevel.h,v 1.61 2006/10/31 21:18:09 christos Exp $ * * $Log: patchlevel.h,v $ + * Revision 1.61 2006/10/31 21:18:09 christos + * bump + * + * Revision 1.60 2006/03/02 22:15:12 christos + * welcome to 4.17 + * + * Revision 1.59 2005/10/17 17:15:21 christos + * welcome to 4.16 + * + * Revision 1.58 2005/08/18 15:52:56 christos + * welcome to 4.15 + * * Revision 1.57 2005/06/25 15:52:14 christos * Welcome to 4.14 * diff --git a/contrib/file-4/src/print.c b/contrib/file-4/src/print.c index a6ed790f9c..e9cd7abb42 100644 --- a/contrib/file-4/src/print.c +++ b/contrib/file-4/src/print.c @@ -41,7 +41,7 @@ #include #ifndef lint -FILE_RCSID("@(#)$Id: print.c,v 1.47 2005/03/14 16:56:25 christos Exp $") +FILE_RCSID("@(#)$Id: print.c,v 1.54 2006/10/31 19:37:17 christos Exp $") #endif /* lint */ #define SZOF(a) (sizeof(a) / sizeof(a[0])) @@ -50,13 +50,8 @@ FILE_RCSID("@(#)$Id: print.c,v 1.47 2005/03/14 16:56:25 christos Exp $") protected void file_mdump(struct magic *m) { - private const char *typ[] = { "invalid", "byte", "short", "invalid", - "long", "string", "date", "beshort", - "belong", "bedate", "leshort", "lelong", - "ledate", "pstring", "ldate", "beldate", - "leldate", "regex" }; - private const char optyp[] = { '@', '&', '|', '^', '+', '-', - '*', '/', '%' }; + private const char optyp[] = { FILE_OPS }; + (void) fputc('[', stderr); (void) fprintf(stderr, ">>>>>>>> %d" + 8 - (m->cont_level & 7), m->offset); @@ -64,8 +59,8 @@ file_mdump(struct magic *m) if (m->flag & INDIR) { (void) fprintf(stderr, "(%s,", /* Note: type is unsigned */ - (m->in_type < SZOF(typ)) ? - typ[m->in_type] : "*bad*"); + (m->in_type < file_nnames) ? + file_names[m->in_type] : "*bad*"); if (m->in_op & FILE_OPINVERSE) (void) fputc('~', stderr); (void) fprintf(stderr, "%c%d),", @@ -75,7 +70,7 @@ file_mdump(struct magic *m) } (void) fprintf(stderr, " %s%s", (m->flag & UNSIGNED) ? "u" : "", /* Note: type is unsigned */ - (m->type < SZOF(typ)) ? typ[m->type] : "*bad*"); + (m->type < file_nnames) ? file_names[m->type] : "*bad*"); if (m->mask_op & FILE_OPINVERSE) (void) fputc('~', stderr); if (m->mask) { @@ -83,8 +78,8 @@ file_mdump(struct magic *m) fputc(optyp[m->mask_op&0x7F], stderr); else fputc('?', stderr); - if(FILE_STRING != m->type || FILE_PSTRING != m->type) - (void) fprintf(stderr, "%.8x", m->mask); + if (FILE_STRING != m->type || FILE_PSTRING != m->type) + (void) fprintf(stderr, "%.8llx", m->mask); else { if (m->mask & STRING_IGNORE_LOWERCASE) (void) fputc(CHAR_IGNORE_LOWERCASE, stderr); @@ -105,27 +100,50 @@ file_mdump(struct magic *m) case FILE_LONG: case FILE_LESHORT: case FILE_LELONG: + case FILE_MELONG: case FILE_BESHORT: case FILE_BELONG: (void) fprintf(stderr, "%d", m->value.l); break; - case FILE_STRING: + case FILE_BEQUAD: + case FILE_LEQUAD: + case FILE_QUAD: + (void) fprintf(stderr, "%lld", m->value.q); + break; case FILE_PSTRING: + case FILE_STRING: case FILE_REGEX: - file_showstr(stderr, m->value.s, ~0U); + case FILE_BESTRING16: + case FILE_LESTRING16: + case FILE_SEARCH: + file_showstr(stderr, m->value.s, (size_t)m->vallen); break; case FILE_DATE: case FILE_LEDATE: case FILE_BEDATE: + case FILE_MEDATE: (void)fprintf(stderr, "%s,", file_fmttime(m->value.l, 1)); break; case FILE_LDATE: case FILE_LELDATE: case FILE_BELDATE: + case FILE_MELDATE: (void)fprintf(stderr, "%s,", file_fmttime(m->value.l, 0)); break; + case FILE_QDATE: + case FILE_LEQDATE: + case FILE_BEQDATE: + (void)fprintf(stderr, "%s,", + file_fmttime((uint32_t)m->value.q, 1)); + break; + case FILE_QLDATE: + case FILE_LEQLDATE: + case FILE_BEQLDATE: + (void)fprintf(stderr, "%s,", + file_fmttime((uint32_t)m->value.q, 0)); + break; default: (void) fputs("*bad*", stderr); break; diff --git a/contrib/file-4/src/readelf.c b/contrib/file-4/src/readelf.c index 21b8c24d00..1ef1f2e31e 100644 --- a/contrib/file-4/src/readelf.c +++ b/contrib/file-4/src/readelf.c @@ -37,19 +37,23 @@ #include "readelf.h" #ifndef lint -FILE_RCSID("@(#)$Id: readelf.c,v 1.47 2005/06/25 15:52:14 christos Exp $") +FILE_RCSID("@(#)$Id: readelf.c,v 1.59 2006/10/31 19:37:17 christos Exp $") #endif #ifdef ELFCORE -private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t); +private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t, + off_t, int *); #endif -private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t); -private int doshn(struct magic_set *, int, int, int, off_t, int, size_t); +private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t, + off_t, int *); +private int doshn(struct magic_set *, int, int, int, off_t, int, size_t, int *); private size_t donote(struct magic_set *, unsigned char *, size_t, size_t, int, - int, size_t); + int, size_t, int *); #define ELF_ALIGN(a) ((((a) + align - 1) / align) * align) +#define isquote(c) (strchr("'\"`", (c)) != NULL) + private uint16_t getu16(int, uint16_t); private uint32_t getu32(int, uint32_t); private uint64_t getu64(int, uint64_t); @@ -119,48 +123,65 @@ getu64(int swap, uint64_t value) return value; } -#define sh_addr (class == ELFCLASS32 \ +#ifdef USE_ARRAY_FOR_64BIT_TYPES +# define elf_getu64(swap, array) \ + ((swap ? ((uint64_t)getu32(swap, array[0])) << 32 : getu32(swap, array[0])) + \ + (swap ? getu32(swap, array[1]) : ((uint64_t)getu32(swap, array[1]) << 32))) +#else +# define elf_getu64(swap, value) getu64(swap, value) +#endif + +#define xsh_addr (class == ELFCLASS32 \ ? (void *) &sh32 \ : (void *) &sh64) -#define sh_size (class == ELFCLASS32 \ +#define xsh_sizeof (class == ELFCLASS32 \ ? sizeof sh32 \ : sizeof sh64) -#define shs_type (class == ELFCLASS32 \ +#define xsh_size (class == ELFCLASS32 \ + ? getu32(swap, sh32.sh_size) \ + : getu64(swap, sh64.sh_size)) +#define xsh_offset (class == ELFCLASS32 \ + ? getu32(swap, sh32.sh_offset) \ + : getu64(swap, sh64.sh_offset)) +#define xsh_type (class == ELFCLASS32 \ ? getu32(swap, sh32.sh_type) \ : getu32(swap, sh64.sh_type)) -#define ph_addr (class == ELFCLASS32 \ +#define xph_addr (class == ELFCLASS32 \ ? (void *) &ph32 \ : (void *) &ph64) -#define ph_size (class == ELFCLASS32 \ +#define xph_sizeof (class == ELFCLASS32 \ ? sizeof ph32 \ : sizeof ph64) -#define ph_type (class == ELFCLASS32 \ +#define xph_type (class == ELFCLASS32 \ ? getu32(swap, ph32.p_type) \ : getu32(swap, ph64.p_type)) -#define ph_offset (class == ELFCLASS32 \ +#define xph_offset (class == ELFCLASS32 \ ? getu32(swap, ph32.p_offset) \ : getu64(swap, ph64.p_offset)) -#define ph_align (size_t)((class == ELFCLASS32 \ +#define xph_align (size_t)((class == ELFCLASS32 \ ? (off_t) (ph32.p_align ? \ getu32(swap, ph32.p_align) : 4) \ : (off_t) (ph64.p_align ? \ getu64(swap, ph64.p_align) : 4))) -#define ph_filesz (size_t)((class == ELFCLASS32 \ +#define xph_filesz (size_t)((class == ELFCLASS32 \ ? getu32(swap, ph32.p_filesz) \ : getu64(swap, ph64.p_filesz))) -#define ph_memsz (size_t)((class == ELFCLASS32 \ +#define xnh_addr (class == ELFCLASS32 \ + ? (void *) &nh32 \ + : (void *) &nh64) +#define xph_memsz (size_t)((class == ELFCLASS32 \ ? getu32(swap, ph32.p_memsz) \ : getu64(swap, ph64.p_memsz))) -#define nh_size (class == ELFCLASS32 \ +#define xnh_sizeof (class == ELFCLASS32 \ ? sizeof nh32 \ : sizeof nh64) -#define nh_type (class == ELFCLASS32 \ +#define xnh_type (class == ELFCLASS32 \ ? getu32(swap, nh32.n_type) \ : getu32(swap, nh64.n_type)) -#define nh_namesz (class == ELFCLASS32 \ +#define xnh_namesz (class == ELFCLASS32 \ ? getu32(swap, nh32.n_namesz) \ : getu32(swap, nh64.n_namesz)) -#define nh_descsz (class == ELFCLASS32 \ +#define xnh_descsz (class == ELFCLASS32 \ ? getu32(swap, nh32.n_descsz) \ : getu32(swap, nh64.n_descsz)) #define prpsoffsets(i) (class == ELFCLASS32 \ @@ -170,14 +191,16 @@ getu64(int swap, uint64_t value) #ifdef ELFCORE size_t prpsoffsets32[] = { 8, /* FreeBSD */ - 28, /* Linux 2.0.36 */ - 32, /* Linux (I forget which kernel version) */ + 28, /* Linux 2.0.36 (short name) */ + 44, /* Linux (path name) */ 84, /* SunOS 5.x */ }; size_t prpsoffsets64[] = { - 40, /* Linux (tested on core from 2.4.x) */ - 120, /* SunOS 5.x, 64-bit */ + 16, /* FreeBSD, 64-bit */ + 40, /* Linux (tested on core from 2.4.x, short name) */ + 56, /* Linux (path name) */ + 120, /* SunOS 5.x, 64-bit */ }; #define NOFFSETS32 (sizeof prpsoffsets32 / sizeof prpsoffsets32[0]) @@ -216,47 +239,66 @@ private const char *os_style_names[] = { "NetBSD", }; +#define FLAGS_DID_CORE 1 +#define FLAGS_DID_NOTE 2 + private int dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off, - int num, size_t size) + int num, size_t size, off_t fsize, int *flags) { Elf32_Phdr ph32; Elf64_Phdr ph64; size_t offset; unsigned char nbuf[BUFSIZ]; ssize_t bufsize; + off_t savedoffset; + struct stat st; - if (size != ph_size) { + if (fstat(fd, &st) < 0) { + file_badread(ms); + return -1; + } + + if (size != xph_sizeof) { if (file_printf(ms, ", corrupted program header size") == -1) return -1; return 0; } + /* * Loop through all the program headers. */ for ( ; num; num--) { - if (lseek(fd, off, SEEK_SET) == (off_t)-1) { + if ((savedoffset = lseek(fd, off, SEEK_SET)) == (off_t)-1) { file_badseek(ms); return -1; } - if (read(fd, ph_addr, ph_size) == -1) { + if (read(fd, xph_addr, xph_sizeof) == -1) { file_badread(ms); return -1; } + if (xph_offset > fsize) { + if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) { + file_badseek(ms); + return -1; + } + continue; + } + off += size; - if (ph_type != PT_NOTE) + if (xph_type != PT_NOTE) continue; /* * This is a PT_NOTE section; loop through all the notes * in the section. */ - if (lseek(fd, (off_t) ph_offset, SEEK_SET) == (off_t)-1) { + if (lseek(fd, (off_t)xph_offset, SEEK_SET) == (off_t)-1) { file_badseek(ms); return -1; } bufsize = read(fd, nbuf, - ((ph_filesz < sizeof(nbuf)) ? ph_filesz : sizeof(nbuf))); + ((xph_filesz < sizeof(nbuf)) ? xph_filesz : sizeof(nbuf))); if (bufsize == -1) { file_badread(ms); return -1; @@ -266,7 +308,7 @@ dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off, if (offset >= (size_t)bufsize) break; offset = donote(ms, nbuf, offset, (size_t)bufsize, - class, swap, 4); + class, swap, 4, flags); if (offset == 0) break; @@ -278,7 +320,7 @@ dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off, private size_t donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, - int class, int swap, size_t align) + int class, int swap, size_t align, int *flags) { Elf32_Nhdr nh32; Elf64_Nhdr nh64; @@ -288,19 +330,16 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, #endif uint32_t namesz, descsz; - if (class == ELFCLASS32) - memcpy(&nh32, &nbuf[offset], sizeof(nh32)); - else - memcpy(&nh64, &nbuf[offset], sizeof(nh64)); - offset += nh_size; + (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof); + offset += xnh_sizeof; - namesz = nh_namesz; - descsz = nh_descsz; + namesz = xnh_namesz; + descsz = xnh_descsz; if ((namesz == 0) && (descsz == 0)) { /* * We're out of note headers. */ - return offset; + return (offset >= size) ? offset : size; } if (namesz & 0x80000000) { @@ -328,11 +367,17 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, offset = ELF_ALIGN(doff + descsz); if (doff + descsz > size) { - return offset; + /* + * We're past the end of the buffer. + */ + return (offset >= size) ? offset : size; } + if (*flags & FLAGS_DID_NOTE) + goto core; + if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 && - nh_type == NT_GNU_VERSION && descsz == 16) { + xnh_type == NT_GNU_VERSION && descsz == 16) { uint32_t desc[4]; (void)memcpy(desc, &nbuf[doff], sizeof(desc)); @@ -358,11 +403,12 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, if (file_printf(ms, " %d.%d.%d", getu32(swap, desc[1]), getu32(swap, desc[2]), getu32(swap, desc[3])) == -1) return size; + *flags |= FLAGS_DID_NOTE; return size; } if (namesz == 7 && strcmp((char *)&nbuf[noff], "NetBSD") == 0 && - nh_type == NT_NETBSD_VERSION && descsz == 4) { + xnh_type == NT_NETBSD_VERSION && descsz == 4) { uint32_t desc; (void)memcpy(&desc, &nbuf[doff], sizeof(desc)); desc = getu32(swap, desc); @@ -382,10 +428,10 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, * p = patchlevel */ if (desc > 100000000U) { - u_int ver_patch = (desc / 100) % 100; - u_int ver_rel = (desc / 10000) % 100; - u_int ver_min = (desc / 1000000) % 100; - u_int ver_maj = desc / 100000000; + uint32_t ver_patch = (desc / 100) % 100; + uint32_t ver_rel = (desc / 10000) % 100; + uint32_t ver_min = (desc / 1000000) % 100; + uint32_t ver_maj = desc / 100000000; if (file_printf(ms, " %u.%u", ver_maj, ver_min) == -1) return size; @@ -394,17 +440,21 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, return size; } else if (ver_rel != 0) { while (ver_rel > 26) { - file_printf(ms, "Z"); + if (file_printf(ms, "Z") == -1) + return size; ver_rel -= 26; } - file_printf(ms, "%c", 'A' + ver_rel - 1); + if (file_printf(ms, "%c", 'A' + ver_rel - 1) + == -1) + return size; } } + *flags |= FLAGS_DID_NOTE; return size; } if (namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0 && - nh_type == NT_FREEBSD_VERSION && descsz == 4) { + xnh_type == NT_FREEBSD_VERSION && descsz == 4) { uint32_t desc; (void)memcpy(&desc, &nbuf[doff], sizeof(desc)); desc = getu32(swap, desc); @@ -477,30 +527,34 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, return size; } } + *flags |= FLAGS_DID_NOTE; return size; } if (namesz == 8 && strcmp((char *)&nbuf[noff], "OpenBSD") == 0 && - nh_type == NT_OPENBSD_VERSION && descsz == 4) { + xnh_type == NT_OPENBSD_VERSION && descsz == 4) { if (file_printf(ms, ", for OpenBSD") == -1) return size; /* Content of note is always 0 */ + *flags |= FLAGS_DID_NOTE; return size; } if (namesz == 10 && strcmp((char *)&nbuf[noff], "DragonFly") == 0 && - nh_type == NT_DRAGONFLY_VERSION && descsz == 4) { + xnh_type == NT_DRAGONFLY_VERSION && descsz == 4) { + uint32_t desc; if (file_printf(ms, ", for DragonFly") == -1) return size; - uint32_t desc; (void)memcpy(&desc, &nbuf[doff], sizeof(desc)); desc = getu32(swap, desc); if (file_printf(ms, " %d.%d.%d", desc / 100000, desc / 10000 % 10, desc % 10000) == -1) return size; + *flags |= FLAGS_DID_NOTE; return size; } +core: /* * Sigh. The 2.0.36 kernel in Debian 2.1, at * least, doesn't correctly implement name @@ -530,113 +584,130 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size, } #ifdef ELFCORE - if (os_style != -1) - if (file_printf(ms, ", %s-style", os_style_names[os_style]) == -1) - return size; + if ((*flags & FLAGS_DID_CORE) != 0) + return size; - if (os_style == OS_STYLE_NETBSD && nh_type == NT_NETBSD_CORE_PROCINFO) { - uint32_t signo; - /* - * Extract the program name. It is at - * offset 0x7c, and is up to 32-bytes, - * including the terminating NUL. - */ - if (file_printf(ms, ", from '%.31s'", &nbuf[doff + 0x7c]) == -1) + if (os_style != -1) { + if (file_printf(ms, ", %s-style", os_style_names[os_style]) + == -1) return size; - - /* - * Extract the signal number. It is at - * offset 0x08. - */ - memcpy(&signo, &nbuf[doff + 0x08], - sizeof(signo)); - if (file_printf(ms, " (signal %u)", getu32(swap, signo)) == -1) - return size; - return size; - } else if (os_style != OS_STYLE_NETBSD && nh_type == NT_PRPSINFO) { - size_t i, j; - unsigned char c; - /* - * Extract the program name. We assume - * it to be 16 characters (that's what it - * is in SunOS 5.x and Linux). - * - * Unfortunately, it's at a different offset - * in varous OSes, so try multiple offsets. - * If the characters aren't all printable, - * reject it. - */ - for (i = 0; i < NOFFSETS; i++) { - size_t reloffset = prpsoffsets(i); - size_t noffset = doff + reloffset; - for (j = 0; j < 16; j++, noffset++, reloffset++) { - /* - * Make sure we're not past - * the end of the buffer; if - * we are, just give up. - */ - if (noffset >= size) - goto tryanother; + } - /* - * Make sure we're not past - * the end of the contents; - * if we are, this obviously - * isn't the right offset. - */ - if (reloffset >= descsz) - goto tryanother; + switch (os_style) { + case OS_STYLE_NETBSD: + if (xnh_type == NT_NETBSD_CORE_PROCINFO) { + uint32_t signo; + /* + * Extract the program name. It is at + * offset 0x7c, and is up to 32-bytes, + * including the terminating NUL. + */ + if (file_printf(ms, ", from '%.31s'", + &nbuf[doff + 0x7c]) == -1) + return size; + + /* + * Extract the signal number. It is at + * offset 0x08. + */ + (void)memcpy(&signo, &nbuf[doff + 0x08], + sizeof(signo)); + if (file_printf(ms, " (signal %u)", + getu32(swap, signo)) == -1) + return size; + return size; + } + break; - c = nbuf[noffset]; - if (c == '\0') { + default: + if (xnh_type == NT_PRPSINFO) { + size_t i, j; + unsigned char c; + /* + * Extract the program name. We assume + * it to be 16 characters (that's what it + * is in SunOS 5.x and Linux). + * + * Unfortunately, it's at a different offset + * in varous OSes, so try multiple offsets. + * If the characters aren't all printable, + * reject it. + */ + for (i = 0; i < NOFFSETS; i++) { + size_t reloffset = prpsoffsets(i); + size_t noffset = doff + reloffset; + for (j = 0; j < 16; j++, noffset++, + reloffset++) { /* - * A '\0' at the - * beginning is - * obviously wrong. - * Any other '\0' - * means we're done. + * Make sure we're not past + * the end of the buffer; if + * we are, just give up. */ - if (j == 0) + if (noffset >= size) goto tryanother; - else - break; - } else { + /* - * A nonprintable - * character is also - * wrong. + * Make sure we're not past + * the end of the contents; + * if we are, this obviously + * isn't the right offset. */ -#define isquote(c) (strchr("'\"`", (c)) != NULL) - if (!isprint(c) || isquote(c)) + if (reloffset >= descsz) goto tryanother; - } - } - /* - * Well, that worked. - */ - if (file_printf(ms, ", from '%.16s'", - &nbuf[doff + prpsoffsets(i)]) == -1) + c = nbuf[noffset]; + if (c == '\0') { + /* + * A '\0' at the + * beginning is + * obviously wrong. + * Any other '\0' + * means we're done. + */ + if (j == 0) + goto tryanother; + else + break; + } else { + /* + * A nonprintable + * character is also + * wrong. + */ + if (!isprint(c) || isquote(c)) + goto tryanother; + } + } + /* + * Well, that worked. + */ + if (file_printf(ms, ", from '%.16s'", + &nbuf[doff + prpsoffsets(i)]) == -1) + return size; return size; - return size; - tryanother: - ; + tryanother: + ; + } } - return offset; + break; } #endif + *flags |= FLAGS_DID_CORE; return offset; } private int doshn(struct magic_set *ms, int class, int swap, int fd, off_t off, int num, - size_t size) + size_t size, int *flags) { Elf32_Shdr sh32; Elf64_Shdr sh64; + int stripped = 1; + void *nbuf; + off_t noff; - if (size != sh_size) { + if (size != xsh_sizeof) { if (file_printf(ms, ", corrupted section header size") == -1) return -1; return 0; @@ -648,17 +719,61 @@ doshn(struct magic_set *ms, int class, int swap, int fd, off_t off, int num, } for ( ; num; num--) { - if (read(fd, sh_addr, sh_size) == -1) { + if (read(fd, xsh_addr, xsh_sizeof) == -1) { file_badread(ms); return -1; } - if (shs_type == SHT_SYMTAB /* || shs_type == SHT_DYNSYM */) { - if (file_printf(ms, ", not stripped") == -1) + switch (xsh_type) { + case SHT_SYMTAB: +#if 0 + case SHT_DYNSYM: +#endif + stripped = 0; + break; + case SHT_NOTE: + if ((off = lseek(fd, (off_t)0, SEEK_CUR)) == + (off_t)-1) { + file_badread(ms); return -1; - return 0; + } + if ((nbuf = malloc((size_t)xsh_size)) == NULL) { + file_error(ms, errno, "Cannot allocate memory" + " for note"); + return -1; + } + if ((noff = lseek(fd, (off_t)xsh_offset, SEEK_SET)) == + (off_t)-1) { + file_badread(ms); + free(nbuf); + return -1; + } + if (read(fd, nbuf, (size_t)xsh_size) != + (ssize_t)xsh_size) { + free(nbuf); + file_badread(ms); + return -1; + } + + noff = 0; + for (;;) { + if (noff >= (size_t)xsh_size) + break; + noff = donote(ms, nbuf, (size_t)noff, + (size_t)xsh_size, class, swap, 4, + flags); + if (noff == 0) + break; + } + if ((lseek(fd, off, SEEK_SET)) == (off_t)-1) { + free(nbuf); + file_badread(ms); + return -1; + } + free(nbuf); + break; } } - if (file_printf(ms, ", stripped") == -1) + if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1) return -1; return 0; } @@ -670,7 +785,7 @@ doshn(struct magic_set *ms, int class, int swap, int fd, off_t off, int num, */ private int dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off, - int num, size_t size) + int num, size_t size, off_t fsize, int *flags) { Elf32_Phdr ph32; Elf64_Phdr ph64; @@ -679,29 +794,52 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off, unsigned char nbuf[BUFSIZ]; int bufsize; size_t offset, align; - off_t savedoffset; + off_t savedoffset = (off_t)-1; + struct stat st; - if (size != ph_size) { + if (fstat(fd, &st) < 0) { + file_badread(ms); + return -1; + } + + if (size != xph_sizeof) { if (file_printf(ms, ", corrupted program header size") == -1) return -1; return 0; } + if (lseek(fd, off, SEEK_SET) == (off_t)-1) { file_badseek(ms); return -1; } for ( ; num; num--) { - if (read(fd, ph_addr, ph_size) == -1) { + if (read(fd, xph_addr, xph_sizeof) == -1) { file_badread(ms); return -1; } + if (xph_offset > st.st_size && savedoffset != (off_t)-1) { + if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) { + file_badseek(ms); + return -1; + } + continue; + } + if ((savedoffset = lseek(fd, (off_t)0, SEEK_CUR)) == (off_t)-1) { file_badseek(ms); return -1; } - switch (ph_type) { + if (xph_offset > fsize) { + if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) { + file_badseek(ms); + return -1; + } + continue; + } + + switch (xph_type) { case PT_DYNAMIC: linking_style = "dynamically"; break; @@ -709,7 +847,7 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off, shared_libraries = " (uses shared libs)"; break; case PT_NOTE: - if ((align = ph_align) & 0x80000000) { + if ((align = xph_align) & 0x80000000) { if (file_printf(ms, ", invalid note alignment 0x%lx", (unsigned long)align) == -1) @@ -720,13 +858,13 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off, * This is a PT_NOTE section; loop through all the notes * in the section. */ - if (lseek(fd, (off_t) ph_offset, SEEK_SET) + if (lseek(fd, (off_t)xph_offset, SEEK_SET) == (off_t)-1) { file_badseek(ms); return -1; } - bufsize = read(fd, nbuf, ((ph_filesz < sizeof(nbuf)) ? - ph_filesz : sizeof(nbuf))); + bufsize = read(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ? + xph_filesz : sizeof(nbuf))); if (bufsize == -1) { file_badread(ms); return -1; @@ -736,7 +874,8 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off, if (offset >= (size_t)bufsize) break; offset = donote(ms, nbuf, offset, - (size_t)bufsize, class, swap, align); + (size_t)bufsize, class, swap, align, + flags); if (offset == 0) break; } @@ -759,11 +898,19 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, size_t nbytes) { union { +#if defined(__s390x__) || defined(__powerpc64__) int32_t l; char c[sizeof (int32_t)]; +#else + long l; + char c[sizeof (long)]; +#endif } u; int class; int swap; + struct stat st; + off_t fsize; + int flags = 0; /* * If we cannot seek, it must be a pipe, socket or fifo. @@ -771,6 +918,12 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE)) fd = file_pipe2file(ms, fd, buf, nbytes); + if (fstat(fd, &st) == -1) { + file_badread(ms); + return -1; + } + fsize = st.st_size; + /* * ELF executables have multiple section headers in arbitrary * file locations and thus file(1) cannot determine it from easily. @@ -783,7 +936,7 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, return 0; - class = buf[4]; + class = buf[EI_CLASS]; if (class == ELFCLASS32) { Elf32_Ehdr elfhdr; @@ -793,14 +946,15 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, u.l = 1; (void) memcpy(&elfhdr, buf, sizeof elfhdr); - swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[5]; + swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[EI_DATA]; if (getu16(swap, elfhdr.e_type) == ET_CORE) { #ifdef ELFCORE if (dophn_core(ms, class, swap, fd, (off_t)getu32(swap, elfhdr.e_phoff), getu16(swap, elfhdr.e_phnum), - (size_t)getu16(swap, elfhdr.e_phentsize)) == -1) + (size_t)getu16(swap, elfhdr.e_phentsize), + fsize, &flags) == -1) return -1; #else ; @@ -810,14 +964,16 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, if (dophn_exec(ms, class, swap, fd, (off_t)getu32(swap, elfhdr.e_phoff), getu16(swap, elfhdr.e_phnum), - (size_t)getu16(swap, elfhdr.e_phentsize)) + (size_t)getu16(swap, elfhdr.e_phentsize), + fsize, &flags) == -1) return -1; } if (doshn(ms, class, swap, fd, (off_t)getu32(swap, elfhdr.e_shoff), getu16(swap, elfhdr.e_shnum), - (size_t)getu16(swap, elfhdr.e_shentsize)) == -1) + (size_t)getu16(swap, elfhdr.e_shentsize), + &flags) == -1) return -1; } return 1; @@ -831,18 +987,15 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, u.l = 1; (void) memcpy(&elfhdr, buf, sizeof elfhdr); - swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[5]; + swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[EI_DATA]; if (getu16(swap, elfhdr.e_type) == ET_CORE) { #ifdef ELFCORE if (dophn_core(ms, class, swap, fd, -#ifdef USE_ARRAY_FOR_64BIT_TYPES - (off_t)getu32(swap, elfhdr.e_phoff[1]), -#else - (off_t)getu64(swap, elfhdr.e_phoff), -#endif + (off_t)elf_getu64(swap, elfhdr.e_phoff), getu16(swap, elfhdr.e_phnum), - (size_t)getu16(swap, elfhdr.e_phentsize)) == -1) + (size_t)getu16(swap, elfhdr.e_phentsize), + fsize, &flags) == -1) return -1; #else ; @@ -850,24 +1003,17 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, } else { if (getu16(swap, elfhdr.e_type) == ET_EXEC) { if (dophn_exec(ms, class, swap, fd, -#ifdef USE_ARRAY_FOR_64BIT_TYPES - (off_t)getu32(swap, elfhdr.e_phoff[1]), -#else - (off_t)getu64(swap, elfhdr.e_phoff), -#endif + (off_t)elf_getu64(swap, elfhdr.e_phoff), getu16(swap, elfhdr.e_phnum), - (size_t)getu16(swap, elfhdr.e_phentsize)) - == -1) + (size_t)getu16(swap, elfhdr.e_phentsize), + fsize, &flags) == -1) return -1; } if (doshn(ms, class, swap, fd, -#ifdef USE_ARRAY_FOR_64BIT_TYPES - (off_t)getu32(swap, elfhdr.e_shoff[1]), -#else - (off_t)getu64(swap, elfhdr.e_shoff), -#endif + (off_t)elf_getu64(swap, elfhdr.e_shoff), getu16(swap, elfhdr.e_shnum), - (size_t)getu16(swap, elfhdr.e_shentsize)) == -1) + (size_t)getu16(swap, elfhdr.e_shentsize), &flags) + == -1) return -1; } return 1; diff --git a/contrib/file-4/src/readelf.h b/contrib/file-4/src/readelf.h index fb25dccb3f..20a4d0fc01 100644 --- a/contrib/file-4/src/readelf.h +++ b/contrib/file-4/src/readelf.h @@ -50,6 +50,7 @@ typedef uint32_t Elf64_Addr[2]; typedef uint32_t Elf64_Off[2]; typedef uint32_t Elf64_Xword[2]; #else +#undef USE_ARRAY_FOR_64BIT_TYPES typedef uint64_t Elf64_Addr; typedef uint64_t Elf64_Off; typedef uint64_t Elf64_Xword; diff --git a/contrib/file-4/src/softmagic.c b/contrib/file-4/src/softmagic.c index 7c32e7fc1c..894c05ce81 100644 --- a/contrib/file-4/src/softmagic.c +++ b/contrib/file-4/src/softmagic.c @@ -39,24 +39,28 @@ #ifndef lint -FILE_RCSID("@(#)$Id: softmagic.c,v 1.73 2005/03/06 05:58:22 christos Exp $") +FILE_RCSID("@(#)$Id: softmagic.c,v 1.83 2006/10/31 19:37:17 christos Exp $") #endif /* lint */ private int match(struct magic_set *, struct magic *, uint32_t, const unsigned char *, size_t); private int mget(struct magic_set *, union VALUETYPE *, const unsigned char *, - struct magic *, size_t, int); -private int mcheck(struct magic_set *, union VALUETYPE *, struct magic *); + struct magic *, size_t, unsigned int); +private int magiccheck(struct magic_set *, union VALUETYPE *, struct magic *); private int32_t mprint(struct magic_set *, union VALUETYPE *, struct magic *); private void mdebug(uint32_t, const char *, size_t); private int mcopy(struct magic_set *, union VALUETYPE *, int, int, const unsigned char *, size_t, size_t); private int mconvert(struct magic_set *, union VALUETYPE *, struct magic *); private int check_mem(struct magic_set *, unsigned int); +private int print_sep(struct magic_set *, int); +private void cvt_8(union VALUETYPE *, const struct magic *); +private void cvt_16(union VALUETYPE *, const struct magic *); +private void cvt_32(union VALUETYPE *, const struct magic *); +private void cvt_64(union VALUETYPE *, const struct magic *); /* - * softmagic - lookup one file in database - * (already read from MAGIC by apprentice.c). + * softmagic - lookup one file in parsed, in-memory copy of database * Passed the name and FILE * of one file to be typed. */ /*ARGSUSED1*/ /* nbytes passed for regularity, maybe need later */ @@ -120,7 +124,7 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, if (flush) { if (magic[magindex].reln == '!') flush = 0; } else { - switch (mcheck(ms, &p, &magic[magindex])) { + switch (magiccheck(ms, &p, &magic[magindex])) { case -1: return -1; case 0: @@ -141,21 +145,20 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, continue; } - if (!firstline) { /* we found another match */ - /* put a newline and '-' to do some simple formatting*/ - if (file_printf(ms, "\n- ") == -1) + /* + * If we are going to print something, we'll need to print + * a blank before we print something else. + */ + if (magic[magindex].desc[0]) { + need_separator = 1; + if (print_sep(ms, firstline) == -1) return -1; } if ((ms->c.off[cont_level] = mprint(ms, &p, &magic[magindex])) == -1) return -1; - /* - * If we printed something, we'll need to print - * a blank before we print something else. - */ - if (magic[magindex].desc[0]) - need_separator = 1; + /* and any continuations that match */ if (check_mem(ms, ++cont_level) == -1) return -1; @@ -182,12 +185,20 @@ match(struct magic_set *ms, struct magic *magic, uint32_t nmagic, if (flush && magic[magindex].reln != '!') goto done; - switch (flush ? 1 : mcheck(ms, &p, &magic[magindex])) { + switch (flush ? 1 : magiccheck(ms, &p, &magic[magindex])) { case -1: return -1; case 0: break; default: + /* + * If we are going to print something, + * make sure that we have a separator first. + */ + if (magic[magindex].desc[0]) { + if (print_sep(ms, firstline) == -1) + return -1; + } /* * This continuation matched. * Print its message, with @@ -245,39 +256,108 @@ check_mem(struct magic_set *ms, unsigned int level) return -1; } +private int +check_fmt(struct magic_set *ms, struct magic *m) +{ + regex_t rx; + int rc; + + if (strchr(m->desc, '%') == NULL) + return 0; + + rc = regcomp(&rx, "%[-0-9\\.]*s", REG_EXTENDED|REG_NOSUB); + if (rc) { + char errmsg[512]; + regerror(rc, &rx, errmsg, sizeof(errmsg)); + file_error(ms, 0, "regex error %d, (%s)", rc, errmsg); + return -1; + } else { + rc = regexec(&rx, m->desc, 0, 0, 0); + regfree(&rx); + return !rc; + } +} + private int32_t mprint(struct magic_set *ms, union VALUETYPE *p, struct magic *m) { - uint32_t v; - int32_t t=0 ; + uint64_t v; + int32_t t = 0; + char buf[512]; switch (m->type) { case FILE_BYTE: - v = file_signextend(ms, m, (size_t)p->b); - if (file_printf(ms, m->desc, (unsigned char) v) == -1) + v = file_signextend(ms, m, (uint64_t)p->b); + switch (check_fmt(ms, m)) { + case -1: return -1; + case 1: + if (snprintf(buf, sizeof(buf), "%c", + (unsigned char)v) < 0) + return -1; + if (file_printf(ms, m->desc, buf) == -1) + return -1; + break; + default: + if (file_printf(ms, m->desc, (unsigned char) v) == -1) + return -1; + break; + } t = m->offset + sizeof(char); break; case FILE_SHORT: case FILE_BESHORT: case FILE_LESHORT: - v = file_signextend(ms, m, (size_t)p->h); - if (file_printf(ms, m->desc, (unsigned short) v) == -1) + v = file_signextend(ms, m, (uint64_t)p->h); + switch (check_fmt(ms, m)) { + case -1: return -1; + case 1: + if (snprintf(buf, sizeof(buf), "%hu", (unsigned short)v) < 0) + return -1; + if (file_printf(ms, m->desc, buf) == -1) + return -1; + break; + default: + if (file_printf(ms, m->desc, (unsigned short) v) == -1) + return -1; + break; + } t = m->offset + sizeof(short); break; case FILE_LONG: case FILE_BELONG: case FILE_LELONG: - v = file_signextend(ms, m, p->l); - if (file_printf(ms, m->desc, (uint32_t) v) == -1) + case FILE_MELONG: + v = file_signextend(ms, m, (uint64_t)p->l); + switch (check_fmt(ms, m)) { + case -1: return -1; + case 1: + if (snprintf(buf, sizeof(buf), "%u", (uint32_t)v) < 0) + return -1; + if (file_printf(ms, m->desc, buf) == -1) + return -1; + break; + default: + if (file_printf(ms, m->desc, (uint32_t) v) == -1) + return -1; + break; + } t = m->offset + sizeof(int32_t); break; + case FILE_QUAD: + case FILE_BEQUAD: + case FILE_LEQUAD: + v = file_signextend(ms, m, p->q); + if (file_printf(ms, m->desc, (uint64_t) v) == -1) + return -1; + t = m->offset + sizeof(int64_t); + break; case FILE_STRING: case FILE_PSTRING: case FILE_BESTRING16: @@ -302,6 +382,7 @@ mprint(struct magic_set *ms, union VALUETYPE *p, struct magic *m) case FILE_DATE: case FILE_BEDATE: case FILE_LEDATE: + case FILE_MEDATE: if (file_printf(ms, m->desc, file_fmttime(p->l, 1)) == -1) return -1; t = m->offset + sizeof(time_t); @@ -310,15 +391,36 @@ mprint(struct magic_set *ms, union VALUETYPE *p, struct magic *m) case FILE_LDATE: case FILE_BELDATE: case FILE_LELDATE: + case FILE_MELDATE: if (file_printf(ms, m->desc, file_fmttime(p->l, 0)) == -1) return -1; t = m->offset + sizeof(time_t); break; + + case FILE_QDATE: + case FILE_BEQDATE: + case FILE_LEQDATE: + if (file_printf(ms, m->desc, file_fmttime((uint32_t)p->q, 1)) + == -1) + return -1; + t = m->offset + sizeof(uint64_t); + break; + + case FILE_QLDATE: + case FILE_BEQLDATE: + case FILE_LEQLDATE: + if (file_printf(ms, m->desc, file_fmttime((uint32_t)p->q, 0)) + == -1) + return -1; + t = m->offset + sizeof(uint64_t); + break; + case FILE_REGEX: if (file_printf(ms, m->desc, p->s) == -1) return -1; t = m->offset + strlen(p->s); break; + case FILE_SEARCH: if (file_printf(ms, m->desc, m->value.s) == -1) return -1; @@ -332,6 +434,62 @@ mprint(struct magic_set *ms, union VALUETYPE *p, struct magic *m) return(t); } + +#define DO_CVT(fld, cast) \ + if (m->mask) \ + switch (m->mask_op & 0x7F) { \ + case FILE_OPAND: \ + p->fld &= cast m->mask; \ + break; \ + case FILE_OPOR: \ + p->fld |= cast m->mask; \ + break; \ + case FILE_OPXOR: \ + p->fld ^= cast m->mask; \ + break; \ + case FILE_OPADD: \ + p->fld += cast m->mask; \ + break; \ + case FILE_OPMINUS: \ + p->fld -= cast m->mask; \ + break; \ + case FILE_OPMULTIPLY: \ + p->fld *= cast m->mask; \ + break; \ + case FILE_OPDIVIDE: \ + p->fld /= cast m->mask; \ + break; \ + case FILE_OPMODULO: \ + p->fld %= cast m->mask; \ + break; \ + } \ + if (m->mask_op & FILE_OPINVERSE) \ + p->fld = ~p->fld \ + +private void +cvt_8(union VALUETYPE *p, const struct magic *m) +{ + DO_CVT(b, (uint8_t)); +} + +private void +cvt_16(union VALUETYPE *p, const struct magic *m) +{ + DO_CVT(h, (uint16_t)); +} + +private void +cvt_32(union VALUETYPE *p, const struct magic *m) +{ + DO_CVT(l, (uint32_t)); +} + +private void +cvt_64(union VALUETYPE *p, const struct magic *m) +{ + DO_CVT(q, (uint64_t)); +} + /* * Convert the byte order of the data we are looking at * While we're here, let's apply the mask operation @@ -342,99 +500,20 @@ mconvert(struct magic_set *ms, union VALUETYPE *p, struct magic *m) { switch (m->type) { case FILE_BYTE: - if (m->mask) - switch (m->mask_op & 0x7F) { - case FILE_OPAND: - p->b &= m->mask; - break; - case FILE_OPOR: - p->b |= m->mask; - break; - case FILE_OPXOR: - p->b ^= m->mask; - break; - case FILE_OPADD: - p->b += m->mask; - break; - case FILE_OPMINUS: - p->b -= m->mask; - break; - case FILE_OPMULTIPLY: - p->b *= m->mask; - break; - case FILE_OPDIVIDE: - p->b /= m->mask; - break; - case FILE_OPMODULO: - p->b %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->b = ~p->b; + cvt_8(p, m); return 1; case FILE_SHORT: - if (m->mask) - switch (m->mask_op & 0x7F) { - case FILE_OPAND: - p->h &= m->mask; - break; - case FILE_OPOR: - p->h |= m->mask; - break; - case FILE_OPXOR: - p->h ^= m->mask; - break; - case FILE_OPADD: - p->h += m->mask; - break; - case FILE_OPMINUS: - p->h -= m->mask; - break; - case FILE_OPMULTIPLY: - p->h *= m->mask; - break; - case FILE_OPDIVIDE: - p->h /= m->mask; - break; - case FILE_OPMODULO: - p->h %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->h = ~p->h; + cvt_16(p, m); return 1; case FILE_LONG: case FILE_DATE: case FILE_LDATE: - if (m->mask) - switch (m->mask_op & 0x7F) { - case FILE_OPAND: - p->l &= m->mask; - break; - case FILE_OPOR: - p->l |= m->mask; - break; - case FILE_OPXOR: - p->l ^= m->mask; - break; - case FILE_OPADD: - p->l += m->mask; - break; - case FILE_OPMINUS: - p->l -= m->mask; - break; - case FILE_OPMULTIPLY: - p->l *= m->mask; - break; - case FILE_OPDIVIDE: - p->l /= m->mask; - break; - case FILE_OPMODULO: - p->l %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->l = ~p->l; + cvt_32(p, m); + return 1; + case FILE_QUAD: + case FILE_QDATE: + case FILE_QLDATE: + cvt_64(p, m); return 1; case FILE_STRING: case FILE_BESTRING16: @@ -465,137 +544,50 @@ mconvert(struct magic_set *ms, union VALUETYPE *p, struct magic *m) } case FILE_BESHORT: p->h = (short)((p->hs[0]<<8)|(p->hs[1])); - if (m->mask) - switch (m->mask_op&0x7F) { - case FILE_OPAND: - p->h &= m->mask; - break; - case FILE_OPOR: - p->h |= m->mask; - break; - case FILE_OPXOR: - p->h ^= m->mask; - break; - case FILE_OPADD: - p->h += m->mask; - break; - case FILE_OPMINUS: - p->h -= m->mask; - break; - case FILE_OPMULTIPLY: - p->h *= m->mask; - break; - case FILE_OPDIVIDE: - p->h /= m->mask; - break; - case FILE_OPMODULO: - p->h %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->h = ~p->h; + cvt_16(p, m); return 1; case FILE_BELONG: case FILE_BEDATE: case FILE_BELDATE: p->l = (int32_t) ((p->hl[0]<<24)|(p->hl[1]<<16)|(p->hl[2]<<8)|(p->hl[3])); - if (m->mask) - switch (m->mask_op&0x7F) { - case FILE_OPAND: - p->l &= m->mask; - break; - case FILE_OPOR: - p->l |= m->mask; - break; - case FILE_OPXOR: - p->l ^= m->mask; - break; - case FILE_OPADD: - p->l += m->mask; - break; - case FILE_OPMINUS: - p->l -= m->mask; - break; - case FILE_OPMULTIPLY: - p->l *= m->mask; - break; - case FILE_OPDIVIDE: - p->l /= m->mask; - break; - case FILE_OPMODULO: - p->l %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->l = ~p->l; + cvt_32(p, m); + return 1; + case FILE_BEQUAD: + case FILE_BEQDATE: + case FILE_BEQLDATE: + p->q = (int64_t) + (((int64_t)p->hq[0]<<56)|((int64_t)p->hq[1]<<48)| + ((int64_t)p->hq[2]<<40)|((int64_t)p->hq[3]<<32)| + (p->hq[4]<<24)|(p->hq[5]<<16)|(p->hq[6]<<8)|(p->hq[7])); + cvt_64(p, m); return 1; case FILE_LESHORT: p->h = (short)((p->hs[1]<<8)|(p->hs[0])); - if (m->mask) - switch (m->mask_op&0x7F) { - case FILE_OPAND: - p->h &= m->mask; - break; - case FILE_OPOR: - p->h |= m->mask; - break; - case FILE_OPXOR: - p->h ^= m->mask; - break; - case FILE_OPADD: - p->h += m->mask; - break; - case FILE_OPMINUS: - p->h -= m->mask; - break; - case FILE_OPMULTIPLY: - p->h *= m->mask; - break; - case FILE_OPDIVIDE: - p->h /= m->mask; - break; - case FILE_OPMODULO: - p->h %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->h = ~p->h; + cvt_16(p, m); return 1; case FILE_LELONG: case FILE_LEDATE: case FILE_LELDATE: p->l = (int32_t) ((p->hl[3]<<24)|(p->hl[2]<<16)|(p->hl[1]<<8)|(p->hl[0])); - if (m->mask) - switch (m->mask_op&0x7F) { - case FILE_OPAND: - p->l &= m->mask; - break; - case FILE_OPOR: - p->l |= m->mask; - break; - case FILE_OPXOR: - p->l ^= m->mask; - break; - case FILE_OPADD: - p->l += m->mask; - break; - case FILE_OPMINUS: - p->l -= m->mask; - break; - case FILE_OPMULTIPLY: - p->l *= m->mask; - break; - case FILE_OPDIVIDE: - p->l /= m->mask; - break; - case FILE_OPMODULO: - p->l %= m->mask; - break; - } - if (m->mask_op & FILE_OPINVERSE) - p->l = ~p->l; + cvt_32(p, m); + return 1; + case FILE_LEQUAD: + case FILE_LEQDATE: + case FILE_LEQLDATE: + p->q = (int64_t) + (((int64_t)p->hq[7]<<56)|((int64_t)p->hq[6]<<48)| + ((int64_t)p->hq[5]<<40)|((int64_t)p->hq[4]<<32)| + (p->hq[3]<<24)|(p->hq[2]<<16)|(p->hq[1]<<8)|(p->hq[0])); + cvt_64(p, m); + return 1; + case FILE_MELONG: + case FILE_MEDATE: + case FILE_MELDATE: + p->l = (int32_t) + ((p->hl[1]<<24)|(p->hl[0]<<16)|(p->hl[3]<<8)|(p->hl[2])); + cvt_32(p, m); return 1; case FILE_REGEX: case FILE_SEARCH: @@ -626,11 +618,16 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir, * (starting at 1), not as bytes-from start-of-file */ char *b, *c, *last = NULL; - if ((p->buf = strdup((const char *)s)) == NULL) { + if (s == NULL) { + p->search.buflen = 0; + p->search.buf = NULL; + return 0; + } + if ((p->search.buf = strdup((const char *)s)) == NULL) { file_oomem(ms); return -1; } - for (b = p->buf; offset && + for (b = p->search.buf; offset && ((b = strchr(c = b, '\n')) || (b = strchr(c, '\r'))); offset--, b++) { last = b; @@ -638,18 +635,26 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir, } if (last != NULL) *last = '\0'; + p->search.buflen = last - p->search.buf; return 0; } if (indir == 0 && (type == FILE_BESTRING16 || type == FILE_LESTRING16)) { - const char *src = s + offset; - const char *esrc = s + nbytes; + const unsigned char *src = s + offset; + const unsigned char *esrc = s + nbytes; char *dst = p->s, *edst = &p->s[sizeof(p->s) - 1]; if (type == FILE_BESTRING16) src++; + /* check for pointer overflow */ + if (src < s) { + file_error(ms, 0, "invalid offset %zu in mcopy()", + offset); + return -1; + } + for (;src < esrc; src++, dst++) { if (dst < edst) *dst = *src++; @@ -678,13 +683,14 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir, * might even cause problems */ if (nbytes < sizeof(*p)) - (void)memset(((char *)p) + nbytes, '\0', sizeof(*p) - nbytes); + (void)memset(((char *)(void *)p) + nbytes, '\0', + sizeof(*p) - nbytes); return 0; } private int mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s, - struct magic *m, size_t nbytes, int cont_level) + struct magic *m, size_t nbytes, unsigned int cont_level) { uint32_t offset = m->offset; @@ -700,7 +706,7 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s, int off = m->in_offset; if (m->in_op & FILE_OPINDIRECT) { const union VALUETYPE *q = - ((const union VALUETYPE *)(s + offset + off)); + ((const void *)(s + offset + off)); switch (m->in_type) { case FILE_BYTE: off = q->b; @@ -725,6 +731,10 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s, off = (int32_t)((q->hl[3]<<24)|(q->hl[2]<<16)| (q->hl[1]<<8)|(q->hl[0])); break; + case FILE_MELONG: + off = (int32_t)((q->hl[1]<<24)|(q->hl[0]<<16)| + (q->hl[3]<<8)|(q->hl[2])); + break; } } switch (m->in_type) { @@ -1042,6 +1052,76 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s, if (m->in_op & FILE_OPINVERSE) offset = ~offset; break; + case FILE_MELONG: + if (nbytes < (offset + 4)) + return 0; + if (off) { + switch (m->in_op & 0x7F) { + case FILE_OPAND: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) & + off; + break; + case FILE_OPOR: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) | + off; + break; + case FILE_OPXOR: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) ^ + off; + break; + case FILE_OPADD: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) + + off; + break; + case FILE_OPMINUS: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) - + off; + break; + case FILE_OPMULTIPLY: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) * + off; + break; + case FILE_OPDIVIDE: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) / + off; + break; + case FILE_OPMODULO: + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])) % + off; + break; + } + } else + offset = (int32_t)((p->hl[1]<<24)| + (p->hl[0]<<16)| + (p->hl[3]<<8)| + (p->hl[2])); + if (m->in_op & FILE_OPINVERSE) + offset = ~offset; + break; case FILE_LONG: if (nbytes < (offset + 4)) return 0; @@ -1115,12 +1195,15 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s, case FILE_LONG: case FILE_BELONG: case FILE_LELONG: + case FILE_MELONG: case FILE_DATE: case FILE_BEDATE: case FILE_LEDATE: + case FILE_MEDATE: case FILE_LDATE: case FILE_BELDATE: case FILE_LELDATE: + case FILE_MELDATE: if (nbytes < (offset + 4)) return 0; break; @@ -1135,12 +1218,18 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s, } if (m->type == FILE_SEARCH) { - p->buf = malloc(m->mask + m->vallen); - if (p->buf == NULL) { + size_t mlen = (size_t)(m->mask + m->vallen); + size_t flen = nbytes - offset; + if (flen < mlen) + mlen = flen; + p->search.buflen = mlen; + p->search.buf = malloc(mlen + 1); + if (p->search.buf == NULL) { file_error(ms, errno, "Cannot allocate search buffer"); return 0; } - (void)memcpy(p->buf, s + offset, m->mask + m->vallen); + (void)memcpy(p->search.buf, s + offset, mlen); + p->search.buf[mlen] = '\0'; } if (!mconvert(ms, p, m)) return 0; @@ -1148,10 +1237,10 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s, } private int -mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) +magiccheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) { - uint32_t l = m->value.l; - uint32_t v; + uint64_t l = m->value.q; + uint64_t v; int matched; if ( (m->value.s[0] == 'x') && (m->value.s[1] == '\0') ) { @@ -1173,15 +1262,30 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) case FILE_LONG: case FILE_BELONG: case FILE_LELONG: + case FILE_MELONG: case FILE_DATE: case FILE_BEDATE: case FILE_LEDATE: + case FILE_MEDATE: case FILE_LDATE: case FILE_BELDATE: case FILE_LELDATE: + case FILE_MELDATE: v = p->l; break; + case FILE_QUAD: + case FILE_LEQUAD: + case FILE_BEQUAD: + case FILE_QDATE: + case FILE_BEQDATE: + case FILE_LEQDATE: + case FILE_QLDATE: + case FILE_BEQLDATE: + case FILE_LEQLDATE: + v = p->q; + break; + case FILE_STRING: case FILE_BESTRING16: case FILE_LESTRING16: @@ -1237,18 +1341,23 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) regex_t rx; char errmsg[512]; + if (p->search.buf == NULL) + return 0; + rc = regcomp(&rx, m->value.s, REG_EXTENDED|REG_NOSUB|REG_NEWLINE| ((m->mask & STRING_IGNORE_LOWERCASE) ? REG_ICASE : 0)); if (rc) { - free(p->buf); + free(p->search.buf); + p->search.buf = NULL; regerror(rc, &rx, errmsg, sizeof(errmsg)); file_error(ms, 0, "regex error %d, (%s)", rc, errmsg); return -1; } else { - rc = regexec(&rx, p->buf, 0, 0, 0); + rc = regexec(&rx, p->search.buf, 0, 0, 0); regfree(&rx); - free(p->buf); + free(p->search.buf); + p->search.buf = NULL; return !rc; } } @@ -1258,27 +1367,35 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) * search for a string in a certain range */ unsigned char *a = (unsigned char*)m->value.s; - unsigned char *b = (unsigned char*)p->buf; - int len = m->vallen; - int range = 0; + unsigned char *b = (unsigned char*)p->search.buf; + size_t len, slen = m->vallen; + size_t range = 0; + if (slen > sizeof(m->value.s)) + slen = sizeof(m->value.s); l = 0; v = 0; + if (b == NULL) + return 0; + len = slen; while (++range <= m->mask) { while (len-- > 0 && (v = *b++ - *a++) == 0) continue; if (!v) { - m->offset += range-1; + m->offset += range - 1; break; } - len = m->vallen; + if (range + slen >= p->search.buflen) + break; + len = slen; a = (unsigned char*)m->value.s; - b = (unsigned char*)p->buf + range; + b = (unsigned char*)p->search.buf + range; } - free(p->buf); + free(p->search.buf); + p->search.buf = NULL; break; } default: - file_error(ms, 0, "invalid type %d in mcheck()", m->type); + file_error(ms, 0, "invalid type %d in magiccheck()", m->type); return -1; } @@ -1288,21 +1405,21 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) switch (m->reln) { case 'x': if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%u == *any* = 1\n", v); + (void) fprintf(stderr, "%llu == *any* = 1\n", v); matched = 1; break; case '!': matched = v != l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%u != %u = %d\n", + (void) fprintf(stderr, "%llu != %llu = %d\n", v, l, matched); break; case '=': matched = v == l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%u == %u = %d\n", + (void) fprintf(stderr, "%llu == %llu = %d\n", v, l, matched); break; @@ -1310,13 +1427,13 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) if (m->flag & UNSIGNED) { matched = v > l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%u > %u = %d\n", + (void) fprintf(stderr, "%llu > %llu = %d\n", v, l, matched); } else { matched = (int32_t) v > (int32_t) l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%d > %d = %d\n", + (void) fprintf(stderr, "%lld > %lld = %d\n", v, l, matched); } break; @@ -1325,13 +1442,13 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) if (m->flag & UNSIGNED) { matched = v < l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%u < %u = %d\n", + (void) fprintf(stderr, "%llu < %llu = %d\n", v, l, matched); } else { matched = (int32_t) v < (int32_t) l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "%d < %d = %d\n", + (void) fprintf(stderr, "%lld < %lld = %d\n", v, l, matched); } break; @@ -1339,14 +1456,14 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) case '&': matched = (v & l) == l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "((%x & %x) == %x) = %d\n", + (void) fprintf(stderr, "((%llx & %llx) == %llx) = %d\n", v, l, l, matched); break; case '^': matched = (v & l) != l; if ((ms->flags & MAGIC_DEBUG) != 0) - (void) fprintf(stderr, "((%x & %x) != %x) = %d\n", + (void) fprintf(stderr, "((%llx & %llx) != %llx) = %d\n", v, l, l, matched); break; @@ -1359,3 +1476,15 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m) return matched; } + +private int +print_sep(struct magic_set *ms, int firstline) +{ + if (firstline) + return 0; + /* + * we found another match + * put a newline and '-' to do some simple formatting + */ + return file_printf(ms, "\n- "); +} diff --git a/contrib/file-4/src/tar.h b/contrib/file-4/src/tar.h index c3fc185eec..4fb4276fb3 100644 --- a/contrib/file-4/src/tar.h +++ b/contrib/file-4/src/tar.h @@ -32,7 +32,7 @@ * * Created 25 August 1985 by John Gilmore, ihnp4!hoptoad!gnu. * - * $Id: tar.h,v 1.8 2004/09/11 19:15:58 christos Exp $ # checkin only + * $Id: tar.h,v 1.9 2006/05/03 15:19:25 christos Exp $ # checkin only */ /* @@ -82,7 +82,8 @@ union record { #define CHKBLANKS " " /* 8 blanks, no null */ /* The magic field is filled with this if uname and gname are valid. */ -#define TMAGIC "ustar " /* 7 chars and a null */ +#define TMAGIC "ustar" /* 5 chars and a null */ +#define GNUTMAGIC "ustar " /* 7 chars and a null */ /* The linkflag defines the type of file */ #define LF_OLDNORMAL '\0' /* Normal disk file, Unix compat */