2 #------------------------------------------------------------------------------
3 # $File: database,v 1.37 2014/03/14 18:47:29 christos Exp $
4 # database: file(1) magic for various databases
6 # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
10 # Will be maintained as part of the GDBM distribution in the future.
12 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian
13 !:mime application/x-gdbm
14 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian
15 !:mime application/x-gdbm
16 0 string GDBM GNU dbm 2.x database
17 !:mime application/x-gdbm
21 # Ian Darwin's file /etc/magic files: big/little-endian version.
23 # Hash 1.85/1.86 databases store metadata in network byte order.
24 # Btree 1.85/1.86 databases store the metadata in host byte order.
25 # Hash and Btree 2.X and later databases store the metadata in host byte order.
27 0 long 0x00061561 Berkeley DB
28 !:mime application/x-dbm
32 >>4 belong >0 (Hash, version %d, native byte-order)
36 >>4 belong >0 (Hash, version %d, little-endian)
38 0 belong 0x00061561 Berkeley DB
42 >>4 belong >0 (Hash, version %d, big-endian)
46 >>4 belong >0 (Hash, version %d, native byte-order)
48 0 long 0x00053162 Berkeley DB 1.85/1.86
49 >4 long >0 (Btree, version %d, native byte-order)
50 0 belong 0x00053162 Berkeley DB 1.85/1.86
51 >4 belong >0 (Btree, version %d, big-endian)
52 0 lelong 0x00053162 Berkeley DB 1.85/1.86
53 >4 lelong >0 (Btree, version %d, little-endian)
55 12 long 0x00061561 Berkeley DB
56 >16 long >0 (Hash, version %d, native byte-order)
57 12 belong 0x00061561 Berkeley DB
58 >16 belong >0 (Hash, version %d, big-endian)
59 12 lelong 0x00061561 Berkeley DB
60 >16 lelong >0 (Hash, version %d, little-endian)
62 12 long 0x00053162 Berkeley DB
63 >16 long >0 (Btree, version %d, native byte-order)
64 12 belong 0x00053162 Berkeley DB
65 >16 belong >0 (Btree, version %d, big-endian)
66 12 lelong 0x00053162 Berkeley DB
67 >16 lelong >0 (Btree, version %d, little-endian)
69 12 long 0x00042253 Berkeley DB
70 >16 long >0 (Queue, version %d, native byte-order)
71 12 belong 0x00042253 Berkeley DB
72 >16 belong >0 (Queue, version %d, big-endian)
73 12 lelong 0x00042253 Berkeley DB
74 >16 lelong >0 (Queue, version %d, little-endian)
77 12 long 0x00040988 Berkeley DB
78 >16 long >0 (Log, version %d, native byte-order)
79 12 belong 0x00040988 Berkeley DB
80 >16 belong >0 (Log, version %d, big-endian)
81 12 lelong 0x00040988 Berkeley DB
82 >16 lelong >0 (Log, version %d, little-endian)
86 # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
87 0 string/b RRD\0 RRDTool DB
88 >4 string/b x version %s
90 >>10 short !0 16bit aligned
91 >>>10 bedouble 8.642135e+130 big-endian
92 >>>>18 short x 32bit long (m68k)
95 >>>12 long !0 32bit aligned
96 >>>>12 bedouble 8.642135e+130 big-endian
97 >>>>>20 long 0 64bit long
98 >>>>>20 long !0 32bit long
99 >>>>12 ledouble 8.642135e+130 little-endian
100 >>>>>24 long 0 64bit long
101 >>>>>24 long !0 32bit long (i386)
102 >>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian
103 >>>>>24 short !0 32bit long (arm)
105 >>8 quad 0 64bit aligned
106 >>>16 bedouble 8.642135e+130 big-endian
107 >>>>24 long 0 64bit long (s390x)
108 >>>>24 long !0 32bit long (hppa/mips/ppc/s390/sparc)
109 >>>16 ledouble 8.642135e+130 little-endian
110 >>>>28 long 0 64bit long (alpha/amd64/ia64)
111 >>>>28 long !0 32bit long (armel/mipsel)
113 #----------------------------------------------------------------------
114 # ROOT: file(1) magic for ROOT databases
116 0 string root\0 ROOT file
117 >4 belong x Version %d
118 >33 belong x (Compression: %d)
121 # Alex Ott <ott@jet.msk.su>
122 ## Paradox file formats
123 #2 leshort 0x0800 Paradox
127 #>0x39 byte 10 v. 5.x
128 #>0x39 byte 11 v. 5.x
129 #>0x39 byte 12 v. 7.x
130 #>>0x04 byte 0 indexed .DB data file
131 #>>0x04 byte 1 primary index .PX file
132 #>>0x04 byte 2 non-indexed .DB data file
133 #>>0x04 byte 3 non-incrementing secondary index .Xnn file
134 #>>0x04 byte 4 secondary index .Ynn file
135 #>>0x04 byte 5 incrementing secondary index .Xnn file
136 #>>0x04 byte 6 non-incrementing secondary index .XGn file
137 #>>0x04 byte 7 secondary index .YGn file
138 #>>>0x04 byte 8 incrementing secondary index .XGn file
140 ## XBase database files
141 # updated by Joerg Jenderek at Feb 2013
142 # http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
143 # http://www.clicketyclick.dk/databases/xbase/format/dbf.html
144 # http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
145 # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
146 0 ubelong&0x0000FFFF <0x00000C20
147 # skip Infocom game Z-machine
149 # skip Androids *.xml
154 # skip HELP.CA3 by test for reserved byte ( NULL )
156 # reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
157 #>>>>>30 ubeshort x 30NULL?%x
158 # possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
159 >>>>>>24 ubelong&0xffFFFFff >0x01302000
161 >>>>>>24 ubelong&0xffFFFFff <0x01302001
162 # for Xbase Database file (*.DBF) reserved (NULL) for multi-user
163 >>>>>>>24 ubelong&0xffFFFFff =0
164 # test for 2 reserved NULL bytes,transaction and encryption byte flag
165 >>>>>>>>12 ubelong&0xFFFFfEfE 0
168 >>>>>>>>>28 ubyte&0xf8 0
170 >>>>>>>>>>8 uleshort >31
171 # skip PIC15736.PCX by test for language driver name or field name
172 >>>>>>>>>>>32 ubyte >0
173 #!:mime application/x-dbf; charset=unknown-8bit ??
174 #!:mime application/x-dbase
175 >>>>>>>>>>>>0 use xbase-type
177 >>>>>>>>>>>>0 ubyte x \b DBF
178 >>>>>>>>>>>>4 lelong 0 \b, no records
179 >>>>>>>>>>>>4 lelong >0 \b, %ld record
181 >>>>>>>>>>>>>4 lelong >1 \bs
182 # http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
183 # 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
184 >>>>>>>>>>>>10 uleshort x * %d
185 # file size = records * record size + header size
186 >>>>>>>>>>>>1 ubyte x \b, update-date
187 >>>>>>>>>>>>1 use xbase-date
188 # http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
189 #>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x
190 # 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
191 >>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x
192 #>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file
193 >>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX
194 >>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
195 >>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
196 # 1st record offset + 1 = header size
197 >>>>>>>>>>>>8 uleshort >0
198 >>>>>>>>>>>>(8.s+1) ubyte >0
199 >>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
200 >>>>>>>>>>>>>(8.s+1) ubyte >0
201 >>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
202 # for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL)
203 >>>>>>>24 ubelong&0x0133f7ff >0
204 # test for reserved NULL byte
206 # test for valid TAG key format (0x10 or 0)
207 >>>>>>>>>559 ubyte&0xeF 0
209 >>>>>>>>>45 ubeshort <0x0C20
210 >>>>>>>>>>45 ubyte >0
211 >>>>>>>>>>>46 ubyte <32
212 >>>>>>>>>>>>46 ubyte >0
213 #!:mime application/x-mdx
214 >>>>>>>>>>>>>0 use xbase-type
215 >>>>>>>>>>>>>0 ubyte x \b MDX
216 >>>>>>>>>>>>>1 ubyte x \b, creation-date
217 >>>>>>>>>>>>>1 use xbase-date
218 >>>>>>>>>>>>>44 ubyte x \b, update-date
219 >>>>>>>>>>>>>44 use xbase-date
220 # No.of tags in use (1,2,5,12)
221 >>>>>>>>>>>>>28 uleshort x \b, %d
222 # No. of entries in tag (0x30)
223 >>>>>>>>>>>>>25 ubyte x \b/%d tags
225 >>>>>>>>>>>>>26 ubyte x * %d
227 >>>>>>>>>>>>>548 string x \b, 1st tag "%.11s"
229 #>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
231 # Print the xBase names of different version variants
236 >>0 ubyte 0x02 FoxBase
237 # FoxBase+/dBaseIII+, no memo
238 >>0 ubyte 0x03 FoxBase+/dBase III
239 !:mime application/x-dbf
240 # dBASE IV no memo file
241 >>0 ubyte 0x04 dBase IV
242 !:mime application/x-dbf
243 # dBASE V no memo file
244 >>0 ubyte 0x05 dBase V
245 !:mime application/x-dbf
246 >>0 ubyte 0x30 Visual FoxPro
247 !:mime application/x-dbf
248 >>0 ubyte 0x31 Visual FoxPro, autoincrement
249 !:mime application/x-dbf
250 # Visual FoxPro, with field type Varchar or Varbinary
251 >>0 ubyte 0x32 Visual FoxPro, with field type Varchar
252 !:mime application/x-dbf
253 # dBASE IV SQL, no memo;dbv memo var size (Flagship)
254 >>0 ubyte 0x43 dBase IV, with SQL table
255 !:mime application/x-dbf
256 # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
257 #>>0 ubyte 0x62 dBase IV, with SQL table
258 #!:mime application/x-dbf
259 # dBASE IV, with memo!!
260 >>0 ubyte 0x7b dBase IV, with memo
261 !:mime application/x-dbf
262 # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
263 #>>0 ubyte 0x82 dBase IV, with SQL system
264 #!:mime application/x-dbf
265 # FoxBase+/dBaseIII+ with memo .DBT!
266 >>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT
267 !:mime application/x-dbf
268 # VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
269 >>0 ubyte 0x87 VISUAL OBJECTS, with memo file
270 !:mime application/x-dbf
271 # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
272 #>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
273 #!:mime application/x-dbf
274 # dBASE IV with memo!
275 >>0 ubyte 0x8B dBase IV, with memo .DBT
276 !:mime application/x-dbf
277 # dBase IV with SQL Table,no memo?
278 >>0 ubyte 0x8E dBase IV, with SQL table
279 !:mime application/x-dbf
280 # .dbv and .dbt memo (Flagship)?
281 >>0 ubyte 0xB3 Flagship
282 # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
283 #>>0 ubyte 0xCA dBase IV with memo .DBT
284 #!:mime application/x-dbf
285 # dBASE IV with SQL table, with memo .DBT
286 >>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
287 !:mime application/x-dbf
288 # HiPer-Six format;Clipper SIX, with SMT memo file
289 >>0 ubyte 0xE5 Clipper SIX with memo
290 !:mime application/x-dbf
291 # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
292 #>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
293 #!:mime application/x-dbf
294 >>0 ubyte 0xF5 FoxPro with memo
295 !:mime application/x-dbf
296 # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
297 #>>0 ubyte 0xFA FoxPro 2.x, with memo
298 #!:mime application/x-dbf
299 # unknown version (should not happen)
301 !:mime application/x-dbf
303 # flags in version byte
304 # DBT flag (with dBASE III memo .DBT)!!
305 # >>0 ubyte&0x80 >0 DBT_FLAG=%x
307 # >>0 ubyte&0x08 >0 MEMO_FLAG=%x
309 # >>0 ubyte&0x70 >0 SQL_FLAG=%x
310 # test and print the date of xBase .DBF .MDX
312 # inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
319 # YY is interpreted as 20YY or 19YY
320 >>>>>>0 ubyte <100 \b %.2d
321 # YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
322 >>>>>>0 ubyte >99 \b %d
326 # dBase memo files .DBT or .FPT
327 # http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
331 # next free block index is positive
333 # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
334 >>>>17 ubelong&0xFFfdFE00 0x00000000
335 # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
336 >>>>>20 ubelong&0xFF01209B 0x00000000
340 >>>>>>>0 use xbase-memo-print
341 # dBASE IV DBT , FoxPro FPT or many PNG , ZIP , DBF garbage
343 # dBASE IV DBT with DBF name or DBF garbage
344 >>>>>>>8 ubelong >0x40000000
345 # skip DBF and catch dBASE IV DBT with DBF name and with non big index of next free block
346 >>>>>>>>0 ulelong <0x01010002
347 >>>>>>>>>0 use xbase-memo-print
349 # skip MM*DD*.bin by test for for reserved NULL byte
350 >>>>>>>>508 ubelong 0
351 # real memo files should contain text here
352 >>>>>>>>>520 ubelong >0x20202019
353 >>>>>>>>>>520 ubelong <0xFEFEFEFF
354 >>>>>>>>>>>0 use xbase-memo-print
355 # garbage PCX , ZIP , JAR , XPI
358 # Print the information of dBase DBT or FoxPro FPT memo files
359 0 name xbase-memo-print
363 >>16 ubyte 3 dBase III DBT
365 >>>512 ubelong <0x00000003 FoxPro FPT
366 # Size of blocks for FoxPro
367 >>>>6 ubeshort x \b, blocks size %lu
368 # Number of next available block for appending data for FoxPro
369 >>>>0 ubelong =0 \b, next free block index %lu
370 >>>>0 ubelong !0 \b, next free block index %lu
371 >>>512 default x dBase IV DBT
372 # DBF file name without extention
373 >>>>8 string >\0 \b of %-.8s.DBF
374 # size of blocks ; not reliable 0x2020204C
375 #>>>>4 ulelong =0 \b, blocks size %lu
376 >>>>4 ulelong !0 \b, blocks size %lu
377 # Block length found 0 , 512
378 #>>>>20 uleshort =0 \b, block length %u
379 >>>>20 uleshort !0 \b, block length %u
380 # Number of next available block for appending data
381 >>>>0 ulelong =0 \b, next free block index %lu
382 >>>>0 ulelong !0 \b, next free block index %lu
384 >>>512 ubelong =0xFFFF0800
385 >>>>520 string >\0 \b, 1st used item "%s"
390 >>>>520 string >\0 \b, 1st used item "%s"
392 # may be deleted memo field
393 >>>>512 string >\0 \b, 1st item "%s"
396 # DBASE index file *.NDX
397 # DBASE Compound Index file *.CDX
398 # dBASE IV Printer Driver *.PRF
399 ## End of XBase database stuff
402 4 string Standard\ Jet\ DB Microsoft Access Database
403 !:mime application/x-msaccess
404 4 string Standard\ ACE\ DB Microsoft Access Database
405 !:mime application/x-msaccess
407 # TDB database from Samba et al - Martin Pool <mbp@samba.org>
408 0 string TDB\ file TDB database
409 >32 lelong 0x2601196D version 6, little-endian
410 >>36 lelong x hash size %d bytes
412 # SE Linux policy database
413 0 lelong 0xf97cff8c SE Linux policy
416 >24 lelong x %d symbols
417 >28 lelong x %d ocons
419 # ICE authority file data (Wolfram Kleff)
420 2 string ICE ICE authority data
422 # X11 Xauthority file (Wolfram Kleff)
423 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
424 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
425 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
426 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
427 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
428 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
429 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
430 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
431 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
433 # From: Maxime Henrion <mux@FreeBSD.org>
434 # PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
435 0 string PGDMP PostgreSQL custom database dump
438 >5 beshort <0x101 \b-0
442 # Type: Advanced Data Format (ADF) database
443 # URL: http://www.grc.nasa.gov/WWW/cgns/adf/
444 # From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
445 0 string @(#)ADF\ Database CGNS Advanced Data Format
447 # Tokyo Cabinet magic data
448 # http://tokyocabinet.sourceforge.net/index.html
449 0 string ToKyO\ CaBiNeT\n Tokyo Cabinet
452 !:mime application/x-tokyocabinet-hash
453 >32 byte 1 \b, B+ tree
454 !:mime application/x-tokyocabinet-btree
455 >32 byte 2 \b, Fixed-length
456 !:mime application/x-tokyocabinet-fixed
458 !:mime application/x-tokyocabinet-table
459 >33 byte &1 \b, [open]
460 >33 byte &2 \b, [fatal]
461 >34 byte x \b, apow=%d
462 >35 byte x \b, fpow=%d
463 >36 byte &0x01 \b, [large]
464 >36 byte &0x02 \b, [deflate]
465 >36 byte &0x04 \b, [bzip]
466 >36 byte &0x08 \b, [tcbs]
467 >36 byte &0x10 \b, [excodec]
468 >40 lequad x \b, bnum=%lld
469 >48 lequad x \b, rnum=%lld
470 >56 lequad x \b, fsiz=%lld
472 # Type: QDBM Quick Database Manager
473 # From: Benoit Sibaud <bsibaud@april.org>
474 0 string \\[depot\\]\n\f Quick Database Manager, little endian
475 0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian
477 # Type: TokyoCabinet database
478 # URL: http://tokyocabinet.sourceforge.net/
479 # From: Benoit Sibaud <bsibaud@april.org>
480 0 string ToKyO\ CaBiNeT\n TokyoCabinet database
481 >14 string x (version %s)
483 # From: Stephane Blondon http://www.yaal.fr
484 # Database file for Zope (done by FileStorage)
485 0 string FS21 Zope Object Database File Storage (data)
486 # Cache file for the database of Zope (done by ClientStorage)
487 0 string ZEC3 Zope Object Database Client Cache File (data)
489 # IDA (Interactive Disassembler) database
490 0 string IDA1 IDA (Interactive Disassembler) database