1.\" $File: magic.man,v 1.103 2023/07/20 14:32:07 christos Exp $ 2.Dd Arpil 18, 2023 3.Dt MAGIC __FSECTION__ 4.Os 5.\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems. 6.Sh NAME 7.Nm magic 8.Nd file command's magic pattern file 9.Sh DESCRIPTION 10This manual page documents the format of magic files as 11used by the 12.Xr file __CSECTION__ 13command, version __VERSION__. 14The 15.Xr file __CSECTION__ 16command identifies the type of a file using, 17among other tests, 18a test for whether the file contains certain 19.Dq "magic patterns" . 20The database of these 21.Dq "magic patterns" 22is usually located in a binary file in 23.Pa __MAGIC__.mgc 24or a directory of source text magic pattern fragment files in 25.Pa __MAGIC__ . 26The database specifies what patterns are to be tested for, what message or 27MIME type to print if a particular pattern is found, 28and additional information to extract from the file. 29.Pp 30The format of the source fragment files that are used to build this database 31is as follows: 32Each line of a fragment file specifies a test to be performed. 33A test compares the data starting at a particular offset 34in the file with a byte value, a string or a numeric value. 35If the test succeeds, a message is printed. 36The line consists of the following fields: 37.Bl -tag -width ".Dv message" 38.It Dv offset 39A number specifying the offset (in bytes) into the file of the data 40which is to be tested. 41This offset can be a negative number if it is: 42.Bl -bullet -compact 43.It 44The first direct offset of the magic entry (at continuation level 0), 45in which case it is interpreted an offset from end end of the file 46going backwards. 47This works only when a file descriptor to the file is available and it 48is a regular file. 49.It 50A continuation offset relative to the end of the last up-level field 51.Dv ( \*[Am] ) . 52.El 53.It Dv type 54The type of the data to be tested. 55The possible values are: 56.Bl -tag -width ".Dv lestring16" 57.It Dv byte 58A one-byte value. 59.It Dv short 60A two-byte value in this machine's native byte order. 61.It Dv long 62A four-byte value in this machine's native byte order. 63.It Dv quad 64An eight-byte value in this machine's native byte order. 65.It Dv float 66A 32-bit single precision IEEE floating point number in this machine's native byte order. 67.It Dv double 68A 64-bit double precision IEEE floating point number in this machine's native byte order. 69.It Dv string 70A string of bytes. 71The string type specification can be optionally followed by a /<width> 72option and optionally followed by a set of flags /[bCcftTtWw]*. 73The width limits the number of characters to be copied. 74Zero means all characters. 75The following flags are supported: 76.Bl -tag -width B -compact -offset XXXX 77.It b 78Force binary file test. 79.It C 80Use upper case insensitive matching: upper case 81characters in the magic match both lower and upper case characters in the 82target, whereas lower case characters in the magic only match upper case 83characters in the target. 84.It c 85Use lower case insensitive matching: lower case 86characters in the magic match both lower and upper case characters in the 87target, whereas upper case characters in the magic only match upper case 88characters in the target. 89To do a complete case insensitive match, specify both 90.Dq c 91and 92.Dq C . 93.It f 94Require that the matched string is a full word, not a partial word match. 95.It T 96Trim the string, i.e. leading and trailing whitespace 97.It t 98Force text file test. 99.It W 100Compact whitespace in the target, which must 101contain at least one whitespace character. 102If the magic has 103.Dv n 104consecutive blanks, the target needs at least 105.Dv n 106consecutive blanks to match. 107.It w 108Treat every blank in the magic as an optional blank. 109is deleted before the string is printed. 110.El 111.It Dv pstring 112A Pascal-style string where the first byte/short/int is interpreted as the 113unsigned length. 114The length defaults to byte and can be specified as a modifier. 115The following modifiers are supported: 116.Bl -tag -width B -compact -offset XXXX 117.It B 118A byte length (default). 119.It H 120A 2 byte big endian length. 121.It h 122A 2 byte little endian length. 123.It L 124A 4 byte big endian length. 125.It l 126A 4 byte little endian length. 127.It J 128The length includes itself in its count. 129.El 130The string is not NUL terminated. 131.Dq J 132is used rather than the more 133valuable 134.Dq I 135because this type of length is a feature of the JPEG 136format. 137.It Dv date 138A four-byte value interpreted as a UNIX date. 139.It Dv qdate 140An eight-byte value interpreted as a UNIX date. 141.It Dv ldate 142A four-byte value interpreted as a UNIX-style date, but interpreted as 143local time rather than UTC. 144.It Dv qldate 145An eight-byte value interpreted as a UNIX-style date, but interpreted as 146local time rather than UTC. 147.It Dv qwdate 148An eight-byte value interpreted as a Windows-style date. 149.It Dv beid3 150A 32-bit ID3 length in big-endian byte order. 151.It Dv beshort 152A two-byte value in big-endian byte order. 153.It Dv belong 154A four-byte value in big-endian byte order. 155.It Dv bequad 156An eight-byte value in big-endian byte order. 157.It Dv befloat 158A 32-bit single precision IEEE floating point number in big-endian byte order. 159.It Dv bedouble 160A 64-bit double precision IEEE floating point number in big-endian byte order. 161.It Dv bedate 162A four-byte value in big-endian byte order, 163interpreted as a Unix date. 164.It Dv beqdate 165An eight-byte value in big-endian byte order, 166interpreted as a Unix date. 167.It Dv beldate 168A four-byte value in big-endian byte order, 169interpreted as a UNIX-style date, but interpreted as local time rather 170than UTC. 171.It Dv beqldate 172An eight-byte value in big-endian byte order, 173interpreted as a UNIX-style date, but interpreted as local time rather 174than UTC. 175.It Dv beqwdate 176An eight-byte value in big-endian byte order, 177interpreted as a Windows-style date. 178.It Dv bestring16 179A two-byte unicode (UCS16) string in big-endian byte order. 180.It Dv leid3 181A 32-bit ID3 length in little-endian byte order. 182.It Dv leshort 183A two-byte value in little-endian byte order. 184.It Dv lelong 185A four-byte value in little-endian byte order. 186.It Dv lequad 187An eight-byte value in little-endian byte order. 188.It Dv lefloat 189A 32-bit single precision IEEE floating point number in little-endian byte order. 190.It Dv ledouble 191A 64-bit double precision IEEE floating point number in little-endian byte order. 192.It Dv ledate 193A four-byte value in little-endian byte order, 194interpreted as a UNIX date. 195.It Dv leqdate 196An eight-byte value in little-endian byte order, 197interpreted as a UNIX date. 198.It Dv leldate 199A four-byte value in little-endian byte order, 200interpreted as a UNIX-style date, but interpreted as local time rather 201than UTC. 202.It Dv leqldate 203An eight-byte value in little-endian byte order, 204interpreted as a UNIX-style date, but interpreted as local time rather 205than UTC. 206.It Dv leqwdate 207An eight-byte value in little-endian byte order, 208interpreted as a Windows-style date. 209.It Dv lestring16 210A two-byte unicode (UCS16) string in little-endian byte order. 211.It Dv melong 212A four-byte value in middle-endian (PDP-11) byte order. 213.It Dv medate 214A four-byte value in middle-endian (PDP-11) byte order, 215interpreted as a UNIX date. 216.It Dv meldate 217A four-byte value in middle-endian (PDP-11) byte order, 218interpreted as a UNIX-style date, but interpreted as local time rather 219than UTC. 220.It Dv indirect 221Starting at the given offset, consult the magic database again. 222The offset of the 223.Dv indirect 224magic is by default absolute in the file, but one can specify 225.Dv /r 226to indicate that the offset is relative from the beginning of the entry. 227.It Dv name 228Define a 229.Dq named 230magic instance that can be called from another 231.Dv use 232magic entry, like a subroutine call. 233Named instance direct magic offsets are relative to the offset of the 234previous matched entry, but indirect offsets are relative to the beginning 235of the file as usual. 236Named magic entries always match. 237.It Dv use 238Recursively call the named magic starting from the current offset. 239If the name of the referenced begins with a 240.Dv ^ 241then the endianness of the magic is switched; if the magic mentioned 242.Dv leshort 243for example, 244it is treated as 245.Dv beshort 246and vice versa. 247This is useful to avoid duplicating the rules for different endianness. 248.It Dv regex 249A regular expression match in extended POSIX regular expression syntax 250(like egrep). 251Regular expressions can take exponential time to process, and their 252performance is hard to predict, so their use is discouraged. 253When used in production environments, their performance 254should be carefully checked. 255The size of the string to search should also be limited by specifying 256.Dv /<length> , 257to avoid performance issues scanning long files. 258The type specification can also be optionally followed by 259.Dv /[c][s][l] . 260The 261.Dq c 262flag makes the match case insensitive, while the 263.Dq s 264flag update the offset to the start offset of the match, rather than the end. 265The 266.Dq l 267modifier, changes the limit of length to mean number of lines instead of a 268byte count. 269Lines are delimited by the platforms native line delimiter. 270When a line count is specified, an implicit byte count also computed assuming 271each line is 80 characters long. 272If neither a byte or line count is specified, the search is limited automatically 273to 8KiB. 274.Dv ^ 275and 276.Dv $ 277match the beginning and end of individual lines, respectively, 278not beginning and end of file. 279.It Dv search 280A literal string search starting at the given offset. 281The same modifier flags can be used as for string patterns. 282The search expression must contain the range in the form 283.Dv /number, 284that is the number of positions at which the match will be 285attempted, starting from the start offset. 286This is suitable for 287searching larger binary expressions with variable offsets, using 288.Dv \e 289escapes for special characters. 290The order of modifier and number is not relevant. 291.It Dv default 292This is intended to be used with the test 293.Em x 294(which is always true) and it has no type. 295It matches when no other test at that continuation level has matched before. 296Clearing that matched tests for a continuation level, can be done using the 297.Dv clear 298test. 299.It Dv clear 300This test is always true and clears the match flag for that continuation level. 301It is intended to be used with the 302.Dv default 303test. 304.It Dv der 305Parse the file as a DER Certificate file. 306The test field is used as a der type that needs to be matched. 307The DER types are: 308.Dv eoc , 309.Dv bool , 310.Dv int , 311.Dv bit_str , 312.Dv octet_str , 313.Dv null , 314.Dv obj_id , 315.Dv obj_desc , 316.Dv ext , 317.Dv real , 318.Dv enum , 319.Dv embed , 320.Dv utf8_str , 321.Dv rel_oid , 322.Dv time , 323.Dv res2 , 324.Dv seq , 325.Dv set , 326.Dv num_str , 327.Dv prt_str , 328.Dv t61_str , 329.Dv vid_str , 330.Dv ia5_str , 331.Dv utc_time , 332.Dv gen_time , 333.Dv gr_str , 334.Dv vis_str , 335.Dv gen_str , 336.Dv univ_str , 337.Dv char_str , 338.Dv bmp_str , 339.Dv date , 340.Dv tod , 341.Dv datetime , 342.Dv duration , 343.Dv oid-iri , 344.Dv rel-oid-iri . 345These types can be followed by an optional numeric size, which indicates 346the field width in bytes. 347.It Dv guid 348A Globally Unique Identifier, parsed and printed as 349XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX. 350It's format is a string. 351.It Dv offset 352This is a quad value indicating the current offset of the file. 353It can be used to determine the size of the file or the magic buffer. 354For example the magic entries: 355.Bd -literal -offset indent 356-0 offset x this file is %lld bytes 357-0 offset <=100 must be more than 100 \e 358 bytes and is only %lld 359.Ed 360.It Dv octal 361A string representing an octal number. 362.El 363.El 364.Pp 365For compatibility with the Single 366.Ux 367Standard, the type specifiers 368.Dv dC 369and 370.Dv d1 371are equivalent to 372.Dv byte , 373the type specifiers 374.Dv uC 375and 376.Dv u1 377are equivalent to 378.Dv ubyte , 379the type specifiers 380.Dv dS 381and 382.Dv d2 383are equivalent to 384.Dv short , 385the type specifiers 386.Dv uS 387and 388.Dv u2 389are equivalent to 390.Dv ushort , 391the type specifiers 392.Dv dI , 393.Dv dL , 394and 395.Dv d4 396are equivalent to 397.Dv long , 398the type specifiers 399.Dv uI , 400.Dv uL , 401and 402.Dv u4 403are equivalent to 404.Dv ulong , 405the type specifier 406.Dv d8 407is equivalent to 408.Dv quad , 409the type specifier 410.Dv u8 411is equivalent to 412.Dv uquad , 413and the type specifier 414.Dv s 415is equivalent to 416.Dv string . 417In addition, the type specifier 418.Dv dQ 419is equivalent to 420.Dv quad 421and the type specifier 422.Dv uQ 423is equivalent to 424.Dv uquad . 425.Pp 426Each top-level magic pattern (see below for an explanation of levels) 427is classified as text or binary according to the types used. 428Types 429.Dq regex 430and 431.Dq search 432are classified as text tests, unless non-printable characters are used 433in the pattern. 434All other tests are classified as binary. 435A top-level 436pattern is considered to be a test text when all its patterns are text 437patterns; otherwise, it is considered to be a binary pattern. 438When 439matching a file, binary patterns are tried first; if no match is 440found, and the file looks like text, then its encoding is determined 441and the text patterns are tried. 442.Pp 443The numeric types may optionally be followed by 444.Dv \*[Am] 445and a numeric value, 446to specify that the value is to be AND'ed with the 447numeric value before any comparisons are done. 448Prepending a 449.Dv u 450to the type indicates that ordered comparisons should be unsigned. 451.It Dv test 452The value to be compared with the value from the file. 453If the type is 454numeric, this value 455is specified in C form; if it is a string, it is specified as a C string 456with the usual escapes permitted (e.g. \en for new-line). 457.Pp 458Numeric values 459may be preceded by a character indicating the operation to be performed. 460It may be 461.Dv = , 462to specify that the value from the file must equal the specified value, 463.Dv \*[Lt] , 464to specify that the value from the file must be less than the specified 465value, 466.Dv \*[Gt] , 467to specify that the value from the file must be greater than the specified 468value, 469.Dv \*[Am] , 470to specify that the value from the file must have set all of the bits 471that are set in the specified value, 472.Dv ^ , 473to specify that the value from the file must have clear any of the bits 474that are set in the specified value, or 475.Dv ~ , 476the value specified after is negated before tested. 477.Dv x , 478to specify that any value will match. 479If the character is omitted, it is assumed to be 480.Dv = . 481Operators 482.Dv \*[Am] , 483.Dv ^ , 484and 485.Dv ~ 486don't work with floats and doubles. 487The operator 488.Dv !\& 489specifies that the line matches if the test does 490.Em not 491succeed. 492.Pp 493Numeric values are specified in C form; e.g. 494.Dv 13 495is decimal, 496.Dv 013 497is octal, and 498.Dv 0x13 499is hexadecimal. 500.Pp 501Numeric operations are not performed on date types, instead the numeric 502value is interpreted as an offset. 503.Pp 504For string values, the string from the 505file must match the specified string. 506The operators 507.Dv = , 508.Dv \*[Lt] 509and 510.Dv \*[Gt] 511(but not 512.Dv \*[Am] ) 513can be applied to strings. 514The length used for matching is that of the string argument 515in the magic file. 516This means that a line can match any non-empty string (usually used to 517then print the string), with 518.Em \*[Gt]\e0 519(because all non-empty strings are greater than the empty string). 520.Pp 521Dates are treated as numerical values in the respective internal 522representation. 523.Pp 524The special test 525.Em x 526always evaluates to true. 527.It Dv message 528The message to be printed if the comparison succeeds. 529If the string contains a 530.Xr printf 3 531format specification, the value from the file (with any specified masking 532performed) is printed using the message as the format string. 533If the string begins with 534.Dq \eb , 535the message printed is the remainder of the string with no whitespace 536added before it: multiple matches are normally separated by a single 537space. 538.El 539.Pp 540An APPLE 4+4 character APPLE creator and type can be specified as: 541.Bd -literal -offset indent 542!:apple CREATYPE 543.Ed 544.Pp 545A slash-separated list of commonly found filename extensions can be specified 546as: 547.Bd -literal -offset indent 548!:ext ext[/ext...] 549.Ed 550.Pp 551i.e. the literal string 552.Dq !:ext 553followed by a slash-separated list of commonly found extensions; for example 554for JPEG images: 555.Bd -literal -offset indent 556!:ext jpeg/jpg/jpe/jfif 557.Ed 558.Pp 559A MIME type is given on a separate line, which must be the next 560non-blank or comment line after the magic line that identifies the 561file type, and has the following format: 562.Bd -literal -offset indent 563!:mime MIMETYPE 564.Ed 565.Pp 566i.e. the literal string 567.Dq !:mime 568followed by the MIME type. 569.Pp 570An optional strength can be supplied on a separate line which refers to 571the current magic description using the following format: 572.Bd -literal -offset indent 573!:strength OP VALUE 574.Ed 575.Pp 576The operand 577.Dv OP 578can be: 579.Dv + , 580.Dv - , 581.Dv * , 582or 583.Dv / 584and 585.Dv VALUE 586is a constant between 0 and 255. 587This constant is applied using the specified operand 588to the currently computed default magic strength. 589.Pp 590Some file formats contain additional information which is to be printed 591along with the file type or need additional tests to determine the true 592file type. 593These additional tests are introduced by one or more 594.Em \*[Gt] 595characters preceding the offset. 596The number of 597.Em \*[Gt] 598on the line indicates the level of the test; a line with no 599.Em \*[Gt] 600at the beginning is considered to be at level 0. 601Tests are arranged in a tree-like hierarchy: 602if the test on a line at level 603.Em n 604succeeds, all following tests at level 605.Em n+1 606are performed, and the messages printed if the tests succeed, until a line 607with level 608.Em n 609(or less) appears. 610For more complex files, one can use empty messages to get just the 611"if/then" effect, in the following way: 612.Bd -literal -offset indent 6130 string MZ 614\*[Gt]0x18 leshort \*[Lt]0x40 MS-DOS executable 615\*[Gt]0x18 leshort \*[Gt]0x3f extended PC executable (e.g., MS Windows) 616.Ed 617.Pp 618Offsets do not need to be constant, but can also be read from the file 619being examined. 620If the first character following the last 621.Em \*[Gt] 622is a 623.Em \&( 624then the string after the parenthesis is interpreted as an indirect offset. 625That means that the number after the parenthesis is used as an offset in 626the file. 627The value at that offset is read, and is used again as an offset 628in the file. 629Indirect offsets are of the form: 630.Em (( x [[.,][bBcCeEfFgGhHiIlmsSqQ]][+\-][ y ]) . 631The value of 632.Em x 633is used as an offset in the file. 634A byte, id3 length, short or long is read at that offset depending on the 635.Em [bBcCeEfFgGhHiIlmsSqQ] 636type specifier. 637The value is treated as signed if 638.Dq , 639is specified or unsigned if 640.Dq . 641is specified. 642The capitalized types interpret the number as a big endian 643value, whereas the small letter versions interpret the number as a little 644endian value; 645the 646.Em m 647type interprets the number as a middle endian (PDP-11) value. 648To that number the value of 649.Em y 650is added and the result is used as an offset in the file. 651The default type if one is not specified is long. 652The following types are recognized: 653.Bl -column -offset indent "Type" "Half/Short" "Little" "Size" 654.It Sy Type Sy Mnemonic Sy Endian Sy Size 655.It bcBc Byte/Char N/A 1 656.It efg Double Little 8 657.It EFG Double Big 8 658.It hs Half/Short Little 2 659.It HS Half/Short Big 2 660.It i ID3 Little 4 661.It I ID3 Big 4 662.It m Middle Middle 4 663.It o Octal Textual Variable 664.It q Quad Little 8 665.It Q Quad Big 8 666.El 667.Pp 668That way variable length structures can be examined: 669.Bd -literal -offset indent 670# MS Windows executables are also valid MS-DOS executables 6710 string MZ 672\*[Gt]0x18 leshort \*[Lt]0x40 MZ executable (MS-DOS) 673# skip the whole block below if it is not an extended executable 674\*[Gt]0x18 leshort \*[Gt]0x3f 675\*[Gt]\*[Gt](0x3c.l) string PE\e0\e0 PE executable (MS-Windows) 676\*[Gt]\*[Gt](0x3c.l) string LX\e0\e0 LX executable (OS/2) 677.Ed 678.Pp 679This strategy of examining has a drawback: you must make sure that you 680eventually print something, or users may get empty output (such as when 681there is neither PE\e0\e0 nor LE\e0\e0 in the above example). 682.Pp 683If this indirect offset cannot be used directly, simple calculations are 684possible: appending 685.Em [+-*/%\*[Am]|^]number 686inside parentheses allows one to modify 687the value read from the file before it is used as an offset: 688.Bd -literal -offset indent 689# MS Windows executables are also valid MS-DOS executables 6900 string MZ 691# sometimes, the value at 0x18 is less that 0x40 but there's still an 692# extended executable, simply appended to the file 693\*[Gt]0x18 leshort \*[Lt]0x40 694\*[Gt]\*[Gt](4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP) 695\*[Gt]\*[Gt](4.s*512) leshort !0x014c MZ executable (MS-DOS) 696.Ed 697.Pp 698Sometimes you do not know the exact offset as this depends on the length or 699position (when indirection was used before) of preceding fields. 700You can specify an offset relative to the end of the last up-level 701field using 702.Sq \*[Am] 703as a prefix to the offset: 704.Bd -literal -offset indent 7050 string MZ 706\*[Gt]0x18 leshort \*[Gt]0x3f 707\*[Gt]\*[Gt](0x3c.l) string PE\e0\e0 PE executable (MS-Windows) 708# immediately following the PE signature is the CPU type 709\*[Gt]\*[Gt]\*[Gt]\*[Am]0 leshort 0x14c for Intel 80386 710\*[Gt]\*[Gt]\*[Gt]\*[Am]0 leshort 0x184 for DEC Alpha 711.Ed 712.Pp 713Indirect and relative offsets can be combined: 714.Bd -literal -offset indent 7150 string MZ 716\*[Gt]0x18 leshort \*[Lt]0x40 717\*[Gt]\*[Gt](4.s*512) leshort !0x014c MZ executable (MS-DOS) 718# if it's not COFF, go back 512 bytes and add the offset taken 719# from byte 2/3, which is yet another way of finding the start 720# of the extended executable 721\*[Gt]\*[Gt]\*[Gt]\*[Am](2.s-514) string LE LE executable (MS Windows VxD driver) 722.Ed 723.Pp 724Or the other way around: 725.Bd -literal -offset indent 7260 string MZ 727\*[Gt]0x18 leshort \*[Gt]0x3f 728\*[Gt]\*[Gt](0x3c.l) string LE\e0\e0 LE executable (MS-Windows) 729# at offset 0x80 (-4, since relative offsets start at the end 730# of the up-level match) inside the LE header, we find the absolute 731# offset to the code area, where we look for a specific signature 732\*[Gt]\*[Gt]\*[Gt](\*[Am]0x7c.l+0x26) string UPX \eb, UPX compressed 733.Ed 734.Pp 735Or even both! 736.Bd -literal -offset indent 7370 string MZ 738\*[Gt]0x18 leshort \*[Gt]0x3f 739\*[Gt]\*[Gt](0x3c.l) string LE\e0\e0 LE executable (MS-Windows) 740# at offset 0x58 inside the LE header, we find the relative offset 741# to a data area where we look for a specific signature 742\*[Gt]\*[Gt]\*[Gt]\*[Am](\*[Am]0x54.l-3) string UNACE \eb, ACE self-extracting archive 743.Ed 744.Pp 745If you have to deal with offset/length pairs in your file, even the 746second value in a parenthesized expression can be taken from the file itself, 747using another set of parentheses. 748Note that this additional indirect offset is always relative to the 749start of the main indirect offset. 750.Bd -literal -offset indent 7510 string MZ 752\*[Gt]0x18 leshort \*[Gt]0x3f 753\*[Gt]\*[Gt](0x3c.l) string PE\e0\e0 PE executable (MS-Windows) 754# search for the PE section called ".idata"... 755\*[Gt]\*[Gt]\*[Gt]\*[Am]0xf4 search/0x140 .idata 756# ...and go to the end of it, calculated from start+length; 757# these are located 14 and 10 bytes after the section name 758\*[Gt]\*[Gt]\*[Gt]\*[Gt](\*[Am]0xe.l+(-4)) string PK\e3\e4 \eb, ZIP self-extracting archive 759.Ed 760.Pp 761If you have a list of known values at a particular continuation level, 762and you want to provide a switch-like default case: 763.Bd -literal -offset indent 764# clear that continuation level match 765\*[Gt]18 clear 766\*[Gt]18 lelong 1 one 767\*[Gt]18 lelong 2 two 768\*[Gt]18 default x 769# print default match 770\*[Gt]\*[Gt]18 lelong x unmatched 0x%x 771.Ed 772.Sh SEE ALSO 773.Xr file __CSECTION__ 774\- the command that reads this file. 775.Sh BUGS 776The formats 777.Dv long , 778.Dv belong , 779.Dv lelong , 780.Dv melong , 781.Dv short , 782.Dv beshort , 783and 784.Dv leshort 785do not depend on the length of the C data types 786.Dv short 787and 788.Dv long 789on the platform, even though the Single 790.Ux 791Specification implies that they do. 792However, as OS X Mountain Lion has passed the Single 793.Ux 794Specification validation suite, and supplies a version of 795.Xr file __CSECTION__ 796in which they do not depend on the sizes of the C data types and that is 797built for a 64-bit environment in which 798.Dv long 799is 8 bytes rather than 4 bytes, presumably the validation suite does not 800test whether, for example 801.Dv long 802refers to an item with the same size as the C data type 803.Dv long . 804There should probably be 805.Dv type 806names 807.Dv int8 , 808.Dv uint8 , 809.Dv int16 , 810.Dv uint16 , 811.Dv int32 , 812.Dv uint32 , 813.Dv int64 , 814and 815.Dv uint64 , 816and specified-byte-order variants of them, 817to make it clearer that those types have specified widths. 818.\" 819.\" From: guy@sun.uucp (Guy Harris) 820.\" Newsgroups: net.bugs.usg 821.\" Subject: /etc/magic's format isn't well documented 822.\" Message-ID: <2752@sun.uucp> 823.\" Date: 3 Sep 85 08:19:07 GMT 824.\" Organization: Sun Microsystems, Inc. 825.\" Lines: 136 826.\" 827.\" Here's a manual page for the format accepted by the "file" made by adding 828.\" the changes I posted to the S5R2 version. 829.\" 830.\" Modified for Ian Darwin's version of the file command. 831