xref: /freebsd/contrib/file/magic/Magdir/coff (revision 5ca8e32633c4ffbbcd6762e5888b6a4ba0708c6c)
1
2#------------------------------------------------------------------------------
3# $File: coff,v 1.7 2022/11/21 22:30:22 christos Exp $
4# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
5#
6# COFF
7#
8# by Joerg Jenderek at Oct 2015, Feb 2021
9# https://en.wikipedia.org/wiki/COFF
10# https://de.wikipedia.org/wiki/Common_Object_File_Format
11# http://www.delorie.com/djgpp/doc/coff/filhdr.html
12
13# display name+variables+flags of Common Object Files Format (32bit)
14# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
15# mips,motorola,msdos,osf1,sharc,varied.out,vax
160	name				display-coff
17# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
18>18	uleshort&0x8E80	0
19# skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections
20>>2	uleshort	>0
21# skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections
22>>>2	uleshort	<4207
23>>>>0	clear		x
24# f_magic - magic number
25# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
26>>>>0	uleshort	0x014C		Intel 80386
27# Hitachi SH big-endian COFF (./hitachi-sh)
28>>>>0	uleshort	0x0500		Hitachi SH big-endian
29# Hitachi SH little-endian COFF (./hitachi-sh)
30>>>>0	uleshort	0x0550		Hitachi SH little-endian
31# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
32#>>>>0	uleshort	0x01DF
33# MS Windows COFF Intel Itanium, AMD64
34# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx
35>>>>0	uleshort	0x0200		Intel ia64
36>>>>0	uleshort	0x8664		Intel amd64
37# ARM COFF (./arm)
38>>>>0	uleshort	0xaa64		Aarch64
39>>>>0	uleshort	0x01c0		ARM
40>>>>0	uleshort	0xa641		ARM64EC
41>>>>0	uleshort	0x01c2		ARM Thumb
42>>>>0	uleshort	0x01c4		ARMv7 Thumb
43# TODO for other COFFs
44#>>>>0	uleshort	0xABCD		COFF_TEMPLATE
45>>>>0	default		x
46>>>>>0	uleshort	x		type %#04x
47>>>>0	uleshort	x		COFF
48# F_EXEC flag bit
49>>>>18	leshort		^0x0002		object file
50!:mime	application/x-coff
51!:ext	o/obj/lib
52# no cof sample found
53#!:ext	cof/o/obj/lib
54>>>>18	leshort		&0x0002		executable
55#!:mime	application/x-coffexec
56# F_RELFLG flag bit,static object
57>>>>18	leshort		&0x0001		\b, no relocation info
58# F_LNNO flag bit
59>>>>18	leshort		&0x0004		\b, no line number info
60# F_LSYMS flag bit
61>>>>18	leshort		&0x0008		\b, stripped
62>>>>18	leshort		^0x0008		\b, not stripped
63# flags in other COFF versions
64#0x0010    F_FDPR_PROF
65#0x0020    F_FDPR_OPTI
66#0x0040    F_DSA
67# F_AR32WR flag bit
68#>>>>18	leshort		&0x0100		\b, 32 bit little endian
69#0x1000    F_DYNLOAD
70#0x2000    F_SHROBJ
71#0x4000    F_LOADONLY
72# f_nscns - number of sections like: 1 2 3 4 5 7 8 9 11 12 15 16 19 20 21 22 26 30 36 40 42 56 80 89 96 124
73>>>>2	uleshort	<2		\b, %u section
74>>>>2	uleshort	>1		\b, %u sections
75# f_symptr - symbol table pointer, only for not stripped
76# like: 0 0x7c 0xf4 0x104 0x182 0x1c2 0x1c6 0x468 0x948 0x416e 0x149a6 0x1c9d8 0x23a68 0x35120 0x7afa0
77>>>>8	ulelong		>0		\b, symbol offset=%#x
78# f_nsyms - number of symbols, only for not stripped
79# like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546
80>>>>12	ulelong		>0		\b, %d symbols
81# f_opthdr - optional header size. An object file should have a value of 0
82>>>>16	uleshort	>0		\b, optional header size %u
83# f_timdat - file time & date stamp only for little endian
84>>>>4	ledate		>0		\b, created %s
85# at offset 20 can be optional header, extra bytes FILHSZ-20 because
86# do not rely on sizeof(FILHDR) to give the correct size for header.
87# or first section header
88# additional variables for other COFF files
89>>>>16	uleshort	=0
90# first section name s_name[8] like: .text .data .debug$S .drectve .testseg
91>>>>>20	string		x		\b, 1st section name "%.8s"
92# >20	beshort		0407		(impure)
93# >20	beshort		0410		(pure)
94# >20	beshort		0413		(demand paged)
95# >20	beshort		0421		(standalone)
96# >22	leshort		>0		- version %d
97# >168	string		.lowmem		Apple toolbox
98
99