1 2#------------------------------------------------------------------------------ 3# $File: database,v 1.59 2020/03/25 01:49:58 christos Exp $ 4# database: file(1) magic for various databases 5# 6# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk) 7# 8# 9# GDBM magic numbers 10# Will be maintained as part of the GDBM distribution in the future. 11# <downsj@teeny.org> 120 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit 13!:mime application/x-gdbm 140 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old 15!:mime application/x-gdbm 160 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit 17!:mime application/x-gdbm 180 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit 19!:mime application/x-gdbm 200 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old 21!:mime application/x-gdbm 220 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit 23!:mime application/x-gdbm 240 string GDBM GNU dbm 2.x database 25!:mime application/x-gdbm 26# 27# Berkeley DB 28# 29# Ian Darwin's file /etc/magic files: big/little-endian version. 30# 31# Hash 1.85/1.86 databases store metadata in network byte order. 32# Btree 1.85/1.86 databases store the metadata in host byte order. 33# Hash and Btree 2.X and later databases store the metadata in host byte order. 34 350 long 0x00061561 Berkeley DB 36!:mime application/x-dbm 37>8 belong 4321 38>>4 belong >2 1.86 39>>4 belong <3 1.85 40>>4 belong >0 (Hash, version %d, native byte-order) 41>8 belong 1234 42>>4 belong >2 1.86 43>>4 belong <3 1.85 44>>4 belong >0 (Hash, version %d, little-endian) 45 460 belong 0x00061561 Berkeley DB 47>8 belong 4321 48>>4 belong >2 1.86 49>>4 belong <3 1.85 50>>4 belong >0 (Hash, version %d, big-endian) 51>8 belong 1234 52>>4 belong >2 1.86 53>>4 belong <3 1.85 54>>4 belong >0 (Hash, version %d, native byte-order) 55 560 long 0x00053162 Berkeley DB 1.85/1.86 57>4 long >0 (Btree, version %d, native byte-order) 580 belong 0x00053162 Berkeley DB 1.85/1.86 59>4 belong >0 (Btree, version %d, big-endian) 600 lelong 0x00053162 Berkeley DB 1.85/1.86 61>4 lelong >0 (Btree, version %d, little-endian) 62 6312 long 0x00061561 Berkeley DB 64>16 long >0 (Hash, version %d, native byte-order) 6512 belong 0x00061561 Berkeley DB 66>16 belong >0 (Hash, version %d, big-endian) 6712 lelong 0x00061561 Berkeley DB 68>16 lelong >0 (Hash, version %d, little-endian) 69 7012 long 0x00053162 Berkeley DB 71>16 long >0 (Btree, version %d, native byte-order) 7212 belong 0x00053162 Berkeley DB 73>16 belong >0 (Btree, version %d, big-endian) 7412 lelong 0x00053162 Berkeley DB 75>16 lelong >0 (Btree, version %d, little-endian) 76 7712 long 0x00042253 Berkeley DB 78>16 long >0 (Queue, version %d, native byte-order) 7912 belong 0x00042253 Berkeley DB 80>16 belong >0 (Queue, version %d, big-endian) 8112 lelong 0x00042253 Berkeley DB 82>16 lelong >0 (Queue, version %d, little-endian) 83 84# From Max Bowsher. 8512 long 0x00040988 Berkeley DB 86>16 long >0 (Log, version %d, native byte-order) 8712 belong 0x00040988 Berkeley DB 88>16 belong >0 (Log, version %d, big-endian) 8912 lelong 0x00040988 Berkeley DB 90>16 lelong >0 (Log, version %d, little-endian) 91 92# 93# 94# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch> 950 string/b RRD\0 RRDTool DB 96>4 string/b x version %s 97 98>>10 short !0 16bit aligned 99>>>10 bedouble 8.642135e+130 big-endian 100>>>>18 short x 32bit long (m68k) 101 102>>10 short 0 103>>>12 long !0 32bit aligned 104>>>>12 bedouble 8.642135e+130 big-endian 105>>>>>20 long 0 64bit long 106>>>>>20 long !0 32bit long 107>>>>12 ledouble 8.642135e+130 little-endian 108>>>>>24 long 0 64bit long 109>>>>>24 long !0 32bit long (i386) 110>>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian 111>>>>>24 short !0 32bit long (arm) 112 113>>8 quad 0 64bit aligned 114>>>16 bedouble 8.642135e+130 big-endian 115>>>>24 long 0 64bit long (s390x) 116>>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC) 117>>>16 ledouble 8.642135e+130 little-endian 118>>>>28 long 0 64bit long (alpha/amd64/ia64) 119>>>>28 long !0 32bit long (armel/mipsel) 120 121#---------------------------------------------------------------------- 122# ROOT: file(1) magic for ROOT databases 123# 1240 string root\0 ROOT file 125>4 belong x Version %d 126>33 belong x (Compression: %d) 127 128# XXX: Weak magic. 129# Alex Ott <ott@jet.msk.su> 130## Paradox file formats 131#2 leshort 0x0800 Paradox 132#>0x39 byte 3 v. 3.0 133#>0x39 byte 4 v. 3.5 134#>0x39 byte 9 v. 4.x 135#>0x39 byte 10 v. 5.x 136#>0x39 byte 11 v. 5.x 137#>0x39 byte 12 v. 7.x 138#>>0x04 byte 0 indexed .DB data file 139#>>0x04 byte 1 primary index .PX file 140#>>0x04 byte 2 non-indexed .DB data file 141#>>0x04 byte 3 non-incrementing secondary index .Xnn file 142#>>0x04 byte 4 secondary index .Ynn file 143#>>0x04 byte 5 incrementing secondary index .Xnn file 144#>>0x04 byte 6 non-incrementing secondary index .XGn file 145#>>0x04 byte 7 secondary index .YGn file 146#>>>0x04 byte 8 incrementing secondary index .XGn file 147 148## XBase database files 149# updated by Joerg Jenderek at Feb 2013 150# https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm 151# https://www.clicketyclick.dk/databases/xbase/format/dbf.html 152# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 1530 ubelong&0x0000FFFF <0x00000C20 154# skip Infocom game Z-machine 155>2 ubyte >0 156# skip Androids *.xml 157>>3 ubyte >0 158>>>3 ubyte <32 159# 1 < version VV 160>>>>0 ubyte >1 161# skip HELP.CA3 by test for reserved byte ( NULL ) 162>>>>>27 ubyte 0 163# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF) 164#>>>>>30 ubeshort x 30NULL?%x 165# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 166>>>>>>24 ubelong&0xffFFFFff >0x01302000 167# .DBF or .MDX 168>>>>>>24 ubelong&0xffFFFFff <0x01302001 169# for Xbase Database file (*.DBF) reserved (NULL) for multi-user 170>>>>>>>24 ubelong&0xffFFFFff =0 171# test for 2 reserved NULL bytes,transaction and encryption byte flag 172>>>>>>>>12 ubelong&0xFFFFfEfE 0 173# test for MDX flag 174>>>>>>>>>28 ubyte x 175>>>>>>>>>28 ubyte&0xf8 0 176# header size >= 32 177>>>>>>>>>>8 uleshort >31 178# skip PIC15736.PCX by test for language driver name or field name 179>>>>>>>>>>>32 ubyte >0 180#!:mime application/x-dbf; charset=unknown-8bit ?? 181#!:mime application/x-dbase 182>>>>>>>>>>>>0 use xbase-type 183# database file 184>>>>>>>>>>>>0 ubyte x \b DBF 185>>>>>>>>>>>>4 lelong 0 \b, no records 186>>>>>>>>>>>>4 lelong >0 \b, %d record 187# plural s appended 188>>>>>>>>>>>>>4 lelong >1 \bs 189# https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF 190# 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000) 191>>>>>>>>>>>>10 uleshort x * %d 192# file size = records * record size + header size 193>>>>>>>>>>>>1 ubyte x \b, update-date 194>>>>>>>>>>>>1 use xbase-date 195# https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx 196#>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x 197# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ? 198>>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x 199#>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file 200>>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX 201>>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT 202>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer 203# 1st record offset + 1 = header size 204>>>>>>>>>>>>8 uleshort >0 205>>>>>>>>>>>>(8.s+1) ubyte >0 206>>>>>>>>>>>>>8 uleshort >0 \b, at offset %d 207>>>>>>>>>>>>>(8.s+1) ubyte >0 208>>>>>>>>>>>>>>&-1 string >\0 1st record "%s" 209# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 210>>>>>>>24 ubelong&0x0133f7ff >0 211# test for reserved NULL byte 212>>>>>>>>47 ubyte 0 213# test for valid TAG key format (0x10 or 0) 214>>>>>>>>>559 ubyte&0xeF 0 215# test MM <= 12 216>>>>>>>>>>45 ubeshort <0x0C20 217>>>>>>>>>>>45 ubyte >0 218>>>>>>>>>>>>46 ubyte <32 219>>>>>>>>>>>>>46 ubyte >0 220#!:mime application/x-mdx 221>>>>>>>>>>>>>>0 use xbase-type 222>>>>>>>>>>>>>>0 ubyte x \b MDX 223>>>>>>>>>>>>>>1 ubyte x \b, creation-date 224>>>>>>>>>>>>>>1 use xbase-date 225>>>>>>>>>>>>>>44 ubyte x \b, update-date 226>>>>>>>>>>>>>>44 use xbase-date 227# No.of tags in use (1,2,5,12) 228>>>>>>>>>>>>>>28 uleshort x \b, %d 229# No. of entries in tag (0x30) 230>>>>>>>>>>>>>>25 ubyte x \b/%d tags 231# Length of tag 232>>>>>>>>>>>>>>26 ubyte x * %d 233# 1st tag name_ 234>>>>>>>>>>>>>548 string x \b, 1st tag "%.11s" 235# 2nd tag name 236#>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s" 237# 238# Print the xBase names of different version variants 2390 name xbase-type 240>0 ubyte <2 241# 1 < version 242>0 ubyte >1 243>>0 ubyte 0x02 FoxBase 244# FoxBase+/dBaseIII+, no memo 245>>0 ubyte 0x03 FoxBase+/dBase III 246!:mime application/x-dbf 247# dBASE IV no memo file 248>>0 ubyte 0x04 dBase IV 249!:mime application/x-dbf 250# dBASE V no memo file 251>>0 ubyte 0x05 dBase V 252!:mime application/x-dbf 253>>0 ubyte 0x30 Visual FoxPro 254!:mime application/x-dbf 255>>0 ubyte 0x31 Visual FoxPro, autoincrement 256!:mime application/x-dbf 257# Visual FoxPro, with field type Varchar or Varbinary 258>>0 ubyte 0x32 Visual FoxPro, with field type Varchar 259!:mime application/x-dbf 260# dBASE IV SQL, no memo;dbv memo var size (Flagship) 261>>0 ubyte 0x43 dBase IV, with SQL table 262!:mime application/x-dbf 263# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 264#>>0 ubyte 0x62 dBase IV, with SQL table 265#!:mime application/x-dbf 266# dBASE IV, with memo!! 267>>0 ubyte 0x7b dBase IV, with memo 268!:mime application/x-dbf 269# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 270#>>0 ubyte 0x82 dBase IV, with SQL system 271#!:mime application/x-dbf 272# FoxBase+/dBaseIII+ with memo .DBT! 273>>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT 274!:mime application/x-dbf 275# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file 276>>0 ubyte 0x87 VISUAL OBJECTS, with memo file 277!:mime application/x-dbf 278# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 279#>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT 280#!:mime application/x-dbf 281# dBASE IV with memo! 282>>0 ubyte 0x8B dBase IV, with memo .DBT 283!:mime application/x-dbf 284# dBase IV with SQL Table,no memo? 285>>0 ubyte 0x8E dBase IV, with SQL table 286!:mime application/x-dbf 287# .dbv and .dbt memo (Flagship)? 288>>0 ubyte 0xB3 Flagship 289# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 290#>>0 ubyte 0xCA dBase IV with memo .DBT 291#!:mime application/x-dbf 292# dBASE IV with SQL table, with memo .DBT 293>>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT 294!:mime application/x-dbf 295# HiPer-Six format;Clipper SIX, with SMT memo file 296>>0 ubyte 0xE5 Clipper SIX with memo 297!:mime application/x-dbf 298# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 299#>>0 ubyte 0xF4 dBase IV, with SQL table, with memo 300#!:mime application/x-dbf 301>>0 ubyte 0xF5 FoxPro with memo 302!:mime application/x-dbf 303# https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx 304#>>0 ubyte 0xFA FoxPro 2.x, with memo 305#!:mime application/x-dbf 306# unknown version (should not happen) 307>>0 default x xBase 308!:mime application/x-dbf 309>>>0 ubyte x (0x%x) 310# flags in version byte 311# DBT flag (with dBASE III memo .DBT)!! 312# >>0 ubyte&0x80 >0 DBT_FLAG=%x 313# memo flag ?? 314# >>0 ubyte&0x08 >0 MEMO_FLAG=%x 315# SQL flag ?? 316# >>0 ubyte&0x70 >0 SQL_FLAG=%x 317# test and print the date of xBase .DBF .MDX 3180 name xbase-date 319# inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31 320>0 ubelong x 321>1 ubyte <13 322>>1 ubyte >0 323>>>2 ubyte >0 324>>>>2 ubyte <32 325>>>>>0 ubyte x 326# YY is interpreted as 20YY or 19YY 327>>>>>>0 ubyte <100 \b %.2d 328# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY 329>>>>>>0 ubyte >99 \b %d 330>>>>>1 ubyte x \b-%d 331>>>>>2 ubyte x \b-%d 332 333# dBase memo files .DBT or .FPT 334# https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx 33516 ubyte <4 336>16 ubyte !2 337>>16 ubyte !1 338# next free block index is positive 339>>>0 ulelong >0 340# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size 341>>>>17 ubelong&0xFFfdFEff 0x00000000 342# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h 343>>>>>20 ubelong&0xFF01209B 0x00000000 344# dBASE III 345>>>>>>16 ubyte 3 346# dBASE III DBT 347>>>>>>>0 use dbase3-memo-print 348# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage 349>>>>>>16 ubyte 0 350# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF 351>>>>>>>20 uleshort 0 352# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage 353>>>>>>>>8 ulong =0 354>>>>>>>>>6 ubeshort >0 355# skip emacs.PIF 356>>>>>>>>>>4 ushort 0 357# check for valid FoxPro field type 358>>>>>>>>>>>512 ubelong <3 359>>>>>>>>>>>>0 use foxpro-memo-print 360# dBASE III DBT , garbage 361# skip WORD1XW.DOC with improbably high free block index 362>>>>>>>>>0 ulelong <0x400000 363# skip WinStore.App.exe by looking for printable 2nd character of 1st memo item 364>>>>>>>>>>513 ubyte >037 365# unusual dBASE III DBT like adressen.dbt 366>>>>>>>>>>>0 use dbase3-memo-print 367# dBASE III DBT like angest.dbt, or garbage PCX DBF 368>>>>>>>>8 ubelong !0 369# skip PCX and some DBF by test for for reserved NULL bytes 370>>>>>>>>>510 ubeshort 0 371# skip bad symples with improbably high free block index above 2 GiB file limit 372>>>>>>>>>>0 ulelong <0x400000 373# skip AI070GEP.EPS by printable 1st character of 1st memo item 374>>>>>>>>>>>512 ubyte >037 375# skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character 376>>>>>>>>>>>>513 ubyte >037 377>>>>>>>>>>>>>0 use dbase3-memo-print 378# dBASE IV DBT with positive block size 379>>>>>>>20 uleshort >0 380# dBASE IV DBT with valid block length like 512, 1024 381# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero 382# skip also 3600h 3E00h size 383>>>>>>>>20 uleshort&0xE00f 0 384>>>>>>>>>0 use dbase4-memo-print 385 386# Print the information of dBase III DBT memo file 3870 name dbase3-memo-print 388>0 ubyte x dBase III DBT 389!:mime application/x-dbt 390!:ext dbt 391# instead 3 as version number 0 for unusual examples like biblio.dbt 392>16 ubyte !3 \b, version number %u 393# Number of next available block for appending data 394#>0 lelong =0 \b, next free block index %u 395>0 lelong !0 \b, next free block index %u 396# no positiv block length 397#>20 uleshort =0 \b, block length %u 398>20 uleshort !0 \b, block length %u 399# dBase III memo field terminated by \032\032 400>512 string >\0 \b, 1st item "%s" 401# https://www.clicketyclick.dk/databases/xbase/format/dbt.html 402# Print the information of dBase IV DBT memo file 4030 name dbase4-memo-print 404>0 lelong x dBase IV DBT 405!:mime application/x-dbt 406!:ext dbt 407# 8 character shorted main name of coresponding dBASE IV DBF file 408>8 ubelong >0x20000000 409# skip unusual like for angest.dbt 410>>20 uleshort >0 411>>>8 string >\0 \b of %-.8s.DBF 412# value 0 implies 512 as size 413#>4 ulelong =0 \b, blocks size %u 414# size of blocks not reliable like 0x2020204C in angest.dbt 415>4 ulelong !0 416>>4 ulelong&0x0000003f 0 \b, blocks size %u 417# dBase IV DBT with positive block length (found 512 , 1024) 418>20 uleshort >0 \b, block length %u 419# next available block 420#>0 lelong =0 \b, next free block index %u 421>0 lelong !0 \b, next free block index %u 422>20 uleshort >0 423>>(20.s) ubelong x 424>>>&-4 use dbase4-memofield-print 425# unusual dBase IV DBT without block length (implies 512 as length) 426>20 uleshort =0 427>>512 ubelong x 428>>>&-4 use dbase4-memofield-print 429# Print the information of dBase IV memo field 4300 name dbase4-memofield-print 431# free dBase IV memo field 432>0 ubelong !0xFFFF0800 433>>0 lelong x \b, next free block %u 434>>4 lelong x \b, next used block %u 435# used dBase IV memo field 436>0 ubelong =0xFFFF0800 437# length of memo field 438>>4 lelong x \b, field length %d 439>>>8 string >\0 \b, 1st used item "%s" 440# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm 441# Print the information of FoxPro FPT memo file 4420 name foxpro-memo-print 443>0 belong x FoxPro FPT 444!:mime application/x-fpt 445!:ext fpt 446# Size of blocks for FoxPro ( 64,256 ) 447>6 ubeshort x \b, blocks size %u 448# next available block 449#>0 belong =0 \b, next free block index %u 450>0 belong !0 \b, next free block index %u 451# field type ( 0~picture, 1~memo, 2~object ) 452>512 ubelong <3 \b, field type %u 453# length of memo field 454>512 ubelong 1 455>>516 belong >0 \b, field length %d 456>>>520 string >\0 \b, 1st item "%s" 457 458# TODO: 459# DBASE index file *.NDX 460# DBASE Compound Index file *.CDX 461# dBASE IV Printer Driver *.PRF 462## End of XBase database stuff 463 464# MS Access database 4654 string Standard\ Jet\ DB Microsoft Access Database 466!:mime application/x-msaccess 4674 string Standard\ ACE\ DB Microsoft Access Database 468!:mime application/x-msaccess 469 470# From: Joerg Jenderek 471# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine 472# Reference: https://github.com/libyal/libesedb/archive/master.zip 473# libesedb-master/documentation/ 474# Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc 475# Note: also known as "JET Blue". Used by numerous Windows components such as 476# Windows Search, Mail, Exchange and Active Directory. 4774 ubelong 0xefcdab89 478# unknown1 479>132 ubelong 0 Extensible storage engine 480!:mime application/x-ms-ese 481# file_type 0~database 1~stream 482>>12 ulelong 0 DataBase 483# Security DataBase (sdb) 484!:ext edb/sdb 485>>12 ulelong 1 STreaMing 486!:ext stm 487# format_version 620h 488>>8 uleshort x \b, version 0x%x 489>>10 uleshort >0 revision 0x%4.4x 490>>0 ubelong x \b, checksum 0x%8.8x 491# Page size 4096 8192 32768 492>>236 ulequad x \b, page size %lld 493# database_state 494>>52 ulelong 1 \b, JustCreated 495>>52 ulelong 2 \b, DirtyShutdown 496#>>52 ulelong 3 \b, CleanShutdown 497>>52 ulelong 4 \b, BeingConverted 498>>52 ulelong 5 \b, ForceDetach 499# Windows NT major version when the databases indexes were updated. 500>>216 ulelong x \b, Windows version %d 501# Windows NT minor version 502>>220 ulelong x \b.%d 503 504# From: Joerg Jenderek 505# URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility 506# Note: files contain application compatibility fixes, application compatibility modes and application help messages. 5078 string sdbf 508>7 ubyte 0 509# TAG_TYPE_LIST+TAG_INDEXES 510>>12 uleshort 0x7802 Windows application compatibility Shim DataBase 511# version? 2 3 512#>>>0 ulelong x \b, version %d 513!:mime application/x-ms-sdb 514!:ext sdb 515 516# TDB database from Samba et al - Martin Pool <mbp@samba.org> 5170 string TDB\ file TDB database 518>32 lelong 0x2601196D version 6, little-endian 519>>36 lelong x hash size %d bytes 520 521# SE Linux policy database 5220 lelong 0xf97cff8c SE Linux policy 523>16 lelong x v%d 524>20 lelong 1 MLS 525>24 lelong x %d symbols 526>28 lelong x %d ocons 527 528# ICE authority file data (Wolfram Kleff) 5292 string ICE ICE authority data 530 531# X11 Xauthority file (Wolfram Kleff) 53210 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 53311 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 53412 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 53513 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 53614 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 53715 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 53816 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 53917 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 54018 string MIT-MAGIC-COOKIE-1 X11 Xauthority data 541 542# From: Maxime Henrion <mux@FreeBSD.org> 543# PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org> 5440 string PGDMP PostgreSQL custom database dump 545>5 byte x - v%d 546>6 byte x \b.%d 547>5 beshort <0x101 \b-0 548>5 beshort >0x100 549>>7 byte x \b-%d 550 551# Type: Advanced Data Format (ADF) database 552# URL: https://www.grc.nasa.gov/WWW/cgns/adf/ 553# From: Nicolas Chauvat <nicolas.chauvat@logilab.fr> 5540 string @(#)ADF\ Database CGNS Advanced Data Format 555 556# Tokyo Cabinet magic data 557# http://tokyocabinet.sourceforge.net/index.html 5580 string ToKyO\ CaBiNeT\n Tokyo Cabinet 559>14 string x \b (%s) 560>32 byte 0 \b, Hash 561!:mime application/x-tokyocabinet-hash 562>32 byte 1 \b, B+ tree 563!:mime application/x-tokyocabinet-btree 564>32 byte 2 \b, Fixed-length 565!:mime application/x-tokyocabinet-fixed 566>32 byte 3 \b, Table 567!:mime application/x-tokyocabinet-table 568>33 byte &1 \b, [open] 569>33 byte &2 \b, [fatal] 570>34 byte x \b, apow=%d 571>35 byte x \b, fpow=%d 572>36 byte &0x01 \b, [large] 573>36 byte &0x02 \b, [deflate] 574>36 byte &0x04 \b, [bzip] 575>36 byte &0x08 \b, [tcbs] 576>36 byte &0x10 \b, [excodec] 577>40 lequad x \b, bnum=%lld 578>48 lequad x \b, rnum=%lld 579>56 lequad x \b, fsiz=%lld 580 581# Type: QDBM Quick Database Manager 582# From: Benoit Sibaud <bsibaud@april.org> 5830 string \\[depot\\]\n\f Quick Database Manager, little endian 5840 string \\[DEPOT\\]\n\f Quick Database Manager, big endian 585 586# Type: TokyoCabinet database 587# URL: http://tokyocabinet.sourceforge.net/ 588# From: Benoit Sibaud <bsibaud@april.org> 5890 string ToKyO\ CaBiNeT\n TokyoCabinet database 590>14 string x (version %s) 591 592# From: Stephane Blondon https://www.yaal.fr 593# Database file for Zope (done by FileStorage) 5940 string FS21 Zope Object Database File Storage v3 (data) 5950 string FS30 Zope Object Database File Storage v4 (data) 596 597# Cache file for the database of Zope (done by ClientStorage) 5980 string ZEC3 Zope Object Database Client Cache File (data) 599 600# IDA (Interactive Disassembler) database 6010 string IDA1 IDA (Interactive Disassembler) database 602 603# Hopper (reverse engineering tool) https://www.hopperapp.com/ 6040 string hopperdb Hopper database 605 606# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine) 607# Reference: http://www.provue.com/Panorama/ 608# From: Joerg Jenderek 609# NOTE: test only versions 4 and 6.0 with Windows 610# length of Panorama database name 6115 ubyte >0 612# look after database name for "some" null bits 613>(5.B+7) ubelong&0xF3ffF000 0 614# look for first keyword 615>>&1 search/2 DESIGN Panorama database 616#!:mime application/x-panorama-database 617!:apple KASXZEPD 618!:ext pan 619# database name 620>>>5 pstring x \b, "%s" 621 622# 623# 624# askSam Database by Stefan A. Haubenthal <polluks@web.de> 6250 string askw40\0 askSam DB 626 627# 628# 629# MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de> 6300 string MBSTV\040 MUIbase DB 631>6 string x version %s 632 633# 634# CDB database 6350 string NBCDB\012 NetBSD Constant Database 636>7 byte x \b, version %d 637>8 string x \b, for '%s' 638>24 lelong x \b, datasize %d 639>28 lelong x \b, entries %d 640>32 lelong x \b, index %d 641>36 lelong x \b, seed %#x 642 643# 644# Redis RDB - https://redis.io/topics/persistence 6450 string REDIS Redis RDB file, 646>5 regex [0-9][0-9][0-9][0-9] version %s 647 648# Mork database. 649# Used by older versions of Mozilla Suite and Firefox, 650# and current versions of Thunderbird. 651# From: David Korth <gerbilsoft@gerbilsoft.com> 6520 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database 653>23 string x \b, version %.3s 654 655# URL: https://en.wikipedia.org/wiki/Management_Information_Format 656# Reference: https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf 657# From: Joerg Jenderek 658# Note: only tested with monitor asset reports of Dell Display Manager 659# skip start like Language=fr|CA|iso8859-1 6600 search/27/C Start\040Component DMI Management Information Format 661#!:mime text/plain 662!:mime text/x-dmtf-mif 663!:ext mif 664 665