1b6cee71dSXin LI 2b6cee71dSXin LI#------------------------------------------------------------ 3*898496eeSXin LI# $File: java,v 1.22 2023/01/11 23:59:49 christos Exp $ 4b6cee71dSXin LI# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 5b6cee71dSXin LI# same magic number, 0xcafebabe, so they are both handled 6b6cee71dSXin LI# in the entry called "cafebabe". 7b6cee71dSXin LI#------------------------------------------------------------ 8b6cee71dSXin LI# Java serialization 9b6cee71dSXin LI# From Martin Pool (m.pool@pharos.com.au) 10b6cee71dSXin LI0 beshort 0xaced Java serialization data 11b6cee71dSXin LI>2 beshort >0x0004 \b, version %d 12b6cee71dSXin LI 13b6cee71dSXin LI0 belong 0xfeedfeed Java KeyStore 14b6cee71dSXin LI!:mime application/x-java-keystore 15b6cee71dSXin LI0 belong 0xcececece Java JCE KeyStore 16b6cee71dSXin LI!:mime application/x-java-jce-keystore 17b6cee71dSXin LI 18b6cee71dSXin LI# Java source 193e41d09dSXin LI0 regex \^import.*;$ Java source 20b6cee71dSXin LI!:mime text/x-java 213e41d09dSXin LI 223e41d09dSXin LI# Java HPROF dumps 233e41d09dSXin LI# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 243e41d09dSXin LI0 string JAVA\x20PROFILE\x201.0. 2548c779cdSXin LI>0x12 byte 0 2648c779cdSXin LI>>0x11 ubyte-0x31 <2 Java HPROF dump, 2748c779cdSXin LI>>>0x17 beqdate/1000 x created %s 2848c779cdSXin LI 2948c779cdSXin LI# Java jmod module 3048c779cdSXin LI# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java 3148c779cdSXin LI# Grr. 2 byte magic "JM", really? In 2019? 3248c779cdSXin LI0 belong 0x4a4d0100 Java jmod module version 1.0 3348c779cdSXin LI!:mime application/x-java-jmod 3448c779cdSXin LI 3548c779cdSXin LI# Java jlinked image 3648c779cdSXin LI# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp 3748c779cdSXin LI0 belong 0xcafedada Java module image (big endian) 3848c779cdSXin LI>4 beshort >0x00 \b, version %d 3948c779cdSXin LI>6 beshort x \b.%d 4048c779cdSXin LI!:mime application/x-java-image 4148c779cdSXin LI 4248c779cdSXin LI0 lelong 0xcafedada Java module image (little endian) 4348c779cdSXin LI>6 leshort >0x00 \b, version %d 4448c779cdSXin LI>4 leshort x \b.%d 4548c779cdSXin LI!:mime application/x-java-image 46*898496eeSXin LI 47*898496eeSXin LI# JAR Manifest & Signature File 48*898496eeSXin LI# Reference: https://docs.oracle.com/javase/8/docs/technotes/guides/jar/jar.html 49*898496eeSXin LI0 string/t Manifest-Version:\x201.0 JAR Manifest 50*898496eeSXin LI!:ext MF 51*898496eeSXin LI0 string/t Signature-Version:\x201.0 JAR Signature File 52*898496eeSXin LI!:ext SF 53