1b6cee71dSXin LI 2b6cee71dSXin LI#------------------------------------------------------------ 3*48c779cdSXin LI# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $ 4b6cee71dSXin LI# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 5b6cee71dSXin LI# same magic number, 0xcafebabe, so they are both handled 6b6cee71dSXin LI# in the entry called "cafebabe". 7b6cee71dSXin LI#------------------------------------------------------------ 8b6cee71dSXin LI# Java serialization 9b6cee71dSXin LI# From Martin Pool (m.pool@pharos.com.au) 10b6cee71dSXin LI0 beshort 0xaced Java serialization data 11b6cee71dSXin LI>2 beshort >0x0004 \b, version %d 12b6cee71dSXin LI 13b6cee71dSXin LI0 belong 0xfeedfeed Java KeyStore 14b6cee71dSXin LI!:mime application/x-java-keystore 15b6cee71dSXin LI0 belong 0xcececece Java JCE KeyStore 16b6cee71dSXin LI!:mime application/x-java-jce-keystore 17b6cee71dSXin LI 18b6cee71dSXin LI# Java source 193e41d09dSXin LI0 regex \^import.*;$ Java source 20b6cee71dSXin LI!:mime text/x-java 213e41d09dSXin LI 223e41d09dSXin LI# Java HPROF dumps 233e41d09dSXin LI# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 243e41d09dSXin LI0 string JAVA\x20PROFILE\x201.0. 25*48c779cdSXin LI>0x12 byte 0 26*48c779cdSXin LI>>0x11 ubyte-0x31 <2 Java HPROF dump, 27*48c779cdSXin LI>>>0x17 beqdate/1000 x created %s 28*48c779cdSXin LI 29*48c779cdSXin LI# Java jmod module 30*48c779cdSXin LI# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java 31*48c779cdSXin LI# Grr. 2 byte magic "JM", really? In 2019? 32*48c779cdSXin LI0 belong 0x4a4d0100 Java jmod module version 1.0 33*48c779cdSXin LI!:mime application/x-java-jmod 34*48c779cdSXin LI 35*48c779cdSXin LI# Java jlinked image 36*48c779cdSXin LI# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp 37*48c779cdSXin LI0 belong 0xcafedada Java module image (big endian) 38*48c779cdSXin LI>4 beshort >0x00 \b, version %d 39*48c779cdSXin LI>6 beshort x \b.%d 40*48c779cdSXin LI!:mime application/x-java-image 41*48c779cdSXin LI 42*48c779cdSXin LI0 lelong 0xcafedada Java module image (little endian) 43*48c779cdSXin LI>6 leshort >0x00 \b, version %d 44*48c779cdSXin LI>4 leshort x \b.%d 45*48c779cdSXin LI!:mime application/x-java-image 46