1 2#------------------------------------------------------------ 3# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $ 4# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 5# same magic number, 0xcafebabe, so they are both handled 6# in the entry called "cafebabe". 7#------------------------------------------------------------ 8# Java serialization 9# From Martin Pool (m.pool@pharos.com.au) 100 beshort 0xaced Java serialization data 11>2 beshort >0x0004 \b, version %d 12 130 belong 0xfeedfeed Java KeyStore 14!:mime application/x-java-keystore 150 belong 0xcececece Java JCE KeyStore 16!:mime application/x-java-jce-keystore 17 18# Java source 190 regex \^import.*;$ Java source 20!:mime text/x-java 21 22# Java HPROF dumps 23# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 240 string JAVA\x20PROFILE\x201.0. 25>0x12 byte 0 26>>0x11 ubyte-0x31 <2 Java HPROF dump, 27>>>0x17 beqdate/1000 x created %s 28 29# Java jmod module 30# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java 31# Grr. 2 byte magic "JM", really? In 2019? 320 belong 0x4a4d0100 Java jmod module version 1.0 33!:mime application/x-java-jmod 34 35# Java jlinked image 36# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp 370 belong 0xcafedada Java module image (big endian) 38>4 beshort >0x00 \b, version %d 39>6 beshort x \b.%d 40!:mime application/x-java-image 41 420 lelong 0xcafedada Java module image (little endian) 43>6 leshort >0x00 \b, version %d 44>4 leshort x \b.%d 45!:mime application/x-java-image 46