1 2#------------------------------------------------------------------------------ 3# $File: msvc,v 1.12 2024/03/31 15:08:13 christos Exp $ 4# msvc: file(1) magic for msvc 5# "H. Nanosecond" <aldomel@ix.netcom.com> 6# Microsoft visual C 7# 8# I have version 1.0 9 10# .aps 110 string HWB\000\377\001\000\000\000 Microsoft Visual C .APS file 12 13# .ide 14#too long 0 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316 MSVC .ide 150 string \102\157\162\154\141\156\144\040\103\053\053\040\120\162\157 MSVC .ide 16 17# .res 18# https://learn.microsoft.com/en-us/windows/win32/menurc/resource-file-formats 19# https://learn.microsoft.com/en-us/windows/win32/menurc/resourceheader 20# A binary resource file consists of a number of concatenated resource entries. 21# Each entry consists of a resource header and the data for that resource. 22# Resource file starts with an empty resource entry with 32-byte long header in 23# which is stored ordinal type 0 and ordinal name 0. 240 string \000\000\000\000\040\000\000\000\377\377\000\000\377\377\000\000 Microsoft Visual C binary resource file 25!:ext res 26 27#.lib 28# URL: https://en.wikipedia.org/wiki/Microsoft_Visual_C%2B%2B 29# http://fileformats.archiveteam.org/wiki/Microsoft_Library 30# http://fileformats.archiveteam.org/wiki/OMF 31# Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lib-msvc.trid.xml 32# https://pierrelib.pagesperso-orange.fr/exec_formats/OMF_v1.1.pdf 33# Update: Joerg Jenderek 34#0 string \360\015\000\000 Microsoft Visual C library 35#0 string \360\075\000\000 Microsoft Visual C library 36#0 string \360\175\000\000 Microsoft Visual C library 37# test for RecordType~LibraryHeaderRecord=0xF0 + RecordLength=???Dh + dictionary offset is multiple of 0x200 380 ubelong&0xFF0f80ff =0xF00d0000 39# Microsoft Visual C library (strength=70) before MIDI SysEx messages (strength=50) handled by ./sysex 40#!:strength +0 41# test for valid 2nd RecordType~Translator Header Record=THEADR=80h or LHEADR=82h 42>(1.s+3) ubyte&0xFD =0x80 43>>0 use omf-lib 44# display information about Microsoft Visual C/OMF library 450 name omf-lib 46# RecordType~LibraryHeaderRecord=0xF0 47#>0 byte 0xF0 Microsoft Visual C library 48# the above description was used in file version 5.41 49>0 byte 0xF0 Microsoft Visual C/OMF library 50#>0 byte 0xF0 relocatable Object Module Format (OMF) libray 51#!:mime application/octet-stream 52!:mime application/x-omf-lib 53!:ext lib 54# 1st record data length like 13=0Dh 29=1Dh 61=3Dh 125=7Dh 509=01FDh ... 32765=7FFDh 55#>1 uleshort x \b, 1st record data length %u 56#>1 uleshort x \b, 1st record data length %#x 57# 2**4=16 <= RecordLength+3 = PageSize = 2**n {16 32 512 no examples 64 128 256 1024 2048 ...32768} <= 2**15=32768 58>1 uleshort+3 x \b, page size %u 59# dictionary offset like: 400h 600h a00h c00h 1200h 1800h 2400h 5600h 12800h 19200h 28a00h 60>3 ulelong x \b, at %#x dictionary 61# dictionary block a 512 bytes; the first 37 bytes correspond to the 37 buckets 62#>(3.l) ubequad x (%#16.16llx...) 63# dictionary size; length in 512-byte blocks; a prime number? like: 64# 1 2 3 4 5 6 7 9 11 13 15 16 18 21 22 23 24 25 31 50 53 89 101 117 277 65>7 uleshort x with %u block 66# plurals s 67>7 uleshort >1 \bs 68# If dictionary byte 38 (FFLAG) has the value 255, there is no space left 69>(3.l+37) ubyte <0xFF (FFLAG=%#x) 70>(3.l+37) ubyte =0xFF (FFLAG=full) 71# dictionary entry; length byte of following symbol, the following text bytes of symbol, two bytes specifies the page number 72# like: dbfntx1! DBFNTX.LIB zlibCompileFlags_ ZLIB.LIB atoi! mwlibc.lib 73>(3.l+38) pstring x 1st entry %s 74# like: 1 33 41 47 458 8783 75>>&0 uleshort x in page %u 76# library flags; 0 or 1, but WHAT IS 0x4d in MOUSE.LIB ? 77>9 ubyte >1 \b, flags %#x 78>9 ubyte =1 case sensitive 79# In the library after header comes first object module with a Library Module Header Record (LHEADR=82h) 80# but in examples Translator Header Record (THEADR=80h) which is handled identically 81>(1.s+3) ubyte x \b, 2nd record 82>(1.s+3) ubyte !0x80 (type %#x) 83#>(1.s+4) uleshort x \b, 2nd record data length %u 84# Module name often source name like "dos\crt0.asm" in mlibce.lib or "QB4UTIL.ASM" in QB4UTIL.LIB 85# or "C:\Documents and Settings\Allan Campbell\My Documents\FDOSBoot\zlib\zutil.c" in ZLIB.LIB 86# or title like "87INIT" in FP87.LIB or "ACOSASIN" in MATHC.LIB or "Copyright" in calc-bcc.lib 87>(1.s+6) pstring x "%s" 88# 2nd record checksum 89#>>&0 ubyte x checksum %#x 90# 3rd RecordType: 96h~LNAMES 88h~COMENT 91>>&1 ubyte x \b, 3rd record 92>>&1 ubyte !0x88 93>>>&-1 ubyte !0x96 94# 3rd unusual record type 95>>>>&-1 ubyte x (type %#x) 96# 3rd record is a List of Names Record (LNAMES=96h) 97>>&1 ubyte =0x96 LNAMES 98# LNAMES record length like: 2 15 19 99#>>>&0 uleshort x \b, LNAMES record length %u 100>>>&0 uleshort >2 101# 1st LNAME string length; null is valid; maximal 255 102#>>>>&0 ubyte x 1st LNAME length %u 103>>>>&0 ubyte =0 104# 2nd LNAME length like: 4 7 8 17 31 105#>>>>>&0 ubyte x 2nd LNAME length %u 106# name used for segment, class, group, overlay, etc like: 107# CODE (mwlibc.lib) _TEXT32 (JMPPM32.LIB) _OVLCODE (WOVL.LIB) 108>>>>>&0 pstring x %s 109# 3rd LNAME length like: 4 5 110#>>>>>>&0 ubyte x 3rd LNAME length %u 111# like: DATA (mwlibc.lib) CODE (JMPPM32.LIB) _TEXT (EMU87.LIB) 112>>>>>>&0 pstring x %s 113# maybe 4th LNAME length like: 4 6 114>>>>>>>&0 ubyte <44 115# like: DATA (DEBUG.LIB) DGROUP (mwlibc.lib MOUSE.LIB) 116>>>>>>>>&-1 pstring x %s 117# 3rd record is a COMMENT (Including all comment class extensions) 118>>&1 ubyte =0x88 COMMENT 119# comment record length like: 3 FLIB7M.LIB 1Bh 1Eh 23h 27h 2Bh 30h freetype-bcc.lib 120#>>>&0 uleshort x \b, record length %#x 121# real comment length = record length - 1 (comment type) - 1 (comment Class) - 1 (checksum) -1 (char count) 122# like: 2 LIBFL.LIB 4 "UUID" 5 "dscap" 6 "int386" 7 "qb4util" 8 "AMSGEXIT" 16 REXX.LIB 20 27 35 44 freetype-bcc.lib 123#>>>>&-2 uleshort-4 >0 \b, comment length %u 124# check that record contain at least comment type (1 byte), comment class (1 byte), checksum (1 byte) 125# probably always true 126>>>&0 uleshort >2 127# comment type: 80h~NP~no purge bit 40h~NL~no list bit 128#>>>>&0 ubyte !0 Type %#x 129>>>>&0 ubyte &0x80 Preserved 130# no example 131>>>>&0 ubyte &0x40 NoList 132# comment class like: 0~Translator A0~OMF extensions A3~LIBMOD A1~New OMF extensions AA~UNKNOWN 133>>>>&1 ubyte x class=%#x 134# check that comment record contains at least real content 135>>>>&-2 uleshort >3 136# Translator comment record (0); it may name the source language or translator 137>>>>>&1 ubyte =0 Translator 138#>>>>>>&0 ubyte x Translator length %u 139# like: "TC86 Borland Turbo C 2.01 " (GEMS.LIB) "TC86 Borland Turbo C++ 3.00" (CATDB.LIB) 140>>>>>>&0 pstring x "%s" 141# OMF extensions comment record (A0); first byte of commentary string identifies subtype 142>>>>>&1 ubyte =0xA0 OMF extensions 143# A0 subtype like: 1~IMPDEF 144>>>>>>&0 ubyte !1 subtype %#x 145# Import Definition Record (Comment Class A0, Subtype 01~IMPDEF) 146>>>>>>&0 ubyte 1 IMPDEF 147# ordinal flag; determines form of Entry Ident field. If nonzero (seems to be 1) Entry is ordinal 148>>>>>>>&0 ubyte !0 ordinal 149# like: IMPORT.LIB DOSCALLS.LIB mlibw.lib mwinlibc.lib REXX.LIB 150>>>>>>>>&-1 ubyte >1 %u 151# Internal Name in count, char string format; module name for the imported symbol 152# like: 7 "REXXSAA" 9 11 13 14 15 16 20 21 26 "_Z10_clip_linePdS_S_S_dddd" 153#>>>>>>>&1 ubyte x internal name length %u 154# internal module name like: _DllGetVersion DllGetVersion BezierTerminationTest Copyright 155>>>>>>>&1 pstring x %s 156# module name in count, char string format; DLL name that supplies a matching export symbol 157# like: jpeg62.dll (jpeg-bcc.lib) unrar3.dll (unrar-bcc.lib) REXX (REXX.LIB) 158>>>>>>>>&0 pstring x exported by %s 159# Entry Ident; 16-bit if ordinal flag != 0 or imported name in count, char string format if ordinal flag = 0 160# like: \0 (calc-bcc.lib) DllGetVersion (libtiff-bcc.lib) UTF8ToHtml (libxml2-bcc.lib) xslAddCall (libxslt-bcc.lib) 161#>>>>>>>>>&0 pstring >\0 entry ident %s 162# "New OMF" extensions comment (A1); indicate version of symbolic debug information 163# like: LIBFL.LIB 164>>>>>&1 ubyte =0xA1 New OMF extensions 165# symbolic debug information version n 166>>>>>>&0 ubyte x n=%u 167# symbolic debug information style like: HL~IBM PM Debugger style (LIBFL.LIB) DX~AIX style CV~Microsoft symbol and type style 168>>>>>>>&0 string HL IBM style 169>>>>>>>&0 string DX AIX style 170>>>>>>>&0 string CV Microsoft style 171# LIBMOD comment record (A3) used only by the librarian 172# Microsoft extension added for LIB version 3.07 in macro assembler (MASM 5.0) 173>>>>>&1 ubyte =0xA3 LIBMOD 174# The A3 LIBMOD record contains only the ASCII string of the module name in count char format 175#>>>>>>&0 ubyte x LIBMOD length %u 176# LIBMOD comment record module name without path and extension like: 177# qb4util (QB4UTIL.LIB) affaldiv (libh.lib) crt0 (slibc.lib) clipper (DDDRAWS.LIB) dinpdev (DINPUTS.LIB) UUID (UUID.LIB) 178>>>>>>&0 pstring x %s 179# GRR: WHAT iS THAT? AA foo comment record 180#>>>>>&1 ubyte =0xAA AA-comment 181# like: OS220 182#>>>>>>&0 string x what=%-5.5s 183# 184 185#.pch 1860 string DTJPCH0\000\022\103\006\200 Microsoft Visual C .pch 187 188# Summary: Symbol Table / Debug info used by Microsoft compilers 189# URL: https://en.wikipedia.org/wiki/Program_database 190# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format 191# Update: Joerg Jenderek 192# Note: test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86 193# info does only applies partly for older files like msvbvm50.pdb about year 2001 1940 string Microsoft\ C/C++\040 195# "Microsoft Program DataBase" by TrID 196>24 search/14 \r\n\x1A MSVC program database 197!:mime application/x-ms-pdb 198!:ext pdb 199# "MSF 7.00" "program database 2.00" for msvbvm50.pdb 200>>16 regex \([0-9.]+\) ver %s 201#>>>0x38 search/128123456 /LinkInfo \b with linkinfo 202# "MSF 7.00" variant 203>>0x1e leshort 0 204# PageSize 400h 1000h 205>>>0x20 lelong x \b, %d 206# Page Count 207>>>0x28 lelong x \b*%d bytes 208# "program database 2.00" variant 209>>0x1e leshort !0 210# PageSize 400h 211>>>0x2c lelong x \b, %d 212# Page Count for msoo-dll.pdb 4379h 213>>>0x32 leshort x \b*%d bytes 214 215# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d 2160 string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0 Microsoft Roslyn C# debugging symbols version 1.0 217 218#.sbr 2190 string \000\002\000\007\000 MSVC .sbr 220>5 string >\0 %s 221 222#.bsc 2230 string \002\000\002\001 MSVC .bsc 224 225#.wsp 2260 string 1.00\ .0000.0000\000\003 MSVC .wsp version 1.0000.0000 227# these seem to start with the version and contain menus 228