1b6cee71dSXin LI 2b6cee71dSXin LI#------------------------------------------------------------------------------ 3*ae316d1dSXin LI# $File: xenix,v 1.17 2024/02/29 03:42:40 christos Exp $ 4b6cee71dSXin LI# xenix: file(1) magic for Microsoft Xenix 5b6cee71dSXin LI# 6*ae316d1dSXin LI# "Middle model" stuff, and "Xenix 8086 relocatable or i286 small 7b6cee71dSXin LI# model" lifted from "magic.xenix", with comment "derived empirically; 8b6cee71dSXin LI# treat as folklore until proven" 9b6cee71dSXin LI# 10b6cee71dSXin LI# "small model", "large model", "huge model" stuff lifted from XXX 11b6cee71dSXin LI# 12b6cee71dSXin LI# XXX - "x.out" collides with PDP-11 archives 13b6cee71dSXin LI# 14b6cee71dSXin LI0 string core core file (Xenix) 1520f8619dSXin LI# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix 1643a5ec4eSXin LI# http://fileformats.archiveteam.org/wiki/OMF 1720f8619dSXin LI# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf 1820f8619dSXin LI# Update: Joerg Jenderek 1920f8619dSXin LI# recordtype~TranslatorHEADerRecord 2020f8619dSXin LI0 byte 0x80 2143a5ec4eSXin LI# GRR: line above is too general as it catches also Extensible storage engine DataBase, 2243a5ec4eSXin LI# all lif files like forth.lif hpcc88.lif lex90b.lif ( See ./lif) 2343a5ec4eSXin LI# and all compressed DEGAS low-res bitmaps like: MUNCHIE.PC1 PIDER1.PC1 2420f8619dSXin LI# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3 2520f8619dSXin LI>1 uleshort <1022 2643a5ec4eSXin LI# skip examples like GAME.PICTURE Strange.Pic by looking for positive record length 2720f8619dSXin LI>>1 uleshort >0 2843a5ec4eSXin LI# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positive string length 2920f8619dSXin LI>>>3 ubyte >0 3043a5ec4eSXin LI# skip examples like OMBRE.6 with "UUUUUU" name by looking for valid high second record type 31898496eeSXin LI>>>>(1.s+3) ubyte >0x6D 32898496eeSXin LI# skip few Atari DEGAS bitmap TPDEMO.PC2 RECIPE.PC2 with invalid "high" second record type FEh FFh 33898496eeSXin LI>>>>>(1.s+3) ubyte <0xF2 8086 relocatable (Microsoft) 3420f8619dSXin LI#!:mime application/octet-stream 3520f8619dSXin LI!:mime application/x-object 3643a5ec4eSXin LI!:ext obj/o/a 3743a5ec4eSXin LI# T-module name often source name like "hello.c" or "jmppm32.asm" in JMPPM32.OBJ or 3843a5ec4eSXin LI# "kbhit" in KBHITS.OBJ or "CAUSEWAY_KERNAL" in CWAPI.OBJ 39898496eeSXin LI>>>>>>3 pstring x \b, "%s" 4043a5ec4eSXin LI# data length probably lower 256 according to TrID obj_omf.trid.xml 41898496eeSXin LI>>>>>>1 uleshort x \b, 1st record data length %u 4220f8619dSXin LI# checksum 43898496eeSXin LI#>>>>>>(3.b+4) ubyte x \b, checksum %#2.2x 4443a5ec4eSXin LI# second recordtype: 96h~LNAMES 88h~COMENT 8CH~EXTDEF 45898496eeSXin LI# highest F1h~Library End Record 46898496eeSXin LI>>>>>>(1.s+3) ubyte x \b, 2nd record type %#x 47898496eeSXin LI>>>>>>(1.s+4) uleshort x \b, 2nd record data length %u 48*ae316d1dSXin LI 49*ae316d1dSXin LI# Microsoft Xenix archive header 50*ae316d1dSXin LI0 leshort 0xff65 Microsoft x.out 51b6cee71dSXin LI>2 string __.SYMDEF randomized 52b6cee71dSXin LI>0 byte x archive 53*ae316d1dSXin LI 54*ae316d1dSXin LI# Microsoft Xenix x.out header 55*ae316d1dSXin LI# Used by Xenix and also by Windows/386 2.x for WIN386.386 file 56*ae316d1dSXin LI# URL: http://www.polarhome.com/service/man/?qf=a.out&tf=2&of=Xenix 57*ae316d1dSXin LI# http://lock.cmpxchg8b.com/files/a.out.h 58*ae316d1dSXin LI# https://www.geoffchappell.com/notes/windows/retro/win386.htm 59*ae316d1dSXin LI# Big-endian examples: 60*ae316d1dSXin LI# - static executables for Xenix V2.x from Motorola 6800 files in IMD tar archive: 61*ae316d1dSXin LI# https://github.com/pski/model2archive/blob/master/Software/Xenix/Xenix_Games/GAMES1.IMD 62*ae316d1dSXin LI# Little-endian examples: 63*ae316d1dSXin LI# - static executables from Windows/386 2.x: WIN386.386, CGA.386, EGA.386, CTVGA.386, HERCULES.386, 8514.386 64*ae316d1dSXin LI# - static executables from SCO Xenix 2.1.3 for 8086: /bin/vi, /bin/file, ... 65*ae316d1dSXin LI# - standalone kernel executables from SCO Xenix 2.1.3 for 8086: /boot, /dos, /xenix 66*ae316d1dSXin LI0 leshort 0x206 67*ae316d1dSXin LI>0x1c byte&0xc0 =0x40 Microsoft x.out little-endian 68*ae316d1dSXin LI>>0 use microsoft-x.out 69*ae316d1dSXin LI0 beshort 0x206 70*ae316d1dSXin LI>0x1c byte&0xc0 =0x00 Microsoft x.out PDP-11-endian 71*ae316d1dSXin LI# PDP-11-endian is not supported by magic "use" keyword yet but because 72*ae316d1dSXin LI# we do not use long and quad types, we can parse it as big-endian 73*ae316d1dSXin LI>>0 use \^microsoft-x.out 74*ae316d1dSXin LI>0x1c byte&0xc0 =0x80 Microsoft x.out big-endian 75*ae316d1dSXin LI>>0 use \^microsoft-x.out 76*ae316d1dSXin LI0 name microsoft-x.out 77*ae316d1dSXin LI# Parse type mask 78b6cee71dSXin LI>0x1e leshort &0x10 overlay 79b6cee71dSXin LI>0x1e leshort &0x2 separate 80b6cee71dSXin LI>0x1e leshort &0x4 pure 81b6cee71dSXin LI>0x1e leshort &0x800 segmented 82*ae316d1dSXin LI>0x1e clear x 83*ae316d1dSXin LI>0x1e leshort&0x501 =0x001 static executable 84*ae316d1dSXin LI>0x1e leshort&0x501 =0x100 shared library module 85*ae316d1dSXin LI>0x1e leshort&0x501 =0x101 dynamic executable 86*ae316d1dSXin LI>0x1e leshort&0x501 =0x401 standalone kernel executable 87*ae316d1dSXin LI>0x1e leshort&0x501 =0x500 virtual kernel module 88*ae316d1dSXin LI>0x1e default x unknown binary type 89*ae316d1dSXin LI# Parse OS type and OS version mask 90*ae316d1dSXin LI>0x1e leshort&0xc000 =0x0000 for pre-SysV 91*ae316d1dSXin LI>0x1e leshort&0xc000 =0x4000 for Xenix V2.x 92*ae316d1dSXin LI>0x1e leshort&0xc000 =0x8000 for Xenix V3.x 93*ae316d1dSXin LI>0x1e leshort&0xc000 =0xc000 94*ae316d1dSXin LI>>0x1e leshort ^0x800 for Xenix V5.x 95*ae316d1dSXin LI>>0x1e leshort &0x800 96*ae316d1dSXin LI>>>2 leshort =0x2c 97*ae316d1dSXin LI>>>>0x46 ubyte 1 98*ae316d1dSXin LI>>>>>0x47 ubyte 0 for Xenix V2.x 99*ae316d1dSXin LI>>>>>0x47 ubyte 1 for Xenix V3.x 100*ae316d1dSXin LI>>>>>0x47 ubyte 2 for Xenix V5.x 101*ae316d1dSXin LI# little-endian segmented static executable for Intel i386 with OS type 1 and 102*ae316d1dSXin LI# OS version 2 is used also by Windows/386 2.x for *.386 files (e.g. WIN386.386) 103*ae316d1dSXin LI>>>>>>0x1c ulequad&0x3fff00ff =0x0801004a or Windows/386 2.x 104*ae316d1dSXin LI>>>>0x46 ubyte 2 for iRMX 105*ae316d1dSXin LI>>>>0x46 ubyte 3 for Concurrent CP/M 106*ae316d1dSXin LI# Parse CPU mask 107*ae316d1dSXin LI>0x1c byte&0x3f =0x01 \b, PDP-11 108*ae316d1dSXin LI>0x1c byte&0x3f =0x02 \b, PDP-11/23 109*ae316d1dSXin LI>0x1c byte&0x3f =0x03 \b, Zilog Z8000 110*ae316d1dSXin LI>0x1c byte&0x3f =0x04 \b, Intel 8086 111*ae316d1dSXin LI>0x1c byte&0x3f =0x05 \b, Motorola 6800 112*ae316d1dSXin LI>0x1c byte&0x3f =0x06 \b, Zilog Z80 113*ae316d1dSXin LI>0x1c byte&0x3f =0x07 \b, VAX 780/750 114*ae316d1dSXin LI>0x1c byte&0x3f =0x08 \b, NS16032 115*ae316d1dSXin LI>0x1c byte&0x3f =0x09 \b, Intel i286 116*ae316d1dSXin LI>0x1c byte&0x3f =0x0a \b, Intel i386 117*ae316d1dSXin LI>0x1c byte&0x3f =0x0b \b, Intel i186 118*ae316d1dSXin LI>0x1c byte&0x3f =0x29 \b, Intel i286 119*ae316d1dSXin LI# Parse other flags 120*ae316d1dSXin LI# /bin/file from SCO Xenix 2.1.3 for 8086 reports bit 0x40 as Middle model 121*ae316d1dSXin LI# even that in a.out.h is this defined as large model text, so do same 122*ae316d1dSXin LI>0x1e leshort &0x40 \b, Middle model 123*ae316d1dSXin LI# following long check works in any endianity (including PDP-11) 124*ae316d1dSXin LI>0x10 lelong !0 \b, not stripped 125*ae316d1dSXin LI# Flags for debugging 126*ae316d1dSXin LI#>0x1c byte &0x40 \b, words swapped (differs from PDP-11) 127*ae316d1dSXin LI#>0x1c byte &0x80 \b, bytes swapped (differs from PDP-11) 128*ae316d1dSXin LI#>0x1e leshort &0x1 \b, executable 129*ae316d1dSXin LI#>0x1e leshort &0x2 \b, separate I&D 130*ae316d1dSXin LI#>0x1e leshort &0x4 \b, pure text 131*ae316d1dSXin LI#>0x1e leshort &0x8 \b, fixed stack 132*ae316d1dSXin LI#>0x1e leshort &0x10 \b, text overlay 133*ae316d1dSXin LI#>0x1e leshort &0x20 \b, large model data 134*ae316d1dSXin LI#>0x1e leshort &0x40 \b, large model text 135*ae316d1dSXin LI#>0x1e leshort &0x80 \b, FPU required 136*ae316d1dSXin LI#>0x1e leshort &0x100 \b, virtual module / huge model data 137*ae316d1dSXin LI#>0x1e leshort &0x200 \b, iterated text/data present 138*ae316d1dSXin LI#>0x1e leshort &0x400 \b, absolute memory image 139*ae316d1dSXin LI#>0x1e leshort &0x800 \b, segment table present 140*ae316d1dSXin LI#>0x1e leshort &0x1000 \b, advisory locking 141*ae316d1dSXin LI#>0x1e leshort &0x2000 \b, needs 5.3 functionality 142b6cee71dSXin LI 143*ae316d1dSXin LI# Microsoft Xenix a.out header 144*ae316d1dSXin LI# URL: http://www.polarhome.com/service/man/?qf=a.out&tf=2&of=Xenix 145*ae316d1dSXin LI# http://lock.cmpxchg8b.com/files/a.out.h 146*ae316d1dSXin LI# FIXME: Below magic definition is probably wrong, it does not match struct aexec from a.out.h 147b6cee71dSXin LI0 leshort 0x140 old Microsoft 8086 x.out 148b6cee71dSXin LI>0x3 byte &0x4 separate 149b6cee71dSXin LI>0x3 byte &0x2 pure 150b6cee71dSXin LI>0 byte &0x1 executable 151b6cee71dSXin LI>0 byte ^0x1 relocatable 152b6cee71dSXin LI>0x14 lelong >0 not stripped 153b6cee71dSXin LI 154*ae316d1dSXin LI# Microsoft Xenix b.out header 155*ae316d1dSXin LI# URL: http://www.polarhome.com/service/man/?qf=a.out&tf=2&of=Xenix 156*ae316d1dSXin LI# http://lock.cmpxchg8b.com/files/a.out.h 157*ae316d1dSXin LI# FIXME: Below magic definition is probably wrong, it does not match struct bexec from a.out.h 158b6cee71dSXin LI0 lelong 0x206 b.out 159b6cee71dSXin LI>0x1e leshort &0x10 overlay 160b6cee71dSXin LI>0x1e leshort &0x2 separate 161b6cee71dSXin LI>0x1e leshort &0x4 pure 162b6cee71dSXin LI>0x1e leshort &0x800 segmented 163b6cee71dSXin LI>0x1e leshort &0x400 standalone 164b6cee71dSXin LI>0x1e leshort &0x1 executable 165b6cee71dSXin LI>0x1e leshort ^0x1 object file 166b6cee71dSXin LI>0x1e leshort &0x4000 V2.3 167b6cee71dSXin LI>0x1e leshort &0x8000 V3.0 168*ae316d1dSXin LI>0x1c byte &0x4 8086 169*ae316d1dSXin LI>0x1c byte &0xb i186 170*ae316d1dSXin LI>0x1c byte &0x9 i286 171*ae316d1dSXin LI>0x1c byte &0x29 i286 172*ae316d1dSXin LI>0x1c byte &0xa i386 173b6cee71dSXin LI>0x1e leshort &0x4 Large Text 174b6cee71dSXin LI>0x1e leshort &0x2 Large Data 175b6cee71dSXin LI>0x1e leshort &0x102 Huge Objects Enabled 176b6cee71dSXin LI 177*ae316d1dSXin LI0 leshort 0x580 XENIX 8086 relocatable or i286 small model 178898496eeSXin LI# GRR: line above is too general as it catches also all 8086 relocatable (Microsoft) with 1st record data length 5 C0M.OBJ C0T.OBJ C0S.OBJ 179