1 2#------------------------------------------------------------------------------ 3# $File: xenix,v 1.17 2024/02/29 03:42:40 christos Exp $ 4# xenix: file(1) magic for Microsoft Xenix 5# 6# "Middle model" stuff, and "Xenix 8086 relocatable or i286 small 7# model" lifted from "magic.xenix", with comment "derived empirically; 8# treat as folklore until proven" 9# 10# "small model", "large model", "huge model" stuff lifted from XXX 11# 12# XXX - "x.out" collides with PDP-11 archives 13# 140 string core core file (Xenix) 15# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix 16# http://fileformats.archiveteam.org/wiki/OMF 17# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf 18# Update: Joerg Jenderek 19# recordtype~TranslatorHEADerRecord 200 byte 0x80 21# GRR: line above is too general as it catches also Extensible storage engine DataBase, 22# all lif files like forth.lif hpcc88.lif lex90b.lif ( See ./lif) 23# and all compressed DEGAS low-res bitmaps like: MUNCHIE.PC1 PIDER1.PC1 24# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3 25>1 uleshort <1022 26# skip examples like GAME.PICTURE Strange.Pic by looking for positive record length 27>>1 uleshort >0 28# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positive string length 29>>>3 ubyte >0 30# skip examples like OMBRE.6 with "UUUUUU" name by looking for valid high second record type 31>>>>(1.s+3) ubyte >0x6D 32# skip few Atari DEGAS bitmap TPDEMO.PC2 RECIPE.PC2 with invalid "high" second record type FEh FFh 33>>>>>(1.s+3) ubyte <0xF2 8086 relocatable (Microsoft) 34#!:mime application/octet-stream 35!:mime application/x-object 36!:ext obj/o/a 37# T-module name often source name like "hello.c" or "jmppm32.asm" in JMPPM32.OBJ or 38# "kbhit" in KBHITS.OBJ or "CAUSEWAY_KERNAL" in CWAPI.OBJ 39>>>>>>3 pstring x \b, "%s" 40# data length probably lower 256 according to TrID obj_omf.trid.xml 41>>>>>>1 uleshort x \b, 1st record data length %u 42# checksum 43#>>>>>>(3.b+4) ubyte x \b, checksum %#2.2x 44# second recordtype: 96h~LNAMES 88h~COMENT 8CH~EXTDEF 45# highest F1h~Library End Record 46>>>>>>(1.s+3) ubyte x \b, 2nd record type %#x 47>>>>>>(1.s+4) uleshort x \b, 2nd record data length %u 48 49# Microsoft Xenix archive header 500 leshort 0xff65 Microsoft x.out 51>2 string __.SYMDEF randomized 52>0 byte x archive 53 54# Microsoft Xenix x.out header 55# Used by Xenix and also by Windows/386 2.x for WIN386.386 file 56# URL: http://www.polarhome.com/service/man/?qf=a.out&tf=2&of=Xenix 57# http://lock.cmpxchg8b.com/files/a.out.h 58# https://www.geoffchappell.com/notes/windows/retro/win386.htm 59# Big-endian examples: 60# - static executables for Xenix V2.x from Motorola 6800 files in IMD tar archive: 61# https://github.com/pski/model2archive/blob/master/Software/Xenix/Xenix_Games/GAMES1.IMD 62# Little-endian examples: 63# - static executables from Windows/386 2.x: WIN386.386, CGA.386, EGA.386, CTVGA.386, HERCULES.386, 8514.386 64# - static executables from SCO Xenix 2.1.3 for 8086: /bin/vi, /bin/file, ... 65# - standalone kernel executables from SCO Xenix 2.1.3 for 8086: /boot, /dos, /xenix 660 leshort 0x206 67>0x1c byte&0xc0 =0x40 Microsoft x.out little-endian 68>>0 use microsoft-x.out 690 beshort 0x206 70>0x1c byte&0xc0 =0x00 Microsoft x.out PDP-11-endian 71# PDP-11-endian is not supported by magic "use" keyword yet but because 72# we do not use long and quad types, we can parse it as big-endian 73>>0 use \^microsoft-x.out 74>0x1c byte&0xc0 =0x80 Microsoft x.out big-endian 75>>0 use \^microsoft-x.out 760 name microsoft-x.out 77# Parse type mask 78>0x1e leshort &0x10 overlay 79>0x1e leshort &0x2 separate 80>0x1e leshort &0x4 pure 81>0x1e leshort &0x800 segmented 82>0x1e clear x 83>0x1e leshort&0x501 =0x001 static executable 84>0x1e leshort&0x501 =0x100 shared library module 85>0x1e leshort&0x501 =0x101 dynamic executable 86>0x1e leshort&0x501 =0x401 standalone kernel executable 87>0x1e leshort&0x501 =0x500 virtual kernel module 88>0x1e default x unknown binary type 89# Parse OS type and OS version mask 90>0x1e leshort&0xc000 =0x0000 for pre-SysV 91>0x1e leshort&0xc000 =0x4000 for Xenix V2.x 92>0x1e leshort&0xc000 =0x8000 for Xenix V3.x 93>0x1e leshort&0xc000 =0xc000 94>>0x1e leshort ^0x800 for Xenix V5.x 95>>0x1e leshort &0x800 96>>>2 leshort =0x2c 97>>>>0x46 ubyte 1 98>>>>>0x47 ubyte 0 for Xenix V2.x 99>>>>>0x47 ubyte 1 for Xenix V3.x 100>>>>>0x47 ubyte 2 for Xenix V5.x 101# little-endian segmented static executable for Intel i386 with OS type 1 and 102# OS version 2 is used also by Windows/386 2.x for *.386 files (e.g. WIN386.386) 103>>>>>>0x1c ulequad&0x3fff00ff =0x0801004a or Windows/386 2.x 104>>>>0x46 ubyte 2 for iRMX 105>>>>0x46 ubyte 3 for Concurrent CP/M 106# Parse CPU mask 107>0x1c byte&0x3f =0x01 \b, PDP-11 108>0x1c byte&0x3f =0x02 \b, PDP-11/23 109>0x1c byte&0x3f =0x03 \b, Zilog Z8000 110>0x1c byte&0x3f =0x04 \b, Intel 8086 111>0x1c byte&0x3f =0x05 \b, Motorola 6800 112>0x1c byte&0x3f =0x06 \b, Zilog Z80 113>0x1c byte&0x3f =0x07 \b, VAX 780/750 114>0x1c byte&0x3f =0x08 \b, NS16032 115>0x1c byte&0x3f =0x09 \b, Intel i286 116>0x1c byte&0x3f =0x0a \b, Intel i386 117>0x1c byte&0x3f =0x0b \b, Intel i186 118>0x1c byte&0x3f =0x29 \b, Intel i286 119# Parse other flags 120# /bin/file from SCO Xenix 2.1.3 for 8086 reports bit 0x40 as Middle model 121# even that in a.out.h is this defined as large model text, so do same 122>0x1e leshort &0x40 \b, Middle model 123# following long check works in any endianity (including PDP-11) 124>0x10 lelong !0 \b, not stripped 125# Flags for debugging 126#>0x1c byte &0x40 \b, words swapped (differs from PDP-11) 127#>0x1c byte &0x80 \b, bytes swapped (differs from PDP-11) 128#>0x1e leshort &0x1 \b, executable 129#>0x1e leshort &0x2 \b, separate I&D 130#>0x1e leshort &0x4 \b, pure text 131#>0x1e leshort &0x8 \b, fixed stack 132#>0x1e leshort &0x10 \b, text overlay 133#>0x1e leshort &0x20 \b, large model data 134#>0x1e leshort &0x40 \b, large model text 135#>0x1e leshort &0x80 \b, FPU required 136#>0x1e leshort &0x100 \b, virtual module / huge model data 137#>0x1e leshort &0x200 \b, iterated text/data present 138#>0x1e leshort &0x400 \b, absolute memory image 139#>0x1e leshort &0x800 \b, segment table present 140#>0x1e leshort &0x1000 \b, advisory locking 141#>0x1e leshort &0x2000 \b, needs 5.3 functionality 142 143# Microsoft Xenix a.out header 144# URL: http://www.polarhome.com/service/man/?qf=a.out&tf=2&of=Xenix 145# http://lock.cmpxchg8b.com/files/a.out.h 146# FIXME: Below magic definition is probably wrong, it does not match struct aexec from a.out.h 1470 leshort 0x140 old Microsoft 8086 x.out 148>0x3 byte &0x4 separate 149>0x3 byte &0x2 pure 150>0 byte &0x1 executable 151>0 byte ^0x1 relocatable 152>0x14 lelong >0 not stripped 153 154# Microsoft Xenix b.out header 155# URL: http://www.polarhome.com/service/man/?qf=a.out&tf=2&of=Xenix 156# http://lock.cmpxchg8b.com/files/a.out.h 157# FIXME: Below magic definition is probably wrong, it does not match struct bexec from a.out.h 1580 lelong 0x206 b.out 159>0x1e leshort &0x10 overlay 160>0x1e leshort &0x2 separate 161>0x1e leshort &0x4 pure 162>0x1e leshort &0x800 segmented 163>0x1e leshort &0x400 standalone 164>0x1e leshort &0x1 executable 165>0x1e leshort ^0x1 object file 166>0x1e leshort &0x4000 V2.3 167>0x1e leshort &0x8000 V3.0 168>0x1c byte &0x4 8086 169>0x1c byte &0xb i186 170>0x1c byte &0x9 i286 171>0x1c byte &0x29 i286 172>0x1c byte &0xa i386 173>0x1e leshort &0x4 Large Text 174>0x1e leshort &0x2 Large Data 175>0x1e leshort &0x102 Huge Objects Enabled 176 1770 leshort 0x580 XENIX 8086 relocatable or i286 small model 178# GRR: line above is too general as it catches also all 8086 relocatable (Microsoft) with 1st record data length 5 C0M.OBJ C0T.OBJ C0S.OBJ 179