xref: /titanic_41/usr/src/cmd/file/magic (revision 4bff34e37def8a90f9194d81bc345c52ba20086a)
1#
2# Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
3# Use is subject to license terms.
4#
5# CDDL HEADER START
6#
7# The contents of this file are subject to the terms of the
8# Common Development and Distribution License (the "License").
9# You may not use this file except in compliance with the License.
10#
11# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
12# or http://www.opensolaris.org/os/licensing.
13# See the License for the specific language governing permissions
14# and limitations under the License.
15#
16# When distributing Covered Code, include this CDDL HEADER in each
17# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
18# If applicable, add the following below this CDDL HEADER, with the
19# fields enclosed by brackets "[]" replaced with your own identifying
20# information: Portions Copyright [yyyy] [name of copyright owner]
21#
22# CDDL HEADER END
23#
24#ident	"%Z%%M%	%I%	%E% SMI"
25#
26# This file contains the dictionary of file format identifiers (magic strings)
27# used by file(1).  The fields of this file are as follows:
28#
29# (1) byte offset
30# (2) value type
31# (3) optional operator (= by default)
32# (4) value to match (numeric or string)
33# (5) string to be printed
34#
35# Numeric values may be decimal, octal, or hex.  Also note that the last string
36# may have one printf format specifier.  The '>' in occassional column 1's is
37# magic: it forces file(1) to continue scanning and matching additional lines.
38# The first line afterwards not so marked terminates the search.
39#
40# The entries for ELF are not needed anymore, as file(1) now uses the elf(3ELF)
41# routines to look at ELF files.  They remain, commented out, for reference.
42#
43#0	string		\177ELF		ELF
44#>4	byte		1		32-bit
45#>5	byte		1		LSB
46#>5	byte		2		MSB
47#>16	short		0		unknown type
48#>16	short		1		relocatable
49#>16	short		2		executable
50#>16	short		3		dynamic lib
51#>16	short		4		core file
52#>18	short		0		unknown machine
53#>18	short		1		WE32100
54#>18	short		2		SPARC
55#>18	short		3		80386
56#>18	short		4		M68000
57#>18	short		5		M88000
58#>18	short		6		i80486
59#>18	short		7		i860
60#>18	short		8		RS3000_BE
61#>18	short		9		UNKNOWN
62#>18	short		10		RS3000_LE
63#>18	short		11		RS6000
64#>18	short		12		UNKNOWN
65#>18	short		13		UNKNOWN
66#>18	short		14		UNKNOWN
67#>18	short		15		PA_RISC
68#>18	short		16		nCUBE
69#>18	short		17		VPP500
70#>18	short		18		SPARC32PLUS
71#>18	short		19		UNKNOWN
72#>18	short		20		PowerPC
73#>20	long		1		Version 1
74#>36	long		1		MAU Required
75257	string		ustar		USTAR tar archive
76>156	byte		88		extended format
770	short		070701		cpio archive
780	string		070701		ASCII cpio archive
790	short		070702		cpio archive - CRC header
800	string		070702		ASCII cpio archive - CRC header
810	short		070707		cpio archive - CHR (-c) header
820	string		070707		ASCII cpio archive - CHR (-c) header
830	long		0177555		obsolete ar archive
840	short		0177545		pdp11/pre System V ar archive
850	long		0100554		apl workspace
860	short		017037		packed data
870	string		<ar>		System V Release 1 ar archive
880	string		!<arch>		current ar archive
890	short		0407		pdp11/pre System V vax executable
90>8	ushort		>0		not stripped
91>15	ubyte		>0		- version %ld
920	short		0401		unix-rt ldp
930	short		0405		pdp11 overlay
940	short		0410		pdp11/pre System V vax pure executable
95>8	ushort		>0		not stripped
96>15	ubyte		>0		- version %ld
970	short		0411		pdp11 separate I&D
98>8	ushort		>0		not stripped
99>15	ubyte		>0		- version %ld
1000	short		015001		Compiled Terminfo Entry
101# little-endian entry
1020	short		0432		Compiled Terminfo Entry
1030	short		0433		Curses screen image
1040	short		0434		Curses screen image
1050	short		0437		pdp11 kernel overlay
1060	short		0570		vax executable
107>12	long		>0		not stripped
108>22	ushort		>0		- version %ld
1090	short		0575		vax pure executable
110>12	long		>0		not stripped
111>22	ushort		>0		- version %ld
1120	short		0502		basic-16 executable
113>12	long		>0		not stripped
114>22	ushort		>0		- version %ld
1150	short		0503		basic-16 executable (TV)
116>12	long		>0		not stripped
117>22	ushort		>0		- version %ld
1180	short		0510		x86 executable
119>12	long		>0		not stripped
1200	short		0511		x86 executable (TV)
121>12	long		>0		not stripped
1220	short		0550		3b20 executable
123>12	long		>0		not stripped
124>22	ushort		>0		- version %ld
1250	short		0551		3b20 executable (TV)
126>12	long		>0		not stripped
127>22	ushort		>0		- version %ld
1280	short		0560		WE32000 executable
129>12	long		>0		not stripped
130>18	short		^00010000	- N/A on 3b2/300 w/paging
131>18	short		&00020000	- 32100 required
132>18	short		&00040000	and mau hardware required
133>20	short		0443		(target shared library)
134>20	short		0410		(swapped)
135>20	short		0413		(paged)
136>22	ushort		>0		- version %ld
1370	short		0561		WE32000 executable (TV)
138>12	long		>0		not stripped
139>18	short		&00020000	- 32100 required
140>18	short		&00040000	and mau hardware required
141>22	ushort		>0		- version %ld
1420	short		=0512		iAPX 286 executable small model (COFF)
143>12	long		>0		not stripped
144>22	ushort		>0		- version %ld
1450	short		=0522		iAPX 286 executable large model (COFF)
146>12	long		>0		not stripped
147>22	ushort		>0		- version %ld
1480	short		0514		iAPX 386 executable (COFF) (deprecated)
149>12	long		>0		not stripped
150>22	ushort		>0		- version %ld
1510	short		0520		mc68k executable
152>12	long		>0		not stripped
1530	short		0521		mc68k executable (shared)
154>12	long		>0		not stripped
1550	short		0522		mc68k executable (shared demand paged)
156>12	long		>0		not stripped
157# big-endian entries for pure executables
1582	short		0410		pure
159>1	byte		0		sun2 executable
160>1	byte		1		mc68010 executable
161>1	byte		2		mc68020 executable
162>1	byte		3		SPARC executable
163>0	ubyte		>077		dynamically linked
164# little-endian entries for pure executables
1652	short		04001		pure
166>1	byte		0		sun2 executable
167>1	byte		1		mc68010 executable
168>1	byte		2		mc68020 executable
169>1	byte		3		SPARC executable
170>0	ubyte		>077		dynamically linked
171# big-endian entries for impure executables
1722	short		0407		impure
173>1	byte		0		sun2 executable
174>1	byte		1		mc68010 executable
175>1	byte		2		mc68020 executable
176>1	byte		3		SPARC executable
177>0	ubyte		>077		dynamically linked
178# little-endian entries for impure executables
1792	short		03401		impure
180>1	byte		0		sun2 executable
181>1	byte		1		mc68010 executable
182>1	byte		2		mc68020 executable
183>1	byte		3		SPARC executable
184>0	ubyte		>077		dynamically linked
185# big-endian entries for Sun demand paged executables
1862	short		0413		Sun demand paged
187>1	byte		0		sun2 executable
188>1	byte		1		mc68010 executable
189>1	byte		2		mc68020 executable
190>1	byte		3		SPARC executable
191>0	ubyte		>077		dynamically linked
192# little-endian entries for Sun demand paged executables
1932	short		05401		Sun demand paged
194>1	byte		0		sun2 executable
195>1	byte		1		mc68010 executable
196>1	byte		2		mc68020 executable
197>1	byte		3		SPARC executable
198>0	ubyte		>077		dynamically linked
1990	short		0x8001		Adobe PostScript Type 1 binary font (PFB)
2000	short		0x0180		Adobe PostScript Type 1 binary font (PFB)
2010	long		0x00010000	TrueType font file version 1.0 (TTF)
2020	long		0x00000100	TrueType font file version 1.0 (TTF)
2030	long		0xf00000ff	extended accounting file
204# little-endian entry
2050	long		0xff0000f0	extended accounting file
2060	byte		0x80		8086 relocatable (Microsoft)
2070	byte		0xf0		MS-DOS library
2080	short		0xff65		x.out
209>2	string		__.SYMDEF	randomized
210>0	byte		x		archive
2110	short		0x206		Microsoft a.out
212>0x1e	short		&0x10		overlay
213>0x1e	short		&0x2		separate
214>0x1e	short		&0x4		pure
215>0x1e	short		&0x800		segmented
216>0x1e	short		&0x400		standalone
217>0x1e	short		&0x8		fixed-stack
218>0x1c	byte		&0x80		byte-swapped
219>0x1c	byte		&0x40		word-swapped
220>0x10	long		>0		not-stripped
221>0x1e	short		^0xc000		pre-SysV
222>0x1c	byte		&0x4		86
223>0x1c	byte		&0x9		286
224>0x1c	byte		&0xa		386
225>0x1e	short		&0x1		executable
226>0x1e	short		^0x1		object file
227>0x1e	short		&0x40		Large Text
228>0x1e	short		&0x20		Large Data
229>0x1e	short		&0x120		Huge Objects Enabled
2300	short		0x10b		VAX demand load format a.out object file
231>0x10	long		>0		not stripped
2320	short		0x140		old Microsoft 8086 x.out
233>0x3	byte		&0x4		separate
234>0x3	byte		&0x2		pure
235>0	byte		&0x1		executable
236>0	byte		^0x1		relocatable
237>0x14	long		>0		not stripped
2380	long		0x10b		VAX demand load format a.out object file
239>0x10	long		>0		not stripped
2400	long		0x140		old Microsoft 8086 x.out
241>0x3	byte		&0x4		separate
242>0x3	byte		&0x2		pure
243>0	byte		&0x1		executable
244>0	byte		^0x1		relocatable
245>0x14	long		>0		not stripped
2460	long		0xe807		object file (z8000 a.out)
2470	long		0xe808		pure object file (z8000 a.out)
2480	long		0xe809		separate object file (z8000 a.out)
2490	long		0xe805		overlay object file (z8000 a.out)
2500	long		0x178		Bell 5.0 executable
2512	short		0410		Sun read-only text executable
252>2	short		0407		Sun old executable
253>1	byte		3		(SPARC)
254>1	byte		2		(68020)
255>1	byte		1		(68010)
256>1	byte		0		(Sun2)
2570	short		0143561		byte-swapped cpio archive
2580	long		0101555		PDP-11 single precision APL workspace
2590	long		0101554		PDP-11 double precision APL workspace
2600	long		0101557		VAX single precision APL workspace
2610	long		0101556		VAX double precision APL workspace
2620	short		017437		old packed data
2630	string		\037\036	packed data
2640	string		\377\037	compacted data
2650	string		\037\235	compressed data
266>2	byte&0x80	>0		block compressed
267>2	byte&0x1f	x		%d bits
2680	string		\037\213	gzip compressed data
269>2	byte		8		- deflate method
270>3	byte		&0x1		, ascii
271>3	byte		&0x2		, continuation
272>3	byte		&0x4		, extra field
273>3	byte		&0x8		, original file name
274>3	byte		&0x10		, comment
275>3	byte		&0x20		, encrypted
276>8	byte		2		, max compression
277>8	byte		4		, max speed
2780	string		!<arch>\n__.SYMDEF	archive random library
2790	long		0x1010101	MMDF mailbox
2800	string		<!OPS		Interleaf ASCII document
28124	string		SunGKS		SunGKS
282# version number follows, in the form m.n
283>0	string		GKSM		Metafile
2840	string		GKSM		GKS Metafile
285# version number follows, in the form <!OPS, Version n.n>
2860	string		%!PS-AdobeFont	Adobe PostScript ASCII font (PFA)
2870	string		%!		PostScript document
288>2	string		PS-Adobe	 conforming to level
289>10	string		-1.0		 1.0
290>10	string		-2.0		 2.0
291>10	string		-3.0		 3.0
292# version ID follows, in the form PS-Adobe-nn
2930	string		Interpress/Xerox	Interpress document
294# version ID follows, in the form /n.n
2950	string		StartFontMetrics	Adobe font metrics
2960	string		StartFont	Adobe font bits
2970	long		0x137A2944	NeWS bitmap font
2980	long		0x137A2947	NeWS font family
2998	long		0x137A2B45	X11/NeWS bitmap font
3008	long		0x137A2B48	X11/NeWS font family
301# snoop files are always big-endian
302# big-endian entries, with ullong equivalent of string "snoop"
3030	ullong		0x736e6f6f70000000	Snoop capture file
304>8	long		>0		- version %ld
305# little-endian entries, with ullong equivalent of string "snoop"
3060	ullong		0x000000706f6f6e73	Snoop capture file
307>11	long		>0		- version %ld
3080	short		0436		vfont definition
3090	string		<MakerFile	Frame Maker document
3100	string		<MIFFile	Frame Maker MIF file
3110	string		<MML		Frame Maker MML file
3120	string		<BookFile	Frame Maker book file
313# Audio files are always big-endian so there are two sets of tables here.
314# The CPU endian architecture is determined via the ordering of the first 4 bytes
315# (the string ".snd"). The tables below have this value represented as a single
316# 4 byte long. If the architecture is big-endian the %d token can be used for
317# interpreting the sampling rate.
318# Since %d can't be done on the data for little endian machines the limitation
319# is that sampling rates not included in the x86 entries will not be recognized.
320#
321# big-endian entries
322#
3230	long		0x2e736e64	audio data:
324>12	long		1		8-bit u-law,
325>12	long		2		8-bit linear PCM,
326>12	long		3		16-bit linear PCM,
327>12	long		4		24-bit linear PCM,
328>12	long		5		32-bit linear PCM,
329>12	long		6		32-bit floating point,
330>12	long		7		64-bit floating point,
331>12	long		23		compressed (4-bit G.721 ADPCM),
332>12	long		24		compressed (8-bit G.722 ADPCM),
333>12	long		25		compressed (3-bit G.723 ADPCM),
334>12	long		26		compressed (5-bit G.723 ADPCM),
335>12	long		27		8-bit A-law,
336>20	long		1		mono,
337>20	long		2		stereo,
338>20	long		4		quad,
339>16	long		x		%d Hz
340#
341# little-endian entries
342#
3430	long		0x646e732e	audio data:
344>12	long		0x01000000	8-bit u-law,
345>12	long		0x02000000	8-bit linear PCM,
346>12	long		0x03000000	16-bit linear PCM,
347>12	long		0x04000000	24-bit linear PCM,
348>12	long		0x05000000	32-bit linear PCM,
349>12	long		0x06000000	32-bit floating point,
350>12	long		0x07000000	64-bit floating point,
351>12	long		0x17000000	compressed (4-bit G.721 ADPCM),
352>12	long		0x18000000	compressed (8-bit G.722 ADPCM),
353>12	long		0x19000000	compressed (3-bit G.723 ADPCM),
354>12	long		0x1a000000	compressed (5-bit G.723 ADPCM),
355>12	long		0x1b000000	8-bit A-law,
356>20	long		0x01000000	mono,
357>20	long		0x02000000	stereo,
358>20	long		0x04000000	quad,
359>16	long		0x401f0000	8000 Hz
360>16	long		0x80250000	9600 Hz
361>16	long		0x112b0000	11025 Hz
362>16	long		0x803e0000	16000 Hz
363>16	long		0xd4490000	18900 Hz
364>16	long		0x22560000	22050 Hz
365>16	long		0x007d0000	32000 Hz
366>16	long		0xa8930000	37800 Hz
367>16	long		0x44ac0000	44100 Hz
368>16	long		0x80bb0000	48000 Hz
369# .wav files are always little-endian
370# .wav big-endian entries, starting with long value for the string "RIFF"
3710	long		0x52494646	audio data:
372>34	short		0x0800		8-bit
373>34	short		0x1000		16-bit
374>20	short		0x0100		linear PCM,
375>20	short		0x0200		MS ADPCM,
376>20	short		0x0600		A-law,
377>20	short		0x0700		u-law,
378>20	short		0x1100		DVI ADPCM,
379>22	short		0x0100		mono
380>22	short		0x0200		stereo
381# .wav little-endian entries, starting with long value for the string "RIFF"
3820	long		0x46464952	audio data:
383>34	short		0x0008		8-bit
384>34	short		0x0010		16-bit
385>20	short		0x0001		linear PCM,
386>20	short		0x0002		MS ADPCM,
387>20	short		0x0006		A-law,
388>20	short		0x0007		u-law,
389>20	short		0x0011		DVI ADPCM,
390>22	short		0x0001		mono
391>22	short		0x0002		stereo
392# .aiff files are always big-endian
393# .aiff big-endian entries, starting with long value for the string "FORM"
3940	long		0x464f524d	audio data:
395>26	short		0x0008		8-bit linear PCM,
396>26	short		0x0010		16-bit linear PCM,
397>20	short		0x0001		mono
398>20	short		0x0002		stereo
399# .aiff little-endian entries, starting with long value for the string "FORM"
4000	long		0x4d524f46	audio data:
401>26	short		0x0800		8-bit linear PCM,
402>26	short		0x1000		16-bit linear PCM,
403>20	short		0x0100		mono
404>20	short		0x0200		stereo
405# .mid files are always big-endian
406# .mid big-endian entries, starting with long value for the string "MThd"
4070	long		0x4d546864	MIDI data:
408>8	short		x		type %u,
409>10	short		x		%u track(s)
410# .mid little-endian entry (the string "MThd")
411# can't translate big-endian type and track information
4120	long		0x6468544d	MIDI data
413#
4140	short		0x1010		PEX Binary Archive
415# rasterfiles are big-endian
416# big-endian rasterfile entries
4170	long		0x59a66a95	rasterfile,
418>4	long		>0		%ld x
419>8	long		>0		%ld x
420>12	long		>0		%ld
421>20	long		0		old format image
422>20	long		1		standard format image
423>20	long		2		run-length byte encoded image
424>20	long		3		XRGB or RGB format image
425>20	long		4		tiff format image
426>20	long		5		iff (TAAC format) image
427>20	long		0xffff		experimental format image
428# little-endian rasterfile entries
429# cannot translate resolution stored as big-endian longs
4300	long		0x956aa659	rasterfile,
431>23	long		0		old format image
432>23	long		1		standard format image
433>23	long		2		run-length byte encoded image
434>23	long		3		XRGB or RGB format image
435>23	long		4		tiff format image
436>23	long		5		iff (TAAC format) image
437>20	long		0xffff		experimental format image
4380	long		0x884f5053	Interleaf fast-saved document
4390	long		0x2a535441	Aster*x
440>7	long		0x574f5244		Words Document
441>7	long		0x47524150		Graphic
442>7	long		0x53505245		Spreadsheet
443>7	long		0x4d414352		Macro
4440	long		0x32323738	Aster*x Version 2
445>29	byte		0x36			Words Document
446>29	byte		0x35			Graphic
447>29	byte		0x32			Spreadsheet
448>29	byte		0x38			Macro
4494	string		pgscriptver	IslandWrite document
45013	string		DrawFile	IslandDraw document
4510	string		P1		PBM ascii file
4520	string		P2		PGM ascii file
4530	string		P3		PPM ascii file
4540	string		P4		PBM raw file
4550	string		P5		PGM raw file
4560	string		P6		PPM raw file
4570	string		\115\115	TIFF file, big-endian
4580	string		\111\111	TIFF file, little-endian
4590	string		GIF87a		GIF file, v87
4600	string		GIF89a		GIF file, v89
4610	string		\377\330\377\340	JPEG file
4620	string		\377\330\377\341	JPEG file
4630	string		\377\330\377\356	JPG file
4648	string		ILBM		IFF ILBM file
4650	string		\312\376\272\276	java class file
46636	string		acsp	Kodak Color Management System, ICC Profile
4670	string		%PDF		Adobe Portable Document Format (PDF)
468>4	string		-1.0		v1.0
469>4	string		-1.1		v1.1
470>4	string		-1.2		v1.2
471>4	string		-1.3		v1.3
472>4	string		-1.4		v1.4
473>4	string		-1.5		v1.5
4740	string		<html		html document
4750	string		<HTML		html document
4760	string		<Html		html document
4770	string		<!doctype HTML	html document
4780	string		<!doctype Html	html document
4790	string		<!doctype html	html document
4800	string		<!DOCTYPE HTML	html document
4810	string		<!DOCTYPE Html	html document
4820	string		<!DOCTYPE html	html document
4830	string		<!Doctype HTML	html document
4840	string		<!Doctype Html	html document
4850	string		<!Doctype html	html document
4860	string		<head		html document
4870	string		<HEAD		html document
4880	string		<Head		html document
4890	string		<title		html document
4900	string		<TITLE		html document
4910	string		<Title		html document
4920	string		<?xml		XML document
4930	string		<?XML		XML document
4940	string		<?Xml		XML document
4950	string		\0211PNG	PNG image data
4960	string		.RMF		RealMedia file
4970	string		FlAsH-aRcHiVe	Flash Archive
498>13	string		-1.0		 1.0
499>13	string		-2.0		 2.0
50038	string		application/vnd.sun.xml.writer	StarOffice 7 Text Document
50138	string		application/vnd.sun.xml.calc	StarOffice 7 Spreadsheet
50238	string		application/vnd.sun.xml.draw	StarOffice 7 Drawing
50338	string		application/vnd.sun.xml.impress	StarOffice 7 Presentation
50438	string		application/vnd.sun.xml.math	StarOffice 7 Formula
50538	string		application/vnd.oasis.opendocument.chart	OpenDocument Chart
50638	string		application/vnd.oasis.opendocument.database	OpenDocument Database
50738	string		application/vnd.sun.xml.base			OpenDocument Database
50838	string		application/vnd.oasis.opendocument.formula	OpenDocument Formula
50938	string		application/vnd.oasis.opendocument.image	OpenDocument Image
51038	string		application/vnd.oasis.opendocument.text-web	HTML Document Template
51138	string		application/vnd.oasis.opendocument.text-	OpenDocument
512>78	string		template						Text Template
513>78	string		master							Master Document
51438	string		application/vnd.oasis.opendocument.text		OpenDocument Text
51538	string		application/vnd.oasis.opendocument.graphics	OpenDocument Drawing
516>81	string		-template						Template
51738	string		application/vnd.oasis.opendocument.presentation	OpenDocument Presentation
518>85	string		-template						Template
51938	string		application/vnd.oasis.opendocument.spreadsheet	OpenDocument Spreadsheet
520>84	string		-template						Template
5210	string		PK\003\004	ZIP archive
5220	string		MZ		DOS executable (EXE)
5230	string		LZ		DOS built-in
5240	byte		0xe9		DOS executable (COM)
5250	byte		0xeb		DOS executable (COM)
52624	long		60012		ufsdump archive file
5270	string		TZif		zoneinfo timezone data file
5280	string		BZh		bzip2 compressed data
529>3	byte		>47		, block size = %c00k
5300	string		SUNWcpch	Sun C compiler precompiled header
5310	string		SUNWCpch	Sun C++ compiler precompiled header
5320	string		\043\040PaCkAgE\040DaTaStReAm	package datastream
5330	short		0xcff1		CTF data file
5340	string		\177DOF		DTrace DOF data file
5350	string		\177FCF		fmd(1M) checkpoint file
5360	string		EFT\0		Fault tree file,
537>4	ushort		x		v%u
538>6	ushort		x		rev %u,
539>8	ushort		x		from esc v%u
540>10	ushort		x		rev %u
5410	string		_SM_		DMTF SMBIOS image
542>6	byte		x		version %u
543>7	byte		x		.%u
5440	byte		0x11		Solaris Audit File
5450	byte		0x78		Solaris Audit File
546# ZFS send stream entries
5478	ullong		0x00000002f5bacbac	ZFS snapshot stream
548# little endian stream
5498	ullong		0xaccbbaf502000000	ZFS snapshot stream
550