xref: /titanic_50/usr/src/cmd/file/magic (revision 28e4da25922bdfc5cba7ab29f47de911bbd78009)
1 #
2 # Copyright (c) 1988, 2010, Oracle and/or its affiliates. All rights reserved.
3 #
4 # CDDL HEADER START
5 #
6 # The contents of this file are subject to the terms of the
7 # Common Development and Distribution License (the "License").
8 # You may not use this file except in compliance with the License.
9 #
10 # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
11 # or http://www.opensolaris.org/os/licensing.
12 # See the License for the specific language governing permissions
13 # and limitations under the License.
14 #
15 # When distributing Covered Code, include this CDDL HEADER in each
16 # file and include the License file at usr/src/OPENSOLARIS.LICENSE.
17 # If applicable, add the following below this CDDL HEADER, with the
18 # fields enclosed by brackets "[]" replaced with your own identifying
19 # information: Portions Copyright [yyyy] [name of copyright owner]
20 #
21 # CDDL HEADER END
22 #
23 # This file contains the dictionary of file format identifiers (magic strings)
24 # used by file(1).  The fields of this file are as follows:
25 #
26 # (1) byte offset
27 # (2) value type
28 # (3) optional operator (= by default)
29 # (4) value to match (numeric or string)
30 # (5) string to be printed
31 #
32 # Numeric values may be decimal, octal, or hex.  Also note that the last string
33 # may have one printf format specifier.  The '>' in occassional column 1's is
34 # magic: it forces file(1) to continue scanning and matching additional lines.
35 # The first line afterwards not so marked terminates the search.
36 #
37 # The entries for ELF are not needed anymore, as file(1) now uses the elf(3ELF)
38 # routines to look at ELF files.  They remain, commented out, for reference.
39 #
40 #0	string		\177ELF		ELF
41 #>4	byte		1		32-bit
42 #>5	byte		1		LSB
43 #>5	byte		2		MSB
44 #>16	short		0		unknown type
45 #>16	short		1		relocatable
46 #>16	short		2		executable
47 #>16	short		3		dynamic lib
48 #>16	short		4		core file
49 #>18	short		0		unknown machine
50 #>18	short		1		WE32100
51 #>18	short		2		SPARC
52 #>18	short		3		80386
53 #>18	short		4		M68000
54 #>18	short		5		M88000
55 #>18	short		6		i80486
56 #>18	short		7		i860
57 #>18	short		8		RS3000_BE
58 #>18	short		9		UNKNOWN
59 #>18	short		10		RS3000_LE
60 #>18	short		11		RS6000
61 #>18	short		12		UNKNOWN
62 #>18	short		13		UNKNOWN
63 #>18	short		14		UNKNOWN
64 #>18	short		15		PA_RISC
65 #>18	short		16		nCUBE
66 #>18	short		17		VPP500
67 #>18	short		18		SPARC32PLUS
68 #>18	short		19		UNKNOWN
69 #>18	short		20		PowerPC
70 #>20	long		1		Version 1
71 #>36	long		1		MAU Required
72 257	string		ustar		USTAR tar archive
73 >156	byte		88		extended format
74 0	short		070701		cpio archive
75 0	string		070701		ASCII cpio archive
76 0	short		070702		cpio archive - CRC header
77 0	string		070702		ASCII cpio archive - CRC header
78 0	short		070707		cpio archive - CHR (-c) header
79 0	string		070707		ASCII cpio archive - CHR (-c) header
80 0	long		0177555		obsolete ar archive
81 0	short		0177545		pdp11/pre System V ar archive
82 0	long		0100554		apl workspace
83 0	short		017037		packed data
84 0	string		<ar>		System V Release 1 ar archive
85 0	string		!<arch>		current ar archive
86 0	short		0407		pdp11/pre System V vax executable
87 >8	ushort		>0		not stripped
88 >15	ubyte		>0		- version %ld
89 0	short		0401		unix-rt ldp
90 0	short		0405		pdp11 overlay
91 0	short		0410		pdp11/pre System V vax pure executable
92 >8	ushort		>0		not stripped
93 >15	ubyte		>0		- version %ld
94 0	short		0411		pdp11 separate I&D
95 >8	ushort		>0		not stripped
96 >15	ubyte		>0		- version %ld
97 0	short		015001		Compiled Terminfo Entry
98 # little-endian entry
99 0	short		0432		Compiled Terminfo Entry
100 0	short		0433		Curses screen image
101 0	short		0434		Curses screen image
102 0	short		0437		pdp11 kernel overlay
103 0	short		0570		vax executable
104 >12	long		>0		not stripped
105 >22	ushort		>0		- version %ld
106 0	short		0575		vax pure executable
107 >12	long		>0		not stripped
108 >22	ushort		>0		- version %ld
109 0	short		0502		basic-16 executable
110 >12	long		>0		not stripped
111 >22	ushort		>0		- version %ld
112 0	short		0503		basic-16 executable (TV)
113 >12	long		>0		not stripped
114 >22	ushort		>0		- version %ld
115 0	short		0510		x86 executable
116 >12	long		>0		not stripped
117 0	short		0511		x86 executable (TV)
118 >12	long		>0		not stripped
119 0	short		0550		3b20 executable
120 >12	long		>0		not stripped
121 >22	ushort		>0		- version %ld
122 0	short		0551		3b20 executable (TV)
123 >12	long		>0		not stripped
124 >22	ushort		>0		- version %ld
125 0	short		0560		WE32000 executable
126 >12	long		>0		not stripped
127 >18	short		^00010000	- N/A on 3b2/300 w/paging
128 >18	short		&00020000	- 32100 required
129 >18	short		&00040000	and mau hardware required
130 >20	short		0443		(target shared library)
131 >20	short		0410		(swapped)
132 >20	short		0413		(paged)
133 >22	ushort		>0		- version %ld
134 0	short		0561		WE32000 executable (TV)
135 >12	long		>0		not stripped
136 >18	short		&00020000	- 32100 required
137 >18	short		&00040000	and mau hardware required
138 >22	ushort		>0		- version %ld
139 0	short		=0512		iAPX 286 executable small model (COFF)
140 >12	long		>0		not stripped
141 >22	ushort		>0		- version %ld
142 0	short		=0522		iAPX 286 executable large model (COFF)
143 >12	long		>0		not stripped
144 >22	ushort		>0		- version %ld
145 0	short		0514		iAPX 386 executable (COFF) (deprecated)
146 >12	long		>0		not stripped
147 >22	ushort		>0		- version %ld
148 0	short		0520		mc68k executable
149 >12	long		>0		not stripped
150 0	short		0521		mc68k executable (shared)
151 >12	long		>0		not stripped
152 0	short		0522		mc68k executable (shared demand paged)
153 >12	long		>0		not stripped
154 # big-endian entries for pure executables
155 2	short		0410		pure
156 >1	byte		0		sun2 executable
157 >1	byte		1		mc68010 executable
158 >1	byte		2		mc68020 executable
159 >1	byte		3		SPARC executable
160 >0	ubyte		>077		dynamically linked
161 # little-endian entries for pure executables
162 2	short		04001		pure
163 >1	byte		0		sun2 executable
164 >1	byte		1		mc68010 executable
165 >1	byte		2		mc68020 executable
166 >1	byte		3		SPARC executable
167 >0	ubyte		>077		dynamically linked
168 # big-endian entries for impure executables
169 2	short		0407		impure
170 >1	byte		0		sun2 executable
171 >1	byte		1		mc68010 executable
172 >1	byte		2		mc68020 executable
173 >1	byte		3		SPARC executable
174 >0	ubyte		>077		dynamically linked
175 # little-endian entries for impure executables
176 2	short		03401		impure
177 >1	byte		0		sun2 executable
178 >1	byte		1		mc68010 executable
179 >1	byte		2		mc68020 executable
180 >1	byte		3		SPARC executable
181 >0	ubyte		>077		dynamically linked
182 # big-endian entries for Sun demand paged executables
183 2	short		0413		Sun demand paged
184 >1	byte		0		sun2 executable
185 >1	byte		1		mc68010 executable
186 >1	byte		2		mc68020 executable
187 >1	byte		3		SPARC executable
188 >0	ubyte		>077		dynamically linked
189 # little-endian entries for Sun demand paged executables
190 2	short		05401		Sun demand paged
191 >1	byte		0		sun2 executable
192 >1	byte		1		mc68010 executable
193 >1	byte		2		mc68020 executable
194 >1	byte		3		SPARC executable
195 >0	ubyte		>077		dynamically linked
196 0	short		0x8001		Adobe PostScript Type 1 binary font (PFB)
197 0	short		0x0180		Adobe PostScript Type 1 binary font (PFB)
198 0	long		0x00010000	TrueType font file version 1.0 (TTF)
199 0	long		0x00000100	TrueType font file version 1.0 (TTF)
200 0	long		0xf00000ff	extended accounting file
201 # little-endian entry
202 0	long		0xff0000f0	extended accounting file
203 0	byte		0x80		8086 relocatable (Microsoft)
204 0	byte		0xf0		MS-DOS library
205 0	short		0xff65		x.out
206 >2	string		__.SYMDEF	randomized
207 >0	byte		x		archive
208 0	short		0x206		Microsoft a.out
209 >0x1e	short		&0x10		overlay
210 >0x1e	short		&0x2		separate
211 >0x1e	short		&0x4		pure
212 >0x1e	short		&0x800		segmented
213 >0x1e	short		&0x400		standalone
214 >0x1e	short		&0x8		fixed-stack
215 >0x1c	byte		&0x80		byte-swapped
216 >0x1c	byte		&0x40		word-swapped
217 >0x10	long		>0		not-stripped
218 >0x1e	short		^0xc000		pre-SysV
219 >0x1c	byte		&0x4		86
220 >0x1c	byte		&0x9		286
221 >0x1c	byte		&0xa		386
222 >0x1e	short		&0x1		executable
223 >0x1e	short		^0x1		object file
224 >0x1e	short		&0x40		Large Text
225 >0x1e	short		&0x20		Large Data
226 >0x1e	short		&0x120		Huge Objects Enabled
227 0	short		0x10b		VAX demand load format a.out object file
228 >0x10	long		>0		not stripped
229 0	short		0x140		old Microsoft 8086 x.out
230 >0x3	byte		&0x4		separate
231 >0x3	byte		&0x2		pure
232 >0	byte		&0x1		executable
233 >0	byte		^0x1		relocatable
234 >0x14	long		>0		not stripped
235 0	long		0x10b		VAX demand load format a.out object file
236 >0x10	long		>0		not stripped
237 0	long		0x140		old Microsoft 8086 x.out
238 >0x3	byte		&0x4		separate
239 >0x3	byte		&0x2		pure
240 >0	byte		&0x1		executable
241 >0	byte		^0x1		relocatable
242 >0x14	long		>0		not stripped
243 0	long		0xe807		object file (z8000 a.out)
244 0	long		0xe808		pure object file (z8000 a.out)
245 0	long		0xe809		separate object file (z8000 a.out)
246 0	long		0xe805		overlay object file (z8000 a.out)
247 0	long		0x178		Bell 5.0 executable
248 2	short		0410		Sun read-only text executable
249 >2	short		0407		Sun old executable
250 >1	byte		3		(SPARC)
251 >1	byte		2		(68020)
252 >1	byte		1		(68010)
253 >1	byte		0		(Sun2)
254 0	short		0143561		byte-swapped cpio archive
255 0	long		0101555		PDP-11 single precision APL workspace
256 0	long		0101554		PDP-11 double precision APL workspace
257 0	long		0101557		VAX single precision APL workspace
258 0	long		0101556		VAX double precision APL workspace
259 0	short		017437		old packed data
260 0	string		\037\036	packed data
261 0	string		\377\037	compacted data
262 0	string		\037\235	compressed data
263 >2	byte&0x80	>0		block compressed
264 >2	byte&0x1f	x		%d bits
265 0	string		\037\213	gzip compressed data
266 >2	byte		8		- deflate method
267 >3	byte		&0x1		, ascii
268 >3	byte		&0x2		, continuation
269 >3	byte		&0x4		, extra field
270 >3	byte		&0x8		, original file name
271 >3	byte		&0x10		, comment
272 >3	byte		&0x20		, encrypted
273 >8	byte		2		, max compression
274 >8	byte		4		, max speed
275 0	string		!<arch>\n__.SYMDEF	archive random library
276 0	long		0x1010101	MMDF mailbox
277 0	string		<!OPS		Interleaf ASCII document
278 24	string		SunGKS		SunGKS
279 # version number follows, in the form m.n
280 >0	string		GKSM		Metafile
281 0	string		GKSM		GKS Metafile
282 # version number follows, in the form <!OPS, Version n.n>
283 0	string		%!PS-AdobeFont	Adobe PostScript ASCII font (PFA)
284 0	string		%!		PostScript document
285 >2	string		PS-Adobe	 conforming to level
286 >10	string		-1.0		 1.0
287 >10	string		-2.0		 2.0
288 >10	string		-3.0		 3.0
289 # Handle Microsoft PostScript files (CTRL-D%!)
290 0	string		\004%!		PostScript document text
291 # version ID follows, in the form PS-Adobe-nn
292 0	string		Interpress/Xerox	Interpress document
293 # version ID follows, in the form /n.n
294 0	string		StartFontMetrics	Adobe font metrics
295 0	string		StartFont	Adobe font bits
296 0	long		0x137A2944	NeWS bitmap font
297 0	long		0x137A2947	NeWS font family
298 8	long		0x137A2B45	X11/NeWS bitmap font
299 8	long		0x137A2B48	X11/NeWS font family
300 # snoop files are always big-endian
301 # big-endian entries, with ullong equivalent of string "snoop"
302 0	ullong		0x736e6f6f70000000	Snoop capture file
303 >8	long		>0		- version %ld
304 # little-endian entries, with ullong equivalent of string "snoop"
305 0	ullong		0x000000706f6f6e73	Snoop capture file
306 >11	long		>0		- version %ld
307 0	short		0436		vfont definition
308 0	string		<MakerFile	Frame Maker document
309 0	string		<MIFFile	Frame Maker MIF file
310 0	string		<MML		Frame Maker MML file
311 0	string		<BookFile	Frame Maker book file
312 # Audio files are always big-endian so there are two sets of tables here.
313 # The CPU endian architecture is determined via the ordering of the first 4 bytes
314 # (the string ".snd"). The tables below have this value represented as a single
315 # 4 byte long. If the architecture is big-endian the %d token can be used for
316 # interpreting the sampling rate.
317 # Since %d can't be done on the data for little endian machines the limitation
318 # is that sampling rates not included in the x86 entries will not be recognized.
319 #
320 # big-endian entries
321 #
322 0	long		0x2e736e64	audio data:
323 >12	long		1		8-bit u-law,
324 >12	long		2		8-bit linear PCM,
325 >12	long		3		16-bit linear PCM,
326 >12	long		4		24-bit linear PCM,
327 >12	long		5		32-bit linear PCM,
328 >12	long		6		32-bit floating point,
329 >12	long		7		64-bit floating point,
330 >12	long		23		compressed (4-bit G.721 ADPCM),
331 >12	long		24		compressed (8-bit G.722 ADPCM),
332 >12	long		25		compressed (3-bit G.723 ADPCM),
333 >12	long		26		compressed (5-bit G.723 ADPCM),
334 >12	long		27		8-bit A-law,
335 >20	long		1		mono,
336 >20	long		2		stereo,
337 >20	long		4		quad,
338 >16	long		x		%d Hz
339 #
340 # little-endian entries
341 #
342 0	long		0x646e732e	audio data:
343 >12	long		0x01000000	8-bit u-law,
344 >12	long		0x02000000	8-bit linear PCM,
345 >12	long		0x03000000	16-bit linear PCM,
346 >12	long		0x04000000	24-bit linear PCM,
347 >12	long		0x05000000	32-bit linear PCM,
348 >12	long		0x06000000	32-bit floating point,
349 >12	long		0x07000000	64-bit floating point,
350 >12	long		0x17000000	compressed (4-bit G.721 ADPCM),
351 >12	long		0x18000000	compressed (8-bit G.722 ADPCM),
352 >12	long		0x19000000	compressed (3-bit G.723 ADPCM),
353 >12	long		0x1a000000	compressed (5-bit G.723 ADPCM),
354 >12	long		0x1b000000	8-bit A-law,
355 >20	long		0x01000000	mono,
356 >20	long		0x02000000	stereo,
357 >20	long		0x04000000	quad,
358 >16	long		0x401f0000	8000 Hz
359 >16	long		0x80250000	9600 Hz
360 >16	long		0x112b0000	11025 Hz
361 >16	long		0x803e0000	16000 Hz
362 >16	long		0xd4490000	18900 Hz
363 >16	long		0x22560000	22050 Hz
364 >16	long		0x007d0000	32000 Hz
365 >16	long		0xa8930000	37800 Hz
366 >16	long		0x44ac0000	44100 Hz
367 >16	long		0x80bb0000	48000 Hz
368 # .wav files are always little-endian
369 # .wav big-endian entries, starting with long value for the string "RIFF"
370 0	long		0x52494646	audio data:
371 >34	short		0x0800		8-bit
372 >34	short		0x1000		16-bit
373 >20	short		0x0100		linear PCM,
374 >20	short		0x0200		MS ADPCM,
375 >20	short		0x0600		A-law,
376 >20	short		0x0700		u-law,
377 >20	short		0x1100		DVI ADPCM,
378 >22	short		0x0100		mono
379 >22	short		0x0200		stereo
380 # .wav little-endian entries, starting with long value for the string "RIFF"
381 0	long		0x46464952	audio data:
382 >34	short		0x0008		8-bit
383 >34	short		0x0010		16-bit
384 >20	short		0x0001		linear PCM,
385 >20	short		0x0002		MS ADPCM,
386 >20	short		0x0006		A-law,
387 >20	short		0x0007		u-law,
388 >20	short		0x0011		DVI ADPCM,
389 >22	short		0x0001		mono
390 >22	short		0x0002		stereo
391 # .aiff files are always big-endian
392 # .aiff big-endian entries, starting with long value for the string "FORM"
393 0	long		0x464f524d	audio data:
394 >26	short		0x0008		8-bit linear PCM,
395 >26	short		0x0010		16-bit linear PCM,
396 >20	short		0x0001		mono
397 >20	short		0x0002		stereo
398 # .aiff little-endian entries, starting with long value for the string "FORM"
399 0	long		0x4d524f46	audio data:
400 >26	short		0x0800		8-bit linear PCM,
401 >26	short		0x1000		16-bit linear PCM,
402 >20	short		0x0100		mono
403 >20	short		0x0200		stereo
404 # .mid files are always big-endian
405 # .mid big-endian entries, starting with long value for the string "MThd"
406 0	long		0x4d546864	MIDI data:
407 >8	short		x		type %u,
408 >10	short		x		%u track(s)
409 # .mid little-endian entry (the string "MThd")
410 # can't translate big-endian type and track information
411 0	long		0x6468544d	MIDI data
412 #
413 0	short		0x1010		PEX Binary Archive
414 # rasterfiles are big-endian
415 # big-endian rasterfile entries
416 0	long		0x59a66a95	rasterfile,
417 >4	long		>0		%ld x
418 >8	long		>0		%ld x
419 >12	long		>0		%ld
420 >20	long		0		old format image
421 >20	long		1		standard format image
422 >20	long		2		run-length byte encoded image
423 >20	long		3		XRGB or RGB format image
424 >20	long		4		tiff format image
425 >20	long		5		iff (TAAC format) image
426 >20	long		0xffff		experimental format image
427 # little-endian rasterfile entries
428 # cannot translate resolution stored as big-endian longs
429 0	long		0x956aa659	rasterfile,
430 >23	long		0		old format image
431 >23	long		1		standard format image
432 >23	long		2		run-length byte encoded image
433 >23	long		3		XRGB or RGB format image
434 >23	long		4		tiff format image
435 >23	long		5		iff (TAAC format) image
436 >20	long		0xffff		experimental format image
437 0	long		0x884f5053	Interleaf fast-saved document
438 0	long		0x2a535441	Aster*x
439 >7	long		0x574f5244		Words Document
440 >7	long		0x47524150		Graphic
441 >7	long		0x53505245		Spreadsheet
442 >7	long		0x4d414352		Macro
443 0	long		0x32323738	Aster*x Version 2
444 >29	byte		0x36			Words Document
445 >29	byte		0x35			Graphic
446 >29	byte		0x32			Spreadsheet
447 >29	byte		0x38			Macro
448 4	string		pgscriptver	IslandWrite document
449 13	string		DrawFile	IslandDraw document
450 0	string		P1		PBM ascii file
451 0	string		P2		PGM ascii file
452 0	string		P3		PPM ascii file
453 0	string		P4		PBM raw file
454 0	string		P5		PGM raw file
455 0	string		P6		PPM raw file
456 0	string		\115\115	TIFF file, big-endian
457 0	string		\111\111	TIFF file, little-endian
458 0	string		GIF87a		GIF file, v87
459 0	string		GIF89a		GIF file, v89
460 0	string		\377\330\377\340	JPEG file
461 0	string		\377\330\377\341	JPEG file
462 0	string		\377\330\377\356	JPG file
463 8	string		ILBM		IFF ILBM file
464 0	string		\312\376\272\276	java class file
465 36	string		acsp	Kodak Color Management System, ICC Profile
466 0	string		%PDF		Adobe Portable Document Format (PDF)
467 >4	string		-1.0		v1.0
468 >4	string		-1.1		v1.1
469 >4	string		-1.2		v1.2
470 >4	string		-1.3		v1.3
471 >4	string		-1.4		v1.4
472 >4	string		-1.5		v1.5
473 0	string		<html		html document
474 0	string		<HTML		html document
475 0	string		<Html		html document
476 0	string		<!doctype HTML	html document
477 0	string		<!doctype Html	html document
478 0	string		<!doctype html	html document
479 0	string		<!DOCTYPE HTML	html document
480 0	string		<!DOCTYPE Html	html document
481 0	string		<!DOCTYPE html	html document
482 0	string		<!Doctype HTML	html document
483 0	string		<!Doctype Html	html document
484 0	string		<!Doctype html	html document
485 0	string		<head		html document
486 0	string		<HEAD		html document
487 0	string		<Head		html document
488 0	string		<title		html document
489 0	string		<TITLE		html document
490 0	string		<Title		html document
491 0	string		<?xml		XML document
492 0	string		<?XML		XML document
493 0	string		<?Xml		XML document
494 0	string		\0211PNG	PNG image data
495 0	string		.RMF		RealMedia file
496 0	string		FlAsH-aRcHiVe	Flash Archive
497 >13	string		-1.0		 1.0
498 >13	string		-2.0		 2.0
499 38	string		application/vnd.sun.xml.writer	StarOffice 7 Text Document
500 38	string		application/vnd.sun.xml.calc	StarOffice 7 Spreadsheet
501 38	string		application/vnd.sun.xml.draw	StarOffice 7 Drawing
502 38	string		application/vnd.sun.xml.impress	StarOffice 7 Presentation
503 38	string		application/vnd.sun.xml.math	StarOffice 7 Formula
504 38	string		application/vnd.oasis.opendocument.chart	OpenDocument Chart
505 38	string		application/vnd.oasis.opendocument.database	OpenDocument Database
506 38	string		application/vnd.sun.xml.base			OpenDocument Database
507 38	string		application/vnd.oasis.opendocument.formula	OpenDocument Formula
508 38	string		application/vnd.oasis.opendocument.image	OpenDocument Image
509 38	string		application/vnd.oasis.opendocument.text-web	HTML Document Template
510 38	string		application/vnd.oasis.opendocument.text-	OpenDocument
511 >78	string		template						Text Template
512 >78	string		master							Master Document
513 38	string		application/vnd.oasis.opendocument.text		OpenDocument Text
514 38	string		application/vnd.oasis.opendocument.graphics	OpenDocument Drawing
515 >81	string		-template						Template
516 38	string		application/vnd.oasis.opendocument.presentation	OpenDocument Presentation
517 >85	string		-template						Template
518 38	string		application/vnd.oasis.opendocument.spreadsheet	OpenDocument Spreadsheet
519 >84	string		-template						Template
520 0	string		PK\003\004	ZIP archive
521 0	string		MZ		DOS executable (EXE)
522 0	string		LZ		DOS built-in
523 0	byte		0xe9		DOS executable (COM)
524 0	byte		0xeb		DOS executable (COM)
525 0	string		\013\023\010\000	ksh compiled shell script executable
526 24	long		60012		ufsdump archive file
527 0	string		TZif		zoneinfo timezone data file
528 0	string		BZh		bzip2 compressed data
529 >3	byte		>47		, block size = %c00k
530 0	string		SUNWcpch	Sun C compiler precompiled header
531 0	string		SUNWCpch	Sun C++ compiler precompiled header
532 0	string		\043\040PaCkAgE\040DaTaStReAm	package datastream
533 0	short		0xcff1		CTF data file
534 0	string		\177DOF		DTrace DOF data file
535 0	string		\177FCF		fmd(1M) checkpoint file
536 0	string		EFT\0		Fault tree file,
537 >4	ushort		x		v%u
538 >6	ushort		x		rev %u,
539 >8	ushort		x		from esc v%u
540 >10	ushort		x		rev %u
541 0	string		_SM_		DMTF SMBIOS image
542 >6	byte		x		version %u
543 >7	byte		x		.%u
544 0	byte		0x11		Solaris Audit File
545 0	byte		0x78		Solaris Audit File
546 # ZFS send stream entries
547 8	ullong		0x00000002f5bacbac	ZFS snapshot stream
548 # little endian stream
549 8	ullong		0xaccbbaf502000000	ZFS snapshot stream
550 
551 
552 # Video files
553 2	string		\001\272\041	MPEG Movie file
554 0	string		\377\375	MPEG-1 Audio Layer 2
555 0	string		\377\373	MPEG-1 Audio Layer 3
556 0	string		\377\372	MPEG-1 Audio Layer 3
557 0	string		\111\104\063	MPEG-1 Layer 3 with ID3v2
558 
559 # AVI and GVI files
560 20	string	hdrlavih	RIFF Avi Video
561 >36	ulong	>0		%u Max Bps,
562 >64	ushort	x		%u X
563 >68	ushort	x		%u,
564 >48	ulong	x		%u frames
565 
566 20	string	goog		RIFF gvi
567 >88	ulong	>0		%u Max Bps
568 >116	ushort	x		%u X
569 >120	ushort	x		%u,
570 >100	ulong	x		%u frames
571 
572 # JPEG 2000 - jp2 image file.
573 3	string		\014\152\120\040\040	JPEG 2000 Image file
574 
575 # iso 9660 CD-ROM image and El Torito Bootable standard
576 32769	string		CD\0		ISO 9660 filesystem image
577 >34823	string		EL\040TORITO	- El Torito
578 
579 # Palm Pilot files .pdb and .prc of some type.
580 0x3c	string	TEXtREAd		Palm DOC file
581 0x3c	string	SDocSilX		iSilo 3 Doc file for PalmPilot
582 0x3c	string	applSil			iSilo Application file
583 0x3c	string	appl			Palm Pilot Application
584 0x3c	string	ToGoToGo		iSilo Doc file for Palm Pilot
585 
586 #SGI files with .rgb extention
587 0	string	\001\332			SGI Image data,
588 >2	byte	1			RLE,
589 >2	byte	0			Verbatim,
590 >5	ubyte	x			%u-D
591 >7	ubyte	x			%u x
592 >9	ubyte	x			%u,
593 >11	ubyte	x			%u channel(s)
594 
595 2048	string		PCD_IPI		Kodak Photo CD image pack file
596 >0xe02	byte&0x03	0x00		, landscape mode
597 >0xe02	byte&0x03	0x01		, portrait mode
598 >0xe02	byte&0x03	0x02		, landscape mode
599 >0xe02	byte&0x03	0x03		, portrait mode
600 0	string		PCD_OPA		Kodak Photo CD overview pack file
601 
602 # MS Documents. Not much info available.
603 0	string	\320\317\021\340\241\261\032\341	Microsoft
604 >546	string	bjbj					Word
605 >0	byte	<0					Document
606 0	string	{\\rtf		Microsoft Rich Text Format Document
607 
608 # mp4 media format with different media files embedded in it
609 4	string	ftyp		MPEG-4
610 >8	string	isom		Base Media v1 [IS0 14496-12:2003]
611 >8	string	iso2		Base Media v2 [ISO 14496-12:2005]
612 >8	string	m4a\040		Apple iTunes AAC-LC (.M4A) Audio
613 >8	string	m4v\040		Apple iTunes (.M4V) Video
614 >8	string	qt		Apple QuickTime (.MOV/QT)
615 >8	string	jp2		JPEG 2000 Image
616 >8	string	jpm		JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
617 >8	string	jpx		JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
618 >8	string	mp42		v2 [ISO 14496-14]
619 4	string	moov		QuickTime MOV file
620 
621 0	string		\375\067\172\130\132\000	xz compressed data
622