|
@@ -7,9 +7,13 @@
|
|
|
# updated by Joerg Jenderek
|
|
|
0 string @
|
|
|
>1 string/cB \ echo\ off MS-DOS batch file text
|
|
|
+!:mime text/x-msdos-batch
|
|
|
>1 string/cB echo\ off MS-DOS batch file text
|
|
|
+!:mime text/x-msdos-batch
|
|
|
>1 string/cB rem\ MS-DOS batch file text
|
|
|
+!:mime text/x-msdos-batch
|
|
|
>1 string/cB set\ MS-DOS batch file text
|
|
|
+!:mime text/x-msdos-batch
|
|
|
|
|
|
|
|
|
# OS/2 batch files are REXX. the second regex is a bit generic, oh well
|
|
@@ -39,14 +43,15 @@
|
|
|
#
|
|
|
# Required OS version and subsystem version were 4.0 on some NT 3.51
|
|
|
# executables built with Visual C++ 4.0, so it's not clear that
|
|
|
-# they're interesting. The user version was 0.0, but there's
|
|
|
+# they're interesting. The user version was 0.0, but there's
|
|
|
# probably some linker directive to set it. The linker version was
|
|
|
# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
|
|
|
#
|
|
|
# many of the compressed formats were extraced from IDARC 1.23 source code
|
|
|
#
|
|
|
-0 string MZ MS-DOS executable
|
|
|
+0 string MZ
|
|
|
!:mime application/x-dosexec
|
|
|
+>0x18 leshort <0x40 MS-DOS executable
|
|
|
>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows
|
|
|
>>&18 leshort&0x2000 >0 (DLL)
|
|
|
>>&88 leshort 0 (unknown subsystem)
|
|
@@ -72,27 +77,35 @@
|
|
|
!:mime application/zip
|
|
|
|
|
|
>0x18 leshort >0x3f
|
|
|
->>(0x3c.l) string PE\0\0 PE
|
|
|
+>>(0x3c.l) string PE\0\0 PE
|
|
|
+>>>(0x3c.l+25) byte 1 \b32 executable
|
|
|
+>>>(0x3c.l+25) byte 2 \b32+ executable
|
|
|
# hooray, there's a DOS extender using the PE format, with a valid PE
|
|
|
# executable inside (which just prints a message and exits if run in win)
|
|
|
->>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender
|
|
|
->>>(8.s*16) string !32STUB for MS Windows
|
|
|
->>>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
|
|
|
->>>>(0x3c.l+92) leshort 0 (unknown subsystem)
|
|
|
->>>>(0x3c.l+92) leshort 1 (native)
|
|
|
->>>>(0x3c.l+92) leshort 2 (GUI)
|
|
|
->>>>(0x3c.l+92) leshort 3 (console)
|
|
|
->>>>(0x3c.l+92) leshort 7 (POSIX)
|
|
|
->>>>(0x3c.l+4) leshort 0x0 unknown processor
|
|
|
->>>>(0x3c.l+4) leshort 0x14c Intel 80386
|
|
|
->>>>(0x3c.l+4) leshort 0x166 MIPS R4000
|
|
|
->>>>(0x3c.l+4) leshort 0x184 Alpha
|
|
|
->>>>(0x3c.l+4) leshort 0x268 Motorola 68000
|
|
|
->>>>(0x3c.l+4) leshort 0x1f0 PowerPC
|
|
|
->>>>(0x3c.l+4) leshort 0x290 PA-RISC
|
|
|
->>>>(0x3c.l+22) leshort&0x0100 >0 32-bit
|
|
|
->>>>(0x3c.l+22) leshort&0x1000 >0 system file
|
|
|
->>>>(0x3c.l+232) lelong >0 Mono/.Net assembly
|
|
|
+>>>(0x3c.l+92) leshort <10
|
|
|
+>>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender
|
|
|
+>>>>(8.s*16) string !32STUB for MS Windows
|
|
|
+>>>>>(0x3c.l+22) leshort&0x2000 >0 (DLL)
|
|
|
+>>>>>(0x3c.l+92) leshort 0 (unknown subsystem)
|
|
|
+>>>>>(0x3c.l+92) leshort 1 (native)
|
|
|
+>>>>>(0x3c.l+92) leshort 2 (GUI)
|
|
|
+>>>>>(0x3c.l+92) leshort 3 (console)
|
|
|
+>>>>>(0x3c.l+92) leshort 7 (POSIX)
|
|
|
+>>>(0x3c.l+92) leshort 10 (EFI application)
|
|
|
+>>>(0x3c.l+92) leshort 11 (EFI boot service driver)
|
|
|
+>>>(0x3c.l+92) leshort 12 (EFI runtime driver)
|
|
|
+>>>(0x3c.l+92) leshort 13 (XBOX)
|
|
|
+>>>(0x3c.l+4) leshort 0x0 unknown processor
|
|
|
+>>>(0x3c.l+4) leshort 0x14c Intel 80386
|
|
|
+>>>(0x3c.l+4) leshort 0x166 MIPS R4000
|
|
|
+>>>(0x3c.l+4) leshort 0x184 Alpha
|
|
|
+>>>(0x3c.l+4) leshort 0x268 Motorola 68000
|
|
|
+>>>(0x3c.l+4) leshort 0x1f0 PowerPC
|
|
|
+>>>(0x3c.l+4) leshort 0x290 PA-RISC
|
|
|
+>>>(0x3c.l+4) leshort 0x200 Intel Itanium
|
|
|
+>>>(0x3c.l+22) leshort&0x0100 >0 32-bit
|
|
|
+>>>(0x3c.l+22) leshort&0x1000 >0 system file
|
|
|
+>>>(0x3c.l+232) lelong >0 Mono/.Net assembly
|
|
|
|
|
|
>>>>(0x3c.l+0xf8) string UPX0 \b, UPX compressed
|
|
|
>>>>(0x3c.l+0xf8) search/0x140 PEC2 \b, PECompact2 compressed
|
|
@@ -121,6 +134,8 @@
|
|
|
>>>>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
|
|
|
>>>>0x30 string Inno \b, InnoSetup self-extracting archive
|
|
|
|
|
|
+>>(0x3c.l) string !PE\0\0 MS-DOS executable
|
|
|
+
|
|
|
>>(0x3c.l) string NE \b, NE
|
|
|
>>>(0x3c.l+0x36) byte 0 (unknown OS)
|
|
|
>>>(0x3c.l+0x36) byte 1 for OS/2 1.x
|
|
@@ -182,7 +197,7 @@
|
|
|
>>>(4.s*512) leshort !0x014c \b, MZ for MS-DOS
|
|
|
# header data too small for extended executable
|
|
|
>2 long !0
|
|
|
->>0x18 leshort <0x40
|
|
|
+>>0x18 leshort <0x40
|
|
|
>>>(4.s*512) leshort !0x014c
|
|
|
|
|
|
>>>>&(2.s-514) string !LE
|
|
@@ -212,31 +227,31 @@
|
|
|
|
|
|
# .EXE formats (Greg Roelofs, newt@uchicago.edu)
|
|
|
#
|
|
|
->0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
|
|
|
+>0x35 string \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
|
|
|
>0xe7 string LH/2\ Self-Extract \b, %s
|
|
|
>0x1c string diet \b, diet compressed
|
|
|
>0x1c string LZ09 \b, LZEXE v0.90 compressed
|
|
|
>0x1c string LZ91 \b, LZEXE v0.91 compressed
|
|
|
->0x1c string tz \b, TinyProg compressed
|
|
|
+>0x1c string tz \b, TinyProg compressed
|
|
|
>0x1e string PKLITE \b, %s compressed
|
|
|
->0x64 string W\ Collis\0\0 \b, Compack compressed
|
|
|
+>0x64 string W\ Collis\0\0 \b, Compack compressed
|
|
|
>0x24 string LHa's\ SFX \b, LHa self-extracting archive
|
|
|
!:mime application/x-lha
|
|
|
>0x24 string LHA's\ SFX \b, LHa self-extracting archive
|
|
|
!:mime application/x-lha
|
|
|
->0x24 string \ $ARX \b, ARX self-extracting archive
|
|
|
->0x24 string \ $LHarc \b, LHarc self-extracting archive
|
|
|
->0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
|
|
|
+>0x24 string \ $ARX \b, ARX self-extracting archive
|
|
|
+>0x24 string \ $LHarc \b, LHarc self-extracting archive
|
|
|
+>0x20 string SFX\ by\ LARC \b, LARC self-extracting archive
|
|
|
>1638 string -lh5- \b, LHa self-extracting archive v2.13S
|
|
|
->0x17888 string Rar! \b, RAR self-extracting archive
|
|
|
->0x40 string aPKG \b, aPackage self-extracting archive
|
|
|
+>0x17888 string Rar! \b, RAR self-extracting archive
|
|
|
+>0x40 string aPKG \b, aPackage self-extracting archive
|
|
|
|
|
|
->32 string AIN
|
|
|
->>35 string 2 \b, AIN 2.x compressed
|
|
|
->>35 string <2 \b, AIN 1.x compressed
|
|
|
->>35 string >2 \b, AIN 1.x compressed
|
|
|
->28 string UC2X \b, UCEXE compressed
|
|
|
->28 string WWP\ \b, WWPACK compressed
|
|
|
+>32 string AIN
|
|
|
+>>35 string 2 \b, AIN 2.x compressed
|
|
|
+>>35 string <2 \b, AIN 1.x compressed
|
|
|
+>>35 string >2 \b, AIN 1.x compressed
|
|
|
+>28 string UC2X \b, UCEXE compressed
|
|
|
+>28 string WWP\ \b, WWPACK compressed
|
|
|
|
|
|
# skip to the end of the exe
|
|
|
>(4.s*512) long x
|
|
@@ -263,15 +278,15 @@
|
|
|
|
|
|
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
|
|
|
>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
|
|
|
->>49824 leshort =1 \b, 1 file
|
|
|
->>49824 leshort >1 \b, %u files
|
|
|
+>>49824 leshort =1 \b, 1 file
|
|
|
+>>49824 leshort >1 \b, %u files
|
|
|
|
|
|
# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
|
|
|
# Uncommenting only the first two lines will cover about 2/3 of COM files,
|
|
|
# but it isn't feasible to match all COM files since there must be at least
|
|
|
# two dozen different one-byte "magics".
|
|
|
#0 byte 0xe9 DOS executable (COM)
|
|
|
-#>0x1FE leshort 0xAA55 \b, boot code
|
|
|
+#>0x1FE leshort 0xAA55 \b, boot code
|
|
|
>6 string SFX\ of\ LHarc (%s)
|
|
|
0 belong 0xffffffff DOS executable (device driver)
|
|
|
#CMD640X2.SYS
|
|
@@ -297,22 +312,22 @@
|
|
|
#0 byte 0x8c DOS executable (COM)
|
|
|
# 0xeb conflicts with "sequent" magic
|
|
|
#0 byte 0xeb DOS executable (COM)
|
|
|
-#>0x1FE leshort 0xAA55 \b, boot code
|
|
|
+#>0x1FE leshort 0xAA55 \b, boot code
|
|
|
#>85 string UPX \b, UPX compressed
|
|
|
#>4 string \ $ARX \b, ARX self-extracting archive
|
|
|
#>4 string \ $LHarc \b, LHarc self-extracting archive
|
|
|
-#>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
|
|
|
+#>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
|
|
|
#0 byte 0xb8 COM executable
|
|
|
# modified by Joerg Jenderek
|
|
|
->1 lelong !0x21cd4cff for DOS
|
|
|
+>1 lelong !0x21cd4cff for DOS
|
|
|
# http://syslinux.zytor.com/comboot.php
|
|
|
# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
|
|
|
# start with assembler instructions mov eax,21cd4cffh
|
|
|
->1 lelong 0x21cd4cff (32-bit COMBOOT)
|
|
|
+>1 lelong 0x21cd4cff (32-bit COMBOOT)
|
|
|
0 string \x81\xfc
|
|
|
>4 string \x77\x02\xcd\x20\xb9
|
|
|
->>36 string UPX! FREE-DOS executable (COM), UPX compressed
|
|
|
-252 string Must\ have\ DOS\ version DR-DOS executable (COM)
|
|
|
+>>36 string UPX! FREE-DOS executable (COM), UPX compressed
|
|
|
+252 string Must\ have\ DOS\ version DR-DOS executable (COM)
|
|
|
# GRR search is not working
|
|
|
#2 search/28 \xcd\x21 COM executable for MS-DOS
|
|
|
#WHICHFAT.cOM
|
|
@@ -349,14 +364,6 @@
|
|
|
#0 byte 0xf0 MS-DOS program library data
|
|
|
#
|
|
|
|
|
|
-#
|
|
|
-# Windows Registry files.
|
|
|
-# updated by Joerg Jenderek
|
|
|
-0 string regf Windows NT/XP registry file
|
|
|
-0 string CREG Windows 95/98/ME registry file
|
|
|
-0 string SHCC3 Windows 3.1 registry file
|
|
|
-
|
|
|
-
|
|
|
# AAF files:
|
|
|
# <stuartc@rd.bbc.co.uk> Stuart Cunningham
|
|
|
0 string \320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377 AAF legacy file using MS Structured Storage
|
|
@@ -378,7 +385,7 @@
|
|
|
0 belong 0x31be0000 Microsoft Word Document
|
|
|
!:mime application/msword
|
|
|
#
|
|
|
-0 string PO^Q` Microsoft Word 6.0 Document
|
|
|
+0 string PO^Q` Microsoft Word 6.0 Document
|
|
|
!:mime application/msword
|
|
|
#
|
|
|
0 string \376\067\0\043 Microsoft Office Document
|
|
@@ -410,7 +417,7 @@
|
|
|
>4 belong 0x07800100 fm3 or fmb document data
|
|
|
>4 belong 0x07800000 fm3 or fmb document data
|
|
|
#
|
|
|
-0 belong 0x00000200 Lotus 1-2-3
|
|
|
+0 belong 0x00000200 Lotus 1-2-3
|
|
|
!:mime application/x-123
|
|
|
>4 belong 0x06040600 wk1 document data
|
|
|
>4 belong 0x06800200 fmt document data
|
|
@@ -420,24 +427,21 @@
|
|
|
!:mime application/vnd.lotus-wordpro
|
|
|
|
|
|
|
|
|
-# Help files
|
|
|
-0 string ?_\3\0 MS Windows Help Data
|
|
|
-
|
|
|
-# DeIsL1.isu what this is I don't know
|
|
|
-0 string \161\250\000\000\001\002 DeIsL1.isu whatever that is
|
|
|
+# Summary: Script used by InstallScield to uninstall applications
|
|
|
+# Extension: .isu
|
|
|
+# Submitted by: unknown
|
|
|
+# Modified by (1): Abel Cheung <abelcheung@gmail.com> (replace useless entry)
|
|
|
+0 string \x71\xa8\x00\x00\x01\x02
|
|
|
+>12 string Stirling\ Technologies, InstallShield Uninstall Script
|
|
|
|
|
|
# Winamp .avs
|
|
|
-#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
|
|
|
+#0 string Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
|
|
|
0 string Nullsoft\ AVS\ Preset\ Winamp plug in
|
|
|
|
|
|
-# Hyper terminal:
|
|
|
-0 string HyperTerminal\ hyperterm
|
|
|
->15 string 1.0\ --\ HyperTerminal\ data\ file MS-windows Hyperterminal
|
|
|
-
|
|
|
# Windows Metafont .WMF
|
|
|
-0 string \327\315\306\232 ms-windows metafont .wmf
|
|
|
-0 string \002\000\011\000 ms-windows metafont .wmf
|
|
|
-0 string \001\000\011\000 ms-windows metafont .wmf
|
|
|
+0 string \327\315\306\232 ms-windows metafont .wmf
|
|
|
+0 string \002\000\011\000 ms-windows metafont .wmf
|
|
|
+0 string \001\000\011\000 ms-windows metafont .wmf
|
|
|
|
|
|
#tz3 files whatever that is (MS Works files)
|
|
|
0 string \003\001\001\004\070\001\000\000 tz3 ms-works file
|
|
@@ -457,16 +461,6 @@
|
|
|
0 string MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
|
|
|
|
|
|
|
|
|
-# Windows help file FTG FTS
|
|
|
-0 string \164\146\115\122\012\000\000\000\001\000\000\000 MS Windows help cache
|
|
|
-
|
|
|
-# grp old windows 3.1 group files
|
|
|
-0 string \120\115\103\103 MS Windows 3.1 group files
|
|
|
-
|
|
|
-
|
|
|
-# lnk files windows symlinks
|
|
|
-0 string \114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106 MS Windows shortcut
|
|
|
-
|
|
|
#ico files
|
|
|
0 string \102\101\050\000\000\000\056\000\000\000\000\000\000\000 Icon for MS Windows
|
|
|
|
|
@@ -493,18 +487,27 @@
|
|
|
# then there is a copyright notice
|
|
|
|
|
|
|
|
|
-# recycled/info the windows trash bin index
|
|
|
-9 string \000\000\000\030\001\000\000\000 MS Windows recycled bin info
|
|
|
+# Windows Recycle Bin record file (named INFO2)
|
|
|
+# By Abel Cheung (abelcheung AT gmail dot com)
|
|
|
+# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
|
|
|
+# Since Vista uses another structure, INFO2 structure probably won't change
|
|
|
+# anymore. Detailed analysis in:
|
|
|
+# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
|
|
|
+0 lelong 0x00000004
|
|
|
+>12 lelong 0x00000118 Windows Recycle Bin INFO2 file (Win98 or below)
|
|
|
+
|
|
|
+0 lelong 0x00000005
|
|
|
+>12 lelong 0x00000320 Windows Recycle Bin INFO2 file (Win2k - WinXP)
|
|
|
|
|
|
|
|
|
##### put in Either Magic/font or Magic/news
|
|
|
-# Acroread or something files wrongly identified as G3 .pfm
|
|
|
+# Acroread or something files wrongly identified as G3 .pfm
|
|
|
# these have the form \000 \001 any? \002 \000 \000
|
|
|
# or \000 \001 any? \022 \000 \000
|
|
|
-#0 string \000\001 pfm?
|
|
|
-#>3 string \022\000\000Copyright\ yes
|
|
|
-#>3 string \002\000\000Copyright\ yes
|
|
|
-#>3 string >\0 oops, not a font file. Cancel that.
|
|
|
+#0 string \000\001 pfm?
|
|
|
+#>3 string \022\000\000Copyright\ yes
|
|
|
+#>3 string \002\000\000Copyright\ yes
|
|
|
+#>3 string >\0 oops, not a font file. Cancel that.
|
|
|
#it clashes with ttf files so put it lower down.
|
|
|
|
|
|
# From Doug Lee via a FreeBSD pr
|
|
@@ -552,7 +555,7 @@
|
|
|
!:mime application/vnd.ms-tnef
|
|
|
|
|
|
# HtmlHelp files (.chm)
|
|
|
-0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
|
|
|
+0 string ITSF\003\000\000\000\x60\000\000\000\001\000\000\000 MS Windows HtmlHelp Data
|
|
|
|
|
|
# GFA-BASIC (Wolfram Kleff)
|
|
|
2 string GFA-BASIC3 GFA-BASIC 3 data
|
|
@@ -567,8 +570,8 @@
|
|
|
|
|
|
# InstallShield Cabinet files
|
|
|
0 string ISc( InstallShield Cabinet archive data
|
|
|
->5 byte&0xf0 =0x60 version 6,
|
|
|
->5 byte&0xf0 !0x60 version 4/5,
|
|
|
+>5 byte&0xf0 =0x60 version 6,
|
|
|
+>5 byte&0xf0 !0x60 version 4/5,
|
|
|
>(12.l+40) lelong x %u files
|
|
|
|
|
|
# Windows CE package files
|
|
@@ -582,57 +585,27 @@
|
|
|
>20 lelong 10004 \b, Hitachi SH3E
|
|
|
>20 lelong 10005 \b, Hitachi SH4
|
|
|
>20 lelong 70001 \b, ARM 7TDMI
|
|
|
->52 leshort 1 \b, 1 file
|
|
|
->52 leshort >1 \b, %u files
|
|
|
->56 leshort 1 \b, 1 registry entry
|
|
|
->56 leshort >1 \b, %u registry entries
|
|
|
-
|
|
|
-# Outlook Personal Folders
|
|
|
-0 lelong 0x4E444221 Microsoft Outlook binary email folder
|
|
|
->10 leshort 0x0e (Outlook <=2002)
|
|
|
->10 leshort 0x17 (Outlook >=2003)
|
|
|
-
|
|
|
-
|
|
|
-# From: Dirk Jagdmann <doj@cubic.org>
|
|
|
-0 lelong 0x00035f3f Windows 3.x help file
|
|
|
-
|
|
|
-# Christophe Monniez
|
|
|
-0 string Client\ UrlCache\ MMF Microsoft Internet Explorer Cache File
|
|
|
->20 string >\0 Version %s
|
|
|
-0 string \xCF\xAD\x12\xFE Microsoft Outlook Express DBX File
|
|
|
->4 byte =0xC5 Message database
|
|
|
->4 byte =0xC6 Folder database
|
|
|
->4 byte =0xC7 Accounts informations
|
|
|
->4 byte =0x30 Offline database
|
|
|
+>52 leshort 1 \b, 1 file
|
|
|
+>52 leshort >1 \b, %u files
|
|
|
+>56 leshort 1 \b, 1 registry entry
|
|
|
+>56 leshort >1 \b, %u registry entries
|
|
|
|
|
|
|
|
|
# Windows Enhanced Metafile (EMF)
|
|
|
# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
|
|
|
-# for further information. Note that "0 lelong 1" should be true i.e.
|
|
|
-# the first double word in the file should be 1. With the extended
|
|
|
-# syntax available by some file commands you could write:
|
|
|
-# 0 lelong 1
|
|
|
-# &40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data
|
|
|
-#40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data
|
|
|
-#>44 ulelong x version 0x%x.
|
|
|
-# If the description has a length greater than zero, it exists and is
|
|
|
-# found at offset (*64).
|
|
|
-#>64 ulelong >0 Description available at offset 0x%x
|
|
|
-#>>60 ulelong >0 (length 0x%x)
|
|
|
-# Note it would be better to print out the description, which is found
|
|
|
-# as below. Unfortunately the following only prints out the first couple
|
|
|
-# of characters instead of all the "description length"
|
|
|
-# number of characters -- indicated by the ulelong at offset 60.
|
|
|
-#>>(64.l) lestring16 >0 Description: %15.15s
|
|
|
+# for further information.
|
|
|
+0 ulelong 1
|
|
|
+>40 string \ EMF Windows Enhanced Metafile (EMF) image data
|
|
|
+>>44 ulelong x version 0x%x
|
|
|
|
|
|
# From: Alex Beregszaszi <alex@fsn.hu>
|
|
|
0 string COWD VMWare3
|
|
|
->4 byte 3 disk image
|
|
|
+>4 byte 3 disk image
|
|
|
>>32 lelong x (%d/
|
|
|
>>36 lelong x \b%d/
|
|
|
>>40 lelong x \b%d)
|
|
|
->4 byte 2 undoable disk image
|
|
|
->>32 string >\0 (%s)
|
|
|
+>4 byte 2 undoable disk image
|
|
|
+>>32 string >\0 (%s)
|
|
|
|
|
|
0 string VMDK VMware4 disk image
|
|
|
0 string KDMV VMware4 disk image
|
|
@@ -642,39 +615,39 @@
|
|
|
# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
|
|
|
# Made by reading sources and doing trial and error on existing
|
|
|
# qcow files
|
|
|
-0 string QFI Qemu Image, Format: Qcow
|
|
|
+0 string QFI Qemu Image, Format: Qcow
|
|
|
|
|
|
# Uncomment the following line to display Magic (only used for debugging
|
|
|
# this magic number)
|
|
|
-#>0 string x , Magic: %s
|
|
|
+#>0 string x , Magic: %s
|
|
|
|
|
|
# There are currently 2 Versions: "1" and "2"
|
|
|
# I do not use Version 2 and therefor branch here
|
|
|
# but can assure: it works (tested on both versions)
|
|
|
# Also my Qemu 0.9.0 which uses this Version 2 refuses
|
|
|
# to start in its bios
|
|
|
->0x04 belong 2 , Version: 2
|
|
|
->0x04 belong 1 , Version: 1
|
|
|
+>0x04 belong 2 , Version: 2
|
|
|
+>0x04 belong 1 , Version: 1
|
|
|
|
|
|
# Using the existence of the Backing File Offset to Branch or not
|
|
|
# to read Backing File Information
|
|
|
->>0xc belong >0 , Backing File( Offset: %lu
|
|
|
->>>(0xc.L) string >\0 , Path: %s
|
|
|
+>>0xc belong >0 , Backing File( Offset: %lu
|
|
|
+>>>(0xc.L) string >\0 , Path: %s
|
|
|
|
|
|
# Didn't get the trick here how qemu stores the "Size" at this Position
|
|
|
# There is actually something stored but nothing makes sense
|
|
|
# The header in the sources talks about it
|
|
|
-#>>>16 lelong x , Size: %lu
|
|
|
+#>>>16 lelong x , Size: %lu
|
|
|
|
|
|
# Modification time of the Backing File
|
|
|
# Really useful if you want to know if your backing
|
|
|
# file is still usable together with this image
|
|
|
->>>20 bedate x , Mtime: %s )
|
|
|
+>>>20 bedate x , Mtime: %s )
|
|
|
|
|
|
# Don't know how to calculate in Magicfiles
|
|
|
# Also: this Information is not reliably
|
|
|
-# stored in image-files
|
|
|
->>24 lelong x , Disk Size could be: %d * 256 bytes
|
|
|
+# stored in image-files
|
|
|
+>>24 lelong x , Disk Size could be: %d * 256 bytes
|
|
|
|
|
|
0 string QEVM QEMU's suspend to disk image
|
|
|
|
|
@@ -688,14 +661,14 @@
|
|
|
# False positive with PPT (also currently this string is too long)
|
|
|
#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06 Microsoft Installer
|
|
|
0 string \320\317\021\340\241\261\032\341 Microsoft Office Document
|
|
|
-#>48 byte 0x1B Excel Document
|
|
|
-#!:mime application/vnd.ms-excel
|
|
|
+#>48 byte 0x1B Excel Document
|
|
|
+#!:mime application/vnd.ms-excel
|
|
|
>546 string bjbj Microsoft Word Document
|
|
|
!:mime application/msword
|
|
|
>546 string jbjb Microsoft Word Document
|
|
|
!:mime application/msword
|
|
|
|
|
|
-0 string \224\246\056 Microsoft Word Document
|
|
|
+0 string \224\246\056 Microsoft Word Document
|
|
|
!:mime application/msword
|
|
|
|
|
|
512 string R\0o\0o\0t\0\ \0E\0n\0t\0r\0y Microsoft Word Document
|
|
@@ -709,19 +682,19 @@
|
|
|
>48 string x version %.3s
|
|
|
|
|
|
# Type: Microsoft DirectDraw Surface
|
|
|
-# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
|
|
|
+# URL: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
|
|
|
# From: Morten Hustveit <morten@debian.org>
|
|
|
-0 string DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
|
|
|
+0 string DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
|
|
|
>16 lelong >0 %hd x
|
|
|
>12 lelong >0 %hd,
|
|
|
>84 string x %.4s
|
|
|
|
|
|
# Type: Microsoft Document Imaging Format (.mdi)
|
|
|
-# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
|
|
|
+# URL: http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
|
|
|
# From: Daniele Sempione <scrows@oziosi.org>
|
|
|
0 short 0x5045 Microsoft Document Imaging Format
|
|
|
|
|
|
# MS eBook format (.lit)
|
|
|
-0 string ITOLITLS Microsoft Reader eBook Data
|
|
|
+0 string ITOLITLS Microsoft Reader eBook Data
|
|
|
>8 lelong x \b, version %u
|
|
|
!:mime application/x-ms-reader
|