Merge upstream version 5.46

ChangeLog

@@ -1,3 +1,35 @@
+2024-11-27  14:44  Christos Zoulas <christos@zoulas.com>
+
+	* release 5.46
+	* Add OFFPOSITIVE
+
+2024-11-25  13:56  Christos Zoulas <christos@zoulas.com>
+	
+	* avoid leaking symbols in libmagic
+
+2024-11-10  13:56  Christos Zoulas <christos@zoulas.com>
+	
+	* PR/562: jsummers: Search/regex offsets are absolute to the
+	  beginning of the file, so adjust them by subtracting the
+	  offset that the "use" starts so that we don't double-count it.
+
+
+2024-11-09  19:30  Christos Zoulas <christos@zoulas.com>
+ 	* PR/543: matshch: bump nbuf so we can get the flags into the buffer.
+
+
+2024-11-02  14:34  Christos Zoulas <christos@zoulas.com>
+
+ 	* Add Android elf notes (enh)
+
+2023-12-29  12:55  Christos Zoulas <christos@zoulas.com>
+
+	* Add limit for number of magic warnings allowed
+
+2023-07-29  12:55  Christos Zoulas <christos@zoulas.com>
+
+	* check regex bounds (found by clusterfuzz)
+
 2023-07-27  15:45  Christos Zoulas <christos@zoulas.com>
 
 	* release 5.45

Makefile.in

@@ -264,6 +264,7 @@ EGREP = @EGREP@
 ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 HAVE_VISIBILITY = @HAVE_VISIBILITY@
 INSTALL = @INSTALL@

aclocal.m4

@@ -14,8 +14,8 @@
 m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
 m4_ifndef([AC_AUTOCONF_VERSION],
   [m4_copy([m4_PACKAGE_VERSION], [AC_AUTOCONF_VERSION])])dnl
-m4_if(m4_defn([AC_AUTOCONF_VERSION]), [2.71],,
-[m4_warning([this file was generated for autoconf 2.71.
+m4_if(m4_defn([AC_AUTOCONF_VERSION]), [2.72],,
+[m4_warning([this file was generated for autoconf 2.72.
 You have another version of autoconf.  It may work, but is not guaranteed to.
 If you have problems, you may need to regenerate the build system entirely.
 To do so, use the procedure documented by the package, typically 'autoreconf'.])])

config.h.in

@@ -12,10 +12,10 @@
 /* Define for ELF core file support */
 #undef ELFCORE
 
-/* Define to 1 if you have the `asctime_r' function. */
+/* Define to 1 if you have the 'asctime_r' function. */
 #undef HAVE_ASCTIME_R
 
-/* Define to 1 if you have the `asprintf' function. */
+/* Define to 1 if you have the 'asprintf' function. */
 #undef HAVE_ASPRINTF
 
 /* Define to 1 if you have the <byteswap.h> header file. */
@@ -24,24 +24,24 @@
 /* Define to 1 if you have the <bzlib.h> header file. */
 #undef HAVE_BZLIB_H
 
-/* Define to 1 if you have the `ctime_r' function. */
+/* Define to 1 if you have the 'ctime_r' function. */
 #undef HAVE_CTIME_R
 
 /* HAVE_DAYLIGHT */
 #undef HAVE_DAYLIGHT
 
-/* Define to 1 if you have the declaration of `daylight', and to 0 if you
+/* Define to 1 if you have the declaration of 'daylight', and to 0 if you
    don't. */
 #undef HAVE_DECL_DAYLIGHT
 
-/* Define to 1 if you have the declaration of `tzname', and to 0 if you don't.
+/* Define to 1 if you have the declaration of 'tzname', and to 0 if you don't.
    */
 #undef HAVE_DECL_TZNAME
 
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H
 
-/* Define to 1 if you have the `dprintf' function. */
+/* Define to 1 if you have the 'dprintf' function. */
 #undef HAVE_DPRINTF
 
 /* Define to 1 if you have the <err.h> header file. */
@@ -50,63 +50,69 @@
 /* Define to 1 if you have the <fcntl.h> header file. */
 #undef HAVE_FCNTL_H
 
-/* Define to 1 if you have the `fmtcheck' function. */
+/* Define to 1 if you have the 'fmtcheck' function. */
 #undef HAVE_FMTCHECK
 
-/* Define to 1 if you have the `fork' function. */
+/* Define to 1 if you have the 'fork' function. */
 #undef HAVE_FORK
 
-/* Define to 1 if you have the `freelocale' function. */
+/* Define to 1 if you have the 'freelocale' function. */
 #undef HAVE_FREELOCALE
 
-/* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
+/* Define to 1 if fseeko (and ftello) are declared in stdio.h. */
 #undef HAVE_FSEEKO
 
-/* Define to 1 if you have the `getline' function. */
+/* Define to 1 if you have the 'getline' function. */
 #undef HAVE_GETLINE
 
 /* Define to 1 if you have the <getopt.h> header file. */
 #undef HAVE_GETOPT_H
 
-/* Define to 1 if you have the `getopt_long' function. */
+/* Define to 1 if you have the 'getopt_long' function. */
 #undef HAVE_GETOPT_LONG
 
-/* Define to 1 if you have the `getpagesize' function. */
+/* Define to 1 if you have the 'getpagesize' function. */
 #undef HAVE_GETPAGESIZE
 
-/* Define to 1 if you have the `gmtime_r' function. */
+/* Define to 1 if you have the 'gmtime_r' function. */
 #undef HAVE_GMTIME_R
 
-/* Define to 1 if the system has the type `intptr_t'. */
+/* Define to 1 if the system has the type 'intptr_t'. */
 #undef HAVE_INTPTR_T
 
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
 
-/* Define to 1 if you have the `bz2' library (-lbz2). */
+/* Define to 1 if you have the 'bz2' library (-lbz2). */
 #undef HAVE_LIBBZ2
 
-/* Define to 1 if you have the `gnurx' library (-lgnurx). */
+/* Define to 1 if you have the 'gnurx' library (-lgnurx). */
 #undef HAVE_LIBGNURX
 
-/* Define to 1 if you have the `lz' library (-llz). */
+/* Define to 1 if you have the 'lrzip' library (-llrzip). */
+#undef HAVE_LIBLRZIP
+
+/* Define to 1 if you have the 'lz' library (-llz). */
 #undef HAVE_LIBLZ
 
-/* Define to 1 if you have the `lzma' library (-llzma). */
+/* Define to 1 if you have the 'lzma' library (-llzma). */
 #undef HAVE_LIBLZMA
 
-/* Define to 1 if you have the `seccomp' library (-lseccomp). */
+/* Define to 1 if you have the 'seccomp' library (-lseccomp). */
 #undef HAVE_LIBSECCOMP
 
-/* Define to 1 if you have the `z' library (-lz). */
+/* Define to 1 if you have the 'z' library (-lz). */
 #undef HAVE_LIBZ
 
-/* Define to 1 if you have the `zstd' library (-lzstd). */
+/* Define to 1 if you have the 'zstd' library (-lzstd). */
 #undef HAVE_LIBZSTD
 
-/* Define to 1 if you have the `localtime_r' function. */
+/* Define to 1 if you have the 'localtime_r' function. */
 #undef HAVE_LOCALTIME_R
 
+/* Define to 1 if you have the <Lrzip.h> header file. */
+#undef HAVE_LRZIP_H
+
 /* Define to 1 if you have the <lzlib.h> header file. */
 #undef HAVE_LZLIB_H
 
@@ -119,31 +125,31 @@
 /* Define to 1 if <wchar.h> declares mbstate_t. */
 #undef HAVE_MBSTATE_T
 
-/* Define to 1 if you have the `memmem' function. */
+/* Define to 1 if you have the 'memmem' function. */
 #undef HAVE_MEMMEM
 
 /* Define to 1 if you have the <minix/config.h> header file. */
 #undef HAVE_MINIX_CONFIG_H
 
-/* Define to 1 if you have the `mkostemp' function. */
+/* Define to 1 if you have the 'mkostemp' function. */
 #undef HAVE_MKOSTEMP
 
-/* Define to 1 if you have the `mkstemp' function. */
+/* Define to 1 if you have the 'mkstemp' function. */
 #undef HAVE_MKSTEMP
 
-/* Define to 1 if you have a working `mmap' system call. */
+/* Define to 1 if you have a working 'mmap' system call. */
 #undef HAVE_MMAP
 
-/* Define to 1 if you have the `newlocale' function. */
+/* Define to 1 if you have the 'newlocale' function. */
 #undef HAVE_NEWLOCALE
 
-/* Define to 1 if you have the `pipe2' function. */
+/* Define to 1 if you have the 'pipe2' function. */
 #undef HAVE_PIPE2
 
-/* Define to 1 if you have the `posix_spawnp' function. */
+/* Define to 1 if you have the 'posix_spawnp' function. */
 #undef HAVE_POSIX_SPAWNP
 
-/* Define to 1 if you have the `pread' function. */
+/* Define to 1 if you have the 'pread' function. */
 #undef HAVE_PREAD
 
 /* Have sig_t type */
@@ -161,7 +167,7 @@
 /* Define to 1 if you have the <stdlib.h> header file. */
 #undef HAVE_STDLIB_H
 
-/* Define to 1 if you have the `strcasestr' function. */
+/* Define to 1 if you have the 'strcasestr' function. */
 #undef HAVE_STRCASESTR
 
 /* Define to 1 if you have the <strings.h> header file. */
@@ -170,28 +176,28 @@
 /* Define to 1 if you have the <string.h> header file. */
 #undef HAVE_STRING_H
 
-/* Define to 1 if you have the `strlcat' function. */
+/* Define to 1 if you have the 'strlcat' function. */
 #undef HAVE_STRLCAT
 
-/* Define to 1 if you have the `strlcpy' function. */
+/* Define to 1 if you have the 'strlcpy' function. */
 #undef HAVE_STRLCPY
 
-/* Define to 1 if you have the `strndup' function. */
+/* Define to 1 if you have the 'strndup' function. */
 #undef HAVE_STRNDUP
 
-/* Define to 1 if you have the `strtof' function. */
+/* Define to 1 if you have the 'strtof' function. */
 #undef HAVE_STRTOF
 
 /* HAVE_STRUCT_OPTION */
 #undef HAVE_STRUCT_OPTION
 
-/* Define to 1 if `st_rdev' is a member of `struct stat'. */
+/* Define to 1 if 'st_rdev' is a member of 'struct stat'. */
 #undef HAVE_STRUCT_STAT_ST_RDEV
 
-/* Define to 1 if `tm_gmtoff' is a member of `struct tm'. */
+/* Define to 1 if 'tm_gmtoff' is a member of 'struct tm'. */
 #undef HAVE_STRUCT_TM_TM_GMTOFF
 
-/* Define to 1 if `tm_zone' is a member of `struct tm'. */
+/* Define to 1 if 'tm_zone' is a member of 'struct tm'. */
 #undef HAVE_STRUCT_TM_TM_ZONE
 
 /* Define to 1 if you have the <sys/bswap.h> header file. */
@@ -233,28 +239,28 @@
 /* HAVE_TZNAME */
 #undef HAVE_TZNAME
 
-/* Define to 1 if the system has the type `uintptr_t'. */
+/* Define to 1 if the system has the type 'uintptr_t'. */
 #undef HAVE_UINTPTR_T
 
 /* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H
 
-/* Define to 1 if you have the `uselocale' function. */
+/* Define to 1 if you have the 'uselocale' function. */
 #undef HAVE_USELOCALE
 
-/* Define to 1 if you have the `utime' function. */
+/* Define to 1 if you have the 'utime' function. */
 #undef HAVE_UTIME
 
-/* Define to 1 if you have the `utimes' function. */
+/* Define to 1 if you have the 'utimes' function. */
 #undef HAVE_UTIMES
 
 /* Define to 1 if you have the <utime.h> header file. */
 #undef HAVE_UTIME_H
 
-/* Define to 1 if you have the `vasprintf' function. */
+/* Define to 1 if you have the 'vasprintf' function. */
 #undef HAVE_VASPRINTF
 
-/* Define to 1 if you have the `vfork' function. */
+/* Define to 1 if you have the 'vfork' function. */
 #undef HAVE_VFORK
 
 /* Define to 1 if you have the <vfork.h> header file. */
@@ -270,13 +276,13 @@
 /* Define to 1 if you have the <wctype.h> header file. */
 #undef HAVE_WCTYPE_H
 
-/* Define to 1 if you have the `wcwidth' function. */
+/* Define to 1 if you have the 'wcwidth' function. */
 #undef HAVE_WCWIDTH
 
-/* Define to 1 if `fork' works. */
+/* Define to 1 if 'fork' works. */
 #undef HAVE_WORKING_FORK
 
-/* Define to 1 if `vfork' works. */
+/* Define to 1 if 'vfork' works. */
 #undef HAVE_WORKING_VFORK
 
 /* Define to 1 if you have the <xlocale.h> header file. */
@@ -291,17 +297,20 @@
 /* Define to 1 if you have the <zstd.h> header file. */
 #undef HAVE_ZSTD_H
 
+/* Enable lrziplib compression support */
+#undef LRZIPLIBSUPPORT
+
 /* Define to the sub-directory where libtool stores uninstalled libraries. */
 #undef LT_OBJDIR
 
 /* Enable lzlib compression support */
 #undef LZLIBSUPPORT
 
-/* Define to 1 if `major', `minor', and `makedev' are declared in <mkdev.h>.
+/* Define to 1 if 'major', 'minor', and 'makedev' are declared in <mkdev.h>.
    */
 #undef MAJOR_IN_MKDEV
 
-/* Define to 1 if `major', `minor', and `makedev' are declared in
+/* Define to 1 if 'major', 'minor', and 'makedev' are declared in
    <sysmacros.h>. */
 #undef MAJOR_IN_SYSMACROS
 
@@ -326,15 +335,15 @@
 /* Define to the version of this package. */
 #undef PACKAGE_VERSION
 
-/* Define to 1 if all of the C90 standard headers exist (not just the ones
+/* Define to 1 if all of the C89 standard headers exist (not just the ones
    required in a freestanding environment). This macro is provided for
    backward compatibility; new code need not use it. */
 #undef STDC_HEADERS
 
-/* Define to 1 if your <sys/time.h> declares `struct tm'. */
+/* Define to 1 if your <sys/time.h> declares 'struct tm'. */
 #undef TM_IN_SYS_TIME
 
-/* Enable extensions on AIX 3, Interix.  */
+/* Enable extensions on AIX, Interix, z/OS.  */
 #ifndef _ALL_SOURCE
 # undef _ALL_SOURCE
 #endif
@@ -395,11 +404,15 @@
 #ifndef __STDC_WANT_IEC_60559_DFP_EXT__
 # undef __STDC_WANT_IEC_60559_DFP_EXT__
 #endif
+/* Enable extensions specified by C23 Annex F.  */
+#ifndef __STDC_WANT_IEC_60559_EXT__
+# undef __STDC_WANT_IEC_60559_EXT__
+#endif
 /* Enable extensions specified by ISO/IEC TS 18661-4:2015.  */
 #ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
 # undef __STDC_WANT_IEC_60559_FUNCS_EXT__
 #endif
-/* Enable extensions specified by ISO/IEC TS 18661-3:2015.  */
+/* Enable extensions specified by C23 Annex H and ISO/IEC TS 18661-3:2015.  */
 #ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
 # undef __STDC_WANT_IEC_60559_TYPES_EXT__
 #endif
@@ -449,12 +462,15 @@
 /* Number of bits in a file offset, on hosts where this is settable. */
 #undef _FILE_OFFSET_BITS
 
-/* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */
+/* Define to 1 if necessary to make fseeko visible. */
 #undef _LARGEFILE_SOURCE
 
-/* Define for large files, on AIX-style hosts. */
+/* Define to 1 on platforms where this makes off_t a 64-bit type. */
 #undef _LARGE_FILES
 
+/* Number of bits in time_t, on hosts where this is settable. */
+#undef _TIME_BITS
+
 /* Define for Solaris 2.5.1 so the uint32_t typedef from <sys/synch.h>,
    <pthread.h>, or <semaphore.h> is not used. If the typedef were allowed, the
    #define below would cause a syntax error. */
@@ -470,6 +486,9 @@
    #define below would cause a syntax error. */
 #undef _UINT8_T
 
+/* Define to 1 on platforms where this makes time_t a 64-bit type. */
+#undef __MINGW_USE_VC2005_COMPAT
+
 /* Define to the type of a signed integer type of width exactly 32 bits if
    such a type exists and the standard includes do not define it. */
 #undef int32_t
@@ -485,13 +504,13 @@
 /* Define to a type if <wchar.h> does not define. */
 #undef mbstate_t
 
-/* Define to `long int' if <sys/types.h> does not define. */
+/* Define to 'long int' if <sys/types.h> does not define. */
 #undef off_t
 
 /* Define as a signed integer type capable of holding a process identifier. */
 #undef pid_t
 
-/* Define to `unsigned int' if <sys/types.h> does not define. */
+/* Define as 'unsigned int' if <stddef.h> doesn't define. */
 #undef size_t
 
 /* Define to the type of an unsigned integer type of width exactly 16 bits if
@@ -514,5 +533,5 @@
    pointer, if such a type exists, and if the system does not define it. */
 #undef uintptr_t
 
-/* Define as `fork' if `vfork' does not work. */
+/* Define as 'fork' if 'vfork' does not work. */
 #undef vfork

configure.ac

@@ -1,5 +1,5 @@
 dnl Process this file with autoconf to produce a configure script.
-AC_INIT([file],[5.45],[christos@astron.com])
+AC_INIT([file],[5.46],[christos@astron.com])
 AM_INIT_AUTOMAKE([subdir-objects foreign])
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
 
@@ -59,6 +59,11 @@ AC_ARG_ENABLE([lzlib],
 [AS_HELP_STRING([--disable-lzlib], [disable liblz (lzip) compression support @<:@default=auto@:>@])])
 AC_MSG_RESULT($enable_lzlib)
 
+AC_MSG_CHECKING(for lrziplib support)
+AC_ARG_ENABLE([lrziplib],
+[AS_HELP_STRING([--disable-lrziplib], [disable liblrzip (lrzip) compression support @<:@default=auto@:>@])])
+AC_MSG_RESULT($enable_lrziplib)
+
 AC_MSG_CHECKING(for libseccomp support)
 AC_ARG_ENABLE([libseccomp],
 [AS_HELP_STRING([--disable-libseccomp], [disable libseccomp sandboxing @<:@default=auto@:>@])])
@@ -128,6 +133,9 @@ fi
 if test "$enable_lzlib" != "no"; then
   AC_CHECK_HEADERS(lzlib.h)
 fi
+if test "$enable_lrziplib" != "no"; then
+  AC_CHECK_HEADERS(Lrzip.h)
+fi
 AC_CHECK_TYPE([sig_t],[AC_DEFINE([HAVE_SIG_T],1,[Have sig_t type])],,[#include <signal.h>])
 
 dnl Checks for typedefs, structures, and compiler characteristics.
@@ -152,6 +160,18 @@ AC_TYPE_UINT64_T
 AC_TYPE_INT64_T
 AC_TYPE_INTPTR_T
 AC_TYPE_UINTPTR_T
+m4_ifdef([AC_SYS_YEAR2038], [AC_SYS_YEAR2038], [
+# GNU libc only allows setting _TIME_BITS when FILE_OFFSET_BITS is also set.
+# GNU libc defines __TIMESIZE on systems where _TIME_BITS can be set.
+AS_IF([test X"$ac_cv_sys_file_offset_bits" = X"64"], [
+    AC_CHECK_DECL(__TIMESIZE, [
+	AC_DEFINE([_TIME_BITS], [64], [Number of bits in a timestamp, on hosts where this is settable.])
+    ], [], [
+AC_INCLUDES_DEFAULT
+#include <time.h>
+	])
+    ])
+])
 AC_FUNC_MMAP
 AC_FUNC_FORK
 AC_FUNC_MBRTOWC
@@ -202,6 +222,10 @@ fi
 if test "$enable_lzlib" != "no"; then
   AC_CHECK_LIB(lz, LZ_decompress_open)
 fi
+if test "$enable_lrziplib" != "no"; then
+  AC_CHECK_LIB(lrzip, lrzip_new)
+fi
+
 if test "$enable_libseccomp" != "no"; then
     AC_CHECK_LIB(seccomp, seccomp_init)
 fi
@@ -254,5 +278,14 @@ if  test "$ac_cv_header_lzlib_h$ac_cv_lib_lz_LZ_decompress_open" = "yesyes"; the
   AC_DEFINE([LZLIBSUPPORT], 1, [Enable lzlib compression support])
 fi
 
+if test "$enable_lrziplib" = "yes"; then
+  if test "$ac_cv_header_Lrzip_h$ac_cv_lib_lrzip_lrzip_new" != "yesyes"; then
+    AC_MSG_ERROR([lrzip support requested but not found])
+  fi
+fi
+if  test "$ac_cv_header_Lrzip_h$ac_cv_lib_lrzip_lrzip_new" = "yesyes"; then
+  AC_DEFINE([LRZIPLIBSUPPORT], 1, [Enable lrziplib compression support])
+fi
+
 AC_CONFIG_FILES([Makefile src/Makefile magic/Makefile tests/Makefile doc/Makefile python/Makefile libmagic.pc])
 AC_OUTPUT

doc/Makefile.in

@@ -186,6 +186,7 @@ EGREP = @EGREP@
 ETAGS = @ETAGS@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
+FILECMD = @FILECMD@
 GREP = @GREP@
 HAVE_VISIBILITY = @HAVE_VISIBILITY@
 INSTALL = @INSTALL@

doc/file.man

@@ -1,5 +1,5 @@
-.\" $File: file.man,v 1.150 2023/05/21 17:08:34 christos Exp $
-.Dd May 21, 2023
+.\" $File: file.man,v 1.151 2024/04/07 21:27:35 christos Exp $
+.Dd April 7, 2024
 .Dt FILE __CSECTION__
 .Os
 .Sh NAME
@@ -348,7 +348,7 @@ Set various parameter limits.
 .It Li elf_shsize Ta 128MB Ta max ELF section size processed
 .It Li encoding Ta 65K Ta max number of bytes to determine encoding
 .It Li indir Ta 50 Ta recursion limit for indirect magic
-.It Li name Ta 50 Ta use count limit for name/use magic
+.It Li name Ta 100 Ta use count limit for name/use magic
 .It Li regex Ta 8K Ta length limit for regex searches
 .El
 .It Fl r , Fl Fl raw

doc/libmagic.man

@@ -1,4 +1,4 @@
-.\" $File: libmagic.man,v 1.49 2023/07/20 14:32:07 christos Exp $
+.\" $File: libmagic.man,v 1.50 2023/12/29 18:04:47 christos Exp $
 .\"
 .\" Copyright (c) Christos Zoulas 2003, 2018, 2022
 .\" All Rights Reserved.
@@ -25,7 +25,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd June 16, 2023
+.Dd December 29, 2023
 .Dt LIBMAGIC 3
 .Os
 .Sh NAME
@@ -311,7 +311,10 @@ library.
 .It Li MAGIC_PARAM_ELF_PHNUM_MAX Ta size_t Ta 128
 .It Li MAGIC_PARAM_ELF_SHNUM_MAX Ta size_t Ta 32768
 .It Li MAGIC_PARAM_REGEX_MAX Ta size_t Ta 8192
-.It Li MAGIC_PARAM_BYTES_MAX Ta size_t Ta 1048576
+.It Li MAGIC_PARAM_BYTES_MAX Ta size_t Ta 7340032
+.It Li MAGIC_PARAM_ENCODING_MAX Ta size_t Ta 1048576
+.It Li MAGIC_PARAM_ELF_SHSIZE_MAX Ta size_t Ta 134217728
+.It Li MAGIC_PARAM_MAGWARN_MAX Ta size_t Ta 64
 .El
 .Pp
 The
@@ -341,6 +344,26 @@ The
 parameter controls how many ELF sections will be processed.
 .Pp
 The
+.Dv MAGIC_PARAM_REGEX_MAX
+parameter controls the maximum length for regex searches.
+.Pp
+The
+.Dv MAGIC_PARAM_BYTES_MAX
+parameter controls the maximum number of bytes to look inside a file.
+.Pp
+The
+.Dv MAGIC_PARAM_ENCODING_MAX
+parameter controls the maximum number of bytes to scan for encoding detection.
+.Pp
+The
+.Dv MAGIC_PARAM_ELF_SHSIZE_MAX
+parameter controls the maximum number of bytes in an elf section.
+.Pp
+The
+.Dv MAGIC_PARAM_MAGWARN_MAX
+parameter controls the maximum number of warnings to tolerate in a magic file.
+.Pp
+The
 .Fn magic_version
 command returns the version number of this library which is compiled into
 the shared library using the constant

doc/magic.man

@@ -1,5 +1,5 @@
-.\" $File: magic.man,v 1.103 2023/07/20 14:32:07 christos Exp $
-.Dd Arpil 18, 2023
+.\" $File: magic.man,v 1.110 2024/11/27 15:37:00 christos Exp $
+.Dd November 27, 2024
 .Dt MAGIC __FSECTION__
 .Os
 .\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems.
@@ -50,6 +50,10 @@ is a regular file.
 A continuation offset relative to the end of the last up-level field
 .Dv ( \*[Am] ) .
 .El
+If the offset starts with the symbol
+.Dq + ,
+then all offsets are interpreted as from the beginning of the file (the
+default).
 .It Dv type
 The type of the data to be tested.
 The possible values are:
@@ -146,6 +150,10 @@ An eight-byte value interpreted as a UNIX-style date, but interpreted as
 local time rather than UTC.
 .It Dv qwdate
 An eight-byte value interpreted as a Windows-style date.
+.It Dv msdosdate
+A two-byte value interpreted as FAT/DOS-style date.
+.It Dv msdostime
+A two-byte value interpreted as FAT/DOS-style time.
 .It Dv beid3
 A 32-bit ID3 length in big-endian byte order.
 .It Dv beshort
@@ -175,6 +183,12 @@ than UTC.
 .It Dv beqwdate
 An eight-byte value in big-endian byte order,
 interpreted as a Windows-style date.
+.It Dv bemsdosdate
+A two-byte value in big-endian byte order,
+interpreted as FAT/DOS-style date.
+.It Dv bemsdostime
+A two-byte value in big-endian byte order,
+interpreted as FAT/DOS-style time.
 .It Dv bestring16
 A two-byte unicode (UCS16) string in big-endian byte order.
 .It Dv leid3
@@ -206,6 +220,12 @@ than UTC.
 .It Dv leqwdate
 An eight-byte value in little-endian byte order,
 interpreted as a Windows-style date.
+.It Dv lemsdosdate
+A two-byte value in big-endian byte order,
+interpreted as FAT/DOS-style date.
+.It Dv lemsdostime
+A two-byte value in big-endian byte order,
+interpreted as FAT/DOS-style time.
 .It Dv lestring16
 A two-byte unicode (UCS16) string in little-endian byte order.
 .It Dv melong
@@ -360,7 +380,6 @@ For example the magic entries:
 .It Dv octal
 A string representing an octal number.
 .El
-.El
 .Pp
 For compatibility with the Single
 .Ux
@@ -610,9 +629,9 @@ with level
 For more complex files, one can use empty messages to get just the
 "if/then" effect, in the following way:
 .Bd -literal -offset indent
-0      string   MZ
-\*[Gt]0x18  leshort  \*[Lt]0x40   MS-DOS executable
-\*[Gt]0x18  leshort  \*[Gt]0x3f   extended PC executable (e.g., MS Windows)
+0      string    MZ
+\*[Gt]0x18  uleshort  \*[Lt]0x40   MS-DOS executable
+\*[Gt]0x18  uleshort  \*[Gt]0x3f   extended PC executable (e.g., MS Windows)
 .Ed
 .Pp
 Offsets do not need to be constant, but can also be read from the file
@@ -627,17 +646,17 @@ the file.
 The value at that offset is read, and is used again as an offset
 in the file.
 Indirect offsets are of the form:
-.Em (( x [[.,][bBcCeEfFgGhHiIlmsSqQ]][+\-][ y ]) .
+.Em ( x [[.,][bBcCeEfFgGhHiIlmosSqQ]][+\-][ y ]) .
 The value of
 .Em x
 is used as an offset in the file.
 A byte, id3 length, short or long is read at that offset depending on the
-.Em [bBcCeEfFgGhHiIlmsSqQ]
+.Em [bBcCeEfFgGhHiIlLmsSqQ]
 type specifier.
 The value is treated as signed if
-.Dq ,
+.Dq \&,
 is specified or unsigned if
-.Dq .
+.Dq \&.
 is specified.
 The capitalized types interpret the number as a big endian
 value, whereas the small letter versions interpret the number as a little
@@ -652,13 +671,15 @@ The default type if one is not specified is long.
 The following types are recognized:
 .Bl -column -offset indent "Type" "Half/Short" "Little" "Size"
 .It Sy Type	Sy Mnemonic	Sy Endian	Sy Size
-.It bcBc	Byte/Char	N/A	1
+.It bcBC	Byte/Char	N/A	1
 .It efg	Double	Little	8
 .It EFG	Double	Big	8
 .It hs	Half/Short	Little	2
 .It HS	Half/Short	Big	2
 .It i	ID3	Little	4
 .It I	ID3	Big	4
+.It l	Long	Little	4
+.It L	Long	Big	4
 .It m	Middle	Middle	4
 .It o	Octal	Textual	Variable
 .It q	Quad	Little	8
@@ -668,12 +689,12 @@ The following types are recognized:
 That way variable length structures can be examined:
 .Bd -literal -offset indent
 # MS Windows executables are also valid MS-DOS executables
-0           string  MZ
-\*[Gt]0x18       leshort \*[Lt]0x40   MZ executable (MS-DOS)
+0           string   MZ
+\*[Gt]0x18       uleshort \*[Lt]0x40  MZ executable (MS-DOS)
 # skip the whole block below if it is not an extended executable
-\*[Gt]0x18       leshort \*[Gt]0x3f
-\*[Gt]\*[Gt](0x3c.l)  string  PE\e0\e0  PE executable (MS-Windows)
-\*[Gt]\*[Gt](0x3c.l)  string  LX\e0\e0  LX executable (OS/2)
+\*[Gt]0x18       uleshort \*[Gt]0x3f
+\*[Gt]\*[Gt](0x3c.l)  string   PE\e0\e0 PE executable (MS-Windows)
+\*[Gt]\*[Gt](0x3c.l)  string   LX\e0\e0 LX executable (OS/2)
 .Ed
 .Pp
 This strategy of examining has a drawback: you must make sure that you
@@ -687,12 +708,12 @@ inside parentheses allows one to modify
 the value read from the file before it is used as an offset:
 .Bd -literal -offset indent
 # MS Windows executables are also valid MS-DOS executables
-0           string  MZ
+0           string   MZ
 # sometimes, the value at 0x18 is less that 0x40 but there's still an
 # extended executable, simply appended to the file
-\*[Gt]0x18       leshort \*[Lt]0x40
-\*[Gt]\*[Gt](4.s*512) leshort 0x014c  COFF executable (MS-DOS, DJGPP)
-\*[Gt]\*[Gt](4.s*512) leshort !0x014c MZ executable (MS-DOS)
+\*[Gt]0x18       uleshort \*[Lt]0x40
+\*[Gt]\*[Gt](4.s*512) leshort  0x014c  COFF executable (MS-DOS, DJGPP)
+\*[Gt]\*[Gt](4.s*512) leshort  !0x014c MZ executable (MS-DOS)
 .Ed
 .Pp
 Sometimes you do not know the exact offset as this depends on the length or
@@ -702,44 +723,45 @@ field using
 .Sq \*[Am]
 as a prefix to the offset:
 .Bd -literal -offset indent
-0           string  MZ
-\*[Gt]0x18       leshort \*[Gt]0x3f
-\*[Gt]\*[Gt](0x3c.l)  string  PE\e0\e0    PE executable (MS-Windows)
+0           string   MZ
+\*[Gt]0x18       uleshort \*[Gt]0x3f
+\*[Gt]\*[Gt](0x3c.l)  string   PE\e0\e0    PE executable (MS-Windows)
 # immediately following the PE signature is the CPU type
-\*[Gt]\*[Gt]\*[Gt]\*[Am]0       leshort 0x14c     for Intel 80386
-\*[Gt]\*[Gt]\*[Gt]\*[Am]0       leshort 0x184     for DEC Alpha
+\*[Gt]\*[Gt]\*[Gt]\*[Am]0       leshort  0x14c     for Intel 80386
+\*[Gt]\*[Gt]\*[Gt]\*[Am]0       leshort  0x8664    for x86-64
+\*[Gt]\*[Gt]\*[Gt]\*[Am]0       leshort  0x184     for DEC Alpha
 .Ed
 .Pp
 Indirect and relative offsets can be combined:
 .Bd -literal -offset indent
-0             string  MZ
-\*[Gt]0x18         leshort \*[Lt]0x40
-\*[Gt]\*[Gt](4.s*512)   leshort !0x014c MZ executable (MS-DOS)
+0             string   MZ
+\*[Gt]0x18         uleshort \*[Lt]0x40
+\*[Gt]\*[Gt](4.s*512)   leshort  !0x014c MZ executable (MS-DOS)
 # if it's not COFF, go back 512 bytes and add the offset taken
 # from byte 2/3, which is yet another way of finding the start
 # of the extended executable
-\*[Gt]\*[Gt]\*[Gt]\*[Am](2.s-514) string  LE      LE executable (MS Windows VxD driver)
+\*[Gt]\*[Gt]\*[Gt]\*[Am](2.s-514) string   LE      LE executable (MS Windows VxD driver)
 .Ed
 .Pp
 Or the other way around:
 .Bd -literal -offset indent
-0                 string  MZ
-\*[Gt]0x18             leshort \*[Gt]0x3f
-\*[Gt]\*[Gt](0x3c.l)        string  LE\e0\e0  LE executable (MS-Windows)
+0                 string   MZ
+\*[Gt]0x18             uleshort \*[Gt]0x3f
+\*[Gt]\*[Gt](0x3c.l)        string   LE\e0\e0  LE executable (MS-Windows)
 # at offset 0x80 (-4, since relative offsets start at the end
 # of the up-level match) inside the LE header, we find the absolute
 # offset to the code area, where we look for a specific signature
-\*[Gt]\*[Gt]\*[Gt](\*[Am]0x7c.l+0x26) string  UPX     \eb, UPX compressed
+\*[Gt]\*[Gt]\*[Gt](\*[Am]0x7c.l+0x26) string   UPX     \eb, UPX compressed
 .Ed
 .Pp
 Or even both!
 .Bd -literal -offset indent
-0                string  MZ
-\*[Gt]0x18            leshort \*[Gt]0x3f
-\*[Gt]\*[Gt](0x3c.l)       string  LE\e0\e0 LE executable (MS-Windows)
+0                string   MZ
+\*[Gt]0x18            uleshort \*[Gt]0x3f
+\*[Gt]\*[Gt](0x3c.l)       string   LE\e0\e0 LE executable (MS-Windows)
 # at offset 0x58 inside the LE header, we find the relative offset
 # to a data area where we look for a specific signature
-\*[Gt]\*[Gt]\*[Gt]\*[Am](\*[Am]0x54.l-3)  string  UNACE  \eb, ACE self-extracting archive
+\*[Gt]\*[Gt]\*[Gt]\*[Am](\*[Am]0x54.l-3)  string   UNACE  \eb, ACE self-extracting archive
 .Ed
 .Pp
 If you have to deal with offset/length pairs in your file, even the
@@ -749,7 +771,7 @@ Note that this additional indirect offset is always relative to the
 start of the main indirect offset.
 .Bd -literal -offset indent
 0                 string       MZ
-\*[Gt]0x18             leshort      \*[Gt]0x3f
+\*[Gt]0x18             uleshort     \*[Gt]0x3f
 \*[Gt]\*[Gt](0x3c.l)        string       PE\e0\e0 PE executable (MS-Windows)
 # search for the PE section called ".idata"...
 \*[Gt]\*[Gt]\*[Gt]\*[Am]0xf4          search/0x140 .idata
@@ -762,7 +784,7 @@ If you have a list of known values at a particular continuation level,
 and you want to provide a switch-like default case:
 .Bd -literal -offset indent
 # clear that continuation level match
-\*[Gt]18	clear
+\*[Gt]18	clear	x
 \*[Gt]18	lelong	1	one
 \*[Gt]18	lelong	2	two
 \*[Gt]18	default	x
@@ -828,3 +850,15 @@ to make it clearer that those types have specified widths.
 .\" the changes I posted to the S5R2 version.
 .\"
 .\" Modified for Ian Darwin's version of the file command.
+.\"
+.\" For emacs editor
+.\" Local Variables:
+.\" eval: (add-hook 'before-save-hook 'time-stamp)
+.\" time-stamp-start: ".Dd "
+.\" time-stamp-end: "$"
+.\" time-stamp-format: "%:B %02d, %:Y"
+.\" time-stamp-time-zone: "UTC0"
+.\" system-time-locale: "C"
+.\" eval:(setq compile-command (concat "groff -Tlatin1 -m man " (buffer-file-name)) )
+.\" End:
+.\"

m4/libtool.m4

@@ -1,6 +1,7 @@
 # libtool.m4 - Configure libtool for the host system. -*-Autoconf-*-
 #
-#   Copyright (C) 1996-2001, 2003-2015 Free Software Foundation, Inc.
+#   Copyright (C) 1996-2001, 2003-2019, 2021-2022 Free Software
+#   Foundation, Inc.
 #   Written by Gordon Matzigkeit, 1996
 #
 # This file is free software; the Free Software Foundation gives
@@ -31,7 +32,7 @@ m4_define([_LT_COPYING], [dnl
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 ])
 
-# serial 58 LT_INIT
+# serial 59 LT_INIT
 
 
 # LT_PREREQ(VERSION)
@@ -181,6 +182,7 @@ m4_require([_LT_FILEUTILS_DEFAULTS])dnl
 m4_require([_LT_CHECK_SHELL_FEATURES])dnl
 m4_require([_LT_PATH_CONVERSION_FUNCTIONS])dnl
 m4_require([_LT_CMD_RELOAD])dnl
+m4_require([_LT_DECL_FILECMD])dnl
 m4_require([_LT_CHECK_MAGIC_METHOD])dnl
 m4_require([_LT_CHECK_SHAREDLIB_FROM_LINKLIB])dnl
 m4_require([_LT_CMD_OLD_ARCHIVE])dnl
@@ -219,8 +221,8 @@ esac
 ofile=libtool
 can_build_shared=yes
 
-# All known linkers require a '.a' archive for static linking (except MSVC,
-# which needs '.lib').
+# All known linkers require a '.a' archive for static linking (except MSVC and
+# ICC, which need '.lib').
 libext=a
 
 with_gnu_ld=$lt_cv_prog_gnu_ld
@@ -778,7 +780,7 @@ _LT_EOF
   # if finds mixed CR/LF and LF-only lines.  Since sed operates in
   # text mode, it properly converts lines to CR/LF.  This bash problem
   # is reportedly fixed, but why not run on old versions too?
-  sed '$q' "$ltmain" >> "$cfgfile" \
+  $SED '$q' "$ltmain" >> "$cfgfile" \
      || (rm -f "$cfgfile"; exit 1)
 
    mv -f "$cfgfile" "$ofile" ||
@@ -1042,8 +1044,8 @@ int forced_loaded() { return 2;}
 _LT_EOF
       echo "$LTCC $LTCFLAGS -c -o conftest.o conftest.c" >&AS_MESSAGE_LOG_FD
       $LTCC $LTCFLAGS -c -o conftest.o conftest.c 2>&AS_MESSAGE_LOG_FD
-      echo "$AR cru libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
-      $AR cru libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
+      echo "$AR $AR_FLAGS libconftest.a conftest.o" >&AS_MESSAGE_LOG_FD
+      $AR $AR_FLAGS libconftest.a conftest.o 2>&AS_MESSAGE_LOG_FD
       echo "$RANLIB libconftest.a" >&AS_MESSAGE_LOG_FD
       $RANLIB libconftest.a 2>&AS_MESSAGE_LOG_FD
       cat > conftest.c << _LT_EOF
@@ -1067,17 +1069,12 @@ _LT_EOF
       _lt_dar_allow_undefined='$wl-undefined ${wl}suppress' ;;
     darwin1.*)
       _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-    darwin*) # darwin 5.x on
-      # if running on 10.5 or later, the deployment target defaults
-      # to the OS version, if on x86, and 10.4, the deployment
-      # target defaults to 10.4. Don't you love it?
-      case ${MACOSX_DEPLOYMENT_TARGET-10.0},$host in
-	10.0,*86*-darwin8*|10.0,*-darwin[[91]]*)
-	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
-	10.[[012]][[,.]]*)
-	  _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
-	10.*)
-	  _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
+    darwin*)
+      case $MACOSX_DEPLOYMENT_TARGET,$host in
+        10.[[012]],*|,*powerpc*-darwin[[5-8]]*)
+          _lt_dar_allow_undefined='$wl-flat_namespace $wl-undefined ${wl}suppress' ;;
+        *)
+          _lt_dar_allow_undefined='$wl-undefined ${wl}dynamic_lookup' ;;
       esac
     ;;
   esac
@@ -1126,12 +1123,12 @@ m4_defun([_LT_DARWIN_LINKER_FEATURES],
     output_verbose_link_cmd=func_echo_all
     _LT_TAGVAR(archive_cmds, $1)="\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dsymutil"
     _LT_TAGVAR(module_cmds, $1)="\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dsymutil"
-    _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
-    _LT_TAGVAR(module_expsym_cmds, $1)="sed -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
+    _LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$libobjs \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring $_lt_dar_single_mod$_lt_dar_export_syms$_lt_dsymutil"
+    _LT_TAGVAR(module_expsym_cmds, $1)="$SED -e 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC \$allow_undefined_flag -o \$lib -bundle \$libobjs \$deplibs \$compiler_flags$_lt_dar_export_syms$_lt_dsymutil"
     m4_if([$1], [CXX],
 [   if test yes != "$lt_cv_apple_cc_single_mod"; then
       _LT_TAGVAR(archive_cmds, $1)="\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dsymutil"
-      _LT_TAGVAR(archive_expsym_cmds, $1)="sed 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
+      _LT_TAGVAR(archive_expsym_cmds, $1)="$SED 's|^|_|' < \$export_symbols > \$output_objdir/\$libname-symbols.expsym~\$CC -r -keep_private_externs -nostdlib -o \$lib-master.o \$libobjs~\$CC -dynamiclib \$allow_undefined_flag -o \$lib \$lib-master.o \$deplibs \$compiler_flags -install_name \$rpath/\$soname \$verstring$_lt_dar_export_syms$_lt_dsymutil"
     fi
 ],[])
   else
@@ -1245,7 +1242,8 @@ _LT_DECL([], [ECHO], [1], [An echo program that protects backslashes])
 # _LT_WITH_SYSROOT
 # ----------------
 AC_DEFUN([_LT_WITH_SYSROOT],
-[AC_MSG_CHECKING([for sysroot])
+[m4_require([_LT_DECL_SED])dnl
+AC_MSG_CHECKING([for sysroot])
 AC_ARG_WITH([sysroot],
 [AS_HELP_STRING([--with-sysroot@<:@=DIR@:>@],
   [Search for dependent libraries within DIR (or the compiler's sysroot
@@ -1262,7 +1260,7 @@ case $with_sysroot in #(
    fi
    ;; #(
  /*)
-   lt_sysroot=`echo "$with_sysroot" | sed -e "$sed_quote_subst"`
+   lt_sysroot=`echo "$with_sysroot" | $SED -e "$sed_quote_subst"`
    ;; #(
  no|'')
    ;; #(
@@ -1292,7 +1290,7 @@ ia64-*-hpux*)
   # options accordingly.
   echo 'int i;' > conftest.$ac_ext
   if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *ELF-32*)
 	HPUX_IA64_MODE=32
 	;;
@@ -1309,7 +1307,7 @@ ia64-*-hpux*)
   echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
   if AC_TRY_EVAL(ac_compile); then
     if test yes = "$lt_cv_prog_gnu_ld"; then
-      case `/usr/bin/file conftest.$ac_objext` in
+      case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	  LD="${LD-ld} -melf32bsmip"
 	  ;;
@@ -1321,7 +1319,7 @@ ia64-*-hpux*)
 	;;
       esac
     else
-      case `/usr/bin/file conftest.$ac_objext` in
+      case `$FILECMD conftest.$ac_objext` in
 	*32-bit*)
 	  LD="${LD-ld} -32"
 	  ;;
@@ -1343,7 +1341,7 @@ mips64*-*linux*)
   echo '[#]line '$LINENO' "configure"' > conftest.$ac_ext
   if AC_TRY_EVAL(ac_compile); then
     emul=elf
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *32-bit*)
 	emul="${emul}32"
 	;;
@@ -1351,7 +1349,7 @@ mips64*-*linux*)
 	emul="${emul}64"
 	;;
     esac
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *MSB*)
 	emul="${emul}btsmip"
 	;;
@@ -1359,7 +1357,7 @@ mips64*-*linux*)
 	emul="${emul}ltsmip"
 	;;
     esac
-    case `/usr/bin/file conftest.$ac_objext` in
+    case `$FILECMD conftest.$ac_objext` in
       *N32*)
 	emul="${emul}n32"
 	;;
@@ -1379,14 +1377,14 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
   # not appear in the list.
   echo 'int i;' > conftest.$ac_ext
   if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.o` in
+    case `$FILECMD conftest.o` in
       *32-bit*)
 	case $host in
 	  x86_64-*kfreebsd*-gnu)
 	    LD="${LD-ld} -m elf_i386_fbsd"
 	    ;;
 	  x86_64-*linux*)
-	    case `/usr/bin/file conftest.o` in
+	    case `$FILECMD conftest.o` in
 	      *x86-64*)
 		LD="${LD-ld} -m elf32_x86_64"
 		;;
@@ -1454,7 +1452,7 @@ s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
   # options accordingly.
   echo 'int i;' > conftest.$ac_ext
   if AC_TRY_EVAL(ac_compile); then
-    case `/usr/bin/file conftest.o` in
+    case `$FILECMD conftest.o` in
     *64-bit*)
       case $lt_cv_prog_gnu_ld in
       yes*)
@@ -1493,9 +1491,22 @@ need_locks=$enable_libtool_lock
 m4_defun([_LT_PROG_AR],
 [AC_CHECK_TOOLS(AR, [ar], false)
 : ${AR=ar}
-: ${AR_FLAGS=cru}
 _LT_DECL([], [AR], [1], [The archiver])
-_LT_DECL([], [AR_FLAGS], [1], [Flags to create an archive])
+
+# Use ARFLAGS variable as AR's operation code to sync the variable naming with
+# Automake.  If both AR_FLAGS and ARFLAGS are specified, AR_FLAGS should have
+# higher priority because thats what people were doing historically (setting
+# ARFLAGS for automake and AR_FLAGS for libtool).  FIXME: Make the AR_FLAGS
+# variable obsoleted/removed.
+
+test ${AR_FLAGS+y} || AR_FLAGS=${ARFLAGS-cr}
+lt_ar_flags=$AR_FLAGS
+_LT_DECL([], [lt_ar_flags], [0], [Flags to create an archive (by configure)])
+
+# Make AR_FLAGS overridable by 'make ARFLAGS='.  Don't try to run-time override
+# by AR_FLAGS because that was never working and AR_FLAGS is about to die.
+_LT_DECL([], [AR_FLAGS], [\@S|@{ARFLAGS-"\@S|@lt_ar_flags"}],
+         [Flags to create an archive])
 
 AC_CACHE_CHECK([for archiver @FILE support], [lt_cv_ar_at_file],
   [lt_cv_ar_at_file=no
@@ -1714,7 +1725,7 @@ AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl
     lt_cv_sys_max_cmd_len=8192;
     ;;
 
-  bitrig* | darwin* | dragonfly* | freebsd* | netbsd* | openbsd*)
+  bitrig* | darwin* | dragonfly* | freebsd* | midnightbsd* | netbsd* | openbsd*)
     # This has been around since 386BSD, at least.  Likely further.
     if test -x /sbin/sysctl; then
       lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax`
@@ -1757,7 +1768,7 @@ AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl
   sysv5* | sco5v6* | sysv4.2uw2*)
     kargmax=`grep ARG_MAX /etc/conf/cf.d/stune 2>/dev/null`
     if test -n "$kargmax"; then
-      lt_cv_sys_max_cmd_len=`echo $kargmax | sed 's/.*[[	 ]]//'`
+      lt_cv_sys_max_cmd_len=`echo $kargmax | $SED 's/.*[[	 ]]//'`
     else
       lt_cv_sys_max_cmd_len=32768
     fi
@@ -2207,26 +2218,35 @@ m4_defun([_LT_CMD_STRIPLIB],
 striplib=
 old_striplib=
 AC_MSG_CHECKING([whether stripping libraries is possible])
-if test -n "$STRIP" && $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
-  test -z "$old_striplib" && old_striplib="$STRIP --strip-debug"
-  test -z "$striplib" && striplib="$STRIP --strip-unneeded"
-  AC_MSG_RESULT([yes])
+if test -z "$STRIP"; then
+  AC_MSG_RESULT([no])
 else
-# FIXME - insert some real tests, host_os isn't really good enough
-  case $host_os in
-  darwin*)
-    if test -n "$STRIP"; then
+  if $STRIP -V 2>&1 | $GREP "GNU strip" >/dev/null; then
+    old_striplib="$STRIP --strip-debug"
+    striplib="$STRIP --strip-unneeded"
+    AC_MSG_RESULT([yes])
+  else
+    case $host_os in
+    darwin*)
+      # FIXME - insert some real tests, host_os isn't really good enough
       striplib="$STRIP -x"
       old_striplib="$STRIP -S"
       AC_MSG_RESULT([yes])
-    else
+      ;;
+    freebsd*)
+      if $STRIP -V 2>&1 | $GREP "elftoolchain" >/dev/null; then
+        old_striplib="$STRIP --strip-debug"
+        striplib="$STRIP --strip-unneeded"
+        AC_MSG_RESULT([yes])
+      else
+        AC_MSG_RESULT([no])
+      fi
+      ;;
+    *)
       AC_MSG_RESULT([no])
-    fi
-    ;;
-  *)
-    AC_MSG_RESULT([no])
-    ;;
-  esac
+      ;;
+    esac
+  fi
 fi
 _LT_DECL([], [old_striplib], [1], [Commands to strip libraries])
 _LT_DECL([], [striplib], [1])
@@ -2549,7 +2569,7 @@ cygwin* | mingw* | pw32* | cegcc*)
     case $host_os in
     cygwin*)
       # Cygwin DLLs use 'cyg' prefix rather than 'lib'
-      soname_spec='`echo $libname | sed -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
+      soname_spec='`echo $libname | $SED -e 's/^lib/cyg/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
 m4_if([$1], [],[
       sys_lib_search_path_spec="$sys_lib_search_path_spec /usr/lib/w32api"])
       ;;
@@ -2559,14 +2579,14 @@ m4_if([$1], [],[
       ;;
     pw32*)
       # pw32 DLLs use 'pw' prefix rather than 'lib'
-      library_names_spec='`echo $libname | sed -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
+      library_names_spec='`echo $libname | $SED -e 's/^lib/pw/'``echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
       ;;
     esac
     dynamic_linker='Win32 ld.exe'
     ;;
 
-  *,cl*)
-    # Native MSVC
+  *,cl* | *,icl*)
+    # Native MSVC or ICC
     libname_spec='$name'
     soname_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext'
     library_names_spec='$libname.dll.lib'
@@ -2585,7 +2605,7 @@ m4_if([$1], [],[
       done
       IFS=$lt_save_ifs
       # Convert to MSYS style.
-      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | sed -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'`
+      sys_lib_search_path_spec=`$ECHO "$sys_lib_search_path_spec" | $SED -e 's|\\\\|/|g' -e 's| \\([[a-zA-Z]]\\):| /\\1|g' -e 's|^ ||'`
       ;;
     cygwin*)
       # Convert to unix form, then to dos form, then back to unix form
@@ -2622,7 +2642,7 @@ m4_if([$1], [],[
     ;;
 
   *)
-    # Assume MSVC wrapper
+    # Assume MSVC and ICC wrapper
     library_names_spec='$libname`echo $release | $SED -e 's/[[.]]/-/g'`$versuffix$shared_ext $libname.lib'
     dynamic_linker='Win32 ld.exe'
     ;;
@@ -2655,7 +2675,7 @@ dgux*)
   shlibpath_var=LD_LIBRARY_PATH
   ;;
 
-freebsd* | dragonfly*)
+freebsd* | dragonfly* | midnightbsd*)
   # DragonFly does not have aout.  When/if they implement a new
   # versioning mechanism, adjust this.
   if test -x /usr/bin/objformat; then
@@ -3454,7 +3474,7 @@ beos*)
 
 bsdi[[45]]*)
   lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (shared object|dynamic lib)'
-  lt_cv_file_magic_cmd='/usr/bin/file -L'
+  lt_cv_file_magic_cmd='$FILECMD -L'
   lt_cv_file_magic_test_file=/shlib/libc.so
   ;;
 
@@ -3488,14 +3508,14 @@ darwin* | rhapsody*)
   lt_cv_deplibs_check_method=pass_all
   ;;
 
-freebsd* | dragonfly*)
+freebsd* | dragonfly* | midnightbsd*)
   if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
     case $host_cpu in
     i*86 )
       # Not sure whether the presence of OpenBSD here was a mistake.
       # Let's accept both of them until this is cleared up.
       lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly)/i[[3-9]]86 (compact )?demand paged shared library'
-      lt_cv_file_magic_cmd=/usr/bin/file
+      lt_cv_file_magic_cmd=$FILECMD
       lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*`
       ;;
     esac
@@ -3509,7 +3529,7 @@ haiku*)
   ;;
 
 hpux10.20* | hpux11*)
-  lt_cv_file_magic_cmd=/usr/bin/file
+  lt_cv_file_magic_cmd=$FILECMD
   case $host_cpu in
   ia64*)
     lt_cv_deplibs_check_method='file_magic (s[[0-9]][[0-9]][[0-9]]|ELF-[[0-9]][[0-9]]) shared object file - IA64'
@@ -3556,7 +3576,7 @@ netbsd*)
 
 newos6*)
   lt_cv_deplibs_check_method='file_magic ELF [[0-9]][[0-9]]*-bit [[ML]]SB (executable|dynamic lib)'
-  lt_cv_file_magic_cmd=/usr/bin/file
+  lt_cv_file_magic_cmd=$FILECMD
   lt_cv_file_magic_test_file=/usr/lib/libnls.so
   ;;
 
@@ -3683,13 +3703,13 @@ else
 	mingw*) lt_bad_file=conftest.nm/nofile ;;
 	*) lt_bad_file=/dev/null ;;
 	esac
-	case `"$tmp_nm" -B $lt_bad_file 2>&1 | sed '1q'` in
+	case `"$tmp_nm" -B $lt_bad_file 2>&1 | $SED '1q'` in
 	*$lt_bad_file* | *'Invalid file or object type'*)
 	  lt_cv_path_NM="$tmp_nm -B"
 	  break 2
 	  ;;
 	*)
-	  case `"$tmp_nm" -p /dev/null 2>&1 | sed '1q'` in
+	  case `"$tmp_nm" -p /dev/null 2>&1 | $SED '1q'` in
 	  */dev/null*)
 	    lt_cv_path_NM="$tmp_nm -p"
 	    break 2
@@ -3715,7 +3735,7 @@ else
     # Let the user override the test.
   else
     AC_CHECK_TOOLS(DUMPBIN, [dumpbin "link -dump"], :)
-    case `$DUMPBIN -symbols -headers /dev/null 2>&1 | sed '1q'` in
+    case `$DUMPBIN -symbols -headers /dev/null 2>&1 | $SED '1q'` in
     *COFF*)
       DUMPBIN="$DUMPBIN -symbols -headers"
       ;;
@@ -3955,7 +3975,7 @@ esac
 
 if test "$lt_cv_nm_interface" = "MS dumpbin"; then
   # Gets list of data symbols to import.
-  lt_cv_sys_global_symbol_to_import="sed -n -e 's/^I .* \(.*\)$/\1/p'"
+  lt_cv_sys_global_symbol_to_import="$SED -n -e 's/^I .* \(.*\)$/\1/p'"
   # Adjust the below global symbol transforms to fixup imported variables.
   lt_cdecl_hook=" -e 's/^I .* \(.*\)$/extern __declspec(dllimport) char \1;/p'"
   lt_c_name_hook=" -e 's/^I .* \(.*\)$/  {\"\1\", (void *) 0},/p'"
@@ -3973,20 +3993,20 @@ fi
 # Transform an extracted symbol line into a proper C declaration.
 # Some systems (esp. on ia64) link data and code symbols differently,
 # so use this general approach.
-lt_cv_sys_global_symbol_to_cdecl="sed -n"\
+lt_cv_sys_global_symbol_to_cdecl="$SED -n"\
 $lt_cdecl_hook\
 " -e 's/^T .* \(.*\)$/extern int \1();/p'"\
 " -e 's/^$symcode$symcode* .* \(.*\)$/extern char \1;/p'"
 
 # Transform an extracted symbol line into symbol name and symbol address
-lt_cv_sys_global_symbol_to_c_name_address="sed -n"\
+lt_cv_sys_global_symbol_to_c_name_address="$SED -n"\
 $lt_c_name_hook\
 " -e 's/^: \(.*\) .*$/  {\"\1\", (void *) 0},/p'"\
 " -e 's/^$symcode$symcode* .* \(.*\)$/  {\"\1\", (void *) \&\1},/p'"
 
 # Transform an extracted symbol line into symbol name with lib prefix and
 # symbol address.
-lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="sed -n"\
+lt_cv_sys_global_symbol_to_c_name_address_lib_prefix="$SED -n"\
 $lt_c_name_lib_hook\
 " -e 's/^: \(.*\) .*$/  {\"\1\", (void *) 0},/p'"\
 " -e 's/^$symcode$symcode* .* \(lib.*\)$/  {\"\1\", (void *) \&\1},/p'"\
@@ -4010,7 +4030,7 @@ for ac_symprfx in "" "_"; do
   if test "$lt_cv_nm_interface" = "MS dumpbin"; then
     # Fake it for dumpbin and say T for any non-static function,
     # D for any global variable and I for any imported variable.
-    # Also find C++ and __fastcall symbols from MSVC++,
+    # Also find C++ and __fastcall symbols from MSVC++ or ICC,
     # which start with @ or ?.
     lt_cv_sys_global_symbol_pipe="$AWK ['"\
 "     {last_section=section; section=\$ 3};"\
@@ -4028,9 +4048,9 @@ for ac_symprfx in "" "_"; do
 "     s[1]~prfx {split(s[1],t,\"@\"); print f,t[1],substr(t[1],length(prfx))}"\
 "     ' prfx=^$ac_symprfx]"
   else
-    lt_cv_sys_global_symbol_pipe="sed -n -e 's/^.*[[	 ]]\($symcode$symcode*\)[[	 ]][[	 ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
+    lt_cv_sys_global_symbol_pipe="$SED -n -e 's/^.*[[	 ]]\($symcode$symcode*\)[[	 ]][[	 ]]*$ac_symprfx$sympat$opt_cr$/$symxfrm/p'"
   fi
-  lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | sed '/ __gnu_lto/d'"
+  lt_cv_sys_global_symbol_pipe="$lt_cv_sys_global_symbol_pipe | $SED '/ __gnu_lto/d'"
 
   # Check to see that the pipe works correctly.
   pipe_works=no
@@ -4317,7 +4337,7 @@ m4_if([$1], [CXX], [
 	    ;;
 	esac
 	;;
-      freebsd* | dragonfly*)
+      freebsd* | dragonfly* | midnightbsd*)
 	# FreeBSD uses GNU C++
 	;;
       hpux9* | hpux10* | hpux11*)
@@ -4400,7 +4420,7 @@ m4_if([$1], [CXX], [
 	    _LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
 	    ;;
 	  *)
-	    case `$CC -V 2>&1 | sed 5q` in
+	    case `$CC -V 2>&1 | $SED 5q` in
 	    *Sun\ C*)
 	      # Sun C++ 5.9
 	      _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
@@ -4736,7 +4756,7 @@ m4_if([$1], [CXX], [
 	_LT_TAGVAR(lt_prog_compiler_static, $1)='-qstaticlink'
 	;;
       *)
-	case `$CC -V 2>&1 | sed 5q` in
+	case `$CC -V 2>&1 | $SED 5q` in
 	*Sun\ Ceres\ Fortran* | *Sun*Fortran*\ [[1-7]].* | *Sun*Fortran*\ 8.[[0-3]]*)
 	  # Sun Fortran 8.3 passes all unrecognized flags to the linker
 	  _LT_TAGVAR(lt_prog_compiler_pic, $1)='-KPIC'
@@ -4919,7 +4939,7 @@ m4_if([$1], [CXX], [
     if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
       _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
     else
-      _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
+      _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
     fi
     ;;
   pw32*)
@@ -4927,7 +4947,7 @@ m4_if([$1], [CXX], [
     ;;
   cygwin* | mingw* | cegcc*)
     case $cc_basename in
-    cl*)
+    cl* | icl*)
       _LT_TAGVAR(exclude_expsyms, $1)='_NULL_IMPORT_DESCRIPTOR|_IMPORT_DESCRIPTOR_.*'
       ;;
     *)
@@ -4984,15 +5004,15 @@ dnl Note also adjust exclude_expsyms for C++ above.
 
   case $host_os in
   cygwin* | mingw* | pw32* | cegcc*)
-    # FIXME: the MSVC++ port hasn't been tested in a loooong time
+    # FIXME: the MSVC++ and ICC port hasn't been tested in a loooong time
     # When not using gcc, we currently assume that we are using
-    # Microsoft Visual C++.
+    # Microsoft Visual C++ or Intel C++ Compiler.
     if test yes != "$GCC"; then
       with_gnu_ld=no
     fi
     ;;
   interix*)
-    # we just hope/assume this is gcc and not c89 (= MSVC++)
+    # we just hope/assume this is gcc and not c89 (= MSVC++ or ICC)
     with_gnu_ld=yes
     ;;
   openbsd* | bitrig*)
@@ -5044,7 +5064,7 @@ dnl Note also adjust exclude_expsyms for C++ above.
       _LT_TAGVAR(whole_archive_flag_spec, $1)=
     fi
     supports_anon_versioning=no
-    case `$LD -v | $SED -e 's/([^)]\+)\s\+//' 2>&1` in
+    case `$LD -v | $SED -e 's/([[^)]]\+)\s\+//' 2>&1` in
       *GNU\ gold*) supports_anon_versioning=yes ;;
       *\ [[01]].* | *\ 2.[[0-9]].* | *\ 2.10.*) ;; # catch versions < 2.11
       *\ 2.11.93.0.2\ *) supports_anon_versioning=yes ;; # RH7.3 ...
@@ -5156,6 +5176,7 @@ _LT_EOF
 	emximp -o $lib $output_objdir/$libname.def'
       _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
       _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+      _LT_TAGVAR(file_list_spec, $1)='@'
       ;;
 
     interix[[3-9]]*)
@@ -5170,7 +5191,7 @@ _LT_EOF
       # 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
       # time.  Moving up from 0x10000000 also allows more sbrk(2) space.
       _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
-      _LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
+      _LT_TAGVAR(archive_expsym_cmds, $1)='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
       ;;
 
     gnu* | linux* | tpf* | k*bsd*-gnu | kopensolaris*-gnu)
@@ -5213,7 +5234,7 @@ _LT_EOF
 	  _LT_TAGVAR(compiler_needs_object, $1)=yes
 	  ;;
 	esac
-	case `$CC -V 2>&1 | sed 5q` in
+	case `$CC -V 2>&1 | $SED 5q` in
 	*Sun\ C*)			# Sun C 5.9
 	  _LT_TAGVAR(whole_archive_flag_spec, $1)='$wl--whole-archive`new_convenience=; for conv in $convenience\"\"; do test -z \"$conv\" || new_convenience=\"$new_convenience,$conv\"; done; func_echo_all \"$new_convenience\"` $wl--no-whole-archive'
 	  _LT_TAGVAR(compiler_needs_object, $1)=yes
@@ -5225,7 +5246,7 @@ _LT_EOF
 
         if test yes = "$supports_anon_versioning"; then
           _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-            cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+            cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
             echo "local: *; };" >> $output_objdir/$libname.ver~
             $CC '"$tmp_sharedflag""$tmp_addflag"' $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
         fi
@@ -5241,7 +5262,7 @@ _LT_EOF
 	  _LT_TAGVAR(archive_cmds, $1)='$LD -shared $libobjs $deplibs $linker_flags -soname $soname -o $lib'
 	  if test yes = "$supports_anon_versioning"; then
 	    _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-              cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+              cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
               echo "local: *; };" >> $output_objdir/$libname.ver~
               $LD -shared $libobjs $deplibs $linker_flags -soname $soname -version-script $output_objdir/$libname.ver -o $lib'
 	  fi
@@ -5373,7 +5394,7 @@ _LT_EOF
 	if $NM -V 2>&1 | $GREP 'GNU' > /dev/null; then
 	  _LT_TAGVAR(export_symbols_cmds, $1)='$NM -Bpg $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W")) && ([substr](\$ 3,1,1) != ".")) { if (\$ 2 == "W") { print \$ 3 " weak" } else { print \$ 3 } } }'\'' | sort -u > $export_symbols'
 	else
-	  _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
+	  _LT_TAGVAR(export_symbols_cmds, $1)='`func_echo_all $NM | $SED -e '\''s/B\([[^B]]*\)$/P\1/'\''` -PCpgl $libobjs $convenience | awk '\''{ if (((\$ 2 == "T") || (\$ 2 == "D") || (\$ 2 == "B") || (\$ 2 == "L") || (\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) && ([substr](\$ 1,1,1) != ".")) { if ((\$ 2 == "W") || (\$ 2 == "V") || (\$ 2 == "Z")) { print \$ 1 " weak" } else { print \$ 1 } } }'\'' | sort -u > $export_symbols'
 	fi
 	aix_use_runtimelinking=no
 
@@ -5556,12 +5577,12 @@ _LT_EOF
 
     cygwin* | mingw* | pw32* | cegcc*)
       # When not using gcc, we currently assume that we are using
-      # Microsoft Visual C++.
+      # Microsoft Visual C++ or Intel C++ Compiler.
       # hardcode_libdir_flag_spec is actually meaningless, as there is
       # no search path for DLLs.
       case $cc_basename in
-      cl*)
-	# Native MSVC
+      cl* | icl*)
+	# Native MSVC or ICC
 	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
 	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
 	_LT_TAGVAR(always_export_symbols, $1)=yes
@@ -5602,7 +5623,7 @@ _LT_EOF
           fi'
 	;;
       *)
-	# Assume MSVC wrapper
+	# Assume MSVC and ICC wrapper
 	_LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
 	_LT_TAGVAR(allow_undefined_flag, $1)=unsupported
 	# Tell ltmain to make .lib files, not .a files.
@@ -5650,7 +5671,7 @@ _LT_EOF
       ;;
 
     # FreeBSD 3 and greater uses gcc -shared to do shared libraries.
-    freebsd* | dragonfly*)
+    freebsd* | dragonfly* | midnightbsd*)
       _LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag -o $lib $libobjs $deplibs $compiler_flags'
       _LT_TAGVAR(hardcode_libdir_flag_spec, $1)='-R$libdir'
       _LT_TAGVAR(hardcode_direct, $1)=yes
@@ -5861,6 +5882,7 @@ _LT_EOF
 	emximp -o $lib $output_objdir/$libname.def'
       _LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
       _LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+      _LT_TAGVAR(file_list_spec, $1)='@'
       ;;
 
     osf3*)
@@ -6631,8 +6653,8 @@ if test yes != "$_lt_caught_CXX_error"; then
 
       cygwin* | mingw* | pw32* | cegcc*)
 	case $GXX,$cc_basename in
-	,cl* | no,cl*)
-	  # Native MSVC
+	,cl* | no,cl* | ,icl* | no,icl*)
+	  # Native MSVC or ICC
 	  # hardcode_libdir_flag_spec is actually meaningless, as there is
 	  # no search path for DLLs.
 	  _LT_TAGVAR(hardcode_libdir_flag_spec, $1)=' '
@@ -6730,6 +6752,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	  emximp -o $lib $output_objdir/$libname.def'
 	_LT_TAGVAR(old_archive_From_new_cmds, $1)='emximp -o $output_objdir/${libname}_dll.a $output_objdir/$libname.def'
 	_LT_TAGVAR(enable_shared_with_static_runtimes, $1)=yes
+	_LT_TAGVAR(file_list_spec, $1)='@'
 	;;
 
       dgux*)
@@ -6760,7 +6783,7 @@ if test yes != "$_lt_caught_CXX_error"; then
         _LT_TAGVAR(archive_cmds_need_lc, $1)=no
         ;;
 
-      freebsd* | dragonfly*)
+      freebsd* | dragonfly* | midnightbsd*)
         # FreeBSD 3 and later use GNU C++ and GNU ld with standard ELF
         # conventions
         _LT_TAGVAR(ld_shlibs, $1)=yes
@@ -6897,7 +6920,7 @@ if test yes != "$_lt_caught_CXX_error"; then
 	# 256 KiB-aligned image base between 0x50000000 and 0x6FFC0000 at link
 	# time.  Moving up from 0x10000000 also allows more sbrk(2) space.
 	_LT_TAGVAR(archive_cmds, $1)='$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
-	_LT_TAGVAR(archive_expsym_cmds, $1)='sed "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
+	_LT_TAGVAR(archive_expsym_cmds, $1)='$SED "s|^|_|" $export_symbols >$output_objdir/$soname.expsym~$CC -shared $pic_flag $libobjs $deplibs $compiler_flags $wl-h,$soname $wl--retain-symbols-file,$output_objdir/$soname.expsym $wl--image-base,`expr ${RANDOM-$$} % 4096 / 2 \* 262144 + 1342177280` -o $lib'
 	;;
       irix5* | irix6*)
         case $cc_basename in
@@ -7037,13 +7060,13 @@ if test yes != "$_lt_caught_CXX_error"; then
 	    _LT_TAGVAR(archive_cmds, $1)='$CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname -o $lib'
 	    if test yes = "$supports_anon_versioning"; then
 	      _LT_TAGVAR(archive_expsym_cmds, $1)='echo "{ global:" > $output_objdir/$libname.ver~
-                cat $export_symbols | sed -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
+                cat $export_symbols | $SED -e "s/\(.*\)/\1;/" >> $output_objdir/$libname.ver~
                 echo "local: *; };" >> $output_objdir/$libname.ver~
                 $CC -qmkshrobj $libobjs $deplibs $compiler_flags $wl-soname $wl$soname $wl-version-script $wl$output_objdir/$libname.ver -o $lib'
 	    fi
 	    ;;
 	  *)
-	    case `$CC -V 2>&1 | sed 5q` in
+	    case `$CC -V 2>&1 | $SED 5q` in
 	    *Sun\ C*)
 	      # Sun C++ 5.9
 	      _LT_TAGVAR(no_undefined_flag, $1)=' -zdefs'
@@ -8189,6 +8212,14 @@ _LT_DECL([], [DLLTOOL], [1], [DLL creation program])
 AC_SUBST([DLLTOOL])
 ])
 
+# _LT_DECL_FILECMD
+# ----------------
+# Check for a file(cmd) program that can be used to detect file type and magic
+m4_defun([_LT_DECL_FILECMD],
+[AC_CHECK_TOOL([FILECMD], [file], [:])
+_LT_DECL([], [FILECMD], [1], [A file(cmd) program that detects file types])
+])# _LD_DECL_FILECMD
+
 # _LT_DECL_SED
 # ------------
 # Check for a fully-functional sed program, that truncates

m4/ltoptions.m4

@@ -1,7 +1,7 @@
 # Helper functions for option handling.                    -*- Autoconf -*-
 #
-#   Copyright (C) 2004-2005, 2007-2009, 2011-2015 Free Software
-#   Foundation, Inc.
+#   Copyright (C) 2004-2005, 2007-2009, 2011-2019, 2021-2022 Free
+#   Software Foundation, Inc.
 #   Written by Gary V. Vaughan, 2004
 #
 # This file is free software; the Free Software Foundation gives

m4/ltsugar.m4

@@ -1,6 +1,6 @@
 # ltsugar.m4 -- libtool m4 base layer.                         -*-Autoconf-*-
 #
-# Copyright (C) 2004-2005, 2007-2008, 2011-2015 Free Software
+# Copyright (C) 2004-2005, 2007-2008, 2011-2019, 2021-2022 Free Software
 # Foundation, Inc.
 # Written by Gary V. Vaughan, 2004
 #

m4/ltversion.m4

@@ -1,6 +1,7 @@
 # ltversion.m4 -- version numbers			-*- Autoconf -*-
 #
-#   Copyright (C) 2004, 2011-2015 Free Software Foundation, Inc.
+#   Copyright (C) 2004, 2011-2019, 2021-2022 Free Software Foundation,
+#   Inc.
 #   Written by Scott James Remnant, 2004
 #
 # This file is free software; the Free Software Foundation gives
@@ -9,15 +10,15 @@
 
 # @configure_input@
 
-# serial 4179 ltversion.m4
+# serial 4245 ltversion.m4
 # This file is part of GNU Libtool
 
-m4_define([LT_PACKAGE_VERSION], [2.4.6])
-m4_define([LT_PACKAGE_REVISION], [2.4.6])
+m4_define([LT_PACKAGE_VERSION], [2.4.7])
+m4_define([LT_PACKAGE_REVISION], [2.4.7])
 
 AC_DEFUN([LTVERSION_VERSION],
-[macro_version='2.4.6'
-macro_revision='2.4.6'
+[macro_version='2.4.7'
+macro_revision='2.4.7'
 _LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?])
 _LT_DECL(, macro_revision, 0)
 ])

m4/lt~obsolete.m4

@@ -1,7 +1,7 @@
 # lt~obsolete.m4 -- aclocal satisfying obsolete definitions.    -*-Autoconf-*-
 #
-#   Copyright (C) 2004-2005, 2007, 2009, 2011-2015 Free Software
-#   Foundation, Inc.
+#   Copyright (C) 2004-2005, 2007, 2009, 2011-2019, 2021-2022 Free
+#   Software Foundation, Inc.
 #   Written by Scott James Remnant, 2004.
 #
 # This file is free software; the Free Software Foundation gives

magic/Magdir/acorn

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: acorn,v 1.8 2021/04/26 15:56:00 christos Exp $
+# $File: acorn,v 1.9 2024/08/30 17:29:28 christos Exp $
 # acorn:  file(1) magic for files found on Acorn systems
 #
 
@@ -67,36 +67,3 @@
 >>8	byte	x	version %d,
 >>10	leshort	=1	1 pattern
 >>10	leshort	!1	%d patterns
-
-# From: Joerg Jenderek
-# URL: https://www.kyzer.me.uk/pack/xad/#PackDir
-# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c
-# GRR: line below is too general as it matches also "Git pack" in ./revision
-0	string	PACK\0
-# check for valid compression method 0-4
->5	ulelong	<5
-# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems
-# To skip "Git pack" version 0 test for root directory object like
-# ADFS::RPC.$.websitezip.FONTFIX
->>9	string	>ADFS\  PackDir archive (RISC OS)
-# TrID labels above as "Acorn PackDir compressed Archive"
-# compression mode y (0 - 4) for GIF LZW with a maximum n bits
-# (y~n,0~12,1~13,2~14,3~15,4~16)
->>>5	ulelong+12 x	\b, LZW %u-bits compression
-# https://www.filebase.org.uk/filetypes
-# !Packdir compressed archive has three hexadecimal digits code 68E
-!:mime	application/x-acorn-68E
-!:ext	pkd/bin
-# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
->>>9	string	x	\b, root "%s"
-# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
->>>>&1	ulelong	x	\b, load address %#x
-# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
->>>>&5	ulelong	x	\b, exec address %#x
-# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
->>>>&9	ulelong	x	\b, attributes %#x 
-# number of entries in this directory. for root dir 0
-#>>>&13	ulelong	x	\b, entries %#x 
-# the entries start here with object name
->>>>&17	string	x	\b, 1st object "%s"
-

magic/Magdir/adventure

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: adventure,v 1.18 2019/04/19 00:42:27 christos Exp $
+# $File: adventure,v 1.19 2023/12/02 13:48:56 christos Exp $
 # adventure: file(1) magic for Adventure game files
 #
 # from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
@@ -10,6 +10,8 @@
 # ALAN
 # I assume there are other, lower versions, but these are the only ones I
 # saw in the archive.
+#
+# FIXME: Conflicts with Microsoft x.out big-endian and PDP-11 binaries (./xenix)
 0	beshort	0x0206	ALAN game data
 >2	byte	<10	version 2.6%d
 

magic/Magdir/algol68

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: algol68,v 1.6 2022/11/06 18:36:55 christos Exp $
+# $File: algol68,v 1.7 2024/08/27 18:50:56 christos Exp $
 # algol68:  file(1) magic for Algol 68 source
 #
 # URL: 		https://en.wikipedia.org/wiki/ALGOL_68
@@ -13,8 +13,6 @@
 >0	use		algol_68
 0	regex/1024	\bMODE[\t\ ]
 >0	use		algol_68
-0	regex/1024	\bMODE[\t\ ]
->0	use		algol_68
 0	regex/1024	\bREF[\t\ ]
 >0	use		algol_68
 0	regex/1024	\bFLEX[\t\ ]\*\\[

magic/Magdir/android

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------
-# $File: android,v 1.24 2023/02/20 16:51:59 christos Exp $
+# $File: android,v 1.26 2024/09/04 19:06:11 christos Exp $
 # Various android related magic entries
 #------------------------------------------------------------
 
@@ -9,11 +9,11 @@
 # Fixed to avoid regexec 17 errors on some dex files
 # From <diff@lookout.com> "Tim Strazzere"
 0	string	dex\n
->0	regex	dex\n[0-9]{2}\0	Dalvik dex file
->4	string	>000			version %s
+>0	regex	dex\n[0-9]{2}	Dalvik dex file
+>>4	string	>000			version %s
 0	string	dey\n
->0	regex	dey\n[0-9]{2}\0	Dalvik dex file (optimized for host)
->4	string	>000			version %s
+>0	regex	dey\n[0-9]{2}	Dalvik dex file (optimized for host)
+>>4	string	>000			version %s
 
 # Android bootimg format
 # From https://android.googlesource.com/\
@@ -223,7 +223,7 @@
 #            +/refs/heads/androidx-main/profileinstaller/profileinstaller/\
 #            src/main/java/androidx/profileinstaller/ProfileVersion.java
 0	string	pro\x00
->0	regex	pro\x000[0-9][0-9]\x00	Android ART profile
+>4	regex	0[0-9][0-9]	Android ART profile
 !:ext	prof
 >>4	string	001\x00	\b, version 001 N
 >>4	string	005\x00	\b, version 005 O
@@ -231,7 +231,7 @@
 >>4	string	010\x00	\b, version 010 P
 >>4	string	015\x00	\b, version 015 S
 0	string	prm\x00
->0	regex	prm\x000[0-9][0-9]\x00	Android ART profile metadata
+>0	regex	0[0-9][0-9]	Android ART profile metadata
 !:ext	profm
 >>4	string	001\x00	\b, version 001 N
 >>4	string	002\x00	\b, version 002

magic/Magdir/animation

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: animation,v 1.94 2023/06/16 20:06:50 christos Exp $
+# $File: animation,v 1.98 2024/09/01 15:51:51 christos Exp $
 # animation:  file(1) magic for animation/movie formats
 #
 # animation formats
@@ -542,36 +542,36 @@
 >>2	byte&0xF0	!0xF0		MPEG ADTS, layer III, v1
 !:strength +20
 !:mime	audio/mpeg
->2	byte&0xF0	0x10		\b, 32 kbps
->2	byte&0xF0	0x20		\b, 40 kbps
->2	byte&0xF0	0x30		\b, 48 kbps
->2	byte&0xF0	0x40		\b, 56 kbps
->2	byte&0xF0	0x50		\b, 64 kbps
->2	byte&0xF0	0x60		\b, 80 kbps
->2	byte&0xF0	0x70		\b, 96 kbps
->2	byte&0xF0	0x80		\b, 112 kbps
->2	byte&0xF0	0x90		\b, 128 kbps
->2	byte&0xF0	0xA0		\b, 160 kbps
->2	byte&0xF0	0xB0		\b, 192 kbps
->2	byte&0xF0	0xC0		\b, 224 kbps
->2	byte&0xF0	0xD0		\b, 256 kbps
->2	byte&0xF0	0xE0		\b, 320 kbps
+>>>2	byte&0xF0	0x10		\b, 32 kbps
+>>>2	byte&0xF0	0x20		\b, 40 kbps
+>>>2	byte&0xF0	0x30		\b, 48 kbps
+>>>2	byte&0xF0	0x40		\b, 56 kbps
+>>>2	byte&0xF0	0x50		\b, 64 kbps
+>>>2	byte&0xF0	0x60		\b, 80 kbps
+>>>2	byte&0xF0	0x70		\b, 96 kbps
+>>>2	byte&0xF0	0x80		\b, 112 kbps
+>>>2	byte&0xF0	0x90		\b, 128 kbps
+>>>2	byte&0xF0	0xA0		\b, 160 kbps
+>>>2	byte&0xF0	0xB0		\b, 192 kbps
+>>>2	byte&0xF0	0xC0		\b, 224 kbps
+>>>2	byte&0xF0	0xD0		\b, 256 kbps
+>>>2	byte&0xF0	0xE0		\b, 320 kbps
 # timing
->2	byte&0x0C	0x00		\b, 44.1 kHz
->2	byte&0x0C	0x04		\b, 48 kHz
->2	byte&0x0C	0x08		\b, 32 kHz
+>>>2	byte&0x0C	0x00		\b, 44.1 kHz
+>>>2	byte&0x0C	0x04		\b, 48 kHz
+>>>2	byte&0x0C	0x08		\b, 32 kHz
 # channels/options
->3	byte&0xC0	0x00		\b, Stereo
->3	byte&0xC0	0x40		\b, JntStereo
->3	byte&0xC0	0x80		\b, 2x Monaural
->3	byte&0xC0	0xC0		\b, Monaural
-#>1	byte		^0x01		\b, Data Verify
-#>2	byte		&0x02		\b, Packet Pad
-#>2	byte		&0x01		\b, Custom Flag
-#>3	byte		&0x08		\b, Copyrighted
-#>3	byte		&0x04		\b, Original Source
-#>3	byte&0x03	1		\b, NR: 50/15 ms
-#>3	byte&0x03	3		\b, NR: CCIT J.17
+>>>3	byte&0xC0	0x00		\b, Stereo
+>>>3	byte&0xC0	0x40		\b, JntStereo
+>>>3	byte&0xC0	0x80		\b, 2x Monaural
+>>>3	byte&0xC0	0xC0		\b, Monaural
+#>>>1	byte		^0x01		\b, Data Verify
+#>>>2	byte		&0x02		\b, Packet Pad
+#>>>2	byte		&0x01		\b, Custom Flag
+#>>>3	byte		&0x08		\b, Copyrighted
+#>>>3	byte		&0x04		\b, Original Source
+#>>>3	byte&0x03	1		\b, NR: 50/15 ms
+#>>>3	byte&0x03	3		\b, NR: CCIT J.17
 
 # MP2, M1A
 0       beshort&0xFFFE  0xFFFC         MPEG ADTS, layer II, v1
@@ -855,7 +855,7 @@
 # Live MPEG-4 audio streams (instead of RTP FlexMux)
 0       beshort&0xFFE0  0x56E0         MPEG-4 LOAS
 !:mime	audio/x-mp4a-latm
-#>1     beshort&0x1FFF  x              \b, %hu byte packet
+#>1     beshort&0x1FFF  x              \b, %u byte packet
 >3      byte&0xE0       0x40
 >>4     byte&0x3C       0x04           \b, single stream
 >>4     byte&0x3C       0x08           \b, 2 streams
@@ -927,15 +927,12 @@
 #
 # from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
 # syncbyte      8 bit	0x47
-# error_ind     1 bit	-
-# payload_start 1 bit	1
-# priority      1 bit	-
-# PID          13 bit	0x0000
-# scrambling    2 bit	-
-# adaptfld_ctrl 2 bit	1 or 3
-# conti_count   4 bit	-
-0	belong&0xFF5FFF10	0x47400010
->188	byte			0x47		MPEG transport stream data
+# 188 bytes per packet
+0		byte			0x47
+>188	byte			0x47
+>>376	byte			0x47
+>>>564	byte			0x47
+>>>>752	byte			0x47		MPEG transport stream data
 !:mime  video/MP2T
 !:ext	ts
 
@@ -943,8 +940,11 @@
 # From: Alexandre Iooss <erdnaxe@crans.org>
 # URL: https://en.wikipedia.org/wiki/MPEG_transport_stream
 # Note: similar to ISO 13818.1 but with 4 extra bytes per packets
-4	belong&0xFF5FFF10	=0x47400010
->196	byte			=0x47		BDAV MPEG-2 Transport Stream (M2TS)
+4		byte			0x47
+>196	byte			0x47
+>>388	byte			0x47
+>>>580	byte			0x47
+>>>>772	byte			0x47		BDAV MPEG-2 Transport Stream (M2TS)
 !:mime	video/MP2T
 !:ext	m2ts/mts
 
@@ -1204,3 +1204,47 @@
 >12	leshort x	\b, %d
 >14	leshort x	\bx%d
 >24	lelong	>0	\b, %d frames
+
+
+# libplacebo cache file
+# https://libplacebo.org
+0	string	pl_cache	libplacebo cache
+>8	ulelong	x		\b, version %u
+>12	ulelong	=0		\b, empty
+>12	ulelong	=1		\b, 1 entry
+>12	ulelong	>1		\b, %u entries
+
+>4	byte	1		\b, version 3.00.00
+>4	byte	2		\b, version 3.03.00
+>4	byte	3		\b, version 4.00.00
+>4	byte	4		\b, version 4.02.00
+>4	byte	5		\b, version 5.00.00
+
+# live2d: file(1) magic for Live2D Cubism file formats
+# https://www.live2d.com/en/
+0	string/4	MOC3	Live2D Cubism MOC3
+>4	byte	0	\b, SDK version invalid/unknown (%d)
+>4	byte	1	\b, SDK version 3.0.00 - 3.2.07 (%d)
+>4	byte	2	\b, SDK version 3.3.00 - 3.3.03 (%d)
+>4	byte	3	\b, SDK version 4.0.00 - 4.1.05 (%d)
+>4	byte	4	\b, SDK version 4.2.00 - 4.2.02 (%d)
+>4	byte	5	\b, SDK version 5.0.00 (%d)
+>4	byte	>5	\b, SDK version unknown (%d)
+>5	byte	0	\b, little endian
+>5	byte	>0	\b, big endian
+!:mime	application/x-moc3-data
+!:ext	moc3
+
+0	string/4	CAFF	Live2D Cubism archive
+>4	ubyte	x	version %d
+>&0	ubyte	x	\b.%d
+>&1	ubyte	x	\b.%d
+>7	string/4	=----	\b, standard format
+>7	string/4	!----	\b, unknown format (%.4s)
+>11	ubyte	x	version %d
+>&0	ubyte	x	\b.%d
+>&1	ubyte	x	\b.%d
+>14	belong	=0	\b, no obfuscation
+>14	belong	!0	\b, XOR obfuscation key %d
+!:mime	application/x-cubism-archive
+!:ext	cmo3/can3

magic/Magdir/apple

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: apple,v 1.48 2023/05/01 14:20:21 christos Exp $
+# $File: apple,v 1.51 2024/09/04 19:06:12 christos Exp $
 # apple:  file(1) magic for Apple file formats
 #
 0	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
@@ -17,8 +17,13 @@
 # Ref: https://applesaucefdc.com/a2r/
 0	string		A2R
 >3	string		\x31\xFF\x0A\x0D\x0A	Applesauce A2R 1.x Disk Image
+>>0	use		applesauce
 >3	string		\x32\xFF\x0A\x0D\x0A	Applesauce A2R 2.x Disk Image
+>>0	use		applesauce
 >3	string		\x33\xFF\x0A\x0D\x0A	Applesauce A2R 3.x Disk Image
+>>0	use		applesauce
+
+0	name		applesauce
 >8	string		INFO
 >>49	byte		01			\b, 5.25″ SS 40trk
 >>49	byte		02			\b, 3.5″ DS 80trk
@@ -36,7 +41,11 @@
 # Ref: https://applesaucefdc.com/woz/reference2/
 0	string		WOZ
 >3	string		\x31\xFF\x0A\x0D\x0A	Apple ][ WOZ 1.0 Disk Image
+>>0	use		applewoz
 >3	string		\x32\xFF\x0A\x0D\x0A	Apple ][ WOZ 2.0 Disk Image
+>>0	use		applewoz
+
+0	name		applewoz
 >12	string		INFO
 >>21	byte		01			\b, 5.25 inch
 >>21	byte		02			\b, 3.5 inch
@@ -49,13 +58,13 @@
 # Ref: https://applesaucefdc.com/moof-reference/
 0	string		MOOF
 >4	string		\xFF\x0A\x0D\x0A	Apple Macintosh MOOF Disk Image
->12	string		INFO
->>21	byte		01			\b, SSDD GCR (400K)
->>21	byte		02			\b, DSDD GCR (800K)
->>21	byte		03			\b, DSHD MFM (1.44M)
->>22	byte		01			\b, write protected
->>23	byte		01			\b, cross track synchronized
->>25	string/T	x			\b, %.32s
+>>12	string		INFO
+>>>21	byte		01			\b, SSDD GCR (400K)
+>>>21	byte		02			\b, DSDD GCR (800K)
+>>>21	byte		03			\b, DSHD MFM (1.44M)
+>>>22	byte		01			\b, write protected
+>>>23	byte		01			\b, cross track synchronized
+>>>25	string/T	x			\b, %.32s
 
 # Type: Apple Emulator disk images
 # From: Greg Wildman <greg@apple2.org.za>
@@ -192,11 +201,9 @@
 # Ref: https://github.com/peterferrie/qboot
 0	string	\x01\x4A\xA8\x69\x0F\x85\x27\xC9
 >8	string	\x12\xF0\x10\xE6\x3D\x86\xDA\x8A	Apple ][ QBoot Image
-
 # Type: Peter Ferrie 0Boot
 # From: Greg Wildman <greg@apple2.org.za>
 # Ref: https://github.com/peterferrie/0boot
-0	string	\x01\x4A\xA8\x69\x0F\x85\x27\xC9
 >8	string	\x12\xF0\x10\xE6\x3D\x86\xDA\x8A	Apple ][ 0Boot Image
 
 # Different proprietary boot sectors
@@ -438,22 +445,22 @@
 #  object is the first object (true for CoreFoundation implementation).
 # From: David Remahl <dremahl@apple.com>
 0		string	bplist
->6		byte	x	\bCoreFoundation binary property list data, version %#c
+>6		byte	x	CoreFoundation binary property list data, version %#c
 >>7		byte	x	\b%c
->6		string		00		\b
->>8		byte&0xF0	0x00	\b
->>>8	byte&0x0F	0x00	\b, root type: null
->>>8	byte&0x0F	0x08	\b, root type: false boolean
->>>8	byte&0x0F	0x09	\b, root type: true boolean
->>8		byte&0xF0	0x10	\b, root type: integer
->>8		byte&0xF0	0x20	\b, root type: real
->>8		byte&0xF0	0x30	\b, root type: date
->>8		byte&0xF0	0x40    \b, root type: data
->>8		byte&0xF0	0x50	\b, root type: ascii string
->>8		byte&0xF0	0x60	\b, root type: unicode string
->>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
->>8		byte&0xF0	0xa0	\b, root type: array
->>8		byte&0xF0	0xd0	\b, root type: dictionary
+>>6		string		00		\b
+>>>8		byte&0xF0	0x00	\b
+>>>>8	byte&0x0F	0x00	\b, root type: null
+>>>>8	byte&0x0F	0x08	\b, root type: false boolean
+>>>>8	byte&0x0F	0x09	\b, root type: true boolean
+>>>8		byte&0xF0	0x10	\b, root type: integer
+>>>8		byte&0xF0	0x20	\b, root type: real
+>>>8		byte&0xF0	0x30	\b, root type: date
+>>>8		byte&0xF0	0x40    \b, root type: data
+>>>8		byte&0xF0	0x50	\b, root type: ascii string
+>>>8		byte&0xF0	0x60	\b, root type: unicode string
+>>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
+>>>8		byte&0xF0	0xa0	\b, root type: array
+>>>8		byte&0xF0	0xd0	\b, root type: dictionary
 
 # Apple/NeXT typedstream data
 #  Serialization format used by NeXT and Apple for various
@@ -478,7 +485,6 @@
 #
 0	string		caff		CoreAudio Format audio file
 >4	beshort		<10		version %d
->6	beshort		x
 
 
 #------------------------------------------------------------------------------

magic/Magdir/archive

@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: archive,v 1.193 2023/07/27 17:55:58 christos Exp $
+# $File: archive,v 1.207 2024/11/27 15:37:46 christos Exp $
 # archive:  file(1) magic for archive formats (see also "msdos" for self-
 #           extracting compressed archives)
 #
@@ -25,6 +25,11 @@
 >>>>>>155 ubyte&0xDF	=0	
 # space or ascii digit 0 at start of check sum
 >>>>>>>148	ubyte&0xEF	=0x20	
+# check for specific 1st member name that indicates other mime type and file name suffix
+>>>>>>>>0	string		TpmEmuTpms/permall
+# maybe also look for 2nd tar member efi/nvram containing UEFI variables part
+#>>>>>>>>>512	search/0x1800	efi/nvram\0		EFI_PART_FOUND
+>>>>>>>>>0	use	tar-nvram
 # FOR DEBUGGING: 
 #>>>>>>>>0	regex		\^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp)	NAME "%s"
 # check for 1st image main name with digits used for sorting
@@ -34,9 +39,35 @@
 # check for 1st member name with ovf suffix
 >>>>>>>>0	regex		\^.{1,96}[.](ovf)
 >>>>>>>>>0	use	tar-ova
-# if 1st member name without digits and without used image suffix and without *.ovf then it is a TAR archive
+# look for relative directory ./var/ or ./lte/ as 1st member name that indicates AVM firmware with other file name suffix
+>>>>>>>>0	ubequad&0xFFffE5eaE8ffFFff	0x2e2f6460602f0000
+>>>>>>>>>0	use	tar-avm
+# maybe look for AVM specific 2nd name entry
+# >>>>>>>>>517	string		/content\0	content~
+# >>>>>>>>>>0	use	tar-avm
+# >>>>>>>>>517	string		/install\0	install~
+# >>>>>>>>>>0	use	tar-avm
+# >>>>>>>>>517	string		/chksum\0	chksum~
+# >>>>>>>>>>0	use	tar-avm
+# >>>>>>>>>517	string		/modfw.nfo\0	modfw~
+# >>>>>>>>>>0	use	tar-avm
+# most (419/429) *.WBM (71/71) *.WBT with user name jcameron of Webmin developer Jamie Cameron in first tar archive member
+>>>>>>>>265	string		jcameron
+>>>>>>>>>0	use	tar-webmin
+# if 1st member name without digits and without used image suffix, without *.ovf,
+# ./var/ , ./lte/ and TpmEmuTpms/ then it is a pure TAR archive or Webmin without jcameron user name
 >>>>>>>>0	default		x
->>>>>>>>>0	use	tar-file
+# few (10/429) *.WBM without user name jcameron in 1st tar member but with WBM module.info name like:
+# apcupsd-0.81-2.wbm csavupdate.wbm cwmail.wbm dac960.wbm etcupdate.wbm logviewer.wbm memcached.wbm rinetd.wbm shoutcast.wbm vacationadmin-webmin-module-1.1.2.wbm
+# few (10/95) *.WBT without user name jcameron in 1st tar member but with WBT theme.info name like:
+# authentic-theme-21.09.5.wbt Mozilla-Modern.wbt virtual-server-theme-2.7.wbt fkn-webmintheme.0.6.0.wbt
+>>>>>>>>>512	search/210965/s	e.info\0
+>>>>>>>>>>0	use	tar-webmin
+# pure TAR
+>>>>>>>>>0	default		x
+>>>>>>>>>>0	use	tar-file
+# Note:	called "TAR - Tape ARchive" by TrID, "Tape Archive Format" by DROID via PUID x-fmt/265
+#	and "Tar archive" by shared MIME-info database from freedesktop.org
 #	minimal check and then display tar archive information which can also be
 #	embedded inside others like Android Backup, Clam AntiVirus database
 0	name		tar-file
@@ -86,7 +117,11 @@
 >>261	default		x		tar archive (unknown ustar)
 !:mime	application/x-ustar
 !:ext	tar/ustar
-# type flag of 1st tar archive member
+# show information for 1st tar archive member
+>0	use	tar-entry
+#	display information of tar archive member (file type, name, permissions, user, group)
+0	name		tar-entry
+# type flag of tar archive member
 #>156	ubyte		x		\b, %c-type
 >156	ubyte		x		
 >>156	ubyte		0		\b, file
@@ -142,7 +177,7 @@
 >>265	string		>\0		\b, user %-.32s
 # group name null terminated
 >>297	string		>\0		\b, group %-.32s
-# device major minor if not zero
+# device major minor if not zero (binary or ASCII)
 >>329	ubequad&0xCFCFCFCFcFcFcFdf	!0
 >>>329	string		x		\b, devmaj %-.7s
 >>337	ubequad&0xCFCFCFCFcFcFcFdf	!0
@@ -157,6 +192,25 @@
 >>508	default		x		
 # padding[255] in old tar sometimes comment field
 >>>257	string		>\0		\b, comment: %-.40s
+# Summary:	VirtualBox NvramFile with UEFI variables packed inside TAR archive
+# URL:		hhttps://www.virtualbox.org/manual/ch08.html#vboxmanage-modifynvram
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/n/nvram-virtualbox-tar.trid.xml
+# Note:		called "VirtualBox saved (U)EFI BIOS settings (TAR) by TrID and
+#		verified by 7-Zip `7z l -ttar Mint-21.1.nvram` and
+#		VirtualBox `VBoxManage modifynvram "Mint-21.1" listvars`
+0	name		tar-nvram
+# 
+>0	string		x		VirtualBox NVRAM file
+#!:mime	application/x-gtar
+!:mime	application/x-virtualbox-nvram
+!:ext	nvram
+# first name[100] like: TpmEmuTpms/permall
+>0	use	tar-entry
+# 2nd tar member efi/nvram contains UEFI variables part described by ./virtual
+>512	search/0x1800/s	efi/nvram\0
+>>&0	use	tar-entry
+# 2nd tar member efi/nvram content could be described by ./virtual
+#>>&512	indirect	x
 # Summary:	Comic Book Archive *.CBT with TAR format
 # URL:		https://en.wikipedia.org/wiki/Comic_book_archive
 #		http://fileformats.archiveteam.org/wiki/Comic_Book_Archive
@@ -169,7 +223,8 @@
 !:ext	cbt
 # name[100] probably like: 19.jpg 0001.png 0002.png
 # or maybe like ComicInfo.xml
->0	string		>\0		\b, 1st image %-.60s
+#>0	string		>\0		\b, 1st image %-.60s
+>0	use	tar-entry
 # Summary:	Open Virtualization Format *.OVF with disk images and more packed as TAR archive *.OVA
 # From:		Joerg Jenderek
 # URL:		https://en.wikipedia.org/wiki/Open_Virtualization_Format
@@ -184,7 +239,85 @@
 !:mime	application/x-virtualbox-ova
 !:ext	ova
 # assuming name[100] like: DOS-0.9.ovf FreeDOS_1.ovf Win98SE_DE.ovf
->0	string		>\0		\b, with %-.60s
+#>0	string		>\0		\b, with %-.60s
+>0	use	tar-entry
+# Summary:	AVM firmware (FRITZ!OS) for the FRITZ!Box (router)
+# From:		Joerg Jenderek
+# URL:		https://en.wikipedia.org/wiki/Fritz!Box
+#		https://www.redteam-pentesting.de/de/advisories/rt-sa-2014-010/-avm-fritz-box-firmware-signature-bypass
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/i/image-avm.trid.xml
+# Note:		verified by 7-Zip `7z l -ttar FRITZ.Box_4040-07.57.image`
+0	name		tar-avm
+>0	string		x		AVM FRITZ!Box firmware
+#!:mime	application/x-gtar
+!:mime	application/x-avm-image
+!:ext	image
+# tar member ./var/content starts with line like "Product=Fritz_Box_HW227 (FRITZ!Box 4040)"
+>>1024	search/512	Product=Fritz_Box_
+>>>&0	string		x		%s
+# version string like: 07.57 07.58
+>>>1044	search		Version=	\b, version
+>>>>&0	string		x		%s
+# product phrase too far behind (dozen MB) in many samples like: FRITZ.Box_4040-07.12.image FRITZ.Box_6820v3_LTE-07.57.image
+# so try to look for other characteristic foo
+# >>1024	default		x		OTHER_PATTERN!
+# >>>1023	search		AVM_PATTERN	PATTERNfound
+# first name[100] like: ./var/ ./lte/ 
+>0	use	tar-entry
+# if 1st entry is directory then show 2nd entry
+>156	ubyte		0x35
+# 2nd tar member name like: ./var/content (often ) ./var/install ./var/chksum ./lte/modfw.nfo
+>>512	use	tar-entry
+# Summary:	Webmin Module or Theme
+# From:		Joerg Jenderek
+# URL:		https://en.wikipedia.org/wiki/Webmin
+#		https://webmin.com/docs/development/creating-modules/
+#		https://webmin.com/docs/development/creating-themes/
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/w/wbm.trid.xml
+#		http://mark0.net/download/triddefs_xml.7z/defs/w/wbt.trid.xml
+#		http://mark0.net/download/triddefs_xml.7z/defs/w/wbt-gif.trid.xml
+# Note:		called "Webmin Module" "Webmin Theme" by TrID
+#		most verfied by 7-Zip `7z l -ttar *.wbm | grep "\module.info"` and
+#		`7z l -ttar *.wbt | grep "\theme.info"`
+0	name		tar-webmin
+>0	string		x		Webmin
+# Webmin module or theme
+>>512	search/1767941/s /module.info	Module
+!:mime	application/x-webmin-module
+!:ext	wbm
+# According to documentation module.info is mandatory but instead theme.info is found in
+# old-blue-theme.wbm old-blue-theme-1.0.wbm old-mscstyle3.wbm virtual-server-mobile.wbm
+# GRR:  maybe here wrong file name suffix WBM instead of WBT
+>>512	default		x
+>>>512	search/3149333/s /theme.info	Theme
+!:mime	application/x-webmin-theme
+!:ext	wbt
+# next 3 lines should not happen
+>>>512	default		x		Module or Theme
+!:mime	application/x-webmin
+!:ext	wbm/wbt
+# GNU or POSIX tar
+>257	string		=ustar		(
+# 2 space characters followed by a null for GNU variant for most (428/429) WBM samples
+>>261	ubelong		=0x72202000	\bGNU tar)
+#!:mime	application/x-gtar
+# UStar version variant with ASCII "00" as in few (1/429) samples like cwmail.wbm
+>>261	ubelong		0x72003030	\bPOSIX tar)
+#!:mime	application/x-ustar
+#>>>156	ubyte		x		tar archive
+# Apparently first archive member name[100] is directory like: dynbind/ ssh/ virtualmin-powerdns/ virtual-server-mobile/ vnc/
+>>0	use	tar-entry
+# look for characteristic WBM module info name starting with "module.info" for language variant like in: ssh2.wbm
+>>512	search/1767941/s /module.info
+# look for TAR magic of WBM archive module info
+>>>&0	search/257/s	ustar
+# show details for WBM archive member module info
+>>>>&-257 use	tar-entry
+# look for characteristic WBT theme info name with "theme.info" like in: authentic-theme-21.09.5.wbt
+>>512	search/3149333/s /theme.info\0
+# look for TAR magic of WBT archive theme info
+>>>&0	search/257/s	ustar
+>>>>&-257 use	tar-entry
 
 # Incremental snapshot gnu-tar format from:
 # https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
@@ -765,7 +898,7 @@
 >>>>>>>(16.s)			uleshort	x
 >>>>>>>>&16				string	x	\b, %-.8s
 >>>>>>12			uleshort	&0x10	
->>>>>>>(16.s)			uleshort	x
+#>>>>>>>(16.s)			uleshort	x
 >>>>>>>&16				string	x	%-.8s
 >>>>>>>>&1				string	x	\b.%-.3s
 >>>12	uleshort				&0x01
@@ -957,7 +1090,45 @@
 # ZET
 0	string	OZ\xc3\x9d ZET archive data
 # TSComp
-0	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
+# Update:	Joerg Jenderek 2023 Nov 
+# URL:		http://fileformats.archiveteam.org/wiki/TSComp
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/t/tscomp.trid.xml
+#		https://entropymine.com/deark/releases/deark-1.6.5.tar.gz
+#		deark-1.6.5/modules/installshld.c 
+# Note:		called "TSComp compressed data" by TrID
+#		verified by command like `deark -m tscomp -l -d2 MAKERRES.DL$`
+#		The "13" might be a version number. The "8c" is a mystery
+0	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive
+#!:mime	application/octet-stream
+!:mime	application/x-tscomp-compressed
+# filename style: 0~old version 1~without wildcard 2~with wildcard
+#>0x08	ubyte		x				\b, filename style %u
+>0x08	ubyte		0				data, filename style 0
+# no example found
+!:ext	??$
+#>0x08	ubyte		1				data, without wildcard
+>0x08	ubyte		1				data
+# for single-file archives, often the last letter of the filename extension is changed to "$"; but also name like: BUILD3.BM!
+!:ext	??$/??!
+>0x08	ubyte		2				data, with wildcard
+# for multi-file archives common extensions seem to be .lib and .cmp, but also names like: SAMPMIF$ OTDATA.$$$ TWOFILES.TSC WIN.PAK 
+!:ext	/lib/cmp/$$$/tsc/pak
+# fnlen; pascal string length; original 1st file name like: CHFORMAT.MML
+>0x1c	pstring		x				\b, %s
+# md->fi->timestamp
+>0x16	lemsdosdate	x				\b, modified %s
+>0x18	lemsdostime	x				%s
+# 1st compressed size: like 180 (SAMPMML$$)
+>0x0E	ulelong		x				\b, compressed size %u
+# de_dbg_indent(c, 1): like: 12h
+#>0x0d	ubyte		x				b, at 0xD %#x
+# like: 0
+#>0x1A	ubeshort	x				\b, at 0x1A %#x
+# 2nd member offset
+#>0x12	ulelong		x				\b, next offset %#x
+>0x12	ulelong		>0
+# original 2nd archive member name like: FORMATS.MML
+>>(0x12.l+15)	pstring	x				\b, %s ...
 # ARQ
 0	string	gW\4\1 ARQ archive data
 # Squash
@@ -1376,7 +1547,7 @@
 # This is a really bad format. A file containing HAWAII will match this...
 #0	string		HA		HA archive data,
 #>2	leshort		=1		1 file,
-#>2	leshort		>1		%hu files,
+#>2	leshort		>1		%u files,
 #>4	byte&0x0f	=0		first is type CPY
 #>4	byte&0x0f	=1		first is type ASC
 #>4	byte&0x0f	=2		first is type HSC
@@ -1466,7 +1637,7 @@
 #	check and display information of lharc header
 0	name				lharc-header
 # header size 0x4 , 0x1b-0x61
->0	ubyte		x
+#>0	ubyte		x
 # compressed data size != compressed file size
 #>7	ulelong		x		\b, data size %d
 # attribute: 0x2~?? 0x10~symlink|target 0x20~normal
@@ -1590,7 +1761,7 @@
 
 # RAR (Roshal Archive) archive
 0	string		Rar!\x1a\7\0		RAR archive data
-!:mime	application/x-rar
+!:mime	application/vnd.rar
 !:ext	rar/cbr
 # file header
 >(0xc.l+9)	byte	0x74
@@ -1602,13 +1773,13 @@
 >>7		use	rar-archive-header
 
 0	string		Rar!\x1a\7\1\0		RAR archive data, v5
-!:mime	application/x-rar
+!:mime	application/vnd.rar
 !:ext	rar
 
 # Very old RAR archive
 # https://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
 0	string		RE\x7e\x5e  RAR archive data (<v1.5)
-!:mime	application/x-rar
+!:mime	application/vnd.rar
 !:ext	rar/cbr
 
 # SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
@@ -1623,9 +1794,19 @@
 !:mime	application/zip
 !:ext zip/cbz
 
-# Android APK file (Zip archive)
+
 0	string		PK\003\004
 !:strength +1
+# IOS/IPadOS IPA file (Zip archive)
+# Starts with Payload (file name length = 19)
+>26	uleshort	8
+>>30  	string		Payload		IOS/iPadOS IPA file
+>>>&26  search/6000	PK\003\004
+>>>>&34	string		x	containing %s
+!:mime	application/x-ios-app
+!:ext	ipa
+
+# Android APK file (Zip archive)
 # Starts with AndroidManifest.xml (file name length = 19)
 >26	uleshort	19
 >>30	string	AndroidManifest.xml	Android package (APK), with AndroidManifest.xml
@@ -1693,20 +1874,7 @@
 !:ext	apk
 >>>>>-22	string	PK\005\006
 >>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	\b, with APK Signing Block
-# APK Signing Block
->0	default	x
->>-22	string	PK\005\006
->>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	Android package (APK), with APK Signing Block
-!:mime	application/vnd.android.package-archive
-!:ext	apk
 
-# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
-0	string		PK\005\006	Zip archive data (empty)
-!:mime application/zip
-!:ext zip/cbz
-!:strength +1
-0	string		PK\003\004
-!:strength +1
 
 # Specialised zip formats which start with a member named 'mimetype'
 # (stored uncompressed, with no 'extra field') containing the file's MIME type.
@@ -1946,18 +2114,41 @@
 #>30	search/100/b application/epub+zip	EPUB document
 #!:mime application/epub+zip
 
-# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
-#   Next line excludes specialized formats:
+# APK Signing Block
 >(26.s+30)	leshort	!0xcafe
 >>30	search/100/b !application/epub+zip
->>>26    string          !\x8\0\0\0mimetype	Zip archive data
+>>>26    string          !\x8\0\0\0mimetype
+>>>>-22	string	PK\005\006
+>>>>>(-6.l-16)	string	APK\x20Sig\x20Block\x2042	Android package (APK), with APK Signing Block
+!:mime	application/vnd.android.package-archive
+!:ext	apk
+
+# Keyman Compiled Package File (keyman.com)
+# https://help.keyman.com/developer/current-version/reference/file-types/kmp
+# Find start of central directory
+>>>>>(-6.l)	string		PK\001\002
+# Scan central directory for string 'kmp.json', will suffice for a
+# package containing about 150 files
+>>>>>>(-6.l)	search/9000	kmp.json	Keyman Compiled Package File
+!:mime	application/vnd.keyman.kmp+zip
+!:ext kmp
+
+# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
+#   Next line excludes specialized formats:
+>>>>+4	default		x
+>>>>>4	beshort		x			Zip archive data, at least
 !:mime	application/zip
->>>>4	beshort		x			\b, at least
->>>>4	use		zipversion
->>>>4	beshort		x			to extract
->>>>8	beshort		x			\b, compression method=
->>>>8	use		zipcompression
->>>>0x161	string		WINZIP		\b, WinZIP self-extracting
+>>>>>4	use		zipversion
+>>>>>4	beshort		x			to extract
+>>>>>8	beshort		x			\b, compression method=
+>>>>>8	use		zipcompression
+>>>>>0x161	string		WINZIP		\b, WinZIP self-extracting
+
+# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
+0	string		PK\005\006	Zip archive data (empty)
+!:mime application/zip
+!:ext zip/cbz
+!:strength +1
 
 # StarView Metafile
 # From Pierre Ducroquet <pinaraf@pinaraf.info>
@@ -2252,12 +2443,6 @@
 0	belong	0x1ee7ff00	EET archive
 !:mime	application/x-eet
 
-# rzip archives
-0	string	RZIP		rzip compressed data
->4	byte	x		- version %d
->5	byte	x		\b.%d
->6	belong	x		(%d bytes)
-
 # From:		Joerg Jenderek
 # URL:		https://help.foxitsoftware.com/kb/install-fzip-file.php
 # reference:	http://mark0.net/download/triddefs_xml.7z/
@@ -2605,3 +2790,23 @@
 >>(12.l+12)	string }}}}		Electron ASAR archive
 !:ext	asar
 >>>12		ulelong	x		\b, header length: %d bytes
+
+# Wasay ImageIt DataPack
+# From: Alexandre Iooss <erdnaxe@crans.org>
+# URL: https://www.neowin.net/forum/topic/615151-anyone-know-what-program-opens-dsi-and-wsi-files/
+# Note: Used in Acer eRecovery and Lenovo OneKey Recovery (OKR)
+4	string		WSVD
+# bytes 3-4 are the checksum or the first 32 bytes of the file
+>0	uleshort	0x40	Wasay ImageIt DataPack
+>>8	uleshort	x	v%u
+>>10	uleshort	x	\b.%u
+>>16	lestring16/8	x	\b, "%s"
+>>12	uleshort	x	(%u)
+>>32	byte		x	\b, created on %02d
+>>33	byte		x	\b%02d
+>>34	byte		x	\b/%02d
+>>35	byte		x	\b/%02d
+>>36	byte		x	%02d
+>>37	byte		x	\b:%02d
+>>38	byte		x	\b:%02d
+>>56	ulelong		x	\b, size: %u bytes

magic/Magdir/aria

@@ -1,5 +1,7 @@
 
 #------------------------------------------------------------------------------
+# $File: aria,v 1.2 2024/06/10 23:09:52 christos Exp $
+# aria:		file(1) magic for download manager aria
 # URL: 		https://de.wikipedia.org/wiki/Aria_(Software)
 # Reference:	https://github.com/aria2/aria2/blob/master/doc/manual-src/en/technical-notes.rst
 # From:		Joerg Jenderek

magic/Magdir/arm

@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: arm,v 1.3 2022/10/31 14:35:39 christos Exp $
+# $File: arm,v 1.4 2024/02/18 14:15:22 christos Exp $
 # arm: file(1) magic for ARM COFF
 #
 # https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
@@ -40,6 +40,15 @@
 >>0	use				display-coff
 !:strength -10
 
+# ARM64 Compiled Hybrid PE X86
+0	leshort		0x3a64
+# test for unused flag bits in f_flags
+>18	uleshort&0x8E80	0
+# use little endian variant of subroutine to
+# display name+variables+flags for common object formatted files
+>>0	use				display-coff
+!:strength -10
+
 # ARM64EC
 0	leshort		0xa641
 # test for unused flag bits in f_flags

magic/Magdir/asf

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: asf,v 1.4 2022/10/31 13:22:26 christos Exp $
+# $File: asf,v 1.5 2024/09/04 19:06:12 christos Exp $
 # asf:  file(1) magic for Microsoft Advanced Systems Format (ASF) files
 # http://www.staroceans.org/e-book/ASF_Specification.pdf
 
@@ -10,13 +10,13 @@
 #>16	lequad	>0
 #>>(16.q)	use	asf-object
 # ASF_Simple_Index_Object
->0	guid	33000890-E5B1-11CF-89F4-00A0C90349CB
+#>0	guid	33000890-E5B1-11CF-89F4-00A0C90349CB
 >0	guid	D6E229D3-35DA-11D1-9034-00A0C90349BE ASF_Index_Object
 >0	guid	FEB103F8-12AD-4C64-840F-2A1D2F7AD48C ASF_Media_Object_Index_Object
 >0	guid	3CB73FD0-0C4A-4803-953D-EDF7B6228F0C ASF_Timecode_Index_Object
 
 # ASF_File_Properties_Object
->0	guid	8CABDCA1-A947-11CF-8EE4-00C00C205365 
+#>0	guid	8CABDCA1-A947-11CF-8EE4-00C00C205365 
 
 # ASF_Stream_Properties_Object
 >0	guid	B7DC0791-A9B7-11CF-8EE6-00C00C205365
@@ -52,15 +52,15 @@
 >>40	use	asf-name 
 >>0	lelong	x	\b)
 #ASF_Header_Extension_Object
->0	guid	5FBF03B5-A92E-11CF-8EE3-00C00C205365
+#>0	guid	5FBF03B5-A92E-11CF-8EE3-00C00C205365
 # ASF_Codec_List_Object
->0	guid	86D15240-311D-11D0-A3A4-00A0C90348F6
+#>0	guid	86D15240-311D-11D0-A3A4-00A0C90348F6
 >0	guid	1EFB1A30-0B62-11D0-A39B-00A0C90348F6 ASF_Script_Command_Object
 >0	guid	F487CD01-A951-11CF-8EE6-00C00C205365 ASF_Marker_Object
 >0	guid	D6E229DC-35DA-11D1-9034-00A0C90349BE ASF_Bitrate_Mutual_Exclusion_Object
 >0	guid	75B22635-668E-11CF-A6D9-00AA0062CE6C ASF_Error_Correction_Object
 # ASF_Content_Description_Object
->0	guid	75B22633-668E-11CF-A6D9-00AA0062CE6C
+#>0	guid	75B22633-668E-11CF-A6D9-00AA0062CE6C
 #>>24	leshort	title length %d
 #>>26	leshort	author length %d
 #>>28	leshort	copyright length %d
@@ -73,7 +73,7 @@
 >0	guid	298AE614-2622-4C17-B935-DAE07EE9289C ASF_Extended_Content_Encryption_Object
 >0	guid	2211B3FC-BD23-11D2-B4B7-00A0C955FC6E ASF_Digital_Signature_Object
 # ASF_Padding_Object
->0	guid	1806D474-CADF-4509-A4BA-9AABCB96AAE8
+#>0	guid	1806D474-CADF-4509-A4BA-9AABCB96AAE8
 >0	guid	14E6A5CB-C672-4332-8399-A96952065B5A ASF_Extended_Stream_Properties_Object
 >0	guid	A08649CF-4775-4670-8A16-6E35357566CD ASF_Advanced_Mutual_Exclusion_Object
 >0	guid	D1465A40-5A79-4338-B71B-E36B8FD6C249 ASF_Group_Mutual_Exclusion_Object

magic/Magdir/audio

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: audio,v 1.127 2023/03/05 20:15:49 christos Exp $
+# $File: audio,v 1.133 2024/09/04 19:07:20 christos Exp $
 # audio:  file(1) magic for sound formats (see also "iff")
 #
 # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
@@ -99,8 +99,8 @@
 !:mime	audio/x-unknown
 # is this next line right?  it came this way...
 >19	byte	0x1A
->23	byte	>0			- version %d
->22	byte	>0			\b.%d
+>>23	byte	>0			- version %d
+>>22	byte	>0			\b.%d
 
 # first entry is also the string "NTRK"
 0	belong		0x4e54524b	MultiTrack sound data
@@ -276,13 +276,12 @@
 # http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
 0	belong		0x64a30100		IRCAM file (VAX little-endian)
 0	belong		0x0001a364		IRCAM file (VAX big-endian)
-0	belong		0x64a30200		IRCAM file (Sun big-endian)
 0	belong		0x0002a364		IRCAM file (Sun little-endian)
+0	belong		0x64a30200		IRCAM file (Sun big-endian)
 0	belong		0x64a30300		IRCAM file (MIPS little-endian)
 0	belong		0x0003a364		IRCAM file (MIPS big-endian)
-0	belong		0x64a30400		IRCAM file (NeXT big-endian)
-0	belong		0x64a30400		IRCAM file (NeXT big-endian)
 0	belong		0x0004a364		IRCAM file (NeXT little-endian)
+0	belong		0x64a30400		IRCAM file (NeXT big-endian)
 
 # NIST SPHERE <mpruett@sgi.com>
 0	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file
@@ -487,7 +486,7 @@
 # Sharp Jisaku Melody format for PDC
 0	string		\001Sharp\040JisakuMelody	SHARP Cell-Phone ringing Melody
 >20	string		Ver01.00	Ver. 1.00
->>32	byte		x		, %d tracks
+>>32	byte		x		\b, %d tracks
 
 # Free lossless audio codec <http://flac.sourceforge.net>
 # From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
@@ -644,6 +643,7 @@
 0	string	[Equalizer\ preset]	XMMS equalizer preset
 # .m3u
 0	search/1	#EXTM3U 	M3U playlist text
+!:mime  audio/x-mpegurl
 # .pls
 0	search/1	[playlist]	PLS playlist text
 # licq.conf
@@ -713,10 +713,36 @@
 
 # Type: Adaptive Multi-Rate Codec
 # URL:  http://filext.com/detaillist.php?extdetail=AMR
+#		http://fileformats.archiveteam.org/wiki/Adaptive_Multi-Rate_Audio
+# Reference:	https://datatracker.ietf.org/doc/html/rfc4867
+#		http://mark0.net/download/triddefs_xml.7z/defs/a/audio-amr.trid.xml
+# Update:	Joerg Jenderek
 # From: Russell Coker <russell@coker.com.au>
-0	string	#!AMR		Adaptive Multi-Rate Codec (GSM telephony)
-!:mime	audio/amr
+# Note:		called "AMR (Adaptive Multi Rate) encoded audio" by TrID and
+#		"Adaptive Multi-Rate Audio" by DROID via PUID fmt/356 and
+#		"AMR" "AMR audio" or "Adaptive Multi-Rate" by shared MIME-info database from freedesktop.org
+0	string	#!AMR		Adaptive Multi-Rate Codec
+# Adaptive Multi-Rate Codec (strength=80) before wrong "a AMR script executable (binary data)" (strength=20=60/3) by ./varied.script
+#!:strength +0
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/a/audio-awb.trid.xml
+# Note:		called "Adaptive Multi-Rate Wideband ACELP codec" by TrID and
+#		"Adaptive Multi-Rate Wideband Audio" bY DROID via PUID fmt/954 and
+#		"AMR-WB" "AMR-WB audio" or "Adaptive Multi-Rate Wideband" by shared MIME-info database from freedesktop.org
+>5	string	-WB		(Wideband)
+# https://www.iana.org/assignments/media-types/audio/AMR-WB
+!:mime	audio/AMR-WB
+#!:mime	audio/amr-wb-encrypted
+!:apple	????amrw
+!:ext	awb
+# variant without Wideband
+>5	default	x		(GSM telephony)
+# https://www.iana.org/assignments/media-types/audio/AMR
+!:mime	audio/AMR
+# last character in type code is space
+!:apple	????amr 
 !:ext  amr
+# GRR: maybe also 3ga suffix?		https://telparia.com/fileFormatSamples/audio/amr/example.3ga
+#!:ext  amr/3ga
 
 # Type: SuperCollider 3 Synth Definition File Format
 # From: Mario Lang <mlang@debian.org>
@@ -907,16 +933,16 @@
 # From Martin Mueller Skarbiniks Pedersen
 0		string		GDM
 >0x3		byte		0xFE	General Digital Music.
->0x4		string		>\0	title: "%s"
->0x24		string		>\0	musician: "%s"
->>0x44		beshort		0x0D0A
->>>0x46		byte		0x1A
->>>>0x47	string		GMFS	Version
->>>>0x4B	byte		x	%d.
->>>>0x4C	byte		x	\b%02d
->>>>0x4D	beshort		0x000	(2GDM v
->>>>0x4F	byte		x	\b%d.
->>>>>0x50	byte		x	\b%d)
+>>0x4		string		>\0	title: "%s"
+>>0x24		string		>\0	musician: "%s"
+>>>0x44		beshort		0x0D0A
+>>>>0x46	byte		0x1A
+>>>>>0x47	string		GMFS	Version
+>>>>>0x4B	byte		x	%d.
+>>>>>0x4C	byte		x	\b%02d
+>>>>>0x4D	beshort		0x000	(2GDM v
+>>>>>0x4F	byte		x	\b%d.
+>>>>>>0x50	byte		x	\b%d)
 
 0		string		MTM	Multitracker
 >0x3		byte/16		x	Version %d.
@@ -939,18 +965,18 @@
 >4		string		"ArtOfNoise by Bastian Spiegel(twice/lego)"
 >0x2e		string		NAME	Art of Noise Tracker Song
 >3		string		<9
->3		string		4	(4 voices)
->3		string		8	(8 voices)
+>>3		string		4	(4 voices)
+>>3		string		8	(8 voices)
 >>0x36		string		>\0	Title: "%s"
 
 0		string		FAR
 >0x2c		byte		0x0d
->0x2d		byte		0x0a
->0x2e		byte		0x1a
->>0x3		byte		0xFE	Farandole Tracker Song
->>>0x31		byte/16		x	Version %d.
->>>0x31		byte&0x0F	x	\b%02d
->>>>0x4		string		>\0	\b, title: "%s"
+>>0x2d		byte		0x0a
+>>>0x2e		byte		0x1a
+>>>>0x3		byte		0xFE	Farandole Tracker Song
+>>>>>0x31		byte/16		x	Version %d.
+>>>>>0x31		byte&0x0F	x	\b%02d
+>>>>>0x4		string		>\0	\b, title: "%s"
 
 # magic for Klystrack, https://kometbomb.github.io/klystrack/
 # from Alex Myczko <alex@aiei.ch>
@@ -1034,25 +1060,37 @@
 # Added by David Korth <gerbilsoft@gerbilsoft.com>
 0	string	PSF
 >3	byte	0x01
+>>0	use	portable_sound_format
 >3	byte	0x02
+>>0	use	portable_sound_format
 >3	byte	0x11
+>>0	use	portable_sound_format
 >3	byte	0x12
+>>0	use	portable_sound_format
 >3	byte	0x13
+>>0	use	portable_sound_format
 >3	byte	0x21
+>>0	use	portable_sound_format
 >3	byte	0x22
+>>0	use	portable_sound_format
 >3	byte	0x23
+>>0	use	portable_sound_format
 >3	byte	0x41
->>0	string	PSF	Portable Sound Format
+>>0	use	portable_sound_format
+
+
+0	name	portable_sound_format
+>0	string	PSF	Portable Sound Format
 !:mime	audio/x-psf
->>>3	byte	0x01	(Sony PlayStation)
->>>3	byte	0x02	(Sony PlayStation 2)
->>>3	byte	0x11	(Sega Saturn)
->>>3	byte	0x12	(Sega Dreamcast)
->>>3	byte	0x13	(Sega Mega Drive)
->>>3	byte	0x21	(Nintendo 64)
->>>3	byte	0x22	(Game Boy Advance)
->>>3	byte	0x23	(Super NES)
->>>3	byte	0x41	(Capcom QSound)
+>>3	byte	0x01	(Sony PlayStation)
+>>3	byte	0x02	(Sony PlayStation 2)
+>>3	byte	0x11	(Sega Saturn)
+>>3	byte	0x12	(Sega Dreamcast)
+>>3	byte	0x13	(Sega Mega Drive)
+>>3	byte	0x21	(Nintendo 64)
+>>3	byte	0x22	(Game Boy Advance)
+>>3	byte	0x23	(Super NES)
+>>3	byte	0x41	(Capcom QSound)
 
 # Atari 8-bit SAP audio format
 # http://asap.sourceforge.net/sap-format.html
@@ -1289,3 +1327,14 @@
 
 # version > 1 or 0
 >>&0		default		x		\b, unknown version
+
+# https://moddingwiki.shikadi.net/wiki/ROL_Format
+4	string	\\roll\\default	AdLib Visual Composer ROL file
+>0	leshort	x		\b, version %d.
+>2	leshort	x		\b%d
+>44	leshort	x		\b, tickBeat %d
+>46	leshort	x		\b, beatMeasure %d
+>48	leshort	x		\b, scaleY %d
+>50	leshort	x		\b, scaleX %d
+>52	byte	0		\b, percussive
+>52	byte	1		\b, melodic

magic/Magdir/ber

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: ber,v 1.2 2019/04/19 00:42:27 christos Exp $
+# $File: ber,v 1.3 2024/09/01 13:49:15 christos Exp $
 # ber:  file(1) magic for several BER formats used in the mobile
 # telecommunications industry (Georg Sauthoff)
 
@@ -41,7 +41,6 @@
 
 # NRT Files
 # NRT a.k.a. NRTRDE
-0	byte	0x61
 # <SpecificationVersionNumber>2</><ReleaseVersionNumber> block
 >&1	search/b8 \x5f\x29\x01\x02\x5f\x25\x01
 >>&0	byte	x	NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)

magic/Magdir/biosig

@@ -1,7 +1,7 @@
 
-##############################################################################
-#
-#    Magic ids for biomedical signal file formats 
+#------------------------------------------------------------------------------
+# $File: biosig,v 1.4 2024/06/10 23:09:52 christos Exp $
+#    file(1) magic for biomedical signal file formats 
 #    Copyright (C) 2018 Alois Schloegl <alois.schloegl@gmail.com>
 #
 #    The list has been derived from biosig projects

magic/Magdir/bsdi

@@ -1,21 +1,26 @@
 
 #------------------------------------------------------------------------------
-# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
+# $File: bsdi,v 1.9 2024/03/31 15:06:56 christos Exp $
 # bsdi:  file(1) magic for BSD/OS (from BSDI) objects
 # Some object/executable formats use the same magic numbers as are used
 # in other OSes; those are handled by entries in aout.
 #
 
-0	lelong		0314		386 compact demand paged pure executable
+0	lelong		0314		i386 compact demand paged pure executable
 >16	lelong		>0		not stripped
 >32	byte		0x6a		(uses shared libs)
 
+# Update:	Joerg Jenderek
 # same as in SunOS 4.x, except for static shared libraries
+# Note:	was also called "a.out SunOS SPARC demand paged" by ./sun v 1.28
 0	belong&077777777	0600413		SPARC demand paged
 >0	byte		&0x80
 >>20	belong		<4096		shared library
 >>20	belong		=4096		dynamically linked executable
 >>20	belong		>4096		dynamically linked executable
+#!:mime	application/x-foo-executable
+# typically no file name suffix for executables
+!:ext	/
 >0	byte		^0x80		executable
 >16	belong		>0		not stripped
 >36	belong		0xb4100001	(uses shared libs)

magic/Magdir/c64

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: c64,v 1.14 2023/06/16 19:24:06 christos Exp $
+# $File: c64,v 1.16 2024/03/07 22:30:21 christos Exp $
 # c64:  file(1) magic for various commodore 64 related files
 #
 # From: Dirk Jagdmann <doj@cubic.org>
@@ -12,13 +12,32 @@
 
 # C64 (and other CBM) cartridges
 # Extended by David Korth <gerbilsoft@gerbilsoft.com>
+# Update:	Joerg Jenderek
 # Reference: https://vice-emu.sourceforge.io/vice_17.html#SEC391
+#		http://ist.uwaterloo.ca/~schepers/formats/CRT.TTX
+#		http://mark0.net/download/triddefs_xml.7z/defs/c/crt-c64.trid.xml
+# Note:		called "C64 Cartridge image" by TrID and
+#		"CRT C64 Cartridge Image Format" by DROID via PUID fmt/822
 
-0	string		C64\40CARTRIDGE	Commodore 64 cartridge
+0	string		C64\40CARTRIDGE
+# skip DROID fmt-822-signature-id-1179.crt with missing packet length
+>0x44	ubelong		>0x10
+>>0	use		c64-crt
+#	display Commodore 64 cartridge information
+0	name		c64-crt
+>0	string		x		Commodore 64 cartridge
+#!:mime	application/octet-stream
+!:mime	application/x-commodore-crt
+!:ext	crt
+#		http://mark0.net/download/triddefs_xml.7z/defs/c/car-ccs64.trid.xml
+#!:ext	crt/car
 >0x20	ubyte	0	\b,
 >0x20	ubyte	!0
+# 32-byte null padded cartridge name like: "BUGS BUNNY" "CART64" "EasyFlash" "FINAL CARTRIDGE" "Magic Desk" "VICE CART"
 >>0x20	string/T	x	\b: "%.32s",
+# cartridge hardware type
 >0x16	beshort	0
+# cartridge port EXROM line status
 >>0x18	beshort	0x0000	16 KB game
 >>0x18	beshort	0x0001	8 KB game
 >>0x18	beshort	0x0100	UltiMax mode
@@ -59,6 +78,7 @@
 >0x16	beshort	34	Capture
 >0x16	beshort	35	Action Replay 3
 >0x16	beshort	36
+# cartridge Hardware Revision/Subtype (usually 0) (added in v1.01)
 >>0x1A	ubyte	1	Nordic Replay
 >>0x1A	ubyte	!1	Retro Replay
 >0x16	beshort	37	MMC64
@@ -104,6 +124,24 @@
 >0x16	beshort	75	IEEE Flash! 64
 >0x16	beshort	76	Turtle Graphics II
 >0x16	beshort	77	Freeze Frame MK2
+>0x16	beshort	78	Partner 64
+# cartridge hardware type: (0-78)
+>0x16	ubeshort >78	unknown type %#x
+# Cartridge Hardware Revision/Subtype (usually 0 added in v1.01)
+>>0x1A	ubyte	>0	revision %#x
+# padded with 3 space characters for CRT but for CCS64 Cartridge (*.CAR) maybe different according to TrID
+>14	ubeshort	!0x2020	\b, at 14 %#x
+# file header length like: 20h (reported wrong) 40h (default and minimum)
+>0x10	ubelong	!0x40	\b, header length %#x
+# cartridge version like: 1.0 1.1 (adds CRT sub type/hardware revision) 2.0 (introduces VIC20, PLUS4, C128, CBM2)
+>0x14	ubeshort	!0x0100
+>>0x14	ubyte		x	\b, version %u
+>>0x15	ubyte		x	\b.%u
+# cartridge content start with ROM signature which must be CHIP
+>0x40	ubelong	!0x43484950	\b, invalid ROM signature
+>>0x40	string	x		"%0.4s"
+# total packet length (length of ROM image size and header combined) like: 2010h 4010h
+>0x44	ubelong	x	\b, packet length %#x
 
 0	string		C128\40CARTRIDGE	Commodore 128 cartridge
 >0x20	ubyte	0	\b,
@@ -164,26 +202,112 @@
 
 0	belong		0xFF424CFF	WRAptor packer (c64)
 
-0	string		C64S\x20tape\x20file	T64 tape Image
->32	leshort		x		Version:%#x
->36	leshort		!0		Entries:%i
->40	string		x		Name:%.24s
-
-0	string		C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
->32	leshort		x		Version:%#x
->36	leshort		!0		Entries:%i
->40	string		x		Name:%.24s
-
-0	string		C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
->32	leshort		x		Version:%#x
->36	leshort		!0		Entries:%i
->40	string		x		Name:%.24s
+# URL:		http://fileformats.archiveteam.org/wiki/T64
+# Reference:	http://ist.uwaterloo.ca/~schepers/formats/T64.TXT
+#		https://vice-emu.sourceforge.io/vice_16.html#SEC394
+#		https://www.infinite-loop.at/Power64/Documentation/Power64-ReadMe/AE-File_Formats.html
+#		http://mark0.net/download/triddefs_xml.7z/defs/e/emu-t64.trid.xml
+# Note:		called "Commodore 64 Tape container" by TrID, "T64 Tape Image Format" by DROID via PUID fmt/820 and
+# 		"T64 tape Image" by ./c64,v 1.14
+#		verified by command like `deark -m t64 -l -d2 Caitan_the_Demo.t64` and
+#		`cbmconvert -v2 -t -D4 ironmanoffroad.d64 ironmanoffroad.t64`
+# 32 byte signature starting like C64S\x20tape\x20file
+# C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0
+# C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0
+0	string/b	C64
+# skip raw Commodore TAPe by check for unsed areas (\0 filled) and valid low (40h+m*20h; m=0-FFffh) offset 
+>0x46	ubequad&0xFFff1F00C0ffFFff	0	Commodore Tape image
+#!:mime	application/octet-stream
+#!:mime	application/x-commodore-tape
+!:ext	t64
+# version like: 0100h (examples found) 0101h 0200h (no examples)
+>>32	leshort		x		Version:%#x
+#>>32	leshort		!0x0100		Version:%#x
+# number of used directory entries like: 0 1 2 5
+>>36	leshort		!0		Entries:%i
+# tape container name, 24 characters (padded with 20h but with A0h for DirMaster created samples) like:
+# ->ZYRON'S PD<- IMAGETAPE MY-T64-TEST\240\240\240 OPERATIONWOLF+3-711.T64
+>>40	string/24/Tb	>\040		Name:%.24s
+# MaxFiles; maximal directory entries like: 0 1 2 5 30 (=1Eh some emulators expect exactly this value) 31 32
+>>34	uleshort	x		MaxFiles:%u
+# 1st C64 filetype: 0~free 1~normal tape file 2~tape file with header 3~memory snapshot 4~tape block 5~digitized stream 6-255~reserved
+>>0x40	ubyte		!1		\b, C64 file type %#x
+# 1st start address or load address of first entry like: 0000 (empty|snapshot) 04a0h (ironmanoffroad.t64) 0801h (typically) 1201h (3501_quizmaster_program_s1.t64)
+>>0x42	uleshort	!0x0801		\b, load address %#4.4x
+# 1st actual end address in memory
+>>0x44	uleshort	x		\b, end address %#4.4x
+# reserved; must be 0
+>>0x26	ubeshort	!0		\b, at +0x26 %#x
+# not used like: 0 (examples found and according to TrID)
+>>0x46	ubeshort	!0		\b, at 0x46 %#4.4x
+# not used like: 0 (examples found and according to TrID)
+>>0x4c	ubelong		!0		\b, at 0x4C %#8.8x
+# offset (=64+32*m) into 1st container file like: 0 (empty) 60h 80h E0h 400h 440h ...
+>>0x48	ulelong		>0		\b, at %#x
+# 1st filename (in PETASCII, padded with 20h, not A0h) like: "DRILLINSTR. /HTL" "WIZBALL+        " ...
+>>>0x50	string/16/bT	x		"%0.16s"
+# https://www.lyonlabs.org/commodore/onrequest/Inside_Commodore_Dos.pdf
+# file type like: 0~Scratched 1~SEQunclosed 81h~SEQ 82h~PRG C2h~PRGlocked ...
+>>>0x41	ubyte		x
+>>>>0x41	ubyte	=0x00		Scratched type
+>>>>0x41	ubyte	=0x01		SEQ unclosed type
+#>>>>0x41	ubyte	=0x44		foo type
+>>>>0x41	ubyte	=0x80		DEL type
+>>>>0x41	ubyte	=0x81		SEQ type
+>>>>0x41	ubyte	=0x82		PRG type
+>>>>0x41	ubyte	=0x83		USR type
+>>>>0x41	ubyte	=0x84		REL type
+>>>>0x41	ubyte	=0xC2		PRG locked type
+# other 	unusual file type
+>>>>0x41	default	x
+>>>>>0x41	ubyte	x		%#2.2x type
+# inspect 1st entry content (often Commodore C64 BASIC program *.PRG) without load adress
+#>>(0x48.l)	ubequad		x	\b, 1st data %16.16llx...
 
 # Raw tape file format (.tap files)
 # Esa Hyyti <esa@netlab.tkk.fi>
-0	string		C64-TAPE-RAW	C64 Raw Tape File (.tap),
+# Update:	Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/Tap_file
+#		https://vice-emu.sourceforge.io/vice_16.html#SEC392
+# Reference:	http://ist.uwaterloo.ca/~schepers/formats/TAP.TXT
+# Note:		called "TAP (Commodore 64)" by DROID via PUID fmt/802
+#		a variant starting with C16-TAPE-RAW should exist, but no examples found
+0	string/b	C64-TAPE-RAW	Commodore raw Tape image (platform
+#0	string		C64-TAPE-RAW	C64 Raw Tape File (.tap),
+#!:mime	application/octet-stream
+!:mime	application/x-commodore-tape
+!:ext	tap
+# According to TrID als raw suffix, but no such samples found
+#!:ext	tap/raw
+# computer platform like: 0~C64 1~VIC-20 2~C16 Plus/4 3~PET 4~C5x0 5~C6x0 C7x0
+>0xD	ubyte		0		C64
+>0xD	ubyte		1		VIC-20
+>0xD	ubyte		2		C16 Plus/4
+>0xD	ubyte		3		PET
+>0xD	ubyte		4		C5x0
+>0xD	ubyte		5		C6x0 C7x0
+# this should not happen!
+>0xD	ubyte		>5		%#2.2x
+>0xD	ubyte		x		\b),
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/t/tap.trid.xml
+#		http://mark0.net/download/triddefs_xml.7z/defs/t/tap-1.trid.xml
+# Note:		called "C64 Tape image format" (v0-original) (v1-updated)" by TrID
+# TAP version like: 0~OriginalLayout 1~Updated (often)
 >0x0c	byte		x		Version:%u,
+# file data size (not including header)
 >0x10	lelong		x		Length:%u cycles
+# video standard like: 0~PAL 1~NTSC 2~OLD NTSC 3~PALN
+>0xE	ubyte		x    		\b, video
+>0xE	ubyte		0		PAL
+>0xE	ubyte		1		NTSC
+>0xE	ubyte		2		old NTSC
+>0xE	ubyte		3		PALN
+# this should not happen!
+>0xE	ubyte		>3		%#2.2x
+# reserved for future expansion like: 0
+>0xF	ubyte		!0		\b, at 0xF %#2.2x
+# file data
+#>014	ubequad		x		\b, data %16.16llx
 
 # magic for Goattracker2, http://covertbitops.c64.org/
 # from Alex Myczko <alex@aiei.ch>

magic/Magdir/cafebabe

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: cafebabe,v 1.28 2022/07/01 23:24:47 christos Exp $
+# $File: cafebabe,v 1.31 2024/08/30 16:53:22 christos Exp $
 # Cafe Babes unite!
 #
 # Since Java bytecode and Mach-O universal binaries have the same magic number,
@@ -14,10 +14,47 @@
 # (and use as a hack). Let's not use 18, because the Mach-O people
 # might add another one or two as time goes by...
 #
+
+### MACH-O START ###
+# URL:		https://en.wikipedia.org/wiki/Mach-O
+
+0	name		mach-o		\b [
+# for debugging purpose CPU type as hexadecimal
+#>0	ubequad		x		CPU=%16.16llx
+# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
+>0	use		mach-o-cpu	\b
+# for debugging purpose print offset to 1st mach_header like:
+# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
+#>8	ubelong		x		at %#x offset
+>(8.L)	indirect	x		\b:
+>0	belong		x		\b]
+
+# Reference:	https://opensource.apple.com/source/cctools/cctools-949.0.1/
+#		include/mach-o/fat.h
+#		include/mach/machine.h
+0	belong		0xcafebabe
+>4	belong		1		Mach-O universal binary with 1 architecture:
+!:mime application/x-mach-binary
+>>8	use		mach-o		\b
+# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
+>4	ubelong		>1
+>>4	ubelong		<20		Mach-O universal binary with %d architectures:
+!:mime application/x-mach-binary
+>>>8	use		mach-o		\b
+>>>4	ubelong		>1
+>>>>28	use		mach-o		\b
+>>>4	ubelong		>2
+>>>>48	use		mach-o		\b
+>>>4	ubelong		>3
+>>>>68	use		mach-o		\b
+>>>4	ubelong		>4
+>>>>88	use		mach-o		\b
+>>>4	ubelong		>5
+>>>>108	use		mach-o		\b
+### MACH-O END ###
 ### JAVA START ###
 # Reference:	http://en.wikipedia.org/wiki/Java_class_file
 # Update:	Joerg Jenderek
-0	belong		0xcafebabe
 >4	ubelong		>30		compiled Java class data,
 !:mime	application/x-java-applet
 #!:mime	application/java-byte-code
@@ -50,6 +87,12 @@
 >>4	belong		0x003E		(Java SE 18)
 >>4	belong		0x003F		(Java SE 19)
 >>4	belong		0x0040		(Java SE 20)
+>>4	belong		0x0041		(Java SE 21)
+>>4	belong		0x0042		(Java SE 22)
+>>4	belong		0x0043		(Java SE 23)
+>>4	belong		0x0044		(Java SE 24)
+>>4	belong		0x0045		(Java SE 25)
+>>4	belong		0x0046		(Java SE 26)
 # pool count unequal zero
 #>>8	beshort		x	        \b, pool count %#x
 # pool table
@@ -60,48 +103,4 @@
 >4	byte		x		\b%d
 !:mime	application/x-java-pack200
 
-
-0	belong		0xcafed00d	JAR compressed with pack200,
->5	byte		x		version %d.
->4	byte		x		\b%d
-!:mime	application/x-java-pack200
-
 ### JAVA END ###
-### MACH-O START ###
-# URL:		https://en.wikipedia.org/wiki/Mach-O
-
-0	name		mach-o		\b [
-# for debugging purpose CPU type as hexadecimal
-#>0	ubequad		x		CPU=%16.16llx 
-# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
->0	use		mach-o-cpu	\b
-# for debugging purpose print offset to 1st mach_header like:
-# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
-#>8	ubelong		x		at %#x offset
->(8.L)	indirect	x		\b:
->0	belong		x		\b]
-
-# Reference:	https://opensource.apple.com/source/cctools/cctools-949.0.1/
-#		include/mach-o/fat.h
-#		include/mach/machine.h
-0	belong		0xcafebabe
->4	belong		1		Mach-O universal binary with 1 architecture:
-!:mime application/x-mach-binary
->>8	use		mach-o		\b
-# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
->4	ubelong		>1
->>4	ubelong		<20		Mach-O universal binary with %d architectures:
-!:mime application/x-mach-binary
->>>8	use		mach-o		\b
->>>4	ubelong		>1
->>>>28	use		mach-o		\b
->>>4	ubelong		>2
->>>>48	use		mach-o		\b
->>>4	ubelong		>3
->>>>68	use		mach-o		\b
->>>4	ubelong		>4
->>>>88	use		mach-o		\b
->>>4	ubelong		>5
->>>>108	use		mach-o		\b
-
-### MACH-O END ###

magic/Magdir/cbor

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $
+# $File: cbor,v 1.2 2024/09/04 19:06:12 christos Exp $
 # cbor:  file(1) magic for CBOR files as defined in RFC 7049
 
 0	string	\xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
@@ -13,7 +13,7 @@
 >3	ubyte	<0x80
 >>3	ubyte	>0x5f	(text string)
 >3	ubyte	<0xa0
->3	ubyte	>0x7f	(array)
+>>3	ubyte	>0x7f	(array)
 >3	ubyte	<0xc0
 >>3	ubyte	>0x9f	(map)
 >3	ubyte	<0xe0

magic/Magdir/claris

@@ -1,8 +1,10 @@
 
 #------------------------------------------------------------------------------
-# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $
+# $File: claris,v 1.9 2024/07/07 14:36:49 christos Exp $
 # claris:  file(1) magic for claris
 # "H. Nanosecond" <aldomel@ix.netcom.com>
+# Update:	Joerg Jenderek 2024 May
+# URL:		https://en.wikipedia.org/wiki/AppleWorks
 # Claris Works a word processor, etc.
 # Version 3.0
 
@@ -12,8 +14,14 @@
 #0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
 #null to byte 1000 octal
 514	string	\377\377\377\377\000
+# https://sembiance.com/fileFormatSamples/image/pict/
+# Claris clip art (strength=80) after few Macintosh QuickDraw (strength=81=70+11 ./images) with corner coordinates -1/-1  and Y=0x00?? like PICT_2012.pict
+#!:strength +0
 >0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
 514	string	\377\377\377\377\001
+# https://sembiance.com/fileFormatSamples/image/pict/
+# Claris clip art (strength=80) after few Macintosh QuickDraw (strength=81=70+11 ./images) with corner coordinates -1/-1 and Y=0x01?? like PICT_129.pict
+#!:strength +0
 >0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
 
 # Claris works files

magic/Magdir/coff

@@ -1,49 +1,92 @@
 
 #------------------------------------------------------------------------------
-# $File: coff,v 1.7 2022/11/21 22:30:22 christos Exp $
+# $File: coff,v 1.15 2024/11/10 18:54:33 christos Exp $
 # coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
 #
 # COFF
 #
-# by Joerg Jenderek at Oct 2015, Feb 2021
+# by Joerg Jenderek at Oct 2015, Feb 2021, Mar 2024
 # https://en.wikipedia.org/wiki/COFF
 # https://de.wikipedia.org/wiki/Common_Object_File_Format
 # http://www.delorie.com/djgpp/doc/coff/filhdr.html
+# https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#coff-file-header-object-and-image
+# https://formats.kaitai.io/uefi_te/index.html
+
+# Display COFF processor type, including MS COFF and PE/COFF
+0	name				display-coff-processor
+# PE/COFF, DJGPP, i386 COFF executable, MS Windows COFF Intel i386 object file (./intel)
+>0	uleshort		0x014c	Intel i386
+>0	uleshort		0x014d	Intel i860
+>0	uleshort		0x0160	MIPS R3000 (big-endian)
+>0	uleshort		0x0162	MIPS R3000
+>0	uleshort		0x0166	MIPS R4000
+>0	uleshort		0x0168	MIPS R10000
+>0	uleshort		0x0169	MIPS WCE v2
+>0	uleshort		0x0184	Alpha 32-bit
+>0	uleshort		0x01a2	Hitachi SH3
+>0	uleshort		0x01a3	Hitachi SH3 DSP
+>0	uleshort		0x01a4	Hitachi SH4E
+>0	uleshort		0x01a6	Hitachi SH4
+>0	uleshort		0x01a8	Hitachi SH5
+>0	uleshort		0x01c0	ARMv4
+>0	uleshort		0x01c2	ARMv4T
+>0	uleshort		0x01c4	ARMv7
+>0	uleshort		0x01d3	Matsushita AM33
+# executable (RISC System/6000 V3.1) or obj module (./ibm6000 v 1.15), not PE/COFF
+>0	uleshort		0x01df	RISC System/6000
+>0	uleshort		0x01f0	PowerPC 32-bit (little-endian)
+>0	uleshort		0x01f1	PowerPC 32-bit with FPU (little-endian)
+>0	uleshort		0x01f2	PowerPC 64-bit (big-endian)
+>0	uleshort		0x0200	Intel Itanium
+>0	uleshort		0x0266	MIPS16
+>0	uleshort		0x0268	Motorola 68000
+>0	uleshort		0x0284	Alpha 64-bit
+>0	uleshort		0x0290	PA-RISC
+>0	uleshort		0x0366	MIPS with FPU
+>0	uleshort		0x0466	MIPS16 with FPU
+# Hitachi SH big-endian COFF (./hitachi-sh), not PE/COFF
+>0	uleshort		0x0500	Hitachi SH (big-endian)
+>0	uleshort		0x0520	Tricore
+# Hitachi SH little-endian COFF (./hitachi-sh), not PE/COFF
+>0	uleshort		0x0550	Hitachi SH (little-endian)
+>0	uleshort		0x0601	PowerPC 32-bit (big-endian)
+# Windows CE 3.0 Common Executable Format, created by linkcef.exe with /MACHINE:CEF flag
+# https://web.archive.org/web/20000819035046/http://microsoft.com/windows/embedded/ce/downloads/cef.asp
+# https://web.archive.org/web/20000914080342/http://microsoft.com/windows/embedded/ce/developer/applications/appdevelopment/cef2.asp
+# https://web.archive.org/web/20021022055906/http://msdn.microsoft.com/library/en-us/dnce30/html/cef2.asp
+>0	uleshort		0x0cef	Common Executable Format
+>0	uleshort		0x0ebc	EFI byte code
+>0	uleshort		0x3a64	ARM64 (i386 ABI)
+>0	uleshort		0x5032	RISC-V 32-bit
+>0	uleshort		0x5064	RISC-V 64-bit
+>0	uleshort		0x5128	RISC-V 128-bit
+>0	uleshort		0x6232	LoongArch 32-bit
+>0	uleshort		0x6264	LoongArch 64-bit
+>0	uleshort		0x8664	x86-64
+>0	uleshort		0x9041	Mitsubishi M32R
+>0	uleshort		0xa641	ARM64 (x86-64 ABI)
+>0	uleshort		0xa64e	ARM64 (classic + x86-64 ABI)
+# PE/COFF ARM64 classic ABI, ARM COFF (./arm)
+>0	uleshort		0xaa64	ARM64
+>0	uleshort		0xace1	OMNI VM (omniprox.dll)
+# Processor type CEE can be only in object files (created by older ilasm.exe with /OBJECT flag), not in PE executables
+>0	uleshort		0xc0ee	COM+ Execution Engine
+>0	default			x	Unknown processor
+>>0	uleshort		x	0x%04x
 
 # display name+variables+flags of Common Object Files Format (32bit)
 # Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
 # mips,motorola,msdos,osf1,sharc,varied.out,vax
 0	name				display-coff
-# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
->18	uleshort&0x8E80	0
+# test for unused flag bits (0x8000,x0080) in f_flags
+# flag bits (0x0800,0x0400,0x0200) now seems to be used in RISC System/6000 V3.1
+>18	uleshort&0x8080	0
 # skip DOCTOR.DAILY READER.NDA REDBOX.ROOT by looking for positive number of sections
 >>2	uleshort	>0
 # skip ega80woa.fnt svgafix.fnt HP3FNTS1.DAT HP3FNTS2.DAT INTRO.ACT LEARN.PIF by looking for low number of sections
 >>>2	uleshort	<4207
->>>>0	clear		x
 # f_magic - magic number
-# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
->>>>0	uleshort	0x014C		Intel 80386
-# Hitachi SH big-endian COFF (./hitachi-sh)
->>>>0	uleshort	0x0500		Hitachi SH big-endian
-# Hitachi SH little-endian COFF (./hitachi-sh)
->>>>0	uleshort	0x0550		Hitachi SH little-endian
-# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
-#>>>>0	uleshort	0x01DF
-# MS Windows COFF Intel Itanium, AMD64
-# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680313(v=vs.85).aspx
->>>>0	uleshort	0x0200		Intel ia64
->>>>0	uleshort	0x8664		Intel amd64
-# ARM COFF (./arm)
->>>>0	uleshort	0xaa64		Aarch64
->>>>0	uleshort	0x01c0		ARM
->>>>0	uleshort	0xa641		ARM64EC
->>>>0	uleshort	0x01c2		ARM Thumb
->>>>0	uleshort	0x01c4		ARMv7 Thumb
-# TODO for other COFFs
-#>>>>0	uleshort	0xABCD		COFF_TEMPLATE
->>>>0	default		x
->>>>>0	uleshort	x		type %#04x
+>>>>0	use		display-coff-processor
 >>>>0	uleshort	x		COFF
 # F_EXEC flag bit
 >>>>18	leshort		^0x0002		object file
@@ -53,6 +96,9 @@
 #!:ext	cof/o/obj/lib
 >>>>18	leshort		&0x0002		executable
 #!:mime	application/x-coffexec
+!:mime	application/x-coff-executable
+# typically no file name suffix for executables
+!:ext	/
 # F_RELFLG flag bit,static object
 >>>>18	leshort		&0x0001		\b, no relocation info
 # F_LNNO flag bit
@@ -79,16 +125,39 @@
 # like: 0 2 7 9 10 11 20 35 41 63 71 80 105 146 153 158 170 208 294 572 831 1546
 >>>>12	ulelong		>0		\b, %d symbols
 # f_opthdr - optional header size. An object file should have a value of 0
+# like: 72 (IBM\HH\HYPERHLP)
 >>>>16	uleshort	>0		\b, optional header size %u
-# f_timdat - file time & date stamp only for little endian
+# f_timdat - file time & date stamp
 >>>>4	ledate		>0		\b, created %s
 # at offset 20 can be optional header, extra bytes FILHSZ-20 because
 # do not rely on sizeof(FILHDR) to give the correct size for header.
 # or first section header
 # additional variables for other COFF files
 >>>>16	uleshort	=0
-# first section name s_name[8] like: .text .data .debug$S .drectve .testseg
->>>>>20	string		x		\b, 1st section name "%.8s"
+# most section names start with point character except samples created by "exotic" compilers
+# first section name s_name[8] like: .text .data .debug$S .drectve .testseg .rsrc .rsrc$01 .pad
+>>>>>(16.s+20)	string		x		\b, 1st section name "%.8s"
+# physical address s_paddr like: 0
+#>>>>>(16.s+28)	lelong		!0		\b, s_paddr %#8.8x
+# virtual address s_vaddr like: 0
+#>>>>>(16.s+32)	lelong		!0		\b, s_vaddr %#8.8x
+# section size s_size
+#>>>>>(16.s+36)	lelong		x		\b, s_size %#8.8x
+# file ptr to raw data for section s_scnpt
+#>>>>>(16.s+40)	lelong		x		\b, s_scnpt %#8.8x
+# file ptr to relocation s_relptr like: 0
+#>>>>>(16.s+44)	lelong		!0		\b, s_relptr %#8.8x
+# file ptr to gp histogram s_lnnoptr like: 0
+#>>>>>(16.s+48)	lelong		!0		\b, s_lnnoptr %#8.8x
+# number of relocation entries s_nreloc like: 0 1 2 5 6 8 19h 26h 27h 38h 50h 5Fh 89h Dh 1Ch 69h A9h 1DCh 651h
+#>>>>>(16.s+52)	uleshort	x		\b, s_nreloc %#4.4x
+# number of gp histogram entries s_nlnno like: 0
+#>>>>>(16.s+54)	uleshort	!0		\b, s_nlnno %#4.4x
+# flags s_flags
+#>>>>>(16.s+56)	lelong		x		\b, s_flags %#8.8x
+# second section name s_name[8] like: .bss .data .debug$S .rsrc$01
+>>>>2	uleshort	>1
+>>>>>(16.s+60)	string		x		\b, 2nd section name "%.8s"
 # >20	beshort		0407		(impure)
 # >20	beshort		0410		(pure)
 # >20	beshort		0413		(demand paged)
@@ -96,3 +165,53 @@
 # >22	leshort		>0		- version %d
 # >168	string		.lowmem		Apple toolbox
 
+# PowerPC COFF object file or executable
+0	leshort		0x01f0
+>16	leshort		0
+>>0	use		display-coff
+# can be created by: LINK.EXE /MACHINE:powerpc /ROM
+>16	leshort		!0
+>>18	leshort		&0x0002
+>>>20	leshort		0x010b
+>>>>0	use		display-coff
+0	leshort		0x01f1
+>16	leshort		0
+>>0	use		display-coff
+0	leshort		0x01f2
+>16	leshort		0
+>>0	use		display-coff
+0	leshort		0x0601
+>16	leshort		0
+>>0	use		display-coff
+# can be created by: LINK.EXE /MACHINE:MPPC /ROM
+>16	leshort		!0
+>>18	leshort		&0x0002
+>>>20	leshort		0x010b
+>>>>0	use		display-coff
+
+0	name		display-subsystem
+>0	ubyte		0	unknown
+>0	ubyte		1	native
+>0	ubyte		2	windows_gui
+>0	ubyte		3	windows_cui
+>0	ubyte		7	posix_cui
+>0	ubyte		9	windows_ce_gui
+>0	ubyte		10	efi_application
+>0	ubyte		11	efi_boot_service_driver
+>0	ubyte		12	efi_runtime_driver
+>0	ubyte		13	efi_rom
+>0	ubyte		14	xbox
+>0	ubyte		16	windows_boot-application
+>0	default		x	Unknown subsystem
+>>0	ubyte		x	%#x
+
+
+# https://formats.kaitai.io/uefi_te/index.html
+0	string		VZ	TE (Terse Executable) file
+>2	use		display-coff-processor
+>4	byte		x	\b, sections %d
+>5	use		display-subsystem
+>6	uleshort	x	\b, stripped-size %u
+>8	ulelong		x	\b, entry %#x
+>12	ulelong		x	\b, base_of_code %#x
+>16	ulequad		x	\b, image_base %#llx

magic/Magdir/commands

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: commands,v 1.73 2022/11/06 18:39:23 christos Exp $
+# $File: commands,v 1.77 2024/11/10 16:55:15 christos Exp $
 # commands:  file(1) magic for various shells and interpreters
 #
 #0	string/w	:			shell archive or script for antique kernel text
@@ -89,6 +89,13 @@
 !:mime	text/x-shellscript
 0	string/fwt	#!\ /usr/bin/env\ bash	Bourne-Again shell script text executable
 !:mime	text/x-shellscript
+0	string/fwt	#!\ /bin/env\ bash	Bourne-Again shell script text executable
+!:mime	text/x-shellscript
+
+0	string/fwt	#!\ /bin/dash	Dash shell script text executable
+!:mime	text/x-shellscript
+0	string/fwt	#!\ /usr/bin/dash	Dash shell script text executable
+!:mime	text/x-shellscript
 
 # Fish shell magic
 # From: Benjamin Lowry <ben@ben.gmbh>
@@ -110,6 +117,8 @@
 
 0	search/1/fwt	#!\ /usr/bin/stap	Systemtap script text executable
 !:mime  text/x-systemtap
+0	search/1/fwt	#!\ /sbin/openrc-run	OpenRC script text executable
+!:mime  text/x-shellscript
 
 # From: Kylie McClain <kylie@somas.is>
 # Type: execline scripts
@@ -127,6 +136,9 @@
 >0	regex	\^#!.*/bin/execlineb([[:space:]].*)*$	execline script text executable
 !:mime	text/x-execline
 
+0	string	#!/nix/store/
+>&-11	string/T	x			a %s script text executable
+
 # PHP scripts
 # Ulf Harnhammar <ulfh@update.uu.se>
 0	search/1/c	=<?php			PHP script text

magic/Magdir/compress

@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: compress,v 1.91 2023/06/16 19:37:47 christos Exp $
+# $File: compress,v 1.96 2024/11/09 23:47:04 christos Exp $
 # compress:  file(1) magic for pure-compression formats (no archives)
 #
 # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
@@ -203,6 +203,7 @@
 # lzop from <markus.oberhumer@jk.uni-linz.ac.at>
 0	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
 !:ext	lzo
+!:mime	application/x-lzop
 >9	beshort		<0x0940
 >>9	byte&0xf0	=0x00		- version 0.
 >>9	beshort&0x0fff	x		\b%03x,
@@ -376,18 +377,15 @@
 
 0	string		ArC\x01		FreeArc archive <http://freearc.org>
 
-# Type:	DACT compressed files
-0	long	0x444354C3	DACT compressed data
->4	byte	>-1		(version %i.
->5	byte	>-1		%i.
->6	byte	>-1		%i)
->7	long	>0		, original size: %i bytes
->15	long	>30		, block size: %i bytes
-
 # Valve Pack (VPK) files
+# https://developer.valvesoftware.com/wiki/VPK_(file_format)#File_Format
 0	lelong	0x55aa1234	Valve Pak file
 >0x4	lelong	x		\b, version %u
->0x8	lelong	x		\b, %u entries
+>0x8	lelong	x		\b, tree size %u 
+>0x12	lelong	x		\b, file data size %u 
+>0x16	lelong	x		\b, archive MD5 size %u 
+>0x20	lelong	x		\b, other MD5 size %u 
+>0x24	lelong	x		\b, signature size %u 
 
 # Snappy framing format
 # https://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
@@ -424,11 +422,6 @@
 0	string	bvx2	lzfse compressed, compressed tables
 0	string	bvxn	lzfse encoded, lzvn compressed
 
-# pcxLib.exe compression program
-# http://www.shikadi.net/moddingwiki/PCX_Library
-0	string/b	pcxLib
->0x0A	string/b	Copyright\020(c)\020Genus\020Microprogramming,\020Inc.	pcxLib compressed
-
 # https://support-docs.illumina.com/SW/ORA_Format_Specification/Content/SW/ORA/ORAFormatSpecification.htm
 0	uleshort	0x7c49	
 >2	lelong		0x80	ORA FASTQ compressed file
@@ -459,3 +452,7 @@
 >-125	u8	x	NB reads: %llu,
 >-109	u8	x	NB bases: %llu.
 >-219	u4&0x02	2	File contains interleaved paired reads
+
+# https://github.com/xamarin/xamarin-android/pull/4686
+0	string	XALZ	Xamarin LZ4-compressed assembly
+>8	ulelong	x	\b, uncompressed size %u

magic/Magdir/console

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: console,v 1.72 2023/06/16 19:24:06 christos Exp $
+# $File: console,v 1.80 2024/11/09 23:55:02 christos Exp $
 # Console game magic
 # Toby Deshane <hac@shoelace.digivill.net>
 
@@ -115,17 +115,18 @@
 # gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
 # Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
 #
-0x104		bequad		0xCEED6666CC0D000B	Game Boy ROM image
-# TODO: application/x-gameboy-color-rom for GBC.
-!:mime		application/x-gameboy-rom
+
+# Title (16 chars for GB; 15 chars for CGB)
+0		name		gameboy-title
 >0x143		byte&0x80	0x80
 >>0x134		string		>\0			\b: "%.15s"
 >0x143		byte&0x80	!0x80
 >>0x134		string		>\0			\b: "%.16s"
 >0x14c		byte		x			(Rev.%02u)
 
-# Machine type. (SGB, CGB, SGB+CGB)
+# Machine type (SGB, CGB, SGB+CGB)
 # Old licensee code 0x33 is required for SGB, but not CGB.
+0		name		gameboy-machine-type
 >0x14b		byte		0x33
 >>0x146		byte		0x03
 >>>0x143	byte&0x80	0x80	[SGB+CGB]
@@ -137,53 +138,78 @@
 >>0x143		byte&0xC0	0x80	[CGB]
 >>0x143		byte&0xC0	0xC0	[CGB ONLY]
 
-# Mapper.
->0x147 byte 0x00  [ROM ONLY]
->0x147 byte 0x01  [MBC1]
->0x147 byte 0x02  [MBC1+RAM]
->0x147 byte 0x03  [MBC1+RAM+BATT]
->0x147 byte 0x05  [MBC2]
->0x147 byte 0x06  [MBC2+BATTERY]
->0x147 byte 0x08  [ROM+RAM]
->0x147 byte 0x09  [ROM+RAM+BATTERY]
->0x147 byte 0x0B  [MMM01]
->0x147 byte 0x0C  [MMM01+SRAM]
->0x147 byte 0x0D  [MMM01+SRAM+BATT]
->0x147 byte 0x0F  [MBC3+TIMER+BATT]
->0x147 byte 0x10  [MBC3+TIMER+RAM+BATT]
->0x147 byte 0x11  [MBC3]
->0x147 byte 0x12  [MBC3+RAM]
->0x147 byte 0x13  [MBC3+RAM+BATT]
->0x147 byte 0x19  [MBC5]
->0x147 byte 0x1A  [MBC5+RAM]
->0x147 byte 0x1B  [MBC5+RAM+BATT]
->0x147 byte 0x1C  [MBC5+RUMBLE]
->0x147 byte 0x1D  [MBC5+RUMBLE+SRAM]
->0x147 byte 0x1E  [MBC5+RUMBLE+SRAM+BATT]
->0x147 byte 0xFC  [Pocket Camera]
->0x147 byte 0xFD  [Bandai TAMA5]
->0x147 byte 0xFE  [Hudson HuC-3]
->0x147 byte 0xFF  [Hudson HuC-1]
-
-# ROM size.
->0x148 byte 0     \b, ROM: 256Kbit
->0x148 byte 1     \b, ROM: 512Kbit
->0x148 byte 2     \b, ROM: 1Mbit
->0x148 byte 3     \b, ROM: 2Mbit
->0x148 byte 4     \b, ROM: 4Mbit
->0x148 byte 5     \b, ROM: 8Mbit
->0x148 byte 6     \b, ROM: 16Mbit
->0x148 byte 7     \b, ROM: 32Mbit
->0x148 byte 0x52  \b, ROM: 9Mbit
->0x148 byte 0x53  \b, ROM: 10Mbit
->0x148 byte 0x54  \b, ROM: 12Mbit
-
-# RAM size.
->0x149 byte 1     \b, RAM: 16Kbit
->0x149 byte 2     \b, RAM: 64Kbit
->0x149 byte 3     \b, RAM: 256Kbit
->0x149 byte 4     \b, RAM: 1Mbit
->0x149 byte 5     \b, RAM: 512Kbit
+# Mapper
+0	name gameboy-mapper
+>0	byte 0x00  [ROM ONLY]
+>0	byte 0x01  [MBC1]
+>0	byte 0x02  [MBC1+RAM]
+>0	byte 0x03  [MBC1+RAM+BATT]
+>0	byte 0x05  [MBC2]
+>0	byte 0x06  [MBC2+BATTERY]
+>0	byte 0x08  [ROM+RAM]
+>0	byte 0x09  [ROM+RAM+BATTERY]
+>0	byte 0x0B  [MMM01]
+>0	byte 0x0C  [MMM01+SRAM]
+>0	byte 0x0D  [MMM01+SRAM+BATT]
+>0	byte 0x0F  [MBC3+TIMER+BATT]
+>0	byte 0x10  [MBC3+TIMER+RAM+BATT]
+>0	byte 0x11  [MBC3]
+>0	byte 0x12  [MBC3+RAM]
+>0	byte 0x13  [MBC3+RAM+BATT]
+>0	byte 0x19  [MBC5]
+>0	byte 0x1A  [MBC5+RAM]
+>0	byte 0x1B  [MBC5+RAM+BATT]
+>0	byte 0x1C  [MBC5+RUMBLE]
+>0	byte 0x1D  [MBC5+RUMBLE+SRAM]
+>0	byte 0x1E  [MBC5+RUMBLE+SRAM+BATT]
+>0	byte 0xFC  [Pocket Camera]
+>0	byte 0xFD  [Bandai TAMA5]
+>0	byte 0xFE  [Hudson HuC-3]
+>0	byte 0xFF  [Hudson HuC-1]
+
+# ROM size
+0	name gameboy-rom-size
+>0	byte 0     \b, ROM: 256Kbit
+>0	byte 1     \b, ROM: 512Kbit
+>0	byte 2     \b, ROM: 1Mbit
+>0	byte 3     \b, ROM: 2Mbit
+>0	byte 4     \b, ROM: 4Mbit
+>0	byte 5     \b, ROM: 8Mbit
+>0	byte 6     \b, ROM: 16Mbit
+>0	byte 7     \b, ROM: 32Mbit
+>0	byte 0x52  \b, ROM: 9Mbit
+>0	byte 0x53  \b, ROM: 10Mbit
+>0	byte 0x54  \b, ROM: 12Mbit
+
+# RAM size
+0	name	gameboy-ram-size
+>0	byte 1     \b, RAM: 16Kbit
+>0	byte 2     \b, RAM: 64Kbit
+>0	byte 3     \b, RAM: 256Kbit
+>0	byte 4     \b, RAM: 1Mbit
+>0	byte 5     \b, RAM: 512Kbit
+
+# Game Boy (Color)
+0x104		bequad		0xCEED6666CC0D000B
+>0x143		byte&0x80	0x80	Game Boy Color ROM image
+!:mime		application/x-gameboy-color-rom
+>0x143		byte&0x80	!0x80	Game Boy ROM image
+!:mime		application/x-gameboy-rom
+>0		use		gameboy-title
+>0		use		gameboy-machine-type
+>0x147		use		gameboy-mapper
+>0x148		use		gameboy-rom-size
+>0x149		use		gameboy-ram-size
+
+# Analogue Pocket
+0x104		bequad		0x0110CEEF000044AA
+>0		byte		x	Analogue Pocket ROM image
+!:mime		application/x-analogue-pocket-rom
+>0		use		gameboy-title
+>0		use		gameboy-machine-type
+>0x147		use		gameboy-mapper
+>0x148		use		gameboy-rom-size
+>0x149		use		gameboy-ram-size
 
 #------------------------------------------------------------------------------
 # genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats
@@ -210,45 +236,45 @@
 
 # TODO: Check for 32X CD?
 # Sega Mega CD disc images: 2048-byte sectors.
-0	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
+0	string	SEGADISCSYSTEM\040\040	Sega Mega CD disc image
 !:mime	application/x-sega-cd-rom
 >0	use	sega-mega-drive-header
 >0	byte	x			\b, 2048-byte sectors
-0	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
+0	string	SEGABOOTDISC\040\040\040\040	Sega Mega CD disc image
 !:mime	application/x-sega-cd-rom
 >0	use	sega-mega-drive-header
 >0	byte	x			\b, 2048-byte sectors
 # Sega Mega CD disc images: 2352-byte sectors.
-0x10	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
+0x10	string	SEGADISCSYSTEM\040\040	Sega Mega CD disc image
 !:mime	application/x-sega-cd-rom
 >0x10	use	sega-mega-drive-header
 >0	byte	x			\b, 2352-byte sectors
-0x10	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
+0x10	string	SEGABOOTDISC\040\040\040\040	Sega Mega CD disc image
 !:mime	application/x-sega-cd-rom
 >0x10	use	sega-mega-drive-header
 >0	byte	x			\b, 2352-byte sectors
 
 # Sega Mega Drive: Identify the system ID.
 0x100		string	SEGA
->0x3C0		string	MARS\ CHECK\ MODE	Sega 32X ROM image
+>0x3C0		string	MARS\040CHECK\040MODE	Sega 32X ROM image
 !:mime		application/x-genesis-32x-rom
 >>0		use	sega-mega-drive-header
->0x104		string	\ PICO			Sega Pico ROM image
+>0x104		string	\040PICO			Sega Pico ROM image
 !:mime		application/x-sega-pico-rom
 >>0		use	sega-mega-drive-header
->0x104		string	TOYS\ PICO		Sega Pico ROM image
+>0x104		string	TOYS\040PICO		Sega Pico ROM image
 !:mime		application/x-sega-pico-rom
 >>0		use	sega-mega-drive-header
->0x104		string	\ TOYS\ PICO		Sega Pico ROM image
+>0x104		string	\040TOYS\040PICO		Sega Pico ROM image
 !:mime		application/x-sega-pico-rom
 >>0		use	sega-mega-drive-header
->0x104		string	\ IAC			Sega Pico ROM image
+>0x104		string	\040IAC			Sega Pico ROM image
 !:mime		application/x-sega-pico-rom
 >>0		use	sega-mega-drive-header
->0x104		string	\ TERA68K		Sega Teradrive (68K) ROM image
+>0x104		string	\040TERA68K		Sega Teradrive (68K) ROM image
 !:mime		application/x-sega-teradrive-rom
 >>0		use	sega-mega-drive-header
->0x104		string	\ TERA286		Sega Teradrive (286) ROM image
+>0x104		string	\040TERA286		Sega Teradrive (286) ROM image
 !:mime		application/x-sega-teradrive-rom
 >>0		use	sega-mega-drive-header
 >0x180		string	BR			Sega Mega CD Boot ROM image
@@ -259,23 +285,23 @@
 >>0		use	sega-mega-drive-header
 
 # Sega Mega Drive: Some ROMs have "SEGA" at 0x101, not 0x100.
-0x100		string	\ SEGA			Sega Mega Drive / Genesis ROM image
+0x100		string	\040SEGA			Sega Mega Drive / Genesis ROM image
 >0		use	sega-mega-drive-header
 
 # Sega Pico ROMs that don't start with "SEGA".
-0x100		string	SAMSUNG\ PICO		Samsung Pico ROM image
+0x100		string	SAMSUNG\040PICO		Samsung Pico ROM image
 !:mime		application/x-sega-pico-rom
 >0		use	sega-mega-drive-header
-0x100		string	IMA\ IKUNOUJYUKU	Samsung Pico ROM image
+0x100		string	IMA\040IKUNOUJYUKU	Samsung Pico ROM image
 !:mime		application/x-sega-pico-rom
 >0		use	sega-mega-drive-header
-0x100		string	IMA IKUNOJYUKU		Samsung Pico ROM image
+0x100		string	IMA\040IKUNOJYUKU	Samsung Pico ROM image
 !:mime		application/x-sega-pico-rom
 >0		use	sega-mega-drive-header
 
 # Sega Picture Magic (modified 32X)
-0x100		string	Picture\ Magic
->0x3C0		string	PICTURE MAGIC-01	Sega 32X ROM image
+0x100		string	Picture\040Magic
+>0x3C0		string	PICTURE\040MAGIC-01	Sega 32X ROM image
 !:mime		application/x-genesis-32x-rom
 >>0		use	sega-mega-drive-header
 
@@ -314,59 +340,59 @@
 # The SMS boot ROM checks the header at three locations.
 0	name	sega-master-system-rom-header
 # Machine type.
->0x0F	byte&0xF0	0x30	Sega Master System
+>0x0F	ubyte&0xF0	0x30	Sega Master System
 !:mime	application/x-sms-rom
->0x0F	byte&0xF0	0x40	Sega Master System
+>0x0F	ubyte&0xF0	0x40	Sega Master System
 !:mime	application/x-sms-rom
->0x0F	byte&0xF0	0x50	Sega Game Gear
+>0x0F	ubyte&0xF0	0x50	Sega Game Gear
 !:mime	application/x-gamegear-rom
->0x0F	byte&0xF0	0x60	Sega Game Gear
+>0x0F	ubyte&0xF0	0x60	Sega Game Gear
 !:mime	application/x-gamegear-rom
->0x0F	byte&0xF0	0x70	Sega Game Gear
+>0x0F	ubyte&0xF0	0x70	Sega Game Gear
 !:mime	application/x-gamegear-rom
 >0x0F	default		x	Sega Master System / Game Gear
 !:mime	application/x-sms-rom
 >0	byte		x	ROM image:
 # Product code.
->0x0E	byte&0xF0	0x10	1
->0x0E	byte&0xF0	0x20	2
->0x0E	byte&0xF0	0x30	3
->0x0E	byte&0xF0	0x40	4
->0x0E	byte&0xF0	0x50	5
->0x0E	byte&0xF0	0x60	6
->0x0E	byte&0xF0	0x70	7
->0x0E	byte&0xF0	0x80	8
->0x0E	byte&0xF0	0x90	9
->0x0E	byte&0xF0	0xA0	10
->0x0E	byte&0xF0	0xB0	11
->0x0E	byte&0xF0	0xC0	12
->0x0E	byte&0xF0	0xD0	13
->0x0E	byte&0xF0	0xE0	14
->0x0E	byte&0xF0	0xF0	15
+>0x0E	ubyte&0xF0	0x10	1
+>0x0E	ubyte&0xF0	0x20	2
+>0x0E	ubyte&0xF0	0x30	3
+>0x0E	ubyte&0xF0	0x40	4
+>0x0E	ubyte&0xF0	0x50	5
+>0x0E	ubyte&0xF0	0x60	6
+>0x0E	ubyte&0xF0	0x70	7
+>0x0E	ubyte&0xF0	0x80	8
+>0x0E	ubyte&0xF0	0x90	9
+>0x0E	ubyte&0xF0	0xA0	10
+>0x0E	ubyte&0xF0	0xB0	11
+>0x0E	ubyte&0xF0	0xC0	12
+>0x0E	ubyte&0xF0	0xD0	13
+>0x0E	ubyte&0xF0	0xE0	14
+>0x0E	ubyte&0xF0	0xF0	15
 # If the product code is 5 digits, we'll need to backspace here.
->0x0E	byte&0xF0	!0
->>0x0C	leshort		x	\b%04x
->0x0E	byte&0xF0	0
->>0x0C	leshort		x	%04x
+>0x0E	ubyte&0xF0	!0
+>>0x0C	uleshort	x	\b%04x
+>0x0E	ubyte&0xF0	0
+>>0x0C	uleshort	x	%04x
 # Revision.
->0x0E	byte&0x0F	x	(Rev.%02d)
+>0x0E	ubyte&0x0F	x	(Rev.%02d)
 # ROM size. (Used for the boot ROM checksum routine.)
->0x0F	byte&0x0F	0x0A	(8 KB)
->0x0F	byte&0x0F	0x0B	(16 KB)
->0x0F	byte&0x0F	0x0C	(32 KB)
->0x0F	byte&0x0F	0x0D	(48 KB)
->0x0F	byte&0x0F	0x0E	(64 KB)
->0x0F	byte&0x0F	0x0F	(128 KB)
->0x0F	byte&0x0F	0x00	(256 KB)
->0x0F	byte&0x0F	0x01	(512 KB)
->0x0F	byte&0x0F	0x02	(1 MB)
+>0x0F	ubyte&0x0F	0x0A	(8 KB)
+>0x0F	ubyte&0x0F	0x0B	(16 KB)
+>0x0F	ubyte&0x0F	0x0C	(32 KB)
+>0x0F	ubyte&0x0F	0x0D	(48 KB)
+>0x0F	ubyte&0x0F	0x0E	(64 KB)
+>0x0F	ubyte&0x0F	0x0F	(128 KB)
+>0x0F	ubyte&0x0F	0x00	(256 KB)
+>0x0F	ubyte&0x0F	0x01	(512 KB)
+>0x0F	ubyte&0x0F	0x02	(1 MB)
 
 # SMS/GG header locations.
-0x7FF0	string	TMR\ SEGA
+0x7FF0	string	TMR\040SEGA
 >0x7FF0	use	sega-master-system-rom-header
-0x3FF0	string	TMR\ SEGA
+0x3FF0	string	TMR\040SEGA
 >0x3FF0	use	sega-master-system-rom-header
-0x1FF0	string	TMR\ SEGA
+0x1FF0	string	TMR\040SEGA
 >0x1FF0	use	sega-master-system-rom-header
 
 #------------------------------------------------------------------------------
@@ -384,12 +410,12 @@
 >>0x2A	byte	0	\b)
 
 # 2048-byte sector version.
-0	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
+0	string	SEGA\040SEGASATURN\040	Sega Saturn disc image
 !:mime	application/x-saturn-rom
 >0	use	sega-saturn-disc-header
 >0	byte	x			(2048-byte sectors)
 # 2352-byte sector version.
-0x10	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
+0x10	string	SEGA\040SEGASATURN\040	Sega Saturn disc image
 !:mime	application/x-saturn-rom
 >0x10	use	sega-saturn-disc-header
 >0	byte	x			(2352-byte sectors)
@@ -410,12 +436,12 @@
 >>0x4A	byte	0	\b)
 
 # 2048-byte sector version.
-0	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
+0	string	SEGA\040SEGAKATANA\040	Sega Dreamcast disc image
 !:mime	application/x-dc-rom
 >0	use	sega-dreamcast-disc-header
 >0	byte	x			(2048-byte sectors)
 # 2352-byte sector version.
-0x10	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
+0x10	string	SEGA\040SEGAKATANA\040	Sega Dreamcast disc image
 !:mime	application/x-dc-rom
 >0x10	use	sega-dreamcast-disc-header
 >0	byte	x			(2352-byte sectors)
@@ -509,7 +535,7 @@
 # - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
 # - https://www.devrs.com/ngp/files/ngpctech.txt
 #
-0x0A	string		BY\ SNK\ CORPORATION	Neo Geo Pocket
+0x0A	string		BY\040SNK\040CORPORATION	Neo Geo Pocket
 !:mime	application/x-neo-geo-pocket-rom
 >0x23	byte		0x10			Color
 >0	byte		x			ROM image
@@ -524,7 +550,7 @@
 
 #------------------------------------------------------------------------------
 # Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
-0	string	PS-X\ EXE	Sony Playstation executable
+0	string	PS-X\040EXE	Sony Playstation executable
 >16	lelong	x		PC=%#08x,
 >20	lelong	!0		GP=%#08x,
 >24	lelong	!0		.text=[%#08x,
@@ -723,17 +749,54 @@
 
 # From: Alex Myczko <alex@aiei.ch>
 # From: David Pflug <david@pflug.email>
+# Update:	Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/Game_Boy_Sound
+#		http://en.wikipedia.org/wiki/Game_Boy_Sound_System
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/g/gbs.trid.xml
+# Note:		called "GameBoy Sound System dump" by TrID,
+#		"Gameboy GBS rom image" by X11 Gameboy sound player xgbsplay and
+#		verified by gbsplay `LANG=C gbsinfo /usr/share/doc/gbsplay/examples/nightmode.gbs`
 # is the offset 12 or the offset 16 correct?
 # GBS (Game Boy Sound) magic
-# ftp://ftp.modland.com/pub/documents/format_documentation/\
+# http://ftp.modland.com/pub/documents/format_documentation/\
 # Gameboy%20Sound%20System%20(.gbs).txt
-0	string		GBS		Nintendo Gameboy Music/Audio Data
-#12	string		GameBoy\ Music\ Module	Nintendo Gameboy Music Module
+# skip Grand Theft Auto 2 Style data (*.sty via sty-gta2.trid.xml) and Opera (*.patch) by check for valid "low" version
+0	string		GBS\001		Nintendo Gameboy Music/Audio Data
+!:mime		audio/x-nintendo-gbs
+# by gbsplay or xgbsplay tools
+#!:mime		audio/gbs
+#!:mime		audio/prs.gbs
+!:ext	gbs
+# fields are right null-filled; no terminating \0 if all bytes are used; if field unknown, should be set to a single ?
+# title string like: "Blues Brothers" "Bugs Bunny Crazy Castle 3"
+#12	string		GameBoy\040Music\040Module	Nintendo Gameboy Music Module
 >16	string		>\0	("%.32s" by
+# author string like: <?>, by Laxity, Justin Muir, 1993 Ocean
 >48	string		>\0	%.32s, copyright
->80	string		>\0	%.32s),
->3	byte		x	version %u,
->4	byte		x	%u tracks
+# copyright string like: empty "1991 Titus" "2001 Imagineer/KT.Kodansha/P&B" "2000 Newline, Ubisoft, D. Eclip."
+>80	string		>\0	%.32s
+# GBSVersion; 1 
+#>3	byte		!1	version %u,
+# number of songs (1-255)
+>4	ubyte		x	\b), %u track
+# plural s
+>4	ubyte		>1	\bs
+# default subsong; like: 1 (often) 2 29 60 79 82
+>5	ubyte		!1	\b, %u first
+# load address (400h-7fffh)
+>6	uleshort	x	\b, load address %#4.4x
+# init address (400h-7fffh)
+>8	uleshort	x	\b, init address %#4.4x
+# play address (400-7fffh)
+>10	uleshort	x	\b, play address %#4.4x
+# stack pointer; like: FFFEh (default) CFFFh DCFEh DDFEh DDFFh DEFFh E000h FFF4h
+>12	uleshort	x	\b, stack pointer %#4.4x
+# timer modulo; often 0
+>14	ubyte		!0	\b, timer modulo %#x
+# timer control; often 0
+>15	ubyte		!0	\b, timer control %#x
+# code and Data (see RST VECTORS)
+#>0x70	ubequad		x	\b, data %#16.16llx...
 
 # IPS Patch Files from: From: Thomas Klausner <tk@giga.or.at>
 # see https://zerosoft.zophar.net/ips.php
@@ -807,6 +870,37 @@
 !:ext   ciso/cso
 >>>>8           ulequad                 x               \b, original size %llu bytes
 >>>>16          ulelong                 x               \b, datablock size %u bytes
+# Type: Nintendo GameCube/Wii disc image (CISO format)
+# NOTE: This is NOT the same as Compact ISO or PSP CISO,
+# though it has the same magic number.
+# Other fields are used to determine what type of CISO this is:
+# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
+# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
+# - None of the above: Compact ISO.
+>4		lelong	0x200000
+>>8		byte	1
+>>>0x801C	belong	0xC2339F3D	Nintendo GameCube disc image (CISO format):
+!:mime	application/x-wii-rom
+>>>>0x8000	use	nintendo-gcn-disc-common
+>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii disc image (CISO format):
+!:mime	application/x-wii-rom
+>>>>0x8000	use	nintendo-gcn-disc-common
+# .cso files
+# Reference: https://pismotec.com/ciso/ciso.h
+# NOTE: There are two other formats with the same magic but
+# completely incompatible specifications:
+# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
+# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
+# Other fields are used to determine what type of CISO this is:
+# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
+# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
+# - 0x10 == 0x00004000: For >2GB files using maxcso...
+# 			https://github.com/unknownbrackets/maxcso/issues/26
+# - None of the above: Compact ISO.
+>4	lelong	!0
+>>4	lelong	!0x200000
+>>>16	lelong	!0x800
+>>>>16	lelong	!0x4000		Compressed ISO CD image
 
 # From: Daniel Dawson <ddawson@icehouse.net>
 # SNES9x .smv "movie" file format.
@@ -918,22 +1012,6 @@
 !:mime	application/x-wii-rom
 >>0x200	use	nintendo-gcn-disc-common
 
-# Type: Nintendo GameCube/Wii disc image (CISO format)
-# NOTE: This is NOT the same as Compact ISO or PSP CISO,
-# though it has the same magic number.
-0		string	CISO
-# Other fields are used to determine what type of CISO this is:
-# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
-# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
-# - None of the above: Compact ISO.
->4		lelong	0x200000
->>8		byte	1
->>>0x801C	belong	0xC2339F3D	Nintendo GameCube disc image (CISO format):
-!:mime	application/x-wii-rom
->>>>0x8000	use	nintendo-gcn-disc-common
->>>0x8018	belong	0x5D1C9EA3	Nintendo Wii disc image (CISO format):
-!:mime	application/x-wii-rom
->>>>0x8000	use	nintendo-gcn-disc-common
 
 # Type: Nintendo GameCube/Wii disc image (GCZ format)
 # Due to zlib compression, we can't get the actual disc information.
@@ -1133,7 +1211,7 @@
 # The header is terminated with a 0, so that will
 # terminate the title as well.
 #
-0	string	g\ GCE	Vectrex ROM image
+0	string	g\040GCE	Vectrex ROM image
 >0x11	string	>\0	\b: "%.16s"
 
 #------------------------------------------------------------------------------
@@ -1213,8 +1291,8 @@
 # From: David Korth <gerbilsoft@gerbilsoft.com>
 # References:
 # - https://problemkaputt.de/fullsnes.htm#snescartsufamiturbominicartridgeadaptor
-0	string		BANDAI\ SFC-ADX
->0x10	string		!SFC-ADX\ BACKUP	Sufami Turbo ROM image:
+0	string		BANDAI\040SFC-ADX
+>0x10	string		!SFC-ADX\040BACKUP	Sufami Turbo ROM image:
 >>0x10	string/T	x	"%.14s"
 >>0x30	byte		x	\b, ID %02X
 >>0x31	byte		x	\b%02X
@@ -1224,3 +1302,77 @@
 >>0x34	ubyte		1	[FastROM]
 >>0x35	ubyte		1	[SRAM]
 >>0x35	ubyte		3	[Special]
+
+#------------------------------------------------------------------------------
+# Type: Super NES ROM image
+# From: Alexandre Iooss <erdnaxe@crans.org>
+# Reference: https://snes.nesdev.org/wiki/ROM_header
+0		name		snes-rom-hdr
+# cartridge title is encoded in JIS X 0201, 21 chars padded with spaces
+>0		ubyte-0x20	<0xC0
+>>1		ubyte-0x20	<0xC0
+>>>2		ubyte-0x20	<0xC0
+>>>>3		ubyte-0x20	<0xC0
+>>>>>4		ubyte-0x20	<0xC0
+>>>>>>5		ubyte-0x20	<0xC0
+>>>>>>>6	ubyte-0x20	<0xC0
+>>>>>>>>7	ubyte-0x20	<0xC0
+>>>>>>>>>8	ubyte-0x20	<0xC0
+>>>>>>>>>>9	ubyte-0x20	<0xC0
+>>>>>>>>>>>10	ubyte-0x20	<0xC0
+>>>>>>>>>>>>21	ubyte-0x20	<0xC0		Super NES ROM image
+>>>>>>>>>>>>>0	string/21/T	x		"%s"
+>>>>>>>>>>>>>25	byte		0		(Japan)
+>>>>>>>>>>>>>25	byte		1		(USA)
+>>>>>>>>>>>>>25	byte		2		(Europe)
+>>>>>>>>>>>>>25	byte		6		(France)
+>>>>>>>>>>>>>25	byte		7		(Netherlands)
+>>>>>>>>>>>>>25	byte		9		(Germany)
+>>>>>>>>>>>>>25	byte		10		(Brazil)
+>>>>>>>>>>>>>27	byte		>0		(Rev.%02u)
+>>>>>>>>>>>>>21	byte&0xF	0x0		\b, LoROM
+>>>>>>>>>>>>>21	byte&0xF	0x1		\b, HiROM
+>>>>>>>>>>>>>21	byte&0x10	0x10		\b, FastROM
+>>>>>>>>>>>>>23	byte		8		\b, ROM size: 256KB
+>>>>>>>>>>>>>23	byte		9		\b, ROM size: 512KB
+>>>>>>>>>>>>>23	byte		10		\b, ROM size: 1024KB
+>>>>>>>>>>>>>23	byte		11		\b, ROM size: 2048KB
+>>>>>>>>>>>>>23	byte		12		\b, ROM size: 4096KB
+>>>>>>>>>>>>>24	byte		0		\b, RAM size: 1KB
+>>>>>>>>>>>>>24	byte		1		\b, RAM size: 2KB
+>>>>>>>>>>>>>24	byte		2		\b, RAM size: 4KB
+>>>>>>>>>>>>>24	byte		3		\b, RAM size: 8KB
+>>>>>>>>>>>>>24	byte		4		\b, RAM size: 16KB
+>>>>>>>>>>>>>24	byte		5		\b, RAM size: 32KB
+>>>>>>>>>>>>>24	byte		6		\b, RAM size: 64KB
+
+# header position for LoROM: $007FC0
+32725		ubyte&0xEF	0x20
+# ROM is <=4096KB, RAM is <=64KB and country<=10
+>32727		ubyte		<13
+>>32728		ubyte		<7
+>>>32729	ubyte		<11
+>>>>32704	use		snes-rom-hdr
+
+# HiROM header at $00FFC0
+65493		ubyte&0xEF	0x21
+# ROM is <=4096KB, RAM is <=64KB and country<=10
+>65495		ubyte		<13
+>>65496		ubyte		<7
+>>>65497	ubyte		<11
+>>>>65472	use		snes-rom-hdr
+
+#------------------------------------------------------------------------------
+# ancast: file(1) magic for Wii U firmware images, aka "ancast" images.
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# References:
+# - https://wiiubrew.org/wiki/Ancast_image
+0	ubelong	0xEFA282D9	Wii U firmware image:
+>0x20	ubelong	2		ARM
+>>0x1A4	ubelong	0x21		\b, NAND boot
+>>0x1A4	ubelong	0x22		\b, SD boot
+>>0x1A8	ubelong	1		\b, for devkits
+>>0x1A8	ubelong	2		\b, for retail
+>0x20	ubelong	1		PowerPC
+>>0xA4	ubelong	0x11		\b, Wii U mode
+>>0xA4	ubelong	0x12		\b, Wii mode

magic/Magdir/ctf

@@ -1,5 +1,6 @@
 
 #--------------------------------------------------------------
+# $File: ctf,v 1.5 2024/06/10 23:09:52 christos Exp $
 # ctf:  file(1) magic for CTF (Common Trace Format) trace files
 #
 # Specs. available here: <https://www.efficios.com/ctf>

magic/Magdir/database

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: database,v 1.69 2023/01/12 00:14:04 christos Exp $
+# $File: database,v 1.73 2024/11/09 19:54:36 christos Exp $
 # database:  file(1) magic for various databases
 #
 # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
@@ -740,13 +740,6 @@
 >32	lelong	0x2601196D		version 6, little-endian
 >>36	lelong	x			hash size %d bytes
 
-# SE Linux policy database
-0       lelong  0xf97cff8c      SE Linux policy
->16     lelong  x               v%d
->20     lelong  1      MLS
->24     lelong  x       %d symbols
->28     lelong  x       %d ocons
-
 # ICE authority file data (Wolfram Kleff)
 2	string		ICE		ICE authority data
 
@@ -820,7 +813,9 @@
 0	string		ZEC3	Zope Object Database Client Cache File (data)
 
 # IDA (Interactive Disassembler) database
+0	string		IDA0	IDA (Interactive Disassembler) database
 0	string		IDA1	IDA (Interactive Disassembler) database
+0	string		IDA2	IDA (Interactive Disassembler) database
 
 # Hopper (reverse engineering tool) https://www.hopperapp.com/
 0	string		hopperdb	Hopper database
@@ -871,8 +866,31 @@
 # Used by older versions of Mozilla Suite and Firefox,
 # and current versions of Thunderbird.
 # From: David Korth <gerbilsoft@gerbilsoft.com>
+# Update:	Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/Mork
+#		https://en.wikipedia.org/wiki/Mork_(file_format)
+# Note:		called "Mork" by DROID via fmt/612
 0	string	//\ <!--\ <mdb:mork:z\ v="	Mozilla Mork database
+# display Mozilla Mork database (strength=260=260+0) before "exported SGML document" (strength=28=38-10) via ./sgml
+#!:strength +0
+#!:mime	text/plain
+!:mime	text/x-mozilla-mork
+# version like 1.4
 >23	string	x		\b, version %.3s
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/msf.trid.xml
+# Note:		called "Mozilla Mail Summary file" by TrID
+>26	search/7516	mailboxName		\b, Mail Summary file
+# like: Archives.msf Drafts.msf INBOX.msf Junk.msf Sent.msf Templates.msf Trash.msf 
+!:ext						msf
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mab.trid.xml
+# Note:		called "Mozilla Address Book" by TrID
+>26	search/192	addrbk			\b, Address Book
+!:ext						mab
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/dat-mork.trid.xml
+# Note:		called "Mozilla Mail folder cache" by TrID
+>26	search/210	indexingPriority	\b, Mail folder cache
+# panacea.dat
+!:ext						dat
 
 # URL:		https://en.wikipedia.org/wiki/Management_Information_Format
 # Reference:	https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf
@@ -884,3 +902,10 @@
 !:mime	text/x-dmtf-mif
 !:ext	mif
 
+# https://github.com/boltdb/bolt
+# https://github.com/etcd-io/bbolt 
+# See magic value here: https://github.com/boltdb/bolt/blob/fd01fc79c553a8e99d512a07e8e0c63d4a3ccfc5/db.go#L24
+# The magic value is written according to endianess of the host,
+# so we check both to detect them also on hosts with differnet endianess
+16      lelong    0xED0CDAED      BoltDB database
+16      belong    0xED0CDAED      BoltDB database, big-endian

magic/Magdir/dataone

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: dataone,v 1.3 2022/04/18 21:38:10 christos Exp $
+# $File: dataone,v 1.4 2024/08/27 19:17:10 christos Exp $
 #
 # DataONE- files from Dave Vieglais <dave.vieglais@gmail.com> &
 #                     Pratik Shrivastava <pratikshrivastava23@gmail.com>
@@ -11,6 +11,11 @@
 # EML (Ecological Metadata Language Format)
 0	string	\<?xml\ version=
 >&0	regex/1024	eml-[0-9]\\.[0-9]\\.[0-9]+	eml://ecoinformatics.org/%s
+# Object Reuse and Exchange Vocabulary
+>&0	search/1024	rdf
+>>&0	search/1024	openarchives	https://www.openarchives.org/ore/terms
+!:mime application/rdf+xml
+
 
 # onedcx (DataONE Dublin Core Extended v1.0)
 >&0	regex/1024	onedcx/v[0-9]\\.[0-9]+		https://ns.dataone.org/metadata/schema/onedcx/v1.0
@@ -34,12 +39,6 @@
 !:mime	text/xml
 
 
-# Object Reuse and Exchange Vocabulary
-0	string	\<?xml\ version=
->&0	search/1024	rdf
->>&0	search/1024	openarchives	https://www.openarchives.org/ore/terms
-!:mime application/rdf+xml
-
 
 # Dryad Metadata Application Profile Version 3.1
 0	string	<DryadData

magic/Magdir/diff

@@ -1,33 +1,142 @@
 
 #------------------------------------------------------------------------------
-# $File: diff,v 1.17 2020/08/22 18:16:58 christos Exp $
+# $File: diff,v 1.21 2024/07/13 14:47:09 christos Exp $
 # diff:  file(1) magic for diff(1) output
 #
+# Update:	Joerg Jenderek
+# URL: 		https://en.wikipedia.org/wiki/Diff
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/diff.trid.xml
+# Note:		called "diff output text" by TrID and
+#		"Differences between files" by shared MIME-info database from freedesktop.org
+#		According to shared MIME-info database also tabulator character instead of space character and
+#		by TrID minus character after space character
 0	search/1	diff\040	diff output text
+# diff output text (strength=40=40+0) after unified diff output (strength=131=38+93)
+#!:strength +0
 !:mime	text/x-diff
+#!:mime	text/x-patch
+!:ext	diff/patch
+# no short named pch dif examples found
+#!:ext	diff/patch/dif/pch
+# URL:		https://en.wikipedia.org/wiki/Diff_utility#Context_format
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/diff-context.trid.xml
+# Note:		called "context diff output" by TrID
+#		and "Differences between files" by shared MIME-info database from freedesktop.org
 0	search/1	***\040
+# context diff output text (strength=42=38+4) before
+# C source (strength=41,39,37)				exported SGML document (strength=39,28)
+!:strength +4
 >&0	search/1024	\n---\040	context diff output text
 !:mime	text/x-diff
+#!:mime	text/x-patch
+!:ext	diff/patch
+# no short named pch dif examples found
+#!:ext	diff/patch/dif/pch
 0	search/1	Only\040in\040 	diff output text
+# diff output text output text (strength=38=38+0) after unified diff output (strength=131=38+93)
+#!:strength +0
 !:mime	text/x-diff
+#!:mime	text/x-patch
+!:ext	diff
 0	search/1	Common\040subdirectories:\040 	diff output text
 !:mime	text/x-diff
 
+# URL: 		https://en.wikipedia.org/wiki/Diff#Extensions
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/diff-rcs.trid.xml
+# Note:		called "RCS/CVS diff output" by TrID
+#		and "Differences between files" by shared MIME-info database from freedesktop.org
 0	search/1	Index:		RCS/CVS diff output text
+# RCS/CVS diff output text (strength=36=36+0) after unified diff output (strength=131=38+93)
+#!:strength +0
 !:mime	text/x-diff
+#!:mime	text/x-patch
+!:ext	diff/patch
 
 # bsdiff:  file(1) magic for bsdiff(1) output
-0	string/b	BSDIFF40	bsdiff(1) patch file
+# Update:	Joerg Jenderek
+# URL: 		http://www.daemonology.net/bsdiff/
+# Reference:	https://github.com/cperciva/bsdiff/blob/master/bsdiff-ra/FORMAT
+#		http://mark0.net/download/triddefs_xml.7z/defs/b/bsdiff.trid.xml
+# Note:		called "bsdiff patch" by TrID and and "BSDIFF" version 4.0 by DROID via PUID fmt/439 and
+#		"Binary differences between files" by shared MIME-info database from freedesktop.org
+0	string/b	BSDIFF40
+# skip DROID fmt-439-signature-id-672.bsdiff with invalid new file segment length 0
+>16	long		!0		bsdiff(1) patch file
+#!:mime	application/octet-stream
+!:mime	application/x-bsdiff
+!:ext	bsdiff
+# new file length
+#>>8	lequad		x		\b, new length %lld
+# new file segment length
+#>>16	lelong		x		\b, new segment length %d
+# compressed header block length
+#>>20	lelong		!0		\b, compressed header length %d
+# patch data block length
+#>>24	lequad		x		\b, data length %lld
+# look for bzip data by ./compress after message with 1 space at end
+>>0x20	indirect	x		\b, at 0x20 
 
+# From:		Joerg Jenderek
+# URL:		https://www.chromium.org/developers/design-documents/software-updates-courgette/
+# Reference:	https://github.com/adobe/chromium/blob/master/courgette/third_party/bsdiff.h
+#		http://mark0.net/download/triddefs_xml.7z/defs/b/bsdiff-chrome.trid.xml
+# Note:		called "Courgette Binary Diff output" by TrID
+#		the Courgette bsdiff tool use a total different file format compared with BSD variant from Colin Percival
+0	string/b	GBSDIF42	Courgette binary diff output
+#!:mime	application/octet-stream
+!:mime	application/x-patch
+!:ext	patch/bsdiff
+# slen; length of the file to be patched
+#>8	ubelong		x		\b, source length %u
+# scrc32; CRC32 of the file to be patched
+>12	ubelong		x		\b, crc %#8.8x
+# dlen; length of the result file
+#>16	ubelong		x		\b, result length %u
+# cblen; length of the control block
+#>20	ubelong		x		\b, control length %u
+# difflen; length of the diff block
+#>24	ubelong		x		\b, patch length %u
+# extralen; length of the extra block
+#>28	ubelong		x		\b, extra length %u
 
 # unified diff
-0	search/4096	---\040
->&0	search/1024 	\n
->>&0	search/1 	+++\040
->>>&0	search/1024 	\n
->>>>&0	search/1	@@		unified diff output text
+# URL:		http://fileformats.archiveteam.org/wiki/Unified_diff
+#		https://en.wikipedia.org/wiki/Diff_utility#Unified_format
+# Reference:	https://www.artima.com/weblogs/viewpost.jsp?thread=164293
+#		http://mark0.net/download/triddefs_xml.7z/defs/d/diff-unified.trid.xml
+# Note:		called "unified diff output" by TrID and
+#		"Differences between files" by shared MIME-info database from freedesktop.org
+# use b flag to forces the test to be done for binary files (non ASCII text like with Ctrl-D Ctrl-V Ctrl-Z)
+0	search/4096/b	---\040
+!:strength + 93
+>0	use		diff-unified
+# most samples are just pure ASCII text like: ShellR64.patch
+0	search/11054	---\040
+# unified diff (strength=131=38+93) before
+# HTML document text (strength=170,90,71,53,52,51,49)	POSIX shell script (fix-qt5.6-build.patch strength=130 ./commands)
+# JavaScript source (strength=112,84,81,80,79,78,72,69)	C++ source (strength=71,70,69,68,67,54),
+# Python script (strength=69,67,63,60,58,57,56,54,52,37)LaTeX document text (strength=62,56,55,51,43)
+# TeX document (strength=51,38)				C source (strength=41,39,37)
+# exported SGML document (strength=39,28)		diff output text (strength=38=38+0)
+# Pascal source (strength=37)				RCS/CVS diff (strength=36=36+0),
+# Algol 68 source (strength=?)				CSV ASCII text (strength=?)
+!:strength + 93
+>0	use		diff-unified
+#	check for 3 characteristic lines of unified diff
+0	name			diff-unified
+>0	search/11084 	+++\040
+>>&0	search/1024 	\n
+# at signs line sometimes other (with 2 space chars before) like: indent-header.patch
+>>>&0	search/2	@@\040-	unified diff output text
 !:mime	text/x-diff
-!:strength + 90
+#!:mime	text/x-patch
+# https://file-extension.net/seeker/file_extension_dif file_extension_pch file_extension_rej
+!:ext	diff/patch/dif/pch/rej
+# GRR: mainly for debugging purpose for variants with text before real diff output
+>>>>0	string	!---\040
+>>>>>0	string		x	\b, 1st line "%s"
+>>>>>>&1 string		x	\b, 2nd line "%s"
+>>>>>>>&1 string	x	\b, 3rd line "%s"
 
 # librsync -- the library for network deltas
 #

magic/Magdir/digital

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: digital,v 1.12 2021/07/03 14:01:46 christos Exp $
+# $File: digital,v 1.17 2024/08/30 16:53:22 christos Exp $
 #  Digital UNIX - Info
 #
 0	string	=!<arch>\n________64E	Alpha archive
@@ -10,7 +10,12 @@
 0	leshort		0603
 >24	leshort		0410		COFF format alpha pure
 >24	leshort		0413		COFF format alpha demand paged
+# TODO: use other subroutine (./coff) to display name+flags+variables for common object formatted files
+#>0	use				display-coff-foo
 >>22	leshort&030000	!020000		executable
+#!:mime	application/x-foo-executable
+# typically no file name suffix for executables like \DEC\HH\HYPERHLP
+!:ext	/
 >>22	leshort&020000	!0		dynamically linked
 >>16	lelong		!0		not stripped
 >>16	lelong		0		stripped
@@ -23,6 +28,19 @@
 >>26	byte		x		\b.%d
 >>28	byte		x		\b-%d
 
+# Alpha COFF object file or executable
+0	leshort		0x0184
+>16	leshort		0
+>>0	use		display-coff
+# can be created by LINK.EXE /MACHINE:ALPHA /ROM
+>16	leshort		!0
+>>18	leshort		&0x0002
+>>>20	leshort		0x0107
+>>>>0	use		display-coff
+0	leshort		0x0284
+>16	leshort		0
+>>0	use		display-coff
+
 # Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
 #
 # The actual magic number is just "Core", followed by a 2-byte version

magic/Magdir/efi

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $
+# $File: efi,v 1.7 2024/02/18 14:15:22 christos Exp $
 # efi:  file(1) magic for Universal EFI binaries
 
 0	lelong	0x0ef1fab9
@@ -13,3 +13,46 @@
 >>&20	lelong	7		\b, i386
 >>&20	lelong	0x01000007	\b, x86_64
 >4	lelong	>2		Universal EFI binary with %d architectures
+
+# EFI Signature List
+# From: Alexandre Iooss <erdnaxe@crans.org>
+# URL: https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git
+0	name	efi_sig_list
+>0	guid	D719B2CB-3D3A-4596-A3BC-DAD00E67656F	EFI Signature List, SIG DB
+>0	guid	4AAFD29D-68DF-49EE-8AA9-347D375665A7	EFI Signature List, PKCS7
+>0	guid	3C5766E8-269C-4E34-AA14-ED776E85B3B6	EFI Signature List, RSA2048
+>0	guid	E2B36190-879B-4A3D-AD8D-F2E7BBA32784	EFI Signature List, RSA2048 SHA256
+>0	guid	67F8444F-8743-48F1-A328-1EAAB8736080	EFI Signature List, RSA2048 SHA1
+>0	guid	A7717414-C616-4977-9420-844712A735BF	EFI Signature List, RSA2048 SHA256 type
+>0	guid	826CA512-CF10-4AC9-B187-BE01496631BD	EFI Signature List, SHA1
+>0	guid	0B6E5233-A65C-44C9-9407-D9AB83BFC8BD	EFI Signature List, SHA224
+>0	guid	C1C41626-504C-4092-ACA9-41F936934328	EFI Signature List, SHA256
+>0	guid	FF3E5307-9FD0-48C9-85F1-8AD56C701E01	EFI Signature List, SHA384
+>0	guid	093E0FAE-A6C4-4F50-9F1B-D41E2B89C19A	EFI Signature List, SHA512
+>0	guid	A5C059A1-94E4-4AA7-87B5-AB155C2BF072	EFI Signature List, X509
+>0	guid	3BD2A492-96C0-4079-B420-FCF98EF103ED	EFI Signature List, X509 SHA256
+>0	guid	7076876E-80C2-4EE6-AAD2-28B349A6865B	EFI Signature List, X509 SHA384
+>0	guid	446DBF63-2502-4CDA-BCFA-2465D2B0FE9D	EFI Signature List, X509 SHA512
+>0	guid	605DAB50-E046-4300-ABB6-3DD810DD8B23	EFI Signature List, MOK_OWNER
+>0	guid	A46423E3-4617-49F1-B9FF-D1BFA9115839	EFI Signature List, SECURITY PROTOCOL
+>0	guid	94AB2F58-1438-4EF1-9152-18941A3A0E68	EFI Signature List, SECURITY2 PROTOCOL
+>0	guid	AAF32C78-947B-439A-A180-2E144EC37792	EFI Signature List, SECURE VARIABLE
+# Hypothesis: EFI Signature List are smaller than 16MiB
+19	byte	=0
+>23	byte	=0
+>>27	byte	=0
+>>>0	use	efi_sig_list
+>>>>16	ulelong	x					\b, total size: %d bytes
+# Variant: EFI Signature List as an EFI variable
+# See https://docs.kernel.org/filesystems/efivarfs.html
+23	byte	=0
+>27	byte	=0
+>>31	byte	=0
+>>>4	use	efi_sig_list
+>>>>0	ulelong	x					\b, EFI variable %d
+>>>>20	ulelong	x					\b, total size: %d bytes
+
+# EFI byte code COFF object file
+0	leshort		0x0ebc
+>16	leshort		0
+>>0	use		display-coff

magic/Magdir/elf

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: elf,v 1.88 2023/01/08 17:09:18 christos Exp $
+# $File: elf,v 1.91 2024/11/09 23:52:23 christos Exp $
 # elf:  file(1) magic for ELF executables
 #
 # We have to check the byte order flag to see what byte order all the
@@ -82,15 +82,15 @@
 >18	leshort		0		no machine,
 >18	leshort		1		AT&T WE32100,
 >18	leshort		2		SPARC,
->18	leshort		3		Intel 80386,
+>18	leshort		3		Intel i386,
 >18	leshort		4		Motorola m68k,
 >>4	byte		1
 >>>36	lelong		&0x01000000	68000,
 >>>36	lelong		&0x00810000	CPU32,
 >>>36	lelong		0		68020,
 >18	leshort		5		Motorola m88k,
->18	leshort		6		Intel 80486,
->18	leshort		7		Intel 80860,
+>18	leshort		6		Intel i486,
+>18	leshort		7		Intel i860,
 # The official e_machine number for MIPS is now #8, regardless of endianness.
 # The second number (#10) will be deprecated later. For now, we still
 # say something if #10 is encountered, but only gory details for #8.
@@ -375,5 +375,29 @@
 >7	byte		16		(FenixOS)
 >7	byte		17		(Nuxi CloudABI)
 >7	byte		97		(ARM)
+>7	byte		102		(Cell LV2)
 >7	byte		202		(Cafe OS)
 >7	byte		255		(embedded)
+
+# SELF Signed ELF used on the playstation
+# https://www.psdevwiki.com/ps4/SELF_File_Format#make_fself_by_flatz
+# https://www.psdevwiki.com/ps3/SELF_-_SPRX
+0	lelong		0x4F153D1D
+>4	lelong		0x00010112	PS4 Signed ELF file
+>8	byte		1		\b, SELF/SPRX signed-elf/prx
+>8	byte		2		\b, SRVK signed-revoke-list
+>8	byte		3		\b, SPKG signed-package
+>8	byte		4		\b, SSPP signed-security-policy-profile
+>8	byte		5		\b, SDIFF signed-diff
+>8	byte		6		\b, SPSFO signed-param-sfo
+>9	byte&0xf0	x		\b, version %#x	
+>9	byte&0x0f	4		\b, game
+>9	byte&0x0f	5		\b, module
+>9	byte&0x0f	6		\b, video app
+>9	byte&0x0f	8		\b, System/EX application
+>9	byte&0x0f	9		\b, System/EX module/dll
+#>12	leshort		x		\b, header size %d
+#>14	leshort		x		\b, signature size %d
+#>16	lelong		x		\b, file size %d
+#>18	leshort		x		\b, number of segments %d
+#>20	leshort		22

magic/Magdir/epoc

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $
+# $File: epoc,v 1.10 2024/02/14 23:51:54 rrt Exp $
 # EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
 # Stefan Praszalowicz <hpicollo@worldnet.fr> and Peter Breitenlohner <peb@mppmu.mpg.de>
 # Useful information for improving this file can be found at:
@@ -8,55 +8,82 @@
 #------------------------------------------------------------------------------
 0	lelong		0x10000037	Psion Series 5
 >4	lelong		0x10000039	font file
+!:mime application/x-epoc-font
 >4	lelong		0x1000003A	printer driver
+!:mime application/x-epoc-pdriver
 >4	lelong		0x1000003B	clipboard
+!:mime application/x-epoc-clipboard
 >4	lelong		0x10000042	multi-bitmap image
 !:mime image/x-epoc-mbm
 >4	lelong		0x1000006A	application information file
->4	lelong		0x1000006D
+>4	lelong		0x1000006D      Record file
+!:mime image/x-epoc-record
 >>8	lelong		0x1000007D	Sketch image
 !:mime image/x-epoc-sketch
 >>8	lelong		0x1000007E	voice note
+!:mime application/x-epoc-voice
 >>8	lelong		0x1000007F	Word file
 !:mime application/x-epoc-word
 >>8	lelong		0x10000085	OPL program (TextEd)
 !:mime application/x-epoc-opl
+>>8	lelong		0x10000086	Data file
+!:mime application/x-epoc-data
 >>8	lelong		0x10000087	Comms settings
 >>8	lelong		0x10000088	Sheet file
 !:mime application/x-epoc-sheet
 >>8	lelong		0x100001C4	EasyFax initialisation file
+!:mime application/x-epoc-eini
 >4	lelong		0x10000073	OPO module
 !:mime application/x-epoc-opo
 >4	lelong		0x10000074	OPL application
 !:mime application/x-epoc-app
 >4	lelong		0x1000008A	exported multi-bitmap image
+!:mime image/x-epoc-xmbm
 >4	lelong		0x1000016D
 >>8	lelong		0x10000087	Comms names
 
 0	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image
+!:mime image/x-epoc-mbm
 
 0	lelong		0x10000050	Psion Series 5
 >4	lelong		0x1000006D	database
 >>8	lelong		0x10000084	Agenda file
 !:mime application/x-epoc-agenda
->>8	lelong		0x10000086	Data file
-!:mime application/x-epoc-data
+>>8	lelong		0x10000086	Address book
+!:mime application/x-epoc-addressbook
 >>8	lelong		0x10000CEA	Jotter file
 !:mime application/x-epoc-jotter
 >4	lelong		0x100000E4	ini file
+!:mime application/x-epoc-ini
+>4      lelong          0x10000075      Backlite file
+!:mime application/x-epoc-backlite
 
 0	lelong		0x10000079	Psion Series 5 binary:
 >4	lelong		0x00000000	DLL
+!:mime application/x-epoc-dll
 >4	lelong		0x10000049	comms hardware library
+!:mime application/x-epoc-chlib
 >4	lelong		0x1000004A	comms protocol library
+!:mime application/x-epoc-cplib
 >4	lelong		0x1000005D	OPX
+!:mime application/x-epoc-opx
 >4	lelong		0x1000006C	application
+!:mime application/x-epoc-app
 >4	lelong		0x1000008D	DLL
+!:mime application/x-epoc-dll
 >4	lelong		0x100000AC	logical device driver
+!:mime application/x-epoc-ldd
 >4	lelong		0x100000AD	physical device driver
+!:mime application/x-epoc-pdd
 >4	lelong		0x100000E5	file transfer protocol
->4	lelong		0x100000E5	file transfer protocol
+!:mime application/x-epoc-ftp
 >4	lelong		0x10000140	printer definition
+!:mime application/x-epoc-ppd
 >4	lelong		0x10000141	printer definition
+!:mime application/x-epoc-ppd
 
 0	lelong		0x1000007A	Psion Series 5 executable
+
+4       lelong          0x1000006d
+>8      lelong          0x10000419      Psion Series 5 Application Installer
+!:mime application/x-epoc-sis

magic/Magdir/espressif

@@ -1,5 +1,7 @@
 
-# $File: espressif,v 1.3 2021/04/26 15:56:00 christos Exp $
+#------------------------------------------------------------------------------
+# $File: espressif,v 1.4 2024/06/10 23:09:52 christos Exp $
+# espressif:  file(1) magic for ESP8266 based devices
 # configuration dump of Tasmota firmware for ESP8266 based devices by Espressif
 # URL: https://github.com/arendst/Sonoff-Tasmota/
 # Reference: https://codeload.github.com/arendst/Sonoff-Tasmota/zip/release-6.2/

magic/Magdir/filesystems

@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: filesystems,v 1.158 2023/05/21 17:19:08 christos Exp $
+# $File: filesystems,v 1.165 2024/09/01 15:51:51 christos Exp $
 # filesystems:  file(1) magic for different filesystems
 #
 0	name	partid
@@ -1282,7 +1282,7 @@
 #>>>(0x1BC.s+11)		ubyte		x			\b,cfg_def %#x
 # for older versions
 >>>(0x1BC.s+9)		ubyte		<2
-#>>>>(0x1BC.s+12)	ubyte		18			\b,%hhu/18 seconds
+#>>>>(0x1BC.s+12)	ubyte		18			\b,%u/18 seconds
 >>>>(0x1BC.s+12)	ubyte		!18			\b,%u/18 seconds
 # floppy A: or B:
 >>>>(0x1BC.s+13)	ubyte		<2			\b,floppy %#x
@@ -1401,14 +1401,14 @@
 >>>>>16		ubyte		=1		\b, FAT  %u
 >>>>>16		ubyte		>0
 >>>>>17		uleshort	>0		\b, root entries %u
-#>>>>>17	uleshort	=0		\b, root entries %hu=0 (usual Fat32)
+#>>>>>17	uleshort	=0		\b, root entries %u=0 (usual Fat32)
 >>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB)
-#>>>>>19	uleshort	=0		\b, sectors %hu=0 (usual Fat32)
+#>>>>>19	uleshort	=0		\b, sectors %u=0 (usual Fat32)
 >>>>>21		ubyte		>0xF0		\b, Media descriptor %#x
 #>>>>>21	ubyte		=0xF0		\b, Media descriptor %#x (usual floppy)
 >>>>>21		ubyte		<0xF0		\b, Media descriptor %#x
 >>>>>22		uleshort	>0		\b, sectors/FAT %u
-#>>>>>22	uleshort	=0		\b, sectors/FAT %hu=0 (usual Fat32)
+#>>>>>22	uleshort	=0		\b, sectors/FAT %u=0 (usual Fat32)
 >>>>>24		uleshort	x		\b, sectors/track %u
 >>>>>26		ubyte		>2		\b, heads %u
 #>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
@@ -1479,7 +1479,7 @@
 >>>>>>36	ulelong		x		\b, sectors/FAT %u
 # https://technet.microsoft.com/en-us/library/cc977221.aspx
 >>>>>>40	uleshort	>0		\b, extension flags %#x
-#>>>>>>40	uleshort	=0		\b, extension flags %hu
+#>>>>>>40	uleshort	=0		\b, extension flags %u
 >>>>>>42	uleshort	>0		\b, fsVersion %u
 #>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
 >>>>>>44	ulelong		>2		\b, rootdir cluster %u
@@ -1938,26 +1938,29 @@
 # defect IO.SYS+MSDOS.SYS ?
 #>>>>>0x162	use			2xDOS-filename
 
-0	name				cdrom
->38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
+0	name				cdrom	ISO 9660 CD-ROM filesystem data
 !:mime	application/x-iso9660-image
 !:ext	iso/iso9660
->38913	string    NSR0      UDF filesystem data
-!:mime	application/x-iso9660-image
-!:ext	iso/udf
->>38917	string    1         (version 1.0)
->>38917	string    2         (version 1.5)
->>38917	string    3         (version 2.0)
->>38917	byte     >0x33      (unknown version, ID %#X)
->>38917	byte     <0x31      (unknown version, ID %#X)
 # The next line is not necessary because the MBR staff is done looking for boot signature
 >0x1FE	leshort  0xAA55     (DOS/MBR boot sector)
 # "application id" which appears to be used as a volume label
 >32808	string/T  >\0       '%.32s'
 >34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
+# check for extended area (combined ISO + UDF)
+>36865	string    BEA01     +
+>>36864	use       extendedarea
+
 37633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
 !:mime	application/x-iso9660-image
+
+# URL:		http://fileformats.archiveteam.org/wiki/High_Sierra
+# Update:	Joerg Jenderek
 32777	string    CDROM     High Sierra CD-ROM filesystem data
+# https://www.unix.com/man-page/OpenSolaris/7fs/hsfs/
+#!:mime	application/octet-stream
+#!:mime	application/x-hsfs-image
+# BOOKSHELF.ISO "Shareware Grab Bag.iso"
+!:ext	iso
 # "application id" which appears to be used as a volume label
 >32816	string/T  >\0       '%.32s'
 
@@ -1973,6 +1976,55 @@
 !:strength +35
 >0	use	cdrom
 
+# From:		Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/Universal_Disk_Format
+#		https://en.wikipedia.org/wiki/Universal_Disk_Format
+# Reference:	https://wiki.osdev.org/UDF
+# Note:		called "UDF Disc Image" by DROID via PUID fmt/1738
+#		verified by udftools `udfinfo nero-UDFv26.iso` and 7-Zip `7z l -tUdf nero-UDF1.iso`
+#		
+# look for type descriptor at relative offset 1 of block 16 if it is an extended descriptor section
+32769	string	BEA01
+>32768	use	extendedarea
+
+0	name	extendedarea
+# look for type descriptor at relative offset 1 of block 17 with size 2048 (valid for images with blocksize of 512, 1024 or 2048 bytes)
+>2049		string	NSR0
+>>2048		use	NSR0
+>2049		default	x
+# look for type descriptor at relative offset 1 of block 17 with size 4096 (valid for images with blocksize of 4096 bytes)
+>>4097		string	NSR0
+>>>4096		use	NSR0
+>>4097		default	x
+# look for type descriptor at relative offset 1 of block 17 with size 8192 (valid for images with blocksize of 8192 bytes)
+>>>8193		string	NSR0
+>>>>8192	use	NSR0
+>>>8193		default	x
+# look for type descriptor at relative offset 1 of block 17 with size 16384 (valid for images with blocksize of 16384 bytes)
+>>>>16385	string	NSR0
+>>>>>16384	use	NSR0
+>>>>16385	default	x
+# look for type descriptor at relative offset 1 of block 17 with size 32768 (valid for images with blocksize of 32768 bytes)
+>>>>>32769	string	NSR0
+>>>>>>32768	use	NSR0
+>>>>>32769	default	x
+
+0	name	NSR0
+# NSR02 indicates ISO/IEC 13346 first edition, or ECMA-167 second edition
+# OSTA UDF 1.x revisions are based on ISO/IEC 13346 first edition
+# FIXME: This detection is incorrect as it does not detect UDF 1.x, but ECMA-167 2nd
+>5	ubyte	0x32	UDF filesystem data (version 1.x)
+#!:mime	application/octet-stream
+!:mime	application/x-udf-image
+!:ext	iso/udf
+# NSR03 indicates ISO/IEC 13346 second edition, or ECMA-167 third edition
+# OSTA UDF 2.x revisions are based on ECMA-167 third edition
+# FIXME: This detection is incorrect as it does not detect UDF 2.x, but ECMA-167 3rd
+>5	ubyte	0x33	UDF filesystem data (version 2.x)
+#!:mime	application/octet-stream
+!:mime	application/x-udf-image
+!:ext	iso/udf
+
 # URL: https://en.wikipedia.org/wiki/NRG_(file_format)
 # Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/
 #	11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh
@@ -1983,24 +2035,6 @@
 !:ext	nrg
 >307200	use cdrom
 
-# .cso files
-# Reference: https://pismotec.com/ciso/ciso.h
-# NOTE: There are two other formats with the same magic but
-# completely incompatible specifications:
-# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
-# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
-0    string    CISO
-# Other fields are used to determine what type of CISO this is:
-# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
-# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
-# - 0x10 == 0x00004000: For >2GB files using maxcso...
-# 			https://github.com/unknownbrackets/maxcso/issues/26
-# - None of the above: Compact ISO.
->4	lelong	!0
->>4	lelong	!0x200000
->>>16	lelong	!0x800
->>>>16	lelong	!0x4000		Compressed ISO CD image
-
 # cramfs filesystem - russell@coker.com.au
 0       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
 >4      lelong  x size %u
@@ -2199,20 +2233,6 @@
 >560	string		x		label: %.64s,
 >136	string		x		mountpoint: %.128s
 
-# Summary: Oracle ASM tagged volume
-# Created by: Aaron Botsis <redhat@digitalmafia.org>
-32	string		ORCLDISK	Oracle ASM Volume,
->40	string		x		Disk Name: %0.12s
-32	string		ORCLCLRD	Oracle ASM Volume (cleared),
->40	string		x		Disk Name: %0.12s
-
-# Oracle Clustered Filesystem - Aaron Botsis <redhat@digitalmafia.org>
-8	string		OracleCFS	Oracle Clustered Filesystem,
->4	long		x		rev %d
->0	long		x		\b.%d,
->560	string		x		label: %.64s,
->136	string		x		mountpoint: %.128s
-
 # Oracle ASM tagged volume - Aaron Botsis <redhat@digitalmafia.org>
 32	string		ORCLDISK	Oracle ASM Volume,
 >40	string		x		Disk Name: %0.12s
@@ -2278,12 +2298,6 @@
 # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
 0	string	*dvdisaster*	dvdisaster error correction file
 
-# xfs metadump image
-# mb_magic XFSM at 0; superblock magic XFSB at 1 << mb_blocklog
-# but can we do the << ?  For now it's always 512 (0x200) anyway.
-0	string XFSM
->0x200	string XFSB	XFS filesystem metadump image
-
 # Type:	CROM filesystem
 # From:	Werner Fink <werner@suse.de>
 0	string	CROMFS	CROMFS
@@ -2692,3 +2706,60 @@
 >>0	ubelong	>5
 >>0	default	x	YAFFS filesystem root entry (big endian)
 >>>0	use	\^yaffs
+
+# littlefs superblock
+# From: Alexandre Iooss <erdnaxe@crans.org>
+# URL: https://github.com/littlefs-project/littlefs/blob/v2.9.0/SPEC.md
+# Match first commit tag, then "littlefs" magic
+4	ulelong		0xf7ff0ff0
+>8	string		littlefs	littlefs superblock
+>>22	uleshort	x		\b, version %u
+>>20	uleshort	x		\b.%u
+>>24	ulelong		x		\b, block size: %u bytes
+>>28	ulelong		x		\b, %u blocks
+
+# EldOS Corporation SolidFS (aka SolFS)
+# 256 bytes page size
+0x0	string	\x08\x00\x4e\x57\x20
+>0x100	string	\x4e\x57\x00\x00\x01
+>0x1A2	string	\x4C\x00\x40 EldOS Corporation SolidFS, 256 bytes page size
+
+# 512 bytes page size
+0x0	string	\x09\x00\x4e\x57\x20
+>0x200	string	\x4e\x57\x00\x00\x01
+>0x2A2	string	\x4C\x00\x40 EldOS Corporation SolidFS, 512 bytes page size
+
+# 1 kibibyte page size
+0x0	string	\x0A\x00\x4e\x57\x20
+>0x400	string	\x4e\x57\x00\x00\x01
+>0x4A2	string	\x4C\x00\x40 EldOS Corporation SolidFS, 1KiB page size
+
+# 2 kibibyte page size
+0x0	string	\x0B\x00\x4e\x57\x20
+>0x800	string	\x4e\x57\x00\x00\x01
+>0x8A2	string	\x4C\x00\x40 EldOS Corporation SolidFS, 2KiB page size
+
+# 4 kibibyte page size
+0x0	string	\x0C\x00\x4e\x57\x20
+>0x1000	string	\x4e\x57\x00\x00\x01
+>0x10A2	string	\x4C\x00\x40 EldOS Corporation SolidFS, 4KiB page size
+
+# 8 kibibyte page size
+0x0	string	\x0D\x00\x4e\x57\x20
+>0x2000	string	\x4e\x57\x00\x00\x01
+>0x20A2	string	\x4C\x00\x40 EldOS Corporation SolidFS, 8KiB page size
+
+# 16 kibibyte page size
+0x0	string	\x0E\x00\x4e\x57\x20
+>0x4000	string	\x4e\x57\x00\x00\x01
+>0x40A2	string	\x4C\x00\x40 EldOS Corporation SolidFS, 16KiB page size
+
+# 32 kibibyte page size
+0x0	string	\x0F\x00\x4e\x57\x20
+>0x8000	string	\x4e\x57\x00\x00\x01
+>0x80A2	string	\x4C\x00\x40 EldOS Corporation SolidFS, 32KiB page size
+
+# 64 kibibyte page size
+0x0		string	\x10\x00\x4e\x57\x20
+>0x10000	string	\x4e\x57\x00\x00\x01
+>0x100A2	string	\x4C\x00\x40 EldOS Corporation SolidFS, 64KiB page size

magic/Magdir/firmware

@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: firmware,v 1.7 2023/03/11 18:52:03 christos Exp $
+# $File: firmware,v 1.13 2024/09/04 19:04:03 christos Exp $
 # firmware:  file(1) magic for firmware files
 #
 
@@ -111,11 +111,20 @@
 
 # ESP-IDF application image
 # From: Alexandre Iooss <erdnaxe@crans.org>
+# Update:	Joerg Jenderek
 # URL: https://github.com/espressif/esp-idf/blob/v5.0/components/bootloader_support/include/esp_app_format.h
+# Reference:	https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-reference/system/app_image_format.html
 # Note: Concatenation of esp_image_header_t, esp_image_segment_header_t and esp_app_desc_t
 # 	First segment contains esp_app_desc_t
+# ESP_IMAGE_HEADER_MAGIC at the beginning of esp_image_header_t structure
 0	ubyte		0xE9
+# display ESP-IDF application image (strength=40=40+0) before DOS executable with 16bit JuMP (strength=40) handled by ./msdos
+#!:strength	+0
+# ESP_APP_DESC_MAGIC_WORD; magic for the esp_app_desc_t structure
 >32	ulelong		0xABCD5432	ESP-IDF application image
+#!:mime	application/octet-stream
+!:mime	application/x-espressif-bin
+!:ext	bin
 >>12	uleshort	0x0000		for ESP32
 >>12	uleshort	0x0002		for ESP32-S2
 >>12	uleshort	0x0005		for ESP32-C3
@@ -131,3 +140,138 @@
 >>>112	string/16	x		%s
 >>144	string/32	x		\b, IDF version: %s
 >>4	ulelong		x		\b, entry address: 0x%08X
+
+# AVR firmware
+# From: Alexandre Iooss <erdnaxe@crans.org>
+# URL: https://microchipdeveloper.com/8avr:int
+# Match 4-byte JMP for Reset, Int0-2, PcInt0-3 and WDT
+0		uleshort&0xFE0E	0x940C
+>4		uleshort&0xFE0E	0x940C
+>>8		uleshort&0XFE0E	0x940C
+>>>12		uleshort&0XFE0E	0x940C
+>>>>16		uleshort&0XFE0E	0x940C
+>>>>>20		uleshort&0XFE0E	0x940C
+>>>>>>24	uleshort&0XFE0E	0x940C
+>>>>>>>28	uleshort&0XFE0E	0x940C
+>>>>>>>>32	uleshort&0XFE0E	0x940C	AVR firmware
+# Handle only 16-bit addressing
+>>>>>>>>>0	uleshort	0x940C
+>>>>>>>>>>2	uleshort	x	\b, reset at 0x%04x
+# Match 2-byte RJMP for Reset, Int0-2, PcInt0-3 and WDT for smaller AVR
+1		byte&0xF0	0xC0
+>3		byte&0xF0	0xC0
+>>5		byte&0xF0	0xC0
+>>>7		byte&0xF0	0xC0
+>>>>9		byte&0xF0	0xC0
+>>>>>11		byte&0xF0	0xC0
+>>>>>>13	byte&0xF0	0xC0
+>>>>>>>15	byte&0xF0	0xC0
+>>>>>>>>17	byte&0xF0	0xC0	AVR firmware
+>>>>>>>>>0	uleshort&0x0FFF	x	\b, reset at 0x%04x
+
+# Summary:	Intel HEXadecimal file format
+# URL:		https://en.wikipedia.org/wiki/Intel_HEX
+# Reference:	http://www.piclist.com/techref/fileext/hex/intel.htm
+#		http://mark0.net/download/triddefs_xml.7z/defs/h/hex-intel.trid.xml
+# From:		Joerg Jenderek
+# Note:		called "Intel Hexadecimal object format" by TrID, "Intel® hexadecimal object file" on Linux
+#		and "Intel HEX binary data" by Notepad++
+# look for start code; 1 character, an ASCII colon ':'; all characters preceding this symbol should be ignored
+0	ubyte		0x3A
+# check for valid record type string with range 00 - 05 (3030h - 3035h)
+>&6	ubeshort&0xFFf8	=0x3030
+# check for valid record length string like: 02 04 08 10h 20h 03 (usbdload.hex usbdldv2.hex from Windows Vista)
+#>>1	string		x		LENGTH_STRING=%0.2s
+#>>1	ubeshort	x		LENGTH=%#4.4x
+>>&-8	ubeshort&0xFCf0	=0x3030
+>>>0	use		intel-hex
+#	display information (offset, record length and type) of Intel HEX
+0	name		intel-hex
+# RECORD MARK
+>0	ubyte		x		Intel hexadecimal object
+#!:mime	text/plain
+!:mime	text/x-hex
+!:ext	hex
+# no samples with other suffix found
+# .hex .mcs .int .ihex .ihe .ihx .h80 .h86 .a43 .a90 .obj .obl .obh .rom .eep
+# .hxl-.hxh .h00-.h15 .p00-.pff
+# RECLEN; 2 hex digits for number of bytes in 1st data field; like 0x02 0x03 0x04 0x08 0x10 0x20; maximum 255
+>1	string		x		\b, 0x%2.2s record length
+# OFFSET; 4 hex digits for 1st 16-bit memory offset of data like: 0000 (often) 1C00h 1E00h 3800h 3E00h 76EDh 7800h 7E00h ...
+>3	string		x		\b, 0x%4.4s offset
+# RECTYP; 2 hex digits (00 - 05); meaning of 1st data field; 00~DataRecord (often) 0l~EndOfFileRecord 02~ExtendedSegmentAddressRecord 03~StartSegmentAddressRecord 04~ExtendedLinearAddressRecord 05~StartLinearAddressRecord
+>7	string		x		\b, '%2.2s' type
+# DATA; n bytes of 1st data represented by 2n hex digits followed by 1 byte checksum
+>9	string		x		\b, data+checksum %s
+# last record :00000001FF with RECLEN 0, OFFSET 0, record type 01 for EndOfFile and 1 checksum byte FF
+# samples with CarriageReturnLineFeed terminator
+>-2	ubeshort	=0x0d0a
+# This should not happen!
+>>-13	string		!:00000001FF	\b, last line %s
+>-2	ubeshort	!0x0d0a
+# samples with LineFeed terminator
+>>-1	ubyte		=0x0a
+# This should not happen!
+>>>-12	string		!:00000001FF	\b, last line %s
+
+# Raspberry Pi RP2040 firmware
+# From: Alexandre Iooss <erdnaxe@crans.org>
+# Note: RP2040 flash image starts with stage2 bootloader, then a vector table.
+# URL: https://github.com/raspberrypi/pico-sdk/tree/1.5.1/src/rp2_common/boot_stage2
+# boot2_*.S code (_stage2_boot)
+0		ulelong			0x4B32B500
+>4		ulelong			0x60582021
+>>8		ulelong			0x21026898
+# exit_from_boot2.S code (check_return) `pop {r0}; cmp r0, #0`
+>>>148		ulelong			0x2800bc01
+# Cortex-M vector table with reserved section filled with a default interrupt address
+>>>>259		byte			0x20
+# make sure required vector table entries are ARM Thumb and in flash
+>>>>>260	ulelong&0xE0000001	1
+>>>>>>264	ulelong&0xE0000001	1
+>>>>>>>268	ulelong&0xE0000001	1
+>>>>>>>>300	ulelong&0xE0000001	1
+>>>>>>>>>312	ulelong&0xE0000001	1		Raspberry Pi RP2040 firmware
+>>>>>>>>>>256	ulelong			>0		\b, initial SP at 0x%08x
+>>>>>>>>>>260	ulelong^1		x		\b, reset at 0x%08x
+>>>>>>>>>>264	ulelong^1		x		\b, NMI at 0x%08x
+>>>>>>>>>>268	ulelong^1		x		\b, HardFault at 0x%08x
+>>>>>>>>>>300	ulelong^1		x		\b, SVCall at 0x%08x
+>>>>>>>>>>312	ulelong^1		x		\b, PendSV at 0x%08x
+# optional binary_info in the first 256 bytes, used by picotool
+# https://github.com/raspberrypi/pico-sdk/blob/master/src/common/pico_binary_info/include/pico/binary_info/defs.h
+>>>>>>>>>>256	search/256		\xf2\xeb\x88\x71	\b, with binary_info
+
+# Silicon Labs Gecko Bootloader update image
+# From: Alexandre Iooss <erdnaxe@crans.org>
+# Reference: https://github.com/raboof/gbl
+#            https://github.com/dsyx/emberznet-doc
+# Note: TLV always starting with tag 0x03A617EB of length 8
+0	ulelong		0x03A617EB
+>4	ulelong		8		Silicon Labs Gecko bootloader update image
+!:ext	gbl
+>>12	byte		1		\b, encrypted (AES-CTR-128)
+>>13	byte		1		\b, signed (ECDSA-P256)
+# If not encrypted, indicate first image type
+>>16	ulelong		0xF40A0AF4	\b, application image
+>>16	ulelong		0xF50909F5	\b, bootloader image
+
+# Silicon Labs Gecko Bootloader OTA update with Zigbee EmberZNet SDK
+# URL: https://github.com/SiliconLabs/gecko_sdk
+0	ulelong		0x0BEEF11E
+>6	ulelong		0x38		Silicon Labs Gecko EmberZNet OTA image
+!:ext	ota/zigbee
+>>4	ubeshort	x		v%d
+
+# Device Firmware Upgrade with ST STMicroelectronics extensions
+# From: Alexandre Iooss <erdnaxe@crans.org>
+# Reference: STMicroelectronics note UM0391
+# Reference: https://dfu-util.sourceforge.net/dfuse.html
+# DFU prefix
+0	string		DfuSe\x01	DFU image (STM variant)
+!:ext	dfu
+>6	ulelong		x		\b, size: %d bytes
+# DFU suffix, specification 0x011A
+>-10	string		\x1A\x01UFD
+>>-12	uleshort	x		\b, for device %04X:
+>>-14	uleshort	x		\b%04X

magic/Magdir/fonts

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: fonts,v 1.51 2022/08/16 11:16:39 christos Exp $
+# $File: fonts,v 1.52 2024/11/09 23:52:53 christos Exp $
 # fonts:  file(1) magic for font data
 #
 0	search/1	FONT		ASCII vfont text
@@ -447,3 +447,37 @@
 #>20	belong		x	\b, totalCompressedSize %d
 >24	beshort		x	\b, version %d
 >26	beshort		x	\b.%d
+
+### fontconfig cache files
+
+# fontconfig cache files: little-endian
+0	name		fc-cache-le
+# size is at offset 8, and is intptr_t
+# hence, if offset 12 is zero, this is likely 64-bit
+# NOTE: cannot determine double alignment here
+>12	ulelong		0	le64
+>12	ulelong		!0	le32
+# version number
+>4	lelong		x	\b-%d
+
+# fontconfig cache files: big-endian
+0	name		fc-cache-be
+# size is at offset 8, and is intptr_t
+# hence, if offset 12 is zero, this is likely 64-bit
+# NOTE: cannot determine double alignment here
+>12	ubelong		0	be64
+>12	ubelong		!0	be32
+# version number
+>4	belong		x	\b-%d
+
+# fontconfig cache files
+# https://gitlab.freedesktop.org/fontconfig/fontconfig
+# https://www.microsoft.com/typography/otspec/otff.htm
+0	ulelong		0xFC02FC04	fontconfig cache file:
+>0	use		fc-cache-le
+0	ulelong		0xFC02FC05	fontconfig cache file (mmap):
+>0	use		fc-cache-le
+0	ubelong		0xFC02FC04	fontconfig cache file:
+>0	use		fc-cache-be
+0	ubelong		0xFC02FC05	fontconfig cache file (mmap):
+>0	use		fc-cache-be

magic/Magdir/frame

@@ -1,23 +1,53 @@
 
 #------------------------------------------------------------------------------
-# $File: frame,v 1.14 2019/11/25 00:31:30 christos Exp $
+# $File: frame,v 1.19 2024/03/04 00:34:31 christos Exp $
 # frame:  file(1) magic for FrameMaker files
 #
 # This stuff came on a FrameMaker demo tape, most of which is
 # copyright, but this file is "published" as witness the following:
 #
-# Note that this is the Framemaker Maker Interchange Format, not the
-# Normal format which would be application/vnd.framemaker.
+# URL:		https://en.wikipedia.org/wiki/Adobe_FrameMaker
 #
-0	string		\<MakerFile	FrameMaker document
-!:mime	application/x-mif
->11	string		5.5		 (5.5
->11	string		5.0		 (5.0
->11	string		4.0		 (4.0
->11	string		3.0		 (3.0
->11	string		2.0		 (2.0
->11	string		1.0		 (1.0
->14	byte		x		  %c)
+# Update:	Joerg Jenderek 2024 Mar
+# URL:		http://fileformats.archiveteam.org/wiki/FrameMaker
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/f/fm.trid.xml
+# Note:		called "FrameMaker document" by TrID and "Adobe FrameMaker document" by shared MIME-info database
+# skip "text" DROID samples like: fmt-190-signature-id-840.fm fmt-533-signature-id-837.fm fmt-534-signature-id-838.fm fmt-535-signature-id-839.fm fmt-536-signature-id-841.fm
+# fmt-537-signature-id-842.fm fmt-538-signature-id-843.fm fmt-539-signature-id-844.fm x-fmt-302-signature-id-395.fm
+0	string/b	\<MakerFile	FrameMaker document
+#!:mime	application/octet-stream
+# https://www.iana.org/assignments/media-types/application/vnd.framemaker
+!:mime	application/vnd.framemaker
+# version string like 1.0 2.0 3.0 4.0 5.0 5.5 6.0 7.0 8.0 9.0 10.0
+>11	string		x		(%0.3s
+# before closing directive ">" is appended version letter like: F H J K Q Y
+>>14	ubyte		>0x40		%c
+# or last digit of 4 character version string
+>>14	ubyte		<0x41		\b%c
+# test again so that next default clause works
+>14	ubyte		x
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/h/hlp-fm.trid.xml
+# Note:		called "FrameMaker Help" by TrID
+# look for reference to FrameMaker help name suffix like in: index1.hlp
+>>18	search/9688/s	.hlp:		 \b) help
+# the internal FrameMaker help are just FrameMaker document with hlp suffix; XREF.HLP is same as Xref-hlp.fm
+!:ext	hlp
+# For control reason show link name like:
+# "Overview" "lastpage "firstpage "Add File" "Conditional Text" "Table Format" "Creating a reference frame" "firstpageCov" "Spot Colors" "Selecting text" "proceduresbl" "lastpageu" "Introducing HelpHe" "Menu of Syntax Descriptions" "Main FrameMaker window"
+#>>>&5	string		x		 LINK_NAME "%s"
+>>>&5	string		x
+# look for gotolink or openlink keyword before help file name
+>>>&-18	search/18/s	link\040
+# link construct with help name like: "gotolink xref.hlp:Overview" "openlink syntax1.hlp:firstpage"
+>>>>&-4	regex/s		=^\[A-Za-z0-9.:\040]{1,}	with "%s"
+# if not FrameMaker Help assume it is "normal" FrameMaker document
+# shown with closing parenthesis to get look like in frame,v 1.18
+>>18	default			x	\b)
+# sometimes without suffix like: CHAPTER HARVARD LETTER MEMO1 NEWSLTR REPORT3
+# no samples found with .bk or .book extension
+# allchaps.ix (Framemaker Index) and others like:
+# title.fm4 wp.filt textre1.htr pmscript.ind change.nbh books.prd executiv.sum Hyper.Template
+!:ext	/fm/doc/toc/ix
 # URL:		http://fileformats.archiveteam.org/wiki/Maker_Interchange_Format
 # Reference:	https://help.adobe.com/en_US/framemaker/mifreference/mifref.pdf
 # Update:	Joerg Jenderek 2019 Nov
@@ -36,22 +66,70 @@
 # comment starting with # shows the name+version number of generating program
 >13	search/3	#
 >>&0	string		x		"%s"
+# Update:	Joerg Jenderek
+# Note:		called "Adobe FrameMaker document" by shared MIME-info database from freedesktop.org
 0	search/1	\<MakerDictionary	FrameMaker Dictionary text
-!:mime	application/x-mif
+#!:mime	text/plain
+#!:mime	application/x-mif
+!:mime	application/vnd.framemaker
+# like site.dict but often extension is a 3 letters country code like in: hyphens.brt hyphens.eng
+!:ext	dict/eng/brt
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/f/fm-hyph-dict-30.trid.xml
+# Note:		called "FrameMaker hyphens dictionary (v3.0)" by TrID
 >17	string		3.0		 (3.0)
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/f/fm-hyph-dict-20.trid.xml
+# Note:		called "FrameMaker hyphens dictionary (v2.0)" by TrID
 >17	string		2.0		 (2.0)
 >17	string		1.0		 (1.x)
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bfont.trid.xml
+# Update:	Joerg Jenderek 2023
+# Note:		called "XFrameMaker Bitmapped screen Font" by TrID and
+#		"Adobe FrameMaker font" by shared MIME-info database from freedesktop.org
 0	string		\<MakerScreenFont	FrameMaker Font file
-!:mime	application/x-mif
+#!:mime	application/octet-stream
+#!:mime	application/x-mif
+!:mime	application/x-font-framemaker
+!:ext	bfont
+# Note:		maybe also other version like: 1.x
+>17	string		!1.01
+>>17	string		x		 (%-0.4s)
 >17	string		1.01		 (%s)
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mml-fm.trid.xml
+# Update:	Joerg Jenderek 2023 Nov
+# Note:		called "FrameMaker Maker Markup Language" by TrID and
+#		"Adobe FrameMaker document" by shared MIME-info database from freedesktop.org
 0	string		\<MML		FrameMaker MML file
-!:mime	application/x-mif
-0	string		\<BookFile	FrameMaker Book file
-!:mime	application/x-mif
->10	string		3.0		 (3.0
->10	string		2.0		 (2.0
->10	string		1.0		 (1.0
->13	byte		x		  %c)
+#!:mime	text/plain
+#!:mime	application/x-mif
+!:mime	application/vnd.framemaker
+!:ext	mml
+# Note:		sometimes followed by space and version like 1.00 (formats.mml sample.mml) and more text
+>5	string		>0		 (%-0.4s)
+# URL:		http://fileformats.archiveteam.org/wiki/FrameMaker
+# Reference:	http://mark0.net/download/triddefs_xml.7z
+# 		defs/b/book-fm.trid.xml
+# 		defs/b/bk-fm.trid.xml
+# Update:	Joerg Jenderek 2023 Dez
+# Note:		called "FrameMaker book (binary)" by TrID and
+#		"Adobe FrameMaker document" by shared MIME-info database from freedesktop.org
+# look for BookFile, Bookfile (capitalized) or BOOKFILE (upcased) directive
+0	string/c	\<Bookfile	FrameMaker Book file
+#!:mime	application/octet-stream
+#!:mime	application/x-mif
+!:mime	application/vnd.framemaker
+# http://extension.nirsoft.net/book
+!:ext	bk/book
+# version like: 1.0 2.0 3.0 4.0 5.0 5.5 6.0 7.0 8.0 10.0
+# 3 characters of version number string
+>10	string		x		(%-0.3s
+# if greater sign then exact 3 byte version string
+>13	ubyte		=0x3e		\b)
+# if digit then 4 byte version string
+>13	ubyte		<0x3A		\b%c)
+# if letter then this is appended sub level after 3 byte version string
+>13	ubyte		>0x3A		%c)
+# first directive typically is followed by one space character
+>9	ubyte		!0x20		\b, no space before version
 # XXX - this book entry should be verified, if you find one, uncomment this
 #0	string		\<Book\040 	FrameMaker Book (ASCII) file
 #!:mime	application/x-mif

magic/Magdir/games

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: games,v 1.31 2023/03/29 22:57:27 christos Exp $
+# $File: games,v 1.35 2024/11/09 23:04:46 christos Exp $
 # games:  file(1) for games
 
 # Fabio Bonelli <fabiobonelli@libero.it>
@@ -32,53 +32,6 @@
 >0      string  x       , name=%s
 >44     string  x       , world=%s
 
-# Quake
-
-# Update: Joerg Jenderek
-# URL: http://fileformats.archiveteam.org/wiki/PAK
-# reference: https://quakewiki.org/wiki/.pak
-# GRR: line below is too general as it matches also Acorn PackDir compressed Archive
-# and Git pack ./revision
-0       string  PACK    
-# real Quake examples like pak0.pak have only some hundreds like 150 files
-# So test for few files
->8	ulelong <0x01000000	
-# in file version 5.32 test for null terminator is only true for
-# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h 
-# look for null terminator of 1st entry name
->>(4.l+55)	ubyte	0	Quake I or II world or extension
-!:mime	application/x-dzip
-!:ext	pak
-#>>>8	ulelong	x	\b, table size %u
-# dividing this by entry size (64) gives number of files
->>>8	ulelong/64 x	\b, %u files
-# offset to the beginning of the file table
->>>4	ulelong	x	\b, offset %#x
-# 1st file entry
->>>(4.l)	use	pak-entry
-# 2nd file entry
-#>>>4	ulelong+64	x	\b, offset %#x
-#>>>(4.l+64)	use	pak-entry
-#
-#	display file table entry of Quake PAK archive
-0	name		pak-entry
-# normally entry start after header which implies offset 12 or higher
->56	ulelong	>11	
-# the offset from the beginning of pak to beginning of this entry file contents
->>56	ulelong	x	at %#x
-# the size of file for this entry 
->>60	ulelong	x	%u bytes
-# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp
->>0	string	x	'%-.56s'
-# inspect entry content by jumping to entry offset
->>(56)	indirect x	\b: 
-
-#0       string  -1\x0a  Quake I demo
-#>30     string  x        version %.4s
-#>61     string  x        level %s
-
-#0       string  5\x0a   Quake I save
-
 # The levels
 
 # Quake 1
@@ -186,12 +139,12 @@
 
 # MAME input recordings
 
-0	string	MAMEINP\0		MAME input recording
->8	leqdate	x			at %s,
->16	leshort	x			format version %d.
->18	leshort	x			\b%d,
->20	string	x			%s driver,
->32	string	x			%s
+0	string		MAMEINP\0		MAME input recording
+>8	leqdate		x			at %s,
+>16	leshort		x			format version %d.
+>18	leshort		x			\b%d,
+>20	string/12	x			%s driver,
+>32	string/32	x			%s
 
 # doom - submitted by Jon Dowland
 
@@ -694,3 +647,20 @@
 # Big-endian version (such as PS3)
 >8	ubelong	<0x100	Wwise Audio Package (big-endian)
 !:ext	pck
+
+# RPG Maker MV/MZ encrypted assets. Version was only ever known to be 00030100.
+0	string	RPGMV\0\0\0
+>12	string	\0\0\0\0
+>>8	belong	x		RPG Maker MV encrypted asset, version %08x
+!:ext	png_/ogg_/m4a_/rpgmvp/rpgmvo/rpgmvm
+
+# https://arthran2.itch.io/encrypterator-3000
+0	string	ART\0ENCRYPTER100FREE\0VERSION\0\0\0\0	RPG Maker MV encrypted asset, Encrypterator 3000 variant.
+!:ext	png_/ogg_/m4a_/rpgmvp/rpgmvo/rpgmvm
+
+
+# http://www.shikadi.net/moddingwiki/PCX_Library
+0	string/b	pcxLib\0
+>122	ubyte		0x01	pcxLib archive
+>>144	uleshort	0	\b, uncompressed
+>>144	uleshort	!0	\b, compressed

magic/Magdir/gentoo

@@ -1,34 +1,34 @@
 #------------------------------------------------------------------------------
-# $File: gentoo,v 1.5 2022/12/26 17:16:55 christos Exp $
+# $File: gentoo,v 1.6 2024/02/11 15:39:59 christos Exp $
 # gentoo:  file(1) magic for gentoo specific formats
 #
 # Summary: Gentoo ebuild Manifest files (GLEP 74)
 # Reference: https://www.gentoo.org/glep/glep-0074.html
 # Submitted by: Michal Gorny <mgorny@gentoo.org>
 # Start by doing a fast check for the most common tags.
-0	string	AUX
+0	string	AUX\040
 >0	use	gentoo-manifest
-0	string	DATA
+0	string	DATA\040
 >0	use	gentoo-manifest
-0	string	DIST
+0	string	DIST\040
 >0	use	gentoo-manifest
-0	string	EBUILD
+0	string	EBUILD\040
 >0	use	gentoo-manifest
-0	string	MANIFEST
+0	string	MANIFEST\040
 >0	use	gentoo-manifest
 
 # Manifest can be PGP-signed.
 0	string	-----BEGIN\040PGP\040SIGNED\040MESSAGE-----
 >34	search/32	\n\n
->>&0	string	AUX
+>>&0	string	AUX\040
 >>>&0	use	gentoo-manifest
->>&0	string	DATA
+>>&0	string	DATA\040
 >>>&0	use	gentoo-manifest
->>&0	string	DIST
+>>&0	string	DIST\040
 >>>&0	use	gentoo-manifest
->>&0	string	EBUILD
+>>&0	string	EBUILD\040
 >>>&0	use	gentoo-manifest
->>&0	string	MANIFEST
+>>&0	string	MANIFEST\040
 >>>&0	use	gentoo-manifest
 
 # Use a more detailed regex to verify that we were correct.

magic/Magdir/geo

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: geo,v 1.10 2022/10/31 13:22:26 christos Exp $
+# $File: geo,v 1.11 2024/11/09 23:35:01 christos Exp $
 # Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
 
 ######################################################################
@@ -164,3 +164,7 @@
 # alex myczko <alex@aiei.ch>
 # http://pointclouds.org/documentation/tutorials/pcd_file_format.php
 0	string		#\ .PCD	Point Cloud Data
+
+# FlatGeobuf is a GIS file format for encoding geographic data.
+# https://flatgeobuf.org/#specification
+0	bequad		0x6667620366676201	FlatGeobuf file

magic/Magdir/geos

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
+# $File: geos,v 1.5 2024/04/07 17:56:40 christos Exp $
 # GEOS files (Vidar Madsen, vidar@gimp.org)
 # semi-commonly used in embedded and handheld systems.
 0	belong	0xc745c153	GEOS
@@ -18,3 +18,12 @@
 #>52	short	x	\b, proto %d
 #>54	short	x	\br%d
 #>168	string	>\0	\b, copyright "%s"
+
+30	string	PRG\ formatted\ GEOS\ file	Formatted GEOS file
+>22	byte	6	\b, APPLICATION
+>22	byte	14	\b, AUTO_EXEC
+>22	byte	5	\b, DESK_ACC
+>22	byte	2	\b, ASSEMBLY
+>22	byte	11	\b, DISK_DEVICE
+>22	byte	9	\b, PRINTER
+>22	byte	4	\b, SYSTEM

magic/Magdir/hitachi-sh

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: hitachi-sh,v 1.10 2020/12/12 20:01:47 christos Exp $
+# $File: hitachi-sh,v 1.11 2024/02/18 14:15:22 christos Exp $
 # hitach-sh: file(1) magic for Hitachi Super-H
 #
 # Super-H COFF
@@ -28,3 +28,19 @@
 >>0	use				display-coff
 !:strength -10
 
+# Hitachi SH COFF object file
+0	leshort		0x01a2
+>16	leshort		0
+>>0	use		display-coff
+0	leshort		0x01a3
+>16	leshort		0
+>>0	use		display-coff
+0	leshort		0x01a4
+>16	leshort		0
+>>0	use		display-coff
+0	leshort		0x01a6
+>16	leshort		0
+>>0	use		display-coff
+0	leshort		0x01a8
+>16	leshort		0
+>>0	use		display-coff

magic/Magdir/hp

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: hp,v 1.25 2019/01/13 00:32:38 christos Exp $
+# $File: hp,v 1.27 2024/08/27 18:50:57 christos Exp $
 # hp:  file(1) magic for Hewlett Packard machines (see also "printer")
 #
 # XXX - somebody should figure out whether any byte order needs to be
@@ -261,25 +261,6 @@
 >7	string		J		(ASCII Vector specification)
 >7	string		K		(wildcard)
 
-# Summary: HP-38/39 calculator
-# Created by: Samuel Thibault <samuel.thibault@ens-lyon.org>
-0	string		HP3
->3	string		8		HP 38
->3	string		9		HP 39
->4	string		Bin		binary
->4	string		Asc		ASCII
->7	string		A		(Directory List)
->7	string		B		(Zaplet)
->7	string		C		(Note)
->7	string		D		(Program)
->7	string		E		(Variable)
->7	string		F		(List)
->7	string		G		(Matrix)
->7	string		H		(Library)
->7	string		I		(Target List)
->7	string		J		(ASCII Vector specification)
->7	string		K		(wildcard)
-
 # hpBSD magic numbers
 0	beshort		200		hp200 (68010) BSD
 >2	beshort		0407		impure binary
@@ -430,4 +411,8 @@
 >>>>>>>>>0xC4	belong	33		- received SIGXCPU
 >>>>>>>>>0xC4	belong	34		- received SIGXFSZ
 
+# PA-RISC COFF object file
+0	leshort		0x0290
+>16	leshort		0
+>>0	use		display-coff
 

magic/Magdir/ibm370

@@ -1,10 +1,10 @@
 
 #------------------------------------------------------------------------------
-# $File: ibm370,v 1.11 2021/03/14 16:51:45 christos Exp $
+# $File: ibm370,v 1.13 2024/06/19 16:52:57 christos Exp $
 # ibm370:  file(1) magic for IBM 370 and compatibles.
 #
 # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
-# What the heck *is* "USS/370"?
+# "USS/370" is an old name for the z/OS Unix subsystem
 # AIX 4.1's "/etc/magic" has
 #
 #	0	short		0535		370 sysV executable
@@ -48,5 +48,11 @@
 >24	belong		>0		- version %d
 
 # NETDATA (https://en.wikipedia.org/wiki/NETDATA)
-#	-\INMR01 In EBCDIC
-0	string 		\x60\xe0\xc9\xd5\xd4\xd9\xf0\xf1	IBM NETDATA file
+# INMR01 In EBCDIC starting at offset 2
+2	string		\xc9\xd5\xd4\xd9\xf0\xf1	IBM NETDATA file
+
+# z/OS Program Object executable
+# Starts with "IEWPLMH" in EBCDIC, followed by a single EBCDIC space to pad
+# to 8 bytes. According to https://www.ibm.com/support/pages/apar/PK91585
+# IEWPLMH is eyecatcher for "Binder Program Load Module Header" control block
+0	string   	\xc9\xc5\xe6\xd7\xd3\xd4\xc8\x40	z/OS Program Object executable

magic/Magdir/ibm6000

@@ -1,10 +1,13 @@
 
 #------------------------------------------------------------------------------
-# $File: ibm6000,v 1.15 2021/07/03 14:01:46 christos Exp $
+# $File: ibm6000,v 1.16 2024/03/31 15:06:56 christos Exp $
 # ibm6000:  file(1) magic for RS/6000 and the RT PC.
 #
-0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
->12	belong		>0		not stripped
+# Update:	Joerg Jenderek
+#0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
+0	beshort		0x01df
+# use subroutine (./coff) to display name+flags+variables for common object formatted files
+>0	use				\^display-coff
 # Breaks sun4 statically linked execs.
 #0      beshort		0x0103		executable (RT Version 2) or obj module
 #>2	byte		0x50		pure

magic/Magdir/iff

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: iff,v 1.18 2022/03/21 19:57:18 christos Exp $
+# $File: iff,v 1.20 2024/02/09 00:44:31 christos Exp $
 # iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
 #
 # Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
@@ -10,11 +10,25 @@
 # IFF files begin with an 8 byte FORM header, followed by a 4 character
 # FORM type, which is followed by the first chunk in the FORM.
 
+# URL:		http://fileformats.archiveteam.org/wiki/IFF
+#		https://en.wikipedia.org/wiki/Interchange_File_Format
+# Reference:	https://wiki.amigaos.net/wiki/IFF_FORM_and_Chunk_Registry
+# Note:		called "Interchange File" by DROID via PUID x-fmt/157 and
+#		"IFF file" or as alias expanded "Interchange File Format" by shared MIME-info database from freedesktop.org
 0	string		FORM		IFF data
 #>4	belong		x		\b, FORM is %d bytes long
 # audio formats
+# Update:	Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/AIFF
+#		https://en.wikipedia.org/wiki/Audio_Interchange_File_Format
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/a/audio-aiff.trid.xml
+# Note:		called "AIFF Audio Interchange File Format" by TrID and
+#		"Audio Interchange File Format" by DROID via PUID fmt/414
 >8	string		AIFF		\b, AIFF audio
 !:mime	audio/x-aiff
+# not officially registered
+#!:mime	audio/aiff
+!:ext	aiff/aif/aff
 >8	string		AIFC		\b, AIFF-C compressed audio
 !:mime	audio/x-aiff
 >8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
@@ -51,7 +65,14 @@
 >8	string		CTLG		\b, CTLG message catalog
 >8	string		PREF		\b, PREF preferences
 >8	string		DTYP		\b, DTYP datatype description
+# Update:	Joerg Jenderek
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/i/iff-pch.trid.xml
+# Note:		called "IFF binary Patch" by TrID
 >8	string		PTCH		\b, PTCH binary patch
+#!:mime		application/octet-stream
+#!:mime		application/x-iff
+#!:mime		application/x-amiga-patch
+!:ext		patch/pch
 >8	string		AMFF		\b, AMFF AmigaMetaFile format
 >8	string		WZRD		\b, WZRD StormWIZARD resource
 >8	string		DOC\040		\b, DOC desktop publishing document

magic/Magdir/images

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: images,v 1.243 2023/07/17 16:49:09 christos Exp $
+# $File: images,v 1.263 2024/11/10 20:44:30 christos Exp $
 # images:  file(1) magic for image formats (see also "iff", and "c-lang" for
 # XPM bitmaps)
 #
@@ -13,8 +13,10 @@
 # Targa - matches `povray', `ppmtotga' and `xv' outputs
 # by Philippe De Muyter <phdm@macqel.be>
 # URL: http://justsolve.archiveteam.org/wiki/TGA
+#      https://en.wikipedia.org/wiki/Truevision_TGA
 # Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf
-# Update: Joerg Jenderek
+# Update: Joerg Jenderek February 2024
+# Note:		called by DROID "Truevision TGA Bitmap" version 1.0 via PUID x-fmt/367
 # at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
 #	,32 or 33 (both not observed)
 # at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
@@ -27,6 +29,8 @@
 # and Image Type 1 2 3 9 10 11 32 33
 # and Color Map Entry Size 0 15 16 24 32
 0	ubequad&0x00FeC400000000C0	0
+# Targa image data (strength=70=110-40) before some Commodore disc image (strength=70=70+0 ./c64) like Cabal+2-MarioSoft(1).d64
+# and some MMDF mailbox (strength=70=70+0 ./mmdf) like uupc.input.1
 # Conflict with MPEG sequences.
 !:strength -40
 # Prevent conflicts with CRI ADX.
@@ -42,7 +46,10 @@
 >>>>17	ubyte&0x0F		!11
 # skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32
 >>>>>16	ubyte			1
->>>>>>0		use		tga-image
+# skip few Commodore D64 disc image like "The Great Gianna Sisters.d64" and 
+# few MMDF mailbox like uupc.input.1 with unlikely black&white, dimension 0101h x 0101h (257x257) and +0101h origin (+257 +257)
+>>>>>>8	quad			!0x0101010101010101
+>>>>>>>0	use		tga-image
 >>>>>16	ubyte			8
 >>>>>>0		use		tga-image
 >>>>>16	ubyte			15
@@ -57,9 +64,11 @@
 0	name				tga-image
 >2	ubyte		<34		Targa image data
 !:mime	image/x-tga
+# Apple Uniform Type Identifier:	com.truevision.tga-image
 !:apple	????TPIC
 # normal extension .tga but some Truevision products used others:
 # tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that)
+# afi bpx
 !:ext	tga/tpic/icb/vda/vst
 # image type 1 2 3 9 10 11 32 33
 >2	ubyte&0xF7	1		- Map
@@ -110,6 +119,7 @@
 # positive length implies identification field
 >0	ubyte		>0
 >>18	string		x		"%s"
+# Note:		called by DROID "Truevision TGA Bitmap" version 2.0 via fmt/402
 # last 18 bytes of newer tga file footer signature
 >18	search/4261301/s	TRUEVISION-XFILE.\0
 # extension area offset if not 0
@@ -327,17 +337,21 @@
 # NewSubFileType
 >0	uleshort	0xfe
 >>12	use		tiff_entry
+# Width
 >0	uleshort	0x100
 >>4	ulelong		1
->>>12	use		tiff_entry
 >>>8	uleshort	x		\b, width=%d
+>>>12	use		tiff_entry
+# Height
 >0	uleshort	0x101
 >>4	ulelong		1
 >>>8	uleshort	x		\b, height=%d
 >>>12	use		tiff_entry
+# BPS
 >0	uleshort	0x102
 >>8	uleshort	x		\b, bps=%d
 >>12	use		tiff_entry
+# Compression
 >0	uleshort	0x103
 >>4	ulelong		1		\b, compression=
 >>>8	uleshort	1		\bnone
@@ -365,6 +379,7 @@
 >>>8	default		x
 >>>>8	uleshort	x		\b(unknown %#x)
 >>>12	use		tiff_entry
+# Photometric Interpretation
 >0	uleshort	0x106		\b, PhotometricInterpretation=
 >>8	clear		x
 >>8	uleshort	0		\bWhiteIsZero
@@ -460,10 +475,8 @@
 # GPS IFD
 >0	uleshort	0x8825		\b, GPS-Data
 >>12	use		tiff_entry
-
 #>0	uleshort	x		\b, unknown=%#x
 #>>12	use		tiff_entry
-
 0	string		MM\x00\x2b	Big TIFF image data, big-endian
 !:mime	image/tiff
 0	string		II\x2b\x00	Big TIFF image data, little-endian
@@ -496,6 +509,12 @@
 !:ext   png
 !:strength +10
 >16	use		png-ihdr
+>33	string		\x00\x00\x00\x08acTL	\b, animated
+>>41	ubelong		1			(%d frame
+>>41	ubelong		>1			(%d frames
+>>45	ubelong		0			\b, infinite repetitions)
+>>45	ubelong		1			\b, %d repetition)
+>>45	ubelong		>1			\b, %d repetitions)
 
 # Apple CgBI PNG image.
 0	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
@@ -544,6 +563,23 @@
 #>10	ubyte&0x07	=0x06		128 colors
 #>10	ubyte&0x07	=0x07		256 colors
 
+# URL:		http://fileformats.archiveteam.org/wiki/Jeff%27s_Image_Format
+#		http://web.archive.org/web/20010603113404/http://jeff.cafe.net/jif
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jif.trid.xml
+#		https://www.nationalarchives.gov.uk/PRONOM/fmt/994
+# From:		Joerg Jenderek
+# Note:		nearly identical to GIF, except that it uses zlib compression instead of LZW
+#		called by TrID "Jeff's Image Format bitmap" and "Jeffs Image Format" by DROID via fmt/994
+#		verfied by XnView `nconvert -fullinfo *.jif` as "Jeff's Image Format"
+0	string		JIF99a		Jeffs Image Format data
+!:mime	image/x-jif
+# http://extension.nirsoft.net/jif
+#!:mime	image/jif
+!:apple	????JIFf
+!:ext	jif
+>6	uleshort	x		%u x
+>8	uleshort	x		%u
+
 # ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
 # 1 plane, no encoding.
 0	string		\361\0\100\273	CMU window manager raster image data
@@ -1171,6 +1207,22 @@
 #>>(10.l) ubequad	!0	\b, bits %#16.16llx
 # dib header size: 12~Ch~OS/2 1.x 64~40h~OS/2 2.x
 #>>14	ulelong		x		\b, dib header size %u
+# Type: Vision Research Phantom CINE Format
+# URL: https://www.phantomhighspeed.com/
+# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk
+# From: Harry Mallon <hjmallon at gmail.com>
+#
+# This has a short "CI" code but the 44 is the size of the struct which is
+# stable
+>2	uleshort 44		Vision Research CINE Video,
+>>4	uleshort	0		Grayscale,
+>>4	uleshort 1		JPEG Compressed,
+>>4	uleshort 2		RAW,
+>>6	uleshort x		version %d,
+>>20	ulelong	x		%d frames,
+>>48	ulelong	x		%dx
+>>52	ulelong	x		\b%d
+
 # Conflicts with other entries [BABYL]
 # URL:	http://fileformats.archiveteam.org/wiki/BMP#OS.2F2_Bitmap_Array
 # Note:	container for OS/2 icon "IC", color icon "CI", color pointer "CP" or bitmap "BM"
@@ -1296,20 +1348,75 @@
 
 # SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
 #
-# See
-#	http://reality.sgi.com/grafica/sgiimage.html
-#
-0	ubeshort		474		SGI image data
-#>2	ubyte		0		\b, verbatim
->2	ubyte		1		\b, RLE
-#>3	ubyte		1		\b, normal precision
->3	ubyte		2		\b, high precision
->4	ubeshort	x		\b, %d-D
->6	ubeshort	x		\b, %d x
->8	ubeshort	x		%d
->10	ubeshort	x		\b, %d channel
->10	ubeshort	!1		\bs
->80	string		>0		\b, "%s"
+# Update:	Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/SGI_(image_file_format)
+#		https://en.wikipedia.org/wiki/Silicon_Graphics_Image
+# Reference:	https://paulbourke.net/dataformats/sgirgb/sgiversion.html
+#		http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-sgi.trid.xml
+# Note:		called "Silicon Graphics bitmap (generic)" by TrID,
+#		"Silicon Graphics Image" by DROID via PUID x-fmt/140 and shared MIME-info database from freedesktop.org,
+#		verfied by ImageMagick `identify -verbose *.sgi` as SGI (Irix RGB image) and
+#		verfied by XnView `nconvert -in sgi -info *.sgi` as SGI RGB
+# look for magic number (integer 474=0x01DA) + storage format (0 or 1) + number of bytes per pixel channel (1 or 2) 
+# to skip few TeX font metric data (like pxmi.tfm pxmi1.tfm eksfi8a.tfm ./tex) with invalid "high" bytes/pixel (11 12)
+0	ubelong&0xFFffFEfc	0x01da0000
+# skip DROID x-fmt-140-signature-id-623.bw with invalid "low" dimensions "0 x 0"
+>6	long			!0		SGI image data
+#!:mime	image/sgi
+!:mime	image/x-sgi
+!:apple	????.SGI
+# STORAGE format; allowed values 0~VERBATIM 1~RLE 
+#>>2	ubyte		0		\b, verbatim
+>>2	ubyte		1		\b, RLE
+#>>2	ubyte		>1		STORAGE=%#x
+# BPC; number of bytes per pixel component; allowed values 1 2
+#>>3	ubyte		1		\b, normal precision
+>>3	ubyte		2		\b, high precision
+#>>3	ubyte		x		BPC=%#x
+# DIMENSION; allowed values are 1~scanline 2~XSIZExYSIZE 3~XSIZExYSIZExZSIZE
+>>4	ubeshort	x		\b, %d-D
+# XSIZE; width of image in pixels
+>>6	ubeshort	x		\b, %d x
+# YSIZE; height of image in pixels
+>>8	ubeshort	x		%d
+# ZSIZE; number of channels in image; 1~B/W (greyscale) 3~RGB 4~RGB+ALPHA channel
+>>10	ubeshort	x		\b, %d
+# GRR: avoid
+# Magdir\images, 1347: Warning: Current entry does not yet have a description for adding a EXTENSION type
+>>>10	ubeshort	1		channel
+# GRR: exception https://sembiance.com/fileFormatSamples/image/sgi/greytest.rgb
+!:ext	bw
+# no examples found with .int suffix
+#!:ext	bw/int
+# no examples found with .inta suffix for black/white+ALPHA channel
+# no examples found with 2 channels
+#>>>10	ubeshort	2		channels
+#!:ext	sgi
+>>>10	ubeshort	3		channels
+!:ext	rgb/sgi
+>>>10	ubeshort	4		channels
+!:ext	rgba/sgi
+>>>10	default		x		channels
+# no examples found with 5 and more channels
+!:ext	sgi
+# IMAGENAME; null terminated ascii string of up to 79 characters
+>>24	string		>\0		\b, "%0.80s"
+# PINMIN; minimum pixel value in the image; often 0
+>>12	ubelong		!0		\b, %u PINMIN
+# PINMAX; maximum pixel value in the image; often 255
+>>16	ubelong		!255		\b, %u PINMAX
+# DUMMY; 4 bytes of data should be set to 0
+>>20	ubelong		!0		\b, at 20 %#x
+# COLORMAP; 0~normal 1~DITHEREDobsolete 2~SCREENobsolete 3~COLORMAP
+>>104	ubelong		!0		\b, %u COLORMAP
+# DUMMY; 404 bytes should be set to 0 but not always true; makes header exactly 512 bytes
+>>111	ubyte		!0		\b, at 111 %#x
+>>113	ubyte		!0		\b, at 113 %#x
+>>118	ubeshort	!0		\b, at 118 %#4.4x
+>>121	ubyte		!0		\b, at 121 %#x
+>>132	ubelong		!0		\b, at 132 %#8.8x
+>>135	ubyte		!0		\b, at 135 %#x
+>>137	ubequad		!0		\b, at 137 %#16.16llx
 
 0	string		IT01		FIT image data
 >4	ubelong		x		\b, %d x
@@ -1329,17 +1436,95 @@
 0	string		PCD_OPA		Kodak Photo CD overview pack file
 
 # FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
+# Update:	Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/Flexible_Image_Transport_System
+#		https://en.wikipedia.org/wiki/FITS
+# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-fts.trid.xml
+# Note:		called "Flexible Image Transport System bitmap" by TrID, GIMP and DROID via PUID x-fmt/383
+#		"FITS document" with expanded acronym "Flexible Image Transport System" by shared MIME-info database from freedesktop.org
+#		verified as "Flexible Image Transport System" by XnView `nconvert -fullinfo M57.FIT MOON.FTS` ,
+#		as "FTS (Flexible Image Transport System)" by ImageMagick command `identify MOON.FTS` ,
+#		by NetPBM `fitstopnm M57.FIT | file` ,
+#		falsified by `fitsverify M57.FIT MOON.FTS`
 # FITS is the Flexible Image Transport System, the de facto standard for
 # data and image transfer, storage, etc., for the astronomical community.
 # (FITS floating point formats are big-endian.)
-0	string	SIMPLE\ \ =	FITS image data
+# keyword is a 1- to 8-character, left-justified ASCII string; columns that do not contain data are filled with spaces
+# The assignment indicator (=) always occupies columns nine and ten in the card
+0	string	SIMPLE\ \ =
+# skip DROID x-fmt-383-signature-id-57.fits by check for left padding spaces of 2nd card value
+>89	ubeshort	=0x2020	FITS image
+# URL:		https://heasarc.gsfc.nasa.gov/fitsio/fpack/
+# Reference:	https://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-fz.trid.xml
+#		https://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/docs/fpackguide.pdf
+# Note:		called "Flexible Image Transport System bitmap (compressed)" by TrID
+>>240	search/0x4790/b	ZCMPTYPE=	data, compression type
+# fz suffix for compressed fits
+!:ext	fz
+# Flexible Image Transport System compression value (followed by optional FITS comment) like: NOCOMPRESS GZIP_1 GZIP_2 HCOMPRESS_1 PLIO_1 RICE_1
+#>>>&0	string		x		COMPRESSION=%0.13s
+>>>&0	regex		[A-Z_1-2]{4,11}	%s
+# not compressed Flexible Image Transport System with other filename suffix
+>>240	default		x		data
+!:ext	fits/fit/fts
+# five keywords that are required in every FITS file: SIMPLE, BITPIX, NAXIS, NAXISn, and END. EXTEND is also a required keyword if extensions are present in the file
+# required keyword in standard on 3rd card contains integer number of bits used to represent each data value but in 2nd card for M57.FIT
+>>80	search/81/b	BITPIX\040\040=
+#>>>&11	string	x		BIT=%-0.18s
+# this is the number of bits per pixel for image data
+>>>&20	string	8		\b, 8-bit, character or unsigned binary integer
+# few samples with more right positioned values like: M57.FIT
+# GRR: avoid warning: Magdir\images, 1380: Warning: description `, 8-bit, character or unsigned binary integer (too right positioned)' truncated
+>>>&28	string	8		\b, 8-bit, character or unsigned binary integer
+>>>>0	string	x		(too right positioned)
+# few samples not right justified positioned like: MOON.FTS
+>>>&11	string	8		\b, 8-bit, character or unsigned binary integer
+>>>>0	string	x		(too left positioned)
+# according to DROID but no examples found
+#>>>&19	string	08		\b, 8-bit, character or unsigned binary integer
+#>>>&19	string	+8		\b, 8-bit, character or unsigned binary integer
+>>>&19	string	16		\b, 16-bit, two's complement binary integer
+>>>&18	string	\04032		\b, 32-bit, two's complement binary integer
+>>>&18	string	-32		\b, 32-bit, floating point, single precision
+>>>&18	string	-64		\b, 64-bit, floating point, double precision
+# second 64-bit variant like: blank.fits
+>>>&18	string	\04064		\b, 64-bit, two's complement binary integer
+# in standard number of dimensions by keyword NAXIS on 3rd card image but in few cases on 2nd card like: M57.FIT
+>>80	search/81/b	NAXIS\040\040\040=		\b,
+# before optional comment 31 ASCII charactes left padded with spaces for integer (0-999) of data axis like: 0 (extension no data) 1 (spectrum) 2 (conventional bitmap) 3 (animated bitmap example.fit test.fits) 6 (DDTSUVDATA.fits)
+#>>>>&0	string		x		NAXIS=%-0.31s
+# single digit 0 implies no data or similar
+>>>&0	search/31/b	\0400\040	0 axes
+!:mime	application/fits
+# single digit 1 implies one-dimensional entity such as a spectrum or a time series (no example found)
+>>>&-1	search/31/b	\0401\040	1 axis
+!:mime	application/fits
+#!:mime	image/fits
+# single digit 2 implies conventional bitmap
+>>>&0	search/31/b	\0402\040	2 axes
+!:mime	image/fits
+# single digit 3 implies data cubes of three dimensions (animated bitmap or similar)
+>>>&0	search/31/b	\0403\040	3 axes
 !:mime	image/fits
-!:ext	fits/fts
->109	string	8		\b, 8-bit, character or unsigned binary integer
->108	string	16		\b, 16-bit, two's complement binary integer
->107	string	\ 32		\b, 32-bit, two's complement binary integer
->107	string	-32		\b, 32-bit, floating point, single precision
->107	string	-64		\b, 64-bit, floating point, double precision
+# data cubes more dimensions like: 5 (group.fits) 6 (DDTSUVDATA.fits)
+>>>&0	default		x
+>>>>&0	regex/31/s	=[0-9]{1,3} 	%s axis
+!:mime	application/fits
+# often NAXIS1 as 4th card but sometimes at higher offset like: 29400 (IUElwp25637mxlo.fits) 20400 (NICMOSn4hk12010_mos.fits)
+>>240	search/29400/bs	NAXIS1\040\040=		\b,
+# before optional comment 31 ASCII charactes left padded with spaces for first axis like: 192 512 1024 1200 2000 2064 3600 ...
+>>>&9	regex	=[0-9]{1,31} 	%s
+# often NAXIS2 as 5th card but sometimes not existent or at higher offset like: 29120 (IUElwp25637mxlo.fits) 20480 (NICMOSn4hk12010_mos.fits)
+>>>320	search/29120/bs	NAXIS2\040\040=		x
+# before optional comment 31 ASCII charactes left padded with spaces for second axis like: 2 4 165 512 800 1024 3600 ...
+>>>>&9	regex	=[0-9]{1,31} 	%s
+# not standard cards
+>>80	string	!BITPIX\040\040= \b, at 80
+# in M57.FIT like: "NAXIS   ="
+>>>80	string	x		"%-0.9s"
+>>160	string	!NAXIS\040\040\040= \b, at 160
+# in M57.FIT like: "BITPIX  ="
+>>>160	string	x		"%-0.9s"
 
 # other images
 0	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
@@ -1573,6 +1758,35 @@
 >>-0		offset	=32066
 # (2/41) like: medres.pi2
 >>>0		use		degas-bitmap
+# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
+# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
+# Update: Joerg Jenderek
+# See http://fileformats.archiveteam.org/wiki/GEM_Raster
+# For variations, also see:
+#    https://www.seasip.info/Gem/ff_img.html (Ventura)
+#    http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
+#    http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
+#    http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
+# header_size
+>2      beshort     0x0008
+>>0     use gem_info
+>2      beshort     0x0009
+>>0     use gem_info
+# no example for NOSIG
+>2      beshort     24
+>>0     use gem_info
+# no example for HYPERPAINT
+>2      beshort     25
+>>0     use gem_info
+16      string      XIMG\0
+>0      use gem_info
+# no example
+16      string      STTT\0\x10
+>0      use gem_info
+# no example or description
+16      string      TIMG\0
+>0      use gem_info
+
 # DEGAS high-res uncompressed bitmap *.pi3
 0	beshort		0x0002
 # skip Intel ia64 COFF msvcrt.lib by test for unused bits of 1st atari color palette entry
@@ -1763,8 +1977,12 @@
 
 # PCX image files
 # From: Dan Fandrich <dan@coneharvesters.com>
-# updated by Joerg Jenderek at Feb 2013 by https://de.wikipedia.org/wiki/PCX
+# updated by Joerg Jenderek at Feb 2013, Nov 2023 by https://en.wikipedia.org/wiki/PCX
 # https://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
+# URL:		http://fileformats.archiveteam.org/wiki/PCX
+# Note:		called "PCX image" with acronym "PiCture eXchange" by shared MIME-info database from freedesktop.org
+#		verfied partly as pcx "Zsoft Paintbrush" format by XnView `nconvert -in pcx -fullinfo *.pcx` and
+#		by ImageMagick version 7.1.1-21 command `identify *.pcx`
 # GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
 # test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
 0	ubelong&0xffF8fe00	0x0a000000
@@ -1772,28 +1990,39 @@
 >3	ubyte		>0
 # test for valid versions
 >>1	ubyte		<6
->>>1	ubyte		!1	PCX
-!:mime	image/x-pcx
-#!:mime	image/pcx
->>>>1	ubyte		0	ver. 2.5 image data
->>>>1	ubyte		2	ver. 2.8 image data, with palette
->>>>1	ubyte		3	ver. 2.8 image data, without palette
->>>>1	ubyte		4	for Windows image data
->>>>1	ubyte		5	ver. 3.0 image data
->>>>4	uleshort	x	bounding box [%d,
->>>>6	uleshort	x	%d] -
->>>>8	uleshort	x	[%d,
->>>>10	uleshort	x	%d],
->>>>65	ubyte		>1	%d planes each of
->>>>3	ubyte		x	%d-bit
->>>>68	ubyte		1	colour,
->>>>68	ubyte		2	grayscale,
+>>>1	ubyte		!1
+# skip DROID fmt-89-signature-id-62.pcx fmt-88-signature-id-63.pcx fmt-87-signature-id-64.pcx fmt-86-signature-id-65.pcx with invalid dimensions
+>>>>8	long		!0	PCX
+!:mime	image/vnd.zbrush.pcx
+# deprecated
+#!:mime	image/x-pcx
+!:ext	pcx/pcc
+# also examples like: abydos.st E-DIODE.ST MUSIC-13.ST ROSE.ST
+#!:ext	pcx/pcc/st
+# Note:		called as "PCX bitmap (v2.5)" by TrID via bitmap-pcx.trid.xml and "PCX" version 0 by DROID via PUID fmt/86
+>>>>>1	ubyte		0	ver. 2.5 image data
+# Note:		called as "PCX bitmap (v2.8, palette)" by TrID via bitmap-pcx-v28p.trid.xml and "PCX" version 2 by DROID via PUID fmt/87
+>>>>>1	ubyte		2	ver. 2.8 image data, with palette
+# Note:		called as "PCX bitmap (v2.8)" by TrID via bitmap-pcx-v28.trid.xml and "PCX" version 3 by DROID via PUID fmt/88
+>>>>>1	ubyte		3	ver. 2.8 image data, without palette
+# Note:		called as "PCX bitmap (Win)" by TrID via bitmap-pcx-win.trid.xml and "PCX" version 4 by DROID via PUID fmt/89
+>>>>>1	ubyte		4	for Windows image data
+# Note:		called as "PCX bitmap (v3.0) by TrID via bitmap-pcx-v30.trid.xml and "PCX" version 5 by DROID via PUID fmt/90
+>>>>>1	ubyte		5	ver. 3.0 image data
+>>>>>4	uleshort	x	bounding box [%d,
+>>>>>6	uleshort	x	%d] -
+>>>>>8	uleshort	x	[%d,
+>>>>>10	uleshort	x	%d],
+>>>>>65	ubyte		>1	%d planes each of
+>>>>>3	ubyte		x	%d-bit
+>>>>>68	ubyte		1	colour,
+>>>>>68	ubyte		2	grayscale,
 # this should not happen
->>>>68	default		x	image,
->>>>12	uleshort	>0	%d x
->>>>>14	uleshort	x	%d dpi,
->>>>2	ubyte		0	uncompressed
->>>>2	ubyte		1	RLE compressed
+>>>>>68	default		x	image,
+>>>>>12	uleshort	>0	%d x
+>>>>>>14 uleshort	x	%d dpi,
+>>>>>2	ubyte		0	uncompressed
+>>>>>2	ubyte		1	RLE compressed
 
 # Adobe Photoshop
 # From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
@@ -1966,35 +2195,6 @@
 0	string	NITF	National Imagery Transmission Format
 >25	string	>\0	dated %.14s
 
-# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
-# Format variations from: Bernd Nuernberger <bernd.nuernberger@web.de>
-# Update: Joerg Jenderek
-# See http://fileformats.archiveteam.org/wiki/GEM_Raster
-# For variations, also see:
-#    https://www.seasip.info/Gem/ff_img.html (Ventura)
-#    http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
-#    http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
-#    http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
-0       beshort     0x0001
-# header_size
->2      beshort     0x0008
->>0     use gem_info
->2      beshort     0x0009
->>0     use gem_info
-# no example for NOSIG
->2      beshort     24
->>0     use gem_info
-# no example for HYPERPAINT
->2      beshort     25
->>0     use gem_info
-16      string      XIMG\0
->0      use gem_info
-# no example
-16      string      STTT\0\x10
->0      use gem_info
-# no example or description
-16      string      TIMG\0
->0      use gem_info
 
 0   name        gem_info
 # version is 2 for some XIMG and 1 for all others
@@ -2085,43 +2285,41 @@
 
 # Hercules DASD image files
 # From Jan Jaeger <jj@septa.nl> and Jay Maynard <jaymaynard@gmail.com>
+
+# Common Hercules CKD image files
+0       name    HercCKD 
+>0      lelong  x               \b, %d heads per cylinder
+>4      lelong  x               \b, track size %d bytes
+>8      ubyte   >0x2F
+>>8     ubyte   0x45            \b, device type 9345
+>>8     ubyte   !0x45           \b, device type 33%2.2X
+>8      ubyte   <0x30           \b, device type 23%2.2X
+
 0       string  CKD_P370        Hercules CKD DASD image file
->8      lelong  x               \b, %d heads per cylinder
->12     lelong  x               \b, track size %d bytes
->16     byte    x               \b, device type 33%2.2X
+>8      use     HercCKD
 
 0       string  CKD_C370        Hercules compressed CKD DASD image file
->8      lelong  x               \b, %d heads per cylinder
->12     lelong  x               \b, track size %d bytes
->16     byte    x               \b, device type 33%2.2X
+>8      use     HercCKD
 >552    lelong  x               \b, %d total cylinders
 >>557   byte    0               \b, no compression
 >>557   byte    1               \b, ZLIB compression
 >>557   byte    2               \b, BZ2 compression
 
 0       string  CKD_S370        Hercules CKD DASD shadow file
->8      lelong  x               \b, %d heads per cylinder
->12     lelong  x               \b, track size %d bytes
->16     byte    x               \b, device type 33%2.2X
+>8      use     HercCKD
 
 0       string  CKD_P064        Hercules CKD64 DASD image file
->8      lelong  x               \b, %d heads per cylinder
->12     lelong  x               \b, track size %d bytes
->16     byte    x               \b, device type 33%2.2X
+>8      use     HercCKD
 
 0       string  CKD_C064        Hercules compressed CKD64 DASD image file
->8      lelong  x               \b, %d heads per cylinder
->12     lelong  x               \b, track size %d bytes
->16     byte    x               \b, device type 33%2.2X
+>8      use     HercCKD
 >524    lelong  x               \b, %d total cylinders
 >>585   byte    0               \b, no compression
 >>585   byte    1               \b, ZLIB compression
 >>585   byte    2               \b, BZ2 compression
 
 0       string  CKD_S064        Hercules CKD64 DASD shadow file
->8      lelong  x               \b, %d heads per cylinder
->12     lelong  x               \b, track size %d bytes
->16     byte    x               \b, device type 33%2.2X
+>8      use     HercCKD
 
 # Squeak images and programs - etoffi@softhome.net
 0	string		\146\031\0\0	Squeak image data
@@ -2481,7 +2679,6 @@
 >>0	use	ulead-imaginfo
 # From:		Joerg Jenderek
 # Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pe4-imaginfo.trid.xml
-11	string	\001\0\0\0\0
 # check for version 4 part
 >19	string	\0\0\0\004\0
 >>0	use	ulead-imaginfo
@@ -2954,7 +3151,8 @@
 # FIXME: Handle DX10 and XBOX formats.
 >>0x54	string	DX10
 >>>0x80	use	ms-directdraw-dx10
->>0x54	string	!DX10			\b, compressed using %.4s
+>>0x54	string	!DX10
+>>>0x54	string	x			\b, compressed using %.4s
 >0x50	ulelong&0x2	0x2		\b, alpha only
 >0x50	ulelong&0x200	0x200		\b, YUV
 >0x50	ulelong&0x20000	0x20000		\b, luminance
@@ -3101,6 +3299,10 @@
 >>0x10	ubelong	!0x44445320		Sega PVR image:
 >>>0x10	use	sega-pvr-image-header
 >>0x08	ulelong	x	\b, global index = %u
+# Sega GVR image with GBIX.
+>0x10	string	GVRT	Sega GVR image:
+>>0x10	use	sega-gvr-image-header
+>>0x08	ubelong	x	\b, global index = %u
 
 # Sega GVR header.
 0	name	sega-gvr-image-header
@@ -3122,12 +3324,6 @@
 0	string	GVRT	Sega GVR image:
 >0x10	use	sega-gvr-image-header
 
-# Sega GVR image with GBIX.
-0	string	GBIX
->0x10	string	GVRT	Sega GVR image:
->>0x10	use	sega-gvr-image-header
->>0x08	ubelong	x	\b, global index = %u
-
 # Sega GVR image with GCIX. (Wii)
 0	string	GCIX
 >0x10	string	GVRT	Sega GVR image:
@@ -3137,28 +3333,9 @@
 # Light Field Picture
 # Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
 # Typical file extensions: .lfp .lfr .lfx
-
 0	ubelong	0x894C4650
->4	ubelong	0x0D0A1A0A
->12	ubelong	0x00000000	Lytro Light Field Picture
->8	ubelong	x		\b, version %d
-
-# Type: Vision Research Phantom CINE Format
-# URL: https://www.phantomhighspeed.com/
-# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk
-# From: Harry Mallon <hjmallon at gmail.com>
-#
-# This has a short "CI" code but the 44 is the size of the struct which is
-# stable
-0	string	CI
->2	uleshort 44		Vision Research CINE Video,
->>4	uleshort	0		Grayscale,
->>4	uleshort 1		JPEG Compressed,
->>4	uleshort 2		RAW,
->>6	uleshort x		version %d,
->>20	ulelong	x		%d frames,
->>48	ulelong	x		%dx
->>52	ulelong	x		\b%d
+>4	ubelong	0x0D0A1A0A	Lytro Light Field Picture
+>>8	ubelong	x		\b, version %u
 
 # Type: ARRI Raw Image
 # Info: SMPTE RDD30:2014
@@ -3173,6 +3350,7 @@
 # Type: Khronos KTX texture.
 # From: David Korth <gerbilsoft@gerbilsoft.com>
 # Reference: https://www.khronos.org/opengles/sdk/tools/KTX/file_format_spec/
+# https://www.iana.org/assignments/media-types/image/ktx
 
 # glEnum decoding.
 # NOTE: Only the most common formats are listed here.
@@ -3247,6 +3425,8 @@
 # Main KTX header.
 # Determine endianness, then check the rest of the header.
 0	string	\xABKTX\ 11\xBB\r\n\x1A\n	Khronos KTX texture
+!:mime	image/ktx
+!:ext	ktx
 >12	ulelong	0x04030201			(little-endian)
 >>16	use	khronos-ktx-endian-header
 >12	ubelong	0x04030201			(big-endian)
@@ -3256,6 +3436,7 @@
 # From: David Korth <gerbilsoft@gerbilsoft.com>
 # Based on draft19.
 # Reference: http://github.khronos.org/KTX-Specification/
+# https://www.iana.org/assignments/media-types/image/ktx2
 
 # Supercompression enum.
 0	name	khronos-ktx2-supercompression
@@ -3517,6 +3698,8 @@
 
 # Main KTX2 header.
 0	string	\xABKTX\ 20\xBB\r\n\x1A\n	Khronos KTX2 texture
+!:mime	image/ktx2
+!:ext	ktx2
 >20	ulelong	x	\b, %u
 >24	ulelong	>1	x %u
 >28	ulelong	>1	x %u
@@ -3610,7 +3793,7 @@
 
 # Microsoft Paint graphic
 # http://www.fileformat.info/format/mspaint/egff.htm
-0	string	DanM 	icrosoft Paint image data (version 1.x)
+0	string	DanM 	Microsoft Paint image data (version 1.x)
 >4	uleshort	x	(%d
 >>6	uleshort	x	x %d)
 0	string	LinS 	Microsoft Paint image data (version 2.0)
@@ -3629,9 +3812,7 @@
 >>>>33		string	and
 >>>>>37		string	layers
 >>>>>>43	ulelong	x	reMarkable tablet notebook lines, 1404 x 1872, %x page(s)
-
 # newer per-page files for the reMarkable
-0		string	reMarkable
 >11		string	.lines
 >>18		string	file,
 >>>24		string	version=
@@ -4026,9 +4207,9 @@
 >>>13	ubyte		x	*bad colorspace %u*
 
 
-# Type: Godot 3, 4 texture (pixel format)
+# Type: Godot 3 texture (pixel format)
 # From: David Korth <gerbilsoft@gerbilsoft.com>
-0	name	godot-pixel-format
+0	name	godot-pixel-format-v3
 >0	ulelong&0xFFFFF	0	L8
 >0	ulelong&0xFFFFF	1	LA8
 >0	ulelong&0xFFFFF	2	R8
@@ -4066,7 +4247,54 @@
 >0	ulelong&0xFFFFF	34	ETC2_RGB8
 >0	ulelong&0xFFFFF	35	ETC2_RGBA8
 >0	ulelong&0xFFFFF	36	ETC2_RGB8A1
+# NOTE: This is a custom pixel format used by Sonic Colors Ultimate.
+# Godot 4 later added its own ASTC format values.
+>0	ulelong&0xFFFFF	37	ASTC_8x8
+
+# Type: Godot 4 texture (pixel format)
+# From: David Korth <gerbilsoft@gerbilsoft.com>
+# NOTE: This is a custom pixel format used by Sonic Colors Ultimate.
+# Godot 4 later added its own ASTC format values.
+0	name	godot-pixel-format-v4
+>0	ulelong&0xFFFFF	0	L8
+>0	ulelong&0xFFFFF	1	LA8
+>0	ulelong&0xFFFFF	2	R8
+>0	ulelong&0xFFFFF	3	RG8
+>0	ulelong&0xFFFFF	4	RGB8
+>0	ulelong&0xFFFFF	5	RGBA8
+>0	ulelong&0xFFFFF	6	RGBA4444
+>0	ulelong&0xFFFFF	7	RGB565
+>0	ulelong&0xFFFFF	8	RF
+>0	ulelong&0xFFFFF	9	RGF
+>0	ulelong&0xFFFFF	10	RGBF
+>0	ulelong&0xFFFFF	11	RGBAF
+>0	ulelong&0xFFFFF	12	RH
+>0	ulelong&0xFFFFF	13	RGH
+>0	ulelong&0xFFFFF	14	RGBH
+>0	ulelong&0xFFFFF	15	RGBAH
+>0	ulelong&0xFFFFF	16	RGBE9995
+>0	ulelong&0xFFFFF	17	DXT1
+>0	ulelong&0xFFFFF	18	DXT3
+>0	ulelong&0xFFFFF	19	DXT5
+>0	ulelong&0xFFFFF	20	RGTC_R
+>0	ulelong&0xFFFFF	21	RGTC_RG
+>0	ulelong&0xFFFFF	22	BPTC_RGBA
+>0	ulelong&0xFFFFF	23	BPTC_RGBF
+>0	ulelong&0xFFFFF	24	BPTC_RGBFU
+>0	ulelong&0xFFFFF	25	ETC
+>0	ulelong&0xFFFFF	36	ETC2_R11
+>0	ulelong&0xFFFFF	27	ETC2_R11S
+>0	ulelong&0xFFFFF	28	ETC2_RG11
+>0	ulelong&0xFFFFF	29	ETC2_RG11S
+>0	ulelong&0xFFFFF	30	ETC2_RGB8
+>0	ulelong&0xFFFFF	31	ETC2_RGBA8
+>0	ulelong&0xFFFFF	32	ETC2_RGB8A1
+>0	ulelong&0xFFFFF	33	ETC2_RA_AS_RG
+>0	ulelong&0xFFFFF	34	DXT5_RA_AS_RG
+>0	ulelong&0xFFFFF	35	ASTC_4x4
+>0	ulelong&0xFFFFF	36	ASTC_4x4_HDR
 >0	ulelong&0xFFFFF	37	ASTC_8x8
+>0	ulelong&0xFFFFF	38	ASTC_8x8_HDR
 
 # Type: Godot 3, 4 texture (rescale display, width)
 # From: David Korth <gerbilsoft@gerbilsoft.com>
@@ -4138,7 +4366,7 @@
 >16	ulelong&0x100000	0x100000	lossless encoding
 >16	ulelong&0x200000	0x200000	lossy encoding
 >16	ulelong&0x300000	0
->>16	use	godot-pixel-format
+>>16	use	godot-pixel-format-v3
 
 # Type: Godot 4 texture
 # From: David Korth <gerbilsoft@gerbilsoft.com>
@@ -4157,7 +4385,7 @@
 >12	use	godot-rescale-display-h
 >12	uleshort	x	\b,
 >0x2C	ulelong		>1	%u mipmaps,
->0x30	use	godot-pixel-format
+>0x30	use	godot-pixel-format-v4
 >0x24	ulelong		1	\b, embedded PNG image
 >0x24	ulelong		2	\b, embedded WebP image
 >0x24	ulelong		3	\b, Basis Universal
@@ -4217,3 +4445,140 @@
 >3	string	Em	5-7
 >3	string	Fk	8-12
 >3	default	x	MAX
+
+
+# https://teem.sourceforge.net/nrrd/index.html
+# From: Quasar Jarosz <quasar@uams.edu>, 2023
+0	string	NRRD000				NRRD imaging data
+!:mime  image/x.nrrd
+!:ext   nrrd
+>7	string	x				\b, version %s
+>0	search	type: 
+>>&1	string	x				\b, type: %s
+>0	search	dimension: 
+>>&1	string	x				\b, dimensions: %s
+>0	search	sizes: 
+>>&1	string	x				\b, sizes: %s
+>0	search	encoding: 
+>>&1	string	x				\b, encoding: %s
+
+# From:		Joerg Jenderek
+# URL:		http://justsolve.archiveteam.org/wiki/PICT
+#		https://en.wikipedia.org/wiki/PICT
+# Reference:	https://www.fileformat.info/format/macpict/egff.htm
+#		http://mark0.net/download/triddefs_xml.7z/defs/p/pict-v2.trid.xml
+# Note: 	called "Macintosh Quickdraw/PICT drawing" by shared MIME-info database from freedesktop.org,
+#		"QuickDraw/PICT bitmap (v2)" by TrID and "Macintosh PICT Image" version 2.0 by DROID via PUID via fmt/341
+# 		verified by command like `deark -m pict -l -d2 flag_b24.pct` as PICT v2,
+#		partly by NetPBM `picttoppm venus.pct | file` as "Macintosh PICT",
+#		partly by ImageMagick `identify -verbose flag_b24.pct` as (Apple Macintosh QuickDraw/PICT) and
+#		partly by XnView `nconvert -fullinfo *.pict *.pic *.pct` as "Macintosh PICT 2"
+# look for version operator (0011h) and version number (02FFh)
+522 ubelong				0x001102ff
+# few Macintosh QuickDraw with one corner at -1/-1 coordinates like PICT_129.pict PICT_2012.pict (strength=81=70+11) before Claris clip art (strength=80 ./claris)
+!:strength +11
+# look for Version operator (0C00h)
+>526	ubeshort			0x0c00
+# skip DROID fmt-341-signature-id-468.pct with invalid dimension x=0
+>>520		ubeshort		!0
+# skip DROID variant fmt-341-signature-id-468.pct using 0xAB instead 0x0 
+>>>0		long			!0xABABABAB		Macintosh QuickDraw PICT, version 2
+#!:mime		application/octet-stream
+!:mime		image/x-pict
+!:apple		????PICT
+!:ext		pict/pic/pct
+# maybe also suffix pict2	https://www.xnview.com/de/image_formats/
+#!:ext		pict2/pict/pic/pct
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pict.trid.xml
+# Note: 	called "Macintosh Quickdraw/PICT Drawing" by TrID
+#		"real" content stored by opcode 0x8200 (CompressedQuickTime *.qtif) with none, cvid or JPEG compression
+# look for LongText QuickTime followed by trademark character
+>>>>554		search/691976/b		QuickTime\252		\b, QuickTime
+# look for LongText afterwards like "and a/None|Cinepak|Photo - JPEG decompressor/are needed to see this picture"
+>>>>>&0		search/28/bs	\040decompressor	with decompressor
+>>>>>>&-4	string			None			None
+# Cinepak and "Compact Video decompressor" seems to be cvid
+>>>>>>&-7	string			Cinepak			Cinepak
+>>>>>>&-12	string			Photo\040-\040JPEG	JPEG
+>>>>>>&-13	string			Compact\040Video	cvid
+# case where decompression is not like: Cinepak None "Photo - JPEG" "Compact Video decompressor"
+>>>>>>&-6		default			x
+>>>>>>>&0	string			x			"%0.6s"
+# file size in bytes; not reliable sometimes 0 or little smaller than real size
+#>>>>512	ubeshort		x			\b, size %u
+# 8 bytes picFrame (rectangle); for most examples one corner is located at coordinates 0/0; except deark other tools fail when negative values
+# GRR: samples with coordinates -1/-1 and Y=0x01??|0x00?? are interpreted as "Claris clip art" (strength=80 ./claris)
+#>>>>518		ubeshort		x			Y=%#4.4x
+>>>>520		ubeshort		x			\b, %u
+>>>>>516	beshort			!0			\b-%d
+>>>>518		ubeshort		x			x %u
+>>>>>514	beshort			!0			\b-%d
+# Note:		at the beginning all zeros or information about the particular software like: PICT
+>>>>0		long			!0			\b, at 0
+>>>>>0		string			x			%.4s
+# version 2.0 files also have a 26-byte header following the version information
+# like: 0 FFFEh (freedesktop egff~Encyclopedia of Graphics File Formats) FFFFh (egff)
+>>>>528		ubeshort		x			\b, at 528 %#4.4x
+# 2nd opcode like: 0x0000~NOP 0x0001~Clip 0x00a0~ShortComment 0x00a1~LongComment 0x001e~DefHilite 0x001f~OpColor
+>>>>552		ubeshort		x			\b, at 552 second opcode %#4.4x
+# last opcode if not opEndPic (00FFh)
+>>>>-2		ubeshort		!0x00FF			\b, at the end %#4.4x opcode
+# Reference:	http://web.archive.org/web/20010703041301/http://developer.apple.com/technotes/qd/qd_14.html
+#		http://mark0.net/download/triddefs_xml.7z/defs/p/pict-v1.trid.xml
+# Note: 	called "QuickDraw/PICT bitmap (v1)" by TrID and "Macintosh PICT Image" version 1.0 by DROID via PUID via x-fmt/80
+# 		verified by command like `deark -m pict -l -d2 FC9.PCT` as PICT v1,
+#		by ImageMagick `identify -verbose *.pict` as PICT (Apple Macintosh QuickDraw/PICT) and
+#		by XnView `nconvert -fullinfo *.pict *.pct` as "Macintosh PICT"
+# 1 byte opcode for picversion (11h); next byte version number (1)
+522		ubeshort	0x1101
+# skip DROID x-fmt-80-signature-id-859.pct x-fmt-80-signature-id-860.pct without next opcode usually clipRgn (1h)
+>524		ubyte		=0x01
+>>0		use		mac-pict1
+#	display Macintosh PICT drawing version 1 information
+0		name		mac-pict1
+>520		ubeshort	x		Macintosh QuickDraw PICT, version 1
+#!:mime		application/octet-stream
+!:mime		image/x-pict
+!:apple		????PICT
+!:ext		pict/pct
+# maybe also suffix pict1 and pic
+#!:ext		pict1/pict/pic/pct
+# file size in bytes; not reliable sometimes 0 or smaller than real size
+#>512		ubeshort	x		\b, size %u
+# 8 bytes picFrame (rectangle)
+>520		ubeshort	x		\b, %u
+>516		ubeshort	!0		\b-%u
+>518		ubeshort	x		x %u
+>514		ubeshort	!0		\b-%u
+# Note:		According to DROID at the beginning all zeros or information about the particular software like DRWG(MD|D2)
+>0		long		!0		\b, at 0
+>>0		string		x		%.6s
+>>0		ubelong		x		%#8.8x
+>>4		ubeshort	x		\b%4.4x
+# 2nd opcode if not clipRgn (1h)
+>524		ubyte		!0x01		\b, at 524 %#2.2x opcode 
+# last opcode if not opEndPic (FFh)
+>-1		ubyte		!0xFF		\b, at the end %#2.2x opcode 
+
+# https://github.com/aseprite/aseprite/blob/main/docs/ase-file-specs.md
+20		ulelong		0
+>24		ulelong		0
+>>4		uleshort	0xA5E0	Aseprite asset file
+!:ext	aseprite
+>>>0		ulelong		x	\b, size %u
+>>>6		uleshort	x	\b, frames %u
+>>>8		uleshort	x	\b, size %ux
+>>>10		uleshort	x	\b%u
+>>>12		uleshort	32	\b, RGBA
+>>>12		uleshort	16	\b, Grayscale
+>>>12		uleshort	8	\b, Indexed
+>>>14		ulelong		x	\b, flags %#x
+#>>>18		uleshort	x	\b, speed %u
+>>>28		ubyte		x	\b, transparency index %u
+>>>32		uleshort	x	\b, number of colors %u
+>>>34		ubyte		>0	\b, pixel ratio %u:
+>>>>35		ubyte		x	\b%u
+>>>36		leshort		x	\b, grid position (%d, 
+>>>38		leshort		x	\b%d)
+>>>40		uleshort	x	\b, grid size %dx
+>>>42		uleshort	x	\b%d

magic/Magdir/ispell

@@ -1,7 +1,7 @@
 
 #------------------------------------------------------------------------------
-# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
-# ispell:  file(1) magic for ispell
+# $File: ispell,v 1.10 2023/10/23 19:49:58 christos Exp $
+# ispell:  file(1) magic for ispell, MySpell, Hunspell and aspell
 #
 # Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
 # will match 0x9600 through 0x9603 in *both* little endian and big endian.
@@ -61,3 +61,189 @@
 >12     long            x               lexsize %d,
 >16     long            x               hashsize %d,
 >20     long            x               stblsize %d
+
+# Summary:	affixes defition text files for Ispell/MySpell/Hunspell
+# From:		Joerg Jenderek
+# URL:		https://www.openoffice.org/lingucomponent/affix.readme
+#		https://man.archlinux.org/man/hunspell.5.en
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/a/affix.trid.xml
+# Note:		called "Affix file" by TrID
+# variant starting with comment character
+0		ubyte		0x23
+# look for SET character command followed by whitespace (seems to be often 1 space character) like in:
+# /usr/share/calibre/dictionaries/en-GB/en-GB.aff
+>0		search/60459	SET\040
+# skip scripts like /bin/affixcompress /bin/setupcon /bin/imdbpy2sql.py by checking for valid character SET argument
+# character SET argument like: UTF-8
+>>&0		string		UTF-8
+>>>0		use					spell-aff
+# character SET argument like: ISO8859-1 - ISO8859-10 ISO8859-13 - ISO8859-15
+>>&0		string		ISO8859-
+>>>0		use				spell-aff
+# character SET argument for Russian with Cyrillic alphabet like: KOI8-R KOI8-U
+# no russian support until war against ukraine
+>>&0		string		KOI8-
+#>>>0		use				spell-aff
+# character SET argument for languages with Cyrillic alphabet like: cp1251
+# no cyrillic support until russia war against ukraine
+>>&0		string		cp1251
+#>>>0		use				spell-aff
+# character SET argument for Indian Script Code for Information Interchange (ISCII) like: ISCII-DEVANAGARI
+>>&0		string		ISCII-
+# no example found
+>>>0		use				spell-aff
+# not "real" affix rule files but found as tests unit inside thunderbird sources like:
+# 1463589.aff 1695964.aff 2970240.aff
+>0		default		x
+# look for suffix SFX command followed by whitespace like in:
+# 1695964.aff
+>>0		search/164	SFX\040
+>>>0		use				spell-aff
+# if not real Hunspell/MySpell affix look for ispell variant
+>>0		default		x
+# URL:		https://manpages.debian.org/testing/ispell/ispell.5.en.html
+# look for ispell declaration like in: /usr/lib/ispell/espanol.aff
+>>>0		search/8251	defstringtype
+# defstringtype declaration start with unique name (like "list" "lat" "utf8" "iso" "nroff" often like formatter name)
+# followed by formatter name (like "nroff" "tex")
+# followed by suffix list (like ".mm" ".ms" ".me" ".man" ".NeXT" ".txt" ".list")
+#>>>>&1		string		x		DECLARATION=%s
+>>>>0		use				spell-aff
+# ispell variant without declaration like in: /usr/lib/ispell/bulgarian.aff /usr/lib/ispell/russian.aff
+>>>0		default		x
+# skip /etc/nilfs_cleanerd.conf by looking for ispell suffix section
+>>>>0		search/3233	suffixes\n
+>>>>>0		use				spell-aff
+# variant starting with empty line and comment character at the beginning of 2nd line like in: /usr/lib/ispell/polish.aff
+0		ubeshort	0x0a23
+# skip /etc/discover-modprobe.conf by looking for ispell declaration
+>2		search/3118	defstringtype
+>>0		use				spell-aff
+# starting with UTF-8 Byte Order Mark (BOM) https://en.wikipedia.org/wiki/Byte_order_mark
+0		string		\xEF\xBB\xBF
+# starting with UTF-8 Byte Order Mark (BOM) followed by comment starting character
+>3		string		\x23
+# starting with UTF-8 BOM and with SET character command followed by whitespace
+# like in: /opt/Wolfram/WolframEngine/13.1/SystemFiles/Components/SpellingData/SpellingDictionaries/lt.aff
+# look for character SET command used in MySpell and Hunspell
+>3		search/9883	SET\040
+>>0		use				spell-aff
+# look for FLAG type command used in MySpell and Hunspell
+0		string		FLAG
+# followed by space character like in
+# /opt/Wolfram/WolframEngine/13.1/SystemFiles/Components/SpellingData/SpellingDictionaries/en_US.aff
+>4		ubyte		0x20
+>>0		use				spell-aff
+# or followed by tabulator character like in
+# /opt/Wolfram/WolframEngine/13.1/SystemFiles/Components/SpellingData/SpellingDictionaries/ar.aff
+>4		ubyte		0x09
+>>0		use				spell-aff
+# starting with character SET command used in MySpell and Hunspell like in: org/languagetool/resource/sv/hunspell/sv_SE.aff
+0		string		SET\040
+>0		use				spell-aff
+# starting with language code LANG used in MySpell and Hunspell like in: /usr/share/hunspell/tr_TR.aff
+0		string		LANG\040
+>0		use				spell-aff
+# starting with affix flag command AF used in MySpell and Hunspell like in: /usr/lib/thunderbird/extensions/langpack-hu@thunderbird.mozilla.org/dictionaries/hu.aff
+0		string		AF\040
+# look for number of flag vector aliases
+>3		regex		[0-9]{1,4}
+>>0		use				spell-aff
+#	display information (encoding,language,...) about affixes rules text for Ispell/MySpell/Hunspell
+0		name				spell-aff
+>1		ubeshort	x		affix definition
+#!:mime		text/plain
+!:mime		text/x-affix
+!:ext		aff
+# GRR: need extra test so that default clause works
+>0		ubyte		x
+# look for ispell declaration
+>>0		search/8251	defstringtype	for Ispell
+# ispell variant without declaration
+>>0		default		x
+# look for ispell suffixes command
+>>>0		search/3233	suffixes
+# skip "suffixes used to create first part of a compound" by checking for flag argument like in: languagetool\resource\sv\hunspell\sv_SE.aff
+>>>>&0		search/2	flag		for Ispell
+>>>>&0		default		x		for MySpell/Hunspell
+# without suffixes keyword
+>>>0		default		x		for MySpell/Hunspell
+# look for language code command used in MySpell and Hunspell
+# like in: /usr/share/hunspell/de_AT.aff /usr/share/hunspell/it_IT.aff /usr/share/hunspell/tr_TR.aff /usr/lib/firefox/browser/extensions/langpack-hu@firefox.mozilla.org/dictionaries/hu.aff
+>>0		search/1117643	LANG\040	\b, language
+# language code argument like: de_DE hu_HU it_IT mn_MN tr_TR
+>>>&0		string		x		%s
+# look for character SET command used in MySpell and Hunspell
+>>0		search/1117729	SET
+# skip SETTINGS like in /usr/lib/ispell/ngerman.aff
+# SET command followed often by space character (0x20) or tabulator (0x09) like in
+# /opt/Wolfram/WolframEngine/13.1/SystemFiles/Components/SpellingData/SpellingDictionaries/ar.aff
+>>>&0	ubyte&0xD6	=0x00
+# skip SSET	#     schosS in /usr/lib/ispell/ogerman.aff
+>>>>&0		ubyte		>0x48		\b,
+# character SET argument like: cp1251 ISCII-DEVANAGAR ISO8859-1 - ISO8859-10 ISO8859-13 - ISO8859-15 KOI8-R KOI8-U UTF-8
+>>>>>&-1	string	x			"%s" encoded
+# for control reasons show first non empty lines for ASCII or ISO-8859 text variant
+>1		ubeshort	!0xBBBF
+# 1st line starting with 0x0A like in /usr/src/dicts/sjp-ispell-pl-20140213/polish.aff
+>>0		ubyte		=0x0A
+>>>1		ubyte		!0x0A		\b, 2nd line
+>>>>&-1		string		x		"%s"
+# 3rd line starting with 0x0A like in polish.aff
+>>>>>&1		ubyte		=0x0A
+>>>>>>&0	string		x		\b, 4th line "%s"
+# 1st line starting with ASCII text like: 
+# this is the affix file of the de_DE Hunspell dictionary
+>>0		ubyte		!0x0A
+>>>0		string		x		\b, 1st line "%s"
+>>>>&1		ubyte		>0x1F		\b, 2nd line
+>>>>>&-1	string		x		"%s"
+# 2nd line starting with 0x0A like in /usr/lib/ispell/bulgarian.aff
+>>>>&1		ubyte		=0x0A		\b, 3rd line
+>>>>>&0		string		x		"%s"
+# for control reasons show first lines for variant starting with ByteOrderMark (BOM=\xEF\xBB\xBF)
+>1		ubeshort	=0xBBBF	   	\b, with BOM
+>>3		string		x		\b, 1st line "%s"
+>>>&1		ubyte		>0x1F		\b, 2nd line
+>>>>&-1		string		x		"%s"
+
+# From:		Joerg Jenderek
+# URL:		https://en.wikipedia.org/wiki/GNU_Aspell
+#		https://manpages.ubuntu.com/manpages/trusty/en/man8/aspell-autobuildhash.8.html
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/r/rws-aspell.trid.xml
+#		https://ftp.gnu.org/gnu/aspell/aspell-0.60.8.tar.gz
+#		aspell-0.60.8/modules/speller/default/data.cpp
+#		aspell-0.60.8/modules/speller/default/readonly_ws.cpp
+# Note:		called "aspell dictionary" by TrID
+0	string	aspell\040default\040speller\040rowl	aspell dictionary
+#!:mime	application/octet-stream
+!:mime	application/x-aspell-dictionary
+!:ext	rws
+# version like: 1.10 1.4
+>28	string	x					\b, version %s
+# u32int endian_check; 12345678=00BC614Eh
+#>64	ulelong	x					\b, endian_check=%u
+>>64	ulelong	12345678				\b, little endian
+# not tested
+>>64	ubelong	12345678				\b, big endian
+# older aspell version not like 0.60.8
+>>64	default	x					\b, old
+# URL:		https://en.wikipedia.org/wiki/GNU_Aspell
+# Reference	http://aspell.net/man-html/Format-of-the-Personal-and-Replacement-Dictionaries.html
+# personal_ws-1.1 lang num [encoding]
+0	string	personal_				aspell personal
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pws-aspell.trid.xml
+# Note:		called "aspell Personal dictionary" by TrID
+>9	string	ws-					dictionary
+#!:mime	text/plain
+!:mime	text/x-aspell-dictionary
+# like: ~/.aspell.en.pws ~/.aspell.de_DE.pws ~/.aspell.it.pws
+!:ext	pws
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/prepl-aspell.trid.xml
+# Note:		called "aspell Personal Replacement dictionary" by TrID
+# personal_repl-1.1 lang num [encoding]
+>9	string	repl-					replacement dictionary
+#!:mime	text/plain
+!:mime	text/x-aspell-dictionary
+# like: ~/.aspell.en.prepl ~/.aspell.de_DE.prepl ~/.aspell.it.prepl
+!:ext	prepl

magic/Magdir/javascript

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: javascript,v 1.5 2023/01/12 00:02:16 christos Exp $
+# $File: javascript,v 1.7 2024/11/10 14:48:55 christos Exp $
 # javascript:  magic for javascript and node.js scripts.
 #
 0	string/tw	#!/bin/node		Node.js script executable
@@ -17,51 +17,48 @@
 !:mime application/javascript
 
 # JavaScript
-# The strength is increased to beat the C++ & HTML rules
+# The strength is increased to beat the C++ but lose to HTML rules,
+# because javascript is embedded in hmtl files typically
 0	search	"use\x20strict"	JavaScript source
-!:strength +30
+!:strength +20
 !:mime	application/javascript
 !:ext 	js
 0	search	'use\x20strict'	JavaScript source
-!:strength +30
+!:strength +20
 !:mime	application/javascript
 !:ext 	js
 0	regex	module(\\.|\\[["'])exports.*=	JavaScript source
-!:strength +30
+!:strength +20
 !:mime	application/javascript
 !:ext 	js
 0	regex	\^(const|var|let).*=.*require\\(	JavaScript source
-!:strength +30
+!:strength +20
 !:mime	application/javascript
 !:ext 	js
 0	regex	\^export\x20(function|class|default|const|var|let|async)\x20	JavaScript source
-!:strength +30
+!:strength +20
 !:mime	application/javascript
 !:ext 	js
 0	regex	\\((async\x20)?function[(\x20]	JavaScript source
-!:strength +30
+!:strength +20
 !:mime	application/javascript
 !:ext 	js
 0	regex	\^(import|export).*\x20from\x20	JavaScript source
-!:strength +30
+!:strength +20
 !:mime	application/javascript
 !:ext 	js
 0	regex	\^(import|export)\x20["']\\./	JavaScript source
-!:strength +30
-!:mime	application/javascript
-!:ext 	js
-0	regex	\^require\\(["']	JavaScript source
-!:strength +30
+!:strength +20
 !:mime	application/javascript
 !:ext 	js
 0	regex	typeof.*[!=]==	JavaScript source
-!:strength +30
+!:strength +20
 !:mime	application/javascript
 !:ext 	js
 
 # React Native minified JavaScript
 0	search/128	__BUNDLE_START_TIME__=	React Native minified JavaScript
-!:strength +30
+!:strength +20
 !:mime	application/javascript
 !:ext	bundle/jsbundle
 

magic/Magdir/jpeg

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: jpeg,v 1.38 2022/12/02 17:42:04 christos Exp $
+# $File: jpeg,v 1.40 2024/11/10 00:26:35 christos Exp $
 # JPEG images
 # SunOS 5.5.1 had
 #
@@ -34,12 +34,12 @@
 >>13	byte		0		\b, aspect ratio
 >>13	byte		1		\b, resolution (DPI)
 >>13	byte		2		\b, resolution (DPCM)
->>14	beshort		x		\b, density %dx
->>16	beshort		x		\b%d
->>4	beshort		x		\b, segment length %d
+>>14	ubeshort	x		\b, density %ux
+>>16	ubeshort	x		\b%u
+>>4	ubeshort	x		\b, segment length %u
 # Next, show thumbnail info, if it exists:
->>18	byte		!0		\b, thumbnail %dx
->>>19	byte		x		\b%d
+>>18	byte		!0		\b, thumbnail %ux
+>>>19	byte		x		\b%u
 >6	string		Exif		\b, Exif standard: [
 >>12	indirect/r	x
 >>12	string		x		\b]
@@ -57,22 +57,22 @@
 >0	beshort		0xFFC0
 >>(2.S+2)	use			jpeg_segment
 >>4	byte		x		\b, baseline, precision %d
->>7	beshort		x		\b, %dx
->>5	beshort		x		\b%d
+>>7	ubeshort	x		\b, %ux
+>>5	ubeshort	x		\b%u
 >>9	byte		x		\b, components %d
 
 >0	beshort		0xFFC1
 >>(2.S+2)	use			jpeg_segment
 >>4	byte		x		\b, extended sequential, precision %d
->>7	beshort		x		\b, %dx
->>5	beshort		x		\b%d
+>>7	ubeshort	x		\b, %ux
+>>5	ubeshort	x		\b%u
 >>9	byte		x		\b, components %d
 
 >0	beshort		0xFFC2
 >>(2.S+2)	use			jpeg_segment
 >>4	byte		x		\b, progressive, precision %d
->>7	beshort		x		\b, %dx
->>5	beshort		x		\b%d
+>>7	ubeshort	x		\b, %ux
+>>5	ubeshort	x		\b%u
 >>9	byte		x		\b, components %d
 
 # Define Huffman Tables
@@ -165,25 +165,40 @@
 #45	beshort		0xff52
 
 # JPEG extended range
+# Update:	Joerg Jenderek 2023
 # URL:		http://fileformats.archiveteam.org/wiki/JPEG_XR
 # Reference:	https://www.itu.int/rec/T-REC-T.832
 #		http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-wmp.trid.xml
-# Note:         called by TrID "JPEG XR bitmap"
+#		http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jxr.trid.xml
+# Note:         called by TrID "JPEG XR bitmap" and "JPEG XR bitmap (WMPHOTO)"
+#		verified as "JPEG XR" by XnView `nconvert -fullinfo *.jxr *.wdp`
+#		partly by ImageMagick command `identify -verbose *.wdp`
+#		and libjxr-tools `JxrDecApp -v -i example.wdp -o example.tif`
 0	string		\x49\x49\xbc
-# FILE_VERSION_ID; shall be equal to 1; other values are reserved for future use
+# FILE_VERSION_ID; shall be equal to 1; other values are reserved for future use and are unlike to appear
 >3	byte		1
 # FIRST_IFD_OFFSET; shall be an integer multiple of 2; so skip DROID fmt-590-signature-id-931.wdp
->>4	lelong%2	0	JPEG-XR
+>>4	lelong%2	0	JPEG-XR Image
 #!:mime	image/vnd.ms-photo
 !:mime	image/jxr
 # NO example for HDP !
 !:ext	jxr/wdp/hdp
 # MAYBE also WMP ?
 #!:ext	jxr/wdp/hdp/wmp
-# moved from ./images (version 1.205 ), merged and
-# partly verified by XnView `nconvert -info abydos.jxr FLOWER.wdp`
-# example: https://web.archive.org/web/20160403012904/
+# moved from ./images (version 1.243 ) and merged
+# example:
 # http://shikino.co.jp/solution/upfile/FLOWER.wdp.zip
+# often GDI_SIGNATURE "WMPHOTO\0" at offset 90 like: FLOWER.wdp abydos.jxr SMALLTOMATO.wdp
+>90	bequad		0x574D50484F544F00
+>>0	use	jxr-info
+# seldom no GDI_SIGNATURE WMPHOTO\0 at offset 90 like: example.wdp MARKET-3361-ipm-bg-DE-treat[1].wdp
+>90	bequad		!0x574D50484F544F00
+# look for GDI_SIGNATURE WMPHOTO\0 at other offset
+>>4	search/3267/sb	WMPHOTO\0
+>>>&-90	use	jxr-info
+#
+0	name	jxr-info
+# check for GDI_SIGNATURE that corresponds to "WMPHOTO\0"
 >90	bequad		0x574D50484F544F00
 >>98	byte&0x08	=0x08			\b, hard tiling
 >>99	byte&0x80	=0x80			\b, tiling present
@@ -198,8 +213,8 @@
 >>99	byte&0x38	0x30			\bLT
 >>99	byte&0x38	0x38			\bLB
 >>100	byte&0x80	=0x80			\b, short header
->>>102	beshort+1	x			\b, %d
->>>104	beshort+1	x			\bx%d
+>>>102	beshort+1	x			\b, %u
+>>>104	beshort+1	x			\bx%u
 >>100	byte&0x80	=0x00			\b, long header
 >>>102	belong+1	x			\b, %x
 >>>106	belong+1	x			\bx%x

magic/Magdir/keyman

@@ -0,0 +1,14 @@
+
+#------------------------------------------------------------------------------
+# $File: keyman,v 1.2 2024/10/17 19:23:07 christos Exp $
+# 
+# Keyman support for .kmx and .kmp files (kmp support is in archive)
+#
+# https://help.keyman.com/developer/current-version/reference/file-types/kmx
+# https://help.keyman.com/developer/current-version/reference/file-types/kmp
+
+0	string/b 	KXTS    Keyman Compiled Keyboard File
+!:ext kmx
+!:mime	application/vnd.keyman.kmx
+>4	lelong     	x	version 0x%x
+>>48	lelong 		&32	KMX+ Data

magic/Magdir/lammps

@@ -1,7 +1,6 @@
-#------------------------------------------------------------------------------
-# $File: lammps,v 1.1 2021/03/14 16:24:18 christos Exp $
-#
 
+#------------------------------------------------------------------------------
+# $File: lammps,v 1.2 2024/06/10 23:09:52 christos Exp $
 # Magic file patterns for use with file(1) for the
 # LAMMPS molecular dynamics simulation software.
 # https://lammps.sandia.gov

magic/Magdir/lauterbach

@@ -0,0 +1,7 @@
+
+#------------------------------------------------------------------------------
+# $File: lauterbach,v 1.1 2024/10/02 01:45:32 christos Exp $
+# Lauterbach GmbH file formats
+#
+0	string	trace32\x20analyzer\x20data	Lauterbach T32 trace data 
+!:ext ad

magic/Magdir/linux

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: linux,v 1.85 2023/07/17 14:40:09 christos Exp $
+# $File: linux,v 1.91 2024/11/09 21:15:48 christos Exp $
 # linux:  file(1) magic for Linux files
 #
 # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
@@ -137,34 +137,230 @@
 # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
 # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
 # and Nicolas Lichtmaier <nick@debian.org>
-# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
+# and Joerg Jenderek [unifying + more kernel info]
+# many start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
+# by assembler instructions like: movw $0x07c0,%ax; movw %ax,%ds; movw $0x9000,%ax; movw %ax,%es; movw $0x0001,%cx; subw %si,%si; subw
 # Linux kernel boot images (i386 arch) (Wolfram Kleff)
 # URL: https://www.kernel.org/doc/Documentation/x86/boot.txt
 514	string		HdrS		Linux kernel
+# to display Linux kernel (strength=125=70+55) after VBR boot sector (130=70+60) but before DOS/MBR IPL (115=50+65), MBR boot sector (105=40+65) via ./filesystem
+# before MZ PE32 executable (EFI application) (strength=50) and before DOS executable (COM) (strength=40) with start instruction 0xe9 via ./msdos
 !:strength + 55
 # often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes
 # Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin
 # DamnSmallLinux 1.5 damnsmll.lnx 
+#!:mime	application/octet-stream
+!:mime	application/x-linux-kernel
 !:ext	/dat/bin/lnx
+# GRR: does there exist here samples without 55AA boot signature? I believe NO (Joerg Jenderek)
 >510	leshort		0xAA55		x86 boot executable
+>>0		use	kernel-info
+# show information about Linux kernel (root, swap device, vga modus, boot protocol, setup size, init_size, EFI entry point)
+0		name	kernel-info
+# like: plpbtrom.bin
+# After 16 bit jump instruction Hi, are you searching something? This is the Plop Boot Manager written by Elmar Hanlhofer http?://www.plop.at
+>48	string		Plop\040Boot\040Manager		from PLOP Boot Manager
+# dummy test below 512 limit (for LILO 24.2 bootsect.b) to get same magic indention level like in v 1.85
+# and display comma before zImage/bzImage or version
+>498	leshort		x		\b,
+# boot protocol option flags valid since boot protocol >= 2.00
 >>518	leshort		>0x1ff
->>>529	byte		0		zImage,
->>>529	byte		1		bzImage,
->>>526	lelong		>0
+# loadflags bit 0 (read); LOADED_HIGH; if 0, the protected-mode code is loaded at 0x10000
+>>>529	ubyte&0x01	0		zImage,
+# loadflags bit 0 (read); LOADED_HIGH; if 1, the protected-mode code is loaded at 0x100000; that implies is_bzImage
+>>>529	ubyte&0x01	1		bzImage,
+# kernel_version; since protocol 2.00 if not zero 2 byte pointer to kernel version string -200h; should be < 200h*setup_sects
+# 0h (ldntldr.bin plpbtrom.bin) 260h (memtest32.bin memtest64.bin) 3b0h (memdisk16.bin) 890h (damnsmll.lnx) 3400h (linux64) 3640h (linux)
+#>>>526	uleshort	x		kernel_version=%#4.4x
+>>>526	uleshort	>0
+# GRR: \353fHdrS\003\002 wrong shown if kernel_version=0 like in ldntldr.bin (GRUB for DOS)
 >>>>(526.s+0x200) string	>\0	version %s,
+# 498 MasterBootRecord 4th partition entry partition type (0~empty 1~FAT12) done by ./filesystems
+# 499 MasterBootRecord 4th partition entry end heads done by ./filesystems
+# root_flags; if set (=1), the root is mounted readonly; deprecated, use the "ro" or "rw" option on the command line instead	
+#>>498	uleshort	>1		root_flags=%u
 >>498	leshort		1		RO-rootFS,
 >>498	leshort		0		RW-rootFS,
+# root_dev; default root device number like 0 301h (/dev/hda1 damnsmll.lnx) 380h (/dev/hd?? linux-elks); deprecated and replaced by command line option root=
 >>508	leshort		>0		root_dev %#X,
->>502	leshort		>0		swap_dev %#X,
+# since protocol 2.04 the 2 upper bytes of long syssize and not swap_dev any more
+>>518	uleshort	<0x204
+# 502-505 MasterBootRecord 4th partition entry 1st LBA sector done by ./filesystems
+>>>502	leshort		>0		swap_dev %#X,
 >>504	leshort		>0		RAMdisksize %u KB,
+# 506-509 MasterBootRecord 4th partition entry sectors in partition done by ./filesystems
 >>506	leshort		0xFFFF		Normal VGA
 >>506	leshort		0xFFFE		Extended VGA
 >>506	leshort		0xFFFD		Prompt for Videomode
 >>506	leshort		>0		Video mode %d
+# more kernel information added by Joerg Jenderek 2023
+# if needed display comma after video mode and before setup_sects
+>>506	leshort		>-4
+>>>506	leshort		!0		\b,
+# setup_sects; if field contains 0, the real value is 4; size of the setup in sectors like:
+# 0 (memdisk16.bin) 1 (ldntldr.bin) 2 (memtest32.bin memtest64.bin) 4 (plpbtrom.bin linux-elks) 8 (bootsect.b) 10 (damnsmll.lnx) 25 27 (linux64) 29 30 31 33 (linux)
+# MasterBootRecord 4th partition entry start cylinder bits 0-7 done by ./filesystems
+>>497	ubyte		!0		setup size 512*%u
+>>497	ubyte		=0		setup size 512*4 (not 0)
+# 500 MasterBootRecord 4th partition entry end sectors+cylinder bits 8-9 done by ./filesystems
+# 501 MasterBootRecord 4th partition entry end cylinder bits 0-7 done by ./filesystems
+# syssize; 32-bit code size in 16-byte paragraphs; since protocol 2.04 long before unreliable short
+>>518	uleshort	<0x204		\b,
+# 0 (ldntldr.bin) 0 (memdisk16.bin) f180h (damnsmll.lnx)
+>>>500	uleshort	x		syssize %#x
+>>518	uleshort	>0x203		\b,
+# 0 (plpbtrom.bin) 1270h (linux-elks) 217eh (memtest32.bin) 22deh (memtest64.bin) 2c01h (memtest86+.bin) 459c6h (linux misinterpreted as swap_dev 0X4) 70c32h (linux64 misinterpreted as swap_dev 0X7)
+>>>500	ulelong		x		syssize %#x
+# jump; jump instruction relative to byte 0x202
+>>512	ubyte		=0xEB		\b, jump
+# jump adress like: 0x230 (damnsmll.lnx) 0x240 (memdisk16.bin) 0x268 (memtest32.bin memtest64.bin ldntldr.bin linux AFTER handover offset) 0x26c (linux64)
+>>>513	byte+2		x		0x2%2.2x
+# next instruction like:
+# b800088ec00fb60e	mov ax,0x0800; mov es,ax; movzx cx,byte []					memdisk16.bin
+# 8cc88ed88ec0e88b00	movw %cs,%ax; movw %ax,%ds; movw %ax,%es; call get_mem_info			memtest32.bin
+# 8cc88ed88ec0e88b00	movw %cs,%ax; movw %ax,%ds; movw %ax,%es; call get_mem_info			memtest64.bin
+>>>(513.b+514)		ubequad		x	%#16.16llx instruction
+# without jump instruction like: 0 (bootsect-lilo-24.2.b EOF!) 0xb8 (mov linux-elks) 0xfa (cli memtest86+.bin)
+>>512	ubyte		!0xEB		\b, at 0x200 %#x instruction
+# boot protocol version field valid since version >= 2.00 which is indicated by HdrS magic
+# so skip memtest86+.bin with misinterpreted protocol 144.0 (0x9000)
+>>514	string		HdrS		\b,
+# Boot protocol version; 2.3 (ldntldr.bin damnsmll.lnx) 2.6 (plpbtrom.bin) 2.10 2.11 (linux) 2.12 (memtest32.bin) 2.13 2.15 (linux64)
+>>>519	ubyte		x		protocol %u
+>>>518	ubyte		x		\b.%u
+# boot protocol in hexadecimal needed for addtional tests
+#>>>518	uleshort	x		(%#4.4x)
+# type_of_loader; Boot loader identifier; filled out by the bootloader
+>>>528		ubyte		>0	\b, loader %#x
+# loadflags; boot protocol option flags
+#>>>529	ubyte		x		loadflags=%#x
+# loadflags bit 1 (kernel internal); KASLR_FLAG KASLR status to kernel
+>>>529	ubyte&0x02	!0		\b, KASLR enabled
+# loadflags bit 5 (write); QUIET_FLAG
+>>>529	ubyte&0x20	!0		\b, quiet
+# loadflags bit 6 (write) since boot protocal version >= 2.07; KEEP_SEGMENTS
+>>>518	uleshort	>0x206
+>>>>529	ubyte&0x40	!0		\b, keep segments
+# loadflags bit 7 (write); CAN_USE_HEAP
+>>>529	ubyte&0x80	!0		\b, can use heap
+# payload_offset; since boot protocol 2.08 if non-zero contains offset of the protected-mode code to the payload like: cdh (linux) 40dh (linux64)
+>>>518	uleshort	>0x207
+>>>>584	ulelong		>0		\b, from protected-mode code at offset %#x
+# payload_length; since boot protocol 2.08 the length of the payload like: 452c41h (linux) 6fb644h (linux64)
+>>>>>588 ulelong	x		%#x bytes
+# jump setup size sectors a 512 bytes from kernel beginning
+>>>>>(497.b*512)	ubequad	x
+#>>>>>(497.b*512)	ubequad	x	512BYTES_BEFORE_PROTECTED-MODE_CODE=%#16.16llx
+# jump payload_offset bytes + 512 bytes (for boot sector) - 8 (ubequad length) to payload start
+#>>>>>>&(584.l+504) ubeshort	x	PAYLOAD=%#4.4x
+# supported compression formats are gzip (magic numbers 1F8B or 1F9E linux) bzip2 (425A), LZMA (5D00 linux64), XZ (FD37) LZ4 (0221) ZST v0.8+ (28B5)
+>>>>>>&(584.l+504) ubeshort	=0x1F8B	gzip compressed
+>>>>>>&(584.l+504) ubeshort	=0x1F9E	gzip compressed
+>>>>>>&(584.l+504) ubeshort	=0x425A	bzip2 compressed
+>>>>>>&(584.l+504) ubeshort	=0x5D00	LZMA compressed
+>>>>>>&(584.l+504) ubeshort	=0xFD37	XZ compressed
+>>>>>>&(584.l+504) ubeshort	=0x0221	LZ4 compressed
+>>>>>>&(584.l+504) ubeshort	=0x28B5	ZST compressed
+# TODO: handle compressed data by ./compress; difficulties with leading space and duplicate gzip compressed
+#>>>>>>&(584.l+504) indirect	x	COMPRESS_NOT_WORKING
+# setup_move_size; for protocol 2.00-2.01; bytes starting with the beginning of the boot sector
+# like: 0 (ldntldr.bin memdisk16.bin memtest32.bin memtest64.bin plpbtrom.bin) 8000h (damnsmll.lnx linux linux64)
+>>>518	uleshort	<0x202
+>>>>518	uleshort	>0x1FF
+>>>>530	uleshort	x		\b, setup_move_size %#4.4x
+# code32_start; address to jump to in protected mode like: 100000h (linux linux64 memtest32.bin memtest64.bin)
+#>>>>532	ulelong		>0		\b, code32_start %#x
+# kernel_alignment; since boot protocol 2.05 alignment unit required by the kernel (if relocatable_kernel is true) like: 0 (plptrom.bin) 1000h (memtest32.bin memtest64.bin) 200000h (linux) 1000000h (linux64)
+#>>>518	uleshort	>0x204
+#>>>>560	ulelong		x		\b, kernel_alignment %#x
+# relocatable_kernel; since boot protocol 2.05 the protected-mode part of the kernel can be loaded at any address if this field is nonzero
+>>>518	uleshort	>0x204
+>>>>564	ubyte		=1		\b, relocatable
+#>>>>564	ubyte		x		\b, relocatable_kernel=%u
+# min_alignment; since boot protocol 2.10 if nonzero, indicates as a power of two the minimum alignment required like: 12 (4 KB memtest32.bin memtest64.bin) 13 (8 KB linux) 21 (2 MB linux64)
+#>>>518	uleshort	>0x209
+#>>>>565	ubyte		>0		\b, min_alignment %u
+# xloadflags; since boot protocol 2.12 like: 3fh (linux64 unexpected value) 4h(memtest32.bin) 9h(memtest64.bin)
+>>>518	uleshort	>0x20B
+#>>>>566	uleshort	x		\b, xloadflags=%#4.4x
+# handover_offset; offset from beginning of kernel image to EFI handover protocol entry point like:
+# 0 (damnsmll.lnx ldntldr.bin) 10h (memtest32.bin memtest64.bin) 30h (linux) 190h (linux64) 8e9000b8h (plpbtrom.bin INVALID!)
+# this value makes only sense when 32 or 64-bit EFI handoff entry point
+>>>>566	uleshort&0x000C	!0		\b, handover offset
+>>>>>612 ulelong	x		%#x
+# Bit 0 XLF_KERNEL_64; if 1, this kernel has the legacy 64-bit entry point at 0x200
+>>>>566	uleshort&0x0001	!0		\b, legacy 64-bit entry point
+# Bit 1 XLF_CAN_BE_LOADED_ABOVE_4G; if 1, kernel/boot_params/cmdline/ramdisk can be above 4G
+>>>>566	uleshort&0x0002	!0		\b, can be above 4G
+# Bit 2 XLF_EFI_HANDOVER_32; if 1, the kernel supports the 32-bit EFI handoff entry point
+>>>>566	uleshort&0x0004	!0		\b, 32-bit EFI handoff entry point
+# Bit 3 XLF_EFI_HANDOVER_64; if 1, the kernel supports the 64-bit EFI handoff entry point
+>>>>566	uleshort&0x0008	!0		\b, 64-bit EFI handoff entry point
+# Bit 4 EFI_KEXEC; if 1, the kernel supports kexec EFI boot with EFI runtime support
+>>>>566	uleshort&0x0010	!0		\b, EFI kexec boot support
+# GRR: What does bit 5 mean?
+>>>>566	uleshort&0x0020	!0		\b, xloadflags bit 5
+# cmdline_size; since boot protocol 2.06 maximum size of the kernel command line like: 255 (memtest32.bin memtest64.bin) 2047 (linux linux64 plpbtrom); version <= 2.06 maximum was 255
+>>>518	uleshort	>0x205
+>>>>568	ulelong		x		\b, max cmdline size %u
+# hardware_subarch; since boot protocol 2.07 hardware subarchtecture like: 0~default x86 1~lguest 2~Xen 3~Moorestown 4~CE4100 TV
+>>>518	uleshort	>0x206
+>>>>572	ulelong		>0		\b, hardware_subarch %u
+# hardware_subarch_data; since boot protocol 2.07 pointer to data specific for hardware subarch; unused for default x86
+>>>>>576 ulequad	>0		\b, hardware_subarch_data %#llx
+# setup_data; since boot protocol 2.09 64-bit physical pointer to NULL terminated single linked list of struct setup_data
+>>>518	uleshort	>0x208
+>>>>592	ulequad		>0		\b, setup_data %16.16llx
+# pref_address; since boot protocol 2.10 if nonzero preferred load address for kernel like: 100000h (memtest32.bin memtest64.bin) 200000h (linux) 1000000h (linux64)
+#>>>518	uleshort	>0x209
+#>>>>600	ulequad		>0		\b, pref_address %#llx
+# init_size; since boot protocol 2.10 indicates amount of contiguous memory kernel needs before it is capable of examining its memory map
+# like: 0h (damnsmll.lnx) 687f8h (memtest32.bin) 6acf8h (memtest64.bin) aa3000h (linux) 2514000h (linux64) 67ea0000h (memdisk16.bin INVALID) a4f3f2ffh (plpbtrom.bin INVALID) ffffff80h (ldntldr.bin INVALID)
+>>>518	uleshort	>0x209
+>>>>608	ulelong		x		\b, init_size %#x
 # This also matches new kernels, which were caught above by "HdrS".
-0		belong	0xb8c0078e	Linux kernel
+# but also few samples without "HdrS" magic like: bootsect-lilo-24.2.b linux-elks memtest86+.bin
+# URL:		https://tldp.org/HOWTO/Linux-i386-Boot-Code-HOWTO/bootsect.html
+#0		belong	0xb8c0078e	Linux kernel
+0		belong	0xb8c0078e
+# to display Linux x86 kernel or Linux ELKS Kernel (strength=70=70+0) after VBR boot sector (130=70+60) DOS/MBR IPL (115=50+65), MBR boot sector (105=40+65) via ./filesystem
+#!:strength +0
+# "newer" kernel (with HdrS magic) already done before
+>514	string		HdrS
+# so handle "old" kernel variant (without HdrS magic)
+>514	default	x			Linux
+#!:mime	application/octet-stream
+!:mime	application/x-linux-kernel
+# GRR: in file 5.45 remaining default clause not working for samples with size = 512 like LILO 24.2 bootsect.b
+>>0	belong	x
+# ELKS kernel variant is now unified with other "old" kernel variant (without HdrS magic)
+>>0x1e6		belong		=0x454c4b53	ELKS Kernel
+!:ext	/
+# "old" kernel variant and not ELKS
+>>0x1e6		belong		!0x454c4b53	x86 kernel
+!:ext	/b/bin
+# show kernel version information based on "Loading" message offset
+>>0		use	kernel-version-old1
+# unified "old" variant with start instruction \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 
+>>4		string		\xd8\xb8\x00\x90
+# show kernel version information part 2 for "old" kernel variant (without HdrS magic) based on new HdrS field
+>>>0		use	kernel-version-old2
+# show kernel version information part 3 for "old" kernel variant (without HdrS magic) based on new HdrS field
+>>>0		use	kernel-version-old3
+# show common kernel information 
+>>0		use	kernel-info
+# show kernel version information part 1 for "old" kernel variant (without HdrS magic) based on "Loading" message offset
+0		name	kernel-version-old1
 >0x1e3		string	Loading		version 1.3.79 or older
 >0x1e9		string	Loading		from prehistoric times
+# LILO 24.2-5.1 bootsect.b
+>0x1c5		string	Loading			from LILO 24.2
+# Memtest86 5.31b memtest86+.bin
+>0x1d2		string	Loading			from Memtest86 5.31b
+# DamnSmallLinux kernel version 2.4.26 damnsmll.lnx not needed because done by kernel_version pointer
+#>0x1cb		string	Loading			damnsmll.lnx 2.4.26~
+# Memtest86+ v6.20 memtest32.bin not needed because done by kernel_version pointer
+#>0x1c6		string	Loading\040Memtest86+	from Memtest86+ v6.20
 
 # System.map files - Nicolas Lichtmaier <nick@debian.org>
 8	search/1	\ A\ _text	Linux kernel symbol map text
@@ -183,13 +379,37 @@
 ############################################################################
 # Linux kernel versions
 
-0		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
+# apply only to "old" kernel variant (without HdrS magic) like damnsmll.lnx memtest86+.bin
+# wrong (497 setup_sects 498 root_flags) and now already done by 1st unified "old" kernel variant
+#0		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
+0		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90foo	OLD_VARIANT Linux
 >497		leshort		0		x86 boot sector
+>>0		use	kernel-version-old2
+>497		leshort		!0		x86 kernel
+# not needed any more because information is now shown by common kernel-info with other phrases
+>>0		use	kernel-info-old
+# kernel version information part 3 for "old" kernel variant (without HdrS magic) based on HdrS field
+>>0		use	kernel-version-old3
+>>0		use	kernel-version-4
+# version information part 2 for "old" kernel variant (without HdrS magic) based on new HdrS field
+0		name	kernel-version-old2
+# dummy test to get same magic indention level like in v 1.85
+>518		leshort		x
 >>514		belong		0x8e	of a kernel from the dawn of time!
 >>514		belong		0x908ed8b4	version 0.99-1.1.42
 >>514		belong		0x908ed8b8	for memtest86
-
+# dummy test function to get same magic indention level like in v 1.85
+0		name	kernel-version-dummy
 >497		leshort		!0		x86 kernel
+# not needed any more because information is now shown by kernel-info
+#>0		use	kernel-info-old
+>>0		use	kernel-info
+# kernel version information part 3 for "old" kernel variant (without HdrS magic) based on HdrS field
+>0		use	kernel-version-old3
+# deprecated because same information is shown by kernel-info with other phrases
+0		name	kernel-info-old
+# dummy test to get same magic indention level like in v 1.85
+>504		leshort		x
 >>504		leshort		>0		RAMdisksize=%u KB
 >>502		leshort		>0		swap=%#X
 >>508		leshort		>0		root=%#X
@@ -199,6 +419,10 @@
 >>506		leshort		0xFFFE		vga=extended
 >>506		leshort		0xFFFD		vga=ask
 >>506		leshort		>0		vga=%d
+# kernel version information part 3 for "old" kernel variant (without HdrS magic) based on HdrS field
+0		name	kernel-version-old3
+# dummy test to get same magic indention level like in v 1.85
+>514		belong		x
 >>514		belong		0x908ed881	version 1.1.43-1.1.45
 >>514		belong		0x15b281cd
 >>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
@@ -207,16 +431,27 @@
 >>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
 >>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
 >>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
+# show kernel version information part 4 for kernel variant (with HdrS magic) based on "HdrS" field
+# not needed any more because information is now shown by common kernel-info
+0		name	kernel-version-4
+# dummy test to get same magic indention level like in v 1.85
+>518		leshort		x
 >>514		string		HdrS
 >>>518		leshort		>0x1FF
 >>>>529		byte		0		\b, zImage
 >>>>529		byte		1		\b, bzImage
+# GRR: Not valid if kernel_version=0
 >>>>(526.s+0x200) string 	>\0		\b, version %s
 
 # Linux boot sector thefts.
-0		belong		0xb8c0078e	Linux
->0x1e6		belong		0x454c4b53	ELKS Kernel
->0x1e6		belong		!0x454c4b53	style boot sector
+# ELKS kernel variant is now unified with above "old" kernel variant (without HdrS magic)
+#0		belong		0xb8c0078e	Linux
+# display "Linux ELKS Kernel" or "Linux style boot sector" (strength=70) after DOS/MBR IPL (115=50+65) and MBR boot sector (105=40+65) via ./filesystem
+#!:strength +0
+# https://en.wikipedia.org/wiki/Embeddable_Linux_Kernel_Subset
+# https://github.com/jbruchon/elks/releases/download/v0.6.0/fd2880-fat.img/linux
+#>0x1e6		belong		0x454c4b53	ELKS Kernel
+#>0x1e6		belong		!0x454c4b53	style boot sector
 
 ############################################################################
 # Linux S390 kernel image
@@ -238,16 +473,44 @@
 # Linux ARM compressed kernel image
 # From: Kevin Cernekee <cernekee@gmail.com>
 # Update: Joerg Jenderek
+# Update: Luke T. Shumaker
+0	name	arm-zimage
+# Version indicators
+>0x34	lelong	0x45454545	(kernel >=v4.15)
+>0x34	lelong	!0x45454545
+>>0x30	clear	x
+>>0x30	belong	0x04030201	(kernel >=v3.17, <v4.15)
+>>0x30	lelong	0x04030201	(kernel >=v3.17, <v4.15)
+>>0x30	default x	(kernel <v3.17)
+# Endianness indicators
+#
+# The kernel has 3 endianness modes: little-endian, and 2 variants of
+# big-endian: BE-32 (ARMv5) and BE-8 (ARMv6+).
+#
+# In kernels <v3.17:
+#  - the 0x016f2818 @ 0x24 magic number indicates big-endian or
+#    little-endian (can't distinguish between BE-8 and BE-32)
+# In kernels >=v3.17:
+#  - a new 0x04030201 @ 0x30 magic number indicates big-endian or
+#    little-endian, but doesn't distinguish between BE-8 and BE-32
+#  - the old 0x016f2818 @ 0x24 magic number is little-endian for
+#    LE *and* BE-8, or big-endian for BE-32
+#
+# >=v3.17
+>0x30	clear	x
+>0x30	belong	0x04030201	(big-endian,
+>>0x24	belong	0x016f2818	BE-32, ARMv5)
+>>0x24	lelong	0x016f2818	BE-8, ARMv6+)
+>0x30	lelong	0x04030201	(little-endian)
+# <v3.17
+>0x30	default x
+>>0x24	lelong	0x016f2818	(little-endian)
+>>0x24	belong	0x016f2818	(big-endian)
+
 0x24	lelong	0x016f2818	Linux kernel ARM boot executable zImage
-# There are three possible situations: LE, BE with LE bootloader and pure BE.
-# In order to aid telling these apart a new endian flag was added. In order
-# to support kernels before the flag and BE with LE bootloader was added we'll
-# do a negative check against the BE variant of the flag when we see a LE magic.
->0x30	belong	!0x04030201	(little-endian)
-# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin"
-!:ext	img/bin
->0x30	belong	0x04030201	(big-endian)
-0x24	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)
+>0	use	arm-zimage
+0x24	belong	0x016f2818	Linux kernel ARM boot executable zImage
+>0	use	arm-zimage
 
 ############################################################################
 # Linux AARCH64 kernel image
@@ -259,6 +522,12 @@
 >0x18   lelong  &6          \b, 32K pages
 
 ############################################################################
+# Linux RISC-V kernel image
+0x38	string	RSC\05		Linux kernel RISC-V boot executable Image
+>0x18	lelong	^1		\b, little-endian
+>0x18	lelong	&1		\b, big-endian
+
+############################################################################
 # Linux 8086 executable
 0	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
 >5	string		.
@@ -357,26 +626,12 @@
 >8	lelong	x	version %d,
 >12	lelong	x	chunk_size %d
 
-# SE Linux policy database
-0	lelong	0xf97cff8c		SE Linux policy
->16	lelong	x			v%d
->20	lelong	1			MLS
->24	lelong	x			%d symbols
->28	lelong	x			%d ocons
-
 # Summary: Xen saved domain file
 # Created by: Radek Vokal <rvokal@redhat.com>
 0	string		LinuxGuestRecord	Xen saved domain
 >20	search/256	(name
 >>&1	string		x			(name %s)
 
-# Type: Xen, the virtual machine monitor
-# From: Radek Vokal <rvokal@redhat.com>
-0	string		LinuxGuestRecord	Xen saved domain
-#>2	regex		\(name\ [^)]*\)		%s
->20	search/256	(name			(name
->>&1	string		x			%s...)
-
 # Systemd journald files
 # See https://www.freedesktop.org/wiki/Software/systemd/journal-files/.
 # From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>
@@ -541,12 +796,90 @@
 # Site:        https://fedorahosted.org/mlocate/
 # Format docs: https://linux.die.net/man/5/mlocate.db
 # Type: mlocate database file
+# URL:		https://en.wikipedia.org/wiki/Locate_(Unix)
 # URL:  https://fedorahosted.org/mlocate/
 # From: Wander Nauta <info@wandernauta.nl>
+# Update:	Joerg Jenderek
 0		string		\0mlocate	mlocate database
->12		byte		x		\b, version %d
+#!:mime	application/octet-stream
+!:mime	application/x-mlocate
+# default mlocate.db if not overriden with --output option of updatedb
+!:ext	db
+# at the moment value is 0; a higher version will probably not occur, because mlocate is now often replaced by plocate
+>12		byte		!0		\b, version %d
+# configured with -l option of updatedb
 >13		byte		1		\b, require visibility
+# 2 byte pad for 32-bit total alignment 
+#>14		short		!0		\b, padding %#x
+# standard is 1 byte / if not overriden with --database-root option of updatedb
 >16		string		x		\b, root %s
+# 1st variable name nil terminated like: prune_bind_mounts
+>>&1		string		x		\b, 1st variable %s
+# 1st variable value like: 0 1
+>>>&1		string		x		\b=%s
+# configuration block size in big endian like: 82 85 174 181 185 483 491 496 497 556 600 
+>8		ubelong		x		\b, configuration size %u
+
+# URL:		https://plocate.sesse.net/
+# Reference:	https://plocate.sesse.net/download/plocate-1.1.19.tar.gz
+#		plocate-1.1.19/db.h
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/d/db-plocate.trid.xml
+# Note:		called "plocate database" by TrID
+# magic[8]
+0		string		\0plocate	plocate database
+#!:mime		application/octet-stream
+!:mime		application/x-plocate
+# default /var/lib/plocate/plocate.db if not overriden with --output option of updatedb.plocate 
+!:ext		db
+# version; 2 is the current version
+>8		ulelong    	!1		\b, version %u
+# hashtable_size; like 1 (for "empty" samples) 1b5c3h
+#>12		ulelong    	>1		\b, hash table size %#x
+# extra_ht_slots; like: 10h
+>16		ulelong    	!0x10		\b, extra_ht_slots %#x
+# num_docids; like 0 (for "empty" samples) a132h
+>20		ulelong    	>0		\b, num_docids %u
+# hash_table_offset_bytes; 78h (for "empty" samples) afdf99h
+#>24		ulequad    	!0x78		\b, hash table offset %#llx
+# filename_index_offset_bytes; 70h (for "empty" samples) aad571h
+#>32		ulequad    	!0x70		\b, filename index offset %#llx
+# version 1 and up only
+>8		ulelong    	>0
+# max_version;  nominally 1 or 2 but can be increased if more features are added in a backward-compatible way
+>>40		ulelong    	!2		\b, max version %u
+# zstd_dictionary_length_bytes; 0 (for "empty" samples) 400h
+>>44		ulelong    	!0		\b, at %#x
+# zstd_dictionary_offset_bytes; 0 (for "empty" samples) 70h
+>>48		ulequad    	>0		\b+%#llx
+# jump to beginning of zstd dictionary
+>>>(48.q)		ubequad    	x
+# jump realative zstd dictionary length bytes - 8 (quad length) forward to ZST data beginning
+#>>>>&(44.l-8)		ubelong    	x		ZST=%8.8x
+>>>>&(44.l-8)		ubelong    	x
+# print 1 space char after zstd_dictionary_offset and then handles Zstandard compressed data by ./compress
+# to get phrase like "at 0x400+0x70 Zstandard compressed data (v0.8+)"
+>>>>>&-4		indirect	x		\b 
+# only if max_version >= 2 and only relevant for updatedb
+>40		ulelong    	>1
+# directory_data_length_byte
+#>>56		ulequad    	x		\b, directory data length %#llx
+# directory_data_offset_bytes;
+#>>64		ulequad    	x		offset %#llx
+# next_zstd_dictionary_length_bytes; 0 (for "empty" samples) 400h
+>>72		ulequad    	>0		\b, next zstd dictionary length %#llx
+# next_zstd_dictionary_offset_bytes; 0 (for "empty" samples) 14b9cb8h
+>>>80		ulequad    	>0		offset %#llx
+# conf_block_length_bytes like; 65 147 148 151 152 452 537 540 543 
+>>88		ulequad    	x		\b, configuration size %llu
+# conf_block_offset_bytes; 1a1h (for "empty" samples) 14ba0b8h
+>>96		ulequad    	>0		\b, at %#llx 1st variable
+# 1st variable name nil terminated like: prune_bind_mounts
+>>>(96.q)	string    	x		%s
+# 1st variable value nil terminated like: 0 1
+>>>>&1		string		x		\b=%s
+# bool check_visibility; 0 or 1 configured with -l option of updatedb.plocate
+>>104		ubyte    	1		\b, require visibility
+#>>104		ubyte    	x		\b, check_visibility %#x
 
 # Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL:
 # https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
@@ -625,3 +958,13 @@
 >124	ubyte		!0x79
 >>124	ubyte		>0x40			\b, english y is %c
 #>764	ubyte		x			\b, english Y is %c
+
+
+# From: Ben Dooks <ben.dooks@codethink.co.uk>
+# URL: https://github.com/torvalds/linux/blob/master/tools/perf/util/header.c
+# perf files for v1 and v2
+0	string		PERFFILE		Linux perf recording, version 1
+
+0	lequad		0x32454c4946524550	Linux perf recording, version 2. little endian
+
+0	bequad		0x32454c4946524550	Linux perf recording, version 2. big endian

magic/Magdir/lisp

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: lisp,v 1.27 2020/08/14 19:23:39 christos Exp $
+# $File: lisp,v 1.28 2024/05/30 15:32:20 christos Exp $
 # lisp:  file(1) magic for lisp programs
 #
 # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
@@ -76,3 +76,13 @@
 # From: David Allouche <david@allouche.net>
 0	search/1	\<TeXmacs|	TeXmacs document text
 !:mime	text/texmacs
+
+# Chibi-Scheme
+0	string	\a\achibi\n			Chibi-Scheme memory image data
+>8	ubyte	=0				\b, big-endian
+>>9	ubyte	x				\b, format version %d
+>>11	ubyte	x				\b.%d
+>8	ubyte	>0				\b, little-endian
+>>8	ubyte	x				\b, format version %d
+>>10	ubyte	x				\b.%d
+>12	string	x				\b, ABI %s

magic/Magdir/magic

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: magic,v 1.11 2023/06/27 13:42:49 christos Exp $
+# $File: magic,v 1.12 2024/06/10 23:09:52 christos Exp $
 # magic:  file(1) magic for magic files
 #
 # Update:	Joerg Jenderek
@@ -10,13 +10,19 @@
 !:mime	text/x-file
 # no suffix in ../Header
 !:ext	/
-#
-# some samples start with a comment line
+# 
+# some (34/339) samples start with a comment line
 0	ubyte		=0x23
-# many samples start with separator line
+# some (28/339) samples start with separator line (about 78 minus characters) like:
+# archive arm assembler beetle c-lang clojure compress der filesystems firmware gentoo lammps
+# m4 mail.news make marc21 music parrot pascal pc88 pc98 perl ringdove tcl varied.script webassembly x68000 zfs
 >4	string		--------
->>0	use		magic-fragment
-# few samples with 1st comment line and without seperator comment line
+# skip scripts fse.sed stage1.sed constants.pxi gotmail.awk from fetchmail package by
+# searching for reference to man page file(1) {lammps v 1.1} or file (1) {muscic v 1.1}
+>>12	search/180	(1)
+>>>0	use		magic-fragment
+# few (6/339) samples with 1st comment line and without separator comment line
+# like: blcr bsi selinux sisu ssh svf
 >4	default		x
 # few sample with 1st comment line and without seperator comment line and regular expression like: sisu
 >>1	search/112	regex\x09
@@ -33,10 +39,22 @@
 >>>>>0	use		magic-fragment
 # but many samples start with an empty first line
 0	ubyte		=0x0A
-# many samples sttart with separator comment line
+# many samples start with separator comment line
 >4	string		--------
->>0	use		magic-fragment
-# few samples with 1st empty line and without seperator comment line like: biosig espressif
+# skip some MS-DOS C source text {EMSINIT.INC MEM.C RESTPARS.C RTDO.C RTDO1.C RTFILE.C RTFILE1.C RTNEW.C RTNEW1.C RTOLD.C RTOLD1.C RTT1.C RTT3.C}
+# and match many fragments by looking for Revision Control System keyword near the beginning
+>>1	search/128	$File
+>>>0	use		magic-fragment
+# few samples {ctf (2022-03-26) msx (2021-06-30) nasa (2021-02-23) symbos (2021-02-23) weak (2021-02-23)}
+# with 1st empty line, separator comment line and without Revision Control System keyword but with reference to man page file(1)
+>>1	default		x
+>>>1	search/180	file(1)
+>>>>0	use		magic-fragment
+>>>1	default		x
+# sample aria (2021-12-24) with 1st empty line, separator comment line and without Revision Control System keyword and without reference to man page file(1) 
+>>>>1	search/1024	\041:mime
+>>>>>0	use		magic-fragment
+# few samples with 1st empty line and without separator comment line like: biosig (2021-02-23) espressif (v 1.3)
 >4	default		x
 >>1	search/581	\041:mime
 >>>0	use		magic-fragment
@@ -47,14 +65,21 @@
 # most without suffix but mail.news varied.out varied.script
 !:ext	/news/out/script
 # next lines are mainly for control reasons
-# some (34/339) samples start comment line
+# some (34/339) samples start with comment line
 >0	ubyte		!0x0A
 >>0	string		x		\b, 1st line "%s"
 >>>&1	string		x		\b, 2nd line "%s"
+# show more information to see difference between fragments and misidentfied scripts
+>>>>&1	string		x		\b, 3rd line "%s"
+>>>>>&1	string		x		\b, 4th line "%s"
+>>>>>>&1 string		x		\b, 5th line "%s"
 # but most (305/339) samples start with an empty first line
 >0	ubyte		=0x0A
 >>1	string		x		\b, 2nd line "%s"
 >>>&1	string		x		\b, 3rd line "%s"
+# show more information to see difference between fragments and misidentfied scripts
+>>>>&1	string		x		\b, 4th line "%s"
+>>>>>&1	string		x		\b, 5th line "%s"
 #
 # URL:		http://en.wikipedia.org/wiki/File_(command)
 # Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mgc.trid.xml
@@ -64,6 +89,8 @@
 !:mime application/x-file
 !:ext	mgc
 >4	lelong		x		(version %d) (little endian)
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mgc-be.trid.xml
+# Note:		called "magic compiled data (BE)" by TrID
 0	belong		0xF11E041C	magic binary file for file(1) cmd
 #!:mime	application/octet-stream
 !:mime application/x-file

magic/Magdir/mail.news

@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: mail.news,v 1.30 2022/10/31 13:22:26 christos Exp $
+# $File: mail.news,v 1.32 2024/11/10 16:59:38 christos Exp $
 # mail.news:  file(1) magic for mail and news
 #
 # Unfortunately, saved netnews also has From line added in some news software.
@@ -26,6 +26,12 @@
 !:mime	message/rfc822
 0	string/t		Date:		news or mail text
 !:mime	message/rfc822
+0	string/t		Subject:	news or mail text
+!:mime	message/rfc822
+0	string/t		Cc:		news or mail text
+!:mime	message/rfc822
+0	string/t		To:		news or mail text
+!:mime	message/rfc822
 0	string/t		Article 	saved news text
 !:mime	message/news
 # Reference:	http://quimby.gnus.org/notes/BABYL
@@ -43,6 +49,20 @@
 0	string/t		MIME-Version:	MIME entity text
 #0	string/t		Content-	MIME entity text
 
+# From:		Joerg Jenderek
+# URL:		https://tools.ietf.org/rfc/rfc4155.txt
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mbox.trid.xml
+# Note:		called "Standard Unix Mailbox" by TrID and
+#		"mailbox file" by shared MIME-info database
+#https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/master/data/freedesktop.org.xml.in?ref_type=heads
+0	string			From\040	Mailbox text
+#!:mime	text/plain
+!:mime	application/mbox
+# like: INBOX 1.mbox
+!:ext	/mbox
+# For control reasons show first line like: "From - Tue May 30 21:55:54 2023" "From noreply@unitymedia.info  Thu Oct 13 17:23:38 2016"
+>0	string		x	\b, 1st line "%s"
+
 # TNEF files...
 # URL:		http://fileformats.archiveteam.org/wiki/Transport_Neutral_Encapsulation_Format
 #		https://en.wikipedia.org/wiki/Transport_Neutral_Encapsulation_Format

magic/Magdir/map

@@ -1,7 +1,6 @@
 
-
 #------------------------------------------------------------------------------
-# $File: map,v 1.10 2023/02/03 20:41:57 christos Exp $
+# $File: map,v 1.11 2024/06/10 23:09:52 christos Exp $
 # map:  file(1) magic for Map data
 #
 

magic/Magdir/meteorological

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: meteorological,v 1.4 2022/12/09 18:02:09 christos Exp $
+# $File: meteorological,v 1.6 2024/11/10 17:05:08 christos Exp $
 # rinex:  file(1) magic for RINEX files
 # http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
 # ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
@@ -44,10 +44,21 @@
 !:mime	rinex/observation
 
 # https://en.wikipedia.org/wiki/GRIB
+# https://www.iana.org/assignments/media-types/application/grib
 0	string	GRIB
 >7	byte 	=1	Gridded binary (GRIB) version 1
-!:mime	application/x-grib
+!:mime	application/grib;edition=1
 !:ext	grb/grib
 >7	byte	=2	Gridded binary (GRIB) version 2
-!:mime	application/x-grib2
+!:mime	application/grib;edition=2
 !:ext	grb2/grib2
+
+# BUFR is a meteorological data format for storing point or time series data.
+# https://www.iana.org/assignments/media-types/application/bufr
+0	string	BUFR
+>7	byte	=3	Binary Universal Form data (BUFR) Edition 3
+!:mime	application/bufr
+!:ext	bufr
+>7	byte	=4	Binary Universal Form data (BUFR) Edition 4
+!:mime	application/bufr
+!:ext	bufr

magic/Magdir/mips

@@ -1,120 +1,102 @@
 
 #------------------------------------------------------------------------------
-# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $
+# $File: mips,v 1.15 2024/09/01 13:49:15 christos Exp $
 # mips:  file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
 # and DEC Ultrix
 #
-0	beshort	0x0160		MIPSEB ECOFF executable
->20	beshort	0407		(impure)
->20	beshort	0410		(swapped)
->20	beshort	0413		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
+0	name			display-mips-ecoff
+>20	leshort	0407		(impure)
+>20	leshort	0410		(swapped)
+>20	leshort	0413		(paged)
+>8	lelong	!0		not stripped
+>8	lelong	0		stripped
 >22	byte	x		- version %d
 >23	byte	x		\b.%d
 #
-0	beshort	0x0162		MIPSEL-BE ECOFF executable
->20	beshort	0407		(impure)
->20	beshort	0410		(swapped)
->20	beshort	0413		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
->23	byte	x		- version %d
->22	byte	x		\b.%d
-#
-0	beshort	0x6001		MIPSEB-LE ECOFF executable
->20	beshort	03401		(impure)
->20	beshort	04001		(swapped)
->20	beshort	05401		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
->23	byte	x		- version %d
->22	byte	x		\b.%d
-#
-0	beshort	0x6201		MIPSEL ECOFF executable
->20	beshort	03401		(impure)
->20	beshort	04001		(swapped)
->20	beshort	05401		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
->23	byte	x		- version %d
->22	byte	x		\b.%d
+# MIPS 1
+#
+0	beshort	0x0160
+>16	beshort	56		MIPSEB ECOFF executable
+>>0	use			\^display-mips-ecoff
+>16	leshort	0
+>>0	use			display-coff
+#
+0	beshort	0x0162
+>16	beshort	56		MIPSEL-BE ECOFF executable
+>>0	use			\^display-mips-ecoff
+#
+0	leshort	0x0160
+>16	leshort	56		MIPSEB-LE ECOFF executable
+>>0	use			display-mips-ecoff
+>16	leshort	0
+>>0	use			display-coff
+#
+0	leshort	0x0162
+>16	leshort	56		MIPSEL ECOFF executable
+>>0	use			display-mips-ecoff
 #
 # MIPS 2 additions
 #
-0	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
->20	beshort	0407		(impure)
->20	beshort	0410		(swapped)
->20	beshort	0413		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
->22	byte	x		- version %d
->23	byte	x		\b.%d
+0	beshort	0x0163
+>16	beshort	56		MIPSEB MIPS-II ECOFF executable
+>>0	use			\^display-mips-ecoff
 #
-0	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
->20	beshort	0407		(impure)
->20	beshort	0410		(swapped)
->20	beshort	0413		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
->22	byte	x		- version %d
->23	byte	x		\b.%d
+0	beshort	0x0166
+>16	beshort	56		MIPSEL-BE MIPS-II ECOFF executable
+>>0	use			\^display-mips-ecoff
+>16	leshort	0
+>>0	use			display-coff
+#
+0	leshort	0x0163
+>16	leshort	56		MIPSEB-LE MIPS-II ECOFF executable
+>>0	use			display-mips-ecoff
 #
-0	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
->20	beshort	03401		(impure)
->20	beshort	04001		(swapped)
->20	beshort	05401		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
->23	byte	x		- version %d
->22	byte	x		\b.%d
-#
-0	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
->20	beshort	03401		(impure)
->20	beshort	04001		(swapped)
->20	beshort	05401		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
->23	byte	x		- version %d
->22	byte	x		\b.%d
+0	leshort	0x0166
+>16	leshort	56		MIPSEL MIPS-II ECOFF executable
+>>0	use			display-mips-ecoff
 #
 # MIPS 3 additions
 #
-0	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
->20	beshort	0407		(impure)
->20	beshort	0410		(swapped)
->20	beshort	0413		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
->22	byte	x		- version %d
->23	byte	x		\b.%d
+0	beshort	0x0140
+>16	beshort	56		MIPSEB MIPS-III ECOFF executable
+>>0	use			\^display-mips-ecoff
 #
-0	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
->20	beshort	0407		(impure)
->20	beshort	0410		(swapped)
->20	beshort	0413		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
->22	byte	x		- version %d
->23	byte	x		\b.%d
+0	beshort	0x0142
+>16	beshort	56		MIPSEL-BE MIPS-III ECOFF executable
+>>0	use			\^display-mips-ecoff
 #
-0	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
->20	beshort	03401		(impure)
->20	beshort	04001		(swapped)
->20	beshort	05401		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
->23	byte	x		- version %d
->22	byte	x		\b.%d
-#
-0	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
->20	beshort	03401		(impure)
->20	beshort	04001		(swapped)
->20	beshort	05401		(paged)
->8	belong	>0		not stripped
->8	belong	0		stripped
->23	byte	x		- version %d
->22	byte	x		\b.%d
+0	leshort	0x0140
+>16	leshort	56		MIPSEB-LE MIPS-III ECOFF executable
+>>0	use			display-mips-ecoff
+#
+0	leshort	0x0142
+>16	leshort	56		MIPSEL MIPS-III ECOFF executable
+>>0	use			display-mips-ecoff
+#
+# MIPS Ucode additions
 #
 0	beshort	0x180		MIPSEB Ucode
 0	beshort	0x182		MIPSEL-BE Ucode
+#
+# MIPS COFF object file (have zero length optional header)
+#
+0	leshort			0x0168
+>16	leshort			0
+>>0	use			display-coff
+# can be created by LINK.EXE /MACHINE:MIPSR10 /ROM
+>16	leshort			!0
+>>18	leshort			&0x0002
+>>>20	leshort			0x0107
+>>>>0	use			display-coff
+0	leshort	0x0169
+>16	leshort	0
+>>0	use			display-coff
+0	leshort	0x0266
+>16	leshort	0
+>>0	use			display-coff
+0	leshort	0x0366
+>16	leshort	0
+>>0	use			display-coff
+0	leshort	0x0466
+>16	leshort	0
+>>0	use			display-coff

magic/Magdir/mmdf

@@ -1,6 +1,25 @@
 
 #------------------------------------------------------------------------------
-# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
+# $File: mmdf,v 1.7 2024/02/29 03:40:37 christos Exp $
 # mmdf:  file(1) magic for MMDF mail files
+# Update:	Joerg Jenderek Feb 2024
+# URL:		https://en.wikipedia.org/wiki/MMDF
+# Reference:	https://docs.oracle.com/cd/E88353_01/html/E37852/mmdf-5.html
+# Note:		Multi-channel Memorandum Distribution Facility (MMDF) mailbox format is a legacy variant of mbox format
+#		(handled by ./mail.news); each message is surrounded by lines containing 4 control-A
 #
-0	string	\001\001\001\001	MMDF mailbox
+0	string	\001\001\001\001
+# GRR: MMDF mailbox (strength=70=70+0 ./mmdf) after D64 Image (strength=70=70+0 ./c64) Targa image data (strength=70=110-40 ./images)
+# and before "PDP-11 UNIX/RT ldp" (strength=50=50+0 ./pdp)
+#!:strength +0
+# skip few Commodore disc Image where first content are initialized with ^A like "The Great Gianna Sisters.d64"
+# by looking for following valid line terminator (10=0Ah~LineFeed or 13=0Dh~CarriageReturn)
+#>4		ubyte&0xF8	=0x08	MMDF mailbox
+# or by looking for MBOX Mailbox (/mail.news) characteristic like:
+# https://github.com/dfandrich/oldmailconvert/blob/master/testdata/uupc.input.1
+>5	search/610/b		From\ 	MMDF mailbox
+#!:mime	application/octet-stream
+!:mime	message/x-mmdf
+# https://github.com/dfandrich/oldmailconvert/blob/master/testdata/maillog.expected.2
+# but default mailbox name is like /usr/spool/mail/username
+!:ext	/mmdf

magic/Magdir/motorola

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: motorola,v 1.12 2021/04/26 15:56:00 christos Exp $
+# $File: motorola,v 1.13 2024/02/11 21:25:17 christos Exp $
 # motorola:  file(1) magic for Motorola 68K and 88K binaries
 #
 # 68K
@@ -18,6 +18,12 @@
 >12	belong		>0		not stripped
 0	beshort		0522		mc68k executable (shared demand paged)
 >12	belong		>0		not stripped
+
+# Motorola 68000 COFF object file
+0	leshort		0x0268
+>16	leshort		0
+>>0	use		display-coff
+
 #
 # Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
 #

magic/Magdir/msooxml

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: msooxml,v 1.19 2023/03/14 19:46:15 christos Exp $
+# $File: msooxml,v 1.23 2024/07/19 18:48:23 christos Exp $
 # msooxml:  file(1) magic for Microsoft Office XML
 # From: Ralf Brown <ralf.brown@gmail.com>
 
@@ -38,31 +38,40 @@
 # since some documents include a 520-byte extra field following the file
 # header, we need to scan for the next header
 >>>(18.l+49)	search/6000	PK\003\004
+>>>>&26		use		msooxml
+>>>>&26		default		x
 # now skip to the *third* local file header; again, we need to scan due to a
 # 520-byte extra field following the file header
->>>>&26		search/6000	PK\003\004
+>>>>>&26	search/6000	PK\003\004
 # and check the subdirectory name to determine which type of OOXML
-# file we have.  Correct the mimetype with the registered ones:
+# file we have.	 Correct the mimetype with the registered ones:
 # https://technet.microsoft.com/en-us/library/cc179224.aspx
->>>>>&26		use		msooxml	
->>>>>&26		default		x
+>>>>>>&26	use		msooxml
+>>>>>>&26	default		x
 # OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
->>>>>>&26	search/6000	PK\003\004
->>>>>>>&26	use		msooxml	
+>>>>>>>&26	search/6000	PK\003\004
+>>>>>>>>&26	use		msooxml
 # Some OOXML generators add an extra customXml directory. Check another file.
->>>>>>>&26	default		x
->>>>>>>>&26	search/6000	PK\003\004
->>>>>>>>>&26	use		msooxml	
+>>>>>>>>&26	default		x
+>>>>>>>>>&26	search/6000	PK\003\004
+>>>>>>>>>>&26	use		msooxml
+>>>>>>>>>>&26	default		x
+>>>>>>>>>>>&26	search/6000	PK\003\004
+>>>>>>>>>>>>&26	use		msooxml
+>>>>>>>>>>>>&26	default		x		Microsoft OOXML
+>>>>>>>>>>>&26	default		x		Microsoft OOXML
+>>>>>>>>>>&26	default		x		Microsoft OOXML
 >>>>>>>>>&26	default		x		Microsoft OOXML
+>>>>>>>>&26	default		x		Microsoft OOXML
 >>>>>>>&26	default		x		Microsoft OOXML
->>>>>&26	default		x		Microsoft OOXML
+>>>>>>&26	default		x		Microsoft OOXML
 >>0x1E		regex		\\[trash\\]
 >>>&26		search/6000	PK\003\004
 >>>>&26		search/6000	PK\003\004
->>>>>&26	use		msooxml	
->>>>>&26	default		x	
+>>>>>&26	use		msooxml
+>>>>>&26	default		x
 >>>>>>&26	search/6000	PK\003\004
->>>>>>>&26	use		msooxml	
+>>>>>>>&26	use		msooxml
 >>>>>>>&26	default		x		Microsoft OOXML
 >>>>>>&26	default		x		Microsoft OOXML
 >>>>>&26	default		x		Microsoft OOXML

magic/Magdir/msvc

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: msvc,v 1.11 2022/01/17 17:17:30 christos Exp $
+# $File: msvc,v 1.12 2024/03/31 15:08:13 christos Exp $
 # msvc:  file(1) magic for msvc
 # "H. Nanosecond" <aldomel@ix.netcom.com>
 # Microsoft visual C
@@ -15,9 +15,14 @@
 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide
 
 # .res
-0	string	\000\000\000\000\040\000\000\000\377	MSVC .res
-0	string	\377\003\000\377\001\000\020\020\350	MSVC .res
-0	string	\377\003\000\377\001\000\060\020\350	MSVC .res
+# https://learn.microsoft.com/en-us/windows/win32/menurc/resource-file-formats
+# https://learn.microsoft.com/en-us/windows/win32/menurc/resourceheader
+# A binary resource file consists of a number of concatenated resource entries.
+# Each entry consists of a resource header and the data for that resource.
+# Resource file starts with an empty resource entry with 32-byte long header in
+# which is stored ordinal type 0 and ordinal name 0.
+0	string	\000\000\000\000\040\000\000\000\377\377\000\000\377\377\000\000	Microsoft Visual C binary resource file
+!:ext	res
 
 #.lib
 # URL: 		https://en.wikipedia.org/wiki/Microsoft_Visual_C%2B%2B

magic/Magdir/msx

@@ -1,5 +1,6 @@
 
 #------------------------------------------------------------------------------
+# $File: msx,v 1.12 2024/08/30 17:29:28 christos Exp $
 # msx:  file(1) magic for the MSX Home Computer
 # v1.3
 # Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
@@ -202,21 +203,6 @@
 >>4	uleshort	>0			\b, stahdl=%#04x
 >>6	uleshort	>0			\b, devhdl=%#04x
 >>8	uleshort	>0			\b, bas=%#04x
-0	string/b		AB\0\0
->6	uleshort	0
->>4	uleshort	>0x400F			MSX-BASIC extension ROM
->>>4	uleshort	>0			\b, stahdl=%#04x
->>>6	uleshort	>0			\b, devhdl=%#04x
->>>0x1C		string		OPLL			\b, MSX-Music
->>>>0x18	string		PAC2			\b (external)
->>>>0x18	string		APRL			\b (internal)
-
-0	string/b		AB\0\0\0\0
->6	uleshort	>0x400F			MSX device BIOS
->>6	uleshort	>0			\b, devhdl=%#04x
-
-
-0	string/b		AB
 #>2	string		5JSuperLAYDOCK		MSX Super Laydock ROM
 #>3	string		@HYDLIDE3MSX		MSX Hydlide-3 ROM
 #>3	string		@3\x80IA862		Golvellius MSX1 ROM
@@ -242,6 +228,21 @@
 >>>>>6	uleshort	0
 >>>>>>8	uleshort	>0			MSX BASIC program in ROM, bas=%#04x
 
+0	string/b		AB\0\0
+>6	uleshort	0
+>>4	uleshort	>0x400F			MSX-BASIC extension ROM
+>>>4	uleshort	>0			\b, stahdl=%#04x
+>>>6	uleshort	>0			\b, devhdl=%#04x
+>>>0x1C		string		OPLL			\b, MSX-Music
+>>>>0x18	string		PAC2			\b (external)
+>>>>0x18	string		APRL			\b (internal)
+
+0	string/b		AB\0\0\0\0
+>6	uleshort	>0x400F			MSX device BIOS
+>>6	uleshort	>0			\b, devhdl=%#04x
+
+
+
 0x4000	string/b		AB
 >0x4002	uleshort	>0x400F
 >>0x400A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order

magic/Magdir/music

@@ -1,6 +1,6 @@
 #------------------------------------------------------------------------------
-# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
-# music:  file (1) magic for music formats
+# $File: music,v 1.2 2024/06/10 23:09:52 christos Exp $
+# music:  file(1) magic for music formats
 
 # BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
 # and Bagpipe Writer by Doug Wickstrom

magic/Magdir/nasa

@@ -1,6 +1,7 @@
 
 #------------------------------------------------------------------------------
-# nasa:	file(1) magic
+# $File: nasa,v 1.3 2024/06/10 23:09:52 christos Exp $
+# nasa:	file(1) magic for NASA SPICE file
 
 # From: Barry Carter <carter.barry@gmail.com>
 0	string	DAF/SPK				NASA SPICE file (binary format)

magic/Magdir/ole2compounddocs

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: ole2compounddocs,v 1.26 2023/05/15 16:46:12 christos Exp $
+# $File: ole2compounddocs,v 1.29 2024/06/18 17:07:48 christos Exp $
 # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
 # storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
 # Additional tests for OLE 2 Compound Documents should be under this recipe.
@@ -319,6 +319,18 @@
 #>>>>>>&0	use		PageMaker
 # THIS WORKS PARTLY!
 >>>>>>&0	indirect	x
+#
+# URL:		http://fileformats.archiveteam.org/wiki/Easy_CD_Creator
+# From:		Joerg Jenderek
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/c/cl4.trid.xml
+# Note:		called "Easy CD Creator Layout" by TrID
+#		"newer" version 4 contain a clsid
+# Second directory entry name Contents
+>>>>128 	lestring16	Contents		: Easy CD Creator 2 Layout
+# contains also 3 strings SesnDescriptor CD_PLUS 0090
+#!:mime	application/x-ole-storage
+!:mime	application/x-corel-cl2
+!:ext	cl2
 #	remaining null clsid
 >>>>128 	default		x
 >>>>>0 	use		ole2-unknown
@@ -503,10 +515,17 @@
 # https://extension.nirsoft.net/wsb
 # like: wsbsamp.wsb WORKS2003_CD:\MSWorks\Common\Sammlung.wsb
 !:ext	wsb
-#??
-# URL:	http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
+#
+# Update:	Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/Microsoft_Publisher
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pub.trid.xml
+# Note:		called like "Microsoft Publisher document" by TrID
+#		"version" string MSPublisher.2 inside CompObj stream
 >>88 	ubequad		0x00c0000000000046	: Microsoft
->>>80 	ubequad		0x0112020000000000	Publisher
+>>>80 	ubequad		0x0012020000000000	Publisher 95 (2.0)
+!:mime	application/vnd.ms-publisher
+!:ext	pub
+>>>80 	ubequad		0x0112020000000000	Publisher 97-2013 (3.0-11.0)
 !:mime	application/vnd.ms-publisher
 !:ext	pub
 #
@@ -731,6 +750,33 @@
 !:ext	max
 # also chr for character file according to DROID https://www.nationalarchives.gov.uk/PRONOM/fmt/978
 #!:ext	max/chr
+# From:		Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/IPT
+#		https://en.wikipedia.org/wiki/Autodesk_Inventor
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/i/ipt.trid.xml
+# Note:		called "Autodesk Inventor Part" by TrID
+# second, third, fifth and seventh directory entry name like RSeStorage RSeEmbeddings RefdFiles RSeDb
+>>88 	ubequad		0x93c37e0706000000	: Autodesk
+>>>80 	ubequad		0x90b4294db249d011	Inventor Part
+#!:mime	application/x-ole-storage
+!:mime	model/x-autodesk-ipt
+!:ext	ipt
+# From:		Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/Easy_CD_Creator
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/c/cl4.trid.xml
+# Note:		called "Easy CD Creator Layout" by TrID,
+#		"Easy CD Creator 4" by CREATR32.exe and "Easy CD Creator Document" on Windows
+#		verified by Michal Mutl Structured Storage Viewer `SSView.exe MY_CD3.cl4`
+#		verified partly by libolecf-utils `olecfinfo -v MY_CD4.cl4`
+#		created by Adaptec Easy CD Creator 4.02b
+#		"older" version 2 contain no clsid
+>>88 	ubequad		0x893f00802964b632	: Easy
+>>>80 	ubequad		0x0293c3a90a77d111	CD Creator 4 Layout
+#!:mime	application/x-ole-storage
+!:mime	application/x-corel-cl4
+!:ext	cl4
+# maybe also suffix cl3
+#!:ext	cl3/cl4
 # remaining non null clsid
 >>88 	default		x
 >>>0 	use		ole2-unknown

magic/Magdir/olf

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
+# $File: olf,v 1.5 2024/02/29 03:42:40 christos Exp $
 # olf:  file(1) magic for OLF executables
 #
 # We have to check the byte order flag to see what byte order all the
@@ -43,11 +43,11 @@
 >>18	leshort		0		no machine,
 >>18	leshort		1		AT&T WE32100 - invalid byte order,
 >>18	leshort		2		SPARC - invalid byte order,
->>18	leshort		3		Intel 80386,
+>>18	leshort		3		Intel i386,
 >>18	leshort		4		Motorola 68000 - invalid byte order,
 >>18	leshort		5		Motorola 88000 - invalid byte order,
->>18	leshort		6		Intel 80486,
->>18	leshort		7		Intel 80860,
+>>18	leshort		6		Intel i486,
+>>18	leshort		7		Intel i860,
 >>18	leshort		8		MIPS R3000_BE - invalid byte order,
 >>18	leshort		9		Amdahl - invalid byte order,
 >>18	leshort		10		MIPS R3000_LE,
@@ -74,11 +74,11 @@
 >>18	beshort		0		no machine,
 >>18	beshort		1		AT&T WE32100,
 >>18	beshort		2		SPARC,
->>18	beshort		3		Intel 80386 - invalid byte order,
+>>18	beshort		3		Intel i386 - invalid byte order,
 >>18	beshort		4		Motorola 68000,
 >>18	beshort		5		Motorola 88000,
->>18	beshort		6		Intel 80486 - invalid byte order,
->>18	beshort		7		Intel 80860,
+>>18	beshort		6		Intel i486 - invalid byte order,
+>>18	beshort		7		Intel i860,
 >>18	beshort		8		MIPS R3000_BE,
 >>18	beshort		9		Amdahl,
 >>18	beshort		10		MIPS R3000_LE - invalid byte order,

magic/Magdir/pack

@@ -0,0 +1,101 @@
+#------------------------------------------------------------------------------
+# $File: pack,v 1.1 2024/08/30 17:29:28 christos Exp $
+# file(1) magic for things that have PACK as magic
+
+0	string	PACK
+# Type: Git pack
+# From: Adam Buchbinder <adam.buchbinder@gmail.com>
+# Update: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/Git
+# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt
+# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
+# those have a little-endian offset immediately following the magic 'PACK',
+# the first byte of which is never 0, while the first byte of the Git pack
+# version, since it's a tiny number stored in big-endian format, is always 0.
+# GRR: line above is too general as it matches also PackDir archive ./acorn
+# test for major version. Git 2017 accepts version number 2 or 3
+>4	ubelong	<9
+# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc
+# or SystemDevice::foobar
+>>9	search/13 ::
+# but in git binary
+>>9	default	x	Git pack
+!:mime	application/x-git
+!:ext	pack
+# 4 GB limit implies unsigned integer
+>>>4	ubelong	x		\b, version %u
+>>>8	ubelong	x		\b, %u objects
+
+# From: Joerg Jenderek
+# URL: https://www.kyzer.me.uk/pack/xad/#PackDir
+# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c
+# GRR: line below is too general as it matches also "Git pack" in ./revision
+# check for valid compression method 0-4
+>5	ulelong	<5
+# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems
+# To skip "Git pack" version 0 test for root directory object like
+# ADFS::RPC.$.websitezip.FONTFIX
+>>9	string	>ADFS\  PackDir archive (RISC OS)
+# TrID labels above as "Acorn PackDir compressed Archive"
+# compression mode y (0 - 4) for GIF LZW with a maximum n bits
+# (y~n,0~12,1~13,2~14,3~15,4~16)
+>>>5	ulelong+12 x	\b, LZW %u-bits compression
+# https://www.filebase.org.uk/filetypes
+# !Packdir compressed archive has three hexadecimal digits code 68E
+!:mime	application/x-acorn-68E
+!:ext	pkd/bin
+# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
+>>>9	string	x	\b, root "%s"
+# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
+>>>>&1	ulelong	x	\b, load address %#x
+# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
+>>>>&5	ulelong	x	\b, exec address %#x
+# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
+>>>>&9	ulelong	x	\b, attributes %#x 
+# number of entries in this directory. for root dir 0
+#>>>&13	ulelong	x	\b, entries %#x 
+# the entries start here with object name
+>>>>&17	string	x	\b, 1st object "%s"
+
+# Update: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/PAK
+# reference: https://quakewiki.org/wiki/.pak
+# GRR: line below is too general as it matches also Acorn PackDir compressed Archive
+# real Quake examples like pak0.pak have only some hundreds like 150 files
+# So test for few files
+>8	ulelong <0x01000000	
+# in file version 5.32 test for null terminator is only true for
+# offset ~< FILE_BYTES_MAX = 1 MB defined in ../../src/file.h 
+# look for null terminator of 1st entry name
+>>(4.l+55)	ubyte	0	Quake I or II world or extension
+!:mime	application/x-dzip
+!:ext	pak
+#>>>8	ulelong	x	\b, table size %u
+# dividing this by entry size (64) gives number of files
+>>>8	ulelong/64 x	\b, %u files
+# offset to the beginning of the file table
+>>>4	ulelong	x	\b, offset %#x
+# 1st file entry
+>>>(4.l)	use	pak-entry
+# 2nd file entry
+#>>>4	ulelong+64	x	\b, offset %#x
+#>>>(4.l+64)	use	pak-entry
+#
+#	display file table entry of Quake PAK archive
+0	name		pak-entry
+# normally entry start after header which implies offset 12 or higher
+>56	ulelong	>11	
+# the offset from the beginning of pak to beginning of this entry file contents
+>>56	ulelong	x	at %#x
+# the size of file for this entry 
+>>60	ulelong	x	%u bytes
+# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp
+>>0	string	x	'%-.56s'
+# inspect entry content by jumping to entry offset
+>>(56)	indirect x	\b: 
+
+#0       string  -1\x0a  Quake I demo
+#>30     string  x        version %.4s
+#>61     string  x        level %s
+
+#0       string  5\x0a   Quake I save

magic/Magdir/pc88

@@ -1,24 +0,0 @@
-#------------------------------------------------------------------------------
-# pc88:  file(1) magic for the NEC Home Computer
-# v1.0
-# Fabio R. Schmidlin <sd-snatcher@users.sourceforge.net>
-
-# PC88 2D disk image
-0x20		ulelong&0xFFFFFEFF	0x2A0
->0x10		string		\0\0\0\0\0\0\0\0\0\0
->>0x280		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
->>>0x1A		ubyte&0xEF	0
->>>>0x1B	ubyte&0x8F	0
->>>>>0x1B	ubyte&70	<0x40
->>>>>>0x1C	ulelong	>0x21
->>>>>>>0		regex	[[:print:]]*	NEC PC-88 disk image, name=%s
->>>>>>>>0x1B	ubyte	0	\b, media=2D
->>>>>>>>0x1B	ubyte	0x10	\b, media=2DD
->>>>>>>>0x1B	ubyte	0x20	\b, media=2HD
->>>>>>>>0x1B	ubyte	0x30	\b, media=1D
->>>>>>>>0x1B	ubyte	0x40	\b, media=1DD
->>>>>>>>0x1A	ubyte	0x10	\b, write-protected
-
-
-
-

magic/Magdir/pdp

@@ -1,7 +1,8 @@
 
 #------------------------------------------------------------------------------
-# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
+# $File: pdp,v 1.12 2024/02/29 03:40:37 christos Exp $
 # pdp:  file(1) magic for PDP-11 executable/object and APL workspace
+# URL: 	https://en.wikipedia.org/wiki/PDP-11
 #
 0	lelong		0101555		PDP-11 single precision APL workspace
 0	lelong		0101554		PDP-11 double precision APL workspace
@@ -12,13 +13,22 @@
 >8	leshort		>0		not stripped
 >15	byte		>0		- version %d
 
-# updated by Joerg Jenderek at Mar 2013
+# updated by Joerg Jenderek at Mar 2013, Feb 2024
 # GRR: line below too general as it catches also Windows precompiled setup information *.PNF
 0	leshort		0401
+# PDP-11 UNIX/RT ldp (strength=50=50+0) after D64 Image (strength=70=70+0 ./c64) and MMDF mailbox (strength=70=70+0 ./mmdf)
+#!:strength +0
 # skip *.PNF with WinDirPathOffset 58h
->68	ulelong		!0x00000058	PDP-11 UNIX/RT ldp
+>68	ulelong		!0x00000058
 # skip *.PNF with high byte of InfVersionDatumCount zero
 #>>15	byte		!0		PDP-11 UNIX/RT ldp
+# skip few Commodore D64 disc image like "The Great Gianna Sisters.d64" initialized with ^A and handled by ./c64 
+>>8	quad		!0x0101010101010101
+# skip MMDF mailbox like maillog.expected.2 with MBOX characteristic near the beginning handled by ./mmdf 
+>>>5	search/610/b	From\ 
+>>>5	default		x		PDP-11 UNIX/RT ldp
+#!:mime	application/octet-stream
+#!:ext	foo
 0	leshort		0405		PDP-11 old overlay
 
 0	leshort		0410		PDP-11 pure executable

magic/Magdir/pgp

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: pgp,v 1.25 2021/04/26 15:56:00 christos Exp $
+# $File: pgp,v 1.26 2024/09/01 15:51:51 christos Exp $
 # pgp:  file(1) magic for Pretty Good Privacy
 
 # Handling of binary PGP keys is in pgp-binary-keys.
@@ -108,15 +108,15 @@
 >7	belong	x			%08X
 >11	byte	0x01			RSA (Encrypt or Sign) 1024b
 >11	byte	0x02			RSA Encrypt-Only 1024b
->12	string	\x04\x00
->12	string	\x03\xff
->12	string	\x03\xfe
->12	string	\x03\xfd
->12	string	\x03\xfc
->12	string	\x03\xfb
->12	string	\x03\xfa
->12	string	\x03\xf9
->142	byte	0xd2			.
+#>12	string	\x04\x00
+#>12	string	\x03\xff
+#>12	string	\x03\xfe
+#>12	string	\x03\xfd
+#>12	string	\x03\xfc
+#>12	string	\x03\xfb
+#>12	string	\x03\xfa
+#>12	string	\x03\xf9
+#>142	byte	0xd2			.
 
 # 2048b RSA encrypted data
 
@@ -125,15 +125,15 @@
 >8	belong	x			%08X
 >12	byte	0x01			RSA (Encrypt or Sign) 2048b
 >12	byte	0x02			RSA Encrypt-Only 2048b
->13	string	\x08\x00
->13	string	\x07\xff
->13	string	\x07\xfe
->13	string	\x07\xfd
->13	string	\x07\xfc
->13	string	\x07\xfb
->13	string	\x07\xfa
->13	string	\x07\xf9
->271	byte	0xd2			.
+#>13	string	\x08\x00
+#>13	string	\x07\xff
+#>13	string	\x07\xfe
+#>13	string	\x07\xfd
+#>13	string	\x07\xfc
+#>13	string	\x07\xfb
+#>13	string	\x07\xfa
+#>13	string	\x07\xf9
+#>271	byte	0xd2			.
 
 # 3072b RSA encrypted data
 
@@ -142,15 +142,15 @@
 >8	belong	x			%08X
 >12	byte	0x01			RSA (Encrypt or Sign) 3072b
 >12	byte	0x02			RSA Encrypt-Only 3072b
->13	string	\x0c\x00
->13	string	\x0b\xff
->13	string	\x0b\xfe
->13	string	\x0b\xfd
->13	string	\x0b\xfc
->13	string	\x0b\xfb
->13	string	\x0b\xfa
->13	string	\x0b\xf9
->399	byte	0xd2			.
+#>13	string	\x0c\x00
+#>13	string	\x0b\xff
+#>13	string	\x0b\xfe
+#>13	string	\x0b\xfd
+#>13	string	\x0b\xfc
+#>13	string	\x0b\xfb
+#>13	string	\x0b\xfa
+#>13	string	\x0b\xf9
+#>399	byte	0xd2			.
 
 # 4096b RSA encrypted data
 
@@ -159,15 +159,15 @@
 >8	belong	x			%08X
 >12	byte	0x01			RSA (Encrypt or Sign) 4096b
 >12	byte	0x02			RSA Encrypt-Only 4096b
->13	string	\x10\x00
->13	string	\x0f\xff
->13	string	\x0f\xfe
->13	string	\x0f\xfd
->13	string	\x0f\xfc
->13	string	\x0f\xfb
->13	string	\x0f\xfa
->13	string	\x0f\xf9
->527	byte	0xd2			.
+#>13	string	\x10\x00
+#>13	string	\x0f\xff
+#>13	string	\x0f\xfe
+#>13	string	\x0f\xfd
+#>13	string	\x0f\xfc
+#>13	string	\x0f\xfb
+#>13	string	\x0f\xfa
+#>13	string	\x0f\xf9
+#>527	byte	0xd2			.
 
 # 8192b RSA encrypted data
 
@@ -176,15 +176,15 @@
 >8	belong	x			%08X
 >12	byte	0x01			RSA (Encrypt or Sign) 8192b
 >12	byte	0x02			RSA Encrypt-Only 8192b
->13	string	\x20\x00
->13	string	\x1f\xff
->13	string	\x1f\xfe
->13	string	\x1f\xfd
->13	string	\x1f\xfc
->13	string	\x1f\xfb
->13	string	\x1f\xfa
->13	string	\x1f\xf9
->1039	byte	0xd2			.
+#>13	string	\x20\x00
+#>13	string	\x1f\xff
+#>13	string	\x1f\xfe
+#>13	string	\x1f\xfd
+#>13	string	\x1f\xfc
+#>13	string	\x1f\xfb
+#>13	string	\x1f\xfa
+#>13	string	\x1f\xf9
+#>1039	byte	0xd2			.
 
 # 1024b Elgamal encrypted data
 
@@ -192,14 +192,14 @@
 >4	belong	x			keyid: %08X
 >8	belong	x			%08X
 >12	byte	0x10			Elgamal Encrypt-Only 1024b.
->13	string	\x04\x00
->13	string	\x03\xff
->13	string	\x03\xfe
->13	string	\x03\xfd
->13	string	\x03\xfc
->13	string	\x03\xfb
->13	string	\x03\xfa
->13	string	\x03\xf9
+#>13	string	\x04\x00
+#>13	string	\x03\xff
+#>13	string	\x03\xfe
+#>13	string	\x03\xfd
+#>13	string	\x03\xfc
+#>13	string	\x03\xfb
+#>13	string	\x03\xfa
+#>13	string	\x03\xf9
 
 # 2048b Elgamal encrypted data
 
@@ -207,14 +207,14 @@
 >4	belong	x			keyid: %08X
 >8	belong	x			%08X
 >12	byte	0x10			Elgamal Encrypt-Only 2048b.
->13	string	\x08\x00
->13	string	\x07\xff
->13	string	\x07\xfe
->13	string	\x07\xfd
->13	string	\x07\xfc
->13	string	\x07\xfb
->13	string	\x07\xfa
->13	string	\x07\xf9
+#>13	string	\x08\x00
+#>13	string	\x07\xff
+#>13	string	\x07\xfe
+#>13	string	\x07\xfd
+#>13	string	\x07\xfc
+#>13	string	\x07\xfb
+#>13	string	\x07\xfa
+#>13	string	\x07\xf9
 
 # 3072b Elgamal encrypted data
 
@@ -222,14 +222,14 @@
 >4	belong	x			keyid: %08X
 >8	belong	x			%08X
 >12	byte	0x10			Elgamal Encrypt-Only 3072b.
->13	string	\x0c\x00
->13	string	\x0b\xff
->13	string	\x0b\xfe
->13	string	\x0b\xfd
->13	string	\x0b\xfc
->13	string	\x0b\xfb
->13	string	\x0b\xfa
->13	string	\x0b\xf9
+#>13	string	\x0c\x00
+#>13	string	\x0b\xff
+#>13	string	\x0b\xfe
+#>13	string	\x0b\xfd
+#>13	string	\x0b\xfc
+#>13	string	\x0b\xfb
+#>13	string	\x0b\xfa
+#>13	string	\x0b\xf9
 
 # crypto algo mapper
 

magic/Magdir/plan9

@@ -1,13 +1,13 @@
 
 #------------------------------------------------------------------------------
-# $File: plan9,v 1.6 2021/07/30 12:25:13 christos Exp $
+# $File: plan9,v 1.7 2024/02/29 03:42:40 christos Exp $
 # plan9:  file(1) magic for AT&T Bell Labs' Plan 9 executables and object files
 # From: "Stefan A. Haubenthal" <polluks@web.de>
 #
 0	belong		0x00000107	Plan 9 executable, Motorola 68k
 0	belong		0x00000197	Plan 9 executable, AT&T Hobbit
-0	belong		0x000001EB	Plan 9 executable, Intel 386
-0	belong		0x00000247	Plan 9 executable, Intel 960
+0	belong		0x000001EB	Plan 9 executable, Intel i386
+0	belong		0x00000247	Plan 9 executable, Intel i960
 0	belong		0x000002AB	Plan 9 executable, SPARC
 0	belong		0x00000407	Plan 9 executable, MIPS R3000
 0	belong		0x0000048B	Plan 9 executable, AT&T DSP 3210
@@ -22,4 +22,4 @@
 0	belong		0x430D013C	Plan 9 object file, AT&T Hobbit
 0	belong		0x4D013201	Plan 9 object file, Motorola 68k
 0	belong		0x7410013C	Plan 9 object file, SPARC
-0	belong		0x7E004501	Plan 9 object file, Intel 386
+0	belong		0x7E004501	Plan 9 object file, Intel i386

magic/Magdir/printer

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: printer,v 1.34 2023/06/16 19:27:12 christos Exp $
+# $File: printer,v 1.36 2024/08/27 18:50:57 christos Exp $
 # printer:  file(1) magic for printer-formatted files
 #
 
@@ -86,19 +86,6 @@
 # (LANGUAGE and Language)
 # For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
 # From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
-#
-0	string		\033%-12345X@PJL	HP Printer Job Language data
->&0	string		>\0			%s
->>&0	string		>\0			%s
->>>&0	string		>\0			%s
->>>>&0	string		>\0			%s
-#>15	string		\ ENTER\ LANGUAGE\ =
-#>31	string		PostScript		PostScript
-
-# From: Stefan Thurner <thurners@nicsys.de>
-0	string		\033%-12345X@PJL
->&0	search/10000	%!			PJL encapsulated PostScript document text
-
 # Rick Richardson <rickrich@gmail.com>
 
 # For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
@@ -106,13 +93,14 @@
 # For Konica Minolta Printers - LAVAFLOW
 # For Samsung Printers - QPDL
 # For HP Printers - ZJS stands for Zenographics ZJStream
-0	string		\033%-12345X@PJL	HP Printer Job Language data
 >0	search/10000	@PJL\ ENTER\ LANGUAGE=HBPL	- HBPL
 >0	search/10000	@PJL\ ENTER\ LANGUAGE=HIPERC	- Oki Data HIPERC
 >0	search/10000	@PJL\ ENTER\ LANGUAGE=LAVAFLOW	- Konica Minolta LAVAFLOW
 >0	search/10000	@PJL\ ENTER\ LANGUAGE=QPDL	- Samsung QPDL
 >0	search/10000	@PJL\ ENTER\ LANGUAGE\ =\ QPDL	- Samsung QPDL
 >0	search/10000	@PJL\ ENTER\ LANGUAGE=ZJS	- HP ZJS
+# From: Stefan Thurner <thurners@nicsys.de>
+>&0	search/10000	%!			PJL encapsulated PostScript document text
 # Summary:	Hewlett-Packard printer firmware update
 # From:		Joerg Jenderek
 # URL:		https://support.hp.com/us-en/drivers/selfservice/hp-envy-6000e-all-in-one-printer-series/2100187505/model/2100187513
@@ -230,8 +218,9 @@
 0	string	PS4
 >0		use		hpgl
 # la.hp
-0	string	BP
->0		use		hpgl
+# Too weak
+#0	string	BP
+#>0		use		hpgl
 # miter.hp
 # Plot Absolute x,y{,x,y{...}}; x and y in range between -32767 and 32768 like: PA4000,3000;
 0	string	PA
@@ -241,8 +230,9 @@
 #>2	regex	\^([-]{0,1}[0-9]{1,5})	COORDINATE=%s
 >>0		use		hpgl
 # pw.hpg	number of pens x
-0	string	NP
->0		use		hpgl
+# Too weak
+#0	string	NP
+#>0		use		hpgl
 # win_1.hp
 #0	string	\003INCA		WHAT_IS_THAT
 #>0		use		hpgl

magic/Magdir/python

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: python,v 1.45 2022/07/24 23:59:37 christos Exp $
+# $File: python,v 1.47 2024/08/27 18:50:57 christos Exp $
 # python:  file(1) magic for python
 #
 # Outlook puts """ too for urgent messages
@@ -191,6 +191,7 @@
 
 # magic 3392+ implements PEP 552: Deterministic pycs
 0	name		pyc-pep552
+>0	uleshort	x	(magic: %04d),
 # the flag field determines how .pyc validity is checked
 >4	ulelong&1	0		timestamp-based,
 >>8	uledate		x		.py timestamp: %s UTC,
@@ -208,24 +209,28 @@
 >>1		ubyte		0x0d		Byte-compiled Python module for
 !:mime application/x-bytecode.python
 # now look at the magic number to determine the version
->>>0		uleshort	<3400		CPython 3.7,
+>>>0		uleshort	<3400		CPython 3.7
 >>>0		default		x
->>>>0		uleshort	<3420		CPython 3.8,
+>>>>0		uleshort	<3420		CPython 3.8
 >>>>0		default		x
->>>>>0		uleshort	<3430		CPython 3.9,
+>>>>>0		uleshort	<3430		CPython 3.9
 >>>>>0		default		x
->>>>>>0		uleshort	<3450		CPython 3.10,
+>>>>>>0		uleshort	<3450		CPython 3.10
 >>>>>>0		default		x
->>>>>>>0	uleshort	<3500		CPython 3.11,
->>>>>>>0	default		x		CPython 3.12 or newer,
+>>>>>>>0	uleshort	<3500		CPython 3.11
+>>>>>>>0	default		x
+>>>>>>>>0	uleshort	<3550		CPython 3.12
+>>>>>>>>0	default		x
+>>>>>>>>>0	uleshort	<3600		CPython 3.13
+>>>>>>>>>0	default		x		CPython 3.14 or newer
 >>>0		use		pyc-pep552
->>0		uleshort	240		Byte-compiled Python module for PyPy3.7,
+>>0		uleshort	240		Byte-compiled Python module for PyPy3.7
 !:mime application/x-bytecode.python
 >>>0		use		pyc-pep552
->>0		uleshort	256		Byte-compiled Python module for PyPy3.8,
+>>0		uleshort	256		Byte-compiled Python module for PyPy3.8
 !:mime application/x-bytecode.python
 >>>0		use		pyc-pep552
->>0		uleshort	336		Byte-compiled Python module for PyPy3.9,
+>>0		uleshort	336		Byte-compiled Python module for PyPy3.9
 !:mime application/x-bytecode.python
 >>>0		use		pyc-pep552
 
@@ -245,6 +250,9 @@
 >0	regex		\^from[\040\t]+([A-Za-z0-9_]|\\.)+[\040\t]+import.*$	Python script text executable
 !:strength + 15
 !:mime text/x-script.python
+>0	regex		\^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
+!:mime text/x-script.python
+
 
 # def __init__ (self, ...):
 0	search/4096	def\ __init__
@@ -259,11 +267,6 @@
 !:strength + 15
 !:mime text/x-script.python
 
-# import module [as abrev]
-0	search/8192	import
->0	regex	\^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
-!:mime text/x-script.python
-
 # comments
 #0	search/4096	'''
 #>&0	regex	.*'''$	Python script text executable

magic/Magdir/revision

@@ -1,7 +1,8 @@
 
 #------------------------------------------------------------------------------
-# $File: revision,v 1.11 2019/04/19 00:42:27 christos Exp $
+# $File: revision,v 1.12 2024/08/30 17:29:28 christos Exp $
 # file(1) magic for revision control files
+
 # From Hendrik Scholz <hendrik@scholz.net>
 0	string/t	/1\ :pserver:	cvs password text file
 
@@ -13,30 +14,6 @@
 # From: Josh Triplett <josh@freedesktop.org>
 0	string	#\ v2\ git\ bundle\n	Git bundle
 
-# Type: Git pack
-# From: Adam Buchbinder <adam.buchbinder@gmail.com>
-# Update: Joerg Jenderek
-# URL: http://fileformats.archiveteam.org/wiki/Git
-# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt
-# The actual magic is 'PACK', but that clashes with Doom/Quake packs. However,
-# those have a little-endian offset immediately following the magic 'PACK',
-# the first byte of which is never 0, while the first byte of the Git pack
-# version, since it's a tiny number stored in big-endian format, is always 0.
-0	string	PACK
-# GRR: line above is too general as it matches also PackDir archive ./acorn
-# test for major version. Git 2017 accepts version number 2 or 3
->4	ubelong	<9
-# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc
-# or SystemDevice::foobar
->>9	search/13 ::
-# but in git binary
->>9	default	x	Git pack
-!:mime	application/x-git
-!:ext	pack
-# 4 GB limit implies unsigned integer
->>>4	ubelong	x		\b, version %u
->>>8	ubelong	x		\b, %u objects
-
 # Type: Git pack index
 # From: Adam Buchbinder <adam.buchbinder@gmail.com>
 0	string	\377tOc		Git pack index

magic/Magdir/riff

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: riff,v 1.45 2022/07/24 23:47:49 christos Exp $
+# $File: riff,v 1.50 2024/04/13 16:40:48 christos Exp $
 # riff:  file(1) magic for RIFF format
 # See
 #
@@ -140,24 +140,39 @@
 >>&(4.l+4)  use riff-walk
 >0  string  fact
 >>&(4.l+4)  use riff-walk
->0  string  VP8
+# https://developers.google.com/speed/webp/docs/riff_container
+>0  string  VP8\x20
 >>11		byte		0x9d
 >>>12		byte		0x01
 >>>>13		byte		0x2a	\b, VP8 encoding
 >>>>>14		leshort&0x3fff	x	\b, %d
 >>>>>16		leshort&0x3fff	x	\bx%d, Scaling:
 >>>>>14		leshort&0xc000	0x0000	\b [none]
->>>>>14		leshort&0xc000	0x1000	\b [5/4]
->>>>>14		leshort&0xc000	0x2000	\b [5/3]
->>>>>14		leshort&0xc000	0x3000	\b [2]
->>>>>14		leshort&0xc000	0x0000	\bx[none]
->>>>>14		leshort&0xc000	0x1000	\bx[5/4]
->>>>>14		leshort&0xc000	0x2000	\bx[5/3]
->>>>>14		leshort&0xc000	0x3000	\bx[2]
+>>>>>14		leshort&0xc000	0x4000	\b [5/4]
+>>>>>14		leshort&0xc000	0x8000	\b [5/3]
+>>>>>14		leshort&0xc000	0xc000	\b [2]
+>>>>>16		leshort&0xc000	0x0000	\bx[none]
+>>>>>16		leshort&0xc000	0x4000	\bx[5/4]
+>>>>>16		leshort&0xc000	0x8000	\bx[5/3]
+>>>>>16		leshort&0xc000	0xc000	\bx[2]
 >>>>>15		byte&0x80	=0x00	\b, YUV color
 >>>>>15		byte&0x80	=0x80	\b, bad color specification
 >>>>>15		byte&0x40	=0x40	\b, no clamping required
 >>>>>15		byte&0x40	=0x00	\b, decoders should clamp
+>0  string  VP8L
+>>8		byte		0x2f	\b, lossless
+>>>11		byte		&0x01	\b, with alpha
+>0  string  VP8X
+>>4		lelong		0x0a
+>>>8		byte		&0x02	\b, animated
+>>>8		byte		&0x04	\b, XMP metadata
+>>>8		byte		&0x08	\b, EXIF metadata
+>>>8		byte		&0x10	\b, with alpha
+>>>8		byte		&0x20	\b, ICC profile
+# TODO: These two values are off-by-one, for a 64x64 WebP they contain
+# 63x63 as there can be no 0x0 file.
+>>>12		lelong&0xffffff	x	\b, %d+1
+>>>15		lelong&0xffffff	x	\bx%d+1
 #>0  string  x		we got %s
 #>>&(4.l+4)  use riff-walk
 
@@ -332,6 +347,35 @@
 # MORE TESTS NEEDED HERE!
 #>>>0	use		corel-des
 #>>>0	use		corel-draw
+# From:		Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/SHW_(Corel)
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/s/shw-corel.trid.xml
+# Note:		called "CorelSHOW presentation (v4)" by TrID
+#		and "Corel Presentation" by DROID via PUID fmt/877
+>8	string		shw4		\b, CorelSHOW presentation, version 4
+#!:mime	application/octet-stream
+!:mime	application/x-corel-shw
+!:ext	shw
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/s/shw-corel-5.trid.xml
+# Note:		called "CorelSHOW presentation (v5)" by TrID
+>8	string		shw5		\b, CorelSHOW presentation, version 5
+#!:mime	application/octet-stream
+!:mime	application/x-corel-shw
+!:ext	shw
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/s/shb-corel.trid.xml
+# Note:		called "CorelSHOW Background (v5)" by TrID
+>8	string		shl5		\b, CorelSHOW Background, version 5
+#!:mime	application/octet-stream
+!:mime	application/x-corel-shb
+# GRR: no example
+!:ext	shb
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/s/shr-corel.trid.xml
+# Note:		called "CorelSHOW player data (v5)" by TrID
+>8	string		shr5		\b, CorelSHOW player data, version 5
+#!:mime	application/octet-stream
+!:mime	application/x-corel-shr
+# GRR: no example
+!:ext	shr
 >8	string		NUNDROOT	\b, Steinberg CuBase
 # From:		Joerg Jenderek
 # URL:		http://fileformats.archiveteam.org/wiki/MIDI_Instrument_Definition_File
@@ -354,6 +398,17 @@
 >>0x31	search/256	inst		by
 # probably manufacture name like: "Unspecified Company" "NVidia Corporation"
 >>>&0x24	string	x		"%s"
+# From:		Joerg Jenderek
+# URL:		https://en.wikipedia.org/wiki/Microsoft_Flight_Simulator
+# Reference:	https://www.fsdeveloper.com/wiki/index.php?title=MDL_file_format_(FSX)
+#		http://mark0.net/download/triddefs_xml.7z/defs/m/mdl-fs-gen.trid.xml
+# Note:		called "Microsoft Flight Simulator 3D model (generic)" by TrID
+>8	string		MDL
+>>12	string		MDLH		\b, Microsoft Flight Simulator 3D model
+#!:mime	application/x-riff
+!:mime	application/x-ms-mdl
+!:ext	mdl
+#>>>8	string		MDL8		\b, version 8?
 # AVI == Audio Video Interleave
 # Reference:	http://fileformats.archiveteam.org/wiki/AVI
 >8	string		AVI\040		\b, AVI
@@ -650,6 +705,22 @@
 !:mime	application/x-trid-trd
 !:ext	trd
 # From:		Joerg Jenderek
+# URL:		http://fileformats.archiveteam.org/wiki/Easy_CD_Creator
+#		https://en.wikipedia.org/wiki/Roxio
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/i/img-cif.trid.xml
+# Note:		called "Easy CD Creator disk image" by TrID,
+#		"Adaptec CD Image File" by Adaptec CD Creator 2.1.082 1995-1996 and
+#		"Easy CD/DVD Creator image" by PowerISO 8.5
+>8      string          imag            \b, Easy CD Creator disk image
+#!:mime	application/octet-stream
+#!:mime	application/x-riff
+!:mime	application/x-corel-cif
+!:ext	cif
+# contains also 2 strings disc info
+# look for ISO 9660 CD-ROM tag handled by ./filesystems
+>>32769	search/4565/s	CD001	\b; with
+>>>&-32769	use	cdrom
+# From:		Joerg Jenderek
 # URL:		https://en.wikipedia.org/wiki/CorelDRAW
 # Reference:	http://fileformats.archiveteam.org/wiki/CorelDRAW
 # Note:		Since version 3 CorelDraw Pictures are RIFF based

magic/Magdir/rpm

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
+# $File: rpm,v 1.13 2023/10/31 21:46:28 christos Exp $
 #
 # RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
 #
@@ -28,6 +28,11 @@
 >>8	beshort		16		PowerPC64
 >>8	beshort		17		SuperH
 >>8	beshort		18		Xtensa
+>>8	beshort		19		AArch64
+>>8	beshort		20		MIPSr6
+>>8	beshort		21		MIPS64r6
+>>8	beshort		22		RISC-V64
+>>8	beshort		23		LoongArch64
 >>8	beshort		255		noarch
 
 #delta RPM    Daniel Novotny (dnovotny@redhat.com)
@@ -42,4 +47,9 @@
 >>8	beshort		16		PowerPC64
 >>8	beshort		17		SuperH
 >>8	beshort		18		Xtensa
+>>8	beshort		19		AArch64
+>>8	beshort		20		MIPSr6
+>>8	beshort		21		MIPS64r6
+>>8	beshort		22		RISC-V64
+>>8	beshort		23		LoongArch64
 >>10	string		x		%s

magic/Magdir/sgml

@@ -1,45 +1,49 @@
 
 #------------------------------------------------------------------------------
-# $File: sgml,v 1.48 2023/01/18 16:10:21 christos Exp $
+# $File: sgml,v 1.53 2024/11/10 14:48:55 christos Exp $
 # Type:	SVG Vectorial Graphics
 # From:	Noel Torres <tecnico@ejerciciosresueltos.com>
-0	string		\<?xml\ version=
+0	string/bt	\<?xml\ version=
 >14	regex		['"\ \t]*[0-9.]+['"\ \t]*
 >>19	search/4096	\<svg			SVG Scalable Vector Graphics image
+!:strength +50
 !:mime	image/svg+xml
 !:ext   svg
 >>19	search/4096	\<gnc-v2		GnuCash file
 !:mime	application/x-gnucash
-0	string		\<svg			SVG Scalable Vector Graphics image
+0	string/bt	\<svg			SVG Scalable Vector Graphics image
 !:mime	image/svg+xml
 !:ext   svg
 
-# Sitemap file
-0	string/t		\<?xml\ version=
 >14	regex		['"\ \t]*[0-9.]+['"\ \t]*
+# Sitemap file
 >>19	search/4096	\<urlset		XML Sitemap document text
 !:mime	application/xml-sitemap
 
+# XML-based format representing braille pages in a digital format.
+#
+# Specification:
+# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html
+#
+# Simon Aittamaa <simon.aittamaa@gmail.com>
+>>19    search/4096	\<pef           Portable Embosser Format
+!:mime  application/x-pef+xml
+
 # OpenStreetMap XML (.osm)
 # https://wiki.openstreetmap.org/wiki/OSM_XML
 # From: Markus Heidelberg <markus.heidelberg@web.de>
-0	string		\<?xml\ version=
->14	regex		['"\ \t]*[0-9.]+['"\ \t]*
 >>19	search/4096	\<osm			OpenStreetMap XML data
 
 # xhtml
-0	string/t		\<?xml\ version="
 >19	search/4096/cWbt	\<!doctype\ html	XHTML document text
 >>15	string		>\0	(version %.3s)
-!:mime	text/html
-0	string/t		\<?xml\ version='
->19	search/4096/cWbt	\<!doctype\ html	XHTML document text
->>15	string		>\0	(version %.3s)
-!:mime	text/html
-0	string/t		\<?xml\ version="
->19	search/4096/cWbt	\<html	broken XHTML document text
+!:strength + 15
+!:mime	application/xhtml+xml
+
+>19	search/4096/cWbt	\<html\ xmlns=		XHTML document text
 >>15	string		>\0	(version %.3s)
-!:mime	text/html
+!:mime	application/xhtml+xml
+
 
 #------------------------------------------------------------------------------
 # sgml:  file(1) magic for Standard Generalized Markup Language
@@ -53,11 +57,14 @@
 # avoid misdetection as JavaScript
 0	string/cWt	\<!doctype\ html	HTML document text
 !:mime	text/html
+!:strength + 30
 0	string/ct	\<html>	HTML document text
 !:mime	text/html
+!:strength + 30
 0	string/ct	\<!--
 >&0	search/4096/cWt	\<!doctype\ html	HTML document text
 !:mime	text/html
+!:strength + 30
 >&0	search/4096/ct	\<html>	HTML document text
 !:mime	text/html
 
@@ -65,69 +72,68 @@
 # https://www.w3.org/TR/SVG/single-page.html
 0	search/4096/cWbt	\<!doctype\ svg	SVG XML document
 !:mime  image/svg+xml
-!:strength + 15
+!:strength + 30
 
 0	search/4096/cwt	\<head\>		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 0	search/4096/cWt	\<head\ 		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 0	search/4096/cwt	\<title\>		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 0	search/4096/cWt	\<title\ 		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 0	search/4096/cwt	\<html\>		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 0	search/4096/cWt	\<html\ 		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 0	search/4096/cwt	\<script\> 		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 0	search/4096/cWt	\<script\ 		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 0	search/4096/cwt	\<style\> 		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 0	search/4096/cWt	\<style\  		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 0	search/4096/cwt	\<table\>		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 0	search/4096/cWt	\<table\ 		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
 
 0	search/4096/cwt	\<a\ href=		HTML document text
 !:mime	text/html
-!:strength + 15
+!:strength + 30
+
+# Microsoft HTML Application (HTA)
+# https://learn.microsoft.com/en-us/previous-versions//ms536496(v=vs.85)
+0	search/4096/cWt	\<hta:application\ 	Microsoft HTML Application (HTA)
+!:mime	application/hta
+!:ext	hta
+!:strength + 50
 
 # Extensible markup language (XML), a subset of SGML
 # from Marc Prud'hommeaux (marc@apocalypse.org)
 0	search/1/cwt	\<?xml			XML document text
 !:mime	text/xml
-!:strength + 15
-0	string/t		\<?xml\ version\ "	XML
-!:mime	text/xml
-!:strength + 15
+!:strength + 30
 0	string/t		\<?xml\ version="	XML
 !:mime	text/xml
-!:strength + 15
->15	string/t	>\0			%.3s document text
->>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
->>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
-0	string/t	\<?xml\ version='	XML
-!:mime	text/xml
-!:strength + 15
+!:strength + 30
 >15	string/t	>\0			%.3s document text
 >>23	search/1	\<xsl:stylesheet	(XSL stylesheet)
 >>24	search/1	\<xsl:stylesheet	(XSL stylesheet)
+
 0	search/1/wt	\<?XML			broken XML document text
 !:mime	text/xml
 !:strength - 10
@@ -146,16 +152,6 @@
 0	search/1	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
 0	search/1	#\ KDE\ Cookie\ File	Konqueror cookie text
 
-# XML-based format representing braille pages in a digital format.
-#
-# Specification:
-# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html
-#
-# Simon Aittamaa <simon.aittamaa@gmail.com>
-0	string		\<?xml\ version=
->14	regex		['"\ \t]*[0-9.]+['"\ \t]*
->>19    search/4096	\<pef           Portable Embosser Format
-!:mime  application/x-pef+xml
 
 # https://www.qgis.org/en/site/
 0	string		\<!DOCTYPE\040qgis	QGIS XML document

magic/Magdir/sharc

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------
-# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $
+# $File: sharc,v 1.9 2024/09/04 19:06:12 christos Exp $
 # file(1) magic for sharc files
 #
 # SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
@@ -19,5 +19,5 @@
 0	string			.system		SHARC architecture file
 
 0	leshort			0x521C		SHARC COFF binary
->2	leshort			>1		, %d sections
->>12	lelong			>0		, not stripped
+>2	leshort			>1		\b, %d sections
+>>12	lelong			>0		\b, not stripped

magic/Magdir/sniffer

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: sniffer,v 1.34 2022/12/14 18:27:36 christos Exp $
+# $File: sniffer,v 1.36 2024/06/16 15:09:26 christos Exp $
 # sniffer:  file(1) magic for packet capture files
 #
 # From: guy@alum.mit.edu (Guy Harris)
@@ -78,8 +78,8 @@
 #
 # "libpcap" capture files.
 # https://www.tcpdump.org/manpages/pcap-savefile.5.html
-# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
-# the main program that uses that format, but there are other programs
+# (We call them "libpcap capture file(s)", as "libpcap" is
+# the first library that uses that format, but there are other programs
 # that use "libpcap", or that use the same capture file format.)
 #
 0	name		pcap-be
@@ -198,7 +198,7 @@
 >20	belong&0x03FFFFFF		204		(PPP with direction pseudo-header
 >20	belong&0x03FFFFFF		205		(Cisco HDLC with direction pseudo-header
 >20	belong&0x03FFFFFF		206		(Frame Relay with direction pseudo-header
->20	belong&0x03FFFFFF		209		(Linux IPMB
+>20	belong&0x03FFFFFF		209		(Linux I2C
 >20	belong&0x03FFFFFF		215		(802.15.4 with non-ASK PHY header
 >20	belong&0x03FFFFFF		216		(Linux evdev events
 >20	belong&0x03FFFFFF		219		(MPLS with label as link-layer header

magic/Magdir/sql

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# $File: sql,v 1.26 2023/04/29 17:26:58 christos Exp $
+# $File: sql,v 1.27 2023/08/19 15:33:04 christos Exp $
 # sql:  file(1) magic for SQL files
 #
 # From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
@@ -100,6 +100,7 @@
 # URL:		https://en.wikipedia.org/wiki/SQLite
 # Reference:	https://www.sqlite.org/fileformat.html
 # Update:	Joerg Jenderek
+# TODO:		missing extensions for Bentley Systems and Esri Spatially-Enabled Database
 # Version 3 of SQLite allows applications to embed their own "user version"
 # number in the database at offset 60.  Later, SQLite added an "application id"
 # at offset 68 that is preferred over "user version" for indicating the
@@ -110,7 +111,6 @@
 >16 ubeshort >0                 SQLite 3.x
 # deprecated
 #!:mime	application/x-sqlite3
-!:mime	application/vnd.sqlite3
 # seldom found extension sqlite3 like in SyncData.sqlite3
 # db
 # db3 like: AddrBook.db3 cgipcrvp.db3
@@ -119,14 +119,88 @@
 # SQLite database weewx.sdb used by weather software weewx
 # https://www.weewx.com/docs/usersguide.htm
 # Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
+# ide is used in storage.ide
+# localstorage like in Enigma2 http_itv.ard.de_0.localstorage
+# xowa like in home-html.user.xowa		http://fileformats.archiveteam.org/wiki/XOWA
+# sqlar like in sqlar-src-4824e73896.sqlar	http://fileformats.archiveteam.org/wiki/SQLite_Archive
+# sketch					http://fileformats.archiveteam.org/wiki/Sketch
+# ftb						http://fileformats.archiveteam.org/wiki/MyHeritage_Family_Tree_Builder
+# lrcat						http://fileformats.archiveteam.org/wiki/Lightroom_catalog
+# without suffix like in "Diagnostic Data"
 # Unfortunately extension sqlite also used for other databases starting with string
 # "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
 # and with string "ZV-zlib" in like extra.sqlite
->>68 belong !0x5CDE09EF	database
-!:ext sqlite/sqlite3/db/db3/dbe/sdb/help
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/maple-sqlite.trid.xml
 >>68 belong =0x5CDE09EF  database
 # maple is used for Maple Workbook
 !:ext maple
+# From:		Joerg Jenderek
+# URL: 		https://en.wikipedia.org/wiki/Audacity_(audio_editor)
+#		http://fileformats.archiveteam.org/wiki/Audacity_Project_Format
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/a/aup3.trid.xml
+# Note:		called "Audacity 3 Project" by TrID and "Audacity Project File" version 3.x by DROID via PUID fmt/1826
+#		with user version 03000000h whereas older versions *.AUP are not SQLite based
+>>68 belong =0x41554459  database
+!:mime	application/x-audacity-project+sqlite3
+!:ext	aup3
+# From:		Joerg Jenderek
+# URL: 		http://fileformats.archiveteam.org/wiki/TeXnicard
+# Reference:	http://fileformats.archiveteam.org/wiki/TeXnicard_card_database
+# Note:		no examples found
+>>68 belong =0x6A035744  database
+!:mime	application/vnd.sqlite3
+!:ext	db
+# Update:	Joerg Jenderek
+# URL: 		http://fileformats.archiveteam.org/wiki/Fossil_repository_database
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/f/fossil.trid.xml 
+# Note:		called "Fossil repository data base" by TrID
+>>68 belong =0x0F055111  database
+!:mime	application/vnd.sqlite3
+!:ext	fossil/fsl
+# URL: 		http://fileformats.archiveteam.org/wiki/Fossil_checkout_database
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/f/fossil-checkout.trid.xml
+# Note:		called "Fossil checkout data base" by TrID
+>>68 belong =0x0F055112  database
+!:mime	application/vnd.sqlite3
+# name _FOSSIL_ on Windows or .fslckout else
+!:ext	/fslckout
+# Update:	Joerg Jenderek
+# URL: 		http://fileformats.archiveteam.org/wiki/Fossil_configuration_database
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/f/fossil-config.trid.xml
+# Note:		called "Fossil configuration data base" by TrID
+>>68 belong =0x0F055113  database
+!:mime	application/vnd.sqlite3
+# %LOCALAPPDATA%\_fossil on Windows and ~/.fossil or fossil.db else
+!:ext	/fossil/db
+# Update:	Joerg Jenderek
+# URL: 		http://fileformats.archiveteam.org/wiki/GeoPackage
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/g/gpkg-v1.trid.xml
+# Note:		called "GeoPackage (v1)" by TrID and "OGC GeoPackage" version 1.0-1.31 by DROID via PUID fmt/1700
+#		with GP10 application id
+>>68 belong =0x47503130  database
+# https://www.iana.org/assignments/media-types/application/geopackage+sqlite3
+!:mime	application/geopackage+sqlite3
+# https://github.com/opengeospatial/ets-gpkg12/blob/master/src/test/resources/gpkg/bluemarble.gpkg
+!:ext	gpkg
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/g/gpkg-v12.trid.xml
+# Note:		called "GeoPackage (v1.2)" by TrID and "OGC GeoPackage" version 1.0-1.31 by DROID via PUID fmt/1700
+#		with GPKG application id
+>>68 belong =0x47504B47  database
+!:mime	application/geopackage+sqlite3
+!:ext	gpkg
+# Update:	Joerg Jenderek
+# URL: 		https://github.com/mapbox/mbtiles-spec/tree/master
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/m/mbtiles-MPBX.trid.xml
+# Note:		called "MBTiles tileset (MPBX)" by TrID and many samples without application id MPBX like
+# https://ftp.gwdg.de/pub/misc/openstreetmap/openseamap/charts/mbtiles/OSM-OpenCPN2-MagellanStrait.mbtiles
+>>68 belong =0x4D504258  database
+!:mime	application/vnd.sqlite3
+!:ext	mbtiles
+>>68 default x           database
+!:mime	application/vnd.sqlite3
+# no examples found with s3db sl3 suffix
+!:ext	/sqlite/sqlite3/db/db3/dbe/sdb/help/ide/localstorage/sqlar/xowa/mbtiles
+# GRR: the line above only works if in ../../src/file.h FILE_MAGICSIZE ext[] are raised or you get
 >>60 belong =0x5f4d544e  (Monotone source repository)
 # if no known user version then check for Application IDs with default clause
 >>60 belong !0x5f4d544e
@@ -143,17 +217,24 @@
 >>>68 belong =0x4d504258 (MBTiles tileset)
 #	https://www.maplesoft.com/support/help/errors/view.aspx?path=Formats/Maple
 >>>68 belong =0x5CDE09EF (Maple Workbook)
+# AUDY	Audacity Project File
+>>>68 belong =0x41554459 (Audacity Project)
+>>>68 belong =0x6A035744 (TeXnicard card database)
 # unknown application ID
 >>>68 default x
 >>>>68 belong !0         \b, application id %u
 # The "user version" as read and set by the user_version pragma like:
-# 1 2 4 5 7 9 10 25 36 43 53 400 416 131073 131074 131075
+# 1 2 4 5 7 9 10 25 36 43 53 400 416 131073 131074 131075 50331648
 >>60 belong !0          \b, user version %d
-# SQLITE_VERSION_NUMBER like: 0 3008011 3016002 3007014 3017000 3022000 3028000 3031001
+# expressed as hexadecimal because some people mention version number in hexadecimal with marking that item
+>>>60 belong	x	(%#x)
+# SQLITE_VERSION_NUMBER like: 0 3007014 3008011 3016002 3017000 3022000 3028000 3031001 3032003 3035005
 >>96 belong  x           \b, last written using SQLite version %d
 # database page size in bytes; a power of two between 512 and 32768, or 1 for 65536
 # like: 512 1024 often 4096 32768
->>16 ubeshort !4096      \b, page size %u
+>>16 ubeshort !4096      \b, page size
+>>>16	ubeshort !1      %u
+>>>16	ubeshort =1      65536
 # File format write version. 1 for legacy; 2 for WAL; 0 for corruptDB.sqlite
 >>18 ubyte   !1          \b, writer version %u
 # File format read version. 1 for legacy; 2 for WAL; 4 for corruptDB.sqlite

magic/Magdir/ssh

@@ -1,19 +1,64 @@
 # Type:	OpenSSH key files
 # From:	Nicolas Collignon <tsointsoin@gmail.com>
+# Update:	Joerg Jenderek
+# URL:		https://en.wikipedia.org/wiki/Secure_Shell_Protocol
 
 0	string	SSH\040PRIVATE\040KEY	OpenSSH RSA1 private key,
 >28	string	>\0			version %s
 0	string	-----BEGIN\040OPENSSH\040PRIVATE\040KEY-----	OpenSSH private key
+!:mime	application/x-pem-file
 # https://www.rfc-editor.org/rfc/rfc5958
 0	string	-----BEGIN\040PRIVATE\040KEY-----	OpenSSH private key (no password)
+#!:mime		text/plain
+!:mime		text/x-ssh-private-key
+!:ext		key
 0	string	-----BEGIN\040ENCRYPTED\040PRIVATE\040KEY-----	OpenSSH private key (with password)
+# https://download.qemu.org/qemu-9.0.0.tar.xz
+# qemu-9.0.0/roms/skiboot/libstb/crypto/mbedtls/tests/data_files/format_gen.pub
+0	string	-----BEGIN\040PUBLIC\040KEY-----		OpenSSH public key
+#!:mime		text/plain
+!:mime		text/x-ssh-public-key
+!:ext		pub
 
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pub-ssh-dss.trid.xml
+# Note:		called "SSH-DSS Public key" by TrID
 0	string	ssh-dss\040		OpenSSH DSA public key
+#!:mime		text/plain
+!:mime		text/x-ssh-public-key
+!:ext		pub
+# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/p/pub-ssh-rsa.trid.xml
+# Note:		called "SSH-RSA Public key" by TrID
 0	string	ssh-rsa\040		OpenSSH RSA public key
+#!:mime		text/plain
+!:mime		text/x-ssh-public-key
+!:ext		pub
 0	string	ecdsa-sha2-nistp256	OpenSSH ECDSA public key
+#!:mime		text/plain
+!:mime		text/x-ssh-public-key
+!:ext		pub
+# https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.u2f?annotate=HEAD
+0	string	sk-ecdsa-sha2-nistp256@openssh.com	OpenSSH U2F ECDSA public key
+#!:mime		text/plain
+!:mime		text/x-ssh-public-key
+!:ext		pub
 0	string	ecdsa-sha2-nistp384	OpenSSH ECDSA public key
+#!:mime		text/plain
+!:mime		text/x-ssh-public-key
+!:ext		pub
 0	string	ecdsa-sha2-nistp521	OpenSSH ECDSA public key
+#!:mime		text/plain
+!:mime		text/x-ssh-public-key
+!:ext		pub
 0	string	ssh-ed25519		OpenSSH ED25519 public key
+#!:mime		text/plain
+!:mime		text/x-ssh-public-key
+!:ext		pub
+0	string	sk-ssh-ed25519@openssh.com	OpenSSH U2F ED25519 public key
+#!:mime		text/plain
+!:mime		text/x-ssh-public-key
+!:ext		pub
+
+
 
 0	string	SSHKRL\n\0
 >8	ubelong	1		OpenSSH key/certificate revocation list, format %u