Import upstream version 3.37

Header

@@ -1,4 +1,4 @@
-#! file
+# Magic
 # Magic data for file(1) command.
 # Machine-generated from src/cmd/file/magdir/*; edit there only!
 # Format is described in magic(files), where:

MAINT

@@ -1,4 +1,4 @@
-$Id: MAINT,v 1.3 1997/11/05 16:03:18 christos Exp $
+$Id: MAINT,v 1.4 2000/04/11 02:43:51 christos Exp $
 
 Maintenance notes:
 
@@ -29,5 +29,5 @@ your changed version.
 
 Thank you for your assistance and cooperation.
 
-Mark Moraes		Christos Zoulas
-moraes@deshaw.com	christos@astron.com
+Christos Zoulas
+christos@astron.com

Magdir/adi

@@ -0,0 +1,12 @@
+
+#------------------------------------------------------------------------------
+# adi: file(1) magic for ADi's objects
+# From Gregory McGarry <g.mcgarry@ieee.org>
+#
+0	leshort		0x521c		COFF DSP21k
+>18	lelong		&02		executable,
+>18	lelong		^02
+>>18	lelong		&01		static object,
+>>18	lelong		^01		relocatable object,
+>18	lelong		&010		stripped
+>18	lelong		^010		not stripped

Magdir/allegro

@@ -0,0 +1,7 @@
+#------------------------------------------------------------------------------
+# allegro:  file(1) magic for Allegro datafiles
+# Toby Deshane <hac@shoelace.digivill.net>
+#
+0 belong 0x736C6821   Allegro datafile (packed)
+0 belong 0x736C682E   Allegro datafile (not packed/autodetect)
+0 belong 0x736C682B   Allegro datafile (appended exe data)

Magdir/alpha

@@ -17,5 +17,14 @@
 
 # Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
 #
+# The actual magic number is just "Core", followed by a 2-byte version
+# number; however, treating any file that begins with "Core" as a Digital
+# UNIX core dump file may produce too many false hits, so we include one
+# byte of the version number as well; DU 5.0 appears only to be up to
+# version 2.
+#
 0	string		Core\001	Alpha COFF format core dump (Digital UNIX)
 >24	string		>\0		\b, from '%s'
+0	string		Core\002	Alpha COFF format core dump (Digital UNIX)
+>24	string		>\0		\b, from '%s'
+

Magdir/amigaos

@@ -4,7 +4,7 @@
 #
 # From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
 # Some formats are still missing: AmigaOS special IFF's, e.g.: FORM....CTLG
-# (the others should be seperate, anyway)
+# (the others should be separate, anyway)
 #
 0	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
 0	belong		0x000003e7	AmigaOS object/library data

Magdir/animation

@@ -11,8 +11,16 @@
 #>4	beshort&0xfff0	x			(%d x
 #>5	beshort&0x0fff  x			%d)
 0	belong		0x000001ba		MPEG system stream data
+
 # MPEG Audio (*.mpx)
 # from dreesen@math.fu-berlin.de
+
+# XXX
+# This conflicts with the FF FE signature for UTF-16-encoded Unicode
+# text, which will be identified as an MP3 file.  I don't have any MP3s
+# so I don't know how to (or even if it's possible to) change this to
+# tell the two apart.    enf@pobox.com
+
 0       beshort         &0xfff0         MP
 # MPEG 1.0
 >1      byte&0x08       =0x08           \b
@@ -132,3 +140,31 @@
 0	string		MOVI		Silicon Graphics movie file
 4	string		moov		Apple QuickTime movie file (moov)
 4	string		mdat		Apple QuickTime movie file (mdat)
+
+# iso 13818 transport stream
+#
+# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
+# (the following is a little bit restrictive and works fine for a stream
+#  that starts with PAT properly. it won't work for stream data, that is
+#  cut from an input device data right in the middle, but this shouldn't
+#  disturb)
+# syncbyte      8 bit	0x47
+# error_ind     1 bit	-
+# payload_start 1 bit	1
+# priority      1 bit	-
+# PID          13 bit	0x0000
+# scrambling    2 bit	-
+# adaptfld_ctrl 2 bit	1 or 3
+# conti_count   4 bit	0
+0	belong&0xFF5FFF1F	0x47400010	MPEG transport stream data
+>188	byte			!0x47		CORRUPTED
+
+# DIF digital video file format <mpruett@sgi.com>
+0	belong&0xffffff00	0x1f070000      DIF
+>4	byte			&0x01		(DVCPRO) movie file
+>4	byte			^0x01		(DV) movie file
+>3	byte			&0x80		(PAL)
+>3	byte			^0x80		(NTSC)
+
+# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
+0	belong			0x3026b275	Microsoft ASF

Magdir/apple

@@ -4,8 +4,119 @@
 #
 0	string		FiLeStArTfIlEsTaRt	binscii (apple ][) text
 0	string		\x0aGL			Binary II (apple ][) data
+0	string		\x76\xff		Squeezed (apple ][) data
 0	string		NuFile			NuFile archive (apple ][) data
 0	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
 0	belong		0x00051600		AppleSingle encoded Macintosh file
 0	belong		0x00051607		AppleDouble encoded Macintosh file
 
+# magic for Newton PDA package formats
+# from Ruda Moura <ruda@helllabs.org>
+0	string	package0	Newton package, NOS 1.x,
+>12	belong	&0x80000000	AutoRemove,
+>12	belong	&0x40000000	CopyProtect,
+>12	belong	&0x10000000	NoCompression,
+>12	belong	&0x04000000	Relocation,
+>12	belong	&0x02000000	UseFasterCompression,
+>16	belong	x		version %d
+
+0	string	package1	Newton package, NOS 2.x,
+>12	belong	&0x80000000	AutoRemove,
+>12	belong	&0x40000000	CopyProtect,
+>12	belong	&0x10000000	NoCompression,
+>12	belong	&0x04000000	Relocation,
+>12	belong	&0x02000000	UseFasterCompression,
+>16	belong	x		version %d
+
+# The following entries for the Apple II are for files that have
+# been transferred as raw binary data from an Apple, without having
+# been encapsulated by any of the above archivers.
+#
+# In general, Apple II formats are hard to identify because Apple DOS
+# and especially Apple ProDOS have strong typing in the file system and
+# therefore programmers never felt much need to include type information
+# in the files themselves.
+#
+# Eric Fischer <enf@pobox.com>
+
+# AppleWorks word processor:
+#
+# This matches the standard tab stops for an AppleWorks file, but if
+# a file has a tab stop set in the first four columns this will fail.
+#
+# The "O" is really the magic number, but that's so common that it's
+# necessary to check the tab stops that follow it to avoid false positives.
+
+4       string          O====   AppleWorks word processor data
+>85     byte&0x01       >0      \b, zoomed
+>90     byte&0x01       >0      \b, paginated
+>92     byte&0x01       >0      \b, with mail merge
+#>91    byte            x       \b, left margin %d
+
+# AppleWorks database:
+#
+# This isn't really a magic number, but it's the closest thing to one
+# that I could find.  The 1 and 2 really mean "order in which you defined
+# categories" and "left to right, top to bottom," respectively; the D and R
+# mean that the cursor should move either down or right when you press Return.
+
+#30	string		\x01D	AppleWorks database data
+#30	string		\x02D	AppleWorks database data
+#30	string		\x01R	AppleWorks database data
+#30	string		\x02R	AppleWorks database data
+
+# AppleWorks spreadsheet:
+#
+# Likewise, this isn't really meant as a magic number.  The R or C means
+# row- or column-order recalculation; the A or M means automatic or manual
+# recalculation.
+
+#131	string		RA	AppleWorks spreadsheet data
+#131	string		RM	AppleWorks spreadsheet data
+#131	string		CA	AppleWorks spreadsheet data
+#131	string		CM	AppleWorks spreadsheet data
+
+# Applesoft BASIC:
+#
+# This is incredibly sloppy, but will be true if the program was
+# written at its usual memory location of 2048 and its first line
+# number is less than 256.  Yuck.
+
+0       belong&0xff00ff 0x80000 Applesoft BASIC program data
+#>2     leshort         x       \b, first line number %d
+
+# ORCA/EZ assembler:
+# 
+# This will not identify ORCA/M source files, since those have
+# some sort of date code instead of the two zero bytes at 6 and 7
+# XXX Conflicts with ELF
+#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
+#>5      byte                    x               \b, build number %d
+
+# Broderbund Fantavision
+#
+# I don't know what these values really mean, but they seem to recur.
+# Will they cause too many conflicts?
+
+# Probably :-)
+#2	belong&0xFF00FF		0x040008	Fantavision movie data
+
+# Some attempts at images.
+#
+# These are actually just bit-for-bit dumps of the frame buffer, so
+# there's really no reasonably way to distinguish them except for their
+# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
+# or, occasionally, 8184.
+#
+# Nevertheless this will manage to catch a lot of images that happen
+# to have a solid-colored line at the bottom of the screen.
+
+8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
+8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
+8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
+8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
+8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background
+
+# Beagle Bros. Apple Mechanic fonts
+
+0	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font

Magdir/archive

@@ -182,6 +182,8 @@
 2	string		-lh3-		LHa 2.x? archive data [lh3]
 2	string		-lh4-		LHa (2.x) archive data [lh4]
 2	string		-lh5-		LHa (2.x) archive data [lh5]
+2	string		-lh6-		LHa (2.x) archive data [lh6]
+2	string		-lh7-		LHa (2.x) archive data [lh7]
 >20	byte		x		- header level %d
 
 # RAR archiver (Greg Roelofs, newt@uchicago.edu)
@@ -228,3 +230,23 @@
 2       string          -pm2-           PMarc archive data [pm2]
 2       string          -pms-           PMarc SFX archive (CP/M, DOS)
 5       string          -pc1-           PopCom compressed executable (CP/M)
+
+# From rafael@icp.inpg.fr (Rafael Laboissiere) 
+# The Project Revision Control System (see
+# http://www.XCF.Berkeley.EDU/~jmacd/prcs.html) generates a packaged project
+# file which is recognized by the following entry:
+0	leshort		0xeb81	PRCS packaged project
+
+# Microsoft cabinets 
+# by David Necas (Yeti) <yeti@physics.muni.cz>
+0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
+>25	byte	x		v%d
+>24	byte	x		\b.%d
+
+# GTKtalog catalogs 
+# by David Necas (Yeti) <yeti@physics.muni.cz>
+4	string	gtktalog\ 	GTKtalog catalog data,
+>13	string	3		version 3
+>>14	beshort	0x677a		(gzipped)
+>>14	beshort	!0x677a		(not gzipped)
+>13	string	>3		version %s

Magdir/audio

@@ -102,8 +102,9 @@
 1080	string	8CHN		8-channel Fasttracker module sound data
 1080	string	CD81		8-channel Oktalyzer module sound data
 1080	string	OKTA		8-channel Oktalyzer module sound data
-1082	string	CH
->1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
+# Not good enough.
+#1082	string	CH
+#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
 1080	string	16CN		16-channel Taketracker module sound data
 1080	string	32CN		32-channel Taketracker module sound data
 
@@ -118,3 +119,26 @@
 >14	beshort		=1			single song,
 >14	beshort		>1			%d songs,
 >16	beshort		>0			default song: %d
+
+# IRCAM <mpruett@sgi.com>
+# VAX and MIPS files are little-endian; Sun and NeXT are big-endian
+0	belong		0x64a30100		IRCAM file (VAX)
+0	belong		0x64a30200		IRCAM file (Sun)
+0	belong		0x64a30300		IRCAM file (MIPS little-endian)
+0	belong		0x64a30400		IRCAM file (NeXT)
+
+# NIST SPHERE <mpruett@sgi.com>
+0	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file
+
+# Sample Vision <mpruett@sgi.com>
+0	string		SOUND\ SAMPLE\ DATA\ 	Sample Vision file
+
+# Audio Visual Research <mpruett@sgi.com>
+0	string		2BIT			Audio Visual Research file
+
+# From Felix von Leitner <leitner@fefe.de>
+0	string		OggS	Ogg-Vorbis compressed sound file
+
+# SGI SoundTrack <mpruett@sgi.com>
+0	string		_SGI_SoundTrack		SGI SoundTrack project file
+0	string		ID3	mp3 file with ID3 2.0 tag

Magdir/blender

@@ -0,0 +1,17 @@
+#------------------------------------------------------------------------------
+# blender: file(1) magic for Blender 3D data files
+#
+# Coded by Guillermo S. Romero <gsromero@alumnos.euitt.upm.es> using the
+# data from Ton Roosendaal <ton@blender.nl>. Ton or his company do not
+# support the rule, so mail GSR if problems with it. Rule version: 1.1.
+# You can get latest version with comments and details about the format
+# at http://acd.asoc.euitt.upm.es/~gsromero/3d/blender/magic.blender
+
+0	string	=BLENDER	Blender3D,
+>7	string	=_		saved as 32-bits
+>7      string	=-		saved as 64-bits
+>8	string	=v		little endian
+>8	string	=V		big endian
+>9	byte	x		with version %c.
+>10	byte	x		\b%c
+>11	byte	x		\b%c

Magdir/citrus

@@ -0,0 +1,6 @@
+#------------------------------------------------------------------------------
+# citrus locale declaration
+#
+
+0	string		RuneCT		Citrus locale declaration for LC_CTYPE
+

Magdir/claris

@@ -0,0 +1,46 @@
+
+#------------------------------------------------------------------------------
+# claris:  file(1) magic for claris
+# "H. Nanosecond" <aldomel@ix.netcom.com>
+# Claris Works a word processor, etc.
+# Version 3.0
+
+# .pct claris works clip art files
+#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
+#*
+#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
+#null to byte 1000 octal
+514	string	\377\377\377\377\000	Claris clip art?
+>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	yes.
+514	string	\377\377\377\377\001	Claris clip art?
+>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	yes.
+
+# Claris works files
+# .cwk
+0	string	\002\000\210\003\102\117\102\117\000\001\206 Claris works document
+# .plt
+0	string	\020\341\000\000\010\010	Claris Works pallete files .plt
+
+# .msp a dictionary file I am not sure about this I have only one .msp file
+0	string	\002\271\262\000\040\002\000\164	Claris works dictionary
+
+# .usp are user dictionary bits
+# I am not sure about a magic header:
+#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
+#        soh   S   p   f   8   U   D  sp   ^   S  cr  nl   p   o   d   i
+#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
+#          a   t   r   i   s   t  sp   ^   S  cr  nl   d   i   v  sp   #
+
+# .mth Thesaurus
+# statrts with \0 but no magic header
+
+# .chy Hyphenation file
+# I am not sure: 000 210 034 000 000
+
+# other claris files
+#./windows/claris/useng.ndx: data
+#./windows/claris/xtndtran.l32: data
+#./windows/claris/xtndtran.lst: data
+#./windows/claris/clworks.lbl: data
+#./windows/claris/clworks.prf: data
+#./windows/claris/userd.spl: data

Magdir/commands

@@ -2,98 +2,61 @@
 #------------------------------------------------------------------------------
 # commands:  file(1) magic for various shells and interpreters
 #
-0	string		:\ shell archive or commands for antique kernel text
-0	string		#!/bin/sh		Bourne shell script text
-0	string		#!\ /bin/sh		Bourne shell script text
-0	string		#!\	/bin/sh		Bourne shell script text
-0	string		#!/bin/csh		C shell script text
-0	string		#!\ /bin/csh		C shell script text
-0	string		#!\	/bin/csh	C shell script text
+0	string		:			shell archive or script for antique kernel text
+0	string/b	#!\ /bin/sh		Bourne shell script text executable
+0	string/b	#!\ /bin/csh		C shell script text executable
 # korn shell magic, sent by George Wu, gwu@clyde.att.com
-0	string		#!/bin/ksh		Korn shell script text
-0	string		#!\ /bin/ksh		Korn shell script text
-0	string		#!\	/bin/ksh	Korn shell script text
-0	string	 	#!/bin/tcsh		Tenex C shell script text
-0	string	 	#!\ /bin/tcsh		Tenex C shell script text
-0	string	 	#!\	/bin/tcsh	Tenex C shell script text
-0	string		#!/usr/local/tcsh	Tenex C shell script text
-0	string	 	#!\ /usr/local/tcsh	Tenex C shell script text
-0	string		#!/usr/local/bin/tcsh	Tenex C shell script text
-0	string		#!\ /usr/local/bin/tcsh	Tenex C shell script text
-0	string		#!\	/usr/local/bin/tcsh	Tenex C shell script text
+0	string/b	#!\ /bin/ksh		Korn shell script text executable
+0	string/b 	#!\ /bin/tcsh		Tenex C shell script text executable
+0	string/b 	#!\ /usr/local/tcsh	Tenex C shell script text executable
+0	string/b	#!\ /usr/local/bin/tcsh	Tenex C shell script text executable
+
 #
 # zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
-0	string		#!/usr/local/bin/zsh	Paul Falstad's zsh
-0	string		#!\ /usr/local/bin/zsh	Paul Falstad's zsh
-0	string		#!\	/usr/local/bin/zsh	Paul Falstad's zsh
-0	string		#!/usr/local/bin/ash	Neil Brown's ash
-0	string		#!\ /usr/local/bin/ash	Neil Brown's ash
-0	string		#!\	/usr/local/bin/ash	Neil Brown's ash
-0	string		#!/usr/local/bin/ae	Neil Brown's ae
-0	string		#!\ /usr/local/bin/ae	Neil Brown's ae
-0	string		#!\	/usr/local/bin/ae	Neil Brown's ae
-0	string		#!/bin/nawk		new awk script text
-0	string		#!\ /bin/nawk		new awk script text
-0	string		#!\	/bin/nawk		new awk script text
-0	string		#!/usr/bin/nawk		new awk script text
-0	string		#!\ /usr/bin/nawk	new awk script text
-0	string		#!\	/usr/bin/nawk	new awk script text
-0	string		#!/usr/local/bin/nawk	new awk script text
-0	string		#!\ /usr/local/bin/nawk	new awk script text
-0	string		#!\	/usr/local/bin/nawk	new awk script text
-0	string		#!/bin/gawk		GNU awk script text
-0	string		#!\ /bin/gawk		GNU awk script text
-0	string		#!\	/bin/gawk		GNU awk script text
-0	string		#!/usr/bin/gawk		GNU awk script text
-0	string		#!\ /usr/bin/gawk	GNU awk script text
-0	string		#!\	/usr/bin/gawk	GNU awk script text
-0	string		#!/usr/local/bin/gawk	GNU awk script text
-0	string		#!\ /usr/local/bin/gawk	GNU awk script text
-0	string		#!\	/usr/local/bin/gawk	GNU awk script text
+0	string/b	#!\ /usr/local/bin/zsh	Paul Falstad's zsh script text executable
+0	string/b	#!\ /usr/local/bin/ash	Neil Brown's ash script text executable
+0	string/b	#!\ /usr/local/bin/ae	Neil Brown's ae script text executable
+0	string/b	#!\ /bin/nawk		new awk script text executable
+0	string/b	#!\ /usr/bin/nawk	new awk script text executable
+0	string/b	#!\ /usr/local/bin/nawk	new awk script text executable
+0	string/b	#!\ /bin/gawk		GNU awk script text executable
+0	string/b	#!\ /usr/bin/gawk	GNU awk script text executable
+0	string/b	#!\ /usr/local/bin/gawk	GNU awk script text executable
 #
-0	string		#!/bin/awk		awk commands text
-0	string		#!\ /bin/awk		awk commands text
-0	string		#!\	/bin/awk		awk commands text
-0	string		#!/usr/bin/awk		awk commands text
-0	string		#!\ /usr/bin/awk	awk commands text
-0	string		#!\	/usr/bin/awk	awk commands text
-0	string		BEGIN			awk commands text
+0	string/b	#!\ /bin/awk		awk script text executable
+0	string/b	#!\ /usr/bin/awk	awk script text executable
+0	string		BEGIN			awk script text
 
 # For Larry Wall's perl language.  The ``eval'' line recognizes an
 # outrageously clever hack for USG systems.
 #				Keith Waclena <keith@cerberus.uchicago.edu>
-0	string		#!/bin/perl			perl commands text
-0	string		#!\ /bin/perl			perl commands text
-0	string		#!\	/bin/perl		perl commands text
-0	string		eval\ "exec\ /bin/perl		perl commands text
-0	string		#!/usr/bin/perl			perl commands text
-0	string		#!\ /usr/bin/perl		perl commands text
-0	string		#!\	/usr/bin/perl		perl commands text
-0	string		eval\ "exec\ /usr/bin/perl	perl commands text
-0	string		#!/usr/local/bin/perl		perl commands text
-0	string		#!\ /usr/local/bin/perl		perl commands text
-0	string		#!\	/usr/local/bin/perl	perl commands text
-0	string		eval\ "exec\ /usr/local/bin/perl	perl commands text
+0	string/b	#!\ /bin/perl			perl script text executable
+0	string		eval\ "exec\ /bin/perl		perl script text
+0	string/b	#!\ /usr/bin/perl		perl script text executable
+0	string		eval\ "exec\ /usr/bin/perl	perl script text
+0	string/b	#!\ /usr/local/bin/perl		perl script text
+0	string		eval\ "exec\ /usr/local/bin/perl	perl script text executable
 
 # AT&T Bell Labs' Plan 9 shell
-0	string		#!/bin/rc	Plan 9 rc shell script text
-0	string		#!\ /bin/rc	Plan 9 rc shell script text
-0	string		#!\	/bin/rc	Plan 9 rc shell script text
+0	string/b	#!\ /bin/rc	Plan 9 rc shell script text executable
 
 # bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
-0	string		#!/bin/bash	Bourne-Again shell script text
-0	string		#!\ /bin/bash	Bourne-Again shell script text
-0	string		#!\	/bin/bash	Bourne-Again shell script text
-0	string		#!/usr/local/bin/bash	Bourne-Again shell script text
-0	string		#!\ /usr/local/bin/bash	Bourne-Again shell script text
-0	string		#!\	/usr/local/bin/bash	Bourne-Again shell script text
+0	string/b	#!\ /bin/bash	Bourne-Again shell script text executable
+0	string/b	#!\ /usr/local/bin/bash	Bourne-Again shell script text executable
+
+# using env
+0	string		#!/usr/bin/env		a
+>15	string		>\0			%s script text executable
+0	string		#!\ /usr/bin/env	a
+>16	string		>\0			%s script text executable
+
 
 # generic shell magic
 0	string		#!\ /			a
->3	string		>\0			%s script text
+>3	string		>\0			%s script text executable
 0	string		#!\	/		a
->3	string		>\0			%s script text
+>3	string		>\0			%s script text executable
 0	string		#!/			a
->2	string		>\0			%s script text
-0	string		#!\ 			commands text
+>2	string		>\0			%s script text executable
+0	string		#!\ 			script text executable
 >3	string		>\0			for %s

Magdir/compress

@@ -21,6 +21,7 @@
 >3	byte		&0x02		continuation,
 >3	byte		&0x04		extra field,
 >3	byte		&0x08		original filename,
+>>10    string          x               `%s',
 >3	byte		&0x10		comment,
 >3	byte		&0x20		encrypted,
 >4	ledate		x		last modified: %s,
@@ -93,7 +94,7 @@
 # bzip	a block-sorting file compressor
 #	by Julian Seward <sewardj@cs.man.ac.uk> and others
 #
-0	string		BZ		bzip compressed	data
+0	string		BZ		bzip compressed data
 >2	byte		x		\b, version: %c
 >3	string		=1		\b, compression block size 100k
 >3	string		=2		\b, compression block size 200k

Magdir/console

@@ -0,0 +1,122 @@
+#------------------------------------------------------------------------------
+# Console game magic
+# Toby Deshane <hac@shoelace.digivill.net>
+#    ines:  file(1) magic for Marat's iNES Nintendo Entertainment System
+#           ROM dump format
+
+0 string NES\032 iNES ROM dump,
+>4 byte  x     %dx16k PRG
+>5 byte  x     \b, %dx8k CHR
+>6 byte&0x01  =0x1  \b, [Vert.]
+>6 byte&0x01  =0x0  \b, [Horiz.]
+>6 byte&0x02  =0x2  \b, [SRAM]
+>6 byte&0x04  =0x4  \b, [Trainer]
+>6 byte&0x04  =0x8  \b, [4-Scr]
+
+#------------------------------------------------------------------------------
+# gameboy:  file(1) magic for the Nintendo (Color) Gameboy raw ROM format
+#
+0x104 belong 0xCEED6666 Gameboy ROM:
+>0x134 string >\0 "%.16s"
+>0x146 byte 0x03  \b,[SGB]
+>0x147 byte 0x00  \b, [ROM ONLY]
+>0x147 byte 0x01  \b, [ROM+MBC1]
+>0x147 byte 0x02  \b, [ROM+MBC1+RAM]
+>0x147 byte 0x03  \b, [ROM+MBC1+RAM+BATT]
+>0x147 byte 0x05  \b, [ROM+MBC2]
+>0x147 byte 0x06  \b, [ROM+MBC2+BATTERY]
+>0x147 byte 0x08  \b, [ROM+RAM]
+>0x147 byte 0x09  \b, [ROM+RAM+BATTERY]
+>0x147 byte 0x0B  \b, [ROM+MMM01]
+>0x147 byte 0x0C  \b, [ROM+MMM01+SRAM]
+>0x147 byte 0x0D  \b, [ROM+MMM01+SRAM+BATT]
+>0x147 byte 0x0F  \b, [ROM+MBC3+TIMER+BATT]
+>0x147 byte 0x10  \b, [ROM+MBC3+TIMER+RAM+BATT]
+>0x147 byte 0x11  \b, [ROM+MBC3]
+>0x147 byte 0x12  \b, [ROM+MBC3+RAM]
+>0x147 byte 0x13  \b, [ROM+MBC3+RAM+BATT]
+>0x147 byte 0x19  \b, [ROM+MBC5]
+>0x147 byte 0x1A  \b, [ROM+MBC5+RAM]
+>0x147 byte 0x1B  \b, [ROM+MBC5+RAM+BATT]
+>0x147 byte 0x1C  \b, [ROM+MBC5+RUMBLE]
+>0x147 byte 0x1D  \b, [ROM+MBC5+RUMBLE+SRAM]
+>0x147 byte 0x1E  \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
+>0x147 byte 0x1F  \b, [Pocket Camera]
+>0x147 byte 0xFD  \b, [Bandai TAMA5]
+>0x147 byte 0xFE  \b, [Hudson HuC-3]
+>0x147 byte 0xFF  \b, [Hudson HuC-1]
+
+>0x148 byte 0     \b, ROM: 256Kbit
+>0x148 byte 1     \b, ROM: 512Kbit
+>0x148 byte 2     \b, ROM: 1Mbit
+>0x148 byte 3     \b, ROM: 2Mbit
+>0x148 byte 4     \b, ROM: 4Mbit
+>0x148 byte 5     \b, ROM: 8Mbit
+>0x148 byte 6     \b, ROM: 16Mbit
+>0x148 byte 0x52  \b, ROM: 9Mbit
+>0x148 byte 0x53  \b, ROM: 10Mbit
+>0x148 byte 0x54  \b, ROM: 12Mbit
+
+>0x149 byte 1     \b, RAM: 16Kbit
+>0x149 byte 2     \b, RAM: 64Kbit
+>0x149 byte 3     \b, RAM: 128Kbit
+>0x149 byte 4     \b, RAM: 1Mbit
+
+#>0x14e long  x     \b, CRC: %x
+
+#------------------------------------------------------------------------------
+# genesis:  file(1) magic for the Sega MegaDrive/Genesis raw ROM format
+#
+0x100 string SEGA  Sega MegaDrive/Genesis raw ROM dump
+>0x120 string >\0 Name: "%.16s"
+>0x110 string >\0 %.16s
+>0x1B0 string RA with SRAM
+
+#------------------------------------------------------------------------------
+# genesis:  file(1) magic for the Super MegaDrive ROM dump format
+#
+0x280 string EAGN  Super MagicDrive ROM dump
+>0 byte x %dx16k blocks
+>2 byte 0 \b, last in series or standalone
+>2 byte >0 \b, split ROM
+>8 byte 0xAA
+>9 byte 0xBB
+
+#------------------------------------------------------------------------------
+# genesis:  file(1) alternate magic for the Super MegaDrive ROM dump format
+#
+0x280 string EAMG  Super MagicDrive ROM dump
+>0 byte x %dx16k blocks
+>2 byte x \b, last in series or standalone
+>8 byte 0xAA
+>9 byte 0xBB
+
+#------------------------------------------------------------------------------
+# smsgg:  file(1) magic for Sega Master System and Game Gear ROM dumps
+#
+# Does not detect all images.  Very preliminary guesswork.  Need more data
+# on format.
+#
+# FIXME: need a little more info...;P
+#
+#0 byte 0xF3
+#>1 byte 0xED  Sega Master System/Game Gear ROM dump
+#>1 byte 0x31  Sega Master System/Game Gear ROM dump
+#>1 byte 0xDB  Sega Master System/Game Gear ROM dump
+#>1 byte 0xAF  Sega Master System/Game Gear ROM dump
+#>1 byte 0xC3  Sega Master System/Game Gear ROM dump
+
+#------------------------------------------------------------------------------
+# dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
+#
+0 belong 0x21068028   Sega Dreamcast VMU game image
+0 string LCDi         Dream Animator file
+
+#------------------------------------------------------------------------------
+# v64: file(1) uncertain magic for the V64 format N64 ROM dumps
+#
+0 belong 0x37804012    V64 Nintendo 64 ROM dump
+
+#------------------------------------------------------------------------------
+# msx: file(1) magic for MSX game cartridge dumps
+0 beshort 0x4142 MSX game cartridge dump 

Magdir/ctags

@@ -0,0 +1,5 @@
+
+# ----------------------------------------------------------------------------
+# ctags:  file (1) magic for Exuberant Ctags files
+# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
+0       string  !_TAG   Exuberant Ctags tag file

Magdir/database

@@ -12,84 +12,63 @@
 0	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian
 0	string	GDBM		GNU dbm 2.x database
 #
-0	belong	0x061561	Berkeley DB
->4	belong	>2		1.86
->4	belong	<3		1.85
->8	belong	4321		Hash/Big Endian
->8	belong	1234		Hash/Little Endian
->4	belong	>0		(Version %d,
->12	belong	x		Bucket Size %d,
->16	belong	x		Bucket Shift %d,
->20	belong	x		Directory Size %d,
->24	belong	x		Segment Size %d,
->28	belong	x		Segment Shift %d,
->32	belong	x		Overflow Point %d,
->36	belong	x		Last Freed %d,
->40	belong	x		Max Bucket %d,
->44	belong	x		High Mask 0x%x,
->48	belong	x		Low Mask 0x%x,
->52	belong	x		Fill Factor %d,
->56	belong	x		Number of Keys %d)
+# Berkeley DB
 #
+# Ian Darwin's file /etc/magic files: big/little-endian version.
 #
-0	belong	0x053162	Berkeley DB 1.85/1.86 Btree/Big Endian
->4	belong	>0		(Version %d,
->8	belong	x		Page Size %d,
->12	belong	x		Free Page %d,
->16	belong	x		Number of Records %d,
->20	belong	x		Flags 0x%x)
-0	lelong	0x053162	Berkeley DB 1.85/1.86 Btree/Little Endian
->4	lelong	>0		(Version %d,
->8	lelong	x		Page Size %d,
->12	lelong	x		Free Page %d,
->16	lelong	x		Number of Records %d,
->20	lelong	x		Flags 0x%x)
-#
-#
-12	belong	0x061561	Berkeley DB 2.X Hash/Big Endian
->16	belong	>0		(Version %d,
->0	belong  x		Logical sequence number: file - %d,
->4	belong  x		offset - %d,
->20	belong	x		Bucket Size %d,
->24	belong	x		Overflow Point %d,
->28	belong	x		Last Freed %d,
->32	belong	x		Max Bucket %d,
->36	belong	x		High Mask 0x%x,
->40	belong	x		Low Mask 0x%x,
->44	belong	x		Fill Factor %d,
->48	belong	x		Number of Keys %d)
-#
-# DB2.X formats from Khimenko Victor <khim@sch57.msk.ru>
-#
-12	lelong	0x061561	Berkeley DB 2.X Hash/Little Endian
->16	lelong	>0		(Version %d,
->0	lelong  x		Logical sequence number: file - %d,
->4	lelong  x		offset - %d,
->20	lelong	x		Bucket Size %d,
->24	lelong	x		Overflow Point %d,
->28	lelong	x		Last Freed %d,
->32	lelong	x		Max Bucket %d,
->36	lelong	x		High Mask 0x%x,
->40	lelong	x		Low Mask 0x%x,
->44	lelong	x		Fill Factor %d,
->48	lelong	x		Number of Keys %d)
-#
-#
-12	belong	0x053162	Berkeley DB 2.X Btree/Big Endian
->16	belong	>0		(Version %d, 
->0	belong  x		Logical sequence number: file - %d,
->4	belong  x		offset - %d,
->20	belong	x		Page Size %d,
->24	belong	x		Maxkey %d,
->28	belong	x		Minkey %d,
->32	belong	x		Free Page %d)
+# Hash 1.85/1.86 databases store metadata in network byte order.
+# Btree 1.85/1.86 databases store the metadata in host byte order.
+# Hash and Btree 2.X and later databases store the metadata in host byte order.
+
+0	long	0x00061561	Berkeley DB
+>8	belong	4321
+>>4	belong	>2		1.86
+>>4	belong	<3		1.85
+>>4	belong	>0		(Hash, version %d, native byte-order)
+>8	belong	1234
+>>4	belong	>2		1.86
+>>4	belong	<3		1.85
+>>4	belong	>0		(Hash, version %d, little-endian)
+
+0	belong	0x00061561	Berkeley DB
+>8	belong	4321
+>>4	belong	>2		1.86
+>>4	belong	<3		1.85
+>>4	belong	>0		(Hash, version %d, big-endian)
+>8	belong	1234
+>>4	belong	>2		1.86
+>>4	belong	<3		1.85
+>>4	belong	>0		(Hash, version %d, native byte-order)
+
+0	long	0x00053162	Berkeley DB 1.85/1.86
+>4	long	>0		(Btree, version %d, native byte-order)
+0	belong	0x00053162	Berkeley DB 1.85/1.86
+>4	belong	>0		(Btree, version %d, big-endian)
+0	lelong	0x00053162	Berkeley DB 1.85/1.86
+>4	lelong	>0		(Btree, version %d, little-endian)
+
+12	long	0x00061561	Berkeley DB
+>16	long	>0		(Hash, version %d, native byte-order)
+12	belong	0x00061561	Berkeley DB
+>16	belong	>0		(Hash, version %d, big-endian)
+12	lelong	0x00061561	Berkeley DB
+>16	lelong	>0		(Hash, version %d, little-endian)
+
+12	long	0x00053162	Berkeley DB
+>16	long	>0		(Btree, version %d, native byte-order)
+12	belong	0x00053162	Berkeley DB
+>16	belong	>0		(Btree, version %d, big-endian)
+12	lelong	0x00053162	Berkeley DB
+>16	lelong	>0		(Btree, version %d, little-endian)
+
+12	long	0x00042253	Berkeley DB
+>16	long	>0		(Queue, version %d, native byte-order)
+12	belong	0x00042253	Berkeley DB
+>16	belong	>0		(Queue, version %d, big-endian)
+12	lelong	0x00042253	Berkeley DB
+>16	lelong	>0		(Queue, version %d, little-endian)
 #
 #
-12	lelong	0x053162	Berkeley DB 2.X Btree/Little Endian
->16	lelong	>0		(Version %d,
->0	lelong  x		Logical sequence number: file - %d,
->4	lelong  x		offset - %d,
->20	lelong	x		Page Size %d,
->24	lelong	x		Maxkey %d,
->28	lelong	x		Minkey %d,
->32	lelong	x		Free Page %d)
+# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
+0	string	RRD		RRDTool DB
+>4	string	x		version %s

Magdir/dyadic

@@ -0,0 +1,12 @@
+
+#------------------------------------------------------------------------------
+# Dyadic: file(1) magic for Dyalog APL.
+#
+0 	byte	0xaa
+>1	byte	<4		Dyalog APL
+>>1	byte	0x00		incomplete workspace
+>>1	byte	0x01		component file
+>>1	byte	0x02		external variable
+>>1	byte	0x03		workspace
+>>2	byte	x		version %d
+>>3	byte	x		.%d

Magdir/editors

@@ -0,0 +1,9 @@
+
+#------------------------------------------------------------------------------
+# T602 editor documents 
+# by David Necas <yeti@physics.muni.cz>
+0	string	@CT\ 	T602 document data,
+>4	string	0	Kamenicky
+>4	string	1	CP 852
+>4	string	2	KOI8-CS
+>4	string	>2	unknown encoding

Magdir/elf

@@ -12,12 +12,31 @@
 0	string		\177ELF		ELF
 >4	byte		0		invalid class
 >4	byte		1		32-bit
-# only for MIPS R3000_BE
+# only for MIPS
 >>18	beshort		8
+>>18	beshort		10
 >>>36   belong          &0x20           N32
 >4	byte		2		64-bit
 >5	byte		0		invalid byte order
 >5	byte		1		LSB
+# only for MIPS R3000_BE
+>>18    leshort		8
+# only for 32-bit
+>>>4	byte		1
+>>>>36  lelong&0xf0000000       0x00000000      mips-1
+>>>>36  lelong&0xf0000000       0x10000000      mips-2
+>>>>36  lelong&0xf0000000       0x20000000      mips-3
+>>>>36  lelong&0xf0000000       0x30000000      mips-4
+>>>>36  lelong&0xf0000000       0x40000000      mips-5
+>>>>36  lelong&0xf0000000       0x50000000      mips-6
+# only for 64-bit
+>>>4	byte		2
+>>>>48  lelong&0xf0000000       0x00000000      mips-1
+>>>>48  lelong&0xf0000000       0x10000000      mips-2
+>>>>48  lelong&0xf0000000       0x20000000      mips-3
+>>>>48  lelong&0xf0000000       0x30000000      mips-4
+>>>>48  lelong&0xf0000000       0x40000000      mips-5
+>>>>48  lelong&0xf0000000       0x50000000      mips-6
 >>16	leshort		0		no file type,
 >>16	leshort		1		relocatable,
 >>16	leshort		2		executable,
@@ -36,11 +55,14 @@
 >>18	leshort		5		Motorola 88000 - invalid byte order,
 >>18	leshort		6		Intel 80486,
 >>18	leshort		7		Intel 80860,
->>18	leshort		8		MIPS R3000_BE - invalid byte order,
+# "officially" big endian, but binutils bfd only emits magic #8 for MIPS.
+>>18	leshort		8		MIPS R3000_LE [bfd bug],
 >>18	leshort		9		Amdahl - invalid byte order,
 >>18	leshort		10		MIPS R3000_LE,
 >>18	leshort		11		RS6000 - invalid byte order,
 >>18	leshort		15		PA-RISC - invalid byte order,
+>>>50	leshort		0x0214		2.0
+>>>48	leshort		&0x0008		(LP64),
 >>18	leshort		16		nCUBE,
 >>18	leshort		17		Fujitsu VPP500,
 >>18	leshort		18		SPARC32PLUS,
@@ -49,7 +71,7 @@
 >>18	leshort		37		Fujitsu FR20,
 >>18	leshort		38		TRW RH-32,
 >>18	leshort		39		Motorola RCE,
->>18	leshort		40		Advanced RISC Machines ARM,
+>>18	leshort		40		ARM,
 >>18	leshort		41		Alpha,
 >>18	leshort		42		Hitachi SH,
 >>18	leshort		43		SPARC V9 - invalid byte order,
@@ -63,11 +85,12 @@
 >>18	leshort		51		Stanford MIPS-X,
 >>18	leshort		52		Motorola Coldfire,
 >>18	leshort		53		Motorola M68HC12,
+>>18	leshort		62		AMD x86-64,
+>>18	leshort		75		Digital VAX,
 >>18	leshort		0x9026		Alpha (unofficial),
 >>20	lelong		0		invalid version
 >>20	lelong		1		version 1
 >>36	lelong		1		MathCoPro/FPU/MAU Required
->8	string		>\0		(%s)
 >5	byte		2		MSB
 # only for MIPS R3000_BE
 >>18    beshort		8
@@ -107,7 +130,9 @@
 >>18	beshort		9		Amdahl,
 >>18	beshort		10		MIPS R3000_LE - invalid byte order,
 >>18	beshort		11		RS6000,
->>18	beshort		15		PA-RISC,
+>>18	beshort		15		PA-RISC
+>>>50	beshort		0x0214		2.0
+>>>48	beshort		&0x0008		(LP64)
 >>18	beshort		16		nCUBE,
 >>18	beshort		17		Fujitsu VPP500,
 >>18	beshort		18		SPARC32PLUS,
@@ -123,7 +148,7 @@
 >>18	beshort		37		Fujitsu FR20,
 >>18	beshort		38		TRW RH-32,
 >>18	beshort		39		Motorola RCE,
->>18	beshort		40		Advanced RISC Machines ARM,
+>>18	beshort		40		ARM,
 >>18	beshort		41		Alpha,
 >>18	beshort		42		Hitachi SH,
 >>18	beshort		43		SPARC V9,
@@ -137,7 +162,26 @@
 >>18	beshort		51		Stanford MIPS-X,
 >>18	beshort		52		Motorola Coldfire,
 >>18	beshort		53		Motorola M68HC12,
+>>18	beshort		73		Cray NV1,
+>>18	beshort		75		Digital VAX,
 >>18	beshort		0x9026		Alpha (unofficial),
 >>20	belong		0		invalid version
 >>20	belong		1		version 1
 >>36	belong		1		MathCoPro/FPU/MAU Required
+>8	string		>\0		(%s)
+>8	string		\0
+>>7	byte		0		(SYSV)
+>>7	byte		1		(HP-UX)
+>>7	byte		2		(NetBSD)
+>>7	byte		3		(GNU/Linux)
+>>7	byte		4		(GNU/Hurd)
+>>7	byte		5		(86Open)
+>>7	byte		6		(Solaris)
+>>7	byte		7		(Monterey)
+>>7	byte		8		(IRIX)
+>>7	byte		9		(FreeBSD)
+>>7	byte		10		(Tru64)
+>>7	byte		11		(Novell Modesto)
+>>7	byte		12		(OpenBSD)
+>>7	byte		97		(ARM)
+>>7	byte		255		(embedded)

Magdir/epoc

@@ -0,0 +1,10 @@
+
+#------------------------------------------------------------------------------
+# Epoc 32 : file(1) magic for Epoc Documents [psion/osaris
+# Stefan Praszalowicz (hpicollo@worldnet.fr)
+#0	lelong		0x10000037	Epoc32
+>4	lelong		0x1000006D
+>>8	lelong		0x1000007F	Word
+>>8	lelong		0x10000088	Sheet
+>>8	lelong		0x1000007D	Sketch
+>>8	lelong		0x10000085	TextEd

Magdir/filesystems

@@ -2,7 +2,6 @@
 #------------------------------------------------------------------------------
 # filesystems:  file(1) magic for different filesystems
 #
-0x438	leshort	0xEF53			Linux/i386 ext2 filesystem
 0	string	\366\366\366\366	PC formatted floppy with no filesystem
 # Sun disk labels
 # From /usr/include/sun/dklabel.h:
@@ -62,17 +61,58 @@
 
 0x18b	string	OS/2	OS/2 Boot Manager
 
-9564	lelong		0x00011954	Unix Fast File system,
+9564	lelong		0x00011954	Unix Fast File system (little-endian),
 >8404	string		x		last mounted on %s,
->9504	ledate		x		last checkd at %s,
->8224	ledate		x		last writen at %s,
+#>9504	ledate		x		last checked at %s,
+>8224	ledate		x		last written at %s,
+>8401	byte		x		clean flag %d,
 >8228	lelong		x		number of blocks %d,
 >8232	lelong		x		number of data blocks %d,
 >8236	lelong		x		number of cylinder groups %d,
->8240	lelong		x		number of basic blocks %d,
->8244	lelong		x		number of fragment blocks %d,
->8248	lelong		x		minimum percentage of free blocks %d,
->8252	lelong		x		rotational delay %dms,
->8256	lelong		x		disk rotational speed %drps,
+>8240	lelong		x		block size %d,
+>8244	lelong		x		fragment size %d,
+>8252	lelong		x		minimum percentage of free blocks %d,
+>8256	lelong		x		rotational delay %dms,
+>8260	lelong		x		disk rotational speed %drps,
 >8320	lelong		0		TIME optimization
 >8320	lelong		1		SPACE optimization
+
+9564	belong		0x00011954	Unix Fast File system (big-endian),
+>8404	string		x		last mounted on %s,
+#>9504	bedate		x		last checked at %s,
+>8224	bedate		x		last written at %s,
+>8401	byte		x		clean flag %d,
+>8228	belong		x		number of blocks %d,
+>8232	belong		x		number of data blocks %d,
+>8236	belong		x		number of cylinder groups %d,
+>8240	belong		x		block size %d,
+>8244	belong		x		fragment size %d,
+>8252	belong		x		minimum percentage of free blocks %d,
+>8256	belong		x		rotational delay %dms,
+>8260	belong		x		disk rotational speed %drps,
+>8320	belong		0		TIME optimization
+>8320	belong		1		SPACE optimization
+
+# ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com>
+0x438	leshort		0xEF53		Linux
+>0x44c	lelong		x		rev %d
+>0x43e	leshort		x		\b.%d
+>0x45c	lelong		^0x0000004	ext2 filesystem data
+>>0x43a	leshort		^0x0000001	(mounted or unclean)
+>0x45c	lelong		&0x0000004	ext3 filesystem data
+>>0x460	lelong		&0x0000004	(needs journal recovery)
+>0x43a	leshort		&0x0000002	(errors)
+>0x460	lelong		&0x0000001	(compressed)
+#>0x460	lelong		&0x0000002	(filetype)
+#>0x464	lelong		&0x0000001	(sparse_super)
+>0x464	lelong		&0x0000002	(large files)
+
+# SGI disk labels - Nathan Scott <nathans@debian.org>
+0	belong		0x0BE5A941	SGI disk label (volume header)
+
+# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
+0	belong		0x58465342	SGI XFS filesystem data
+>0x4	belong		x		(blksz=3D%d,
+>0x68	beshort		x		inosz=3D%d,
+>0x64	beshort		^0x2004		v1 dirs)
+>0x64	beshort		&0x2004		v2 dirs)

Magdir/fonts

@@ -46,3 +46,6 @@
 7	belong		0x00564944	DOS code page font data (from Linux?)
 4098	string		DOSFONT		DOSFONT2 encrypted font data
 
+# downloadable fonts for browser (prints type) anthon@mnt.org
+0	string		PFR1		PFR1 font
+>102	string		>0		\b: %s

Magdir/freebsd

@@ -126,5 +126,18 @@
 
 # /var/run/ld.so.hints
 # What are you laughing about?
-0	lelong			011421044151	ld.so hints file
->4	lelong			>0		(version %d)
+0	lelong			011421044151	ld.so hints file (Little Endian
+>4	lelong			>0		\b, version %d)
+>4	belong			<=0		\b)
+0	belong			011421044151	ld.so hints file (Big Endian
+>4	belong			>0		\b, version %d)
+>4	belong			<=0		\b)
+
+#
+# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
+#
+0	string	SCRSHOT_	scrshot(1) screenshot,
+>8	byte	x		version %d,
+>9	byte	2		%d bytes in header,
+>>10	byte	x		%d chars wide by
+>>11	byte	x		%d chars high

Magdir/fsav

@@ -0,0 +1,27 @@
+
+#------------------------------------------------------------------------------
+# fsav:  file(1) magic for datafellows fsav virus definition files
+# Anthon van der Neut (anthon@mnt.org)
+0	beshort		0x1575		fsav (linux) macro virus
+>8	leshort		>0		(%d-
+>11	byte		>0		\b%02d-
+>10	byte		>0		\b%02d)
+
+# comment this out for now because it regognizes every file where
+# the eighth character is \n
+#8	byte		0x0a
+#>12	byte		0x07
+#>11	leshort		>0		fsav (linux) virus (%d-
+#>10	byte		0		\b01-
+#>10	byte		1		\b02-
+#>10	byte		2		\b03-
+#>10	byte		3		\b04-
+#>10	byte		4		\b05-
+#>10	byte		5		\b06-
+#>10	byte		6		\b07-
+#>10	byte		7		\b08-
+#>10	byte		8		\b08-
+#>10	byte		9		\b10-
+#>10	byte		10		\b11-
+#>10	byte		11		\b12-
+#>9	byte		>0		\b%02d)

Magdir/gnu

@@ -7,3 +7,6 @@
 0	string		\225\4\22\336	GNU message catalog (big endian),
 >4	belong		x		revision %d,
 >8	belong		x		%d messages
+# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
+0	string		*nazgul*	Nazgul style compiled message catalog
+>8	lelong		>0		\b, version %ld

Magdir/hitachi-sh

@@ -0,0 +1,18 @@
+
+#------------------------------------------------------------------------------
+# hitach-sh: file(1) magic for Hitachi Super-H
+#
+# Super-H COFF
+#
+0	beshort		0x0500		Hitachi SH big-endian COFF
+>18	beshort&0x0002	=0x0000		object
+>18	beshort&0x0002	=0x0002		executable
+>18	beshort&0x0008	=0x0000		\b, stripped
+>18	beshort&0x0008	=0x0008		\b, not stripped
+#
+0	leshort		0x0550		Hitachi SH little-endian COFF
+>18	leshort&0x0002	=0x0000		object
+>18	leshort&0x0002	=0x0002		executable
+>18	leshort&0x0008	=0x0000		\b, stripped
+>18	leshort&0x0008	=0x0008		\b, not stripped
+

Magdir/hp

@@ -249,3 +249,143 @@
 >2	beshort		0407		impure binary
 >2	beshort		0410		read-only binary
 >2	beshort		0413		demand paged binary
+#
+# From David Gero <dgero@nortelnetworks.com>
+# HP-UX 10.20 core file format from /usr/include/sys/core.h
+# Unfortunately, HP-UX uses corehead blocks without specifying the order
+# There are four we care about:
+#     CORE_KERNEL, which starts with the string "HP-UX"
+#     CORE_EXEC, which contains the name of the command
+#     CORE_PROC, which contains the signal number that caused the core dump
+#     CORE_FORMAT, which contains the version of the core file format (== 1)
+# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
+# but we include all 6 variations of the order of the first 3, and
+# assume that PROC will always be last
+# Order 1: KERNEL, EXEC, FORMAT, PROC
+0x10		string	HP-UX
+>0		belong	2
+>>0xC		belong	0x3C
+>>>0x4C		belong	0x100
+>>>>0x58	belong	0x44
+>>>>>0xA0	belong	1
+>>>>>>0xAC	belong	4
+>>>>>>>0xB0	belong	1
+>>>>>>>>0xB4	belong	4		core file
+>>>>>>>>>0x90	string	>\0		from '%s'
+>>>>>>>>>0xC4	belong	3		- received SIGQUIT
+>>>>>>>>>0xC4	belong	4		- received SIGILL
+>>>>>>>>>0xC4	belong	5		- received SIGTRAP
+>>>>>>>>>0xC4	belong	6		- received SIGABRT
+>>>>>>>>>0xC4	belong	7		- received SIGEMT
+>>>>>>>>>0xC4	belong	8		- received SIGFPE
+>>>>>>>>>0xC4	belong	10		- received SIGBUS
+>>>>>>>>>0xC4	belong	11		- received SIGSEGV
+>>>>>>>>>0xC4	belong	12		- received SIGSYS
+>>>>>>>>>0xC4	belong	33		- received SIGXCPU
+>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
+# Order 2: KERNEL, FORMAT, EXEC, PROC
+>>>0x4C		belong	1
+>>>>0x58	belong	4
+>>>>>0x5C	belong	1
+>>>>>>0x60	belong	0x100
+>>>>>>>0x6C	belong	0x44
+>>>>>>>>0xB4	belong	4		core file
+>>>>>>>>>0xA4	string	>\0		from '%s'
+>>>>>>>>>0xC4	belong	3		- received SIGQUIT
+>>>>>>>>>0xC4	belong	4		- received SIGILL
+>>>>>>>>>0xC4	belong	5		- received SIGTRAP
+>>>>>>>>>0xC4	belong	6		- received SIGABRT
+>>>>>>>>>0xC4	belong	7		- received SIGEMT
+>>>>>>>>>0xC4	belong	8		- received SIGFPE
+>>>>>>>>>0xC4	belong	10		- received SIGBUS
+>>>>>>>>>0xC4	belong	11		- received SIGSEGV
+>>>>>>>>>0xC4	belong	12		- received SIGSYS
+>>>>>>>>>0xC4	belong	33		- received SIGXCPU
+>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
+# Order 3: FORMAT, KERNEL, EXEC, PROC
+0x24		string	HP-UX
+>0		belong	1
+>>0xC		belong	4
+>>>0x10		belong	1
+>>>>0x14	belong	2
+>>>>>0x20	belong	0x3C
+>>>>>>0x60	belong	0x100
+>>>>>>>0x6C	belong	0x44
+>>>>>>>>0xB4	belong	4		core file
+>>>>>>>>>0xA4	string	>\0		from '%s'
+>>>>>>>>>0xC4	belong	3		- received SIGQUIT
+>>>>>>>>>0xC4	belong	4		- received SIGILL
+>>>>>>>>>0xC4	belong	5		- received SIGTRAP
+>>>>>>>>>0xC4	belong	6		- received SIGABRT
+>>>>>>>>>0xC4	belong	7		- received SIGEMT
+>>>>>>>>>0xC4	belong	8		- received SIGFPE
+>>>>>>>>>0xC4	belong	10		- received SIGBUS
+>>>>>>>>>0xC4	belong	11		- received SIGSEGV
+>>>>>>>>>0xC4	belong	12		- received SIGSYS
+>>>>>>>>>0xC4	belong	33		- received SIGXCPU
+>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
+# Order 4: EXEC, KERNEL, FORMAT, PROC
+0x64		string	HP-UX
+>0		belong	0x100
+>>0xC		belong	0x44
+>>>0x54		belong	2
+>>>>0x60	belong	0x3C
+>>>>>0xA0	belong	1
+>>>>>>0xAC	belong	4
+>>>>>>>0xB0	belong	1
+>>>>>>>>0xB4	belong	4		core file
+>>>>>>>>>0x44	string	>\0		from '%s'
+>>>>>>>>>0xC4	belong	3		- received SIGQUIT
+>>>>>>>>>0xC4	belong	4		- received SIGILL
+>>>>>>>>>0xC4	belong	5		- received SIGTRAP
+>>>>>>>>>0xC4	belong	6		- received SIGABRT
+>>>>>>>>>0xC4	belong	7		- received SIGEMT
+>>>>>>>>>0xC4	belong	8		- received SIGFPE
+>>>>>>>>>0xC4	belong	10		- received SIGBUS
+>>>>>>>>>0xC4	belong	11		- received SIGSEGV
+>>>>>>>>>0xC4	belong	12		- received SIGSYS
+>>>>>>>>>0xC4	belong	33		- received SIGXCPU
+>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
+# Order 5: FORMAT, EXEC, KERNEL, PROC
+0x78		string	HP-UX
+>0		belong	1
+>>0xC		belong	4
+>>>0x10		belong	1
+>>>>0x14	belong	0x100
+>>>>>0x20	belong	0x44
+>>>>>>0x68	belong	2
+>>>>>>>0x74	belong	0x3C
+>>>>>>>>0xB4	belong	4		core file
+>>>>>>>>>0x58	string	>\0		from '%s'
+>>>>>>>>>0xC4	belong	3		- received SIGQUIT
+>>>>>>>>>0xC4	belong	4		- received SIGILL
+>>>>>>>>>0xC4	belong	5		- received SIGTRAP
+>>>>>>>>>0xC4	belong	6		- received SIGABRT
+>>>>>>>>>0xC4	belong	7		- received SIGEMT
+>>>>>>>>>0xC4	belong	8		- received SIGFPE
+>>>>>>>>>0xC4	belong	10		- received SIGBUS
+>>>>>>>>>0xC4	belong	11		- received SIGSEGV
+>>>>>>>>>0xC4	belong	12		- received SIGSYS
+>>>>>>>>>0xC4	belong	33		- received SIGXCPU
+>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
+# Order 6: EXEC, FORMAT, KERNEL, PROC
+>0		belong	0x100
+>>0xC		belong	0x44
+>>>0x54		belong	1
+>>>>0x60	belong	4
+>>>>>0x64	belong	1
+>>>>>>0x68	belong	2
+>>>>>>>0x74	belong	0x2C
+>>>>>>>>0xB4	belong	4		core file
+>>>>>>>>>0x44	string	>\0		from '%s'
+>>>>>>>>>0xC4	belong	3		- received SIGQUIT
+>>>>>>>>>0xC4	belong	4		- received SIGILL
+>>>>>>>>>0xC4	belong	5		- received SIGTRAP
+>>>>>>>>>0xC4	belong	6		- received SIGABRT
+>>>>>>>>>0xC4	belong	7		- received SIGEMT
+>>>>>>>>>0xC4	belong	8		- received SIGFPE
+>>>>>>>>>0xC4	belong	10		- received SIGBUS
+>>>>>>>>>0xC4	belong	11		- received SIGSEGV
+>>>>>>>>>0xC4	belong	12		- received SIGSYS
+>>>>>>>>>0xC4	belong	33		- received SIGXCPU
+>>>>>>>>>0xC4	belong	34		- received SIGXFSZ

Magdir/images

@@ -24,12 +24,24 @@
 
 # PBMPLUS images
 # The next byte following the magic is always whitespace.
-0	string		P1		PBM image text
-0	string		P2		PGM image text
-0	string		P3		PPM image text
-0	string		P4		PBM "rawbits" image data
-0	string		P5		PGM "rawbits" image data
-0	string		P6		PPM "rawbits" image data
+0	string		P1		Netpbm PBM image text
+0	string		P2		Netpbm PGM image text
+0	string		P3		Netpbm PPM image text
+0	string		P4		Netpbm PBM "rawbits" image data
+0	string		P5		Netpbm PGM "rawbits" image data
+0	string		P6		Netpbm PPM "rawbits" image data
+0	string		P7		Netpbm PAM image file
+
+# From: bryanh@giraffe-data.com (Bryan Henderson)
+0	string		\117\072	Solitaire Image Recorder format
+>4	string		\013		MGI Type 11
+>4	string		\021		MGI Type 17
+0	string		.MDA		MicroDesign data
+>21	byte		48		version 2
+>21	byte		51		version 3
+0	string		.MDP		MicroDesign page data
+>21	byte		48		version 2
+>21	byte		51		version 3
 
 # NIFF (Navy Interchange File Format, a modification of TIFF) images
 0	string		IIN1		NIFF image data
@@ -219,6 +231,10 @@
 >12	belong		x		%d
 #
 2048	string		PCD_IPI		Kodak Photo CD image pack file
+>0xe02	byte&0x03	0x00		, landscape mode
+>0xe02	byte&0x03	0x01		, portrait mode
+>0xe02	byte&0x03	0x02		, landscape mode
+>0xe02	byte&0x03	0x03		, portrait mode
 0	string		PCD_OPA		Kodak Photo CD overview pack file
 
 # FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
@@ -242,4 +258,78 @@
 0	beshort		0x1010		PEX Binary Archive
 
 # Visio drawings
-03000	string	Visio\ (TM)\ Drawing			%s
+03000	string	Visio\ (TM)\ Drawing	%s
+
+# Tgif files
+0	string	\%TGIF\ x 		Tgif file version %s
+
+# DICOM medical imaging data
+128	string	DICM			DICOM medical imaging data
+
+# XWD - X-Windows Dump file.
+#   As described in /usr/X11R6/include/X11/XWDFile.h
+#   used by the xwd program.
+#   Bradford Castalia, idaeim, 1/01
+4	belong	7			XWD X-Windows Dump image data
+>100	string	>\0			\b, "%s"
+>16	belong	x			\b, %dx
+>20	belong	x			\b%dx
+>12	belong	x			\b%d
+
+# PDS - Planetary Data System
+#   These files use Parameter Value Language in the header section.
+#   Unfortunately, there is no certain magic, but the following
+#   strings have been found to be most likely.
+0	string	NJPL1I00		PDS (JPL) image data
+2	string	NJPL1I			PDS (JPL) image data
+0	string	CCSD3ZF			PDS (CCSD) image data
+2	string	CCSD3Z			PDS (CCSD) image data
+0	string	PDS_			PDS image data
+0	string	LBLSIZE=		PDS (VICAR) image data
+
+# pM8x: ATARI STAD compressed bitmap format
+#
+# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
+# p M 8 5/6 xx yy zz data...
+# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
+# bytes either run horizontally (pM85) or vertically (pM86). yy is the
+# most frequent byte, xx and zz are runlength escape codes, where xx is
+# used for runs of yy.
+#
+0	string	pM85		Atari ST STAD bitmap image data (hor)
+>5	byte	0x00		(white background)
+>5	byte	0xFF		(black background)
+0	string	pM86		Atari ST STAD bitmap image data (vert)
+>5	byte	0x00		(white background)
+>5	byte	0xFF		(black background)
+
+# XXX:
+# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
+# magic.
+# SGI RICE image file <mpruett@sgi.com>
+#0	beshort	0x5249		RICE image
+#>2	beshort	x		v%d
+#>4	beshort	x		(%d x
+#>6	beshort	x		%d)
+#>8	beshort	0		8 bit
+#>8	beshort	1		10 bit
+#>8	beshort	2		12 bit
+#>8	beshort	3		13 bit
+#>10	beshort	0		4:2:2
+#>10	beshort	1		4:2:2:4
+#>10	beshort	2		4:4:4
+#>10	beshort	3		4:4:4:4
+#>12	beshort	1		RGB
+#>12	beshort	2		CCIR601
+#>12	beshort	3		RP175
+#>12	beshort	4		YUV
+
+#------------------------------------------------------------------------------
+#
+# Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image  file format
+# for the EPOC operating system, which is used with PDAs like those from Psion
+#
+# see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description
+# of various EPOC file formats
+
+0	string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file

Magdir/ispell

@@ -52,3 +52,11 @@
 >2	beshort		0x0E		8-bit, capitalization, 256 flags
 >2	beshort		0x0F		7-bit, capitalization, 256 flags
 >4	beshort		>0		and %d string characters
+# ispell 4.0 hash files  kromJx <kromJx@crosswinds.net>
+# Ispell 4.0
+0       string          ISPL            ispell
+>4      long            x               hash file version %d,
+>8      long            x               lexletters %d,
+>12     long            x               lexsize %d,
+>16     long            x               hashsize %d,
+>20     long            x               stblsize %d

Magdir/jpeg

@@ -10,7 +10,7 @@
 #
 0	beshort		0xffd8		JPEG image data
 >6	string		JFIF		\b, JFIF standard
-
+>6	string		Exif		\b, EXIF standard
 # The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
 # in a vain attempt to add image size reporting for JFIF.  Note that these
 # tests are not fool-proof since some perfectly valid JPEGs are currently
@@ -22,8 +22,6 @@
 >13	byte		0		\b, aspect ratio
 >13	byte		1		\b, resolution (DPI)
 >13	byte		2		\b, resolution (DPCM)
->14	beshort		x		\b X%d:
->16	beshort		x		\bY%d
 #>4	beshort		x		\b, segment length %d
 # Next, show thumbnail info, if it exists:
 >18	byte		!0		\b, thumbnail %dx
@@ -56,6 +54,8 @@
 # I've commented-out quantisation table reporting.  I doubt anyone cares yet.
 #>(4.S+5)	byte		0xDB		\b, quantisation table
 #>>(4.S+6)	beshort		x		\b length=%d
+>14	beshort		x		\b, %d x
+>16	beshort		x		\b %d
 
 # HSI is Handmade Software's proprietary JPEG encoding scheme
 0	string		hsi1		JPEG image data, HSI proprietary

Magdir/lif

@@ -2,6 +2,6 @@
 #------------------------------------------------------------------------------
 # lif:  file(1) magic for lif
 #
-# XXX - byte order?  (Probably beshort, Daniel Quinlan <quinlan@yggdrasil.com>)
+# (Daniel Quinlan <quinlan@yggdrasil.com>)
 #
-0	short		0x8000		lif file
+0	beshort		0x8000		lif file

Magdir/linux

@@ -35,9 +35,6 @@
 >28	long		!0		not stripped
 0	string		\01\03\040\20	Minix-386 executable
 >28	long		!0		not stripped
-# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
-0	string		*nazgul*	Linux compiled message catalog
->8	lelong		>0		\b, version %ld
 # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
 216	lelong		0421		Linux/i386 core file
 >220	string		>\0		of '%s'

Magdir/lisp

@@ -6,8 +6,9 @@
 0	string	;;			Lisp/Scheme program text
 # Emacs 18 - this is always correct, but not very magical.
 0	string	\012(			byte-compiled Emacs-Lisp program data
-# Emacs 19
-0	string	;ELC\023\000\000\000	byte-compiled Emacs-Lisp program data
+# Emacs 19+ - ver. recognition added by Ian Springer
+0	string	;ELC			byte-compiled Emacs-Lisp program data,
+>4	byte	>0			version %d
 #
 # Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
 0	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program text
@@ -16,3 +17,6 @@
 # Files produced by GNU gettext
 0	long	0xDE120495		GNU-format message catalog data
 0	long	0x950412DE		GNU-format message catalog data
+
+#.com and .bin for MIT scheme 
+0	string	\372\372\372\372	MIT scheme (library?)

Magdir/macintosh

@@ -11,69 +11,325 @@
 # files obtained from most archives. (franklsm@tuns.ca)
 0	string		SIT!			StuffIt Archive (data)
 >2	string		x			: %s
-65	string		SIT!			StuffIt Archive (rsrc + data)
->2	string		x			: %s
 0	string		SITD			StuffIt Deluxe (data)
 >2	string		x			: %s
-65	string		SITD			StuffIt Deluxe (rsrc + data)
->2	string		x			: %s
 0	string		Seg			StuffIt Deluxe Segment (data)
 >2	string		x			: %s
-65	string		Seg			StuffIt Deluxe Segment (rsrc + data)
->2	string		x			: %s
 
 # Macintosh Applications and Installation binaries (franklsm@tuns.ca)
 0	string		APPL			Macintosh Application (data)
->2	string		x			: %s
-65	string		APPL			Macintosh Application (rsrc + data)
->2	string		x			: %s
+>2	string		x			\b: %s
 
 # Macintosh System files (franklsm@tuns.ca)
 0	string		zsys			Macintosh System File (data)
-65	string		zsys			Macintosh System File(rsrc + data)
 0	string		FNDR			Macintosh Finder (data)
-65	string		FNDR			Macintosh Finder(rsrc + data)
 0	string		libr			Macintosh Library (data)
 >2	string		x			: %s
-65	string		libr			Macintosh Library(rsrc + data)
->2	string		x			: %s
 0	string		shlb			Macintosh Shared Library (data)
 >2	string		x			: %s
-65	string		shlb			Macintosh Shared Library(rsrc + data)
->2	string		x			: %s
 0	string		cdev			Macintosh Control Panel (data)
 >2	string		x			: %s
-65	string		cdev			Macintosh Control Panel(rsrc + data)
->2	string		x			: %s
 0	string		INIT			Macintosh Extension (data)
 >2	string		x			: %s
-65	string		INIT			Macintosh Extension(rsrc + data)
->2	string		x			: %s
 0	string		FFIL			Macintosh Truetype Font (data)
 >2	string		x			: %s
-65	string		FFIL			Macintosh Truetype Font(rsrc + data)
->2	string		x			: %s
 0	string		LWFN			Macintosh Postscript Font (data)
 >2	string		x			: %s
-65	string		LWFN			Macintosh Postscript Font(rsrc + data)
->2	string		x			: %s
 
 # Additional Macintosh Files (franklsm@tuns.ca)
-
 0	string		PACT			Macintosh Compact Pro Archive (data)
 >2	string		x			: %s
-65	string		PACT			Macintosh Compact Pro Archive(rsrc + data)
->2	string		x			: %s
 0	string		ttro			Macintosh TeachText File (data)
 >2	string		x			: %s
-65	string		ttro			Macintosh TeachText File(rsrc + data)
->2	string		x			: %s
 0	string		TEXT			Macintosh TeachText File (data)
 >2	string		x			: %s
-65	string		TEXT			Macintosh TeachText File(rsrc + data)
->2	string		x			: %s
 0	string		PDF			Macintosh PDF File (data)
 >2	string		x			: %s
-65	string		PDF			Macintosh PDF File(rsrc + data)
->2	string		x			: %s
 
+# MacBinary format (Eric Fischer, enf@pobox.com)
+#
+# Unfortunately MacBinary doesn't really have a magic number prior
+# to the MacBinary III format.  The checksum is really the way to
+# do it, but the magic file format isn't up to the challenge.
+#
+# 0	byte		0
+# 1	byte				# filename length
+# 2	string				# filename
+# 65    string				# file type
+# 69	string				# file creator
+# 73	byte				# Finder flags
+# 74	byte		0
+# 75	beshort				# vertical posn in window
+# 77	beshort				# horiz posn in window
+# 79	beshort				# window or folder ID
+# 81    byte				# protected?
+# 82	byte		0
+# 83	belong				# length of data segment
+# 87	belong				# length of resource segment
+# 91	belong				# file creation date
+# 95	belong				# file modification date
+# 99	beshort				# length of comment after resource
+# 101	byte				# new Finder flags
+# 102	string		mBIN		# (only in MacBinary III)
+# 106	byte				# char. code of file name
+# 107	byte				# still more Finder flags
+# 116	belong				# total file length
+# 120	beshort				# length of add'l header
+# 122	byte		129		# for MacBinary II
+# 122	byte		130		# for MacBinary III
+# 123	byte		129		# minimum version that can read fmt
+# 124	beshort				# checksum
+#
+# This attempts to use the version numbers as a magic number, requiring
+# that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
+# be 0x81.  This works for the files I have, but maybe not for everyone's.
+
+122	beshort&0xFCFF	0x8081		Macintosh MacBinary data
+
+# MacBinary I doesn't have the version number field at all, but MacBinary II
+# has been in use since 1987 so I hope there aren't many really old files
+# floating around that this will miss.  The original spec calls for using
+# the nulls in 0, 74, and 82 as the magic number.
+#
+# Another possibility, that would also work for MacBinary I, is to use
+# the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
+# have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
+# and that 74 will be 0.  So something like
+# 
+# 71 	belong&0x80804EFF 0x00000000 	Macintosh MacBinary data
+# 
+# >73	byte&0x01	0x01		\b, inited
+# >73	byte&0x02	0x02		\b, changed
+# >73	byte&0x04	0x04		\b, busy
+# >73	byte&0x08	0x08		\b, bozo
+# >73	byte&0x10	0x10		\b, system
+# >73	byte&0x10	0x20		\b, bundle
+# >73	byte&0x10	0x40		\b, invisible
+# >73	byte&0x10	0x80		\b, locked
+
+>65	string		x		\b, type "%4.4s"
+
+>65	string		8BIM		(PhotoShop)
+>65	string		ALB3		(PageMaker 3)
+>65	string		ALB4		(PageMaker 4)
+>65	string		ALT3		(PageMaker 3)
+>65	string		APPL		(application)
+>65	string		AWWP		(AppleWorks word processor)
+>65	string		CIRC		(simulated circuit)
+>65	string		DRWG		(MacDraw)
+>65	string		EPSF		(Encapsulated PostScript)
+>65	string		FFIL		(font suitcase)
+>65	string		FKEY		(function key)
+>65	string		FNDR		(Macintosh Finder)
+>65	string		GIFf		(GIF image)
+>65	string		Gzip		(GNU gzip)
+>65	string		INIT		(system extension)
+>65	string		LIB\ 		(library)
+>65	string		LWFN		(PostScript font)
+>65	string		MSBC		(Microsoft BASIC)
+>65	string		PACT		(Compact Pro archive)
+>65	string		PDF\ 		(Portable Document Format)
+>65	string		PICT		(picture)
+>65	string		PNTG		(MacPaint picture)
+>65	string		PREF		(preferences)
+>65	string		PROJ		(Think C project)
+>65	string		QPRJ		(Think Pascal project)
+>65	string		SCFL		(Defender scores)
+>65	string		SCRN		(startup screen)
+>65	string		SITD		(StuffIt Deluxe)
+>65	string		SPn3		(SuperPaint)
+>65	string		STAK		(HyperCard stack)
+>65	string		Seg\ 		(StuffIt segment)
+>65	string		TARF		(Unix tar archive)
+>65	string		TEXT		(ASCII)
+>65	string		TIFF		(TIFF image)
+>65	string		TOVF		(Eudora table of contents)
+>65	string		WDBN		(Microsoft Word word processor)
+>65	string		WORD		(MacWrite word processor)
+>65	string		XLS\ 		(Microsoft Excel)
+>65	string		ZIVM		(compress (.Z))
+>65	string		ZSYS		(Pre-System 7 system file)
+>65	string		acf3		(Aldus FreeHand)
+>65	string		cdev		(control panel)
+>65	string		dfil		(Desk Acessory suitcase)
+>65	string		libr		(library)
+>65	string		nX^d		(WriteNow word processor)
+>65	string		nX^w		(WriteNow dictionary)
+>65	string		rsrc		(resource)
+>65	string		scbk		(Scrapbook)
+>65	string		shlb		(shared library)
+>65	string		ttro		(SimpleText read-only)
+>65	string		zsys		(system file)
+
+>69	string		x		\b, creator "%4.4s"
+
+# Somewhere, Apple has a repository of registered Creator IDs.  These are
+# just the ones that I happened to have files from and was able to identify.
+
+>69	string		8BIM		(Adobe Photoshop)
+>69	string		ALD3		(PageMaker 3)
+>69	string		ALD4		(PageMaker 4)
+>69	string		ALFA		(Alpha editor)
+>69	string		APLS		(Apple Scanner)
+>69	string		APSC		(Apple Scanner)
+>69	string		BRKL		(Brickles)
+>69	string		BTFT		(BitFont)
+>69	string		CCL2 		(Common Lisp 2)
+>69	string		CCL\ 		(Common Lisp)
+>69	string		CDmo		(The Talking Moose)
+>69	string		CPCT		(Compact Pro)
+>69	string		CSOm		(Eudora)
+>69	string		DMOV		(Font/DA Mover)
+>69	string		DSIM		(DigSim)
+>69	string		EDIT		(Macintosh Edit)
+>69	string		ERIK		(Macintosh Finder)
+>69	string		EXTR		(self-extracting archive)
+>69	string		Gzip		(GNU gzip)
+>69	string		KAHL		(Think C)
+>69	string		LWFU		(LaserWriter Utility)
+>69	string		LZIV		(compress)
+>69	string		MACA		(MacWrite)
+>69	string		MACS		(Macintosh operating system)
+>69	string		MAcK		(MacKnowledge terminal emulator)
+>69	string		MLND		(Defender)
+>69	string		MPNT		(MacPaint)
+>69	string		MSBB		(Microsoft BASIC (binary))
+>69	string		MSWD		(Microsoft Word)
+>69	string		NCSA		(NCSA Telnet)
+>69	string		PJMM		(Think Pascal)
+>69	string		PSAL		(Hunt the Wumpus)
+>69	string		PSI2		(Apple File Exchange)
+>69	string		R*ch		(BBEdit)
+>69	string		RMKR		(Resource Maker)
+>69	string		RSED		(Resource Editor)
+>69	string		Rich		(BBEdit)
+>69	string		SIT!		(StuffIt)
+>69	string		SPNT		(SuperPaint)
+>69	string		Unix		(NeXT Mac filesystem)
+>69	string		VIM!		(Vim editor)
+>69	string		WILD		(HyperCard)
+>69	string		XCEL		(Microsoft Excel)
+>69	string		aCa2		(Fontographer)
+>69	string		aca3		(Aldus FreeHand)
+>69	string		dosa		(Macintosh MS-DOS file system)
+>69	string		movr		(Font/DA Mover)
+>69	string		nX^n		(WriteNow)
+>69	string		pdos		(Apple ProDOS file system)
+>69	string		scbk		(Scrapbook)
+>69	string		ttxt		(SimpleText)
+>69	string		ufox		(Foreign File Access)
+
+# Just in case...
+
+102	string		mBIN		MacBinary III data with surprising version number
+
+# sas magic from Bruce Foster (bef@nwu.edu)
+#
+#0	string		SAS		SAS
+#>8	string		x		%s
+0	string		SAS		SAS
+>24	string		DATA		data file
+>24	string		CATALOG		catalog
+>24	string		INDEX		data file index
+>24	string		VIEW		data view
+# spss magic for SPSS system and portable files, 
+#	 from Bruce Foster (bef@nwu.edu).
+
+0	long		0xc1e2c3c9	SPSS Portable File
+>40	string 		x		%s
+
+0	string		$FL2		SPSS System File
+>24	string		x		%s
+
+# Macintosh filesystem data
+# From "Tom N Harris" <telliamed@mac.com>
+# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
+# entries depend on the data arithmetic added after v.35
+# There's also some Pascal strings in here, ditto...
+
+# The boot block signature, according to IM:Files, is 
+# "for HFS volumes, this field always contains the value 0x4C4B."
+# But if this is true for MFS or HFS+ volumes, I don't know.
+# Alternatively, the boot block is supposed to be zeroed if it's
+# unused, so a simply >0 should suffice.
+
+0x400	beshort			0xD2D7		Macintosh MFS data
+>0	beshort			0x4C4B		(bootable)
+>0x40a	beshort			&0x8000		(locked)
+>0x402	beldate-0x7C25B080	x		created: %s,
+>0x406	beldate-0x7C25B080	>0		last backup: %s,
+>0x414	belong			x		block size: %d,
+>0x412	beshort			x		number of blocks: %d,
+>0x424	pstring			x		volume name: %s
+
+0x400	beshort			0x4244		Macintosh HFS data
+>0	beshort			0x4C4B		(bootable)
+>0x40a	beshort			&0x8000		(locked)
+>0x40a	beshort			^0x0100		(mounted)
+>0x40a	beshort			&0x0800		(unclean)
+>0x402	beldate-0x7C25B080	x		created: %s,
+>0x406	beldate-0x7C25B080	x		last modified: %s,
+>0x440	beldate-0x7C25B080	>0		last backup: %s,
+>0x414	belong			x		block size: %d,
+>0x412	beshort			x		number of blocks: %d,
+>0x424	pstring			x		volume name: %s
+#>0x480	beshort			=0x482B		Embedded HFS+ Volume:
+#>>((0x482*(0x414))+(0x41c*512))	x	\b
+# Well, this is (theoretically) how we could do this. But it occurs to
+# me that we likely don't read in a large enough chunk. I don't have any
+# HFS+ volumes to see what a typical offset would be.
+
+0x400	beshort			0x482B		Macintosh HFS Extended
+>&2	beshort			x		version %d data
+>0	beshort			0x4C4B		(bootable)
+>&4	belong			^0x00000100	(mounted)
+>&4	belong			&0x00000800	(unclean)
+>&4	belong			&0x00008000	(locked)
+>&8	string			x		last mounted by: '%.4s',
+# really, that should be treated as a belong and we print a string
+# based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
+>&16	beldate-0x7C25B080	x		created: %s,
+>&20	beldate-0x7C25B080	x		last modified: %s,
+>&24	beldate-0x7C25B080	>0		last backup: %s,
+>&28	beldate-0x7C25B080	>0		last checked: %s,
+>&40	belong			x		block size: %d,
+>&44	belong			x		number of blocks: %d,
+>&48	belong			x		free blocks: %d
+
+# I don't think this is really necessary since it doesn't do much and 
+# anything with a valid driver descriptor will also have a valid
+# partition map
+#0		beshort		0x4552		Apple Device Driver data
+#>&24		beshort		=1		\b, MacOS
+
+# Is that the partition type a cstring or a pstring? Well, IM says "strings 
+# shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 
+# cstring. Of course, partitions can contain more than four entries, but 
+# what're you gonna do?
+0x200		beshort		0x504D		Apple Partition data
+>&2		beshort		x		block size: %d
+>&48		string		x		first type: %s,
+>&12		belong		x		number of blocks: %d,
+>(&0x2.S)	beshort		0x504D		
+>>&48		string		x		second type: %s
+>>&12		belong		x		number of blocks: %d,
+>>(&0x2.S)	beshort		0x504D		
+>>>&48		string		x		third type: %s
+>>>&12		belong		x		number of blocks: %d,
+>>>(&0x2.S)	beshort		0x504D		
+>>>>&48		string		x		fourth type: %s
+>>>>&12		belong		x		number of blocks: %d,
+# AFAIK, only the signature is different
+0x200		beshort		0x5453		Apple Old Partition data
+>&2		beshort		x		block size: %d
+>&48		string		x		first type: %s,
+>&12		belong		x		number of blocks: %d,
+>(&0x2.S)	beshort		0x504D		
+>>&48		string		x		second type: %s
+>>&12		belong		x		number of blocks: %d,
+>>(&0x2.S)	beshort		0x504D		
+>>>&48		string		x		third type: %s
+>>>&12		belong		x		number of blocks: %d,
+>>>(&0x2.S)	beshort		0x504D		
+>>>>&48		string		x		fourth type: %s
+>>>>&12		belong		x		number of blocks: %d,

Magdir/magic

@@ -3,3 +3,7 @@
 # magic:  file(1) magic for magic files
 #
 0	string		#\ Magic	magic text file for file(1) cmd
+0	lelong		0xF11E041C	magic binary file for file(1) cmd
+>4	lelong		x		(version %d) (little endian)
+0	belong		0xF11E041C	magic binary file for file(1) cmd
+>4	belong		x		(version %d) (big endian)

Magdir/mail.news

@@ -19,3 +19,10 @@
 0	string		Received:	RFC 822 mail text
 0	string		MIME-Version:	MIME entity text
 #0	string		Content-	MIME entity text
+
+# TNEF files...
+0	lelong		0x223E9F78	Transport Neutral Encapsulation Format
+
+# From: Kevin Sullivan <ksulliva@psc.edu>
+0	string		*mbx*		MBX mail folder
+

Magdir/maple

@@ -0,0 +1,57 @@
+
+#------------------------------------------------------------------------------
+# maple:  file(1) magic for maple files
+# "H. Nanosecond" <aldomel@ix.netcom.com>
+# Maple V release 4, a multi-purpose math program
+#
+
+# maple library .lib
+0	string	\000MVR4\nI	MapleVr4 library
+
+# .ind
+# no magic for these :-(
+# they are compiled indexes for maple files
+
+# .hdb 
+0	string	\000\004\000\000	Maple help database
+
+# .mhp
+# this has the form <PACKAGE=name>
+0	string	\<PACKAGE=	Maple help file
+0	string	\<HELP\ NAME=	Maple help file
+0	string	\n\<HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
+0	string	#\ Newton	Maple help file, old style
+0	string	#\ daub	Maple help file, old style
+0	string	#===========	Maple help file, old style
+
+# .mws
+0	string	\000\000\001\044\000\221	Maple worksheet
+#this is anomalous
+0	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
+# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
+# that is {VERSION major_version miunor_version computer_type version_string}
+0	string	{VERSION\ 	Maple worksheet
+>9	string	>\0	version %.1s.
+>>10	string
+>>>11	string	>\0	%.1s
+
+# .mps
+0	string	\0\0\001$	Maple something
+# from byte 4 it is either 'nul E' or 'soh R'
+# I think 'nul E' means a file that was saved as  a different name
+# a sort of revision marking
+# 'soh R' means new 
+>4	string	\000\105	An old revision
+>4	string	\001\122	The latest save
+
+# .mpl
+# some of these are the same as .mps above
+#0000000 000 000 001 044 000 105 same as .mps
+#0000000 000 000 001 044 001 122 same as .mps
+
+0	string	#\n##\ <SHAREFILE=	Maple something
+0	string	\n#\n##\ <SHAREFILE=	Maple something
+0	string	##\ <SHAREFILE=	Maple something
+0	string	#\r##\ <SHAREFILE=	Maple something
+0	string	\r#\r##\ <SHAREFILE=	Maple something
+0	string	#\ \r##\ <DESCRIBE>	Maple something anomalous.

Magdir/mathematica

@@ -0,0 +1,59 @@
+
+#------------------------------------------------------------------------------
+# mathematica:  file(1) magic for mathematica files
+# "H. Nanosecond" <aldomel@ix.netcom.com>
+# Mathematica a multi-purpose math program
+# versions 2.2 and 3.0
+
+#mathematica .mb
+0	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
+0	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook
+
+# .ma
+# multiple possibilites:
+
+0	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
+#>41	string	>\0	%s
+
+#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x
+
+#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
+#>675	string	>\0	%s #doesn't work well
+
+# there may be 'cr' instread of 'nl' in some does this matter?
+
+# generic:
+0	string	(*^\r\r::[\011	Mathematica notebook version 2.x
+0	string	\(\*\^\r\n\r\n\:\:\[\011	Mathematica notebook version 2.x
+0	string	(*^\015			Mathematica notebook version 2.x
+0	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
+0	string	(*^\r::[\011	Mathematica notebook version 2.x
+0	string	(*^\r\n::[\011	Mathematica notebook version 2.x
+0	string	(*^\n\n::[\011	Mathematica notebook version 2.x
+0	string	(*^\n::[\011	Mathematica notebook version 2.x
+
+
+# Mathematica .mx files
+
+#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
+0	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
+#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000	
+# >71... is optional
+>88	string	>\0	from %s
+
+
+# Mathematica files PBF:
+# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
+0	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)
+
+# .ml files  These are menu resources I think
+# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 
+# how to put that into a magic rule?
+4	string	\ A~	MAthematica .ml file
+
+# .nb files
+#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
+0	string	(***********************	Mathematica 3.0 notebook
+
+# other (* matches it is a comment start in these langs
+0	string	(*	Mathematica, or Pascal,  Modula-2 or 3 code

Magdir/sgi

@@ -1,6 +1,6 @@
 
 #------------------------------------------------------------------------------
-# sgi:  file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
+# mips:  file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
 #                         Dec Ultrix (MIPS)
 # all of SGI's *current* machines and OSes run in big-endian mode on the
 # MIPS machines, as far as I know.
@@ -27,7 +27,7 @@
 0	belong	0xdeadbabe	IRIX Parallel Arena
 >8	belong	>0		- version %ld
 #
-0	beshort	0x0160		MIPSEB COFF executable
+0	beshort	0x0160		MIPSEB ECOFF executable
 >20	beshort	0407		(impure)
 >20	beshort	0410		(swapped)
 >20	beshort	0413		(paged)
@@ -36,7 +36,7 @@
 >22	byte	x		- version %ld
 >23	byte	x		.%ld
 #
-0	beshort	0x0162		MIPSEL COFF executable
+0	beshort	0x0162		MIPSEL-BE ECOFF executable
 >20	beshort	0407		(impure)
 >20	beshort	0410		(swapped)
 >20	beshort	0413		(paged)
@@ -45,7 +45,7 @@
 >23	byte	x		- version %d
 >22	byte	x		.%ld
 #
-0	beshort	0x6001		MIPSEB-LE COFF executable
+0	beshort	0x6001		MIPSEB-LE ECOFF executable
 >20	beshort	03401		(impure)
 >20	beshort	04001		(swapped)
 >20	beshort	05401		(paged)
@@ -54,7 +54,7 @@
 >23	byte	x		- version %d
 >22	byte	x		.%ld
 #
-0	beshort	0x6201		MIPSEL-LE COFF executable
+0	beshort	0x6201		MIPSEL ECOFF executable
 >20	beshort	03401		(impure)
 >20	beshort	04001		(swapped)
 >20	beshort	05401		(paged)
@@ -65,7 +65,7 @@
 #
 # MIPS 2 additions
 #
-0	beshort	0x0163		MIPSEB MIPS-II COFF executable
+0	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
 >20	beshort	0407		(impure)
 >20	beshort	0410		(swapped)
 >20	beshort	0413		(paged)
@@ -74,7 +74,7 @@
 >22	byte	x		- version %ld
 >23	byte	x		.%ld
 #
-0	beshort	0x0166		MIPSEL MIPS-II COFF executable
+0	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
 >20	beshort	0407		(impure)
 >20	beshort	0410		(swapped)
 >20	beshort	0413		(paged)
@@ -83,7 +83,7 @@
 >22	byte	x		- version %ld
 >23	byte	x		.%ld
 #
-0	beshort	0x6301		MIPSEB-LE MIPS-II COFF executable
+0	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
 >20	beshort	03401		(impure)
 >20	beshort	04001		(swapped)
 >20	beshort	05401		(paged)
@@ -92,7 +92,7 @@
 >23	byte	x		- version %ld
 >22	byte	x		.%ld
 #
-0	beshort	0x6601		MIPSEL-LE MIPS-II COFF executable
+0	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
 >20	beshort	03401		(impure)
 >20	beshort	04001		(swapped)
 >20	beshort	05401		(paged)
@@ -103,7 +103,7 @@
 #
 # MIPS 3 additions
 #
-0	beshort	0x0140		MIPSEB MIPS-III COFF executable
+0	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
 >20	beshort	0407		(impure)
 >20	beshort	0410		(swapped)
 >20	beshort	0413		(paged)
@@ -112,7 +112,7 @@
 >22	byte	x		- version %ld
 >23	byte	x		.%ld
 #
-0	beshort	0x0142		MIPSEL MIPS-III COFF executable
+0	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
 >20	beshort	0407		(impure)
 >20	beshort	0410		(swapped)
 >20	beshort	0413		(paged)
@@ -121,7 +121,7 @@
 >22	byte	x		- version %ld
 >23	byte	x		.%ld
 #
-0	beshort	0x4001		MIPSEB-LE MIPS-III COFF executable
+0	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
 >20	beshort	03401		(impure)
 >20	beshort	04001		(swapped)
 >20	beshort	05401		(paged)
@@ -130,7 +130,7 @@
 >23	byte	x		- version %ld
 >22	byte	x		.%ld
 #
-0	beshort	0x4201		MIPSEL-LE MIPS-III COFF executable
+0	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
 >20	beshort	03401		(impure)
 >20	beshort	04001		(swapped)
 >20	beshort	05401		(paged)
@@ -140,7 +140,7 @@
 >22	byte	x		.%ld
 #
 0	beshort	0x180		MIPSEB Ucode
-0	beshort	0x182		MIPSEL Ucode
+0	beshort	0x182		MIPSEL-BE Ucode
 # 32bit core file
 0	belong	0xdeadadb0	IRIX core dump
 >4	belong	1		of
@@ -167,8 +167,11 @@
 #
 0	string	\#Inventor V	IRIS Inventor 1.0 file
 0	string	\#Inventor V2	Open Inventor 2.0 file
-# XXX - I don't know what next thing is!  It is likely to be an image
-# (or movie) format
+# GLF is OpenGL stream encoding
 0	string	glfHeadMagic();		GLF_TEXT
-4	belong	0x41010000		GLF_BINARY_LSB_FIRST
-4	belong	0x00000141		GLF_BINARY_MSB_FIRST
+4	belong	0x7d000000		GLF_BINARY_LSB_FIRST
+4	belong	0x0000007d		GLF_BINARY_MSB_FIRST
+# GLS is OpenGL stream encoding; GLS is the successor of GLF
+0	string	glsBeginGLS(		GLS_TEXT
+4	belong	0x10000000		GLS_BINARY_LSB_FIRST
+4	belong	0x00000010		GLS_BINARY_MSB_FIRST

Magdir/motorola

@@ -30,3 +30,21 @@
 #
 # Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
 0   string      S0          Motorola S-Record; binary data in text format
+
+# ATARI ST relocatable PRG
+#
+# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
+# (according to Roland Waldi, Oct 21, 1987)
+# besides the magic 0x601a, the text segment size is checked to be
+# not larger than 1 MB (which is a lot on ST).
+# The additional 0x601b distinction I took from Doug Lee's magic.
+0	belong&0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
+>2	belong			x		(txt=%ld,
+>6	belong			x		dat=%ld,
+>10	belong			x		bss=%ld,
+>14	belong			x		sym=%ld)
+0	belong&0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
+>2	belong			x		(txt=%ld,
+>6	belong			x		dat=%ld,
+>10	belong			x		bss=%ld,
+>14	belong			x		sym=%ld)

Magdir/msdos

@@ -175,12 +175,135 @@
 >4	belong	0x06040600	wk1 document data
 >4	belong	0x06800200	fmt document data
 
-# WordPerfect documents - Trevor Johnson <trevor@jpj.net>
-#
-1	string	WPC		WordPerfect document
-
 # Help files
 0	string	?_\3\0		MS Windows Help Data
 
 # Microsoft CAB distribution format  Dale Worley <root@dworley.ny.mediaone.net>
 0	string		MSCF\000\000\000\000	Microsoft CAB file
+
+#  DeIsL1.isu what this is I don't know
+0	string	\161\250\000\000\001\002	DeIsL1.isu whatever that is
+
+# Winamp .avs
+#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032	A plug in for Winamp ms-windows Freeware media player
+0	string	Nullsoft\ AVS\ Preset\ 	Winamp plug in
+
+# Hyper terminal:
+0	string	HyperTerminal\ 	hyperterm
+>15	string	1.0\ --\ HyperTerminal\ data\ file	MS-windows Hyperterminal
+
+# Windows Metafont .WMF
+0	string	\327\315\306\232\000\000\000\000\000\000	ms-windows metafont .wmf
+
+#tz3 files whatever that is (MS Works files)
+0	string	\003\001\001\004\070\001\000\000	tz3 ms-works file
+0	string	\003\002\001\004\070\001\000\000	tz3 ms-works file
+0	string	\003\003\001\004\070\001\000\000	tz3 ms-works file
+
+# PGP sig files .sig
+#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
+0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
+0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
+0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
+0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
+0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
+0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
+
+# windows zips files .dmf
+0	string	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 Ms-windows special zipped file
+
+
+# Windows help file FTG FTS
+0	string	\164\146\115\122\012\000\000\000\001\000\000\000	ms-windows help cache
+
+# grp old windows 3.1 group files
+0 string  \120\115\103\103	Ms-windows 3.1 group files
+
+
+# lnk files windows symlinks
+0	string	\114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106	ms-Windows shortcut
+
+#ico files
+0	string	\102\101\050\000\000\000\056\000\000\000\000\000\000\000	Icon for ms-windows
+
+# Windows icons (Ian Springer <ips@fpk.hp.com>)
+0	string	\000\000\001\000	ms-windows icon resource
+>4	byte	1			- 1 icon
+>4	byte	>1			- %d icons
+>>6	byte	>0			\b, %dx
+>>>7	byte	>0			\b%d
+>>8	byte	0			\b, 256-colors
+>>8	byte	>0			\b, %d-colors
+
+
+# True Type fonts currently misidentified as raw G3 data
+
+0	string	\000\001\000\000\000 MS-Windows true type font .ttf
+
+
+# .chr files
+0	string	PK\010\010BGI	Borland font 
+>4	string	>\0	%s
+# then there is a copyright notice
+
+
+# .bgi files
+0	string	pk\010\010BGI	Borland device 
+>4	string	>\0	%s
+# then there is a copyright notice
+
+
+# recycled/info the windows trash bin index
+9	string	\000\000\000\030\001\000\000\000 ms-windows recycled bin info
+
+
+##### put in Either Magic/font or Magic/news
+# Acroread or something  files wrongly identified as G3  .pfm
+# these have the form \000 \001 any? \002 \000 \000
+# or \000 \001 any? \022 \000 \000
+0	string  \000\001 pfm?
+>3	string  \022\000\000Copyright\  yes
+>3	string  \002\000\000Copyright\  yes
+#>3	string  >\0     oops, not a font file. Cancel that.
+#it clashes with ttf files so put it lower down.
+
+# From Doug Lee via a FreeBSD pr
+9	string		GERBILDOC	First Choice document
+9	string		GERBILDB	First Choice database
+9	string		GERBILCLIP	First Choice database
+0	string		GERBIL		First Choice device file
+9	string		RABBITGRAPH	RabbitGraph file
+0	string		DCU1		Borland Delphi .DCU file
+0	string		!<spell>	MKS Spell hash list (old format)
+0	string		!<spell2>	MKS Spell hash list
+0	string		AH		Halo(TM) bitmapped font file
+0	lelong		0x08086b70	TurboC BGI file
+0	lelong		0x08084b50	TurboC Font file
+
+# WARNING: below line conflicts with Infocom game data Z-machine 3
+0	byte		0x03		DBase 3 data file
+>0x04	lelong		0		(no records)
+>0x04	lelong		>0		(%ld records)
+0	byte		0x83		DBase 3 data file with memo(s)
+>0x04	lelong		0		(no records)
+>0x04	lelong		>0		(%ld records)
+0	leshort		0x0006		DBase 3 index file
+0	string		PMCC		Windows 3.x .GRP file
+1	string		RDC-meg		MegaDots 
+>8	byte		>0x2F		version %c
+>9	byte		>0x2F		\b.%c file
+0	lelong		0x4C
+>4	lelong		0x00021401	Windows shortcut file
+
+# DOS EPS Binary File Header
+# From: Ed Sznyter <ews@Black.Market.NET>
+0	belong		0xC5D0D3C6	DOS EPS Binary File
+>4	long		>0		Postscript starts at byte %d
+>>8	long		>0		length %d
+>>>12	long		>0		Metafile starts at byte %d
+>>>>16	long		>0		length %d
+>>>20	long		>0		TIFF starts at byte %d
+>>>>24	long		>0		length %d
+
+# TNEF magic From "Joomy" <joomy@se-ed.net> 
+0	leshort		0x223e9f78	TNEF

Magdir/msvc

@@ -0,0 +1,44 @@
+
+#------------------------------------------------------------------------------
+# msvc:  file(1) magic for msvc
+# "H. Nanosecond" <aldomel@ix.netcom.com>
+# Microsoft visual C
+# 
+# I have version 1.0
+
+# .aps
+0	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file
+
+# .ide
+#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
+0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide
+
+# .res
+0	string	\000\000\000\000\040\000\000\000\377	MSVC .res
+0	string	\377\003\000\377\001\000\020\020\350	MSVC .res
+0	string	\377\003\000\377\001\000\060\020\350	MSVC .res
+
+#.lib
+0	string	\360\015\000\000	Microsoft Visual C library
+0	string	\360\075\000\000	Microsoft Visual C library
+0	string	\360\175\000\000	Microsoft Visual C library
+
+#.pch
+0	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch
+
+# .pdb
+# too long 0	string	Microsoft\ C/C++\ program\ database\ 
+0	string	Microsoft\ C/C++\ 	MSVC program database
+>18	string	program\ database\ 	
+>33	string	>\0	ver %s
+
+#.sbr
+0	string	\000\002\000\007\000	MSVC .sbr
+>5	string 	>\0	%s
+
+#.bsc
+0	string	\002\000\002\001	MSVC .bsc
+
+#.wsp
+0	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
+# these seem to start with the version and contain menus

Magdir/natinst

@@ -0,0 +1,23 @@
+
+#-----------------------------------------------------------------------------
+# natinst:  file(1) magic for National Instruments Code Files
+
+#
+# From <egamez@fcfm.buap.mx> Enrique Gámez-Flores
+# version 1
+# Many formats still missing, we use, for the moment LabVIEW
+# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
+#
+0       string          RSRC            National Instruments,
+# Check if it's a LabVIEW File
+>8      string          LV              LabVIEW File,
+# Check wich kind of file is
+>>10    string          SB              Code Resource File, data
+>>10    string          IN              Virtual Instrument Program, data
+>>10    string          AR              VI Library, data
+# This is for Menu Libraries
+>8      string          LMNULBVW        Portable File Names, data
+# This is for General Resources
+>8      string          rsc             Resources File, data
+# This is for VXI Package
+0       string          VMAP            National Instruments, VXI File, data

Magdir/netbsd

@@ -30,6 +30,7 @@
 >16	lelong			>0		not stripped
 0	belong&0377777777	041400507	NetBSD/i386 core
 >12	string			>\0		from '%s'
+>32	lelong			!0		(signal %d)
 
 0	belong&0377777777	041600413	NetBSD/m68k demand paged
 >0	byte			&0x80		
@@ -51,6 +52,7 @@
 >16	belong			>0		not stripped
 0	belong&0377777777	041600507	NetBSD/m68k core
 >12	string			>\0		from '%s'
+>32	belong			!0		(signal %d)
 
 0	belong&0377777777	042000413	NetBSD/m68k4k demand paged
 >0	byte			&0x80		
@@ -72,6 +74,7 @@
 >16	belong			>0		not stripped
 0	belong&0377777777	042000507	NetBSD/m68k4k core
 >12	string			>\0		from '%s'
+>32	belong			!0		(signal %d)
 
 0	belong&0377777777	042200413	NetBSD/ns32532 demand paged
 >0	byte			&0x80		
@@ -93,6 +96,10 @@
 >16	lelong			>0		not stripped
 0	belong&0377777777	042200507	NetBSD/ns32532 core
 >12	string			>\0		from '%s'
+>32	lelong			!0		(signal %d)
+
+0	belong&0377777777	045200507	NetBSD/powerpc core
+>12	string			>\0		from '%s'
 
 0	belong&0377777777	042400413	NetBSD/sparc demand paged
 >0	byte			&0x80		
@@ -114,6 +121,7 @@
 >16	belong			>0		not stripped
 0	belong&0377777777	042400507	NetBSD/sparc core
 >12	string			>\0		from '%s'
+>32	belong			!0		(signal %d)
 
 0	belong&0377777777	042600413	NetBSD/pmax demand paged
 >0	byte			&0x80		
@@ -135,6 +143,7 @@
 >16	lelong			>0		not stripped
 0	belong&0377777777	042600507	NetBSD/pmax core
 >12	string			>\0		from '%s'
+>32	lelong			!0		(signal %d)
 
 0	belong&0377777777	043000413	NetBSD/vax 1k demand paged
 >0	byte			&0x80		
@@ -156,6 +165,7 @@
 >16	lelong			>0		not stripped
 0	belong&0377777777	043000507	NetBSD/vax 1k core
 >12	string			>\0		from '%s'
+>32	lelong			!0		(signal %d)
 
 0	belong&0377777777	045400413	NetBSD/vax 4k demand paged
 >0	byte			&0x80		
@@ -177,6 +187,7 @@
 >16	lelong			>0		not stripped
 0	belong&0377777777	045400507	NetBSD/vax 4k core
 >12	string			>\0		from '%s'
+>32	lelong			!0		(signal %d)
 
 # NetBSD/alpha does not support (and has never supported) a.out objects,
 # so no rules are provided for them.  NetBSD/alpha ELF objects are 
@@ -186,6 +197,7 @@
 >10	leshort		0x0000			stripped
 0	belong&0377777777	043200507	NetBSD/alpha core
 >12	string			>\0		from '%s'
+>32	lelong			!0		(signal %d)
 
 0	belong&0377777777	043400413	NetBSD/mips demand paged
 >0	byte			&0x80		
@@ -207,12 +219,13 @@
 >16	belong			>0		not stripped
 0	belong&0377777777	043400507	NetBSD/mips core
 >12	string			>\0		from '%s'
+>32	belong			!0		(signal %d)
 
 0	belong&0377777777	043600413	NetBSD/arm32 demand paged
 >0	byte			&0x80
->>20	lelong			<8192		shared library
->>20	lelong			=8192		dynamically linked executable
->>20	lelong			>8192		dynamically linked executable
+>>20	lelong			<4096		shared library
+>>20	lelong			=4096		dynamically linked executable
+>>20	lelong			>4096		dynamically linked executable
 >0	byte			^0x80		executable
 >16	lelong			>0		not stripped
 0	belong&0377777777	043600410	NetBSD/arm32 pure
@@ -226,5 +239,8 @@
 >>20	lelong			!0		executable
 >>20	lelong			=0		object file
 >16	lelong			>0		not stripped
-0	belong&0377777777	043600507	NetBSD/arm32 core
+# NetBSD/arm26 has always used ELF objects, but it shares a core file
+# format with NetBSD/arm32.
+0	belong&0377777777	043600507	NetBSD/arm core
 >12	string			>\0		from '%s'
+>32	lelong			!0		(signal %d)

Magdir/netscape

@@ -0,0 +1,21 @@
+
+#------------------------------------------------------------------------------
+# netscape:  file(1) magic for Netscape files
+# "H. Nanosecond" <aldomel@ix.netcom.com>
+# version 3 and 4 I think
+#
+
+# Netscape Address book  .nab
+0	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
+
+# .snm Caches
+0	string		#\ Netscape\ folder\ cache	Netscape folder cache
+0	string	\000\036\204\220\000	Netscape folder cache
+# .n2p 
+# Net 2 Phone 
+#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
+0	string	SX961999	Net2phone
+
+#
+#This is files ending in .art, FIXME add more rules
+0       string          JG\004\016\0\0\0\0      ART

Magdir/os9

@@ -1,6 +1,4 @@
 #
-#	$NetBSD: os9,v 1.2 1997/01/09 20:19:04 tls Exp $
-#
 # Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without

Magdir/parix

@@ -0,0 +1,12 @@
+
+#------------------------------------------------------------------------------
+#
+# Parix COFF executables
+# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
+#
+0	beshort&0xfff	0xACE	PARIX
+>0	byte&0xf0	0x80	T800
+>0	byte&0xf0	0x90	T9000
+>19	byte&0x02	0x02	executable
+>19	byte&0x02	0x00	object
+>19	byte&0x0c	0x00	not stripped

Magdir/printer

@@ -84,3 +84,5 @@
 # Now magic for IMAGEN font files...
 0	string		Rast		RST-format raster font data
 >45	string		>0		face %
+# From Jukka Ukkonen
+0	string		\033[K\002\0\0\017\033(a\001\0\001\033(g	Canon Bubble Jet BJC formatted data

Magdir/project

@@ -0,0 +1,9 @@
+
+#------------------------------------------------------------------------------
+# project:  file(1) magic for Project management
+# 
+# Magic strings for ftnchek project files. Alexander Mai
+0	string	FTNCHEK_\ P	project file for ftnchek
+>10	string	1		version 2.7
+>10	string	2		version 2.8 to 2.10
+>10	string	3		version 2.11 or later

Magdir/python

@@ -0,0 +1,5 @@
+# often the module starts with a multiline string
+0	string		"""	a python script text executable
+# MAGIC as specified in Python/import.c (1.5.2/1.6)
+# 20121  ( YEAR - 1995 ) + MONTH  + DAY (little endian followed by "\r\n"
+0	belong		0x994e0d0a	python compiled

Magdir/riff

@@ -39,6 +39,15 @@
 >8	string		WAVE		\b, WAVE audio
 >>20	leshort		1		\b, Microsoft PCM
 >>>34	leshort		>0		\b, %d bit
+>>20	leshort		2		\b, Microsoft ADPCM
+>>20	leshort		6		\b, ITU G.711 a-law
+>>20	leshort		7		\b, ITU G.711 u-law
+>>20	leshort		17		\b, IMA ADPCM
+>>20	leshort		20		\b, ITU G.723 ADPCM (Yamaha)
+>>20	leshort		49		\b, GSM 6.10
+>>20	leshort		64		\b, ITU G.721 ADPCM
+>>20	leshort		80		\b, MPEG
+>>20	leshort		85		\b, MPEG Layer 3
 >>22	leshort		=1		\b, mono
 >>22	leshort		=2		\b, stereo
 >>22	leshort		>2		\b, %d channels
@@ -91,3 +100,5 @@
 # Notation Interchange File Format (big-endian only)
 >8	string		NIFF		\b, Notation Interchange File Format
 
+# SoundFont 2 <mpruett@sgi.com>
+>8	string		sfbk		SoundFont 2

Magdir/sgml

@@ -3,26 +3,18 @@
 # sgml:  file(1) magic for Standard Generalized Markup Language
 # HyperText Markup Language (HTML) is an SGML document type,
 # from Daniel Quinlan (quinlan@yggdrasil.com)
-0   string      \<!DOCTYPE\ HTML    HTML document text
-0   string      \<!doctype\ html    HTML document text
-0   string      \<HEAD      HTML document text
-0   string      \<head      HTML document text
-0   string      \<TITLE     HTML document text
-0   string      \<title     HTML document text
-0   string      \<html      HTML document text
-0   string      \<HTML      HTML document text
+# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
+0   string/cB	\<!doctype\ html	HTML document text
+0   string/c	\<head			HTML document text
+0   string/c	\<title			HTML document text
+0   string/c	\<html			HTML document text
 
 # Extensible markup language (XML), a subset of SGML
 # from Marc Prud'hommeaux (marc@apocalypse.org)
-0       string          \<?xml          XML document text
-0       string          \<?XML          XML document text
-0       string          \<?Xml          XML document text
-
-# SGML, mostly from rph@sq
-0   string      \<!DOCTYPE  exported SGML document text
-0   string      \<!doctype  exported SGML document text
-0   string      \<!SUBDOC   exported SGML subdocument text
-0   string      \<!subdoc   exported SGML subdocument text
-0   string      \<!--       exported SGML document text
+0   string/c	\<?xml			XML document text
 
 
+# SGML, mostly from rph@sq
+0   string/c	\<!doctype		exported SGML document text
+0   string/c	\<!subdoc		exported SGML subdocument text
+0   string	\<!--			exported SGML document text

Magdir/sharc

@@ -0,0 +1,22 @@
+
+#------------------------------------------------------------------------
+# file(1) magic for sharc files
+#
+# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 
+# FutureGroove Music (dsp@futuregroove.de)
+
+#------------------------------------------------------------------------
+0	string			Draw		RiscOS Drawfile
+0	string			PACK		RiscOS PackdDir archive
+
+#------------------------------------------------------------------------
+# SHARC DSP stuff (based on the FGM SHARC DSP SDK)
+
+0	string			!		Assembler source
+0	string			Analog		ADi asm listing file
+0	string			.SYSTEM		SHARC architecture file
+0	string			.system		SHARC architecture file
+
+0	leshort			0x521C		SHARC COFF binary
+>2	leshort			>1		, %hd sections
+>>12	lelong			>0		, not stripped

Magdir/sketch

@@ -0,0 +1,5 @@
+
+#------------------------------------------------------------------------------
+# Sketch Drawings: http://sketch.sourceforge.net/ 
+# From: Edwin Mons <e@ik.nu>
+0	string	##Sketch	Sketch document text

Magdir/smalltalk

@@ -0,0 +1,24 @@
+
+#-----------------------------------------------
+# GNU Smalltalk image, starting at version 1.6.2
+# From: catull_us@yahoo.com
+#
+0	string	GSTIm\0\0	GNU SmallTalk
+# little-endian
+>7	byte&1	=0		LE image version
+>>10	byte	x		%d.
+>>9	byte	x		\b%d.
+>>8	byte	x		\b%d
+#>>12	lelong	x		, data: %ld
+#>>16	lelong	x		, table: %ld
+#>>20	lelong	x		, memory: %ld
+# big-endian
+>7	byte&1	=1		BE image version
+>>8	byte	x		%d.
+>>9	byte	x		\b%d.
+>>10	byte	x		\b%d
+#>>12	belong	x		, data: %ld
+#>>16	belong	x		, table: %ld
+#>>20	belong	x		, memory: %ld
+