Merge upstream version 4.17, import Debian version 4.17-1

ChangeLog

@@ -1,3 +1,42 @@
+2006-03-02 16:06 Christos Zoulas <christos@zoulas.com>
+
+	* Print empty if the file is (Mike Frysinger)
+
+	* Don't try to read past the end of the buffer (Mike Frysinger)
+
+	* Sort magic entries by strength [experimental]
+
+2005-11-29 13:26 Christos Zoulas <christos@zoulas.com>
+
+	* Use iswprint() to convert the output string.
+	    (Bastien Nocera)
+
+2005-10-31 8:54 Christos Zoulas <christos@zoulas.com>
+
+	* Fix regression where the core info was not completely processed
+	    (Radek Vokál)
+
+2005-10-20 11:15 Christos Zoulas <christos@zoulas.com>
+
+	* Middle Endian magic (Diomidis Spinellis)
+
+2005-10-17 11:15 Christos Zoulas <christos@zoulas.com>
+
+	* Open with O_BINARY for CYGWIN (Corinna Vinschen)
+
+	* Don't close stdin (Arkadiusz Miskiewicz)
+
+	* Look for note sections in non executables.
+
+2005-09-20 13:33 Christos Zoulas <christos@zoulas.com>
+	
+	* Don't print SVR4 Style in core files multiple times
+	    (Radek Vokál)
+
+2005-08-27 04:09 Christos Zoulas <christos@zoulas.com>
+
+	* Cygwin changes Corinna Vinschen
+
 2005-08-18 09:53 Christos Zoulas <christos@zoulas.com>
 
 	* Remove erroreous mention of /etc/magic in the file man page

Makefile.in

@@ -1,4 +1,4 @@
-# Makefile.in generated by automake 1.9.5 from Makefile.am.
+# Makefile.in generated by automake 1.9.6 from Makefile.am.
 # @configure_input@
 
 # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,

aclocal.m4

@@ -1,4 +1,4 @@
-# generated automatically by aclocal 1.9.5 -*- Autoconf -*-
+# generated automatically by aclocal 1.9.6 -*- Autoconf -*-
 
 # Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004,
 # 2005  Free Software Foundation, Inc.
@@ -6176,7 +6176,7 @@ AC_DEFUN([AM_AUTOMAKE_VERSION], [am__api_version="1.9"])
 # Call AM_AUTOMAKE_VERSION so it can be traced.
 # This function is AC_REQUIREd by AC_INIT_AUTOMAKE.
 AC_DEFUN([AM_SET_CURRENT_AUTOMAKE_VERSION],
-	 [AM_AUTOMAKE_VERSION([1.9.5])])
+	 [AM_AUTOMAKE_VERSION([1.9.6])])
 
 # AM_AUX_DIR_EXPAND                                         -*- Autoconf -*-
 

configure

@@ -1808,7 +1808,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE=file
- VERSION=4.15
+ VERSION=4.17
 
 
 cat >>confdefs.h <<_ACEOF

configure.in

@@ -1,7 +1,7 @@
 dnl Process this file with autoconf to produce a configure script.
 AC_INIT
 AC_CONFIG_SRCDIR([src/file.c])
-AM_INIT_AUTOMAKE(file, 4.15)
+AM_INIT_AUTOMAKE(file, 4.17)
 AM_CONFIG_HEADER([config.h])
 AM_MAINTAINER_MODE
 

debian/p

@@ -0,0 +1,29 @@
+diff -ur file-4.15.old/src/readelf.c file-4.15/src/readelf.c
+--- file-4.15.old/src/readelf.c	2005-07-14 04:22:25.000000000 +0200
++++ file-4.15/src/readelf.c	2005-11-05 11:15:12.000000000 +0100
+@@ -352,6 +352,14 @@
+ 			if (file_printf(ms, "Solaris") == -1)
+ 				return size;
+ 			break;
++		case GNU_OS_KFREEBSD:
++			if (file_printf(ms, "kFreeBSD") == -1)
++				return size;
++			break;
++		case GNU_OS_KNETBSD:
++			if (file_printf(ms, "kNetBSD") == -1)
++				return size;
++			break;
+ 		default:
+ 			if (file_printf(ms, "<unknown>") == -1)
+ 				return size; 
+diff -ur file-4.15.old/src/readelf.h file-4.15/src/readelf.h
+--- file-4.15.old/src/readelf.h	2005-06-30 18:33:01.000000000 +0200
++++ file-4.15/src/readelf.h	2005-11-05 11:15:41.000000000 +0100
+@@ -231,5 +231,7 @@
+ #define GNU_OS_LINUX	0
+ #define GNU_OS_HURD	1
+ #define GNU_OS_SOLARIS	2
++#define GNU_OS_KFREEBSD	3
++#define GNU_OS_KNETBSD	4
+ 
+ #endif

doc/Makefile.in

@@ -1,4 +1,4 @@
-# Makefile.in generated by automake 1.9.5 from Makefile.am.
+# Makefile.in generated by automake 1.9.6 from Makefile.am.
 # @configure_input@
 
 # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,

doc/file.man

@@ -1,4 +1,4 @@
-.TH FILE __CSECTION__ "October 2005" "Debian/GNU Linux" "Copyrighted but distributable"
+.TH FILE __CSECTION__ "March 2006" "Debian/GNU Linux" "Copyrighted but distributable"
 .\" $Id: file.man,v 1.57 2005/08/18 15:18:22 christos Exp $
 .SH NAME
 file

doc/magic.man

@@ -54,6 +54,9 @@ Finally the ``c'' flag, specifies case insensitive matching: lowercase
 characters in the magic match both lower and upper case characters in the
 target, whereas upper case characters in the magic, only much uppercase
 characters in the target.
+.IP pstring
+A pascal style string where the first byte is interpreted as the an
+unsigned length. The string is not NUL terminated.
 .IP date
 A four-byte value interpreted as a UNIX date.
 .IP ldate
@@ -66,6 +69,12 @@ A four-byte value (on most systems) in big-endian byte order.
 .IP bedate
 A four-byte value (on most systems) in big-endian byte order,
 interpreted as a Unix date.
+.IP beldate
+A four-byte value (on most systems) in big-endian byte order,
+interpreted as a UNIX-style date, but interpreted as local time rather
+than UTC.
+.IP bestring16
+A two-byte unicode (UCS16) string in big-endian byte order.
 .IP leshort
 A two-byte value (on most systems) in little-endian byte order.
 .IP lelong
@@ -77,6 +86,17 @@ interpreted as a UNIX date.
 A four-byte value (on most systems) in little-endian byte order,
 interpreted as a UNIX-style date, but interpreted as local time rather
 than UTC.
+.IP lestring16
+A two-byte unicode (UCS16) string in little-endian byte order.
+.IP melong
+A four-byte value (on most systems) in middle-endian (PDP-11) byte order.
+.IP medate
+A four-byte value (on most systems) in middle-endian (PDP-11) byte order,
+interpreted as a UNIX date.
+.IP meldate
+A four-byte value (on most systems) in middle-endian (PDP-11) byte order,
+interpreted as a UNIX-style date, but interpreted as local time rather
+than UTC.
 .IP regex
 A regular expression match in extended POSIX regular expression syntax
 (much like egrep).
@@ -137,6 +157,8 @@ that are set in the specified value,
 .BR ^ ,
 to specify that the value from the file must have clear any of the bits
 that are set in the specified value, or
+.BR ~ ,
+the value specified after is negated before tested.
 .BR x ,
 to specify that any value will match.
 If the character is omitted, it is assumed to be
@@ -228,11 +250,14 @@ The value of
 .I x
 is used as an offset in the file. A byte, short or long is read at that offset
 depending on the
-.B [bslBSL]
+.B [bslBSLm]
 type specifier.
 The capitalized types interpret the number as a big endian
 value, whereas the small letter versions interpret the number as a little
-endian value.
+endian value;
+the
+.B m
+type interprets the number as a middle endian (PDP-11) value.
 To that number the value of
 .I y
 is added and the result is used as an offset in the file.
@@ -340,20 +365,22 @@ The formats
 .IR long ,
 .IR belong ,
 .IR lelong ,
+.IR melong ,
 .IR short ,
 .IR beshort ,
 .IR leshort ,
 .IR date ,
 .IR bedate ,
+.IR medate ,
+.IR ledate ,
+.IR beldate ,
+.IR leldate ,
 and
-.I ledate
+.I meldate
 are system-dependent; perhaps they should be specified as a number
 of bytes (2B, 4B, etc),
 since the files being recognized typically come from
 a system on which the lengths are invariant.
-.PP
-There is (currently) no support for specified-endian data to be used in
-indirect offsets.
 .SH SEE ALSO
 .BR file (__CSECTION__)
 \- the command that reads this file.
@@ -370,4 +397,4 @@ indirect offsets.
 .\" the changes I posted to the S5R2 version.
 .\"
 .\" Modified for Ian Darwin's version of the file command.
-.\" @(#)$Id: magic.man,v 1.28 2005/03/17 17:34:15 christos Exp $
+.\" @(#)$Id: magic.man,v 1.30 2006/02/19 18:16:03 christos Exp $

magic/Magdir/amigaos

@@ -42,6 +42,9 @@
 0	beshort		0x0f03		AmigaOS outline font
 0	belong		0x80001001	AmigaOS outline tag
 0	string		##\ version	catalog translation
+0	string		EMOD\0		Amiga E module
+8	string		ECXM\0		ECX module
+0	string/c	@database	AmigaGuide file
 
 # Amiga disk types
 # 

magic/Magdir/animation

@@ -320,31 +320,35 @@
 #>3     byte&0x03       3              \b, NR: CCIT J.17
 
 # MPA, M1A
-0       beshort&0xFFFE  0xFFFE         MPEG ADTS, layer I, v1
+# modified by Joerg Jenderek
+# GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
+0	beshort&0xFFFE		0xFFFE	
+>2	byte&0xF0	>0x0F		
+>>2	byte&0xF0	<0xE1		MPEG ADTS, layer I, v1
 # rate
->2      byte&0xF0       0x10           \b,  32 kBits
->2      byte&0xF0       0x20           \b,  64 kBits
->2      byte&0xF0       0x30           \b,  96 kBits
->2      byte&0xF0       0x40           \b, 128 kBits
->2      byte&0xF0       0x50           \b, 160 kBits
->2      byte&0xF0       0x60           \b, 192 kBits
->2      byte&0xF0       0x70           \b, 224 kBits
->2      byte&0xF0       0x80           \b, 256 kBits
->2      byte&0xF0       0x90           \b, 288 kBits
->2      byte&0xF0       0xA0           \b, 320 kBits
->2      byte&0xF0       0xB0           \b, 352 kBits
->2      byte&0xF0       0xC0           \b, 384 kBits
->2      byte&0xF0       0xD0           \b, 416 kBits
->2      byte&0xF0       0xE0           \b, 448 kBits
+>>>2      byte&0xF0       0x10           \b,  32 kBits
+>>>2      byte&0xF0       0x20           \b,  64 kBits
+>>>2      byte&0xF0       0x30           \b,  96 kBits
+>>>2      byte&0xF0       0x40           \b, 128 kBits
+>>>2      byte&0xF0       0x50           \b, 160 kBits
+>>>2      byte&0xF0       0x60           \b, 192 kBits
+>>>2      byte&0xF0       0x70           \b, 224 kBits
+>>>2      byte&0xF0       0x80           \b, 256 kBits
+>>>2      byte&0xF0       0x90           \b, 288 kBits
+>>>2      byte&0xF0       0xA0           \b, 320 kBits
+>>>2      byte&0xF0       0xB0           \b, 352 kBits
+>>>2      byte&0xF0       0xC0           \b, 384 kBits
+>>>2      byte&0xF0       0xD0           \b, 416 kBits
+>>>2      byte&0xF0       0xE0           \b, 448 kBits
 # timing
->2      byte&0x0C       0x00           \b, 44.1 kHz
->2      byte&0x0C       0x04           \b, 48 kHz
->2      byte&0x0C       0x08           \b, 32 kHz
+>>>2      byte&0x0C       0x00           \b, 44.1 kHz
+>>>2      byte&0x0C       0x04           \b, 48 kHz
+>>>2      byte&0x0C       0x08           \b, 32 kHz
 # channels/options
->3      byte&0xC0       0x00           \b, Stereo
->3      byte&0xC0       0x40           \b, JntStereo
->3      byte&0xC0       0x80           \b, 2x Monaural
->3      byte&0xC0       0xC0           \b, Monaural
+>>>3      byte&0xC0       0x00           \b, Stereo
+>>>3      byte&0xC0       0x40           \b, JntStereo
+>>>3      byte&0xC0       0x80           \b, 2x Monaural
+>>>3      byte&0xC0       0xC0           \b, Monaural
 #>1     byte            ^0x01          \b, Data Verify
 #>2     byte            &0x02          \b, Packet Pad
 #>2     byte            &0x01          \b, Custom Flag

magic/Magdir/apple

@@ -151,3 +151,41 @@
 
 # From: Toby Peterson <toby@apple.com>
 0	string	bplist00	Apple binary property list
+
+# Apple binary property list (bplist)
+#  Assumes version bytes are hex.
+#  Provides content hints for version 0 files. Assumes that the root
+#  object is the first object (true for CoreFoundation implementation).
+# From: David Remahl <dremahl@apple.com>
+0		string	bplist
+>6		byte	x	\bCoreFoundation binary property list data, version 0x%c
+>>7		byte	x	\b%c
+>6		string		00		\b
+>>8		byte&0xF0	0x00	\b
+>>>8	byte&0x0F	0x00	\b, root type: null
+>>>8	byte&0x0F	0x08	\b, root type: false boolean
+>>>8	byte&0x0F	0x09	\b, root type: true boolean
+>>8		byte&0xF0	0x10	\b, root type: integer
+>>8		byte&0xF0	0x20	\b, root type: real
+>>8		byte&0xF0	0x30	\b, root type: date
+>>8		byte&0xF0	0x40    \b, root type: data
+>>8		byte&0xF0	0x50	\b, root type: ascii string
+>>8		byte&0xF0	0x60	\b, root type: unicode string
+>>8		byte&0xF0	0x80	\b, root type: uid (CORRUPT)
+>>8		byte&0xF0	0xa0	\b, root type: array
+>>8		byte&0xF0	0xd0	\b, root type: dictionary
+
+# Apple/NeXT typedstream data
+#  Serialization format used by NeXT and Apple for various
+#  purposes in YellowStep/Cocoa, including some nib files.
+# From: David Remahl <dremahl@apple.com>
+2		string		typedstream	NeXT/Apple typedstream data, big endian
+>0		byte		x		\b, version %hhd
+>0		byte		<5		\b
+>>13	byte		0x81	\b
+>>>14	ubeshort	x		\b, system %hd
+2		string		streamtyped NeXT/Apple typedstream data, little endian
+>0		byte		x		\b, version %hhd
+>0		byte		<5		\b
+>>13	byte		0x81	\b
+>>>14	uleshort	x		\b, system %hd

magic/Magdir/archive

@@ -37,7 +37,7 @@
 # still uses gzip for the control.tar (first in the archive).  Only
 # data.tar varies, and the location of its filename varies too.
 # file/libmagic does not current have support for ascii-string based
-# (offsets) as of 2005-09-15. (Ian Jackson)
+# (offsets) as of 2005-09-15.
 #>81	string		bz2		\b, uses bzip2 compression
 #>84	string		gz		\b, uses gzip compression
 #>136	ledate		x		created: %s
@@ -135,10 +135,8 @@
 # I can't create either SPARK or ArcFS archives so I have not tested this stuff
 # [GRR:  the original entries collide with ARC, above; replaced with combined
 #  version (not tested)]
-#0	byte		0x1a		RISC OS archive
-#>1	string		archive		(ArcFS format)
-#0	string		\032archive	RISC OS archive (ArcFS format)
-0       string          \032            RISC OS archive (spark format)
+#0	byte		0x1a		RISC OS archive (spark format)
+0	string		\032archive	RISC OS archive (ArcFS format)
 0       string          Archive\000     RISC OS archive (ArcFS format)
 
 # All these were taken from idarc, many could not be verified. Unfortunately,
@@ -228,6 +226,14 @@
 0	string	PPMZ PPMZ archive data
 # MS Compress
 4	string	\x88\xf0\x27 MS Compress archive data
+# updated by Joerg Jenderek
+>9	string	\0		
+>>0	string	KWAJ		
+>>>7	string	\321\003	MS Compress archive data
+>>>>14	ulong	>0		\b, original size: %ld bytes
+>>>>18		ubyte	>0x65  	
+>>>>>18		string	x    	\b, was %.8s
+>>>>>(10.b-4)	string	x    	\b.%.3s
 # MP3 (archiver, not lossy audio compression)
 0	string	MP3\x1a MP3-Archiver archive data
 # ZET
@@ -518,11 +524,66 @@
 0	string		UC2\x1a		UC2 archive data
 
 # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
-0	string		PK\003\004	Zip archive data
->4	byte		0x09		\b, at least v0.9 to extract
->4	byte		0x0a		\b, at least v1.0 to extract
->4	byte		0x0b		\b, at least v1.1 to extract
->4	byte		0x14		\b, at least v2.0 to extract
+0	string		PK\003\004
+>4	byte		0x09		Zip archive data, at least v0.9 to extract
+>4	byte		0x0a		Zip archive data, at least v1.0 to extract
+>4	byte		0x0b		Zip archive data, at least v1.1 to extract
+>4	byte		0x14
+>>30	ubelong		!0x6d696d65	Zip archive data, at least v2.0 to extract
+
+# OpenOffice.org / KOffice / StarOffice documents
+# From: Abel Cheung <abel@oaka.org>
+# Listed here because they are basically zip files
+>>30	string		mimetype
+
+# KOffice (1.2 or above) formats
+>>>50	string	vnd.kde.		KOffice (>=1.2)
+>>>>58	string	karbon			Karbon document
+>>>>58	string	kchart			KChart document
+>>>>58	string	kformula		KFormula document
+>>>>58	string	kivio			Kivio document
+>>>>58	string	kontour			Kontour document
+>>>>58	string	kpresenter		KPresenter document
+>>>>58	string	kspread			KSpread document
+>>>>58	string	kword			KWord document
+
+# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
+>>>50	string	vnd.sun.xml.		OpenOffice.org 1.x
+>>>>62	string	writer			Writer
+>>>>>68	byte	!0x2e			document
+>>>>>68	string	.template		template
+>>>>>68	string	.global			global document
+>>>>62	string	calc			Calc
+>>>>>66	byte	!0x2e			spreadsheet
+>>>>>66	string	.template		template
+>>>>62	string	draw			Draw
+>>>>>66	byte	!0x2e			document
+>>>>>66	string	.template		template
+>>>>62	string	impress			Impress
+>>>>>69	byte	!0x2e			presentation
+>>>>>69	string	.template		template
+>>>>62	string	math			Math document
+
+# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
+# http://lists.oasis-open.org/archives/office/200505/msg00006.html
+>>>50	string	vnd.oasis.opendocument.	OpenDocument
+>>>>73	string	text
+>>>>>77	byte	!0x2d			Text
+>>>>>77	string	-template		Text Template
+>>>>>77	string	-web			HTML Document Template
+>>>>>77	string	-master			Master Document
+>>>>73	string	graphics		Drawing
+>>>>>81	string	-template		Template
+>>>>73	string	presentation		Presentation
+>>>>>85	string	-template		Template
+>>>>73	string	spreadsheet		Spreadsheet
+>>>>>84	string	-template		Template
+>>>>73	string	chart			Chart
+>>>>>78	string	-template		Template
+>>>>73	string	formula			Formula
+>>>>>80	string	-template		Template
+>>>>73	string	database		Database
+>>>>73	string	image			Image
 
 # Zoo archiver
 20	lelong		0xfdc4a7dc	Zoo archive data
@@ -618,7 +679,7 @@
 >5	leshort	&0x0400		\b, small dictionary
 >5	leshort	&0x0800		\b, multi-volume
 >5	leshort	&0x1000		\b, contains AV-String
->>30	string\x16*UNREGISTERED\x20VERSION*	(unregistered)
+>>30	string	\x16*UNREGISTERED\x20VERSION*	(unregistered)
 >5	leshort &0x2000		\b, with recovery record
 >5	leshort &0x4000		\b, locked
 >5	leshort &0x8000		\b, solid
@@ -633,8 +694,8 @@
 >>0x2A	string	>\0		: %s
 
 # DR-DOS 7.03 Packed File *.??_
-0	string	Packed\ File\  Personal		NetWare Packed File
->12	string	x    				\b, was "%.12s"
+0	string	Packed\ File\ 	Personal NetWare Packed File
+>12	string	x    		\b, was "%.12s"
 
 # EET archive
 # From: Tilman Sauerbeck <tilman@code-monkey.de>

magic/Magdir/audio

@@ -236,7 +236,7 @@
 >122	byte&0x1	=1		PAL
 >122	byte&0x1	=0		NTSC
 
-# Impuse tracker module (audio/x-it)
+# Impulse tracker module (audio/x-it)
 0	string		IMPM		Impulse Tracker module sound data -
 >4	string		>\0		"%s"
 >40	leshort		!0		compatible w/ITv%x
@@ -399,15 +399,28 @@
 # From "Simon Hosie
 0       string  TFMX-SONG       TFMX module sound data
 
+# Monkey's Audio compressed audio format (.ape)
 # From danny.milo@gmx.net (Danny Milosavljevic)
-# monkeysaudio for magic.mime
-0	string	MAC\	X/Monkey audio,
->4	leshort >0	version %d,
->6	leshort >0	compression level %d,
->8	leshort >0	flags %x,
->10	leshort >0	channels %d,
->12	lelong	>0	samplerate %d,
->24	lelong	>0	frames %d
+# New version from Abel Cheung <abel (@) oaka.org>
+0		string		MAC\040		Monkey's Audio compressed format
+>4		uleshort	>0x0F8B		version %d
+>>(0x08.l)	uleshort	=1000		with fast compression
+>>(0x08.l)	uleshort	=2000		with normal compression
+>>(0x08.l)	uleshort	=3000		with high compression
+>>(0x08.l)	uleshort	=4000		with extra high compression
+>>(0x08.l)	uleshort	=5000		with insane compression
+>>(0x08.l+18)	uleshort	=1		\b, mono
+>>(0x08.l+18)	uleshort	=2		\b, stereo
+>>(0x08.l+20)	ulelong		x		\b, sample rate %d
+>4		uleshort	<0x0F8C		version %d
+>>6		uleshort	=1000		with fast compression
+>>6		uleshort	=2000		with normal compression
+>>6		uleshort	=3000		with high compression
+>>6		uleshort	=4000		with extra high compression
+>>6		uleshort	=5000		with insane compression
+>>10		uleshort	=1		\b, mono
+>>10		uleshort	=2		\b, stereo
+>>12		ulelong		x		\b, sample rate %d
 
 # adlib sound files
 # From Gürkan Sengün <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
@@ -442,3 +455,27 @@
 >16	byte		x		mid-side
 
 384	string		LockStream	LockStream Embedded file (mostly MP3 on old Nokia phones)
+
+# format VQF (proprietary codec for sound)
+# some infos on the header file available at :
+# http://www.twinvq.org/english/technology_format.html
+0	string		TWIN97012000	VQF data
+>27	short		0		\b, Mono
+>27	short		1		\b, Stereo
+>31	short 		>0		\b, %d kbit/s
+>35	short 		>0		\b, %d kHz
+
+# Nelson A. de Oliveira (naoliv@gmail.com)
+# .eqf
+0	string	Winamp\ EQ\ library\ file	%s
+# it will match only versions like v<digit>.<digit>
+# Since I saw only eqf files with version v1.1 I think that it's OK
+>23	string	x	\b%.4s
+# .preset
+0	string	\[Equalizer\ preset\]	XMMS equalizer preset
+# .m3u
+0	string	\#EXTM3U	M3U playlist
+# .pls
+0	string	\[playlist\]	PLS playlist
+# licq.conf
+1	string	\[licq\]	LICQ configuration file

magic/Magdir/basis

@@ -0,0 +1,16 @@
+#----------------------------------------------------------------
+# basis: file(1) magic for BBx/Pro5-files
+#      Oliver Dammer <dammer@olida.de>	 2005/11/07
+# http://www.basis.com business-basic-files.
+#
+0	string		\074\074bbx\076\076	BBx
+>7	string		\000			indexed file
+>7	string		\001			serial file
+>7	string		\002			keyed file
+>>13	short		0			(sort)
+>7	string		\004			program
+>>18	byte		x			(LEVEL %d)
+>>>23	string		>\000			psaved
+>7	string		\006			mkeyed file
+>>13	short		0			(sort)
+>>8	string		\000			(mkey)

magic/Magdir/btsnoop

@@ -0,0 +1,11 @@
+#------------------------------------------------------------------------------
+# BTSnoop:  file(1) magic for BTSnoop files
+#
+# From <marcel@holtmann.org>
+0	string		btsnoop\0		BTSnoop
+>8	belong		x			version %d,
+>12	belong		1001			Unencapsulated HCI
+>12	belong		1002			HCI UART (H4)
+>12	belong		1003			HCI BCSP
+>12	belong		1004			HCI Serial (H5)
+>>12	belong		x			type %d

magic/Magdir/chi

@@ -1,7 +0,0 @@
-
-#------------------------------------------------------------------------------
-# chi:  file(1) magic for ChiWriter files
-#
-0       string          \\1cw\          ChiWriter file
->5      string          >\0             version %s
-0       string          \\1cw           ChiWriter file

magic/Magdir/commands

@@ -27,7 +27,8 @@
 #
 0	string/b	#!\ /bin/awk		awk script text executable
 0	string/b	#!\ /usr/bin/awk	awk script text executable
-0	string		BEGIN			awk script text
+# update to distinguish from *.vcf files
+0	regex		BEGIN[[:space:]]*[{]	awk script text
 
 # AT&T Bell Labs' Plan 9 shell
 0	string/b	#!\ /bin/rc	Plan 9 rc shell script text executable

magic/Magdir/compress

@@ -22,22 +22,28 @@
 >2	byte		<8		\b, reserved method
 >2	byte		>8		\b, unknown method
 >3	byte		&0x01		\b, ASCII
->3	byte		&0x02		\b, continuation
+>3	byte		&0x02		\b, has CRC
 >3	byte		&0x04		\b, extra field
 >3	byte&0xC	=0x08
 >>10	string		x		\b, was "%s"
->9	byte		=0x00		\b, from MS-DOS
+>3	byte		&0x10		\b, has comment
+>9	byte		=0x00		\b, from FAT filesystem (MS-DOS, OS/2, NT)
 >9	byte		=0x01		\b, from Amiga
 >9	byte		=0x02		\b, from VMS
 >9	byte		=0x03		\b, from Unix
+>9	byte		=0x04		\b, from VM/CMS
 >9	byte		=0x05		\b, from Atari
->9	byte		=0x06		\b, from OS/2
+>9	byte		=0x06		\b, from HPFS filesystem (OS/2, NT)
 >9	byte		=0x07		\b, from MacOS
->9	byte		=0x0A		\b, from Tops/20
->9	byte		=0x0B		\b, from Win/32
+>9	byte		=0x08		\b, from Z-System
+>9	byte		=0x09		\b, from CP/M
+>9	byte		=0x0A		\b, from TOPS/20
+>9	byte		=0x0B		\b, from NTFS filesystem (NT)
+>9	byte		=0x0C		\b, from QDOS
+>9	byte		=0x0D		\b, from Acorn RISCOS
 >3	byte		&0x10		\b, comment
 >3	byte		&0x20		\b, encrypted
-### >4	ledate		x		last modified: %s,
+>4	ledate		>0		\b, last modified: %s
 >8	byte		2		\b, max compression
 >8	byte		4		\b, max speed
 
@@ -170,3 +176,14 @@
 
 # AFX compressed files (Wolfram Kleff)
 2	string		-afx-		AFX compressed file data
+
+# Supplementary magic data for the file(1) command to support
+# rzip(1).  The format is described in magic(5).
+#
+# Copyright (C) 2003 by Andrew Tridgell.  You may do whatever you want with
+# this file.
+#
+0	string		RZIP		rzip compressed data
+>4	byte		x		- version %d
+>5	byte		x		\b.%d
+>6	belong		x		(%d bytes)

magic/Magdir/cracklib

@@ -8,6 +8,6 @@
 >>8	long	>-1		(%i words)
 0	belong	0x70775631	Cracklib password index, big endian
 >4	belong	>-1		(%i words)
-0	long	0
->4	belong	0x70775631	Cracklib password index, big endian ("64-bit")
+# really bellong 0x0000000070775631
+0	search/1	\0\0\0\0pwV1	Cracklib password index, big endian ("64-bit")
 >12	belong	>0		(%i words)

magic/Magdir/database

@@ -210,3 +210,7 @@
 16	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
 17	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
 18	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
+
+# SQLite (Ty Sarna)
+0	string	**\ This\ file\ contains\ an\ SQLite	SQLite Database
+>&1	regex	[^\ ]+					Version %s

magic/Magdir/dump

@@ -79,3 +79,15 @@
 >760	string	>\0		Device %s,
 >824	string	>\0		Host %s,
 >888	lelong	>0		Flags %x
+
+18	leshort	60011		old-fs dump file (16-bit, assuming PDP-11 endianness),
+>2	medate	x		Previous dump %s,
+>6	medate	x		This dump %s,
+>10	leshort	>0		Volume %ld,
+>0	leshort	1		tape header.
+>0	leshort	2		beginning of file record.
+>0	leshort	3		map of inodes on tape.
+>0	leshort	4		continuation of file record.
+>0	leshort	5		end of volume.
+>0	leshort	6		map of inodes deleted.
+>0	leshort	7		end of medium (for floppy).

magic/Magdir/filesystems

@@ -23,12 +23,35 @@
 >0770	long		x		%ld blocks
 # Is there a boot block written 1 sector in?
 >512    belong&077777777	0600407	\b, boot block present
-# DOS Emulator image is 128 byte header + harddisc image
+# Joerg Jenderek: Smart Boot Manager backup file is 41 byte header + first sectors of disc
+# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
+0		string	SBMBAKUP_	Smart Boot Manager backup file
+>9		string	x		\b, version %-5.5s
+>>14		string	=_		
+>>>15		string	x		%-.1s
+>>>>16		string	=_		\b.
+>>>>>17		string	x		\b%-.1s
+>>>>>>18	string	=_		\b.
+>>>>>>>19	string	x		\b%-.1s
+>>>22		ubyte	0		
+>>>>21		ubyte	x		\b, from drive 0x%x
+>>>22		ubyte	>0		
+>>>>21		string	x		\b, from drive %s
+
+# Joerg Jenderek
+# DOS Emulator image is 128 byte, null right padded header + harddisc image
 0	string	DOSEMU\0			
->0x27E	leshort	0xAA55			DOS Emulator image
+>0x27E	leshort	0xAA55			
+#offset is 128
+>>19	ubyte	128			
+>>>(19.b-1)	ubyte	0x0	DOS Emulator image
+>>>>7	ulelong	>0		\b, %u heads
+>>>>11	ulelong	>0		\b, %d sectors/track
+>>>>15	ulelong	>0		\b, %d cylinders
+
 0x1FE	leshort	0xAA55			x86 boot sector
 >2	string	OSBS			\b, OS/BS MBR
-# J\xf6rg Jenderek <joerg.jenderek@gmx.net>
+# J\xf6rg Jenderek <joerg dot jenderek at web dot de>
 >0x8C	string	Invalid\ partition\ table	\b, MS-DOS MBR
 # dr-dos with some upper-, lowercase variants
 >0x9D	string	Invalid\ partition\ table$	
@@ -49,39 +72,103 @@
 >>>>>>>387	string	Copyright\ (c)\ 1984,1998	
 >>>>>>>>411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
 >0x10F	string	Ung\201ltige\ Partitionstabelle	\b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
+>>0x1B8	ubelong	>0				\b, Serial 0x%-.4x
 >0x8B	string	Ung\201ltige\ Partitionstabelle	\b, MS-DOS MBR, german version 5.00 to 4.00.950
+>271	string	Invalid\ partition\ table\0		
+>>295	string	Error\ loading\ operating\ system\0	
+>>>326	string	Missing\ operating\ system\0		\b, mbr
+#
+>139	string	Invalid\ partition\ table\0		
+>>163	string	Error\ loading\ operating\ system\0	
+>>>194	string	Missing\ operating\ system\0		\b, Microsoft Windows XP mbr
+# http://www.heise.de/ct/05/09/006/ page 184
+#HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices\DosDevices\?:=Serial4Bytes+8Bytes
+>>>>0x1B8	ulelong	>0				\b,Serial 0x%-.4x
 >300	string	Invalid\ partition\ table\0	
 >>324	string	Error\ loading\ operating\ system\0
 >>>355	string	Missing\ operating\ system\0		\b, Microsoft Windows XP MBR
 #??>>>389	string	Invalid\ system\ disk		
+>>>>0x1B8	ulelong	>0				\b, Serial 0x%-.4x
 >300	string	Ung\201ltige\ Partitionstabelle
 #split string to avoid error: String too long
 >>328	string	Fehler\ beim\ Laden\ 	
 >>>346	string	des\ Betriebssystems	
 >>>>366	string	Betriebssystem\ nicht\ vorhanden	\b, Microsoft Windows XP MBR (german)
+>>>>>0x1B8	ulelong	>0				\b, Serial 0x%-.4x
 >0x145	string	Default:\ F				\b, FREE-DOS MBR
 >64	string	no\ active\ partition\ found	
->>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta9 MBR
+>>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta 0.9 MBR
+>271	string	Operating\ system\ loading 		
+>>296	string	error\r					\b, SYSLINUX MBR (2.10)
 # bootloader, bootmanager
 >43	string	SMART\ BTMGRFAT12\ \ \ 		
 >>430	string	SBMK\ Bad!\r			
 >>>3	string	SBM				\b, Smart Boot Manager
 >>>>6	string	>\0                             \b, version %s
->382	string	XOSLLOADXCF			\b, EXtended Operating System Loader
+>382	string	XOSLLOADXCF			\b, eXtended Operating System Loader
 >6	string	LILO				\b, LInux i386 boot LOader
 >>120	string	LILO				\b, version 22.3.4 SuSe
 >>172	string	LILO				\b, version 22.5.8 Debian
 >402	string	Geom\0Hard\ Disk\0Read\0\ Error\0
 >>394	string	stage1				\b, GRand Unified Bootloader (0.5.95)
+>343	string	Geom\0Read\0\ Error\0		
+>>321	string	Loading\ stage1.5		\b, Grand Unified Bootloader
 >380	string	Geom\0Hard\ Disk\0Read\0\ Error\0
 >>374	string	GRUB\ \0			\b, GRand Unified Bootloader
 >382	string	Geom\0Hard\ Disk\0Read\0\ Error\0
 >>376	string	GRUB\ \0			\b, GRand Unified Bootloader (0.93)
 >383	string	Geom\0Hard\ Disk\0Read\0\ Error\0
 >>377	string	GRUB\ \0			\b, GRand Unified Bootloader (0.94)
+>385	string	Geom\0Hard\ Disk\0Read\0\ Error\0
+>>379	string	GRUB\ \0			\b, GRand Unified Bootloader (0.95)
 >480	string	Boot\ failed\r			
 >>495	string	LDLINUX\ SYS			\b, SYSLINUX bootloader (2.06)
 >395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
+# mbr partion table entries, if not fat boot secor, activ flag 0 or 0x80 and type > 0
+>3			string		!MS	
+>>3			string		!SYSLINUX
+>>>82			string		!FAT32	
+>>>>446			ubyte		<0x81	
+>>>>>446		ubyte&0x7F	0	
+>>>>>>450		ubyte		>0	\b; partition 1: ID=0x%x
+>>>>>>>446		ubyte		0x80	\b, active
+>>>>>>>447		ubyte		x	\b, starthead %u
+#>>>>>>>448		ubyte		x	\b, start C_S: 0x%x
+#>>>>>>448		ubeshort&1023	x	\b, startcylinder? %d
+>>>>>>>454		ulelong		x	\b, startsector %u
+>>>>>>>458		ulelong		x	\b, %u sectors
+#
+>>>>462			ubyte		<0x81	
+>>>>>462		ubyte&0x7F	0		
+>>>>>>466		ubyte		>0	\b; partition 2: ID=0x%x
+>>>>>>>462		ubyte		0x80	\b, active
+>>>>>>>463		ubyte		x	\b, starthead %u
+#>>>>>>>464		ubyte		x	\b, start C_S: 0x%x
+#>>>>>>>464		ubeshort&1023	x	\b, startcylinder? %d
+>>>>>>>470		ulelong		x	\b, startsector %u
+>>>>>>>474		ulelong		x	\b, %u sectors
+#
+>>>>478			ubyte		<0x81		
+>>>>>478		ubyte&0x7F	0		
+>>>>>>482		ubyte		>0	\b; partition 3: ID=0x%x
+>>>>>>>478		ubyte		0x80	\b, active
+>>>>>>>479		ubyte		x	\b, starthead %u
+#>>>>>>>480		ubyte		x	\b, start C_S: 0x%x
+#>>>>>>>481		ubyte		x	\b, start C2S: 0x%x
+#>>>>>>>480		ubeshort&1023	x	\b, startcylinder? %d
+>>>>>>>486		ulelong		x	\b, startsector %u
+>>>>>>>490		ulelong		x	\b, %u sectors
+#
+>>>>494			ubyte		<0x81	
+>>>>>494		ubyte&0x7F	0		
+>>>>>>498		ubyte		>0	\b; partition 4: ID=0x%x
+>>>>>>>494		ubyte		0x80	\b, active
+>>>>>>>495		ubyte		x	\b, starthead %u
+#>>>>>>>496		ubyte		x	\b, start C_S: 0x%x
+#>>>>>>>496		ubeshort&1023	x	\b, startcylinder? %d
+>>>>>>>502		ulelong		x	\b, startsector %u
+>>>>>>>506		ulelong		x	\b, %u sectors
+# mbr partion table entries end
 >185	string	FDBOOT\ Version\ 			
 >>204	string	\rNo\ Systemdisk.\ 			
 >>>220	string	Booting\ from\ harddisk.\n\r		
@@ -108,69 +195,115 @@
 >>>>>>>>>(1.b+11)	ubyte	0xb			
 >>>>>>>>>>(1.b+12)	ubyte	0x56			
 >>>>>>>>>>(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
+>103	string	This\ is\ not\ a\ bootable\ disk.\ 	
+>>132	string	Please\ insert\ a\ bootable\ 		
+>>>157	string	floppy\ and\r\n				
+>>>>169	string	press\ any\ key\ to\ try\ again...\r	\b, FREE-DOS message display
+#
+>66	string	Solaris\ Boot\ Sector    		
+>>99	string	Incomplete\ MDBoot\ load.		
+>>>89	string	Version 				\b, Sun Solaris Bootloader
+>>>>97	byte	x					version %c
+#
+>408	string	OS/2\ !!\ SYS01475\r\0			
+>>429	string	OS/2\ !!\ SYS02025\r\0			
+>>>450	string	OS/2\ !!\ SYS02027\r\0			
+>>>469	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp bootloader
+#
+>409	string	OS/2\ !!\ SYS01475\r\0			
+>>430	string	OS/2\ !!\ SYS02025\r\0			
+>>>451	string	OS/2\ !!\ SYS02027\r\0			
+>>>470	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp Bootloader
+>112		string	This\ disk\ is\ not\ bootable\r			
+>>142		string	If\ you\ wish\ to\ make\ it\ bootable		
+>>>176		string	run\ the\ DOS\ program\ SYS\  			
+>>>200		string	after\ the\r					
+>>>>216		string	system\ has\ been\ loaded\r\n			
+>>>>>242	string	Please\ insert\ a\ DOS\ diskette\ 		
+>>>>>271	string	into\r\n\ the\ drive\ and\ 			
+>>>>>>292	string	strike\ any\ key...\0		\b, IBM OS/2 Warp message display
 # XP
 >430	string	NTLDR\ is\ missing\xFF\r\n		
 >>449	string	Disk\ error\xFF\r\n			
 >>>462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
 # DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
->>>>417		ubyte		<0x7E 			
->>>>>417	string		>\ 			%-.5s
->>>>>>422	ubyte		<0x7E 			
->>>>>>>422	string		>\ 			\b%-.3s
+>>>>417		ubyte&0xDF	>0			
+>>>>>417	string		x			%-.5s
+>>>>>>422	ubyte&0xDF	>0			
+>>>>>>>422	string		x 			\b%-.3s
+>>>>>425	ubyte&0xDF	>0			
 >>>>>>425	string		>\ 			\b.%-.3s
 #
->>>>368		ubyte		<0x7E 			
->>>>>368	string		>\ 			%-.5s
->>>>>>373	ubyte		<0x7E			
->>>>>>>373	string		>\ 			\b%-.3s
->>>>>>376	string		>\ 			\b.%-.3s
+>>>>371		ubyte		>0x20			
+>>>>>368	ubyte&0xDF	>0			
+>>>>>>368	string		x 			%-.5s
+>>>>>>>373	ubyte&0xDF	>0			
+>>>>>>>>373	string		x 			\b%-.3s
+>>>>>>376	ubyte&0xDF	>0			
+>>>>>>>376	string		x 			\b.%-.3s
 #
 >430	string	NTLDR\ nicht\ gefunden\xFF\r\n		
 >>453	string	Datentr\204gerfehler\xFF\r\n		
 >>>473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
->>>>417		ubyte		<0x7E 			
->>>>>417	string		>\ 			%-.5s
->>>>>>422	ubyte		<0x7E 			
->>>>>>>422	string		>\ 			\b%-.3s
+>>>>417		ubyte&0xDF	>0			
+>>>>>417	string		x			%-.5s
+>>>>>>422	ubyte&0xDF	>0			
+>>>>>>>422	string		x 			\b%-.3s
+>>>>>425	ubyte&0xDF	>0			
 >>>>>>425	string		>\ 			\b.%-.3s
 #
->>>>368		ubyte		<0x7E 			
->>>>>368	string		>\ 			%-.5s
->>>>>>373	ubyte		<0x7E 			
->>>>>>>373	string		>\ 			\b%-.3s
->>>>>>376	string		>\ 			\b.%-.3s
+>>>>368		ubyte&0xDF	>0			
+>>>>>368	string		x 			%-.5s
+>>>>>>373	ubyte&0xDF	>0			
+>>>>>>>373	string		x 			\b%-.3s
+>>>>>376	ubyte&0xDF	>0			
+>>>>>>376	string		x 			\b.%-.3s
 #
 >430	string	NTLDR\ fehlt\xFF\r\n			
 >>444	string	Datentr\204gerfehler\xFF\r\n		
 >>>464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
->>>>417		ubyte		<0x7E 			
->>>>>417	string		>\ 			%-.5s
->>>>>>422	ubyte		<0x7E 			
->>>>>>>422	string		>\ 			\b%-.3s
+>>>>417		ubyte&0xDF	>0			
+>>>>>417	string		x			%-.5s
+>>>>>>422	ubyte&0xDF	>0			
+>>>>>>>422	string		x 			\b%-.3s
+>>>>>425	ubyte&0xDF	>0			
 >>>>>>425	string		>\ 			\b.%-.3s
+# variant
+>>>>371		ubyte		>0x20			
+>>>>>368	ubyte&0xDF	>0			
+>>>>>>368	string		x 			%-.5s
+>>>>>>>373	ubyte&0xDF	>0			
+>>>>>>>>373	string		x 			\b%-.3s
+>>>>>>376	ubyte&0xDF	>0			
+>>>>>>>376	string		x 			\b.%-.3s
 #
 >430	string	NTLDR\ fehlt\xFF\r\n			
 >>444	string	Medienfehler\xFF\r\n			
 >>>459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
->>>>368		ubyte		<0x7E 			
->>>>>368	string		>\ 			%-.5s
->>>>>>373	ubyte		<0x7E			
->>>>>>>373	string		>\ 			\b%-.3s
->>>>>>376	string		>\ 			\b.%-.3s
->>>>417		ubyte		<0x7E 			
->>>>>417	string		>\ 			%-.5s
->>>>>>422	ubyte		<0x7E 			
->>>>>>>422	string		>\ 			\b%-.3s
+>>>>371		ubyte		>0x20			
+>>>>>368	ubyte&0xDF	>0			
+>>>>>>368	string		x 			%-.5s
+>>>>>>>373	ubyte&0xDF	>0			
+>>>>>>>>373	string		x 			\b%-.3s
+>>>>>>376	ubyte&0xDF	>0			
+>>>>>>>376	string		x 			\b.%-.3s
+# variant
+>>>>417		ubyte&0xDF	>0			
+>>>>>417	string		x			%-.5s
+>>>>>>422	ubyte&0xDF	>0			
+>>>>>>>422	string		x 			\b%-.3s
+>>>>>425	ubyte&0xDF	>0			
 >>>>>>425	string		>\ 			\b.%-.3s
 #
 >430	string	Datentr\204ger\ entfernen\xFF\r\n	
 >>454	string	Medienfehler\xFF\r\n			
 >>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
->>>>368		ubyte		<0x7E 			
->>>>>368	string		>\ 			%-.5s
->>>>>>373	ubyte		<0x7E			
->>>>>>>373	string		>\ 			\b%-.3s
->>>>>>376	string		>\ 			\b.%-.3s
+>>>>368		ubyte&0xDF	>0			
+>>>>>368	string		x 			%-.5s
+>>>>>>373	ubyte&0xDF	>0			
+>>>>>>>373	string		x 			\b%-.3s
+>>>>>376	ubyte&0xDF	>0			
+>>>>>>376	string		x 			\b.%-.3s
 #>3	string	NTFS\ \ \ \ 				
 >389	string	Fehler\ beim\ Lesen\ 
 >>407	string	des\ Datentr\204gers
@@ -185,12 +318,27 @@
 >>>>>429 string	Insert\ a\ system\ diskette\ 	
 >>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
 # DOS loader variants different languages,offsets
->472	string	IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS		
->>497	string	WINBOOT\ SYS				
+>472	ubyte&0xDF	>0
 >>389	string	Invalid\ system\ disk\xFF\r\n		
 >>>411	string	Disk\ I/O\ error			
 >>>>428	string	Replace\ the\ disk,\ and\ 		
 >>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
+#IO.SYS
+>>>>>>472	ubyte&0xDF	>0			
+>>>>>>>472	string		x 			\b %-.2s
+>>>>>>>>474	ubyte&0xDF	>0			
+>>>>>>>>>474	string		x 			\b%-.5s
+>>>>>>>>>>479	ubyte&0xDF	>0			
+>>>>>>>>>>>479 string		x 			\b%-.1s
+>>>>>>>480	ubyte&0xDF	>0			
+>>>>>>>>480	string		x 			\b.%-.3s
+#MSDOS.SYS
+>>>>>>>483	ubyte&0xDF	>0			\b+
+>>>>>>>>483	string		x 			\b%-.5s
+>>>>>>>>>488	ubyte&0xDF	>0			
+>>>>>>>>>>488	string		x 			\b%-.3s
+>>>>>>>>491	ubyte&0xDF	>0			
+>>>>>>>>>491	string		x 			\b.%-.3s
 #
 >>390	string	Invalid\ system\ disk\xFF\r\n		
 >>>412	string	Disk\ I/O\ error\xFF\r\n		
@@ -200,30 +348,121 @@
 >>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n		
 >>>>427	string	Datentraeger\ wechseln\ und\ 		
 >>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
+#WINBOOT.SYS only not spaces (0xDF)
+>>>>>>497	ubyte&0xDF	>0			
+>>>>>>>497	string		x 			%-.5s
+>>>>>>>>502	ubyte&0xDF	>0			
+>>>>>>>>>502	string		x 			\b%-.1s
+>>>>>>>>>>503	ubyte&0xDF	>0			
+>>>>>>>>>>>503	string		x 			\b%-.1s
+>>>>>>>>>>>>504	ubyte&0xDF	>0			
+>>>>>>>>>>>>>504 string		x 			\b%-.1s
+>>>>>>505	ubyte&0xDF	>0			
+>>>>>>>505	string		x 			\b.%-.3s
+#IO.SYS
+>>>>>>472	ubyte&0xDF	>0			or
+>>>>>>>472	string		x 			\b %-.2s
+>>>>>>>>474	ubyte&0xDF	>0			
+>>>>>>>>>474	string		x 			\b%-.5s
+>>>>>>>>>>479	ubyte&0xDF	>0			
+>>>>>>>>>>>479 string		x 			\b%-.1s
+>>>>>>>480	ubyte&0xDF	>0			
+>>>>>>>>480	string		x 			\b.%-.3s
+#MSDOS.SYS
+>>>>>>>483	ubyte&0xDF	>0			\b+
+>>>>>>>>483	string		x 			\b%-.5s
+>>>>>>>>>488	ubyte&0xDF	>0			
+>>>>>>>>>>488	string		x 			\b%-.3s
+>>>>>>>>491	ubyte&0xDF	>0			
+>>>>>>>>>491	string		x 			\b.%-.3s
 #
 >>390	string	Ungueltiges\ System\ \xFF\r\n		
 >>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n		
 >>>>429	string	Datentraeger\ wechseln\ und\ 		
 >>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
+#WINBOOT.SYS only not spaces (0xDF)
+>>>>>>497	ubyte&0xDF	>0			
+>>>>>>>497	string		x 			%-.7s
+>>>>>>>>504	ubyte&0xDF	>0			
+>>>>>>>>>504	string		x 			\b%-.1s
+>>>>>>505	ubyte&0xDF	>0			
+>>>>>>>505	string		x 			\b.%-.3s
+#IO.SYS
+>>>>>>472	ubyte&0xDF	>0			or
+>>>>>>>472	string		x 			\b %-.2s
+>>>>>>>>474	ubyte&0xDF	>0			
+>>>>>>>>>474	string		x 			\b%-.6s
+>>>>>>>480	ubyte&0xDF	>0			
+>>>>>>>>480	string		x 			\b.%-.3s
+#MSDOS.SYS
+>>>>>>>483	ubyte&0xDF	>0			\b+
+>>>>>>>>483	string		x 			\b%-.5s
+>>>>>>>>>488	ubyte&0xDF	>0			
+>>>>>>>>>>488	string		x 			\b%-.3s
+>>>>>>>>491	ubyte&0xDF	>0			
+>>>>>>>>>491	string		x 			\b.%-.3s
 #
 >>389	string	Ungueltiges\ System\ \xFF\r\n		
 >>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n		
 >>>>428	string	Datentraeger\ wechseln\ und\ 		
 >>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
->479	string	IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS		
+# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
+>>>>>>472	string		x 			%-.2s
+>>>>>>>474	ubyte&0xDF	>0			
+>>>>>>>>474	string		x 			\b%-.5s
+>>>>>>>>479	ubyte&0xDF	>0			
+>>>>>>>>>479	string		x 			\b%-.1s
+>>>>>>480	ubyte&0xDF	>0			
+>>>>>>>480	string		x 			\b.%-.3s
+>>>>>>483	ubyte&0xDF	>0			\b+
+>>>>>>>483	string		x 			\b%-.5s
+>>>>>>>488	ubyte&0xDF	>0			
+>>>>>>>>488	string		x 			\b%-.2s
+>>>>>>>>490	ubyte&0xDF	>0			
+>>>>>>>>>490	string		x 			\b%-.1s
+>>>>>>>491	ubyte&0xDF	>0			
+>>>>>>>>491	string		x 			\b.%-.3s
+>479	ubyte&0xDF	>0
 >>416	string	Kein\ System\ oder\ 			
 >>>433	string	Laufwerksfehler				
 >>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
->486	string	IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS		
+#IO.SYS
+>>>>>479	string		x 			\b %-.2s
+>>>>>>481	ubyte&0xDF	>0			
+>>>>>>>481	string		x 			\b%-.6s
+>>>>>487	ubyte&0xDF	>0			
+>>>>>>487	string		x 			\b.%-.3s
+#MSDOS.SYS
+>>>>>>490	ubyte&0xDF	>0			\b+
+>>>>>>>490	string		x 			\b%-.5s
+>>>>>>>>495	ubyte&0xDF	>0			
+>>>>>>>>>495	string		x 			\b%-.3s
+>>>>>>>498	ubyte&0xDF	>0			
+>>>>>>>>498	string		x 			\b.%-.3s
+#
+>486	ubyte&0xDF	>0
 >>416	string	Non-System\ disk\ or\ 			
 >>>435	string	disk\ error\r				
 >>>>447	string	Replace\ and\ press\ any\ key\ 		
 >>>>>473 string	when\ ready\r				\b, Microsoft DOS Bootloader
->480	string	IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS		
+>480	ubyte&0xDF	>0			
 >>393	string	Non-System\ disk\ or\ 			
 >>>412	string	disk\ error\r				
 >>>>424	string	Replace\ and\ press\ any\ key\ 		
 >>>>>450 string	when\ ready\r				\b, Microsoft DOS bootloader
+#IO.SYS
+>>>>>480	string		x 			\b %-.2s
+>>>>>>482	ubyte&0xDF	>0			
+>>>>>>>48	string		x 			\b%-.6s
+>>>>>488	ubyte&0xDF	>0			
+>>>>>>488	string		x 			\b.%-.3s
+#MSDOS.SYS
+>>>>>>491	ubyte&0xDF	>0			\b+
+>>>>>>>491	string		x 			\b%-.5s
+>>>>>>>>496	ubyte&0xDF	>0			
+>>>>>>>>>496	string		x 			\b%-.3s
+>>>>>>>499	ubyte&0xDF	>0			
+>>>>>>>>499	string		x 			\b.%-.3s
 #>43	string	\224R-LOADER\ \ SYS			=label					
 >54	string	SYS
 >>324	string	VASKK
@@ -239,26 +478,65 @@
 >499	string	KERNEL\ \ SYS				
 >>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
 >449	string	KERNEL\ \ SYS				
->>319	string	BOOT\ error!				\b, FREE-DOS 5.0 Bootloader
+>>319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
+>125	string	Loading\ FreeDOS...\r			
+>>311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
+>>>441		ubyte&0xDF	>0			
+>>>>441		string		x 			\b %-.6s
+>>>>>447	ubyte&0xDF	>0			
+>>>>>>447	string		x 			\b%-.1s
+>>>>>>>448	ubyte&0xDF	>0			
+>>>>>>>>448	string		x 			\b%-.1s
+>>>>449		ubyte&0xDF	>0			
+>>>>>449	string		x 			\b.%-.3s
 >124	string	FreeDOS\0				
->>331	string	\ err\0					\b, FREE-DOS BETa 9 Bootloader
+>>331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
 # DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
->>>497		string		>\ 			%-.6s
->>>>503		string		>\ 			\b%-.1s
->>>>504		string		>\ 			\b%-.1s
->>>505		string		>\ 			\b.%-.3s
->>333	string	\ err\0					\b, FREE-DOS BEta 9 Bootloader
->>>497		string		>\ 			%-.6s
->>>>503		string		>\ 			\b%-.1s
->>>>504		string		>\ 			\b%-.1s
->>>505		string		>\ 			\b.%-.3s
->>334	string	\ err\0					\b, FREE-DOS Beta 9 Bootloader
->>>497		string		>\ 			%-.6s
->>>>503		string		>\ 			\b%-.1s
->>>>504		string		>\ 			\b%-.1s
->>>505		string		>\ 			\b.%-.3s
+>>>497		ubyte&0xDF	>0			
+>>>>497		string		x 			\b %-.6s
+>>>>>503	ubyte&0xDF	>0			
+>>>>>>503	string		x 			\b%-.1s
+>>>>>>>504	ubyte&0xDF	>0			
+>>>>>>>>504	string		x 			\b%-.1s
+>>>>505		ubyte&0xDF	>0			
+>>>>>505	string		x 			\b.%-.3s
+>>333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
+>>>497		ubyte&0xDF	>0			
+>>>>497		string		x 			\b %-.6s
+>>>>>503	ubyte&0xDF	>0			
+>>>>>>503	string		x 			\b%-.1s
+>>>>>>>504	ubyte&0xDF	>0			
+>>>>>>>>504	string		x 			\b%-.1s
+>>>>505		ubyte&0xDF	>0			
+>>>>>505	string		x 			\b.%-.3s
+>>334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
+>>>497		ubyte&0xDF	>0			
+>>>>497		string		x 			\b %-.6s
+>>>>>503	ubyte&0xDF	>0			
+>>>>>>503	string		x 			\b%-.1s
+>>>>>>>504	ubyte&0xDF	>0			
+>>>>>>>>504	string		x 			\b%-.1s
+>>>>505		ubyte&0xDF	>0			
+>>>>>505	string		x 			\b.%-.3s
+>336	string	Error!\ 				
+>>343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
+>>>497		ubyte&0xDF	>0			
+>>>>497		string		x 			\b %-.6s
+>>>>>503	ubyte&0xDF	>0			
+>>>>>>503	string		x 			\b%-.1s
+>>>>>>>504	ubyte&0xDF	>0			
+>>>>>>>>504	string		x 			\b%-.1s
+>>>>505		ubyte&0xDF	>0			
+>>>>>505	string		x 			\b.%-.3s
 # loader end
->0	string	\0\0\0\0		\b, extended partition table
+# Joerg Jenderek
+>446	ubyte	0			
+>>450	ubyte	>0			
+>>>482	ubyte	0			
+>>>>498	ubyte	0			
+>>>>466	ubyte	0x05			\b, extended partition table
+>>>>466	ubyte	0x0F			\b, extended partition table (LBA)
+>>>>466	ubyte	0x0			\b, extended partition table (last)	
 # JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
 # older drives may use E9 xx xx
 >0		lelong&0x009000EB	0x009000EB 
@@ -316,7 +594,7 @@
 >>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
 >>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
 >>>>>>>43	string		=NO\ NAME	\b, unlabeled
->>>>>>54	string		FAT1		\b, FAT
+>>>>>>54	string		FAT		\b, FAT
 >>>>>>>54	string		FAT12		\b (12 bit)
 >>>>>>>54	string		FAT16		\b (16 bit)
 # FAT32 specific

magic/Magdir/fsav

@@ -2,26 +2,59 @@
 #------------------------------------------------------------------------------
 # fsav:  file(1) magic for datafellows fsav virus definition files
 # Anthon van der Neut (anthon@mnt.org)
-0	beshort		0x1575		fsav (linux) macro virus
+
+# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
+0	beshort		0x1575		fsav macro virus signatures
 >8	leshort		>0		(%d-
 >11	byte		>0		\b%02d-
 >10	byte		>0		\b%02d)
+# ftp://ftp.f-prot.com/pub/sign.zip
+#10	ubyte		<12
+#>9	ubyte		<32
+#>>8	ubyte		0x0a
+#>>>12	ubyte		0x07
+#>>>>11	uleshort	>0		fsav DOS/Windows virus signatures (%d-
+#>>>>10	byte		0		\b01-
+#>>>>10	byte		1		\b02-
+#>>>>10	byte		2		\b03-
+#>>>>10	byte		3		\b04-
+#>>>>10	byte		4		\b05-
+#>>>>10	byte		5		\b06-
+#>>>>10	byte		6		\b07-
+#>>>>10	byte		7		\b08-
+#>>>>10	byte		8		\b09-
+#>>>>10	byte		9		\b10-
+#>>>>10	byte		10		\b11-
+#>>>>10	byte		11		\b12-
+#>>>>9	ubyte		>0		\b%02d)
+# ftp://ftp.f-prot.com/pub/sign2.zip
+#0	ubyte		0x62		
+#>1	ubyte		0xF5		
+#>>2	ubyte		0x1		
+#>>>3	ubyte		0x1		
+#>>>>4	ubyte		0x0e		
+#>>>>>13		ubyte	>0		fsav virus signatures
+#>>>>>>11	ubyte	x		size 0x%02x
+#>>>>>>12	ubyte	x		\b%02x
+#>>>>>>13	ubyte	x		\b%02x bytes
 
-# comment this out for now because it regognizes every file where
-# the eighth character is \n
-#8	byte		0x0a
-#>12	byte		0x07
-#>11	leshort		>0		fsav (linux) virus (%d-
-#>10	byte		0		\b01-
-#>10	byte		1		\b02-
-#>10	byte		2		\b03-
-#>10	byte		3		\b04-
-#>10	byte		4		\b05-
-#>10	byte		5		\b06-
-#>10	byte		6		\b07-
-#>10	byte		7		\b08-
-#>10	byte		8		\b08-
-#>10	byte		9		\b10-
-#>10	byte		10		\b11-
-#>10	byte		11		\b12-
-#>9	byte		>0		\b%02d)
+# Joerg Jenderek: joerg dot jenderek at web dot de
+# http://www.clamav.net/doc/latest/html/node45.html
+# .cvd files start with a 512 bytes colon separated header
+# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
+# + gzipped tarball files
+0	string		ClamAV-VDB:	
+>11	string		>\0		Clam AntiVirus database %-.23s
+>>34	string		:		
+>>>35	regex		[^:]+		\b, version 
+>>>>35		string		x 	\b%-.1s
+>>>>>36		string 		!:	
+>>>>>>36	string		x 	\b%-.1s
+>>>>>>>37	string		!:	
+>>>>>>>>37	string		x 	\b%-.1s
+>>>>>>>>>38	string		!:	
+>>>>>>>>>>38	string		x 	\b%-.1s
+>>>>512	string		\037\213	\b, gzipped
+>>>>769	string		ustar\0		\b, tared
+>512	string		\037\213	\b, gzipped
+>769	string		ustar\0		\b, tared

magic/Magdir/iff

@@ -15,21 +15,39 @@
 >8	string		AIFF		\b, AIFF audio
 >8	string		AIFC		\b, AIFF-C compressed audio
 >8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
+>8	string		16SV		\b, 16SV 16-bit sampled sound voice
 >8	string		SAMP		\b, SAMP sampled audio
->8	string		DTYP		\b, DTYP datatype description
->8	string		PTCH		\b, PTCH binary patch
+>8	string		MAUD		\b, MAUD MacroSystem audio
+>8	string		SMUS		\b, SMUS simple music
+>8	string		CMUS		\b, CMUS complex music
 # image formats
 >8	string		ILBMBMHD	\b, ILBM interleaved image
 >>20	beshort		x		\b, %d x
 >>22	beshort		x		%d
 >8	string		RGBN		\b, RGBN 12-bit RGB image
 >8	string		RGB8		\b, RGB8 24-bit RGB image
+>8	string		DEEP		\b, DEEP TVPaint/XiPaint image
 >8	string		DR2D		\b, DR2D 2-D object
 >8	string		TDDD		\b, TDDD 3-D rendering
+>8	string		LWOB		\b, LWOB 3-D object
+>8	string		LWO2		\b, LWO2 3-D object, v2
+>8	string		LWLO		\b, LWLO 3-D layered object
+>8	string		REAL		\b, REAL Real3D rendering
+>8	string		MC4D		\b, MC4D MaxonCinema4D rendering
+>8	string		ANIM		\b, ANIM animation
+>8	string		YAFA		\b, YAFA animation
+>8	string		SSA\ 		\b, SSA super smooth animation
+>8	string		ACBM		\b, ACBM continuous image
+>8	string		FAXX		\b, FAXX fax image
 # other formats
 >8	string		FTXT		\b, FTXT formatted text
 >8	string		CTLG		\b, CTLG message catalog
 >8	string		PREF		\b, PREF preferences
+>8	string		DTYP		\b, DTYP datatype description
+>8	string		PTCH		\b, PTCH binary patch
+>8	string		AMFF		\b, AMFF AmigaMetaFile format
+>8	string		WZRD		\b, WZRD StormWIZARD resource
+>8	string		DOC\ 		\b, DOC desktop publishing document
 
 # These go at the end of the iff rules
 #

magic/Magdir/linux

@@ -60,6 +60,8 @@
 4086	string		SWAPSPACE2	Linux/i386 swap file (new style)
 >0x400	long		x		%d (4K pages)
 >0x404	long		x		size %d pages
+>>4086	string		SWAPSPACE2	
+>>>1052	string		>\0		Label %s
 # ECOFF magic for OSF/1 and Linux (only tested under Linux though)
 #
 #	from Erik Troan (ewt@redhat.com) examining od dumps, so this
@@ -82,7 +84,7 @@
 # Linux kernel boot images (i386 arch) (Wolfram Kleff)
 514	string		HdrS		Linux kernel
 >510	leshort		0xAA55		x86 boot executable
->>518	leshort		>=3D0x200
+>>518	leshort		>=0x200
 >>529	byte		0		zImage,
 >>>529	byte		1		bzImage,
 >>>(526.s+0x200) string	>\0		version %s,
@@ -185,3 +187,45 @@
 0	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
 >4	belong	x			version %d
 
+# SE Linux policy database
+# From: Mike Frysinger <vapier@gentoo.org>
+0	lelong	0xf97cff8c		SE Linux policy
+>16	lelong	x			v%d
+>20	lelong	1			MLS
+>24	lelong	x			%d symbols
+>28	lelong	x			%d ocons
+
+# Linux Logical Volume Manager (LVM) 
+# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
+#
+# System ID, UUID and volume group name are 128 bytes long
+# but they should never be full and initialized with zeros...
+#
+# LVM1
+#
+0x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
+>0x12c	string	>\0		, System ID: %s
+
+0x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
+>0x12c	string	>\0		, System ID: %s
+
+#  LVM2
+#
+# It seems that the label header can be in one the four first sector
+# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
+#
+# 0x200 seems to be the common case
+
+0x218		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
+# read the offset to add to the start of the header, and the header
+# start in 0x200
+>(0x214.l+0x200) string	>\0		, UUID: %s
+
+0x018		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
+>(0x014.l)	 string	>\0		, UUID: %s
+
+0x418		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
+>(0x414.l+0x400) string	>\0		, UUID: %s
+
+0x618		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
+>(0x614.l+0x600) string	>\0		, UUID: %s

magic/Magdir/lisp

@@ -4,8 +4,18 @@
 #
 # various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
 
-# This is a guess, but a good one.
-0	string	;;			Lisp/Scheme program text
+# updated by Joerg Jenderek
+0	string	;;			
+# windows INF files often begin with semicolon and use CRLF as line end
+# lisp files are mainly created on unix system with LF as line end
+>2	search/2048	!\r		Lisp/Scheme program text
+>2	search/2048	\r		Windows INF file
+0	string	(			
+>1	string	if\ 			Lisp/Scheme program text
+>1	string	setq\ 			Lisp/Scheme program text
+>1	string	defvar\ 		Lisp/Scheme program text
+>1	string	autoload\ 		Lisp/Scheme program text
+>1	string	custom-set-variables	Lisp/Scheme program text
 
 # Emacs 18 - this is always correct, but not very magical.
 0	string	\012(			Emacs v18 byte-compiled Lisp data

magic/Magdir/maple

@@ -32,7 +32,6 @@
 # that is {VERSION major_version miunor_version computer_type version_string}
 0	string	{VERSION\ 	Maple worksheet
 >9	string	>\0	version %.1s.
->>10	string
 >>>11	string	>\0	%.1s
 
 # .mps

magic/Magdir/misctools

@@ -3,6 +3,7 @@
 #
 0	string	%%!!			X-Post-It-Note text
 0	string	BEGIN:VCALENDAR		vCalendar calendar file
+0	string	BEGIN:VCARD		vCard visiting card
 
 # From: Alex Beregszaszi <alex@fsn.hu>
 4	string	gtktalog		GNOME Catalogue (gtktalog)

magic/Magdir/msdos

@@ -4,7 +4,13 @@
 #
 
 # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
-0	string/c	@echo\ off	MS-DOS batch file text
+# updated by Joerg Jenderek
+0	string	@			
+>1	string/cB	\ echo\ off	MS-DOS batch file text
+>1	string/cB	echo\ off	MS-DOS batch file text
+>1	string/cB	rem\ 		MS-DOS batch file text
+>1	string/cB	set\ 		MS-DOS batch file text
+
 
 # OS/2 batch files are REXX. the second regex is a bit generic, oh well
 # the matched commands seem to be common in REXX and uncommon elsewhere
@@ -39,8 +45,8 @@
 #
 # many of the compressed formats were extraced from IDARC 1.23 source code
 #
-0	string	MZ
->0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 PE executable for MS Windows
+0	string	MZ		MS-DOS executable
+>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows
 >>&18	leshort&0x2000	>0	(DLL)
 >>&88	leshort		0	(unknown subsystem)
 >>&88	leshort		1	(native)
@@ -60,7 +66,7 @@
 >>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
 
 >0x18  leshort >0x3f
->>(0x3c.l) string PE\0\0 PE executable
+>>(0x3c.l) string PE\0\0 PE 
 # hooray, there's a DOS extender using the PE format, with a valid PE
 # executable inside (which just prints a message and exits if run in win)
 >>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender
@@ -108,7 +114,7 @@
 >>>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
 >>>>0x30		string		Inno \b, InnoSetup self-extracting archive
 
->>(0x3c.l)		string		NE NE executable
+>>(0x3c.l)		string		NE \b, NE
 >>>(0x3c.l+0x36)	byte		0 (unknown OS)
 >>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
 >>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
@@ -120,7 +126,7 @@
 >>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
 >>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
 
->>(0x3c.l)		string		LX\0\0 LX executable
+>>(0x3c.l)		string		LX\0\0 \b, LX
 >>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
 >>>(0x3c.l+0x0a)	leshort		1 for OS/2
 >>>(0x3c.l+0x0a)	leshort		2 for MS Windows
@@ -138,9 +144,9 @@
 >>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
 
 # MS Windows system file, supposedly a collection of LE executables
->>(0x3c.l)		string		W3 W3 executable for MS Windows
+>>(0x3c.l)		string		W3 \b, W3 for MS Windows
 
->>(0x3c.l)		string		LE\0\0 LE executable
+>>(0x3c.l)		string		LE\0\0 \b, LE executable
 >>>(0x3c.l+0x0a)	leshort		1
 # some DOS extenders use LE files with OS/2 header
 >>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
@@ -158,7 +164,7 @@
 #>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
 # fails with DOS-Extenders.
 >>>(0x3c.l+0x0a)	leshort		2 for MS Windows
->>>(0x3c.l+0x0a)	leshort		3 for MS-DOS
+>>>(0x3c.l+0x0a)	leshort		3 for DOS
 >>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
 >>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
 >>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
@@ -166,25 +172,25 @@
 # looks like ASCII, probably some embedded copyright message.
 # and definitely not NE/LE/LX/PE
 >>0x3c		lelong	>0x20000000
->>>(4.s*512)	leshort !0x014c MZ executable for MS-DOS
+>>>(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
 # header data too small for extended executable
 >2		long	!0
 >>0x18		leshort	<0x40
 >>>(4.s*512)	leshort !0x014c
 
 >>>>&(2.s-514)	string	!LE
->>>>>&-2	string	!BW MZ executable for MS-DOS
->>>>&(2.s-514)	string	LE LE executable
+>>>>>&-2	string	!BW \b, MZ for MS-DOS
+>>>>&(2.s-514)	string	LE \b, LE
 >>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
 # educated guess since indirection is still not capable enough for complex offset
 # calculations (next embedded executable would be at &(&2*512+&0-2)
 # I suspect there are only LE executables in these multi-exe files
 >>>>&(2.s-514)	string	BW
->>>>>0x240	search/0x100	DOS/4G LE executable for MS-DOS, DOS4GW DOS extender (embedded)
->>>>>0x240	search/0x100	!DOS/4G BW executable collection for MS-DOS
+>>>>>0x240	search/0x100	DOS/4G ,\b LE for MS-DOS, DOS4GW DOS extender (embedded)
+>>>>>0x240	search/0x100	!DOS/4G ,\b BW collection for MS-DOS
 
 # This sequence skips to the first COFF segment, usually .text
->(4.s*512)	leshort		0x014c COFF executable
+>(4.s*512)	leshort		0x014c \b, COFF
 >>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
 >>(8.s*16)	string		emx
 >>>&1		string		x for DOS, Win or OS/2, emx %s
@@ -255,18 +261,76 @@
 # Uncommenting only the first two lines will cover about 2/3 of COM files,
 # but it isn't feasible to match all COM files since there must be at least
 # two dozen different one-byte "magics".
-0	byte		0xe9		MS-DOS executable (COM)
+0	byte		0xe9		DOS executable (COM)
+>0x1FE	leshort		0xAA55		\b, boot code
 >6	string		SFX\ of\ LHarc	(%s)
-0	byte		0x8c		MS-DOS executable (COM)
+0	belong	0xffffffff		DOS executable (device driver)
+#CMD640X2.SYS
+>10	string	>\x23			
+>>10	string	!\x2e			
+>>>17	string	<\x5B			
+>>>>10	string	x			\b, name: %.8s
+#UDMA.SYS KEYB.SYS CMD640X2.SYS
+>10	string	<\x41			
+>>12	string	>\x40			
+>>>10	string	!$			
+>>>>12	string	x			\b, name: %.8s
+#BTCDROM.SYS ASPICD.SYS
+>22	string	>\x40			
+>>22	string	<\x5B			
+>>>23	string	<\x5B			
+>>>>22	string	x			\b, name: %.8s
+#ATAPICD.SYS
+>76	string	\0			
+>>77	string	>\x40			
+>>>77	string	<\x5B			
+>>>>77	string	x			\b, name: %.8s
+0	byte		0x8c		DOS executable (COM)
 # 0xeb conflicts with "sequent" magic
-0	byte		0xeb		MS-DOS executable (COM)
+0	byte		0xeb		DOS executable (COM)
+>0x1FE	leshort		0xAA55		\b, boot code
+>85	string		UPX		\b, UPX compressed
 >4	string		\ $ARX		\b, ARX self-extracting archive
 >4	string		\ $LHarc	\b, LHarc self-extracting archive
 >0x20e	string		SFX\ by\ LARC	\b, LARC self-extracting archive
-0	byte		0xb8		COM executable for MS-DOS
+0	byte		0xb8		COM executable
+# modified by Joerg Jenderek
+>1	lelong          !0x21cd4cff	for DOS
+# http://syslinux.zytor.com/comboot.php
+# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
+# start with assembler instructions mov eax,21cd4cffh
+>1	lelong          0x21cd4cff	(32-bit COMBOOT)
+0	string	\x81\xfc		
+>4	string	\x77\x02\xcd\x20\xb9	
+>>36	string	UPX! 			FREE-DOS executable (COM), UPX compressed
+252	string Must\ have\ DOS\ version	DR-DOS executable (COM)
+# GRR search is not working
+#2	search/28	\xcd\x21	COM executable for MS-DOS
+#WHICHFAT.cOM
+2	string	\xcd\x21		COM executable for DOS
+#DELTREE.cOM DELTREE2.cOM
+4	string	\xcd\x21		COM executable for DOS
+#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
+5	string	\xcd\x21		COM executable for DOS
+#DELTMP.COm HASFAT32.cOM
+7	string	\xcd\x21		
+>0	byte	!0xb8			COM executable for DOS
+#COMP.cOM MORE.COm
+10	string	\xcd\x21		
+>5	string	!\xcd\x21		COM executable for DOS
+#comecho.com
+13	string	\xcd\x21		COM executable for DOS
+#HELP.COm EDIT.coM
+18	string	\xcd\x21		COM executable for MS-DOS
+#NWRPLTRM.COm
+23	string	\xcd\x21		COM executable for MS-DOS
+#LOADFIX.cOm LOADFIX.cOm
+30	string	\xcd\x21		COM executable for MS-DOS
+#syslinux.com 3.11
+70	string	\xcd\x21		COM executable for DOS
 # many compressed/converted COMs start with a copy loop instead of a jump
 0x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
-0x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for MS-DOS
+0x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
 >0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
 0x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
 # FIXME: missing diet .com compression
@@ -278,9 +342,10 @@
 
 #
 # Windows Registry files.
-#
-0	string		regf		Windows NT registry file
-0	string		CREG		Windows 95 registry file
+# updated by Joerg Jenderek
+0	string		regf		Windows NT/XP registry file
+0	string		CREG		Windows 95/98/ME registry file
+0	string		SHCC3		Windows 3.1 registry file
 
 
 # AAF files:
@@ -340,7 +405,9 @@
 >15	string	1.0\ --\ HyperTerminal\ data\ file	MS-windows Hyperterminal
 
 # Windows Metafont .WMF
-0	string	\327\315\306\232\000\000\000\000\000\000	ms-windows metafont .wmf
+0       string  \327\315\306\232        ms-windows metafont .wmf
+0       string  \002\000\011\000        ms-windows metafont .wmf
+0       string  \001\000\011\000        ms-windows metafont .wmf
 
 #tz3 files whatever that is (MS Works files)
 0	string	\003\001\001\004\070\001\000\000	tz3 ms-works file

magic/Magdir/ncr

@@ -34,14 +34,14 @@
 0	beshort		000640	Tower32/800 68020
 >18	   beshort		&020000	w/68881 object
 >18	   beshort		&040000	compatible object
->18	   beshort		&~060000	object
+>18	   beshort		&060000	object
 >20	   beshort		0407	executable
 >20	   beshort		0413	pure executable
 >12	   belong		>0	not stripped
 >22	   beshort		>0	- version %ld
 0	beshort		000645	Tower32/800 68010
 >18	   beshort		&040000	compatible object
->18	   beshort		&~060000 object
+>18	   beshort		&060000 object
 >20	   beshort		0407	executable
 >20	   beshort		0413	pure executable
 >12	   belong		>0	not stripped

magic/Magdir/psion

@@ -8,7 +8,7 @@
 >4	lelong		0x1000003A	printer driver
 >4	lelong		0x1000003B	clipboard
 >4	lelong		0x10000042	multi-bitmap image
->4	lelong		0x1000006A	application infomation file
+>4	lelong		0x1000006A	application information file
 >4	lelong		0x1000006D
 >>8	lelong		0x1000007D	sketch image
 >>8	lelong		0x1000007E	voice note
@@ -37,7 +37,7 @@
 >4	lelong		0x100000AD	physical device driver
 >4	lelong		0x100000E5	file transfer protocol
 >4	lelong		0x100000E5	file transfer protocol
->4	lelong		0x10000140	printer defintion
->4	lelong		0x10000141	printer defintion
+>4	lelong		0x10000140	printer definition
+>4	lelong		0x10000141	printer definition
 
 0	lelong		0x1000007A	Psion Series 5 executable

magic/Magdir/python

@@ -12,3 +12,7 @@
 0	belong		0x2aeb0d0a	python 2.1 byte-compiled
 0	belong		0x2ded0d0a	python 2.2 byte-compiled
 0	belong		0x3bf20d0a	python 2.3 byte-compiled
+0	belong		0x6df20d0a	python 2.4 byte-compiled
+
+0	string/b  #!\ /usr/bin/python	python script text executable
+

magic/Magdir/wordprocessors

@@ -106,6 +106,12 @@
 # Hangul (Korean) Word Processor File
 0	string	HWP\ Document\ File	Hangul (Korean) Word Processor File
 
-# CosmicBook, from Benoît Rouits
+# CosmicBook, from Benoît Rouits
 0       string  CSBK    Ted Neslson's CosmicBook hypertext file
 
+2       string  EYWR    AmigaWriter file
+
+# chi:  file(1) magic for ChiWriter files
+0       string          \\1cw\          ChiWriter file
+>5      string          >\0             version %s
+0       string          \\1cw           ChiWriter file

magic/Makefile.am

@@ -44,16 +44,17 @@ Magdir/archive \
 Magdir/asterix \
 Magdir/att3b \
 Magdir/audio \
-Magdir/bFLT \
+Magdir/basis \
+Magdir/bflt \
 Magdir/blender \
 Magdir/blit \
 Magdir/bout \
 Magdir/bsdi \
+Magdir/btsnoop \
 Magdir/cad \
 Magdir/c-lang \
 Magdir/c64 \
 Magdir/cddb \
-Magdir/chi \
 Magdir/chord \
 Magdir/cisco \
 Magdir/citrus \

magic/Makefile.in

@@ -1,4 +1,4 @@
-# Makefile.in generated by automake 1.9.5 from Makefile.am.
+# Makefile.in generated by automake 1.9.6 from Makefile.am.
 # @configure_input@
 
 # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
@@ -184,16 +184,17 @@ Magdir/archive \
 Magdir/asterix \
 Magdir/att3b \
 Magdir/audio \
-Magdir/bFLT \
+Magdir/basis \
+Magdir/bflt \
 Magdir/blender \
 Magdir/blit \
 Magdir/bout \
 Magdir/bsdi \
+Magdir/btsnoop \
 Magdir/cad \
 Magdir/c-lang \
 Magdir/c64 \
 Magdir/cddb \
-Magdir/chi \
 Magdir/chord \
 Magdir/cisco \
 Magdir/citrus \

magic/magic.mime

@@ -269,7 +269,8 @@
 0       string          #!\ /bin/awk            application/x-awk
 0       string          #!/usr/bin/awk          application/x-awk
 0       string          #!\ /usr/bin/awk        application/x-awk
-0       string          BEGIN                   application/x-awk
+# update to distinguish from *.vcf files by Joerg Jenderek: joerg dot jenderek at web dot de
+0	regex		BEGIN[[:space:]]*[{]	application/x-awk
 
 # For Larry Wall's perl language.  The ``eval'' line recognizes an
 # outrageously clever hack for USG systems.
@@ -915,7 +916,9 @@
 # From: Tilman Sauerbeck <tilman@code-monkey.de>
 0	belong	0x1ee7ff00	application/x-eet
 
-0	string		CWS		application/x-shockwave-flash
+# From: Denis Knauf, via gentoo.
+0	string	fLaC		audio/x-flac
+0	string	CWS		application/x-shockwave-flash
 
 # Gnumeric spreadsheet
 # This entry is only semi-helpful, as Gnumeric compresses its files, so

magic/magic2mime

@@ -1,6 +1,6 @@
-#! /usr/local/bin/perl
+#! /usr/bin/env perl
 # -*- PERL -*-
-# $Id: magic2mime,v 1.2 2003/03/23 04:17:27 christos Exp $
+# $Id: magic2mime,v 1.3 2006/03/02 22:10:26 christos Exp $
 # Copyright (c) 1996, 1997 vax@linkdead.paranoia.com (VaX#n8)
 #
 # Usage: echo 'your-file-output-here' | file_to_ctype.pl

python/Makefile.in

@@ -1,4 +1,4 @@
-# Makefile.in generated by automake 1.9.5 from Makefile.am.
+# Makefile.in generated by automake 1.9.6 from Makefile.am.
 # @configure_input@
 
 # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,

src/Makefile.am

@@ -10,7 +10,7 @@ AM_CPPFLAGS = -DMAGIC='"/etc/magic:$(MAGIC)"'
 libmagic_la_SOURCES = magic.c apprentice.c softmagic.c ascmagic.c \
 	compress.c is_tar.c readelf.c print.c fsmagic.c \
 	funcs.c file.h names.h patchlevel.h readelf.h tar.h apptype.c
-libmagic_la_LDFLAGS = -version-info 1:0:0
+libmagic_la_LDFLAGS = -no-undefined -version-info 1:0:0
 
 file_SOURCES = file.c
 file_LDADD = libmagic.la

src/Makefile.in

@@ -1,4 +1,4 @@
-# Makefile.in generated by automake 1.9.5 from Makefile.am.
+# Makefile.in generated by automake 1.9.6 from Makefile.am.
 # @configure_input@
 
 # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
@@ -16,8 +16,6 @@
 
 
 
-SOURCES = $(libmagic_la_SOURCES) $(file_SOURCES)
-
 srcdir = @srcdir@
 top_srcdir = @top_srcdir@
 VPATH = @srcdir@
@@ -203,7 +201,7 @@ libmagic_la_SOURCES = magic.c apprentice.c softmagic.c ascmagic.c \
 	compress.c is_tar.c readelf.c print.c fsmagic.c \
 	funcs.c file.h names.h patchlevel.h readelf.h tar.h apptype.c
 
-libmagic_la_LDFLAGS = -version-info 1:0:0
+libmagic_la_LDFLAGS = -no-undefined -version-info 1:0:0
 file_SOURCES = file.c
 file_LDADD = libmagic.la
 all: all-am

src/apprentice.c

@@ -45,7 +45,7 @@
 #endif
 
 #ifndef	lint
-FILE_RCSID("@(#)$Id: apprentice.c,v 1.84 2005/03/25 18:03:18 christos Exp $")
+FILE_RCSID("@(#)$Id: apprentice.c,v 1.87 2006/03/02 22:08:57 christos Exp $")
 #endif	/* lint */
 
 #define	EATAB {while (isascii((unsigned char) *l) && \
@@ -80,12 +80,22 @@ FILE_RCSID("@(#)$Id: apprentice.c,v 1.84 2005/03/25 18:03:18 christos Exp $")
 #define IS_STRING(t) (IS_PLAINSTRING(t) || (t) == FILE_REGEX || \
     (t) == FILE_SEARCH)
 
-private int getvalue(struct magic_set *ms, struct magic *, char **);
+struct magic_entry {
+	struct magic *mp;	
+	uint32_t cont_count;
+	uint32_t max_count;
+};
+
+private int getvalue(struct magic_set *ms, struct magic *, const char **);
 private int hextoint(int);
-private char *getstr(struct magic_set *, char *, char *, int, int *);
-private int parse(struct magic_set *, struct magic **, uint32_t *, char *, int);
-private void eatsize(char **);
+private const char *getstr(struct magic_set *, const char *, char *, int,
+    int *);
+private int parse(struct magic_set *, struct magic_entry **, uint32_t *,
+    const char *, int);
+private void eatsize(const char **);
 private int apprentice_1(struct magic_set *, const char *, int, struct mlist *);
+private size_t apprentice_magic_strength(const struct magic *);
+private int apprentice_sort(const void *, const void *);
 private int apprentice_file(struct magic_set *, struct magic **, uint32_t *,
     const char *, int);
 private void byteswap(struct magic *, uint32_t);
@@ -102,6 +112,7 @@ private int check_format(struct magic_set *, struct magic *);
 private size_t maxmagic = 0;
 private size_t magicsize = sizeof(struct magic);
 
+
 #ifdef COMPILE_ONLY
 
 int main(int, char *[]);
@@ -164,6 +175,7 @@ apprentice_1(struct magic_set *ms, const char *fn, int action,
 		free(magic);
 		return rv;
 	}
+
 #ifndef COMPILE_ONLY
 	if ((rv = apprentice_map(ms, &magic, &nmagic, fn)) == -1) {
 		if (ms->flags & MAGIC_CHECK)
@@ -286,6 +298,64 @@ file_apprentice(struct magic_set *ms, const char *fn, int action)
 	return mlist;
 }
 
+private size_t
+apprentice_magic_strength(const struct magic *m)
+{
+	switch (m->type) {
+	case FILE_BYTE:
+		return 1;
+
+	case FILE_SHORT:
+	case FILE_LESHORT:
+	case FILE_BESHORT:
+		return 2;
+
+	case FILE_LONG:
+	case FILE_LELONG:
+	case FILE_BELONG:
+	case FILE_MELONG:
+		return 4;
+
+	case FILE_PSTRING:
+	case FILE_STRING:
+	case FILE_REGEX:
+	case FILE_BESTRING16:
+	case FILE_LESTRING16:
+	case FILE_SEARCH:
+		return m->vallen;
+
+	case FILE_DATE:
+	case FILE_LEDATE:
+	case FILE_BEDATE:
+	case FILE_MEDATE:
+		return 4;
+
+	case FILE_LDATE:
+	case FILE_LELDATE:
+	case FILE_BELDATE:
+	case FILE_MELDATE:
+		return 8;
+
+	default:
+		return 0;
+	}
+}
+
+private int
+apprentice_sort(const void *a, const void *b)
+{
+	const struct magic_entry *ma = a;
+	const struct magic_entry *mb = b;
+	size_t sa = apprentice_magic_strength(ma->mp);
+	size_t sb = apprentice_magic_strength(mb->mp);
+	if (sa == sb)
+		return 0;
+	else if (sa > sb)
+		return -1;
+	else
+		return 1;
+}
+
 /*
  * parse from a file
  * const char *fn: name of magic file
@@ -299,6 +369,8 @@ apprentice_file(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp,
 	FILE *f;
 	char line[BUFSIZ+1];
 	int errs = 0;
+	struct magic_entry *marray;
+	uint32_t marraycount, i, mentrycount;
 
 	f = fopen(ms->file = fn, "r");
 	if (f == NULL) {
@@ -309,12 +381,12 @@ apprentice_file(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp,
 	}
 
         maxmagic = MAXMAGIS;
-	*magicp = (struct magic *) calloc(maxmagic, sizeof(struct magic));
-	if (*magicp == NULL) {
+	if ((marray = malloc(maxmagic * sizeof(*marray))) == NULL) {
 		(void)fclose(f);
 		file_oomem(ms);
 		return -1;
 	}
+	marraycount = 0;
 
 	/* print silly verbose header for USG compat. */
 	if (action == FILE_CHECK)
@@ -323,23 +395,53 @@ apprentice_file(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp,
 	/* parse it */
 	for (ms->line = 1; fgets(line, BUFSIZ, f) != NULL; ms->line++) {
 		size_t len;
-		if (line[0]=='#')	/* comment, do not parse */
+		if (line[0] == '#')	/* comment, do not parse */
 			continue;
 		len = strlen(line);
 		if (len < 2) /* null line, garbage, etc */
 			continue;
-		line[len - 1] = '\0'; /* delete newline */
-		if (parse(ms, magicp, nmagicp, line, action) != 0)
-			errs = 1;
+		if (line[len - 1] == '\n')
+			line[len - 1] = '\0'; /* delete newline */
+		if (parse(ms, &marray, &marraycount, line, action) != 0)
+			errs++;
 	}
 
 	(void)fclose(f);
+	if (errs)
+		goto out;
+
+#ifndef NOORDER
+	qsort(marray, marraycount, sizeof(*marray), apprentice_sort);
+#endif
+
+	for (i = 0, mentrycount = 0; i < marraycount; i++)
+		mentrycount += marray[i].cont_count;
+
+	if ((*magicp = malloc(sizeof(**magicp) * mentrycount)) == NULL) {
+		file_oomem(ms);
+		errs++;
+		goto out;
+	}
+
+	mentrycount = 0;
+	for (i = 0; i < marraycount; i++) {
+		(void)memcpy(*magicp + mentrycount, marray[i].mp,
+		    marray[i].cont_count * sizeof(**magicp));
+		mentrycount += marray[i].cont_count;
+	}
+out:
+	for (i = 0; i < marraycount; i++)
+		free(marray[i].mp);
+	free(marray);
 	if (errs) {
-		free(*magicp);
 		*magicp = NULL;
 		*nmagicp = 0;
+		return errs;
+	} else {
+		*nmagicp = mentrycount;
+		return 0;
 	}
-	return errs;
+
 }
 
 /*
@@ -366,12 +468,15 @@ file_signextend(struct magic_set *ms, struct magic *m, uint32_t v)
 		case FILE_DATE:
 		case FILE_BEDATE:
 		case FILE_LEDATE:
+		case FILE_MEDATE:
 		case FILE_LDATE:
 		case FILE_BELDATE:
 		case FILE_LELDATE:
+		case FILE_MELDATE:
 		case FILE_LONG:
 		case FILE_BELONG:
 		case FILE_LELONG:
+		case FILE_MELONG:
 			v = (int32_t) v;
 			break;
 		case FILE_STRING:
@@ -394,36 +499,74 @@ file_signextend(struct magic_set *ms, struct magic *m, uint32_t v)
  * parse one line from magic file, put into magic[index++] if valid
  */
 private int
-parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l,
-    int action)
+parse(struct magic_set *ms, struct magic_entry **mentryp, uint32_t *nmentryp, 
+    const char *line, int action)
 {
 	int i = 0;
+	struct magic_entry *me;
 	struct magic *m;
+	const char *l = line;
 	char *t;
 	private const char *fops = FILE_OPS;
 	uint32_t val;
+	uint32_t cont_level, cont_count;
 
-#define ALLOC_INCR	200
-	if (*nmagicp + 1 >= maxmagic){
-		maxmagic += ALLOC_INCR;
-		if ((m = (struct magic *) realloc(*magicp,
-		    sizeof(struct magic) * maxmagic)) == NULL) {
-			file_oomem(ms);
-			if (*magicp)
-				free(*magicp);
-			return -1;
-		}
-		*magicp = m;
-		memset(&(*magicp)[*nmagicp], 0, sizeof(struct magic)
-		    * ALLOC_INCR);
-	}
-	m = &(*magicp)[*nmagicp];
-	m->flag = 0;
-	m->cont_level = 0;
+	cont_level = 0;
 
 	while (*l == '>') {
 		++l;		/* step over */
-		m->cont_level++; 
+		cont_level++; 
+	}
+
+#define ALLOC_CHUNK	(size_t)10
+#define ALLOC_INCR	(size_t)200
+
+	if (cont_level != 0) {
+		if (*nmentryp == 0) {
+			file_error(ms, 0, "No current entry for continuation");
+			return -1;
+		}
+		me = &(*mentryp)[*nmentryp - 1];
+		if (me->cont_count == me->max_count) {
+			struct magic *nm;
+			size_t cnt = me->max_count + ALLOC_CHUNK;
+			if ((nm = realloc(me->mp, sizeof(*nm) * cnt)) == NULL) {
+				file_oomem(ms);
+				return -1;
+			}
+			me->mp = m = nm;
+			me->max_count = cnt;
+		}
+		m = &me->mp[me->cont_count++];
+		memset(m, 0, sizeof(*m));
+		m->cont_level = cont_level;
+	} else {
+		if (*nmentryp == maxmagic) {
+			struct magic_entry *mp;
+
+			maxmagic += ALLOC_INCR;
+			if ((mp = realloc(*mentryp, sizeof(*mp) * maxmagic)) ==
+			    NULL) {
+				file_oomem(ms);
+				return -1;
+			}
+			(void)memset(&mp[*nmentryp], 0, sizeof(*mp) *
+			    ALLOC_INCR);
+			*mentryp = mp;
+		}
+		me = &(*mentryp)[*nmentryp];
+		if (me->mp == NULL) {
+			if ((m = malloc(sizeof(*m) * ALLOC_CHUNK)) == NULL) {
+				file_oomem(ms);
+				return -1;
+			}
+			me->mp = m;
+			me->max_count = ALLOC_CHUNK;
+		} else
+			m = me->mp;
+		memset(m, 0, sizeof(*m));
+		m->cont_level = 0;
+		me->cont_count = 1;
 	}
 
 	if (m->cont_level != 0 && *l == '&') {
@@ -463,6 +606,9 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l,
 			case 'L':
 				m->in_type = FILE_BELONG;
 				break;
+			case 'm':
+				m->in_type = FILE_MELONG;
+				break;
 			case 'h':
 			case 's':
 				m->in_type = FILE_LESHORT;
@@ -528,16 +674,15 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l,
 			m->in_op |= FILE_OPINDIRECT;
 			l++;
 		}
-		if (isdigit((unsigned char)*l) || *l == '-') 
+		if (isdigit((unsigned char)*l) || *l == '-') {
 			m->in_offset = (int32_t)strtol(l, &t, 0);
-		else
-			t = l;
-		if (*t++ != ')' ||
-		    ((m->in_op & FILE_OPINDIRECT) && *t++ != ')')) 
+			l = t;
+		}
+		if (*l++ != ')' || 
+		    ((m->in_op & FILE_OPINDIRECT) && *l++ != ')'))
 			if (ms->flags & MAGIC_CHECK)
 				file_magwarn(ms,
 				    "missing ')' in indirect offset");
-		l = t;
 	}
 
 
@@ -555,11 +700,14 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l,
 #define NBEDATE		6
 #define NLESHORT	7
 #define NLELONG		6
+#define NMELONG		6
 #define NLEDATE		6
+#define NMEDATE		6
 #define NPSTRING	7
 #define NLDATE		5
 #define NBELDATE	7
 #define NLELDATE	7
+#define NMELDATE	7
 #define NREGEX		5
 #define NBESTRING16	10
 #define NLESTRING16	10
@@ -604,9 +752,15 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l,
 	} else if (strncmp(l, "lelong", NLELONG)==0) {
 		m->type = FILE_LELONG;
 		l += NLELONG;
+	} else if (strncmp(l, "melong", NMELONG)==0) {
+		m->type = FILE_MELONG;
+		l += NMELONG;
 	} else if (strncmp(l, "ledate", NLEDATE)==0) {
 		m->type = FILE_LEDATE;
 		l += NLEDATE;
+	} else if (strncmp(l, "medate", NMEDATE)==0) {
+		m->type = FILE_MEDATE;
+		l += NMEDATE;
 	} else if (strncmp(l, "pstring", NPSTRING)==0) {
 		m->type = FILE_PSTRING;
 		l += NPSTRING;
@@ -619,6 +773,9 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l,
 	} else if (strncmp(l, "leldate", NLELDATE)==0) {
 		m->type = FILE_LELDATE;
 		l += NLELDATE;
+	} else if (strncmp(l, "meldate", NMELDATE)==0) {
+		m->type = FILE_MELDATE;
+		l += NMELDATE;
 	} else if (strncmp(l, "regex", NREGEX)==0) {
 		m->type = FILE_REGEX;
 		l += NREGEX;
@@ -648,7 +805,8 @@ parse(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp, char *l,
 		if (op != FILE_OPDIVIDE || !IS_PLAINSTRING(m->type)) {
 			++l;
 			m->mask_op |= op;
-			val = (uint32_t)strtoul(l, &l, 0);
+			val = (uint32_t)strtoul(l, &t, 0);
+			l = t;
 			m->mask = file_signextend(ms, m, val);
 			eatsize(&l);
 		} else {
@@ -746,7 +904,8 @@ GetDesc:
 		file_mdump(m);
 	}
 #endif
-	++(*nmagicp);		/* make room for next */
+	if (m->cont_level == 0)
+		++(*nmentryp);		/* make room for next */
 	return 0;
 }
 
@@ -807,7 +966,7 @@ check_format(struct magic_set *ms, struct magic *m)
  * just after the number read.  Return 0 for success, non-zero for failure.
  */
 private int
-getvalue(struct magic_set *ms, struct magic *m, char **p)
+getvalue(struct magic_set *ms, struct magic *m, const char **p)
 {
 	int slen;
 
@@ -829,8 +988,10 @@ getvalue(struct magic_set *ms, struct magic *m, char **p)
 		return 0;
 	default:
 		if (m->reln != 'x') {
+			char *ep;
 			m->value.l = file_signextend(ms, m,
-			    (uint32_t)strtoul(*p, p, 0));
+			    (uint32_t)strtoul(*p, &ep, 0));
+			*p = ep;
 			eatsize(p);
 		}
 		return 0;
@@ -843,10 +1004,11 @@ getvalue(struct magic_set *ms, struct magic *m, char **p)
  * Copy the converted version to "p", returning its length in *slen.
  * Return updated scan pointer as function result.
  */
-private char *
-getstr(struct magic_set *ms, char *s, char *p, int plen, int *slen)
+private const char *
+getstr(struct magic_set *ms, const char *s, char *p, int plen, int *slen)
 {
-	char	*origs = s, *origp = p;
+	const char *origs = s;
+	char 	*origp = p;
 	char	*pmax = p + plen - 1;
 	int	c;
 	int	val;
@@ -1018,9 +1180,9 @@ file_showstr(FILE *fp, const char *s, size_t len)
  * eatsize(): Eat the size spec from a number [eg. 10UL]
  */
 private void
-eatsize(char **p)
+eatsize(const char **p)
 {
-	char *l = *p;
+	const char *l = *p;
 
 	if (LOWCASE(*l) == 'u') 
 		l++;
@@ -1059,7 +1221,7 @@ apprentice_map(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp,
 	if (dbname == NULL)
 		return -1;
 
-	if ((fd = open(dbname, O_RDONLY)) == -1)
+	if ((fd = open(dbname, O_RDONLY|O_BINARY)) == -1)
 		return -1;
 
 	if (fstat(fd, &st) == -1) {
@@ -1149,7 +1311,7 @@ apprentice_compile(struct magic_set *ms, struct magic **magicp,
 	if (dbname == NULL) 
 		return -1;
 
-	if ((fd = open(dbname, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1) {
+	if ((fd = open(dbname, O_WRONLY|O_CREAT|O_TRUNC|O_BINARY, 0644)) == -1) {
 		file_error(ms, errno, "cannot open `%s'", dbname);
 		return -1;
 	}

src/ascmagic.c

@@ -49,7 +49,7 @@
 #include "names.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$Id: ascmagic.c,v 1.43 2005/06/25 15:52:14 christos Exp $")
+FILE_RCSID("@(#)$Id: ascmagic.c,v 1.45 2006/03/12 22:09:33 christos Exp $")
 #endif	/* lint */
 
 typedef unsigned long unichar;
@@ -154,6 +154,11 @@ file_ascmagic(struct magic_set *ms, const unsigned char *buf, size_t nbytes)
 		}
 	}
 
+	if (nbytes <= 1) {
+		rv = 0;
+		goto done;
+	}
+
 	/*
 	 * for troff, look for . + letter + letter or .\";
 	 * this must be done to disambiguate tar archives' ./file

src/file.c

@@ -39,7 +39,6 @@
 #include <sys/types.h>
 #include <sys/param.h>	/* for MAXPATHLEN */
 #include <sys/stat.h>
-#include <fcntl.h>	/* for open() */
 #ifdef RESTORE_TIME
 # if (__COHERENT__ >= 0x420)
 #  include <sys/utime.h>
@@ -72,7 +71,7 @@
 #include "patchlevel.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$Id: file.c,v 1.97 2005/08/12 14:19:33 christos Exp $")
+FILE_RCSID("@(#)$Id: file.c,v 1.100 2005/10/17 18:41:44 christos Exp $")
 #endif	/* lint */
 
 
@@ -160,7 +159,8 @@ main(int argc, char *argv[])
 #endif
 
 #ifdef LC_CTYPE
-	setlocale(LC_CTYPE, ""); /* makes islower etc work for other langs */
+	/* makes islower etc work for other langs */
+	(void)setlocale(LC_CTYPE, "");
 #endif
 
 #ifdef __EMX__
@@ -253,8 +253,9 @@ main(int argc, char *argv[])
 			flags |= MAGIC_DEVICES;
 			break;
 		case 'v':
-			(void) fprintf(stdout, "%s-"VERSION"\n", progname);
-			(void) fprintf(stdout, "magic data from %s\n",
+			(void)fprintf(stdout, "%s-%d.%.2d\n", progname,
+				       FILE_VERSION_MAJOR, patchlevel);
+			(void)fprintf(stdout, "magic file from %s\n",
 				       magicfile);
 			return 1;
 		case 'z':
@@ -322,6 +323,7 @@ main(int argc, char *argv[])
 
 
 private void
+/*ARGSUSED*/
 load(const char *m, int flags)
 {
 	if (magic)
@@ -347,6 +349,7 @@ unwrap(char *fn)
 	char buf[MAXPATHLEN];
 	FILE *f;
 	int wid = 0, cwid;
+	size_t len;
 
 	if (strcmp("-", fn) == 0) {
 		f = stdin;
@@ -359,7 +362,10 @@ unwrap(char *fn)
 		}
 
 		while (fgets(buf, MAXPATHLEN, f) != NULL) {
-			cwid = file_mbswidth(buf) - 1;
+			len = strlen(buf);
+			if (len > 0 && buf[len - 1] == '\n')
+				buf[len - 1] = '\0';
+			cwid = file_mbswidth(buf);
 			if (cwid > wid)
 				wid = cwid;
 		}
@@ -368,14 +374,15 @@ unwrap(char *fn)
 	}
 
 	while (fgets(buf, MAXPATHLEN, f) != NULL) {
-	        // cut off CR, we _need_ bytes here, not characters
-		buf[strlen(buf)-1] = '\0';
+		len = strlen(buf);
+		if (len > 0 && buf[len - 1] == '\n')
+			buf[len - 1] = '\0';
 		process(buf, wid);
 		if(nobuffer)
-			(void) fflush(stdout);
+			(void)fflush(stdout);
 	}
 
-	(void) fclose(f);
+	(void)fclose(f);
 }
 
 private void
@@ -385,14 +392,14 @@ process(const char *inname, int wid)
 	int std_in = strcmp(inname, "-") == 0;
 
 	if (wid > 0 && !bflag)
-		(void) printf("%s%s%*s ", std_in ? "/dev/stdin" : inname,
+		(void)printf("%s%s%*s ", std_in ? "/dev/stdin" : inname,
 		    separator, (int) (nopad ? 0 : (wid - file_mbswidth(inname))), "");
 
 	type = magic_file(magic, std_in ? NULL : inname);
 	if (type == NULL)
-		printf("ERROR: %s\n", magic_error(magic));
+		(void)printf("ERROR: %s\n", magic_error(magic));
 	else
-		printf("%s\n", type);
+		(void)printf("%s\n", type);
 }
 
 
@@ -501,7 +508,7 @@ usage(void)
 private void
 help(void)
 {
-	puts(
+	(void)puts(
 "Usage: file [OPTION]... [FILE]...\n"
 "Determine file type of FILEs.\n"
 "\n"

src/file.h

@@ -27,7 +27,7 @@
  */
 /*
  * file.h - definitions for file(1) program
- * @(#)$Id: file.h,v 1.70 2005/07/29 17:57:20 christos Exp $
+ * @(#)$Id: file.h,v 1.73 2005/10/20 14:59:01 christos Exp $
  */
 
 #ifndef __file_h__
@@ -39,6 +39,7 @@
 
 #include <stdio.h>	/* Include that here, to make sure __P gets defined */
 #include <errno.h>
+#include <fcntl.h>	/* For open and flags */
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
 #endif
@@ -112,6 +113,9 @@ struct magic {
 #define				FILE_BESTRING16	18
 #define				FILE_LESTRING16	19
 #define				FILE_SEARCH	20
+#define				FILE_MEDATE	21
+#define				FILE_MELDATE	22
+#define				FILE_MELONG	23
 
 #define				FILE_FORMAT_NAME	\
 /* 0 */ 			"invalid 0",		\
@@ -134,7 +138,10 @@ struct magic {
 /* 17 */ 			"regex",		\
 /* 18 */			"bestring16",		\
 /* 19 */			"lestring16",		\
-/* 20 */ 			"search",
+/* 20 */ 			"search",		\
+/* 21 */ 			"medate",		\
+/* 22 */ 			"meldate",		\
+/* 23 */ 			"melong",
 
 #define	FILE_FMT_NUM	"cduxXi"
 #define FILE_FMT_STR	"s"	
@@ -160,7 +167,10 @@ struct magic {
 /* 17 */ 			FILE_FMT_STR,		\
 /* 18 */			FILE_FMT_STR,		\
 /* 19 */			FILE_FMT_STR,		\
-/* 20 */			FILE_FMT_STR,
+/* 20 */			FILE_FMT_STR,		\
+/* 21 */			FILE_FMT_STR,		\
+/* 22 */			FILE_FMT_STR,		\
+/* 23 */			FILE_FMT_NUM,
 
 	/* Word 3 */
 	uint8_t in_op;		/* operator for indirection */
@@ -291,6 +301,10 @@ int snprintf(char *, size_t, const char *, ...);
 #define QUICK
 #endif
 
+#ifndef O_BINARY
+#define O_BINARY	0
+#endif
+
 #define FILE_RCSID(id) \
 static const char *rcsid(const char *p) { \
 	return rcsid(p = id); \

src/funcs.c

@@ -30,9 +30,12 @@
 #include <stdlib.h>
 #include <string.h>
 #include <ctype.h>
+#if defined(HAVE_WCHAR_H)
+#include <wchar.h>
+#endif
 
 #ifndef	lint
-FILE_RCSID("@(#)$Id: funcs.c,v 1.15 2005/07/12 20:05:38 christos Exp $")
+FILE_RCSID("@(#)$Id: funcs.c,v 1.19 2006/03/02 22:10:26 christos Exp $")
 #endif	/* lint */
 
 #ifndef HAVE_VSNPRINTF
@@ -128,7 +131,10 @@ file_buffer(struct magic_set *ms, int fd, const void *buf, size_t nb)
 		if ((m = file_ascmagic(ms, buf, nb)) == 0) {
 		    /* abandon hope, all ye who remain here */
 		    if (file_printf(ms, ms->flags & MAGIC_MIME ?
-			"application/octet-stream" : "data") == -1)
+			(nb ? "application/octet-stream" :
+			    "application/empty") :
+			(nb ? "data" :
+			    "empty")) == -1)
 			    return -1;
 		    m = 1;
 		}
@@ -152,6 +158,13 @@ file_reset(struct magic_set *ms)
 	return 0;
 }
 
+#define OCTALIFY(n, o)	\
+	*(n)++ = '\\', \
+	*(n)++ = (((uint32_t)*(o) >> 6) & 3) + '0', \
+	*(n)++ = (((uint32_t)*(o) >> 3) & 7) + '0', \
+	*(n)++ = (((uint32_t)*(o) >> 0) & 7) + '0', \
+	(o)++
+
 protected const char *
 file_getbuffer(struct magic_set *ms)
 {
@@ -174,14 +187,50 @@ file_getbuffer(struct magic_set *ms)
 		ms->o.pbuf = nbuf;
 	}
 
+#if defined(HAVE_WCHAR_H) && defined(HAVE_MBRTOWC) && defined(HAVE_WCWIDTH)
+	{
+		mbstate_t state;
+		wchar_t nextchar;
+		int mb_conv = 1;
+		size_t bytesconsumed;
+		char *eop;
+		(void)memset(&state, 0, sizeof(mbstate_t));
+
+		np = ms->o.pbuf;
+		op = ms->o.buf;
+		eop = op + strlen(ms->o.buf);
+
+		while (op < eop) {
+			bytesconsumed = mbrtowc(&nextchar, op, eop - op,
+			    &state);
+			if (bytesconsumed == (size_t)(-1) ||
+			    bytesconsumed == (size_t)(-2)) {
+				mb_conv = 0;
+				break;
+			}
+
+			if (iswprint(nextchar) ) {
+				(void)memcpy(np, op, bytesconsumed);
+				op += bytesconsumed;
+				np += bytesconsumed;
+			} else {
+				while (bytesconsumed-- > 0)
+					OCTALIFY(np, op);
+			}
+		}
+		*np = '\0';
+
+		/* Parsing succeeded as a multi-byte sequence */
+		if (mb_conv != 0)
+			return ms->o.pbuf;
+	}
+#endif
+
 	for (np = ms->o.pbuf, op = ms->o.buf; *op; op++) {
 		if (isprint((unsigned char)*op)) {
 			*np++ = *op;	
 		} else {
-			*np++ = '\\';
-			*np++ = ((*op >> 6) & 3) + '0';
-			*np++ = ((*op >> 3) & 7) + '0';
-			*np++ = ((*op >> 0) & 7) + '0';
+			OCTALIFY(np, op);
 		}
 	}
 	*np = '\0';
@@ -196,7 +245,7 @@ file_getbuffer(struct magic_set *ms)
 int
 vsnprintf(char *buf, size_t len, const char *fmt, va_list ap)
 {
-	vsprintf(buf, fmt, ap);
+	return vsprintf(buf, fmt, ap);
 }
 #endif
 
@@ -205,9 +254,11 @@ vsnprintf(char *buf, size_t len, const char *fmt, va_list ap)
 int
 snprintf(char *buf, size_t len, const char *fmt, ...)
 {
+	int rv;
 	va_list ap;
 	va_start(ap, fmt);
-	vsprintf(buf, fmt, ap);
+	rv = vsprintf(buf, fmt, ap);
 	va_end(ap);
+	return rv;
 }
 #endif

src/magic.c

@@ -35,7 +35,6 @@
 #include <sys/types.h>
 #include <sys/param.h>	/* for MAXPATHLEN */
 #include <sys/stat.h>
-#include <fcntl.h>	/* for open() */
 #ifdef QUICK
 #include <sys/mman.h>
 #endif
@@ -63,7 +62,7 @@
 #include "patchlevel.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$Id: magic.c,v 1.28 2005/06/25 15:52:14 christos Exp $")
+FILE_RCSID("@(#)$Id: magic.c,v 1.32 2005/10/17 15:31:10 christos Exp $")
 #endif	/* lint */
 
 #ifdef __EMX__
@@ -76,6 +75,10 @@ private void free_mlist(struct mlist *);
 private void close_and_restore(const struct magic_set *, const char *, int,
     const struct stat *);
 
+#ifndef	STDIN_FILENO
+#define	STDIN_FILENO	0
+#endif
+
 public struct magic_set *
 magic_open(int flags)
 {
@@ -179,8 +182,11 @@ private void
 close_and_restore(const struct magic_set *ms, const char *name, int fd,
     const struct stat *sb)
 {
+	if (fd == STDIN_FILENO)
+		return;
 	(void) close(fd);
-	if (fd != STDIN_FILENO && (ms->flags & MAGIC_PRESERVE_ATIME) != 0) {
+
+	if ((ms->flags & MAGIC_PRESERVE_ATIME) != 0) {
 		/*
 		 * Try to restore access, modification times if read it.
 		 * This is really *bad* because it will modify the status
@@ -237,12 +243,14 @@ magic_file(struct magic_set *ms, const char *inname)
 		goto done;
 	}
 
-#ifndef	STDIN_FILENO
-#define	STDIN_FILENO	0
-#endif
 	if (inname == NULL)
 		fd = STDIN_FILENO;
-	else if ((fd = open(inname, O_RDONLY)) < 0) {
+	else if ((fd = open(inname, O_RDONLY|O_BINARY)) < 0) {
+#ifdef __CYGWIN__
+	    char *tmp = alloca(strlen(inname) + 5);
+	    (void)strcat(strcpy(tmp, inname), ".exe");
+	    if ((fd = open(tmp, O_RDONLY|O_BINARY)) < 0) {
+#endif
 		/* We cannot open it, but we were able to stat it. */
 		if (sb.st_mode & 0222)
 			if (file_printf(ms, "writable, ") == -1)
@@ -257,6 +265,9 @@ magic_file(struct magic_set *ms, const char *inname)
 			goto done;
 		rv = 0;
 		goto done;
+#ifdef __CYGWIN__
+	    }
+#endif
 	}
 
 	/*

src/patchlevel.h

@@ -1,13 +1,19 @@
 #define	FILE_VERSION_MAJOR	4
-#define	patchlevel		15
+#define	patchlevel		17
 
 /*
  * Patchlevel file for Ian Darwin's MAGIC command.
- * $Id: patchlevel.h,v 1.58 2005/08/18 15:52:56 christos Exp $
+ * $Id: patchlevel.h,v 1.60 2006/03/02 22:15:12 christos Exp $
  *
  * $Log: patchlevel.h,v $
+ * Revision 1.60  2006/03/02 22:15:12  christos
+ * welcome to 4.17
+ *
+ * Revision 1.59  2005/10/17 17:15:21  christos
+ * welcome to 4.16
+ *
  * Revision 1.58  2005/08/18 15:52:56  christos
- * welcome to 5.15
+ * welcome to 4.15
  *
  * Revision 1.57  2005/06/25 15:52:14  christos
  * Welcome to 4.14

src/print.c

@@ -41,7 +41,7 @@
 #include <time.h>
 
 #ifndef lint
-FILE_RCSID("@(#)$Id: print.c,v 1.47 2005/03/14 16:56:25 christos Exp $")
+FILE_RCSID("@(#)$Id: print.c,v 1.50 2006/03/02 22:07:53 christos Exp $")
 #endif  /* lint */
 
 #define SZOF(a)	(sizeof(a) / sizeof(a[0]))
@@ -50,13 +50,9 @@ FILE_RCSID("@(#)$Id: print.c,v 1.47 2005/03/14 16:56:25 christos Exp $")
 protected void
 file_mdump(struct magic *m)
 {
-	private const char *typ[] = { "invalid", "byte", "short", "invalid",
-				     "long", "string", "date", "beshort",
-				     "belong", "bedate", "leshort", "lelong",
-				     "ledate", "pstring", "ldate", "beldate",
-				     "leldate", "regex" };
-	private const char optyp[] = { '@', '&', '|', '^', '+', '-', 
-				      '*', '/', '%' };
+	private const char *typ[] = { FILE_FORMAT_NAME };
+	private const char optyp[] = { FILE_OPS };
+
 	(void) fputc('[', stderr);
 	(void) fprintf(stderr, ">>>>>>>> %d" + 8 - (m->cont_level & 7),
 		       m->offset);
@@ -83,7 +79,7 @@ file_mdump(struct magic *m)
 			fputc(optyp[m->mask_op&0x7F], stderr);
 		else
 			fputc('?', stderr);
-		if(FILE_STRING != m->type || FILE_PSTRING != m->type)
+		if (FILE_STRING != m->type || FILE_PSTRING != m->type)
 			(void) fprintf(stderr, "%.8x", m->mask);
 		else {
 			if (m->mask & STRING_IGNORE_LOWERCASE) 
@@ -105,24 +101,30 @@ file_mdump(struct magic *m)
 		case FILE_LONG:
 		case FILE_LESHORT:
 		case FILE_LELONG:
+		case FILE_MELONG:
 		case FILE_BESHORT:
 		case FILE_BELONG:
 			(void) fprintf(stderr, "%d", m->value.l);
 			break;
-		case FILE_STRING:
 		case FILE_PSTRING:
+		case FILE_STRING:
 		case FILE_REGEX:
-			file_showstr(stderr, m->value.s, ~0U);
+		case FILE_BESTRING16:
+		case FILE_LESTRING16:
+		case FILE_SEARCH:
+			file_showstr(stderr, m->value.s, m->vallen);
 			break;
 		case FILE_DATE:
 		case FILE_LEDATE:
 		case FILE_BEDATE:
+		case FILE_MEDATE:
 			(void)fprintf(stderr, "%s,",
 			    file_fmttime(m->value.l, 1));
 			break;
 		case FILE_LDATE:
 		case FILE_LELDATE:
 		case FILE_BELDATE:
+		case FILE_MELDATE:
 			(void)fprintf(stderr, "%s,",
 			    file_fmttime(m->value.l, 0));
 			break;

src/readelf.c

@@ -37,7 +37,7 @@
 #include "readelf.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$Id: readelf.c,v 1.49 2005/07/14 02:22:25 christos Exp $")
+FILE_RCSID("@(#)$Id: readelf.c,v 1.54 2006/01/13 00:45:21 christos Exp $")
 #endif
 
 #ifdef	ELFCORE
@@ -46,10 +46,12 @@ private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t);
 private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t);
 private int doshn(struct magic_set *, int, int, int, off_t, int, size_t);
 private size_t donote(struct magic_set *, unsigned char *, size_t, size_t, int,
-    int, size_t);
+    int, size_t, int *);
 
 #define	ELF_ALIGN(a)	((((a) + align - 1) / align) * align)
 
+#define isquote(c) (strchr("'\"`", (c)) != NULL)
+
 private uint16_t getu16(int, uint16_t);
 private uint32_t getu32(int, uint32_t);
 private uint64_t getu64(int, uint64_t);
@@ -119,48 +121,65 @@ getu64(int swap, uint64_t value)
 		return value;
 }
 
-#define sh_addr		(class == ELFCLASS32		\
+#ifdef USE_ARRAY_FOR_64BIT_TYPES
+# define elf_getu64(swap, array) \
+	((swap ? ((uint64_t)getu32(swap, array[0])) << 32 : getu32(swap, array[0])) + \
+	 (swap ? getu32(swap, array[1]) : ((uint64_t)getu32(swap, array[1]) << 32)))
+#else
+# define elf_getu64(swap, value) getu64(swap, value)
+#endif
+
+#define xsh_addr	(class == ELFCLASS32		\
 			 ? (void *) &sh32		\
 			 : (void *) &sh64)
-#define sh_size		(class == ELFCLASS32		\
+#define xsh_sizeof	(class == ELFCLASS32		\
 			 ? sizeof sh32			\
 			 : sizeof sh64)
-#define shs_type	(class == ELFCLASS32		\
+#define xsh_size	(class == ELFCLASS32		\
+			 ? getu32(swap, sh32.sh_size)	\
+			 : getu64(swap, sh64.sh_size))
+#define xsh_offset	(class == ELFCLASS32		\
+			 ? getu32(swap, sh32.sh_offset)	\
+			 : getu64(swap, sh64.sh_offset))
+#define xsh_type	(class == ELFCLASS32		\
 			 ? getu32(swap, sh32.sh_type)	\
 			 : getu32(swap, sh64.sh_type))
-#define ph_addr		(class == ELFCLASS32		\
+#define xph_addr	(class == ELFCLASS32		\
 			 ? (void *) &ph32		\
 			 : (void *) &ph64)
-#define ph_size		(class == ELFCLASS32		\
+#define xph_sizeof	(class == ELFCLASS32		\
 			 ? sizeof ph32			\
 			 : sizeof ph64)
-#define ph_type		(class == ELFCLASS32		\
+#define xph_type	(class == ELFCLASS32		\
 			 ? getu32(swap, ph32.p_type)	\
 			 : getu32(swap, ph64.p_type))
-#define ph_offset	(class == ELFCLASS32		\
+#define xph_offset	(class == ELFCLASS32		\
 			 ? getu32(swap, ph32.p_offset)	\
 			 : getu64(swap, ph64.p_offset))
-#define ph_align	(size_t)((class == ELFCLASS32	\
+#define xph_align	(size_t)((class == ELFCLASS32	\
 			 ? (off_t) (ph32.p_align ? 	\
 			    getu32(swap, ph32.p_align) : 4) \
 			 : (off_t) (ph64.p_align ?	\
 			    getu64(swap, ph64.p_align) : 4)))
-#define ph_filesz	(size_t)((class == ELFCLASS32	\
+#define xph_filesz	(size_t)((class == ELFCLASS32	\
 			 ? getu32(swap, ph32.p_filesz)	\
 			 : getu64(swap, ph64.p_filesz)))
-#define ph_memsz	(size_t)((class == ELFCLASS32	\
+#define xnh_addr	(class == ELFCLASS32		\
+			 ? (void *) &nh32		\
+			 : (void *) &nh64)
+#define xph_memsz	(size_t)((class == ELFCLASS32	\
 			 ? getu32(swap, ph32.p_memsz)	\
 			 : getu64(swap, ph64.p_memsz)))
-#define nh_size		(class == ELFCLASS32		\
+#define xnh_sizeof	(class == ELFCLASS32		\
 			 ? sizeof nh32			\
 			 : sizeof nh64)
-#define nh_type		(class == ELFCLASS32		\
+#define xnh_type	(class == ELFCLASS32		\
 			 ? getu32(swap, nh32.n_type)	\
 			 : getu32(swap, nh64.n_type))
-#define nh_namesz	(class == ELFCLASS32		\
+#define xnh_namesz	(class == ELFCLASS32		\
 			 ? getu32(swap, nh32.n_namesz)	\
 			 : getu32(swap, nh64.n_namesz))
-#define nh_descsz	(class == ELFCLASS32		\
+#define xnh_descsz	(class == ELFCLASS32		\
 			 ? getu32(swap, nh32.n_descsz)	\
 			 : getu32(swap, nh64.n_descsz))
 #define prpsoffsets(i)	(class == ELFCLASS32		\
@@ -217,6 +236,8 @@ private const char *os_style_names[] = {
 	"NetBSD",
 };
 
+#define FLAGS_DID_CORE		1
+
 private int
 dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off,
     int num, size_t size)
@@ -226,12 +247,14 @@ dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off,
 	size_t offset;
 	unsigned char nbuf[BUFSIZ];
 	ssize_t bufsize;
+	int flags = 0;
 
-	if (size != ph_size) {
+	if (size != xph_sizeof) {
 		if (file_printf(ms, ", corrupted program header size") == -1)
 			return -1;
 		return 0;
 	}
+
 	/*
 	 * Loop through all the program headers.
 	 */
@@ -240,24 +263,24 @@ dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off,
 			file_badseek(ms);
 			return -1;
 		}
-		if (read(fd, ph_addr, ph_size) == -1) {
+		if (read(fd, xph_addr, xph_sizeof) == -1) {
 			file_badread(ms);
 			return -1;
 		}
 		off += size;
-		if (ph_type != PT_NOTE)
+		if (xph_type != PT_NOTE)
 			continue;
 
 		/*
 		 * This is a PT_NOTE section; loop through all the notes
 		 * in the section.
 		 */
-		if (lseek(fd, (off_t) ph_offset, SEEK_SET) == (off_t)-1) {
+		if (lseek(fd, (off_t)xph_offset, SEEK_SET) == (off_t)-1) {
 			file_badseek(ms);
 			return -1;
 		}
 		bufsize = read(fd, nbuf,
-		    ((ph_filesz < sizeof(nbuf)) ? ph_filesz : sizeof(nbuf)));
+		    ((xph_filesz < sizeof(nbuf)) ? xph_filesz : sizeof(nbuf)));
 		if (bufsize == -1) {
 			file_badread(ms);
 			return -1;
@@ -267,7 +290,7 @@ dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off,
 			if (offset >= (size_t)bufsize)
 				break;
 			offset = donote(ms, nbuf, offset, (size_t)bufsize,
-			    class, swap, 4);
+			    class, swap, 4, &flags);
 			if (offset == 0)
 				break;
 
@@ -279,7 +302,7 @@ dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off,
 
 private size_t
 donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size,
-    int class, int swap, size_t align)
+    int class, int swap, size_t align, int *flags)
 {
 	Elf32_Nhdr nh32;
 	Elf64_Nhdr nh64;
@@ -289,14 +312,11 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size,
 #endif
 	uint32_t namesz, descsz;
 
-	if (class == ELFCLASS32)
-		memcpy(&nh32, &nbuf[offset], sizeof(nh32));
-	else
-		memcpy(&nh64, &nbuf[offset], sizeof(nh64));
-	offset += nh_size;
+	(void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
+	offset += xnh_sizeof;
 
-	namesz = nh_namesz;
-	descsz = nh_descsz;
+	namesz = xnh_namesz;
+	descsz = xnh_descsz;
 	if ((namesz == 0) && (descsz == 0)) {
 		/*
 		 * We're out of note headers.
@@ -333,7 +353,7 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size,
 	}
 
 	if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 &&
-	    nh_type == NT_GNU_VERSION && descsz == 16) {
+	    xnh_type == NT_GNU_VERSION && descsz == 16) {
 		uint32_t desc[4];
 		(void)memcpy(desc, &nbuf[doff], sizeof(desc));
 
@@ -352,6 +372,14 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size,
 			if (file_printf(ms, "Solaris") == -1)
 				return size;
 			break;
+		case GNU_OS_KFREEBSD:
+			if (file_printf(ms, "kFreeBSD") == -1)
+				return size;
+			break;
+		case GNU_OS_KNETBSD:
+			if (file_printf(ms, "kNetBSD") == -1)
+				return size;
+			break;
 		default:
 			if (file_printf(ms, "<unknown>") == -1)
 				return size; 
@@ -363,7 +391,7 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size,
 	}
 
 	if (namesz == 7 && strcmp((char *)&nbuf[noff], "NetBSD") == 0 &&
-	    nh_type == NT_NETBSD_VERSION && descsz == 4) {
+	    xnh_type == NT_NETBSD_VERSION && descsz == 4) {
 		uint32_t desc;
 		(void)memcpy(&desc, &nbuf[doff], sizeof(desc));
 		desc = getu32(swap, desc);
@@ -405,7 +433,7 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size,
 	}
 
 	if (namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0 &&
-	    nh_type == NT_FREEBSD_VERSION && descsz == 4) {
+	    xnh_type == NT_FREEBSD_VERSION && descsz == 4) {
 		uint32_t desc;
 		(void)memcpy(&desc, &nbuf[doff], sizeof(desc));
 		desc = getu32(swap, desc);
@@ -482,7 +510,7 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size,
 	}
 
 	if (namesz == 8 && strcmp((char *)&nbuf[noff], "OpenBSD") == 0 &&
-	    nh_type == NT_OPENBSD_VERSION && descsz == 4) {
+	    xnh_type == NT_OPENBSD_VERSION && descsz == 4) {
 		if (file_printf(ms, ", for OpenBSD") == -1)
 			return size;
 		/* Content of note is always 0 */
@@ -490,7 +518,7 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size,
 	}
 
 	if (namesz == 10 && strcmp((char *)&nbuf[noff], "DragonFly") == 0 &&
-	    nh_type == NT_DRAGONFLY_VERSION && descsz == 4) {
+	    xnh_type == NT_DRAGONFLY_VERSION && descsz == 4) {
 		uint32_t desc;
 		if (file_printf(ms, ", for DragonFly") == -1)
 			return size;
@@ -531,100 +559,113 @@ donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size,
 	}
 
 #ifdef ELFCORE
-	if (os_style != -1)
-		if (file_printf(ms, ", %s-style", os_style_names[os_style]) == -1)
-			return size;
+	if (os_style != -1) {
+		if ((*flags & FLAGS_DID_CORE) == 0) {
+			if (file_printf(ms, ", %s-style",
+			    os_style_names[os_style]) == -1)
+				return size;
+			*flags |= FLAGS_DID_CORE;
+		}
+	}
 
-	if (os_style == OS_STYLE_NETBSD && nh_type == NT_NETBSD_CORE_PROCINFO) {
-		uint32_t signo;
-		/*
-		 * Extract the program name.  It is at
-		 * offset 0x7c, and is up to 32-bytes,
-		 * including the terminating NUL.
-		 */
-		if (file_printf(ms, ", from '%.31s'", &nbuf[doff + 0x7c]) == -1)
-			return size;
-		
-		/*
-		 * Extract the signal number.  It is at
-		 * offset 0x08.
-		 */
-		memcpy(&signo, &nbuf[doff + 0x08],
-		    sizeof(signo));
-		if (file_printf(ms, " (signal %u)", getu32(swap, signo)) == -1)
+	switch (os_style) {
+	case OS_STYLE_NETBSD:
+		if (xnh_type == NT_NETBSD_CORE_PROCINFO) {
+			uint32_t signo;
+			/*
+			 * Extract the program name.  It is at
+			 * offset 0x7c, and is up to 32-bytes,
+			 * including the terminating NUL.
+			 */
+			if (file_printf(ms, ", from '%.31s'",
+			    &nbuf[doff + 0x7c]) == -1)
+				return size;
+			
+			/*
+			 * Extract the signal number.  It is at
+			 * offset 0x08.
+			 */
+			(void)memcpy(&signo, &nbuf[doff + 0x08],
+			    sizeof(signo));
+			if (file_printf(ms, " (signal %u)",
+			    getu32(swap, signo)) == -1)
+				return size;
 			return size;
-		return size;
-	} else if (os_style != OS_STYLE_NETBSD && nh_type == NT_PRPSINFO) {
-		size_t i, j;
-		unsigned char c;
-		/*
-		 * Extract the program name.  We assume
-		 * it to be 16 characters (that's what it
-		 * is in SunOS 5.x and Linux).
-		 *
-		 * Unfortunately, it's at a different offset
-		 * in varous OSes, so try multiple offsets.
-		 * If the characters aren't all printable,
-		 * reject it.
-		 */
-		for (i = 0; i < NOFFSETS; i++) {
-			size_t reloffset = prpsoffsets(i);
-			size_t noffset = doff + reloffset;
-			for (j = 0; j < 16; j++, noffset++, reloffset++) {
-				/*
-				 * Make sure we're not past
-				 * the end of the buffer; if
-				 * we are, just give up.
-				 */
-				if (noffset >= size)
-					goto tryanother;
-
-				/*
-				 * Make sure we're not past
-				 * the end of the contents;
-				 * if we are, this obviously
-				 * isn't the right offset.
-				 */
-				if (reloffset >= descsz)
-					goto tryanother;
+		}
+		break;
 
-				c = nbuf[noffset];
-				if (c == '\0') {
+	default:
+		if (xnh_type == NT_PRPSINFO) {
+			size_t i, j;
+			unsigned char c;
+			/*
+			 * Extract the program name.  We assume
+			 * it to be 16 characters (that's what it
+			 * is in SunOS 5.x and Linux).
+			 *
+			 * Unfortunately, it's at a different offset
+			 * in varous OSes, so try multiple offsets.
+			 * If the characters aren't all printable,
+			 * reject it.
+			 */
+			for (i = 0; i < NOFFSETS; i++) {
+				size_t reloffset = prpsoffsets(i);
+				size_t noffset = doff + reloffset;
+				for (j = 0; j < 16; j++, noffset++,
+				    reloffset++) {
 					/*
-					 * A '\0' at the
-					 * beginning is
-					 * obviously wrong.
-					 * Any other '\0'
-					 * means we're done.
+					 * Make sure we're not past
+					 * the end of the buffer; if
+					 * we are, just give up.
 					 */
-					if (j == 0)
+					if (noffset >= size)
 						goto tryanother;
-					else
-						break;
-				} else {
+
 					/*
-					 * A nonprintable
-					 * character is also
-					 * wrong.
+					 * Make sure we're not past
+					 * the end of the contents;
+					 * if we are, this obviously
+					 * isn't the right offset.
 					 */
-#define isquote(c) (strchr("'\"`", (c)) != NULL)
-					if (!isprint(c) || isquote(c))
+					if (reloffset >= descsz)
 						goto tryanother;
-				}
-			}
 
-			/*
-			 * Well, that worked.
-			 */
-			if (file_printf(ms, ", from '%.16s'",
-			    &nbuf[doff + prpsoffsets(i)]) == -1)
+					c = nbuf[noffset];
+					if (c == '\0') {
+						/*
+						 * A '\0' at the
+						 * beginning is
+						 * obviously wrong.
+						 * Any other '\0'
+						 * means we're done.
+						 */
+						if (j == 0)
+							goto tryanother;
+						else
+							break;
+					} else {
+						/*
+						 * A nonprintable
+						 * character is also
+						 * wrong.
+						 */
+						if (!isprint(c) || isquote(c))
+							goto tryanother;
+					}
+				}
+				/*
+				 * Well, that worked.
+				 */
+				if (file_printf(ms, ", from '%.16s'",
+				    &nbuf[doff + prpsoffsets(i)]) == -1)
+					return size;
 				return size;
-			return size;
 
-		tryanother:
-			;
+			tryanother:
+				;
+			}
 		}
-		return offset;
+		break;
 	}
 #endif
 	return offset;
@@ -636,8 +677,12 @@ doshn(struct magic_set *ms, int class, int swap, int fd, off_t off, int num,
 {
 	Elf32_Shdr sh32;
 	Elf64_Shdr sh64;
+	int stripped = 1;
+	int flags = 0;
+	void *nbuf;
+	off_t noff;
 
-	if (size != sh_size) {
+	if (size != xsh_sizeof) {
 		if (file_printf(ms, ", corrupted section header size") == -1)
 			return -1;
 		return 0;
@@ -649,17 +694,61 @@ doshn(struct magic_set *ms, int class, int swap, int fd, off_t off, int num,
 	}
 
 	for ( ; num; num--) {
-		if (read(fd, sh_addr, sh_size) == -1) {
+		if (read(fd, xsh_addr, xsh_sizeof) == -1) {
 			file_badread(ms);
 			return -1;
 		}
-		if (shs_type == SHT_SYMTAB /* || shs_type == SHT_DYNSYM */) {
-			if (file_printf(ms, ", not stripped") == -1)
+		switch (xsh_type) {
+		case SHT_SYMTAB:
+#if 0
+		case SHT_DYNSYM:
+#endif
+			stripped = 0;
+			break;
+		case SHT_NOTE:
+			if ((off = lseek(fd, (off_t)0, SEEK_CUR)) ==
+			    (off_t)-1) {
+				file_badread(ms);
 				return -1;
-			return 0;
+			}
+			if ((nbuf = malloc((size_t)xsh_size)) == NULL) {
+				file_error(ms, errno, "Cannot allocate memory"
+				    " for note");
+				return -1;
+			}
+			if ((noff = lseek(fd, (off_t)xsh_offset, SEEK_SET)) ==
+			    (off_t)-1) {
+				file_badread(ms);
+				free(nbuf);
+				return -1;
+			}
+			if (read(fd, nbuf, (size_t)xsh_size) !=
+			    (ssize_t)xsh_size) {
+				free(nbuf);
+				file_badread(ms);
+				return -1;
+			}
+
+			noff = 0;
+			for (;;) {
+				if (noff >= (size_t)xsh_size)
+					break;
+				noff = donote(ms, nbuf, (size_t)noff,
+				    (size_t)xsh_size, class, swap, 4,
+				    &flags);
+				if (noff == 0)
+					break;
+			}
+			if ((lseek(fd, off, SEEK_SET)) == (off_t)-1) {
+				free(nbuf);
+				file_badread(ms);
+				return -1;
+			}
+			free(nbuf);
+			break;
 		}
 	}
-	if (file_printf(ms, ", stripped") == -1)
+	if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
 		return -1;
 	return 0;
 }
@@ -681,8 +770,9 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off,
 	int bufsize;
 	size_t offset, align;
 	off_t savedoffset;
+	int flags = 0;
 
-	if (size != ph_size) {
+	if (size != xph_sizeof) {
 		if (file_printf(ms, ", corrupted program header size") == -1)
 		    return -1;
 		return 0;
@@ -693,7 +783,7 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off,
 	}
 
   	for ( ; num; num--) {
-  		if (read(fd, ph_addr, ph_size) == -1) {
+  		if (read(fd, xph_addr, xph_sizeof) == -1) {
   			file_badread(ms);
 			return -1;
 		}
@@ -702,7 +792,7 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off,
 			return -1;
 		}
 
-		switch (ph_type) {
+		switch (xph_type) {
 		case PT_DYNAMIC:
 			linking_style = "dynamically";
 			break;
@@ -710,7 +800,7 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off,
 			shared_libraries = " (uses shared libs)";
 			break;
 		case PT_NOTE:
-			if ((align = ph_align) & 0x80000000) {
+			if ((align = xph_align) & 0x80000000) {
 				if (file_printf(ms, 
 				    ", invalid note alignment 0x%lx",
 				    (unsigned long)align) == -1)
@@ -721,13 +811,13 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off,
 			 * This is a PT_NOTE section; loop through all the notes
 			 * in the section.
 			 */
-			if (lseek(fd, (off_t) ph_offset, SEEK_SET)
+			if (lseek(fd, (off_t)xph_offset, SEEK_SET)
 			    == (off_t)-1) {
 				file_badseek(ms);
 				return -1;
 			}
-			bufsize = read(fd, nbuf, ((ph_filesz < sizeof(nbuf)) ?
-			    ph_filesz : sizeof(nbuf)));
+			bufsize = read(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ?
+			    xph_filesz : sizeof(nbuf)));
 			if (bufsize == -1) {
 				file_badread(ms);
 				return -1;
@@ -737,7 +827,8 @@ dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off,
 				if (offset >= (size_t)bufsize)
 					break;
 				offset = donote(ms, nbuf, offset,
-				    (size_t)bufsize, class, swap, align);
+				    (size_t)bufsize, class, swap, align,
+				    &flags);
 				if (offset == 0)
 					break;
 			}
@@ -766,22 +857,24 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf,
 	int class;
 	int swap;
 
-	/*
-	 * If we cannot seek, it must be a pipe, socket or fifo.
-	 */
-	if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
-		fd = file_pipe2file(ms, fd, buf, nbytes);
+	/* Return if it's not ELF (so we avoid pipe2file unless needed) */
+	if (buf[EI_MAG0] != ELFMAG0
+	    || (buf[EI_MAG1] != ELFMAG1 && buf[EI_MAG1] != OLFMAG1)
+	    || buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3)
+	    return 0;
 
 	/*
 	 * ELF executables have multiple section headers in arbitrary
 	 * file locations and thus file(1) cannot determine it from easily.
 	 * Instead we traverse thru all section headers until a symbol table
-	 * one is found or else the binary is stripped.
+	 * one is found or else the binary is stripped. So whole file is needed
 	 */
-	if (buf[EI_MAG0] != ELFMAG0
-	    || (buf[EI_MAG1] != ELFMAG1 && buf[EI_MAG1] != OLFMAG1)
-	    || buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3)
-	    return 0;
+
+	/*
+	 * If we cannot seek, it must be a pipe, socket or fifo.
+	 */
+	if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
+		fd = file_pipe2file(ms, fd, buf, nbytes);
 
 
 	class = buf[4];
@@ -837,11 +930,7 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf,
 		if (getu16(swap, elfhdr.e_type) == ET_CORE) {
 #ifdef ELFCORE
 			if (dophn_core(ms, class, swap, fd,
-#ifdef USE_ARRAY_FOR_64BIT_TYPES
-			    (off_t)getu32(swap, elfhdr.e_phoff[1]),
-#else
-			    (off_t)getu64(swap, elfhdr.e_phoff),
-#endif
+			    (off_t)elf_getu64(swap, elfhdr.e_phoff),
 			    getu16(swap, elfhdr.e_phnum), 
 			    (size_t)getu16(swap, elfhdr.e_phentsize)) == -1)
 				return -1;
@@ -851,22 +940,14 @@ file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf,
 		} else {
 			if (getu16(swap, elfhdr.e_type) == ET_EXEC) {
 				if (dophn_exec(ms, class, swap, fd,
-#ifdef USE_ARRAY_FOR_64BIT_TYPES
-				    (off_t)getu32(swap, elfhdr.e_phoff[1]),
-#else
-				    (off_t)getu64(swap, elfhdr.e_phoff),
-#endif
+				    (off_t)elf_getu64(swap, elfhdr.e_phoff),
 				    getu16(swap, elfhdr.e_phnum), 
 				    (size_t)getu16(swap, elfhdr.e_phentsize))
 				    == -1)
 					return -1;
 			}
 			if (doshn(ms, class, swap, fd,
-#ifdef USE_ARRAY_FOR_64BIT_TYPES
-			    (off_t)getu32(swap, elfhdr.e_shoff[1]),
-#else
-			    (off_t)getu64(swap, elfhdr.e_shoff),
-#endif
+			    (off_t)elf_getu64(swap, elfhdr.e_shoff),
 			    getu16(swap, elfhdr.e_shnum),
 			    (size_t)getu16(swap, elfhdr.e_shentsize)) == -1)
 				return -1;

src/readelf.h

@@ -50,6 +50,7 @@ typedef	uint32_t 	Elf64_Addr[2];
 typedef	uint32_t 	Elf64_Off[2];
 typedef uint32_t 	Elf64_Xword[2];
 #else
+#undef USE_ARRAY_FOR_64BIT_TYPES
 typedef	uint64_t 	Elf64_Addr;
 typedef	uint64_t 	Elf64_Off;
 typedef uint64_t 	Elf64_Xword;
@@ -231,5 +232,7 @@ typedef struct {
 #define GNU_OS_LINUX	0
 #define GNU_OS_HURD	1
 #define GNU_OS_SOLARIS	2
+#define GNU_OS_KFREEBSD	3
+#define GNU_OS_KNETBSD	4
 
 #endif

src/softmagic.c

@@ -39,13 +39,13 @@
 
 
 #ifndef	lint
-FILE_RCSID("@(#)$Id: softmagic.c,v 1.74 2005/07/29 17:57:20 christos Exp $")
+FILE_RCSID("@(#)$Id: softmagic.c,v 1.78 2006/03/12 22:09:33 christos Exp $")
 #endif	/* lint */
 
 private int match(struct magic_set *, struct magic *, uint32_t,
     const unsigned char *, size_t);
 private int mget(struct magic_set *, union VALUETYPE *, const unsigned char *,
-    struct magic *, size_t, int);
+    struct magic *, size_t, unsigned int);
 private int mcheck(struct magic_set *, union VALUETYPE *, struct magic *);
 private int32_t mprint(struct magic_set *, union VALUETYPE *, struct magic *);
 private void mdebug(uint32_t, const char *, size_t);
@@ -272,6 +272,7 @@ mprint(struct magic_set *ms, union VALUETYPE *p, struct magic *m)
   	case FILE_LONG:
   	case FILE_BELONG:
   	case FILE_LELONG:
+  	case FILE_MELONG:
 		v = file_signextend(ms, m, p->l);
 		if (file_printf(ms, m->desc, (uint32_t) v) == -1)
 			return -1;
@@ -302,6 +303,7 @@ mprint(struct magic_set *ms, union VALUETYPE *p, struct magic *m)
 	case FILE_DATE:
 	case FILE_BEDATE:
 	case FILE_LEDATE:
+	case FILE_MEDATE:
 		if (file_printf(ms, m->desc, file_fmttime(p->l, 1)) == -1)
 			return -1;
 		t = m->offset + sizeof(time_t);
@@ -310,6 +312,7 @@ mprint(struct magic_set *ms, union VALUETYPE *p, struct magic *m)
 	case FILE_LDATE:
 	case FILE_BELDATE:
 	case FILE_LELDATE:
+	case FILE_MELDATE:
 		if (file_printf(ms, m->desc, file_fmttime(p->l, 0)) == -1)
 			return -1;
 		t = m->offset + sizeof(time_t);
@@ -597,6 +600,41 @@ mconvert(struct magic_set *ms, union VALUETYPE *p, struct magic *m)
 		if (m->mask_op & FILE_OPINVERSE)
 			p->l = ~p->l;
 		return 1;
+	case FILE_MELONG:
+	case FILE_MEDATE:
+	case FILE_MELDATE:
+		p->l = (int32_t)
+		    ((p->hl[1]<<24)|(p->hl[0]<<16)|(p->hl[3]<<8)|(p->hl[2]));
+		if (m->mask)
+			switch (m->mask_op&0x7F) {
+			case FILE_OPAND:
+				p->l &= m->mask;
+				break;
+			case FILE_OPOR:
+				p->l |= m->mask;
+				break;
+			case FILE_OPXOR:
+				p->l ^= m->mask;
+				break;
+			case FILE_OPADD:
+				p->l += m->mask;
+				break;
+			case FILE_OPMINUS:
+				p->l -= m->mask;
+				break;
+			case FILE_OPMULTIPLY:
+				p->l *= m->mask;
+				break;
+			case FILE_OPDIVIDE:
+				p->l /= m->mask;
+				break;
+			case FILE_OPMODULO:
+				p->l %= m->mask;
+				break;
+			}
+		if (m->mask_op & FILE_OPINVERSE)
+			p->l = ~p->l;
+		return 1;
 	case FILE_REGEX:
 	case FILE_SEARCH:
 		return 1;
@@ -626,6 +664,11 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 		 * (starting at 1), not as bytes-from start-of-file
 		 */
 		char *b, *c, *last = NULL;
+		if (s == NULL) {
+			p->search.buflen = 0;
+			p->search.buf = NULL;
+			return 0;
+		}
 		if ((p->search.buf = strdup((const char *)s)) == NULL) {
 			file_oomem(ms);
 			return -1;
@@ -644,8 +687,8 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 
 	if (indir == 0 && (type == FILE_BESTRING16 || type == FILE_LESTRING16))
 	{
-		const char *src = s + offset;
-		const char *esrc = s + nbytes;
+		const unsigned char *src = s + offset;
+		const unsigned char *esrc = s + nbytes;
 		char *dst = p->s, *edst = &p->s[sizeof(p->s) - 1];
 
 		if (type == FILE_BESTRING16)
@@ -679,13 +722,14 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 	 * might even cause problems
 	 */
 	if (nbytes < sizeof(*p))
-		(void)memset(((char *)p) + nbytes, '\0', sizeof(*p) - nbytes);
+		(void)memset(((char *)(void *)p) + nbytes, '\0',
+		    sizeof(*p) - nbytes);
 	return 0;
 }
 
 private int
 mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s,
-    struct magic *m, size_t nbytes, int cont_level)
+    struct magic *m, size_t nbytes, unsigned int cont_level)
 {
 	uint32_t offset = m->offset;
 
@@ -701,7 +745,7 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s,
 		int off = m->in_offset;
 		if (m->in_op & FILE_OPINDIRECT) {
 			const union VALUETYPE *q =
-			    ((const union VALUETYPE *)(s + offset + off));
+			    ((const void *)(s + offset + off));
 			switch (m->in_type) {
 			case FILE_BYTE:
 				off = q->b;
@@ -726,6 +770,10 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s,
 				off = (int32_t)((q->hl[3]<<24)|(q->hl[2]<<16)|
 						 (q->hl[1]<<8)|(q->hl[0]));
 				break;
+			case FILE_MELONG:
+				off = (int32_t)((q->hl[1]<<24)|(q->hl[0]<<16)|
+						 (q->hl[3]<<8)|(q->hl[2]));
+				break;
 			}
 		}
 		switch (m->in_type) {
@@ -1043,6 +1091,76 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s,
 			if (m->in_op & FILE_OPINVERSE)
 				offset = ~offset;
 			break;
+		case FILE_MELONG:
+			if (nbytes < (offset + 4))
+				return 0;
+			if (off) {
+				switch (m->in_op & 0x7F) {
+				case FILE_OPAND:
+					offset = (int32_t)((p->hl[1]<<24)|
+							 (p->hl[0]<<16)|
+							 (p->hl[3]<<8)|
+							 (p->hl[2])) &
+						 off;
+					break;
+				case FILE_OPOR:
+					offset = (int32_t)((p->hl[1]<<24)|
+							 (p->hl[0]<<16)|
+							 (p->hl[3]<<8)|
+							 (p->hl[2])) |
+						 off;
+					break;
+				case FILE_OPXOR:
+					offset = (int32_t)((p->hl[1]<<24)|
+							 (p->hl[0]<<16)|
+							 (p->hl[3]<<8)|
+							 (p->hl[2])) ^
+						 off;
+					break;
+				case FILE_OPADD:
+					offset = (int32_t)((p->hl[1]<<24)|
+							 (p->hl[0]<<16)|
+							 (p->hl[3]<<8)|
+							 (p->hl[2])) +
+						 off;
+					break;
+				case FILE_OPMINUS:
+					offset = (int32_t)((p->hl[1]<<24)|
+							 (p->hl[0]<<16)|
+							 (p->hl[3]<<8)|
+							 (p->hl[2])) -
+						 off;
+					break;
+				case FILE_OPMULTIPLY:
+					offset = (int32_t)((p->hl[1]<<24)|
+							 (p->hl[0]<<16)|
+							 (p->hl[3]<<8)|
+							 (p->hl[2])) *
+						 off;
+					break;
+				case FILE_OPDIVIDE:
+					offset = (int32_t)((p->hl[1]<<24)|
+							 (p->hl[0]<<16)|
+							 (p->hl[3]<<8)|
+							 (p->hl[2])) /
+						 off;
+					break;
+				case FILE_OPMODULO:
+					offset = (int32_t)((p->hl[1]<<24)|
+							 (p->hl[0]<<16)|
+							 (p->hl[3]<<8)|
+							 (p->hl[2])) %
+						 off;
+					break;
+				}
+			} else
+				offset = (int32_t)((p->hl[1]<<24)|
+						 (p->hl[0]<<16)|
+						 (p->hl[3]<<8)|
+						 (p->hl[2]));
+			if (m->in_op & FILE_OPINVERSE)
+				offset = ~offset;
+			break;
 		case FILE_LONG:
 			if (nbytes < (offset + 4))
 				return 0;
@@ -1116,12 +1234,15 @@ mget(struct magic_set *ms, union VALUETYPE *p, const unsigned char *s,
 		case FILE_LONG:
 		case FILE_BELONG:
 		case FILE_LELONG:
+		case FILE_MELONG:
 		case FILE_DATE:
 		case FILE_BEDATE:
 		case FILE_LEDATE:
+		case FILE_MEDATE:
 		case FILE_LDATE:
 		case FILE_BELDATE:
 		case FILE_LELDATE:
+		case FILE_MELDATE:
 			if (nbytes < (offset + 4))
 				return 0;
 			break;
@@ -1180,12 +1301,15 @@ mcheck(struct magic_set *ms, union VALUETYPE *p, struct magic *m)
 	case FILE_LONG:
 	case FILE_BELONG:
 	case FILE_LELONG:
+	case FILE_MELONG:
 	case FILE_DATE:
 	case FILE_BEDATE:
 	case FILE_LEDATE:
+	case FILE_MEDATE:
 	case FILE_LDATE:
 	case FILE_BELDATE:
 	case FILE_LELDATE:
+	case FILE_MELDATE:
 		v = p->l;
 		break;