Browse Source

Import upstream version 3.20.1

Nicolás Lichtmaier 24 years ago
commit
f17a9918da
100 changed files with 5609 additions and 0 deletions
  1. 31 0
      LEGAL.NOTICE
  2. 33 0
      MAINT
  3. 5 0
      Magdir/Header
  4. 7 0
      Magdir/Localstuff
  5. 16 0
      Magdir/Makefile
  6. 17 0
      Magdir/alliant
  7. 16 0
      Magdir/alpha
  8. 54 0
      Magdir/animation
  9. 6 0
      Magdir/apl
  10. 10 0
      Magdir/apple
  11. 217 0
      Magdir/archive
  12. 39 0
      Magdir/att3b
  13. 90 0
      Magdir/audio
  14. 19 0
      Magdir/blit
  15. 13 0
      Magdir/c-lang
  16. 7 0
      Magdir/chi
  17. 64 0
      Magdir/clipper
  18. 75 0
      Magdir/commands
  19. 86 0
      Magdir/compress
  20. 7 0
      Magdir/convex
  21. 36 0
      Magdir/database
  22. 11 0
      Magdir/diamond
  23. 8 0
      Magdir/diff
  24. 81 0
      Magdir/dump
  25. 61 0
      Magdir/elf
  26. 21 0
      Magdir/encore
  27. 6 0
      Magdir/filesystems
  28. 38 0
      Magdir/fonts
  29. 36 0
      Magdir/frame
  30. 97 0
      Magdir/freebsd
  31. 212 0
      Magdir/hp
  32. 19 0
      Magdir/ibm370
  33. 16 0
      Magdir/ibm6000
  34. 28 0
      Magdir/iff
  35. 226 0
      Magdir/images
  36. 35 0
      Magdir/intel
  37. 8 0
      Magdir/interleaf
  38. 54 0
      Magdir/ispell
  39. 4 0
      Magdir/java
  40. 8 0
      Magdir/karma
  41. 11 0
      Magdir/lex
  42. 7 0
      Magdir/lif
  43. 85 0
      Magdir/linux
  44. 10 0
      Magdir/lisp
  45. 38 0
      Magdir/mach
  46. 5 0
      Magdir/magic
  47. 21 0
      Magdir/mail.news
  48. 72 0
      Magdir/microsoft
  49. 7 0
      Magdir/mirage
  50. 10 0
      Magdir/mkid
  51. 5 0
      Magdir/mmdf
  52. 32 0
      Magdir/motorola
  53. 73 0
      Magdir/msdos
  54. 48 0
      Magdir/ncr
  55. 192 0
      Magdir/netbsd
  56. 12 0
      Magdir/news
  57. 7 0
      Magdir/pbm
  58. 7 0
      Magdir/pdf
  59. 25 0
      Magdir/pdp
  60. 13 0
      Magdir/pgp
  61. 5 0
      Magdir/pkgadd
  62. 17 0
      Magdir/plus5
  63. 55 0
      Magdir/printer
  64. 7 0
      Magdir/psdbms
  65. 11 0
      Magdir/pyramid
  66. 17 0
      Magdir/rpm
  67. 12 0
      Magdir/rtf
  68. 5 0
      Magdir/sc
  69. 21 0
      Magdir/sccs
  70. 10 0
      Magdir/sendmail
  71. 34 0
      Magdir/sequent
  72. 165 0
      Magdir/sgi
  73. 21 0
      Magdir/sgml
  74. 30 0
      Magdir/softquad
  75. 86 0
      Magdir/sun
  76. 9 0
      Magdir/terminfo
  77. 36 0
      Magdir/tex
  78. 12 0
      Magdir/timezone
  79. 27 0
      Magdir/troff
  80. 7 0
      Magdir/typeset
  81. 36 0
      Magdir/unknown
  82. 30 0
      Magdir/uuencode
  83. 15 0
      Magdir/varied.out
  84. 34 0
      Magdir/vax
  85. 31 0
      Magdir/visx
  86. 27 0
      Magdir/vms
  87. 11 0
      Magdir/zilog
  88. 16 0
      Magdir/zyxel
  89. 172 0
      Makefile
  90. 76 0
      PORTING
  91. 89 0
      README
  92. 626 0
      apprentice.c
  93. 123 0
      ascmagic.c
  94. 122 0
      compress.c
  95. 20 0
      file-3.20.1.lsm
  96. 425 0
      file.c
  97. 132 0
      file.h
  98. 364 0
      file.man
  99. 176 0
      fsmagic.c
  100. 0 0
      is_tar.c

+ 31 - 0
LEGAL.NOTICE

@@ -0,0 +1,31 @@
+Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995.
+Software written by Ian F. Darwin and others; maintained by Christos Zoulas.
+$Id: LEGAL.NOTICE,v 1.9 1995/10/27 23:14:20 christos Exp $
+
+This software (or derivative software) may not be made subject to any 
+license which denies anyone permission to alter it and redistribute it 
+freely.  Derivative software must also still fall under this license.
+
+This software is not subject to any export provision of the United States
+Department of Commerce, and may be exported to any country or planet.
+
+Permission is granted to anyone to use this software for any purpose on
+any computer system, and to alter it and redistribute it freely, subject
+to the following restrictions:
+
+1. The author is not responsible for the consequences of use of this
+   software, no matter how awful, even if they arise from flaws in it.
+
+2. The origin of this software must not be misrepresented, either by
+   explicit claim or by omission.  Since few users ever read sources,
+   credits must appear in the documentation.
+
+3. Altered versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.  Since few users
+   ever read sources, credits must appear in the documentation.
+   Derivative works must also be marked as such, and credits must appear
+   in the documentation.
+
+4. This notice may not be removed or altered.
+
+

+ 33 - 0
MAINT

@@ -0,0 +1,33 @@
+$Id: MAINT,v 1.2 1993/09/23 21:47:01 christos Exp $
+
+Maintenance notes:
+
+I am continuing to maintain the file command. I welcome your help,
+but to make my life easier I'd like to request the following:
+
+- Don't change the version numbers!
+
+If your changes are extensive, I will have to work hard to 
+integrate them into my version.  If you check it into SCCS locally,
+the version numbers will likely be kept. IF you check it into RCS
+or CVS locally, please use -k to keep the version numbers, and
+please use branch deltas (1.21.1, 1.21.2, ...).  If you don't do
+this, I will likely be unable to use your changes; life's just too
+short.
+
+- Do not distribute changed versions.
+
+People trying to be helpful occasionally put up their hacked versions
+of the file command for FTP, then the "archie" server finds and publishes
+the hacked version, and people all over the world get copies of it.
+Within a day or two I am getting email from around the world
+asking me why "my" file command won't compile!!! Needless to say this
+detracts from the limited time I have available to work on the actual
+software.  Therefore I ask you again to please NOT distribute
+your changed version.
+
+
+Thank you for your assistance and cooperation.
+
+Mark Moraes		Christos Zoulas
+moraes@deshaw.com	christos@deshaw.com

+ 5 - 0
Magdir/Header

@@ -0,0 +1,5 @@
+#! file
+# Magic data for file(1) command.
+# Machine-genererated from src/cmd/file/magdir/*; edit there only!
+# Format is described in magic(files), where:
+# files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID.

+ 7 - 0
Magdir/Localstuff

@@ -0,0 +1,7 @@
+
+#------------------------------------------------------------------------------
+# Localstuff:  file(1) magic for locally observed files
+#
+# $Id: Localstuff,v 1.3 1995/01/21 21:09:00 christos Exp $
+# Add any locally observed files here.  Remember:
+# text if readable, executable if runnable binary, data if unreadable.

+ 16 - 0
Magdir/Makefile

@@ -0,0 +1,16 @@
+#
+# Makefile for /etc/magic file for Ian Darwin's file(1) command.
+# Copyright (c) 1989 Ian F. Darwin, Toronto, Canada.
+# $Id: Makefile,v 1.8 1993/01/05 13:22:31 ian Exp $
+#
+#
+SHELL		= /bin/sh
+HEADER		= Header
+LOCALSTUFF	= Localstuff
+
+ALL		=  $(HEADER) $(LOCALSTUFF) [a-z]*
+
+install:	../magic
+../magic:	$(ALL)
+		echo "# Magic file created `date` by `who am i`" > $@
+		cat $(ALL) >> $@

+ 17 - 0
Magdir/alliant

@@ -0,0 +1,17 @@
+
+#------------------------------------------------------------------------------
+# alliant:  file(1) magic for Alliant FX series a.out files
+#
+# If the FX series is the one that had a processor with a 68K-derived
+# instruction set, the "short" should probably become "beshort" and the
+# "long" should probably become "belong".
+# If it's the i860-based one, they should probably become either the
+# big-endian or little-endian versions, depending on the mode they ran
+# the 860 in....
+#
+0	short		0420		0420 Alliant virtual executable
+>2	short		&0x0020		common library
+>16	long		>0		not stripped
+0	short		0421		0421 Alliant compact executable
+>2	short		&0x0020		common library
+>16	long		>0		not stripped

+ 16 - 0
Magdir/alpha

@@ -0,0 +1,16 @@
+#------------------------------------------------------------------------------
+# alpha architecture description
+#
+
+0	leshort		0603		COFF format alpha
+>22	leshort&030000	!020000		executable
+>24	leshort		0410		pure
+>24	leshort		0413		paged
+>22	leshort&020000	!0		dynamically linked
+>16	lelong		!0		not stripped
+>16	lelong		0		stripped
+>22	leshort&030000	020000		shared library
+>24	leshort		0407		object
+>27	byte		x		- version %d
+>26	byte		x		.%d
+>28	byte		x		-%d

+ 54 - 0
Magdir/animation

@@ -0,0 +1,54 @@
+
+#------------------------------------------------------------------------------
+# animation:  file(1) magic for animation/movie formats
+#
+# animation formats
+# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
+# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
+
+# MPEG animation format
+0	string		\000\000\001\263	MPEG file
+
+# FLI animation format
+4	leshort		0xAF11			FLI file
+>6	leshort		x			- %d frames,
+>8	leshort		x			width=%d pixels,
+>10	leshort		x			height=%d pixels,
+>12	leshort		x			depth=%d,
+>16	leshort		x			ticks/frame=%d
+# FLC animation format
+4	leshort		0xAF12			FLC file
+>6	leshort		x			- %d frames
+>8	leshort		x			width=%d pixels,
+>10	leshort		x			height=%d pixels,
+>12	leshort		x			depth=%d,
+>16	leshort		x			ticks/frame=%d
+
+# DL animation format
+# XXX - collision with most `mips' magic
+#
+# I couldn't find a real magic number for these, however, this
+# -appears- to work.  Note that it might catch other files, too, so be
+# careful!
+#
+# Note that title and author appear in the two 20-byte chunks
+# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
+# 255 (hex FF)!  The DL format is really bad.
+#
+#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
+#>42	byte	x	- %d screens,
+#>43	byte	x	%d commands
+#0	byte	2	DL version 2
+#>1	byte	1	- large format (320x200,1 image/screen),
+#>1	byte	2	- medium format (160x100,4 images/screen),
+#>1	byte	>2	- unknown format,
+#>42	byte	x	%d screens,
+#>43	byte	x	%d commands
+# Based on empirical evidence, DL version 3 have several nulls following the
+# \003.  Most of them start with non-null values at hex offset 0x34 or so.
+#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3
+
+# SGI and Apple formats
+0	string		MOVI		Silicon Graphics movie file
+4	string		moov		Apple QuickTime movie file (moov)
+4	string		mdat		Apple QuickTime movie file (mdat)

+ 6 - 0
Magdir/apl

@@ -0,0 +1,6 @@
+
+#------------------------------------------------------------------------------
+# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
+#       workspaces)
+#
+0	long		0100554		APL workspace (Ken's original?)

+ 10 - 0
Magdir/apple

@@ -0,0 +1,10 @@
+
+#------------------------------------------------------------------------------
+# apple:  file(1) magic for Apple II file formats
+#
+0	string		FiLeStArTfIlEsTaRt	binscii (apple ][) text
+0	string		\x0aGL			Binary II (apple ][) data
+0	string		\x76\xff		Squeezed (apple ][) data
+0	string		SIT!			StuffIt (macintosh) text
+0	string		NuFile			NuFile archive (apple ][) data
+0	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data

+ 217 - 0
Magdir/archive

@@ -0,0 +1,217 @@
+
+#------------------------------------------------------------------------------
+# archive:  file(1) magic for archive formats (see also "msdos" for self-
+#           extracting compressed archives)
+#
+# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
+# pre-POSIX "tar" archives are handled in the C code.
+
+# POSIX tar archives
+257	string		ustar\0		POSIX tar archive
+257	string		ustar\040\040\0	GNU tar archive
+
+# cpio archives
+#
+# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
+# The idea is to indicate archives produced on machines with the same
+# byte order as the machine running "file" with "cpio archive", and
+# to indicate archives produced on machines with the opposite byte order
+# from the machine running "file" with "byte-swapped cpio archive".
+#
+# The SVR4 "cpio(4)" hints that there are additional formats, but they
+# are defined as "short"s; I think all the new formats are
+# character-header formats and thus are strings, not numbers.
+0	short		070707		cpio archive
+0	short		0143561		byte-swapped cpio archive
+0	string		070707		ASCII cpio archive (pre-SVR4 or odc)
+0	string		070701		ASCII cpio archive (SVR4 with no CRC)
+0	string		070702		ASCII cpio archive (SVR4 with CRC)
+
+# other archives
+0	long		0177555		very old archive
+0	short		0177555		very old PDP-11 archive
+0	long		0177545		old archive
+0	short		0177545		old PDP-11 archive
+0	long		0100554		apl workspace
+0	string		=<ar>		archive
+
+# MIPS archive (needs to go first)
+#
+0	string	!<arch>\n__________E	MIPS archive
+>20	string	U			with MIPS Ucode members
+>21	string	L			with MIPSEL members
+>21	string	B			with MIPSEB members
+>19	string	L			and an EL hash table
+>19	string	B			and an EB hash table
+>22	string	X			-- out of date
+
+0	string		!<arch>		archive
+>8	string		__.SYMDEF	random library
+0	string		-h-		Software Tools format archive text
+
+#
+# XXX - why are there multiple <ar> thingies?  Note that 0x213c6172 is
+# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
+#
+# 0	string		!<arch>		current ar archive
+# 0	long		0x213c6172	archive file
+#
+# and for SVR3.1 archives, we have:
+#
+# 0	string		\<ar>		System V Release 1 ar archive
+# 0	string		=<ar>		archive
+# 0	string		=<ar>		archive
+#
+# XXX - did Aegis really store shared libraries, breakpointed modules,
+# and absolute code program modules in the same format as new-style
+# "ar" archives?
+#
+0	string		!<arch>		current ar archive
+>8	string		__.SYMDEF	random library
+>8	string		debian-split	part of multipart Debian package
+>8	string		debian-binary	Debian binary package
+>0	belong		=65538		- pre SR9.5
+>0	belong		=65539		- post SR9.5
+>0	beshort		2		- object archive
+>0	beshort		3		- shared library module
+>0	beshort		4		- debug break-pointed module
+>0	beshort		5		- absolute code program module
+0	string		\<ar>		System V Release 1 ar archive
+0	string		=<ar>		archive
+#
+# XXX - from "vax", which appears to collect a bunch of byte-swapped
+# thingies, to help you recognize VAX files on big-endian machines;
+# with "leshort", "lelong", and "string", that's no longer necessary....
+#
+0	belong		0x65ff0000	VAX 3.0 archive
+0	belong		0x3c61723e	VAX 5.0 archive
+#
+0	long		0x213c6172	archive file
+0	lelong		0177555		very old VAX archive
+0	leshort		0177555		very old PDP-11 archive
+#
+# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
+# be a random library (it said 0xff65 rather than 0177545).
+#
+0	lelong		0177545		old VAX archive
+>8	string		__.SYMDEF	random library
+0	leshort		0177545		old PDP-11 archive
+>8	string		__.SYMDEF	random library
+#
+0	string		=<ar>		archive
+#
+# From "pdp":
+#
+0	lelong		0x39bed		PDP-11 old archive
+0	lelong		0x39bee		PDP-11 4.0 archive
+#
+0	string		-h-		Software Tools format archive text
+
+# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
+#
+# The first byte is the magic (0x1a), byte 2 is the compression type for
+# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
+# filename of the first file (null terminated).  Since some types collide
+# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
+# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
+0	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
+0	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
+0	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
+0	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
+0	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
+0	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched
+
+# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
+# I can't create either SPARK or ArcFS archives so I have not tested this stuff
+# [GRR:  the original entries collide with ARC, above; replaced with combined
+#  version (not tested)]
+#0	byte		0x1a		RISC OS archive
+#>1	string		archive		(ArcFS format)
+0	string		\032archive	RISC OS archive (ArcFS format)
+
+# ARJ archiver (jason@jarthur.Claremont.EDU)
+0	leshort		0xea60		ARJ archive data
+>5	byte		x		\b, v%d,
+>8	byte		&0x04		multi-volume,
+>8	byte		&0x10		slash-switched,
+>8	byte		&0x20		backup,
+>34	string		x		original name: %s,
+>7	byte		0		os: MS-DOS
+>7	byte		1		os: PRIMOS
+>7	byte		2		os: Unix
+>7	byte		3		os: Amiga
+>7	byte		4		os: Macintosh
+>7	byte		5		os: OS/2
+>7	byte		6		os: Apple ][ GS
+>7	byte		7		os: Atari ST
+>7	byte		8		os: NeXT
+>7	byte		9		os: VAX/VMS
+>3	byte		>0		%d]
+
+# HA archiver (Greg Roelofs, newt@uchicago.edu)
+# This is a really bad format. A file containing HAWAII will match this...
+#0	string		HA		HA archive data,
+#>2	leshort		=1		1 file,
+#>2	leshort		>1		%u files,
+#>4	byte&0x0f	=0		first is type CPY
+#>4	byte&0x0f	=1		first is type ASC
+#>4	byte&0x0f	=2		first is type HSC
+#>4	byte&0x0f	=0x0e		first is type DIR
+#>4	byte&0x0f	=0x0f		first is type SPECIAL
+
+# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
+0	string		HPAK		HPACK archive data
+
+# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
+0	string		\351,\001JAM\		JAM archive,
+>7	string		>\0			version %.4s
+>0x26	byte		=0x27			-
+>>0x2b	string          >\0			label %.11s,
+>>0x27	lelong		x			serial %08x,
+>>0x36	string		>\0			fstype %.8s
+
+# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
+2	string		-lh0-		LHarc 1.x archive data [lh0]
+2	string		-lh1-		LHarc 1.x archive data [lh1]
+2	string		-lz4-		LHarc 1.x archive data [lz4]
+2	string		-lz5-		LHarc 1.x archive data [lz5]
+#	[never seen any but the last; -lh4- reported in comp.compression:]
+2	string		-lzs-		LHa 2.x? archive data [lzs]
+2	string		-lh -		LHa 2.x? archive data [lh ]
+2	string		-lhd-		LHa 2.x? archive data [lhd]
+2	string		-lh2-		LHa 2.x? archive data [lh2]
+2	string		-lh3-		LHa 2.x? archive data [lh3]
+2	string		-lh4-		LHa (2.x) archive data [lh4]
+2	string		-lh5-		LHa (2.x) archive data [lh5]
+>20	byte		x		- header level %d
+
+# RAR archiver (Greg Roelofs, newt@uchicago.edu)
+0	string		Rar!		RAR archive data
+
+# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
+0	string		SQSH		squished archive data (Acorn RISCOS)
+
+# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
+# I can't figure out the self-extracting form of these buggers...
+0	string		UC2\x1a		UC2 archive data
+
+# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
+0	string		PK\003\004	Zip archive data
+>4	byte		0x09		\b, at least v0.9 to extract
+>4	byte		0x0a		\b, at least v1.0 to extract
+>4	byte		0x0b		\b, at least v1.1 to extract
+>4	byte		0x14		\b, at least v2.0 to extract
+
+# Zoo archiver
+20	lelong		0xfdc4a7dc	Zoo archive data
+>4	byte		>48		\b, v%c.
+>>6	byte		>47		\b%c
+>>>7	byte		>47		\b%c
+>32	byte		>0		\b, modify: v%d
+>>33	byte		x		\b.%d+
+>42	lelong		0xfdc4a7dc	\b,
+>>70	byte		>0		extract: v%d
+>>>71	byte		x		\b.%d+
+
+# Shell archives
+10	string		#\ This\ is\ a\ shell\ archive	shell archive text

+ 39 - 0
Magdir/att3b

@@ -0,0 +1,39 @@
+
+#------------------------------------------------------------------------------
+# att3b:  file(1) magic for AT&T 3B machines
+#
+# The `versions' should be un-commented if they work for you.
+# (Was the problem just one of endianness?)
+#
+# 3B20
+#
+0	beshort		0550		3b20 COFF executable
+>12	belong		>0		not stripped
+#>22	beshort		>0		- version %ld
+0	beshort		0551		3b20 COFF executable (TV)
+>12	belong		>0		not stripped
+#>22	beshort		>0		- version %ld
+#
+# WE32K
+#
+0	beshort		0560		WE32000 COFF
+>18	beshort		^00000020	object
+>18	beshort		&00000020	executable
+>12	belong		>0		not stripped
+>18	beshort		^00010000	N/A on 3b2/300 w/paging
+>18	beshort		&00020000	32100 required
+>18	beshort		&00040000	and MAU hardware required
+>20	beshort		0407		(impure)
+>20	beshort		0410		(pure)
+>20	beshort		0413		(demand paged)
+>20	beshort		0443		(target shared library)
+>22	beshort		>0		- version %ld
+0	beshort		0561		WE32000 COFF executable (TV)
+>12	belong		>0		not stripped
+#>18	beshort		&00020000	- 32100 required
+#>18	beshort		&00040000	and MAU hardware required
+#>22	beshort		>0		- version %ld
+#
+# core file for 3b2 
+0	string		\000\004\036\212\200	3b2 core file
+>364	string		>\0		of '%s'

+ 90 - 0
Magdir/audio

@@ -0,0 +1,90 @@
+
+#------------------------------------------------------------------------------
+# audio:  file(1) magic for sound formats (see also "iff")
+#
+# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
+# and others
+#
+
+# Sun/NeXT audio data
+0	string		.snd		Sun/NeXT audio data:
+>12	belong		1		8-bit ISDN u-law,
+>12	belong		2		8-bit linear PCM [REF-PCM],
+>12	belong		3		16-bit linear PCM,
+>12	belong		4		24-bit linear PCM,
+>12	belong		5		32-bit linear PCM,
+>12	belong		6		32-bit IEEE floating point,
+>12	belong		7		64-bit IEEE floating point,
+>12	belong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
+>20	belong		1		mono,
+>20	belong		2		stereo,
+>20	belong		4		quad,
+>16	belong		>0		%d Hz
+
+# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
+# that uses little-endian encoding and has a different magic number
+0	lelong		0x0064732E	DEC audio data:
+>12	lelong		1		8-bit ISDN u-law,
+>12	lelong		2		8-bit linear PCM [REF-PCM],
+>12	lelong		3		16-bit linear PCM,
+>12	lelong		4		24-bit linear PCM,
+>12	lelong		5		32-bit linear PCM,
+>12	lelong		6		32-bit IEEE floating point,
+>12	lelong		7		64-bit IEEE floating point,
+>12	lelong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
+>20	lelong		1		mono,
+>20	lelong		2		stereo,
+>20	lelong		4		quad,
+>16	lelong		>0		%d Hz
+
+# Creative Labs AUDIO stuff
+0	string	MThd			Standard MIDI data
+>9 	byte	>0			(format %d)
+>11	byte	>1			using %d channels
+0	string	CTMF			Creative Music (CMF) data
+0	string	SBI			SoundBlaster instrument data
+0	string	Creative\ Voice\ File	Creative Labs voice data
+# is this next line right?  it came this way...
+>19	byte	0x1A
+>23	byte	>0			- version %d
+>22	byte	>0			\b.%d
+
+# first entry is also the string "NTRK"
+0	belong		0x4e54524b	MultiTrack sound data
+>4	belong		x		- version %ld
+
+# Microsoft WAVE format (*.wav)
+# [GRR 950115:  probably all of the shorts and longs should be leshort/lelong]
+0	string		RIFF		Microsoft RIFF
+>8	string		WAVE		\b, WAVE audio data
+>>34	short		>0		\b, %d bit
+>>22	short		=1		\b, mono
+>>22	short		=2		\b, stereo
+>>22	short		>2		\b, %d channels
+>>24	long		>0		%d Hz
+# AVI == Audio Video Interleave
+>8      string          AVI\            \b, AVI data
+
+# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
+# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
+0	string		EMOD		Extended MOD sound data,
+>4	byte&0xf0	x		version %d
+>4	byte&0x0f	x		\b.%d,
+>45	byte		x		%d instruments
+>83	byte		0		(module)
+>83	byte		1		(song)
+
+# Real Audio (Magic .ra\0375)
+0	belong		0x2e7261fd	realaudio sound file
+
+# Real Audio (Magic .ra\0375)
+0	belong		0x2e7261fd	realaudio sound file
+
+# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
+# Oct 31, 1995
+0	string		MTM		MultiTracker Module sound file
+0	string		if		Composer 669 Module sound data
+0	string		FAR		Module sound data
+0	string		MAS_U		ULT(imate) Module sound data
+0x2c	string		SCRM		ScreamTracker III Module sound data
+0	string		Extended Module	Extended Module sound data

+ 19 - 0
Magdir/blit

@@ -0,0 +1,19 @@
+
+#------------------------------------------------------------------------------
+# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
+#
+# Note that this 0407 conflicts with several other a.out formats...
+#
+# XXX - should this be redone with "be" and "le", so that it works on
+# little-endian machines as well?  If so, what's the deal with
+# "VAX-order" and "VAX-order2"?
+#
+#0	long		0407		68K Blit (standalone) executable
+#0	short		0407		VAX-order2 68K Blit (standalone) executable
+0	short		03401		VAX-order 68K Blit (standalone) executable
+0	long		0406		68k Blit mpx/mux executable
+0	short		0406		VAX-order2 68k Blit mpx/mux executable
+0	short		03001		VAX-order 68k Blit mpx/mux executable
+# Need more values for WE32 DMD executables.
+# Note that 0520 is the same as COFF
+#0	short		0520		tty630 layers executable

+ 13 - 0
Magdir/c-lang

@@ -0,0 +1,13 @@
+
+#------------------------------------------------------------------------------
+# c-lang:  file(1) magic for C programs (or REXX)
+#
+
+# XPM icons (Greg Roelofs, newt@uchicago.edu)
+# if you uncomment "/*" for C/REXX below, also uncomment this entry
+#0	string		/*\ XPM\ */	X pixmap image data
+
+# this first will upset you if you're a PL/1 shop...
+# in which case rm it; ascmagic will catch real C programs
+#0	string		/*		C or REXX program text
+0	string		//		C++ program text

+ 7 - 0
Magdir/chi

@@ -0,0 +1,7 @@
+
+#------------------------------------------------------------------------------
+# chi:  file(1) magic for ChiWriter files
+#
+0       string          \\1cw\          ChiWriter file
+>5      string          >\0             version %s
+0       string          \\1cw           ChiWriter file

+ 64 - 0
Magdir/clipper

@@ -0,0 +1,64 @@
+
+#------------------------------------------------------------------------------
+# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
+#
+# XXX - what byte order does the Clipper use?
+#
+# XXX - what's the "!" stuff:
+#
+# >18	short		!074000,000000	C1 R1 
+# >18	short		!074000,004000	C2 R1
+# >18	short		!074000,010000	C3 R1
+# >18	short		!074000,074000	TEST
+#
+# I shall assume it's ANDing the field with the first value and
+# comparing it with the second, and rewrite it as:
+#
+# >18	short&074000	000000		C1 R1 
+# >18	short&074000	004000		C2 R1
+# >18	short&074000	010000		C3 R1
+# >18	short&074000	074000		TEST
+#
+# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
+# sort, nor does SunOS 4.x, so either it's something Intergraph added
+# in CLIX, or something AT&T added in SVR3.2 or later, or something
+# somebody else thought was a good idea; it's not documented in the
+# man page for this version of "magic", nor does it appear to be
+# implemented (at least not after I blew off the bogus code to turn
+# old-style "&"s into new-style "&"s, which just didn't work at all).
+#
+0	short		0575		CLIPPER COFF executable (VAX #)
+>20	short		0407		(impure)
+>20	short		0410		(5.2 compatible)
+>20	short		0411		(pure)
+>20	short		0413		(demand paged)
+>20	short		0443		(target shared library)
+>12	long		>0		not stripped
+>22	short		>0		- version %ld
+0	short		0577		CLIPPER COFF executable
+>18	short&074000	000000		C1 R1 
+>18	short&074000	004000		C2 R1
+>18	short&074000	010000		C3 R1
+>18	short&074000	074000		TEST
+>20	short		0407		(impure)
+>20	short		0410		(pure)
+>20	short		0411		(separate I&D)
+>20	short		0413		(paged)
+>20	short		0443		(target shared library)
+>12	long		>0		not stripped
+>22	short		>0		- version %ld
+>48	long&01		01		alignment trap enabled
+>52	byte		1		-Ctnc
+>52	byte		2		-Ctsw
+>52	byte		3		-Ctpw
+>52	byte		4		-Ctcb
+>53	byte		1		-Cdnc
+>53	byte		2		-Cdsw
+>53	byte		3		-Cdpw
+>53	byte		4		-Cdcb
+>54	byte		1		-Csnc
+>54	byte		2		-Cssw
+>54	byte		3		-Cspw
+>54	byte		4		-Cscb
+4	string		pipe		CLIPPER instruction trace
+4	string		prof		CLIPPER instruction profile

+ 75 - 0
Magdir/commands

@@ -0,0 +1,75 @@
+
+#------------------------------------------------------------------------------
+# commands:  file(1) magic for various shells and interpreters
+#
+0	string		:\ shell archive or commands for antique kernel text
+0	string		#!/bin/sh		Bourne shell script text
+0	string		#!\ /bin/sh		Bourne shell script text
+0	string		#!/bin/csh		C shell script text
+0	string		#!\ /bin/csh		C shell script text
+# korn shell magic, sent by George Wu, gwu@clyde.att.com
+0	string		#!/bin/ksh		Korn shell script text
+0	string		#!\ /bin/ksh		Korn shell script text
+0	string	 	#!/bin/tcsh		Tenex C shell script text
+0	string	 	#!\ /bin/tcsh		Tenex C shell script text
+0	string		#!/usr/local/tcsh	Tenex C shell script text
+0	string	 	#!\ /usr/local/tcsh	Tenex C shell script text
+0	string		#!/usr/local/bin/tcsh	Tenex C shell script text
+0	string		#!\ /usr/local/bin/tcsh	Tenex C shell script text
+#
+# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
+0	string		#!/usr/local/bin/zsh	Paul Falstad's zsh
+0	string		#!\ /usr/local/bin/zsh	Paul Falstad's zsh
+0	string		#!/usr/local/bin/ash	Neil Brown's ash
+0	string		#!\ /usr/local/bin/ash	Neil Brown's ash
+0	string		#!/usr/local/bin/ae	Neil Brown's ae
+0	string		#!\ /usr/local/bin/ae	Neil Brown's ae
+0	string		#!/bin/nawk		new awk script text
+0	string		#!\ /bin/nawk		new awk script text
+0	string		#!/usr/bin/nawk		new awk script text
+0	string		#!\ /usr/bin/nawk	new awk script text
+0	string		#!/usr/local/bin/nawk	new awk script text
+0	string		#!\ /usr/local/bin/nawk	new awk script text
+0	string		#!/bin/gawk		GNU awk script text
+0	string		#!\ /bin/gawk		GNU awk script text
+0	string		#!/usr/bin/gawk		GNU awk script text
+0	string		#!\ /usr/bin/gawk	GNU awk script text
+0	string		#!/usr/local/bin/gawk	GNU awk script text
+0	string		#!\ /usr/local/bin/gawk	GNU awk script text
+#
+0	string		#!/bin/awk		awk commands text
+0	string		#!\ /bin/awk		awk commands text
+0	string		#!/usr/bin/awk		awk commands text
+0	string		#!\ /usr/bin/awk	awk commands text
+0	string		BEGIN			awk commands text
+
+# For Larry Wall's perl language.  The ``eval'' line recognizes an
+# outrageously clever hack for USG systems.
+#				Keith Waclena <keith@cerberus.uchicago.edu>
+0	string		#!/bin/perl			perl commands text
+0	string		#!\ /bin/perl			perl commands text
+0	string		eval\ "exec\ /bin/perl		perl commands text
+0	string		#!/usr/bin/perl			perl commands text
+0	string		#!\ /usr/bin/perl		perl commands text
+0	string		eval\ "exec\ /usr/bin/perl	perl commands text
+0	string		#!/usr/local/bin/perl		perl commands text
+0	string		#!\ /usr/local/bin/perl		perl commands text
+0	string		eval\ "exec\ /usr/local/bin/perl	perl commands text
+
+# AT&T Bell Labs' Plan 9 shell
+0	string		#!/bin/rc	Plan 9 rc shell script text
+0	string		#!\ /bin/rc	Plan 9 rc shell script text
+
+# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
+0	string		#!/bin/bash	Bourne-Again shell script text
+0	string		#!\ /bin/bash	Bourne-Again shell script text
+0	string		#!/usr/local/bin/bash	Bourne-Again shell script text
+0	string		#!\ /usr/local/bin/bash	Bourne-Again shell script text
+
+# generic shell magic
+0	string		#!\ /			a
+>3	string		>\0			%s script text
+0	string		#!/			a
+>2	string		>\0			%s script text
+0	string		#!\ 			commands text
+>3	string		>\0			for %s

+ 86 - 0
Magdir/compress

@@ -0,0 +1,86 @@
+
+#------------------------------------------------------------------------------
+# compress:  file(1) magic for pure-compression formats (no archives)
+#
+# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
+#
+# Formats for various forms of compressed data
+# Formats for "compress" proper have been moved into "compress.c",
+# because it tries to uncompress it to figure out what's inside.
+
+# standard unix compress
+0	string		\037\235	compress'd data
+>2	byte&0x80	>0		block compressed
+>2	byte&0x1f	x		%d bits
+
+# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
+0       string          \037\213        gzip compressed data
+>2      byte            <8              \b, reserved method,
+>2      byte            8               \b, deflated,
+>3	byte		&0x01		ASCII,
+>3	byte		&0x02		continuation,
+>3	byte		&0x04		extra field,
+>3	byte		&0x08		original filename,
+>3	byte		&0x10		comment,
+>3	byte		&0x20		encrypted,
+>4	ledate		x		last modified: %s,
+>8	byte		2		max compression,
+>8	byte		4		max speed,
+>9	byte		=0x00		os: MS-DOS
+>9	byte		=0x01		os: Amiga
+>9	byte		=0x02		os: VMS
+>9	byte		=0x03		os: Unix
+>9	byte		=0x05		os: Atari
+>9	byte		=0x06		os: OS/2
+>9	byte		=0x07		os: MacOS
+>9	byte		=0x0A		os: Tops/20
+>9	byte		=0x0B		os: Win/32
+
+# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
+0	string		\037\036	packed data
+>2	belong		>1		\b, %d characters originally
+>2	belong		=1		\b, %d character originally
+#
+# This magic number is byte-order-independent.  XXX - Does that mean this
+# is big-endian, little-endian, either, or that you can't tell?
+# this short is valid for SunOS
+0	short		017437		old packed data
+
+# XXX - why *two* entries for "compacted data", one of which is
+# byte-order independent, and one of which is byte-order dependent?
+#
+0	short		0x1fff		compacted data
+# This string is valid for SunOS (BE) and a matching "short" is listed
+# in the Ultrix (LE) magic file.
+0	string		\377\037	compacted data
+0	short		0145405		huf output
+
+# Squeeze and Crunch...
+# These numbers were gleaned from the Unix versions of the programs to
+# handle these formats.  Note that I can only uncrunch, not crunch, and
+# I didn't have a crunched file handy, so the crunch number is untested.
+#				Keith Waclena <keith@cerberus.uchicago.edu>
+0	leshort		0x76FF		squeezed data (CP/M, DOS)
+0	leshort		0x76FE		crunched data (CP/M, DOS)
+
+# Freeze
+0	string		\037\237	frozen file 2.1
+0	string		\037\236	frozen file 1.0 (or gzip 0.5)
+
+# SCO compress -H (LZH)
+0	string		\037\240	SCO compress -H (LZH) data
+
+# European GSM 06.10 is a provisional standard for full-rate speech
+# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
+# excitation/long term prediction) coding at 13 kbit/s.
+#
+# There's only a magic nibble (4 bits); that nibble repeats every 33
+# bytes.  This isn't suited for use, but maybe we can use it someday.
+#
+# This will cause very short GSM files to be declared as data and
+# mismatches to be declared as data too!
+#0	byte&0xF0	0xd0	data
+#>33	byte&0xF0	0xd0
+#>66	byte&0xF0	0xd0
+#>99	byte&0xF0	0xd0
+#>132	byte&0xF0	0xd0	GSM 06.10 compressed audio

+ 7 - 0
Magdir/convex

@@ -0,0 +1,7 @@
+
+#------------------------------------------------------------------------------
+# convex:  file(1) magic for Convex boxes
+#
+# Convexes are big-endian.
+#
+0	long		0513		Convex executable

+ 36 - 0
Magdir/database

@@ -0,0 +1,36 @@
+
+#------------------------------------------------------------------------------
+# database:  file(1) magic for various databases
+#
+# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
+#
+#
+# GDBM magic numbers
+#  Will be maintained as part of the GDBM distribution in the future.
+#  <downsj@teeny.org>
+0	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian
+0	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian
+0	string	GDBM		GNU dbm 2.x database
+#
+0	belong	0x061561	Berkeley DB Hash file
+>4	belong	>0		(Version %d,
+>8	belong	1234		Little Endian,
+>8	belong	4321		Big Endian,
+>12	belong	x		Bucket Size %d,
+>16	belong	x		Directory Size %d,
+>20	belong	x		Segment Size %d,
+>24	belong	x		Segment Shift %d,
+>28	belong	x		Overflow Point %d,
+>32	belong	x		Last Freed %d,
+>36	belong	x		Max Bucket %d,
+>40	belong	x		High Mask 0x%x,
+>44	belong	x		Low Mask 0x%x,
+>48	belong	x		Fill Factor %d,
+>52	belong	x		Number of Keys %d)
+#
+0	belong	0x053162	Berkeley DB Btree file
+>4	belong	>0		(Version %d,
+>8	belong	x		Page Size %d,
+>12	belong	x		Free Page %d,
+>16	belong	x		Number of Records %d,
+>20	belong	x		Flags 0x%x)

+ 11 - 0
Magdir/diamond

@@ -0,0 +1,11 @@
+
+#------------------------------------------------------------------------------
+# diamond:  file(1) magic for Diamond system
+#
+# ... diamond is a multi-media mail and electronic conferencing system....
+#
+# XXX - I think it was either renamed Slate, or replaced by Slate....
+#
+#	The full deal is too long...
+#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
+0	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document

+ 8 - 0
Magdir/diff

@@ -0,0 +1,8 @@
+
+#------------------------------------------------------------------------------
+# diff:  file(1) magic for diff(1) output
+#
+0	string		diff\ 	'diff' output text
+0	string		***\ 		'diff' output text
+0	string		Only\ in\ 	'diff' output text
+0	string		Common\ subdirectories:\ 	'diff' output text

+ 81 - 0
Magdir/dump

@@ -0,0 +1,81 @@
+
+#------------------------------------------------------------------------------
+# dump:  file(1) magic for dump file format--for new and old dump filesystems
+#
+# We specify both byte orders in order to recognize byte-swapped dumps.
+#
+24	belong	60012		new-fs dump file (big endian),
+>4	bedate	x		Previous dump %s,
+>8	bedate	x		This dump %s,
+>12	belong	>0		Volume %ld,
+>692	belong	0		Level zero, type:
+>692	belong	>0		Level %d, type:
+>0	belong	1		tape header,
+>0	belong	2		beginning of file record,
+>0	belong	3		map of inodes on tape,
+>0	belong	4		continuation of file record,
+>0	belong	5		end of volume,
+>0	belong	6		map of inodes deleted,
+>0	belong	7		end of medium (for floppy),
+>676	string	>\0		Label %s,
+>696	string	>\0		Filesystem %s,
+>760	string	>\0		Device %s,
+>824	string	>\0		Host %s,
+>888	belong	>0		Flags %x
+
+24	belong	60011		old-fs dump file (big endian),
+#>4	bedate	x		Previous dump %s,
+#>8	bedate	x		This dump %s,
+>12	belong	>0		Volume %ld,
+>692	belong	0		Level zero, type:
+>692	belong	>0		Level %d, type:
+>0	belong	1		tape header,
+>0	belong	2		beginning of file record,
+>0	belong	3		map of inodes on tape,
+>0	belong	4		continuation of file record,
+>0	belong	5		end of volume,
+>0	belong	6		map of inodes deleted,
+>0	belong	7		end of medium (for floppy),
+>676	string	>\0		Label %s,
+>696	string	>\0		Filesystem %s,
+>760	string	>\0		Device %s,
+>824	string	>\0		Host %s,
+>888	belong	>0		Flags %x
+
+24	lelong	60012		new-fs dump file (little endian),
+>4	ledate	x		Previous dump %s,
+>8	ledate	x		This dump %s,
+>12	lelong	>0		Volume %ld,
+>692	lelong	0		Level zero, type:
+>692	lelong	>0		Level %d, type:
+>0	lelong	1		tape header,
+>0	lelong	2		beginning of file record,
+>0	lelong	3		map of inodes on tape,
+>0	lelong	4		continuation of file record,
+>0	lelong	5		end of volume,
+>0	lelong	6		map of inodes deleted,
+>0	lelong	7		end of medium (for floppy),
+>676	string	>\0		Label %s,
+>696	string	>\0		Filesystem %s,
+>760	string	>\0		Device %s,
+>824	string	>\0		Host %s,
+>888	lelong	>0		Flags %x
+
+24	lelong	60011		old-fs dump file (little endian),
+#>4	ledate	x		Previous dump %s,
+#>8	ledate	x		This dump %s,
+>12	lelong	>0		Volume %ld,
+>692	lelong	0		Level zero, type:
+>692	lelong	>0		Level %d, type:
+>0	lelong	1		tape header,
+>0	lelong	2		beginning of file record,
+>0	lelong	3		map of inodes on tape,
+>0	lelong	4		continuation of file record,
+>0	lelong	5		end of volume,
+>0	lelong	6		map of inodes deleted,
+>0	lelong	7		end of medium (for floppy),
+>676	string	>\0		Label %s,
+>696	string	>\0		Filesystem %s,
+>760	string	>\0		Device %s,
+>824	string	>\0		Host %s,
+>888	lelong	>0		Flags %x

+ 61 - 0
Magdir/elf

@@ -0,0 +1,61 @@
+
+#------------------------------------------------------------------------------
+# elf:  file(1) magic for ELF executables
+#
+# We have to check the byte order flag to see what byte order all the
+# other stuff in the header is in.
+#
+# Byte order is probably big-endian for MIPS RS3000 and Amdahl.
+# MIPS RS3000 may also be for MIPS RS2000.
+#
+# updated by Daniel Quinlan (quinlan@yggdrasil.com)
+0	string		\177ELF		ELF
+>4	byte		0		invalid class
+>4	byte		1		32-bit
+>4	byte		2		64-bit
+>5	byte		0		invalid byte order
+>5	byte		1		LSB
+>>16	leshort		0		no file type,
+>>16	leshort		1		relocatable,
+>>16	leshort		2		executable,
+>>16	leshort		3		shared object,
+# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
+>>16	leshort		4		core file
+>>>576  string          >\0             of '%s'
+>>>400  lelong          >0              (signal %d),
+>>16	leshort		&0xff00		processor-specific,
+>>18	leshort		0		no machine,
+>>18	leshort		1		AT&T WE32100 - invalid byte order,
+>>18	leshort		2		SPARC - invalid byte order,
+>>18	leshort		3		Intel 386,
+>>18	leshort		4		Motorola 68000 - invalid byte order,
+>>18	leshort		5		Motorola 88000 - invalid byte order,
+>>18	leshort		6		Intel 486,
+>>18	leshort		7		Intel 860,
+>>18	leshort		8		MIPS RS3000,
+>>18	leshort		9		Amdahl,
+>>20	lelong		0		invalid version
+>>20	lelong		1		version 1
+>>36	lelong		1		MathCoPro/FPU/MAU Required
+>5	byte		2		MSB
+>>16	beshort		0		no file type,
+>>16	beshort		1		relocatable,
+>>16	beshort		2		executable,
+>>16	beshort		3		shared object,
+>>16	beshort		4		core file,
+>>>576	string		>\0		of '%s'
+>>>400	lelong		>0		(signal %d),
+>>16	beshort		&0xff00		processor-specific,
+>>18	beshort		0		no machine,
+>>18	beshort		1		AT&T WE32100,
+>>18	beshort		2		SPARC,
+>>18	beshort		3		Intel 386 - invalid byte order,
+>>18	beshort		4		Motorola 68000,
+>>18	beshort		5		Motorola 88000,
+>>18	beshort		6		Intel 486 - invalid byte order,
+>>18	beshort		7		Intel 860,
+>>18	beshort		8		MIPS RS3000,
+>>18	leshort		9		Amdahl,
+>>20	belong		0		invalid version
+>>20	belong		1		version 1
+>>36	belong		1		MathCoPro/FPU/MAU Required

+ 21 - 0
Magdir/encore

@@ -0,0 +1,21 @@
+
+#------------------------------------------------------------------------------
+# encore:  file(1) magic for Encore machines
+#
+# XXX - needs to have the byte order specified (NS32K was little-endian,
+# dunno whether they run the 88K in little-endian mode or not).
+#
+0	short		0x154		Encore
+>20	short		0x107		executable
+>20	short		0x108		pure executable
+>20	short		0x10b		demand-paged executable
+>20	short		0x10f		unsupported executable
+>12	long		>0		not stripped
+>22	short		>0		- version %ld
+>22	short		0		-
+#>4	date		x		stamp %s
+0	short		0x155		Encore unsupported executable
+>12	long		>0		not stripped
+>22	short		>0		- version %ld
+>22	short		0		-
+#>4	date		x		stamp %s

+ 6 - 0
Magdir/filesystems

@@ -0,0 +1,6 @@
+
+#------------------------------------------------------------------------------
+# filesystems:  file(1) magic for different filesystems
+#
+0x438	leshort	0xEF53			Linux/i386 ext2 filesystem
+0	string	\366\366\366\366	PC formatted floppy with no filesystem

+ 38 - 0
Magdir/fonts

@@ -0,0 +1,38 @@
+
+#------------------------------------------------------------------------------
+# fonts:  file(1) magic for font data
+#
+0	string		FONT		ASCII vfont text
+0	short		0436		Berkeley vfont data
+0	short		017001		byte-swapped Berkeley vfont data
+
+# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
+0	string		%!PS-AdobeFont-1.0	PostScript Type 1 font text
+>20	string		>\0			(%s)
+6	string		%!PS-AdobeFont-1.0	PostScript Type 1 font program data
+
+# X11 font files in SNF (Server Natural Format) format
+0	belong		00000004		X11 SNF font data, MSB first
+0	lelong		00000004		X11 SNF font data, LSB first
+
+# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
+0	string		STARTFONT\040		X11 BDF font text
+
+# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
+# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
+0	string		\001fcp			X11 Portable Compiled Font data
+>12	byte		0x02			\b, LSB first
+>12	byte		0x0a			\b, MSB first
+0	string		D1.0\015		X11 Speedo font data
+
+# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
+# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
+0	belong		0x14025919	libGrx font data,
+>8	leshort		x		%dx
+>10	leshort		x		\b%d
+>40	string		x		%s
+# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
+0	belong		0xff464f4e	DOS code page font data collection
+7	belong		0x00454741	DOS code page font data
+7	belong		0x00564944	DOS code page font data (from Linux?)
+4098	string		DOSFONT		DOSFONT2 encrypted font data

+ 36 - 0
Magdir/frame

@@ -0,0 +1,36 @@
+
+#------------------------------------------------------------------------------
+# frame:  file(1) magic for FrameMaker files
+#
+# This stuff came on a FrameMaker demo tape, most of which is
+# copyright, but this file is "published" as witness the following:
+#
+0	string		\<MakerFile	FrameMaker document
+>11	string		4.0		 (4.0
+>11	string		3.0		 (3.0
+>11	string		2.0		 (2.0
+>11	string		1.0		 (1.0
+>14	byte		x		  %c)
+0	string		\<MIFFile	FrameMaker MIF (ASCII) file
+>9	string		4.0		 (4.0)
+>9	string		3.0		 (3.0)
+>9	string		2.0		 (2.0)
+>9	string		1.0		 (1.x)
+0	string		\<MakerDictionary	FrameMaker Dictionary text
+>17	string		3.0		 (3.0)
+>17	string		2.0		 (2.0)
+>17	string		1.0		 (1.x)
+0	string		\<MakerScreenFont	FrameMaker Font file
+>17	string		1.01		 (%s)
+0	string		\<MML		FrameMaker MML file
+0	string		\<BookFile	FrameMaker Book file
+>10	string		3.0		 (3.0
+>10	string		2.0		 (2.0
+>10	string		1.0		 (1.0
+>13	byte		x		  %c)
+# XXX - this book entry should be verified, if you find one, uncomment this
+#0	string		\<Book\ 	FrameMaker Book (ASCII) file
+#>6	string		3.0		 (3.0)
+#>6	string		2.0		 (2.0)
+#>6	string		1.0		 (1.0)
+0	string		\<Maker	Intermediate Print File	FrameMaker IPL file

+ 97 - 0
Magdir/freebsd

@@ -0,0 +1,97 @@
+# the following are for BSD/i386 (FreeBSD, NetBSD, etc.)
+
+0	lelong&0377777777	041400407	BSD/i386
+>20	lelong			<4096
+>>3	byte&0xC0		&0x80		shared library
+>>3	byte&0xC0		0x40		PIC object
+>>3	byte&0xC0		0x00		object
+>20	lelong			>4095
+>>3	byte&0x80		0x80		dynamically linked executable
+>>3	byte&0x80		0x00		executable
+>16	lelong			>0		not stripped
+
+0	lelong&0377777777	041400410	BSD/i386 pure
+>20	lelong			<4096
+>>3	byte&0xC0		&0x80		shared library
+>>3	byte&0xC0		0x40		PIC object
+>>3	byte&0xC0		0x00		object
+>20	lelong			>4095
+>>3	byte&0x80		0x80		dynamically linked executable
+>>3	byte&0x80		0x00		executable
+>16	lelong			>0		not stripped
+
+0	lelong&0377777777	041400413	BSD/i386 demand paged
+>20	lelong			<4096
+>>3	byte&0xC0		&0x80		shared library
+>>3	byte&0xC0		0x40		PIC object
+>>3	byte&0xC0		0x00		object
+>20	lelong			>4095
+>>3	byte&0x80		0x80		dynamically linked executable
+>>3	byte&0x80		0x00		executable
+>16	lelong			>0		not stripped
+
+0	lelong&0377777777	041400314	BSD/i386 compact demand paged
+>20	lelong			<4096
+>>3	byte&0xC0		&0x80		shared library
+>>3	byte&0xC0		0x40		PIC object
+>>3	byte&0xC0		0x00		object
+>20	lelong			>4095
+>>3	byte&0x80		0x80		dynamically linked executable
+>>3	byte&0x80		0x00		executable
+>16	lelong			>0		not stripped
+
+0	belong&0377777777	041400407	BSD/i386
+>20	belong			<4096
+>>0	byte&0xC0		&0x80		shared library
+>>0	byte&0xC0		0x40		PIC object
+>>0	byte&0xC0		0x00		object
+>20	belong			>4095
+>>0	byte&0x80		0x80		dynamically linked executable
+>>0	byte&0x80		0x00		executable
+>16	belong			>0		not stripped
+
+0	belong&0377777777	041400410	BSD/i386 pure
+>20	belong			<4096
+>>0	byte&0xC0		&0x80		shared library
+>>0	byte&0xC0		0x40		PIC object
+>>0	byte&0xC0		0x00		object
+>20	belong			>4095
+>>0	byte&0x80		0x80		dynamically linked executable
+>>0	byte&0x80		0x00		executable
+>16	belong			>0		not stripped
+
+0	belong&0377777777	041400413	BSD/i386 demand paged
+>20	belong			<4096
+>>0	byte&0xC0		&0x80		shared library
+>>0	byte&0xC0		0x40		PIC object
+>>0	byte&0xC0		0x00		object
+>20	belong			>4095
+>>0	byte&0x80		0x80		dynamically linked executable
+>>0	byte&0x80		0x00		executable
+>16	belong			>0		not stripped
+
+0	belong&0377777777	041400314	BSD/i386 compact demand paged
+>20	belong			<4096
+>>0	byte&0xC0		&0x80		shared library
+>>0	byte&0xC0		0x40		PIC object
+>>0	byte&0xC0		0x00		object
+>20	belong			>4095
+>>0	byte&0x80		0x80		dynamically linked executable
+>>0	byte&0x80		0x00		executable
+>16	belong			>0		not stripped
+
+# XXX gross hack to identify core files
+# cores start with a struct tss; we take advantage of the following:
+# byte 7:     highest byte of the kernel stack pointer, always 0xfe
+#      8/9:   kernel (ring 0) ss value, always 0x0010
+#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
+#      28:    low order byte of the current PTD entry, always 0 since the
+#             PTD is page-aligned
+#
+7	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	BSD i386 a.out core file
+>1031	string	>\0	from "%s"
+
+# /var/run/ld.so.hints
+# What are you laughing about?
+0	lelong			011421044151	BSD ld.so hints file
+>4	lelong			>0		(version %d)

+ 212 - 0
Magdir/hp

@@ -0,0 +1,212 @@
+
+#------------------------------------------------------------------------------
+# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
+#
+# XXX - somebody should figure out whether any byte order needs to be
+# applied to the "TML" stuff; I'm assuming the Apollo stuff is
+# big-endian as it was mostly 68K-based.
+#
+# HP-PA is big-endian, so it (and "800", which is *also* HP-PA-based; I
+# assume "HPPA-RISC1.1" really means "HP-PA Version 1.1", which first
+# showed up in the 700 series, although later 800 series machines are,
+# I think, based on the PA7100 which implements HP-PA 1.1) are flagged
+# as big-endian.
+#
+# I think the 500 series was the old stack-based machines, running a
+# UNIX environment atop the "SUN kernel"; dunno whether it was
+# big-endian or little-endian.
+#
+# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
+# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
+# HP magic is useful for reference, but using "long" magic is a better
+# practice in order to avoid collisions.
+#
+# 0	beshort		200		hp200 (68010) BSD binary
+# 0	beshort		300		hp300 (68020+68881) BSD binary
+# 0	beshort		0x20c		hp200/300 HP-UX binary
+# 0	beshort		0x20b		hp800 HP-UX binary
+
+#
+# The "misc" stuff needs a byte order; the archives look suspiciously
+# like the old 177545 archives (0xff65 = 0177545).
+#
+#### Old Apollo stuff
+0	beshort		0627		Apollo m68k COFF executable
+>18	beshort		^040000		not stripped
+>22	beshort		>0		- version %ld
+0	beshort		0624		apollo a88k COFF executable
+>18	beshort		^040000		not stripped
+>22	beshort		>0		- version %ld
+0       long            01203604016     TML 0123 byte-order format
+0       long            01702407010     TML 1032 byte-order format
+0       long            01003405017     TML 2301 byte-order format
+0       long            01602007412     TML 3210 byte-order format
+#### HPPA
+0	belong 		0x02100106	HPPA-RISC1.1 relocatable object
+0	belong 		0x02100107	HPPA-RISC1.1 executable
+>(144)	belong		0x054ef630	dynamically linked
+>96	belong		>0		- not stripped
+
+0	belong 		0x02100108	HPPA-RISC1.1 shared executable
+>(144)	belong		0x054ef630	dynamically linked
+>96	belong		>0		- not stripped
+
+0	belong 		0x0210010b	HPPA-RISC1.1 demand-load executable
+>(144)	belong		0x054ef630	dynamically linked
+>96	belong		>0		- not stripped
+
+0	belong 		0x0210010e	HPPA-RISC1.1 shared library
+>96	belong		>0		- not stripped
+
+0	belong 		0x0210010d	HPPA-RISC1.1 dynamic load library
+>96	belong		>0		- not stripped
+
+#### 800
+0	belong 		0x020b0106	HP s800 relocatable object
+
+0	belong 		0x020b0107	HP s800 executable
+>(144)	belong		0x054ef630	dynamically linked
+>96	belong		>0		- not stripped
+
+0	belong 		0x020b0108	HP s800 shared executable
+>(144)	belong		0x054ef630	dynamically linked
+>96	belong		>0		- not stripped
+
+0	belong 		0x020b010b	HP s800 demand-load executable
+>(144)	belong		0x054ef630	dynamically linked
+>96	belong		>0		- not stripped
+
+0	belong 		0x020b010e	HP s800 shared library
+>96	belong		>0		- not stripped
+
+0	belong 		0x020b010d	HP s800 dynamic load library
+>96	belong		>0		- not stripped
+
+0	belong		0x213c6172	archive file
+>68	belong 		0x020b0619	- HP s800 relocatable library
+
+#### 500
+0	long		0x02080106	HP s500 relocatable executable
+>16	long		>0		- version %ld
+
+0	long		0x02080107	HP s500 executable
+>16	long		>0		- version %ld
+
+0	long		0x02080108	HP s500 pure executable
+>16	long		>0		- version %ld
+
+#### 200
+0	belong 		0x020c0108	HP s200 pure executable
+>4	beshort		>0		- version %ld
+>8	belong		&0x80000000	save fp regs
+>8	belong		&0x40000000	dynamically linked
+>8	belong		&0x20000000	debuggable
+>36	belong		>0		not stripped
+
+0	belong		0x020c0107	HP s200 executable
+>4	beshort		>0		- version %ld
+>8	belong		&0x80000000	save fp regs
+>8	belong		&0x40000000	dynamically linked
+>8	belong		&0x20000000	debuggable
+>36	belong		>0		not stripped
+
+0	belong		0x020c010b	HP s200 demand-load executable
+>4	beshort		>0		- version %ld
+>8	belong		&0x80000000	save fp regs
+>8	belong		&0x40000000	dynamically linked
+>8	belong		&0x20000000	debuggable
+>36	belong		>0		not stripped
+
+0	belong		0x020c0106	HP s200 relocatable executable
+>4	beshort		>0		- version %ld
+>6	beshort		>0		- highwater %d
+>8	belong		&0x80000000	save fp regs
+>8	belong		&0x20000000	debuggable
+>8	belong		&0x10000000	PIC
+
+0	belong 		0x020a0108	HP s200 (2.x release) pure executable
+>4	beshort		>0		- version %ld
+>36	belong		>0		not stripped
+
+0	belong		0x020a0107	HP s200 (2.x release) executable
+>4	beshort		>0		- version %ld
+>36	belong		>0		not stripped
+
+0	belong		0x020c010e	HP s200 shared library
+>4	beshort		>0		- version %ld
+>6	beshort		>0		- highwater %d
+>36	belong		>0		not stripped
+
+0	belong		0x020c010d	HP s200 dynamic load library
+>4	beshort		>0		- version %ld
+>6	beshort		>0		- highwater %d
+>36	belong		>0		not stripped
+
+#### MISC
+0	long		0x0000ff65	HP old archive
+0	long		0x020aff65	HP s200 old archive
+0	long		0x020cff65	HP s200 old archive
+0	long		0x0208ff65	HP s500 old archive
+
+0	long		0x015821a6	HP core file
+
+0	long		0x4da7eee8	HP-WINDOWS font
+>8	byte		>0		- version %ld
+0	string		Bitmapfile	HP Bitmapfile
+
+0	string		IMGfile	CIS 	compimg HP Bitmapfile
+# XXX - see "lif"
+0	short		0x8000		lif file
+0	long		0x020c010c	compiled Lisp
+
+0	string		msgcat01	HP NLS message catalog,
+>8	long		>0		%d messages
+
+# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
+0	string		HPHP48-		HP48 binary
+>7	byte		>0		- Rev %c
+>8	short		0x1129		(ADR)
+>8	short		0x3329		(REAL)
+>8	short		0x5529		(LREAL)
+>8	short		0x7729		(COMPLX)
+>8	short		0x9d29		(LCOMPLX)
+>8	short		0xbf29		(CHAR)
+>8	short		0xe829		(ARRAY)
+>8	short		0x0a2a		(LNKARRAY)
+>8	short		0x2c2a		(STRING)
+>8	short		0x4e2a		(HXS)
+>8	short		0x742a		(LIST)
+>8	short		0x962a		(DIR)
+>8	short		0xb82a		(ALG)
+>8	short		0xda2a		(UNIT)
+>8	short		0xfc2a		(TAGGED)
+>8	short		0x1e2b		(GROB)
+>8	short		0x402b		(LIB)
+>8	short		0x622b		(BACKUP)
+>8	short		0x882b		(LIBDATA)
+>8	short		0x9d2d		(PROG)
+>8	short		0xcc2d		(CODE)
+>8	short		0x482e		(GNAME)
+>8	short		0x6d2e		(LNAME)
+>8	short		0x922e		(XLIB)
+0	string		%%HP:		HP48 text
+>6	string		T(0)		- T(0)
+>6	string		T(1)		- T(1)
+>6	string		T(2)		- T(2)
+>6	string		T(3)		- T(3)
+>10	string		A(D)		A(D)
+>10	string		A(R)		A(R)
+>10	string		A(G)		A(G)
+>14	string		F(.)		F(.);
+>14	string		F(,)		F(,);
+
+# hpBSD magic numbers
+0	beshort		200		hp200 (68010) BSD
+>2	beshort		0407		impure binary
+>2	beshort		0410		read-only binary
+>2	beshort		0413		demand paged binary
+0	beshort		300		hp300 (68020+68881) BSD
+>2	beshort		0407		impure binary
+>2	beshort		0410		read-only binary
+>2	beshort		0413		demand paged binary
+

+ 19 - 0
Magdir/ibm370

@@ -0,0 +1,19 @@
+
+#------------------------------------------------------------------------------
+# ibm370:  file(1) magic for IBM 370 and compatibles.
+#
+# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
+# What the heck *is* "USS/370"?
+#
+0       beshort		0531		SVR2 executable (Amdahl-UTS)
+>12	belong		>0		not stripped
+>24     belong		>0		- version %ld
+0	beshort		0534		SVR2 pure executable (Amdahl-UTS)
+>12	belong		>0		not stripped
+>24	belong		>0		- version %ld
+0	beshort		0530		SVR2 pure executable (USS/370)
+>12	belong		>0		not stripped
+>24	belong		>0		- version %ld
+0	beshort		0535		SVR2 executable (USS/370)
+>12	belong		>0		not stripped
+>24	belong		>0		- version %ld

+ 16 - 0
Magdir/ibm6000

@@ -0,0 +1,16 @@
+
+#------------------------------------------------------------------------------
+# ibm6000:  file(1) magic for RS/6000 and the RT PC.
+#
+0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
+>12	belong		>0		not stripped
+# Breaks sun4 statically linked execs.
+#0      beshort		0x0103		executable (RT Version 2) or obj module
+#>2	byte		0x50		pure
+#>28	belong		>0		not stripped
+#>6	beshort		>0		- version %ld
+0	beshort		0x0104		shared library
+0	beshort		0x0105		ctab data
+0	beshort		0xfe04		structured file
+0	string		0xabcdef	message catalog
+0	string		\<aiaff>	archive

+ 28 - 0
Magdir/iff

@@ -0,0 +1,28 @@
+
+#------------------------------------------------------------------------------
+# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
+#
+# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
+# Arts for file interchange.  It has also been used by Apple, SGI, and
+# especially Commodore-Amiga.
+#
+# IFF files begin with an 8 byte FORM header, followed by a 4 character
+# FORM type, which is followed by the first chunk in the FORM.
+
+0	string		FORM		IFF data
+#>4	belong		x		\b, FORM is %d bytes long
+# audio formats
+>8	string		AIFF		\b, AIFF audio
+>8	string		AIFC		\b, AIFF-C compressed audio
+>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
+>8	string		SAMP		\b, SAMP sampled audio
+# image formats
+>8	string		ILBMBMHD	\b, ILBM interleaved image
+>>20	beshort		x		\b, %d x
+>>22	beshort		x		%d
+>8	string		RGBN		\b, RGBN 12-bit RGB image
+>8	string		RGB8		\b, RGB8 24-bit RGB image
+>8	string		DR2D		\b, DR2D 2-D object
+>8	string		TDDD		\b, TDDD 3-D rendering
+# other formats
+>8	string		FTXT		\b, FTXT formatted text

+ 226 - 0
Magdir/images

@@ -0,0 +1,226 @@
+
+#------------------------------------------------------------------------------
+# images:  file(1) magic for image formats (see also "iff")
+#
+# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
+# additions by janl@ifi.uio.no as well as others. Jan also suggested
+# merging several one- and two-line files into here.
+#
+# little magic: PCX (first byte is 0x0a)
+# no magic: Targa
+
+# PBMPLUS images
+# The next byte following the magic is always whitespace.
+0	string		P1		PBM image text
+0	string		P2		PGM image text
+0	string		P3		PPM image text
+0	string		P4		PBM "rawbits" image data
+0	string		P5		PGM "rawbits" image data
+0	string		P6		PPM "rawbits" image data
+
+# NIFF (Navy Interchange File Format, a modification of TIFF) images
+0	string		IIN1		NIFF image data
+
+# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
+# The second word of TIFF files is the TIFF version number, 42, which has
+# never changed.  The TIFF specification recommends testing for it.
+0	string		MM\x00\x2a	TIFF image data, big-endian
+0	string		II\x2a\x00	TIFF image data, little-endian
+
+# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
+# (Greg Roelofs, newt@uchicago.edu)
+# (Albert Cahalan, acahalan@cs.uml.edu)
+# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
+#
+0	string		\x89PNG		PNG image data,
+>4	belong		!0x0d0a1a0a	CORRUPTED
+>4	belong		0x0d0a1a0a
+>>16	belong		x		%ld x
+>>20	belong		x		%ld,
+>>24	byte		x		%d-bit
+>>25	byte		0		grayscale,
+>>25	byte		2		\b/color RGB,
+>>25	byte		3		colormap,
+>>25	byte		4		gray+alpha,
+>>25	byte		6		\b/color RGBA,
+#>>26	byte		0		deflate/32K,
+>>28	byte		0		non-interlaced
+>>28	byte		1		interlaced
+1	string		PNG		PNG image data, CORRUPTED
+
+# GIF
+0	string		GIF8		GIF image data
+>4	string		7a		\b, version 8%s,
+>4	string		9a		\b, version 8%s,
+>6	leshort		>0		%hd x
+>8	leshort		>0		%hd,
+#>10	byte		&0x80		color mapped,
+#>10	byte&0x07	=0x00		2 colors
+#>10	byte&0x07	=0x01		4 colors
+#>10	byte&0x07	=0x02		8 colors
+#>10	byte&0x07	=0x03		16 colors
+#>10	byte&0x07	=0x04		32 colors
+#>10	byte&0x07	=0x05		64 colors
+#>10	byte&0x07	=0x06		128 colors
+#>10	byte&0x07	=0x07		256 colors
+
+# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
+# 1 plane, no encoding.
+0	string		\361\0\100\273	CMU window manager raster image data
+>4	lelong		>0		%d x
+>8	lelong		>0		%d,
+>12	lelong		>0		%d-bit
+
+# Magick Image File Format
+0	string		id=ImageMagick	MIFF image data
+
+# Artisan
+0	long		1123028772	Artisan image data
+>4	long		1		\b, rectangular 24-bit
+>4	long		2		\b, rectangular 8-bit with colormap
+>4	long		3		\b, rectangular 32-bit (24-bit with matte)
+
+# FIG (Facility for Interactive Generation of figures), an object-based format
+0	string		#FIG		FIG image text
+>5	string		x		\b, version %.3s
+
+# PHIGS
+0	string		ARF_BEGARF		PHIGS clear text archive
+0	string		@(#)SunPHIGS		SunPHIGS
+# version number follows, in the form m.n
+>40	string		SunBin			binary
+>32	string		archive			archive
+
+# GKS (Graphics Kernel System)
+0	string		GKSM		GKS Metafile
+>24	string		SunGKS		\b, SunGKS
+
+# CGM image files
+0	string		BEGMF		clear text Computer Graphics Metafile
+# XXX - questionable magic
+0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
+0	beshort		0x3020		character Computer Graphics Metafile
+
+# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
+0	string	yz	MGR bitmap, modern format, 8-bit aligned
+0	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
+0	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
+0	string	yx	MGR bitmap, modern format, squeezed
+
+# Fuzzy Bitmap (FBM) images
+0	string		%bitmap\0	FBM image data
+>30	long		0x31		\b, mono
+>30	long		0x33		\b, color
+
+# facsimile data
+1	string		PC\ Research,\ Inc	group 3 fax data
+>29	byte		0		\b, normal resolution (204x98 DPI)
+>29	byte		1		\b, fine resolution (204x196 DPI)
+
+# JPEG images
+0	beshort		0xffd8		JPEG image data
+>6	string		JFIF		\b, JFIF standard
+# HSI is Handmade Software's proprietary JPEG encoding scheme
+0	string		hsi1		JPEG image data, HSI proprietary
+
+# PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
+0	string		BM		PC bitmap data
+>14	leshort		12		\b, OS/2 1.x format
+>>18	leshort		x		\b, %d x
+>>20	leshort		x		%d
+>14	leshort		64		\b, OS/2 2.x format
+>>18	leshort		x		\b, %d x
+>>20	leshort		x		%d
+>14	leshort		40		\b, Windows 3.x format
+>>18	lelong		x		\b, %d x
+>>22	lelong		x		%d x
+>>28	leshort		x		%d
+0	string		IC		PC icon data
+0	string		PI		PC pointer image data
+0	string		CI		PC color icon data
+0	string		CP		PC color pointer image data
+# Conflicts with other entries [BABYL]
+#0	string		BA		PC bitmap array data
+
+# XPM icons (Greg Roelofs, newt@uchicago.edu)
+# note possible collision with C/REXX entry in c-lang; currently commented out
+0	string		/*\ XPM\ */	X pixmap image text
+
+# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
+0	leshort		0xcc52		RLE image data,
+>6	leshort		x		%d x
+>8	leshort		x		%d
+>2	leshort		>0		\b, lower left corner: %d
+>4	leshort		>0		\b, lower right corner: %d
+>10	byte&0x1	=0x1		\b, clear first
+>10	byte&0x2	=0x2		\b, no background
+>10	byte&0x4	=0x4		\b, alpha channel
+>10	byte&0x8	=0x8		\b, comment
+>11	byte		>0		\b, %d color channels
+>12	byte		>0		\b, %d bits per pixel
+>13	byte		>0		\b, %d color map channels
+
+# image file format (Robert Potter, potter@cs.rochester.edu)
+0	string		Imagefile\ version-	iff image data
+# this adds the whole header (inc. version number), informative but longish
+>10	string		>\0		%s
+
+# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
+0	belong		0x59a66a95	Sun raster image data
+>4	belong		>0		\b, %d x
+>8	belong		>0		%d,
+>12	belong		>0		%d-bit,
+#>16	belong		>0		%d bytes long,
+>20	belong		0		old format,
+#>20	belong		1		standard,
+>20	belong		2		compressed,
+>20	belong		3		RGB,
+>20	belong		4		TIFF,
+>20	belong		5		IFF,
+>20	belong		0xffff		reserved for testing,
+>24	belong		0		no colormap
+>24	belong		1		RGB colormap
+>24	belong		2		raw colormap
+#>28	belong		>0		colormap is %d bytes long
+
+# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
+# file://sgi.com/graphics/SGIIMAGESPEC
+0	beshort		474		SGI image data
+#>2	byte		0		\b, verbatim
+>2	byte		1		\b, RLE
+#>3	byte		1		\b, normal precision
+>3	byte		2		\b, high precision
+>4	beshort		x		\b, %d-D
+>6	beshort		x		\b, %d x
+>8	beshort		x		%d
+>10	beshort		x		\b, %d channel
+>10	beshort		!1		\bs
+>80	string		>0		\b, "%s"
+
+0	string		IT01		FIT image data
+>4	belong		x		\b, %d x
+>8	belong		x		%d x
+>12	belong		x		%d
+#
+0	string		IT02		FIT image data
+>4	belong		x		\b, %d x
+>8	belong		x		%d x
+>12	belong		x		%d
+#
+2048	string		PCD_IPI		Kodak Photo CD image pack file
+0	string		PCD_OPA		Kodak Photo CD overview pack file
+
+# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
+# FITS is the Flexible Image Transport System, the de facto standard for
+# data and image transfer, storage, etc., for the astronomical community.
+# (FITS floating point formats are big-endian.)
+0	string	SIMPLE\ \ =	FITS image data
+>109	string	8		\b, 8-bit, character or unsigned binary integer
+>108	string	16		\b, 16-bit, two's complement binary integer
+>107	string	\ 32		\b, 32-bit, two's complement binary integer
+>107	string	-32		\b, 32-bit, floating point, single precision
+>107	string	-64		\b, 64-bit, floating point, double precision
+
+# other images
+0	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
+0	string		!!		Bennet Yee's "face" format

+ 35 - 0
Magdir/intel

@@ -0,0 +1,35 @@
+
+#------------------------------------------------------------------------------
+# intel:  file(1) magic for x86 Unix
+#
+# Various flavors of x86 UNIX executable/object (other than Xenix, which
+# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
+# Windows as well.
+#
+# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
+# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
+# as well, if, as, and when IBM makes it portable.
+#
+# The `versions' should be un-commented if they work for you.
+# (Was the problem just one of endianness?)
+#
+0	leshort		0502		basic-16 executable
+>12	lelong		>0		not stripped
+#>22	leshort		>0		- version %ld
+0	leshort		0503		basic-16 executable (TV)
+>12	lelong		>0		not stripped
+#>22	leshort		>0		- version %ld
+0	leshort		0510		x86 executable
+>12	lelong		>0		not stripped
+0	leshort		0511		x86 executable (TV)
+>12	lelong		>0		not stripped
+0	leshort		=0512		iAPX 286 executable small model (COFF)
+>12	lelong		>0		not stripped
+#>22	leshort		>0		- version %ld
+0	leshort		=0522		iAPX 286 executable large model (COFF)
+>12	lelong		>0		not stripped
+#>22	leshort		>0		- version %ld
+# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
+0	leshort		=0514		386 COFF executable
+>12	lelong		>0		not stripped
+>22	leshort		>0		- version %ld

+ 8 - 0
Magdir/interleaf

@@ -0,0 +1,8 @@
+
+#------------------------------------------------------------------------------
+# interleaf:  file(1) magic for InterLeaf TPS:
+#
+0	string		=\210OPS	Interleaf saved data
+0	string		=<!OPS		Interleaf document text
+>5	string		,\ Version\ =	\b, version
+>>17	string		>\0		%.3s

+ 54 - 0
Magdir/ispell

@@ -0,0 +1,54 @@
+
+#------------------------------------------------------------------------------
+# ispell:  file(1) magic for ispell
+#
+# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
+# will match 0x9600 through 0x9603 in *both* little endian and big endian.
+# (No other current magic entries collide.)
+#
+# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
+#
+0	leshort&0xFFFC	0x9600		little endian ispell
+>0	byte		0		hash file (?),
+>0	byte		1		3.0 hash file,
+>0	byte		2		3.1 hash file,
+>0	byte		3		hash file (?),
+>2	leshort		0x00		8-bit, no capitalization, 26 flags
+>2	leshort		0x01		7-bit, no capitalization, 26 flags
+>2	leshort		0x02		8-bit, capitalization, 26 flags
+>2	leshort		0x03		7-bit, capitalization, 26 flags
+>2	leshort		0x04		8-bit, no capitalization, 52 flags
+>2	leshort		0x05		7-bit, no capitalization, 52 flags
+>2	leshort		0x06		8-bit, capitalization, 52 flags
+>2	leshort		0x07		7-bit, capitalization, 52 flags
+>2	leshort		0x08		8-bit, no capitalization, 128 flags
+>2	leshort		0x09		7-bit, no capitalization, 128 flags
+>2	leshort		0x0A		8-bit, capitalization, 128 flags
+>2	leshort		0x0B		7-bit, capitalization, 128 flags
+>2	leshort		0x0C		8-bit, no capitalization, 256 flags
+>2	leshort		0x0D		7-bit, no capitalization, 256 flags
+>2	leshort		0x0E		8-bit, capitalization, 256 flags
+>2	leshort		0x0F		7-bit, capitalization, 256 flags
+>4	leshort		>0		and %d string characters
+0	beshort&0xFFFC	0x9600		big endian ispell
+>1	byte		0		hash file (?),
+>1	byte		1		3.0 hash file,
+>1	byte		2		3.1 hash file,
+>1	byte		3		hash file (?),
+>2	beshort		0x00		8-bit, no capitalization, 26 flags
+>2	beshort		0x01		7-bit, no capitalization, 26 flags
+>2	beshort		0x02		8-bit, capitalization, 26 flags
+>2	beshort		0x03		7-bit, capitalization, 26 flags
+>2	beshort		0x04		8-bit, no capitalization, 52 flags
+>2	beshort		0x05		7-bit, no capitalization, 52 flags
+>2	beshort		0x06		8-bit, capitalization, 52 flags
+>2	beshort		0x07		7-bit, capitalization, 52 flags
+>2	beshort		0x08		8-bit, no capitalization, 128 flags
+>2	beshort		0x09		7-bit, no capitalization, 128 flags
+>2	beshort		0x0A		8-bit, capitalization, 128 flags
+>2	beshort		0x0B		7-bit, capitalization, 128 flags
+>2	beshort		0x0C		8-bit, no capitalization, 256 flags
+>2	beshort		0x0D		7-bit, no capitalization, 256 flags
+>2	beshort		0x0E		8-bit, capitalization, 256 flags
+>2	beshort		0x0F		7-bit, capitalization, 256 flags
+>4	beshort		>0		and %d string characters

+ 4 - 0
Magdir/java

@@ -0,0 +1,4 @@
+#------------------------------------------------------------
+# Java ByteCode
+0	belong		0xcafebabe
+>4	belong		0x0003002d	Java bytecode

+ 8 - 0
Magdir/karma

@@ -0,0 +1,8 @@
+
+#------------------------------------------------------------------------------
+# karma:  file(1) magic for Karma data files
+#
+# From <rgooch@atnf.csiro.au>
+
+0	string		KarmaRHD Version	Karma Data Structure Version
+>16	long		x		%lu

+ 11 - 0
Magdir/lex

@@ -0,0 +1,11 @@
+
+#------------------------------------------------------------------------------
+# lex:  file(1) magic for lex
+#
+#	derived empirically, your offsets may vary!
+53	string		yyprevious	C program text (from lex)
+>3	string		>\0		 for %s
+# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
+21	string		generated\ by\ flex	C program text (from flex)
+# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
+0	string		%{		lex description text

+ 7 - 0
Magdir/lif

@@ -0,0 +1,7 @@
+
+#------------------------------------------------------------------------------
+# lif:  file(1) magic for lif
+#
+# XXX - byte order?  (Probably beshort, Daniel Quinlan <quinlan@yggdrasil.com>)
+#
+0	short		0x8000		lif file

+ 85 - 0
Magdir/linux

@@ -0,0 +1,85 @@
+
+#------------------------------------------------------------------------------
+# linux:  file(1) magic for Linux files
+#
+# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
+# The following basic Linux magic is useful for reference, but using
+# "long" magic is a better practice in order to avoid collisions.
+#
+# 2	leshort		100		Linux/i386
+# >0	leshort		0407		impure executable (OMAGIC)
+# >0	leshort		0410		pure executable (NMAGIC)
+# >0	leshort		0413		demand-paged executable (ZMAGIC)
+# >0	leshort		0314		demand-paged executable (QMAGIC)
+#
+0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
+>16	lelong		0		\b, stripped
+0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
+>16	lelong		0		\b, stripped
+0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
+>16	lelong		0		\b, stripped
+0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
+>16	lelong		0		\b, stripped
+#
+0	string		\007\001\000	Linux/i386 object file
+>20	lelong		>0x1020		\b, DLL library
+# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
+0	string		*nazgul*	compiled message catalog
+>8	lelong		>0		\b, version %ld
+# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
+216	lelong		0421		Linux/i386 core file
+>220	string		>\0		of '%s'
+>200	lelong		>0		(signal %d)
+#
+# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
+# this can be overridden by the DOS executable (COM) entry
+2	string		LILO		Linux/i386 LILO boot/chain loader
+#
+# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
+0	string		0.9
+>8	byte		0x0a		Debian Binary Package
+>>3	byte		>0		\b, created by dpkg 0.9%c
+>>4	byte		>0		pl%c
+# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
+0	leshort		0x0436		Linux/i386 PC Screen Font data,
+>2	byte		0		256 characters, no directory,
+>2	byte		1		512 characters, no directory,
+>2	byte		2		256 characters, Unicode directory,
+>2	byte		3		512 characters, Unicode directory,
+>3	byte		>0		8x%d
+# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
+4086	string		SWAP-SPACE	Linux/i386 swap file
+# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
+#
+#	from Erik Troan (ewt@redhat.com) examining od dumps, so this
+#		could be wrong
+#      updated by David Mosberger (davidm@azstarnet.com) based on
+#      GNU BFD and MIPS info found below.
+#
+0	leshort		0x0183		ECOFF alpha
+>24	leshort		0407		executable
+>24	leshort		0410		pure
+>24	leshort		0413		demand paged
+>8	long		>0		not stripped
+>8	long		0		stripped
+>23	leshort		>0		- version %ld.
+
+# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
+# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
+# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
+514		string	HdrS		Linux kernel
+>518		leshort	>0
+>>529		byte	0		zImage data,
+>>529		byte	1		bzImage data,
+>0x048c		byte	0x31
+>>0x048c	string	x		version %s
+>0x0493		byte	0x31
+>>0x0493	string	x		version %s
+>0x048c		byte	0x32
+>>0x048c	string	x		version %s
+>0x0493		byte	0x32
+>>0x0493	string	x		version %s
+# This also matches new kernels, which were caught above by "HdrS".
+0		belong	0xb8c0078e	Linux kernel
+>0x1e3		string	Loading		version 1.3.79 or older
+>0x1e9		string	Loading		from prehistoric times

+ 10 - 0
Magdir/lisp

@@ -0,0 +1,10 @@
+
+#------------------------------------------------------------------------------
+# lisp:  file(1) magic for lisp programs
+#
+# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
+0	string	;;			Lisp/Scheme program text
+# Emacs 18 - this is always correct, but not very magical.
+0	string	\012(			byte-compiled Emacs-Lisp program data
+# Emacs 19
+0	string	;ELC\023\000\000\000	byte-compiled Emacs-Lisp program data

+ 38 - 0
Magdir/mach

@@ -0,0 +1,38 @@
+#------------------------------------------------------------------------------
+# mach file description
+#
+0	belong		0xcafebabe	mach-o fat file
+>4	belong		1		with 1 architecture
+>4	belong		>1
+>>4	belong		x		with %ld architectures		
+#
+0	belong		0xfeedface	mach-o
+>12	belong		1		object
+>12	belong		2		executable
+>12	belong		3		shared library
+>12	belong		4		core
+>12	belong		5		preload executable
+>12	belong		>5
+>>12	belong		x		filetype=%ld
+>4	belong		<0
+>>4	belong		x		architecture=%ld
+>4	belong		1		vax
+>4	belong		2		romp
+>4	belong		3		architecture=3
+>4	belong		4		ns32032
+>4	belong		5		ns32332
+>4	belong		6		for m68k architecture
+>4	belong		7		i386
+>4	belong		8		mips
+>4	belong		9		ns32532
+>4	belong		10		architecture=10
+>4	belong		11		hp pa-risc
+>4	belong		12		acorn
+>4	belong		13		m88k
+>4	belong		14		sparc
+>4	belong		15		i860-big
+>4	belong		16		i860
+>4	belong		17		rs6000
+>4	belong		18		powerPC
+>4	belong		>18
+>>4	belong		x		architecture=%ld

+ 5 - 0
Magdir/magic

@@ -0,0 +1,5 @@
+
+#------------------------------------------------------------------------------
+# magic:  file(1) magic for magic files
+#
+0	string		#\ Magic	magic text file for file(1) cmd

+ 21 - 0
Magdir/mail.news

@@ -0,0 +1,21 @@
+
+#------------------------------------------------------------------------------
+# mail.news:  file(1) magic for mail and news
+#
+# Unfortunately, saved netnews also has From line added in some news software.
+#0	string		From 		mail text
+# There are tests to ascmagic.c to cope with mail and news.
+0	string		Relay-Version: 	old news text
+0	string		#!\ rnews	batched news text
+0	string		N#!\ rnews	mailed, batched news text
+0	string		Forward\ to 	mail forwarding text
+0	string		Pipe\ to 	mail piping text
+0	string		Return-Path:	smtp mail text
+0	string		Path:		news text
+0	string		Xref:		news text
+0	string		From:		news or mail text
+0	string		Article 	saved news text
+0	string		BABYL		Emacs RMAIL text
+0	string		Received:	RFC 822 mail message
+0	string		MIME-Version:	MIME entity
+0	string		Content-	MIME entity

+ 72 - 0
Magdir/microsoft

@@ -0,0 +1,72 @@
+
+#------------------------------------------------------------------------------
+# microsoft:  file(1) magic for Microsoft Xenix
+#
+# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
+# model" lifted from "magic.xenix", with comment "derived empirically;
+# treat as folklore until proven"
+#
+# "small model", "large model", "huge model" stuff lifted from XXX
+#
+# XXX - "x.out" collides with PDP-11 archives
+#
+0	string		core		core file (Xenix)
+0	byte		0x80		8086 relocatable (Microsoft)
+0	leshort		0xff65		x.out
+>2	string		__.SYMDEF	 randomized
+>0	byte		x		archive
+0	leshort		0x206		Microsoft a.out
+>8	leshort		1		Middle model
+>0x1e	leshort		&0x10		overlay
+>0x1e	leshort		&0x2		separate
+>0x1e	leshort		&0x4		pure
+>0x1e	leshort		&0x800		segmented
+>0x1e	leshort		&0x400		standalone
+>0x1e	leshort		&0x8		fixed-stack
+>0x1c	byte		&0x80		byte-swapped
+>0x1c	byte		&0x40		word-swapped
+>0x10	lelong		>0		not-stripped
+>0x1e	leshort		^0xc000		pre-SysV
+>0x1e	leshort		&0x4000		V2.3
+>0x1e	leshort		&0x8000		V3.0
+>0x1c	byte		&0x4		86
+>0x1c	byte		&0xb		186
+>0x1c	byte		&0x9		286
+>0x1c	byte		&0xa		386
+>0x1f	byte		<0x040		small model
+>0x1f	byte		=0x048		large model	
+>0x1f	byte		=0x049		huge model 
+>0x1e	leshort		&0x1		executable
+>0x1e	leshort		^0x1		object file
+>0x1e	leshort		&0x40		Large Text
+>0x1e	leshort		&0x20		Large Data
+>0x1e	leshort		&0x120		Huge Objects Enabled
+>0x10	lelong		>0		not stripped
+
+0	leshort		0x140		old Microsoft 8086 x.out
+>0x3	byte		&0x4		separate
+>0x3	byte		&0x2		pure
+>0	byte		&0x1		executable
+>0	byte		^0x1		relocatable
+>0x14	lelong		>0		not stripped
+
+0	lelong		0x206		b.out
+>0x1e	leshort		&0x10		overlay
+>0x1e	leshort		&0x2		separate
+>0x1e	leshort		&0x4		pure
+>0x1e	leshort		&0x800		segmented
+>0x1e	leshort		&0x400		standalone
+>0x1e	leshort		&0x1		executable
+>0x1e	leshort		^0x1		object file
+>0x1e	leshort		&0x4000		V2.3
+>0x1e	leshort		&0x8000		V3.0
+>0x1c	byte		&0x4		86
+>0x1c	byte		&0xb		186
+>0x1c	byte		&0x9		286
+>0x1c	byte		&0x29		286
+>0x1c	byte		&0xa		386
+>0x1e	leshort		&0x4		Large Text
+>0x1e	leshort		&0x2		Large Data
+>0x1e	leshort		&0x102		Huge Objects Enabled
+
+0	leshort		0x580		XENIX 8086 relocatable or 80286 small model

+ 7 - 0
Magdir/mirage

@@ -0,0 +1,7 @@
+
+#------------------------------------------------------------------------------
+# mirage:  file(1) magic for Mirage executables
+#
+# XXX - byte order?
+#
+0	long	31415		Mirage Assembler m.out executable

+ 10 - 0
Magdir/mkid

@@ -0,0 +1,10 @@
+
+#------------------------------------------------------------------------------
+# mkid:  file(1) magic for mkid(1) databases
+#
+# ID is the binary tags database produced by mkid(1).
+#
+# XXX - byte order?
+#
+0	string		\311\304	ID tags data
+>2	short		>0		version %d

+ 5 - 0
Magdir/mmdf

@@ -0,0 +1,5 @@
+
+#------------------------------------------------------------------------------
+# mmdf:  file(1) magic for MMDF mail files
+#
+0	string	\001\001\001\001	MMDF mailbox

+ 32 - 0
Magdir/motorola

@@ -0,0 +1,32 @@
+
+#------------------------------------------------------------------------------
+# motorola:  file(1) magic for Motorola 68K and 88K binaries
+#
+# 68K
+#
+0	beshort		0520		mc68k COFF
+>18	beshort		^00000020	object
+>18	beshort		&00000020	executable
+>12	belong		>0		not stripped
+>168	string		.lowmem		Apple toolbox
+>20	beshort		0407		(impure)
+>20	beshort		0410		(pure)
+>20	beshort		0413		(demand paged)
+>20	beshort		0421		(standalone)
+0	beshort		0521		mc68k executable (shared)
+>12	belong		>0		not stripped
+0	beshort		0522		mc68k executable (shared demand paged)
+>12	belong		>0		not stripped
+#
+# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
+#
+0	beshort		0554		68K BCS executable
+#
+# 88K
+#
+# Motorola/88Open BCS
+#
+0	beshort		0555		88K BCS executable
+#
+# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
+0   string      S0          Motorola S-Record; binary data in text format

+ 73 - 0
Magdir/msdos

@@ -0,0 +1,73 @@
+
+#------------------------------------------------------------------------------
+# msdos:  file(1) magic for MS-DOS files
+#
+
+# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
+0	string	@echo\ off	MS-DOS batch file text
+
+# .EXE formats (Greg Roelofs, newt@uchicago.edu)
+#
+0	string	MZ		MS-DOS executable (EXE)
+>24	string	@		\b, OS/2 or Windows
+>1638	string	-lh5-		\b, LHa SFX archive v2.13S
+>7195	string	Rar!		\b, RAR self-extracting archive
+#
+# [GRR 950118:  file 3.15 has a buffer-size limitation; offsets bigger than
+#   8161 bytes are ignored.  To make the following entries work, increase
+#   HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
+#   NT/Win32 and VMS.]
+# [GRR:  some company sells a self-extractor/displayer for image data(!)]
+#
+>11696	string	PK\003\004	\b, PKZIP SFX archive v1.1
+>13297	string	PK\003\004	\b, PKZIP SFX archive v1.93a
+>15588	string	PK\003\004	\b, PKZIP2 SFX archive v1.09
+>15770	string	PK\003\004	\b, PKZIP SFX archive v2.04g
+>28374	string	PK\003\004	\b, PKZIP2 SFX archive v1.02
+#
+# Info-ZIP self-extractors
+#    these are the DOS versions:
+>25115	string	PK\003\004	\b, Info-ZIP SFX archive v5.12
+>26331	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
+#    these are the OS/2 versions (OS/2 is flagged above):
+>47031	string	PK\003\004	\b, Info-ZIP SFX archive v5.12
+>49845	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
+#    this is the NT/Win32 version:
+>69120	string	PK\003\004	\b, Info-ZIP NT SFX archive v5.12 w/decryption
+#
+# TELVOX Teleinformatica CODEC self-extractor for OS/2:
+>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
+>>49824	leshort		=1			\b, 1 file
+>>49824	leshort		>1			\b, %u files
+
+# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
+# Uncommenting only the first two lines will cover about 2/3 of COM files,
+# but it isn't feasible to match all COM files since there must be at least
+# two dozen different one-byte "magics".
+#0	byte		0xe9		MS-DOS executable (COM)
+#0	byte		0x8c		MS-DOS executable (COM)
+# 0xeb conflicts with "sequent" magic
+#0	byte		0xeb		MS-DOS executable (COM)
+#0	byte		0xb8		MS-DOS executable (COM)
+
+# miscellaneous formats
+0	string		LZ		MS-DOS executable (built-in)
+#0	byte		0xf0		MS-DOS program library data
+#
+
+# Popular applications
+2080	string	Microsoft\ Word\ 6.0\ Document	%s
+#
+0	belong	0x31be0000	Microsoft Word Document
+#
+2080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
+#
+0	belong	0x00001a00	Lotus 1-2-3
+>4	belong	0x00100400	wk3 document
+>4	belong	0x02100400	wk4 document
+>4	belong	0x07800100	fm3 or fmb document
+>4	belong	0x07800000	fm3 or fmb document
+#
+0	belong	0x00000200 	Lotus 1-2-3
+>4	belong	0x06040600	wk1 document
+>4	belong	0x06800200	fmt document

+ 48 - 0
Magdir/ncr

@@ -0,0 +1,48 @@
+
+#------------------------------------------------------------------------------
+# ncr:  file(1) magic for NCR Tower objects
+#
+# contributed by
+# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
+# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
+#
+0	beshort		000610	Tower/XP rel 2 object
+>12	   belong		>0	not stripped
+>20	   beshort		0407	executable
+>20	   beshort		0410	pure executable
+>22	   beshort		>0	- version %ld
+0	beshort		000615	Tower/XP rel 2 object
+>12	   belong		>0	not stripped
+>20	   beshort		0407	executable
+>20	   beshort		0410	pure executable
+>22	   beshort		>0	- version %ld
+0	beshort		000620	Tower/XP rel 3 object
+>12	   belong		>0	not stripped
+>20	   beshort		0407	executable
+>20	   beshort		0410	pure executable
+>22	   beshort		>0	- version %ld
+0	beshort		000625	Tower/XP rel 3 object
+>12	   belong		>0	not stripped
+>20	   beshort		0407	executable
+>20	   beshort		0410	pure executable
+>22	   beshort		>0	- version %ld
+0	beshort		000630	Tower32/600/400 68020 object
+>12	   belong		>0	not stripped
+>20	   beshort		0407	executable
+>20	   beshort		0410	pure executable
+>22	   beshort		>0	- version %ld
+0	beshort		000640	Tower32/800 68020
+>18	   beshort		&020000	w/68881 object
+>18	   beshort		&040000	compatible object
+>18	   beshort		&~060000	object
+>20	   beshort		0407	executable
+>20	   beshort		0413	pure executable
+>12	   belong		>0	not stripped
+>22	   beshort		>0	- version %ld
+0	beshort		000645	Tower32/800 68010
+>18	   beshort		&040000	compatible object
+>18	   beshort		&~060000 object
+>20	   beshort		0407	executable
+>20	   beshort		0413	pure executable
+>12	   belong		>0	not stripped
+>22	   beshort		>0	- version %ld

+ 192 - 0
Magdir/netbsd

@@ -0,0 +1,192 @@
+
+#------------------------------------------------------------------------------
+# netbsd:  file(1) magic for NetBSD objects
+#
+# All new-style magic numbers are in network byte order.
+#
+0	lelong			000000413	386BSD demand paged executable
+>16	lelong			>0		not stripped
+0	lelong			000000314	BSDI demand paged executable
+>16	lelong			>0		not stripped
+>32	byte			0x6a		(uses shared libs)
+
+0	lelong&077777777	041400314	FreeBSD/i386 demand paged
+>3	byte			&0x80
+>>20	lelong			<4096		shared library
+>>20	lelong			=4096		dynamically linked executable
+>>20	lelong			>4096		dynamically linked executable
+>3	byte			^0x80		executable
+>16	lelong			>0		not stripped
+
+0	lelong			000000407	NetBSD little-endian object file
+>16	lelong			>0		not stripped
+0	belong			000000407	NetBSD big-endian object file
+>16	belong			>0		not stripped
+
+0	belong&0377777777	041400413	NetBSD/i386 demand paged
+>0	byte			&0x80		
+>>20	lelong			<4096		shared library
+>>20	lelong			=4096		dynamically linked executable
+>>20	lelong			>4096		dynamically linked executable
+>0	byte			^0x80		executable
+>16	lelong			>0		not stripped
+0	belong&0377777777	041400410	NetBSD/i386 pure
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80		executable
+>16	lelong			>0		not stripped
+0	belong&0377777777	041400407	NetBSD/i386
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80
+>>0	byte			&0x40		position independent
+>>20	lelong			!0		executable
+>>20	lelong			=0		object file
+>16	lelong			>0		not stripped
+0	belong&0377777777	041400507	NetBSD/i386 core
+>12	string			>\0		from '%s'
+
+0	belong&0377777777	041600413	NetBSD/m68k demand paged
+>0	byte			&0x80		
+>>20	belong			<8192		shared library
+>>20	belong			=8192		dynamically linked executable
+>>20	belong			>8192		dynamically linked executable
+>0	byte			^0x80		executable
+>16	belong			>0		not stripped
+0	belong&0377777777	041600410	NetBSD/m68k pure
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80		executable
+>16	belong			>0		not stripped
+0	belong&0377777777	041600407	NetBSD/m68k
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80
+>>0	byte			&0x40		position independent
+>>20	belong			!0		executable
+>>20	belong			=0		object file
+>16	belong			>0		not stripped
+0	belong&0377777777	041600507	NetBSD/m68k core
+>12	string			>\0		from '%s'
+
+0	belong&0377777777	042000413	NetBSD/m68k4k demand paged
+>0	byte			&0x80		
+>>20	belong			<4096		shared library
+>>20	belong			=4096		dynamically linked executable
+>>20	belong			>4096		dynamically linked executable
+>0	byte			^0x80		executable
+>16	belong			>0		not stripped
+0	belong&0377777777	042000410	NetBSD/m68k4k pure
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80		executable
+>16	belong			>0		not stripped
+0	belong&0377777777	042000407	NetBSD/m68k4k
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80
+>>0	byte			&0x40		position independent
+>>20	belong			!0		executable
+>>20	belong			=0		object file
+>16	belong			>0		not stripped
+0	belong&0377777777	042000507	NetBSD/m68k4k core
+>12	string			>\0		from '%s'
+
+0	belong&0377777777	042200413	NetBSD/ns32532 demand paged
+>0	byte			&0x80		
+>>20	lelong			<4096		shared library
+>>20	lelong			=4096		dynamically linked executable
+>>20	lelong			>4096		dynamically linked executable
+>0	byte			^0x80		executable
+>16	lelong			>0		not stripped
+0	belong&0377777777	042200410	NetBSD/ns32532 pure
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80		executable
+>16	lelong			>0		not stripped
+0	belong&0377777777	042200407	NetBSD/ns32532
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80
+>>0	byte			&0x40		position independent
+>>20	lelong			!0		executable
+>>20	lelong			=0		object file
+>16	lelong			>0		not stripped
+0	belong&0377777777	042200507	NetBSD/ns32532 core
+>12	string			>\0		from '%s'
+
+0	belong&0377777777	042400413	NetBSD/sparc demand paged
+>0	byte			&0x80		
+>>20	belong			<8192		shared library
+>>20	belong			=8192		dynamically linked executable
+>>20	belong			>8192		dynamically linked executable
+>0	byte			^0x80		executable
+>16	belong			>0		not stripped
+0	belong&0377777777	042400410	NetBSD/sparc pure
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80		executable
+>16	belong			>0		not stripped
+0	belong&0377777777	042400407	NetBSD/sparc
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80
+>>0	byte			&0x40		position independent
+>>20	belong			!0		executable
+>>20	belong			=0		object file
+>16	belong			>0		not stripped
+0	belong&0377777777	042400507	NetBSD/sparc core
+>12	string			>\0		from '%s'
+
+0	belong&0377777777	042600413	NetBSD/pmax demand paged
+>0	byte			&0x80		
+>>20	lelong			<4096		shared library
+>>20	lelong			=4096		dynamically linked executable
+>>20	lelong			>4096		dynamically linked executable
+>0	byte			^0x80		executable
+>16	lelong			>0		not stripped
+0	belong&0377777777	042600410	NetBSD/pmax pure
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80		executable
+>16	lelong			>0		not stripped
+0	belong&0377777777	042600407	NetBSD/pmax
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80
+>>0	byte			&0x40		position independent
+>>20	lelong			!0		executable
+>>20	lelong			=0		object file
+>16	lelong			>0		not stripped
+0	belong&0377777777	042600507	NetBSD/pmax core
+>12	string			>\0		from '%s'
+
+0	belong&0377777777	043000413	NetBSD/vax demand paged
+>0	byte			&0x80		
+>>20	lelong			<4096		shared library
+>>20	lelong			=4096		dynamically linked executable
+>>20	lelong			>4096		dynamically linked executable
+>0	byte			^0x80		executable
+>16	lelong			>0		not stripped
+0	belong&0377777777	043000410	NetBSD/vax pure
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80		executable
+>16	lelong			>0		not stripped
+0	belong&0377777777	043000407	NetBSD/vax
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80
+>>0	byte			&0x40		position independent
+>>20	lelong			!0		executable
+>>20	lelong			=0		object file
+>16	lelong			>0		not stripped
+0	belong&0377777777	043000507	NetBSD/vax core
+>12	string			>\0		from '%s'
+
+0	belong&0377777777	043400413	NetBSD/mips demand paged
+>0	byte			&0x80		
+>>20	belong			<8192		shared library
+>>20	belong			=8192		dynamically linked executable
+>>20	belong			>8192		dynamically linked executable
+>0	byte			^0x80		executable
+>16	belong			>0		not stripped
+0	belong&0377777777	043400410	NetBSD/mips pure
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80		executable
+>16	belong			>0		not stripped
+0	belong&0377777777	043400407	NetBSD/mips
+>0	byte			&0x80		dynamically linked executable
+>0	byte			^0x80
+>>0	byte			&0x40		position independent
+>>20	belong			!0		executable
+>>20	belong			=0		object file
+>16	belong			>0		not stripped
+0	belong&0377777777	043400507	NetBSD/mips core
+>12	string			>\0		from '%s'

+ 12 - 0
Magdir/news

@@ -0,0 +1,12 @@
+
+#------------------------------------------------------------------------------
+# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
+#
+0	string		StartFontMetrics	ASCII font metrics
+0	string		StartFont	ASCII font bits
+0	belong		0x137A2944	NeWS bitmap font
+0	belong		0x137A2947	NeWS font family
+0	belong		0x137A2950	scalable OpenFont binary
+0	belong		0x137A2951	encrypted scalable OpenFont binary
+8	belong		0x137A2B45	X11/NeWS bitmap font
+8	belong		0x137A2B48	X11/NeWS font family

+ 7 - 0
Magdir/pbm

@@ -0,0 +1,7 @@
+
+#------------------------------------------------------------------------------
+# pbm:  file(1) magic for Portable Bitmap files
+#
+# XXX - byte order?
+#
+0	short	0x2a17	"compact bitmap" format (Poskanzer)

+ 7 - 0
Magdir/pdf

@@ -0,0 +1,7 @@
+#------------------------------------------------------------------------------
+# pdf:  file(1) magic for Portable Document Format
+#
+
+0	string		%PDF-		PDF document
+>5	byte		x		\b, version %c
+>7	byte		x		\b.%c

+ 25 - 0
Magdir/pdp

@@ -0,0 +1,25 @@
+
+#------------------------------------------------------------------------------
+# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
+#
+0	lelong		0101555		PDP-11 single precision APL workspace
+0	lelong		0101554		PDP-11 double precision APL workspace
+#
+# PDP-11 a.out
+#
+0	leshort		0407		PDP-11 executable
+>8	leshort		>0		not stripped
+>15	byte		>0		- version %ld
+
+0	leshort		0401		PDP-11 UNIX/RT ldp
+0	leshort		0405		PDP-11 old overlay
+
+0	leshort		0410		PDP-11 pure executable
+>8	leshort		>0		not stripped
+>15	byte		>0		- version %ld
+
+0	leshort		0411		PDP-11 separate I&D executable
+>8	leshort		>0		not stripped
+>15	byte		>0		- version %ld
+
+0	leshort		0437		PDP-11 kernel overlay

+ 13 - 0
Magdir/pgp

@@ -0,0 +1,13 @@
+
+#------------------------------------------------------------------------------
+# pgp:  file(1) magic for Pretty Good Privacy
+#
+0       beshort         0x9900                  PGP key public ring
+0       beshort         0x9501                  PGP key security ring
+0       beshort         0x9500                  PGP key security ring
+0	beshort		0xa600			PGP encrypted data
+0       string          -----BEGIN\040PGP       PGP armored data
+>15     string          PUBLIC\040KEY\040BLOCK- public key block
+>15     string          MESSAGE-                message
+>15     string          SIGNED\040MESSAGE-      signed message
+>15     string          PGP\040SIGNATURE-       signature

+ 5 - 0
Magdir/pkgadd

@@ -0,0 +1,5 @@
+
+#------------------------------------------------------------------------------
+# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
+#
+0       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)

+ 17 - 0
Magdir/plus5

@@ -0,0 +1,17 @@
+
+#------------------------------------------------------------------------------
+# plus5:  file(1) magic for Plus Five's UNIX MUMPS
+#
+# XXX - byte order?  Paging Hokey....
+#
+0	short		0x259		mumps avl global
+>2	byte		>0		(V%d)
+>6	byte		>0		with %d byte name
+>7	byte		>0		and %d byte data cells
+0	short		0x25a		mumps blt global
+>2	byte		>0		(V%d)
+>8	short		>0		- %d byte blocks
+>15	byte		0x00		- P/D format
+>15	byte		0x01		- P/K/D format
+>15	byte		0x02		- K/D format
+>15	byte		>0x02		- Bad Flags

+ 55 - 0
Magdir/printer

@@ -0,0 +1,55 @@
+
+#------------------------------------------------------------------------------
+# printer:  file(1) magic for printer-formatted files
+#
+
+# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
+0	string		%!		PostScript document text
+>2	string		PS-Adobe-	conforming
+>>11	string		>\0		at level %.3s
+>>>15	string		EPS		- type %s
+>>>15	string		Query		- type %s
+>>>15	string		ExitServer	- type %s
+# Some PCs have the annoying habit of adding a ^D as a document separator
+0	string		\004%!		PostScript document text
+>3	string		PS-Adobe-	conforming
+>>12	string		>\0		at level %.3s
+>>>16	string		EPS		- type %s
+>>>16	string		Query		- type %s
+>>>16	string		ExitServer	- type %s
+
+# HP Printer Job Language
+0	string		\033%-12345X@PJL	HP Printer Job Language data
+>15	string		\ ENTER\ LANGUAGE\ =
+>31	string		PostScript		Postscript
+
+# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
+0	string		\033E\033	HP PCL printer data
+>3	string		\&l0A		- default page size
+>3	string		\&l1A		- US executive page size
+>3	string		\&l2A		- US letter page size
+>3	string		\&l3A		- US legal page size
+>3	string		\&l26A		- A4 page size
+>3	string		\&l80A		- Monarch envelope size
+>3	string		\&l81A		- No. 10 envelope size
+>3	string		\&l90A		- Intl. DL envelope size
+>3	string		\&l91A		- Intl. C5 envelope size
+>3	string		\&l100A		- Intl. B5 envelope size
+>3	string		\&l-81A		- No. 10 envelope size (landscape)
+>3	string		\&l-90A		- Intl. DL envelope size (landscape)
+
+# IMAGEN printer-ready files:
+0	string	@document(		Imagen printer
+# this only works if "language xxx" is first item in Imagen header.
+>10	string	language\ impress	(imPRESS data)
+>10	string	language\ daisy		(daisywheel text)
+>10	string	language\ diablo	(daisywheel text)
+>10	string	language\ printer	(line printer emulation)
+>10	string	language\ tektronix	(Tektronix 4014 emulation)
+# Add any other languages that your Imagen uses - remember
+# to keep the word `text' if the file is human-readable.
+# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
+#
+# Now magic for IMAGEN font files...
+0	string		Rast		RST-format raster font data
+>45	string		>0		face %

+ 7 - 0
Magdir/psdbms

@@ -0,0 +1,7 @@
+
+#------------------------------------------------------------------------------
+# psdbms:  file(1) magic for psdatabase
+#
+0	belong&0xff00ffff	0x56000000	ps database
+>1	string	>\0	version %s
+>4	string	>\0	from kernel %s

+ 11 - 0
Magdir/pyramid

@@ -0,0 +1,11 @@
+
+#------------------------------------------------------------------------------
+# pyramid:  file(1) magic for Pyramids
+#
+# XXX - byte order?
+#
+0	long		0x50900107	Pyramid 90x family executable
+0	long		0x50900108	Pyramid 90x family pure executable
+>16	long		>0		not stripped
+0	long		0x5090010b	Pyramid 90x family demand paged pure executable
+>16	long		>0		not stripped

+ 17 - 0
Magdir/rpm

@@ -0,0 +1,17 @@
+#------------------------------------------------------------------------------
+#
+# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
+#
+0	beshort		0xedab    	
+>2	beshort		0xeedb		RPM
+>>4	byte		x		v%d
+>>6	beshort		0		bin
+>>6	beshort		1		src
+>>8	beshort		1		i386
+>>8	beshort		2		Alpha
+>>8	beshort		3		Sparc
+>>8	beshort		4		MIPS
+>>8	beshort		5		PowerPC
+>>8	beshort		6		68000
+>>8     beshort         7               SGI
+>>10	string		x		%s

+ 12 - 0
Magdir/rtf

@@ -0,0 +1,12 @@
+
+#------------------------------------------------------------------------------
+# rtf:	file(1) magic for Rich Text Format (RTF)
+#