#------------------------------------------------------------------------------ # linux: file(1) magic for Linux files # # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> # The following basic Linux magic is useful for reference, but using # "long" magic is a better practice in order to avoid collisions. # # 2 leshort 100 Linux/i386 # >0 leshort 0407 impure executable (OMAGIC) # >0 leshort 0410 pure executable (NMAGIC) # >0 leshort 0413 demand-paged executable (ZMAGIC) # >0 leshort 0314 demand-paged executable (QMAGIC) # 0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) >16 lelong 0 \b, stripped 0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) >16 lelong 0 \b, stripped 0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) >16 lelong 0 \b, stripped 0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) >16 lelong 0 \b, stripped # 0 string \007\001\000 Linux/i386 object file >20 lelong >0x1020 \b, DLL library # Linux-8086 stuff: 0 string \01\03\020\04 Linux-8086 impure executable >28 long !0 not stripped 0 string \01\03\040\04 Linux-8086 executable >28 long !0 not stripped # 0 string \243\206\001\0 Linux-8086 object file # 0 string \01\03\020\20 Minix-386 impure executable >28 long !0 not stripped 0 string \01\03\040\20 Minix-386 executable >28 long !0 not stripped # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 216 lelong 0421 Linux/i386 core file >220 string >\0 of '%s' >200 lelong >0 (signal %d) # # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> # this can be overridden by the DOS executable (COM) entry 2 string LILO Linux/i386 LILO boot/chain loader # # Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de> #0 string 0.9 #>8 byte 0x0a old Debian Binary Package #>>3 byte >0 \b, created by dpkg 0.9%c #>>4 byte >0 pl%c # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 0 leshort 0x0436 Linux/i386 PC Screen Font data, >2 byte 0 256 characters, no directory, >2 byte 1 512 characters, no directory, >2 byte 2 256 characters, Unicode directory, >2 byte 3 512 characters, Unicode directory, >3 byte >0 8x%d # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 4086 string SWAP-SPACE Linux/i386 swap file # Linux swap - russel@coker.com.au 0xff6 string SWAP-SPACE Linux/i386 swap file version 0 (4K pages) 0xff6 string SWAPSPACE2 Linux/i386 swap file version >0x400 long x %d (4K pages) >0x404 long x size %d pages # ECOFF magic for OSF/1 and Linux (only tested under Linux though) # # from Erik Troan (ewt@redhat.com) examining od dumps, so this # could be wrong # updated by David Mosberger (davidm@azstarnet.com) based on # GNU BFD and MIPS info found below. # 0 leshort 0x0183 ECOFF alpha >24 leshort 0407 executable >24 leshort 0410 pure >24 leshort 0413 demand paged >8 long >0 not stripped >8 long 0 stripped >23 leshort >0 - version %ld. # Linux kernel boot images (i386 arch) (Wolfram Kleff) 514 string HdrS Linux kernel >510 leshort 0xAA55 x86 boot executable >>518 leshort 0x201 >>>529 byte 0 zImage, >>>529 byte 1 bzImage, >>>(526.s+0x200) string >\0 version %s, >>498 leshort 1 RO-rootFS, >>498 leshort 0 RW-rootFS, >>508 leshort >0 root_dev=0x%X, >>502 leshort >0 swap_dev=0x%X, >>504 leshort >0 RAMdisksize=%u KB, >>506 leshort 0xFFFF Normal VGA >>506 leshort 0xFFFE Extended VGA >>506 leshort 0xFFFD Prompt for Videomode >>506 leshort >0 Video mode=%d # This also matches new kernels, which were caught above by "HdrS". 0 belong 0xb8c0078e Linux kernel >0x1e3 string Loading version 1.3.79 or older >0x1e9 string Loading from prehistoric times # System.map files - Nicol�s Lichtmaier <nick@debian.org> 8 string \ A\ _text Linux kernel symbol map text # LSM entries - Nicol�s Lichtmaier <nick@debian.org> 0 string Begin3 Linux Software Map entry text 0 string Begin4 Linux Software Map entry text (new format) # Moved from filesystems to be able to detect linux kernels. 0x1FE leshort 0xAA55 x86 boot sector >2 string OSBS \b, OS/BS MBR >0x8C string Invalid\ partition\ table \b, MS-DOS MBR >0 string \0\0\0\0 \b, extended partition table >0 leshort 0x3CEB \b, system >>3 string >\0 %s >>0x36 string FAT \b, %s >>>0x39 string 12 (%s bit) >>>0x39 string 16 (%s bit) >0x52 string FAT32 \b, FAT (32 bit) >>>43 string >NO\ NAME label: %.11s, >>>43 string <NO\ NAME label: %.11s, >>>43 string NO\ NAME unlabeled, >>>19 leshort >0 %d sectors >>>19 leshort 0 >>>>32 lelong x %d sectors >0x200 lelong 0x82564557 \b, BSD disklabel # From Matt Zimmerman 0 belong 0x4f4f4f4d User-mode Linux COW file >4 belong x \b, version %d >8 string >\0 \b, backing file %s