Subject: Improve detection of Flash data Author: Christoph Biedl Bug-Debian: https://bugs.debian.org/838860 --- a/magic/Magdir/flash +++ b/magic/Magdir/flash @@ -11,22 +11,44 @@ # 0 name swf-details ->0 string F Macromedia Flash data -!:mime application/x-shockwave-flash ->0 string C Macromedia Flash data (compressed) -!:mime application/x-shockwave-flash ->0 string Z Macromedia Flash data (lzma compressed) -!:mime application/x-shockwave-flash ->3 byte x \b, version %d + +>0 string F +>>8 byte&0xfd 0x08 Macromedia Flash data +!:mime application/x-shockwave-flash +>>>3 byte x \b, version %d +>>8 byte&0xfe 0x10 Macromedia Flash data +!:mime application/x-shockwave-flash +>>>3 byte x \b, version %d +>>8 byte 0x18 Macromedia Flash data +!:mime application/x-shockwave-flash +>>>3 byte x \b, version %d +>>8 beshort&ff87 0x2000 Macromedia Flash data +!:mime application/x-shockwave-flash +>>>3 byte x \b, version %d +>>8 beshort&ffe0 0x3000 Macromedia Flash data +!:mime application/x-shockwave-flash +>>>3 byte x \b, version %d +>>8 byte&0x7 0 +>>>8 ubyte >0x2f +>>>>9 ubyte <0x20 Macromedia Flash data +!:mime application/x-shockwave-flash +>>>>>3 byte x \b, version %d + +>0 string C +>>8 byte 0x78 Macromedia Flash data (compressed) +!:mime application/x-shockwave-flash +>>>3 byte x \b, version %d + +>0 string Z +>>8 byte 0x5d Macromedia Flash data (lzma compressed) +!:mime application/x-shockwave-flash +>>>3 byte x \b, version %d + 1 string WS ->4 lelong !0 ->>3 byte 255 Suspicious ->>>0 use swf-details - ->>3 ubyte <32 ->>>3 ubyte !0 ->>>>0 use swf-details +>4 ulelong >14 +>>3 ubyte !0 +>>>0 use swf-details # From: Cal Peake 0 string FLV\x01 Macromedia Flash Video