database 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646
  1. #------------------------------------------------------------------------------
  2. # $File: database,v 1.55 2019/04/19 00:42:27 christos Exp $
  3. # database: file(1) magic for various databases
  4. #
  5. # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
  6. #
  7. #
  8. # GDBM magic numbers
  9. # Will be maintained as part of the GDBM distribution in the future.
  10. # <downsj@teeny.org>
  11. 0 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit
  12. !:mime application/x-gdbm
  13. 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old
  14. !:mime application/x-gdbm
  15. 0 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit
  16. !:mime application/x-gdbm
  17. 0 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit
  18. !:mime application/x-gdbm
  19. 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old
  20. !:mime application/x-gdbm
  21. 0 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit
  22. !:mime application/x-gdbm
  23. 0 string GDBM GNU dbm 2.x database
  24. !:mime application/x-gdbm
  25. #
  26. # Berkeley DB
  27. #
  28. # Ian Darwin's file /etc/magic files: big/little-endian version.
  29. #
  30. # Hash 1.85/1.86 databases store metadata in network byte order.
  31. # Btree 1.85/1.86 databases store the metadata in host byte order.
  32. # Hash and Btree 2.X and later databases store the metadata in host byte order.
  33. 0 long 0x00061561 Berkeley DB
  34. !:mime application/x-dbm
  35. >8 belong 4321
  36. >>4 belong >2 1.86
  37. >>4 belong <3 1.85
  38. >>4 belong >0 (Hash, version %d, native byte-order)
  39. >8 belong 1234
  40. >>4 belong >2 1.86
  41. >>4 belong <3 1.85
  42. >>4 belong >0 (Hash, version %d, little-endian)
  43. 0 belong 0x00061561 Berkeley DB
  44. >8 belong 4321
  45. >>4 belong >2 1.86
  46. >>4 belong <3 1.85
  47. >>4 belong >0 (Hash, version %d, big-endian)
  48. >8 belong 1234
  49. >>4 belong >2 1.86
  50. >>4 belong <3 1.85
  51. >>4 belong >0 (Hash, version %d, native byte-order)
  52. 0 long 0x00053162 Berkeley DB 1.85/1.86
  53. >4 long >0 (Btree, version %d, native byte-order)
  54. 0 belong 0x00053162 Berkeley DB 1.85/1.86
  55. >4 belong >0 (Btree, version %d, big-endian)
  56. 0 lelong 0x00053162 Berkeley DB 1.85/1.86
  57. >4 lelong >0 (Btree, version %d, little-endian)
  58. 12 long 0x00061561 Berkeley DB
  59. >16 long >0 (Hash, version %d, native byte-order)
  60. 12 belong 0x00061561 Berkeley DB
  61. >16 belong >0 (Hash, version %d, big-endian)
  62. 12 lelong 0x00061561 Berkeley DB
  63. >16 lelong >0 (Hash, version %d, little-endian)
  64. 12 long 0x00053162 Berkeley DB
  65. >16 long >0 (Btree, version %d, native byte-order)
  66. 12 belong 0x00053162 Berkeley DB
  67. >16 belong >0 (Btree, version %d, big-endian)
  68. 12 lelong 0x00053162 Berkeley DB
  69. >16 lelong >0 (Btree, version %d, little-endian)
  70. 12 long 0x00042253 Berkeley DB
  71. >16 long >0 (Queue, version %d, native byte-order)
  72. 12 belong 0x00042253 Berkeley DB
  73. >16 belong >0 (Queue, version %d, big-endian)
  74. 12 lelong 0x00042253 Berkeley DB
  75. >16 lelong >0 (Queue, version %d, little-endian)
  76. # From Max Bowsher.
  77. 12 long 0x00040988 Berkeley DB
  78. >16 long >0 (Log, version %d, native byte-order)
  79. 12 belong 0x00040988 Berkeley DB
  80. >16 belong >0 (Log, version %d, big-endian)
  81. 12 lelong 0x00040988 Berkeley DB
  82. >16 lelong >0 (Log, version %d, little-endian)
  83. #
  84. #
  85. # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
  86. 0 string/b RRD\0 RRDTool DB
  87. >4 string/b x version %s
  88. >>10 short !0 16bit aligned
  89. >>>10 bedouble 8.642135e+130 big-endian
  90. >>>>18 short x 32bit long (m68k)
  91. >>10 short 0
  92. >>>12 long !0 32bit aligned
  93. >>>>12 bedouble 8.642135e+130 big-endian
  94. >>>>>20 long 0 64bit long
  95. >>>>>20 long !0 32bit long
  96. >>>>12 ledouble 8.642135e+130 little-endian
  97. >>>>>24 long 0 64bit long
  98. >>>>>24 long !0 32bit long (i386)
  99. >>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian
  100. >>>>>24 short !0 32bit long (arm)
  101. >>8 quad 0 64bit aligned
  102. >>>16 bedouble 8.642135e+130 big-endian
  103. >>>>24 long 0 64bit long (s390x)
  104. >>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC)
  105. >>>16 ledouble 8.642135e+130 little-endian
  106. >>>>28 long 0 64bit long (alpha/amd64/ia64)
  107. >>>>28 long !0 32bit long (armel/mipsel)
  108. #----------------------------------------------------------------------
  109. # ROOT: file(1) magic for ROOT databases
  110. #
  111. 0 string root\0 ROOT file
  112. >4 belong x Version %d
  113. >33 belong x (Compression: %d)
  114. # XXX: Weak magic.
  115. # Alex Ott <ott@jet.msk.su>
  116. ## Paradox file formats
  117. #2 leshort 0x0800 Paradox
  118. #>0x39 byte 3 v. 3.0
  119. #>0x39 byte 4 v. 3.5
  120. #>0x39 byte 9 v. 4.x
  121. #>0x39 byte 10 v. 5.x
  122. #>0x39 byte 11 v. 5.x
  123. #>0x39 byte 12 v. 7.x
  124. #>>0x04 byte 0 indexed .DB data file
  125. #>>0x04 byte 1 primary index .PX file
  126. #>>0x04 byte 2 non-indexed .DB data file
  127. #>>0x04 byte 3 non-incrementing secondary index .Xnn file
  128. #>>0x04 byte 4 secondary index .Ynn file
  129. #>>0x04 byte 5 incrementing secondary index .Xnn file
  130. #>>0x04 byte 6 non-incrementing secondary index .XGn file
  131. #>>0x04 byte 7 secondary index .YGn file
  132. #>>>0x04 byte 8 incrementing secondary index .XGn file
  133. ## XBase database files
  134. # updated by Joerg Jenderek at Feb 2013
  135. # https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
  136. # https://www.clicketyclick.dk/databases/xbase/format/dbf.html
  137. # http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
  138. # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
  139. 0 ubelong&0x0000FFFF <0x00000C20
  140. # skip Infocom game Z-machine
  141. >2 ubyte >0
  142. # skip Androids *.xml
  143. >>3 ubyte >0
  144. >>>3 ubyte <32
  145. # 1 < version VV
  146. >>>>0 ubyte >1
  147. # skip HELP.CA3 by test for reserved byte ( NULL )
  148. >>>>>27 ubyte 0
  149. # reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
  150. #>>>>>30 ubeshort x 30NULL?%x
  151. # possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
  152. >>>>>>24 ubelong&0xffFFFFff >0x01302000
  153. # .DBF or .MDX
  154. >>>>>>24 ubelong&0xffFFFFff <0x01302001
  155. # for Xbase Database file (*.DBF) reserved (NULL) for multi-user
  156. >>>>>>>24 ubelong&0xffFFFFff =0
  157. # test for 2 reserved NULL bytes,transaction and encryption byte flag
  158. >>>>>>>>12 ubelong&0xFFFFfEfE 0
  159. # test for MDX flag
  160. >>>>>>>>>28 ubyte x
  161. >>>>>>>>>28 ubyte&0xf8 0
  162. # header size >= 32
  163. >>>>>>>>>>8 uleshort >31
  164. # skip PIC15736.PCX by test for language driver name or field name
  165. >>>>>>>>>>>32 ubyte >0
  166. #!:mime application/x-dbf; charset=unknown-8bit ??
  167. #!:mime application/x-dbase
  168. >>>>>>>>>>>>0 use xbase-type
  169. # database file
  170. >>>>>>>>>>>>0 ubyte x \b DBF
  171. >>>>>>>>>>>>4 lelong 0 \b, no records
  172. >>>>>>>>>>>>4 lelong >0 \b, %d record
  173. # plural s appended
  174. >>>>>>>>>>>>>4 lelong >1 \bs
  175. # https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
  176. # 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
  177. >>>>>>>>>>>>10 uleshort x * %d
  178. # file size = records * record size + header size
  179. >>>>>>>>>>>>1 ubyte x \b, update-date
  180. >>>>>>>>>>>>1 use xbase-date
  181. # https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
  182. #>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x
  183. # 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
  184. >>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x
  185. #>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file
  186. >>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX
  187. >>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
  188. >>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
  189. # 1st record offset + 1 = header size
  190. >>>>>>>>>>>>8 uleshort >0
  191. >>>>>>>>>>>>(8.s+1) ubyte >0
  192. >>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
  193. >>>>>>>>>>>>>(8.s+1) ubyte >0
  194. >>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
  195. # for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
  196. >>>>>>>24 ubelong&0x0133f7ff >0
  197. # test for reserved NULL byte
  198. >>>>>>>>47 ubyte 0
  199. # test for valid TAG key format (0x10 or 0)
  200. >>>>>>>>>559 ubyte&0xeF 0
  201. # test MM <= 12
  202. >>>>>>>>>>45 ubeshort <0x0C20
  203. >>>>>>>>>>>45 ubyte >0
  204. >>>>>>>>>>>>46 ubyte <32
  205. >>>>>>>>>>>>>46 ubyte >0
  206. #!:mime application/x-mdx
  207. >>>>>>>>>>>>>>0 use xbase-type
  208. >>>>>>>>>>>>>>0 ubyte x \b MDX
  209. >>>>>>>>>>>>>>1 ubyte x \b, creation-date
  210. >>>>>>>>>>>>>>1 use xbase-date
  211. >>>>>>>>>>>>>>44 ubyte x \b, update-date
  212. >>>>>>>>>>>>>>44 use xbase-date
  213. # No.of tags in use (1,2,5,12)
  214. >>>>>>>>>>>>>>28 uleshort x \b, %d
  215. # No. of entries in tag (0x30)
  216. >>>>>>>>>>>>>>25 ubyte x \b/%d tags
  217. # Length of tag
  218. >>>>>>>>>>>>>>26 ubyte x * %d
  219. # 1st tag name_
  220. >>>>>>>>>>>>>548 string x \b, 1st tag "%.11s"
  221. # 2nd tag name
  222. #>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
  223. #
  224. # Print the xBase names of different version variants
  225. 0 name xbase-type
  226. >0 ubyte <2
  227. # 1 < version
  228. >0 ubyte >1
  229. >>0 ubyte 0x02 FoxBase
  230. # FoxBase+/dBaseIII+, no memo
  231. >>0 ubyte 0x03 FoxBase+/dBase III
  232. !:mime application/x-dbf
  233. # dBASE IV no memo file
  234. >>0 ubyte 0x04 dBase IV
  235. !:mime application/x-dbf
  236. # dBASE V no memo file
  237. >>0 ubyte 0x05 dBase V
  238. !:mime application/x-dbf
  239. >>0 ubyte 0x30 Visual FoxPro
  240. !:mime application/x-dbf
  241. >>0 ubyte 0x31 Visual FoxPro, autoincrement
  242. !:mime application/x-dbf
  243. # Visual FoxPro, with field type Varchar or Varbinary
  244. >>0 ubyte 0x32 Visual FoxPro, with field type Varchar
  245. !:mime application/x-dbf
  246. # dBASE IV SQL, no memo;dbv memo var size (Flagship)
  247. >>0 ubyte 0x43 dBase IV, with SQL table
  248. !:mime application/x-dbf
  249. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  250. #>>0 ubyte 0x62 dBase IV, with SQL table
  251. #!:mime application/x-dbf
  252. # dBASE IV, with memo!!
  253. >>0 ubyte 0x7b dBase IV, with memo
  254. !:mime application/x-dbf
  255. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  256. #>>0 ubyte 0x82 dBase IV, with SQL system
  257. #!:mime application/x-dbf
  258. # FoxBase+/dBaseIII+ with memo .DBT!
  259. >>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT
  260. !:mime application/x-dbf
  261. # VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
  262. >>0 ubyte 0x87 VISUAL OBJECTS, with memo file
  263. !:mime application/x-dbf
  264. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  265. #>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
  266. #!:mime application/x-dbf
  267. # dBASE IV with memo!
  268. >>0 ubyte 0x8B dBase IV, with memo .DBT
  269. !:mime application/x-dbf
  270. # dBase IV with SQL Table,no memo?
  271. >>0 ubyte 0x8E dBase IV, with SQL table
  272. !:mime application/x-dbf
  273. # .dbv and .dbt memo (Flagship)?
  274. >>0 ubyte 0xB3 Flagship
  275. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  276. #>>0 ubyte 0xCA dBase IV with memo .DBT
  277. #!:mime application/x-dbf
  278. # dBASE IV with SQL table, with memo .DBT
  279. >>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
  280. !:mime application/x-dbf
  281. # HiPer-Six format;Clipper SIX, with SMT memo file
  282. >>0 ubyte 0xE5 Clipper SIX with memo
  283. !:mime application/x-dbf
  284. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  285. #>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
  286. #!:mime application/x-dbf
  287. >>0 ubyte 0xF5 FoxPro with memo
  288. !:mime application/x-dbf
  289. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  290. #>>0 ubyte 0xFA FoxPro 2.x, with memo
  291. #!:mime application/x-dbf
  292. # unknown version (should not happen)
  293. >>0 default x xBase
  294. !:mime application/x-dbf
  295. >>>0 ubyte x (0x%x)
  296. # flags in version byte
  297. # DBT flag (with dBASE III memo .DBT)!!
  298. # >>0 ubyte&0x80 >0 DBT_FLAG=%x
  299. # memo flag ??
  300. # >>0 ubyte&0x08 >0 MEMO_FLAG=%x
  301. # SQL flag ??
  302. # >>0 ubyte&0x70 >0 SQL_FLAG=%x
  303. # test and print the date of xBase .DBF .MDX
  304. 0 name xbase-date
  305. # inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
  306. >0 ubelong x
  307. >1 ubyte <13
  308. >>1 ubyte >0
  309. >>>2 ubyte >0
  310. >>>>2 ubyte <32
  311. >>>>>0 ubyte x
  312. # YY is interpreted as 20YY or 19YY
  313. >>>>>>0 ubyte <100 \b %.2d
  314. # YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
  315. >>>>>>0 ubyte >99 \b %d
  316. >>>>>1 ubyte x \b-%d
  317. >>>>>2 ubyte x \b-%d
  318. # dBase memo files .DBT or .FPT
  319. # https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
  320. 16 ubyte <4
  321. >16 ubyte !2
  322. >>16 ubyte !1
  323. # next free block index is positive
  324. >>>0 ulelong >0
  325. # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
  326. >>>>17 ubelong&0xFFfdFE00 0x00000000
  327. # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
  328. >>>>>20 ubelong&0xFF01209B 0x00000000
  329. # dBASE III
  330. >>>>>>16 ubyte 3
  331. # dBASE III DBT
  332. >>>>>>>0 use dbase3-memo-print
  333. # dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
  334. >>>>>>16 ubyte 0
  335. # unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF
  336. >>>>>>>20 uleshort 0
  337. # FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
  338. >>>>>>>>8 ulong =0
  339. >>>>>>>>>6 ubeshort >0
  340. # skip emacs.PIF
  341. >>>>>>>>>>4 ushort 0
  342. >>>>>>>>>>>0 use foxpro-memo-print
  343. # dBASE III DBT , garbage
  344. >>>>>>>>>6 ubeshort 0
  345. # skip MM*DD*.bin by test for for reserved NULL byte
  346. >>>>>>>>>>510 ubeshort 0
  347. # skip TK-DOS11.img image by looking for memo text
  348. >>>>>>>>>>>512 ubelong <0xfeffff03
  349. # skip EFI executables by looking for memo text
  350. >>>>>>>>>>>>512 ubelong >0x1F202020
  351. >>>>>>>>>>>>>513 ubyte >0
  352. # unusual dBASE III DBT like adressen.dbt
  353. >>>>>>>>>>>>>>0 use dbase3-memo-print
  354. # dBASE III DBT like angest.dbt, or garbage PCX DBF
  355. >>>>>>>>8 ubelong !0
  356. # skip PCX and some DBF by test for for reserved NULL bytes
  357. >>>>>>>>>510 ubeshort 0
  358. # skip some DBF by test of invalid version
  359. >>>>>>>>>>0 ubyte >5
  360. >>>>>>>>>>>0 ubyte <48
  361. >>>>>>>>>>>>0 use dbase3-memo-print
  362. # dBASE IV DBT with positive block size
  363. >>>>>>>20 uleshort >0
  364. # dBASE IV DBT with valid block length like 512, 1024
  365. # multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
  366. >>>>>>>>20 uleshort&0x800f 0
  367. >>>>>>>>>0 use dbase4-memo-print
  368. # Print the information of dBase III DBT memo file
  369. 0 name dbase3-memo-print
  370. >0 ubyte x dBase III DBT
  371. # instead 3 as version number 0 for unusual examples like biblio.dbt
  372. >16 ubyte !3 \b, version number %u
  373. # Number of next available block for appending data
  374. #>0 lelong =0 \b, next free block index %u
  375. >0 lelong !0 \b, next free block index %u
  376. # no positiv block length
  377. #>20 uleshort =0 \b, block length %u
  378. >20 uleshort !0 \b, block length %u
  379. # dBase III memo field terminated by \032\032
  380. >512 string >\0 \b, 1st item "%s"
  381. # Print the information of dBase IV DBT memo file
  382. 0 name dbase4-memo-print
  383. >0 lelong x dBase IV DBT
  384. !:mime application/x-dbt
  385. !:ext dbt
  386. # 8 character shorted main name of coresponding dBASE IV DBF file
  387. >8 ubelong >0x20000000
  388. # skip unusual like for angest.dbt
  389. >>20 uleshort >0
  390. >>>8 string >\0 \b of %-.8s.DBF
  391. # value 0 implies 512 as size
  392. #>4 ulelong =0 \b, blocks size %u
  393. # size of blocks not reliable like 0x2020204C in angest.dbt
  394. >4 ulelong !0
  395. >>4 ulelong&0x0000003f 0 \b, blocks size %u
  396. # dBase IV DBT with positive block length (found 512 , 1024)
  397. >20 uleshort >0 \b, block length %u
  398. # next available block
  399. #>0 lelong =0 \b, next free block index %u
  400. >0 lelong !0 \b, next free block index %u
  401. >20 uleshort >0
  402. >>(20.s) ubelong x
  403. >>>&-4 use dbase4-memofield-print
  404. # unusual dBase IV DBT without block length (implies 512 as length)
  405. >20 uleshort =0
  406. >>512 ubelong x
  407. >>>&-4 use dbase4-memofield-print
  408. # Print the information of dBase IV memo field
  409. 0 name dbase4-memofield-print
  410. # free dBase IV memo field
  411. >0 ubelong !0xFFFF0800
  412. >>0 lelong x \b, next free block %u
  413. >>4 lelong x \b, next used block %u
  414. # used dBase IV memo field
  415. >0 ubelong =0xFFFF0800
  416. # length of memo field
  417. >>4 lelong x \b, field length %d
  418. >>>8 string >\0 \b, 1st used item "%s"
  419. # Print the information of FoxPro FPT memo file
  420. 0 name foxpro-memo-print
  421. >0 belong x FoxPro FPT
  422. # Size of blocks for FoxPro ( 64,256 )
  423. >6 ubeshort x \b, blocks size %u
  424. # next available block
  425. #>0 belong =0 \b, next free block index %u
  426. >0 belong !0 \b, next free block index %u
  427. # field type ( 0~picture, 1~memo, 2~object )
  428. >512 ubelong <3 \b, field type %u
  429. # length of memo field
  430. >512 ubelong 1
  431. >>516 belong >0 \b, field length %d
  432. >>>520 string >\0 \b, 1st item "%s"
  433. # TODO:
  434. # DBASE index file *.NDX
  435. # DBASE Compound Index file *.CDX
  436. # dBASE IV Printer Driver *.PRF
  437. ## End of XBase database stuff
  438. # MS Access database
  439. 4 string Standard\ Jet\ DB Microsoft Access Database
  440. !:mime application/x-msaccess
  441. 4 string Standard\ ACE\ DB Microsoft Access Database
  442. !:mime application/x-msaccess
  443. # From: Joerg Jenderek
  444. # URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
  445. # Reference: https://github.com/libyal/libesedb/archive/master.zip
  446. # libesedb-master/documentation/
  447. # Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
  448. # Note: also known as "JET Blue". Used by numerous Windows components such as
  449. # Windows Search, Mail, Exchange and Active Directory.
  450. 4 ubelong 0xefcdab89
  451. # unknown1
  452. >132 ubelong 0 Extensible storage engine
  453. !:mime application/x-ms-ese
  454. # file_type 0~database 1~stream
  455. >>12 ulelong 0 DataBase
  456. # Security DataBase (sdb)
  457. !:ext edb/sdb
  458. >>12 ulelong 1 STreaMing
  459. !:ext stm
  460. # format_version 620h
  461. >>8 uleshort x \b, version 0x%x
  462. >>10 uleshort >0 revision 0x%4.4x
  463. >>0 ubelong x \b, checksum 0x%8.8x
  464. # Page size 4096 8192 32768
  465. >>236 ulequad x \b, page size %lld
  466. # database_state
  467. >>52 ulelong 1 \b, JustCreated
  468. >>52 ulelong 2 \b, DirtyShutdown
  469. #>>52 ulelong 3 \b, CleanShutdown
  470. >>52 ulelong 4 \b, BeingConverted
  471. >>52 ulelong 5 \b, ForceDetach
  472. # Windows NT major version when the databases indexes were updated.
  473. >>216 ulelong x \b, Windows version %d
  474. # Windows NT minor version
  475. >>220 ulelong x \b.%d
  476. # From: Joerg Jenderek
  477. # URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility
  478. # Note: files contain application compatibility fixes, application compatibility modes and application help messages.
  479. 8 string sdbf
  480. >7 ubyte 0
  481. # TAG_TYPE_LIST+TAG_INDEXES
  482. >>12 uleshort 0x7802 Windows application compatibility Shim DataBase
  483. # version? 2 3
  484. #>>>0 ulelong x \b, version %d
  485. !:mime application/x-ms-sdb
  486. !:ext sdb
  487. # TDB database from Samba et al - Martin Pool <mbp@samba.org>
  488. 0 string TDB\ file TDB database
  489. >32 lelong 0x2601196D version 6, little-endian
  490. >>36 lelong x hash size %d bytes
  491. # SE Linux policy database
  492. 0 lelong 0xf97cff8c SE Linux policy
  493. >16 lelong x v%d
  494. >20 lelong 1 MLS
  495. >24 lelong x %d symbols
  496. >28 lelong x %d ocons
  497. # ICE authority file data (Wolfram Kleff)
  498. 2 string ICE ICE authority data
  499. # X11 Xauthority file (Wolfram Kleff)
  500. 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  501. 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  502. 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  503. 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  504. 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  505. 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  506. 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  507. 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  508. 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  509. # From: Maxime Henrion <mux@FreeBSD.org>
  510. # PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
  511. 0 string PGDMP PostgreSQL custom database dump
  512. >5 byte x - v%d
  513. >6 byte x \b.%d
  514. >5 beshort <0x101 \b-0
  515. >5 beshort >0x100
  516. >>7 byte x \b-%d
  517. # Type: Advanced Data Format (ADF) database
  518. # URL: https://www.grc.nasa.gov/WWW/cgns/adf/
  519. # From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
  520. 0 string @(#)ADF\ Database CGNS Advanced Data Format
  521. # Tokyo Cabinet magic data
  522. # http://tokyocabinet.sourceforge.net/index.html
  523. 0 string ToKyO\ CaBiNeT\n Tokyo Cabinet
  524. >14 string x \b (%s)
  525. >32 byte 0 \b, Hash
  526. !:mime application/x-tokyocabinet-hash
  527. >32 byte 1 \b, B+ tree
  528. !:mime application/x-tokyocabinet-btree
  529. >32 byte 2 \b, Fixed-length
  530. !:mime application/x-tokyocabinet-fixed
  531. >32 byte 3 \b, Table
  532. !:mime application/x-tokyocabinet-table
  533. >33 byte &1 \b, [open]
  534. >33 byte &2 \b, [fatal]
  535. >34 byte x \b, apow=%d
  536. >35 byte x \b, fpow=%d
  537. >36 byte &0x01 \b, [large]
  538. >36 byte &0x02 \b, [deflate]
  539. >36 byte &0x04 \b, [bzip]
  540. >36 byte &0x08 \b, [tcbs]
  541. >36 byte &0x10 \b, [excodec]
  542. >40 lequad x \b, bnum=%lld
  543. >48 lequad x \b, rnum=%lld
  544. >56 lequad x \b, fsiz=%lld
  545. # Type: QDBM Quick Database Manager
  546. # From: Benoit Sibaud <bsibaud@april.org>
  547. 0 string \\[depot\\]\n\f Quick Database Manager, little endian
  548. 0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian
  549. # Type: TokyoCabinet database
  550. # URL: http://tokyocabinet.sourceforge.net/
  551. # From: Benoit Sibaud <bsibaud@april.org>
  552. 0 string ToKyO\ CaBiNeT\n TokyoCabinet database
  553. >14 string x (version %s)
  554. # From: Stephane Blondon https://www.yaal.fr
  555. # Database file for Zope (done by FileStorage)
  556. 0 string FS21 Zope Object Database File Storage v3 (data)
  557. 0 string FS30 Zope Object Database File Storage v4 (data)
  558. # Cache file for the database of Zope (done by ClientStorage)
  559. 0 string ZEC3 Zope Object Database Client Cache File (data)
  560. # IDA (Interactive Disassembler) database
  561. 0 string IDA1 IDA (Interactive Disassembler) database
  562. # Hopper (reverse engineering tool) https://www.hopperapp.com/
  563. 0 string hopperdb Hopper database
  564. # URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
  565. # Reference: http://www.provue.com/Panorama/
  566. # From: Joerg Jenderek
  567. # NOTE: test only versions 4 and 6.0 with Windows
  568. # length of Panorama database name
  569. 5 ubyte >0
  570. # look after database name for "some" null bits
  571. >(5.B+7) ubelong&0xF3ffF000 0
  572. # look for first keyword
  573. >>&1 search/2 DESIGN Panorama database
  574. #!:mime application/x-panorama-database
  575. !:apple KASXZEPD
  576. !:ext pan
  577. # database name
  578. >>>5 pstring x \b, "%s"
  579. #
  580. #
  581. # askSam Database by Stefan A. Haubenthal <polluks@web.de>
  582. 0 string askw40\0 askSam DB
  583. #
  584. #
  585. # MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
  586. 0 string MBSTV\040 MUIbase DB
  587. >6 string x version %s
  588. #
  589. # CDB database
  590. 0 string NBCDB\012 NetBSD Constant Database
  591. >7 byte x \b, version %d
  592. >8 string x \b, for '%s'
  593. >24 lelong x \b, datasize %d
  594. >28 lelong x \b, entries %d
  595. >32 lelong x \b, index %d
  596. >36 lelong x \b, seed %#x
  597. #
  598. # Redis RDB - https://redis.io/topics/persistence
  599. 0 string REDIS Redis RDB file,
  600. >5 regex [0-9][0-9][0-9][0-9] version %s
  601. # Mork database.
  602. # Used by older versions of Mozilla Suite and Firefox,
  603. # and current versions of Thunderbird.
  604. # From: David Korth <gerbilsoft@gerbilsoft.com>
  605. 0 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database
  606. >23 string x \b, version %.3s