gnu 6.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178
  1. #------------------------------------------------------------------------------
  2. # $File: gnu,v 1.21 2019/04/19 00:42:27 christos Exp $
  3. # gnu: file(1) magic for various GNU tools
  4. #
  5. # GNU nlsutils message catalog file format
  6. #
  7. # GNU message catalog (.mo and .gmo files)
  8. # Update: Joerg Jenderek
  9. # URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html
  10. # Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/
  11. # gettext-0.19.8.1/gettext-runtime/intl/gmo.h
  12. # Note: maybe call it like "GNU translation gettext machine object"
  13. 0 string \336\22\4\225 GNU message catalog (little endian),
  14. #0 ulelong 0x950412DE GNU-format message catalog data
  15. # TODO: write lines in such a way that code can also be called for big endian variant
  16. #>0 use gettext-object
  17. #0 name gettext-object
  18. >4 ulelong x revision
  19. !:mime application/x-gettext-translation
  20. # mo extension is also used for Easeus Partition Master PE32 executable module
  21. # like ConvertFatToNTFS.mo
  22. !:ext gmo/mo
  23. # only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit
  24. # major revision
  25. >4 ulelong/0xFFff x %u.
  26. # minor revision
  27. >4 ulelong&0x0000FFff x \b%u
  28. >>8 ulelong x \b, %u message
  29. # plural s
  30. >>8 ulelong >1 \bs
  31. # size of hashing table
  32. #>20 ulelong x \b, %u hash
  33. #>20 ulelong >1 \bes
  34. #>24 ulelong x at 0x%x
  35. # for revsion x.0 offset of table with originals is 1Ch if directly after header
  36. >4 ulelong&0x0000FFff =0
  37. >>12 ulelong !0x1C \b, at 0x%x string table
  38. # but for x.1 table offset i found is 30h. That means directly after bigger header
  39. >4 ulelong&0x0000FFff >0
  40. >>12 ulelong !0x30 \b, at 0x%x string table
  41. # The following variables are only used in .mo files with minor revision >= 1
  42. # number of system dependent segments
  43. #>>28 ulelong x \b, %u segment
  44. #>>28 ulelong >1 \bs
  45. # offset of table describing system dependent segments
  46. #>>32 ulelong x at 0x%x
  47. # number of system dependent strings pairs
  48. >>36 ulelong x \b, %u sysdep message
  49. >>36 ulelong >1 \bs
  50. # offset of table with start offsets of original sysdep strings
  51. #>>40 ulelong x \b, at 0x%x sysdep strings
  52. # offset of table with start offsets of translated sysdep strings
  53. #>>44 ulelong x \b, at 0x%x sysdep translations
  54. # >>(44.l) ulelong x 0x%x chars
  55. # >>>&0 ulelong x at 0x%x
  56. # >>>>(&-4) string x "%s"
  57. # string table after big header
  58. #>>48 ubequad x \b, string table 0x%llx
  59. #
  60. # 0th string length seems to be always 0
  61. #>(12.l) ulelong x \b, %u chars
  62. #>>&0 ulelong x at 0x%x
  63. # if 1st string length positiv inspect offset and string
  64. #>(12.l+8) ulelong >0 \b, %u chars
  65. #>>&0 ulelong x at 0x%x
  66. # if 2nd string length positiv inspect offset and string
  67. # >(12.l+16) ulelong >0 \b, %u chars
  68. # >>&0 ulelong x at 0x%x
  69. # skip newline byte
  70. #>>>(&-4) ubyte =0x0A
  71. #>>>>&0 string x "%s"
  72. #>>>(&-4) ubyte !0x0A
  73. #>>>>&-1 string x '%s'
  74. # offset of table with translation strings
  75. #>16 ulelong x \b, at 0x%x translation table
  76. # check translation 0 length and offset
  77. >(16.l) ulelong >0
  78. >>&0 ulelong x
  79. # translation 0 seems to be often Project-Id with name and version
  80. >>>(&-4) string x \b, %s
  81. # trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL
  82. >(16.l+8) ulelong >1
  83. >>&0 ulelong x
  84. >>>(&-4) ubyte !0x0A
  85. >>>>&-1 string x '%s'
  86. # 1 New Line like in tar-1.29\po\de.gmo
  87. >>>(&-4) ubyte =0x0A
  88. >>>>&0 ubyte !0x0A
  89. >>>>>&-1 string x '%s'
  90. # 2nd New Line like in parted-3.1\po\de.gmo
  91. >>>>&0 ubyte =0x0A
  92. >>>>>&0 string x '%s'
  93. 0 string \225\4\22\336 GNU message catalog (big endian),
  94. #0 ubelong 0x950412DE GNU-format message catalog data
  95. !:mime application/x-gettext-translation
  96. !:ext gmo/mo
  97. # TODO: for big endian use same code as for little endian
  98. #>0 use \^gettext-object
  99. # DEBUG code
  100. #>16 ubelong x \b, at 0x%x translation table
  101. #>(16.L) ubelong x 0x%x chars
  102. #>>&0 ubelong x at 0x%x
  103. # unexpected value HERE!
  104. #>>>(&-4) ubequad x 0x%llx
  105. #
  106. >4 beshort x revision %d.
  107. >6 beshort >0 \b%d,
  108. >>8 belong x %d messages,
  109. >>36 belong x %d sysdep messages
  110. >6 beshort =0 \b%d,
  111. >>8 belong x %d messages
  112. # GnuPG
  113. # The format is very similar to pgp
  114. 0 string \001gpg GPG key trust database
  115. >4 byte x version %d
  116. # Note: magic.mime had 0x8501 for the next line instead of 0x8502
  117. 0 beshort 0x8502 GPG encrypted data
  118. !:mime text/PGP # encoding: data
  119. # Update: Joerg Jenderek
  120. # Note: PGP and GPG use same data structure.
  121. # So recognition is now done by ./pgp with start test for byte 0x99
  122. # This magic is not particularly good, as the keyrings don't have true
  123. # magic. Nevertheless, it covers many keyrings.
  124. # 0 ubeshort-0x9901 <2
  125. # >3 byte 4
  126. # >>4 bedate x GPG key public ring, created %s
  127. # !:mime application/x-gnupg-keyring
  128. # Symmetric encryption
  129. 0 leshort 0x0d8c
  130. >4 leshort 0x0203
  131. >>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher)
  132. >>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher)
  133. >>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher)
  134. >>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher)
  135. >>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher)
  136. >>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher)
  137. >>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher)
  138. >>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher)
  139. >>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher)
  140. >>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher)
  141. # GnuPG Keybox file
  142. # <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
  143. # From: Philipp Hahn <hahn@univention.de>
  144. 0 belong 32
  145. >4 byte 1
  146. >>8 string KBXf GPG keybox database
  147. >>>5 byte 1 version %d
  148. >>>16 bedate x \b, created-at %s
  149. >>>20 bedate x \b, last-maintained %s
  150. # Gnumeric spreadsheet
  151. # This entry is only semi-helpful, as Gnumeric compresses its files, so
  152. # they will ordinarily reported as "compressed", but at least -z helps
  153. 39 string =<gmr:Workbook Gnumeric spreadsheet
  154. # From: James Youngman <jay@gnu.org>
  155. # gnu find magic
  156. 0 string \0LOCATE GNU findutils locate database data
  157. >7 string >\0 \b, format %s
  158. >7 string 02 \b (frcode)
  159. # Files produced by GNU gettext
  160. # gettext message catalogue
  161. 0 search/1024 \nmsgid
  162. >&0 search/1024 \nmsgstr GNU gettext message catalogue text
  163. !:strength +100
  164. !:mime text/x-po