file/Magdir/linux

#------------------------------------------------------------------------------
# linux:  file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
# The following basic Linux magic is useful for reference, but using
# "long" magic is a better practice in order to avoid collisions.
#
# 2	leshort		100		Linux/i386
# >0	leshort		0407		impure executable (OMAGIC)
# >0	leshort		0410		pure executable (NMAGIC)
# >0	leshort		0413		demand-paged executable (ZMAGIC)
# >0	leshort		0314		demand-paged executable (QMAGIC)
#
0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
>16	lelong		0		\b, stripped
#
0	string		\007\001\000	Linux/i386 object file
>20	lelong		>0x1020		\b, DLL library
# Linux-8086 stuff:
0	string		\01\03\020\04	Linux-8086 impure executable
>28	long		!0		not stripped
0	string		\01\03\040\04	Linux-8086 executable
>28	long		!0		not stripped
#
0	string		\243\206\001\0	Linux-8086 object file
#
0	string		\01\03\020\20	Minix-386 impure executable
>28	long		!0		not stripped
0	string		\01\03\040\20	Minix-386 executable
>28	long		!0		not stripped
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
216	lelong		0421		Linux/i386 core file
>220	string		>\0		of '%s'
>200	lelong		>0		(signal %d)
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
# this can be overridden by the DOS executable (COM) entry
2	string		LILO		Linux/i386 LILO boot/chain loader
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
#0	string		0.9
#>8	byte		0x0a		old Debian Binary Package
#>>3	byte		>0		\b, created by dpkg 0.9%c
#>>4	byte		>0		pl%c
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
0	leshort		0x0436		Linux/i386 PC Screen Font data,
>2	byte		0		256 characters, no directory,
>2	byte		1		512 characters, no directory,
>2	byte		2		256 characters, Unicode directory,
>2	byte		3		512 characters, Unicode directory,
>3	byte		>0		8x%d
# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
4086	string		SWAP-SPACE	Linux/i386 swap file
# Linux swap - russel@coker.com.au
0xff6   string  SWAP-SPACE Linux/i386 swap file version 0 (4K pages)
0xff6   string  SWAPSPACE2 Linux/i386 swap file version
>0x400  long    x %d (4K pages)
>0x404  long    x size %d pages
# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
#
#	from Erik Troan (ewt@redhat.com) examining od dumps, so this
#		could be wrong
#      updated by David Mosberger (davidm@azstarnet.com) based on
#      GNU BFD and MIPS info found below.
#
0	leshort		0x0183		ECOFF alpha
>24	leshort		0407		executable
>24	leshort		0410		pure
>24	leshort		0413		demand paged
>8	long		>0		not stripped
>8	long		0		stripped
>23	leshort		>0		- version %ld.

# Linux kernel boot images (i386 arch) (Wolfram Kleff)
514	string		HdrS		Linux kernel
>510	leshort		0xAA55		x86 boot executable
>>518	leshort		0x201
>>>529	byte		0		zImage,
>>>529	byte		1		bzImage,
>>>(526.s+0x200) string	>\0		version %s,
>>498	leshort		1		RO-rootFS,
>>498	leshort		0		RW-rootFS,
>>508	leshort		>0		root_dev=0x%X,
>>502	leshort		>0		swap_dev=0x%X,
>>504	leshort		>0		RAMdisksize=%u KB,
>>506	leshort		0xFFFF		Normal VGA
>>506	leshort		0xFFFE		Extended VGA
>>506	leshort		0xFFFD		Prompt for Videomode
>>506	leshort		>0		Video mode=%d

# This also matches new kernels, which were caught above by "HdrS".
0		belong	0xb8c0078e	Linux kernel
>0x1e3		string	Loading		version 1.3.79 or older
>0x1e9		string	Loading		from prehistoric times

# System.map files - Nicolás Lichtmaier <nick@debian.org>
8	string	\ A\ _text	Linux kernel symbol map text

# LSM entries - Nicolás Lichtmaier <nick@debian.org>
0	string	Begin3	Linux Software Map entry text
0	string	Begin4	Linux Software Map entry text (new format)

# Moved from filesystems to be able to detect linux kernels.
0x1FE	leshort	0xAA55			x86 boot sector
>2	string	OSBS			\b, OS/BS MBR
>0x8C	string	Invalid\ partition\ table	\b, MS-DOS MBR
>0	string	\0\0\0\0		\b, extended partition table
>0	leshort 0x3CEB			\b, system
>>3	string	>\0			%s
>>0x36	string	FAT			\b, %s
>>>0x39	string	12			(%s bit)
>>>0x39	string	16			(%s bit)
>0x52	string	FAT32			\b, FAT (32 bit)
>>>43	string		>NO\ NAME	label: %.11s,
>>>43	string		<NO\ NAME	label: %.11s,
>>>43	string		NO\ NAME	unlabeled,
>>>19	leshort		>0		%d sectors
>>>19	leshort		0		
>>>>32	lelong		x		%d sectors
>0x200	lelong	0x82564557		\b, BSD disklabel

# From Matt Zimmerman
0       belong  0x4f4f4f4d      User-mode Linux COW file
>4      belong  x               \b, version %d
>8      string  >\0             \b, backing file %s