msdos 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186
  1. #------------------------------------------------------------------------------
  2. # msdos: file(1) magic for MS-DOS files
  3. #
  4. # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
  5. 0 string @echo\ off MS-DOS batch file text
  6. # XXX - according to Microsoft's spec, at an offset of 0x3c in a
  7. # PE-format executable is the offset in the file of the PE header;
  8. # unfortunately, that's a little-endian offset, and there's no way
  9. # to specify an indirect offset with a specified byte order.
  10. # So, for now, we assume the standard MS-DOS stub, which puts the
  11. # PE header at 0x80 = 128.
  12. #
  13. # Required OS version and subsystem version were 4.0 on some NT 3.51
  14. # executables built with Visual C++ 4.0, so it's not clear that
  15. # they're interesting. The user version was 0.0, but there's
  16. # probably some linker directive to set it. The linker version was
  17. # 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
  18. #
  19. 128 string PE\0\0 MS Windows PE
  20. >150 leshort&0x0100 >0 32-bit
  21. >132 leshort 0x0 unknown processor
  22. >132 leshort 0x14c Intel 80386
  23. >132 leshort 0x166 MIPS R4000
  24. >132 leshort 0x184 Alpha
  25. >132 leshort 0x268 Motorola 68000
  26. >132 leshort 0x1f0 PowerPC
  27. >132 leshort 0x290 PA-RISC
  28. >148 leshort >27
  29. >>220 leshort 0 unknown subsystem
  30. >>220 leshort 1 native
  31. >>220 leshort 2 GUI
  32. >>220 leshort 3 console
  33. >>220 leshort 7 POSIX
  34. >150 leshort&0x2000 =0 executable
  35. #>>136 ledate x stamp %s,
  36. >>150 leshort&0x0001 >0 not relocatable
  37. #>>150 leshort&0x0004 =0 with line numbers,
  38. #>>150 leshort&0x0008 =0 with local symbols,
  39. #>>150 leshort&0x0200 =0 with debug symbols,
  40. >>150 leshort&0x1000 >0 system file
  41. #>>148 leshort >0
  42. #>>>154 byte x linker %d
  43. #>>>155 byte x \b.%d,
  44. #>>148 leshort >27
  45. #>>>192 leshort x requires OS %d
  46. #>>>194 leshort x \b.%d,
  47. #>>>196 leshort x user version %d
  48. #>>>198 leshort x \b.%d,
  49. #>>>200 leshort x subsystem version %d
  50. #>>>202 leshort x \b.%d,
  51. >150 leshort&0x2000 >0 DLL
  52. #>>136 ledate x stamp %s,
  53. >>150 leshort&0x0001 >0 not relocatable
  54. #>>150 leshort&0x0004 =0 with line numbers,
  55. #>>150 leshort&0x0008 =0 with local symbols,
  56. #>>150 leshort&0x0200 =0 with debug symbols,
  57. >>150 leshort&0x1000 >0 system file
  58. #>>148 leshort >0
  59. #>>>154 byte x linker %d
  60. #>>>155 byte x \b.%d,
  61. #>>148 leshort >27
  62. #>>>192 leshort x requires OS %d
  63. #>>>194 leshort x \b.%d,
  64. #>>>196 leshort x user version %d
  65. #>>>198 leshort x \b.%d,
  66. #>>>200 leshort x subsystem version %d
  67. #>>>202 leshort x \b.%d,
  68. 0 leshort 0x14c MS Windows COFF Intel 80386 object file
  69. #>4 ledate x stamp %s
  70. 0 leshort 0x166 MS Windows COFF MIPS R4000 object file
  71. #>4 ledate x stamp %s
  72. 0 leshort 0x184 MS Windows COFF Alpha object file
  73. #>4 ledate x stamp %s
  74. 0 leshort 0x268 MS Windows COFF Motorola 68000 object file
  75. #>4 ledate x stamp %s
  76. 0 leshort 0x1f0 MS Windows COFF PowerPC object file
  77. #>4 ledate x stamp %s
  78. 0 leshort 0x290 MS Windows COFF PA-RISC object file
  79. #>4 ledate x stamp %s
  80. # .EXE formats (Greg Roelofs, newt@uchicago.edu)
  81. #
  82. 0 string MZ MS-DOS executable (EXE)
  83. >24 string @ \b, OS/2 or MS Windows
  84. >>0xe7 string LH/2\ Self-Extract \b, %s
  85. >>0xe9 string PKSFX2 \b, %s
  86. >>122 string Windows\ self-extracting\ ZIP \b, %s
  87. >0x1c string RJSX\xff\xff \b, ARJ SFX
  88. >0x1c string diet\xf9\x9c \b, diet compressed
  89. >0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, PKSFX
  90. # JM: 0x1e "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved\7\0\0\0"
  91. >0x1e string PKLITE\ Copr. \b, %.6s compressed
  92. >0x24 string LHa's\ SFX \b, %.15s
  93. >0x24 string LHA's\ SFX \b, %.15s
  94. >1638 string -lh5- \b, LHa SFX archive v2.13S
  95. >7195 string Rar! \b, RAR self-extracting archive
  96. #
  97. # [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than
  98. # 8161 bytes are ignored. To make the following entries work, increase
  99. # HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
  100. # NT/Win32 and VMS.]
  101. # [GRR: some company sells a self-extractor/displayer for image data(!)]
  102. #
  103. >11696 string PK\003\004 \b, PKZIP SFX archive v1.1
  104. >13297 string PK\003\004 \b, PKZIP SFX archive v1.93a
  105. >15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09
  106. >15770 string PK\003\004 \b, PKZIP SFX archive v2.04g
  107. >28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02
  108. #
  109. # Info-ZIP self-extractors
  110. # these are the DOS versions:
  111. >25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12
  112. >26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
  113. # these are the OS/2 versions (OS/2 is flagged above):
  114. >47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12
  115. >49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
  116. # this is the NT/Win32 version:
  117. >69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption
  118. #
  119. # TELVOX Teleinformatica CODEC self-extractor for OS/2:
  120. >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
  121. >>49824 leshort =1 \b, 1 file
  122. >>49824 leshort >1 \b, %u files
  123. # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
  124. # Uncommenting only the first two lines will cover about 2/3 of COM files,
  125. # but it isn't feasible to match all COM files since there must be at least
  126. # two dozen different one-byte "magics".
  127. #0 byte 0xe9 MS-DOS executable (COM)
  128. #>6 string SFX\ of\ LHarc (%s)
  129. #0 byte 0x8c MS-DOS executable (COM)
  130. # 0xeb conflicts with "sequent" magic
  131. #0 byte 0xeb MS-DOS executable (COM)
  132. #0 byte 0xb8 MS-DOS executable (COM)
  133. # miscellaneous formats
  134. 0 string LZ MS-DOS executable (built-in)
  135. #0 byte 0xf0 MS-DOS program library data
  136. #
  137. #
  138. # Windows NT Registry files.
  139. #
  140. 0 string regf Windows NT Registry file
  141. # Popular applications
  142. 2080 string Microsoft\ Word\ 6.0\ Document %s
  143. 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
  144. # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
  145. 2112 string MSWordDoc Microsoft Word document data
  146. #
  147. 0 belong 0x31be0000 Microsoft Word Document
  148. #
  149. 0 string PO^Q` Microsoft Word 6.0 Document
  150. #
  151. 0 string \376\067\0\043 Microsoft Office Document
  152. 0 string \320\317\021\340\241\261 Microsoft Office Document
  153. 0 string \333\245-\0\0\0 Microsoft Office Document
  154. #
  155. 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
  156. #
  157. # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
  158. 2114 string Biff5 Microsoft Excel 5.0 Worksheet
  159. #
  160. 0 belong 0x00001a00 Lotus 1-2-3
  161. >4 belong 0x00100400 wk3 document data
  162. >4 belong 0x02100400 wk4 document data
  163. >4 belong 0x07800100 fm3 or fmb document data
  164. >4 belong 0x07800000 fm3 or fmb document data
  165. #
  166. 0 belong 0x00000200 Lotus 1-2-3
  167. >4 belong 0x06040600 wk1 document data
  168. >4 belong 0x06800200 fmt document data
  169. # WordPerfect documents - Trevor Johnson <trevor@jpj.net>
  170. #
  171. 1 string WPC WordPerfect document
  172. # Help files
  173. 0 string ?_\3\0 MS Windows Help Data
  174. # Microsoft CAB distribution format Dale Worley <root@dworley.ny.mediaone.net>
  175. 0 string MSCF\000\000\000\000 Microsoft CAB file