file/magic/Magdir/java

#------------------------------------------------------------
# $File: java,v 1.14 2013/02/08 16:54:45 christos Exp $
# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
# same magic number, 0xcafebabe, so they are both handled
# in the entry called "cafebabe".
#------------------------------------------------------------
# Java serialization
# From Martin Pool (m.pool@pharos.com.au)
0	beshort		0xaced		Java serialization data
>2	beshort		>0x0004		\b, version %d

0	belong		0xfeedfeed	Java KeyStore
!:mime	application/x-java-keystore
0	belong		0xcececece	Java JCE KeyStore
!:mime	application/x-java-jce-keystore

# Dalvik .dex format. http://retrodev.com/android/dexformat.html
# From <mkf@google.com> "Mike Fleming"
0	string	dex\n
>0	regex	dex\n[0-9][0-9][0-9]\0	Dalvik dex file
>4	string	>000			version %s
0	string	dey\n
>0	regex	dey\n[0-9][0-9][0-9]\0	Dalvik dex file (optimized for host)
>4	string	>000			version %s

# Java source
0	regex	^import.*;$	Java source
!:mime	text/x-java

# http://android.stackexchange.com/questions/23357/\
# is-there-a-way-to-look-inside-and-modify-an-adb-backup-created-file/\
# 23608#23608
0	string	ANDROID\040BACKUP\n	Android Backup
>15	string	1\n			\b, version 1
>17	string	0\n			\b, uncompressed
>17	string	1\n			\b, compressed
>19	string	none\n			\b, unencrypted
>19	string	AES-256\n		\b, encrypted AES-256