archive 7.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222
  1. #------------------------------------------------------------------------------
  2. # archive: file(1) magic for archive formats (see also "msdos" for self-
  3. # extracting compressed archives)
  4. #
  5. # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
  6. # pre-POSIX "tar" archives are handled in the C code.
  7. # POSIX tar archives
  8. 257 string ustar\0 POSIX tar archive
  9. 257 string ustar\040\040\0 GNU tar archive
  10. # cpio archives
  11. #
  12. # Yes, the top two "cpio archive" formats *are* supposed to just be "short".
  13. # The idea is to indicate archives produced on machines with the same
  14. # byte order as the machine running "file" with "cpio archive", and
  15. # to indicate archives produced on machines with the opposite byte order
  16. # from the machine running "file" with "byte-swapped cpio archive".
  17. #
  18. # The SVR4 "cpio(4)" hints that there are additional formats, but they
  19. # are defined as "short"s; I think all the new formats are
  20. # character-header formats and thus are strings, not numbers.
  21. 0 short 070707 cpio archive
  22. 0 short 0143561 byte-swapped cpio archive
  23. 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
  24. 0 string 070701 ASCII cpio archive (SVR4 with no CRC)
  25. 0 string 070702 ASCII cpio archive (SVR4 with CRC)
  26. # Debian package (needs to go before regular portable archives)
  27. #
  28. 0 string !<arch>\ndebian
  29. >8 string debian-split part of multipart Debian package
  30. >8 string debian-binary Debian binary package
  31. >68 string >\n (format %s)
  32. >136 ledate x created: %s
  33. # other archives
  34. 0 long 0177555 very old archive
  35. 0 short 0177555 very old PDP-11 archive
  36. 0 long 0177545 old archive
  37. 0 short 0177545 old PDP-11 archive
  38. 0 long 0100554 apl workspace
  39. 0 string =<ar> archive
  40. # MIPS archive (needs to go before regular portable archives)
  41. #
  42. 0 string !<arch>\n__________E MIPS archive
  43. >20 string U with MIPS Ucode members
  44. >21 string L with MIPSEL members
  45. >21 string B with MIPSEB members
  46. >19 string L and an EL hash table
  47. >19 string B and an EB hash table
  48. >22 string X -- out of date
  49. 0 string -h- Software Tools format archive text
  50. #
  51. # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
  52. # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
  53. #
  54. # 0 string !<arch> current ar archive
  55. # 0 long 0x213c6172 archive file
  56. #
  57. # and for SVR1 archives, we have:
  58. #
  59. # 0 string \<ar> System V Release 1 ar archive
  60. # 0 string =<ar> archive
  61. #
  62. # XXX - did Aegis really store shared libraries, breakpointed modules,
  63. # and absolute code program modules in the same format as new-style
  64. # "ar" archives?
  65. #
  66. 0 string !<arch> current ar archive
  67. >8 string __.SYMDEF random library
  68. >0 belong =65538 - pre SR9.5
  69. >0 belong =65539 - post SR9.5
  70. >0 beshort 2 - object archive
  71. >0 beshort 3 - shared library module
  72. >0 beshort 4 - debug break-pointed module
  73. >0 beshort 5 - absolute code program module
  74. 0 string \<ar> System V Release 1 ar archive
  75. 0 string =<ar> archive
  76. #
  77. # XXX - from "vax", which appears to collect a bunch of byte-swapped
  78. # thingies, to help you recognize VAX files on big-endian machines;
  79. # with "leshort", "lelong", and "string", that's no longer necessary....
  80. #
  81. 0 belong 0x65ff0000 VAX 3.0 archive
  82. 0 belong 0x3c61723e VAX 5.0 archive
  83. #
  84. 0 long 0x213c6172 archive file
  85. 0 lelong 0177555 very old VAX archive
  86. 0 leshort 0177555 very old PDP-11 archive
  87. #
  88. # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
  89. # be a random library (it said 0xff65 rather than 0177545).
  90. #
  91. 0 lelong 0177545 old VAX archive
  92. >8 string __.SYMDEF random library
  93. 0 leshort 0177545 old PDP-11 archive
  94. >8 string __.SYMDEF random library
  95. #
  96. # From "pdp" (but why a 4-byte quantity?)
  97. #
  98. 0 lelong 0x39bed PDP-11 old archive
  99. 0 lelong 0x39bee PDP-11 4.0 archive
  100. # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
  101. #
  102. # The first byte is the magic (0x1a), byte 2 is the compression type for
  103. # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
  104. # filename of the first file (null terminated). Since some types collide
  105. # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
  106. # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
  107. 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
  108. 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
  109. 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
  110. 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
  111. 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
  112. 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
  113. # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
  114. # I can't create either SPARK or ArcFS archives so I have not tested this stuff
  115. # [GRR: the original entries collide with ARC, above; replaced with combined
  116. # version (not tested)]
  117. #0 byte 0x1a RISC OS archive
  118. #>1 string archive (ArcFS format)
  119. 0 string \032archive RISC OS archive (ArcFS format)
  120. # ARJ archiver (jason@jarthur.Claremont.EDU)
  121. 0 leshort 0xea60 ARJ archive data
  122. >5 byte x \b, v%d,
  123. >8 byte &0x04 multi-volume,
  124. >8 byte &0x10 slash-switched,
  125. >8 byte &0x20 backup,
  126. >34 string x original name: %s,
  127. >7 byte 0 os: MS-DOS
  128. >7 byte 1 os: PRIMOS
  129. >7 byte 2 os: Unix
  130. >7 byte 3 os: Amiga
  131. >7 byte 4 os: Macintosh
  132. >7 byte 5 os: OS/2
  133. >7 byte 6 os: Apple ][ GS
  134. >7 byte 7 os: Atari ST
  135. >7 byte 8 os: NeXT
  136. >7 byte 9 os: VAX/VMS
  137. >3 byte >0 %d]
  138. # HA archiver (Greg Roelofs, newt@uchicago.edu)
  139. # This is a really bad format. A file containing HAWAII will match this...
  140. #0 string HA HA archive data,
  141. #>2 leshort =1 1 file,
  142. #>2 leshort >1 %u files,
  143. #>4 byte&0x0f =0 first is type CPY
  144. #>4 byte&0x0f =1 first is type ASC
  145. #>4 byte&0x0f =2 first is type HSC
  146. #>4 byte&0x0f =0x0e first is type DIR
  147. #>4 byte&0x0f =0x0f first is type SPECIAL
  148. # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
  149. 0 string HPAK HPACK archive data
  150. # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
  151. 0 string \351,\001JAM\ JAM archive,
  152. >7 string >\0 version %.4s
  153. >0x26 byte =0x27 -
  154. >>0x2b string >\0 label %.11s,
  155. >>0x27 lelong x serial %08x,
  156. >>0x36 string >\0 fstype %.8s
  157. # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
  158. 2 string -lh0- LHarc 1.x archive data [lh0]
  159. 2 string -lh1- LHarc 1.x archive data [lh1]
  160. 2 string -lz4- LHarc 1.x archive data [lz4]
  161. 2 string -lz5- LHarc 1.x archive data [lz5]
  162. # [never seen any but the last; -lh4- reported in comp.compression:]
  163. 2 string -lzs- LHa 2.x? archive data [lzs]
  164. 2 string -lh\40- LHa 2.x? archive data [lh ]
  165. 2 string -lhd- LHa 2.x? archive data [lhd]
  166. 2 string -lh2- LHa 2.x? archive data [lh2]
  167. 2 string -lh3- LHa 2.x? archive data [lh3]
  168. 2 string -lh4- LHa (2.x) archive data [lh4]
  169. 2 string -lh5- LHa (2.x) archive data [lh5]
  170. >20 byte x - header level %d
  171. # RAR archiver (Greg Roelofs, newt@uchicago.edu)
  172. 0 string Rar! RAR archive data
  173. # SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
  174. 0 string SQSH squished archive data (Acorn RISCOS)
  175. # UC2 archiver (Greg Roelofs, newt@uchicago.edu)
  176. # I can't figure out the self-extracting form of these buggers...
  177. 0 string UC2\x1a UC2 archive data
  178. # ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
  179. 0 string PK\003\004 Zip archive data
  180. >4 byte 0x09 \b, at least v0.9 to extract
  181. >4 byte 0x0a \b, at least v1.0 to extract
  182. >4 byte 0x0b \b, at least v1.1 to extract
  183. >4 byte 0x14 \b, at least v2.0 to extract
  184. # Zoo archiver
  185. 20 lelong 0xfdc4a7dc Zoo archive data
  186. >4 byte >48 \b, v%c.
  187. >>6 byte >47 \b%c
  188. >>>7 byte >47 \b%c
  189. >32 byte >0 \b, modify: v%d
  190. >>33 byte x \b.%d+
  191. >42 lelong 0xfdc4a7dc \b,
  192. >>70 byte >0 extract: v%d
  193. >>>71 byte x \b.%d+
  194. # Shell archives
  195. 10 string #\ This\ is\ a\ shell\ archive shell archive text
  196. #
  197. # Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
  198. #0 string 0.9
  199. #>8 byte 0x0a old Debian binary package
  200. #>>3 string >\n (format 0.9%s)