file/magic/magic.mime

# Magic data for KMimeMagic (originally for file(1) command)
#
# The format is 4-5 columns:
#    Column #1: byte number to begin checking from, ">" indicates continuation
#    Column #2: type of data to match
#    Column #3: contents of data to match
#    Column #4: MIME type of result
#    Column #5: MIME encoding of result (optional)

#------------------------------------------------------------------------------
# Localstuff:  file(1) magic for locally observed files
# Add any locally observed files here.

# Real Audio (Magic .ra\0375)
0	belong		0x2e7261fd	audio/x-pn-realaudio
0	string		.RMF		application/vnd.rn-realmedia

#video/x-pn-realvideo
#video/vnd.rn-realvideo
#application/vnd.rn-realmedia
#	sigh, there are many mimes for that but the above are the most common.

# Taken from magic, converted to magic.mime
# mime types according to http://www.geocities.com/nevilo/mod.htm:
#	audio/it	.it
#	audio/x-zipped-it	.itz
#	audio/xm	fasttracker modules
#	audio/x-s3m	screamtracker modules
#	audio/s3m	screamtracker modules
#	audio/x-zipped-mod	mdz
#	audio/mod	mod
#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)

# Taken from loader code from mikmod version 2.14
# by Steve McIntyre (stevem@chiark.greenend.org.uk)
# <doj@cubic.org> added title printing on 2003-06-24
0	string	MAS_UTrack_V00
>14	string	>/0		audio/x-mod
#audio/x-tracker-module

#0	string	UN05		MikMod UNI format module sound data

0	string	Extended\ Module: audio/x-mod
#audio/x-tracker-module
##>17	string	>\0		Title: "%s"

21	string/c	\!SCREAM!	audio/x-mod
#audio/x-screamtracker-module
21	string	BMOD2STM	audio/x-mod
#audio/x-screamtracker-module
1080	string	M.K.		audio/x-mod
#audio/x-protracker-module
#>0	string	>\0		Title: "%s"
1080	string	M!K!		audio/x-mod
#audio/x-protracker-module
#>0	string	>\0		Title: "%s"
1080	string	FLT4		audio/x-mod
#audio/x-startracker-module
#>0	string	>\0		Title: "%s"
1080	string	FLT8		audio/x-mod
#audio/x-startracker-module
#>0	string	>\0		Title: "%s"
1080	string	4CHN		audio/x-mod
#audio/x-fasttracker-module
#>0	string	>\0		Title: "%s"
1080	string	6CHN		audio/x-mod
#audio/x-fasttracker-module
#>0	string	>\0		Title: "%s"
1080	string	8CHN		audio/x-mod
#audio/x-fasttracker-module
#>0	string	>\0		Title: "%s"
1080	string	CD81		audio/x-mod
#audio/x-oktalyzer-tracker-module
#>0	string	>\0		Title: "%s"
1080	string	OKTA		audio/x-mod
#audio/x-oktalyzer-tracker-module
#>0	string	>\0		Title: "%s"
# Not good enough.
#1082	string	CH
#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
1080	string	16CN		audio/x-mod
#audio/x-taketracker-module
#>0	string	>\0		Title: "%s"
1080	string	32CN		audio/x-mod
#audio/x-taketracker-module
#>0	string	>\0		Title: "%s"

# Impuse tracker module (it)
0	string		IMPM		audio/x-mod
#>4	string		>\0		"%s"
#>40	leshort		!0		compatible w/ITv%x
#>42	leshort		!0		created w/ITv%x

#------------------------------------------------------------------------------
# end local stuff
#------------------------------------------------------------------------------

# xml based formats!

# svg

0	string		\<?xml
#			text/xml
>38	string		\<\!DOCTYPE\040svg	image/svg+xml


# xml
0	string		\<?xml			text/xml


#------------------------------------------------------------------------------
# Java

0	short		0xcafe
>2	short		0xbabe		application/java

#------------------------------------------------------------------------------
# audio:  file(1) magic for sound formats
#
# from Jan Nicolai Langfeldt <janl@ifi.uio.no>,
#

# Sun/NeXT audio data
0	string		.snd
>12	belong		1		audio/basic
>12	belong		2		audio/basic
>12	belong		3		audio/basic
>12	belong		4		audio/basic
>12	belong		5		audio/basic
>12	belong		6		audio/basic
>12	belong		7		audio/basic

>12	belong		23		audio/x-adpcm

# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
# (0x0064732E in little-endian encoding).
0	lelong		0x0064732E	
>12	lelong		1		audio/x-dec-basic
>12	lelong		2		audio/x-dec-basic
>12	lelong		3		audio/x-dec-basic
>12	lelong		4		audio/x-dec-basic
>12	lelong		5		audio/x-dec-basic
>12	lelong		6		audio/x-dec-basic
>12	lelong		7		audio/x-dec-basic
#                                       compressed (G.721 ADPCM)
>12	lelong		23		audio/x-dec-adpcm

# Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM"
#					AIFF audio data
8	string		AIFF		audio/x-aiff	
#					AIFF-C audio data
8	string		AIFC		audio/x-aiff	
#					IFF/8SVX audio data
8	string		8SVX		audio/x-aiff	



# Creative Labs AUDIO stuff
#					Standard MIDI data
0	string	MThd			audio/unknown	
#>9 	byte	>0			(format %d)
#>11	byte	>1			using %d channels
#					Creative Music (CMF) data
0	string	CTMF			audio/unknown	
#					SoundBlaster instrument data
0	string	SBI			audio/unknown	
#					Creative Labs voice data
0	string	Creative\ Voice\ File	audio/unknown	
## is this next line right?  it came this way...
#>19	byte	0x1A
#>23	byte	>0			- version %d
#>22	byte	>0			\b.%d

# [GRR 950115:  is this also Creative Labs?  Guessing that first line
#  should be string instead of unknown-endian long...]
#0	long		0x4e54524b	MultiTrack sound data
#0	string		NTRK		MultiTrack sound data
#>4	long		x		- version %ld

# Microsoft WAVE format (*.wav)
# [GRR 950115:  probably all of the shorts and longs should be leshort/lelong]
#					Microsoft RIFF
0	string		RIFF
#					- WAVE format
>8	string		WAVE		audio/x-wav
>8	string/B	AVI		video/x-msvideo
#
>8 	string		CDRA		image/x-coreldraw

# AAC (aka MPEG-2 NBC)
0       beshort&0xfff6    0xfff0          audio/X-HX-AAC-ADTS
0       string          ADIF            audio/X-HX-AAC-ADIF
0       beshort&0xffe0  0x56e0          audio/MP4A-LATM
0       beshort         0x4De1          audio/MP4A-LATM

# MPEG Layer 3 sound files
0       beshort&0xfffe  =0xfffa         audio/mpeg
#MP3 with ID3 tag
0	string		ID3		audio/mpeg
# Ogg/Vorbis
0	string		OggS		application/ogg

#------------------------------------------------------------------------------
# c-lang:  file(1) magic for C programs or various scripts
#

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# ideally should go into "images", but entries below would tag XPM as C source
0	string		/*\ XPM		image/x-xpmi 7bit

# 3DS (3d Studio files)
#16	beshort		0x3d3d		image/x-3ds

# this first will upset you if you're a PL/1 shop... (are there any left?)
# in which case rm it; ascmagic will catch real C programs
#					C or REXX program text
#0	string		/*		text/x-c
#					C++ program text
#0	string		//		text/x-c++

#------------------------------------------------------------------------------
# commands:  file(1) magic for various shells and interpreters
#
#0       string          :\ shell archive or commands for antique kernel text
0       string          #!/bin/sh               application/x-shellscript
0       string          #!\ /bin/sh             application/x-shellscript
0       string          #!/bin/csh              application/x-shellscript
0       string          #!\ /bin/csh            application/x-shellscript
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0       string          #!/bin/ksh              application/x-shellscript
0       string          #!\ /bin/ksh            application/x-shellscript
0       string          #!/bin/tcsh             application/x-shellscript
0       string          #!\ /bin/tcsh           application/x-shellscript
0       string          #!/usr/local/tcsh       application/x-shellscript
0       string          #!\ /usr/local/tcsh     application/x-shellscript
0       string          #!/usr/local/bin/tcsh   application/x-shellscript
0       string          #!\ /usr/local/bin/tcsh application/x-shellscript
# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0       string          #!/bin/bash     		application/x-shellscript
0       string          #!\ /bin/bash           application/x-shellscript
0       string          #!/usr/local/bin/bash   application/x-shellscript
0       string          #!\ /usr/local/bin/bash application/x-shellscript

#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0       string          #!/bin/zsh	        application/x-shellscript
0       string          #!/usr/bin/zsh	        application/x-shellscript
0       string          #!/usr/local/bin/zsh    application/x-shellscript
0       string          #!\ /usr/local/bin/zsh  application/x-shellscript
0       string          #!/usr/local/bin/ash    application/x-shellscript
0       string          #!\ /usr/local/bin/ash  application/x-shellscript
#0       string          #!/usr/local/bin/ae     Neil Brown's ae
#0       string          #!\ /usr/local/bin/ae   Neil Brown's ae
0       string          #!/bin/nawk             application/x-nawk
0       string          #!\ /bin/nawk           application/x-nawk
0       string          #!/usr/bin/nawk         application/x-nawk
0       string          #!\ /usr/bin/nawk       application/x-nawk
0       string          #!/usr/local/bin/nawk   application/x-nawk
0       string          #!\ /usr/local/bin/nawk application/x-nawk
0       string          #!/bin/gawk             application/x-gawk
0       string          #!\ /bin/gawk           application/x-gawk
0       string          #!/usr/bin/gawk         application/x-gawk
0       string          #!\ /usr/bin/gawk       application/x-gawk
0       string          #!/usr/local/bin/gawk   application/x-gawk
0       string          #!\ /usr/local/bin/gawk application/x-gawk
#
0       string          #!/bin/awk              application/x-awk
0       string          #!\ /bin/awk            application/x-awk
0       string          #!/usr/bin/awk          application/x-awk
0       string          #!\ /usr/bin/awk        application/x-awk
# update to distinguish from *.vcf files by Joerg Jenderek: joerg dot jenderek at web dot de
#0	regex		BEGIN[[:space:]]*[{]	application/x-awk

# For Larry Wall's perl language.  The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
#                               Keith Waclena <keith@cerberus.uchicago.edu>
0       string          #!/bin/perl                     application/x-perl
0       string          #!\ /bin/perl                   application/x-perl
0       string          eval\ "exec\ /bin/perl          application/x-perl
0       string          #!/usr/bin/perl                 application/x-perl
0       string          #!\ /usr/bin/perl               application/x-perl
0       string          eval\ "exec\ /usr/bin/perl      application/x-perl
0       string          #!/usr/local/bin/perl           application/x-perl
0       string          #!\ /usr/local/bin/perl         application/x-perl
0       string          eval\ "exec\ /usr/local/bin/perl application/x-perl

#------------------------------------------------------------------------------
# compress:  file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, whap, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.

# standard unix compress
#0	string		\037\235	application/x-compress

# gzip (GNU zip, not to be confused with [Info-ZIP/PKWARE] zip archiver)
#0       string          \037\213        application/x-gzip

0		string			PK\003\004		application/x-zip

# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0	string		Rar!		application/x-rar

# According to gzip.h, this is the correct byte order for packed data.
0	string		\037\036	application/octet-stream
#
# This magic number is byte-order-independent.
#
0	short		017437		application/octet-stream

# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
# compacted data
0	short		0x1fff		application/octet-stream
0	string		\377\037	application/octet-stream
# huf output
0	short		0145405		application/octet-stream

# Squeeze and Crunch...
# These numbers were gleaned from the Unix versions of the programs to
# handle these formats.  Note that I can only uncrunch, not crunch, and
# I didn't have a crunched file handy, so the crunch number is untested.
#				Keith Waclena <keith@cerberus.uchicago.edu>
#0	leshort		0x76FF		squeezed data (CP/M, DOS)
#0	leshort		0x76FE		crunched data (CP/M, DOS)

# Freeze
#0	string		\037\237	Frozen file 2.1
#0	string		\037\236	Frozen file 1.0 (or gzip 0.5)

# lzh?
#0	string		\037\240	LZH compressed data

257	string		ustar\0		application/x-tar	posix
257	string		ustar\040\040\0		application/x-tar	gnu

0	short		070707		application/x-cpio
0	short		0143561		application/x-cpio	swapped

0	string		=<ar>		application/x-archive
0	string		\!<arch>	application/x-archive
>8	string		debian		application/x-debian-package

#------------------------------------------------------------------------------
#
# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
#
0       beshort         0xedab
>2      beshort         0xeedb          application/x-rpm

0	lelong&0x8080ffff	0x0000081a	application/x-arc	lzw
0	lelong&0x8080ffff	0x0000091a	application/x-arc	squashed
0	lelong&0x8080ffff	0x0000021a	application/x-arc	uncompressed
0	lelong&0x8080ffff	0x0000031a	application/x-arc	packed
0	lelong&0x8080ffff	0x0000041a	application/x-arc	squeezed
0	lelong&0x8080ffff	0x0000061a	application/x-arc	crunched

0	leshort	0xea60	application/x-arj

# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2	string	-lh0-	application/x-lharc	lh0
2	string	-lh1-	application/x-lharc	lh1
2	string	-lz4-	application/x-lharc	lz4
2	string	-lz5-	application/x-lharc	lz5
#	[never seen any but the last; -lh4- reported in comp.compression:]
2	string	-lzs-	application/x-lha	lzs
2	string	-lh\ -	application/x-lha	lh
2	string	-lhd-	application/x-lha	lhd
2	string	-lh2-	application/x-lha	lh2
2	string	-lh3-	application/x-lha	lh3
2	string	-lh4-	application/x-lha	lh4
2	string	-lh5-	application/x-lha	lh5
2	string	-lh6-	application/x-lha	lh6
2	string	-lh7-	application/x-lha	lh7
# Shell archives
10	string	#\ This\ is\ a\ shell\ archive	application/octet-stream	x-shell

#------------------------------------------------------------------------------
# frame:  file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0	string		\<MakerFile	application/x-frame
0	string		\<MIFFile	application/x-frame
0	string		\<MakerDictionary	application/x-frame
0	string		\<MakerScreenFon	application/x-frame
0	string		\<MML		application/x-frame
0	string		\<Book		application/x-frame
0	string		\<Maker		application/x-frame

#------------------------------------------------------------------------------
# html:  file(1) magic for HTML (HyperText Markup Language) docs
#
# from Daniel Quinlan <quinlan@yggdrasil.com>
#
0	string/cB	\<!DOCTYPE\ html	text/html
0	string/cb	\<head	text/html
0	string/cb	\<title	text/html
0       string/bc	\<html	text/html
0	string		\<!--	text/html
0	string/c	\<h1	text/html

0	string		\<?xml			text/xml

#------------------------------------------------------------------------------
# images:  file(1) magic for image formats (see also "c-lang" for XPM bitmaps)
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# XXX - byte order for GIF and TIFF fields?
# [GRR:  TIFF allows both byte orders; GIF is probably little-endian]
#

# [GRR:  what the hell is this doing in here?]
#0	string		xbtoa		btoa'd file

# PBMPLUS
#					PBM file
0	string		P1		image/x-portable-bitmap	7bit
#					PGM file
0	string		P2		image/x-portable-greymap	7bit
#					PPM file
0	string		P3		image/x-portable-pixmap	7bit
#					PBM "rawbits" file
0	string		P4		image/x-portable-bitmap
#					PGM "rawbits" file
0	string		P5		image/x-portable-greymap
#					PPM "rawbits" file
0	string		P6		image/x-portable-pixmap

# NIFF (Navy Interchange File Format, a modification of TIFF)
# [GRR:  this *must* go before TIFF]
0	string		IIN1		image/x-niff

# TIFF and friends
#					TIFF file, big-endian
0	string		MM		image/tiff
#					TIFF file, little-endian
0	string		II		image/tiff

# possible GIF replacements; none yet released!
# (Greg Roelofs, newt@uchicago.edu)
#
# GRR 950115:  this was mine ("Zip GIF"):
#					ZIF image (GIF+deflate alpha)
0	string		GIF94z		image/unknown
#
# GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
#					FGF image (GIF+deflate beta)
0	string		FGF95a		image/unknown
#
# GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
# (best; not yet implemented):
#					PBF image (deflate compression)
0	string		PBF		image/unknown

# GIF
0	string		GIF		image/gif

# JPEG images
0	beshort		0xffd8		image/jpeg

# PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
0	string		BM		image/x-ms-bmp
#>14	byte		12		(OS/2 1.x format)
#>14	byte		64		(OS/2 2.x format)
#>14	byte		40		(Windows 3.x format)
#0	string		IC		icon
#0	string		PI		pointer
#0	string		CI		color icon
#0	string		CP		color pointer
#0	string		BA		bitmap array

# CDROM Filesystems
32769    string    CD001     application/x-iso9660

# Newer StuffIt archives (grant@netbsd.org)
0	string		StuffIt			application/x-stuffit
#>162	string		>0			: %s

# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@yggdrasil.com
11	string	must\ be\ converted\ with\ BinHex\ 4	application/mac-binhex40
##>41	string	x					\b, version %.3s


#------------------------------------------------------------------------------
# lisp:  file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string	;;			text/plain	8bit
# Emacs 18 - this is always correct, but not very magical.
0	string	\012(			application/x-elc
# Emacs 19
0	string	;ELC\023\000\000\000	application/x-elc

#------------------------------------------------------------------------------
# mail.news:  file(1) magic for mail and news
#
# There are tests to ascmagic.c to cope with mail and news.
0	string		Relay-Version: 	message/rfc822	7bit
0	string		#!\ rnews	message/rfc822	7bit
0	string		N#!\ rnews	message/rfc822	7bit
0	string		Forward\ to 	message/rfc822	7bit
0	string		Pipe\ to 	message/rfc822	7bit
0	string		Return-Path:	message/rfc822	7bit
0	string		Received:	message/rfc822
0	string		Path:		message/news	8bit
0	string		Xref:		message/news	8bit
0	string		From:		message/rfc822	7bit
0	string		Article 	message/news	8bit
#------------------------------------------------------------------------------
# msword: file(1) magic for MS Word files
#
# Contributor claims:
# Reversed-engineered MS Word magic numbers
#

0	string		\376\067\0\043			application/msword
0	string		\320\317\021\340\241\261	application/msword
0	string		\333\245-\0\0\0			application/msword



#------------------------------------------------------------------------------
# printer:  file(1) magic for printer-formatted files
#

# PostScript
0	string		%!		application/postscript
0	string		\004%!		application/postscript

# Acrobat
# (due to clamen@cs.cmu.edu)
0	string		%PDF-		application/pdf

#------------------------------------------------------------------------------
# sc:  file(1) magic for "sc" spreadsheet
#
38	string		Spreadsheet	application/x-sc

#------------------------------------------------------------------------------
# tex:  file(1) magic for TeX files
#
# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
#
# From <conklin@talisman.kaleida.com>

# Although we may know the offset of certain text fields in TeX DVI
# and font files, we can't use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0	string		\367\002	application/x-dvi
#0	string		\367\203	TeX generic font data
#0	string		\367\131	TeX packed font data
#0	string		\367\312	TeX virtual font data
#0	string		This\ is\ TeX,	TeX transcript text	
#0	string		This\ is\ METAFONT,	METAFONT transcript text

# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data.  The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2	string		\000\021	application/x-tex-tfm
2	string		\000\022	application/x-tex-tfm
#>34	string		>\0		(%s)

# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\\input\ texinfo		text/x-texinfo
0	string		This\ is\ Info\ file	text/x-info

# correct TeX magic for Linux (and maybe more)
# from Peter Tobias (tobias@server.et-inf.fho-emden.de)
#
0	leshort		0x02f7		application/x-dvi

# RTF - Rich Text Format
0	string		{\\rtf		text/rtf

#------------------------------------------------------------------------------
# animation:  file(1) magic for animation/movie formats
#
# animation formats, originally from vax@ccwf.cc.utexas.edu (VaX#n8)
#						MPEG file
# MPEG sequences
0       belong             0x000001BA
>4      byte               &0x40          video/mp2p
>4      byte               ^0x40          video/mpeg
0       belong             0x000001BB     video/mpeg
0       belong             0x000001B0     video/mp4v-es
0       belong             0x000001B5     video/mp4v-es
0       belong             0x000001B3     video/mpv
0       belong&0xFF5FFF1F  0x47400010     video/mp2t
0       belong             0x00000001
>4      byte&0x1F          0x07           video/h264

# FLI animation format
0	leshort		0xAF11				video/fli
# FLC animation format
0	leshort		0xAF12				video/flc
#
# SGI and Apple formats
# Added ISO mimes
0	string		MOVI	      video/sgi
4	string		moov	      video/quicktime
4	string		mdat	      video/quicktime
4	string		wide	      video/quicktime
4	string		skip	      video/quicktime
4	string		free	      video/quicktime
4	string		idsc	      image/x-quicktime
4	string		idat	      image/x-quicktime
4	string		pckg	      application/x-quicktime
4	string/B	jP	      image/jp2
4	string		ftyp
>8	string		isom	      video/mp4
>8	string		mp41	      video/mp4
>8	string		mp42	      video/mp4
>8	string/B	jp2	      image/jp2
>8	string		3gp	      video/3gpp
>8      string          avc1          video/3gpp
>8	string		mmp4	      video/mp4
>8	string/B	M4A	      audio/mp4
>8	string/B	qt	      video/quicktime
# The contributor claims:
#   I couldn't find a real magic number for these, however, this
#   -appears- to work.  Note that it might catch other files, too,
#   so BE CAREFUL!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)! DL format SUCKS BIG ROCKS.
#
#						DL file version 1 , medium format (160x100, 4 images/screen)
0	byte		1			video/unknown
0	byte		2			video/unknown
#
# Databases
#
# GDBM magic numbers
#  Will be maintained as part of the GDBM distribution in the future.
#  <downsj@teeny.org>
0       belong  0x13579ace      application/x-gdbm
0       lelong  0x13579ace      application/x-gdbm
0       string  GDBM            application/x-gdbm
#
0       belong  0x061561        application/x-dbm
#
# Executables
#
0	string		\177ELF 
>16	leshort		0		application/octet-stream
>16	leshort		1		application/x-object
>16	leshort		2		application/x-executable
>16	leshort		3		application/x-sharedlib
>16	leshort		4		application/x-coredump
>16	beshort		0		application/octet-stream
>16	beshort		1		application/x-object
>16	beshort		2		application/x-executable
>16	beshort		3		application/x-sharedlib
>16	beshort		4		application/x-coredump
#
# DOS
0		string			MZ				application/x-dosexec
#
# KDE
0		string	[KDE\ Desktop\ Entry]	application/x-kdelnk
0		string	\#\ KDE\ Config\ File	application/x-kdelnk
# xmcd database file for kscd
0		string	\#\ xmcd                text/xmcd

#------------------------------------------------------------------------------
# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
#
0       string          #\ PaCkAgE\ DaTaStReAm  application/x-svr4-package

#PNG Image Format
0	string		\x89PNG			image/png

# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
0	string		\x8aMNG			video/x-mng
0	string		\x8aJNG			video/x-jng

#------------------------------------------------------------------------------
# Hierarchical Data Format, used to facilitate scientific data exchange
# specifications at http://hdf.ncsa.uiuc.edu/
#Hierarchical Data Format (version 4) data
0	belong		0x0e031301		application/x-hdf
#Hierarchical Data Format (version 5) data
0	string		\211HDF\r\n\032		application/x-hdf

# Adobe Photoshop
0	string		8BPS			image/x-photoshop

# Felix von Leitner <felix-file@fefe.de>
0	string		d8:announce		application/x-bittorrent


# lotus 1-2-3 document
0	belong	0x00001a00	application/x-123
0	belong	0x00000200 	application/x-123

# MS Access database
4	string	Standard\ Jet\ DB	application/msaccess

## magic for XBase files
#0      byte       0x02	
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x03	
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x04	
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x05	
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x30
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x43
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x7b
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x83	
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x8b
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x8e	
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0xb3
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0xf5
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0	leshort		0x0006		application/x-dbt

# Debian has entries for the old PGP formats:
# pgp:  file(1) magic for Pretty Good Privacy
# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
#text/PGP key public ring
0	beshort		0x9900			application/pgp
#text/PGP key security ring
0	beshort		0x9501			application/pgp
#text/PGP key security ring
0	beshort		0x9500			application/pgp
#text/PGP encrypted data
0	beshort		0xa600			application/pgp-encrypted
#text/PGP armored data
##public key block
2	string	---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK-	application/pgp-keys
0	string	-----BEGIN\040PGP\40MESSAGE-			application/pgp
0	string	-----BEGIN\040PGP\40SIGNATURE-			application/pgp-signature
#
# GnuPG Magic:
# 
#
#text/GnuPG key public ring
0	beshort		0x9901			application/pgp
#text/OpenPGP data
0	beshort		0x8501			application/pgp-encrypted	

# flash:        file(1) magic for Macromedia Flash file format
#
# See
#
#       http://www.macromedia.com/software/flash/open/
#
0	string		FWS             
>3	byte		x			application/x-shockwave-flash

# The following paramaters are created for Namazu.
# <http://www.namazu.org/>
#
# 1999/08/13
#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc
0	string		BZh			application/x-bzip2

# 1999/09/09
# VRML (suggested by Masao Takaku)
0	string		#VRML\ V1.0\ ascii	model/vrml
0	string		#VRML\ V2.0\ utf8	model/vrml

#------------------------------------------------------------------------------
# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
#
# Contributor kenzo-:
# Reversed-engineered JS Ichitaro magic numbers
#

0	string		DOC
>43	byte		0x14		application/ichitaro4
>144	string	JDASH		application/ichitaro4

0	string		DOC
>43	byte		0x15		application/ichitaro5

0	string		DOC
>43	byte		0x16		application/ichitaro6

#------------------------------------------------------------------------------
# office97: file(1) magic for MicroSoft Office files
#
# Contributor kenzo-:
# Reversed-engineered MS Office magic numbers
#

#0       string          \320\317\021\340\241\261\032\341
#>48     byte            0x1B            application/excel

2080	string	Microsoft\ Excel\ 5.0\ Worksheet	application/excel
2114	string	Biff5					application/excel

0       string	\224\246\056		application/msword

0	belong	0x31be0000		application/msword

0	string	PO^Q`			application/msword

0	string	\320\317\021\340\241\261\032\341
>546	string	bjbj			application/msword
>546	string	jbjb			application/msword

512	string	R\0o\0o\0t\0\ \0E\0n\0t\0r\0y	application/msword

2080	string	Microsoft\ Word\ 6.0\ Document	application/msword
2080	string	Documento\ Microsoft\ Word\ 6	application/msword
2112	string	MSWordDoc			application/msword

#0	string	\320\317\021\340\241\261\032\341	application/powerpoint
0	string	\320\317\021\340\241\261\032\341	application/msword

0       string  #\ PaCkAgE\ DaTaStReAm  application/x-svr4-package


# WinNT/WinCE PE files (Warner Losh, imp@village.org)
#
128		string	PE\000\000	application/octet-stream
0		string	PE\000\000	application/octet-stream

# miscellaneous formats
0		string	LZ		application/octet-stream


# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
0		string	MZ
>24		string	@		application/octet-stream

0		string	MZ
>30		string	Copyright\ 1989-1990\ PKWARE\ Inc.	application/x-zip

0		string	MZ
>30		string	PKLITE\ Copr.	application/x-zip

0		string	MZ
>36		string	LHa's\ SFX	application/x-lha

0		string	MZ		application/octet-stream

# LHA archiver
2		string	-lh
>6		string	-		application/x-lha


# Zoo archiver
20		lelong	0xfdc4a7dc	application/x-zoo

# ARC archiver
0       	lelong&0x8080ffff	0x0000081a	application/x-arc
0		lelong&0x8080ffff	0x0000091a	application/x-arc
0		lelong&0x8080ffff	0x0000021a	application/x-arc
0		lelong&0x8080ffff	0x0000031a	application/x-arc
0		lelong&0x8080ffff	0x0000041a	application/x-arc
0		lelong&0x8080ffff	0x0000061a	application/x-arc

# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
0		lelong	0x223e9f78	application/ms-tnef

# From: stephane.loeuillet@tiscali.f
# http://www.djvuzone.org/
0	string		AT&TFORM	image/x.djvu

# Danny Milosavljevic <danny.milo@gmx.net>
# this are adrift (adventure game standard) game files, extension .taf
# depending on version magic continues with 0x93453E6139FA (V 4.0)
# 0x9445376139FA (V 3.90)
# 0x9445366139FA (V 3.80)
# this is from source (http://www.adrift.org.uk/) and I have some taf
# files, and checked them.
#0	belong	0x3C423FC9
#>4	belong	0x6A87C2CF	application/x-adrift
#0	string	\000\000\001\000	image/x-ico

# Quark Xpress 3 Files:
# (made the mimetype up) 
0	string	\0\0MMXPR3\0	application/x-quark-xpress-3

# EET archive
# From: Tilman Sauerbeck <tilman@code-monkey.de>
0	belong	0x1ee7ff00	application/x-eet

# From: Denis Knauf, via gentoo.
0	string	fLaC		audio/x-flac
0	string	CWS		application/x-shockwave-flash

# Gnumeric spreadsheet
# This entry is only semi-helpful, as Gnumeric compresses its files, so
# they will ordinarily reported as "compressed", but at least -z helps
39      string          =<gmr:Workbook           application/x-gnumeric