freebsd 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164
  1. #------------------------------------------------------------------------------
  2. # $File: freebsd,v 1.9 2022/01/19 12:44:13 christos Exp $
  3. # freebsd: file(1) magic for FreeBSD objects
  4. #
  5. # All new-style FreeBSD magic numbers are in host byte order (i.e.,
  6. # little-endian on x86).
  7. #
  8. # XXX - this comes from the file "freebsd" in a recent FreeBSD version of
  9. # "file"; it, and the NetBSD stuff in "netbsd", appear to use different
  10. # schemes for distinguishing between executable images, shared libraries,
  11. # and object files.
  12. #
  13. # FreeBSD says:
  14. #
  15. # Regardless of whether it's pure, demand-paged, or none of the
  16. # above:
  17. #
  18. # if the entry point is < 4096, then it's a shared library if
  19. # the "has run-time loader information" bit is set, and is
  20. # position-independent if the "is position-independent" bit
  21. # is set;
  22. #
  23. # if the entry point is >= 4096 (or >4095, same thing), then it's
  24. # an executable, and is dynamically-linked if the "has run-time
  25. # loader information" bit is set.
  26. #
  27. # On x86, NetBSD says:
  28. #
  29. # If it's neither pure nor demand-paged:
  30. #
  31. # if it has the "has run-time loader information" bit set, it's
  32. # a dynamically-linked executable;
  33. #
  34. # if it doesn't have that bit set, then:
  35. #
  36. # if it has the "is position-independent" bit set, it's
  37. # position-independent;
  38. #
  39. # if the entry point is non-zero, it's an executable, otherwise
  40. # it's an object file.
  41. #
  42. # If it's pure:
  43. #
  44. # if it has the "has run-time loader information" bit set, it's
  45. # a dynamically-linked executable, otherwise it's just an
  46. # executable.
  47. #
  48. # If it's demand-paged:
  49. #
  50. # if it has the "has run-time loader information" bit set,
  51. # then:
  52. #
  53. # if the entry point is < 4096, it's a shared library;
  54. #
  55. # if the entry point is = 4096 or > 4096 (i.e., >= 4096),
  56. # it's a dynamically-linked executable);
  57. #
  58. # if it doesn't have the "has run-time loader information" bit
  59. # set, then it's just an executable.
  60. #
  61. # (On non-x86, NetBSD does much the same thing, except that it uses
  62. # 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
  63. # pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
  64. # had 8K pages; dunno about MIPS.)
  65. #
  66. # I suspect the two will differ only in perverse and uninteresting cases
  67. # ("shared" libraries that aren't demand-paged and whose pages probably
  68. # won't actually be shared, executables with entry points <4096).
  69. #
  70. # I leave it to those more familiar with FreeBSD and NetBSD to figure out
  71. # what the right answer is (although using ">4095", FreeBSD-style, is
  72. # probably better than separately checking for "=4096" and ">4096",
  73. # NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
  74. # executables using the NetBSD technique.)
  75. #
  76. 0 lelong&0377777777 041400407 FreeBSD/i386
  77. >20 lelong <4096
  78. >>3 byte&0xC0 &0x80 shared library
  79. >>3 byte&0xC0 0x40 PIC object
  80. >>3 byte&0xC0 0x00 object
  81. >20 lelong >4095
  82. >>3 byte&0x80 0x80 dynamically linked executable
  83. >>3 byte&0x80 0x00 executable
  84. >16 lelong >0 not stripped
  85. 0 lelong&0377777777 041400410 FreeBSD/i386 pure
  86. >20 lelong <4096
  87. >>3 byte&0xC0 &0x80 shared library
  88. >>3 byte&0xC0 0x40 PIC object
  89. >>3 byte&0xC0 0x00 object
  90. >20 lelong >4095
  91. >>3 byte&0x80 0x80 dynamically linked executable
  92. >>3 byte&0x80 0x00 executable
  93. >16 lelong >0 not stripped
  94. 0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
  95. >20 lelong <4096
  96. >>3 byte&0xC0 &0x80 shared library
  97. >>3 byte&0xC0 0x40 PIC object
  98. >>3 byte&0xC0 0x00 object
  99. >20 lelong >4095
  100. >>3 byte&0x80 0x80 dynamically linked executable
  101. >>3 byte&0x80 0x00 executable
  102. >16 lelong >0 not stripped
  103. 0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
  104. >20 lelong <4096
  105. >>3 byte&0xC0 &0x80 shared library
  106. >>3 byte&0xC0 0x40 PIC object
  107. >>3 byte&0xC0 0x00 object
  108. >20 lelong >4095
  109. >>3 byte&0x80 0x80 dynamically linked executable
  110. >>3 byte&0x80 0x00 executable
  111. >16 lelong >0 not stripped
  112. # XXX gross hack to identify core files
  113. # cores start with a struct tss; we take advantage of the following:
  114. # byte 7: highest byte of the kernel stack pointer, always 0xfe
  115. # 8/9: kernel (ring 0) ss value, always 0x0010
  116. # 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
  117. # 28: low order byte of the current PTD entry, always 0 since the
  118. # PTD is page-aligned
  119. #
  120. 7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
  121. >1039 string >\0 from '%s'
  122. # /var/run/ld.so.hints
  123. # What are you laughing about?
  124. 0 lelong 011421044151 ld.so hints file (Little Endian
  125. >4 lelong >0 \b, version %d)
  126. >4 belong <1 \b)
  127. 0 belong 011421044151 ld.so hints file (Big Endian
  128. >4 belong >0 \b, version %d)
  129. >4 belong <1 \b)
  130. #
  131. # Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
  132. #
  133. 0 string SCRSHOT_ scrshot(1) screenshot,
  134. >8 byte x version %d,
  135. >9 byte 2 %d bytes in header,
  136. >>10 byte x %d chars wide by
  137. >>11 byte x %d chars high
  138. #
  139. # FreeBSD kernel minidumps
  140. #
  141. 0 string minidump\040FreeBSD/ FreeBSD kernel minidump
  142. # powerpc uses 32-byte magic, followed by 32-byte mmu kind, then version
  143. >17 string powerpc
  144. >>17 string >\0 for %s,
  145. >>>32 string >\0 %s,
  146. >>>>64 byte 0 big endian,
  147. >>>>>64 belong x version %d
  148. >>>>64 default x little endian,
  149. >>>>>64 lelong x version %d
  150. # all other architectures use 24-byte magic, followed by version
  151. >17 default x
  152. >>17 string >\0 for %s,
  153. >>>24 byte 0 big endian,
  154. >>>>24 belong x version %d
  155. >>>24 default x little endian,
  156. >>>>24 lelong x version %d