database 30 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838
  1. #------------------------------------------------------------------------------
  2. # $File: database,v 1.67 2022/07/12 18:57:42 christos Exp $
  3. # database: file(1) magic for various databases
  4. #
  5. # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
  6. #
  7. #
  8. # GDBM magic numbers
  9. # Will be maintained as part of the GDBM distribution in the future.
  10. # <downsj@teeny.org>
  11. 0 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit
  12. !:mime application/x-gdbm
  13. 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old
  14. !:mime application/x-gdbm
  15. 0 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit
  16. !:mime application/x-gdbm
  17. 0 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit
  18. !:mime application/x-gdbm
  19. 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old
  20. !:mime application/x-gdbm
  21. 0 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit
  22. !:mime application/x-gdbm
  23. 0 string GDBM GNU dbm 2.x database
  24. !:mime application/x-gdbm
  25. #
  26. # Berkeley DB
  27. #
  28. # Ian Darwin's file /etc/magic files: big/little-endian version.
  29. #
  30. # Hash 1.85/1.86 databases store metadata in network byte order.
  31. # Btree 1.85/1.86 databases store the metadata in host byte order.
  32. # Hash and Btree 2.X and later databases store the metadata in host byte order.
  33. 0 long 0x00061561 Berkeley DB
  34. !:mime application/x-dbm
  35. >8 belong 4321
  36. >>4 belong >2 1.86
  37. >>4 belong <3 1.85
  38. >>4 belong >0 (Hash, version %d, native byte-order)
  39. >8 belong 1234
  40. >>4 belong >2 1.86
  41. >>4 belong <3 1.85
  42. >>4 belong >0 (Hash, version %d, little-endian)
  43. 0 belong 0x00061561 Berkeley DB
  44. >8 belong 4321
  45. >>4 belong >2 1.86
  46. >>4 belong <3 1.85
  47. >>4 belong >0 (Hash, version %d, big-endian)
  48. >8 belong 1234
  49. >>4 belong >2 1.86
  50. >>4 belong <3 1.85
  51. >>4 belong >0 (Hash, version %d, native byte-order)
  52. 0 long 0x00053162 Berkeley DB 1.85/1.86
  53. >4 long >0 (Btree, version %d, native byte-order)
  54. 0 belong 0x00053162 Berkeley DB 1.85/1.86
  55. >4 belong >0 (Btree, version %d, big-endian)
  56. 0 lelong 0x00053162 Berkeley DB 1.85/1.86
  57. >4 lelong >0 (Btree, version %d, little-endian)
  58. 12 long 0x00061561 Berkeley DB
  59. >16 long >0 (Hash, version %d, native byte-order)
  60. 12 belong 0x00061561 Berkeley DB
  61. >16 belong >0 (Hash, version %d, big-endian)
  62. 12 lelong 0x00061561 Berkeley DB
  63. >16 lelong >0 (Hash, version %d, little-endian)
  64. 12 long 0x00053162 Berkeley DB
  65. >16 long >0 (Btree, version %d, native byte-order)
  66. 12 belong 0x00053162 Berkeley DB
  67. >16 belong >0 (Btree, version %d, big-endian)
  68. 12 lelong 0x00053162 Berkeley DB
  69. >16 lelong >0 (Btree, version %d, little-endian)
  70. 12 long 0x00042253 Berkeley DB
  71. >16 long >0 (Queue, version %d, native byte-order)
  72. 12 belong 0x00042253 Berkeley DB
  73. >16 belong >0 (Queue, version %d, big-endian)
  74. 12 lelong 0x00042253 Berkeley DB
  75. >16 lelong >0 (Queue, version %d, little-endian)
  76. # From Max Bowsher.
  77. 12 long 0x00040988 Berkeley DB
  78. >16 long >0 (Log, version %d, native byte-order)
  79. 12 belong 0x00040988 Berkeley DB
  80. >16 belong >0 (Log, version %d, big-endian)
  81. 12 lelong 0x00040988 Berkeley DB
  82. >16 lelong >0 (Log, version %d, little-endian)
  83. #
  84. #
  85. # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
  86. 0 string/b RRD\0 RRDTool DB
  87. >4 string/b x version %s
  88. >>10 short !0 16bit aligned
  89. >>>10 bedouble 8.642135e+130 big-endian
  90. >>>>18 short x 32bit long (m68k)
  91. >>10 short 0
  92. >>>12 long !0 32bit aligned
  93. >>>>12 bedouble 8.642135e+130 big-endian
  94. >>>>>20 long 0 64bit long
  95. >>>>>20 long !0 32bit long
  96. >>>>12 ledouble 8.642135e+130 little-endian
  97. >>>>>24 long 0 64bit long
  98. >>>>>24 long !0 32bit long (i386)
  99. >>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian
  100. >>>>>24 short !0 32bit long (arm)
  101. >>8 quad 0 64bit aligned
  102. >>>16 bedouble 8.642135e+130 big-endian
  103. >>>>24 long 0 64bit long (s390x)
  104. >>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC)
  105. >>>16 ledouble 8.642135e+130 little-endian
  106. >>>>28 long 0 64bit long (alpha/amd64/ia64)
  107. >>>>28 long !0 32bit long (armel/mipsel)
  108. #----------------------------------------------------------------------
  109. # ROOT: file(1) magic for ROOT databases
  110. #
  111. 0 string root\0 ROOT file
  112. >4 belong x Version %d
  113. >33 belong x (Compression: %d)
  114. # XXX: Weak magic.
  115. # Alex Ott <ott@jet.msk.su>
  116. ## Paradox file formats
  117. #2 leshort 0x0800 Paradox
  118. #>0x39 byte 3 v. 3.0
  119. #>0x39 byte 4 v. 3.5
  120. #>0x39 byte 9 v. 4.x
  121. #>0x39 byte 10 v. 5.x
  122. #>0x39 byte 11 v. 5.x
  123. #>0x39 byte 12 v. 7.x
  124. #>>0x04 byte 0 indexed .DB data file
  125. #>>0x04 byte 1 primary index .PX file
  126. #>>0x04 byte 2 non-indexed .DB data file
  127. #>>0x04 byte 3 non-incrementing secondary index .Xnn file
  128. #>>0x04 byte 4 secondary index .Ynn file
  129. #>>0x04 byte 5 incrementing secondary index .Xnn file
  130. #>>0x04 byte 6 non-incrementing secondary index .XGn file
  131. #>>0x04 byte 7 secondary index .YGn file
  132. #>>>0x04 byte 8 incrementing secondary index .XGn file
  133. ## XBase database files
  134. # updated by Joerg Jenderek at Feb 2013
  135. # https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
  136. # https://www.clicketyclick.dk/databases/xbase/format/dbf.html
  137. # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
  138. 0 ubelong&0x0000FFFF <0x00000C20
  139. !:strength +10
  140. # skip Infocom game Z-machine
  141. >2 ubyte >0
  142. # skip Androids *.xml
  143. >>3 ubyte >0
  144. >>>3 ubyte <32
  145. # 1 < version VV
  146. >>>>0 ubyte >1
  147. # skip HELP.CA3 by test for reserved byte ( NULL )
  148. >>>>>27 ubyte 0
  149. # reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
  150. #>>>>>30 ubeshort x 30NULL?%x
  151. # possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
  152. >>>>>>24 ubelong&0xffFFFFff >0x01302000
  153. # .DBF or .MDX
  154. >>>>>>24 ubelong&0xffFFFFff <0x01302001
  155. # for Xbase Database file (*.DBF) reserved (NULL) for multi-user
  156. >>>>>>>24 ubelong&0xffFFFFff =0
  157. # test for 2 reserved NULL bytes,transaction and encryption byte flag
  158. >>>>>>>>12 ubelong&0xFFFFfEfE 0
  159. # test for MDX flag
  160. >>>>>>>>>28 ubyte x
  161. >>>>>>>>>28 ubyte&0xf8 0
  162. # header size >= 32
  163. >>>>>>>>>>8 uleshort >31
  164. # skip PIC15736.PCX by test for language driver name or field name
  165. >>>>>>>>>>>32 ubyte >0
  166. #!:mime application/x-dbf; charset=unknown-8bit ??
  167. #!:mime application/x-dbase
  168. >>>>>>>>>>>>0 use xbase-type
  169. # database file
  170. >>>>>>>>>>>>28 ubyte&0x04 =0 \b DBF
  171. !:ext dbf
  172. >>>>>>>>>>>>28 ubyte&0x04 =4 \b DataBaseContainer
  173. !:ext dbc
  174. >>>>>>>>>>>>4 lelong 0 \b, no records
  175. >>>>>>>>>>>>4 lelong >0 \b, %d record
  176. # plural s appended
  177. >>>>>>>>>>>>>4 lelong >1 \bs
  178. # https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
  179. # 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
  180. >>>>>>>>>>>>10 uleshort x * %d
  181. # file size = records * record size + header size
  182. >>>>>>>>>>>>1 ubyte x \b, update-date
  183. >>>>>>>>>>>>1 use xbase-date
  184. # https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
  185. #>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=%#x
  186. # 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
  187. >>>>>>>>>>>>29 ubyte >0 \b, codepage ID=%#x
  188. #>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file
  189. # MDX or CDX index
  190. >>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX
  191. >>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
  192. #>>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
  193. # 1st record offset + 1 = header size
  194. >>>>>>>>>>>>8 uleshort >0
  195. >>>>>>>>>>>>(8.s+1) ubyte >0
  196. >>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
  197. >>>>>>>>>>>>>(8.s+1) ubyte >0
  198. >>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
  199. # for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
  200. >>>>>>>24 ubelong&0x0133f7ff >0
  201. # test for reserved NULL byte
  202. >>>>>>>>47 ubyte 0
  203. # test for valid TAG key format (0x10 or 0)
  204. >>>>>>>>>559 ubyte&0xeF 0
  205. # test MM <= 12
  206. >>>>>>>>>>45 ubeshort <0x0C20
  207. >>>>>>>>>>>45 ubyte >0
  208. >>>>>>>>>>>>46 ubyte <32
  209. >>>>>>>>>>>>>46 ubyte >0
  210. #!:mime application/x-mdx
  211. >>>>>>>>>>>>>>0 use xbase-type
  212. >>>>>>>>>>>>>>0 ubyte x \b MDX
  213. >>>>>>>>>>>>>>1 ubyte x \b, creation-date
  214. >>>>>>>>>>>>>>1 use xbase-date
  215. >>>>>>>>>>>>>>44 ubyte x \b, update-date
  216. >>>>>>>>>>>>>>44 use xbase-date
  217. # No.of tags in use (1,2,5,12)
  218. >>>>>>>>>>>>>>28 uleshort x \b, %d
  219. # No. of entries in tag (0x30)
  220. >>>>>>>>>>>>>>25 ubyte x \b/%d tags
  221. # Length of tag
  222. >>>>>>>>>>>>>>26 ubyte x * %d
  223. # 1st tag name_
  224. >>>>>>>>>>>>>548 string x \b, 1st tag "%.11s"
  225. # 2nd tag name
  226. #>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
  227. #
  228. # Print the xBase names of different version variants
  229. 0 name xbase-type
  230. >0 ubyte <2
  231. # 1 < version
  232. >0 ubyte >1
  233. >>0 ubyte 0x02 FoxBase
  234. !:mime application/x-dbf
  235. # like: ACCESS.DBF USER.DBF dbase3date.dbf mitarbei.dbf produkte.dbf umlaut-test-v2.dbf
  236. # FoxBase+/dBaseIII+, no memo
  237. >>0 ubyte 0x03 FoxBase+/dBase III
  238. !:mime application/x-dbf
  239. # like: 92DATA.DBF MSCATLOG.DBF SYLLABI2.DBF SYLLABUS.DBF T4.DBF Teleadr.dbf us_city.dbf
  240. # dBASE IV no memo file
  241. >>0 ubyte 0x04 dBase IV
  242. !:mime application/x-dbf
  243. # like: Quattro-test11.dbf umlaut-test-v4.dbf
  244. # dBASE V no memo file
  245. >>0 ubyte 0x05 dBase V
  246. !:mime application/x-dbf
  247. # like: dbase4double.dbf Quattro-test2.dbf umlaut-test7.dbf
  248. !:ext dbf
  249. # probably Apollo Database Server 9.7? xBase (0x6)
  250. >>0 ubyte 0x06 Apollo
  251. !:mime application/x-dbf
  252. # like: ALIAS.DBF CRYPT.DBF PROCS.DBF USERS.DBF
  253. # https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
  254. >>0 ubyte 0x2F FoxBase+/Dbase III plus, no memo
  255. !:mime application/x-dbf
  256. # no example
  257. >>0 ubyte 0x30 Visual FoxPro
  258. !:mime application/x-dbf
  259. # like: 26FRX.DBF 30DBC.DBF 30DBCPRO.DBF BEHINDSC.DBF USER_LEV.DBF
  260. # Microsoft Visual FoxPro Database Container File like: FOXPRO-DB-TEST.DBC TESTDATA.DBC TASTRADE.DBC
  261. >>0 ubyte 0x31 Visual FoxPro, autoincrement
  262. !:mime application/x-dbf
  263. # like: AI_Table.DBF dbase_31.dbf w_cityFoxpro.dbf
  264. # Visual FoxPro, with field type Varchar or Varbinary
  265. >>0 ubyte 0x32 Visual FoxPro, with field type Varchar
  266. !:mime application/x-dbf
  267. # like: dbase_32.dbf
  268. # dBASE IV SQL, no memo;dbv memo var size (Flagship)
  269. >>0 ubyte 0x43 dBase IV, with SQL table
  270. !:mime application/x-dbf
  271. # like: ASSEMBLY.DBF INVENTRY.DBF STAFF.DBF
  272. # https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
  273. >>0 ubyte 0x62 dBase IV, with SQL table
  274. #!:mime application/x-dbf
  275. # no example
  276. # dBASE IV, with memo!!
  277. >>0 ubyte 0x7b dBase IV, with memo
  278. !:mime application/x-dbf
  279. # like: test3memo.DBF dbase5.DBF
  280. # https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
  281. >>0 ubyte 0x82 dBase IV, with SQL system
  282. #!:mime application/x-dbf
  283. # no example
  284. # FoxBase+/dBaseIII+ with memo .DBT!
  285. >>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT
  286. !:mime application/x-dbf
  287. # like: T2.DBF t3.DBF biblio.dbf dbase_83.dbf dbase3dbt0_4.dbf fsadress.dbf stop.dbf
  288. # VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
  289. >>0 ubyte 0x87 VISUAL OBJECTS, with memo file
  290. !:mime application/x-dbf
  291. # like: ACCESS.DBF dbase3date.dbf dbase3float.dbf holdings.dbf mitarbei.dbf
  292. # https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
  293. >>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
  294. #!:mime application/x-dbf
  295. # no example
  296. # dBASE IV with memo!
  297. >>0 ubyte 0x8B dBase IV, with memo .DBT
  298. !:mime application/x-dbf
  299. # like: animals.dbf archive.dbf callin.dbf dbase_8b.dbf phnebook.dbf t6.dbf
  300. # dBase IV with SQL Table,no memo?
  301. >>0 ubyte 0x8E dBase IV, with SQL table
  302. !:mime application/x-dbf
  303. # like: dbase5.DBF test3memo.DBF test-memo.DBF
  304. # .dbv and .dbt memo (Flagship)?
  305. >>0 ubyte 0xB3 Flagship
  306. !:mime application/x-dbf
  307. # no example
  308. # https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
  309. >>0 ubyte 0xCA dBase IV with memo .DBT
  310. #!:mime application/x-dbf
  311. # no example
  312. # dBASE IV with SQL table, with memo .DBT
  313. >>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
  314. !:mime application/x-dbf
  315. # like: dbase5.DBF test3memo.DBF test-memo.DBF
  316. # HiPer-Six format;Clipper SIX, with SMT memo file
  317. >>0 ubyte 0xE5 Clipper SIX with memo
  318. !:mime application/x-dbf
  319. # like: dbase5.DBF test3memo.DBF test-memo.DBF testClipper.dbf DATA.DBF
  320. # https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
  321. >>0 ubyte 0xF4 dBase IV, with SQL table, with memo
  322. #!:mime application/x-dbf
  323. # no example
  324. >>0 ubyte 0xF5 FoxPro with memo
  325. !:mime application/x-dbf
  326. # like: CUSTOMER.DBF FOXUSER1.DBF Invoice.DBF NG.DBF OBJSAMP.DBF dbase_f5.dbf kunde.dbf
  327. # probably Apollo Database Server 9.7 with SQL and memo mask? xBase (0xF6)
  328. >>0 ubyte 0xF6 Apollo, with SQL table with memo
  329. !:mime application/x-dbf
  330. # like: SCRIPTS.DBF
  331. # https://docs.microsoft.com/en-us/previous-versions/visualstudio/foxpro/st4a0s68(v=vs.80)
  332. #>>0 ubyte 0xFA FoxPro 2.x, with memo
  333. #!:mime application/x-dbf
  334. # no example
  335. # unknown version (should not happen)
  336. >>0 default x xBase
  337. !:mime application/x-dbf
  338. >>>0 ubyte x (%#x)
  339. # flags in version byte
  340. # DBT flag (with dBASE III memo .DBT)!!
  341. # >>0 ubyte&0x80 >0 DBT_FLAG=%x
  342. # memo flag ??
  343. # >>0 ubyte&0x08 >0 MEMO_FLAG=%x
  344. # SQL flag ??
  345. # >>0 ubyte&0x70 >0 SQL_FLAG=%x
  346. # test and print the date of xBase .DBF .MDX
  347. 0 name xbase-date
  348. # inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
  349. >0 ubelong x
  350. >1 ubyte <13
  351. >>1 ubyte >0
  352. >>>2 ubyte >0
  353. >>>>2 ubyte <32
  354. >>>>>0 ubyte x
  355. # YY is interpreted as 20YY or 19YY
  356. >>>>>>0 ubyte <100 \b %.2d
  357. # YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
  358. >>>>>>0 ubyte >99 \b %d
  359. >>>>>1 ubyte x \b-%d
  360. >>>>>2 ubyte x \b-%d
  361. # dBase memo files .DBT or .FPT
  362. # https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
  363. 16 ubyte <4
  364. >16 ubyte !2
  365. >>16 ubyte !1
  366. # next free block index is positive
  367. >>>0 ulelong >0
  368. # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
  369. >>>>17 ubelong&0xFFfdFEff 0x00000000
  370. # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
  371. >>>>>20 ubelong&0xFF01209B 0x00000000
  372. # dBASE III
  373. >>>>>>16 ubyte 3
  374. # dBASE III DBT
  375. >>>>>>>0 use dbase3-memo-print
  376. # dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
  377. >>>>>>16 ubyte 0
  378. # unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF
  379. >>>>>>>20 uleshort 0
  380. # FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
  381. >>>>>>>>8 ulong =0
  382. >>>>>>>>>6 ubeshort >0
  383. # skip emacs.PIF
  384. >>>>>>>>>>4 ushort 0
  385. # check for valid FoxPro field type
  386. >>>>>>>>>>>512 ubelong <3
  387. # skip LXMDCLN4.OUT LXMDCLN6.OUT LXMDALG6.OUT with invalid blocksize 170=AAh
  388. >>>>>>>>>>>>6 ubeshort&0x002f 0
  389. >>>>>>>>>>>>>0 use foxpro-memo-print
  390. # dBASE III DBT , garbage
  391. # skip WORD1XW.DOC with improbably high free block index
  392. >>>>>>>>>0 ulelong <0x400000
  393. # skip WinStore.App.exe by looking for printable 2nd character of 1st memo item
  394. >>>>>>>>>>513 ubyte >037
  395. # skip DOS executables CPQ0TD.DRV E30ODI.COM IBM0MONO.DRV by looking for printable 1st character of 1st memo item
  396. >>>>>>>>>>>512 ubyte >037
  397. # unusual dBASE III DBT like adressen.dbt
  398. >>>>>>>>>>>>0 use dbase3-memo-print
  399. # dBASE III DBT like angest.dbt, or garbage PCX DBF
  400. >>>>>>>>8 ubelong !0
  401. # skip PCX and some DBF by test for for reserved NULL bytes
  402. >>>>>>>>>510 ubeshort 0
  403. # skip bad symples with improbably high free block index above 2 GiB file limit
  404. >>>>>>>>>>0 ulelong <0x400000
  405. # skip AI070GEP.EPS by printable 1st character of 1st memo item
  406. >>>>>>>>>>>512 ubyte >037
  407. # skip some Microsoft Visual C, OMF library like: BZ2.LIB WATTCPWL.LIB ZLIB.LIB
  408. >>>>>>>>>>>>512 ubyte <0200
  409. # skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character
  410. >>>>>>>>>>>>>513 ubyte >037
  411. >>>>>>>>>>>>>>0 use dbase3-memo-print
  412. # dBASE IV DBT with positive block size
  413. >>>>>>>20 uleshort >0
  414. # dBASE IV DBT with valid block length like 512, 1024
  415. # multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
  416. # skip also 3600h 3E00h size
  417. >>>>>>>>20 uleshort&0xE00f 0
  418. >>>>>>>>>0 use dbase4-memo-print
  419. # Print the information of dBase III DBT memo file
  420. 0 name dbase3-memo-print
  421. >0 ubyte x dBase III DBT
  422. !:mime application/x-dbt
  423. !:ext dbt
  424. # instead 3 as version number 0 for unusual examples like biblio.dbt
  425. >16 ubyte !3 \b, version number %u
  426. # Number of next available block for appending data
  427. #>0 lelong =0 \b, next free block index %u
  428. >0 lelong !0 \b, next free block index %u
  429. # no positive block length
  430. #>20 uleshort =0 \b, block length %u
  431. >20 uleshort !0 \b, block length %u
  432. # dBase III memo field terminated by \032\032
  433. # like: "WHAT IS XBASE" test.dbt "Borges, Malte" biblio.dbt "First memo\032\032" T2.DBT
  434. >512 string >\0 \b, 1st item "%s"
  435. # For DEBUGGING
  436. #>512 ubelong x \b, 1ST item %#8.8x
  437. # https://www.clicketyclick.dk/databases/xbase/format/dbt.html
  438. # Print the information of dBase IV DBT memo file
  439. 0 name dbase4-memo-print
  440. >0 lelong x dBase IV DBT
  441. !:mime application/x-dbt
  442. !:ext dbt
  443. # 8 character shorted main name of corresponding dBASE IV DBF file
  444. >8 ubelong >0x20000000
  445. # skip unusual like for angest.dbt
  446. >>20 uleshort >0
  447. >>>8 string >\0 \b of %-.8s.DBF
  448. # value 0 implies 512 as size
  449. #>4 ulelong =0 \b, blocks size %u
  450. # size of blocks not reliable like 0x2020204C in angest.dbt
  451. >4 ulelong !0
  452. >>4 ulelong&0x0000003f 0 \b, blocks size %u
  453. # dBase IV DBT with positive block length (found 512 , 1024)
  454. >20 uleshort >0 \b, block length %u
  455. # next available block
  456. #>0 lelong =0 \b, next free block index %u
  457. >0 lelong !0 \b, next free block index %u
  458. >20 uleshort >0
  459. >>(20.s) ubelong x
  460. >>>&-4 use dbase4-memofield-print
  461. # unusual dBase IV DBT without block length (implies 512 as length)
  462. >20 uleshort =0
  463. >>512 ubelong x
  464. >>>&-4 use dbase4-memofield-print
  465. # Print the information of dBase IV memo field
  466. 0 name dbase4-memofield-print
  467. # free dBase IV memo field
  468. >0 ubelong !0xFFFF0800
  469. >>0 lelong x \b, next free block %u
  470. >>4 lelong x \b, next used block %u
  471. # used dBase IV memo field
  472. >0 ubelong =0xFFFF0800
  473. # length of memo field
  474. >>4 lelong x \b, field length %d
  475. >>>8 string >\0 \b, 1st used item "%s"
  476. # http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm
  477. # Print the information of FoxPro FPT memo file
  478. 0 name foxpro-memo-print
  479. >0 belong x FoxPro FPT
  480. !:mime application/x-fpt
  481. !:ext fpt
  482. # Size of blocks for FoxPro ( 64,256 ); probably a multiple of two
  483. >6 ubeshort x \b, blocks size %u
  484. # next available block
  485. #>0 belong =0 \b, next free block index %u
  486. >0 belong !0 \b, next free block index %u
  487. # field type ( 0~picture, 1~memo, 2~object )
  488. >512 ubelong <3 \b, field type %u
  489. # length of memo field
  490. >512 ubelong 1
  491. >>516 belong >0 \b, field length %d
  492. >>>520 string >\0 \b, 1st item "%s"
  493. # Summary: DBASE Compound Index file *.CDX and FoxPro index *.IDX
  494. # From: Joerg Jenderek
  495. # URL: https://www.clicketyclick.dk/databases/xbase/format/cdx.html
  496. # https://www.clicketyclick.dk/databases/xbase/format/idx.html
  497. # https://www.clicketyclick.dk/databases/xbase/format/idx_comp.html
  498. # Reference: https://mark0.net/download/triddefs_xml.7z/defs/s/sybase-ianywhere-cdx.trid.xml
  499. # https://mark0.net/download/triddefs_xml.7z/defs/c/cdx-vfp7.trid.xml
  500. # like: kunde.cdx
  501. 0 ulelong 0x1C00
  502. >0 use xbase-index
  503. # like: SYLLABI2.CDX SYLLABUS.CDX
  504. 0 ulelong 0x0800
  505. >0 use xbase-index
  506. # often in xBase index pointer to root node 400h
  507. 0 ulelong 0x0400
  508. # skip most Maple help database *.hdb with version tag handled by ./maple
  509. >1028 string !version
  510. # skip Maple help database hsum.hdb checking for valid reserved area
  511. >>492 quad =0
  512. # skip remaining Maple help database *.hdb by checking key length
  513. #>>>12 uleshort !0x000F KEY_LENGTHVALID
  514. >>>0 use xbase-index
  515. # display information about dBase/FoxPro index
  516. 0 name xbase-index
  517. >0 ulelong x xBase
  518. !:mime application/x-dbase-index
  519. >14 ubyte &0x40 compound index
  520. # DCX for FoxPro database index like: TESTDATA.DCX
  521. !:ext cdx/dcx
  522. >14 ubyte ^0x40 index
  523. # only 1 example like: TEST.IDX
  524. !:ext idx
  525. # pointer to root node like: 1C00h 800h often 400h
  526. >0 ulelong !0x400 \b, root pointer %#x
  527. # Pointer to free node list: often 0 but -1 if not present
  528. >4 ulelong !0 \b, free node pointer %#x
  529. # MAYBE number of pages in file (Foxbase, FoxPro 1.x) or
  530. # http://www.foxpert.com/foxpro/knowlbits/files/knowlbits_200708_1.HTM
  531. # Whenever Visual FoxPro updates the index file it increments this reserved field
  532. # Reserved for internal use like: 02000000h 03000000h 460c0000h 780f0000h 89000000h 9fdc0100h often 0
  533. >8 ulelong !0 \b, reserved counter %#x
  534. # length of key like: mostly 000Ah 0028h (TEST.IDX)
  535. >12 uleshort !0x000A \b, key length %#x
  536. # index options like: 24h E0h E8h
  537. # 1~a unique index 8~index has FOR clause 32~compact index format 64~compound index header
  538. # 16~Bit vector (SoftC) 128~Structure index (FoxPro)
  539. >14 ubyte x \b, index options (%#x
  540. >14 ubyte &0x01 \b, unique
  541. >14 ubyte &0x08 \b, has FOR clause
  542. >14 ubyte &0x10 \b, bit vector (SoftC)
  543. >14 ubyte &0x20 \b, compact format
  544. #>14 ubyte &0x40 \b, compound header
  545. >14 ubyte &0x80 \b, structure
  546. >14 ubyte x \b)
  547. # WHAT EXACTLY IS THAT? index signature like: 0 (sybase-ianywhere-cdx.trid.xml) 1 (cdx-vfp7.trid.xml)
  548. >15 ubyte !0 \b, index signature %u
  549. # reserved area (0-bytes) til about 500, but not for uncompressed Index files *.idx
  550. >16 quad !0 \b, at 16 reserved %#llx
  551. >492 quad !0 \b, at 492 reserved %#llx
  552. # for IDX variant
  553. #>14 ubyte ^0x40 IDX
  554. # for CDX variant
  555. >14 ubyte &0x40
  556. # Ascending or descending: 0~ascending 1~descending
  557. >>502 uleshort x \b, sort order %u
  558. # Total expression length (FoxPro 2) like: 0 1
  559. >>504 uleshort !0 \b, expression length %u
  560. # FOR expression pool length like: 1
  561. >>506 uleshort !1 \b, FOR expression pool length %#x
  562. # reserved for internal use like: 0
  563. >>508 uleshort !0 \b, at 0x508 reserved %#x
  564. # Key expression pool length like: 1
  565. >>510 uleshort !1 \b, key expression pool length %#x
  566. # 512 - 1023 Key & FOR expression pool (uncompiled)
  567. >>512 quad !0 \b, key expression pool %#llx
  568. #>>520 quad !0 \b, key expression pool %#llx
  569. # Summary: dBASE IV Printer Form *.PRF
  570. # From: Joerg Jenderek
  571. # URL: https://en.wikipedia.org/wiki/.dbf#Other_file_types_found_in_dBASE
  572. # Reference: https://mark0.net/download/triddefs_xml.7z/defs/p/prf-dbase.trid.xml
  573. 0 ubeshort 0x0400
  574. # skip some Xbase Index files *.ndx and Infocom (Z-machine 4) *.z4 handled by ./adventure
  575. # by looking for valid printer driver name extension
  576. >0x58 search/8 .PR2
  577. >>0 use xbase-prf
  578. # display information of dbase print form like printer driver *.PR2
  579. 0 name xbase-prf dBase Printer Form
  580. !:mime application/x-dbase-prf
  581. !:ext prf
  582. # MAYBE version? like: 4~DBASE IV
  583. #>0 ubyte x \b, version %u
  584. # MAYBE flag like: 1~with output file name 0~not
  585. #>2 ubyte !0 \b, flag %u
  586. # optional printer text output file name like E:\DBASE\IV\T6.txt
  587. >3 string >\0 \b, output file %s
  588. # probably padding with nils til 0x53
  589. #>0x48 uquad !0 \b, at 0x48 padding %#llx
  590. # dBASE IV printer driver name like: Generic.PR2 ASCII.PR2
  591. >0x56 string >\0 \b, using printer driver %s
  592. # 2 is probably last character of previous dBASE printer driver name
  593. #>0x60 ubyte !0x32 \b, at 0x60 %#x
  594. # probably padding with nils til 0xa8
  595. #>0x61 uquad !0 \b, at 0x61 padding %#llx
  596. # unknown 0x03020300 0x03020100 at 0xa8
  597. >0xa8 ubelong x \b, at 0xa8 unknown %#8.8x
  598. # probably padding with nils til 0x2aa
  599. #>0x2a0 uquad !0 \b, at 0x2a0 padding %#llx
  600. # unknown 0x100ff7f01000001 at 0x2AB
  601. >0x2ab ubequad !0x100ff7f01000001 \b, at 0x2ab unknown %#llx
  602. # unknown 0x0042 at 0x2b3
  603. >0x2b3 ubeshort !0x0042 \b, at 0x2b3 unknown %#4.4x
  604. # unknown last 4 bytes at 0x2b6 like: 0 0x23
  605. >0x2b6 ubelong !0 \b, at 0x2b6 unknown %#8.8x
  606. # TODO:
  607. # DBASE index file *.NDX
  608. # dBASE compiled Format *.FMO
  609. # FoxPro Database memo file *.DCT
  610. # FoxPro Forms Memo *.SCT
  611. # FoxPro Generated Menu Program *.MPR
  612. # FoxPro Report *.FRX
  613. # FoxPro Report Memo *.FRT
  614. # Foxpro Generated Screen Program *.SPR
  615. # Foxpro memo *.PJT
  616. ## End of XBase database stuff
  617. # MS Access database
  618. 4 string Standard\ Jet\ DB Microsoft Access Database
  619. !:mime application/x-msaccess
  620. 4 string Standard\ ACE\ DB Microsoft Access Database
  621. !:mime application/x-msaccess
  622. # From: Joerg Jenderek
  623. # URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
  624. # Reference: https://github.com/libyal/libesedb/archive/master.zip
  625. # libesedb-master/documentation/
  626. # Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
  627. # Note: also known as "JET Blue". Used by numerous Windows components such as
  628. # Windows Search, Mail, Exchange and Active Directory.
  629. 4 ubelong 0xefcdab89
  630. # unknown1
  631. >132 ubelong 0 Extensible storage engine
  632. !:mime application/x-ms-ese
  633. # file_type 0~database 1~stream
  634. >>12 ulelong 0 DataBase
  635. # Security DataBase (sdb)
  636. !:ext edb/sdb
  637. >>12 ulelong 1 STreaMing
  638. !:ext stm
  639. # format_version 620h
  640. >>8 uleshort x \b, version %#x
  641. >>10 uleshort >0 revision %#4.4x
  642. >>0 ubelong x \b, checksum %#8.8x
  643. # Page size 4096 8192 32768
  644. >>236 ulequad x \b, page size %lld
  645. # database_state
  646. >>52 ulelong 1 \b, JustCreated
  647. >>52 ulelong 2 \b, DirtyShutdown
  648. #>>52 ulelong 3 \b, CleanShutdown
  649. >>52 ulelong 4 \b, BeingConverted
  650. >>52 ulelong 5 \b, ForceDetach
  651. # Windows NT major version when the databases indexes were updated.
  652. >>216 ulelong x \b, Windows version %d
  653. # Windows NT minor version
  654. >>220 ulelong x \b.%d
  655. # From: Joerg Jenderek
  656. # URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility
  657. # Note: files contain application compatibility fixes, application compatibility modes and application help messages.
  658. 8 string sdbf
  659. >7 ubyte 0
  660. # TAG_TYPE_LIST+TAG_INDEXES
  661. >>12 uleshort 0x7802 Windows application compatibility Shim DataBase
  662. # version? 2 3
  663. #>>>0 ulelong x \b, version %d
  664. !:mime application/x-ms-sdb
  665. !:ext sdb
  666. # TDB database from Samba et al - Martin Pool <mbp@samba.org>
  667. 0 string TDB\ file TDB database
  668. >32 lelong 0x2601196D version 6, little-endian
  669. >>36 lelong x hash size %d bytes
  670. # SE Linux policy database
  671. 0 lelong 0xf97cff8c SE Linux policy
  672. >16 lelong x v%d
  673. >20 lelong 1 MLS
  674. >24 lelong x %d symbols
  675. >28 lelong x %d ocons
  676. # ICE authority file data (Wolfram Kleff)
  677. 2 string ICE ICE authority data
  678. # X11 Xauthority file (Wolfram Kleff)
  679. 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  680. 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  681. 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  682. 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  683. 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  684. 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  685. 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  686. 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  687. 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  688. # From: Maxime Henrion <mux@FreeBSD.org>
  689. # PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
  690. 0 string PGDMP PostgreSQL custom database dump
  691. >5 byte x - v%d
  692. >6 byte x \b.%d
  693. >5 beshort <0x101 \b-0
  694. >5 beshort >0x100
  695. >>7 byte x \b-%d
  696. # Type: Advanced Data Format (ADF) database
  697. # URL: https://www.grc.nasa.gov/WWW/cgns/adf/
  698. # From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
  699. 0 string @(#)ADF\ Database CGNS Advanced Data Format
  700. # Tokyo Cabinet magic data
  701. # http://tokyocabinet.sourceforge.net/index.html
  702. 0 string ToKyO\ CaBiNeT\n Tokyo Cabinet
  703. >14 string x \b (%s)
  704. >32 byte 0 \b, Hash
  705. !:mime application/x-tokyocabinet-hash
  706. >32 byte 1 \b, B+ tree
  707. !:mime application/x-tokyocabinet-btree
  708. >32 byte 2 \b, Fixed-length
  709. !:mime application/x-tokyocabinet-fixed
  710. >32 byte 3 \b, Table
  711. !:mime application/x-tokyocabinet-table
  712. >33 byte &1 \b, [open]
  713. >33 byte &2 \b, [fatal]
  714. >34 byte x \b, apow=%d
  715. >35 byte x \b, fpow=%d
  716. >36 byte &0x01 \b, [large]
  717. >36 byte &0x02 \b, [deflate]
  718. >36 byte &0x04 \b, [bzip]
  719. >36 byte &0x08 \b, [tcbs]
  720. >36 byte &0x10 \b, [excodec]
  721. >40 lequad x \b, bnum=%lld
  722. >48 lequad x \b, rnum=%lld
  723. >56 lequad x \b, fsiz=%lld
  724. # Type: QDBM Quick Database Manager
  725. # From: Benoit Sibaud <bsibaud@april.org>
  726. 0 string \\[depot\\]\n\f Quick Database Manager, little endian
  727. 0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian
  728. # Type: TokyoCabinet database
  729. # URL: http://tokyocabinet.sourceforge.net/
  730. # From: Benoit Sibaud <bsibaud@april.org>
  731. 0 string ToKyO\ CaBiNeT\n TokyoCabinet database
  732. >14 string x (version %s)
  733. # From: Stephane Blondon https://www.yaal.fr
  734. # Database file for Zope (done by FileStorage)
  735. 0 string FS21 Zope Object Database File Storage v3 (data)
  736. 0 string FS30 Zope Object Database File Storage v4 (data)
  737. # Cache file for the database of Zope (done by ClientStorage)
  738. 0 string ZEC3 Zope Object Database Client Cache File (data)
  739. # IDA (Interactive Disassembler) database
  740. 0 string IDA1 IDA (Interactive Disassembler) database
  741. # Hopper (reverse engineering tool) https://www.hopperapp.com/
  742. 0 string hopperdb Hopper database
  743. # URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
  744. # Reference: http://www.provue.com/Panorama/
  745. # From: Joerg Jenderek
  746. # NOTE: test only versions 4 and 6.0 with Windows
  747. # length of Panorama database name
  748. 5 ubyte >0
  749. # look after database name for "some" null bits
  750. >(5.B+7) ubelong&0xF3ffF000 0
  751. # look for first keyword
  752. >>&1 search/2 DESIGN Panorama database
  753. #!:mime application/x-panorama-database
  754. !:apple KASXZEPD
  755. !:ext pan
  756. # database name
  757. >>>5 pstring x \b, "%s"
  758. #
  759. #
  760. # askSam Database by Stefan A. Haubenthal <polluks@web.de>
  761. 0 string askw40\0 askSam DB
  762. #
  763. #
  764. # MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
  765. 0 string MBSTV\040 MUIbase DB
  766. >6 string x version %s
  767. #
  768. # CDB database
  769. 0 string NBCDB\012 NetBSD Constant Database
  770. >7 byte x \b, version %d
  771. >8 string x \b, for '%s'
  772. >24 lelong x \b, datasize %d
  773. >28 lelong x \b, entries %d
  774. >32 lelong x \b, index %d
  775. >36 lelong x \b, seed %#x
  776. #
  777. # Redis RDB - https://redis.io/topics/persistence
  778. 0 string REDIS Redis RDB file,
  779. >5 regex [0-9][0-9][0-9][0-9] version %s
  780. # Mork database.
  781. # Used by older versions of Mozilla Suite and Firefox,
  782. # and current versions of Thunderbird.
  783. # From: David Korth <gerbilsoft@gerbilsoft.com>
  784. 0 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database
  785. >23 string x \b, version %.3s
  786. # URL: https://en.wikipedia.org/wiki/Management_Information_Format
  787. # Reference: https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf
  788. # From: Joerg Jenderek
  789. # Note: only tested with monitor asset reports of Dell Display Manager
  790. # skip start like Language=fr|CA|iso8859-1
  791. 0 search/27/C Start\040Component DMI Management Information Format
  792. #!:mime text/plain
  793. !:mime text/x-dmtf-mif
  794. !:ext mif