database 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664
  1. #------------------------------------------------------------------------------
  2. # $File: database,v 1.59 2020/03/25 01:49:58 christos Exp $
  3. # database: file(1) magic for various databases
  4. #
  5. # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
  6. #
  7. #
  8. # GDBM magic numbers
  9. # Will be maintained as part of the GDBM distribution in the future.
  10. # <downsj@teeny.org>
  11. 0 belong 0x13579acd GNU dbm 1.x or ndbm database, big endian, 32-bit
  12. !:mime application/x-gdbm
  13. 0 belong 0x13579ace GNU dbm 1.x or ndbm database, big endian, old
  14. !:mime application/x-gdbm
  15. 0 belong 0x13579acf GNU dbm 1.x or ndbm database, big endian, 64-bit
  16. !:mime application/x-gdbm
  17. 0 lelong 0x13579acd GNU dbm 1.x or ndbm database, little endian, 32-bit
  18. !:mime application/x-gdbm
  19. 0 lelong 0x13579ace GNU dbm 1.x or ndbm database, little endian, old
  20. !:mime application/x-gdbm
  21. 0 lelong 0x13579acf GNU dbm 1.x or ndbm database, little endian, 64-bit
  22. !:mime application/x-gdbm
  23. 0 string GDBM GNU dbm 2.x database
  24. !:mime application/x-gdbm
  25. #
  26. # Berkeley DB
  27. #
  28. # Ian Darwin's file /etc/magic files: big/little-endian version.
  29. #
  30. # Hash 1.85/1.86 databases store metadata in network byte order.
  31. # Btree 1.85/1.86 databases store the metadata in host byte order.
  32. # Hash and Btree 2.X and later databases store the metadata in host byte order.
  33. 0 long 0x00061561 Berkeley DB
  34. !:mime application/x-dbm
  35. >8 belong 4321
  36. >>4 belong >2 1.86
  37. >>4 belong <3 1.85
  38. >>4 belong >0 (Hash, version %d, native byte-order)
  39. >8 belong 1234
  40. >>4 belong >2 1.86
  41. >>4 belong <3 1.85
  42. >>4 belong >0 (Hash, version %d, little-endian)
  43. 0 belong 0x00061561 Berkeley DB
  44. >8 belong 4321
  45. >>4 belong >2 1.86
  46. >>4 belong <3 1.85
  47. >>4 belong >0 (Hash, version %d, big-endian)
  48. >8 belong 1234
  49. >>4 belong >2 1.86
  50. >>4 belong <3 1.85
  51. >>4 belong >0 (Hash, version %d, native byte-order)
  52. 0 long 0x00053162 Berkeley DB 1.85/1.86
  53. >4 long >0 (Btree, version %d, native byte-order)
  54. 0 belong 0x00053162 Berkeley DB 1.85/1.86
  55. >4 belong >0 (Btree, version %d, big-endian)
  56. 0 lelong 0x00053162 Berkeley DB 1.85/1.86
  57. >4 lelong >0 (Btree, version %d, little-endian)
  58. 12 long 0x00061561 Berkeley DB
  59. >16 long >0 (Hash, version %d, native byte-order)
  60. 12 belong 0x00061561 Berkeley DB
  61. >16 belong >0 (Hash, version %d, big-endian)
  62. 12 lelong 0x00061561 Berkeley DB
  63. >16 lelong >0 (Hash, version %d, little-endian)
  64. 12 long 0x00053162 Berkeley DB
  65. >16 long >0 (Btree, version %d, native byte-order)
  66. 12 belong 0x00053162 Berkeley DB
  67. >16 belong >0 (Btree, version %d, big-endian)
  68. 12 lelong 0x00053162 Berkeley DB
  69. >16 lelong >0 (Btree, version %d, little-endian)
  70. 12 long 0x00042253 Berkeley DB
  71. >16 long >0 (Queue, version %d, native byte-order)
  72. 12 belong 0x00042253 Berkeley DB
  73. >16 belong >0 (Queue, version %d, big-endian)
  74. 12 lelong 0x00042253 Berkeley DB
  75. >16 lelong >0 (Queue, version %d, little-endian)
  76. # From Max Bowsher.
  77. 12 long 0x00040988 Berkeley DB
  78. >16 long >0 (Log, version %d, native byte-order)
  79. 12 belong 0x00040988 Berkeley DB
  80. >16 belong >0 (Log, version %d, big-endian)
  81. 12 lelong 0x00040988 Berkeley DB
  82. >16 lelong >0 (Log, version %d, little-endian)
  83. #
  84. #
  85. # Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
  86. 0 string/b RRD\0 RRDTool DB
  87. >4 string/b x version %s
  88. >>10 short !0 16bit aligned
  89. >>>10 bedouble 8.642135e+130 big-endian
  90. >>>>18 short x 32bit long (m68k)
  91. >>10 short 0
  92. >>>12 long !0 32bit aligned
  93. >>>>12 bedouble 8.642135e+130 big-endian
  94. >>>>>20 long 0 64bit long
  95. >>>>>20 long !0 32bit long
  96. >>>>12 ledouble 8.642135e+130 little-endian
  97. >>>>>24 long 0 64bit long
  98. >>>>>24 long !0 32bit long (i386)
  99. >>>>12 string \x43\x2b\x1f\x5b\x2f\x25\xc0\xc7 middle-endian
  100. >>>>>24 short !0 32bit long (arm)
  101. >>8 quad 0 64bit aligned
  102. >>>16 bedouble 8.642135e+130 big-endian
  103. >>>>24 long 0 64bit long (s390x)
  104. >>>>24 long !0 32bit long (hppa/mips/ppc/s390/SPARC)
  105. >>>16 ledouble 8.642135e+130 little-endian
  106. >>>>28 long 0 64bit long (alpha/amd64/ia64)
  107. >>>>28 long !0 32bit long (armel/mipsel)
  108. #----------------------------------------------------------------------
  109. # ROOT: file(1) magic for ROOT databases
  110. #
  111. 0 string root\0 ROOT file
  112. >4 belong x Version %d
  113. >33 belong x (Compression: %d)
  114. # XXX: Weak magic.
  115. # Alex Ott <ott@jet.msk.su>
  116. ## Paradox file formats
  117. #2 leshort 0x0800 Paradox
  118. #>0x39 byte 3 v. 3.0
  119. #>0x39 byte 4 v. 3.5
  120. #>0x39 byte 9 v. 4.x
  121. #>0x39 byte 10 v. 5.x
  122. #>0x39 byte 11 v. 5.x
  123. #>0x39 byte 12 v. 7.x
  124. #>>0x04 byte 0 indexed .DB data file
  125. #>>0x04 byte 1 primary index .PX file
  126. #>>0x04 byte 2 non-indexed .DB data file
  127. #>>0x04 byte 3 non-incrementing secondary index .Xnn file
  128. #>>0x04 byte 4 secondary index .Ynn file
  129. #>>0x04 byte 5 incrementing secondary index .Xnn file
  130. #>>0x04 byte 6 non-incrementing secondary index .XGn file
  131. #>>0x04 byte 7 secondary index .YGn file
  132. #>>>0x04 byte 8 incrementing secondary index .XGn file
  133. ## XBase database files
  134. # updated by Joerg Jenderek at Feb 2013
  135. # https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
  136. # https://www.clicketyclick.dk/databases/xbase/format/dbf.html
  137. # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
  138. 0 ubelong&0x0000FFFF <0x00000C20
  139. # skip Infocom game Z-machine
  140. >2 ubyte >0
  141. # skip Androids *.xml
  142. >>3 ubyte >0
  143. >>>3 ubyte <32
  144. # 1 < version VV
  145. >>>>0 ubyte >1
  146. # skip HELP.CA3 by test for reserved byte ( NULL )
  147. >>>>>27 ubyte 0
  148. # reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
  149. #>>>>>30 ubeshort x 30NULL?%x
  150. # possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
  151. >>>>>>24 ubelong&0xffFFFFff >0x01302000
  152. # .DBF or .MDX
  153. >>>>>>24 ubelong&0xffFFFFff <0x01302001
  154. # for Xbase Database file (*.DBF) reserved (NULL) for multi-user
  155. >>>>>>>24 ubelong&0xffFFFFff =0
  156. # test for 2 reserved NULL bytes,transaction and encryption byte flag
  157. >>>>>>>>12 ubelong&0xFFFFfEfE 0
  158. # test for MDX flag
  159. >>>>>>>>>28 ubyte x
  160. >>>>>>>>>28 ubyte&0xf8 0
  161. # header size >= 32
  162. >>>>>>>>>>8 uleshort >31
  163. # skip PIC15736.PCX by test for language driver name or field name
  164. >>>>>>>>>>>32 ubyte >0
  165. #!:mime application/x-dbf; charset=unknown-8bit ??
  166. #!:mime application/x-dbase
  167. >>>>>>>>>>>>0 use xbase-type
  168. # database file
  169. >>>>>>>>>>>>0 ubyte x \b DBF
  170. >>>>>>>>>>>>4 lelong 0 \b, no records
  171. >>>>>>>>>>>>4 lelong >0 \b, %d record
  172. # plural s appended
  173. >>>>>>>>>>>>>4 lelong >1 \bs
  174. # https://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
  175. # 1 <= record size <= 4000 (dBase 3,4) or 32 * KB (=0x8000)
  176. >>>>>>>>>>>>10 uleshort x * %d
  177. # file size = records * record size + header size
  178. >>>>>>>>>>>>1 ubyte x \b, update-date
  179. >>>>>>>>>>>>1 use xbase-date
  180. # https://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
  181. #>>>>>>>>>>>>29 ubyte =0 \b, codepage ID=0x%x
  182. # 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
  183. >>>>>>>>>>>>29 ubyte >0 \b, codepage ID=0x%x
  184. #>>>>>>>>>>>>28 ubyte&0x01 0 \b, no index file
  185. >>>>>>>>>>>>28 ubyte&0x01 1 \b, with index file .MDX
  186. >>>>>>>>>>>>28 ubyte&0x02 2 \b, with memo .FPT
  187. >>>>>>>>>>>>28 ubyte&0x04 4 \b, DataBaseContainer
  188. # 1st record offset + 1 = header size
  189. >>>>>>>>>>>>8 uleshort >0
  190. >>>>>>>>>>>>(8.s+1) ubyte >0
  191. >>>>>>>>>>>>>8 uleshort >0 \b, at offset %d
  192. >>>>>>>>>>>>>(8.s+1) ubyte >0
  193. >>>>>>>>>>>>>>&-1 string >\0 1st record "%s"
  194. # for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
  195. >>>>>>>24 ubelong&0x0133f7ff >0
  196. # test for reserved NULL byte
  197. >>>>>>>>47 ubyte 0
  198. # test for valid TAG key format (0x10 or 0)
  199. >>>>>>>>>559 ubyte&0xeF 0
  200. # test MM <= 12
  201. >>>>>>>>>>45 ubeshort <0x0C20
  202. >>>>>>>>>>>45 ubyte >0
  203. >>>>>>>>>>>>46 ubyte <32
  204. >>>>>>>>>>>>>46 ubyte >0
  205. #!:mime application/x-mdx
  206. >>>>>>>>>>>>>>0 use xbase-type
  207. >>>>>>>>>>>>>>0 ubyte x \b MDX
  208. >>>>>>>>>>>>>>1 ubyte x \b, creation-date
  209. >>>>>>>>>>>>>>1 use xbase-date
  210. >>>>>>>>>>>>>>44 ubyte x \b, update-date
  211. >>>>>>>>>>>>>>44 use xbase-date
  212. # No.of tags in use (1,2,5,12)
  213. >>>>>>>>>>>>>>28 uleshort x \b, %d
  214. # No. of entries in tag (0x30)
  215. >>>>>>>>>>>>>>25 ubyte x \b/%d tags
  216. # Length of tag
  217. >>>>>>>>>>>>>>26 ubyte x * %d
  218. # 1st tag name_
  219. >>>>>>>>>>>>>548 string x \b, 1st tag "%.11s"
  220. # 2nd tag name
  221. #>>>>>>>>>>>>(26.b+548) string x \b, 2nd tag "%.11s"
  222. #
  223. # Print the xBase names of different version variants
  224. 0 name xbase-type
  225. >0 ubyte <2
  226. # 1 < version
  227. >0 ubyte >1
  228. >>0 ubyte 0x02 FoxBase
  229. # FoxBase+/dBaseIII+, no memo
  230. >>0 ubyte 0x03 FoxBase+/dBase III
  231. !:mime application/x-dbf
  232. # dBASE IV no memo file
  233. >>0 ubyte 0x04 dBase IV
  234. !:mime application/x-dbf
  235. # dBASE V no memo file
  236. >>0 ubyte 0x05 dBase V
  237. !:mime application/x-dbf
  238. >>0 ubyte 0x30 Visual FoxPro
  239. !:mime application/x-dbf
  240. >>0 ubyte 0x31 Visual FoxPro, autoincrement
  241. !:mime application/x-dbf
  242. # Visual FoxPro, with field type Varchar or Varbinary
  243. >>0 ubyte 0x32 Visual FoxPro, with field type Varchar
  244. !:mime application/x-dbf
  245. # dBASE IV SQL, no memo;dbv memo var size (Flagship)
  246. >>0 ubyte 0x43 dBase IV, with SQL table
  247. !:mime application/x-dbf
  248. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  249. #>>0 ubyte 0x62 dBase IV, with SQL table
  250. #!:mime application/x-dbf
  251. # dBASE IV, with memo!!
  252. >>0 ubyte 0x7b dBase IV, with memo
  253. !:mime application/x-dbf
  254. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  255. #>>0 ubyte 0x82 dBase IV, with SQL system
  256. #!:mime application/x-dbf
  257. # FoxBase+/dBaseIII+ with memo .DBT!
  258. >>0 ubyte 0x83 FoxBase+/dBase III, with memo .DBT
  259. !:mime application/x-dbf
  260. # VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
  261. >>0 ubyte 0x87 VISUAL OBJECTS, with memo file
  262. !:mime application/x-dbf
  263. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  264. #>>0 ubyte 0x8A FoxBase+/dBase III, with memo .DBT
  265. #!:mime application/x-dbf
  266. # dBASE IV with memo!
  267. >>0 ubyte 0x8B dBase IV, with memo .DBT
  268. !:mime application/x-dbf
  269. # dBase IV with SQL Table,no memo?
  270. >>0 ubyte 0x8E dBase IV, with SQL table
  271. !:mime application/x-dbf
  272. # .dbv and .dbt memo (Flagship)?
  273. >>0 ubyte 0xB3 Flagship
  274. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  275. #>>0 ubyte 0xCA dBase IV with memo .DBT
  276. #!:mime application/x-dbf
  277. # dBASE IV with SQL table, with memo .DBT
  278. >>0 ubyte 0xCB dBase IV with SQL table, with memo .DBT
  279. !:mime application/x-dbf
  280. # HiPer-Six format;Clipper SIX, with SMT memo file
  281. >>0 ubyte 0xE5 Clipper SIX with memo
  282. !:mime application/x-dbf
  283. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  284. #>>0 ubyte 0xF4 dBase IV, with SQL table, with memo
  285. #!:mime application/x-dbf
  286. >>0 ubyte 0xF5 FoxPro with memo
  287. !:mime application/x-dbf
  288. # https://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
  289. #>>0 ubyte 0xFA FoxPro 2.x, with memo
  290. #!:mime application/x-dbf
  291. # unknown version (should not happen)
  292. >>0 default x xBase
  293. !:mime application/x-dbf
  294. >>>0 ubyte x (0x%x)
  295. # flags in version byte
  296. # DBT flag (with dBASE III memo .DBT)!!
  297. # >>0 ubyte&0x80 >0 DBT_FLAG=%x
  298. # memo flag ??
  299. # >>0 ubyte&0x08 >0 MEMO_FLAG=%x
  300. # SQL flag ??
  301. # >>0 ubyte&0x70 >0 SQL_FLAG=%x
  302. # test and print the date of xBase .DBF .MDX
  303. 0 name xbase-date
  304. # inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
  305. >0 ubelong x
  306. >1 ubyte <13
  307. >>1 ubyte >0
  308. >>>2 ubyte >0
  309. >>>>2 ubyte <32
  310. >>>>>0 ubyte x
  311. # YY is interpreted as 20YY or 19YY
  312. >>>>>>0 ubyte <100 \b %.2d
  313. # YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
  314. >>>>>>0 ubyte >99 \b %d
  315. >>>>>1 ubyte x \b-%d
  316. >>>>>2 ubyte x \b-%d
  317. # dBase memo files .DBT or .FPT
  318. # https://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
  319. 16 ubyte <4
  320. >16 ubyte !2
  321. >>16 ubyte !1
  322. # next free block index is positive
  323. >>>0 ulelong >0
  324. # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
  325. >>>>17 ubelong&0xFFfdFEff 0x00000000
  326. # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
  327. >>>>>20 ubelong&0xFF01209B 0x00000000
  328. # dBASE III
  329. >>>>>>16 ubyte 3
  330. # dBASE III DBT
  331. >>>>>>>0 use dbase3-memo-print
  332. # dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
  333. >>>>>>16 ubyte 0
  334. # unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT , or garbage PCX DBF
  335. >>>>>>>20 uleshort 0
  336. # FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
  337. >>>>>>>>8 ulong =0
  338. >>>>>>>>>6 ubeshort >0
  339. # skip emacs.PIF
  340. >>>>>>>>>>4 ushort 0
  341. # check for valid FoxPro field type
  342. >>>>>>>>>>>512 ubelong <3
  343. >>>>>>>>>>>>0 use foxpro-memo-print
  344. # dBASE III DBT , garbage
  345. # skip WORD1XW.DOC with improbably high free block index
  346. >>>>>>>>>0 ulelong <0x400000
  347. # skip WinStore.App.exe by looking for printable 2nd character of 1st memo item
  348. >>>>>>>>>>513 ubyte >037
  349. # unusual dBASE III DBT like adressen.dbt
  350. >>>>>>>>>>>0 use dbase3-memo-print
  351. # dBASE III DBT like angest.dbt, or garbage PCX DBF
  352. >>>>>>>>8 ubelong !0
  353. # skip PCX and some DBF by test for for reserved NULL bytes
  354. >>>>>>>>>510 ubeshort 0
  355. # skip bad symples with improbably high free block index above 2 GiB file limit
  356. >>>>>>>>>>0 ulelong <0x400000
  357. # skip AI070GEP.EPS by printable 1st character of 1st memo item
  358. >>>>>>>>>>>512 ubyte >037
  359. # skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character
  360. >>>>>>>>>>>>513 ubyte >037
  361. >>>>>>>>>>>>>0 use dbase3-memo-print
  362. # dBASE IV DBT with positive block size
  363. >>>>>>>20 uleshort >0
  364. # dBASE IV DBT with valid block length like 512, 1024
  365. # multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
  366. # skip also 3600h 3E00h size
  367. >>>>>>>>20 uleshort&0xE00f 0
  368. >>>>>>>>>0 use dbase4-memo-print
  369. # Print the information of dBase III DBT memo file
  370. 0 name dbase3-memo-print
  371. >0 ubyte x dBase III DBT
  372. !:mime application/x-dbt
  373. !:ext dbt
  374. # instead 3 as version number 0 for unusual examples like biblio.dbt
  375. >16 ubyte !3 \b, version number %u
  376. # Number of next available block for appending data
  377. #>0 lelong =0 \b, next free block index %u
  378. >0 lelong !0 \b, next free block index %u
  379. # no positiv block length
  380. #>20 uleshort =0 \b, block length %u
  381. >20 uleshort !0 \b, block length %u
  382. # dBase III memo field terminated by \032\032
  383. >512 string >\0 \b, 1st item "%s"
  384. # https://www.clicketyclick.dk/databases/xbase/format/dbt.html
  385. # Print the information of dBase IV DBT memo file
  386. 0 name dbase4-memo-print
  387. >0 lelong x dBase IV DBT
  388. !:mime application/x-dbt
  389. !:ext dbt
  390. # 8 character shorted main name of coresponding dBASE IV DBF file
  391. >8 ubelong >0x20000000
  392. # skip unusual like for angest.dbt
  393. >>20 uleshort >0
  394. >>>8 string >\0 \b of %-.8s.DBF
  395. # value 0 implies 512 as size
  396. #>4 ulelong =0 \b, blocks size %u
  397. # size of blocks not reliable like 0x2020204C in angest.dbt
  398. >4 ulelong !0
  399. >>4 ulelong&0x0000003f 0 \b, blocks size %u
  400. # dBase IV DBT with positive block length (found 512 , 1024)
  401. >20 uleshort >0 \b, block length %u
  402. # next available block
  403. #>0 lelong =0 \b, next free block index %u
  404. >0 lelong !0 \b, next free block index %u
  405. >20 uleshort >0
  406. >>(20.s) ubelong x
  407. >>>&-4 use dbase4-memofield-print
  408. # unusual dBase IV DBT without block length (implies 512 as length)
  409. >20 uleshort =0
  410. >>512 ubelong x
  411. >>>&-4 use dbase4-memofield-print
  412. # Print the information of dBase IV memo field
  413. 0 name dbase4-memofield-print
  414. # free dBase IV memo field
  415. >0 ubelong !0xFFFF0800
  416. >>0 lelong x \b, next free block %u
  417. >>4 lelong x \b, next used block %u
  418. # used dBase IV memo field
  419. >0 ubelong =0xFFFF0800
  420. # length of memo field
  421. >>4 lelong x \b, field length %d
  422. >>>8 string >\0 \b, 1st used item "%s"
  423. # http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm
  424. # Print the information of FoxPro FPT memo file
  425. 0 name foxpro-memo-print
  426. >0 belong x FoxPro FPT
  427. !:mime application/x-fpt
  428. !:ext fpt
  429. # Size of blocks for FoxPro ( 64,256 )
  430. >6 ubeshort x \b, blocks size %u
  431. # next available block
  432. #>0 belong =0 \b, next free block index %u
  433. >0 belong !0 \b, next free block index %u
  434. # field type ( 0~picture, 1~memo, 2~object )
  435. >512 ubelong <3 \b, field type %u
  436. # length of memo field
  437. >512 ubelong 1
  438. >>516 belong >0 \b, field length %d
  439. >>>520 string >\0 \b, 1st item "%s"
  440. # TODO:
  441. # DBASE index file *.NDX
  442. # DBASE Compound Index file *.CDX
  443. # dBASE IV Printer Driver *.PRF
  444. ## End of XBase database stuff
  445. # MS Access database
  446. 4 string Standard\ Jet\ DB Microsoft Access Database
  447. !:mime application/x-msaccess
  448. 4 string Standard\ ACE\ DB Microsoft Access Database
  449. !:mime application/x-msaccess
  450. # From: Joerg Jenderek
  451. # URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
  452. # Reference: https://github.com/libyal/libesedb/archive/master.zip
  453. # libesedb-master/documentation/
  454. # Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
  455. # Note: also known as "JET Blue". Used by numerous Windows components such as
  456. # Windows Search, Mail, Exchange and Active Directory.
  457. 4 ubelong 0xefcdab89
  458. # unknown1
  459. >132 ubelong 0 Extensible storage engine
  460. !:mime application/x-ms-ese
  461. # file_type 0~database 1~stream
  462. >>12 ulelong 0 DataBase
  463. # Security DataBase (sdb)
  464. !:ext edb/sdb
  465. >>12 ulelong 1 STreaMing
  466. !:ext stm
  467. # format_version 620h
  468. >>8 uleshort x \b, version 0x%x
  469. >>10 uleshort >0 revision 0x%4.4x
  470. >>0 ubelong x \b, checksum 0x%8.8x
  471. # Page size 4096 8192 32768
  472. >>236 ulequad x \b, page size %lld
  473. # database_state
  474. >>52 ulelong 1 \b, JustCreated
  475. >>52 ulelong 2 \b, DirtyShutdown
  476. #>>52 ulelong 3 \b, CleanShutdown
  477. >>52 ulelong 4 \b, BeingConverted
  478. >>52 ulelong 5 \b, ForceDetach
  479. # Windows NT major version when the databases indexes were updated.
  480. >>216 ulelong x \b, Windows version %d
  481. # Windows NT minor version
  482. >>220 ulelong x \b.%d
  483. # From: Joerg Jenderek
  484. # URL: https://forensicswiki.org/wiki/Windows_Application_Compatibility
  485. # Note: files contain application compatibility fixes, application compatibility modes and application help messages.
  486. 8 string sdbf
  487. >7 ubyte 0
  488. # TAG_TYPE_LIST+TAG_INDEXES
  489. >>12 uleshort 0x7802 Windows application compatibility Shim DataBase
  490. # version? 2 3
  491. #>>>0 ulelong x \b, version %d
  492. !:mime application/x-ms-sdb
  493. !:ext sdb
  494. # TDB database from Samba et al - Martin Pool <mbp@samba.org>
  495. 0 string TDB\ file TDB database
  496. >32 lelong 0x2601196D version 6, little-endian
  497. >>36 lelong x hash size %d bytes
  498. # SE Linux policy database
  499. 0 lelong 0xf97cff8c SE Linux policy
  500. >16 lelong x v%d
  501. >20 lelong 1 MLS
  502. >24 lelong x %d symbols
  503. >28 lelong x %d ocons
  504. # ICE authority file data (Wolfram Kleff)
  505. 2 string ICE ICE authority data
  506. # X11 Xauthority file (Wolfram Kleff)
  507. 10 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  508. 11 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  509. 12 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  510. 13 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  511. 14 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  512. 15 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  513. 16 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  514. 17 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  515. 18 string MIT-MAGIC-COOKIE-1 X11 Xauthority data
  516. # From: Maxime Henrion <mux@FreeBSD.org>
  517. # PostgreSQL's custom dump format, Maxime Henrion <mux@FreeBSD.org>
  518. 0 string PGDMP PostgreSQL custom database dump
  519. >5 byte x - v%d
  520. >6 byte x \b.%d
  521. >5 beshort <0x101 \b-0
  522. >5 beshort >0x100
  523. >>7 byte x \b-%d
  524. # Type: Advanced Data Format (ADF) database
  525. # URL: https://www.grc.nasa.gov/WWW/cgns/adf/
  526. # From: Nicolas Chauvat <nicolas.chauvat@logilab.fr>
  527. 0 string @(#)ADF\ Database CGNS Advanced Data Format
  528. # Tokyo Cabinet magic data
  529. # http://tokyocabinet.sourceforge.net/index.html
  530. 0 string ToKyO\ CaBiNeT\n Tokyo Cabinet
  531. >14 string x \b (%s)
  532. >32 byte 0 \b, Hash
  533. !:mime application/x-tokyocabinet-hash
  534. >32 byte 1 \b, B+ tree
  535. !:mime application/x-tokyocabinet-btree
  536. >32 byte 2 \b, Fixed-length
  537. !:mime application/x-tokyocabinet-fixed
  538. >32 byte 3 \b, Table
  539. !:mime application/x-tokyocabinet-table
  540. >33 byte &1 \b, [open]
  541. >33 byte &2 \b, [fatal]
  542. >34 byte x \b, apow=%d
  543. >35 byte x \b, fpow=%d
  544. >36 byte &0x01 \b, [large]
  545. >36 byte &0x02 \b, [deflate]
  546. >36 byte &0x04 \b, [bzip]
  547. >36 byte &0x08 \b, [tcbs]
  548. >36 byte &0x10 \b, [excodec]
  549. >40 lequad x \b, bnum=%lld
  550. >48 lequad x \b, rnum=%lld
  551. >56 lequad x \b, fsiz=%lld
  552. # Type: QDBM Quick Database Manager
  553. # From: Benoit Sibaud <bsibaud@april.org>
  554. 0 string \\[depot\\]\n\f Quick Database Manager, little endian
  555. 0 string \\[DEPOT\\]\n\f Quick Database Manager, big endian
  556. # Type: TokyoCabinet database
  557. # URL: http://tokyocabinet.sourceforge.net/
  558. # From: Benoit Sibaud <bsibaud@april.org>
  559. 0 string ToKyO\ CaBiNeT\n TokyoCabinet database
  560. >14 string x (version %s)
  561. # From: Stephane Blondon https://www.yaal.fr
  562. # Database file for Zope (done by FileStorage)
  563. 0 string FS21 Zope Object Database File Storage v3 (data)
  564. 0 string FS30 Zope Object Database File Storage v4 (data)
  565. # Cache file for the database of Zope (done by ClientStorage)
  566. 0 string ZEC3 Zope Object Database Client Cache File (data)
  567. # IDA (Interactive Disassembler) database
  568. 0 string IDA1 IDA (Interactive Disassembler) database
  569. # Hopper (reverse engineering tool) https://www.hopperapp.com/
  570. 0 string hopperdb Hopper database
  571. # URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
  572. # Reference: http://www.provue.com/Panorama/
  573. # From: Joerg Jenderek
  574. # NOTE: test only versions 4 and 6.0 with Windows
  575. # length of Panorama database name
  576. 5 ubyte >0
  577. # look after database name for "some" null bits
  578. >(5.B+7) ubelong&0xF3ffF000 0
  579. # look for first keyword
  580. >>&1 search/2 DESIGN Panorama database
  581. #!:mime application/x-panorama-database
  582. !:apple KASXZEPD
  583. !:ext pan
  584. # database name
  585. >>>5 pstring x \b, "%s"
  586. #
  587. #
  588. # askSam Database by Stefan A. Haubenthal <polluks@web.de>
  589. 0 string askw40\0 askSam DB
  590. #
  591. #
  592. # MUIbase Database Tool by Stefan A. Haubenthal <polluks@web.de>
  593. 0 string MBSTV\040 MUIbase DB
  594. >6 string x version %s
  595. #
  596. # CDB database
  597. 0 string NBCDB\012 NetBSD Constant Database
  598. >7 byte x \b, version %d
  599. >8 string x \b, for '%s'
  600. >24 lelong x \b, datasize %d
  601. >28 lelong x \b, entries %d
  602. >32 lelong x \b, index %d
  603. >36 lelong x \b, seed %#x
  604. #
  605. # Redis RDB - https://redis.io/topics/persistence
  606. 0 string REDIS Redis RDB file,
  607. >5 regex [0-9][0-9][0-9][0-9] version %s
  608. # Mork database.
  609. # Used by older versions of Mozilla Suite and Firefox,
  610. # and current versions of Thunderbird.
  611. # From: David Korth <gerbilsoft@gerbilsoft.com>
  612. 0 string //\ <!--\ <mdb:mork:z\ v=" Mozilla Mork database
  613. >23 string x \b, version %.3s
  614. # URL: https://en.wikipedia.org/wiki/Management_Information_Format
  615. # Reference: https://www.dmtf.org/sites/default/files/standards/documents/DSP0005.pdf
  616. # From: Joerg Jenderek
  617. # Note: only tested with monitor asset reports of Dell Display Manager
  618. # skip start like Language=fr|CA|iso8859-1
  619. 0 search/27/C Start\040Component DMI Management Information Format
  620. #!:mime text/plain
  621. !:mime text/x-dmtf-mif
  622. !:ext mif