cherry-pick-all-since-5.43-release.patch 258 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151415241534154415541564157415841594160416141624163416441654166416741684169417041714172417341744175417641774178417941804181418241834184418541864187418841894190419141924193419441954196419741984199420042014202420342044205420642074208420942104211421242134214421542164217421842194220422142224223422442254226422742284229423042314232423342344235423642374238423942404241424242434244424542464247424842494250425142524253425442554256425742584259426042614262426342644265426642674268426942704271427242734274427542764277427842794280428142824283428442854286428742884289429042914292429342944295429642974298429943004301430243034304430543064307430843094310431143124313431443154316431743184319432043214322432343244325432643274328432943304331433243334334433543364337433843394340434143424343434443454346434743484349435043514352435343544355435643574358435943604361436243634364436543664367436843694370437143724373437443754376437743784379438043814382438343844385438643874388438943904391439243934394439543964397439843994400440144024403440444054406440744084409441044114412441344144415441644174418441944204421442244234424442544264427442844294430443144324433443444354436443744384439444044414442444344444445444644474448444944504451445244534454445544564457445844594460446144624463446444654466446744684469447044714472447344744475447644774478447944804481448244834484448544864487448844894490449144924493449444954496449744984499450045014502450345044505450645074508450945104511451245134514451545164517451845194520452145224523452445254526452745284529453045314532453345344535453645374538453945404541454245434544454545464547454845494550455145524553455445554556455745584559456045614562456345644565456645674568456945704571457245734574457545764577457845794580458145824583458445854586458745884589459045914592459345944595459645974598459946004601460246034604460546064607460846094610461146124613461446154616461746184619462046214622462346244625462646274628462946304631463246334634463546364637463846394640464146424643464446454646464746484649465046514652465346544655465646574658465946604661466246634664466546664667466846694670467146724673467446754676467746784679468046814682468346844685468646874688468946904691469246934694469546964697469846994700470147024703470447054706470747084709471047114712471347144715471647174718471947204721472247234724472547264727472847294730473147324733473447354736473747384739474047414742474347444745474647474748474947504751475247534754475547564757475847594760476147624763476447654766476747684769477047714772477347744775477647774778477947804781478247834784478547864787478847894790479147924793479447954796479747984799480048014802480348044805480648074808480948104811481248134814481548164817481848194820482148224823482448254826482748284829483048314832483348344835483648374838483948404841484248434844484548464847484848494850485148524853485448554856485748584859486048614862486348644865486648674868486948704871487248734874487548764877487848794880488148824883488448854886488748884889489048914892489348944895489648974898489949004901490249034904490549064907490849094910491149124913491449154916491749184919492049214922492349244925492649274928492949304931493249334934493549364937493849394940494149424943494449454946494749484949495049514952495349544955495649574958495949604961496249634964496549664967496849694970497149724973497449754976497749784979498049814982498349844985498649874988498949904991499249934994499549964997499849995000500150025003500450055006500750085009501050115012501350145015501650175018501950205021502250235024502550265027502850295030503150325033503450355036503750385039504050415042504350445045504650475048504950505051505250535054505550565057505850595060506150625063506450655066506750685069507050715072507350745075507650775078507950805081508250835084508550865087508850895090509150925093509450955096509750985099510051015102510351045105510651075108510951105111511251135114511551165117511851195120512151225123512451255126512751285129513051315132513351345135513651375138513951405141514251435144514551465147514851495150515151525153515451555156515751585159516051615162516351645165516651675168516951705171517251735174517551765177517851795180518151825183518451855186518751885189519051915192519351945195519651975198519952005201520252035204520552065207520852095210521152125213521452155216521752185219522052215222522352245225522652275228522952305231523252335234523552365237523852395240524152425243524452455246524752485249525052515252525352545255525652575258525952605261526252635264526552665267526852695270527152725273527452755276527752785279528052815282528352845285528652875288528952905291529252935294529552965297529852995300530153025303530453055306530753085309531053115312531353145315531653175318531953205321532253235324532553265327532853295330533153325333533453355336533753385339534053415342534353445345534653475348534953505351535253535354535553565357535853595360536153625363536453655366536753685369537053715372537353745375537653775378537953805381538253835384538553865387538853895390539153925393539453955396539753985399540054015402540354045405540654075408540954105411541254135414541554165417541854195420542154225423542454255426542754285429543054315432543354345435543654375438543954405441544254435444544554465447544854495450545154525453545454555456545754585459546054615462546354645465546654675468546954705471547254735474547554765477547854795480548154825483548454855486548754885489549054915492549354945495549654975498549955005501550255035504550555065507550855095510551155125513551455155516551755185519552055215522552355245525552655275528552955305531553255335534553555365537553855395540554155425543554455455546554755485549555055515552555355545555555655575558555955605561556255635564556555665567556855695570557155725573557455755576557755785579558055815582558355845585558655875588558955905591559255935594559555965597559855995600560156025603560456055606560756085609561056115612561356145615561656175618561956205621562256235624562556265627562856295630563156325633563456355636563756385639564056415642564356445645564656475648564956505651565256535654565556565657565856595660566156625663566456655666566756685669567056715672567356745675567656775678567956805681568256835684568556865687568856895690569156925693569456955696569756985699570057015702570357045705570657075708570957105711571257135714571557165717571857195720572157225723572457255726572757285729573057315732573357345735573657375738573957405741574257435744574557465747574857495750575157525753575457555756575757585759576057615762576357645765576657675768576957705771577257735774577557765777577857795780578157825783578457855786578757885789579057915792579357945795579657975798579958005801580258035804580558065807580858095810581158125813581458155816581758185819582058215822582358245825582658275828582958305831583258335834583558365837583858395840584158425843584458455846584758485849585058515852585358545855585658575858585958605861586258635864586558665867586858695870587158725873587458755876587758785879588058815882588358845885588658875888588958905891589258935894589558965897589858995900590159025903590459055906590759085909591059115912591359145915591659175918591959205921592259235924592559265927592859295930593159325933593459355936593759385939594059415942594359445945594659475948594959505951595259535954595559565957595859595960596159625963596459655966596759685969597059715972597359745975597659775978597959805981598259835984598559865987598859895990599159925993599459955996599759985999600060016002600360046005600660076008600960106011601260136014601560166017601860196020602160226023602460256026602760286029603060316032603360346035603660376038603960406041604260436044604560466047604860496050605160526053605460556056605760586059606060616062606360646065606660676068606960706071607260736074607560766077607860796080608160826083608460856086608760886089609060916092609360946095609660976098609961006101610261036104610561066107610861096110611161126113611461156116611761186119612061216122612361246125612661276128612961306131613261336134613561366137613861396140614161426143614461456146614761486149615061516152615361546155615661576158615961606161616261636164616561666167616861696170617161726173617461756176617761786179618061816182618361846185618661876188618961906191619261936194619561966197619861996200620162026203620462056206620762086209621062116212621362146215621662176218621962206221622262236224622562266227622862296230623162326233623462356236623762386239624062416242624362446245624662476248624962506251625262536254625562566257625862596260626162626263626462656266626762686269627062716272627362746275627662776278627962806281628262836284628562866287628862896290629162926293629462956296629762986299630063016302630363046305630663076308630963106311631263136314631563166317631863196320632163226323632463256326632763286329633063316332633363346335633663376338633963406341634263436344634563466347634863496350635163526353635463556356635763586359636063616362636363646365636663676368636963706371637263736374637563766377637863796380638163826383638463856386638763886389639063916392639363946395639663976398639964006401640264036404640564066407640864096410641164126413641464156416641764186419642064216422642364246425642664276428642964306431643264336434643564366437643864396440644164426443644464456446644764486449645064516452645364546455645664576458645964606461646264636464646564666467646864696470647164726473647464756476647764786479648064816482648364846485648664876488648964906491649264936494649564966497649864996500650165026503650465056506650765086509651065116512651365146515651665176518651965206521652265236524652565266527652865296530653165326533653465356536653765386539654065416542654365446545654665476548654965506551655265536554655565566557655865596560656165626563656465656566656765686569657065716572657365746575657665776578657965806581658265836584658565866587658865896590659165926593659465956596659765986599660066016602660366046605660666076608660966106611661266136614661566166617661866196620662166226623662466256626662766286629663066316632663366346635663666376638663966406641664266436644664566466647664866496650665166526653665466556656665766586659666066616662666366646665666666676668666966706671667266736674667566766677667866796680668166826683668466856686668766886689669066916692669366946695669666976698669967006701670267036704670567066707670867096710671167126713671467156716671767186719672067216722672367246725672667276728672967306731673267336734673567366737673867396740674167426743674467456746674767486749675067516752675367546755675667576758675967606761676267636764676567666767676867696770677167726773677467756776677767786779678067816782678367846785678667876788678967906791679267936794679567966797679867996800680168026803680468056806680768086809681068116812681368146815681668176818681968206821682268236824682568266827682868296830683168326833683468356836683768386839684068416842684368446845684668476848684968506851685268536854685568566857685868596860686168626863686468656866686768686869687068716872687368746875687668776878687968806881688268836884688568866887688868896890689168926893689468956896689768986899690069016902690369046905690669076908690969106911691269136914691569166917691869196920692169226923692469256926692769286929693069316932693369346935693669376938693969406941694269436944694569466947694869496950695169526953695469556956695769586959696069616962696369646965696669676968696969706971697269736974697569766977697869796980698169826983698469856986698769886989699069916992699369946995699669976998699970007001700270037004700570067007700870097010701170127013701470157016701770187019702070217022702370247025702670277028702970307031703270337034703570367037703870397040704170427043704470457046704770487049705070517052705370547055705670577058705970607061706270637064706570667067706870697070707170727073707470757076707770787079708070817082708370847085708670877088708970907091709270937094709570967097709870997100710171027103710471057106710771087109711071117112711371147115711671177118711971207121712271237124712571267127712871297130713171327133713471357136713771387139714071417142714371447145714671477148714971507151715271537154715571567157715871597160716171627163716471657166716771687169717071717172717371747175717671777178717971807181718271837184718571867187718871897190719171927193719471957196719771987199720072017202720372047205720672077208720972107211721272137214721572167217721872197220722172227223722472257226722772287229723072317232723372347235723672377238723972407241724272437244724572467247724872497250725172527253725472557256725772587259726072617262726372647265726672677268726972707271727272737274727572767277727872797280728172827283728472857286728772887289729072917292729372947295729672977298729973007301730273037304730573067307730873097310731173127313731473157316731773187319732073217322732373247325732673277328732973307331733273337334733573367337733873397340734173427343734473457346734773487349735073517352735373547355
  1. Subject: All commits since the 5.43 release up to and including FILE5_43-145-g13aa1436
  2. Upstream-Author: Christos Zoulas <christos@zoulas.com>
  3. Last-Update: 2022-12-21
  4. --- a/ChangeLog
  5. +++ b/ChangeLog
  6. @@ -1,3 +1,33 @@
  7. +2022-12-14 9:24 Christos Zoulas <christos@zoulas.com>
  8. +
  9. + * Handle nan's so that we don't get internal floating point exceptions
  10. + when they are enabled (Vincent Mihalkovic)
  11. +
  12. +2022-10-23 10:21 Christos Zoulas <christos@zoulas.com>
  13. +
  14. + * PR/397: Restore the ability to process files from stdin immediately.
  15. +
  16. +2022-09-20 17:12 Christos Zoulas <christos@zoulas.com>
  17. +
  18. + * fixed various clustefuzz issues
  19. +
  20. +2022-09-19 15:54 Christos Zoulas <christos@zoulas.com>
  21. +
  22. + * Fix error detection for decompression code (Vincent Mihalkovic)
  23. +
  24. +2022-09-15 13:50 Christos Zoulas <christos@zoulas.com>
  25. +
  26. + * Add MAGIC_NO_COMPRESS_FORK and use it to produce a more
  27. + meaningful error message if we are sandboxing.
  28. +
  29. +2022-09-15 10:45 Christos Zoulas <christos@zoulas.com>
  30. +
  31. + * Add built-in lzip decompression support (Michal Gorny)
  32. +
  33. +2022-09-14 10:35 Christos Zoulas <christos@zoulas.com>
  34. +
  35. + * Add built-in zstd decompression support (Martin Rodriguez Reboredo)
  36. +
  37. 2022-09-13 14:55 Christos Zoulas <christos@zoulas.com>
  38. * release 5.43
  39. @@ -229,7 +259,7 @@
  40. 2019-12-15 22:13 Christos Zoulas <christos@zoulas.com>
  41. Document changes since the previous release:
  42. - Always accept -S (no sandbox) even if we don't support sandboxing
  43. - - More syscalls elided for sandboxiing
  44. + - More syscalls elided for sandboxing
  45. - For ELF dynamic means having an interpreter not just PT_DYNAMIC
  46. - Check for large ELF session header offset
  47. - When saving and restoring a locale, keep the locale name in our
  48. @@ -1759,7 +1789,7 @@
  49. * Magic format checks (Dr. Werner Fink)
  50. - * Magic format function improvent (Karl Chen)
  51. + * Magic format function improvement (Karl Chen)
  52. 2006-05-03 11:11 Christos Zoulas <christos@astron.com>
  53. --- a/acinclude.m4
  54. +++ b/acinclude.m4
  55. @@ -39,11 +39,12 @@
  56. #include <stdlib.h>])
  57. AC_CACHE_CHECK(for daylight, ac_cv_var_daylight,
  58. [AC_LINK_IFELSE(
  59. -[AC_LANG_PROGRAM([#include <time.h>],
  60. +[AC_LANG_PROGRAM([#include <time.h>
  61. +#include <stdlib.h>],
  62. [#if !HAVE_DECL_DAYLIGHT
  63. extern int daylight;
  64. #endif
  65. -atoi(daylight);])], ac_cv_var_daylight=yes, ac_cv_var_daylight=no)])
  66. +daylight = atoi("1");])], ac_cv_var_daylight=yes, ac_cv_var_daylight=no)])
  67. if test $ac_cv_var_daylight = yes; then
  68. AC_DEFINE(HAVE_DAYLIGHT,1,[HAVE_DAYLIGHT])
  69. fi
  70. --- a/configure.ac
  71. +++ b/configure.ac
  72. @@ -49,6 +49,16 @@
  73. [AS_HELP_STRING([--disable-xzlib], [disable liblzma/xz compression support @<:@default=auto@:>@])])
  74. AC_MSG_RESULT($enable_xzlib)
  75. +AC_MSG_CHECKING(for zstdlib support)
  76. +AC_ARG_ENABLE([zstdlib],
  77. +[AS_HELP_STRING([--disable-zstdlib], [disable zstdlib compression support @<:@default=auto@:>@])])
  78. +AC_MSG_RESULT($enable_zstdlib)
  79. +
  80. +AC_MSG_CHECKING(for lzlib support)
  81. +AC_ARG_ENABLE([lzlib],
  82. +[AS_HELP_STRING([--disable-lzlib], [disable liblz (lzip) compression support @<:@default=auto@:>@])])
  83. +AC_MSG_RESULT($enable_lzlib)
  84. +
  85. AC_MSG_CHECKING(for libseccomp support)
  86. AC_ARG_ENABLE([libseccomp],
  87. [AS_HELP_STRING([--disable-libseccomp], [disable libseccomp sandboxing @<:@default=auto@:>@])])
  88. @@ -112,6 +122,12 @@
  89. if test "$enable_xzlib" != "no"; then
  90. AC_CHECK_HEADERS(lzma.h)
  91. fi
  92. +if test "$enable_zstdlib" != "no"; then
  93. + AC_CHECK_HEADERS(zstd.h zstd_errors.h)
  94. +fi
  95. +if test "$enable_lzlib" != "no"; then
  96. + AC_CHECK_HEADERS(lzlib.h)
  97. +fi
  98. AC_CHECK_TYPE([sig_t],[AC_DEFINE([HAVE_SIG_T],1,[Have sig_t type])],,[#include <signal.h>])
  99. dnl Checks for typedefs, structures, and compiler characteristics.
  100. @@ -180,6 +196,12 @@
  101. if test "$enable_xzlib" != "no"; then
  102. AC_CHECK_LIB(lzma, lzma_stream_decoder)
  103. fi
  104. +if test "$enable_zstdlib" != "no"; then
  105. + AC_CHECK_LIB(zstd, ZSTD_createDStream)
  106. +fi
  107. +if test "$enable_lzlib" != "no"; then
  108. + AC_CHECK_LIB(lz, LZ_decompress_open)
  109. +fi
  110. if test "$enable_libseccomp" != "no"; then
  111. AC_CHECK_LIB(seccomp, seccomp_init)
  112. fi
  113. @@ -215,6 +237,22 @@
  114. if test "$ac_cv_header_lzma_h$ac_cv_lib_lzma_lzma_stream_decoder" = "yesyes"; then
  115. AC_DEFINE([XZLIBSUPPORT], 1, [Enable xzlib compression support])
  116. fi
  117. +if test "$enable_zstdlib" = "yes"; then
  118. + if test "$ac_cv_header_zstd_h$ac_cv_lib_zstd_ZSTD_createDStream" != "yesyes"; then
  119. + AC_MSG_ERROR([zstdlib support requested but not found])
  120. + fi
  121. +fi
  122. +if test "$ac_cv_header_zstd_h$ac_cv_lib_zstd_ZSTD_createDStream" = "yesyes"; then
  123. + AC_DEFINE([ZSTDLIBSUPPORT], 1, [Enable zstdlib compression support])
  124. +fi
  125. +if test "$enable_lzlib" = "yes"; then
  126. + if test "$ac_cv_header_lzlib_h$ac_cv_lib_lz_LZ_decompress_open" != "yesyes"; then
  127. + AC_MSG_ERROR([lzlib support requested but not found])
  128. + fi
  129. +fi
  130. +if test "$ac_cv_header_lzlib_h$ac_cv_lib_lz_LZ_decompress_open" = "yesyes"; then
  131. + AC_DEFINE([LZLIBSUPPORT], 1, [Enable lzlib compression support])
  132. +fi
  133. AC_CONFIG_FILES([Makefile src/Makefile magic/Makefile tests/Makefile doc/Makefile python/Makefile libmagic.pc])
  134. AC_OUTPUT
  135. --- a/doc/file.man
  136. +++ b/doc/file.man
  137. @@ -1,5 +1,5 @@
  138. -.\" $File: file.man,v 1.144 2021/02/05 22:08:31 christos Exp $
  139. -.Dd February 5, 2021
  140. +.\" $File: file.man,v 1.147 2022/10/31 13:22:26 christos Exp $
  141. +.Dd October 26, 2022
  142. .Dt FILE __CSECTION__
  143. .Os
  144. .Sh NAME
  145. @@ -727,7 +727,7 @@
  146. It would be better if buffer managements was done when the file descriptor
  147. is available so we can seek around the file.
  148. One must be careful though because this has performance and thus security
  149. -considerations, because one can slow down things by repeateadly seeking.
  150. +considerations, because one can slow down things by repeatedly seeking.
  151. .Pp
  152. There is support now for keeping separate buffers and having offsets from
  153. the end of the file, but the internal buffer management still needs an
  154. --- a/doc/libmagic.man
  155. +++ b/doc/libmagic.man
  156. @@ -1,6 +1,6 @@
  157. -.\" $File: libmagic.man,v 1.45 2019/06/08 22:16:24 christos Exp $
  158. +.\" $File: libmagic.man,v 1.46 2022/09/15 16:54:14 christos Exp $
  159. .\"
  160. -.\" Copyright (c) Christos Zoulas 2003, 2018.
  161. +.\" Copyright (c) Christos Zoulas 2003, 2018, 2022
  162. .\" All Rights Reserved.
  163. .\"
  164. .\" Redistribution and use in source and binary forms, with or without
  165. @@ -25,7 +25,7 @@
  166. .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  167. .\" SUCH DAMAGE.
  168. .\"
  169. -.Dd June 8, 2019
  170. +.Dd September 15, 2022
  171. .Dt LIBMAGIC 3
  172. .Os
  173. .Sh NAME
  174. @@ -143,6 +143,8 @@
  175. Don't check for
  176. .Dv EMX
  177. application type (only on EMX).
  178. +.It Dv MAGIC_NO_COMPRESS_FORK
  179. +Don't allow decompressors that use fork.
  180. .It Dv MAGIC_NO_CHECK_CDF
  181. Don't get extra information on MS Composite Document Files.
  182. .It Dv MAGIC_NO_CHECK_COMPRESS
  183. --- a/doc/magic.man
  184. +++ b/doc/magic.man
  185. @@ -1,5 +1,5 @@
  186. -.\" $File: magic.man,v 1.100 2022/09/10 13:19:26 christos Exp $
  187. -.Dd September 10, 2022
  188. +.\" $File: magic.man,v 1.101 2022/10/09 18:51:04 christos Exp $
  189. +.Dd October 9, 2022
  190. .Dt MAGIC __FSECTION__
  191. .Os
  192. .\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems.
  193. @@ -68,54 +68,52 @@
  194. A 64-bit double precision IEEE floating point number in this machine's native byte order.
  195. .It Dv string
  196. A string of bytes.
  197. -The string type specification can be optionally followed
  198. -by /[WwcCtbTf]*.
  199. -The
  200. -.Dq W
  201. -flag compacts whitespace in the target, which must
  202. -contain at least one whitespace character.
  203. -If the magic has
  204. -.Dv n
  205. -consecutive blanks, the target needs at least
  206. -.Dv n
  207. -consecutive blanks to match.
  208. -The
  209. -.Dq w
  210. -flag treats every blank in the magic as an optional blank.
  211. -The
  212. -.Dq f
  213. -flags requires that the matched string is a full word, not a partial word match.
  214. -The
  215. -.Dq c
  216. -flag specifies case insensitive matching: lower case
  217. +The string type specification can be optionally followed by a /<width>
  218. +option and optionally followed by a set of flags /[bCcftTtWw]*.
  219. +The width limits the number of characters to be copied.
  220. +Zero means all characters.
  221. +The following flags are supported:
  222. +.Bl -tag -width B -compact -offset XXXX
  223. +.It b
  224. +Force binary file test.
  225. +.It C
  226. +Use upper case insensitive matching: upper case
  227. characters in the magic match both lower and upper case characters in the
  228. -target, whereas upper case characters in the magic only match upper case
  229. +target, whereas lower case characters in the magic only match upper case
  230. characters in the target.
  231. -The
  232. -.Dq C
  233. -flag specifies case insensitive matching: upper case
  234. +.It c
  235. +Use lower case insensitive matching: lower case
  236. characters in the magic match both lower and upper case characters in the
  237. -target, whereas lower case characters in the magic only match upper case
  238. +target, whereas upper case characters in the magic only match upper case
  239. characters in the target.
  240. To do a complete case insensitive match, specify both
  241. .Dq c
  242. and
  243. .Dq C .
  244. -The
  245. -.Dq t
  246. -flag forces the test to be done for text files, while the
  247. -.Dq b
  248. -flag forces the test to be done for binary files.
  249. -The
  250. -.Dq T
  251. -flag causes the string to be trimmed, i.e. leading and trailing whitespace
  252. +.It f
  253. +Require that the matched string is a full word, not a partial word match.
  254. +.It T
  255. +Trim the string, i.e. leading and trailing whitespace
  256. +.It t
  257. +Force text file test.
  258. +.It W
  259. +Compact whitespace in the target, which must
  260. +contain at least one whitespace character.
  261. +If the magic has
  262. +.Dv n
  263. +consecutive blanks, the target needs at least
  264. +.Dv n
  265. +consecutive blanks to match.
  266. +.It w
  267. +Treat every blank in the magic as an optional blank.
  268. is deleted before the string is printed.
  269. +.El
  270. .It Dv pstring
  271. A Pascal-style string where the first byte/short/int is interpreted as the
  272. unsigned length.
  273. The length defaults to byte and can be specified as a modifier.
  274. The following modifiers are supported:
  275. -.Bl -tag -compact -width B
  276. +.Bl -tag -width B -compact -offset XXXX
  277. .It B
  278. A byte length (default).
  279. .It H
  280. --- a/magic/Magdir/algol68
  281. +++ b/magic/Magdir/algol68
  282. @@ -1,6 +1,6 @@
  283. #------------------------------------------------------------------------------
  284. -# $File: algol68,v 1.4 2021/08/15 06:00:55 christos Exp $
  285. +# $File: algol68,v 1.6 2022/11/06 18:36:55 christos Exp $
  286. # algol68: file(1) magic for Algol 68 source
  287. #
  288. # URL: https://en.wikipedia.org/wiki/ALGOL_68
  289. @@ -9,14 +9,8 @@
  290. 0 search/8192 (input,
  291. >0 use algol_68
  292. # graph_2d.a68
  293. -0 regex/4006 \^PROC
  294. -#>&-4 string x \b, dBase or Algol "%s"
  295. -# most xBase scripts *.prg with PROCEDURE like: Areacode BarCount Def_mens Vendors
  296. -#>&-4 string =PROCEDURE \b, dBase PROCEDURE
  297. -# skip xBase program scripts *.prg with PROCEDURE keyword
  298. -# keyword proc probably followed by white space used to specify algol procedures
  299. ->&-4 string !PROCEDURE
  300. ->>0 use algol_68
  301. +0 regex/4006 \^PROC[[:space:]][a-zA-Z0-9_[:space:]]*[[:space:]]=
  302. +>0 use algol_68
  303. 0 regex/1024 \bMODE[\t\ ]
  304. >0 use algol_68
  305. 0 regex/1024 \bMODE[\t\ ]
  306. --- a/magic/Magdir/animation
  307. +++ b/magic/Magdir/animation
  308. @@ -1,6 +1,6 @@
  309. #------------------------------------------------------------------------------
  310. -# $File: animation,v 1.90 2022/08/16 11:16:39 christos Exp $
  311. +# $File: animation,v 1.91 2022/11/30 20:34:47 christos Exp $
  312. # animation: file(1) magic for animation/movie formats
  313. #
  314. # animation formats
  315. @@ -938,6 +938,15 @@
  316. !:mime video/MP2T
  317. !:ext ts
  318. +# Blu-ray disc Audio-Video MPEG-2 transport stream
  319. +# From: Alexandre Iooss <erdnaxe@crans.org>
  320. +# URL: https://en.wikipedia.org/wiki/MPEG_transport_stream
  321. +# Note: similar to ISO 13818.1 but with 4 extra bytes per packets
  322. +4 belong&0xFF5FFF10 =0x47400010
  323. +>196 byte =0x47 BDAV MPEG-2 Transport Stream (M2TS)
  324. +!:mime video/MP2T
  325. +!:ext m2ts/mts
  326. +
  327. # DIF digital video file format <mpruett@sgi.com>
  328. 0 belong&0xffffff00 0x1f070000 DIF
  329. !:mime video/x-dv
  330. --- a/magic/Magdir/apple
  331. +++ b/magic/Magdir/apple
  332. @@ -1,6 +1,6 @@
  333. #------------------------------------------------------------------------------
  334. -# $File: apple,v 1.45 2021/04/26 15:56:00 christos Exp $
  335. +# $File: apple,v 1.47 2022/12/09 15:48:14 christos Exp $
  336. # apple: file(1) magic for Apple file formats
  337. #
  338. 0 search/1/t FiLeStArTfIlEsTaRt binscii (apple ][) text
  339. @@ -11,26 +11,48 @@
  340. 0 belong 0x00051600 AppleSingle encoded Macintosh file
  341. 0 belong 0x00051607 AppleDouble encoded Macintosh file
  342. +# Type: Apple Emulator A2R format
  343. +# From: Greg Wildman <greg@apple2.org.za>
  344. +# Ref: https://applesaucefdc.com/a2r2-reference/
  345. +# Ref: https://applesaucefdc.com/a2r/
  346. +0 string A2R
  347. +>3 string \x31\xFF\x0A\x0D\x0A Applesauce A2R 1.x Disk Image
  348. +>3 string \x32\xFF\x0A\x0D\x0A Applesauce A2R 2.x Disk Image
  349. +>3 string \x33\xFF\x0A\x0D\x0A Applesauce A2R 3.x Disk Image
  350. +>8 string INFO
  351. +>>49 byte 01 \b, 5.25″ SS 40trk
  352. +>>49 byte 02 \b, 3.5″ DS 80trk
  353. +>>49 byte 03 \b, 5.25″ DS 80trk
  354. +>>49 byte 04 \b, 5.25″ DS 40trk
  355. +>>49 byte 05 \b, 3.5″ DS 80trk
  356. +>>49 byte 06 \b, 8″ DS
  357. +>>50 byte 01 \b, write protected
  358. +>>51 byte 01 \b, cross track synchronized
  359. +>>17 string/T x \b, %.32s
  360. +
  361. # Type: Apple Emulator WOZ format
  362. # From: Greg Wildman <greg@apple2.org.za>
  363. # Ref: https://applesaucefdc.com/woz/reference/
  364. # Ref: https://applesaucefdc.com/woz/reference2/
  365. -#
  366. -# Note: The following test are mostly identical. I would rather not
  367. -# use a regex to identify the WOZ format number.
  368. -0 string WOZ1
  369. ->4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image
  370. +0 string WOZ
  371. +>3 string \x31\xFF\x0A\x0D\x0A Apple ][ WOZ 1.0 Disk Image
  372. +>3 string \x32\xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image
  373. >12 string INFO
  374. >>21 byte 01 \b, 5.25 inch
  375. >>21 byte 02 \b, 3.5 inch
  376. >>22 byte 01 \b, write protected
  377. >>23 byte 01 \b, cross track synchronized
  378. >>25 string/T x \b, %.32s
  379. -0 string WOZ2
  380. ->4 string \xFF\x0A\x0D\x0A Apple ][ WOZ 2.0 Disk Image
  381. +
  382. +# Type: Apple Macintosh Emulator MOOF format
  383. +# From: Greg Wildman <greg@apple2.org.za>
  384. +# Ref: https://applesaucefdc.com/moof-reference/
  385. +0 string MOOF
  386. +>4 string \xFF\x0A\x0D\x0A Apple Macintosh MOOF Disk Image
  387. >12 string INFO
  388. ->>21 byte 01 \b, 5.25 inch
  389. ->>21 byte 02 \b, 3.5 inch
  390. +>>21 byte 01 \b, SSDD GCR (400K)
  391. +>>21 byte 02 \b, DSDD GCR (800K)
  392. +>>21 byte 03 \b, DSHD MFM (1.44M)
  393. >>22 byte 01 \b, write protected
  394. >>23 byte 01 \b, cross track synchronized
  395. >>25 string/T x \b, %.32s
  396. @@ -43,29 +65,79 @@
  397. >0x400 string \x00\x00\x03\x00
  398. >>0x404 byte &0xF0
  399. >>>0x405 string x \b, Volume /%s
  400. ->>>0x429 leshort x \b, %u Blocks
  401. +>>>0x429 uleshort x \b, %u Blocks
  402. # ProDOS ordered ?
  403. >0xb00 string \x00\x00\x03\x00
  404. >>0xb04 byte &0xF0
  405. >>>0xb05 string x \b, Volume /%s
  406. ->>>0xb29 leshort x \b, %u Blocks
  407. +>>>0xb29 uleshort x \b, %u Blocks
  408. #
  409. -# DOS3.3 boot loader?
  410. -0 string \x01\xA5\x27\xC9\x09\xD0\x18\xA5\x2B
  411. ->0x11001 string \x11\x0F\x03 Apple DOS 3.3 Image
  412. ->>0x11006 byte x \b, Volume %u
  413. ->>0x11034 byte x \b, %u Tracks
  414. ->>0x11035 byte x \b, %u Sectors
  415. ->>0x11036 leshort x \b, %u bytes per sector
  416. -# DOS3.2 ?
  417. ->0x11001 string \x11\x0C\x02 Apple DOS 3.2 Image
  418. ->>0x11006 byte x \b, Volume %u
  419. ->>0x11034 byte x \b, %u Tracks
  420. ->>0x11035 byte x \b, %u Sectors
  421. ->>0x11036 leshort x \b, %u bytes per sector
  422. -# DOS3.1 ?
  423. ->0x11001 string \x11\x0C\x01
  424. ->>0x11c00 string \x00\x11\x0B Apple DOS 3.1 Image
  425. +# Proboot HD
  426. +0 string \x01\x8A\x48\xD8\x2C\x82\xC0\x8D\x0E\xC0\x8D\x0C Apple ProDOS ProBoot Image
  427. +>0x400 string \x00\x00\x03\x00
  428. +>>0x404 byte &0xF0
  429. +>>>0x405 string x \b, Volume /%s
  430. +>>>0x429 uleshort x \b, %u Blocks
  431. +>0xb00 string \x00\x00\x03\x00
  432. +>>0xb04 byte &0xF0
  433. +>>>0xb05 string x \b, Volume /%s
  434. +>>>0xb29 uleshort x \b, %u Blocks
  435. +0 string \x01\xA8\x8A\x20\x7B\xF8\x29\x07\x09\xC0\x99\x30 Apple ProDOS ProBoot Image
  436. +>0x400 string \x00\x00\x03\x00
  437. +>>0x404 byte &0xF0
  438. +>>>0x405 string x \b, Volume /%s
  439. +>>>0x429 uleshort x \b, %u Blocks
  440. +>0xb00 string \x00\x00\x03\x00
  441. +>>0xb04 byte &0xF0
  442. +>>>0xb05 string x \b, Volume /%s
  443. +>>>0xb29 uleshort x \b, %u Blocks
  444. +0 string \x01\x4A\xD0\x34\xE6\x3D\x8A\x20\x7B\xF8\x09\xC0 Apple ProDOS ProBoot Image
  445. +>0x400 string \x00\x00\x03\x00
  446. +>>0x404 byte &0xF0
  447. +>>>0x405 string x \b, Volume /%s
  448. +>>>0x429 uleshort x \b, %u Blocks
  449. +>0xb00 string \x00\x00\x03\x00
  450. +>>0xb04 byte &0xF0
  451. +>>>0xb05 string x \b, Volume /%s
  452. +>>>0xb29 uleshort x \b, %u Blocks
  453. +#
  454. +# ProDOS formatted
  455. +0 string \x01\xBD\x88\xC0\x20\x2F\xFB\x20\x58\xFC\x20\x40 Apple ProDOS Unbootable Image
  456. +>0x400 string \x00\x00\x03\x00
  457. +>>0x404 byte &0xF0
  458. +>>>0x405 string x \b, Volume /%s
  459. +>>>0x429 uleshort x \b, %u Blocks
  460. +>0xb00 string \x00\x00\x03\x00
  461. +>>0xb04 byte &0xF0
  462. +>>>0xb05 string x \b, Volume /%s
  463. +>>>0xb29 uleshort x \b, %u Blocks
  464. +0 string \x01\x38\xB0\x03\x4C\x1C\x09\x78\x86\x43\xC9\x03 Apple ProDOS Unbootable Image
  465. +>0x400 string \x00\x00\x03\x00
  466. +>>0x404 byte &0xF0
  467. +>>>0x405 string x \b, Volume /%s
  468. +>>>0x429 uleshort x \b, %u Blocks
  469. +>0xb00 string \x00\x00\x03\x00
  470. +>>0xb04 byte &0xF0
  471. +>>>0xb05 string x \b, Volume /%s
  472. +>>>0xb29 uleshort x \b, %u Blocks
  473. +#
  474. +# DOS3 boot loader
  475. +0 string \x01\xA5\x27\xC9\x09\xD0
  476. +>0x11001 byte 0x11
  477. +>>0x11003 ubyte x Apple DOS 3.%u Image
  478. +>>0x11006 ubyte x \b, Volume #%03u
  479. +>>0x11034 ubyte x \b, %u Tracks
  480. +>>0x11035 ubyte x \b, %u Sectors
  481. +>>0x11036 uleshort x \b, %u bytes per sector
  482. +#
  483. +# DOS3 uninitialized disk
  484. +0 string \x01\xA6\x2B\xBD\x88\xC0\x8A\x4A\x4A
  485. +>0x11001 byte 0x11
  486. +>>0x11003 ubyte x Apple DOS 3.%u Unbootable Image
  487. +>>>0x11006 ubyte x \b, Volume #%03u
  488. +>>>0x11034 ubyte x \b, %u Tracks
  489. +>>>0x11035 ubyte x \b, %u Sectors
  490. +>>>0x11036 uleshort x \b, %u bytes per sector
  491. #
  492. # Pascal boot loader?
  493. 0 string \x01\xE0\x60\xF0\x03\x4C\xE3\x08\xAD
  494. @@ -112,9 +184,70 @@
  495. >>0x440 string \x00\x00\x03\x00
  496. >>>0x444 byte &0xF0
  497. >>>>0x445 string x \b, Volume /%s
  498. ->>>>0x469 leshort x \b, %u Blocks
  499. +>>>>0x469 uleshort x \b, %u Blocks
  500. >0xc byte 02 \b, NIB data
  501. +# Type: Peter Ferrie QBoot
  502. +# From: Greg Wildman <greg@apple2.org.za>
  503. +# Ref: https://github.com/peterferrie/qboot
  504. +0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9
  505. +>8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ QBoot Image
  506. +
  507. +# Type: Peter Ferrie 0Boot
  508. +# From: Greg Wildman <greg@apple2.org.za>
  509. +# Ref: https://github.com/peterferrie/0boot
  510. +0 string \x01\x4A\xA8\x69\x0F\x85\x27\xC9
  511. +>8 string \x12\xF0\x10\xE6\x3D\x86\xDA\x8A Apple ][ 0Boot Image
  512. +
  513. +# Different proprietary boot sectors
  514. +0 string \x01\x0F\x21\x74\x00\x01\x6B\x00\x02\x30\x81\x5D Apple ][ Disk Image
  515. +0 string \x01\x20\x58\xFC\xA2\x00\x8E\x78\x04\x8E\xF4\x03 Apple ][ Disk Image
  516. +0 string \x01\x20\x58\xFC\xAD\x51\xC0\xAD\x54\xC0\xA6\x2B Apple ][ Disk Image
  517. +0 string \x01\x20\x89\xFE\x20\x93\xFE\xA6\x2B\xBD\x88\xC0 Apple ][ Disk Image
  518. +0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x25\x08\x68\x85 Apple ][ Disk Image
  519. +0 string \x01\x20\x93\xFE\x20\x89\xFE\x4C\x2D\x08\x68\x85 Apple ][ Disk Image
  520. +0 string \x01\x38\x90\x2A\xC9\x01\xF0\x33\xA8\xC8\xC0\x10 Apple ][ Disk Image
  521. +0 string \x01\x38\xB0\x03\x4C\x32\xA1\x87\x43\xC9\x03\x08 Apple ][ Disk Image
  522. +0 string \x01\x4C\x04\x08\xA9\x2A\x8D\x02\x08\x86\x2B\xEE Apple ][ Disk Image
  523. +0 string \x01\x4C\x60\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image
  524. +0 string \x01\x4C\x92\x08\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image
  525. +0 string \x01\x4C\xB3\x08\x09\xD0\x18\xA5\x2B\x4A\x4A\x4A Apple ][ Disk Image
  526. +0 string \x01\x8D\xFB\x03\x8E\xFC\x03\x8C\xFD\x03\x8A\x29 Apple ][ Disk Image
  527. +0 string \x01\xA2\xFF\x9A\xD8\x20\x20\x08\x20\x34\x08\xAD Apple ][ Disk Image
  528. +0 string \x01\xA5\x27\xBD\x88\xC0\x2C\x10\xC0\xA2\x00\xA9 Apple ][ Disk Image
  529. +0 string \x01\xA5\x2B\xAE\x51\xC0\xEA\xAA\xBD\x88\xC0\x20 Apple ][ Disk Image
  530. +0 string \x01\xA6\x27\xBD\x0B\x08\x48\xBD\x0A\x08\x48\x85 Apple ][ Disk Image
  531. +0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x01\x85 Apple ][ Disk Image
  532. +0 string \x01\xA6\x2B\xBD\x88\xC0\x20\x58\xFC\xA9\x25\x85 Apple ][ Disk Image
  533. +0 string \x01\xA8\xC0\x0F\x90\x16\xF0\x12\xA0\xFF\x18\xAD Apple ][ Disk Image
  534. +0 string \x01\xA9\x00\x85\xF0\xA9\x04\x85\xF1\xA0\x00\xA9 Apple ][ Disk Image
  535. +0 string \x01\xA9\x5C\x8D\xF2\x03\xA9\xC6\x8D\xF3\x03\x49 Apple ][ Disk Image
  536. +0 string \x01\xA9\x60\x8D\x01\x08\x20\x2F\xFB\x20\x58\xFC Apple ][ Disk Image
  537. +0 string \x01\xA9\x60\x8D\x01\x08\x20\x49\x08\xA9\x0A\x85 Apple ][ Disk Image
  538. +0 string \x01\xA9\x60\x8D\x01\x08\x2C\x82\xC0\xBD\x88\xC0 Apple ][ Disk Image
  539. +0 string \x01\xA9\x60\x8D\x01\x08\x86\x43\x8A\x4A\x4A\x4A Apple ][ Disk Image
  540. +0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\x86\xFF\xB5\x00 Apple ][ Disk Image
  541. +0 string \x01\xA9\x60\x8D\x01\x08\xA2\x00\xB5\x00\x9D\x00 Apple ][ Disk Image
  542. +0 string \x01\xA9\x60\x8D\x01\x08\xA9\xB2\x8D\xF2\x03\xA9 Apple ][ Disk Image
  543. +0 string \x01\xA9\x60\x8D\x01\x08\xA9\xFF\x8D\xF3\x03\x8D Apple ][ Disk Image
  544. +0 string \x01\xAC\x00\x08\xF0\x19\xB9\x30\x08\x85\x3D\xCE Apple ][ Disk Image
  545. +0 string \x01\xAC\x23\x08\x30\x2E\xB9\x24\x08\x85\x3D\xCE Apple ][ Disk Image
  546. +0 string \x01\xAD\x00\x08\xC9\x09\xB0\x20\x69\x02\x8D\x00 Apple ][ Disk Image
  547. +0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\x86\x2B\x8A\x4A Apple ][ Disk Image
  548. +0 string \x01\xB0\x00\xA9\x3C\x8D\x02\x08\xA9\xF5\x8D\xF2 Apple ][ Disk Image
  549. +0 string \x01\xB0\x00\xA9\x3F\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image
  550. +0 string \x01\xB0\x00\xA9\x48\x8D\x02\x08\x86\x2B\x8E\xF4 Apple ][ Disk Image
  551. +0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x09\xC0\x8D Apple ][ Disk Image
  552. +0 string \x01\xBD\x88\xC0\x8A\x4A\x4A\x4A\x4A\x8D\x2F\x08 Apple ][ Disk Image
  553. +0 string \x01\xD8\x2C\x81\xC0\xA9\x60\x4D\x58\xFF\xD0\xFE Apple ][ Disk Image
  554. +0 string \x01\xD8\x78\xBD\x88\xC0\xA9\xFD\x85\x37\x85\x39 Apple ][ Disk Image
  555. +0 string \x01\xE0\x60\xF0\x03\x4C\x16\x09\xAD\x00\x08\xC9 Apple ][ Disk Image
  556. +0 string \x01\xE0\x60\xF0\x03\x4C\xCB\x08\xAD\x00\x08\xC9 Apple ][ Disk Image
  557. +0 string \x01\xE0\x60\xF0\x03\x4C\xEE\x08\xAD\x00\x08\xC9 Apple ][ Disk Image
  558. +0 string \x01\xE0\x60\xF0\x03\x4C\xEF\x08\xAD\x00\x08\xC9 Apple ][ Disk Image
  559. +0 string \x01\xE0\x70\xB0\x04\xE0\x40\xB0\x39\xBD\x88\xC0 Apple ][ Disk Image
  560. +0 string \x01\xEA\x8D\xF4\x03\xA9\x60\x9D\x88\xC0\x8D\x51 Apple ][ Disk Image
  561. +
  562. # magic for Newton PDA package formats
  563. # from Ruda Moura <ruda@helllabs.org>
  564. 0 string package0 Newton package, NOS 1.x,
  565. @@ -491,9 +624,107 @@
  566. # Usually not in separate files, but have either filename rsrc with
  567. # no extension, or a filename corresponding to another file, with
  568. # extensions rsr/rsrc
  569. +# URL: http://fileformats.archiveteam.org/wiki/Macintosh_resource_file
  570. +# https://en.wikipedia.org/wiki/Resource_fork
  571. +# Reference: https://github.com/kreativekorp/ksfl/wiki/Macintosh-Resource-File-Format
  572. +# http://developer.apple.com/legacy/mac/library/documentation/mac/pdf/MoreMacintoshToolbox.pdf
  573. +# https://formats.kaitai.io/resource_fork/
  574. +# Update: Joerg Jenderek
  575. +# Note: verified often by command like `deark -m macrsrc Icon_.rsrc`
  576. +# offset of resource data; usually starts at offset 0x0100
  577. 0 string \000\000\001\000
  578. ->4 leshort 0
  579. ->>16 lelong 0 Apple HFS/HFS+ resource fork
  580. +# skip NPETraceSession.etl with invalid "low" map offset 0
  581. +>4 ubelong >0xFF
  582. +# skip few Atari DEGAS Elite bitmap (eil2.pi1 nastro.pi1) with ivalid "high" 0x6550766 0x7510763 map length
  583. +>>12 ubelong <0x8001
  584. +# most examples with zeroed system reserved field
  585. +>>>16 lelong =0
  586. +>>>>0 use apple-rsr
  587. +# few samples with not zeroed system reserved field like: Empty.rsrc.rsr OpenSans-CondBold.dfont
  588. +>>>16 lelong !0
  589. +# resource fork variant with not zeroed system reserved field and copy of header
  590. +>>>>(4.L) ubelong 0x100
  591. +# GRR: the line above only works if in ../../src/file.h FILE_BYTES_MAX is raised from 1 MiB above 0x6ab0f4 (HelveticaNeue.dfont)
  592. +>>>>>0 use apple-rsr
  593. +# data fork variant with not zeroed system reserved field and no copy of header
  594. +>>>>(4.L) ubelong 0
  595. +>>>>>0 use apple-rsr
  596. +# Note: moved and merged from ./macintosh
  597. +# From: Adam Buchbinder <adam.buchbinder@gmail.com>
  598. +# URL: https://en.wikipedia.org/wiki/Datafork_TrueType
  599. +# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
  600. +# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
  601. +# don't know what they mean.
  602. +# display information about Mac OSX datafork font DFONT
  603. +0 name apple-dfont
  604. +>(4.L+30) ubelong x Mac OSX datafork font,
  605. +# https://en.wikipedia.org/wiki/Datafork_TrueType
  606. +!:mime application/x-dfont
  607. +!:ext dfont
  608. +# https://exiftool.org/TagNames/RSRC.html
  609. +>(4.L+30) ubelong 0x73666e74 TrueType
  610. +>(4.L+30) ubelong 0x464f4e54 'FONT'
  611. +>(4.L+30) ubelong 0x4e464e54 'NFNT'
  612. +>(4.L+30) ubelong 0x504f5354 PostScript
  613. +>(4.L+30) ubelong 0x464f4e44 'FOND'
  614. +>(4.L+30) ubelong 0x76657273 'vers'
  615. +# display information about Macintosh resource
  616. +0 name apple-rsr
  617. +>(4.L+30) ubelong 0x73666e74
  618. +>>0 use apple-dfont
  619. +>(4.L+30) ubelong 0x464f4e54
  620. +>>0 use apple-dfont
  621. +>(4.L+30) ubelong 0x4e464e54
  622. +>>0 use apple-dfont
  623. +>(4.L+30) ubelong 0x504f5354
  624. +>>0 use apple-dfont
  625. +>(4.L+30) ubelong 0x464f4e44
  626. +>>0 use apple-dfont
  627. +>(4.L+30) ubelong 0x76657273
  628. +>>0 use apple-dfont
  629. +>(4.L+30) default x Apple HFS/HFS+ resource fork
  630. +#!:mime application/octet-stream
  631. +!:mime application/x-apple-rsr
  632. +!:ext rsrc/rsr
  633. +# offset to resource data; usually starts at offset 0x0100
  634. +>0 ubelong !0x100 \b, data offset %#x
  635. +# offset to resource map; positive but not nil like in NPETraceSession.etl
  636. +>4 ubelong x \b, map offset %#x
  637. +# length of resource map; positive with 32K limitation but not
  638. +# nil like in NPETraceSession.etl or high like 0x7510763 in nastro.pi1
  639. +>12 ubelong x \b, map length %#x
  640. +# length of resource data; positive but not nil like in NPETraceSession.etl
  641. +>8 ubelong x \b, data length %#x
  642. +# reserved 112 bytes for system use; apparently often nil, but 8fd20000h in Empty.rsrc.rsr and 0x00768c2b in OpenSans-CondBold.dfont
  643. +>16 ubelong !0 \b, at 16 %#8.8x
  644. +# https://fontforge.org/docs/techref/macformats.html
  645. +# jump to resource map
  646. +# a copy of resource header or 16 bytes of zeros for data fork
  647. +#>(4.L) ubelong x \b, DATA offset %#x
  648. +#>(4.L+4) ubelong x \b, MAP offset %#x
  649. +#>(4.L+8) ubelong x \b, DATA length %#x
  650. +#>(4.L+12) ubelong x \b, MAP length %#x
  651. +# nextResourceMap; handle to next resource map; used by the Resource Manager for internal bookkeeping; should be zero
  652. +>(4.L+16) ubelong !0 \b, nextResourceMap %#x
  653. +# fileRef; file reference number; used by the Resource Manager for internal bookkeeping; should be zero
  654. +>(4.L+20) ubeshort !0 \b, fileRef %#x
  655. +# attributes; Resource fork attributes (80h~read-only 40h~compression needed 20h~changed); other bits are reserved and should be zero
  656. +>(4.L+22) ubeshort !0 \b, attributes %#x
  657. +# typeListOffset; offset from resource map to start of type list like: 1Ch
  658. +>(4.L+24) ubeshort x \b, list offset %#x
  659. +# nameListOffset; offset from esource map to start of name list like: 32h 46h 56h (XLISP.RSR XLISPTIN.RSR) 13Eh (HelveticaNeue.dfont)
  660. +>(4.L+26) ubeshort x \b, name offset %#x
  661. +# typeCount; number of types in the map minus 1; If there are no resources, this is 0xFFFF
  662. +>(4.L+28) beshort+1 >0 \b, %u type
  663. +# plural s
  664. +>>(4.L+28) beshort+1 >1 \bs
  665. +# resource type list array; 1st resource type like: ALRT CODE FOND MPSR icns scsz
  666. +>>(4.L+30) ubelong x \b, %#x
  667. +>>(4.L+30) string x '%-.4s'
  668. +# resourceCount; number of this type resources minus one. If there is one resource of this type, this is 0x0000
  669. +>>(4.L+34) beshort+1 x * %d
  670. +# resourceListOffset; offset from type list to resource list like: Ah 12h DAh
  671. +>(4.L+36) ubeshort x resource offset %#x
  672. #https://en.wikipedia.org/wiki/AppleScript
  673. 0 string FasdUAS AppleScript compiled
  674. --- a/magic/Magdir/archive
  675. +++ b/magic/Magdir/archive
  676. @@ -1,5 +1,5 @@
  677. #------------------------------------------------------------------------------
  678. -# $File: archive,v 1.169 2022/09/12 13:13:28 christos Exp $
  679. +# $File: archive,v 1.179 2022/12/21 15:50:59 christos Exp $
  680. # archive: file(1) magic for archive formats (see also "msdos" for self-
  681. # extracting compressed archives)
  682. #
  683. @@ -506,11 +506,12 @@
  684. >>>>0 use ttcomp
  685. 0 string \1\4
  686. # TODO:
  687. -# skip Commodore PET BASIC 4.0 program *.prg
  688. -# variant ASCII, 1K dictionary (strength=48=50-2). With strength=49 wrong order! WHY?
  689. # skip shared library (strength=50) handled by ./ibm6000
  690. !:strength -2
  691. ->0 use ttcomp
  692. +# skip Commodore PET BASIC programs (Mastermind.prg) with last 3 nil bytes (\0~end of line followed by 0000h line offset)
  693. +#>-4 ubelong x LAST_BYTES=%8.8x
  694. +>-4 ubelong&0x00FFffFF !0
  695. +>>0 use ttcomp
  696. # display information of TTComp archive
  697. 0 name ttcomp
  698. # (version 5.25) labeled the entry as "TTComp archive data"
  699. @@ -753,6 +754,88 @@
  700. !:ext ??$
  701. >>8 ulelong >0 \b, original size: %u bytes
  702. +# Summary: lzss compressed/EDI Pack
  703. +# From: Joerg Jenderek
  704. +# URL: http://fileformats.archiveteam.org/wiki/EDI_Install_packed_file
  705. +# Note: called "EDI Install LZS compressed data" by TrID and verified by
  706. +# command like `deark -l -m edi_pack -d2 BOOK01A.IC$` as "EDI Pack LZSS1"
  707. +0 string EDILZSS
  708. +>7 string 1
  709. +# look for point character before orginal file name extension
  710. +>>8 search/9/b .
  711. +# check suffix of possible orginal file anme
  712. +#>>>&0 ubelong x SUFFIX=%8.8x
  713. +# samples without valid character after point in original file name field like: FENNEL.LZS PLANTAIN.LZS
  714. +>>>&0 ubyte <0x20
  715. +>>>>0 use edi-lzs
  716. +# samples with valid character after point in original file name field
  717. +>>>&0 ubyte >0x1F
  718. +# check 2nd charcter of suffix
  719. +#>>>>&0 ubyte x 2ND_SUFFIX=%x
  720. +# sample with one valid character after point followed by \0 in original file name field like: SPELMATE.H$
  721. +>>>>&0 ubyte =0
  722. +>>>>>0 use edi-pack
  723. +>>>>&0 ubyte >0x1F
  724. +# check 3rd charcter of suffix
  725. +#>>>>>&0 ubyte x 3RD_SUFFIX=%x
  726. +# no sample with 2 valid characters after point followed by \0 in original file name field
  727. +>>>>>&0 ubyte =0
  728. +>>>>>>0 use edi-pack
  729. +# samples with valid 3rd character after point in original file name field
  730. +>>>>>&0 ubyte >0x1F
  731. +# sample with 3 valid character after point followed by \0 in original file name field like: BOOK01A.IC$ CTL3D.DL$
  732. +>>>>>>&0 ubyte =0
  733. +>>>>>>>0 use edi-pack
  734. +# sample with 3 valid character after point followed by no \0 in original file name field like: HERBTEXT.LZS
  735. +>>>>>>&0 ubyte !0
  736. +>>>>>>>0 use edi-lzs
  737. +# no sample with invalid 3rd character after point in original file name field
  738. +>>>>>&0 default x
  739. +>>>>>>0 use edi-lzs
  740. +# sample with invalid 2nd character after point in original file name field like: LACERATE.LZS SPLINTER.LZS
  741. +>>>>&0 default x
  742. +>>>>>0 use edi-lzs
  743. +# sample without point character in original file name field like GUNSHOT.LZS
  744. +>>8 default x
  745. +>>>0 use edi-lzs
  746. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/e/edi-lzss2.trid.xml
  747. +# Note: called "EDI Install Pro LZSS2 compressed data" by TrID and verified by
  748. +# command like `deark -l -m edi_pack -d2 4WAY.WA$` as "EDI Pack LZSS2"
  749. +>7 string 2 EDI LZSS2 packed
  750. +#!:mime application/octet-stream
  751. +!:mime application/x-edi-pack-lzss
  752. +# the name of a compressed file often ends in character '$' or '_'
  753. +!:ext ??$/??_
  754. +# original filename, NUL-terminated, padded to 13 bytes like: mci.vbx 4way.wav skymap.exe cmdialog.vbx
  755. +>>8 string x "%-0.13s"
  756. +# original file size, as a 4-byte integer.
  757. +>>21 ulelong x \b, %u bytes
  758. +# compressed data like: ff5249464606ec00 ff4d5aa601010000
  759. +>>>25 ubequad x \b, data %#16.16llx...
  760. +0 name edi-pack
  761. +# Note: verified by command like `deark -l -d2 SPELMATE.H$` as "EDI Pack LZSS1"
  762. +# original filename, NUL-terminated, padded to 13 bytes like: ctl3d.dll spelmate.h filemenu.rc owl.def index-it.exe
  763. +# but not like \377Aloe.lzs\273 (HERBTEXT.LZS)
  764. +>8 string x EDI LZSS packed "%-.13s"
  765. +#!:mime application/octet-stream
  766. +!:mime application/x-edi-pack-lzss
  767. +# the name of a compressed file often ends in character '$' or '_'
  768. +!:ext ??$/?$
  769. +# compressed data like: f7000001eff02020 ff4d5aa900020000 ff2f2a207370656c
  770. +>21 ubequad x \b, data %#16.16llx...
  771. +# URL: http://fileformats.archiveteam.org/wiki/EDI_LZSSLib
  772. +# Note: verified partly by command like `deark -l -m edi_pack -d2 GUNSHOT.LZS` as "EDI LZSSLib"
  773. +0 name edi-lzs
  774. +# Note: verified by command like `deark -l -d2 GUNSHOT.LZS` as "EDI LZSSLib"
  775. +# no original filename looks like: \277BM\226.\0 \277BM.n\001 \277BM\226.\0 \277BM.g\001 \377Aloe.lzs\273
  776. +>8 string x EDI LZSSLib packed
  777. +#!:mime application/octet-stream
  778. +!:mime application/x-edi-pack-lzss
  779. +# The name of a compressed file ends with LZS suffix
  780. +!:ext lzs
  781. +# compressed data like: bf424df6e10100f3 ff416c6f652e6c7a ff416c6f652e6c7a
  782. +>8 ubequad x \b, data %#16.16llx...
  783. +
  784. # Summary: CAZIP compressed file
  785. # From: Joerg Jenderek
  786. # URL: http://fileformats.archiveteam.org/wiki/CAZIP
  787. @@ -791,8 +874,6 @@
  788. 3 string OctSqu Squash archive data
  789. # Terse
  790. 0 string \5\1\1\0 Terse archive data
  791. -# PUCrunch
  792. -0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
  793. # UHarc
  794. 0 string UHA UHarc archive data
  795. # ABComp
  796. @@ -821,8 +902,10 @@
  797. # QFC
  798. 0 string \x1aFC\x1a QFC archive data
  799. 0 string \x1aQF\x1a QFC archive data
  800. -# PRO-PACK
  801. -0 string RNC PRO-PACK archive data
  802. +# PRO-PACK https://www.segaretro.org/Rob_Northen_compression
  803. +0 string RNC
  804. +>3 byte 1 PRO-PACK archive data (compression 1)
  805. +>3 byte 2 PRO-PACK archive data (compression 2)
  806. # 777
  807. 0 string 777 777 archive data
  808. # LZS221
  809. @@ -1234,7 +1317,7 @@
  810. >>>>>>3 regex \^lh[01] LHarc 1.x/ARX archive data
  811. # LHice archiver use ".ICE" as name extension instead usual one ".lzh"
  812. # FOOBAR archiver use ".foo" as name extension instead usual one
  813. -# "Florain Orjanov's and Olga Bachetska's ARchiver" not found at the moment
  814. +# "Florian Orjanov's and Olga Bachetska's ARchiver" not found at the moment
  815. >>>>>>>2 string -lh1 \b
  816. !:ext lha/lzh/ice
  817. >>>>>>3 regex \^lh[23d] LHa 2.x? archive data
  818. @@ -1789,6 +1872,14 @@
  819. !:mime application/zip
  820. !:ext zip/cbz
  821. +# Recognize ZIP archives with prepended data by end-of-central-directory record
  822. +# https://en.wikipedia.org/wiki/ZIP_(file_format)#End_of_central_directory_record_(EOCD)
  823. +# by Michal Gorny <mgorny@gentoo.org>
  824. +-2 uleshort 0
  825. +>&-22 string PK\005\006 Zip archive, with extra data prepended
  826. +!:mime application/zip
  827. +!:ext zip/cbz
  828. +
  829. # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
  830. # by Stefan `Sec` Zehl <sec@42.org>
  831. 7 string **ACE** ACE archive data
  832. @@ -2066,6 +2157,7 @@
  833. # https://gitweb.gentoo.org/proj/portage.git/tree/man/xpak.5
  834. -4 string STOP
  835. >-16 string XPAKSTOP Gentoo binary package (XPAK)
  836. +!:mime application/vnd.gentoo.xpak
  837. # From: Joerg Jenderek
  838. # URL: https://kodi.wiki/view/TexturePacker
  839. @@ -2110,3 +2202,71 @@
  840. # From wof (wof@stachelkaktus.net)
  841. 0 string Unison\ archive\ format Unison archive format
  842. +
  843. +# https://ankiweb.net
  844. +30 string collection.anki2 Anki APKG file
  845. +#!:ext .apkg
  846. +
  847. +# Synology archive (DiskStation Manager 7.0+)
  848. +# From: Alexandre Iooss <erdnaxe@crans.org>
  849. +# Note: These archives are signed and encrypted.
  850. +0 ulelong&0xFFFFFF00 0xEFBEAD00
  851. +# MessagePack header (fixarray of 5 elements starting with a bin of 32 bytes)
  852. +>8 ulelong&0x00FFFFFF 0x20C495 Synology archive
  853. +!:ext spk
  854. +# Extract some properties from MessagePack third item
  855. +>>43 search/0x10000 package=
  856. +>>>&0 string x \b, package %s
  857. +>>43 search/0x10000 arch=
  858. +>>>&0 string x %s
  859. +>>43 search/0x10000 version=
  860. +>>>&0 string x %s
  861. +>>43 search/0x10000 create_time=
  862. +>>>&0 string x \b, created on %s
  863. +
  864. +# MonoGame/XNA processed assets archive
  865. +# From: Alexandre Iooss <erdnaxe@crans.org>
  866. +# URL: https://github.com/MonoGame/MonoGame/blob/v3.8.1/MonoGame.Framework/Content/ContentManager.cs
  867. +0 string XNB
  868. +# XNB must be version 4 or 5
  869. +>4 byte <6
  870. +>>4 byte >3
  871. +# Size must be positive
  872. +>>>6 lelong >0 MonoGame/XNA processed assets
  873. +!:ext xnb
  874. +>>>>3 string =w \b, for Windows
  875. +>>>>3 string =x \b, for Xbox360
  876. +>>>>3 string =i \b, for iOS
  877. +>>>>3 string =a \b, for Android
  878. +>>>>3 string =d \b, for DesktopGL
  879. +>>>>3 string =X \b, for MacOSX
  880. +>>>>3 string =W \b, for WindowsStoreApp
  881. +>>>>3 string =n \b, for NativeClient
  882. +>>>>3 string =M \b, for WindowsPhone8
  883. +>>>>3 string =r \b, for RaspberryPi
  884. +>>>>3 string =P \b, for PlayStation4
  885. +>>>>3 string =5 \b, for PlayStation5
  886. +>>>>3 string =O \b, for XboxOne
  887. +>>>>3 string =S \b, for Nintendo Switch
  888. +>>>>3 string =G \b, for Google Stadia
  889. +>>>>3 string =b \b, for WebAssembly and Bridge.NET
  890. +>>>>3 string =m \b, for WindowsPhone7.0 (XNA)
  891. +>>>>3 string =p \b, for PlayStationMobile
  892. +>>>>3 string =v \b, for PSVita
  893. +>>>>3 string =g \b, for Windows (OpenGL)
  894. +>>>>3 string =l \b, for Linux
  895. +>>>>4 byte x \b, version %d
  896. +>>>>5 byte &0x80 \b, LZX compressed
  897. +>>>>>10 lelong x \b, decompressed size: %d bytes
  898. +>>>>5 byte &0x40 \b, LZ4 compressed
  899. +>>>>>10 lelong x \b, decompressed size: %d bytes
  900. +
  901. +# Electron ASAR archive
  902. +# From: Alexandre Iooss <erdnaxe@crans.org>
  903. +# URL: https://github.com/electron/asar
  904. +0 ulelong 4
  905. +# Match JSON header start and end
  906. +>16 string {"files":{"
  907. +>>(12.l+12) string }}}} Electron ASAR archive
  908. +!:ext asar
  909. +>>>12 ulelong x \b, header length: %d bytes
  910. --- a/magic/Magdir/arm
  911. +++ b/magic/Magdir/arm
  912. @@ -1,5 +1,5 @@
  913. #------------------------------------------------------------------------------
  914. -# $File: arm,v 1.2 2021/07/14 17:40:31 christos Exp $
  915. +# $File: arm,v 1.3 2022/10/31 14:35:39 christos Exp $
  916. # arm: file(1) magic for ARM COFF
  917. #
  918. # https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
  919. @@ -36,6 +36,15 @@
  920. # test for unused flag bits in f_flags
  921. >18 uleshort&0x8E80 0
  922. # use little endian variant of subroutine to
  923. +# display name+variables+flags for common object formatted files
  924. +>>0 use display-coff
  925. +!:strength -10
  926. +
  927. +# ARM64EC
  928. +0 leshort 0xa641
  929. +# test for unused flag bits in f_flags
  930. +>18 uleshort&0x8E80 0
  931. +# use little endian variant of subroutine to
  932. # display name+variables+flags for common object formatted files
  933. >>0 use display-coff
  934. !:strength -10
  935. --- a/magic/Magdir/asf
  936. +++ b/magic/Magdir/asf
  937. @@ -1,6 +1,6 @@
  938. #------------------------------------------------------------------------------
  939. -# $File: asf,v 1.3 2022/04/25 17:33:13 christos Exp $
  940. +# $File: asf,v 1.4 2022/10/31 13:22:26 christos Exp $
  941. # asf: file(1) magic for Microsoft Advanced Systems Format (ASF) files
  942. # http://www.staroceans.org/e-book/ASF_Specification.pdf
  943. @@ -21,7 +21,7 @@
  944. # ASF_Stream_Properties_Object
  945. >0 guid B7DC0791-A9B7-11CF-8EE6-00C00C205365
  946. #>>56 lequad x Time Offset %lld
  947. -#>>64 lelong x Type-Specicic Data Length %d
  948. +#>>64 lelong x Type-Specific Data Length %d
  949. #>>68 lelong x Error Correction Data Length %d
  950. #>>72 leshort x Flags %#x
  951. #>>74 lelong x Reserved %x
  952. --- a/magic/Magdir/audio
  953. +++ b/magic/Magdir/audio
  954. @@ -1,6 +1,6 @@
  955. #------------------------------------------------------------------------------
  956. -# $File: audio,v 1.124 2022/08/28 08:58:20 christos Exp $
  957. +# $File: audio,v 1.126 2022/10/09 13:40:22 christos Exp $
  958. # audio: file(1) magic for sound formats (see also "iff")
  959. #
  960. # Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
  961. --- a/magic/Magdir/blender
  962. +++ b/magic/Magdir/blender
  963. @@ -1,13 +1,24 @@
  964. #------------------------------------------------------------------------------
  965. -# $File: blender,v 1.8 2019/04/19 00:42:27 christos Exp $
  966. +# $File: blender,v 1.9 2022/12/21 15:53:27 christos Exp $
  967. # blender: file(1) magic for Blender 3D related files
  968. #
  969. # Native format rule v1.2. For questions use the developers list
  970. # https://lists.blender.org/mailman/listinfo/bf-committers
  971. # GLOB chunk was moved near start and provides subversion info since 2.42
  972. -
  973. +# Update: Joerg Jenderek
  974. +# URL: http://fileformats.archiveteam.org/wiki/BLEND
  975. +# http://www.blender.org/
  976. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/blend.trid.xml
  977. +# http://formats.kaitai.io/blender_blend/index.html
  978. +# Note: called "Blender 3D data" by TrID
  979. +# and gzip compressed variant handled by ./compress
  980. 0 string =BLENDER Blender3D,
  981. +#!:mime application/octet-stream
  982. +!:mime application/x-blender
  983. +!:ext blend
  984. +# no sample found with extension blender
  985. +#!:ext blend/blender
  986. >7 string =_ saved as 32-bits
  987. >>8 string =v little endian
  988. >>>9 byte x with version %c.
  989. --- a/magic/Magdir/c-lang
  990. +++ b/magic/Magdir/c-lang
  991. @@ -1,5 +1,5 @@
  992. #------------------------------------------------------------------------------
  993. -# $File: c-lang,v 1.30 2021/08/16 10:17:05 christos Exp $
  994. +# $File: c-lang,v 1.31 2022/12/01 22:04:33 christos Exp $
  995. # c-lang: file(1) magic for C and related languages programs
  996. #
  997. # The strength is to beat standard HTML
  998. @@ -88,13 +88,13 @@
  999. !:strength + 30
  1000. !:mime text/x-c++
  1001. 0 search/8192 protected
  1002. ->0 regex \^[[:space:]]*protected: C++ source text
  1003. +>0 regex \^[[:space:]]*protected: C++ source text
  1004. !:strength + 30
  1005. !:mime text/x-c++
  1006. # Objective-C
  1007. 0 search/8192 #import
  1008. ->0 regex \^#import Objective-C source text
  1009. +>0 regex \^#import[[:space:]]+["<] Objective-C source text
  1010. !:strength + 25
  1011. !:mime text/x-objective-c
  1012. --- a/magic/Magdir/c64
  1013. +++ b/magic/Magdir/c64
  1014. @@ -1,6 +1,6 @@
  1015. #------------------------------------------------------------------------------
  1016. -# $File: c64,v 1.12 2022/05/14 20:03:39 christos Exp $
  1017. +# $File: c64,v 1.13 2022/11/21 22:25:37 christos Exp $
  1018. # c64: file(1) magic for various commodore 64 related files
  1019. #
  1020. # From: Dirk Jagdmann <doj@cubic.org>
  1021. @@ -194,7 +194,338 @@
  1022. >100 byte >0 \b, %u subsong(s)
  1023. # CBM BASIC (cc65 compiled)
  1024. +# Summary: binary executable or Basic program for Commodore C64 computers
  1025. +# Update: Joerg Jenderek
  1026. +# URL: http://fileformats.archiveteam.org/wiki/Commodore_BASIC_tokenized_file
  1027. +# Reference: https://www.c64-wiki.com/wiki/BASIC_token
  1028. +# https://github.com/thezerobit/bastext/blob/master/bastext.doc
  1029. +# http://mark0.net/download/triddefs_xml.7z/defs/p/prg-c64.trid.xml
  1030. +# TODO: unify Commodore BASIC/program sub routines
  1031. +# Note: "PUCrunch archive data" moved from ./archive and merged with c64-exe
  1032. 0 leshort 0x0801
  1033. ->2 leshort 0x080b
  1034. ->6 string \x9e CBM BASIC
  1035. ->7 string >\0 \b, SYS %s
  1036. +# if first token is not SYS this implies BASIC program in most cases
  1037. +>6 ubyte !0x9e
  1038. +# but sELF-ExTRACTING-zIP executable unzp6420.prg contains SYS token at end of second BASIC line (at 0x35)
  1039. +>>23 search/30 \323ELF-E\330TRACTING-\332IP
  1040. +>>>0 use c64-exe
  1041. +>>23 default x
  1042. +>>>0 use c64-prg
  1043. +# if first token is SYS this implies binary executable
  1044. +>6 ubyte =0x9e
  1045. +>>0 use c64-exe
  1046. +# display information about C64 binary executable (memory address, line number, token)
  1047. +0 name c64-exe
  1048. +>0 uleshort x Commodore C64
  1049. +# http://a1bert.kapsi.fi/Dev/pucrunch/
  1050. +# start address 0801h; next offset 080bh; BASIC line number is 239=00EFh; BASIC instruction is SYS 2061
  1051. +# the above combination appartly also occur for other Commodore programs like: gunzip111.c64.prg
  1052. +# and there exist PUCrunch archive for other machines like C16 with other magics
  1053. +>0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 program, probably PUCrunch archive data
  1054. +!:mime application/x-compress-pucrunch
  1055. +!:ext prg/pck
  1056. +>0 string !\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 program
  1057. +!:mime application/x-commodore-exec
  1058. +!:ext prg/
  1059. +# start address like: 801h
  1060. +>0 uleshort !0x0801 \b, start address %#4.4x
  1061. +# 1st BASIC fragment
  1062. +>2 use basic-line
  1063. +# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
  1064. +>(2.s-0x800) ubyte x
  1065. +>>&-1 ubyte !0 \b, no EOL=%#x
  1066. +# valid 2nd BASIC fragment found only in sELF-ExTRACTING-zIP executable unzp6420.prg
  1067. +>>23 search/30 \323ELF-E\330TRACTING-\332IP
  1068. +# jump again from beginning
  1069. +>>>(2.s-0x800) ubyte x
  1070. +>>>>&0 use basic-line
  1071. +# Zero-byte marking the end of the BASIC line
  1072. +>-3 ubyte !0 \b, 3 last bytes %#2.2x
  1073. +# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
  1074. +>>-2 ubeshort x \b%4.4x
  1075. +# display information about tokenized C64 BASIC program (memory address, line number, token)
  1076. +0 name c64-prg
  1077. +>0 uleshort x Commodore C64 BASIC program
  1078. +!:mime application/x-commodore-basic
  1079. +# Tokenized BASIC programs were stored by Commodore as file type program "PRG" in separate field in directory structures.
  1080. +# So file name can have no suffix like in saveroms; When transferring to other platforms, they are often saved with .prg extensions.
  1081. +# BAS suffix is typically used for the BASIC source but also found in program pods.bas
  1082. +!:ext prg/bas/
  1083. +# start address like: 801h
  1084. +>0 uleshort !0x0801 \b, start address %#4.4x
  1085. +# 1st BASIC fragment
  1086. +>2 use basic-line
  1087. +# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
  1088. +>(2.s-0x0800) ubyte x
  1089. +>>&-1 ubyte !0 \b, no EOL=%#x
  1090. +# 2nd BASIC fragment
  1091. +>>&0 use basic-line
  1092. +# zero-byte marking the end of the BASIC line
  1093. +>-3 ubyte !0 \b, 3 last bytes %#2.2x
  1094. +# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
  1095. +>>-2 ubeshort x \b%4.4x
  1096. +# Summary: binary executable or Basic program for Commodore C128 computers
  1097. +# URL: https://en.wikipedia.org/wiki/Commodore_128
  1098. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/prg-c128.trid.xml
  1099. +# From: Joerg Jenderek
  1100. +# Note: Commodore 128 BASIC 7.0 variant; there exist varaints with different start addresses
  1101. +0 leshort 0x1C01
  1102. +!:strength +1
  1103. +# GRR: line above with strength 51 (50+1) is too generic because it matches SVr3 curses screen image, big-endian with strength (50) handled by ./terminfo
  1104. +# probably skip SVr3 curses images with "invalid high" second line offset
  1105. +>2 uleshort <0x1D02
  1106. +# skip foo with "invalid low" second line offset
  1107. +>>2 uleshort >0x1C06
  1108. +# if first token is not SYS this implies BASIC program
  1109. +>>>6 ubyte !0x9e
  1110. +>>>>0 use c128-prg
  1111. +# if first token is SYS this implies binary executable
  1112. +>>>6 ubyte =0x9e
  1113. +>>>>0 use c128-exe
  1114. +# Summary: binary executable or Basic program for Commodore C128 computers
  1115. +# Note: Commodore 128 BASIC 7.1 extension by Rick Simon
  1116. +# start adress 132Dh
  1117. +#0 leshort 0x132D THIS_IS_C128_7.1
  1118. +#>0 use c128-prg
  1119. +# Summary: binary executable or Basic program for Commodore C128 computers
  1120. +# Note: Commodore 128 BASIC 7.0 saved with graphics mode enabled
  1121. +# start adress 4001h
  1122. +#0 leshort 0x4001 THIS_IS_C128_GRAPHIC
  1123. +#>0 use c128-prg
  1124. +# display information about tokenized C128 BASIC program (memory address, line number, token)
  1125. +0 name c128-prg
  1126. +>0 uleshort x Commodore C128 BASIC program
  1127. +!:mime application/x-commodore-basic
  1128. +!:ext prg
  1129. +# start address like: 1C01h
  1130. +>0 uleshort !0x1C01 \b, start address %#4.4x
  1131. +# 1st BASIC fragment
  1132. +>2 use basic-line
  1133. +# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
  1134. +>(2.s-0x1C00) ubyte x
  1135. +>>&-1 ubyte !0 \b, no EOL=%#x
  1136. +# 2nd BASIC fragment
  1137. +>>&0 use basic-line
  1138. +# Zero-byte marking the end of the BASIC line
  1139. +>-3 ubyte !0 \b, 3 last bytes %#2.2x
  1140. +# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
  1141. +>>-2 ubeshort x \b%4.4x
  1142. +# display information about C128 program (memory address, line number, token)
  1143. +0 name c128-exe
  1144. +>0 uleshort x Commodore C128 program
  1145. +!:mime application/x-commodore-exec
  1146. +!:ext prg/
  1147. +# start address like: 1C01h
  1148. +>0 uleshort !0x1C01 \b, start address %#4.4x
  1149. +# 1st BASIC fragment
  1150. +>2 use basic-line
  1151. +# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
  1152. +>(2.s-0x1C00) ubyte x
  1153. +>>&-1 ubyte !0 \b, no EOL=%#x
  1154. +# no valid 2nd BASIC fragment in Commodore executables
  1155. +#>>&0 use basic-line
  1156. +# Zero-byte marking the end of the BASIC line
  1157. +>-3 ubyte !0 \b, 3 last bytes %#2.2x
  1158. +# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
  1159. +>>-2 ubeshort x \b%4.4x
  1160. +# Summary: binary executable or Basic program for Commodore C16/VIC-20/Plus4 computers
  1161. +# URL: https://en.wikipedia.org/wiki/Commodore_Plus/4
  1162. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/prg-vic20.trid.xml
  1163. +# defs/p/prg-plus4.trid.xml
  1164. +# From: Joerg Jenderek
  1165. +# Note: there exist VIC-20 variants with different start address
  1166. +# GRR: line below is too generic because it matches Novell LANalyzer capture
  1167. +# with regular trace header record handled by ./sniffer
  1168. +0 leshort 0x1001
  1169. +# skip regular Novell LANalyzer capture (novell-2.tr1 novell-lanalyzer.tr1 novell-win10.tr1) with "invalid low" token value 54h
  1170. +>6 ubyte >0x7F
  1171. +# skip regular Novell LANalyzer capture (novell-2.tr1 novell-lanalyzer.tr1 novell-win10.tr1) with "invalid low" second line offset 4Ch
  1172. +#>>2 uleshort >0x1006 OFFSET_NOT_TOO_LOW
  1173. +# skip foo with "invalid high" second line offset but not for 0x123b (Minefield.prg)
  1174. +#>>>2 uleshort <0x1102 OFFSET_NOT_TOO_HIGH
  1175. +# if first token is not SYS this implies BASIC program
  1176. +>>6 ubyte !0x9e
  1177. +# valid second end of line separator implies BASIC program
  1178. +>>>(2.s-0x1000) ubyte =0
  1179. +>>>>0 use c16-prg
  1180. +# invalid second end of line separator !=0 implies binary executable like: Minefield.prg
  1181. +>>>(2.s-0x1000) ubyte !0
  1182. +>>>>0 use c16-exe
  1183. +# if first token is SYS this implies binary executable
  1184. +>>6 ubyte =0x9e
  1185. +>>>0 use c16-exe
  1186. +# display information about C16 program (memory address, line number, token)
  1187. +0 name c16-exe
  1188. +>0 uleshort x Commodore C16/VIC-20/Plus4 program
  1189. +!:mime application/x-commodore-exec
  1190. +!:ext prg/
  1191. +# start address like: 1001h
  1192. +>0 uleshort !0x1001 \b, start address %#4.4x
  1193. +# 1st BASIC fragment
  1194. +>2 use basic-line
  1195. +# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
  1196. +>(2.s-0x1000) ubyte x
  1197. +>>&-1 ubyte !0 \b, no EOL=%#x
  1198. +# no valid 2nd BASIC fragment in excutables
  1199. +#>>&0 use basic-line
  1200. +# Zero-byte marking the end of the BASIC line
  1201. +>-3 ubyte !0 \b, 3 last bytes %#2.2x
  1202. +# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
  1203. +>>-2 ubeshort x \b%4.4x
  1204. +# display information about tokenized C16 BASIC program (memory address, line number, token)
  1205. +0 name c16-prg
  1206. +>0 uleshort x Commodore C16/VIC-20/Plus4 BASIC program
  1207. +!:mime application/x-commodore-basic
  1208. +!:ext prg
  1209. +# start address like: 1001h
  1210. +>0 uleshort !0x1001 \b, start address %#4.4x
  1211. +# 1st BASIC fragment
  1212. +>2 use basic-line
  1213. +# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
  1214. +>(2.s-0x1000) ubyte x
  1215. +>>&-1 ubyte !0 \b, no EOL=%#x
  1216. +# 2nd BASIC fragment
  1217. +>>&0 use basic-line
  1218. +# Zero-byte marking the end of the BASIC line
  1219. +>-3 ubyte !0 \b, 3 last bytes %#2.2x
  1220. +# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
  1221. +>>-2 ubeshort x \b%4.4x
  1222. +# Summary: binary executable or Basic program for Commodore VIC-20 computer with 8K RAM expansion
  1223. +# URL: https://en.wikipedia.org/wiki/VIC-20
  1224. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/prg-vic20-8k.trid.xml
  1225. +# From: Joerg Jenderek
  1226. +# Note: Basic v2.0 with Basic v4.0 extension (VIC20); there exist VIC-20 variants with different start addresses
  1227. +# start adress 1201h
  1228. +0 leshort 0x1201
  1229. +# if first token is not SYS this implies BASIC program
  1230. +>6 ubyte !0x9e
  1231. +>>0 use vic-prg
  1232. +# if first token is SYS this implies binary executable
  1233. +>6 ubyte =0x9e
  1234. +>>0 use vic-exe
  1235. +# display information about Commodore VIC-20 BASIC+8K program (memory address, line number, token)
  1236. +0 name vic-prg
  1237. +>0 uleshort x Commodore VIC-20 +8K BASIC program
  1238. +!:mime application/x-commodore-basic
  1239. +!:ext prg
  1240. +# start address like: 1201h
  1241. +>0 uleshort !0x1201 \b, start address %#4.4x
  1242. +# 1st BASIC fragment
  1243. +>2 use basic-line
  1244. +# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
  1245. +>(2.s-0x1200) ubyte x
  1246. +>>&-1 ubyte !0 \b, no EOL=%#x
  1247. +# 2nd BASIC fragment
  1248. +>>&0 use basic-line
  1249. +# Zero-byte marking the end of the BASIC line
  1250. +>-3 ubyte !0 \b, 3 last bytes %#2.2x
  1251. +# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
  1252. +>>-2 ubeshort x \b%4.4x
  1253. +# display information about Commodore VIC-20 +8K program (memory address, line number, token)
  1254. +0 name vic-exe
  1255. +>0 uleshort x Commodore VIC-20 +8K program
  1256. +!:mime application/x-commodore-exec
  1257. +!:ext prg/
  1258. +# start address like: 1201h
  1259. +>0 uleshort !0x1201 \b, start address %#4.4x
  1260. +# 1st BASIC fragment
  1261. +>2 use basic-line
  1262. +# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
  1263. +>(2.s-0x0400) ubyte x
  1264. +>>&-1 ubyte !0 \b, no EOL=%#x
  1265. +# no valid 2nd BASIC fragment in excutables
  1266. +#>>&0 use basic-line
  1267. +# Zero-byte marking the end of the BASIC line
  1268. +>-3 ubyte !0 \b, 3 last bytes %#2.2x
  1269. +# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
  1270. +>>-2 ubeshort x \b%4.4x
  1271. +# Summary: binary executable or Basic program for Commodore PET computers
  1272. +# URL: https://en.wikipedia.org/wiki/Commodore_PET
  1273. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/prg-pet.trid.xml
  1274. +# From: Joerg Jenderek
  1275. +# start adress 0401h
  1276. +0 leshort 0x0401
  1277. +!:strength +1
  1278. +# GRR: line above with strength 51 (50+1) is too generic because it matches TTComp archive data, ASCII, 1K dictionary
  1279. +# (strength=48=50-2) handled by ./archive and shared library (strength=50) handled by ./ibm6000
  1280. +# skip TTComp archive data, ASCII, 1K dictionary ttcomp-ascii-1k.bin with "invalid high" second line offset 4162h
  1281. +>2 uleshort <0x0502
  1282. +# skip foo with "invalid low" second line offset
  1283. +#>>2 uleshort >0x0406 OFFSET_NOT_TOO_LOW
  1284. +# skip bar with "invalid end of line"
  1285. +#>>>(2.s-0x0400) ubyte =0 END_OF_LINE_OK
  1286. +# if first token is not SYS this implies BASIC program
  1287. +>>6 ubyte !0x9e
  1288. +>>>0 use pet-prg
  1289. +# if first token is SYS this implies binary executable
  1290. +>>6 ubyte =0x9e
  1291. +>>>0 use pet-exe
  1292. +# display information about Commodore PET BASIC program (memory address, line number, token)
  1293. +0 name pet-prg
  1294. +>0 uleshort x Commodore PET BASIC program
  1295. +!:mime application/x-commodore-basic
  1296. +!:ext prg
  1297. +# start address like: 0401h
  1298. +>0 uleshort !0x0401 \b, start address %#4.4x
  1299. +# 1st BASIC fragment
  1300. +>2 use basic-line
  1301. +# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
  1302. +>(2.s-0x0400) ubyte x
  1303. +# 2nd BASIC fragment
  1304. +>>&0 use basic-line
  1305. +# zero-byte marking the end of the BASIC line
  1306. +>-3 ubyte !0 \b, 3 last bytes %#2.2x
  1307. +# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
  1308. +>>-2 ubeshort x \b%4.4x
  1309. +# display information about Commodore PET program (memory address, line number, token)
  1310. +0 name pet-exe
  1311. +>0 uleshort x Commodore PET program
  1312. +!:mime application/x-commodore-exec
  1313. +!:ext prg/
  1314. +# start address like: 0401h
  1315. +>0 uleshort !0x0401 \b, start address %#4.4x
  1316. +# 1st BASIC fragment
  1317. +>2 use basic-line
  1318. +# jump to 1 byte before next BASIC fragment; this must be zero-byte marking the end of line
  1319. +>(2.s-0x0400) ubyte x
  1320. +>>&-1 ubyte !0 \b, no EOL=%#x
  1321. +# no valid 2nd BASIC fragment in excutables
  1322. +#>>&0 use basic-line
  1323. +# Zero-byte marking the end of the BASIC line
  1324. +>-3 ubyte !0 \b, 3 last bytes %#2.2x
  1325. +# Two zero-bytes in place of the pointer to next BASIC line indicates the end of the program
  1326. +>>-2 ubeshort x \b%4.4x
  1327. +# display information about tokenized BASIC line (memory address, line number, Token)
  1328. +0 name basic-line
  1329. +# pointer to memory address of beginning of "next" BASIC line
  1330. +# greater then previous offset but maximal 100h difference
  1331. +>0 uleshort x \b, offset %#4.4x
  1332. +# BASIC line number with range from 0 to 65520; practice to increment numbers by some value (5, 10 or 100)
  1333. +>2 uleshort x \b, line %u
  1334. +# https://www.c64-wiki.com/wiki/BASIC_token
  1335. +# The "high-bit" bytes from #128-#254 stood for the various BASIC commands and mathematical operators
  1336. +>4 ubyte x \b, token (%#x)
  1337. +# https://www.c64-wiki.com/wiki/REM
  1338. +>4 string \x8f REM
  1339. +# remark string like: ** SYNTHESIZER BY RICOCHET **
  1340. +>>5 string >\0 %s
  1341. +#>>>&1 uleshort x \b, NEXT OFFSET %#4.4x
  1342. +# https://www.c64-wiki.com/wiki/PRINT
  1343. +>4 string \x99 PRINT
  1344. +# string like: "Hello world" "\021 \323ELF-E\330TRACTING-\332IP (64 ONLY)\016\231":\2362141
  1345. +>>5 string x %s
  1346. +#>>>&0 ubequad x AFTER_PRINT=%#16.16llx
  1347. +# https://www.c64-wiki.com/wiki/POKE
  1348. +>4 string \x97 POKE
  1349. +# <Memory address>,<number>
  1350. +>>5 regex \^[0-9,\040]+ %s
  1351. +# https://www.c64-wiki.com/wiki/SYS 0x9e=\236
  1352. +>4 string \x9e SYS
  1353. +# SYS <Address> parameter is a 16-bit unsigned integer; in the range 0 - 65535
  1354. +>>5 regex \^[0-9]{1,5} %s
  1355. +# maybe followed by spaces, "control-characters" or colon (:) followed by next commnds or in victracker.prg
  1356. +# (\302(43)\252256\254\302(44)\25236) /T.L.R/
  1357. +#>>5 string x SYS_STRING="%s"
  1358. +# https://www.c64-wiki.com/wiki/GOSUB
  1359. +>4 string \x8d GOSUB
  1360. +# <line>
  1361. +>>5 string >\0 %s
  1362. --- a/magic/Magdir/cad
  1363. +++ b/magic/Magdir/cad
  1364. @@ -1,6 +1,6 @@
  1365. #------------------------------------------------------------------------------
  1366. -# $File: cad,v 1.29 2021/12/06 19:33:27 christos Exp $
  1367. +# $File: cad,v 1.31 2022/12/09 15:36:23 christos Exp $
  1368. # autocad: file(1) magic for cad files
  1369. #
  1370. @@ -301,18 +301,50 @@
  1371. # https://docs.techsoft3d.com/visualize/3df/latest/build/general/hsf/\
  1372. # HSF_architecture.html
  1373. # Stephane Charette <stephane.charette@gmail.com>
  1374. -0 string ;;\020HSF\020V OpenHSF (Hoops Stream Format)
  1375. ->7 regex/9 V[.0-9]{4,5}\020 %s
  1376. +0 string ;;\040HSF\040V OpenHSF (Hoops Stream Format)
  1377. +>7 regex/9 V[.0-9]{4,5}\040 %s
  1378. !:ext hsf
  1379. # AutoCAD Drawing Exchange Format
  1380. +# Update: Joerg Jenderek
  1381. +# URL: http://fileformats.archiveteam.org/wiki/DXF
  1382. +# https://en.wikipedia.org/wiki/AutoCAD_DXF
  1383. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/
  1384. +# dxf-var0.trid.xml dxf-var0u.trid.xml dxf-var2.trid.xml dxf-var2u.trid.xml
  1385. +# Note: called "AutoCAD Drawing eXchange Format" by TrID and
  1386. +# "Drawing Interchange File Format (ASCII)" by DROID
  1387. +# GRR: some samples does not match 1st test like: abydos.dxf
  1388. 0 regex \^[\ \t]*0\r?\000$
  1389. >1 regex \^[\ \t]*SECTION\r?$
  1390. >>2 regex \^[\ \t]*2\r?$
  1391. +# GRR: some samples without HEADER section like: airplan2.dxf
  1392. >>>3 regex \^[\ \t]*HEADER\r?$ AutoCAD Drawing Exchange Format
  1393. -!:mime application/x-dxf
  1394. +#!:mime application/x-dxf
  1395. +!:mime image/vnd.dxf
  1396. !:ext dxf
  1397. +# DROID PUID fmt/64 fmt-64-signature-id-99.dxf
  1398. +>>>>&1 search/8192 MC0.0 \b, 1.0
  1399. +# DROID PUID fmt/65 fmt-65-signature-id-100.dxf
  1400. +>>>>&1 search/8192 AC1.2 \b, 1.2
  1401. +# DROID PUID fmt/66 fmt-66-signature-id-101.dxf
  1402. +>>>>&1 search/8192 AC1.3 \b, 1.3
  1403. +# DROID PUID fmt/67 fmt-67-signature-id-102.dxf
  1404. +>>>>&1 search/8192 AC1.40 \b, 1.4
  1405. +# DROID PUID fmt/68 fmt-68-signature-id-103.dxf
  1406. +>>>>&1 search/8192 AC1.50 \b, 2.0
  1407. +# DROID PUID fmt/69 fmt-69-signature-id-104.dxf
  1408. +>>>>&1 search/8192 AC2.10 \b, 2.1
  1409. +# DROID PUID fmt/70 fmt-70-signature-id-105.dxf
  1410. +>>>>&1 search/8192 AC2.21 \b, 2.2
  1411. +# DROID PUID fmt/71 fmt-71-signature-id-106.dxf
  1412. +>>>>&1 search/8192 AC1002 \b, 2.5
  1413. +# DROID PUID fmt/72 fmt-72-signature-id-107.dxf
  1414. +>>>>&1 search/8192 AC1003 \b, 2.6
  1415. +# DROID PUID fmt/73 fmt-73-signature-id-108.dxf
  1416. +>>>>&1 search/8192 AC1004 \b, R9
  1417. >>>>&1 search/8192 AC1006 \b, R10
  1418. +# http://cd.textfiles.com/amigaenv/DXF/OBJEKTE/LASTMINUTE/apple.dxf
  1419. +#>>>>&1 search/8192 AC1008 \b, Rfoo
  1420. >>>>&1 search/8192 AC1009 \b, R11/R12
  1421. >>>>&1 search/8192 AC1012 \b, R13
  1422. >>>>&1 search/8192 AC1013 \b, R13c3
  1423. --- a/magic/Magdir/coff
  1424. +++ b/magic/Magdir/coff
  1425. @@ -1,6 +1,6 @@
  1426. #------------------------------------------------------------------------------
  1427. -# $File: coff,v 1.6 2021/04/26 15:56:00 christos Exp $
  1428. +# $File: coff,v 1.7 2022/11/21 22:30:22 christos Exp $
  1429. # coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
  1430. #
  1431. # COFF
  1432. @@ -37,6 +37,7 @@
  1433. # ARM COFF (./arm)
  1434. >>>>0 uleshort 0xaa64 Aarch64
  1435. >>>>0 uleshort 0x01c0 ARM
  1436. +>>>>0 uleshort 0xa641 ARM64EC
  1437. >>>>0 uleshort 0x01c2 ARM Thumb
  1438. >>>>0 uleshort 0x01c4 ARMv7 Thumb
  1439. # TODO for other COFFs
  1440. --- a/magic/Magdir/commands
  1441. +++ b/magic/Magdir/commands
  1442. @@ -1,6 +1,6 @@
  1443. #------------------------------------------------------------------------------
  1444. -# $File: commands,v 1.69 2022/04/20 21:14:23 christos Exp $
  1445. +# $File: commands,v 1.73 2022/11/06 18:39:23 christos Exp $
  1446. # commands: file(1) magic for various shells and interpreters
  1447. #
  1448. #0 string/w : shell archive or script for antique kernel text
  1449. @@ -8,6 +8,8 @@
  1450. !:mime text/x-shellscript
  1451. 0 string/fwb #!\ /bin/sh POSIX shell script executable (binary data)
  1452. !:mime text/x-shellscript
  1453. +>10 string #\040This\040script\040was\040generated\040using\040Makeself \b, self-executable archive
  1454. +>>53 string x \b, Makeself %s
  1455. 0 string/fwt #!\ /bin/csh C shell script text executable
  1456. !:mime text/x-shellscript
  1457. @@ -97,9 +99,6 @@
  1458. 0 string/fwt #!\ /usr/bin/env\ fish fish shell script text executable
  1459. !:mime text/x-shellscript
  1460. -0 string/wt #!\ a
  1461. ->&-1 string/T x %s script text executable
  1462. -
  1463. 0 search/1/fwt #!\ /usr/bin/tclsh Tcl/Tk script text executable
  1464. !:mime text/x-tcl
  1465. @@ -189,3 +188,14 @@
  1466. # From Danny Weldon
  1467. 0 string \x0b\x13\x08\x00
  1468. >0x04 uleshort <4 ksh byte-code version %d
  1469. +
  1470. +# From: arno <arenevier@fdn.fr>
  1471. +# mozilla xpconnect typelib
  1472. +# see https://www.mozilla.org/scriptable/typelib_file.html
  1473. +0 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib
  1474. +>0x10 byte x version %d
  1475. +>>0x11 byte x \b.%d
  1476. +
  1477. +0 string/fwt #!\ /usr/bin/env\ runghc GHC script executable
  1478. +0 string/fwt #!\ /usr/bin/env\ runhaskell Haskell script executable
  1479. +0 string/fwt #!\ /usr/bin/env\ julia Julia script executable
  1480. --- a/magic/Magdir/compress
  1481. +++ b/magic/Magdir/compress
  1482. @@ -1,5 +1,5 @@
  1483. #------------------------------------------------------------------------------
  1484. -# $File: compress,v 1.83 2022/08/16 11:16:39 christos Exp $
  1485. +# $File: compress,v 1.88 2022/12/21 15:55:52 christos Exp $
  1486. # compress: file(1) magic for pure-compression formats (no archives)
  1487. #
  1488. # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
  1489. @@ -12,13 +12,14 @@
  1490. 0 string \037\235 compress'd data
  1491. !:mime application/x-compress
  1492. !:apple LZIVZIVU
  1493. +!:ext Z
  1494. >2 byte&0x80 >0 block compressed
  1495. >2 byte&0x1f x %d bits
  1496. # gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
  1497. # URL: https://en.wikipedia.org/wiki/Gzip
  1498. # Reference: https://tools.ietf.org/html/rfc1952
  1499. -# Update: Joerg Jenderek, Apr 2019
  1500. +# Update: Joerg Jenderek, Apr 2019, Dec 2022
  1501. # Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
  1502. # * Original filename is only at offset 10 if "extra field" absent
  1503. # * Produce shorter output - notably, only report compression methods
  1504. @@ -61,20 +62,24 @@
  1505. !:mime application/gzip
  1506. >>>0 use gzip-info
  1507. # size of the original (uncompressed) input data modulo 2^32
  1508. ->>-0 offset >48
  1509. +# TODO: check for GXD MCD cad the reported size
  1510. >>>-4 ulelong x \b, original size modulo 2^32 %u
  1511. ->>-0 offset <48 \b, truncated
  1512. # gzipped TAR or VirtualBox extension package
  1513. #!:mime application/x-compressed-tar
  1514. #!:mime application/x-virtualbox-vbox-extpack
  1515. # https://www.w3.org/TR/SVG/mimereg.html
  1516. -#!:mime image/image/svg+xml-compressed
  1517. +#!:mime image/svg+xml-compressed
  1518. # zlib.3.gz
  1519. # microcode-20180312.tgz
  1520. # tpz same as tgz
  1521. # lua-md5_1.2-1_i386_i486.ipk https://en.wikipedia.org/wiki/Opkg
  1522. # Oracle_VM_VirtualBox_Extension_Pack-5.0.12-104815.vbox-extpack
  1523. -!:ext gz/tgz/tpz/ipk/vbox-extpack/svgz
  1524. +# trees.blend http://fileformats.archiveteam.org/wiki/BLEND
  1525. +# 2020-07-19-Note-16-24.xoj https://xournal.sourceforge.net/manual.html
  1526. +# MYgnucash-gz.gnucash https://wiki.gnucash.org/wiki/GnuCash_XML_format
  1527. +# text-rotate.dia https://en.wikipedia.org/wiki/Dia_(software)
  1528. +# MYrdata.RData https://en.wikipedia.org/wiki/R_(programming_language)
  1529. +!:ext gz/tgz/tpz/ipk/vbox-extpack/svgz/blend/dia/gnucash/rdata/xoj
  1530. # FNAME/FCOMMENT bit implies file name/comment as iso-8859-1 text
  1531. >3 byte&0x18 >0 gzip compressed data
  1532. !:mime application/gzip
  1533. @@ -83,12 +88,13 @@
  1534. #!:mime application/x-abiword-compressed
  1535. #!:mime image/image/svg+xml-compressed
  1536. # kleopatra_splashscreen.svgz gzipped .svg
  1537. -!:ext gz/tgz/tpz/zabw/svgz
  1538. +# RSI-Mega-Demo_Disk1.adz gzipped .adf http://fileformats.archiveteam.org/wiki/ADF_(Amiga)
  1539. +# PostbankTest.kmy gzipped XML https://docs.kde.org/stable5/en/kmymoney/kmymoney/details.formats.compressed.html
  1540. +# Logo.xcfgz gzipped .xcf http://fileformats.archiveteam.org/wiki/XCF
  1541. +!:ext gz/tgz/tpz/zabw/svgz/adz/kmy/xcfgz
  1542. >>0 use gzip-info
  1543. # size of the original (uncompressed) input data modulo 2^32
  1544. ->>-0 offset >48
  1545. ->>>-4 ulelong x \b, original size modulo 2^32 %u
  1546. ->>-0 offset <48 \b, truncated
  1547. +>>-4 ulelong x \b, original size modulo 2^32 %u
  1548. # display information of gzip compressed files
  1549. 0 name gzip-info
  1550. #>2 byte x THIS iS GZIP
  1551. @@ -125,6 +131,7 @@
  1552. # packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
  1553. 0 string \037\036 packed data
  1554. !:mime application/octet-stream
  1555. +!:ext z
  1556. >2 belong >1 \b, %d characters originally
  1557. >2 belong =1 \b, %d character originally
  1558. #
  1559. @@ -159,6 +166,7 @@
  1560. # lzip
  1561. 0 string LZIP lzip compressed data
  1562. !:mime application/x-lzip
  1563. +!:ext lz
  1564. >4 byte x \b, version: %d
  1565. # squeeze and crunch
  1566. @@ -194,6 +202,7 @@
  1567. # lzop from <markus.oberhumer@jk.uni-linz.ac.at>
  1568. 0 string \x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a lzop compressed data
  1569. +!:ext lzo
  1570. >9 beshort <0x0940
  1571. >>9 byte&0xf0 =0x00 - version 0.
  1572. >>9 beshort&0x0fff x \b%03x,
  1573. @@ -254,20 +263,24 @@
  1574. !:mime application/x-7z-compressed
  1575. !:ext 7z/cb7
  1576. +0 name lzma LZMA compressed data,
  1577. +!:mime application/x-lzma
  1578. +!:ext lzma
  1579. +>5 lequad =0xffffffffffffffff streamed
  1580. +>5 lequad !0xffffffffffffffff non-streamed, size %lld
  1581. +
  1582. # Type: LZMA
  1583. 0 lelong&0xffffff =0x5d
  1584. ->12 leshort 0xff LZMA compressed data,
  1585. -!:mime application/x-lzma
  1586. ->>5 lequad =0xffffffffffffffff streamed
  1587. ->>5 lequad !0xffffffffffffffff non-streamed, size %lld
  1588. ->12 leshort 0 LZMA compressed data,
  1589. ->>5 lequad =0xffffffffffffffff streamed
  1590. ->>5 lequad !0xffffffffffffffff non-streamed, size %lld
  1591. +>12 leshort 0xff
  1592. +>>0 use lzma
  1593. +>12 leshort 0
  1594. +>>0 use lzma
  1595. # http://tukaani.org/xz/xz-file-format.txt
  1596. 0 ustring \xFD7zXZ\x00 XZ compressed data, checksum
  1597. !:strength * 2
  1598. !:mime application/x-xz
  1599. +!:ext xz
  1600. >7 byte&0xf 0x0 NONE
  1601. >7 byte&0xf 0x1 CRC32
  1602. >7 byte&0xf 0x4 CRC64
  1603. @@ -283,6 +296,7 @@
  1604. # https://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
  1605. 0 lelong 0x184d2204 LZ4 compressed data (v1.4+)
  1606. !:mime application/x-lz4
  1607. +!:ext lz4
  1608. # Added by osm0sis@xda-developers.com
  1609. 0 lelong 0x184c2103 LZ4 compressed data (v1.0-v1.3)
  1610. !:mime application/x-lz4
  1611. @@ -319,19 +333,26 @@
  1612. # https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
  1613. 0 lelong 0xFD2FB522 Zstandard compressed data (v0.2)
  1614. !:mime application/zstd
  1615. +!:ext zst
  1616. 0 lelong 0xFD2FB523 Zstandard compressed data (v0.3)
  1617. !:mime application/zstd
  1618. +!:ext zst
  1619. 0 lelong 0xFD2FB524 Zstandard compressed data (v0.4)
  1620. !:mime application/zstd
  1621. +!:ext zst
  1622. 0 lelong 0xFD2FB525 Zstandard compressed data (v0.5)
  1623. !:mime application/zstd
  1624. +!:ext zst
  1625. 0 lelong 0xFD2FB526 Zstandard compressed data (v0.6)
  1626. !:mime application/zstd
  1627. +!:ext zst
  1628. 0 lelong 0xFD2FB527 Zstandard compressed data (v0.7)
  1629. !:mime application/zstd
  1630. +!:ext zst
  1631. >4 use zstd-dictionary-id
  1632. 0 lelong 0xFD2FB528 Zstandard compressed data (v0.8+)
  1633. !:mime application/zstd
  1634. +!:ext zst
  1635. >4 use zstd-dictionary-id
  1636. # https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
  1637. @@ -407,3 +428,24 @@
  1638. # http://www.shikadi.net/moddingwiki/PCX_Library
  1639. 0 string/b pcxLib
  1640. >0x0A string/b Copyright\020(c)\020Genus\020Microprogramming,\020Inc. pcxLib compressed
  1641. +
  1642. +# https://support-docs.illumina.com/SW/ORA_Format_Specification/Content/SW/ORA/ORAFormatSpecification.htm
  1643. +0 uleshort 0x7c49
  1644. +>2 lelong 0x80 ORA FASTQ compressed file
  1645. +>6 ulelong x \b, DNA size %u
  1646. +>10 ulelong x \b, read names size %u
  1647. +>14 ulelong x \b, quality buffer 1 size %u
  1648. +>18 ulelong x \b, quality buffer 2 size %u
  1649. +>22 ulelong x \b, sequence buffer size %u
  1650. +>26 ulelong x \b, N-position buffer size %u
  1651. +>30 ulelong x \b, crypto buffer size %u
  1652. +>34 ulelong x \b, misc buffer 1 size %u
  1653. +>38 ulelong x \b, misc buffer 2 size %u
  1654. +>42 ulelong x \b, flags %#x
  1655. +>46 lelong x \b, read size %d
  1656. +>50 lelong x \b, number of reads %d
  1657. +>54 leshort x \b, version %d
  1658. +
  1659. +# https://github.com/kspalaiologos/bzip3/blob/master/doc/file_format.md
  1660. +0 string/b BZ3v1 bzip3 compressed data
  1661. +>5 ulelong x \b, blocksize %u
  1662. --- a/magic/Magdir/console
  1663. +++ b/magic/Magdir/console
  1664. @@ -1,6 +1,6 @@
  1665. #------------------------------------------------------------------------------
  1666. -# $File: console,v 1.68 2022/05/14 20:04:43 christos Exp $
  1667. +# $File: console,v 1.70 2022/10/31 13:22:26 christos Exp $
  1668. # Console game magic
  1669. # Toby Deshane <hac@shoelace.digivill.net>
  1670. @@ -68,7 +68,7 @@
  1671. !:mime application/x-nes-rom
  1672. #------------------------------------------------------------------------------
  1673. -# fds: file(1) magic for Famciom Disk System disk images
  1674. +# fds: file(1) magic for Famicom Disk System disk images
  1675. # Reference: https://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format
  1676. # From: David Korth <gerbilsoft@gerbilsoft.com>
  1677. # TODO: Check "Disk info block" and get info from that in addition to the optional header.
  1678. @@ -760,6 +760,28 @@
  1679. >5 byte 0 \b, Simple Encoding
  1680. >6 string x \b, description: %s
  1681. +# Compressed ISO disc image (used mostly by PSP, PS2 and MegaDrive)
  1682. +# From: Alexandre Iooss <erdnaxe@crans.org>
  1683. +# URL: https://en.wikipedia.org/wiki/.CSO
  1684. +# NOTE: This is NOT the same as Compact ISO or GameCube/Wii disc image,
  1685. +# though it has the same magic number.
  1686. +0 string CISO
  1687. +# Match CISO version 1 with ISO-9660 sector size
  1688. +>20 ubyte <2
  1689. +>>16 ulelong =2048 CSO v1 disk image
  1690. +!:mime application/x-compressed-iso
  1691. +!:ext ciso/cso
  1692. +>>>8 ulequad x \b, original size %llu bytes
  1693. +>>>16 ulelong x \b, datablock size %u bytes
  1694. +# Match CISO version 2
  1695. +>20 ubyte =2
  1696. +>>22 uleshort =0
  1697. +>>>4 ulelong =24 CSO v2 disk image
  1698. +!:mime application/x-compressed-iso
  1699. +!:ext ciso/cso
  1700. +>>>>8 ulequad x \b, original size %llu bytes
  1701. +>>>>16 ulelong x \b, datablock size %u bytes
  1702. +
  1703. # From: Daniel Dawson <ddawson@icehouse.net>
  1704. # SNES9x .smv "movie" file format.
  1705. 0 string SMV\x1A SNES9x input recording
  1706. --- a/magic/Magdir/database
  1707. +++ b/magic/Magdir/database
  1708. @@ -1,6 +1,6 @@
  1709. #------------------------------------------------------------------------------
  1710. -# $File: database,v 1.67 2022/07/12 18:57:42 christos Exp $
  1711. +# $File: database,v 1.68 2022/09/23 19:54:41 christos Exp $
  1712. # database: file(1) magic for various databases
  1713. #
  1714. # extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
  1715. @@ -410,8 +410,10 @@
  1716. >>>>>>>>>>513 ubyte >037
  1717. # skip DOS executables CPQ0TD.DRV E30ODI.COM IBM0MONO.DRV by looking for printable 1st character of 1st memo item
  1718. >>>>>>>>>>>512 ubyte >037
  1719. -# unusual dBASE III DBT like adressen.dbt
  1720. ->>>>>>>>>>>>0 use dbase3-memo-print
  1721. +# skip few (14/758) Microsoft Event Trace Logs (boot_BASE+CSWITCH_1.etl DlTel-Merge.etl UpdateUx.006.etl) with invalid "high" 1st item \377\377
  1722. +>>>>>>>>>>>>512 ubyte <0377
  1723. +# unusual dBASE III DBT like adressen.dbt biblio.dbt fsadress.dbt
  1724. +>>>>>>>>>>>>>0 use dbase3-memo-print
  1725. # dBASE III DBT like angest.dbt, or garbage PCX DBF
  1726. >>>>>>>>8 ubelong !0
  1727. # skip PCX and some DBF by test for for reserved NULL bytes
  1728. @@ -424,7 +426,19 @@
  1729. >>>>>>>>>>>>512 ubyte <0200
  1730. # skip gluon-ffhat-1.0-tp-link-tl-wr1043n-nd-v2-sysupgrade.bin by printable 2nd character
  1731. >>>>>>>>>>>>>513 ubyte >037
  1732. ->>>>>>>>>>>>>>0 use dbase3-memo-print
  1733. +# skip few (8/758) Microsoft Event Trace Logs (WBEngine.3.etl Wifi.etl) with valid 1st item like
  1734. +# "9600.20369.amd64fre.winblue_ltsb_escrow.220427-1727"
  1735. +# "9600.19846.amd64fre.winblue_ltsb_escrow.200923-1735"
  1736. +# "10586.494.amd64fre.th2_release_sec.160630-1736"
  1737. +# by looking for valid terminating character Ctrl-Z
  1738. +>>>>>>>>>>>>>>513 search/0x11E \032
  1739. +# followed by second character Ctrl-Z implies typical DBT
  1740. +>>>>>>>>>>>>>>>&0 ubyte 032
  1741. +# examples like: angest.dbt
  1742. +>>>>>>>>>>>>>>>>0 use dbase3-memo-print
  1743. +>>>>>>>>>>>>>>>&0 ubyte 0
  1744. +# no example found here with terminating sequence CTRL-Z + \0
  1745. +>>>>>>>>>>>>>>>>0 use dbase3-memo-print
  1746. # dBASE IV DBT with positive block size
  1747. >>>>>>>20 uleshort >0
  1748. # dBASE IV DBT with valid block length like 512, 1024
  1749. @@ -451,6 +465,11 @@
  1750. >512 string >\0 \b, 1st item "%s"
  1751. # For DEBUGGING
  1752. #>512 ubelong x \b, 1ST item %#8.8x
  1753. +#>513 search/0x225 \032 FOUND_TERMINATOR
  1754. +#>>&0 ubyte 032 2xCTRL_Z
  1755. +# fsadress.dbt has 1 Ctrl-Z terminator followed by nil byte
  1756. +#>>&0 ubyte 0 1xCTRL_Z
  1757. +
  1758. # https://www.clicketyclick.dk/databases/xbase/format/dbt.html
  1759. # Print the information of dBase IV DBT memo file
  1760. 0 name dbase4-memo-print
  1761. --- a/magic/Magdir/dsf
  1762. +++ /dev/null
  1763. @@ -1,25 +0,0 @@
  1764. -
  1765. -#------------------------------------------------------------
  1766. -# $File: dsf,v 1.1 2022/01/08 16:29:18 christos Exp $
  1767. -# dsf: file(1) magic for DSD Stream File
  1768. -# URL: https://en.wikipedia.org/wiki/Direct_Stream_Digital
  1769. -# Reference: https://dsd-guide.com/sites/default/files/white-papers/DSFFileFormatSpec_E.pdf
  1770. -0 string DSD\x20 DSD Stream File,
  1771. ->0x30 leshort 1 mono,
  1772. ->0x30 leshort 2 stereo,
  1773. ->0x30 leshort 3 three-channel,
  1774. ->0x30 leshort 4 quad-channel,
  1775. ->0x30 leshort 5 3.1 4-channel,
  1776. ->0x30 leshort 6 five-channel,
  1777. ->0x30 leshort 7 5.1 surround,
  1778. ->0x30 default x
  1779. ->>0x30 leshort x unknown channel format (%d),
  1780. ->0x38 lelong 2822400 simple-rate,
  1781. ->0x38 lelong 5644800 double-rate,
  1782. ->0x38 default x
  1783. ->>0x38 lelong x %d Hz,
  1784. ->0x3c leshort 1 1 bit,
  1785. ->0x3c leshort 8 8 bit,
  1786. ->0x3c default x
  1787. ->>0x3c leshort x %d bit,
  1788. ->0x40 lelong x %d samples
  1789. --- a/magic/Magdir/filesystems
  1790. +++ b/magic/Magdir/filesystems
  1791. @@ -1,5 +1,5 @@
  1792. #------------------------------------------------------------------------------
  1793. -# $File: filesystems,v 1.150 2022/07/04 16:40:33 christos Exp $
  1794. +# $File: filesystems,v 1.152 2022/12/10 20:56:50 christos Exp $
  1795. # filesystems: file(1) magic for different filesystems
  1796. #
  1797. 0 name partid
  1798. @@ -1596,7 +1596,8 @@
  1799. >0x1e lequad x %lld total clusters,
  1800. >0x26 lequad x %lld clusters in use
  1801. -9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
  1802. +
  1803. +0 name ffsv1
  1804. >8404 string x last mounted on %s,
  1805. #>9504 ledate x last checked at %s,
  1806. >8224 ledate x last written at %s,
  1807. @@ -1612,105 +1613,59 @@
  1808. >8320 lelong 0 TIME optimization
  1809. >8320 lelong 1 SPACE optimization
  1810. -42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1811. ->&-1164 string x last mounted on %s,
  1812. ->&-696 string >\0 volume name %s,
  1813. ->&-304 leqldate x last written at %s,
  1814. ->&-1167 byte x clean flag %d,
  1815. ->&-1168 byte x readonly flag %d,
  1816. ->&-296 lequad x number of blocks %lld,
  1817. ->&-288 lequad x number of data blocks %lld,
  1818. ->&-1332 lelong x number of cylinder groups %d,
  1819. ->&-1328 lelong x block size %d,
  1820. ->&-1324 lelong x fragment size %d,
  1821. ->&-180 lelong x average file size %d,
  1822. ->&-176 lelong x average number of files in dir %d,
  1823. ->&-272 lequad x pending blocks to free %lld,
  1824. ->&-264 lelong x pending inodes to free %d,
  1825. ->&-664 lequad x system-wide uuid %0llx,
  1826. ->&-1316 lelong x minimum percentage of free blocks %d,
  1827. ->&-1248 lelong 0 TIME optimization
  1828. ->&-1248 lelong 1 SPACE optimization
  1829. -
  1830. -66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1831. ->&-1164 string x last mounted on %s,
  1832. ->&-696 string >\0 volume name %s,
  1833. ->&-304 leqldate x last written at %s,
  1834. ->&-1167 byte x clean flag %d,
  1835. ->&-1168 byte x readonly flag %d,
  1836. ->&-296 lequad x number of blocks %lld,
  1837. ->&-288 lequad x number of data blocks %lld,
  1838. ->&-1332 lelong x number of cylinder groups %d,
  1839. ->&-1328 lelong x block size %d,
  1840. ->&-1324 lelong x fragment size %d,
  1841. ->&-180 lelong x average file size %d,
  1842. ->&-176 lelong x average number of files in dir %d,
  1843. ->&-272 lequad x pending blocks to free %lld,
  1844. ->&-264 lelong x pending inodes to free %d,
  1845. ->&-664 lequad x system-wide uuid %0llx,
  1846. ->&-1316 lelong x minimum percentage of free blocks %d,
  1847. ->&-1248 lelong 0 TIME optimization
  1848. ->&-1248 lelong 1 SPACE optimization
  1849. +9564 lelong 0x00011954 Unix Fast File system [v1] (little-endian),
  1850. +>0 use ffsv1
  1851. 9564 belong 0x00011954 Unix Fast File system [v1] (big-endian),
  1852. >7168 belong 0x4c41424c Apple UFS Volume
  1853. >>7186 string x named %s,
  1854. >>7176 belong x volume label version %d,
  1855. >>7180 bedate x created on %s,
  1856. ->8404 string x last mounted on %s,
  1857. -#>9504 bedate x last checked at %s,
  1858. ->8224 bedate x last written at %s,
  1859. ->8401 byte x clean flag %d,
  1860. ->8228 belong x number of blocks %d,
  1861. ->8232 belong x number of data blocks %d,
  1862. ->8236 belong x number of cylinder groups %d,
  1863. ->8240 belong x block size %d,
  1864. ->8244 belong x fragment size %d,
  1865. ->8252 belong x minimum percentage of free blocks %d,
  1866. ->8256 belong x rotational delay %dms,
  1867. ->8260 belong x disk rotational speed %drps,
  1868. ->8320 belong 0 TIME optimization
  1869. ->8320 belong 1 SPACE optimization
  1870. +>0 use \^ffsv1
  1871. +
  1872. +0 name ffsv2
  1873. +>212 string x last mounted on %s,
  1874. +>680 string >\0 volume name %s,
  1875. +>1072 leqldate x last written at %s,
  1876. +>209 byte x clean flag %d,
  1877. +>210 byte x readonly flag %d,
  1878. +>1080 lequad x number of blocks %lld,
  1879. +>1088 lequad x number of data blocks %lld,
  1880. +>44 lelong x number of cylinder groups %d,
  1881. +>48 lelong x block size %d,
  1882. +>52 lelong x fragment size %d,
  1883. +>1196 lelong x average file size %d,
  1884. +>1200 lelong x average number of files in dir %d,
  1885. +>1104 lequad x pending blocks to free %lld,
  1886. +>1112 lelong x pending inodes to free %d,
  1887. +>712 lequad x system-wide uuid %0llx,
  1888. +>60 lelong x minimum percentage of free blocks %d,
  1889. +>128 lelong 0 TIME optimization
  1890. +>128 lelong 1 SPACE optimization
  1891. +
  1892. +42332 lelong 0x19012038 Unix Fast File system [v2ea] (little-endian)
  1893. +>40960 use ffsv2
  1894. +
  1895. +42332 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1896. +>40960 use ffsv2
  1897. +
  1898. +42332 belong 0x19012038 Unix Fast File system [v2ea] (little-endian)
  1899. +>40960 use \^ffsv2
  1900. 42332 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  1901. ->&-1164 string x last mounted on %s,
  1902. ->&-696 string >\0 volume name %s,
  1903. ->&-304 beqldate x last written at %s,
  1904. ->&-1167 byte x clean flag %d,
  1905. ->&-1168 byte x readonly flag %d,
  1906. ->&-296 bequad x number of blocks %lld,
  1907. ->&-288 bequad x number of data blocks %lld,
  1908. ->&-1332 belong x number of cylinder groups %d,
  1909. ->&-1328 belong x block size %d,
  1910. ->&-1324 belong x fragment size %d,
  1911. ->&-180 belong x average file size %d,
  1912. ->&-176 belong x average number of files in dir %d,
  1913. ->&-272 bequad x pending blocks to free %lld,
  1914. ->&-264 belong x pending inodes to free %d,
  1915. ->&-664 bequad x system-wide uuid %0llx,
  1916. ->&-1316 belong x minimum percentage of free blocks %d,
  1917. ->&-1248 belong 0 TIME optimization
  1918. ->&-1248 belong 1 SPACE optimization
  1919. +>40960 use \^ffsv2
  1920. +
  1921. +66908 lelong 0x19012038 Unix Fast File system [v2ea] (little-endian)
  1922. +>65536 use ffsv2
  1923. +
  1924. +66908 lelong 0x19540119 Unix Fast File system [v2] (little-endian)
  1925. +>65536 use ffsv2
  1926. +
  1927. +66908 belong 0x19012038 Unix Fast File system [v2ea] (little-endian)
  1928. +>65536 use \^ffsv2
  1929. 66908 belong 0x19540119 Unix Fast File system [v2] (big-endian)
  1930. ->&-1164 string x last mounted on %s,
  1931. ->&-696 string >\0 volume name %s,
  1932. ->&-304 beqldate x last written at %s,
  1933. ->&-1167 byte x clean flag %d,
  1934. ->&-1168 byte x readonly flag %d,
  1935. ->&-296 bequad x number of blocks %lld,
  1936. ->&-288 bequad x number of data blocks %lld,
  1937. ->&-1332 belong x number of cylinder groups %d,
  1938. ->&-1328 belong x block size %d,
  1939. ->&-1324 belong x fragment size %d,
  1940. ->&-180 belong x average file size %d,
  1941. ->&-176 belong x average number of files in dir %d,
  1942. ->&-272 bequad x pending blocks to free %lld,
  1943. ->&-264 belong x pending inodes to free %d,
  1944. ->&-664 bequad x system-wide uuid %0llx,
  1945. ->&-1316 belong x minimum percentage of free blocks %d,
  1946. ->&-1248 belong 0 TIME optimization
  1947. ->&-1248 belong 1 SPACE optimization
  1948. +>65536 use \^ffsv2
  1949. 0 ulequad 0xc8414d4dc5523031 HAMMER filesystem (little-endian),
  1950. >0x90 lelong+1 x volume %d
  1951. --- /dev/null
  1952. +++ b/magic/Magdir/firmware
  1953. @@ -0,0 +1,33 @@
  1954. +#------------------------------------------------------------------------------
  1955. +# $File: firmware,v 1.3 2022/10/15 15:38:44 christos Exp $
  1956. +# firmware: file(1) magic for firmware files
  1957. +#
  1958. +
  1959. +# https://github.com/MatrixEditor/frontier-smart-api/blob/main/docs/firmware-2.0.md#11-header-structure
  1960. +# examples: https://github.com/cweiske/frontier-silicon-firmwares
  1961. +0 lelong 0x00001176
  1962. +>4 lelong 0x7c Frontier Silicon firmware download
  1963. +>>8 lelong x \b, MeOS version %x
  1964. +>>12 string/32/T x \b, version %s
  1965. +>>40 string/64/T x \b, customization %s
  1966. +
  1967. +# HPE iLO firmware update image
  1968. +# From: Alexandre Iooss <erdnaxe@crans.org>
  1969. +# URL: https://www.sstic.org/2018/presentation/backdooring_your_server_through_its_bmc_the_hpe_ilo4_case/
  1970. +# iLO1 (ilo1*.bin) or iLO2 (ilo2_*.bin) images
  1971. +0 string \x20\x36\xc1\xce\x60\x37\x62\xf0\x3f\x06\xde\x00\x00\x03\x7f\x00
  1972. +>16 ubeshort =0xCFDD HPE iLO2 firmware update image
  1973. +>16 ubeshort =0x6444 HPE iLO1 firmware update image
  1974. +# iLO3 images (ilo3_*.bin) start directly with image name
  1975. +0 string iLO3\x20v\x20 HPE iLO3 firmware update image,
  1976. +>7 string x version %s
  1977. +# iLO4 images (ilo4_*.bin) start with a signature and a certificate
  1978. +0 string --=</Begin\x20HP\x20Signed
  1979. +>75 string label_HPBBatch
  1980. +>>5828 string iLO\x204
  1981. +>>>5732 string HPIMAGE\x00 HPE iLO4 firmware update image,
  1982. +>>>6947 string x version %s
  1983. +# iLO5 images (ilo5_*.bin) start with a signature
  1984. +>75 string label_HPE-HPB-BMC-ILO5-4096
  1985. +>>880 string HPIMAGE\x00 HPE iLO5 firmware update image,
  1986. +>>944 string x version %s
  1987. --- a/magic/Magdir/games
  1988. +++ b/magic/Magdir/games
  1989. @@ -1,6 +1,6 @@
  1990. #------------------------------------------------------------------------------
  1991. -# $File: games,v 1.25 2022/05/31 18:40:20 christos Exp $
  1992. +# $File: games,v 1.29 2022/12/21 15:49:49 christos Exp $
  1993. # games: file(1) for games
  1994. # Fabio Bonelli <fabiobonelli@libero.it>
  1995. @@ -293,12 +293,92 @@
  1996. >2 regex/c GM\\[21\\] - twix Game
  1997. # Epic Games/Unreal Engine Package
  1998. -#
  1999. -0 lelong 0x9E2A83C1 Unreal Engine Package,
  2000. ->4 leshort x version: %i
  2001. ->12 lelong !0 \b, names: %i
  2002. ->28 lelong !0 \b, imports: %i
  2003. ->20 lelong !0 \b, exports: %i
  2004. +# URL: https://docs.unrealengine.com/udk/Three/ContentCooking.html
  2005. +# https://eliotvu.com/page/unreal-package-file-format
  2006. +# Little-endian version (such as x86 PC)
  2007. +0 lelong 0x9E2A83C1 Unreal Engine package (little-endian)
  2008. +!:ext xxx/tfc/upk/me1/u
  2009. +>4 uleshort !0 \b, version %u
  2010. +>>6 uleshort !0 \b/%03u
  2011. +>>0 use upk_header
  2012. +# Big-endian version (such as PS3)
  2013. +0 belong 0x9E2A83C1 Unreal Engine package (big-endian)
  2014. +!:ext xxx/tfc
  2015. +>6 ubeshort !0 \b, version %u
  2016. +>>4 ubeshort !0 \b/%03u
  2017. +>>0 use \^upk_header
  2018. +
  2019. +0 name upk_header
  2020. +# Identify game from version and licensee
  2021. +>4 ulelong 0x000002b2 (Alice Madness Returns)
  2022. +>4 ulelong 0x002f0313 (Aliens: Colonial Marines)
  2023. +>4 ulelong 0x005b021b (Alpha Protocol)
  2024. +>4 ulelong 0x0000032c (AntiChamber)
  2025. +>4 ulelong 0x00200223 (APB: All Points Bulletin)
  2026. +>4 ulelong 0x004b02d7 (Bioshock Infinite)
  2027. +>4 ulelong 0x00380340 (Borderlands 2)
  2028. +>4 ulelong 0x001d02e6 (Bulletstorm)
  2029. +>4 ulelong 0x00050240 (CrimeCraft)
  2030. +>4 ulelong 0x00000356 (Deadlight)
  2031. +>4 ulelong 0x001e0321 (Dishonored)
  2032. +>4 ulelong 0x000202a6 (Dungeon Defenders)
  2033. +>4 ulelong 0x000901ea (Gears of War)
  2034. +>4 ulelong 0x0000023f (Gears of War 2)
  2035. +>4 ulelong 0x0000033c (Gears of War 3)
  2036. +>4 ulelong 0x0000034e (Gears of War: Judgement)
  2037. +>4 ulelong 0x0004035c (Hawken)
  2038. +>4 ulelong 0x0001034a (Infinity Blade 2)
  2039. +>4 ulelong 0x00000350 (InMomentum)
  2040. +>4 ulelong 0x0015037D (Life Is Strange)
  2041. +>4 ulelong 0x000b01a5 (Medal of Honor: Airborne)
  2042. +>4 ulelong 0x002b0218 (Mirrors Edge)
  2043. +>4 ulelong 0x0000027e (Monday Night Combat)
  2044. +>4 ulelong 0x0000024b (MoonBase Alpha)
  2045. +>4 ulelong 0x002e01d8 (Mortal Kombat Komplete Edition 2605)
  2046. +>4 ulelong 0x0000035c (Painkiller HD)
  2047. +>4 ulelong 0x0000034d (Q.U.B.E)
  2048. +>4 ulelong 0x80660340 (Quantum Conundrum)
  2049. +>4 ulelong 0x0000035b (Ravaged)
  2050. +>4 ulelong 0x00150340 (Remember Me)
  2051. +>4 ulelong 0x00060171 (Roboblitz)
  2052. +>4 ulelong 0x00000325 (Rock of Ages)
  2053. +>4 ulelong 0x0000032a (Sanctum)
  2054. +>4 ulelong 0x00030248 (Saw)
  2055. +>4 ulelong 0x007e0248 (Singularity)
  2056. +>4 ulelong 0x00090388 (Soldier Front 2)
  2057. +>4 ulelong 0x000701e6 (Stargate Worlds)
  2058. +>4 ulelong 0x00000334 (Super Monday Night Combat)
  2059. +>4 ulelong 0x000002c2 (The Ball)
  2060. +>4 ulelong 0x000e0262 (The Exiled Realm of Arborea or TERA)
  2061. +>4 ulelong 0x0000035b (The Five Cores)
  2062. +>4 ulelong 0x00000349 (The Haunted: Hells Reach)
  2063. +>4 ulelong 0x00000354 (Unmechanical)
  2064. +>4 ulelong 0x035c0298 (Unreal Development Kit)
  2065. +>4 ulelong 0x00000200 (Unreal Tournament 3)
  2066. +>4 ulelong 0x0000032d (Waves)
  2067. +>4 ulelong 0x003b034d (XCOM: Enemy Unknown)
  2068. +# Newer versions insert more headers
  2069. +>4 ulelong&0xFFFF <249
  2070. +>>12 lelong !0 \b, names: %d
  2071. +>>28 lelong !0 \b, imports: %d
  2072. +>>20 lelong !0 \b, exports: %d
  2073. +>4 ulelong&0xFFFF >248
  2074. +>>12 belong&0xFF !0
  2075. +>>>12 string x \b, folder "%s"
  2076. +>>>>&5 lelong !0 \b, names: %d
  2077. +>>>>&21 lelong !0 \b, imports: %d
  2078. +>>>>&13 lelong !0 \b, exports: %d
  2079. +>>12 belong&0xFF 0
  2080. +>>>16 belong&0xFF !0
  2081. +>>>>16 string x \b, folder "%s"
  2082. +>>>>>&5 lelong !0 \b, names: %d
  2083. +>>>>>&21 lelong !0 \b, imports: %d
  2084. +>>>>>&13 lelong !0 \b, exports: %d
  2085. +>>>16 belong&0xFF 0
  2086. +>>>>20 string x \b, folder "%s"
  2087. +>>>>>&5 lelong !0 \b, names: %d
  2088. +>>>>>&21 lelong !0 \b, imports: %d
  2089. +>>>>>&13 lelong !0 \b, exports: %d
  2090. 0 string ESVG
  2091. >4 lelong 0x00160000
  2092. @@ -510,3 +590,31 @@
  2093. >>0 ulelong&0xf =8 RDR 2,
  2094. >>4 ulelong x %d bytes,
  2095. >>>8 ulelong x %d entries
  2096. +
  2097. +# Blitz3D Model File Format
  2098. +# From: Alexandre Iooss <erdnaxe@crans.org>
  2099. +# URL: https://github.com/minetest/B3DExport/blob/master/B3DExport.py
  2100. +0 string BB3D
  2101. +>4 lelong >0
  2102. +>>8 lelong >0 Blitz3D Model
  2103. +!:ext b3d
  2104. +>>>8 lelong x \b, version %d
  2105. +
  2106. +# Minetest Schematic File Format
  2107. +# From: Alexandre Iooss <erdnaxe@crans.org>
  2108. +# URL: https://github.com/minetest/minetest/blob/5.6.1/src/mapgen/mg_schematic.h
  2109. +0 string MTSM Minetest Schematic
  2110. +!:ext mts
  2111. +>4 ubeshort x \b, version %d
  2112. +>6 ubeshort x \b, size [%d
  2113. +>8 ubeshort x \b, %d
  2114. +>10 ubeshort x \b, %d]
  2115. +
  2116. +# MagicaVoxel File Format
  2117. +# From: Alexandre Iooss <erdnaxe@crans.org>
  2118. +# URL: https://github.com/ephtracy/voxel-model/blob/ee2216c28a78ebb68691dc6cfa9c4ba429117ea2/MagicaVoxel-file-format-vox.txt
  2119. +# Note: This format is used in Veloren voxel RPG.
  2120. +0 string VOX\x20
  2121. +>4 lelong >0 MagicaVoxel model
  2122. +!:ext vox
  2123. +>>4 lelong x \b, version %d
  2124. --- a/magic/Magdir/gentoo
  2125. +++ b/magic/Magdir/gentoo
  2126. @@ -1,5 +1,5 @@
  2127. #------------------------------------------------------------------------------
  2128. -# $File: gentoo,v 1.2 2022/09/12 13:13:28 christos Exp $
  2129. +# $File: gentoo,v 1.4 2022/11/29 23:06:09 christos Exp $
  2130. # gentoo: file(1) magic for gentoo specific formats
  2131. #
  2132. # Summary: Gentoo ebuild Manifest files (GLEP 74)
  2133. @@ -36,6 +36,7 @@
  2134. # (<tag>'s already been matched prior to calling)
  2135. 0 name gentoo-manifest
  2136. >&0 regex [[:space:]]+[[:print:]]+[[:space:]]+[[:digit:]]+[[:space:]]+[[:alnum:]]+[[:space:]]+[[:xdigit:]]{32} Gentoo Manifest (GLEP 74)
  2137. +!:mime application/vnd.gentoo.manifest
  2138. # Summary: Gentoo ebuild and eclass files
  2139. # Reference: https://projects.gentoo.org/pms/8/pms.html
  2140. @@ -43,16 +44,20 @@
  2141. 0 search/512 EAPI=
  2142. >0 regex .*\n[\040\t]*EAPI=["']? Gentoo ebuild
  2143. >>&0 regex [[:alnum:]+_.-]+ \b, EAPI %s
  2144. +!:mime application/vnd.gentoo.ebuild
  2145. 0 search/512 @ECLASS:\040 Gentoo eclass
  2146. >&0 string x %s
  2147. +!:mime application/vnd.gentoo.eclass
  2148. # Summary: Gentoo supplementary package and category metadata files
  2149. # Reference: https://www.gentoo.org/glep/glep-0068.html
  2150. # Submitted by: Michal Gorny <mgorny@gentoo.org>
  2151. 0 string \<?xml
  2152. >0 search/512 \<catmetadata Gentoo category metadata file
  2153. +!:mime application/vnd.gentoo.catmetadata+xml
  2154. >0 search/512 \<pkgmetadata Gentoo package metadata file
  2155. +!:mime application/vnd.gentoo.pkgmetadata+xml
  2156. # Summary: Gentoo GLEP 78 binary package
  2157. # Reference: https://www.gentoo.org/glep/glep-0078.html
  2158. --- a/magic/Magdir/geo
  2159. +++ b/magic/Magdir/geo
  2160. @@ -1,6 +1,6 @@
  2161. #------------------------------------------------------------------------------
  2162. -# $File: geo,v 1.8 2022/03/24 15:48:58 christos Exp $
  2163. +# $File: geo,v 1.10 2022/10/31 13:22:26 christos Exp $
  2164. # Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
  2165. ######################################################################
  2166. @@ -54,7 +54,43 @@
  2167. ######################################################################
  2168. # GeoAcoustics - GeoSwath Plus
  2169. -4 beshort 0x2002 GeoSwath RDF
  2170. +# Update: Joerg Jenderek
  2171. +# URL: https://www.mbari.org/products/research-software/mb-system/
  2172. +# Reference: http://ccom.unh.edu/sites/default/files/news-and-events/conferences/auv-bootcamp/
  2173. +# GS%2B-6063-BB-GS%2B-Broadcast-Raw-Data-File-Format-Command-Specification.pdf
  2174. +# Note: All data is written using Intel 80x86 byte ordering (LSB to MSB)
  2175. +# raw_header_siz; file header size is 544 bytes
  2176. +4 beshort 0x2002
  2177. +# GRR: line above is too general as it matches also some Microsoft Event Trace Logs *.ETL
  2178. +# skip many (63/753) Microsoft Event Trace Logs (AMSITrace.etl lxcore_kernel.etl NotificationUxBroker.052.etl WindowsBackup.4.etl) with invalid "low" ping header size 0
  2179. +>6 leshort >0 GeoSwath RDF
  2180. +# skip foo samples with invalid "high" spare bytes
  2181. +#>>536 ulequad =0 OK_THIS_IS_GeoSwath_RDF
  2182. +#!:mime application/octet-stream
  2183. +!:mime application/x-geoswath-rdf
  2184. +# http://ccom.unh.edu/sites/default/files/news-and-events/conferences/auv-bootcamp/060116342.rdf
  2185. +!:ext rdf
  2186. +# filename; original file name like: "C:\GS+\Projects\Default\Raw Data Files\060116342.rdf"
  2187. +>>8 string x "%-.512s"
  2188. +# version[8]; recording software version number like: 3.16c
  2189. +>>527 string x \b, version %-.8s
  2190. +# creation; unsigned int file creation time; WHAT time format is this?
  2191. +>>0 ulelong x \b, creation time %#8.8x
  2192. +# raw_ping_header_size; size of ping header in bytes like: 64
  2193. +>>6 leshort !64 \b, ping header size %d
  2194. +# frequency; system frequency in hertz like: 500000
  2195. +>>520 lelong x \b, frequency %d
  2196. +# echo_type; Echosounder type index like: 1
  2197. +>>524 leshort x \b, echo type %#x
  2198. +# file_mode; file mode mask (0x00 bathy & sidescan, 0x80 bathy, 0x40 sidescan, 0x20 seismic)
  2199. +>>526 ubyte !0 \b, file mode %#2.2x
  2200. +# pps_mode; PPS synch mode like: 2
  2201. +>>535 byte x \b, pps mode %#x
  2202. +# char spare[8]; apparently zeroed
  2203. +>>536 ubequad !0 \b, spare %#16.16llx
  2204. +# Ping_number; 1st ping number like: 4944
  2205. +>>544 lelong x \b, 1st ping number %d
  2206. +
  2207. 0 string Start:- GeoSwatch auf text file
  2208. # Seabeam 2100
  2209. @@ -88,7 +124,7 @@
  2210. #
  2211. ######################################################################
  2212. -# IVS - IVS3d.com Tagged Data Represetation
  2213. +# IVS - IVS3d.com Tagged Data Representation
  2214. 0 string %%\ TDR\ 2.0 IVS Fledermaus TDR file
  2215. # http://www.ecma-international.org/publications/standards/Ecma-363.htm
  2216. --- a/magic/Magdir/images
  2217. +++ b/magic/Magdir/images
  2218. @@ -1,6 +1,6 @@
  2219. #------------------------------------------------------------------------------
  2220. -# $File: images,v 1.227 2022/09/11 20:58:52 christos Exp $
  2221. +# $File: images,v 1.236 2022/10/31 13:22:26 christos Exp $
  2222. # images: file(1) magic for image formats (see also "iff", and "c-lang" for
  2223. # XPM bitmaps)
  2224. #
  2225. @@ -179,7 +179,7 @@
  2226. # adding 65 to strength so that Netpbm images comes before "x86 boot sector" or
  2227. # "DOS/MBR boot sector" identified by ./filesystems
  2228. 0 name netpbm
  2229. ->3 regex/s =[0-9]{1,50}[\040\t\f\r\n]+[0-9]{1,50} Netpbm image data
  2230. +>3 regex/s =\^[0-9]{1,50}[\040\t\f\r\n]+[0-9]{1,50} Netpbm image data
  2231. >>&0 regex =[0-9]{1,50} \b, size = %s x
  2232. >>>&0 regex =[0-9]{1,50} \b %s
  2233. @@ -311,12 +311,12 @@
  2234. 0 string MM\x00\x2a TIFF image data, big-endian
  2235. !:strength +70
  2236. !:mime image/tiff
  2237. -!:ext tif,tiff
  2238. +!:ext tif/tiff
  2239. >(4.L) use \^tiff_ifd
  2240. 0 string II\x2a\x00 TIFF image data, little-endian
  2241. !:mime image/tiff
  2242. !:strength +70
  2243. -!:ext tif,tiff
  2244. +!:ext tif/tiff
  2245. >(4.l) use tiff_ifd
  2246. 0 name tiff_ifd
  2247. @@ -625,7 +625,7 @@
  2248. >>8 string x "%s"
  2249. # should be point character (2Eh) of version string according to TrID
  2250. #>6 ubyte !0x2E \b, at 6 %#x
  2251. -# caret character (23h) at the beginning in most or probaly all exanples
  2252. +# caret character (23h) at the beginning in most or probably all examples
  2253. #>0 ubyte !0x23 \b, starting with character %#x
  2254. # URL: http://fileformats.archiveteam.org/wiki/DeskMate_Draw
  2255. # http://en.wikipedia.org/wiki/Deskmate
  2256. @@ -652,7 +652,86 @@
  2257. >24 string SunGKS \b, SunGKS
  2258. # CGM image files
  2259. -0 string BEGMF clear text Computer Graphics Metafile
  2260. +# Update: Joerg Jenderek
  2261. +# URL: http://fileformats.archiveteam.org/wiki/CGM
  2262. +# https://en.wikipedia.org/wiki/Computer_Graphics_Metafile
  2263. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cgm-ct.trid.xml
  2264. +# http://standards.iso.org/ittf/PubliclyAvailableStandards/c032381_ISO_IEC_8632-4_1999(E).zip
  2265. +# Note: called "Computer Graphics Metafile (Clear Text)" by TrID and
  2266. +# "Computer Graphics Metafile ASCII" by DROID or CGM by XnView
  2267. +# verified by LibreOffice and partly by XnView `nconvert -info *.CGM`
  2268. +# According to TrID only letter B and M are always upcased and by DROID often only B is upcased for command BEGIN METAFILE
  2269. +0 string/c begmf
  2270. +# skip SOME DROID fmt-301-signature-id-359.cgm fmt-301-signature-id-361.cgm fmt-302-signature-id-364.cgm
  2271. +# fmt-302-signature-id-365.cgm x-fmt-142-signature-id-350.cgm x-fmt-142-signature-id-351.cgm
  2272. +>5 short !0
  2273. +# skip other versions of DROID fmt-301-signature-id-359.cgm fmt-301-signature-id-361.cgm fmt-302-signature-id-364.cgm
  2274. +# fmt-302-signature-id-365.cgm x-fmt-142-signature-id-350.cgm x-fmt-142-signature-id-351.cgm
  2275. +>>5 short !0xABab clear text Computer Graphics Metafile
  2276. +# https://reposcope.com/mimetype/image/cgm
  2277. +!:mime image/cgm
  2278. +!:ext cgm
  2279. +# SF:NAME like: 'metafile example';
  2280. +>>>5 string x %s
  2281. +# look for command METAFILE VERSION (MFVERSION <SOFTSEP> <I:VERSION>)
  2282. +>>>2 search/128/c mfversion
  2283. +#>>>>&0 ubyte x SOFTSEP=%#x
  2284. +# version like: 1 3 4
  2285. +>>>>&1 ubyte >0x31 \b, version %c
  2286. +# Summary: Computer Graphics Metafile (binary)
  2287. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/c/cgm-bin.trid.xml
  2288. +# https://standards.iso.org/ittf/PubliclyAvailableStandards/c032380_ISO_IEC_8632-3_1999(E).zip
  2289. +# Note: called "Computer Graphics Metafile (binary)" by TrID and DROID or CGM by XnView
  2290. +# verified by LibreOffice and partly by XnView `nconvert -info *.CGM`
  2291. +# look for BEGIN METAFILE (element Class 0 and ID 1 and "random" Parameter) that is binary C C C C 0 0 0 0 0 0 1 P P P P P
  2292. +0 ubeshort&0xFFe0 0x0020
  2293. +# skip SOME DROID fmt-303-signature-id-368.cgm fmt-304-signature-id-369.cgm fmt-305-signature-id-370.cgm fmt-306-signature-id-371.cgm
  2294. +# with containing only 28 bytes
  2295. +>28 ubyte x
  2296. +# look for METAFILE VERSION (element class 1 and id 1 and parameter P1 with length 2) that is binary 0 0 0 1 i i i i i i 1 P P P 1 P
  2297. +# with "low" version; 2nd worst case argentin.cgm with parameter length 56
  2298. +# worst MS.CGM
  2299. +#>>2 search/73/b \x10\x22\0 binary Computer Graphics Metafile
  2300. +>>2 search/128/b \x10\x22\0 binary Computer Graphics Metafile
  2301. +!:mime image/cgm
  2302. +!:ext cgm
  2303. +# metafile 2 byte version number like: 1 (most) 2 3 4
  2304. +>>>&-1 ubeshort >1 \b, version %u
  2305. +# length number of 1st parameter octets in range 0 to 30 implies short command
  2306. +>>>0 ubeshort&0x001F <31 \b, parameter length %u
  2307. +# length of string like: 8 9 10 11 12 29
  2308. +#>>>>2 ubyte x \b, %u BYTES (SHORT)
  2309. +# string like: 'HiJaak 2' 'Example 1' 'sahara.cgm' 'MASTERCLIPS--Art Of Business '
  2310. +>>>>2 pstring >\0 '%s'
  2311. +# after 1st short command with even parameter length comes 2nd command like: 1022h 0010h (EAF00010.CGM 'HiJaak 2' FLOPPY2.CGM TIGER.CGM 'B:\TIGER.CGM')
  2312. +>>>>0 ubeshort&0x0001 =0
  2313. +>>>>>(2.b+3) ubeshort !0x1022 \b, 2nd command %#4.4x (short even)
  2314. +# after 1st short command with odd parameter length comes nil padding byte followed 2nd command like: 1022h
  2315. +>>>>0 ubeshort&0x0001 =1
  2316. +#>>>>>(2.b+3) ubyte !0 \b, PADDING %#x
  2317. +>>>>>(2.b+4) ubeshort !0x1022 \b, 2nd command %#4.4x (short odd)
  2318. +# 11111 binary (decimal 31) in the parameter field indicates that the command is in long-form
  2319. +>>>0 ubeshort&0x001F =0x1F
  2320. +# bit 15 is partition flag with 1 for 'not-last' partition and 0 for 'last' partition
  2321. +>>>>2 ubeshort&0x8000 !0 \b, partition flag %#4.4x
  2322. +# bits 0 to 14 is parameter list length; the number of following parameter octets; range 0 to 32767
  2323. +# length of 1st long command parameter like: 53
  2324. +>>>>2 ubeshort&0x7Fff x \b, parameter length %u (long)
  2325. +# The two header words are then followed by lenghth of 1st string like: 52
  2326. +#>>>>4 ubyte x \b, %u BYTES
  2327. +# string like: 'K:\PROJECTS\GRAPHICS\DWKS3.5\CLIPART\FLAGS\Italy.cgm'
  2328. +>>>>4 pstring/B x '%s'
  2329. +# odd long parameter length implies single null padding octet to start command on word boundary
  2330. +>>>>2 ubeshort&0x0001 =1
  2331. +# after 1st long command with odd parameter length comes nil padding byte followed by 2nd command like: 1022h
  2332. +#>>>>>(4.b+5) ubyte !0 \b, PADDING %#x
  2333. +>>>>>(4.b+6) ubeshort !0x1022 \b, 2nd command %#4.4x (long odd)
  2334. +# even long parameter length implies next command directly is following
  2335. +>>>>2 ubeshort&0x0001 =0
  2336. +# after 1st long command with even parameter length comes 2nd command like: 1022h 0x1054 (MS.CGM)
  2337. +>>>>>(4.b+5) ubeshort !0x1022 \b, 2nd command %#4.4x (long even)
  2338. +# look for END METAFILE (element class 0 and id 2 and 0 parameter) that is binary 0 0 0 0 i i i i i 1 i P P P P P
  2339. +>>>-2 ubeshort !0x0040 \b, NOT_FOUND_END_METAFILE
  2340. # MGR bitmaps (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
  2341. 0 string yz MGR bitmap, modern format, 8-bit aligned
  2342. @@ -1138,7 +1217,7 @@
  2343. 0 string /*\040
  2344. # 9 byte c-comment "/* XPM */" not at the beginning like: mozicon16.xpm mozicon50.xpm (thunderbird)
  2345. >0 search/0xCE /*\ XPM\ */
  2346. -# skip DROID x-fmt-208-signature-id-620.xpm by looking for char aray without explict length
  2347. +# skip DROID x-fmt-208-signature-id-620.xpm by looking for char array without explict length
  2348. # and match mh-logo.xpm (emacs)
  2349. >>&0 search/1249 []
  2350. >>>0 use xpm-image
  2351. @@ -1146,7 +1225,7 @@
  2352. >0 default x
  2353. # words are separated by a white space which can be composed of space and tabulation characters
  2354. >>0 search/0x52 static\040char\040
  2355. -# skip debug.c testmlc.c by looking for char aray without explict length
  2356. +# skip debug.c testmlc.c by looking for char array without explict length
  2357. # https://www.clamav.net/downloads/production/clamav-0.104.2.tar.gz
  2358. # clamav-0.104.2\libclammspack\mspack\debug.c
  2359. >>>&0 search/64 []
  2360. @@ -1459,22 +1538,22 @@
  2361. # skip g3test.g3 by test for unused bits of 2nd color entry
  2362. >>4 ubeshort&0xF000 0
  2363. #>>>0 beshort x 1ST_VALUE=%x
  2364. ->>>-0 offset x FILE_SIZE=%lld
  2365. +#>>>-0 offset x FILE_SIZE=%lld
  2366. # standard DEGAS low-res uncompressed bitmap *.pi1 with file size 32034
  2367. ->>>-0 offset =32034 VARIANT_STANDARD
  2368. +>>>-0 offset =32034
  2369. #>>>>0 beshort x 1st_VALUE=%x
  2370. # like: 8ball.pi1 teddy.pi1 sonic01.pi1
  2371. >>>>0 use degas-bitmap
  2372. # about 61 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 32066
  2373. ->>>-0 offset =32066 VARIANT_ELITE
  2374. +>>>-0 offset =32066
  2375. # like: spider.pi1 pinkgirl.pi1 frog3.pi1
  2376. >>>>0 use degas-bitmap
  2377. # about 55 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 32128
  2378. ->>>-0 offset =32128 VARIANT_3
  2379. +>>>-0 offset =32128
  2380. # like: mountain.pi1 bigspid.pi1 alf33.pi1
  2381. >>>>0 use degas-bitmap
  2382. # 1 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 44834
  2383. ->>>-0 offset =44834 VARIANT_4
  2384. +>>>-0 offset =44834
  2385. # like: kenshin.pi1
  2386. >>>>0 use degas-bitmap
  2387. # DEGAS mid-res uncompressed bitmap *.pi2 (strength=50) after GEM Images like:
  2388. @@ -1483,19 +1562,17 @@
  2389. #!:strength +0
  2390. # skip many control files like gnucash-4.8.setup.exe.aria2 by test for non black in 4 palette entries
  2391. >2 quad !0
  2392. -# skip control file load-v0001.aria2 by test for unused bits of 5th color palette entry
  2393. ->>10 ubeshort&0xF000 0
  2394. -# skip many GEM Image data like DANCER.IMG GAMEOVR4.IMG SHIP.IMG by test for unused bits of 8th color palette entry
  2395. ->>>16 ubeshort&0xF000 0
  2396. -# skip many GEM Image data like BEETHVEN.IMG CABINETS.IMG MEMO.IMG by test for unused bits of 14th color palette entry
  2397. ->>>>28 ubeshort&0xF000 0
  2398. -# skip few GEM Image data like CHURCH.IMG by test for unused bits of 15th color palette entry
  2399. ->>>>>30 ubeshort&0xF000 0
  2400. -# skip many GEM Image data like TIGER.IMG TURKEY.IMG XMAS.IMG by test for unused bits of 16th color palette entry
  2401. ->>>>>>32 ubeshort&0xF000 0
  2402. -# skip GEM Image data like clinton.img by test for existing bytes at the end
  2403. ->>>>>>>32026 quad x
  2404. ->>>>>>>>0 use degas-bitmap
  2405. +# skip control file load-v0001.aria2 and many GEM Image data like
  2406. +# GAMEOVR4.IMG BEETHVEN.IMG CHURCH.IMG TURKEY.IMG clinton.img
  2407. +# by test for valid file sizes
  2408. +# standard DEGAS mid-res uncompressed bitmap *.pi2 with file size 32034
  2409. +>>-0 offset =32034
  2410. +# (39/41) like: GEMINI03.PI2 ST_TOOLS.PI2 TBX_DEMO.PI2
  2411. +>>>0 use degas-bitmap
  2412. +# few DEGAS Elite mid-res uncompressed bitmap *.pi2 with file size 32066
  2413. +>>-0 offset =32066
  2414. +# (2/41) like: medres.pi2
  2415. +>>>0 use degas-bitmap
  2416. # DEGAS high-res uncompressed bitmap *.pi3
  2417. 0 beshort 0x0002
  2418. # skip Intel ia64 COFF msvcrt.lib by test for unused bits of 1st atari color palette entry
  2419. @@ -1515,8 +1592,12 @@
  2420. # 00000000 "LEREDACT.PI3" 03730773 "TBX_DEMO.PI3"
  2421. #>>>>&8 ubelong x \b, LAST CHAR+NIL %8.8x
  2422. >>>>&8 ubelong&0xff00ffFF !0
  2423. +# skip many Adobe Photoshop Color swatch (ANPA-Farben.aco TOYO-Farbsystem.aco) with invalid 3rd color entry (1319 2201 2206 21f5 2480 24db 25fd)
  2424. +>>>>>6 ubeshort&0xF000 0
  2425. +# skip few Adobe Photoshop Color swatch (FOCOLTONE-Farben.aco "PANTONE process coated.aco") with invalid 4th color entry (ffff)
  2426. +>>>>>>8 ubeshort&0xF000 0
  2427. # many DEGAS bitmap like: ARABDEMO.PI3 ELMRSESN.PI3 GEMVIEW.PI3 LEREDACT.PI3 PICCOLO.PI3 REPRO_JR.PI3 ST_TOOLS.PI3 TBX_DEMO.PI3 evgem7.pi3
  2428. ->>>>>0 use degas-bitmap
  2429. +>>>>>>>0 use degas-bitmap
  2430. # test for last character of Adobe PhotoShop Brush UTF16-LE string and terminating nul char
  2431. >>>>&8 ubelong&0xff00ffFF =0
  2432. # select last DEGAS bitmaps by invalid last char of brush note like BASICNES.PI3 DB_HELP.PI3 DB_WRITR.PI3 LEREDACT.PI3
  2433. @@ -1528,13 +1609,23 @@
  2434. 0 beshort 0x8000
  2435. # skip lif files handled via ./lif by test for unused bits of 1st palette entry
  2436. >2 ubeshort&0xF000 0
  2437. ->>0 use degas-bitmap
  2438. +# skip CRI ADX ADPCM audio (R04HT.adx R03T-15552.adx) with 44100 Hz misinterpreted as 5th color entry value AC44h
  2439. +>>10 ubeshort&0xF000 0
  2440. +# skip few (fmt-840-signature-id-1195.adx fmt-840-signature-id-1199.adx) by test for 4 first non black colors in palette entries
  2441. +>>>2 quad !0
  2442. +>>>>0 use degas-bitmap
  2443. # DEGAS mid-res compressed bitmap *.pc2 like: abydos.pc2 ARTIS3.PC2 SMTHDRAW.PC2 STAR_2K.PC2 TX2_DEMO.PC2
  2444. 0 beshort 0x8001
  2445. ->0 use degas-bitmap
  2446. +# skip many (1274/1369) PostScript Type 1 font (DarkGardenMK.pfb coupbi.pfb MONOBOLD.PFB) with invalid 1st atari color palette entry 5506 5b06 6906 7906 7e06 fb15
  2447. +>2 ubeshort&0xF000 0
  2448. +# skip some (95/1369) PostScript Type 1 font (fmt-525-signature-id-816.pfb LUXEMBRG.PFB) with invalid 3rd atari color palette entry 2521
  2449. +>>6 ubeshort&0xF000 0
  2450. +>>>0 use degas-bitmap
  2451. # DEGAS high-res compressed bitmap *.pc3 like: abydos.pc3 COYOTE.PC3 ELEPHANT.PC3 TX2_DEMO.PC3 SMTHDRAW.PC3
  2452. 0 beshort 0x8002
  2453. ->0 use degas-bitmap
  2454. +# skip some (36/212) Python Pickle (factor_cache.pickle environment.pickle) with invalid 1st atari color entry (2863 6363 7d71)
  2455. +>2 ubeshort&0xF000 0
  2456. +>>0 use degas-bitmap
  2457. # display information of Atari DEGAS and DEGAS Elite bitmap images
  2458. 0 name degas-bitmap
  2459. >0 ubyte x Atari DEGAS
  2460. @@ -1741,6 +1832,113 @@
  2461. >>>6 belong x 0x%8.8x
  2462. >>>6 beshort x \b%4.4x
  2463. +# From: Joerg Jenderek
  2464. +# URL: https://www.adobe.com/devnet-apps/photoshop/fileformatashtml/
  2465. +# http://fileformats.archiveteam.org/wiki/Photoshop
  2466. +# Reference: http://www.nomodes.com/aco.html
  2467. +# Note: registers as Photoshop.SwatchesFile for Photoshop.exe on Windows
  2468. +# check for valid versions like: 2 (newest) 1 (old) 0 (oldest no examples)
  2469. +0 ubeshort <3
  2470. +# skip few Atari DEGAS med-res bitmap (DIAGRAM1.PI2) and many ISO 9660 CD-ROM by check for invalid low color numbers (0)
  2471. +>2 ubeshort >0
  2472. +# skip few Targa (bmpsuite-15col.tga rgb24_top_left_colormap.tga) by check for invalid high color space ID (F0 1D)
  2473. +>>4 ubeshort <16
  2474. +# skip many (69/327) Targa image *.TGA by check of accessing near the ending of first color space section (size=nc*5*2)
  2475. +>>>(2.S*10) ubelong x
  2476. +# RGB branch for Adobe Photoshop Color swatch
  2477. +>>>>4 ubeshort =0
  2478. +# skip many (220/327) Targa by check of for invalid high RGB color z value (hexadecimal 2 3 2e03 4600 5e04 7502 8002 8b05 c700)
  2479. +>>>>>12 ubeshort =0
  2480. +# RGB branch for Adobe Photoshop Color swatch for older versions
  2481. +>>>>>>0 ubeshort <2
  2482. +>>>>>>>0 use adobe-aco
  2483. +# RGB branch for Adobe Photoshop Color swatch for newer version 2
  2484. +>>>>>>0 ubeshort =2
  2485. +# skip many (74/176) Atari DEGAS hi-res bitmap (*.PI3) by check for invalid low color name length (0)
  2486. +>>>>>>>16 ubeshort >0
  2487. +>>>>>>>>0 use adobe-aco
  2488. +# non RGB branch for Adobe Photoshop Color swatch
  2489. +>>>>4 ubeshort !0
  2490. +# non RGB branch for Adobe Photoshop Color swatch for older versions
  2491. +>>>>>0 ubeshort <2
  2492. +# skip many GEM Image (CHURCH.IMG TIGER.IMG) by check for invalid second high color space ID (55 114 143 157 256 288 450)
  2493. +>>>>>>14 ubeshort <16
  2494. +>>>>>>>0 use adobe-aco
  2495. +# non RGB branch for Adobe Photoshop Color swatch for newer version 2
  2496. +>>>>>0 ubeshort =2
  2497. +# skip few Atari DEGAS hi-res bitmap (pal1wb-blue.pi3) and few ABR by check for invalid "high" nil bytes (7) before color name length
  2498. +>>>>>>14 ubeshort =0
  2499. +>>>>>>>0 use adobe-aco
  2500. +# display Adobe Photoshop Color swatch file information (version, number of colors, color spaces, coordinates, names)
  2501. +0 name adobe-aco
  2502. +>0 ubeshort x Adobe Photoshop Color swatch, version %u
  2503. +#!:mime application/octet-stream
  2504. +!:mime application/x-adobe-aco
  2505. +!:apple ????8BCO
  2506. +!:ext aco
  2507. +>0 ubeshort <2
  2508. +>>(2.S*10) ubelong x
  2509. +# version 2 section after version 1 section
  2510. +>>>&0 ubeshort 2 and 2
  2511. +# nc; number of colors like: 20 50 86 88 126 204 300 1050 1137 1280 2092 3010 4096
  2512. +>2 ubeshort x \b, %u colors
  2513. +# maybe last 4 bytes of first section (probably y z color value) like: 0 0x66660000 0xfe700000 0xffff0000
  2514. +#>(2.S*10) ubelong x 1ST_SECTION_END=%#8.8x
  2515. +>0 ubeshort <2 \b; 1st
  2516. +# first older Adobe Photoshop Color entry
  2517. +>>4 use aco-color
  2518. +>>>2 ubeshort >1 \b; 2nd
  2519. +# second older Adobe Photoshop Color entry
  2520. +>>>>14 use aco-color
  2521. +>0 ubeshort =2 \b; 1st
  2522. +# first new Adobe Photoshop Color entry
  2523. +>>4 use aco-color-v2
  2524. +>>>2 ubeshort >1 \b; 2nd
  2525. +# jump first color name length words
  2526. +>>>>(16.S*2) ubequad x
  2527. +# second new Adobe Photoshop Color entry
  2528. +>>>>>&10 use aco-color-v2
  2529. +# display Adobe Photoshop Color entry (color space, color coordinates)
  2530. +0 name aco-color
  2531. +# each color spec entry occupies five words
  2532. +# color space: 0~RGB 1~HSB 2~CMYK 3~Pantone 4~Focoltone 5~Trumatch 6~Toyo 7~Lab 8~Grayscale 9?~wideCMYK 10~HKS ...
  2533. +#>0 ubeshort x COLOR_ENTRY
  2534. +>0 ubeshort 0 RGB
  2535. +>0 ubeshort 1 HSB
  2536. +>0 ubeshort 2 CMYK
  2537. +>0 ubeshort 3 Pantone
  2538. +>0 ubeshort 4 Focoltone
  2539. +>0 ubeshort 5 Trumatch
  2540. +>0 ubeshort 6 Toyo
  2541. +>0 ubeshort 7 Lab
  2542. +>0 ubeshort 8 Grayscale
  2543. +>0 ubeshort 9 wide CMYK
  2544. +>0 ubeshort 10 HKS
  2545. +# unofficial
  2546. +# >0 ubeshort 12 foo
  2547. +# >0 ubeshort 13 bar
  2548. +# >0 ubeshort 14 FOO
  2549. +# >0 ubeshort 15 BAR
  2550. +>0 ubeshort x space (%u)
  2551. +# color coordinate w
  2552. +>2 ubeshort x \b, w %#x
  2553. +# color coordinate x
  2554. +>4 ubeshort x \b, x %#x
  2555. +# color coordinate y
  2556. +>6 ubeshort x \b, y %#x
  2557. +# color coordinate z; zero for RGB space
  2558. +>8 ubeshort x \b, z %#x
  2559. +# display Adobe Photoshop Color entry version 2 (color space, color coordinates names)
  2560. +0 name aco-color-v2
  2561. +>0 use aco-color
  2562. +#>10 ubeshort x \b, NUL_BYTES %#x
  2563. +# color name length plus one (len+1) like: 7 8 9 13 14 15 16 17 22 26
  2564. +#>>12 ubeshort x \b, LENGTH %u
  2565. +>>12 ubeshort-1 x \b, %u chars
  2566. +# len words; UTF-16 representation of the color name like: "DIC 1s" "PANTONE Process Yellow PC"
  2567. +>>14 bestring16 x "%s"
  2568. +# followed by nil word
  2569. +
  2570. # XV thumbnail indicator (ThMO)
  2571. # URL: https://en.wikipedia.org/wiki/Xv_(software)
  2572. # Reference: http://fileformats.archiveteam.org/wiki/XV_thumbnail
  2573. @@ -2537,6 +2735,7 @@
  2574. # BS encoded bitstreams
  2575. 2 uleshort 0x3800 BS image,
  2576. +# GRR: the above line is also true for binary Computer Graphics Metafile SAB00012.CGM with long parameter length 56 (=38h)
  2577. >6 uleshort x Version %d,
  2578. >4 uleshort x Quantization %d,
  2579. >0 uleshort x (Decompresses to %d words)
  2580. --- a/magic/Magdir/intel
  2581. +++ b/magic/Magdir/intel
  2582. @@ -1,6 +1,6 @@
  2583. #------------------------------------------------------------------------------
  2584. -# $File: intel,v 1.22 2022/04/02 14:47:42 christos Exp $
  2585. +# $File: intel,v 1.23 2022/10/31 13:22:26 christos Exp $
  2586. # intel: file(1) magic for x86 Unix
  2587. #
  2588. # Various flavors of x86 UNIX executable/object (other than Xenix, which
  2589. @@ -141,7 +141,7 @@
  2590. # e80d0fcbh PXE-Intel.rom
  2591. # b8004875h orchid.bin
  2592. >>3 ubelong x %#8.8x
  2593. -# For misidetified raspberry pi pieeprom-*.bin like: 0xf00f
  2594. +# For misidentified raspberry pi pieeprom-*.bin like: 0xf00f
  2595. #>2 ubeshort x \b, AT 2 %#4.4x
  2596. ################################################################################
  2597. # new sections for BIOS (ia32) ROM Extension
  2598. @@ -230,12 +230,12 @@
  2599. # PCI data structure length like: 24h 28h
  2600. >>(24.s+0xA) uleshort >0x28 \b, length %u
  2601. # PCI data structure revision like: 0 3
  2602. ->>(24.s+0xC) ubyte >0 \b, revison %u
  2603. +>>(24.s+0xC) ubyte >0 \b, revision %u
  2604. # image length (hexadecimal) in multiple of 512 bytes like: 54 56 68 6a 76 78 7c 7d 7e 7f 80 81 83
  2605. # Apparently this gives the same information as given by byte at offset 2 but as 16-bit
  2606. #>>(24.s+0x10) uleshort x \b, length %u*512
  2607. # revision level of code/data like: 0 1 201h 502h
  2608. ->>(24.s+0xC) ubyte >1 \b, code revison %#x
  2609. +>>(24.s+0xC) ubyte >1 \b, code revision %#x
  2610. # code type: 0~Intel x86/PC-AT compatible 1~Open firmware standard for PCI42 FF~Reserved
  2611. >>(24.s+0x14) ubyte >0 \b, code type %#x
  2612. # last image indicator; bit 7 indicates "last image"; bits 0-6 are reserved
  2613. --- a/magic/Magdir/jpeg
  2614. +++ b/magic/Magdir/jpeg
  2615. @@ -1,6 +1,6 @@
  2616. #------------------------------------------------------------------------------
  2617. -# $File: jpeg,v 1.37 2022/06/17 18:03:35 christos Exp $
  2618. +# $File: jpeg,v 1.38 2022/12/02 17:42:04 christos Exp $
  2619. # JPEG images
  2620. # SunOS 5.5.1 had
  2621. #
  2622. @@ -239,8 +239,7 @@
  2623. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jxl.trid.xml
  2624. # Note: called by TrID "JPEG XL bitmap"
  2625. 0 string \xff\x0a JPEG XL codestream
  2626. -#!:mime image/jxl
  2627. -!:mime image/x-jxl
  2628. +!:mime image/jxl
  2629. !:ext jxl
  2630. # JPEG XL (transcoded JPEG file)
  2631. @@ -249,6 +248,5 @@
  2632. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jxl-iso.trid.xml
  2633. # Note: called by TrID "JPEG XL bitmap (ISOBMFF)"
  2634. 0 string \x00\x00\x00\x0cJXL\x20\x0d\x0a\x87\x0a JPEG XL container
  2635. -#!:mime image/jxl
  2636. -!:mime image/x-jxl
  2637. +!:mime image/jxl
  2638. !:ext jxl
  2639. --- a/magic/Magdir/lif
  2640. +++ b/magic/Magdir/lif
  2641. @@ -1,6 +1,6 @@
  2642. #------------------------------------------------------------------------------
  2643. -# $File: lif,v 1.10 2021/04/26 15:56:00 christos Exp $
  2644. +# $File: lif,v 1.11 2022/10/19 20:15:16 christos Exp $
  2645. # lif: file(1) magic for lif
  2646. #
  2647. # (Daniel Quinlan <quinlan@yggdrasil.com>)
  2648. @@ -16,9 +16,9 @@
  2649. >14 beshort =0
  2650. # skip MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for low version number
  2651. >>20 ubeshort <0x0100
  2652. -# skip DEGAS MUNCHIE.PC1 BOARD.PC1 ENEMIES.PC1 by test for ASCII like volume name
  2653. -#>>>2 ubelong >0x2020201F
  2654. ->>>0 use lif-file
  2655. +# skip DROID fmt-840-signature-id-1195.adx fmt-840-signature-id-1199.adx by test for ASCII like volume name
  2656. +>>>2 ubelong >0x2020201F
  2657. +>>>>0 use lif-file
  2658. 0 name lif-file
  2659. # LIF ID
  2660. >0 beshort x lif file
  2661. @@ -27,6 +27,7 @@
  2662. !:ext lif/hpi/dat
  2663. # volume label; A-Z 0-9 _ ; default are 6 spaces
  2664. >2 string x "%.6s"
  2665. +#>2 ubelong x LABEL=%8.8x
  2666. # version number; 0 for systems without extensions or 1 for model 64000
  2667. >20 ubeshort x \b, version %u
  2668. # LIF identifier; 010000 for system 3000
  2669. --- a/magic/Magdir/linux
  2670. +++ b/magic/Magdir/linux
  2671. @@ -1,6 +1,6 @@
  2672. #------------------------------------------------------------------------------
  2673. -# $File: linux,v 1.82 2022/09/07 11:23:44 christos Exp $
  2674. +# $File: linux,v 1.84 2022/11/29 23:10:29 christos Exp $
  2675. # linux: file(1) magic for Linux files
  2676. #
  2677. # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
  2678. @@ -67,8 +67,8 @@
  2679. >16 lelong x %d characters,
  2680. >12 lelong&0x01 0 no directory,
  2681. >12 lelong&0x01 !0 Unicode directory,
  2682. ->24 lelong x %d
  2683. ->28 lelong x \bx%d
  2684. +>28 lelong x %d
  2685. +>24 lelong x \bx%d
  2686. # Linux swap and hibernate files
  2687. # Linux kernel: include/linux/swap.h
  2688. @@ -492,9 +492,12 @@
  2689. 0 lelong 0x58313116 CRIU inventory
  2690. # Kdump compressed dump files
  2691. -# https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION
  2692. +# https://github.com/makedumpfile/makedumpfile/blob/master/IMPLEMENTATION
  2693. -0 string KDUMP Kdump compressed dump
  2694. +0 string KDUMP\x20\x20\x20 Kdump compressed dump
  2695. +>0 use kdump-compressed-dump
  2696. +
  2697. +0 name kdump-compressed-dump
  2698. >8 long x v%d
  2699. >12 string >\0 \b, system %s
  2700. >77 string >\0 \b, node %s
  2701. @@ -503,6 +506,12 @@
  2702. >272 string >\0 \b, machine %s
  2703. >337 string >\0 \b, domain %s
  2704. +# Flattened format
  2705. +0 string makedumpfile
  2706. +>16 bequad 1
  2707. +>>0x1010 string KDUMP\x20\x20\x20 Flattened kdump compressed dump
  2708. +>>>0x1010 use kdump-compressed-dump
  2709. +
  2710. # Device Tree files
  2711. 0 search/1024 /dts-v1/ Device Tree File (v1)
  2712. # beat c code
  2713. --- a/magic/Magdir/macintosh
  2714. +++ b/magic/Magdir/macintosh
  2715. @@ -1,6 +1,6 @@
  2716. #------------------------------------------------------------------------------
  2717. -# $File: macintosh,v 1.32 2021/04/26 15:56:00 christos Exp $
  2718. +# $File: macintosh,v 1.36 2022/12/06 18:45:20 christos Exp $
  2719. # macintosh description
  2720. #
  2721. # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
  2722. @@ -95,7 +95,10 @@
  2723. # MacBinary format (Eric Fischer, enf@pobox.com)
  2724. # Update: Joerg Jenderek
  2725. # URL: https://en.wikipedia.org/wiki/MacBinary
  2726. +# http://fileformats.archiveteam.org/wiki/MacBinary
  2727. # Reference: https://files.stairways.com/other/macbinaryii-standard-info.txt
  2728. +# Note: verified by macutils `macunpack -i -v BBEdit4.0.sit.bin` and
  2729. +# `deark -l -d -m macbinary G3FirmwareUpdate1.1.smi.bin`
  2730. #
  2731. # Unfortunately MacBinary doesn't really have a magic number prior
  2732. # to the MacBinary III format.
  2733. @@ -114,19 +117,19 @@
  2734. >>>>74 byte 0
  2735. # zero fill, must be zero for compatibility
  2736. >>>>>82 byte 0
  2737. +# skip few DEGAS mid-res uncompressed bitmap (GEMINI03.PI2 CODE_RAM.PI2) with "too high" file names ffffff88 ffff4f00
  2738. +>>>>>>2 ubelong <0xffff0000
  2739. # MacBinary I test for valid version numbers
  2740. ->>>>>>122 ubeshort 0
  2741. -# additional check for creation date after 1 Jan 1970 ~ 7C25B080h
  2742. -#>>>>>>>91 ubelong >0x7c25b07F
  2743. +>>>>>>>122 ubeshort 0
  2744. # additional check for undefined header fields in MacBinary I
  2745. -#>>>>>>>101 ulong 0
  2746. ->>>>>>>0 use mac-bin
  2747. +#>>>>>>>>101 ulong 0
  2748. +>>>>>>>>0 use mac-bin
  2749. # MacBinary II the newer versions begins at 129
  2750. ->>>>>>122 ubeshort 0x8181
  2751. ->>>>>>>0 use mac-bin
  2752. +>>>>>>>122 ubeshort 0x8181
  2753. +>>>>>>>>0 use mac-bin
  2754. # MacBinary III with MacBinary II to read
  2755. ->>>>>122 ubeshort 0x8281
  2756. ->>>>>>0 use mac-bin
  2757. +>>>>>>122 ubeshort 0x8281
  2758. +>>>>>>>0 use mac-bin
  2759. # display information of MacBinary file
  2760. 0 name mac-bin
  2761. @@ -139,7 +142,7 @@
  2762. !:mime application/x-macbinary
  2763. !:apple PSPTBINA
  2764. !:ext bin/macbin
  2765. -# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary
  2766. +# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidentified as MacBinary
  2767. #>1 ubyte >63 \b, name length %u too BIG!
  2768. #>122 ubeshort x \b, version %#x
  2769. # Finder flags if not 0
  2770. @@ -180,12 +183,16 @@
  2771. # 124 beshort # checksum
  2772. #>124 ubeshort !0 \b, CRC %#x
  2773. # creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
  2774. ->91 beldate-0x7C25B080 x \b, %s
  2775. -# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow
  2776. +# few (31/1247) examples (hinkC4.0.sitx.bin InternetExplorer5.1.smi.bin G3FirmwareUpdate1.1.smi.bin Firewire2.3.3.smi.bin LR2image.bin) contain zeroed date fields
  2777. +>91 long !0
  2778. +>>91 beldate-0x7C25B080 x \b, %s
  2779. +# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidentified or time overflow
  2780. >91 ubelong <0x7c25b080 INVALID date
  2781. -#>91 belong-0x7C25B080 x \b, DEBUG DATE %d
  2782. +# reported date seconds by deark
  2783. +#>91 ubelong x deark-DATE=%u
  2784. # last modified date
  2785. ->95 beldate-0x7C25B080 x \b, modified %s
  2786. +>95 long !0
  2787. +>>95 beldate-0x7C25B080 x \b, modified %s
  2788. # Apple creator+typ if not null
  2789. # file creator (normally expressed as four characters)
  2790. >69 ulong !0 \b, creator
  2791. @@ -197,6 +204,7 @@
  2792. # length of data segment
  2793. >83 ubelong !0 \b, %u bytes
  2794. # filename (in the range 1-63)
  2795. +# like "BBEdit4.0.sit" "Archive.sitx" "MacPGP 2.2 (.sea)"
  2796. >1 pstring x "%s"
  2797. # print 1 space and then at offset 128 inspect data fork content if it has one
  2798. >83 ubelong !0 \b
  2799. @@ -447,7 +455,7 @@
  2800. >>>0x412 beshort x number of blocks: %d,
  2801. >>>0x424 pstring x volume name: %s
  2802. -0x400 beshort 0x482B Macintosh HFS Extended
  2803. +0 name hfsplus
  2804. >&0 beshort x version %d data
  2805. >0 beshort 0x4C4B (bootable)
  2806. >0x404 belong ^0x00000100 (mounted)
  2807. @@ -466,6 +474,11 @@
  2808. >&42 belong x number of blocks: %d,
  2809. >&46 belong x free blocks: %d
  2810. +0x400 beshort 0x482B Apple HFS Plus
  2811. +>&0 use hfsplus
  2812. +0x400 beshort 0x4858 Apple HFS Plus Extended
  2813. +>&0 use hfsplus
  2814. +
  2815. ## AFAIK, only the signature is different
  2816. # same as Apple Partition Map
  2817. # GRR: This magic is too weak, it is just "TS"
  2818. @@ -490,14 +503,3 @@
  2819. # From: Remi Mommsen <mommsen@slac.stanford.edu>
  2820. 0 string BOMStore Mac OS X bill of materials (BOM) file
  2821. -# From: Adam Buchbinder <adam.buchbinder@gmail.com>
  2822. -# URL: https://en.wikipedia.org/wiki/Datafork_TrueType
  2823. -# Derived from the 'fondu' and 'ufond' source code (fondu.sf.net). 'sfnt' is
  2824. -# TrueType; 'POST' is PostScript. 'FONT' and 'NFNT' sometimes appear, but I
  2825. -# don't know what they mean.
  2826. -0 belong 0x100
  2827. ->(0x4.L+24) beshort x
  2828. ->>&4 belong 0x73666e74 Mac OSX datafork font, TrueType
  2829. ->>&4 belong 0x464f4e54 Mac OSX datafork font, 'FONT'
  2830. ->>&4 belong 0x4e464e54 Mac OSX datafork font, 'NFNT'
  2831. ->>&4 belong 0x504f5354 Mac OSX datafork font, PostScript
  2832. --- a/magic/Magdir/mail.news
  2833. +++ b/magic/Magdir/mail.news
  2834. @@ -1,5 +1,5 @@
  2835. #------------------------------------------------------------------------------
  2836. -# $File: mail.news,v 1.29 2022/06/17 18:02:19 christos Exp $
  2837. +# $File: mail.news,v 1.30 2022/10/31 13:22:26 christos Exp $
  2838. # mail.news: file(1) magic for mail and news
  2839. #
  2840. # Unfortunately, saved netnews also has From line added in some news software.
  2841. @@ -65,7 +65,7 @@
  2842. # other ID (like 02900000h) or TnefVersion ID (idTnefVersion=06900800h)
  2843. >7 ubelong !0x06900800 \b, 1st id %#8.8x
  2844. >7 ubelong =0x06900800
  2845. -# TnefVersion lenght like: 4
  2846. +# TnefVersion length like: 4
  2847. >>11 ulelong !4 \b, TnefVersion length %x
  2848. # TNEFVersionData; TnefVersion data like: 00010000h
  2849. >>15 ulelong !0x00010000h \b, version %#8.8x
  2850. --- a/magic/Magdir/mathematica
  2851. +++ b/magic/Magdir/mathematica
  2852. @@ -1,6 +1,6 @@
  2853. #------------------------------------------------------------------------------
  2854. -# $File: mathematica,v 1.14 2021/11/07 16:27:36 christos Exp $
  2855. +# $File: mathematica,v 1.15 2022/10/31 13:22:26 christos Exp $
  2856. # mathematica: file(1) magic for mathematica files
  2857. # "H. Nanosecond" <aldomel@ix.netcom.com>
  2858. # Mathematica a multi-purpose math program
  2859. @@ -132,7 +132,7 @@
  2860. >>>>0 ulelong <53
  2861. # skip tokens.dat and some Netwfw*.dat by check for valid imaginary flag value of MAT version 4
  2862. >>>>>12 ulelong <2
  2863. -# no misidentfied little endian MATrix example with "short" matrix name
  2864. +# no misidentified little endian MATrix example with "short" matrix name
  2865. >>>>>>16 ulelong <3
  2866. >>>>>>>0 use \^matlab4
  2867. # little endian MATrix with "long" matrix name or some misidentified samples
  2868. --- a/magic/Magdir/meteorological
  2869. +++ b/magic/Magdir/meteorological
  2870. @@ -1,6 +1,6 @@
  2871. #------------------------------------------------------------------------------
  2872. -# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
  2873. +# $File: meteorological,v 1.4 2022/12/09 18:02:09 christos Exp $
  2874. # rinex: file(1) magic for RINEX files
  2875. # http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
  2876. # ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
  2877. @@ -45,5 +45,9 @@
  2878. # https://en.wikipedia.org/wiki/GRIB
  2879. 0 string GRIB
  2880. ->7 byte =1 Gridded binary (GRIB) version 1
  2881. +>7 byte =1 Gridded binary (GRIB) version 1
  2882. +!:mime application/x-grib
  2883. +!:ext grb/grib
  2884. >7 byte =2 Gridded binary (GRIB) version 2
  2885. +!:mime application/x-grib2
  2886. +!:ext grb2/grib2
  2887. --- a/magic/Magdir/modem
  2888. +++ b/magic/Magdir/modem
  2889. @@ -1,6 +1,6 @@
  2890. #------------------------------------------------------------------------------
  2891. -# $File: modem,v 1.10 2021/04/26 15:56:00 christos Exp $
  2892. +# $File: modem,v 1.11 2022/10/19 20:15:16 christos Exp $
  2893. # modem: file(1) magic for modem programs
  2894. #
  2895. # From: Florian La Roche <florian@knorke.saar.de>
  2896. @@ -11,6 +11,7 @@
  2897. # Summary: CCITT Group 3 Facsimile in "raw" form (i.e. no header).
  2898. # Modified by: Joerg Jenderek
  2899. # URL: https://de.wikipedia.org/wiki/Fax
  2900. +# http://fileformats.archiveteam.org/wiki/CCITT_Group_3
  2901. # Reference: https://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
  2902. # GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
  2903. 0 short 0x0100
  2904. @@ -32,7 +33,10 @@
  2905. # skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
  2906. >>>>>>8 ubequad !0x2e01010454010203
  2907. # skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
  2908. ->>>>>>>8 ubequad !0x5dee74ad1aa56394 raw G3 (Group 3) FAX, byte-padded
  2909. +>>>>>>>8 ubequad !0x5dee74ad1aa56394
  2910. +# skip few (5/41) DEGAS mid-res bitmap (GEMINI01.PI2 GEMINI02.PI2 GEMINI03.PI2 CODE_RAM.PI2 TBX_DEMO.PI2)
  2911. +# with file size 32034
  2912. +>>>>>>>>-0 offset !32034 raw G3 (Group 3) FAX, byte-padded
  2913. # version 5.25 labeled the entry above "raw G3 data, byte-padded"
  2914. !:mime image/g3fax
  2915. #!:apple ????TIFF
  2916. @@ -43,7 +47,9 @@
  2917. # 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
  2918. >2 search/9 \0\0
  2919. # maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
  2920. ->2 default x raw G3 (Group 3) FAX
  2921. +>2 default x
  2922. +# skip some (84/1246) MacBinary II/III (Cyberdog2.068k.smi.bin FileMakerPro4.img.bin Hypercard1.25.image.bin UsbStorage1.3.5.smi.bin) with "non random" numbers by versions values 81h/82h + 81h
  2923. +>>122 ubeshort&0xFcFf !0x8081 raw G3 (Group 3) FAX
  2924. # version 5.25 labeled the above entry as "raw G3 data"
  2925. !:mime image/g3fax
  2926. !:ext g3
  2927. --- a/magic/Magdir/msdos
  2928. +++ b/magic/Magdir/msdos
  2929. @@ -1,6 +1,6 @@
  2930. #------------------------------------------------------------------------------
  2931. -# $File: msdos,v 1.158 2022/09/07 11:17:31 christos Exp $
  2932. +# $File: msdos,v 1.163 2022/12/18 14:54:39 christos Exp $
  2933. # msdos: file(1) magic for MS-DOS files
  2934. #
  2935. @@ -49,29 +49,127 @@
  2936. #
  2937. # Many of the compressed formats were extracted from IDARC 1.23 source code.
  2938. #
  2939. +# e_magic
  2940. 0 string/b MZ
  2941. -# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
  2942. ->0x18 leshort <0x40 MS-DOS executable
  2943. +# TODO
  2944. +# FLT: Syntrillium CoolEdit Filter https://en.wikipedia.org/wiki/Adobe_Audition
  2945. +# FMX64:FileMaker Pro 64-bit plug-in https://en.wikipedia.org/wiki/FileMaker
  2946. +# FMX: FileMaker Pro 32-bit plug-in https://en.wikipedia.org/wiki/FileMaker
  2947. +# FOD: WIFE Font Driver
  2948. +# GAU: MS Flight Simulator Gauge
  2949. +# IFS: OS/2 Installable File System https://en.wikipedia.org/wiki/OS/2
  2950. +# MEXW32:MATLAB Windows 32bit compiled function https://en.wikipedia.org/wiki/MATLAB
  2951. +# MEXW64:MATLAB Windows 64bit compiled function https://en.wikipedia.org/wiki/MATLAB
  2952. +# MLL: Maya plug-in (generic) http://en.wikipedia.org/wiki/Autodesk_Maya
  2953. +# PFL: PhotoFilter plugin http://photofiltre.free.fr
  2954. +# 8*: PhotoShop plug-in (generic) http://www.adobe.com/products/photoshop/main.html
  2955. +# PLG: Aston Shell plugin http://www.astonshell.com/
  2956. +# QLB: Microsoft Basic Quick library https://en.wikipedia.org/wiki/QuickBASIC
  2957. +# SKL: WinLIFT skin http://www.zapsolution.com/winlift/index.htm
  2958. +# TBK: Asymetrix ToolBook application http://www.toolbook.com
  2959. +# TBP: The Bat! plugin http://www.ritlabs.com
  2960. +# UPC: Ultimate Paint Graphics Editor plugin http://ultimatepaint.j-t-l.com
  2961. +# XFM: Syntrillium Cool Edit Transform Effect bad http://www.cooledit.com
  2962. +# XPL: X-Plane plugin http://www.xsquawkbox.net/xpsdk/
  2963. +# ZAP: ZoneLabs Zone Alarm data http://www.zonelabs.com
  2964. +#
  2965. +# NEXT LINES FOR DEBUGGING!
  2966. +# e_cblp; bytes on last page of file
  2967. +# e_cp; pages in file
  2968. +#>4 uleshort x \b, e_cp 0x%x
  2969. +# e_lfanew; file address of new exe header
  2970. +#>0x3c ulelong x \b, e_lfanew 0x%x
  2971. +# e_lfarlc; address of relocation table
  2972. +#>0x18 uleshort x \b, e_lfarlc=0x%x
  2973. +# e_ovno; overlay number. If zero, this is the main executable foo
  2974. +#>0x1a uleshort !0 \b, e_ovno 0x%x
  2975. +#>0x1C ubequad !0 \b, e_res 0x%16.16llx
  2976. +# e_oemid; often 0
  2977. +#>0x24 uleshort !0 \b, e_oemid 0x%x
  2978. +# e_oeminfo; typically zeroes, but 13Dh (WORDSTAR.CNV WPFT5.CNV) 143h (WRITWIN.CNV)
  2979. +# 1A3h (DBASE.CNV LOTUS123.CNV RFTDCA.CNV WORDDOS.CNV WORDMAC.CNV WORDWIN1.CNVXLBIFF.CNV)
  2980. +#>0x26 uleshort !0 \b, e_oeminfo 0x%x
  2981. +# e_res2; typically zeroes, but 000006006F082D2Ah SCSICFG.EXE 00009A0300007C03h de.exe
  2982. +# 0000CA0000000002h country.exe dosxmgr.exe 421E0A00421EA823h QMC.EXE
  2983. +#>0x28 ubequad !0 \b, e_res2 0x%16.16llx
  2984. +# https://web.archive.org/web/20171116024937/http://www.ctyme.com/intr/rb-2939.htm#table1593
  2985. +# https://github.com/uxmal/reko/blob/master/src/ImageLoaders/MzExe/ExeImageLoader.cs
  2986. +# new exe header magic like: PE NE LE LX W3 W4
  2987. +# no examples found for ZM DL MP P2 P3
  2988. +#>(0x3c.l) string x \b, at [0x3c] %.2s
  2989. +#>(0x3c.l) ubelong x \b, at [0x3c] %#8.8x
  2990. +#>(0x3c.l+4) ubelong x \b, at [0x3c+4] %#8.8x
  2991. +#
  2992. +# Most non-DOS MZ-executable extensions have the relocation table more than 0x40 bytes into the file.
  2993. +# http://www.mitec.cz/Downloads/EXE.zip/EXE64.exe e_lfarlc=0x8ead
  2994. +# OS/2 ECS\INSTALL\DETECTEI\PCISCAN.EXE e_lfarlc=0x1c
  2995. +# some EFI apps Shell_Full.efi ext4_x64_signed.efi e_lfarlc=0
  2996. +# Icon library WORD60.ICL e_lfarlc=0
  2997. +# Microsoft compiled help format 2.0 WINWORD.DEV.HXS e_lfarlc=0
  2998. +>0x18 uleshort <0x40
  2999. +# check magic of new second header
  3000. +# NE executable with low e_lfarlc like: WORD60.ICL
  3001. +# ICL: Icons Library 16-bit http://fileformats.archiveteam.org/wiki/Icon_library
  3002. +>>(0x3c.l) string NE Windows Icons Library 16-bit
  3003. +!:mime image/x-ms-icl
  3004. +!:ext icl
  3005. +# handle LX executable with low e_lfarlc like: PCISCAN.EXE
  3006. +>>(0x3c.l) string LX
  3007. +>>>(0x3c.l) use lx-executable
  3008. +# skip Portable Executable (PE) with low e_lfarlc here, because handled later
  3009. +# like: ext4_x64_signed.efi Shell_Full.efi WINWORD.DEV.HXS
  3010. +>>(0x3c.l) string PE
  3011. +# not New Executable (NE) and not PE with low e_lfarlc like:
  3012. +# MACCNV55.EXE WORK_RTF.EXE TELE200.EXE NDD.EXE iflash.exe
  3013. +>>(0x3c.l) default x MS-DOS executable, MZ for MS-DOS
  3014. !:mime application/x-dosexec
  3015. # Windows and later versions of DOS will allow .EXEs to be named with a .COM
  3016. # extension, mostly for compatibility's sake.
  3017. +# like: EDIT.COM 4DOS.COM CMD8086.COM CMD-FR.COM SYSLINUX.COM
  3018. # URL: https://en.wikipedia.org/wiki/Personal_NetWare#VLM
  3019. # Reference: https://mark0.net/download/triddefs_xml.7z/defs/e/exe-vlm-msg.trid.xml
  3020. -!:ext exe/com/vlm
  3021. +# also like: BGISRV.DRV
  3022. +!:ext exe/com/vlm/drv
  3023. # These traditional tests usually work but not always. When test quality support is
  3024. # implemented these can be turned on.
  3025. #>>0x18 leshort 0x1c (Borland compiler)
  3026. #>>0x18 leshort 0x1e (MS compiler)
  3027. # Maybe it's a PE?
  3028. +# URL: http://fileformats.archiveteam.org/wiki/Portable_Executable
  3029. +# Reference: https://docs.microsoft.com/de-de/windows/win32/debug/pe-format
  3030. >(0x3c.l) string PE\0\0 PE
  3031. -!:mime application/x-dosexec
  3032. +!:mime application/vnd.microsoft.portable-executable
  3033. +# https://docs.microsoft.com/de-de/windows/win32/debug/pe-format#characteristics
  3034. +# DLL Characteristics
  3035. +#>>(0x3c.l+22) uleshort x \b, CHARACTERISTICS %#4.4x,
  3036. +# 0x0200~IMAGE_FILE_DEBUG_STRIPPED Debugging information is removed from the image file
  3037. +# 0x1000~IMAGE_FILE_SYSTEM The image file is a system file, not a user program.
  3038. +# 0x2000~IMAGE_FILE_DLL The image file is a dynamic-link library (DLL)
  3039. >>(0x3c.l+24) leshort 0x010b \b32 executable
  3040. +# https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#windows-subsystem
  3041. +#>>>(0x3c.l+92) leshort x \b, SUBSYSTEM %u
  3042. >>(0x3c.l+24) leshort 0x020b \b32+ executable
  3043. +#>>>(0x3c.l+92) leshort x \b, SUBSYSTEM %u
  3044. >>(0x3c.l+24) leshort 0x0107 ROM image
  3045. >>(0x3c.l+24) default x Unknown PE signature
  3046. >>>&0 leshort x %#x
  3047. >>(0x3c.l+22) leshort&0x2000 >0 (DLL)
  3048. +# 0~IMAGE_SUBSYSTEM_UNKNOWN An unknown subsystem
  3049. +>>(0x3c.l+92) leshort 0 (
  3050. +# Summary: Microsoft compiled help *.HXS format 2.0
  3051. +# URL: https://en.wikipedia.org/wiki/Microsoft_Help_2
  3052. +# Reference: http://www.russotto.net/chm/itolitlsformat.html
  3053. +# https://mark0.net/download/triddefs_xml.7z/defs/h/hxs.trid.xml
  3054. +# Note: 2 PE sections (.rsrc, .its) implies Microsoft compiled help format; the .its section contains the help content ITOLITLS
  3055. +# verified by command like `pelook.exe -d WINWORD.HXS & pelook.exe -h WINWORD.HXS`
  3056. +>>>(0x3c.l+6) uleshort =2 \bMicrosoft compiled help format 2.0)
  3057. +!:ext hxs
  3058. +# 3 PE sections (.text, .reloc, .rsrc) implies some Control Panel Item like:
  3059. +# CPL: Control Panel item for WINE 1.7.28 https://www.winehq.org/
  3060. +>>>(0x3c.l+6) uleshort !2 \bControl Panel Item)
  3061. +!:ext cpl
  3062. +# 1~IMAGE_SUBSYSTEM_NATIVE device drivers and native Windows processes
  3063. >>(0x3c.l+92) leshort 1
  3064. # Native PEs include ntoskrnl.exe, hal.dll, smss.exe, autochk.exe, and all the
  3065. # drivers in Windows/System32/drivers/*.sys.
  3066. @@ -79,6 +177,7 @@
  3067. !:ext dll/sys
  3068. >>>(0x3c.l+22) leshort&0x2000 0 (native)
  3069. !:ext exe/sys
  3070. +# 2~IMAGE_SUBSYSTEM_WINDOWS_GUI The Windows graphical user interface (GUI) subsystem
  3071. >>(0x3c.l+92) leshort 2
  3072. >>>(0x3c.l+22) leshort&0x2000 >0 (GUI)
  3073. # These could probably be at least partially distinguished from one another by
  3074. @@ -94,21 +193,72 @@
  3075. # Screen savers typically include code from the scrnsave.lib static library, but
  3076. # that's not guaranteed.
  3077. !:ext exe/scr
  3078. +# 3~IMAGE_SUBSYSTEM_WINDOWS_CUI The Windows character subsystem
  3079. >>(0x3c.l+92) leshort 3
  3080. >>>(0x3c.l+22) leshort&0x2000 >0 (console)
  3081. !:ext dll/cpl/tlb/ocx/acm/ax/ime
  3082. >>>(0x3c.l+22) leshort&0x2000 0 (console)
  3083. !:ext exe/com
  3084. -# https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
  3085. ->>(0x3c.l+92) leshort 7 (POSIX)
  3086. ->>(0x3c.l+92) leshort 9 (Windows CE)
  3087. +# NO Windows Subsystem number 4!
  3088. +>>(0x3c.l+92) leshort 4 (Unknown subsystem 4)
  3089. +# 5~IMAGE_SUBSYSTEM_OS2_CUI The OS/2 character subsystem
  3090. +>>(0x3c.l+92) leshort 5 (OS/2)
  3091. +# GRR: No examples found by Joerg Jenderek
  3092. +#!:ext foo-exe-os2
  3093. +# NO Windows Subsystem number 6!
  3094. +>>(0x3c.l+92) leshort 6 (Unknown subsystem 6)
  3095. +# 7~IMAGE_SUBSYSTEM_POSIX_CUI The Posix character subsystem
  3096. +>>(0x3c.l+92) leshort 7 (POSIX
  3097. +>>>(0x3c.l+22) leshort&0x2000 >0 \b)
  3098. +# like: PSXDLL.DLL
  3099. +!:ext dll
  3100. +>>>(0x3c.l+22) leshort&0x2000 0 \b)
  3101. +# like: PAX.EXE
  3102. +!:ext exe
  3103. +# 8~IMAGE_SUBSYSTEM_NATIVE_WINDOWS Native Win9x driver
  3104. +>>(0x3c.l+92) leshort 8 (Win9x)
  3105. +# GRR: No examples found by Joerg Jenderek
  3106. +#!:ext foo-exe-win98
  3107. +# 9~IMAGE_SUBSYSTEM_WINDOWS_CE_GUI Windows CE
  3108. +>>(0x3c.l+92) leshort 9 (Windows CE
  3109. +>>>(0x3c.l+22) leshort&0x2000 >0 \b)
  3110. +# like: MCS9900Ce50.dll Mosiisr99x.dll TMCGPS.DLL
  3111. +!:ext dll
  3112. +>>>(0x3c.l+22) leshort&0x2000 0 \b)
  3113. +# like: NNGStart.exe navigator.exe
  3114. +!:ext exe
  3115. +# 10~IMAGE_SUBSYSTEM_EFI_APPLICATION An Extensible Firmware Interface (EFI) application
  3116. >>(0x3c.l+92) leshort 10 (EFI application)
  3117. +# like: bootmgfw.efi grub.efi gdisk_x64.efi Shell_Full.efi shim.efi syslinux.efi
  3118. +!:ext efi
  3119. +# 11~IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER An EFI driver with boot services
  3120. >>(0x3c.l+92) leshort 11 (EFI boot service driver)
  3121. +# like: ext2_x64_signed.efi Fat_x64.efi iso9660_x64_signed.efi
  3122. +!:ext efi
  3123. >>(0x3c.l+92) leshort 12 (EFI runtime driver)
  3124. +# no sample found
  3125. +!:ext efi
  3126. +# 13~IMAGE_SUBSYSTEM_EFI_ROM An EFI ROM image
  3127. >>(0x3c.l+92) leshort 13 (EFI ROM)
  3128. +# no sample found
  3129. +!:ext efi
  3130. +# 14~IMAGE_SUBSYSTEM_XBOX XBOX
  3131. >>(0x3c.l+92) leshort 14 (XBOX)
  3132. ->>(0x3c.l+92) leshort 15 (Windows boot application)
  3133. ->>(0x3c.l+92) default x (Unknown subsystem
  3134. +#!:ext foo-xbox
  3135. +# NO Windows Subsystem number 15!
  3136. +>>(0x3c.l+92) leshort 15 (Unknown subsystem 15)
  3137. +# 16~IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION Windows boot application
  3138. +>>(0x3c.l+92) leshort 16 (Windows boot application
  3139. +>>>(0x3c.l+22) leshort&0x2000 >0 \b)
  3140. +# like: bootvhd.dll bootuwf.dll hvloader.dll tcbloader.dll bootspaces.dll
  3141. +!:ext dll
  3142. +>>>(0x3c.l+22) leshort&0x2000 0 \b)
  3143. +# like: bootmgr.efi memtest.efi shellx64.efi memtest.exe winload.exe winresume.exe bootvhd.dll hvloader.dll
  3144. +!:ext efi/exe
  3145. +# GRR: the next 2 lines are not executed!
  3146. +#>>(0x3c.l+92) default x (Unknown subsystem
  3147. +#>>>&0 leshort x %#x)
  3148. +>>(0x3c.l+92) leshort >16 (Unknown subsystem
  3149. >>>&0 leshort x %#x)
  3150. >>(0x3c.l+4) leshort 0x14c Intel 80386
  3151. >>(0x3c.l+4) leshort 0x166 MIPS R4000
  3152. @@ -140,6 +290,7 @@
  3153. >>(0x3c.l+4) leshort 0x8664 x86-64
  3154. >>(0x3c.l+4) leshort 0xaa64 Aarch64
  3155. >>(0x3c.l+4) leshort 0xc0ee MSIL
  3156. +# GRR: the next 2 lines are not executed!
  3157. >>(0x3c.l+4) default x Unknown processor type
  3158. >>>&0 leshort x %#x
  3159. >>(0x3c.l+22) leshort&0x0200 >0 (stripped to external PDB)
  3160. @@ -176,33 +327,134 @@
  3161. >>&(0x3c.l+0xf8) search/0x100 _winzip_ \b, ZIP self-extracting archive (WinZip)
  3162. >>&(0x3c.l+0xf8) search/0x100 SharedD \b, Microsoft Installer self-extracting archive
  3163. >>0x30 string Inno \b, InnoSetup self-extracting archive
  3164. +# NumberOfSections; Normal Dynamic Link libraries have a few sections for code, data and resource etc.
  3165. +# PE used as container have less sections
  3166. +>>(0x3c.l+6) leshort >1 \b, %u sections
  3167. +# do not display for 1 section to get output like in version 5.43 and to keep output columns low
  3168. +#>>(0x3c.l+6) leshort =1 \b, %u section
  3169. # If the relocation table is 0x40 or more bytes into the file, it's definitely
  3170. # not a DOS EXE.
  3171. ->0x18 leshort >0x3f
  3172. +>0x18 uleshort >0x3f
  3173. # Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
  3174. # must be one of the unusual subformats.
  3175. >>(0x3c.l) string !PE\0\0 MS-DOS executable
  3176. -!:mime application/x-dosexec
  3177. +#!:mime application/x-dosexec
  3178. >>(0x3c.l) string NE \b, NE
  3179. -!:mime application/x-dosexec
  3180. +#!:mime application/x-dosexec
  3181. +!:mime application/x-ms-ne-executable
  3182. +# FOR DEBUGGING!
  3183. +# Reference: https://wiki.osdev.org/NE
  3184. +# ProgFlags; Program flags, bitmapped
  3185. +#>>>(0x3c.l+0x0C) ubyte x \b, ProgFlags 0x%2.2x
  3186. +# >>>(0x3c.l+0x0c) ubyte&0x03 =0 \b, none
  3187. +# >>>(0x3c.l+0x0c) ubyte&0x03 =1 \b, single shared
  3188. +# >>>(0x3c.l+0x0c) ubyte&0x03 =2 \b, multiple
  3189. +# >>>(0x3c.l+0x0c) ubyte&0x03 =3 \b, (null)
  3190. +# >>>(0x3c.l+0x0c) ubyte &0x04 \b, Global initialization
  3191. +# >>>(0x3c.l+0x0c) ubyte &0x08 \b, Protected mode only
  3192. +# >>>(0x3c.l+0x0c) ubyte &0x10 \b, 8086 instructions
  3193. +# >>>(0x3c.l+0x0c) ubyte &0x20 \b, 80286 instructions
  3194. +# >>>(0x3c.l+0x0c) ubyte &0x40 \b, 80386 instructions
  3195. +# >>>(0x3c.l+0x0c) ubyte &0x80 \b, 80x87 instructions
  3196. +# ApplFlags; Application flags, bitmapped
  3197. +# https://www.fileformat.info/format/exe/corion-ne.htm
  3198. +#>>>(0x3c.l+0x0D) ubyte x \b, ApplFlags 0x%2.2x
  3199. +# Application type (bits 0-2); 1~Full screen (not aware of Windows/P.M. API)
  3200. +# 2~Compatible with Windows/P.M. API 3~Uses Windows/P.M. API
  3201. +#>>>(0x3c.l+0x0D) ubyte&0x07 =1 \b, Full screen
  3202. +#>>>(0x3c.l+0x0D) ubyte&0x07 =2 \b, Compatible with Windows/P.M. API
  3203. +#>>>(0x3c.l+0x0D) ubyte&0x07 =3 \b, use Windows/P.M. API
  3204. +# bit 7; DLL or driver (SS:SP info invalid, CS:IP points at FAR init routine called with AX handle
  3205. +#>>>(0x3c.l+0x0D) ubyte &0x80 \b, DLL or driver
  3206. +# AutoDataSegIndex; automatic data segment index like: 0 2 3 22
  3207. +# zero if the SINGLEDATA and MULTIPLEDATA bits are cleared
  3208. +#>>>(0x3c.l+0x0e) uleshort x \b, AutoDataSegIndex %u
  3209. +# InitHeapSize; intial local heap size like; 0 400h 1400h
  3210. +# zero if there is no local allocation
  3211. +#>>>(0x3c.l+0x10) uleshort !0 \b, InitHeapSize 0x%x
  3212. +# InitStackSize; inital stack size like: 0 10h A00h 7D0h A8Ch FA0h 1000h 1388h
  3213. +# 1400h (CBT) 1800h 2000h 2800h 2EE0h 2F3Ch 3258h 3E80h 4000h 4E20h 5000h 6000h
  3214. +# 6D60h 8000h 40000h
  3215. +# zero if the SS register value does not equal the DS register value
  3216. +#>>>(0x3c.l+0x12) uleshort !0 \b, InitStackSize 0x%x
  3217. +# EntryPoint; segment offset value of CS:IP like: 0 10000h 18A84h 11C1Ah 307F1h
  3218. +#>>>(0x3c.l+0x14) ulelong !0 \b, EntryPoint 0x%x
  3219. +# InitStack; specifies the segment offset value of stack pointer SS:SP
  3220. +# like: 0 20000h 160000h
  3221. +#>>>(0x3c.l+0x18) ulelong !0 \b, InitStack 0x%x
  3222. +# SegCount; number of segments in segment table like: 0 1 2 3 16h
  3223. +#>>>(0x3c.l+0x1C) uleshort x \b, SegCount 0x%x
  3224. +# ModRefs; number of module references (DLLs) like; 0 1 3
  3225. +#>>>(0x3c.l+0x1E) uleshort !0 \b, ModRefs %u
  3226. +# NoResNamesTabSiz; size in bytes of non-resident names table
  3227. +# like: Bh 16h B4h B9h 2Ch 18Fh 16AAh
  3228. +#>>>(0x3c.l+0x20) uleshort x \b, NoResNamesTabSiz 0x%x
  3229. +# SegTableOffset; offset of Segment table like: 40h
  3230. +#>>>(0x3c.l+0x22) uleshort !0x40 \b, SegTableOffset 0x%x
  3231. +# ResTableOffset; offset of resources table like: 40h 50h 58h F0h
  3232. +# 40h for most fonts likedos737.fon FMFONT.FOT but 60h for L1WBASE.FON
  3233. +#>>>(0x3c.l+0x24) uleshort x \b, ResTableOffset 0x%x
  3234. +# ResidNamTable; offset of resident names table
  3235. +# like: 58h 5Ch 60h 68h 74h 98h 2E3h 2E7h 2F0h
  3236. +#>>>(0x3c.l+0x26) uleshort x \b, ResidNamTable 0x%x
  3237. +# ImportNameTable; offset of imported names table (array of counted strings, terminated with string of length 00h)
  3238. +# like: 77h 7Eh 80h C6h A7h ACh 2F8h 3FFh
  3239. +#>>>(0x3c.l+0x2a) uleshort x \b, ImportNameTable 0x%x
  3240. +# OffStartNonResTab; offset from start of file to non-resident names table
  3241. +# like: 110h 11Dh 19Bh 1A5h 3F5h 4C8h 4EEh D93h
  3242. +#>>>(0x3c.l+0x2c) ulelong x \b, OffStartNonResTab 0x%x
  3243. +# MovEntryCount; number of movable entry points like: 0 4 5 6 16 17 24 312 355 446
  3244. +#>>>(0x3c.l+0x30) uleshort !0 \b, MovEntryCount %u
  3245. +# FileAlnSzShftCnt; log2 of the segment sector size; 4~16 0~9~512 (default)
  3246. +#>>>(0x3c.l+0x32) uleshort !9 \b, FileAlnSzShftCnt %u
  3247. +# nResTabEntries; number of resource table entries like: 0 2
  3248. +#>>>(0x3c.l+0x34) uleshort !0 \b, nResTabEntries %u
  3249. +# targOS; Target OS; 0~unknown~OS/2 1.0 or MS Windows 1-2
  3250. +# OS/2 1.0 like: DTM.DLL SHELL11F.EXE HELPMSG.EXE CREATEDD.EXE
  3251. +# or Windows 1.03 - 2.1 like: MSDOSD.EXE KARTEI.EXE KALENDER.EXE
  3252. +#>>>(0x3c.l+0x36) byte x TARGOS %x
  3253. +>>>(0x3c.l+0x36) byte 0 for OS/2 1.0 or MS Windows 1-2
  3254. >>>(0x3c.l+0x36) byte 1 for OS/2 1.x
  3255. >>>(0x3c.l+0x36) byte 2 for MS Windows 3.x
  3256. >>>(0x3c.l+0x36) byte 3 for MS-DOS
  3257. >>>(0x3c.l+0x36) byte 4 for Windows 386
  3258. >>>(0x3c.l+0x36) byte 5 for Borland Operating System Services
  3259. +# http://downloads.sourceforge.net/dfendreloaded/D-Fend-Reloaded-1.4.4.zip
  3260. +# D-Fend Reloaded/VirtualHD/FREEDOS/DPMILD32.EXE
  3261. +# GRR: WHAT OS is this?
  3262. +#>>>(0x3c.l+0x36) byte 6 for TARGET SIX
  3263. +# https://en.wikipedia.org/wiki/Phar_Lap_(company)
  3264. +>>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender, OS/2
  3265. +# like: CVP7.EXE
  3266. +>>>(0x3c.l+0x36) byte 0x82 for MS-DOS, Phar Lap DOS extender, Windows
  3267. >>>(0x3c.l+0x36) default x
  3268. ->>>>(0x3c.l+0x36) byte x (unknown OS %x)
  3269. ->>>(0x3c.l+0x36) byte 0x81 for MS-DOS, Phar Lap DOS extender
  3270. +>>>>(0x3c.l+0x36) ubyte x (unknown OS %#x)
  3271. +# expctwinver; expected Windows version (minor first) like:
  3272. +# 0.0~DTM.DLL 203.4~Windows 1.03 GDI.EXE 2.1~TTY.DRV 3.0~dos737.fon FMFONT.FOT THREED.VBX 3.10~GDI.EXE 4.0~(ME) VGAFULL.3GR
  3273. +>>>(0x3c.l+0x3F) ubyte x (%u
  3274. +>>>(0x3c.l+0x3E) ubyte x \b.%u)
  3275. +# OS2EXEFlags; other EXE flags
  3276. +# 0~Long filename support 1~2.x protected mode 4~2.x proportional fonts 8~Executable has gangload area
  3277. +#>>>(0x3c.l+0x37) byte !0 \b, OS2EXEFlags 0x%x
  3278. +# retThunkOffset; offset to return thunks or start of gangload area like: 0 34h 58h 246h
  3279. +#>>>(0x3c.l+0x38) uleshort !0 \b, retThunkOffset 0x%x
  3280. +# segrefthunksoff; offset to segment reference thunks or size of gangload area
  3281. +# like: 0 33Eh 39Ah AEEh
  3282. +#>>>(0x3c.l+0x3A) uleshort !0 \b, segrefthunksoff 0x%x
  3283. +# mincodeswap; minimum code swap area size like 0 620Ch
  3284. +#>>>(0x3c.l+0x3C) uleshort !0 \b, mincodeswap 0x%x
  3285. >>>(0x3c.l+0x0c) leshort&0x8000 0x8000 (DLL or font)
  3286. # DRV: Driver
  3287. # 3GR: Grabber device driver
  3288. # CPL: Control Panel Item
  3289. -# VBX: Visual Basic Extension
  3290. -# FON: Bitmap font
  3291. +# VBX: Visual Basic Extension https://en.wikipedia.org/wiki/Visual_Basic
  3292. +# FON: Bitmap font http://fileformats.archiveteam.org/wiki/FON
  3293. # FOT: Font resource file
  3294. +# EXE: WINSPOOL.EXE USER.EXE krnl386.exe GDI.EXE
  3295. +# CNV: Microsoft Word text conversion https://www.file-extensions.org/cnv-file-extension-microsoft-word-text-conversion-data
  3296. !:ext dll/drv/3gr/cpl/vbx/fon/fot
  3297. >>>(0x3c.l+0x0c) leshort&0x8000 0 (EXE)
  3298. !:ext exe/scr
  3299. @@ -228,8 +480,17 @@
  3300. >>>&(&0x54.l-3) string arjsfx \b, ARJ self-extracting archive
  3301. # MS Windows system file, supposedly a collection of LE executables
  3302. +# like vmm32.vxd WIN386.EXE
  3303. >>(0x3c.l) string W3 \b, W3 for MS Windows
  3304. -!:mime application/x-dosexec
  3305. +#!:mime application/x-dosexec
  3306. +!:mime application/x-ms-w3-executable
  3307. +!:ext vxd/exe
  3308. +# W4 executable
  3309. +>>(0x3c.l) string W4 \b, W4 for MS Windows
  3310. +#!:mime application/x-dosexec
  3311. +!:mime application/x-ms-w4-executable
  3312. +# windows 98 VMM32.VXD
  3313. +!:ext vxd
  3314. >>(0x3c.l) string LE\0\0 \b, LE executable
  3315. !:mime application/x-dosexec
  3316. @@ -268,11 +529,19 @@
  3317. !:ext exe/com
  3318. # header data too small for extended executable
  3319. >2 long !0
  3320. ->>0x18 leshort <0x40
  3321. +>>0x18 uleshort <0x40
  3322. >>>(4.s*512) leshort !0x014c
  3323. >>>>&(2.s-514) string !LE
  3324. ->>>>>&-2 string !BW \b, MZ for MS-DOS
  3325. +>>>>>&-2 string !BW
  3326. +#>>>>>>(0x3c.l) string x \b, 2ND MAGIC %.2s
  3327. +# but some LX executable appear here also like: PCISCAN.EXE
  3328. +>>>>>>(0x3c.l) string !LX
  3329. +# because Portable Executable (PE) already done skip many here like:
  3330. +# xcopy32.exe stinger64.exe WimUtil.exe
  3331. +# NO such DOS examples found and
  3332. +# DOS examples seems to be already handled by e_lfarlc <0x40 like: CMD8086.COM CMD-FR.COM
  3333. +>>>>>>>(0x3c.l) string !PE \b, MZ for MS-DOS
  3334. !:mime application/x-dosexec
  3335. >>>>&(2.s-514) string LE \b, LE
  3336. >>>>>0x240 search/0x100 DOS/4G for MS-DOS, DOS4GW DOS extender
  3337. @@ -386,6 +655,7 @@
  3338. >0x00 uleshort x executable
  3339. #!:mime application/x-msdownload
  3340. !:mime application/x-lx-executable
  3341. +!:ext exe
  3342. # byte order: 00h~little-endian non-zero=1~big-endian
  3343. #>0x02 ubyte =0 (little-endian)
  3344. >0x02 ubyte !0 (big-endian)
  3345. @@ -420,7 +690,7 @@
  3346. >0x0a leshort 3 for DOS
  3347. # http://www.ctyme.com/intr/rb-2939.htm#Table1610
  3348. # library by module type mask 00038000h (bits 15-17);
  3349. -# 0h ~exectable Program module
  3350. +# 0h ~executable Program module
  3351. >0x10 ulelong&0x00038000 =0x00000000 (program)
  3352. #!:ext exe
  3353. # OSF_IS_DLL=8000h ~Library module (DLL)
  3354. @@ -602,11 +872,11 @@
  3355. 0 name msdos-com
  3356. # URL: http://fileformats.archiveteam.org/wiki/DOS_executable_(.com)
  3357. >0 byte x DOS executable (
  3358. -# DOS execuable with JuMP 16-bit instruction
  3359. +# DOS executable with JuMP 16-bit instruction
  3360. >0 byte =0xE9
  3361. # check for probably nil padding til offset 64 of Lotus driver name
  3362. >>56 quad =0
  3363. -# check for "long" alpabetical Lotus driver name like:
  3364. +# check for "long" alphabetic Lotus driver name like:
  3365. # Diablo "COMPAQ Text Display" "IBM Monochrome Display" "Plantronics ColorPlus"
  3366. >>>24 regex =^[A-Z][A-Za-z\040]{5,21} \bLotus driver) %s
  3367. !:mime application/x-dosexec
  3368. @@ -616,7 +886,7 @@
  3369. >>>24 default x \bCOM)
  3370. !:mime application/x-dosexec
  3371. !:ext com
  3372. -# DOS excutable with JuMP 16-bit and without nil padding
  3373. +# DOS executable with JuMP 16-bit and without nil padding
  3374. >>56 quad !0
  3375. # https://wiki.syslinux.org/wiki/index.php?title=Doc/comboot
  3376. # TODO: HOWTO distinguish COMboot from pure DOS executables?
  3377. @@ -781,7 +1051,7 @@
  3378. >>1 default x
  3379. # look for interrupt instruction like in rem.com (DJGPP) LOADER.COM (DR-DOS 7.x)
  3380. >>>3 search/118 \xCD
  3381. -# FOR DEBUGGING; possible hexadecimal interupt number like: 10~BANNER.COM 13~bcdw_cl.com 15~poweroff.com (Syslinux)
  3382. +# FOR DEBUGGING; possible hexadecimal interrupt number like: 10~BANNER.COM 13~bcdw_cl.com 15~poweroff.com (Syslinux)
  3383. # 1A~BERNDPCI.COM 20~SETENHKB.COM 21~mostly 22~gfxboot.com (Syslinux) 2F~SHUTDOWN.COM (GEMSYS)
  3384. #>>>>&0 ubyte x \b, INTERUPT %#x
  3385. # few examples with interrupt 0x13 instruction
  3386. @@ -791,7 +1061,7 @@
  3387. # skip Gpt.com Mbr.com (edk2-UDK2018 bootsector) described as "DOS/MBR boot sector" by ./filesystems
  3388. # by check for assembler instructions: mov es,ax ; mov ax,07c0h ; mov ds,ax
  3389. >>>>>3 ubequad !0x8ec0b8c0078ed88d
  3390. -# few COM exectables with interrupt 0x13 instruction like: Bootable CD Wizard executables bcdw_cl.com fdemuoff.com
  3391. +# few COM executables with interrupt 0x13 instruction like: Bootable CD Wizard executables bcdw_cl.com fdemuoff.com
  3392. # http://bootcd.narod.ru/bcdw150z_en.zip
  3393. >>>>>>0 use msdos-com
  3394. # few examples with interrupt 0x16 instruction like flashimg.img
  3395. @@ -806,7 +1076,7 @@
  3396. #>>>>>&-1 ubyte x \b, INTERUPT %#x
  3397. # like: LOADER.COM SETENHKB.COM banner.com copybs.com gif2raw.com poweroff.com rem.com
  3398. >>>>>0 use msdos-com
  3399. -# few COM executables without interupt instruction like RESTART.COM (DOS 7.10) REBOOT.COM
  3400. +# few COM executables without interrupt instruction like RESTART.COM (DOS 7.10) REBOOT.COM
  3401. # or some EUC-KR text files or one Ulead Imaginfo thumbnail
  3402. >>>3 default x
  3403. # FOR DEBUGGING; 2nd instruction like 0x50 (RESTART.COM) 0x8e (REBOOT.COM)
  3404. @@ -1575,6 +1845,12 @@
  3405. >0x2c default x
  3406. # look for 1st member name
  3407. >>(16.l+16) ubyte x
  3408. +# From: Joerg Jenderek
  3409. +# URL: https://docs.microsoft.com/en-us/windows-hardware/drivers/install/building-device-metadata-packages
  3410. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/devicemetadata-ms.trid.xml
  3411. +>>>&-1 string PackageInfo.xml \b, Device Metadata Package
  3412. +!:mime application/vnd.ms-cab-compressed
  3413. +!:ext devicemetadata-ms
  3414. # https://en.wikipedia.org/wiki/SNP_file_format
  3415. >>>&-1 string/c _accrpt_.snp \b, Access report snapshot
  3416. !:mime application/msaccess
  3417. --- a/magic/Magdir/ole2compounddocs
  3418. +++ b/magic/Magdir/ole2compounddocs
  3419. @@ -1,6 +1,6 @@
  3420. #------------------------------------------------------------------------------
  3421. -# $File: ole2compounddocs,v 1.19 2022/09/11 20:52:40 christos Exp $
  3422. +# $File: ole2compounddocs,v 1.22 2022/12/09 15:56:56 christos Exp $
  3423. # Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
  3424. # storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
  3425. # Additional tests for OLE 2 Compound Documents should be under this recipe.
  3426. @@ -72,6 +72,7 @@
  3427. #>67 ubyte x \b, color %x
  3428. # the DirIDs of the child nodes. Should both be -1 in the root storage entry
  3429. #>68 bequad !0xffffffffffffffff \b, DirIDs %llx
  3430. +# NEXT lines for DEBUGGING
  3431. # second directory entry name like VisioDocument Control000
  3432. #>128 lestring16 x \b, 2nd %.20s
  3433. # third directory entry like WordDocument
  3434. @@ -201,6 +202,18 @@
  3435. !:ext nfo
  3436. #
  3437. # From: Joerg Jenderek
  3438. +# URL: https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  3439. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/arn-autoruns-v14.trid.xml
  3440. +# Note: older versions til 13 about middle 2021 handled by ./windows
  3441. +# called "Sysinternals Autoruns data (v14)" by TrID
  3442. +# second, third and fourth directory entry name like Header Items 0
  3443. +>>>>128 lestring16 Header : Microsoft sysinternals AutoRuns data, version 14
  3444. +#!:mime application/x-ole-storage
  3445. +!:mime application/x-ms-arn
  3446. +# like: MyHOSTNAME.arn
  3447. +!:ext arn
  3448. +#
  3449. +# From: Joerg Jenderek
  3450. # URL: https://en.wikipedia.org/wiki/Microsoft_Access
  3451. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/m/mdz.trid.xml
  3452. # http://fileformats.archiveteam.org/wiki/Microsoft_Compound_File
  3453. @@ -305,62 +318,59 @@
  3454. # THIS WORKS PARTLY!
  3455. >>>>>>&0 indirect x
  3456. # remaining null clsid
  3457. ->>>>128 default x : UNKNOWN
  3458. -# second directory entry name like VisioDocument Control000
  3459. ->>>>>128 lestring16 x with names %.20s
  3460. -# third directory entry like WordDocument
  3461. ->>>>>256 lestring16 x %.20s
  3462. -# forth
  3463. ->>>>>384 lestring16 x %.20s
  3464. -!:mime application/x-ole-storage
  3465. -# according to file version 5.41 with -e soft option
  3466. -#!:mime application/CDFV2
  3467. -#!:ext ???
  3468. +>>>>128 default x
  3469. +>>>>>0 use ole2-unknown
  3470. # look for known clsid GUID
  3471. # - Visio documents
  3472. # URL: http://fileformats.archiveteam.org/wiki/Visio
  3473. # Last update on 10/23/2006 by Lester Hightower, 07/20/2019 by Joerg Jenderek
  3474. ->>88 ubequad 0xc000000000000046 : Microsoft
  3475. ->>>80 ubequad 0x131a020000000000 Visio 2000-2002 Document, stencil or template
  3476. +>>88 ubequad 0xc000000000000046
  3477. +>>>80 ubequad 0x131a020000000000 : Microsoft Visio 2000-2002 Document, stencil or template
  3478. !:mime application/vnd.visio
  3479. # VSD~Drawing VSS~Stencil VST~Template
  3480. !:ext vsd/vss/vst
  3481. ->>>80 ubequad 0x141a020000000000 Visio 2003-2010 Document, stencil or template
  3482. +>>>80 ubequad 0x141a020000000000 : Microsoft Visio 2003-2010 Document, stencil or template
  3483. !:mime application/vnd.visio
  3484. !:ext vsd/vss/vst
  3485. #
  3486. # URL: http://fileformats.archiveteam.org/wiki/Windows_Installer
  3487. ->>>80 ubequad 0x84100c0000000000 Windows Installer Package
  3488. +# https://en.wikipedia.org/wiki/Windows_Installer#ICE_validation
  3489. +# Update: Joerg Jenderek
  3490. +# Windows Installer Package *.MSI or validation module *.CUB
  3491. +>>>80 ubequad 0x84100c0000000000 : Microsoft Windows Installer Package or validation module
  3492. !:mime application/x-msi
  3493. #!:mime application/x-ms-win-installer
  3494. -!:ext msi
  3495. ->>>80 ubequad 0x86100c0000000000 Windows Installer Patch
  3496. +# https://learn.microsoft.com/en-us/windows/win32/msi/internal-consistency-evaluators-ices
  3497. +# cub is used for validation module like: Vstalogo.cub XPlogo.cub darice.cub logo.cub mergemod.cub
  3498. +#!:mime application/x-ms-cub
  3499. +!:ext msi/cub
  3500. +>>>80 ubequad 0x86100c0000000000 : Microsoft Windows Installer Patch
  3501. # ??
  3502. !:mime application/x-wine-extension-msp
  3503. #!:mime application/x-ms-msp
  3504. !:ext msp
  3505. #
  3506. # URL: http://fileformats.archiveteam.org/wiki/DOC
  3507. ->>>80 ubequad 0x0009020000000000 Word 6-95 document or template
  3508. +>>>80 ubequad 0x0009020000000000 : Microsoft Word 6-95 document or template
  3509. !:mime application/msword
  3510. # for template MSWDW8TN
  3511. !:apple MSWDWDBN
  3512. !:ext doc/dot
  3513. ->>>80 ubequad 0x0609020000000000 Word 97-2003 document or template
  3514. +>>>80 ubequad 0x0609020000000000 : Microsoft Word 97-2003 document or template
  3515. !:mime application/msword
  3516. !:apple MSWDWDBN
  3517. # dot for template; no extension on Macintosh
  3518. !:ext doc/dot/
  3519. #
  3520. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Word_Processor
  3521. ->>>80 ubequad 0x0213020000000000 Works 3-4 document or template
  3522. +>>>80 ubequad 0x0213020000000000 : Microsoft Works 3-4 document or template
  3523. !:mime application/vnd.ms-works
  3524. !:apple ????AWWP
  3525. # ps for template https://filext.com/file-extension/PS bps for backup
  3526. !:ext wps/ps/bps
  3527. #
  3528. # URL: http://fileformats.archiveteam.org/wiki/Microsoft_Works_Database
  3529. ->>>80 ubequad 0x0313020000000000 Works 3-4 database or template
  3530. +>>>80 ubequad 0x0313020000000000 : Microsoft Works 3-4 database or template
  3531. !:mime application/vnd.ms-works-db
  3532. # https://www.macdisk.com/macsigen.php
  3533. !:apple ????AWDB
  3534. @@ -368,14 +378,14 @@
  3535. !:ext wdb/db/bdb
  3536. #
  3537. # URL: https://en.wikipedia.org/wiki/Microsoft_Excel
  3538. ->>>80 ubequad 0x1008020000000000 Excel 5-95 worksheet, addin or template
  3539. +>>>80 ubequad 0x1008020000000000 : Microsoft Excel 5-95 worksheet, addin or template
  3540. !:mime application/vnd.ms-excel
  3541. # https://www.macdisk.com/macsigen.php
  3542. !:apple ????XLS5
  3543. # worksheet/addin/template/no extension on Macintosh
  3544. !:ext xls/xla/xlt/
  3545. #
  3546. ->>>80 ubequad 0x2008020000000000 Excel 97-2003
  3547. +>>>80 ubequad 0x2008020000000000 : Microsoft Excel 97-2003
  3548. !:mime application/vnd.ms-excel
  3549. # https://www.macdisk.com/macsigen.php XLS5 for Excel 5
  3550. !:apple ????XLS9
  3551. @@ -391,23 +401,36 @@
  3552. #!:ext xls/xlt/
  3553. #
  3554. # URL: http://fileformats.archiveteam.org/wiki/OLE2
  3555. ->>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 item
  3556. -#>>>80 ubequad 0x0b0d020000000000 Outlook 97-2003 Message
  3557. +>>>80 ubequad 0x0b0d020000000000 : Microsoft Outlook 97-2003 item
  3558. +#>>>80 ubequad 0x0b0d020000000000 : Microsoft Outlook 97-2003 Message
  3559. #!:mime application/vnd.ms-outlook
  3560. !:mime application/x-ms-msg
  3561. !:ext msg
  3562. # URL: https://wiki.fileformat.com/email/oft/
  3563. ->>>80 ubequad 0x46f0060000000000 Outlook 97-2003 item template
  3564. +>>>80 ubequad 0x46f0060000000000 : Microsoft Outlook 97-2003 item template
  3565. #!:mime application/vnd.ms-outlook
  3566. !:mime application/x-ms-oft
  3567. !:ext oft
  3568. #
  3569. # URL: http://fileformats.archiveteam.org/wiki/PPT
  3570. ->>>80 ubequad 0x5148040000000000 PowerPoint 4.0 presentation
  3571. +>>>80 ubequad 0x5148040000000000 : Microsoft PowerPoint 4.0 presentation
  3572. !:mime application/vnd.ms-powerpoint
  3573. # https://www.macdisk.com/macsigen.php
  3574. !:apple ????PPT3
  3575. !:ext ppt
  3576. +# Summary: "newer" Greenstreet Art drawing
  3577. +# From: Joerg Jenderek
  3578. +# URL: http://fileformats.archiveteam.org/wiki/GST_ART
  3579. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/a/art-gst-docfile.trid.xml
  3580. +# Note: called like "Greenstreet Art drawing" by TrID
  3581. +# Note: CONTENT stream contains binary part of older versions with phrase GST:ART at offset 16
  3582. +# verified by Michal Mutl Structured Storage Viewer `SSView.exe BCARD2.ART`
  3583. +>>>80 ubequad 0x602c020000000000 : Greenstreet Art drawing
  3584. +#!:mime application/x-ole-storage
  3585. +!:mime image/x-greenstreet-art
  3586. +!:ext art
  3587. +>>>80 default x
  3588. +>>>>0 use ole2-unknown
  3589. #??
  3590. # URL: http://www.checkfilename.com/view-details/Microsoft-Works/RespageIndex/0/sTab/2/
  3591. >>88 ubequad 0xa29a00aa004a1a72 : Microsoft
  3592. @@ -661,13 +684,28 @@
  3593. #!:ext max/chr
  3594. # remaining non null clsid
  3595. >>88 default x
  3596. -# GRR: check again for non null clsid because wrong when called by indirect directive
  3597. ->>>88 ubequad !0 : UNKNOWN
  3598. +>>>0 use ole2-unknown
  3599. +# display information about directory for not detected CDF files
  3600. +0 name ole2-unknown
  3601. +>80 ubequad x : UNKNOWN
  3602. # https://reposcope.com/mimetype/application/x-ole-storage
  3603. !:mime application/x-ole-storage
  3604. # according to file version 5.41 with -e soft option
  3605. #!:mime application/CDFV2
  3606. #!:ext ???
  3607. ->>>>80 ubequad !0 \b, clsid %#16.16llx
  3608. ->>>>88 ubequad x \b%16.16llx
  3609. -
  3610. +>80 ubequad !0 \b, clsid %#16.16llx
  3611. +>>88 ubequad x \b%16.16llx
  3612. +# converted hexadecimal format to standard GUUID notation
  3613. +>>80 guid x {%s}
  3614. +# second directory entry name like VisioDocument Control000
  3615. +>128 lestring16 x with names %.20s
  3616. +# third directory entry like WordDocument Preview.dib
  3617. +>256 lestring16 x %.20s
  3618. +# forth like \005SummaryInformation
  3619. +>384 lestring16 x %.25s
  3620. +# 5th
  3621. +>512 lestring16 x %.10s
  3622. +# 6th
  3623. +>640 lestring16 x %.10s
  3624. +# 7th
  3625. +>768 lestring16 x %.10s
  3626. --- /dev/null
  3627. +++ b/magic/Magdir/playdate
  3628. @@ -0,0 +1,57 @@
  3629. +
  3630. +#------------------------------------------------------------------------------
  3631. +# $File: playdate,v 1.1 2022/11/04 13:34:48 christos Exp $
  3632. +#
  3633. +# Various native file formats for the Playdate portable video game console.
  3634. +#
  3635. +# These are unofficially documented at
  3636. +# https://github.com/jaames/playdate-reverse-engineering
  3637. +#
  3638. +# The SDK is a source for many test files, and can be used to
  3639. +# create others. https://play.date/dev/
  3640. +
  3641. +
  3642. +# pdi: static image
  3643. +0 string Playdate\ IMG Playdate image data
  3644. +>12 belong&0x80 0x80 (compressed)
  3645. +>>20 lelong x %d x
  3646. +>>24 lelong x %d
  3647. +>12 belong&0x80 0x00 (uncompressed)
  3648. +>>16 leshort x %d x
  3649. +>>18 leshort x %d
  3650. +
  3651. +# pdt: multiple static images
  3652. +0 string Playdate\ IMT Playdate image data set
  3653. +>12 belong&0x80 0x80 (compressed)
  3654. +>>20 lelong x %d x
  3655. +>>24 lelong x %d,
  3656. +>>28 lelong x %d cells
  3657. +>12 belong&0x80 0x00 (uncompressed)
  3658. +>>20 lelong x tile grid %d x
  3659. +>>24 lelong x %d
  3660. +
  3661. +# pds: string tables
  3662. +0 string Playdate\ STR Playdate localization strings
  3663. +>12 belong&0x80 0x80 (compressed)
  3664. +>12 belong&0x80 0x00 (uncompressed)
  3665. +
  3666. +# pda: audio
  3667. +0 string Playdate\ AUD Playdate audio file
  3668. +>12 lelong&0xffffff x %d Hz,
  3669. +>15 byte 0 unsigned, 8-bit PCM, 1 channel
  3670. +>15 byte 1 unsigned, 8-bit PCM, 2 channel
  3671. +>15 byte 2 signed, 16-bit little-endian PCM, 1 channel
  3672. +>15 byte 3 signed, 16-bit little-endian PCM, 1 channel
  3673. +>15 byte 4 4-bit ADPCM, 1 channel
  3674. +>15 byte 5 4-bit ADPCM, 2 channel
  3675. +
  3676. +# pda: video
  3677. +0 string Playdate\ VID Playdate video file
  3678. +>24 leshort x %d x
  3679. +>26 leshort x %d,
  3680. +>16 leshort x %d frames,
  3681. +>20 lefloat x %.2f FPS
  3682. +
  3683. +# pdz: executable package
  3684. +# Not a lot we can do, as it's a stream of entries with no summary information.
  3685. +0 string Playdate\ PDZ Playdate executable package
  3686. --- a/magic/Magdir/printer
  3687. +++ b/magic/Magdir/printer
  3688. @@ -1,6 +1,6 @@
  3689. #------------------------------------------------------------------------------
  3690. -# $File: printer,v 1.29 2019/04/19 00:42:27 christos Exp $
  3691. +# $File: printer,v 1.31 2022/12/18 14:50:43 christos Exp $
  3692. # printer: file(1) magic for printer-formatted files
  3693. #
  3694. @@ -45,6 +45,8 @@
  3695. #
  3696. 0 string *PPD-Adobe:\x20 PPD file
  3697. >&0 string x \b, version %s
  3698. +!:ext ppd
  3699. +!:mime application/vnd.cups-ppd
  3700. # HP Printer Job Language
  3701. 0 string \033%-12345X@PJL HP Printer Job Language data
  3702. @@ -148,3 +150,82 @@
  3703. # From: Paolo <oopla@users.sf.net>
  3704. # Epson ESC/Page, ESC/PageColor
  3705. 0 string \x1b\x01@EJL Epson ESC/Page language printer data
  3706. +
  3707. +# Summary: Hewlett-Packard Graphics Language
  3708. +# From: Joerg Jenderek
  3709. +# URL: http://fileformats.archiveteam.org/wiki/HP-GL
  3710. +# https://en.wikipedia.org/wiki/HPGL
  3711. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hpg.trid.xml
  3712. +# Note: called "Hewlett-Packard Graphics Language" by TrID and
  3713. +# "Hewlett Packard Graphics Language" by DROID via PUID x-fmt/293 and
  3714. +# HPGL by XnView command `nconvert -info *`
  3715. +# initialize, start a plotting job
  3716. +0 string IN;
  3717. +>0 use hpgl
  3718. +# fill.plt
  3719. +0 string INPS
  3720. +>0 use hpgl
  3721. +# http://ftp.funet.fi/index/graphics/packages/hpgl2ps/hpgl2ps.tar.Z/hpgl2ps/test1.hpgl
  3722. +0 string DF;
  3723. +>0 use hpgl
  3724. +# http://ftp.funet.fi/index/graphics/packages/hpgl2ps/hpgl2ps.tar.Z/hpgl2ps/test3.hpgl
  3725. +# Select Pen n
  3726. +0 string SP
  3727. +>0 use hpgl
  3728. +# charsize.hp pages.hp set the scaling points (P1 and P2) to their default positions
  3729. +0 string IP0
  3730. +>0 use hpgl
  3731. +# ci.hp
  3732. +0 string CO\040
  3733. +>0 use hpgl
  3734. +# iw.hp 286x192.5_lh.hpg 286x192.5_lq.hpg
  3735. +0 string PS\040
  3736. +>0 use hpgl
  3737. +# thick.hp
  3738. +0 string PS9
  3739. +>0 use hpgl
  3740. +# ul.hp
  3741. +0 string PS4
  3742. +>0 use hpgl
  3743. +# la.hp
  3744. +0 string BP
  3745. +>0 use hpgl
  3746. +# miter.hp
  3747. +0 string PA
  3748. +>0 use hpgl
  3749. +# pw.hpg number of pens x
  3750. +0 string NP
  3751. +>0 use hpgl
  3752. +# win_1.hp
  3753. +#0 string \003INCA WHAT_IS_THAT
  3754. +#>0 use hpgl
  3755. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/h/hpgl2.trid.xml
  3756. +# Note: called "Hewlett-Packard Graphics Language 2" by TrID
  3757. +0 string \033%-1B Hewlett-Packard Graphics Language 2
  3758. +!:mime application/vnd.hp-HPGL
  3759. +# like: dt.plt
  3760. +!:ext plt
  3761. +#!:ext plt/gl2/hpg2/spl
  3762. +# remaining part after escsape sequnce
  3763. +>5 string x with "%-.10s"
  3764. +# display Hewlett-Packard Graphics Language vector graphic information
  3765. +0 name hpgl
  3766. +>0 string x Hewlett-Packard Graphics Language
  3767. +#!:mime vector/x-hpgl
  3768. +# https://www.iana.org/assignments/media-types/application/vnd.hp-HPGL
  3769. +!:mime application/vnd.hp-HPGL
  3770. +# no example with HPL suffix found
  3771. +!:ext hpgl/hpg/hp/plt
  3772. +# like: "IN;" "DF;IN;LT;PU1000,1000;PD2000,10" "SP6;DI0,1;SR0.70,1.90;SC0,800,"
  3773. +# "CO Concentric circles drawn with different linewidths;"
  3774. +>0 string x \b, starting with "%-.54s"
  3775. +# continue but not for 1 long line without CR or LF
  3776. +>>&0 ubyte <0x0E
  3777. +#>>&0 ubyte <0x0E TERMINATOR=%x
  3778. +# second line after 1 terminator character
  3779. +>>>&0 string >\r with "%-.10s"
  3780. +# next character again CR or LF
  3781. +>>>&0 ubyte <0x0E
  3782. +#>>>&0 ubyte <0x0E 2ND_CHARACTER=%x
  3783. +# second line after 2 terminator characters
  3784. +>>>>&0 string >\r with "%-.10s"
  3785. --- a/magic/Magdir/qt
  3786. +++ b/magic/Magdir/qt
  3787. @@ -1,6 +1,6 @@
  3788. #------------------------------------------------------------------------------
  3789. -# $File: qt,v 1.3 2019/04/19 00:42:27 christos Exp $
  3790. +# $File: qt,v 1.4 2022/11/11 14:50:23 christos Exp $
  3791. # qt: file(1) magic for Qt
  3792. # https://doc.qt.io/qt-5/resources.html
  3793. @@ -17,3 +17,14 @@
  3794. # src/corelib/kernel/qtranslator.cpp#L62
  3795. 0 string \x3c\xb8\x64\x18\xca\xef\x9c\x95
  3796. >8 string \xcd\x21\x1c\xbf\x60\xa1\xbd\xdd Qt Translation file
  3797. +
  3798. +
  3799. +# Qt V4 Javascript engine compiled unit
  3800. +# From: Alexandre Iooss <erdnaxe@crans.org>
  3801. +# URL: https://github.com/qt/qtdeclarative/blob/v6.4.0/src/qml/common/qv4compileddata_p.h
  3802. +0 string qv4cdata QV4 compiled unit
  3803. +!:ext qmlc
  3804. +>8 ulelong x \b, version %d
  3805. +>12 byte x \b, Qt %d
  3806. +>13 byte x \b.%d
  3807. +>14 byte x \b.%d
  3808. --- /dev/null
  3809. +++ b/magic/Magdir/rust
  3810. @@ -0,0 +1,21 @@
  3811. +
  3812. +#------------------------------------------------------------------------------
  3813. +# $File: rust,v 1.2 2022/11/18 15:58:15 christos Exp $
  3814. +# Magic for Rust and related languages programs
  3815. +#
  3816. +
  3817. +# Rust compiler metadata
  3818. +# From: Alexandre Iooss <erdnaxe@crans.org>
  3819. +# URL: https://github.com/rust-lang/rust/blob/1.64.0/compiler/rustc_metadata/src/rmeta/mod.rs
  3820. +0 string rust\x00\x00\x00
  3821. +>12 string \014rustc\x20 Rust compiler metadata
  3822. +!:ext rmeta
  3823. +>>7 byte x \b, version %d
  3824. +
  3825. +# Rust incremental compilation metadata
  3826. +# From: Alexandre Iooss <erdnaxe@crans.org>
  3827. +# URL: https://github.com/rust-lang/rust/blob/1.64.0/compiler/rustc_incremental/src/persist/file_format.rs
  3828. +0 string RSIC
  3829. +>4 uleshort =0 Rust incremental compilation metadata
  3830. +!:ext bin
  3831. +>>6 pstring x \b, rustc %s
  3832. --- a/magic/Magdir/sendmail
  3833. +++ b/magic/Magdir/sendmail
  3834. @@ -1,6 +1,6 @@
  3835. #------------------------------------------------------------------------------
  3836. -# $File: sendmail,v 1.11 2019/04/19 00:42:27 christos Exp $
  3837. +# $File: sendmail,v 1.12 2022/10/31 13:22:26 christos Exp $
  3838. # sendmail: file(1) magic for sendmail config files
  3839. #
  3840. # XXX - byte order?
  3841. @@ -13,7 +13,7 @@
  3842. # - version \330jK\354
  3843. 0 byte 046
  3844. # https://www.sendmail.com/sm/open_source/docs/older_release_notes/
  3845. -# freezed configuration file (dbm format?) created from sendmal.cf with -bz
  3846. +# freezed configuration file (dbm format?) created from sendmail.cf with -bz
  3847. # by older sendmail. til version 8.6 support for frozen configuration files is removed
  3848. # valid version numbers look like "7.14.4" and should be similar to output of commands
  3849. # "sendmail -d0 -bt < /dev/null |grep -i Version" or "egrep '^DZ' /etc/sendmail.cf"
  3850. --- a/magic/Magdir/sniffer
  3851. +++ b/magic/Magdir/sniffer
  3852. @@ -1,6 +1,6 @@
  3853. #------------------------------------------------------------------------------
  3854. -# $File: sniffer,v 1.32 2022/07/30 16:46:56 christos Exp $
  3855. +# $File: sniffer,v 1.34 2022/12/14 18:27:36 christos Exp $
  3856. # sniffer: file(1) magic for packet capture files
  3857. #
  3858. # From: guy@alum.mit.edu (Guy Harris)
  3859. @@ -327,14 +327,79 @@
  3860. #
  3861. # Novell LANalyzer capture files.
  3862. -#
  3863. -0 leshort 0x1001 Novell LANalyzer capture file
  3864. -0 leshort 0x1007 Novell LANalyzer capture file
  3865. +# URL: http://www.blacksheepnetworks.com/security/info/nw/lan/trace.txt
  3866. +# Reference: https://github.com/wireshark/wireshark/blob/master/wiretap/lanalyzer.c
  3867. +# Update: Joerg Jenderek
  3868. +#
  3869. +# regular trace header record (RT_HeaderRegular)
  3870. +0 leshort 0x1001
  3871. +# GRR: line above is too generic because it matches Commodore Plus/4 BASIC V3.5
  3872. +# and VIC-20 BASIC V2 program
  3873. +# skip many Commodore Basic program (Microzodiac.prg Minefield.prg Vic-tac-toe.prg breakvic_joy.prg)
  3874. +# with invalid second record type 0 instead of "Trace receive channel name record"
  3875. +>(2.s+4) leshort =0x1006h
  3876. +>>0 use novell-lanalyzer
  3877. +# cyclic trace header record (RT_HeaderCyclic)
  3878. +0 leshort 0x1007
  3879. +>0 use novell-lanalyzer
  3880. +0 name novell-lanalyzer
  3881. +>0 leshort x Novell LANalyzer capture file
  3882. +# https://reposcope.com/mimetype/application/x-lanalyzer
  3883. +!:mime application/x-lanalyzer
  3884. +# maybe also TR2 .. TR9 TRA .. TRZ
  3885. +!:ext tr1
  3886. +# version like: 1.5
  3887. +>4 ubyte x \b, version %u
  3888. +# minor version; one byte identifying the trace file minor version number
  3889. +>5 ubyte x \b.%u
  3890. +# Trace header record type like: 1001~regular or 1007~cyclic
  3891. +>0 leshort !0x1001 \b, record type %4.4x
  3892. +# record_length[2] is the length of the data part of 1st reorcd (without "type" and "length" fields) like: 4Ch
  3893. +>2 leshort x \b, record length %#x
  3894. +# second record type like: 1006h~Trace receive channel name record
  3895. +>(2.s+4) leshort !0x1006h \b, 2nd record type %#4.4x
  3896. +>(2.s+6) leshort x \b, 2nd record length %#x
  3897. +# each channel name is a null-terminated, eight-byte ASCII string like: Channel1
  3898. +>(2.s+8) string x \b, names %.9s
  3899. +# 2nd channel name like: Channel2
  3900. +>(2.s+17) string x %.9s ...
  3901. #
  3902. # HP-UX "nettl" capture files.
  3903. -#
  3904. +# URL: https://nixdoc.net/man-pages/HP-UX/man1m/nettl.1m.html
  3905. +# Reference: https://github.com/wireshark/wireshark/blob/master/wiretap/nettl.c
  3906. +# Update: Joerg Jenderek
  3907. +# Note: Wireshark fills "meta information header fields" with "dummy" values
  3908. +# nettl_magic_hpux9[12]; for HP-UX 9.x not tested
  3909. +0 string \x00\x00\x00\x01\x00\x00\x00\x00\x00\x07\xD0\x00 HP/UX 9.x nettl capture file
  3910. +!:mime application/x-nettl
  3911. +!:ext trc0/trc1
  3912. +# nettl_magic_hpux10[12]; for HP-UX 10.x and 11.x
  3913. 0 string \x54\x52\x00\x64\x00 HP/UX nettl capture file
  3914. +# https://reposcope.com/mimetype/application/x-nettl
  3915. +!:mime application/x-nettl
  3916. +# maybe also TRC000 TRC001 TRC002 ...
  3917. +!:ext trc0/trc1
  3918. +# file_name[56]; maybe also like /tmp/raw.tr.TRC000
  3919. +>12 string !/tmp/wireshark.TRC000
  3920. +>>12 string x "%-.56s"
  3921. +# tz[20]; like UTC
  3922. +>68 string !UTC \b, tz
  3923. +>>68 string x %-.20s
  3924. +# host_name[9];
  3925. +>88 string >\0 \b, host %-.9s
  3926. +# os_vers[9]; like B.11.11
  3927. +>97 string !B.11.11 \b, os
  3928. +>>97 string x %-.9s
  3929. +# os_v; like 55h
  3930. +>>106 ubyte x (%#x)
  3931. +# xxa[8]; like 0
  3932. +>107 ubequad !0 \b, xxa=%#16.16llx
  3933. +# model[11] like: 9000/800
  3934. +>115 string !9000/800 \b, model
  3935. +>>115 string x %-.11s
  3936. +# unknown; probably just padding to 128 bytes like: 0406h
  3937. +>126 ubeshort !0x0406h \b, at 126 %#4.4x
  3938. #
  3939. # RADCOM WAN/LAN Analyzer capture files.
  3940. --- a/magic/Magdir/softquad
  3941. +++ b/magic/Magdir/softquad
  3942. @@ -1,7 +1,8 @@
  3943. #------------------------------------------------------------------------------
  3944. -# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
  3945. +# $File: softquad,v 1.14 2022/10/28 17:19:54 christos Exp $
  3946. # softquad: file(1) magic for SoftQuad Publishing Software
  3947. +# URL: https://en.wikipedia.org/wiki/SoftQuad_Software
  3948. #
  3949. # Author/Editor and RulesBuilder
  3950. #
  3951. @@ -17,8 +18,10 @@
  3952. 0 short 0xc0da Compiled PSI (v2) data
  3953. >3 string >\0 (%s)
  3954. # Binary sqtroff font/desc files...
  3955. -0 short 0125252 SoftQuad DESC or font file binary
  3956. ->2 short >0 - version %d
  3957. +# GRR: the line below is also true for 5View capture file handled by ./sniffer
  3958. +0 short 0125252
  3959. +# skip 5View capture file with "invalid" version AAAAh
  3960. +>2 short >0 SoftQuad DESC or font file binary - version %d
  3961. # Bitmaps...
  3962. 0 search/1 SQ\ BITMAP1 SoftQuad Raster Format text
  3963. #0 string SQ\ BITMAP2 SoftQuad Raster Format data
  3964. --- a/magic/Magdir/sysex
  3965. +++ b/magic/Magdir/sysex
  3966. @@ -1,6 +1,6 @@
  3967. #------------------------------------------------------------------------
  3968. -# $File: sysex,v 1.11 2022/01/17 17:16:51 christos Exp $
  3969. +# $File: sysex,v 1.12 2022/10/31 13:22:26 christos Exp $
  3970. # sysex: file(1) magic for MIDI sysex files
  3971. #
  3972. # GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
  3973. @@ -10,8 +10,8 @@
  3974. 0 ubeshort&0xFF80 0xF000
  3975. # MIDI System Exclusive (SysEx) messages (strength=50) after Microsoft Visual C library (strength=70)
  3976. #!:strength +0
  3977. -# skip Microsoft Visual C library with page size 16 misidentifed as ADA and
  3978. -# page size 32 misidentifed as Inventronics by looking for terminating End Of eXclusive byte (EOX)
  3979. +# skip Microsoft Visual C library with page size 16 misidentified as ADA and
  3980. +# page size 32 misidentified as Inventronics by looking for terminating End Of eXclusive byte (EOX)
  3981. >2 search/12 \xF7
  3982. >>0 use midi-sysex
  3983. # display information about MIDI System Exclusive (SysEx) messages
  3984. --- a/magic/Magdir/terminfo
  3985. +++ b/magic/Magdir/terminfo
  3986. @@ -1,6 +1,6 @@
  3987. #------------------------------------------------------------------------------
  3988. -# $File: terminfo,v 1.12 2021/02/23 00:51:10 christos Exp $
  3989. +# $File: terminfo,v 1.13 2022/11/21 22:25:37 christos Exp $
  3990. # terminfo: file(1) magic for terminfo
  3991. #
  3992. # URL: https://invisible-island.net/ncurses/man/term.5.html
  3993. @@ -37,6 +37,7 @@
  3994. # AIX and HPUX use the SVr4 big-endian format
  3995. # Solaris uses the SVr3 formats (sparc and x86 differ endian-ness)
  3996. 0 beshort 0433 SVr2 curses screen image, big-endian
  3997. +# GRR: line below too general as it catches Commodore C128 program (crc32.prg XLINK.PRG) with start address 1C01h handled by ./c64
  3998. 0 beshort 0434 SVr3 curses screen image, big-endian
  3999. 0 beshort 0435 SVr4 curses screen image, big-endian
  4000. #
  4001. --- a/magic/Magdir/tex
  4002. +++ b/magic/Magdir/tex
  4003. @@ -1,6 +1,6 @@
  4004. #------------------------------------------------------------------------------
  4005. -# $File: tex,v 1.21 2019/04/19 00:42:27 christos Exp $
  4006. +# $File: tex,v 1.22 2022/12/21 16:50:04 christos Exp $
  4007. # tex: file(1) magic for TeX files
  4008. #
  4009. # XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
  4010. @@ -10,13 +10,15 @@
  4011. # Although we may know the offset of certain text fields in TeX DVI
  4012. # and font files, we can't use them reliably because they are not
  4013. # zero terminated. [but we do anyway, christos]
  4014. -0 string \367\002 TeX DVI file
  4015. +0 string \367\002
  4016. +>(14.b+15) string \213
  4017. +>>14 pstring >\0 TeX DVI file (%s)
  4018. !:mime application/x-dvi
  4019. ->16 string >\0 (%s)
  4020. 0 string \367\203 TeX generic font data
  4021. 0 string \367\131 TeX packed font data
  4022. >3 string >\0 (%s)
  4023. -0 string \367\312 TeX virtual font data
  4024. +0 string \367\312
  4025. +>(2.b+11) string \363 TeX virtual font data
  4026. 0 search/1 This\ is\ TeX, TeX transcript text
  4027. 0 search/1 This\ is\ METAFONT, METAFONT transcript text
  4028. --- a/magic/Magdir/uterus
  4029. +++ b/magic/Magdir/uterus
  4030. @@ -1,6 +1,6 @@
  4031. #------------------------------------------------------------------------------
  4032. -# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $
  4033. +# $File: uterus,v 1.4 2022/10/31 13:22:26 christos Exp $
  4034. # file(1) magic for uterus files
  4035. # http://freecode.com/projects/uterus
  4036. #
  4037. @@ -11,6 +11,6 @@
  4038. >7 byte x \b%c
  4039. >8 string \<\> \b, big-endian
  4040. >>16 belong >0 \b, slut size %u
  4041. ->8 string \>\< \b, litte-endian
  4042. +>8 string \>\< \b, little-endian
  4043. >>16 lelong >0 \b, slut size %u
  4044. >10 byte &8 \b, compressed
  4045. --- a/magic/Magdir/varied.script
  4046. +++ b/magic/Magdir/varied.script
  4047. @@ -1,59 +1,21 @@
  4048. #------------------------------------------------------------------------------
  4049. -# $File: varied.script,v 1.13 2019/10/11 14:35:29 christos Exp $
  4050. +# $File: varied.script,v 1.15 2022/10/18 13:01:30 christos Exp $
  4051. # varied.script: file(1) magic for various interpreter scripts
  4052. -0 string/t #!\ / a
  4053. ->3 string >\0 %s script text executable
  4054. -!:strength / 2
  4055. +0 string/wt #!\ a
  4056. +>&-1 string/T x %s script text executable
  4057. +!:strength / 3
  4058. +
  4059. +0 string/wb #!\ a
  4060. +>&-1 string/T x %s script executable (binary data)
  4061. +!:strength / 3
  4062. -0 string/b #!\ / a
  4063. ->3 string >\0 %s script executable (binary data)
  4064. -!:strength / 2
  4065. -
  4066. -0 string/t #!\t/ a
  4067. ->3 string >\0 %s script text executable
  4068. -!:strength / 2
  4069. -
  4070. -0 string/b #!\t/ a
  4071. ->3 string >\0 %s script executable (binary data)
  4072. -!:strength / 2
  4073. -
  4074. -0 string/t #!/ a
  4075. ->2 string >\0 %s script text executable
  4076. -!:strength / 2
  4077. -
  4078. -0 string/b #!/ a
  4079. ->2 string >\0 %s script executable (binary data)
  4080. -!:strength / 2
  4081. -
  4082. -0 string/t #!\ script text executable
  4083. ->3 string >\0 for %s
  4084. -!:strength / 2
  4085. -
  4086. -0 string/b #!\ script executable
  4087. ->3 string >\0 for %s (binary data)
  4088. -!:strength / 2
  4089. # using env
  4090. -0 string/t #!/usr/bin/env a
  4091. ->15 string/t >\0 %s script text executable
  4092. -!:strength / 10
  4093. -
  4094. -0 string/b #!/usr/bin/env a
  4095. ->15 string/b >\0 %s script executable (binary data)
  4096. -!:strength / 10
  4097. -
  4098. -0 string/t #!\ /usr/bin/env a
  4099. ->16 string/t >\0 %s script text executable
  4100. -!:strength / 10
  4101. -
  4102. -0 string/b #!\ /usr/bin/env a
  4103. ->16 string/b >\0 %s script executable (binary data)
  4104. -!:strength / 10
  4105. -
  4106. -# From: arno <arenevier@fdn.fr>
  4107. -# mozilla xpconnect typelib
  4108. -# see https://www.mozilla.org/scriptable/typelib_file.html
  4109. -0 string XPCOM\nTypeLib\r\n\032 XPConnect Typelib
  4110. ->0x10 byte x version %d
  4111. ->>0x11 byte x \b.%d
  4112. +0 string/wt #!\ /usr/bin/env a
  4113. +>15 string/T >\0 %s script text executable
  4114. +!:strength / 6
  4115. +
  4116. +0 string/wb #!\ /usr/bin/env a
  4117. +>15 string/T >\0 %s script executable (binary data)
  4118. +!:strength / 6
  4119. --- a/magic/Magdir/web
  4120. +++ b/magic/Magdir/web
  4121. @@ -1,6 +1,6 @@
  4122. #------------------------------------------------------------------------------
  4123. -# $File: web,v 1.1 2020/05/17 19:14:28 christos Exp $
  4124. +# $File: web,v 1.2 2022/10/29 16:02:37 christos Exp $
  4125. # http://www.rdfhdt.org/
  4126. # From Christoph Biedl
  4127. @@ -10,3 +10,9 @@
  4128. 0 string $HDT\x01 HDT file (binary compressed indexed RDF triples) type 1
  4129. !:mime application/vnd.hdt
  4130. !:ext hdt
  4131. +
  4132. +0 string [Adblock\040Plus Adblock Plus
  4133. +>&1 regex [0-9.]+ %s
  4134. +>1 string x rules file
  4135. +>10 search/100 Version:
  4136. +>>&1 regex [0-9]+ \b, version %s
  4137. --- a/magic/Magdir/windows
  4138. +++ b/magic/Magdir/windows
  4139. @@ -1,6 +1,6 @@
  4140. #------------------------------------------------------------------------------
  4141. -# $File: windows,v 1.46 2022/07/02 17:46:09 christos Exp $
  4142. +# $File: windows,v 1.50 2022/11/30 20:24:43 christos Exp $
  4143. # windows: file(1) magic for Microsoft Windows
  4144. #
  4145. # This file is mainly reserved for files where programs
  4146. @@ -115,10 +115,23 @@
  4147. # Summary: Vista Event Log
  4148. -# Extension: .evtx
  4149. # Created by: Andreas Schuster (https://computer.forensikblog.de/)
  4150. -# Reference (1): https://computer.forensikblog.de/en/2007/05/some_magic.html
  4151. -0 string ElfFile\0 MS Windows Vista Event Log
  4152. +# Update: Joerg Jenderek
  4153. +# URL: https://github.com/libyal/libevtx/blob/main/documentation/Windows%20XML%20Event%20Log%20(EVTX).asciidoc
  4154. +# Reference (1): https://web.archive.org/web/20110803085000/
  4155. +# https://computer.forensikblog.de/en/2007/05/some_magic.html
  4156. +# http://mark0.net/download/triddefs_xml.7z/defs/e/evtx.trid.xml
  4157. +# Note: called "Vista Event Log" by TrID and "Event Log" by Windows
  4158. +# verified partly by `wevtutil.exe gli /lf:true dumpfile.evtx`
  4159. +0 string ElfFile\0 MS Windows
  4160. +#!:mime application/octet-stream
  4161. +!:mime application/x-ms-evtx
  4162. +!:ext evtx
  4163. +# Major+Minor format version: 3.1~Vista and later 3.2~Windows 10 (2004) and later
  4164. +>0x24 ulelong =0x00030001 Vista-8.1 Event Log
  4165. +>0x24 ulelong !0x00030001 10-11 Event Log, version
  4166. +>>0x26 uleshort x %u
  4167. +>>0x24 uleshort x \b.%u
  4168. >0x2a leshort x \b, %d chunks
  4169. >>0x10 lelong x \b (no. %d in use)
  4170. >0x18 lelong >1 \b, next record no. %d
  4171. @@ -126,6 +139,32 @@
  4172. >0x78 lelong &1 \b, DIRTY
  4173. >0x78 lelong &2 \b, FULL
  4174. +# Summary: Windows Event Trace Log
  4175. +# From: Joerg Jenderek
  4176. +# URL: http://fileformats.archiveteam.org/wiki/ETL
  4177. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/e/etl.trid.xml
  4178. +# https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/etw/tracelog/trace_logfile_header.htm
  4179. +# Note: called "Window tracing/diagnostic binary log" by TrID
  4180. +# verified by `tracerpt.EXE Wifi.etl -of EVTX`
  4181. +# and by etl-parser `etl2xml --input AMSITrace.etl --output AMSITrace.xml`
  4182. +# Every ETL file begins with a WMI_BUFFER_HEADER, a SYSTEM_TRACE_HEADER and a TRACE_LOGFILE_HEADER
  4183. +0 ubyte 0
  4184. +# look for corresponding encoded as UTF-16 file name extension like in: boot_BASE+CSWITCH_1.etl
  4185. +>0 search/0x699087/b .\0e\0t\0l\0\0\0
  4186. +# GRR: line above only works if in ../../src/file.h FILE_BYTES_MAX is raised above 699086h (6,59 MiB)
  4187. +>>0 use trace-etl
  4188. +# display information of Windows Performance Analyzer Trace File (file name)
  4189. +0 name trace-etl
  4190. +>0 ubyte x Windows Event Trace Log
  4191. +#!:mime application/x-ms-etl
  4192. +# http://extension.nirsoft.net/etl
  4193. +!:mime application/etl
  4194. +!:ext etl
  4195. +# look for DOS drive letter part of log file name like: PhotosAppTracing_startedInBGMode.etl
  4196. +>0 search/0x2b4/sb :\0\x5c\0
  4197. +# like: "c:\Windows\Logs\NetSetup\service.0.etl" "C:\Windows\System32\LogFiles\WMI\Wifi.etl"
  4198. +>>&-2 lestring16 x "%s"
  4199. +
  4200. # Summary: Windows System Deployment Image
  4201. # Created by: Joerg Jenderek
  4202. # URL: http://en.wikipedia.org/wiki/System_Deployment_Image
  4203. @@ -752,6 +791,27 @@
  4204. # like: 12510866.CPX
  4205. !:ext cpx
  4206. # From: Joerg Jenderek
  4207. +# URL: https://en.wikipedia.org/wiki/File_Explorer
  4208. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-exp.trid.xml,scf-exp-old.trid.xml
  4209. +# Note: called "Windows Explorer Command Shell File" by TrID and "File Explorer Command" by Windows via SHCmdFile
  4210. +>>&0 regex/c \^Shell]\r\n Windows Explorer Shell Command File
  4211. +#!:mime text/plain
  4212. +!:mime text/x-ms-scf
  4213. +# like: channels.scf desktop.scf explorer.scf "Desktop anzeigen.scf"
  4214. +!:ext scf
  4215. +# look for icon file directive maybe pointing to malicious file
  4216. +>>>1 search/128 IconFile= \b, icon
  4217. +>>>>&0 string x "%s"
  4218. +# From: Joerg Jenderek
  4219. +# URL: http://en.wikipedia.org/wiki/VIA_Technologies
  4220. +# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/scf-via.trid.xml
  4221. +# Note: called "VIA setup configuration file" by TrID
  4222. +>>&0 regex/c \^SCF]\r\n VIA setup configuration
  4223. +#!:mime text/plain
  4224. +!:mime text/x-via-scf
  4225. +# like: SETUP.SCF
  4226. +!:ext scf
  4227. +# From: Joerg Jenderek
  4228. # URL: https://en.wikipedia.org/wiki/InstallShield
  4229. # Reference: http://mark0.net/download/triddefs_xml.7z/defs/l/lid-is.trid.xml
  4230. # Note: contain also 3 keywords like: count Default key0
  4231. @@ -871,21 +931,24 @@
  4232. >>>2 uleshort <3
  4233. # look for colon in WinDirPath after PNF header
  4234. #>>>>0x59 search/18 :
  4235. ->>>>0 use PreCompiledInf
  4236. +# skip few Adobe Photoshop Color swatch ("Mac OS.aco" TRUMATCH-Farben.aco Windows.aco) and some
  4237. +# Targa image (money-256.tga XING_B_UCM8.tga x-fmt-367-signature-id-604.tga) with "invalid low section name" \0
  4238. +>>>>(20.l) ubelong >0x40004000
  4239. +>>>>>0 use PreCompiledInf
  4240. 0 name PreCompiledInf
  4241. >0 uleshort x Windows Precompiled iNF
  4242. !:mime application/x-pnf
  4243. !:ext pnf
  4244. # major version 1 for older Windows like XP and 3 since about Windows Vista
  4245. -# 101h~98-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362
  4246. +# 101h~95-XP; 301h~Windows Vista-7 ; 302h~Windows 10 14393; 303h~Windows 10 18362-Windows11
  4247. >1 ubyte x \b, version %u
  4248. >0 ubyte x \b.%u
  4249. >0 uleshort =0x0101 (Windows
  4250. ->>4 ulelong&0x00000001 !0x00000001 98)
  4251. +>>4 ulelong&0x00000001 !0x00000001 95-98)
  4252. >>4 ulelong&0x00000001 =0x00000001 XP)
  4253. >0 uleshort =0x0301 (Windows Vista-8.1)
  4254. >0 uleshort =0x0302 (Windows 10 older)
  4255. ->0 uleshort =0x0303 (Windows 10)
  4256. +>0 uleshort =0x0303 (Windows 10-11)
  4257. # 1 ,2 (windows 98 SE)
  4258. >2 uleshort !2 \b, InfStyle %u
  4259. # PNF_FLAG_IS_UNICODE 0x00000001
  4260. @@ -927,7 +990,7 @@
  4261. >>(20.l) string x "%s"
  4262. # FILETIME is number of 100-nanosecond intervals since 1 January 1601
  4263. #>24 ulequad x \b, InfVersionLastWriteTime %16.16llx
  4264. -#>24 foodate-0xbar x \b, InfVersionLastWriteTime %s
  4265. +>24 qwdate x \b, InfVersionLastWriteTime %s
  4266. # for Windows 98, XP
  4267. >0 uleshort <0x0102
  4268. # only found values lower 0x00ffFFff
  4269. @@ -965,6 +1028,7 @@
  4270. >>>>>(72.l) string x OsLoaderPath "%s"
  4271. # 1fdh
  4272. #>>>76 uleshort x \b, StringTableHashBucketCount %#x
  4273. +# https://docs.microsoft.com/en-us/openspecs/office_standards/ms-oe376/6c085406-a698-4e12-9d4d-c3b0ee3dbc4a
  4274. # only 407h found
  4275. >>>78 uleshort !0x409 \b, LanguageID %x
  4276. #>>>78 uleshort =0x409 \b, LanguageID %x
  4277. @@ -1342,7 +1406,7 @@
  4278. # 5000010021083f00 50000100b0335600 50000100cbfdf800 50000100dfbc4700
  4279. #>4 ubequad x \b, at 4 %#16.16llx
  4280. # copyright text like: "Stirling Technologies, Inc. (c) 1990-1994"
  4281. -# "InstallSHIELD Software Coporation (c) 1990-1997"
  4282. +# "InstallSHIELD Software Corporation (c) 1990-1997"
  4283. >13 pstring/h x "%s"
  4284. # look for specific ASCII variable names
  4285. >1 search/0x121/s SRCDIR \b, variable names:
  4286. --- a/magic/Magdir/wordprocessors
  4287. +++ b/magic/Magdir/wordprocessors
  4288. @@ -1,6 +1,6 @@
  4289. #------------------------------------------------------------------------------
  4290. -# $File: wordprocessors,v 1.31 2022/08/31 08:00:53 christos Exp $
  4291. +# $File: wordprocessors,v 1.32 2022/10/31 13:22:26 christos Exp $
  4292. # wordprocessors: file(1) magic fo word processors.
  4293. #
  4294. ####### PWP file format used on Smith Corona Personal Word Processors:
  4295. @@ -430,7 +430,7 @@
  4296. >110 uleshort/256 =0 document
  4297. # https://www.macdisk.com/macsigen.php
  4298. !:apple ALB3ALD3
  4299. -# PT3 for template and no example for PageMaker document/publiction with PM3 extension
  4300. +# PT3 for template and no example for PageMaker document/publication with PM3 extension
  4301. !:ext pm3/pt3
  4302. >110 uleshort/256 =4 document
  4303. !:apple ALD4ALB4
  4304. --- a/magic/Magdir/xenix
  4305. +++ b/magic/Magdir/xenix
  4306. @@ -1,6 +1,6 @@
  4307. #------------------------------------------------------------------------------
  4308. -# $File: xenix,v 1.14 2021/04/26 15:56:00 christos Exp $
  4309. +# $File: xenix,v 1.15 2022/10/19 20:15:16 christos Exp $
  4310. # xenix: file(1) magic for Microsoft Xenix
  4311. #
  4312. # "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
  4313. @@ -28,20 +28,23 @@
  4314. # skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positive string length
  4315. >>>3 ubyte >0
  4316. # skip examples like OMBRE.6 with "UUUUUU" name by looking for valid high second record type
  4317. ->>>>(1.s+3) ubyte >0x6D 8086 relocatable (Microsoft)
  4318. +>>>>(1.s+3) ubyte >0x6D
  4319. +# skip few Atari DEGAS bitmap TPDEMO.PC2 RECIPE.PC2 with invalid "high" second record type FEh FFh
  4320. +>>>>>(1.s+3) ubyte <0xF2 8086 relocatable (Microsoft)
  4321. #!:mime application/octet-stream
  4322. !:mime application/x-object
  4323. !:ext obj/o/a
  4324. # T-module name often source name like "hello.c" or "jmppm32.asm" in JMPPM32.OBJ or
  4325. # "kbhit" in KBHITS.OBJ or "CAUSEWAY_KERNAL" in CWAPI.OBJ
  4326. ->>>>>3 pstring x \b, "%s"
  4327. +>>>>>>3 pstring x \b, "%s"
  4328. # data length probably lower 256 according to TrID obj_omf.trid.xml
  4329. ->>>>>1 uleshort x \b, 1st record data length %u
  4330. +>>>>>>1 uleshort x \b, 1st record data length %u
  4331. # checksum
  4332. -#>>>>>(3.b+4) ubyte x \b, checksum %#2.2x
  4333. +#>>>>>>(3.b+4) ubyte x \b, checksum %#2.2x
  4334. # second recordtype: 96h~LNAMES 88h~COMENT 8CH~EXTDEF
  4335. ->>>>>(1.s+3) ubyte x \b, 2nd record type %#x
  4336. ->>>>>(1.s+4) uleshort x \b, 2nd record data length %u
  4337. +# highest F1h~Library End Record
  4338. +>>>>>>(1.s+3) ubyte x \b, 2nd record type %#x
  4339. +>>>>>>(1.s+4) uleshort x \b, 2nd record data length %u
  4340. 0 leshort 0xff65 x.out
  4341. >2 string __.SYMDEF randomized
  4342. >0 byte x archive
  4343. @@ -100,3 +103,4 @@
  4344. >0x1e leshort &0x102 Huge Objects Enabled
  4345. 0 leshort 0x580 XENIX 8086 relocatable or 80286 small model
  4346. +# GRR: line above is too general as it catches also all 8086 relocatable (Microsoft) with 1st record data length 5 C0M.OBJ C0T.OBJ C0S.OBJ
  4347. --- a/magic/Magdir/xilinx
  4348. +++ b/magic/Magdir/xilinx
  4349. @@ -1,6 +1,6 @@
  4350. #------------------------------------------------------------------------------
  4351. -# $File: xilinx,v 1.9 2021/04/26 15:56:00 christos Exp $
  4352. +# $File: xilinx,v 1.10 2022/12/18 14:59:32 christos Exp $
  4353. # This is Aaron's attempt at a MAGIC file for Xilinx .bit files.
  4354. # Xilinx-Magic@RevRagnarok.com
  4355. # Got the info from FPGA-FAQ 0026
  4356. @@ -38,3 +38,21 @@
  4357. # Raw bitstream files
  4358. 0 long 0xffffffff
  4359. >&0 belong 0xaa995566 Xilinx RAW bitstream (.BIN)
  4360. +
  4361. +# AXLF (xclbin) files used by AMD/Xilinx accelerators.
  4362. +# The file format is defined by XRT source tree:
  4363. +# https://github.com/Xilinx/XRT/blob/master/src/runtime_src/core/include/xclbin.h
  4364. +# Display file size, creation date, accelerator shell name, xclbin uuid and
  4365. +# number of sections.
  4366. +
  4367. +0 string xclbin2 AMD/Xilinx accelerator AXLF (xclbin) file
  4368. +>0x130 lequad x \b, %lld bytes
  4369. +>0x138 leqdate x \b, created %s
  4370. +>0x160 string >0 \b, shell "%.64s"
  4371. +>0x1a0 ubelong x \b, uuid %08x
  4372. +>0x1a4 ubeshort x \b-%04x
  4373. +>0x1a6 ubeshort x \b-%04x
  4374. +>0x1a8 ubeshort x \b-%04x
  4375. +>0x1aa ubelong x \b-%08x
  4376. +>0x1ae ubeshort x \b%04x
  4377. +>0x1c0 lelong x \b, %d sections
  4378. \ No newline at end of file
  4379. --- a/magic/Makefile.am
  4380. +++ b/magic/Makefile.am
  4381. @@ -1,5 +1,5 @@
  4382. #
  4383. -# $File: Makefile.am,v 1.182 2022/09/11 21:04:30 christos Exp $
  4384. +# $File: Makefile.am,v 1.186 2022/11/11 14:52:44 christos Exp $
  4385. #
  4386. MAGIC_FRAGMENT_BASE = Magdir
  4387. MAGIC_DIR = $(top_srcdir)/magic
  4388. @@ -92,7 +92,6 @@
  4389. $(MAGIC_FRAGMENT_DIR)/diff \
  4390. $(MAGIC_FRAGMENT_DIR)/digital \
  4391. $(MAGIC_FRAGMENT_DIR)/dolby \
  4392. -$(MAGIC_FRAGMENT_DIR)/dsf \
  4393. $(MAGIC_FRAGMENT_DIR)/dump \
  4394. $(MAGIC_FRAGMENT_DIR)/dyadic \
  4395. $(MAGIC_FRAGMENT_DIR)/ebml \
  4396. @@ -108,6 +107,7 @@
  4397. $(MAGIC_FRAGMENT_DIR)/fcs \
  4398. $(MAGIC_FRAGMENT_DIR)/filesystems \
  4399. $(MAGIC_FRAGMENT_DIR)/finger \
  4400. +$(MAGIC_FRAGMENT_DIR)/firmware \
  4401. $(MAGIC_FRAGMENT_DIR)/flash \
  4402. $(MAGIC_FRAGMENT_DIR)/flif \
  4403. $(MAGIC_FRAGMENT_DIR)/fonts \
  4404. @@ -245,6 +245,7 @@
  4405. $(MAGIC_FRAGMENT_DIR)/pgp-binary-keys \
  4406. $(MAGIC_FRAGMENT_DIR)/pkgadd \
  4407. $(MAGIC_FRAGMENT_DIR)/plan9 \
  4408. +$(MAGIC_FRAGMENT_DIR)/playdate \
  4409. $(MAGIC_FRAGMENT_DIR)/plus5 \
  4410. $(MAGIC_FRAGMENT_DIR)/pmem \
  4411. $(MAGIC_FRAGMENT_DIR)/polyml \
  4412. @@ -267,6 +268,7 @@
  4413. $(MAGIC_FRAGMENT_DIR)/rtf \
  4414. $(MAGIC_FRAGMENT_DIR)/rst \
  4415. $(MAGIC_FRAGMENT_DIR)/ruby \
  4416. +$(MAGIC_FRAGMENT_DIR)/rust \
  4417. $(MAGIC_FRAGMENT_DIR)/sc \
  4418. $(MAGIC_FRAGMENT_DIR)/sccs \
  4419. $(MAGIC_FRAGMENT_DIR)/scientific \
  4420. --- a/src/Makefile.am
  4421. +++ b/src/Makefile.am
  4422. @@ -17,10 +17,10 @@
  4423. else
  4424. MINGWLIBS =
  4425. endif
  4426. -libmagic_la_LIBADD = $(LTLIBOBJS) $(MINGWLIBS)
  4427. +libmagic_la_LIBADD = -lm $(LTLIBOBJS) $(MINGWLIBS)
  4428. file_SOURCES = file.c seccomp.c
  4429. -file_LDADD = libmagic.la
  4430. +file_LDADD = libmagic.la -lm
  4431. CLEANFILES = magic.h
  4432. EXTRA_DIST = magic.h.in cdf.mk BNF memtest.c
  4433. HDR= $(top_srcdir)/src/magic.h.in
  4434. --- a/src/apprentice.c
  4435. +++ b/src/apprentice.c
  4436. @@ -32,7 +32,7 @@
  4437. #include "file.h"
  4438. #ifndef lint
  4439. -FILE_RCSID("@(#)$File: apprentice.c,v 1.326 2022/09/13 18:46:07 christos Exp $")
  4440. +FILE_RCSID("@(#)$File: apprentice.c,v 1.338 2022/10/23 13:21:42 christos Exp $")
  4441. #endif /* lint */
  4442. #include "magic.h"
  4443. @@ -476,7 +476,6 @@
  4444. {
  4445. struct magic_map *map;
  4446. #ifndef COMPILE_ONLY
  4447. - struct mlist *ml;
  4448. size_t i;
  4449. #endif
  4450. @@ -498,7 +497,7 @@
  4451. map = apprentice_map(ms, fn);
  4452. if (map == NULL) {
  4453. if (ms->flags & MAGIC_CHECK)
  4454. - file_magwarn(ms, "using regular magic file `%s'", fn);
  4455. + file_magwarn(NULL, "using regular magic file `%s'", fn);
  4456. map = apprentice_load(ms, fn, action);
  4457. if (map == NULL)
  4458. return -1;
  4459. @@ -511,7 +510,7 @@
  4460. apprentice_unmap(map);
  4461. else
  4462. mlist_free_all(ms);
  4463. - file_oomem(ms, sizeof(*ml));
  4464. + file_oomem(ms, sizeof(*ms->mlist[0]));
  4465. return -1;
  4466. }
  4467. }
  4468. @@ -555,7 +554,7 @@
  4469. size_t i, len;
  4470. if ((ms = CAST(struct magic_set *, calloc(CAST(size_t, 1u),
  4471. - sizeof(struct magic_set)))) == NULL)
  4472. + sizeof(*ms)))) == NULL)
  4473. return NULL;
  4474. if (magic_setflags(ms, flags) == -1) {
  4475. @@ -693,7 +692,6 @@
  4476. size_t *sizes, size_t nbufs)
  4477. {
  4478. size_t i, j;
  4479. - struct mlist *ml;
  4480. struct magic_map *map;
  4481. if (nbufs == 0)
  4482. @@ -706,7 +704,7 @@
  4483. for (i = 0; i < MAGIC_SETS; i++) {
  4484. mlist_free(ms->mlist[i]);
  4485. if ((ms->mlist[i] = mlist_alloc()) == NULL) {
  4486. - file_oomem(ms, sizeof(*ms->mlist[i]));
  4487. + file_oomem(ms, sizeof(*ms->mlist[0]));
  4488. goto fail;
  4489. }
  4490. }
  4491. @@ -718,7 +716,7 @@
  4492. for (j = 0; j < MAGIC_SETS; j++) {
  4493. if (add_mlist(ms->mlist[j], map, j) == -1) {
  4494. - file_oomem(ms, sizeof(*ml));
  4495. + file_oomem(ms, sizeof(*ms->mlist[0]));
  4496. goto fail;
  4497. }
  4498. }
  4499. @@ -754,7 +752,7 @@
  4500. for (i = 0; i < MAGIC_SETS; i++) {
  4501. mlist_free(ms->mlist[i]);
  4502. if ((ms->mlist[i] = mlist_alloc()) == NULL) {
  4503. - file_oomem(ms, sizeof(*ms->mlist[i]));
  4504. + file_oomem(ms, sizeof(*ms->mlist[0]));
  4505. for (j = 0; j < i; j++) {
  4506. mlist_free(ms->mlist[j]);
  4507. ms->mlist[j] = NULL;
  4508. @@ -942,8 +940,8 @@
  4509. switch (m->type) {
  4510. case FILE_DEFAULT: /* make sure this sorts last */
  4511. if (m->factor_op != FILE_FACTOR_OP_NONE) {
  4512. - fprintf(stderr, "Bad factor_op %d", m->factor_op);
  4513. - abort();
  4514. + file_magwarn(NULL, "Usupported factor_op in default %d",
  4515. + m->factor_op);
  4516. }
  4517. return 0;
  4518. @@ -1169,14 +1167,16 @@
  4519. * description/mimetype.
  4520. */
  4521. lineindex = descindex = mimeindex = magindex;
  4522. - for (magindex++; magindex < ml->nmagic &&
  4523. - ml->magic[magindex].cont_level != 0; magindex++) {
  4524. + for (; magindex + 1 < ml->nmagic &&
  4525. + ml->magic[magindex + 1].cont_level != 0;
  4526. + magindex++) {
  4527. + uint32_t mi = magindex + 1;
  4528. if (*ml->magic[descindex].desc == '\0'
  4529. - && *ml->magic[magindex].desc)
  4530. - descindex = magindex;
  4531. + && *ml->magic[mi].desc)
  4532. + descindex = mi;
  4533. if (*ml->magic[mimeindex].mimetype == '\0'
  4534. - && *ml->magic[magindex].mimetype)
  4535. - mimeindex = magindex;
  4536. + && *ml->magic[mi].mimetype)
  4537. + mimeindex = mi;
  4538. }
  4539. printf("Strength = %3" SIZE_T_FORMAT "u@%u: %s [%s]\n",
  4540. @@ -1591,7 +1591,7 @@
  4541. i = set_text_binary(ms, mset[j].me, mset[j].count, i);
  4542. }
  4543. if (mset[j].me)
  4544. - qsort(mset[j].me, mset[j].count, sizeof(*mset[j].me),
  4545. + qsort(mset[j].me, mset[j].count, sizeof(*mset[0].me),
  4546. apprentice_sort);
  4547. /*
  4548. @@ -2436,6 +2436,7 @@
  4549. const char *l = line;
  4550. char *el;
  4551. unsigned long factor;
  4552. + char sbuf[512];
  4553. struct magic *m = &me->mp[0];
  4554. if (m->factor_op != FILE_FACTOR_OP_NONE) {
  4555. @@ -2446,12 +2447,15 @@
  4556. }
  4557. if (m->type == FILE_NAME) {
  4558. file_magwarn(ms, "%s: Strength setting is not supported in "
  4559. - "\"name\" magic entries", m->value.s);
  4560. + "\"name\" magic entries",
  4561. + file_printable(ms, sbuf, sizeof(sbuf), m->value.s,
  4562. + sizeof(m->value.s)));
  4563. return -1;
  4564. }
  4565. EATAB;
  4566. switch (*l) {
  4567. case FILE_FACTOR_OP_NONE:
  4568. + break;
  4569. case FILE_FACTOR_OP_PLUS:
  4570. case FILE_FACTOR_OP_MINUS:
  4571. case FILE_FACTOR_OP_TIMES:
  4572. @@ -2762,6 +2766,7 @@
  4573. }
  4574. invalid:
  4575. *estr = "not valid";
  4576. + return -1;
  4577. toolong:
  4578. *estr = "too long";
  4579. return -1;
  4580. @@ -2832,6 +2837,7 @@
  4581. {
  4582. char *ep;
  4583. uint64_t ull;
  4584. + int y;
  4585. switch (m->type) {
  4586. case FILE_BESTRING16:
  4587. @@ -2853,8 +2859,8 @@
  4588. }
  4589. if (m->type == FILE_REGEX) {
  4590. file_regex_t rx;
  4591. - int rc = file_regcomp(ms, &rx, m->value.s,
  4592. - REG_EXTENDED);
  4593. + int rc =
  4594. + file_regcomp(ms, &rx, m->value.s, REG_EXTENDED);
  4595. if (rc == 0) {
  4596. file_regfree(&rx);
  4597. }
  4598. @@ -2899,6 +2905,7 @@
  4599. m->value.q = file_signextend(ms, m, ull);
  4600. if (*p == ep) {
  4601. file_magwarn(ms, "Unparsable number `%s'", *p);
  4602. + return -1;
  4603. } else {
  4604. size_t ts = typesize(m->type);
  4605. uint64_t x;
  4606. @@ -2908,32 +2915,38 @@
  4607. file_magwarn(ms,
  4608. "Expected numeric type got `%s'",
  4609. type_tbl[m->type].name);
  4610. + return -1;
  4611. }
  4612. for (q = *p; isspace(CAST(unsigned char, *q)); q++)
  4613. continue;
  4614. - if (*q == '-')
  4615. + if (*q == '-' && ull != UINT64_MAX)
  4616. ull = -CAST(int64_t, ull);
  4617. switch (ts) {
  4618. case 1:
  4619. x = CAST(uint64_t, ull & ~0xffULL);
  4620. + y = (x & ~0xffULL) != ~0xffULL;
  4621. break;
  4622. case 2:
  4623. x = CAST(uint64_t, ull & ~0xffffULL);
  4624. + y = (x & ~0xffffULL) != ~0xffffULL;
  4625. break;
  4626. case 4:
  4627. x = CAST(uint64_t, ull & ~0xffffffffULL);
  4628. + y = (x & ~0xffffffffULL) != ~0xffffffffULL;
  4629. break;
  4630. case 8:
  4631. x = 0;
  4632. + y = 0;
  4633. break;
  4634. default:
  4635. fprintf(stderr, "Bad width %zu", ts);
  4636. abort();
  4637. }
  4638. - if (x) {
  4639. + if (x && y) {
  4640. file_magwarn(ms, "Overflow for numeric"
  4641. " type `%s' value %#" PRIx64,
  4642. type_tbl[m->type].name, ull);
  4643. + return -1;
  4644. }
  4645. }
  4646. if (errno == 0) {
  4647. --- a/src/apptype.c
  4648. +++ b/src/apptype.c
  4649. @@ -27,7 +27,7 @@
  4650. #include "file.h"
  4651. #ifndef lint
  4652. -FILE_RCSID("@(#)$File: apptype.c,v 1.14 2018/09/09 20:33:28 christos Exp $")
  4653. +FILE_RCSID("@(#)$File: apptype.c,v 1.16 2022/09/24 20:30:13 christos Exp $")
  4654. #endif /* lint */
  4655. #include <stdlib.h>
  4656. --- a/src/ascmagic.c
  4657. +++ b/src/ascmagic.c
  4658. @@ -35,7 +35,7 @@
  4659. #include "file.h"
  4660. #ifndef lint
  4661. -FILE_RCSID("@(#)$File: ascmagic.c,v 1.110 2021/12/06 15:33:00 christos Exp $")
  4662. +FILE_RCSID("@(#)$File: ascmagic.c,v 1.112 2022/09/24 20:30:13 christos Exp $")
  4663. #endif /* lint */
  4664. #include "magic.h"
  4665. --- a/src/asctime_r.c
  4666. +++ b/src/asctime_r.c
  4667. @@ -1,8 +1,8 @@
  4668. -/* $File: asctime_r.c,v 1.1 2012/05/15 17:14:36 christos Exp $ */
  4669. +/* $File: asctime_r.c,v 1.3 2022/09/24 20:30:13 christos Exp $ */
  4670. #include "file.h"
  4671. #ifndef lint
  4672. -FILE_RCSID("@(#)$File: asctime_r.c,v 1.1 2012/05/15 17:14:36 christos Exp $")
  4673. +FILE_RCSID("@(#)$File: asctime_r.c,v 1.3 2022/09/24 20:30:13 christos Exp $")
  4674. #endif /* lint */
  4675. #include <time.h>
  4676. #include <string.h>
  4677. --- a/src/asprintf.c
  4678. +++ b/src/asprintf.c
  4679. @@ -29,7 +29,7 @@
  4680. #include "file.h"
  4681. #ifndef lint
  4682. -FILE_RCSID("@(#)$File: asprintf.c,v 1.5 2018/09/09 20:33:28 christos Exp $")
  4683. +FILE_RCSID("@(#)$File: asprintf.c,v 1.7 2022/09/24 20:30:13 christos Exp $")
  4684. #endif
  4685. int asprintf(char **ptr, const char *fmt, ...)
  4686. --- a/src/buffer.c
  4687. +++ b/src/buffer.c
  4688. @@ -27,7 +27,7 @@
  4689. #include "file.h"
  4690. #ifndef lint
  4691. -FILE_RCSID("@(#)$File: buffer.c,v 1.8 2020/02/16 15:52:49 christos Exp $")
  4692. +FILE_RCSID("@(#)$File: buffer.c,v 1.10 2022/09/24 20:30:13 christos Exp $")
  4693. #endif /* lint */
  4694. #include "magic.h"
  4695. --- a/src/cdf.c
  4696. +++ b/src/cdf.c
  4697. @@ -35,7 +35,7 @@
  4698. #include "file.h"
  4699. #ifndef lint
  4700. -FILE_RCSID("@(#)$File: cdf.c,v 1.121 2021/10/20 13:56:15 christos Exp $")
  4701. +FILE_RCSID("@(#)$File: cdf.c,v 1.123 2022/09/24 20:30:13 christos Exp $")
  4702. #endif
  4703. #include <assert.h>
  4704. --- a/src/cdf_time.c
  4705. +++ b/src/cdf_time.c
  4706. @@ -27,7 +27,7 @@
  4707. #include "file.h"
  4708. #ifndef lint
  4709. -FILE_RCSID("@(#)$File: cdf_time.c,v 1.20 2021/12/06 15:33:00 christos Exp $")
  4710. +FILE_RCSID("@(#)$File: cdf_time.c,v 1.23 2022/09/24 20:30:13 christos Exp $")
  4711. #endif
  4712. #include <time.h>
  4713. @@ -157,7 +157,7 @@
  4714. return -1;
  4715. }
  4716. *t = (ts->ts_nsec / 100) * CDF_TIME_PREC;
  4717. - *t = tm.tm_sec;
  4718. + *t += tm.tm_sec;
  4719. *t += tm.tm_min * 60;
  4720. *t += tm.tm_hour * 60 * 60;
  4721. *t += tm.tm_mday * 60 * 60 * 24;
  4722. --- a/src/compress.c
  4723. +++ b/src/compress.c
  4724. @@ -35,7 +35,7 @@
  4725. #include "file.h"
  4726. #ifndef lint
  4727. -FILE_RCSID("@(#)$File: compress.c,v 1.136 2022/09/13 16:08:34 christos Exp $")
  4728. +FILE_RCSID("@(#)$File: compress.c,v 1.152 2022/10/31 13:22:26 christos Exp $")
  4729. #endif
  4730. #include "magic.h"
  4731. @@ -79,6 +79,17 @@
  4732. #include <lzma.h>
  4733. #endif
  4734. +#if defined(HAVE_ZSTD_H) && defined(ZSTDLIBSUPPORT)
  4735. +#define BUILTIN_ZSTDLIB
  4736. +#include <zstd.h>
  4737. +#include <zstd_errors.h>
  4738. +#endif
  4739. +
  4740. +#if defined(HAVE_LZLIB_H) && defined(LZLIBSUPPORT)
  4741. +#define BUILTIN_LZLIB
  4742. +#include <lzlib.h>
  4743. +#endif
  4744. +
  4745. #ifdef DEBUG
  4746. int tty = -1;
  4747. #define DPRINTF(...) do { \
  4748. @@ -175,6 +186,8 @@
  4749. #define METH_FROZEN 2
  4750. #define METH_BZIP 7
  4751. #define METH_XZ 9
  4752. +#define METH_LZIP 8
  4753. +#define METH_ZSTD 12
  4754. #define METH_LZMA 13
  4755. #define METH_ZLIB 14
  4756. { { .magic = "\037\235" }, 2, gzip_args, NULL }, /* 0, compressed */
  4757. @@ -207,21 +220,29 @@
  4758. private ssize_t swrite(int, const void *, size_t);
  4759. #if HAVE_FORK
  4760. private size_t ncompr = __arraycount(compr);
  4761. -private int uncompressbuf(int, size_t, size_t, const unsigned char *,
  4762. +private int uncompressbuf(int, size_t, size_t, int, const unsigned char *,
  4763. unsigned char **, size_t *);
  4764. #ifdef BUILTIN_DECOMPRESS
  4765. private int uncompresszlib(const unsigned char *, unsigned char **, size_t,
  4766. size_t *, int);
  4767. private int uncompressgzipped(const unsigned char *, unsigned char **, size_t,
  4768. - size_t *);
  4769. + size_t *, int);
  4770. #endif
  4771. #ifdef BUILTIN_BZLIB
  4772. private int uncompressbzlib(const unsigned char *, unsigned char **, size_t,
  4773. - size_t *);
  4774. + size_t *, int);
  4775. #endif
  4776. #ifdef BUILTIN_XZLIB
  4777. private int uncompressxzlib(const unsigned char *, unsigned char **, size_t,
  4778. - size_t *);
  4779. + size_t *, int);
  4780. +#endif
  4781. +#ifdef BUILTIN_ZSTDLIB
  4782. +private int uncompresszstd(const unsigned char *, unsigned char **, size_t,
  4783. + size_t *, int);
  4784. +#endif
  4785. +#ifdef BUILTIN_LZLIB
  4786. +private int uncompresslzlib(const unsigned char *, unsigned char **, size_t,
  4787. + size_t *, int);
  4788. #endif
  4789. static int makeerror(unsigned char **, size_t *, const char *, ...)
  4790. @@ -287,7 +308,9 @@
  4791. }
  4792. nsz = nbytes;
  4793. - urv = uncompressbuf(fd, ms->bytes_max, i, buf, &newbuf, &nsz);
  4794. + free(newbuf);
  4795. + urv = uncompressbuf(fd, ms->bytes_max, i,
  4796. + (ms->flags & MAGIC_NO_COMPRESS_FORK), buf, &newbuf, &nsz);
  4797. DPRINTF("uncompressbuf = %d, %s, %" SIZE_T_FORMAT "u\n", urv,
  4798. (char *)newbuf, nsz);
  4799. switch (urv) {
  4800. @@ -297,7 +320,8 @@
  4801. if (urv == ERRDATA)
  4802. prv = format_decompression_error(ms, i, newbuf);
  4803. else
  4804. - prv = file_buffer(ms, -1, NULL, name, newbuf, nsz);
  4805. + prv = file_buffer(ms, -1, NULL, name, newbuf,
  4806. + nsz);
  4807. if (prv == -1)
  4808. goto error;
  4809. rv = 1;
  4810. @@ -314,7 +338,8 @@
  4811. * XXX: If file_buffer fails here, we overwrite
  4812. * the compressed text. FIXME.
  4813. */
  4814. - if (file_buffer(ms, -1, NULL, NULL, buf, nbytes) == -1) {
  4815. + if (file_buffer(ms, -1, NULL, NULL, buf, nbytes) == -1)
  4816. + {
  4817. if (file_pop_buffer(ms, pb) != NULL)
  4818. abort();
  4819. goto error;
  4820. @@ -538,11 +563,17 @@
  4821. private int
  4822. uncompressgzipped(const unsigned char *old, unsigned char **newch,
  4823. - size_t bytes_max, size_t *n)
  4824. + size_t bytes_max, size_t *n, int extra __attribute__((__unused__)))
  4825. {
  4826. - unsigned char flg = old[3];
  4827. + unsigned char flg;
  4828. size_t data_start = 10;
  4829. + if (*n < 4) {
  4830. + goto err;
  4831. + }
  4832. +
  4833. + flg = old[3];
  4834. +
  4835. if (flg & FEXTRA) {
  4836. if (data_start + 1 >= *n)
  4837. goto err;
  4838. @@ -578,9 +609,6 @@
  4839. int rc;
  4840. z_stream z;
  4841. - if ((*newch = CAST(unsigned char *, malloc(bytes_max + 1))) == NULL)
  4842. - return makeerror(newch, n, "No buffer, %s", strerror(errno));
  4843. -
  4844. z.next_in = CCAST(Bytef *, old);
  4845. z.avail_in = CAST(uint32_t, *n);
  4846. z.next_out = *newch;
  4847. @@ -595,8 +623,10 @@
  4848. goto err;
  4849. rc = inflate(&z, Z_SYNC_FLUSH);
  4850. - if (rc != Z_OK && rc != Z_STREAM_END)
  4851. + if (rc != Z_OK && rc != Z_STREAM_END) {
  4852. + inflateEnd(&z);
  4853. goto err;
  4854. + }
  4855. *n = CAST(size_t, z.total_out);
  4856. rc = inflateEnd(&z);
  4857. @@ -608,16 +638,14 @@
  4858. return OKDATA;
  4859. err:
  4860. - strlcpy(RCAST(char *, *newch), z.msg ? z.msg : zError(rc), bytes_max);
  4861. - *n = strlen(RCAST(char *, *newch));
  4862. - return ERRDATA;
  4863. + return makeerror(newch, n, "%s", z.msg ? z.msg : zError(rc));
  4864. }
  4865. #endif
  4866. #ifdef BUILTIN_BZLIB
  4867. private int
  4868. uncompressbzlib(const unsigned char *old, unsigned char **newch,
  4869. - size_t bytes_max, size_t *n)
  4870. + size_t bytes_max, size_t *n, int extra __attribute__((__unused__)))
  4871. {
  4872. int rc;
  4873. bz_stream bz;
  4874. @@ -627,17 +655,16 @@
  4875. if (rc != BZ_OK)
  4876. goto err;
  4877. - if ((*newch = CAST(unsigned char *, malloc(bytes_max + 1))) == NULL)
  4878. - return makeerror(newch, n, "No buffer, %s", strerror(errno));
  4879. -
  4880. bz.next_in = CCAST(char *, RCAST(const char *, old));
  4881. bz.avail_in = CAST(uint32_t, *n);
  4882. bz.next_out = RCAST(char *, *newch);
  4883. bz.avail_out = CAST(unsigned int, bytes_max);
  4884. rc = BZ2_bzDecompress(&bz);
  4885. - if (rc != BZ_OK && rc != BZ_STREAM_END)
  4886. + if (rc != BZ_OK && rc != BZ_STREAM_END) {
  4887. + BZ2_bzDecompressEnd(&bz);
  4888. goto err;
  4889. + }
  4890. /* Assume byte_max is within 32bit */
  4891. /* assert(bz.total_out_hi32 == 0); */
  4892. @@ -651,16 +678,14 @@
  4893. return OKDATA;
  4894. err:
  4895. - snprintf(RCAST(char *, *newch), bytes_max, "bunzip error %d", rc);
  4896. - *n = strlen(RCAST(char *, *newch));
  4897. - return ERRDATA;
  4898. + return makeerror(newch, n, "bunzip error %d", rc);
  4899. }
  4900. #endif
  4901. #ifdef BUILTIN_XZLIB
  4902. private int
  4903. uncompressxzlib(const unsigned char *old, unsigned char **newch,
  4904. - size_t bytes_max, size_t *n)
  4905. + size_t bytes_max, size_t *n, int extra __attribute__((__unused__)))
  4906. {
  4907. int rc;
  4908. lzma_stream xz;
  4909. @@ -670,17 +695,16 @@
  4910. if (rc != LZMA_OK)
  4911. goto err;
  4912. - if ((*newch = CAST(unsigned char *, malloc(bytes_max + 1))) == NULL)
  4913. - return makeerror(newch, n, "No buffer, %s", strerror(errno));
  4914. -
  4915. xz.next_in = CCAST(const uint8_t *, old);
  4916. xz.avail_in = CAST(uint32_t, *n);
  4917. xz.next_out = RCAST(uint8_t *, *newch);
  4918. xz.avail_out = CAST(unsigned int, bytes_max);
  4919. rc = lzma_code(&xz, LZMA_RUN);
  4920. - if (rc != LZMA_OK && rc != LZMA_STREAM_END)
  4921. + if (rc != LZMA_OK && rc != LZMA_STREAM_END) {
  4922. + lzma_end(&xz);
  4923. goto err;
  4924. + }
  4925. *n = CAST(size_t, xz.total_out);
  4926. @@ -691,9 +715,113 @@
  4927. return OKDATA;
  4928. err:
  4929. - snprintf(RCAST(char *, *newch), bytes_max, "unxz error %d", rc);
  4930. - *n = strlen(RCAST(char *, *newch));
  4931. - return ERRDATA;
  4932. + return makeerror(newch, n, "unxz error %d", rc);
  4933. +}
  4934. +#endif
  4935. +
  4936. +#ifdef BUILTIN_ZSTDLIB
  4937. +private int
  4938. +uncompresszstd(const unsigned char *old, unsigned char **newch,
  4939. + size_t bytes_max, size_t *n, int extra __attribute__((__unused__)))
  4940. +{
  4941. + size_t rc;
  4942. + ZSTD_DStream *zstd;
  4943. + ZSTD_inBuffer in;
  4944. + ZSTD_outBuffer out;
  4945. +
  4946. + if ((zstd = ZSTD_createDStream()) == NULL) {
  4947. + return makeerror(newch, n, "No ZSTD decompression stream, %s",
  4948. + strerror(errno));
  4949. + }
  4950. +
  4951. + rc = ZSTD_DCtx_reset(zstd, ZSTD_reset_session_only);
  4952. + if (ZSTD_isError(rc))
  4953. + goto err;
  4954. +
  4955. + in.src = CCAST(const void *, old);
  4956. + in.size = *n;
  4957. + in.pos = 0;
  4958. + out.dst = RCAST(void *, *newch);
  4959. + out.size = bytes_max;
  4960. + out.pos = 0;
  4961. +
  4962. + rc = ZSTD_decompressStream(zstd, &out, &in);
  4963. + if (ZSTD_isError(rc))
  4964. + goto err;
  4965. +
  4966. + *n = out.pos;
  4967. +
  4968. + ZSTD_freeDStream(zstd);
  4969. +
  4970. + /* let's keep the nul-terminate tradition */
  4971. + (*newch)[*n] = '\0';
  4972. +
  4973. + return OKDATA;
  4974. +err:
  4975. + ZSTD_freeDStream(zstd);
  4976. + return makeerror(newch, n, "zstd error %d", ZSTD_getErrorCode(rc));
  4977. +}
  4978. +#endif
  4979. +
  4980. +#ifdef BUILTIN_LZLIB
  4981. +private int
  4982. +uncompresslzlib(const unsigned char *old, unsigned char **newch,
  4983. + size_t bytes_max, size_t *n, int extra __attribute__((__unused__)))
  4984. +{
  4985. + enum LZ_Errno err;
  4986. + size_t old_remaining = *n;
  4987. + size_t new_remaining = bytes_max;
  4988. + size_t total_read = 0;
  4989. + unsigned char *bufp;
  4990. + struct LZ_Decoder *dec;
  4991. +
  4992. + bufp = *newch;
  4993. +
  4994. + dec = LZ_decompress_open();
  4995. + if (!dec) {
  4996. + return makeerror(newch, n, "unable to allocate LZ_Decoder");
  4997. + }
  4998. + if (LZ_decompress_errno(dec) != LZ_ok)
  4999. + goto err;
  5000. +
  5001. + for (;;) {
  5002. + // LZ_decompress_read() stops at member boundaries, so we may
  5003. + // have more than one successful read after writing all data
  5004. + // we have.
  5005. + if (old_remaining > 0) {
  5006. + int wr = LZ_decompress_write(dec, old, old_remaining);
  5007. + if (wr < 0)
  5008. + goto err;
  5009. + old_remaining -= wr;
  5010. + old += wr;
  5011. + }
  5012. +
  5013. + int rd = LZ_decompress_read(dec, bufp, new_remaining);
  5014. + if (rd > 0) {
  5015. + new_remaining -= rd;
  5016. + bufp += rd;
  5017. + total_read += rd;
  5018. + }
  5019. +
  5020. + if (rd < 0 || LZ_decompress_errno(dec) != LZ_ok)
  5021. + goto err;
  5022. + if (new_remaining == 0)
  5023. + break;
  5024. + if (old_remaining == 0 && rd == 0)
  5025. + break;
  5026. + }
  5027. +
  5028. + LZ_decompress_close(dec);
  5029. + *n = total_read;
  5030. +
  5031. + /* let's keep the nul-terminate tradition */
  5032. + *bufp = '\0';
  5033. +
  5034. + return OKDATA;
  5035. +err:
  5036. + err = LZ_decompress_errno(dec);
  5037. + LZ_decompress_close(dec);
  5038. + return makeerror(newch, n, "lzlib error: %s", LZ_strerror(err));
  5039. }
  5040. #endif
  5041. @@ -705,6 +833,7 @@
  5042. va_list ap;
  5043. int rv;
  5044. + free(*buf);
  5045. va_start(ap, fmt);
  5046. rv = vasprintf(&msg, fmt, ap);
  5047. va_end(ap);
  5048. @@ -747,7 +876,7 @@
  5049. #else
  5050. if (dup2(fd, i) == -1) {
  5051. DPRINTF("dup(%d, %d) failed (%s)\n", fd, i, strerror(errno));
  5052. - exit(1);
  5053. + exit(EXIT_FAILURE);
  5054. }
  5055. close(v ? fd : fd);
  5056. #endif
  5057. @@ -804,15 +933,15 @@
  5058. pid = fork();
  5059. if (pid == -1) {
  5060. DPRINTF("Fork failed (%s)\n", strerror(errno));
  5061. - exit(1);
  5062. + return -1;
  5063. }
  5064. if (pid == 0) {
  5065. /* child */
  5066. if (swrite(fd, old, n) != CAST(ssize_t, n)) {
  5067. DPRINTF("Write failed (%s)\n", strerror(errno));
  5068. - exit(1);
  5069. + exit(EXIT_FAILURE);
  5070. }
  5071. - exit(0);
  5072. + exit(EXIT_SUCCESS);
  5073. }
  5074. /* parent */
  5075. return pid;
  5076. @@ -864,44 +993,79 @@
  5077. case METH_LZMA:
  5078. return "xzlib";
  5079. #endif
  5080. +#ifdef BUILTIN_ZSTDLIB
  5081. + case METH_ZSTD:
  5082. + return "zstd";
  5083. +#endif
  5084. +#ifdef BUILTIN_LZLIB
  5085. + case METH_LZIP:
  5086. + return "lzlib";
  5087. +#endif
  5088. default:
  5089. return compr[method].argv[0];
  5090. }
  5091. }
  5092. -private int
  5093. -uncompressbuf(int fd, size_t bytes_max, size_t method, const unsigned char *old,
  5094. - unsigned char **newch, size_t* n)
  5095. +private int (*
  5096. +getdecompressor(int method))(const unsigned char *, unsigned char **, size_t,
  5097. + size_t *, int)
  5098. {
  5099. - int fdp[3][2];
  5100. - int status, rv, w;
  5101. - pid_t pid;
  5102. - pid_t writepid = -1;
  5103. - size_t i;
  5104. - ssize_t r;
  5105. - char *const *args;
  5106. -#ifdef HAVE_POSIX_SPAWNP
  5107. - posix_spawn_file_actions_t fa;
  5108. -#endif
  5109. -
  5110. switch (method) {
  5111. #ifdef BUILTIN_DECOMPRESS
  5112. case METH_FROZEN:
  5113. - return uncompressgzipped(old, newch, bytes_max, n);
  5114. + return uncompressgzipped;
  5115. case METH_ZLIB:
  5116. - return uncompresszlib(old, newch, bytes_max, n, 1);
  5117. + return uncompresszlib;
  5118. #endif
  5119. #ifdef BUILTIN_BZLIB
  5120. case METH_BZIP:
  5121. - return uncompressbzlib(old, newch, bytes_max, n);
  5122. + return uncompressbzlib;
  5123. #endif
  5124. #ifdef BUILTIN_XZLIB
  5125. case METH_XZ:
  5126. case METH_LZMA:
  5127. - return uncompressxzlib(old, newch, bytes_max, n);
  5128. + return uncompressxzlib;
  5129. +#endif
  5130. +#ifdef BUILTIN_ZSTDLIB
  5131. + case METH_ZSTD:
  5132. + return uncompresszstd;
  5133. +#endif
  5134. +#ifdef BUILTIN_LZLIB
  5135. + case METH_LZIP:
  5136. + return uncompresslzlib;
  5137. #endif
  5138. default:
  5139. - break;
  5140. + return NULL;
  5141. + }
  5142. +}
  5143. +
  5144. +private int
  5145. +uncompressbuf(int fd, size_t bytes_max, size_t method, int nofork,
  5146. + const unsigned char *old, unsigned char **newch, size_t* n)
  5147. +{
  5148. + int fdp[3][2];
  5149. + int status, rv, w;
  5150. + pid_t pid;
  5151. + pid_t writepid = -1;
  5152. + size_t i;
  5153. + ssize_t r;
  5154. + char *const *args;
  5155. +#ifdef HAVE_POSIX_SPAWNP
  5156. + posix_spawn_file_actions_t fa;
  5157. +#endif
  5158. + int (*decompress)(const unsigned char *, unsigned char **,
  5159. + size_t, size_t *, int) = getdecompressor(method);
  5160. +
  5161. + *newch = CAST(unsigned char *, malloc(bytes_max + 1));
  5162. + if (*newch == NULL)
  5163. + return makeerror(newch, n, "No buffer, %s", strerror(errno));
  5164. +
  5165. + if (decompress) {
  5166. + if (nofork) {
  5167. + return makeerror(newch, n,
  5168. + "Fork is required to uncompress, but disabled");
  5169. + }
  5170. + return (*decompress)(old, newch, bytes_max, n, 1);
  5171. }
  5172. (void)fflush(stdout);
  5173. @@ -916,7 +1080,7 @@
  5174. * analyze two large compressed files, both will spawn
  5175. * an uncompressing child here, which writes out uncompressed data.
  5176. * We read some portion, then close the pipe, then waitpid() the child.
  5177. - * If uncompressed data is larger, child shound get EPIPE and exit.
  5178. + * If uncompressed data is larger, child should get EPIPE and exit.
  5179. * However, with *parallel* calls OTHER child may unintentionally
  5180. * inherit pipe fds, thus keeping pipe open and making writes in
  5181. * our child block instead of failing with EPIPE!
  5182. @@ -968,7 +1132,7 @@
  5183. (void)execvp(compr[method].argv[0], args);
  5184. dprintf(STDERR_FILENO, "exec `%s' failed, %s",
  5185. compr[method].argv[0], strerror(errno));
  5186. - _exit(1); /* _exit(), not exit(), because of vfork */
  5187. + _exit(EXIT_FAILURE); /* _exit(), not exit(), because of vfork */
  5188. }
  5189. #endif
  5190. /* parent */
  5191. @@ -979,39 +1143,41 @@
  5192. if (fd == -1) {
  5193. closefd(fdp[STDIN_FILENO], 0);
  5194. writepid = writechild(fdp[STDIN_FILENO][1], old, *n);
  5195. + if (writepid == (pid_t)-1) {
  5196. + rv = makeerror(newch, n, "Write to child failed, %s",
  5197. + strerror(errno));
  5198. + goto err;
  5199. + }
  5200. closefd(fdp[STDIN_FILENO], 1);
  5201. }
  5202. - *newch = CAST(unsigned char *, malloc(bytes_max + 1));
  5203. - if (*newch == NULL) {
  5204. - rv = makeerror(newch, n, "No buffer, %s",
  5205. - strerror(errno));
  5206. - goto err;
  5207. - }
  5208. rv = OKDATA;
  5209. - errno = 0;
  5210. r = sread(fdp[STDOUT_FILENO][0], *newch, bytes_max, 0);
  5211. - if (r == 0 && errno == 0)
  5212. - goto ok;
  5213. - if (r <= 0) {
  5214. - DPRINTF("Read stdout failed %d (%s)\n", fdp[STDOUT_FILENO][0],
  5215. - r != -1 ? strerror(errno) : "no data");
  5216. -
  5217. + if (r < 0) {
  5218. rv = ERRDATA;
  5219. - if (r == 0 &&
  5220. - (r = sread(fdp[STDERR_FILENO][0], *newch, bytes_max, 0)) > 0)
  5221. - {
  5222. - r = filter_error(*newch, r);
  5223. - goto ok;
  5224. - }
  5225. - free(*newch);
  5226. - if (r == 0)
  5227. - rv = makeerror(newch, n, "Read failed, %s",
  5228. - strerror(errno));
  5229. - else
  5230. - rv = makeerror(newch, n, "No data");
  5231. + DPRINTF("Read stdout failed %d (%s)\n", fdp[STDOUT_FILENO][0],
  5232. + strerror(errno));
  5233. goto err;
  5234. + }
  5235. + if (CAST(size_t, r) == bytes_max) {
  5236. + /*
  5237. + * close fd so that the child exits with sigpipe and ignore
  5238. + * errors, otherwise we risk the child blocking and never
  5239. + * exiting.
  5240. + */
  5241. + closefd(fdp[STDOUT_FILENO], 0);
  5242. + goto ok;
  5243. }
  5244. + if ((r = sread(fdp[STDERR_FILENO][0], *newch, bytes_max, 0)) > 0) {
  5245. + rv = ERRDATA;
  5246. + r = filter_error(*newch, r);
  5247. + goto ok;
  5248. + }
  5249. + if (r == 0)
  5250. + goto ok;
  5251. + rv = makeerror(newch, n, "Read stderr failed, %s",
  5252. + strerror(errno));
  5253. + goto err;
  5254. ok:
  5255. *n = r;
  5256. /* NUL terminate, as every buffer is handled here. */
  5257. @@ -1024,7 +1190,6 @@
  5258. w = waitpid(pid, &status, 0);
  5259. wait_err:
  5260. if (w == -1) {
  5261. - free(*newch);
  5262. rv = makeerror(newch, n, "Wait failed, %s", strerror(errno));
  5263. DPRINTF("Child wait return %#x\n", status);
  5264. } else if (!WIFEXITED(status)) {
  5265. --- a/src/ctime_r.c
  5266. +++ b/src/ctime_r.c
  5267. @@ -1,8 +1,8 @@
  5268. -/* $File: ctime_r.c,v 1.1 2012/05/15 17:14:36 christos Exp $ */
  5269. +/* $File: ctime_r.c,v 1.3 2022/09/24 20:30:13 christos Exp $ */
  5270. #include "file.h"
  5271. #ifndef lint
  5272. -FILE_RCSID("@(#)$File: ctime_r.c,v 1.1 2012/05/15 17:14:36 christos Exp $")
  5273. +FILE_RCSID("@(#)$File: ctime_r.c,v 1.3 2022/09/24 20:30:13 christos Exp $")
  5274. #endif /* lint */
  5275. #include <time.h>
  5276. #include <string.h>
  5277. --- a/src/der.c
  5278. +++ b/src/der.c
  5279. @@ -35,7 +35,7 @@
  5280. #include "file.h"
  5281. #ifndef lint
  5282. -FILE_RCSID("@(#)$File: der.c,v 1.24 2022/07/30 18:08:36 christos Exp $")
  5283. +FILE_RCSID("@(#)$File: der.c,v 1.27 2022/09/24 20:30:13 christos Exp $")
  5284. #endif
  5285. #else
  5286. #define SIZE_T_FORMAT "z"
  5287. @@ -270,7 +270,7 @@
  5288. DPRINTF(("%s: bad tag 1\n", __func__));
  5289. return -1;
  5290. }
  5291. - DPRINTF(("%s1: %d %" SIZE_T_FORMAT "u %u\n", __func__, ms->offset,
  5292. + DPRINTF(("%s1: %u %" SIZE_T_FORMAT "u %d\n", __func__, ms->offset,
  5293. offs, m->offset));
  5294. uint32_t tlen = getlength(b, &offs, len);
  5295. @@ -278,7 +278,7 @@
  5296. DPRINTF(("%s: bad tag 2\n", __func__));
  5297. return -1;
  5298. }
  5299. - DPRINTF(("%s2: %d %" SIZE_T_FORMAT "u %u\n", __func__, ms->offset,
  5300. + DPRINTF(("%s2: %u %" SIZE_T_FORMAT "u %u\n", __func__, ms->offset,
  5301. offs, tlen));
  5302. offs += ms->offset + m->offset;
  5303. @@ -286,14 +286,14 @@
  5304. #ifdef DEBUG_DER
  5305. size_t i;
  5306. for (i = 0; i < m->cont_level; i++)
  5307. - printf("cont_level[%" SIZE_T_FORMAT "u] = %u\n", i,
  5308. + printf("cont_level[%" SIZE_T_FORMAT "u] = %d\n", i,
  5309. ms->c.li[i].off);
  5310. #endif
  5311. if (m->cont_level != 0) {
  5312. if (offs + tlen > nbytes)
  5313. return -1;
  5314. ms->c.li[m->cont_level - 1].off = CAST(int, offs + tlen);
  5315. - DPRINTF(("cont_level[%u] = %u\n", m->cont_level - 1,
  5316. + DPRINTF(("cont_level[%u] = %d\n", m->cont_level - 1,
  5317. ms->c.li[m->cont_level - 1].off));
  5318. }
  5319. return CAST(int32_t, offs);
  5320. @@ -316,7 +316,7 @@
  5321. return -1;
  5322. }
  5323. - DPRINTF(("%s1: %d %" SIZE_T_FORMAT "u %u\n", __func__, ms->offset,
  5324. + DPRINTF(("%s1: %d %" SIZE_T_FORMAT "u %d\n", __func__, ms->offset,
  5325. offs, m->offset));
  5326. tlen = getlength(b, &offs, len);
  5327. --- a/src/dprintf.c
  5328. +++ b/src/dprintf.c
  5329. @@ -28,7 +28,7 @@
  5330. #include "file.h"
  5331. #ifndef lint
  5332. -FILE_RCSID("@(#)$File: dprintf.c,v 1.2 2018/09/09 20:33:28 christos Exp $")
  5333. +FILE_RCSID("@(#)$File: dprintf.c,v 1.4 2022/09/24 20:30:13 christos Exp $")
  5334. #endif /* lint */
  5335. #include <assert.h>
  5336. --- a/src/encoding.c
  5337. +++ b/src/encoding.c
  5338. @@ -35,7 +35,7 @@
  5339. #include "file.h"
  5340. #ifndef lint
  5341. -FILE_RCSID("@(#)$File: encoding.c,v 1.39 2022/09/13 18:46:07 christos Exp $")
  5342. +FILE_RCSID("@(#)$File: encoding.c,v 1.41 2022/09/24 20:30:13 christos Exp $")
  5343. #endif /* lint */
  5344. #include "magic.h"
  5345. --- a/src/file.c
  5346. +++ b/src/file.c
  5347. @@ -32,7 +32,7 @@
  5348. #include "file.h"
  5349. #ifndef lint
  5350. -FILE_RCSID("@(#)$File: file.c,v 1.204 2022/09/13 18:46:07 christos Exp $")
  5351. +FILE_RCSID("@(#)$File: file.c,v 1.212 2022/10/26 18:09:26 christos Exp $")
  5352. #endif /* lint */
  5353. #include "magic.h"
  5354. @@ -366,6 +366,8 @@
  5355. if (sandbox && enable_sandbox_full() == -1)
  5356. #endif
  5357. file_err(EXIT_FAILURE, "SECCOMP initialisation failed");
  5358. + if (sandbox)
  5359. + flags |= MAGIC_NO_COMPRESS_FORK;
  5360. #endif /* HAVE_LIBSECCOMP */
  5361. if (MAGIC_VERSION != magic_version())
  5362. @@ -512,11 +514,8 @@
  5363. size_t llen = 0;
  5364. int wid = 0, cwid;
  5365. int e = 0;
  5366. - size_t fi = 0, fimax = 100;
  5367. - char **flist = CAST(char **, malloc(sizeof(*flist) * fimax));
  5368. -
  5369. - if (flist == NULL)
  5370. -out: file_err(EXIT_FAILURE, "Cannot allocate memory for file list");
  5371. + size_t fi = 0, fimax = 0;
  5372. + char **flist = NULL;
  5373. if (strcmp("-", fn) == 0)
  5374. f = stdin;
  5375. @@ -530,26 +529,37 @@
  5376. while ((len = getline(&line, &llen, f)) > 0) {
  5377. if (line[len - 1] == '\n')
  5378. line[len - 1] = '\0';
  5379. + cwid = file_mbswidth(ms, line);
  5380. + if (nobuffer) {
  5381. + e |= process(ms, line, cwid);
  5382. + free(line);
  5383. + line = NULL;
  5384. + llen = 0;
  5385. + continue;
  5386. + }
  5387. + if (cwid > wid)
  5388. + wid = cwid;
  5389. if (fi >= fimax) {
  5390. fimax += 100;
  5391. char **nf = CAST(char **,
  5392. realloc(flist, fimax * sizeof(*flist)));
  5393. - if (nf == NULL)
  5394. - goto out;
  5395. + if (nf == NULL) {
  5396. + file_err(EXIT_FAILURE,
  5397. + "Cannot allocate memory for file list");
  5398. + }
  5399. flist = nf;
  5400. }
  5401. flist[fi++] = line;
  5402. - cwid = file_mbswidth(ms, line);
  5403. - if (cwid > wid)
  5404. - wid = cwid;
  5405. line = NULL;
  5406. llen = 0;
  5407. }
  5408. - fimax = fi;
  5409. - for (fi = 0; fi < fimax; fi++) {
  5410. - e |= process(ms, flist[fi], wid);
  5411. - free(flist[fi]);
  5412. + if (!nobuffer) {
  5413. + fimax = fi;
  5414. + for (fi = 0; fi < fimax; fi++) {
  5415. + e |= process(ms, flist[fi], wid);
  5416. + free(flist[fi]);
  5417. + }
  5418. }
  5419. free(flist);
  5420. @@ -561,10 +571,10 @@
  5421. private void
  5422. file_octal(unsigned char c)
  5423. {
  5424. - putc('\\', stdout);
  5425. - putc(((c >> 6) & 7) + '0', stdout);
  5426. - putc(((c >> 3) & 7) + '0', stdout);
  5427. - putc(((c >> 0) & 7) + '0', stdout);
  5428. + (void)putc('\\', stdout);
  5429. + (void)putc(((c >> 6) & 7) + '0', stdout);
  5430. + (void)putc(((c >> 3) & 7) + '0', stdout);
  5431. + (void)putc(((c >> 0) & 7) + '0', stdout);
  5432. }
  5433. private void
  5434. @@ -591,7 +601,7 @@
  5435. inname += bytesconsumed;
  5436. n -= bytesconsumed;
  5437. if (iswprint(nextchar)) {
  5438. - printf("%lc", nextchar);
  5439. + printf("%lc", (wint_t)nextchar);
  5440. continue;
  5441. }
  5442. /* XXX: What if it is > 255? */
  5443. @@ -602,7 +612,7 @@
  5444. for (i = 0; i < n; i++) {
  5445. unsigned char c = CAST(unsigned char, inname[i]);
  5446. if (isprint(c)) {
  5447. - putc(c);
  5448. + (void)putc(c, stdout);
  5449. continue;
  5450. }
  5451. file_octal(c);
  5452. @@ -698,8 +708,8 @@
  5453. if (!def)
  5454. return;
  5455. if (((def & 1) && posixly) || ((def & 2) && !posixly))
  5456. - fprintf(stdout, " (default)");
  5457. - fputc('\n', stdout);
  5458. + (void)fprintf(stdout, " (default)");
  5459. + (void)putc('\n', stdout);
  5460. }
  5461. private void
  5462. @@ -711,7 +721,7 @@
  5463. p = CCAST(char *, strchr(opts, '%'));
  5464. if (p == NULL) {
  5465. - fprintf(stdout, "%s", opts);
  5466. + (void)fprintf(stdout, "%s", opts);
  5467. defprint(def);
  5468. return;
  5469. }
  5470. @@ -719,26 +729,26 @@
  5471. for (sp = p - 1; sp > opts && *sp == ' '; sp--)
  5472. continue;
  5473. - fprintf(stdout, "%.*s", CAST(int, p - opts), opts);
  5474. + (void)printf("%.*s", CAST(int, p - opts), opts);
  5475. pad = (int)CAST(int, p - sp - 1);
  5476. switch (*++p) {
  5477. case 'e':
  5478. comma = 0;
  5479. for (i = 0; i < __arraycount(nv); i++) {
  5480. - fprintf(stdout, "%s%s", comma++ ? ", " : "", nv[i].name);
  5481. + (void)printf("%s%s", comma++ ? ", " : "", nv[i].name);
  5482. if (i && i % 5 == 0 && i != __arraycount(nv) - 1) {
  5483. - fprintf(stdout, ",\n%*s", pad, "");
  5484. + (void)printf(",\n%*s", pad, "");
  5485. comma = 0;
  5486. }
  5487. }
  5488. break;
  5489. case 'P':
  5490. for (i = 0; i < __arraycount(pm); i++) {
  5491. - fprintf(stdout, "%9s %7zu %s", pm[i].name, pm[i].def,
  5492. + (void)printf("%9s %7zu %s", pm[i].name, pm[i].def,
  5493. pm[i].desc);
  5494. if (i != __arraycount(pm) - 1)
  5495. - fprintf(stdout, "\n%*s", pad, "");
  5496. + (void)printf("\n%*s", pad, "");
  5497. }
  5498. break;
  5499. default:
  5500. @@ -746,7 +756,7 @@
  5501. *p);
  5502. break;
  5503. }
  5504. - fprintf(stdout, "%s", opts + (p - opts) + 1);
  5505. + (void)printf("%s", opts + (p - opts) + 1);
  5506. }
  5507. @@ -758,15 +768,15 @@
  5508. "Determine type of FILEs.\n"
  5509. "\n", stdout);
  5510. #define OPT(shortname, longname, opt, def, doc) \
  5511. - fprintf(stdout, " -%c, --" longname, shortname), \
  5512. + (void)printf(" -%c, --" longname, shortname), \
  5513. docprint(doc, def);
  5514. #define OPT_LONGONLY(longname, opt, def, doc, id) \
  5515. - fprintf(stdout, " --" longname), \
  5516. + (void)printf(" --" longname), \
  5517. docprint(doc, def);
  5518. #include "file_opts.h"
  5519. #undef OPT
  5520. #undef OPT_LONGONLY
  5521. - fprintf(stdout, "\nReport bugs to https://bugs.astron.com/\n");
  5522. + (void)printf("\nReport bugs to https://bugs.astron.com/\n");
  5523. exit(EXIT_SUCCESS);
  5524. }
  5525. @@ -791,11 +801,11 @@
  5526. int se = errno;
  5527. va_start(ap, fmt);
  5528. - fprintf(stderr, "%s: ", file_progname);
  5529. - vfprintf(stderr, fmt, ap);
  5530. + (void)fprintf(stderr, "%s: ", file_progname);
  5531. + (void)vfprintf(stderr, fmt, ap);
  5532. va_end(ap);
  5533. if (se)
  5534. - fprintf(stderr, " (%s)\n", strerror(se));
  5535. + (void)fprintf(stderr, " (%s)\n", strerror(se));
  5536. else
  5537. fputc('\n', stderr);
  5538. exit(e);
  5539. @@ -807,10 +817,10 @@
  5540. va_list ap;
  5541. va_start(ap, fmt);
  5542. - fprintf(stderr, "%s: ", file_progname);
  5543. - vfprintf(stderr, fmt, ap);
  5544. + (void)fprintf(stderr, "%s: ", file_progname);
  5545. + (void)vfprintf(stderr, fmt, ap);
  5546. va_end(ap);
  5547. - fprintf(stderr, "\n");
  5548. + (void)fprintf(stderr, "\n");
  5549. exit(e);
  5550. }
  5551. @@ -821,11 +831,11 @@
  5552. int se = errno;
  5553. va_start(ap, fmt);
  5554. - fprintf(stderr, "%s: ", file_progname);
  5555. - vfprintf(stderr, fmt, ap);
  5556. + (void)fprintf(stderr, "%s: ", file_progname);
  5557. + (void)vfprintf(stderr, fmt, ap);
  5558. va_end(ap);
  5559. if (se)
  5560. - fprintf(stderr, " (%s)\n", strerror(se));
  5561. + (void)fprintf(stderr, " (%s)\n", strerror(se));
  5562. else
  5563. fputc('\n', stderr);
  5564. errno = se;
  5565. @@ -838,9 +848,9 @@
  5566. int se = errno;
  5567. va_start(ap, fmt);
  5568. - fprintf(stderr, "%s: ", file_progname);
  5569. - vfprintf(stderr, fmt, ap);
  5570. + (void)fprintf(stderr, "%s: ", file_progname);
  5571. + (void)vfprintf(stderr, fmt, ap);
  5572. va_end(ap);
  5573. - fprintf(stderr, "\n");
  5574. + (void)fprintf(stderr, "\n");
  5575. errno = se;
  5576. }
  5577. --- a/src/file.h
  5578. +++ b/src/file.h
  5579. @@ -27,7 +27,7 @@
  5580. */
  5581. /*
  5582. * file.h - definitions for file(1) program
  5583. - * @(#)$File: file.h,v 1.237 2022/09/10 13:21:42 christos Exp $
  5584. + * @(#)$File: file.h,v 1.240 2022/10/02 12:53:28 christos Exp $
  5585. */
  5586. #ifndef __file_h__
  5587. @@ -483,8 +483,8 @@
  5588. size_t bytes_max; /* number of bytes to read from file */
  5589. size_t encoding_max; /* bytes to look for encoding */
  5590. #ifndef FILE_BYTES_MAX
  5591. -# define FILE_BYTES_MAX (1024 * 1024) /* how much of the file to look at */
  5592. -#endif
  5593. +# define FILE_BYTES_MAX (7 * 1024 * 1024)/* how much of the file to look at */
  5594. +#endif /* above 0x6ab0f4 map offset for HelveticaNeue.dfont */
  5595. #define FILE_ELF_NOTES_MAX 256
  5596. #define FILE_ELF_PHNUM_MAX 2048
  5597. #define FILE_ELF_SHNUM_MAX 32768
  5598. --- a/src/file_opts.h
  5599. +++ b/src/file_opts.h
  5600. @@ -37,7 +37,7 @@
  5601. " performed for file. Valid tests are:\n"
  5602. " %e\n")
  5603. OPT_LONGONLY("exclude-quiet", 1, 0,
  5604. - " TEST like exclude, but ignore unknown tests\n", OPT_EXCLUDE_QUIET)
  5605. + " TEST like exclude, but ignore unknown tests\n", OPT_EXCLUDE_QUIET)
  5606. OPT('f', "files-from", 1, 0,
  5607. " FILE read the filenames to be examined from FILE\n")
  5608. OPT('F', "separator", 1, 0,
  5609. @@ -59,9 +59,9 @@
  5610. " list magic strength\n")
  5611. #ifdef S_IFLNK
  5612. OPT('L', "dereference", 0, 1,
  5613. - " follow symlinks")
  5614. + " follow symlinks (default if POSIXLY_CORRECT is set)")
  5615. OPT('h', "no-dereference", 0, 2,
  5616. - " don't follow symlinks")
  5617. + " don't follow symlinks (default if POSIXLY_CORRECT is not set)")
  5618. #endif
  5619. OPT('n', "no-buffer", 0, 0,
  5620. " do not buffer output\n")
  5621. --- a/src/fmtcheck.c
  5622. +++ b/src/fmtcheck.c
  5623. @@ -30,7 +30,7 @@
  5624. #include "file.h"
  5625. #ifndef lint
  5626. -FILE_RCSID("@(#)$File: fmtcheck.c,v 1.4 2022/09/13 18:46:07 christos Exp $")
  5627. +FILE_RCSID("@(#)$File: fmtcheck.c,v 1.6 2022/09/24 20:30:13 christos Exp $")
  5628. #endif /* lint */
  5629. #include <stdio.h>
  5630. --- a/src/fsmagic.c
  5631. +++ b/src/fsmagic.c
  5632. @@ -32,7 +32,7 @@
  5633. #include "file.h"
  5634. #ifndef lint
  5635. -FILE_RCSID("@(#)$File: fsmagic.c,v 1.82 2022/04/11 18:14:41 christos Exp $")
  5636. +FILE_RCSID("@(#)$File: fsmagic.c,v 1.84 2022/09/24 20:30:13 christos Exp $")
  5637. #endif /* lint */
  5638. #include "magic.h"
  5639. --- a/src/funcs.c
  5640. +++ b/src/funcs.c
  5641. @@ -27,7 +27,7 @@
  5642. #include "file.h"
  5643. #ifndef lint
  5644. -FILE_RCSID("@(#)$File: funcs.c,v 1.131 2022/09/13 18:46:07 christos Exp $")
  5645. +FILE_RCSID("@(#)$File: funcs.c,v 1.135 2022/10/09 13:44:47 christos Exp $")
  5646. #endif /* lint */
  5647. #include "magic.h"
  5648. @@ -656,10 +656,43 @@
  5649. return rv;
  5650. }
  5651. +private int
  5652. +check_regex(struct magic_set *ms, const char *pat)
  5653. +{
  5654. + char sbuf[512];
  5655. + unsigned char oc = '\0';
  5656. +
  5657. + for (const char *p = pat; *p; p++) {
  5658. + unsigned char c = *p;
  5659. + // Avoid repetition
  5660. + if (c == oc && strchr("?*+{", c) != NULL) {
  5661. + size_t len = strlen(pat);
  5662. + file_magwarn(ms,
  5663. + "repetition-operator operand `%c' "
  5664. + "invalid in regex `%s'", c,
  5665. + file_printable(ms, sbuf, sizeof(sbuf), pat, len));
  5666. + return -1;
  5667. + }
  5668. + oc = c;
  5669. + if (isprint(c) || isspace(c) || c == '\b'
  5670. + || c == 0x8a) // XXX: apple magic fixme
  5671. + continue;
  5672. + size_t len = strlen(pat);
  5673. + file_magwarn(ms,
  5674. + "non-ascii characters in regex \\%#o `%s'",
  5675. + c, file_printable(ms, sbuf, sizeof(sbuf), pat, len));
  5676. + return -1;
  5677. + }
  5678. + return 0;
  5679. +}
  5680. +
  5681. protected int
  5682. file_regcomp(struct magic_set *ms file_locale_used, file_regex_t *rx,
  5683. const char *pat, int flags)
  5684. {
  5685. + if (check_regex(ms, pat) == -1)
  5686. + return -1;
  5687. +
  5688. #ifdef USE_C_LOCALE
  5689. locale_t old = uselocale(ms->c_lc_ctype);
  5690. assert(old != NULL);
  5691. @@ -677,10 +710,11 @@
  5692. (void)setlocale(LC_CTYPE, old);
  5693. #endif
  5694. if (rc > 0 && (ms->flags & MAGIC_CHECK)) {
  5695. - char errmsg[512];
  5696. + char errmsg[512], buf[512];
  5697. (void)regerror(rc, rx, errmsg, sizeof(errmsg));
  5698. - file_magerror(ms, "regex error %d for `%s', (%s)", rc, pat,
  5699. + file_magerror(ms, "regex error %d for `%s', (%s)", rc,
  5700. + file_printable(ms, buf, sizeof(buf), pat, strlen(pat)),
  5701. errmsg);
  5702. }
  5703. return rc;
  5704. --- a/src/getopt_long.c
  5705. +++ b/src/getopt_long.c
  5706. @@ -32,7 +32,7 @@
  5707. #include "file.h"
  5708. #ifndef lint
  5709. -FILE_RCSID("@(#)$File: getopt_long.c,v 1.7 2018/09/09 20:33:28 christos Exp $")
  5710. +FILE_RCSID("@(#)$File: getopt_long.c,v 1.9 2022/09/24 20:30:13 christos Exp $")
  5711. #endif /* lint */
  5712. #include <assert.h>
  5713. --- a/src/gmtime_r.c
  5714. +++ b/src/gmtime_r.c
  5715. @@ -1,8 +1,8 @@
  5716. -/* $File: gmtime_r.c,v 1.2 2015/07/11 14:41:37 christos Exp $ */
  5717. +/* $File: gmtime_r.c,v 1.4 2022/09/24 20:30:13 christos Exp $ */
  5718. #include "file.h"
  5719. #ifndef lint
  5720. -FILE_RCSID("@(#)$File: gmtime_r.c,v 1.2 2015/07/11 14:41:37 christos Exp $")
  5721. +FILE_RCSID("@(#)$File: gmtime_r.c,v 1.4 2022/09/24 20:30:13 christos Exp $")
  5722. #endif /* lint */
  5723. #include <time.h>
  5724. #include <string.h>
  5725. --- a/src/is_csv.c
  5726. +++ b/src/is_csv.c
  5727. @@ -32,7 +32,7 @@
  5728. #include "file.h"
  5729. #ifndef lint
  5730. -FILE_RCSID("@(#)$File: is_csv.c,v 1.7 2022/05/28 00:44:22 christos Exp $")
  5731. +FILE_RCSID("@(#)$File: is_csv.c,v 1.10 2022/09/24 20:30:13 christos Exp $")
  5732. #endif
  5733. #include <string.h>
  5734. @@ -174,7 +174,7 @@
  5735. int
  5736. main(int argc, char *argv[])
  5737. {
  5738. - int fd, rv;
  5739. + int fd;
  5740. struct stat st;
  5741. unsigned char *p;
  5742. --- a/src/is_json.c
  5743. +++ b/src/is_json.c
  5744. @@ -32,7 +32,7 @@
  5745. #include "file.h"
  5746. #ifndef lint
  5747. -FILE_RCSID("@(#)$File: is_json.c,v 1.26 2022/09/13 18:46:07 christos Exp $")
  5748. +FILE_RCSID("@(#)$File: is_json.c,v 1.30 2022/09/27 19:12:40 christos Exp $")
  5749. #endif
  5750. #include "magic.h"
  5751. @@ -440,7 +440,7 @@
  5752. return 1;
  5753. if (mime) {
  5754. if (file_printf(ms, "application/%s",
  5755. - jt == 1 ? "json" : "x-ndjason") == -1)
  5756. + jt == 1 ? "json" : "x-ndjson") == -1)
  5757. return -1;
  5758. return 1;
  5759. }
  5760. @@ -475,7 +475,7 @@
  5761. int
  5762. main(int argc, char *argv[])
  5763. {
  5764. - int fd, rv;
  5765. + int fd;
  5766. struct stat st;
  5767. unsigned char *p;
  5768. size_t stats[JSON_MAX];
  5769. --- a/src/is_tar.c
  5770. +++ b/src/is_tar.c
  5771. @@ -40,7 +40,7 @@
  5772. #include "file.h"
  5773. #ifndef lint
  5774. -FILE_RCSID("@(#)$File: is_tar.c,v 1.47 2022/09/13 18:46:07 christos Exp $")
  5775. +FILE_RCSID("@(#)$File: is_tar.c,v 1.49 2022/09/24 20:30:13 christos Exp $")
  5776. #endif
  5777. #include "magic.h"
  5778. --- a/src/localtime_r.c
  5779. +++ b/src/localtime_r.c
  5780. @@ -1,8 +1,8 @@
  5781. -/* $File: localtime_r.c,v 1.2 2015/07/11 14:41:37 christos Exp $ */
  5782. +/* $File: localtime_r.c,v 1.4 2022/09/24 20:30:13 christos Exp $ */
  5783. #include "file.h"
  5784. #ifndef lint
  5785. -FILE_RCSID("@(#)$File: localtime_r.c,v 1.2 2015/07/11 14:41:37 christos Exp $")
  5786. +FILE_RCSID("@(#)$File: localtime_r.c,v 1.4 2022/09/24 20:30:13 christos Exp $")
  5787. #endif /* lint */
  5788. #include <time.h>
  5789. #include <string.h>
  5790. --- a/src/magic.c
  5791. +++ b/src/magic.c
  5792. @@ -33,7 +33,7 @@
  5793. #include "file.h"
  5794. #ifndef lint
  5795. -FILE_RCSID("@(#)$File: magic.c,v 1.117 2021/12/06 15:33:00 christos Exp $")
  5796. +FILE_RCSID("@(#)$File: magic.c,v 1.119 2022/09/24 20:30:13 christos Exp $")
  5797. #endif /* lint */
  5798. #include "magic.h"
  5799. --- a/src/magic.h.in
  5800. +++ b/src/magic.h.in
  5801. @@ -47,6 +47,8 @@
  5802. * extensions */
  5803. #define MAGIC_COMPRESS_TRANSP 0x2000000 /* Check inside compressed files
  5804. * but not report compression */
  5805. +#define MAGIC_NO_COMPRESS_FORK 0x4000000 /* Don't allow decompression that
  5806. + * needs to fork */
  5807. #define MAGIC_NODESC (MAGIC_EXTENSION|MAGIC_MIME|MAGIC_APPLE)
  5808. #define MAGIC_NO_CHECK_COMPRESS 0x0001000 /* Don't check for compressed files */
  5809. --- a/src/memtest.c
  5810. +++ b/src/memtest.c
  5811. @@ -24,9 +24,10 @@
  5812. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  5813. * SUCH DAMAGE.
  5814. */
  5815. +#include "file.h"
  5816. #ifndef lint
  5817. -FILE_RCSID("@(#)$File: memtest.c,v 1.3 2022/09/13 18:46:07 christos Exp $")
  5818. +FILE_RCSID("@(#)$File: memtest.c,v 1.6 2022/09/24 20:30:13 christos Exp $")
  5819. #endif
  5820. #include <sys/types.h>
  5821. --- a/src/pread.c
  5822. +++ b/src/pread.c
  5823. @@ -1,6 +1,6 @@
  5824. #include "file.h"
  5825. #ifndef lint
  5826. -FILE_RCSID("@(#)$File: pread.c,v 1.3 2014/09/15 19:11:25 christos Exp $")
  5827. +FILE_RCSID("@(#)$File: pread.c,v 1.5 2022/09/24 20:30:13 christos Exp $")
  5828. #endif /* lint */
  5829. #include <fcntl.h>
  5830. #include <unistd.h>
  5831. --- a/src/print.c
  5832. +++ b/src/print.c
  5833. @@ -32,7 +32,7 @@
  5834. #include "file.h"
  5835. #ifndef lint
  5836. -FILE_RCSID("@(#)$File: print.c,v 1.92 2022/09/10 13:21:42 christos Exp $")
  5837. +FILE_RCSID("@(#)$File: print.c,v 1.96 2022/09/27 01:58:20 christos Exp $")
  5838. #endif /* lint */
  5839. #include <string.h>
  5840. @@ -52,7 +52,7 @@
  5841. static const char optyp[] = { FILE_OPS };
  5842. char tbuf[256];
  5843. - (void) fprintf(stderr, "%u: %.*s %u", m->lineno,
  5844. + (void) fprintf(stderr, "%u: %.*s %d", m->lineno,
  5845. (m->cont_level & 7) + 1, ">>>>>>>>", m->offset);
  5846. if (m->flag & INDIR) {
  5847. @@ -62,7 +62,7 @@
  5848. "*bad in_type*");
  5849. if (m->in_op & FILE_OPINVERSE)
  5850. (void) fputc('~', stderr);
  5851. - (void) fprintf(stderr, "%c%u),",
  5852. + (void) fprintf(stderr, "%c%d),",
  5853. (CAST(size_t, m->in_op & FILE_OPS_MASK) <
  5854. __arraycount(optyp)) ?
  5855. optyp[m->in_op & FILE_OPS_MASK] : '?', m->in_offset);
  5856. @@ -134,7 +134,7 @@
  5857. case FILE_BESHORT:
  5858. case FILE_BELONG:
  5859. case FILE_INDIRECT:
  5860. - (void) fprintf(stderr, "%d", m->value.l);
  5861. + (void) fprintf(stderr, "%d", CAST(int32_t, m->value.l));
  5862. break;
  5863. case FILE_BEQUAD:
  5864. case FILE_LEQUAD:
  5865. @@ -250,7 +250,7 @@
  5866. /* cuz we use stdout for most, stderr here */
  5867. (void) fflush(stdout);
  5868. - if (ms->file)
  5869. + if (ms && ms->file)
  5870. (void) fprintf(stderr, "%s, %lu: ", ms->file,
  5871. CAST(unsigned long, ms->line));
  5872. (void) fprintf(stderr, "Warning: ");
  5873. @@ -263,7 +263,8 @@
  5874. protected const char *
  5875. file_fmtvarint(char *buf, size_t blen, const unsigned char *us, int t)
  5876. {
  5877. - snprintf(buf, blen, "%jd", file_varint2uintmax_t(us, t, NULL));
  5878. + snprintf(buf, blen, "%jd", CAST(intmax_t,
  5879. + file_varint2uintmax_t(us, t, NULL)));
  5880. return buf;
  5881. }
  5882. --- a/src/readcdf.c
  5883. +++ b/src/readcdf.c
  5884. @@ -26,7 +26,7 @@
  5885. #include "file.h"
  5886. #ifndef lint
  5887. -FILE_RCSID("@(#)$File: readcdf.c,v 1.76 2022/01/17 16:59:01 christos Exp $")
  5888. +FILE_RCSID("@(#)$File: readcdf.c,v 1.78 2022/09/24 20:30:13 christos Exp $")
  5889. #endif
  5890. #include <assert.h>
  5891. --- a/src/readelf.c
  5892. +++ b/src/readelf.c
  5893. @@ -27,7 +27,7 @@
  5894. #include "file.h"
  5895. #ifndef lint
  5896. -FILE_RCSID("@(#)$File: readelf.c,v 1.182 2022/07/31 16:01:01 christos Exp $")
  5897. +FILE_RCSID("@(#)$File: readelf.c,v 1.186 2022/09/24 20:30:13 christos Exp $")
  5898. #endif
  5899. #ifdef BUILTIN_ELF
  5900. @@ -451,6 +451,10 @@
  5901. if (file_printf(ms, " %u.%u", ver_maj, ver_min) == -1)
  5902. return -1;
  5903. + if (ver_maj >= 9) {
  5904. + ver_patch += 100 * ver_rel;
  5905. + ver_rel = 0;
  5906. + }
  5907. if (ver_rel == 0 && ver_patch != 0) {
  5908. if (file_printf(ms, ".%u", ver_patch) == -1)
  5909. return -1;
  5910. @@ -460,8 +464,7 @@
  5911. return -1;
  5912. ver_rel -= 26;
  5913. }
  5914. - if (file_printf(ms, "%c", 'A' + ver_rel - 1)
  5915. - == -1)
  5916. + if (file_printf(ms, "%c", 'A' + ver_rel - 1) == -1)
  5917. return -1;
  5918. }
  5919. }
  5920. --- a/src/seccomp.c
  5921. +++ b/src/seccomp.c
  5922. @@ -27,7 +27,7 @@
  5923. #include "file.h"
  5924. #ifndef lint
  5925. -FILE_RCSID("@(#)$File: seccomp.c,v 1.22 2022/07/30 16:49:18 christos Exp $")
  5926. +FILE_RCSID("@(#)$File: seccomp.c,v 1.24 2022/09/24 20:30:13 christos Exp $")
  5927. #endif /* lint */
  5928. #if HAVE_LIBSECCOMP
  5929. --- a/src/softmagic.c
  5930. +++ b/src/softmagic.c
  5931. @@ -32,11 +32,12 @@
  5932. #include "file.h"
  5933. #ifndef lint
  5934. -FILE_RCSID("@(#)$File: softmagic.c,v 1.328 2022/09/13 18:46:07 christos Exp $")
  5935. +FILE_RCSID("@(#)$File: softmagic.c,v 1.337 2022/12/14 14:24:36 christos Exp $")
  5936. #endif /* lint */
  5937. #include "magic.h"
  5938. #include <assert.h>
  5939. +#include <math.h>
  5940. #include <string.h>
  5941. #include <ctype.h>
  5942. #include <stdlib.h>
  5943. @@ -45,11 +46,11 @@
  5944. private int match(struct magic_set *, struct magic *, file_regex_t **, size_t,
  5945. const struct buffer *, size_t, int, int, int, uint16_t *,
  5946. - uint16_t *, int *, int *, int *, int *);
  5947. + uint16_t *, int *, int *, int *, int *, int *);
  5948. private int mget(struct magic_set *, struct magic *, const struct buffer *,
  5949. const unsigned char *, size_t,
  5950. size_t, unsigned int, int, int, int, uint16_t *,
  5951. - uint16_t *, int *, int *, int *, int *);
  5952. + uint16_t *, int *, int *, int *, int *, int *);
  5953. private int msetoffset(struct magic_set *, struct magic *, struct buffer *,
  5954. const struct buffer *, size_t, unsigned int);
  5955. private int magiccheck(struct magic_set *, struct magic *, file_regex_t **);
  5956. @@ -118,7 +119,7 @@
  5957. uint16_t *indir_count, uint16_t *name_count, int mode, int text)
  5958. {
  5959. struct mlist *ml;
  5960. - int rv = 0, printed_something = 0, need_separator = 0;
  5961. + int rv = 0, printed_something = 0, need_separator = 0, firstline = 1;
  5962. uint16_t nc, ic;
  5963. if (name_count == NULL) {
  5964. @@ -133,7 +134,8 @@
  5965. for (ml = ms->mlist[0]->next; ml != ms->mlist[0]; ml = ml->next) {
  5966. int ret = match(ms, ml->magic, ml->magic_rxcomp, ml->nmagic, b,
  5967. 0, mode, text, 0, indir_count, name_count,
  5968. - &printed_something, &need_separator, NULL, NULL);
  5969. + &printed_something, &need_separator, &firstline,
  5970. + NULL, NULL);
  5971. switch (ret) {
  5972. case -1:
  5973. return ret;
  5974. @@ -205,15 +207,13 @@
  5975. match(struct magic_set *ms, struct magic *magic, file_regex_t **magic_rxcomp,
  5976. size_t nmagic, const struct buffer *b, size_t offset, int mode, int text,
  5977. int flip, uint16_t *indir_count, uint16_t *name_count,
  5978. - int *printed_something, int *need_separator, int *returnval,
  5979. - int *found_match)
  5980. + int *printed_something, int *need_separator, int *firstline,
  5981. + int *returnval, int *found_match)
  5982. {
  5983. uint32_t magindex = 0;
  5984. unsigned int cont_level = 0;
  5985. int found_matchv = 0; /* if a match is found it is set to 1*/
  5986. int returnvalv = 0, e;
  5987. - /* a flag to print X\n X\n- X */
  5988. - int firstline = !(*printed_something || *need_separator);
  5989. struct buffer bb;
  5990. int print = (ms->flags & MAGIC_NODESC) == 0;
  5991. @@ -257,7 +257,8 @@
  5992. switch (mget(ms, m, b, CAST(const unsigned char *, bb.fbuf),
  5993. bb.flen, offset, cont_level,
  5994. mode, text, flip, indir_count, name_count,
  5995. - printed_something, need_separator, returnval, found_match))
  5996. + printed_something, need_separator, firstline, returnval,
  5997. + found_match))
  5998. {
  5999. case -1:
  6000. return -1;
  6001. @@ -290,7 +291,7 @@
  6002. goto flush;
  6003. }
  6004. - if ((e = handle_annotation(ms, m, firstline)) != 0)
  6005. + if ((e = handle_annotation(ms, m, *firstline)) != 0)
  6006. {
  6007. *found_match = 1;
  6008. *need_separator = 1;
  6009. @@ -309,7 +310,7 @@
  6010. *returnval = 1;
  6011. *need_separator = 1;
  6012. *printed_something = 1;
  6013. - if (print_sep(ms, firstline) == -1)
  6014. + if (print_sep(ms, *firstline) == -1)
  6015. return -1;
  6016. if (mprint(ms, m) == -1)
  6017. return -1;
  6018. @@ -368,7 +369,7 @@
  6019. bb.fbuf), bb.flen, offset,
  6020. cont_level, mode, text, flip, indir_count,
  6021. name_count, printed_something, need_separator,
  6022. - returnval, found_match)) {
  6023. + firstline, returnval, found_match)) {
  6024. case -1:
  6025. return -1;
  6026. case 0:
  6027. @@ -405,7 +406,7 @@
  6028. } else
  6029. ms->c.li[cont_level].got_match = 1;
  6030. - if ((e = handle_annotation(ms, m, firstline))
  6031. + if ((e = handle_annotation(ms, m, *firstline))
  6032. != 0) {
  6033. *found_match = 1;
  6034. *need_separator = 1;
  6035. @@ -431,7 +432,7 @@
  6036. */
  6037. if (!*printed_something) {
  6038. *printed_something = 1;
  6039. - if (print_sep(ms, firstline)
  6040. + if (print_sep(ms, *firstline)
  6041. == -1)
  6042. return -1;
  6043. }
  6044. @@ -467,14 +468,14 @@
  6045. }
  6046. }
  6047. if (*printed_something) {
  6048. - firstline = 0;
  6049. + *firstline = 0;
  6050. }
  6051. if (*found_match) {
  6052. if ((ms->flags & MAGIC_CONTINUE) == 0)
  6053. return *returnval;
  6054. // So that we print a separator
  6055. *printed_something = 0;
  6056. - firstline = 0;
  6057. + *firstline = 0;
  6058. }
  6059. cont_level = 0;
  6060. }
  6061. @@ -1320,6 +1321,7 @@
  6062. mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
  6063. const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
  6064. {
  6065. + size_t size = sizeof(*p);
  6066. /*
  6067. * Note: FILE_SEARCH and FILE_REGEX do not actually copy
  6068. * anything, but setup pointers into the source
  6069. @@ -1417,6 +1419,9 @@
  6070. }
  6071. case FILE_STRING: /* XXX - these two should not need */
  6072. case FILE_PSTRING: /* to copy anything, but do anyway. */
  6073. + if (m->str_range != 0 && m->str_range < sizeof(*p))
  6074. + size = m->str_range;
  6075. + break;
  6076. default:
  6077. break;
  6078. }
  6079. @@ -1432,10 +1437,10 @@
  6080. (void)memset(p, '\0', sizeof(*p));
  6081. return 0;
  6082. }
  6083. - if (nbytes - offset < sizeof(*p))
  6084. + if (nbytes - offset < size)
  6085. nbytes = nbytes - offset;
  6086. else
  6087. - nbytes = sizeof(*p);
  6088. + nbytes = size;
  6089. (void)memcpy(p, s + offset, nbytes);
  6090. @@ -1449,10 +1454,17 @@
  6091. return 0;
  6092. }
  6093. -private uint32_t
  6094. -do_ops(struct magic *m, intmax_t lhs, intmax_t off)
  6095. +private int
  6096. +do_ops(struct magic *m, uint32_t *rv, intmax_t lhs, intmax_t off)
  6097. {
  6098. intmax_t offset;
  6099. + // On purpose not INTMAX_MAX
  6100. + if (lhs >= INT_MAX || lhs <= INT_MIN ||
  6101. + off >= INT_MAX || off <= INT_MIN) {
  6102. + fprintf(stderr, "lhs/off overflow %jd %jd\n", lhs, off);
  6103. + return 1;
  6104. + }
  6105. +
  6106. if (off) {
  6107. switch (m->in_op & FILE_OPS_MASK) {
  6108. case FILE_OPAND:
  6109. @@ -1484,8 +1496,12 @@
  6110. offset = lhs;
  6111. if (m->in_op & FILE_OPINVERSE)
  6112. offset = ~offset;
  6113. -
  6114. - return CAST(uint32_t, offset);
  6115. + if (offset >= UINT_MAX) {
  6116. + fprintf(stderr, "offset overflow %jd\n", offset);
  6117. + return 1;
  6118. + }
  6119. + *rv = CAST(uint32_t, offset);
  6120. + return 0;
  6121. }
  6122. private int
  6123. @@ -1564,7 +1580,7 @@
  6124. mget(struct magic_set *ms, struct magic *m, const struct buffer *b,
  6125. const unsigned char *s, size_t nbytes, size_t o, unsigned int cont_level,
  6126. int mode, int text, int flip, uint16_t *indir_count, uint16_t *name_count,
  6127. - int *printed_something, int *need_separator, int *returnval,
  6128. + int *printed_something, int *need_separator, int *firstline, int *returnval,
  6129. int *found_match)
  6130. {
  6131. uint32_t eoffset, offset = ms->offset;
  6132. @@ -1685,22 +1701,26 @@
  6133. case FILE_BYTE:
  6134. if (OFFSET_OOB(nbytes, offset, 1))
  6135. return 0;
  6136. - offset = do_ops(m, SEXT(sgn,8,p->b), off);
  6137. + if (do_ops(m, &offset, SEXT(sgn,8,p->b), off))
  6138. + return 0;
  6139. break;
  6140. case FILE_BESHORT:
  6141. if (OFFSET_OOB(nbytes, offset, 2))
  6142. return 0;
  6143. - offset = do_ops(m, SEXT(sgn,16,BE16(p)), off);
  6144. + if (do_ops(m, &offset, SEXT(sgn,16,BE16(p)), off))
  6145. + return 0;
  6146. break;
  6147. case FILE_LESHORT:
  6148. if (OFFSET_OOB(nbytes, offset, 2))
  6149. return 0;
  6150. - offset = do_ops(m, SEXT(sgn,16,LE16(p)), off);
  6151. + if (do_ops(m, &offset, SEXT(sgn,16,LE16(p)), off))
  6152. + return 0;
  6153. break;
  6154. case FILE_SHORT:
  6155. if (OFFSET_OOB(nbytes, offset, 2))
  6156. return 0;
  6157. - offset = do_ops(m, SEXT(sgn,16,p->h), off);
  6158. + if (do_ops(m, &offset, SEXT(sgn,16,p->h), off))
  6159. + return 0;
  6160. break;
  6161. case FILE_BELONG:
  6162. case FILE_BEID3:
  6163. @@ -1709,7 +1729,8 @@
  6164. lhs = BE32(p);
  6165. if (in_type == FILE_BEID3)
  6166. lhs = cvt_id3(ms, CAST(uint32_t, lhs));
  6167. - offset = do_ops(m, SEXT(sgn,32,lhs), off);
  6168. + if (do_ops(m, &offset, SEXT(sgn,32,lhs), off))
  6169. + return 0;
  6170. break;
  6171. case FILE_LELONG:
  6172. case FILE_LEID3:
  6173. @@ -1718,33 +1739,39 @@
  6174. lhs = LE32(p);
  6175. if (in_type == FILE_LEID3)
  6176. lhs = cvt_id3(ms, CAST(uint32_t, lhs));
  6177. - offset = do_ops(m, SEXT(sgn,32,lhs), off);
  6178. + if (do_ops(m, &offset, SEXT(sgn,32,lhs), off))
  6179. + return 0;
  6180. break;
  6181. case FILE_MELONG:
  6182. if (OFFSET_OOB(nbytes, offset, 4))
  6183. return 0;
  6184. - offset = do_ops(m, SEXT(sgn,32,ME32(p)), off);
  6185. + if (do_ops(m, &offset, SEXT(sgn,32,ME32(p)), off))
  6186. + return 0;
  6187. break;
  6188. case FILE_LONG:
  6189. if (OFFSET_OOB(nbytes, offset, 4))
  6190. return 0;
  6191. - offset = do_ops(m, SEXT(sgn,32,p->l), off);
  6192. + if (do_ops(m, &offset, SEXT(sgn,32,p->l), off))
  6193. + return 0;
  6194. break;
  6195. case FILE_LEQUAD:
  6196. if (OFFSET_OOB(nbytes, offset, 8))
  6197. return 0;
  6198. - offset = do_ops(m, SEXT(sgn,64,LE64(p)), off);
  6199. + if (do_ops(m, &offset, SEXT(sgn,64,LE64(p)), off))
  6200. + return 0;
  6201. break;
  6202. case FILE_BEQUAD:
  6203. if (OFFSET_OOB(nbytes, offset, 8))
  6204. return 0;
  6205. - offset = do_ops(m, SEXT(sgn,64,BE64(p)), off);
  6206. + if (do_ops(m, &offset, SEXT(sgn,64,BE64(p)), off))
  6207. + return 0;
  6208. break;
  6209. case FILE_OCTAL:
  6210. if (OFFSET_OOB(nbytes, offset, m->vallen))
  6211. return 0;
  6212. - offset = do_ops(m,
  6213. - SEXT(sgn,64,strtoull(p->s, NULL, 8)), off);
  6214. + if(do_ops(m, &offset,
  6215. + SEXT(sgn,64,strtoull(p->s, NULL, 8)), off))
  6216. + return 0;
  6217. break;
  6218. default:
  6219. if ((ms->flags & MAGIC_DEBUG) != 0)
  6220. @@ -1863,7 +1890,7 @@
  6221. if ((rv = match(ms, mlp->magic, mlp->magic_rxcomp,
  6222. mlp->nmagic, &bb, 0, BINTEST, text, 0, indir_count,
  6223. name_count, printed_something, need_separator,
  6224. - NULL, NULL)) != 0)
  6225. + firstline, NULL, NULL)) != 0)
  6226. break;
  6227. }
  6228. @@ -1915,7 +1942,7 @@
  6229. eoffset = ms->eoffset;
  6230. rv = match(ms, ml.magic, ml.magic_rxcomp, ml.nmagic, b,
  6231. offset + o, mode, text, flip, indir_count, name_count,
  6232. - printed_something, need_separator, returnval,
  6233. + printed_something, need_separator, firstline, returnval,
  6234. &nfound_match);
  6235. ms->ms_value.q = nfound_match;
  6236. (*name_count)--;
  6237. @@ -1927,7 +1954,7 @@
  6238. *need_separator = oneed_separator;
  6239. ms->offset = offset;
  6240. ms->eoffset = eoffset;
  6241. - return rv;
  6242. + return rv || *found_match;
  6243. case FILE_NAME:
  6244. if (ms->flags & MAGIC_NODESC)
  6245. @@ -2126,19 +2153,19 @@
  6246. break;
  6247. case '!':
  6248. - matched = fv != fl;
  6249. + matched = isunordered(fl, fv) ? 1 : fv != fl;
  6250. break;
  6251. case '=':
  6252. - matched = fv == fl;
  6253. + matched = isunordered(fl, fv) ? 0 : fv == fl;
  6254. break;
  6255. case '>':
  6256. - matched = fv > fl;
  6257. + matched = isgreater(fv, fl);
  6258. break;
  6259. case '<':
  6260. - matched = fv < fl;
  6261. + matched = isless(fv, fl);
  6262. break;
  6263. default:
  6264. @@ -2159,19 +2186,19 @@
  6265. break;
  6266. case '!':
  6267. - matched = dv != dl;
  6268. + matched = isunordered(dv, dl) ? 1 : dv != dl;
  6269. break;
  6270. case '=':
  6271. - matched = dv == dl;
  6272. + matched = isunordered(dv, dl) ? 0 : dv == dl;
  6273. break;
  6274. case '>':
  6275. - matched = dv > dl;
  6276. + matched = isgreater(dv, dl);
  6277. break;
  6278. case '<':
  6279. - matched = dv < dl;
  6280. + matched = isless(dv, dl);
  6281. break;
  6282. default:
  6283. @@ -2212,6 +2239,12 @@
  6284. slen = MIN(m->vallen, sizeof(m->value.s));
  6285. l = 0;
  6286. v = 0;
  6287. + if ((ms->flags & MAGIC_DEBUG) != 0) {
  6288. + fprintf(stderr, "search: [");
  6289. + file_showstr(stderr, ms->search.s, ms->search.s_len);
  6290. + fprintf(stderr, "] for [");
  6291. + file_showstr(stderr, m->value.s, slen);
  6292. + }
  6293. #ifdef HAVE_MEMMEM
  6294. if (slen > 0 && m->str_flags == 0) {
  6295. const char *found;
  6296. @@ -2220,6 +2253,10 @@
  6297. idx = ms->search.s_len;
  6298. found = CAST(const char *, memmem(ms->search.s, idx,
  6299. m->value.s, slen));
  6300. + if ((ms->flags & MAGIC_DEBUG) != 0) {
  6301. + fprintf(stderr, "] %sfound\n",
  6302. + found ? "" : "not ");
  6303. + }
  6304. if (!found) {
  6305. v = 1;
  6306. break;
  6307. @@ -2245,6 +2282,9 @@
  6308. break;
  6309. }
  6310. }
  6311. + if ((ms->flags & MAGIC_DEBUG) != 0) {
  6312. + fprintf(stderr, "] %sfound\n", v == 0 ? "" : "not ");
  6313. + }
  6314. break;
  6315. }
  6316. case FILE_REGEX: {
  6317. --- a/src/strlcat.c
  6318. +++ b/src/strlcat.c
  6319. @@ -19,7 +19,7 @@
  6320. /* OPENBSD ORIGINAL: lib/libc/string/strlcat.c */
  6321. #include "file.h"
  6322. #ifndef lint
  6323. -FILE_RCSID("@(#)$File: strlcat.c,v 1.3 2022/09/13 18:46:07 christos Exp $")
  6324. +FILE_RCSID("@(#)$File: strlcat.c,v 1.5 2022/09/24 20:30:13 christos Exp $")
  6325. #endif
  6326. #include <sys/types.h>
  6327. --- a/src/strlcpy.c
  6328. +++ b/src/strlcpy.c
  6329. @@ -19,7 +19,7 @@
  6330. /* OPENBSD ORIGINAL: lib/libc/string/strlcpy.c */
  6331. #include "file.h"
  6332. #ifndef lint
  6333. -FILE_RCSID("@(#)$File: strlcpy.c,v 1.3 2022/09/13 18:46:07 christos Exp $")
  6334. +FILE_RCSID("@(#)$File: strlcpy.c,v 1.5 2022/09/24 20:30:13 christos Exp $")
  6335. #endif
  6336. #include <sys/types.h>
  6337. --- a/src/tar.h
  6338. +++ b/src/tar.h
  6339. @@ -32,7 +32,7 @@
  6340. *
  6341. * Created 25 August 1985 by John Gilmore, ihnp4!hoptoad!gnu.
  6342. *
  6343. - * $File: tar.h,v 1.13 2010/11/30 14:58:53 rrt Exp $ # checkin only
  6344. + * $File: tar.h,v 1.15 2022/09/24 20:30:13 christos Exp $ # checkin only
  6345. */
  6346. /*
  6347. --- a/src/vasprintf.c
  6348. +++ b/src/vasprintf.c
  6349. @@ -108,7 +108,7 @@
  6350. #include "file.h"
  6351. #ifndef lint
  6352. -FILE_RCSID("@(#)$File: vasprintf.c,v 1.20 2022/07/30 17:04:18 christos Exp $")
  6353. +FILE_RCSID("@(#)$File: vasprintf.c,v 1.23 2022/09/24 20:30:13 christos Exp $")
  6354. #endif /* lint */
  6355. #include <assert.h>
  6356. @@ -139,8 +139,6 @@
  6357. size_t pseudo_len; /* total length of output text if it were not limited in size */
  6358. size_t maxlen;
  6359. va_list vargs; /* pointer to current position into vargs */
  6360. - char * sprintf_string;
  6361. - FILE * fprintf_file;
  6362. } xprintf_struct;
  6363. /*
  6364. @@ -595,8 +593,6 @@
  6365. }
  6366. /* for (v)asnprintf */
  6367. - dummy_base = s->buffer_base;
  6368. -
  6369. dummy_base = s->buffer_base + s->real_len;
  6370. save_len = s->real_len;
  6371. @@ -625,6 +621,7 @@
  6372. xprintf_struct s;
  6373. int retval;
  6374. + memset(&s, 0, sizeof(s));
  6375. s.src_string = format_string;
  6376. #ifdef va_copy
  6377. va_copy (s.vargs, vargs);
  6378. --- a/tests/CVE-2014-1943.result
  6379. +++ b/tests/CVE-2014-1943.result
  6380. @@ -1 +1 @@
  6381. -Apple Driver Map, blocksize 0
  6382. \ No newline at end of file
  6383. +Apple Driver Map, blocksize 0
  6384. --- a/tests/JW07022A.mp3.result
  6385. +++ b/tests/JW07022A.mp3.result
  6386. @@ -1 +1 @@
  6387. -Audio file with ID3 version 2.2.0, contains: MPEG ADTS, layer III, v1, 96 kbps, 44.1 kHz, Monaural
  6388. \ No newline at end of file
  6389. +Audio file with ID3 version 2.2.0, contains: MPEG ADTS, layer III, v1, 96 kbps, 44.1 kHz, Monaural
  6390. --- a/tests/Makefile.am
  6391. +++ b/tests/Makefile.am
  6392. @@ -17,6 +17,14 @@
  6393. bcachefs.testfile \
  6394. cl8m8ocofedso.result \
  6395. cl8m8ocofedso.testfile \
  6396. +cmd1.testfile \
  6397. +cmd1.result \
  6398. +cmd2.testfile \
  6399. +cmd2.result \
  6400. +cmd3.testfile \
  6401. +cmd3.result \
  6402. +cmd4.testfile \
  6403. +cmd4.result \
  6404. dsd64-dff.result \
  6405. dsd64-dff.testfile \
  6406. dsd64-dsf.result \
  6407. @@ -37,6 +45,8 @@
  6408. issue311docx.testfile \
  6409. issue359xlsx.result \
  6410. issue359xlsx.testfile \
  6411. +jpeg-text.result \
  6412. +jpeg-text.testfile \
  6413. json1.result \
  6414. json1.testfile \
  6415. json2.result \
  6416. @@ -57,6 +67,11 @@
  6417. jsonlines1.result \
  6418. matilde.arm.result \
  6419. matilde.arm.testfile \
  6420. +multiple-A.magic \
  6421. +multiple-B.magic \
  6422. +multiple.flags \
  6423. +multiple.result \
  6424. +multiple.testfile \
  6425. pcjr.result \
  6426. pcjr.testfile \
  6427. pgp-binary-key-v2-phil.result \
  6428. @@ -75,6 +90,12 @@
  6429. pgp-binary-key-v4-rsa-no-userid-secret.testfile \
  6430. pgp-binary-key-v4-rsa-secret-key.result \
  6431. pgp-binary-key-v4-rsa-secret-key.testfile \
  6432. +pnm1.result \
  6433. +pnm1.testfile \
  6434. +pnm2.result \
  6435. +pnm2.testfile \
  6436. +pnm3.result \
  6437. +pnm3.testfile \
  6438. regex-eol.magic \
  6439. regex-eol.result \
  6440. regex-eol.testfile \
  6441. @@ -127,14 +148,27 @@
  6442. T = $(top_srcdir)/tests
  6443. check-local:
  6444. - MAGIC=$(top_builddir)/magic/magic ./test
  6445. set -e; \
  6446. for i in $T/*.testfile; do \
  6447. - echo Running test: $$i; \
  6448. - if [ -f $${i%%.testfile}.magic ]; then \
  6449. - m=$${i%%.testfile}.magic; \
  6450. - else \
  6451. + t=$${i%%.testfile}; \
  6452. + echo Running test: $$t; \
  6453. + m=; \
  6454. + for j in $$(eval echo $${t}\*.magic); do \
  6455. + if [ -f "$$j" ]; then \
  6456. + if [ -z "$$m" ]; then \
  6457. + m=$$j; \
  6458. + else \
  6459. + m=$$m:$$j; \
  6460. + fi \
  6461. + fi \
  6462. + done; \
  6463. + if [ -z "$$m" ]; then \
  6464. m=$(top_builddir)/magic/magic; \
  6465. fi; \
  6466. - TZ=UTC MAGIC=$$m ./test $$i $${i%%.testfile}.result; \
  6467. + f=-e; \
  6468. + if [ -f $${t}.flags ]; then \
  6469. + f=$$f$$(cat $${t}.flags); \
  6470. + fi; \
  6471. + echo TZ=UTC MAGIC=$$m ./test $$f $$i $${t}.result; \
  6472. + TZ=UTC MAGIC=$$m ./test $$f $$i $${t}.result; \
  6473. done
  6474. --- a/tests/android-vdex-1.result
  6475. +++ b/tests/android-vdex-1.result
  6476. @@ -1 +1 @@
  6477. -Android vdex file, verifier deps version: 021, dex section version: 002, number of dex files: 4, verifier deps size: 106328
  6478. \ No newline at end of file
  6479. +Android vdex file, verifier deps version: 021, dex section version: 002, number of dex files: 4, verifier deps size: 106328
  6480. --- a/tests/android-vdex-2.result
  6481. +++ b/tests/android-vdex-2.result
  6482. @@ -1 +1 @@
  6483. -Android vdex file, being processed by dex2oat, verifier deps version: 019, dex section version: 002, number of dex files: 1, verifier deps size: 1016
  6484. \ No newline at end of file
  6485. +Android vdex file, being processed by dex2oat, verifier deps version: 019, dex section version: 002, number of dex files: 1, verifier deps size: 1016
  6486. --- a/tests/arj.result
  6487. +++ b/tests/arj.result
  6488. @@ -1 +1 @@
  6489. -ARJ archive data, v11, slash-switched, created 5 1980+48, original name: example_m0.arj, os: Unix
  6490. \ No newline at end of file
  6491. +ARJ archive data, v11, slash-switched, created 5 1980+48, original name: example_m0.arj, os: Unix
  6492. --- a/tests/bcachefs.result
  6493. +++ b/tests/bcachefs.result
  6494. @@ -1 +1 @@
  6495. -bcachefs, UUID=46bd306f-80ad-4cd0-af4f-147e7d85f393, label "Label", version 13, min version 13, device 0/UUID=72a60ede-4cb6-4374-aa70-cb38a50af5ef, 1 devices
  6496. \ No newline at end of file
  6497. +bcachefs, UUID=46bd306f-80ad-4cd0-af4f-147e7d85f393, label "Label", version 13, min version 13, device 0/UUID=72a60ede-4cb6-4374-aa70-cb38a50af5ef, 1 devices
  6498. --- a/tests/cl8m8ocofedso.result
  6499. +++ b/tests/cl8m8ocofedso.result
  6500. @@ -1 +1 @@
  6501. -Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 192 kbps, 44.1 kHz, JntStereo
  6502. \ No newline at end of file
  6503. +Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 192 kbps, 44.1 kHz, JntStereo
  6504. --- /dev/null
  6505. +++ b/tests/cmd1.result
  6506. @@ -0,0 +1 @@
  6507. +a /usr/bin/cmd1 script, ASCII text executable
  6508. --- /dev/null
  6509. +++ b/tests/cmd1.testfile
  6510. @@ -0,0 +1 @@
  6511. +#! /usr/bin/cmd1
  6512. --- /dev/null
  6513. +++ b/tests/cmd2.result
  6514. @@ -0,0 +1 @@
  6515. +a /usr/bin/cmd2 script, ASCII text executable
  6516. --- /dev/null
  6517. +++ b/tests/cmd2.testfile
  6518. @@ -0,0 +1 @@
  6519. +#!/usr/bin/cmd2
  6520. --- /dev/null
  6521. +++ b/tests/cmd3.result
  6522. @@ -0,0 +1 @@
  6523. +a /usr/bin/cmd3 script executable (binary data)
  6524. --- /dev/null
  6525. +++ b/tests/cmd3.testfile
  6526. @@ -0,0 +1,2 @@
  6527. +#!/usr/bin/cmd3
  6528. +
  6529. --- /dev/null
  6530. +++ b/tests/cmd4.result
  6531. @@ -0,0 +1 @@
  6532. +a /usr/bin/cmd4 script executable (binary data)
  6533. --- /dev/null
  6534. +++ b/tests/cmd4.testfile
  6535. @@ -0,0 +1,2 @@
  6536. +#! /usr/bin/cmd4
  6537. +
  6538. --- a/tests/dsd64-dff.result
  6539. +++ b/tests/dsd64-dff.result
  6540. @@ -1 +1 @@
  6541. -DSDIFF audio bitstream data, 1 bit, mono, "DSD 64" 2822400 Hz, no compression, ID3 version 2.0.0
  6542. \ No newline at end of file
  6543. +DSDIFF audio bitstream data, 1 bit, mono, "DSD 64" 2822400 Hz, no compression, ID3 version 2.0.0
  6544. --- a/tests/dsd64-dsf.result
  6545. +++ b/tests/dsd64-dsf.result
  6546. @@ -1 +1 @@
  6547. -DSF audio bitstream data, 1 bit, mono, "DSD 64" 2822400 Hz, no compression, ID3 version 2.3.0
  6548. \ No newline at end of file
  6549. +DSF audio bitstream data, 1 bit, mono, "DSD 64" 2822400 Hz, no compression, ID3 version 2.3.0
  6550. --- a/tests/escapevel.result
  6551. +++ b/tests/escapevel.result
  6552. @@ -1 +1 @@
  6553. -Zip data (MIME type "application/vnd.nz.gen.geek_central.ti5x"?)
  6554. \ No newline at end of file
  6555. +Zip data (MIME type "application/vnd.nz.gen.geek_central.ti5x"?)
  6556. --- a/tests/ext4.result
  6557. +++ b/tests/ext4.result
  6558. @@ -1 +1 @@
  6559. -Linux rev 1.0 ext4 filesystem data, UUID=d32bbb08-3a76-4510-a064-3045f887dbdf (extents) (64bit) (large files) (huge files)
  6560. \ No newline at end of file
  6561. +Linux rev 1.0 ext4 filesystem data, UUID=d32bbb08-3a76-4510-a064-3045f887dbdf (extents) (64bit) (large files) (huge files)
  6562. --- a/tests/fit-map-data.result
  6563. +++ b/tests/fit-map-data.result
  6564. @@ -1 +1 @@
  6565. -FIT Map data, unit id 65536, serial 3879446968, Sat May 31 10:00:34 2014, manufacturer 1 (garmin), product 1632, type 4 (Activity)
  6566. \ No newline at end of file
  6567. +FIT Map data, unit id 65536, serial 3879446968, Sat May 31 10:00:34 2014, manufacturer 1 (garmin), product 1632, type 4 (Activity)
  6568. --- a/tests/gedcom.result
  6569. +++ b/tests/gedcom.result
  6570. @@ -1 +1 @@
  6571. -GEDCOM genealogy text version 5.5, ASCII text
  6572. \ No newline at end of file
  6573. +GEDCOM genealogy text version 5.5, ASCII text
  6574. --- a/tests/hddrawcopytool.result
  6575. +++ b/tests/hddrawcopytool.result
  6576. @@ -1 +1 @@
  6577. -HDD Raw Copy Tool 1.10 - HD model: ST500DM0 02-1BD142 serial: 51D20233A7C0
  6578. \ No newline at end of file
  6579. +HDD Raw Copy Tool 1.10 - HD model: ST500DM0 02-1BD142 serial: 51D20233A7C0
  6580. --- a/tests/issue311docx.result
  6581. +++ b/tests/issue311docx.result
  6582. @@ -1 +1 @@
  6583. -Microsoft Word 2007+
  6584. \ No newline at end of file
  6585. +Microsoft Word 2007+
  6586. --- a/tests/issue359xlsx.result
  6587. +++ b/tests/issue359xlsx.result
  6588. @@ -1 +1 @@
  6589. -Microsoft Excel 2007+
  6590. \ No newline at end of file
  6591. +Microsoft Excel 2007+
  6592. --- /dev/null
  6593. +++ b/tests/jpeg-text.result
  6594. @@ -0,0 +1 @@
  6595. +ASCII text, with no line terminators
  6596. --- /dev/null
  6597. +++ b/tests/jpeg-text.testfile
  6598. @@ -0,0 +1 @@
  6599. +/*! jP
  6600. \ No newline at end of file
  6601. --- a/tests/json1.result
  6602. +++ b/tests/json1.result
  6603. @@ -1 +1 @@
  6604. -JSON text data
  6605. \ No newline at end of file
  6606. +JSON text data
  6607. --- a/tests/json2.result
  6608. +++ b/tests/json2.result
  6609. @@ -1 +1 @@
  6610. -JSON text data
  6611. \ No newline at end of file
  6612. +JSON text data
  6613. --- a/tests/json3.result
  6614. +++ b/tests/json3.result
  6615. @@ -1 +1 @@
  6616. -JSON text data
  6617. \ No newline at end of file
  6618. +JSON text data
  6619. --- a/tests/json4.result
  6620. +++ b/tests/json4.result
  6621. @@ -1 +1 @@
  6622. -JSON text data
  6623. \ No newline at end of file
  6624. +JSON text data
  6625. --- a/tests/json5.result
  6626. +++ b/tests/json5.result
  6627. @@ -1 +1 @@
  6628. -ASCII text
  6629. \ No newline at end of file
  6630. +ASCII text
  6631. --- a/tests/json6.result
  6632. +++ b/tests/json6.result
  6633. @@ -1 +1 @@
  6634. -JSON text data
  6635. \ No newline at end of file
  6636. +JSON text data
  6637. --- a/tests/json7.result
  6638. +++ b/tests/json7.result
  6639. @@ -1 +1 @@
  6640. -ASCII text
  6641. \ No newline at end of file
  6642. +ASCII text
  6643. --- a/tests/json8.result
  6644. +++ b/tests/json8.result
  6645. @@ -1 +1 @@
  6646. -JSON text data
  6647. \ No newline at end of file
  6648. +JSON text data
  6649. --- a/tests/jsonlines1.result
  6650. +++ b/tests/jsonlines1.result
  6651. @@ -1 +1 @@
  6652. -New Line Delimited JSON text data
  6653. \ No newline at end of file
  6654. +New Line Delimited JSON text data
  6655. --- a/tests/matilde.arm.result
  6656. +++ b/tests/matilde.arm.result
  6657. @@ -1 +1 @@
  6658. -Adaptive Multi-Rate Codec (GSM telephony)
  6659. \ No newline at end of file
  6660. +Adaptive Multi-Rate Codec (GSM telephony)
  6661. --- /dev/null
  6662. +++ b/tests/multiple-A.magic
  6663. @@ -0,0 +1,2 @@
  6664. +0 search {\\rt1 RTF1.0
  6665. +16 search ViVa2 Viva File 2.0
  6666. --- /dev/null
  6667. +++ b/tests/multiple-B.magic
  6668. @@ -0,0 +1,2 @@
  6669. +6 search ABCD ABCD File
  6670. +10 search TesT Test File 1.0
  6671. --- /dev/null
  6672. +++ b/tests/multiple.flags
  6673. @@ -0,0 +1 @@
  6674. +k
  6675. --- /dev/null
  6676. +++ b/tests/multiple.result
  6677. @@ -0,0 +1 @@
  6678. +RTF1.0\012- Viva File 2.0\012- ABCD File\012- Test File 1.0, ASCII text, with no line terminators
  6679. --- /dev/null
  6680. +++ b/tests/multiple.testfile
  6681. @@ -0,0 +1 @@
  6682. +{\rt1 ABCDTesT xxViVa2
  6683. \ No newline at end of file
  6684. --- a/tests/pcjr.result
  6685. +++ b/tests/pcjr.result
  6686. @@ -1 +1 @@
  6687. -PCjr Cartridge image
  6688. \ No newline at end of file
  6689. +PCjr Cartridge image
  6690. --- a/tests/pgp-binary-key-v2-phil.result
  6691. +++ b/tests/pgp-binary-key-v2-phil.result
  6692. @@ -1 +1 @@
  6693. -OpenPGP Public Key Version 2, Created Fri May 21 05:20:00 1993, RSA (Encrypt or Sign, 1024 bits); User ID; Signature; OpenPGP Certificate
  6694. \ No newline at end of file
  6695. +OpenPGP Public Key Version 2, Created Fri May 21 05:20:00 1993, RSA (Encrypt or Sign, 1024 bits); User ID; Signature; OpenPGP Certificate
  6696. --- a/tests/pgp-binary-key-v3-lutz.result
  6697. +++ b/tests/pgp-binary-key-v3-lutz.result
  6698. @@ -1 +1 @@
  6699. -OpenPGP Public Key Version 3, Created Mon Mar 17 11:14:30 1997, RSA (Encrypt or Sign, 1127 bits); User ID; Signature; OpenPGP Certificate
  6700. \ No newline at end of file
  6701. +OpenPGP Public Key Version 3, Created Mon Mar 17 11:14:30 1997, RSA (Encrypt or Sign, 1127 bits); User ID; Signature; OpenPGP Certificate
  6702. --- a/tests/pgp-binary-key-v4-dsa.result
  6703. +++ b/tests/pgp-binary-key-v4-dsa.result
  6704. @@ -1 +1 @@
  6705. -OpenPGP Public Key Version 4, Created Mon Apr 7 22:23:01 1997, DSA (1024 bits); User ID; Signature; OpenPGP Certificate
  6706. \ No newline at end of file
  6707. +OpenPGP Public Key Version 4, Created Mon Apr 7 22:23:01 1997, DSA (1024 bits); User ID; Signature; OpenPGP Certificate
  6708. --- a/tests/pgp-binary-key-v4-ecc-no-userid-secret.result
  6709. +++ b/tests/pgp-binary-key-v4-ecc-no-userid-secret.result
  6710. @@ -1 +1 @@
  6711. -OpenPGP Secret Key Version 4, Created Wed Aug 26 20:52:13 2020, EdDSA; Signature; Secret Subkey; OpenPGP Certificate
  6712. \ No newline at end of file
  6713. +OpenPGP Secret Key Version 4, Created Wed Aug 26 20:52:13 2020, EdDSA; Signature; Secret Subkey; OpenPGP Certificate
  6714. --- a/tests/pgp-binary-key-v4-ecc-secret-key.result
  6715. +++ b/tests/pgp-binary-key-v4-ecc-secret-key.result
  6716. @@ -1 +1 @@
  6717. -OpenPGP Secret Key Version 4, Created Sat Aug 22 14:07:46 2020, EdDSA; User ID; Signature; OpenPGP Certificate
  6718. \ No newline at end of file
  6719. +OpenPGP Secret Key Version 4, Created Sat Aug 22 14:07:46 2020, EdDSA; User ID; Signature; OpenPGP Certificate
  6720. --- a/tests/pgp-binary-key-v4-rsa-key.result
  6721. +++ b/tests/pgp-binary-key-v4-rsa-key.result
  6722. @@ -1 +1 @@
  6723. -OpenPGP Secret Key Version 4, Created Sat Aug 22 14:05:57 2020, RSA (Encrypt or Sign, 3072 bits); User ID; Signature; OpenPGP Certificate
  6724. \ No newline at end of file
  6725. +OpenPGP Secret Key Version 4, Created Sat Aug 22 14:05:57 2020, RSA (Encrypt or Sign, 3072 bits); User ID; Signature; OpenPGP Certificate
  6726. --- a/tests/pgp-binary-key-v4-rsa-no-userid-secret.result
  6727. +++ b/tests/pgp-binary-key-v4-rsa-no-userid-secret.result
  6728. @@ -1 +1 @@
  6729. -OpenPGP Secret Key Version 4, Created Sat Aug 22 20:13:52 2020, RSA (Encrypt or Sign, 3072 bits); Signature; Secret Subkey; OpenPGP Certificate
  6730. \ No newline at end of file
  6731. +OpenPGP Secret Key Version 4, Created Sat Aug 22 20:13:52 2020, RSA (Encrypt or Sign, 3072 bits); Signature; Secret Subkey; OpenPGP Certificate
  6732. --- a/tests/pgp-binary-key-v4-rsa-secret-key.result
  6733. +++ b/tests/pgp-binary-key-v4-rsa-secret-key.result
  6734. @@ -1 +1 @@
  6735. -OpenPGP Secret Key Version 4, Created Sat Aug 22 14:05:57 2020, RSA (Encrypt or Sign, 3072 bits); User ID; Signature; OpenPGP Certificate
  6736. \ No newline at end of file
  6737. +OpenPGP Secret Key Version 4, Created Sat Aug 22 14:05:57 2020, RSA (Encrypt or Sign, 3072 bits); User ID; Signature; OpenPGP Certificate
  6738. --- /dev/null
  6739. +++ b/tests/pnm1.result
  6740. @@ -0,0 +1 @@
  6741. +Netpbm image data, size = 2 x 2, greymap, ASCII text
  6742. --- /dev/null
  6743. +++ b/tests/pnm1.testfile
  6744. @@ -0,0 +1,5 @@
  6745. +P2
  6746. +2
  6747. +2
  6748. +255
  6749. +0 0 0 0
  6750. --- /dev/null
  6751. +++ b/tests/pnm2.result
  6752. @@ -0,0 +1 @@
  6753. +Netpbm image data, size = 2 x 2, rawbits, greymap
  6754. --- /dev/null
  6755. +++ b/tests/pnm3.result
  6756. @@ -0,0 +1 @@
  6757. +Netpbm image data, size = 10 x 20, pixmap, ASCII text
  6758. --- /dev/null
  6759. +++ b/tests/pnm3.testfile
  6760. @@ -0,0 +1,5 @@
  6761. +P3
  6762. +# CREATOR: GIMP PNM Filter Version 1.1
  6763. +10 20
  6764. +255
  6765. +255
  6766. --- a/tests/regex-eol.result
  6767. +++ b/tests/regex-eol.result
  6768. @@ -1 +1 @@
  6769. -Ansible Vault text, version 1.1, using AES256 encryption
  6770. \ No newline at end of file
  6771. +Ansible Vault text, version 1.1, using AES256 encryption
  6772. --- a/tests/test.c
  6773. +++ b/tests/test.c
  6774. @@ -27,6 +27,7 @@
  6775. #include <stdio.h>
  6776. #include <stdlib.h>
  6777. +#include <unistd.h>
  6778. #include <string.h>
  6779. #include <errno.h>
  6780. @@ -51,34 +52,36 @@
  6781. {
  6782. size_t len = 256;
  6783. int c;
  6784. - char *l = (char *)xrealloc(NULL, len), *s = l;
  6785. + char *l = xrealloc(NULL, len), *s = l;
  6786. for (c = getc(fp); c != EOF; c = getc(fp)) {
  6787. if (s == l + len) {
  6788. - l = xrealloc(l, len * 2);
  6789. + s = l + len;
  6790. len *= 2;
  6791. + l = xrealloc(l, len);
  6792. }
  6793. *s++ = c;
  6794. }
  6795. if (s != l && s[-1] == '\n')
  6796. s--;
  6797. - if (s == l + len)
  6798. - l = (char *)xrealloc(l, len + 1);
  6799. + if (s == l + len) {
  6800. + l = xrealloc(l, len + 1);
  6801. + s = l + len;
  6802. + }
  6803. *s++ = '\0';
  6804. *final_len = s - l;
  6805. - l = (char *)xrealloc(l, s - l);
  6806. - return l;
  6807. + return xrealloc(l, s - l);
  6808. }
  6809. int
  6810. main(int argc, char **argv)
  6811. {
  6812. - struct magic_set *ms;
  6813. + struct magic_set *ms = NULL;
  6814. const char *result;
  6815. size_t result_len, desired_len;
  6816. char *desired = NULL;
  6817. - int e = EXIT_FAILURE;
  6818. + int e = EXIT_FAILURE, flags, c;
  6819. FILE *fp;
  6820. @@ -88,7 +91,32 @@
  6821. else
  6822. prog = argv[0];
  6823. - ms = magic_open(MAGIC_ERROR);
  6824. + if (argc == 1)
  6825. + return 0;
  6826. +
  6827. + flags = 0;
  6828. + while ((c = getopt(argc, argv, "ek")) != -1)
  6829. + switch (c) {
  6830. + case 'e':
  6831. + flags |= MAGIC_ERROR;
  6832. + break;
  6833. + case 'k':
  6834. + flags |= MAGIC_CONTINUE;
  6835. + break;
  6836. + default:
  6837. + goto usage;
  6838. + }
  6839. +
  6840. + argc -= optind;
  6841. + argv += optind;
  6842. + if (argc != 2) {
  6843. +usage:
  6844. + (void)fprintf(stderr,
  6845. + "Usage: %s [-ek] TEST-FILE RESULT\n", prog);
  6846. + goto bad;
  6847. + }
  6848. +
  6849. + ms = magic_open(flags);
  6850. if (ms == NULL) {
  6851. (void)fprintf(stderr, "%s: ERROR opening MAGIC_NONE: %s\n",
  6852. prog, strerror(errno));
  6853. @@ -100,29 +128,20 @@
  6854. goto bad;
  6855. }
  6856. - if (argc == 1) {
  6857. - e = 0;
  6858. - goto bad;
  6859. - }
  6860. -
  6861. - if (argc != 3) {
  6862. - (void)fprintf(stderr, "Usage: %s TEST-FILE RESULT\n", prog);
  6863. - goto bad;
  6864. - }
  6865. - if ((result = magic_file(ms, argv[1])) == NULL) {
  6866. + if ((result = magic_file(ms, argv[0])) == NULL) {
  6867. (void)fprintf(stderr, "%s: ERROR loading file %s: %s\n",
  6868. prog, argv[1], magic_error(ms));
  6869. goto bad;
  6870. }
  6871. - fp = fopen(argv[2], "r");
  6872. + fp = fopen(argv[1], "r");
  6873. if (fp == NULL) {
  6874. (void)fprintf(stderr, "%s: ERROR opening `%s': %s",
  6875. - prog, argv[2], strerror(errno));
  6876. + prog, argv[1], strerror(errno));
  6877. goto bad;
  6878. }
  6879. desired = slurp(fp, &desired_len);
  6880. fclose(fp);
  6881. - (void)printf("%s: %s\n", argv[1], result);
  6882. + (void)printf("%s: %s\n", argv[0], result);
  6883. if (strcmp(result, desired) != 0) {
  6884. result_len = strlen(result);
  6885. (void)fprintf(stderr, "%s: ERROR: result was (len %zu)\n%s\n"
  6886. @@ -133,6 +152,7 @@
  6887. e = 0;
  6888. bad:
  6889. free(desired);
  6890. - magic_close(ms);
  6891. + if (ms)
  6892. + magic_close(ms);
  6893. return e;
  6894. }
  6895. --- a/tests/uf2.result
  6896. +++ b/tests/uf2.result
  6897. @@ -1 +1 @@
  6898. -UF2 firmware image, family ESP32-S2, address 00000000, 4829 total blocks
  6899. \ No newline at end of file
  6900. +UF2 firmware image, family ESP32-S2, address 00000000, 4829 total blocks
  6901. --- a/tests/zstd-3-skippable-frames.result
  6902. +++ b/tests/zstd-3-skippable-frames.result
  6903. @@ -1 +1 @@
  6904. -Zstandard compressed data (v0.8+), Dictionary ID: 1
  6905. \ No newline at end of file
  6906. +Zstandard compressed data (v0.8+), Dictionary ID: 1
  6907. --- a/tests/zstd-dictionary-0.result
  6908. +++ b/tests/zstd-dictionary-0.result
  6909. @@ -1 +1 @@
  6910. -Zstandard dictionary (ID 0)
  6911. \ No newline at end of file
  6912. +Zstandard dictionary (ID 0)
  6913. --- a/tests/zstd-dictionary-1.result
  6914. +++ b/tests/zstd-dictionary-1.result
  6915. @@ -1 +1 @@
  6916. -Zstandard dictionary (ID 1)
  6917. \ No newline at end of file
  6918. +Zstandard dictionary (ID 1)
  6919. --- a/tests/zstd-dictionary-2.result
  6920. +++ b/tests/zstd-dictionary-2.result
  6921. @@ -1 +1 @@
  6922. -Zstandard dictionary (ID 285212672)
  6923. \ No newline at end of file
  6924. +Zstandard dictionary (ID 285212672)
  6925. --- a/tests/zstd-skippable-frame-0.result
  6926. +++ b/tests/zstd-skippable-frame-0.result
  6927. @@ -1 +1 @@
  6928. -Zstandard compressed data (v0.2)
  6929. \ No newline at end of file
  6930. +Zstandard compressed data (v0.2)
  6931. --- a/tests/zstd-skippable-frame-4.result
  6932. +++ b/tests/zstd-skippable-frame-4.result
  6933. @@ -1 +1 @@
  6934. -Zstandard compressed data (v0.3)
  6935. \ No newline at end of file
  6936. +Zstandard compressed data (v0.3)
  6937. --- a/tests/zstd-skippable-frame-8.result
  6938. +++ b/tests/zstd-skippable-frame-8.result
  6939. @@ -1 +1 @@
  6940. -Zstandard compressed data (v0.4)
  6941. \ No newline at end of file
  6942. +Zstandard compressed data (v0.4)
  6943. --- a/tests/zstd-skippable-frame-C.result
  6944. +++ b/tests/zstd-skippable-frame-C.result
  6945. @@ -1 +1 @@
  6946. -Zstandard compressed data (v0.8+), Dictionary ID: 1
  6947. \ No newline at end of file
  6948. +Zstandard compressed data (v0.8+), Dictionary ID: 1
  6949. --- a/tests/zstd-v0.2-FF.result
  6950. +++ b/tests/zstd-v0.2-FF.result
  6951. @@ -1 +1 @@
  6952. -Zstandard compressed data (v0.2)
  6953. \ No newline at end of file
  6954. +Zstandard compressed data (v0.2)
  6955. --- a/tests/zstd-v0.3-FF.result
  6956. +++ b/tests/zstd-v0.3-FF.result
  6957. @@ -1 +1 @@
  6958. -Zstandard compressed data (v0.3)
  6959. \ No newline at end of file
  6960. +Zstandard compressed data (v0.3)
  6961. --- a/tests/zstd-v0.4-FF.result
  6962. +++ b/tests/zstd-v0.4-FF.result
  6963. @@ -1 +1 @@
  6964. -Zstandard compressed data (v0.4)
  6965. \ No newline at end of file
  6966. +Zstandard compressed data (v0.4)
  6967. --- a/tests/zstd-v0.5-FF.result
  6968. +++ b/tests/zstd-v0.5-FF.result
  6969. @@ -1 +1 @@
  6970. -Zstandard compressed data (v0.5)
  6971. \ No newline at end of file
  6972. +Zstandard compressed data (v0.5)
  6973. --- a/tests/zstd-v0.6-FF.result
  6974. +++ b/tests/zstd-v0.6-FF.result
  6975. @@ -1 +1 @@
  6976. -Zstandard compressed data (v0.6)
  6977. \ No newline at end of file
  6978. +Zstandard compressed data (v0.6)
  6979. --- a/tests/zstd-v0.7-00.result
  6980. +++ b/tests/zstd-v0.7-00.result
  6981. @@ -1 +1 @@
  6982. -Zstandard compressed data (v0.7), Dictionary ID: None
  6983. \ No newline at end of file
  6984. +Zstandard compressed data (v0.7), Dictionary ID: None
  6985. --- a/tests/zstd-v0.7-21.result
  6986. +++ b/tests/zstd-v0.7-21.result
  6987. @@ -1 +1 @@
  6988. -Zstandard compressed data (v0.7), Dictionary ID: 1
  6989. \ No newline at end of file
  6990. +Zstandard compressed data (v0.7), Dictionary ID: 1
  6991. --- a/tests/zstd-v0.7-22.result
  6992. +++ b/tests/zstd-v0.7-22.result
  6993. @@ -1 +1 @@
  6994. -Zstandard compressed data (v0.7), Dictionary ID: 513
  6995. \ No newline at end of file
  6996. +Zstandard compressed data (v0.7), Dictionary ID: 513
  6997. --- a/tests/zstd-v0.8-00.result
  6998. +++ b/tests/zstd-v0.8-00.result
  6999. @@ -1 +1 @@
  7000. -Zstandard compressed data (v0.8+), Dictionary ID: None
  7001. \ No newline at end of file
  7002. +Zstandard compressed data (v0.8+), Dictionary ID: None
  7003. --- a/tests/zstd-v0.8-01.result
  7004. +++ b/tests/zstd-v0.8-01.result
  7005. @@ -1 +1 @@
  7006. -Zstandard compressed data (v0.8+), Dictionary ID: 2
  7007. \ No newline at end of file
  7008. +Zstandard compressed data (v0.8+), Dictionary ID: 2
  7009. --- a/tests/zstd-v0.8-02.result
  7010. +++ b/tests/zstd-v0.8-02.result
  7011. @@ -1 +1 @@
  7012. -Zstandard compressed data (v0.8+), Dictionary ID: 770
  7013. \ No newline at end of file
  7014. +Zstandard compressed data (v0.8+), Dictionary ID: 770
  7015. --- a/tests/zstd-v0.8-03.result
  7016. +++ b/tests/zstd-v0.8-03.result
  7017. @@ -1 +1 @@
  7018. -Zstandard compressed data (v0.8+), Dictionary ID: 84148994
  7019. \ No newline at end of file
  7020. +Zstandard compressed data (v0.8+), Dictionary ID: 84148994
  7021. --- a/tests/zstd-v0.8-16.result
  7022. +++ b/tests/zstd-v0.8-16.result
  7023. @@ -1 +1 @@
  7024. -Zstandard compressed data (v0.8+), Dictionary ID: 770
  7025. \ No newline at end of file
  7026. +Zstandard compressed data (v0.8+), Dictionary ID: 770
  7027. --- a/tests/zstd-v0.8-20.result
  7028. +++ b/tests/zstd-v0.8-20.result
  7029. @@ -1 +1 @@
  7030. -Zstandard compressed data (v0.8+), Dictionary ID: None
  7031. \ No newline at end of file
  7032. +Zstandard compressed data (v0.8+), Dictionary ID: None
  7033. --- a/tests/zstd-v0.8-21.result
  7034. +++ b/tests/zstd-v0.8-21.result
  7035. @@ -1 +1 @@
  7036. -Zstandard compressed data (v0.8+), Dictionary ID: 1
  7037. \ No newline at end of file
  7038. +Zstandard compressed data (v0.8+), Dictionary ID: 1
  7039. --- a/tests/zstd-v0.8-22.result
  7040. +++ b/tests/zstd-v0.8-22.result
  7041. @@ -1 +1 @@
  7042. -Zstandard compressed data (v0.8+), Dictionary ID: 513
  7043. \ No newline at end of file
  7044. +Zstandard compressed data (v0.8+), Dictionary ID: 513
  7045. --- a/tests/zstd-v0.8-23.result
  7046. +++ b/tests/zstd-v0.8-23.result
  7047. @@ -1 +1 @@
  7048. -Zstandard compressed data (v0.8+), Dictionary ID: 67305985
  7049. \ No newline at end of file
  7050. +Zstandard compressed data (v0.8+), Dictionary ID: 67305985
  7051. --- a/tests/zstd-v0.8-F4.result
  7052. +++ b/tests/zstd-v0.8-F4.result
  7053. @@ -1 +1 @@
  7054. -Zstandard compressed data (v0.8+), Dictionary ID: None
  7055. \ No newline at end of file
  7056. +Zstandard compressed data (v0.8+), Dictionary ID: None
  7057. --- a/tests/zstd-v0.8-FF.result
  7058. +++ b/tests/zstd-v0.8-FF.result
  7059. @@ -1 +1 @@
  7060. -Zstandard compressed data (v0.8+), Dictionary ID: 67305985
  7061. \ No newline at end of file
  7062. +Zstandard compressed data (v0.8+), Dictionary ID: 67305985