git Service of IN-Ulm e.V. Explore Help
Sign In
cbiedl
/
file
1
0
Fork 0
Files Pull Requests 0 Wiki
Tree: e36164ff39
Branches Tags
file
/
magic
/
Magdir
/
linux

linux 13 KB
History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346 
  1. 

  2. #------------------------------------------------------------------------------
    3. 

  3. # $File: linux,v 1.47 2013/02/06 14:18:52 christos Exp $
    4. 

  4. # linux:  file(1) magic for Linux files
    5. 

  5. #
    6. 

  6. # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
    7. 

  7. # The following basic Linux magic is useful for reference, but using
    8. 

  8. # "long" magic is a better practice in order to avoid collisions.
    9. 

  9. #
    10. 

  10. # 2	leshort		100		Linux/i386
    11. 

  11. # >0	leshort		0407		impure executable (OMAGIC)
    12. 

  12. # >0	leshort		0410		pure executable (NMAGIC)
    13. 

  13. # >0	leshort		0413		demand-paged executable (ZMAGIC)
    14. 

  14. # >0	leshort		0314		demand-paged executable (QMAGIC)
    15. 

  15. #
    16. 

  16. 0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
    17. 

  17. >16	lelong		0		\b, stripped
    18. 

  18. 0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
    19. 

  19. >16	lelong		0		\b, stripped
    20. 

  20. 0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
    21. 

  21. >16	lelong		0		\b, stripped
    22. 

  22. 0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
    23. 

  23. >16	lelong		0		\b, stripped
    24. 

  24. #
    25. 

  25. 0	string		\007\001\000	Linux/i386 object file
    26. 

  26. >20	lelong		>0x1020		\b, DLL library
    27. 

  27. # Linux-8086 stuff:
    28. 

  28. 0	string		\01\03\020\04	Linux-8086 impure executable
    29. 

  29. >28	long		!0		not stripped
    30. 

  30. 0	string		\01\03\040\04	Linux-8086 executable
    31. 

  31. >28	long		!0		not stripped
    32. 

  32. #
    33. 

  33. 0	string		\243\206\001\0	Linux-8086 object file
    34. 

  34. #
    35. 

  35. 0	string		\01\03\020\20	Minix-386 impure executable
    36. 

  36. >28	long		!0		not stripped
    37. 

  37. 0	string		\01\03\040\20	Minix-386 executable
    38. 

  38. >28	long		!0		not stripped
    39. 

  39. 0	string		\01\03\04\20	Minix-386 NSYM/GNU executable
    40. 

  40. >28	long		!0		not stripped
    41. 

  41. # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
    42. 

  42. 216	lelong		0421		Linux/i386 core file
    43. 

  43. >220	string		>\0		of '%s'
    44. 

  44. >200	lelong		>0		(signal %d)
    45. 

  45. #
    46. 

  46. # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
    47. 

  47. # this can be overridden by the DOS executable (COM) entry
    48. 

  48. 2	string		LILO		Linux/i386 LILO boot/chain loader
    49. 

  49. #
    50. 

  50. # Linux make config build file, from Ole Aamot <oka@oka.no>
    51. 

  51. 28 	string		make\ config	Linux make config build file
    52. 

  52. #
    53. 

  53. # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
    54. 

  54. # Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
    55. 

  55. # See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
    56. 

  56. 0	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
    57. 

  57. >2	byte&0x01	0		256 characters,
    58. 

  58. >2	byte&0x01	!0		512 characters,
    59. 

  59. >2	byte&0x02	0		no directory,
    60. 

  60. >2	byte&0x02	!0		Unicode directory,
    61. 

  61. >3	byte		>0		8x%d
    62. 

  62. 0	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
    63. 

  63. >16	lelong		x		%d characters,
    64. 

  64. >12	lelong&0x01	0		no directory,
    65. 

  65. >12	lelong&0x01	!0		Unicode directory,
    66. 

  66. >24	lelong		x		%d
    67. 

  67. >28	lelong		x		\bx%d
    68. 

  68. 

  69. # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
    70. 

  70. 4086	string		SWAP-SPACE	Linux/i386 swap file
    71. 

  71. # From: Jeff Bailey <jbailey@ubuntu.com>
    72. 

  72. # Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
    73. 

  73. 4076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
    74. 

  74. # From: James Hunt <james.hunt@ubuntu.com>
    75. 

  75. 4076    string          SWAPSPACE2LINHIB0001    Linux/i386 swap file (new style) (compressed hibernate)
    76. 

  76. # according to man page of mkswap (8) March 1999
    77. 

  77. # volume label and UUID Russell Coker
    78. 

  78. # http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
    79. 

  79. 4086	string		SWAPSPACE2	Linux/i386 swap file (new style),
    80. 

  80. >0x400	long		x		version %d (4K pages),
    81. 

  81. >0x404	long		x		size %d pages,
    82. 

  82. >1052	string		\0		no label,
    83. 

  83. >1052	string		>\0		LABEL=%s,
    84. 

  84. >0x40c	belong		x		UUID=%08x
    85. 

  85. >0x410	beshort		x		\b-%04x
    86. 

  86. >0x412	beshort		x		\b-%04x
    87. 

  87. >0x414	beshort		x		\b-%04x
    88. 

  88. >0x416	belong		x		\b-%08x
    89. 

  89. >0x41a	beshort		x		\b%04x
    90. 

  90. # From Daniel Novotny <dnovotny@redhat.com>
    91. 

  91. # swap file for PowerPC
    92. 

  92. 65526	string		SWAPSPACE2	Linux/ppc swap file
    93. 

  93. 16374	string		SWAPSPACE2	Linux/ia64 swap file
    94. 

  94. #
    95. 

  95. # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
    96. 

  96. # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
    97. 

  97. # and Nicolas Lichtmaier <nick@debian.org>
    98. 

  98. # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
    99. 

  99. # Linux kernel boot images (i386 arch) (Wolfram Kleff)
    100. 

  100. 514	string		HdrS		Linux kernel
    101. 

  101. !:strength + 5
    102. 

  102. >510	leshort		0xAA55		x86 boot executable
    103. 

  103. >>518	leshort		>0x1ff
    104. 

  104. >>>529	byte		0		zImage,
    105. 

  105. >>>529	byte		1		bzImage,
    106. 

  106. >>>(526.s+0x200) string	>\0		version %s,
    107. 

  107. >>498	leshort		1		RO-rootFS,
    108. 

  108. >>498	leshort		0		RW-rootFS,
    109. 

  109. >>508	leshort		>0		root_dev 0x%X,
    110. 

  110. >>502	leshort		>0		swap_dev 0x%X,
    111. 

  111. >>504	leshort		>0		RAMdisksize %u KB,
    112. 

  112. >>506	leshort		0xFFFF		Normal VGA
    113. 

  113. >>506	leshort		0xFFFE		Extended VGA
    114. 

  114. >>506	leshort		0xFFFD		Prompt for Videomode
    115. 

  115. >>506	leshort		>0		Video mode %d
    116. 

  116. # This also matches new kernels, which were caught above by "HdrS".
    117. 

  117. 0		belong	0xb8c0078e	Linux kernel
    118. 

  118. >0x1e3		string	Loading		version 1.3.79 or older
    119. 

  119. >0x1e9		string	Loading		from prehistoric times
    120. 

  120. 

  121. # System.map files - Nicolas Lichtmaier <nick@debian.org>
    122. 

  122. 8	search/1	\ A\ _text	Linux kernel symbol map text
    123. 

  123. 

  124. # LSM entries - Nicolas Lichtmaier <nick@debian.org>
    125. 

  125. 0	search/1	Begin3	Linux Software Map entry text
    126. 

  126. 0	search/1	Begin4	Linux Software Map entry text (new format)
    127. 

  127. 

  128. # From Matt Zimmerman, enhanced for v3 by Matthew Palmer
    129. 

  129. 0	belong	0x4f4f4f4d	User-mode Linux COW file
    130. 

  130. >4	belong	<3		\b, version %d
    131. 

  131. >>8	string	>\0		\b, backing file %s
    132. 

  132. >4	belong	>2		\b, version %d
    133. 

  133. >>32	string	>\0		\b, backing file %s
    134. 

  134. 

  135. ############################################################################
    136. 

  136. # Linux kernel versions
    137. 

  137. 

  138. 0		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
    139. 

  139. >497		leshort		0		x86 boot sector
    140. 

  140. >>514		belong		0x8e	of a kernel from the dawn of time!
    141. 

  141. >>514		belong		0x908ed8b4	version 0.99-1.1.42
    142. 

  142. >>514		belong		0x908ed8b8	for memtest86
    143. 

  143. 

  144. >497		leshort		!0		x86 kernel
    145. 

  145. >>504		leshort		>0		RAMdisksize=%u KB
    146. 

  146. >>502		leshort		>0		swap=0x%X
    147. 

  147. >>508		leshort		>0		root=0x%X
    148. 

  148. >>>498		leshort		1		\b-ro
    149. 

  149. >>>498		leshort		0		\b-rw
    150. 

  150. >>506		leshort		0xFFFF		vga=normal
    151. 

  151. >>506		leshort		0xFFFE		vga=extended
    152. 

  152. >>506		leshort		0xFFFD		vga=ask
    153. 

  153. >>506		leshort		>0		vga=%d
    154. 

  154. >>514		belong		0x908ed881	version 1.1.43-1.1.45
    155. 

  155. >>514		belong		0x15b281cd
    156. 

  156. >>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
    157. 

  157. >>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
    158. 

  158. >>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
    159. 

  159. >>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
    160. 

  160. >>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
    161. 

  161. >>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
    162. 

  162. >>514		string		HdrS
    163. 

  163. >>>518		leshort		>0x1FF
    164. 

  164. >>>>529		byte		0		\b, zImage
    165. 

  165. >>>>529		byte		1		\b, bzImage
    166. 

  166. >>>>(526.s+0x200) string 	>\0		\b, version %s
    167. 

  167. 

  168. # Linux boot sector thefts.
    169. 

  169. 0		belong		0xb8c0078e	Linux
    170. 

  170. >0x1e6		belong		0x454c4b53	ELKS Kernel
    171. 

  171. >0x1e6		belong		!0x454c4b53	style boot sector
    172. 

  172. 

  173. ############################################################################
    174. 

  174. # Linux S390 kernel image
    175. 

  175. # Created by: Jan Kaluza <jkaluza@redhat.com>
    176. 

  176. 8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
    177. 

  177. >0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
    178. 

  178. # 64bit
    179. 

  179. >>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
    180. 

  180. >>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
    181. 

  181. >>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
    182. 

  182. >>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
    183. 

  183. # 32bit
    184. 

  184. >>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
    185. 

  185. >>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
    186. 

  186. >>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
    187. 

  187. >>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
    188. 

  188. 

  189. # Linux ARM compressed kernel image
    190. 

  190. # From: Kevin Cernekee <cernekee@gmail.com>
    191. 

  191. 36	lelong	0x016f2818	Linux kernel ARM boot executable zImage (little-endian)
    192. 

  192. 36	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)
    193. 

  193. 

  194. ############################################################################
    195. 

  195. # Linux 8086 executable
    196. 

  196. 0	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
    197. 

  197. >5	string		.		
    198. 

  198. >>4	string		>\0		\b, libc version %s
    199. 

  199. 

  200. 0	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
    201. 

  201. >2	byte&0x01	!0		\b, unmapped zero page
    202. 

  202. >2	byte&0x20	0		\b, impure
    203. 

  203. >2	byte&0x20	!0
    204. 

  204. >>2	byte&0x10	!0		\b, A_EXEC
    205. 

  205. >2	byte&0x02	!0		\b, A_PAL
    206. 

  206. >2	byte&0x04	!0		\b, A_NSYM
    207. 

  207. >2	byte&0x08	!0		\b, A_STAND
    208. 

  208. >2	byte&0x40	!0		\b, A_PURE
    209. 

  209. >2	byte&0x80	!0		\b, A_TOVLY
    210. 

  210. >28     long            !0              \b, not stripped
    211. 

  211. >37	string		.		
    212. 

  212. >>36	string		>\0		\b, libc version %s
    213. 

  213. 

  214. # 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
    215. 

  215. # 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
    216. 

  216. # 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
    217. 

  217. # 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable
    218. 

  218. 

  219. # SYSLINUX boot logo files (from 'ppmtolss16' sources)
    220. 

  220. # http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
    221. 

  221. # file extension .lss .16
    222. 

  222. 0	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
    223. 

  223. # syslinux-4.05/mime/image/x-lss16.xml
    224. 

  224. !:mime image/x-lss16
    225. 

  225. >4	leshort	x			\b, width %d
    226. 

  226. >6	leshort	x			\b, height %d
    227. 

  227. 

  228. 0	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
    229. 

  229. >4	belong	x			version %d
    230. 

  230. 

  231. # SE Linux policy database
    232. 

  232. # From: Mike Frysinger <vapier@gentoo.org>
    233. 

  233. 0	lelong	0xf97cff8c		SE Linux policy
    234. 

  234. >16	lelong	x			v%d
    235. 

  235. >20	lelong	1			MLS
    236. 

  236. >24	lelong	x			%d symbols
    237. 

  237. >28	lelong	x			%d ocons
    238. 

  238. 

  239. # Linux Logical Volume Manager (LVM) 
    240. 

  240. # Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
    241. 

  241. #
    242. 

  242. # System ID, UUID and volume group name are 128 bytes long
    243. 

  243. # but they should never be full and initialized with zeros...
    244. 

  244. #
    245. 

  245. # LVM1
    246. 

  246. #
    247. 

  247. 0x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
    248. 

  248. >0x12c	string	>\0		, System ID: %s
    249. 

  249. 

  250. 0x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
    251. 

  251. >0x12c	string	>\0		, System ID: %s
    252. 

  252. 

  253. #  LVM2
    254. 

  254. #
    255. 

  255. # It seems that the label header can be in one the four first sector
    256. 

  256. # of the disk... (from _find_labeller in lib/label/label.c of LVM2)
    257. 

  257. #
    258. 

  258. # 0x200 seems to be the common case
    259. 

  259. 

  260. 0x218           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
    261. 

  261. # read the offset to add to the start of the header, and the header
    262. 

  262. # start in 0x200
    263. 

  263. >&(&-12.l-0x21) byte    x
    264. 

  264. # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
    265. 

  265. >>&0x0          string  >\x2f          \b, UUID: %.6s
    266. 

  266. >>&0x6          string  >\x2f          \b-%.4s
    267. 

  267. >>&0xa          string  >\x2f          \b-%.4s
    268. 

  268. >>&0xe          string  >\x2f          \b-%.4s
    269. 

  269. >>&0x12         string  >\x2f          \b-%.4s
    270. 

  270. >>&0x16         string  >\x2f          \b-%.4s
    271. 

  271. >>&0x1a         string  >\x2f          \b-%.6s
    272. 

  272. >>&0x20         lequad  x              \b, size: %lld
    273. 

  273. 

  274. 0x018           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
    275. 

  275. >&(&-12.l-0x21) byte    x
    276. 

  276. # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
    277. 

  277. >>&0x0          string  >\x2f          \b, UUID: %.6s
    278. 

  278. >>&0x6          string  >\x2f          \b-%.4s
    279. 

  279. >>&0xa          string  >\x2f          \b-%.4s
    280. 

  280. >>&0xe          string  >\x2f          \b-%.4s
    281. 

  281. >>&0x12         string  >\x2f          \b-%.4s
    282. 

  282. >>&0x16         string  >\x2f          \b-%.4s
    283. 

  283. >>&0x1a         string  >\x2f          \b-%.6s
    284. 

  284. >>&0x20         lequad  x              \b, size: %lld
    285. 

  285. 

  286. 0x418           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
    287. 

  287. >&(&-12.l-0x21) byte    x
    288. 

  288. # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
    289. 

  289. >>&0x0          string  >\x2f          \b, UUID: %.6s
    290. 

  290. >>&0x6          string  >\x2f          \b-%.4s
    291. 

  291. >>&0xa          string  >\x2f          \b-%.4s
    292. 

  292. >>&0xe          string  >\x2f          \b-%.4s
    293. 

  293. >>&0x12         string  >\x2f          \b-%.4s
    294. 

  294. >>&0x16         string  >\x2f          \b-%.4s
    295. 

  295. >>&0x1a         string  >\x2f          \b-%.6s
    296. 

  296. >>&0x20         lequad  x              \b, size: %lld
    297. 

  297. 

  298. 0x618           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
    299. 

  299. >&(&-12.l-0x21) byte    x              
    300. 

  300. # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
    301. 

  301. >>&0x0          string  >\x2f          \b, UUID: %.6s
    302. 

  302. >>&0x6          string  >\x2f          \b-%.4s
    303. 

  303. >>&0xa          string  >\x2f          \b-%.4s
    304. 

  304. >>&0xe          string  >\x2f          \b-%.4s
    305. 

  305. >>&0x12         string  >\x2f          \b-%.4s
    306. 

  306. >>&0x16         string  >\x2f          \b-%.4s
    307. 

  307. >>&0x1a         string  >\x2f          \b-%.6s
    308. 

  308. >>&0x20         lequad  x              \b, size: %lld
    309. 

  309. 

  310. # LVM snapshot
    311. 

  311. # from Jason Farrel
    312. 

  312. 0	string	SnAp	LVM Snapshot (CopyOnWrite store)
    313. 

  313. >4	lelong	!0	- valid,
    314. 

  314. >4	lelong	0	- invalid,
    315. 

  315. >8	lelong	x	version %d,
    316. 

  316. >12	lelong	x	chunk_size %d
    317. 

  317. 

  318. # SE Linux policy database
    319. 

  319. 0	lelong	0xf97cff8c		SE Linux policy
    320. 

  320. >16	lelong	x			v%d
    321. 

  321. >20	lelong	1			MLS
    322. 

  322. >24	lelong	x			%d symbols
    323. 

  323. >28	lelong	x			%d ocons
    324. 

  324. 

  325. # LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
    326. 

  326. # Anthon van der Neut (anthon@mnt.org)
    327. 

  327. 0	string	LUKS\xba\xbe	LUKS encrypted file,
    328. 

  328. >6	beshort x		ver %d
    329. 

  329. >8	string	x		[%s,
    330. 

  330. >40	string	x		%s,
    331. 

  331. >72	string	x		%s]
    332. 

  332. >168	string	x		UUID: %s
    333. 

  333. 

  334. 

  335. # Summary: Xen saved domain file
    336. 

  336. # Created by: Radek Vokal <rvokal@redhat.com>
    337. 

  337. 0	string		LinuxGuestRecord	Xen saved domain
    338. 

  338. >20	search/256	(name			
    339. 

  339. >>&1	string		x			(name %s)
    340. 

  340. 

  341. # Type: Xen, the virtual machine monitor
    342. 

  342. # From: Radek Vokal <rvokal@redhat.com>
    343. 

  343. 0	string		LinuxGuestRecord	Xen saved domain
    344. 

  344. #>2	regex		\(name\ [^)]*\)		%s
    345. 

  345. >20	search/256	(name			(name
    346. 

  346. >>&1	string		x			%s...)
    347.