linux 3.2 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485
  1. #------------------------------------------------------------------------------
  2. # linux: file(1) magic for Linux files
  3. #
  4. # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
  5. # The following basic Linux magic is useful for reference, but using
  6. # "long" magic is a better practice in order to avoid collisions.
  7. #
  8. # 2 leshort 100 Linux/i386
  9. # >0 leshort 0407 impure executable (OMAGIC)
  10. # >0 leshort 0410 pure executable (NMAGIC)
  11. # >0 leshort 0413 demand-paged executable (ZMAGIC)
  12. # >0 leshort 0314 demand-paged executable (QMAGIC)
  13. #
  14. 0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)
  15. >16 lelong 0 \b, stripped
  16. 0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)
  17. >16 lelong 0 \b, stripped
  18. 0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)
  19. >16 lelong 0 \b, stripped
  20. 0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)
  21. >16 lelong 0 \b, stripped
  22. #
  23. 0 string \007\001\000 Linux/i386 object file
  24. >20 lelong >0x1020 \b, DLL library
  25. # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
  26. 0 string *nazgul* compiled message catalog
  27. >8 lelong >0 \b, version %ld
  28. # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
  29. 216 lelong 0421 Linux/i386 core file
  30. >220 string >\0 of '%s'
  31. >200 lelong >0 (signal %d)
  32. #
  33. # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
  34. # this can be overridden by the DOS executable (COM) entry
  35. 2 string LILO Linux/i386 LILO boot/chain loader
  36. #
  37. # Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
  38. 0 string 0.9
  39. >8 byte 0x0a Debian Binary Package
  40. >>3 byte >0 \b, created by dpkg 0.9%c
  41. >>4 byte >0 pl%c
  42. # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
  43. 0 leshort 0x0436 Linux/i386 PC Screen Font data,
  44. >2 byte 0 256 characters, no directory,
  45. >2 byte 1 512 characters, no directory,
  46. >2 byte 2 256 characters, Unicode directory,
  47. >2 byte 3 512 characters, Unicode directory,
  48. >3 byte >0 8x%d
  49. # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
  50. 4086 string SWAP-SPACE Linux/i386 swap file
  51. # ECOFF magic for OSF/1 and Linux (only tested under Linux though)
  52. #
  53. # from Erik Troan (ewt@redhat.com) examining od dumps, so this
  54. # could be wrong
  55. # updated by David Mosberger (davidm@azstarnet.com) based on
  56. # GNU BFD and MIPS info found below.
  57. #
  58. 0 leshort 0x0183 ECOFF alpha
  59. >24 leshort 0407 executable
  60. >24 leshort 0410 pure
  61. >24 leshort 0413 demand paged
  62. >8 long >0 not stripped
  63. >8 long 0 stripped
  64. >23 leshort >0 - version %ld.
  65. # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
  66. # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
  67. # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
  68. 514 string HdrS Linux kernel
  69. >518 leshort >0
  70. >>529 byte 0 zImage data,
  71. >>529 byte 1 bzImage data,
  72. >0x048c byte 0x31
  73. >>0x048c string x version %s
  74. >0x0493 byte 0x31
  75. >>0x0493 string x version %s
  76. >0x048c byte 0x32
  77. >>0x048c string x version %s
  78. >0x0493 byte 0x32
  79. >>0x0493 string x version %s
  80. # This also matches new kernels, which were caught above by "HdrS".
  81. 0 belong 0xb8c0078e Linux kernel
  82. >0x1e3 string Loading version 1.3.79 or older
  83. >0x1e9 string Loading from prehistoric times