Date: Mon, 4 May 2009 00:37:44 +0000 (UTC) From: "David E. O'Brien" <obrien@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r191771 - in head: contrib/file contrib/file/Magdir contrib/file/tests lib/libmagic usr.bin/file Message-ID: <200905040037.n440biJ1028655@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: obrien Date: Mon May 4 00:37:44 2009 New Revision: 191771 URL: http://svn.freebsd.org/changeset/base/191771 Log: Merge vendor/file/dist@191739, bringing FILE 5.00 to 8-CURRENT. Added: head/contrib/file/Magdir/wireless - copied unchanged from r191769, vendor/file/dist/Magdir/wireless head/contrib/file/Makefile.am-src - copied unchanged from r191769, vendor/file/dist/Makefile.am-src head/contrib/file/cdf.c - copied unchanged from r191769, vendor/file/dist/cdf.c head/contrib/file/cdf.h - copied unchanged from r191769, vendor/file/dist/cdf.h head/contrib/file/cdf_time.c - copied unchanged from r191769, vendor/file/dist/cdf_time.c head/contrib/file/encoding.c - copied unchanged from r191769, vendor/file/dist/encoding.c head/contrib/file/readcdf.c - copied unchanged from r191769, vendor/file/dist/readcdf.c Deleted: head/contrib/file/.cvsignore head/usr.bin/file/config.h Modified: head/contrib/file/ (props changed) head/contrib/file/ChangeLog head/contrib/file/Magdir/animation head/contrib/file/Magdir/audio head/contrib/file/Magdir/cafebabe head/contrib/file/Magdir/compress head/contrib/file/Magdir/elf head/contrib/file/Magdir/epoc head/contrib/file/Magdir/filesystems head/contrib/file/Magdir/graphviz head/contrib/file/Magdir/images head/contrib/file/Magdir/jpeg head/contrib/file/Magdir/mach head/contrib/file/Magdir/macintosh head/contrib/file/Magdir/msdos head/contrib/file/Magdir/perl head/contrib/file/Magdir/printer head/contrib/file/Magdir/timezone head/contrib/file/Magdir/xwindows head/contrib/file/Makefile.am head/contrib/file/Makefile.in head/contrib/file/README head/contrib/file/TODO head/contrib/file/apprentice.c head/contrib/file/apptype.c head/contrib/file/ascmagic.c head/contrib/file/asprintf.c (contents, props changed) head/contrib/file/compress.c head/contrib/file/config.h.in head/contrib/file/configure head/contrib/file/configure.ac head/contrib/file/elfclass.h (props changed) head/contrib/file/file.c head/contrib/file/file.h head/contrib/file/file.man head/contrib/file/file_opts.h head/contrib/file/fsmagic.c head/contrib/file/funcs.c head/contrib/file/getopt_long.c (contents, props changed) head/contrib/file/is_tar.c head/contrib/file/libmagic.man head/contrib/file/magic.c head/contrib/file/magic.h head/contrib/file/magic.man head/contrib/file/mygetopt.h (props changed) head/contrib/file/patchlevel.h head/contrib/file/print.c head/contrib/file/readelf.c head/contrib/file/softmagic.c head/contrib/file/tests/Makefile.am (props changed) head/contrib/file/tests/Makefile.in (props changed) head/contrib/file/tests/test.c (props changed) head/contrib/file/vasprintf.c (contents, props changed) head/lib/libmagic/Makefile head/lib/libmagic/config.h head/usr.bin/file/Makefile Modified: head/contrib/file/ChangeLog ============================================================================== --- head/contrib/file/ChangeLog Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/ChangeLog Mon May 4 00:37:44 2009 (r191771) @@ -1,9 +1,105 @@ +2008-12-12 15:50 Christos Zoulas <christos@zoulas.com> + + * fix initial offset calculation for non 4K sector files + + * add loop limits to avoid DoS attacks by constructing + looping sector references. + +2008-12-03 13:05 Christos Zoulas <christos@zoulas.com> + + * fix memory botches on cdf file parsing. + + * exit with non-zero value for any error, not just for the last + file processed. + +2008-11-09 20:42 Charles Longeau <chl@tuxfamily.org> + + * Replace all str{cpy,cat} functions with strl{cpy,cat} + * Ensure that strl{cpy,cat} are included in libmagic, + as needed. + +2008-11-06 18:18 Christos Zoulas <christos@zoulas.com> + + * Handle ID3 format files. + +2008-11-06 23:00 Reuben Thomas <rrt@sc3d.org> + + * Fix --mime, --mime-type and --mime-encoding under new scheme. + + * Rename "ascii" to "text" and add "encoding" test. + + * Return a precise ("utf-16le" or "utf-16be") MIME charset for + UTF-16. + + * Fix error in comment caused by automatic indentation adding + words! + +2008-11-06 10:35 Christos Zoulas <christos@astron.com> + + * use memchr instead of strchr because the string + might not be NUL terminated (Scott MacVicar) + +2008-11-03 07:31 Reuben Thomas <rrt@sc3d.org> + + * Fix a printf with a non-literal format string. + + * Fix formatting and punctuation of help for "--apple". + +2008-10-30 11:00 Reuben Thomas <rrt@sc3d.org> + + * Correct words counts in comments of struct magic. + + * Fix handle_annotation to allow both Apple and MIME types to be + printed, and to return correct code if MIME type is + printed (1, not 0) or if there's an error (-1 not 1). + + * Fix output of charset for MIME type (precede with semi-colon; + fixes Debian bug #501460). + + * Fix potential attacks via conversion specifications in magic + strings. + + * Add a FIXME for Debian bug #488562 (magic files should be + read in a defined order, by sorting the names). + +2008-10-18 16:45 Christos Zoulas <christos@astron.com> + + * Added APPLE file creator/type + +2008-10-12 10:20 Christos Zoulas <christos@astron.com> + + * Added CDF parsing + +2008-10-09 16:40 Christos Zoulas <christos@astron.com> + + * filesystem and msdos patches (Joerg Jenderek) + +2008-10-09 13:20 Christos Zoulas <christos@astron.com> + + * correct --exclude documentation issues: remove troff and fortran + and rename "token" to "tokens". (Randy McMurchy) + +2008-10-01 10:30 Christos Zoulas <christos@astron.com> + + * Read ~/.magic in addition to the default magic file not instead + of, as documented in the man page. + +2008-09-10 21:30 Reuben Thomas <rrt@sc3d.org> + + * Comment out graphviz patterns, as they match too many files. + 2008-08-30 12:54 Christos Zoulas <christos@astron.com> * Don't eat trailing \n in magic enties. * Cast defines to allow compilation using a c++ compiler. +2008-08-25 23:56 Reuben Thomas <rrt@sc3d.org> + + * Add text/x-lua MIME type for Lua scripts. + + * Escape { in regex in graphviz patterns. + 2008-07-26 00:59 Reuben Thomas <rrt@sc3d.org> * Add MIME types for special files. @@ -55,22 +151,22 @@ 2008-05-06 00:13 Robert Byrnes <byrnes@wildpumpkin.net> - * src/Makefile.am: + * src/Makefile.am: Ensure that getopt_long and [v]asprintf are included in libmagic, as needed. Remove unnecessary EXTRA_DIST. - * src/Makefile.in: + * src/Makefile.in: Rerun automake. - * src/vasprintf.c (dispatch): + * src/vasprintf.c (dispatch): Fix variable precision bug: be sure to step past '*'. - * src/vasprintf.c (core): + * src/vasprintf.c (core): Remove unreachable code. - * src/apprentice.c (set_test_type): + * src/apprentice.c (set_test_type): Add cast to avoid compiler warning. 2008-04-22 23:45 Christos Zoulas <christos@astron.com> @@ -81,12 +177,12 @@ 2008-04-04 11:00 Christos Zoulas <christos@astron.com> - * >= <= is not supported, so fix the magic and warn about it. + * >= <= is not supported, so fix the magic and warn about it. reported by: Thien-Thi Nguyen <ttn@gnuvola.org> 2008-03-27 16:16 Robert Byrnes <byrnes@wildpumpkin.net> - * src/readelf.c (donote): + * src/readelf.c (donote): ELF core file command name/line bug fixes and enhancements: Try larger offsets first to avoid false matches @@ -112,7 +208,7 @@ * Clarify UTF-8 BOM message (Reuben Thomas) * Add HTML comment to token list in names.h - + 2007-02-04 15:50 Christos Zoulas <christos@astron.com> * Debian fixes (Reuben Thomas) @@ -152,7 +248,7 @@ 2007-10-28 20:48 Christos Zoulas <christos@astron.com> - * float and double magic support (Behan Webster) + * float and double magic support (Behan Webster) 2007-10-28 20:48 Christos Zoulas <christos@astron.com> @@ -199,7 +295,7 @@ be easily parsed: mimetype [charset=character-set] [encoding=encoding-mime-type] - Remove spurious extra text from some MIME type printouts + Remove spurious extra text from some MIME type printouts (mostly in is_tar). Fix one case where -i produced nothing at all (for a 1-byte file, @@ -229,7 +325,7 @@ 2007-03-15 10:51 Christos Zoulas <christos@astron.com> * fix fortran and nroff reversed tests (Dmitry V. Levin) - + * fix exclude option (Dmitry V. Levin) 2007-02-08 17:30 Christos Zoulas <christos@astron.com> @@ -248,7 +344,7 @@ * Add exclude flag. 2007-01-18 05:29 Anon Ymous <do@not.spam.me> - + * Move the "type" detection code from parse() into its own table driven routine. This avoids maintaining multiple lists in file.h. @@ -256,7 +352,7 @@ * Add an optional conditional field (ust before the type field). This code is wrapped in "#ifdef ENABLE_CONDITIONALS" as it is likely to go away. - + 2007-01-16 23:24 Anon Ymous <do@not.spam.me> * Fix an initialization bug in check_mem(). @@ -327,7 +423,7 @@ 2006-12-08 16:32 Christos Zoulas <christos@astron.com> * store and print the line number of the magic - entry for debugging. + entry for debugging. * if the magic entry did not print anything, don't treat it as a match @@ -342,7 +438,7 @@ file_softmagic. 2006-11-25 13:35 Christos Zoulas <christos@astron.com> - + * Don't store the current offset in the magic struct, because it needs to be restored and it was not done properly all the time. Bug @@ -432,7 +528,7 @@ * Look for note sections in non executables. 2005-09-20 13:33 Christos Zoulas <christos@astron.com> - + * Don't print SVR4 Style in core files multiple times (Radek Vokál) @@ -443,9 +539,9 @@ 2005-08-18 09:53 Christos Zoulas <christos@astron.com> * Remove erroreous mention of /etc/magic in the file man page - This is gentoo bug 101639. (Mike Frysinger) + This is gentoo bug 101639. (Mike Frysinger) - * Cross-compile support and detection (Mike Frysinger) + * Cross-compile support and detection (Mike Frysinger) 2005-08-12 10:17 Christos Zoulas <christos@astron.com> @@ -477,20 +573,20 @@ * Avoid NULL pointer dereference in time conversion. 2005-03-06 00:00 Joerg Walter <jwalt@mail.garni.ch> - + * Add indirect magic offset support, and search mode. 2005-01-12 00:00 Stepan Kasal <kasal@ucw.cz> - * src/ascmagic.c (file_ascmagic): Fix three bugs about text files: - If a CRLF text file happens to have CR at offset HOWMANY - 1 - (currently 0xffff), it should not be counted as CR line - terminator. - If a line has length exactly MAXLINELEN, it should not yet be - treated as a ``very long line'', as MAXLINELEN is ``longest sane - line length''. - With CRLF, the line length was not computed correctly, and even - lines of length MAXLINELEN - 1 were treated as ``very long''. + * src/ascmagic.c (file_ascmagic): Fix three bugs about text files: + If a CRLF text file happens to have CR at offset HOWMANY - 1 + (currently 0xffff), it should not be counted as CR line + terminator. + If a line has length exactly MAXLINELEN, it should not yet be + treated as a ``very long line'', as MAXLINELEN is ``longest sane + line length''. + With CRLF, the line length was not computed correctly, and even + lines of length MAXLINELEN - 1 were treated as ``very long''. 2004-12-07 14:15 Christos Zoulas <christos@astron.com> @@ -525,12 +621,12 @@ * Remove 3rd and 4th copyright clause; approved by Ian Darwin. - * Fix small memory leaks; caught by: Tamas Sarlos + * Fix small memory leaks; caught by: Tamas Sarlos <stamas@csillag.ilab.sztaki.hu> 2004-07-24 16:33 Christos Zoulas <christos@astron.com> - * magic.mime update Danny Milosavljevic <danny.milo@gmx.net> + * magic.mime update Danny Milosavljevic <danny.milo@gmx.net> * FreeBSD version update Oliver Eikemeier <eikemeier@fillmore-labs.com> Modified: head/contrib/file/Magdir/animation ============================================================================== --- head/contrib/file/Magdir/animation Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/animation Mon May 4 00:37:44 2009 (r191771) @@ -325,6 +325,7 @@ # MP2, M1A 0 beshort&0xFFFE 0xFFFC MPEG ADTS, layer II, v1 +!:mime audio/mpeg # rates >2 byte&0xF0 0x10 \b, 32 kbps >2 byte&0xF0 0x20 \b, 48 kbps @@ -399,6 +400,7 @@ # MP3, M2A 0 beshort&0xFFFE 0xFFF2 MPEG ADTS, layer III, v2 +!:mime audio/mpeg # rate >2 byte&0xF0 0x10 \b, 8 kbps >2 byte&0xF0 0x20 \b, 16 kbps @@ -790,3 +792,24 @@ 0 belong 0x00000001 >4 byte&0x1F 0x07 !:mime video/h264 + +# Type: Bink Video +# URL: http://wiki.multimedia.cx/index.php?title=3DBink_Container +# From: <hoehle@users.sourceforge.net> 2008-07-18 +0 string BIK Bink Video +>3 regex =[a-z] rev.%s +#>4 ulelong x size %d +>20 ulelong x \b, %d +>24 ulelong x \bx%d +>8 ulelong x \b, %d frames +>32 ulelong x at rate %d/ +>28 ulelong >1 \b%d +>40 ulelong =0 \b, no audio +>40 ulelong !0 \b, %d audio track +>>40 ulelong !1 \bs +# follow properties of the first audio track only +>>48 uleshort x %dHz +>>51 byte&0x20 0 mono +>>51 byte&0x20 !0 stereo +#>>51 byte&0x10 0 FFT +#>>51 byte&0x10 !0 DCT Modified: head/contrib/file/Magdir/audio ============================================================================== --- head/contrib/file/Magdir/audio Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/audio Mon May 4 00:37:44 2009 (r191771) @@ -286,43 +286,14 @@ # SGI SoundTrack <mpruett@sgi.com> 0 string _SGI_SoundTrack SGI SoundTrack project file # ID3 version 2 tags <waschk@informatik.uni-rostock.de> -0 string ID3 Audio file with ID3 version 2. -# ??? Normally such a file is an MP3 file, but this will give false positives -!:mime audio/mpeg ->3 ubyte <0xff \b%d -#>4 ubyte <0xff \b%d tag ->2584 string fLaC \b, FLAC encoding ->>2588 byte&0x7f >0 \b, unknown version ->>2588 byte&0x7f 0 \b -# some common bits/sample values ->>>2600 beshort&0x1f0 0x030 \b, 4 bit ->>>2600 beshort&0x1f0 0x050 \b, 6 bit ->>>2600 beshort&0x1f0 0x070 \b, 8 bit ->>>2600 beshort&0x1f0 0x0b0 \b, 12 bit ->>>2600 beshort&0x1f0 0x0f0 \b, 16 bit ->>>2600 beshort&0x1f0 0x170 \b, 24 bit ->>>2600 byte&0xe 0x0 \b, mono ->>>2600 byte&0xe 0x2 \b, stereo ->>>2600 byte&0xe 0x4 \b, 3 channels ->>>2600 byte&0xe 0x6 \b, 4 channels ->>>2600 byte&0xe 0x8 \b, 5 channels ->>>2600 byte&0xe 0xa \b, 6 channels ->>>2600 byte&0xe 0xc \b, 7 channels ->>>2600 byte&0xe 0xe \b, 8 channels -# some common sample rates ->>>2597 belong&0xfffff0 0x0ac440 \b, 44.1 kHz ->>>2597 belong&0xfffff0 0x0bb800 \b, 48 kHz ->>>2597 belong&0xfffff0 0x07d000 \b, 32 kHz ->>>2597 belong&0xfffff0 0x056220 \b, 22.05 kHz ->>>2597 belong&0xfffff0 0x05dc00 \b, 24 kHz ->>>2597 belong&0xfffff0 0x03e800 \b, 16 kHz ->>>2597 belong&0xfffff0 0x02b110 \b, 11.025 kHz ->>>2597 belong&0xfffff0 0x02ee00 \b, 12 kHz ->>>2597 belong&0xfffff0 0x01f400 \b, 8 kHz ->>>2597 belong&0xfffff0 0x177000 \b, 96 kHz ->>>2597 belong&0xfffff0 0x0fa000 \b, 64 kHz ->>>2601 byte&0xf >0 \b, >4G samples ->2584 string !fLaC \b, MP3 encoding +0 string ID3 Audio file with ID3 version 2 +>3 byte x \b.%d +>4 byte x \b.%d +>>5 byte &0x80 \b, unsynchronized frames +>>5 byte &0x40 \b, extended header +>>5 byte &0x20 \b, experimental +>>5 byte &0x10 \b, footer present +>(6.I) indirect x \b, contains: # NSF (NES sound file) magic 0 string NESM\x1a NES Sound File Modified: head/contrib/file/Magdir/cafebabe ============================================================================== --- head/contrib/file/Magdir/cafebabe Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/cafebabe Mon May 4 00:37:44 2009 (r191771) @@ -12,16 +12,18 @@ # (and use as a hack). Let's not use 18, because the Mach-O people # might add another one or two as time goes by... # -0 beshort 0xcafe ->2 beshort 0xbabe +0 belong 0xcafebabe !:mime application/x-java-applet ->>2 belong >30 compiled Java class data, ->>>6 beshort x version %d. ->>>4 beshort x \b%d ->>4 belong 1 Mach-O fat file with 1 architecture ->>4 belong >1 ->>>4 belong <20 Mach-O fat file with %ld architectures ->2 beshort 0xd00d JAR compressed with pack200, +>4 belong >30 compiled Java class data, +>>6 beshort x version %d. +>>4 beshort x \b%d + +0 belong 0xcafebabe +>4 belong 1 Mach-O fat file with 1 architecture +>4 belong >1 +>>4 belong <20 Mach-O fat file with %ld architectures + +0 belong 0xcafed00d JAR compressed with pack200, >>5 byte x version %d. >>4 byte x \b%d !:mime application/x-java-pack200 Modified: head/contrib/file/Magdir/compress ============================================================================== --- head/contrib/file/Magdir/compress Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/compress Mon May 4 00:37:44 2009 (r191771) @@ -11,6 +11,7 @@ # standard unix compress 0 string \037\235 compress'd data !:mime application/x-compress +!:apple LZIVZIVU >2 byte&0x80 >0 block compressed >2 byte&0x1f x %d bits @@ -76,6 +77,11 @@ !:mime application/x-bzip2 >3 byte >47 \b, block size = %c00k +# lzip +0 string LZIP lzip compressed data +!:mime application/x-lzip +>4 byte x \b, version: %d + # squeeze and crunch # Michael Haardt <michael@cantor.informatik.rwth-aachen.de> 0 beshort 0x76FF squeezed data, Modified: head/contrib/file/Magdir/elf ============================================================================== --- head/contrib/file/Magdir/elf Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/elf Mon May 4 00:37:44 2009 (r191771) @@ -143,11 +143,13 @@ >>18 leshort 91 picoJava, >>18 leshort 92 OpenRISC, >>18 leshort 93 ARC Cores Tangent-A5, ->>18 leshort 0x3426 OpenRISC (obsolete), ->>18 leshort 0x8472 OpenRISC (obsolete), >>18 leshort 94 Tensilica Xtensa, >>18 leshort 97 NatSemi 32k, >>18 leshort 106 Analog Devices Blackfin, +>>18 leshort 113 Altera Nios II, +>>18 leshort 0xae META, +>>18 leshort 0x3426 OpenRISC (obsolete), +>>18 leshort 0x8472 OpenRISC (obsolete), >>18 leshort 0x9026 Alpha (unofficial), >>20 lelong 0 invalid version >>20 lelong 1 version 1 Modified: head/contrib/file/Magdir/epoc ============================================================================== --- head/contrib/file/Magdir/epoc Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/epoc Mon May 4 00:37:44 2009 (r191771) @@ -1,10 +1,11 @@ - #------------------------------------------------------------------------------ -# Epoc 32 : file(1) magic for Epoc Documents [psion/osaris +# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1] # Stefan Praszalowicz (hpicollo@worldnet.fr) -#0 lelong 0x10000037 Epoc32 +# Useful information for improving this file can be found at: +# http://software.frodo.looijaard.name/psiconv/formats/Index.html +0 lelong 0x10000037 >4 lelong 0x1000006D ->>8 lelong 0x1000007F Word ->>8 lelong 0x10000088 Sheet ->>8 lelong 0x1000007D Sketch ->>8 lelong 0x10000085 TextEd +>>8 lelong 0x1000007F Psion Word +>>8 lelong 0x10000088 Psion Sheet +>>8 lelong 0x1000007D Psion Sketch +>>8 lelong 0x10000085 Psion TextEd Modified: head/contrib/file/Magdir/filesystems ============================================================================== --- head/contrib/file/Magdir/filesystems Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/filesystems Mon May 4 00:37:44 2009 (r191771) @@ -104,9 +104,32 @@ >>>346 string des\ Betriebssystems >>>>366 string Betriebssystem\ nicht\ vorhanden \b, Microsoft Windows XP MBR (german) >>>>>0x1B8 ulelong >0 \b, Serial 0x%-.4x ->0x145 string Default:\ F \b, FREE-DOS MBR +#>0x145 string Default:\ F \b, FREE-DOS MBR +#>0x14B string Default:\ F \b, FREE-DOS 1.0 MBR +>0x145 search/7 Default:\ F \b, FREE-DOS MBR +#>>313 string F0\ .\ .\ . +#>>>322 string disk\ 1 +#>>>>382 string FAT3 >64 string no\ active\ partition\ found >>96 string read\ error\ while\ reading\ drive \b, FREE-DOS Beta 0.9 MBR +# Ranish Partition Manager http://www.ranish.com/part/ +>387 search/4 \0\ Error!\r +>>378 search/7 Virus! +>>>397 search/4 Booting\ +>>>>408 search/4 HD1/\0 \b, Ranish MBR ( +>>>>>416 string Writing\ changes... \b2.37 +>>>>>>438 ubyte x \b,0x%x dots +>>>>>>440 ubyte >0 \b,virus check +>>>>>>441 ubyte >0 \b,partition %c +#2.38,2.42,2.44 +>>>>>416 string !Writing\ changes... \b +>>>>>>418 ubyte 1 \bvirus check, +>>>>>>419 ubyte x \b0x%x seconds +>>>>>>420 ubyte&0x0F >0 \b,partition +>>>>>>>420 ubyte&0x0F <5 \b %x +>>>>>>>420 ubyte&0x0F 0Xf \b ask +>>>>>420 ubyte x \b) +# >271 string Operating\ system\ loading >>296 string error\r \b, SYSLINUX MBR (2.10) # http://www.acronis.de/ @@ -124,18 +147,20 @@ >0x40 string SBML # label with 11 characters of FAT 12 bit filesystem >>43 string SMART\ BTMGR ->>>430 string SBMK\ Bad!\r ->>>>3 string SBM \b, Smart Boot Manager ->>>>>6 string >\0 \b, version %s +>>>430 string SBMK\ Bad!\r \b, Smart Boot Manager +# OEM-ID not always "SBM" +#>>>>3 strings SBM +>>>>6 string >\0 \b, version %s >382 string XOSLLOADXCF \b, eXtended Operating System Loader >6 string LILO \b, LInux i386 boot LOader >>120 string LILO \b, version 22.3.4 SuSe >>172 string LILO \b, version 22.5.8 Debian -# updated by Joerg Jenderek +# updated by Joerg Jenderek at Oct 2008 # variables according to grub-0.97/stage1/stage1.S or # http://www.gnu.org/software/grub/manual/grub.html#Embedded-data # usual values are marked with comments to get only informations of strange GRUB loaders ->0 ulelong 0x009048EB +>342 search/60 \0Geom\0 +#>0 ulelong x %x=0x009048EB , 0x2a9048EB 0 >>0x41 ubyte <2 >>>0x3E ubyte >2 \b; GRand Unified Bootloader # 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90 @@ -178,15 +203,14 @@ >3 string BCDL >>498 string BCDL\ \ \ \ BIN \b, Bootable CD Loader (1.50Z) # mbr partion table entries -# OEM-ID not Microsoft,SYSLINUX,or MTOOLs +# OEM-ID does not contain MicroSoft,NEWLDR,DOS,SYSLINUX,or MTOOLs >3 string !MS >>3 string !SYSLINUX >>>3 string !MTOOL +>>>>3 string !NEWLDR +>>>>>5 string !DOS # not FAT (32 bit) ->>>>82 string !FAT32 -#not IO.SYS ->>>>>472 string !IO\ \ \ \ \ \ SYS ->>>>>>480 string !IO\ \ \ \ \ \ SYS +>>>>>>82 string !FAT32 #not Linux kernel >>>>>>>514 string !HdrS #not BeOS @@ -272,6 +296,11 @@ >>>>>>>>>(1.b+11) ubyte 0xb >>>>>>>>>>(1.b+12) ubyte 0x56 >>>>>>>>>>(1.b+13) ubyte 0xb4 \b, mkdosfs boot message display +>214 string Please\ try\ to\ install\ FreeDOS\ \b, DOS Emulator boot message display +#>>244 string from\ dosemu-freedos-*-bin.tgz\r +#>>>170 string Sorry,\ could\ not\ load\ an\ +#>>>>195 string operating\ system.\r\n +# >103 string This\ is\ not\ a\ bootable\ disk.\ >>132 string Please\ insert\ a\ bootable\ >>>157 string floppy\ and\r\n @@ -374,12 +403,22 @@ >430 string Datentr\204ger\ entfernen\xFF\r\n >>454 string Medienfehler\xFF\r\n >>>469 string Neustart:\ Taste\ dr\201cken\r \b, Microsoft Windows XP Bootloader (4.german) ->>>>368 ubyte&0xDF >0 ->>>>>368 string x %-.5s ->>>>>>373 ubyte&0xDF >0 ->>>>>>>373 string x \b%-.3s ->>>>>376 ubyte&0xDF >0 ->>>>>>376 string x \b.%-.3s +>>>>379 string \0 +>>>>>368 ubyte&0xDF >0 +>>>>>>368 string x %-.5s +>>>>>>>373 ubyte&0xDF >0 +>>>>>>>>373 string x \b%-.3s +>>>>>>376 ubyte&0xDF >0 +>>>>>>>376 string x \b.%-.3s +# variant +>>>>417 ubyte&0xDF >0 +>>>>>417 string x %-.5s +>>>>>>422 ubyte&0xDF >0 +>>>>>>>422 string x \b%-.3s +>>>>>425 ubyte&0xDF >0 +>>>>>>425 string >\ \b.%-.3s +# + #>3 string NTFS\ \ \ \ >389 string Fehler\ beim\ Lesen\ >>407 string des\ Datentr\204gers @@ -567,12 +606,27 @@ >>>489 string Any\ key\ to\ retry \b, DR-DOS Bootloader >>471 string Cannot\ load\ DOS\ >>487 string press\ key\ to\ retry \b, Open-DOS Bootloader +#?? >444 string KERNEL\ \ SYS >>314 string BOOT\ error! \b, FREE-DOS Bootloader >499 string KERNEL\ \ SYS >>305 string BOOT\ err!\0 \b, Free-DOS Bootloader >449 string KERNEL\ \ SYS >>319 string BOOT\ error! \b, FREE-DOS 0.5 Bootloader +# +>449 string Loading\ FreeDOS +>>0x1AF ulelong >0 \b, FREE-DOS 0.95,1.0 Bootloader +>>>497 ubyte&0xDF >0 +>>>>497 string x \b %-.6s +>>>>>503 ubyte&0xDF >0 +>>>>>>503 string x \b%-.1s +>>>>>>>504 ubyte&0xDF >0 +>>>>>>>>504 string x \b%-.1s +>>>>505 ubyte&0xDF >0 +>>>>>505 string x \b.%-.3s +# +>331 string Error!.0 \b, FREE-DOS 1.0 bootloader +# >125 string Loading\ FreeDOS...\r >>311 string BOOT\ error!\r \b, FREE-DOS bootloader >>>441 ubyte&0xDF >0 @@ -706,13 +760,7 @@ #it also hangs with another message ("NF"). >>>>>492 string RENF \b, FAT (12 bit) >>>>>495 string RENF \b, FAT (16 bit) -# added by Joerg Jenderek -# http://syslinux.zytor.com/iso.php -0 ulelong 0x7c40eafa isolinux Loader -# http://syslinux.zytor.com/pxe.php -0 ulelong 0x007c05ea pxelinux Loader -0 ulelong 0x60669c66 pxelinux Loader -# loader end +# x86 bootloader end # updated by Joerg Jenderek at Sep 2007 >3 ubyte 0 #no active flag @@ -732,6 +780,7 @@ # older drives may use Near JuMP instruction E9 xx xx >0 lelong&0x009000EB 0x009000EB >0 lelong&0x000000E9 0x000000E9 +# minimal short forward jump found 03cx?? # maximal short forward jump is 07fx >1 ubyte <0xff \b, code offset 0x%x # mtools-3.9.8/msdos.h @@ -740,91 +789,92 @@ >>11 uleshort&0x000f x >>>11 uleshort <32769 >>>>11 uleshort >31 ->>>>>3 string >\0 \b, OEM-ID "%8.8s" +>>>>>21 ubyte&0xf0 0xF0 +>>>>>>3 string >\0 \b, OEM-ID "%8.8s" #http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC ->>>>>>8 string IHC \b cached by Windows 9M ->>>>>11 uleshort >512 \b, Bytes/sector %u -#>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) ->>>>>11 uleshort <512 \b, Bytes/sector %u ->>>>>13 ubyte >1 \b, sectors/cluster %u -#>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) ->>>>>14 uleshort >32 \b, reserved sectors %u -#>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) -#>>>>>14 uleshort >1 \b, reserved sectors %u -#>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) ->>>>>14 uleshort <1 \b, reserved sectors %u ->>>>>16 ubyte >2 \b, FATs %u -#>>>>>16 ubyte =2 \b, FATs %u (usual) ->>>>>16 ubyte =1 \b, FAT %u ->>>>>16 ubyte >0 ->>>>>17 uleshort >0 \b, root entries %u -#>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) ->>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) -#>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) ->>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x -#>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) ->>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x ->>>>>22 uleshort >0 \b, sectors/FAT %u -#>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) ->>>>>26 ubyte >2 \b, heads %u -#>>>>>26 ubyte =2 \b, heads %u (usual floppy) ->>>>>26 ubyte =1 \b, heads %u +>>>>>>>8 string IHC \b cached by Windows 9M +>>>>>>11 uleshort >512 \b, Bytes/sector %u +#>>>>>>11 uleshort =512 \b, Bytes/sector %u=512 (usual) +>>>>>>11 uleshort <512 \b, Bytes/sector %u +>>>>>>13 ubyte >1 \b, sectors/cluster %u +#>>>>>>13 ubyte =1 \b, sectors/cluster %u (usual on Floppies) +>>>>>>14 uleshort >32 \b, reserved sectors %u +#>>>>>>14 uleshort =32 \b, reserved sectors %u (usual Fat32) +#>>>>>>14 uleshort >1 \b, reserved sectors %u +#>>>>>>14 uleshort =1 \b, reserved sectors %u (usual FAT12,FAT16) +>>>>>>14 uleshort <1 \b, reserved sectors %u +>>>>>>16 ubyte >2 \b, FATs %u +#>>>>>>16 ubyte =2 \b, FATs %u (usual) +>>>>>>16 ubyte =1 \b, FAT %u +>>>>>>16 ubyte >0 +>>>>>>17 uleshort >0 \b, root entries %u +#>>>>>>17 uleshort =0 \b, root entries %u=0 (usual Fat32) +>>>>>>19 uleshort >0 \b, sectors %u (volumes <=32 MB) +#>>>>>>19 uleshort =0 \b, sectors %u=0 (usual Fat32) +>>>>>>21 ubyte >0xF0 \b, Media descriptor 0x%x +#>>>>>>21 ubyte =0xF0 \b, Media descriptor 0x%x (usual floppy) +>>>>>>21 ubyte <0xF0 \b, Media descriptor 0x%x +>>>>>>22 uleshort >0 \b, sectors/FAT %u +#>>>>>>22 uleshort =0 \b, sectors/FAT %u=0 (usual Fat32) +>>>>>>26 ubyte >2 \b, heads %u +#>>>>>>26 ubyte =2 \b, heads %u (usual floppy) +>>>>>>26 ubyte =1 \b, heads %u #skip for Digital Research DOS (version 3.41) 1440 kB Bootdisk ->>>>>38 ubyte !0x70 ->>>>>>28 ulelong >0 \b, hidden sectors %u -#>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) ->>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) -#>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) +>>>>>>38 ubyte !0x70 +>>>>>>>28 ulelong >0 \b, hidden sectors %u +#>>>>>>>28 ulelong =0 \b, hidden sectors %u (usual floppy) +>>>>>>>32 ulelong >0 \b, sectors %u (volumes > 32 MB) +#>>>>>>>32 ulelong =0 \b, sectors %u (volumes > 32 MB) # FAT<32 specific ->>>>>82 string !FAT32 -#>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) -#>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) ->>>>>>36 ubyte !0x80 ->>>>>>>36 ubyte !0 \b, physical drive 0x%x ->>>>>>37 ubyte >0 \b, reserved 0x%x -#>>>>>>37 ubyte =0 \b, reserved 0x%x ->>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) ->>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) ->>>>>>38 ubyte =0x29 ->>>>>>>39 ulelong x \b, serial number 0x%x ->>>>>>>43 string <NO\ NAME \b, label: "%11.11s" ->>>>>>>43 string >NO\ NAME \b, label: "%11.11s" ->>>>>>>43 string =NO\ NAME \b, unlabeled ->>>>>>54 string FAT \b, FAT ->>>>>>>54 string FAT12 \b (12 bit) ->>>>>>>54 string FAT16 \b (16 bit) +>>>>>>82 string !FAT32 +#>>>>>>>36 ubyte 0x80 \b, physical drive 0x%x=0x80 (usual harddisk) +#>>>>>>>36 ubyte 0 \b, physical drive 0x%x=0 (usual floppy) +>>>>>>>36 ubyte !0x80 +>>>>>>>>36 ubyte !0 \b, physical drive 0x%x +>>>>>>>37 ubyte >0 \b, reserved 0x%x +#>>>>>>>37 ubyte =0 \b, reserved 0x%x +>>>>>>>38 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) +>>>>>>>38 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) +>>>>>>>38 ubyte =0x29 +>>>>>>>>39 ulelong x \b, serial number 0x%x +>>>>>>>>43 string <NO\ NAME \b, label: "%11.11s" +>>>>>>>>43 string >NO\ NAME \b, label: "%11.11s" +>>>>>>>>43 string =NO\ NAME \b, unlabeled +>>>>>>>54 string FAT \b, FAT +>>>>>>>>54 string FAT12 \b (12 bit) +>>>>>>>>54 string FAT16 \b (16 bit) # FAT32 specific ->>>>>82 string FAT32 \b, FAT (32 bit) ->>>>>>36 ulelong x \b, sectors/FAT %u ->>>>>>40 uleshort >0 \b, extension flags %u -#>>>>>>40 uleshort =0 \b, extension flags %u ->>>>>>42 uleshort >0 \b, fsVersion %u -#>>>>>>42 uleshort =0 \b, fsVersion %u (usual) ->>>>>>44 ulelong >2 \b, rootdir cluster %u -#>>>>>>44 ulelong =2 \b, rootdir cluster %u -#>>>>>>44 ulelong =1 \b, rootdir cluster %u ->>>>>>48 uleshort >1 \b, infoSector %u -#>>>>>>48 uleshort =1 \b, infoSector %u (usual) ->>>>>>48 uleshort <1 \b, infoSector %u ->>>>>>50 uleshort >6 \b, Backup boot sector %u -#>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) ->>>>>>50 uleshort <6 \b, Backup boot sector %u ->>>>>>54 ulelong >0 \b, reserved1 0x%x ->>>>>>58 ulelong >0 \b, reserved2 0x%x ->>>>>>62 ulelong >0 \b, reserved3 0x%x +>>>>>>82 string FAT32 \b, FAT (32 bit) +>>>>>>>36 ulelong x \b, sectors/FAT %u +>>>>>>>40 uleshort >0 \b, extension flags %u +#>>>>>>>40 uleshort =0 \b, extension flags %u +>>>>>>>42 uleshort >0 \b, fsVersion %u +#>>>>>>>42 uleshort =0 \b, fsVersion %u (usual) +>>>>>>>44 ulelong >2 \b, rootdir cluster %u +#>>>>>>>44 ulelong =2 \b, rootdir cluster %u +#>>>>>>>44 ulelong =1 \b, rootdir cluster %u +>>>>>>>48 uleshort >1 \b, infoSector %u +#>>>>>>>48 uleshort =1 \b, infoSector %u (usual) +>>>>>>>48 uleshort <1 \b, infoSector %u +>>>>>>>50 uleshort >6 \b, Backup boot sector %u +#>>>>>>>50 uleshort =6 \b, Backup boot sector %u (usual) +>>>>>>>50 uleshort <6 \b, Backup boot sector %u +>>>>>>>54 ulelong >0 \b, reserved1 0x%x +>>>>>>>58 ulelong >0 \b, reserved2 0x%x +>>>>>>>62 ulelong >0 \b, reserved3 0x%x # same structure as FAT1X ->>>>>>64 ubyte >0x80 \b, physical drive 0x%x -#>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) ->>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x -#>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) ->>>>>>65 ubyte >0 \b, reserved 0x%x ->>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) ->>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) ->>>>>>66 ubyte =0x29 ->>>>>>>67 ulelong x \b, serial number 0x%x ->>>>>>>71 string <NO\ NAME \b, label: "%11.11s" ->>>>>>71 string >NO\ NAME \b, label: "%11.11s" ->>>>>>71 string =NO\ NAME \b, unlabeled +>>>>>>>64 ubyte >0x80 \b, physical drive 0x%x +#>>>>>>>64 ubyte =0x80 \b, physical drive 0x%x=80 (usual harddisk) +>>>>>>>64 ubyte&0x7F >0 \b, physical drive 0x%x +#>>>>>>>64 ubyte =0 \b, physical drive 0x%x=0 (usual floppy) +>>>>>>>65 ubyte >0 \b, reserved 0x%x +>>>>>>>66 ubyte >0x29 \b, dos < 4.0 BootSector (0x%x) +>>>>>>>66 ubyte <0x29 \b, dos < 4.0 BootSector (0x%x) +>>>>>>>66 ubyte =0x29 +>>>>>>>>67 ulelong x \b, serial number 0x%x +>>>>>>>>71 string <NO\ NAME \b, label: "%11.11s" +>>>>>>>71 string >NO\ NAME \b, label: "%11.11s" +>>>>>>>71 string =NO\ NAME \b, unlabeled ### FATs end >0x200 lelong 0x82564557 \b, BSD disklabel # FATX @@ -854,6 +904,13 @@ 0x18b string OS/2 OS/2 Boot Manager +# updated by Joerg Jenderek at Oct 2008!! +# http://syslinux.zytor.com/iso.php +0 ulelong 0x7c40eafa isolinux Loader +# http://syslinux.zytor.com/pxe.php +0 ulelong 0x007c05ea pxelinux Loader +0 ulelong 0x60669c66 pxelinux Loader + # added by Joerg Jenderek # In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or # grub-1.94/kern/i386/pc/startup.S @@ -1324,6 +1381,14 @@ >0x10024 belong x (blocksize %d, >0x10060 string >\0 lockproto %s) +# BTRFS +0x10040 string _BHRfS_M BTRFS Filesystem +>0x1012b string >\0 (label "%s", +>0x10090 lelong x sectorsize %d, +>0x10094 lelong x nodesize %d, +>0x10098 lelong x leafsize %d) + + # dvdisaster's .ecc # From: "Nelson A. de Oliveira" <naoliv@gmail.com> 0 string *dvdisaster* dvdisaster error correction file Modified: head/contrib/file/Magdir/graphviz ============================================================================== --- head/contrib/file/Magdir/graphviz Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/graphviz Mon May 4 00:37:44 2009 (r191771) @@ -1,7 +1,10 @@ - #------------------------------------------------------------------------------ # graphviz: file(1) magic for http://www.graphviz.org/ -0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]*.*\\{ graphviz graph text -!:mime text/vnd.graphviz -0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]*.*\\{ graphviz digraph text -!:mime text/vnd.graphviz + +# FIXME: These patterns match too generally. For example, the first +# line matches a LaTeX file containing the word "graph" (with a { +# following later) and the second line matches this file. +#0 regex/100 [\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{ graphviz graph text +#!:mime text/vnd.graphviz +#0 regex/100 [\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{ graphviz digraph text +#!:mime text/vnd.graphviz Modified: head/contrib/file/Magdir/images ============================================================================== --- head/contrib/file/Magdir/images Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/images Mon May 4 00:37:44 2009 (r191771) @@ -110,6 +110,7 @@ # GIF 0 string GIF8 GIF image data !:mime image/gif +!:apple 8BIMGIFf >4 string 7a \b, version 8%s, >4 string 9a \b, version 8%s, >6 leshort >0 %hd x @@ -600,3 +601,7 @@ # Wavelet Scalar Quantization format used in gray-scale fingerprint images # From Tano M Fotang <mfotang@quanteq.com> 0 string \xff\xa0\xff\xa8\x00 Wavelet Scalar Quantization image data + +# JPEG 2000 Code Stream Bitmap +# From Petr Splichal <psplicha@redhat.com> +0 string \xFF\x4F\xFF\x51\x00 JPEG-2000 Code Stream Bitmap data Modified: head/contrib/file/Magdir/jpeg ============================================================================== --- head/contrib/file/Magdir/jpeg Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/jpeg Mon May 4 00:37:44 2009 (r191771) @@ -10,6 +10,7 @@ # 0 beshort 0xffd8 JPEG image data !:mime image/jpeg +!:apple 8BIMJPEG !:strength +1 >6 string JFIF \b, JFIF standard # The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06 Modified: head/contrib/file/Magdir/mach ============================================================================== --- head/contrib/file/Magdir/mach Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/mach Mon May 4 00:37:44 2009 (r191771) @@ -4,7 +4,7 @@ # Java ByteCode, so they are both handled in the file "cafebabe". # The "feedface" ones are handled herein. #------------------------------------------------------------ -0 lelong&0xfeffffff 0xfeedface Mach-O +0 lelong&0xfffffffe 0xfeedface Mach-O >0 byte 0xcf 64-bit >12 lelong 1 object >12 lelong 2 executable Modified: head/contrib/file/Magdir/macintosh ============================================================================== --- head/contrib/file/Magdir/macintosh Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/macintosh Mon May 4 00:37:44 2009 (r191771) @@ -11,6 +11,8 @@ # Stuffit archives are the de facto standard of compression for Macintosh # files obtained from most archives. (franklsm@tuns.ca) 0 string SIT! StuffIt Archive (data) +!:mime application/x-stuffit +!:apple SIT!SIT! >2 string x : %s 0 string SITD StuffIt Deluxe (data) >2 string x : %s @@ -20,6 +22,7 @@ # Newer StuffIt archives (grant@netbsd.org) 0 string StuffIt StuffIt Archive !:mime application/x-stuffit +!:apple SIT!SIT! #>162 string >0 : %s # Macintosh Applications and Installation binaries (franklsm@tuns.ca) Modified: head/contrib/file/Magdir/msdos ============================================================================== --- head/contrib/file/Magdir/msdos Mon May 4 00:19:00 2009 (r191770) +++ head/contrib/file/Magdir/msdos Mon May 4 00:37:44 2009 (r191771) @@ -4,15 +4,15 @@ # # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) -# updated by Joerg Jenderek +# updated by Joerg Jenderek at Oct 2008 0 string @ ->1 string/cB \ echo\ off MS-DOS batch file text +>1 string/cB \ echo\ off DOS batch file text !:mime text/x-msdos-batch ->1 string/cB echo\ off MS-DOS batch file text +>1 string/cB echo\ off DOS batch file text !:mime text/x-msdos-batch ->1 string/cB rem\ MS-DOS batch file text +>1 string/cB rem\ DOS batch file text !:mime text/x-msdos-batch ->1 string/cB set\ MS-DOS batch file text +>1 string/cB set\ DOS batch file text !:mime text/x-msdos-batch @@ -285,8 +285,9 @@ # Uncommenting only the first two lines will cover about 2/3 of COM files, # but it isn't feasible to match all COM files since there must be at least # two dozen different one-byte "magics". -#0 byte 0xe9 DOS executable (COM) -#>0x1FE leshort 0xAA55 \b, boot code +# test too generic ? +0 byte 0xe9 DOS executable (COM) +>0x1FE leshort 0xAA55 \b, boot code >6 string SFX\ of\ LHarc (%s) 0 belong 0xffffffff DOS executable (device driver) #CMD640X2.SYS @@ -309,25 +310,38 @@ >>77 string >\x40 >>>77 string <\x5B >>>>77 string x \b, name: %.8s -#0 byte 0x8c DOS executable (COM) -# 0xeb conflicts with "sequent" magic -#0 byte 0xeb DOS executable (COM) -#>0x1FE leshort 0xAA55 \b, boot code -#>85 string UPX \b, UPX compressed -#>4 string \ $ARX \b, ARX self-extracting archive -#>4 string \ $LHarc \b, LHarc self-extracting archive -#>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive +# test too generic ? +0 byte 0x8c DOS executable (COM) +# updated by Joerg Jenderek at Oct 2008 +0 ulelong 0xffff10eb DR-DOS executable (COM) +# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb +0 ubeshort&0xeb8d >0xeb00 +# DR-DOS STACKER.COM SCREATE.SYS missed +>0 byte 0xeb DOS executable (COM) +>>0x1FE leshort 0xAA55 \b, boot code +>>85 string UPX \b, UPX compressed +>>4 string \ $ARX \b, ARX self-extracting archive +>>4 string \ $LHarc \b, LHarc self-extracting archive +>>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive +# updated by Joerg Jenderek at Oct 2008 #0 byte 0xb8 COM executable +0 uleshort&0x80ff 0x00b8 # modified by Joerg Jenderek ->1 lelong !0x21cd4cff for DOS +>1 lelong !0x21cd4cff COM executable for DOS # http://syslinux.zytor.com/comboot.php # (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode # start with assembler instructions mov eax,21cd4cffh ->1 lelong 0x21cd4cff (32-bit COMBOOT) *** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200905040037.n440biJ1028655>