From owner-freebsd-questions@FreeBSD.ORG  Fri Jul  2 18:23:28 2010
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 3A2FD106566B
	for <freebsd-questions@freebsd.org>;
	Fri,  2 Jul 2010 18:23:28 +0000 (UTC)
	(envelope-from freebsd-questions-local@be-well.ilk.org)
Received: from mail3.sea5.speakeasy.net (mail3.sea5.speakeasy.net
	[69.17.117.42]) by mx1.freebsd.org (Postfix) with ESMTP id 1442D8FC18
	for <freebsd-questions@freebsd.org>;
	Fri,  2 Jul 2010 18:23:27 +0000 (UTC)
Received: (qmail 26579 invoked from network); 2 Jul 2010 18:23:27 -0000
Received: from dsl092-078-145.bos1.dsl.speakeasy.net (HELO be-well.ilk.org)
	([66.92.78.145])
	(envelope-sender <freebsd-questions-local@be-well.ilk.org>)
	by mail3.sea5.speakeasy.net (qmail-ldap-1.03) with SMTP
	for <freebsd@edvax.de>; 2 Jul 2010 18:23:27 -0000
Received: by be-well.ilk.org (Postfix, from userid 1147)
	id 514E35084D; Fri,  2 Jul 2010 14:23:24 -0400 (EDT)
From: Lowell Gilbert <freebsd-questions-local@be-well.ilk.org>
To: Polytropon <freebsd@edvax.de>
References: <4C2DF07F.1020509@tundraware.com> <44630xq527.fsf@be-well.ilk.org>
	<20100702173504.c53738b2.freebsd@edvax.de>
Date: Fri, 02 Jul 2010 14:23:24 -0400
In-Reply-To: <20100702173504.c53738b2.freebsd@edvax.de> (Polytropon's message
	of "Fri, 2 Jul 2010 17:35:04 +0200")
Message-ID: <44r5jln3oj.fsf@be-well.ilk.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/23.2 (berkeley-unix)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: freebsd-questions@freebsd.org
Subject: Re: 'file' Command Giving False Positives
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: freebsd-questions@freebsd.org
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Jul 2010 18:23:28 -0000

Polytropon <freebsd@edvax.de> writes:

> On Fri, 02 Jul 2010 11:25:20 -0400, Lowell Gilbert <freebsd-questions-local@be-well.ilk.org> wrote:
>> Why is it incorrect?  "LZ" as the first two bytes in a file is (unless
>> my memory is badly mistaken) exactly what the old command.com looked for
>> as the flag of an executable.
>
> If I ask *my* memory, it tells me that what you mean is "MZ". As
> far as I remember, those are the initials of a programmer involved
> with the creation of the DOS binary executable format. :-)

Apparently, your memory is better than mine, because that was indeed
what I was thinking of.  Which leads to the question of why magic(5)
lists LZ as representing "MS-DOS executable (built-in)".  I'd be
hesitant to change that unless we knew for sure it was wrong.

Even if it _is_ wrong, the "problem" still remains for "MZ" at least:
Any file starting with those letters is going to be identified as an
MS-DOS executable, and there's no clear way to distinguish it from a
text file that happens to start with those letters.