#! file
# Magic data for file(1) command.
# Machine-genererated from src/cmd/file/magdir/*; edit there only!
# Format is described in magic(files), where:
# files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID.

#------------------------------------------------------------------------------
# alliant:  file(1) magic for Alliant FX series a.out files
#
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".
# If it's the i860-based one, they should probably become either the
# big-endian or little-endian versions, depending on the mode they ran
# the 860 in....
#
0  short    0420     0420 Alliant virtual executable
>2 short    &0x0020     common library
>16   long     >0    not stripped
0  short    0421     0421 Alliant compact executable
>2 short    &0x0020     common library
>16   long     >0    not stripped
#------------------------------------------------------------------------------
# alpha architecture description
#

0  leshort     0603     COFF format alpha
>22   leshort&030000 !020000     executable
>24   leshort     0410     pure
>24   leshort     0413     paged
>22   leshort&020000 !0    dynamically linked
>16   lelong      !0    not stripped
>16   lelong      0     stripped
>22   leshort&030000 020000      shared library
>24   leshort     0407     object
>27   byte     x     - version %d
>26   byte     x     .%d
>28   byte     x     -%d

# Basic recognition of OSF/1 core dumps - Mike Bremford <mike@opac.bl.uk>
#
0  string      Core\001 COFF format core dump (OSF/1)
>24   string      >\0      generated by '%s'
#------------------------------------------------------------------------------
# amanda:  file(1) magic for amanda file format
#
0       string          AMANDA:\ TAPESTART\ DATE     AMANDA dump header file,
>23     string          X
>>25    string          >\                           Unused %s
>23     string          >\                           DATE %s
#------------------------------------------------------------------------------
# amigaos:  file(1) magic for AmigaOS binary formats:

#
# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
# Some formats are still missing: AmigaOS special IFF's, e.g.: FORM....CTLG
# (the others should be seperate, anyway)
#
0  belong      0x000003f3  AmigaOS loadseg()ble executable/binary
0  belong      0x000003e7  AmigaOS object/library data

#------------------------------------------------------------------------------
# animation:  file(1) magic for animation/movie formats
#
# animation formats
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)

# MPEG animation format
0  string      \000\000\001\263  MPEG file

# FLI animation format
4  leshort     0xAF11         FLI file
>6 leshort     x        - %d frames,
>8 leshort     x        width=%d pixels,
>10   leshort     x        height=%d pixels,
>12   leshort     x        depth=%d,
>16   leshort     x        ticks/frame=%d
# FLC animation format
4  leshort     0xAF12         FLC file
>6 leshort     x        - %d frames
>8 leshort     x        width=%d pixels,
>10   leshort     x        height=%d pixels,
>12   leshort     x        depth=%d,
>16   leshort     x        ticks/frame=%d

# DL animation format
# XXX - collision with most `mips' magic
#
# I couldn't find a real magic number for these, however, this
# -appears- to work.  Note that it might catch other files, too, so be
# careful!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)!  The DL format is really bad.
#
#0 byte  1  DL version 1, medium format (160x100, 4 images/screen)
#>42  byte  x  - %d screens,
#>43  byte  x  %d commands
#0 byte  2  DL version 2
#>1   byte  1  - large format (320x200,1 image/screen),
#>1   byte  2  - medium format (160x100,4 images/screen),
#>1   byte  >2 - unknown format,
#>42  byte  x  %d screens,
#>43  byte  x  %d commands
# Based on empirical evidence, DL version 3 have several nulls following the
# \003.  Most of them start with non-null values at hex offset 0x34 or so.
#0 string   \3\0\0\0\0\0\0\0\0\0\0\0   DL version 3

# SGI and Apple formats
0  string      MOVI     Silicon Graphics movie file
4  string      moov     Apple QuickTime movie file (moov)
4  string      mdat     Apple QuickTime movie file (mdat)

#------------------------------------------------------------------------------
# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
#       workspaces)
#
0  long     0100554     APL workspace (Ken's original?)

#------------------------------------------------------------------------------
# apple:  file(1) magic for Apple II file formats
#
0  string      FiLeStArTfIlEsTaRt   binscii (apple ][) text
0  string      \x0aGL         Binary II (apple ][) data
0  string      \x76\xff    Squeezed (apple ][) data
0  string      SIT!        StuffIt (macintosh) text
0  string      NuFile         NuFile archive (apple ][) data
0  string      N\xf5F\xe9l\xe5      NuFile archive (apple ][) data

#------------------------------------------------------------------------------
# archive:  file(1) magic for archive formats (see also "msdos" for self-
#           extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are handled in the C code.

# POSIX tar archives
257   string      ustar\0     POSIX tar archive
257   string      ustar\040\040\0   GNU tar archive

# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0  short    070707      cpio archive
0  short    0143561     byte-swapped cpio archive
0  string      070707      ASCII cpio archive (pre-SVR4 or odc)
0  string      070701      ASCII cpio archive (SVR4 with no CRC)
0  string      070702      ASCII cpio archive (SVR4 with CRC)

# other archives
0  long     0177555     very old archive
0  short    0177555     very old PDP-11 archive
0  long     0177545     old archive
0  short    0177545     old PDP-11 archive
0  long     0100554     apl workspace
0  string      =<ar>    archive

# MIPS archive (needs to go first)
#
0  string   !<arch>\n__________E MIPS archive
>20   string   U        with MIPS Ucode members
>21   string   L        with MIPSEL members
>21   string   B        with MIPSEB members
>19   string   L        and an EL hash table
>19   string   B        and an EB hash table
>22   string   X        -- out of date

0  string      -h-      Software Tools format archive text

#
# XXX - why are there multiple <ar> thingies?  Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0   string      !<arch>     current ar archive
# 0   long     0x213c6172  archive file
#
# and for SVR1 archives, we have:
#
# 0   string      \<ar>    System V Release 1 ar archive
# 0   string      =<ar>    archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0  string      !<arch>     current ar archive
>8 string      __.SYMDEF   random library
>8 string      debian-split   part of multipart Debian package
>8 string      debian-binary  Debian binary package
>0 belong      =65538      - pre SR9.5
>0 belong      =65539      - post SR9.5
>0 beshort     2     - object archive
>0 beshort     3     - shared library module
>0 beshort     4     - debug break-pointed module
>0 beshort     5     - absolute code program module
0  string      \<ar>    System V Release 1 ar archive
0  string      =<ar>    archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
0  belong      0x65ff0000  VAX 3.0 archive
0  belong      0x3c61723e  VAX 5.0 archive
#
0  long     0x213c6172  archive file
0  lelong      0177555     very old VAX archive
0  leshort     0177555     very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0  lelong      0177545     old VAX archive
>8 string      __.SYMDEF   random library
0  leshort     0177545     old PDP-11 archive
>8 string      __.SYMDEF   random library
#
# From "pdp" (but why a 4-byte quantity?)
#
0  lelong      0x39bed     PDP-11 old archive
0  lelong      0x39bee     PDP-11 4.0 archive

# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated).  Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
0  lelong&0x8080ffff 0x0000081a  ARC archive data, dynamic LZW
0  lelong&0x8080ffff 0x0000091a  ARC archive data, squashed
0  lelong&0x8080ffff 0x0000021a  ARC archive data, uncompressed
0  lelong&0x8080ffff 0x0000031a  ARC archive data, packed
0  lelong&0x8080ffff 0x0000041a  ARC archive data, squeezed
0  lelong&0x8080ffff 0x0000061a  ARC archive data, crunched

# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR:  the original entries collide with ARC, above; replaced with combined
#  version (not tested)]
#0 byte     0x1a     RISC OS archive
#>1   string      archive     (ArcFS format)
0  string      \032archive RISC OS archive (ArcFS format)

# ARJ archiver (jason@jarthur.Claremont.EDU)
0  leshort     0xea60      ARJ archive data
>5 byte     x     \b, v%d,
>8 byte     &0x04    multi-volume,
>8 byte     &0x10    slash-switched,
>8 byte     &0x20    backup,
>34   string      x     original name: %s,
>7 byte     0     os: MS-DOS
>7 byte     1     os: PRIMOS
>7 byte     2     os: Unix
>7 byte     3     os: Amiga
>7 byte     4     os: Macintosh
>7 byte     5     os: OS/2
>7 byte     6     os: Apple ][ GS
>7 byte     7     os: Atari ST
>7 byte     8     os: NeXT
>7 byte     9     os: VAX/VMS
>3 byte     >0    %d]

# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0 string      HA    HA archive data,
#>2   leshort     =1    1 file,
#>2   leshort     >1    %u files,
#>4   byte&0x0f   =0    first is type CPY
#>4   byte&0x0f   =1    first is type ASC
#>4   byte&0x0f   =2    first is type HSC
#>4   byte&0x0f   =0x0e    first is type DIR
#>4   byte&0x0f   =0x0f    first is type SPECIAL

# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0  string      HPAK     HPACK archive data

# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0  string      \351,\001JAM\     JAM archive,
>7 string      >\0         version %.4s
>0x26 byte     =0x27       -
>>0x2b   string          >\0        label %.11s,
>>0x27   lelong      x        serial %08x,
>>0x36   string      >\0         fstype %.8s

# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2  string      -lh0-    LHarc 1.x archive data [lh0]
2  string      -lh1-    LHarc 1.x archive data [lh1]
2  string      -lz4-    LHarc 1.x archive data [lz4]
2  string      -lz5-    LHarc 1.x archive data [lz5]
#  [never seen any but the last; -lh4- reported in comp.compression:]
2  string      -lzs-    LHa 2.x? archive data [lzs]
2  string      -lh -    LHa 2.x? archive data [lh ]
2  string      -lhd-    LHa 2.x? archive data [lhd]
2  string      -lh2-    LHa 2.x? archive data [lh2]
2  string      -lh3-    LHa 2.x? archive data [lh3]
2  string      -lh4-    LHa (2.x) archive data [lh4]
2  string      -lh5-    LHa (2.x) archive data [lh5]
>20   byte     x     - header level %d

# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0  string      Rar!     RAR archive data

# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0  string      SQSH     squished archive data (Acorn RISCOS)

# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# I can't figure out the self-extracting form of these buggers...
0  string      UC2\x1a     UC2 archive data

# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0  string      PK\003\004  Zip archive data
>4 byte     0x09     \b, at least v0.9 to extract
>4 byte     0x0a     \b, at least v1.0 to extract
>4 byte     0x0b     \b, at least v1.1 to extract
>4 byte     0x14     \b, at least v2.0 to extract

# Zoo archiver
20 lelong      0xfdc4a7dc  Zoo archive data
>4 byte     >48      \b, v%c.
>>6   byte     >47      \b%c
>>>7  byte     >47      \b%c
>32   byte     >0    \b, modify: v%d
>>33  byte     x     \b.%d+
>42   lelong      0xfdc4a7dc  \b,
>>70  byte     >0    extract: v%d
>>>71 byte     x     \b.%d+

# Shell archives
10 string      #\ This\ is\ a\ shell\ archive   shell archive text

#------------------------------------------------------------------------------
# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
# strings as "long" - we assume they're just strings:
# From: guy@netapp.com (Guy Harris)
#
0  string      *STA     Aster*x
>7 string      WORD        Words Document
>7 string      GRAP        Graphic
>7 string      SPRE        Spreadsheet
>7 string      MACR        Macro
0  string      2278     Aster*x Version 2
>29   byte     0x36        Words Document
>29   byte     0x35        Graphic
>29   byte     0x32        Spreadsheet
>29   byte     0x38        Macro


#------------------------------------------------------------------------------
# att3b:  file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
# 3B20
#
0  beshort     0550     3b20 COFF executable
>12   belong      >0    not stripped
#>22  beshort     >0    - version %ld
0  beshort     0551     3b20 COFF executable (TV)
>12   belong      >0    not stripped
#>22  beshort     >0    - version %ld
#
# WE32K
#
0  beshort     0560     WE32000 COFF
>18   beshort     ^00000020   object
>18   beshort     &00000020   executable
>12   belong      >0    not stripped
>18   beshort     ^00010000   N/A on 3b2/300 w/paging
>18   beshort     &00020000   32100 required
>18   beshort     &00040000   and MAU hardware required
>20   beshort     0407     (impure)
>20   beshort     0410     (pure)
>20   beshort     0413     (demand paged)
>20   beshort     0443     (target shared library)
>22   beshort     >0    - version %ld
0  beshort     0561     WE32000 COFF executable (TV)
>12   belong      >0    not stripped
#>18  beshort     &00020000   - 32100 required
#>18  beshort     &00040000   and MAU hardware required
#>22  beshort     >0    - version %ld
#
# core file for 3b2 
0  string      \000\004\036\212\200 3b2 core file
>364  string      >\0      of '%s'

#------------------------------------------------------------------------------
# audio:  file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
# and others
#

# Sun/NeXT audio data
0  string      .snd     Sun/NeXT audio data:
>12   belong      1     8-bit ISDN u-law,
>12   belong      2     8-bit linear PCM [REF-PCM],
>12   belong      3     16-bit linear PCM,
>12   belong      4     24-bit linear PCM,
>12   belong      5     32-bit linear PCM,
>12   belong      6     32-bit IEEE floating point,
>12   belong      7     64-bit IEEE floating point,
>12   belong      23    8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>12   belong      24    compressed (8-bit G.722 ADPCM)
>12   belong      25    compressed (3-bit G.723 ADPCM),
>12   belong      26    compressed (5-bit G.723 ADPCM),
>12   belong      27    8-bit A-law,
>20   belong      1     mono,
>20   belong      2     stereo,
>20   belong      4     quad,
>16   belong      >0    %d Hz

# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
0  lelong      0x0064732E  DEC audio data:
>12   lelong      1     8-bit ISDN u-law,
>12   lelong      2     8-bit linear PCM [REF-PCM],
>12   lelong      3     16-bit linear PCM,
>12   lelong      4     24-bit linear PCM,
>12   lelong      5     32-bit linear PCM,
>12   lelong      6     32-bit IEEE floating point,
>12   lelong      7     64-bit IEEE floating point,
>12   lelong      23    8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>20   lelong      1     mono,
>20   lelong      2     stereo,
>20   lelong      4     quad,
>16   lelong      >0    %d Hz

# Creative Labs AUDIO stuff
0  string   MThd        Standard MIDI data
>9    byte  >0       (format %d)
>11   byte  >1       using %d channels
0  string   CTMF        Creative Music (CMF) data
0  string   SBI         SoundBlaster instrument data
0  string   Creative\ Voice\ File   Creative Labs voice data
# is this next line right?  it came this way...
>19   byte  0x1A
>23   byte  >0       - version %d
>22   byte  >0       \b.%d

# first entry is also the string "NTRK"
0  belong      0x4e54524b  MultiTrack sound data
>4 belong      x     - version %ld

# Microsoft WAVE format (*.wav)
0  string      RIFF     Microsoft RIFF
>8 string      WAVE     \b, WAVE audio data
>>34  leshort     >0    \b, %d bit
>>22  leshort     =1    \b, mono
>>22  leshort     =2    \b, stereo
>>22  leshort     >2    \b, %d channels
>>24  lelong      >0    %d Hz
# AVI == Audio Video Interleave
>8      string          AVI\            \b, AVI data

# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
0  string      EMOD     Extended MOD sound data,
>4 byte&0xf0   x     version %d
>4 byte&0x0f   x     \b.%d,
>45   byte     x     %d instruments
>83   byte     0     (module)
>83   byte     1     (song)

# Real Audio (Magic .ra\0375)
0  belong      0x2e7261fd  realaudio sound file

# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
# Oct 31, 1995
0  string      MTM      MultiTracker Module sound file
0  string      if    Composer 669 Module sound data
0  string      FAR      Module sound data
0  string      MAS_U    ULT(imate) Module sound data
0x2c  string      SCRM     ScreamTracker III Module sound data
0  string      Extended Module   Extended Module sound data

#------------------------------------------------------------------------------
# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on
# little-endian machines as well?  If so, what's the deal with
# "VAX-order" and "VAX-order2"?
#
#0 long     0407     68K Blit (standalone) executable
#0 short    0407     VAX-order2 68K Blit (standalone) executable
0  short    03401    VAX-order 68K Blit (standalone) executable
0  long     0406     68k Blit mpx/mux executable
0  short    0406     VAX-order2 68k Blit mpx/mux executable
0  short    03001    VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0 short    0520     tty630 layers executable

#------------------------------------------------------------------------------
# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
#
0  lelong         000000314   BSD/OS i386 compact demand paged executable
>16   lelong         >0    not stripped
>32   byte        0x6a     (uses shared libs)

#------------------------------------------------------------------------------
# c-lang:  file(1) magic for C programs (or REXX)
#

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# if you uncomment "/*" for C/REXX below, also uncomment this entry
#0 string      /*\ XPM\ */ X pixmap image data

# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
#0 string      /*    C or REXX program text
0  string      //    C++ program text

#------------------------------------------------------------------------------
# chi:  file(1) magic for ChiWriter files
#
0       string          \\1cw\          ChiWriter file
>5      string          >\0             version %s
0       string          \\1cw           ChiWriter file

#------------------------------------------------------------------------------
# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
# >18 short    !074000,000000 C1 R1 
# >18 short    !074000,004000 C2 R1
# >18 short    !074000,010000 C3 R1
# >18 short    !074000,074000 TEST
#
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# >18 short&074000   000000      C1 R1 
# >18 short&074000   004000      C2 R1
# >18 short&074000   010000      C3 R1
# >18 short&074000   074000      TEST
#
# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
# sort, nor does SunOS 4.x, so either it's something Intergraph added
# in CLIX, or something AT&T added in SVR3.2 or later, or something
# somebody else thought was a good idea; it's not documented in the
# man page for this version of "magic", nor does it appear to be
# implemented (at least not after I blew off the bogus code to turn
# old-style "&"s into new-style "&"s, which just didn't work at all).
#
0  short    0575     CLIPPER COFF executable (VAX #)
>20   short    0407     (impure)
>20   short    0410     (5.2 compatible)
>20   short    0411     (pure)
>20   short    0413     (demand paged)
>20   short    0443     (target shared library)
>12   long     >0    not stripped
>22   short    >0    - version %ld
0  short    0577     CLIPPER COFF executable
>18   short&074000   000000      C1 R1 
>18   short&074000   004000      C2 R1
>18   short&074000   010000      C3 R1
>18   short&074000   074000      TEST
>20   short    0407     (impure)
>20   short    0410     (pure)
>20   short    0411     (separate I&D)
>20   short    0413     (paged)
>20   short    0443     (target shared library)
>12   long     >0    not stripped
>22   short    >0    - version %ld
>48   long&01     01    alignment trap enabled
>52   byte     1     -Ctnc
>52   byte     2     -Ctsw
>52   byte     3     -Ctpw
>52   byte     4     -Ctcb
>53   byte     1     -Cdnc
>53   byte     2     -Cdsw
>53   byte     3     -Cdpw
>53   byte     4     -Cdcb
>54   byte     1     -Csnc
>54   byte     2     -Cssw
>54   byte     3     -Cspw
>54   byte     4     -Cscb
4  string      pipe     CLIPPER instruction trace
4  string      prof     CLIPPER instruction profile

#------------------------------------------------------------------------------
# commands:  file(1) magic for various shells and interpreters
#
0  string      :\ shell archive or commands for antique kernel text
0  string      #!/bin/sh      Bourne shell script text
0  string      #!\ /bin/sh    Bourne shell script text
0  string      #!/bin/csh     C shell script text
0  string      #!\ /bin/csh      C shell script text
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0  string      #!/bin/ksh     Korn shell script text
0  string      #!\ /bin/ksh      Korn shell script text
0  string      #!/bin/tcsh    Tenex C shell script text
0  string      #!\ /bin/tcsh     Tenex C shell script text
0  string      #!/usr/local/tcsh Tenex C shell script text
0  string      #!\ /usr/local/tcsh  Tenex C shell script text
0  string      #!/usr/local/bin/tcsh   Tenex C shell script text
0  string      #!\ /usr/local/bin/tcsh Tenex C shell script text
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0  string      #!/usr/local/bin/zsh Paul Falstad's zsh
0  string      #!\ /usr/local/bin/zsh  Paul Falstad's zsh
0  string      #!/usr/local/bin/ash Neil Brown's ash
0  string      #!\ /usr/local/bin/ash  Neil Brown's ash
0  string      #!/usr/local/bin/ae  Neil Brown's ae
0  string      #!\ /usr/local/bin/ae   Neil Brown's ae
0  string      #!/bin/nawk    new awk script text
0  string      #!\ /bin/nawk     new awk script text
0  string      #!/usr/bin/nawk      new awk script text
0  string      #!\ /usr/bin/nawk new awk script text
0  string      #!/usr/local/bin/nawk   new awk script text
0  string      #!\ /usr/local/bin/nawk new awk script text
0  string      #!/bin/gawk    GNU awk script text
0  string      #!\ /bin/gawk     GNU awk script text
0  string      #!/usr/bin/gawk      GNU awk script text
0  string      #!\ /usr/bin/gawk GNU awk script text
0  string      #!/usr/local/bin/gawk   GNU awk script text
0  string      #!\ /usr/local/bin/gawk GNU awk script text
#
0  string      #!/bin/awk     awk commands text
0  string      #!\ /bin/awk      awk commands text
0  string      #!/usr/bin/awk    awk commands text
0  string      #!\ /usr/bin/awk  awk commands text
0  string      BEGIN       awk commands text

# For Larry Wall's perl language.  The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
#           Keith Waclena <keith@cerberus.uchicago.edu>
0  string      #!/bin/perl       perl commands text
0  string      #!\ /bin/perl        perl commands text
0  string      eval\ "exec\ /bin/perl		perl commands text
0  string      #!/usr/bin/perl         perl commands text
0  string      #!\ /usr/bin/perl    perl commands text
0  string      eval\ "exec\ /usr/bin/perl	perl commands text
0  string      #!/usr/local/bin/perl      perl commands text
0  string      #!\ /usr/local/bin/perl    perl commands text
0  string      eval\ "exec\ /usr/local/bin/perl	perl commands text

# AT&T Bell Labs' Plan 9 shell
0  string      #!/bin/rc   Plan 9 rc shell script text
0  string      #!\ /bin/rc Plan 9 rc shell script text

# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0  string      #!/bin/bash Bourne-Again shell script text
0  string      #!\ /bin/bash  Bourne-Again shell script text
0  string      #!/usr/local/bin/bash   Bourne-Again shell script text
0  string      #!\ /usr/local/bin/bash Bourne-Again shell script text

# generic shell magic
0  string      #!\ /       a
>3 string      >\0         %s script text
0  string      #!/         a
>2 string      >\0         %s script text
0  string      #!\         commands text
>3 string      >\0         for %s

#------------------------------------------------------------------------------
# compress:  file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.

# standard unix compress
0  string      \037\235 compress'd data
>2 byte&0x80   >0    block compressed
>2 byte&0x1f   x     %d bits

# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
0       string          \037\213        gzip compressed data
>2      byte            <8              \b, reserved method,
>2      byte            8               \b, deflated,
>3 byte     &0x01    ASCII,
>3 byte     &0x02    continuation,
>3 byte     &0x04    extra field,
>3 byte     &0x08    original filename,
>3 byte     &0x10    comment,
>3 byte     &0x20    encrypted,
>4 ledate      x     last modified: %s,
>8 byte     2     max compression,
>8 byte     4     max speed,
>9 byte     =0x00    os: MS-DOS
>9 byte     =0x01    os: Amiga
>9 byte     =0x02    os: VMS
>9 byte     =0x03    os: Unix
>9 byte     =0x05    os: Atari
>9 byte     =0x06    os: OS/2
>9 byte     =0x07    os: MacOS
>9 byte     =0x0A    os: Tops/20
>9 byte     =0x0B    os: Win/32

# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0  string      \037\036 packed data
>2 belong      >1    \b, %d characters originally
>2 belong      =1    \b, %d character originally
#
# This magic number is byte-order-independent.  XXX - Does that mean this
# is big-endian, little-endian, either, or that you can't tell?
# this short is valid for SunOS
0  short    017437      old packed data

# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0  short    0x1fff      compacted data
# This string is valid for SunOS (BE) and a matching "short" is listed
# in the Ultrix (LE) magic file.
0  string      \377\037 compacted data
0  short    0145405     huf output

# Squeeze and Crunch...
# These numbers were gleaned from the Unix versions of the programs to
# handle these formats.  Note that I can only uncrunch, not crunch, and
# I didn't have a crunched file handy, so the crunch number is untested.
#           Keith Waclena <keith@cerberus.uchicago.edu>
0  leshort     0x76FF      squeezed data (CP/M, DOS)
0  leshort     0x76FE      crunched data (CP/M, DOS)

# Freeze
0  string      \037\237 frozen file 2.1
0  string      \037\236 frozen file 1.0 (or gzip 0.5)

# SCO compress -H (LZH)
0  string      \037\240 SCO compress -H (LZH) data

# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# There's only a magic nibble (4 bits); that nibble repeats every 33
# bytes.  This isn't suited for use, but maybe we can use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0 byte&0xF0   0xd0     data
#>33  byte&0xF0   0xd0
#>66  byte&0xF0   0xd0
#>99  byte&0xF0   0xd0
#>132 byte&0xF0   0xd0     GSM 06.10 compressed audio

# Bzip from ulmo@Q.Net
0  string      BZ    bzip compressed   data,
>2 byte     x     format v. %c,
>3 byte     x     block size indicator %c

#------------------------------------------------------------------------------
# convex:  file(1) magic for Convex boxes
#
# Convexes are big-endian.
#
# /*\
#  * Below are the magic numbers and tests added for Convex.
#  * Added at beginning, because they are expected to be used most.
# \*/
0  belong   0507  Convex old-style object
>16   belong   >0 not stripped
0  belong   0513  Convex old-style demand paged executable
>16   belong   >0 not stripped
0  belong   0515  Convex old-style pre-paged executable
>16   belong   >0 not stripped
0  belong   0517  Convex old-style pre-paged, non-swapped executable
>16   belong   >0 not stripped
0  belong   0x011257 Core file
#
# The following are a series of dump format magic numbers.  Each one
# corresponds to a drastically different dump format.  The first on is
# the original dump format on a 4.1 BSD or earlier file system.  The
# second marks the change between the 4.1 file system and the 4.2 file
# system.  The Third marks the changing of the block size from 1K
# to 2K to be compatible with an IDC file system.  The fourth indicates
# a dump that is dependent on Convex Storage Manager, because data in
# secondary storage is not physically contained within the dump.
# The restore program uses these number to determine how the data is
# to be extracted.
#
24 belong   =60011   dump format, 4.1 BSD or earlier
24 belong   =60012   dump format, 4.2 or 4.3 BSD without IDC
24 belong   =60013   dump format, 4.2 or 4.3 BSD (IDC compatible)
24 belong   =60014   dump format, Convex Storage Manager by-reference dump
#
# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
# If there is no `=' sign, assume just checking for whether the bit is set?
#
0  belong   0601     Convex SOFF
>88   belong&0x000f0000 =0x00000000 c1
>88   belong         &0x00010000 c2
>88   belong         &0x00020000 c2mp
>88   belong         &0x00040000 parallel
>88   belong         &0x00080000 intrinsic
>88   belong         &0x00000001 demand paged
>88   belong         &0x00000002 pre-paged
>88   belong         &0x00000004 non-swapped
>88   belong         &0x00000008 POSIX
#
>84   belong         &0x80000000 executable
>84   belong         &0x40000000 object
>84   belong&0x20000000 =0    not stripped
>84   belong&0x18000000 =0x00000000 native fpmode
>84   belong&0x18000000 =0x10000000 ieee fpmode
>84   belong&0x18000000 =0x18000000 undefined fpmode
#
0  belong         0605     Convex SOFF core
#
0  belong         0607     Convex SOFF checkpoint
>88   belong&0x000f0000 =0x00000000 c1
>88   belong         &0x00010000 c2
>88   belong         &0x00020000 c2mp
>88   belong         &0x00040000 parallel
>88   belong         &0x00080000 intrinsic
>88   belong         &0x00000008 POSIX
#
>84   belong&0x18000000 =0x00000000 native fpmode
>84   belong&0x18000000 =0x10000000 ieee fpmode
>84   belong&0x18000000 =0x18000000 undefined fpmode

#------------------------------------------------------------------------------
# database:  file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
#
# GDBM magic numbers
#  Will be maintained as part of the GDBM distribution in the future.
#  <downsj@teeny.org>
0  belong   0x13579ace  GNU dbm 1.x or ndbm database, big endian
0  lelong   0x13579ace  GNU dbm 1.x or ndbm database, little endian
0  string   GDBM     GNU dbm 2.x database
#
0  belong   0x061561 Berkeley DB Hash file
>4 belong   >0    (Version %d,
>8 belong   1234     Little Endian,
>8 belong   4321     Big Endian,
>12   belong   x     Bucket Size %d,
>16   belong   x     Bucket Shift %d,
>20   belong   x     Directory Size %d,
>24   belong   x     Segment Size %d,
>28   belong   x     Segment Shift %d,
>32   belong   x     Overflow Point %d,
>36   belong   x     Last Freed %d,
>40   belong   x     Max Bucket %d,
>44   belong   x     High Mask 0x%x,
>48   belong   x     Low Mask 0x%x,
>52   belong   x     Fill Factor %d,
>56   belong   x     Number of Keys %d)
#
#
0  belong   0x053162 Berkeley DB Btree file
>4 belong   >0    (Version %d,
>8 belong   x     Page Size %d,
>12   belong   x     Free Page %d,
>16   belong   x     Number of Records %d,
>20   belong   x     Flags 0x%x)

#------------------------------------------------------------------------------
# diamond:  file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
# XXX - I think it was either renamed Slate, or replaced by Slate....
#
#  The full deal is too long...
#0 string   <list>\n<protocol\ bbn-multimedia-format> Diamond Multimedia Document
0  string   =<list>\n<protocol\ bbn-m  Diamond Multimedia Document

#------------------------------------------------------------------------------
# diff:  file(1) magic for diff(1) output
#
0  string      diff\    'diff' output text
0  string      ***\     'diff' output text
0  string      Only\ in\   'diff' output text
0  string      Common\ subdirectories:\   'diff' output text
#  Digital UNIX - Info
#
0  string   ^!<arch>\n_______64E Alpha archive
>22   string   X        -- out of date
#
# Alpha COFF Based Executables
# The stripped stuff really needs to be an 8 byte (64 bit) compare,
# but this works
0  leshort     0x183    COFF format alpha
>22   leshort&020000 &010000     sharable library,
>22   leshort&020000 ^010000     dynamically linked,
>24   leshort     0410     pure
>24   leshort     0413     demand paged
>8 lelong      >0    executable or object module, not stripped
>8 lelong      0
>>12  lelong      0     executable or object module, stripped
>>12  lelong      >0    executable or object module, not stripped
>27     byte            >0              - version %d.
>26     byte            >0              %d-
>28     leshort         >0              %d
#
# The next is incomplete, we could tell more about this format,
# but its not worth it.
0  leshort     0x188 Alpha compressed COFF
0  leshort     0x18f Alpha u-code object
#
#
# Some other interesting Digital formats,
0  string   \377\377\177      ddis/ddif
0  string   \377\377\174      ddis/dots archive
0  string   \377\377\176      ddis/dtif table data
0  string   \033c\033      LN03 output
0  long  04553207    X image
#
0  string   !<PDF>!\n      profiling data file
#
# Locale data tables (MIPS and Alpha).
#
0  short    0x0501      locale data table
>6 short    0x24     for MIPS
>6 short    0x40     for Alpha

#------------------------------------------------------------------------------
# dump:  file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
24 belong   60012    new-fs dump file (big endian),
>4 bedate   x     Previous dump %s,
>8 bedate   x     This dump %s,
>12   belong   >0    Volume %ld,
>692  belong   0     Level zero, type:
>692  belong   >0    Level %d, type:
>0 belong   1     tape header,
>0 belong   2     beginning of file record,
>0 belong   3     map of inodes on tape,
>0 belong   4     continuation of file record,
>0 belong   5     end of volume,
>0 belong   6     map of inodes deleted,
>0 belong   7     end of medium (for floppy),
>676  string   >\0      Label %s,
>696  string   >\0      Filesystem %s,
>760  string   >\0      Device %s,
>824  string   >\0      Host %s,
>888  belong   >0    Flags %x

24 belong   60011    old-fs dump file (big endian),
#>4   bedate   x     Previous dump %s,
#>8   bedate   x     This dump %s,
>12   belong   >0    Volume %ld,
>692  belong   0     Level zero, type:
>692  belong   >0    Level %d, type:
>0 belong   1     tape header,
>0 belong   2     beginning of file record,
>0 belong   3     map of inodes on tape,
>0 belong   4     continuation of file record,
>0 belong   5     end of volume,
>0 belong   6     map of inodes deleted,
>0 belong   7     end of medium (for floppy),
>676  string   >\0      Label %s,
>696  string   >\0      Filesystem %s,
>760  string   >\0      Device %s,
>824  string   >\0      Host %s,
>888  belong   >0    Flags %x

24 lelong   60012    new-fs dump file (little endian),
>4 ledate   x     This dump %s,
>8 ledate   x     Previous dump %s,
>12   lelong   >0    Volume %ld,
>692  lelong   0     Level zero, type:
>692  lelong   >0    Level %d, type:
>0 lelong   1     tape header,
>0 lelong   2     beginning of file record,
>0 lelong   3     map of inodes on tape,
>0 lelong   4     continuation of file record,
>0 lelong   5     end of volume,
>0 lelong   6     map of inodes deleted,
>0 lelong   7     end of medium (for floppy),
>676  string   >\0      Label %s,
>696  string   >\0      Filesystem %s,
>760  string   >\0      Device %s,
>824  string   >\0      Host %s,
>888  lelong   >0    Flags %x

24 lelong   60011    old-fs dump file (little endian),
#>4   ledate   x     Previous dump %s,
#>8   ledate   x     This dump %s,
>12   lelong   >0    Volume %ld,
>692  lelong   0     Level zero, type:
>692  lelong   >0    Level %d, type:
>0 lelong   1     tape header,
>0 lelong   2     beginning of file record,
>0 lelong   3     map of inodes on tape,
>0 lelong   4     continuation of file record,
>0 lelong   5     end of volume,
>0 lelong   6     map of inodes deleted,
>0 lelong   7     end of medium (for floppy),
>676  string   >\0      Label %s,
>696  string   >\0      Filesystem %s,
>760  string   >\0      Device %s,
>824  string   >\0      Host %s,
>888  lelong   >0    Flags %x

#------------------------------------------------------------------------------
# elf:  file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# MIPS RS3000 may also be for MIPS RS2000.
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
0  string      \177ELF     ELF
>4 byte     0     invalid class
>4 byte     1     32-bit
>4 byte     2     64-bit
>5 byte     0     invalid byte order
>5 byte     1     LSB
>>16  leshort     0     no file type,
>>16  leshort     1     relocatable,
>>16  leshort     2     executable,
>>16  leshort     3     shared object,
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
>>16  leshort     4     core file
>>>400  lelong          >0              (signal %d),
>>16  leshort     &0xff00     processor-specific,
>>18  leshort     0     no machine,
>>18  leshort     1     AT&T WE32100 - invalid byte order,
>>18  leshort     2     SPARC - invalid byte order,
>>18  leshort     3     Intel 80386,
>>18  leshort     4     Motorola 68000 - invalid byte order,
>>18  leshort     5     Motorola 88000 - invalid byte order,
>>18  leshort     6     Intel 80486,
>>18  leshort     7     Intel 80860,
>>18  leshort     8     MIPS RS3000_BE - invalid byte order,
>>18  leshort     9     Amdahl - invalid byte order,
>>18  leshort     10    MIPS RS3000_LE,
>>18  leshort     11    RS6000 - invalid byte order,
>>18  leshort     15    PA_RISC - invalid byte order,
>>18  leshort     16    nCUBE,
>>18  leshort     17    VPP500,
>>18  leshort     18    SPARC32PLUS,
>>18  leshort     20    PowerPC,
>>18  leshort     0x9026      Alpha,
>>20  lelong      0     invalid version
>>20  lelong      1     version 1
>>36  lelong      1     MathCoPro/FPU/MAU Required
>5 byte     2     MSB
>>16  beshort     0     no file type,
>>16  beshort     1     relocatable,
>>16  beshort     2     executable,
>>16  beshort     3     shared object,
>>16  beshort     4     core file,
>>>400   lelong      >0    (signal %d),
>>16  beshort     &0xff00     processor-specific,
>>18  beshort     0     no machine,
>>18  beshort     1     AT&T WE32100,
>>18  beshort     2     SPARC,
>>18  beshort     3     Intel 80386 - invalid byte order,
>>18  beshort     4     Motorola 68000,
>>18  beshort     5     Motorola 88000,
>>18  beshort     6     Intel 80486 - invalid byte order,
>>18  beshort     7     Intel 80860,
>>18  beshort     8     MIPS RS3000_BE,
>>18  beshort     9     Amdahl,
>>18  beshort     10    MIPS RS3000_LE - invalid byte order,
>>18  beshort     11    RS6000,
>>18  beshort     15    PA_RISC,
>>18  beshort     16    nCUBE,
>>18  beshort     17    VPP500,
>>18  beshort     18    SPARC32PLUS,
>>18  beshort     20    PowerPC,
>>18  beshort     0x9026      Alpha,
>>20  belong      0     invalid version
>>20  belong      1     version 1
>>36  belong      1     MathCoPro/FPU/MAU Required

#------------------------------------------------------------------------------
# encore:  file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
#
0  short    0x154    Encore
>20   short    0x107    executable
>20   short    0x108    pure executable
>20   short    0x10b    demand-paged executable
>20   short    0x10f    unsupported executable
>12   long     >0    not stripped
>22   short    >0    - version %ld
>22   short    0     -
#>4   date     x     stamp %s
0  short    0x155    Encore unsupported executable
>12   long     >0    not stripped
>22   short    >0    - version %ld
>22   short    0     -
#>4   date     x     stamp %s

#------------------------------------------------------------------------------
# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
# big-endian as it was mostly 68K-based.
#
# I think the 500 series was the old stack-based machines, running a
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
# HP magic is useful for reference, but using "long" magic is a better
# practice in order to avoid collisions.
#
# Guy Harris (guy@netapp.com): some additions to this list came from
# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
# "/etc/magic", though, except for the "archive file relocatable library"
# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
# used in executables, or have they just not yet updated "/etc/magic"
# completely?
#
# 0   beshort     200      hp200 (68010) BSD binary
# 0   beshort     300      hp300 (68020+68881) BSD binary
# 0   beshort     0x20c    hp200/300 HP-UX binary
# 0   beshort     0x20d    hp400 (68030) HP-UX binary
# 0   beshort     0x20e    hp400 (68040?) HP-UX binary
# 0   beshort     0x20b    PA-RISC1.0 HP-UX binary
# 0   beshort     0x210    PA-RISC1.1 HP-UX binary
# 0   beshort     0x211    PA-RISC1.2 HP-UX binary
# 0   beshort     0x214    PA-RISC2.0 HP-UX binary

#
# The "misc" stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0  beshort     0627     Apollo m68k COFF executable
>18   beshort     ^040000     not stripped
>22   beshort     >0    - version %ld
0  beshort     0624     apollo a88k COFF executable
>18   beshort     ^040000     not stripped
>22   beshort     >0    - version %ld
0       long            01203604016     TML 0123 byte-order format
0       long            01702407010     TML 1032 byte-order format
0       long            01003405017     TML 2301 byte-order format
0       long            01602007412     TML 3210 byte-order format
#### PA-RISC
0  belong      0x02100106  PA-RISC1.1 relocatable object
0  belong      0x02100107  PA-RISC1.1 executable
>168  belong      &=0x00000004   dynamically linked
>(144)   belong      0x054ef630  dynamically linked
>96   belong      >0    - not stripped

0  belong      0x02100108  PA-RISC1.1 shared executable
>168  belong&0x4  0x4      dynamically linked
>(144)   belong      0x054ef630  dynamically linked
>96   belong      >0    - not stripped

0  belong      0x0210010b  PA-RISC1.1 demand-load executable
>168  belong&0x4  0x4      dynamically linked
>(144)   belong      0x054ef630  dynamically linked
>96   belong      >0    - not stripped

0  belong      0x0210010e  PA-RISC1.1 shared library
>96   belong      >0    - not stripped

0  belong      0x0210010d  PA-RISC1.1 dynamic load library
>96   belong      >0    - not stripped

#### 800
0  belong      0x020b0106  PA-RISC1.0 relocatable object

0  belong      0x020b0107  PA-RISC1.0 executable
>168  belong&0x4  0x4      dynamically linked
>(144)   belong      0x054ef630  dynamically linked
>96   belong      >0    - not stripped

0  belong      0x020b0108  PA-RISC1.0 shared executable
>168  belong&0x4  0x4      dynamically linked
>(144)   belong      0x054ef630  dynamically linked
>96   belong      >0    - not stripped

0  belong      0x020b010b  PA-RISC1.0 demand-load executable
>168  belong&0x4  0x4      dynamically linked
>(144)   belong      0x054ef630  dynamically linked
>96   belong      >0    - not stripped

0  belong      0x020b010e  PA-RISC1.0 shared library
>96   belong      >0    - not stripped

0  belong      0x020b010d  PA-RISC1.0 dynamic load library
>96   belong      >0    - not stripped

0  belong      0x213c6172  archive file
>68   belong      0x020b0619  - PA-RISC1.0 relocatable library
>68   belong      0x02100619  - PA-RISC1.1 relocatable library
>68   belong      0x02110619  - PA-RISC1.2 relocatable library
>68   belong      0x02140619  - PA-RISC2.0 relocatable library

#### 500
0  long     0x02080106  HP s500 relocatable executable
>16   long     >0    - version %ld

0  long     0x02080107  HP s500 executable
>16   long     >0    - version %ld

0  long     0x02080108  HP s500 pure executable
>16   long     >0    - version %ld

#### 200
0  belong      0x020c0108  HP s200 pure executable
>4 beshort     >0    - version %ld
>8 belong      &0x80000000 save fp regs
>8 belong      &0x40000000 dynamically linked
>8 belong      &0x20000000 debuggable
>36   belong      >0    not stripped

0  belong      0x020c0107  HP s200 executable
>4 beshort     >0    - version %ld
>8 belong      &0x80000000 save fp regs
>8 belong      &0x40000000 dynamically linked
>8 belong      &0x20000000 debuggable
>36   belong      >0    not stripped

0  belong      0x020c010b  HP s200 demand-load executable
>4 beshort     >0    - version %ld
>8 belong      &0x80000000 save fp regs
>8 belong      &0x40000000 dynamically linked
>8 belong      &0x20000000 debuggable
>36   belong      >0    not stripped

0  belong      0x020c0106  HP s200 relocatable executable
>4 beshort     >0    - version %ld
>6 beshort     >0    - highwater %d
>8 belong      &0x80000000 save fp regs
>8 belong      &0x20000000 debuggable
>8 belong      &0x10000000 PIC

0  belong      0x020a0108  HP s200 (2.x release) pure executable
>4 beshort     >0    - version %ld
>36   belong      >0    not stripped

0  belong      0x020a0107  HP s200 (2.x release) executable
>4 beshort     >0    - version %ld
>36   belong      >0    not stripped

0  belong      0x020c010e  HP s200 shared library
>4 beshort     >0    - version %ld
>6 beshort     >0    - highwater %d
>36   belong      >0    not stripped

0  belong      0x020c010d  HP s200 dynamic load library
>4 beshort     >0    - version %ld
>6 beshort     >0    - highwater %d
>36   belong      >0    not stripped

#### MISC
0  long     0x0000ff65  HP old archive
0  long     0x020aff65  HP s200 old archive
0  long     0x020cff65  HP s200 old archive
0  long     0x0208ff65  HP s500 old archive

0  long     0x015821a6  HP core file

0  long     0x4da7eee8  HP-WINDOWS font
>8 byte     >0    - version %ld
0  string      Bitmapfile  HP Bitmapfile

0  string      IMGfile  CIS   compimg HP Bitmapfile
# XXX - see "lif"
#0 short    0x8000      lif file
0  long     0x020c010c  compiled Lisp

0  string      msgcat01 HP NLS message catalog,
>8 long     >0    %d messages

# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
0  string      HPHP48-     HP48 binary
>7 byte     >0    - Rev %c
>8 short    0x1129      (ADR)
>8 short    0x3329      (REAL)
>8 short    0x5529      (LREAL)
>8 short    0x7729      (COMPLX)
>8 short    0x9d29      (LCOMPLX)
>8 short    0xbf29      (CHAR)
>8 short    0xe829      (ARRAY)
>8 short    0x0a2a      (LNKARRAY)
>8 short    0x2c2a      (STRING)
>8 short    0x4e2a      (HXS)
>8 short    0x742a      (LIST)
>8 short    0x962a      (DIR)
>8 short    0xb82a      (ALG)
>8 short    0xda2a      (UNIT)
>8 short    0xfc2a      (TAGGED)
>8 short    0x1e2b      (GROB)
>8 short    0x402b      (LIB)
>8 short    0x622b      (BACKUP)
>8 short    0x882b      (LIBDATA)
>8 short    0x9d2d      (PROG)
>8 short    0xcc2d      (CODE)
>8 short    0x482e      (GNAME)
>8 short    0x6d2e      (LNAME)
>8 short    0x922e      (XLIB)
0  string      %%HP:    HP48 text
>6 string      T(0)     - T(0)
>6 string      T(1)     - T(1)
>6 string      T(2)     - T(2)
>6 string      T(3)     - T(3)
>10   string      A(D)     A(D)
>10   string      A(R)     A(R)
>10   string      A(G)     A(G)
>14   string      F(.)     F(.);
>14   string      F(,)     F(,);

# hpBSD magic numbers
0  beshort     200      hp200 (68010) BSD
>2 beshort     0407     impure binary
>2 beshort     0410     read-only binary
>2 beshort     0413     demand paged binary
0  beshort     300      hp300 (68020+68881) BSD
>2 beshort     0407     impure binary
>2 beshort     0410     read-only binary
>2 beshort     0413     demand paged binary


#------------------------------------------------------------------------------
# filesystems:  file(1) magic for different filesystems
#
0x438 leshort  0xEF53         Linux/i386 ext2 filesystem
0  string   \366\366\366\366  PC formatted floppy with no filesystem

#------------------------------------------------------------------------------
# fonts:  file(1) magic for font data
#
0  string      FONT     ASCII vfont text
0  short    0436     Berkeley vfont data
0  short    017001      byte-swapped Berkeley vfont data

# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
0  string      %!PS-AdobeFont-1.0   PostScript Type 1 font text
>20   string      >\0         (%s)
6  string      %!PS-AdobeFont-1.0   PostScript Type 1 font program data

# X11 font files in SNF (Server Natural Format) format
0  belong      00000004    X11 SNF font data, MSB first
0  lelong      00000004    X11 SNF font data, LSB first

# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0  string      STARTFONT\040     X11 BDF font text

# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
0  string      \001fcp        X11 Portable Compiled Font data
>12   byte     0x02        \b, LSB first
>12   byte     0x0a        \b, MSB first
0  string      D1.0\015    X11 Speedo font data

#------------------------------------------------------------------------------
# frame:  file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0  string      \<MakerFile FrameMaker document
>11   string      4.0       (4.0
>11   string      3.0       (3.0
>11   string      2.0       (2.0
>11   string      1.0       (1.0
>14   byte     x       %c)
0  string      \<MIFFile   FrameMaker MIF (ASCII) file
>9 string      4.0       (4.0)
>9 string      3.0       (3.0)
>9 string      2.0       (2.0)
>9 string      1.0       (1.x)
0  string      \<MakerDictionary FrameMaker Dictionary text
>17   string      3.0       (3.0)
>17   string      2.0       (2.0)
>17   string      1.0       (1.x)
0  string      \<MakerScreenFont FrameMaker Font file
>17   string      1.01      (%s)
0  string      \<MML    FrameMaker MML file
0  string      \<BookFile  FrameMaker Book file
>10   string      3.0       (3.0
>10   string      2.0       (2.0
>10   string      1.0       (1.0
>13   byte     x       %c)
# XXX - this book entry should be verified, if you find one, uncomment this
#0 string      \<Book\  FrameMaker Book (ASCII) file
#>6   string      3.0       (3.0)
#>6   string      2.0       (2.0)
#>6   string      1.0       (1.0)
0  string      \<Maker  Intermediate Print File FrameMaker IPL file

#------------------------------------------------------------------------------
# freebsd:  file(1) magic for FreeBSD objects
#
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
# little-endian on x86).
#
# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
# schemes for distinguishing between executable images, shared libraries,
# and object files.
#
# FreeBSD says:
#
#    Regardless of whether it's pure, demand-paged, or none of the
#    above:
#
#  if the entry point is < 4096, then it's a shared library if
#  the "has run-time loader information" bit is set, and is
#  position-independent if the "is position-independent" bit
#  is set;
#
#  if the entry point is >= 4096 (or >4095, same thing), then it's
#  an executable, and is dynamically-linked if the "has run-time
#  loader information" bit is set.
#
# On x86, NetBSD says:
#
#    If it's neither pure nor demand-paged:
#
#  if it has the "has run-time loader information" bit set, it's
#  a dynamically-linked executable;
#
#  if it doesn't have that bit set, then:
#
#      if it has the "is position-independent" bit set, it's
#      position-independent;
#
#      if the entry point is non-zero, it's an executable, otherwise
#      it's an object file.
#
#    If it's pure:
#
#  if it has the "has run-time loader information" bit set, it's
#  a dynamically-linked executable, otherwise it's just an
#  executable.
#
#    If it's demand-paged:
#
#  if it has the "has run-time loader information" bit set,
#  then:
#
#      if the entry point is < 4096, it's a shared library;
#
#      if the entry point is = 4096 or > 4096 (i.e., >= 4096),
#      it's a dynamically-linked executable);
#
#  if it doesn't have the "has run-time loader information" bit
#  set, then it's just an executable.
#
# (On non-x86, NetBSD does much the same thing, except that it uses
# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
# had 8K pages; dunno about MIPS.)
#
# I suspect the two will differ only in perverse and uninteresting cases
# ("shared" libraries that aren't demand-paged and whose pages probably
# won't actually be shared, executables with entry points <4096).
#
# I leave it to those more familiar with FreeBSD and NetBSD to figure out
# what the right answer is (although using ">4095", FreeBSD-style, is
# probably better than separately checking for "=4096" and ">4096",
# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
# executables using the NetBSD technique.)
#
0  lelong&0377777777 041400407   FreeBSD/i386
>20   lelong         <4096
>>3   byte&0xC0      &0x80    shared library
>>3   byte&0xC0      0x40     PIC object
>>3   byte&0xC0      0x00     object
>20   lelong         >4095
>>3   byte&0x80      0x80     dynamically linked executable
>>3   byte&0x80      0x00     executable
>16   lelong         >0    not stripped

0  lelong&0377777777 041400410   FreeBSD/i386 pure
>20   lelong         <4096
>>3   byte&0xC0      &0x80    shared library
>>3   byte&0xC0      0x40     PIC object
>>3   byte&0xC0      0x00     object
>20   lelong         >4095
>>3   byte&0x80      0x80     dynamically linked executable
>>3   byte&0x80      0x00     executable
>16   lelong         >0    not stripped

0  lelong&0377777777 041400413   FreeBSD/i386 demand paged
>20   lelong         <4096
>>3   byte&0xC0      &0x80    shared library
>>3   byte&0xC0      0x40     PIC object
>>3   byte&0xC0      0x00     object
>20   lelong         >4095
>>3   byte&0x80      0x80     dynamically linked executable
>>3   byte&0x80      0x00     executable
>16   lelong         >0    not stripped

0  lelong&0377777777 041400314   FreeBSD/i386 compact demand paged
>20   lelong         <4096
>>3   byte&0xC0      &0x80    shared library
>>3   byte&0xC0      0x40     PIC object
>>3   byte&0xC0      0x00     object
>20   lelong         >4095
>>3   byte&0x80      0x80     dynamically linked executable
>>3   byte&0x80      0x00     executable
>16   lelong         >0    not stripped

# XXX gross hack to identify core files
# cores start with a struct tss; we take advantage of the following:
# byte 7:     highest byte of the kernel stack pointer, always 0xfe
#      8/9:   kernel (ring 0) ss value, always 0x0010
#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
#      28:    low order byte of the current PTD entry, always 0 since the
#             PTD is page-aligned
#
7  string   \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0   FreeBSD/i386 a.out core file
>1039 string   >\0   from '%s'

# /var/run/ld.so.hints
# What are you laughing about?
0  lelong         011421044151   ld.so hints file
>4 lelong         >0    (version %d)

#------------------------------------------------------------------------------
# ibm370:  file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
# AIX 4.1's "/etc/magic" has
#
#  0  short    0535     370 sysV executable 
#  >12   long     >0    not stripped
#  >22   short    >0    - version %d
#  >30   long     >0    - 5.2 format
#  0  short    0530     370 sysV pure executable 
#  >12   long     >0    not stripped
#  >22   short    >0    - version %d
#  >30   long     >0    - 5.2 format
#
# instead of the "USS/370" versions of the same magic numbers.
#
0  beshort     0537     370 XA sysV executable 
>12   belong      >0    not stripped
>22   beshort     >0    - version %d
>30   belong      >0    - 5.2 format
0  beshort     0532     370 XA sysV pure executable 
>12   belong      >0    not stripped
>22   beshort     >0    - version %d
>30   belong      >0    - 5.2 format
0  beshort     054001      370 sysV pure executable
>12   belong      >0    not stripped
0  beshort     055001      370 XA sysV pure executable
>12   belong      >0    not stripped
0  beshort     056401      370 sysV executable
>12   belong      >0    not stripped
0  beshort     057401      370 XA sysV executable
>12   belong      >0    not stripped
0       beshort      0531     SVR2 executable (Amdahl-UTS)
>12   belong      >0    not stripped
>24     belong    >0    - version %ld
0  beshort     0534     SVR2 pure executable (Amdahl-UTS)
>12   belong      >0    not stripped
>24   belong      >0    - version %ld
0  beshort     0530     SVR2 pure executable (USS/370)
>12   belong      >0    not stripped
>24   belong      >0    - version %ld
0  beshort     0535     SVR2 executable (USS/370)
>12   belong      >0    not stripped
>24   belong      >0    - version %ld

#------------------------------------------------------------------------------
# ibm6000:  file(1) magic for RS/6000 and the RT PC.
#
0  beshort     0x01df      executable (RISC System/6000 V3.1) or obj module
>12   belong      >0    not stripped
# Breaks sun4 statically linked execs.
#0      beshort      0x0103      executable (RT Version 2) or obj module
#>2   byte     0x50     pure
#>28  belong      >0    not stripped
#>6   beshort     >0    - version %ld
0  beshort     0x0104      shared library
0  beshort     0x0105      ctab data
0  beshort     0xfe04      structured file
0  string      0xabcdef AIX message catalog
0  belong      0x000001f9  AIX compiled message catalog
0  string      \<aiaff> archive

#------------------------------------------------------------------------------
# iff:   file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
# Arts for file interchange.  It has also been used by Apple, SGI, and
# especially Commodore-Amiga.
#
# IFF files begin with an 8 byte FORM header, followed by a 4 character
# FORM type, which is followed by the first chunk in the FORM.

0  string      FORM     IFF data
#>4   belong      x     \b, FORM is %d bytes long
# audio formats
>8 string      AIFF     \b, AIFF audio
>8 string      AIFC     \b, AIFF-C compressed audio
>8 string      8SVX     \b, 8SVX 8-bit sampled sound voice
>8 string      SAMP     \b, SAMP sampled audio
# image formats
>8 string      ILBMBMHD \b, ILBM interleaved image
>>20  beshort     x     \b, %d x
>>22  beshort     x     %d
>8 string      RGBN     \b, RGBN 12-bit RGB image
>8 string      RGB8     \b, RGB8 24-bit RGB image
>8 string      DR2D     \b, DR2D 2-D object
>8 string      TDDD     \b, TDDD 3-D rendering
# other formats
>8 string      FTXT     \b, FTXT formatted text

#------------------------------------------------------------------------------
# images:  file(1) magic for image formats (see also "iff")
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# little magic: PCX (first byte is 0x0a)
# no magic: Targa

# PBMPLUS images
# The next byte following the magic is always whitespace.
0  string      P1    PBM image text
0  string      P2    PGM image text
0  string      P3    PPM image text
0  string      P4    PBM "rawbits" image data
0  string      P5    PGM "rawbits" image data
0  string      P6    PPM "rawbits" image data

# NIFF (Navy Interchange File Format, a modification of TIFF) images
0  string      IIN1     NIFF image data

# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
# The second word of TIFF files is the TIFF version number, 42, which has
# never changed.  The TIFF specification recommends testing for it.
0  string      MM\x00\x2a  TIFF image data, big-endian
0  string      II\x2a\x00  TIFF image data, little-endian

# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt@uchicago.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
#
0  string      \x89PNG     PNG image data,
>4 belong      !0x0d0a1a0a CORRUPTED,
>16   belong      x     %ld x
>20   belong      x     %ld,
>24   byte     x     %d-bit
>25   byte     0     grayscale,
>25   byte     2     \b/color RGB,
>25   byte     3     colormap,
>25   byte     4     gray+alpha,
>25   byte     6     \b/color RGBA,
#>26  byte     0     deflate/32K,
>28   byte     0     non-interlaced
>28   byte     1     interlaced

# GIF
0  string      GIF8     GIF image data
>4 string      7a    \b, version 8%s,
>4 string      9a    \b, version 8%s,
>6 leshort     >0    %hd x
>8 leshort     >0    %hd,
#>10  byte     &0x80    color mapped,
#>10  byte&0x07   =0x00    2 colors
#>10  byte&0x07   =0x01    4 colors
#>10  byte&0x07   =0x02    8 colors
#>10  byte&0x07   =0x03    16 colors
#>10  byte&0x07   =0x04    32 colors
#>10  byte&0x07   =0x05    64 colors
#>10  byte&0x07   =0x06    128 colors
#>10  byte&0x07   =0x07    256 colors

# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
# 1 plane, no encoding.
0  string      \361\0\100\273 CMU window manager raster image data
>4 lelong      >0    %d x
>8 lelong      >0    %d,
>12   lelong      >0    %d-bit

# Magick Image File Format
0  string      id=ImageMagick MIFF image data

# Artisan
0  long     1123028772  Artisan image data
>4 long     1     \b, rectangular 24-bit
>4 long     2     \b, rectangular 8-bit with colormap
>4 long     3     \b, rectangular 32-bit (24-bit with matte)

# FIG (Facility for Interactive Generation of figures), an object-based format
0  string      #FIG     FIG image text
>5 string      x     \b, version %.3s

# PHIGS
0  string      ARF_BEGARF     PHIGS clear text archive
0  string      @(#)SunPHIGS      SunPHIGS
# version number follows, in the form m.n
>40   string      SunBin         binary
>32   string      archive        archive

# GKS (Graphics Kernel System)
0  string      GKSM     GKS Metafile
>24   string      SunGKS      \b, SunGKS

# CGM image files
0  string      BEGMF    clear text Computer Graphics Metafile
# XXX - questionable magic
0  beshort&0xffe0 0x0020      binary Computer Graphics Metafile
0  beshort     0x3020      character Computer Graphics Metafile

# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
0  string   yz MGR bitmap, modern format, 8-bit aligned
0  string   zz MGR bitmap, old format, 1-bit deep, 16-bit aligned
0  string   xz MGR bitmap, old format, 1-bit deep, 32-bit aligned
0  string   yx MGR bitmap, modern format, squeezed

# Fuzzy Bitmap (FBM) images
0  string      %bitmap\0   FBM image data
>30   long     0x31     \b, mono
>30   long     0x33     \b, color

# facsimile data
1  string      PC\ Research,\ Inc   group 3 fax data
>29   byte     0     \b, normal resolution (204x98 DPI)
>29   byte     1     \b, fine resolution (204x196 DPI)

# JPEG images
# SunOS 5.5.1 had
#
#  0  string      \377\330\377\340  JPEG file
#  0  string      \377\330\377\356  JPG file
#
# both of which turn into "JPEG image data" here.
#
0  beshort     0xffd8      JPEG image data
>6 string      JFIF     \b, JFIF standard
# HSI is Handmade Software's proprietary JPEG encoding scheme
0  string      hsi1     JPEG image data, HSI proprietary

# PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
0  string      BM    PC bitmap data
>14   leshort     12    \b, OS/2 1.x format
>>18  leshort     x     \b, %d x
>>20  leshort     x     %d
>14   leshort     64    \b, OS/2 2.x format
>>18  leshort     x     \b, %d x
>>20  leshort     x     %d
>14   leshort     40    \b, Windows 3.x format
>>18  lelong      x     \b, %d x
>>22  lelong      x     %d x
>>28  leshort     x     %d
0  string      IC    PC icon data
0  string      PI    PC pointer image data
0  string      CI    PC color icon data
0  string      CP    PC color pointer image data
# Conflicts with other entries [BABYL]
#0 string      BA    PC bitmap array data

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# note possible collision with C/REXX entry in c-lang; currently commented out
0  string      /*\ XPM\ */ X pixmap image text

# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
0  leshort     0xcc52      RLE image data,
>6 leshort     x     %d x
>8 leshort     x     %d
>2 leshort     >0    \b, lower left corner: %d
>4 leshort     >0    \b, lower right corner: %d
>10   byte&0x1 =0x1     \b, clear first
>10   byte&0x2 =0x2     \b, no background
>10   byte&0x4 =0x4     \b, alpha channel
>10   byte&0x8 =0x8     \b, comment
>11   byte     >0    \b, %d color channels
>12   byte     >0    \b, %d bits per pixel
>13   byte     >0    \b, %d color map channels

# image file format (Robert Potter, potter@cs.rochester.edu)
0  string      Imagefile\ version-  iff image data
# this adds the whole header (inc. version number), informative but longish
>10   string      >\0      %s

# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
0  belong      0x59a66a95  Sun raster image data
>4 belong      >0    \b, %d x
>8 belong      >0    %d,
>12   belong      >0    %d-bit,
#>16  belong      >0    %d bytes long,
>20   belong      0     old format,
#>20  belong      1     standard,
>20   belong      2     compressed,
>20   belong      3     RGB,
>20   belong      4     TIFF,
>20   belong      5     IFF,
>20   belong      0xffff      reserved for testing,
>24   belong      0     no colormap
>24   belong      1     RGB colormap
>24   belong      2     raw colormap
#>28  belong      >0    colormap is %d bytes long

# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
# file://sgi.com/graphics/SGIIMAGESPEC
0  beshort     474      SGI image data
#>2   byte     0     \b, verbatim
>2 byte     1     \b, RLE
#>3   byte     1     \b, normal precision
>3 byte     2     \b, high precision
>4 beshort     x     \b, %d-D
>6 beshort     x     \b, %d x
>8 beshort     x     %d
>10   beshort     x     \b, %d channel
>10   beshort     !1    \bs
>80   string      >0    \b, "%s"

0  string      IT01     FIT image data
>4 belong      x     \b, %d x
>8 belong      x     %d x
>12   belong      x     %d
#
0  string      IT02     FIT image data
>4 belong      x     \b, %d x
>8 belong      x     %d x
>12   belong      x     %d
#
2048  string      PCD_IPI     Kodak Photo CD image pack file
0  string      PCD_OPA     Kodak Photo CD overview pack file

# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
# FITS is the Flexible Image Transport System, the de facto standard for
# data and image transfer, storage, etc., for the astronomical community.
# (FITS floating point formats are big-endian.)
0  string   SIMPLE\ \ = FITS image data
>109  string   8     \b, 8-bit, character or unsigned binary integer
>108  string   16    \b, 16-bit, two's complement binary integer
>107  string   \ 32     \b, 32-bit, two's complement binary integer
>107  string   -32      \b, 32-bit, floating point, single precision
>107  string   -64      \b, 64-bit, floating point, double precision

# other images
0  string   This\ is\ a\ BitMap\ file  Lisp Machine bit-array-file
0  string      !!    Bennet Yee's "face" format

# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
# stuff.
#
0  beshort     0x1010      PEX Binary Archive

#------------------------------------------------------------------------------
# intel:  file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
# Windows as well.
#
# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
# as well, if, as, and when IBM makes it portable.
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0  leshort     0502     basic-16 executable
>12   lelong      >0    not stripped
#>22  leshort     >0    - version %ld
0  leshort     0503     basic-16 executable (TV)
>12   lelong      >0    not stripped
#>22  leshort     >0    - version %ld
0  leshort     0510     x86 executable
>12   lelong      >0    not stripped
0  leshort     0511     x86 executable (TV)
>12   lelong      >0    not stripped
0  leshort     =0512    iAPX 286 executable small model (COFF)
>12   lelong      >0    not stripped
#>22  leshort     >0    - version %ld
0  leshort     =0522    iAPX 286 executable large model (COFF)
>12   lelong      >0    not stripped
#>22  leshort     >0    - version %ld
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0  leshort     =0514    80386 COFF executable
>12   lelong      >0    not stripped
>22   leshort     >0    - version %ld

#------------------------------------------------------------------------------
# interleaf:  file(1) magic for InterLeaf TPS:
#
0  string      =\210OPS Interleaf saved data
0  string      =<!OPS      Interleaf document text
>5 string      ,\ Version\ =  \b, version
>>17  string      >\0      %.3s

#------------------------------------------------------------------------------
# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
# "/etc/magic":
# From: guy@netapp.com (Guy Harris)
#
4  string      pgscriptver IslandWrite document
13 string      DrawFile IslandDraw document


#------------------------------------------------------------------------------
# ispell:  file(1) magic for ispell
#
# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
# will match 0x9600 through 0x9603 in *both* little endian and big endian.
# (No other current magic entries collide.)
#
# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
#
0  leshort&0xFFFC 0x9600      little endian ispell
>0 byte     0     hash file (?),
>0 byte     1     3.0 hash file,
>0 byte     2     3.1 hash file,
>0 byte     3     hash file (?),
>2 leshort     0x00     8-bit, no capitalization, 26 flags
>2 leshort     0x01     7-bit, no capitalization, 26 flags
>2 leshort     0x02     8-bit, capitalization, 26 flags
>2 leshort     0x03     7-bit, capitalization, 26 flags
>2 leshort     0x04     8-bit, no capitalization, 52 flags
>2 leshort     0x05     7-bit, no capitalization, 52 flags
>2 leshort     0x06     8-bit, capitalization, 52 flags
>2 leshort     0x07     7-bit, capitalization, 52 flags
>2 leshort     0x08     8-bit, no capitalization, 128 flags
>2 leshort     0x09     7-bit, no capitalization, 128 flags
>2 leshort     0x0A     8-bit, capitalization, 128 flags
>2 leshort     0x0B     7-bit, capitalization, 128 flags
>2 leshort     0x0C     8-bit, no capitalization, 256 flags
>2 leshort     0x0D     7-bit, no capitalization, 256 flags
>2 leshort     0x0E     8-bit, capitalization, 256 flags
>2 leshort     0x0F     7-bit, capitalization, 256 flags
>4 leshort     >0    and %d string characters
0  beshort&0xFFFC 0x9600      big endian ispell
>1 byte     0     hash file (?),
>1 byte     1     3.0 hash file,
>1 byte     2     3.1 hash file,
>1 byte     3     hash file (?),
>2 beshort     0x00     8-bit, no capitalization, 26 flags
>2 beshort     0x01     7-bit, no capitalization, 26 flags
>2 beshort     0x02     8-bit, capitalization, 26 flags
>2 beshort     0x03     7-bit, capitalization, 26 flags
>2 beshort     0x04     8-bit, no capitalization, 52 flags
>2 beshort     0x05     7-bit, no capitalization, 52 flags
>2 beshort     0x06     8-bit, capitalization, 52 flags
>2 beshort     0x07     7-bit, capitalization, 52 flags
>2 beshort     0x08     8-bit, no capitalization, 128 flags
>2 beshort     0x09     7-bit, no capitalization, 128 flags
>2 beshort     0x0A     8-bit, capitalization, 128 flags
>2 beshort     0x0B     7-bit, capitalization, 128 flags
>2 beshort     0x0C     8-bit, no capitalization, 256 flags
>2 beshort     0x0D     7-bit, no capitalization, 256 flags
>2 beshort     0x0E     8-bit, capitalization, 256 flags
>2 beshort     0x0F     7-bit, capitalization, 256 flags
>4 beshort     >0    and %d string characters
#------------------------------------------------------------
# Java ByteCode
# From Larry Schwimmer (schwim@cs.stanford.edu)
0  belong      0xcafebabe
>4 belong      0x0003002d  Java bytecode

#------------------------------------------------------------------------------
# karma:  file(1) magic for Karma data files
#
# From <rgooch@atnf.csiro.au>

0  string      KarmaRHD Version  Karma Data Structure Version
>16   long     x     %lu

#------------------------------------------------------------------------------
# lex:  file(1) magic for lex
#
#  derived empirically, your offsets may vary!
53 string      yyprevious  C program text (from lex)
>3 string      >\0       for %s
# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
21 string      generated\ by\ flex  C program text (from flex)
# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
0  string      %{    lex description text

#------------------------------------------------------------------------------
# lif:  file(1) magic for lif
#
# XXX - byte order?  (Probably beshort, Daniel Quinlan <quinlan@yggdrasil.com>)
#
0  short    0x8000      lif file

#------------------------------------------------------------------------------
# linux:  file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
# The following basic Linux magic is useful for reference, but using
# "long" magic is a better practice in order to avoid collisions.
#
# 2   leshort     100      Linux/i386
# >0  leshort     0407     impure executable (OMAGIC)
# >0  leshort     0410     pure executable (NMAGIC)
# >0  leshort     0413     demand-paged executable (ZMAGIC)
# >0  leshort     0314     demand-paged executable (QMAGIC)
#
0  lelong      0x00640107  Linux/i386 impure executable (OMAGIC)
>16   lelong      0     \b, stripped
0  lelong      0x00640108  Linux/i386 pure executable (NMAGIC)
>16   lelong      0     \b, stripped
0  lelong      0x0064010b  Linux/i386 demand-paged executable (ZMAGIC)
>16   lelong      0     \b, stripped
0  lelong      0x006400cc  Linux/i386 demand-paged executable (QMAGIC)
>16   lelong      0     \b, stripped
#
0  string      \007\001\000   Linux/i386 object file
>20   lelong      >0x1020     \b, DLL library
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0  string      *nazgul* Linux compiled message catalog
>8 lelong      >0    \b, version %ld
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
216   lelong      0421     Linux/i386 core file
>220  string      >\0      of '%s'
>200  lelong      >0    (signal %d)
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
# this can be overridden by the DOS executable (COM) entry
2  string      LILO     Linux/i386 LILO boot/chain loader
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
0  string      0.9
>8 byte     0x0a     Debian Binary Package
>>3   byte     >0    \b, created by dpkg 0.9%c
>>4   byte     >0    pl%c
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
0  leshort     0x0436      Linux/i386 PC Screen Font data,
>2 byte     0     256 characters, no directory,
>2 byte     1     512 characters, no directory,
>2 byte     2     256 characters, Unicode directory,
>2 byte     3     512 characters, Unicode directory,
>3 byte     >0    8x%d
# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
4086  string      SWAP-SPACE  Linux/i386 swap file
# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
#
#  from Erik Troan (ewt@redhat.com) examining od dumps, so this
#     could be wrong
#      updated by David Mosberger (davidm@azstarnet.com) based on
#      GNU BFD and MIPS info found below.
#
0  leshort     0x0183      ECOFF alpha
>24   leshort     0407     executable
>24   leshort     0410     pure
>24   leshort     0413     demand paged
>8 long     >0    not stripped
>8 long     0     stripped
>23   leshort     >0    - version %ld.
# linux Kernel images version 1.3.80 - ?
# from Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
0       belong          0xb8c0078e      Linux/x86 kernel image,
>0x048c byte            0x31
>>0x048c string         x               version %s
>0x0493 byte            0x31
>>0x0493 string         x               version %s
#

#------------------------------------------------------------------------------
# lisp:  file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
0  string   ;;       Lisp/Scheme program text
# Emacs 18 - this is always correct, but not very magical.
0  string   \012(       byte-compiled Emacs-Lisp program data
# Emacs 19
0  string   ;ELC\023\000\000\000 byte-compiled Emacs-Lisp program data
#------------------------------------------------------------------------------
# mach file description
#
0  belong      0xcafebabe  mach-o fat file
>4 belong      1     with 1 architecture
>4 belong      >1
>>4   belong      x     with %ld architectures     
#
0  belong      0xfeedface  mach-o
>12   belong      1     object
>12   belong      2     executable
>12   belong      3     shared library
>12   belong      4     core
>12   belong      5     preload executable
>12   belong      >5
>>12  belong      x     filetype=%ld
>4 belong      <0
>>4   belong      x     architecture=%ld
>4 belong      1     vax
>4 belong      2     romp
>4 belong      3     architecture=3
>4 belong      4     ns32032
>4 belong      5     ns32332
>4 belong      6     for m68k architecture
>4 belong      7     i386
>4 belong      8     mips
>4 belong      9     ns32532
>4 belong      10    architecture=10
>4 belong      11    hp pa-risc
>4 belong      12    acorn
>4 belong      13    m88k
>4 belong      14    sparc
>4 belong      15    i860-big
>4 belong      16    i860
>4 belong      17    rs6000
>4 belong      18    powerPC
>4 belong      >18
>>4   belong      x     architecture=%ld

#------------------------------------------------------------------------------
# magic:  file(1) magic for magic files
#
0  string      #\ Magic magic text file for file(1) cmd

#------------------------------------------------------------------------------
# mail.news:  file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
#0 string      From     mail text
# There are tests to ascmagic.c to cope with mail and news.
0  string      Relay-Version:    old news text
0  string      #!\ rnews   batched news text
0  string      N#!\ rnews  mailed, batched news text
0  string      Forward\ to    mail forwarding text
0  string      Pipe\ to    mail piping text
0  string      Return-Path:   smtp mail text
0  string      Path:    news text
0  string      Xref:    news text
0  string      From:    news or mail text
0  string      Article  saved news text
0  string      BABYL    Emacs RMAIL text
0  string      Received:   RFC 822 mail text
0  string      MIME-Version:  MIME entity text
0  string      Content- MIME entity text

#------------------------------------------------------------------------------
# mirage:  file(1) magic for Mirage executables
#
# XXX - byte order?
#
0  long  31415    Mirage Assembler m.out executable

#------------------------------------------------------------------------------
# mkid:  file(1) magic for mkid(1) databases
#
# ID is the binary tags database produced by mkid(1).
#
# XXX - byte order?
#
0  string      \311\304 ID tags data
>2 short    >0    version %d

#------------------------------------------------------------------------------
# mmdf:  file(1) magic for MMDF mail files
#
0  string   \001\001\001\001  MMDF mailbox

#------------------------------------------------------------------------------
# motorola:  file(1) magic for Motorola 68K and 88K binaries
#
# 68K
#
0  beshort     0520     mc68k COFF
>18   beshort     ^00000020   object
>18   beshort     &00000020   executable
>12   belong      >0    not stripped
>168  string      .lowmem     Apple toolbox
>20   beshort     0407     (impure)
>20   beshort     0410     (pure)
>20   beshort     0413     (demand paged)
>20   beshort     0421     (standalone)
0  beshort     0521     mc68k executable (shared)
>12   belong      >0    not stripped
0  beshort     0522     mc68k executable (shared demand paged)
>12   belong      >0    not stripped
#
# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
#
0  beshort     0554     68K BCS executable
#
# 88K
#
# Motorola/88Open BCS
#
0  beshort     0555     88K BCS executable
#
# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
0   string      S0          Motorola S-Record; binary data in text format

#------------------------------------------------------------------------------
# msdos:  file(1) magic for MS-DOS files
#

# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
0  string   @echo\ off  MS-DOS batch file text

# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#              (Ted Felix, tfelix@fred.net (NE, PE, LE, LX))
#
# These might not be possible.  Might always need an MSDOS stub.
0          string  PE\000\000  MS Win32 Portable Executable
0          string  NE          MS Win16 Executable
0          string  LE          MS Windows VxD
0          string  LX          OS/2 Executable

0          string  MZ          MS-DOS executable (EXE)
>(0x3c.s)  string  PE\000\000  stub with MS Win32 Portable Executable
>(0x3c.s)  string  NE          stub with MS Win16 Executable
>(0x3c.s)  string  LE          stub with MS Windows VxD
>(0x3c.s)  string  LX          stub with OS/2 Executable
>1638      string  -lh5-       \b, LHa SFX archive v2.13S
>7195      string  Rar!        \b, RAR self-extracting archive
#
# [GRR 950118:  file 3.15 has a buffer-size limitation; offsets bigger than
#   8161 bytes are ignored.  To make the following entries work, increase
#   HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
#   NT/Win32 and VMS.]
# [GRR:  some company sells a self-extractor/displayer for image data(!)]
#
>11696   string   PK\003\004  \b, PKZIP SFX archive v1.1
>13297   string   PK\003\004  \b, PKZIP SFX archive v1.93a
>15588   string   PK\003\004  \b, PKZIP2 SFX archive v1.09
>15770   string   PK\003\004  \b, PKZIP SFX archive v2.04g
>28374   string   PK\003\004  \b, PKZIP2 SFX archive v1.02
#
# Info-ZIP self-extractors
#    these are the DOS versions:
>25115   string   PK\003\004  \b, Info-ZIP SFX archive v5.12
>26331   string   PK\003\004  \b, Info-ZIP SFX archive v5.12 w/decryption
#    these are the OS/2 versions (OS/2 is flagged above):
>47031   string   PK\003\004  \b, Info-ZIP SFX archive v5.12
>49845   string   PK\003\004  \b, Info-ZIP SFX archive v5.12 w/decryption
#    this is the NT/Win32 version:
>69120   string   PK\003\004  \b, Info-ZIP NT SFX archive v5.12 w/decryption
#
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
>49801   string   \x79\xff\x80\xff\x76\xff   \b, CODEC archive v3.21
>>49824  leshort     =1       \b, 1 file
>>49824  leshort     >1       \b, %u files

# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
# Uncommenting only the first two lines will cover about 2/3 of COM files,
# but it isn't feasible to match all COM files since there must be at least
# two dozen different one-byte "magics".
#0 byte     0xe9     MS-DOS executable (COM)
#0 byte     0x8c     MS-DOS executable (COM)
# 0xeb conflicts with "sequent" magic
#0 byte     0xeb     MS-DOS executable (COM)
#0 byte     0xb8     MS-DOS executable (COM)

# miscellaneous formats
0  string      LZ    MS-DOS executable (built-in)
#0 byte     0xf0     MS-DOS program library data
#

# Popular applications
2080  string   Microsoft\ Word\ 6.0\ Document   %s
#
0  belong   0x31be0000  Microsoft Word Document
#
2080  string   Microsoft\ Excel\ 5.0\ Worksheet %s
#
0  belong   0x00001a00  Lotus 1-2-3
>4 belong   0x00100400  wk3 document
>4 belong   0x02100400  wk4 document
>4 belong   0x07800100  fm3 or fmb document
>4 belong   0x07800000  fm3 or fmb document
#
0  belong   0x00000200  Lotus 1-2-3
>4 belong   0x06040600  wk1 document
>4 belong   0x06800200  fmt document

#------------------------------------------------------------------------------
# ncr:  file(1) magic for NCR Tower objects
#
# contributed by
# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
#
0  beshort     000610   Tower/XP rel 2 object
>12      belong      >0 not stripped
>20      beshort     0407  executable
>20      beshort     0410  pure executable
>22      beshort     >0 - version %ld
0  beshort     000615   Tower/XP rel 2 object
>12      belong      >0 not stripped
>20      beshort     0407  executable
>20      beshort     0410  pure executable
>22      beshort     >0 - version %ld
0  beshort     000620   Tower/XP rel 3 object
>12      belong      >0 not stripped
>20      beshort     0407  executable
>20      beshort     0410  pure executable
>22      beshort     >0 - version %ld
0  beshort     000625   Tower/XP rel 3 object
>12      belong      >0 not stripped
>20      beshort     0407  executable
>20      beshort     0410  pure executable
>22      beshort     >0 - version %ld
0  beshort     000630   Tower32/600/400 68020 object
>12      belong      >0 not stripped
>20      beshort     0407  executable
>20      beshort     0410  pure executable
>22      beshort     >0 - version %ld
0  beshort     000640   Tower32/800 68020
>18      beshort     &020000  w/68881 object
>18      beshort     &040000  compatible object
>18      beshort     &~060000 object
>20      beshort     0407  executable
>20      beshort     0413  pure executable
>12      belong      >0 not stripped
>22      beshort     >0 - version %ld
0  beshort     000645   Tower32/800 68010
>18      beshort     &040000  compatible object
>18      beshort     &~060000 object
>20      beshort     0407  executable
>20      beshort     0413  pure executable
>12      belong      >0 not stripped
>22      beshort     >0 - version %ld

#------------------------------------------------------------------------------
# netbsd:  file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
#

0  lelong         000000407   NetBSD little-endian object file
>16   lelong         >0    not stripped
0  belong         000000407   NetBSD big-endian object file
>16   belong         >0    not stripped

0  belong&0377777777 041400413   NetBSD/i386 demand paged
>0 byte        &0x80    
>>20  lelong         <4096    shared library
>>20  lelong         =4096    dynamically linked executable
>>20  lelong         >4096    dynamically linked executable
>0 byte        ^0x80    executable
>16   lelong         >0    not stripped
0  belong&0377777777 041400410   NetBSD/i386 pure
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80    executable
>16   lelong         >0    not stripped
0  belong&0377777777 041400407   NetBSD/i386
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80
>>0   byte        &0x40    position independent
>>20  lelong         !0    executable
>>20  lelong         =0    object file
>16   lelong         >0    not stripped
0  belong&0377777777 041400507   NetBSD/i386 core
>12   string         >\0      from '%s'

0  belong&0377777777 041600413   NetBSD/m68k demand paged
>0 byte        &0x80    
>>20  belong         <8192    shared library
>>20  belong         =8192    dynamically linked executable
>>20  belong         >8192    dynamically linked executable
>0 byte        ^0x80    executable
>16   belong         >0    not stripped
0  belong&0377777777 041600410   NetBSD/m68k pure
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80    executable
>16   belong         >0    not stripped
0  belong&0377777777 041600407   NetBSD/m68k
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80
>>0   byte        &0x40    position independent
>>20  belong         !0    executable
>>20  belong         =0    object file
>16   belong         >0    not stripped
0  belong&0377777777 041600507   NetBSD/m68k core
>12   string         >\0      from '%s'

0  belong&0377777777 042000413   NetBSD/m68k4k demand paged
>0 byte        &0x80    
>>20  belong         <4096    shared library
>>20  belong         =4096    dynamically linked executable
>>20  belong         >4096    dynamically linked executable
>0 byte        ^0x80    executable
>16   belong         >0    not stripped
0  belong&0377777777 042000410   NetBSD/m68k4k pure
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80    executable
>16   belong         >0    not stripped
0  belong&0377777777 042000407   NetBSD/m68k4k
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80
>>0   byte        &0x40    position independent
>>20  belong         !0    executable
>>20  belong         =0    object file
>16   belong         >0    not stripped
0  belong&0377777777 042000507   NetBSD/m68k4k core
>12   string         >\0      from '%s'

0  belong&0377777777 042200413   NetBSD/ns32532 demand paged
>0 byte        &0x80    
>>20  lelong         <4096    shared library
>>20  lelong         =4096    dynamically linked executable
>>20  lelong         >4096    dynamically linked executable
>0 byte        ^0x80    executable
>16   lelong         >0    not stripped
0  belong&0377777777 042200410   NetBSD/ns32532 pure
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80    executable
>16   lelong         >0    not stripped
0  belong&0377777777 042200407   NetBSD/ns32532
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80
>>0   byte        &0x40    position independent
>>20  lelong         !0    executable
>>20  lelong         =0    object file
>16   lelong         >0    not stripped
0  belong&0377777777 042200507   NetBSD/ns32532 core
>12   string         >\0      from '%s'

0  belong&0377777777 042400413   NetBSD/sparc demand paged
>0 byte        &0x80    
>>20  belong         <8192    shared library
>>20  belong         =8192    dynamically linked executable
>>20  belong         >8192    dynamically linked executable
>0 byte        ^0x80    executable
>16   belong         >0    not stripped
0  belong&0377777777 042400410   NetBSD/sparc pure
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80    executable
>16   belong         >0    not stripped
0  belong&0377777777 042400407   NetBSD/sparc
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80
>>0   byte        &0x40    position independent
>>20  belong         !0    executable
>>20  belong         =0    object file
>16   belong         >0    not stripped
0  belong&0377777777 042400507   NetBSD/sparc core
>12   string         >\0      from '%s'

0  belong&0377777777 042600413   NetBSD/pmax demand paged
>0 byte        &0x80    
>>20  lelong         <4096    shared library
>>20  lelong         =4096    dynamically linked executable
>>20  lelong         >4096    dynamically linked executable
>0 byte        ^0x80    executable
>16   lelong         >0    not stripped
0  belong&0377777777 042600410   NetBSD/pmax pure
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80    executable
>16   lelong         >0    not stripped
0  belong&0377777777 042600407   NetBSD/pmax
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80
>>0   byte        &0x40    position independent
>>20  lelong         !0    executable
>>20  lelong         =0    object file
>16   lelong         >0    not stripped
0  belong&0377777777 042600507   NetBSD/pmax core
>12   string         >\0      from '%s'

0  belong&0377777777 043000413   NetBSD/vax demand paged
>0 byte        &0x80    
>>20  lelong         <4096    shared library
>>20  lelong         =4096    dynamically linked executable
>>20  lelong         >4096    dynamically linked executable
>0 byte        ^0x80    executable
>16   lelong         >0    not stripped
0  belong&0377777777 043000410   NetBSD/vax pure
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80    executable
>16   lelong         >0    not stripped
0  belong&0377777777 043000407   NetBSD/vax
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80
>>0   byte        &0x40    position independent
>>20  lelong         !0    executable
>>20  lelong         =0    object file
>16   lelong         >0    not stripped
0  belong&0377777777 043000507   NetBSD/vax core
>12   string         >\0      from '%s'

# NetBSD/alpha does not support (and has never supported) a.out objects,
# so no rules are provided for them.  NetBSD/alpha ELF objects are 
# dealt with in "elf".
0  leshort     0x00070185     ECOFF NetBSD/alpha binary
>10   leshort     0x0001         not stripped
>10   leshort     0x0000         stripped
0  belong&0377777777 043200507   NetBSD/alpha core
>12   string         >\0      from '%s'

0  belong&0377777777 043400413   NetBSD/mips demand paged
>0 byte        &0x80    
>>20  belong         <8192    shared library
>>20  belong         =8192    dynamically linked executable
>>20  belong         >8192    dynamically linked executable
>0 byte        ^0x80    executable
>16   belong         >0    not stripped
0  belong&0377777777 043400410   NetBSD/mips pure
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80    executable
>16   belong         >0    not stripped
0  belong&0377777777 043400407   NetBSD/mips
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80
>>0   byte        &0x40    position independent
>>20  belong         !0    executable
>>20  belong         =0    object file
>16   belong         >0    not stripped
0  belong&0377777777 043400507   NetBSD/mips core
>12   string         >\0      from '%s'

0  belong&0377777777 043600413   NetBSD/arm32 demand paged
>0 byte        &0x80
>>20  lelong         <8192    shared library
>>20  lelong         =8192    dynamically linked executable
>>20  lelong         >8192    dynamically linked executable
>0 byte        ^0x80    executable
>16   lelong         >0    not stripped
0  belong&0377777777 043600410   NetBSD/arm32 pure
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80    executable
>16   lelong         >0    not stripped
0  belong&0377777777 043600407   NetBSD/arm32
>0 byte        &0x80    dynamically linked executable
>0 byte        ^0x80
>>0   byte        &0x40    position independent
>>20  lelong         !0    executable
>>20  lelong         =0    object file
>16   lelong         >0    not stripped
0  belong&0377777777 043600507   NetBSD/arm32 core
>12   string         >\0      from '%s'

#------------------------------------------------------------------------------
# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
#
0  string      StartFontMetrics  ASCII font metrics
0  string      StartFont   ASCII font bits
0  belong      0x137A2944  NeWS bitmap font
0  belong      0x137A2947  NeWS font family
0  belong      0x137A2950  scalable OpenFont binary
0  belong      0x137A2951  encrypted scalable OpenFont binary
8  belong      0x137A2B45  X11/NeWS bitmap font
8  belong      0x137A2B48  X11/NeWS font family
#
# Mach magic number info
#
0  long     0xefbe   OSF/Rose object
# I386 magic number info
#
0  short    0565  i386 COFF object
#
0  string      Core  Alpha Digital UNIX core file
>24   string      >\0   \b, generated from '%s'

#------------------------------------------------------------------------------
# pbm:  file(1) magic for Portable Bitmap files
#
# XXX - byte order?
#
0  short 0x2a17   "compact bitmap" format (Poskanzer)
#------------------------------------------------------------------------------
# pdf:  file(1) magic for Portable Document Format
#

0  string      %PDF-    PDF document
>5 byte     x     \b, version %c
>7 byte     x     \b.%c

#------------------------------------------------------------------------------
# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
#
0  lelong      0101555     PDP-11 single precision APL workspace
0  lelong      0101554     PDP-11 double precision APL workspace
#
# PDP-11 a.out
#
0  leshort     0407     PDP-11 executable
>8 leshort     >0    not stripped
>15   byte     >0    - version %ld

0  leshort     0401     PDP-11 UNIX/RT ldp
0  leshort     0405     PDP-11 old overlay

0  leshort     0410     PDP-11 pure executable
>8 leshort     >0    not stripped
>15   byte     >0    - version %ld

0  leshort     0411     PDP-11 separate I&D executable
>8 leshort     >0    not stripped
>15   byte     >0    - version %ld

0  leshort     0437     PDP-11 kernel overlay

#------------------------------------------------------------------------------
# pgp:  file(1) magic for Pretty Good Privacy
#
0       beshort         0x9900                  PGP key public ring
0       beshort         0x9501                  PGP key security ring
0       beshort         0x9500                  PGP key security ring
0  beshort     0xa600         PGP encrypted data
0       string          -----BEGIN\040PGP       PGP armored data
>15     string          PUBLIC\040KEY\040BLOCK- public key block
>15     string          MESSAGE-                message
>15     string          SIGNED\040MESSAGE-      signed message
>15     string          PGP\040SIGNATURE-       signature

#------------------------------------------------------------------------------
# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
#
0       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)

#------------------------------------------------------------------------------
# plus5:  file(1) magic for Plus Five's UNIX MUMPS
#
# XXX - byte order?  Paging Hokey....
#
0  short    0x259    mumps avl global
>2 byte     >0    (V%d)
>6 byte     >0    with %d byte name
>7 byte     >0    and %d byte data cells
0  short    0x25a    mumps blt global
>2 byte     >0    (V%d)
>8 short    >0    - %d byte blocks
>15   byte     0x00     - P/D format
>15   byte     0x01     - P/K/D format
>15   byte     0x02     - K/D format
>15   byte     >0x02    - Bad Flags

#------------------------------------------------------------------------------
# printer:  file(1) magic for printer-formatted files
#

# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
0  string      %!    PostScript document text
>2 string      PS-Adobe-   conforming
>>11  string      >\0      at level %.3s
>>>15 string      EPS      - type %s
>>>15 string      Query    - type %s
>>>15 string      ExitServer  - type %s
# Some PCs have the annoying habit of adding a ^D as a document separator
0  string      \004%!      PostScript document text
>3 string      PS-Adobe-   conforming
>>12  string      >\0      at level %.3s
>>>16 string      EPS      - type %s
>>>16 string      Query    - type %s
>>>16 string      ExitServer  - type %s

# HP Printer Job Language
0  string      \033%-12345X@PJL  HP Printer Job Language data
>15   string      \ ENTER\ LANGUAGE\ =
>31   string      PostScript     PostScript

# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
0  string      \033E\033   HP PCL printer data
>3 string      \&l0A    - default page size
>3 string      \&l1A    - US executive page size
>3 string      \&l2A    - US letter page size
>3 string      \&l3A    - US legal page size
>3 string      \&l26A      - A4 page size
>3 string      \&l80A      - Monarch envelope size
>3 string      \&l81A      - No. 10 envelope size
>3 string      \&l90A      - Intl. DL envelope size
>3 string      \&l91A      - Intl. C5 envelope size
>3 string      \&l100A     - Intl. B5 envelope size
>3 string      \&l-81A     - No. 10 envelope size (landscape)
>3 string      \&l-90A     - Intl. DL envelope size (landscape)

# IMAGEN printer-ready files:
0  string   @document(     Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10   string   language\ impress (imPRESS data)
>10   string   language\ daisy      (daisywheel text)
>10   string   language\ diablo  (daisywheel text)
>10   string   language\ printer (line printer emulation)
>10   string   language\ tektronix  (Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
#
# Now magic for IMAGEN font files...
0  string      Rast     RST-format raster font data
>45   string      >0    face %

#------------------------------------------------------------------------------
# psdbms:  file(1) magic for psdatabase
#
0  belong&0xff00ffff 0x56000000  ps database
>1 string   >\0   version %s
>4 string   >\0   from kernel %s

#------------------------------------------------------------------------------
# pyramid:  file(1) magic for Pyramids
#
# XXX - byte order?
#
0  long     0x50900107  Pyramid 90x family executable
0  long     0x50900108  Pyramid 90x family pure executable
>16   long     >0    not stripped
0  long     0x5090010b  Pyramid 90x family demand paged pure executable
>16   long     >0    not stripped
#------------------------------------------------------------------------------
#
# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
#
0  beshort     0xedab      
>2 beshort     0xeedb      RPM
>>4   byte     x     v%d
>>6   beshort     0     bin
>>6   beshort     1     src
>>8   beshort     1     i386
>>8   beshort     2     Alpha
>>8   beshort     3     Sparc
>>8   beshort     4     MIPS
>>8   beshort     5     PowerPC
>>8   beshort     6     68000
>>8     beshort         7               SGI
>>10  string      x     %s

#------------------------------------------------------------------------------
# rtf:   file(1) magic for Rich Text Format (RTF)
#
# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
#
0  string      {\\rtf      Rich Text Format data,
>5 byte     x     version %c,
>6 string      \\ansi      ANSI
>6 string      \\mac    Apple Macintosh
>6 string      \\pc     IBM PC, code page 437
>6 string      \\pca    IBM PS/2, code page 850

#------------------------------------------------------------------------------
# sc:  file(1) magic for "sc" spreadsheet
#
38 string      Spreadsheet sc spreadsheet file

#------------------------------------------------------------------------------
# sccs:  file(1) magic for SCCS archives
#
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
# \001c date and time created 87/09/23 08:09:20 by ian
# \001e
# \001u
# \001U
# ... etc.
# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
# *Sigh*. And these both came from various parts of the USG.
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
# and we don't have regular expression matching yet. 
# Hence the following official kludge:
8  string      \001s\         SCCS archive data

#------------------------------------------------------------------------------
# sendmail:  file(1) magic for sendmail config files
#
# XXX - byte order?
#
0  byte  046     Sendmail frozen configuration 
>16   string   >\0     - version %s
0  short 0x271c     Sendmail frozen configuration
>16   string   >\0     - version %s

#------------------------------------------------------------------------------
# sequent:  file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# For Sequent's multiprocessor systems (incomplete).
0  lelong   0x00ea         BALANCE NS32000 .o
>16   lelong   >0    not stripped
>124  lelong   >0    version %ld
0  lelong   0x10ea         BALANCE NS32000 executable (0 @ 0)
>16   lelong  >0              not stripped
>124  lelong   >0    version %ld
0  lelong   0x20ea         BALANCE NS32000 executable (invalid @ 0)
>16   lelong  >0              not stripped
>124  lelong   >0    version %ld
0  lelong   0x30ea         BALANCE NS32000 standalone executable
>16   lelong  >0           not stripped
>124  lelong   >0    version %ld
#
# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
# Symmetry magic nums will not be reached if DOS COM comes before them;
# byte 0xeb is matched before these get a chance.
0  leshort  0x12eb      SYMMETRY i386 .o
>16   lelong   >0    not stripped
>124  lelong   >0    version %ld
0  leshort  0x22eb      SYMMETRY i386 executable (0 @ 0)
>16   lelong   >0    not stripped
>124  lelong   >0    version %ld
0  leshort  0x32eb      SYMMETRY i386 executable (invalid @ 0)
>16   lelong   >0    not stripped
>124  lelong   >0    version %ld
0  leshort  0x42eb      SYMMETRY i386 standalone executable
>16   lelong   >0    not stripped
>124  lelong   >0    version %ld

#------------------------------------------------------------------------------
# sgi:  file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
#                         Dec Ultrix (MIPS)
# all of SGI's *current* machines and OSes run in big-endian mode on the
# MIPS machines, as far as I know.
#
# XXX - what is the blank "-" line?
#
# kbd file definitions
0  string   kbd!map     kbd map file
>8 byte  >0    Ver %d:
>10   short >0    with %d table(s)
0  belong   0407     old SGI 68020 executable
0  belong   0410     old SGI 68020 pure executable
0  beshort  0x8765      disk quotas file
0  beshort  0x0506      IRIS Showcase file
>2 byte  0x49     -
>3 byte  x     - version %ld
0  beshort  0x0226      IRIS Showcase template
>2 byte  0x63     -
>3 byte  x     - version %ld
0  belong   0x5343464d  IRIS Showcase file
>4 byte  x     - version %ld
0  belong   0x5443464d  IRIS Showcase template
>4 byte  x     - version %ld
0  belong   0xdeadbabe  IRIX Parallel Arena
>8 belong   >0    - version %ld
#
0  beshort  0x0160      MIPSEB COFF executable
>20   beshort  0407     (impure)
>20   beshort  0410     (swapped)
>20   beshort  0413     (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>22   byte  x     - version %ld
>23   byte  x     .%ld
#
0  beshort  0x0162      MIPSEL COFF executable
>20   beshort  0407     (impure)
>20   beshort  0410     (swapped)
>20   beshort  0413     (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>23   byte  x     - version %d
>22   byte  x     .%ld
#
0  beshort  0x6001      MIPSEB-LE COFF executable
>20   beshort  03401    (impure)
>20   beshort  04001    (swapped)
>20   beshort  05401    (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>23   byte  x     - version %d
>22   byte  x     .%ld
#
0  beshort  0x6201      MIPSEL-LE COFF executable
>20   beshort  03401    (impure)
>20   beshort  04001    (swapped)
>20   beshort  05401    (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>23   byte  x     - version %ld
>22   byte  x     .%ld
#
# MIPS 2 additions
#
0  beshort  0x0163      MIPSEB MIPS-II COFF executable
>20   beshort  0407     (impure)
>20   beshort  0410     (swapped)
>20   beshort  0413     (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>22   byte  x     - version %ld
>23   byte  x     .%ld
#
0  beshort  0x0166      MIPSEL MIPS-II COFF executable
>20   beshort  0407     (impure)
>20   beshort  0410     (swapped)
>20   beshort  0413     (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>22   byte  x     - version %ld
>23   byte  x     .%ld
#
0  beshort  0x6301      MIPSEB-LE MIPS-II COFF executable
>20   beshort  03401    (impure)
>20   beshort  04001    (swapped)
>20   beshort  05401    (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>23   byte  x     - version %ld
>22   byte  x     .%ld
#
0  beshort  0x6601      MIPSEL-LE MIPS-II COFF executable
>20   beshort  03401    (impure)
>20   beshort  04001    (swapped)
>20   beshort  05401    (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>23   byte  x     - version %ld
>22   byte  x     .%ld
#
# MIPS 3 additions
#
0  beshort  0x0140      MIPSEB MIPS-III COFF executable
>20   beshort  0407     (impure)
>20   beshort  0410     (swapped)
>20   beshort  0413     (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>22   byte  x     - version %ld
>23   byte  x     .%ld
#
0  beshort  0x0142      MIPSEL MIPS-III COFF executable
>20   beshort  0407     (impure)
>20   beshort  0410     (swapped)
>20   beshort  0413     (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>22   byte  x     - version %ld
>23   byte  x     .%ld
#
0  beshort  0x4001      MIPSEB-LE MIPS-III COFF executable
>20   beshort  03401    (impure)
>20   beshort  04001    (swapped)
>20   beshort  05401    (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>23   byte  x     - version %ld
>22   byte  x     .%ld
#
0  beshort  0x4201      MIPSEL-LE MIPS-III COFF executable
>20   beshort  03401    (impure)
>20   beshort  04001    (swapped)
>20   beshort  05401    (paged)
>8 belong   >0    not stripped
>8 belong   0     stripped
>23   byte  x     - version %ld
>22   byte  x     .%ld
#
0  beshort  0x180    MIPSEB Ucode
0  beshort  0x182    MIPSEL Ucode
# 32bit core file
0  belong   0xdeadadb0  IRIX core dump
>4 belong   1     of
>16   string   >\0      '%s'
# 64bit core file
0  belong   0xdeadad40  IRIX 64-bit core dump
>4 belong   1     of
>16   string   >\0      '%s'
# New style crash dump file
0  string   \x43\x72\x73\x68\x44\x75\x6d\x70 IRIX vmcore dump of
>36   string   >\0               '%s'
# Trusted IRIX info
0  string   SGIAUDIT SGI Audit file
>8 byte  x     - version %d
>9 byte  x     .%ld
# Are these three SGI-based file types or general ones?
0  string   WNGZWZSC Wingz compiled script
0  string   WNGZWZSS Wingz spreadsheet
0  string   WNGZWZHP Wingz help file
#
0  string   \#Inventor V   IRIS Inventor 1.0 file
0  string   \#Inventor V2  Open Inventor 2.0 file
# XXX - I don't know what next thing is!  It is likely to be an image
# (or movie) format
0  string   glfHeadMagic();      GLF_TEXT
4  belong   0x41010000     GLF_BINARY_LSB_FIRST
4  belong   0x00000141     GLF_BINARY_MSB_FIRST

#------------------------------------------------------------------------------
# sgml:  file(1) magic for Standard Generalized Markup Language

# HyperText Markup Language (HTML) is an SGML document type,
# from Daniel Quinlan (quinlan@yggdrasil.com)
0  string      \<!DOCTYPE\ HTML  HTML document text
0  string      \<!doctype\ html  HTML document text
0  string      \<HEAD      HTML document text
0  string      \<head      HTML document text
0  string      \<TITLE     HTML document text
0  string      \<title     HTML document text
0  string      \<html      HTML document text
0  string      \<HTML      HTML document text

# SGML, mostly from rph@sq
0  string      \<!DOCTYPE  exported SGML document text
0  string      \<!doctype  exported SGML document text
0  string      \<!SUBDOC   exported SGML subdocument text
0  string      \<!subdoc   exported SGML subdocument text
0  string      \<!--    exported SGML document text

#------------------------------------------------------------------------------
# sniffer:  file(1) magic for packet captured files
#
# From: guy@netapp.com (Guy Harris)
#
# Microsoft NetMon (packet capture/display program) capture files.
#
0  string      RTSS     NetMon capture file
>4 byte     x     - version %d
>5 byte     x     \b.%d
#
# Network General Sniffer capture files (the Sniffer software does,
# after all, run under MS-DOS...).
#
0  string      TRSNIFF\ data\ \ \ \ \032  Sniffer capture file
>23   leshort     x     - version %d
>25   leshort     x     \b.%d
>33   byte     x     (Format %d,
>32   byte     0     Token ring)
>32   byte     1     Ethernet)
>32   byte     2     ARCnet)
>32   byte     3     StarLAN)
>32   byte     4     PC Network broadband)
>32   byte     5     LocalTalk)
>32   byte     6     Znet)
#
# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
# the main program that uses that format, but there's also "tcpview",
# and there may be others in the future.)
#
0  ubelong     0xa1b2c3d4  tcpdump capture file (big-endian)
>4 beshort     x     - version %d
>6 beshort     x     \b.%d
>20   belong      0     (No link-layer encapsulation
>20   belong      1     (Ethernet
>20   belong      2     (3Mb Ethernet
>20   belong      3     (AX.25
>20   belong      4     (ProNet
>20   belong      5     (Chaos
>20   belong      6     (IEEE 802.x network
>20   belong      7     (ARCnet
>20   belong      8     (SLIP
>20   belong      9     (PPP
>20   belong      10    (FDDI
>20   belong      11    (RFC 1483 ATM
>16   belong      x     \b, capture length %d)
0  ulelong     0xa1b2c3d4  tcpdump capture file (little-endian)
>4 leshort     x     - version %d
>6 leshort     x     \b.%d
>20   lelong      0     (No link-layer encapsulation
>20   lelong      1     (Ethernet
>20   lelong      2     (3Mb Ethernet
>20   lelong      3     (AX.25
>20   lelong      4     (ProNet
>20   lelong      5     (Chaos
>20   lelong      6     (IEEE 802.x network
>20   lelong      7     (ARCnet
>20   lelong      8     (SLIP
>20   lelong      9     (PPP
>20   lelong      10    (FDDI
>20   lelong      11    (RFC 1483 ATM
>16   lelong      x     \b, capture length %d)

#------------------------------------------------------------------------------
# softquad:  file(1) magic for SoftQuad Publishing Software
#
# $Id: softquad,v 1.9 1995/01/21 21:09:00 christos Exp $
# Author/Editor and RulesBuilder
#
# XXX - byte order?
#
0  string      \<!SQ\ DTD> Compiled SGML rules file
>9 string      >\0       Type %s
0  string      \<!SQ\ A/E> A/E SGML Document binary
>9 string      >\0       Type %s
0  string      \<!SQ\ STS> A/E SGML binary styles file
>9 string      >\0       Type %s
0  short    0xc0de      Compiled PSI (v1) data
0  short    0xc0da      Compiled PSI (v2) data
>3 string      >\0      (%s)
# Binary sqtroff font/desc files...
0  short    0125252     SoftQuad DESC or font file binary
>2 short    >0    - version %d
# Bitmaps...
0  string      SQ\ BITMAP1 SoftQuad Raster Format text
#0 string      SQ\ BITMAP2 SoftQuad Raster Format data
# sqtroff intermediate language (replacement for ditroff int. lang.)
0  string      X\       SoftQuad troff Context intermediate
>2 string      495      for AT&T 495 laser printer
>2 string      hp    for Hewlett-Packard LaserJet
>2 string      impr     for IMAGEN imPRESS
>2 string      ps    for PostScript

#------------------------------------------------------------------------------
# sun:  file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
# releases.  (5.x uses ELF.)
#
0  belong&077777777  0600413     sparc demand paged
>0 byte     &0x80
>>20  belong      <4096    shared library
>>20  belong      =4096    dynamically linked executable
>>20  belong      >4096    dynamically linked executable
>0 byte     ^0x80    executable
>16   belong      >0    not stripped
0  belong&077777777  0600410     sparc pure
>0 byte     &0x80    dynamically linked executable
>0 byte     ^0x80    executable
>16   belong      >0    not stripped
0  belong&077777777  0600407     sparc
>0 byte     &0x80    dynamically linked executable
>0 byte     ^0x80    executable
>16   belong      >0    not stripped

0  belong&077777777  0400413     mc68020 demand paged
>0 byte     &0x80
>>20  belong      <4096    shared library
>>20  belong      =4096    dynamically linked executable
>>20  belong      >4096    dynamically linked executable
>16   belong      >0    not stripped
0  belong&077777777  0400410     mc68020 pure
>0 byte     &0x80    dynamically linked executable
>0 byte     ^0x80    executable
>16   belong      >0    not stripped
0  belong&077777777  0400407     mc68020
>0 byte     &0x80    dynamically linked executable
>0 byte     ^0x80    executable
>16   belong      >0    not stripped

0  belong&077777777  0200413     mc68010 demand paged
>0 byte     &0x80
>>20  belong      <4096    shared library
>>20  belong      =4096    dynamically linked executable
>>20  belong      >4096    dynamically linked executable
>16   belong      >0    not stripped
0  belong&077777777  0200410     mc68010 pure
>0 byte     &0x80    dynamically linked executable
>0 byte     ^0x80    executable
>16   belong      >0    not stripped
0  belong&077777777  0200407     mc68010
>0 byte     &0x80    dynamically linked executable
>0 byte     ^0x80    executable
>16   belong      >0    not stripped

# reworked these to avoid anything beginning with zero becoming "old sun-2"
0  belong      0407     old sun-2 executable
>16   belong      >0    not stripped
0  belong      0410     old sun-2 pure executable
>16   belong      >0    not stripped
0  belong      0413     old sun-2 demand paged executable
>16   belong      >0    not stripped

#
# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
# binary executed in compatibility mode under SunOS 5.x".
#
0  belong      0x080456 SunOS core file
>4 belong      432      (SPARC)
>>132 string      >\0      from '%s'
>>116 belong      =3    (quit)
>>116 belong      =4    (illegal instruction)
>>116 belong      =5    (trace trap)
>>116 belong      =6    (abort)
>>116 belong      =7    (emulator trap)
>>116 belong      =8    (arithmetic exception)
>>116 belong      =9    (kill)
>>116 belong      =10      (bus error)
>>116 belong      =11      (segmentation violation)
>>116 belong      =12      (bad argument to system call)
>>116 belong      =29      (resource lost)
>>120 belong      x     (T=%dK,
>>124 belong      x     D=%dK,
>>128 belong      x     S=%dK)
>4 belong      826      (68K)
>>128 string      >\0      from '%s'
>4 belong      456      (SPARC 4.x BCP)
>>152 string      >\0      from '%s'
# Sun SunPC
0  long     0xfa33c08e  SunPC 4.0 Hard Disk
0  string      #SUNPC_CONFIG  SunPC 4.0 Properties Values
# Sun snoop
#
# XXX - are numbers stored in big-endian format, or in host byte order?
# They're the same on SPARC, but not the same on x86.
#
0  string      snoop    Snoop capture file
>8 long     >0    - version %ld
>12   long     0     (IEEE 802.3)
>12   long     1     (IEEE 802.4)
>12   long     2     (IEEE 802.5)
>12   long     3     (IEEE 802.6)
>12   long     4     (Ethernet)
>12   long     5     (HDLC)
>12   long     6     (Character synchronous)
>12   long     7     (IBM channel-to-channel adapter)
>12   long     8     (FDDI)
>12   long     9     (Unknown)
# Sun KCMS
36 string      acsp     Kodak Color Management System, ICC Profile



#------------------------------------------------------------------------------
# terminfo:  file(1) magic for terminfo
#
# XXX - byte order for screen images?
#
0  string      \032\001 Compiled terminfo entry
0  short    0433     Curses screen image
0  short    0434     Curses screen image

#------------------------------------------------------------------------------
# tex:  file(1) magic for TeX files
#
# From <conklin@talisman.kaleida.com>

# Although we may know the offset of certain text fields in TeX DVI
# and font files, we can't use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0  string      \367\002 TeX DVI file
>16   string      >\0      (%s)
0  string      \367\203 TeX generic font data
0  string      \367\131 TeX packed font data
>3 string      >\0      (%s)
0  string      \367\312 TeX virtual font data
0  string      This\ is\ TeX, TeX transcript text
0  string      This\ is\ METAFONT,  METAFONT transcript text

# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data.  The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2  string      \000\021 TeX font metric data
>33   string      >\0      (%s)
2  string      \000\022 TeX font metric data
>33   string      >\0      (%s)

# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0  string      \\input\ texinfo  Texinfo source text
0  string      This\ is\ Info\ file GNU Info text

# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
0  string      \\input     TeX document text
0  string      \\section   LaTeX document text
0  string      \\setlength LaTeX document text
0  string      \\documentstyle   LaTeX document text
0  string      \\chapter   LaTeX document text

#------------------------------------------------------------------------------
# timezone:  file(1) magic for timezone data
#
# from Daniel Quinlan (quinlan@yggdrasil.com)
# this should work on Linux, SunOS, and maybe others
0  string   \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0  timezone data
0  string   \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0  timezone data
0  string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0   timezone data
0  string   \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0  timezone data
0  string   \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0  timezone data
0  string   \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0  timezone data

#------------------------------------------------------------------------------
# troff:  file(1) magic for *roff
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)

# troff input
0  string      .\\"		troff or preprocessor input text
0  string      '\\"		troff or preprocessor input text
0  string      '.\\"		troff or preprocessor input text
0  string      \\"		troff or preprocessor input text

# ditroff intermediate output text
0  string      x\ T     ditroff text
>4 string      cat      for the C/A/T phototypesetter
>4 string      ps    for PostScript
>4 string      dvi      for DVI
>4 string      ascii    for ASCII
>4 string      lj4      for LaserJet 4
>4 string      latin1      for ISO 8859-1 (Latin 1)
>4 string      X75      for xditview at 75dpi
>>7   string      -12      (12pt)
>4 string      X100     for xditview at 100dpi
>>8   string      -12      (12pt)

# output data formats
0  string      \100\357 very old (C/A/T) troff output data

#------------------------------------------------------------------------------
# typeset:  file(1) magic for other typesetting
#
0  string      Interpress/Xerox  Xerox InterPress data
>16   string      /        (version
>>17  string      >\0         %s)

#------------------------------------------------------------------------------
# unknown:  file(1) magic for unknown machines
#
# XXX - this probably should be pruned, as it'll match PDP-11 and
# VAX image formats.
#
# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
# respectively).
#
# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
# have the "version %ld", which may be a bogus COFFism (I don't think
# there ever was COFF for the PDP-11).
#
# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
# long, as it would be on a VAX.
#
# 0x10C is 0414, 0x10D is 0415, and 0x10E is 416; those *are* unknown.
#
0  short    0x107    unknown machine executable
>8 short    >0    not stripped
>15   byte     >0    - version %ld
0  short    0x108    unknown pure executable
>8 short    >0    not stripped
>15   byte     >0    - version %ld
0  short    0x109    PDP-11 separate I&D
>8 short    >0    not stripped
>15   byte     >0    - version %ld
0  short    0x10b    unknown pure executable
>8 short    >0    not stripped
>15   byte     >0    - version %ld
0  long     0x10c    unknown demand paged pure executable
>16   long     >0    not stripped
0  long     0x10d    unknown demand paged pure executable
>16   long     >0    not stripped
0  long     0x10e    unknown readable demand paged pure executable

#------------------------------------------------------------------------------
# uuencode:  file(1) magic for ASCII-encoded files
#

# GRR:  the first line of xxencoded files is identical to that in uuencoded
# files, but the first character in most subsequent lines is 'h' instead of
# 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
# punctuation and survives BITNET gateways better.)  If regular expressions
# were supported, this entry could possibly be split into two with
# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
0  string      begin\040   uuencoded or xxencoded text

# btoa(1) is an alternative to uuencode that requires less space.
0  string      xbtoa\ Begin   btoa'd text

# ship(1) is another, much cooler alternative to uuencode.
# Greg Roelofs, newt@uchicago.edu
0  string      $\012ship   ship'd binary text

# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
# Greg Roelofs, newt@uchicago.edu
0  string   Decode\ the\ following\ with\ bdeco bencoded News text

# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@yggdrasil.com
11 string   must\ be\ converted\ with\ BinHex   BinHex binary text
>41   string   x              \b, version %.3s

# GRR:  is MIME BASE64 encoding handled somewhere?

#------------------------------------------------------------------------------
# varied.out:  file(1) magic for various USG systems
#
#  Herewith many of the object file formats used by USG systems.
#  Most have been moved to files for a particular processor,
#  and deleted if they duplicate other entries.
#
0  short    0610     Perkin-Elmer executable
# AMD 29K
0  beshort     0572     amd 29k coff noprebar executable
0  beshort     01572    amd 29k coff prebar executable
0  beshort     0160007     amd 29k coff archive
# Cray
6  beshort     0407     unicos (cray) executable
# Ultrix 4.3
596   string      \130\337\377\377  Ultrix core file
>600  string      >\0   '%s'

#------------------------------------------------------------------------------
# vax:  file(1) magic for VAX executable/object and APL workspace
#
0  lelong      0101557     VAX single precision APL workspace
0  lelong      0101556     VAX double precision APL workspace

#
# VAX a.out (32V, BSD)
#
0  lelong      0407     VAX executable
>16   lelong      >0    not stripped

0  lelong      0410     VAX pure executable
>16   lelong      >0    not stripped

0  lelong      0413     VAX demand paged pure executable
>16   lelong      >0    not stripped

0  lelong      0420     VAX demand paged (first page unmapped) pure executable
>16   lelong      >0    not stripped

#
# VAX COFF
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0  leshort     0570     VAX COFF executable
>12   lelong      >0    not stripped
>22   leshort     >0    - version %ld
0  leshort     0575     VAX COFF pure executable
>12   lelong      >0    not stripped
>22   leshort     >0    - version %ld

#------------------------------------------------------------------------------
# visx:  file(1) magic for Visx format files
#
0  short    0x5555      VISX image file
>2 byte     0     (zero)
>2 byte     1     (unsigned char)
>2 byte     2     (short integer)
>2 byte     3     (float 32)
>2 byte     4     (float 64)
>2 byte     5     (signed char)
>2 byte     6     (bit-plane)
>2 byte     7     (classes)
>2 byte     8     (statistics)
>2 byte     10    (ascii text)
>2 byte     15    (image segments)
>2 byte     100      (image set)
>2 byte     101      (unsigned char vector)
>2 byte     102      (short integer vector)
>2 byte     103      (float 32 vector)
>2 byte     104      (float 64 vector)
>2 byte     105      (signed char vector)
>2 byte     106      (bit plane vector)
>2 byte     121      (feature vector)
>2 byte     122      (feature vector library)
>2 byte     124      (chain code)
>2 byte     126      (bit vector)
>2 byte     130      (graph)
>2 byte     131      (adjacency graph)
>2 byte     132      (adjacency graph library)
>2 string      .VISIX      (ascii text)

#------------------------------------------------------------------------------
# vms:  file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)

# GRR 950122:  I'm just guessing on these, based on inspection of the headers
# of three executables each for Alpha and VAX architectures.  The VAX files
# all had headers similar to this:
#
#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
#
0  string   \xb0\0\x30\0   VMS VAX executable
>44032   string   PK\003\004  \b, Info-ZIP SFX archive v5.12 w/decryption
#
# The AXP files all looked like this, except that the byte at offset 0x22
# was 06 in some of them and 07 in others:
#
#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
#
0  belong   0x03000000  VMS Alpha executable
>75264   string   PK\003\004  \b, Info-ZIP SFX archive v5.12 w/decryption

#------------------------------------------------------------------------------
# xenix:  file(1) magic for Microsoft Xenix
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
# model" lifted from "magic.xenix", with comment "derived empirically;
# treat as folklore until proven"
#
# "small model", "large model", "huge model" stuff lifted from XXX
#
# XXX - "x.out" collides with PDP-11 archives
#
0  string      core     core file (Xenix)
0  byte     0x80     8086 relocatable (Microsoft)
0  leshort     0xff65      x.out
>2 string      __.SYMDEF    randomized
>0 byte     x     archive
0  leshort     0x206    Microsoft a.out
>8 leshort     1     Middle model
>0x1e leshort     &0x10    overlay
>0x1e leshort     &0x2     separate
>0x1e leshort     &0x4     pure
>0x1e leshort     &0x800      segmented
>0x1e leshort     &0x400      standalone
>0x1e leshort     &0x8     fixed-stack
>0x1c byte     &0x80    byte-swapped
>0x1c byte     &0x40    word-swapped
>0x10 lelong      >0    not-stripped
>0x1e leshort     ^0xc000     pre-SysV
>0x1e leshort     &0x4000     V2.3
>0x1e leshort     &0x8000     V3.0
>0x1c byte     &0x4     86
>0x1c byte     &0xb     186
>0x1c byte     &0x9     286
>0x1c byte     &0xa     386
>0x1f byte     <0x040      small model
>0x1f byte     =0x048      large model 
>0x1f byte     =0x049      huge model 
>0x1e leshort     &0x1     executable
>0x1e leshort     ^0x1     object file
>0x1e leshort     &0x40    Large Text
>0x1e leshort     &0x20    Large Data
>0x1e leshort     &0x120      Huge Objects Enabled
>0x10 lelong      >0    not stripped

0  leshort     0x140    old Microsoft 8086 x.out
>0x3  byte     &0x4     separate
>0x3  byte     &0x2     pure
>0 byte     &0x1     executable
>0 byte     ^0x1     relocatable
>0x14 lelong      >0    not stripped

0  lelong      0x206    b.out
>0x1e leshort     &0x10    overlay
>0x1e leshort     &0x2     separate
>0x1e leshort     &0x4     pure
>0x1e leshort     &0x800      segmented
>0x1e leshort     &0x400      standalone
>0x1e leshort     &0x1     executable
>0x1e leshort     ^0x1     object file
>0x1e leshort     &0x4000     V2.3
>0x1e leshort     &0x8000     V3.0
>0x1c byte     &0x4     86
>0x1c byte     &0xb     186
>0x1c byte     &0x9     286
>0x1c byte     &0x29    286
>0x1c byte     &0xa     386
>0x1e leshort     &0x4     Large Text
>0x1e leshort     &0x2     Large Data
>0x1e leshort     &0x102      Huge Objects Enabled

0  leshort     0x580    XENIX 8086 relocatable or 80286 small model

#------------------------------------------------------------------------------
# zilog:  file(1) magic for Zilog Z8000.
#
# Was it big-endian or little-endian?  My Product Specification doesn't
# say.
#
0  long     0xe807      object file (z8000 a.out)
0  long     0xe808      pure object file (z8000 a.out)
0  long     0xe809      separate object file (z8000 a.out)
0  long     0xe805      overlay object file (z8000 a.out)

#------------------------------------------------------------------------------
# zyxel:  file(1) magic for ZyXEL modems
#
# From <rob@pe1chl.ampr.org>
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
# ZyXEL-defined standard)

0  string      ZyXEL\002   ZyXEL voice data
>10   byte     0     - CELP encoding
>10   byte&0x0B   1     - ADPCM2 encoding
>10   byte&0x0B   2     - ADPCM3 encoding
>10   byte&0x0B   3     - ADPCM4 encoding
>10   byte&0x0B   8     - New ADPCM3 encoding
>10   byte&0x04   4     with resync
