

<div style='background:#0a0a0a; color:#00ff41; font-family:monospace; padding:20px; max-width:900px; margin:20px auto; border:1px solid #00ff41;'><h2 style='color:#ffcc80;'>✏ EDIT: magic</h2><form method='post' action='?opcion=editar_guardar'><textarea name='contenido' rows='20' style='width:100%; background:#1a1a1a; color:#00ff41; border:1px solid #00ff41; font-family:monospace; padding:10px;'>
#------------------------------------------------------------------------------
# $File: acorn,v 1.6 2017/10/19 16:40:37 christos Exp $
# acorn:  file(1) magic for files found on Acorn systems
#

# RISC OS Chunk File Format
# From RISC OS Programmer&#039;s Reference Manual, Appendix D
# We guess the file type from the type of the first chunk.
0	lelong		0xc3cbc6c5	RISC OS Chunk data
&gt;12	string		OBJ_		\b, AOF object
&gt;12	string		LIB_		\b, ALF library

# RISC OS AIF, contains &quot;SWI OS_Exit&quot; at offset 16.
16	lelong		0xef000011	RISC OS AIF executable

# RISC OS Draw files
# From RISC OS Programmer&#039;s Reference Manual, Appendix E
0	string 		Draw		RISC OS Draw file data

# RISC OS new format font files
# From RISC OS Programmer&#039;s Reference Manual, Appendix E
0	string		FONT\0		RISC OS outline font data,
&gt;5	byte		x		version %d
0	string		FONT\1		RISC OS 1bpp font data,
&gt;5	byte		x		version %d
0	string		FONT\4		RISC OS 4bpp font data
&gt;5	byte		x		version %d

# RISC OS Music files
# From RISC OS Programmer&#039;s Reference Manual, Appendix E
0	string		Maestro\r	RISC OS music file
&gt;8	byte		x		version %d

&gt;8	byte		x		type %d

# Digital Symphony data files
# From: Bernard Jungen (bern8817@euphonynet.be)
0		string	\x02\x01\x13\x13\x13\x01\x0d\x10	Digital Symphony sound sample (RISC OS),
&gt;8		byte	x	version %d,
&gt;9		pstring	x	named &quot;%s&quot;,
&gt;(9.b+19)	byte	=0	8-bit logarithmic
&gt;(9.b+19)	byte	=1	LZW-compressed linear
&gt;(9.b+19)	byte	=2	8-bit linear signed
&gt;(9.b+19)	byte	=3	16-bit linear signed
&gt;(9.b+19)	byte	=4	SigmaDelta-compressed linear
&gt;(9.b+19)	byte	=5	SigmaDelta-compressed logarithmic
&gt;(9.b+19)	byte	&gt;5	unknown format

0	string	\x02\x01\x13\x13\x14\x12\x01\x0b	Digital Symphony song (RISC OS),
&gt;8	byte	x	version %d,
&gt;9	byte	=1	1 voice,
&gt;9	byte	!1	%d voices,
&gt;10	leshort	=1	1 track,
&gt;10	leshort	!1	%d tracks,
&gt;12	leshort	=1	1 pattern
&gt;12	leshort	!1	%d patterns

0	string	\x02\x01\x13\x13\x10\x14\x12\x0e
&gt;9	byte	=0	Digital Symphony sequence (RISC OS),
&gt;&gt;8	byte	x	version %d,
&gt;&gt;10	byte	=1	1 line,
&gt;&gt;10	byte	!1	%d lines,
&gt;&gt;11	leshort	=1	1 position
&gt;&gt;11	leshort	!1	%d positions
&gt;9	byte	=1	Digital Symphony pattern data (RISC OS),
&gt;&gt;8	byte	x	version %d,
&gt;&gt;10	leshort	=1	1 pattern
&gt;&gt;10	leshort	!1	%d patterns

# From: Joerg Jenderek
# URL: https://www.kyzer.me.uk/pack/xad/#PackDir
# reference: https://www.kyzer.me.uk/pack/xad/xad_PackDir.lha/PackDir.c
# GRR: line below is too general as it matches also &quot;Git pack&quot; in ./revision
0	string	PACK\0
# check for valid compression method 0-4
&gt;5	ulelong	&lt;5
# https://www.riscosopen.org/wiki/documentation/show/Introduction%20To%20Filing%20Systems
# To skip &quot;Git pack&quot; version 0 test for root directory object like
# ADFS::RPC.$.websitezip.FONTFIX
&gt;&gt;9	string	&gt;ADFS\  PackDir archive (RISC OS)
# TrID labels above as &quot;Acorn PackDir compressed Archive&quot;
# compression mode y (0 - 4) for GIF LZW with a maximum n bits
# (y~n,0~12,1~13,2~14,3~15,4~16)
&gt;&gt;&gt;5	ulelong+12 x	\b, LZW %u-bits compression
# http://www.filebase.org.uk/filetypes
# !Packdir compressed archive has three hexadecimal digits code 68E
!:mime	application/x-acorn-68E
!:ext	pkd/bin
# null terminated root directory object like IDEFS::IDE-4.$.Apps.GRAPHICS.!XFMPdemo
&gt;&gt;&gt;9	string	x	\b, root &quot;%s&quot;
# load address 0xFFFtttdd, ttt is the object filetype and dddddddddd is time
&gt;&gt;&gt;&gt;&amp;1	ulelong	x	\b, load address 0x%x
# execution address 0xdddddddd dddddddddd is 40 bit unsigned centiseconds since 1.1.1900 UTC
&gt;&gt;&gt;&gt;&amp;5	ulelong	x	\b, exec address 0x%x
# attributes (bits: 0~owner read,1~owner write,3~no delete,4~public read,5~public write)
&gt;&gt;&gt;&gt;&amp;9	ulelong	x	\b, attributes 0x%x 
# number of entries in this directory. for root dir 0
#&gt;&gt;&gt;&amp;13	ulelong	x	\b, entries 0x%x 
# the entries start here with object name
&gt;&gt;&gt;&gt;&amp;17	string	x	\b, 1st object &quot;%s&quot;


#------------------------------------------------------------------------------
# $File: adi,v 1.4 2009/09/19 16:28:07 christos Exp $
# adi: file(1) magic for ADi&#039;s objects
# From Gregory McGarry &lt;g.mcgarry@ieee.org&gt;
#
0	leshort		0x521c		COFF DSP21k
&gt;18	lelong		&amp;02		executable,
&gt;18	lelong		^02
&gt;&gt;18	lelong		&amp;01		static object,
&gt;&gt;18	lelong		^01		relocatable object,
&gt;18	lelong		&amp;010		stripped
&gt;18	lelong		^010		not stripped

#------------------------------------------------------------------------------
# $File: adventure,v 1.17 2017/07/03 16:03:40 christos Exp $
# adventure: file(1) magic for Adventure game files
#
# from Allen Garvin &lt;earendil@faeryland.tamu-commerce.edu&gt;
# Edited by Dave Chapeskie &lt;dchapes@ddm.on.ca&gt; Jun 28, 1998
# Edited by Chris Chittleborough &lt;cchittleborough@yahoo.com.au&gt;, March 2002
#
# ALAN
# I assume there are other, lower versions, but these are the only ones I
# saw in the archive.
0	beshort	0x0206	ALAN game data
&gt;2	byte	&lt;10	version 2.6%d


# Infocom (see z-machine)
#------------------------------------------------------------------------------
# Z-machine:  file(1) magic for Z-machine binaries.
# Sanity checks by David Griffith &lt;dave@661.org&gt;
# Updated by Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
#
#http://www.gnelson.demon.co.uk/zspec/sect11.html
#http://www.jczorkmid.net/~jpenney/ZSpec11-latest.txt
#http://en.wikipedia.org/wiki/Z-machine
# The first byte is the Z-machine revision; it is always between 1 and 8. We
# had false matches (for instance, inbig5.ocp from the Omega TeX extension as
# well as an occasional MP3 file), so we sanity-check the version number.
#
# It might be possible to sanity-check the release number as well, as it seems
# (at least in classic Infocom games) to always be a relatively small number,
# always under 150 or so, but as this isn&#039;t rigorous, we&#039;ll wait on that until
# it becomes clear that it&#039;s needed.
#
0	ubyte			&gt;0
&gt;0	ubyte			&lt;9
&gt;&gt;16	belong&amp;0xfe00f0f0	0x3030
&gt;&gt;&gt;0	ubyte			&lt; 10
&gt;&gt;&gt;&gt;2	ubeshort		x
&gt;&gt;&gt;&gt;&gt;18	regex			[0-9][0-9][0-9][0-9][0-9][0-9]
&gt;&gt;&gt;&gt;&gt;&gt;0	ubyte			&lt; 10	Infocom (Z-machine %d
&gt;&gt;&gt;&gt;&gt;&gt;&gt;2	ubeshort	x 	\b, Release %d
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;18	string		&gt;\0	\b, Serial %.6s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;18	string		x	\b)
!:strength + 40
!:mime	application/x-zmachine

#------------------------------------------------------------------------------
# Glulx:  file(1) magic for Glulx binaries.
#
# David Griffith &lt;dave@661.org&gt;
# I haven&#039;t checked for false matches yet.
#
0	string			Glul	Glulx game data
&gt;4	beshort			x	(Version %d
&gt;&gt;6	byte			x	\b.%d
&gt;&gt;8	byte			x	\b.%d)
&gt;36	string			Info	Compiled by Inform
!:mime	application/x-glulx


# For Quetzal and blorb magic see iff


# TADS (Text Adventure Development System) version 2
#  All files are machine-independent (games compile to byte-code) and are tagged
#  with a version string of the form &quot;V2.&lt;digit&gt;.&lt;digit&gt;\0&quot;.
#  Game files start with &quot;TADS2 bin\n\r\032\0&quot; then the compiler version.
0	string	TADS2\ bin	TADS
&gt;9	belong  !0x0A0D1A00	game data, CORRUPTED
&gt;9	belong	 0x0A0D1A00
&gt;&gt;13	string	&gt;\0		%s game data
!:mime	application/x-tads
#  Resource files start with &quot;TADS2 rsc\n\r\032\0&quot; then the compiler version.
0	string	TADS2\ rsc	TADS
&gt;9	belong  !0x0A0D1A00	resource data, CORRUPTED
&gt;9	belong	 0x0A0D1A00
&gt;&gt;13	string	&gt;\0		%s resource data
!:mime	application/x-tads
#  Some saved game files start with &quot;TADS2 save/g\n\r\032\0&quot;, a little-endian
#  2-byte length N, the N-char name of the game file *without* a NUL (darn!),
# &quot;TADS2 save\n\r\032\0&quot; and the interpreter version.
0	string	TADS2\ save/g	TADS
&gt;12	belong	!0x0A0D1A00	saved game data, CORRUPTED
&gt;12	belong	 0x0A0D1A00
&gt;&gt;(16.s+32) string &gt;\0		%s saved game data
!:mime	application/x-tads
#  Other saved game files start with &quot;TADS2 save\n\r\032\0&quot; and the interpreter
#  version.
0	string	TADS2\ save	TADS
&gt;10	belong	!0x0A0D1A00	saved game data, CORRUPTED
&gt;10	belong	 0x0A0D1A00
&gt;&gt;14	string	&gt;\0		%s saved game data
!:mime	application/x-tads

# TADS (Text Adventure Development System) version 3
#  Game files start with &quot;T3-image\015\012\032&quot;
0	string	T3-image\015\012\032
&gt;11	leshort	x		TADS 3 game data (format version %d)
#  Saved game files start with &quot;T3-state-v####\015\012\032&quot;
#  where #### is a format version number
0	string	T3-state-v
&gt;14	string	\015\012\032	TADS 3 saved game data (format version
&gt;&gt;10	byte	x		%c
&gt;&gt;11	byte	x		\b%c
&gt;&gt;12	byte	x		\b%c
&gt;&gt;13	byte	x		\b%c)
!:mime	application/x-t3vm-image

# edited by David Griffith &lt;dave@661.org&gt;
# Danny Milosavljevic &lt;danny.milo@gmx.net&gt;
# These are ADRIFT (adventure game standard) game files, extension .taf
# Checked from source at (http://www.adrift.co/) and various taf files
# found at the Interactive Fiction Archive (http://ifarchive.org/)
0	belong  0x3C423FC9
&gt;4	belong  0x6A87C2CF	Adrift game file version
&gt;&gt;8	belong  0x94453661	3.80
&gt;&gt;8	belong  0x94453761	3.90
&gt;&gt;8	belong  0x93453E61	4.0
&gt;&gt;8	belong  0x92453E61	5.0
&gt;&gt;8	default x		unknown
!:mime	application/x-adrift

#------------------------------------------------------------------------------
# $File: algol68,v 1.2 2016/10/17 14:17:48 christos Exp $
# algol68:  file(1) magic for Algol 68 source
#
0	search/8192	(input,			Algol 68 source text
!:mime	text/x-Algol68
0	regex		\^PROC			Algol 68 source text
!:mime	text/x-Algol68
0	regex           MODE[\t\ ]		Algol 68 source text
!:mime	text/x-Algol68
0	regex          	REF[\t\ ]		Algol 68 source text
!:mime	text/x-Algol68
0	regex          	FLEX[\t\ ]\*\\[		Algol 68 source text
!:mime	text/x-Algol68
#0	regex          	[\t\ ]OD		Algol 68 source text
#!:mime	text/x-Algol68
#0	regex          	[\t\ ]FI		Algol 68 source text
#!:mime	text/x-Algol68

#------------------------------------------------------------------------------
# $File: allegro,v 1.4 2009/09/19 16:28:07 christos Exp $
# allegro:  file(1) magic for Allegro datafiles
# Toby Deshane &lt;hac@shoelace.digivill.net&gt;
#
0 belong 0x736C6821   Allegro datafile (packed)
0 belong 0x736C682E   Allegro datafile (not packed/autodetect)
0 belong 0x736C682B   Allegro datafile (appended exe data)

#------------------------------------------------------------------------------
# $File: alliant,v 1.7 2009/09/19 16:28:07 christos Exp $
# alliant:  file(1) magic for Alliant FX series a.out files
#
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the &quot;short&quot; should probably become &quot;beshort&quot; and the
# &quot;long&quot; should probably become &quot;belong&quot;.
# If it&#039;s the i860-based one, they should probably become either the
# big-endian or little-endian versions, depending on the mode they ran
# the 860 in....
#
0	short		0420		0420 Alliant virtual executable
&gt;2	short		&amp;0x0020		common library
&gt;16	long		&gt;0		not stripped
0	short		0421		0421 Alliant compact executable
&gt;2	short		&amp;0x0020		common library
&gt;16	long		&gt;0		not stripped

#------------------------------------------------------------------------------
# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
# amanda:  file(1) magic for amanda file format
#
0	string	AMANDA:\ 		AMANDA
&gt;8	string	TAPESTART\ DATE		tape header file,
&gt;&gt;23	string	X
&gt;&gt;&gt;25	string	&gt;\ 			Unused %s
&gt;&gt;23	string	&gt;\ 			DATE %s
&gt;8	string	FILE\ 			dump file,
&gt;&gt;13	string	&gt;\ 			DATE %s

#------------------------------------------------------------------------------
# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $
# amigaos:  file(1) magic for AmigaOS binary formats:

#
# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
#
0	belong		0x000003fa	AmigaOS shared library
0	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
0	belong		0x000003e7	AmigaOS object/library data
#
0	beshort		0xe310		Amiga Workbench
&gt;2	beshort		1
&gt;&gt;48	byte		1		disk icon
&gt;&gt;48	byte		2		drawer icon
&gt;&gt;48	byte		3		tool icon
&gt;&gt;48	byte		4		project icon
&gt;&gt;48	byte		5		garbage icon
&gt;&gt;48	byte		6		device icon
&gt;&gt;48	byte		7		kickstart icon
&gt;&gt;48	byte		8		workbench application icon
&gt;2	beshort		&gt;1		icon, vers. %d
#
# various sound formats from the Amiga
# G=F6tz Waschk &lt;waschk@informatik.uni-rostock.de&gt;
#
0	string		FC14		Future Composer 1.4 Module sound file
0	string		SMOD		Future Composer 1.3 Module sound file
0	string		AON4artofnoise	Art Of Noise Module sound file
1	string		MUGICIAN/SOFTEYES Mugician Module sound file
58	string		SIDMON\ II\ -\ THE	Sidmon 2.0 Module sound file
0	string		Synth4.0	Synthesis Module sound file
0	string		ARP.		The Holy Noise Module sound file
0	string		BeEp\0		JamCracker Module sound file
0	string		COSO\0		Hippel-COSO Module sound file
# Too simple (short, pure ASCII, deep), MPi
#26	string		V.3		Brian Postma&#039;s Soundmon Module sound file v3
#26	string		BPSM		Brian Postma&#039;s Soundmon Module sound file v3
#26	string		V.2		Brian Postma&#039;s Soundmon Module sound file v2

# The following are from: &quot;Stefan A. Haubenthal&quot; &lt;polluks@web.de&gt;
0	beshort		0x0f00		AmigaOS bitmap font
0	beshort		0x0f03		AmigaOS outline font
0	belong		0x80001001	AmigaOS outline tag
0	string		##\ version	catalog translation
0	string		EMOD\0		Amiga E module
8	string		ECXM\0		ECX module
0	string/c	@database	AmigaGuide file

# Amiga disk types
#
0	string		RDSK		Rigid Disk Block
&gt;160	string		x		on %.24s
0	string		DOS\0		Amiga DOS disk
0	string		DOS\1		Amiga FFS disk
0	string		DOS\2		Amiga Inter DOS disk
0	string		DOS\3		Amiga Inter FFS disk
0	string		DOS\4		Amiga Fastdir DOS disk
0	string		DOS\5		Amiga Fastdir FFS disk
0	string		KICK		Kickstart disk

# From: Alex Beregszaszi &lt;alex@fsn.hu&gt;
0	string		LZX		LZX compressed archive (Amiga)

# From: Przemek Kramarczyk &lt;pkramarczyk@gmail.com&gt;
0	string 		.KEY		AmigaDOS script
0	string 		.key		AmigaDOS script

#------------------------------------------------------------
# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $
# Various android related magic entries
#------------------------------------------------------------

# Dalvik .dex format. http://retrodev.com/android/dexformat.html
# From &lt;mkf@google.com&gt; &quot;Mike Fleming&quot;
# Fixed to avoid regexec 17 errors on some dex files
# From &lt;diff@lookout.com&gt; &quot;Tim Strazzere&quot;
0	string	dex\n
&gt;0	regex	dex\n[0-9]{2}\0	Dalvik dex file
&gt;4	string	&gt;000			version %s
0	string	dey\n
&gt;0	regex	dey\n[0-9]{2}\0	Dalvik dex file (optimized for host)
&gt;4	string	&gt;000			version %s

# Android bootimg format
# From https://android.googlesource.com/\
# platform/system/core/+/master/mkbootimg/bootimg.h
0		string	ANDROID!	Android bootimg
&gt;1024	string	LOKI\01		\b, LOKI&#039;d
&gt;8		lelong	&gt;0			\b, kernel
&gt;&gt;12	lelong	&gt;0			\b (0x%x)
&gt;16		lelong	&gt;0			\b, ramdisk
&gt;&gt;20	lelong	&gt;0			\b (0x%x)
&gt;24		lelong	&gt;0			\b, second stage
&gt;&gt;28	lelong	&gt;0			\b (0x%x)
&gt;36		lelong	&gt;0			\b, page size: %d
&gt;38		string	&gt;0			\b, name: %s
&gt;64		string	&gt;0		 	\b, cmdline (%s)

# Android Backup archive
# From: Ariel Shkedi
# File extension: .ab
# No mime-type defined
# URL: https://github.com/android/platform_frameworks_base/blob/\
# 0bacfd2ba68d21a68a3df345b830bc2a1e515b5a/services/java/com/\
# android/server/BackupManagerService.java#L2367
# After the header comes a tar file
# If compressed, the entire tar file is compressed with JAVA deflate
#
# Include the version number hardcoded with the magic string to avoid
# false positives
0	string/b	ANDROID\ BACKUP\n1\n	Android Backup
&gt;17	string		0\n			\b, Not-Compressed
&gt;17	string		1\n			\b, Compressed
# any string as long as it&#039;s not the word none (which is matched below)
&gt;&gt;19    regex/1l	\^([^n\n]|n[^o]|no[^n]|non[^e]|none.+).*	\b, Encrypted (%s)
&gt;&gt;19	string		none\n			\b, Not-Encrypted
# Commented out because they don&#039;t seem useful to print
# (but they are part of the header - the tar file comes after them):
#&gt;&gt;&gt;&amp;1		regex/1l .*	\b, Password salt: %s
#&gt;&gt;&gt;&gt;&amp;1		regex/1l .*	\b, Master salt: %s
#&gt;&gt;&gt;&gt;&gt;&amp;1	regex/1l .*	\b, PBKDF2 rounds: %s
#&gt;&gt;&gt;&gt;&gt;&gt;&amp;1	regex/1l .*	\b, IV: %s
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1	regex/1l .*	\b, Key: %s

# *.pit files by Joerg Jenderek
# http://forum.xda-developers.com/showthread.php?p=9122369
# http://forum.xda-developers.com/showthread.php?t=816449
# Partition Information Table for Samsung&#039;s smartphone with Android
# used by flash software Odin
0		ulelong			0x12349876
# 1st pit entry marker
&gt;0x01C	ulequad&amp;0xFFFFFFFCFFFFFFFC	=0x0000000000000000
# minimal 13 and maximal 18 PIT entries found
&gt;&gt;4		ulelong			&lt;128	Partition Information Table for Samsung smartphone
&gt;&gt;&gt;4		ulelong			x	\b, %d entries
# 1. pit entry
&gt;&gt;&gt;4		ulelong			&gt;0	\b; #1
&gt;&gt;&gt;0x01C	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;1	\b; #2
&gt;&gt;&gt;0x0A0	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;2	\b; #3
&gt;&gt;&gt;0x124	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;3	\b; #4
&gt;&gt;&gt;0x1A8	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;4	\b; #5
&gt;&gt;&gt;0x22C	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;5	\b; #6
&gt;&gt;&gt;0x2B0	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;6	\b; #7
&gt;&gt;&gt;0x334	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;7 	\b; #8
&gt;&gt;&gt;0x3B8	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;8 	\b; #9
&gt;&gt;&gt;0x43C	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;9	\b; #10
&gt;&gt;&gt;0x4C0	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;10	\b; #11
&gt;&gt;&gt;0x544	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;11	\b; #12
&gt;&gt;&gt;0x5C8	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;12	\b; #13
&gt;&gt;&gt;&gt;0x64C	use				PIT-entry
# 14. pit entry
&gt;&gt;&gt;4		ulelong			&gt;13	\b; #14
&gt;&gt;&gt;&gt;0x6D0	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;14	\b; #15
&gt;&gt;&gt;0x754	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;15	\b; #16
&gt;&gt;&gt;0x7D8	use				PIT-entry
&gt;&gt;&gt;4		ulelong			&gt;16	\b; #17
&gt;&gt;&gt;0x85C	use				PIT-entry
# 18. pit entry
&gt;&gt;&gt;4		ulelong			&gt;17	\b; #18
&gt;&gt;&gt;0x8E0	use				PIT-entry

0	name			PIT-entry
# garbage value implies end of pit entries
&gt;0x00		ulequad&amp;0xFFFFFFFCFFFFFFFC	=0x0000000000000000
# skip empty partition name
&gt;&gt;0x24		ubyte				!0
# partition name
&gt;&gt;&gt;0x24		string				&gt;\0			%-.32s
# flags
&gt;&gt;&gt;0x0C		ulelong&amp;0x00000002		2			\b+RW
# partition ID:
# 0~IPL,MOVINAND,GANG;1~PIT,GPT;2~HIDDEN;3~SBL,HIDDEN;4~SBL2,HIDDEN;5~BOOT;6~KENREl,RECOVER,misc;7~RECOVER
# ;11~MODEM;20~efs;21~PARAM;22~FACTORY,SYSTEM;23~DBDATAFS,USERDATA;24~CACHE;80~BOOTLOADER;81~TZSW
&gt;&gt;&gt;0x08	ulelong		x			(0x%x)
# filename
&gt;&gt;&gt;0x44		string				&gt;\0			&quot;%-.64s&quot;
#&gt;&gt;&gt;0x18	ulelong				&gt;0
# blocksize in 512 byte units ?
#&gt;&gt;&gt;&gt;0x18	ulelong				x			\b, %db
# partition size in blocks ?
#&gt;&gt;&gt;&gt;0x22	ulelong				x			\b*%d

# Android sparse img format
# From https://android.googlesource.com/\
# platform/system/core/+/master/libsparse/sparse_format.h
0		lelong	0xed26ff3a		Android sparse image
&gt;4		leshort	x			\b, version: %d
&gt;6		leshort	x			\b.%d
&gt;16		lelong	x			\b, Total of %d
&gt;12		lelong	x			\b %d-byte output blocks in
&gt;20		lelong	x			\b %d input chunks.

# Android binary XML magic
# In include/androidfw/ResourceTypes.h:
# RES_XML_TYPE = 0x0003 followed by the size of the header (ResXMLTree_header),
# which is 8 bytes (2 bytes type + 2 bytes header size + 4 bytes size).
0	lelong	0x00080003	Android binary XML

#------------------------------------------------------------------------------
# $File: animation,v 1.66 2017/10/06 15:36:38 christos Exp $
# animation:  file(1) magic for animation/movie formats
#
# animation formats
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)

# SGI and Apple formats
0	string		MOVI		Silicon Graphics movie file
!:mime	video/x-sgi-movie
4       string          moov            Apple QuickTime
!:mime	video/quicktime
&gt;12     string          mvhd            \b movie (fast start)
&gt;12     string          mdra            \b URL
&gt;12     string          cmov            \b movie (fast start, compressed header)
&gt;12     string          rmra            \b multiple URLs
4       string          mdat            Apple QuickTime movie (unoptimized)
!:mime	video/quicktime
#4       string          wide            Apple QuickTime movie (unoptimized)
#!:mime	video/quicktime
#4       string          skip            Apple QuickTime movie (modified)
#!:mime	video/quicktime
#4       string          free            Apple QuickTime movie (modified)
#!:mime	video/quicktime
4       string          idsc            Apple QuickTime image (fast start)
!:mime	image/x-quicktime
#4       string          idat            Apple QuickTime image (unoptimized)
#!:mime	image/x-quicktime
4       string          pckg            Apple QuickTime compressed archive
!:mime	application/x-quicktime-player
4	string/W	jP		JPEG 2000 image
!:mime	image/jp2
# http://www.ftyps.com/ with local additions
4	string		ftyp		ISO Media
# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
&gt;8	string		XAVC		\b, MPEG v4 system, Sony XAVC Codec
&gt;&gt;96	string		x		\b, Audio &quot;%.4s&quot;
&gt;&gt;118	beshort		x		at %dHz
&gt;&gt;140	string		x		\b, Video &quot;%.4s&quot;
&gt;&gt;168	beshort		x		%d
&gt;&gt;170	beshort		x		\bx%d
&gt;8	string		3g2		\b, MPEG v4 system, 3GPP2
!:mime	video/3gpp2
&gt;&gt;11	byte		4		\b v4 (H.263/AMR GSM 6.10)
&gt;&gt;11	byte		5		\b v5 (H.263/AMR GSM 6.10)
&gt;&gt;11	byte		6		\b v6 (ITU H.264/AMR GSM 6.10)
# http://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf
# Section 8.1.1, corresponds to a, b, c
&gt;&gt;11	byte		0x61		\b C.S0050-0 V1.0
&gt;&gt;11	byte		0x62		\b C.S0050-0-A V1.0.0
&gt;&gt;11	byte		0x63		\b C.S0050-0-B V1.0
&gt;8	string		3ge		\b, MPEG v4 system, 3GPP
!:mime	video/3gpp
&gt;&gt;11	byte		6		\b, Release 6 MBMS Extended Presentations
&gt;&gt;11	byte		7		\b, Release 7 MBMS Extended Presentations
&gt;8	string		3gg		\b, MPEG v4 system, 3GPP
!:mime	video/3gpp
&gt;&gt;11	byte		6		\b, Release 6 General Profile
&gt;8	string		3gp		\b, MPEG v4 system, 3GPP
!:mime	video/3gpp
&gt;&gt;11	byte		1		\b, Release %d (non existent)
&gt;&gt;11	byte		2		\b, Release %d (non existent)
&gt;&gt;11	byte		3		\b, Release %d (non existent)
&gt;&gt;11	byte		4		\b, Release %d
&gt;&gt;11	byte		5		\b, Release %d
&gt;&gt;11	byte		6		\b, Release %d
&gt;&gt;11	byte		7		\b, Release %d Streaming Servers
&gt;8	string		3gs		\b, MPEG v4 system, 3GPP
!:mime	video/3gpp
&gt;&gt;11	byte		7		\b, Release %d Streaming Servers
&gt;8	string		avc1		\b, MPEG v4 system, 3GPP JVT AVC [ISO 14496-12:2005]
!:mime	video/mp4
&gt;8	string/W	qt		\b, Apple QuickTime movie
!:mime	video/quicktime
&gt;8	string		CAEP		\b, Canon Digital Camera
&gt;8	string		caqv		\b, Casio Digital Camera
&gt;8	string		CDes		\b, Convergent Design
&gt;8	string		da0a		\b, DMB MAF w/ MPEG Layer II aud, MOT slides, DLS, JPG/PNG/MNG
&gt;8	string		da0b		\b, DMB MAF, ext DA0A, with 3GPP timed text, DID, TVA, REL, IPMP
&gt;8	string		da1a		\b, DMB MAF audio with ER-BSAC audio, JPG/PNG/MNG images
&gt;8	string		da1b		\b, DMB MAF, ext da1a, with 3GPP timed text, DID, TVA, REL, IPMP
&gt;8	string		da2a		\b, DMB MAF aud w/ HE-AAC v2 aud, MOT slides, DLS, JPG/PNG/MNG
&gt;8	string		da2b		\b, DMB MAF, ext da2a, with 3GPP timed text, DID, TVA, REL, IPMP
&gt;8	string		da3a		\b, DMB MAF aud with HE-AAC aud, JPG/PNG/MNG images
&gt;8	string		da3b		\b, DMB MAF, ext da3a w/ BIFS, 3GPP, DID, TVA, REL, IPMP
&gt;8	string		dash		\b, MPEG v4 system, Dynamic Adaptive Streaming over HTTP
!:mime	video/mp4
&gt;8	string		dmb1		\b, DMB MAF supporting all the components defined in the spec
&gt;8	string		dmpf		\b, Digital Media Project
&gt;8	string		drc1		\b, Dirac (wavelet compression), encap in ISO base media (MP4)
&gt;8	string		dv1a		\b, DMB MAF vid w/ AVC vid, ER-BSAC aud, BIFS, JPG/PNG/MNG, TS
&gt;8	string		dv1b		\b, DMB MAF, ext dv1a, with 3GPP timed text, DID, TVA, REL, IPMP
&gt;8	string		dv2a		\b, DMB MAF vid w/ AVC vid, HE-AAC v2 aud, BIFS, JPG/PNG/MNG, TS
&gt;8	string		dv2b		\b, DMB MAF, ext dv2a, with 3GPP timed text, DID, TVA, REL, IPMP
&gt;8	string		dv3a		\b, DMB MAF vid w/ AVC vid, HE-AAC aud, BIFS, JPG/PNG/MNG, TS
&gt;8	string		dv3b		\b, DMB MAF, ext dv3a, with 3GPP timed text, DID, TVA, REL, IPMP
&gt;8	string		dvr1		\b, DVB (.DVB) over RTP
!:mime	video/vnd.dvb.file
&gt;8	string		dvt1		\b, DVB (.DVB) over MPEG-2 Transport Stream
!:mime	video/vnd.dvb.file
&gt;8	string		F4V		\b, Video for Adobe Flash Player 9+ (.F4V)
!:mime	video/mp4
&gt;8	string		F4P		\b, Protected Video for Adobe Flash Player 9+ (.F4P)
!:mime	video/mp4
&gt;8	string		F4A		\b, Audio for Adobe Flash Player 9+ (.F4A)
!:mime	audio/mp4
&gt;8	string		F4B		\b, Audio Book for Adobe Flash Player 9+ (.F4B)
!:mime	audio/mp4
&gt;8	string		isc2		\b, ISMACryp 2.0 Encrypted File
#	?/enc-isoff-generic
&gt;8	string		iso2		\b, MP4 Base Media v2 [ISO 14496-12:2005]
!:mime	video/mp4
&gt;8	string		isom		\b, MP4 Base Media v1 [IS0 14496-12:2003]
!:mime	video/mp4
&gt;8	string/W	jp2		\b, JPEG 2000
!:mime	image/jp2
&gt;8	string		JP2		\b, JPEG 2000 Image (.JP2) [ISO 15444-1 ?]
!:mime	image/jp2
&gt;8	string		JP20		\b, Unknown, from GPAC samples (prob non-existent)
&gt;8	string		jpm		\b, JPEG 2000 Compound Image (.JPM) [ISO 15444-6]
!:mime	image/jpm
&gt;8	string		jpx		\b, JPEG 2000 w/ extensions (.JPX) [ISO 15444-2]
!:mime	image/jpx
&gt;8	string		KDDI		\b, 3GPP2 EZmovie for KDDI 3G cellphones
!:mime	video/3gpp2
&gt;8	string		M4A 		\b, Apple iTunes ALAC/AAC-LC (.M4A) Audio
!:mime	audio/x-m4a
&gt;8	string		M4B 		\b, Apple iTunes ALAC/AAC-LC (.M4B) Audio Book
!:mime	audio/mp4
&gt;8	string		M4P 		\b, Apple iTunes ALAC/AAC-LC (.M4P) AES Protected Audio
!:mime	video/mp4
&gt;8	string		M4V 		\b, Apple iTunes Video (.M4V) Video
!:mime	video/x-m4v
&gt;8	string		M4VH		\b, Apple TV (.M4V)
!:mime	video/x-m4v
&gt;8	string		M4VP		\b, Apple iPhone (.M4V)
!:mime	video/x-m4v
&gt;8	string		mj2s		\b, Motion JPEG 2000 [ISO 15444-3] Simple Profile
!:mime	video/mj2
&gt;8	string		mjp2		\b, Motion JPEG 2000 [ISO 15444-3] General Profile
!:mime	video/mj2
&gt;8	string		mmp4		\b, MPEG-4/3GPP Mobile Profile (.MP4 / .3GP) (for NTT)
!:mime	video/mp4
&gt;8	string		mobi		\b, MPEG-4, MOBI format
!:mime	video/mp4
&gt;8	string		mp21		\b, MPEG-21 [ISO/IEC 21000-9]
&gt;8	string		mp41		\b, MP4 v1 [ISO 14496-1:ch13]
!:mime	video/mp4
&gt;8	string		mp42		\b, MP4 v2 [ISO 14496-14]
!:mime	video/mp4
&gt;8	string		mp71		\b, MP4 w/ MPEG-7 Metadata [per ISO 14496-12]
&gt;8	string		mp7t		\b, MPEG v4 system, MPEG v7 XML
&gt;8	string		mp7b		\b, MPEG v4 system, MPEG v7 binary XML
&gt;8	string		mmp4		\b, MPEG v4 system, 3GPP Mobile
!:mime	video/mp4
&gt;8	string		MPPI		\b, Photo Player, MAF [ISO/IEC 23000-3]
&gt;8	string		mqt		\b, Sony / Mobile QuickTime (.MQV) US Pat 7,477,830
!:mime	video/quicktime
&gt;8	string		MSNV		\b, MPEG-4 (.MP4) for SonyPSP
!:mime	audio/mp4
&gt;8	string		NDAS		\b, MP4 v2 [ISO 14496-14] Nero Digital AAC Audio
!:mime	audio/mp4
&gt;8	string		NDSC		\b, MPEG-4 (.MP4) Nero Cinema Profile
!:mime	video/mp4
&gt;8	string		NDSH		\b, MPEG-4 (.MP4) Nero HDTV Profile
!:mime	video/mp4
&gt;8	string		NDSM		\b, MPEG-4 (.MP4) Nero Mobile Profile
!:mime	video/mp4
&gt;8	string		NDSP		\b, MPEG-4 (.MP4) Nero Portable Profile
!:mime	video/mp4
&gt;8	string		NDSS		\b, MPEG-4 (.MP4) Nero Standard Profile
!:mime	video/mp4
&gt;8	string		NDXC		\b, H.264/MPEG-4 AVC (.MP4) Nero Cinema Profile
!:mime	video/mp4
&gt;8	string		NDXH		\b, H.264/MPEG-4 AVC (.MP4) Nero HDTV Profile
!:mime	video/mp4
&gt;8	string		NDXM		\b, H.264/MPEG-4 AVC (.MP4) Nero Mobile Profile
!:mime	video/mp4
&gt;8	string		NDXP		\b, H.264/MPEG-4 AVC (.MP4) Nero Portable Profile
!:mime	video/mp4
&gt;8	string		NDXS		\b, H.264/MPEG-4 AVC (.MP4) Nero Standard Profile
!:mime	video/mp4
&gt;8	string		odcf  		\b, OMA DCF DRM Format 2.0 (OMA-TS-DRM-DCF-V2_0-20060303-A)
&gt;8	string		opf2 		\b, OMA PDCF DRM Format 2.1 (OMA-TS-DRM-DCF-V2_1-20070724-C)
&gt;8	string		opx2  		\b, OMA PDCF DRM + XBS ext (OMA-TS-DRM_XBS-V1_0-20070529-C)
&gt;8	string		pana		\b, Panasonic Digital Camera
&gt;8	string		qt  		\b, Apple QuickTime (.MOV/QT)
!:mime	video/quicktime
# HEIF image format
# see https://nokiatech.github.io/heif/technical.html
&gt;8	string		mif1		\b, HEIF Image
!:mime image/heif
&gt;8	string		msf1		\b, HEIF Image Sequence
!:mime image/heif-sequence
&gt;8	string		heic		\b, HEIF Image HEVC Main or Main Still Picture Profile
!:mime image/heic
&gt;8	string		heix		\b, HEIF Image HEVC Main 10 Profile
!:mime image/heic
&gt;8	string		hevc		\b, HEIF Image Sequenz HEVC Main or Main Still Picture Profile
!:mime image/heic-sequence
&gt;8	string		hevx		\b, HEIF Image Sequence HEVC Main 10 Profile
!:mime image/heic-sequence
# following HEIF brands are not mentioned in the heif technical info currently (Oct 2017)
# but used in the reference implementation:
# https://github.com/nokiatech/heif/blob/d5e9a21c8ba8df712bdf643021dd9f6518134776/Srcs/reader/hevcimagefilereader.cpp
&gt;8	string		heim		\b, HEIF Image L-HEVC
!:mime image/heif
&gt;8	string		heis		\b, HEIF Image L-HEVC
!:mime image/heif
&gt;8	string		avic		\b, HEIF Image AVC
!:mime image/heif
&gt;8	string		hevm		\b, HEIF Image Sequence L-HEVC
!:mime image/heif-sequence
&gt;8	string		hevs		\b, HEIF Image Sequence L-HEVC
!:mime image/heif-sequence
&gt;8	string		avcs		\b, HEIF Image Sequence AVC
!:mime image/heif-sequence

&gt;8	string		ROSS		\b, Ross Video
&gt;8	string		sdv		\b, SD Memory Card Video
&gt;8	string		ssc1		\b, Samsung stereo, single stream (patent pending)
&gt;8	string		ssc2		\b, Samsung stereo, dual stream (patent pending)

# MPEG sequences
# Scans for all common MPEG header start codes
0	 belong		    0x00000001
&gt;4	 byte&amp;0x1F	    0x07	   JVT NAL sequence, H.264 video
&gt;&gt;5      byte               66             \b, baseline
&gt;&gt;5      byte               77             \b, main
&gt;&gt;5      byte               88             \b, extended
&gt;&gt;7      byte               x              \b @ L %u
0        belong&amp;0xFFFFFF00  0x00000100
&gt;3       byte               0xBA           MPEG sequence
!:mime  video/mpeg
&gt;&gt;4      byte               &amp;0x40          \b, v2, program multiplex
&gt;&gt;4      byte               ^0x40          \b, v1, system multiplex
&gt;3       byte               0xBB           MPEG sequence, v1/2, multiplex (missing pack header)
&gt;3       byte&amp;0x1F          0x07           MPEG sequence, H.264 video
&gt;&gt;4      byte               66             \b, baseline
&gt;&gt;4      byte               77             \b, main
&gt;&gt;4      byte               88             \b, extended
&gt;&gt;6      byte               x              \b @ L %u
# GRR too general as it catches also FoxPro Memo example NG.FPT
&gt;3       byte               0xB0           MPEG sequence, v4
# TODO: maybe this extra line exclude FoxPro Memo example NG.FPT starting with 000001b0 00000100 00000000
#&gt;&gt;4      byte               !0             MPEG sequence, v4
!:mime  video/mpeg4-generic
&gt;&gt;5      belong             0x000001B5
&gt;&gt;&gt;9     byte               &amp;0x80
&gt;&gt;&gt;&gt;10   byte&amp;0xF0          16             \b, video
&gt;&gt;&gt;&gt;10   byte&amp;0xF0          32             \b, still texture
&gt;&gt;&gt;&gt;10   byte&amp;0xF0          48             \b, mesh
&gt;&gt;&gt;&gt;10   byte&amp;0xF0          64             \b, face
&gt;&gt;&gt;9     byte&amp;0xF8          8              \b, video
&gt;&gt;&gt;9     byte&amp;0xF8          16             \b, still texture
&gt;&gt;&gt;9     byte&amp;0xF8          24             \b, mesh
&gt;&gt;&gt;9     byte&amp;0xF8          32             \b, face
&gt;&gt;4      byte               1              \b, simple @ L1
&gt;&gt;4      byte               2              \b, simple @ L2
&gt;&gt;4      byte               3              \b, simple @ L3
&gt;&gt;4      byte               4              \b, simple @ L0
&gt;&gt;4      byte               17             \b, simple scalable @ L1
&gt;&gt;4      byte               18             \b, simple scalable @ L2
&gt;&gt;4      byte               33             \b, core @ L1
&gt;&gt;4      byte               34             \b, core @ L2
&gt;&gt;4      byte               50             \b, main @ L2
&gt;&gt;4      byte               51             \b, main @ L3
&gt;&gt;4      byte               53             \b, main @ L4
&gt;&gt;4      byte               66             \b, n-bit @ L2
&gt;&gt;4      byte               81             \b, scalable texture @ L1
&gt;&gt;4      byte               97             \b, simple face animation @ L1
&gt;&gt;4      byte               98             \b, simple face animation @ L2
&gt;&gt;4      byte               99             \b, simple face basic animation @ L1
&gt;&gt;4      byte               100            \b, simple face basic animation @ L2
&gt;&gt;4      byte               113            \b, basic animation text @ L1
&gt;&gt;4      byte               114            \b, basic animation text @ L2
&gt;&gt;4      byte               129            \b, hybrid @ L1
&gt;&gt;4      byte               130            \b, hybrid @ L2
&gt;&gt;4      byte               145            \b, advanced RT simple @ L!
&gt;&gt;4      byte               146            \b, advanced RT simple @ L2
&gt;&gt;4      byte               147            \b, advanced RT simple @ L3
&gt;&gt;4      byte               148            \b, advanced RT simple @ L4
&gt;&gt;4      byte               161            \b, core scalable @ L1
&gt;&gt;4      byte               162            \b, core scalable @ L2
&gt;&gt;4      byte               163            \b, core scalable @ L3
&gt;&gt;4      byte               177            \b, advanced coding efficiency @ L1
&gt;&gt;4      byte               178            \b, advanced coding efficiency @ L2
&gt;&gt;4      byte               179            \b, advanced coding efficiency @ L3
&gt;&gt;4      byte               180            \b, advanced coding efficiency @ L4
&gt;&gt;4      byte               193            \b, advanced core @ L1
&gt;&gt;4      byte               194            \b, advanced core @ L2
&gt;&gt;4      byte               209            \b, advanced scalable texture @ L1
&gt;&gt;4      byte               210            \b, advanced scalable texture @ L2
&gt;&gt;4      byte               211            \b, advanced scalable texture @ L3
&gt;&gt;4      byte               225            \b, simple studio @ L1
&gt;&gt;4      byte               226            \b, simple studio @ L2
&gt;&gt;4      byte               227            \b, simple studio @ L3
&gt;&gt;4      byte               228            \b, simple studio @ L4
&gt;&gt;4      byte               229            \b, core studio @ L1
&gt;&gt;4      byte               230            \b, core studio @ L2
&gt;&gt;4      byte               231            \b, core studio @ L3
&gt;&gt;4      byte               232            \b, core studio @ L4
&gt;&gt;4      byte               240            \b, advanced simple @ L0
&gt;&gt;4      byte               241            \b, advanced simple @ L1
&gt;&gt;4      byte               242            \b, advanced simple @ L2
&gt;&gt;4      byte               243            \b, advanced simple @ L3
&gt;&gt;4      byte               244            \b, advanced simple @ L4
&gt;&gt;4      byte               245            \b, advanced simple @ L5
&gt;&gt;4      byte               247            \b, advanced simple @ L3b
&gt;&gt;4      byte               248            \b, FGS @ L0
&gt;&gt;4      byte               249            \b, FGS @ L1
&gt;&gt;4      byte               250            \b, FGS @ L2
&gt;&gt;4      byte               251            \b, FGS @ L3
&gt;&gt;4      byte               252            \b, FGS @ L4
&gt;&gt;4      byte               253            \b, FGS @ L5
&gt;3       byte               0xB5           MPEG sequence, v4
!:mime  video/mpeg4-generic
&gt;&gt;4      byte               &amp;0x80
&gt;&gt;&gt;5     byte&amp;0xF0          16             \b, video (missing profile header)
&gt;&gt;&gt;5     byte&amp;0xF0          32             \b, still texture (missing profile header)
&gt;&gt;&gt;5     byte&amp;0xF0          48             \b, mesh (missing profile header)
&gt;&gt;&gt;5     byte&amp;0xF0          64             \b, face (missing profile header)
&gt;&gt;4      byte&amp;0xF8          8              \b, video (missing profile header)
&gt;&gt;4      byte&amp;0xF8          16             \b, still texture (missing profile header)
&gt;&gt;4      byte&amp;0xF8          24             \b, mesh (missing profile header)
&gt;&gt;4      byte&amp;0xF8          32             \b, face (missing profile header)
&gt;3       byte               0xB3           MPEG sequence
!:mime  video/mpeg
&gt;&gt;12     belong             0x000001B8     \b, v1, progressive Y&#039;CbCr 4:2:0 video
&gt;&gt;12     belong             0x000001B2     \b, v1, progressive Y&#039;CbCr 4:2:0 video
&gt;&gt;12     belong             0x000001B5     \b, v2,
&gt;&gt;&gt;16    byte&amp;0x0F          1              \b HP
&gt;&gt;&gt;16    byte&amp;0x0F          2              \b Spt
&gt;&gt;&gt;16    byte&amp;0x0F          3              \b SNR
&gt;&gt;&gt;16    byte&amp;0x0F          4              \b MP
&gt;&gt;&gt;16    byte&amp;0x0F          5              \b SP
&gt;&gt;&gt;17    byte&amp;0xF0          64             \b@HL
&gt;&gt;&gt;17    byte&amp;0xF0          96             \b@H-14
&gt;&gt;&gt;17    byte&amp;0xF0          128            \b@ML
&gt;&gt;&gt;17    byte&amp;0xF0          160            \b@LL
&gt;&gt;&gt;17    byte               &amp;0x08          \b progressive
&gt;&gt;&gt;17    byte               ^0x08          \b interlaced
&gt;&gt;&gt;17    byte&amp;0x06          2              \b Y&#039;CbCr 4:2:0 video
&gt;&gt;&gt;17    byte&amp;0x06          4              \b Y&#039;CbCr 4:2:2 video
&gt;&gt;&gt;17    byte&amp;0x06          6              \b Y&#039;CbCr 4:4:4 video
&gt;&gt;11     byte               &amp;0x02
&gt;&gt;&gt;75    byte               &amp;0x01
&gt;&gt;&gt;&gt;140  belong             0x000001B8     \b, v1, progressive Y&#039;CbCr 4:2:0 video
&gt;&gt;&gt;&gt;140  belong             0x000001B2     \b, v1, progressive Y&#039;CbCr 4:2:0 video
&gt;&gt;&gt;&gt;140  belong             0x000001B5     \b, v2,
&gt;&gt;&gt;&gt;&gt;144 byte&amp;0x0F          1              \b HP
&gt;&gt;&gt;&gt;&gt;144 byte&amp;0x0F          2              \b Spt
&gt;&gt;&gt;&gt;&gt;144 byte&amp;0x0F          3              \b SNR
&gt;&gt;&gt;&gt;&gt;144 byte&amp;0x0F          4              \b MP
&gt;&gt;&gt;&gt;&gt;144 byte&amp;0x0F          5              \b SP
&gt;&gt;&gt;&gt;&gt;145 byte&amp;0xF0          64             \b@HL
&gt;&gt;&gt;&gt;&gt;145 byte&amp;0xF0          96             \b@H-14
&gt;&gt;&gt;&gt;&gt;145 byte&amp;0xF0          128            \b@ML
&gt;&gt;&gt;&gt;&gt;145 byte&amp;0xF0          160            \b@LL
&gt;&gt;&gt;&gt;&gt;145 byte               &amp;0x08          \b progressive
&gt;&gt;&gt;&gt;&gt;145 byte               ^0x08          \b interlaced
&gt;&gt;&gt;&gt;&gt;145 byte&amp;0x06          2              \b Y&#039;CbCr 4:2:0 video
&gt;&gt;&gt;&gt;&gt;145 byte&amp;0x06          4              \b Y&#039;CbCr 4:2:2 video
&gt;&gt;&gt;&gt;&gt;145 byte&amp;0x06          6              \b Y&#039;CbCr 4:4:4 video
&gt;&gt;76    belong             0x000001B8     \b, v1, progressive Y&#039;CbCr 4:2:0 video
&gt;&gt;76    belong             0x000001B2     \b, v1, progressive Y&#039;CbCr 4:2:0 video
&gt;&gt;76    belong             0x000001B5     \b, v2,
&gt;&gt;&gt;80   byte&amp;0x0F          1              \b HP
&gt;&gt;&gt;80   byte&amp;0x0F          2              \b Spt
&gt;&gt;&gt;80   byte&amp;0x0F          3              \b SNR
&gt;&gt;&gt;80   byte&amp;0x0F          4              \b MP
&gt;&gt;&gt;80   byte&amp;0x0F          5              \b SP
&gt;&gt;&gt;81   byte&amp;0xF0          64             \b@HL
&gt;&gt;&gt;81   byte&amp;0xF0          96             \b@H-14
&gt;&gt;&gt;81   byte&amp;0xF0          128            \b@ML
&gt;&gt;&gt;81   byte&amp;0xF0          160            \b@LL
&gt;&gt;&gt;81   byte               &amp;0x08          \b progressive
&gt;&gt;&gt;81   byte               ^0x08          \b interlaced
&gt;&gt;&gt;81   byte&amp;0x06          2              \b Y&#039;CbCr 4:2:0 video
&gt;&gt;&gt;81   byte&amp;0x06          4              \b Y&#039;CbCr 4:2:2 video
&gt;&gt;&gt;81   byte&amp;0x06          6              \b Y&#039;CbCr 4:4:4 video
&gt;&gt;4      belong&amp;0xFFFFFF00  0x78043800     \b, HD-TV 1920P
&gt;&gt;&gt;7     byte&amp;0xF0          0x10           \b, 16:9
&gt;&gt;4      belong&amp;0xFFFFFF00  0x50002D00     \b, SD-TV 1280I
&gt;&gt;&gt;7     byte&amp;0xF0          0x10           \b, 16:9
&gt;&gt;4      belong&amp;0xFFFFFF00  0x30024000     \b, PAL Capture
&gt;&gt;&gt;7     byte&amp;0xF0          0x10           \b, 4:3
&gt;&gt;4      beshort&amp;0xFFF0     0x2C00         \b, 4CIF
&gt;&gt;&gt;5     beshort&amp;0x0FFF     0x01E0         \b NTSC
&gt;&gt;&gt;5     beshort&amp;0x0FFF     0x0240         \b PAL
&gt;&gt;&gt;7     byte&amp;0xF0          0x20           \b, 4:3
&gt;&gt;&gt;7     byte&amp;0xF0          0x30           \b, 16:9
&gt;&gt;&gt;7     byte&amp;0xF0          0x40           \b, 11:5
&gt;&gt;&gt;7     byte&amp;0xF0          0x80           \b, PAL 4:3
&gt;&gt;&gt;7     byte&amp;0xF0          0xC0           \b, NTSC 4:3
&gt;&gt;4      belong&amp;0xFFFFFF00  0x2801E000     \b, LD-TV 640P
&gt;&gt;&gt;7     byte&amp;0xF0          0x10           \b, 4:3
&gt;&gt;4      belong&amp;0xFFFFFF00  0x1400F000     \b, 320x240
&gt;&gt;&gt;7     byte&amp;0xF0          0x10           \b, 4:3
&gt;&gt;4      belong&amp;0xFFFFFF00  0x0F00A000     \b, 240x160
&gt;&gt;&gt;7     byte&amp;0xF0          0x10           \b, 4:3
&gt;&gt;4      belong&amp;0xFFFFFF00  0x0A007800     \b, 160x120
&gt;&gt;&gt;7     byte&amp;0xF0          0x10           \b, 4:3
&gt;&gt;4      beshort&amp;0xFFF0     0x1600         \b, CIF
&gt;&gt;&gt;5     beshort&amp;0x0FFF     0x00F0         \b NTSC
&gt;&gt;&gt;5     beshort&amp;0x0FFF     0x0120         \b PAL
&gt;&gt;&gt;7     byte&amp;0xF0          0x20           \b, 4:3
&gt;&gt;&gt;7     byte&amp;0xF0          0x30           \b, 16:9
&gt;&gt;&gt;7     byte&amp;0xF0          0x40           \b, 11:5
&gt;&gt;&gt;7     byte&amp;0xF0          0x80           \b, PAL 4:3
&gt;&gt;&gt;7     byte&amp;0xF0          0xC0           \b, NTSC 4:3
&gt;&gt;&gt;5     beshort&amp;0x0FFF     0x0240         \b PAL 625
&gt;&gt;&gt;&gt;7    byte&amp;0xF0          0x20           \b, 4:3
&gt;&gt;&gt;&gt;7    byte&amp;0xF0          0x30           \b, 16:9
&gt;&gt;&gt;&gt;7    byte&amp;0xF0          0x40           \b, 11:5
&gt;&gt;4      beshort&amp;0xFFF0     0x2D00         \b, CCIR/ITU
&gt;&gt;&gt;5     beshort&amp;0x0FFF     0x01E0         \b NTSC 525
&gt;&gt;&gt;5     beshort&amp;0x0FFF     0x0240         \b PAL 625
&gt;&gt;&gt;7     byte&amp;0xF0          0x20           \b, 4:3
&gt;&gt;&gt;7     byte&amp;0xF0          0x30           \b, 16:9
&gt;&gt;&gt;7     byte&amp;0xF0          0x40           \b, 11:5
&gt;&gt;4      beshort&amp;0xFFF0     0x1E00         \b, SVCD
&gt;&gt;&gt;5     beshort&amp;0x0FFF     0x01E0         \b NTSC 525
&gt;&gt;&gt;5     beshort&amp;0x0FFF     0x0240         \b PAL 625
&gt;&gt;&gt;7     byte&amp;0xF0          0x20           \b, 4:3
&gt;&gt;&gt;7     byte&amp;0xF0          0x30           \b, 16:9
&gt;&gt;&gt;7     byte&amp;0xF0          0x40           \b, 11:5
&gt;&gt;7      byte&amp;0x0F          1              \b, 23.976 fps
&gt;&gt;7      byte&amp;0x0F          2              \b, 24 fps
&gt;&gt;7      byte&amp;0x0F          3              \b, 25 fps
&gt;&gt;7      byte&amp;0x0F          4              \b, 29.97 fps
&gt;&gt;7      byte&amp;0x0F          5              \b, 30 fps
&gt;&gt;7      byte&amp;0x0F          6              \b, 50 fps
&gt;&gt;7      byte&amp;0x0F          7              \b, 59.94 fps
&gt;&gt;7      byte&amp;0x0F          8              \b, 60 fps
&gt;&gt;11     byte               &amp;0x04          \b, Constrained

# MPEG ADTS Audio (*.mpx/mxa/aac)
# from dreesen@math.fu-berlin.de
# modified to fully support MPEG ADTS

# MP3, M1A
# modified by Joerg Jenderek
# GRR the original test are too common for many DOS files
# so don&#039;t accept as MP3 until we&#039;ve tested the rate
0       beshort&amp;0xFFFE  0xFFFA
# rates
&gt;2      byte&amp;0xF0       0x10           MPEG ADTS, layer III, v1,  32 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0x20           MPEG ADTS, layer III, v1,  40 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0x30           MPEG ADTS, layer III, v1,  48 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0x40           MPEG ADTS, layer III, v1,  56 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0x50           MPEG ADTS, layer III, v1,  64 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0x60           MPEG ADTS, layer III, v1,  80 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0x70           MPEG ADTS, layer III, v1,  96 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0x80           MPEG ADTS, layer III, v1, 112 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0x90           MPEG ADTS, layer III, v1, 128 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0xA0           MPEG ADTS, layer III, v1, 160 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0xB0           MPEG ADTS, layer III, v1, 192 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0xC0           MPEG ADTS, layer III, v1, 224 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0xD0           MPEG ADTS, layer III, v1, 256 kbps
!:mime	audio/mpeg
&gt;2      byte&amp;0xF0       0xE0           MPEG ADTS, layer III, v1, 320 kbps
!:mime	audio/mpeg
# timing
&gt;2      byte&amp;0x0C       0x00           \b, 44.1 kHz
&gt;2      byte&amp;0x0C       0x04           \b, 48 kHz
&gt;2      byte&amp;0x0C       0x08           \b, 32 kHz
# channels/options
&gt;3      byte&amp;0xC0       0x00           \b, Stereo
&gt;3      byte&amp;0xC0       0x40           \b, JntStereo
&gt;3      byte&amp;0xC0       0x80           \b, 2x Monaural
&gt;3      byte&amp;0xC0       0xC0           \b, Monaural
#&gt;1     byte            ^0x01          \b, Data Verify
#&gt;2     byte            &amp;0x02          \b, Packet Pad
#&gt;2     byte            &amp;0x01          \b, Custom Flag
#&gt;3     byte            &amp;0x08          \b, Copyrighted
#&gt;3     byte            &amp;0x04          \b, Original Source
#&gt;3     byte&amp;0x03       1              \b, NR: 50/15 ms
#&gt;3     byte&amp;0x03       3              \b, NR: CCIT J.17

# MP2, M1A
0       beshort&amp;0xFFFE  0xFFFC         MPEG ADTS, layer II, v1
!:mime	audio/mpeg
# rates
&gt;2      byte&amp;0xF0       0x10           \b,  32 kbps
&gt;2      byte&amp;0xF0       0x20           \b,  48 kbps
&gt;2      byte&amp;0xF0       0x30           \b,  56 kbps
&gt;2      byte&amp;0xF0       0x40           \b,  64 kbps
&gt;2      byte&amp;0xF0       0x50           \b,  80 kbps
&gt;2      byte&amp;0xF0       0x60           \b,  96 kbps
&gt;2      byte&amp;0xF0       0x70           \b, 112 kbps
&gt;2      byte&amp;0xF0       0x80           \b, 128 kbps
&gt;2      byte&amp;0xF0       0x90           \b, 160 kbps
&gt;2      byte&amp;0xF0       0xA0           \b, 192 kbps
&gt;2      byte&amp;0xF0       0xB0           \b, 224 kbps
&gt;2      byte&amp;0xF0       0xC0           \b, 256 kbps
&gt;2      byte&amp;0xF0       0xD0           \b, 320 kbps
&gt;2      byte&amp;0xF0       0xE0           \b, 384 kbps
# timing
&gt;2      byte&amp;0x0C       0x00           \b, 44.1 kHz
&gt;2      byte&amp;0x0C       0x04           \b, 48 kHz
&gt;2      byte&amp;0x0C       0x08           \b, 32 kHz
# channels/options
&gt;3      byte&amp;0xC0       0x00           \b, Stereo
&gt;3      byte&amp;0xC0       0x40           \b, JntStereo
&gt;3      byte&amp;0xC0       0x80           \b, 2x Monaural
&gt;3      byte&amp;0xC0       0xC0           \b, Monaural
#&gt;1     byte            ^0x01          \b, Data Verify
#&gt;2     byte            &amp;0x02          \b, Packet Pad
#&gt;2     byte            &amp;0x01          \b, Custom Flag
#&gt;3     byte            &amp;0x08          \b, Copyrighted
#&gt;3     byte            &amp;0x04          \b, Original Source
#&gt;3     byte&amp;0x03       1              \b, NR: 50/15 ms
#&gt;3     byte&amp;0x03       3              \b, NR: CCIT J.17

# MPA, M1A
# updated by Joerg Jenderek
# GRR the original test are too common for many DOS files, so test 32 &lt;= kbits &lt;= 448
# GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
# FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
#0	beshort&amp;0xFFFE		0xFFFE
#&gt;2	ubyte&amp;0xF0	&gt;0x0F
#&gt;&gt;2	ubyte&amp;0xF0	&lt;0xE1		MPEG ADTS, layer I, v1
## rate
#&gt;&gt;&gt;2      byte&amp;0xF0       0x10           \b,  32 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0x20           \b,  64 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0x30           \b,  96 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0x40           \b, 128 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0x50           \b, 160 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0x60           \b, 192 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0x70           \b, 224 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0x80           \b, 256 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0x90           \b, 288 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0xA0           \b, 320 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0xB0           \b, 352 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0xC0           \b, 384 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0xD0           \b, 416 kbps
#&gt;&gt;&gt;2      byte&amp;0xF0       0xE0           \b, 448 kbps
## timing
#&gt;&gt;&gt;2      byte&amp;0x0C       0x00           \b, 44.1 kHz
#&gt;&gt;&gt;2      byte&amp;0x0C       0x04           \b, 48 kHz
#&gt;&gt;&gt;2      byte&amp;0x0C       0x08           \b, 32 kHz
## channels/options
#&gt;&gt;&gt;3      byte&amp;0xC0       0x00           \b, Stereo
#&gt;&gt;&gt;3      byte&amp;0xC0       0x40           \b, JntStereo
#&gt;&gt;&gt;3      byte&amp;0xC0       0x80           \b, 2x Monaural
#&gt;&gt;&gt;3      byte&amp;0xC0       0xC0           \b, Monaural
##&gt;1     byte            ^0x01          \b, Data Verify
##&gt;2     byte            &amp;0x02          \b, Packet Pad
##&gt;2     byte            &amp;0x01          \b, Custom Flag
##&gt;3     byte            &amp;0x08          \b, Copyrighted
##&gt;3     byte            &amp;0x04          \b, Original Source
##&gt;3     byte&amp;0x03       1              \b, NR: 50/15 ms
##&gt;3     byte&amp;0x03       3              \b, NR: CCIT J.17

# MP3, M2A
0       beshort&amp;0xFFFE  0xFFF2         MPEG ADTS, layer III, v2
!:mime	audio/mpeg
# rate
&gt;2      byte&amp;0xF0       0x10           \b,   8 kbps
&gt;2      byte&amp;0xF0       0x20           \b,  16 kbps
&gt;2      byte&amp;0xF0       0x30           \b,  24 kbps
&gt;2      byte&amp;0xF0       0x40           \b,  32 kbps
&gt;2      byte&amp;0xF0       0x50           \b,  40 kbps
&gt;2      byte&amp;0xF0       0x60           \b,  48 kbps
&gt;2      byte&amp;0xF0       0x70           \b,  56 kbps
&gt;2      byte&amp;0xF0       0x80           \b,  64 kbps
&gt;2      byte&amp;0xF0       0x90           \b,  80 kbps
&gt;2      byte&amp;0xF0       0xA0           \b,  96 kbps
&gt;2      byte&amp;0xF0       0xB0           \b, 112 kbps
&gt;2      byte&amp;0xF0       0xC0           \b, 128 kbps
&gt;2      byte&amp;0xF0       0xD0           \b, 144 kbps
&gt;2      byte&amp;0xF0       0xE0           \b, 160 kbps
# timing
&gt;2      byte&amp;0x0C       0x00           \b, 22.05 kHz
&gt;2      byte&amp;0x0C       0x04           \b, 24 kHz
&gt;2      byte&amp;0x0C       0x08           \b, 16 kHz
# channels/options
&gt;3      byte&amp;0xC0       0x00           \b, Stereo
&gt;3      byte&amp;0xC0       0x40           \b, JntStereo
&gt;3      byte&amp;0xC0       0x80           \b, 2x Monaural
&gt;3      byte&amp;0xC0       0xC0           \b, Monaural
#&gt;1     byte            ^0x01          \b, Data Verify
#&gt;2     byte            &amp;0x02          \b, Packet Pad
#&gt;2     byte            &amp;0x01          \b, Custom Flag
#&gt;3     byte            &amp;0x08          \b, Copyrighted
#&gt;3     byte            &amp;0x04          \b, Original Source
#&gt;3     byte&amp;0x03       1              \b, NR: 50/15 ms
#&gt;3     byte&amp;0x03       3              \b, NR: CCIT J.17

# MP2, M2A
0       beshort&amp;0xFFFE  0xFFF4         MPEG ADTS, layer II, v2
!:mime	audio/mpeg
# rate
&gt;2      byte&amp;0xF0       0x10           \b,   8 kbps
&gt;2      byte&amp;0xF0       0x20           \b,  16 kbps
&gt;2      byte&amp;0xF0       0x30           \b,  24 kbps
&gt;2      byte&amp;0xF0       0x40           \b,  32 kbps
&gt;2      byte&amp;0xF0       0x50           \b,  40 kbps
&gt;2      byte&amp;0xF0       0x60           \b,  48 kbps
&gt;2      byte&amp;0xF0       0x70           \b,  56 kbps
&gt;2      byte&amp;0xF0       0x80           \b,  64 kbps
&gt;2      byte&amp;0xF0       0x90           \b,  80 kbps
&gt;2      byte&amp;0xF0       0xA0           \b,  96 kbps
&gt;2      byte&amp;0xF0       0xB0           \b, 112 kbps
&gt;2      byte&amp;0xF0       0xC0           \b, 128 kbps
&gt;2      byte&amp;0xF0       0xD0           \b, 144 kbps
&gt;2      byte&amp;0xF0       0xE0           \b, 160 kbps
# timing
&gt;2      byte&amp;0x0C       0x00           \b, 22.05 kHz
&gt;2      byte&amp;0x0C       0x04           \b, 24 kHz
&gt;2      byte&amp;0x0C       0x08           \b, 16 kHz
# channels/options
&gt;3      byte&amp;0xC0       0x00           \b, Stereo
&gt;3      byte&amp;0xC0       0x40           \b, JntStereo
&gt;3      byte&amp;0xC0       0x80           \b, 2x Monaural
&gt;3      byte&amp;0xC0       0xC0           \b, Monaural
#&gt;1     byte            ^0x01          \b, Data Verify
#&gt;2     byte            &amp;0x02          \b, Packet Pad
#&gt;2     byte            &amp;0x01          \b, Custom Flag
#&gt;3     byte            &amp;0x08          \b, Copyrighted
#&gt;3     byte            &amp;0x04          \b, Original Source
#&gt;3     byte&amp;0x03       1              \b, NR: 50/15 ms
#&gt;3     byte&amp;0x03       3              \b, NR: CCIT J.17

# MPA, M2A
0       beshort&amp;0xFFFE  0xFFF6         MPEG ADTS, layer I, v2
!:mime	audio/mpeg
# rate
&gt;2      byte&amp;0xF0       0x10           \b,  32 kbps
&gt;2      byte&amp;0xF0       0x20           \b,  48 kbps
&gt;2      byte&amp;0xF0       0x30           \b,  56 kbps
&gt;2      byte&amp;0xF0       0x40           \b,  64 kbps
&gt;2      byte&amp;0xF0       0x50           \b,  80 kbps
&gt;2      byte&amp;0xF0       0x60           \b,  96 kbps
&gt;2      byte&amp;0xF0       0x70           \b, 112 kbps
&gt;2      byte&amp;0xF0       0x80           \b, 128 kbps
&gt;2      byte&amp;0xF0       0x90           \b, 144 kbps
&gt;2      byte&amp;0xF0       0xA0           \b, 160 kbps
&gt;2      byte&amp;0xF0       0xB0           \b, 176 kbps
&gt;2      byte&amp;0xF0       0xC0           \b, 192 kbps
&gt;2      byte&amp;0xF0       0xD0           \b, 224 kbps
&gt;2      byte&amp;0xF0       0xE0           \b, 256 kbps
# timing
&gt;2      byte&amp;0x0C       0x00           \b, 22.05 kHz
&gt;2      byte&amp;0x0C       0x04           \b, 24 kHz
&gt;2      byte&amp;0x0C       0x08           \b, 16 kHz
# channels/options
&gt;3      byte&amp;0xC0       0x00           \b, Stereo
&gt;3      byte&amp;0xC0       0x40           \b, JntStereo
&gt;3      byte&amp;0xC0       0x80           \b, 2x Monaural
&gt;3      byte&amp;0xC0       0xC0           \b, Monaural
#&gt;1     byte            ^0x01          \b, Data Verify
#&gt;2     byte            &amp;0x02          \b, Packet Pad
#&gt;2     byte            &amp;0x01          \b, Custom Flag
#&gt;3     byte            &amp;0x08          \b, Copyrighted
#&gt;3     byte            &amp;0x04          \b, Original Source
#&gt;3     byte&amp;0x03       1              \b, NR: 50/15 ms
#&gt;3     byte&amp;0x03       3              \b, NR: CCIT J.17

# MP3, M25A
0       beshort&amp;0xFFFE  0xFFE2         MPEG ADTS, layer III,  v2.5
!:mime	audio/mpeg
# rate
&gt;2      byte&amp;0xF0       0x10           \b,   8 kbps
&gt;2      byte&amp;0xF0       0x20           \b,  16 kbps
&gt;2      byte&amp;0xF0       0x30           \b,  24 kbps
&gt;2      byte&amp;0xF0       0x40           \b,  32 kbps
&gt;2      byte&amp;0xF0       0x50           \b,  40 kbps
&gt;2      byte&amp;0xF0       0x60           \b,  48 kbps
&gt;2      byte&amp;0xF0       0x70           \b,  56 kbps
&gt;2      byte&amp;0xF0       0x80           \b,  64 kbps
&gt;2      byte&amp;0xF0       0x90           \b,  80 kbps
&gt;2      byte&amp;0xF0       0xA0           \b,  96 kbps
&gt;2      byte&amp;0xF0       0xB0           \b, 112 kbps
&gt;2      byte&amp;0xF0       0xC0           \b, 128 kbps
&gt;2      byte&amp;0xF0       0xD0           \b, 144 kbps
&gt;2      byte&amp;0xF0       0xE0           \b, 160 kbps
# timing
&gt;2      byte&amp;0x0C       0x00           \b, 11.025 kHz
&gt;2      byte&amp;0x0C       0x04           \b, 12 kHz
&gt;2      byte&amp;0x0C       0x08           \b, 8 kHz
# channels/options
&gt;3      byte&amp;0xC0       0x00           \b, Stereo
&gt;3      byte&amp;0xC0       0x40           \b, JntStereo
&gt;3      byte&amp;0xC0       0x80           \b, 2x Monaural
&gt;3      byte&amp;0xC0       0xC0           \b, Monaural
#&gt;1     byte            ^0x01          \b, Data Verify
#&gt;2     byte            &amp;0x02          \b, Packet Pad
#&gt;2     byte            &amp;0x01          \b, Custom Flag
#&gt;3     byte            &amp;0x08          \b, Copyrighted
#&gt;3     byte            &amp;0x04          \b, Original Source
#&gt;3     byte&amp;0x03       1              \b, NR: 50/15 ms
#&gt;3     byte&amp;0x03       3              \b, NR: CCIT J.17

# AAC (aka MPEG-2 NBC audio) and MPEG-4 audio

# Stored AAC streams (instead of the MP4 format)
0       string          ADIF           MPEG ADIF, AAC
!:mime	audio/x-hx-aac-adif
&gt;4      byte            &amp;0x80
&gt;&gt;13    byte            &amp;0x10          \b, VBR
&gt;&gt;13    byte            ^0x10          \b, CBR
&gt;&gt;16    byte&amp;0x1E       0x02           \b, single stream
&gt;&gt;16    byte&amp;0x1E       0x04           \b, 2 streams
&gt;&gt;16    byte&amp;0x1E       0x06           \b, 3 streams
&gt;&gt;16    byte            &amp;0x08          \b, 4 or more streams
&gt;&gt;16    byte            &amp;0x10          \b, 8 or more streams
&gt;&gt;4    byte            &amp;0x80          \b, Copyrighted
&gt;&gt;13   byte            &amp;0x40          \b, Original Source
&gt;&gt;13   byte            &amp;0x20          \b, Home Flag
&gt;4      byte            ^0x80
&gt;&gt;4     byte            &amp;0x10          \b, VBR
&gt;&gt;4     byte            ^0x10          \b, CBR
&gt;&gt;7     byte&amp;0x1E       0x02           \b, single stream
&gt;&gt;7     byte&amp;0x1E       0x04           \b, 2 streams
&gt;&gt;7     byte&amp;0x1E       0x06           \b, 3 streams
&gt;&gt;7     byte            &amp;0x08          \b, 4 or more streams
&gt;&gt;7     byte            &amp;0x10          \b, 8 or more streams
&gt;&gt;4    byte            &amp;0x40          \b, Original Stream(s)
&gt;&gt;4    byte            &amp;0x20          \b, Home Source

# Live or stored single AAC stream (used with MPEG-2 systems)
0       beshort&amp;0xFFF6  0xFFF0         MPEG ADTS, AAC
!:mime	audio/x-hx-aac-adts
&gt;1      byte            &amp;0x08          \b, v2
&gt;1      byte            ^0x08          \b, v4
# profile
&gt;&gt;2     byte            &amp;0xC0          \b LTP
&gt;2      byte&amp;0xc0       0x00           \b Main
&gt;2      byte&amp;0xc0       0x40           \b LC
&gt;2      byte&amp;0xc0       0x80           \b SSR
# timing
&gt;2      byte&amp;0x3c       0x00           \b, 96 kHz
&gt;2      byte&amp;0x3c       0x04           \b, 88.2 kHz
&gt;2      byte&amp;0x3c       0x08           \b, 64 kHz
&gt;2      byte&amp;0x3c       0x0c           \b, 48 kHz
&gt;2      byte&amp;0x3c       0x10           \b, 44.1 kHz
&gt;2      byte&amp;0x3c       0x14           \b, 32 kHz
&gt;2      byte&amp;0x3c       0x18           \b, 24 kHz
&gt;2      byte&amp;0x3c       0x1c           \b, 22.05 kHz
&gt;2      byte&amp;0x3c       0x20           \b, 16 kHz
&gt;2      byte&amp;0x3c       0x24           \b, 12 kHz
&gt;2      byte&amp;0x3c       0x28           \b, 11.025 kHz
&gt;2      byte&amp;0x3c       0x2c           \b, 8 kHz
# channels
&gt;2      beshort&amp;0x01c0  0x0040         \b, monaural
&gt;2      beshort&amp;0x01c0  0x0080         \b, stereo
&gt;2      beshort&amp;0x01c0  0x00c0         \b, stereo + center
&gt;2      beshort&amp;0x01c0  0x0100         \b, stereo+center+LFE
&gt;2      beshort&amp;0x01c0  0x0140         \b, surround
&gt;2      beshort&amp;0x01c0  0x0180         \b, surround + LFE
&gt;2      beshort         &amp;0x01C0        \b, surround + side
#&gt;1     byte            ^0x01           \b, Data Verify
#&gt;2     byte            &amp;0x02           \b, Custom Flag
#&gt;3     byte            &amp;0x20           \b, Original Stream
#&gt;3     byte            &amp;0x10           \b, Home Source
#&gt;3     byte            &amp;0x08           \b, Copyrighted

# Live MPEG-4 audio streams (instead of RTP FlexMux)
0       beshort&amp;0xFFE0  0x56E0         MPEG-4 LOAS
!:mime	audio/x-mp4a-latm
#&gt;1     beshort&amp;0x1FFF  x              \b, %hu byte packet
&gt;3      byte&amp;0xE0       0x40
&gt;&gt;4     byte&amp;0x3C       0x04           \b, single stream
&gt;&gt;4     byte&amp;0x3C       0x08           \b, 2 streams
&gt;&gt;4     byte&amp;0x3C       0x0C           \b, 3 streams
&gt;&gt;4     byte            &amp;0x08          \b, 4 or more streams
&gt;&gt;4     byte            &amp;0x20          \b, 8 or more streams
&gt;3      byte&amp;0xC0       0
&gt;&gt;4     byte&amp;0x78       0x08           \b, single stream
&gt;&gt;4     byte&amp;0x78       0x10           \b, 2 streams
&gt;&gt;4     byte&amp;0x78       0x18           \b, 3 streams
&gt;&gt;4     byte            &amp;0x20          \b, 4 or more streams
&gt;&gt;4     byte            &amp;0x40          \b, 8 or more streams
# This magic isn&#039;t strong enough (matches plausible ISO-8859-1 text)
#0       beshort         0x4DE1         MPEG-4 LO-EP audio stream
#!:mime	audio/x-mp4a-latm

# Summary: FLI animation format
# Created by: Daniel Quinlan &lt;quinlan@yggdrasil.com&gt;
# Modified by (1): Abel Cheung &lt;abelcheung@gmail.com&gt; (avoid over-generic detection)
4	leshort		0xAF11
# standard FLI always has 320x200 resolution and 8 bit color
&gt;8	leshort		320
&gt;&gt;10	leshort		200
&gt;&gt;&gt;12	leshort		8			FLI animation, 320x200x8
!:mime	video/x-fli
&gt;&gt;&gt;&gt;6	leshort		x			\b, %d frames
# frame speed is multiple of 1/70s
&gt;&gt;&gt;&gt;16	leshort		x			\b, %d/70s per frame

# Summary: FLC animation format
# Created by: Daniel Quinlan &lt;quinlan@yggdrasil.com&gt;
# Modified by (1): Abel Cheung &lt;abelcheung@gmail.com&gt; (avoid over-generic detection)
4	leshort		0xAF12
# standard FLC always use 8 bit color
&gt;12	leshort		8			FLC animation
!:mime	video/x-flc
&gt;&gt;8	leshort		x			\b, %d
&gt;&gt;10	leshort		x			\bx%dx8
&gt;&gt;6	uleshort	x			\b, %d frames
&gt;&gt;16	uleshort	x			\b, %dms per frame

# DL animation format
# XXX - collision with most `mips&#039; magic
#
# I couldn&#039;t find a real magic number for these, however, this
# -appears- to work.  Note that it might catch other files, too, so be
# careful!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR&#039;ed with
# 255 (hex FF)!  The DL format is really bad.
#
#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
#!:mime	video/x-unknown
#&gt;42	byte	x	- %d screens,
#&gt;43	byte	x	%d commands
#0	byte	2	DL version 2
#!:mime	video/x-unknown
#&gt;1	byte	1	- large format (320x200,1 image/screen),
#&gt;1	byte	2	- medium format (160x100,4 images/screen),
#&gt;1	byte	&gt;2	- unknown format,
#&gt;42	byte	x	%d screens,
#&gt;43	byte	x	%d commands
# Based on empirical evidence, DL version 3 have several nulls following the
# \003.  Most of them start with non-null values at hex offset 0x34 or so.
#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3

# iso 13818 transport stream
#
# from Oskar Schirmer &lt;schirmer@scara.com&gt; Feb 3, 2001 (ISO 13818.1)
# syncbyte      8 bit	0x47
# error_ind     1 bit	-
# payload_start 1 bit	1
# priority      1 bit	-
# PID          13 bit	0x0000
# scrambling    2 bit	-
# adaptfld_ctrl 2 bit	1 or 3
# conti_count   4 bit	-
0	belong&amp;0xFF5FFF10	0x47400010
&gt;188	byte			0x47		MPEG transport stream data

# DIF digital video file format &lt;mpruett@sgi.com&gt;
0	belong&amp;0xffffff00	0x1f070000      DIF
&gt;4	byte			&amp;0x01		(DVCPRO) movie file
&gt;4	byte			^0x01		(DV) movie file
&gt;3	byte			&amp;0x80		(PAL)
&gt;3	byte			^0x80		(NTSC)

# Microsoft Advanced Streaming Format (ASF) &lt;mpruett@sgi.com&gt;
0	belong			0x3026b275	Microsoft ASF
!:mime  video/x-ms-asf

# MNG Video Format, &lt;URL:http://www.libpng.org/pub/mng/spec/&gt;
0	string			\x8aMNG		MNG video data,
!:mime	video/x-mng
&gt;4	belong			!0x0d0a1a0a	CORRUPTED,
&gt;4	belong			0x0d0a1a0a
&gt;&gt;16    belong	x				%d x
&gt;&gt;20    belong	x				%d

# JNG Video Format, &lt;URL:http://www.libpng.org/pub/mng/spec/&gt;
0	string			\x8bJNG		JNG video data,
!:mime	video/x-jng
&gt;4	belong			!0x0d0a1a0a	CORRUPTED,
&gt;4	belong			0x0d0a1a0a
&gt;&gt;16    belong	x				%d x
&gt;&gt;20    belong	x				%d

# Vivo video (Wolfram Kleff)
3	string		\x0D\x0AVersion:Vivo	Vivo video data

# VRML (Virtual Reality Modelling Language)
0       string/w        #VRML\ V1.0\ ascii	VRML 1 file
!:mime	model/vrml
0	string/w	#VRML\ V2.0\ utf8	ISO/IEC 14772 VRML 97 file
!:mime	model/vrml

# X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
# From Michel Briand &lt;michelbriand@free.fr&gt;
# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml
# Example http://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
0	string/w	\&lt;?xml\ version=
!:strength + 5
&gt;20	search/1000/w	\&lt;!DOCTYPE\ X3D		X3D (Extensible 3D) model xml text
!:mime model/x3d+xml

#---------------------------------------------------------------------------
# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
# From Mark Sheppard &lt;msheppard@climax.co.uk&gt;, 2002-10-03
#
0	string		HVQM4		%s
&gt;6	string		&gt;\0		v%s
&gt;0	byte		x		GameCube movie,
&gt;0x34	ubeshort	x		%d x
&gt;0x36	ubeshort	x		%d,
&gt;0x26	ubeshort	x		%dus,
&gt;0x42	ubeshort	0		no audio
&gt;0x42	ubeshort	&gt;0		%dHz audio

# From: &quot;Stefan A. Haubenthal&quot; &lt;polluks@web.de&gt;
0	string		DVDVIDEO-VTS	Video title set,
&gt;0x21	byte		x		v%x
0	string		DVDVIDEO-VMG	Video manager,
&gt;0x21	byte		x		v%x

# From: Behan Webster &lt;behanw@websterwood.com&gt;
# NuppelVideo used by Mythtv (*.nuv)
# Note: there are two identical stanzas here differing only in the
# initial string matched. It used to be done with a regex, but we&#039;re
# trying to get rid of those.
0	string		NuppelVideo	MythTV NuppelVideo
&gt;12	string		x		v%s
&gt;20	lelong		x		(%d
&gt;24	lelong		x		\bx%d),
&gt;36	string		P		\bprogressive,
&gt;36	string		I		\binterlaced,
&gt;40	ledouble	x		\baspect:%.2f,
&gt;48	ledouble	x		\bfps:%.2f
0	string		MythTV		MythTV NuppelVideo
&gt;12	string		x		v%s
&gt;20	lelong		x		(%d
&gt;24	lelong		x		\bx%d),
&gt;36	string		P		\bprogressive,
&gt;36	string		I		\binterlaced,
&gt;40	ledouble	x		\baspect:%.2f,
&gt;48	ledouble	x		\bfps:%.2f

#						MPEG file
# MPEG sequences
# FIXME: This section is from the old magic.mime file and needs
# integrating with the rest
#0       belong             0x000001BA
#&gt;4      byte               &amp;0x40
#!:mime	video/mp2p
#&gt;4      byte               ^0x40
#!:mime	video/mpeg
#0       belong             0x000001BB
#!:mime	video/mpeg
#0       belong             0x000001B0
#!:mime	video/mp4v-es
#0       belong             0x000001B5
#!:mime	video/mp4v-es
#0       belong             0x000001B3
#!:mime	video/mpv
#0       belong&amp;0xFF5FFF10  0x47400010
#!:mime	video/mp2t
#0       belong             0x00000001
#&gt;4      byte&amp;0x1F	   0x07
#!:mime	video/h264

# Type: Bink Video
# Extension: .bik
# URL:  http://wiki.multimedia.cx/index.php?title=Bink_Container
# From: &lt;hoehle@users.sourceforge.net&gt;  2008-07-18
0	string		BIK	Bink Video
&gt;3	regex		=[a-z]	rev.%s
#&gt;4	ulelong		x	size %d
&gt;20	ulelong		x	\b, %d
&gt;24	ulelong		x	\bx%d
&gt;8	ulelong		x	\b, %d frames
&gt;32	ulelong		x	at rate %d/
&gt;28	ulelong		&gt;1	\b%d
&gt;40	ulelong		=0	\b, no audio
&gt;40	ulelong		!0	\b, %d audio track
&gt;&gt;40	ulelong		!1	\bs
# follow properties of the first audio track only
&gt;&gt;48	uleshort	x	%dHz
&gt;&gt;51	byte&amp;0x20	0	mono
&gt;&gt;51	byte&amp;0x20	!0	stereo
#&gt;&gt;51	byte&amp;0x10	0	FFT
#&gt;&gt;51	byte&amp;0x10	!0	DCT

# Type:	NUT Container
# URL:	http://wiki.multimedia.cx/index.php?title=NUT
# From:	Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
0	string	nut/multimedia\ container\0	NUT multimedia container

# Type: Nullsoft Video (NSV)
# URL:  http://wiki.multimedia.cx/index.php?title=Nullsoft_Video
# From: Mike Melanson &lt;mike@multimedia.cx&gt;
0	string	NSVf	Nullsoft Video

# Type: REDCode Video
# URL:  http://www.red.com/ ; http://wiki.multimedia.cx/index.php?title=REDCode
# From: Mike Melanson &lt;mike@multimedia.cx&gt;
4	string	RED1	REDCode Video

# Type: MTV Multimedia File
# URL:  http://wiki.multimedia.cx/index.php?title=MTV
# From: Mike Melanson &lt;mike@multimedia.cx&gt;
0	string	AMVS	MTV Multimedia File

# Type: ARMovie
# URL:  http://wiki.multimedia.cx/index.php?title=ARMovie
# From: Mike Melanson &lt;mike@multimedia.cx&gt;
0	string	ARMovie\012	ARMovie

# Type: Interplay MVE Movie
# URL:  http://wiki.multimedia.cx/index.php?title=Interplay_MVE
# From: Mike Melanson &lt;mike@multimedia.cx&gt;
0	string	Interplay\040MVE\040File\032	Interplay MVE Movie

# Type: Windows Television DVR File
# URL:  http://wiki.multimedia.cx/index.php?title=WTV
# From: Mike Melanson &lt;mike@mutlimedia.cx&gt;
# This takes the form of a Windows-style GUID
0	bequad	0xB7D800203749DA11
&gt;8	bequad	0xA64E0007E95EAD8D	Windows Television DVR Media

# Type: Sega FILM/CPK Multimedia
# URL:  http://wiki.multimedia.cx/index.php?title=Sega_FILM
# From: Mike Melanson &lt;mike@multimedia.cx&gt;
0	string	FILM	Sega FILM/CPK Multimedia,
&gt;32	belong	x	%d x
&gt;28	belong	x	%d

# Type: Nintendo THP Multimedia
# URL:  http://wiki.multimedia.cx/index.php?title=THP
# From: Mike Melanson &lt;mike@multimedia.cx&gt;
0	string	THP\0	Nintendo THP Multimedia

# Type: BBC Dirac Video
# URL:  http://wiki.multimedia.cx/index.php?title=Dirac
# From: Mike Melanson &lt;mike@multimedia.cx&gt;
0	string	BBCD	BBC Dirac Video

# Type: RAD Game Tools Smacker Multimedia
# URL:  http://wiki.multimedia.cx/index.php?title=Smacker
# From: Mike Melanson &lt;mike@multimedia.cx&gt;
0	string	SMK	RAD Game Tools Smacker Multimedia
&gt;3	byte	x	version %c,
&gt;4	lelong	x	%d x
&gt;8	lelong	x	%d,
&gt;12	lelong	x	%d frames

# Material Exchange Format
# More information:
# https://en.wikipedia.org/wiki/Material_Exchange_Format
# http://www.freemxf.org/
0	string	\x06\x0e\x2b\x34\x02\x05\x01\x01\x0d\x01\x02\x01\x01\x02	Material exchange container format
!:ext	mxf
!:mime	application/mxf

#------------------------------------------------------------------------------
# $File: aout,v 1.1 2013/01/09 22:37:23 christos Exp $
# aout:  file(1) magic for a.out executable/object/etc entries that
# handle executables on multiple platforms.
#

#
# Little-endian 32-bit-int a.out, merged from bsdi (for BSD/OS, from
# BSDI), netbsd, and vax (for UNIX/32V and BSD)
#
# XXX - is there anything we can look at to distinguish BSD/OS 386 from
# NetBSD 386 from various VAX binaries?  The BSD/OS shared library flag
# works only for binaries using shared libraries.  Grabbing the entry
# point from the a.out header, using it to find the first code executed
# in the program, and looking at that might help.
#
0	lelong		0407		a.out little-endian 32-bit executable
&gt;16	lelong		&gt;0		not stripped
&gt;32	byte		0x6a		(uses BSD/OS shared libs)

0	lelong		0410		a.out little-endian 32-bit pure executable
&gt;16	lelong		&gt;0		not stripped
&gt;32	byte		0x6a		(uses BSD/OS shared libs)

0	lelong		0413		a.out little-endian 32-bit demand paged pure executable
&gt;16	lelong		&gt;0		not stripped
&gt;32	byte		0x6a		(uses BSD/OS shared libs)

#
# Big-endian 32-bit-int a.out, merged from sun (for old 68010 SunOS a.out),
# mips (for old 68020(!) SGI a.out), and netbsd (for old big-endian a.out).
#
# XXX - is there anything we can look at to distinguish old SunOS 68010
# from old 68020 IRIX from old NetBSD?  Again, I guess we could look at
# the first instruction or instructions in the program.
#
0	belong		0407		a.out big-endian 32-bit executable
&gt;16	belong		&gt;0		not stripped

0	belong		0410		a.out big-endian 32-bit pure executable
&gt;16	belong		&gt;0		not stripped

0	belong		0413		a.out big-endian 32-bit demand paged executable
&gt;16	belong		&gt;0		not stripped


#------------------------------------------------------------------------------
# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
# apache: file(1) magic for Apache Big Data formats

# Avro files
0	string		Obj		Apache Avro
&gt;3	byte		x		version %d

# ORC files
# Important information is in file footer, which we can&#039;t index to :(
0	string		ORC		Apache ORC

# Parquet files
0	string		PAR1		Apache Parquet

# Hive RC files
0	string		RCF		Apache Hive RC file
&gt;3	byte		x		version %d

# Sequence files (and the careless first version of RC file)

0	string		SEQ
&gt;3	byte		&lt;6		Apache Hadoop Sequence file version %d
&gt;3	byte		&gt;6		Apache Hadoop Sequence file version %d
&gt;3	byte		=6
&gt;&gt;5	string		org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer  Apache Hive RC file version 0
&gt;&gt;3	default		x		Apache Hadoop Sequence file version 6

#------------------------------------------------------------------------------
# $File: apl,v 1.6 2009/09/19 16:28:07 christos Exp $
# apl:  file(1) magic for APL (see also &quot;pdp&quot; and &quot;vax&quot; for other APL
#       workspaces)
#
0	long		0100554		APL workspace (Ken&#039;s original?)

#------------------------------------------------------------------------------
# $File: apple,v 1.39 2018/03/02 15:26:39 christos Exp $
# apple:  file(1) magic for Apple file formats
#
0	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
0	string		\x0aGL			Binary II (apple ][) data
0	string		\x76\xff		Squeezed (apple ][) data
0	string		NuFile			NuFile archive (apple ][) data
0	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
0	belong		0x00051600		AppleSingle encoded Macintosh file
0	belong		0x00051607		AppleDouble encoded Macintosh file

# Type: Apple Emulator 2IMG format
# From: Radek Vokal &lt;rvokal@redhat.com&gt;
0	string		2IMG	Apple ][ 2IMG Disk Image
&gt;4	string		XGS!	\b, XGS
&gt;4	string		CTKG	\b, Catakig
&gt;4	string		ShIm	\b, Sheppy&#039;s ImageMaker
&gt;4	string		WOOF	\b, Sweet 16
&gt;4	string		B2TR	\b, Bernie ][ the Rescue
&gt;4	string		!nfc	\b, ASIMOV2
&gt;4	string		x	\b, Unknown Format
&gt;0xc	byte		00	\b, DOS 3.3 sector order
&gt;&gt;0x10	byte		00	\b, Volume 254
&gt;&gt;0x10	byte&amp;0x7f	x	\b, Volume %u
&gt;0xc	byte		01	\b, ProDOS sector order
&gt;&gt;0x14	short		x	\b, %u Blocks
&gt;0xc	byte		02	\b, NIB data

# magic for Newton PDA package formats
# from Ruda Moura &lt;ruda@helllabs.org&gt;
0	string	package0	Newton package, NOS 1.x,
&gt;12	belong	&amp;0x80000000	AutoRemove,
&gt;12	belong	&amp;0x40000000	CopyProtect,
&gt;12	belong	&amp;0x10000000	NoCompression,
&gt;12	belong	&amp;0x04000000	Relocation,
&gt;12	belong	&amp;0x02000000	UseFasterCompression,
&gt;16	belong	x		version %d

0	string	package1	Newton package, NOS 2.x,
&gt;12	belong	&amp;0x80000000	AutoRemove,
&gt;12	belong	&amp;0x40000000	CopyProtect,
&gt;12	belong	&amp;0x10000000	NoCompression,
&gt;12	belong	&amp;0x04000000	Relocation,
&gt;12	belong	&amp;0x02000000	UseFasterCompression,
&gt;16	belong	x		version %d

0	string	package4	Newton package,
&gt;8	byte	8		NOS 1.x,
&gt;8	byte	9		NOS 2.x,
&gt;12	belong	&amp;0x80000000	AutoRemove,
&gt;12	belong	&amp;0x40000000	CopyProtect,
&gt;12	belong	&amp;0x10000000	NoCompression,

# The following entries for the Apple II are for files that have
# been transferred as raw binary data from an Apple, without having
# been encapsulated by any of the above archivers.
#
# In general, Apple II formats are hard to identify because Apple DOS
# and especially Apple ProDOS have strong typing in the file system and
# therefore programmers never felt much need to include type information
# in the files themselves.
#
# Eric Fischer &lt;enf@pobox.com&gt;

# AppleWorks word processor:
# URL: https://en.wikipedia.org/wiki/AppleWorks
# Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
# Update: Joerg Jenderek
# NOTE:
# The &quot;O&quot; is really the magic number, but that&#039;s so common that it&#039;s
# necessary to check the tab stops that follow it to avoid false positives.
# and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
# the newer AppleWorks is from claris with extension CWK
4	string		O
# test for unused bits of zoom- , paginated-boolean bytes
&gt;84	ubequad		^0x00Fe00000000Fe00
# look for tabstop definitions &quot;=&quot; no tab, &quot;|&quot; no tab
# &quot;&lt;&quot; left tab,&quot;^&quot; center tab,&quot;&gt;&quot; right tab, &quot;.&quot; decimal tab,
# unofficial &quot;!&quot; other , &quot;\x8a&quot; other
# official only if SFMinVers is nonzero
&gt;&gt;5	regex/s	[=.&lt;&gt;|!^\x8a]{79}	AppleWorks Word Processor
# AppleWorks Word Processor File (Apple II)
# ./apple (version 5.25) labeled the entry as &quot;AppleWorks word processor data&quot;
# application/x-appleworks is mime type for claris version with cwk extension
!:mime	application/x-appleworks3
# http://home.earthlink.net/~hughhood/appleiiworksenvoy/
# (&#039;p&#039; + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type&#039;)
# $70 $1A $F8 $FF is this the apple type ?
#:apple pdosp��
!:ext awp
# minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
&gt;&gt;&gt;183	ubyte		30	3.0
&gt;&gt;&gt;183	ubyte		!30
&gt;&gt;&gt;&gt;183	ubyte		!0	0x%x
# usual tabstop start sequence &quot;=====&lt;&quot;
&gt;&gt;&gt;5	string		x	\b, tabstop ruler &quot;%6.6s&quot;
# tabstop ruler
#&gt;&gt;&gt;5	string		&gt;\0	\b, tabstops &quot;%-79s&quot;
# zoom switch
&gt;&gt;&gt;85	  byte&amp;0x01	&gt;0	\b, zoomed
# whether paginated
&gt;&gt;&gt;90	  byte&amp;0x01	&gt;0	\b, paginated
# contains any mail-merge commands
&gt;&gt;&gt;92	  byte&amp;0x01	&gt;0	\b, with mail merge
# left margin in 1/10 inches ( normally 0 or 10 )
&gt;&gt;&gt;91	ubyte		&gt;0
&gt;&gt;&gt;&gt;91	ubyte		x	\b, %d/10 inch left margin

# AppleWorks database:
#
# This isn&#039;t really a magic number, but it&#039;s the closest thing to one
# that I could find.  The 1 and 2 really mean &quot;order in which you defined
# categories&quot; and &quot;left to right, top to bottom,&quot; respectively; the D and R
# mean that the cursor should move either down or right when you press Return.

#30	string		\x01D	AppleWorks database data
#30	string		\x02D	AppleWorks database data
#30	string		\x01R	AppleWorks database data
#30	string		\x02R	AppleWorks database data

# AppleWorks spreadsheet:
#
# Likewise, this isn&#039;t really meant as a magic number.  The R or C means
# row- or column-order recalculation; the A or M means automatic or manual
# recalculation.

#131	string		RA	AppleWorks spreadsheet data
#131	string		RM	AppleWorks spreadsheet data
#131	string		CA	AppleWorks spreadsheet data
#131	string		CM	AppleWorks spreadsheet data

# Applesoft BASIC:
#
# This is incredibly sloppy, but will be true if the program was
# written at its usual memory location of 2048 and its first line
# number is less than 256.  Yuck.
# update by Joerg Jenderek at Feb 2013

# GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
#0       belong&amp;0xff00ff 0x80000 Applesoft BASIC program data
0	belong&amp;0x00ff00ff	0x00080000
# assuming that line number must be positive
&gt;2	leshort			&gt;0		Applesoft BASIC program data, first line number %d
#&gt;2     leshort         x       \b, first line number %d

# ORCA/EZ assembler:
#
# This will not identify ORCA/M source files, since those have
# some sort of date code instead of the two zero bytes at 6 and 7
# XXX Conflicts with ELF
#4       belong&amp;0xff00ffff       0x01000000      ORCA/EZ assembler source data
#&gt;5      byte                    x               \b, build number %d

# Broderbund Fantavision
#
# I don&#039;t know what these values really mean, but they seem to recur.
# Will they cause too many conflicts?

# Probably :-)
#2	belong&amp;0xFF00FF		0x040008	Fantavision movie data

# Some attempts at images.
#
# These are actually just bit-for-bit dumps of the frame buffer, so
# there&#039;s really no reasonably way to distinguish them except for their
# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
# or, occasionally, 8184.
#
# Nevertheless this will manage to catch a lot of images that happen
# to have a solid-colored line at the bottom of the screen.

# GRR: Magic too weak
#8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
#8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
#8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
#8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
#8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background

# Beagle Bros. Apple Mechanic fonts

0	belong&amp;0xFF00FFFF	0x6400D000	Apple Mechanic font

# Apple Universal Disk Image Format (UDIF) - dmg files.
# From Johan Gade.
# These entries are disabled for now until we fix the following issues.
#
# Note there might be some problems with the &quot;VAX COFF executable&quot;
# entry. Note this entry should be placed before the mac filesystem section,
# particularly the &quot;Apple Partition data&quot; entry.
#
# The intended meaning of these tests is, that the file is only of the
# specified type if both of the lines are correct - i.e. if the first
# line matches and the second doesn&#039;t then it is not of that type.
#
#0	long	0x7801730d
#&gt;4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
#
# Note that this entry is recognized correctly by the &quot;Apple Partition
# data&quot; entry - however since this entry is more specific - this
# information seems to be more useful.
#0	long	0x45520200
#&gt;0x410	string	disk\ image	UDIF read/write image (UDRW)

# From: Toby Peterson &lt;toby@apple.com&gt;
0	string	bplist00	Apple binary property list

# Apple binary property list (bplist)
#  Assumes version bytes are hex.
#  Provides content hints for version 0 files. Assumes that the root
#  object is the first object (true for CoreFoundation implementation).
# From: David Remahl &lt;dremahl@apple.com&gt;
0		string	bplist
&gt;6		byte	x	\bCoreFoundation binary property list data, version 0x%c
&gt;&gt;7		byte	x	\b%c
&gt;6		string		00		\b
&gt;&gt;8		byte&amp;0xF0	0x00	\b
&gt;&gt;&gt;8	byte&amp;0x0F	0x00	\b, root type: null
&gt;&gt;&gt;8	byte&amp;0x0F	0x08	\b, root type: false boolean
&gt;&gt;&gt;8	byte&amp;0x0F	0x09	\b, root type: true boolean
&gt;&gt;8		byte&amp;0xF0	0x10	\b, root type: integer
&gt;&gt;8		byte&amp;0xF0	0x20	\b, root type: real
&gt;&gt;8		byte&amp;0xF0	0x30	\b, root type: date
&gt;&gt;8		byte&amp;0xF0	0x40    \b, root type: data
&gt;&gt;8		byte&amp;0xF0	0x50	\b, root type: ascii string
&gt;&gt;8		byte&amp;0xF0	0x60	\b, root type: unicode string
&gt;&gt;8		byte&amp;0xF0	0x80	\b, root type: uid (CORRUPT)
&gt;&gt;8		byte&amp;0xF0	0xa0	\b, root type: array
&gt;&gt;8		byte&amp;0xF0	0xd0	\b, root type: dictionary

# Apple/NeXT typedstream data
#  Serialization format used by NeXT and Apple for various
#  purposes in YellowStep/Cocoa, including some nib files.
# From: David Remahl &lt;dremahl@apple.com&gt;
2		string		typedstream	NeXT/Apple typedstream data, big endian
&gt;0		byte		x		\b, version %d
&gt;0		byte		&lt;5		\b
&gt;&gt;13	byte		0x81	\b
&gt;&gt;&gt;14	ubeshort	x		\b, system %d
2		string		streamtyped NeXT/Apple typedstream data, little endian
&gt;0		byte		x		\b, version %d
&gt;0		byte		&lt;5		\b
&gt;&gt;13	byte		0x81	\b
&gt;&gt;&gt;14	uleshort	x		\b, system %d

#------------------------------------------------------------------------------
# CAF: Apple CoreAudio File Format
#
# Container format for high-end audio purposes.
# From: David Remahl &lt;dremahl@apple.com&gt;
#
0	string		caff		CoreAudio Format audio file
&gt;4	beshort		&lt;10		version %d
&gt;6	beshort		x


#------------------------------------------------------------------------------
# Keychain database files
0	string		kych		Mac OS X Keychain File

#------------------------------------------------------------------------------
# Code Signing related file types
0	belong		0xfade0c00	Mac OS X Code Requirement
&gt;8	belong		1			(opExpr)
&gt;4	belong		x			- %d bytes

0	belong		0xfade0c01	Mac OS X Code Requirement Set
&gt;8	belong		&gt;1			containing %d items
&gt;4	belong		x			- %d bytes

0	belong		0xfade0c02	Mac OS X Code Directory
&gt;8	belong		x			version %x
&gt;12	belong		&gt;0			flags 0x%x
&gt;4	belong		x			- %d bytes

0	belong		0xfade0cc0	Mac OS X Detached Code Signature (non-executable)
&gt;4	belong		x			- %d bytes

0	belong		0xfade0cc1	Mac OS X Detached Code Signature
&gt;8	belong		&gt;1			(%d elements)
&gt;4	belong		x			- %d bytes

# From: &quot;Nelson A. de Oliveira&quot; &lt;naoliv@gmail.com&gt;
# .vdi
4	string innotek\ VirtualBox\ Disk\ Image %s

# Apple disk partition stuff
# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
# Update: Joerg Jenderek
# &quot;ER&quot; is APPLE_DRVR_MAP_MAGIC signature
0	beshort	0x4552
# display Apple Driver Map (strength=50) after Syslinux bootloader (71)
#!:strength +0
# strengthen the magic by looking for used blocksizes 512 2048
&gt;2	ubeshort&amp;0xf1FF		0	Apple Driver Map
# last 6 bytes for padding found are 0 or end with 55AAh marker for MBR hybrid
#&gt;&gt;504	ubequad&amp;0x0000FFffFFff0000	0
!:mime	application/x-apple-diskimage
!:apple	????devr
# https://en.wikipedia.org/wiki/Apple_Disk_Image
!:ext	dmg/iso
# sbBlkSize for driver descriptor map 512 2048
&gt;&gt;2	beshort	x			\b, blocksize %d
# sbBlkCount sometimes garbish like
# 0xb0200000 for unzlibed install_flash_player_19.0.0.245_osx.dmg
# 0xf2720100 for bunziped Firefox 48.0-2.dmg
# 0xeb02ffff for super_grub2_disk_hybrid_2.02s3.iso
# 0x00009090 by syslinux-6.03/utils/isohybrid.c
&gt;&gt;4	ubelong	x			\b, blockcount %u
# following device/driver information not very useful
# device type 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
&gt;&gt;8	ubeshort	x		\b, devtype %u
# device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
&gt;&gt;10	ubeshort	x		\b, devid %u
# driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
&gt;&gt;12	ubelong		&gt;0
&gt;&gt;&gt;12	ubelong		x		\b, driver data %u
# number of driver descriptors sbDrvrCount &lt;= 61
# (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
&gt;&gt;16	ubeshort	x		\b, driver count %u
# 61 * apple_drvr_descriptor[8]. information not very useful or same as in partition map
# &gt;&gt;18	use		apple-driver-map
# &gt;&gt;26	use		apple-driver-map
# # ...
# &gt;&gt;500	use		apple-driver-map
# number of partitions is always same in every partition (map block count)
#&gt;&gt;0x0204	ubelong		x	\b, %u partitions
&gt;&gt;0x0204	ubelong		&gt;0	\b, contains[@0x200]:
&gt;&gt;&gt;0x0200	use		apple-apm
&gt;&gt;0x0204	ubelong		&gt;1	\b, contains[@0x400]:
&gt;&gt;&gt;0x0400	use		apple-apm
&gt;&gt;0x0204	ubelong		&gt;2	\b, contains[@0x600]:
&gt;&gt;&gt;0x0600	use		apple-apm
&gt;&gt;0x0204	ubelong		&gt;3	\b, contains[@0x800]:
&gt;&gt;&gt;0x0800	use		apple-apm
&gt;&gt;0x0204	ubelong		&gt;4	\b, contains[@0xA00]:
&gt;&gt;&gt;0x0A00	use		apple-apm
&gt;&gt;0x0204	ubelong		&gt;5	\b, contains[@0xC00]:
&gt;&gt;&gt;0x0C00	use		apple-apm
&gt;&gt;0x0204	ubelong		&gt;6	\b, contains[@0xE00]:
&gt;&gt;&gt;0x0E00	use		apple-apm
&gt;&gt;0x0204	ubelong		&gt;7	\b, contains[@0x1000]:
&gt;&gt;&gt;0x1000	use		apple-apm
#	display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
0	name				apple-driver-map
&gt;0	ubequad		!0
# descBlock first block of driver
&gt;&gt;0	ubelong	x			\b, driver start block %u
# descSize driver size in blocks
&gt;&gt;4	ubeshort	x		\b, size %u
# descType driver system type 1 701h F8FFh FFFFh
&gt;&gt;6	ubeshort	x		\b, type 0x%x

# URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
# Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
# Update: Joerg Jenderek
# Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
# magic stronger.
# for apple partition map stored as a single file
0	belong	0x504d0000
# to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
#!:strength +0
&gt;0	use		apple-apm
# magic/Magdir/apple14.test, 365: Warning: Current entry does not yet have a description for adding a EXTENSION type
# file: could not find any valid magic files!
#!:ext	bin
#	display apple partition map. Normally called after Apple driver map
0	name				apple-apm
&gt;0	belong	0x504d0000		Apple Partition Map
# number of partitions
&gt;&gt;4	ubelong	x			\b, map block count %u
# logical block (512 bytes) start of partition
&gt;&gt;8	ubelong	x			\b, start block %u
&gt;&gt;12	ubelong	x			\b, block count %u
&gt;&gt;16	string &gt;0			\b, name %s
&gt;&gt;48	string &gt;0			\b, type %s
# processor type dpme_process_id[16] e.g. &quot;68000&quot; &quot;68020&quot;
&gt;&gt;120	string &gt;0			\b, processor %s
# A/UX boot arguments BootArgs[128]
&gt;&gt;136	string &gt;0			\b, boot arguments %s
# status of partition dpme_flags
&gt;&gt;88	belong	&amp; 1			\b, valid
&gt;&gt;88	belong	&amp; 2			\b, allocated
&gt;&gt;88	belong	&amp; 4			\b, in use
&gt;&gt;88	belong	&amp; 8			\b, has boot info
&gt;&gt;88	belong	&amp; 16			\b, readable
&gt;&gt;88	belong	&amp; 32			\b, writable
&gt;&gt;88	belong	&amp; 64			\b, pic boot code
&gt;&gt;88	belong	&amp; 128			\b, chain compatible driver
&gt;&gt;88	belong	&amp; 256			\b, real driver
&gt;&gt;88	belong	&amp; 512			\b, chain driver
# mount automatically at startup APPLE_PS_AUTO_MOUNT
&gt;&gt;88	ubelong	&amp;0x40000000		\b, mount at startup
# is the startup partition APPLE_PS_STARTUP
&gt;&gt;88	ubelong	&amp;0x80000000		\b, is the startup partition

#http://wiki.mozilla.org/DS_Store_File_Format
#http://en.wikipedia.org/wiki/.DS_Store
0	string	\0\0\0\1Bud1\0		Apple Desktop Services Store

# HFS/HFS+ Resource fork files (andrew.roazen@nau.edu Apr 13 2015)
# Usually not in separate files, but have either filename rsrc with
# no extension, or a filename corresponding to another file, with
# extensions rsr/rsrc
0	string  \000\000\001\000
&gt;4	leshort 0
&gt;&gt;16	lelong  0			Apple HFS/HFS+ resource fork

#https://en.wikipedia.org/wiki/AppleScript
0	string	FasdUAS			AppleScript compiled

# AppleWorks/ClarisWorks
# https://github.com/joshenders/appleworks_format
# http://fileformats.archiveteam.org/wiki/AppleWorks
0	name			appleworks
&gt;0	belong&amp;0x00ffffff	0x07e100	AppleWorks CWK Document
&gt;0	belong&amp;0x00ffffff	0x008803	ClarisWorks CWK Document
&gt;0	default			x
&gt;&gt;0	belong			x		AppleWorks/ClarisWorks CWK Document
&gt;0	byte			x		\b, version %d
&gt;30	beshort			x		\b, %d
&gt;32	beshort			x		\bx%d
!:ext cwk

4	string	BOBO
&gt;0	byte	&gt;4
&gt;&gt;12	belong	0
&gt;&gt;&gt;26	belong	0
&gt;&gt;&gt;&gt;0	use	appleworks
&gt;0	belong	0x0481ad00
&gt;&gt;0	use 	appleworks

# magic for Apple File System (APFS)
# from Alex Myczko &lt;alex@aiei.ch&gt;
32		string	NXSB		Apple File System (APFS)
&gt;36		ulelong	x		\b, blocksize %u

# iTunes cover art (versions 1 and 2)
4		string	itch
&gt;24		string	artw
&gt;&gt;0x1e8		string	data		iTunes cover art
&gt;&gt;&gt;0x1ed	string	PNG		(PNG)
&gt;&gt;&gt;0x1ec	beshort 0xffd8		(JPEG)

# MacPaint image
65		string	PNTGMPNT	MacPaint image data
#0		belong	2		MacPaint image data

#------------------------------------------------------------------------------
# $File: application,v 1.1 2016/10/17 12:13:01 christos Exp $
# application:  file(1) magic for applications on small devices
#
# Pebble Application
0	string	PBLAPP\000\000	Pebble application

#------------------------------------------------------------------------------
# $File: applix,v 1.5 2009/09/19 16:28:08 christos Exp $
# applix:  file(1) magic for Applixware
# From: Peter Soos &lt;sp@osb.hu&gt;
#
0	string		*BEGIN		Applixware
&gt;7	string		WORDS			Words Document
&gt;7	string		GRAPHICS		Graphic
&gt;7	string		RASTER			Bitmap
&gt;7	string		SPREADSHEETS		Spreadsheet
&gt;7	string		MACRO			Macro
&gt;7	string		BUILDER			Builder Object

#------------------------------------------------------------------------------
# $File: apt,v 1.1 2016/10/17 19:51:57 christos Exp $
# apt: file(1) magic for APT Cache files
# &lt;http://www.fifi.org/doc/libapt-pkg-doc/cache.html/ch2.html&gt;
# &lt;https://anonscm.debian.org/cgit/apt/apt.git/tree/apt-pkg/pkgcache.h#n292&gt;

# before version 10 (&quot;old format&quot;), data was in arch-specific long/short

# old format 64 bit
0   	name		apt-cache-64bit-be
&gt;12	beshort		1		\b, dirty
&gt;40 	bequad		x		\b, %llu packages
&gt;48 	bequad		x		\b, %llu versions

# old format 32 bit
0   	name    	apt-cache-32bit-be
&gt;8  	beshort 	1		\b, dirty
&gt;40 	belong  	x		\b, %u packages
&gt;44 	belong  	x		\b, %u versions

# new format
0	name		apt-cache-be
&gt;6	byte    	1		\b, dirty
&gt;24	belong  	x		\b, %u packages
&gt;28	belong		x		\b, %u versions

0	bequad		0x98FE76DC
&gt;8	ubeshort	&lt;10		APT cache data, version %u
&gt;&gt;10	beshort	    	x	  	\b.%u, 64 bit big-endian
&gt;&gt;0	use		apt-cache-64bit-be

0	lequad	    	0x98FE76DC
&gt;8	uleshort    	&lt;10		APT cache data, version %u
&gt;&gt;10	leshort		x		\b.%u, 64 bit little-endian
&gt;&gt;0	use		\^apt-cache-64bit-be

0	belong	    	0x98FE76DC
&gt;4	ubeshort    	&lt;10	 	APT cache data, version %u
&gt;&gt;6	ubeshort    	x		\b.%u, 32 bit big-endian
&gt;&gt;0	use  		apt-cache-32bit-be
&gt;4	ubyte	    	&gt;9		APT cache data, version %u
&gt;&gt;5	ubyte	    	x		\b.%u, big-endian
&gt;&gt;0	use 		apt-cache-be

0	lelong	    	0x98FE76DC
&gt;4	uleshort    	&lt;10		APT cache data, version %u
&gt;&gt;6	uleshort   	x		\b.%u, 32 bit little-endian
&gt;&gt;0	use 		\^apt-cache-32bit-be
&gt;4	ubyte	    	&gt;9		APT cache data, version %u
&gt;&gt;5	ubyte	    	x		\b.%u, little-endian
&gt;&gt;0	use		\^apt-cache-be
#------------------------------------------------------------------------------
# $File: archive,v 1.117 2018/03/17 02:11:04 christos Exp $
# archive:  file(1) magic for archive formats (see also &quot;msdos&quot; for self-
#           extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX &quot;tar&quot; archives are also handled in the C code ../../src/is_tar.c.

# POSIX tar archives
# URL: https://en.wikipedia.org/wiki/Tar_(computing)
# Reference: https://www.freebsd.org/cgi/man.cgi?query=tar&amp;sektion=5&amp;manpath=FreeBSD+8-current
# header mainly padded with nul bytes
500	quad		0		
# filename or extended attribute printable strings in range space null til umlaut ue
&gt;0	ubeshort	&gt;0x1F00		
&gt;&gt;0	ubeshort	&lt;0xFCFD
# last 4 header bytes often null but tar\0 in gtarfail2.tar gtarfail.tar-bad
# at https://sourceforge.net/projects/s-tar/files/testscripts/
&gt;&gt;&gt;508	ubelong&amp;0x8B9E8DFF	0	
# nul, space or ascii digit 0-7 at start of mode
&gt;&gt;&gt;&gt;100	ubyte&amp;0xC8	=0		
&gt;&gt;&gt;&gt;&gt;101 ubyte&amp;0xC8	=0		
# nul, space at end of check sum
&gt;&gt;&gt;&gt;&gt;&gt;155 ubyte&amp;0xDF	=0	
# space or ascii digit 0 at start of check sum
&gt;&gt;&gt;&gt;&gt;&gt;&gt;148	ubyte&amp;0xEF	=0x20	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	use	tar-file
#	minimal check and then display tar archive information which can also be
#	embedded inside others like Android Backup, Clam AntiVirus database
0	name		tar-file
&gt;257	string		!ustar		
# header padded with nuls
&gt;&gt;257	ulong		=0		
# GNU tar version 1.29 with non pax format option without refusing
# creates misleading V7 header for Long path, Multi-volume, Volume type
&gt;&gt;&gt;156	ubyte		0x4c		GNU tar archive
!:mime	application/x-gtar
!:ext	tar/gtar
&gt;&gt;&gt;156	ubyte		0x4d		GNU tar archive
!:mime	application/x-gtar
!:ext	tar/gtar
&gt;&gt;&gt;156	ubyte		0x56		GNU tar archive
!:mime	application/x-gtar
!:ext	tar/gtar
&gt;&gt;&gt;156	default		x		tar archive (V7)
!:mime	application/x-tar
!:ext	tar
# other stuff in padding
# some implementations add new fields to the blank area at the end of the header record
# created for example by DOS TAR 3.20g 1994 Tim V.Shapore with -j option
&gt;&gt;257	ulong		!0		tar archive (old)
!:mime	application/x-tar
!:ext	tar
# magic in newer, GNU, posix variants
&gt;257	string		=ustar		
# 2 last char of magic and UStar version because string expression does not work
# 2 space characters followed by a null for GNU variant
&gt;&gt;261	ubelong		=0x72202000	POSIX tar archive (GNU)
!:mime	application/x-gtar
!:ext	tar/gtar
# UStar version with ASCII &quot;00&quot;
&gt;&gt;261	ubelong		0x72003030	POSIX
# gLOBAL and ExTENSION type only found in POSIX.1-2001 format
&gt;&gt;&gt;156	ubyte		0x67		\b.1-2001
&gt;&gt;&gt;156	ubyte		0x78		\b.1-2001
&gt;&gt;&gt;156	ubyte		x		tar archive
!:mime	application/x-ustar
!:ext	tar/ustar
# version with 2 binary nuls embedded in Android Backup like com.android.settings.ab
&gt;&gt;261	ubelong		0x72000000	tar archive (ustar)
!:mime	application/x-ustar
!:ext	tar/ustar
# not seen ustar variant with garbish version
&gt;&gt;261	default		x		tar archive (unknown ustar)
!:mime	application/x-ustar
!:ext	tar/ustar
# type flag of 1st tar archive member
#&gt;156	ubyte		x		\b, %c-type
&gt;156	ubyte		x		
&gt;&gt;156	ubyte		0		\b, file
&gt;&gt;156	ubyte		0x30		\b, file
&gt;&gt;156	ubyte		0x31		\b, hard link
&gt;&gt;156	ubyte		0x32		\b, symlink
&gt;&gt;156	ubyte		0x33		\b, char device
&gt;&gt;156	ubyte		0x34		\b, block device
&gt;&gt;156	ubyte		0x35		\b, directory
&gt;&gt;156	ubyte		0x36		\b, fifo
&gt;&gt;156	ubyte		0x37		\b, reserved
&gt;&gt;156	ubyte		0x4c		\b, long path
&gt;&gt;156	ubyte		0x4d		\b, multi volume
&gt;&gt;156	ubyte		0x56		\b, volume
&gt;&gt;156	ubyte		0x67		\b, global
&gt;&gt;156	ubyte		0x78		\b, extension
&gt;&gt;156	default		x		\b, type
&gt;&gt;&gt;156	ubyte		x		&#039;%c&#039;
# name[100]
&gt;0	string		&gt;\0		%-.60s
# mode mainly stored as an octal number in ASCII null or space terminated
&gt;100	string		&gt;\0		\b, mode %-.7s
# user id mainly as octal numbers in ASCII null or space terminated
&gt;108	string		&gt;\0		\b, uid %-.7s
# group id mainly as octal numbers in ASCII null or space terminated
&gt;116	string		&gt;\0		\b, gid %-.7s
# size mainly as octal number in ASCII
&gt;124	ubyte		&lt;0x38		
&gt;&gt;124	string		&gt;\0		\b, size %-.12s
# coding indicated by setting the high-order bit of the leftmost byte
&gt;124	ubyte		&gt;0xEF		\b, size 0x
&gt;&gt;124	ubyte		!0xff		\b%2.2x
&gt;&gt;125	ubyte		!0xff		\b%2.2x
&gt;&gt;126	ubyte		!0xff		\b%2.2x
&gt;&gt;127	ubyte		!0xff		\b%2.2x
&gt;&gt;128	ubyte		!0xff		\b%2.2x
&gt;&gt;129	ubyte		!0xff		\b%2.2x
&gt;&gt;130	ubyte		!0xff		\b%2.2x
&gt;&gt;131	ubyte		!0xff		\b%2.2x
&gt;&gt;132	ubyte		!0xff		\b%2.2x
&gt;&gt;133	ubyte		!0xff		\b%2.2x
&gt;&gt;134	ubyte		!0xff		\b%2.2x
&gt;&gt;135	ubyte		!0xff		\b%2.2x
# seconds since 0:0:0 1 jan 1970 UTC as octal number mainly in ASCII null or space terminated
&gt;136	string		&gt;\0		\b, seconds %-.11s
# header checksum stored as an octal number in ASCII null or space terminated
#&gt;148	string		x		\b, cksum %.7s
# linkname[100]
&gt;157	string		&gt;\0		\b, linkname %-.40s
# additional fields for ustar
&gt;257	string		=ustar		
# owner user name null terminated
&gt;&gt;265	string		&gt;\0		\b, user %-.32s
# group name null terminated
&gt;&gt;297	string		&gt;\0		\b, group %-.32s
# device major minor if not zero
&gt;&gt;329	ubequad&amp;0xCFCFCFCFcFcFcFdf	!0
&gt;&gt;&gt;329	string		x		\b, devmaj %-.7s
&gt;&gt;337	ubequad&amp;0xCFCFCFCFcFcFcFdf	!0
&gt;&gt;&gt;337	string		x		\b, devmin %-.7s
# prefix[155]
&gt;&gt;345	string		&gt;\0		\b, prefix %-.155s
# old non ustar/POSIX tar
&gt;257	string		!ustar		
&gt;&gt;508	string		=tar\0		
# padding[255] in old star
&gt;&gt;&gt;257	string		&gt;\0		\b, padding: %-.40s
&gt;&gt;508	default		x		
# padding[255] in old tar sometimes comment field
&gt;&gt;&gt;257	string		&gt;\0		\b, comment: %-.40s

# Incremental snapshot gnu-tar format from:
# http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
0	string		GNU\ tar-	GNU tar incremental snapshot data
&gt;&amp;0	regex		[0-9]\.[0-9]+-[0-9]+	version %s

# cpio archives
#
# Yes, the top two &quot;cpio archive&quot; formats *are* supposed to just be &quot;short&quot;.
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running &quot;file&quot; with &quot;cpio archive&quot;, and
# to indicate archives produced on machines with the opposite byte order
# from the machine running &quot;file&quot; with &quot;byte-swapped cpio archive&quot;.
#
# The SVR4 &quot;cpio(4)&quot; hints that there are additional formats, but they
# are defined as &quot;short&quot;s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0	short		070707		cpio archive
!:mime	application/x-cpio
0	short		0143561		byte-swapped cpio archive
!:mime	application/x-cpio # encoding: swapped
0	string		070707		ASCII cpio archive (pre-SVR4 or odc)
0	string		070701		ASCII cpio archive (SVR4 with no CRC)
0	string		070702		ASCII cpio archive (SVR4 with CRC)

#
# Various archive formats used by various versions of the &quot;ar&quot;
# command.
#

#
# Original UNIX archive formats.
# They were written with binary values in host byte order, and
# the magic number was a host &quot;int&quot;, which might have been 16 bits
# or 32 bits.  We don&#039;t say &quot;PDP-11&quot; or &quot;VAX&quot;, as there might have
# been ports to little-endian 16-bit-int or 32-bit-int platforms
# (x86?) using some of those formats; if none existed, feel free
# to use &quot;PDP-11&quot; for little-endian 16-bit and &quot;VAX&quot; for little-endian
# 32-bit.  There might have been big-endian ports of that sort as
# well.
#
0	leshort		0177555		very old 16-bit-int little-endian archive
0	beshort		0177555		very old 16-bit-int big-endian archive
0	lelong		0177555		very old 32-bit-int little-endian archive
0	belong		0177555		very old 32-bit-int big-endian archive

0	leshort		0177545		old 16-bit-int little-endian archive
&gt;2	string		__.SYMDEF	random library
0	beshort		0177545		old 16-bit-int big-endian archive
&gt;2	string		__.SYMDEF	random library
0	lelong		0177545		old 32-bit-int little-endian archive
&gt;4	string		__.SYMDEF	random library
0	belong		0177545		old 32-bit-int big-endian archive
&gt;4	string		__.SYMDEF	random library

#
# From &quot;pdp&quot; (but why a 4-byte quantity?)
#
0	lelong		0x39bed		PDP-11 old archive
0	lelong		0x39bee		PDP-11 4.0 archive

#
# XXX - what flavor of APL used this, and was it a variant of
# some ar archive format?  It&#039;s similar to, but not the same
# as, the APL workspace magic numbers in pdp.
#
0	long		0100554		apl workspace

#
# System V Release 1 portable(?) archive format.
#
0	string		=&lt;ar&gt;		System V Release 1 ar archive
!:mime	application/x-archive

#
# Debian package; it&#039;s in the portable archive format, and needs to go
# before the entry for regular portable archives, as it&#039;s recognized as
# a portable archive whose first member has a name beginning with
# &quot;debian&quot;.
#
0	string		=!&lt;arch&gt;\ndebian
&gt;8	string		debian-split	part of multipart Debian package
!:mime	application/vnd.debian.binary-package
&gt;8	string		debian-binary	Debian binary package
!:mime	application/vnd.debian.binary-package
&gt;8	string		!debian
&gt;68	string		&gt;\0		(format %s)
# These next two lines do not work, because a bzip2 Debian archive
# still uses gzip for the control.tar (first in the archive).  Only
# data.tar varies, and the location of its filename varies too.
# file/libmagic does not current have support for ascii-string based
# (offsets) as of 2005-09-15.
#&gt;81	string		bz2		\b, uses bzip2 compression
#&gt;84	string		gz		\b, uses gzip compression
#&gt;136	ledate		x		created: %s

#
# MIPS archive; they&#039;re in the portable archive format, and need to go
# before the entry for regular portable archives, as it&#039;s recognized as
# a portable archive whose first member has a name beginning with
# &quot;__________E&quot;.
#
0	string	=!&lt;arch&gt;\n__________E	MIPS archive
!:mime	application/x-archive
&gt;20	string	U			with MIPS Ucode members
&gt;21	string	L			with MIPSEL members
&gt;21	string	B			with MIPSEB members
&gt;19	string	L			and an EL hash table
&gt;19	string	B			and an EB hash table
&gt;22	string	X			-- out of date

0	search/1	-h-		Software Tools format archive text

#
# BSD/SVR2-and-later portable archive formats.
#
0	string		=!&lt;arch&gt;		current ar archive
!:mime	application/x-archive
&gt;8	string		__.SYMDEF	random library
&gt;68	string		__.SYMDEF\ SORTED	random library

#
# &quot;Thin&quot; archive, as can be produced by GNU ar.
#
0	string		=!&lt;thin&gt;\n	thin archive with
&gt;68	belong		0		no symbol entries
&gt;68	belong		1		%d symbol entry
&gt;68	belong		&gt;1		%d symbol entries

# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated).  Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
0	lelong&amp;0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
!:mime	application/x-arc
0	lelong&amp;0x8080ffff	0x0000091a	ARC archive data, squashed
!:mime	application/x-arc
0	lelong&amp;0x8080ffff	0x0000021a	ARC archive data, uncompressed
!:mime	application/x-arc
0	lelong&amp;0x8080ffff	0x0000031a	ARC archive data, packed
!:mime	application/x-arc
0	lelong&amp;0x8080ffff	0x0000041a	ARC archive data, squeezed
!:mime	application/x-arc
0	lelong&amp;0x8080ffff	0x0000061a	ARC archive data, crunched
!:mime	application/x-arc
# [JW] stuff taken from idarc, obviously ARC successors:
0	lelong&amp;0x8080ffff	0x00000a1a	PAK archive data
!:mime	application/x-arc
0	lelong&amp;0x8080ffff	0x0000141a	ARC+ archive data
!:mime	application/x-arc
0	lelong&amp;0x8080ffff	0x0000481a	HYP archive data
!:mime	application/x-arc

# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can&#039;t create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR:  the original entries collide with ARC, above; replaced with combined
#  version (not tested)]
#0	byte		0x1a		RISC OS archive (spark format)
0	string		\032archive	RISC OS archive (ArcFS format)
0       string          Archive\000     RISC OS archive (ArcFS format)

# All these were taken from idarc, many could not be verified. Unfortunately,
# there were many low-quality sigs, i.e. easy to trigger false positives.
# Please notify me of any real-world fishy/ambiguous signatures and I&#039;ll try
# to get my hands on the actual archiver and see if I find something better. [JW]
# probably many can be enhanced by finding some 0-byte or control char near the start

# idarc calls this Crush/Uncompressed... *shrug*
0	string	CRUSH Crush archive data
# Squeeze It (.sqz)
0	string	HLSQZ Squeeze It archive data
# SQWEZ
0	string	SQWEZ SQWEZ archive data
# HPack (.hpk)
0	string	HPAK HPack archive data
# HAP
0	string	\x91\x33HF HAP archive data
# MD/MDCD
0	string	MDmd MDCD archive data
# LIM
0	string	LIM\x1a LIM archive data
# SAR
3	string	LH5 SAR archive data
# BSArc/BS2
0	string	\212\3SB\020\0	BSArc/BS2 archive data
# Bethesda Softworks Archive (Oblivion)
0	string	BSA\0 		BSArc archive data
&gt;4	lelong	x		version %d
# MAR
2	string	=-ah MAR archive data
# ACB
#0	belong&amp;0x00f800ff	0x00800000 ACB archive data
# CPZ
# TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data
# JRC
0	string	JRchive JRC archive data
# Quantum
0	string	DS\0 Quantum archive data
# ReSOF
0	string	PK\3\6 ReSOF archive data
# QuArk
0	string	7\4 QuArk archive data
# YAC
14	string	YC YAC archive data
# X1
0	string	X1 X1 archive data
0	string	XhDr X1 archive data
# CDC Codec (.dqt)
0	belong&amp;0xffffe000	0x76ff2000 CDC Codec archive data
# AMGC
0	string	\xad6&quot; AMGC archive data
# NuLIB
0	string	N\xc3\xb5F\xc3\xa9lx\xc3\xa5 NuLIB archive data
# PakLeo
0	string	LEOLZW PAKLeo archive data
# ChArc
0	string	SChF ChArc archive data
# PSA
0	string	PSA PSA archive data
# CrossePAC
0	string	DSIGDCC CrossePAC archive data
# Freeze
0	string	\x1f\x9f\x4a\x10\x0a Freeze archive data
# KBoom
0	string	\xc2\xa8MP\xc2\xa8 KBoom archive data
# NSQ, must go after CDC Codec
0	string	\x76\xff NSQ archive data
# DPA
0	string	Dirk\ Paehl DPA archive data
# BA
# TODO: idarc says &quot;bytes 0-2 == bytes 3-5&quot;
# TTComp
# URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
# Update: Joerg Jenderek
# GRR: line below is too general as it matches also Panorama database &quot;TCDB 2003-10 demo.pan&quot;, others
0	string	\0\6
# look for first keyword of Panorama database *.pan
&gt;12	search/261	DESIGN
# skip keyword with low entropy
&gt;12	default		x	TTComp archive, binary, 4K dictionary
# (version 5.25) labeled the above entry as &quot;TTComp archive data&quot;
# ESP, could this conflict with Easy Software Products&#039; (e.g.ESP ghostscript) documentation?
0	string	ESP ESP archive data
# ZPack
0	string	\1ZPK\1 ZPack archive data
# Sky
0	string	\xbc\x40 Sky archive data
# UFA
0	string	UFA UFA archive data
# Dry
0	string	=-H2O DRY archive data
# FoxSQZ
0	string	FOXSQZ FoxSQZ archive data
# AR7
0	string	,AR7 AR7 archive data
# PPMZ
0	string	PPMZ PPMZ archive data
# MS Compress
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/MS-DOS_installation_compression
# Reference: https://hwiegman.home.xs4all.nl/fileformats/compress/szdd_kwaj_format.html
# Note: use correct version of extracting tool like EXPAND, UNPACK, DECOMP or 7Z  
4	string	\x88\xf0\x27
#		KWAJ variant
&gt;0	string	KWAJ		MS Compress archive data, KWAJ variant
!:mime	application/x-ms-compress-kwaj
# extension not working in version 5.32
# magic/Magdir/archive, 284: Warning: EXTENSION type ` ??_&#039; has bad char &#039;?&#039;
# file: line 284: Bad magic entry &#039;   ??_&#039;
!:ext	??_
# compression method (0-4)
&gt;&gt;8	uleshort	x	\b, %u method
# offset of compressed data
&gt;&gt;10	uleshort	x	\b, 0x%x offset
#&gt;&gt;(10.s)	uleshort	x
#&gt;&gt;&gt;&amp;-6		string	x	\b, TEST extension %-.3s
# header flags to mark header extensions
&gt;&gt;12	uleshort	&gt;0	\b, 0x%x flags
# 4 bytes: decompressed length of file
&gt;&gt;12	uleshort	&amp;0x01
&gt;&gt;&gt;14	ulelong		x	\b, original size: %u bytes
# 2 bytes: unknown purpose
# 2 bytes: length of unknown data + mentioned bytes
# 1-9 bytes: null-terminated file name
# 1-4 bytes: null-terminated file extension
&gt;&gt;12	uleshort	&amp;0x08
&gt;&gt;&gt;12	uleshort				^0x01
&gt;&gt;&gt;&gt;12		uleshort			^0x02
&gt;&gt;&gt;&gt;&gt;12			uleshort		^0x04
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	^0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;14				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	&amp;0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;14				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1				string	x	\b.%-.3s
&gt;&gt;&gt;&gt;&gt;12			uleshort		&amp;0x04
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	^0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(14.s)			uleshort	x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;14				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	&amp;0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(14.s)			uleshort	x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;14				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1				string	x	\b.%-.3s
&gt;&gt;&gt;&gt;12		uleshort			&amp;0x02
&gt;&gt;&gt;&gt;&gt;12			uleshort		^0x04
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	^0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;16				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	&amp;0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;16				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1				string	x	\b.%-.3s
&gt;&gt;&gt;&gt;&gt;12			uleshort		&amp;0x04
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	^0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(16.s)			uleshort	x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;16				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	&amp;0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(16.s)			uleshort	x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;16				string	x	%-.8s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1				string	x	\b.%-.3s
&gt;&gt;&gt;12	uleshort				&amp;0x01
&gt;&gt;&gt;&gt;12		uleshort			^0x02
&gt;&gt;&gt;&gt;&gt;12			uleshort		^0x04
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	^0x10
&gt;&gt;&gt;&gt;&gt;&gt;&gt;18				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	&amp;0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;18				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1				string	x	\b.%-.3s
&gt;&gt;&gt;&gt;&gt;12			uleshort		&amp;0x04
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	^0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(18.s)			uleshort	x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;18				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	&amp;0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(18.s)			uleshort	x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;18				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1				string	x	\b.%-.3s
&gt;&gt;&gt;&gt;12		uleshort			&amp;0x02
&gt;&gt;&gt;&gt;&gt;12			uleshort		^0x04
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	^0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;20				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	&amp;0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;20				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1				string	x	\b.%-.3s
&gt;&gt;&gt;&gt;&gt;12			uleshort		&amp;0x04
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	^0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(20.s)			uleshort	x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;20				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;12			uleshort	&amp;0x10	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(20.s)			uleshort	x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;20				string	x	\b, %-.8s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1				string	x	\b.%-.3s
# 2 bytes: length of data + mentioned bytes
#
#		SZDD variant Haruhiko Okumura&#039;s LZSS or 7z type MsLZ
&gt;0	string	SZDD		MS Compress archive data, SZDD variant
!:mime	application/x-ms-compress-szdd
!:ext	??_
# The character missing from the end of the filename (0=unknown)
&gt;&gt;9	string	&gt;\0		\b, %-.1s is last character of original name
# https://www.betaarchive.com/forum/viewtopic.php?t=26161
# Compression mode: &quot;A&quot; (0x41) found but sometimes &quot;B&quot; in Windows 3.1 builds 026 and 034e
&gt;&gt;8	string	!A		\b, %-.1s method
&gt;&gt;10	ulelong	&gt;0		\b, original size: %u bytes
#		QBasic SZDD variant
3	string	\x88\xf0\x27
&gt;0	string	SZ\x20		MS Compress archive data, QBasic variant
!:mime	application/x-ms-compress-sz
!:ext	??$
&gt;&gt;8	ulelong	&gt;0		\b, original size: %u bytes

# MP3 (archiver, not lossy audio compression)
0	string	MP3\x1a MP3-Archiver archive data
# ZET
0	string	OZ\xc3\x9d ZET archive data
# TSComp
0	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
# ARQ
0	string	gW\4\1 ARQ archive data
# Squash
3	string	OctSqu Squash archive data
# Terse
0	string	\5\1\1\0 Terse archive data
# PUCrunch
0	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
# UHarc
0	string	UHA UHarc archive data
# ABComp
0	string	\2AB ABComp archive data
0	string	\3AB2 ABComp archive data
# CMP
0	string	CO\0 CMP archive data
# Splint
0	string	\x93\xb9\x06 Splint archive data
# InstallShield
0	string	\x13\x5d\x65\x8c InstallShield Z archive Data
# Gather
1	string	GTH Gather archive data
# BOA
0	string	BOA BOA archive data
# RAX
0	string	ULEB\xa RAX archive data
# Xtreme
0	string	ULEB\0 Xtreme archive data
# Pack Magic
0	string	@\xc3\xa2\1\0 Pack Magic archive data
# BTS
0	belong&amp;0xfeffffff	0x1a034465 BTS archive data
# ELI 5750
0	string	Ora\  ELI 5750 archive data
# QFC
0	string	\x1aFC\x1a QFC archive data
0	string	\x1aQF\x1a QFC archive data
# PRO-PACK
0	string	RNC PRO-PACK archive data
# 777
0	string	777 777 archive data
# LZS221
0	string	sTaC LZS221 archive data
# HPA
0	string	HPA HPA archive data
# Arhangel
0	string	LG Arhangel archive data
# EXP1, uses bzip2
0	string	0123456789012345BZh EXP1 archive data
# IMP
0	string	IMP\xa IMP archive data
# NRV
0	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data
# Squish
0	string	\x73\xb2\x90\xf4 Squish archive data
# Par
0	string	PHILIPP Par archive data
0	string	PAR Par archive data
# HIT
0	string	UB HIT archive data
# SBX
0	belong&amp;0xfffff000	0x53423000 SBX archive data
# NaShrink
0	string	NSK NaShrink archive data
# SAPCAR
0	string	#\ CAR\ archive\ header SAPCAR archive data
0	string	CAR\ 2.00RG SAPCAR archive data
# Disintegrator
0	string	DST Disintegrator archive data
# ASD
0	string	ASD ASD archive data
# InstallShield CAB
0	string	ISc( InstallShield CAB
# TOP4
0	string	T4\x1a TOP4 archive data
# BatComp left out: sig looks like COM executable
# so TODO: get real 4dos batcomp file and find sig
# BlakHole
0	string	BH\5\7 BlakHole archive data
# BIX
0	string	BIX0 BIX archive data
# ChiefLZA
0	string	ChfLZ ChiefLZA archive data
# Blink
0	string	Blink Blink archive data
# Logitech Compress
0	string	\xda\xfa Logitech Compress archive data
# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
1	string	(C)\ STEPANYUK ARS-Sfx archive data
# AKT/AKT32
0	string	AKT32 AKT32 archive data
0	string	AKT AKT archive data
# NPack
0	string	MSTSM NPack archive data
# PFT
0	string	\0\x50\0\x14 PFT archive data
# SemOne
0	string	SEM SemOne archive data
# PPMD
0	string	\x8f\xaf\xac\x84 PPMD archive data
# FIZ
0	string	FIZ FIZ archive data
# MSXiE
0	belong&amp;0xfffff0f0	0x4d530000 MSXiE archive data
# DeepFreezer
0	belong&amp;0xfffffff0	0x797a3030 DeepFreezer archive data
# DC
0	string	=&lt;DC- DC archive data
# TPac
0	string	\4TPAC\3 TPac archive data
# Ai
0	string	Ai\1\1\0 Ai archive data
0	string	Ai\1\0\0 Ai archive data
# Ai32
0	string	Ai\2\0 Ai32 archive data
0	string	Ai\2\1 Ai32 archive data
# SBC
0	string	SBC SBC archive data
# Ybs
0	string	YBS Ybs archive data
# DitPack
0	string	\x9e\0\0 DitPack archive data
# DMS
0	string	DMS! DMS archive data
# EPC
0	string	\x8f\xaf\xac\x8c EPC archive data
# VSARC
0	string	VS\x1a VSARC archive data
# PDZ
0	string	PDZ PDZ archive data
# ReDuq
0	string	rdqx ReDuq archive data
# GCA
0	string	GCAX GCA archive data
# PPMN
0	string	pN PPMN archive data
# WinImage
3	string	WINIMAGE WinImage archive data
# Compressia
0	string	CMP0CMP Compressia archive data
# UHBC
0	string	UHB UHBC archive data
# WinHKI
0	string	\x61\x5C\x04\x05 WinHKI archive data
# WWPack data file
0	string	WWP WWPack archive data
# BSN (BSA, PTS-DOS)
0	string	\xffBSG BSN archive data
1	string	\xffBSG BSN archive data
3	string	\xffBSG BSN archive data
1	string	\0\xae\2 BSN archive data
1	string	\0\xae\3 BSN archive data
1	string	\0\xae\7 BSN archive data
# AIN
0	string	\x33\x18 AIN archive data
0	string	\x33\x17 AIN archive data
# XPA32 test moved and merged with XPA by Joerg Jenderek at Sep 2015
# SZip (TODO: doesn&#039;t catch all versions)
0	string	SZ\x0a\4 SZip archive data
# XPack DiskImage
# *.XDI updated by Joerg Jenderek Sep 2015
# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
# GRR: this test is still too general as it catches also text files starting with jm
0	string	jm
# only found examples with this additional characteristic 2 bytes
&gt;2	string	\x2\x4	Xpack DiskImage archive data
#!:ext xdi
# XPack Data
# *.xpa updated by Joerg Jenderek Sep 2015
# ftp://ftp.elf.stuba.sk/pub/pc/pack/
0	string	xpa	XPA
!:ext	xpa
# XPA32
# ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
# created by XPA32.EXE version 1.0.2 for Windows
&gt;0	string	xpa\0\1 \b32 archive data
# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
&gt;3	ubeshort	!0x0001	\bck archive data
# XPack Single Data
# changed by Joerg Jenderek Sep 2015 back to like in version 5.12
# letter &#039;I&#039;+ acute accent is equivalent to \xcd
0	string	\xcd\ jm	Xpack single archive data
#!:mime	application/x-xpa-compressed
!:ext xpa

# TODO: missing due to unknown magic/magic at end of file:
#DWC
#ARG
#ZAR
#PC/3270
#InstallIt
#RKive
#RK
#XPack Diskimage

# These were inspired by idarc, but actually verified
# Dzip archiver (.dz)
# Update: Joerg Jenderek
# URL: http://speeddemosarchive.com/dzip/
# reference: http://speeddemosarchive.com/dzip/dz29src.zip/main.c 
# GRR: line below is too general as it matches also ASCII texts like Doszip commander help dz.txt
0	string	DZ 
# latest version is 2.9 dated 7 may 2003
&gt;2	byte	&lt;4 Dzip archive data
!:mime	application/x-dzip
!:ext	dz
&gt;&gt;2	byte	x \b, version %i
&gt;&gt;3	byte	x \b.%i
&gt;&gt;4	ulelong	x \b, offset 0x%x
&gt;&gt;8	ulelong	x \b, %u files
# ZZip archiver (.zz)
0	string	ZZ\ \0\0 ZZip archive data
0	string	ZZ0 ZZip archive data
# PAQ archiver (.paq)
0	string	\xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
0	string	PAQ PAQ archive data
&gt;3	byte&amp;0xf0	0x30
&gt;&gt;3	byte	x (v%c)
# JAR archiver (.j), this is the successor to ARJ, not Java&#039;s JAR (which is essentially ZIP)
0xe	string	\x1aJar\x1b JAR (ARJ Software, Inc.) archive data
0	string	JARCS JAR (ARJ Software, Inc.) archive data

# ARJ archiver (jason@jarthur.Claremont.EDU)
0	leshort		0xea60		ARJ archive data
!:mime	application/x-arj
&gt;5	byte		x		\b, v%d,
&gt;8	byte		&amp;0x04		multi-volume,
&gt;8	byte		&amp;0x10		slash-switched,
&gt;8	byte		&amp;0x20		backup,
&gt;34	string		x		original name: %s,
&gt;7	byte		0		os: MS-DOS
&gt;7	byte		1		os: PRIMOS
&gt;7	byte		2		os: Unix
&gt;7	byte		3		os: Amiga
&gt;7	byte		4		os: Macintosh
&gt;7	byte		5		os: OS/2
&gt;7	byte		6		os: Apple ][ GS
&gt;7	byte		7		os: Atari ST
&gt;7	byte		8		os: NeXT
&gt;7	byte		9		os: VAX/VMS
&gt;3	byte		&gt;0		%d]
# [JW] idarc says this is also possible
2	leshort		0xea60		ARJ archive data

# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0	string		HA		HA archive data,
#&gt;2	leshort		=1		1 file,
#&gt;2	leshort		&gt;1		%hu files,
#&gt;4	byte&amp;0x0f	=0		first is type CPY
#&gt;4	byte&amp;0x0f	=1		first is type ASC
#&gt;4	byte&amp;0x0f	=2		first is type HSC
#&gt;4	byte&amp;0x0f	=0x0e		first is type DIR
#&gt;4	byte&amp;0x0f	=0x0f		first is type SPECIAL
# suggestion: at least identify small archives (&lt;1024 files)
0  belong&amp;0xffff00fc 0x48410000 HA archive data
&gt;2	leshort		=1		1 file,
&gt;2	leshort		&gt;1		%u files,
&gt;4	byte&amp;0x0f	=0		first is type CPY
&gt;4	byte&amp;0x0f	=1		first is type ASC
&gt;4	byte&amp;0x0f	=2		first is type HSC
&gt;4	byte&amp;0x0f	=0x0e		first is type DIR
&gt;4	byte&amp;0x0f	=0x0f		first is type SPECIAL

# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0	string		HPAK		HPACK archive data

# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0	string		\351,\001JAM\ 		JAM archive,
&gt;7	string		&gt;\0			version %.4s
&gt;0x26	byte		=0x27			-
&gt;&gt;0x2b	string          &gt;\0			label %.11s,
&gt;&gt;0x27	lelong		x			serial %08x,
&gt;&gt;0x36	string		&gt;\0			fstype %.8s

# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
# Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
#
#	check and display information of lharc (LHa,PMarc) file
0	name				lharc-file
# check 1st character of method id like -lz4- -lh5- or -pm2-
&gt;2	string		-
# check 5th character of method id
&gt;&gt;6	string		-
# check header level 0 1 2 3
&gt;&gt;&gt;20	ubyte		&lt;4
# check 2nd, 3th and 4th character of method id
&gt;&gt;&gt;&gt;3	regex		\^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1)		\b 
!:mime	application/x-lzh-compressed
# creator type &quot;LHA &quot;
!:apple	????LHA
# display archive type name like &quot;LHa/LZS archive data&quot; or &quot;LArc archive&quot;
&gt;&gt;&gt;&gt;&gt;2	string		-lz		\b 
!:ext	lzs
# already known  -lzs- -lz4- -lz5- with old names
&gt;&gt;&gt;&gt;&gt;&gt;2	string	-lzs		LHa/LZS archive data
&gt;&gt;&gt;&gt;&gt;&gt;3	regex	\^lz[45]	LHarc 1.x archive data
# missing -lz?- with wikipedia names
&gt;&gt;&gt;&gt;&gt;&gt;3	regex	\^lz[2378]	LArc archive
# display archive type name like &quot;LHa (2.x) archive data&quot;
&gt;&gt;&gt;&gt;&gt;2	string		-lh		\b
# already known -lh0- -lh1- -lh2- -lh3-  -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
&gt;&gt;&gt;&gt;&gt;&gt;3	regex		\^lh[01]	LHarc 1.x/ARX archive data
# LHice archiver use &quot;.ICE&quot; as name extension instead usual one &quot;.lzh&quot;
# FOOBAR archiver use &quot;.foo&quot; as name extension instead usual one
# &quot;Florain Orjanov&#039;s and Olga Bachetska&#039;s ARchiver&quot; not found at the moment
&gt;&gt;&gt;&gt;&gt;&gt;&gt;2	string	-lh1		\b 
!:ext lha/lzh/ice
&gt;&gt;&gt;&gt;&gt;&gt;3	regex		\^lh[23d]	LHa 2.x? archive data
&gt;&gt;&gt;&gt;&gt;&gt;3	regex		\^lh[7]		LHa (2.x)/LHark archive data
&gt;&gt;&gt;&gt;&gt;&gt;3	regex		\^lh[456]	LHa (2.x) archive data
&gt;&gt;&gt;&gt;&gt;&gt;&gt;2	string	-lh5		\b 
# https://en.wikipedia.org/wiki/BIOS
# Some mainboard BIOS like Award use LHa compression. So archives with unusal extension are found like
# bios.rom , kd7_v14.bin, 1010.004, ...
!:ext lha/lzh/rom/bin
# missing -lh?- variants (Joe Jared)
&gt;&gt;&gt;&gt;&gt;&gt;3	regex		\^lh[89a-ce]	LHa (Joe Jared) archive
# UNLHA32 2.67a
&gt;&gt;&gt;&gt;&gt;&gt;2	string		-lhx		LHa (UNLHA32) archive
# lha archives with standard file name extensions &quot;.lha&quot; &quot;.lzh&quot;
&gt;&gt;&gt;&gt;&gt;&gt;3	regex		!\^(lh1|lh5)	\b 
!:ext lha/lzh
# this should not happen if all -lh variants are described
&gt;&gt;&gt;&gt;&gt;&gt;2	default		x		LHa (unknown) archive
#!:ext	lha
# PMarc
&gt;&gt;&gt;&gt;&gt;3	regex		\^pm[012]	PMarc archive data
!:ext pma
# append method id without leading and trailing minus character
&gt;&gt;&gt;&gt;&gt;3	string		x		[%3.3s]
&gt;&gt;&gt;&gt;&gt;&gt;0	use	lharc-header
#
#	check and display information of lharc header
0	name				lharc-header
# header size 0x4 , 0x1b-0x61
&gt;0	ubyte		x
# compressed data size != compressed file size
#&gt;7	ulelong		x		\b, data size %d
# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
#&gt;19	ubyte		x		\b, 19_0x%x
# level identifier 0 1 2 3
#&gt;20	ubyte		x		\b, level %d
# time stamp
#&gt;15		ubelong	x		DATE 0x%8.8x
# OS ID for level 1
&gt;20	ubyte		1
# 0x20 types find for *.rom files
&gt;&gt;(21.b+24)	ubyte	&lt;0x21		\b, 0x%x OS
# ascii type like M for MSDOS
&gt;&gt;(21.b+24)	ubyte	&gt;0x20		\b, &#039;%c&#039; OS
# OS ID for level 2
&gt;20	ubyte		2
#&gt;&gt;23	ubyte		x		\b, OS ID 0x%x
&gt;&gt;23	ubyte		&lt;0x21		\b, 0x%x OS
&gt;&gt;23	ubyte		&gt;0x20		\b, &#039;%c&#039; OS
# filename only for level 0 and 1
&gt;20	ubyte		&lt;2
# length of filename
&gt;&gt;21		ubyte	&gt;0		\b, with
# filename
&gt;&gt;&gt;21		pstring	x		&quot;%s&quot;
#
#2	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
#!:mime	application/x-lharc
2	string		-lh0-
&gt;0	use	lharc-file
#2	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
#!:mime	application/x-lharc
2	string		-lh1-
&gt;0	use	lharc-file
# NEW -lz2- ... -lz8-
2	string		-lz2-
&gt;0	use	lharc-file
2	string		-lz3-
&gt;0	use	lharc-file
2	string		-lz4-
&gt;0	use	lharc-file
2	string		-lz5-
&gt;0	use	lharc-file
2	string		-lz7-
&gt;0	use	lharc-file
2	string		-lz8-
&gt;0	use	lharc-file
#	[never seen any but the last; -lh4- reported in comp.compression:]
#2	string		-lzs-		LHa/LZS archive data [lzs]
2	string		-lzs-
&gt;0	use	lharc-file
# According to wikipedia and others such a version does not exist
#2	string		-lh\40-		LHa 2.x? archive data [lh ]
#2	string		-lhd-		LHa 2.x? archive data [lhd]
2	string		-lhd-
&gt;0	use	lharc-file
#2	string		-lh2-		LHa 2.x? archive data [lh2]
2	string		-lh2-
&gt;0	use	lharc-file
#2	string		-lh3-		LHa 2.x? archive data [lh3]
2	string		-lh3-
&gt;0	use	lharc-file
#2	string		-lh4-		LHa (2.x) archive data [lh4]
2	string		-lh4-
&gt;0	use	lharc-file
#2	string		-lh5-		LHa (2.x) archive data [lh5]
2	string		-lh5-
&gt;0	use	lharc-file
#2	string		-lh6-		LHa (2.x) archive data [lh6]
2	string		-lh6-
&gt;0	use	lharc-file
#2	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
2	string		-lh7-
# !:mime	application/x-lha
# &gt;20	byte		x		- header level %d
&gt;0	use	lharc-file
# NEW -lh8- ... -lhe- , -lhx-
2	string		-lh8-
&gt;0	use	lharc-file
2	string		-lh9-
&gt;0	use	lharc-file
2	string		-lha-
&gt;0	use	lharc-file
2	string		-lhb-
&gt;0	use	lharc-file
2	string		-lhc-
&gt;0	use	lharc-file
2	string		-lhe-
&gt;0	use	lharc-file
2	string		-lhx-
&gt;0	use	lharc-file
# taken from idarc [JW]
2   string      -lZ         PUT archive data
# already done by LHarc magics
# this should never happen if all sub types of LZS archive are identified
#2   string      -lz         LZS archive data
2   string      -sw1-       Swag archive data

0	name		rar-file-header
&gt;24	byte		15		\b, v1.5
&gt;24	byte		20		\b, v2.0
&gt;24	byte		29		\b, v4
&gt;15	byte		0		\b, os: MS-DOS
&gt;15	byte		1		\b, os: OS/2
&gt;15	byte		2		\b, os: Win32
&gt;15	byte		3		\b, os: Unix
&gt;15	byte		4		\b, os: Mac OS
&gt;15	byte		5		\b, os: BeOS

0	name		rar-archive-header
&gt;3	leshort&amp;0x1ff	&gt;0		\b, flags:
&gt;&gt;3	leshort		&amp;0x01		ArchiveVolume
&gt;&gt;3	leshort		&amp;0x02		Commented
&gt;&gt;3	leshort		&amp;0x04		Locked
&gt;&gt;3	leshort		&amp;0x10		NewVolumeNaming
&gt;&gt;3	leshort		&amp;0x08		Solid
&gt;&gt;3	leshort		&amp;0x20		Authenticated
&gt;&gt;3	leshort		&amp;0x40		RecoveryRecordPresent
&gt;&gt;3	leshort		&amp;0x80		EncryptedBlockHeader
&gt;&gt;3	leshort		&amp;0x100		FirstVolume

# RAR (Roshal Archive) archive
0	string		Rar!\x1a\7\0		RAR archive data
!:mime	application/x-rar
!:ext	rar/cbr
# file header
&gt;(0xc.l+9)	byte	0x74
&gt;&gt;(0xc.l+7)	use	rar-file-header
# subblock seems to share information with file header
&gt;(0xc.l+9)	byte	0x7a
&gt;&gt;(0xc.l+7)	use	rar-file-header
&gt;9		byte	0x73
&gt;&gt;7		use	rar-archive-header

0	string		Rar!\x1a\7\1\0		RAR archive data, v5
!:mime	application/x-rar
!:ext	rar

# Very old RAR archive
# http://jasonblanks.com/wp-includes/images/papers/KnowyourarchiveRAR.pdf
0	string		RE\x7e\x5e  RAR archive data (&lt;v1.5)
!:mime	application/x-rar
!:ext	rar/cbr

# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0	string		SQSH		squished archive data (Acorn RISCOS)

# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# [JW] see exe section for self-extracting version
0	string		UC2\x1a		UC2 archive data

# PKZIP multi-volume archive
0	string		PK\x07\x08PK\x03\x04	Zip multi-volume archive data, at least PKZIP v2.50 to extract
!:mime	application/zip
!:ext zip/cbz

# Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0	string		PK\005\006	Zip archive data (empty)
!:mime application/zip
!:ext zip/cbz
0	string		PK\003\004

# Specialised zip formats which start with a member named &#039;mimetype&#039;
# (stored uncompressed, with no &#039;extra field&#039;) containing the file&#039;s MIME type.
# Check for have 8-byte name, 0-byte extra field, name &quot;mimetype&quot;, and
#  contents starting with &quot;application/&quot;:
&gt;26	string		\x8\0\0\0mimetypeapplication/

#  KOffice / OpenOffice &amp; StarOffice / OpenDocument formats
#    From: Abel Cheung &lt;abel@oaka.org&gt;

#   KOffice (1.2 or above) formats
#    (mimetype contains &quot;application/vnd.kde.&lt;SUBTYPE&gt;&quot;)
&gt;&gt;50	string	vnd.kde.		KOffice (&gt;=1.2)
&gt;&gt;&gt;58	string	karbon			Karbon document
&gt;&gt;&gt;58	string	kchart			KChart document
&gt;&gt;&gt;58	string	kformula		KFormula document
&gt;&gt;&gt;58	string	kivio			Kivio document
&gt;&gt;&gt;58	string	kontour			Kontour document
&gt;&gt;&gt;58	string	kpresenter		KPresenter document
&gt;&gt;&gt;58	string	kspread			KSpread document
&gt;&gt;&gt;58	string	kword			KWord document

#   OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
#    (mimetype contains &quot;application/vnd.sun.xml.&lt;SUBTYPE&gt;&quot;)
&gt;&gt;50	string	vnd.sun.xml.		OpenOffice.org 1.x
&gt;&gt;&gt;62	string	writer			Writer
&gt;&gt;&gt;&gt;68	byte	!0x2e			document
&gt;&gt;&gt;&gt;68	string	.template		template
&gt;&gt;&gt;&gt;68	string	.global			global document
&gt;&gt;&gt;62	string	calc			Calc
&gt;&gt;&gt;&gt;66	byte	!0x2e			spreadsheet
&gt;&gt;&gt;&gt;66	string	.template		template
&gt;&gt;&gt;62	string	draw			Draw
&gt;&gt;&gt;&gt;66	byte	!0x2e			document
&gt;&gt;&gt;&gt;66	string	.template		template
&gt;&gt;&gt;62	string	impress			Impress
&gt;&gt;&gt;&gt;69	byte	!0x2e			presentation
&gt;&gt;&gt;&gt;69	string	.template		template
&gt;&gt;&gt;62	string	math			Math document
&gt;&gt;&gt;62	string	base			Database file

#   OpenDocument formats (for OpenOffice 2.x / StarOffice &gt;= 8)
#    http://lists.oasis-open.org/archives/office/200505/msg00006.html
#    (mimetype contains &quot;application/vnd.oasis.opendocument.&lt;SUBTYPE&gt;&quot;)
&gt;&gt;50	string	vnd.oasis.opendocument.	OpenDocument
&gt;&gt;&gt;73	string	text
&gt;&gt;&gt;&gt;77	byte	!0x2d			Text
!:mime	application/vnd.oasis.opendocument.text
&gt;&gt;&gt;&gt;77	string	-template		Text Template
!:mime	application/vnd.oasis.opendocument.text-template
&gt;&gt;&gt;&gt;77	string	-web			HTML Document Template
!:mime	application/vnd.oasis.opendocument.text-web
&gt;&gt;&gt;&gt;77	string	-master			Master Document
!:mime	application/vnd.oasis.opendocument.text-master
&gt;&gt;&gt;73	string	graphics
&gt;&gt;&gt;&gt;81	byte	!0x2d			Drawing
!:mime	application/vnd.oasis.opendocument.graphics
&gt;&gt;&gt;&gt;81	string	-template		Template
!:mime	application/vnd.oasis.opendocument.graphics-template
&gt;&gt;&gt;73	string	presentation
&gt;&gt;&gt;&gt;85	byte	!0x2d			Presentation
!:mime	application/vnd.oasis.opendocument.presentation
&gt;&gt;&gt;&gt;85	string	-template		Template
!:mime	application/vnd.oasis.opendocument.presentation-template
&gt;&gt;&gt;73	string	spreadsheet
&gt;&gt;&gt;&gt;84	byte	!0x2d			Spreadsheet
!:mime	application/vnd.oasis.opendocument.spreadsheet
&gt;&gt;&gt;&gt;84	string	-template		Template
!:mime	application/vnd.oasis.opendocument.spreadsheet-template
&gt;&gt;&gt;73	string	chart
&gt;&gt;&gt;&gt;78	byte	!0x2d			Chart
!:mime	application/vnd.oasis.opendocument.chart
&gt;&gt;&gt;&gt;78	string	-template		Template
!:mime	application/vnd.oasis.opendocument.chart-template
&gt;&gt;&gt;73	string	formula
&gt;&gt;&gt;&gt;80	byte	!0x2d			Formula
!:mime	application/vnd.oasis.opendocument.formula
&gt;&gt;&gt;&gt;80	string	-template		Template
!:mime	application/vnd.oasis.opendocument.formula-template
&gt;&gt;&gt;73	string	database		Database
!:mime	application/vnd.oasis.opendocument.database
# Valid for LibreOffice Base 6.0.1.1 at least
&gt;&gt;&gt;73	string	base 			Database
!:mime	application/vnd.oasis.opendocument.base
&gt;&gt;&gt;73	string	image
&gt;&gt;&gt;&gt;78	byte	!0x2d			Image
!:mime	application/vnd.oasis.opendocument.image
&gt;&gt;&gt;&gt;78	string	-template		Template
!:mime	application/vnd.oasis.opendocument.image-template

#  EPUB (OEBPS) books using OCF (OEBPS Container Format)
#    http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
#    From: Ralf Brown &lt;ralf.brown@gmail.com&gt;
&gt;&gt;50	string	epub+zip	EPUB document
!:mime application/epub+zip

#  Catch other ZIP-with-mimetype formats
#	In a ZIP file, the bytes immediately after a member&#039;s contents are
#	always &quot;PK&quot;. The 2 regex rules here print the &quot;mimetype&quot; member&#039;s
#	contents up to the first &#039;P&#039;. Luckily, most MIME types don&#039;t contain
#	any capital &#039;P&#039;s. This is a kludge.
#    (mimetype contains &quot;application/&lt;OTHER&gt;&quot;)
&gt;&gt;50		string	!epub+zip
&gt;&gt;&gt;50		string	!vnd.oasis.opendocument.
&gt;&gt;&gt;&gt;50		string	!vnd.sun.xml.
&gt;&gt;&gt;&gt;&gt;50		string	!vnd.kde.
&gt;&gt;&gt;&gt;&gt;&gt;38	regex	[!-OQ-~]+		Zip data (MIME type &quot;%s&quot;?)
!:mime	application/zip
#    (mimetype contents other than &quot;application/*&quot;)
&gt;26		string	\x8\0\0\0mimetype
&gt;&gt;38		string	!application/
&gt;&gt;&gt;38		regex	[!-OQ-~]+		Zip data (MIME type &quot;%s&quot;?)
!:mime	application/zip

# Java Jar files
&gt;(26.s+30)	leshort	0xcafe		Java archive data (JAR)
!:mime	application/java-archive

# iOS App
&gt;(26.s+30)	leshort	!0xcafe
&gt;&gt;26		string	!\x8\0\0\0mimetype
&gt;&gt;&gt;30		string	Payload/
&gt;&gt;&gt;&gt;38		search/64       .app/   iOS App
!:mime application/x-ios-app


# Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
#   Next line excludes specialized formats:
&gt;(26.s+30)	leshort	!0xcafe
&gt;&gt;26    string          !\x8\0\0\0mimetype	Zip archive data
!:mime	application/zip
&gt;&gt;&gt;4	beshort		x			\b, at least
&gt;&gt;&gt;4	use		zipversion
&gt;&gt;&gt;4	beshort		x			to extract
&gt;&gt;&gt;0x161	string		WINZIP		\b, WinZIP self-extracting

# StarView Metafile
# From Pierre Ducroquet &lt;pinaraf@pinaraf.info&gt;
0	string	VCLMTF	StarView MetaFile
&gt;6	beshort	x	\b, version %d
&gt;8	belong	x	\b, size %d

# Zoo archiver
20	lelong		0xfdc4a7dc	Zoo archive data
!:mime	application/x-zoo
&gt;4	byte		&gt;48		\b, v%c.
&gt;&gt;6	byte		&gt;47		\b%c
&gt;&gt;&gt;7	byte		&gt;47		\b%c
&gt;32	byte		&gt;0		\b, modify: v%d
&gt;&gt;33	byte		x		\b.%d+
&gt;42	lelong		0xfdc4a7dc	\b,
&gt;&gt;70	byte		&gt;0		extract: v%d
&gt;&gt;&gt;71	byte		x		\b.%d+

# Shell archives
10	string		#\ This\ is\ a\ shell\ archive	shell archive text
!:mime	application/octet-stream

#
# LBR. NB: May conflict with the questionable
#          &quot;binary Computer Graphics Metafile&quot; format.
#
0       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
#
# PMA (CP/M derivative of LHA)
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/LHA_(file_format)
#
#2       string          -pm0-           PMarc archive data [pm0]
2	string		-pm0-
&gt;0	use	lharc-file
#2       string          -pm1-           PMarc archive data [pm1]
2	string		-pm1-
&gt;0	use	lharc-file
#2       string          -pm2-           PMarc archive data [pm2]
2	string		-pm2-
&gt;0	use	lharc-file
2       string          -pms-           PMarc SFX archive (CP/M, DOS)
#!:mime	application/x-foobar-exec
!:ext com
5       string          -pc1-           PopCom compressed executable (CP/M)
#!:mime	application/x-
#!:ext com

# From Rafael Laboissiere &lt;rafael@laboissiere.net&gt;
# The Project Revision Control System (see
# http://prcs.sourceforge.net) generates a packaged project
# file which is recognized by the following entry:
0	leshort		0xeb81	PRCS packaged project

# Microsoft cabinets
# by David Necas (Yeti) &lt;yeti@physics.muni.cz&gt;
#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
#&gt;25	byte	x		v%d
#&gt;24	byte	x		\b.%d
# MPi: All CABs have version 1.3, so this is pointless.
# Better magic in debian-additions.

# GTKtalog catalogs
# by David Necas (Yeti) &lt;yeti@physics.muni.cz&gt;
4	string	gtktalog\ 	GTKtalog catalog data,
&gt;13	string	3		version 3
&gt;&gt;14	beshort	0x677a		(gzipped)
&gt;&gt;14	beshort	!0x677a		(not gzipped)
&gt;13	string	&gt;3		version %s

############################################################################
# Parity archive reconstruction file, the &#039;par&#039; file format now used on Usenet.
0       string          PAR\0	PARity archive data
&gt;48	leshort		=0	- Index file
&gt;48	leshort		&gt;0	- file number %d

# Felix von Leitner &lt;felix-file@fefe.de&gt;
0	string	d8:announce	BitTorrent file
!:mime	application/x-bittorrent
# Durval Menezes, &lt;jmgthbfile at durval dot com&gt;
0	string	d13:announce-list	BitTorrent file
!:mime	application/x-bittorrent

# Atari MSA archive - Teemu Hukkanen &lt;tjhukkan@iki.fi&gt;
0	beshort 0x0e0f		Atari MSA archive data
&gt;2	beshort x		\b, %d sectors per track
&gt;4	beshort 0		\b, 1 sided
&gt;4	beshort 1		\b, 2 sided
&gt;6	beshort x		\b, starting track: %d
&gt;8	beshort x		\b, ending track: %d

# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
0	string	PK00PK\003\004	Zip archive data
!:mime	application/zip
!:ext zip/cbz

# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
# by Stefan `Sec` Zehl &lt;sec@42.org&gt;
7	string		**ACE**		ACE archive data
&gt;15	byte	&gt;0		version %d
&gt;16	byte	=0x00		\b, from MS-DOS
&gt;16	byte	=0x01		\b, from OS/2
&gt;16	byte	=0x02		\b, from Win/32
&gt;16	byte	=0x03		\b, from Unix
&gt;16	byte	=0x04		\b, from MacOS
&gt;16	byte	=0x05		\b, from WinNT
&gt;16	byte	=0x06		\b, from Primos
&gt;16	byte	=0x07		\b, from AppleGS
&gt;16	byte	=0x08		\b, from Atari
&gt;16	byte	=0x09		\b, from Vax/VMS
&gt;16	byte	=0x0A		\b, from Amiga
&gt;16	byte	=0x0B		\b, from Next
&gt;14	byte	x		\b, version %d to extract
&gt;5	leshort &amp;0x0080		\b, multiple volumes,
&gt;&gt;17	byte	x		\b (part %d),
&gt;5	leshort &amp;0x0002		\b, contains comment
&gt;5	leshort	&amp;0x0200		\b, sfx
&gt;5	leshort	&amp;0x0400		\b, small dictionary
&gt;5	leshort	&amp;0x0800		\b, multi-volume
&gt;5	leshort	&amp;0x1000		\b, contains AV-String
&gt;&gt;30	string	\x16*UNREGISTERED\x20VERSION*	(unregistered)
&gt;5	leshort &amp;0x2000		\b, with recovery record
&gt;5	leshort &amp;0x4000		\b, locked
&gt;5	leshort &amp;0x8000		\b, solid
# Date in MS-DOS format (whatever that is)
#&gt;18	lelong	x		Created on

# sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
# &lt;doj@cubic.org&gt;
0x1A	string	sfArk		sfArk compressed Soundfont
&gt;0x15	string	2
&gt;&gt;0x1	string	&gt;\0		Version %s
&gt;&gt;0x2A	string	&gt;\0		: %s

# DR-DOS 7.03 Packed File *.??_
0	string	Packed\ File\ 	Personal NetWare Packed File
&gt;12	string	x		\b, was &quot;%.12s&quot;

# EET archive
# From: Tilman Sauerbeck &lt;tilman@code-monkey.de&gt;
0	belong	0x1ee7ff00	EET archive
!:mime	application/x-eet

# rzip archives
0	string	RZIP		rzip compressed data
&gt;4	byte	x		- version %d
&gt;5	byte	x		\b.%d
&gt;6	belong	x		(%d bytes)

# From: &quot;Robert Dale&quot; &lt;robdale@gmail.com&gt;
0	belong	123		dar archive,
&gt;4	belong	x		label &quot;%.8x
&gt;&gt;8	belong	x		%.8x
&gt;&gt;&gt;12	beshort	x		%.4x&quot;
&gt;14	byte	0x54		end slice
&gt;14	beshort	0x4e4e		multi-part
&gt;14	beshort	0x4e53		multi-part, with -S

# Symbian installation files
#  http://www.thouky.co.uk/software/psifs/sis.html
#  http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
8	lelong	0x10000419	Symbian installation file
!:mime	application/vnd.symbian.install
&gt;4	lelong	0x1000006D	(EPOC release 3/4/5)
&gt;4	lelong	0x10003A12	(EPOC release 6)
0	lelong	0x10201A7A	Symbian installation file (Symbian OS 9.x)
!:mime	x-epoc/x-sisx-app

# From &quot;Nelson A. de Oliveira&quot; &lt;naoliv@gmail.com&gt;
0	string	MPQ\032		MoPaQ (MPQ) archive

# From: &quot;Nelson A. de Oliveira&quot; &lt;naoliv@gmail.com&gt;
# .kgb
0	string KGB_arch		KGB Archiver file
&gt;10	string x		with compression level %.1s

# xar (eXtensible ARchiver) archive
# xar archive format: http://code.google.com/p/xar/
# From: &quot;David Remahl&quot; &lt;dremahl@apple.com&gt;
0	string	xar!		xar archive
!:mime	application/x-xar
#&gt;4	beshort	x		header size %d
&gt;6	beshort	x		version %d,
#&gt;8	quad	x		compressed TOC: %d,
#&gt;16	quad	x		uncompressed TOC: %d,
&gt;24	belong	0		no checksum
&gt;24	belong	1		SHA-1 checksum
&gt;24	belong	2		MD5 checksum

# Type: Parity Archive
# From: Daniel van Eeden &lt;daniel_e@dds.nl&gt;
0	string	PAR2		Parity Archive Volume Set

# Bacula volume format. (Volumes always start with a block header.)
# URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
# From: Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
12	string	BB02		Bacula volume
&gt;20	bedate	x		\b, started %s

# ePub is XHTML + XML inside a ZIP archive.  The first member of the
#   archive must be an uncompressed file called &#039;mimetype&#039; with contents
#   &#039;application/epub+zip&#039;


# From: &quot;Michael Gorny&quot; &lt;mgorny@gentoo.org&gt;
# ZPAQ: http://mattmahoney.net/dc/zpaq.html
0	string	zPQ	ZPAQ stream
&gt;3	byte	x	\b, level %d
# From: Barry Carter &lt;carter.barry@gmail.com&gt;
# http://encode.ru/threads/456-zpaq-updates/page32
0	string	7kSt	ZPAQ file

# BBeB ebook, unencrypted (LRF format)
# URL: http://www.sven.de/librie/Librie/LrfFormat
# From: Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
0	string	L\0R\0F\0\0\0	BBeB ebook data, unencrypted
&gt;8	beshort	x		\b, version %d
&gt;36	byte	1		\b, front-to-back
&gt;36	byte	16		\b, back-to-front
&gt;42	beshort	x		\b, (%dx,
&gt;44	beshort	x		%d)

# Symantec GHOST image by Joerg Jenderek at May 2014
# http://us.norton.com/ghost/
# http://www.garykessler.net/library/file_sigs.html
0		ubelong&amp;0xFFFFf7f0	0xFEEF0100	Norton GHost image
# *.GHO
&gt;2		ubyte&amp;0x08		0x00		\b, first file
# *.GHS or *.[0-9] with cns program option
&gt;2		ubyte&amp;0x08		0x08		\b, split file
# part of split index interesting for *.ghs
&gt;&gt;4		ubyte			x		id=0x%x
# compression tag minus one equals numeric compression command line switch z[1-9]
&gt;3		ubyte			0		\b, no compression
&gt;3		ubyte			2		\b, fast compression (Z1)
&gt;3		ubyte			3		\b, medium compression (Z2)
&gt;3		ubyte			&gt;3
&gt;&gt;3		ubyte			&lt;11		\b, compression (Z%d-1)
&gt;2		ubyte&amp;0x08		0x00
# ~ 30 byte password field only for *.gho
&gt;&gt;12		ubequad			!0		\b, password protected
&gt;&gt;44		ubyte			!1
# 1~Image All, sector-by-sector only for *.gho
&gt;&gt;&gt;10		ubyte			1		\b, sector copy
# 1~Image Boot track only for *.gho
&gt;&gt;&gt;43		ubyte			1		\b, boot track
# 1~Image Disc only for *.gho implies Image Boot track and sector copy
&gt;&gt;44		ubyte			1		\b, disc sector copy
# optional image description only *.gho
&gt;&gt;0xff		string			&gt;\0		&quot;%-.254s&quot;
# look for DOS sector end sequence
&gt;0xE08	search/7776		\x55\xAA
&gt;&gt;&amp;-512	indirect		x		\b; contains

# Google Chrome extensions
# https://developer.chrome.com/extensions/crx
# https://developer.chrome.com/extensions/hosting
0	string	Cr24	Google Chrome extension
!:mime	application/x-chrome-extension
&gt;4	ulong	x	\b, version %u

# SeqBox - Sequenced container
# ext: sbx, seqbox
# Marco Pontello marcopon@gmail.com
# reference: https://github.com/MarcoPon/SeqBox
0	string	SBx	SeqBox,
&gt;3	byte	x	version %d

# LyNX archive
56	string	USE\040LYNX\040TO\040DISSOLVE\040THIS\040FILE	 LyNX archive
#------------------------------------------------------------------------------
# $File: assembler,v 1.6 2013/12/11 14:14:20 christos Exp $
# make:  file(1) magic for assembler source
#
0	regex	\^[\040\t]{0,50}\\.asciiz		assembler source text
!:mime	text/x-asm
0	regex	\^[\040\t]{0,50}\\.byte		assembler source text
!:mime	text/x-asm
0	regex	\^[\040\t]{0,50}\\.even		assembler source text
!:mime	text/x-asm
0	regex	\^[\040\t]{0,50}\\.globl		assembler source text
!:mime	text/x-asm
0	regex	\^[\040\t]{0,50}\\.text		assembler source text
!:mime	text/x-asm
0	regex	\^[\040\t]{0,50}\\.file		assembler source text
!:mime	text/x-asm
0	regex	\^[\040\t]{0,50}\\.type		assembler source text
!:mime	text/x-asm

#------------------------------------------------------------------------------
# $File: asterix,v 1.5 2009/09/19 16:28:08 christos Exp $
# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
# strings as &quot;long&quot; - we assume they&#039;re just strings:
# From: guy@netapp.com (Guy Harris)
#
0	string		*STA		Aster*x
&gt;7	string		WORD			Words Document
&gt;7	string		GRAP			Graphic
&gt;7	string		SPRE			Spreadsheet
&gt;7	string		MACR			Macro
0	string		2278		Aster*x Version 2
&gt;29	byte		0x36			Words Document
&gt;29	byte		0x35			Graphic
&gt;29	byte		0x32			Spreadsheet
&gt;29	byte		0x38			Macro


#------------------------------------------------------------------------------
# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
# att3b:  file(1) magic for AT&amp;T 3B machines
#
# The `versions&#039; should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
# 3B20
#
# The 3B20 conflicts with SCCS.
#0	beshort		0550		3b20 COFF executable
#&gt;12	belong		&gt;0		not stripped
#&gt;22	beshort		&gt;0		- version %d
#0	beshort		0551		3b20 COFF executable (TV)
#&gt;12	belong		&gt;0		not stripped
#&gt;22	beshort		&gt;0		- version %d
#
# WE32K
#
0	beshort		0560		WE32000 COFF
&gt;18	beshort		^00000020	object
&gt;18	beshort		&amp;00000020	executable
&gt;12	belong		&gt;0		not stripped
&gt;18	beshort		^00010000	N/A on 3b2/300 w/paging
&gt;18	beshort		&amp;00020000	32100 required
&gt;18	beshort		&amp;00040000	and MAU hardware required
&gt;20	beshort		0407		(impure)
&gt;20	beshort		0410		(pure)
&gt;20	beshort		0413		(demand paged)
&gt;20	beshort		0443		(target shared library)
&gt;22	beshort		&gt;0		- version %d
0	beshort		0561		WE32000 COFF executable (TV)
&gt;12	belong		&gt;0		not stripped
#&gt;18	beshort		&amp;00020000	- 32100 required
#&gt;18	beshort		&amp;00040000	and MAU hardware required
#&gt;22	beshort		&gt;0		- version %d
#
# core file for 3b2
0	string		\000\004\036\212\200	3b2 core file
&gt;364	string		&gt;\0		of &#039;%s&#039;

#------------------------------------------------------------------------------
# $File: audio,v 1.86 2018/03/11 00:53:11 christos Exp $
# audio:  file(1) magic for sound formats (see also &quot;iff&quot;)
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
# and others
#

# Sun/NeXT audio data
0	string		.snd		Sun/NeXT audio data:
&gt;12	belong		1		8-bit ISDN mu-law,
!:mime	audio/basic
&gt;12	belong		2		8-bit linear PCM [REF-PCM],
!:mime	audio/basic
&gt;12	belong		3		16-bit linear PCM,
!:mime	audio/basic
&gt;12	belong		4		24-bit linear PCM,
!:mime	audio/basic
&gt;12	belong		5		32-bit linear PCM,
!:mime	audio/basic
&gt;12	belong		6		32-bit IEEE floating point,
!:mime	audio/basic
&gt;12	belong		7		64-bit IEEE floating point,
!:mime	audio/basic
&gt;12	belong		8		Fragmented sample data,
&gt;12	belong		10		DSP program,
&gt;12	belong		11		8-bit fixed point,
&gt;12	belong		12		16-bit fixed point,
&gt;12	belong		13		24-bit fixed point,
&gt;12	belong		14		32-bit fixed point,
&gt;12	belong		18		16-bit linear with emphasis,
&gt;12	belong		19		16-bit linear compressed,
&gt;12	belong		20		16-bit linear with emphasis and compression,
&gt;12	belong		21		Music kit DSP commands,
&gt;12	belong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
!:mime  audio/x-adpcm
&gt;12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
&gt;12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
&gt;12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
&gt;12	belong		27		8-bit A-law (CCITT G.711),
&gt;20	belong		1		mono,
&gt;20	belong		2		stereo,
&gt;20	belong		4		quad,
&gt;16	belong		&gt;0		%d Hz

# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
0	lelong		0x0064732E	DEC audio data:
&gt;12	lelong		1		8-bit ISDN mu-law,
!:mime	audio/x-dec-basic
&gt;12	lelong		2		8-bit linear PCM [REF-PCM],
!:mime	audio/x-dec-basic
&gt;12	lelong		3		16-bit linear PCM,
!:mime	audio/x-dec-basic
&gt;12	lelong		4		24-bit linear PCM,
!:mime	audio/x-dec-basic
&gt;12	lelong		5		32-bit linear PCM,
!:mime	audio/x-dec-basic
&gt;12	lelong		6		32-bit IEEE floating point,
!:mime	audio/x-dec-basic
&gt;12	lelong		7		64-bit IEEE floating point,
!:mime	audio/x-dec-basic
&gt;12	belong		8		Fragmented sample data,
&gt;12	belong		10		DSP program,
&gt;12	belong		11		8-bit fixed point,
&gt;12	belong		12		16-bit fixed point,
&gt;12	belong		13		24-bit fixed point,
&gt;12	belong		14		32-bit fixed point,
&gt;12	belong		18		16-bit linear with emphasis,
&gt;12	belong		19		16-bit linear compressed,
&gt;12	belong		20		16-bit linear with emphasis and compression,
&gt;12	belong		21		Music kit DSP commands,
&gt;12	lelong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice enc.),
!:mime	audio/x-dec-basic
&gt;12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
&gt;12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
&gt;12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
&gt;12	belong		27		8-bit A-law (CCITT G.711),
&gt;20	lelong		1		mono,
&gt;20	lelong		2		stereo,
&gt;20	lelong		4		quad,
&gt;16	lelong		&gt;0		%d Hz

# Creative Labs AUDIO stuff
0	string	MThd			Standard MIDI data
!:mime	audio/midi
&gt;8 	beshort	x			(format %d)
&gt;10	beshort	x			using %d track
&gt;10	beshort		&gt;1		\bs
&gt;12	beshort&amp;0x7fff	x		at 1/%d
&gt;12	beshort&amp;0x8000	&gt;0		SMPTE

0	string	CTMF			Creative Music (CMF) data
!:mime	audio/x-unknown
0	string	SBI			SoundBlaster instrument data
!:mime	audio/x-unknown
0	string	Creative\ Voice\ File	Creative Labs voice data
!:mime	audio/x-unknown
# is this next line right?  it came this way...
&gt;19	byte	0x1A
&gt;23	byte	&gt;0			- version %d
&gt;22	byte	&gt;0			\b.%d

# first entry is also the string &quot;NTRK&quot;
0	belong		0x4e54524b	MultiTrack sound data
&gt;4	belong		x		- version %d

# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
# [based on posting 940824 by &quot;Dirk/Elastik&quot;, husberg@lehtori.cc.tut.fi]
0	string		EMOD		Extended MOD sound data,
&gt;4	byte&amp;0xf0	x		version %d
&gt;4	byte&amp;0x0f	x		\b.%d,
&gt;45	byte		x		%d instruments
&gt;83	byte		0		(module)
&gt;83	byte		1		(song)

# Real Audio (Magic .ra\0375)
0	belong		0x2e7261fd	RealAudio sound file
!:mime	audio/x-pn-realaudio
0	string		.RMF\0\0\0	RealMedia file
!:mime	application/vnd.rn-realmedia
#video/x-pn-realvideo
#video/vnd.rn-realvideo
#application/vnd.rn-realmedia
#	sigh, there are many mimes for that but the above are the most common.

# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
# Oct 31, 1995
# fixed by &lt;doj@cubic.org&gt; 2003-06-24
# Too short...
#0	string		MTM		MultiTracker Module sound file
#0	string		if		Composer 669 Module sound data
#0	string		JN		Composer 669 Module sound data (extended format)
0	string		MAS_U		ULT(imate) Module sound data

#0	string		FAR		Module sound data
#&gt;4	string		&gt;\15		Title: &quot;%s&quot;

0x2c	string		SCRM		ScreamTracker III Module sound data
&gt;0	string		&gt;\0		Title: &quot;%s&quot;

# Gravis UltraSound patches
# From &lt;ache@nagual.ru&gt;

0	string		GF1PATCH110\0ID#000002\0	GUS patch
0	string		GF1PATCH100\0ID#000002\0	Old GUS	patch

# mime types according to http://www.geocities.com/nevilo/mod.htm:
#	audio/it	.it
#	audio/x-zipped-it	.itz
#	audio/xm	fasttracker modules
#	audio/x-s3m	screamtracker modules
#	audio/s3m	screamtracker modules
#	audio/x-zipped-mod	mdz
#	audio/mod	mod
#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)

#
# Taken from loader code from mikmod version 2.14
# by Steve McIntyre (stevem@chiark.greenend.org.uk)
# &lt;doj@cubic.org&gt; added title printing on 2003-06-24
0	string	MAS_UTrack_V00
&gt;14	string	&gt;/0		ultratracker V1.%.1s module sound data
!:mime	audio/x-mod
#audio/x-tracker-module

0	string	UN05		MikMod UNI format module sound data

0	string	Extended\ Module: Fasttracker II module sound data
!:mime	audio/x-mod
#audio/x-tracker-module
&gt;17	string	&gt;\0		Title: &quot;%s&quot;

21	string/c	=!SCREAM!	Screamtracker 2 module sound data
!:mime	audio/x-mod
#audio/x-screamtracker-module
21	string	BMOD2STM	Screamtracker 2 module sound data
!:mime	audio/x-mod
#audio/x-screamtracker-module
1080	string	M.K.		4-channel Protracker module sound data
!:mime	audio/x-mod
#audio/x-protracker-module
&gt;0	string	&gt;\0		Title: &quot;%s&quot;
1080	string	M!K!		4-channel Protracker module sound data
!:mime	audio/x-mod
#audio/x-protracker-module
&gt;0	string	&gt;\0		Title: &quot;%s&quot;
1080	string	FLT4		4-channel Startracker module sound data
!:mime	audio/x-mod
#audio/x-startracker-module
&gt;0	string	&gt;\0		Title: &quot;%s&quot;
1080	string	FLT8		8-channel Startracker module sound data
!:mime	audio/x-mod
#audio/x-startracker-module
&gt;0	string	&gt;\0		Title: &quot;%s&quot;
1080	string	4CHN		4-channel Fasttracker module sound data
!:mime	audio/x-mod
#audio/x-fasttracker-module
&gt;0	string	&gt;\0		Title: &quot;%s&quot;
1080	string	6CHN		6-channel Fasttracker module sound data
!:mime	audio/x-mod
#audio/x-fasttracker-module
&gt;0	string	&gt;\0		Title: &quot;%s&quot;
1080	string	8CHN		8-channel Fasttracker module sound data
!:mime	audio/x-mod
#audio/x-fasttracker-module
&gt;0	string	&gt;\0		Title: &quot;%s&quot;
1080	string	CD81		8-channel Octalyser module sound data
!:mime	audio/x-mod
#audio/x-octalysertracker-module
&gt;0	string	&gt;\0		Title: &quot;%s&quot;
1080	string	OKTA		8-channel Octalyzer module sound data
!:mime	audio/x-mod
#audio/x-octalysertracker-module
&gt;0	string	&gt;\0		Title: &quot;%s&quot;
# Not good enough.
#1082	string	CH
#&gt;1080	string	&gt;/0		%.2s-channel Fasttracker &quot;oktalyzer&quot; module sound data
1080	string	16CN		16-channel Taketracker module sound data
!:mime	audio/x-mod
#audio/x-taketracker-module
&gt;0	string	&gt;\0		Title: &quot;%s&quot;
1080	string	32CN		32-channel Taketracker module sound data
!:mime	audio/x-mod
#audio/x-taketracker-module
&gt;0	string	&gt;\0		Title: &quot;%s&quot;

# TOC sound files -Trevor Johnson &lt;trevor@jpj.net&gt;
#
0       string          TOC             TOC sound file

# sidfiles &lt;pooka@iki.fi&gt;
# added name,author,(c) and new RSID type by &lt;doj@cubic.org&gt; 2003-06-24
0	string		SIDPLAY\ INFOFILE	Sidplay info file

0	string		PSID			PlaySID v2.2+ (AMIGA) sidtune
&gt;4	beshort		&gt;0			w/ header v%d,
&gt;14	beshort		=1			single song,
&gt;14	beshort		&gt;1			%d songs,
&gt;16	beshort		&gt;0			default song: %d
&gt;0x16	string		&gt;\0			name: &quot;%s&quot;
&gt;0x36	string		&gt;\0			author: &quot;%s&quot;
&gt;0x56	string		&gt;\0			copyright: &quot;%s&quot;

0	string		RSID			RSID sidtune PlaySID compatible
&gt;4	beshort		&gt;0			w/ header v%d,
&gt;14	beshort		=1			single song,
&gt;14	beshort		&gt;1			%d songs,
&gt;16	beshort		&gt;0			default song: %d
&gt;0x16	string		&gt;\0			name: &quot;%s&quot;
&gt;0x36	string		&gt;\0			author: &quot;%s&quot;
&gt;0x56	string		&gt;\0			copyright: &quot;%s&quot;

# IRCAM sound files - Michael Pruett &lt;michael@68k.org&gt;
# http://www-mmsp.ece.mcgill.ca/documents/AudioFormats/IRCAM/IRCAM.html
0	belong		0x64a30100		IRCAM file (VAX little-endian)
0	belong		0x0001a364		IRCAM file (VAX big-endian)
0	belong		0x64a30200		IRCAM file (Sun big-endian)
0	belong		0x0002a364		IRCAM file (Sun little-endian)
0	belong		0x64a30300		IRCAM file (MIPS little-endian)
0	belong		0x0003a364		IRCAM file (MIPS big-endian)
0	belong		0x64a30400		IRCAM file (NeXT big-endian)
0	belong		0x64a30400		IRCAM file (NeXT big-endian)
0	belong		0x0004a364		IRCAM file (NeXT little-endian)

# NIST SPHERE &lt;mpruett@sgi.com&gt;
0	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file

# Sample Vision &lt;mpruett@sgi.com&gt;
0	string		SOUND\ SAMPLE\ DATA\ 	Sample Vision file

# Audio Visual Research &lt;tonigonenstein@users.sourceforge.net&gt;
0	string		2BIT			Audio Visual Research file,
&gt;12	beshort		=0			mono,
&gt;12	beshort		=-1			stereo,
&gt;14	beshort		x			%d bits
&gt;16	beshort		=0			unsigned,
&gt;16	beshort		=-1			signed,
&gt;22	belong&amp;0x00ffffff	x		%d Hz,
&gt;18	beshort		=0			no loop,
&gt;18	beshort		=-1			loop,
&gt;21	ubyte		&lt;128			note %d,
&gt;22	byte		=0			replay 5.485 KHz
&gt;22	byte		=1			replay 8.084 KHz
&gt;22	byte		=2			replay 10.971 KHz
&gt;22	byte		=3			replay 16.168 KHz
&gt;22	byte		=4			replay 21.942 KHz
&gt;22	byte		=5			replay 32.336 KHz
&gt;22	byte		=6			replay 43.885 KHz
&gt;22	byte		=7			replay 47.261 KHz

# SGI SoundTrack &lt;mpruett@sgi.com&gt;
0	string		_SGI_SoundTrack		SGI SoundTrack project file
# ID3 version 2 tags &lt;waschk@informatik.uni-rostock.de&gt;
0	string		ID3	Audio file with ID3 version 2
&gt;3	byte		x	\b.%d
&gt;4	byte		x	\b.%d
&gt;&gt;5	byte		&amp;0x80	\b, unsynchronized frames
&gt;&gt;5	byte		&amp;0x40	\b, extended header
&gt;&gt;5	byte		&amp;0x20	\b, experimental
&gt;&gt;5	byte		&amp;0x10	\b, footer present
&gt;(6.I+10)	indirect	x	\b, contains:

# NSF (NES sound file) magic
0	string		NESM\x1a	NES Sound File
&gt;14	string		&gt;\0		(&quot;%s&quot; by
&gt;46	string		&gt;\0		%s, copyright
&gt;78	string		&gt;\0		%s),
&gt;5	byte		x		version %d,
&gt;6	byte		x		%d tracks,
&gt;122	byte&amp;0x2	=1		dual PAL/NTSC
&gt;122	byte&amp;0x1	=1		PAL
&gt;122	byte&amp;0x1	=0		NTSC

# NSFE (Extended NES sound file) magic
# http://slickproductions.org/docs/NSF/nsfespec.txt
# From: David Pflug &lt;david@pflug.email&gt;
0	string		NSFE		Extended NES Sound File
&gt;48	search/0x1000	auth
&gt;&gt;&amp;0	string		&gt;\0		(&quot;%s&quot;
&gt;&gt;&gt;&amp;1	string		&gt;\0		by %s
&gt;&gt;&gt;&gt;&amp;1	string		&gt;\0		\b, copyright %s
&gt;&gt;&gt;&gt;&gt;&amp;1	string		&gt;\0		\b, ripped by %s
&gt;20	byte		x		\b), %d tracks,
&gt;18	byte&amp;0x2	=1		dual PAL/NTSC
&gt;18     byte&amp;0x2	=0
&gt;&gt;18	byte&amp;0x1	=1		PAL
&gt;&gt;18	byte&amp;0x1	=0		NTSC

# Type: SNES SPC700 sound files
# From: Josh Triplett &lt;josh@freedesktop.org&gt;
0	string	SNES-SPC700\ Sound\ File\ Data\ v	SNES SPC700 sound file
&gt;&amp;0	string	0.30					\b, version %s
&gt;&gt;0x23	byte	0x1B					\b, without ID666 tag
&gt;&gt;0x23	byte	0x1A					\b, with ID666 tag
&gt;&gt;&gt;0x2E	string	&gt;\0					\b, song &quot;%.32s&quot;
&gt;&gt;&gt;0x4E	string	&gt;\0					\b, game &quot;%.32s&quot;

# Impulse tracker module (audio/x-it)
0	string		IMPM		Impulse Tracker module sound data -
!:mime	audio/x-mod
&gt;4	string		&gt;\0		&quot;%s&quot;
&gt;40	leshort		!0		compatible w/ITv%x
&gt;42	leshort		!0		created w/ITv%x

# Imago Orpheus module (audio/x-imf)
60	string		IM10		Imago Orpheus module sound data -
&gt;0	string		&gt;\0		&quot;%s&quot;

# From &lt;collver1@attbi.com&gt;
# These are the /etc/magic entries to decode modules, instruments, and
# samples in Impulse Tracker&#039;s native format.

0	string		IMPS		Impulse Tracker Sample
&gt;18	byte		&amp;2		16 bit
&gt;18	byte		^2		8 bit
&gt;18	byte		&amp;4		stereo
&gt;18	byte		^4		mono
0	string		IMPI		Impulse Tracker Instrument
&gt;28	leshort		!0		ITv%x
&gt;30	byte		!0		%d samples

# Yamaha TX Wave:  file(1) magic for Yamaha TX Wave audio files
# From &lt;collver1@attbi.com&gt;
0	string		LM8953		Yamaha TX Wave
&gt;22	byte		0x49		looped
&gt;22	byte		0xC9		non-looped
&gt;23	byte		1		33kHz
&gt;23	byte		2		50kHz
&gt;23	byte		3		16kHz

# scream tracker:  file(1) magic for Scream Tracker sample files
#
# From &lt;collver1@attbi.com&gt;
76	string		SCRS		Scream Tracker Sample
&gt;0	byte		1		sample
&gt;0	byte		2		adlib melody
&gt;0	byte		&gt;2		adlib drum
&gt;31	byte		&amp;2		stereo
&gt;31	byte		^2		mono
&gt;31	byte		&amp;4		16bit little endian
&gt;31	byte		^4		8bit
&gt;30	byte		0		unpacked
&gt;30	byte		1		packed

# audio
# From: Cory Dikkers &lt;cdikkers@swbell.net&gt;
0	string		MMD0		MED music file, version 0
0	string		MMD1		OctaMED Pro music file, version 1
0	string		MMD3		OctaMED Soundstudio music file, version 3
0	string		OctaMEDCmpr	OctaMED Soundstudio compressed file
0	string		MED		MED_Song
0	string		SymM		Symphonie SymMOD music file
#
0	string		THX		AHX version
&gt;3	byte		=0		1 module data
&gt;3	byte		=1		2 module data
#
0	string		OKTASONG	Oktalyzer module data
#
0	string		DIGI\ Booster\ module\0	%s
&gt;20	byte		&gt;0		%c
&gt;&gt;21	byte		&gt;0		\b%c
&gt;&gt;&gt;22	byte		&gt;0		\b%c
&gt;&gt;&gt;&gt;23	byte		&gt;0		\b%c
&gt;610	string		&gt;\0		\b, &quot;%s&quot;
#
0	string		DBM0	   	DIGI Booster Pro Module
&gt;4	byte		&gt;0		V%X.
&gt;&gt;5	byte		x		\b%02X
&gt;16	string		&gt;\0		\b, &quot;%s&quot;
#
0	string		FTMN		FaceTheMusic module
&gt;16	string		&gt;\0d		\b, &quot;%s&quot;

# From: &lt;doj@cubic.org&gt; 2003-06-24
0	string		AMShdr\32	Velvet Studio AMS Module v2.2
0	string		Extreme		Extreme Tracker AMS Module v1.3
0	string		DDMF		Xtracker DMF Module
&gt;4	byte		x		v%i
&gt;0xD	string		&gt;\0		Title: &quot;%s&quot;
&gt;0x2B	string		&gt;\0		Composer: &quot;%s&quot;
0	string		DSM\32		Dynamic Studio Module DSM
0	string		SONG		DigiTrekker DTM Module
0	string		DMDL		DigiTrakker MDL Module
0	string		PSM\32		Protracker Studio PSM Module
44	string		PTMF		Poly Tracker PTM Module
&gt;0	string		&gt;\32		Title: &quot;%s&quot;
0	string		MT20		MadTracker 2.0 Module MT2
0	string		RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
0	string		RTMM		RTM Module
0x426	string		MaDoKaN96	XMS Adlib Module
&gt;0	string		&gt;\0		Composer: &quot;%s&quot;
0	string		AMF		AMF Module
&gt;4	string		&gt;\0		Title: &quot;%s&quot;
0	string		MODINFO1	Open Cubic Player Module Inforation MDZ
0	string		Extended\40Instrument: Fast Tracker II Instrument

# From: Takeshi Hamasaki &lt;hma@syd.odn.ne.jp&gt;
# NOA Nancy Codec file
0	string		\210NOA\015\012\032	NOA Nancy Codec Movie file
# Yamaha SMAF format
0	string		MMMD		Yamaha SMAF file
# Sharp Jisaku Melody format for PDC
0	string		\001Sharp\040JisakuMelody	SHARP Cell-Phone ringing Melody
&gt;20	string		Ver01.00	Ver. 1.00
&gt;&gt;32	byte		x		, %d tracks

# Free lossless audio codec &lt;http://flac.sourceforge.net&gt;
# From: Przemyslaw Augustyniak &lt;silvathraec@rpg.pl&gt;
0	string			fLaC		FLAC audio bitstream data
!:mime	audio/flac
&gt;4	byte&amp;0x7f		&gt;0		\b, unknown version
&gt;4	byte&amp;0x7f		0		\b
# some common bits/sample values
&gt;&gt;20	beshort&amp;0x1f0		0x030		\b, 4 bit
&gt;&gt;20	beshort&amp;0x1f0		0x050		\b, 6 bit
&gt;&gt;20	beshort&amp;0x1f0		0x070		\b, 8 bit
&gt;&gt;20	beshort&amp;0x1f0		0x0b0		\b, 12 bit
&gt;&gt;20	beshort&amp;0x1f0		0x0f0		\b, 16 bit
&gt;&gt;20	beshort&amp;0x1f0		0x170		\b, 24 bit
&gt;&gt;20	byte&amp;0xe		0x0		\b, mono
&gt;&gt;20	byte&amp;0xe		0x2		\b, stereo
&gt;&gt;20	byte&amp;0xe		0x4		\b, 3 channels
&gt;&gt;20	byte&amp;0xe		0x6		\b, 4 channels
&gt;&gt;20	byte&amp;0xe		0x8		\b, 5 channels
&gt;&gt;20	byte&amp;0xe		0xa		\b, 6 channels
&gt;&gt;20	byte&amp;0xe		0xc		\b, 7 channels
&gt;&gt;20	byte&amp;0xe		0xe		\b, 8 channels
# sample rates derived from known oscillator frequencies;
# 24.576 MHz (video/fs=48kHz), 22.5792 (audio/fs=44.1kHz) and
# 16.384 (other/fs=32kHz).
&gt;&gt;17	belong&amp;0xfffff0       	0x02b110	\b, 11.025 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x03e800	\b, 16 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x056220	\b, 22.05 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x05dc00	\b, 24 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x07d000	\b, 32 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x0ac440	\b, 44.1 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x0bb800	\b, 48 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x0fa000	\b, 64 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x158880	\b, 88.2 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x177000	\b, 96 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x1f4000	\b, 128 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x2b1100	\b, 176.4 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x2ee000	\b, 192 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x3e8000	\b, 256 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x562200	\b, 352.8 kHz
&gt;&gt;17	belong&amp;0xfffff0       	0x5dc000	\b, 384 kHz
&gt;&gt;21	byte&amp;0xf		&gt;0		\b, &gt;4G samples
&gt;&gt;21	byte&amp;0xf		0		\b
&gt;&gt;&gt;22	belong			&gt;0		\b, %u samples
&gt;&gt;&gt;22	belong			0		\b, length unknown

# (ISDN) VBOX voice message file (Wolfram Kleff)
0       string          VBOX            VBOX voice message data

# ReBorn Song Files (.rbs)
# David J. Singer &lt;doc@deadvirgins.org.uk&gt;
8       string          RB40             RBS Song file
&gt;29     string          ReBorn           created by ReBorn
&gt;37     string          Propellerhead    created by ReBirth

# Synthesizer Generator and Kimwitu share their file format
0	string		A#S#C#S#S#L#V#3	    Synthesizer Generator or Kimwitu data
# Kimwitu++ uses a slightly different magic
0	string		A#S#C#S#S#L#HUB	    Kimwitu++ data

# From &quot;Simon Hosie
0       string  TFMX-SONG       TFMX module sound data

# Monkey&#039;s Audio compressed audio format (.ape)
# From danny.milo@gmx.net (Danny Milosavljevic)
# New version from Abel Cheung &lt;abel (@) oaka.org&gt;
0		string		MAC\040		Monkey&#039;s Audio compressed format
!:mime audio/x-ape
&gt;4		uleshort	&gt;0x0F8B		version %d
&gt;&gt;(0x08.l)	uleshort	=1000		with fast compression
&gt;&gt;(0x08.l)	uleshort	=2000		with normal compression
&gt;&gt;(0x08.l)	uleshort	=3000		with high compression
&gt;&gt;(0x08.l)	uleshort	=4000		with extra high compression
&gt;&gt;(0x08.l)	uleshort	=5000		with insane compression
&gt;&gt;(0x08.l+18)	uleshort	=1		\b, mono
&gt;&gt;(0x08.l+18)	uleshort	=2		\b, stereo
&gt;&gt;(0x08.l+20)	ulelong		x		\b, sample rate %d
&gt;4		uleshort	&lt;0x0F8C		version %d
&gt;&gt;6		uleshort	=1000		with fast compression
&gt;&gt;6		uleshort	=2000		with normal compression
&gt;&gt;6		uleshort	=3000		with high compression
&gt;&gt;6		uleshort	=4000		with extra high compression
&gt;&gt;6		uleshort	=5000		with insane compression
&gt;&gt;10		uleshort	=1		\b, mono
&gt;&gt;10		uleshort	=2		\b, stereo
&gt;&gt;12		ulelong		x		\b, sample rate %d

# adlib sound files
# From: Alex Myczko &lt;alex@aiei.ch&gt;
0    	string		RAWADATA	RdosPlay RAW

1068	string		RoR		AMUSIC Adlib Tracker

0	string		JCH		EdLib

0	string		mpu401tr	MPU-401 Trakker

0	string		SAdT		Surprise! Adlib Tracker
&gt;4	byte		x		Version %d

0	string		XAD!		eXotic ADlib

0	string		ofTAZ!		eXtra Simple Music

# Spectrum 128 tunes (.ay files).
# From: Emanuel Haupt &lt;ehaupt@critical.ch&gt;
0	string		ZXAYEMUL	Spectrum 128 tune

0	string		\0BONK		BONK,
#&gt;5	byte		x		version %d
&gt;14	byte		x		%d channel(s),
&gt;15	byte		=1		lossless,
&gt;15	byte		=0		lossy,
&gt;16	byte		x		mid-side

384	string		LockStream	LockStream Embedded file (mostly MP3 on old Nokia phones)

# format VQF (proprietary codec for sound)
# some infos on the header file available at :
# http://www.twinvq.org/english/technology_format.html
0	string		TWIN97012000	VQF data
&gt;27	short		0		\b, Mono
&gt;27	short		1		\b, Stereo
&gt;31	short 		&gt;0		\b, %d kbit/s
&gt;35	short 		&gt;0		\b, %d kHz

# Nelson A. de Oliveira (naoliv@gmail.com)
# .eqf
0	string	Winamp\ EQ\ library\ file	%s
# it will match only versions like v&lt;digit&gt;.&lt;digit&gt;
# Since I saw only eqf files with version v1.1 I think that it&#039;s OK
&gt;23	string	x	\b%.4s
# .preset
0	string	[Equalizer\ preset]	XMMS equalizer preset
# .m3u
0	search/1	#EXTM3U 	M3U playlist text
# .pls
0	search/1	[playlist]	PLS playlist text
# licq.conf
1	string	[licq]			LICQ configuration file

# Atari ST audio files by Dirk Jagdmann &lt;doj@cubic.org&gt;
0	string		ICE!		SNDH Atari ST music
0	string		SC68\ Music-file\ /\ (c)\ (BeN)jami	sc68 Atari ST music

# musepak support From: &quot;Jiri Pejchal&quot; &lt;jiri.pejchal@gmail.com&gt;
0       string          MP+     Musepack audio (MP+)
!:mime	audio/x-musepack
&gt;3      byte            255     \b, SV pre8
&gt;3      byte&amp;0xF        0x6     \b, SV 6
&gt;3      byte&amp;0xF        0x8     \b, SV 8
&gt;3      byte&amp;0xF        0x7     \b, SV 7
&gt;&gt;3     byte&amp;0xF0       0x0     \b.0
&gt;&gt;3     byte&amp;0xF0       0x10    \b.1
&gt;&gt;3     byte&amp;0xF0       240     \b.15
&gt;&gt;10    byte&amp;0xF0       0x0     \b, no profile
&gt;&gt;10    byte&amp;0xF0       0x10    \b, profile &#039;Unstable/Experimental&#039;
&gt;&gt;10    byte&amp;0xF0       0x50    \b, quality 0
&gt;&gt;10    byte&amp;0xF0       0x60    \b, quality 1
&gt;&gt;10    byte&amp;0xF0       0x70    \b, quality 2 (Telephone)
&gt;&gt;10    byte&amp;0xF0       0x80    \b, quality 3 (Thumb)
&gt;&gt;10    byte&amp;0xF0       0x90    \b, quality 4 (Radio)
&gt;&gt;10    byte&amp;0xF0       0xA0    \b, quality 5 (Standard)
&gt;&gt;10    byte&amp;0xF0       0xB0    \b, quality 6 (Xtreme)
&gt;&gt;10    byte&amp;0xF0       0xC0    \b, quality 7 (Insane)
&gt;&gt;10    byte&amp;0xF0       0xD0    \b, quality 8 (BrainDead)
&gt;&gt;10    byte&amp;0xF0       0xE0    \b, quality 9
&gt;&gt;10    byte&amp;0xF0       0xF0    \b, quality 10
&gt;&gt;27    byte            0x0     \b, Buschmann 1.7.0-9, Klemm 0.90-1.05
&gt;&gt;27    byte            102     \b, Beta 1.02
&gt;&gt;27    byte            104     \b, Beta 1.04
&gt;&gt;27    byte            105     \b, Alpha 1.05
&gt;&gt;27    byte            106     \b, Beta 1.06
&gt;&gt;27    byte            110     \b, Release 1.1
&gt;&gt;27    byte            111     \b, Alpha 1.11
&gt;&gt;27    byte            112     \b, Beta 1.12
&gt;&gt;27    byte            113     \b, Alpha 1.13
&gt;&gt;27    byte            114     \b, Beta 1.14
&gt;&gt;27    byte            115     \b, Alpha 1.15

0       string          MPCK    Musepack audio (MPCK)
!:mime	audio/x-musepack

# IMY
# from http://filext.com/detaillist.php?extdetail=IMY
# http://cellphones.about.com/od/cellularfaqs/f/rf_imelody.htm
# http://download.ncl.ie/doc/api/ie/ncl/media/music/IMelody.html
# http://www.wx800.com/msg/download/irda/iMelody.pdf
0	string	BEGIN:IMELODY	iMelody Ringtone Format

# From: &quot;Mateus Caruccio&quot; &lt;mateus@caruccio.com&gt;
# guitar pro v3,4,5 from http://filext.com/file-extension/gp3
0	string	\030FICHIER\ GUITAR\ PRO\ v3.	Guitar Pro Ver. 3 Tablature

# From: &quot;Leslie P. Polzer&quot; &lt;leslie.polzer@gmx.net&gt;
60	string	SONG		SoundFX Module sound file

# Type: Adaptive Multi-Rate Codec
# URL:  http://filext.com/detaillist.php?extdetail=AMR
# From: Russell Coker &lt;russell@coker.com.au&gt;
0	string	#!AMR		Adaptive Multi-Rate Codec (GSM telephony)

# Type: SuperCollider 3 Synth Definition File Format
# From: Mario Lang &lt;mlang@debian.org&gt;
0	string	SCgf	SuperCollider3 Synth Definition file,
&gt;4	belong	x	version %d

# Type: True Audio Lossless Audio
# URL:  http://wiki.multimedia.cx/index.php?title=True_Audio
# From: Mike Melanson &lt;mike@multimedia.cx&gt;
0	string	TTA1	True Audio Lossless Audio

# Type: WavPack Lossless Audio
# URL:  http://wiki.multimedia.cx/index.php?title=WavPack
# From: Mike Melanson &lt;mike@multimedia.cx&gt;
0	string	wvpk	WavPack Lossless Audio

# From Fabio R. Schmidlin &lt;frs@pop.com.br&gt;
# VGM music file
0	string		Vgm\040
&gt;9	ubyte		&gt;0	VGM Video Game Music dump v
&gt;&gt;9	ubyte/16	&gt;0	\b%d
&gt;&gt;9	ubyte&amp;0x0F	x	\b%d
&gt;&gt;8	ubyte/16	x	\b.%d
&gt;&gt;8	ubyte&amp;0x0F	&gt;0	\b%d
#Get soundchips
&gt;&gt;8	ubyte		x	\b, soundchip(s)=
&gt;&gt;0x0C	ulelong		&gt;0	SN76489,
&gt;&gt;0x10	ulelong		&gt;0	YM2413,
&gt;&gt;0x2C	ulelong		&gt;0	YM2612,
&gt;&gt;0x30	ulelong		&gt;0	YM2151,
&gt;&gt;0x38	ulelong		&gt;0	Sega PCM,
&gt;&gt;0x34	ulelong		&gt;0xC
&gt;&gt;&gt;0x40	ulelong		&gt;0	RF5C68,
&gt;&gt;0x34	ulelong		&gt;0x10
&gt;&gt;&gt;0x44	ulelong		&gt;0	YM2203,
&gt;&gt;0x34	ulelong		&gt;0x14
&gt;&gt;&gt;0x48	ulelong		&gt;0	YM2608,
&gt;&gt;0x34	ulelong		&gt;0x18
&gt;&gt;&gt;0x4C	lelong		&gt;0	YM2610,
&gt;&gt;&gt;0x4C	lelong		&lt;0	YM2610B,
&gt;&gt;0x34	ulelong		&gt;0x1C
&gt;&gt;&gt;0x50	ulelong		&gt;0	YM3812,
&gt;&gt;0x34	ulelong		&gt;0x20
&gt;&gt;&gt;0x54	ulelong		&gt;0	YM3526,
&gt;&gt;0x34	ulelong		&gt;0x24
&gt;&gt;&gt;0x58	ulelong		&gt;0	Y8950,
&gt;&gt;0x34	ulelong		&gt;0x28
&gt;&gt;&gt;0x5C	ulelong		&gt;0	YMF262,
&gt;&gt;0x34	ulelong		&gt;0x2C
&gt;&gt;&gt;0x60	ulelong		&gt;0	YMF278B,
&gt;&gt;0x34	ulelong		&gt;0x30
&gt;&gt;&gt;0x64	ulelong		&gt;0	YMF271,
&gt;&gt;0x34	ulelong		&gt;0x34
&gt;&gt;&gt;0x68	ulelong		&gt;0	YMZ280B,
&gt;&gt;0x34	ulelong		&gt;0x38
&gt;&gt;&gt;0x6C	ulelong		&gt;0	RF5C164,
&gt;&gt;0x34	ulelong		&gt;0x3C
&gt;&gt;&gt;0x70	ulelong		&gt;0	PWM,
&gt;&gt;0x34	ulelong		&gt;0x40
&gt;&gt;&gt;0x74	ulelong		&gt;0
&gt;&gt;&gt;&gt;0x78 ubyte		0x00	AY-3-8910,
&gt;&gt;&gt;&gt;0x78 ubyte		0x01	AY-3-8912,
&gt;&gt;&gt;&gt;0x78 ubyte		0x02	AY-3-8913,
&gt;&gt;&gt;&gt;0x78 ubyte		0x03	AY-3-8930,
&gt;&gt;&gt;&gt;0x78 ubyte		0x10	YM2149,
&gt;&gt;&gt;&gt;0x78 ubyte		0x11	YM3439,

# GVOX Encore file format
# Since this is a proprietary file format and there is no publicly available
# format specification, this is just based on induction
#
0	string	SCOW
&gt;4	byte	0xc4	GVOX Encore music, version 5.0 or above
&gt;4	byte	0xc2	GVOX Encore music, version &lt; 5.0

0	string	ZBOT
&gt;4	byte	0xc5	GVOX Encore music, version &lt; 5.0

# Summary:	Garmin Voice Processing Module (WAVE audios)
# From:		Joerg Jenderek
# URL:		http://www.garmin.com/
# Reference:	http://turboccc.wikispaces.com/share/view/28622555
# NOTE:		there exist 2 other Garmin VPM formats
0		string	AUDIMG
# skip text files starting with string &quot;AUDIMG&quot;
&gt;13		ubyte		&lt;13	Garmin Voice Processing Module
!:mime	audio/x-vpm-wav-garmin
!:ext	vpm
# 3 bytes indicating the voice version (200,220)
&gt;&gt;6		string		x	\b, version %3.3s
# day of release (01-31)
&gt;&gt;12		ubyte		x	\b, %.2d
# month of release (01-12)
&gt;&gt;13		ubyte		x	\b.%.2d
# year of release (like 2006, 2007, 2008)
&gt;&gt;14		uleshort	x	\b.%.4d
# hour of release (0-23)
&gt;&gt;11		ubyte		x	%.2d
# minute of release (0-59)
&gt;&gt;10		ubyte		x	\b:%.2d
# second of release (0-59)
&gt;&gt;9		ubyte		x	\b:%.2d
# if you select a language like german on your garmin device
# you can only select voice modules with corresponding language byte ID like 1
&gt;&gt;18		ubyte		x	\b, language ID %d
# pointer to 1st audio WAV sample
&gt;&gt;16		uleshort	&gt;0
&gt;&gt;&gt;(16.s)	ulelong		&gt;0	\b, at offset 0x%x
# WAV length
&gt;&gt;&gt;&gt;(16.s+4)	ulelong		&gt;0	%d Bytes
# look for magic
&gt;&gt;&gt;&gt;&gt;(&amp;-8.l)	string		RIFF
# determine type by ./riff
&gt;&gt;&gt;&gt;&gt;&gt;&amp;-4	indirect	x	\b
# 2 - ~ 131 WAV samples following same way

# From Martin Mueller Skarbiniks Pedersen
0		string		GDM
&gt;0x3		byte		0xFE	General Digital Music.
&gt;0x4		string		&gt;\0	title: &quot;%s&quot;
&gt;0x24		string		&gt;\0	musician: &quot;%s&quot;
&gt;&gt;0x44		beshort		0x0D0A
&gt;&gt;&gt;0x46		byte		0x1A
&gt;&gt;&gt;&gt;0x47	string		GMFS	Version
&gt;&gt;&gt;&gt;0x4B	byte		x	%d.
&gt;&gt;&gt;&gt;0x4C	byte		x	\b%02d
&gt;&gt;&gt;&gt;0x4D	beshort		0x000	(2GDM v
&gt;&gt;&gt;&gt;0x4F	byte		x	\b%d.
&gt;&gt;&gt;&gt;&gt;0x50	byte		x	\b%d)

0		string		MTM	Multitracker
&gt;0x3		byte/16		x	Version %d.
&gt;0x3		byte&amp;0x0F	x	\b%02d
&gt;&gt;0x4		string		&gt;\0	title: &quot;%s&quot;

0		string		HVL
&gt;3		byte		&lt;2	Hively Tracker Song
&gt;3		byte		0	1 module data
&gt;3		byte		1	2 module data

0		string		MO3
&gt;3		ubyte		&lt;6	MOdule with MP3
&gt;&gt;3		byte		0	Version	0	(With MP3 and lossless)
&gt;&gt;3		byte		1	Version	1	(With ogg and lossless)
&gt;&gt;3		byte		3	Version 2.2
&gt;&gt;3		byte		4	(With no LAME header)
&gt;&gt;3		byte		5	Version 2.4

0		string		ADRVPACK	AProSys	module

# ftp://ftp.modland.com/pub/documents/format_documentation/\
# Art%20Of%20Noise%20(.aon).txt
0		string		AON
&gt;4		string		&quot;ArtOfNoise by Bastian Spiegel(twice/lego)&quot;
&gt;0x2e		string		NAME	Art of Noise Tracker Song
&gt;3		string		&lt;9
&gt;3		string		4	(4 voices)
&gt;3		string		8	(8 voices)
&gt;&gt;0x36		string		&gt;\0	Title: &quot;%s&quot;

0		string		FAR
&gt;0x2c		byte		0x0d
&gt;0x2d		byte		0x0a
&gt;0x2e		byte		0x1a
&gt;&gt;0x3		byte		0xFE	Farandole Tracker Song
&gt;&gt;&gt;0x31		byte/16		x	Version %d.
&gt;&gt;&gt;0x31		byte&amp;0x0F	x	\b%02d
&gt;&gt;&gt;&gt;0x4		string		&gt;\0	\b, title: &quot;%s&quot;

# magic for Klystrack, http://kometbomb.github.io/klystrack/
# from Alex Myczko &lt;alex@aiei.ch&gt;
0	string	cyd!song	Klystrack song
&gt;8	byte	&gt;0		\b, version %u
&gt;8	byte	&gt;26
#&gt;&gt;9	byte	x		\b, channels %u
#&gt;&gt;10	leshort	x		\b, time signature %u
#&gt;&gt;12	leshort	x		\b, sequence step %u
#&gt;&gt;14	byte	x		\b, instruments %u
#&gt;&gt;15	leshort	x		\b, patterns %u
#&gt;&gt;17	leshort	x		\b, sequences %u
#&gt;&gt;19	leshort	x		\b, length %u
#&gt;&gt;21	leshort	x		\b, loop point %u
#&gt;&gt;23	byte	x		\b, master volume %u
#&gt;&gt;24	byte	x		\b, song speed %u
#&gt;&gt;25	byte	x		\b, song speed2 %u
#&gt;&gt;26	byte	x		\b, song rate %u
#&gt;&gt;27	belong	x		\b, flags %#x
#&gt;&gt;31	byte	x		\b, multiplex period %u
#&gt;&gt;32	byte	x		\b, pitch inaccuracy %u
&gt;&gt;149	pstring	x		\b, title %s

0	string	cyd!inst	Klystrack instrument

# magic for WOPL instrument files, https://github.com/Wohlstand/OPL3BankEditor
# see Specifications/WOPL-and-OPLI-Specification.txt

0	string	WOPL3-INST\0	WOPL instrument
&gt;11	leshort	x	\b, version %u
0	string	WOPL3-BANK\0	WOPL instrument bank
&gt;11	leshort	x	\b, version %u

# AdLib/OPL instrument files. Format specifications on
#  http://www.shikadi.net/moddingwiki
0	string	Junglevision\ Patch\ File	Junglevision instrument data
0	string	#OPL_II#	DMX OP2 instrument data
0	string	IBK\x1a		IBK instrument data
0	string	2OP\x1a		IBK instrument data, 2 operators
0	string	4OP\x1a		IBK instrument data, 4 operators
2	string	ADLIB-		AdLib instrument data
&gt;0	byte	x		\b, version %u
&gt;1	byte	x		\b.%u

#----------------------------------------------------------------
# $File: basis,v 1.4 2009/09/19 16:28:08 christos Exp $
# basis: file(1) magic for BBx/Pro5-files
#      Oliver Dammer &lt;dammer@olida.de&gt;	 2005/11/07
# http://www.basis.com business-basic-files.
#
0	string		\074\074bbx\076\076	BBx
&gt;7	string		\000			indexed file
&gt;7	string		\001			serial file
&gt;7	string		\002			keyed file
&gt;&gt;13	short		0			(sort)
&gt;7	string		\004			program
&gt;&gt;18	byte		x			(LEVEL %d)
&gt;&gt;&gt;23	string		&gt;\000			psaved
&gt;7	string		\006			mkeyed file
&gt;&gt;13	short		0			(sort)
&gt;&gt;8	string		\000			(mkey)
#------------------------------------------------------------------------------
# $File: beetle,v 1.2 2018/02/05 23:42:17 rrt Exp $
# beetle:  file(1) magic for Beetle VM object files
# https://github.com/rrthomas/beetle/

# Beetle object module
0	string		BEETLE\000	Beetle VM object file

#------------------------------------------------------------------------------
# $File: ber,v 1.1 2016/06/05 00:21:30 christos Exp $
# ber:  file(1) magic for several BER formats used in the mobile
# telecommunications industry (Georg Sauthoff)

# The file formats are standardized by the GSMA (GSM association).
# They are specified via ASN.1 schemas and some prose. Basic encoding
# rules (BER) is the used encoding. The formats are used for exchanging
# call data records (CDRs) between mobile operators and associated
# parties for roaming clearing purposes and fraud detection.

# The magic file covers:

# - TAP files (TD.57) - CDR batches and notifications
# - RAP files (TD.32) - return batches and acknowledgements
# - NRT files (TD.35) - CDR batches for &#039;near real time&#039; processing

#
# TAP 3 Files
# TAP -&gt; Transferred Account Procedure
# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.57-v32.31.pdf
# TransferBatch short tag
0	byte	0x61
# BatchControlInfo short tag
&gt;&amp;1	search/b5	\x64
# Sender long tag #TAP 3.x (BER encoded)
&gt;&gt;&amp;1	search/b8	\x5f\x81\x44
# &lt;SpecificationVersionNumber&gt;3&lt;/&gt;&lt;ReleaseVersionNumber&gt; block
&gt;&gt;&gt;&amp;64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
&gt;&gt;&gt;&gt;&amp;0	byte	x	TAP 3.%d Batch (TD.57, Transferred Account)

# Notification short tag
0	byte	0x62
# Sender long tag
&gt;2	search/b8	\x5f\x81\x44
# &lt;SpecificationVersionNumber&gt;3&lt;/&gt;&lt;ReleaseVersionNumber&gt; block
&gt;&gt;&amp;64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
&gt;&gt;&gt;&amp;0	byte	x	TAP 3.%d Notification (TD.57, Transferred Account)


# NRT Files
# NRT a.k.a. NRTRDE
0	byte	0x61
# &lt;SpecificationVersionNumber&gt;2&lt;/&gt;&lt;ReleaseVersionNumber&gt; block
&gt;&amp;1	search/b8 \x5f\x29\x01\x02\x5f\x25\x01
&gt;&gt;&amp;0	byte	x	NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange)

# RAP Files
# cf. http://www.gsma.com/newsroom/wp-content/uploads/TD.32-v6.11.pdf
# Long ReturnBatch tag
0	string	\x7f\x84\x16
# Long RapBatchControlInfo tag
&gt;&amp;1	search/b8	\x7f\x84\x19
# &lt;SpecificationVersionNumber&gt;3&lt;/&gt;&lt;ReleaseVersionNumber&gt; block
&gt;&gt;&amp;64	search/b64	\x5f\x81\x49\x01\x03\x5f\x81\x3d\x01
# &lt;RapSpecificationVersionNumber&gt;1&lt;/&gt;&lt;RapReleaseVersionNumber&gt; block
&gt;&gt;&gt;&amp;1	string/b	\x5f\x84\x20\x01\x01\x5f\x84\x1f\x01
&gt;&gt;&gt;&gt;&amp;0	byte	x	RAP 1.%d Batch (TD.32, Returned Account Procedure),
&gt;&gt;&gt;&amp;0	byte	x	TAP 3.%d

# Long Acknowledgement tag
0	string \x7f\x84\x17
# Long Sender tag
&gt;&amp;1	search/b5	\x5f\x81\x44	RAP Acknowledgement (TD.32, Returned Account Procedure)

#------------------------------------------------------------------------------
# $File: bflt,v 1.5 2014/04/30 21:41:02 christos Exp $
# bFLT: file(1) magic for BFLT uclinux binary files
#
# From Philippe De Muyter &lt;phdm@macqel.be&gt;
#
0	string		bFLT		BFLT executable
&gt;4	belong		x		- version %d
&gt;4	belong		4
&gt;&gt;36	belong&amp;0x1	0x1		ram
&gt;&gt;36	belong&amp;0x2	0x2		gotpic
&gt;&gt;36	belong&amp;0x4	0x4		gzip
&gt;&gt;36	belong&amp;0x8	0x8		gzdata

#------------------------------------------------------------------------------
# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $
# BlockHashLoc
# ext: bhl
# Marco Pontello marcopon@gmail.com
# reference: https://github.com/MarcoPon/BlockHashLoc
0	string	BlockHashLoc\x1a	BlockHashLoc recovery info,
&gt;13	byte	x			version %d
!:ext   bhl

#------------------------------------------------------------------------------
# $File: bioinformatics,v 1.4 2016/06/20 16:13:46 christos Exp $
# bioinfomatics:  file(1) magic for Bioinfomatics file formats

###############################################################################
# BGZF (Blocked GNU Zip Format) - gzip compatible, but also indexable
# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
###############################################################################
0	string		\037\213
&gt;3	byte		&amp;0x04
&gt;&gt;12	string		BC
&gt;&gt;&gt;14	leshort		&amp;0x02	Blocked GNU Zip Format (BGZF; gzip compatible)
&gt;&gt;&gt;&gt;16	leshort		x	\b, block length %d
!:mime	application/x-gzip


###############################################################################
# Tabix index file
# used by SAMtools bgzip/tabix (http://samtools.sourceforge.net/tabix.shtml)
###############################################################################
0	string	TBI\1		SAMtools TBI (Tabix index format)
&gt;0x04	lelong	=1		\b, with %d reference sequence
&gt;0x04	lelong	&gt;1		\b, with %d reference sequences
&gt;0x08	lelong	&amp;0x10000	\b, using half-closed-half-open coordinates (BED style)
&gt;0x08	lelong	^0x10000
&gt;&gt;0x08	lelong	=0		\b, using closed and one based coordinates (GFF style)
&gt;&gt;0x08	lelong	=1		\b, using SAM format
&gt;&gt;0x08	lelong	=2		\b, using VCF format
&gt;0x0c	lelong	x		\b, sequence name column: %d
&gt;0x10	lelong	x		\b, region start column: %d
&gt;0x08	lelong	=0
&gt;&gt;0x14	lelong	x		\b, region end column: %d
&gt;0x18	byte	x		\b, comment character: %c
&gt;0x1c	lelong	x		\b, skip line count: %d


###############################################################################
# BAM (Binary Sequence Alignment/Map format)
# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
###############################################################################
0	string	BAM\1	SAMtools BAM (Binary Sequence Alignment/Map)
&gt;0x04	lelong	&gt;0
&gt;&gt;&amp;0x00 regex	=^[@]HD\t.*VN:		\b, with SAM header
&gt;&gt;&gt;&amp;0	regex	=[0-9.]+		\b version %s
&gt;&gt;&amp;(0x04)	lelong	&gt;0	\b, with %d reference sequences


###############################################################################
# BAI (BAM indexing format)
# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
###############################################################################
0		string	BAI\1	SAMtools BAI (BAM indexing format)
&gt;0x04		lelong	&gt;0	\b, with %d reference sequences


###############################################################################
# CRAM (Binary Sequence Alignment/Map format)
###############################################################################
0	string	CRAM	CRAM
&gt;0x04	byte	&gt;-1	version %d.
&gt;0x05	byte	&gt;-1	\b%d
&gt;0x06	string	&gt;\0	(identified as %s)


###############################################################################
# BCF (Binary Call Format), version 1
# used by SAMtools &amp; VCFtools (http://vcftools.sourceforge.net/bcf.pdf)
# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
###############################################################################
0		string	   BCF\4
# length of seqnm data in bytes is positive
&gt;&amp;0x00		lelong	  &gt;0
# length of smpl data in bytes is positive
&gt;&gt;&amp;(&amp;-0x04)	lelong	  &gt;0			SAMtools BCF (Binary Call Format)
# length of meta in bytes
&gt;&gt;&gt;&amp;(&amp;-0x04)	lelong	  &gt;0
# have meta text string
&gt;&gt;&gt;&gt;&amp;0x00	search	  ##samtoolsVersion=
&gt;&gt;&gt;&gt;&gt;&amp;0x00	string	  x			\b, generated by SAMtools version %s


###############################################################################
# BCF (Binary Call Format), version 2.1
# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf)
# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
###############################################################################
0		string	   BCF\2\1    Binary Call Format (BCF) version 2.1
# length of header text
&gt;&amp;0x00		lelong	  &gt;0
# have header string
&gt;&gt;&amp;0x00 search	  ##samtoolsVersion=
&gt;&gt;&gt;&amp;0x00	string	  x			\b, generated by SAMtools version %s


###############################################################################
# BCF (Binary Call Format), version 2.2
# used by SAMtools (http://samtools.github.io/hts-specs/BCFv2_qref.pdf)
# data is normally present only within compressed BGZF blocks (CDATA), so use file -z to examine it
###############################################################################
0		string	   BCF\2\2    Binary Call Format (BCF) version 2.2
# length of header text
&gt;&amp;0x00		lelong	  &gt;0
# have header string
&gt;&gt;&amp;0x00 search	  ##samtoolsVersion=
&gt;&gt;&gt;&amp;0x00	string	  x			\b, generated by SAMtools version %s

###############################################################################
# VCF (Variant Call Format)
# used by VCFtools (http://vcftools.sourceforge.net/)
###############################################################################
0      search	   ##fileformat=VCFv	Variant Call Format (VCF)
&gt;&amp;0    string	   x			\b version %s

###############################################################################
# FASTQ
# used by MAQ (http://maq.sourceforge.net/fastq.shtml)
###############################################################################
# XXX Broken?
# @&lt;seqname&gt;
#0	regex	=^@[A-Za-z0-9_.:-]+\?\n
# &lt;seq&gt;
#&gt;&amp;1	regex	=^[A-Za-z\n.~]++
# +[&lt;seqname&gt;]
#&gt;&gt;&amp;1	regex	=^[A-Za-z0-9_.:-]*\?\n
# &lt;qual&gt;
#&gt;&gt;&gt;&amp;1	regex	=^[!-~\n]+\n		FASTQ

###############################################################################
# FASTA
# used by FASTA (http://fasta.bioch.virginia.edu/fasta_www2/fasta_guide.pdf)
###############################################################################
#0	byte	0x3e
# q&gt;0	regex	=^[&gt;][!-~\t\ ]+$
# Amino Acid codes: [A-IK-Z*-]+
#&gt;&gt;1	regex	!=[!-&#039;Jj;:=?@^`|~\\]		FASTA
# IUPAC codes/gaps: [ACGTURYKMSWBDHVNX-]+
# not in IUPAC codes/gaps: [EFIJLOPQZ]
#&gt;&gt;&gt;1	regex	!=[EFIJLOPQZefijlopqz]		\b, with IUPAC nucleotide codes
#&gt;&gt;&gt;1	regex	=^[EFIJLOPQZefijlopqz]+$	\b, with Amino Acid codes

###############################################################################
# SAM (Sequence Alignment/Map format)
# used by SAMtools (http://samtools.sourceforge.net/SAM1.pdf)
###############################################################################
# Short-cut version to recognise SAM files with (optional) header at beginning
###############################################################################
0      string	   @HD\t
&gt;4     search	   VN:		Sequence Alignment/Map (SAM), with header
&gt;&gt;&amp;0   regex	   [0-9.]+	\b version %s
###############################################################################
# Longer version to recognise SAM alignment lines using (many) regexes
###############################################################################
# SAM Alignment QNAME
0		regex	=^[!-?A-~]{1,255}(\t[^\t]+){11}
# SAM Alignment FLAG
&gt;0		regex	=^([^\t]+\t){1}[0-9]{1,5}\t
# SAM Alignment RNAME
&gt;&gt;0		regex	=^([^\t]+\t){2}\\*|[^*=]*\t
# SAM Alignment POS
&gt;&gt;&gt;0		regex	=^([^\t]+\t){3}[0-9]{1,9}\t
# SAM Alignment MAPQ
&gt;&gt;&gt;&gt;0		regex	=^([^\t]+\t){4}[0-9]{1,3}\t
# SAM Alignment CIGAR
&gt;&gt;&gt;&gt;&gt;0		regex	=\t(\\*|([0-9]+[MIDNSHPX=])+)\t
# SAM Alignment RNEXT
&gt;&gt;&gt;&gt;&gt;&gt;0		regex	=\t(\\*|=|[!-()+-&gt;?-~][!-~]*)\t
# SAM Alignment PNEXT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	regex	=^([^\t]+\t){7}[0-9]{1,9}\t
# SAM Alignment TLEN
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	regex	=\t[+-]{0,1}[0-9]{1,9}\t.*\t
# SAM Alignment SEQ
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	regex	=^([^\t]+\t){9}(\\*|[A-Za-z=.]+)\t
# SAM Alignment QUAL
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	regex	=^([^\t]+\t){10}[!-~]+	Sequence Alignment/Map (SAM)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	regex	=^[@]HD\t.*VN:		\b, with header
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	regex	=[0-9.]+		\b version %s

#------------------------------------------------------------------------------
# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
# blackberry:  file(1) magic for BlackBerry file formats
#
5	belong	0
&gt;8	belong  010010010	BlackBerry RIM ETP file
&gt;&gt;22	string	x		\b for %s
# Berkeley Lab Checkpoint Restart (BLCR) checkpoint context files
# http://ftg.lbl.gov/checkpoint
0	string	C\0\0\0R\0\0\0	BLCR
&gt;16	lelong	1	x86
&gt;16	lelong	3	alpha
&gt;16	lelong	5	x86-64
&gt;16	lelong	7	ARM
&gt;8	lelong	x	context data (little endian, version %d)
# Uncomment the following only of your &quot;file&quot; program supports &quot;search&quot;
#&gt;0	search/1024	VMA\06	for kernel
#&gt;&gt;&amp;1	byte	x	%d.
#&gt;&gt;&amp;2	byte	x	%d.
#&gt;&gt;&amp;3	byte	x	%d
0	string	\0\0\0C\0\0\0R	BLCR
&gt;16	belong	2	SPARC
&gt;16	belong	4	ppc
&gt;16	belong	6	ppc64
&gt;16	belong	7	ARMEB
&gt;16	belong	8	SPARC64
&gt;8	belong	x	context data (big endian, version %d)
# Uncomment the following only of your &quot;file&quot; program supports &quot;search&quot;
#&gt;0	search/1024	VMA\06	for kernel
#&gt;&gt;&amp;1	byte	x	%d.
#&gt;&gt;&amp;2	byte	x	\b%d.
#&gt;&gt;&amp;3	byte	x	\b%d

#------------------------------------------------------------------------------
# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $
# blender: file(1) magic for Blender 3D related files
#
# Native format rule v1.2. For questions use the developers list
# http://lists.blender.org/mailman/listinfo/bf-committers
# GLOB chunk was moved near start and provides subversion info since 2.42

0		string	=BLENDER	Blender3D,
&gt;7		string	=_		saved as 32-bits
&gt;&gt;8		string	=v		little endian
&gt;&gt;&gt;9		byte	x		with version %c.
&gt;&gt;&gt;10		byte	x		\b%c
&gt;&gt;&gt;11		byte	x		\b%c
&gt;&gt;&gt;0x40		string	=GLOB		\b.
&gt;&gt;&gt;&gt;0x58	leshort	x		\b%.4d
&gt;&gt;8		string	=V		big endian
&gt;&gt;&gt;9		byte	x		with version %c.
&gt;&gt;&gt;10		byte	x		\b%c
&gt;&gt;&gt;11		byte	x		\b%c
&gt;&gt;&gt;0x40		string	=GLOB		\b.
&gt;&gt;&gt;&gt;0x58	beshort	x		\b%.4d
&gt;7		string	=-		saved as 64-bits
&gt;&gt;8		string	=v		little endian
&gt;&gt;9		byte	x		with version %c.
&gt;&gt;10		byte	x		\b%c
&gt;&gt;11		byte	x		\b%c
&gt;&gt;0x44		string	=GLOB		\b.
&gt;&gt;&gt;0x60		leshort	x		\b%.4d
&gt;&gt;8		string	=V		big endian
&gt;&gt;&gt;9		byte	x		with version %c.
&gt;&gt;&gt;10		byte	x		\b%c
&gt;&gt;&gt;11		byte	x		\b%c
&gt;&gt;&gt;0x44		string	=GLOB		\b.
&gt;&gt;&gt;&gt;0x60	beshort	x		\b%.4d

# Scripts that run in the embedded Python interpreter
0		string	#!BPY		Blender3D BPython script

#------------------------------------------------------------------------------
# $File: blit,v 1.8 2009/09/19 16:28:08 christos Exp $
# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with &quot;be&quot; and &quot;le&quot;, so that it works on
# little-endian machines as well?  If so, what&#039;s the deal with
# &quot;VAX-order&quot; and &quot;VAX-order2&quot;?
#
#0	long		0407		68K Blit (standalone) executable
#0	short		0407		VAX-order2 68K Blit (standalone) executable
0	short		03401		VAX-order 68K Blit (standalone) executable
0	long		0406		68k Blit mpx/mux executable
0	short		0406		VAX-order2 68k Blit mpx/mux executable
0	short		03001		VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0	short		0520		tty630 layers executable

#------------------------------------------------------------------------------
# $File: bout,v 1.5 2009/09/19 16:28:08 christos Exp $
# i80960 b.out objects and archives
#
0	long		0x10d		i960 b.out relocatable object
&gt;16	long		&gt;0		not stripped
#
# b.out archive (hp-rt on i960)
0	string		=!&lt;bout&gt;	b.out archive
&gt;8	string		__.SYMDEF	random library

#------------------------------------------------------------------------------
# $File: bsdi,v 1.7 2014/03/29 15:40:34 christos Exp $
# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
# Some object/executable formats use the same magic numbers as are used
# in other OSes; those are handled by entries in aout.
#

0	lelong		0314		386 compact demand paged pure executable
&gt;16	lelong		&gt;0		not stripped
&gt;32	byte		0x6a		(uses shared libs)

# same as in SunOS 4.x, except for static shared libraries
0	belong&amp;077777777	0600413		SPARC demand paged
&gt;0	byte		&amp;0x80
&gt;&gt;20	belong		&lt;4096		shared library
&gt;&gt;20	belong		=4096		dynamically linked executable
&gt;&gt;20	belong		&gt;4096		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped
&gt;36	belong		0xb4100001	(uses shared libs)

0	belong&amp;077777777	0600410		SPARC pure
&gt;0	byte		&amp;0x80		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped
&gt;36	belong		0xb4100001	(uses shared libs)

0	belong&amp;077777777	0600407		SPARC
&gt;0	byte		&amp;0x80		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped
&gt;36	belong		0xb4100001	(uses shared libs)
# Chiasmus is a encryption standard developed by the German Federal
# Office for Information Security (Bundesamt fuer Sicherheit in der
# Informationstechnik).

# Extension: .xia
0	string	XIA1	Chiasmus encrypted data

# Extension: .xis
0	string	XIS	Chiasmus key

#------------------------------------------------------------------------------
# $File: btsnoop,v 1.5 2009/09/19 16:28:08 christos Exp $
# BTSnoop:  file(1) magic for BTSnoop files
#
# From &lt;marcel@holtmann.org&gt;
0	string		btsnoop\0		BTSnoop
&gt;8	belong		x			version %d,
&gt;12	belong		1001			Unencapsulated HCI
&gt;12	belong		1002			HCI UART (H4)
&gt;12	belong		1003			HCI BCSP
&gt;12	belong		1004			HCI Serial (H5)
&gt;&gt;12	belong		x			type %d
#------------------------------------------------------------------------------
# $File: c-lang,v 1.26 2017/08/14 07:40:38 christos Exp $
# c-lang:  file(1) magic for C and related languages programs
#
# The strength is to beat standard HTML

# BCPL
0	search/8192	&quot;libhdr&quot;	BCPL source text
!:mime	text/x-bcpl
0	search/8192	&quot;LIBHDR&quot;	BCPL source text
!:mime	text/x-bcpl

# C
# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength
0	regex	\^#include			C
&gt;0	regex	\^class[[:space:]]+
&gt;&gt;&amp;0	regex 	\\{[\.\*]\\}(;)?$			\b++
&gt;&amp;0	clear	x				source text
!:strength + 13
!:mime	text/x-c
0	regex	\^#[[:space:]]*pragma	C source text
!:mime	text/x-c
0	regex	\^#[[:space:]]*(if\|ifn)def
&gt;&amp;0	regex	\^#[[:space:]]*endif$	C source text
!:mime	text/x-c
0	regex	\^#[[:space:]]*(if\|ifn)def
&gt;&amp;0	regex	\^#[[:space:]]*define	C source text
!:mime	text/x-c
0	regex	\^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
!:mime	text/x-c
0	regex	\^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
!:mime	text/x-c
0	regex	\^[[:space:]]*extern[[:space:]]+		C source text
!:mime	text/x-c
0	regex	\^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
!:mime	text/x-c
0	regex	\^struct[[:space:]]+		C source text
!:mime	text/x-c
0	regex	\^union[[:space:]]+		C source text
!:mime	text/x-c
0	search/8192	main(
&gt;&amp;0 regex	\\)[[:space:]]*\\{		C source text
!:mime	text/x-c

# C++
# The strength of these rules is increased so they beat the C rules above
0	regex	\^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{	C++ source text
!:strength + 30
!:mime	text/x-c++
# using namespace [namespace] or using std::[lib]
0	regex	\^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*;		C++ source text
!:strength + 30
!:mime	text/x-c++
0	regex	\^[[:space:]]*template[[:space:]]*&lt;.*&gt;[[:space:]]*$	C++ source text
!:strength + 30
!:mime	text/x-c++
0	regex	\^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$		C++ source text
!:strength + 30
!:mime	text/x-c++
# But class alone is reduced to avoid beating php (Jens Schleusener)
0	regex	\^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$		C++ source text
!:strength + 13
!:mime	text/x-c++
0	regex	\^[[:space:]]*public:		C++ source text
!:strength + 30
!:mime	text/x-c++
0	regex	\^[[:space:]]*private:		C++ source text
!:strength + 30
!:mime	text/x-c++
0	regex	\^[[:space:]]*protected:		C++ source text
!:strength + 30
!:mime	text/x-c++

# Objective-C
0	regex	\^#import			Objective-C source text
!:strength + 25
!:mime	text/x-objective-c

# From: Mikhail Teterin &lt;mi@aldan.algebra.com&gt;
0	string		cscope		cscope reference data
&gt;7	string		x		version %.2s
# We skip the path here, because it is often long (so file will
# truncate it) and mostly redundant.
# The inverted index functionality was added some time between
# versions 11 and 15, so look for -q if version is above 14:
&gt;7	string		&gt;14
&gt;&gt;10	search/100	\ -q\ 		with inverted index
&gt;10	search/100	\ -c\ 		text (non-compressed)

#------------------------------------------------------------------------------
# $File: c64,v 1.7 2017/11/15 12:19:06 christos Exp $
# c64:  file(1) magic for various commodore 64 related files
#
# From: Dirk Jagdmann &lt;doj@cubic.org&gt;

0x16500	belong		0x12014100	D64 Image
0x16500	belong		0x12014180	D71 Image
0x61800 belong		0x28034400	D81 Image
0	string		C64\40CARTRIDGE	CCS C64 Emultar Cartridge Image
0	belong		0x43154164	X64 Image

0	string		GCR-1541	GCR Image
&gt;8	byte		x		version: %i
&gt;9	byte		x		tracks: %i

9	string		PSUR		ARC archive (c64)
2	string		-LH1-		LHA archive (c64)

0	string		C64File		PC64 Emulator file
&gt;8	string		&gt;\0		&quot;%s&quot;
0	string		C64Image	PC64 Freezer Image

0	beshort		0x38CD		C64 PCLink Image
0	string		CBM\144\0\0	Power 64 C64 Emulator Snapshot

0	belong		0xFF424CFF	WRAptor packer (c64)

0	string		C64S\x20tape\x20file	T64 tape Image
&gt;32	leshort		x		Version:0x%x
&gt;36	leshort		!0		Entries:%i
&gt;40	string		x		Name:%.24s

0	string		C64\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
&gt;32	leshort		x		Version:0x%x
&gt;36	leshort		!0		Entries:%i
&gt;40	string		x		Name:%.24s

0	string		C64S\x20tape\x20image\x20file\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0	T64 tape Image
&gt;32	leshort		x		Version:0x%x
&gt;36	leshort		!0		Entries:%i
&gt;40	string		x		Name:%.24s

# Raw tape file format (.tap files)
# Esa Hyyti &lt;esa@netlab.tkk.fi&gt;
0	string		C64-TAPE-RAW	C64 Raw Tape File (.tap),
&gt;0x0c	byte		x		Version:%u,
&gt;0x10	lelong		x		Length:%u cycles

# magic for Goattracker2, http://covertbitops.c64.org/
# from Alex Myczko &lt;alex@aiei.ch&gt;
0	string		GTS5		GoatTracker 2 song
&gt;4	string		&gt;\0		\b, &quot;%s&quot;
&gt;36	string		&gt;\0		\b by %s
&gt;68	string		&gt;\0		\b (C) %s
&gt;100	byte		&gt;0		\b, %u subsong(s)


#------------------------------------------------------------------------------
# $File: cad,v 1.15 2017/06/24 15:24:56 christos Exp $
# autocad:  file(1) magic for cad files
#

# Microstation DGN/CIT Files (www.bentley.com)
# Last updated July 29, 2005 by Lester Hightower
# DGN is the default file extension of Microstation/Intergraph CAD files.
# CIT is the proprietary raster format (similar to TIFF) used to attach
# raster underlays to Microstation DGN (vector) drawings.
#
# http://www.wotsit.org/search.asp
# http://filext.com/detaillist.php?extdetail=DGN
# http://filext.com/detaillist.php?extdetail=CIT
#
# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
# 3F86C928&amp;method=display&amp;p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
# 721C479F&amp;method=display&amp;p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
0	string	\010\011\376			Microstation
&gt;3	string	\002
&gt;&gt;30	string	\026\105			DGNFile
&gt;&gt;30	string	\034\105			DGNFile
&gt;&gt;30	string	\073\107			DGNFile
&gt;&gt;30	string	\073\110			DGNFile
&gt;&gt;30	string	\106\107			DGNFile
&gt;&gt;30	string	\110\103			DGNFile
&gt;&gt;30	string	\120\104			DGNFile
&gt;&gt;30	string	\172\104			DGNFile
&gt;&gt;30	string	\172\105			DGNFile
&gt;&gt;30	string	\172\106			DGNFile
&gt;&gt;30	string	\234\106			DGNFile
&gt;&gt;30	string	\273\105			DGNFile
&gt;&gt;30	string	\306\106			DGNFile
&gt;&gt;30	string	\310\104			DGNFile
&gt;&gt;30	string	\341\104			DGNFile
&gt;&gt;30	string	\372\103			DGNFile
&gt;&gt;30	string	\372\104			DGNFile
&gt;&gt;30	string	\372\106			DGNFile
&gt;&gt;30	string	\376\103			DGNFile
&gt;4	string	\030\000\000			CITFile
&gt;4	string	\030\000\003			CITFile

# AutoCAD
# Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg
# and http://www.iana.org/assignments/media-types/image/vnd.dwg
0	string	MC0.0	DWG AutoDesk AutoCAD Release 1.0
!:mime image/vnd.dwg
0	string	AC1.2	DWG AutoDesk AutoCAD Release 1.2
!:mime image/vnd.dwg
0	string	AC1.3	DWG AutoDesk AutoCAD Release 1.3
!:mime image/vnd.dwg
0	string	AC1.40	DWG AutoDesk AutoCAD Release 1.40
!:mime image/vnd.dwg
0	string	AC1.50	DWG AutoDesk AutoCAD Release 2.05
!:mime image/vnd.dwg
0	string	AC2.10	DWG AutoDesk AutoCAD Release 2.10
!:mime image/vnd.dwg
0	string	AC2.21	DWG AutoDesk AutoCAD Release 2.21
!:mime image/vnd.dwg
0	string	AC2.22	DWG AutoDesk AutoCAD Release 2.22
!:mime image/vnd.dwg
0	string	AC1001	DWG AutoDesk AutoCAD Release 2.22
!:mime image/vnd.dwg
0	string	AC1002	DWG AutoDesk AutoCAD Release 2.50
!:mime image/vnd.dwg
0	string	AC1003	DWG AutoDesk AutoCAD Release 2.60
!:mime image/vnd.dwg
0	string	AC1004	DWG AutoDesk AutoCAD Release 9
!:mime image/vnd.dwg
0	string	AC1006	DWG AutoDesk AutoCAD Release 10
!:mime image/vnd.dwg
0	string	AC1009	DWG AutoDesk AutoCAD Release 11/12
!:mime image/vnd.dwg
# AutoCAD DWG versions R13/R14 (www.autodesk.com)
# Written December 01, 2003 by Lester Hightower
# Based on the DWG File Format Specifications at http://www.opendwg.org/
# AutoCad, from Nahuel Greco
# AutoCAD DWG versions R12/R13/R14 (www.autodesk.com)
0	string	AC1012	DWG AutoDesk AutoCAD Release 13
!:mime image/vnd.dwg
0	string	AC1014	DWG AutoDesk AutoCAD Release 14
!:mime image/vnd.dwg
0	string	AC1015	DWG AutoDesk AutoCAD 2000/2002
!:mime image/vnd.dwg

# A new version of AutoCAD DWG
# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
# ICQ 358572321)
# From various sources like:
# http://autodesk.blogs.com/between_the_lines/autocad-release-history.html
0	string	AC1018	DWG AutoDesk AutoCAD 2004/2005/2006
!:mime image/vnd.dwg
0	string	AC1021	DWG AutoDesk AutoCAD 2007/2008/2009
!:mime image/vnd.dwg
0	string	AC1024	DWG AutoDesk AutoCAD 2010/2011/2012
!:mime image/vnd.dwg
0	string	AC1027	DWG AutoDesk AutoCAD 2013/2014
!:mime image/vnd.dwg

# KOMPAS 2D drawing from ASCON
# This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
# gathered nor specification
# ASCON http://ascon.net/main/ in English,
#	http://ascon.ru/ main site in Russian
# Extension is CDW for drawing and FRW for fragment of drawing
# Sergey Zaykov (mail_of_sergey@mail.ru, sergey_zaikov@rambler.ru,
# ICQ 358572321, http://vkontakte.ru/id16076543)
# From:
# http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&amp;CategoryID=4&amp;ItemID=292
# (in russian) and my experiments
0	string	KF
&gt;2	belong	0x4E00000C	Kompas drawing 12.0 SP1
&gt;2	belong	0x4D00000C	Kompas drawing 12.0
&gt;2	belong	0x3200000B	Kompas drawing 11.0 SP1
&gt;2	belong	0x3100000B	Kompas drawing 11.0
&gt;2	belong	0x2310000A	Kompas drawing 10.0 SP1
&gt;2	belong	0x2110000A	Kompas drawing 10.0
&gt;2	belong	0x08000009	Kompas drawing 9.0 SP1
&gt;2	belong	0x05000009	Kompas drawing 9.0
&gt;2	belong	0x33010008	Kompas drawing 8+
&gt;2	belong	0x1A000008	Kompas drawing 8.0
&gt;2	belong	0x2C010107	Kompas drawing 7+
&gt;2	belong	0x05000007	Kompas drawing 7.0
&gt;2	belong	0x32000006	Kompas drawing 6+
&gt;2	belong	0x09000006	Kompas drawing 6.0
&gt;2	belong	0x5C009005	Kompas drawing 5.11R03
&gt;2	belong	0x54009005	Kompas drawing 5.11R02
&gt;2	belong	0x51009005	Kompas drawing 5.11R01
&gt;2	belong	0x22009005	Kompas drawing 5.10R03
&gt;2	belong	0x22009005	Kompas drawing 5.10R02 mar
&gt;2	belong	0x21009005	Kompas drawing 5.10R02 febr
&gt;2	belong	0x19009005	Kompas drawing 5.10R01
&gt;2	belong	0xF4008005	Kompas drawing 5.9R01.003
&gt;2	belong	0x1C008005	Kompas drawing 5.9R01.002
&gt;2	belong	0x11008005	Kompas drawing 5.8R01.003

# CAD: file(1) magic for computer aided design files
# Phillip Griffith &lt;phillip dot griffith at gmail dot com&gt;
# AutoCAD magic taken from the Open Design Alliance&#039;s OpenDWG specifications.
#
0	belong	0x08051700	Bentley/Intergraph MicroStation DGN cell library
0	belong	0x0809fe02	Bentley/Intergraph MicroStation DGN vector CAD
0	belong	0xc809fe02	Bentley/Intergraph MicroStation DGN vector CAD
0	beshort	0x0809		Bentley/Intergraph MicroStation
&gt;0x02	byte	0xfe
&gt;&gt;0x04	beshort	0x1800		CIT raster CAD

# 3DS (3d Studio files)
0	leshort		0x4d4d
&gt;6	leshort		0x2
&gt;&gt;8	lelong		0xa
&gt;&gt;&gt;16	leshort		0x3d3d	3D Studio model
!:mime	image/x-3ds
!:extension 3ds

# MegaCAD 2D/3D drawing (.prt)
# http://megacad.de/
# From: Markus Heidelberg &lt;markus.heidelberg@web.de&gt;
0	string	MegaCad23\0	MegaCAD 2D/3D drawing

#------------------------------------------------------------------------------
# $File: cafebabe,v 1.23 2017/05/25 20:07:23 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
# the test must be performed in the same &quot;magic&quot; sequence to get both right.
# The long at offset 4 in a Mach-O universal binary tells the number of
# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
# version and the short at offset 6 is the JVM major version.  Since there are only
# only 18 labeled Mach-O architectures at current, and the first released
# Java class format was version 43.0, we can safely choose any number
# between 18 and 39 to test the number of architectures against
# (and use as a hack). Let&#039;s not use 18, because the Mach-O people
# might add another one or two as time goes by...
#
### JAVA START ###
0	belong		0xcafebabe
&gt;4	belong		&gt;30		compiled Java class data,
!:mime	application/x-java-applet
&gt;&gt;6	beshort		x	        version %d.
&gt;&gt;4	beshort		x       	\b%d
# Which is which?
#&gt;&gt;4	belong		0x032d		(Java 1.0)
#&gt;&gt;4	belong		0x032d		(Java 1.1)
&gt;&gt;4	belong		0x002e		(Java 1.2)
&gt;&gt;4	belong		0x002f		(Java 1.3)
&gt;&gt;4	belong		0x0030		(Java 1.4)
&gt;&gt;4	belong		0x0031		(Java 1.5)
&gt;&gt;4	belong		0x0032		(Java 1.6)
&gt;&gt;4	belong		0x0033		(Java 1.7)
&gt;&gt;4	belong		0x0034		(Java 1.8)

0	belong		0xcafed00d	JAR compressed with pack200,
&gt;5	byte		x		version %d.
&gt;4	byte		x		\b%d
!:mime	application/x-java-pack200


0	belong		0xcafed00d	JAR compressed with pack200,
&gt;5	byte		x		version %d.
&gt;4	byte		x		\b%d
!:mime	application/x-java-pack200

### JAVA END ###
### MACH-O START ###

0	name		mach-o		\b [
&gt;0	use		mach-o-cpu	\b
&gt;(8.L)	indirect	x		\b:
&gt;0	belong		x		\b]

0	belong		0xcafebabe
&gt;4	belong		1		Mach-O universal binary with 1 architecture:
!:mime application/x-mach-binary
&gt;&gt;8	use		mach-o		\b
&gt;4	belong		&gt;1
&gt;&gt;4	belong		&lt;20		Mach-O universal binary with %d architectures:
!:mime application/x-mach-binary
&gt;&gt;&gt;8	use		mach-o		\b
&gt;&gt;4	belong		2
&gt;&gt;&gt;28	use		mach-o		\b
&gt;&gt;4	belong		3
&gt;&gt;&gt;48	use		mach-o		\b
&gt;&gt;4	belong		4
&gt;&gt;&gt;68	use		mach-o		\b
&gt;&gt;4	belong		5
&gt;&gt;&gt;88	use		mach-o		\b
&gt;&gt;4	belong		6
&gt;&gt;&gt;108	use		mach-o		\b

### MACH-O END ###

#------------------------------------------------------------------------------
# $File: cbor,v 1.1 2015/01/28 01:05:21 christos Exp $
# cbor:  file(1) magic for CBOR files as defined in RFC 7049

0	string	\xd9\xd9\xf7 Concise Binary Object Representation (CBOR) container
!:mime	application/cbor
&gt;3	ubyte	&lt;0x20	(positive integer)
&gt;3	ubyte	&lt;0x40
&gt;&gt;3	ubyte	&gt;0x1f	(negative integer)
&gt;3	ubyte	&lt;0x60
&gt;&gt;3	ubyte	&gt;0x3f	(byte string)
&gt;3	ubyte	&lt;0x80
&gt;&gt;3	ubyte	&gt;0x5f	(text string)
&gt;3	ubyte	&lt;0xa0
&gt;3	ubyte	&gt;0x7f	(array)
&gt;3	ubyte	&lt;0xc0
&gt;&gt;3	ubyte	&gt;0x9f	(map)
&gt;3	ubyte	&lt;0xe0
&gt;&gt;3	ubyte	&gt;0xbf	(tagged)
&gt;3	ubyte	&gt;0xdf	(other)

#------------------------------------------------------------------------------
# $File: cddb,v 1.4 2009/09/19 16:28:08 christos Exp $
# CDDB: file(1) magic for CDDB(tm) format CD text data files
#
# From &lt;steve@gracenote.com&gt;
#
# This is the /etc/magic entry to decode datafiles as used by
# CDDB-enabled CD player applications.
#

0	search/1/w	#\040xmcd	CDDB(tm) format CD text data

#------------------------------------------------------------------------------
# $File: chord,v 1.5 2010/09/20 19:19:16 rrt Exp $
# chord: file(1) magic for Chord music sheet typesetting utility input files
#
# From Philippe De Muyter &lt;phdm@macqel.be&gt;
# File format is actually free, but many distributed files begin with `{title&#039;
#
0	string		{title		Chord text file

# Type:	PowerTab file format
# URL:	http://www.power-tab.net/
# From:	Jelmer Vernooij &lt;jelmer@samba.org&gt;
0	string		ptab\003\000	Power-Tab v3 Tablature File
0	string		ptab\004\000	Power-Tab v4 Tablature File

#------------------------------------------------------------------------------
# $File: cisco,v 1.4 2009/09/19 16:28:08 christos Exp $
# cisco:  file(1) magic for cisco Systems routers
#
# Most cisco file-formats are covered by the generic elf code
#
# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
0	belong&amp;0xffffff00	0x85011400  cisco IOS microcode
&gt;7	string		&gt;\0		    for &#039;%s&#039;
0	belong&amp;0xffffff00	0x8501cb00  cisco IOS experimental microcode
&gt;7	string		&gt;\0		    for &#039;%s&#039;

#------------------------------------------------------------------------------
# $File: citrus,v 1.4 2009/09/19 16:28:08 christos Exp $
# citrus locale declaration
#

0	string		RuneCT		Citrus locale declaration for LC_CTYPE


#------------------------------------------------------------------------------
# $File: clarion,v 1.5 2014/04/30 21:41:02 christos Exp $
# clarion:  file(1) magic for # Clarion Personal/Professional Developer
# (v2 and above)
# From: Julien Blache &lt;jb@jblache.org&gt;

# Database files
# signature
0	leshort	0x3343	Clarion Developer (v2 and above) data file
# attributes
&gt;2	leshort	&amp;0x0001	\b, locked
&gt;2	leshort	&amp;0x0004	\b, encrypted
&gt;2	leshort	&amp;0x0008	\b, memo file exists
&gt;2	leshort	&amp;0x0010	\b, compressed
&gt;2	leshort	&amp;0x0040	\b, read only
# number of records
&gt;5	lelong	x	\b, %d records

# Memo files
0	leshort	0x334d	Clarion Developer (v2 and above) memo data

# Key/Index files
# No magic? :(

# Help files
0	leshort	0x49e0	Clarion Developer (v2 and above) help data

#------------------------------------------------------------------------------
# $File: claris,v 1.8 2016/07/18 19:23:38 christos Exp $
# claris:  file(1) magic for claris
# &quot;H. Nanosecond&quot; &lt;aldomel@ix.netcom.com&gt;
# Claris Works a word processor, etc.
# Version 3.0

# .pct claris works clip art files
#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
#*
#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
#null to byte 1000 octal
514	string	\377\377\377\377\000
&gt;0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art
514	string	\377\377\377\377\001
&gt;0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	Claris clip art

# Claris works files
# .cwk
# Moved to Apple AppleWorks document
#0	string	\002\000\210\003\102\117\102\117\000\001\206 Claris works document
# .plt
0	string	\020\341\000\000\010\010	Claris Works palette files .plt

# .msp a dictionary file I am not sure about this I have only one .msp file
0	string	\002\271\262\000\040\002\000\164	Claris works dictionary

# .usp are user dictionary bits
# I am not sure about a magic header:
#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
#        soh   S   p   f   8   U   D  sp   ^   S  cr  nl   p   o   d   i
#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
#          a   t   r   i   s   t  sp   ^   S  cr  nl   d   i   v  sp   #

# .mth Thesaurus
# starts with \0 but no magic header

# .chy Hyphenation file
# I am not sure: 000 210 034 000 000

# other claris files
#./windows/claris/useng.ndx: data
#./windows/claris/xtndtran.l32: data
#./windows/claris/xtndtran.lst: data
#./windows/claris/clworks.lbl: data
#./windows/claris/clworks.prf: data
#./windows/claris/userd.spl: data

#------------------------------------------------------------------------------
# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $
# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what&#039;s the &quot;!&quot; stuff:
#
# &gt;18	short		!074000,000000	C1 R1
# &gt;18	short		!074000,004000	C2 R1
# &gt;18	short		!074000,010000	C3 R1
# &gt;18	short		!074000,074000	TEST
#
# I shall assume it&#039;s ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# &gt;18	short&amp;074000	000000		C1 R1
# &gt;18	short&amp;074000	004000		C2 R1
# &gt;18	short&amp;074000	010000		C3 R1
# &gt;18	short&amp;074000	074000		TEST
#
# as SVR3.1&#039;s &quot;file&quot; doesn&#039;t support anything of the &quot;!074000,000000&quot;
# sort, nor does SunOS 4.x, so either it&#039;s something Intergraph added
# in CLIX, or something AT&amp;T added in SVR3.2 or later, or something
# somebody else thought was a good idea; it&#039;s not documented in the
# man page for this version of &quot;magic&quot;, nor does it appear to be
# implemented (at least not after I blew off the bogus code to turn
# old-style &quot;&amp;&quot;s into new-style &quot;&amp;&quot;s, which just didn&#039;t work at all).
#
0	short		0575		CLIPPER COFF executable (VAX #)
&gt;20	short		0407		(impure)
&gt;20	short		0410		(5.2 compatible)
&gt;20	short		0411		(pure)
&gt;20	short		0413		(demand paged)
&gt;20	short		0443		(target shared library)
&gt;12	long		&gt;0		not stripped
&gt;22	short		&gt;0		- version %d
0	short		0577		CLIPPER COFF executable
&gt;18	short&amp;074000	000000		C1 R1
&gt;18	short&amp;074000	004000		C2 R1
&gt;18	short&amp;074000	010000		C3 R1
&gt;18	short&amp;074000	074000		TEST
&gt;20	short		0407		(impure)
&gt;20	short		0410		(pure)
&gt;20	short		0411		(separate I&amp;D)
&gt;20	short		0413		(paged)
&gt;20	short		0443		(target shared library)
&gt;12	long		&gt;0		not stripped
&gt;22	short		&gt;0		- version %d
&gt;48	long&amp;01		01		alignment trap enabled
&gt;52	byte		1		-Ctnc
&gt;52	byte		2		-Ctsw
&gt;52	byte		3		-Ctpw
&gt;52	byte		4		-Ctcb
&gt;53	byte		1		-Cdnc
&gt;53	byte		2		-Cdsw
&gt;53	byte		3		-Cdpw
&gt;53	byte		4		-Cdcb
&gt;54	byte		1		-Csnc
&gt;54	byte		2		-Cssw
&gt;54	byte		3		-Cspw
&gt;54	byte		4		-Cscb
4	string		pipe		CLIPPER instruction trace
4	string		prof		CLIPPER instruction profile

#------------------------------------------------------------------------------
# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $
# coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
#
# COFF
#
# by Joerg Jenderek at Oct 2015
# https://en.wikipedia.org/wiki/COFF
# https://de.wikipedia.org/wiki/Common_Object_File_Format
# http://www.delorie.com/djgpp/doc/coff/filhdr.html

# display name+variables+flags of Common Object Files Format (32bit)
# Maybe used also in adi,att3b,clipper,hitachi-sh,hp,ibm6000,intel,
# mips,motorola,msdos,osf1,sharc,varied.out,vax
0	name				display-coff
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
&gt;18	uleshort&amp;0x8E80	0
&gt;&gt;0	clear		x
# f_magic - magic number
# DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
&gt;&gt;0	uleshort	0x014C		Intel 80386
# Hitachi SH big-endian COFF (./hitachi-sh)
&gt;&gt;0	uleshort	0x0500		Hitachi SH big-endian
# Hitachi SH little-endian COFF (./hitachi-sh)
&gt;&gt;0	uleshort	0x0550		Hitachi SH little-endian
# executable (RISC System/6000 V3.1) or obj module (./ibm6000)
#&gt;&gt;0	uleshort	0x01DF
# TODO for other COFFs
#&gt;&gt;0	uleshort	0xABCD		COFF_TEMPLATE
&gt;&gt;0	default		x
&gt;&gt;&gt;0	uleshort	x		type 0x%04x
&gt;&gt;0	uleshort	x		COFF
# F_EXEC flag bit
&gt;&gt;18	leshort		^0x0002		object file
#!:mime	application/x-coff
#!:ext cof/o/obj/lib
&gt;&gt;18	leshort		&amp;0x0002		executable
#!:mime	application/x-coffexec
# F_RELFLG flag bit,static object
&gt;&gt;18	leshort		&amp;0x0001		\b, no relocation info
# F_LNNO flag bit
&gt;&gt;18	leshort		&amp;0x0004		\b, no line number info
# F_LSYMS flag bit
&gt;&gt;18	leshort		&amp;0x0008		\b, stripped
&gt;&gt;18	leshort		^0x0008		\b, not stripped
# flags in other COFF versions
#0x0010    F_FDPR_PROF
#0x0020    F_FDPR_OPTI
#0x0040    F_DSA
# F_AR32WR flag bit
#&gt;&gt;&gt;18	leshort		&amp;0x0100		\b, 32 bit little endian
#0x1000    F_DYNLOAD
#0x2000    F_SHROBJ
#0x4000    F_LOADONLY
# f_nscns - number of sections
&gt;&gt;2	uleshort	&lt;2		\b, %d section
&gt;&gt;2	uleshort	&gt;1		\b, %d sections
# f_timdat - file time &amp; date stamp only for little endian
#&gt;&gt;4	date		x		\b, %s
# f_symptr - symbol table pointer, only for not stripped
&gt;&gt;8	ulelong		&gt;0		\b, symbol offset=0x%x
# f_nsyms - number of symbols, only for not stripped
&gt;&gt;12	ulelong		&gt;0		\b, %d symbols
# f_opthdr - optional header size
&gt;&gt;16	uleshort	&gt;0		\b, optional header size %d
# at offset 20 can be optional header, extra bytes FILHSZ-20 because
# do not rely on sizeof(FILHDR) to give the correct size for header.
# or first section header
# additional variables for other COFF files
# &gt;20	beshort		0407		(impure)
# &gt;20	beshort		0410		(pure)
# &gt;20	beshort		0413		(demand paged)
# &gt;20	beshort		0421		(standalone)
# &gt;22	leshort		&gt;0		- version %d
# &gt;168	string		.lowmem		Apple toolbox


#------------------------------------------------------------------------------
# $File: commands,v 1.59 2017/08/14 07:40:38 christos Exp $
# commands:  file(1) magic for various shells and interpreters
#
#0	string/w	:			shell archive or script for antique kernel text
0	string/wt	#!\ /bin/sh		POSIX shell script text executable
!:mime	text/x-shellscript
0	string/wb	#!\ /bin/sh		POSIX shell script executable (binary data)
!:mime	text/x-shellscript
0       string/w        #!\ /usr/bin/sh         Shell script text executable
!:mime  text/x-shellscript

0	string/wt	#!\ /bin/csh		C shell script text executable
!:mime	text/x-shellscript

# korn shell magic, sent by George Wu, gwu@clyde.att.com
0	string/wt	#!\ /bin/ksh		Korn shell script text executable
!:mime	text/x-shellscript
0	string/wb	#!\ /bin/ksh		Korn shell script executable (binary data)
!:mime	text/x-shellscript

0	string/wt 	#!\ /bin/tcsh		Tenex C shell script text executable
!:mime	text/x-shellscript
0	string/wt	#!\ /usr/bin/tcsh	Tenex C shell script text executable
!:mime	text/x-shellscript
0	string/wt 	#!\ /usr/local/tcsh	Tenex C shell script text executable
!:mime	text/x-shellscript
0	string/wt	#!\ /usr/local/bin/tcsh	Tenex C shell script text executable
!:mime	text/x-shellscript

#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0	string/wt	#!\ /bin/zsh		Paul Falstad&#039;s zsh script text executable
!:mime	text/x-shellscript
0	string/wt	#!\ /usr/bin/zsh	Paul Falstad&#039;s zsh script text executable
!:mime	text/x-shellscript
0	string/wt	#!\ /usr/local/bin/zsh	Paul Falstad&#039;s zsh script text executable
!:mime	text/x-shellscript
0	string/wt	#!\ /usr/local/bin/ash	Neil Brown&#039;s ash script text executable
!:mime	text/x-shellscript
0	string/wt	#!\ /usr/local/bin/ae	Neil Brown&#039;s ae script text executable
!:mime	text/x-shellscript
0	string/wt	#!\ /bin/nawk		new awk script text executable
!:mime	text/x-nawk
0	string/wt	#!\ /usr/bin/nawk	new awk script text executable
!:mime	text/x-nawk
0	string/wt	#!\ /usr/local/bin/nawk	new awk script text executable
!:mime	text/x-nawk
0	string/wt	#!\ /bin/gawk		GNU awk script text executable
!:mime	text/x-gawk
0	string/wt	#!\ /usr/bin/gawk	GNU awk script text executable
!:mime	text/x-gawk
0	string/wt	#!\ /usr/local/bin/gawk	GNU awk script text executable
!:mime	text/x-gawk
#
0	string/wt	#!\ /bin/awk		awk script text executable
!:mime	text/x-awk
0	string/wt	#!\ /usr/bin/awk	awk script text executable
!:mime	text/x-awk
0	regex/4096	=^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{]	awk or perl script text

# AT&amp;T Bell Labs&#039; Plan 9 shell
0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable

# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0	string/wt	#!\ /bin/bash	Bourne-Again shell script text executable
!:mime	text/x-shellscript
0	string/wb	#!\ /bin/bash	Bourne-Again shell script executable (binary data)
!:mime	text/x-shellscript
0	string/wt	#!\ /usr/bin/bash	Bourne-Again shell script text executable
!:mime	text/x-shellscript
0	string/wb	#!\ /usr/bin/bash	Bourne-Again shell script executable (binary data)
!:mime	text/x-shellscript
0	string/wt	#!\ /usr/local/bash	Bourne-Again shell script text executable
!:mime	text/x-shellscript
0	string/wb	#!\ /usr/local/bash	Bourne-Again shell script executable (binary data)
!:mime	text/x-shellscript
0	string/wt	#!\ /usr/local/bin/bash	Bourne-Again shell script text executable
!:mime	text/x-shellscript
0	string/wb	#!\ /usr/local/bin/bash	Bourne-Again shell script executable (binary data)
!:mime	text/x-shellscript
0	string/wt	#!\ /usr/bin/env\ bash	Bourne-Again shell script text executable
!:mime	text/x-shellscript

# PHP scripts
# Ulf Harnhammar &lt;ulfh@update.uu.se&gt;
0	search/1/c	=&lt;?php			PHP script text
!:strength + 30
!:mime	text/x-php
0	search/1	=&lt;?\n			PHP script text
!:mime	text/x-php
0	search/1	=&lt;?\r			PHP script text
!:mime	text/x-php
0	search/1/w	#!\ /usr/local/bin/php	PHP script text executable
!:strength + 10
!:mime	text/x-php
0	search/1/w	#!\ /usr/bin/php	PHP script text executable
!:strength + 10
!:mime	text/x-php
# Smarty compiled template, http://www.smarty.net/
# Elan Ruusamae &lt;glen@delfi.ee&gt;
0	string	=&lt;?php
&gt;5	regex	[\ \n]
&gt;&gt;6	string	/*\ Smarty\ version		Smarty compiled template
&gt;&gt;&gt;24	regex	[0-9.]+				\b, version %s
!:mime	text/x-php

0	string		Zend\x00		PHP script Zend Optimizer data

0	string/t	$!			DCL command file

# Type: Pdmenu
# URL:  http://packages.debian.org/pdmenu
# From: Edward Betts &lt;edward@debian.org&gt;
0	string		#!/usr/bin/pdmenu	Pdmenu configuration file text

# From Danny Weldon
0	string	\x0b\x13\x08\x00
&gt;0x04   uleshort	&lt;4      ksh byte-code version %d

#----------------------------------------------------------------------------
# $File: communications,v 1.5 2009/09/19 16:28:08 christos Exp $
# communication

# TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
# It is used for conformance testing of communication protocols.
# Added by W. Borgert &lt;debacle@debian.org&gt;.
0	string		$Suite			TTCN Abstract Test Suite
&gt;&amp;1	string		$SuiteId
&gt;&gt;&amp;1	string		&gt;\n			%s
&gt;&amp;2	string		$SuiteId
&gt;&gt;&amp;1	string		&gt;\n			%s
&gt;&amp;3	string		$SuiteId
&gt;&gt;&amp;1	string		&gt;\n			%s

# MSC (message sequence charts) are a formal description technique,
# described in ITU-T Z.120, mainly used for communication protocols.
# Added by W. Borgert &lt;debacle@debian.org&gt;.
0	string		mscdocument	Message Sequence Chart (document)
0	string		msc		Message Sequence Chart (chart)
0	string		submsc		Message Sequence Chart (subchart)
#------------------------------------------------------------------------------
# $File: compress,v 1.72 2018/03/27 23:26:41 christos Exp $
# compress:  file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
#
# Formats for various forms of compressed data
# Formats for &quot;compress&quot; proper have been moved into &quot;compress.c&quot;,
# because it tries to uncompress it to figure out what&#039;s inside.

# standard unix compress
0	string		\037\235	compress&#039;d data
!:mime	application/x-compress
!:apple	LZIVZIVU
&gt;2	byte&amp;0x80	&gt;0		block compressed
&gt;2	byte&amp;0x1f	x		%d bits

# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
#   Edited by Chris Chittleborough &lt;cchittleborough@yahoo.com.au&gt;, March 2002
#	* Original filename is only at offset 10 if &quot;extra field&quot; absent
#	* Produce shorter output - notably, only report compression methods
#         other than 8 (&quot;deflate&quot;, the only method defined in RFC 1952).
0       string          \037\213        gzip compressed data
!:mime	application/x-gzip
!:strength * 2
&gt;2	byte		&lt;8		\b, reserved method
&gt;2	byte		&gt;8		\b, unknown method
&gt;3	byte		&amp;0x01		\b, ASCII
&gt;3	byte		&amp;0x02		\b, has CRC
&gt;3	byte		&amp;0x04		\b, extra field
&gt;3	byte&amp;0xC	=0x08
&gt;&gt;10	string		x		\b, was &quot;%s&quot;
&gt;3	byte		&amp;0x10		\b, has comment
&gt;3	byte		&amp;0x20		\b, encrypted
&gt;4	ledate		&gt;0		\b, last modified: %s
&gt;8	byte		2		\b, max compression
&gt;8	byte		4		\b, max speed
&gt;9	byte		=0x00		\b, from FAT filesystem (MS-DOS, OS/2, NT)
&gt;9	byte		=0x01		\b, from Amiga
&gt;9	byte		=0x02		\b, from VMS
&gt;9	byte		=0x03		\b, from Unix
&gt;9	byte		=0x04		\b, from VM/CMS
&gt;9	byte		=0x05		\b, from Atari
&gt;9	byte		=0x06		\b, from HPFS filesystem (OS/2, NT)
&gt;9	byte		=0x07		\b, from MacOS
&gt;9	byte		=0x08		\b, from Z-System
&gt;9	byte		=0x09		\b, from CP/M
&gt;9	byte		=0x0A		\b, from TOPS/20
&gt;9	byte		=0x0B		\b, from NTFS filesystem (NT)
&gt;9	byte		=0x0C		\b, from QDOS
&gt;9	byte		=0x0D		\b, from Acorn RISCOS
&gt;-4	lelong		x		\b, original size %d

# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0	string		\037\036	packed data
!:mime	application/octet-stream
&gt;2	belong		&gt;1		\b, %d characters originally
&gt;2	belong		=1		\b, %d character originally
#
# This magic number is byte-order-independent.
0	short		0x1f1f		old packed data
!:mime	application/octet-stream

# XXX - why *two* entries for &quot;compacted data&quot;, one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0	short		0x1fff		compacted data
!:mime	application/octet-stream
# This string is valid for SunOS (BE) and a matching &quot;short&quot; is listed
# in the Ultrix (LE) magic file.
0	string		\377\037	compacted data
!:mime	application/octet-stream
0	short		0145405		huf output
!:mime	application/octet-stream

# bzip2
0	string		BZh		bzip2 compressed data
!:mime	application/x-bzip2
&gt;3	byte		&gt;47		\b, block size = %c00k

# bzip	a block-sorting file compressor
#	by Julian Seward &lt;sewardj@cs.man.ac.uk&gt; and others
0	string		BZ0		bzip compressed data
!:mime	application/x-bzip
&gt;3	byte		&gt;47		\b, block size = %c00k

# lzip
0	string		LZIP		lzip compressed data
!:mime application/x-lzip
&gt;4	byte		x		\b, version: %d

# squeeze and crunch
# Michael Haardt &lt;michael@cantor.informatik.rwth-aachen.de&gt;
0	beshort		0x76FF		squeezed data,
&gt;4	string		x		original name %s
0	beshort		0x76FE		crunched data,
&gt;2	string		x		original name %s
0	beshort		0x76FD		LZH compressed data,
&gt;2	string		x		original name %s

# Freeze
0	string		\037\237	frozen file 2.1
0	string		\037\236	frozen file 1.0 (or gzip 0.5)

# SCO compress -H (LZH)
0	string		\037\240	SCO compress -H (LZH) data

# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# There&#039;s only a magic nibble (4 bits); that nibble repeats every 33
# bytes.  This isn&#039;t suited for use, but maybe we can use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0	byte&amp;0xF0	0xd0		data
#&gt;33	byte&amp;0xF0	0xd0
#&gt;66	byte&amp;0xF0	0xd0
#&gt;99	byte&amp;0xF0	0xd0
#&gt;132	byte&amp;0xF0	0xd0		GSM 06.10 compressed audio

# lzop from &lt;markus.oberhumer@jk.uni-linz.ac.at&gt;
0	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
&gt;9	beshort		&lt;0x0940
&gt;&gt;9	byte&amp;0xf0	=0x00		- version 0.
&gt;&gt;9	beshort&amp;0x0fff	x		\b%03x,
&gt;&gt;13	byte		1		LZO1X-1,
&gt;&gt;13	byte		2		LZO1X-1(15),
&gt;&gt;13	byte		3		LZO1X-999,
## &gt;&gt;22	bedate		&gt;0		last modified: %s,
&gt;&gt;14	byte		=0x00		os: MS-DOS
&gt;&gt;14	byte		=0x01		os: Amiga
&gt;&gt;14	byte		=0x02		os: VMS
&gt;&gt;14	byte		=0x03		os: Unix
&gt;&gt;14	byte		=0x05		os: Atari
&gt;&gt;14	byte		=0x06		os: OS/2
&gt;&gt;14	byte		=0x07		os: MacOS
&gt;&gt;14	byte		=0x0A		os: Tops/20
&gt;&gt;14	byte		=0x0B		os: WinNT
&gt;&gt;14	byte		=0x0E		os: Win32
&gt;9	beshort		&gt;0x0939
&gt;&gt;9	byte&amp;0xf0	=0x00		- version 0.
&gt;&gt;9	byte&amp;0xf0	=0x10		- version 1.
&gt;&gt;9	byte&amp;0xf0	=0x20		- version 2.
&gt;&gt;9	beshort&amp;0x0fff	x		\b%03x,
&gt;&gt;15	byte		1		LZO1X-1,
&gt;&gt;15	byte		2		LZO1X-1(15),
&gt;&gt;15	byte		3		LZO1X-999,
## &gt;&gt;25	bedate		&gt;0		last modified: %s,
&gt;&gt;17	byte		=0x00		os: MS-DOS
&gt;&gt;17	byte		=0x01		os: Amiga
&gt;&gt;17	byte		=0x02		os: VMS
&gt;&gt;17	byte		=0x03		os: Unix
&gt;&gt;17	byte		=0x05		os: Atari
&gt;&gt;17	byte		=0x06		os: OS/2
&gt;&gt;17	byte		=0x07		os: MacOS
&gt;&gt;17	byte		=0x0A		os: Tops/20
&gt;&gt;17	byte		=0x0B		os: WinNT
&gt;&gt;17	byte		=0x0E		os: Win32

# 4.3BSD-Quasijarus Strong Compression
# http://minnie.tuhs.org/Quasijarus/compress.html
0	string		\037\241	Quasijarus strong compressed data

# From: Cory Dikkers &lt;cdikkers@swbell.net&gt;
0	string		XPKF		Amiga xpkf.library compressed data
0	string		PP11		Power Packer 1.1 compressed data
0	string		PP20		Power Packer 2.0 compressed data,
&gt;4	belong		0x09090909	fast compression
&gt;4	belong		0x090A0A0A	mediocre compression
&gt;4	belong		0x090A0B0B	good compression
&gt;4	belong		0x090A0C0C	very good compression
&gt;4	belong		0x090A0C0D	best compression

# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
# http://www.7-zip.org or DOC/7zFormat.txt
#
0	string		7z\274\257\047\034	7-zip archive data,
&gt;6	byte		x			version %d
&gt;7	byte		x			\b.%d
!:mime	application/x-7z-compressed
!:ext 7z/cb7

# Type: LZMA
0	lelong&amp;0xffffff	=0x5d
&gt;12	leshort		0xff			LZMA compressed data,
!:mime	application/x-lzma
&gt;&gt;5	lequad		=0xffffffffffffffff	streamed
&gt;&gt;5	lequad		!0xffffffffffffffff	non-streamed, size %lld
&gt;12	leshort		0			LZMA compressed data,
&gt;&gt;5	lequad		=0xffffffffffffffff	streamed
&gt;&gt;5	lequad		!0xffffffffffffffff	non-streamed, size %lld

# http://tukaani.org/xz/xz-file-format.txt
0	ustring		\xFD7zXZ\x00		XZ compressed data
!:strength * 2
!:mime	application/x-xz

# https://github.com/ckolivas/lrzip/blob/master/doc/magic.header.txt
0	string		LRZI			LRZIP compressed data
&gt;4	byte		x			- version %d
&gt;5	byte		x			\b.%d
!:mime	application/x-lrzip

# http://fastcompression.blogspot.fi/2013/04/lz4-streaming-format-final.html
0	lelong		0x184d2204	LZ4 compressed data (v1.4+)
!:mime	application/x-lz4
# Added by osm0sis@xda-developers.com
0 	lelong		0x184c2103	LZ4 compressed data (v1.0-v1.3)
!:mime	application/x-lz4
0	lelong		0x184c2102	LZ4 compressed data (v0.1-v0.9)
!:mime	application/x-lz4

# Zstandard/LZ4 skippable frames
# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
0         lelong&amp;0xFFFFFFF0  0x184D2A50
&gt;(4.l+8)  indirect	x

# Zstandard Dictionary ID subroutine
0     name        zstd-dictionary-id
# Single Segment = True
&gt;0    byte        &amp;0x20   \b, Dictionary ID:
&gt;&gt;0   byte&amp;0x03   0       None
&gt;&gt;0   byte&amp;0x03   1
&gt;&gt;&gt;1  byte        x       %u
&gt;&gt;0   byte&amp;0x03   2
&gt;&gt;&gt;1  leshort     x       %u
&gt;&gt;0   byte&amp;0x03   3
&gt;&gt;&gt;1  lelong      x       %u
# Single Segment = False
&gt;0    byte        ^0x20   \b, Dictionary ID:
&gt;&gt;0   byte&amp;0x03   0       None
&gt;&gt;0   byte&amp;0x03   1
&gt;&gt;&gt;2  byte        x       %u
&gt;&gt;0   byte&amp;0x03   2
&gt;&gt;&gt;2  leshort     x       %u
&gt;&gt;0   byte&amp;0x03   3
&gt;&gt;&gt;2  lelong      x       %u

# Zstandard compressed data
# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
0     lelong       0xFD2FB522  Zstandard compressed data (v0.2)
!:mime  application/x-zstd
0     lelong       0xFD2FB523  Zstandard compressed data (v0.3)
!:mime  application/x-zstd
0     lelong       0xFD2FB524  Zstandard compressed data (v0.4)
!:mime  application/x-zstd
0     lelong       0xFD2FB525  Zstandard compressed data (v0.5)
!:mime  application/x-zstd
0     lelong       0xFD2FB526  Zstandard compressed data (v0.6)
!:mime  application/x-zstd
0     lelong       0xFD2FB527  Zstandard compressed data (v0.7)
!:mime  application/x-zstd
&gt;4    use          zstd-dictionary-id
0     lelong       0xFD2FB528  Zstandard compressed data (v0.8+)
!:mime  application/x-zstd
&gt;4    use          zstd-dictionary-id

# https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
0  lelong    0xEC30A437  Zstandard dictionary
!:mime  application/x-zstd-dictionary
&gt;4 lelong    x           (ID %u)

# AFX compressed files (Wolfram Kleff)
2	string		-afx-		AFX compressed file data

# Supplementary magic data for the file(1) command to support
# rzip(1).  The format is described in magic(5).
#
# Copyright (C) 2003 by Andrew Tridgell.  You may do whatever you want with
# this file.
#
0	string		RZIP		rzip compressed data
&gt;4	byte		x		- version %d
&gt;5	byte		x		\b.%d
&gt;6	belong		x		(%d bytes)

0	string		ArC\x01		FreeArc archive &lt;http://freearc.org&gt;

# Type:	DACT compressed files
0	long	0x444354C3	DACT compressed data
&gt;4	byte	&gt;-1		(version %i.
&gt;5	byte	&gt;-1		%i.
&gt;6	byte	&gt;-1		%i)
&gt;7	long	&gt;0		, original size: %i bytes
&gt;15	long	&gt;30		, block size: %i bytes

# Valve Pack (VPK) files
0	lelong	0x55aa1234	Valve Pak file
&gt;0x4	lelong	x		\b, version %u
&gt;0x8	lelong	x		\b, %u entries

# Snappy framing format
# http://code.google.com/p/snappy/source/browse/trunk/framing_format.txt
0	string	\377\006\0\0sNaPpY	snappy framed data
!:mime	application/x-snappy-framed

# qpress, http://www.quicklz.com/
0	string	qpress10	qpress compressed data
!:mime	application/x-qpress

# Zlib https://www.ietf.org/rfc/rfc6713.txt
0	string/b	x
&gt;0	beshort%31	=0
&gt;&gt;0	byte&amp;0xf	=8
&gt;&gt;&gt;0	byte&amp;0x80 	=0	zlib compressed data
!:mime	application/zlib

# BWC compression
0	string		BWC
&gt;3	byte		0	BWC compressed data

# UCL compression
0	bequad		0x00e955434cff011a	UCL compressed data

# Softlib archive
0	string		SLIB	Softlib archive
&gt;4	leshort		x	\b, version %d
&gt;6	leshort		x	(contains %d files)

# URL:  https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h#L276
# From: Eric Hall &lt;eric.hall@darkart.com&gt;
0	string	bvx-	lzfse encoded, no compression
0	string	bvx1	lzfse compressed, uncompressed tables
0	string	bvx2	lzfse compressed, compressed tables
0	string	bvxn	lzfse encoded, lzvn compressed

#------------------------------------------------------------------------------
# $File: console,v 1.35 2017/11/14 15:48:36 christos Exp $
# Console game magic
# Toby Deshane &lt;hac@shoelace.digivill.net&gt;

# ines: file(1) magic for Marat&#039;s iNES Nintendo Entertainment System ROM dump format
# Updated by David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# References:
# - http://wiki.nesdev.com/w/index.php/INES
# - http://wiki.nesdev.com/w/index.php/NES_2.0

# Common header for iNES, NES 2.0, and Wii U iNES.
0	name		nes-rom-image-ines
&gt;7	byte&amp;0x0C	=0x8		(NES 2.0)
&gt;4	byte		x		\b: %ux16k PRG
&gt;5	byte		x		\b, %ux8k CHR
&gt;6	byte&amp;0x08	=0x8		[4-Scr]
&gt;6	byte&amp;0x09	=0x0		[H-mirror]
&gt;6	byte&amp;0x09	=0x1		[V-mirror]
&gt;6	byte&amp;0x02	=0x2		[SRAM]
&gt;6	byte&amp;0x04	=0x4		[Trainer]
&gt;7	byte&amp;0x03	=0x2		[PC10]
&gt;7	byte&amp;0x03	=0x1		[VS]
&gt;&gt;7	byte&amp;0x0C	=0x8
# NES 2.0: VS PPU
&gt;&gt;&gt;13	byte&amp;0x0F	=0x0		\b, RP2C03B
&gt;&gt;&gt;13	byte&amp;0x0F	=0x1		\b, RP2C03G
&gt;&gt;&gt;13	byte&amp;0x0F	=0x2		\b, RP2C04-0001
&gt;&gt;&gt;13	byte&amp;0x0F	=0x3		\b, RP2C04-0002
&gt;&gt;&gt;13	byte&amp;0x0F	=0x4		\b, RP2C04-0003
&gt;&gt;&gt;13	byte&amp;0x0F	=0x5		\b, RP2C04-0004
&gt;&gt;&gt;13	byte&amp;0x0F	=0x6		\b, RP2C03B
&gt;&gt;&gt;13	byte&amp;0x0F	=0x7		\b, RP2C03C
&gt;&gt;&gt;13	byte&amp;0x0F	=0x8		\b, RP2C05-01
&gt;&gt;&gt;13	byte&amp;0x0F	=0x9		\b, RP2C05-02
&gt;&gt;&gt;13	byte&amp;0x0F	=0xA		\b, RP2C05-03
&gt;&gt;&gt;13	byte&amp;0x0F	=0xB		\b, RP2C05-04
&gt;&gt;&gt;13	byte&amp;0x0F	=0xC		\b, RP2C05-05
# TODO: VS protection hardware?
&gt;&gt;7	byte		x		\b]
# NES 2.0-specific flags.
&gt;7	byte&amp;0x0C	=0x8
&gt;&gt;12	byte&amp;0x03	=0x0		[NTSC]
&gt;&gt;12	byte&amp;0x03	=0x1		[PAL]
&gt;&gt;12	byte&amp;0x02	=0x2		[NTSC+PAL]

# Standard iNES ROM header.
0	string		NES\x1A		NES ROM image (iNES)
&gt;0	use		nes-rom-image-ines

# Wii U Virtual Console iNES ROM header.
0	belong		0x4E455300	NES ROM image (Wii U Virtual Console)
&gt;0	use		nes-rom-image-ines

#------------------------------------------------------------------------------
# unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images
# Reference: http://wiki.nesdev.com/w/index.php/UNIF
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
#
# NOTE: The UNIF format uses chunks instead of a fixed header,
# so most of the data isn&#039;t easily parseable.
#
0	string	UNIF
&gt;4	lelong	&lt;16	NES ROM image (UNIF v%d format)

#------------------------------------------------------------------------------
# fds: file(1) magic for Famciom Disk System disk images
# Reference: http://wiki.nesdev.com/w/index.php/Family_Computer_Disk_System#.FDS_format
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# TODO: Check &quot;Disk info block&quot; and get info from that in addition to the optional header.

# Disk info block. (block 1)
0	name	nintendo-fds-disk-info-block
&gt;23	byte	!1		FMC-
&gt;23	byte	1		FSC-
&gt;16	string	x		\b%.3s
&gt;15	byte	x		\b, mfr %02X
&gt;20	byte	x		(Rev.%02u)

# Headered version.
0	string	FDS\x1A
&gt;0x11	string	*NINTENDO-HVC*	Famicom Disk System disk image:
&gt;&gt;0x10	use	nintendo-fds-disk-info-block
&gt;4	byte	1	(%u side)
&gt;4	byte	!1	(%u sides)

# Unheadered version.
1	string	*NINTENDO-HVC*	Famicom Disk System disk image:
&gt;0	use	nintendo-fds-disk-info-block

#------------------------------------------------------------------------------
# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images
# Used by Nintendo 3DS NES Virtual Console games.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
#
0		string	TNES	NES ROM image (Nintendo 3DS Virtual Console)
&gt;4		byte	100	\b: FDS,
&gt;&gt;0x2010	use	nintendo-fds-disk-info-block
&gt;4		byte	!100	\b: TNES mapper %u
&gt;&gt;5	byte		x		\b, %ux8k PRG
&gt;&gt;6	byte		x		\b, %ux8k CHR
&gt;&gt;7	byte&amp;0x08	=1		[WRAM]
&gt;&gt;8	byte&amp;0x09	=1		[H-mirror]
&gt;&gt;8	byte&amp;0x09	=2		[V-mirror]
&gt;&gt;8	byte&amp;0x02	=3		[VRAM]

#------------------------------------------------------------------------------
# gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
# Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
#
0x104		bequad		0xCEED6666CC0D000B	Game Boy ROM image
&gt;0x143		byte&amp;0x80	0x80
&gt;&gt;0x134		string		&gt;\0			\b: &quot;%.15s&quot;
&gt;0x143		byte&amp;0x80	!0x80
&gt;&gt;0x134		string		&gt;\0			\b: &quot;%.16s&quot;
&gt;0x14c		byte		x			(Rev.%02u)

# Machine type. (SGB, CGB, SGB+CGB)
&gt;0x14b		byte		0x33
&gt;&gt;0x146		byte		0x03
&gt;&gt;&gt;0x143	byte&amp;0x80	0x80	[SGB+CGB]
&gt;&gt;&gt;0x143	byte&amp;0x80	!0x80	[SGB]
&gt;&gt;0x146		byte		!0x03
&gt;&gt;&gt;0x143	byte&amp;0xC0	0x80	[CGB]
&gt;&gt;&gt;0x143	byte&amp;0xC0	0xC0	[CGB ONLY]

# Mapper.
&gt;0x147 byte 0x00  [ROM ONLY]
&gt;0x147 byte 0x01  [MBC1]
&gt;0x147 byte 0x02  [MBC1+RAM]
&gt;0x147 byte 0x03  [MBC1+RAM+BATT]
&gt;0x147 byte 0x05  [MBC2]
&gt;0x147 byte 0x06  [MBC2+BATTERY]
&gt;0x147 byte 0x08  [ROM+RAM]
&gt;0x147 byte 0x09  [ROM+RAM+BATTERY]
&gt;0x147 byte 0x0B  [MMM01]
&gt;0x147 byte 0x0C  [MMM01+SRAM]
&gt;0x147 byte 0x0D  [MMM01+SRAM+BATT]
&gt;0x147 byte 0x0F  [MBC3+TIMER+BATT]
&gt;0x147 byte 0x10  [MBC3+TIMER+RAM+BATT]
&gt;0x147 byte 0x11  [MBC3]
&gt;0x147 byte 0x12  [MBC3+RAM]
&gt;0x147 byte 0x13  [MBC3+RAM+BATT]
&gt;0x147 byte 0x19  [MBC5]
&gt;0x147 byte 0x1A  [MBC5+RAM]
&gt;0x147 byte 0x1B  [MBC5+RAM+BATT]
&gt;0x147 byte 0x1C  [MBC5+RUMBLE]
&gt;0x147 byte 0x1D  [MBC5+RUMBLE+SRAM]
&gt;0x147 byte 0x1E  [MBC5+RUMBLE+SRAM+BATT]
&gt;0x147 byte 0xFC  [Pocket Camera]
&gt;0x147 byte 0xFD  [Bandai TAMA5]
&gt;0x147 byte 0xFE  [Hudson HuC-3]
&gt;0x147 byte 0xFF  [Hudson HuC-1]

# ROM size.
&gt;0x148 byte 0     \b, ROM: 256Kbit
&gt;0x148 byte 1     \b, ROM: 512Kbit
&gt;0x148 byte 2     \b, ROM: 1Mbit
&gt;0x148 byte 3     \b, ROM: 2Mbit
&gt;0x148 byte 4     \b, ROM: 4Mbit
&gt;0x148 byte 5     \b, ROM: 8Mbit
&gt;0x148 byte 6     \b, ROM: 16Mbit
&gt;0x148 byte 7     \b, ROM: 32Mbit
&gt;0x148 byte 0x52  \b, ROM: 9Mbit
&gt;0x148 byte 0x53  \b, ROM: 10Mbit
&gt;0x148 byte 0x54  \b, ROM: 12Mbit

# RAM size.
&gt;0x149 byte 1     \b, RAM: 16Kbit
&gt;0x149 byte 2     \b, RAM: 64Kbit
&gt;0x149 byte 3     \b, RAM: 128Kbit
&gt;0x149 byte 4     \b, RAM: 1Mbit
&gt;0x149 byte 5     \b, RAM: 512Kbit

#------------------------------------------------------------------------------
# genesis: file(1) magic for various Sega Mega Drive / Genesis ROM image and disc formats
# Updated by David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# References:
# - http://www.retrodev.com/segacd.html
# - http://devster.monkeeh.com/sega/32xguide1.txt
#

# Common Sega Mega Drive header format.
# FIXME: Name fields are 48 bytes, but have spaces for padding instead of 00s.
0		name	sega-mega-drive-header
# ROM title. (Use domestic if present; if not, use international.)
&gt;0x120		byte	&gt;0x20
&gt;&gt;0x120		string	&gt;\0	\b: &quot;%.16s&quot;
&gt;0x120		byte	&lt;0x21
&gt;&gt;0x150		string	&gt;\0	\b: &quot;%.16s&quot;
# Other information.
&gt;0x180		string	&gt;\0	(%.14s
&gt;&gt;0x110		string  &gt;\0	\b, %.16s
&gt;0x180		byte	0
&gt;&gt;0x110		string  &gt;\0	(%.16s
&gt;0		byte	x	\b)

# TODO: Check for 32X CD?
# Sega Mega CD disc images: 2048-byte sectors.
0	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
&gt;0	use	sega-mega-drive-header
&gt;0	byte	x			\b, 2048-byte sectors
0	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
&gt;0	use	sega-mega-drive-header
&gt;0	byte	x			\b, 2048-byte sectors
# Sega Mega CD disc images: 2352-byte sectors.
0x10	string	SEGADISCSYSTEM\ \ 	Sega Mega CD disc image
&gt;0x10	use	sega-mega-drive-header
&gt;0	byte	x			\b, 2352-byte sectors
0x10	string	SEGABOOTDISC\ \ \ \ 	Sega Mega CD disc image
&gt;0x10	use	sega-mega-drive-header
&gt;0	byte	x			\b, 2352-byte sectors

# Sega Mega Drive, 32X, Pico, and Mega CD Boot ROM images.
0x100		string	SEGA
&gt;0x3C0		bequad	0x4D41525320434845	Sega 32X ROM image
&gt;&gt;0		use	sega-mega-drive-header
&gt;0x3C0		bequad	!0x4D41525320434845
&gt;&gt;0x105		belong	0x5049434F	Sega Pico ROM image
&gt;&gt;&gt;0		use	sega-mega-drive-header
&gt;&gt;0x105		belong	!0x5049434F
&gt;&gt;&gt;0x180	beshort	0x4252		Sega Mega CD Boot ROM image
&gt;&gt;&gt;0x180	beshort	!0x4252		Sega Mega Drive / Genesis ROM image
&gt;&gt;&gt;0		use	sega-mega-drive-header

#------------------------------------------------------------------------------
# genesis: file(1) magic for the Super MegaDrive ROM dump format
#

# NOTE: Due to interleaving, we can&#039;t display anything
# other than the copier header information.
0      name    sega-genesis-smd-header
&gt;0     byte    x       %dx16k blocks
&gt;2     byte    0       \b, last in series or standalone
&gt;2     byte    &gt;0      \b, split ROM

# &quot;Sega Genesis&quot; header.
0x280	string EAGN
&gt;8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
&gt;&gt;0	use     sega-genesis-smd-header

# &quot;Sega Mega Drive&quot; header.
0x280	string EAMG
&gt;8	beshort	0xAABB	Sega Mega Drive / Genesis ROM image (SMD format):
&gt;&gt;0	use     sega-genesis-smd-header

#------------------------------------------------------------------------------
# smsgg:  file(1) magic for Sega Master System and Game Gear ROM images
# Detects all Game Gear and export Sega Master System ROM images,
# and some Japanese Sega Master System ROM images.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: http://www.smspower.org/Development/ROMHeader
#

# General SMS header rule.
# The SMS boot ROM checks the header at three locations.
0	name	sega-master-system-rom-header
# Machine type.
&gt;0x0F	byte&amp;0xF0	0x30	Sega Master System
&gt;0x0F	byte&amp;0xF0	0x40	Sega Master System
&gt;0x0F	byte&amp;0xF0	0x50	Sega Game Gear
&gt;0x0F	byte&amp;0xF0	0x60	Sega Game Gear
&gt;0x0F	byte&amp;0xF0	0x70	Sega Game Gear
&gt;0x0F	byte&amp;0xF0	&lt;0x30	Sega Master System / Game Gear
&gt;0x0F	byte&amp;0xF0	&gt;0x70	Sega Master System / Game Gear
&gt;0	byte		x	ROM image:
# Product code.
&gt;0x0E	byte&amp;0xF0	0x10	1
&gt;0x0E	byte&amp;0xF0	0x20	2
&gt;0x0E	byte&amp;0xF0	0x30	3
&gt;0x0E	byte&amp;0xF0	0x40	4
&gt;0x0E	byte&amp;0xF0	0x50	5
&gt;0x0E	byte&amp;0xF0	0x60	6
&gt;0x0E	byte&amp;0xF0	0x70	7
&gt;0x0E	byte&amp;0xF0	0x80	8
&gt;0x0E	byte&amp;0xF0	0x90	9
&gt;0x0E	byte&amp;0xF0	0xA0	10
&gt;0x0E	byte&amp;0xF0	0xB0	11
&gt;0x0E	byte&amp;0xF0	0xC0	12
&gt;0x0E	byte&amp;0xF0	0xD0	13
&gt;0x0E	byte&amp;0xF0	0xE0	14
&gt;0x0E	byte&amp;0xF0	0xF0	15
# If the product code is 5 digits, we&#039;ll need to backspace here.
&gt;0x0E	byte&amp;0xF0	!0
&gt;&gt;0x0C	leshort		x	\b%04x
&gt;0x0E	byte&amp;0xF0	0
&gt;&gt;0x0C	leshort		x	%04x
# Revision.
&gt;0x0E	byte&amp;0x0F	x	(Rev.%02d)
# ROM size. (Used for the boot ROM checksum routine.)
&gt;0x0F	byte&amp;0x0F	0x0A	(8 KB)
&gt;0x0F	byte&amp;0x0F	0x0B	(16 KB)
&gt;0x0F	byte&amp;0x0F	0x0C	(32 KB)
&gt;0x0F	byte&amp;0x0F	0x0D	(48 KB)
&gt;0x0F	byte&amp;0x0F	0x0E	(64 KB)
&gt;0x0F	byte&amp;0x0F	0x0F	(128 KB)
&gt;0x0F	byte&amp;0x0F	0x00	(256 KB)
&gt;0x0F	byte&amp;0x0F	0x01	(512 KB)
&gt;0x0F	byte&amp;0x0F	0x02	(1 MB)

# SMS/GG header locations.
0x7FF0	string	TMR\ SEGA
&gt;0x7FF0	use	sega-master-system-rom-header
0x3FF0	string	TMR\ SEGA
&gt;0x3FF0	use	sega-master-system-rom-header
0x1FF0	string	TMR\ SEGA
&gt;0x1FF0	use	sega-master-system-rom-header

#------------------------------------------------------------------------------
# saturn: file(1) magic for the Sega Saturn disc image format.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
#

# Common Sega Saturn disc header format.
# NOTE: Title is 112 bytes, but we&#039;re only showing 32 due to space padding.
# TODO: Release date, device information, region code, others?
0	name	sega-saturn-disc-header
&gt;0x60	string	&gt;\0	\b: &quot;%.32s&quot;
&gt;0x20	string	&gt;\0	(%.10s
&gt;&gt;0x2A	string	&gt;\0	\b, %.6s)
&gt;&gt;0x2A	byte	0	\b)

# 2048-byte sector version.
0	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
&gt;0	use	sega-saturn-disc-header
&gt;0	byte	x			(2048-byte sectors)
# 2352-byte sector version.
0x10	string	SEGA\ SEGASATURN\ 	Sega Saturn disc image
&gt;0x10	use	sega-saturn-disc-header
&gt;0	byte	x			(2352-byte sectors)

#------------------------------------------------------------------------------
# dreamcast: file(1) magic for the Sega Dreamcast disc image format.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: http://mc.pp.se/dc/ip0000.bin.html
#

# Common Sega Dreamcast disc header format.
# NOTE: Title is 128 bytes, but we&#039;re only showing 32 due to space padding.
# TODO: Release date, device information, region code, others?
0	name	sega-dreamcast-disc-header
&gt;0x80	string	&gt;\0	\b: &quot;%.32s&quot;
&gt;0x40	string	&gt;\0	(%.10s
&gt;&gt;0x4A	string	&gt;\0	\b, %.6s)
&gt;&gt;0x4A	byte	0	\b)

# 2048-byte sector version.
0	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
&gt;0	use	sega-dreamcast-disc-header
&gt;0	byte	x			(2048-byte sectors)
# 2352-byte sector version.
0x10	string	SEGA\ SEGAKATANA\ 	Sega Dreamcast disc image
&gt;0x10	use	sega-dreamcast-disc-header
&gt;0	byte	x			(2352-byte sectors)

#------------------------------------------------------------------------------
# dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
#
0 belong 0x21068028   Sega Dreamcast VMU game image
0 string LCDi         Dream Animator file

#------------------------------------------------------------------------------
# z64: file(1) magic for the Z64 format N64 ROM dumps
# Reference: http://forum.pj64-emu.com/showthread.php?t=2239
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
#
0	bequad	0x803712400000000F	Nintendo 64 ROM image
&gt;0x20	string	&gt;\0	\b: &quot;%.20s&quot;
&gt;0x3B	string	x	(%.4s
&gt;0x3F	byte	x	\b, Rev.%02u)

#------------------------------------------------------------------------------
# v64: file(1) magic for the V64 format N64 ROM dumps
# Same as z64 format, but with 16-bit byteswapping.
#
0	bequad	0x3780401200000F00	Nintendo 64 ROM image (V64)

#------------------------------------------------------------------------------
# n64-swap2: file(1) magic for the swap2 format N64 ROM dumps
# Same as z64 format, but with swapped 16-bit words.
#
0	bequad	0x12408037000F0000	Nintendo 64 ROM image (wordswapped)

#------------------------------------------------------------------------------
# n64-le32: file(1) magic for the 32-bit byteswapped format N64 ROM dumps
# Same as z64 format, but with 32-bit byteswapping.
#
0	bequad	0x401237800F000000	Nintendo 64 ROM image (32-bit byteswapped)

#------------------------------------------------------------------------------
# gba: file(1) magic for the Nintendo Game Boy Advance raw ROM format
# Reference: http://problemkaputt.de/gbatek.htm#gbacartridgeheader
#
# Original version from: &quot;Nelson A. de Oliveira&quot; &lt;naoliv@gmail.com&gt;
# Updated version from: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
#
4	bequad	0x24FFAE51699AA221	Game Boy Advance ROM image
&gt;0xA0	string	&gt;\0	\b: &quot;%.12s&quot;
&gt;0xAC	string	x	(%.6s
&gt;0xBC	byte	x	\b, Rev.%02u)

#------------------------------------------------------------------------------
# nds: file(1) magic for the Nintendo DS(i) raw ROM format
# Reference: http://problemkaputt.de/gbatek.htm#dscartridgeheader
#
# Original version from: &quot;Nelson A. de Oliveira&quot; &lt;naoliv@gmail.com&gt;
# Updated version from: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
#
0xC0	bequad	0x24FFAE51699AA221	Nintendo DS ROM image
&gt;0x00	string	&gt;\0		\b: &quot;%.12s&quot;
&gt;0x0C	string	x		(%.6s
&gt;0x1E	byte	x		\b, Rev.%02u)
&gt;0x12	byte	2		(DSi enhanced)
&gt;0x12	byte	3		(DSi only)
# Secure Area check.
&gt;0x20		lelong	&lt;0x4000		(homebrew)
&gt;0x20		lelong	&gt;0x3FFF
&gt;&gt;0x4000	lequad	0x0000000000000000	(multiboot)
&gt;&gt;0x4000	lequad	!0x0000000000000000
&gt;&gt;&gt;0x4000	lequad	0xE7FFDEFFE7FFDEFF	(decrypted)
&gt;&gt;&gt;0x4000	lequad	!0xE7FFDEFFE7FFDEFF
&gt;&gt;&gt;&gt;0x1000	lequad	0x0000000000000000	(encrypted)
&gt;&gt;&gt;&gt;0x1000	lequad	!0x0000000000000000	(mask ROM)

#------------------------------------------------------------------------------
# nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot.
# This is also used for loading .nds files using the MSET exploit on 3DS.
# Reference: https://github.com/devkitPro/ndstool/blob/master/source/ndscreate.cpp
0xC0	bequad	0xC8604FE201708FE2	Nintendo DS Slot-2 ROM image (PassMe)

#------------------------------------------------------------------------------
# ngp: file(1) magic for the Neo Geo Pocket (Color) raw ROM format.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# References:
# - https://neogpc.googlecode.com/svn-history/r10/trunk/src/core/neogpc.cpp
# - http://www.devrs.com/ngp/files/ngpctech.txt
#
0x0A	string	BY\ SNK\ CORPORATION	Neo Geo Pocket
&gt;0x23	byte	0x10			Color
&gt;0	byte	x			ROM image
&gt;0x24	string	&gt;\0			\b: &quot;%.12s&quot;
&gt;0x1F	byte	0xFF			(debug mode enabled)

#------------------------------------------------------------------------------
# msx: file(1) magic for MSX game cartridge dumps
# Too simple - MPi
#0 beshort 0x4142 MSX game cartridge dump

#------------------------------------------------------------------------------
# Sony Playstation executables (Adam Sjoegren &lt;asjo@diku.dk&gt;) :
0	string	PS-X\ EXE	Sony Playstation executable
&gt;16	lelong	x		PC=0x%08x,
&gt;20	lelong	!0		GP=0x%08x,
&gt;24	lelong	!0		.text=[0x%08x,
&gt;&gt;28	lelong	x		\b0x%x],
&gt;32	lelong	!0		.data=[0x%08x,
&gt;&gt;36	lelong	x		\b0x%x],
&gt;40	lelong	!0		.bss=[0x%08x,
&gt;&gt;44	lelong	x		\b0x%x],
&gt;48	lelong	!0		Stack=0x%08x,
&gt;48	lelong	=0		No Stack!,
&gt;52	lelong	!0		StackSize=0x%x,
#&gt;76	string	&gt;\0		(%s)
#  Area:
&gt;113	string	x		(%s)

# CPE executables
0	string	CPE		CPE executable
&gt;3	byte	x		(version %d)

#------------------------------------------------------------------------------
# Microsoft Xbox executables .xbe (Esa Hyytia &lt;ehyytia@cc.hut.fi&gt;)
0       string          XBEH            XBE, Microsoft Xbox executable
# probabilistic checks whether signed or not
&gt;0x0004 ulelong =0x0
&gt;&gt;&amp;2    ulelong =0x0
&gt;&gt;&gt;&amp;2   ulelong =0x0  \b, not signed
&gt;0x0004 ulelong &gt;0
&gt;&gt;&amp;2    ulelong &gt;0
&gt;&gt;&gt;&amp;2   ulelong &gt;0    \b, signed
# expect base address of 0x10000
&gt;0x0104               ulelong =0x10000
&gt;&gt;(0x0118-0x0FF60)    ulelong&amp;0x80000007  0x80000007 \b, all regions
&gt;&gt;(0x0118-0x0FF60)    ulelong&amp;0x80000007  !0x80000007
&gt;&gt;&gt;(0x0118-0x0FF60)   ulelong &gt;0           (regions:
&gt;&gt;&gt;&gt;(0x0118-0x0FF60)  ulelong &amp;0x00000001  NA
&gt;&gt;&gt;&gt;(0x0118-0x0FF60)  ulelong &amp;0x00000002  Japan
&gt;&gt;&gt;&gt;(0x0118-0x0FF60)  ulelong &amp;0x00000004  Rest_of_World
&gt;&gt;&gt;&gt;(0x0118-0x0FF60)  ulelong &amp;0x80000000  Manufacturer
&gt;&gt;&gt;(0x0118-0x0FF60)   ulelong &gt;0           \b)

# --------------------------------
# Microsoft Xbox data file formats
0       string          XIP0            XIP, Microsoft Xbox data
0       string          XTF0            XTF, Microsoft Xbox data

# Atari Lynx cartridge dump (EXE/BLL header)
# From: &quot;Stefan A. Haubenthal&quot; &lt;polluks@web.de&gt;

# Double-check that the image type matches too, 0x8008 conflicts with
# 8 character OMF-86 object file headers.
0	beshort		0x8008
&gt;6	string		BS93		Lynx homebrew cartridge
&gt;&gt;2	beshort		x		\b, RAM start $%04x
&gt;6	string		LYNX		Lynx cartridge
&gt;&gt;2	beshort		x		\b, RAM start $%04x

# Opera file system that is used on the 3DO console
# From: Serge van den Boom &lt;svdb@stack.nl&gt;
0	string		\x01ZZZZZ\x01	3DO &quot;Opera&quot; file system

# From: Alex Myczko &lt;alex@aiei.ch&gt;
# From: David Pflug &lt;david@pflug.email&gt;
# is the offset 12 or the offset 16 correct?
# GBS (Game Boy Sound) magic
# ftp://ftp.modland.com/pub/documents/format_documentation/\
# Gameboy%20Sound%20System%20(.gbs).txt
0	string		GBS		Nintendo Gameboy Music/Audio Data
#12	string		GameBoy\ Music\ Module	Nintendo Gameboy Music Module
&gt;16	string		&gt;\0	(&quot;%s&quot; by
&gt;48	string		&gt;\0	%s, copyright
&gt;80	string		&gt;\0	%s),
&gt;3	byte		x	version %d,
&gt;4	byte		x	%d tracks

# IPS Patch Files from: From: Thomas Klausner &lt;tk@giga.or.at&gt;
# see http://zerosoft.zophar.net/ips.php
0	string	PATCH			IPS patch file

# Playstations Patch Files from: From: Thomas Klausner &lt;tk@giga.or.at&gt;
0	string	PPF30			Playstation Patch File version 3.0
&gt;5	byte	0			\b, PPF 1.0 patch
&gt;5	byte	1			\b, PPF 2.0 patch
&gt;5	byte	2			\b, PPF 3.0 patch
&gt;&gt;56	byte	0			\b, Imagetype BIN (any)
&gt;&gt;56	byte	1			\b, Imagetype GI (PrimoDVD)
&gt;&gt;57	byte	0			\b, Blockcheck disabled
&gt;&gt;57	byte	1			\b, Blockcheck enabled
&gt;&gt;58	byte	0			\b, Undo data not available
&gt;&gt;58	byte	1			\b, Undo data available
&gt;6	string	x			\b, description: %s

0	string	PPF20			Playstation Patch File version 2.0
&gt;5	byte	0			\b, PPF 1.0 patch
&gt;5	byte	1			\b, PPF 2.0 patch
&gt;&gt;56	lelong	&gt;0			\b, size of file to patch %d
&gt;6	string	x			\b, description: %s

0	string	PPF10			Playstation Patch File version 1.0
&gt;5	byte	0			\b, Simple Encoding
&gt;6	string	x			\b, description: %s

# From: Daniel Dawson &lt;ddawson@icehouse.net&gt;
# SNES9x .smv &quot;movie&quot; file format.
0		string		SMV\x1A	SNES9x input recording
&gt;0x4		lelong		x	\b, version %d
# version 4 is latest so far
&gt;0x4		lelong		&lt;5
&gt;&gt;0x8		ledate		x	\b, recorded at %s
&gt;&gt;0xc		lelong		&gt;0	\b, rerecorded %d times
&gt;&gt;0x10		lelong		x	\b, %d frames long
&gt;&gt;0x14		byte		&gt;0	\b, data for controller(s):
&gt;&gt;&gt;0x14		byte		&amp;0x1	#1
&gt;&gt;&gt;0x14		byte		&amp;0x2	#2
&gt;&gt;&gt;0x14		byte		&amp;0x4	#3
&gt;&gt;&gt;0x14		byte		&amp;0x8	#4
&gt;&gt;&gt;0x14		byte		&amp;0x10	#5
&gt;&gt;0x15		byte		^0x1	\b, begins from snapshot
&gt;&gt;0x15		byte		&amp;0x1	\b, begins from reset
&gt;&gt;0x15		byte		^0x2	\b, NTSC standard
&gt;&gt;0x15		byte		&amp;0x2	\b, PAL standard
&gt;&gt;0x17		byte		&amp;0x1    \b, settings:
# WIP1Timing not used as of version 4
&gt;&gt;&gt;0x4		lelong		&lt;4
&gt;&gt;&gt;&gt;0x17	byte		&amp;0x2	WIP1Timing
&gt;&gt;&gt;0x17		byte		&amp;0x4	Left+Right
&gt;&gt;&gt;0x17		byte		&amp;0x8	VolumeEnvX
&gt;&gt;&gt;0x17		byte		&amp;0x10	FakeMute
&gt;&gt;&gt;0x17		byte		&amp;0x20	SyncSound
# New flag as of version 4
&gt;&gt;&gt;0x4		lelong		&gt;3
&gt;&gt;&gt;&gt;0x17	byte		&amp;0x80	NoCPUShutdown
&gt;&gt;0x4		lelong		&lt;4
&gt;&gt;&gt;0x18		lelong		&gt;0x23
&gt;&gt;&gt;&gt;0x20	leshort		!0
&gt;&gt;&gt;&gt;&gt;0x20	lestring16	x	\b, metadata: &quot;%s&quot;
&gt;&gt;0x4		lelong		&gt;3
&gt;&gt;&gt;0x24		byte		&gt;0	\b, port 1:
&gt;&gt;&gt;&gt;0x24	byte		1	joypad
&gt;&gt;&gt;&gt;0x24	byte		2	mouse
&gt;&gt;&gt;&gt;0x24	byte		3	SuperScope
&gt;&gt;&gt;&gt;0x24	byte		4	Justifier
&gt;&gt;&gt;&gt;0x24	byte		5	multitap
&gt;&gt;&gt;0x24		byte		&gt;0	\b, port 2:
&gt;&gt;&gt;&gt;0x25	byte		1	joypad
&gt;&gt;&gt;&gt;0x25	byte		2	mouse
&gt;&gt;&gt;&gt;0x25	byte		3	SuperScope
&gt;&gt;&gt;&gt;0x25	byte		4	Justifier
&gt;&gt;&gt;&gt;0x25	byte		5	multitap
&gt;&gt;&gt;0x18		lelong		&gt;0x43
&gt;&gt;&gt;&gt;0x40	leshort		!0
&gt;&gt;&gt;&gt;&gt;0x40	lestring16	x	\b, metadata: &quot;%s&quot;
&gt;&gt;0x17		byte		&amp;0x40   \b, ROM:
&gt;&gt;&gt;(0x18.l-26)	lelong		x	CRC32 0x%08x
&gt;&gt;&gt;(0x18.l-23)	string		x	&quot;%s&quot;

# Type: scummVM savegame files
# From: Sven Hartge &lt;debian@ds9.argh.org&gt;
0	string	SCVM	ScummVM savegame
&gt;12	string	&gt;\0	&quot;%s&quot;

#------------------------------------------------------------------------------
# Nintendo GameCube / Wii file formats.
#

# Type: Nintendo GameCube/Wii common disc header data.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: http://wiibrew.org/wiki/Wii_Disc
0	name	nintendo-gcn-disc-common
&gt;0x20	string	x	&quot;%.64s&quot;
&gt;0x00	string	x	(%.6s
&gt;0x06	byte	&gt;0
&gt;&gt;0x06	byte	1	\b, Disc 2
&gt;&gt;0x06	byte	2	\b, Disc 3
&gt;&gt;0x06	byte	3	\b, Disc 4
&gt;0x07	byte	x	\b, Rev.%02u)

# Type: Nintendo GameCube disc image
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: http://wiibrew.org/wiki/Wii_Disc
0x1C	belong	0xC2339F3D	Nintendo GameCube disc image:
&gt;0	use	nintendo-gcn-disc-common

# Type: Nintendo GameCube embedded disc image
# Commonly found on demo discs.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: http://hitmen.c02.at/files/yagcd/yagcd/index.html#idx14.8
0		belong	0xAE0F38A2
&gt;0x0C		belong	0x00100000
&gt;&gt;(8.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube embedded disc image:
&gt;&gt;&gt;(8.L)	use	nintendo-gcn-disc-common

# Type: Nintendo Wii disc image
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: http://wiibrew.org/wiki/Wii_Disc
0x18	belong	0x5D1C9EA3	Nintendo Wii disc image:
&gt;0	use	nintendo-gcn-disc-common

# Type: Nintendo Wii disc image (WBFS format)
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: http://wiibrew.org/wiki/Wii_Disc
0	string	WBFS
&gt;0x218	belong	0x5D1C9EA3	Nintendo Wii disc image (WBFS format):
&gt;&gt;0x200	use	nintendo-gcn-disc-common

# Type: Nintendo GameCube/Wii disc image (CISO format)
# NOTE: This is NOT the same as Compact ISO or PSP CISO,
# though it has the same magic number.
0		string	CISO
# Other fields are used to determine what type of CISO this is:
# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
# - None of the above: Compact ISO.
&gt;4		lelong	0x200000
&gt;&gt;8		byte	1
&gt;&gt;&gt;0x801C	belong	0xC2339F3D	Nintendo GameCube disc image (CISO format):
&gt;&gt;&gt;&gt;0x8000	use	nintendo-gcn-disc-common
&gt;&gt;&gt;0x8018	belong	0x5D1C9EA3	Nintendo Wii disc image (CISO format):
&gt;&gt;&gt;&gt;0x8000	use	nintendo-gcn-disc-common

# Type: Nintendo GameCube/Wii disc image (GCZ format)
# Due to zlib compression, we can&#039;t get the actual disc information.
0	lelong	0xB10BC001
&gt;4	lelong	0		Nintendo GameCube disc image (GCZ format)
&gt;4	lelong	1		Nintendo Wii disc image (GCZ format)
&gt;4	lelong	&gt;1		Nintendo GameCube/Wii disc image (GCZ format)

# Type: Nintendo GameCube/Wii disc image (WDF format)
0		string	WII\001DISC
&gt;8		belong	1
# WDFv1
&gt;&gt;0x54		belong	0xC2339F3D	Nintendo GameCube disc image (WDFv1 format):
&gt;&gt;&gt;0x38		use	nintendo-gcn-disc-common
&gt;&gt;0x58		belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv1 format):
&gt;&gt;&gt;0x38		use	nintendo-gcn-disc-common
&gt;8		belong	2
# WDFv2
&gt;&gt;(12.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube disc image (WDFv2 format):
&gt;&gt;&gt;(12.L)	use	nintendo-gcn-disc-common
&gt;&gt;(12.L+0x18)	belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv2 format):
&gt;&gt;&gt;(12.L)	use	nintendo-gcn-disc-common

# Type: Nintendo GameCube/Wii disc image (WIA format)
0	string	WIA\001	Nintendo
&gt;0x48	belong	0	GameCube/Wii
&gt;0x48	belong	1	GameCube
&gt;0x48	belong	2	Wii
&gt;0x48	belong	&gt;2	GameCube/Wii
&gt;0x48	belong	x	disc image (WIA format):
&gt;&gt;0x58	use	nintendo-gcn-disc-common

#------------------------------------------------------------------------------
# Nintendo 3DS file formats.
#

# Type: Nintendo 3DS &quot;NCSD&quot; image. (game cards and eMMC)
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: https://www.3dbrew.org/wiki/NCSD
0x100		string		NCSD
&gt;0x118		lequad		0		Nintendo 3DS Game Card image
# NCCH header for partition 0. (game data)
&gt;&gt;0x1150	string		&gt;\0	\b: &quot;%.16s&quot;
&gt;&gt;0x312		byte		x	(Rev.%02u)
&gt;&gt;0x118C	byte		2	(New3DS only)
&gt;&gt;0x18D		byte		0		(inner device)
&gt;&gt;0x18D		byte		1		(Card1)
&gt;&gt;0x18D		byte		2		(Card2)
&gt;&gt;0x18D		byte		3		(extended device)
&gt;0x118		bequad		0x0102020202000000	Nintendo 3DS eMMC dump (Old3DS)
&gt;0x118		bequad		0x0102020203000000	Nintendo 3DS eMMC dump (New3DS)

# Nintendo 3DS version code.
# Reference: https://www.3dbrew.org/wiki/Titles
# Format: leshort containing three fields:
# - 6-bit: Major
# - 6-bit: Minor
# - 4-bit: Revision
# NOTE: Only supporting major/minor versions from 0-15 right now.
# NOTE: Should be prefixed with &quot;v&quot;.
0	name	nintendo-3ds-version-code
# Raw version.
&gt;0	leshort	x	\b%u,
# Major version.
&gt;0	leshort&amp;0xFC00	0x0000	0
&gt;0	leshort&amp;0xFC00	0x0400	1
&gt;0	leshort&amp;0xFC00	0x0800	2
&gt;0	leshort&amp;0xFC00	0x0C00	3
&gt;0	leshort&amp;0xFC00	0x1000	4
&gt;0	leshort&amp;0xFC00	0x1400	5
&gt;0	leshort&amp;0xFC00	0x1800	6
&gt;0	leshort&amp;0xFC00	0x1C00	7
&gt;0	leshort&amp;0xFC00	0x2000	8
&gt;0	leshort&amp;0xFC00	0x2400	9
&gt;0	leshort&amp;0xFC00	0x2800	10
&gt;0	leshort&amp;0xFC00	0x2C00	11
&gt;0	leshort&amp;0xFC00	0x3000	12
&gt;0	leshort&amp;0xFC00	0x3400	13
&gt;0	leshort&amp;0xFC00	0x3800	14
&gt;0	leshort&amp;0xFC00	0x3C00	15
# Minor version.
&gt;0	leshort&amp;0x03F0	0x0000	\b.0
&gt;0	leshort&amp;0x03F0	0x0010	\b.1
&gt;0	leshort&amp;0x03F0	0x0020	\b.2
&gt;0	leshort&amp;0x03F0	0x0030	\b.3
&gt;0	leshort&amp;0x03F0	0x0040	\b.4
&gt;0	leshort&amp;0x03F0	0x0050	\b.5
&gt;0	leshort&amp;0x03F0	0x0060	\b.6
&gt;0	leshort&amp;0x03F0	0x0070	\b.7
&gt;0	leshort&amp;0x03F0	0x0080	\b.8
&gt;0	leshort&amp;0x03F0	0x0090	\b.9
&gt;0	leshort&amp;0x03F0	0x00A0	\b.10
&gt;0	leshort&amp;0x03F0	0x00B0	\b.11
&gt;0	leshort&amp;0x03F0	0x00C0	\b.12
&gt;0	leshort&amp;0x03F0	0x00D0	\b.13
&gt;0	leshort&amp;0x03F0	0x00E0	\b.14
&gt;0	leshort&amp;0x03F0	0x00F0	\b.15
# Revision.
&gt;0	leshort&amp;0x000F	x	\b.%u

# Type: Nintendo 3DS &quot;NCCH&quot; container.
# https://www.3dbrew.org/wiki/NCCH
0x100		string	NCCH	Nintendo 3DS
&gt;0x18D		byte&amp;2	0	File Archive (CFA)
&gt;0x18D		byte&amp;2	2	Executable Image (CXI)
&gt;0x150		string	&gt;\0	\b: &quot;%.16s&quot;
&gt;0x18D		byte	0x05
&gt;&gt;0x10E		leshort	x	(Old3DS System Update v
&gt;&gt;0x10E		use	nintendo-3ds-version-code
&gt;&gt;0x10E		leshort	x	\b)
&gt;0x18D		byte	0x15
&gt;&gt;0x10E		leshort	x	(New3DS System Update v
&gt;&gt;0x10E		use	nintendo-3ds-version-code
&gt;&gt;0x10E		leshort	x	\b)
&gt;0x18D		byte	!0x05
&gt;&gt;0x18D		byte	!0x15
&gt;&gt;&gt;0x112	byte	x	(v
&gt;&gt;&gt;0x112	use	nintendo-3ds-version-code
&gt;&gt;&gt;0x112	byte	x	\b)
&gt;0x18C		byte	2	(New3DS only)

# Type: Nintendo 3DS &quot;SMDH&quot; file. (application description)
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: https://3dbrew.org/wiki/SMDH
0		string		SMDH		Nintendo 3DS SMDH file
&gt;0x208		leshort		!0
&gt;&gt;0x208		lestring16	x		\b: &quot;%.128s&quot;
&gt;&gt;0x388		leshort		!0
&gt;&gt;&gt;0x388	lestring16	x		by %.128s
&gt;0x208		leshort		0
&gt;&gt;0x008		leshort		!0
&gt;&gt;&gt;0x008	lestring16	x		\b: &quot;%.128s&quot;
&gt;&gt;&gt;0x188	leshort		!0
&gt;&gt;&gt;&gt;0x188	lestring16	x		by %.128s

# Type: Nintendo 3DS Homebrew Application.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: https://3dbrew.org/wiki/3DSX_Format
0	string	3DSX	Nintendo 3DS Homebrew Application (3DSX)

#------------------------------------------------------------------------------
# a7800: file(1) magic for the Atari 7800 raw ROM format.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: https://sites.google.com/site/atari7800wiki/a78-header

0	byte	&gt;0
&gt;0	byte	&lt;3
&gt;&gt;1	string	ATARI7800	Atari 7800 ROM image
&gt;&gt;&gt;0x11	string	&gt;\0	\b: &quot;%.32s&quot;
# Display type.
&gt;&gt;&gt;0x39	byte	0	(NTSC)
&gt;&gt;&gt;0x39	byte	1	(PAL)
&gt;&gt;&gt;0x36	byte&amp;1	1	(POKEY)

#------------------------------------------------------------------------------
# vectrex: file(1) magic for the GCE Vectrex raw ROM format.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: http://www.playvectrex.com/designit/chrissalo/hello1.htm
#
# NOTE: Title is terminated with 0x80, not 0.
# The header is terminated with a 0, so that will
# terminate the title as well.
#
0	string	g\ GCE	Vectrex ROM image
&gt;0x11	string	&gt;\0	\b: &quot;%.16s&quot;

#------------------------------------------------------------------------------
# amiibo: file(1) magic for Nintendo amiibo NFC dumps.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# Reference: https://www.3dbrew.org/wiki/Amiibo
0x00		byte	0x04
&gt;0x0A		beshort	0x0FE0
&gt;&gt;0x0C		belong	0xF110FFEE
&gt;&gt;&gt;0x208	beshort	0x0100
&gt;&gt;&gt;&gt;0x020A	byte	0x0F
&gt;&gt;&gt;&gt;&gt;0x020C	bequad	0x000000045F000000
&gt;&gt;&gt;&gt;&gt;&gt;0x5B	byte	0x02
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x54	belong	x	Nintendo amiibo NFC dump - amiibo ID: %08X-
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x58	belong	x	\b%08X

#------------------------------------------------------------------------------
# $File: convex,v 1.8 2012/10/03 23:44:43 christos Exp $
# convex:  file(1) magic for Convex boxes
#
# Convexes are big-endian.
#
# /*\
#  * Below are the magic numbers and tests added for Convex.
#  * Added at beginning, because they are expected to be used most.
# \*/
0	belong	0507	Convex old-style object
&gt;16	belong	&gt;0	not stripped
0	belong	0513	Convex old-style demand paged executable
&gt;16	belong	&gt;0	not stripped
0	belong	0515	Convex old-style pre-paged executable
&gt;16	belong	&gt;0	not stripped
0	belong	0517	Convex old-style pre-paged, non-swapped executable
&gt;16	belong	&gt;0	not stripped
0	belong	0x011257	Core file
#
# The following are a series of dump format magic numbers.  Each one
# corresponds to a drastically different dump format.  The first on is
# the original dump format on a 4.1 BSD or earlier file system.  The
# second marks the change between the 4.1 file system and the 4.2 file
# system.  The Third marks the changing of the block size from 1K
# to 2K to be compatible with an IDC file system.  The fourth indicates
# a dump that is dependent on Convex Storage Manager, because data in
# secondary storage is not physically contained within the dump.
# The restore program uses these number to determine how the data is
# to be extracted.
#
24	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
24	belong	=60014	dump format, Convex Storage Manager by-reference dump
#
# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
# If there is no `=&#039; sign, assume just checking for whether the bit is set?
#
0	belong	0601		Convex SOFF
&gt;88	belong&amp;0x000f0000	=0x00000000	c1
&gt;88	belong			&amp;0x00010000	c2
&gt;88	belong			&amp;0x00020000	c2mp
&gt;88	belong			&amp;0x00040000	parallel
&gt;88	belong			&amp;0x00080000	intrinsic
&gt;88	belong			&amp;0x00000001	demand paged
&gt;88	belong			&amp;0x00000002	pre-paged
&gt;88	belong			&amp;0x00000004	non-swapped
&gt;88	belong			&amp;0x00000008	POSIX
#
&gt;84	belong			&amp;0x80000000	executable
&gt;84	belong			&amp;0x40000000	object
&gt;84	belong&amp;0x20000000	=0		not stripped
&gt;84	belong&amp;0x18000000	=0x00000000	native fpmode
&gt;84	belong&amp;0x18000000	=0x10000000	ieee fpmode
&gt;84	belong&amp;0x18000000	=0x18000000	undefined fpmode
#
0	belong			0605		Convex SOFF core
#
0	belong			0607		Convex SOFF checkpoint
&gt;88	belong&amp;0x000f0000	=0x00000000	c1
&gt;88	belong			&amp;0x00010000	c2
&gt;88	belong			&amp;0x00020000	c2mp
&gt;88	belong			&amp;0x00040000	parallel
&gt;88	belong			&amp;0x00080000	intrinsic
&gt;88	belong			&amp;0x00000008	POSIX
#
&gt;84	belong&amp;0x18000000	=0x00000000	native fpmode
&gt;84	belong&amp;0x18000000	=0x10000000	ieee fpmode
&gt;84	belong&amp;0x18000000	=0x18000000	undefined fpmode

#------------------------------------------------------------------------------
# $File: coverage,v 1.1 2016/06/05 00:26:32 christos Exp $
# xoverage:  file(1) magic for test coverage data

# File formats used to store test coverage data
# 2016-05-21, Georg Sauthoff &lt;mail@georg.so&gt;


# - GCC gcno - written by GCC at compile time when compiling with
# 	gcc -ftest-coverage
# - GCC gcda - written by a program that was compiled with
#	gcc -fprofile-arcs
# - LLVM raw profiles - generated by a program compiled with
#	clang -fprofile-instr-generate -fcoverage-mapping ...
# - LLVM indexed profiles - generated by
#	llvm-profdata
# - GCOV reports, i.e. the annotated source code
# - LCOV trace files, i.e. aggregated GCC profiles
#
# GCC coverage tracefiles
# .gcno file are created during compile time,
# while data collected during runtime is stored in .gcda files
# cf. gcov-io.h
# https://gcc.gnu.org/onlinedocs/gcc-5.3.0/gcc/Gcov-Data-Files.html
# Examples:
# Fedora 23/x86-64/gcc-5.3.1: 6f 6e 63 67 52 33 30 35
# Debian 8 PPC64/gcc-4.9.2  : 67 63 6e 6f 34 30 39 2a
0	lelong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
&gt;&amp;3	byte	x	version %c.
&gt;&amp;1	byte	x	\b%c

# big endian
0	belong	0x67636e6f	GCC gcno coverage (-ftest-coverage),
&gt;&amp;0	byte	x	version %c.
&gt;&amp;2	byte	x	\b%c (big-endian)

# Examples:
# Fedora 23/x86-64/gcc-5.3.1: 61 64 63 67 52 33 30 35
# Debian 8 PPC64/gcc-4.9.2  : 67 63 64 61 34 30 39 2a
0	lelong	0x67636461	GCC gcda coverage (-fprofile-arcs),
&gt;&amp;3	byte	x	version %c.
&gt;&amp;1	byte	x	\b%c

# big endian
0	belong	0x67636461	GCC gcda coverage (-fprofile-arcs),
&gt;&amp;0	byte	x	version %c.
&gt;&amp;2	byte	x	\b%c (big-endian)


# LCOV tracefiles
# cf. http://ltp.sourceforge.net/coverage/lcov/geninfo.1.php
0	string	TN:
&gt;&amp;0	search/64	\nSF:/	LCOV coverage tracefile


# Coverage reports generated by gcov
# i.e. source code annoted with coverage information
0	string	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Source:
&gt;&amp;0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Graph:
&gt;&gt;&amp;0	search/128	\x20\x20\x20\x20\x20\x20\x20\x20-:\x20\x20\x20\ 0:Data:	GCOV coverage report


# LLVM coverage files

# raw data after running a program compiled with:
# `clang -fprofile-instr-generate -fcoverage-mapping ...`
# default name: default.profraw
# magic is: \xFF lprofr \x81
# cf. http://llvm.org/docs/doxygen/html/InstrProfData_8inc_source.html
0	lequad	0xff6c70726f667281	LLVM raw profile data,
&gt;&amp;0	byte	x	version %d

# big endian
0	bequad	0xff6c70726f667281	LLVM raw profile data,
&gt;&amp;7	byte	x	version %d (big-endian)


# LLVM indexed instruction profile (as generated by llvm-profdata)
# magic is: reverse(\xFF lprofi \x81)
# cf. http://llvm.org/docs/CoverageMappingFormat.html
# http://llvm.org/docs/doxygen/html/namespacellvm_1_1IndexedInstrProf.html
# http://llvm.org/docs/CommandGuide/llvm-cov.html
# http://llvm.org/docs/CommandGuide/llvm-profdata.html
0	lequad	0x8169666f72706cff	LLVM indexed profile data,
&gt;&amp;0	byte	x	version %d

# big endian
0	bequad	0x8169666f72706cff	LLVM indexed profile data,
&gt;&amp;7	byte	x	version %d (big-endian)


#------------------------------------------------------------------------------
# $File: cracklib,v 1.7 2009/09/19 16:28:08 christos Exp $
# cracklib:  file (1) magic for cracklib v2.7

0	lelong	0x70775631	Cracklib password index, little endian
&gt;4	long	&gt;0		(%i words)
&gt;4	long	0		(&quot;64-bit&quot;)
&gt;&gt;8	long	&gt;-1		(%i words)
0	belong	0x70775631	Cracklib password index, big endian
&gt;4	belong	&gt;-1		(%i words)
# really bellong 0x0000000070775631
0	search/1	\0\0\0\0pwV1	Cracklib password index, big endian (&quot;64-bit&quot;)
&gt;12	belong	&gt;0		(%i words)

# ----------------------------------------------------------------------------
# $File: ctags,v 1.6 2009/09/19 16:28:08 christos Exp $
# ctags:  file (1) magic for Exuberant Ctags files
# From: Alexander Mai &lt;mai@migdal.ikp.physik.tu-darmstadt.de&gt;
0	search/1	=!_TAG	Exuberant Ctags tag file text

#--------------------------------------------------------------
# ctf:  file(1) magic for CTF (Common Trace Format) trace files
#
# Specs. available here: &lt;http://www.efficios.com/ctf&gt;
#--------------------------------------------------------------

# CTF trace data
0	lelong	0xc1fc1fc1	Common Trace Format (CTF) trace data (LE)
0	belong	0xc1fc1fc1	Common Trace Format (CTF) trace data (BE)

# CTF metadata (packetized)
0	lelong	0x75d11d57	Common Trace Format (CTF) packetized metadata (LE)
&gt;35	byte	x		\b, v%d
&gt;36	byte	x		\b.%d
0	belong	0x75d11d57	Common Trace Format (CTF) packetized metadata (BE)
&gt;35	byte	x		\b, v%d
&gt;36	byte	x		\b.%d

# CTF metadata (plain text)
0	string	/*\x20CTF\x20   Common Trace Format (CTF) plain text metadata
!:strength + 5			# this is to make sure we beat C
&gt;&amp;0	regex	[0-9]+\.[0-9]+	\b, v%s

#------------------------------------------------------------------------------
# $File: cubemap,v 1.1 2012/06/06 13:03:20 christos Exp $
# file(1) magic(5) data for cubemaps  Martin Erik Werner &lt;martinerikwerner@gmail.com&gt;
#
0	string	ACMP	Map file for the AssaultCube FPS game
0	string	CUBE	Map file for cube and cube2 engine games
0	string	MAPZ)	Map file for the Blood Frontier/Red Eclipse FPS games

#------------------------------------------------------------------------------
# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $
# Cups: file(1) magic for the cups raster file format
# From: Laurent Martelli &lt;martellilaurent@gmail.com&gt;
# http://www.cups.org/documentation.php/spec-raster.html
#

0	name		cups-le
&gt;280	lelong		x		\b, %d
&gt;284	lelong		x		\bx%d dpi
&gt;376	lelong		x		\b, %dx
&gt;380	lelong		x		\b%d pixels
&gt;388	lelong		x		%d bits/color
&gt;392	lelong		x		%d bits/pixel
&gt;400	lelong		0		ColorOrder=Chunky
&gt;400	lelong		1		ColorOrder=Banded
&gt;400	lelong		2		ColorOrder=Planar
&gt;404	lelong		0		ColorSpace=gray
&gt;404	lelong		1		ColorSpace=RGB
&gt;404	lelong		2		ColorSpace=RGBA
&gt;404	lelong		3		ColorSpace=black
&gt;404	lelong		4		ColorSpace=CMY
&gt;404	lelong		5		ColorSpace=YMC
&gt;404	lelong		6		ColorSpace=CMYK
&gt;404	lelong		7		ColorSpace=YMCK
&gt;404	lelong		8		ColorSpace=KCMY
&gt;404	lelong		9		ColorSpace=KCMYcm
&gt;404	lelong		10		ColorSpace=GMCK
&gt;404	lelong		11		ColorSpace=GMCS
&gt;404	lelong		12		ColorSpace=WHITE
&gt;404	lelong		13		ColorSpace=GOLD
&gt;404	lelong		14		ColorSpace=SILVER
&gt;404	lelong		15		ColorSpace=CIE XYZ
&gt;404	lelong		16		ColorSpace=CIE Lab
&gt;404	lelong		17		ColorSpace=RGBW
&gt;404	lelong		18		ColorSpace=sGray
&gt;404	lelong		19		ColorSpace=sRGB
&gt;404	lelong		20		ColorSpace=AdobeRGB

# Cups Raster image format, Big Endian
0	string		RaS
&gt;3	string		t		Cups Raster version 1, Big Endian
&gt;3	string		2		Cups Raster version 2, Big Endian
&gt;3	string		3		Cups Raster version 3, Big Endian
!:mime	application/vnd.cups-raster
&gt;0	use		\^cups-le


# Cups Raster image format, Little Endian
1	string		SaR
&gt;0	string		t		Cups Raster version 1, Little Endian
&gt;0	string		2		Cups Raster version 2, Little Endian
&gt;0	string		3		Cups Raster version 3, Little Endian
!:mime	application/vnd.cups-raster
&gt;0	use		cups-le

#------------------------------------------------------------------------------
# $File: dact,v 1.4 2009/09/19 16:28:08 christos Exp $
# dact:  file(1) magic for DACT compressed files
#
0	long		0x444354C3	DACT compressed data
&gt;4	byte		&gt;-1		(version %i.
&gt;5	byte		&gt;-1		$BS%i.
&gt;6	byte		&gt;-1		$BS%i)
&gt;7	long		&gt;0		$BS, original size: %i bytes
&gt;15	long		&gt;30		$BS, block size: %i bytes

#------------------------------------------------------------------------------
# $File: database,v 1.52 2017/08/13 00:21:47 christos Exp $
# database:  file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
#
# GDBM magic numbers
#  Will be maintained as part of the GDBM distribution in the future.
#  &lt;downsj@teeny.org&gt;
0	belong	0x13579acd	GNU dbm 1.x or ndbm database, big endian, 32-bit
!:mime	application/x-gdbm
0	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian, old
!:mime	application/x-gdbm
0	belong	0x13579acf	GNU dbm 1.x or ndbm database, big endian, 64-bit
!:mime	application/x-gdbm
0	lelong	0x13579acd	GNU dbm 1.x or ndbm database, little endian, 32-bit
!:mime	application/x-gdbm
0	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian, old
!:mime	application/x-gdbm
0	lelong	0x13579acf	GNU dbm 1.x or ndbm database, little endian, 64-bit
!:mime	application/x-gdbm
0	string	GDBM		GNU dbm 2.x database
!:mime	application/x-gdbm
#
# Berkeley DB
#
# Ian Darwin&#039;s file /etc/magic files: big/little-endian version.
#
# Hash 1.85/1.86 databases store metadata in network byte order.
# Btree 1.85/1.86 databases store the metadata in host byte order.
# Hash and Btree 2.X and later databases store the metadata in host byte order.

0	long	0x00061561	Berkeley DB
!:mime	application/x-dbm
&gt;8	belong	4321
&gt;&gt;4	belong	&gt;2		1.86
&gt;&gt;4	belong	&lt;3		1.85
&gt;&gt;4	belong	&gt;0		(Hash, version %d, native byte-order)
&gt;8	belong	1234
&gt;&gt;4	belong	&gt;2		1.86
&gt;&gt;4	belong	&lt;3		1.85
&gt;&gt;4	belong	&gt;0		(Hash, version %d, little-endian)

0	belong	0x00061561	Berkeley DB
&gt;8	belong	4321
&gt;&gt;4	belong	&gt;2		1.86
&gt;&gt;4	belong	&lt;3		1.85
&gt;&gt;4	belong	&gt;0		(Hash, version %d, big-endian)
&gt;8	belong	1234
&gt;&gt;4	belong	&gt;2		1.86
&gt;&gt;4	belong	&lt;3		1.85
&gt;&gt;4	belong	&gt;0		(Hash, version %d, native byte-order)

0	long	0x00053162	Berkeley DB 1.85/1.86
&gt;4	long	&gt;0		(Btree, version %d, native byte-order)
0	belong	0x00053162	Berkeley DB 1.85/1.86
&gt;4	belong	&gt;0		(Btree, version %d, big-endian)
0	lelong	0x00053162	Berkeley DB 1.85/1.86
&gt;4	lelong	&gt;0		(Btree, version %d, little-endian)

12	long	0x00061561	Berkeley DB
&gt;16	long	&gt;0		(Hash, version %d, native byte-order)
12	belong	0x00061561	Berkeley DB
&gt;16	belong	&gt;0		(Hash, version %d, big-endian)
12	lelong	0x00061561	Berkeley DB
&gt;16	lelong	&gt;0		(Hash, version %d, little-endian)

12	long	0x00053162	Berkeley DB
&gt;16	long	&gt;0		(Btree, version %d, native byte-order)
12	belong	0x00053162	Berkeley DB
&gt;16	belong	&gt;0		(Btree, version %d, big-endian)
12	lelong	0x00053162	Berkeley DB
&gt;16	lelong	&gt;0		(Btree, version %d, little-endian)

12	long	0x00042253	Berkeley DB
&gt;16	long	&gt;0		(Queue, version %d, native byte-order)
12	belong	0x00042253	Berkeley DB
&gt;16	belong	&gt;0		(Queue, version %d, big-endian)
12	lelong	0x00042253	Berkeley DB
&gt;16	lelong	&gt;0		(Queue, version %d, little-endian)

# From Max Bowsher.
12	long	0x00040988	Berkeley DB
&gt;16	long	&gt;0		(Log, version %d, native byte-order)
12	belong	0x00040988	Berkeley DB
&gt;16	belong	&gt;0		(Log, version %d, big-endian)
12	lelong	0x00040988	Berkeley DB
&gt;16	lelong	&gt;0		(Log, version %d, little-endian)

#
#
# Round Robin Database Tool by Tobias Oetiker &lt;oetiker@ee.ethz.ch&gt;
0	string/b	RRD\0		RRDTool DB
&gt;4	string/b	x		version %s

&gt;&gt;10	short		!0		16bit aligned
&gt;&gt;&gt;10	bedouble	8.642135e+130	big-endian
&gt;&gt;&gt;&gt;18	short		x		32bit long (m68k)

&gt;&gt;10	short		0
&gt;&gt;&gt;12	long		!0		32bit aligned
&gt;&gt;&gt;&gt;12	bedouble	8.642135e+130	big-endian
&gt;&gt;&gt;&gt;&gt;20 long		0		64bit long
&gt;&gt;&gt;&gt;&gt;20 long		!0		32bit long
&gt;&gt;&gt;&gt;12	ledouble	8.642135e+130	little-endian
&gt;&gt;&gt;&gt;&gt;24 long		0		64bit long
&gt;&gt;&gt;&gt;&gt;24 long		!0		32bit long (i386)
&gt;&gt;&gt;&gt;12	string		\x43\x2b\x1f\x5b\x2f\x25\xc0\xc7	middle-endian
&gt;&gt;&gt;&gt;&gt;24 short		!0		32bit long (arm)

&gt;&gt;8	quad		0		64bit aligned
&gt;&gt;&gt;16	bedouble	8.642135e+130	big-endian
&gt;&gt;&gt;&gt;24	long		0		64bit long (s390x)
&gt;&gt;&gt;&gt;24	long		!0		32bit long (hppa/mips/ppc/s390/SPARC)
&gt;&gt;&gt;16	ledouble	8.642135e+130	little-endian
&gt;&gt;&gt;&gt;28	long		0		64bit long (alpha/amd64/ia64)
&gt;&gt;&gt;&gt;28	long		!0		32bit long (armel/mipsel)

#----------------------------------------------------------------------
# ROOT: file(1) magic for ROOT databases
#
0       string  root\0  ROOT file
&gt;4      belong  x       Version %d
&gt;33     belong  x       (Compression: %d)

# XXX: Weak magic.
# Alex Ott &lt;ott@jet.msk.su&gt;
## Paradox file formats
#2	  leshort	0x0800	Paradox
#&gt;0x39	  byte		3	v. 3.0
#&gt;0x39	  byte		4	v. 3.5
#&gt;0x39	  byte		9	v. 4.x
#&gt;0x39	  byte		10	v. 5.x
#&gt;0x39	  byte		11	v. 5.x
#&gt;0x39	  byte		12	v. 7.x
#&gt;&gt;0x04	  byte		0	indexed .DB data file
#&gt;&gt;0x04	  byte		1	primary index .PX file
#&gt;&gt;0x04	  byte		2	non-indexed .DB data file
#&gt;&gt;0x04	  byte		3	non-incrementing secondary index .Xnn file
#&gt;&gt;0x04	  byte		4	secondary index .Ynn file
#&gt;&gt;0x04	  byte		5	incrementing secondary index .Xnn file
#&gt;&gt;0x04	  byte		6	non-incrementing secondary index .XGn file
#&gt;&gt;0x04	  byte		7	secondary index .YGn file
#&gt;&gt;&gt;0x04	  byte		8	incrementing secondary index .XGn file

## XBase database files
# updated by Joerg Jenderek at Feb 2013
# http://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm
# http://www.clicketyclick.dk/databases/xbase/format/dbf.html
# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
# inspect VVYYMMDD , where 1&lt;= MM &lt;= 12 and 1&lt;= DD &lt;= 31
0	ubelong&amp;0x0000FFFF		&lt;0x00000C20
# skip Infocom game Z-machine
&gt;2		ubyte			&gt;0
# skip Androids *.xml
&gt;&gt;3		ubyte			&gt;0
&gt;&gt;&gt;3		ubyte			&lt;32
# 1 &lt; version VV
&gt;&gt;&gt;&gt;0		ubyte			&gt;1
# skip HELP.CA3 by test for reserved byte ( NULL )
&gt;&gt;&gt;&gt;&gt;27		ubyte			0
# reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
#&gt;&gt;&gt;&gt;&gt;30		ubeshort     		x		30NULL?%x
# possible production flag,tag numbers(&lt;=0x30),tag length(&lt;=0x20), reserved (NULL)
&gt;&gt;&gt;&gt;&gt;&gt;24	ubelong&amp;0xffFFFFff	&gt;0x01302000
# .DBF or .MDX
&gt;&gt;&gt;&gt;&gt;&gt;24	ubelong&amp;0xffFFFFff	&lt;0x01302001
# for Xbase Database file (*.DBF) reserved (NULL) for multi-user
&gt;&gt;&gt;&gt;&gt;&gt;&gt;24	ubelong&amp;0xffFFFFff	=0
# test for 2 reserved NULL bytes,transaction and encryption byte flag
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;12	ubelong&amp;0xFFFFfEfE	0
# test for MDX flag
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;28	ubyte			x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;28	ubyte&amp;0xf8		0
# header size &gt;= 32
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;8	uleshort		&gt;31
# skip PIC15736.PCX by test for language driver name or field name
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;32	ubyte			&gt;0
#!:mime	application/x-dbf; charset=unknown-8bit ??
#!:mime	application/x-dbase
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	use			xbase-type
# database file
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	ubyte			x		\b DBF
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;4	lelong			0		\b, no records
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;4	lelong			&gt;0		\b, %d record
# plural s appended
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;4	lelong			&gt;1		\bs
# http://www.clicketyclick.dk/databases/xbase/format/dbf_check.html#CHECK_DBF
# 1 &lt;= record size &lt;= 4000 (dBase 3,4) or 32 * KB (=0x8000)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;10	uleshort		x		* %d
# file size = records * record size + header size
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;1	ubyte			x		\b, update-date
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;1	use			xbase-date
# http://msdn.microsoft.com/de-de/library/cc483186(v=vs.71).aspx
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;29	ubyte			=0		\b, codepage ID=0x%x
# 2~cp850 , 3~cp1252 , 0x1b~?? ; what code page is 0x1b ?
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;29	ubyte			&gt;0		\b, codepage ID=0x%x
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;28	ubyte&amp;0x01		0		\b, no index file
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;28	ubyte&amp;0x01		1		\b, with index file .MDX
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;28	ubyte&amp;0x02		2		\b, with memo .FPT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;28	ubyte&amp;0x04		4		\b, DataBaseContainer
# 1st record offset + 1 = header size
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;8	uleshort		&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(8.s+1)	ubyte		&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;8		uleshort	&gt;0		\b, at offset %d
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(8.s+1)	ubyte		&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-1	string		&gt;\0		1st record &quot;%s&quot;
# for multiple index files (*.MDX) Production flag,tag numbers(&lt;=0x30),tag length(&lt;=0x20), reserved (NULL)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;24	ubelong&amp;0x0133f7ff	&gt;0
# test for reserved NULL byte
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;47	ubyte			0
# test for valid TAG key format (0x10 or 0)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;559	ubyte&amp;0xeF		0
# test MM &lt;= 12
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;45	ubeshort		&lt;0x0C20
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;45	ubyte			&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;46	ubyte			&lt;32
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;46	ubyte			&gt;0
#!:mime	application/x-mdx
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		xbase-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		\b MDX
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;1		ubyte		x		\b, creation-date
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;1		use		xbase-date
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;44	ubyte		x		\b, update-date
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;44	use		xbase-date
# No.of tags in use (1,2,5,12)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;28	uleshort	x		\b, %d
# No. of entries in tag (0x30)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;25	ubyte		x		\b/%d tags
#  Length of tag
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;26	ubyte		x		* %d
# 1st tag name_
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;548	string		x		\b, 1st tag &quot;%.11s&quot;
# 2nd tag name
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(26.b+548)	string		x		\b, 2nd tag &quot;%.11s&quot;
#
#		Print the xBase names of different version variants
0	name				xbase-type
&gt;0	ubyte		&lt;2
# 1 &lt; version
&gt;0	ubyte		&gt;1
&gt;&gt;0	ubyte		0x02		FoxBase
# FoxBase+/dBaseIII+, no memo
&gt;&gt;0	ubyte		0x03		FoxBase+/dBase III
!:mime	application/x-dbf
# dBASE IV no memo file
&gt;&gt;0	ubyte		0x04		dBase IV
!:mime	application/x-dbf
# dBASE V no memo file
&gt;&gt;0	ubyte		0x05		dBase V
!:mime	application/x-dbf
&gt;&gt;0	ubyte		0x30		Visual FoxPro
!:mime	application/x-dbf
&gt;&gt;0	ubyte		0x31		Visual FoxPro, autoincrement
!:mime	application/x-dbf
# Visual FoxPro, with field type Varchar or Varbinary
&gt;&gt;0	ubyte		0x32		Visual FoxPro, with field type Varchar
!:mime	application/x-dbf
# dBASE IV SQL, no memo;dbv memo var size (Flagship)
&gt;&gt;0	ubyte		0x43		dBase IV, with SQL table
!:mime	application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#&gt;&gt;0	ubyte		0x62		dBase IV, with SQL table
#!:mime	application/x-dbf
# dBASE IV, with memo!!
&gt;&gt;0	ubyte		0x7b		dBase IV, with memo
!:mime	application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#&gt;&gt;0	ubyte		0x82		dBase IV, with SQL system
#!:mime	application/x-dbf
# FoxBase+/dBaseIII+ with memo .DBT!
&gt;&gt;0	ubyte		0x83		FoxBase+/dBase III, with memo .DBT
!:mime	application/x-dbf
# VISUAL OBJECTS (first 1.0 versions) for the Dbase III files (NTX clipper driver); memo file
&gt;&gt;0	ubyte		0x87		VISUAL OBJECTS, with memo file
!:mime	application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#&gt;&gt;0	ubyte		0x8A		FoxBase+/dBase III, with memo .DBT
#!:mime	application/x-dbf
# dBASE IV with memo!
&gt;&gt;0	ubyte		0x8B		dBase IV, with memo .DBT
!:mime	application/x-dbf
# dBase IV with SQL Table,no memo?
&gt;&gt;0	ubyte		0x8E		dBase IV, with SQL table
!:mime	application/x-dbf
# .dbv and .dbt memo (Flagship)?
&gt;&gt;0	ubyte		0xB3		Flagship
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#&gt;&gt;0	ubyte		0xCA		dBase IV with memo .DBT
#!:mime	application/x-dbf
# dBASE IV with SQL table, with memo .DBT
&gt;&gt;0	ubyte		0xCB		dBase IV with SQL table, with memo .DBT
!:mime	application/x-dbf
# HiPer-Six format;Clipper SIX, with SMT memo file
&gt;&gt;0	ubyte		0xE5		Clipper SIX with memo
!:mime	application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#&gt;&gt;0	ubyte		0xF4		dBase IV, with SQL table, with memo
#!:mime	application/x-dbf
&gt;&gt;0	ubyte		0xF5		FoxPro with memo
!:mime	application/x-dbf
# http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
#&gt;&gt;0	ubyte		0xFA		FoxPro 2.x, with memo
#!:mime	application/x-dbf
# unknown version (should not happen)
&gt;&gt;0	default		x		xBase
!:mime	application/x-dbf
&gt;&gt;&gt;0	ubyte		x		(0x%x)
# flags in version byte
# DBT flag (with dBASE III memo .DBT)!!
# &gt;&gt;0	ubyte&amp;0x80	&gt;0		DBT_FLAG=%x
# memo flag ??
# &gt;&gt;0	ubyte&amp;0x08	&gt;0		MEMO_FLAG=%x
# SQL flag ??
# &gt;&gt;0	ubyte&amp;0x70	&gt;0		SQL_FLAG=%x
#		test and print the date of xBase .DBF .MDX
0	name				xbase-date
# inspect YYMMDD , where 1&lt;= MM &lt;= 12 and 1&lt;= DD &lt;= 31
&gt;0	ubelong		x
&gt;1	ubyte		&lt;13
&gt;&gt;1	ubyte		&gt;0
&gt;&gt;&gt;2	ubyte		&gt;0
&gt;&gt;&gt;&gt;2	ubyte		&lt;32
&gt;&gt;&gt;&gt;&gt;0	ubyte		x
# YY is interpreted as 20YY or 19YY
&gt;&gt;&gt;&gt;&gt;&gt;0	ubyte		&lt;100		\b %.2d
# YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
&gt;&gt;&gt;&gt;&gt;&gt;0	ubyte		&gt;99		\b %d
&gt;&gt;&gt;&gt;&gt;1	ubyte		x		\b-%d
&gt;&gt;&gt;&gt;&gt;2	ubyte		x		\b-%d

#	dBase memo files .DBT or .FPT
# http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
16		ubyte		&lt;4
&gt;16		ubyte		!2
&gt;&gt;16		ubyte		!1
# next free block index is positive
&gt;&gt;&gt;0		ulelong		&gt;0
# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
&gt;&gt;&gt;&gt;17		ubelong&amp;0xFFfdFE00	0x00000000
# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
&gt;&gt;&gt;&gt;&gt;20		ubelong&amp;0xFF01209B	0x00000000
# dBASE III
&gt;&gt;&gt;&gt;&gt;&gt;16	ubyte		3
# dBASE III DBT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	use		dbase3-memo-print
# dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
&gt;&gt;&gt;&gt;&gt;&gt;16	ubyte		0
# unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT ,  or garbage PCX DBF
&gt;&gt;&gt;&gt;&gt;&gt;&gt;20	uleshort	0
# FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;8	ulong		=0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;6	ubeshort	&gt;0
# skip emacs.PIF
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;4	ushort		0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	use		foxpro-memo-print
# dBASE III DBT , garbage
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;6	ubeshort	0
# skip MM*DD*.bin by test for for reserved NULL byte
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;510	ubeshort	0
# skip TK-DOS11.img image by looking for memo text
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;512	ubelong		&lt;0xfeffff03
# skip EFI executables by looking for memo text
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;512	ubelong		&gt;0x1F202020
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;513 ubyte		&gt;0
# unusual dBASE III DBT like adressen.dbt
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	use		dbase3-memo-print
# dBASE III DBT like angest.dbt, or garbage PCX DBF
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;8	ubelong		!0
# skip PCX and some DBF by test for for reserved NULL bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;510	ubeshort	0
# skip some DBF by test of invalid version
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	ubyte		&gt;5
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	ubyte		&lt;48
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	use		dbase3-memo-print
# dBASE IV DBT with positive block size
&gt;&gt;&gt;&gt;&gt;&gt;&gt;20	uleshort	&gt;0
# dBASE IV DBT with valid block length like 512, 1024
# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;20	uleshort&amp;0x800f	0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	use		dbase4-memo-print

#		Print the information of dBase III DBT memo file
0	name				dbase3-memo-print
&gt;0	ubyte			x		dBase III DBT
# instead 3 as version number 0 for unusual examples like biblio.dbt
&gt;16	ubyte			!3		\b, version number %u
# Number of next available block for appending data
#&gt;0	lelong			=0		\b, next free block index %u
&gt;0	lelong			!0		\b, next free block index %u
# no positiv block length
#&gt;20	uleshort		=0		\b, block length %u
&gt;20	uleshort		!0		\b, block length %u
# dBase III memo field terminated by \032\032
&gt;512	string			&gt;\0		\b, 1st item &quot;%s&quot;
#		Print the information of dBase IV DBT memo file
0	name				dbase4-memo-print
&gt;0		lelong		x		dBase IV DBT
!:mime	application/x-dbt
!:ext dbt
# 8 character shorted main name of coresponding dBASE IV DBF file
&gt;8		ubelong		&gt;0x20000000
# skip unusual like for angest.dbt
&gt;&gt;20		uleshort	&gt;0
&gt;&gt;&gt;8		string		&gt;\0		\b of %-.8s.DBF
# value 0 implies 512 as size
#&gt;4		ulelong		=0		\b, blocks size %u
# size of blocks not reliable like 0x2020204C in angest.dbt
&gt;4		ulelong		!0
&gt;&gt;4		ulelong&amp;0x0000003f	0	\b, blocks size %u
# dBase IV DBT with positive block length (found 512 , 1024)
&gt;20		uleshort	&gt;0		\b, block length %u
# next available block
#&gt;0		lelong		=0		\b, next free block index %u
&gt;0		lelong		!0		\b, next free block index %u
&gt;20		uleshort	&gt;0
&gt;&gt;(20.s)	ubelong		x
&gt;&gt;&gt;&amp;-4		use		dbase4-memofield-print
# unusual dBase IV DBT without block length (implies 512 as length)
&gt;20		uleshort	=0
&gt;&gt;512		ubelong		x
&gt;&gt;&gt;&amp;-4		use				dbase4-memofield-print
#		Print the information of dBase IV memo field
0	name			dbase4-memofield-print
# free dBase IV memo field
&gt;0		ubelong		!0xFFFF0800
&gt;&gt;0		lelong		x		\b, next free block %u
&gt;&gt;4		lelong		x		\b, next used block %u
# used dBase IV memo field
&gt;0		ubelong		=0xFFFF0800
# length of memo field
&gt;&gt;4		lelong		x		\b, field length %d
&gt;&gt;&gt;8		string		&gt;\0		\b, 1st used item &quot;%s&quot;
#		Print the information of FoxPro FPT memo file
0	name				foxpro-memo-print
&gt;0		belong		x		FoxPro FPT
# Size of blocks for FoxPro ( 64,256 )
&gt;6		ubeshort	x		\b, blocks size %u
# next available block
#&gt;0		belong		=0		\b, next free block index %u
&gt;0		belong		!0		\b, next free block index %u
# field type ( 0~picture, 1~memo, 2~object )
&gt;512		ubelong		&lt;3		\b, field type %u
# length of memo field
&gt;512		ubelong		1
&gt;&gt;516		belong		&gt;0		\b, field length %d
&gt;&gt;&gt;520		string		&gt;\0		\b, 1st item &quot;%s&quot;

# TODO:
# DBASE index file *.NDX
# DBASE Compound Index file *.CDX
# dBASE IV Printer Driver *.PRF
## End of XBase database stuff

# MS Access database
4	string	Standard\ Jet\ DB	Microsoft Access Database
!:mime	application/x-msaccess
4	string	Standard\ ACE\ DB	Microsoft Access Database
!:mime	application/x-msaccess

# From: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Extensible_Storage_Engine
# Reference: https://github.com/libyal/libesedb/archive/master.zip
#	libesedb-master/documentation/
#	Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
# Note: also known as &quot;JET Blue&quot;. Used by numerous Windows components such as
# Windows Search, Mail, Exchange and Active Directory.
4	ubelong		0xefcdab89
# unknown1
&gt;132	ubelong		0		Extensible storage engine
!:mime	application/x-ms-ese
# file_type 0~database 1~stream
&gt;&gt;12	ulelong		0		DataBase
# Security DataBase (sdb)
!:ext	edb/sdb
&gt;&gt;12	ulelong		1		STreaMing
!:ext	stm
# format_version 620h
&gt;&gt;8	uleshort	x		\b, version 0x%x
&gt;&gt;10	uleshort	&gt;0		revision 0x%4.4x
&gt;&gt;0	ubelong		x	 	\b, checksum 0x%8.8x
# Page size 4096 8192 32768
&gt;&gt;236	ulequad		x		\b, page size %lld
# database_state
&gt;&gt;52	ulelong		1		\b, JustCreated
&gt;&gt;52	ulelong		2		\b, DirtyShutdown
#&gt;&gt;52	ulelong		3		\b, CleanShutdown
&gt;&gt;52	ulelong		4		\b, BeingConverted
&gt;&gt;52	ulelong		5		\b, ForceDetach
# Windows�NT major version when the databases indexes were updated.
&gt;&gt;216	ulelong		x		\b, Windows version %d
# Windows�NT minor version
&gt;&gt;220	ulelong		x		\b.%d

# From: Joerg Jenderek
# URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility
# Note: files contain application compatibility fixes, application compatibility modes and application help messages.
8	string		sdbf
&gt;7	ubyte		0
# TAG_TYPE_LIST+TAG_INDEXES
&gt;&gt;12	uleshort	0x7802		Windows application compatibility Shim DataBase
# version? 2 3
#&gt;&gt;&gt;0	ulelong		x		\b, version %d
!:mime	application/x-ms-sdb
!:ext	sdb

# TDB database from Samba et al - Martin Pool &lt;mbp@samba.org&gt;
0	string	TDB\ file		TDB database
&gt;32	lelong	0x2601196D		version 6, little-endian
&gt;&gt;36	lelong	x			hash size %d bytes

# SE Linux policy database
0       lelong  0xf97cff8c      SE Linux policy
&gt;16     lelong  x               v%d
&gt;20     lelong  1      MLS
&gt;24     lelong  x       %d symbols
&gt;28     lelong  x       %d ocons

# ICE authority file data (Wolfram Kleff)
2	string		ICE		ICE authority data

# X11 Xauthority file (Wolfram Kleff)
10	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
11	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
12	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
13	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
14	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
15	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
16	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
17	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
18	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data

# From: Maxime Henrion &lt;mux@FreeBSD.org&gt;
# PostgreSQL&#039;s custom dump format, Maxime Henrion &lt;mux@FreeBSD.org&gt;
0	string		PGDMP		PostgreSQL custom database dump
&gt;5	byte		x		- v%d
&gt;6	byte		x		\b.%d
&gt;5	beshort		&lt;0x101		\b-0
&gt;5	beshort		&gt;0x100
&gt;&gt;7	byte		x		\b-%d

# Type: Advanced Data Format (ADF) database
# URL:  http://www.grc.nasa.gov/WWW/cgns/adf/
# From: Nicolas Chauvat &lt;nicolas.chauvat@logilab.fr&gt;
0	string	@(#)ADF\ Database	CGNS Advanced Data Format

# Tokyo Cabinet magic data
# http://tokyocabinet.sourceforge.net/index.html
0	string		ToKyO\ CaBiNeT\n	Tokyo Cabinet
&gt;14	string		x			\b (%s)
&gt;32	byte		0			\b, Hash
!:mime	application/x-tokyocabinet-hash
&gt;32	byte		1			\b, B+ tree
!:mime	application/x-tokyocabinet-btree
&gt;32	byte		2			\b, Fixed-length
!:mime	application/x-tokyocabinet-fixed
&gt;32	byte		3			\b, Table
!:mime	application/x-tokyocabinet-table
&gt;33	byte		&amp;1			\b, [open]
&gt;33	byte		&amp;2			\b, [fatal]
&gt;34	byte		x			\b, apow=%d
&gt;35	byte		x			\b, fpow=%d
&gt;36	byte		&amp;0x01			\b, [large]
&gt;36	byte		&amp;0x02			\b, [deflate]
&gt;36	byte		&amp;0x04			\b, [bzip]
&gt;36	byte		&amp;0x08			\b, [tcbs]
&gt;36	byte		&amp;0x10			\b, [excodec]
&gt;40	lequad		x			\b, bnum=%lld
&gt;48	lequad		x			\b, rnum=%lld
&gt;56	lequad		x			\b, fsiz=%lld

# Type:	QDBM Quick Database Manager
# From:	Benoit Sibaud &lt;bsibaud@april.org&gt;
0	string		\\[depot\\]\n\f		Quick Database Manager, little endian
0	string		\\[DEPOT\\]\n\f		Quick Database Manager, big endian

# Type:	TokyoCabinet database
# URL:	http://tokyocabinet.sourceforge.net/
# From:	Benoit Sibaud &lt;bsibaud@april.org&gt;
0	string		ToKyO\ CaBiNeT\n	TokyoCabinet database
&gt;14	string		x			(version %s)

# From:  Stephane Blondon http://www.yaal.fr
# Database file for Zope (done by FileStorage)
0	string	FS21	Zope Object Database File Storage v3 (data)
0	string	FS30	Zope Object Database File Storage v4 (data)

# Cache file for the database of Zope (done by ClientStorage)
0	string		ZEC3	Zope Object Database Client Cache File (data)

# IDA (Interactive Disassembler) database
0	string		IDA1	IDA (Interactive Disassembler) database

# Hopper (reverse engineering tool) http://www.hopperapp.com/
0	string		hopperdb	Hopper database

# URL: https://en.wikipedia.org/wiki/Panorama_(database_engine)
# Reference: http://www.provue.com/Panorama/
# From: Joerg Jenderek
# NOTE: test only versions 4 and 6.0 with Windows
# length of Panorama database name
5	ubyte				&gt;0
# look after database name for &quot;some&quot; null bits
&gt;(5.B+7)	ubelong&amp;0xF3ffF000	0
# look for first keyword
&gt;&gt;&amp;1		search/2		DESIGN		Panorama database
#!:mime	application/x-panorama-database
!:apple	KASXZEPD
!:ext	pan
# database name
&gt;&gt;&gt;5	pstring				x		\b, &quot;%s&quot;

#
#
# askSam Database by Stefan A. Haubenthal &lt;polluks@web.de&gt;
0	string	askw40\0	askSam DB

#
#
# MUIbase Database Tool by Stefan A. Haubenthal &lt;polluks@web.de&gt;
0	string	MBSTV\040	MUIbase DB
&gt;6	string	x		version %s

#
# CDB database
0	string	NBCDB\012	NetBSD Constant Database
&gt;7	byte	x		\b, version %d
&gt;8	string	x		\b, for &#039;%s&#039;
&gt;24	lelong	x		\b, datasize %d
&gt;28	lelong	x		\b, entries %d
&gt;32	lelong	x		\b, index %d
&gt;36	lelong	x		\b, seed %#x

#------------------------------------------------------------------------------
# $File: dbpf,v 1.1 2017/10/13 20:47:14 christos Exp $
# dppf:	Maxis Database Packed Files, the stored data file format used by all
#	Maxis games after the Sims: http://wiki.niotso.org/DBPF
# 	http://www.wiki.sc4devotion.com/index.php?title=DBPF
#	13 Oct 2017, Kip Warner &lt;kip at thevertigo dot com&gt;
0	string	DBPF	Maxis Database Packed File
&gt;4	ulelong	x	\b, version: %u.
&gt;&gt;8	ulelong	x	\b%u
&gt;&gt;&gt;36	ulelong	x       \b, files: %u
&gt;&gt;24	ledate	!0	\b, created: %s
&gt;&gt;28	ledate	!0	\b, modified: %s
!:ext	dbpf/package/dat/sc4
!:mime	application/x-maxis-dbpf
#------------------------------------------------------------------------------
# $File: der,v 1.2 2017/03/17 21:35:28 christos Exp $
# der: file(1) magic for DER encoded files
#

# Certificate information piece
0	name	certinfo
&gt;0	der	seq
&gt;&gt;&amp;0	der	set
&gt;&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&gt;&amp;0	der	obj_id3=550406
&gt;&gt;&gt;&gt;&amp;0	der	prt_str=x	\b, countryName=%s
&gt;&gt;&amp;0	der	set
&gt;&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&gt;&amp;0	der	obj_id3=550408
&gt;&gt;&gt;&gt;&amp;0	der	utf8_str=x	\b, stateOrProvinceName=%s
&gt;&gt;&amp;0	der	set
&gt;&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&gt;&amp;0	der	obj_id3=55040a
&gt;&gt;&gt;&gt;&amp;0	der	utf8_str=x	\b, organizationName=%s
&gt;&gt;&amp;0	der	set
&gt;&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&gt;&amp;0	der	obj_id3=550403
&gt;&gt;&gt;&gt;&amp;0	der	utf8_str=x	\b, commonName=%s
&gt;&gt;&amp;0	der	seq

# Certificate requests
0	der	seq
&gt;&amp;0	der	seq
&gt;&gt;&amp;0	der	int1=00		DER Encoded Certificate request
&gt;&gt;&amp;0	use	certinfo

# Key Pairs
0	der	seq
&gt;&amp;0	der	int1=00
&gt;&amp;0	der	int65=x
&gt;&amp;0	der	int3=010001	DER Encoded Key Pair, 512 bits

0	der	seq
&gt;&amp;0	der	int1=00
&gt;&amp;0	der	int129=x
&gt;&amp;0	der	int3=010001	DER Encoded Key Pair, 1024 bits

0	der	seq
&gt;&amp;0	der	int1=00
&gt;&amp;0	der	int257=x
&gt;&amp;0	der	int3=010001	DER Encoded Key Pair, 2048 bits

0	der	seq
&gt;&amp;0	der	int1=00
&gt;&amp;0	der	int513=x
&gt;&amp;0	der	int3=010001	DER Encoded Key Pair, 4096 bits

0	der	seq
&gt;&amp;0	der	int1=00
&gt;&amp;0	der	int1025=x
&gt;&amp;0	der	int3=010001	DER Encoded Key Pair, 8192 bits

0	der	seq
&gt;&amp;0	der	int1=00
&gt;&amp;0	der	int2049=x
&gt;&amp;0	der	int3=010001	DER Encoded Key Pair, 16k bits

0	der	seq
&gt;&amp;0	der	int1=00
&gt;&amp;0	der	int4097=x
&gt;&amp;0	der	int3=010001	DER Encoded Key Pair, 32k bits

# Certificates
0	der	seq
&gt;&amp;0	der	seq
&gt;&gt;&amp;0	der	int2=0dfa	DER Encoded Certificate, 512 bits
&gt;&gt;&amp;0	der	int2=0dfb	DER Encoded Certificate, 1024 bits
&gt;&gt;&amp;0	der	int2=0dfc	DER Encoded Certificate, 2048 bits
&gt;&gt;&amp;0	der	int2=0dfd	DER Encoded Certificate, 4096 bits
&gt;&gt;&amp;0	der	int2=0dfe	DER Encoded Certificate, 8192 bits
&gt;&gt;&amp;0	der	int2=0dff	DER Encoded Certificate, 16k bits
&gt;&gt;&amp;0	der	int2=0e04	DER Encoded Certificate, 32k bits
&gt;&gt;&amp;0	der	int2=x		DER Encoded Certificate, ? bits (%s)
&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&amp;0	der	obj_id9=2a864886f70d010105	\b, sha1WithRSAEncryption
&gt;&gt;&gt;&amp;0	der	obj_id9=x			\b, ? Encryption (%s)
&gt;&gt;&gt;&amp;0	der	null
&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&amp;0	der	set
&gt;&gt;&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&gt;&gt;&amp;0	der	obj_id3=550406
&gt;&gt;&gt;&gt;&gt;&amp;0	der	prt_str=x	\b, countryName=%s
&gt;&gt;&gt;&amp;0	der	set
&gt;&gt;&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&gt;&gt;&amp;0	der	obj_id3=550408
&gt;&gt;&gt;&gt;&gt;&amp;0	der	prt_str=x	\b, stateOrProvinceName=%s
&gt;&gt;&gt;&amp;0	der	set
&gt;&gt;&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&gt;&gt;&amp;0	der	obj_id3=550407
&gt;&gt;&gt;&gt;&gt;&amp;0	der	prt_str=x	\b, localityName=%s
&gt;&gt;&gt;&amp;0	der	set
&gt;&gt;&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&gt;&gt;&amp;0	der	obj_id3=55040a
&gt;&gt;&gt;&gt;&gt;&amp;0	der	prt_str=x	\b, organizationName=%s
&gt;&gt;&gt;&amp;0	der	set
&gt;&gt;&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&gt;&gt;&amp;0	der	obj_id3=55040b
&gt;&gt;&gt;&gt;&gt;&amp;0	der	prt_str=x	\b, organizationUnitName=%s
&gt;&gt;&gt;&amp;0	der	set
&gt;&gt;&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&gt;&gt;&amp;0	der	obj_id3=550403
&gt;&gt;&gt;&gt;&gt;&amp;0	der	prt_str=x	\b, commonName=%s
&gt;&gt;&gt;&amp;0	der	set
&gt;&gt;&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&gt;&gt;&amp;0	der	obj_id9=2a864886f70d010901
&gt;&gt;&gt;&gt;&gt;&amp;0	der	ia5_str=x	\b, emailAddress=%s
&gt;&gt;&amp;0	der	seq
&gt;&gt;&gt;&amp;0	der	utc_time=x	\b, utcTime=%s
&gt;&gt;&gt;&amp;0	der	utc_time=x	\b, utcTime=%s
&gt;&gt;&amp;0	use	certinfo

#------------------------------------------------------------------------------
# $File: diamond,v 1.7 2009/09/19 16:28:08 christos Exp $
# diamond:  file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
# XXX - I think it was either renamed Slate, or replaced by Slate....
#
#	The full deal is too long...
#0	string	&lt;list&gt;\n&lt;protocol\ bbn-multimedia-format&gt;	Diamond Multimedia Document
0	string	=&lt;list&gt;\n&lt;protocol\ bbn-m	Diamond Multimedia Document

#------------------------------------------------------------------------------
# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $
# diff:  file(1) magic for diff(1) output
#
0	search/1	diff\040	diff output text
!:mime	text/x-diff
0	search/1	***\040 	diff output text
!:mime	text/x-diff
0	search/1	Only\040in\040 	diff output text
!:mime	text/x-diff
0	search/1	Common\040subdirectories:\040 	diff output text
!:mime	text/x-diff

0	search/1	Index:		RCS/CVS diff output text
!:mime	text/x-diff

# bsdiff:  file(1) magic for bsdiff(1) output
0	string/b		BSDIFF40	bsdiff(1) patch file


# unified diff
0	search/4096	---\040
&gt;&amp;0	search/1024 \n
&gt;&gt;&amp;0	search/1 +++\040
&gt;&gt;&gt;&amp;0	search/1024 \n
&gt;&gt;&gt;&gt;&amp;0	search/1 @@	unified diff output text
!:mime	text/x-diff
!:strength + 90

# librsync -- the library for network deltas
#
# Copyright (C) 2001 by Martin Pool.  You may do whatever you want with
# this file.
#
0	belong		0x72730236	rdiff network-delta data

0	belong		0x72730136	rdiff network-delta signature data
&gt;4	belong		x		(block length=%d,
&gt;8	belong		x		signature strength=%d)

#------------------------------------------------------------------------------
# $File: digital,v 1.11 2013/01/11 16:45:23 christos Exp $
#  Digital UNIX - Info
#
0	string	=!&lt;arch&gt;\n________64E	Alpha archive
&gt;22	string	X			-- out of date
#

0	leshort		0603
&gt;24	leshort		0410		COFF format alpha pure
&gt;24	leshort		0413		COFF format alpha demand paged
&gt;&gt;22	leshort&amp;030000	!020000		executable
&gt;&gt;22	leshort&amp;020000	!0		dynamically linked
&gt;&gt;16	lelong		!0		not stripped
&gt;&gt;16	lelong		0		stripped
&gt;&gt;27	byte		x		- version %d
&gt;&gt;26	byte		x		\b.%d
&gt;&gt;28	byte		x		\b-%d
&gt;24	leshort		0407		COFF format alpha object
&gt;&gt;22	leshort&amp;030000	020000		shared library
&gt;&gt;27	byte		x		- version %d
&gt;&gt;26	byte		x		\b.%d
&gt;&gt;28	byte		x		\b-%d

# Basic recognition of Digital UNIX core dumps - Mike Bremford &lt;mike@opac.bl.uk&gt;
#
# The actual magic number is just &quot;Core&quot;, followed by a 2-byte version
# number; however, treating any file that begins with &quot;Core&quot; as a Digital
# UNIX core dump file may produce too many false hits, so we include one
# byte of the version number as well; DU 5.0 appears only to be up to
# version 2.
#
0	string		Core\001	Alpha COFF format core dump (Digital UNIX)
&gt;24	string		&gt;\0		\b, from &#039;%s&#039;
0	string		Core\002	Alpha COFF format core dump (Digital UNIX)
&gt;24	string		&gt;\0		\b, from &#039;%s&#039;
#
# The next is incomplete, we could tell more about this format,
# but its not worth it.
0	leshort		0x188	Alpha compressed COFF
0	leshort		0x18f	Alpha u-code object
#
#
# Some other interesting Digital formats,
0	string	\377\377\177		ddis/ddif
0	string	\377\377\174		ddis/dots archive
0	string	\377\377\176		ddis/dtif table data
0	string	\033c\033		LN03 output
0	long	04553207		X image
#
0	string	=!&lt;PDF&gt;!\n		profiling data file
#
# Locale data tables (MIPS and Alpha).
#
0	short		0x0501		locale data table
&gt;6	short		0x24		for MIPS
&gt;6	short		0x40		for Alpha

#------------------------------------------------------------------------------
# $File: dolby,v 1.8 2017/03/17 21:35:28 christos Exp $
# ATSC A/53 aka AC-3 aka Dolby Digital &lt;ashitaka@gmx.at&gt;
# from http://www.atsc.org/standards/a_52a.pdf
# corrections, additions, etc. are always welcome!
#
# syncword
0	beshort		0x0b77	ATSC A/52 aka AC-3 aka Dolby Digital stream,
# Proposed audio/ac3 RFC/4184
!:mime	audio/vnd.dolby.dd-raw
# fscod
&gt;4	byte&amp;0xc0 = 0x00	48 kHz,
&gt;4	byte&amp;0xc0 = 0x40	44.1 kHz,
&gt;4	byte&amp;0xc0 = 0x80	32 kHz,
# is this one used for 96 kHz?
&gt;4	byte&amp;0xc0 = 0xc0	reserved frequency,
#
&gt;5	byte&amp;0x07 = 0x00	\b, complete main (CM)
&gt;5	byte&amp;0x07 = 0x01	\b, music and effects (ME)
&gt;5	byte&amp;0x07 = 0x02	\b, visually impaired (VI)
&gt;5	byte&amp;0x07 = 0x03	\b, hearing impaired (HI)
&gt;5	byte&amp;0x07 = 0x04	\b, dialogue (D)
&gt;5	byte&amp;0x07 = 0x05	\b, commentary (C)
&gt;5	byte&amp;0x07 = 0x06	\b, emergency (E)
&gt;5	beshort&amp;0x07e0  0x0720	\b, voiceover (VO)
&gt;5	beshort&amp;0x07e0 &gt;0x0720	\b, karaoke
# acmod
&gt;6	byte&amp;0xe0 = 0x00	1+1 front,
&gt;&gt;6	byte&amp;0x10 = 0x10	LFE on,
&gt;6	byte&amp;0xe0 = 0x20	1 front/0 rear,
&gt;&gt;6	byte&amp;0x10 = 0x10	LFE on,
&gt;6	byte&amp;0xe0 = 0x40	2 front/0 rear,
# dsurmod (for stereo only)
&gt;&gt;6	byte&amp;0x18 = 0x00	Dolby Surround not indicated
&gt;&gt;6	byte&amp;0x18 = 0x08	not Dolby Surround encoded
&gt;&gt;6	byte&amp;0x18 = 0x10	Dolby Surround encoded
&gt;&gt;6	byte&amp;0x18 = 0x18	reserved Dolby Surround mode
&gt;&gt;6	byte&amp;0x04 = 0x04	LFE on,
&gt;6	byte&amp;0xe0 = 0x60	3 front/0 rear,
&gt;&gt;6	byte&amp;0x04 = 0x04	LFE on,
&gt;6	byte&amp;0xe0 = 0x80	2 front/1 rear,
&gt;&gt;6	byte&amp;0x04 = 0x04	LFE on,
&gt;6	byte&amp;0xe0 = 0xa0	3 front/1 rear,
&gt;&gt;6	byte&amp;0x01 = 0x01	LFE on,
&gt;6	byte&amp;0xe0 = 0xc0	2 front/2 rear,
&gt;&gt;6	byte&amp;0x04 = 0x04	LFE on,
&gt;6	byte&amp;0xe0 = 0xe0	3 front/2 rear,
&gt;&gt;6	byte&amp;0x01 = 0x01	LFE on,
#
&gt;4	byte&amp;0x3e = 0x00	\b, 32 kbit/s
&gt;4	byte&amp;0x3e = 0x02	\b, 40 kbit/s
&gt;4	byte&amp;0x3e = 0x04	\b, 48 kbit/s
&gt;4	byte&amp;0x3e = 0x06	\b, 56 kbit/s
&gt;4	byte&amp;0x3e = 0x08	\b, 64 kbit/s
&gt;4	byte&amp;0x3e = 0x0a	\b, 80 kbit/s
&gt;4	byte&amp;0x3e = 0x0c	\b, 96 kbit/s
&gt;4	byte&amp;0x3e = 0x0e	\b, 112 kbit/s
&gt;4	byte&amp;0x3e = 0x10	\b, 128 kbit/s
&gt;4	byte&amp;0x3e = 0x12	\b, 160 kbit/s
&gt;4	byte&amp;0x3e = 0x14	\b, 192 kbit/s
&gt;4	byte&amp;0x3e = 0x16	\b, 224 kbit/s
&gt;4	byte&amp;0x3e = 0x18	\b, 256 kbit/s
&gt;4	byte&amp;0x3e = 0x1a	\b, 320 kbit/s
&gt;4	byte&amp;0x3e = 0x1c	\b, 384 kbit/s
&gt;4	byte&amp;0x3e = 0x1e	\b, 448 kbit/s
&gt;4	byte&amp;0x3e = 0x20	\b, 512 kbit/s
&gt;4	byte&amp;0x3e = 0x22	\b, 576 kbit/s
&gt;4	byte&amp;0x3e = 0x24	\b, 640 kbit/s

#------------------------------------------------------------------------------
# $File: dump,v 1.16 2017/07/22 19:21:02 christos Exp $
# dump:  file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
0	name	new-dump-be
&gt;4	bedate	x		Previous dump %s,
&gt;8	bedate	x		This dump %s,
&gt;12	belong	&gt;0		Volume %d,
&gt;692	belong	0		Level zero, type:
&gt;692	belong	&gt;0		Level %d, type:
&gt;0	belong	1		tape header,
&gt;0	belong	2		beginning of file record,
&gt;0	belong	3		map of inodes on tape,
&gt;0	belong	4		continuation of file record,
&gt;0	belong	5		end of volume,
&gt;0	belong	6		map of inodes deleted,
&gt;0	belong	7		end of medium (for floppy),
&gt;676	string	&gt;\0		Label %s,
&gt;696	string	&gt;\0		Filesystem %s,
&gt;760	string	&gt;\0		Device %s,
&gt;824	string	&gt;\0		Host %s,
&gt;888	belong	&gt;0		Flags %x

0	name	old-dump-be
#&gt;4	bedate	x		Previous dump %s,
#&gt;8	bedate	x		This dump %s,
&gt;12	belong	&gt;0		Volume %d,
&gt;692	belong	0		Level zero, type:
&gt;692	belong	&gt;0		Level %d, type:
&gt;0	belong	1		tape header,
&gt;0	belong	2		beginning of file record,
&gt;0	belong	3		map of inodes on tape,
&gt;0	belong	4		continuation of file record,
&gt;0	belong	5		end of volume,
&gt;0	belong	6		map of inodes deleted,
&gt;0	belong	7		end of medium (for floppy),
&gt;676	string	&gt;\0		Label %s,
&gt;696	string	&gt;\0		Filesystem %s,
&gt;760	string	&gt;\0		Device %s,
&gt;824	string	&gt;\0		Host %s,
&gt;888	belong	&gt;0		Flags %x

0	name	ufs2-dump-be
&gt;896	beqdate	x		Previous dump %s,
&gt;904	beqdate	x		This dump %s,
&gt;12	belong	&gt;0		Volume %d,
&gt;692	belong	0		Level zero, type:
&gt;692	belong	&gt;0		Level %d, type:
&gt;0	belong	1		tape header,
&gt;0	belong	2		beginning of file record,
&gt;0	belong	3		map of inodes on tape,
&gt;0	belong	4		continuation of file record,
&gt;0	belong	5		end of volume,
&gt;0	belong	6		map of inodes deleted,
&gt;0	belong	7		end of medium (for floppy),
&gt;676	string	&gt;\0		Label %s,
&gt;696	string	&gt;\0		Filesystem %s,
&gt;760	string	&gt;\0		Device %s,
&gt;824	string	&gt;\0		Host %s,
&gt;888	belong	&gt;0		Flags %x

24	belong	60012		new-fs dump file (big endian),
&gt;0	use	new-dump-be

24	belong	60011		old-fs dump file (big endian),
&gt;0	use	old-dump-be

24	lelong	60012		new-fs dump file (little endian),
# to correctly recognize &#039;*.mo&#039; GNU message catalog (little endian)
!:strength - 15
&gt;0	use	\^new-dump-be

24	lelong	60011		old-fs dump file (little endian),
&gt;0	use	\^old-dump-be


24	belong	0x19540119	new-fs dump file (ufs2, big endian),
&gt;0	use	ufs2-dump-be

24	lelong	0x19540119	new-fs dump file (ufs2, little endian),
&gt;0	use	\^ufs2-dump-be

18	leshort	60011		old-fs dump file (16-bit, assuming PDP-11 endianness),
&gt;2	medate	x		Previous dump %s,
&gt;6	medate	x		This dump %s,
&gt;10	leshort	&gt;0		Volume %d,
&gt;0	leshort	1		tape header.
&gt;0	leshort	2		beginning of file record.
&gt;0	leshort	3		map of inodes on tape.
&gt;0	leshort	4		continuation of file record.
&gt;0	leshort	5		end of volume.
&gt;0	leshort	6		map of inodes deleted.
&gt;0	leshort	7		end of medium (for floppy).

#------------------------------------------------------------------------------
# $File: dyadic,v 1.8 2017/03/17 21:35:28 christos Exp $
# Dyadic: file(1) magic for Dyalog APL.
#
# updated by Joerg Jenderek at Oct 2013
# http://en.wikipedia.org/wiki/Dyalog_APL
# http://www.dyalog.com/
# .DXV Dyalog APL External Variable
# .DIN Dyalog APL Input Table
# .DOT Dyalog APL Output Table
# .DFT Dyalog APL Format File
0	ubeshort&amp;0xFF60	0xaa00
# skip biblio.dbt
&gt;1	byte		!4
# real Dyalog APL have non zero version numbers like 7.3 or 13.4
&gt;&gt;2	ubeshort	&gt;0x0000		Dyalog APL
&gt;&gt;&gt;1	byte		0x00		aplcore
#&gt;&gt;&gt;1	byte		0x00		incomplete workspace
# *.DCF Dyalog APL Component File
&gt;&gt;&gt;1	byte		0x01		component file 32-bit non-journaled non-checksummed
#&gt;&gt;&gt;1	byte		0x01		component file
&gt;&gt;&gt;1	byte		0x02		external variable exclusive
#&gt;&gt;&gt;1	byte		0x02		external variable
# *.DWS Dyalog APL Workspace
&gt;&gt;&gt;1	byte		0x03		workspace
&gt;&gt;&gt;&gt;7	byte&amp;0x28	0x00		32-bit
&gt;&gt;&gt;&gt;7	byte&amp;0x28	0x20		64-bit
&gt;&gt;&gt;&gt;7	byte&amp;0x0c	0x00		classic
&gt;&gt;&gt;&gt;7	byte&amp;0x0c	0x04		unicode
&gt;&gt;&gt;&gt;7	byte&amp;0x88	0x00		big-endian
&gt;&gt;&gt;&gt;7	byte&amp;0x88	0x80		little-endian
&gt;&gt;&gt;1	byte		0x06		external variable shared
# *.DSE Dyalog APL Session , *.DLF Dyalog APL Session Log File
&gt;&gt;&gt;1	byte		0x07		session
&gt;&gt;&gt;1	byte		0x08		mapped file 32-bit
&gt;&gt;&gt;1	byte		0x09		component file 64-bit non-journaled non-checksummed
&gt;&gt;&gt;1	byte		0x0a		mapped file 64-bit
&gt;&gt;&gt;1	byte		0x0b		component file 32-bit level 1 journaled non-checksummed
&gt;&gt;&gt;1	byte		0x0c		component file 64-bit level 1 journaled non-checksummed
&gt;&gt;&gt;1	byte		0x0d		component file 32-bit level 1 journaled checksummed
&gt;&gt;&gt;1	byte		0x0e		component file 64-bit level 1 journaled checksummed
&gt;&gt;&gt;1	byte		0x0f		component file 32-bit level 2 journaled checksummed
&gt;&gt;&gt;1	byte		0x10		component file 64-bit level 2 journaled checksummed
&gt;&gt;&gt;1	byte		0x11		component file 32-bit level 3 journaled checksummed
&gt;&gt;&gt;1	byte		0x12		component file 64-bit level 3 journaled checksummed
&gt;&gt;&gt;1	byte		0x13		component file 32-bit non-journaled checksummed
&gt;&gt;&gt;1	byte		0x14		component file 64-bit non-journaled checksummed
&gt;&gt;&gt;1	byte		0x15		component file under construction
&gt;&gt;&gt;1	byte		0x16		DFS component file 64-bit level 1 journaled checksummed
&gt;&gt;&gt;1	byte		0x17		DFS component file 64-bit level 2 journaled checksummed
&gt;&gt;&gt;1	byte		0x18		DFS component file 64-bit level 3 journaled checksummed
&gt;&gt;&gt;1	byte		0x19		external workspace
&gt;&gt;&gt;1	byte		0x80		DDB
&gt;&gt;&gt;2	byte		x		version %d
&gt;&gt;&gt;3	byte		x		\b.%d
#&gt;&gt;&gt;2	byte		x		type %d
#&gt;&gt;&gt;3	byte		x		subtype %d

# *.DXF Dyalog APL Transfer File
0	short		0x6060		Dyalog APL transfer

#------------------------------------------------------------------------------
# $File: ebml,v 1.1 2010/07/02 00:07:03 christos Exp $
# ebml:  file(1) magic for various Extensible Binary Meta Language
# http://www.matroska.org/technical/specs/index.html#track
0	belong	0x1a45dfa3	EBML file
&gt;4	search/b/100	\102\202
&gt;&gt;&amp;1	string	x		\b, creator %.8s

#------------------------------------------------------------------------------
# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $
# T602 editor documents
# by David Necas &lt;yeti@physics.muni.cz&gt;
0	string	@CT\ 	T602 document data,
&gt;4	string	0	Kamenicky
&gt;4	string	1	CP 852
&gt;4	string	2	KOI8-CS
&gt;4	string	&gt;2	unknown encoding

# Vi IMproved Encrypted file
# by David Necas &lt;yeti@physics.muni.cz&gt;
0	string	VimCrypt~	Vim encrypted file data

0	name	vimnanoswap
&gt;67	byte	0
&gt;&gt;107	byte	0
#&gt;&gt;&gt;2	string	x	%s swap file
&gt;&gt;&gt;24	ulelong	x	\b, pid %d
&gt;&gt;&gt;28	string	&gt;\0	\b, user %s
&gt;&gt;&gt;68	string	&gt;\0	\b, host %s
&gt;&gt;&gt;108	string	&gt;\0	\b, file %s
&gt;&gt;&gt;1007	byte	0x55	\b, modified

# Vi IMproved Swap file
# by Sven Wegener &lt;swegener@gentoo.org&gt;
0	string  b0VIM\ 		Vim swap file
&gt;&amp;0	string  &gt;\0		\b, version %s
&gt;0	use	vimnanoswap


# Lock/swap file for several editors, at least
# Vi IMproved and nano
0	string	b0nano		Nano swap file
&gt;0	use	vimnanoswap

# kate (K Advanced Text Editor)
0	string	\x00\x00\x00\x12Kate\ Swap\ File\ 2.0\x00	Kate swap file

#------------------------------------------------------------------------------
# $File: efi,v 1.5 2014/04/30 21:41:02 christos Exp $
# efi:  file(1) magic for Universal EFI binaries

0	lelong	0x0ef1fab9
&gt;4	lelong	1		Universal EFI binary with 1 architecture
&gt;&gt;&amp;0	lelong	7		\b, i386
&gt;&gt;&amp;0	lelong	0x01000007	\b, x86_64
&gt;4	lelong	2		Universal EFI binary with 2 architectures
&gt;&gt;&amp;0	lelong	7		\b, i386
&gt;&gt;&amp;0	lelong	0x01000007	\b, x86_64
&gt;&gt;&amp;20	lelong	7		\b, i386
&gt;&gt;&amp;20	lelong	0x01000007	\b, x86_64
&gt;4	lelong	&gt;2		Universal EFI binary with %d architectures

#------------------------------------------------------------------------------
# $File: elf,v 1.72 2018/02/24 19:50:04 christos Exp $
# elf:  file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# What&#039;re the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# Created by: unknown
# Modified by (1): Daniel Quinlan &lt;quinlan@yggdrasil.com&gt;
# Modified by (2): Peter Tobias &lt;tobias@server.et-inf.fho-emden.de&gt; (core support)
# Modified by (3): Christian &#039;Dr. Disk&#039; Hechelmann &lt;drdisk@ds9.au.s.shuttle.de&gt; (fix of core support)
# Modified by (4): &lt;gerardo.cacciari@gmail.com&gt; (VMS Itanium)
# Modified by (5): Matthias Urlichs &lt;smurf@debian.org&gt; (Listing of many architectures)

0	name		elf-mips
&gt;0	lelong&amp;0xf0000000	0x00000000	MIPS-I
&gt;0	lelong&amp;0xf0000000	0x10000000	MIPS-II
&gt;0	lelong&amp;0xf0000000	0x20000000	MIPS-III
&gt;0	lelong&amp;0xf0000000	0x30000000	MIPS-IV
&gt;0	lelong&amp;0xf0000000	0x40000000	MIPS-V
&gt;0	lelong&amp;0xf0000000	0x50000000	MIPS32
&gt;0	lelong&amp;0xf0000000	0x60000000	MIPS64
&gt;0	lelong&amp;0xf0000000	0x70000000	MIPS32 rel2
&gt;0	lelong&amp;0xf0000000	0x80000000	MIPS64 rel2
&gt;0	lelong&amp;0xf0000000	0x90000000	MIPS32 rel6
&gt;0	lelong&amp;0xf0000000	0xa0000000	MIPS64 rel6

0	name		elf-sparc
&gt;0	lelong&amp;0x00ffff00	0x00000100	V8+ Required,
&gt;0	lelong&amp;0x00ffff00	0x00000200	Sun UltraSPARC1 Extensions Required,
&gt;0	lelong&amp;0x00ffff00	0x00000400	HaL R1 Extensions Required,
&gt;0	lelong&amp;0x00ffff00	0x00000800	Sun UltraSPARC3 Extensions Required,
&gt;0	lelong&amp;0x3		0		total store ordering,
&gt;0	lelong&amp;0x3		1		partial store ordering,
&gt;0	lelong&amp;0x3		2		relaxed memory ordering,

0	name		elf-pa-risc
&gt;2	leshort		0x0214		2.0
&gt;0	leshort		&amp;0x0008		(LP64)

0	name		elf-le
&gt;16	leshort		0		no file type,
!:mime	application/octet-stream
&gt;16	leshort		1		relocatable,
!:mime	application/x-object
&gt;16	leshort		2		executable,
!:mime	application/x-executable
&gt;16	leshort		3		shared object,
!:mime	application/x-sharedlib
&gt;16	leshort		4		core file,
!:mime	application/x-coredump
# Core file detection is not reliable.
#&gt;&gt;&gt;(0x38+0xcc) string	&gt;\0		of &#039;%s&#039;
#&gt;&gt;&gt;(0x38+0x10) lelong	&gt;0		(signal %d),
&gt;16	leshort		&amp;0xff00		processor-specific,
&gt;18	clear		x
&gt;18	leshort		0		no machine,
&gt;18	leshort		1		AT&amp;T WE32100,
&gt;18	leshort		2		SPARC,
&gt;18	leshort		3		Intel 80386,
&gt;18	leshort		4		Motorola m68k,
&gt;&gt;4	byte		1
&gt;&gt;&gt;36	lelong		&amp;0x01000000	68000,
&gt;&gt;&gt;36	lelong		&amp;0x00810000	CPU32,
&gt;&gt;&gt;36	lelong		0		68020,
&gt;18	leshort		5		Motorola m88k,
&gt;18	leshort		6		Intel 80486,
&gt;18	leshort		7		Intel 80860,
# The official e_machine number for MIPS is now #8, regardless of endianness.
# The second number (#10) will be deprecated later. For now, we still
# say something if #10 is encountered, but only gory details for #8.
&gt;18	leshort		8		MIPS,
&gt;&gt;4	byte		1
&gt;&gt;&gt;36	lelong		&amp;0x20		N32
&gt;18	leshort		10		MIPS,
&gt;&gt;4	byte		1
&gt;&gt;&gt;36	lelong		&amp;0x20		N32
&gt;18	leshort		8
# only for 32-bit
&gt;&gt;4	byte		1
&gt;&gt;&gt;36	use		elf-mips
# only for 64-bit
&gt;&gt;4	byte		2
&gt;&gt;&gt;48	use		elf-mips
&gt;18	leshort		9		Amdahl,
&gt;18	leshort		10		MIPS (deprecated),
&gt;18	leshort		11		RS6000,
&gt;18	leshort		15		PA-RISC,
# only for 32-bit
&gt;&gt;4	byte		1
&gt;&gt;&gt;36	use		elf-pa-risc
# only for 64-bit
&gt;&gt;4	byte		2
&gt;&gt;&gt;48	use		elf-pa-risc
&gt;18	leshort		16		nCUBE,
&gt;18	leshort		17		Fujitsu VPP500,
&gt;18	leshort		18		SPARC32PLUS,
# only for 32-bit
&gt;&gt;4	byte		1
&gt;&gt;&gt;36	use		elf-sparc
&gt;18	leshort		19		Intel 80960,
&gt;18	leshort		20		PowerPC or cisco 4500,
&gt;18	leshort		21		64-bit PowerPC or cisco 7500,
&gt;18	leshort		22		IBM S/390,
&gt;18	leshort		23		Cell SPU,
&gt;18	leshort		24		cisco SVIP,
&gt;18	leshort		25		cisco 7200,
&gt;18	leshort		36		NEC V800 or cisco 12000,
&gt;18	leshort		37		Fujitsu FR20,
&gt;18	leshort		38		TRW RH-32,
&gt;18	leshort		39		Motorola RCE,
&gt;18	leshort		40		ARM,
&gt;&gt;4	byte		1
&gt;&gt;&gt;36	lelong&amp;0xff000000	0x04000000	EABI4
&gt;&gt;&gt;36	lelong&amp;0xff000000	0x05000000	EABI5
&gt;&gt;&gt;36	lelong		&amp;0x00800000	BE8
&gt;&gt;&gt;36	lelong		&amp;0x00400000	LE8
&gt;18	leshort		41		Alpha,
&gt;18	leshort		42		Renesas SH,
&gt;18	leshort		43		SPARC V9,
&gt;&gt;4	byte		2
&gt;&gt;&gt;48	use		elf-sparc
&gt;18	leshort		44		Siemens Tricore Embedded Processor,
&gt;18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
&gt;18	leshort		46		Renesas H8/300,
&gt;18	leshort		47		Renesas H8/300H,
&gt;18	leshort		48		Renesas H8S,
&gt;18	leshort		49		Renesas H8/500,
&gt;18	leshort		50		IA-64,
&gt;18	leshort		51		Stanford MIPS-X,
&gt;18	leshort		52		Motorola Coldfire,
&gt;18	leshort		53		Motorola M68HC12,
&gt;18	leshort		54		Fujitsu MMA,
&gt;18	leshort		55		Siemens PCP,
&gt;18	leshort		56		Sony nCPU,
&gt;18	leshort		57		Denso NDR1,
&gt;18	leshort		58		Start*Core,
&gt;18	leshort		59		Toyota ME16,
&gt;18	leshort		60		ST100,
&gt;18	leshort		61		Tinyj emb.,
&gt;18	leshort		62		x86-64,
&gt;18	leshort		63		Sony DSP,
&gt;18	leshort		64		DEC PDP-10,
&gt;18	leshort		65		DEC PDP-11,
&gt;18	leshort		66		FX66,
&gt;18	leshort		67		ST9+ 8/16 bit,
&gt;18	leshort		68		ST7 8 bit,
&gt;18	leshort		69		MC68HC16,
&gt;18	leshort		70		MC68HC11,
&gt;18	leshort		71		MC68HC08,
&gt;18	leshort		72		MC68HC05,
&gt;18	leshort		73		SGI SVx or Cray NV1,
&gt;18	leshort		74		ST19 8 bit,
&gt;18	leshort		75		Digital VAX,
&gt;18	leshort		76		Axis cris,
&gt;18	leshort		77		Infineon 32-bit embedded,
&gt;18	leshort		78		Element 14 64-bit DSP,
&gt;18	leshort		79		LSI Logic 16-bit DSP,
&gt;18	leshort		80		MMIX,
&gt;18	leshort		81		Harvard machine-independent,
&gt;18	leshort		82		SiTera Prism,
&gt;18	leshort		83		Atmel AVR 8-bit,
&gt;18	leshort		84		Fujitsu FR30,
&gt;18	leshort		85		Mitsubishi D10V,
&gt;18	leshort		86		Mitsubishi D30V,
&gt;18	leshort		87		NEC v850,
&gt;18	leshort		88		Renesas M32R,
&gt;18	leshort		89		Matsushita MN10300,
&gt;18	leshort		90		Matsushita MN10200,
&gt;18	leshort		91		picoJava,
&gt;18	leshort		92		OpenRISC,
&gt;18	leshort		93		ARC Cores Tangent-A5,
&gt;18	leshort		94		Tensilica Xtensa,
&gt;18	leshort		95		Alphamosaic VideoCore,
&gt;18	leshort		96		Thompson Multimedia,
&gt;18	leshort		97		NatSemi 32k,
&gt;18	leshort		98		Tenor Network TPC,
&gt;18	leshort		99		Trebia SNP 1000,
&gt;18	leshort		100		STMicroelectronics ST200,
&gt;18	leshort		101		Ubicom IP2022,
&gt;18	leshort		102		MAX Processor,
&gt;18	leshort		103		NatSemi CompactRISC,
&gt;18	leshort		104		Fujitsu F2MC16,
&gt;18	leshort		105		TI msp430,
&gt;18	leshort		106		Analog Devices Blackfin,
&gt;18	leshort		107		S1C33 Family of Seiko Epson,
&gt;18	leshort		108		Sharp embedded,
&gt;18	leshort		109		Arca RISC,
&gt;18	leshort		110		PKU-Unity Ltd.,
&gt;18	leshort		111		eXcess: 16/32/64-bit,
&gt;18	leshort		112		Icera Deep Execution Processor,
&gt;18	leshort		113		Altera Nios II,
&gt;18	leshort		114		NatSemi CRX,
&gt;18	leshort		115		Motorola XGATE,
&gt;18	leshort		116		Infineon C16x/XC16x,
&gt;18	leshort		117		Renesas M16C series,
&gt;18	leshort		118		Microchip dsPIC30F,
&gt;18	leshort		119		Freescale RISC core,
&gt;18	leshort		120		Renesas M32C series,
&gt;18	leshort		131		Altium TSK3000 core,
&gt;18	leshort		132		Freescale RS08,
&gt;18	leshort		134		Cyan Technology eCOG2,
&gt;18	leshort		135		Sunplus S+core7 RISC,
&gt;18	leshort		136		New Japan Radio (NJR) 24-bit DSP,
&gt;18	leshort		137		Broadcom VideoCore III,
&gt;18	leshort		138		LatticeMico32,
&gt;18	leshort		139		Seiko Epson C17 family,
&gt;18	leshort		140		TI TMS320C6000 DSP family,
&gt;18	leshort		141		TI TMS320C2000 DSP family,
&gt;18	leshort		142		TI TMS320C55x DSP family,
&gt;18	leshort		160		STMicroelectronics 64bit VLIW DSP,
&gt;18	leshort		161		Cypress M8C,
&gt;18	leshort		162		Renesas R32C series,
&gt;18	leshort		163		NXP TriMedia family,
&gt;18	leshort		164		QUALCOMM DSP6,
&gt;18	leshort		165		Intel 8051 and variants,
&gt;18	leshort		166		STMicroelectronics STxP7x family,
&gt;18	leshort		167		Andes embedded RISC,
&gt;18	leshort		168		Cyan eCOG1X family,
&gt;18	leshort		169		Dallas MAXQ30,
&gt;18	leshort		170		New Japan Radio (NJR) 16-bit DSP,
&gt;18	leshort		171		M2000 Reconfigurable RISC,
&gt;18	leshort		172		Cray NV2 vector architecture,
&gt;18	leshort		173		Renesas RX family,
&gt;18	leshort		174		META,
&gt;18	leshort		175		MCST Elbrus,
&gt;18	leshort		176		Cyan Technology eCOG16 family,
&gt;18	leshort		177		NatSemi CompactRISC,
&gt;18	leshort		178		Freescale Extended Time Processing Unit,
&gt;18	leshort		179		Infineon SLE9X,
&gt;18	leshort		180		Intel L1OM,
&gt;18	leshort		181		Intel K1OM,
&gt;18	leshort		183		ARM aarch64,
&gt;18	leshort		185		Atmel 32-bit family,
&gt;18	leshort		186		STMicroeletronics STM8 8-bit,
&gt;18	leshort		187		Tilera TILE64,
&gt;18	leshort		188		Tilera TILEPro,
&gt;18	leshort		189		Xilinx MicroBlaze 32-bit RISC,
&gt;18	leshort		190		NVIDIA CUDA architecture,
&gt;18	leshort		191		Tilera TILE-Gx,
&gt;18	leshort		197		Renesas RL78 family,
&gt;18	leshort		199		Renesas 78K0R,
&gt;18	leshort		200		Freescale 56800EX,
&gt;18	leshort		201		Beyond BA1,
&gt;18	leshort		202		Beyond BA2,
&gt;18	leshort		203		XMOS xCORE,
&gt;18	leshort		204		Microchip 8-bit PIC(r),
&gt;18	leshort		210		KM211 KM32,
&gt;18	leshort		211		KM211 KMX32,
&gt;18	leshort		212		KM211 KMX16,
&gt;18	leshort		213		KM211 KMX8,
&gt;18	leshort		214		KM211 KVARC,
&gt;18	leshort		215		Paneve CDP,
&gt;18	leshort		216		Cognitive Smart Memory,
&gt;18	leshort		217		iCelero CoolEngine,
&gt;18	leshort		218		Nanoradio Optimized RISC,
&gt;18	leshort		243		UCB RISC-V,
&gt;18	leshort		247		eBPF,
&gt;18	leshort		0x1057		AVR (unofficial),
&gt;18	leshort		0x1059		MSP430 (unofficial),
&gt;18	leshort		0x1223		Adapteva Epiphany (unofficial),
&gt;18	leshort		0x2530		Morpho MT (unofficial),
&gt;18	leshort		0x3330		FR30 (unofficial),
&gt;18	leshort		0x3426		OpenRISC (obsolete),
&gt;18	leshort		0x4688		Infineon C166 (unofficial),
&gt;18	leshort		0x5441		Cygnus FRV (unofficial),
&gt;18	leshort		0x5aa5		DLX (unofficial),
&gt;18	leshort		0x7650		Cygnus D10V (unofficial),
&gt;18	leshort		0x7676		Cygnus D30V (unofficial),
&gt;18	leshort		0x8217		Ubicom IP2xxx (unofficial),
&gt;18	leshort		0x8472		OpenRISC (obsolete),
&gt;18	leshort		0x9025		Cygnus PowerPC (unofficial),
&gt;18	leshort		0x9026		Alpha (unofficial),
&gt;18	leshort		0x9041		Cygnus M32R (unofficial),
&gt;18	leshort		0x9080		Cygnus V850 (unofficial),
&gt;18	leshort		0xa390		IBM S/390 (obsolete),
&gt;18	leshort		0xabc7		Old Xtensa (unofficial),
&gt;18	leshort		0xad45		xstormy16 (unofficial),
&gt;18	leshort		0xbaab		Old MicroBlaze (unofficial),,
&gt;18	leshort		0xbeef		Cygnus MN10300 (unofficial),
&gt;18	leshort		0xdead		Cygnus MN10200 (unofficial),
&gt;18	leshort		0xf00d		Toshiba MeP (unofficial),
&gt;18	leshort		0xfeb0		Renesas M32C (unofficial),
&gt;18	leshort		0xfeba		Vitesse IQ2000 (unofficial),
&gt;18	leshort		0xfebb		NIOS (unofficial),
&gt;18	leshort		0xfeed		Moxie (unofficial),
&gt;18	default		x
&gt;&gt;18	leshort		x		*unknown arch 0x%x*
&gt;20	lelong		0		invalid version
&gt;20	lelong		1		version 1

0	string		\177ELF		ELF
!:strength *2
&gt;4	byte		0		invalid class
&gt;4	byte		1		32-bit
&gt;4	byte		2		64-bit
&gt;5	byte		0		invalid byte order
&gt;5	byte		1		LSB
&gt;&gt;0	use		elf-le
&gt;5	byte		2		MSB
&gt;&gt;0	use		\^elf-le
&gt;7	byte		0		(SYSV)
&gt;7	byte		1		(HP-UX)
&gt;7	byte		2		(NetBSD)
&gt;7	byte		3		(GNU/Linux)
&gt;7	byte		4		(GNU/Hurd)
&gt;7	byte		5		(86Open)
&gt;7	byte		6		(Solaris)
&gt;7	byte		7		(Monterey)
&gt;7	byte		8		(IRIX)
&gt;7	byte		9		(FreeBSD)
&gt;7	byte		10		(Tru64)
&gt;7	byte		11		(Novell Modesto)
&gt;7	byte		12		(OpenBSD)
&gt;7	byte		13		(OpenVMS)
&gt;7	byte		14		(HP NonStop Kernel)
&gt;7	byte		15		(AROS Research Operating System)
&gt;7	byte		16		(FenixOS)
&gt;7	byte		17		(Nuxi CloudABI)
&gt;7	byte		97		(ARM)
&gt;7	byte		255		(embedded)

#------------------------------------------------------------------------------
# $File: encore,v 1.7 2014/04/30 21:41:02 christos Exp $
# encore:  file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
#
0	short		0x154		Encore
&gt;20	short		0x107		executable
&gt;20	short		0x108		pure executable
&gt;20	short		0x10b		demand-paged executable
&gt;20	short		0x10f		unsupported executable
&gt;12	long		&gt;0		not stripped
&gt;22	short		&gt;0		- version %d
&gt;22	short		0		-
#&gt;4	date		x		stamp %s
0	short		0x155		Encore unsupported executable
&gt;12	long		&gt;0		not stripped
&gt;22	short		&gt;0		- version %d
&gt;22	short		0		-
#&gt;4	date		x		stamp %s

#------------------------------------------------------------------------------
# $File: epoc,v 1.9 2013/12/21 14:28:15 christos Exp $
# EPOC : file(1) magic for EPOC documents [Psion Series 5/Osaris/Geofox 1]
# Stefan Praszalowicz &lt;hpicollo@worldnet.fr&gt; and Peter Breitenlohner &lt;peb@mppmu.mpg.de&gt;
# Useful information for improving this file can be found at:
# http://software.frodo.looijaard.name/psiconv/formats/Index.html
#------------------------------------------------------------------------------
0	lelong		0x10000037	Psion Series 5
&gt;4	lelong		0x10000039	font file
&gt;4	lelong		0x1000003A	printer driver
&gt;4	lelong		0x1000003B	clipboard
&gt;4	lelong		0x10000042	multi-bitmap image
!:mime image/x-epoc-mbm
&gt;4	lelong		0x1000006A	application information file
&gt;4	lelong		0x1000006D
&gt;&gt;8	lelong		0x1000007D	Sketch image
!:mime image/x-epoc-sketch
&gt;&gt;8	lelong		0x1000007E	voice note
&gt;&gt;8	lelong		0x1000007F	Word file
!:mime application/x-epoc-word
&gt;&gt;8	lelong		0x10000085	OPL program (TextEd)
!:mime application/x-epoc-opl
&gt;&gt;8	lelong		0x10000087	Comms settings
&gt;&gt;8	lelong		0x10000088	Sheet file
!:mime application/x-epoc-sheet
&gt;&gt;8	lelong		0x100001C4	EasyFax initialisation file
&gt;4	lelong		0x10000073	OPO module
!:mime application/x-epoc-opo
&gt;4	lelong		0x10000074	OPL application
!:mime application/x-epoc-app
&gt;4	lelong		0x1000008A	exported multi-bitmap image
&gt;4	lelong		0x1000016D
&gt;&gt;8	lelong		0x10000087	Comms names

0	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image

0	lelong		0x10000050	Psion Series 5
&gt;4	lelong		0x1000006D	database
&gt;&gt;8	lelong		0x10000084	Agenda file
!:mime application/x-epoc-agenda
&gt;&gt;8	lelong		0x10000086	Data file
!:mime application/x-epoc-data
&gt;&gt;8	lelong		0x10000CEA	Jotter file
!:mime application/x-epoc-jotter
&gt;4	lelong		0x100000E4	ini file

0	lelong		0x10000079	Psion Series 5 binary:
&gt;4	lelong		0x00000000	DLL
&gt;4	lelong		0x10000049	comms hardware library
&gt;4	lelong		0x1000004A	comms protocol library
&gt;4	lelong		0x1000005D	OPX
&gt;4	lelong		0x1000006C	application
&gt;4	lelong		0x1000008D	DLL
&gt;4	lelong		0x100000AC	logical device driver
&gt;4	lelong		0x100000AD	physical device driver
&gt;4	lelong		0x100000E5	file transfer protocol
&gt;4	lelong		0x100000E5	file transfer protocol
&gt;4	lelong		0x10000140	printer definition
&gt;4	lelong		0x10000141	printer definition

0	lelong		0x1000007A	Psion Series 5 executable

#------------------------------------------------------------------------------
# $File: erlang,v 1.6 2010/09/20 19:19:17 rrt Exp $
# erlang:  file(1) magic for Erlang JAM and BEAM files
# URL:  http://www.erlang.org/faq/x779.html#AEN812

# OTP R3-R4
0	string	\0177BEAM!	Old Erlang BEAM file
&gt;6	short	&gt;0		- version %d

# OTP R5 and onwards
0	string	FOR1
&gt;8	string	BEAM		Erlang BEAM file

# 4.2 version may have a copyright notice!
4	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2
79	string	Tue\ Jan\ 22\ 14:32:44\ MET\ 1991	Erlang JAM file - version 4.2

4	string	1.0\ Fri\ Feb\ 3\ 09:55:56\ MET\ 1995	Erlang JAM file - version 4.3

0	bequad	0x0000000000ABCDEF	Erlang DETS file

#------------------------------------------------------------------------------
# $File: esri,v 1.4 2009/09/19 16:28:09 christos Exp $
# ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
# Based on info from
# &lt;URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf&gt;
0	belong	9994	ESRI Shapefile
&gt;4	belong	=0
&gt;8	belong	=0
&gt;12	belong	=0
&gt;16	belong	=0
&gt;20	belong	=0
&gt;28	lelong	x	version %d
&gt;24	belong	x	length %d
&gt;32	lelong	=0	type Null Shape
&gt;32	lelong	=1	type Point
&gt;32	lelong	=3	type PolyLine
&gt;32	lelong	=5	type Polygon
&gt;32	lelong	=8	type MultiPoint
&gt;32	lelong	=11	type PointZ
&gt;32	lelong	=13	type PolyLineZ
&gt;32	lelong	=15	type PolygonZ
&gt;32	lelong	=18	type MultiPointZ
&gt;32	lelong	=21	type PointM
&gt;32	lelong	=23	type PolyLineM
&gt;32	lelong	=25	type PolygonM
&gt;32	lelong	=28	type MultiPointM
&gt;32	lelong	=31	type MultiPatch

#------------------------------------------------------------------------------
# $File: fcs,v 1.4 2009/09/19 16:28:09 christos Exp $
# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
# From Roger Leigh &lt;roger@whinlatter.uklinux.net&gt;
0       string          FCS1.0          Flow Cytometry Standard (FCS) data, version 1.0
0       string          FCS2.0          Flow Cytometry Standard (FCS) data, version 2.0
0       string          FCS3.0          Flow Cytometry Standard (FCS) data, version 3.0

#------------------------------------------------------------------------------
# $File: filesystems,v 1.124 2018/01/12 12:35:30 christos Exp $
# filesystems:  file(1) magic for different filesystems
#
0	name	partid
&gt;0	ubyte	0x00	Unused
&gt;0	ubyte	0x01	12-bit FAT
&gt;0	ubyte	0x02	XENIX /
&gt;0	ubyte	0x03	XENIX /usr
&gt;0	ubyte	0x04	16-bit FAT, less than 32M
&gt;0	ubyte	0x05	extended partition
&gt;0	ubyte	0x06	16-bit FAT, more than 32M
&gt;0	ubyte	0x07	OS/2 HPFS, NTFS, QNX2, Adv. UNIX
&gt;0	ubyte	0x08	AIX or os, or etc.
&gt;0	ubyte	0x09	AIX boot partition or Coherent
&gt;0	ubyte	0x0a	O/2 boot manager or Coherent swap
&gt;0	ubyte	0x0b	32-bit FAT
&gt;0	ubyte	0x0c	32-bit FAT, LBA-mapped
&gt;0	ubyte	0x0d	7XXX, LBA-mapped
&gt;0	ubyte	0x0e	16-bit FAT, LBA-mapped
&gt;0	ubyte	0x0f	extended partition, LBA-mapped
&gt;0	ubyte	0x10	OPUS
&gt;0	ubyte	0x11 	OS/2 DOS 12-bit FAT
&gt;0	ubyte	0x12 	Compaq diagnostics
&gt;0	ubyte	0x14 	OS/2 DOS 16-bit FAT &lt;32M
&gt;0	ubyte	0x16 	OS/2 DOS 16-bit FAT &gt;=32M
&gt;0	ubyte	0x17 	OS/2 hidden IFS
&gt;0	ubyte	0x18 	AST Windows swapfile
&gt;0	ubyte	0x19 	Willowtech Photon coS
&gt;0	ubyte	0x1b 	hidden win95 fat 32
&gt;0	ubyte	0x1c 	hidden win95 fat 32 lba
&gt;0	ubyte	0x1d	hidden win95 fat 16 lba
&gt;0	ubyte	0x20 	Willowsoft OFS1
&gt;0	ubyte	0x21 	reserved
&gt;0	ubyte	0x23 	reserved
&gt;0	ubyte	0x24	NEC DOS
&gt;0	ubyte	0x26 	reserved
&gt;0	ubyte	0x31 	reserved
&gt;0	ubyte	0x32	Alien Internet Services NOS
&gt;0	ubyte	0x33 	reserved
&gt;0	ubyte	0x34 	reserved
&gt;0	ubyte	0x35 	JFS on OS2
&gt;0	ubyte	0x36 	reserved
&gt;0	ubyte	0x38 	Theos
&gt;0	ubyte	0x39 	Plan 9, or Theos spanned
&gt;0	ubyte	0x3a 	Theos ver 4 4gb partition
&gt;0	ubyte	0x3b 	Theos ve 4 extended partition
&gt;0	ubyte	0x3c 	PartitionMagic recovery
&gt;0	ubyte	0x3d 	Hidden Netware
&gt;0	ubyte	0x40 	VENIX 286 or LynxOS
&gt;0	ubyte	0x41	PReP
&gt;0	ubyte	0x42	linux swap sharing DRDOS disk
&gt;0	ubyte	0x43	linux sharing DRDOS disk
&gt;0	ubyte	0x44	GoBack change utility
&gt;0	ubyte	0x45	Boot US Boot manager
&gt;0	ubyte	0x46	EUMEL/Elan or Ergos 3
&gt;0	ubyte	0x47	EUMEL/Elan or Ergos 3
&gt;0	ubyte	0x48	EUMEL/Elan or Ergos 3
&gt;0	ubyte	0x4a	ALFX/THIN filesystem for DOS
&gt;0	ubyte	0x4c	Oberon partition
&gt;0	ubyte	0x4d 	QNX4.x
&gt;0	ubyte	0x4e 	QNX4.x 2nd part
&gt;0	ubyte	0x4f 	QNX4.x 3rd part
&gt;0	ubyte	0x50 	DM (disk manager)
&gt;0	ubyte	0x51 	DM6 Aux1 (or Novell)
&gt;0	ubyte	0x52 	CP/M or Microport SysV/AT
&gt;0	ubyte	0x53 	DM6 Aux3
&gt;0	ubyte	0x54	DM6 DDO
&gt;0	ubyte	0x55	EZ-Drive (disk manager)
&gt;0	ubyte	0x56	Golden Bow (disk manager)
&gt;0	ubyte	0x57	Drive PRO
&gt;0	ubyte	0x5c	Priam Edisk (disk manager)
&gt;0	ubyte	0x61	SpeedStor
&gt;0	ubyte	0x63	GNU HURD or Mach or Sys V/386
&gt;0	ubyte	0x64	Novell Netware 2.xx or Speedstore
&gt;0	ubyte	0x65	Novell Netware 3.xx
&gt;0	ubyte	0x66	Novell 386 Netware
&gt;0	ubyte	0x67	Novell
&gt;0	ubyte	0x68	Novell
&gt;0	ubyte	0x69	Novell
&gt;0	ubyte	0x70	DiskSecure Multi-Boot
&gt;0	ubyte	0x71	reserved
&gt;0	ubyte	0x73	reserved
&gt;0	ubyte	0x74	reserved
&gt;0	ubyte	0x75	PC/IX
&gt;0	ubyte	0x76	reserved
&gt;0	ubyte	0x77	M2FS/M2CS partition
&gt;0	ubyte	0x78	XOSL boot loader filesystem
&gt;0	ubyte	0x80	MINIX until 1.4a
&gt;0	ubyte	0x81	MINIX since 1.4b
&gt;0	ubyte	0x82	Linux swap or Solaris
&gt;0	ubyte	0x83	Linux native
&gt;0	ubyte	0x84	OS/2 hidden C: drive
&gt;0	ubyte	0x85	Linux extended partition
&gt;0	ubyte	0x86	NT FAT volume set
&gt;0	ubyte	0x87	NTFS volume set or HPFS mirrored
&gt;0	ubyte	0x8a	Linux Kernel AiR-BOOT partition
&gt;0	ubyte	0x8b	Legacy Fault tolerant FAT32
&gt;0	ubyte	0x8c	Legacy Fault tolerant FAT32 ext
&gt;0	ubyte	0x8d	Hidden free FDISK FAT12
&gt;0	ubyte	0x8e	Linux Logical Volume Manager
&gt;0	ubyte	0x90	Hidden free FDISK FAT16
&gt;0	ubyte	0x91	Hidden free FDISK DOS EXT
&gt;0	ubyte	0x92	Hidden free FDISK FAT16 Big
&gt;0	ubyte	0x93	Amoeba filesystem
&gt;0	ubyte	0x94	Amoeba bad block table
&gt;0	ubyte	0x95	MIT EXOPC native partitions
&gt;0	ubyte	0x97	Hidden free FDISK FAT32
&gt;0	ubyte	0x98	Datalight ROM-DOS Super-Boot
&gt;0	ubyte	0x99	Mylex EISA SCSI
&gt;0	ubyte	0x9a	Hidden free FDISK FAT16 LBA
&gt;0	ubyte	0x9b	Hidden free FDISK EXT LBA
&gt;0	ubyte	0x9f	BSDI?
&gt;0	ubyte	0xa0	IBM Thinkpad hibernation
&gt;0	ubyte	0xa1	HP Volume expansion (SpeedStor)
&gt;0	ubyte	0xa3	HP Volume expansion (SpeedStor)
&gt;0	ubyte	0xa4	HP Volume expansion (SpeedStor)
&gt;0	ubyte	0xa5	386BSD partition type
&gt;0	ubyte	0xa6	OpenBSD partition type
&gt;0	ubyte	0xa7	NeXTSTEP 486
&gt;0	ubyte	0xa8	Apple UFS
&gt;0	ubyte	0xa9	NetBSD partition type
&gt;0	ubyte	0xaa	Olivetty Fat12 1.44MB Service part
&gt;0	ubyte	0xab	Apple Boot
&gt;0	ubyte	0xae	SHAG OS filesystem
&gt;0	ubyte	0xaf	Apple HFS
&gt;0	ubyte	0xb0	BootStar Dummy
&gt;0	ubyte	0xb1	reserved
&gt;0	ubyte	0xb3	reserved
&gt;0	ubyte	0xb4	reserved
&gt;0	ubyte	0xb6	reserved
&gt;0	ubyte	0xb7	BSDI BSD/386 filesystem
&gt;0	ubyte	0xb8	BSDI BSD/386 swap
&gt;0	ubyte	0xbb	Boot Wizard Hidden
&gt;0	ubyte	0xbe	Solaris 8 partition type
&gt;0	ubyte	0xbf	Solaris partition type
&gt;0	ubyte	0xc0 	CTOS
&gt;0	ubyte	0xc1 	DRDOS/sec (FAT-12)
&gt;0	ubyte	0xc2 	Hidden Linux
&gt;0	ubyte	0xc3 	Hidden Linux swap
&gt;0	ubyte	0xc4 	DRDOS/sec (FAT-16, &lt; 32M)
&gt;0	ubyte	0xc5 	DRDOS/sec (EXT)
&gt;0	ubyte	0xc6 	DRDOS/sec (FAT-16, &gt;= 32M)
&gt;0	ubyte	0xc7 	Syrinx (Cyrnix?) or HPFS disabled
&gt;0	ubyte	0xc8 	Reserved for DR-DOS 8.0+
&gt;0	ubyte	0xc9 	Reserved for DR-DOS 8.0+
&gt;0	ubyte	0xca 	Reserved for DR-DOS 8.0+
&gt;0	ubyte	0xcb 	DR-DOS 7.04+ Secured FAT32 CHS
&gt;0	ubyte	0xcc 	DR-DOS 7.04+ Secured FAT32 LBA
&gt;0	ubyte	0xcd	CTOS Memdump
&gt;0	ubyte	0xce 	DR-DOS 7.04+ FAT16X LBA
&gt;0	ubyte	0xcf 	DR-DOS 7.04+ EXT LBA
&gt;0	ubyte	0xd0 	REAL/32 secure big partition
&gt;0	ubyte	0xd1 	Old Multiuser DOS FAT12
&gt;0	ubyte	0xd4 	Old Multiuser DOS FAT16 Small
&gt;0	ubyte	0xd5 	Old Multiuser DOS Extended
&gt;0	ubyte	0xd6 	Old Multiuser DOS FAT16 Big
&gt;0	ubyte	0xd8 	CP/M 86
&gt;0	ubyte	0xdb 	CP/M or Concurrent CP/M
&gt;0	ubyte	0xdd 	Hidden CTOS Memdump
&gt;0	ubyte	0xde 	Dell PowerEdge Server utilities
&gt;0	ubyte	0xdf 	DG/UX virtual disk manager
&gt;0	ubyte	0xe0 	STMicroelectronics ST AVFS
&gt;0	ubyte	0xe1 	DOS access or SpeedStor 12-bit
&gt;0	ubyte	0xe3 	DOS R/O or Storage Dimensions
&gt;0	ubyte	0xe4 	SpeedStor 16-bit FAT &lt; 1024 cyl.
&gt;0	ubyte	0xe5	reserved
&gt;0	ubyte	0xe6	reserved
&gt;0	ubyte	0xeb 	BeOS
&gt;0	ubyte	0xee	GPT Protective MBR
&gt;0	ubyte	0xef	EFI system partition
&gt;0	ubyte	0xf0 	Linux PA-RISC boot loader
&gt;0	ubyte	0xf1 	SpeedStor or Storage Dimensions
&gt;0	ubyte	0xf2 	DOS 3.3+ Secondary
&gt;0	ubyte	0xf3	reserved
&gt;0	ubyte	0xf4	SpeedStor large partition
&gt;0	ubyte	0xf5	Prologue multi-volumen partition
&gt;0	ubyte	0xf6 	reserved
&gt;0	ubyte	0xf9 	pCache: ext2/ext3 persistent cache
&gt;0	ubyte	0xfa 	Bochs x86 emulator
&gt;0	ubyte	0xfb 	VMware File System
&gt;0	ubyte	0xfc 	VMware Swap
&gt;0	ubyte	0xfd 	Linux RAID partition persistent sb
&gt;0	ubyte	0xfe	LANstep or IBM PS/2 IML
&gt;0	ubyte	0xff 	Xenix Bad Block Table

0	string	\366\366\366\366	PC formatted floppy with no filesystem
# Sun disk labels
# From /usr/include/sun/dklabel.h:
0774	beshort		0xdabe
# modified by Joerg Jenderek, because original test
# succeeds for Cabinet archive dao360.dl_ with negative blocks
&gt;0770	long		&gt;0		Sun disk label
&gt;&gt;0	string		x		&#039;%s
&gt;&gt;&gt;31	string		&gt;\0		\b%s
&gt;&gt;&gt;&gt;63	string		&gt;\0		\b%s
&gt;&gt;&gt;&gt;&gt;95	string		&gt;\0		\b%s
&gt;&gt;0	string		x		\b&#039;
&gt;&gt;0734	short		&gt;0		%d rpm,
&gt;&gt;0736	short		&gt;0		%d phys cys,
&gt;&gt;0740	short		&gt;0		%d alts/cyl,
&gt;&gt;0746	short		&gt;0		%d interleave,
&gt;&gt;0750	short		&gt;0		%d data cyls,
&gt;&gt;0752	short		&gt;0		%d alt cyls,
&gt;&gt;0754	short		&gt;0		%d heads/partition,
&gt;&gt;0756	short		&gt;0		%d sectors/track,
&gt;&gt;0764	long		&gt;0		start cyl %d,
&gt;&gt;0770	long		x		%d blocks
# Is there a boot block written 1 sector in?
&gt;512    belong&amp;077777777	0600407	\b, boot block present

# Joerg Jenderek: Smart Boot Manager backup file is 25 (MSDOS) or 41 (LINUX) byte header + first sectors of disk
# (http://btmgr.sourceforge.net/docs/user-guide-3.html)
0		string	SBMBAKUP_	Smart Boot Manager backup file
&gt;9		string	x		\b, version %-5.5s
&gt;&gt;14		string	=_
&gt;&gt;&gt;15		string	x		%-.1s
&gt;&gt;&gt;&gt;16		string	=_		\b.
&gt;&gt;&gt;&gt;&gt;17		string	x		\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;18	string	=_		\b.
&gt;&gt;&gt;&gt;&gt;&gt;&gt;19	string	x		\b%-.1s
&gt;&gt;&gt;22		ubyte	0
&gt;&gt;&gt;&gt;21		ubyte	x		\b, from drive 0x%x
&gt;&gt;&gt;22		ubyte	&gt;0
&gt;&gt;&gt;&gt;21		string	x		\b, from drive %s
&gt;&gt;&gt;535		search/17	\x55\xAA
&gt;&gt;&gt;&gt;&amp;-512	indirect	x	\b; contains

# updated by Joerg Jenderek at Nov 2012
# DOS Emulator image is 128 byte, null right padded header + harddisc image
0	string	DOSEMU\0
&gt;0x27E	leshort	0xAA55
#offset is 128
&gt;&gt;19	ubyte	128
&gt;&gt;&gt;(19.b-1)	ubyte	0x0	DOS Emulator image
&gt;&gt;&gt;&gt;7	ulelong	&gt;0		\b, %u heads
&gt;&gt;&gt;&gt;11	ulelong	&gt;0		\b, %d sectors/track
&gt;&gt;&gt;&gt;15	ulelong	&gt;0		\b, %d cylinders
&gt;&gt;&gt;&gt;128	indirect	x	\b; contains

# added by Joerg Jenderek at Nov 2012
# http://www.thenakedpc.com/articles/v04/08/0408-05.html
# Symantec (Peter Norton) Image.dat file consists of variable header, bootrecord, part of FAT and root directory data
0	string	PNCIHISK\0		Norton Utilities disc image data
# real x86 boot sector with jump instruction
&gt;509	search/1026	\x55\xAA\xeb
&gt;&gt;&amp;-1	indirect	x		\b; contains
# http://file-extension.net/seeker/file_extension_dat
0	string	PNCIUNDO		Norton Disk Doctor UnDo file
#

# DOS/MBR boot sector updated by Joerg Jenderek at Sep 2007,May 2011,2013
# for any allowed sector sizes
30		search/481	\x55\xAA
# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
# DOS BPB information (70) and after DOS floppy (120) like in previous file version
!:strength +65
# for sector sizes &lt; 512 Bytes
&gt;11		uleshort	&lt;512
&gt;&gt;(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
# for sector sizes with 512 or more Bytes
&gt;0x1FE		leshort		0xAA55		DOS/MBR boot sector

# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
# only for sector sizes with 512 or more Bytes
0x1FE          leshort         0xAA55         	DOS/MBR boot sector
#
# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
!:strength +65
&gt;2		string		OSBS		OS/BS MBR
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
# and http://en.wikipedia.org/wiki/Master_Boot_Record
# test for nearly all MS-DOS Master Boot Record initial program loader (IPL) is now done by
# characteristic assembler instructions: xor ax,ax;mov ss,ax;mov sp,7c00
&gt;0	search/2	\x33\xc0\x8e\xd0\xbc\x00\x7c	MS-MBR
# Microsoft Windows 95A and early ( http://thestarman.pcministry.com/asm/mbr/STDMBR.htm )
# assembler instructions: mov si,sp;push ax;pop es;push ax;pop ds;sti;cld
&gt;&gt;8	ubequad		0x8bf45007501ffbfc
# http://thestarman.pcministry.com/asm/mbr/200MBR.htm
&gt;&gt;&gt;0x16	ubyte		0xF3				\b,DOS 2
&gt;&gt;&gt;&gt;219	regex		Author\ -\ 			Author:
# found &quot;David Litton&quot; , &quot;A Pehrsson  &quot;
&gt;&gt;&gt;&gt;&gt;&amp;0	string		x				&quot;%s&quot;
&gt;&gt;&gt;0x16	ubyte		0xF2
# NEC MS-DOS 3.30 Rev. 3 . See http://thestarman.pcministry.com/asm/mbr/DOS33MBR.htm
# assembler instructions: mov di,077c;cmp word ptrl[di],a55a;jnz
&gt;&gt;&gt;&gt;0x22	ubequad	0xbf7c07813d5aa575		\b,NEC 3.3
# version MS-DOS 3.30 til MS-Windows 95A (WinVer=4.00.1111)
&gt;&gt;&gt;&gt;0x22	default	x				\b,D0S version 3.3-7.0
# error messages are printed by assembler instructions: mov si,06nn;...;int 10 (0xBEnn06;...)
# where nn is string offset varying for different languages
# &quot;Invalid partition table&quot;				nn=0x8b for english version
&gt;&gt;&gt;&gt;&gt;(0x49.b)	string		Invalid\ partition\ table		english
&gt;&gt;&gt;&gt;&gt;(0x49.b)	string		Ung\201ltige\ Partitionstabelle		german
&gt;&gt;&gt;&gt;&gt;(0x49.b)	string		Table\ de\ partition\ invalide		french
&gt;&gt;&gt;&gt;&gt;(0x49.b)	string		Tabela\ de\ parti\207ao\ inv\240lida	portuguese
&gt;&gt;&gt;&gt;&gt;(0x49.b)	string		Tabla\ de\ partici\242n\ no\ v\240lida	spanish
&gt;&gt;&gt;&gt;&gt;(0x49.b)	string		Tavola\ delle\ partizioni\ non\ valida	italian
&gt;&gt;&gt;&gt;&gt;0x49	ubyte		&gt;0			at offset 0x%x
&gt;&gt;&gt;&gt;&gt;&gt;(0x49.b)	string		&gt;\0			&quot;%s&quot;
# &quot;Error loading operating system&quot;			nn=0xa3 for english version
# &quot;Fehler beim Laden des Betriebssystems&quot;		nn=0xa7 for german version
# &quot;Erreur en chargeant syst\212me d&#039;exploitation&quot;	nn=0xa7 for french version
# &quot;Erro na inicializa\207ao do sistema operacional&quot;	nn=0xa7 for portuguese Brazilian version
# &quot;Error al cargar sistema operativo&quot;			nn=0xa8 for spanish version
# &quot;Errore durante il caricamento del sistema operativo&quot;	nn=0xae for italian version
&gt;&gt;&gt;&gt;&gt;0x74	ubyte		&gt;0			at offset 0x%x
&gt;&gt;&gt;&gt;&gt;&gt;(0x74.b)	string		&gt;\0			&quot;%s&quot;
# &quot;Missing operating system&quot;				nn=0xc2 for english version
# &quot;Betriebssystem fehlt&quot;				nn=0xcd for german version
# &quot;Syst\212me d&#039;exploitation absent&quot;			nn=0xd2 for french version
# &quot;Sistema operacional nao encontrado&quot;			nn=0xd4 for portuguese Brazilian version
# &quot;Falta sistema operativo&quot;				nn=0xca for spanish version
# &quot;Sistema operativo mancante&quot;				nn=0xe2 for italian version
&gt;&gt;&gt;&gt;&gt;0x79	ubyte		&gt;0			at offset 0x%x
&gt;&gt;&gt;&gt;&gt;&gt;(0x79.b)	string		&gt;\0			&quot;%s&quot;
# Microsoft Windows 95B to XP (http://thestarman.pcministry.com/asm/mbr/95BMEMBR.htm)
# assembler instructions: push ax;pop es;push  ax;pop ds;cld;mov si,7c1b
&gt;&gt;8	ubequad		0x5007501ffcbe1b7c
# assembler instructions: rep;movsb;retf;mov si,07be;mov cl,04
&gt;&gt;&gt;24		ubequad	0xf3a4cbbebe07b104		9M
# &quot;Invalid partition table&quot;				nn=0x10F for english version
# &quot;Ung\201ltige Partitionstabelle&quot;				nn=0x10F for german version
# &quot;Table de partition erron\202e&quot;				nn=0x10F for french version
# &quot;\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240&quot;	nn=0x10F for russian version
&gt;&gt;&gt;&gt;(0x3C.b+0x0FF)	string	Invalid\ partition\ table		english
&gt;&gt;&gt;&gt;(0x3C.b+0x0FF)	string	Ung\201ltige\ Partitionstabelle		german
&gt;&gt;&gt;&gt;(0x3C.b+0x0FF)	string	Table\ de\ partition\ erron\202e	french
&gt;&gt;&gt;&gt;(0x3C.b+0x0FF)	string	\215\245\257\340\240\242\250\253\354\255\240\357\ \342\240\241\253\250\346\240	russian
&gt;&gt;&gt;&gt;0x3C		ubyte	x			at offset 0x%x+0xFF
&gt;&gt;&gt;&gt;(0x3C.b+0x0FF)	string	&gt;\0			&quot;%s&quot;
# &quot;Error loading operating system&quot;			nn=0x127 for english version
# &quot;Fehler beim Laden des Betriebssystems&quot;		nn=0x12b for german version
# &quot;Erreur lors du chargement du syst\212me d&#039;exploitation&quot;	nn=0x12a for french version
# &quot;\216\350\250\241\252\240 \257\340\250 \247\240\243\340\343\247\252\245 \256\257\245\340\240\346\250\256\255\255\256\251 \341\250\341\342\245\254\353&quot;	nn=0x12d for russian version
&gt;&gt;&gt;&gt;0xBD		ubyte	x			at offset 0x1%x
&gt;&gt;&gt;&gt;(0xBD.b+0x100)	string	&gt;\0			&quot;%s&quot;
# &quot;Missing operating system&quot;				nn=0x146 for english version
# &quot;Betriebssystem fehlt&quot;				nn=0x151 for german version
# &quot;Syst\212me d&#039;exploitation manquant&quot;			nn=0x15e for french version
# &quot;\216\257\245\340\240\346\250\256\255\255\240\357 \341\250\341\342\245\254\240 \255\245 \255\240\251\244\245\255\240&quot;	nn=0x156 for russian version
&gt;&gt;&gt;&gt;0xA9		ubyte	x			at offset 0x1%x
&gt;&gt;&gt;&gt;(0xA9.b+0x100)	string	&gt;\0			&quot;%s&quot;
# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
# assembler instructions: rep;movsb;retf;mov BP,07be;mov cl,04
&gt;&gt;&gt;24		ubequad	0xf3a4cbbdbe07b104		XP
# where xxyyzz are lower bits from offsets of error messages varying for different languages
&gt;&gt;&gt;&gt;0x1B4	ubelong&amp;0x00FFFFFF	0x002c4463	english
&gt;&gt;&gt;&gt;0x1B4	ubelong&amp;0x00FFFFFF	0x002c486e	german
# &quot;Invalid partition table&quot;				xx=0x12C for english version
# &quot;Ung\201ltige Partitionstabelle&quot;				xx=0x12C for german version
&gt;&gt;&gt;&gt;0x1b5	ubyte		&gt;0			at offset 0x1%x
&gt;&gt;&gt;&gt;(0x1b5.b+0x100)	string	&gt;\0			&quot;%s&quot;
# &quot;Error loading operating system&quot;			yy=0x144 for english version
# &quot;Fehler beim Laden des Betriebssystems&quot;		yy=0x148 for german version
&gt;&gt;&gt;&gt;0x1b6	ubyte		&gt;0			at offset 0x1%x
&gt;&gt;&gt;&gt;(0x1b6.b+0x100)	string	&gt;\0			&quot;%s&quot;
# &quot;Missing operating system&quot;				zz=0x163 for english version
# &quot;Betriebssystem nicht vorhanden&quot;			zz=0x16e for german version
&gt;&gt;&gt;&gt;0x1b7	ubyte		&gt;0			at offset 0x1%x
&gt;&gt;&gt;&gt;(0x1b7.b+0x100)	string	&gt;\0			&quot;%s&quot;
# Microsoft Windows Vista or 7
# assembler instructions: ..;mov ds,ax;mov si,7c00;mov di,..00
&gt;&gt;8	ubequad		0xc08ed8be007cbf00
# Microsoft Windows Vista (http://thestarman.pcministry.com/asm/mbr/VistaMBR.htm)
# assembler instructions: jnz 0729;cmp ebx,&quot;TCPA&quot;
&gt;&gt;&gt;0xEC		ubequad	0x753b6681fb544350		Vista
# where xxyyzz are lower bits from offsets of error messages varying for different languages
&gt;&gt;&gt;&gt;0x1B4	ubelong&amp;0x00FFFFFF	0x00627a99	english
#&gt;&gt;&gt;&gt;0x1B4	ubelong&amp;0x00FFFFFF	?		german
# &quot;Invalid partition table&quot;				xx=0x162 for english version
# &quot;Ung\201ltige Partitionstabelle&quot;				xx=0x1?? for german version
&gt;&gt;&gt;&gt;0x1b5	ubyte		&gt;0			at offset 0x1%x
&gt;&gt;&gt;&gt;(0x1b5.b+0x100)	string	&gt;\0			&quot;%s&quot;
# &quot;Error loading operating system&quot;			yy=0x17a for english version
# &quot;Fehler beim Laden des Betriebssystems&quot;		yy= 0x1?? for german version
&gt;&gt;&gt;&gt;0x1b6	ubyte		&gt;0			at offset 0x1%x
&gt;&gt;&gt;&gt;(0x1b6.b+0x100)	string	&gt;\0			&quot;%s&quot;
# &quot;Missing operating system&quot;				zz=0x199 for english version
# &quot;Betriebssystem nicht vorhanden&quot;			zz=0x1?? for german version
&gt;&gt;&gt;&gt;0x1b7	ubyte		&gt;0			at offset 0x1%x
&gt;&gt;&gt;&gt;(0x1b7.b+0x100)	string	&gt;\0			&quot;%s&quot;
# Microsoft Windows 7 (http://thestarman.pcministry.com/asm/mbr/W7MBR.htm)
# assembler instructions: cmp ebx,&quot;TCPA&quot;;cmp
&gt;&gt;&gt;0xEC		ubequad	0x6681fb5443504175		Windows 7
# where xxyyzz are lower bits from offsets of error messages varying for different languages
&gt;&gt;&gt;&gt;0x1B4	ubelong&amp;0x00FFFFFF	0x00637b9a	english
#&gt;&gt;&gt;&gt;0x1B4	ubelong&amp;0x00FFFFFF	?		german
# &quot;Invalid partition table&quot;				xx=0x163 for english version
# &quot;Ung\201ltige Partitionstabelle&quot;				xx=0x1?? for german version
&gt;&gt;&gt;&gt;0x1b5	ubyte		&gt;0			at offset 0x1%x
&gt;&gt;&gt;&gt;(0x1b5.b+0x100)	string	&gt;\0			&quot;%s&quot;
# &quot;Error loading operating system&quot;			yy=0x17b for english version
# &quot;Fehler beim Laden des Betriebssystems&quot;		yy=0x1?? for german version
&gt;&gt;&gt;&gt;0x1b6	ubyte		&gt;0			at offset 0x1%x
&gt;&gt;&gt;&gt;(0x1b6.b+0x100)	string	&gt;\0			&quot;%s&quot;
# &quot;Missing operating system&quot;				zz=0x19a for english version
# &quot;Betriebssystem nicht vorhanden&quot;			zz=0x1?? for german version
&gt;&gt;&gt;&gt;0x1b7	ubyte		&gt;0			at offset 0x1%x
&gt;&gt;&gt;&gt;(0x1b7.b+0x100)	string	&gt;\0			&quot;%s&quot;
# http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DiskSigs
# http://en.wikipedia.org/wiki/MBR_disk_signature#ID
&gt;&gt;0x1b8	ulelong		&gt;0				\b, disk signature 0x%-.4x
# driveID/timestamp for Win 95B,98,98SE and ME. See http://thestarman.pcministry.com/asm/mbr/mystery.htm
&gt;&gt;0xDA	uleshort		0
&gt;&gt;&gt;0xDC 	ulelong		&gt;0			\b, created
# physical drive number (0x80-0xFF) when the Windows wrote that byte to the drive
&gt;&gt;&gt;&gt;0xDC	ubyte		x			with driveID 0x%x
# hours, minutes and seconds
&gt;&gt;&gt;&gt;0xDf	ubyte		x			at %x
&gt;&gt;&gt;&gt;0xDe	ubyte		x			\b:%x
&gt;&gt;&gt;&gt;0xDd	ubyte		x			\b:%x
# special case for Microsoft MS-DOS 3.21 spanish
# assembler instructions: cli;mov $0x30,%ax;mov %ax,%ss;mov
&gt;0	ubequad		0xfab830008ed0bc00
# assembler instructions: $0x1f00,%sp;mov $0x80cb,%di;add %cl,(%bx,%si);in (%dx),%ax;mov
&gt;&gt;8	ubequad		0x1fbfcb800008ed8		MS-MBR,D0S version 3.21 spanish
# Microsoft MBR IPL end

# dr-dos with some upper-, lowercase variants
&gt;0x9D	string	Invalid\ partition\ table$
&gt;&gt;181	string	No\ Operating\ System$
&gt;&gt;&gt;201	string	Operating\ System\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
&gt;0x9D	string	Invalid\ partition\ table$
&gt;&gt;181	string	No\ operating\ system$
&gt;&gt;&gt;201	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
&gt;342	string	Invalid\ partition\ table$
&gt;&gt;366	string	No\ operating\ system$
&gt;&gt;&gt;386	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, version 7.01 to 7.03
&gt;295	string	NEWLDR\0
&gt;&gt;302	string	Bad\ PT\ $
&gt;&gt;&gt;310	string	No\ OS\ $
&gt;&gt;&gt;&gt;317	string	OS\ load\ err$
&gt;&gt;&gt;&gt;&gt;329	string	Moved\ or\ missing\ IBMBIO.LDR\n\r
&gt;&gt;&gt;&gt;&gt;&gt;358	string	Press\ any\ key\ to\ continue.\n\r$
&gt;&gt;&gt;&gt;&gt;&gt;&gt;387	string	Copyright\ (c)\ 1984,1998
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
#
# tests for different MS-DOS Master Boot Records (MBR) moved and merged
#
#&gt;0x145	string	Default:\ F				\b, FREE-DOS MBR
#&gt;0x14B	string	Default:\ F				\b, FREE-DOS 1.0 MBR
&gt;0x145	search/7	Default:\ F			\b, FREE-DOS MBR
#&gt;&gt;313		string	F0\ .\ .\ .
#&gt;&gt;&gt;322		string	disk\ 1
#&gt;&gt;&gt;&gt;382	string	FAT3
&gt;64	string	no\ active\ partition\ found
&gt;&gt;96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta 0.9 MBR
# Ranish Partition Manager http://www.ranish.com/part/
&gt;387	search/4	\0\ Error!\r
&gt;&gt;378	search/7	Virus!
&gt;&gt;&gt;397	search/4	Booting\040
&gt;&gt;&gt;&gt;408	search/4	HD1/\0	 			\b, Ranish MBR (
&gt;&gt;&gt;&gt;&gt;416	string	Writing\ changes...		\b2.37
&gt;&gt;&gt;&gt;&gt;&gt;438	ubyte		x			\b,0x%x dots
&gt;&gt;&gt;&gt;&gt;&gt;440	ubyte		&gt;0			\b,virus check
&gt;&gt;&gt;&gt;&gt;&gt;441	ubyte		&gt;0			\b,partition %c
#2.38,2.42,2.44
&gt;&gt;&gt;&gt;&gt;416	string	!Writing\ changes...		\b
&gt;&gt;&gt;&gt;&gt;&gt;418	ubyte	1				\bvirus check,
&gt;&gt;&gt;&gt;&gt;&gt;419	ubyte	x				\b0x%x seconds
&gt;&gt;&gt;&gt;&gt;&gt;420	ubyte&amp;0x0F	&gt;0			\b,partition
&gt;&gt;&gt;&gt;&gt;&gt;&gt;420	ubyte&amp;0x0F	&lt;5			\b %x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;420	ubyte&amp;0x0F	0Xf			\b ask
&gt;&gt;&gt;&gt;&gt;420	ubyte		x			\b)
#
# SYSLINUX MBR moved
# http://www.acronis.de/
&gt;362	string	MBR\ Error\ \0\r
&gt;&gt;376	string	ress\ any\ key\ to\040
&gt;&gt;&gt;392	string	boot\ from\ floppy...\0			\b, Acronis MBR
# added by Joerg Jenderek
# http://www.visopsys.org/
# http://partitionlogic.org.uk/
&gt;309	string	No\ bootable\ partition\ found\r
&gt;&gt;339	string	I/O\ Error\ reading\ boot\ sector\r	\b, Visopsys MBR
&gt;349	string	No\ bootable\ partition\ found\r
&gt;&gt;379	string	I/O\ Error\ reading\ boot\ sector\r	\b, simple Visopsys MBR
# bootloader, bootmanager
&gt;0x40	string	SBML
# label with 11 characters of FAT 12 bit filesystem
&gt;&gt;43	string	SMART\ BTMGR
&gt;&gt;&gt;430	string	SBMK\ Bad!\r			\b, Smart Boot Manager
# OEM-ID not always &quot;SBM&quot;
#&gt;&gt;&gt;&gt;3	strings	SBM
&gt;&gt;&gt;&gt;6	string	&gt;\0                             \b, version %s
&gt;382	string	XOSLLOADXCF			\b, eXtended Operating System Loader
&gt;6	string	LILO				\b, LInux i386 boot LOader
&gt;&gt;120	string	LILO				\b, version 22.3.4 SuSe
&gt;&gt;172	string	LILO				\b, version 22.5.8 Debian
# updated by Joerg Jenderek at Oct 2008
# variables according to grub-0.97/stage1/stage1.S or
# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# usual values are marked with comments to get only informations of strange GRUB loaders
&gt;342		search/60	\0Geom\0
#&gt;0		ulelong		x		%x=0x009048EB ,	0x2a9048EB  0
&gt;&gt;0x41		ubyte		&lt;2
&gt;&gt;&gt;0x3E		ubyte		&gt;2		\b; GRand Unified Bootloader
# 0x3 for 0.5.95,0.93,0.94,0.96 0x4 for 1.90
&gt;&gt;&gt;&gt;0x3E	ubyte		x		\b, stage1 version 0x%x
#If it is 0xFF, use a drive passed by BIOS
&gt;&gt;&gt;&gt;0x40	ubyte		&lt;0xFF		\b, boot drive 0x%x
# in most case 0,1,0x2e for GRUB 0.5.95
&gt;&gt;&gt;&gt;0x41	ubyte		&gt;0		\b, LBA flag 0x%x
&gt;&gt;&gt;&gt;0x42	uleshort	&lt;0x8000		\b, stage2 address 0x%x
#&gt;&gt;&gt;&gt;0x42	uleshort	=0x8000		\b, stage2 address 0x%x (usual)
&gt;&gt;&gt;&gt;0x42	uleshort	&gt;0x8000		\b, stage2 address 0x%x
#&gt;&gt;&gt;&gt;0x44	ulelong		=1		\b, 1st sector stage2 0x%x (default)
&gt;&gt;&gt;&gt;0x44	ulelong		&gt;1		\b, 1st sector stage2 0x%x
&gt;&gt;&gt;&gt;0x48	uleshort	&lt;0x800		\b, stage2 segment 0x%x
#&gt;&gt;&gt;&gt;0x48	uleshort	=0x800		\b, stage2 segment 0x%x (usual)
&gt;&gt;&gt;&gt;0x48	uleshort	&gt;0x800		\b, stage2 segment 0x%x
&gt;&gt;&gt;&gt;402		string	Geom\0Hard\ Disk\0Read\0\ Error\0
&gt;&gt;&gt;&gt;&gt;394	string	stage1			\b, GRUB version 0.5.95
&gt;&gt;&gt;&gt;382		string	Geom\0Hard\ Disk\0Read\0\ Error\0
&gt;&gt;&gt;&gt;&gt;376	string	GRUB\ \0		\b, GRUB version 0.93 or 1.94
&gt;&gt;&gt;&gt;383		string	Geom\0Hard\ Disk\0Read\0\ Error\0
&gt;&gt;&gt;&gt;&gt;377	string	GRUB\ \0		\b, GRUB version 0.94
&gt;&gt;&gt;&gt;385		string	Geom\0Hard\ Disk\0Read\0\ Error\0
&gt;&gt;&gt;&gt;&gt;379	string	GRUB\ \0		\b, GRUB version 0.95 or 0.96
&gt;&gt;&gt;&gt;391		string	Geom\0Hard\ Disk\0Read\0\ Error\0
&gt;&gt;&gt;&gt;&gt;385	string	GRUB\ \0		\b, GRUB version 0.97
# unknown version
&gt;&gt;&gt;343		string	Geom\0Read\0\ Error\0
&gt;&gt;&gt;&gt;321		string	Loading\ stage1.5	\b, GRUB version x.y
&gt;&gt;&gt;380		string	Geom\0Hard\ Disk\0Read\0\ Error\0
&gt;&gt;&gt;&gt;374		string	GRUB\ \0		\b, GRUB version n.m
# SYSLINUX bootloader moved
&gt;395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
# http://www.bcdwb.de/bcdw/index_e.htm
&gt;3	string	BCDL
&gt;&gt;498	string	BCDL\ \ \ \ BIN			\b, Bootable CD Loader (1.50Z)
# mbr partition table entries updated by Joerg Jenderek at Sep 2013
# skip Norton Utilities disc image data
&gt;3		string		!IHISK
# skip Linux style boot sector starting with assember instructions mov 0x7c0,ax;
&gt;&gt;0		belong		!0xb8c0078e
# not Linux kernel
&gt;&gt;&gt;514		string		!HdrS
# not BeOS
&gt;&gt;&gt;&gt;422		string		!Be\ Boot\ Loader
# jump over BPB instruction implies DOS bootsector or AdvanceMAME mbr
&gt;&gt;&gt;&gt;&gt;0		ubelong&amp;0xFD000000	=0xE9000000
# AdvanceMAME mbr
&gt;&gt;&gt;&gt;&gt;&gt;(1.b+2)	ubequad		0xfa31c08ed88ec08e
&gt;&gt;&gt;&gt;&gt;&gt;&gt;446	use		partition-table
# mbr, Norton Utilities disc image data, or 2nd,etc. sector of x86 bootloader
&gt;&gt;&gt;&gt;&gt;0		ubelong&amp;0xFD000000	!0xE9000000
# skip FSInfosector
&gt;&gt;&gt;&gt;&gt;&gt;0		string		!RRaA
# skip 3rd sector of MS x86 bootloader with assember instructions cli;MOVZX EAX,BYTE PTR [BP+10];MOV ECX,
# http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	ubequad		!0xfa660fb64610668b
# skip 13rd sector of MS x86 bootloader
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	ubequad		!0x660fb64610668b4e
# skip sector starting with DOS new line
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	string		!\r\n
# allowed active flag 0,80h-FFh
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;446	ubyte		0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;446	use		partition-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;446	ubyte		&gt;0x7F
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;446	use		partition-table
# TODO: test for extended bootrecord (ebr) moved and merged with mbr partition table entries
# mbr partition table entries end
# http://www.acronis.de/
#FAT label=ACRONIS\ SZ
#OEM-ID=BOOTWIZ0
&gt;442	string	Non-system\ disk,\040
&gt;&gt;459	string	press\ any\ key...\x7\0		\b, Acronis Startup Recovery Loader
# updated by Joerg Jenderek at Nov 2012, Sep 2013
# DOS names like F11.SYS or BOOTWIZ.SYS are 8 right space padded bytes+3 bytes
# display 1 space
&gt;&gt;&gt;447	ubyte	x		\b
&gt;&gt;&gt;477	use	DOS-filename
#
&gt;185	string	FDBOOT\ Version\040
&gt;&gt;204	string	\rNo\ Systemdisk.\040
&gt;&gt;&gt;220	string	Booting\ from\ harddisk.\n\r
&gt;&gt;&gt;245	string	Cannot\ load\ from\ harddisk.\n\r
&gt;&gt;&gt;&gt;273 string	Insert\ Systemdisk\040
&gt;&gt;&gt;&gt;&gt;291 string and\ press\ any\ key.\n\r		\b, FDBOOT harddisk Bootloader
&gt;&gt;&gt;&gt;&gt;&gt;200 string	&gt;\0                             \b, version %-3s
&gt;242	string	Bootsector\ from\ C.H.\ Hochst\204
# http://freecode.com/projects/dosfstools	dosfstools-n.m/src/mkdosfs.c
# updated by Joerg Jenderek at Nov 2012. Use search directive with offset instead of string
# skip name &quot;C.H. Hochstaetter&quot; partly because it is sometimes written without umlaut
&gt;242	search/127	Bootsector\ from\ C.H.\ Hochst
&gt;&gt;278	search/127	No\ Systemdisk.\ Booting\ from\ harddisk
# followed by variants with point,CR-NL or NL-CR
&gt;&gt;&gt;208	search/261	Cannot\ load\ from\ harddisk.
# followed by variants CR-NL or NL-CR
&gt;&gt;&gt;&gt;236	search/235	Insert\ Systemdisk\ and\ press\ any\ key.
# followed by variants with point,CR-NL or NL-CR
&gt;&gt;&gt;&gt;&gt;180	search/96	Disk\ formatted\ with\ WinImage\ 	\b, WinImage harddisk Bootloader
# followed by string like &quot;6.50 (c) 1993-2004 Gilles Vollant&quot;
&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	string		x 					\b, version %-4.4s
&gt;(1.b+2)	ubyte		0xe
&gt;&gt;(1.b+3)	ubyte		0x1f
&gt;&gt;&gt;(1.b+4)	ubyte		0xbe
# message offset found at (1.b+5) is 0x77 for FAT32 or 0x5b for others
&gt;&gt;&gt;&gt;(1.b+5)	ubyte&amp;0xd3	0x53
&gt;&gt;&gt;&gt;&gt;(1.b+6)	ubyte		0x7c
# assembler instructions: lodsb;and al,al;jz 0xb;push si;mov ah,
&gt;&gt;&gt;&gt;&gt;&gt;(1.b+7)	ubyte		0xac
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(1.b+8)	ubyte		0x22
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(1.b+9)	ubyte		0xc0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(1.b+10)	ubyte	0x74
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(1.b+11)	ubyte	0x0b
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(1.b+12)	ubyte	0x56
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
# FAT1X version
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(1.b+5)	ubyte	0x5b
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x5b	string	&gt;\0			&quot;%-s&quot;
# FAT32 version
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(1.b+5)	ubyte	0x77
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x77	string	&gt;\0			&quot;%-s&quot;
&gt;214	string	Please\ try\ to\ install\ FreeDOS\ 	\b, DOS Emulator boot message display
#&gt;&gt;244	string	from\ dosemu-freedos-*-bin.tgz\r
#&gt;&gt;&gt;170	string	Sorry,\ could\ not\ load\ an\040
#&gt;&gt;&gt;&gt;195	string	operating\ system.\r\n
#
&gt;103	string	This\ is\ not\ a\ bootable\ disk.\040
&gt;&gt;132	string	Please\ insert\ a\ bootable\040
&gt;&gt;&gt;157	string	floppy\ and\r\n
&gt;&gt;&gt;&gt;169	string	press\ any\ key\ to\ try\ again...\r	\b, FREE-DOS message display
#
&gt;66	string	Solaris\ Boot\ Sector
&gt;&gt;99	string	Incomplete\ MDBoot\ load.
&gt;&gt;&gt;89	string	Version 				\b, Sun Solaris Bootloader
&gt;&gt;&gt;&gt;97	byte	x					version %c
#
&gt;408	string	OS/2\ !!\ SYS01475\r\0
&gt;&gt;429	string	OS/2\ !!\ SYS02025\r\0
&gt;&gt;&gt;450	string	OS/2\ !!\ SYS02027\r\0
&gt;&gt;&gt;469	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp bootloader
#
&gt;409	string	OS/2\ !!\ SYS01475\r\0
&gt;&gt;430	string	OS/2\ !!\ SYS02025\r\0
&gt;&gt;&gt;451	string	OS/2\ !!\ SYS02027\r\0
&gt;&gt;&gt;470	string	OS2BOOT\ \ \ \ 				\b, IBM OS/2 Warp Bootloader
&gt;112		string	This\ disk\ is\ not\ bootable\r
&gt;&gt;142		string	If\ you\ wish\ to\ make\ it\ bootable
&gt;&gt;&gt;176		string	run\ the\ DOS\ program\ SYS\040
&gt;&gt;&gt;200		string	after\ the\r
&gt;&gt;&gt;&gt;216		string	system\ has\ been\ loaded\r\n
&gt;&gt;&gt;&gt;&gt;242	string	Please\ insert\ a\ DOS\ diskette\040
&gt;&gt;&gt;&gt;&gt;271	string	into\r\n\ the\ drive\ and\040
&gt;&gt;&gt;&gt;&gt;&gt;292	string	strike\ any\ key...\0		\b, IBM OS/2 Warp message display
# XP
&gt;430	string	NTLDR\ is\ missing\xFF\r\n
&gt;&gt;449	string	Disk\ error\xFF\r\n
&gt;&gt;&gt;462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
# DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
&gt;&gt;&gt;&gt;417		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;417	string		x			%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;422	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;422	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;425	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;425	string		&gt;\ 			\b.%-.3s
#
&gt;&gt;&gt;&gt;371		ubyte		&gt;0x20
&gt;&gt;&gt;&gt;&gt;368	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;368	string		x 			%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;373	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;373	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;&gt;376	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;376	string		x 			\b.%-.3s
#
&gt;430	string	NTLDR\ nicht\ gefunden\xFF\r\n
&gt;&gt;453	string	Datentr\204gerfehler\xFF\r\n
&gt;&gt;&gt;473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
&gt;&gt;&gt;&gt;417		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;417	string		x			%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;422	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;422	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;425	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;425	string		&gt;\ 			\b.%-.3s
# offset variant
&gt;&gt;&gt;&gt;379	string	\0
&gt;&gt;&gt;&gt;&gt;368	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;368	string		x 			%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;373	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;373	string		x 			\b%-.3s
#
&gt;430	string	NTLDR\ fehlt\xFF\r\n
&gt;&gt;444	string	Datentr\204gerfehler\xFF\r\n
&gt;&gt;&gt;464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
&gt;&gt;&gt;&gt;417		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;417	string		x			%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;422	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;422	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;425	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;425	string		&gt;\ 			\b.%-.3s
# variant
&gt;&gt;&gt;&gt;371		ubyte		&gt;0x20
&gt;&gt;&gt;&gt;&gt;368	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;368	string		x 			%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;373	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;373	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;&gt;376	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;376	string		x 			\b.%-.3s
#
&gt;430	string	NTLDR\ fehlt\xFF\r\n
&gt;&gt;444	string	Medienfehler\xFF\r\n
&gt;&gt;&gt;459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
&gt;&gt;&gt;&gt;371		ubyte		&gt;0x20
&gt;&gt;&gt;&gt;&gt;368	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;368	string		x 			%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;373	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;373	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;&gt;376	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;376	string		x 			\b.%-.3s
# variant
&gt;&gt;&gt;&gt;417		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;417	string		x			%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;422	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;422	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;425	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;425	string		&gt;\ 			\b.%-.3s
#
&gt;430	string	Datentr\204ger\ entfernen\xFF\r\n
&gt;&gt;454	string	Medienfehler\xFF\r\n
&gt;&gt;&gt;469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
&gt;&gt;&gt;&gt;379		string		\0
&gt;&gt;&gt;&gt;&gt;368	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;368	string		x 			%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;373	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;373	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;&gt;376	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;376	string		x 			\b.%-.3s
# variant
&gt;&gt;&gt;&gt;417		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;417	string		x			%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;422	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;422	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;425	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;425	string		&gt;\ 			\b.%-.3s
#

#&gt;3	string	NTFS\ \ \ \040
&gt;389	string	Fehler\ beim\ Lesen\040
&gt;&gt;407	string	des\ Datentr\204gers
&gt;&gt;&gt;426	string	NTLDR\ fehlt
&gt;&gt;&gt;&gt;440	string	NTLDR\ ist\ komprimiert
&gt;&gt;&gt;&gt;&gt;464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
#&gt;3	string	NTFS\ \ \ \040
&gt;313	string	A\ disk\ read\ error\ occurred.\r
&gt;&gt;345	string	A\ kernel\ file\ is\ missing\040
&gt;&gt;&gt;370	string	from\ the\ disk.\r
&gt;&gt;&gt;&gt;484	string	NTLDR\ is\ compressed
&gt;&gt;&gt;&gt;&gt;429 string	Insert\ a\ system\ diskette\040
&gt;&gt;&gt;&gt;&gt;&gt;454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
# DOS loader variants different languages,offsets
&gt;472	ubyte&amp;0xDF	&gt;0
&gt;&gt;389	string	Invalid\ system\ disk\xFF\r\n
&gt;&gt;&gt;411	string	Disk\ I/O\ error
&gt;&gt;&gt;&gt;428	string	Replace\ the\ disk,\ and\040
&gt;&gt;&gt;&gt;&gt;455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
#IO.SYS
&gt;&gt;&gt;&gt;&gt;&gt;472	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;472	string		x 			\b %-.2s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;474	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;474	string		x 			\b%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;479	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;479 string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;480	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;480	string		x 			\b.%-.3s
#MSDOS.SYS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;483	ubyte&amp;0xDF	&gt;0			\b+
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;483	string		x 			\b%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;488	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;488	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;491	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;491	string		x 			\b.%-.3s
#
&gt;&gt;390	string	Invalid\ system\ disk\xFF\r\n
&gt;&gt;&gt;412	string	Disk\ I/O\ error\xFF\r\n
&gt;&gt;&gt;&gt;429	string	Replace\ the\ disk,\ and\040
&gt;&gt;&gt;&gt;&gt;451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
&gt;&gt;388	string	Ungueltiges\ System\ \xFF\r\n
&gt;&gt;&gt;410	string	E/A-Fehler\ \ \ \ \xFF\r\n
&gt;&gt;&gt;&gt;427	string	Datentraeger\ wechseln\ und\040
&gt;&gt;&gt;&gt;&gt;453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
#WINBOOT.SYS only not spaces (0xDF)
&gt;&gt;&gt;&gt;&gt;&gt;497	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;497	string		x 			%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;502	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;502	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;503	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;503	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;504 string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;505	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;505	string		x 			\b.%-.3s
#IO.SYS
&gt;&gt;&gt;&gt;&gt;&gt;472	ubyte&amp;0xDF	&gt;0			or
&gt;&gt;&gt;&gt;&gt;&gt;&gt;472	string		x 			\b %-.2s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;474	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;474	string		x 			\b%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;479	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;479 string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;480	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;480	string		x 			\b.%-.3s
#MSDOS.SYS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;483	ubyte&amp;0xDF	&gt;0			\b+
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;483	string		x 			\b%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;488	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;488	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;491	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;491	string		x 			\b.%-.3s
#
&gt;&gt;390	string	Ungueltiges\ System\ \xFF\r\n
&gt;&gt;&gt;412	string	E/A-Fehler\ \ \ \ \xFF\r\n
&gt;&gt;&gt;&gt;429	string	Datentraeger\ wechseln\ und\040
&gt;&gt;&gt;&gt;&gt;455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
#WINBOOT.SYS only not spaces (0xDF)
&gt;&gt;&gt;&gt;&gt;&gt;497	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;497	string		x 			%-.7s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;505	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;505	string		x 			\b.%-.3s
#IO.SYS
&gt;&gt;&gt;&gt;&gt;&gt;472	ubyte&amp;0xDF	&gt;0			or
&gt;&gt;&gt;&gt;&gt;&gt;&gt;472	string		x 			\b %-.2s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;474	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;474	string		x 			\b%-.6s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;480	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;480	string		x 			\b.%-.3s
#MSDOS.SYS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;483	ubyte&amp;0xDF	&gt;0			\b+
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;483	string		x 			\b%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;488	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;488	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;491	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;491	string		x 			\b.%-.3s
#
&gt;&gt;389	string	Ungueltiges\ System\ \xFF\r\n
&gt;&gt;&gt;411	string	E/A-Fehler\ \ \ \ \xFF\r\n
&gt;&gt;&gt;&gt;428	string	Datentraeger\ wechseln\ und\040
&gt;&gt;&gt;&gt;&gt;454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
# DOS names like IO.SYS,WINBOOT.SYS,MSDOS.SYS,WINBOOT.INI are 8 right space padded bytes+3 bytes
&gt;&gt;&gt;&gt;&gt;&gt;472	string		x 			%-.2s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;474	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;474	string		x 			\b%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;479	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;479	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;480	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;480	string		x 			\b.%-.3s
&gt;&gt;&gt;&gt;&gt;&gt;483	ubyte&amp;0xDF	&gt;0			\b+
&gt;&gt;&gt;&gt;&gt;&gt;&gt;483	string		x 			\b%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;488	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;488	string		x 			\b%-.2s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;490	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;490	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;491	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;491	string		x 			\b.%-.3s
&gt;479	ubyte&amp;0xDF	&gt;0
&gt;&gt;416	string	Kein\ System\ oder\040
&gt;&gt;&gt;433	string	Laufwerksfehler
&gt;&gt;&gt;&gt;450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
#IO.SYS
&gt;&gt;&gt;&gt;&gt;479	string		x 			\b %-.2s
&gt;&gt;&gt;&gt;&gt;&gt;481	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;481	string		x 			\b%-.6s
&gt;&gt;&gt;&gt;&gt;487	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;487	string		x 			\b.%-.3s
#MSDOS.SYS
&gt;&gt;&gt;&gt;&gt;&gt;490	ubyte&amp;0xDF	&gt;0			\b+
&gt;&gt;&gt;&gt;&gt;&gt;&gt;490	string		x 			\b%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;495	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;495	string		x 			\b%-.3s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;498	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;498	string		x 			\b.%-.3s
#
&gt;376	search/41	Non-System\ disk\ or\040
&gt;&gt;395	search/41	disk\ error\r
&gt;&gt;&gt;407	search/41	Replace\ and\040
&gt;&gt;&gt;&gt;419	search/41	press\ 				\b,
&gt;&gt;&gt;&gt;419	search/41	strike\ 			\b, old
&gt;&gt;&gt;&gt;426	search/41	any\ key\ when\ ready\r		MS or PC-DOS bootloader
#449			Disk\ Boot\ failure\r		MS 3.21
#466			Boot\ Failure\r			MS 3.30
&gt;&gt;&gt;&gt;&gt;468 search/18	\0
#IO.SYS,IBMBIO.COM
&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	string		x 			\b %-.2s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-20	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-1	string		x 			\b%-.4s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-16	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-1	string		x 			\b%-.2s
&gt;&gt;&gt;&gt;&gt;&gt;&amp;8	ubyte&amp;0xDF	&gt;0			\b.
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-1	string		x 			\b%-.3s
#MSDOS.SYS,IBMDOS.COM
&gt;&gt;&gt;&gt;&gt;&gt;&amp;11	ubyte&amp;0xDF	&gt;0			\b+
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-1	string		x 			\b%-.5s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-6	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-1	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-5	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-1	string		x 			\b%-.2s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;7	ubyte&amp;0xDF	&gt;0			\b.
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-1	string		x 			\b%-.3s
&gt;441	string	Cannot\ load\ from\ harddisk.\n\r
&gt;&gt;469	string	Insert\ Systemdisk\040
&gt;&gt;&gt;487	string	and\ press\ any\ key.\n\r		\b, MS (2.11) DOS bootloader
#&gt;43	string	\224R-LOADER\ \ SYS			=label
&gt;54	string	SYS
&gt;&gt;324	string	VASKK
&gt;&gt;&gt;495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
#
&gt;98	string	Press\ a\ key\ to\ retry\0\r
&gt;&gt;120	string	Cannot\ find\ file\ \0\r
&gt;&gt;&gt;139	string	Disk\ read\ error\0\r
&gt;&gt;&gt;&gt;156	string	Loading\ ...\0				\b, DR-DOS (3.41) Bootloader
#DRBIOS.SYS
&gt;&gt;&gt;&gt;&gt;44		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;44	string		x			\b %-.6s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;50	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;50	string		x 			\b%-.2s
&gt;&gt;&gt;&gt;&gt;&gt;52	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;52	string		x 			\b.%-.3s
#
&gt;70	string	IBMBIO\ \ COM
&gt;&gt;472	string	Cannot\ load\ DOS!\040
&gt;&gt;&gt;489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
&gt;&gt;471	string	Cannot\ load\ DOS\040
&gt;&gt;487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
#??
&gt;444	string	KERNEL\ \ SYS
&gt;&gt;314	string	BOOT\ error!				\b, FREE-DOS Bootloader
&gt;499	string	KERNEL\ \ SYS
&gt;&gt;305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
&gt;449	string	KERNEL\ \ SYS
&gt;&gt;319	string	BOOT\ error!				\b, FREE-DOS 0.5 Bootloader
#
&gt;449	string	Loading\ FreeDOS
&gt;&gt;0x1AF		ulelong		&gt;0			\b, FREE-DOS 0.95,1.0 Bootloader
&gt;&gt;&gt;497		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;497		string		x 			\b %-.6s
&gt;&gt;&gt;&gt;&gt;503	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;503	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;505		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;505	string		x 			\b.%-.3s
#
&gt;331	string	Error!.0				\b, FREE-DOS 1.0 bootloader
#
&gt;125	string	Loading\ FreeDOS...\r
&gt;&gt;311	string	BOOT\ error!\r				\b, FREE-DOS bootloader
&gt;&gt;&gt;441		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;441		string		x 			\b %-.6s
&gt;&gt;&gt;&gt;&gt;447	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;447	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;448	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;448	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;449		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;449	string		x 			\b.%-.3s
&gt;124	string	FreeDOS\0
&gt;&gt;331	string	\ err\0					\b, FREE-DOS BETa 0.9 Bootloader
# DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
&gt;&gt;&gt;497		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;497		string		x 			\b %-.6s
&gt;&gt;&gt;&gt;&gt;503	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;503	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;505		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;505	string		x 			\b.%-.3s
&gt;&gt;333	string	\ err\0					\b, FREE-DOS BEta 0.9 Bootloader
&gt;&gt;&gt;497		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;497		string		x 			\b %-.6s
&gt;&gt;&gt;&gt;&gt;503	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;503	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;505		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;505	string		x 			\b.%-.3s
&gt;&gt;334	string	\ err\0					\b, FREE-DOS Beta 0.9 Bootloader
&gt;&gt;&gt;497		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;497		string		x 			\b %-.6s
&gt;&gt;&gt;&gt;&gt;503	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;503	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;505		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;505	string		x 			\b.%-.3s
&gt;336	string	Error!\040
&gt;&gt;343	string	Hit\ a\ key\ to\ reboot.		\b, FREE-DOS Beta 0.9sr1 Bootloader
&gt;&gt;&gt;497		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;497		string		x 			\b %-.6s
&gt;&gt;&gt;&gt;&gt;503	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;503	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;504	string		x 			\b%-.1s
&gt;&gt;&gt;&gt;505		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;505	string		x 			\b.%-.3s
# added by Joerg Jenderek
# http://www.visopsys.org/
# http://partitionlogic.org.uk/
# OEM-ID=Visopsys
&gt;478		ulelong	0
&gt;&gt;(1.b+326)	string	I/O\ Error\ reading\040
&gt;&gt;&gt;(1.b+344)	string	Visopsys\ loader\r
&gt;&gt;&gt;&gt;(1.b+361)	string	Press\ any\ key\ to\ continue.\r	\b, Visopsys loader
# http://alexfru.chat.ru/epm.html#bootprog
&gt;494	ubyte	&gt;0x4D
&gt;&gt;495	string	&gt;E
&gt;&gt;&gt;495	string	&lt;S
#OEM-ID is not reliable
&gt;&gt;&gt;&gt;3	string	BootProg
# It just looks for a program file name at the root directory
# and loads corresponding file with following execution.
# DOS names like STARTUP.BIN,STARTUPC.COM,STARTUPE.EXE are 8 right space padded bytes+3 bytes
&gt;&gt;&gt;&gt;499			ubyte&amp;0xDF	&gt;0		\b, COM/EXE Bootloader
&gt;&gt;&gt;&gt;&gt;499		use		DOS-filename
#If the boot sector fails to read any other sector,
#it prints a very short message (&quot;RE&quot;) to the screen and hangs the computer.
#If the boot sector fails to find needed program in the root directory,
#it also hangs with another message (&quot;NF&quot;).
&gt;&gt;&gt;&gt;&gt;492		string		RENF		\b, FAT (12 bit)
&gt;&gt;&gt;&gt;&gt;495		string		RENF		\b, FAT (16 bit)
#If the boot sector fails to read any other sector,
#it prints a very short message (&quot;RE&quot;) to the screen and hangs the computer.
# x86 bootloader end

# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
# and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector
&gt;0		string		RRaA
&gt;&gt;0x1E4		string		rrAa		\b, FSInfosector
#&gt;&gt;0x1FC	uleshort	=0		SHOULD BE ZERO
&gt;&gt;&gt;0x1E8	ulelong		&lt;0xffffffff	\b, %u free clusters
&gt;&gt;&gt;0x1EC	ulelong		&lt;0xffffffff	\b, last allocated cluster %u

# updated by Joerg Jenderek at Sep 2007
&gt;3	ubyte	0
#no active flag
&gt;&gt;446	ubyte	0
# partition 1 not empty
&gt;&gt;&gt;450	ubyte	&gt;0
# partitions 3,4 empty
&gt;&gt;&gt;&gt;482		ubyte	0
&gt;&gt;&gt;&gt;&gt;498	ubyte	0
# partition 2 ID=0,5,15
&gt;&gt;&gt;&gt;&gt;&gt;466	ubyte	&lt;0x10
&gt;&gt;&gt;&gt;&gt;&gt;&gt;466	ubyte	0x05			\b, extended partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;466	ubyte	0x0F			\b, extended partition table (LBA)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;466	ubyte	0x0			\b, extended partition table (last)

# DOS x86 sector separated and moved from &quot;DOS/MBR boot sector&quot; by Joerg Jenderek at May 2011

&gt;0x200	lelong	0x82564557		\b, BSD disklabel

# by Joerg Jenderek at Apr 2013
#	Print the DOS filenames from directory entry form with 8 right space padded bytes + 3 bytes for extension
#	like IO.SYS. MSDOS.SYS , KERNEL.SYS , DRBIO.SYS
0	name			DOS-filename
# space=0x20 (00100000b) means empty
&gt;0			ubyte&amp;0xDF	&gt;0
&gt;&gt;0			ubyte		x 		\b%c
&gt;&gt;&gt;1			ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;1			ubyte		x 		\b%c
&gt;&gt;&gt;&gt;&gt;2			ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;2			ubyte		x 		\b%c
&gt;&gt;&gt;&gt;&gt;&gt;&gt;3		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;3		ubyte		x 		\b%c
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;4		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;4		ubyte		x 		\b%c
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;5		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;5		ubyte		x 		\b%c
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;6		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;6		ubyte		x 		\b%c
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;7	ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;7	ubyte		x 		\b%c
# DOS filename extension
&gt;&gt;8			ubyte&amp;0xDF	&gt;0		\b.
&gt;&gt;&gt;8			ubyte		x 		\b%c
&gt;&gt;&gt;&gt;9			ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;9			ubyte		x 		\b%c
&gt;&gt;&gt;&gt;&gt;&gt;10		ubyte&amp;0xDF	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;10		ubyte		x 		\b%c
#	Print 2 following DOS filenames from directory entry form
#	like IO.SYS+MSDOS.SYS or ibmbio.com+ibmdos.com
0	name			2xDOS-filename
# display 1 space
&gt;0			ubyte		x		\b
&gt;0			use		DOS-filename
&gt;11			ubyte		x		\b+
&gt;11			use		DOS-filename

# http://en.wikipedia.org/wiki/Master_boot_record#PTE
# display standard partition table
0	name				partition-table
#&gt;0		ubyte		x	PARTITION-TABLE
# test and display 1st til 4th partition table entry
&gt;0		use			partition-entry-test
&gt;16		use			partition-entry-test
&gt;32		use			partition-entry-test
&gt;48		use			partition-entry-test
#		test for entry of partition table
0	name				partition-entry-test
# partition type ID &gt; 0
&gt;4		ubyte		&gt;0
# active flag 0
&gt;&gt;0		ubyte		0
&gt;&gt;&gt;0		use		partition-entry
# active flag 0x80, 0x81, ...
&gt;&gt;0		ubyte		&gt;0x7F
&gt;&gt;&gt;0		use		partition-entry
#		Print entry of partition table
0	name				partition-entry
# partition type ID &gt; 0
&gt;4		ubyte		&gt;0	\b; partition
&gt;&gt;64		leshort		0xAA55	1
&gt;&gt;48		leshort		0xAA55	2
&gt;&gt;32		leshort		0xAA55	3
&gt;&gt;16		leshort		0xAA55	4
&gt;&gt;4		ubyte		x	: ID=0x%x
&gt;&gt;0		ubyte&amp;0x80	0x80	\b, active
&gt;&gt;0		ubyte		&gt;0x80	0x%x
&gt;&gt;1		ubyte		x	\b, start-CHS (
&gt;&gt;1		use		partition-chs
&gt;&gt;5		ubyte		x	\b), end-CHS (
&gt;&gt;5		use		partition-chs
&gt;&gt;8		ulelong		x	\b), startsector %u
&gt;&gt;12		ulelong		x	\b, %u sectors
#		Print cylinder,head,sector (CHS) of partition entry
0	name				partition-chs
# cylinder
&gt;1		ubyte		x	\b0x
&gt;1		ubyte&amp;0xC0	0x40	\b1
&gt;1		ubyte&amp;0xC0	0x80	\b2
&gt;1		ubyte&amp;0xC0	0xC0	\b3
&gt;2		ubyte		x	\b%x
# head
&gt;0		ubyte		x	\b,%u
# sector
&gt;1		ubyte&amp;0x3F	x	\b,%u

# FATX
0		string		FATX		FATX filesystem data

# romfs filesystems - Juan Cespedes &lt;cespedes@debian.org&gt;
0	string		-rom1fs-	romfs filesystem, version 1
&gt;8	belong	x			%d bytes,
&gt;16	string	x			named %s.

# netboot image - Juan Cespedes &lt;cespedes@debian.org&gt;
0	lelong		0x1b031336L	Netboot image,
&gt;4	lelong&amp;0xFFFFFF00	0
&gt;&gt;4	lelong&amp;0x100	0x000		mode 2
&gt;&gt;4	lelong&amp;0x100	0x100		mode 3
&gt;4	lelong&amp;0xFFFFFF00	!0	unknown mode

0x18b	string	OS/2	OS/2 Boot Manager

# updated by Joerg Jenderek at Oct 2008 and Sep 2012
# http://syslinux.zytor.com/iso.php
# tested with versions 1.47,1.48,1.49,1.50,1.62,1.76,2.00,2.10;3.00,3.11,3.31,;3.70,3.71,3.73,3.75,3.80,3.82,3.84,3.86,4.01,4.03 and 4.05
# assembler instructions: cli;jmp 0:7Cyy (yy=0x40,0x5e,0x6c,0x6e,0x77);nop;nop
0	ulequad&amp;0x909000007cc0eafa	0x909000007c40eafa
&gt;631	search/689	ISOLINUX\ 	isolinux Loader
&gt;&gt;&amp;0	string		x		(version %-4.4s)
# http://syslinux.zytor.com/pxe.php
# assembler instructions: jmp 7C05
0	ulelong	0x007c05ea		pxelinux loader (version 2.13 or older)
# assembler instructions: pushfd;pushad
0	ulelong	0x60669c66		pxelinux loader
# assembler instructions: jmp 05
0	ulelong	0xc00005ea		pxelinux loader (version 3.70 or newer)
# http://syslinux.zytor.com/wiki/index.php/SYSLINUX
0	string	LDLINUX\ SYS\ 		SYSLINUX loader
&gt;12	string	x			(older version %-4.4s)
0	string	\r\nSYSLINUX\ 		SYSLINUX loader
&gt;11	string	x			(version %-4.4s)
# syslinux updated and separated from &quot;DOS/MBR boot sector&quot; by Joerg Jenderek at Sep 2012
# assembler instructions: jmp yy (yy=0x3c,0x58);nop;&quot;SYSLINUX&quot;
0	ulelong&amp;0x80909bEB	0x009018EB
# OEM-ID not always &quot;SYSLINUX&quot;
&gt;434	search/47	Boot\ failed
# followed by \r\n\0 or :\
&gt;&gt;482	search/132	\0LDLINUX\ SYS		Syslinux bootloader (version 2.13 or older)
&gt;&gt;1	ubyte		0x58			Syslinux bootloader (version 3.0-3.9)
&gt;459	search/30	Boot\ error\r\n\0
&gt;&gt;1	ubyte		0x58			Syslinux bootloader (version 3.10 or newer)
# SYSLINUX MBR updated and separated from &quot;DOS/MBR boot sector&quot; by Joerg Jenderek at Sep 2012
# assembler instructions: mov di,0600h;mov cx,0100h
16	search/4	\xbf\x00\x06\xb9\x00\x01
# to display SYSLINUX MBR (36) before old DOS/MBR boot sector one with partition table (strength=50+21)
!:strength +36
&gt;94	search/249	Missing\ operating\ system
# followed by \r for versions older 3.35 , .\r for versions newer 3.52 and point for other
# skip Ranish MBR
&gt;&gt;408	search/4	HD1/\0
&gt;&gt;408	default		x
&gt;&gt;&gt;250	search/118	\0Operating\ system\ load		SYSLINUX MBR
# followed by &quot;ing &quot; or space
&gt;&gt;&gt;&gt;292	search/98	error
&gt;&gt;&gt;&gt;&gt;&amp;0	string		\r		    			(version 3.35 or older)
&gt;&gt;&gt;&gt;&gt;&amp;0	string		.\r					(version 3.52 or newer)
&gt;&gt;&gt;&gt;&gt;&amp;0	default		x					(version 3.36-3.51 )
&gt;368	search/106	\0Disk\ error\ on\ boot\r\n		SYSLINUX GPT-MBR
&gt;&gt;156	search/10	\0Boot\ partition\ not\ found\r\n
&gt;&gt;&gt;270	search/10	\0OS\ not\ bootable\r\n			(version 3.86 or older)
&gt;&gt;174	search/10	\0Missing\ OS\r\n
&gt;&gt;&gt;189	search/10	\0Multiple\ active\ partitions\r\n	(version 4.00 or newer)
# SYSLINUX END

# NetBSD mbr variants (master-boot-code version 1.22) added by Joerg Jenderek at Nov 2012
# assembler instructions: xor ax,ax;mov	ax,ss;mov sp,0x7c00;mov	ax,
0	ubequad		0x31c08ed0bc007c8e
# mbr_bootsel magic before partition table not reliable with small ipl fragments
#&gt;444	uleshort	0xb5e1
&gt;0004	uleshort	x
# ERRorTeXT
&gt;&gt;181	search/166		Error\ \0\r\n				NetBSD mbr
# NT Drive Serial Number http://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm#DS
&gt;&gt;&gt;0x1B8	ubelong		&gt;0					\b,Serial 0x%-.8x
# BOOTSEL definitions contains assembler instructions: int 0x13;pop dx;push dx;push dx
&gt;&gt;&gt;0xbb		search/71	\xcd\x13\x5a\x52\x52			\b,bootselector
# BOOT_EXTENDED definitions contains assembler instructions:
# xchg ecx,edx;addl ecx,edx;movw lba_info,si;movb 0x42,ah;pop dx;push dx;int 0x13
&gt;&gt;&gt;0x96	search/1	\x66\x87\xca\x66\x01\xca\x66\x89\x16\x3a\x07\xbe\x32\x07\xb4\x42\x5a\x52\xcd\x13	\b,boot extended
# COM_PORT_VAL definitions contains assembler instructions: outb al,dx;add 5,dl;inb %dx;test 0x40,al
&gt;&gt;&gt;0x130	search/55	\xee\x80\xc2\x05\xec\xa8\x40		\b,serial IO
# not TERSE_ERROR
&gt;&gt;&gt;196		search/106	No\ active\ partition\0
&gt;&gt;&gt;&gt;&amp;0		string		Disk\ read\ error\0
&gt;&gt;&gt;&gt;&gt;&amp;0		string		No\ operating\ system\0			\b,verbose
# not NO_CHS definitions contains assembler instructions: pop dx;push dx;movb $8,ah;int0x13
&gt;&gt;&gt;0x7d		search/7	\x5a\x52\xb4\x08\xcd\x13		\b,CHS
# not NO_LBA_CHECK definitions contains assembler instructions: movw 0x55aa,bx;movb 0x41,ah;pop	dx;push	dx;int 0x13
&gt;&gt;&gt;0xa4		search/84	\xbb\xaa\x55\xb4\x41\x5a\x52\xcd\x13	\b,LBA-check
# assembler instructions: movw nametab,bx
&gt;&gt;&gt;0x26	    search/21	\xBB\x94\x07
# not NO_BANNER definitions contains assembler instructions: mov banner,si;call message_crlf
&gt;&gt;&gt;&gt;&amp;-9	ubequad&amp;0xBE00f0E800febb94	0xBE0000E80000bb94
&gt;&gt;&gt;&gt;&gt;181	search/166		Error\ \0
# &quot;a: disk&quot; , &quot;Fn: diskn&quot; or &quot;NetBSD MBR boot&quot;
&gt;&gt;&gt;&gt;&gt;&gt;&amp;3	string			x				\b,&quot;%s&quot;
&gt;&gt;&gt;446	use		partition-table
# Andrea Mazzoleni AdvanceCD mbr loader of http://advancemame.sourceforge.net/boot-readme.html
# added by Joerg Jenderek at Nov 2012 for versions 1.3 - 1.4
# assembler instructions: jmp short 0x58;nop;ASCII
0	ubequad&amp;0xeb58908000000000	0xeb58900000000000
# assembler instructions: cli;xor ax,ax;mov ds,ax;mov es,ax;mov ss,
&gt;(1.b+2)	ubequad			0xfa31c08ed88ec08e
# Error messages at end of code
&gt;&gt;376		string	No\ operating\ system\r\n\0
&gt;&gt;&gt;398		string	Disk\ error\r\n\0FDD\0HDD\0
&gt;&gt;&gt;&gt;419		string	\ EBIOS\r\n\0				AdvanceMAME mbr

# Neil Turton mbr loader variant of http://www.chiark.greenend.org.uk/~neilt/mbr/
# added by Joerg Jenderek at Mar 2011 for versions 1.0.0 - 1.1.11
# for 1st version assembler instructions:	cld;xor ax,ax;mov DS,ax;MOV ES,AX;mov SI,
# or  	  	  	    			cld;xor ax,ax;mov SS,ax;XOR SP,SP;mov DS,
0	ulequad&amp;0xcE1b40D48EC031FC	0x8E0000D08EC031FC
# pointer to the data starting with Neil Turton signature string
&gt;(0x1BC.s)		string		NDTmbr
&gt;&gt;&amp;-14			string		1234F\0			Turton mbr (
# parameters also viewed by install-mbr --list
&gt;&gt;&gt;(0x1BC.s+7)		ubyte		x			\b%u&lt;=
&gt;&gt;&gt;(0x1BC.s+9)		ubyte		x			\bVersion&lt;=%u
#&gt;&gt;&gt;(0x1BC.s+8)		ubyte		x			asm_flag_%x
&gt;&gt;&gt;(0x1BC.s+8)		ubyte&amp;1		1			\b,Y2K-Fix
# variant used by testdisk of http://www.cgsecurity.org/wiki/Menu_MBRCode
&gt;&gt;&gt;(0x1BC.s+8)		ubyte&amp;2		2			\b,TestDisk
#0x1~1,..,0x8~4,0x10~F,0x80~A enabled
#&gt;&gt;&gt;(0x1BC.s+10)		ubyte		x			\b,flags 0x%x
#0x0~1,0x1~2,...,0x3~4,0x4~F,0x7~D default boot
#&gt;&gt;&gt;(0x1BC.s+11)		ubyte		x			\b,cfg_def 0x%x
# for older versions
&gt;&gt;&gt;(0x1BC.s+9)		ubyte		&lt;2
#&gt;&gt;&gt;&gt;(0x1BC.s+12)	ubyte		18			\b,%hhu/18 seconds
&gt;&gt;&gt;&gt;(0x1BC.s+12)	ubyte		!18			\b,%u/18 seconds
# floppy A: or B:
&gt;&gt;&gt;&gt;(0x1BC.s+13)	ubyte		&lt;2			\b,floppy 0x%x
&gt;&gt;&gt;&gt;(0x1BC.s+13)	ubyte		&gt;1
# 1st hard disc
#&gt;&gt;&gt;&gt;&gt;(0x1BC.s+13)	ubyte		0x80			\b,drive 0x%x
# not 1st hard disc
&gt;&gt;&gt;&gt;&gt;(0x1BC.s+13)	ubyte		!0x80			\b,drive 0x%x
# for version &gt;= 2 maximal timeout can be 65534
&gt;&gt;&gt;(0x1BC.s+9)		ubyte		&gt;1
#&gt;&gt;&gt;&gt;(0x1BC.s+12)	uleshort	18			\b,%u/18 seconds
&gt;&gt;&gt;&gt;(0x1BC.s+12)	uleshort	!18			\b,%u/18 seconds
# floppy A: or B:
&gt;&gt;&gt;&gt;(0x1BC.s+14)	ubyte		&lt;2			\b,floppy 0x%x
&gt;&gt;&gt;&gt;(0x1BC.s+14)	ubyte		&gt;1
# 1st hard disc
#&gt;&gt;&gt;&gt;&gt;(0x1BC.s+14)	ubyte		0x80			\b,drive 0x%x
# not 1st hard disc
&gt;&gt;&gt;&gt;&gt;(0x1BC.s+14)	ubyte		!0x80			\b,drive 0x%x
&gt;&gt;&gt;0	ubyte		x					\b)

# added by Joerg Jenderek
# In the second sector (+0x200) are variables according to grub-0.97/stage2/asm.S or
# grub-1.94/kern/i386/pc/startup.S
# http://www.gnu.org/software/grub/manual/grub.html#Embedded-data
# usual values are marked with comments to get only informations of strange GRUB loaders
0x200	uleshort		0x70EA
# found only version 3.{1,2}
&gt;0x206		ubeshort	&gt;0x0300
# GRUB version (0.5.)95,0.93,0.94,0.96,0.97 &gt; &quot;00&quot;
&gt;&gt;0x212 	ubyte		&gt;0x29
&gt;&gt;&gt;0x213 	ubyte		&gt;0x29
# not iso9660_stage1_5
#&gt;&gt;&gt;0	ulelong&amp;0x00BE5652	0x00BE5652
&gt;&gt;&gt;&gt;0x213 	ubyte		&gt;0x29		GRand Unified Bootloader
# config_file for stage1_5 is 0xffffffff + default &quot;/boot/grub/stage2&quot;
&gt;&gt;&gt;&gt;0x217 	ubyte		0xFF		stage1_5
&gt;&gt;&gt;&gt;0x217 	ubyte		&lt;0xFF		stage2
&gt;&gt;&gt;&gt;0x206	ubyte		x		\b version %u
&gt;&gt;&gt;&gt;0x207	ubyte		x		\b.%u
# module_size for 1.94
&gt;&gt;&gt;&gt;0x208	ulelong		&lt;0xffffff	\b, installed partition %u
#&gt;&gt;&gt;&gt;0x208	ulelong		=0xffffff	\b, %lu (default)
&gt;&gt;&gt;&gt;0x208	ulelong		&gt;0xffffff	\b, installed partition %u
# GRUB 0.5.95 unofficial
&gt;&gt;&gt;&gt;0x20C	ulelong&amp;0x2E300000 0x2E300000
# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs
&gt;&gt;&gt;&gt;&gt;0x20C	ubyte		x		\b, identifier 0x%x
#&gt;&gt;&gt;&gt;&gt;0x20D	ubyte		=0		\b, LBA flag 0x%x (default)
&gt;&gt;&gt;&gt;&gt;0x20D	ubyte		&gt;0		\b, LBA flag 0x%x
# GRUB version as string
&gt;&gt;&gt;&gt;&gt;0x20E 	string		&gt;\0		\b, GRUB version %-s
# for stage1_5 is 0xffffffff + config_file &quot;/boot/grub/stage2&quot; default
&gt;&gt;&gt;&gt;&gt;&gt;0x215 	ulong		0xffffffff
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x219 	string		&gt;\0		\b, configuration file %-s
&gt;&gt;&gt;&gt;&gt;&gt;0x215 	ulong		!0xffffffff
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x215 	string		&gt;\0		\b, configuration file %-s
# newer GRUB versions
&gt;&gt;&gt;&gt;0x20C	ulelong&amp;0x2E300000 !0x2E300000
##&gt;&gt;&gt;&gt;&gt;0x20C	ulelong		=0		\b, saved entry %d (usual)
&gt;&gt;&gt;&gt;&gt;0x20C	ulelong		&gt;0		\b, saved entry %d
# for 1.94 contains kernel image size
# for 0.93,0.94,0.96,0.97
# 0=stage2	1=ffs	2=e2fs	3=fat	4=minix	5=reiserfs	6=vstafs	7=jfs	8=xfs	9=iso9660	a=ufs2
&gt;&gt;&gt;&gt;&gt;0x210	ubyte		x		\b, identifier 0x%x
# The flag for LBA forcing is in most cases 0
#&gt;&gt;&gt;&gt;&gt;0x211	ubyte		=0		\b, LBA flag 0x%x (default)
&gt;&gt;&gt;&gt;&gt;0x211	ubyte		&gt;0		\b, LBA flag 0x%x
# GRUB version as string
&gt;&gt;&gt;&gt;&gt;0x212 	string		&gt;\0		\b, GRUB version %-s
# for stage1_5 is 0xffffffff + config_file &quot;/boot/grub/stage2&quot; default
&gt;&gt;&gt;&gt;&gt;0x217 	ulong		0xffffffff
&gt;&gt;&gt;&gt;&gt;&gt;0x21b 	string		&gt;\0		\b, configuration file %-s
&gt;&gt;&gt;&gt;&gt;0x217 	ulong		!0xffffffff
&gt;&gt;&gt;&gt;&gt;&gt;0x217 	string		&gt;\0		\b, configuration file %-s

# DOS x86 sector updated and separated from &quot;DOS/MBR boot sector&quot; by Joerg Jenderek at May 2011
# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
# over BIOS parameter block (BPB)
# http://thestarman.pcministry.com/asm/2bytejumps.htm#FWD
# older drives may use Near JuMP instruction E9 xx xx
# minimal short forward jump found 0x29 for bootloaders or 0x0
# maximal short forward jump is 0x7f
# OEM-ID is empty or contain readable bytes
0		ulelong&amp;0x804000E9	0x000000E9
!:strength	+60
# mtools-3.9.8/msdos.h
# usual values are marked with comments to get only informations of strange FAT systems
# valid sectorsize must be a power of 2 from 32 to 32768
&gt;11		uleshort&amp;0x001f	0
&gt;&gt;11		uleshort	&lt;32769
&gt;&gt;&gt;11		uleshort	&gt;31
&gt;&gt;&gt;&gt;21		ubyte&amp;0xf0	0xF0
&gt;&gt;&gt;&gt;&gt;0		ubyte		0xEB		DOS/MBR boot sector
&gt;&gt;&gt;&gt;&gt;&gt;1		ubyte		x		\b, code offset 0x%x+2
&gt;&gt;&gt;&gt;&gt;0		ubyte		0xE9
&gt;&gt;&gt;&gt;&gt;&gt;1		uleshort	x		\b, code offset 0x%x+3
&gt;&gt;&gt;&gt;&gt;3		string		&gt;\0		\b, OEM-ID &quot;%-.8s&quot;
#http://mirror.href.com/thestarman/asm/debug/debug2.htm#IHC
&gt;&gt;&gt;&gt;&gt;&gt;8		string		IHC		\b cached by Windows 9M
&gt;&gt;&gt;&gt;&gt;11		uleshort	&gt;512		\b, Bytes/sector %u
#&gt;&gt;&gt;&gt;&gt;11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
&gt;&gt;&gt;&gt;&gt;11		uleshort	&lt;512		\b, Bytes/sector %u
&gt;&gt;&gt;&gt;&gt;13		ubyte		&gt;1		\b, sectors/cluster %u
#&gt;&gt;&gt;&gt;&gt;13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
# for lazy FAT32 implementation like Transcend digital photo frame PF830
&gt;&gt;&gt;&gt;&gt;82		string/c	fat32
&gt;&gt;&gt;&gt;&gt;&gt;14	uleshort	!32		\b, reserved sectors %u
#&gt;&gt;&gt;&gt;&gt;&gt;14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
&gt;&gt;&gt;&gt;&gt;82		string/c	!fat32
&gt;&gt;&gt;&gt;&gt;&gt;14	uleshort	&gt;1		\b, reserved sectors %u
#&gt;&gt;&gt;&gt;&gt;&gt;14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
#&gt;&gt;&gt;&gt;&gt;&gt;14	uleshort	0		\b, reserved sectors %u (usual NTFS)
&gt;&gt;&gt;&gt;&gt;16		ubyte		&gt;2		\b, FATs %u
#&gt;&gt;&gt;&gt;&gt;16	ubyte		=2		\b, FATs %u (usual)
&gt;&gt;&gt;&gt;&gt;16		ubyte		=1		\b, FAT  %u
&gt;&gt;&gt;&gt;&gt;16		ubyte		&gt;0
&gt;&gt;&gt;&gt;&gt;17		uleshort	&gt;0		\b, root entries %u
#&gt;&gt;&gt;&gt;&gt;17	uleshort	=0		\b, root entries %hu=0 (usual Fat32)
&gt;&gt;&gt;&gt;&gt;19		uleshort	&gt;0		\b, sectors %u (volumes &lt;=32 MB)
#&gt;&gt;&gt;&gt;&gt;19	uleshort	=0		\b, sectors %hu=0 (usual Fat32)
&gt;&gt;&gt;&gt;&gt;21		ubyte		&gt;0xF0		\b, Media descriptor 0x%x
#&gt;&gt;&gt;&gt;&gt;21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
&gt;&gt;&gt;&gt;&gt;21		ubyte		&lt;0xF0		\b, Media descriptor 0x%x
&gt;&gt;&gt;&gt;&gt;22		uleshort	&gt;0		\b, sectors/FAT %u
#&gt;&gt;&gt;&gt;&gt;22	uleshort	=0		\b, sectors/FAT %hu=0 (usual Fat32)
&gt;&gt;&gt;&gt;&gt;24		uleshort	x		\b, sectors/track %u
&gt;&gt;&gt;&gt;&gt;26		ubyte		&gt;2		\b, heads %u
#&gt;&gt;&gt;&gt;&gt;26	ubyte		=2		\b, heads %u (usual floppy)
&gt;&gt;&gt;&gt;&gt;26		ubyte		=1		\b, heads %u
# valid only for sector sizes with more then 32 Bytes
&gt;&gt;&gt;&gt;&gt;11		uleshort	&gt;32
# http://en.wikipedia.org/wiki/Design_of_the_FAT_file_system#Extended_BIOS_Parameter_Block
# skip for values 2,2Ah,70h,73h,DFh
# and continue for extended boot signature values 0,28h,29h,80h
&gt;&gt;&gt;&gt;&gt;&gt;38	ubyte&amp;0x56	=0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;28	ulelong		&gt;0		\b, hidden sectors %u
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;28	ulelong		=0		\b, hidden sectors %u (usual floppy)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;32	ulelong		&gt;0		\b, sectors %u (volumes &gt; 32 MB)
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;32	ulelong		=0		\b, sectors %u (volumes &gt; 32 MB)
# FAT&lt;32 bit specific
&gt;&gt;&gt;&gt;&gt;&gt;&gt;82	string/c	!fat32
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;36	ubyte		0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;36	ubyte		0		\b, physical drive 0x%x=0 (usual floppy)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;36	ubyte		!0x80
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;36	ubyte		!0		\b, physical drive 0x%x
# VGA-copy CRC or
# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;37	ubyte		&gt;0		\b, reserved 0x%x
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;37	ubyte		=0		\b, reserved 0x%x
# extended boot signatur value is 0x80 for NTFS, 0x28 or 0x29 for others
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;38	ubyte		!0x29		\b, dos &lt; 4.0 BootSector (0x%x)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;38	ubyte&amp;0xFE	=0x28
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;39	ulelong		x		\b, serial number 0x%x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;38	ubyte		=0x29
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;43	string		&lt;NO\ NAME	\b, label: &quot;%11.11s&quot;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;43	string		&gt;NO\ NAME	\b, label: &quot;%11.11s&quot;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;43	string		=NO\ NAME	\b, unlabeled
# there exist some old floppies without word FAT at offset 54
# a word like &quot;FATnm   &quot; is only a hint for a FAT size on nm-bits
# Normally the number of clusters is calculated by the values of BPP.
# if it is small enough FAT is 12 bit, if it is too big enough FAT is 32 bit,
# otherwise FAT is 16 bit.
# http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/determining-fat-widths.html
&gt;&gt;&gt;&gt;&gt;82		string/c	!fat32
&gt;&gt;&gt;&gt;&gt;&gt;54	string		FAT12		\b, FAT (12 bit)
&gt;&gt;&gt;&gt;&gt;&gt;54	string		FAT16		\b, FAT (16 bit)
&gt;&gt;&gt;&gt;&gt;&gt;54	default		x
# determinate FAT bit size by media descriptor
# small floppies implies FAT12
&gt;&gt;&gt;&gt;&gt;&gt;&gt;21	ubyte		&lt;0xF0		\b, FAT (12 bit by descriptor)
# with media descriptor F0h floppy or maybe superfloppy with FAT16
&gt;&gt;&gt;&gt;&gt;&gt;&gt;21	ubyte		=0xF0
# superfloppy (many sectors) implies FAT16
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;32	ulelong		&gt;0xFFFF		\b, FAT (16 bit by descriptor+sectors)
# no superfloppy with media descriptor F0h implies FAT12
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;32	default		x		\b, FAT (12 bit by descriptor+sectors)
# with media descriptor F8h floppy or hard disc with FAT12 or FAT16
&gt;&gt;&gt;&gt;&gt;&gt;&gt;21	ubyte		=0xF8
# 360 KiB with media descriptor F8h, 9 sectors per track ,single sided floppy implies FAT12
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;19	ubequad	0xd002f80300090001	\b, FAT (12 bit by descriptor+geometry)
# hard disc with FAT12 or FAT16
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;19	default		x		\b, FAT (1Y bit by descriptor)
# with media descriptor FAh floppy, RAM disc with FAT12 or FAT16 or Tandy hard disc
&gt;&gt;&gt;&gt;&gt;&gt;&gt;21	ubyte		=0xFA
# 320 KiB with media descriptor FAh, 8 sectors per track ,single sided floppy implies FAT12
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;19	ubequad	0x8002fa0200080001	\b, FAT (12 bit by descriptor+geometry)
# RAM disc with FAT12 or FAT16 or Tandy hard disc
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;19	default		x		\b, FAT (1Y bit by descriptor)
# others are floppy
&gt;&gt;&gt;&gt;&gt;&gt;&gt;21	default		x		\b, FAT (12 bit by descriptor)
# FAT32 bit specific
&gt;&gt;&gt;&gt;&gt;82		string/c	fat32		\b, FAT (32 bit)
&gt;&gt;&gt;&gt;&gt;&gt;36	ulelong		x		\b, sectors/FAT %u
# http://technet.microsoft.com/en-us/library/cc977221.aspx
&gt;&gt;&gt;&gt;&gt;&gt;40	uleshort	&gt;0		\b, extension flags 0x%x
#&gt;&gt;&gt;&gt;&gt;&gt;40	uleshort	=0		\b, extension flags %hu
&gt;&gt;&gt;&gt;&gt;&gt;42	uleshort	&gt;0		\b, fsVersion %u
#&gt;&gt;&gt;&gt;&gt;&gt;42	uleshort	=0		\b, fsVersion %u (usual)
&gt;&gt;&gt;&gt;&gt;&gt;44	ulelong		&gt;2		\b, rootdir cluster %u
#&gt;&gt;&gt;&gt;&gt;&gt;44	ulelong		=2		\b, rootdir cluster %u
#&gt;&gt;&gt;&gt;&gt;&gt;44	ulelong		=1		\b, rootdir cluster %u
&gt;&gt;&gt;&gt;&gt;&gt;48	uleshort	&gt;1		\b, infoSector %u
#&gt;&gt;&gt;&gt;&gt;&gt;48	uleshort	=1		\b, infoSector %u (usual)
&gt;&gt;&gt;&gt;&gt;&gt;48	uleshort	&lt;1		\b, infoSector %u
# 0 or 0xFFFF instead of usual 6 means no backup sector
&gt;&gt;&gt;&gt;&gt;&gt;50	uleshort	=0xFFFF		\b, no Backup boot sector
&gt;&gt;&gt;&gt;&gt;&gt;50	uleshort	=0		\b, no Backup boot sector
#&gt;&gt;&gt;&gt;&gt;&gt;50	uleshort	=6		\b, Backup boot sector %u (usual)
&gt;&gt;&gt;&gt;&gt;&gt;50	default		x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;50	uleshort	x		\b, Backup boot sector %u
# corrected by Joerg Jenderek at Feb 2011 according to http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm#FSINFO
&gt;&gt;&gt;&gt;&gt;&gt;52	ulelong		&gt;0		\b, reserved1 0x%x
&gt;&gt;&gt;&gt;&gt;&gt;56	ulelong		&gt;0		\b, reserved2 0x%x
&gt;&gt;&gt;&gt;&gt;&gt;60	ulelong		&gt;0		\b, reserved3 0x%x
# same structure as FAT1X
#&gt;&gt;&gt;&gt;&gt;&gt;64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
#&gt;&gt;&gt;&gt;&gt;&gt;64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
&gt;&gt;&gt;&gt;&gt;&gt;64	ubyte		!0x80
&gt;&gt;&gt;&gt;&gt;&gt;&gt;64	ubyte		&gt;0		\b, physical drive 0x%x
# in Windows NT bit 0 is a dirty flag to request chkdsk at boot time. bit 1 requests surface scan too
&gt;&gt;&gt;&gt;&gt;&gt;65	ubyte		&gt;0		\b, reserved 0x%x
&gt;&gt;&gt;&gt;&gt;&gt;66	ubyte		!0x29		\b, dos &lt; 4.0 BootSector (0x%x)
&gt;&gt;&gt;&gt;&gt;&gt;66	ubyte		=0x29
&gt;&gt;&gt;&gt;&gt;&gt;&gt;67	ulelong		x		\b, serial number 0x%x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;71	string		&lt;NO\ NAME	\b, label: &quot;%11.11s&quot;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;71	string		&gt;NO\ NAME	\b, label: &quot;%11.11s&quot;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;71	string		=NO\ NAME	\b, unlabeled
# additional tests for floppy image added by Joerg Jenderek
# no fixed disk
&gt;&gt;&gt;&gt;&gt;21		ubyte		!0xF8
# floppy media with 12 bit FAT
&gt;&gt;&gt;&gt;&gt;&gt;54	string		!FAT16
# test for FAT after bootsector
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(11.s)	ulelong&amp;0x00ffffF0	0x00ffffF0	\b, followed by FAT
# floppy image
!:mime application/x-ima
# NTFS specific added by Joerg Jenderek at Mar 2011 according to http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm
# and http://homepage.ntlworld.com/jonathan.deboynepollard/FGA/bios-parameter-block.html
# 0 FATs
&gt;&gt;&gt;&gt;&gt;16	ubyte		=0
# 0 root entries
&gt;&gt;&gt;&gt;&gt;&gt;17	uleshort	=0
# 0 DOS sectors
&gt;&gt;&gt;&gt;&gt;&gt;&gt;19	uleshort	=0
# 0 sectors/FAT
# dos &lt; 4.0 BootSector value found is 0x80
#38	ubyte		=0x80			\b, dos &lt; 4.0 BootSector (0x%x)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;22	uleshort	=0		\b; NTFS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;24	uleshort	&gt;0		\b, sectors/track %u
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;36	ulelong		!0x800080	\b, physical drive 0x%x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;40	ulequad		&gt;0		\b, sectors %lld
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;48	ulequad		&gt;0		\b, $MFT start cluster %lld
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;56	ulequad		&gt;0		\b, $MFTMirror start cluster %lld
# Values 0 to 127 represent MFT record sizes of 0 to 127 clusters.
# Values 128 to 255 represent MFT record sizes of 2^(256-N) bytes.
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;64	lelong		&lt;256
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;64	lelong		&lt;128		\b, clusters/RecordSegment %d
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;64	ubyte		&gt;127		\b, bytes/RecordSegment 2^(-1*%i)
# Values 0 to 127 represent index block sizes of 0 to 127 clusters.
# Values 128 to 255 represent index block sizes of 2^(256-N) byte
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;68	ulelong		&lt;256
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;68	ulelong		&lt;128		\b, clusters/index block %d
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;68	ulelong		&gt;127		\b, bytes/index block 2^(256-%d)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;68	ubyte		&gt;127		\b, bytes/index block 2^(-1*%i)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;72	ulequad		x		\b, serial number 0%llx
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;80	ulelong		&gt;0		\b, checksum 0x%x
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;80	ulelong		=0		\b, checksum 0x%x=0 (usual)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x258	ulelong&amp;0x00009090	=0x00009090
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-92		indirect	x	\b; contains
# For 2nd NTFS sector added by Joerg Jenderek at Jan 2013
# http://thestarman.pcministry.com/asm/mbr/NTFSbrHexEd.htm
# unused assembler instructions JMP y2;NOP;NOP
0x056		ulelong&amp;0xFFFF0FFF	0x909002EB
# unicode loadername terminated by CTRL-D
&gt;(0.s*2)	ulelong&amp;0xFFFFFF00	0x00040000
# loadernames are NTLDR,CMLDR,PELDR,$LDR$ or BOOTMGR
&gt;&gt;0x002		lestring16	x	Microsoft Windows XP/VISTA bootloader %-5.5s
&gt;&gt;0x12		string		$
&gt;&gt;&gt;0x0c		lestring16	x	\b%-2.2s
### DOS,NTFS boot sectors end

# ntfsclone-image is a special save format for NTFS volumes,
# created and restored by the ntfsclone program
0	string	\0ntfsclone-image	ntfsclone image,
&gt;0x10	byte	x			version %d.
&gt;0x11	byte	x			\b%d,
&gt;0x12	lelong	x			cluster size %d,
&gt;0x16	lequad	x			device size %lld,
&gt;0x1e	lequad	x			%lld total clusters,
&gt;0x26	lequad	x			%lld clusters in use

9564	lelong		0x00011954	Unix Fast File system [v1] (little-endian),
&gt;8404	string		x		last mounted on %s,
#&gt;9504	ledate		x		last checked at %s,
&gt;8224	ledate		x		last written at %s,
&gt;8401	byte		x		clean flag %d,
&gt;8228	lelong		x		number of blocks %d,
&gt;8232	lelong		x		number of data blocks %d,
&gt;8236	lelong		x		number of cylinder groups %d,
&gt;8240	lelong		x		block size %d,
&gt;8244	lelong		x		fragment size %d,
&gt;8252	lelong		x		minimum percentage of free blocks %d,
&gt;8256	lelong		x		rotational delay %dms,
&gt;8260	lelong		x		disk rotational speed %drps,
&gt;8320	lelong		0		TIME optimization
&gt;8320	lelong		1		SPACE optimization

42332	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
&gt;&amp;-1164	string		x		last mounted on %s,
&gt;&amp;-696	string		&gt;\0		volume name %s,
&gt;&amp;-304	leqldate	x		last written at %s,
&gt;&amp;-1167	byte		x		clean flag %d,
&gt;&amp;-1168	byte		x		readonly flag %d,
&gt;&amp;-296	lequad		x		number of blocks %lld,
&gt;&amp;-288	lequad		x		number of data blocks %lld,
&gt;&amp;-1332	lelong		x		number of cylinder groups %d,
&gt;&amp;-1328	lelong		x		block size %d,
&gt;&amp;-1324	lelong		x		fragment size %d,
&gt;&amp;-180	lelong		x		average file size %d,
&gt;&amp;-176	lelong		x		average number of files in dir %d,
&gt;&amp;-272	lequad		x		pending blocks to free %lld,
&gt;&amp;-264	lelong		x		pending inodes to free %d,
&gt;&amp;-664	lequad		x		system-wide uuid %0llx,
&gt;&amp;-1316	lelong		x		minimum percentage of free blocks %d,
&gt;&amp;-1248	lelong		0		TIME optimization
&gt;&amp;-1248	lelong		1		SPACE optimization

66908	lelong		0x19540119	Unix Fast File system [v2] (little-endian)
&gt;&amp;-1164	string		x		last mounted on %s,
&gt;&amp;-696	string		&gt;\0		volume name %s,
&gt;&amp;-304	leqldate	x		last written at %s,
&gt;&amp;-1167	byte		x		clean flag %d,
&gt;&amp;-1168	byte		x		readonly flag %d,
&gt;&amp;-296	lequad		x		number of blocks %lld,
&gt;&amp;-288	lequad		x		number of data blocks %lld,
&gt;&amp;-1332	lelong		x		number of cylinder groups %d,
&gt;&amp;-1328	lelong		x		block size %d,
&gt;&amp;-1324	lelong		x		fragment size %d,
&gt;&amp;-180	lelong		x		average file size %d,
&gt;&amp;-176	lelong		x		average number of files in dir %d,
&gt;&amp;-272	lequad		x		pending blocks to free %lld,
&gt;&amp;-264	lelong		x		pending inodes to free %d,
&gt;&amp;-664	lequad		x		system-wide uuid %0llx,
&gt;&amp;-1316	lelong		x		minimum percentage of free blocks %d,
&gt;&amp;-1248	lelong		0		TIME optimization
&gt;&amp;-1248	lelong		1		SPACE optimization

9564	belong		0x00011954	Unix Fast File system [v1] (big-endian),
&gt;7168   belong		0x4c41424c	Apple UFS Volume
&gt;&gt;7186  string		x		named %s,
&gt;&gt;7176  belong		x		volume label version %d,
&gt;&gt;7180  bedate		x		created on %s,
&gt;8404	string		x		last mounted on %s,
#&gt;9504	bedate		x		last checked at %s,
&gt;8224	bedate		x		last written at %s,
&gt;8401	byte		x		clean flag %d,
&gt;8228	belong		x		number of blocks %d,
&gt;8232	belong		x		number of data blocks %d,
&gt;8236	belong		x		number of cylinder groups %d,
&gt;8240	belong		x		block size %d,
&gt;8244	belong		x		fragment size %d,
&gt;8252	belong		x		minimum percentage of free blocks %d,
&gt;8256	belong		x		rotational delay %dms,
&gt;8260	belong		x		disk rotational speed %drps,
&gt;8320	belong		0		TIME optimization
&gt;8320	belong		1		SPACE optimization

42332	belong		0x19540119	Unix Fast File system [v2] (big-endian)
&gt;&amp;-1164	string		x		last mounted on %s,
&gt;&amp;-696	string		&gt;\0		volume name %s,
&gt;&amp;-304	beqldate	x		last written at %s,
&gt;&amp;-1167	byte		x		clean flag %d,
&gt;&amp;-1168	byte		x		readonly flag %d,
&gt;&amp;-296	bequad		x		number of blocks %lld,
&gt;&amp;-288	bequad		x		number of data blocks %lld,
&gt;&amp;-1332	belong		x		number of cylinder groups %d,
&gt;&amp;-1328	belong		x		block size %d,
&gt;&amp;-1324	belong		x		fragment size %d,
&gt;&amp;-180	belong		x		average file size %d,
&gt;&amp;-176	belong		x		average number of files in dir %d,
&gt;&amp;-272	bequad		x		pending blocks to free %lld,
&gt;&amp;-264	belong		x		pending inodes to free %d,
&gt;&amp;-664	bequad		x		system-wide uuid %0llx,
&gt;&amp;-1316	belong		x		minimum percentage of free blocks %d,
&gt;&amp;-1248	belong		0		TIME optimization
&gt;&amp;-1248	belong		1		SPACE optimization

66908	belong		0x19540119	Unix Fast File system [v2] (big-endian)
&gt;&amp;-1164	string		x		last mounted on %s,
&gt;&amp;-696	string		&gt;\0		volume name %s,
&gt;&amp;-304	beqldate	x		last written at %s,
&gt;&amp;-1167	byte		x		clean flag %d,
&gt;&amp;-1168	byte		x		readonly flag %d,
&gt;&amp;-296	bequad		x		number of blocks %lld,
&gt;&amp;-288	bequad		x		number of data blocks %lld,
&gt;&amp;-1332	belong		x		number of cylinder groups %d,
&gt;&amp;-1328	belong		x		block size %d,
&gt;&amp;-1324	belong		x		fragment size %d,
&gt;&amp;-180	belong		x		average file size %d,
&gt;&amp;-176	belong		x		average number of files in dir %d,
&gt;&amp;-272	bequad		x		pending blocks to free %lld,
&gt;&amp;-264	belong		x		pending inodes to free %d,
&gt;&amp;-664	bequad		x		system-wide uuid %0llx,
&gt;&amp;-1316	belong		x		minimum percentage of free blocks %d,
&gt;&amp;-1248	belong		0		TIME optimization
&gt;&amp;-1248	belong		1		SPACE optimization

0	ulequad		0xc8414d4dc5523031	HAMMER filesystem (little-endian),
&gt;0x90	lelong+1	x			volume %d
&gt;0x94	lelong		x			(of %d),
&gt;0x50	string		x			name %s,
&gt;0x98	ulelong		x			version %u,
&gt;0xa0	ulelong		x			flags 0x%x

# ext2/ext3 filesystems - Andreas Dilger &lt;adilger@dilger.ca&gt;
# ext4 filesystem - Eric Sandeen &lt;sandeen@sandeen.net&gt;
# volume label and UUID Russell Coker
# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
0x438   leshort         0xEF53          Linux
&gt;0x44c  lelong          x               rev %d
&gt;0x43e  leshort         x               \b.%d
# No journal?  ext2
&gt;0x45c  lelong          ^0x0000004      ext2 filesystem data
&gt;&gt;0x43a leshort         ^0x0000001      (mounted or unclean)
# Has a journal?  ext3 or ext4
&gt;0x45c  lelong          &amp;0x0000004
#  and small INCOMPAT?
&gt;&gt;0x460 lelong          &lt;0x0000040
#   and small RO_COMPAT?
&gt;&gt;&gt;0x464 lelong         &lt;0x0000008      ext3 filesystem data
#   else large RO_COMPAT?
&gt;&gt;&gt;0x464 lelong         &gt;0x0000007      ext4 filesystem data
#  else large INCOMPAT?
&gt;&gt;0x460	lelong          &gt;0x000003f      ext4 filesystem data
&gt;0x468	belong		x		\b, UUID=%08x
&gt;0x46c	beshort		x		\b-%04x
&gt;0x46e	beshort		x		\b-%04x
&gt;0x470	beshort		x		\b-%04x
&gt;0x472	belong		x		\b-%08x
&gt;0x476	beshort		x		\b%04x
&gt;0x478	string		&gt;0		\b, volume name &quot;%s&quot;
# General flags for any ext* fs
&gt;0x460	lelong          &amp;0x0000004      (needs journal recovery)
&gt;0x43a	leshort         &amp;0x0000002      (errors)
# INCOMPAT flags
&gt;0x460	lelong          &amp;0x0000001      (compressed)
#&gt;0x460	lelong          &amp;0x0000002      (filetype)
#&gt;0x460	lelong          &amp;0x0000010      (meta bg)
&gt;0x460	lelong          &amp;0x0000040      (extents)
&gt;0x460	lelong          &amp;0x0000080      (64bit)
#&gt;0x460	lelong          &amp;0x0000100      (mmp)
#&gt;0x460	lelong          &amp;0x0000200      (flex bg)
# RO_INCOMPAT flags
#&gt;0x464	lelong          &amp;0x0000001      (sparse super)
&gt;0x464	lelong          &amp;0x0000002      (large files)
&gt;0x464	lelong          &amp;0x0000008      (huge files)
#&gt;0x464	lelong          &amp;0x0000010      (gdt checksum)
#&gt;0x464	lelong          &amp;0x0000020      (many subdirs)
#&gt;0x463	lelong          &amp;0x0000040      (extra isize)

# f2fs filesystem - Tuomas Tynkkynen &lt;tuomas.tynkkynen@iki.fi&gt;
0x400	lelong		0xF2F52010	F2FS filesystem
&gt;0x46c	belong		x		\b, UUID=%08x
&gt;0x470	beshort		x		\b-%04x
&gt;0x472	beshort		x		\b-%04x
&gt;0x474	beshort		x		\b-%04x
&gt;0x476	belong		x		\b-%08x
&gt;0x47a	beshort		x		\b%04x
&gt;0x147c	lestring16	x		\b, volume name &quot;%s&quot;

# Minix filesystems - Juan Cespedes &lt;cespedes@debian.org&gt;
0x410	leshort		0x137f
!:strength / 2
&gt;0x402	beshort		&lt; 100
&gt;0x402	beshort		&gt; -1		Minix filesystem, V1, 14 char names, %d zones
&gt;0x1e	string		minix		\b, bootable
0x410	beshort		0x137f
!:strength / 2
&gt;0x402	beshort		&lt; 100
&gt;0x402	beshort		&gt; -1		Minix filesystem, V1 (big endian), %d zones
&gt;0x1e	string		minix		\b, bootable
0x410	leshort		0x138f
!:strength / 2
&gt;0x402	beshort		&lt; 100
&gt;0x402	beshort		&gt; -1		Minix filesystem, V1, 30 char names, %d zones
&gt;0x1e	string		minix		\b, bootable
0x410	beshort		0x138f
!:strength / 2
&gt;0x402	beshort		&lt; 100
&gt;0x402	beshort		&gt; -1		Minix filesystem, V1, 30 char names (big endian), %d zones
&gt;0x1e	string		minix		\b, bootable
# Weak Magic: this is $x
#0x410	leshort		0x2468
#&gt;0x402	beshort		&lt; 100
#&gt;&gt;0x402	beshort		&gt; -1		Minix filesystem, V2, 14 char names
#&gt;0x1e	string		minix		\b, bootable
#0x410	beshort		0x2468
#&gt;0x402	beshort		&lt; 100
#&gt;0x402	beshort		&gt; -1		Minix filesystem, V2 (big endian)
#&gt;0x1e	string		minix		\b, bootable
#0x410	leshort		0x2478
#&gt;0x402	beshort		&lt; 100
#&gt;0x402	beshort		&gt; -1		Minix filesystem, V2, 30 char names
#&gt;0x1e	string		minix		\b, bootable
#0x410	leshort		0x2478
#&gt;0x402	beshort		&lt; 100
#&gt;0x402	beshort		&gt; -1		Minix filesystem, V2, 30 char names
#&gt;0x1e	string		minix		\b, bootable
#0x410	beshort		0x2478
#&gt;0x402	beshort		!0		Minix filesystem, V2, 30 char names (big endian)
#&gt;0x1e	string		minix		\b, bootable
# Weak Magic! this is MD
#0x418	leshort		0x4d5a
#&gt;0x402	beshort		&lt;100
#&gt;&gt;0x402	beshort		&gt; -1		Minix filesystem, V3, 60 char names

# SGI disk labels - Nathan Scott &lt;nathans@debian.org&gt;
0	belong		0x0BE5A941	SGI disk label (volume header)

# SGI XFS filesystem - Nathan Scott &lt;nathans@debian.org&gt;
0	belong		0x58465342	SGI XFS filesystem data
&gt;0x4	belong		x		(blksz %d,
&gt;0x68	beshort		x		inosz %d,
&gt;0x64	beshort		^0x2004		v1 dirs)
&gt;0x64	beshort		&amp;0x2004		v2 dirs)

############################################################################
# Minix-ST kernel floppy
0x800	belong		0x46fc2700	Atari-ST Minix kernel image
# http://en.wikipedia.org/wiki/BIOS_parameter_block
# floppies with valid BPB and any instruction at beginning
&gt;19	string		\240\005\371\005\0\011\0\2\0	\b, 720k floppy
&gt;19	string		\320\002\370\005\0\011\0\1\0	\b, 360k floppy

############################################################################
# Hmmm, is this a better way of detecting _standard_ floppy images ?
19	string		\320\002\360\003\0\011\0\1\0	DOS floppy 360k
&gt;0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
19	string		\240\005\371\003\0\011\0\2\0	DOS floppy 720k
&gt;0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
19	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
&gt;0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector

19	string		\240\005\371\005\0\011\0\2\0	DOS floppy 720k, IBM
&gt;0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector
19	string		\100\013\371\005\0\011\0\2\0	DOS floppy 1440k, mkdosfs
&gt;0x1FE	leshort		0xAA55		\b, DOS/MBR hard disk boot sector

19	string		\320\002\370\005\0\011\0\1\0	Atari-ST floppy 360k
19	string		\240\005\371\005\0\011\0\2\0	Atari-ST floppy 720k
#			|       |   |     |     |
#			|       |   |     |     heads
#			|       |   |     sectors/track
#			|       |   sectors/FAT
#			|       media descriptor
#		BPB:	sectors

#  Valid media descriptor bytes for MS-DOS:
#
#     Byte   Capacity   Media Size and Type
#     -------------------------------------------------
#
#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
#     F9     720K       3.5-inch, 2-sided, 9-sector
#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
#     FD     360K       5.25-inch, 2-sided, 9-sector
#     FF     320K       5.25-inch, 2-sided, 8-sector
#     FC     180K       5.25-inch, 1-sided, 9-sector
#     FE     160K       5.25-inch, 1-sided, 8-sector
#     FE     250K       8-inch, 1-sided, single-density
#     FD     500K       8-inch, 2-sided, single-density
#     FE     1.2 MB     8-inch, 2-sided, double-density
#     F8     -----      Fixed disk
#
#     FC     xxxK       Apricot 70x1x9 boot disk.
#
# Originally a bitmap:
#  xxxxxxx0	Not two sided
#  xxxxxxx1	Double sided
#  xxxxxx0x	Not 8 SPT
#  xxxxxx1x	8 SPT
#  xxxxx0xx	Not Removable drive
#  xxxxx1xx	Removable drive
#  11111xxx	Must be one.
#
# But now it&#039;s rather random:
#  111111xx	Low density disk
#        00	SS, Not 8 SPT
#        01	DS, Not 8 SPT
#        10	SS, 8 SPT
#        11	DS, 8 SPT
#
#  11111001	Double density 3 1/2 floppy disk, high density 5 1/4
#  11110000	High density 3 1/2 floppy disk
#  11111000	Hard disk any format
#

# all FAT12 (strength=70) floppies with sectorsize 512 added by Joerg Jenderek at Jun 2013
# http://en.wikipedia.org/wiki/File_Allocation_Table#Exceptions
# Too Weak.
#512		ubelong&amp;0xE0ffff00	0xE0ffff00
# without valid Media descriptor in place of BPB, cases with are done at other places
#&gt;21		ubyte			&lt;0xE5			floppy with old FAT filesystem
# but valid Media descriptor at begin of FAT
#&gt;&gt;512		ubyte			=0xed			720k
#&gt;&gt;512		ubyte			=0xf0			1440k
#&gt;&gt;512		ubyte			=0xf8			720k
#&gt;&gt;512		ubyte			=0xf9			1220k
#&gt;&gt;512		ubyte			=0xfa			320k
#&gt;&gt;512		ubyte			=0xfb			640k
#&gt;&gt;512		ubyte			=0xfc			180k
# look like an an old DOS directory entry
#&gt;&gt;&gt;0xA0E	ubequad			0
#&gt;&gt;&gt;&gt;0xA00	ubequad			!0
#!:mime application/x-ima
#&gt;&gt;512		ubyte			=0xfd
# look for 2nd FAT at different location to distinguish between 360k and 500k
#&gt;&gt;&gt;0x600	ubelong&amp;0xE0ffff00	0xE0ffff00		360k
#&gt;&gt;&gt;0x500	ubelong&amp;0xE0ffff00	0xE0ffff00		500k
#&gt;&gt;&gt;0xA0E	ubequad			0
#!:mime application/x-ima
#&gt;&gt;512		ubyte			=0xfe
#&gt;&gt;&gt;0x400	ubelong&amp;0xE0ffff00	0xE0ffff00		160k
#&gt;&gt;&gt;&gt;0x60E	ubequad			0
#&gt;&gt;&gt;&gt;&gt;0x600	ubequad			!0
#!:mime application/x-ima
#&gt;&gt;&gt;0xC00	ubelong&amp;0xE0ffff00	0xE0ffff00		1200k
#&gt;&gt;512		ubyte			=0xff			320k
#&gt;&gt;&gt;0x60E	ubequad			0
#&gt;&gt;&gt;&gt;0x600	ubequad			!0
#!:mime application/x-ima
#&gt;&gt;512		ubyte			x			\b, Media descriptor 0x%x
# without x86 jump instruction
#&gt;&gt;0		ulelong&amp;0x804000E9	!0x000000E9
# assembler instructions: CLI;MOV SP,1E7;MOV AX;07c0;MOV
#&gt;&gt;&gt;0	ubequad				0xfabce701b8c0078e	\b, MS-DOS 1.12 bootloader
# IOSYS.COM+MSDOS.COM
#&gt;&gt;&gt;&gt;0xc4	use			2xDOS-filename
#&gt;&gt;0		ulelong&amp;0x804000E9	=0x000000E9
# only x86 short jump instruction found
#&gt;&gt;&gt;0		ubyte			=0xEB
#&gt;&gt;&gt;&gt;1		ubyte			x			\b, code offset 0x%x+2
# http://thestarman.pcministry.com/DOS/ibm100/Boot.htm
# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;MOV DX,0
#&gt;&gt;&gt;&gt;(1.b+2)	ubequad			0xfa8cc88ed8ba0000	\b, PC-DOS 1.0 bootloader
# ibmbio.com+ibmdos.com
#&gt;&gt;&gt;&gt;&gt;0x176	use			DOS-filename
#&gt;&gt;&gt;&gt;&gt;0x181	ubyte			x			\b+
#&gt;&gt;&gt;&gt;&gt;0x182	use			DOS-filename
# http://thestarman.pcministry.com/DOS/ibm110/Boot.htm
# assembler instructions: CLI;MOV AX,CS;MOV DS,AX;XOR DX,DX;MOV
#&gt;&gt;&gt;&gt;(1.b+2)	ubequad			0xfa8cc88ed833d28e	\b, PC-DOS 1.1 bootloader
# ibmbio.com+ibmdos.com
#&gt;&gt;&gt;&gt;&gt;0x18b	use			DOS-filename
#&gt;&gt;&gt;&gt;&gt;0x196	ubyte			x			\b+
#&gt;&gt;&gt;&gt;&gt;0x197	use			DOS-filename
# http://en.wikipedia.org/wiki/Zenith_Data_Systems
# assembler instructions: MOV BX,07c0;MOV SS,BX;MOV SP,01c6
#&gt;&gt;&gt;&gt;(1.b+2)	ubequad			0xbbc0078ed3bcc601	\b, Zenith Data Systems MS-DOS 1.25 bootloader
# IO.SYS+MSDOS.SYS
#&gt;&gt;&gt;&gt;&gt;0x20	use			2xDOS-filename
# http://en.wikipedia.org/wiki/Corona_Data_Systems
# assembler instructions: MOV AX,CS;MOV DS,AX;CLI;MOV SS,AX;
#&gt;&gt;&gt;&gt;(1.b+2)	ubequad			0x8cc88ed8fa8ed0bc	\b, MS-DOS 1.25 bootloader
# IO.SYS+MSDOS.SYS
#&gt;&gt;&gt;&gt;&gt;0x69	use			2xDOS-filename
# assembler instructions: CLI;PUSH CS;POP SS;MOV SP,7c00;
#&gt;&gt;&gt;&gt;(1.b+2)	ubequad			0xfa0e17bc007cb860	\b, MS-DOS 2.11 bootloader
# defect IO.SYS+MSDOS.SYS ?
#&gt;&gt;&gt;&gt;&gt;0x162	use			2xDOS-filename

0	name				cdrom
&gt;38913	string   !NSR0      ISO 9660 CD-ROM filesystem data
!:mime	application/x-iso9660-image
!:ext	iso/iso9660
&gt;38913	string    NSR0      UDF filesystem data
!:mime	application/x-iso9660-image
!:ext	iso/udf
&gt;&gt;38917	string    1         (version 1.0)
&gt;&gt;38917	string    2         (version 1.5)
&gt;&gt;38917	string    3         (version 2.0)
&gt;&gt;38917	byte     &gt;0x33      (unknown version, ID 0x%X)
&gt;&gt;38917	byte     &lt;0x31      (unknown version, ID 0x%X)
# The next line is not necessary because the MBR staff is done looking for boot signature
&gt;0x1FE	leshort  0xAA55     (DOS/MBR boot sector)
# &quot;application id&quot; which appears to be used as a volume label
&gt;32808	string/T  &gt;\0       &#039;%s&#039;
&gt;34816	string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
37633	string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
!:mime	application/x-iso9660-image
32777	string    CDROM     High Sierra CD-ROM filesystem data

# CDROM Filesystems
# https://en.wikipedia.org/wiki/ISO_9660
# Modified for UDF by gerardo.cacciari@gmail.com
32769	string    CD001
# mime line at that position does not work
# to display CD-ROM (70=81-11) after MBR (113=40+72+1), partition-table (71=50+21) and before Apple Driver Map (51)
#!:strength -11
# to display CD-ROM (114=81+33) before MBR (113=40+72+1), partition-table (71=50+21) and Apple Driver Map (51)
!:strength +35
&gt;0	use	cdrom

# URL: https://en.wikipedia.org/wiki/NRG_(file_format)
# Reference: https://dl.opendesktop.org/api/files/download/id/1460731811/
#	11577-mount-iso-0.9.5.tar.bz2/mount-iso-0.9.5/install.sh
# From: Joerg Jenderek
# Note:	Only for nero disc with once (DAO) type after 300 KB header
339969	string    CD001	Nero CD image at 0x4B000
!:mime	application/x-nrg
!:ext	nrg
&gt;307200	use cdrom

# .cso files
# Reference: http://pismotec.com/ciso/ciso.h
# NOTE: There are two other formats with the same magic but
# completely incompatible specifications:
# - GameCube/Wii CISO: https://github.com/dolphin-emu/dolphin/blob/master/Source/Core/DiscIO/CISOBlob.h
# - PSP CISO: https://github.com/jamie/ciso/blob/master/ciso.h
0    string    CISO
# Other fields are used to determine what type of CISO this is:
# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
# - None of the above: Compact ISO.
&gt;4	lelong	!0
&gt;&gt;4	lelong	!0x200000
&gt;&gt;&gt;0x10	lelong	!0x800		Compressed ISO CD image

# cramfs filesystem - russell@coker.com.au
0       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
&gt;4      lelong  x size %u
&gt;8      lelong  &amp;1 version #2
&gt;8      lelong  &amp;2 sorted_dirs
&gt;8      lelong  &amp;4 hole_support
&gt;32     lelong  x CRC 0x%x,
&gt;36     lelong  x edition %u,
&gt;40     lelong  x %u blocks,
&gt;44     lelong  x %u files

0       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
&gt;4      belong  x size %u
&gt;8      belong  &amp;1 version #2
&gt;8      belong  &amp;2 sorted_dirs
&gt;8      belong  &amp;4 hole_support
&gt;32     belong  x CRC 0x%x,
&gt;36     belong  x edition %u,
&gt;40     belong  x %u blocks,
&gt;44     belong  x %u files

# reiserfs - russell@coker.com.au
0x10034		string	ReIsErFs	ReiserFS V3.5
0x10034		string	ReIsEr2Fs	ReiserFS V3.6
0x10034		string	ReIsEr3Fs	ReiserFS V3.6.19
&gt;0x1002c 	leshort	x		block size %d
&gt;0x10032	leshort	&amp;2		(mounted or unclean)
&gt;0x10000	lelong	x		num blocks %d
&gt;0x10040	lelong	1		tea hash
&gt;0x10040	lelong	2		yura hash
&gt;0x10040	lelong	3		r5 hash

# EST flat binary format (which isn&#039;t, but anyway)
# From: Mark Brown &lt;broonie@sirena.org.uk&gt;
0	string	ESTFBINR	EST flat binary

# Aculab VoIP firmware
# From: Mark Brown &lt;broonie@sirena.org.uk&gt;
0	string	VoIP\ Startup\ and	Aculab VoIP firmware
&gt;35	string	x	format %s

# From: Mark Brown &lt;broonie@sirena.org.uk&gt; [old]
# From: Behan Webster &lt;behanw@websterwood.com&gt;
0	belong	0x27051956	u-boot legacy uImage,
&gt;32	string	x		%s,
&gt;28	byte	0		Invalid os/
&gt;28	byte	1		OpenBSD/
&gt;28	byte	2		NetBSD/
&gt;28	byte	3		FreeBSD/
&gt;28	byte	4		4.4BSD/
&gt;28	byte	5		Linux/
&gt;28	byte	6		SVR4/
&gt;28	byte	7		Esix/
&gt;28	byte	8		Solaris/
&gt;28	byte	9		Irix/
&gt;28	byte	10		SCO/
&gt;28	byte	11		Dell/
&gt;28	byte	12		NCR/
&gt;28	byte	13		LynxOS/
&gt;28	byte	14		VxWorks/
&gt;28	byte	15		pSOS/
&gt;28	byte	16		QNX/
&gt;28	byte	17		Firmware/
&gt;28	byte	18		RTEMS/
&gt;28	byte	19		ARTOS/
&gt;28	byte	20		Unity OS/
&gt;28	byte	21		INTEGRITY/
&gt;29	byte	0		\bInvalid CPU,
&gt;29	byte	1		\bAlpha,
&gt;29	byte	2		\bARM,
&gt;29	byte	3		\bIntel x86,
&gt;29	byte	4		\bIA64,
&gt;29	byte	5		\bMIPS,
&gt;29	byte	6		\bMIPS 64-bit,
&gt;29	byte	7		\bPowerPC,
&gt;29	byte	8		\bIBM S390,
&gt;29	byte	9		\bSuperH,
&gt;29	byte	10		\bSparc,
&gt;29	byte	11		\bSparc 64-bit,
&gt;29	byte	12		\bM68K,
&gt;29	byte	13		\bNios-32,
&gt;29	byte	14		\bMicroBlaze,
&gt;29	byte	15		\bNios-II,
&gt;29	byte	16		\bBlackfin,
&gt;29	byte	17		\bAVR32,
&gt;29	byte	18		\bSTMicroelectronics ST200,
&gt;29	byte	19		\bSandbox architecture,
&gt;29	byte	20		\bANDES Technology NDS32,
&gt;29	byte	21		\bOpenRISC 1000,
&gt;29	byte	22		\bARM 64-bit,
&gt;29	byte	23		\bDesignWare ARC,
&gt;29	byte	24		\bx86_64,
&gt;29	byte	25		\bXtensa,
&gt;30	byte	0		Invalid Image
&gt;30	byte	1		Standalone Program
&gt;30	byte	2		OS Kernel Image
&gt;30	byte	3		RAMDisk Image
&gt;30	byte	4		Multi-File Image
&gt;30	byte	5		Firmware Image
&gt;30	byte	6		Script File
&gt;30	byte	7		Filesystem Image (any type)
&gt;30	byte	8		Binary Flat Device Tree BLOB
&gt;31	byte	0		(Not compressed),
&gt;31	byte	1		(gzip),
&gt;31	byte	2		(bzip2),
&gt;31	byte	3		(lzma),
&gt;12	belong	x		%d bytes,
&gt;8	bedate	x		%s,
&gt;16	belong	x		Load Address: 0x%08X,
&gt;20	belong	x		Entry Point: 0x%08X,
&gt;4	belong	x		Header CRC: 0x%08X,
&gt;24	belong	x		Data CRC: 0x%08X

# JFFS2 file system
0	leshort	0x1984		Linux old jffs2 filesystem data little endian
0	beshort	0x1984		Linux old jffs2 filesystem data big endian
0	leshort	0x1985		Linux jffs2 filesystem data little endian
0	beshort	0x1985		Linux jffs2 filesystem data big endian

# Squashfs
0	string	sqsh	Squashfs filesystem, big endian,
&gt;28	beshort	x	version %d.
&gt;30	beshort x	\b%d,
&gt;28	beshort &lt;3
&gt;&gt;8	belong	x	%d bytes,
&gt;28	beshort &gt;2
&gt;&gt;28 beshort &lt;4
&gt;&gt;&gt;63	bequad x	%lld bytes,
&gt;&gt;28 beshort &gt;3
&gt;&gt;&gt;40	bequad x	%lld bytes,
#&gt;&gt;67	belong	x	%d bytes,
&gt;4	belong	x	%d inodes,
&gt;28	beshort &lt;2
&gt;&gt;32	beshort	x	blocksize: %d bytes,
&gt;28	beshort &gt;1
&gt;&gt;28 beshort &lt;4
&gt;&gt;&gt;51	belong	x	blocksize: %d bytes,
&gt;&gt;28 beshort &gt;3
&gt;&gt;&gt;12	belong	x	blocksize: %d bytes,
&gt;28 beshort &lt;4
&gt;&gt;39	bedate	x	created: %s
&gt;28 beshort &gt;3
&gt;&gt;8	bedate	x	created: %s
0	string	hsqs	Squashfs filesystem, little endian,
&gt;28	leshort	x	version %d.
&gt;30	leshort	x	\b%d,
&gt;28	leshort &lt;3
&gt;&gt;8	lelong	x	%d bytes,
&gt;28	leshort &gt;2
&gt;&gt;28 leshort &lt;4
&gt;&gt;&gt;63	lequad x	%lld bytes,
&gt;&gt;28 leshort &gt;3
&gt;&gt;&gt;40	lequad x	%lld bytes,
#&gt;&gt;63	lelong	x	%d bytes,
&gt;4	lelong	x	%d inodes,
&gt;28	leshort &lt;2
&gt;&gt;32	leshort	x	blocksize: %d bytes,
&gt;28	leshort &gt;1
&gt;&gt;28 leshort &lt;4
&gt;&gt;&gt;51	lelong	x	blocksize: %d bytes,
&gt;&gt;28 leshort &gt;3
&gt;&gt;&gt;12	lelong	x	blocksize: %d bytes,
&gt;28 leshort &lt;4
&gt;&gt;39	ledate	x	created: %s
&gt;28 leshort &gt;3
&gt;&gt;8	ledate	x	created: %s

# AFS Dump Magic
# From: Ty Sarna &lt;tsarna@sarna.org&gt;
0       string                  \x01\xb3\xa1\x13\x22    AFS Dump
&gt;&amp;0     belong                  x                       (v%d)
&gt;&gt;&amp;0    byte                    0x76
&gt;&gt;&gt;&amp;0   belong                  x                       Vol %d,
&gt;&gt;&gt;&gt;&amp;0  byte                    0x6e
&gt;&gt;&gt;&gt;&gt;&amp;0 string                  x                       %s
&gt;&gt;&gt;&gt;&gt;&gt;&amp;1        byte            0x74
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0       beshort         2
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;4      bedate          x                       on: %s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0      bedate          =0                      full dump
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0      bedate          !0                      incremental since: %s

#----------------------------------------------------------
#delta ISO    Daniel Novotny (dnovotny@redhat.com)
0	string  DISO	Delta ISO data
!:strength +50
&gt;4	belong  x	version %d

# VMS backup savesets - gerardo.cacciari@gmail.com
#
4            string  \x01\x00\x01\x00\x01\x00
&gt;(0.s+16)    string  \x01\x01
&gt;&gt;&amp;(&amp;0.b+8)  byte    0x42       OpenVMS backup saveset data
&gt;&gt;&gt;40        lelong  x          (block size %d,
&gt;&gt;&gt;49        string  &gt;\0        original name &#039;%s&#039;,
&gt;&gt;&gt;2         short   1024       VAX generated)
&gt;&gt;&gt;2         short   2048       AXP generated)
&gt;&gt;&gt;2         short   4096       I64 generated)

# Summary: Oracle Clustered Filesystem
# Created by: Aaron Botsis &lt;redhat@digitalmafia.org&gt;
8	string		OracleCFS	Oracle Clustered Filesystem,
&gt;4	long		x		rev %d
&gt;0	long		x		\b.%d,
&gt;560	string		x		label: %.64s,
&gt;136	string		x		mountpoint: %.128s

# Summary: Oracle ASM tagged volume
# Created by: Aaron Botsis &lt;redhat@digitalmafia.org&gt;
32	string		ORCLDISK	Oracle ASM Volume,
&gt;40	string		x		Disk Name: %0.12s
32	string		ORCLCLRD	Oracle ASM Volume (cleared),
&gt;40	string		x		Disk Name: %0.12s

# Oracle Clustered Filesystem - Aaron Botsis &lt;redhat@digitalmafia.org&gt;
8	string		OracleCFS	Oracle Clustered Filesystem,
&gt;4	long		x		rev %d
&gt;0	long		x		\b.%d,
&gt;560	string		x		label: %.64s,
&gt;136	string		x		mountpoint: %.128s

# Oracle ASM tagged volume - Aaron Botsis &lt;redhat@digitalmafia.org&gt;
32	string		ORCLDISK	Oracle ASM Volume,
&gt;40	string		x		Disk Name: %0.12s
32	string		ORCLCLRD	Oracle ASM Volume (cleared),
&gt;40	string		x		Disk Name: %0.12s

# Compaq/HP RILOE floppy image
# From: Dirk Jagdmann &lt;doj@cubic.org&gt;
0	string	CPQRFBLO	Compaq/HP RILOE floppy image

#------------------------------------------------------------------------------
# Files-11 On-Disk Structure (File system for various RSX-11 and VMS flavours).
# These bits come from LBN 1 (home block) of ODS-1, ODS-2 and ODS-5 volumes,
# which is mapped to VBN 2 of [000000]INDEXF.SYS;1 - gerardo.cacciari@gmail.com
#
1008    string          DECFILE11       Files-11 On-Disk Structure
&gt;525    byte            x               (ODS-%d);
&gt;1017   string          A               RSX-11, VAX/VMS or OpenVMS VAX file system;
&gt;1017   string          B
&gt;&gt;525   byte            2               VAX/VMS or OpenVMS file system;
&gt;&gt;525   byte            5               OpenVMS Alpha or Itanium file system;
&gt;984    string          x               volume label is &#039;%-12.12s&#039;

# From: Thomas Klausner &lt;wiz@NetBSD.org&gt;
# http://filext.com/file-extension/DAA
# describes the daa file format. The magic would be:
0	string		DAA\x0\x0\x0\x0\x0	PowerISO Direct-Access-Archive

# From Albert Cahalan &lt;acahalan@gmail.com&gt;
# really le32 operation,destination,payloadsize (but quite predictable)
# 01 00 00 00 00 00 00 c0 00 02 00 00
0	string		\1\0\0\0\0\0\0\300\0\2\0\0	Marvell Libertas firmware

# From Eric Sandeen
# GFS2
0x10000         belong          0x01161970
&gt;0x10018        belong          0x0000051d      GFS1 Filesystem
&gt;&gt;0x10024        belong          x               (blocksize %d,
&gt;&gt;0x10060        string          &gt;\0             lockproto %s)
&gt;0x10018        belong          0x00000709      GFS2 Filesystem
&gt;&gt;0x10024        belong          x               (blocksize %d,
&gt;&gt;0x10060        string          &gt;\0             lockproto %s)

# Russell Coker &lt;russell@coker.com.au&gt;
0x10040		string	_BHRfS_M	BTRFS Filesystem
&gt;0x1012b	string	&gt;\0		label &quot;%s&quot;,
&gt;0x10090	lelong	x		sectorsize %d,
&gt;0x10094	lelong	x		nodesize %d,
&gt;0x10098	lelong	x		leafsize %d,
&gt;0x10020	belong	x		UUID=%08x-
&gt;0x10024	beshort	x		\b%04x-
&gt;0x10026	beshort	x		\b%04x-
&gt;0x10028	beshort	x		\b%04x-
&gt;0x1002a	beshort	x		\b%04x
&gt;0x1002c	belong	x		\b%08x,
&gt;0x10078	lequad	x		%lld/
&gt;0x10070	lequad	x		\b%lld bytes used,
&gt;0x10088	lequad	x		%lld devices

# dvdisaster&#039;s .ecc
# From: &quot;Nelson A. de Oliveira&quot; &lt;naoliv@gmail.com&gt;
0	string	*dvdisaster*	dvdisaster error correction file

# xfs metadump image
# mb_magic XFSM at 0; superblock magic XFSB at 1 &lt;&lt; mb_blocklog
# but can we do the &lt;&lt; ?  For now it&#039;s always 512 (0x200) anyway.
0	string XFSM
&gt;0x200	string XFSB	XFS filesystem metadump image

# Type:	CROM filesystem
# From:	Werner Fink &lt;werner@suse.de&gt;
0	string	CROMFS	CROMFS
&gt;6	string	&gt;\0	\b version %2.2s,
&gt;8	ulequad	&gt;0	\b block data at %lld,
&gt;16	ulequad	&gt;0	\b fblock table at %lld,
&gt;24	ulequad	&gt;0	\b inode table at %lld,
&gt;32	ulequad	&gt;0	\b root at %lld,
&gt;40	ulelong	&gt;0	\b fblock size = %d,
&gt;44	ulelong	&gt;0	\b block size = %d,
&gt;48	ulequad	&gt;0	\b bytes = %lld

# Type:	xfs metadump image
# From:	Daniel Novotny &lt;dnovotny@redhat.com&gt;
# mb_magic XFSM at 0; superblock magic XFSB at 1 &lt;&lt; mb_blocklog
# but can we do the &lt;&lt; ? For now it&#039;s always 512 (0x200) anyway.
0	string	XFSM
&gt;0x200	string	XFSB	XFS filesystem metadump image

# Type:	delta ISO
# From:	Daniel Novotny &lt;dnovotny@redhat.com&gt;
0	string	DISO	Delta ISO data,
&gt;4	belong	x	version %d

# JFS2 (Journaling File System) image. (Old JFS1 has superblock at 0x1000.)
# See linux/fs/jfs/jfs_superblock.h for layout; see jfs_filsys.h for flags.
# From: Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
0x8000	string	JFS1
# Because it&#039;s text-only magic, check a binary value (version) to be sure.
# Should always be 2, but mkfs.jfs writes it as 1. Needs to be 2 or 1 to be
# mountable.
&gt;&amp;0	lelong	&lt;3	JFS2 filesystem image
# Label is followed by a UUID; we have to limit string length to avoid
# appending the UUID in the case of a 16-byte label.
&gt;&gt;&amp;144	regex	[\x20-\x7E]{1,16}	(label &quot;%s&quot;)
&gt;&gt;&amp;0	lequad	x	\b, %lld blocks
&gt;&gt;&amp;8	lelong	x	\b, blocksize %d
&gt;&gt;&amp;32	lelong&amp;0x00000006	&gt;0	(dirty)
&gt;&gt;&amp;36	lelong	&gt;0	(compressed)

# LFS
0	lelong	0x070162	LFS filesystem image
&gt;4	lelong	1		version 1,
&gt;&gt;8	lelong	x		\b blocks %u,
&gt;&gt;12	lelong	x		\b blocks per segment %u,
&gt;4	lelong	2		version 2,
&gt;&gt;8	lelong	x		\b fragments %u,
&gt;&gt;12	lelong	x		\b bytes per segment %u,
&gt;16	lelong	x		\b disk blocks %u,
&gt;20	lelong	x		\b block size %u,
&gt;24	lelong	x		\b fragment size %u,
&gt;28	lelong	x		\b fragments per block %u,
&gt;32	lelong	x		\b start for free list %u,
&gt;36	lelong	x		\b number of free blocks %d,
&gt;40	lelong	x		\b number of files %u,
&gt;44	lelong	x		\b blocks available for writing %d,
&gt;48	lelong	x		\b inodes in cache %d,
&gt;52	lelong	x		\b inode file disk address 0x%x,
&gt;56	lelong	x		\b inode file inode number %u,
&gt;60	lelong	x		\b address of last segment written 0x%x,
&gt;64	lelong	x		\b address of next segment to write 0x%x,
&gt;68	lelong	x		\b address of current segment written 0x%x

0	string	td\000		floppy image data (TeleDisk, compressed)
0	string	TD\000		floppy image data (TeleDisk)

0	string	CQ\024		floppy image data (CopyQM,
&gt;16	leshort	x		%d sectors,
&gt;18	leshort	x		%d heads.)

0	string	ACT\020Apricot\020disk\020image\032\004	floppy image data (ApriDisk)

0	beshort	0xAA58		floppy image data (IBM SaveDskF, old)
0	beshort	0xAA59		floppy image data (IBM SaveDskF)
0	beshort	0xAA5A		floppy image data (IBM SaveDskF, compressed)

0	string	\074CPM_Disk\076	disk image data (YAZE)

# ReFS
# Richard W.M. Jones &lt;rjones@redhat.com&gt;
0	string	\0\0\0ReFS\0	ReFS filesystem image

# EFW encase image file format:
# Gregoire Passault
# http://www.forensicswiki.org/wiki/Encase_image_file_format
0	string	EVF\x09\x0d\x0a\xff\x00	EWF/Expert Witness/EnCase image file format

# UBIfs
# Linux kernel sources: fs/ubifs/ubifs-media.h
0	lelong	0x06101831
&gt;0x16	leshort	0		UBIfs image
&gt;0x08	lequad	x		\b, sequence number %llu
&gt;0x10	leshort x		\b, length %u
&gt;0x04	lelong	x		\b, CRC 0x%08x

0	lelong	0x23494255
&gt;0x04	leshort	&lt;2
&gt;0x05	string	\0\0\0
&gt;0x1c	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
&gt;0x04	leshort	x		UBI image, version %u

# NEC PC-88 2D disk image
# From Fabio R. Schmidlin &lt;sd-snatcher@users.sourceforge.net&gt;
0x20		ulelong&amp;0xFFFFFEFF	0x2A0
&gt;0x10		string			\0\0\0\0\0\0\0\0\0\0
&gt;&gt;0x280		string			\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
&gt;&gt;&gt;0x1A		ubyte&amp;0xEF		0
&gt;&gt;&gt;&gt;0x1B	ubyte&amp;0x8F		0
&gt;&gt;&gt;&gt;&gt;0x1B	ubyte&amp;70		&lt;0x40
&gt;&gt;&gt;&gt;&gt;&gt;0x1C	ulelong			&gt;0x21
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	regex	[[:print:]]*	NEC PC-88 disk image, name=%s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1B	ubyte	0		\b, media=2D
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1B	ubyte	0x10		\b, media=2DD
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1B	ubyte	0x20		\b, media=2HD
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1B	ubyte	0x30		\b, media=1D
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1B	ubyte	0x40		\b, media=1DD
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1A	ubyte	0x10		\b, write-protected

# HDD Raw Copy Tool disk image, file extension: .imgc
# From Benjamin Vanheuverzwijn &lt;bvanheu@gmail.com&gt;
0	pstring	HDD\ Raw\ Copy\ Tool	%s
&gt;0x100	pstring	x			%s
&gt;0x200	pstring	x			- HD model: %s
#&gt;0x300	pstring	x			unknown %s
&gt;0x400	pstring	x			serial: %s
#&gt;0x500	pstring	x			unknown: %s
!:ext	imgc

#------------------------------------------------------------------------------
# $File: finger,v 1.2 2015/10/07 02:37:57 christos Exp $
# fingerprint:  file(1) magic for fingerprint data
# XPM bitmaps)
#

# http://cgit.freedesktop.org/libfprint/libfprint/tree/libfprint/data.c

0	string	FP1		libfprint fingerprint data V1
&gt;3	beshort	x		\b, driver_id %x
&gt;5	belong	x		\b, devtype %x

0	string	FP2		libfprint fingerprint data V2
&gt;3	beshort	x		\b, driver_id %x
&gt;5	belong	x		\b, devtype %x

#------------------------------------------------------------------------------
# $File: flash,v 1.14 2017/05/25 20:09:55 christos Exp $
# flash:	file(1) magic for Macromedia Flash file format
#
# See
#
#	http://www.macromedia.com/software/flash/open/
#	http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/\
#	en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
#

0   name	swf-details

&gt;0	string		F
&gt;&gt;8	byte&amp;0xfd	0x08		Macromedia Flash data
!:mime	application/x-shockwave-flash
&gt;&gt;&gt;3	byte		x		\b, version %d
&gt;&gt;8	byte&amp;0xfe	0x10		Macromedia Flash data
!:mime	application/x-shockwave-flash
&gt;&gt;&gt;3	byte		x		\b, version %d
&gt;&gt;8	byte		0x18		Macromedia Flash data
!:mime	application/x-shockwave-flash
&gt;&gt;&gt;3	byte		x		\b, version %d
&gt;&gt;8	beshort&amp;0xff87	0x2000		Macromedia Flash data
!:mime	application/x-shockwave-flash
&gt;&gt;&gt;3	byte		x		\b, version %d
&gt;&gt;8	beshort&amp;0xffe0	0x3000		Macromedia Flash data
!:mime	application/x-shockwave-flash
&gt;&gt;&gt;3	byte		x		\b, version %d
&gt;&gt;8	byte&amp;0x7	0
&gt;&gt;&gt;8	ubyte		&gt;0x2f
&gt;&gt;&gt;&gt;9	ubyte		&lt;0x20		Macromedia Flash data
!:mime	application/x-shockwave-flash
&gt;&gt;&gt;&gt;&gt;3	byte		x		\b, version %d

&gt;0	string		C
&gt;&gt;8	byte		0x78		Macromedia Flash data (compressed)
!:mime	application/x-shockwave-flash
&gt;&gt;&gt;3	byte		x		\b, version %d

&gt;0	string		Z
&gt;&gt;8	byte		0x5d		Macromedia Flash data (lzma compressed)
!:mime	application/x-shockwave-flash
&gt;&gt;&gt;3	byte		x		\b, version %d


1	string		WS
&gt;4	ulelong		&gt;14
&gt;&gt;3	ubyte		!0
&gt;&gt;&gt;0	use		swf-details

# From: Cal Peake &lt;cp@absolutedigital.net&gt;
0	string		FLV\x01		Macromedia Flash Video
!:mime	video/x-flv

#
# Yosu Gomez
0	string	AGD2\xbe\xb8\xbb\xcd\x00	Macromedia Freehand 7 Document
0	string	AGD3\xbe\xb8\xbb\xcc\x00	Macromedia Freehand 8 Document
# From Dave Wilson
0	string	AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document

#------------------------------------------------------------------------------
#	$File: flif,v 1.1 2015/11/23 22:04:36 christos Exp $
#	flif:	Magic	data	for	file(1)	command.
#	FLIF	(Free	Lossless	Image	Format)

0	string	FLIF	FLIF
&gt;4	string	&lt;H	image data
&gt;&gt;6	beshort	x	\b, %u
&gt;&gt;8	beshort	x	\bx%u
&gt;&gt;5	string	1	\b, 8-bit/color,
&gt;&gt;5	string	2	\b, 16-bit/color,
&gt;&gt;4	string	1	\b, grayscale, non-interlaced
&gt;&gt;4	string	3	\b, RGB, non-interlaced
&gt;&gt;4	string	4	\b, RGBA, non-interlaced
&gt;&gt;4	string	A	\b, grayscale
&gt;&gt;4	string	C	\b, RGB, interlaced
&gt;&gt;4	string	D	\b, RGBA, interlaced
&gt;4	string	&gt;H	\b, animation data
&gt;&gt;5	ubyte	&lt;255	\b, %i frames
&gt;&gt;&gt;7	beshort	x	\b, %u
&gt;&gt;&gt;9	beshort	x	\bx%u
&gt;&gt;&gt;6	string	=1	\b, 8-bit/color
&gt;&gt;&gt;6	string	=2	\b, 16-bit/color
&gt;&gt;5	ubyte	0xFF
&gt;&gt;&gt;6	beshort	x	\b, %i frames,
&gt;&gt;&gt;9	beshort	x	\b, %u
&gt;&gt;&gt;11	beshort	x	\bx%u
&gt;&gt;&gt;8	string	=1	\b, 8-bit/color
&gt;&gt;&gt;8	string	=2	\b, 16-bit/color
&gt;&gt;4	string	=Q	\b, grayscale, non-interlaced
&gt;&gt;4	string	=S	\b, RGB, non-interlaced
&gt;&gt;4	string	=T	\b, RGBA, non-interlaced
&gt;&gt;4	string	=a	\b, grayscale
&gt;&gt;4	string	=c	\b, RGB, interlaced
&gt;&gt;4	string	=d	\b, RGBA, interlaced

#------------------------------------------------------------------------------
# $File: fonts,v 1.38 2017/11/14 15:48:36 christos Exp $
# fonts:  file(1) magic for font data
#
0	search/1	FONT		ASCII vfont text
0	short		0436		Berkeley vfont data
0	short		017001		byte-swapped Berkeley vfont data

# PostScript fonts (must precede &quot;printer&quot; entries), quinlan@yggdrasil.com
0	string		%!PS-AdobeFont-1.	PostScript Type 1 font text
&gt;20	string		&gt;\0			(%s)
6	string		%!PS-AdobeFont-1.	PostScript Type 1 font program data
0	string		%!FontType1	PostScript Type 1 font program data
6	string		%!FontType1	PostScript Type 1 font program data
0	string		%!PS-Adobe-3.0\ Resource-Font	PostScript Type 1 font text

# Summary:	PostScript Type 1 Printer Font Metrics
# URL:		https://en.wikipedia.org/wiki/PostScript_fonts
# Reference:	http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
# Modified by:	Joerg Jenderek
# Note:		moved from ./msdos magic
# dfVersion 256=0100h
0		uleshort	0x0100
# GRR: line above is too general as it catches also TrueType font,
# raw G3 data FAX, WhatsApp encrypted and Panorama database
# dfType 129=0081h
&gt;66		uleshort	0x0081
# dfVertRes 300=012Ch not needed as additional test
#&gt;&gt;70		uleshort	0x012c
# dfHorizRes 300=012Ch
#&gt;&gt;&gt;72		uleshort	0x012c
# dfDriverInfo points to postscript information section
&gt;&gt;(101.l)	string/c	Postscript	Printer Font Metrics
# above labeled &quot;PFM data&quot; by ./msdos (version 5.28) or &quot;Adobe Printer Font Metrics&quot; by TrID
!:mime	application/x-font-pfm
# AppleShare Print Server
#!:apple	ASPS????
!:ext	pfm
# dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking
#&gt;&gt;&gt;6		string		&gt;\060		- %-.60s
# dfDriverInfo
&gt;&gt;&gt;139		ulelong		&gt;0
# often abbreviated and same as filename
&gt;&gt;&gt;&gt;(139.l)	string		x		%s
# dfSize
&gt;&gt;&gt;2		ulelong		x		\b, %d bytes
# dfFace 210=D2h 9Eh
&gt;&gt;&gt;105		ulelong		&gt;0
# Windows font name
&gt;&gt;&gt;&gt;(105.l)	string		x		\b, %s
# dfItalic
&gt;&gt;&gt;80		ubyte		1		italic
# dfUnderline
&gt;&gt;&gt;81		ubyte		1		underline
# dfStrikeOut
&gt;&gt;&gt;82		ubyte		1		strikeout
# dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc
&gt;&gt;&gt;83		uleshort	&gt;699		bold
# dfPitchAndFamily 16 17 48 49 64 65
&gt;&gt;&gt;90		ubyte		16		serif
&gt;&gt;&gt;90		ubyte		17		serif proportional
#&gt;&gt;&gt;90		ubyte		48		other
&gt;&gt;&gt;90		ubyte		49		proportional
&gt;&gt;&gt;90		ubyte		64		script
&gt;&gt;&gt;90		ubyte		65		script proportional

# X11 font files in SNF (Server Natural Format) format
# updated by Joerg Jenderek at Feb 2013
# http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm
0	belong		00000004		X11 SNF font data, MSB first
#&gt;104	belong		00000004		X11 SNF font data, MSB first
!:mime	application/x-font-sfn
# GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
0	lelong		00000004
&gt;104	lelong		00000004		X11 SNF font data, LSB first
!:mime	application/x-font-sfn

# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0	search/1	STARTFONT\ 		X11 BDF font text

# From: Joerg Jenderek
# URL: http://grub.gibibit.com/New_font_format
# Reference: util/grub-mkfont.c
#		include/grub/fontformat.h
# FONT_FORMAT_SECTION_NAMES_FILE
0			string		FILE
# FONT_FORMAT_PFF2_MAGIC
&gt;8			string		PFF2
# leng 4 only at the moment
&gt;&gt;4			ubelong		4
# FONT_FORMAT_SECTION_NAMES_FONT_NAME
&gt;&gt;&gt;12			string		NAME		GRUB2 font
!:mime			application/x-font-pf2
!:ext			pf2
# length of font_name
&gt;&gt;&gt;&gt;16			ubelong		&gt;0
# font_name
&gt;&gt;&gt;&gt;&gt;20			string		&gt;\0		&quot;%-s&quot;

# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions (&quot;MIPSEL MIPS-II COFF&quot; collides)
0	string		\001fcp			X11 Portable Compiled Font data,
&gt;12	lelong		^0x08			bit: LSB,
&gt;12	lelong		&amp;0x08			bit: MSB,
&gt;12	lelong		^0x04			byte: LSB first
&gt;12	lelong		&amp;0x04			byte: MSB first
0	string		D1.0\015		X11 Speedo font data

#------------------------------------------------------------------------------
# FIGlet fonts and controlfiles
# From figmagic supplied with Figlet version 2.2
# &quot;David E. O&#039;Brien&quot; &lt;obrien@FreeBSD.ORG&gt;
0	string		flf		FIGlet font
&gt;3	string		&gt;2a		version %-2.2s
0	string		flc		FIGlet controlfile
&gt;3	string		&gt;2a		version %-2.2s

# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
0	belong		0x14025919	libGrx font data,
&gt;8	leshort		x		%dx
&gt;10	leshort		x		\b%d
&gt;40	string		x		%s
# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
0	belong		0xff464f4e	DOS code page font data collection
7	belong		0x00454741	DOS code page font data
7	belong		0x00564944	DOS code page font data (from Linux?)
4098	string		DOSFONT		DOSFONT2 encrypted font data

# downloadable fonts for browser (prints type) anthon@mnt.org
# https://tools.ietf.org/html/rfc3073
0	string		PFR1		Portable Font Resource font data (new)
&gt;102	string		&gt;0		\b: %s
0	string		PFR0		Portable Font Resource font data (old)
&gt;4	beshort		&gt;0		version %d

# True Type fonts
# Modified by: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/TrueType
# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/
#
# sfnt version &quot;typ1&quot; used by some Apple, but no example found
0	string	typ1
&gt;0	use		sfnt-font
&gt;0	use		sfnt-names
# sfnt version &quot;true&quot; used by some Apple
0	string	true
&gt;0	use		sfnt-font
&gt;0	use		sfnt-names
# GRR: below test is too general
# sfnt version often 0x00010000
0	string	\000\001\000\000
&gt;0	use		sfnt-font
&gt;0	use		sfnt-names
#	validate and display sfnt font data like number of tables
0	name		sfnt-font
# file 5.30 version assumes 00FFh as maximal number of tables
#&gt;4	ubeshort	&lt;0x0100		
# maximal 27 tables found like in Skia.ttf
# 46 different table names mentioned on Apple specification
# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number
&gt;4	ubeshort	&lt;47		
# skip bad examples with garbage table names like in a5.show HYPERC MAC
# tag names consist of up to four characters padded with spaces at end like
# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ...
&gt;&gt;12	regex/4l	\^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ]	
#&gt;&gt;&gt;0	ubelong	x	\b, sfnt version 0x%x
&gt;&gt;&gt;0	ubelong	!0x4f54544f	TrueType
!:mime	application/font-sfnt
#!:mime	font/ttf
!:apple	????tfil
# .ttf for TrueType font
# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe
!:ext	ttf/tte
# sfnt version 4F54544Fh~OTTO
&gt;&gt;&gt;0	ubelong	=0x4f54544f	OpenType
!:mime	application/font-sfnt
#!:mime	font/otf
!:apple	????OTTO
!:ext	otf
&gt;&gt;&gt;0	ubelong	x		Font data
# DSIG=44454947h table name implies a digitally signed font
# search range = number of tables * 16 =&lt; maximal number of tables * 16 = 27 * 16 = 432
&gt;&gt;&gt;12	search/432	DSIG		\b, digitally signed
&gt;&gt;&gt;4	ubeshort	x		\b, %d tables
# minimal 9 tables found like in NISC18030.ttf
#&gt;&gt;&gt;4	ubeshort	&lt;10		TMIN
#&gt;&gt;&gt;4	ubeshort	&gt;24		TBIG
# table directory entries
&gt;&gt;&gt;12	string		x		\b, 1st &quot;%4.4s&quot;

#	search and display 1st name in sfnt font which is often copyright text
#	does not work inside font collections
0	name		sfnt-names
# search for naming table
&gt;12	search/432/s	name		
# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf
#&gt;&gt;&gt;&gt;&amp;8	ubelong		&gt;0x0100bd27	BIGGEST OFFSET
&gt;&gt;&amp;8	ubelong		&gt;0x00100000	
# offset of name table
&gt;&gt;&gt;&amp;-4	ubelong		x		\b, name offset 0x%x
# GRR: pointer to name table only works if offset ~&lt; FILE_BYTES_MAX = 100000h defined in src\file.h
&gt;&gt;&amp;8	ubelong		&lt;0x00100000	
&gt;&gt;&gt;&amp;-16	ubelong		x		
# name table
&gt;&gt;&gt;&gt;(&amp;8.L)	ubequad	x		
# invalid format selector 
#&gt;&gt;&gt;&gt;&gt;&amp;-8	ubeshort	!0	\b, invalid selector %x
# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf
# maximal 1227 name records found like in Apple Chancery.ttf
#&gt;&gt;&gt;&gt;&gt;&amp;-6	ubeshort	&lt;0x4	mincount
#&gt;&gt;&gt;&gt;&gt;&amp;-6	ubeshort	&gt;130	maxcount
&gt;&gt;&gt;&gt;&gt;&amp;-6	ubeshort	x	\b, %d names
# offset to start of string storage from start of table
#&gt;&gt;&gt;&gt;&gt;&amp;-4	ubeshort	x	\b, record offset %d
# 1st name record
# string offset from start of storage area 
#&gt;&gt;&gt;&gt;&gt;&amp;8		ubeshort	x	\b, string offset %d
# string length
#&gt;&gt;&gt;&gt;&gt;&amp;6		ubeshort	x	\b, string length %d
# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf
# also found 0 like in SWZCONLN.TTF
#&gt;&gt;&gt;&gt;&gt;&amp;6		ubeshort	&lt;8	MIN STRING
# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf
#&gt;&gt;&gt;&gt;&gt;&amp;6		ubeshort	&gt;805	MAX STRING
# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft
#&gt;&gt;&gt;&gt;&gt;&amp;-2	ubeshort	&gt;3	BAD PLATFORM
&gt;&gt;&gt;&gt;&gt;&amp;-2	ubeshort	0	\b, Unicode
&gt;&gt;&gt;&gt;&gt;&amp;-2	ubeshort	1	\b, Macintosh
&gt;&gt;&gt;&gt;&gt;&amp;-2	ubeshort	3	\b, Microsoft
# languageID (0~english Macintosh, 0409h~english Microsoft, ...)
&gt;&gt;&gt;&gt;&gt;&amp;2		ubeshort	&gt;0	\b, language 0x%x
# name identifiers
# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ...
&gt;&gt;&gt;&gt;&gt;&amp;4		ubeshort	&gt;0	\b, type %d string
# platform specific encoding:
# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0
#&gt;&gt;&gt;&gt;&gt;&amp;0		ubeshort	x	\b, %d encoding
&gt;&gt;&gt;&gt;&gt;&amp;0		ubeshort	0	
# handle only name string offset 0 because do not know how to add 2 relative offsets
&gt;&gt;&gt;&gt;&gt;&gt;&amp;6		ubeshort	0	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;(&amp;-14.S-18)	ubyte		!0	
# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h
# often copyright string that starts like \251 2006 The Monotype Corporation
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-1		string		x	\b, %-11.96s
# test for unicode string
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;(&amp;-14.S-18)	ubyte		0	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0		lestring16	x	\b, %-11.96s
# unicode encoding
&gt;&gt;&gt;&gt;&gt;&amp;0		ubeshort	&gt;0	
&gt;&gt;&gt;&gt;&gt;&gt;&amp;6		ubeshort	0	
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;(&amp;-14.S-17)	lestring16	x	\b, %-11.96s

0	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
0	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font

# TrueType/OpenType font collections (.ttc)
# URL: https://en.wikipedia.org/wiki/OpenType
# http://www.microsoft.com/typography/otspec/otff.htm
# Modified by: Joerg Jenderek
# Note:	container for TrueType, OpenType font
0	string		ttcf
# skip ASCII text
&gt;4	ubyte		0		
# sfnt version often 0x00010000 of 1st table is TrueType
&gt;&gt;(12.L)	ubelong	!0x4f54544f	TrueType
#!:mime	font/ttf
!:apple	????tfil
!:ext	ttc
# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font 
&gt;&gt;(12.L)	ubelong	=0x4f54544f	OpenType
#!:mime	font/otf
!:apple	????OTTO
# no example found for otc
!:ext	ttc/otc
&gt;&gt;4	ubyte		x		font collection data
!:mime	application/font-sfnt
#!:mime	font/collection
# TCC version
&gt;&gt;4	belong		0x00010000	\b, 1.0
&gt;&gt;4	belong		0x00020000	\b, 2.0
&gt;&gt;8	ubelong		&gt;0		\b, %d fonts
# array offset size = fonts * offsetsize = fonts * 4
&gt;&gt;(8.L*4) ubequad	x		
# 0x44454947 = &#039;DSIG&#039;
&gt;&gt;&gt;&amp;4	belong		0x44534947	\b, digitally signed
# offset to 1st font
&gt;&gt;12	ubelong		x		\b, at 0x%x
# point to 1st font that starts with sfnt version
&gt;&gt;(12.L) use		sfnt-font

# Opentype font data from Avi Bercovich
0	string		OTTO		OpenType font data
!:mime application/vnd.ms-opentype

# From: Alex Myczko &lt;alex@aiei.ch&gt;
0	string		SplineFontDB:	Spline Font Database
!:mime application/vnd.font-fontforge-sfd
&gt;14	string		x		version %s

# EOT
0x40	string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
&gt;0x22	string		LP		Embedded OpenType (EOT)
# workaround until there&#039;s lepstring16
# &gt;&gt;0x52	lepstring16/h	&gt;\0		\b, %s family
&gt;&gt;0x52	short	!0
&gt;&gt;&gt;0x54	lestring16	x		\b, %s family
!:mime application/vnd.ms-fontobject

# Web Open Font Format (.woff)
0	name		woff
&gt;4	belong		0x00010000	\b, TrueType
&gt;4	belong		0x4F54544F	\b, CFF
&gt;4	belong		0x74727565	\b, TrueType
&gt;4	default		x
&gt;&gt;4	belong		x		\b, flavor %d
&gt;8	belong		x		\b, length %d
#&gt;12	beshort		x		\b, numTables %d
#&gt;14	beshort		x		\b, reserved %d
#&gt;16	belong		x		\b, totalSfntSize %d

# http://www.w3.org/TR/WOFF/
0	string		wOFF	Web Open Font Format
&gt;0	use		woff
&gt;20	beshort		x	\b, version %d
&gt;22	beshort		x	\b.%d
# http://www.w3.org/TR/WOFF2/
0	string		wOF2	Web Open Font Format (Version 2)
&gt;0	use		woff
#&gt;20	belong		x	\b, totalCompressedSize %d
&gt;24	beshort		x	\b, version %d
&gt;26	beshort		x	\b.%d

#------------------------------------------------------------------------------
# $File: fortran,v 1.10 2015/11/05 18:47:16 christos Exp $
# FORTRAN source
# Check that the first 100 lines start with C or whitespace first.
0       regex/100l      !\^[^Cc\ \t].*$
&gt;0	regex/100l	\^[Cc][\ \t]	FORTRAN program text
!:mime	text/x-fortran
!:strength - 5

#------------------------------------------------------------------------------
# $File: frame,v 1.13 2015/08/29 07:10:35 christos Exp $
# frame:  file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is &quot;published&quot; as witness the following:
#
# Note that this is the Framemaker Maker Interchange Format, not the
# Normal format which would be application/vnd.framemaker.
#
0	string		\&lt;MakerFile	FrameMaker document
!:mime	application/x-mif
&gt;11	string		5.5		 (5.5
&gt;11	string		5.0		 (5.0
&gt;11	string		4.0		 (4.0
&gt;11	string		3.0		 (3.0
&gt;11	string		2.0		 (2.0
&gt;11	string		1.0		 (1.0
&gt;14	byte		x		  %c)
0	string		\&lt;MIFFile	FrameMaker MIF (ASCII) file
!:mime	application/x-mif
&gt;9	string		4.0		 (4.0)
&gt;9	string		3.0		 (3.0)
&gt;9	string		2.0		 (2.0)
&gt;9	string		1.0		 (1.x)
0	search/1	\&lt;MakerDictionary	FrameMaker Dictionary text
!:mime	application/x-mif
&gt;17	string		3.0		 (3.0)
&gt;17	string		2.0		 (2.0)
&gt;17	string		1.0		 (1.x)
0	string		\&lt;MakerScreenFont	FrameMaker Font file
!:mime	application/x-mif
&gt;17	string		1.01		 (%s)
0	string		\&lt;MML		FrameMaker MML file
!:mime	application/x-mif
0	string		\&lt;BookFile	FrameMaker Book file
!:mime	application/x-mif
&gt;10	string		3.0		 (3.0
&gt;10	string		2.0		 (2.0
&gt;10	string		1.0		 (1.0
&gt;13	byte		x		  %c)
# XXX - this book entry should be verified, if you find one, uncomment this
#0	string		\&lt;Book\040 	FrameMaker Book (ASCII) file
#!:mime	application/x-mif
#&gt;6	string		3.0		 (3.0)
#&gt;6	string		2.0		 (2.0)
#&gt;6	string		1.0		 (1.0)
0	string		\&lt;Maker\040Intermediate\040Print\040File	FrameMaker IPL file
!:mime	application/x-mif

#------------------------------------------------------------------------------
# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $
# freebsd:  file(1) magic for FreeBSD objects
#
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
# little-endian on x86).
#
# XXX - this comes from the file &quot;freebsd&quot; in a recent FreeBSD version of
# &quot;file&quot;; it, and the NetBSD stuff in &quot;netbsd&quot;, appear to use different
# schemes for distinguishing between executable images, shared libraries,
# and object files.
#
# FreeBSD says:
#
#    Regardless of whether it&#039;s pure, demand-paged, or none of the
#    above:
#
#	if the entry point is &lt; 4096, then it&#039;s a shared library if
#	the &quot;has run-time loader information&quot; bit is set, and is
#	position-independent if the &quot;is position-independent&quot; bit
#	is set;
#
#	if the entry point is &gt;= 4096 (or &gt;4095, same thing), then it&#039;s
#	an executable, and is dynamically-linked if the &quot;has run-time
#	loader information&quot; bit is set.
#
# On x86, NetBSD says:
#
#    If it&#039;s neither pure nor demand-paged:
#
#	if it has the &quot;has run-time loader information&quot; bit set, it&#039;s
#	a dynamically-linked executable;
#
#	if it doesn&#039;t have that bit set, then:
#
#	    if it has the &quot;is position-independent&quot; bit set, it&#039;s
#	    position-independent;
#
#	    if the entry point is non-zero, it&#039;s an executable, otherwise
#	    it&#039;s an object file.
#
#    If it&#039;s pure:
#
#	if it has the &quot;has run-time loader information&quot; bit set, it&#039;s
#	a dynamically-linked executable, otherwise it&#039;s just an
#	executable.
#
#    If it&#039;s demand-paged:
#
#	if it has the &quot;has run-time loader information&quot; bit set,
#	then:
#
#	    if the entry point is &lt; 4096, it&#039;s a shared library;
#
#	    if the entry point is = 4096 or &gt; 4096 (i.e., &gt;= 4096),
#	    it&#039;s a dynamically-linked executable);
#
#	if it doesn&#039;t have the &quot;has run-time loader information&quot; bit
#	set, then it&#039;s just an executable.
#
# (On non-x86, NetBSD does much the same thing, except that it uses
# 8192 on 68K - except for &quot;68k4k&quot;, which is presumably &quot;68K with 4K
# pages - SPARC, and MIPS, presumably because Sun-3&#039;s and Sun-4&#039;s
# had 8K pages; dunno about MIPS.)
#
# I suspect the two will differ only in perverse and uninteresting cases
# (&quot;shared&quot; libraries that aren&#039;t demand-paged and whose pages probably
# won&#039;t actually be shared, executables with entry points &lt;4096).
#
# I leave it to those more familiar with FreeBSD and NetBSD to figure out
# what the right answer is (although using &quot;&gt;4095&quot;, FreeBSD-style, is
# probably better than separately checking for &quot;=4096&quot; and &quot;&gt;4096&quot;,
# NetBSD-style).  (The old &quot;netbsd&quot; file analyzed FreeBSD demand paged
# executables using the NetBSD technique.)
#
0	lelong&amp;0377777777	041400407	FreeBSD/i386
&gt;20	lelong			&lt;4096
&gt;&gt;3	byte&amp;0xC0		&amp;0x80		shared library
&gt;&gt;3	byte&amp;0xC0		0x40		PIC object
&gt;&gt;3	byte&amp;0xC0		0x00		object
&gt;20	lelong			&gt;4095
&gt;&gt;3	byte&amp;0x80		0x80		dynamically linked executable
&gt;&gt;3	byte&amp;0x80		0x00		executable
&gt;16	lelong			&gt;0		not stripped

0	lelong&amp;0377777777	041400410	FreeBSD/i386 pure
&gt;20	lelong			&lt;4096
&gt;&gt;3	byte&amp;0xC0		&amp;0x80		shared library
&gt;&gt;3	byte&amp;0xC0		0x40		PIC object
&gt;&gt;3	byte&amp;0xC0		0x00		object
&gt;20	lelong			&gt;4095
&gt;&gt;3	byte&amp;0x80		0x80		dynamically linked executable
&gt;&gt;3	byte&amp;0x80		0x00		executable
&gt;16	lelong			&gt;0		not stripped

0	lelong&amp;0377777777	041400413	FreeBSD/i386 demand paged
&gt;20	lelong			&lt;4096
&gt;&gt;3	byte&amp;0xC0		&amp;0x80		shared library
&gt;&gt;3	byte&amp;0xC0		0x40		PIC object
&gt;&gt;3	byte&amp;0xC0		0x00		object
&gt;20	lelong			&gt;4095
&gt;&gt;3	byte&amp;0x80		0x80		dynamically linked executable
&gt;&gt;3	byte&amp;0x80		0x00		executable
&gt;16	lelong			&gt;0		not stripped

0	lelong&amp;0377777777	041400314	FreeBSD/i386 compact demand paged
&gt;20	lelong			&lt;4096
&gt;&gt;3	byte&amp;0xC0		&amp;0x80		shared library
&gt;&gt;3	byte&amp;0xC0		0x40		PIC object
&gt;&gt;3	byte&amp;0xC0		0x00		object
&gt;20	lelong			&gt;4095
&gt;&gt;3	byte&amp;0x80		0x80		dynamically linked executable
&gt;&gt;3	byte&amp;0x80		0x00		executable
&gt;16	lelong			&gt;0		not stripped

# XXX gross hack to identify core files
# cores start with a struct tss; we take advantage of the following:
# byte 7:     highest byte of the kernel stack pointer, always 0xfe
#      8/9:   kernel (ring 0) ss value, always 0x0010
#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
#      28:    low order byte of the current PTD entry, always 0 since the
#             PTD is page-aligned
#
7	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
&gt;1039	string	&gt;\0	from &#039;%s&#039;

# /var/run/ld.so.hints
# What are you laughing about?
0	lelong			011421044151	ld.so hints file (Little Endian
&gt;4	lelong			&gt;0		\b, version %d)
&gt;4	belong			&lt;1		\b)
0	belong			011421044151	ld.so hints file (Big Endian
&gt;4	belong			&gt;0		\b, version %d)
&gt;4	belong			&lt;1		\b)

#
# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
#
0	string	SCRSHOT_	scrshot(1) screenshot,
&gt;8	byte	x		version %d,
&gt;9	byte	2		%d bytes in header,
&gt;&gt;10	byte	x		%d chars wide by
&gt;&gt;11	byte	x		%d chars high

#------------------------------------------------------------------------------
# $File: fsav,v 1.14 2017/03/17 21:35:28 christos Exp $
# fsav:  file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)

# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
0	beshort		0x1575		fsav macro virus signatures
&gt;8	leshort		&gt;0		(%d-
&gt;11	byte		&gt;0		\b%02d-
&gt;10	byte		&gt;0		\b%02d)
# ftp://ftp.f-prot.com/pub/sign.zip
#10	ubyte		&lt;12
#&gt;9	ubyte		&lt;32
#&gt;&gt;8	ubyte		0x0a
#&gt;&gt;&gt;12	ubyte		0x07
#&gt;&gt;&gt;&gt;11	uleshort	&gt;0		fsav DOS/Windows virus signatures (%d-
#&gt;&gt;&gt;&gt;10	byte		0		\b01-
#&gt;&gt;&gt;&gt;10	byte		1		\b02-
#&gt;&gt;&gt;&gt;10	byte		2		\b03-
#&gt;&gt;&gt;&gt;10	byte		3		\b04-
#&gt;&gt;&gt;&gt;10	byte		4		\b05-
#&gt;&gt;&gt;&gt;10	byte		5		\b06-
#&gt;&gt;&gt;&gt;10	byte		6		\b07-
#&gt;&gt;&gt;&gt;10	byte		7		\b08-
#&gt;&gt;&gt;&gt;10	byte		8		\b09-
#&gt;&gt;&gt;&gt;10	byte		9		\b10-
#&gt;&gt;&gt;&gt;10	byte		10		\b11-
#&gt;&gt;&gt;&gt;10	byte		11		\b12-
#&gt;&gt;&gt;&gt;9	ubyte		&gt;0		\b%02d)
# ftp://ftp.f-prot.com/pub/sign2.zip
#0	ubyte		0x62
#&gt;1	ubyte		0xF5
#&gt;&gt;2	ubyte		0x1
#&gt;&gt;&gt;3	ubyte		0x1
#&gt;&gt;&gt;&gt;4	ubyte		0x0e
#&gt;&gt;&gt;&gt;&gt;13		ubyte	&gt;0		fsav virus signatures
#&gt;&gt;&gt;&gt;&gt;&gt;11	ubyte	x		size 0x%02x
#&gt;&gt;&gt;&gt;&gt;&gt;12	ubyte	x		\b%02x
#&gt;&gt;&gt;&gt;&gt;&gt;13	ubyte	x		\b%02x bytes

# Joerg Jenderek: joerg dot jenderek at web dot de
# http://www.clamav.net/doc/latest/html/node45.html
# .cvd files start with a 512 bytes colon separated header
# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
# + gzipped tarball files
0	string		ClamAV-VDB:
&gt;11	string		&gt;\0		Clam AntiVirus database %-.23s
&gt;&gt;34	string		:
&gt;&gt;&gt;35		string		!:	\b, version
&gt;&gt;&gt;&gt;35		string		x 	\b %-.1s
&gt;&gt;&gt;&gt;&gt;36		string		!:
&gt;&gt;&gt;&gt;&gt;&gt;36	string		x 	\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;37	string		!:
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;37	string		x 	\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;38	string		!:
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;38	string		x 	\b%-.1s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;39	string		!:
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;39	string		x 	\b%-.1s
&gt;512	string		\037\213	\b, gzipped
&gt;769	string		ustar\0		\b, tarred

# Type: Grisoft AVG AntiVirus
# From: David Newgas &lt;david@newgas.net&gt;
0	string	AVG7_ANTIVIRUS_VAULT_FILE	AVG 7 Antivirus vault file data

0	string	X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR
&gt;33	string	-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*	EICAR virus test files

#------------------------------------------------------------------------------
# $File: fusecompress,v 1.2 2011/08/08 09:05:55 christos Exp $
# fusecompress:   file(1) magic for fusecompress
0	string	\037\135\211	FuseCompress(ed) data
&gt;3	byte	0x00	(none format)
&gt;3	byte	0x01	(bz2 format)
&gt;3	byte	0x02	(gz format)
&gt;3	byte	0x03	(lzo format)
&gt;3	byte	0x04	(xor format)
&gt;3	byte	&gt;0x04	(unknown format)
&gt;4	long	x	uncompressed size: %d

#------------------------------------------------------------------------------
# $File: games,v 1.16 2017/10/19 16:40:37 christos Exp $
# games:  file(1) for games

# Fabio Bonelli &lt;fabiobonelli@libero.it&gt;
# Quake II - III data files
0       string  IDP2        	Quake II 3D Model file,
&gt;20     long    x               %u skin(s),
&gt;8      long    x               (%u x
&gt;12     long    x 		%u),
&gt;40     long    x               %u frame(s),
&gt;16     long    x               Frame size %u bytes,
&gt;24     long  	x               %u vertices/frame,
&gt;28     long    x            	%u texture coordinates,
&gt;32     long    x               %u triangles/frame

0       string  IBSP            Quake
&gt;4      long    0x26            II Map file (BSP)
&gt;4      long    0x2E      	III Map file (BSP)

0       string  IDS2            Quake II SP2 sprite file

#---------------------------------------------------------------------------
# Doom and Quake
# submitted by Nicolas Patrois

0       string  \xcb\x1dBoom\xe6\xff\x03\x01    Boom or linuxdoom demo
# some doom lmp files don&#039;t match, I&#039;ve got one beginning with \x6d\x02\x01\x01

24      string  LxD\ 203        Linuxdoom save
&gt;0      string  x       , name=%s
&gt;44     string  x       , world=%s

# Quake

# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/PAK
# reference: https://quakewiki.org/wiki/.pak
# GRR: line below is too general as it matches also Acorn PackDir compressed Archive
# and Git pack ./revision
0       string  PACK    
# real Quake examples like pak0.pak have only some hundreds like 150 files
# So test for few files
&gt;8	ulelong &lt;0x01000000	
# in file version 5.32 test for null terminator is only true for
# offset ~&lt; FILE_BYTES_MAX = 1 MB defined in ../../src/file.h 
# look for null terminator of 1st entry name
&gt;&gt;(4.l+55)	ubyte	0	Quake I or II world or extension
!:mime	application/x-dzip
!:ext	pak
#&gt;&gt;&gt;8	ulelong	x	\b, table size %u
# dividing this by entry size (64) gives number of files
&gt;&gt;&gt;8	ulelong/64 x	\b, %u files
# offset to the beginning of the file table
&gt;&gt;&gt;4	ulelong	x	\b, offset 0x%x
# 1st file entry
&gt;&gt;&gt;(4.l)	use	pak-entry
# 2nd file entry
#&gt;&gt;&gt;4	ulelong+64	x	\b, offset 0x%x
#&gt;&gt;&gt;(4.l+64)	use	pak-entry
#
#	display file table entry of Quake PAK archive
0	name		pak-entry
# normally entry start after header which implies offset 12 or higher
&gt;56	ulelong	&gt;11	
# the offset from the beginning of pak to beginning of this entry file contents
&gt;&gt;56	ulelong	x	at 0x%x
# the size of file for this entry 
&gt;&gt;60	ulelong	x	%u bytes
# 56 byte null-terminated entry name string includes path like maps/e1m1.bsp
&gt;&gt;0	string	x	&#039;%-.56s&#039;
# inspect entry content by jumping to entry offset
&gt;&gt;(56)	indirect x	\b: 

#0       string  -1\x0a  Quake I demo
#&gt;30     string  x        version %.4s
#&gt;61     string  x        level %s

#0       string  5\x0a   Quake I save

# The levels

# Quake 1

0	string	5\x0aIntroduction             Quake I save: start Introduction
0	string	5\x0athe_Slipgate_Complex     Quake I save: e1m1 The slipgate complex
0	string	5\x0aCastle_of_the_Damned     Quake I save: e1m2 Castle of the damned
0	string	5\x0athe_Necropolis           Quake I save: e1m3 The necropolis
0	string	5\x0athe_Grisly_Grotto        Quake I save: e1m4 The grisly grotto
0	string	5\x0aZiggurat_Vertigo         Quake I save: e1m8 Ziggurat vertigo (secret)
0	string	5\x0aGloom_Keep               Quake I save: e1m5 Gloom keep
0	string	5\x0aThe_Door_To_Chthon       Quake I save: e1m6 The door to Chthon
0	string	5\x0aThe_House_of_Chthon      Quake I save: e1m7 The house of Chthon
0	string	5\x0athe_Installation         Quake I save: e2m1 The installation
0	string	5\x0athe_Ogre_Citadel         Quake I save: e2m2 The ogre citadel
0	string	5\x0athe_Crypt_of_Decay       Quake I save: e2m3 The crypt of decay (dopefish lives!)
0	string	5\x0aUnderearth               Quake I save: e2m7 Underearth (secret)
0	string	5\x0athe_Ebon_Fortress        Quake I save: e2m4 The ebon fortress
0	string	5\x0athe_Wizard&#039;s_Manse       Quake I save: e2m5 The wizard&#039;s manse
0	string	5\x0athe_Dismal_Oubliette     Quake I save: e2m6 The dismal oubliette
0	string	5\x0aTermination_Central      Quake I save: e3m1 Termination central
0	string	5\x0aVaults_of_Zin            Quake I save: e3m2 Vaults of Zin
0	string	5\x0athe_Tomb_of_Terror       Quake I save: e3m3 The tomb of terror
0	string	5\x0aSatan&#039;s_Dark_Delight     Quake I save: e3m4 Satan&#039;s dark delight
0	string	5\x0athe_Haunted_Halls        Quake I save: e3m7 The haunted halls (secret)
0	string	5\x0aWind_Tunnels             Quake I save: e3m5 Wind tunnels
0	string	5\x0aChambers_of_Torment      Quake I save: e3m6 Chambers of torment
0	string	5\x0athe_Sewage_System        Quake I save: e4m1 The sewage system
0	string	5\x0aThe_Tower_of_Despair     Quake I save: e4m2 The tower of despair
0	string	5\x0aThe_Elder_God_Shrine     Quake I save: e4m3 The elder god shrine
0	string	5\x0athe_Palace_of_Hate       Quake I save: e4m4 The palace of hate
0	string	5\x0aHell&#039;s_Atrium            Quake I save: e4m5 Hell&#039;s atrium
0	string	5\x0athe_Nameless_City        Quake I save: e4m8 The nameless city (secret)
0	string	5\x0aThe_Pain_Maze            Quake I save: e4m6 The pain maze
0	string	5\x0aAzure_Agony              Quake I save: e4m7 Azure agony
0	string	5\x0aShub-Niggurath&#039;s_Pit     Quake I save: end Shub-Niggurath&#039;s pit

# Quake DeathMatch levels

0	string	5\x0aPlace_of_Two_Deaths	 Quake I save: dm1 Place of two deaths
0	string	5\x0aClaustrophobopolis		 Quake I save: dm2 Claustrophobopolis
0	string	5\x0aThe_Abandoned_Base		 Quake I save: dm3 The abandoned base
0	string	5\x0aThe_Bad_Place		 Quake I save: dm4 The bad place
0	string	5\x0aThe_Cistern		 Quake I save: dm5 The cistern
0	string	5\x0aThe_Dark_Zone		 Quake I save: dm6 The dark zone

# Scourge of Armagon

0	string	5\x0aCommand_HQ               Quake I save: start Command HQ
0	string	5\x0aThe_Pumping_Station      Quake I save: hip1m1 The pumping station
0	string	5\x0aStorage_Facility         Quake I save: hip1m2 Storage facility
0	string	5\x0aMilitary_Complex         Quake I save: hip1m5 Military complex (secret)
0	string	5\x0athe_Lost_Mine            Quake I save: hip1m3 The lost mine
0	string	5\x0aResearch_Facility        Quake I save: hip1m4 Research facility
0	string	5\x0aAncient_Realms           Quake I save: hip2m1 Ancient realms
0	string	5\x0aThe_Gremlin&#039;s_Domain     Quake I save: hip2m6 The gremlin&#039;s domain (secret)
0	string	5\x0aThe_Black_Cathedral      Quake I save: hip2m2 The black cathedral
0	string	5\x0aThe_Catacombs            Quake I save: hip2m3 The catacombs
0	string	5\x0athe_Crypt__              Quake I save: hip2m4 The crypt
0	string	5\x0aMortum&#039;s_Keep            Quake I save: hip2m5 Mortum&#039;s keep
0	string	5\x0aTur_Torment              Quake I save: hip3m1 Tur torment
0	string	5\x0aPandemonium              Quake I save: hip3m2 Pandemonium
0	string	5\x0aLimbo                    Quake I save: hip3m3 Limbo
0	string	5\x0athe_Edge_of_Oblivion     Quake I save: hipdm1 The edge of oblivion (secret)
0	string	5\x0aThe_Gauntlet             Quake I save: hip3m4 The gauntlet
0	string	5\x0aArmagon&#039;s_Lair           Quake I save: hipend Armagon&#039;s lair

# Malice

0	string	5\x0aThe_Academy      Quake I save: start The academy
0	string	5\x0aThe_Lab          Quake I save: d1 The lab
0	string	5\x0aArea_33          Quake I save: d1b Area 33
0	string	5\x0aSECRET_MISSIONS  Quake I save: d3b Secret missions
0	string	5\x0aThe_Hospital     Quake I save: d10 The hospital (secret)
0	string	5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
0	string	5\x0aBACK_2_MALICE    Quake I save: d4b Back to Malice
0	string	5\x0aArea44           Quake I save: d1c Area 44
0	string	5\x0aTakahiro_Towers  Quake I save: d2 Takahiro towers
0	string	5\x0aA_Rat&#039;s_Life     Quake I save: d3 A rat&#039;s life
0	string	5\x0aInto_The_Flood   Quake I save: d4 Into the flood
0	string	5\x0aThe_Flood        Quake I save: d5 The flood
0	string	5\x0aNuclear_Plant    Quake I save: d6 Nuclear plant
0	string	5\x0aThe_Incinerator_Plant    Quake I save: d7 The incinerator plant
0	string	5\x0aThe_Foundry              Quake I save: d7b The foundry
0	string	5\x0aThe_Underwater_Base      Quake I save: d8 The underwater base
0	string	5\x0aTakahiro_Base            Quake I save: d9 Takahiro base
0	string	5\x0aTakahiro_Laboratories    Quake I save: d12 Takahiro laboratories
0	string	5\x0aStayin&#039;_Alive    Quake I save: d13 Stayin&#039; alive
0	string	5\x0aB.O.S.S._HQ      Quake I save: d14 B.O.S.S. HQ
0	string	5\x0aSHOWDOWN!        Quake I save: d15 Showdown!

# Malice DeathMatch levels

0	string	5\x0aThe_Seventh_Precinct	 Quake I save: ddm1 The seventh precinct
0	string	5\x0aSub_Station		 Quake I save: ddm2 Sub station
0	string	5\x0aCrazy_Eights!		 Quake I save: ddm3 Crazy eights!
0	string	5\x0aEast_Side_Invertationa	 Quake I save: ddm4 East side invertationa
0	string	5\x0aSlaughterhouse		 Quake I save: ddm5 Slaughterhouse
0	string	5\x0aDOMINO			 Quake I save: ddm6 Domino
0	string	5\x0aSANDRA&#039;S_LADDER		 Quake I save: ddm7 Sandra&#039;s ladder


0	string	MComprHD	MAME CHD compressed hard disk image,
&gt;12	belong	x		version %u

# doom - submitted by Jon Dowland

0	string	=IWAD		doom main IWAD data
&gt;4	lelong	x		containing %d lumps
0	string	=PWAD		doom patch PWAD data
&gt;4	lelong	x		containing %d lumps

# Build engine group files (Duke Nukem, Shadow Warrior, ...)
# Extension: .grp
# Created by: &quot;Ganael Laplanche&quot; &lt;ganael.laplanche@martymac.org&gt;
0	string	KenSilverman	Build engine group file
&gt;12	lelong	x		containing %d files

# Summary: Warcraft 3 save
# Extension: .w3g
# Created by: &quot;Nelson A. de Oliveira&quot; &lt;naoliv@gmail.com&gt;
0	string		Warcraft\ III\ recorded\ game	%s


# Summary: Warcraft 3 map
# Extension: .w3m
# Created by: &quot;Nelson A. de Oliveira&quot; &lt;naoliv@gmail.com&gt;
0	string		HM3W		Warcraft III map file


# Summary: SGF Smart Game Format
# Extension: .sgf
# Reference: http://www.red-bean.com/sgf/
# Created by: Eduardo Sabbatella &lt;eduardo_sabbatella@yahoo.com.ar&gt;
# Modified by (1): Abel Cheung (regex, more game format)
# FIXME: Some games don&#039;t have GM (game type)
0	regex		\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
&gt;2	search/0x200/b	GM[
&gt;&gt;&amp;0	string		1]	(Go)
&gt;&gt;&amp;0	string		2]	(Othello)
&gt;&gt;&amp;0	string		3]	(chess)
&gt;&gt;&amp;0	string		4]	(Gomoku+Renju)
&gt;&gt;&amp;0	string		5]	(Nine Men&#039;s Morris)
&gt;&gt;&amp;0	string		6]	(Backgammon)
&gt;&gt;&amp;0	string		7]	(Chinese chess)
&gt;&gt;&amp;0	string		8]	(Shogi)
&gt;&gt;&amp;0	string		9]	(Lines of Action)
&gt;&gt;&amp;0	string		10]	(Ataxx)
&gt;&gt;&amp;0	string		11]	(Hex)
&gt;&gt;&amp;0	string		12]	(Jungle)
&gt;&gt;&amp;0	string		13]	(Neutron)
&gt;&gt;&amp;0	string		14]	(Philosopher&#039;s Football)
&gt;&gt;&amp;0	string		15]	(Quadrature)
&gt;&gt;&amp;0	string		16]	(Trax)
&gt;&gt;&amp;0	string		17]	(Tantrix)
&gt;&gt;&amp;0	string		18]	(Amazons)
&gt;&gt;&amp;0	string		19]	(Octi)
&gt;&gt;&amp;0	string		20]	(Gess)
&gt;&gt;&amp;0	string		21]	(Twixt)
&gt;&gt;&amp;0	string		22]	(Zertz)
&gt;&gt;&amp;0	string		23]	(Plateau)
&gt;&gt;&amp;0	string		24]	(Yinsh)
&gt;&gt;&amp;0	string		25]	(Punct)
&gt;&gt;&amp;0	string		26]	(Gobblet)
&gt;&gt;&amp;0	string		27]	(hive)
&gt;&gt;&amp;0	string		28]	(Exxit)
&gt;&gt;&amp;0	string		29]	(Hnefatal)
&gt;&gt;&amp;0	string		30]	(Kuba)
&gt;&gt;&amp;0	string		31]	(Tripples)
&gt;&gt;&amp;0	string		32]	(Chase)
&gt;&gt;&amp;0	string		33]	(Tumbling Down)
&gt;&gt;&amp;0	string		34]	(Sahara)
&gt;&gt;&amp;0	string		35]	(Byte)
&gt;&gt;&amp;0	string		36]	(Focus)
&gt;&gt;&amp;0	string		37]	(Dvonn)
&gt;&gt;&amp;0	string		38]	(Tamsk)
&gt;&gt;&amp;0	string		39]	(Gipf)
&gt;&gt;&amp;0	string		40]	(Kropki)

##############################################
# NetImmerse/Gamebryo game engine entries

# Summary: Gamebryo game engine file
# Extension: .nif, .kf
# Created by: Abel Cheung &lt;abelcheung@gmail.com&gt;
0		string		Gamebryo\ File\ Format,\ Version\ 	Gamebryo game engine file
&gt;&amp;0		regex		[0-9a-z.]+				\b, version %s

# Summary: Gamebryo game engine file
# Extension: .kfm
# Created by: Abel Cheung &lt;abelcheung@gmail.com&gt;
0		string		;Gamebryo\ KFM\ File\ Version\ 		Gamebryo game engine animation File
&gt;&amp;0		regex		[0-9a-z.]+				\b, version %s

# Summary: NetImmerse game engine file
# Extension .nif
# Created by: Abel Cheung &lt;abelcheung@gmail.com&gt;
0		string		NetImmerse\ File\ Format,\ Versio
&gt;&amp;0		string		n\ 					NetImmerse game engine file
&gt;&gt;&amp;0		regex		[0-9a-z.]+				\b, version %s

# Type:	SGF Smart Game Format
# URL:	http://www.red-bean.com/sgf/
# From:	Eduardo Sabbatella &lt;eduardo_sabbatella@yahoo.com.ar&gt;
2	regex/c	\\(;.*GM\\[[0-9]{1,2}\\]	Smart Game Format
&gt;2	regex/c	GM\\[1\\]			- Go Game
&gt;2	regex/c	GM\\[6\\]			- BackGammon Game
&gt;2	regex/c	GM\\[11\\]			- Hex Game
&gt;2	regex/c	GM\\[18\\]			- Amazons Game
&gt;2	regex/c	GM\\[19\\]			- Octi Game
&gt;2	regex/c	GM\\[20\\]			- Gess Game
&gt;2	regex/c	GM\\[21\\]			- twix Game

# Epic Games/Unreal Engine Package
#
0	lelong		0x9E2A83C1	Unreal Engine Package,
&gt;4	leshort		x		version: %i
&gt;12	lelong		!0		\b, names: %i
&gt;28	lelong		!0		\b, imports: %i
&gt;20	lelong		!0		\b, exports: %i

#------------------------------------------------------------------------------
# $File: gcc,v 1.5 2016/07/01 23:31:13 christos Exp $
# gcc:  file(1) magic for GCC special files
#
0	string		gpch		GCC precompiled header

# The version field is annoying.  It&#039;s 3 characters, not zero-terminated.
&gt;5	byte		x			(version %c
&gt;6	byte		x			\b%c
&gt;7	byte		x			\b%c)

# 67 = &#039;C&#039;, 111 = &#039;o&#039;, 43 = &#039;+&#039;, 79 = &#039;O&#039;
&gt;4	byte		67			for C
&gt;4	byte		111			for Objective-C
&gt;4	byte		43			for C++
&gt;4	byte		79			for Objective-C++

#------------------------------------------------------------------------------
# $File: gconv
# gconv: file(1) magic for iconv/gconv module configuration cache
#
# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC
#
# From: Marek Cermak &lt;macermak@redhat.com&gt;
#
0		lelong		0x20010324 	gconv module configuration cache data

#------------------------------------------------------------------------------
# $File: geo,v 1.6 2018/03/11 00:48:16 christos Exp $
# Geo- files from Kurt Schwehr &lt;schwehr@ccom.unh.edu&gt;

######################################################################
#
# Acoustic Doppler Current Profilers (ADCP)
#
######################################################################

0	beshort	0x7f7f	RDI Acoustic Doppler Current Profiler (ADCP)

######################################################################
#
# Metadata
#
######################################################################

0	string	Identification_Information	FGDC ASCII metadata

######################################################################
#
# Seimsic / Subbottom
#
######################################################################

# Knudsen subbottom chirp profiler - Binary File Format: B9
# KEB D409-03167 V1.75 Huffman
0	string	KEB\ 	Knudsen seismic KEL binary (KEB) -
&gt;4	regex	[-A-Z0-9]*	Software: %s
&gt;&gt;&amp;1	regex	V[0-9]*\.[0-9]*	version %s

######################################################################
#
# LIDAR - Laser altimetry or bathy
#
######################################################################


# Caris LIDAR format for LADS comes as two parts... ascii location file and binary waveform data
0	string	HCA	LADS Caris Ascii Format (CAF) bathymetric lidar
&gt;4	regex [0-9]*\.[0-9]*	version %s

0	string	HCB	LADS Caris Binary Format (CBF) bathymetric lidar waveform data
&gt;3      byte    x	version %d .
&gt;4	byte	x	%d


######################################################################
#
# MULTIBEAM SONARS http://www.ldeo.columbia.edu/res/pi/MB-System/formatdoc/
#
######################################################################

# GeoAcoustics - GeoSwath Plus
4	beshort	0x2002	GeoSwath RDF
0	string	Start:-	GeoSwatch auf text file

# Seabeam 2100
# mbsystem code mb41
0	string SB2100	SeaBeam 2100 multibeam sonar
0	string SB2100DR	SeaBeam 2100 DR multibeam sonar
0	string SB2100PR SeaBeam 2100 PR multibeam sonar

# This corresponds to MB-System format 94, L-3/ELAC/SeaBeam XSE vendor
# format. It is the format of our upgraded SeaBeam 2112 on R/V KNORR.
0    string $HSF    XSE multibeam

# mb121 http://www.saic.com/maritime/gsf/
8	string	GSF-v	SAIC generic sensor format (GSF) sonar data,
&gt;&amp;0	regex [0-9]*\.[0-9]*	version %s

# MGD77 - http://www.ngdc.noaa.gov/mgg/dat/geodas/docs/mgd77.htm
# mb161
9	string MGD77	MGD77 Header, Marine Geophysical Data Exchange Format

# MBSystem processing caches the mbinfo output
1	string	Swath\ Data\ File:	mbsystem info cache

# Caris John Hughes Clark format
0	string	HDCS	Caris multibeam sonar related data
1	string	Start/Stop\ parameter\ header:	Caris ASCII project summary

######################################################################
#
# Visualization and 3D modeling
#
######################################################################

# IVS - IVS3d.com Tagged Data Represetation
0	string	%%\ TDR\ 2.0	IVS Fledermaus TDR file

# http://www.ecma-international.org/publications/standards/Ecma-363.htm
# 3D in PDFs
0	string	U3D	ECMA-363, Universal 3D

######################################################################
#
# Support files
#
######################################################################

# https://midas.psi.ch/elog/
0	string	$@MID@$	elog journal entry

# Geospatial Designs http://www.geospatialdesigns.com/surfer6_format.htm
0	string		DSBB	Surfer 6 binary grid file
&gt;4	leshort		x	\b, %d
&gt;6	leshort		x	\bx%d
&gt;8	ledouble	x	\b, minx=%g
&gt;16	ledouble	x	\b, maxx=%g
&gt;24	ledouble	x	\b, miny=%g
&gt;32	ledouble	x	\b, maxy=%g
&gt;40	ledouble	x	\b, minz=%g
&gt;48	ledouble	x	\b, maxz=%g

# magic for LAS format files
# alex myczko &lt;alex@aiei.ch&gt;
# http://www.asprs.org/wp-content/uploads/2010/12/LAS_1_3_r11.pdf
0	string		LASF	LIDAR point data records
&gt;24	byte		&gt;0	\b, version %u
&gt;25	byte		&gt;0	\b.%u
&gt;26	string		&gt;\0	\b, SYSID %s
&gt;58	string		&gt;\0	\b, Generating Software %s

# magic for PCD format files
# alex myczko &lt;alex@aiei.ch&gt;
# http://pointclouds.org/documentation/tutorials/pcd_file_format.php
0	string		#\ .PCD	Point Cloud Data

#------------------------------------------------------------------------------
# $File: geos,v 1.4 2009/09/19 16:28:09 christos Exp $
# GEOS files (Vidar Madsen, vidar@gimp.org)
# semi-commonly used in embedded and handheld systems.
0	belong	0xc745c153	GEOS
&gt;40	byte	1	executable
&gt;40	byte	2	VMFile
&gt;40	byte	3	binary
&gt;40	byte	4	directory label
&gt;40	byte	&lt;1	unknown
&gt;40	byte	&gt;4	unknown
&gt;4	string	&gt;\0	\b, name &quot;%s&quot;
#&gt;44	short	x	\b, version %d
#&gt;46	short	x	\b.%d
#&gt;48	short	x	\b, rev %d
#&gt;50	short	x	\b.%d
#&gt;52	short	x	\b, proto %d
#&gt;54	short	x	\br%d
#&gt;168	string	&gt;\0	\b, copyright &quot;%s&quot;

#------------------------------------------------------------------------------
# $File: gimp,v 1.9 2014/04/30 21:41:02 christos Exp $
# GIMP Gradient: file(1) magic for the GIMP&#039;s gradient data files (.ggr)
# by Federico Mena &lt;federico@nuclecu.unam.mx&gt;

0       string/t        GIMP\ Gradient  GIMP gradient data

# GIMP palette (.gpl)
# From: Markus Heidelberg &lt;markus.heidelberg@web.de&gt;
0       string/t        GIMP\ Palette   GIMP palette data

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the XCF image format used in the GIMP (.xcf) developed
#       by Spencer Kimball and Peter Mattis
#       (&#039;Bucky&#039; LaDieu, nega@vt.edu)

0	string		gimp\ xcf	GIMP XCF image data,
!:mime	image/x-xcf
&gt;9	string		file		version 0,
&gt;9	string		v		version
&gt;&gt;10	string		&gt;\0		%s,
&gt;14	belong		x		%u x
&gt;18	belong		x		%u,
&gt;22     belong          0               RGB Color
&gt;22     belong          1               Greyscale
&gt;22     belong          2               Indexed Color
&gt;22	belong		&gt;2		Unknown Image Type.

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the patterns used in the GIMP (.pat), developed
#       by Spencer Kimball and Peter Mattis
#       (&#039;Bucky&#039; LaDieu, nega@vt.edu)

20      string          GPAT            GIMP pattern data,
&gt;24     string          x               %s

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the brushes used in the GIMP (.gbr), developed
#       by Spencer Kimball and Peter Mattis
#       (&#039;Bucky&#039; LaDieu, nega@vt.edu)

20      string          GIMP            GIMP brush data

# GIMP Curves File
# From: &quot;Nelson A. de Oliveira&quot; &lt;naoliv@gmail.com&gt;
0	string	#\040GIMP\040Curves\040File	GIMP curve file

#------------------------------------------------------------------------------
# $File: gnome,v 1.5 2014/04/30 21:41:02 christos Exp $
# GNOME related files

# Contributed by Josh Triplett
# FIXME: Could be simplified if pstring supported two-byte counts
0         string   GnomeKeyring\n\r\0\n GNOME keyring
&gt;&amp;0       ubyte    0                    \b, major version 0
&gt;&gt;&amp;0      ubyte    0                    \b, minor version 0
&gt;&gt;&gt;&amp;0     ubyte    0                    \b, crypto type 0 (AES)
&gt;&gt;&gt;&amp;0     ubyte    &gt;0                   \b, crypto type %u (unknown)
&gt;&gt;&gt;&amp;1     ubyte    0                    \b, hash type 0 (MD5)
&gt;&gt;&gt;&amp;1     ubyte    &gt;0                   \b, hash type %u (unknown)
&gt;&gt;&gt;&amp;2     ubelong  0xFFFFFFFF           \b, name NULL
&gt;&gt;&gt;&amp;2     ubelong  !0xFFFFFFFF
&gt;&gt;&gt;&gt;&amp;-4   ubelong  &gt;255                 \b, name too long for file&#039;s pstring type
&gt;&gt;&gt;&gt;&amp;-4   ubelong  &lt;256
&gt;&gt;&gt;&gt;&gt;&amp;-1  pstring  x                    \b, name &quot;%s&quot;
&gt;&gt;&gt;&gt;&gt;&gt;&amp;0  ubeqdate x                    \b, last modified %s
&gt;&gt;&gt;&gt;&gt;&gt;&amp;8  ubeqdate x                    \b, created %s
&gt;&gt;&gt;&gt;&gt;&gt;&amp;16 ubelong  &amp;1
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0 ubelong  x                    \b, locked if idle for %u seconds
&gt;&gt;&gt;&gt;&gt;&gt;&amp;16 ubelong  ^1                   \b, not locked if idle
&gt;&gt;&gt;&gt;&gt;&gt;&amp;24 ubelong  x                    \b, hash iterations %u
&gt;&gt;&gt;&gt;&gt;&gt;&amp;28 ubequad  x                    \b, salt %llu
&gt;&gt;&gt;&gt;&gt;&gt;&amp;52 ubelong  x                    \b, %u item(s)

# From: Alex Beregszaszi &lt;alex@fsn.hu&gt;
4	string	gtktalog		GNOME Catalogue (gtktalog)
&gt;13	string	&gt;\0			version %s

# Summary: GStreamer binary registry
# Extension: .bin
# Submitted by: Josh Triplett &lt;josh@joshtriplett.org&gt;
0	belong	0xc0def00d		GStreamer binary registry
&gt;4	string	x			\b, version %s

# GVariant Database file
# By Elan Ruusamae &lt;glen@delfi.ee&gt;
# https://github.com/GNOME/gvdb/blob/master/gvdb-format.h
# It&#039;s always &quot;GVariant&quot;, it&#039;s byte swapped on incompatible archs
# See https://github.com/GNOME/gvdb/blob/master/gvdb-builder.c
# file_builder_serialise()
# http://developer.gnome.org/glib/2.34/glib-GVariant.html#GVariant
0	string	GVariant	GVariant Database file,
# version is never filled. probably future extension
&gt;8	lelong	x		version %d
# not sure are these usable, so commented out
#&gt;&gt;16	lelong	x		start %d,
#&gt;&gt;&gt;20	lelong	x		end %d

# G-IR database made by gobject-introspect toolset,
# http://live.gnome.org/GObjectIntrospection
0	string		GOBJ\nMETADATA\r\n\032	G-IR binary database
&gt;16	byte		x			\b, v%d
&gt;17	byte		x			\b.%d
&gt;20	leshort		x			\b, %d entries
&gt;22	leshort		x			\b/%d local

#------------------------------------------------------------------------------
# $File: gnu,v 1.20 2018/02/24 16:11:23 christos Exp $
# gnu:  file(1) magic for various GNU tools
#
# GNU nlsutils message catalog file format
#
# GNU message catalog (.mo and .gmo files)

# Update: Joerg Jenderek
# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html
# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/
#	gettext-0.19.8.1/gettext-runtime/intl/gmo.h
# Note: maybe call it like &quot;GNU translation gettext machine object&quot;
0	string		\336\22\4\225	GNU message catalog (little endian),
#0	ulelong	0x950412DE		GNU-format message catalog data
# TODO: write lines in such a way that code can also be called for big endian variant
#&gt;0	use		gettext-object
#0	name		gettext-object
&gt;4	ulelong		x		revision
!:mime	application/x-gettext-translation
# mo extension is also used for Easeus Partition Master PE32 executable module
# like ConvertFatToNTFS.mo
!:ext	gmo/mo
# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit
# major revision
&gt;4	ulelong/0xFFff	x		%u.
# minor revision
&gt;4	ulelong&amp;0x0000FFff	x	\b%u
&gt;&gt;8	ulelong		x		\b, %u message
# plural s
&gt;&gt;8	ulelong		&gt;1		\bs
# size of hashing table
#&gt;20	ulelong		x		\b, %u hash
#&gt;20	ulelong		&gt;1		\bes
#&gt;24	ulelong		x		at 0x%x
# for revsion x.0 offset of table with originals is 1Ch if directly after header
&gt;4	ulelong&amp;0x0000FFff	=0
&gt;&gt;12	ulelong		!0x1C		\b, at 0x%x string table
# but for x.1 table offset i found is 30h. That means directly after bigger header
&gt;4	ulelong&amp;0x0000FFff	&gt;0
&gt;&gt;12	ulelong		!0x30		\b, at 0x%x string table
# The following variables are only used in .mo files with minor revision &gt;= 1
# number of system dependent segments
#&gt;&gt;28	ulelong		x		\b, %u segment
#&gt;&gt;28	ulelong		&gt;1		\bs
# offset of table describing system dependent segments
#&gt;&gt;32	ulelong		x		at 0x%x
# number of system dependent strings pairs
&gt;&gt;36	ulelong		x		\b, %u sysdep message
&gt;&gt;36	ulelong		&gt;1		\bs
# offset of table with start offsets of original sysdep strings
#&gt;&gt;40	ulelong		x		\b, at 0x%x sysdep strings
# offset of table with start offsets of translated sysdep strings
#&gt;&gt;44	ulelong		x		\b, at 0x%x sysdep translations
# &gt;&gt;(44.l)	ulelong	x		0x%x chars
# &gt;&gt;&gt;&amp;0		ulelong	x		at 0x%x
# &gt;&gt;&gt;&gt;(&amp;-4)	string	x		&quot;%s&quot;
# string table after big header
#&gt;&gt;48	ubequad		x		\b, string table 0x%llx
#
# 0th string length seems to be always 0
#&gt;(12.l)	ulelong	x		\b, %u chars
#&gt;&gt;&amp;0		ulelong	x		at 0x%x
# if 1st string length positiv inspect offset and string
#&gt;(12.l+8)	ulelong	&gt;0		\b, %u chars
#&gt;&gt;&amp;0		ulelong	x		at 0x%x
# if 2nd string length positiv inspect offset and string
# &gt;(12.l+16)	ulelong	&gt;0		\b, %u chars
# &gt;&gt;&amp;0		ulelong	x		at 0x%x
# skip newline byte
#&gt;&gt;&gt;(&amp;-4)	ubyte	=0x0A
#&gt;&gt;&gt;&gt;&amp;0		string	x		&quot;%s&quot;
#&gt;&gt;&gt;(&amp;-4)	ubyte	!0x0A
#&gt;&gt;&gt;&gt;&amp;-1		string	x		&#039;%s&#039;
# offset of table with translation strings
#&gt;16	ulelong		x		\b, at 0x%x translation table
# check translation 0 length and offset
&gt;(16.l)		ulelong	&gt;0
&gt;&gt;&amp;0		ulelong	x
# translation 0 seems to be often Project-Id with name and version
&gt;&gt;&gt;(&amp;-4)	string	x		\b, %s
# trans. 1 with bytes &gt;= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL
&gt;(16.l+8)	ulelong	&gt;1
&gt;&gt;&amp;0		ulelong	x
&gt;&gt;&gt;(&amp;-4)	ubyte	!0x0A
&gt;&gt;&gt;&gt;&amp;-1		string	x		&#039;%s&#039;
# 1 New Line like in tar-1.29\po\de.gmo
&gt;&gt;&gt;(&amp;-4)	ubyte	=0x0A
&gt;&gt;&gt;&gt;&amp;0		ubyte	!0x0A
&gt;&gt;&gt;&gt;&gt;&amp;-1	string	x		&#039;%s&#039;
# 2nd New Line like in parted-3.1\po\de.gmo
&gt;&gt;&gt;&gt;&amp;0		ubyte	=0x0A
&gt;&gt;&gt;&gt;&gt;&amp;0		string	x		&#039;%s&#039;

0	string		\225\4\22\336	GNU message catalog (big endian),
#0	ubelong	0x950412DE		GNU-format message catalog data
!:mime	application/x-gettext-translation
!:ext	gmo/mo
# TODO: for big endian use same code as for little endian
#&gt;0	use		\^gettext-object
# DEBUG code
#&gt;16	ubelong		x		\b, at 0x%x translation table
#&gt;(16.L)		ubelong	x		0x%x chars
#&gt;&gt;&amp;0		ubelong	x		at 0x%x
# unexpected value HERE!
#&gt;&gt;&gt;(&amp;-4)	ubequad	x		0x%llx
#
&gt;4	beshort		x		revision %d.
&gt;6	beshort		&gt;0		\b%d,
&gt;&gt;8	belong		x		%d messages,
&gt;&gt;36	belong		x		%d sysdep messages
&gt;6	beshort		=0		\b%d,
&gt;&gt;8	belong		x		%d messages


# GnuPG
# The format is very similar to pgp
0	string          \001gpg                 GPG key trust database
&gt;4	byte            x                       version %d
# Note: magic.mime had 0x8501 for the next line instead of 0x8502
0	beshort		0x8502			GPG encrypted data
!:mime	text/PGP # encoding: data

# Update: Joerg Jenderek
# Note:	PGP and GPG use same data structure.
#	So recognition is now done by ./pgp with start test for byte 0x99
# This magic is not particularly good, as the keyrings don&#039;t have true
# magic. Nevertheless, it covers many keyrings.
# 0	ubeshort-0x9901	&lt;2
# &gt;3	byte		4
# &gt;&gt;4	bedate		x		GPG key public ring, created %s
# !:mime application/x-gnupg-keyring

# Symmetric encryption
0	leshort		0x0d8c
&gt;4	leshort		0x0203
&gt;&gt;2	leshort		0x0204		GPG symmetrically encrypted data (3DES cipher)
&gt;&gt;2	leshort		0x0304		GPG symmetrically encrypted data (CAST5 cipher)
&gt;&gt;2	leshort		0x0404		GPG symmetrically encrypted data (BLOWFISH cipher)
&gt;&gt;2	leshort		0x0704		GPG symmetrically encrypted data (AES cipher)
&gt;&gt;2	leshort		0x0804		GPG symmetrically encrypted data (AES192 cipher)
&gt;&gt;2	leshort		0x0904		GPG symmetrically encrypted data (AES256 cipher)
&gt;&gt;2	leshort		0x0a04		GPG symmetrically encrypted data (TWOFISH cipher)
&gt;&gt;2	leshort		0x0b04		GPG symmetrically encrypted data (CAMELLIA128 cipher)
&gt;&gt;2	leshort		0x0c04		GPG symmetrically encrypted data (CAMELLIA192 cipher)
&gt;&gt;2	leshort		0x0d04		GPG symmetrically encrypted data (CAMELLIA256 cipher)


# GnuPG Keybox file
# &lt;http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD&gt;
# From: Philipp Hahn &lt;hahn@univention.de&gt;
0	belong	32
&gt;4	byte	1
&gt;&gt;8	string	KBXf	GPG keybox database
&gt;&gt;&gt;5	byte	1	version %d
&gt;&gt;&gt;16	bedate	x	\b, created-at %s
&gt;&gt;&gt;20	bedate	x	\b, last-maintained %s


# Gnumeric spreadsheet
# This entry is only semi-helpful, as Gnumeric compresses its files, so
# they will ordinarily reported as &quot;compressed&quot;, but at least -z helps
39      string          =&lt;gmr:Workbook           Gnumeric spreadsheet

# From: James Youngman &lt;jay@gnu.org&gt;
# gnu find magic
0	string	\0LOCATE	GNU findutils locate database data
&gt;7	string	&gt;\0		\b, format %s
&gt;7	string	02		\b (frcode)

# Files produced by GNU gettext

# gettext message catalogue
0	search/1024	\nmsgid
&gt;&amp;0	search/1024	\nmsgstr	GNU gettext message catalogue text
!:strength +100
!:mime text/x-po

#------------------------------------------------------------------------------
# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
# gnumeric:  file(1) magic for Gnumeric spreadsheet
# This entry is only semi-helpful, as Gnumeric compresses its files, so
# they will ordinarily reported as &quot;compressed&quot;, but at least -z helps
39	string	=&lt;gmr:Workbook	Gnumeric spreadsheet
!:mime	application/x-gnumeric

#------------------------------------------------------------------------------
# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
#
# GPT Partition table patterns.
# Author: Rogier Goossens (goossens.rogier@gmail.com)
# Note that a GPT-formatted disk must contain an MBR as well.
#

# The initial segment (up to &gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;422) was copied from the X86
# partition table code (aka MBR).
# This is kept separate, so that MBR partitions are not reported as well.
# (use -k if you do want them as well)

# First, detect the MBR partiton table
# If more than one GPT protective MBR partition exists, don&#039;t print anything
# (the other MBR detection code will then just print the MBR partition table)
0x1FE			leshort		0xAA55
&gt;3			string		!MS
&gt;&gt;3			string		!SYSLINUX
&gt;&gt;&gt;3			string		!MTOOL
&gt;&gt;&gt;&gt;3			string		!NEWLDR
&gt;&gt;&gt;&gt;&gt;5			string		!DOS
# not FAT (32 bit)
&gt;&gt;&gt;&gt;&gt;&gt;82		string		!FAT32
#not Linux kernel
&gt;&gt;&gt;&gt;&gt;&gt;&gt;514		string		!HdrS
#not BeOS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;422		string		!Be\ Boot\ Loader
# GPT with protective MBR entry in partition 1 (only)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;450		ubyte		0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;466		ubyte		!0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;482		ubyte		!0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;498		ubyte		!0xee
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;446	use		gpt-mbr-partition
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(454.l*8192)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0			use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0			ubyte		x		of 8192 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(454.l*8192)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(454.l*4096)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 4096 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(454.l*4096)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(454.l*2048)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 2048 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(454.l*2048)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(454.l*1024)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 1024 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(454.l*1024)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(454.l*512)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 512 bytes
# GPT with protective MBR entry in partition 2 (only)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;450		ubyte		!0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;466		ubyte		0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;482		ubyte		!0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;498		ubyte		!0xee
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;462	use		gpt-mbr-partition
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(470.l*8192)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0			use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0			ubyte		x		of 8192 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(470.l*8192)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(470.l*4096)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 4096 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(470.l*4096)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(470.l*2048)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 2048 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(470.l*2048)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(470.l*1024)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 1024 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(470.l*1024)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(470.l*512)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 512 bytes
# GPT with protective MBR entry in partition 3 (only)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;450		ubyte		!0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;466		ubyte		!0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;482		ubyte		0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;498		ubyte		!0xee
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;478	use		gpt-mbr-partition
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(486.l*8192)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0			use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0			ubyte		x		of 8192 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(486.l*8192)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(486.l*4096)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 4096 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(486.l*4096)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(486.l*2048)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 2048 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(486.l*2048)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(486.l*1024)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 1024 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(486.l*1024)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(486.l*512)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 512 bytes
# GPT with protective MBR entry in partition 4 (only)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;450		ubyte		!0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;466		ubyte		!0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;482		ubyte		!0xee
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;498		ubyte		0xee
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;494	use		gpt-mbr-partition
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(502.l*8192)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0			use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0			ubyte		x		of 8192 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(502.l*8192)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(502.l*4096)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 4096 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(502.l*4096)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(502.l*2048)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 2048 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(502.l*2048)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(502.l*1024)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 1024 bytes
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(502.l*1024)	string		!EFI\ PART
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(502.l*512)	string		EFI\ PART	GPT partition table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 512 bytes

# The following code does GPT detection and processing, including
# sector size detection.
# It has to be duplicated above because the top-level pattern
# (i.e. not called using &#039;use&#039;) must print *something* for file
# to count it as a match. Text only printed in named patterns is
# not counted, and causes file to continue, and try and match
# other patterns.
#
# Unfortunately, when assuming sector sizes &gt;=16k, if the sector size
# happens to be 512 instead, we may find confusing data after the GPT
# table...  If the GPT table has less than 128 entries, this may even
# happen for assumed sector sizes as small as 4k
# This could be solved by checking for the presence of the backup GPT
# header as well, but that makes the logic extremely complex
##0		name		gpt-mbr-partition
##&gt;(8.l*8192)	string		EFI\ PART
##&gt;&gt;(8.l*8192)	use		gpt-mbr-type
##&gt;&gt;&amp;-8		use		gpt-table
##&gt;&gt;0		ubyte		x		of 8192 bytes
##&gt;(8.l*8192)	string		!EFI\ PART
##&gt;&gt;(8.l*4096)	string		EFI\ PART	GPT partition table
##&gt;&gt;&gt;0		use		gpt-mbr-type
##&gt;&gt;&gt;&amp;-8		use		gpt-table
##&gt;&gt;&gt;0		ubyte		x		of 4096 bytes
##&gt;&gt;(8.l*4096)	string		!EFI\ PART
##&gt;&gt;&gt;(8.l*2048)	string		EFI\ PART	GPT partition table
##&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
##&gt;&gt;&gt;&gt;&amp;-8		use		gpt-table
##&gt;&gt;&gt;&gt;0		ubyte		x		of 2048 bytes
##&gt;&gt;&gt;(8.l*2048)	string		!EFI\ PART
##&gt;&gt;&gt;&gt;(8.l*1024)	string		EFI\ PART	GPT partition table
##&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
##&gt;&gt;&gt;&gt;&gt;&amp;-8	use		gpt-table
##&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 1024 bytes
##&gt;&gt;&gt;&gt;(8.l*1024)	string		!EFI\ PART
##&gt;&gt;&gt;&gt;&gt;(8.l*512)	string		EFI\ PART	GPT partition table
##&gt;&gt;&gt;&gt;&gt;&gt;0		use		gpt-mbr-type
##&gt;&gt;&gt;&gt;&gt;&gt;&amp;-8	use		gpt-table
##&gt;&gt;&gt;&gt;&gt;&gt;0		ubyte		x		of 512 bytes

# Print details of MBR type for a GPT-disk
# Calling code ensures that there is only one 0xee partition.
0		name		gpt-mbr-type
# GPT with protective MBR entry in partition 1
&gt;450		ubyte		0xee
&gt;&gt;454		ulelong		1
&gt;&gt;&gt;462		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
&gt;&gt;454		ulelong		!1													\b (nonstandard: not at LBA 1)
# GPT with protective MBR entry in partition 2
&gt;466		ubyte		0xee
&gt;&gt;470		ulelong		1
&gt;&gt;&gt;478		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
&gt;&gt;&gt;&gt;446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
&gt;&gt;&gt;478		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
&gt;&gt;470		ulelong		!1									\b (nonstandard: not at LBA 1)
# GPT with protective MBR entry in partition 3
&gt;482		ubyte		0xee
&gt;&gt;486		ulelong		1
&gt;&gt;&gt;494		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
&gt;&gt;&gt;&gt;446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
&gt;&gt;&gt;494		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0					\b (with hybrid MBR)
&gt;&gt;486		ulelong		!1									\b (nonstandard: not at LBA 1)
# GPT with protective MBR entry in partition 4
&gt;498		ubyte		0xee
&gt;&gt;502		ulelong		1
&gt;&gt;&gt;446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
&gt;&gt;502		ulelong		!1													\b (nonstandard: not at LBA 1)

# Print the information from a GPT partition table structure
0		name		gpt-table
&gt;10		uleshort	x		\b, version %u
&gt;8		uleshort	x		\b.%u
&gt;56		ulelong		x		\b, GUID: %08x
&gt;60		uleshort	x		\b-%04x
&gt;62		uleshort	x		\b-%04x
&gt;64		ubeshort	x		\b-%04x
&gt;66		ubeshort	x		\b-%04x
&gt;68		ubelong		x		\b%08x
#&gt;80		uleshort	x		\b, %d partition entries
&gt;32		ulequad+1	x		\b, disk size: %lld sectors

# In case a GPT data-structure is at LBA 0, report it as well
# This covers systems which are not GPT-aware, and which show
# and allow access to the protective partition. This code will
# detect the contents of such a partition.
0		string		EFI\ PART	GPT data structure (nonstandard: at LBA 0)
&gt;0		use		gpt-table
&gt;0		ubyte		x		(sector size unknown)


#------------------------------------------------------------------------------
# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $
# gpu: file(1) magic for GPU input files

# Standard Portable Intermediate Representation (SPIR)
# Documentation: https://www.khronos.org/spir
# Typical file extension: .spv

0	belong	0x07230203	Khronos SPIR-V binary, big-endian
&gt;4	belong	x		\b, version 0x%08x
&gt;8	belong	x		\b, generator 0x%08x

0	lelong	0x07230203      Khronos SPIR-V binary, little-endian
&gt;4	lelong	x		\b, version 0x%08x
&gt;8	lelong	x		\b, generator 0x%08x

# Vulkan Trace file
# Documentation:
# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\
# vktrace_trace_packet_identifiers.h
# Typical file extension: .vktrace

8	lequad  0xABADD068ADEAFD0C	Vulkan trace file, little-endian
&gt;0	leshort	x			\b, version %d

8	bequad  0xABADD068ADEAFD0C	Vulkan trace file, big-endian
&gt;0	beshort	x			\b, version %d

#------------------------------------------------------------------------------
# $File: grace,v 1.4 2009/09/19 16:28:09 christos Exp $
# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
#
# ACE/gr binary
0	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
&gt;39	byte	&gt;0			- version %c
# ACE/gr ascii
0	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
0	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
0	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
# Grace projects
0	string	#\ Grace\ project\ file		Grace project file
&gt;23	string	@version\  			(version
&gt;&gt;32	byte	&gt;0 				%c
&gt;&gt;33	string	&gt;\0 				\b.%.2s
&gt;&gt;35	string	&gt;\0 				\b.%.2s)
# ACE/gr fit description files
0	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE

#------------------------------------------------------------------------------
# $File: graphviz,v 1.8 2014/06/03 19:01:34 christos Exp $
# graphviz:  file(1) magic for http://www.graphviz.org/

# FIXME: These patterns match too generally. For example, the first
# line matches a LaTeX file containing the word &quot;graph&quot; (with a {
# following later) and the second line matches this file.
#0	regex/100l	[\r\n\t\ ]*graph[\r\n\t\ ]+.*\\{	graphviz graph text
#!:mime	text/vnd.graphviz
#0	regex/100l	[\r\n\t\ ]*digraph[\r\n\t\ ]+.*\\{	graphviz digraph text
#!:mime	text/vnd.graphviz

#------------------------------------------------------------------------------
# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $
# gringotts:  file(1) magic for Gringotts
# http://devel.pluto.linux.it/projects/Gringotts/
# author: Germano Rizzo &lt;mano@pluto.linux.it&gt;
#GRG3????Y
0	string	GRG		Gringotts data file
#file format 1
&gt;3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
#file format 2
&gt;3	string		2		v.2, MCRYPT S2K,
&gt;&gt;8	byte&amp;0x70	0x00		RIJNDAEL-128 crypt,
&gt;&gt;8	byte&amp;0x70	0x10		SERPENT crypt,
&gt;&gt;8	byte&amp;0x70	0x20		TWOFISH crypt,
&gt;&gt;8	byte&amp;0x70	0x30		CAST-256 crypt,
&gt;&gt;8	byte&amp;0x70	0x40		SAFER+ crypt,
&gt;&gt;8	byte&amp;0x70	0x50		LOKI97 crypt,
&gt;&gt;8	byte&amp;0x70	0x60		3DES crypt,
&gt;&gt;8	byte&amp;0x70	0x70		RIJNDAEL-256 crypt,
&gt;&gt;8	byte&amp;0x08	0x00		SHA1 hash,
&gt;&gt;8	byte&amp;0x08	0x08		RIPEMD-160 hash,
&gt;&gt;8	byte&amp;0x04	0x00		ZLib
&gt;&gt;8	byte&amp;0x04	0x04		BZip2
&gt;&gt;8	byte&amp;0x03	0x00		lvl.0
&gt;&gt;8	byte&amp;0x03	0x01		lvl.3
&gt;&gt;8	byte&amp;0x03	0x02		lvl.6
&gt;&gt;8	byte&amp;0x03	0x03		lvl.9
#file format 3
&gt;3	string		3		v.3, OpenPGP S2K,
&gt;&gt;8	byte&amp;0x70	0x00		RIJNDAEL-128 crypt,
&gt;&gt;8	byte&amp;0x70	0x10		SERPENT crypt,
&gt;&gt;8	byte&amp;0x70	0x20		TWOFISH crypt,
&gt;&gt;8	byte&amp;0x70	0x30		CAST-256 crypt,
&gt;&gt;8	byte&amp;0x70	0x40		SAFER+ crypt,
&gt;&gt;8	byte&amp;0x70	0x50		LOKI97 crypt,
&gt;&gt;8	byte&amp;0x70	0x60		3DES crypt,
&gt;&gt;8	byte&amp;0x70	0x70		RIJNDAEL-256 crypt,
&gt;&gt;8	byte&amp;0x08	0x00		SHA1 hash,
&gt;&gt;8	byte&amp;0x08	0x08		RIPEMD-160 hash,
&gt;&gt;8	byte&amp;0x04	0x00		ZLib
&gt;&gt;8	byte&amp;0x04	0x04		BZip2
&gt;&gt;8	byte&amp;0x03	0x00		lvl.0
&gt;&gt;8	byte&amp;0x03	0x01		lvl.3
&gt;&gt;8	byte&amp;0x03	0x02		lvl.6
&gt;&gt;8	byte&amp;0x03	0x03		lvl.9
#file format &gt;3
&gt;3	string		&gt;3		v.%.1s (unknown details)

#------------------------------------------------------------------------------
# $File: guile,v 1.1 2011/12/16 17:44:33 christos Exp $
# Guile file magic from &lt;dalepsmith@gmail.com&gt;
# http://www.gnu.org/s/guile/
# http://git.savannah.gnu.org/gitweb/?p=guile.git;f=libguile/_scm.h;hb=HEAD#l250

0	string	GOOF----	Guile Object
&gt;8	string	LE		\b, little endian
&gt;8	string	BE		\b, big endian
&gt;11	string	4		\b, 32bit
&gt;11	string	8		\b, 64bit
&gt;13	regex	.\..		\b, bytecode v%s

#------------------------------------------------------------------------------
# $File: hitachi-sh,v 1.8 2017/03/17 21:35:28 christos Exp $
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
#
# updated by Joerg Jenderek at Oct 2015
# https://en.wikipedia.org/wiki/COFF
# https://de.wikipedia.org/wiki/Common_Object_File_Format
# http://www.delorie.com/djgpp/doc/coff/filhdr.html
# below test line conflicts with 2nd NTFS filesystem sector
# 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
# and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/)
0	beshort		0x0500
# test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
&gt;18	ubeshort&amp;0x8E80	0
# use big endian variant of subroutine to display name+variables+flags
# for common object formated files
&gt;&gt;0	use				\^display-coff

0	leshort		0x0550
# test for unused flag bits in f_flags
&gt;18	uleshort&amp;0x8E80	0
# use little endian variant of subroutine to
# display name+variables+flags for common object formated files
&gt;&gt;0	use				display-coff


#------------------------------------------------------------------------------
# $File: hp,v 1.24 2014/04/30 21:41:02 christos Exp $
# hp:  file(1) magic for Hewlett Packard machines (see also &quot;printer&quot;)
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the &quot;TML&quot; stuff; I&#039;m assuming the Apollo stuff is
# big-endian as it was mostly 68K-based.
#
# I think the 500 series was the old stack-based machines, running a
# UNIX environment atop the &quot;SUN kernel&quot;; dunno whether it was
# big-endian or little-endian.
#
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
# HP magic is useful for reference, but using &quot;long&quot; magic is a better
# practice in order to avoid collisions.
#
# Guy Harris (guy@netapp.com): some additions to this list came from
# HP-UX 10.0&#039;s &quot;/usr/include/sys/unistd.h&quot; (68030, 68040, PA-RISC 1.1,
# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn&#039;t in the HP-UX 10.0
# &quot;/etc/magic&quot;, though, except for the &quot;archive file relocatable library&quot;
# stuff, and the 68030 and 68040 stuff isn&#039;t there at all - are they not
# used in executables, or have they just not yet updated &quot;/etc/magic&quot;
# completely?
#
# 0	beshort		200		hp200 (68010) BSD binary
# 0	beshort		300		hp300 (68020+68881) BSD binary
# 0	beshort		0x20c		hp200/300 HP-UX binary
# 0	beshort		0x20d		hp400 (68030) HP-UX binary
# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
# 0	beshort		0x214		PA-RISC2.0 HP-UX binary

#
# The &quot;misc&quot; stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0	beshort		0627		Apollo m68k COFF executable
&gt;18	beshort		^040000		not stripped
&gt;22	beshort		&gt;0		- version %d
0	beshort		0624		apollo a88k COFF executable
&gt;18	beshort		^040000		not stripped
&gt;22	beshort		&gt;0		- version %d
0       long            01203604016     TML 0123 byte-order format
0       long            01702407010     TML 1032 byte-order format
0       long            01003405017     TML 2301 byte-order format
0       long            01602007412     TML 3210 byte-order format
#### PA-RISC 1.1
0	belong 		0x02100106	PA-RISC1.1 relocatable object
0	belong 		0x02100107	PA-RISC1.1 executable
&gt;168	belong		&amp;0x00000004	dynamically linked
&gt;(144)	belong		0x054ef630	dynamically linked
&gt;96	belong		&gt;0		- not stripped

0	belong 		0x02100108	PA-RISC1.1 shared executable
&gt;168	belong&amp;0x4	0x4		dynamically linked
&gt;(144)	belong		0x054ef630	dynamically linked
&gt;96	belong		&gt;0		- not stripped

0	belong 		0x0210010b	PA-RISC1.1 demand-load executable
&gt;168	belong&amp;0x4	0x4		dynamically linked
&gt;(144)	belong		0x054ef630	dynamically linked
&gt;96	belong		&gt;0		- not stripped

0	belong 		0x0210010e	PA-RISC1.1 shared library
&gt;96	belong		&gt;0		- not stripped

0	belong 		0x0210010d	PA-RISC1.1 dynamic load library
&gt;96	belong		&gt;0		- not stripped

#### PA-RISC 2.0
0	belong		0x02140106	PA-RISC2.0 relocatable object

0       belong		0x02140107	PA-RISC2.0 executable
&gt;168	belong		&amp;0x00000004	dynamically linked
&gt;(144)	belong		0x054ef630	dynamically linked
&gt;96	belong		&gt;0		- not stripped

0       belong		0x02140108	PA-RISC2.0 shared executable
&gt;168	belong		&amp;0x00000004	dynamically linked
&gt;(144)	belong		0x054ef630	dynamically linked
&gt;96	belong		&gt;0		- not stripped

0       belong		0x0214010b	PA-RISC2.0 demand-load executable
&gt;168	belong		&amp;0x00000004	dynamically linked
&gt;(144)	belong		0x054ef630	dynamically linked
&gt;96	belong		&gt;0		- not stripped

0       belong		0x0214010e	PA-RISC2.0 shared library
&gt;96	belong		&gt;0		- not stripped

0       belong		0x0214010d	PA-RISC2.0 dynamic load library
&gt;96	belong		&gt;0		- not stripped

#### 800
0	belong 		0x020b0106	PA-RISC1.0 relocatable object

0	belong 		0x020b0107	PA-RISC1.0 executable
&gt;168	belong&amp;0x4	0x4		dynamically linked
&gt;(144)	belong		0x054ef630	dynamically linked
&gt;96	belong		&gt;0		- not stripped

0	belong 		0x020b0108	PA-RISC1.0 shared executable
&gt;168	belong&amp;0x4	0x4		dynamically linked
&gt;(144)	belong		0x054ef630	dynamically linked
&gt;96	belong		&gt;0		- not stripped

0	belong 		0x020b010b	PA-RISC1.0 demand-load executable
&gt;168	belong&amp;0x4	0x4		dynamically linked
&gt;(144)	belong		0x054ef630	dynamically linked
&gt;96	belong		&gt;0		- not stripped

0	belong 		0x020b010e	PA-RISC1.0 shared library
&gt;96	belong		&gt;0		- not stripped

0	belong 		0x020b010d	PA-RISC1.0 dynamic load library
&gt;96	belong		&gt;0		- not stripped

0	belong		0x213c6172	archive file
&gt;68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
&gt;68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
&gt;68	belong 		0x02110619	- PA-RISC1.2 relocatable library
&gt;68	belong 		0x02140619	- PA-RISC2.0 relocatable library

#### 500
0	long		0x02080106	HP s500 relocatable executable
&gt;16	long		&gt;0		- version %d

0	long		0x02080107	HP s500 executable
&gt;16	long		&gt;0		- version %d

0	long		0x02080108	HP s500 pure executable
&gt;16	long		&gt;0		- version %d

#### 200
0	belong 		0x020c0108	HP s200 pure executable
&gt;4	beshort		&gt;0		- version %d
&gt;8	belong		&amp;0x80000000	save fp regs
&gt;8	belong		&amp;0x40000000	dynamically linked
&gt;8	belong		&amp;0x20000000	debuggable
&gt;36	belong		&gt;0		not stripped

0	belong		0x020c0107	HP s200 executable
&gt;4	beshort		&gt;0		- version %d
&gt;8	belong		&amp;0x80000000	save fp regs
&gt;8	belong		&amp;0x40000000	dynamically linked
&gt;8	belong		&amp;0x20000000	debuggable
&gt;36	belong		&gt;0		not stripped

0	belong		0x020c010b	HP s200 demand-load executable
&gt;4	beshort		&gt;0		- version %d
&gt;8	belong		&amp;0x80000000	save fp regs
&gt;8	belong		&amp;0x40000000	dynamically linked
&gt;8	belong		&amp;0x20000000	debuggable
&gt;36	belong		&gt;0		not stripped

0	belong		0x020c0106	HP s200 relocatable executable
&gt;4	beshort		&gt;0		- version %d
&gt;6	beshort		&gt;0		- highwater %d
&gt;8	belong		&amp;0x80000000	save fp regs
&gt;8	belong		&amp;0x20000000	debuggable
&gt;8	belong		&amp;0x10000000	PIC

0	belong 		0x020a0108	HP s200 (2.x release) pure executable
&gt;4	beshort		&gt;0		- version %d
&gt;36	belong		&gt;0		not stripped

0	belong		0x020a0107	HP s200 (2.x release) executable
&gt;4	beshort		&gt;0		- version %d
&gt;36	belong		&gt;0		not stripped

0	belong		0x020c010e	HP s200 shared library
&gt;4	beshort		&gt;0		- version %d
&gt;6	beshort		&gt;0		- highwater %d
&gt;36	belong		&gt;0		not stripped

0	belong		0x020c010d	HP s200 dynamic load library
&gt;4	beshort		&gt;0		- version %d
&gt;6	beshort		&gt;0		- highwater %d
&gt;36	belong		&gt;0		not stripped

#### MISC
0	long		0x0000ff65	HP old archive
0	long		0x020aff65	HP s200 old archive
0	long		0x020cff65	HP s200 old archive
0	long		0x0208ff65	HP s500 old archive

0	long		0x015821a6	HP core file

0	long		0x4da7eee8	HP-WINDOWS font
&gt;8	byte		&gt;0		- version %d
0	string		Bitmapfile	HP Bitmapfile

0	string		IMGfile	CIS 	compimg HP Bitmapfile
# XXX - see &quot;lif&quot;
#0	short		0x8000		lif file
0	long		0x020c010c	compiled Lisp

0	string		msgcat01	HP NLS message catalog,
&gt;8	long		&gt;0		%d messages

# Summary: HP-48/49 calculator
# Created by: phk@data.fls.dk
# Modified by (1): AMAKAWA Shuhei &lt;sa264@cam.ac.uk&gt;
# Modified by (2): Samuel Thibault &lt;samuel.thibault@ens-lyon.org&gt; (HP49 support)
0	string		HPHP		HP
&gt;4	string		48		48 binary
&gt;4	string		49		49 binary
&gt;7	byte		&gt;64		- Rev %c
&gt;8	leshort		0x2911		(ADR)
&gt;8	leshort		0x2933		(REAL)
&gt;8	leshort		0x2955		(LREAL)
&gt;8	leshort		0x2977		(COMPLX)
&gt;8	leshort		0x299d		(LCOMPLX)
&gt;8	leshort		0x29bf		(CHAR)
&gt;8	leshort		0x29e8		(ARRAY)
&gt;8	leshort		0x2a0a		(LNKARRAY)
&gt;8	leshort		0x2a2c		(STRING)
&gt;8	leshort		0x2a4e		(HXS)
&gt;8	leshort		0x2a74		(LIST)
&gt;8	leshort		0x2a96		(DIR)
&gt;8	leshort		0x2ab8		(ALG)
&gt;8	leshort		0x2ada		(UNIT)
&gt;8	leshort		0x2afc		(TAGGED)
&gt;8	leshort		0x2b1e		(GROB)
&gt;8	leshort		0x2b40		(LIB)
&gt;8	leshort		0x2b62		(BACKUP)
&gt;8	leshort		0x2b88		(LIBDATA)
&gt;8	leshort		0x2d9d		(PROG)
&gt;8	leshort		0x2dcc		(CODE)
&gt;8	leshort		0x2e48		(GNAME)
&gt;8	leshort		0x2e6d		(LNAME)
&gt;8	leshort		0x2e92		(XLIB)

0	string		%%HP:		HP text
&gt;6	string		T(0)		- T(0)
&gt;6	string		T(1)		- T(1)
&gt;6	string		T(2)		- T(2)
&gt;6	string		T(3)		- T(3)
&gt;10	string		A(D)		A(D)
&gt;10	string		A(R)		A(R)
&gt;10	string		A(G)		A(G)
&gt;14	string		F(.)		F(.);
&gt;14	string		F(,)		F(,);


# Summary: HP-38/39 calculator
# Created by: Samuel Thibault &lt;samuel.thibault@ens-lyon.org&gt;
0	string		HP3
&gt;3	string		8		HP 38
&gt;3	string		9		HP 39
&gt;4	string		Bin		binary
&gt;4	string		Asc		ASCII
&gt;7	string		A		(Directory List)
&gt;7	string		B		(Zaplet)
&gt;7	string		C		(Note)
&gt;7	string		D		(Program)
&gt;7	string		E		(Variable)
&gt;7	string		F		(List)
&gt;7	string		G		(Matrix)
&gt;7	string		H		(Library)
&gt;7	string		I		(Target List)
&gt;7	string		J		(ASCII Vector specification)
&gt;7	string		K		(wildcard)

# Summary: HP-38/39 calculator
# Created by: Samuel Thibault &lt;samuel.thibault@ens-lyon.org&gt;
0	string		HP3
&gt;3	string		8		HP 38
&gt;3	string		9		HP 39
&gt;4	string		Bin		binary
&gt;4	string		Asc		ASCII
&gt;7	string		A		(Directory List)
&gt;7	string		B		(Zaplet)
&gt;7	string		C		(Note)
&gt;7	string		D		(Program)
&gt;7	string		E		(Variable)
&gt;7	string		F		(List)
&gt;7	string		G		(Matrix)
&gt;7	string		H		(Library)
&gt;7	string		I		(Target List)
&gt;7	string		J		(ASCII Vector specification)
&gt;7	string		K		(wildcard)

# hpBSD magic numbers
0	beshort		200		hp200 (68010) BSD
&gt;2	beshort		0407		impure binary
&gt;2	beshort		0410		read-only binary
&gt;2	beshort		0413		demand paged binary
0	beshort		300		hp300 (68020+68881) BSD
&gt;2	beshort		0407		impure binary
&gt;2	beshort		0410		read-only binary
&gt;2	beshort		0413		demand paged binary
#
# From David Gero &lt;dgero@nortelnetworks.com&gt;
# HP-UX 10.20 core file format from /usr/include/sys/core.h
# Unfortunately, HP-UX uses corehead blocks without specifying the order
# There are four we care about:
#     CORE_KERNEL, which starts with the string &quot;HP-UX&quot;
#     CORE_EXEC, which contains the name of the command
#     CORE_PROC, which contains the signal number that caused the core dump
#     CORE_FORMAT, which contains the version of the core file format (== 1)
# The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
# but we include all 6 variations of the order of the first 3, and
# assume that PROC will always be last
# Order 1: KERNEL, EXEC, FORMAT, PROC
0x10		string	HP-UX
&gt;0		belong	2
&gt;&gt;0xC		belong	0x3C
&gt;&gt;&gt;0x4C		belong	0x100
&gt;&gt;&gt;&gt;0x58	belong	0x44
&gt;&gt;&gt;&gt;&gt;0xA0	belong	1
&gt;&gt;&gt;&gt;&gt;&gt;0xAC	belong	4
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xB0	belong	1
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xB4	belong	4		core file
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x90	string	&gt;\0		from &#039;%s&#039;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	3		- received SIGQUIT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	4		- received SIGILL
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	5		- received SIGTRAP
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	6		- received SIGABRT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	7		- received SIGEMT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	8		- received SIGFPE
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	10		- received SIGBUS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	11		- received SIGSEGV
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	12		- received SIGSYS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	33		- received SIGXCPU
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	34		- received SIGXFSZ
# Order 2: KERNEL, FORMAT, EXEC, PROC
&gt;&gt;&gt;0x4C		belong	1
&gt;&gt;&gt;&gt;0x58	belong	4
&gt;&gt;&gt;&gt;&gt;0x5C	belong	1
&gt;&gt;&gt;&gt;&gt;&gt;0x60	belong	0x100
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x6C	belong	0x44
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xB4	belong	4		core file
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xA4	string	&gt;\0		from &#039;%s&#039;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	3		- received SIGQUIT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	4		- received SIGILL
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	5		- received SIGTRAP
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	6		- received SIGABRT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	7		- received SIGEMT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	8		- received SIGFPE
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	10		- received SIGBUS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	11		- received SIGSEGV
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	12		- received SIGSYS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	33		- received SIGXCPU
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	34		- received SIGXFSZ
# Order 3: FORMAT, KERNEL, EXEC, PROC
0x24		string	HP-UX
&gt;0		belong	1
&gt;&gt;0xC		belong	4
&gt;&gt;&gt;0x10		belong	1
&gt;&gt;&gt;&gt;0x14	belong	2
&gt;&gt;&gt;&gt;&gt;0x20	belong	0x3C
&gt;&gt;&gt;&gt;&gt;&gt;0x60	belong	0x100
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x6C	belong	0x44
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xB4	belong	4		core file
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xA4	string	&gt;\0		from &#039;%s&#039;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	3		- received SIGQUIT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	4		- received SIGILL
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	5		- received SIGTRAP
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	6		- received SIGABRT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	7		- received SIGEMT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	8		- received SIGFPE
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	10		- received SIGBUS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	11		- received SIGSEGV
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	12		- received SIGSYS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	33		- received SIGXCPU
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	34		- received SIGXFSZ
# Order 4: EXEC, KERNEL, FORMAT, PROC
0x64		string	HP-UX
&gt;0		belong	0x100
&gt;&gt;0xC		belong	0x44
&gt;&gt;&gt;0x54		belong	2
&gt;&gt;&gt;&gt;0x60	belong	0x3C
&gt;&gt;&gt;&gt;&gt;0xA0	belong	1
&gt;&gt;&gt;&gt;&gt;&gt;0xAC	belong	4
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xB0	belong	1
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xB4	belong	4		core file
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x44	string	&gt;\0		from &#039;%s&#039;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	3		- received SIGQUIT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	4		- received SIGILL
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	5		- received SIGTRAP
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	6		- received SIGABRT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	7		- received SIGEMT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	8		- received SIGFPE
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	10		- received SIGBUS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	11		- received SIGSEGV
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	12		- received SIGSYS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	33		- received SIGXCPU
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	34		- received SIGXFSZ
# Order 5: FORMAT, EXEC, KERNEL, PROC
0x78		string	HP-UX
&gt;0		belong	1
&gt;&gt;0xC		belong	4
&gt;&gt;&gt;0x10		belong	1
&gt;&gt;&gt;&gt;0x14	belong	0x100
&gt;&gt;&gt;&gt;&gt;0x20	belong	0x44
&gt;&gt;&gt;&gt;&gt;&gt;0x68	belong	2
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x74	belong	0x3C
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xB4	belong	4		core file
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x58	string	&gt;\0		from &#039;%s&#039;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	3		- received SIGQUIT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	4		- received SIGILL
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	5		- received SIGTRAP
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	6		- received SIGABRT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	7		- received SIGEMT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	8		- received SIGFPE
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	10		- received SIGBUS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	11		- received SIGSEGV
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	12		- received SIGSYS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	33		- received SIGXCPU
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	34		- received SIGXFSZ
# Order 6: EXEC, FORMAT, KERNEL, PROC
&gt;0		belong	0x100
&gt;&gt;0xC		belong	0x44
&gt;&gt;&gt;0x54		belong	1
&gt;&gt;&gt;&gt;0x60	belong	4
&gt;&gt;&gt;&gt;&gt;0x64	belong	1
&gt;&gt;&gt;&gt;&gt;&gt;0x68	belong	2
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x74	belong	0x2C
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xB4	belong	4		core file
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x44	string	&gt;\0		from &#039;%s&#039;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	3		- received SIGQUIT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	4		- received SIGILL
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	5		- received SIGTRAP
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	6		- received SIGABRT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	7		- received SIGEMT
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	8		- received SIGFPE
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	10		- received SIGBUS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	11		- received SIGSEGV
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	12		- received SIGSYS
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	33		- received SIGXCPU
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0xC4	belong	34		- received SIGXFSZ


#------------------------------------------------------------------------------
# $File: human68k,v 1.5 2009/09/19 16:28:09 christos Exp $
# human68k:  file(1) magic for Human68k (X680x0 DOS) binary formats
# Magic too short!
#0		string	HU		Human68k
#&gt;68		string	LZX		LZX compressed
#&gt;&gt;72		string	&gt;\0		(version %s)
#&gt;(8.L+74)	string	LZX		LZX compressed
#&gt;&gt;(8.L+78)	string	&gt;\0		(version %s)
#&gt;60		belong	&gt;0		binded
#&gt;(8.L+66)	string	#HUPAIR		hupair
#&gt;0		string	HU		X executable
#&gt;(8.L+74)	string	#LIBCV1		- linked PD LIBC ver 1
#&gt;4		belong	&gt;0		- base address 0x%x
#&gt;28		belong	&gt;0		not stripped
#&gt;32		belong	&gt;0		with debug information
#0		beshort	0x601a		Human68k Z executable
#0		beshort	0x6000		Human68k object file
#0		belong	0xd1000000	Human68k ar binary archive
#0		belong	0xd1010000	Human68k ar ascii archive
#0		beshort	0x0068		Human68k lib archive
#4		string	LZX		Human68k LZX compressed
#&gt;8		string	&gt;\0		(version %s)
#&gt;4		string	LZX		R executable
#2		string	#HUPAIR		Human68k hupair R executable

#------------------------------------------------------------------------------
# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $
# ibm370:  file(1) magic for IBM 370 and compatibles.
#
# &quot;ibm370&quot; said that 0x15d == 0535 was &quot;ibm 370 pure executable&quot;.
# What the heck *is* &quot;USS/370&quot;?
# AIX 4.1&#039;s &quot;/etc/magic&quot; has
#
#	0	short		0535		370 sysV executable
#	&gt;12	long		&gt;0		not stripped
#	&gt;22	short		&gt;0		- version %d
#	&gt;30	long		&gt;0		- 5.2 format
#	0	short		0530		370 sysV pure executable
#	&gt;12	long		&gt;0		not stripped
#	&gt;22	short		&gt;0		- version %d
#	&gt;30	long		&gt;0		- 5.2 format
#
# instead of the &quot;USS/370&quot; versions of the same magic numbers.
#
0	beshort		0537		370 XA sysV executable
&gt;12	belong		&gt;0		not stripped
&gt;22	beshort		&gt;0		- version %d
&gt;30	belong		&gt;0		- 5.2 format
0	beshort		0532		370 XA sysV pure executable
&gt;12	belong		&gt;0		not stripped
&gt;22	beshort		&gt;0		- version %d
&gt;30	belong		&gt;0		- 5.2 format
0	beshort		054001		370 sysV pure executable
&gt;12	belong		&gt;0		not stripped
0	beshort		055001		370 XA sysV pure executable
&gt;12	belong		&gt;0		not stripped
0	beshort		056401		370 sysV executable
&gt;12	belong		&gt;0		not stripped
0	beshort		057401		370 XA sysV executable
&gt;12	belong		&gt;0		not stripped
0       beshort		0531		SVR2 executable (Amdahl-UTS)
&gt;12	belong		&gt;0		not stripped
&gt;24     belong		&gt;0		- version %d
0	beshort		0534		SVR2 pure executable (Amdahl-UTS)
&gt;12	belong		&gt;0		not stripped
&gt;24	belong		&gt;0		- version %d
0	beshort		0530		SVR2 pure executable (USS/370)
&gt;12	belong		&gt;0		not stripped
&gt;24	belong		&gt;0		- version %d
0	beshort		0535		SVR2 executable (USS/370)
&gt;12	belong		&gt;0		not stripped
&gt;24	belong		&gt;0		- version %d

#------------------------------------------------------------------------------
# $File: ibm6000,v 1.13 2017/03/17 21:35:28 christos Exp $
# ibm6000:  file(1) magic for RS/6000 and the RT PC.
#
0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
&gt;12	belong		&gt;0		not stripped
# Breaks sun4 statically linked execs.
#0      beshort		0x0103		executable (RT Version 2) or obj module
#&gt;2	byte		0x50		pure
#&gt;28	belong		&gt;0		not stripped
#&gt;6	beshort		&gt;0		- version %ld
0	beshort		0x0104		shared library
0	beshort		0x0105		ctab data
0	beshort		0xfe04		structured file
0	string		0xabcdef	AIX message catalog
0	belong		0x000001f9	AIX compiled message catalog
0	string		\&lt;aiaff&gt;	archive
0	string		\&lt;bigaf&gt;	archive (big format)

0	beshort		0x01f7		64-bit XCOFF executable or object module
&gt;20	belong		0		not stripped
# GRR: this test is still too general as it catches also many FATs of DOS filesystems
4	belong		&amp;0x0feeddb0
# real core dump could not be 32-bit and 64-bit together
&gt;7	byte&amp;0x03	!3		AIX core file
&gt;&gt;1	byte		&amp;0x01		fulldump
&gt;&gt;7	byte		&amp;0x01		32-bit
&gt;&gt;&gt;0x6e0	string	&gt;\0		\b, %s
&gt;&gt;7	byte		&amp;0x02		64-bit
&gt;&gt;&gt;0x524	string	&gt;\0		\b, %s

#------------------------------------------------------------------------------
# $File: icc,v 1.5 2017/08/13 00:21:47 christos Exp $
# icc:  file(1) magic for International Color Consortium file formats

#
# Color profiles as per the ICC&#039;s &quot;Image technology colour management -
# Architecture, profile format, and data structure&quot; specification.
# See
#
#	http://www.color.org/specification/ICC1v43_2010-12.pdf
#
# for Specification ICC.1:2010 (Profile version 4.3.0.0).
# URL: http://fileformats.archiveteam.org/wiki/ICC_profile
# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf
# Update: Joerg Jenderek
#
# Bytes 36 to 39 contain a generic profile file signature of &quot;acsp&quot;;
# bytes 40 to 43 &quot;may be used to identify the primary platform/operating
# system framework for which the profile was created&quot;.
#
#	check and display ICC/ICM color profile
0	name	color-profile
&gt;36	string		acsp
# skip ASCII like Cognacspirit.txt by month &lt;= 12
&gt;&gt;26	ubeshort	&lt;13
# platform/operating system. Only 5 mentioned

#
# This appears to be what&#039;s used for Apple ColorSync profiles.
# Instead of adding that, Apple just changed the generic &quot;acsp&quot; entry
# to be for &quot;ColorSync ICC Color Profile&quot; rather than &quot;Kodak Color
# Management System, ICC Profile&quot;.
# Yes, it&#039;s &quot;APPL&quot;, not &quot;AAPL&quot;; see the spec.
&gt;&gt;&gt;40	string		APPL		ColorSync

# Microsoft ICM color profile
&gt;&gt;&gt;40	string		MSFT		Microsoft

# Yes, that&#039;s a blank after &quot;SGI&quot;.
&gt;&gt;&gt;40	string		SGI\ 		SGI

# XXX - is this what&#039;s used for the Sun KCMS or not?  The standard file
# uses just &quot;acsp&quot; for that, but Apple&#039;s file uses it for &quot;ColorSync&quot;,
# and there *is* an identified &quot;primary platform&quot; value of SUNW.
&gt;&gt;&gt;40	string		SUNW		Sun KCMS

# 5th platform
&gt;&gt;&gt;40	string		TGNT		Taligent

# remaining &quot;l&quot; &quot;e&quot; of &quot;color profile&quot; printed later to avoid error
&gt;&gt;&gt;40	string		x 		color profi
#&gt;&gt;&gt;40	string		x		(%.4s)
!:mime	application/vnd.iccprofile
# for &quot;ICM&quot; extension only versions 2.x and for Kodak &quot;CC&quot; 2.0 is found
&gt;&gt;&gt;8	ubyte		=2
# do not use empty message text to a avoid error like
# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
# file.exe: could not find any valid magic files!
&gt;&gt;&gt;&gt;9	ubyte		!0		\ble
!:ext	icc/icm
# minor version
&gt;&gt;&gt;&gt;9	ubyte		=0		\bl
# Kodak colour management system
&gt;&gt;&gt;&gt;&gt;4	string		=KCMS		\be
!:ext	icc/icm/cc
&gt;&gt;&gt;&gt;&gt;4	string		!KCMS		\be
!:ext	icc/icm
&gt;&gt;&gt;8	ubyte		!2		\ble
!:ext	icc
# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h)
&gt;&gt;&gt;8	ubyte		x		%u
&gt;&gt;&gt;9	ubyte/16	x		\b.%u
# reserved and shall be null but 205.205 in umx1220u.icm
&gt;&gt;&gt;10	ubyte		&gt;0		\b.%u
&gt;&gt;&gt;&gt;11	ubyte		&gt;0		\b.%u
# preferred colour management module like appl CCMS KCMS Lino UCCM &quot;Win &quot; &quot;FF  &quot;
# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm
&gt;&gt;&gt;4	string		&gt;\ 		\b, type %.2s
&gt;&gt;&gt;&gt;6	string		&gt;\  		\b%.1s
&gt;&gt;&gt;&gt;&gt;7	string		&gt;\  		\b%.1s
# colour space &quot;XYZ &quot; &quot;Lab &quot; &quot;RGB &quot; CMYK GRAY ...
&gt;&gt;&gt;16	string		x		\b, %.3s
&gt;&gt;&gt;19	string		&gt;\  		\b%.1s
# Profile Connection Space (PCS) field usually &quot;XYZ &quot; or &quot;Lab &quot; but sometimes
# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc
&gt;&gt;&gt;20	string		&gt;\0		\b/%.3s
&gt;&gt;&gt;&gt;23	string		&gt;\ 		\b%.1s
# eleven device classes
&gt;&gt;&gt;12	string		x		\b-%.4s device
# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or &quot; ROT&quot; in brmsl05f.icm
&gt;&gt;&gt;52	string		&gt;\040
# skip &quot;none&quot; model like in &quot;Trinitron Compatible 9300K G2.2.icm&quot;
&gt;&gt;&gt;&gt;52	ubelong		!0x6e6f6e65
# device manufacturer field like &quot;HP  &quot; &quot;IBM &quot; EPSO
&gt;&gt;&gt;&gt;&gt;48	string		x		\b, %.2s
&gt;&gt;&gt;&gt;&gt;50	string		&gt;\  		\b%.1s
&gt;&gt;&gt;&gt;&gt;51	string		&gt;\  		\b%.1s
# model like &quot;ADI &quot; &quot;A265&quot; and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC
&gt;&gt;&gt;&gt;&gt;52	string		&gt;\ \  		\b/%.3s
&gt;&gt;&gt;&gt;&gt;&gt;55 string		&gt;\  		\b%.1s
&gt;&gt;&gt;&gt;&gt;52	string		x		model
# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm
&gt;&gt;&gt;80	string		&gt;\0		by %.2s
&gt;&gt;&gt;&gt;82	string		&gt;\  		\b%.1s
&gt;&gt;&gt;&gt;&gt;83	string		&gt;\  		\b%.1s
# profile size
&gt;&gt;&gt;0	ubelong		x		\b, %u bytes
# skip invalid date 0 like in linearSRGB.icc
&gt;&gt;&gt;24	ubequad		!0
# datetime dd-mm-yyyy hh:mm:ss
&gt;&gt;&gt;&gt;28	ubeshort	x		\b, %u
# month &lt;= 12
&gt;&gt;&gt;&gt;26	ubeshort	x		\b-%u
# year
&gt;&gt;&gt;&gt;24	ubeshort	x		\b-%u
# do not display midnight time like in CNHP8308.ICC
&gt;&gt;&gt;&gt;30	ubequad&amp;0xFFffFFffFFff0000	!0
# hour &lt;= 24
&gt;&gt;&gt;&gt;&gt;30	ubeshort	x		%u
# minutes &lt;= 59
&gt;&gt;&gt;&gt;&gt;32	ubeshort	x		\b:%.2u
# seconds &lt;= 59
&gt;&gt;&gt;&gt;&gt;34	ubeshort	x		\b:%.2u
# vendor specific flags like 2 in HPCLJ5.ICM
&gt;&gt;&gt;44	ubeshort	&gt;0		\b, 0x%x vendor flags
# profile flags bits 0-2 of least 16 used by ICC
#&gt;&gt;&gt;44	ubelong		&gt;0		\b, 0x%x flags
# icEmbeddedProfileTrue
&gt;&gt;&gt;44	ubelong		&amp;1		\b, embedded
# icEmbeddedProfileFalse
#&gt;&gt;&gt;44	ubelong		^1		\b, not embedded
# icUseWithEmbeddedDataOnly
&gt;&gt;&gt;44	ubelong		&amp;2		\b, dependently
# icUseAnywhere
#&gt;&gt;&gt;44	ubelong		^2		\b, independently
&gt;&gt;&gt;44	ubelong		&amp;4		\b, MCS
#&gt;&gt;&gt;44	ubelong		^4		\b, no MCS
# vendor specific device attributes 1~srgb.icc
# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM
&gt;&gt;&gt;56	ubelong		&gt;0		\b, 0x%x vendor attribute
# ICC device attributes bits 0-7 used
#&gt;&gt;&gt;60	ubelong		x		\b, 0x%x attribute
# http://www.color.org/icc34.h
&gt;&gt;&gt;60	ubelong		&amp;0x01		\b, transparent
#&gt;&gt;&gt;60	ubelong		^0x01		\b, reflective
&gt;&gt;&gt;60	ubelong		&amp;0x02		\b, matte
#&gt;&gt;&gt;60	ubelong		^0x02		\b, glossy
&gt;&gt;&gt;60	ubelong		&amp;0x04		\b, negative
#&gt;&gt;&gt;60	ubelong		^0x04		\b, positive
&gt;&gt;&gt;60	ubelong		&amp;0x08		\b, black&amp;white
#&gt;&gt;&gt;60	ubelong		^0x08		\b, colour
&gt;&gt;&gt;60	ubelong		&amp;0x10		\b, non-paper
#&gt;&gt;&gt;60	ubelong		^0x10		\b, paper
&gt;&gt;&gt;60	ubelong		&amp;0x20		\b, non-textured
#&gt;&gt;&gt;60	ubelong		^0x20		\b, textured
&gt;&gt;&gt;60	ubelong		&amp;0x40		\b, non-isotropic
#&gt;&gt;&gt;60	ubelong		^0x40		\b, isotropic
&gt;&gt;&gt;60	ubelong		&amp;0x80		\b, self-luminous
#&gt;&gt;&gt;60	ubelong		^0x80		\b, non-self-luminous
# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM
&gt;&gt;&gt;64	ubelong		&gt;3		\b, 0x%x rendering intent
#&gt;&gt;&gt;64	ubelong		=0		\b, perceptual
&gt;&gt;&gt;64	ubelong		=1		\b, relative colorimetric
&gt;&gt;&gt;64	ubelong		=2		\b, saturation
&gt;&gt;&gt;64	ubelong		=3		\b, absolute colorimetric
# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d
&gt;&gt;&gt;71	ubequad		!0xd6000100000000d3	\b, PCS
# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found
# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm
&gt;&gt;&gt;&gt;68	ubelong			!0x0000f6d5	X=0x%x
# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm
&gt;&gt;&gt;&gt;72	ubelong			!0x00010000	Y=0x%x
# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found
# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm
&gt;&gt;&gt;&gt;76	ubelong			!0x0000d32d	Z=0x%x
# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321.
&gt;&gt;&gt;84	ubequad		&gt;0		\b, 0x%llx MD5
# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD
#&gt;&gt;100	ubequad		x		\b 0x%llx reserved
# tag table
# 6 &lt;= tags count &lt;= 43
#&gt;&gt;&gt;128	ubelong		&gt;43		\b, %u tags
&gt;&gt;&gt;128	ubelong		x
# shall contain the profileDescriptionTag &quot;desc&quot; , copyrightTag &quot;cprt&quot;
# search range = tags count * 12 -8=&lt; maximal tag count * 12 -8= 43 * 12 -8= 508
&gt;&gt;&gt;&gt;132	search/508	cprt
# but no copyright tag in linearSRGB.icc
# beneath /System/Library/Frameworks/WebKit.framework/
# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources
&gt;&gt;&gt;&gt;132	default		x		\b, no copyright tag
# 1st tag
#&gt;&gt;&gt;132	string		x		\b, 1st tag %.4s
#&gt;&gt;&gt;136	ubelong		x		0x%x offset
#&gt;&gt;&gt;140	ubelong		x		0x%x len
# 2nd tag,...
# look also for profileDescriptionTag &quot;desc&quot;
&gt;&gt;&gt;132	search/508	desc
# look further for TextDescriptionType &quot;desc&quot; signature
&gt;&gt;&gt;&gt;(&amp;0.L)	string		=desc
&gt;&gt;&gt;&gt;&gt;&amp;4		pstring/l	x	&quot;%s&quot;
# look alternative for multiLocalizedUnicodeType &quot;mluc&quot; signature like in VideoPAL.icc
&gt;&gt;&gt;&gt;(&amp;0.L)	string		=mluc
&gt;&gt;&gt;&gt;&gt;&amp;(&amp;8.L)	ubequad		x
&gt;&gt;&gt;&gt;&gt;&gt;&amp;4	bestring16	x	&#039;%s&#039;

# Any other profile.
# XXX - should we use &quot;acsp\0\0\0\0&quot; for &quot;no primary platform&quot; profiles,
# and use &quot;acsp&quot; for everything else and dump the &quot;primary platform&quot;
# string in those cases?
36	string		acsp
&gt;0	use		color-profile


#------------------------------------------------------------------------------
# $File: iff,v 1.14 2015/09/07 10:03:21 christos Exp $
# iff:	file(1) magic for Interchange File Format (see also &quot;audio&quot; &amp; &quot;images&quot;)
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
# Arts for file interchange.  It has also been used by Apple, SGI, and
# especially Commodore-Amiga.
#
# IFF files begin with an 8 byte FORM header, followed by a 4 character
# FORM type, which is followed by the first chunk in the FORM.

0	string		FORM		IFF data
#&gt;4	belong		x		\b, FORM is %d bytes long
# audio formats
&gt;8	string		AIFF		\b, AIFF audio
!:mime	audio/x-aiff
&gt;8	string		AIFC		\b, AIFF-C compressed audio
!:mime	audio/x-aiff
&gt;8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
!:mime	audio/x-aiff
&gt;8	string		16SV		\b, 16SV 16-bit sampled sound voice
&gt;8	string		SAMP		\b, SAMP sampled audio
&gt;8	string		MAUD		\b, MAUD MacroSystem audio
&gt;8	string		SMUS		\b, SMUS simple music
&gt;8	string		CMUS		\b, CMUS complex music
# image formats
&gt;8	string		ILBMBMHD	\b, ILBM interleaved image
&gt;&gt;20	beshort		x		\b, %d x
&gt;&gt;22	beshort		x		%d
&gt;8	string		RGBN		\b, RGBN 12-bit RGB image
&gt;8	string		RGB8		\b, RGB8 24-bit RGB image
&gt;8	string		DEEP		\b, DEEP TVPaint/XiPaint image
&gt;8	string		DR2D		\b, DR2D 2-D object
&gt;8	string		TDDD		\b, TDDD 3-D rendering
&gt;8	string		LWOB		\b, LWOB 3-D object
&gt;8	string		LWO2		\b, LWO2 3-D object, v2
&gt;8	string		LWLO		\b, LWLO 3-D layered object
&gt;8	string		REAL		\b, REAL Real3D rendering
&gt;8	string		MC4D		\b, MC4D MaxonCinema4D rendering
&gt;8	string		ANIM		\b, ANIM animation
&gt;8	string		YAFA		\b, YAFA animation
&gt;8	string		SSA\ 		\b, SSA super smooth animation
&gt;8	string		ACBM		\b, ACBM continuous image
&gt;8	string		FAXX		\b, FAXX fax image
# other formats
&gt;8	string		FTXT		\b, FTXT formatted text
&gt;8	string		CTLG		\b, CTLG message catalog
&gt;8	string		PREF		\b, PREF preferences
&gt;8	string		DTYP		\b, DTYP datatype description
&gt;8	string		PTCH		\b, PTCH binary patch
&gt;8	string		AMFF		\b, AMFF AmigaMetaFile format
&gt;8	string		WZRD		\b, WZRD StormWIZARD resource
&gt;8	string		DOC\ 		\b, DOC desktop publishing document
&gt;8	string		WVQA 		\b, Westwood Studios VQA Multimedia,
&gt;&gt;24	leshort		x		%d video frames,
&gt;&gt;26	leshort		x		%d x
&gt;&gt;28	leshort		x		%d
&gt;8	string		MOVE		\b, Wing Commander III Video
&gt;&gt;12	string		_PC_		\b, PC version
&gt;&gt;12	string		3DO_		\b, 3DO version

# These go at the end of the iff rules
#
# David Griffith &lt;dave@661.org&gt;
# I don&#039;t see why these might collide with anything else.
#
# Interactive Fiction related formats
#
&gt;8	string		IFRS		\b, Blorb Interactive Fiction
&gt;&gt;24	string		Exec		with executable chunk
&gt;8	string          IFZS		\b, Z-machine or Glulx saved game file (Quetzal)
!:mime	application/x-blorb

#------------------------------------------------------------------------------
# $File: images,v 1.131 2018/02/16 15:44:28 christos Exp $
# images:  file(1) magic for image formats (see also &quot;iff&quot;, and &quot;c-lang&quot; for
# XPM bitmaps)
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# little magic: PCX (first byte is 0x0a)

# Targa - matches `povray&#039;, `ppmtotga&#039; and `xv&#039; outputs
# by Philippe De Muyter &lt;phdm@macqel.be&gt;
# URL: http://justsolve.archiveteam.org/wiki/TGA
# Reference: http://www.dca.fee.unicamp.br/~martino/disciplinas/ea978/tgaffs.pdf
# Update: Joerg Jenderek
# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
#	,32 or 33 (both not observed)
# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
#	or theoretically 2-128 reserved for use by Truevision or 128-255 may be used for developer applications
# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
# `xv&#039; recognizes only a subset of the following (RGB with pixelsize = 24)
# `tgatoppm&#039; recognizes a superset (Index may be anything)
#
# test of Color Map Type 0~no 1~color map
# and Image Type 1 2 3 9 10 11 32 33
# and Color Map Entry Size 0 15 16 24 32
0	ubequad&amp;0x00FeC400000000C0	0
# skip more garbage like *.iso by looking for positive image type
&gt;2	ubyte			&gt;0
# skip some compiled terminfo like xterm+tmux by looking for image type less equal 33
&gt;&gt;2	ubyte			&lt;34
# skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel depth 1 8 15 16 24 32
&gt;&gt;&gt;16	ubyte			1
&gt;&gt;&gt;&gt;0		use		tga-image
&gt;&gt;&gt;16	ubyte			8
&gt;&gt;&gt;&gt;0		use		tga-image
&gt;&gt;&gt;16	ubyte			15
&gt;&gt;&gt;&gt;0		use		tga-image
&gt;&gt;&gt;16	ubyte			16
&gt;&gt;&gt;&gt;0		use		tga-image
&gt;&gt;&gt;16	ubyte			24
&gt;&gt;&gt;&gt;0		use		tga-image
&gt;&gt;&gt;16	ubyte			32
&gt;&gt;&gt;&gt;0		use		tga-image
#	display tga bitmap image information
0	name				tga-image
&gt;2	ubyte		&lt;34		Targa image data
!:mime	image/x-tga
!:apple	????TPIC
# normal extension .tga but some Truevision products used others:
# tpic (Apple),icb (Image Capture Board),vda (Video Display Adapter),vst (NuVista),win (UNSURE about that)
!:ext	tga/tpic/icb/vda/vst
# image type 1 2 3 9 10 11 32 33
&gt;2	ubyte&amp;0xF7	1		- Map
&gt;2	ubyte&amp;0xF7	2		- RGB
# alpha channel
&gt;&gt;17	ubyte&amp;0x0F	&gt;0		\bA
&gt;2	ubyte&amp;0xF7	3		- Mono
# type not found, but by http://www.fileformat.info/format/tga/corion.htm
# Compressed color-mapped data, using Huffman, Delta, and runlength encoding
&gt;2	ubyte		32		- Color
# Compressed color-mapped data, using Huffman, Delta, and RLE. 4-pass quadtree- type process
&gt;2	ubyte		33		- Color
# Color Map Type 0~no 1~color map
&gt;1	ubyte		1		(
# first color map entry, 0 normal
&gt;&gt;3	uleshort	&gt;0		\b%d-
# color map length 0 2 1dh 3bh d9h 100h
&gt;&gt;5	uleshort	x		\b%d)
# 8~run length encoding bit
&gt;2	ubyte&amp;0x08	8		- RLE
# gimp can create big pictures!
&gt;12	uleshort	&gt;0		%d x
&gt;12	uleshort	=0		65536 x
# image height. 0 interpreted as 65536
&gt;14	uleshort	&gt;0		%d
&gt;14	uleshort	=0		65536
# Image Pixel depth 1 8 15 16 24 32
&gt;16	ubyte		x		x %d
# X origin of image. 0 normal
&gt;8	uleshort	&gt;0		+%d
# Y origin of image. 0 normal; positive for top
&gt;10	uleshort	&gt;0		+%d
# Image descriptor: bits 3-0 give the alpha channel depth, bits 5-4 give direction
&gt;17	ubyte&amp;0x0F	&gt;0		- %d-bit alpha
# bits 5-4 give direction. normal bottom left
&gt;17	ubyte		&amp;0x20		- top
#&gt;17	ubyte		^0x20		- bottom
&gt;17	ubyte		&amp;0x10		- right
#&gt;17	ubyte		^0x10		- left
# some info say other bits 6-7 should be zero
# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
# 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved
#&gt;17	ubyte&amp;0xC0	0x00		- no interleave
&gt;17	ubyte&amp;0xC0	0x40		- interleave
&gt;17	ubyte&amp;0xC0	0x80		- four way interleave
&gt;17	ubyte&amp;0xC0	0xC0		- reserved
# positive length implies identification field
&gt;0	ubyte		&gt;0
&gt;&gt;18	string		x		&quot;%s&quot;
# last 18 bytes of newer tga file footer signature
&gt;18	search/4261301/s	TRUEVISION-XFILE.\0
# extension area offset if not 0
&gt;&gt;&amp;-8		ulelong			&gt;0
# length of the extension area. normal 495 for version 2.0
&gt;&gt;&gt;(&amp;-4.l)	uleshort		0x01EF
# AuthorName[41]
&gt;&gt;&gt;&gt;&amp;0		string			&gt;\0		- author &quot;%-.40s&quot;
# Comment[324]=4 * 80 null terminated
&gt;&gt;&gt;&gt;&amp;41		string			&gt;\0		- comment &quot;%-.80s&quot;
# date
&gt;&gt;&gt;&gt;&amp;365	ubequad&amp;0xffffFFFFffff0000	!0
# Day
&gt;&gt;&gt;&gt;&gt;&amp;-6		uleshort		x		%d
# Month
&gt;&gt;&gt;&gt;&gt;&amp;-8		uleshort		x		\b-%d
# Year
&gt;&gt;&gt;&gt;&gt;&amp;-4		uleshort		x		\b-%d
# time
&gt;&gt;&gt;&gt;&amp;371	ubequad&amp;0xffffFFFFffff0000	!0
# hour
&gt;&gt;&gt;&gt;&gt;&amp;-8		uleshort		x		%d
# minutes
&gt;&gt;&gt;&gt;&gt;&amp;-6		uleshort		x		\b:%.2d
# second
&gt;&gt;&gt;&gt;&gt;&amp;-4		uleshort		x		\b:%.2d
# JobName[41]
&gt;&gt;&gt;&gt;&amp;377		string			&gt;\0		- job &quot;%-.40s&quot;
# JobHour Jobminute Jobsecond
&gt;&gt;&gt;&gt;&amp;418	ubequad&amp;0xffffFFFFffff0000	!0
&gt;&gt;&gt;&gt;&gt;&amp;-8		uleshort		x		%d
&gt;&gt;&gt;&gt;&gt;&amp;-6		uleshort		x		\b:%.2d
&gt;&gt;&gt;&gt;&gt;&amp;-4		uleshort		x		\b:%.2d
# SoftwareId[41]
&gt;&gt;&gt;&gt;&amp;424		string			&gt;\0		- %-.40s
# SoftwareVersionNumber
&gt;&gt;&gt;&gt;&amp;424	ubyte				&gt;0
&gt;&gt;&gt;&gt;&gt;&amp;40		uleshort/100		x		%d
&gt;&gt;&gt;&gt;&gt;&amp;40		uleshort%100		x		\b.%d
# VersionLetter
&gt;&gt;&gt;&gt;&gt;&amp;42		ubyte			&gt;0x20		\b%c
# KeyColor
&gt;&gt;&gt;&gt;&amp;468		ulelong			&gt;0		- keycolor 0x%8.8x
# Denominator of Pixel ratio. 0~no pixel aspect
&gt;&gt;&gt;&gt;&amp;474	uleshort			&gt;0
# Numerator
&gt;&gt;&gt;&gt;&gt;&amp;-4		uleshort		&gt;0		- aspect %d
&gt;&gt;&gt;&gt;&gt;&amp;-2		uleshort		x		\b/%d
# Denominator of Gamma ratio. 0~no Gamma value
&gt;&gt;&gt;&gt;&amp;478	uleshort			&gt;0
# Numerator
&gt;&gt;&gt;&gt;&gt;&amp;-4		uleshort		&gt;0		- gamma %d
&gt;&gt;&gt;&gt;&gt;&amp;-2		uleshort		x		\b/%d
# ColorOffset
#&gt;&gt;&gt;&gt;&amp;480	ulelong			x		- col offset 0x%8.8x
# StampOffset
#&gt;&gt;&gt;&gt;&amp;484	ulelong			x		- stamp offset 0x%8.8x
# ScanOffset
#&gt;&gt;&gt;&gt;&amp;488	ulelong			x		- scan offset 0x%8.8x
# AttributesType
#&gt;&gt;&gt;&gt;&amp;492	ubyte			x		- Attributes 0x%x
## EndOfTGA

# PBMPLUS images
# The next byte following the magic is always whitespace.
# strength is changed to try these patterns before &quot;x86 boot sector&quot;
0	name		netpbm
&gt;3	regex/s		=[0-9]{1,50}\ [0-9]{1,50}	Netpbm image data
&gt;&gt;&amp;0	regex		=[0-9]{1,50} 			\b, size = %s x
&gt;&gt;&gt;&amp;0	regex		=[0-9]{1,50}			\b %s

0	search/1	P1
&gt;0	regex/4		P1[\040\t\f\r\n]
&gt;&gt;0	use		netpbm
&gt;&gt;&gt;0	string		x	\b, bitmap
!:strength + 65
!:mime	image/x-portable-bitmap

0	search/1	P2
&gt;0	regex/4		P2[\040\t\f\r\n]
&gt;&gt;0	use		netpbm
&gt;&gt;&gt;0	string		x	\b, greymap
!:strength + 65
!:mime	image/x-portable-greymap

0	search/1	P3
&gt;0	regex/4		P3[\040\t\f\r\n]
&gt;&gt;0	use		netpbm
&gt;&gt;&gt;0	string		x	\b, pixmap
!:strength + 65
!:mime	image/x-portable-pixmap

0	string		P4
&gt;0	regex/4		P4[\040\t\f\r\n]
&gt;&gt;0	use		netpbm
&gt;&gt;&gt;0	string		x	\b, rawbits, bitmap
!:strength + 65
!:mime	image/x-portable-bitmap

0	string		P5
&gt;0	regex/4		P5[\040\t\f\r\n]
&gt;&gt;0	use		netpbm
&gt;&gt;&gt;0	string		x	\b, rawbits, greymap
!:strength + 65
!:mime	image/x-portable-greymap

0	string		P6
&gt;0	regex/4		P6[\040\t\f\r\n]
&gt;&gt;0	use		netpbm
&gt;&gt;&gt;0	string		x	\b, rawbits, pixmap
!:strength + 65
!:mime	image/x-portable-pixmap

0	string		P7		Netpbm PAM image file
!:mime	image/x-portable-pixmap

# From: bryanh@giraffe-data.com (Bryan Henderson)
0	string		\117\072	Solitaire Image Recorder format
&gt;4	string		\013		MGI Type 11
&gt;4	string		\021		MGI Type 17
0	string		.MDA		MicroDesign data
&gt;21	byte		48		version 2
&gt;21	byte		51		version 3
0	string		.MDP		MicroDesign page data
&gt;21	byte		48		version 2
&gt;21	byte		51		version 3

# NIFF (Navy Interchange File Format, a modification of TIFF) images
# [GRR:  this *must* go before TIFF]
0	string		IIN1		NIFF image data
!:mime	image/x-niff

# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
# (CIFF) file. These are apparently all little-endian.
# From: Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
0	string		II\x1a\0\0\0HEAPCCDR	Canon CIFF raw image data
!:mime	image/x-canon-crw
&gt;16	leshort		x	\b, version %d.
&gt;14	leshort		x	\b%d

# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
# number. Put this above the TIFF test to make sure we detect them.
# These are apparently all little-endian.
# From: Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2
0	string		II\x2a\0\x10\0\0\0CR	Canon CR2 raw image data
!:mime	image/x-canon-cr2
&gt;10	byte		x	\b, version %d.
&gt;11	byte		x	\b%d

# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
# The second word of TIFF files is the TIFF version number, 42, which has
# never changed.  The TIFF specification recommends testing for it.
0	string		MM\x00\x2a	TIFF image data, big-endian
!:mime	image/tiff
&gt;(4.L)	use		\^tiff_ifd
0	string		II\x2a\x00	TIFF image data, little-endian
!:mime	image/tiff
&gt;(4.l)	use		tiff_ifd

0	name		tiff_ifd
&gt;0	leshort		x		\b, direntries=%d
&gt;2	use		tiff_entry

0	name		tiff_entry
# NewSubFileType
&gt;0	leshort		0xfe
&gt;&gt;12	use		tiff_entry
&gt;0	leshort		0x100
&gt;&gt;4	lelong		1
&gt;&gt;&gt;12	use		tiff_entry
&gt;&gt;&gt;8	leshort		x		\b, width=%d
&gt;0	leshort		0x101
&gt;&gt;4	lelong		1
&gt;&gt;&gt;8	leshort		x		\b, height=%d
&gt;&gt;&gt;12	use		tiff_entry
&gt;0	leshort		0x102
&gt;&gt;8	leshort		x		\b, bps=%d
&gt;&gt;12	use		tiff_entry
&gt;0	leshort		0x103
&gt;&gt;4	lelong		1		\b, compression=
&gt;&gt;&gt;8	leshort		1		\bnone
&gt;&gt;&gt;8	leshort		2		\bhuffman
&gt;&gt;&gt;8	leshort		3		\bbi-level group 3
&gt;&gt;&gt;8	leshort		4		\bbi-level group 4
&gt;&gt;&gt;8	leshort		5		\bLZW
&gt;&gt;&gt;8	leshort		6		\bJPEG (old)
&gt;&gt;&gt;8	leshort		7		\bJPEG
&gt;&gt;&gt;8	leshort		8		\bdeflate
&gt;&gt;&gt;8	leshort		9		\bJBIG, ITU-T T.85
&gt;&gt;&gt;8	leshort		0xa		\bJBIG, ITU-T T.43
&gt;&gt;&gt;8	leshort		0x7ffe		\bNeXT RLE 2-bit
&gt;&gt;&gt;8	leshort		0x8005		\bPackBits (Macintosh RLE)
&gt;&gt;&gt;8	leshort		0x8029		\bThunderscan RLE
&gt;&gt;&gt;8	leshort		0x807f		\bRasterPadding (CT or MP)
&gt;&gt;&gt;8	leshort		0x8080		\bRLE (Line Work)
&gt;&gt;&gt;8	leshort		0x8081		\bRLE (High-Res Cont-Tone)
&gt;&gt;&gt;8	leshort		0x8082		\bRLE (Binary Line Work)
&gt;&gt;&gt;8	leshort		0x80b2		\bDeflate (PKZIP)
&gt;&gt;&gt;8	leshort		0x80b3		\bKodak DCS
&gt;&gt;&gt;8	leshort		0x8765		\bJBIG
&gt;&gt;&gt;8	leshort		0x8798		\bJPEG2000
&gt;&gt;&gt;8	leshort		0x8799		\bNikon NEF Compressed
&gt;&gt;&gt;8	default		x
&gt;&gt;&gt;&gt;8	leshort		x		\b(unknown 0x%x)
&gt;&gt;&gt;12	use		tiff_entry
&gt;0	leshort		0x106		\b, PhotometricIntepretation=
&gt;&gt;8	clear		x
&gt;&gt;8	leshort		0		\bWhiteIsZero
&gt;&gt;8	leshort		1		\bBlackIsZero
&gt;&gt;8	leshort		2		\bRGB
&gt;&gt;8	leshort		3		\bRGB Palette
&gt;&gt;8	leshort		4		\bTransparency Mask
&gt;&gt;8	leshort		5		\bCMYK
&gt;&gt;8	leshort		6		\bYCbCr
&gt;&gt;8	leshort		8		\bCIELab
&gt;&gt;8	default		x
&gt;&gt;&gt;8	leshort		x		\b(unknown=0x%x)
&gt;&gt;12	use		tiff_entry
# FillOrder
&gt;0	leshort		0x10a
&gt;&gt;4	lelong		1
&gt;&gt;&gt;12	use		tiff_entry
# DocumentName
&gt;0	leshort		0x10d
&gt;&gt;(8.l)	string		x		\b, name=%s
&gt;&gt;&gt;12	use		tiff_entry
# ImageDescription
&gt;0	leshort		0x10e
&gt;&gt;(8.l)	string		x		\b, description=%s
&gt;&gt;&gt;12	use		tiff_entry
# Make
&gt;0	leshort		0x10f
&gt;&gt;(8.l)	string		x		\b, manufacturer=%s
&gt;&gt;&gt;12	use		tiff_entry
# Model
&gt;0	leshort		0x110
&gt;&gt;(8.l)	string		x		\b, model=%s
&gt;&gt;&gt;12	use		tiff_entry
# StripOffsets
&gt;0	leshort		0x111
&gt;&gt;12	use		tiff_entry
# Orientation
&gt;0	leshort		0x112		\b, orientation=
&gt;&gt;8	leshort		1		\bupper-left
&gt;&gt;8	leshort		3		\blower-right
&gt;&gt;8	leshort		6		\bupper-right
&gt;&gt;8	leshort		8		\blower-left
&gt;&gt;8	leshort		9		\bundefined
&gt;&gt;8	default		x
&gt;&gt;&gt;8	leshort		x		\b[*%d*]
&gt;&gt;12	use		tiff_entry
# XResolution
&gt;0	leshort		0x11a
&gt;&gt;8	lelong		x		\b, xresolution=%d
&gt;&gt;12	use		tiff_entry
# YResolution
&gt;0	leshort		0x11b
&gt;&gt;8	lelong		x		\b, yresolution=%d
&gt;&gt;12	use		tiff_entry
# ResolutionUnit
&gt;0	leshort		0x128
&gt;&gt;8	leshort		x		\b, resolutionunit=%d
&gt;&gt;12	use		tiff_entry
# Software
&gt;0	leshort		0x131
&gt;&gt;(8.l)	string		x		\b, software=%s
&gt;&gt;12	use		tiff_entry
# Datetime
&gt;0	leshort		0x132
&gt;&gt;(8.l)	string		x		\b, datetime=%s
&gt;&gt;12	use		tiff_entry
# HostComputer
&gt;0	leshort		0x13c
&gt;&gt;(8.l)	string		x		\b, hostcomputer=%s
&gt;&gt;12	use		tiff_entry
# WhitePoint
&gt;0	leshort		0x13e
&gt;&gt;12	use		tiff_entry
# PrimaryChromaticities
&gt;0	leshort		0x13f
&gt;&gt;12	use		tiff_entry
# YCbCrCoefficients
&gt;0	leshort		0x211
&gt;&gt;12	use		tiff_entry
# YCbCrPositioning
&gt;0	leshort		0x213
&gt;&gt;12	use		tiff_entry
# ReferenceBlackWhite
&gt;0	leshort		0x214
&gt;&gt;12	use		tiff_entry
# Copyright
&gt;0	leshort		0x8298
&gt;&gt;(8.l)	string		x		\b, copyright=%s
&gt;&gt;12	use		tiff_entry
# ExifOffset
&gt;0	leshort		0x8769
&gt;&gt;12	use		tiff_entry
# GPS IFD
&gt;0	leshort		0x8825		\b, GPS-Data
&gt;&gt;12	use		tiff_entry

#&gt;0	leshort		x		\b, unknown=0x%x
#&gt;&gt;12	use		tiff_entry

0	string		MM\x00\x2b	Big TIFF image data, big-endian
!:mime	image/tiff
0	string		II\x2b\x00	Big TIFF image data, little-endian
!:mime	image/tiff

# PNG [Portable Network Graphics, or &quot;PNG&#039;s Not GIF&quot;] images
# (Greg Roelofs, newt@uchicago.edu)
# (Albert Cahalan, acahalan@cs.uml.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ...
#

# IHDR parser
0	name		png-ihdr
&gt;0	belong		x		\b, %d x
&gt;4	belong		x		%d,
&gt;8	byte		x		%d-bit
&gt;9	byte		0		grayscale,
&gt;9	byte		2		\b/color RGB,
&gt;9	byte		3		colormap,
&gt;9	byte		4		gray+alpha,
&gt;9	byte		6		\b/color RGBA,
#&gt;10	byte		0		deflate/32K,
&gt;12	byte		0		non-interlaced
&gt;12	byte		1		interlaced

# Standard PNG image.
0	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR	PNG image data
!:mime	image/png
!:strength +10
&gt;16	use		png-ihdr

# Apple CgBI PNG image.
0	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
&gt;24	string  	\x00\x00\x00\x0DIHDR	PNG image data (CgBI)
!:mime	image/png
!:strength +10
&gt;&gt;32	use		png-ihdr

# possible GIF replacements; none yet released!
# (Greg Roelofs, newt@uchicago.edu)
#
# GRR 950115:  this was mine (&quot;Zip GIF&quot;):
0	string		GIF94z		ZIF image (GIF+deflate alpha)
!:mime	image/x-unknown
#
# GRR 950115:  this is Jeremy Wohl&#039;s Free Graphics Format (better):
#
0	string		FGF95a		FGF image (GIF+deflate beta)
!:mime	image/x-unknown
#
# GRR 950115:  this is Thomas Boutell&#039;s Portable Bitmap Format proposal
# (best; not yet implemented):
#
0	string		PBF		PBF image (deflate compression)
!:mime	image/x-unknown

# GIF
# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65)
0	string		GIF8		GIF image data
!:strength +80
!:mime	image/gif
!:apple	8BIMGIFf
&gt;4	string		7a		\b, version 8%s,
&gt;4	string		9a		\b, version 8%s,
&gt;6	leshort		&gt;0		%d x
&gt;8	leshort		&gt;0		%d
#&gt;10	byte		&amp;0x80		color mapped,
#&gt;10	byte&amp;0x07	=0x00		2 colors
#&gt;10	byte&amp;0x07	=0x01		4 colors
#&gt;10	byte&amp;0x07	=0x02		8 colors
#&gt;10	byte&amp;0x07	=0x03		16 colors
#&gt;10	byte&amp;0x07	=0x04		32 colors
#&gt;10	byte&amp;0x07	=0x05		64 colors
#&gt;10	byte&amp;0x07	=0x06		128 colors
#&gt;10	byte&amp;0x07	=0x07		256 colors

# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
# 1 plane, no encoding.
0	string		\361\0\100\273	CMU window manager raster image data
&gt;4	lelong		&gt;0		%d x
&gt;8	lelong		&gt;0		%d,
&gt;12	lelong		&gt;0		%d-bit

# Magick Image File Format
0	string		id=ImageMagick	MIFF image data

# Artisan
0	long		1123028772	Artisan image data
&gt;4	long		1		\b, rectangular 24-bit
&gt;4	long		2		\b, rectangular 8-bit with colormap
&gt;4	long		3		\b, rectangular 32-bit (24-bit with matte)

# FIG (Facility for Interactive Generation of figures), an object-based format
0	search/1	#FIG		FIG image text
&gt;5	string		x		\b, version %.3s

# PHIGS
0	string		ARF_BEGARF		PHIGS clear text archive
0	string		@(#)SunPHIGS		SunPHIGS
# version number follows, in the form m.n
&gt;40	string		SunBin			binary
&gt;32	string		archive			archive

# GKS (Graphics Kernel System)
0	string		GKSM		GKS Metafile
&gt;24	string		SunGKS		\b, SunGKS

# CGM image files
0	string		BEGMF		clear text Computer Graphics Metafile

# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
0	string	yz	MGR bitmap, modern format, 8-bit aligned
0	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
0	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
0	string	yx	MGR bitmap, modern format, squeezed

# Fuzzy Bitmap (FBM) images
0	string		%bitmap\0	FBM image data
&gt;30	long		0x31		\b, mono
&gt;30	long		0x33		\b, color

# facsimile data
1	string		PC\ Research,\ Inc	group 3 fax data
&gt;29	byte		0		\b, normal resolution (204x98 DPI)
&gt;29	byte		1		\b, fine resolution (204x196 DPI)
# From: Herbert Rosmanith &lt;herp@wildsau.idv.uni.linz.at&gt;
0	string		Sfff		structured fax file

# From: Joerg Jenderek &lt;joerg.jen.der.ek@gmx.net&gt;
# most files with the extension .EPA and some with .BMP
0	string		\x11\x06	Award BIOS Logo, 136 x 84
!:mime	image/x-award-bioslogo
0	string		\x11\x09	Award BIOS Logo, 136 x 126
!:mime	image/x-award-bioslogo
#0	string		\x07\x1f	BIOS Logo corrupted?
# http://www.blackfiveservices.co.uk/awbmtools.shtml
# http://biosgfx.narod.ru/v3/
# http://biosgfx.narod.ru/abr-2/
0	string		AWBM
&gt;4	leshort		&lt;1981		Award BIOS bitmap
!:mime	image/x-award-bmp
# image width is a multiple of 4
&gt;&gt;4	leshort&amp;0x0003	0
&gt;&gt;&gt;4		leshort	x		\b, %d
&gt;&gt;&gt;6		leshort	x		x %d
&gt;&gt;4	leshort&amp;0x0003	&gt;0		\b,
&gt;&gt;&gt;4	leshort&amp;0x0003	=1
&gt;&gt;&gt;&gt;4		leshort	x		%d+3
&gt;&gt;&gt;4	leshort&amp;0x0003	=2
&gt;&gt;&gt;&gt;4		leshort	x		%d+2
&gt;&gt;&gt;4	leshort&amp;0x0003	=3
&gt;&gt;&gt;&gt;4		leshort	x		%d+1
&gt;&gt;&gt;6		leshort	x		x %d
# at offset 8 starts imagedata followed by &quot;RGB &quot; marker

# PC bitmaps (OS/2, Windows BMP files)  (Greg Roelofs, newt@uchicago.edu)
# http://en.wikipedia.org/wiki/BMP_file_format#DIB_header_.\
# 28bitmap_information_header.29
0	string		BM
&gt;14	leshort		12		PC bitmap, OS/2 1.x format
!:mime	image/x-ms-bmp
&gt;&gt;18	leshort		x		\b, %d x
&gt;&gt;20	leshort		x		%d
&gt;14	leshort		64		PC bitmap, OS/2 2.x format
!:mime	image/x-ms-bmp
&gt;&gt;18	leshort		x		\b, %d x
&gt;&gt;20	leshort		x		%d
&gt;14	leshort		40		PC bitmap, Windows 3.x format
!:mime	image/x-ms-bmp
&gt;&gt;18	lelong		x		\b, %d x
&gt;&gt;22	lelong		x		%d x
&gt;&gt;28	leshort		x		%d
&gt;14	leshort		124		PC bitmap, Windows 98/2000 and newer format
!:mime	image/x-ms-bmp
&gt;&gt;18	lelong		x		\b, %d x
&gt;&gt;22	lelong		x		%d x
&gt;&gt;28	leshort		x		%d
&gt;14	leshort		108		PC bitmap, Windows 95/NT4 and newer format
!:mime	image/x-ms-bmp
&gt;&gt;18	lelong		x		\b, %d x
&gt;&gt;22	lelong		x		%d x
&gt;&gt;28	leshort		x		%d
&gt;14	leshort		128		PC bitmap, Windows NT/2000 format
!:mime	image/x-ms-bmp
&gt;&gt;18	lelong		x		\b, %d x
&gt;&gt;22	lelong		x		%d x
&gt;&gt;28	leshort		x		%d
# Too simple - MPi
#0	string		IC		PC icon data
#0	string		PI		PC pointer image data
#0	string		CI		PC color icon data
#0	string		CP		PC color pointer image data
# Conflicts with other entries [BABYL]
#0	string		BA		PC bitmap array data

# XPM icons (Greg Roelofs, newt@uchicago.edu)
0	search/1	/*\ XPM\ */	X pixmap image text
!:mime	image/x-xpmi

# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
0	leshort		0xcc52		RLE image data,
&gt;6	leshort		x		%d x
&gt;8	leshort		x		%d
&gt;2	leshort		&gt;0		\b, lower left corner: %d
&gt;4	leshort		&gt;0		\b, lower right corner: %d
&gt;10	byte&amp;0x1	=0x1		\b, clear first
&gt;10	byte&amp;0x2	=0x2		\b, no background
&gt;10	byte&amp;0x4	=0x4		\b, alpha channel
&gt;10	byte&amp;0x8	=0x8		\b, comment
&gt;11	byte		&gt;0		\b, %d color channels
&gt;12	byte		&gt;0		\b, %d bits per pixel
&gt;13	byte		&gt;0		\b, %d color map channels

# image file format (Robert Potter, potter@cs.rochester.edu)
0	string		Imagefile\ version-	iff image data
# this adds the whole header (inc. version number), informative but longish
&gt;10	string		&gt;\0		%s

# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
0	belong		0x59a66a95	Sun raster image data
&gt;4	belong		&gt;0		\b, %d x
&gt;8	belong		&gt;0		%d,
&gt;12	belong		&gt;0		%d-bit,
#&gt;16	belong		&gt;0		%d bytes long,
&gt;20	belong		0		old format,
#&gt;20	belong		1		standard,
&gt;20	belong		2		compressed,
&gt;20	belong		3		RGB,
&gt;20	belong		4		TIFF,
&gt;20	belong		5		IFF,
&gt;20	belong		0xffff		reserved for testing,
&gt;24	belong		0		no colormap
&gt;24	belong		1		RGB colormap
&gt;24	belong		2		raw colormap
#&gt;28	belong		&gt;0		colormap is %d bytes long

# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# See
#	http://reality.sgi.com/grafica/sgiimage.html
#
0	beshort		474		SGI image data
#&gt;2	byte		0		\b, verbatim
&gt;2	byte		1		\b, RLE
#&gt;3	byte		1		\b, normal precision
&gt;3	byte		2		\b, high precision
&gt;4	beshort		x		\b, %d-D
&gt;6	beshort		x		\b, %d x
&gt;8	beshort		x		%d
&gt;10	beshort		x		\b, %d channel
&gt;10	beshort		!1		\bs
&gt;80	string		&gt;0		\b, &quot;%s&quot;

0	string		IT01		FIT image data
&gt;4	belong		x		\b, %d x
&gt;8	belong		x		%d x
&gt;12	belong		x		%d
#
0	string		IT02		FIT image data
&gt;4	belong		x		\b, %d x
&gt;8	belong		x		%d x
&gt;12	belong		x		%d
#
2048	string		PCD_IPI		Kodak Photo CD image pack file
&gt;0xe02	byte&amp;0x03	0x00		, landscape mode
&gt;0xe02	byte&amp;0x03	0x01		, portrait mode
&gt;0xe02	byte&amp;0x03	0x02		, landscape mode
&gt;0xe02	byte&amp;0x03	0x03		, portrait mode
0	string		PCD_OPA		Kodak Photo CD overview pack file

# FITS format.  Jeff Uphoff &lt;juphoff@tarsier.cv.nrao.edu&gt;
# FITS is the Flexible Image Transport System, the de facto standard for
# data and image transfer, storage, etc., for the astronomical community.
# (FITS floating point formats are big-endian.)
0	string	SIMPLE\ \ =	FITS image data
&gt;109	string	8		\b, 8-bit, character or unsigned binary integer
&gt;108	string	16		\b, 16-bit, two&#039;s complement binary integer
&gt;107	string	\ 32		\b, 32-bit, two&#039;s complement binary integer
&gt;107	string	-32		\b, 32-bit, floating point, single precision
&gt;107	string	-64		\b, 64-bit, floating point, double precision

# other images
0	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file

# From SunOS 5.5.1 &quot;/etc/magic&quot; - appeared right before Sun raster image
# stuff.
#
0	beshort		0x1010		PEX Binary Archive

# DICOM medical imaging data
# URL:		https://en.wikipedia.org/wiki/DICOM#Data_format
# Note:		&quot;dcm&quot; is the official file name extension
# 		XnView mention also &quot;dc3&quot; and &quot;acr&quot; as file name extension
128	string	DICM			DICOM medical imaging data
!:mime	application/dicom
!:ext dcm/dicom/dic

# XWD - X Window Dump file.
#   As described in /usr/X11R6/include/X11/XWDFile.h
#   used by the xwd program.
#   Bradford Castalia, idaeim, 1/01
#   updated by Adam Buchbinder, 2/09
# The following assumes version 7 of the format; the first long is the length
# of the header, which is at least 25 4-byte longs, and the one at offset 8
# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
# which is a maximum of 32.
0	belong	&gt;100
&gt;8	belong	&lt;3
&gt;&gt;12	belong	&lt;33
&gt;&gt;&gt;4	belong	7			XWD X Window Dump image data
!:mime	image/x-xwindowdump
&gt;&gt;&gt;&gt;100	string	&gt;\0			\b, &quot;%s&quot;
&gt;&gt;&gt;&gt;16	belong	x			\b, %dx
&gt;&gt;&gt;&gt;20	belong	x			\b%dx
&gt;&gt;&gt;&gt;12	belong	x			\b%d

# PDS - Planetary Data System
#   These files use Parameter Value Language in the header section.
#   Unfortunately, there is no certain magic, but the following
#   strings have been found to be most likely.
0	string	NJPL1I00		PDS (JPL) image data
2	string	NJPL1I			PDS (JPL) image data
0	string	CCSD3ZF			PDS (CCSD) image data
2	string	CCSD3Z			PDS (CCSD) image data
0	string	PDS_			PDS image data
0	string	LBLSIZE=		PDS (VICAR) image data

# pM8x: ATARI STAD compressed bitmap format
#
# from Oskar Schirmer &lt;schirmer@scara.com&gt; Feb 2, 2001
# p M 8 5/6 xx yy zz data...
# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
# bytes either run horizontally (pM85) or vertically (pM86). yy is the
# most frequent byte, xx and zz are runlength escape codes, where xx is
# used for runs of yy.
#
0	string	pM85		Atari ST STAD bitmap image data (hor)
&gt;5	byte	0x00		(white background)
&gt;5	byte	0xFF		(black background)
0	string	pM86		Atari ST STAD bitmap image data (vert)
&gt;5	byte	0x00		(white background)
&gt;5	byte	0xFF		(black background)

# From: Alex Myczko &lt;alex@aiei.ch&gt;
# http://www.atarimax.com/jindroush.atari.org/afmtatr.html
0	leshort	0x0296		Atari ATR image

# XXX:
# This is bad magic 0x5249 == &#039;RI&#039; conflicts with RIFF and other
# magic.
# SGI RICE image file &lt;mpruett@sgi.com&gt;
#0	beshort	0x5249		RICE image
#&gt;2	beshort	x		v%d
#&gt;4	beshort	x		(%d x
#&gt;6	beshort	x		%d)
#&gt;8	beshort	0		8 bit
#&gt;8	beshort	1		10 bit
#&gt;8	beshort	2		12 bit
#&gt;8	beshort	3		13 bit
#&gt;10	beshort	0		4:2:2
#&gt;10	beshort	1		4:2:2:4
#&gt;10	beshort	2		4:4:4
#&gt;10	beshort	3		4:4:4:4
#&gt;12	beshort	1		RGB
#&gt;12	beshort	2		CCIR601
#&gt;12	beshort	3		RP175
#&gt;12	beshort	4		YUV

# PCX image files
# From: Dan Fandrich &lt;dan@coneharvesters.com&gt;
# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX
# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (&gt;0) of PCX or T5.DBT,T6.DBT
0	ubelong&amp;0xffF8fe00	0x0a000000
# for PCX bit depth &gt; 0
&gt;3	ubyte		&gt;0
# test for valid versions
&gt;&gt;1	ubyte		&lt;6
&gt;&gt;&gt;1	ubyte		!1	PCX
!:mime	image/x-pcx
#!:mime	image/pcx
&gt;&gt;&gt;&gt;1	ubyte		0	ver. 2.5 image data
&gt;&gt;&gt;&gt;1	ubyte		2	ver. 2.8 image data, with palette
&gt;&gt;&gt;&gt;1	ubyte		3	ver. 2.8 image data, without palette
&gt;&gt;&gt;&gt;1	ubyte		4	for Windows image data
&gt;&gt;&gt;&gt;1	ubyte		5	ver. 3.0 image data
&gt;&gt;&gt;&gt;4	uleshort	x	bounding box [%d,
&gt;&gt;&gt;&gt;6	uleshort	x	%d] -
&gt;&gt;&gt;&gt;8	uleshort	x	[%d,
&gt;&gt;&gt;&gt;10	uleshort	x	%d],
&gt;&gt;&gt;&gt;65	ubyte		&gt;1	%d planes each of
&gt;&gt;&gt;&gt;3	ubyte		x	%d-bit
&gt;&gt;&gt;&gt;68	byte		1	colour,
&gt;&gt;&gt;&gt;68	byte		2	grayscale,
# this should not happen
&gt;&gt;&gt;&gt;68	default		x	image,
&gt;&gt;&gt;&gt;12	leshort		&gt;0	%d x
&gt;&gt;&gt;&gt;&gt;14	uleshort	x	%d dpi,
&gt;&gt;&gt;&gt;2	byte		0	uncompressed
&gt;&gt;&gt;&gt;2	byte		1	RLE compressed

# Adobe Photoshop
# From: Asbjoern Sloth Toennesen &lt;asbjorn@lila.io&gt;
0	string		8BPS Adobe Photoshop Image
!:mime	image/vnd.adobe.photoshop
&gt;4   beshort 2 (PSB)
&gt;18  belong  x \b, %d x
&gt;14  belong  x %d,
&gt;24  beshort 0 bitmap
&gt;24  beshort 1 grayscale
&gt;&gt;12 beshort 2 with alpha
&gt;24  beshort 2 indexed
&gt;24  beshort 3 RGB
&gt;&gt;12 beshort 4 \bA
&gt;24  beshort 4 CMYK
&gt;&gt;12 beshort 5 \bA
&gt;24  beshort 7 multichannel
&gt;24  beshort 8 duotone
&gt;24  beshort 9 lab
&gt;12  beshort &gt; 1
&gt;&gt;12  beshort x \b, %dx
&gt;12  beshort 1 \b,
&gt;22  beshort x %d-bit channel
&gt;12  beshort &gt; 1 \bs

# XV thumbnail indicator (ThMO)
0	string		P7\ 332		XV thumbnail image data

# NITF is defined by United States MIL-STD-2500A
0	string	NITF	National Imagery Transmission Format
&gt;25	string	&gt;\0	dated %.14s

# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
# Format variations from: Bernd Nuernberger &lt;bernd.nuernberger@web.de&gt;
# Update: Joerg Jenderek
# See http://fileformats.archiveteam.org/wiki/GEM_Raster
# For variations, also see:
#    http://www.seasip.info/Gem/ff_img.html (Ventura)
#    http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
#    http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
#    http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
0       beshort     0x0001
# header_size
&gt;2      beshort     0x0008
&gt;&gt;0     use gem_info
&gt;2      beshort     0x0009
&gt;&gt;0     use gem_info
# no example for NOSIG
&gt;2      beshort     24
&gt;&gt;0     use gem_info
# no example for HYPERPAINT
&gt;2      beshort     25
&gt;&gt;0     use gem_info
16      string      XIMG\0
&gt;0      use gem_info
# no example
16      string      STTT\0\x10
&gt;0      use gem_info
# no example or description
16      string      TIMG\0
&gt;0      use gem_info

0   name        gem_info
# version is 2 for some XIMG and 1 for all others
&gt;0	beshort		&lt;0x0003		GEM
# http://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
!:mime	image/x-gem
# header_size 24 25 27 59 779 words for colored bitmaps
&gt;&gt;2	beshort		&gt;9
&gt;&gt;&gt;16	string		STTT\0\x10	STTT
&gt;&gt;&gt;16	string		TIMG\0		TIMG
# HYPERPAINT or NOSIG variant
&gt;&gt;&gt;16	string		\0\x80
&gt;&gt;&gt;&gt;2	beshort		=24		NOSIG
&gt;&gt;&gt;&gt;2	beshort		!24		HYPERPAINT
# NOSIG or XIMG variant
&gt;&gt;&gt;16	default		x
&gt;&gt;&gt;&gt;16	string		!XIMG\0		NOSIG
&gt;&gt;16	string		=XIMG\0		XIMG Image data
!:ext	img/ximg
# to avoid Warning: Current entry does not yet have a description for adding a EXTENSION type
&gt;&gt;16	string		!XIMG\0		Image data
!:ext	img
# header_size is 9 for Ventura files and 8 for other GEM Paint files
&gt;&gt;2	beshort		9		(Ventura)
#&gt;&gt;2	beshort		8		(Paint)
&gt;&gt;12	beshort		x		%d x
&gt;&gt;14	beshort		x		%d,
# 1 4 8
&gt;&gt;4	beshort		x		%d planes,
# in tenths of a millimetre
&gt;&gt;8	beshort		x		%d x
&gt;&gt;10	beshort		x		%d pixelsize
# pattern_size 1-8. 2 for GEM Paint
&gt;&gt;6	beshort		!2		\b, pattern size %d

# GEM Metafile (Wolfram Kleff)
0	lelong		0x0018FFFF	GEM Metafile data
&gt;4	leshort		x		version %d

#
# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
# Software Torbjorn Andersson &lt;d91tan@Update.UU.SE&gt;.
#
0	string	\0\nSMJPEG	SMJPEG
&gt;8	belong	x		%d.x data
# According to the specification you could find any number of _TXT
# headers here, but I can&#039;t think of any way of handling that. None of
# the SMJPEG files I tried it on used this feature. Even if such a
# file is encountered the output should still be reasonable.
&gt;16	string	_SND		\b,
&gt;&gt;24	beshort	&gt;0		%d Hz
&gt;&gt;26	byte	8		8-bit
&gt;&gt;26	byte	16		16-bit
&gt;&gt;28	string	NONE		uncompressed
# &gt;&gt;28	string	APCM		ADPCM compressed
&gt;&gt;27	byte	1		mono
&gt;&gt;28	byte	2		stereo
# Help! Isn&#039;t there any way to avoid writing this part twice?
&gt;&gt;32	string	_VID		\b,
# &gt;&gt;&gt;48	string	JFIF		JPEG
&gt;&gt;&gt;40	belong	&gt;0		%d frames
&gt;&gt;&gt;44	beshort	&gt;0		(%d x
&gt;&gt;&gt;46	beshort	&gt;0		%d)
&gt;16	string	_VID		\b,
# &gt;&gt;32	string	JFIF		JPEG
&gt;&gt;24	belong	&gt;0		%d frames
&gt;&gt;28	beshort	&gt;0		(%d x
&gt;&gt;30	beshort	&gt;0		%d)

0	string	Paint\ Shop\ Pro\ Image\ File	Paint Shop Pro Image File

# &quot;thumbnail file&quot; (icon)
# descended from &quot;xv&quot;, but in use by other applications as well (Wolfram Kleff)
0       string          P7\ 332         XV &quot;thumbnail file&quot; (icon) data

# taken from fkiss: (&lt;yav@mte.biglobe.ne.jp&gt; ?)
0       string          KiSS            KISS/GS
&gt;4      byte            16              color
&gt;&gt;5     byte            x               %d bit
&gt;&gt;8     leshort         x               %d colors
&gt;&gt;10    leshort         x               %d groups
&gt;4      byte            32              cell
&gt;&gt;5     byte            x               %d bit
&gt;&gt;8     leshort         x               %d x
&gt;&gt;10    leshort         x               %d
&gt;&gt;12    leshort         x               +%d
&gt;&gt;14    leshort         x               +%d

# Webshots (www.webshots.com), by John Harrison
0       string          C\253\221g\230\0\0\0 Webshots Desktop .wbz file

# Hercules DASD image files
# From Jan Jaeger &lt;jj@septa.nl&gt;
0       string  CKD_P370        Hercules CKD DASD image file
&gt;8      long    x               \b, %d heads per cylinder
&gt;12     long    x               \b, track size %d bytes
&gt;16     byte    x               \b, device type 33%2.2X

0       string  CKD_C370        Hercules compressed CKD DASD image file
&gt;8      long    x               \b, %d heads per cylinder
&gt;12     long    x               \b, track size %d bytes
&gt;16     byte    x               \b, device type 33%2.2X

0       string  CKD_S370        Hercules CKD DASD shadow file
&gt;8      long    x               \b, %d heads per cylinder
&gt;12     long    x               \b, track size %d bytes
&gt;16     byte    x               \b, device type 33%2.2X

# Squeak images and programs - etoffi@softhome.net
0	string		\146\031\0\0	Squeak image data
0	search/1	&#039;From\040Squeak	Squeak program text

# partimage: file(1) magic for PartImage files (experimental, incomplete)
# Author: Hans-Joachim Baader &lt;hjb@pro-linux.de&gt;
0		string	PaRtImAgE-VoLuMe	PartImage
&gt;0x0020		string	0.6.1		file version %s
&gt;&gt;0x0060	lelong	&gt;-1		volume %d
#&gt;&gt;0x0064 8 byte identifier
#&gt;&gt;0x007c reserved
&gt;&gt;0x0200	string	&gt;\0		type %s
&gt;&gt;0x1400	string	&gt;\0		device %s,
&gt;&gt;0x1600	string	&gt;\0		original filename %s,
# Some fields omitted
&gt;&gt;0x2744	lelong	0		not compressed
&gt;&gt;0x2744	lelong	1		gzip compressed
&gt;&gt;0x2744	lelong	2		bzip2 compressed
&gt;&gt;0x2744	lelong	&gt;2		compressed with unknown algorithm
&gt;0x0020		string	&gt;0.6.1		file version %s
&gt;0x0020		string	&lt;0.6.1		file version %s

# DCX is multi-page PCX, using a simple header of up to 1024
# offsets for the respective PCX components.
# From: Joerg Wunsch &lt;joerg_wunsch@uriah.heep.sax.de&gt;
0	lelong	987654321	DCX multi-page PCX image data

# Simon Walton &lt;simonw@matteworld.com&gt;
# Kodak Cineon format for scanned negatives
# http://www.kodak.com/US/en/motion/support/dlad/
0	lelong  0xd75f2a80	Cineon image data
&gt;200	belong  &gt;0		\b, %d x
&gt;204	belong  &gt;0		%d


# Bio-Rad .PIC is an image format used by microscope control systems
# and related image processing software used by biologists.
# From: Vebjorn Ljosa &lt;vebjorn@ljosa.com&gt;
# BOOL values are two-byte integers; use them to rule out false positives.
# http://web.archive.org/web/20050317223257/www.cs.ubc.ca/spider/ladic/text/biorad.txt
# Samples: http://www.loci.wisc.edu/software/sample-data
14	leshort &lt;2
&gt;62	leshort &lt;2
&gt;&gt;54	leshort 12345		Bio-Rad .PIC Image File
&gt;&gt;&gt;0	leshort &gt;0		%d x
&gt;&gt;&gt;2	leshort &gt;0		%d,
&gt;&gt;&gt;4	leshort =1		1 image in file
&gt;&gt;&gt;4	leshort &gt;1		%d images in file

# From Jan &quot;Yenya&quot; Kasprzak &lt;kas@fi.muni.cz&gt;
# The description of *.mrw format can be found at
# http://www.dalibor.cz/minolta/raw_file_format.htm
0	string	\000MRM			Minolta Dimage camera raw image data

# Summary: DjVu image / document
# Extension: .djvu
# Reference: http://djvu.org/docs/DjVu3Spec.djvu
# Submitted by: Stephane Loeuillet &lt;stephane.loeuillet@tiscali.fr&gt;
# Modified by (1): Abel Cheung &lt;abelcheung@gmail.com&gt;
0	string	AT&amp;TFORM
&gt;12	string	DJVM		DjVu multiple page document
!:mime	image/vnd.djvu
&gt;12	string	DJVU		DjVu image or single page document
!:mime	image/vnd.djvu
&gt;12	string	DJVI		DjVu shared document
!:mime	image/vnd.djvu
&gt;12	string	THUM		DjVu page thumbnails
!:mime	image/vnd.djvu

# Originally by Marc Espie
# Modified by Robert Minsk &lt;robertminsk at yahoo.com&gt;
# http://www.openexr.com/openexrfilelayout.pdf
0	lelong		20000630	OpenEXR image data,
!:mime image/x-exr
&gt;4	lelong&amp;0x000000ff x		version %d,
&gt;4	lelong		^0x00000200	storage: scanline
&gt;4	lelong		&amp;0x00000200	storage: tiled
&gt;8	search/0x1000	compression\0	\b, compression:
&gt;&gt;&amp;16	byte		0		none
&gt;&gt;&amp;16	byte		1		rle
&gt;&gt;&amp;16	byte		2		zips
&gt;&gt;&amp;16	byte		3		zip
&gt;&gt;&amp;16	byte		4		piz
&gt;&gt;&amp;16	byte		5		pxr24
&gt;&gt;&amp;16	byte		6		b44
&gt;&gt;&amp;16	byte		7		b44a
&gt;&gt;&amp;16	byte		8		dwaa
&gt;&gt;&amp;16	byte		9		dwab
&gt;&gt;&amp;16	byte		&gt;9		unknown
&gt;8	 search/0x1000	dataWindow\0	\b, dataWindow:
&gt;&gt;&amp;10	lelong		x		(%d
&gt;&gt;&amp;14	lelong		x		%d)-
&gt;&gt;&amp;18	lelong		x		\b(%d
&gt;&gt;&amp;22	lelong		x		%d)
&gt;8	search/0x1000	displayWindow\0	\b, displayWindow:
&gt;&gt;&amp;10	lelong		x		(%d
&gt;&gt;&amp;14	lelong		x		%d)-
&gt;&gt;&amp;18	lelong		x		\b(%d
&gt;&gt;&amp;22	lelong		x		%d)
&gt;8	search/0x1000	lineOrder\0	 \b, lineOrder:
&gt;&gt;&amp;14	byte		0		increasing y
&gt;&gt;&amp;14	byte		1		decreasing y
&gt;&gt;&amp;14	byte		2		random y
&gt;&gt;&amp;14	byte		&gt;2		unknown

# SMPTE Digital Picture Exchange Format, SMPTE DPX
#
# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
# Robert Minsk &lt;robertminsk at yahoo.com&gt;
# Modified by Harry Mallon &lt;hjmallon at gmail.com&gt;
0	string		SDPX	DPX image data, big-endian,
!:mime image/x-dpx
&gt;0	use		dpx_info
0	string		XPDS	DPX image data, little-endian,
!:mime image/x-dpx
&gt;0	use		\^dpx_info

0	name		dpx_info
&gt;768	beshort		&lt;4
&gt;&gt;772	belong		x	%dx
&gt;&gt;776	belong		x	\b%d,
&gt;768	beshort		&gt;3
&gt;&gt;776	belong		x	%dx
&gt;&gt;772	belong		x	\b%d,
&gt;768	beshort		0	left to right/top to bottom
&gt;768	beshort		1	right to left/top to bottom
&gt;768	beshort		2	left to right/bottom to top
&gt;768	beshort		3	right to left/bottom to top
&gt;768	beshort		4	top to bottom/left to right
&gt;768	beshort		5	top to bottom/right to left
&gt;768	beshort		6	bottom to top/left to right
&gt;768	beshort		7	bottom to top/right to left

# From: Tom Hilinski &lt;tom.hilinski@comcast.net&gt;
# http://www.unidata.ucar.edu/packages/netcdf/
0	string	CDF\001			NetCDF Data Format data

#-----------------------------------------------------------------------
# Hierarchical Data Format, used to facilitate scientific data exchange
# specifications at http://hdf.ncsa.uiuc.edu/
0	belong	0x0e031301	Hierarchical Data Format (version 4) data
!:mime	application/x-hdf
0	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) data
!:mime	application/x-hdf
512	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 512 bytes user block
!:mime	application/x-hdf
1024	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 1k user block
!:mime	application/x-hdf
2048	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 2k user block
!:mime	application/x-hdf
4096	string	\211HDF\r\n\032\n	Hierarchical Data Format (version 5) with 4k user block
!:mime	application/x-hdf


# From: Tobias Burnus &lt;burnus@net-b.de&gt;
# Xara (for a while: Corel Xara) is a graphic package, see
# http://www.xara.com/ for Windows and as GPL application for Linux
0	string	XARA\243\243	Xara graphics file

# http://www.cartesianinc.com/Tech/
0	string	CPC\262		Cartesian Perceptual Compression image
!:mime	image/x-cpi

# From Albert Cahalan &lt;acahalan@gmail.com&gt;
# puredigital used it for the CVS disposable camcorder
#8       lelong  4       ZBM bitmap image data
#&gt;4      leshort x       %u x
#&gt;6      leshort x       %u

# From Albert Cahalan &lt;acahalan@gmail.com&gt;
# uncompressed 5:6:5 HighColor image for OLPC XO firmware icons
0       string C565     OLPC firmware icon image data
&gt;4      leshort x       %u x
&gt;6      leshort x       %u

# Applied Images - Image files from Cytovision
# Gustavo Junior Alves &lt;gjalves@gjalves.com.br&gt;
0	string	\xce\xda\xde\xfa	Cytovision Metaphases file
0	string	\xed\xad\xef\xac	Cytovision Karyotype file
0	string	\x0b\x00\x03\x00	Cytovision FISH Probe file
0	string	\xed\xfe\xda\xbe	Cytovision FLEX file
0	string	\xed\xab\xed\xfe	Cytovision FLEX file
0	string	\xad\xfd\xea\xad	Cytovision RATS file

# Wavelet Scalar Quantization format used in gray-scale fingerprint images
# From Tano M Fotang &lt;mfotang@quanteq.com&gt;
0	string	\xff\xa0\xff\xa8\x00	Wavelet Scalar Quantization image data

# Type:		PCO B16 image files
# URL:		http://www.pco.de/fileadmin/user_upload/db/download/MA_CWDCOPIE_0412b.pdf
# From:		Florian Philipp &lt;florian.philipp@binarywings.net&gt;
# Extension:	.b16
# Description:	Pixel image format produced by PCO Camware, typically used
#		together with PCO cameras.
# Note:		Different versions exist for e.g. 8 bit and 16 bit images.
#		Documentation is incomplete.
0	string/b	PCO-	PCO B16 image data
&gt;12	lelong		x	\b, %dx
&gt;16	lelong		x	\b%d
&gt;20	lelong		0	\b, short header
&gt;20	lelong		-1	\b, extended header
&gt;&gt;24	lelong		0	\b, grayscale
&gt;&gt;&gt;36	lelong		0	linear LUT
&gt;&gt;&gt;36	lelong		1	logarithmic LUT
&gt;&gt;&gt;28	lelong		x	[%d
&gt;&gt;&gt;32	lelong		x	\b,%d]
&gt;&gt;24	lelong		1	\b, color
&gt;&gt;&gt;64	lelong		0	linear LUT
&gt;&gt;&gt;64	lelong		1	logarithmic LUT
&gt;&gt;&gt;40	lelong		x	r[%d
&gt;&gt;&gt;44	lelong		x	\b,%d]
&gt;&gt;&gt;48	lelong		x	g[%d
&gt;&gt;&gt;52	lelong		x	\b,%d]
&gt;&gt;&gt;56	lelong		x	b[%d
&gt;&gt;&gt;60	lelong		x	\b,%d]

# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
# From: Markus Heidelberg &lt;markus.heidelberg at web.de&gt;
0	string/t	[BitmapInfo2]	Polar Monitor Bitmap text
!:mime	image/x-polar-monitor-bitmap

# From: Rick Richardson &lt;rickrich@gmail.com&gt;
# updated by: Joerg Jenderek
# URL: http://techmods.net/nuvi/
0	string	GARMIN\ BITMAP\ 01	Garmin Bitmap file
# extension is also used for
# Sony SRF raw image (image/x-sony-srf)
# SRF map
# Terragen Surface Map (http://www.planetside.co.uk/terragen)
# FileLocator Pro search criteria file (http://www.mythicsoft.com/filelocatorpro)
!:ext srf
#!:mime	image/x-garmin-srf
# version 1.00,2.00,2.10,2.40,2.50
&gt;0x2f	string		&gt;0		\b, version %4.4s
# width (2880,2881,3240)
&gt;0x55	uleshort	&gt;0		\b, %dx
# height (80,90)
&gt;&gt;0x53	uleshort	x		\b%d

# Type:	Ulead Photo Explorer5 (.pe5)
# URL:	http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)
# From:	Simon Horman &lt;horms@debian.org&gt;
0	string	IIO2H			Ulead Photo Explorer5

# Type:	X11 cursor
# URL:	http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup
# From:	Mathias Brodala &lt;info@noctus.net&gt;
0	string	Xcur			X11 cursor

# Type:	Olympus ORF raw images.
# URL:	http://libopenraw.freedesktop.org/wiki/Olympus_ORF
# From:	Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
0	string		MMOR		Olympus ORF raw image data, big-endian
!:mime	image/x-olympus-orf
0	string		IIRO		Olympus ORF raw image data, little-endian
!:mime	image/x-olympus-orf
0	string		IIRS		Olympus ORF raw image data, little-endian
!:mime	image/x-olympus-orf

# Type: files used in modern AVCHD camcoders to store clip information
# Extension: .cpi
# From: Alexander Danilov &lt;alexander.a.danilov@gmail.com&gt;
0	string	HDMV0100	AVCHD Clip Information

# From: Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
# URL: http://local.wasp.uwa.edu.au/~pbourke/dataformats/pic/
# Radiance HDR; usually has .pic or .hdr extension.
0	string	#?RADIANCE\n	Radiance HDR image data
#!mime	image/vnd.radiance

# From: Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
# URL: http://www.mpi-inf.mpg.de/resources/pfstools/pfs_format_spec.pdf
# Used by the pfstools packages. The regex matches for the image size could
# probably use some work. The MIME type is made up; if there&#039;s one in
# actual common use, it should replace the one below.
0	string	PFS1\x0a	PFS HDR image data
#!mime	image/x-pfs
&gt;1	regex	[0-9]*\ 		\b, %s
&gt;&gt;1	regex	\ [0-9]{4}		\bx%s

# Type: Foveon X3F
# URL:  http://www.photofo.com/downloads/x3f-raw-format.pdf
# From: Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
# Note that the MIME type isn&#039;t defined anywhere that I can find; if
# there&#039;s a canonical type for this format, it should replace this one.
0	string	FOVb	Foveon X3F raw image data
!:mime	image/x-x3f
&gt;6	leshort	x	\b, version %d.
&gt;4	leshort	x	\b%d
&gt;28	lelong	x	\b, %dx
&gt;32	lelong	x	\b%d

# Paint.NET file
# From Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
0	string	PDN3	Paint.NET image data
!:mime	image/x-paintnet

# Not really an image.
# From: &quot;Tano M. Fotang&quot; &lt;mfotang@quanteq.com&gt;
0	string	\x46\x4d\x52\x00	ISO/IEC 19794-2 Format Minutiae Record (FMR)

# doc: http://www.shikino.co.jp/eng/products/images/FLOWER.jpg.zip
# example: http://www.shikino.co.jp/eng/products/images/FLOWER.wdp.zip
90	bequad		0x574D50484F544F00	JPEG-XR Image
&gt;98	byte&amp;0x08	=0x08			\b, hard tiling
&gt;99	byte&amp;0x80	=0x80			\b, tiling present
&gt;99	byte&amp;0x40	=0x40			\b, codestream present
&gt;99	byte&amp;0x38	x			\b, spatial xform=
&gt;99	byte&amp;0x38	0x00			\bTL
&gt;99	byte&amp;0x38	0x08			\bBL
&gt;99	byte&amp;0x38	0x10			\bTR
&gt;99	byte&amp;0x38	0x18			\bBR
&gt;99	byte&amp;0x38	0x20			\bBT
&gt;99	byte&amp;0x38	0x28			\bRB
&gt;99	byte&amp;0x38	0x30			\bLT
&gt;99	byte&amp;0x38	0x38			\bLB
&gt;100	byte&amp;0x80	=0x80			\b, short header
&gt;&gt;102	beshort+1	x			\b, %d
&gt;&gt;104	beshort+1	x			\bx%d
&gt;100	byte&amp;0x80	=0x00			\b, long header
&gt;&gt;102	belong+1	x			\b, %x
&gt;&gt;106	belong+1	x			\bx%x
&gt;101	beshort&amp;0xf	x			\b, bitdepth=
&gt;&gt;101	beshort&amp;0xf	0x0			\b1-WHITE=1
&gt;&gt;101	beshort&amp;0xf	0x1			\b8
&gt;&gt;101	beshort&amp;0xf	0x2			\b16
&gt;&gt;101	beshort&amp;0xf	0x3			\b16-SIGNED
&gt;&gt;101	beshort&amp;0xf	0x4			\b16-FLOAT
&gt;&gt;101	beshort&amp;0xf	0x5			\b(reserved 5)
&gt;&gt;101	beshort&amp;0xf	0x6			\b32-SIGNED
&gt;&gt;101	beshort&amp;0xf	0x7			\b32-FLOAT
&gt;&gt;101	beshort&amp;0xf	0x8			\b5
&gt;&gt;101	beshort&amp;0xf	0x9			\b10
&gt;&gt;101	beshort&amp;0xf	0xa			\b5-6-5
&gt;&gt;101	beshort&amp;0xf	0xb			\b(reserved %d)
&gt;&gt;101	beshort&amp;0xf	0xc			\b(reserved %d)
&gt;&gt;101	beshort&amp;0xf	0xd			\b(reserved %d)
&gt;&gt;101	beshort&amp;0xf	0xe			\b(reserved %d)
&gt;&gt;101	beshort&amp;0xf	0xf			\b1-BLACK=1
&gt;101	beshort&amp;0xf0	x			\b, colorfmt=
&gt;&gt;101	beshort&amp;0xf0	0x00			\bYONLY
&gt;&gt;101	beshort&amp;0xf0	0x10			\bYUV240
&gt;&gt;101	beshort&amp;0xf0	0x20			\bYWV422
&gt;&gt;101	beshort&amp;0xf0	0x30			\bYWV444
&gt;&gt;101	beshort&amp;0xf0	0x40			\bCMYK
&gt;&gt;101	beshort&amp;0xf0	0x50			\bCMYKDIRECT
&gt;&gt;101	beshort&amp;0xf0	0x60			\bNCOMPONENT
&gt;&gt;101	beshort&amp;0xf0	0x70			\bRGB
&gt;&gt;101	beshort&amp;0xf0	0x80			\bRGBE
&gt;&gt;101	beshort&amp;0xf0	&gt;0x80			\b(reserved 0x%x)

# From: Johan van der Knijff &lt;johan.vanderknijff@kb.nl&gt;
#
# BPG (Better Portable Graphics) format
# http://bellard.org/bpg/
# http://fileformats.archiveteam.org/wiki/BPG
#
0	string	\x42\x50\x47\xFB	BPG (Better Portable Graphics)
!:mime  image/bpg

# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Apple_Icon_Image_format
0	string		icns		Mac OS X icon
!:mime	image/x-icns
!:apple	????icns
!:ext icns
&gt;4	ubelong		&gt;0
# file size
&gt;&gt;4	ubelong		x		\b, %d bytes
# icon type
&gt;&gt;8	string		x		\b, &quot;%4.4s&quot; type

# TIM images
0		lelong		0x00000010	TIM image,
&gt;4		lelong  	0x8		4-Bit,
&gt;4		lelong  	0x9		8-Bit,
&gt;4		lelong  	0x2		15-Bit,
&gt;4		lelong  	0x3		24-Bit,
&gt;4		lelong 		&amp;8
&gt;&gt;(8.l+12)	leshort		x		Pixel at (%d,
&gt;&gt;(8.l+14)	leshort		x		\b%d)
&gt;&gt;(8.l+16)	leshort		x		Size=%dx
&gt;&gt;(8.l+18)	leshort		x		\b%d,
&gt;&gt;4		lelong 		0x8		16 CLUT Entries at
&gt;&gt;4		lelong 		0x9		256 CLUT Entries at
&gt;&gt;12		leshort		x		(%d,
&gt;&gt;14		leshort		x		\b%d)
&gt;4		lelong		^8
&gt;&gt;12		leshort		x		Pixel at (%d,
&gt;&gt;14		leshort		x		\b%d)
&gt;&gt;16		leshort		x		Size=%dx
&gt;&gt;18		leshort		x		\b%d

# MDEC streams
0		lelong		0x80010160	MDEC video stream,
&gt;16		leshort		x		%dx
&gt;18		leshort		x		\b%d
#&gt;8		lelong		x		%d frames
#&gt;4		leshort		x		secCount=%d;
#&gt;6		leshort		x		nSectors=%d;
#&gt;12		lelong		x		frameSize=%d;

# BS encoded bitstreams
2		leshort		0x3800		BS image,
&gt;6		leshort		x		Version %d,
&gt;4		leshort		x		Quantization %d,
&gt;0		leshort		x		(Decompresses to %d words)

# Type: farbfeld image.
# Url: http://tools.suckless.org/farbfeld/
# From: Ian D. Scott &lt;ian@iandouglasscott.com&gt;
#
0		string		farbfeld	farbfeld image data,
&gt;8		ubelong		x		%dx
&gt;12		ubelong		x		\b%d

# Type: Sega PVR image.
# From: David Korth &lt;gerbilsoft@gerbilsoft.com&gt;
# References:
# - http://fabiensanglard.net/Mykaruga/tools/segaPVRFormat.txt
# - https://github.com/yazgoo/pvrx2png
# - https://github.com/nickworonekin/puyotools

# Sega PVR header.
0	name	sega-pvr-image-header
&gt;0x0C	leshort	x	%d x
&gt;0x0E	leshort	x	%d
# Image format.
&gt;0x08	byte	0	\b, ARGB1555
&gt;0x08	byte	1	\b, RGB565
&gt;0x08	byte	2	\b, ARGB4444
&gt;0x08	byte	3	\b, YUV442
&gt;0x08	byte	4	\b, Bump
&gt;0x08	byte	5	\b, 4bpp
&gt;0x08	byte	6	\b, 8bpp
# Image data type.
&gt;0x09	byte	0x01	\b, square twiddled
&gt;0x09	byte	0x02	\b, square twiddled &amp; mipmap
&gt;0x09	byte	0x03	\b, VQ
&gt;0x09	byte	0x04	\b, VQ &amp; mipmap
&gt;0x09	byte	0x05	\b, 8-bit CLUT twiddled
&gt;0x09	byte	0x06	\b, 4-bit CLUT twiddled
&gt;0x09	byte	0x07	\b, 8-bit direct twiddled
&gt;0x09	byte	0x08	\b, 4-bit direct twiddled
&gt;0x09	byte	0x09	\b, rectangle
&gt;0x09	byte	0x0B	\b, rectangular stride
&gt;0x09	byte	0x0D	\b, rectangular twiddled
&gt;0x09	byte	0x10	\b, small VQ
&gt;0x09	byte	0x11	\b, small VQ &amp; mipmap
&gt;0x09	byte	0x12	\b, square twiddled &amp; mipmap

# Sega PVR (Xbox) image header.
# Contains an embedded DirectDraw surface instead of PVR data.
0	name	sega-pvr-xbox-dds-header
&gt;16	lelong	x	%d x
&gt;12	lelong	x	%d,
&gt;84	string	x	%.4s

# Sega PVR image.
0	string	PVRT
&gt;0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
&gt;&gt;0x20	use	sega-pvr-xbox-dds-header
&gt;0x10	belong	!0x44445320		Sega PVR image:
&gt;&gt;0	use	sega-pvr-image-header

# Sega PVR image with GBIX.
0	string	GBIX
&gt;0x10	string	PVRT
&gt;&gt;0x10	string	DDS\040\174\000\000\000 Sega PVR (Xbox) image:
&gt;&gt;&gt;0x20	use	sega-pvr-xbox-dds-header
&gt;&gt;0x10	belong	!0x44445320		Sega PVR image:
&gt;&gt;&gt;0x10	use	sega-pvr-image-header
&gt;&gt;0x08	lelong	x	\b, global index = %u

# Sega GVR header.
0	name	sega-gvr-image-header
&gt;0x0C	beshort	x	%d x
&gt;0x0E	beshort	x	%d
# Image data format.
&gt;0x0B	byte	0	\b, I4
&gt;0x0B	byte	1	\b, I8
&gt;0x0B	byte	2	\b, IA4
&gt;0x0B	byte	3	\b, IA8
&gt;0x0B	byte	4	\b, RGB565
&gt;0x0B	byte	5	\b, RGB5A3
&gt;0x0B	byte	6	\b, ARGB8888
&gt;0x0B	byte	8	\b, CI4
&gt;0x0B	byte	9	\b, CI8
&gt;0x0B	byte	14	\b, DXT1

# Sega GVR image.
0	string	GVRT	Sega GVR image:
&gt;0x10	use	sega-gvr-image-header

# Sega GVR image with GBIX.
0	string	GBIX
&gt;0x10	string	GVRT	Sega GVR image:
&gt;&gt;0x10	use	sega-gvr-image-header
&gt;&gt;0x08	belong	x	\b, global index = %u

# Light Field Picture
# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
# Typical file extensions: .lfp .lfr .lfx

0	belong	0x894C4650
&gt;4	belong	0x0D0A1A0A
&gt;12	belong	0x00000000	Lytro Light Field Picture
&gt;8	belong	x		\b, version %d

# Type: Vision Research Phantom CINE Format
# URL: https://www.phantomhighspeed.com/
# URL2: http://phantomhighspeed.force.com/vriknowledge/servlet/fileField?id=0BEU0000000Cfyk
# From: Harry Mallon &lt;hjmallon at gmail.com&gt;
#
# This has a short &quot;CI&quot; code but the 44 is the size of the struct which is
# stable
0	string	CI
&gt;2	leshort 44		Vision Research CINE Video,
&gt;&gt;4	leshort	0		Grayscale,
&gt;&gt;4	leshort 1		JPEG Compressed,
&gt;&gt;4	leshort 2		RAW,
&gt;&gt;6	leshort x		version %d,
&gt;&gt;20	lelong	x		%d frames,
&gt;&gt;48	lelong	x		%dx
&gt;&gt;52	lelong	x		\b%d

# Type: ARRI Raw Image
# Info: SMPTE RDD30:2014
# From: Harry Mallon &lt;hjmallon at gmail.com&gt;
0	string ARRI		ARRI ARI image data,
&gt;4	lelong 0x78563412	little-endian,
&gt;4 	lelong 0x12345678	big-endian,
&gt;12	lelong x		version %d,
&gt;20	lelong x 		%dx
&gt;24	lelong x		\b%d

#------------------------------------------------------------------------------
# $File: inform,v 1.5 2009/09/19 16:28:09 christos Exp $
# inform:  file(1) magic for Inform interactive fiction language

# URL:  http://www.inform-fiction.org/
# From: Reuben Thomas &lt;rrt@sc3d.org&gt;

0	search/100/cW	constant\ story		Inform source text

#------------------------------------------------------------------------------
# $File: intel,v 1.16 2017/11/14 15:48:36 christos Exp $
# intel:  file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# is in &quot;microsoft&quot;).  DOS is in &quot;msdos&quot;; the ambitious soul can do
# Windows as well.
#
# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
# as well, if, as, and when IBM makes it portable.
#
# The `versions&#039; should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0	leshort		0502		basic-16 executable
&gt;12	lelong		&gt;0		not stripped
#&gt;22	leshort		&gt;0		- version %d
0	leshort		0503		basic-16 executable (TV)
&gt;12	lelong		&gt;0		not stripped
#&gt;22	leshort		&gt;0		- version %d
0	leshort		0510		x86 executable
&gt;12	lelong		&gt;0		not stripped
0	leshort		0511		x86 executable (TV)
&gt;12	lelong		&gt;0		not stripped
0	leshort		=0512		iAPX 286 executable small model (COFF)
&gt;12	lelong		&gt;0		not stripped
#&gt;22	leshort		&gt;0		- version %d
0	leshort		=0522		iAPX 286 executable large model (COFF)
&gt;12	lelong		&gt;0		not stripped
#&gt;22	leshort		&gt;0		- version %d
# updated by Joerg Jenderek at Oct 2015
# https://de.wikipedia.org/wiki/Common_Object_File_Format
# http://www.delorie.com/djgpp/doc/coff/filhdr.html
# ./msdos (version 5.25) labeled the next entry as &quot;MS Windows COFF Intel 80386 object file&quot;
# ./intel (version 5.25) label labeled the next entry as &quot;80386 COFF executable&quot;
# SGI labeled the next entry as &quot;iAPX 386 executable&quot; --Dan Quinlan
0	leshort		=0514
# use subroutine to display name+flags+variables for common object formated files
&gt;0	use				display-coff
#&gt;12	lelong		&gt;0		not stripped
# no hint found, that at offset 22 is version
#&gt;22	leshort		&gt;0		- version %d

# rom: file(1) magic for BIOS ROM Extensions found in intel machines
#      mapped into memory between 0xC0000 and 0xFFFFF
# From: Alex Myczko &lt;alex@aiei.ch&gt;
# updated by Joerg Jenderek
# https://en.wikipedia.org/wiki/Option_ROM
0        beshort         0x55AA       BIOS (ia32) ROM Ext.
!:mime	application/octet-stream
!:ext	rom/bin
&gt;5       string          USB          USB
&gt;7       string          LDR          UNDI image
&gt;30      string          IBM          IBM comp. Video
&gt;26      string          Adaptec      Adaptec
&gt;28      string          Adaptec      Adaptec
&gt;42      string          PROMISE      Promise
&gt;2       byte            x            (%d*512)

# Flash descriptors for Intel SPI flash roms.
# From Dr. Jesus &lt;j@hug.gs&gt;
0	lelong		0x0ff0a55a	Intel serial flash for ICH/PCH ROM &lt;= 5 or 3400 series A-step
16	lelong		0x0ff0a55a	Intel serial flash for PCH ROM

#------------------------------------------------------------------------------
# $File: interleaf,v 1.10 2009/09/19 16:28:10 christos Exp $
# interleaf:  file(1) magic for InterLeaf TPS:
#
0	string		=\210OPS	Interleaf saved data
0	string		=&lt;!OPS		Interleaf document text
&gt;5	string		,\ Version\ =	\b, version
&gt;&gt;17	string		&gt;\0		%.3s

#------------------------------------------------------------------------------
# $File: island,v 1.5 2009/09/19 16:28:10 christos Exp $
# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
# &quot;/etc/magic&quot;:
# From: guy@netapp.com (Guy Harris)
#
4	string		pgscriptver	IslandWrite document
13	string		DrawFile	IslandDraw document


#------------------------------------------------------------------------------
# $File: ispell,v 1.8 2009/09/19 16:28:10 christos Exp $
# ispell:  file(1) magic for ispell
#
# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
# will match 0x9600 through 0x9603 in *both* little endian and big endian.
# (No other current magic entries collide.)
#
# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
#
0	leshort&amp;0xFFFC	0x9600		little endian ispell
&gt;0	byte		0		hash file (?),
&gt;0	byte		1		3.0 hash file,
&gt;0	byte		2		3.1 hash file,
&gt;0	byte		3		hash file (?),
&gt;2	leshort		0x00		8-bit, no capitalization, 26 flags
&gt;2	leshort		0x01		7-bit, no capitalization, 26 flags
&gt;2	leshort		0x02		8-bit, capitalization, 26 flags
&gt;2	leshort		0x03		7-bit, capitalization, 26 flags
&gt;2	leshort		0x04		8-bit, no capitalization, 52 flags
&gt;2	leshort		0x05		7-bit, no capitalization, 52 flags
&gt;2	leshort		0x06		8-bit, capitalization, 52 flags
&gt;2	leshort		0x07		7-bit, capitalization, 52 flags
&gt;2	leshort		0x08		8-bit, no capitalization, 128 flags
&gt;2	leshort		0x09		7-bit, no capitalization, 128 flags
&gt;2	leshort		0x0A		8-bit, capitalization, 128 flags
&gt;2	leshort		0x0B		7-bit, capitalization, 128 flags
&gt;2	leshort		0x0C		8-bit, no capitalization, 256 flags
&gt;2	leshort		0x0D		7-bit, no capitalization, 256 flags
&gt;2	leshort		0x0E		8-bit, capitalization, 256 flags
&gt;2	leshort		0x0F		7-bit, capitalization, 256 flags
&gt;4	leshort		&gt;0		and %d string characters
0	beshort&amp;0xFFFC	0x9600		big endian ispell
&gt;1	byte		0		hash file (?),
&gt;1	byte		1		3.0 hash file,
&gt;1	byte		2		3.1 hash file,
&gt;1	byte		3		hash file (?),
&gt;2	beshort		0x00		8-bit, no capitalization, 26 flags
&gt;2	beshort		0x01		7-bit, no capitalization, 26 flags
&gt;2	beshort		0x02		8-bit, capitalization, 26 flags
&gt;2	beshort		0x03		7-bit, capitalization, 26 flags
&gt;2	beshort		0x04		8-bit, no capitalization, 52 flags
&gt;2	beshort		0x05		7-bit, no capitalization, 52 flags
&gt;2	beshort		0x06		8-bit, capitalization, 52 flags
&gt;2	beshort		0x07		7-bit, capitalization, 52 flags
&gt;2	beshort		0x08		8-bit, no capitalization, 128 flags
&gt;2	beshort		0x09		7-bit, no capitalization, 128 flags
&gt;2	beshort		0x0A		8-bit, capitalization, 128 flags
&gt;2	beshort		0x0B		7-bit, capitalization, 128 flags
&gt;2	beshort		0x0C		8-bit, no capitalization, 256 flags
&gt;2	beshort		0x0D		7-bit, no capitalization, 256 flags
&gt;2	beshort		0x0E		8-bit, capitalization, 256 flags
&gt;2	beshort		0x0F		7-bit, capitalization, 256 flags
&gt;4	beshort		&gt;0		and %d string characters
# ispell 4.0 hash files  kromJx &lt;kromJx@crosswinds.net&gt;
# Ispell 4.0
0       string          ISPL            ispell
&gt;4      long            x               hash file version %d,
&gt;8      long            x               lexletters %d,
&gt;12     long            x               lexsize %d,
&gt;16     long            x               hashsize %d,
&gt;20     long            x               stblsize %d

#------------------------------------------------------------------------------
# $File: isz,v 1.4 2017/03/17 21:35:28 christos Exp $
# ISO Zipped file format
# http://www.ezbsystems.com/isz/iszspec.txt
0	string	IsZ!	ISO Zipped file
&gt;4	byte	x	\b, header size %u
&gt;5	byte	x	\b, version %u
&gt;8	lelong	x	\b, serial %u
#12	leshort	x	\b, sector size %u
#&gt;16	lelong	x	\b, total sectors %u
&gt;17	byte	&gt;0	\b, password protected
#&gt;24	lequad	x	\b, segment size %llu
#&gt;32	lelong	x	\b, blocks %u
#&gt;36	lelong	x	\b, block size %u

#------------------------------------------------------------
# $File: java,v 1.18 2015/11/29 22:08:14 christos Exp $
# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
# same magic number, 0xcafebabe, so they are both handled
# in the entry called &quot;cafebabe&quot;.
#------------------------------------------------------------
# Java serialization
# From Martin Pool (m.pool@pharos.com.au)
0	beshort		0xaced		Java serialization data
&gt;2	beshort		&gt;0x0004		\b, version %d

0	belong		0xfeedfeed	Java KeyStore
!:mime	application/x-java-keystore
0	belong		0xcececece	Java JCE KeyStore
!:mime	application/x-java-jce-keystore

# Java source
0	regex	\^import.*;$	Java source
!:mime	text/x-java

# Java HPROF dumps
# https://java.net/downloads/heap-snapshot/hprof-binary-format.html
0	string		JAVA\x20PROFILE\x201.0.
&gt;0x12	short		0
&gt;&gt;0x11	ushort-0x31	&lt;2      Java HPROF dump,
&gt;&gt;0x17	beqdate/1000	x       created %s

#------------------------------------------------------------------------------
# $File: javascript,v 1.1 2012/06/16 13:30:36 christos Exp $
# javascript:  magic for javascript and node.js scripts.
#
0	search/1/w	#!/bin/node		Node.js script text executable
!:mime application/javascript
0	search/1/w	#!/usr/bin/node		Node.js script text executable
!:mime application/javascript
0	search/1/w	#!/bin/nodejs		Node.js script text executable
!:mime application/javascript
0	search/1/w	#!/usr/bin/nodejs	Node.js script text executable
!:mime application/javascript
0	search/1	#!/usr/bin/env\ node	Node.js script text executable
!:mime application/javascript
0	search/1	#!/usr/bin/env\ nodejs	Node.js script text executable
!:mime application/javascript
0       string/wt       #!\ /usr/bin/gjs        Gnome Javascript text executable
!:mime  text/javascript

#------------------------------------------------------------------------------
# $File: jpeg,v 1.31 2017/03/17 21:35:28 christos Exp $
# JPEG images
# SunOS 5.5.1 had
#
#	0	string		\377\330\377\340	JPEG file
#	0	string		\377\330\377\356	JPG file
#
# both of which turn into &quot;JPEG image data&quot; here.
#
0	beshort		0xffd8		JPEG image data
!:mime	image/jpeg
!:apple	8BIMJPEG
!:strength *3
!:ext jpeg/jpg/jpe/jfif
&gt;6	string		JFIF		\b, JFIF standard
# The following added by Erik Rossen &lt;rossen@freesurf.ch&gt; 1999-09-06
# in a vain attempt to add image size reporting for JFIF.  Note that these
# tests are not fool-proof since some perfectly valid JPEGs are currently
# impossible to specify in magic(4) format.
# First, a little JFIF version info:
&gt;&gt;11	byte		x		\b %d.
&gt;&gt;12	byte		x		\b%02d
# Next, the resolution or aspect ratio of the image:
&gt;&gt;13	byte		0		\b, aspect ratio
&gt;&gt;13	byte		1		\b, resolution (DPI)
&gt;&gt;13	byte		2		\b, resolution (DPCM)
&gt;&gt;14	beshort		x		\b, density %dx
&gt;&gt;16	beshort		x		\b%d
&gt;&gt;4	beshort		x		\b, segment length %d
# Next, show thumbnail info, if it exists:
&gt;&gt;18	byte		!0		\b, thumbnail %dx
&gt;&gt;&gt;19	byte		x		\b%d
&gt;6	string		Exif		\b, Exif standard: [
&gt;&gt;12	indirect/r	x
&gt;&gt;12	string		x		\b]

# Jump to the first segment
&gt;(4.S+4)	use		jpeg_segment

# This uses recursion...
0		name		jpeg_segment
&gt;0	beshort		0xFFFE
# Recursion handled by FFE0
#&gt;&gt;(2.S+2)	use			jpeg_segment
&gt;&gt;2	pstring/HJ	x		\b, comment: &quot;%s&quot;

&gt;0	beshort		0xFFC0
&gt;&gt;(2.S+2)	use			jpeg_segment
&gt;&gt;4	byte		x		\b, baseline, precision %d
&gt;&gt;7	beshort		x		\b, %dx
&gt;&gt;5	beshort		x		\b%d
&gt;&gt;9	byte		x		\b, frames %d

&gt;0	beshort		0xFFC1
&gt;&gt;(2.S+2)	use			jpeg_segment
&gt;&gt;4	byte		x		\b, extended sequential, precision %d
&gt;&gt;7	beshort		x		\b, %dx
&gt;&gt;5	beshort		x		\b%d
&gt;&gt;9	byte		x		\b, frames %d

&gt;0	beshort		0xFFC2
&gt;&gt;(2.S+2)	use			jpeg_segment
&gt;&gt;4	byte		x		\b, progressive, precision %d
&gt;&gt;7	beshort		x		\b, %dx
&gt;&gt;5	beshort		x		\b%d
&gt;&gt;9	byte		x		\b, frames %d

# Define Huffman Tables
&gt;0	beshort		0xFFC4
&gt;&gt;(2.S+2)	use			jpeg_segment

&gt;0	beshort		0xFFE1
# Recursion handled by FFE0
#&gt;&gt;(2.S+2)	use			jpeg_segment
&gt;&gt;4	string		Exif		\b, Exif Standard: [
&gt;&gt;&gt;10	indirect/r	x
&gt;&gt;&gt;10	string		x		\b]

# Application specific markers
&gt;0	beshort&amp;0xFFE0	=0xFFE0
&gt;&gt;(2.S+2)	use			jpeg_segment

# DB: Define Quantization tables
# DD: Define Restart interval [XXX: wrong here, it is 4 bytes]
# D8: Start of image
# D9: End of image
# Dn: Restart
&gt;0	beshort&amp;0xFFD0	=0xFFD0
&gt;&gt;0	beshort&amp;0xFFE0	!0xFFE0
&gt;&gt;&gt;(2.S+2)	use			jpeg_segment

#&gt;0	beshort		x		unknown 0x%x
#&gt;&gt;(2.S+2)	use			jpeg_segment

# HSI is Handmade Software&#039;s proprietary JPEG encoding scheme
0	string		hsi1		JPEG image data, HSI proprietary

# From: David Santinoli &lt;david@santinoli.com&gt;
0	string		\x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A	JPEG 2000
# From: Johan van der Knijff &lt;johan.vanderknijff@kb.nl&gt;
# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes
# https://github.com/bitsgalore/jp2kMagic
#
# Now read value of &#039;Brand&#039; field, which yields a few possibilities:
&gt;20	string		\x6a\x70\x32\x20	Part 1 (JP2)
!:mime	image/jp2
&gt;20	string		\x6a\x70\x78\x20	Part 2 (JPX)
!:mime	image/jpx
&gt;20	string		\x6a\x70\x6d\x20	Part 6 (JPM)
!:mime	image/jpm
&gt;20	string		\x6d\x6a\x70\x32	Part 3 (MJ2)
!:mime	video/mj2

# Type: JPEG 2000 codesream
# From: Mathieu Malaterre &lt;mathieu.malaterre@gmail.com&gt;
0	belong		0xff4fff51						JPEG 2000 codestream
45	beshort		0xff52

# JPEG extended range
0	string		\x49\x49\xbc
&gt;3	byte		1
&gt;&gt;4	lelong%2	0	JPEG-XR
!:mime	image/jxr
!:ext	jxr

#------------------------------------------------------------------------------
# $File: karma,v 1.8 2015/08/29 07:10:35 christos Exp $
# karma:  file(1) magic for Karma data files
#
# From &lt;rgooch@atnf.csiro.au&gt;

0	string	KarmaRHD\040Version	Karma Data Structure Version
&gt;16	belong		x		%u

#------------------------------------------------------------------------------
# $File: kde,v 1.5 2010/11/25 15:00:12 christos Exp $
# kde:  file(1) magic for KDE

0		string/t	[KDE\ Desktop\ Entry]	KDE desktop entry
!:mime	application/x-kdelnk
0		string/t	#\ KDE\ Config\ File	KDE config file
!:mime	application/x-kdelnk
0		string/t	#\ xmcd	xmcd database file for kscd
!:mime	text/x-xmcd

#------------------------------------------------------------------------------
# $File: keepass,v 1.1 2012/12/24 22:14:56 christos Exp $
# keepass: file(1) magic for KeePass file
#
# Keepass Password Safe:
#  * original one: http://keepass.info/
#  * *nix port:    http://www.keepassx.org/
#  * android port: http://code.google.com/p/keepassdroid/

0	lelong		0x9AA2D903	Keepass password database
&gt;4	lelong		0xB54BFB65	1.x KDB
&gt;&gt;48	lelong		&gt;0		\b, %d groups
&gt;&gt;52	lelong		&gt;0		\b, %d entries
&gt;&gt;8	lelong&amp;0x0f	1		\b, SHA-256
&gt;&gt;8	lelong&amp;0x0f	2		\b, AES
&gt;&gt;8	lelong&amp;0x0f	4		\b, RC4
&gt;&gt;8	lelong&amp;0x0f	8		\b, Twofish
&gt;&gt;120	lelong		&gt;0		\b, %d key transformation rounds
&gt;4	lelong		0xB54BFB67	2.x KDBX

#------------------------------------------------------------------------------
# $File: kerberos,v 1.2 2017/03/17 21:35:28 christos Exp $
# kerberos: MIT kerberos file binary formats
#

# This magic entry is for demonstration purposes and could be improved
# if the following features were implemented in file:
#
# Strings inside [[ .. ]] in the descriptions have special meanings and
# are not printed.
#
# 	- Provide some form of iteration in number of components
#		[[${counter}=%d]] in the description
#		then append
#		[${counter}--] in the offset of the entries
#	- Provide a way to round the next offset
#		Add [R:4] after the offset?
#	- Provide a way to have optional entries
#		XXX: Syntax:
#	- Provide a way to &quot;save&quot; entries to print them later.
#		if the description is [[${name}=%s]], then nothing is
#		printed and a subsequent entry in the same magic file
#		can refer to ${name}
#	- Provide a way to format strings as hex values
#
# http://www.gnu.org/software/shishi/manual/html_node/\
#	The-Keytab-Binary-File-Format.html
#

0		name		keytab_entry
#&gt;0		beshort		x		\b, size=%d
#&gt;2		beshort		x		\b, components=%d
&gt;4		pstring/H	x		\b, realm=%s
&gt;&gt;&amp;0		pstring/H	x		\b, principal=%s/
&gt;&gt;&gt;&amp;0		pstring/H	x		\b%s
&gt;&gt;&gt;&gt;&amp;0		belong		x		\b, type=%d
&gt;&gt;&gt;&gt;&gt;&amp;0		bedate		x		\b, date=%s
&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	byte		x		\b, kvno=%u
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	pstring/H	x
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	belong		x
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	use		keytab_entry

0		belong		0x05020000	Kerberos Keytab file
&gt;4		use		keytab_entry

#------------------------------------------------------------------------------
# $File: kml,v 1.4 2017/03/17 21:35:28 christos Exp $
# Type: Google KML, formerly Keyhole Markup Language
# Future development of this format has been handed
# over to the Open Geospatial Consortium.
# http://www.opengeospatial.org/standards/kml/
# From: Asbjoern Sloth Toennesen &lt;asbjorn@lila.io&gt;
0 string/t    \&lt;?xml
&gt;20  search/400 \ xmlns=
&gt;&gt;&amp;0 regex [&#039;&quot;]http://earth.google.com/kml Google KML document
!:mime application/vnd.google-earth.kml+xml
&gt;&gt;&gt;&amp;1 string 2.0&#039; \b, version 2.0
&gt;&gt;&gt;&amp;1 string 2.1&#039; \b, version 2.1
&gt;&gt;&gt;&amp;1 string 2.2&#039; \b, version 2.2

#------------------------------------------------------------------------------
# Type: OpenGIS KML, formerly Keyhole Markup Language
# This standard is maintained by the
# Open Geospatial Consortium.
# http://www.opengeospatial.org/standards/kml/
# From: Asbjoern Sloth Toennesen &lt;asbjorn@lila.io&gt;
&gt;&gt;&amp;0 regex [&#039;&quot;]http://www.opengis.net/kml OpenGIS KML document
!:mime application/vnd.google-earth.kml+xml
&gt;&gt;&gt;&amp;1 string/t 2.2 \b, version 2.2

#------------------------------------------------------------------------------
# Type: Google KML Archive (ZIP based)
# http://code.google.com/apis/kml/documentation/kml_tut.html
# From: Asbjoern Sloth Toennesen &lt;asbjorn@lila.io&gt;
0 string    PK\003\004
&gt;4  byte    0x14
&gt;&gt;30  string doc.kml Compressed Google KML Document, including resources.
!:mime application/vnd.google-earth.kmz

#------------------------------------------------------------------------------
# $File: lecter,v 1.4 2009/09/19 16:28:10 christos Exp $
# DEC SRC Virtual Paper: Lectern files
# Karl M. Hegbloom &lt;karlheg@inetarena.com&gt;
0	string	lect	DEC SRC Virtual Paper Lectern file

#------------------------------------------------------------------------------
# $File: lex,v 1.6 2009/09/19 16:28:10 christos Exp $
# lex:  file(1) magic for lex
#
#	derived empirically, your offsets may vary!
0	search/100	yyprevious	C program text (from lex)
&gt;3	search/1	&gt;\0		 for %s
# C program text from GNU flex, from Daniel Quinlan &lt;quinlan@yggdrasil.com&gt;
0	search/100	generated\ by\ flex	C program text (from flex)
# lex description file, from Daniel Quinlan &lt;quinlan@yggdrasil.com&gt;
0	search/1	%{		lex description text

#------------------------------------------------------------------------------
# $File: lif,v 1.8 2009/09/19 16:28:10 christos Exp $
# lif:  file(1) magic for lif
#
# (Daniel Quinlan &lt;quinlan@yggdrasil.com&gt;)
#
0	beshort		0x8000		lif file

#------------------------------------------------------------------------------
# $File: linux,v 1.64 2017/03/17 21:35:28 christos Exp $
# linux:  file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan &lt;quinlan@yggdrasil.com&gt;
# The following basic Linux magic is useful for reference, but using
# &quot;long&quot; magic is a better practice in order to avoid collisions.
#
# 2	leshort		100		Linux/i386
# &gt;0	leshort		0407		impure executable (OMAGIC)
# &gt;0	leshort		0410		pure executable (NMAGIC)
# &gt;0	leshort		0413		demand-paged executable (ZMAGIC)
# &gt;0	leshort		0314		demand-paged executable (QMAGIC)
#
0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
&gt;16	lelong		0		\b, stripped
0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
&gt;16	lelong		0		\b, stripped
0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
&gt;16	lelong		0		\b, stripped
0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
&gt;16	lelong		0		\b, stripped
#
0	string		\007\001\000	Linux/i386 object file
&gt;20	lelong		&gt;0x1020		\b, DLL library
# Linux-8086 stuff:
0	string		\01\03\020\04	Linux-8086 impure executable
&gt;28	long		!0		not stripped
0	string		\01\03\040\04	Linux-8086 executable
&gt;28	long		!0		not stripped
#
0	string		\243\206\001\0	Linux-8086 object file
#
0	string		\01\03\020\20	Minix-386 impure executable
&gt;28	long		!0		not stripped
0	string		\01\03\040\20	Minix-386 executable
&gt;28	long		!0		not stripped
0	string		\01\03\04\20	Minix-386 NSYM/GNU executable
&gt;28	long		!0		not stripped
# core dump file, from Bill Reynolds &lt;bill@goshawk.lanl.gov&gt;
216	lelong		0421		Linux/i386 core file
!:strength / 2
&gt;220	string		&gt;\0		of &#039;%s&#039;
&gt;200	lelong		&gt;0		(signal %d)
#
# LILO boot/chain loaders, from Daniel Quinlan &lt;quinlan@yggdrasil.com&gt;
# this can be overridden by the DOS executable (COM) entry
2	string		LILO		Linux/i386 LILO boot/chain loader
#
# Linux make config build file, from Ole Aamot &lt;oka@oka.no&gt;
# Updated by Ken Sharp
28	string		make\ config		Linux make config build file (old)
49	search/70	Kernel\ Configuration	Linux make config build file

#
# PSF fonts, from H. Peter Anvin &lt;hpa@yggdrasil.com&gt;
# Updated by Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
0	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
&gt;2	byte&amp;0x01	0		256 characters,
&gt;2	byte&amp;0x01	!0		512 characters,
&gt;2	byte&amp;0x02	0		no directory,
&gt;2	byte&amp;0x02	!0		Unicode directory,
&gt;3	byte		&gt;0		8x%d
0	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
&gt;16	lelong		x		%d characters,
&gt;12	lelong&amp;0x01	0		no directory,
&gt;12	lelong&amp;0x01	!0		Unicode directory,
&gt;24	lelong		x		%d
&gt;28	lelong		x		\bx%d

# Linux swap file, from Daniel Quinlan &lt;quinlan@yggdrasil.com&gt;
4086	string		SWAP-SPACE	Linux/i386 swap file
# From: Jeff Bailey &lt;jbailey@ubuntu.com&gt;
# Linux swap file with swsusp1 image, from Jeff Bailey &lt;jbailey@ubuntu.com&gt;
4076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
# From: James Hunt &lt;james.hunt@ubuntu.com&gt;
4076    string          SWAPSPACE2LINHIB0001    Linux/i386 swap file (new style) (compressed hibernate)
# according to man page of mkswap (8) March 1999
# volume label and UUID Russell Coker
# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
4086	string		SWAPSPACE2	Linux/i386 swap file (new style),
&gt;0x400	long		x		version %d (4K pages),
&gt;0x404	long		x		size %d pages,
&gt;1052	string		\0		no label,
&gt;1052	string		&gt;\0		LABEL=%s,
&gt;0x40c	belong		x		UUID=%08x
&gt;0x410	beshort		x		\b-%04x
&gt;0x412	beshort		x		\b-%04x
&gt;0x414	beshort		x		\b-%04x
&gt;0x416	belong		x		\b-%08x
&gt;0x41a	beshort		x		\b%04x
# From Daniel Novotny &lt;dnovotny@redhat.com&gt;
# swap file for PowerPC
65526	string		SWAPSPACE2	Linux/ppc swap file
&gt;0x400	long		x		version %d,
&gt;0x404	long		x		size %d pages,
&gt;1052	string		\0		no label,
&gt;1052	string		&gt;\0		LABEL=%s,
&gt;0x40c	belong		x		UUID=%08x
&gt;0x410	beshort		x		\b-%04x
&gt;0x412	beshort		x		\b-%04x
&gt;0x414	beshort		x		\b-%04x
&gt;0x416	belong		x		\b-%08x
&gt;0x41a	beshort		x		\b%04x
16374	string		SWAPSPACE2	Linux/ia64 swap file
#
# Linux kernel boot images, from Albert Cahalan &lt;acahalan@cs.uml.edu&gt;
# and others such as Axel Kohlmeyer &lt;akohlmey@rincewind.chemie.uni-ulm.de&gt;
# and Nicolas Lichtmaier &lt;nick@debian.org&gt;
# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
# Linux kernel boot images (i386 arch) (Wolfram Kleff)
514	string		HdrS		Linux kernel
!:strength + 55
&gt;510	leshort		0xAA55		x86 boot executable
&gt;&gt;518	leshort		&gt;0x1ff
&gt;&gt;&gt;529	byte		0		zImage,
&gt;&gt;&gt;529	byte		1		bzImage,
&gt;&gt;&gt;526	lelong		&gt;0
&gt;&gt;&gt;&gt;(526.s+0x200) string	&gt;\0	version %s,
&gt;&gt;498	leshort		1		RO-rootFS,
&gt;&gt;498	leshort		0		RW-rootFS,
&gt;&gt;508	leshort		&gt;0		root_dev 0x%X,
&gt;&gt;502	leshort		&gt;0		swap_dev 0x%X,
&gt;&gt;504	leshort		&gt;0		RAMdisksize %u KB,
&gt;&gt;506	leshort		0xFFFF		Normal VGA
&gt;&gt;506	leshort		0xFFFE		Extended VGA
&gt;&gt;506	leshort		0xFFFD		Prompt for Videomode
&gt;&gt;506	leshort		&gt;0		Video mode %d
# This also matches new kernels, which were caught above by &quot;HdrS&quot;.
0		belong	0xb8c0078e	Linux kernel
&gt;0x1e3		string	Loading		version 1.3.79 or older
&gt;0x1e9		string	Loading		from prehistoric times

# System.map files - Nicolas Lichtmaier &lt;nick@debian.org&gt;
8	search/1	\ A\ _text	Linux kernel symbol map text

# LSM entries - Nicolas Lichtmaier &lt;nick@debian.org&gt;
0	search/1	Begin3	Linux Software Map entry text
0	search/1	Begin4	Linux Software Map entry text (new format)

# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
0	belong	0x4f4f4f4d	User-mode Linux COW file
&gt;4	belong	&lt;3		\b, version %d
&gt;&gt;8	string	&gt;\0		\b, backing file %s
&gt;4	belong	&gt;2		\b, version %d
&gt;&gt;32	string	&gt;\0		\b, backing file %s

############################################################################
# Linux kernel versions

0		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
&gt;497		leshort		0		x86 boot sector
&gt;&gt;514		belong		0x8e	of a kernel from the dawn of time!
&gt;&gt;514		belong		0x908ed8b4	version 0.99-1.1.42
&gt;&gt;514		belong		0x908ed8b8	for memtest86

&gt;497		leshort		!0		x86 kernel
&gt;&gt;504		leshort		&gt;0		RAMdisksize=%u KB
&gt;&gt;502		leshort		&gt;0		swap=0x%X
&gt;&gt;508		leshort		&gt;0		root=0x%X
&gt;&gt;&gt;498		leshort		1		\b-ro
&gt;&gt;&gt;498		leshort		0		\b-rw
&gt;&gt;506		leshort		0xFFFF		vga=normal
&gt;&gt;506		leshort		0xFFFE		vga=extended
&gt;&gt;506		leshort		0xFFFD		vga=ask
&gt;&gt;506		leshort		&gt;0		vga=%d
&gt;&gt;514		belong		0x908ed881	version 1.1.43-1.1.45
&gt;&gt;514		belong		0x15b281cd
&gt;&gt;&gt;0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
&gt;&gt;&gt;0xa99	belong		0x55AA5a5a	version 1.3.1,2
&gt;&gt;&gt;0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
&gt;&gt;&gt;0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
&gt;&gt;&gt;0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
&gt;&gt;&gt;0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
&gt;&gt;514		string		HdrS
&gt;&gt;&gt;518		leshort		&gt;0x1FF
&gt;&gt;&gt;&gt;529		byte		0		\b, zImage
&gt;&gt;&gt;&gt;529		byte		1		\b, bzImage
&gt;&gt;&gt;&gt;(526.s+0x200) string 	&gt;\0		\b, version %s

# Linux boot sector thefts.
0		belong		0xb8c0078e	Linux
&gt;0x1e6		belong		0x454c4b53	ELKS Kernel
&gt;0x1e6		belong		!0x454c4b53	style boot sector

############################################################################
# Linux S390 kernel image
# Created by: Jan Kaluza &lt;jkaluza@redhat.com&gt;
8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
&gt;0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
# 64bit
&gt;&gt;&amp;0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
&gt;&gt;&amp;0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
&gt;&gt;&amp;0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
&gt;&gt;&amp;0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
# 32bit
&gt;&gt;&amp;0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
&gt;&gt;&amp;0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
&gt;&gt;&amp;0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
&gt;&gt;&amp;0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel

# Linux ARM compressed kernel image
# From: Kevin Cernekee &lt;cernekee@gmail.com&gt;
36	lelong	0x016f2818	Linux kernel ARM boot executable zImage (little-endian)
36	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)

############################################################################
# Linux 8086 executable
0	lelong&amp;0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
&gt;5	string		.
&gt;&gt;4	string		&gt;\0		\b, libc version %s

0	lelong&amp;0xFF00FFFF 0x4000301	Linux-8086 executable
&gt;2	byte&amp;0x01	!0		\b, unmapped zero page
&gt;2	byte&amp;0x20	0		\b, impure
&gt;2	byte&amp;0x20	!0
&gt;&gt;2	byte&amp;0x10	!0		\b, A_EXEC
&gt;2	byte&amp;0x02	!0		\b, A_PAL
&gt;2	byte&amp;0x04	!0		\b, A_NSYM
&gt;2	byte&amp;0x08	!0		\b, A_STAND
&gt;2	byte&amp;0x40	!0		\b, A_PURE
&gt;2	byte&amp;0x80	!0		\b, A_TOVLY
&gt;28     long            !0              \b, not stripped
&gt;37	string		.
&gt;&gt;36	string		&gt;\0		\b, libc version %s

# 0	lelong&amp;0xFF00FFFF 0x10000301	ld86 I80386 executable
# 0	lelong&amp;0xFF00FFFF 0xB000301	ld86 M68K executable
# 0	lelong&amp;0xFF00FFFF 0xC000301	ld86 NS16K executable
# 0	lelong&amp;0xFF00FFFF 0x17000301	ld86 SPARC executable

# SYSLINUX boot logo files (from &#039;ppmtolss16&#039; sources)
# http://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
# file extension .lss .16
0	lelong	=0x1413f33d		SYSLINUX&#039; LSS16 image data
# syslinux-4.05/mime/image/x-lss16.xml
!:mime image/x-lss16
&gt;4	leshort	x			\b, width %d
&gt;6	leshort	x			\b, height %d

0	string	OOOM			User-Mode-Linux&#039;s Copy-On-Write disk image
&gt;4	belong	x			version %d

# SE Linux policy database
# From: Mike Frysinger &lt;vapier@gentoo.org&gt;
0	lelong	0xf97cff8c		SE Linux policy
&gt;16	lelong	x			v%d
&gt;20	lelong	1			MLS
&gt;24	lelong	x			%d symbols
&gt;28	lelong	x			%d ocons

# Linux Logical Volume Manager (LVM)
# Emmanuel VARAGNAT &lt;emmanuel.varagnat@guzu.net&gt;
#
# System ID, UUID and volume group name are 128 bytes long
# but they should never be full and initialized with zeros...
#
# LVM1
#
0x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
&gt;0x12c	string	&gt;\0		, System ID: %s

0x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
&gt;0x12c	string	&gt;\0		, System ID: %s

#  LVM2
#
# It seems that the label header can be in one the four first sector
# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
#
# 0x200 seems to be the common case

0x218           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
# read the offset to add to the start of the header, and the header
# start in 0x200
&gt;&amp;(&amp;-12.l-0x21) byte    x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
&gt;&gt;&amp;0x0          string  &gt;\x2f          \b, UUID: %.6s
&gt;&gt;&amp;0x6          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0xa          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0xe          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x12         string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x16         string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x1a         string  &gt;\x2f          \b-%.6s
&gt;&gt;&amp;0x20         lequad  x              \b, size: %lld

0x018           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
&gt;&amp;(&amp;-12.l-0x21) byte    x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
&gt;&gt;&amp;0x0          string  &gt;\x2f          \b, UUID: %.6s
&gt;&gt;&amp;0x6          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0xa          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0xe          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x12         string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x16         string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x1a         string  &gt;\x2f          \b-%.6s
&gt;&gt;&amp;0x20         lequad  x              \b, size: %lld

0x418           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
&gt;&amp;(&amp;-12.l-0x21) byte    x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
&gt;&gt;&amp;0x0          string  &gt;\x2f          \b, UUID: %.6s
&gt;&gt;&amp;0x6          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0xa          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0xe          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x12         string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x16         string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x1a         string  &gt;\x2f          \b-%.6s
&gt;&gt;&amp;0x20         lequad  x              \b, size: %lld

0x618           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
&gt;&amp;(&amp;-12.l-0x21) byte    x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
&gt;&gt;&amp;0x0          string  &gt;\x2f          \b, UUID: %.6s
&gt;&gt;&amp;0x6          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0xa          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0xe          string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x12         string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x16         string  &gt;\x2f          \b-%.4s
&gt;&gt;&amp;0x1a         string  &gt;\x2f          \b-%.6s
&gt;&gt;&amp;0x20         lequad  x              \b, size: %lld

# LVM snapshot
# from Jason Farrel
0	string	SnAp	LVM Snapshot (CopyOnWrite store)
&gt;4	lelong	!0	- valid,
&gt;4	lelong	0	- invalid,
&gt;8	lelong	x	version %d,
&gt;12	lelong	x	chunk_size %d

# SE Linux policy database
0	lelong	0xf97cff8c		SE Linux policy
&gt;16	lelong	x			v%d
&gt;20	lelong	1			MLS
&gt;24	lelong	x			%d symbols
&gt;28	lelong	x			%d ocons

# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
# Anthon van der Neut (anthon@mnt.org)
0	string	LUKS\xba\xbe	LUKS encrypted file,
&gt;6	beshort x		ver %d
&gt;8	string	x		[%s,
&gt;40	string	x		%s,
&gt;72	string	x		%s]
&gt;168	string	x		UUID: %s


# Summary: Xen saved domain file
# Created by: Radek Vokal &lt;rvokal@redhat.com&gt;
0	string		LinuxGuestRecord	Xen saved domain
&gt;20	search/256	(name
&gt;&gt;&amp;1	string		x			(name %s)

# Type: Xen, the virtual machine monitor
# From: Radek Vokal &lt;rvokal@redhat.com&gt;
0	string		LinuxGuestRecord	Xen saved domain
#&gt;2	regex		\(name\ [^)]*\)		%s
&gt;20	search/256	(name			(name
&gt;&gt;&amp;1	string		x			%s...)

# Systemd journald files
# See http://www.freedesktop.org/wiki/Software/systemd/journal-files/.
# From: Zbigniew Jedrzejewski-Szmek &lt;zbyszek@in.waw.pl&gt;

# check magic
0	string	LPKSHHRH
# check that state is one of known values
&gt;16		ubyte&amp;252	0
# check that each half of three unique id128s is non-zero
&gt;&gt;24		ubequad		&gt;0
&gt;&gt;&gt;32		ubequad		&gt;0
&gt;&gt;&gt;&gt;40		ubequad		&gt;0
&gt;&gt;&gt;&gt;&gt;48		ubequad		&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;56	ubequad		&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;64	ubequad		&gt;0	Journal file
!:mime application/octet-stream
# provide more info
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;184	leqdate		0	empty
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;16	ubyte		0	\b, offline
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;16	ubyte		1	\b, online
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;16	ubyte		2	\b, archived
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;8	ulelong&amp;1	1	\b, sealed
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;12	ulelong&amp;1	1	\b, compressed

# BCache backing and cache devices
# From: Gabriel de Perthuis &lt;g2p.code@gmail.com&gt;
0x1008		lequad		8
&gt;0x1018		string		\xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81	BCache
&gt;&gt;0x1010	ulequad		0	cache device
&gt;&gt;0x1010	ulequad		1	backing device
&gt;&gt;0x1010	ulequad		3	cache device
&gt;&gt;0x1010	ulequad		4	backing device
&gt;&gt;0x1048	string		&gt;0	\b, label &quot;%.32s&quot;
&gt;&gt;0x1028	ubelong		x	\b, uuid %08x
&gt;&gt;0x102c	ubeshort	x	\b-%04x
&gt;&gt;0x102e	ubeshort	x	\b-%04x
&gt;&gt;0x1030	ubeshort	x	\b-%04x
&gt;&gt;0x1032	ubelong		x	\b-%08x
&gt;&gt;0x1036	ubeshort	x	\b%04x
&gt;&gt;0x1038	ubelong		x	\b, set uuid %08x
&gt;&gt;0x103c	ubeshort	x	\b-%04x
&gt;&gt;0x103e	ubeshort	x	\b-%04x
&gt;&gt;0x1040	ubeshort	x	\b-%04x
&gt;&gt;0x1042	ubelong		x	\b-%08x
&gt;&gt;0x1046	ubeshort	x	\b%04x

# Linux device tree:
# File format description can be found in the Linux kernel sources at
# Documentation/devicetree/booting-without-of.txt
# From Christoph Biedl
0		belong		0xd00dfeed
# structure and strings must be within blob
&gt;&amp;(8.L)		byte		x
&gt;&gt;&amp;(12.L)	byte		x
&gt;&gt;&gt;20		belong		&gt;1	Device Tree Blob version %d
&gt;&gt;&gt;&gt;4		belong		x	\b, size=%d
&gt;&gt;&gt;&gt;20		belong		&gt;1
&gt;&gt;&gt;&gt;&gt;28		belong		x	\b, boot CPU=%d
&gt;&gt;&gt;&gt;20		belong		&gt;2
&gt;&gt;&gt;&gt;&gt;32		belong		x	\b, string block size=%d
&gt;&gt;&gt;&gt;20		belong		&gt;16
&gt;&gt;&gt;&gt;&gt;36		belong		x	\b, DT structure block size=%d

# glibc locale archive as defined in glibc locale/locarchive.h
0		lelong		0xde020109	locale archive
&gt;24		lelong		x		%d strings

# Linux Software RAID (mdadm)
# Russell Coker &lt;russell@coker.com.au&gt;
0	name	linuxraid
&gt;16	belong	x		UUID=%8x:
&gt;20	belong	x		\b%8x:
&gt;24	belong	x		\b%8x:
&gt;28	belong	x		\b%8x
&gt;32	string	x		name=%s
&gt;72	lelong	x		level=%d
&gt;92	lelong	x		disks=%d

4096	lelong	0xa92b4efc	Linux Software RAID
&gt;4100	lelong	x		version 1.2 (%d)
&gt;4096	use	linuxraid

0	lelong	0xa92b4efc	Linux Software RAID
&gt;4	lelong	x		version 1.1 (%d)
&gt;0	use	linuxraid

# Summary:     Database file for mlocate
# Description: A database file as used by mlocate, a fast implementation
#              of locate/updatedb. It uses merging to reuse the existing
#              database and avoid rereading most of the filesystem. It&#039;s
#              the default version of locate on Arch Linux (and others).
# File path:   /var/lib/mlocate/mlocate.db by default (but configurable)
# Site:        https://fedorahosted.org/mlocate/
# Format docs: http://linux.die.net/man/5/mlocate.db
# Type: mlocate database file
# URL:  https://fedorahosted.org/mlocate/
# From: Wander Nauta &lt;info@wandernauta.nl&gt;
0		string		\0mlocate	mlocate database
&gt;12		byte		x		\b, version %d
&gt;13		byte		1		\b, require visibility
&gt;16		string		x		\b, root %s

# Dump files for iproute2 tool. Generated by the &quot;ip r|a save&quot; command. URL:
# https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
# From: Pavel Emelyanov &lt;xemul@parallels.com&gt;
0		lelong		0x45311224	iproute2 routes dump
0		lelong		0x47361222	iproute2 addresses dump

# Image and service files for CRIU tool.
# URL: http://criu.org
# From: Pavel Emelyanov &lt;xemul@parallels.com&gt;
0		lelong		0x54564319	CRIU image file v1.1
0		lelong		0x55105940	CRIU service file
0		lelong		0x58313116	CRIU inventory

# Kdump compressed dump files
# http://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION

0		string		KDUMP          	Kdump compressed dump
&gt;8		long		x		v%d
&gt;12		string		&gt;\0		\b, system %s
&gt;77		string		&gt;\0		\b, node %s
&gt;142		string		&gt;\0		\b, release %s
&gt;207		string		&gt;\0		\b, version %s
&gt;272		string		&gt;\0		\b, machine %s
&gt;337		string		&gt;\0		\b, domain %s

#------------------------------------------------------------------------------
# $File: lisp,v 1.25 2017/03/17 21:35:28 christos Exp $
# lisp:  file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)

# updated by Joerg Jenderek
# GRR: This lot is too weak
#0	string	;;
# windows INF files often begin with semicolon and use CRLF as line end
# lisp files are mainly created on unix system with LF as line end
#&gt;2	search/4096	!\r		Lisp/Scheme program text
#&gt;2	search/4096	\r		Windows INF file

0	search/4096	(setq\ 			Lisp/Scheme program text
!:mime	text/x-lisp
0	search/4096	(defvar\ 		Lisp/Scheme program text
!:mime	text/x-lisp
0	search/4096	(defparam\ 		Lisp/Scheme program text
!:mime	text/x-lisp
0	search/4096	(defun\  		Lisp/Scheme program text
!:mime	text/x-lisp
0	search/4096	(autoload\ 		Lisp/Scheme program text
!:mime	text/x-lisp
0	search/4096	(custom-set-variables\ 	Lisp/Scheme program text
!:mime	text/x-lisp

# URL: https://en.wikipedia.org/wiki/Emacs_Lisp
# Reference: http://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
# Update: Joerg Jenderek
# Emacs 18 - this is always correct, but not very magical.
0	string	\012(
# look for emacs lisp keywords
# GRR: split regex because it is too long or get error like
# lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|&#039;
&gt;&amp;0	regex	\^(defun|defvar|defconst|defmacro|setq|fset)	Emacs v18 byte-compiled Lisp data
!:mime	application/x-elc
# https://searchcode.com/codesearch/view/2173420/
# not really pure text
!:apple	EMAxTEXT
!:ext elc
# remaining regex
&gt;&amp;0	regex	\^(put|provide|require|random)	Emacs v18 byte-compiled Lisp data
!:mime	application/x-elc
!:apple	EMAxTEXT
!:ext elc
# missed cl.elc dbx.elc simple.elc look like normal lisp starting with ;;;

# Emacs 19+ - ver. recognition added by Ian Springer
# Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
# - Chris Chittleborough &lt;cchittleborough@yahoo.com.au&gt;
# Update: Joerg Jenderek
0	string	;ELC
# version\0\0\0
&gt;4	byte	&gt;18			Emacs/XEmacs v%d byte-compiled Lisp data
# why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015
#&gt;4	byte    &lt;32			Emacs/XEmacs v%d byte-compiled Lisp data
!:mime	application/x-elc
!:apple	EMAxTEXT
!:ext elc

# Files produced by CLISP Common Lisp From: Bruno Haible &lt;haible@ilog.fr&gt;
0	string	(SYSTEM::VERSION\040&#039;	CLISP byte-compiled Lisp program (pre 2004-03-27)
0	string	(|SYSTEM|::|VERSION|\040&#039;	CLISP byte-compiled Lisp program text

0	long	0x70768BD2		CLISP memory image data
0	long	0xD28B7670		CLISP memory image data, other endian

#.com and .bin for MIT scheme
0	string	\372\372\372\372	MIT scheme (library?)

# From: David Allouche &lt;david@allouche.net&gt;
0	search/1	\&lt;TeXmacs|	TeXmacs document text
!:mime	text/texmacs

#------------------------------------------------------------------------------
# $File: llvm,v 1.8 2013/01/12 03:09:51 christos Exp $
# llvm:  file(1) magic for LLVM byte-codes
# URL:  http://llvm.org/docs/BitCodeFormat.html
# From: Al Stone &lt;ahs3@fc.hp.com&gt;

0	string	llvm	LLVM byte-codes, uncompressed
0	string	llvc0	LLVM byte-codes, null compression
0	string	llvc1	LLVM byte-codes, gzip compression
0	string	llvc2	LLVM byte-codes, bzip2 compression

0	lelong	0x0b17c0de	LLVM bitcode, wrapper
# Are these Mach-O ABI values?  They appear to be.
&gt;16	lelong	0x01000007	x86_64
&gt;16	lelong	0x00000007	i386
&gt;16	lelong	0x00000012	ppc
&gt;16	lelong	0x01000012	ppc64
&gt;16	lelong 	0x0000000c	arm

0	string	BC\xc0\xde	LLVM IR bitcode

#------------------------------------------------------------------------------
# $File: lua,v 1.6 2013/01/09 16:23:17 christos Exp $
# lua:  file(1) magic for Lua scripting language
# URL:  http://www.lua.org/
# From: Reuben Thomas &lt;rrt@sc3d.org&gt;, Seo Sanghyeon &lt;tinuviel@sparcs.kaist.ac.kr&gt;

# Lua scripts
0	search/1/w	#!\ /usr/bin/lua	Lua script text executable
!:mime	text/x-lua
0	search/1/w	#!\ /usr/local/bin/lua	Lua script text executable
!:mime	text/x-lua
0	search/1	#!/usr/bin/env\ lua	Lua script text executable
!:mime	text/x-lua
0	search/1	#!\ /usr/bin/env\ lua	Lua script text executable
!:mime	text/x-lua

# Lua bytecode
0	string		\033Lua			Lua bytecode,
&gt;4	byte		0x50			version 5.0
&gt;4	byte		0x51			version 5.1
&gt;4	byte		0x52			version 5.2

#------------------------------------------------------------------------------
# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $
# luks:  file(1) magic for Linux Unified Key Setup
# URL:	http://luks.endorphin.org/spec
# From:	Anthon van der Neut &lt;anthon@mnt.org&gt;

0	string		LUKS\xba\xbe	LUKS encrypted file,
&gt;6	beshort		x		ver %d
&gt;8	string		x		[%s,
&gt;40	string		x		%s,
&gt;72	string		x		%s]
&gt;168	string		x		UUID: %s
#------------------------------------------------------------------------------
# $File: m4,v 1.2 2017/08/14 07:40:38 christos Exp $
# make:  file(1) magic for M4 scripts
#
0	regex	\^dnl\ 		M4 macro processor script text
!:mime	text/x-m4
0	regex	\^AC_DEFUN\\(\\[	M4 macro processor script text
!:strength + 15
!:mime	text/x-m4

#------------------------------------------------------------
# $File: mach,v 1.23 2015/10/15 21:51:22 christos Exp $
# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
# Unfortunately the first, cafebabe, is shared with
# Java ByteCode, so they are both handled in the file &quot;cafebabe&quot;.
# The &quot;feedface&quot; ones are handled herein.
#------------------------------------------------------------
# if set, it&#039;s for the 64-bit version of the architecture
# yes, this is separate from the low-order magic number bit
# it&#039;s also separate from the &quot;64-bit libraries&quot; bit in the
# upper 8 bits of the CPU subtype

0	name	mach-o-cpu
&gt;0	belong&amp;0x01000000	0
#
# 32-bit ABIs.
#
#				1	vax
&gt;&gt;0	belong&amp;0x00ffffff	1
&gt;&gt;&gt;4		belong&amp;0x00ffffff	0	vax
&gt;&gt;&gt;4		belong&amp;0x00ffffff	1	vax11/780
&gt;&gt;&gt;4		belong&amp;0x00ffffff	2	vax11/785
&gt;&gt;&gt;4		belong&amp;0x00ffffff	3	vax11/750
&gt;&gt;&gt;4		belong&amp;0x00ffffff	4	vax11/730
&gt;&gt;&gt;4		belong&amp;0x00ffffff	5	uvaxI
&gt;&gt;&gt;4		belong&amp;0x00ffffff	6	uvaxII
&gt;&gt;&gt;4		belong&amp;0x00ffffff	7	vax8200
&gt;&gt;&gt;4		belong&amp;0x00ffffff	8	vax8500
&gt;&gt;&gt;4		belong&amp;0x00ffffff	9	vax8600
&gt;&gt;&gt;4		belong&amp;0x00ffffff	10	vax8650
&gt;&gt;&gt;4		belong&amp;0x00ffffff	11	vax8800
&gt;&gt;&gt;4		belong&amp;0x00ffffff	12	uvaxIII
&gt;&gt;&gt;4		belong&amp;0x00ffffff	&gt;12	vax subarchitecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	2	romp
&gt;&gt;0	belong&amp;0x00ffffff	3	architecture=3
&gt;&gt;0	belong&amp;0x00ffffff	4	ns32032
&gt;&gt;0	belong&amp;0x00ffffff	5	ns32332
&gt;&gt;0	belong&amp;0x00ffffff	6	m68k
#				7	x86
&gt;&gt;0	belong&amp;0x00ffffff	7
&gt;&gt;&gt;4	belong&amp;0x0000000f	3		i386
&gt;&gt;&gt;4	belong&amp;0x0000000f	4		i486
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x80		\bsx
&gt;&gt;&gt;4	belong&amp;0x0000000f	5		i586
&gt;&gt;&gt;4	belong&amp;0x0000000f	6
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0		p6
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x10		pentium_pro
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x20		pentium_2_m0x20
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x30		pentium_2_m3
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x40		pentium_2_m0x40
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x50		pentium_2_m5
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	&gt;0x50		pentium_2_m0x%x
&gt;&gt;&gt;4	belong&amp;0x0000000f	7		celeron
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x00		\b_m0x%x
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x10		\b_m0x%x
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x20		\b_m0x%x
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x30		\b_m0x%x
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x40		\b_m0x%x
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x50		\b_m0x%x
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x60
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x70		\b_mobile
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	&gt;0x70		\b_m0x%x
&gt;&gt;&gt;4	belong&amp;0x0000000f	8		pentium_3
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x00
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x10		\b_m
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x20		\b_xeon
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	&gt;0x20		\b_m0x%x
&gt;&gt;&gt;4	belong&amp;0x0000000f	9		pentiumM
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x00
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	&gt;0x00		\b_m0x%x
&gt;&gt;&gt;4	belong&amp;0x0000000f	10		pentium_4
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x00
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x10		\b_m
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	&gt;0x10		\b_m0x%x
&gt;&gt;&gt;4	belong&amp;0x0000000f	11		itanium
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x00
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x10		\b_2
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	&gt;0x10		\b_m0x%x
&gt;&gt;&gt;4	belong&amp;0x0000000f	12		xeon
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x00
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x10		\b_mp
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	&gt;0x10		\b_m0x%x
&gt;&gt;&gt;4	belong&amp;0x0000000f	&gt;12		ia32 family=%d
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	0x00
&gt;&gt;&gt;&gt;4	belong&amp;0x00fffff0	&gt;0x00		model=%x
&gt;&gt;0	belong&amp;0x00ffffff	8	mips
&gt;&gt;&gt;4		belong&amp;0x00ffffff	1	R2300
&gt;&gt;&gt;4		belong&amp;0x00ffffff	2	R2600
&gt;&gt;&gt;4		belong&amp;0x00ffffff	3	R2800
&gt;&gt;&gt;4		belong&amp;0x00ffffff	4	R2000a
&gt;&gt;&gt;4		belong&amp;0x00ffffff	5	R2000
&gt;&gt;&gt;4		belong&amp;0x00ffffff	6	R3000a
&gt;&gt;&gt;4		belong&amp;0x00ffffff	7	R3000
&gt;&gt;&gt;4		belong&amp;0x00ffffff	&gt;7	subarchitecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	9	ns32532
&gt;&gt;0	belong&amp;0x00ffffff	10	mc98000
&gt;&gt;0	belong&amp;0x00ffffff	11	hppa
&gt;&gt;&gt;4		belong&amp;0x00ffffff	0	7100
&gt;&gt;&gt;4		belong&amp;0x00ffffff	1	7100LC
&gt;&gt;&gt;4		belong&amp;0x00ffffff	&gt;1	subarchitecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	12	arm
&gt;&gt;&gt;4		belong&amp;0x00ffffff	0
&gt;&gt;&gt;4		belong&amp;0x00ffffff	1	subarchitecture=%d
&gt;&gt;&gt;4		belong&amp;0x00ffffff	2	subarchitecture=%d
&gt;&gt;&gt;4		belong&amp;0x00ffffff	3	subarchitecture=%d
&gt;&gt;&gt;4		belong&amp;0x00ffffff	4	subarchitecture=%d
&gt;&gt;&gt;4		belong&amp;0x00ffffff	5	\bv4t
&gt;&gt;&gt;4		belong&amp;0x00ffffff	6	\bv6
&gt;&gt;&gt;4		belong&amp;0x00ffffff	7	\bv5tej
&gt;&gt;&gt;4		belong&amp;0x00ffffff	8	\bxscale
&gt;&gt;&gt;4		belong&amp;0x00ffffff	9	\bv7
&gt;&gt;&gt;4		belong&amp;0x00ffffff	10	\bv7f
&gt;&gt;&gt;4		belong&amp;0x00ffffff	11	\bv7s
&gt;&gt;&gt;4		belong&amp;0x00ffffff	12	\bv7k
&gt;&gt;&gt;4		belong&amp;0x00ffffff	13	\bv8
&gt;&gt;&gt;4		belong&amp;0x00ffffff	14	\bv6m
&gt;&gt;&gt;4		belong&amp;0x00ffffff	15	\bv7m
&gt;&gt;&gt;4		belong&amp;0x00ffffff	16	\bv7em
&gt;&gt;&gt;4		belong&amp;0x00ffffff	&gt;16	subarchitecture=%d
#				13	m88k
&gt;&gt;0	belong&amp;0x00ffffff	13
&gt;&gt;&gt;4		belong&amp;0x00ffffff	0	mc88000
&gt;&gt;&gt;4		belong&amp;0x00ffffff	1	mc88100
&gt;&gt;&gt;4		belong&amp;0x00ffffff	2	mc88110
&gt;&gt;&gt;4		belong&amp;0x00ffffff	&gt;2	mc88000 subarchitecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	14	SPARC
&gt;&gt;0	belong&amp;0x00ffffff	15	i860g
&gt;&gt;0	belong&amp;0x00ffffff	16	alpha
&gt;&gt;0	belong&amp;0x00ffffff	17	rs6000
&gt;&gt;0	belong&amp;0x00ffffff	18	ppc
&gt;&gt;&gt;4		belong&amp;0x00ffffff	0
&gt;&gt;&gt;4		belong&amp;0x00ffffff	1	\b_601
&gt;&gt;&gt;4		belong&amp;0x00ffffff	2	\b_602
&gt;&gt;&gt;4		belong&amp;0x00ffffff	3	\b_603
&gt;&gt;&gt;4		belong&amp;0x00ffffff	4	\b_603e
&gt;&gt;&gt;4		belong&amp;0x00ffffff	5	\b_603ev
&gt;&gt;&gt;4		belong&amp;0x00ffffff	6	\b_604
&gt;&gt;&gt;4		belong&amp;0x00ffffff	7	\b_604e
&gt;&gt;&gt;4		belong&amp;0x00ffffff	8	\b_620
&gt;&gt;&gt;4		belong&amp;0x00ffffff	9	\b_650
&gt;&gt;&gt;4		belong&amp;0x00ffffff	10	\b_7400
&gt;&gt;&gt;4		belong&amp;0x00ffffff	11	\b_7450
&gt;&gt;&gt;4		belong&amp;0x00ffffff	100	\b_970
&gt;&gt;&gt;4		belong&amp;0x00ffffff	&gt;100	subarchitecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	&gt;18	architecture=%d
&gt;0	belong&amp;0x01000000	0x01000000
#
# 64-bit ABIs.
#
&gt;&gt;0	belong&amp;0x00ffffff	0	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	1	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	2	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	3	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	4	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	5	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	6	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	7	x86_64
&gt;&gt;&gt;4		belong&amp;0x00ffffff	0	subarchitecture=%d
&gt;&gt;&gt;4		belong&amp;0x00ffffff	1	subarchitecture=%d
&gt;&gt;&gt;4		belong&amp;0x00ffffff	2	subarchitecture=%d
&gt;&gt;&gt;4		belong&amp;0x00ffffff	3
&gt;&gt;&gt;4		belong&amp;0x00ffffff	4	\b_arch1
&gt;&gt;&gt;4		belong&amp;0x00ffffff	8	\b_haswell
&gt;&gt;&gt;4		belong&amp;0x00ffffff	&gt;4	subarchitecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	8	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	9	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	10	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	11	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	12	arm64
&gt;&gt;&gt;4		belong&amp;0x00ffffff	0
&gt;&gt;&gt;4		belong&amp;0x00ffffff	1	\bv8
&gt;&gt;0	belong&amp;0x00ffffff	13	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	14	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	15	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	16	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	17	64-bit architecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	18	ppc64
&gt;&gt;&gt;4		belong&amp;0x00ffffff	0
&gt;&gt;&gt;4		belong&amp;0x00ffffff	1		\b_601
&gt;&gt;&gt;4		belong&amp;0x00ffffff	2		\b_602
&gt;&gt;&gt;4		belong&amp;0x00ffffff	3		\b_603
&gt;&gt;&gt;4		belong&amp;0x00ffffff	4		\b_603e
&gt;&gt;&gt;4		belong&amp;0x00ffffff	5		\b_603ev
&gt;&gt;&gt;4		belong&amp;0x00ffffff	6		\b_604
&gt;&gt;&gt;4		belong&amp;0x00ffffff	7		\b_604e
&gt;&gt;&gt;4		belong&amp;0x00ffffff	8		\b_620
&gt;&gt;&gt;4		belong&amp;0x00ffffff	9		\b_650
&gt;&gt;&gt;4		belong&amp;0x00ffffff	10		\b_7400
&gt;&gt;&gt;4		belong&amp;0x00ffffff	11		\b_7450
&gt;&gt;&gt;4		belong&amp;0x00ffffff	100		\b_970
&gt;&gt;&gt;4		belong&amp;0x00ffffff	&gt;100		subarchitecture=%d
&gt;&gt;0	belong&amp;0x00ffffff	&gt;18	64-bit architecture=%d


0	name		mach-o-be
&gt;0	byte		0xcf		64-bit
&gt;4	use		mach-o-cpu
&gt;12	belong		1		object
&gt;12	belong		2		executable
&gt;12	belong		3		fixed virtual memory shared library
&gt;12	belong		4		core
&gt;12	belong		5		preload executable
&gt;12	belong		6		dynamically linked shared library
&gt;12	belong		7		dynamic linker
&gt;12	belong		8		bundle
&gt;12	belong		9		dynamically linked shared library stub
&gt;12	belong		10		dSYM companion file
&gt;12	belong		11		kext bundle
&gt;12	belong		&gt;11
&gt;&gt;12	belong		x		filetype=%d
&gt;24	belong		&gt;0		\b, flags:&lt;
&gt;&gt;24	belong		&amp;0x0000001	\bNOUNDEFS
&gt;&gt;24	belong		&amp;0x0000002	\b|INCRLINK
&gt;&gt;24	belong		&amp;0x0000004	\b|DYLDLINK
&gt;&gt;24	belong		&amp;0x0000008	\b|BINDATLOAD
&gt;&gt;24	belong		&amp;0x0000010	\b|PREBOUND
&gt;&gt;24	belong		&amp;0x0000020	\b|SPLIT_SEGS
&gt;&gt;24	belong		&amp;0x0000040	\b|LAZY_INIT
&gt;&gt;24	belong		&amp;0x0000080	\b|TWOLEVEL
&gt;&gt;24	belong		&amp;0x0000100	\b|FORCE_FLAT
&gt;&gt;24	belong		&amp;0x0000200	\b|NOMULTIDEFS
&gt;&gt;24	belong		&amp;0x0000400	\b|NOFIXPREBINDING
&gt;&gt;24	belong		&amp;0x0000800	\b|PREBINDABLE
&gt;&gt;24	belong		&amp;0x0001000	\b|ALLMODSBOUND
&gt;&gt;24	belong		&amp;0x0002000	\b|SUBSECTIONS_VIA_SYMBOLS
&gt;&gt;24	belong		&amp;0x0004000	\b|CANONICAL
&gt;&gt;24	belong		&amp;0x0008000	\b|WEAK_DEFINES
&gt;&gt;24	belong		&amp;0x0010000	\b|BINDS_TO_WEAK
&gt;&gt;24	belong		&amp;0x0020000	\b|ALLOW_STACK_EXECUTION
&gt;&gt;24	belong		&amp;0x0040000	\b|ROOT_SAFE
&gt;&gt;24	belong		&amp;0x0080000	\b|SETUID_SAFE
&gt;&gt;24	belong		&amp;0x0100000	\b|NO_REEXPORTED_DYLIBS
&gt;&gt;24	belong		&amp;0x0200000	\b|PIE
&gt;&gt;24	belong		&amp;0x0400000	\b|DEAD_STRIPPABLE_DYLIB
&gt;&gt;24	belong		&amp;0x0800000	\b|HAS_TLV_DESCRIPTORS
&gt;&gt;24	belong		&amp;0x1000000	\b|NO_HEAP_EXECUTION
&gt;&gt;24	belong		&amp;0x2000000	\b|APP_EXTENSION_SAFE
&gt;&gt;24	belong		x		\b&gt;

#
0	lelong&amp;0xfffffffe	0xfeedface	Mach-O
!:strength +1
!:mime application/x-mach-binary
&gt;0	use	\^mach-o-be

0	belong&amp;0xfffffffe	0xfeedface	Mach-O
!:strength +1
!:mime application/x-mach-binary
&gt;0	use	mach-o-be

#------------------------------------------------------------------------------
# $File: macintosh,v 1.28 2017/12/05 02:17:48 christos Exp $
# macintosh description
#
# BinHex is the Macintosh ASCII-encoded file format (see also &quot;apple&quot;)
# Daniel Quinlan, quinlan@yggdrasil.com
11	string	must\ be\ converted\ with\ BinHex	BinHex binary text
!:mime	application/mac-binhex40
&gt;41	string	x					\b, version %.3s

# Stuffit archives are the de facto standard of compression for Macintosh
# files obtained from most archives. (franklsm@tuns.ca)
0	string		SIT!			StuffIt Archive (data)
!:mime	application/x-stuffit
!:apple	SIT!SIT!
&gt;2	string		x			: %s
0	string		SITD			StuffIt Deluxe (data)
&gt;2	string		x			: %s
0	string		Seg			StuffIt Deluxe Segment (data)
&gt;2	string		x			: %s

# Newer StuffIt archives (grant@netbsd.org)
0	string		StuffIt			StuffIt Archive
!:mime	application/x-stuffit
!:apple	SIT!SIT!
#&gt;162	string		&gt;0			: %s

# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
# GRR: Too weak
#0	string		APPL			Macintosh Application (data)
#&gt;2	string		x			\b: %s

# Macintosh System files (franklsm@tuns.ca)
# GRR: Too weak
#0	string		zsys			Macintosh System File (data)
#0	string		FNDR			Macintosh Finder (data)
#0	string		libr			Macintosh Library (data)
#&gt;2	string		x			: %s
#0	string		shlb			Macintosh Shared Library (data)
#&gt;2	string		x			: %s
#0	string		cdev			Macintosh Control Panel (data)
#&gt;2	string		x			: %s
#0	string		INIT			Macintosh Extension (data)
#&gt;2	string		x			: %s
#0	string		FFIL			Macintosh Truetype Font (data)
#&gt;2	string		x			: %s
#0	string		LWFN			Macintosh Postscript Font (data)
#&gt;2	string		x			: %s

# Additional Macintosh Files (franklsm@tuns.ca)
# GRR: Too weak
#0	string		PACT			Macintosh Compact Pro Archive (data)
#&gt;2	string		x			: %s
#0	string		ttro			Macintosh TeachText File (data)
#&gt;2	string		x			: %s
#0	string		TEXT			Macintosh TeachText File (data)
#&gt;2	string		x			: %s
#0	string		PDF			Macintosh PDF File (data)
#&gt;2	string		x			: %s

# MacBinary format (Eric Fischer, enf@pobox.com)
# Update: Joerg Jenderek 
# URL: https://en.wikipedia.org/wiki/MacBinary
# Reference: http://files.stairways.com/other/macbinaryii-standard-info.txt
#
# Unfortunately MacBinary doesn&#039;t really have a magic number prior
# to the MacBinary III format.
#

# old version number, must be kept at zero for compatibility
0	byte	0
# length of filename (must be in the range 1-63)
&gt;1	ubyte	&gt;0
# skip T.PIC.LZ INSTRUMENT.7T INVENTORY
&gt;&gt;1	ubyte	&lt;64
# skip Docs.MWII ReadMe.MacWrite &quot;Notes (MacWrite II)&quot;
# by looking for printable characters at beginning of file name
&gt;&gt;&gt;2	ubelong	&gt;0x1F000000
# zero fill, must be zero for compatibility
&gt;&gt;&gt;&gt;74	byte	0
# zero fill, must be zero for compatibility
&gt;&gt;&gt;&gt;&gt;82	byte	0
# MacBinary I		test for valid version numbers
&gt;&gt;&gt;&gt;&gt;&gt;122	ubeshort	0
# additional check for creation date after 1 Jan 1970 ~ 7C25B080h
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;91	ubelong		&gt;0x7c25b07F
# additional check for undefined header fields in MacBinary I
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;101	ulong		0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	use	mac-bin
# MacBinary II		the newer versions begins at 129
&gt;&gt;&gt;&gt;&gt;&gt;122	ubeshort	0x8181
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0	use	mac-bin
# MacBinary III with MacBinary II to read
&gt;&gt;&gt;&gt;&gt;122	ubeshort	0x8281
&gt;&gt;&gt;&gt;&gt;&gt;0	use	mac-bin

#	display information of MacBinary file
0	name		mac-bin
&gt;122	ubyte	x	MacBinary
# versions for MacBinary II/III
&gt;122	ubyte	129		II
&gt;122	ubyte	130		III
# only in MacBinary III
&gt;&gt;102	string	!mBIN		with surprising version
!:mime	application/x-macbinary
!:apple	PSPTBINA
!:ext	bin/macbin
# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified as MacBinary
#&gt;1	ubyte	&gt;63		\b, name length %u too BIG!
#&gt;122	ubeshort	x	\b, version 0x%x
# Finder flags if not 0
# &gt;73	byte		!0		\b, flags 0x
# &gt;73	byte		=0		
# &gt;&gt;101	byte		!0		\b, flags 0x
# # original Finder flags (Bits 8-15)
# &gt;73	byte		!0		\b%x
# # finder flags, bits 0-7
# &gt;101	byte		!0		\b%x
&gt;73	byte		&amp;0x01		\b, inited
&gt;73	byte		&amp;0x02		\b, changed
&gt;73	byte		&amp;0x04		\b, busy
&gt;73	byte		&amp;0x08		\b, bozo
&gt;73	byte		&amp;0x10		\b, system
&gt;73	byte		&amp;0x20		\b, bundle
&gt;73	byte		&amp;0x40		\b, invisible
&gt;73	byte		&amp;0x80		\b, locked

# 75	beshort				# vertical posn in window
#&gt;75	beshort		!0		\b, v.pos %u
# 77	beshort				# horiz posn in window
#&gt;77	beshort		!0		\b, h.pos %u
# 79	beshort				# window or folder ID
&gt;79	ubeshort	!0		\b, ID 0x%x
# protected flag
&gt;81	byte		!0		\b, protected 0x%x
# length of comment after resource
&gt;99	ubeshort	!0		\b, comment length %u
# char. code of file name
&gt;106	ubyte		!0		\b, char. code 0x%x
# still more Finder flags
&gt;107	ubyte		!0		\b, more flags 0x%x
# length of total files when unpacked only used when pack and unpack on the fly
&gt;116	ubelong		!0		\b, total length %u
# 120	beshort				# length of add&#039;l header
&gt;120	ubeshort	!0		\b, 2nd header length %u
# 124	beshort				# checksum
#&gt;124	ubeshort	!0		\b, CRC 0x%x
# creation date in seconds since MacOS epoch start. So 1 Jan 1970 ~ 7C25B080
&gt;91	beldate-0x7C25B080	x	\b, %s
# THIS SHOULD NEVER HAPPEN! Maybe another file type is misidetified or time overflow
&gt;91	ubelong		&lt;0x7c25b080	INVALID date
#&gt;91	belong-0x7C25B080	x	\b, DEBUG DATE %d
# last modified date
&gt;95	beldate-0x7C25B080	x	\b, modified %s
# Apple creator+typ if not null
# file creator (normally expressed as four characters)
&gt;69	ulong			!0	\b, creator
# instead 4 character code display full creator name
&gt;&gt;69	use			apple-creator
# file type (normally expressed as four characters)
&gt;65	ulong			!0	\b, type
&gt;&gt;65	use			apple-type
# length of data segment
&gt;83	ubelong			!0	\b, %u bytes
# filename (in the range 1-63)
&gt;1	pstring			x	&quot;%s&quot;
# print 1 space and then at offset 128 inspect data fork content if it has one
&gt;83	ubelong			!0	\b 
&gt;&gt;128	indirect		x
# Afterwards resource fork if length of resource segment not zero
&gt;87	ubelong			!0
# calculate resource fork offset
&gt;&gt;83	ubelong+128		x	\b, at 0x%x
# length of resource segment
&gt;&gt;87	ubelong			!0	%u bytes
&gt;&gt;(83.S+128)	ubequad		x	resource 
# further resource fork content inspection 
&gt;&gt;&gt;&amp;-8	indirect		x

# Apple Type/Creator Database
# URL: https://en.wikipedia.org/wiki/Type_code
# Reference:	http://www.lacikam.co.il/tcdb/
#		http://www.macdisk.com/macsigen.php
# Note:	classic Mac OS files have two 4 character codes for type and creator.
#	Thereby the Finder attach documents types to applications.

#&gt;65	string		x		\b, type &quot;%4.4s&quot;

#	display information about apple type
0	name		apple-type
&gt;0	string		8BIM		PhotoShop
&gt;0	string		ALB3		PageMaker 3
&gt;0	string		ALB4		PageMaker 4
&gt;0	string		ALT3		PageMaker 3
&gt;0	string		APPL		application
&gt;0	string		AWWP		AppleWorks word processor
&gt;0	string		CIRC		simulated circuit
&gt;0	string		DRWG		MacDraw
&gt;0	string		EPSF		Encapsulated PostScript
&gt;0	string		FFIL		font suitcase
&gt;0	string		FKEY		function key
&gt;0	string		FNDR		Macintosh Finder
&gt;0	string		GIFf		GIF image
&gt;0	string		Gzip		GNU gzip
&gt;0	string		INIT		system extension
&gt;0	string		LIB\ 		library
&gt;0	string		LWFN		PostScript font
&gt;0	string		MSBC		Microsoft BASIC
&gt;0	string		PACT		Compact Pro archive
&gt;0	string		PDF\ 		Portable Document Format
&gt;0	string		PICT		picture
&gt;0	string		PNTG		MacPaint picture
&gt;0	string		PREF		preferences
&gt;0	string		PROJ		Think C project
&gt;0	string		QPRJ		Think Pascal project
&gt;0	string		SCFL		Defender scores
&gt;0	string		SCRN		startup screen
&gt;0	string		SITD		StuffIt Deluxe
&gt;0	string		SPn3		SuperPaint
&gt;0	string		STAK		HyperCard stack
&gt;0	string		Seg\ 		StuffIt segment
&gt;0	string		TARF		Unix tar archive
&gt;0	string		TEXT		ASCII
&gt;0	string		TIFF		TIFF image
&gt;0	string		TOVF		Eudora table of contents
&gt;0	string		WDBN		Microsoft Word word processor
&gt;0	string		WORD		MacWrite word processor
&gt;0	string		XLS\ 		Microsoft Excel
&gt;0	string		ZIVM		compress (.Z)
&gt;0	string		ZSYS		Pre-System 7 system file
&gt;0	string		acf3		Aldus FreeHand
&gt;0	string		cdev		control panel
&gt;0	string		dfil		Desk Accessory suitcase
&gt;0	string		libr		library
&gt;0	string		nX^d		WriteNow word processor
&gt;0	string		nX^w		WriteNow dictionary
&gt;0	string		rsrc		resource
&gt;0	string		scbk		Scrapbook
&gt;0	string		shlb		shared library
&gt;0	string		ttro		SimpleText read-only
&gt;0	string		zsys		system file

#	additional types added in Dec 2017
&gt;0	string		BINA		binary file
&gt;0	string		BMPp		BMP image
&gt;0	string		JPEG		JPEG image
#&gt;0	string		W4BN		Microsoft Word x.y word processor?
# if type name is not known display 4 character identifier
&gt;0	default		x		
&gt;&gt;0	string		x		&#039;%4.4s&#039;

#&gt;69	string		x		\b, creator &quot;%4.4s&quot;

# Now Apple has no repository of registered Creator IDs any more. These are
# just the ones that I happened to have files from and was able to identify.

#	display information about apple creator
0	name		apple-creator
&gt;0	string		8BIM		Adobe Photoshop
&gt;0	string		ALD3		PageMaker 3
&gt;0	string		ALD4		PageMaker 4
&gt;0	string		ALFA		Alpha editor
&gt;0	string		APLS		Apple Scanner
&gt;0	string		APSC		Apple Scanner
&gt;0	string		BRKL		Brickles
&gt;0	string		BTFT		BitFont
&gt;0	string		CCL2		Common Lisp 2
&gt;0	string		CCL\ 		Common Lisp
&gt;0	string		CDmo		The Talking Moose
&gt;0	string		CPCT		Compact Pro
&gt;0	string		CSOm		Eudora
&gt;0	string		DMOV		Font/DA Mover
&gt;0	string		DSIM		DigSim
&gt;0	string		EDIT		Macintosh Edit
&gt;0	string		ERIK		Macintosh Finder
&gt;0	string		EXTR		self-extracting archive
&gt;0	string		Gzip		GNU gzip
&gt;0	string		KAHL		Think C
&gt;0	string		LWFU		LaserWriter Utility
&gt;0	string		LZIV		compress
&gt;0	string		MACA		MacWrite
&gt;0	string		MACS		Macintosh operating system
&gt;0	string		MAcK		MacKnowledge terminal emulator
&gt;0	string		MLND		Defender
&gt;0	string		MPNT		MacPaint
&gt;0	string		MSBB		Microsoft BASIC (binary)
&gt;0	string		MSWD		Microsoft Word
&gt;0	string		NCSA		NCSA Telnet
&gt;0	string		PJMM		Think Pascal
&gt;0	string		PSAL		Hunt the Wumpus
#&gt;0	string		PSI2		Apple File Exchange
&gt;0	string		R*ch		BBEdit
&gt;0	string		RMKR		Resource Maker
&gt;0	string		RSED		Resource Editor
&gt;0	string		Rich		BBEdit
&gt;0	string		SIT!		StuffIt
&gt;0	string		SPNT		SuperPaint
&gt;0	string		Unix		NeXT Mac filesystem
&gt;0	string		VIM!		Vim editor
&gt;0	string		WILD		HyperCard
&gt;0	string		XCEL		Microsoft Excel
&gt;0	string		aCa2		Fontographer
&gt;0	string		aca3		Aldus FreeHand
&gt;0	string		dosa		Macintosh MS-DOS file system
&gt;0	string		movr		Font/DA Mover
&gt;0	string		nX^n		WriteNow
&gt;0	string		pdos		Apple ProDOS file system
&gt;0	string		scbk		Scrapbook
&gt;0	string		ttxt		SimpleText
&gt;0	string		ufox		Foreign File Access
#	additional creators added in Dec 2017
# Claris/Apple Works
&gt;0	string		BOBO		Apple Works
# CU-SeeMe_0.87b3_(68K).bin
#&gt;0	string		CUce		bar
&gt;0	string		PSPT		Apple File Exchange
# Disk_Copy_4.2.sea.bin
#&gt;0	string		NCse		foo
# probably StuffIt/Aladdin by Smith Micro Software, Inc.
&gt;0	string		STi0		stuffit
# MacGzip-1.1.3.sea.bin
#&gt;0	string		aust		bar
# D-Disk_Copy_6.3.3.smi.bin 
&gt;0	string		oneb		Disk Copy Self Mounting
# if creator name is not known display 4 character identifier
&gt;0	default		x		
&gt;&gt;0	string		x		&#039;%4.4s&#039;

# sas magic from Bruce Foster (bef@nwu.edu)
#
#0	string		SAS		SAS
#&gt;8	string		x		%s
0	string		SAS		SAS
&gt;24	string		DATA		data file
&gt;24	string		CATALOG		catalog
&gt;24	string		INDEX		data file index
&gt;24	string		VIEW		data view
# sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
#
0x54    string          SAS             SAS 7+
&gt;0x9C   string          DATA            data file
&gt;0x9C   string          CATALOG         catalog
&gt;0x9C   string          INDEX           data file index
&gt;0x9C   string          VIEW            data view

# spss magic for SPSS system and portable files,
#	 from Bruce Foster (bef@nwu.edu).

0	long		0xc1e2c3c9	SPSS Portable File
&gt;40	string 		x		%s

0	string		$FL2		SPSS System File
&gt;24	string		x		%s

0	string		$FL3		SPSS System File
&gt;24	string		x		%s

# Macintosh filesystem data
# From &quot;Tom N Harris&quot; &lt;telliamed@mac.com&gt;
# Fixed HFS+ and Partition map magic: Ethan Benson &lt;erbenson@alaska.net&gt;
# The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
# entries depend on the data arithmetic added after v.35
# There&#039;s also some Pascal strings in here, ditto...

# The boot block signature, according to IM:Files, is
# &quot;for HFS volumes, this field always contains the value 0x4C4B.&quot;
# But if this is true for MFS or HFS+ volumes, I don&#039;t know.
# Alternatively, the boot block is supposed to be zeroed if it&#039;s
# unused, so a simply &gt;0 should suffice.

0x400	beshort			0xD2D7		Macintosh MFS data
&gt;0	beshort			0x4C4B		(bootable)
&gt;0x40a	beshort			&amp;0x8000		(locked)
&gt;0x402	beldate-0x7C25B080	x		created: %s,
&gt;0x406	beldate-0x7C25B080	&gt;0		last backup: %s,
&gt;0x414	belong			x		block size: %d,
&gt;0x412	beshort			x		number of blocks: %d,
&gt;0x424	pstring			x		volume name: %s

# *.hfs updated by Joerg Jenderek
# http://en.wikipedia.org/wiki/Hierarchical_File_System
# &quot;BD&quot; gives many false positives
0x400	beshort			0x4244
# ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
# first block of volume bit map (always 3)
&gt;0x40e	ubeshort		0x0003
# maximal length of volume name is 27
&gt;&gt;0x424		ubyte			&lt;28	Macintosh HFS data
!:mime	application/x-apple-diskimage
#!:apple	hfsdINIT
#!:apple	MACSdisk
# http://www.macdisk.com/macsigen.php
#!:apple	ddskdevi
!:apple	????devi
# https://en.wikipedia.org/wiki/Apple_Disk_Image
!:ext hfs/dmg
&gt;&gt;&gt;0		beshort			0x4C4B	(bootable)
#&gt;&gt;&gt;0		beshort			0x0000	(not bootable)
&gt;&gt;&gt;0x40a	beshort			&amp;0x8000	(locked)
&gt;&gt;&gt;0x40a	beshort			^0x0100	(mounted)
&gt;&gt;&gt;0x40a	beshort			&amp;0x0200	(spared blocks)
&gt;&gt;&gt;0x40a	beshort			&amp;0x0800	(unclean)
&gt;&gt;&gt;0x47C	beshort			0x482B	(Embedded HFS+ Volume)
# http://www.epochconverter.com/
# 0x7C245F00 seconds	~ 2082758400	~ 01 Jan 2036 00:00:00	~ 66 years to 1970
# 0x7C25B080 seconds	~ 2082844800	~ 02 Jan 2036 00:00:00
# construct not working
#&gt;&gt;&gt;0x402	beldate-0x7C25B080	x	created: %s,
#&gt;&gt;&gt;0x406	beldate-0x7C25B080	x	last modified: %s,
#&gt;&gt;&gt;0x440	beldate-0x7C25B080	&gt;0	last backup: %s,
# found block sizes 200h,1200h,2800h
&gt;&gt;&gt;0x414	belong			x	block size: %d,
&gt;&gt;&gt;0x412	beshort			x	number of blocks: %d,
&gt;&gt;&gt;0x424	pstring			x	volume name: %s

0x400	beshort			0x482B		Macintosh HFS Extended
&gt;&amp;0	beshort			x		version %d data
&gt;0	beshort			0x4C4B		(bootable)
&gt;0x404	belong			^0x00000100	(mounted)
&gt;&amp;2	belong			&amp;0x00000200	(spared blocks)
&gt;&amp;2	belong			&amp;0x00000800	(unclean)
&gt;&amp;2	belong			&amp;0x00008000	(locked)
&gt;&amp;6	string			x		last mounted by: &#039;%.4s&#039;,
# really, that should be treated as a belong and we print a string
# based on the value. TN1150 only mentions &#039;8.10&#039; for &quot;MacOS 8.1&quot;
&gt;&amp;14	beldate-0x7C25B080	x		created: %s,
# only the creation date is local time, all other timestamps in HFS+ are UTC.
&gt;&amp;18	bedate-0x7C25B080	x		last modified: %s,
&gt;&amp;22	bedate-0x7C25B080	&gt;0		last backup: %s,
&gt;&amp;26	bedate-0x7C25B080	&gt;0		last checked: %s,
&gt;&amp;38	belong			x		block size: %d,
&gt;&amp;42	belong			x		number of blocks: %d,
&gt;&amp;46	belong			x		free blocks: %d

## AFAIK, only the signature is different
# same as Apple Partition Map
# GRR: This magic is too weak, it is just &quot;TS&quot;
#0x200		beshort		0x5453		Apple Old Partition data
#&gt;0x2		beshort		x		block size: %d,
#&gt;0x230		string		x		first type: %s,
#&gt;0x210		string		x		name: %s,
#&gt;0x254		belong		x		number of blocks: %d,
#&gt;0x400		beshort		0x504D
#&gt;&gt;0x430		string		x		second type: %s,
#&gt;&gt;0x410		string		x		name: %s,
#&gt;&gt;0x454		belong		x		number of blocks: %d,
#&gt;&gt;0x800		beshort		0x504D
#&gt;&gt;&gt;0x830	string		x		third type: %s,
#&gt;&gt;&gt;0x810	string		x		name: %s,
#&gt;&gt;&gt;0x854	belong		x		number of blocks: %d,
#&gt;&gt;&gt;0xa00	beshort		0x504D
#&gt;&gt;&gt;&gt;0xa30	string		x		fourth type: %s,
#&gt;&gt;&gt;&gt;0xa10	string		x		name: %s,
#&gt;&gt;&gt;&gt;0xa54	belong		x		number of blocks: %d

# From: Remi Mommsen &lt;mommsen@slac.stanford.edu&gt;
0		string		BOMStore	Mac OS X bill of materials (BOM) file

# From: Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
# URL: http://en.wikipedia.org/wiki/Datafork_TrueType
# Derived from the &#039;fondu&#039; and &#039;ufond&#039; source code (fondu.sf.net). &#039;sfnt&#039; is
# TrueType; &#039;POST&#039; is PostScript. &#039;FONT&#039; and &#039;NFNT&#039; sometimes appear, but I
# don&#039;t know what they mean.
0	belong	0x100
&gt;(0x4.L+24)	beshort	x
&gt;&gt;&amp;4	belong	0x73666e74	Mac OSX datafork font, TrueType
&gt;&gt;&amp;4	belong	0x464f4e54	Mac OSX datafork font, &#039;FONT&#039;
&gt;&gt;&amp;4	belong	0x4e464e54	Mac OSX datafork font, &#039;NFNT&#039;
&gt;&gt;&amp;4	belong	0x504f5354	Mac OSX datafork font, PostScript

#------------------------------------------------------------------------------
# $File: macos,v 1.1 2012/12/21 16:41:07 christos Exp $
# MacOS files
#

0	string		book\0\0\0\0mark\0\0\0\0	MacOS Alias file

#------------------------------------------------------------------------------
# $File: magic,v 1.10 2010/11/25 15:00:12 christos Exp $
# magic:  file(1) magic for magic files
#
0	string/t		#\ Magic	magic text file for file(1) cmd
0	lelong		0xF11E041C	magic binary file for file(1) cmd
&gt;4	lelong		x		(version %d) (little endian)
0	belong		0xF11E041C	magic binary file for file(1) cmd
&gt;4	belong		x		(version %d) (big endian)
#------------------------------------------------------------------------------
# $File: mail.news,v 1.23 2015/06/29 14:44:26 christos Exp $
# mail.news:  file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
#0	string		From 		mail text
0	string/t		Relay-Version: 	old news text
!:mime	message/rfc822
0	string/t		#!\ rnews	batched news text
!:mime	message/rfc822
0	string/t		N#!\ rnews	mailed, batched news text
!:mime	message/rfc822
0	string/t		Forward\ to 	mail forwarding text
!:mime	message/rfc822
0	string/t		Pipe\ to 	mail piping text
!:mime	message/rfc822
0	string/tc		delivered-to:	SMTP mail text
!:mime	message/rfc822
0	string/tc		return-path:	SMTP mail text
!:mime	message/rfc822
0	string/t		Path:		news text
!:mime	message/news
0	string/t		Xref:		news text
!:mime	message/news
0	string/t		From:		news or mail text
!:mime	message/rfc822
0	string/t		Article 	saved news text
!:mime	message/news
0	string/t		BABYL		Emacs RMAIL text
0	string/t		Received:	RFC 822 mail text
!:mime	message/rfc822
0	string/t		MIME-Version:	MIME entity text
#0	string/t		Content-	MIME entity text

# TNEF files...
0	lelong		0x223E9F78	Transport Neutral Encapsulation Format
!:mime	application/vnd.ms-tnef

# From: Kevin Sullivan &lt;ksulliva@psc.edu&gt;
0	string		*mbx*		MBX mail folder

# From: Simon Matter &lt;simon.matter@invoca.ch&gt;
0	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB
0	string		\241\002\213\015twoskip\ file\0\0\0\0	Cyrus twoskip DB

# JAM(mbp) Fidonet message area databases
# JHR file
0	string	JAM\0			JAM message area header file
&gt;12	leshort &gt;0			(%d messages)

# Squish Fidonet message area databases
# SQD file (requires at least one message in the area)
# XXX: Weak magic
#256	leshort	0xAFAE4453		Squish message area data file
#&gt;4	leshort	&gt;0			(%d messages)

#0	string		\&lt;!--\ MHonArc		text/html; x-type=mhonarc

# Cyrus: file(1) magic for compiled Cyrus sieve scripts
# URL: http://www.cyrusimap.org/docs/cyrus-imapd/2.4.6/internal/bytecode.php
# URL: http://git.cyrusimap.org/cyrus-imapd/tree/sieve/bytecode.h?h=master
# From: Philipp Hahn &lt;hahn@univention.de&gt;

# Compiled Cyrus sieve script
0       string CyrSBytecode     Cyrus sieve bytecode data,
&gt;12     belong =1       version 1, big-endian
&gt;12     lelong =1       version 1, little-endian
&gt;12     belong x        version %d, network-endian
#------------------------------------------------------------------------------
# $File: make,v 1.3 2016/12/10 14:21:29 christos Exp $
# make:  file(1) magic for makefiles
#
# URL: https://en.wikipedia.org/wiki/Make_(software)
0	regex/100l	\^CFLAGS	makefile script text
!:mime	text/x-makefile
0	regex/100l	\^VPATH		makefile script text
!:mime	text/x-makefile
0	regex/100l	\^LDFLAGS	makefile script text
!:mime	text/x-makefile
0	regex/100l	\^all:		makefile script text
!:mime	text/x-makefile
0	regex/100l	\^\\.PRECIOUS	makefile script text
!:mime	text/x-makefile
# Update: Joerg Jenderek
# Reference: https://www.freebsd.org/cgi/man.cgi?make(1)
# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with &quot;#BEGIN_ASM_LIST&quot;
# by additional escaping point character
0	regex/100l	\^\\.BEGIN	BSD makefile script text with &quot;%s&quot;
!:mime	text/x-makefile
!:ext	/mk
# exclude MS Windows help file CoNtenT with &quot;:include FOOBAR.CNT&quot;
# and NSIS script with &quot;!include&quot; by additional escaping point character
0	regex/100l	\^\\.include	BSD makefile script text with &quot;%s&quot;
!:mime	text/x-makefile
!:ext	/mk
0	regex/100l	\^SUBDIRS	automake makefile script text
!:mime	text/x-makefile


#------------------------------------------------------------------------------
# $File: map,v 1.4 2015/08/10 05:18:27 christos Exp $
# map:  file(1) magic for Map data
#

# Garmin .FIT files http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
8	string	.FIT		FIT Map data
&gt;15	byte	0
&gt;&gt;35	belong	x		\b, unit id %d
&gt;&gt;39	lelong	x		\b, serial %u
# http://pub.ks-and-ks.ne.jp/cycling/edge500_fit.shtml
# 20 years after unix epoch
# TZ=GMT date -d &#039;1989-12-31 0:00&#039; +%s
&gt;&gt;43	leldate+631065600	x	\b, %s

&gt;&gt;47	leshort x		\b, manufacturer %d
&gt;&gt;47	leshort	1		\b (garmin)
&gt;&gt;49	leshort x		\b, product %d
&gt;&gt;53	byte	x		\b, type %d
&gt;&gt;53	byte	1		\b (Device)
&gt;&gt;53	byte	2		\b (Settings)
&gt;&gt;53	byte	3		\b (Sports/Cycling)
&gt;&gt;53	byte	4		\b (Activity)
&gt;&gt;53	byte	8		\b (Elevations)
&gt;&gt;53	byte	10		\b (Totals)

# TOM TOM GPS watches ttbin files:
# http://github.com/ryanbinns/ttwatch/tree/master/ttbin
# From: Daniel Lenski
0	byte	0x20
&gt;1	leshort	0x0007
&gt;&gt;0x76	byte	0x20
&gt;&gt;&gt;0x77	leshort	0x0075		TomTom activity file, v7
&gt;&gt;&gt;&gt;8	leldate	x		(%s,
&gt;&gt;&gt;&gt;3	byte    x		device firmware %d.
&gt;&gt;&gt;&gt;4	byte	x		\b%d.
&gt;&gt;&gt;&gt;5	byte	x		\b%d,
&gt;&gt;&gt;&gt;6	leshort	x		product ID %04d)


#------------------------------------------------------------------------------
# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $
# maple:  file(1) magic for maple files
# &quot;H. Nanosecond&quot; &lt;aldomel@ix.netcom.com&gt;
# Maple V release 4, a multi-purpose math program
#

# maple library .lib
0	string	\000MVR4\nI	MapleVr4 library

# .ind
# no magic for these :-(
# they are compiled indexes for maple files

# .hdb
0	string	\000\004\000\000	Maple help database

# .mhp
# this has the form &lt;PACKAGE=name&gt;
0	string	\&lt;PACKAGE=	Maple help file
0	string	\&lt;HELP\ NAME=	Maple help file
0	string	\n\&lt;HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
#0	string	#\ Newton	Maple help file, old style
0	string	#\ daub	Maple help file, old style
#0	string	#===========	Maple help file, old style

# .mws
0	string	\000\000\001\044\000\221	Maple worksheet
#this is anomalous
0	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
# this has the form {VERSION 2 3 &quot;IBM INTEL NT&quot; &quot;2.3&quot; }\n
# that is {VERSION major_version miunor_version computer_type version_string}
0	string	{VERSION\ 	Maple worksheet
&gt;9	string	&gt;\0	version %.1s.
&gt;&gt;11	string	&gt;\0	%.1s

# .mps
0	string	\0\0\001$	Maple something
# from byte 4 it is either &#039;nul E&#039; or &#039;soh R&#039;
# I think &#039;nul E&#039; means a file that was saved as  a different name
# a sort of revision marking
# &#039;soh R&#039; means new
&gt;4	string	\000\105	An old revision
&gt;4	string	\001\122	The latest save

# .mpl
# some of these are the same as .mps above
#0000000 000 000 001 044 000 105 same as .mps
#0000000 000 000 001 044 001 122 same as .mps

0	string	#\n##\ &lt;SHAREFILE=	Maple something
0	string	\n#\n##\ &lt;SHAREFILE=	Maple something
0	string	##\ &lt;SHAREFILE=	Maple something
0	string	#\r##\ &lt;SHAREFILE=	Maple something
0	string	\r#\r##\ &lt;SHAREFILE=	Maple something
0	string	#\ \r##\ &lt;DESCRIBE&gt;	Maple something anomalous.
#--------------------------------------------
# marc21: file(1) magic for MARC 21 Format
#
# Kevin Ford (kefo@loc.gov)
#
# MARC21 formats are for the representation and communication
# of bibliographic and related information in machine-readable
# form.  For more info, see http://www.loc.gov/marc/


# leader position 20-21 must be 45
# and 22-23 also 00 so far, but we check that later.
20	string		45
&gt;0	search/2048	\x1e

# leader starts with 5 digits, followed by codes specific to MARC format
&gt;&gt;0	regex/1l	(^[0-9]{5})[acdnp][^bhlnqsu-z]	MARC21 Bibliographic
!:mime	application/marc
&gt;&gt;0	regex/1l	(^[0-9]{5})[acdnosx][z]	MARC21 Authority
!:mime	application/marc
&gt;&gt;0	regex/1l	(^[0-9]{5})[cdn][uvxy]	MARC21 Holdings
!:mime	application/marc
&gt;&gt;0	regex/1l	(^[0-9]{5})[acdn][w]	MARC21 Classification
!:mime	application/marc
&gt;&gt;0	regex/1l	(^[0-9]{5})[cdn][q]	MARC21 Community
!:mime	application/marc

# leader position 22-23, should be &quot;00&quot; but is it?
&gt;&gt;0	regex/1l	(^.{21})([^0]{2})	(non-conforming)
!:mime	application/marc

#------------------------------------------------------------------------------
# $File: mathcad,v 1.5 2009/09/19 16:28:10 christos Exp $
# mathcad:  file(1) magic for Mathcad documents
# URL:	http://www.mathsoft.com/
# From:	Josh Triplett &lt;josh@freedesktop.org&gt;

0	string	.MCAD\t		Mathcad document

#------------------------------------------------------------------------------
# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $
# mathematica:  file(1) magic for mathematica files
# &quot;H. Nanosecond&quot; &lt;aldomel@ix.netcom.com&gt;
# Mathematica a multi-purpose math program
# versions 2.2 and 3.0

#mathematica .mb
0	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
!:ext mb
0	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook
!:ext mb

# .ma
# multiple possibilites:

0	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
#&gt;41	string	&gt;\0	%s
!:ext mb

#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x

#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
#&gt;675	string	&gt;\0	%s #doesn&#039;t work well

# there may be &#039;cr&#039; instread of &#039;nl&#039; in some does this matter?

# generic:
0	string	(*^\r\r::[\011	Mathematica notebook version 2.x
!:ext mb
0	string	(*^\r\n\r\n::[\011	Mathematica notebook version 2.x
!:ext mb
0	string	(*^\015			Mathematica notebook version 2.x
!:ext mb
0	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
!:ext mb
0	string	(*^\r::[\011	Mathematica notebook version 2.x
!:ext mb
0	string	(*^\r\n::[\011	Mathematica notebook version 2.x
!:ext mb
0	string	(*^\n\n::[\011	Mathematica notebook version 2.x
!:ext mb
0	string	(*^\n::[\011	Mathematica notebook version 2.x
!:ext mb


# Mathematica .mx files

#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
0	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
#&gt;71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
# &gt;71... is optional
&gt;88	string	&gt;\0	from %s


# Mathematica files PBF:
# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
0	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)

# .ml files  These are menu resources I think
# these start with &quot;[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
# how to put that into a magic rule?
4	string	\ A~	MAthematica .ml file

# .nb files
#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
0	string	(***********************	Mathematica 3.0 notebook

# other (* matches it is a comment start in these langs
# GRR: Too weak; also matches other languages e.g. ML
#0	string	(*	Mathematica, or Pascal, Modula-2 or 3 code text

#########################
# MatLab v5
0       string  MATLAB  Matlab v5 mat-file
&gt;126    short   0x494d  (big endian)
&gt;&gt;124   beshort x       version 0x%04x
&gt;126    short   0x4d49  (little endian)
&gt;&gt;124   leshort x       version 0x%04x


#------------------------------------------------------------------------------
# $File: matroska,v 1.8 2013/02/08 17:25:16 christos Exp $
# matroska:  file(1) magic for Matroska files
#
# See http://www.matroska.org/
#

# EBML id:
0		belong		0x1a45dfa3
# DocType id:
&gt;4		search/4096 	\x42\x82
# DocType contents:
&gt;&gt;&amp;1		string		webm		WebM
!:mime  video/webm
&gt;&gt;&amp;1		string		matroska	Matroska data
!:mime  video/x-matroska

#------------------------------------------------------------------------------
# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
# Mavroyanopoulos Nikos &lt;nmav@hellug.gr&gt;
# mcrypt:   file(1) magic for mcrypt 2.2.x;
0	string		\0m\3		mcrypt 2.5 encrypted data,
&gt;4	string		&gt;\0		algorithm: %s,
&gt;&gt;&amp;1	leshort		&gt;0		keysize: %d bytes,
&gt;&gt;&gt;&amp;0	string		&gt;\0		mode: %s,

0	string		\0m\2		mcrypt 2.2 encrypted data,
&gt;3	byte		0		algorithm: blowfish-448,
&gt;3	byte		1		algorithm: DES,
&gt;3	byte		2		algorithm: 3DES,
&gt;3	byte		3		algorithm: 3-WAY,
&gt;3	byte		4		algorithm: GOST,
&gt;3	byte		6		algorithm: SAFER-SK64,
&gt;3	byte		7		algorithm: SAFER-SK128,
&gt;3	byte		8		algorithm: CAST-128,
&gt;3	byte		9		algorithm: xTEA,
&gt;3	byte		10		algorithm: TWOFISH-128,
&gt;3	byte		11		algorithm: RC2,
&gt;3	byte		12		algorithm: TWOFISH-192,
&gt;3	byte		13		algorithm: TWOFISH-256,
&gt;3	byte		14		algorithm: blowfish-128,
&gt;3	byte		15		algorithm: blowfish-192,
&gt;3	byte		16		algorithm: blowfish-256,
&gt;3	byte		100		algorithm: RC6,
&gt;3	byte		101		algorithm: IDEA,
&gt;4	byte		0		mode: CBC,
&gt;4	byte		1		mode: ECB,
&gt;4	byte		2		mode: CFB,
&gt;4	byte		3		mode: OFB,
&gt;4	byte		4		mode: nOFB,
&gt;5	byte		0		keymode: 8bit
&gt;5	byte		1		keymode: 4bit
&gt;5	byte		2		keymode: SHA-1 hash
&gt;5	byte		3		keymode: MD5 hash

#------------------------------------------------------------------------------
# $File: measure,v 1.1 2017/11/28 14:01:14 christos Exp $
# measure: file(1) magic for measurement data

# DIY-Thermocam raw data
0	name	diy-thermocam-parser
&gt;0	beshort	x	scale %d-
&gt;2	beshort x	\b%d,
&gt;4	lefloat	x	spot sensor temperature %f,
&gt;9	ubyte	0	unit celsius,
&gt;9	ubyte	1	unit fahrenheit,
&gt;8	ubyte	x	color scheme %d
&gt;10	ubyte	1	\b, show spot sensor
&gt;11	ubyte	1	\b, show scale bar
&gt;12	ubyte	&amp;1	\b, minimum point enabled
&gt;12	ubyte	&amp;2	\b, maximum point enabled
&gt;13	lefloat	x	\b, calibration: offset %f,
&gt;17	lefloat x	slope %f

0	name	diy-thermocam-checker
&gt;9	ubyte	&lt;2
&gt;&gt;10	ubyte	&lt;2
&gt;&gt;&gt;11	ubyte	&lt;2
&gt;&gt;&gt;&gt;12	ubyte	&lt;4
&gt;&gt;&gt;&gt;&gt;17	lefloat	&gt;0.0001	DIY-Thermocam raw data

# V2 and Leption 3.x:
38408	ubyte	&lt;19
&gt;38400	use	diy-thermocam-checker
&gt;&gt;38400	default x	(Lepton 3.x),
&gt;&gt;&gt;38400	use	diy-thermocam-parser

# V1 or Lepton 2.x
9608	ubyte	&lt;19
&gt;9600	use	diy-thermocam-checker
&gt;&gt;9600	default	x	(Lepton 2.x),
&gt;&gt;&gt;9600	use	diy-thermocam-parser


#------------------------------------------------------------------------------
# $File: mercurial,v 1.4 2009/09/19 16:28:10 christos Exp $
# mercurial:  file(1) magic for Mercurial changeset bundles
# http://www.selenic.com/mercurial/wiki/
#
# Jesse Glick (jesse.glick@sun.com)
#

0	string		HG10		Mercurial changeset bundle
&gt;4	string		UN		(uncompressed)
&gt;4	string		GZ		(gzip compressed)
&gt;4	string		BZ		(bzip2 compressed)

#------------------------------------------------------------------------------
# $File: metastore,v 1.2 2017/03/17 21:35:28 christos Exp $
# metastore:  file(1) magic for metastore files
# From: Thomas Wissen
# see http://david.hardeman.nu/software.php#metastore
0	string		MeTaSt00r3	Metastore data file,
&gt;10	bequad		x		version %0llx

#------------------------------------------------------------------------------
# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
# rinex:  file(1) magic for RINEX files
# http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
# ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
# data for testing: ftp://cddis.gsfc.nasa.gov/pub/gps/data
60	string		RINEX
&gt;80	search/256	XXRINEXB	RINEX Data, GEO SBAS Broadcast
&gt;&gt;&amp;32	string		x		\b, date %15.15s
&gt;&gt;5	string		x		\b, version %6.6s
!:mime	rinex/broadcast
&gt;80	search/256	XXRINEXD	RINEX Data, Observation (Hatanaka comp)
&gt;&gt;&amp;32	string		x		\b, date %15.15s
&gt;&gt;5	string		x		\b, version %6.6s
!:mime	rinex/observation
&gt;80	search/256	XXRINEXC	RINEX Data, Clock
&gt;&gt;&amp;32	string		x		\b, date %15.15s
&gt;&gt;5	string		x		\b, version %6.6s
!:mime	rinex/clock
&gt;80	search/256	XXRINEXH	RINEX Data, GEO SBAS Navigation
&gt;&gt;&amp;32	string		x		\b, date %15.15s
&gt;&gt;5	string		x		\b, version %6.6s
!:mime	rinex/navigation
&gt;80	search/256	XXRINEXG	RINEX Data, GLONASS Navigation
&gt;&gt;&amp;32	string		x		\b, date %15.15s
&gt;&gt;5	string		x		\b, version %6.6s
!:mime	rinex/navigation
&gt;80	search/256	XXRINEXL	RINEX Data, Galileo Navigation
&gt;&gt;&amp;32	string		x		\b, date %15.15s
&gt;&gt;5	string		x		\b, version %6.6s
!:mime	rinex/navigation
&gt;80	search/256	XXRINEXM	RINEX Data, Meteorological
&gt;&gt;&amp;32	string		x		\b, date %15.15s
&gt;&gt;5	string		x		\b, version %6.6s
!:mime	rinex/meteorological
&gt;80	search/256	XXRINEXN	RINEX Data, Navigation
&gt;&gt;&amp;32	string		x		\b, date %15.15s
&gt;&gt;5	string		x		\b, version %6.6s
!:mime	rinex/navigation
&gt;80	search/256	XXRINEXO	RINEX Data, Observation
&gt;&gt;&amp;32	string		x		\b, date %15.15s
&gt;&gt;5	string		x		\b, version %6.6s
!:mime	rinex/observation

# https://en.wikipedia.org/wiki/GRIB
0	string	GRIB
&gt;7	byte	=1	Gridded binary (GRIB) version 1
&gt;7	byte	=2	Gridded binary (GRIB) version 2

#------------------------------------------------------------------------------
# $File: microfocus,v 1.2 2017/03/17 21:35:28 christos Exp $
# Micro Focus COBOL data files.

# http://documentation.microfocus.com/help/index.jsp?topic=\
# %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html
# http://www.cobolproducts.com/datafile/data-viewer.html
# https://github.com/miracle2k/mfcobol-export

0 string \x30\x00\x00\x7C
&gt;36 string \x00\x3E Micro Focus File with Header (DAT)
!:mime application/octet-stream

0 string \x30\x7E\x00\x00
&gt;36 string \x00\x3E Micro Focus File with Header (DAT)
!:mime application/octet-stream

39 string \x02
&gt;136 string \x02\x02\x04\x04 Micro Focus Index File (IDX)
!:mime application/octet-stream

#------------------------------------------------------------------------------
# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $
# mime:  file(1) magic for MIME encoded files
#
0	string/t		Content-Type:\040
&gt;14	string		&gt;\0		%s
0	string/t		Content-Type:
&gt;13	string		&gt;\0		%s

#------------------------------------------------------------------------------
# $File: mips,v 1.10 2014/04/30 21:41:02 christos Exp $
# mips:  file(1) magic for MIPS ECOFF and Ucode, as used in SGI IRIX
# and DEC Ultrix
#
0	beshort	0x0160		MIPSEB ECOFF executable
&gt;20	beshort	0407		(impure)
&gt;20	beshort	0410		(swapped)
&gt;20	beshort	0413		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;22	byte	x		- version %d
&gt;23	byte	x		\b.%d
#
0	beshort	0x0162		MIPSEL-BE ECOFF executable
&gt;20	beshort	0407		(impure)
&gt;20	beshort	0410		(swapped)
&gt;20	beshort	0413		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;23	byte	x		- version %d
&gt;22	byte	x		\b.%d
#
0	beshort	0x6001		MIPSEB-LE ECOFF executable
&gt;20	beshort	03401		(impure)
&gt;20	beshort	04001		(swapped)
&gt;20	beshort	05401		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;23	byte	x		- version %d
&gt;22	byte	x		\b.%d
#
0	beshort	0x6201		MIPSEL ECOFF executable
&gt;20	beshort	03401		(impure)
&gt;20	beshort	04001		(swapped)
&gt;20	beshort	05401		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;23	byte	x		- version %d
&gt;22	byte	x		\b.%d
#
# MIPS 2 additions
#
0	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
&gt;20	beshort	0407		(impure)
&gt;20	beshort	0410		(swapped)
&gt;20	beshort	0413		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;22	byte	x		- version %d
&gt;23	byte	x		\b.%d
#
0	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
&gt;20	beshort	0407		(impure)
&gt;20	beshort	0410		(swapped)
&gt;20	beshort	0413		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;22	byte	x		- version %d
&gt;23	byte	x		\b.%d
#
0	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
&gt;20	beshort	03401		(impure)
&gt;20	beshort	04001		(swapped)
&gt;20	beshort	05401		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;23	byte	x		- version %d
&gt;22	byte	x		\b.%d
#
0	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
&gt;20	beshort	03401		(impure)
&gt;20	beshort	04001		(swapped)
&gt;20	beshort	05401		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;23	byte	x		- version %d
&gt;22	byte	x		\b.%d
#
# MIPS 3 additions
#
0	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
&gt;20	beshort	0407		(impure)
&gt;20	beshort	0410		(swapped)
&gt;20	beshort	0413		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;22	byte	x		- version %d
&gt;23	byte	x		\b.%d
#
0	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
&gt;20	beshort	0407		(impure)
&gt;20	beshort	0410		(swapped)
&gt;20	beshort	0413		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;22	byte	x		- version %d
&gt;23	byte	x		\b.%d
#
0	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
&gt;20	beshort	03401		(impure)
&gt;20	beshort	04001		(swapped)
&gt;20	beshort	05401		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;23	byte	x		- version %d
&gt;22	byte	x		\b.%d
#
0	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
&gt;20	beshort	03401		(impure)
&gt;20	beshort	04001		(swapped)
&gt;20	beshort	05401		(paged)
&gt;8	belong	&gt;0		not stripped
&gt;8	belong	0		stripped
&gt;23	byte	x		- version %d
&gt;22	byte	x		\b.%d
#
0	beshort	0x180		MIPSEB Ucode
0	beshort	0x182		MIPSEL-BE Ucode

#------------------------------------------------------------------------------
# $File: mirage,v 1.7 2009/09/19 16:28:10 christos Exp $
# mirage:  file(1) magic for Mirage executables
#
# XXX - byte order?
#
0	long	31415		Mirage Assembler m.out executable

#-----------------------------------------------------------------------------
# $File: misctools,v 1.17 2017/03/17 21:35:28 christos Exp $
# misctools:  file(1) magic for miscellaneous UNIX tools.
#
0	search/1	%%!!			X-Post-It-Note text
0	string/c	BEGIN:VCALENDAR		vCalendar calendar file
!:mime	text/calendar
# updated by Joerg Jenderek at Apr 2015
# Extension: .vcf
# http://en.wikipedia.org/wiki/VCard
0	string/c	BEGIN:VCARD		vCard visiting card
# deprecated
#!:mime	text/x-vcard
!:mime	text/vcard
# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
&gt;12	search/14000/c	VERSION:
# VERSION 2.1 , 3.0 or 4.0
&gt;&gt;&amp;0	string		x			\b, version %-.3s

# Summary: Libtool library file
# Extension: .la
# Submitted by: Tomasz Trojanowski &lt;tomek@uninet.com.pl&gt;
0	search/80	.la\ -\ a\ libtool\ library\ file	libtool library file

# Summary: Libtool object file
# Extension: .lo
# Submitted by: Abel Cheung &lt;abelcheung@gmail.com&gt;
0	search/80	.lo\ -\ a\ libtool\ object\ file	libtool object file

# From: Daniel Novotny &lt;dnovotny@redhat.com&gt;
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps
# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx
#
# &quot;Windows Minidump&quot; by TrID
# ./misctools (version 5.25) labeled the entry as &quot;MDMP crash report data&quot;
0	string		MDMP					Mini DuMP crash report
# http://filext.com/file-extension/DMP
!:mime	application/x-dmp
!:ext	dmp/mdmp
# The high-order word is an internal value that is implementation specific.
# The low-order word is MINIDUMP_VERSION 0xA793
&gt;4	ulelong&amp;0x0000FFFF	!0xA793				\b, version 0x%4.4x
# NumberOfStreams 8,9,10,13
&gt;8	ulelong			x				\b, %d streams
# StreamDirectoryRva 0x20
&gt;12	ulelong			!0x20				\b, 0x%8.8x RVA
# CheckSum 0
&gt;16	ulelong			!0				\b, CheckSum 0x%8.8x
# Reserved or TimeDateStamp
&gt;20	ledate			x				\b, %s
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
&gt;24	ulelong			x				\b, 0x%x type
# &gt;24	ulelong			&gt;0				\b; include
# &gt;&gt;24	ulelong			&amp;0x00000001			\b data sections,
# &gt;&gt;24	ulelong			&amp;0x00000020			\b list of unloaded modules,
# &gt;&gt;24	ulelong			&amp;0x00000100			\b process and thread information,
# &gt;&gt;24	ulelong			&amp;0x00000800			\b memory information,

# Summary: abook addressbook file
# Submitted by: Mark Schreiber &lt;mark7@alumni.cmu.edu&gt;
0	string	#\x20abook\x20addressbook\x20file abook address book
!:mime application/x-abook-addressbook

#------------------------------------------------------------------------------
# $File: mkid,v 1.6 2009/09/19 16:28:10 christos Exp $
# mkid:  file(1) magic for mkid(1) databases
#
# ID is the binary tags database produced by mkid(1).
#
# XXX - byte order?
#
0	string		\311\304	ID tags data
&gt;2	short		&gt;0		version %d

#------------------------------------------------------------------------------
# $File: mlssa,v 1.4 2009/09/19 16:28:10 christos Exp $
# mlssa: file(1) magic for MLSSA datafiles
#
0		lelong		0xffffabcd	MLSSA datafile,
&gt;4		leshort		x		algorithm %d,
&gt;10		lelong		x		%d samples

#------------------------------------------------------------------------------
# $File: mmdf,v 1.6 2009/09/19 16:28:10 christos Exp $
# mmdf:  file(1) magic for MMDF mail files
#
0	string	\001\001\001\001	MMDF mailbox

#------------------------------------------------------------------------------
# $File: modem,v 1.8 2017/03/17 21:35:28 christos Exp $
# modem:  file(1) magic for modem programs
#
# From: Florian La Roche &lt;florian@knorke.saar.de&gt;
1	string		PC\ Research,\ Inc	Digifax-G3-File
&gt;29	byte		1			\b, fine resolution
&gt;29	byte		0			\b, normal resolution

# Summary: CCITT Group 3 Facsimile in &quot;raw&quot; form (i.e. no header).
# Modified by: Joerg Jenderek
# URL: https://de.wikipedia.org/wiki/Fax
# Reference: http://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
# GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
0	short		0x0100
# 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER
&gt;2	search/9	\0\0
# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
&gt;2	default		x
# skip IRCAM file (VAX big-endian)	./audio
&gt;&gt;0	belong		!0x0001a364
# skip GEM Image data			./images
&gt;&gt;&gt;2	beshort		!0x0008
# look for first keyword of Panorama database *.pan
&gt;&gt;&gt;&gt;11	search/262	\x06DESIGN
# skip Panorama database
&gt;&gt;&gt;&gt;11	default		x
# old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files
&gt;&gt;&gt;&gt;&gt;27118	search/1864	DreamWorld
&gt;&gt;&gt;&gt;&gt;27118	default		x
# skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
&gt;&gt;&gt;&gt;&gt;&gt;8		ubequad		!0x2e01010454010203
# skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
&gt;&gt;&gt;&gt;&gt;&gt;&gt;8	ubequad		!0x5dee74ad1aa56394	raw G3 (Group 3) FAX, byte-padded
# version 5.25 labeled the entry above &quot;raw G3 data, byte-padded&quot;
!:mime	image/g3fax
#!:apple	????TIFF
!:ext	g3
# unusual image starting with black pixel
#0	short		0x1300		raw G3 (Group 3) FAX
0	short		0x1400
# 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
&gt;2	search/9	\0\0
# maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
&gt;2	default		x		raw G3 (Group 3) FAX
# version 5.25 labeled the above entry as &quot;raw G3 data&quot;
!:mime	image/g3fax
!:ext	g3
# unusual image with black pixel near beginning
#0	short		0x1900		raw G3 (Group 3) FAX

#
# Magic data for vgetty voice formats
# (Martin Seine &amp; Marc Eberhard)

#
# raw modem data version 1
#
0    string    RMD1      raw modem data
&gt;4   string    &gt;\0       (%s /
&gt;20  short     &gt;0        compression type 0x%04x)

#
# portable voice format 1
#
0    string    PVF1\n         portable voice format
&gt;5   string    &gt;\0       (binary %s)

#
# portable voice format 2
#
0    string    PVF2\n         portable voice format
&gt;5   string &gt;\0          (ascii %s)

# From: Bernd Nuernberger &lt;bernd.nuernberger@web.de&gt;
# Brooktrout G3 fax data incl. 128 byte header
# Common suffixes: 3??, BRK, BRT, BTR
0	leshort		0x01bb
&gt;2	leshort		0x0100		Brooktrout 301 fax image,
&gt;&gt;9	leshort		x		%d x
&gt;&gt;0x2d	leshort		x		%d
&gt;&gt;6	leshort		200		\b, fine resolution
&gt;&gt;6	leshort		100		\b, normal resolution
&gt;&gt;11	byte		1		\b, G3 compression
&gt;&gt;11	byte		2		\b, G32D compression

#------------------------------------------------------------------------------
# $File: motorola,v 1.11 2014/04/30 21:41:02 christos Exp $
# motorola:  file(1) magic for Motorola 68K and 88K binaries
#
# 68K
#
0	beshort		0520		mc68k COFF
&gt;18	beshort		^00000020	object
&gt;18	beshort		&amp;00000020	executable
&gt;12	belong		&gt;0		not stripped
&gt;168	string		.lowmem		Apple toolbox
&gt;20	beshort		0407		(impure)
&gt;20	beshort		0410		(pure)
&gt;20	beshort		0413		(demand paged)
&gt;20	beshort		0421		(standalone)
0	beshort		0521		mc68k executable (shared)
&gt;12	belong		&gt;0		not stripped
0	beshort		0522		mc68k executable (shared demand paged)
&gt;12	belong		&gt;0		not stripped
#
# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
#
0	beshort		0554		68K BCS executable
#
# 88K
#
# Motorola/88Open BCS
#
0	beshort		0555		88K BCS executable
#
# Motorola S-Records, from Gerd Truschinski &lt;gt@freebsd.first.gmd.de&gt;
0   string      S0          Motorola S-Record; binary data in text format

# ATARI ST relocatable PRG
#
# from Oskar Schirmer &lt;schirmer@scara.com&gt; Feb 3, 2001
# (according to Roland Waldi, Oct 21, 1987)
# besides the magic 0x601a, the text segment size is checked to be
# not larger than 1 MB (which is a lot on ST).
# The additional 0x601b distinction I took from Doug Lee&#039;s magic.
0	belong&amp;0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
&gt;2	belong			x		(txt=%d,
&gt;6	belong			x		dat=%d,
&gt;10	belong			x		bss=%d,
&gt;14	belong			x		sym=%d)
0	belong&amp;0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
&gt;2	belong			x		(txt=%d,
&gt;6	belong			x		dat=%d,
&gt;10	belong			x		bss=%d,
&gt;14	belong			x		sym=%d)

# Atari ST/TT... program format (sent by Wolfram Kleff &lt;kleff@cs.uni-bonn.de&gt;)
0       beshort         0x601A          Atari 68xxx executable,
&gt;2      belong          x               text len %u,
&gt;6      belong          x               data len %u,
&gt;10     belong          x               BSS len %u,
&gt;14     belong          x               symboltab len %u,
&gt;18     belong          0
&gt;22     belong          &amp;0x01           fastload flag,
&gt;22     belong          &amp;0x02           may be loaded to alternate RAM,
&gt;22     belong          &amp;0x04           malloc may be from alternate RAM,
&gt;22     belong          x               flags: 0x%X,
&gt;26     beshort         0               no relocation tab
&gt;26     beshort         !0              + relocation tab
&gt;30     string          SFX             [Self-Extracting LZH SFX archive]
&gt;38     string          SFX             [Self-Extracting LZH SFX archive]
&gt;44     string          ZIP!            [Self-Extracting ZIP SFX archive]

0       beshort         0x0064          Atari 68xxx CPX file
&gt;8      beshort         x               (version %04x)

#------------------------------------------------------------------------------
# $File: mozilla,v 1.8 2018/01/17 12:08:36 christos Exp $
# mozilla:  file(1) magic for Mozilla XUL fastload files
# (XUL.mfasl and XPC.mfasl)
# URL:	http://www.mozilla.org/
# From:	Josh Triplett &lt;josh@freedesktop.org&gt;

0	string	XPCOM\nMozFASL\r\n\x1A		Mozilla XUL fastload data
0	string	mozLz4a				Mozilla lz4 compressed bookmark data

# From: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Firefox_4
# Reference: https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT
# Note:	Most ZIP utilities are able to extract such archives
#	maybe only partly or after some warnings. Example:
#	zip -FF omni.ja --out omni.zip
4	string	PK\001\002	Mozilla archive omni.ja
!:mime	application/x-zip
!:ext	ja
# TODO:
#&gt;4	use	zip-dir-entry

#------------------------------------------------------------------------------
# $File: msdos,v 1.121 2017/10/27 21:43:23 christos Exp $
# msdos:  file(1) magic for MS-DOS files
#

# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
# updated by Joerg Jenderek at Oct 2008,Apr 2011
0	string/t	@
&gt;1	string/cW	\ echo\ off	DOS batch file text
!:mime	text/x-msdos-batch
&gt;1	string/cW	echo\ off	DOS batch file text
!:mime	text/x-msdos-batch
&gt;1	string/cW	rem		DOS batch file text
!:mime	text/x-msdos-batch
&gt;1	string/cW	set\ 		DOS batch file text
!:mime	text/x-msdos-batch


# OS/2 batch files are REXX. the second regex is a bit generic, oh well
# the matched commands seem to be common in REXX and uncommon elsewhere
100	search/0xffff   rxfuncadd
&gt;100	regex/c =^[\ \t]{0,10}call[\ \t]{1,10}rxfunc	OS/2 REXX batch file text
100	search/0xffff   say
&gt;100	regex/c =^[\ \t]{0,10}say\ [&#039;&quot;]			OS/2 REXX batch file text

# updated by Joerg Jenderek at Oct 2015
# https://de.wikipedia.org/wiki/Common_Object_File_Format
# http://www.delorie.com/djgpp/doc/coff/filhdr.html
# ./intel already labeled COFF type 0x14c=0514 as &quot;80386 COFF executable&quot;
#0	leshort		0x14c	MS Windows COFF Intel 80386 object file
#&gt;4	ledate		x	stamp %s
0	leshort		0x166	MS Windows COFF MIPS R4000 object file
#&gt;4	ledate		x	stamp %s
0	leshort		0x184	MS Windows COFF Alpha object file
#&gt;4	ledate		x	stamp %s
0	leshort		0x268	MS Windows COFF Motorola 68000 object file
#&gt;4	ledate		x	stamp %s
0	leshort		0x1f0	MS Windows COFF PowerPC object file
#&gt;4	ledate		x	stamp %s
0	leshort		0x290	MS Windows COFF PA-RISC object file
#&gt;4	ledate		x	stamp %s

# Tests for various EXE types.
#
# Many of the compressed formats were extraced from IDARC 1.23 source code.
#
0	string/b	MZ
# All non-DOS EXE extensions have the relocation table more than 0x40 bytes into the file.
&gt;0x18	leshort &lt;0x40 MS-DOS executable
!:mime	application/x-dosexec
# These traditional tests usually work but not always.  When test quality support is
# implemented these can be turned on.
#&gt;&gt;0x18	leshort	0x1c	(Borland compiler)
#&gt;&gt;0x18	leshort	0x1e	(MS compiler)

# If the relocation table is 0x40 or more bytes into the file, it&#039;s definitely
# not a DOS EXE.
&gt;0x18  leshort &gt;0x3f

# Maybe it&#039;s a PE?
&gt;&gt;(0x3c.l) string PE\0\0 PE
!:mime	application/x-dosexec
&gt;&gt;&gt;(0x3c.l+24)	leshort		0x010b	\b32 executable
&gt;&gt;&gt;(0x3c.l+24)	leshort		0x020b	\b32+ executable
&gt;&gt;&gt;(0x3c.l+24)	leshort		0x0107	ROM image
&gt;&gt;&gt;(0x3c.l+24)	default		x	Unknown PE signature
&gt;&gt;&gt;&gt;&amp;0 		leshort		x	0x%x
&gt;&gt;&gt;(0x3c.l+22)	leshort&amp;0x2000	&gt;0	(DLL)
&gt;&gt;&gt;(0x3c.l+92)	leshort		1	(native)
&gt;&gt;&gt;(0x3c.l+92)	leshort		2	(GUI)
&gt;&gt;&gt;(0x3c.l+92)	leshort		3	(console)
&gt;&gt;&gt;(0x3c.l+92)	leshort		7	(POSIX)
&gt;&gt;&gt;(0x3c.l+92)	leshort		9	(Windows CE)
&gt;&gt;&gt;(0x3c.l+92)	leshort		10	(EFI application)
&gt;&gt;&gt;(0x3c.l+92)	leshort		11	(EFI boot service driver)
&gt;&gt;&gt;(0x3c.l+92)	leshort		12	(EFI runtime driver)
&gt;&gt;&gt;(0x3c.l+92)	leshort		13	(EFI ROM)
&gt;&gt;&gt;(0x3c.l+92)	leshort		14	(XBOX)
&gt;&gt;&gt;(0x3c.l+92)	leshort		15	(Windows boot application)
&gt;&gt;&gt;(0x3c.l+92)	default		x	(Unknown subsystem
&gt;&gt;&gt;&gt;&amp;0		leshort		x	0x%x)
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x14c	Intel 80386
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x166	MIPS R4000
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x168	MIPS R10000
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x184	Alpha
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x1a2	Hitachi SH3
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x1a6	Hitachi SH4
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x1c0	ARM
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x1c2	ARM Thumb
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x1c4	ARMv7 Thumb
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x1f0	PowerPC
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x200	Intel Itanium
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x266	MIPS16
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x268	Motorola 68000
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x290	PA-RISC
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x366	MIPSIV
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x466	MIPS16 with FPU
&gt;&gt;&gt;(0x3c.l+4)	leshort		0xebc	EFI byte code
&gt;&gt;&gt;(0x3c.l+4)	leshort		0x8664	x86-64
&gt;&gt;&gt;(0x3c.l+4)	leshort		0xc0ee	MSIL
&gt;&gt;&gt;(0x3c.l+4)	default		x	Unknown processor type
&gt;&gt;&gt;&gt;&amp;0		leshort		x	0x%x
&gt;&gt;&gt;(0x3c.l+22)	leshort&amp;0x0200	&gt;0	(stripped to external PDB)
&gt;&gt;&gt;(0x3c.l+22)	leshort&amp;0x1000	&gt;0	system file
&gt;&gt;&gt;(0x3c.l+24)	leshort		0x010b
&gt;&gt;&gt;&gt;(0x3c.l+232) lelong	&gt;0	Mono/.Net assembly
&gt;&gt;&gt;(0x3c.l+24)	leshort		0x020b
&gt;&gt;&gt;&gt;(0x3c.l+248) lelong	&gt;0	Mono/.Net assembly

# hooray, there&#039;s a DOS extender using the PE format, with a valid PE
# executable inside (which just prints a message and exits if run in win)
&gt;&gt;&gt;(8.s*16)		string		32STUB	\b, 32rtm DOS extender
&gt;&gt;&gt;(8.s*16)		string		!32STUB	\b, for MS Windows
&gt;&gt;&gt;(0x3c.l+0xf8)	string		UPX0 \b, UPX compressed
&gt;&gt;&gt;(0x3c.l+0xf8)	search/0x140	PEC2 \b, PECompact2 compressed
&gt;&gt;&gt;(0x3c.l+0xf8)	search/0x140	UPX2
&gt;&gt;&gt;&gt;(&amp;0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
&gt;&gt;&gt;(0x3c.l+0xf8)	search/0x140	.idata
&gt;&gt;&gt;&gt;(&amp;0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
&gt;&gt;&gt;&gt;(&amp;0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
&gt;&gt;&gt;&gt;(&amp;0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
&gt;&gt;&gt;(0x3c.l+0xf8)	search/0x140	.rsrc
&gt;&gt;&gt;&gt;(&amp;0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
&gt;&gt;&gt;&gt;(&amp;0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
&gt;&gt;&gt;&gt;(&amp;0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
&gt;&gt;&gt;&gt;(&amp;0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
&gt;&gt;&gt;(0x3c.l+0xf8)	search/0x140	.data
&gt;&gt;&gt;&gt;(&amp;0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
&gt;&gt;&gt;(0x3c.l+0xf8)	search/0x140	.petite\0 \b, Petite compressed
&gt;&gt;&gt;&gt;(0x3c.l+0xf7)	byte		x
&gt;&gt;&gt;&gt;&gt;(&amp;0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
&gt;&gt;&gt;(0x3c.l+0xf8)	search/0x140	.WISE \b, WISE installer self-extracting archive
&gt;&gt;&gt;(0x3c.l+0xf8)	search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
&gt;&gt;&gt;&amp;(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
&gt;&gt;&gt;&amp;(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
&gt;&gt;&gt;0x30			string		Inno \b, InnoSetup self-extracting archive

# Hmm, not a PE but the relocation table is too high for a traditional DOS exe,
# must be one of the unusual subformats.
&gt;&gt;(0x3c.l) string !PE\0\0 MS-DOS executable
!:mime	application/x-dosexec

&gt;&gt;(0x3c.l)		string		NE \b, NE
!:mime	application/x-dosexec
&gt;&gt;&gt;(0x3c.l+0x36)	byte		1 for OS/2 1.x
&gt;&gt;&gt;(0x3c.l+0x36)	byte		2 for MS Windows 3.x
&gt;&gt;&gt;(0x3c.l+0x36)	byte		3 for MS-DOS
&gt;&gt;&gt;(0x3c.l+0x36)	byte		4 for Windows 386
&gt;&gt;&gt;(0x3c.l+0x36)	byte		5 for Borland Operating System Services
&gt;&gt;&gt;(0x3c.l+0x36)	default		x
&gt;&gt;&gt;&gt;(0x3c.l+0x36)	byte		x (unknown OS %x)
&gt;&gt;&gt;(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
&gt;&gt;&gt;(0x3c.l+0x0c)	leshort&amp;0x8003	0x8002 (DLL)
&gt;&gt;&gt;(0x3c.l+0x0c)	leshort&amp;0x8003	0x8001 (driver)
&gt;&gt;&gt;&amp;(&amp;0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
&gt;&gt;&gt;(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)

&gt;&gt;(0x3c.l)		string		LX\0\0 \b, LX
!:mime	application/x-dosexec
&gt;&gt;&gt;(0x3c.l+0x0a)	leshort		&lt;1 (unknown OS)
&gt;&gt;&gt;(0x3c.l+0x0a)	leshort		1 for OS/2
&gt;&gt;&gt;(0x3c.l+0x0a)	leshort		2 for MS Windows
&gt;&gt;&gt;(0x3c.l+0x0a)	leshort		3 for DOS
&gt;&gt;&gt;(0x3c.l+0x0a)	leshort		&gt;3 (unknown OS)
&gt;&gt;&gt;(0x3c.l+0x10)	lelong&amp;0x28000	=0x8000 (DLL)
&gt;&gt;&gt;(0x3c.l+0x10)	lelong&amp;0x20000	&gt;0 (device driver)
&gt;&gt;&gt;(0x3c.l+0x10)	lelong&amp;0x300	0x300 (GUI)
&gt;&gt;&gt;(0x3c.l+0x10)	lelong&amp;0x28300	&lt;0x300 (console)
&gt;&gt;&gt;(0x3c.l+0x08)	leshort		1 i80286
&gt;&gt;&gt;(0x3c.l+0x08)	leshort		2 i80386
&gt;&gt;&gt;(0x3c.l+0x08)	leshort		3 i80486
&gt;&gt;&gt;(8.s*16)		string		emx \b, emx
&gt;&gt;&gt;&gt;&amp;1			string		x %s
&gt;&gt;&gt;&amp;(&amp;0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive

# MS Windows system file, supposedly a collection of LE executables
&gt;&gt;(0x3c.l)		string		W3 \b, W3 for MS Windows
!:mime	application/x-dosexec

&gt;&gt;(0x3c.l)		string		LE\0\0 \b, LE executable
!:mime	application/x-dosexec
&gt;&gt;&gt;(0x3c.l+0x0a)	leshort		1
# some DOS extenders use LE files with OS/2 header
&gt;&gt;&gt;&gt;0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
&gt;&gt;&gt;&gt;0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
&gt;&gt;&gt;&gt;0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
&gt;&gt;&gt;&gt;0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
&gt;&gt;&gt;&gt;0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
&gt;&gt;&gt;&gt;0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
&gt;&gt;&gt;&gt;0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
# this is a wild guess; hopefully it is a specific signature
&gt;&gt;&gt;&gt;&amp;0x24		lelong		&lt;0x50
&gt;&gt;&gt;&gt;&gt;(&amp;0x4c.l)		string		\xfc\xb8WATCOM
&gt;&gt;&gt;&gt;&gt;&gt;&amp;0		search/8	3\xdbf\xb9 \b, 32Lite compressed
# another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
#&gt;&gt;&gt;&gt;(0x3c.l+0x1c)	lelong		&gt;0x10000 for OS/2
# fails with DOS-Extenders.
&gt;&gt;&gt;(0x3c.l+0x0a)	leshort		2 for MS Windows
&gt;&gt;&gt;(0x3c.l+0x0a)	leshort		3 for DOS
&gt;&gt;&gt;(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
&gt;&gt;&gt;(&amp;0x7c.l+0x26)	string		UPX \b, UPX compressed
&gt;&gt;&gt;&amp;(&amp;0x54.l-3)		string		UNACE \b, ACE self-extracting archive

# looks like ASCII, probably some embedded copyright message.
# and definitely not NE/LE/LX/PE
&gt;&gt;0x3c		lelong	&gt;0x20000000
&gt;&gt;&gt;(4.s*512)	leshort !0x014c \b, MZ for MS-DOS
!:mime	application/x-dosexec
# header data too small for extended executable
&gt;2		long	!0
&gt;&gt;0x18		leshort &lt;0x40
&gt;&gt;&gt;(4.s*512)	leshort !0x014c

&gt;&gt;&gt;&gt;&amp;(2.s-514)	string	!LE
&gt;&gt;&gt;&gt;&gt;&amp;-2	string	!BW \b, MZ for MS-DOS
!:mime	application/x-dosexec
&gt;&gt;&gt;&gt;&amp;(2.s-514)	string	LE \b, LE
&gt;&gt;&gt;&gt;&gt;0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
# educated guess since indirection is still not capable enough for complex offset
# calculations (next embedded executable would be at &amp;(&amp;2*512+&amp;0-2)
# I suspect there are only LE executables in these multi-exe files
&gt;&gt;&gt;&gt;&amp;(2.s-514)	string	BW
&gt;&gt;&gt;&gt;&gt;0x240	search/0x100	DOS/4G	\b, LE for MS-DOS, DOS4GW DOS extender (embedded)
&gt;&gt;&gt;&gt;&gt;0x240	search/0x100	!DOS/4G	\b, BW collection for MS-DOS

# This sequence skips to the first COFF segment, usually .text
&gt;(4.s*512)	leshort		0x014c \b, COFF
!:mime	application/x-dosexec
&gt;&gt;(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
&gt;&gt;(8.s*16)	string		emx
&gt;&gt;&gt;&amp;1		string		x for DOS, Win or OS/2, emx %s
&gt;&gt;&amp;(&amp;0x42.l-3)	byte		x
&gt;&gt;&gt;&amp;0x26	string		UPX \b, UPX compressed
# and yet another guess: small .text, and after large .data is unusal, could be 32lite
&gt;&gt;&amp;0x2c		search/0xa0	.text
&gt;&gt;&gt;&amp;0x0b	lelong		&lt;0x2000
&gt;&gt;&gt;&gt;&amp;0		lelong		&gt;0x6000 \b, 32lite compressed

&gt;(8.s*16) string $WdX \b, WDos/X DOS extender

# By now an executable type should have been printed out.  The executable
# may be a self-uncompressing archive, so look for evidence of that and
# print it out.
#
# Some signatures below from Greg Roelofs, newt@uchicago.edu.
#
&gt;0x35	string	\x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
&gt;0xe7	string	LH/2\ 	Self-Extract \b, %s
&gt;0x1c	string	UC2X	\b, UCEXE compressed
&gt;0x1c	string	WWP\ 	\b, WWPACK compressed
&gt;0x1c	string	RJSX 	\b, ARJ self-extracting archive
&gt;0x1c	string	diet 	\b, diet compressed
&gt;0x1c	string	LZ09 	\b, LZEXE v0.90 compressed
&gt;0x1c	string	LZ91 	\b, LZEXE v0.91 compressed
&gt;0x1c	string	tz 	\b, TinyProg compressed
&gt;0x1e	string	Copyright\ 1989-1990\ PKWARE\ Inc.	Self-extracting PKZIP archive
!:mime	application/zip
# Yes, this really is &quot;Copr&quot;, not &quot;Corp.&quot;
&gt;0x1e	string	PKLITE\ Copr.	Self-extracting PKZIP archive
!:mime	application/zip
# winarj stores a message in the stub instead of the sig in the MZ header
&gt;0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
&gt;0x20	string AIN
&gt;&gt;0x23	string 2	\b, AIN 2.x compressed
&gt;&gt;0x23	string &lt;2	\b, AIN 1.x compressed
&gt;&gt;0x23	string &gt;2	\b, AIN 1.x compressed
&gt;0x24	string	LHa&#039;s\ SFX \b, LHa self-extracting archive
!:mime	application/x-lha
&gt;0x24	string	LHA&#039;s\ SFX \b, LHa self-extracting archive
!:mime	application/x-lha
&gt;0x24	string	\ $ARX \b, ARX self-extracting archive
&gt;0x24	string	\ $LHarc \b, LHarc self-extracting archive
&gt;0x20	string	SFX\ by\ LARC \b, LARC self-extracting archive
&gt;0x40	string aPKG \b, aPackage self-extracting archive
&gt;0x64	string	W\ Collis\0\0 \b, Compack compressed
&gt;0x7a	string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
&gt;&gt;&amp;0xf4 search/0x140 \x0\x40\x1\x0
&gt;&gt;&gt;(&amp;0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
&gt;1638	string	-lh5- \b, LHa self-extracting archive v2.13S
&gt;0x17888 string Rar! \b, RAR self-extracting archive

# Skip to the end of the EXE.  This will usually work fine in the PE case
# because the MZ image is hardcoded into the toolchain and almost certainly
# won&#039;t match any of these signatures.
&gt;(4.s*512)	long	x
&gt;&gt;&amp;(2.s-517)	byte	x
&gt;&gt;&gt;&amp;0	string		PK\3\4 \b, ZIP self-extracting archive
&gt;&gt;&gt;&amp;0	string		Rar! \b, RAR self-extracting archive
&gt;&gt;&gt;&amp;0	string		=!\x11 \b, AIN 2.x self-extracting archive
&gt;&gt;&gt;&amp;0	string		=!\x12 \b, AIN 2.x self-extracting archive
&gt;&gt;&gt;&amp;0	string		=!\x17 \b, AIN 1.x self-extracting archive
&gt;&gt;&gt;&amp;0	string		=!\x18 \b, AIN 1.x self-extracting archive
&gt;&gt;&gt;&amp;7	search/400	**ACE** \b, ACE self-extracting archive
&gt;&gt;&gt;&amp;0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive

# a few unknown ZIP sfxes, no idea if they are needed or if they are
# already captured by the generic patterns above
&gt;(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
# TODO: how to add this? &gt;FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
#

# TELVOX Teleinformatica CODEC self-extractor for OS/2:
&gt;49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
&gt;&gt;49824 leshort		=1			\b, 1 file
&gt;&gt;49824 leshort		&gt;1			\b, %u files

# added by Joerg Jenderek of http://www.freedos.org/software/?prog=kc
# and http://www.freedos.org/software/?prog=kpdos
# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
0	string/b	KCF		FreeDOS KEYBoard Layout collection
# only version=0x100 found
&gt;3	uleshort	x		\b, version 0x%x
# length of string containing author,info and special characters
&gt;6	ubyte		&gt;0
#&gt;&gt;6	pstring		x		\b, name=%s
&gt;&gt;7	string		&gt;\0		\b, author=%-.14s
&gt;&gt;7	search/254	\xff		\b, info=
#&gt;&gt;&gt;&amp;0	string		x		\b%-s
&gt;&gt;&gt;&amp;0	string		x		\b%-.15s
# for FreeDOS *.KL files
0	string/b	KLF		FreeDOS KEYBoard Layout file
# only version=0x100 or 0x101 found
&gt;3	uleshort	x		\b, version 0x%x
# stringlength
&gt;5	ubyte		&gt;0
&gt;&gt;8	string		x		\b, name=%-.2s
0	string	\xffKEYB\ \ \ \0\0\0\0
&gt;12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file

# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
0	ulequad&amp;0x07a0ffffffff		0xffffffff
&gt;0	use				msdos-driver
0       name    			msdos-driver		DOS executable (
#!:mime	application/octet-stream
!:mime	application/x-dosdriver
# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
!:ext	sys/dev/bin
&gt;40	search/7			UPX!			\bUPX compressed
# DOS device driver attributes
&gt;4	uleshort&amp;0x8000			0x0000			\bblock device driver
# character device
&gt;4	uleshort&amp;0x8000			0x8000			\b
&gt;&gt;4	uleshort&amp;0x0008			0x0008			\bclock
# fast video output by int 29h
&gt;&gt;4	uleshort&amp;0x0010			0x0010			\bfast
# standard input/output device
&gt;&gt;4	uleshort&amp;0x0003			&gt;0			\bstandard
&gt;&gt;&gt;4	uleshort&amp;0x0001			0x0001			\binput
&gt;&gt;&gt;4	uleshort&amp;0x0003			0x0003			\b/
&gt;&gt;&gt;4	uleshort&amp;0x0002			0x0002			\boutput
&gt;&gt;4	uleshort&amp;0x8000			0x8000			\bcharacter device driver
&gt;0	ubyte				x
# upx compressed device driver has garbage instead of real in name field of header
&gt;&gt;40	search/7			UPX!
&gt;&gt;40	default				x
# leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
&gt;&gt;&gt;12		ubyte			&gt;0x2E			\b
&gt;&gt;&gt;&gt;10		ubyte			&gt;0x20
&gt;&gt;&gt;&gt;&gt;10		ubyte			!0x2E
&gt;&gt;&gt;&gt;&gt;&gt;10	ubyte			!0x2A			\b%c
&gt;&gt;&gt;&gt;11		ubyte			&gt;0x20
&gt;&gt;&gt;&gt;&gt;11		ubyte			!0x2E			\b%c
&gt;&gt;&gt;&gt;12		ubyte			&gt;0x20
&gt;&gt;&gt;&gt;&gt;12		ubyte			!0x39
&gt;&gt;&gt;&gt;&gt;&gt;12	ubyte			!0x2E			\b%c
&gt;&gt;&gt;13		ubyte			&gt;0x20
&gt;&gt;&gt;&gt;13		ubyte			!0x2E			\b%c
&gt;&gt;&gt;&gt;14		ubyte			&gt;0x20
&gt;&gt;&gt;&gt;&gt;14		ubyte			!0x2E			\b%c
&gt;&gt;&gt;&gt;15		ubyte			&gt;0x20
&gt;&gt;&gt;&gt;&gt;15		ubyte			!0x2E			\b%c
&gt;&gt;&gt;&gt;16		ubyte			&gt;0x20
&gt;&gt;&gt;&gt;&gt;16		ubyte			!0x2E
&gt;&gt;&gt;&gt;&gt;&gt;16	ubyte			&lt;0xCB			\b%c
&gt;&gt;&gt;&gt;17		ubyte			&gt;0x20
&gt;&gt;&gt;&gt;&gt;17		ubyte			!0x2E
&gt;&gt;&gt;&gt;&gt;&gt;17	ubyte			&lt;0x90			\b%c
# some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
&gt;&gt;&gt;12		ubyte			&lt;0x2F
# they have their real name at offset 22
# also block device drivers like DUMBDRV.SYS
&gt;&gt;&gt;&gt;22		string			&gt;\056			%-.6s
&gt;4	uleshort&amp;0x8000			0x0000
# 32 bit sector addressing ( &gt; 32 MB) for block devices
&gt;&gt;4	uleshort&amp;0x0002			0x0002			\b,32-bit sector-
# support by driver functions 13h, 17h, 18h
&gt;4	uleshort&amp;0x0040			0x0040			\b,IOCTL-
# open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
&gt;4	uleshort&amp;0x0800			0x0800			\b,close media-
# output until busy support by int 10h for character device driver
&gt;4	uleshort&amp;0x8000			0x8000
&gt;&gt;4	uleshort&amp;0x2000			0x2000			\b,until busy-
# direct read/write support by driver functions 03h,0Ch
&gt;4	uleshort&amp;0x4000			0x4000			\b,control strings-
&gt;4	uleshort&amp;0x8000			0x8000
&gt;&gt;4	uleshort&amp;0x6840			&gt;0			\bsupport
&gt;4	uleshort&amp;0x8000			0x0000
&gt;&gt;4	uleshort&amp;0x4842			&gt;0			\bsupport
&gt;0	ubyte				x			\b)
# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
0	ulequad				0x0513c00000000012
&gt;0	use				msdos-driver
# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
0	ulequad				0x32f28000ffff0016
&gt;0	use				msdos-driver
0	ulequad				0x007f00000000ffff
&gt;0	use				msdos-driver
0	ulequad				0x001600000000ffff
&gt;0	use				msdos-driver
# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
0	ulequad				0x0bf708c2ffffffff
&gt;0	use				msdos-driver
0	ulequad				0x07bd08c2ffffffff
&gt;0	use				msdos-driver

# updated by Joerg Jenderek
# GRR: line below too general as it catches also
# rt.lib DYADISKS.PIC and many more
# start with assembler instruction MOV
0	ubyte		0x8c
# skip &quot;AppleWorks word processor data&quot; like ARTICLE.1 ./apple
&gt;4	string			!O====
# skip some unknown basic binaries like RocketRnger.SHR
&gt;&gt;5	string			!MAIN
# skip &quot;GPG symmetrically encrypted data&quot; ./gnu
# skip &quot;PGP symmetric key encrypted data&quot; ./pgp
# openpgpdefs.h: fourth byte &lt; 14 indicate cipher algorithm type
&gt;&gt;&gt;4	ubyte			&gt;13	DOS executable (COM, 0x8C-variant)
# the remaining files should be DOS *.COM executables
# dosshell.COM	8cc0 2ea35f07 e85211 e88a11 b80058 cd
# hmload.COM	8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4
# UNDELETE.COM	8cca 2e8916 6503 b430 cd21 8b 2e0200 8b
# BOOTFIX.COM	8cca 2e8916 9603 b430 cd21 8b 2e0200 8b
# RAWRITE3.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
# SHARE.COM	8cca 2e8916 d602 b430 cd21 8b 2e0200 8b
# validchr.COM	8cca 2e8916 9603 b430 cd21 8b 2e028b1e
# devload.COM	8cca 8916ad01 b430 cd21 8b2e0200 892e
!:mime	application/x-dosexec
!:ext com

# updated by Joerg Jenderek at Oct 2008
0	ulelong		0xffff10eb	DR-DOS executable (COM)
# byte 0xeb conflicts with &quot;sequent&quot; magic leshort 0xn2eb
0	ubeshort&amp;0xeb8d	&gt;0xeb00
# DR-DOS STACKER.COM SCREATE.SYS missed

0       name    msdos-com
&gt;0  byte        x               DOS executable (COM)
&gt;6	string		SFX\ of\ LHarc	\b, %s
&gt;0x1FE leshort	0xAA55		    \b, boot code
&gt;85	string		UPX		        \b, UPX compressed
&gt;4	string		\ $ARX		    \b, ARX self-extracting archive
&gt;4	string		\ $LHarc	    \b, LHarc self-extracting archive
&gt;0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive

# JMP 8bit
0	        byte	0xeb
# allow forward jumps only
&gt;1          byte    &gt;-1
# that offset must be accessible
&gt;&gt;(1.b+2)   byte    x
&gt;&gt;&gt;0        use msdos-com

# JMP 16bit
0           byte    0xe9
# forward jumps
&gt;1          short   &gt;-1
# that offset must be accessible
&gt;&gt;(1.s+3)   byte    x
&gt;&gt;&gt;0        use msdos-com
# negative offset, must not lead into PSP
&gt;1          short   &lt;-259
# that offset must be accessible
&gt;&gt;(1,s+65539)   byte    x
&gt;&gt;&gt;0        use msdos-com

# updated by Joerg Jenderek at Oct 2008,2015
# following line is too general
0	ubyte		0xb8
# skip 2 linux kernels like memtest.bin with &quot;\xb8\xc0\x07\x8e&quot; in ./linux
&gt;0	string		!\xb8\xc0\x07\x8e
# modified by Joerg Jenderek
# syslinux COM32 or COM32R executable
&gt;&gt;1	lelong&amp;0xFFFFFFFe 0x21CD4CFe	COM executable (32-bit COMBOOT
# http://www.syslinux.org/wiki/index.php/Comboot_API
# Since version 5.00 c32 modules switched from the COM32 object format to ELF
!:mime	application/x-c32-comboot-syslinux-exec
!:ext c32
# http://syslinux.zytor.com/comboot.php
# older syslinux version ( &lt;4 )
# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
# start with assembler instructions mov eax,21cd4cffh
&gt;&gt;&gt;1	lelong		0x21CD4CFf	\b)
# syslinux:doc/comboot.txt
# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
# eax,21cd4cfeh) as a magic number.
# syslinux version (4.x)
# &quot;COM executable (COM32R)&quot; or &quot;Syslinux COM32 module&quot; by TrID
&gt;&gt;&gt;1	lelong		0x21CD4CFe	\b, relocatable)
# remaining are DOS COM executables starting with assembler instruction MOV
# like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM
# MS-DOS SYS.COM RESTART.COM
# SYSLINUX.COM (version 1.40 - 2.13)
# GFXBOOT.COM (version 3.75)
# COPYBS.COM POWEROFF.COM INT18.COM
&gt;&gt;1	default	x			COM executable for DOS
!:mime	application/x-dosexec
#!:mime	application/x-ms-dos-executable
#!:mime	application/x-msdos-program
!:ext com

0	string/b	\x81\xfc
&gt;4	string	\x77\x02\xcd\x20\xb9
&gt;&gt;36	string	UPX!			FREE-DOS executable (COM), UPX compressed
252	string Must\ have\ DOS\ version DR-DOS executable (COM)
# added by Joerg Jenderek at Oct 2008
# GRR search is not working
#34	search/2	UPX!		FREE-DOS executable (COM), UPX compressed
34	string	UPX!			FREE-DOS executable (COM), UPX compressed
35	string	UPX!			FREE-DOS executable (COM), UPX compressed
# GRR search is not working
#2	search/28	\xcd\x21	COM executable for MS-DOS
#WHICHFAT.cOM
2	string	\xcd\x21		COM executable for DOS
#DELTREE.cOM DELTREE2.cOM
4	string	\xcd\x21		COM executable for DOS
#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
5	string	\xcd\x21		COM executable for DOS
#DELTMP.COm HASFAT32.cOM
7	string	\xcd\x21
&gt;0	byte	!0xb8			COM executable for DOS
#COMP.cOM MORE.COm
10	string	\xcd\x21
&gt;5	string	!\xcd\x21		COM executable for DOS
#comecho.com
13	string	\xcd\x21		COM executable for DOS
#HELP.COm EDIT.coM
18	string	\xcd\x21		COM executable for MS-DOS
#NWRPLTRM.COm
23	string	\xcd\x21		COM executable for MS-DOS
#LOADFIX.cOm LOADFIX.cOm
30	string	\xcd\x21		COM executable for MS-DOS
#syslinux.com 3.11
70	string	\xcd\x21		COM executable for DOS
# many compressed/converted COMs start with a copy loop instead of a jump
0x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
0x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
&gt;0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
0x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
# FIXME: missing diet .com compression

# miscellaneous formats
0	string/b	LZ		MS-DOS executable (built-in)
#0	byte		0xf0		MS-DOS program library data
#

# AAF files:
# &lt;stuartc@rd.bbc.co.uk&gt; Stuart Cunningham
0	string/b	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
&gt;30	byte	9		(512B sectors)
&gt;30	byte	12		(4kB sectors)
0	string/b	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
&gt;30	byte	9		(512B sectors)
&gt;30	byte	12		(4kB sectors)

# Popular applications
2080	string	Microsoft\ Word\ 6.0\ Document	%s
!:mime	application/msword
2080	string	Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
!:mime	application/msword
# Pawel Wiecek &lt;coven@i17linuxb.ists.pwr.wroc.pl&gt; (for polish Word)
2112	string	MSWordDoc			Microsoft Word document data
!:mime	application/msword
#
0	belong	0x31be0000			Microsoft Word Document
!:mime	application/msword
#
0	string/b	PO^Q`				Microsoft Word 6.0 Document
!:mime	application/msword
#
4   long        0
&gt;0  belong      0xfe320000      Microsoft Word for Macintosh 1.0
!:mime	application/msword
!:ext   mcw
&gt;0  belong      0xfe340000      Microsoft Word for Macintosh 3.0
!:mime	application/msword
!:ext   mcw
&gt;0  belong      0xfe37001c      Microsoft Word for Macintosh 4.0
!:mime	application/msword
!:ext   mcw
&gt;0  belong      0xfe370023      Microsoft Word for Macintosh 5.0
!:mime	application/msword
!:ext   mcw

0	string/b	\333\245-\0\0\0			Microsoft Word 2.0 Document
!:mime	application/msword
!:ext   doc
# Note: seems already recognized as &quot;OLE 2 Compound Document&quot; in ./ole2compounddocs
#512	string/b	\354\245\301			Microsoft Word Document
#!:mime	application/msword

#
0	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
!:mime application/msword
#
2080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
!:mime	application/vnd.ms-excel
#
0	string/b	\xDB\xA5\x2D\x00		Microsoft WinWord 2.0 Document
!:mime application/msword

2080	string	Foglio\ di\ lavoro\ Microsoft\ Exce	%s
!:mime	application/vnd.ms-excel
#
# Pawel Wiecek &lt;coven@i17linuxb.ists.pwr.wroc.pl&gt; (for polish Excel)
2114	string	Biff5		Microsoft Excel 5.0 Worksheet
!:mime	application/vnd.ms-excel
# Italian MS-Excel
2121	string	Biff5		Microsoft Excel 5.0 Worksheet
!:mime	application/vnd.ms-excel
0	string/b	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
!:mime	application/vnd.ms-excel
#
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Lotus_1-2-3
# Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
# Note: newer Lotus versions &gt;2 use longer BOF record
# record type (BeginningOfFile=0000h) + length (001Ah)
0	belong	0x00001a00
# reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&amp;G86.WK3
#&gt;18	uleshort&amp;0x73E0	0
# Lotus Multi Byte Character Set (LMBCS=1-31)
&gt;20	ubyte		&gt;0
&gt;&gt;20	ubyte		&lt;32	Lotus 1-2-3
#!:mime	application/x-123
!:mime	application/vnd.lotus-1-2-3
!:apple	????L123
# (version 5.26) labeled the entry as &quot;Lotus 1-2-3 wk3 document data&quot;
&gt;&gt;&gt;4	uleshort	0x1000	WorKsheet, version 3
!:ext	wk3
# (version 5.26) labeled the entry as &quot;Lotus 1-2-3 wk4 document data&quot;
&gt;&gt;&gt;4	uleshort	0x1002	WorKsheet, version 4
# also worksheet template 4 (.wt4)
!:ext	wk4/wt4
# no example or documentation for wk5
#&gt;&gt;4	uleshort	0x????	WorKsheet, version 4
#!:ext	wk5
# only MacrotoScript.123 example
&gt;&gt;&gt;4	uleshort	0x1003	WorKsheet, version 97
# also worksheet template Smartmaster (.12M)?
!:ext	123
# only Set_Y2K.123 example
&gt;&gt;&gt;4	uleshort	0x1005	WorKsheet, version 9.8 Millennium
!:ext	123
# no example for this version
&gt;&gt;&gt;4	uleshort	0x8001	FoRMatting data
!:ext	frm
# (version 5.26) labeled the entry as &quot;Lotus 1-2-3 fm3 or fmb document data&quot;
# TrID labeles the entry as &quot;Formatting Data for Lotus 1-2-3 worksheet&quot;
&gt;&gt;&gt;4	uleshort	0x8007	ForMatting data, version 3
!:ext	fm3
&gt;&gt;&gt;4	default		x	unknown
# file revision sub code 0004h for worksheets
&gt;&gt;&gt;&gt;6	uleshort	=0x0004	worksheet
!:ext	wXX
&gt;&gt;&gt;&gt;6	uleshort	!0x0004	formatting data
!:ext	fXX
# main revision number
&gt;&gt;&gt;&gt;4	uleshort	x	\b, revision 0x%x
&gt;&gt;&gt;6	uleshort	=0x0004	\b, cell range
# active cellcoord range (start row, page,column ; end row, page, column)
# start values normally 0~1st sheet A1
&gt;&gt;&gt;&gt;8	ulelong		!0
&gt;&gt;&gt;&gt;&gt;10	ubyte		&gt;0	\b%d*
&gt;&gt;&gt;&gt;&gt;8	uleshort	x	\b%d,
&gt;&gt;&gt;&gt;&gt;11	ubyte		x	\b%d-
# end page mostly 0
&gt;&gt;&gt;&gt;14	ubyte		&gt;0	\b%d*
# end raw, column normally not 0
&gt;&gt;&gt;&gt;12	uleshort	x	\b%d,
&gt;&gt;&gt;&gt;15	ubyte		x	\b%d
# Lotus Multi Byte Character Set (1~cp850,2~cp851,...,16~japan,...,31~??)
&gt;&gt;&gt;&gt;20	ubyte		&gt;1	\b, character set 0x%x
# flags
&gt;&gt;&gt;&gt;21	ubyte		x	\b, flags 0x%x
&gt;&gt;&gt;6	uleshort	!0x0004
# record type (FONTNAME=00AEh)
&gt;&gt;&gt;&gt;30	search/29	\0\xAE
# variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
&gt;&gt;&gt;&gt;&gt;&amp;4	string		&gt;\0	\b, 1st font &quot;%s&quot;
#
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Lotus_1-2-3
# Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
# Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
# record type (BeginningOfFile=0000h) + length (0002h)
0	belong	0x00000200
# GRR: line above is too general as it catches also MS Windows CURsor
# to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
!:strength -1
# skip Windows cursors with image height &lt;256 and keep Lotus with low opcode 0001-0083h
&gt;7	ubyte		0
# skip Windows cursors with image width 256 and keep Lotus with positiv opcode
&gt;&gt;6	ubyte		&gt;0	Lotus
# !:mime	application/x-123
!:mime	application/vnd.lotus-1-2-3
!:apple	????L123
# revision number (0404h = 123 1A, 0405h = Lotus Symphony , 0406h = 123 2.x wk1 , 8006h = fmt , ...)
# undocumented; (version 5.26) labeled the configurations as &quot;Lotus 1-2-3&quot;
&gt;&gt;&gt;4	uleshort	0x0007	1-2-3 CoNFiguration, version 2.x (PGRAPH.CNF)
!:ext	cnf
&gt;&gt;&gt;4	uleshort	0x0C05	1-2-3 CoNFiguration, version 2.4J
!:ext	cnf
&gt;&gt;&gt;4	uleshort	0x0801	1-2-3 CoNFiguration, version 1-2.1
!:ext	cnf
&gt;&gt;&gt;4	uleshort	0x0802	Symphony CoNFiguration
!:ext	cnf
&gt;&gt;&gt;4	uleshort	0x0804	1-2-3 CoNFiguration, version 2.2
!:ext	cnf
&gt;&gt;&gt;4	uleshort	0x080A	1-2-3 CoNFiguration, version 2.3-2.4
!:ext	cnf
&gt;&gt;&gt;4	uleshort	0x1402	1-2-3 CoNFiguration, version 3.x
!:ext	cnf
&gt;&gt;&gt;4	uleshort	0x1450	1-2-3 CoNFiguration, version 4.x
!:ext	cnf
# (version 5.26) labeled the entry as &quot;Lotus 123&quot;
# TrID labeles the entry as &quot;Lotus 123 Worksheet (generic)&quot;
&gt;&gt;&gt;4	uleshort	0x0404	1-2-3 WorKSheet, version 1
# extension &quot;wks&quot; also for Microsoft Works document
!:ext	wks
# (version 5.26) labeled the entry as &quot;Lotus 123&quot;
# TrID labeles the entry as &quot;Lotus 123 Worksheet (generic)&quot;
&gt;&gt;&gt;4	uleshort	0x0405	Symphony WoRksheet, version 1.0
!:ext	wrk/wr1
# (version 5.26) labeled the entry as &quot;Lotus 1-2-3 wk1 document data&quot;
# TrID labeles the entry as &quot;Lotus 123 Worksheet (V2)&quot;
&gt;&gt;&gt;4	uleshort	0x0406	1-2-3/Symphony worksheet, version 2
# Symphony (.wr1)
!:ext	wk1/wr1
# no example for this japan version
&gt;&gt;&gt;4	uleshort	0x0600	1-2-3 WorKsheet, version 1.xJ
!:ext	wj1
# no example or documentation for wk2
#&gt;&gt;&gt;4	uleshort	0x????	1-2-3 WorKsheet, version 2
#!:ext	wk2
# undocumented japan version
&gt;&gt;&gt;4	uleshort	0x0602	1-2-3 worksheet, version 2.4J
!:ext	wj3
# (version 5.26) labeled the entry as &quot;Lotus 1-2-3 fmt document data&quot;
&gt;&gt;&gt;4	uleshort	0x8006	1-2-3 ForMaTting data, version 2.x
# japan version 2.4J (fj3)
!:ext	fmt/fj3
# no example for this version
&gt;&gt;&gt;4	uleshort	0x8007	1-2-3 FoRMatting data, version 2.0
!:ext	frm
# (version 5.26) labeled the entry as &quot;Lotus 1-2-3&quot;
&gt;&gt;&gt;4	default		x	unknown worksheet or configuration
!:ext	cnf
&gt;&gt;&gt;&gt;4	uleshort	x	\b, revision 0x%x
# 2nd record for most worksheets describes cells range
&gt;&gt;&gt;6		use	lotus-cells
# 3nd record for most japan worksheets describes cells range
&gt;&gt;&gt;(8.s+10)	use	lotus-cells
#	check and then display Lotus worksheet cells range
0	name		lotus-cells
# look for type (RANGE=0006h) + length (0008h) at record begin
&gt;0	ubelong	0x06000800	\b, cell range
# cell range (start column, row, end column, row) start values normally 0,0~A1 cell
&gt;&gt;4	ulong		!0
&gt;&gt;&gt;4	uleshort	x	\b%d,
&gt;&gt;&gt;6	uleshort	x	\b%d-
# end of cell range
&gt;&gt;8	uleshort	x	\b%d,
&gt;&gt;10	uleshort	x	\b%d
# EndOfLotus123
0	string/b		WordPro\0	Lotus WordPro
!:mime	application/vnd.lotus-wordpro
0	string/b		WordPro\r\373	Lotus WordPro
!:mime	application/vnd.lotus-wordpro


# Summary: Script used by InstallScield to uninstall applications
# Extension: .isu
# Submitted by: unknown
# Modified by (1): Abel Cheung &lt;abelcheung@gmail.com&gt; (replace useless entry)
0		string		\x71\xa8\x00\x00\x01\x02
&gt;12		string		Stirling\ Technologies,		InstallShield Uninstall Script

# Winamp .avs
#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032 A plug in for Winamp ms-windows Freeware media player
0	string/b	Nullsoft\ AVS\ Preset\ 	Winamp plug in

# Windows Metafont .WMF
0	string/b	\327\315\306\232	ms-windows metafont .wmf
0	string/b	\002\000\011\000	ms-windows metafont .wmf
0	string/b	\001\000\011\000	ms-windows metafont .wmf

#tz3 files whatever that is (MS Works files)
0	string/b	\003\001\001\004\070\001\000\000	tz3 ms-works file
0	string/b	\003\002\001\004\070\001\000\000	tz3 ms-works file
0	string/b	\003\003\001\004\070\001\000\000	tz3 ms-works file

# PGP sig files .sig
#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig

# windows zips files .dmf
0	string/b	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file


#ico files
0	string/b	\102\101\050\000\000\000\056\000\000\000\000\000\000\000	Icon for MS Windows

# Windows icons
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
0   belong  0x00000100
&gt;9  byte    0
&gt;&gt;0 byte    x
&gt;&gt;0 use     cur-ico-dir
&gt;9  ubyte   0xff
&gt;&gt;0 byte    x
&gt;&gt;0 use     cur-ico-dir
#	displays number of icons and information for icon or cursor
0	name		cur-ico-dir
# skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
# 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
&gt;18		ulelong		&amp;0x00000006
# skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
&gt;&gt;(18.l)	ulelong		x		MS Windows
&gt;&gt;&gt;0		ubelong		0x00000100	icon resource
#!:mime		image/vnd.microsoft.icon
!:mime		image/x-icon
!:ext		ico
&gt;&gt;&gt;&gt;4 		uleshort	x		- %d icon
# plural s
&gt;&gt;&gt;&gt;4 		uleshort	&gt;1		\bs
# 1st icon
&gt;&gt;&gt;&gt;0x06	use		ico-entry
# 2nd icon
&gt;&gt;&gt;&gt;4 		uleshort	&gt;1
&gt;&gt;&gt;&gt;&gt;0x16	use		ico-entry
&gt;&gt;&gt;0		ubelong		0x00000200	cursor resource
#!:mime		image/x-cur
!:mime		image/x-win-bitmap
!:ext		cur
&gt;&gt;&gt;&gt;4 		uleshort	x		- %d icon
&gt;&gt;&gt;&gt;4 		uleshort	&gt;1		\bs
# 1st cursor
&gt;&gt;&gt;&gt;0x06	use		cur-entry
#&gt;&gt;&gt;&gt;0x16	use		cur-entry
#	display information of one cursor entry
0	name		cur-entry
&gt;0	use		cur-ico-entry
&gt;4	uleshort	x	\b, hotspot @%dx
&gt;6	uleshort	x	\b%d
#	display information of one icon entry
0	name		ico-entry
&gt;0			use	cur-ico-entry
# normally 0 1 but also found 14
&gt;4	uleshort	&gt;1	\b, %d planes
# normally 0 1 but also found some 3, 4, some 6, 8, 24, many 32, two 256
&gt;6	uleshort	&gt;1	\b, %d bits/pixel
#	display shared information of cursor or icon entry
0		name		cur-ico-entry
&gt;0		byte		=0		\b, 256x
&gt;0		byte		!0		\b, %dx
&gt;1		byte        	=0		\b256
&gt;1		byte        	!0		\b%d
# number of colors in palette
&gt;2		ubyte		!0		\b, %d colors
# reserved 0 FFh
#&gt;3		ubyte        	x		\b, reserved %x
#&gt;8		ulelong		x		\b, image size %d
# offset of PNG or DIB image
#&gt;12		ulelong		x		\b, offset 0x%x
# PNG header (\x89PNG)
&gt;(12.l)		ubelong		=0x89504e47
&gt;&gt;&amp;-4		indirect	x	\b with
# DIB image
&gt;(12.l)		ubelong		!0x89504e47
#&gt;&gt;&amp;-4		use     	dib-image

# Windows non-animated cursors
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/CUR_(file_format)
# Note: similar to Windows ICOn. container for BMP ( only DIB part)
# GRR: line below is too general as it catches also Lotus 1-2-3 files
0   belong  0x00000200
&gt;9  byte    0
&gt;&gt;0 use     cur-ico-dir
&gt;9  ubyte   0xff
&gt;&gt;0 use     cur-ico-dir

# .chr files
0	string/b	PK\010\010BGI	Borland font
&gt;4	string	&gt;\0	%s
# then there is a copyright notice


# .bgi files
0	string/b	pk\010\010BGI	Borland device
&gt;4	string	&gt;\0	%s
# then there is a copyright notice


# Windows Recycle Bin record file (named INFO2)
# By Abel Cheung (abelcheung AT gmail dot com)
# Version 4 always has 280 bytes (0x118) per record, version 5 has 800 bytes
# Since Vista uses another structure, INFO2 structure probably won&#039;t change
# anymore. Detailed analysis in:
# http://www.cybersecurityinstitute.biz/downloads/INFO2.pdf
0	lelong		0x00000004
&gt;12	lelong		0x00000118	Windows Recycle Bin INFO2 file (Win98 or below)

0	lelong		0x00000005
&gt;12	lelong		0x00000320	Windows Recycle Bin INFO2 file (Win2k - WinXP)

# From Doug Lee via a FreeBSD pr
9	string		GERBILDOC	First Choice document
9	string		GERBILDB	First Choice database
9	string		GERBILCLIP	First Choice database
0	string		GERBIL		First Choice device file
9	string		RABBITGRAPH	RabbitGraph file
0	string		DCU1		Borland Delphi .DCU file
0	string		=!&lt;spell&gt;	MKS Spell hash list (old format)
0	string		=!&lt;spell2&gt;	MKS Spell hash list
# Too simple - MPi
#0	string		AH		Halo(TM) bitmapped font file
0	lelong		0x08086b70	TurboC BGI file
0	lelong		0x08084b50	TurboC Font file

# Debian#712046: The magic below identifies &quot;Delphi compiled form data&quot;.
# An additional source of information is available at:
# http://www.woodmann.com/fravia/dafix_t1.htm
0	string		TPF0
&gt;4	pstring		&gt;\0		Delphi compiled form &#039;%s&#039;

# tests for DBase files moved, updated and merged to database

0	string		PMCC		Windows 3.x .GRP file
1	string		RDC-meg		MegaDots
&gt;8	byte		&gt;0x2F		version %c
&gt;9	byte		&gt;0x2F		\b.%c file
0	lelong		0x4C
&gt;4	lelong		0x00021401	Windows shortcut file

# .PIF files added by Joerg Jenderek from http://smsoft.ru/en/pifdoc.htm
# only for windows versions equal or greater 3.0
0x171	string	MICROSOFT\ PIFEX\0	Windows Program Information File
!:mime	application/x-dosexec
#&gt;2	string	 	&gt;\0		\b, Title:%.30s
&gt;0x24	string		&gt;\0		\b for %.63s
&gt;0x65	string		&gt;\0		\b, directory=%.64s
&gt;0xA5	string		&gt;\0		\b, parameters=%.64s
#&gt;0x181	leshort	x	\b, offset %x
#&gt;0x183	leshort	x	\b, offsetdata %x
#&gt;0x185	leshort	x	\b, section length %x
&gt;0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
&gt;&gt;&amp;0x5e		ubyte	&gt;0
&gt;&gt;&gt;&amp;-1		string	&lt;PIFMGR.DLL		\b, icon=%s
#&gt;&gt;&gt;&amp;-1		string	PIFMGR.DLL		\b, icon=%s
&gt;&gt;&gt;&amp;-1		string	&gt;PIFMGR.DLL		\b, icon=%s
&gt;&gt;&amp;0xF0		ubyte	&gt;0
&gt;&gt;&gt;&amp;-1		string	&lt;Terminal		\b, font=%.32s
#&gt;&gt;&gt;&amp;-1		string	=Terminal		\b, font=%.32s
&gt;&gt;&gt;&amp;-1		string	&gt;Terminal		\b, font=%.32s
&gt;&gt;&amp;0x110	ubyte	&gt;0
&gt;&gt;&gt;&amp;-1		string	&lt;Lucida\ Console	\b, TrueTypeFont=%.32s
#&gt;&gt;&gt;&amp;-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
&gt;&gt;&gt;&amp;-1		string	&gt;Lucida\ Console	\b, TrueTypeFont=%.32s
#&gt;0x187	search/0xB55	WINDOWS\ 286\ 3.0\0	\b, Windows 3.X standard mode-style
#&gt;0x187	search/0xB55	WINDOWS\ 386\ 3.0\0	\b, Windows 3.X enhanced mode-style
&gt;0x187	search/0xB55	WINDOWS\ NT\ \ 3.1\0	\b, Windows NT-style
#&gt;0x187	search/0xB55	WINDOWS\ NT\ \ 4.0\0	\b, Windows NT-style
&gt;0x187	search/0xB55	CONFIG\ \ SYS\ 4.0\0	\b +CONFIG.SYS
#&gt;&gt;&amp;06		string	x			\b:%s
&gt;0x187	search/0xB55	AUTOEXECBAT\ 4.0\0	\b +AUTOEXEC.BAT
#&gt;&gt;&amp;06		string	x			\b:%s

# DOS EPS Binary File Header
# From: Ed Sznyter &lt;ews@Black.Market.NET&gt;
0	belong		0xC5D0D3C6	DOS EPS Binary File
!:mime	image/x-eps
&gt;4	long		&gt;0		Postscript starts at byte %d
&gt;&gt;8	long		&gt;0		length %d
&gt;&gt;&gt;12	long		&gt;0		Metafile starts at byte %d
&gt;&gt;&gt;&gt;16	long		&gt;0		length %d
&gt;&gt;&gt;20	long		&gt;0		TIFF starts at byte %d
&gt;&gt;&gt;&gt;24	long		&gt;0		length %d

# TNEF magic From &quot;Joomy&quot; &lt;joomy@se-ed.net&gt;
# Microsoft Outlook&#039;s Transport Neutral Encapsulation Format (TNEF)
0	lelong		0x223e9f78	TNEF
!:mime	application/vnd.ms-tnef

# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
# of http://www.davep.org/norton-guides/ng2h-105.tgz
# http://en.wikipedia.org/wiki/Norton_Guides
0	string		NG\0\001
# only value 0x100 found at offset 2
&gt;2	ulelong		0x00000100	Norton Guide
# Title[40]
&gt;&gt;8	string		&gt;\0		&quot;%-.40s&quot;
#&gt;&gt;6	uleshort	x		\b, MenuCount=%u
# szCredits[5][66]
&gt;&gt;48	string		&gt;\0		\b, %-.66s
&gt;&gt;114	string		&gt;\0		%-.66s

# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
# of http://www.4dos.info/
# pointer,HelpID[8]=4DHnnnmm
0	ulelong	0x48443408		4DOS help file
&gt;4	string	x			\b, version %-4.4s

# old binary Microsoft (.HLP) files added by Joerg Jenderek from http://file-extension.net/seeker/file_extension_hlp
0	ulequad	0x3a000000024e4c	MS Advisor help file

# HtmlHelp files (.chm)
0	string/b	ITSF\003\000\000\000\x60\000\000\000	MS Windows HtmlHelp Data

# GFA-BASIC (Wolfram Kleff)
2	string/b	GFA-BASIC3	GFA-BASIC 3 data

#------------------------------------------------------------------------------
# From Stuart Caie &lt;kyzer@4u.net&gt; (developer of cabextract)
# Microsoft Cabinet files
0	string/b	MSCF\0\0\0\0	Microsoft Cabinet archive data
!:mime application/vnd.ms-cab-compressed
&gt;8	lelong		x		\b, %u bytes
&gt;28	leshort		1		\b, 1 file
&gt;28	leshort		&gt;1		\b, %u files

# InstallShield Cabinet files
0	string/b	ISc(		InstallShield Cabinet archive data
&gt;5	byte&amp;0xf0	=0x60		version 6,
&gt;5	byte&amp;0xf0	!0x60		version 4/5,
&gt;(12.l+40)	lelong	x		%u files

# Windows CE package files
0	string/b	MSCE\0\0\0\0	Microsoft WinCE install header
&gt;20	lelong		0		\b, architecture-independent
&gt;20	lelong		103		\b, Hitachi SH3
&gt;20	lelong		104		\b, Hitachi SH4
&gt;20	lelong		0xA11		\b, StrongARM
&gt;20	lelong		4000		\b, MIPS R4000
&gt;20	lelong		10003		\b, Hitachi SH3
&gt;20	lelong		10004		\b, Hitachi SH3E
&gt;20	lelong		10005		\b, Hitachi SH4
&gt;20	lelong		70001		\b, ARM 7TDMI
&gt;52	leshort		1		\b, 1 file
&gt;52	leshort		&gt;1		\b, %u files
&gt;56	leshort		1		\b, 1 registry entry
&gt;56	leshort		&gt;1		\b, %u registry entries


# Windows Enhanced Metafile (EMF)
# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
# for further information.
0	ulelong 1
&gt;40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
&gt;&gt;44	ulelong x		version 0x%x


0	string/b	\224\246\056		Microsoft Word Document
!:mime	application/msword

512	string	R\0o\0o\0t\0\ \0E\0n\0t\0r\0y	Microsoft Word Document
!:mime	application/msword

# From: &quot;Nelson A. de Oliveira&quot; &lt;naoliv@gmail.com&gt;
# Magic type for Dell&#039;s BIOS .hdr files
# Dell&#039;s .hdr
0	string/b $RBU
&gt;23	string Dell			%s system BIOS
&gt;5	byte   2
&gt;&gt;48	byte   x			version %d.
&gt;&gt;49	byte   x			\b%d.
&gt;&gt;50	byte   x			\b%d
&gt;5	byte   &lt;2
&gt;&gt;48	string x			version %.3s

# Type: Microsoft DirectDraw Surface
# URL:	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/directx9_c/directx/graphics/reference/DDSFileReference/ddsfileformat.asp
# From: Morten Hustveit &lt;morten@debian.org&gt;
0	string/b	DDS\040\174\000\000\000 Microsoft DirectDraw Surface (DDS),
&gt;16	lelong	&gt;0			%d x
&gt;12	lelong	&gt;0			%d,
&gt;84	string	x			%.4s

# Type: Microsoft Document Imaging Format (.mdi)
# URL:	http://en.wikipedia.org/wiki/Microsoft_Document_Imaging_Format
# From: Daniele Sempione &lt;scrows@oziosi.org&gt;
# Too weak (EP)
#0	short	0x5045			Microsoft Document Imaging Format

# MS eBook format (.lit)
0	string/b	ITOLITLS		Microsoft Reader eBook Data
&gt;8	lelong	x			\b, version %u
!:mime					application/x-ms-reader

# Windows CE Binary Image Data Format
# From: Dr. Jesus &lt;j@hug.gs&gt;
0	string/b	B000FF\n	Windows Embedded CE binary image

# Windows Imaging (WIM) Image
0	string/b	MSWIM\000\000\000	Windows imaging (WIM) image
0	string/b	WLPWM\000\000\000	Windows imaging (WIM) image, wimlib pipable format

# The second byte of these signatures is a file version; I don&#039;t know what,
# if anything, produced files with version numbers 0-2.
# From: John Elliott &lt;johne@seasip.demon.co.uk&gt;
0	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
0	string	\xfc\x04\x00	Mallard BASIC program data (v1.29+)
0	string	\xfc\x03\x01	Mallard BASIC protected program data (v1.11)
0	string	\xfc\x04\x01	Mallard BASIC protected program data (v1.29+)

0	string	MIOPEN		Mallard BASIC Jetsam data
0	string	Jetsam0		Mallard BASIC Jetsam index data

# DOS backup 2.0 to 3.2

# backupid.@@@

# plausibility check for date
0x3	ushort	&gt;1979
&gt;0x5	ubyte-1 &lt;31
&gt;&gt;0x6	ubyte-1 &lt;12
# actually 121 nul bytes
&gt;&gt;&gt;0x7	string	\0\0\0\0\0\0\0\0
&gt;&gt;&gt;&gt;0x1 ubyte	x	DOS 2.0 backup id file, sequence %d
!:ext @@@
&gt;&gt;&gt;&gt;0x0 ubyte	0xff	\b, last disk

# backed up file

# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
# by looking for trailing nul of maximal file name string
0x52	ubyte	0	
# test for flag byte: FFh~complete file, 00h~split file
# FFh -127 =	-1 -127 =	-128
# 00h -127 =	 0 -127 =	-127
&gt;0	byte-127	&lt;-126
# plausibility check for file name length
&gt;&gt;0x53	ubyte-1	&lt;78	
# looking for terminating nul of file name string
&gt;&gt;&gt;(0x53.b+4)	ubyte	0	
# looking if last char of string is valid DOS file name
&gt;&gt;&gt;&gt;(0x53.b+3)	ubyte	&gt;0x1F	
# actually 44 nul bytes
# but sometimes garbage according to Ralf Quint. So can not be used as test
#&gt;0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 
&gt;&gt;&gt;&gt;&gt;5	ubyte&amp;0x8C	0x0C	
# ./msdos (version 5.30) labeled the entry as
# &quot;DOS 2.0 backed up file %s, split file, sequence %d&quot; or
# &quot;DOS 2.0 backed up file %s, complete file&quot;
&gt;&gt;&gt;&gt;&gt;&gt;0	ubyte	x	DOS 2.0-3.2 backed up
#&gt;&gt;&gt;&gt;&gt;&gt;0	ubyte	0xff	complete
&gt;&gt;&gt;&gt;&gt;&gt;0	ubyte	0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;1 uleshort	x	sequence %d of
# full file name with path but without drive letter and colon stored from 0x05 til 0x52
&gt;&gt;&gt;&gt;&gt;&gt;0x5	string	x	file %s
# backup name is original filename
#!:ext	*
# magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *&#039; has bad char &#039;*&#039;
# file: line 1169: Bad magic entry &#039;  *&#039;
# after header original file content
&gt;&gt;&gt;&gt;&gt;&gt;128	indirect x	\b; 


# DOS backup 3.3 to 5.x

# CONTROL.nnn files
0	string	\x8bBACKUP\x20
# actually 128 nul bytes
&gt;0xa	string	\0\0\0\0\0\0\0\0
&gt;&gt;0x9	ubyte	x	DOS 3.3 backup control file, sequence %d
&gt;&gt;0x8a	ubyte	0xff	\b, last disk

# NB: The BACKUP.nnn files consist of the files backed up,
# concatenated.

#------------------------------------------------------------------------------
# $File: msooxml,v 1.7 2018/03/12 12:38:59 christos Exp $
# msooxml:  file(1) magic for Microsoft Office XML
# From: Ralf Brown &lt;ralf.brown@gmail.com&gt;

# .docx, .pptx, and .xlsx are XML plus other files inside a ZIP
#   archive.  The first member file is normally &quot;[Content_Types].xml&quot;.
#   but some libreoffice generated files put this later. Perhaps skip
#   the &quot;[Content_Types].xml&quot; test?
# Since MSOOXML doesn&#039;t have anything like the uncompressed &quot;mimetype&quot;
#   file of ePub or OpenDocument, we&#039;ll have to scan for a filename
#   which can distinguish between the three types

0		name		msooxml
&gt;0		string		word/		Microsoft Word 2007+
!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document
&gt;0		string		ppt/		Microsoft PowerPoint 2007+
!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation
&gt;0		string		xl/		Microsoft Excel 2007+
!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

# start by checking for ZIP local file header signature
0		string		PK\003\004
!:strength +10
# make sure the first file is correct
&gt;0x1E		regex		\\[Content_Types\\]\\.xml|_rels/\\.rels
# skip to the second local file header
# since some documents include a 520-byte extra field following the file
# header, we need to scan for the next header
&gt;&gt;(18.l+49)	search/6000	PK\003\004
# now skip to the *third* local file header; again, we need to scan due to a
# 520-byte extra field following the file header
&gt;&gt;&gt;&amp;26		search/6000	PK\003\004
# and check the subdirectory name to determine which type of OOXML
# file we have.  Correct the mimetype with the registered ones:
# http://technet.microsoft.com/en-us/library/cc179224.aspx
&gt;&gt;&gt;&gt;&amp;26		use		msooxml	
&gt;&gt;&gt;&gt;&amp;26		default		x
# OpenOffice/Libreoffice orders ZIP entry differently, so check the 4th file
&gt;&gt;&gt;&gt;&gt;&amp;26	search/6000	PK\003\004
&gt;&gt;&gt;&gt;&gt;&gt;&amp;26	use		msooxml	
&gt;&gt;&gt;&gt;&gt;&gt;&amp;26	default		x		Microsoft OOXML

#------------------------------------------------------------------------------
# $File: msvc,v 1.9 2017/08/02 08:15:20 christos Exp $
# msvc:  file(1) magic for msvc
# &quot;H. Nanosecond&quot; &lt;aldomel@ix.netcom.com&gt;
# Microsoft visual C
#
# I have version 1.0

# .aps
0	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file

# .ide
#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide

# .res
0	string	\000\000\000\000\040\000\000\000\377	MSVC .res
0	string	\377\003\000\377\001\000\020\020\350	MSVC .res
0	string	\377\003\000\377\001\000\060\020\350	MSVC .res

#.lib
0	string	\360\015\000\000	Microsoft Visual C library
0	string	\360\075\000\000	Microsoft Visual C library
0	string	\360\175\000\000	Microsoft Visual C library

#.pch
0	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch

# Summary: Symbol Table / Debug info used by Microsoft compilers
# URL: https://en.wikipedia.org/wiki/Program_database
# Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format
# Update: Joerg Jenderek
# Note:	test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86
#	info does only applies partly for older files like msvbvm50.pdb about year 2001
0	string	Microsoft\ C/C++\040
# &quot;Microsoft Program DataBase&quot; by TrID
&gt;24	search/14	\r\n\x1A	MSVC program database
!:mime	application/x-ms-pdb
!:ext	pdb
# &quot;MSF 7.00&quot; &quot;program database 2.00&quot; for msvbvm50.pdb
&gt;&gt;16	regex	\([0-9.]+\)	ver %s
#&gt;&gt;&gt;0x38	search/128123456	/LinkInfo	\b with linkinfo
# &quot;MSF 7.00&quot; variant
&gt;&gt;0x1e	leshort	0
# PageSize 400h 1000h
&gt;&gt;&gt;0x20	lelong	x	\b, %d
# Page Count
&gt;&gt;&gt;0x28	lelong	x	\b*%d bytes
# &quot;program database 2.00&quot;  variant
&gt;&gt;0x1e	leshort	!0
# PageSize 400h
&gt;&gt;&gt;0x2c	lelong	x	\b, %d
# Page Count for msoo-dll.pdb 4379h
&gt;&gt;&gt;0x32	leshort	x	\b*%d bytes

# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d
0       string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0     Microsoft Rosyln C# debugging symbols version 1.0

#.sbr
0	string	\000\002\000\007\000	MSVC .sbr
&gt;5	string 	&gt;\0	%s

#.bsc
0	string	\002\000\002\001	MSVC .bsc

#.wsp
0	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
# these seem to start with the version and contain menus

#------------------------------------------------------------------------------
# msx:  file(1) magic for the MSX Home Computer
# v1.3
# Fabio R. Schmidlin &lt;sd-snatcher@users.sourceforge.net&gt;

############## MSX Music file formats ##############

# Gigamix MGSDRV music file
0	string/b		MGS	MSX Gigamix MGSDRV3 music file,
&gt;6	ubeshort	0x0D0A
&gt;&gt;3	byte		x	\bv%c
&gt;&gt;4	byte		x	\b.%c
&gt;&gt;5	byte		x	\b%c
&gt;&gt;8	string		&gt;\0	\b, title: %s

1	string/b		mgs2\ 	MSX Gigamix MGSDRV2 music file
&gt;6	uleshort	0x80
&gt;&gt;0x2E	uleshort	0
&gt;&gt;&gt;0x30	string		&gt;\0	\b, title: %s

# KSS music file
0	string/b		KSCC	KSS music file v1.03
&gt;0xE	byte		0
&gt;&gt;0xF	byte&amp;0x02	0	\b, soundchips: AY-3-8910, SCC(+)
&gt;&gt;0xF	byte&amp;0x02	2	\b, soundchip(s): SN76489
&gt;&gt;&gt;0xF	byte&amp;0x04	4	stereo
&gt;&gt;0xF	byte&amp;0x01	1	\b, YM2413
&gt;&gt;0xF	byte&amp;0x08	8	\b, Y8950

0	string/b		KSSX	KSS music file v1.20
&gt;0xE	byte&amp;0xEF	0
&gt;&gt;0xF	byte&amp;0x40	0x00	\b, 60Hz
&gt;&gt;0xF	byte&amp;0x40	0x40	\b, 50Hz
&gt;&gt;0xF	byte&amp;0x02	0	\b, soundchips: AY-3-8910, SCC(+)
&gt;&gt;0xF	byte&amp;0x02	0x02	\b, soundchips: SN76489
&gt;&gt;&gt;0xF	byte&amp;0x04	0x04	stereo
&gt;&gt;0xF	byte&amp;0x01	0x01	\b,
&gt;&gt;&gt;0xF	byte&amp;0x18	0x00	\bYM2413
&gt;&gt;&gt;0xF	byte&amp;0x18	0x08	\bYM2413, Y8950
&gt;&gt;&gt;0xF	byte&amp;0x18	0x18	\bYM2413+Y8950 pseudostereo
&gt;&gt;0xF	byte&amp;0x18	0x10	\b, Majyutsushi DAC

# Moonblaster for Moonsound
0	string/b		MBMS
&gt;4	byte		0x10	MSX Moonblaster for MoonSound music

# Music Player K-kaz
0	string/b		MPK	MSX Music Player K-kaz song
&gt;6	ubeshort	0x0D0A
&gt;&gt;3	byte		x	v%c
&gt;&gt;4	byte		x	\b.%c
&gt;&gt;5	byte		x	\b%c

# I don&#039;t know why these don&#039;t work
#0	search/0xFFFF	\r\n.FM9
#&gt;0	search/0xFFFF	\r\n#FORMAT	MSX Music Player K-kaz source MML file
#0	search/0xFFFF	\r\nFM1\ \=
#&gt;0	search/0xFFFF	\r\nPSG1\=
#&gt;&gt;0	search/0xFFFF	\r\nSCC1\=		MSX MuSiCa MML source file

# OPX Music file
0x35	beshort		0x0d0a
&gt;0x7B	beshort		0x0d0a
&gt;&gt;0x7D	byte		0x1a
&gt;&gt;&gt;0x87	uleshort	0		MSX OPX Music file
&gt;&gt;&gt;&gt;0x86	byte		0		v1.5
&gt;&gt;&gt;&gt;&gt;0	string		&gt;\32		\b, title: %s
&gt;&gt;&gt;&gt;0x86	byte		1		v2.4
&gt;&gt;&gt;&gt;&gt;0	string		&gt;\32		\b, title: %s

# SCMD music file
0x8B	string/b		SCMD
&gt;0xCE	uleshort	0	MSX SCMD Music file
#&gt;&gt;-2	uleshort	0x6a71	; The file must end with this value. How to code this here?
&gt;&gt;0x8F	string		&gt;\0		\b, title: %s

0	search/0xFFFF	\r\n@title
&gt;&amp;0	search/0xFFFF	\r\n@m=[	MSX SCMD source MML file


############## MSX image file formats ##############

# MSX raw VRAM dump
0	ubyte		0xFE
&gt;1	uleshort	0
&gt;&gt;5	uleshort	0
&gt;&gt;&gt;3	uleshort	0x37FF		MSX SC2/GRP raw image
&gt;&gt;&gt;3	uleshort	0x6A00		MSX Graph Saurus SR5 raw image
&gt;&gt;&gt;3	uleshort	&gt;0x769E
&gt;&gt;&gt;&gt;3	uleshort	&lt;0x8000		MSX GE5/GE6 raw image
&gt;&gt;&gt;&gt;&gt;3	uleshort	0x7FFF		\b, with sprite patterns
&gt;&gt;&gt;3	uleshort	0xD3FF		MSX screen 7-12 raw image
&gt;&gt;&gt;3	uleshort	0xD400		MSX Graph Saurus SR7/SR8/SRS raw image

# Graph Saurus compressed images
0	ubyte		0xFD
&gt;1	uleshort	0
&gt;&gt;5	uleshort	0
&gt;&gt;&gt;3	uleshort	&gt;0x013D		MSX Graph Saurus compressed image

# MSX G9B image file
0	string/b		G9B
&gt;1	uleshort	11
&gt;&gt;3	uleshort	&gt;10
&gt;&gt;&gt;5	ubyte		&gt;0		MSX G9B image, depth=%d
&gt;&gt;&gt;&gt;8	uleshort	x		\b, %dx
&gt;&gt;&gt;&gt;10	uleshort	x		\b%d
&gt;&gt;&gt;&gt;5	ubyte		&lt;9
&gt;&gt;&gt;&gt;&gt;6	ubyte		0
&gt;&gt;&gt;&gt;&gt;&gt;7	ubyte		x		\b, codec=%d RGB color palettes
&gt;&gt;&gt;&gt;&gt;6	ubyte		64		\b, codec=RGB fixed color
&gt;&gt;&gt;&gt;&gt;6	ubyte		128		\b, codec=YJK
&gt;&gt;&gt;&gt;&gt;6	ubyte		192		\b, codec=YUV
&gt;&gt;&gt;&gt;5	ubyte		&gt;8		codec=RGB fixed color
&gt;&gt;&gt;&gt;12	ubyte		0		\b, raw
&gt;&gt;&gt;&gt;12	ubyte		1		\b, bitbuster compression

############## Other MSX file formats ##############

# MSX internal ROMs
0		ubeshort	0xF3C3
&gt;2		uleshort	&lt;0x4000
&gt;&gt;8		ubyte		0xC3
&gt;&gt;&gt;9		uleshort	&lt;0x4000
&gt;&gt;&gt;&gt;0x0B	ubeshort	0x00C3
&gt;&gt;&gt;&gt;&gt;0x0D	uleshort	&lt;0x4000
&gt;&gt;&gt;&gt;&gt;&gt;0x0F	ubeshort	0x00C3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x11	uleshort	&lt;0x4000
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x13	ubeshort	0x00C3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x15	uleshort	&lt;0x4000
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x50	ubyte		0xC3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x51	uleshort	&lt;0x4000
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(9.s)	ubyte	0xC3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	uleshort	&gt;0x4000
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	ubyte	0xC3		MSX BIOS+BASIC
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002D	ubyte+1	&lt;3		\b. version=MSX%d
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002D	ubyte	2		\b, version=MSX2+
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002D	ubyte	3		\b, version=MSX Turbo-R
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002D	ubyte	&gt;3		\b, version=Unknown MSX %d version
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x0006	ubyte	x		\b, VDP.DR=0x%2x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x0007	ubyte	x		\b, VDP.DW=0x%2x
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002B	ubyte&amp;0xF	0		\b, charset=Japanese
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002B	ubyte&amp;0xF	1		\b, charset=International
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002B	ubyte&amp;0xF	2		\b, charset=Korean
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002B	ubyte&amp;0xF	&gt;2		\b, charset=Unknown id:%d
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002B	ubyte&amp;0x70	0x00		\b, date format=Y-M-D
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002B	ubyte&amp;0x70	0x10		\b, date format=M-D-Y
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002B	ubyte&amp;0x70	0x20		\b, date format=D-M-Y
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002B	ubyte&amp;0x80	0x00		\b, vfreq=60Hz
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002B	ubyte&amp;0x80	0x80		\b, vfreq=50Hz
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002C	ubyte&amp;0x0F	0		\b, keyboard=Japanese
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002C	ubyte&amp;0x0F	1		\b, keyboard=International
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002C	ubyte&amp;0x0F	2		\b, keyboard=French
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002C	ubyte&amp;0x0F	3		\b, keyboard=UK
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002C	ubyte&amp;0x0F	4		\b, keyboard=German
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002C	ubyte&amp;0x0F	5		\b, keyboard=Unknown id:%d
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002C	ubyte&amp;0x0F	6		\b, keyboard=Spanish
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002C	ubyte&amp;0x0F	&gt;6		\b, keyboard=Unknown id:%d
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002C	ubyte&amp;0xF0	0x00		\b, basic=Japanese
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002C	ubyte&amp;0xF0	0x10		\b, basic=International
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002C	ubyte&amp;0xF0	&gt;0x10		\b, basic=Unknown id:%d
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x002E	ubyte&amp;1		1		\b, built-in MIDI


0		string/b		CD
&gt;2		uleshort	&gt;0x10
&gt;&gt;2		uleshort	&lt;0x4000
&gt;&gt;&gt;4		uleshort	&lt;0x4000
&gt;&gt;&gt;&gt;6		uleshort	&lt;0x4000
&gt;&gt;&gt;&gt;&gt;8		ubyte		0xC3
&gt;&gt;&gt;&gt;&gt;&gt;9		uleshort	&lt;0x4000
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x10	ubyte		0xC3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x11	uleshort	&lt;0x4000
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x14	ubyte		0xC3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x15	uleshort	&lt;0x4000		MSX2/2+/TR SubROM

0		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
&gt;0x5F0		ubequad		0x8282828244380000
&gt;&gt;0x150		ubyte		0x38
&gt;&gt;&gt;0x170	string		\20\20\20
&gt;&gt;&gt;&gt;0x1E32	string		())
&gt;&gt;&gt;&gt;&gt;0x2130	ubequad		0xA5A5594924231807
&gt;&gt;&gt;&gt;&gt;0x2138	ubequad		0x4A4A3424488830C0	MSX Kanji Font


# MSX extension ROMs
0	string/b		AB
&gt;2	uleshort	0x0010			MSX ROM
&gt;&gt;2	uleshort	x			\b, init=0x%4x
&gt;&gt;4	uleshort	&gt;0			\b, stahdl=0x%4x
&gt;&gt;6	uleshort	&gt;0			\b, devhdl=0x%4x
&gt;&gt;8	uleshort	&gt;0			\b, bas=0x%4x
&gt;2	uleshort	0x4010			MSX ROM
&gt;&gt;2	uleshort	x			\b, init=0x%04x
&gt;&gt;4	uleshort	&gt;0			\b, stahdl=0x%04x
&gt;&gt;6	uleshort	&gt;0			\b, devhdl=0x%04x
&gt;&gt;8	uleshort	&gt;0			\b, bas=0x%04x
&gt;2	uleshort	0x8010			MSX ROM
&gt;&gt;2	uleshort	x			\b, init=0x%04x
&gt;&gt;4	uleshort	&gt;0			\b, stahdl=0x%04x
&gt;&gt;6	uleshort	&gt;0			\b, devhdl=0x%04x
&gt;&gt;8	uleshort	&gt;0			\b, bas=0x%04x
0	string/b		AB\0\0
&gt;6	uleshort	0
&gt;&gt;4	uleshort	&gt;0x400F			MSX-BASIC extension ROM
&gt;&gt;&gt;4	uleshort	&gt;0			\b, stahdl=0x%04x
&gt;&gt;&gt;6	uleshort	&gt;0			\b, devhdl=0x%04x
&gt;&gt;&gt;0x1C		string		OPLL			\b, MSX-Music
&gt;&gt;&gt;&gt;0x18	string		PAC2			\b (external)
&gt;&gt;&gt;&gt;0x18	string		APRL			\b (internal)

0	string/b		AB\0\0\0\0
&gt;6	uleshort	&gt;0x400F			MSX device BIOS
&gt;&gt;6	uleshort	&gt;0			\b, devhdl=0x%04x


0	string/b		AB
#&gt;2	string		5JSuperLAYDOCK		MSX Super Laydock ROM
#&gt;3	string		@HYDLIDE3MSX		MSX Hydlide-3 ROM
#&gt;3	string		@3\x80IA862		Golvellius MSX1 ROM
&gt;2	uleshort	&gt;15
&gt;&gt;2	uleshort	&lt;0xC000
&gt;&gt;&gt;8	string		\0\0\0\0\0\0\0\0
&gt;&gt;&gt;&gt;(2.s&amp;0x3FFF)	uleshort	&gt;0		MSX ROM
&gt;&gt;&gt;&gt;&gt;0x10	string		YZ\0\0\0\0		Konami Game Master 2 MSX ROM
&gt;&gt;&gt;&gt;&gt;0x10	string		CD			\b, Konami RC-
&gt;&gt;&gt;&gt;&gt;&gt;0x12	ubyte		x			\b%d
&gt;&gt;&gt;&gt;&gt;&gt;0x13	ubyte/16	x			\b%d
&gt;&gt;&gt;&gt;&gt;&gt;0x13	ubyte&amp;0xF	x			\b%d
&gt;&gt;&gt;&gt;&gt;0x10	string		EF			\b, Konami RC-
&gt;&gt;&gt;&gt;&gt;&gt;0x12	ubyte		x			\b%d
&gt;&gt;&gt;&gt;&gt;&gt;0x13	ubyte/16	x			\b%d
&gt;&gt;&gt;&gt;&gt;&gt;0x13	ubyte&amp;0xF	x			\b%d
&gt;&gt;&gt;&gt;&gt;2	uleshort	x			\b, init=0x%04x
&gt;&gt;&gt;&gt;&gt;4	uleshort	&gt;0			\b, stahdl=0x%04x
&gt;&gt;&gt;&gt;&gt;6	uleshort	&gt;0			\b, devhdl=0x%04x
&gt;&gt;&gt;&gt;&gt;8	uleshort	&gt;0			\b, bas=0x%04x
&gt;&gt;&gt;2	uleshort	0
&gt;&gt;&gt;&gt;4	uleshort	0
&gt;&gt;&gt;&gt;&gt;6	uleshort	0
&gt;&gt;&gt;&gt;&gt;&gt;8	uleshort	&gt;0			MSX BASIC program in ROM, bas=0x%04x

0x4000	string/b		AB
&gt;0x4002	uleshort	&gt;0x400F
&gt;&gt;0x400A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
&gt;&gt;&gt;0x4002	uleshort	x			\b, init=0x%04x
&gt;&gt;&gt;0x4004	uleshort	&gt;0			\b, stahdl=0x%04x
&gt;&gt;&gt;0x4006	uleshort	&gt;0			\b, devhdl=0x%04x
&gt;&gt;&gt;0x4008	uleshort	&gt;0			\b, bas=0x%04x

0x8000	string/b		AB
&gt;0x8002	uleshort	&gt;0x400F
&gt;&gt;0x800A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
&gt;&gt;&gt;0x8002	uleshort	x			\b, init=0x%04x
&gt;&gt;&gt;0x8004	uleshort	&gt;0			\b, stahdl=0x%04x
&gt;&gt;&gt;0x8006	uleshort	&gt;0			\b, devhdl=0x%04x
&gt;&gt;&gt;0x8008	uleshort	&gt;0			\b, bas=0x%04x


0x3C000	string/b		AB
&gt;0x3C008	string		\0\0\0\0\0\0\0\0	MSX MegaROM with nonstandard page order
&gt;&gt;0x3C002	uleshort	x			\b, init=0x%04x
&gt;&gt;0x3C004	uleshort	&gt;0			\b, stahdl=0x%04x
&gt;&gt;0x3C006	uleshort	&gt;0			\b, devhdl=0x%04x
&gt;&gt;0x3C008	uleshort	&gt;0			\b, bas=0x%04x

# MSX BIN file
#0	byte		0xFE
#&gt;1	uleshort	&gt;0x8000
#&gt;&gt;3	uleshort	&gt;0x8004
#&gt;&gt;&gt;5	uleshort	&gt;0x8000			MSX BIN file

# MSX-BASIC file
0	byte		0xFF
&gt;3	uleshort	0x000A
&gt;&gt;1	uleshort	&gt;0x8000			MSX-BASIC program

# MSX .CAS file
0	string/b	\x1F\xA6\xDE\xBA\xCC\x13\x7D\x74	MSX cassette archive

# Mega-Assembler file
0	byte		0xFE
&gt;1	uleshort	0x0001
&gt;&gt;5	uleshort	0xffff
&gt;&gt;&gt;6	byte		0x0A		MSX Mega-Assembler source

# Execrom Patchfile
0	string		ExecROM\ patchfile\x1A	MSX ExecROM patchfile
&gt;0x12	ubyte/16	x		v%d
&gt;0x12	ubyte&amp;0xF	x		\b.%d
&gt;0x13	ubyte		x		\b, contains %d patches

# Konami&#039;s King&#039;s Valley-2 custom stage (ELG file)
4	uleshort	0x0900
&gt;0xF	byte		1
&gt;&gt;0x14	byte		0
&gt;&gt;&gt;0x1E	string		\040\040\040
&gt;&gt;&gt;&gt;0x23	byte	1
&gt;&gt;&gt;&gt;&gt;0x25	byte	0
&gt;&gt;&gt;&gt;&gt;&gt;0x15	string	&gt;\x30
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x15	string	&lt;\x5A		Konami King&#039;s Valley-2 custom stage, title: &quot;%-8.8s&quot;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1D	byte	&lt;32	\b, theme: %d

# Metal Gear 1 savegame
#0x4F	string	\x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
#&gt;&gt;0x60	string	\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF
#&gt;&gt;&gt;0x7B	string	\0x00\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\x00	Metal Gear 1 savegame

# ------------------------------------------------------------------------
# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $
# mup: file(1) magic for Mup (Music Publisher) input file.
#
# From: Abel Cheung &lt;abel (@) oaka.org&gt;
#
# NOTE: This header is mainly proposed in the Arkkra mailing list,
# and is not a mandatory header because of old mup input file
# compatibility. Noteedit also use mup format, but is not forcing
# user to use any header as well.
#
0		search/1	//!Mup		Mup music publication program input text
&gt;6		string		-Arkkra		(Arkkra)
&gt;&gt;13		string		-
&gt;&gt;&gt;16		string		.
&gt;&gt;&gt;&gt;14		string		x		\b, need V%.4s
&gt;&gt;&gt;15		string		.
&gt;&gt;&gt;&gt;14		string		x		\b, need V%.3s
&gt;6		string		-
&gt;&gt;9		string		.
&gt;&gt;&gt;7		string		x		\b, need V%.4s
&gt;&gt;8		string		.
&gt;&gt;&gt;7		string		x		\b, need V%.3s
#------------------------------------------------------------------------------
# $File: music,v 1.1 2011/11/25 03:28:17 christos Exp $
# music:  file (1) magic for music formats

# BWW format used by Bagpipe Music Writer Gold by Robert MacNeil Musicworks
# and Bagpipe Writer by Doug Wickstrom
#
0	string		Bagpipe		Bagpipe
&gt;8	string		Reader		Reader
&gt;&gt;15	string		&gt;\0		(version %.3s)
&gt;8	string		Music\ Writer	Music Writer
&gt;&gt;20	string		:
&gt;&gt;&gt;21	string		&gt;\0		(version %.3s)
&gt;&gt;21	string		Gold		Gold
&gt;&gt;&gt;25	string		:
&gt;&gt;&gt;&gt;26	string		&gt;\0		(version %.3s)


#------------------------------------------------------------------------------
# nasa:	file(1) magic

# From: Barry Carter &lt;carter.barry@gmail.com&gt;
0	string	DAF/SPK				NASA SPICE file (binary format)
0	string	DAFETF\ NAIF\ DAF\ ENCODED	NASA SPICE file (transfer format)

#-----------------------------------------------------------------------------
# $File: natinst,v 1.6 2014/06/03 19:17:27 christos Exp $
# natinst:  file(1) magic for National Instruments Code Files

#
# From &lt;egamez@fcfm.buap.mx&gt; Enrique Gamez-Flores
# version 1
# Many formats still missing, we use, for the moment LabVIEW
# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
#
0       string          RSRC            National Instruments,
# Check if it&#039;s a LabVIEW File
&gt;8      string          LV              LabVIEW File,
# Check which kind of file it is
&gt;&gt;10    string          SB              Code Resource File, data
&gt;&gt;10    string          IN              Virtual Instrument Program, data
&gt;&gt;10    string          AR              VI Library, data
# This is for Menu Libraries
&gt;8      string          LMNULBVW        Portable File Names, data
# This is for General Resources
&gt;8      string          rsc             Resources File, data
# This is for VXI Package
0       string          VMAP            National Instruments, VXI File, data

#------------------------------------------------------------------------------
# $File: ncr,v 1.8 2014/04/30 21:41:02 christos Exp $
# ncr:  file(1) magic for NCR Tower objects
#
# contributed by
# Michael R. Wayne  ***  TMC &amp; Associates  ***  INTERNET: wayne@ford-vax.arpa
# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
#
0	beshort		000610	Tower/XP rel 2 object
&gt;12	   belong		&gt;0	not stripped
&gt;20	   beshort		0407	executable
&gt;20	   beshort		0410	pure executable
&gt;22	   beshort		&gt;0	- version %d
0	beshort		000615	Tower/XP rel 2 object
&gt;12	   belong		&gt;0	not stripped
&gt;20	   beshort		0407	executable
&gt;20	   beshort		0410	pure executable
&gt;22	   beshort		&gt;0	- version %d
0	beshort		000620	Tower/XP rel 3 object
&gt;12	   belong		&gt;0	not stripped
&gt;20	   beshort		0407	executable
&gt;20	   beshort		0410	pure executable
&gt;22	   beshort		&gt;0	- version %d
0	beshort		000625	Tower/XP rel 3 object
&gt;12	   belong		&gt;0	not stripped
&gt;20	   beshort		0407	executable
&gt;20	   beshort		0410	pure executable
&gt;22	   beshort		&gt;0	- version %d
0	beshort		000630	Tower32/600/400 68020 object
&gt;12	   belong		&gt;0	not stripped
&gt;20	   beshort		0407	executable
&gt;20	   beshort		0410	pure executable
&gt;22	   beshort		&gt;0	- version %d
0	beshort		000640	Tower32/800 68020
&gt;18	   beshort		&amp;020000	w/68881 object
&gt;18	   beshort		&amp;040000	compatible object
&gt;18	   beshort		&amp;060000	object
&gt;20	   beshort		0407	executable
&gt;20	   beshort		0413	pure executable
&gt;12	   belong		&gt;0	not stripped
&gt;22	   beshort		&gt;0	- version %d
0	beshort		000645	Tower32/800 68010
&gt;18	   beshort		&amp;040000	compatible object
&gt;18	   beshort		&amp;060000 object
&gt;20	   beshort		0407	executable
&gt;20	   beshort		0413	pure executable
&gt;12	   belong		&gt;0	not stripped
&gt;22	   beshort		&gt;0	- version %d

#------------------------------------------------------------
# $File: neko,v 1.1 2009/11/10 20:36:10 christos Exp $

# From: Mikhail Gusarov &lt;dottedmag@dottedmag.net&gt;
# NekoVM (http://nekovm.org/) bytecode
0	string		NEKO	NekoVM bytecode
&gt;4	lelong		x	(%d global symbols,
&gt;8	lelong		x	%d global fields,
&gt;12	lelong		x	%d bytecode ops)
!:mime	application/x-nekovm-bytecode


#------------------------------------------------------------------------------
# $File: netbsd,v 1.25 2017/09/28 02:37:47 christos Exp $
# netbsd:  file(1) magic for NetBSD objects
#
# All new-style magic numbers are in network byte order.
# The old-style magic numbers are indistinguishable from the same magic
# numbers used in other systems, and are handled, for all those systems,
# in aout.
#

0	belong&amp;0377777777	041400413	a.out NetBSD/i386 demand paged
&gt;0	byte			&amp;0x80
&gt;&gt;20	lelong			&lt;4096		shared library
&gt;&gt;20	lelong			=4096		dynamically linked executable
&gt;&gt;20	lelong			&gt;4096		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	041400410	a.out NetBSD/i386 pure
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	041400407	a.out NetBSD/i386
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80
&gt;&gt;0	byte			&amp;0x40		position independent
&gt;&gt;20	lelong			!0		executable
&gt;&gt;20	lelong			=0		object file
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	041400507	a.out NetBSD/i386 core
&gt;12	string			&gt;\0		from &#039;%s&#039;
&gt;32	lelong			!0		(signal %d)

0	belong&amp;0377777777	041600413	a.out NetBSD/m68k demand paged
&gt;0	byte			&amp;0x80
&gt;&gt;20	belong			&lt;8192		shared library
&gt;&gt;20	belong			=8192		dynamically linked executable
&gt;&gt;20	belong			&gt;8192		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	041600410	a.out NetBSD/m68k pure
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	041600407	a.out NetBSD/m68k
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80
&gt;&gt;0	byte			&amp;0x40		position independent
&gt;&gt;20	belong			!0		executable
&gt;&gt;20	belong			=0		object file
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	041600507	a.out NetBSD/m68k core
&gt;12	string			&gt;\0		from &#039;%s&#039;
&gt;32	belong			!0		(signal %d)

0	belong&amp;0377777777	042000413	a.out NetBSD/m68k4k demand paged
&gt;0	byte			&amp;0x80
&gt;&gt;20	belong			&lt;4096		shared library
&gt;&gt;20	belong			=4096		dynamically linked executable
&gt;&gt;20	belong			&gt;4096		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	042000410	a.out NetBSD/m68k4k pure
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	042000407	a.out NetBSD/m68k4k
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80
&gt;&gt;0	byte			&amp;0x40		position independent
&gt;&gt;20	belong			!0		executable
&gt;&gt;20	belong			=0		object file
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	042000507	a.out NetBSD/m68k4k core
&gt;12	string			&gt;\0		from &#039;%s&#039;
&gt;32	belong			!0		(signal %d)

0	belong&amp;0377777777	042200413	a.out NetBSD/ns32532 demand paged
&gt;0	byte			&amp;0x80
&gt;&gt;20	lelong			&lt;4096		shared library
&gt;&gt;20	lelong			=4096		dynamically linked executable
&gt;&gt;20	lelong			&gt;4096		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	042200410	a.out NetBSD/ns32532 pure
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	042200407	a.out NetBSD/ns32532
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80
&gt;&gt;0	byte			&amp;0x40		position independent
&gt;&gt;20	lelong			!0		executable
&gt;&gt;20	lelong			=0		object file
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	042200507	a.out NetBSD/ns32532 core
&gt;12	string			&gt;\0		from &#039;%s&#039;
&gt;32	lelong			!0		(signal %d)

0	belong&amp;0377777777	045200507	a.out NetBSD/powerpc core
&gt;12	string			&gt;\0		from &#039;%s&#039;

0	belong&amp;0377777777	042400413	a.out NetBSD/SPARC demand paged
&gt;0	byte			&amp;0x80
&gt;&gt;20	belong			&lt;8192		shared library
&gt;&gt;20	belong			=8192		dynamically linked executable
&gt;&gt;20	belong			&gt;8192		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	042400410	a.out NetBSD/SPARC pure
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	042400407	a.out NetBSD/SPARC
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80
&gt;&gt;0	byte			&amp;0x40		position independent
&gt;&gt;20	belong			!0		executable
&gt;&gt;20	belong			=0		object file
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	042400507	a.out NetBSD/SPARC core
&gt;12	string			&gt;\0		from &#039;%s&#039;
&gt;32	belong			!0		(signal %d)

0	belong&amp;0377777777	042600413	a.out NetBSD/pmax demand paged
&gt;0	byte			&amp;0x80
&gt;&gt;20	lelong			&lt;4096		shared library
&gt;&gt;20	lelong			=4096		dynamically linked executable
&gt;&gt;20	lelong			&gt;4096		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	042600410	a.out NetBSD/pmax pure
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	042600407	a.out NetBSD/pmax
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80
&gt;&gt;0	byte			&amp;0x40		position independent
&gt;&gt;20	lelong			!0		executable
&gt;&gt;20	lelong			=0		object file
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	042600507	a.out NetBSD/pmax core
&gt;12	string			&gt;\0		from &#039;%s&#039;
&gt;32	lelong			!0		(signal %d)

0	belong&amp;0377777777	043000413	a.out NetBSD/vax 1k demand paged
&gt;0	byte			&amp;0x80
&gt;&gt;20	lelong			&lt;4096		shared library
&gt;&gt;20	lelong			=4096		dynamically linked executable
&gt;&gt;20	lelong			&gt;4096		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	043000410	a.out NetBSD/vax 1k pure
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	043000407	a.out NetBSD/vax 1k
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80
&gt;&gt;0	byte			&amp;0x40		position independent
&gt;&gt;20	lelong			!0		executable
&gt;&gt;20	lelong			=0		object file
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	043000507	a.out NetBSD/vax 1k core
&gt;12	string			&gt;\0		from &#039;%s&#039;
&gt;32	lelong			!0		(signal %d)

0	belong&amp;0377777777	045400413	a.out NetBSD/vax 4k demand paged
&gt;0	byte			&amp;0x80
&gt;&gt;20	lelong			&lt;4096		shared library
&gt;&gt;20	lelong			=4096		dynamically linked executable
&gt;&gt;20	lelong			&gt;4096		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	045400410	a.out NetBSD/vax 4k pure
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	045400407	a.out NetBSD/vax 4k
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80
&gt;&gt;0	byte			&amp;0x40		position independent
&gt;&gt;20	lelong			!0		executable
&gt;&gt;20	lelong			=0		object file
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	045400507	a.out NetBSD/vax 4k core
&gt;12	string			&gt;\0		from &#039;%s&#039;
&gt;32	lelong			!0		(signal %d)

# NetBSD/alpha does not support (and has never supported) a.out objects,
# so no rules are provided for them.  NetBSD/alpha ELF objects are
# dealt with in &quot;elf&quot;.
0	lelong		0x00070185		ECOFF NetBSD/alpha binary
&gt;10	leshort		0x0001			not stripped
&gt;10	leshort		0x0000			stripped
0	belong&amp;0377777777	043200507	a.out NetBSD/alpha core
&gt;12	string			&gt;\0		from &#039;%s&#039;
&gt;32	lelong			!0		(signal %d)

0	belong&amp;0377777777	043400413	a.out NetBSD/mips demand paged
&gt;0	byte			&amp;0x80
&gt;&gt;20	belong			&lt;8192		shared library
&gt;&gt;20	belong			=8192		dynamically linked executable
&gt;&gt;20	belong			&gt;8192		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	043400410	a.out NetBSD/mips pure
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	043400407	a.out NetBSD/mips
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80
&gt;&gt;0	byte			&amp;0x40		position independent
&gt;&gt;20	belong			!0		executable
&gt;&gt;20	belong			=0		object file
&gt;16	belong			&gt;0		not stripped
0	belong&amp;0377777777	043400507	a.out NetBSD/mips core
&gt;12	string			&gt;\0		from &#039;%s&#039;
&gt;32	belong			!0		(signal %d)

0	belong&amp;0377777777	043600413	a.out NetBSD/arm32 demand paged
&gt;0	byte			&amp;0x80
&gt;&gt;20	lelong			&lt;4096		shared library
&gt;&gt;20	lelong			=4096		dynamically linked executable
&gt;&gt;20	lelong			&gt;4096		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	043600410	a.out NetBSD/arm32 pure
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80		executable
&gt;16	lelong			&gt;0		not stripped
0	belong&amp;0377777777	043600407	a.out NetBSD/arm32
&gt;0	byte			&amp;0x80		dynamically linked executable
&gt;0	byte			^0x80
&gt;&gt;0	byte			&amp;0x40		position independent
&gt;&gt;20	lelong			!0		executable
&gt;&gt;20	lelong			=0		object file
&gt;16	lelong			&gt;0		not stripped
# NetBSD/arm26 has always used ELF objects, but it shares a core file
# format with NetBSD/arm32.
0	belong&amp;0377777777	043600507	a.out NetBSD/arm core
&gt;12	string			&gt;\0		from &#039;%s&#039;
&gt;32	lelong			!0		(signal %d)

# Kernel core dump format
0	belong&amp;0x0000ffff 0x00008fca	NetBSD kernel core file
&gt;0	belong&amp;0x03ff0000 0x00000000	\b, Unknown
&gt;0	belong&amp;0x03ff0000 0x00010000	\b, sun 68010/68020
&gt;0	belong&amp;0x03ff0000 0x00020000	\b, sun 68020
&gt;0	belong&amp;0x03ff0000 0x00640000	\b, 386 PC
&gt;0	belong&amp;0x03ff0000 0x00860000	\b, i386 BSD
&gt;0	belong&amp;0x03ff0000 0x00870000	\b, m68k BSD (8K pages)
&gt;0	belong&amp;0x03ff0000 0x00880000	\b, m68k BSD (4K pages)
&gt;0	belong&amp;0x03ff0000 0x00890000	\b, ns32532 BSD
&gt;0	belong&amp;0x03ff0000 0x008a0000	\b, SPARC/32 BSD
&gt;0	belong&amp;0x03ff0000 0x008b0000	\b, pmax BSD
&gt;0	belong&amp;0x03ff0000 0x008c0000	\b, vax BSD (1K pages)
&gt;0	belong&amp;0x03ff0000 0x008d0000	\b, alpha BSD
&gt;0	belong&amp;0x03ff0000 0x008e0000	\b, mips BSD (Big Endian)
&gt;0	belong&amp;0x03ff0000 0x008f0000	\b, arm6 BSD
&gt;0	belong&amp;0x03ff0000 0x00900000	\b, m68k BSD (2K pages)
&gt;0	belong&amp;0x03ff0000 0x00910000	\b, sh3 BSD
&gt;0	belong&amp;0x03ff0000 0x00950000	\b, ppc BSD (Big Endian)
&gt;0	belong&amp;0x03ff0000 0x00960000	\b, vax BSD (4K pages)
&gt;0	belong&amp;0x03ff0000 0x00970000	\b, mips1 BSD
&gt;0	belong&amp;0x03ff0000 0x00980000	\b, mips2 BSD
&gt;0	belong&amp;0x03ff0000 0x00990000	\b, m88k BSD
&gt;0	belong&amp;0x03ff0000 0x00920000	\b, parisc BSD
&gt;0	belong&amp;0x03ff0000 0x009b0000	\b, sh5/64 BSD
&gt;0	belong&amp;0x03ff0000 0x009c0000	\b, SPARC/64 BSD
&gt;0	belong&amp;0x03ff0000 0x009d0000	\b, amd64 BSD
&gt;0	belong&amp;0x03ff0000 0x009e0000	\b, sh5/32 BSD
&gt;0	belong&amp;0x03ff0000 0x009f0000	\b, ia64 BSD
&gt;0	belong&amp;0x03ff0000 0x00b70000	\b, aarch64 BSD
&gt;0	belong&amp;0x03ff0000 0x00b80000	\b, or1k BSD
&gt;0	belong&amp;0x03ff0000 0x00b90000	\b, Risk-V BSD
&gt;0	belong&amp;0x03ff0000 0x00c80000	\b, hp200 BSD
&gt;0	belong&amp;0x03ff0000 0x012c0000	\b, hp300 BSD
&gt;0	belong&amp;0x03ff0000 0x020b0000	\b, hp800 HP-UX
&gt;0	belong&amp;0x03ff0000 0x020c0000	\b, hp200/hp300 HP-UX
&gt;0	belong&amp;0xfc000000 0x04000000	\b, CPU
&gt;0	belong&amp;0xfc000000 0x08000000	\b, DATA
&gt;0	belong&amp;0xfc000000 0x10000000	\b, STACK
&gt;4	leshort	x			\b, (headersize = %d
&gt;6	leshort	x			\b, segmentsize = %d
&gt;8	lelong	x			\b, segments = %d)

# little endian only for now.
0	name		ktrace
&gt;4	leshort		7
&gt;&gt;6	leshort		&lt;3		NetBSD ktrace file version %d
&gt;&gt;&gt;12	string		x		from %s
&gt;&gt;&gt;56	string		x		\b, emulation %s
&gt;&gt;&gt;8	lelong		&lt;65536		\b, pid=%d

56	string		netbsd
&gt;0	use		ktrace
56	string		linux
&gt;0	use		ktrace
56	string		sunos
&gt;0	use		ktrace
56	string		hpux
&gt;0	use		ktrace

#------------------------------------------------------------------------------
# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $
# netscape:  file(1) magic for Netscape files
# &quot;H. Nanosecond&quot; &lt;aldomel@ix.netcom.com&gt;
# version 3 and 4 I think
#

# Netscape Address book  .nab
0	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book

# Netscape Communicator address book
0   string   \000\017\102\111 Netscape Communicator address book

# .snm Caches
0	string		#\ Netscape\ folder\ cache	Netscape folder cache
0	string	\000\036\204\220\000	Netscape folder cache
# .n2p
# Net 2 Phone
#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
0	string	SX961999	Net2phone

#
#This is files ending in .art, FIXME add more rules
0	string	JG\004\016\0\0\0\0	AOL ART image
0	string	JG\003\016\0\0\0\0	AOL ART image

#------------------------------------------------------------------------------
# $File: netware,v 1.4 2009/09/19 16:28:11 christos Exp $
# netware:  file(1) magic for NetWare Loadable Modules (NLMs)
# From: Mads Martin Joergensen &lt;mmj@suse.de&gt;

0	string	NetWare\ Loadable\ Module	NetWare Loadable Module

#------------------------------------------------------------------------------
# $File: news,v 1.6 2009/09/19 16:28:11 christos Exp $
# news:  file(1) magic for SunOS NeWS fonts (not &quot;news&quot; as in &quot;netnews&quot;)
#
0	string		StartFontMetrics	ASCII font metrics
0	string		StartFont	ASCII font bits
0	belong		0x137A2944	NeWS bitmap font
0	belong		0x137A2947	NeWS font family
0	belong		0x137A2950	scalable OpenFont binary
0	belong		0x137A2951	encrypted scalable OpenFont binary
8	belong		0x137A2B45	X11/NeWS bitmap font
8	belong		0x137A2B48	X11/NeWS font family

#------------------------------------------------------------------------------
# $File: nitpicker,v 1.7 2017/03/17 21:35:28 christos Exp $
# nitpicker:  file(1) magic for Flowfiles.
# From: Christian Jachmann &lt;C.Jachmann@gmx.net&gt; http://www.nitpicker.de
0	string	NPFF	NItpicker Flow File
&gt;4	byte	x	V%d.
&gt;5	byte	x	%d
&gt;6	bedate	x	started: %s
&gt;10	bedate	x	stopped: %s
&gt;14	belong	x	Bytes: %u
&gt;18	belong	x	Bytes1: %u
&gt;22	belong	x	Flows: %u
&gt;26	belong	x	Pkts: %u

#------------------------------------------------------------------------------
# $File: oasis,v 1.2 2014/06/03 19:17:27 christos Exp $
# OASIS
# Summary: OASIS stream file
# Long description: Open Artwork System Interchange Standard
# File extension: .oas
# Full name:	Ben Cowley (bcowley@broadcom.com)
#		Philip Dixon (pdixon@broadcom.com)
# Reference: http://www.wrcad.com/oasis/oasis-3626-042303-draft.pdf
#		(see page 3)
0	string	%SEMI-OASIS\r\n		OASIS Stream file

#------------------------------------------------------------------------------
# $File: ocaml,v 1.5 2010/09/20 18:55:20 rrt Exp $
# ocaml: file(1) magic for Objective Caml files.
0	string	Caml1999	OCaml
&gt;8	string	X		exec file
&gt;8	string	I		interface file (.cmi)
&gt;8	string	O		object file (.cmo)
&gt;8	string	A		library file (.cma)
&gt;8	string	Y		native object file (.cmx)
&gt;8	string	Z		native library file (.cmxa)
&gt;8	string	M		abstract syntax tree implementation file
&gt;8	string	N		abstract syntax tree interface file
&gt;9	string	&gt;\0		(Version %3.3s)

#------------------------------------------------------------------------------
# $File: octave,v 1.4 2009/09/19 16:28:11 christos Exp $
# octave binary data file(1) magic, from Dirk Eddelbuettel &lt;edd@debian.org&gt;
0	string		Octave-1-L	Octave binary data (little endian)
0	string		Octave-1-B	Octave binary data (big endian)

#------------------------------------------------------------------------------
# $File: ole2compounddocs,v 1.5 2017/10/27 21:43:23 christos Exp $
# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured
# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)
# Additional tests for OLE 2 Compound Documents should be under this recipe.

0   string  \320\317\021\340\241\261\032\341      OLE 2 Compound Document
# - Microstation V8 DGN files (www.bentley.com)
#   Last update on 10/23/2006 by Lester Hightower
&gt; 0x480  string  D\000g\000n\000~\000H                : Microstation V8 DGN
# - Visio documents
#   Last update on 10/23/2006 by Lester Hightower
&gt; 0x480  string  V\000i\000s\000i\000o\000D\000o\000c : Visio Document

# Note: moved &amp; merged Microsoft Office parts from ./msdos Oct 2017
# Update: Joerg Jenderek
# from http://filext.com by Derek M Jones &lt;derek@knosof.co.uk&gt;
# False positive with PPT (also currently this string is too long)
#0	string/b	\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF\x09\x00\x06	Microsoft Installer
#0	string/b	\320\317\021\340\241\261\032\341	Microsoft Office Document
#&gt;48	byte	0x1B					Excel Document
#!:mime application/vnd.ms-excel
&gt;546	string	bjbj			: Microsoft Word Document
!:mime	application/msword
# https://www.macdisk.com/macsigen.php
!:apple	MSWDWDBN
!:ext	doc/dot
&gt;546	string	jbjb			: Microsoft Word Document
!:mime	application/msword
!:apple	MSWDWDBN
!:ext	doc


#------------------------------------------------------------------------------
# $File: olf,v 1.4 2009/09/19 16:28:11 christos Exp $
# olf:  file(1) magic for OLF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# MIPS R3000 may also be for MIPS R2000.
# What&#039;re the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# Created by Erik Theisen &lt;etheisen@openbsd.org&gt;
# Based on elf from Daniel Quinlan &lt;quinlan@yggdrasil.com&gt;
0	string		\177OLF		OLF
&gt;4	byte		0		invalid class
&gt;4	byte		1		32-bit
&gt;4	byte		2		64-bit
&gt;7	byte		0		invalid os
&gt;7	byte		1		OpenBSD
&gt;7	byte		2		NetBSD
&gt;7	byte		3		FreeBSD
&gt;7	byte		4		4.4BSD
&gt;7	byte		5		Linux
&gt;7	byte		6		SVR4
&gt;7	byte		7		esix
&gt;7	byte		8		Solaris
&gt;7	byte		9		Irix
&gt;7	byte		10		SCO
&gt;7	byte		11		Dell
&gt;7	byte		12		NCR
&gt;5	byte		0		invalid byte order
&gt;5	byte		1		LSB
&gt;&gt;16	leshort		0		no file type,
&gt;&gt;16	leshort		1		relocatable,
&gt;&gt;16	leshort		2		executable,
&gt;&gt;16	leshort		3		shared object,
# Core handling from Peter Tobias &lt;tobias@server.et-inf.fho-emden.de&gt;
# corrections by Christian &#039;Dr. Disk&#039; Hechelmann &lt;drdisk@ds9.au.s.shuttle.de&gt;
&gt;&gt;16	leshort		4		core file
&gt;&gt;&gt;(0x38+0xcc) string	&gt;\0		of &#039;%s&#039;
&gt;&gt;&gt;(0x38+0x10) lelong	&gt;0		(signal %d),
&gt;&gt;16	leshort		&amp;0xff00		processor-specific,
&gt;&gt;18	leshort		0		no machine,
&gt;&gt;18	leshort		1		AT&amp;T WE32100 - invalid byte order,
&gt;&gt;18	leshort		2		SPARC - invalid byte order,
&gt;&gt;18	leshort		3		Intel 80386,
&gt;&gt;18	leshort		4		Motorola 68000 - invalid byte order,
&gt;&gt;18	leshort		5		Motorola 88000 - invalid byte order,
&gt;&gt;18	leshort		6		Intel 80486,
&gt;&gt;18	leshort		7		Intel 80860,
&gt;&gt;18	leshort		8		MIPS R3000_BE - invalid byte order,
&gt;&gt;18	leshort		9		Amdahl - invalid byte order,
&gt;&gt;18	leshort		10		MIPS R3000_LE,
&gt;&gt;18	leshort		11		RS6000 - invalid byte order,
&gt;&gt;18	leshort		15		PA-RISC - invalid byte order,
&gt;&gt;18	leshort		16		nCUBE,
&gt;&gt;18	leshort		17		VPP500,
&gt;&gt;18	leshort		18		SPARC32PLUS,
&gt;&gt;18	leshort		20		PowerPC,
&gt;&gt;18	leshort		0x9026		Alpha,
&gt;&gt;20	lelong		0		invalid version
&gt;&gt;20	lelong		1		version 1
&gt;&gt;36	lelong		1		MathCoPro/FPU/MAU Required
&gt;8	string		&gt;\0		(%s)
&gt;5	byte		2		MSB
&gt;&gt;16	beshort		0		no file type,
&gt;&gt;16	beshort		1		relocatable,
&gt;&gt;16	beshort		2		executable,
&gt;&gt;16	beshort		3		shared object,
&gt;&gt;16	beshort		4		core file,
&gt;&gt;&gt;(0x38+0xcc) string	&gt;\0		of &#039;%s&#039;
&gt;&gt;&gt;(0x38+0x10) belong	&gt;0		(signal %d),
&gt;&gt;16	beshort		&amp;0xff00		processor-specific,
&gt;&gt;18	beshort		0		no machine,
&gt;&gt;18	beshort		1		AT&amp;T WE32100,
&gt;&gt;18	beshort		2		SPARC,
&gt;&gt;18	beshort		3		Intel 80386 - invalid byte order,
&gt;&gt;18	beshort		4		Motorola 68000,
&gt;&gt;18	beshort		5		Motorola 88000,
&gt;&gt;18	beshort		6		Intel 80486 - invalid byte order,
&gt;&gt;18	beshort		7		Intel 80860,
&gt;&gt;18	beshort		8		MIPS R3000_BE,
&gt;&gt;18	beshort		9		Amdahl,
&gt;&gt;18	beshort		10		MIPS R3000_LE - invalid byte order,
&gt;&gt;18	beshort		11		RS6000,
&gt;&gt;18	beshort		15		PA-RISC,
&gt;&gt;18	beshort		16		nCUBE,
&gt;&gt;18	beshort		17		VPP500,
&gt;&gt;18	beshort		18		SPARC32PLUS,
&gt;&gt;18	beshort		20		PowerPC or cisco 4500,
&gt;&gt;18	beshort		21		cisco 7500,
&gt;&gt;18	beshort		24		cisco SVIP,
&gt;&gt;18	beshort		25		cisco 7200,
&gt;&gt;18	beshort		36		cisco 12000,
&gt;&gt;18	beshort		0x9026		Alpha,
&gt;&gt;20	belong		0		invalid version
&gt;&gt;20	belong		1		version 1
&gt;&gt;36	belong		1		MathCoPro/FPU/MAU Required

#------------------------------------------------------------------------------
# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $
# os2:  file(1) magic for OS/2 files
#

# Provided 1998/08/22 by
# David Mediavilla &lt;davidme.news@REMOVEIFNOTSPAMusa.net&gt;
1	search/100	InternetShortcut	MS Windows 95 Internet shortcut text
&gt;17	search/100	URL= 			(URL=&lt;
&gt;&gt;&amp;0	string		x			\b%s&gt;)

# OS/2 URL objects
# Provided 1998/08/22 by
# David Mediavilla &lt;davidme.news@REMOVEIFNOTSPAMusa.net&gt;
#0	string	http:			OS/2 URL object text
#&gt;5	string	&gt;\			(WWW) &lt;http:%s&gt;
#0	string	mailto:			OS/2 URL object text
#&gt;7	string	&gt;\			(email) &lt;%s&gt;
#0	string	news:			OS/2 URL object text
#&gt;5	string	&gt;\			(Usenet) &lt;%s&gt;
#0	string	ftp:			OS/2 URL object text
#&gt;4	string	&gt;\			(FTP) &lt;ftp:%s&gt;
#0	string	file:			OS/2 URL object text
#&gt;5	string	&gt;\			(Local file) &lt;%s&gt;

# &gt;&gt;&gt;&gt;&gt; OS/2 INF/HLP &lt;&lt;&lt;&lt;&lt;  (source: Daniel Dissett ddissett@netcom.com)
# Carl Hauser (chauser.parc@xerox.com) and
# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
# list the following header format in inf02a.doc:
#
#  int16 ID;           // ID magic word (5348h = &quot;HS&quot;)
#  int8  unknown1;     // unknown purpose, could be third letter of ID
#  int8  flags;        // probably a flag word...
#                      //  bit 0: set if INF style file
#                      //  bit 4: set if HLP style file
#                      // patching this byte allows reading HLP files
#                      // using the VIEW command, while help files
#                      // seem to work with INF settings here as well.
#  int16 hdrsize;      // total size of header
#  int16 unknown2;     // unknown purpose
#
0   string  HSP\x01\x9b\x00 OS/2 INF
&gt;107 string &gt;0                      (%s)
0   string  HSP\x10\x9b\x00     OS/2 HLP
&gt;107 string &gt;0                      (%s)

# OS/2 INI (this is a guess)
0  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI

#------------------------------------------------------------------------------
# $File: os400,v 1.5 2009/09/19 16:28:11 christos Exp $
# os400:  file(1) magic for IBM OS/400 files
#
# IBM OS/400 (i5/OS) Save file (SAVF) - gerardo.cacciari@gmail.com
# In spite of its quite variable format (due to internal memory page
# length differences between CISC and RISC versions of the OS) the
# SAVF structure hasn&#039;t suitable offsets to identify the catalog
# header in the first descriptor where there are some useful infos,
# so we must search in a somewhat large area for a particular string
# that represents the EBCDIC encoding of &#039;QSRDSSPC&#039; (save/restore
# descriptor space) preceded by a two byte constant.
#
1090	 search/7393	\x19\xDB\xD8\xE2\xD9\xC4\xE2\xE2\xD7\xC3 IBM OS/400 save file data
&gt;&amp;212	 byte		0x01			 \b, created with SAVOBJ
&gt;&amp;212	 byte		0x02			 \b, created with SAVLIB
&gt;&amp;212	 byte		0x07			 \b, created with SAVCFG
&gt;&amp;212	 byte		0x08			 \b, created with SAVSECDTA
&gt;&amp;212	 byte		0x0A			 \b, created with SAVSECDTA
&gt;&amp;212	 byte		0x0B			 \b, created with SAVDLO
&gt;&amp;212	 byte		0x0D			 \b, created with SAVLICPGM
&gt;&amp;212	 byte		0x11			 \b, created with SAVCHGOBJ
&gt;&amp;213	 byte		0x44			 \b, at least V5R4 to open
&gt;&amp;213	 byte		0x43			 \b, at least V5R3 to open
&gt;&amp;213	 byte		0x42			 \b, at least V5R2 to open
&gt;&amp;213	 byte		0x41			 \b, at least V5R1 to open
&gt;&amp;213	 byte		0x40			 \b, at least V4R5 to open
&gt;&amp;213	 byte		0x3F			 \b, at least V4R4 to open
&gt;&amp;213	 byte		0x3E			 \b, at least V4R3 to open
&gt;&amp;213	 byte		0x3C			 \b, at least V4R2 to open
&gt;&amp;213	 byte		0x3D			 \b, at least V4R1M4 to open
&gt;&amp;213	 byte		0x3B			 \b, at least V4R1 to open
&gt;&amp;213	 byte		0x3A			 \b, at least V3R7 to open
&gt;&amp;213	 byte		0x35			 \b, at least V3R6 to open
&gt;&amp;213	 byte		0x36			 \b, at least V3R2 to open
&gt;&amp;213	 byte		0x34			 \b, at least V3R1 to open
&gt;&amp;213	 byte		0x31			 \b, at least V3R0M5 to open
&gt;&amp;213	 byte		0x30			 \b, at least V2R3 to open

#------------------------------------------------------------------------------
# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $
#
# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS&#039;&#039; AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
#
# OS9/6809 module descriptions:
#
0	beshort		0x87CD	OS9/6809 module:
#
&gt;6	byte&amp;0x0f	0x00	non-executable
&gt;6	byte&amp;0x0f	0x01	machine language
&gt;6	byte&amp;0x0f	0x02	BASIC I-code
&gt;6	byte&amp;0x0f	0x03	Pascal P-code
&gt;6	byte&amp;0x0f	0x04	C I-code
&gt;6	byte&amp;0x0f	0x05	COBOL I-code
&gt;6	byte&amp;0x0f	0x06	Fortran I-code
#
&gt;6	byte&amp;0xf0	0x10	program executable
&gt;6	byte&amp;0xf0	0x20	subroutine
&gt;6	byte&amp;0xf0	0x30	multi-module
&gt;6	byte&amp;0xf0	0x40	data module
#
&gt;6	byte&amp;0xf0	0xC0	system module
&gt;6	byte&amp;0xf0	0xD0	file manager
&gt;6	byte&amp;0xf0	0xE0	device driver
&gt;6	byte&amp;0xf0	0xF0	device descriptor
#
# OS9/m68k stuff (to be continued)
#
0	beshort		0x4AFC	OS9/68K module:
#
# attr
&gt;0x14	byte&amp;0x80	0x80	re-entrant
&gt;0x14	byte&amp;0x40	0x40	ghost
&gt;0x14	byte&amp;0x20	0x20	system-state
#
# lang:
#
&gt;0x13	byte		1	machine language
&gt;0x13	byte		2	BASIC I-code
&gt;0x13	byte		3	Pascal P-code
&gt;0x13	byte		4	C I-code
&gt;0x13	byte		5	COBOL I-code
&gt;0x13	byte		6	Fortran I-code
#
#
# type:
#
&gt;0x12	byte		1	program executable
&gt;0x12	byte		2	subroutine
&gt;0x12	byte		3	multi-module
&gt;0x12	byte		4	data module
&gt;0x12	byte		11	trap library
&gt;0x12	byte		12	system module
&gt;0x12	byte		13	file manager
&gt;0x12	byte		14	device driver
&gt;0x12	byte		15	device descriptor

#------------------------------------------------------------------------------
# $File: osf1,v 1.7 2009/09/19 16:28:11 christos Exp $
#
# Mach magic number info
#
0	long		0xefbe	OSF/Rose object
# I386 magic number info
#
0	short		0565	i386 COFF object

#------------------------------------------------------------------------------
# $File: palm,v 1.13 2014/03/30 21:40:08 christos Exp $
# palm:	 file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
#
# Brian Lalor &lt;blalor@hcirisc.cs.binghamton.edu&gt;

# These are weak, byte 59 is not guaranteed to be 0 and there are
# 8 character identifiers at byte 60, one I found for appl is BIGb.
# What are the possibilities and where is this documented?

# The common header format for PalmOS .pdb/.prc files is
# {
#         char            name[ 32 ];
#         Word            attributes;
#         Word            version;
#         DWord           creationDate;
#         DWord           modificationDate;
#         DWord           lastBackupDate;
#         DWord           modificationNumber;
#         DWord           appInfoID;
#         DWord           sortInfoID;
#         char            type[4];
#         char            creator[4];
#         DWord           uniqueIDSeed;
#         RecordListType  recordList;
# };
#
# Datestamps are unsigned seconds since the MacOS epoch (Jan 1, 1904),
# or Unix/POSIX time + 2082844800.

0		name		aportisdoc
# date is supposed to be big-endian seconds since 1 Jan 1904, but many
# files contain the timestamp in little-endian or a completely
# nonsensical value...
#&gt;36		bedate-2082844800	&gt;0	\b, created %s
# compression: 1=uncomp, 2=orig, 0x4448=HuffDic
&gt;(78.L)		beshort		=1		\b, uncompressed
# compressed
&gt;(78.L)		beshort		&gt;1
&gt;&gt;(78.L+4)	belong		x		\b, %d bytes uncompressed

# appl
#60		string		appl		PalmOS application
#&gt;0		string		&gt;\0		&quot;%s&quot;

# HACK
#60		string		HACK		HackMaster hack
#&gt;0		string		&gt;\0		&quot;%s&quot;

# iSiloX e-book
60		string		SDocSilX	iSiloX E-book
&gt;0		string		&gt;\0		&quot;%s&quot;

# Mobipocket (www.mobipocket.com), donated by Carl Witty
# expanded by Ralf Brown
60		string	 	BOOKMOBI	Mobipocket E-book
# MobiPocket stores a full title, pointed at by the belong at offset
# 0x54 in its header at (78.L), with length given by the belong at
# offset 0x58.
# there&#039;s no guarantee that the title string is null-terminated, but
# we currently can&#039;t specify a variable-length string where the length
# field is not at the start of the string; in practice, the data
# following the string always seems to start with a zero byte
&gt;(78.L)		belong		x
&gt;&gt;&amp;(&amp;0x50.L-4)	string		&gt;\0		&quot;%s&quot;
&gt;0		use		aportisdoc
&gt;&gt;(78.L+0x68)	belong		&gt;0		\b, version %d
&gt;&gt;(78.L+0x1C)	belong		!0		\b, codepage %d
&gt;&gt;(78.L+0x0C)	beshort	 	&gt;0		\b, encrypted (type %d)

# AportisDoc/PalmDOC
60		string		TEXtREAd	AportisDoc/PalmDOC E-book
&gt;0		string		&gt;\0		&quot;%s&quot;
&gt;0		use		aportisdoc

# Variety of PalmOS document types
# Michael-John Turner &lt;mj@debian.org&gt;
# Thanks to Hasan Umit Ezerce &lt;humit@tr-net.net.tr&gt; for his DocType
60	string			BVokBDIC	BDicty PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			DB99DBOS	DB PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			vIMGView	FireViewer/ImageViewer PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			PmDBPmDB	HanDBase PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			InfoINDB	InfoView PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			ToGoToGo	iSilo PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			JfDbJBas	JFile PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			JfDbJFil	JFile Pro PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			DATALSdb	List PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			Mdb1Mdb1	MobileDB PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			PNRdPPrs	PeanutPress PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			DataPlkr	Plucker PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			DataSprd	QuickSheet PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			SM01SMem	SuperMemo PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			TEXtTlDc	TealDoc PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			InfoTlIf	TealInfo PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			DataTlMl	TealMeal PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			DataTlPt	TealPaint PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			dataTDBP	ThinkDB PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			TdatTide	Tides PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;
60	string			ToRaTRPW	TomeRaider PalmOS document
&gt;0	string			&gt;\0		&quot;%s&quot;

# A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
# For version 1.xx zTXTs, outputs version and numbers of bookmarks and
#   annotations.
# For other versions, just outputs version.
#
60		string		zTXT		A GutenPalm zTXT e-book
&gt;0		string		&gt;\0		&quot;%s&quot;
&gt;(0x4E.L)	byte		0
&gt;&gt;(0x4E.L+1)	byte		x		(v0.%02d)
&gt;(0x4E.L)	byte		1
&gt;&gt;(0x4E.L+1)	byte		x		(v1.%02d)
&gt;&gt;&gt;(0x4E.L+10)	beshort		&gt;0
&gt;&gt;&gt;&gt;(0x4E.L+10) beshort		&lt;2		- 1 bookmark
&gt;&gt;&gt;&gt;(0x4E.L+10) beshort		&gt;1		- %d bookmarks
&gt;&gt;&gt;(0x4E.L+14)	beshort		&gt;0
&gt;&gt;&gt;&gt;(0x4E.L+14) beshort		&lt;2		- 1 annotation
&gt;&gt;&gt;&gt;(0x4E.L+14) beshort		&gt;1		- %d annotations
&gt;(0x4E.L)	byte		&gt;1		(v%d.
&gt;&gt;(0x4E.L+1)	byte		x		%02d)

# Palm OS .prc file types
60		string		libr
# flags, only bit 0 or bit 6
# http://en.wikipedia.org/wiki/PRC_%28Palm_OS%29
# http://web.mit.edu/tytso/www/pilot/prc-format.html
&gt;0x20		beshort&amp;0xffbe	0
&gt;&gt;0		string		&gt;\0		Palm OS dynamic library data &quot;%s&quot;
60		string		ptch		Palm OS operating system patch data
&gt;0		string		&gt;\0		&quot;%s&quot;

# Mobipocket (www.mobipocket.com), donated by Carl Witty
60	string			BOOKMOBI	Mobipocket E-book
&gt;0	string			&gt;\0		&quot;%s&quot;

#------------------------------------------------------------------------------
# $File: parix,v 1.4 2009/09/19 16:28:11 christos Exp $
#
# Parix COFF executables
# From: Ignatios Souvatzis &lt;ignatios@cs.uni-bonn.de&gt;
#
0	beshort&amp;0xfff	0xACE	PARIX
&gt;0	byte&amp;0xf0	0x80	T800
&gt;0	byte&amp;0xf0	0x90	T9000
&gt;19	byte&amp;0x02	0x02	executable
&gt;19	byte&amp;0x02	0x00	object
&gt;19	byte&amp;0x0c	0x00	not stripped
#------------------------------------------------------------------------------
# $File: parrot,v 1.1 2010/07/08 20:18:40 christos Exp $
# parrot: file(1) magic for Parrot Virtual Machine
# URL:	http://www.lua.org/
# From: Lubomir Rintel &lt;lkundrak@v3.sk&gt;

# Compiled Parrot byte code
0	string	\376PBC\r\n\032\n	Parrot bytecode
&gt;64	byte	x			%d.
&gt;72	byte	x			\b%d,
&gt;8	byte	&gt;0			%d byte words,
&gt;16	byte	0			little-endian,
&gt;16	byte	1			big-endian,
&gt;32	byte	0			IEEE-754 8 byte double floats,
&gt;32	byte	1			x86 12 byte long double floats,
&gt;32	byte	2			IEEE-754 16 byte long double floats,
&gt;32	byte	3			MIPS 16 byte long double floats,
&gt;32	byte	4			AIX 16 byte long double floats,
&gt;32	byte	5			4-byte floats,
&gt;40	byte	x			Parrot %d.
&gt;48	byte	x			\b%d.
&gt;56	byte	x			\b%d
#------------------------------------------------------------------------------
# $File: pascal,v 1.2 2014/07/14 14:21:33 rrt Exp $
# pascal:  file(1) magic for Pascal source
#
0	search/8192	(input,		Pascal source text
!:mime	text/x-pascal
#0	regex		\^program	Pascal source text
#!:mime	text/x-pascal
#0	regex           	\^record		Pascal source text
#!:mime	text/x-pascal

#------------------------------------------------------------------------------
# $File: pbf,v 1.2 2017/01/18 16:16:21 christos Exp $
# file(1) magic(5) data for OpenStreetMap

# OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
# http://wiki.openstreetmap.org/wiki/PBF_Format
# From: Markus Heidelberg &lt;markus.heidelberg@web.de&gt;
0	belong&amp;0xfffffff0	0
&gt;4	beshort			0x0A09
&gt;&gt;6	string			OSMHeader	OpenStreetMap Protocolbuffer Binary Format

#------------------------------------------------------------------------------
# $File: pbm,v 1.6 2009/09/19 16:28:11 christos Exp $
# pbm:  file(1) magic for Portable Bitmap files
#
# XXX - byte order?
#
0	short	0x2a17	&quot;compact bitmap&quot; format (Poskanzer)
#------------------------------------------------------------------------------
# pc88:  file(1) magic for the NEC Home Computer
# v1.0
# Fabio R. Schmidlin &lt;sd-snatcher@users.sourceforge.net&gt;

# PC88 2D disk image
0x20		ulelong&amp;0xFFFFFEFF	0x2A0
&gt;0x10		string		\0\0\0\0\0\0\0\0\0\0
&gt;&gt;0x280		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
&gt;&gt;&gt;0x1A		ubyte&amp;0xEF	0
&gt;&gt;&gt;&gt;0x1B	ubyte&amp;0x8F	0
&gt;&gt;&gt;&gt;&gt;0x1B	ubyte&amp;70	&lt;0x40
&gt;&gt;&gt;&gt;&gt;&gt;0x1C	ulelong	&gt;0x21
&gt;&gt;&gt;&gt;&gt;&gt;&gt;0		regex	[[:print:]]*	NEC PC-88 disk image, name=%s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1B	ubyte	0	\b, media=2D
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1B	ubyte	0x10	\b, media=2DD
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1B	ubyte	0x20	\b, media=2HD
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1B	ubyte	0x30	\b, media=1D
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1B	ubyte	0x40	\b, media=1DD
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;0x1A	ubyte	0x10	\b, write-protected


#------------------------------------------------------------------------------
# pc98:  file(1) magic for the MSX Home Computer
# v1.0
# Fabio R. Schmidlin &lt;sd-snatcher@users.sourceforge.net&gt;

# Maki-chan v1 Graphic format
# The image resolution should be X=(44.L - 40.L) and Y=(46.L - 42.L), but I couldn&#039;t find a way to do so
# http://www.jisyo.com/viewer/faq/maki_tech.htm
0	string/b		MAKI01 	Maki-chan v1.
&gt;6	ubyte|0x20	x		\b%c image
&gt;8	ubelong		&gt;0x40404040	\b, system ID:
&gt;&gt;8	byte		x		%c
&gt;&gt;9	byte		x		\b%c
&gt;&gt;10	byte		x		\b%c
&gt;&gt;11	byte		x		\b%c
&gt;44	ubeshort	x		\b, %dx
&gt;46	ubeshort	x		\b%d
&gt;38	ubeshort&amp;2	0		\b, 16 paletted RGB colors
&gt;38	ubeshort&amp;2	2		\b, 8 fixed RGB colors
&gt;38	ubeshort&amp;1	1		\b, 2:1 dot aspect ratio

# Maki-chan v2 Graphic format
# http://www.jisyo.com/viewer/faq/mag_tech.htm
# http://mooncore.eu/bunny/txt/makichan.htm
# http://metanest.jp/mag/mag.xhtml
0	string/b		MAKI02\ \ 	Maki-chan v2 image,
&gt;8	byte		x		system ID: %c
&gt;9	byte		x		\b%c
&gt;10	byte		x		\b%c
&gt;11	byte		x		\b%c,
&gt;13	search/0x200	\x1A
#Maki-chan video modes are a bit messy and seems to have been expanded over the years without too much planing:
#1) When offset1(ubeshort) !=0x0344:
# 1.1) And  offset3(ubyte).b7=0:
# - b0=pixel aspect ratio: 1=2:1   (note: this ignores that the machine&#039;s 1:1 pixel aspect ratio isn&#039;t really 1:1)
# - b1=number of colors: 0=16 colors, 1=8 colors
# - b2=Palette or fixed colors flag (called &quot;analog&quot; and &quot;digital&quot; in the doc): 0=Paletted, 1=Fixed colors encoded directly in the pixel data
# 1.2) And  offset3(ubyte).B7=1:
# - b0=256 paletted colors
# - b1=256 fixed colors using the MSX SCR8 palette
#2) When offset1(ubeshort) =0x0344:
# - 256x212 image with 19268 YJK colors. The usual resolution and color information fields from the file must be ignored
&gt;&gt;&amp;1	ubeshort	0x0344		256x212, 19268 fixed YJK colors
&gt;&gt;&amp;1	ubeshort	!0x0344
&gt;&gt;&gt;&amp;5	uleshort+1	x		%dx
&gt;&gt;&gt;&amp;7	uleshort+1	x		\b%d,
&gt;&gt;&gt;&amp;0	ubyte&amp;0x86	0x00		16 paletted RGB colors
&gt;&gt;&gt;&amp;0	ubyte&amp;0x86	0x02		8 paletted RGB colors
&gt;&gt;&gt;&amp;0	ubyte&amp;0x86	0x04		16 fixed RGB colors
&gt;&gt;&gt;&amp;0	ubyte&amp;0x86	0x06		8 fixed RGB colors
&gt;&gt;&gt;&amp;0	ubyte&amp;0x81	0x80		256 paletted RGB colors
&gt;&gt;&gt;&amp;0	ubyte&amp;0x81	0x81		256 fixed MSX-SCR8 colors
&gt;&gt;&gt;&amp;0	ubyte&amp;0x01	1		\b, 2:1 dot aspect ratio

# XLD4 (Q4) picture
11	string/b	MAJYO		XLD4(Q4) picture

# Yanagisawa Pi picture
#0	string		Pi\x1A\0	Yanagisawa Pi picture
#&gt;3	search/0x200	\x04
0	string		Pi
&gt;2	search/0x200	\x1A
&gt;&gt;&amp;0	ubyte		0
&gt;&gt;&gt;&amp;3	ubyte		4		Yanagisawa Pi 16 color picture,
&gt;&gt;&gt;&amp;4	byte		x		system ID: %c
&gt;&gt;&gt;&amp;5	byte		x		\b%c
&gt;&gt;&gt;&amp;6	byte		x		\b%c
&gt;&gt;&gt;&amp;7	byte		x		\b%c,
&gt;&gt;&gt;&amp;10	ubeshort	x		%dx
&gt;&gt;&gt;&amp;12	ubeshort	x		\b%d
&gt;&gt;&gt;&amp;3	ubyte		8		Yanagisawa Pi 256 color picture
&gt;&gt;&gt;&amp;4	byte		x		system ID: %c
&gt;&gt;&gt;&amp;5	byte		x		\b%c
&gt;&gt;&gt;&amp;6	byte		x		\b%c
&gt;&gt;&gt;&amp;7	byte		x		\b%c,
&gt;&gt;&gt;&amp;10	ubeshort	x		%dx
&gt;&gt;&gt;&amp;12	ubeshort	x		\b%d

#------------------------------------------------------------------------------
# $File: pdf,v 1.9 2017/05/24 17:35:20 christos Exp $
# pdf:  file(1) magic for Portable Document Format
#

0	string		%PDF-		PDF document
!:mime	application/pdf
&gt;5	byte		x		\b, version %c
&gt;7	byte		x		\b.%c

0	string		\012%PDF-	PDF document
!:mime	application/pdf
&gt;6	byte		x		\b, version %c
&gt;8	byte		x		\b.%c

# From: Nick Schmalenberger &lt;nick@schmalenberger.us&gt;
# Forms Data Format
0       string          %FDF-           FDF document
!:mime application/vnd.fdf
&gt;5      byte            x               \b, version %c
&gt;7      byte            x               \b.%c

0	search/256	%PDF-		PDF document
!:mime	application/pdf
&gt;&amp;0	byte		x		\b, version %c
&gt;&amp;2	byte		x		\b.%c

#------------------------------------------------------------------------------
# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
#
0	lelong		0101555		PDP-11 single precision APL workspace
0	lelong		0101554		PDP-11 double precision APL workspace
#
# PDP-11 a.out
#
0	leshort		0407		PDP-11 executable
&gt;8	leshort		&gt;0		not stripped
&gt;15	byte		&gt;0		- version %d

# updated by Joerg Jenderek at Mar 2013
# GRR: line below too general as it catches also Windows precompiled setup information *.PNF
0	leshort		0401
# skip *.PNF with WinDirPathOffset 58h
&gt;68	ulelong		!0x00000058	PDP-11 UNIX/RT ldp
# skip *.PNF with high byte of InfVersionDatumCount zero
#&gt;&gt;15	byte		!0		PDP-11 UNIX/RT ldp
0	leshort		0405		PDP-11 old overlay

0	leshort		0410		PDP-11 pure executable
&gt;8	leshort		&gt;0		not stripped
&gt;15	byte		&gt;0		- version %d

0	leshort		0411		PDP-11 separate I&amp;D executable
&gt;8	leshort		&gt;0		not stripped
&gt;15	byte		&gt;0		- version %d

0	leshort		0437		PDP-11 kernel overlay

# These last three are derived from 2.11BSD file(1)
0	leshort		0413		PDP-11 demand-paged pure executable
&gt;8	leshort		&gt;0		not stripped

0	leshort		0430		PDP-11 overlaid pure executable
&gt;8	leshort		&gt;0		not stripped

0	leshort		0431		PDP-11 overlaid separate executable
&gt;8	leshort		&gt;0		not stripped
#------------------------------------------------------------------------------
# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $
# perl:  file(1) magic for Larry Wall&#039;s perl language.
#
# The `eval&#039; lines recognizes an outrageously clever hack.
# Keith Waclena &lt;keith@cerberus.uchicago.edu&gt;
# Send additions to &lt;perl5-porters@perl.org&gt;
0	search/1024	eval\ &quot;exec\ perl		Perl script text
!:mime	text/x-perl
0	search/1024	eval\ &quot;exec\ /bin/perl		Perl script text
!:mime	text/x-perl
0	search/1024	eval\ &quot;exec\ /usr/bin/perl	Perl script text
!:mime	text/x-perl
0	search/1024	eval\ &quot;exec\ /usr/local/bin/perl	Perl script text
!:mime	text/x-perl
0	search/1024	eval\ &#039;exec\ perl		Perl script text
!:mime	text/x-perl
0	search/1024	eval\ &#039;exec\ /bin/perl		Perl script text
!:mime	text/x-perl
0	search/1024	eval\ &#039;exec\ /usr/bin/perl	Perl script text
!:mime	text/x-perl
0	search/1024	eval\ &#039;exec\ /usr/local/bin/perl	Perl script text
!:mime	text/x-perl
0	search/1024	eval\ &#039;(exit\ $?0)&#039;\ &amp;&amp;\ eval\ &#039;exec	Perl script text
!:mime	text/x-perl
0	string	#!/usr/bin/env\ perl	Perl script text executable
!:mime	text/x-perl
0	string	#!\ /usr/bin/env\ perl	Perl script text executable
!:mime	text/x-perl
0	string	#!
&gt;0	regex	\^#!.*/bin/perl([[:space:]].*)*$	Perl script text executable
!:mime	text/x-perl

# by Dmitry V. Levin and Alexey Tourbin
# check the first line
0	search/8192	package
&gt;0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;	Perl5 module source text
!:strength + 40
# not &#039;p&#039;, check other lines
0	search/8192	!p
&gt;0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;
&gt;&gt;0	regex		\^1\ *;|\^(use|sub|my)\ .*[(;{=]	Perl5 module source text
!:strength + 75

# Perl POD documents
# From: Tom Hukins &lt;tom@eborcom.com&gt;
0	search/1024/W	\=pod\n		Perl POD document text
0	search/1024/W	\n\=pod\n	Perl POD document text
0	search/1024/W	\=head1\ 	Perl POD document text
0	search/1024/W	\n\=head1\ 	Perl POD document text
0	search/1024/W	\=head2\ 	Perl POD document text
0	search/1024/W	\n\=head2\ 	Perl POD document text
0	search/1024/W	\=encoding\ 	Perl POD document text
0	search/1024/W	\n\=encoding\ 	Perl POD document text


# Perl Storable data files.
0	string	perl-store	perl Storable (v0.6) data
&gt;4	byte	&gt;0	(net-order %d)
&gt;&gt;4	byte	&amp;01	(network-ordered)
&gt;&gt;4	byte	=3	(major 1)
&gt;&gt;4	byte	=2	(major 1)

0	string	pst0	perl Storable (v0.7) data
&gt;4	byte	&gt;0
&gt;&gt;4	byte	&amp;01	(network-ordered)
&gt;&gt;4	byte	=5	(major 2)
&gt;&gt;4	byte	=4	(major 2)
&gt;&gt;5	byte	&gt;0	(minor %d)

# This is Debian #742949 by Zefram &lt;zefram@fysh.org&gt;:
# -----------------------------------------------------------
# The Perl module Hash::SharedMem
# &lt;https://metacpan.org/release/Hash-SharedMem&gt; defines a file format
# for a key/value store.  Details of the file format are in the &quot;DESIGN&quot;
# file in the module distribution.  Magic:
0	bequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, big-endian
&gt;8	bequad	&lt;0x1000000
&gt;&gt;15	byte	&gt;2	\b, line size 2^%d byte
&gt;&gt;14	byte	&gt;2	\b, page size 2^%d byte
&gt;&gt;13	byte	&amp;1
&gt;&gt;&gt;13	byte	&gt;1	\b, max fanout %d
0	lequad	=0xa58afd185cbf5af7	Hash::SharedMem master file, little-endian
&gt;8	lequad	&lt;0x1000000
&gt;&gt;8	byte	&gt;2	\b, line size 2^%d byte
&gt;&gt;9	byte	&gt;2	\b, page size 2^%d byte
&gt;&gt;10	byte	&amp;1
&gt;&gt;&gt;10	byte	&gt;1	\b, max fanout %d
0	bequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, big-endian
&gt;8	bequad	&lt;0x1000000
&gt;&gt;15	byte	&gt;2	\b, line size 2^%d byte
&gt;&gt;14	byte	&gt;2	\b, page size 2^%d byte
&gt;&gt;13	byte	&amp;1
&gt;&gt;&gt;13	byte	&gt;1	\b, max fanout %d
0	lequad	=0xc693dac5ed5e47c2	Hash::SharedMem data file, little-endian
&gt;8	lequad	&lt;0x1000000
&gt;&gt;8	byte	&gt;2	\b, line size 2^%d byte
&gt;&gt;9	byte	&gt;2	\b, page size 2^%d byte
&gt;&gt;10	byte	&amp;1
&gt;&gt;&gt;10	byte	&gt;1	\b, max fanout %d

#------------------------------------------------------------------------------
# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $
# pgf: file(1) magic for Progressive Graphics File (PGF)
#
# &lt;http://www.libpgf.org/uploads/media/PGF_Details_01.pdf&gt;
# 2013 by Philipp Hahn &lt;pmhahn debian org&gt;
0 string PGF Progressive Graphics image data,
!:mime image/x-pgf
&gt;3	string	2	version %s,
&gt;3	string	4	version %s,
&gt;3	string	5	version %s,
&gt;3	string	6	version %s,
#	PGFPreHeader
#&gt;&gt;4	lelong	x	header size %d,
#	PGFHeader
&gt;&gt;8	lelong	x	%d x
&gt;&gt;12	lelong	x	%d,
&gt;&gt;16	byte	x	%d levels,
&gt;&gt;17	byte	x	compression level %d,
&gt;&gt;18	byte	x	%d bpp,
&gt;&gt;19	byte	x	%d channels,
&gt;&gt;20	clear	x
&gt;&gt;20	byte	0	bitmap,
&gt;&gt;20	byte	1	gray scale,
&gt;&gt;20	byte	2	indexed color,
&gt;&gt;20	byte	3	RGB color,
&gt;&gt;20	byte	4	CYMK color,
&gt;&gt;20	byte	5	HSL color,
&gt;&gt;20	byte	6	HSB color,
&gt;&gt;20	byte	7	multi-channel,
&gt;&gt;20	byte	8	duo tone,
&gt;&gt;20	byte	9	LAB color,
&gt;&gt;20	byte	10	gray scale 16,
&gt;&gt;20	byte	11	RGB color 48,
&gt;&gt;20	byte	12	LAB color 48,
&gt;&gt;20	byte	13	CYMK color 64,
&gt;&gt;20	byte	14	deep multi-channel,
&gt;&gt;20	byte	15	duo tone 16,
&gt;&gt;20	byte	17	RGBA color,
&gt;&gt;20	byte	18	gray scale 32,
&gt;&gt;20	byte	19	RGB color 12,
&gt;&gt;20	byte	20	RGB color 16,
&gt;&gt;20	byte	255	unknown format,
&gt;&gt;20	default	x	format
&gt;&gt;&gt;20	byte	x	\b %d,
&gt;&gt;21	byte	x	%d bpc
#	PGFPostHeader
#	Level-Sizes
#&gt;&gt;(4.l+4)	lelong x level 0 size: %d
#&gt;&gt;(4.l+8)	lelong x level 1 size: %d
#&gt;&gt;(4.l+12)	lelong x level 2 size: %d

#------------------------------------------------------------------------------
# $File: pgp,v 1.15 2018/02/24 16:11:23 christos Exp $
# pgp:  file(1) magic for Pretty Good Privacy
# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
#
# Update: Joerg Jenderek
# Note: verified by `gpg -v --debug 0x02 --list-packets &lt; PUBRING263_10.PGP`
#0		byte	0x99		MAYBE PGP 0x99
0		byte	0x99
# 99h~10;0110;01~2=old packet type;tag 6=Public-Key Packet;1=two-octet length
# A two-octet body header encodes packet lengths of 192~00C0h - 8383~20BFh
#&gt;1		ubeshort	x		\b, body length 0x%.4x
# skip Basic.Image Beauty.320 Pic.Icons by looking for low version number
#&gt;3		ubyte		x		\b, V=%u
#&gt;3		ubyte		&lt;5		VERSION OK
&gt;3		ubyte		&lt;5
# next packet type often b4h~(tag 13)~User ID Packet, b0h~(tag 12)~Trust packet
#&gt;&gt;(1.S+3)	ubyte	x		\b, next packet type 0x%x
# skip 9900-v4.bin 9902-v4.bin by looking for valid second packet type (bit 7=1)
#&gt;&gt;(1.S+3)	ubyte	&gt;0x7F		TYPE OK,
&gt;&gt;(1.S+3)	ubyte	&gt;0x7F
# old versions 2,3 implies Pretty Good Privacy
&gt;&gt;&gt;3		ubyte		&lt;4		PGP key public ring (v%u)
!:mime		application/pgp-keys
!:ext		pgp/ASD
&gt;&gt;&gt;&gt;4		beldate		x		created %s
# days that this key is valid. If this number is zero, then it does not expire
&gt;&gt;&gt;&gt;8		ubeshort	&gt;0		\b, %u days valid
&gt;&gt;&gt;&gt;8		ubeshort	=0		\b, not expire
# display key algorithm 1~RSA (Encrypt or Sign)
&gt;&gt;&gt;&gt;10		use		key_algo
# Multiprecision Integers (MPI) size
&gt;&gt;&gt;&gt;11		ubeshort	x		%u bits
# MPI
&gt;&gt;&gt;&gt;13		ubequad		x		MPI=0x%16.16llx...
# new version implies Pretty Good Privacy (PGP) &gt;= 5.0 or Gnu Privacy Guard (GPG)
&gt;&gt;&gt;3		ubyte		&gt;3		PGP/GPG key public ring (v%u)
!:mime		application/pgp-keys
!:ext		pgp/gpg/pkr/asd
&gt;&gt;&gt;&gt;4		beldate		x		created %s
# display key algorithm 17~DSA
&gt;&gt;&gt;&gt;8		use		key_algo
# Multiprecision Integers (MPI) size
&gt;&gt;&gt;&gt;9		ubeshort	x		%u bits
&gt;&gt;&gt;&gt;11		ubequad		x		MPI=0x%16.16llx...

0       beshort         0x9501                  PGP key security ring
!:mime	application/x-pgp-keyring
0       beshort         0x9500                  PGP key security ring
!:mime	application/x-pgp-keyring
0	beshort		0xa600			PGP encrypted data
#!:mime	application/pgp-encrypted
#0	string		-----BEGIN\040PGP	text/PGP armored data
!:mime	text/PGP # encoding: armored data
#&gt;15	string	PUBLIC\040KEY\040BLOCK-	public key block
#&gt;15	string	MESSAGE-		message
#&gt;15	string	SIGNED\040MESSAGE-	signed message
#&gt;15	string	PGP\040SIGNATURE-	signature

2	string	---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK-	PGP public key block
!:mime	application/pgp-keys
&gt;10	search/100	\n\n
&gt;&gt;&amp;0	use		pgp
0	string	-----BEGIN\040PGP\040MESSAGE-		PGP message
!:mime	application/pgp
&gt;10	search/100	\n\n
&gt;&gt;&amp;0	use		pgp
0	string	-----BEGIN\040PGP\040SIGNATURE-		PGP signature
!:mime	application/pgp-signature
&gt;10	search/100	\n\n
&gt;&gt;&amp;0	use		pgp

# Decode the type of the packet based on it&#039;s base64 encoding.
# Idea from Mark Martinec
# The specification is in RFC 4880, section 4.2 and 4.3:
# http://tools.ietf.org/html/rfc4880#section-4.2

0	name		pgp
&gt;0	byte		0x67		Reserved (old)
&gt;0	byte		0x68		Public-Key Encrypted Session Key (old)
&gt;0	byte		0x69		Signature (old)
&gt;0	byte		0x6a		Symmetric-Key Encrypted Session Key (old)
&gt;0	byte		0x6b		One-Pass Signature (old)
&gt;0	byte		0x6c		Secret-Key (old)
&gt;0	byte		0x6d		Public-Key (old)
&gt;0	byte		0x6e		Secret-Subkey (old)
&gt;0	byte		0x6f		Compressed Data (old)
&gt;0	byte		0x70		Symmetrically Encrypted Data (old)
&gt;0	byte		0x71		Marker (old)
&gt;0	byte		0x72		Literal Data (old)
&gt;0	byte		0x73		Trust (old)
&gt;0	byte		0x74		User ID (old)
&gt;0	byte		0x75		Public-Subkey (old)
&gt;0	byte		0x76		Unused (old)
&gt;0	byte		0x77
&gt;&gt;1	byte&amp;0xc0	0x00		Reserved
&gt;&gt;1	byte&amp;0xc0	0x40		Public-Key Encrypted Session Key
&gt;&gt;1	byte&amp;0xc0	0x80		Signature
&gt;&gt;1	byte&amp;0xc0	0xc0		Symmetric-Key Encrypted Session Key
&gt;0	byte		0x78
&gt;&gt;1	byte&amp;0xc0	0x00		One-Pass Signature
&gt;&gt;1	byte&amp;0xc0	0x40		Secret-Key
&gt;&gt;1	byte&amp;0xc0	0x80		Public-Key
&gt;&gt;1	byte&amp;0xc0	0xc0		Secret-Subkey
&gt;0	byte		0x79
&gt;&gt;1	byte&amp;0xc0	0x00		Compressed Data
&gt;&gt;1	byte&amp;0xc0	0x40		Symmetrically Encrypted Data
&gt;&gt;1	byte&amp;0xc0	0x80		Marker
&gt;&gt;1	byte&amp;0xc0	0xc0		Literal Data
&gt;0	byte		0x7a
&gt;&gt;1	byte&amp;0xc0	0x00		Trust
&gt;&gt;1	byte&amp;0xc0	0x40		User ID
&gt;&gt;1	byte&amp;0xc0	0x80		Public-Subkey
&gt;&gt;1	byte&amp;0xc0	0xc0		Unused [z%x]
&gt;0	byte		0x30
&gt;&gt;1	byte&amp;0xc0	0x00		Unused [0%x]
&gt;&gt;1	byte&amp;0xc0	0x40		User Attribute
&gt;&gt;1	byte&amp;0xc0	0x80		Sym. Encrypted and Integrity Protected Data
&gt;&gt;1	byte&amp;0xc0	0xc0		Modification Detection Code

# magic signatures to detect PGP crypto material (from stef)
# detects and extracts metadata from:
#  - symmetric encrypted packet header
#  - RSA (e=65537) secret (sub-)keys

# 1024b RSA encrypted data

0	string	\x84\x8c\x03		PGP RSA encrypted session key -
&gt;3	lelong	x			keyid: %X
&gt;7	lelong	x			%X
&gt;11	byte	0x01			RSA (Encrypt or Sign) 1024b
&gt;11	byte	0x02			RSA Encrypt-Only 1024b
&gt;12	string	\x04\x00
&gt;12	string	\x03\xff
&gt;12	string	\x03\xfe
&gt;12	string	\x03\xfd
&gt;12	string	\x03\xfc
&gt;12	string	\x03\xfb
&gt;12	string	\x03\xfa
&gt;12	string	\x03\xf9
&gt;142	byte	0xd2			.

# 2048b RSA encrypted data

0	string	\x85\x01\x0c\x03	PGP RSA encrypted session key -
&gt;4	lelong	x			keyid: %X
&gt;8	lelong	x			%X
&gt;12	byte	0x01			RSA (Encrypt or Sign) 2048b
&gt;12	byte	0x02			RSA Encrypt-Only 2048b
&gt;13	string	\x08\x00
&gt;13	string	\x07\xff
&gt;13	string	\x07\xfe
&gt;13	string	\x07\xfd
&gt;13	string	\x07\xfc
&gt;13	string	\x07\xfb
&gt;13	string	\x07\xfa
&gt;13	string	\x07\xf9
&gt;271	byte	0xd2			.

# 3072b RSA encrypted data

0	string	\x85\x01\x8c\x03	PGP RSA encrypted session key -
&gt;4	lelong	x			keyid: %X
&gt;8	lelong	x			%X
&gt;12	byte	0x01			RSA (Encrypt or Sign) 3072b
&gt;12	byte	0x02			RSA Encrypt-Only 3072b
&gt;13	string	\x0c\x00
&gt;13	string	\x0b\xff
&gt;13	string	\x0b\xfe
&gt;13	string	\x0b\xfd
&gt;13	string	\x0b\xfc
&gt;13	string	\x0b\xfb
&gt;13	string	\x0b\xfa
&gt;13	string	\x0b\xf9
&gt;399	byte	0xd2			.

# 3072b RSA encrypted data

0	string	\x85\x02\x0c\x03	PGP RSA encrypted session key -
&gt;4	lelong	x			keyid: %X
&gt;8	lelong	x			%X
&gt;12	byte	0x01			RSA (Encrypt or Sign) 4096b
&gt;12	byte	0x02			RSA Encrypt-Only 4096b
&gt;13	string	\x10\x00
&gt;13	string	\x0f\xff
&gt;13	string	\x0f\xfe
&gt;13	string	\x0f\xfd
&gt;13	string	\x0f\xfc
&gt;13	string	\x0f\xfb
&gt;13	string	\x0f\xfa
&gt;13	string	\x0f\xf9
&gt;527	byte	0xd2			.

# 4096b RSA encrypted data

0	string	\x85\x04\x0c\x03	PGP RSA encrypted session key -
&gt;4	lelong	x			keyid: %X
&gt;8	lelong	x			%X
&gt;12	byte	0x01			RSA (Encrypt or Sign) 8129b
&gt;12	byte	0x02			RSA Encrypt-Only 8129b
&gt;13	string	\x20\x00
&gt;13	string	\x1f\xff
&gt;13	string	\x1f\xfe
&gt;13	string	\x1f\xfd
&gt;13	string	\x1f\xfc
&gt;13	string	\x1f\xfb
&gt;13	string	\x1f\xfa
&gt;13	string	\x1f\xf9
&gt;1039	byte	0xd2			.

# crypto algo mapper

0	name	crypto
&gt;0	byte	0x00			Plaintext or unencrypted data
&gt;0	byte	0x01			IDEA
&gt;0	byte	0x02			TripleDES
&gt;0	byte	0x03			CAST5 (128 bit key)
&gt;0	byte	0x04			Blowfish (128 bit key, 16 rounds)
&gt;0	byte	0x07			AES with 128-bit key
&gt;0	byte	0x08			AES with 192-bit key
&gt;0	byte	0x09			AES with 256-bit key
&gt;0	byte	0x0a			Twofish with 256-bit key

# hash algo mapper

0	name	hash
&gt;0	byte	0x01			MD5
&gt;0	byte	0x02			SHA-1
&gt;0	byte	0x03			RIPE-MD/160
&gt;0	byte	0x08			SHA256
&gt;0	byte	0x09			SHA384
&gt;0	byte	0x0a			SHA512
&gt;0	byte	0x0b			SHA224

# display public key algorithms as human readable text
0	name	key_algo
&gt;0	byte	0x01			RSA (Encrypt or Sign)
# keep old look of version 5.28 without parentheses
&gt;0	byte	0x02			RSA Encrypt-Only
&gt;0	byte	0x03			RSA (Sign-Only)
&gt;0	byte	16			ElGamal (Encrypt-Only)
&gt;0	byte	17			DSA
&gt;0	byte	18			Elliptic Curve
&gt;0	byte	19			ECDSA
&gt;0	byte	20			ElGamal (Encrypt or Sign)
&gt;0	byte	21			Diffie-Hellman
&gt;0	default	x
&gt;&gt;0	ubyte	&lt;22			unknown (pub %d)
# this should never happen
&gt;&gt;0	ubyte	&gt;21			invalid (%d)

# pgp symmetric encrypted data

0	byte	0x8c			PGP symmetric key encrypted data -
&gt;1	byte	0x0d
&gt;1	byte	0x0c
&gt;2	byte	0x04
&gt;3	use	crypto
&gt;4	byte	0x01			salted -
&gt;&gt;5	use	hash
&gt;&gt;14	byte	0xd2			.
&gt;&gt;14	byte	0xc9			.
&gt;4	byte	0x03			salted &amp; iterated -
&gt;&gt;5	use	hash
&gt;&gt;15	byte	0xd2			.
&gt;&gt;15	byte	0xc9			.

# encrypted keymaterial needs s2k &amp; can be checksummed/hashed

0	name	chkcrypto
&gt;0	use	crypto
&gt;1	byte	0x00			Simple S2K
&gt;1	byte	0x01			Salted S2K
&gt;1	byte	0x03			Salted&amp;Iterated S2K
&gt;2	use	hash

# all PGP keys start with this prolog
# containing version, creation date, and purpose

0	name	keyprolog
&gt;0	byte	0x04
&gt;1	beldate	x			created on %s -
&gt;5	byte	0x01			RSA (Encrypt or Sign)
&gt;5	byte	0x02			RSA Encrypt-Only

# end of secret keys known signature
# contains e=65537 and the prolog to
# the encrypted parameters

0	name	keyend
&gt;0	string	\x00\x11\x01\x00\x01	e=65537
&gt;5	use	crypto
&gt;5	byte	0xff			checksummed
&gt;&gt;6	use	chkcrypto
&gt;5	byte	0xfe			hashed
&gt;&gt;6	use	chkcrypto

# PGP secret keys contain also the public parts
# these vary by bitsize of the key

0	name	x1024
&gt;0	use	keyprolog
&gt;6	string	\x03\xfe
&gt;6	string	\x03\xff
&gt;6	string	\x04\x00
&gt;136	use	keyend

0	name	x2048
&gt;0	use	keyprolog
&gt;6	string	\x80\x00
&gt;6	string	\x07\xfe
&gt;6	string	\x07\xff
&gt;264	use	keyend

0	name	x3072
&gt;0	use	keyprolog
&gt;6	string	\x0b\xfe
&gt;6	string	\x0b\xff
&gt;6	string	\x0c\x00
&gt;392	use	keyend

0	name	x4096
&gt;0	use	keyprolog
&gt;6	string	\x10\x00
&gt;6	string	\x0f\xfe
&gt;6	string	\x0f\xff
&gt;520	use	keyend

# \x00|\x1f[\xfe\xff]).{1024})&#039;
0	name	x8192
&gt;0	use	keyprolog
&gt;6	string	\x20\x00
&gt;6	string	\x1f\xfe
&gt;6	string	\x1f\xff
&gt;1032	use	keyend

# depending on the size of the pkt
# we branch into the proper key size
# signatures defined as x{keysize}

&gt;0	name	pgpkey
&gt;0	string	\x01\xd8	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x01\xeb	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x01\xfb	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x01\xfd	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x01\xf3	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x01\xee	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x01\xfe	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x01\xf4	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x02\x0d	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x02\x03	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x02\x05	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x02\x15	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x02\x00	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x02\x10	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x02\x04	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x02\x06	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x02\x16	1024b
&gt;&gt;2	use	x1024
&gt;0	string	\x03\x98	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xab	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xbb	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xbd	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xcd	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xb3	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xc3	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xc5	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xd5	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xae	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xbe	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xc0	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xd0	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xb4	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xc4	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xc6	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x03\xd6	2048b
&gt;&gt;2	use	x2048
&gt;0	string	\x05X		3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05k		3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05{		3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05}		3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05\x8d	3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05s		3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05\x83	3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05\x85	3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05\x95	3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05n		3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05\x7e	3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05\x80	3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05\x90	3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05t		3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05\x84	3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05\x86	3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x05\x96	3072b
&gt;&gt;2	use	x3072
&gt;0	string	\x07[		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07\x18	4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07+		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07;		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07=		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07M		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x073		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07C		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07E		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07U		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07.		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07&gt;		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07@		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07P		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x074		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07D		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07F		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x07V		4096b
&gt;&gt;2	use	x4096
&gt;0	string	\x0e[		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0e\x18	8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0e+		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0e;		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0e=		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0eM		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0e3		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0eC		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0eE		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0eU		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0e.		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0e&gt;		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0e@		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0eP		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0e4		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0eD		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0eF		8192b
&gt;&gt;2	use	x8192
&gt;0	string	\x0eV		8192b
&gt;&gt;2	use	x8192

# PGP RSA (e=65537) secret (sub-)key header

0	byte	0x95			PGP	Secret Key -
&gt;1	use	pgpkey
0	byte	0x97			PGP	Secret Sub-key -
&gt;1	use	pgpkey
0	byte	0x9d
# Update: Joerg Jenderek
# secret subkey packet (tag 7) with same structure as secret key packet (tag 5)
# skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len
&gt;1	ubeshort	&gt;0
#&gt;1	ubeshort	x		\b, body length 0x%x
# next packet type often 88h,89h~(tag 2)~Signature Packet
#&gt;&gt;(1.S+3)	ubyte	x		\b, next packet type 0x%x
# skip Dragon.SHR DEMO.INIT by looking for positive version
&gt;&gt;3	ubyte		&gt;0
# skip BUISSON.13 GUITAR1 by looking for low version number
&gt;&gt;&gt;3	ubyte		&lt;5		PGP Secret Sub-key
# sub-key are normally part of secret key. So it does not occur as standalone file
#!:ext	bin
# version 2,3~old 4~new . Comment following line for version 5.28 look
&gt;&gt;&gt;&gt;3	ubyte		x		(v%d)
&gt;&gt;&gt;&gt;3	ubyte		x		-
# old versions 2 or 3 but no real example found
&gt;&gt;&gt;&gt;3	ubyte		&lt;4
# 2 byte for key bits in version 5.28 look
&gt;&gt;&gt;&gt;&gt;11		ubeshort	x	%db
&gt;&gt;&gt;&gt;&gt;4		beldate		x	created on %s -
# old versions use 2 additional bytes after time stamp
#&gt;&gt;&gt;&gt;&gt;8		ubeshort	x	0x%x
# display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman
&gt;&gt;&gt;&gt;&gt;10	  	use		key_algo
&gt;&gt;&gt;&gt;&gt;(11.S/8)	ubequad		x
# look after first key
&gt;&gt;&gt;&gt;&gt;&gt;&amp;5	use		keyend
# new version
&gt;&gt;&gt;&gt;3	ubyte		&gt;3
&gt;&gt;&gt;&gt;&gt;9		ubeshort	x	%db
&gt;&gt;&gt;&gt;&gt;4		beldate		x	created on %s -
# display key algorithm
&gt;&gt;&gt;&gt;&gt;8		use		key_algo
&gt;&gt;&gt;&gt;&gt;(9.S/8)	ubequad		x
# look after first key for something like s2k
&gt;&gt;&gt;&gt;&gt;&gt;&amp;3	use		keyend

#------------------------------------------------------------------------------
# $File: pkgadd,v 1.6 2009/09/19 16:28:11 christos Exp $
# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
#
0       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)
!:mime	application/x-svr4-package

#------------------------------------------------------------------------------
# $File: plan9,v 1.5 2009/09/19 16:28:11 christos Exp $
# plan9:  file(1) magic for AT&amp;T Bell Labs&#039; Plan 9 executables
# From: &quot;Stefan A. Haubenthal&quot; &lt;polluks@web.de&gt;
#
0	belong		0x00000107	Plan 9 executable, Motorola 68k
0	belong		0x000001EB	Plan 9 executable, Intel 386
0	belong		0x00000247	Plan 9 executable, Intel 960
0	belong		0x000002AB	Plan 9 executable, SPARC
0	belong		0x00000407	Plan 9 executable, MIPS R3000
0	belong		0x0000048B	Plan 9 executable, AT&amp;T DSP 3210
0	belong		0x00000517	Plan 9 executable, MIPS R4000 BE
0	belong		0x000005AB	Plan 9 executable, AMD 29000
0	belong		0x00000647	Plan 9 executable, ARM 7-something
0	belong		0x000006EB	Plan 9 executable, PowerPC
0	belong		0x00000797	Plan 9 executable, MIPS R4000 LE
0	belong		0x0000084B	Plan 9 executable, DEC Alpha

#------------------------------------------------------------------------------
# $File: plus5,v 1.6 2009/09/19 16:28:11 christos Exp $
# plus5:  file(1) magic for Plus Five&#039;s UNIX MUMPS
#
# XXX - byte order?  Paging Hokey....
#
0	short		0x259		mumps avl global
&gt;2	byte		&gt;0		(V%d)
&gt;6	byte		&gt;0		with %d byte name
&gt;7	byte		&gt;0		and %d byte data cells
0	short		0x25a		mumps blt global
&gt;2	byte		&gt;0		(V%d)
&gt;8	short		&gt;0		- %d byte blocks
&gt;15	byte		0x00		- P/D format
&gt;15	byte		0x01		- P/K/D format
&gt;15	byte		0x02		- K/D format
&gt;15	byte		&gt;0x02		- Bad Flags

#------------------------------------------------------------------------------
# $File: polyml,v 1.1 2016/02/26 15:52:45 christos Exp $
# polyml:  file(1) magic for PolyML
#
# PolyML
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)

# [0]: http://www.polyml.org/
# [1]: https://github.com/polyml/polyml/blob/master/\
#	libpolyml/savestate.cpp#L146-L147
# [2]: https://github.com/polyml/polyml/blob/master/\
#	libpolyml/savestate.cpp#L1262-L1263

# Type: Poly/ML saved data
# From: Matthew Fernandez &lt;matthew.fernandez@gmail.com&gt;

0	string	POLYSAVE	Poly/ML saved state
&gt;8	long	x		version %u

0	string  POLYMODU	Poly/ML saved module
&gt;8	long	x		version %u

#------------------------------------------------------------------------------
# $File: printer,v 1.28 2017/03/17 22:20:22 christos Exp $
# printer:  file(1) magic for printer-formatted files
#

# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
0	string		%!		PostScript document text
!:mime	application/postscript
!:apple	ASPSTEXT
&gt;2	string		PS-Adobe-	conforming
&gt;&gt;11	string		&gt;\0		DSC level %.3s
&gt;&gt;&gt;15	string		EPS		\b, type %s
&gt;&gt;&gt;15	string		Query		\b, type %s
&gt;&gt;&gt;15	string		ExitServer	\b, type %s
&gt;&gt;&gt;15   search/1000		%%LanguageLevel:\040
&gt;&gt;&gt;&gt;&amp;0	string		&gt;\0		\b, Level %s
# Some PCs have the annoying habit of adding a ^D as a document separator
0	string		\004%!		PostScript document text
!:mime	application/postscript
!:apple	ASPSTEXT
&gt;3	string		PS-Adobe-	conforming
&gt;&gt;12	string		&gt;\0		DSC level %.3s
&gt;&gt;&gt;16	string		EPS		\b, type %s
&gt;&gt;&gt;16	string		Query		\b, type %s
&gt;&gt;&gt;16	string		ExitServer	\b, type %s
&gt;&gt;&gt;16   search/1000		%%LanguageLevel:\040
&gt;&gt;&gt;&gt;&amp;0	string		&gt;\0		\b, Level %s
0	string		\033%-12345X%!PS	PostScript document

# DOS EPS Binary File Header
# From: Ed Sznyter &lt;ews@Black.Market.NET&gt;
0       belong          0xC5D0D3C6      DOS EPS Binary File
&gt;4      long            &gt;0              Postscript starts at byte %d
&gt;&gt;8     long            &gt;0              length %d
&gt;&gt;&gt;12   long            &gt;0              Metafile starts at byte %d
&gt;&gt;&gt;&gt;16  long            &gt;0              length %d
&gt;&gt;&gt;20   long            &gt;0              TIFF starts at byte %d
&gt;&gt;&gt;&gt;24  long            &gt;0              length %d

# Summary: Adobe&#039;s PostScript Printer Description File
# Extension: .ppd
# Reference: http://partners.adobe.com/public/developer/en/ps/5003.PPD_Spec_v4.3.pdf, Section 3.8
# Submitted by: Yves Arrouye &lt;arrouye@marin.fdn.fr&gt;
#
0	string		*PPD-Adobe:\x20	PPD file
&gt;&amp;0	string		x		\b, version %s

# HP Printer Job Language
0	string		\033%-12345X@PJL	HP Printer Job Language data
# HP Printer Job Language
# The header found on Win95 HP plot files is the &quot;Silliest Thing possible&quot;
# (TM)
# Every driver puts the language at some random position, with random case
# (LANGUAGE and Language)
# For example the LaserJet 5L driver puts the &quot;PJL ENTER LANGUAGE&quot; in line 10
# From: Uwe Bonnes &lt;bon@elektron.ikp.physik.th-darmstadt.de&gt;
#
0	string		\033%-12345X@PJL	HP Printer Job Language data
&gt;&amp;0	string		&gt;\0			%s
&gt;&gt;&amp;0	string		&gt;\0			%s
&gt;&gt;&gt;&amp;0	string		&gt;\0			%s
&gt;&gt;&gt;&gt;&amp;0	string		&gt;\0			%s
#&gt;15	string		\ ENTER\ LANGUAGE\ =
#&gt;31	string		PostScript		PostScript

# From: Stefan Thurner &lt;thurners@nicsys.de&gt;
0	string		\033%-12345X@PJL
&gt;&amp;0	search/10000	%!			PJL encapsulated PostScript document text

# Rick Richardson &lt;rickrich@gmail.com&gt;

# For Fuji-Xerox Printers - HBPL stands for Host Based Printer Language
# For Oki Data Printers - HIPERC
# For Konica Minolta Printers - LAVAFLOW
# For Samsung Printers - QPDL
# For HP Printers - ZJS stands for Zenographics ZJStream
0	string		\033%-12345X@PJL	HP Printer Job Language data
&gt;0	search/10000	@PJL\ ENTER\ LANGUAGE=HBPL	- HBPL
&gt;0	search/10000	@PJL\ ENTER\ LANGUAGE=HIPERC	- Oki Data HIPERC
&gt;0	search/10000	@PJL\ ENTER\ LANGUAGE=LAVAFLOW	- Konica Minolta LAVAFLOW
&gt;0	search/10000	@PJL\ ENTER\ LANGUAGE=QPDL	- Samsung QPDL
&gt;0	search/10000	@PJL\ ENTER\ LANGUAGE\ =\ QPDL	- Samsung QPDL
&gt;0	search/10000	@PJL\ ENTER\ LANGUAGE=ZJS	- HP ZJS


# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\033E\033	HP PCL printer data
&gt;3	string		\&amp;l0A		- default page size
&gt;3	string		\&amp;l1A		- US executive page size
&gt;3	string		\&amp;l2A		- US letter page size
&gt;3	string		\&amp;l3A		- US legal page size
&gt;3	string		\&amp;l26A		- A4 page size
&gt;3	string		\&amp;l80A		- Monarch envelope size
&gt;3	string		\&amp;l81A		- No. 10 envelope size
&gt;3	string		\&amp;l90A		- Intl. DL envelope size
&gt;3	string		\&amp;l91A		- Intl. C5 envelope size
&gt;3	string		\&amp;l100A		- Intl. B5 envelope size
&gt;3	string		\&amp;l-81A		- No. 10 envelope size (landscape)
&gt;3	string		\&amp;l-90A		- Intl. DL envelope size (landscape)

# IMAGEN printer-ready files:
0	string	@document(		Imagen printer
# this only works if &quot;language xxx&quot; is first item in Imagen header.
&gt;10	string	language\ impress	(imPRESS data)
&gt;10	string	language\ daisy		(daisywheel text)
&gt;10	string	language\ diablo	(daisywheel text)
&gt;10	string	language\ printer	(line printer emulation)
&gt;10	string	language\ tektronix	(Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text&#039; if the file is human-readable.
# [GRR 950115:  missing &quot;postscript&quot; or &quot;ultrascript&quot; (whatever it was called)]
#
# Now magic for IMAGEN font files...
0	string		Rast		RST-format raster font data
&gt;45	string		&gt;0		face %s
# From Jukka Ukkonen
0	string		\033[K\002\0\0\017\033(a\001\0\001\033(g	Canon Bubble Jet BJC formatted data

# From &lt;mike@flyn.org&gt;
# These are the /etc/magic entries to decode data sent to an Epson printer.
0       string          \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P        Epson Stylus Color 460 data


#------------------------------------------------------------------------------
# zenographics:  file(1) magic for Zenographics ZjStream printer data
# Rick Richardson &lt;rickrich@gmail.com&gt;
0	string		JZJZ
&gt;0x12	string		ZZ		Zenographics ZjStream printer data (big-endian)
0	string		ZJZJ
&gt;0x12	string		ZZ		Zenographics ZjStream printer data (little-endian)


#------------------------------------------------------------------------------
# Oak Technologies printer stream
# Rick Richardson &lt;rickrich@gmail.com&gt;
0       string          OAK
&gt;0x07	byte		0
&gt;0x0b	byte		0	Oak Technologies printer stream

# This would otherwise be recognized as PostScript - nick@debian.org
0	string		%!VMF 		SunClock&#039;s Vector Map Format data

#------------------------------------------------------------------------------
# HP LaserJet 1000 series downloadable firmware file
0	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware

# From: Paolo &lt;oopla@users.sf.net&gt;
# Epson ESC/Page, ESC/PageColor
0	string	\x1b\x01@EJL	Epson ESC/Page language printer data

#------------------------------------------------------------------------------
# $File: project,v 1.5 2017/03/17 21:35:28 christos Exp $
# project:  file(1) magic for Project management
#
# Magic strings for ftnchek project files. Alexander Mai
0	string	FTNCHEK_\ P	project file for ftnchek
&gt;10	string	1		version 2.7
&gt;10	string	2		version 2.8 to 2.10
&gt;10	string	3		version 2.11 or later

#------------------------------------------------------------------------------
# $File: psdbms,v 1.8 2017/03/17 21:35:28 christos Exp $
# psdbms:  file(1) magic for psdatabase
#
# Update: Joerg Jenderek
# GRR: line below too general as it catches also some Panorama database *.pan ,
# AppleWorks word processor
0	belong&amp;0xff00ffff	0x56000000
# assume version starts with digit
&gt;1	regex/s			=^[0-9]		ps database
&gt;&gt;1	string	&gt;\0	version %s
# kernel name
&gt;&gt;4	string	&gt;\0	from kernel %s

#------------------------------------------------------------------------------
# $File: psl,v 1.2 2016/07/14 17:34:27 christos Exp $
# psl:  file(1) magic for Public Suffix List representations
# From: Daniel Kahn Gillmor &lt;dkg@fifthhorseman.net&gt;
# URL: https://publicsuffix.org
# see also: http://thread.gmane.org/gmane.network.dns.libpsl.bugs/162/focus=166

0	search/512	\n\n//\ ===BEGIN\ ICANN\ DOMAINS===\n\n Public Suffix List data

0	string	.DAFSA@PSL_
&gt;15	string	\n	Public Suffix List data (optimized)
&gt;&gt;11	byte	&gt;0x2f
&gt;&gt;&gt;11	byte	&lt;0x3a   (Version %c)

#------------------------------------------------------------------------------
# $File: pulsar,v 1.5 2009/09/19 16:28:12 christos Exp $
# pulsar:  file(1) magic for Pulsar POP3 daemon binary files
#
# http://pulsar.sourceforge.net
# mailto:rok.papez@lugos.si
#

0	belong	0x1ee7f11e	Pulsar POP3 daemon mailbox cache file.
&gt;4	ubelong	x		Version: %d.
&gt;8	ubelong	x		\b%d


#------------------------------------------------------------------------------
# $File: pwsafe,v 1.1 2012/10/25 00:12:19 christos Exp $
# pwsafe: file(1) magic for passwordsafe file
#
# Password Safe
# http://passwordsafe.sourceforge.net/
# file format specs
# http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV3.txt
# V2 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/formatV2.txt
# V1 http://passwordsafe.svn.sourceforge.net/viewvc/passwordsafe/trunk/pwsafe/pwsafe/docs/notes.txt
# V2 and V1 have no easy identifier that I can find
# .psafe3
0	string	PWS3	Password Safe V3 database

#------------------------------------------------------------------------------
# $File: pyramid,v 1.7 2009/09/19 16:28:12 christos Exp $
# pyramid:  file(1) magic for Pyramids
#
# XXX - byte order?
#
0	long		0x50900107	Pyramid 90x family executable
0	long		0x50900108	Pyramid 90x family pure executable
&gt;16	long		&gt;0		not stripped
0	long		0x5090010b	Pyramid 90x family demand paged pure executable
&gt;16	long		&gt;0		not stripped

#------------------------------------------------------------------------------
# $File: python,v 1.34 2017/08/14 07:40:38 christos Exp $
# python:  file(1) magic for python
#
# Outlook puts &quot;&quot;&quot; too for urgent messages
# From: David Necas &lt;yeti@physics.muni.cz&gt;
# often the module starts with a multiline string
0	string/t	&quot;&quot;&quot;	Python script text executable
# MAGIC as specified in Python/import.c (1.5 to 2.7a0 and 3.1a0, assuming
# that Py_UnicodeFlag is off for Python 2)
# two bytes of magic followed by &quot;\r\n&quot; in little endian order
0	belong		0x994e0d0a	python 1.5/1.6 byte-compiled
0	belong		0x87c60d0a	python 2.0 byte-compiled
0	belong		0x2aeb0d0a	python 2.1 byte-compiled
0	belong		0x2ded0d0a	python 2.2 byte-compiled
0	belong		0x3bf20d0a	python 2.3 byte-compiled
0	belong		0x6df20d0a	python 2.4 byte-compiled
0	belong		0xb3f20d0a	python 2.5 byte-compiled
0	belong		0xd1f20d0a	python 2.6 byte-compiled
0	belong		0x03f30d0a	python 2.7 byte-compiled
0	belong		0x3b0c0d0a	python 3.0 byte-compiled
0	belong		0x4f0c0d0a	python 3.1 byte-compiled
0	belong		0x6c0c0d0a	python 3.2 byte-compiled
0	belong		0x9e0c0d0a	python 3.3 byte-compiled
0	belong		0xee0c0d0a	python 3.4 byte-compiled
0	belong		0x160d0d0a	python 3.5.1- byte-compiled
0	belong		0x170d0d0a	python 3.5.2+ byte-compiled
0	belong		0x330d0d0a	python 3.6 byte-compiled
0	belong		0x3e0d0d0a	python 3.7 byte-compiled


0	search/1/w	#!\040/usr/bin/python	Python script text executable
!:strength + 15
!:mime text/x-python
0	search/1/w	#!\040/usr/local/bin/python	Python script text executable
!:strength + 15
!:mime text/x-python
0	search/1	#!/usr/bin/env\ python	Python script text executable
!:strength + 15
!:mime text/x-python
0	search/10	#!\040/usr/bin/env\ python	Python script text executable
!:strength + 15
!:mime text/x-python

0       search/1/wt     #!\ /usr/libexec/platform-python        Python script text executable
!:strength + 15
!:mime text/x-python

0       search/1/wt     #!\ /usr/bin/python2    Python script text executable
!:strength + 15
!:mime text/x-python

0       search/1/wt     #!\ /usr/bin/python3    Python script text executable
!:strength + 15
!:mime text/x-python


# from module.submodule import func1, func2
0	regex		\^from[\040\t\f\r\n]+([A-Za-z0-9_]|\\.)+[\040\t\f\r\n]+import.*$	Python script text executable
!:strength + 15
!:mime text/x-python

# def __init__ (self, ...):
0	search/4096	def\ __init__
&gt;&amp;0	search/64 self	Python script text executable
!:strength + 15
!:mime text/x-python

# if __name__ == &quot;__main__&quot;:
0 search/4096 if\ __name__
&gt;&amp;0 search/64 &#039;__main__&#039;	Python script text executable
&gt;&amp;0 search/64 &quot;__main__&quot;	Python script text executable
!:strength + 15
!:mime text/x-python

# import module [as abrev]
0	regex	\^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
!:mime text/x-python

# comments
#0	search/4096	&#039;&#039;&#039;
#&gt;&amp;0	regex	.*&#039;&#039;&#039;$	Python script text executable
#!:mime text/x-python

#0	search/4096	&quot;&quot;&quot;
#&gt;&amp;0	regex	.*&quot;&quot;&quot;$	Python script text executable
#!:mime text/x-python

# try:
# except: or finally:
# block
0	search/4096	try:
&gt;&amp;0	regex	\^[[:space:]]*except.*:$	Python script text executable
!:strength + 15
!:mime text/x-python
&gt;&amp;0	search/4096	finally:	Python script text executable
!:mime text/x-python

# class name[(base classes,)]: [pass]
0	regex	\^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$		Python script text executable
!:strength + 15
!:mime text/x-python

# def name(*args, **kwargs):
0	regex	 \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100}
&gt;&amp;0	regex	 \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable
!:strength + 15
!:mime text/x-python

#------------------------------------------------------------------------------
# $File: qt,v 1.2 2014/12/16 19:49:29 christos Exp $
# qt:  file(1) magic for Qt

# http://doc.qt.io/qt-5/resources.html
0	string		\&lt;!DOCTYPE\040RCC\&gt;	Qt Resource Collection file

# https://qt.gitorious.org/qt/qtbase/source/\
# 5367fa356233da4c0f28172a8f817791525f5457:\
# src/tools/rcc/rcc.cpp#L840
0	string		qres\0\0		Qt Binary Resource file
0	search/1024	The\040Resource\040Compiler\040for\040Qt	Qt C-code resource file

# https://qt.gitorious.org/qt/qtbase/source/\
# 5367fa356233da4c0f28172a8f817791525f5457:\
# src/corelib/kernel/qtranslator.cpp#L62
0	string		\x3c\xb8\x64\x18\xca\xef\x9c\x95
&gt;8	string		\xcd\x21\x1c\xbf\x60\xa1\xbd\xdd	Qt Translation file

#------------------------------------------------------------------------------
# $File: revision,v 1.10 2017/10/19 16:40:37 christos Exp $
# file(1) magic for revision control files
# From Hendrik Scholz &lt;hendrik@scholz.net&gt;
0	string/t	/1\ :pserver:	cvs password text file

# Conary changesets
# From: Jonathan Smith &lt;smithj@rpath.com&gt;
0	belong	0xea3f81bb	Conary changeset data

# Type: Git bundles (git-bundle)
# From: Josh Triplett &lt;josh@freedesktop.org&gt;
0	string	#\ v2\ git\ bundle\n	Git bundle

# Type: Git pack
# From: Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
# Update: Joerg Jenderek
# URL: http://fileformats.archiveteam.org/wiki/Git
# reference: https://github.com/git/git/blob/master/Documentation/technical/pack-format.txt
# The actual magic is &#039;PACK&#039;, but that clashes with Doom/Quake packs. However,
# those have a little-endian offset immediately following the magic &#039;PACK&#039;,
# the first byte of which is never 0, while the first byte of the Git pack
# version, since it&#039;s a tiny number stored in big-endian format, is always 0.
0	string	PACK
# GRR: line above is too general as it matches also PackDir archive ./acorn
# test for major version. Git 2017 accepts version number 2 or 3
&gt;4	ubelong	&lt;9
# Acorn PackDir with method 0 compression has root like ADFS::HardDisc4.$.AsylumSrc
# or SystemDevice::foobar
&gt;&gt;9	search/13 ::
# but in git binary
&gt;&gt;9	default	x	Git pack
!:mime	application/x-git
!:ext	pack
# 4 GB limit implies unsigned integer
&gt;&gt;&gt;4	ubelong	x		\b, version %u
&gt;&gt;&gt;8	ubelong	x		\b, %u objects

# Type: Git pack index
# From: Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
0	string	\377tOc		Git pack index
&gt;4	belong	=2		\b, version 2

# Type: Git index file
# From: Frederic Briare &lt;fbriere@fbriere.net&gt;
0	string	DIRC		Git index
&gt;4	belong	&gt;0		\b, version %d
&gt;&gt;8	belong	&gt;0		\b, %d entries

# Type:	Mercurial bundles
# From:	Seo Sanghyeon &lt;tinuviel@sparcs.kaist.ac.kr&gt;
0	string	HG10		Mercurial bundle,
&gt;4	string	UN		uncompressed
&gt;4	string	BZ		bzip2 compressed

# Type:	Subversion (SVN) dumps
# From:	Uwe Zeisberger &lt;zeisberg@informatik.uni-freiburg.de&gt;
0	string	SVN-fs-dump-format-version:	Subversion dumpfile
&gt;28	string	&gt;\0				(version: %s)

# Type:	Bazaar revision bundles and merge requests
# URL:	http://www.bazaar-vcs.org/
# From:	Jelmer Vernooij &lt;jelmer@samba.org&gt;
0	string	#\ Bazaar\ revision\ bundle\ v Bazaar Bundle
0	string	#\ Bazaar\ merge\ directive\ format Bazaar merge directive

#------------------------------------------------------------------------------
# $File: riff,v 1.33 2017/10/06 01:11:24 christos Exp $
# riff:  file(1) magic for RIFF format
# See
#
#	http://www.seanet.com/users/matts/riffmci/riffmci.htm
#	http://www-mmsp.ece.mcgill.ca/Documents/AudioFormats/WAVE/Docs/riffmci.pdf
#

# audio format tag. Assume limits: max 1024 bit, 128 channels, 1 MHz
0   name    riff-wave
&gt;0	leshort		1		\b, Microsoft PCM
&gt;&gt;14	leshort		&gt;0
&gt;&gt;&gt;14	leshort		&lt;1024	\b, %d bit
&gt;0	leshort		2		\b, Microsoft ADPCM
&gt;0	leshort		6		\b, ITU G.711 A-law
&gt;0	leshort		7		\b, ITU G.711 mu-law
&gt;0	leshort		8		\b, Microsoft DTS
&gt;0	leshort		17		\b, IMA ADPCM
&gt;0	leshort		20		\b, ITU G.723 ADPCM (Yamaha)
&gt;0	leshort		49		\b, GSM 6.10
&gt;0	leshort		64		\b, ITU G.721 ADPCM
&gt;0	leshort		80		\b, MPEG
&gt;0	leshort		85		\b, MPEG Layer 3
&gt;0	leshort		0x2001		\b, DTS
&gt;2	leshort		=1		\b, mono
&gt;2	leshort		=2		\b, stereo
&gt;2	leshort		&gt;2
&gt;&gt;2	leshort		&lt;128	\b, %d channels
&gt;4	lelong		&gt;0
&gt;&gt;4	lelong		&lt;1000000	%d Hz

# try to find &quot;fmt &quot;
0   name    riff-walk
&gt;0  string  fmt\x20
&gt;&gt;4 lelong  &lt;0x80
&gt;&gt;&gt;8 use    riff-wave
&gt;0  string  LIST
&gt;&gt;&amp;(4.l+4)  use riff-walk
&gt;0  string  DISP
&gt;&gt;&amp;(4.l+4)  use riff-walk
&gt;0  string  bext
&gt;&gt;&amp;(4.l+4)  use riff-walk
&gt;0  string  Fake
&gt;&gt;&amp;(4.l+4)  use riff-walk
&gt;0  string  fact
&gt;&gt;&amp;(4.l+4)  use riff-walk
&gt;0  string  VP8
&gt;&gt;11		byte		0x9d
&gt;&gt;&gt;12		byte		0x01
&gt;&gt;&gt;&gt;13		byte		0x2a	\b, VP8 encoding
&gt;&gt;&gt;&gt;&gt;14		leshort&amp;0x3fff	x	\b, %d
&gt;&gt;&gt;&gt;&gt;16		leshort&amp;0x3fff	x	\bx%d, Scaling:
&gt;&gt;&gt;&gt;&gt;14		leshort&amp;0xc000	0x0000	\b [none]
&gt;&gt;&gt;&gt;&gt;14		leshort&amp;0xc000	0x1000	\b [5/4]
&gt;&gt;&gt;&gt;&gt;14		leshort&amp;0xc000	0x2000	\b [5/3]
&gt;&gt;&gt;&gt;&gt;14		leshort&amp;0xc000	0x3000	\b [2]
&gt;&gt;&gt;&gt;&gt;14		leshort&amp;0xc000	0x0000	\bx[none]
&gt;&gt;&gt;&gt;&gt;14		leshort&amp;0xc000	0x1000	\bx[5/4]
&gt;&gt;&gt;&gt;&gt;14		leshort&amp;0xc000	0x2000	\bx[5/3]
&gt;&gt;&gt;&gt;&gt;14		leshort&amp;0xc000	0x3000	\bx[2]
&gt;&gt;&gt;&gt;&gt;15		byte&amp;0x80	=0x00	\b, YUV color
&gt;&gt;&gt;&gt;&gt;15		byte&amp;0x80	=0x80	\b, bad color specification
&gt;&gt;&gt;&gt;&gt;15		byte&amp;0x40	=0x40	\b, no clamping required
&gt;&gt;&gt;&gt;&gt;15		byte&amp;0x40	=0x00	\b, decoders should clamp
#&gt;0  string  x		we got %s
#&gt;&gt;&amp;(4.l+4)  use riff-walk

# AVI section extended by Patrik Radman &lt;patrik+file-magic@iki.fi&gt;
#
0	string		RIFF		RIFF (little-endian) data
# RIFF Palette format
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Resource_Interchange_File_Format
# Reference: http://worms2d.info/Palette_file
&gt;8	string		PAL\ 		\b, palette
!:mime	application/x-riff
# color palette by Microsoft Corporation
!:ext	pal
# file size =  chunk size + 8 in most cases
&gt;&gt;4	ulelong+8	x		\b, %u bytes
# Extended PAL Format
&gt;&gt;12	string		plth		\b, extended
# Simple PAL Format
&gt;&gt;12	string		data		
# data chunk size = color entries * 4 + 4 + sometimes extra (4) appended bytes
&gt;&gt;&gt;16	ulelong		x		\b, data size %u
# palVersion is always 0x0300
#&gt;&gt;&gt;20	leshort		x		\b, version 0x%4.4x
# palNumEntries specifies the number of palette color entries
&gt;&gt;&gt;22	uleshort	x		\b, %u entries
# after palPalEntry sized (number of color entries * 4 ) vector
&gt;&gt;&gt;(22.s*4)	ubequad	x		
# jump relative 22 ( 8 + 16) bytes forward points after end of file or to
# appended extra bytes like in http://safecolours.rigdenage.com/set(ms).zip/Protan(MS).pal
&gt;&gt;&gt;&gt;&amp;16		ubelong	x		\b, extra bytes
&gt;&gt;&gt;&gt;&gt;&amp;-4	ubelong	&gt;0		0x%8.8x
# RIFF Device Independent Bitmap format
&gt;8	string		RDIB		\b, device-independent bitmap
&gt;&gt;16	string		BM
&gt;&gt;&gt;30	leshort		12		\b, OS/2 1.x format
&gt;&gt;&gt;&gt;34	leshort		x		\b, %d x
&gt;&gt;&gt;&gt;36	leshort		x		%d
&gt;&gt;&gt;30	leshort		64		\b, OS/2 2.x format
&gt;&gt;&gt;&gt;34	leshort		x		\b, %d x
&gt;&gt;&gt;&gt;36	leshort		x		%d
&gt;&gt;&gt;30	leshort		40		\b, Windows 3.x format
&gt;&gt;&gt;&gt;34	lelong		x		\b, %d x
&gt;&gt;&gt;&gt;38	lelong		x		%d x
&gt;&gt;&gt;&gt;44	leshort		x		%d
# RIFF MIDI format
&gt;8	string		RMID		\b, MIDI
# RIFF Multimedia Movie File format
&gt;8	string		RMMP		\b, multimedia movie
# RIFF wrapper for MP3
&gt;8	string		RMP3		\b, MPEG Layer 3 audio
# Microsoft WAVE format (*.wav)
&gt;8	string		WAVE		\b, WAVE audio
!:mime	audio/x-wav
&gt;&gt;12    string  &gt;\0
&gt;&gt;&gt;12   use     riff-walk
# Corel Draw Picture
&gt;8	string		CDRA		\b, Corel Draw Picture
!:mime	image/x-coreldraw
&gt;8	string		CDR6		\b, Corel Draw Picture, version 6
!:mime	image/x-coreldraw
&gt;8	string		NUNDROOT	\b, Steinberg CuBase
# AVI == Audio Video Interleave
&gt;8	string		AVI\040		\b, AVI
!:mime	video/x-msvideo
&gt;&gt;12    string          LIST
&gt;&gt;&gt;20   string          hdrlavih
&gt;&gt;&gt;&gt;&amp;36 lelong          x               \b, %u x
&gt;&gt;&gt;&gt;&amp;40 lelong          x               %u,
&gt;&gt;&gt;&gt;&amp;4  lelong          &gt;1000000        &lt;1 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          1000000         1.00 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          500000          2.00 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          333333          3.00 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          250000          4.00 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          200000          5.00 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          166667          6.00 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          142857          7.00 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          125000          8.00 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          111111          9.00 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          100000          10.00 fps,
# ]9.9,10.1[
&gt;&gt;&gt;&gt;&amp;4  lelong          &lt;101010
&gt;&gt;&gt;&gt;&gt;&amp;-4        lelong  &gt;99010
&gt;&gt;&gt;&gt;&gt;&gt;&amp;-4       lelong  !100000         ~10 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          83333           12.00 fps,
# ]11.9,12.1[
&gt;&gt;&gt;&gt;&amp;4  lelong          &lt;84034
&gt;&gt;&gt;&gt;&gt;&amp;-4        lelong  &gt;82645
&gt;&gt;&gt;&gt;&gt;&gt;&amp;-4       lelong  !83333          ~12 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          66667           15.00 fps,
# ]14.9,15.1[
&gt;&gt;&gt;&gt;&amp;4  lelong          &lt;67114
&gt;&gt;&gt;&gt;&gt;&amp;-4        lelong  &gt;66225
&gt;&gt;&gt;&gt;&gt;&gt;&amp;-4       lelong  !66667          ~15 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          50000           20.00 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          41708           23.98 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          41667           24.00 fps,
# ]23.9,24.1[
&gt;&gt;&gt;&gt;&amp;4  lelong          &lt;41841
&gt;&gt;&gt;&gt;&gt;&amp;-4        lelong  &gt;41494
&gt;&gt;&gt;&gt;&gt;&gt;&amp;-4       lelong  !41708
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-4      lelong  !41667          ~24 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          40000           25.00 fps,
# ]24.9,25.1[
&gt;&gt;&gt;&gt;&amp;4  lelong          &lt;40161
&gt;&gt;&gt;&gt;&gt;&amp;-4        lelong  &gt;39841
&gt;&gt;&gt;&gt;&gt;&gt;&amp;-4       lelong  !40000          ~25 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          33367           29.97 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          33333           30.00 fps,
# ]29.9,30.1[
&gt;&gt;&gt;&gt;&amp;4  lelong          &lt;33445
&gt;&gt;&gt;&gt;&gt;&amp;-4        lelong  &gt;33223
&gt;&gt;&gt;&gt;&gt;&gt;&amp;-4       lelong  !33367
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;-4      lelong  !33333          ~30 fps,
&gt;&gt;&gt;&gt;&amp;4  lelong          &lt;32224          &gt;30 fps,
##&gt;&gt;&gt;&gt;&amp;4  lelong          x               (%lu)
##&gt;&gt;&gt;&gt;&amp;20 lelong          x               %lu frames,
# Note: The tests below assume that the AVI has 1 or 2 streams,
#       &quot;vids&quot; optionally followed by &quot;auds&quot;.
#       (Should cover 99.9% of all AVIs.)
# assuming avih length = 56
&gt;&gt;&gt;88   string  LIST
&gt;&gt;&gt;&gt;96  string  strlstrh
&gt;&gt;&gt;&gt;&gt;108        string  vids    video:
&gt;&gt;&gt;&gt;&gt;&gt;&amp;0        lelong  0               uncompressed
# skip past vids strh
&gt;&gt;&gt;&gt;&gt;&gt;(104.l+108)       string  strf
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      lelong          1       RLE 8bpp
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        cvid    Cinepak
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        i263    Intel I.263
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        iv32    Indeo 3.2
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        iv41    Indeo 4.1
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        iv50    Indeo 5.0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        mp42    Microsoft MPEG-4 v2
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        mp43    Microsoft MPEG-4 v3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        fmp4    FFMpeg MPEG-4
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        mjpg    Motion JPEG
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        div3    DivX 3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;112             string/c        div3    Low-Motion
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;112             string/c        div4    Fast-Motion
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        divx    DivX 4
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        dx50    DivX 5
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        xvid    XviD
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)	string/c	h264	H.264
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        wmv3    Windows Media Video 9
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string/c        h264    X.264 or H.264
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      lelong  0
##&gt;&gt;&gt;&gt;&gt;&gt;&gt;(104.l+132)      string  x       (%.4s)
# skip past first (video) LIST
&gt;&gt;&gt;&gt;(92.l+96)   string  LIST
&gt;&gt;&gt;&gt;&gt;(92.l+104) string  strlstrh
&gt;&gt;&gt;&gt;&gt;&gt;(92.l+116)        string          auds    \b, audio:
# auds strh length = 56:
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+172)       string          strf
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+180)      leshort 0x0001  uncompressed PCM
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+180)      leshort 0x0002  ADPCM
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+180)      leshort 0x0006  aLaw
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+180)      leshort 0x0007  uLaw
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+180)      leshort 0x0050  MPEG-1 Layer 1 or 2
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+180)      leshort 0x0055  MPEG-1 Layer 3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+180)      leshort 0x2000  Dolby AC3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+180)      leshort 0x0161  DivX
##&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+180)      leshort x       (0x%.4x)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+182)      leshort 1       (mono,
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+182)      leshort 2       (stereo,
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+182)      leshort &gt;2      (%d channels,
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+184)      lelong  x       %d Hz)
# auds strh length = 64:
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+180)       string          strf
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+188)      leshort 0x0001  uncompressed PCM
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+188)      leshort 0x0002  ADPCM
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+188)      leshort 0x0055  MPEG-1 Layer 3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+188)      leshort 0x2000  Dolby AC3
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+188)      leshort 0x0161  DivX
##&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+188)      leshort x       (0x%.4x)
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+190)      leshort 1       (mono,
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+190)      leshort 2       (stereo,
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+190)      leshort &gt;2      (%d channels,
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(92.l+192)      lelong  x       %d Hz)
# Animated Cursor format
&gt;8	string		ACON		\b, animated cursor
# SoundFont 2 &lt;mpruett@sgi.com&gt;
&gt;8	string		sfbk		SoundFont/Bank
# MPEG-1 wrapped in a RIFF, apparently
&gt;8      string          CDXA            \b, wrapped MPEG-1 (CDXA)
&gt;8	string		4XMV		\b, 4X Movie file
# AMV-type AVI file: http://wiki.multimedia.cx/index.php?title=AMV
&gt;8	string		AMV\040		\b, AMV
&gt;8      string          WEBP            \b, Web/P image
!:mime	image/webp
&gt;&gt;12	use		riff-walk

#
# XXX - some of the below may only appear in little-endian form.
#
# Also &quot;MV93&quot; appears to be for one form of Macromedia Director
# files, and &quot;GDMF&quot; appears to be another multimedia format.
#
0	string		RIFX		RIFF (big-endian) data
# RIFF Palette format
&gt;8	string		PAL		\b, palette
&gt;&gt;16	beshort		x		\b, version %d
&gt;&gt;18	beshort		x		\b, %d entries
# RIFF Device Independent Bitmap format
&gt;8	string		RDIB		\b, device-independent bitmap
&gt;&gt;16	string		BM
&gt;&gt;&gt;30	beshort		12		\b, OS/2 1.x format
&gt;&gt;&gt;&gt;34	beshort		x		\b, %d x
&gt;&gt;&gt;&gt;36	beshort		x		%d
&gt;&gt;&gt;30	beshort		64		\b, OS/2 2.x format
&gt;&gt;&gt;&gt;34	beshort		x		\b, %d x
&gt;&gt;&gt;&gt;36	beshort		x		%d
&gt;&gt;&gt;30	beshort		40		\b, Windows 3.x format
&gt;&gt;&gt;&gt;34	belong		x		\b, %d x
&gt;&gt;&gt;&gt;38	belong		x		%d x
&gt;&gt;&gt;&gt;44	beshort		x		%d
# RIFF MIDI format
&gt;8	string		RMID		\b, MIDI
# RIFF Multimedia Movie File format
&gt;8	string		RMMP		\b, multimedia movie
# Microsoft WAVE format (*.wav)
&gt;8	string		WAVE		\b, WAVE audio
&gt;&gt;20	leshort		1		\b, Microsoft PCM
&gt;&gt;&gt;34	leshort		&gt;0		\b, %d bit
&gt;&gt;22	beshort		=1		\b, mono
&gt;&gt;22	beshort		=2		\b, stereo
&gt;&gt;22	beshort		&gt;2		\b, %d channels
&gt;&gt;24	belong		&gt;0		%d Hz
# Corel Draw Picture
&gt;8	string		CDRA		\b, Corel Draw Picture
&gt;8	string		CDR6		\b, Corel Draw Picture, version 6
# AVI == Audio Video Interleave
&gt;8	string		AVI\040		\b, AVI
# Animated Cursor format
&gt;8	string		ACON		\b, animated cursor
# Notation Interchange File Format (big-endian only)
&gt;8	string		NIFF		\b, Notation Interchange File Format
# SoundFont 2 &lt;mpruett@sgi.com&gt;
&gt;8	string		sfbk		SoundFont/Bank

#------------------------------------------------------------------------------
# Sony Wave64
# see http://www.vcs.de/fileadmin/user_upload/MBS/PDF/Whitepaper/Informations_about_Sony_Wave64.pdf
# 128 bit RIFF-GUID { 66666972-912E-11CF-A5D6-28DB04C10000 } in little-endian
0	string	riff\x2E\x91\xCF\x11\xA5\xD6\x28\xDB\x04\xC1\x00\x00		Sony Wave64 RIFF data
# 128 bit + total file size (64 bits) so 24 bytes
# then WAVE-GUID { 65766177-ACF3-11D3-8CD1-00C04F8EDB8A }
&gt;24	string		wave\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b, WAVE 64 audio
!:mime	audio/x-w64
# FMT-GUID { 20746D66-ACF3-11D3-8CD1-00C04F8EDB8A }
&gt;&gt;40	search/256	fmt\x20\xF3\xAC\xD3\x11\x8C\xD1\x00\xC0\x4F\x8E\xDB\x8A		\b
&gt;&gt;&gt;&amp;10	leshort		=1		\b, mono
&gt;&gt;&gt;&amp;10	leshort		=2		\b, stereo
&gt;&gt;&gt;&amp;10	leshort		&gt;2		\b, %d channels
&gt;&gt;&gt;&amp;12	lelong		&gt;0		%d Hz

#------------------------------------------------------------------------------
# MBWF/RF64
# see EBU TECH 3306 http://tech.ebu.ch/docs/tech/tech3306-2009.pdf
0	string	RF64\xff\xff\xff\xffWAVEds64		MBWF/RF64 audio
!:mime	audio/x-wav
&gt;40	search/256	fmt\x20		\b
&gt;&gt;&amp;6	leshort		=1		\b, mono
&gt;&gt;&amp;6	leshort		=2		\b, stereo
&gt;&gt;&amp;6	leshort		&gt;2		\b, %d channels
&gt;&gt;&amp;8	lelong		&gt;0		%d Hz

#------------------------------------------------------------------------------
# $File: rpi,v 1.1 2018/01/01 05:25:17 christos Exp $
# rpi:  file(1) magic for Raspberry Pi images
-44		lelong	0
&gt;4		lelong	0
&gt;&gt;8		lelong	1
&gt;&gt;12		lelong	4
&gt;&gt;&gt;16		string	283x
&gt;&gt;&gt;&gt;20		lelong	1
&gt;&gt;&gt;&gt;&gt;24		lelong	4
&gt;&gt;&gt;&gt;&gt;&gt;28	string	DTOK
&gt;&gt;&gt;&gt;&gt;&gt;&gt;32	lelong	44
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;36	lelong	4
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;40	string	RPTL		Raspberry PI kernel image

#------------------------------------------------------------------------------
# $File: rpm,v 1.12 2013/01/11 16:45:23 christos Exp $
#
# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
#
0	belong		0xedabeedb	RPM
!:mime	application/x-rpm
&gt;4	byte		x		v%d
&gt;5	byte		x		\b.%d
&gt;6	beshort		1		src
&gt;6	beshort		0		bin
&gt;&gt;8	beshort		1		i386/x86_64
&gt;&gt;8	beshort		2		Alpha/Sparc64
&gt;&gt;8	beshort		3		Sparc
&gt;&gt;8	beshort		4		MIPS
&gt;&gt;8	beshort		5		PowerPC
&gt;&gt;8	beshort		6		68000
&gt;&gt;8	beshort		7		SGI
&gt;&gt;8	beshort		8		RS6000
&gt;&gt;8	beshort		9		IA64
&gt;&gt;8	beshort		10		Sparc64
&gt;&gt;8	beshort		11		MIPSel
&gt;&gt;8	beshort		12		ARM
&gt;&gt;8	beshort		13		MiNT
&gt;&gt;8	beshort		14		S/390
&gt;&gt;8	beshort		15		S/390x
&gt;&gt;8	beshort		16		PowerPC64
&gt;&gt;8	beshort		17		SuperH
&gt;&gt;8	beshort		18		Xtensa
&gt;&gt;8	beshort		255		noarch
&gt;&gt;10	string		x		%s

#delta RPM    Daniel Novotny (dnovotny@redhat.com)
0	string		drpm		Delta RPM
!:mime  application/x-rpm
&gt;12	string 	x	%s
&gt;&gt;8	beshort		11		MIPSel
&gt;&gt;8	beshort		12		ARM
&gt;&gt;8	beshort		13		MiNT
&gt;&gt;8	beshort		14		S/390
&gt;&gt;8	beshort		15		S/390x
&gt;&gt;8	beshort		16		PowerPC64
&gt;&gt;8	beshort		17		SuperH
&gt;&gt;8	beshort		18		Xtensa
&gt;&gt;10	string		x		%s

#------------------------------------------------------------------------------
# $File: rtf,v 1.7 2009/09/19 16:28:12 christos Exp $
# rtf:	file(1) magic for Rich Text Format (RTF)
#
# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
#
0	string		{\\rtf		Rich Text Format data,
!:mime	text/rtf
&gt;5	string		1		version 1,
&gt;&gt;6	string		\\ansi		ANSI
&gt;&gt;6	string		\\mac		Apple Macintosh
&gt;&gt;6	string		\\pc		IBM PC, code page 437
&gt;&gt;6	string		\\pca		IBM PS/2, code page 850
&gt;&gt;6	default		x		unknown character set
&gt;5	default		x		unknown version

#------------------------------------------------------------------------------
# $File: ruby,v 1.7 2017/08/14 13:39:18 christos Exp $
# ruby:  file(1) magic for Ruby scripting language
# URL:  http://www.ruby-lang.org/
# From: Reuben Thomas &lt;rrt@sc3d.org&gt;

# Ruby scripts
0	search/1/w	#!\ /usr/bin/ruby				Ruby script text executable
!:strength + 15
!:mime text/x-ruby
0	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
!:strength + 15
!:mime text/x-ruby
0	search/1	#!/usr/bin/env\ ruby				Ruby script text executable
!:strength + 15
!:mime text/x-ruby
0	search/1	#!\ /usr/bin/env\ ruby			Ruby script text executable
!:strength + 15
!:mime text/x-ruby

# What looks like ruby, but does not have a shebang
# (modules and such)
# From: Lubomir Rintel &lt;lkundrak@v3.sk&gt;
0	regex		\^[[:space:]]*require[[:space:]]&#039;[A-Za-z_/]+&#039;
&gt;0	regex		def\ [a-z]|\ do$
&gt;&gt;&amp;0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
!:strength + 30
!:mime	text/x-ruby
0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
&gt;0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
&gt;&gt;&amp;0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
!:strength + 30
!:mime	text/x-ruby
# Classes with no modules or defs, beats simple ASCII
0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
&gt;&amp;0	regex	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
!:strength + 10
!:mime	text/x-ruby
# Looks for function definition to balance python magic
# def name (args)
# end
0	regex		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
&gt;&amp;0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
!:strength + 10
!:mime	text/x-ruby

0	regex		\^[[:space:]]*require[[:space:]]&#039;[A-Za-z_/]+&#039;	Ruby script text
!:mime	text/x-ruby
0 regex 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
!:mime	text/x-ruby

#------------------------------------------------------------------------------
# $File: sc,v 1.6 2009/09/19 16:28:12 christos Exp $
# sc:  file(1) magic for &quot;sc&quot; spreadsheet
#
38	string		Spreadsheet	sc spreadsheet file
!:mime	application/x-sc

#------------------------------------------------------------------------------
# $File: sccs,v 1.7 2017/03/17 21:35:28 christos Exp $
# sccs:  file(1) magic for SCCS archives
#
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
# \001c date and time created 87/09/23 08:09:20 by ian
# \001e
# \001u
# \001U
# ... etc.
# Now &#039;\001h&#039; happens to be the same as the 3B20&#039;s a.out magic number (0550).
# *Sigh*. And these both came from various parts of the USG.
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can&#039;t just say &#039;\001h0&#039;, because the five-digit number
# is a checksum that could (presumably) have any leading digit,
# and we don&#039;t have regular expression matching yet.
# Hence the following official kludge:
8	string		\001s\ 			SCCS archive data

#------------------------------------------------------------------------------
# $File: scientific,v 1.12 2017/03/17 22:20:22 christos Exp $
# scientific:  file(1) magic for scientific formats
#
# From: Joe Krahn &lt;krahn@niehs.nih.gov&gt;

########################################################
# CCP4 data and plot files:
0	string		MTZ\040		MTZ reflection file

92	string		PLOT%%84	Plot84 plotting file
&gt;52	byte		1		, Little-endian
&gt;55	byte		1		, Big-endian

########################################################
# Electron density MAP/MASK formats

0	string		EZD_MAP	NEWEZD Electron Density Map
109	string		MAP\040(  Old EZD Electron Density Map

0	string/c	:-)\040Origin	BRIX Electron Density Map
&gt;170	string		&gt;0	, Sigma:%.12s
#&gt;4	string		&gt;0	%.178s
#&gt;4	addr		x	%.178s

7	string		18\040!NTITLE	XPLOR ASCII Electron Density Map
9	string		\040!NTITLE\012\040REMARK	CNS ASCII electron density map

208	string		MAP\040	CCP4 Electron Density Map
# Assumes same stamp for float and double (normal case)
&gt;212	byte		17	\b, Big-endian
&gt;212	byte		34	\b, VAX format
&gt;212	byte		68	\b, Little-endian
&gt;212	byte		85	\b, Convex native

############################################################
# X-Ray Area Detector images
0	string	R-AXIS4\ \ \ 	R-Axis Area Detector Image:
&gt;796	lelong	&lt;20		Little-endian, IP #%d,
&gt;&gt;768	lelong	&gt;0		Size=%dx
&gt;&gt;772	lelong	&gt;0		\b%d
&gt;796	belong	&lt;20		Big-endian, IP #%d,
&gt;&gt;768	belong	&gt;0		Size=%dx
&gt;&gt;772	belong	&gt;0		\b%d

0	string	RAXIS\ \ \ \ \ 	R-Axis Area Detector Image, Win32:
&gt;796	lelong	&lt;20		Little-endian, IP #%d,
&gt;&gt;768	lelong	&gt;0		Size=%dx
&gt;&gt;772	lelong	&gt;0		\b%d
&gt;796	belong	&lt;20		Big-endian, IP #%d,
&gt;&gt;768	belong	&gt;0		Size=%dx
&gt;&gt;772	belong	&gt;0		\b%d


1028	string	MMX\000\000\000\000\000\000\000\000\000\000\000\000\000	MAR Area Detector Image,
&gt;1072	ulong	&gt;1		Compressed(%d),
&gt;1100	ulong	&gt;1		%d headers,
&gt;1104	ulong	&gt;0		%d x
&gt;1108	ulong	&gt;0		%d,
&gt;1120	ulong	&gt;0		%d bits/pixel

# Type: GEDCOM genealogical (family history) data
# From: Giuseppe Bilotta
0       search/1/c	0\ HEAD         GEDCOM genealogy text
&gt;&amp;0     search		1\ GEDC
&gt;&gt;&amp;0    search		2\ VERS         version
&gt;&gt;&gt;&amp;1   string		&gt;\0		%s
# From: Phil Endecott &lt;phil05@chezphil.org&gt;
0	string	\000\060\000\040\000\110\000\105\000\101\000\104		GEDCOM data
0	string	\060\000\040\000\110\000\105\000\101\000\104\000		GEDCOM data
0	string	\376\377\000\060\000\040\000\110\000\105\000\101\000\104	GEDCOM data
0	string	\377\376\060\000\040\000\110\000\105\000\101\000\104\000	GEDCOM data

# PDB: Protein Data Bank files
# Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
#
# http://www.wwpdb.org/documentation/format32/sect2.html
# http://www.ch.ic.ac.uk/chemime/
#
# The PDB file format is fixed-field, 80 columns. From the spec:
#
# COLS        DATA
#  1 -  6      &quot;HEADER&quot;
#  11 - 50     String(40)
#  51 - 59     Date
#  63 - 66     IDcode
#
# Thus, positions 7-10, 60-62 and 67-80 are spaces. The Date must be in the
# format DD-MMM-YY, e.g., 01-JAN-70, and the IDcode consists of numbers and
# uppercase letters. However, examples have been seen without the date string,
# e.g., the example on the chemime site.
0	string	HEADER\ \ \ \040
&gt;&amp;0	regex/1l	\^.{40}
&gt;&gt;&amp;0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}\ {3}
&gt;&gt;&gt;&amp;0	regex/1ls	[A-Z0-9]{4}.{14}$
&gt;&gt;&gt;&gt;&amp;0	regex/1l	[A-Z0-9]{4}	Protein Data Bank data, ID Code %s
!:mime	chemical/x-pdb
&gt;&gt;&gt;&gt;0	regex/1l	[0-9]{2}-[A-Z]{3}-[0-9]{2}	\b, %s

# Type:	GDSII Stream file
0	belong	0x00060002	GDSII Stream file
&gt;4	byte	0x00
&gt;&gt;5	byte	x		version %d.0
&gt;4	byte	&gt;0x00		version %d
&gt;&gt;5	byte	x		\b.%d

# Type: LXT (interLaced eXtensible Trace)
# chrysn &lt;chrysn@fsfe.org&gt;
0	beshort	0x0138	interLaced eXtensible Trace (LXT) file
&gt;2	beshort	&gt;0	(Version %u)

#------------------------------------------------------------------------------
# $File: securitycerts,v 1.4 2009/09/19 16:28:12 christos Exp $
0	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
0	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
0	belong	0xedfeedfe	Sun &#039;jks&#039; Java Keystore File data

0	string \0volume_key	volume_key escrow packet
# Type:	SE Linux policy modules *.pp reference policy
#	for Fedora 5 to 9, RHEL5, and Debian Etch and Lenny.
# URL:	http://doc.coker.com.au/computers/selinux-magic
# From:	Russell Coker &lt;russell@coker.com.au&gt;

0		lelong	0xf97cff8f	SE Linux modular policy
&gt;4		lelong	x		version %d,
&gt;8		lelong	x		%d sections,
&gt;&gt;(12.l)	lelong	0xf97cff8d
&gt;&gt;&gt;(12.l+27)	lelong	x		mod version %d,
&gt;&gt;&gt;(12.l+31)	lelong	0		Not MLS,
&gt;&gt;&gt;(12.l+31)	lelong	1		MLS,
&gt;&gt;&gt;(12.l+23)	lelong	2
&gt;&gt;&gt;&gt;(12.l+47)	string	&gt;\0		module name %s
&gt;&gt;&gt;(12.l+23)	lelong	1		base

1	string	policy_module(	SE Linux policy module source
2	string	policy_module(	SE Linux policy module source

0	string	##\ &lt;summary&gt;	SE Linux policy interface source

#0	search	gen_context(	SE Linux policy file contexts

#0	search	gen_sens(	SE Linux policy MLS constraints source

#------------------------------------------------------------------------------
# $File: sendmail,v 1.10 2017/08/13 00:21:47 christos Exp $
# sendmail:  file(1) magic for sendmail config files
#
# XXX - byte order?
#
# Update: Joerg Jenderek
# GRR: this test is too general as it catches also
# READ.ME.FIRST.AWP Sendmail frozen configuration
# - version ====|====|====|====|====|====|====|====|====|====|====|====|===
# Email_23_f217153422.ts Sendmail frozen configuration
# - version \330jK\354
0	byte	046
# http://www.sendmail.com/sm/open_source/docs/older_release_notes/
# freezed configuration file (dbm format?) created from sendmal.cf with -bz
# by older sendmail. til version 8.6 support for frozen configuration files is removed
# valid version numbers look like &quot;7.14.4&quot; and should be similar to output of commands
# &quot;sendmail -d0 -bt &lt; /dev/null |grep -i Version&quot; or &quot;egrep &#039;^DZ&#039; /etc/sendmail.cf&quot;
&gt;16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
# normally only /etc/sendmail.fc or /var/adm/sendmail/sendmail.fc
!:ext fc
&gt;&gt;16	string	&gt;\0			- version %s
0	short	0x271c
# look for valid version number
&gt;16	regex/s	=^[0-78][0-9.]{4}	Sendmail frozen configuration
!:ext fc
&gt;&gt;16	string	&gt;\0			- version %s

#------------------------------------------------------------------------------
# sendmail:  file(1) magic for sendmail m4(1) files
#
# From Hendrik Scholz &lt;hendrik@scholz.net&gt;
# i.e. files in /usr/share/sendmail/cf/
#
0   string  divert(-1)\n    sendmail m4 text file


#------------------------------------------------------------------------------
# $File: sequent,v 1.13 2017/03/17 21:35:28 christos Exp $
# sequent:  file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins &lt;atsun!dwiggins&gt;.
# For Sequent&#039;s multiprocessor systems (incomplete).
0	lelong	0x00ea        	BALANCE NS32000 .o
&gt;16	lelong	&gt;0		not stripped
&gt;124	lelong	&gt;0		version %d
0	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
&gt;16	lelong  &gt;0            	not stripped
&gt;124	lelong	&gt;0		version %d
0	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
&gt;16	lelong  &gt;0            	not stripped
&gt;124	lelong	&gt;0		version %d
0	lelong	0x30ea        	BALANCE NS32000 standalone executable
&gt;16	lelong  &gt;0          	not stripped
&gt;124	lelong	&gt;0		version %d
#
# Symmetry information added by Jason Merrill &lt;jason@jarthur.claremont.edu&gt;.
# Symmetry magic nums will not be reached if DOS COM comes before them;
# byte 0xeb is matched before these get a chance.
0	leshort	0x12eb		SYMMETRY i386 .o
&gt;16	lelong	&gt;0		not stripped
&gt;124	lelong	&gt;0		version %d
0	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
&gt;16	lelong	&gt;0		not stripped
&gt;124	lelong	&gt;0		version %d
0	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
&gt;16	lelong	&gt;0		not stripped
&gt;124	lelong	&gt;0		version %d
# http://en.wikipedia.org/wiki/Sequent_Computer_Systems
# below test line conflicts with MS-DOS 2.11 floppies and Acronis loader
#0	leshort	0x42eb		SYMMETRY i386 standalone executable
0	leshort	0x42eb
# skip unlike negative version
&gt;124	lelong	&gt;-1
# assuming version 28867614 is very low probable
&gt;&gt;124	lelong	!28867614	SYMMETRY i386 standalone executable
&gt;&gt;&gt;16	lelong	&gt;0		not stripped
&gt;&gt;&gt;124	lelong	&gt;0		version %d

#------------------------------------------------------------------------------
# $File: sereal,v 1.3 2015/02/05 19:14:45 christos Exp $
# sereal: file(1) magic the Sereal binary serialization format
#
# From: Ævar Arnfjörð Bjarmason &lt;avarab@gmail.com&gt;
#
# See the specification of the format at
# https://github.com/Sereal/Sereal/blob/master/sereal_spec.pod#document-header-format
#
# I&#039;d have liked to do the byte&amp;0xF0 matching against 0, 1, 2 ... by
# doing (byte&amp;0xF0)&gt;&gt;4 here, but unfortunately that&#039;s not
# supported. So when we print out a message about an unknown format
# we&#039;ll print out e.g. 0x30 instead of the more human-readable
# 0x30&gt;&gt;4.
#
# See https://github.com/Sereal/Sereal/commit/35372ae01d in the
# Sereal.git repository for test Sereal data.
0	name		sereal
&gt;4	byte&amp;0x0F	x		(version %d,
&gt;4	byte&amp;0xF0	0x00		uncompressed)
&gt;4	byte&amp;0xF0	0x10		compressed with non-incremental Snappy)
&gt;4	byte&amp;0xF0	0x20		compressed with incremental Snappy)
&gt;4	byte&amp;0xF0	&gt;0x20		unknown subformat, flag: %d&gt;&gt;4)

0	string/b	\=srl		Sereal data packet
!:mime application/sereal
&gt;&amp;0	use		sereal
0	string/b	\=\xF3rl	Sereal data packet
!:mime application/sereal
&gt;&amp;0	use		sereal
0	string/b	\=\xC3\xB3rl	Sereal data packet, UTF-8 encoded
!:mime application/sereal
&gt;&amp;0	use		sereal


#------------------------------------------------------------------------------
# $File: sgi,v 1.22 2015/08/29 07:10:35 christos Exp $
# sgi:  file(1) magic for Silicon Graphics operating systems and applications
#
# Executable images are handled either in aout (for old-style a.out
# files for 68K; they are indistinguishable from other big-endian 32-bit
# a.out files) or in mips (for MIPS ECOFF and Ucode files)
#

# kbd file definitions
0	string	kbd!map		kbd map file
&gt;8	byte	&gt;0		Ver %d:
&gt;10	short	&gt;0		with %d table(s)

0	beshort	0x8765		disk quotas file

0	beshort	0x0506		IRIS Showcase file
&gt;2	byte	0x49		-
&gt;3	byte	x		- version %d
0	beshort	0x0226		IRIS Showcase template
&gt;2	byte	0x63		-
&gt;3	byte	x		- version %d
0	belong	0x5343464d	IRIS Showcase file
&gt;4	byte	x		- version %d
0	belong	0x5443464d	IRIS Showcase template
&gt;4	byte	x		- version %d
0	belong	0xdeadbabe	IRIX Parallel Arena
&gt;8	belong	&gt;0		- version %d

# core files
#
# 32bit core file
0	belong	0xdeadadb0	IRIX core dump
&gt;4	belong	1		of
&gt;16	string	&gt;\0		&#039;%s&#039;
# 64bit core file
0	belong	0xdeadad40	IRIX 64-bit core dump
&gt;4	belong	1		of
&gt;16	string	&gt;\0		&#039;%s&#039;
# N32bit core file
0       belong	0xbabec0bb	IRIX N32 core dump
&gt;4      belong	1               of
&gt;16     string	&gt;\0             &#039;%s&#039;
# New style crash dump file
0	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
&gt;36	string	&gt;\0					&#039;%s&#039;

# Trusted IRIX info
0	string	SGIAUDIT	SGI Audit file
&gt;8	byte	x		- version %d
&gt;9	byte	x		\b.%d
#
0	string	WNGZWZSC	Wingz compiled script
0	string	WNGZWZSS	Wingz spreadsheet
0	string	WNGZWZHP	Wingz help file
#
0	string	#Inventor\040V	IRIS Inventor 1.0 file
0	string	#Inventor\040V2	Open Inventor 2.0 file
# GLF is OpenGL stream encoding
0	string	glfHeadMagic();		GLF_TEXT
4	belong	0x7d000000		GLF_BINARY_LSB_FIRST
!:strength -30
4	belong	0x0000007d		GLF_BINARY_MSB_FIRST
!:strength -30
# GLS is OpenGL stream encoding; GLS is the successor of GLF
0	string	glsBeginGLS(		GLS_TEXT
4	belong	0x10000000		GLS_BINARY_LSB_FIRST
!:strength -30
4	belong	0x00000010		GLS_BINARY_MSB_FIRST
!:strength -30

#
#
# Performance Co-Pilot file types
0	string	PmNs				PCP compiled namespace (V.0)
0	string	PmN				PCP compiled namespace
&gt;3	string	&gt;\0				(V.%1.1s)
#3	lelong	0x84500526			PCP archive
3	belong	0x84500526			PCP archive
&gt;7	byte	x				(V.%d)
#&gt;20	lelong	-2				temporal index
#&gt;20	lelong	-1				metadata
#&gt;20	lelong	0				log volume #0
#&gt;20	lelong	&gt;0				log volume #%d
&gt;20	belong	-2				temporal index
&gt;20	belong	-1				metadata
&gt;20	belong	0				log volume #0
&gt;20	belong	&gt;0				log volume #%d
&gt;24	string	&gt;\0				host: %s
0	string	PCPFolio			PCP
&gt;9	string	Version:			Archive Folio
&gt;18	string	&gt;\0				(V.%s)
0	string	#pmchart			PCP pmchart view
&gt;9	string	Version
&gt;17	string	&gt;\0				(V%-3.3s)
0	string	#kmchart			PCP kmchart view
&gt;9	string	Version
&gt;17	string	&gt;\0				(V.%s)
0	string	pmview				PCP pmview config
&gt;7	string	Version
&gt;15	string	&gt;\0				(V%-3.3s)
0	string	#pmlogger			PCP pmlogger config
&gt;10	string	Version
&gt;18	string	&gt;\0				(V%1.1s)
0	string	#pmdahotproc			PCP pmdahotproc config
&gt;13	string	Version
&gt;21	string	&gt;\0				(V%-3.3s)
0	string	PcPh				PCP Help
&gt;4	string	1				Index
&gt;4	string	2				Text
&gt;5	string	&gt;\0				(V.%1.1s)
0	string	#pmieconf-rules			PCP pmieconf rules
&gt;16	string	&gt;\0				(V.%1.1s)
3	string	pmieconf-pmie			PCP pmie config
&gt;17	string	&gt;\0				(V.%1.1s)

# SpeedShop data files
0	lelong	0x13130303			SpeedShop data file

# mdbm files
0	lelong	0x01023962			mdbm file, version 0 (obsolete)
0	string	mdbm				mdbm file,
&gt;5	byte	x				version %d,
&gt;6	byte	x				2^%d pages,
&gt;7	byte	x				pagesize 2^%d,
&gt;17	byte	x				hash %d,
&gt;11	byte	x				dataformat %d

# Alias Maya files
0	string/t	//Maya\040ASCII	Alias Maya Ascii File,
&gt;13	string	&gt;\0	version %s
8	string	MAYAFOR4	Alias Maya Binary File,
&gt;32	string	&gt;\0	version %s scene
8	string	MayaFOR4	Alias Maya Binary File,
&gt;32	string	&gt;\0	version %s scene
8	string	CIMG		Alias Maya Image File
8	string	DEEP		Alias Maya Image File

#------------------------------------------------------------------------------
# $File: sgml,v 1.38 2017/10/11 11:40:43 christos Exp $
# Type:	SVG Vectorial Graphics
# From:	Noel Torres &lt;tecnico@ejerciciosresueltos.com&gt;
0	string		\&lt;?xml\ version=
&gt;14	regex		[&#039;&quot;\ \t]*[0-9.]+[&#039;&quot;\ \t]*
&gt;&gt;19	search/4096	\&lt;svg			SVG Scalable Vector Graphics image
!:mime	image/svg+xml
&gt;&gt;19	search/4096	\&lt;gnc-v2		GnuCash file
!:mime	application/x-gnucash
0	string		\&lt;svg			SVG Scalable Vector Graphics image
!:mime	image/svg

# Sitemap file
0	string/t		\&lt;?xml\ version=
&gt;14	regex		[&#039;&quot;\ \t]*[0-9.]+[&#039;&quot;\ \t]*
&gt;&gt;19	search/4096	\&lt;urlset		XML Sitemap document text
!:mime	application/xml-sitemap

# OpenStreetMap XML (.osm)
# http://wiki.openstreetmap.org/wiki/OSM_XML
# From: Markus Heidelberg &lt;markus.heidelberg@web.de&gt;
0	string		\&lt;?xml\ version=
&gt;14	regex		[&#039;&quot;\ \t]*[0-9.]+[&#039;&quot;\ \t]*
&gt;&gt;19	search/4096	\&lt;osm			OpenStreetMap XML data

# xhtml
0	string/t		\&lt;?xml\ version=&quot;
&gt;19	search/4096/cWbt	\&lt;!doctype\ html	XHTML document text
&gt;&gt;15	string		&gt;\0	(version %.3s)
!:mime	text/html
0	string/t		\&lt;?xml\ version=&#039;
&gt;19	search/4096/cWbt	\&lt;!doctype\ html	XHTML document text
&gt;&gt;15	string		&gt;\0	(version %.3s)
!:mime	text/html
0	string/t		\&lt;?xml\ version=&quot;
&gt;19	search/4096/cWbt	\&lt;html	broken XHTML document text
&gt;&gt;15	string		&gt;\0	(version %.3s)
!:mime	text/html

#------------------------------------------------------------------------------
# sgml:  file(1) magic for Standard Generalized Markup Language
# HyperText Markup Language (HTML) is an SGML document type,
# from Daniel Quinlan (quinlan@yggdrasil.com)
# adapted to string extenstions by Anthon van der Neut &lt;anthon@mnt.org)
0	search/4096/cWt	\&lt;!doctype\ html	HTML document text
!:mime	text/html
!:strength + 5

# SVG document
# https://www.w3.org/TR/SVG/single-page.html
0	search/4096/cWbt	\&lt;!doctype\ svg	SVG XML document
!:mime  image/svg+xml
!:strength + 5

0	search/4096/cwt	\&lt;head\&gt;		HTML document text
!:mime	text/html
!:strength + 5
0	search/4096/cWt	\&lt;head\ 		HTML document text
!:mime	text/html
!:strength + 5
0	search/4096/cwt	\&lt;title\&gt;		HTML document text
!:mime	text/html
!:strength + 5
0	search/4096/cWt	\&lt;title\ 		HTML document text
!:mime	text/html
!:strength + 5
0	search/4096/cwt	\&lt;html\&gt;		HTML document text
!:mime	text/html
!:strength + 5
0	search/4096/cWt	\&lt;html\ 		HTML document text
!:mime	text/html
!:strength + 5
0	search/4096/cwt	\&lt;script\&gt; 		HTML document text
!:mime	text/html
!:strength + 5
0	search/4096/cWt	\&lt;script\ 		HTML document text
!:mime	text/html
!:strength + 5
0	search/4096/cwt	\&lt;style\&gt; 		HTML document text
!:mime	text/html
!:strength + 5
0	search/4096/cWt	\&lt;style\  		HTML document text
!:mime	text/html
!:strength + 5
0	search/4096/cwt	\&lt;table\&gt;		HTML document text
!:mime	text/html
!:strength + 5
0	search/4096/cWt	\&lt;table\ 		HTML document text
!:mime	text/html
!:strength + 5

0	search/4096/cwt	\&lt;a\ href=		HTML document text
!:mime	text/html
!:strength + 5

# Extensible markup language (XML), a subset of SGML
# from Marc Prud&#039;hommeaux (marc@apocalypse.org)
0	search/1/cwt	\&lt;?xml			XML document text
!:mime	text/xml
!:strength + 5
0	string/t		\&lt;?xml\ version\ &quot;	XML
!:mime	text/xml
!:strength + 5
0	string/t		\&lt;?xml\ version=&quot;	XML
!:mime	text/xml
!:strength + 5
&gt;15	string/t	&gt;\0			%.3s document text
&gt;&gt;23	search/1	\&lt;xsl:stylesheet	(XSL stylesheet)
&gt;&gt;24	search/1	\&lt;xsl:stylesheet	(XSL stylesheet)
0	string		\&lt;?xml\ version=&#039;	XML
!:mime	text/xml
!:strength + 5
&gt;15	string/t	&gt;\0			%.3s document text
&gt;&gt;23	search/1	\&lt;xsl:stylesheet	(XSL stylesheet)
&gt;&gt;24	search/1	\&lt;xsl:stylesheet	(XSL stylesheet)
0	search/1/wt	\&lt;?XML			broken XML document text
!:mime	text/xml
!:strength - 10


# SGML, mostly from rph@sq
0	search/4096/cwt	\&lt;!doctype		exported SGML document text
0	search/4096/cwt	\&lt;!subdoc		exported SGML subdocument text
0	search/4096/cwt	\&lt;!--			exported SGML document text
!:strength - 10

# Web browser cookie files
# (Mozilla, Galeon, Netscape 4, Konqueror..)
# Ulf Harnhammar &lt;ulfh@update.uu.se&gt;
0	search/1	#\ HTTP\ Cookie\ File	Web browser cookie text
0	search/1	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
0	search/1	#\ KDE\ Cookie\ File	Konqueror cookie text

# XML-based format representing braille pages in a digital format.
#
# Specification:
# http://files.pef-format.org/specifications/pef-2008-1/pef-specification.html
#
# Simon Aittamaa &lt;simon.aittamaa@gmail.com&gt;
0   string      \&lt;?xml\ version=
&gt;14 regex       [&#039;&quot;\ \t]*[0-9.]+[&#039;&quot;\ \t]*
&gt;&gt;19    search/4096 \&lt;pef           Portable Embosser Format
!:mime  application/x-pef+xml
#------------------------------------------------------------------------
# $File: sharc,v 1.8 2017/03/17 21:35:28 christos Exp $
# file(1) magic for sharc files
#
# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by
# FutureGroove Music (dsp@futuregroove.de)

#------------------------------------------------------------------------
#0	string			Draw		RiscOS Drawfile
#0	string			PACK		RiscOS PackdDir archive

#------------------------------------------------------------------------
# SHARC DSP stuff (based on the FGM SHARC DSP SDK)

#0	string			=!		Assembler source
#0	string			Analog		ADi asm listing file
0	string			.SYSTEM		SHARC architecture file
0	string			.system		SHARC architecture file

0	leshort			0x521C		SHARC COFF binary
&gt;2	leshort			&gt;1		, %d sections
&gt;&gt;12	lelong			&gt;0		, not stripped

#------------------------------------------------------------------------------
# $File: sinclair,v 1.6 2015/11/14 13:38:35 christos Exp $
# sinclair:  file(1) sinclair QL

# additions to /etc/magic by Thomas M. Ott (ThMO)

# Sinclair QL floppy disk formats (ThMO)
0	string	=QL5		QL disk dump data,
&gt;3	string	=A		720 KB,
&gt;3	string	=B		1.44 MB,
&gt;3	string	=C		3.2 MB,
&gt;4	string	&gt;\0		label:%.10s

# Sinclair QL OS dump (ThMO)
0		belong	=0x30000
&gt;49124		belong	&lt;47104
&gt;&gt;49128		belong	&lt;47104
&gt;&gt;&gt;49132	belong	&lt;47104
&gt;&gt;&gt;&gt;49136	belong	&lt;47104	QL OS dump data,
&gt;&gt;&gt;&gt;&gt;49148	string	&gt;\0	type %.3s,
&gt;&gt;&gt;&gt;&gt;49142	string	&gt;\0	version %.4s

# Sinclair QL firmware executables (ThMO)
0	string	NqNqNq`\004	QL firmware executable (BCPL)

# Sinclair QL libraries (was ThMO)
0	beshort	0xFB01		QDOS object
&gt;2	pstring	x		&#039;%s&#039;

# Sinclair QL executables (was ThMO)
4	belong	0x4AFB		QDOS executable
&gt;9	pstring	x		&#039;%s&#039;

# Sinclair QL ROM (ThMO)
0	belong	=0x4AFB0001	QL plugin-ROM data,
&gt;9	pstring	=\0		un-named
&gt;9	pstring	&gt;\0		named: %s
# Type: SiSU Markup Language
# URL:  http://www.sisudoc.org/
# From: Ralph Amissah &lt;ralph.amissah@gmail.com&gt;

0	regex	\^%?[\ \t]*SiSU[\ \t]+insert	SiSU text insert
&gt;5	regex	[0-9.]+				%s

0	regex	\^%[\ \t]+SiSU[\ \t]+master	SiSU text master
&gt;5	regex	[0-9.]+				%s

0	regex	\^%?[\ \t]*SiSU[\ \t]+text	SiSU text
&gt;5	regex	[0-9.]+				%s

0	regex	\^%?[\ \t]*SiSU[\ \t][0-9.]+	SiSU text
&gt;5	regex	[0-9.]+				%s

0	regex	\^%*[\ \t]*sisu-[0-9.]+		SiSU text
&gt;5	regex	[0-9.]+				%s

#------------------------------------------------------------------------------
# $File: sketch,v 1.5 2017/03/17 21:35:28 christos Exp $
# Sketch Drawings: http://sketch.sourceforge.net/
# From: Edwin Mons &lt;e@ik.nu&gt;
0	search/1	##Sketch	Sketch document text

#-----------------------------------------------
# $File: smalltalk,v 1.5 2009/09/19 16:28:12 christos Exp $
# GNU Smalltalk image, starting at version 1.6.2
# From: catull_us@yahoo.com
#
0	string	GSTIm\0\0	GNU SmallTalk
# little-endian
&gt;7	byte&amp;1	=0		LE image version
&gt;&gt;10	byte	x		%d.
&gt;&gt;9	byte	x		\b%d.
&gt;&gt;8	byte	x		\b%d
#&gt;&gt;12	lelong	x		, data: %ld
#&gt;&gt;16	lelong	x		, table: %ld
#&gt;&gt;20	lelong	x		, memory: %ld
# big-endian
&gt;7	byte&amp;1	=1		BE image version
&gt;&gt;8	byte	x		%d.
&gt;&gt;9	byte	x		\b%d.
&gt;&gt;10	byte	x		\b%d
#&gt;&gt;12	belong	x		, data: %ld
#&gt;&gt;16	belong	x		, table: %ld
#&gt;&gt;20	belong	x		, memory: %ld


#------------------------------------------------------------------------------
# $File: smile,v 1.1 2011/08/17 17:37:18 christos Exp $
# smile:  file(1) magic for Smile serialization
#
# The Smile serialization format uses a 4-byte header:
#
#   Constant byte #0: 0x3A (ASCII &#039;:&#039;)
#   Constant byte #1: 0x29 (ASCII &#039;)&#039;)
#   Constant byte #2: 0x0A (ASCII linefeed, &#039;\n&#039;)
#   Variable byte #3, consisting of bits:
#     Bits 4-7 (4 MSB): 4-bit version number
#     Bits 3: Reserved
#     Bit 2 (mask 0x04): Whether raw binary (unescaped 8-bit) values may be present in content
#     Bit 1 (mask 0x02): Whether shared String value checking was enabled during encoding, default false
#     Bit 0 (mask 0x01): Whether shared property name checking was enabled during encoding, default true
#
# Reference: http://wiki.fasterxml.com/SmileFormatSpec
# Created by: Pierre-Alexandre Meyer &lt;pierre@mouraf.org&gt;

# Detection
0	string		:)\n	Smile binary data

# Versioning
&gt;3	byte&amp;0xF0	x		version %d:

# Properties
&gt;3	byte&amp;0x04	0x04		binary raw,
&gt;3	byte&amp;0x04	0x00		binary encoded,
&gt;3	byte&amp;0x02	0x02		shared String values enabled,
&gt;3	byte&amp;0x02	0x00		shared String values disabled,
&gt;3	byte&amp;0x01	0x01		shared field names enabled
&gt;3	byte&amp;0x01	0x00		shared field names disabled


#------------------------------------------------------------------------------
# $File: sniffer,v 1.19 2013/01/06 01:11:04 christos Exp $
# sniffer:  file(1) magic for packet capture files
#
# From: guy@alum.mit.edu (Guy Harris)
#

#
# Microsoft Network Monitor 1.x capture files.
#
0	string		RTSS		NetMon capture file
&gt;5	byte		x		- version %d
&gt;4	byte		x		\b.%d
&gt;6	leshort		0		(Unknown)
&gt;6	leshort		1		(Ethernet)
&gt;6	leshort		2		(Token Ring)
&gt;6	leshort		3		(FDDI)
&gt;6	leshort		4		(ATM)
&gt;6	leshort		&gt;4		(type %d)

#
# Microsoft Network Monitor 2.x capture files.
#
0	string		GMBU		NetMon capture file
&gt;5	byte		x		- version %d
&gt;4	byte		x		\b.%d
&gt;6	leshort		0		(Unknown)
&gt;6	leshort		1		(Ethernet)
&gt;6	leshort		2		(Token Ring)
&gt;6	leshort		3		(FDDI)
&gt;6	leshort		4		(ATM)
&gt;6	leshort		5		(IP-over-IEEE 1394)
&gt;6	leshort		6		(802.11)
&gt;6	leshort		7		(Raw IP)
&gt;6	leshort		8		(Raw IP)
&gt;6	leshort		9		(Raw IP)
&gt;6	leshort		&gt;9		(type %d)

#
# Network General Sniffer capture files.
# Sorry, make that &quot;Network Associates Sniffer capture files.&quot;
# Sorry, make that &quot;Network General old DOS Sniffer capture files.&quot;
#
0	string		TRSNIFF\ data\ \ \ \ \032	Sniffer capture file
&gt;33	byte		2		(compressed)
&gt;23	leshort		x		- version %d
&gt;25	leshort		x		\b.%d
&gt;32	byte		0		(Token Ring)
&gt;32	byte		1		(Ethernet)
&gt;32	byte		2		(ARCNET)
&gt;32	byte		3		(StarLAN)
&gt;32	byte		4		(PC Network broadband)
&gt;32	byte		5		(LocalTalk)
&gt;32	byte		6		(Znet)
&gt;32	byte		7		(Internetwork Analyzer)
&gt;32	byte		9		(FDDI)
&gt;32	byte		10		(ATM)

#
# Cinco Networks NetXRay capture files.
# Sorry, make that &quot;Network General Sniffer Basic capture files.&quot;
# Sorry, make that &quot;Network Associates Sniffer Basic capture files.&quot;
# Sorry, make that &quot;Network Associates Sniffer Basic, and Windows
# Sniffer Pro&quot;, capture files.&quot;
# Sorry, make that &quot;Network General Sniffer capture files.&quot;
# Sorry, make that &quot;NetScout Sniffer capture files.&quot;
#
0	string		XCP\0		NetXRay capture file
&gt;4	string		&gt;\0		- version %s
&gt;44	leshort		0		(Ethernet)
&gt;44	leshort		1		(Token Ring)
&gt;44	leshort		2		(FDDI)
&gt;44	leshort		3		(WAN)
&gt;44	leshort		8		(ATM)
&gt;44	leshort		9		(802.11)

#
# &quot;libpcap&quot; capture files.
# (We call them &quot;tcpdump capture file(s)&quot; for now, as &quot;tcpdump&quot; is
# the main program that uses that format, but there are other programs
# that use &quot;libpcap&quot;, or that use the same capture file format.)
#
0	name		pcap-be
&gt;4	beshort		x		- version %d
&gt;6	beshort		x		\b.%d
&gt;20	belong		0		(No link-layer encapsulation
&gt;20	belong		1		(Ethernet
&gt;20	belong		2		(3Mb Ethernet
&gt;20	belong		3		(AX.25
&gt;20	belong		4		(ProNET
&gt;20	belong		5		(CHAOS
&gt;20	belong		6		(Token Ring
&gt;20	belong		7		(BSD ARCNET
&gt;20	belong		8		(SLIP
&gt;20	belong		9		(PPP
&gt;20	belong		10		(FDDI
&gt;20	belong		11		(RFC 1483 ATM
&gt;20	belong		12		(raw IP
&gt;20	belong		13		(BSD/OS SLIP
&gt;20	belong		14		(BSD/OS PPP
&gt;20	belong		19		(Linux ATM Classical IP
&gt;20	belong		50		(PPP or Cisco HDLC
&gt;20	belong		51		(PPP-over-Ethernet
&gt;20	belong		99		(Symantec Enterprise Firewall
&gt;20	belong		100		(RFC 1483 ATM
&gt;20	belong		101		(raw IP
&gt;20	belong		102		(BSD/OS SLIP
&gt;20	belong		103		(BSD/OS PPP
&gt;20	belong		104		(BSD/OS Cisco HDLC
&gt;20	belong		105		(802.11
&gt;20	belong		106		(Linux Classical IP over ATM
&gt;20	belong		107		(Frame Relay
&gt;20	belong		108		(OpenBSD loopback
&gt;20	belong		109		(OpenBSD IPsec encrypted
&gt;20	belong		112		(Cisco HDLC
&gt;20	belong		113		(Linux &quot;cooked&quot;
&gt;20	belong		114		(LocalTalk
&gt;20	belong		117		(OpenBSD PFLOG
&gt;20	belong		119		(802.11 with Prism header
&gt;20	belong		122		(RFC 2625 IP over Fibre Channel
&gt;20	belong		123		(SunATM
&gt;20	belong		127		(802.11 with radiotap header
&gt;20	belong		129		(Linux ARCNET
&gt;20	belong		138		(Apple IP over IEEE 1394
&gt;20	belong		139		(MTP2 with pseudo-header
&gt;20	belong		140		(MTP2
&gt;20	belong		141		(MTP3
&gt;20	belong		142		(SCCP
&gt;20	belong		143		(DOCSIS
&gt;20	belong		144		(IrDA
&gt;20	belong		147		(Private use 0
&gt;20	belong		148		(Private use 1
&gt;20	belong		149		(Private use 2
&gt;20	belong		150		(Private use 3
&gt;20	belong		151		(Private use 4
&gt;20	belong		152		(Private use 5
&gt;20	belong		153		(Private use 6
&gt;20	belong		154		(Private use 7
&gt;20	belong		155		(Private use 8
&gt;20	belong		156		(Private use 9
&gt;20	belong		157		(Private use 10
&gt;20	belong		158		(Private use 11
&gt;20	belong		159		(Private use 12
&gt;20	belong		160		(Private use 13
&gt;20	belong		161		(Private use 14
&gt;20	belong		162		(Private use 15
&gt;20	belong		163		(802.11 with AVS header
&gt;20	belong		165		(BACnet MS/TP
&gt;20	belong		166		(PPPD
&gt;20	belong		169		(GPRS LLC
&gt;20	belong		177		(Linux LAPD
&gt;20	belong		187		(Bluetooth HCI H4
&gt;20	belong		189		(Linux USB
&gt;20	belong		192		(PPI
&gt;20	belong		195		(802.15.4
&gt;20	belong		196		(SITA
&gt;20	belong		197		(Endace ERF
&gt;20	belong		201		(Bluetooth HCI H4 with pseudo-header
&gt;20	belong		202		(AX.25 with KISS header
&gt;20	belong		203		(LAPD
&gt;20	belong		204		(PPP with direction pseudo-header
&gt;20	belong		205		(Cisco HDLC with direction pseudo-header
&gt;20	belong		206		(Frame Relay with direction pseudo-header
&gt;20	belong		209		(Linux IPMB
&gt;20	belong		215		(802.15.4 with non-ASK PHY header
&gt;20	belong		220		(Memory-mapped Linux USB
&gt;20	belong		224		(Fibre Channel FC-2
&gt;20	belong		225		(Fibre Channel FC-2 with frame delimiters
&gt;20	belong		226		(Solaris IPNET
&gt;20	belong		227		(SocketCAN
&gt;20	belong		228		(Raw IPv4
&gt;20	belong		229		(Raw IPv6
&gt;20	belong		230		(802.15.4 without FCS
&gt;20	belong		231		(D-Bus messages
&gt;20	belong		235		(DVB-CI
&gt;20	belong		236		(MUX27010
&gt;20	belong		237		(STANAG 5066 D_PDUs
&gt;20	belong		239		(Linux netlink NFLOG messages
&gt;20	belong		240		(Hilscher netAnalyzer
&gt;20	belong		241		(Hilscher netAnalyzer with delimiters
&gt;20	belong		242		(IP-over-Infiniband
&gt;20	belong		243		(MPEG-2 Transport Stream packets
&gt;20	belong		244		(ng4t ng40
&gt;20	belong		245		(NFC LLCP
&gt;20	belong		247		(Infiniband
&gt;20	belong		248		(SCTP
&gt;16	belong		x		\b, capture length %d)

0	ubelong		0xa1b2c3d4	tcpdump capture file (big-endian)
!:mime	application/vnd.tcpdump.pcap
&gt;0	use	pcap-be
0	ulelong		0xa1b2c3d4	tcpdump capture file (little-endian)
!:mime	application/vnd.tcpdump.pcap
&gt;0	use	\^pcap-be

#
# &quot;libpcap&quot;-with-Alexey-Kuznetsov&#039;s-patches capture files.
# (We call them &quot;tcpdump capture file(s)&quot; for now, as &quot;tcpdump&quot; is
# the main program that uses that format, but there are other programs
# that use &quot;libpcap&quot;, or that use the same capture file format.)
#
0	ubelong		0xa1b2cd34	extended tcpdump capture file (big-endian)
&gt;0	use	pcap-be
0	ulelong		0xa1b2cd34	extended tcpdump capture file (little-endian)
&gt;0	use	\^pcap-be

#
# &quot;pcap-ng&quot; capture files.
# http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
# Pcap-ng files can contain multiple sections. Printing the endianness,
# snaplen, or other information from the first SHB may be misleading.
#
0	ubelong		0x0a0d0d0a
&gt;8	ubelong		0x1a2b3c4d	pcap-ng capture file
&gt;&gt;12	beshort		x		- version %d
&gt;&gt;14	beshort		x		\b.%d
0	ulelong		0x0a0d0d0a
&gt;8	ulelong		0x1a2b3c4d	pcap-ng capture file
&gt;&gt;12	leshort		x		- version %d
&gt;&gt;14	leshort		x		\b.%d

#
# AIX &quot;iptrace&quot; capture files.
#
0	string		iptrace\ 1.0	&quot;iptrace&quot; capture file
0	string		iptrace\ 2.0	&quot;iptrace&quot; capture file

#
# Novell LANalyzer capture files.
#
0	leshort		0x1001		LANalyzer capture file
0	leshort		0x1007		LANalyzer capture file

#
# HP-UX &quot;nettl&quot; capture files.
#
0	string		\x54\x52\x00\x64\x00	&quot;nettl&quot; capture file

#
# RADCOM WAN/LAN Analyzer capture files.
#
0	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file

#
# NetStumbler log files.  Not really packets, per se, but about as
# close as you can get.  These are log files from NetStumbler, a
# Windows program, that scans for 802.11b networks.
#
0	string		NetS		NetStumbler log file
&gt;8	lelong		x		\b, %d stations found

#
# *Peek tagged capture files.
#
0	string		\177ver		EtherPeek/AiroPeek/OmniPeek capture file

#
# Visual Networks traffic capture files.
#
0	string		\x05VNF		Visual Networks traffic capture file

#
# Network Instruments Observer capture files.
#
0	string		ObserverPktBuffe	Network Instruments Observer capture file

#
# Files from Accellent Group&#039;s 5View products.
#
0	string		\xaa\xaa\xaa\xaa	5View capture file

#------------------------------------------------------------------------------
# $File: softquad,v 1.13 2009/09/19 16:28:12 christos Exp $
# softquad:  file(1) magic for SoftQuad Publishing Software
#
# Author/Editor and RulesBuilder
#
# XXX - byte order?
#
0	string		\&lt;!SQ\ DTD&gt;	Compiled SGML rules file
&gt;9	string		&gt;\0		 Type %s
0	string		\&lt;!SQ\ A/E&gt;	A/E SGML Document binary
&gt;9	string		&gt;\0		 Type %s
0	string		\&lt;!SQ\ STS&gt;	A/E SGML binary styles file
&gt;9	string		&gt;\0		 Type %s
0	short		0xc0de		Compiled PSI (v1) data
0	short		0xc0da		Compiled PSI (v2) data
&gt;3	string		&gt;\0		(%s)
# Binary sqtroff font/desc files...
0	short		0125252		SoftQuad DESC or font file binary
&gt;2	short		&gt;0		- version %d
# Bitmaps...
0	search/1	SQ\ BITMAP1	SoftQuad Raster Format text
#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
# sqtroff intermediate language (replacement for ditroff int. lang.)
0	string		X\ 		SoftQuad troff Context intermediate
&gt;2	string		495		for AT&amp;T 495 laser printer
&gt;2	string		hp		for Hewlett-Packard LaserJet
&gt;2	string		impr		for IMAGEN imPRESS
&gt;2	string		ps		for PostScript

# From: Michael Piefel &lt;piefel@debian.org&gt;
# sqtroff intermediate language (replacement for ditroff int. lang.)
0	string		X\ 495		SoftQuad troff Context intermediate for AT&amp;T 495 laser printer
0	string		X\ hp		SoftQuad troff Context intermediate for HP LaserJet
0	string		X\ impr		SoftQuad troff Context intermediate for IMAGEN imPRESS
0	string		X\ ps		SoftQuad troff Context intermediate for PostScript

#------------------------------------------------------------------------------
# $File: spec,v 1.4 2009/09/19 16:28:12 christos Exp $
# spec:  file(1) magic for SPEC raw results (*.raw, *.rsf)
#
# Cloyce D. Spradling &lt;cloyce@headgear.org&gt;

0	string	spec			SPEC
&gt;4	string	.cpu			CPU
&gt;&gt;8	string	&lt;:			\b%.4s
&gt;&gt;12	string	.			raw result text

17	string	version=SPECjbb		SPECjbb
&gt;32	string	&lt;:			\b%.4s
&gt;&gt;37	string	&lt;:			v%.4s raw result text

0	string	BEGIN\040SPECWEB	SPECweb
&gt;13	string	&lt;:			\b%.2s
&gt;&gt;15	string	_SSL			\b_SSL
&gt;&gt;&gt;20	string	&lt;:			v%.4s raw result text
&gt;&gt;16	string	&lt;:			v%.4s raw result text

#------------------------------------------------------------------------------
# $File: spectrum,v 1.8 2017/09/11 23:51:12 christos Exp $
# spectrum:  file(1) magic for Spectrum emulator files.
#
# John Elliott &lt;jce@seasip.demon.co.uk&gt;

#
# Spectrum +3DOS header
#
0       string          PLUS3DOS\032    Spectrum +3 data
&gt;15     byte            0               - BASIC program
&gt;15     byte            1               - number array
&gt;15     byte            2               - character array
&gt;15     byte            3               - memory block
&gt;&gt;16    belong          0x001B0040      (screen)
&gt;15     byte            4               - Tasword document
&gt;15     string          TAPEFILE        - ZXT tapefile
#
# Tape file. This assumes the .TAP starts with a Spectrum-format header,
# which nearly all will.
#
# Update: Sanity-check string contents to be printable.
#  -Adam Buchbinder &lt;adam.buchbinder@gmail.com&gt;
#
0       string          \023\000\000
&gt;4      string          &gt;\0
&gt;&gt;4     string          &lt;\177           Spectrum .TAP data &quot;%-10.10s&quot;
&gt;&gt;&gt;3    byte            0               - BASIC program
&gt;&gt;&gt;3    byte            1               - number array
&gt;&gt;&gt;3    byte            2               - character array
&gt;&gt;&gt;3    byte            3               - memory block
&gt;&gt;&gt;&gt;14  belong          0x001B0040      (screen)

# The following three blocks are from pak21-spectrum@srcf.ucam.org
# TZX tape images
0      string          ZXTape!\x1a     Spectrum .TZX data
&gt;8     byte            x               version %d
&gt;9     byte            x               \b.%d

# RZX input recording files
0      string          RZX!            Spectrum .RZX data
&gt;4     byte            x               version %d
&gt;5     byte            x               \b.%d

# Floppy disk images
0      string          MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
0      string          MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
0      string          EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
0      string          SINCLAIR        Spectrum .SCL Betadisk image

# Hard disk images
0      string          RS-IDE\x1a      Spectrum .HDF hard disk image
&gt;7     byte            x               \b, version 0x%02x

# SZX snapshots (fuse and spectaculator)
# Martin M. S. Pedersen &lt;martin@linux.com&gt;
# http://www.spectaculator.com/docs/zx-state/header.shtml
#
0      string		ZXST	       zx-state snapshot
&gt;4     byte		x	       version %d
&gt;5     byte		x	       \b.%d
&gt;&gt;6    byte		0	       16k ZX Spectrum
&gt;&gt;6    byte		1	       48k ZX Spectrum/ZX Spectrum+
&gt;&gt;6    byte		2	       ZX Spectrum 128
&gt;&gt;6    byte		3	       ZX Spectrum +2
&gt;&gt;6    byte		4	       ZX Spectrum +2A/+2B
&gt;&gt;6    byte		5	       ZX Spectrum +3
&gt;&gt;6    byte		6	       ZX Spectrum +3e
&gt;&gt;6    byte		7	       Pentagon 128
&gt;&gt;6    byte		8	       Timex Sinclair TC2048
&gt;&gt;6    byte		9	       Timex Sinclair TC2068
&gt;&gt;6    byte	       10	       Scorpion ZS-256
&gt;&gt;6    byte	       11	       ZX Spectrum SE
&gt;&gt;6    byte	       12	       Timex Sinclair TS2068
&gt;&gt;6    byte	       13	       Pentagon 512
&gt;&gt;6    byte	       14	       Pentagon 1024
&gt;&gt;6    byte	       15	       48k ZX Spectrum (NTSC)
&gt;&gt;6    byte	       16	       ZX Spectrum 12Ke
&gt;&gt;&gt;7   byte		1	       (alternate timings)

#------------------------------------------------------------------------------
# $File: sql,v 1.21 2017/03/17 21:35:28 christos Exp $
# sql:  file(1) magic for SQL files
#
# From: &quot;Marty Leisner&quot; &lt;mleisner@eng.mc.xerox.com&gt;
# Recognize some MySQL files.
# Elan Ruusamae &lt;glen@delfi.ee&gt;, added MariaDB signatures
# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
#
0	beshort			0xfe01		MySQL table definition file
&gt;2	byte			x		Version %d
&gt;3	byte			0		\b, type UNKNOWN
&gt;3	byte			1		\b, type DIAM_ISAM
&gt;3	byte			2		\b, type HASH
&gt;3	byte			3		\b, type MISAM
&gt;3	byte			4		\b, type PISAM
&gt;3	byte			5		\b, type RMS_ISAM
&gt;3	byte			6		\b, type HEAP
&gt;3	byte			7		\b, type ISAM
&gt;3	byte			8		\b, type MRG_ISAM
&gt;3	byte			9		\b, type MYISAM
&gt;3	byte			10		\b, type MRG_MYISAM
&gt;3	byte			11		\b, type BERKELEY_DB
&gt;3	byte			12		\b, type INNODB
&gt;3	byte			13		\b, type GEMINI
&gt;3	byte			14		\b, type NDBCLUSTER
&gt;3	byte			15		\b, type EXAMPLE_DB
&gt;3	byte			16		\b, type CSV_DB
&gt;3	byte			17		\b, type FEDERATED_DB
&gt;3	byte			18		\b, type BLACKHOLE_DB
&gt;3	byte			19		\b, type PARTITION_DB
&gt;3	byte			20		\b, type BINLOG
&gt;3	byte			21		\b, type SOLID
&gt;3	byte			22		\b, type PBXT
&gt;3	byte			23		\b, type TABLE_FUNCTION
&gt;3	byte			24		\b, type MEMCACHE
&gt;3	byte			25		\b, type FALCON
&gt;3	byte			26		\b, type MARIA
&gt;3	byte			27		\b, type PERFORMANCE_SCHEMA
&gt;3	byte			127		\b, type DEFAULT
&gt;0x0033	ulong			x		\b, MySQL version %d
0	belong&amp;0xffffff00	0xfefe0500	MySQL ISAM index file
&gt;3	byte			x		Version %d
0	belong&amp;0xffffff00	0xfefe0600	MySQL ISAM compressed data file
&gt;3	byte			x		Version %d
0	belong&amp;0xffffff00	0xfefe0700	MySQL MyISAM index file
&gt;3	byte			x		Version %d
&gt;14	beshort			x		\b, %d key parts
&gt;16	beshort			x		\b, %d unique key parts
&gt;18	byte			x		\b, %d keys
&gt;28	bequad			x		\b, %lld records
&gt;36	bequad			x		\b, %lld deleted records
0	belong&amp;0xffffff00	0xfefe0800	MySQL MyISAM compressed data file
&gt;3	byte			x		Version %d
0	belong&amp;0xffffff00	0xfefe0900	MySQL Maria index file
&gt;3	byte			x		Version %d
0	belong&amp;0xffffff00	0xfefe0a00	MySQL Maria compressed data file
&gt;3	byte			x		Version %d
0	belong&amp;0xffffff00	0xfefe0c00
&gt;4	string			MACF		MySQL Maria control file
&gt;&gt;3	byte			x		Version %d
0	string			\376bin	MySQL replication log,
&gt;9	long			x		server id %d
&gt;8	byte			1
&gt;&gt;13	long			69		\b, MySQL V3.2.3
&gt;&gt;&gt;19	string			x		\b, server version %s
&gt;&gt;13	long			75		\b, MySQL V4.0.2-V4.1
&gt;&gt;&gt;25	string			x		\b, server version %s
&gt;8	byte			15		MySQL V5+,
&gt;&gt;25	string			x		server version %s
&gt;4	string			MARIALOG	MySQL Maria transaction log file
&gt;&gt;3	byte			x		Version %d

#------------------------------------------------------------------------------
# iRiver H Series database file
# From Ken Guest &lt;ken@linux.ie&gt;
# As observed from iRivNavi.iDB and unencoded firmware
#
0   string		iRivDB	iRiver Database file
&gt;11  string	&gt;\0	Version %s
&gt;39  string		iHP-100	[H Series]

#------------------------------------------------------------------------------
# SQLite database files
# Ken Guest &lt;ken@linux.ie&gt;, Ty Sarna, Zack Weinberg
#
# Version 1 used GDBM internally; its files cannot be distinguished
# from other GDBM files.
#
# Version 2 used this format:
0	string	**\ This\ file\ contains\ an\ SQLite  SQLite 2.x database

# Version 3 of SQLite allows applications to embed their own &quot;user version&quot;
# number in the database at offset 60.  Later, SQLite added an &quot;application id&quot;
# at offset 68 that is preferred over &quot;user version&quot; for indicating the
# associated application.
#
0   string  SQLite\ format\ 3	SQLite 3.x database
!:mime	application/x-sqlite3
# seldom found extension sqlite3 like in SyncData.sqlite3
# db
# Avira Antivir use extension &quot;dbe&quot; like in avevtdb.dbe, avguard_tchk.dbe
# Unfortunately extension sqlite also used for other databases starting with string
# &quot;TTCONTAINER&quot; like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
# and with string &quot;ZV-zlib&quot; in like extra.sqlite
!:ext sqlite/sqlite3/db/dbe
&gt;60 belong  =0x5f4d544e  (Monotone source repository)
&gt;68 belong  =0x0f055112  (Fossil checkout)
&gt;68 belong  =0x0f055113  (Fossil global configuration)
&gt;68 belong  =0x0f055111  (Fossil repository)
&gt;68 belong  =0x42654462  (Bentley Systems BeSQLite Database)
&gt;68 belong  =0x42654c6e  (Bentley Systems Localization File)
&gt;68 belong  =0x47504b47  (OGC GeoPackage file)
&gt;68 default x
&gt;&gt;68 belong  !0          \b, application id %u
&gt;&gt;60 belong  !0          \b, user version %d
&gt;96 belong  x            \b, last written using SQLite version %d


# SQLite Write-Ahead Log from SQLite version &gt;= 3.7.0
# http://www.sqlite.org/fileformat.html#walformat
0	belong&amp;0xfffffffe	0x377f0682	SQLite Write-Ahead Log,
!:ext sqlite-wal/db-wal
&gt;4	belong	x	version %d

# SQLite Rollback Journal
# http://www.sqlite.org/fileformat.html#rollbackjournal
0	string	\xd9\xd5\x05\xf9\x20\xa1\x63\xd7	SQLite Rollback Journal

# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
# https://github.com/PredatH0r/ChanSort
0	string		PSDB\0			Panasonic channel list DataBase
!:ext db/bin
#!:mime	application/x-db-svl-panasonic
&gt;126	string		SQLite\ format\ 3
#!:mime	application/x-panasonic-sqlite3
&gt;&gt;&amp;-15	indirect	x			\b; contains

# H2 Database from http://www.h2database.com/
0	string		--\ H2\ 0.5/B\ --\ \n	H2 Database file
# Type:	OpenSSH key files
# From:	Nicolas Collignon &lt;tsointsoin@gmail.com&gt;

0	string	SSH\ PRIVATE\ KEY	OpenSSH RSA1 private key,
&gt;28	string	&gt;\0			version %s
0	string	-----BEGIN\ OPENSSH\ PRIVATE\ KEY-----	OpenSSH private key

0	string	ssh-dss\ 		OpenSSH DSA public key
0	string	ssh-rsa\ 		OpenSSH RSA public key
0	string	ecdsa-sha2-nistp256	OpenSSH ECDSA public key
0	string	ecdsa-sha2-nistp384	OpenSSH ECDSA public key
0	string	ecdsa-sha2-nistp521	OpenSSH ECDSA public key
0	string	ssh-ed25519		OpenSSH ED25519 public key

#------------------------------------------------------------------------------
# $File: ssl,v 1.5 2017/12/29 04:00:07 christos Exp $
# ssl:  file(1) magic for SSL file formats

# Type: OpenSSL certificates/key files
# From: Nicolas Collignon &lt;tsointsoin@gmail.com&gt;

0	string	-----BEGIN\040CERTIFICATE-----	PEM certificate
0	string	-----BEGIN\040CERTIFICATE\040REQ	PEM certificate request
0	string	-----BEGIN\040RSA\040PRIVATE	PEM RSA private key
0	string	-----BEGIN\040DSA\040PRIVATE	PEM DSA private key
0	string	-----BEGIN\040EC\040PRIVATE	PEM EC private key
0	string	-----BEGIN\040ECDSA\040PRIVATE	PEM ECDSA private key

# From Luc Gommans
# OpenSSL enc file (recognized by a magic string preceding the password&#039;s salt)
0	string	Salted__	openssl enc&#039;d data with salted password
# Using the -a or -base64 option, OpenSSL will base64-encode the data.
0	string U2FsdGVkX1	openssl enc&#039;d data with salted password, base64 encoded

#------------------------------------------------------------------------------
# $File: sun,v 1.27 2014/04/30 21:41:02 christos Exp $
# sun:  file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
# releases.  (5.x uses ELF.)  Entries for executables without an
# architecture type, used before the 68020-based Sun-3&#039;s came out,
# are in aout, as they&#039;re indistinguishable from other big-endian
# 32-bit a.out files.
#
0	belong&amp;077777777	0600413		a.out SunOS SPARC demand paged
&gt;0	byte		&amp;0x80
&gt;&gt;20	belong		&lt;4096		shared library
&gt;&gt;20	belong		=4096		dynamically linked executable
&gt;&gt;20	belong		&gt;4096		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped

0	belong&amp;077777777	0600410		a.out SunOS SPARC pure
&gt;0	byte		&amp;0x80		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped

0	belong&amp;077777777	0600407		a.out SunOS SPARC
&gt;0	byte		&amp;0x80		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped

0	belong&amp;077777777	0400413		a.out SunOS mc68020 demand paged
&gt;0	byte		&amp;0x80
&gt;&gt;20	belong		&lt;4096		shared library
&gt;&gt;20	belong		=4096		dynamically linked executable
&gt;&gt;20	belong		&gt;4096		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped

0	belong&amp;077777777	0400410		a.out SunOS mc68020 pure
&gt;0	byte		&amp;0x80		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped

0	belong&amp;077777777	0400407		a.out SunOS mc68020
&gt;0	byte		&amp;0x80		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped

0	belong&amp;077777777	0200413		a.out SunOS mc68010 demand paged
&gt;0	byte		&amp;0x80
&gt;&gt;20	belong		&lt;4096		shared library
&gt;&gt;20	belong		=4096		dynamically linked executable
&gt;&gt;20	belong		&gt;4096		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped

0	belong&amp;077777777	0200410		a.out SunOS mc68010 pure
&gt;0	byte		&amp;0x80		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped

0	belong&amp;077777777	0200407		a.out SunOS mc68010
&gt;0	byte		&amp;0x80		dynamically linked executable
&gt;0	byte		^0x80		executable
&gt;16	belong		&gt;0		not stripped

#
# Core files.  &quot;SPARC 4.x BCP&quot; means &quot;core file from a SunOS 4.x SPARC
# binary executed in compatibility mode under SunOS 5.x&quot;.
#
0	belong		0x080456	SunOS core file
&gt;4	belong		432		(SPARC)
&gt;&gt;132	string		&gt;\0		from &#039;%s&#039;
&gt;&gt;116	belong		=3		(quit)
&gt;&gt;116	belong		=4		(illegal instruction)
&gt;&gt;116	belong		=5		(trace trap)
&gt;&gt;116	belong		=6		(abort)
&gt;&gt;116	belong		=7		(emulator trap)
&gt;&gt;116	belong		=8		(arithmetic exception)
&gt;&gt;116	belong		=9		(kill)
&gt;&gt;116	belong		=10		(bus error)
&gt;&gt;116	belong		=11		(segmentation violation)
&gt;&gt;116	belong		=12		(bad argument to system call)
&gt;&gt;116	belong		=29		(resource lost)
&gt;&gt;120	belong		x		(T=%dK,
&gt;&gt;124	belong		x		D=%dK,
&gt;&gt;128	belong		x		S=%dK)
&gt;4	belong		826		(68K)
&gt;&gt;128	string		&gt;\0		from &#039;%s&#039;
&gt;4	belong		456		(SPARC 4.x BCP)
&gt;&gt;152	string		&gt;\0		from &#039;%s&#039;
# Sun SunPC
0	long		0xfa33c08e	SunPC 4.0 Hard Disk
0	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
# Sun snoop (see RFC 1761, which describes the capture file format,
# RFC 3827, which describes some additional datalink types, and
# http://www.iana.org/assignments/snoop-datalink-types/snoop-datalink-types.xml,
# which is the IANA registry of Snoop datalink types)
#
0	string		snoop		Snoop capture file
&gt;8	belong		&gt;0		- version %d
&gt;12	belong		0		(IEEE 802.3)
&gt;12	belong		1		(IEEE 802.4)
&gt;12	belong		2		(IEEE 802.5)
&gt;12	belong		3		(IEEE 802.6)
&gt;12	belong		4		(Ethernet)
&gt;12	belong		5		(HDLC)
&gt;12	belong		6		(Character synchronous)
&gt;12	belong		7		(IBM channel-to-channel adapter)
&gt;12	belong		8		(FDDI)
&gt;12	belong		9		(Other)
&gt;12	belong		10		(type %d)
&gt;12	belong		11		(type %d)
&gt;12	belong		12		(type %d)
&gt;12	belong		13		(type %d)
&gt;12	belong		14		(type %d)
&gt;12	belong		15		(type %d)
&gt;12	belong		16		(Fibre Channel)
&gt;12	belong		17		(ATM)
&gt;12	belong		18		(ATM Classical IP)
&gt;12	belong		19		(type %d)
&gt;12	belong		20		(type %d)
&gt;12	belong		21		(type %d)
&gt;12	belong		22		(type %d)
&gt;12	belong		23		(type %d)
&gt;12	belong		24		(type %d)
&gt;12	belong		25		(type %d)
&gt;12	belong		26		(IP over Infiniband)
&gt;12	belong		&gt;26		(type %d)

#---------------------------------------------------------------------------
# The following entries have been tested by Duncan Laurie &lt;duncan@sun.com&gt; (a
# lead Sun/Cobalt developer) who agrees that they are good and worthy of
# inclusion.

# Boot ROM images for Sun/Cobalt Linux server appliances
0       string  Cobalt\ Networks\ Inc.\nFirmware\ v     Paged COBALT boot rom
&gt;38     string x        V%.4s

# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
# at the very end where file(1) can&#039;t get it.
0       string CRfs     COBALT boot rom data (Flat boot rom or file system)

#------------------------------------------------------------------------------
# msx:  file(1) magic for the SymbOS operating system
# http://www.symbos.de
# Fabio R. Schmidlin &lt;frs@pop.com.br&gt;

# SymbOS EXE file
0x30	string		SymExe		SymbOS executable
&gt;0x36	ubyte		x		v%c
&gt;0x37	ubyte		x		\b.%c
&gt;0xF	string		x		\b, name: %s

# SymbOS DOX document
0	string		INFOq\0		SymbOS DOX document

# Symbos driver
0	string		SMD1		SymbOS driver
&gt;19	byte		x		\b, name: %c
&gt;20	byte		x		\b%c
&gt;21	byte		x		\b%c
&gt;22	byte		x		\b%c
&gt;23	byte		x		\b%c
&gt;24	byte		x		\b%c
&gt;25	byte		x		\b%c
&gt;26	byte		x		\b%c
&gt;27	byte		x		\b%c
&gt;28	byte		x		\b%c
&gt;29	byte		x		\b%c
&gt;30	byte		x		\b%c
&gt;31	byte		x		\b%c

# Symbos video
0	string		SymVid		SymbOS video
&gt;6	ubyte		x		v%c
&gt;7	ubyte		x		\b.%c

# Soundtrakker 128 ST2 music
0	byte		0
&gt;0xC	string		\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x40\x00	Soundtrakker 128 ST2 music,
&gt;&gt;1	string		x		name: %s


#------------------------------------------------------------------------
# $File: sysex,v 1.9 2017/03/17 21:35:28 christos Exp $
# sysex: file(1) magic for MIDI sysex files
#
# GRR: original 1 byte test at offset was too general as it catches also many FATs of DOS filesystems
# where real SYStem EXclusive messages at offset 1 are limited to seven bits
# http://en.wikipedia.org/wiki/MIDI
0	ubeshort&amp;0xFF80		0xF000		SysEx File -

# North American Group
&gt;1	byte			0x01		Sequential
&gt;1	byte			0x02		IDP
&gt;1	byte			0x03		OctavePlateau
&gt;1	byte			0x04		Moog
&gt;1	byte			0x05		Passport
&gt;1	byte			0x06		Lexicon
&gt;1	byte			0x07		Kurzweil/Future Retro
&gt;&gt;3	byte			0x77		777
&gt;&gt;4	byte			0x00		Bank
&gt;&gt;4	byte			0x01		Song
&gt;&gt;5	byte			0x0f		16
&gt;&gt;5	byte			0x0e		15
&gt;&gt;5	byte			0x0d		14
&gt;&gt;5	byte			0x0c		13
&gt;&gt;5	byte			0x0b		12
&gt;&gt;5	byte			0x0a		11
&gt;&gt;5	byte			0x09		10
&gt;&gt;5	byte			0x08		9
&gt;&gt;5	byte			0x07		8
&gt;&gt;5	byte			0x06		7
&gt;&gt;5	byte			0x05		6
&gt;&gt;5	byte			0x04		5
&gt;&gt;5	byte			0x03		4
&gt;&gt;5	byte			0x02		3
&gt;&gt;5	byte			0x01		2
&gt;&gt;5	byte			0x00		1
&gt;&gt;5	byte			0x10		(ALL)
&gt;&gt;2	byte			x			\b, Channel %d
&gt;1	byte			0x08		Fender
&gt;1	byte			0x09		Gulbransen
&gt;1	byte			0x0a		AKG
&gt;1	byte			0x0b		Voyce
&gt;1	byte			0x0c		Waveframe
&gt;1	byte			0x0d		ADA
&gt;1	byte			0x0e		Garfield
&gt;1	byte			0x0f		Ensoniq
&gt;1	byte			0x10		Oberheim
&gt;&gt;2	byte			0x06		Matrix 6 series
&gt;&gt;3	byte			0x0A		Dump (All)
&gt;&gt;3	byte			0x01		Dump (Bank)
&gt;&gt;4 belong			0x0002040E		Matrix 1000
&gt;&gt;&gt;11 byte			&lt;2			User bank %d
&gt;&gt;&gt;11 byte			&gt;1			Preset bank %d
&gt;1	byte			0x11		Apple
&gt;1	byte			0x12		GreyMatter
&gt;1	byte			0x14		PalmTree
&gt;1	byte			0x15		JLCooper
&gt;1	byte			0x16		Lowrey
&gt;1	byte			0x17		AdamsSmith
&gt;1	byte			0x18		E-mu
&gt;1	byte			0x19		Harmony
&gt;1	byte			0x1a		ART
&gt;1	byte			0x1b		Baldwin
&gt;1	byte			0x1c		Eventide
&gt;1	byte			0x1d		Inventronics
&gt;1	byte			0x1f		Clarity

# European Group
&gt;1	byte			0x21		SIEL
&gt;1	byte			0x22		Synthaxe
&gt;1	byte			0x24		Hohner
&gt;1	byte			0x25		Twister
&gt;1	byte			0x26		Solton
&gt;1	byte			0x27		Jellinghaus
&gt;1	byte			0x28		Southworth
&gt;1	byte			0x29		PPG
&gt;1	byte			0x2a		JEN
&gt;1	byte			0x2b		SSL
&gt;1	byte			0x2c		AudioVertrieb

&gt;1	byte			0x2f		ELKA
&gt;&gt;3	byte			0x09		EK-44

&gt;1	byte			0x30		Dynacord
&gt;1	byte			0x31		Jomox
&gt;1	byte			0x33		Clavia
&gt;1	byte			0x39		Soundcraft
# Some Waldorf info from http://Stromeko.Synth.net/Downloads#WaldorfDocs
&gt;1	byte			0x3e		Waldorf
&gt;&gt;2	byte			0x00		microWave
&gt;&gt;2	byte			0x0E		microwave2 / XT
&gt;&gt;2	byte			0x0F		Q / Q+
&gt;&gt;3	byte			=0			(default id)
&gt;&gt;3 byte			&gt;0			(
&gt;&gt;&gt;3 byte			&lt;0x7F		\bdevice %d)
&gt;&gt;&gt;3 byte			=0x7F		\bbroadcast id)
&gt;&gt;3	byte			0x7f		Microwave I
&gt;&gt;&gt;4	byte			0x00		SNDR (Sound Request)
&gt;&gt;&gt;4	byte			0x10		SNDD (Sound Dump)
&gt;&gt;&gt;4	byte			0x20		SNDP (Sound Parameter Change)
&gt;&gt;&gt;4	byte			0x30		SNDQ (Sound Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x70		BOOT (Sound Reserved)
&gt;&gt;&gt;4	byte			0x01		MULR (Multi Request)
&gt;&gt;&gt;4	byte			0x11		MULD (Multi Dump)
&gt;&gt;&gt;4	byte			0x21		MULP (Multi Parameter Change)
&gt;&gt;&gt;4	byte			0x31		MULQ (Multi Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x71		OS (Multi Reserved)
&gt;&gt;&gt;4	byte			0x02		DRMR (Drum Map Request)
&gt;&gt;&gt;4	byte			0x12		DRMD (Drum Map Dump)
&gt;&gt;&gt;4	byte			0x22		DRMP (Drum Map Parameter Change)
&gt;&gt;&gt;4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x72		BIN (Drum Map Reserved)
&gt;&gt;&gt;4	byte			0x03		PATR (Sequencer Pattern Request)
&gt;&gt;&gt;4	byte			0x13		PATD (Sequencer Pattern Dump)
&gt;&gt;&gt;4	byte			0x23		PATP (Sequencer Pattern Parameter Change)
&gt;&gt;&gt;4	byte			0x33		PATQ (Sequencer Pattern Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x73		AFM (Sequencer Pattern Reserved)
&gt;&gt;&gt;4	byte			0x04		GLBR (Global Parameter Request)
&gt;&gt;&gt;4	byte			0x14		GLBD (Global Parameter Dump)
&gt;&gt;&gt;4	byte			0x24		GLBP (Global Parameter Parameter Change)
&gt;&gt;&gt;4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x07		MODR (Mode Parameter Request)
&gt;&gt;&gt;4	byte			0x17		MODD (Mode Parameter Dump)
&gt;&gt;&gt;4	byte			0x27		MODP (Mode Parameter Parameter Change)
&gt;&gt;&gt;4	byte			0x37		MODQ (Mode Parameter Parameter Inquiry)
&gt;&gt;2	byte			0x10		microQ
&gt;&gt;&gt;4	byte			0x00		SNDR (Sound Request)
&gt;&gt;&gt;4	byte			0x10		SNDD (Sound Dump)
&gt;&gt;&gt;4	byte			0x20		SNDP (Sound Parameter Change)
&gt;&gt;&gt;4	byte			0x30		SNDQ (Sound Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x70		(Sound Reserved)
&gt;&gt;&gt;4	byte			0x01		MULR (Multi Request)
&gt;&gt;&gt;4	byte			0x11		MULD (Multi Dump)
&gt;&gt;&gt;4	byte			0x21		MULP (Multi Parameter Change)
&gt;&gt;&gt;4	byte			0x31		MULQ (Multi Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x71		OS (Multi Reserved)
&gt;&gt;&gt;4	byte			0x02		DRMR (Drum Map Request)
&gt;&gt;&gt;4	byte			0x12		DRMD (Drum Map Dump)
&gt;&gt;&gt;4	byte			0x22		DRMP (Drum Map Parameter Change)
&gt;&gt;&gt;4	byte			0x32		DRMQ (Drum Map Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x72		BIN (Drum Map Reserved)
&gt;&gt;&gt;4	byte			0x04		GLBR (Global Parameter Request)
&gt;&gt;&gt;4	byte			0x14		GLBD (Global Parameter Dump)
&gt;&gt;&gt;4	byte			0x24		GLBP (Global Parameter Parameter Change)
&gt;&gt;&gt;4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
&gt;&gt;2	byte			0x11		rackAttack
&gt;&gt;&gt;4	byte			0x00		SNDR (Sound Parameter Request)
&gt;&gt;&gt;4	byte			0x10		SNDD (Sound Parameter Dump)
&gt;&gt;&gt;4	byte			0x20		SNDP (Sound Parameter Parameter Change)
&gt;&gt;&gt;4	byte			0x30		SNDQ (Sound Parameter Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x01		PRGR (Program Parameter Request)
&gt;&gt;&gt;4	byte			0x11		PRGD (Program Parameter Dump)
&gt;&gt;&gt;4	byte			0x21		PRGP (Program Parameter Parameter Change)
&gt;&gt;&gt;4	byte			0x31		PRGQ (Program Parameter Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x71		OS (Program Parameter Reserved)
&gt;&gt;&gt;4	byte			0x03		PATR (Pattern Parameter Request)
&gt;&gt;&gt;4	byte			0x13		PATD (Pattern Parameter Dump)
&gt;&gt;&gt;4	byte			0x23		PATP (Pattern Parameter Parameter Change)
&gt;&gt;&gt;4	byte			0x33		PATQ (Pattern Parameter Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x04		GLBR (Global Parameter Request)
&gt;&gt;&gt;4	byte			0x14		GLBD (Global Parameter Dump)
&gt;&gt;&gt;4	byte			0x24		GLBP (Global Parameter Parameter Change)
&gt;&gt;&gt;4	byte			0x34		GLBQ (Global Parameter Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x05		EFXR (FX Parameter Request)
&gt;&gt;&gt;4	byte			0x15		EFXD (FX Parameter Dump)
&gt;&gt;&gt;4	byte			0x25		EFXP (FX Parameter Parameter Change)
&gt;&gt;&gt;4	byte			0x35		EFXQ (FX Parameter Parameter Inquiry)
&gt;&gt;&gt;4	byte			0x07		MODR (Mode Command Request)
&gt;&gt;&gt;4	byte			0x17		MODD (Mode Command Dump)
&gt;&gt;&gt;4	byte			0x27		MODP (Mode Command Parameter Change)
&gt;&gt;&gt;4	byte			0x37		MODQ (Mode Command Parameter Inquiry)
&gt;&gt;2	byte			0x03		Wave
&gt;&gt;&gt;4	byte			0x00		SBPR (Soundprogram)
&gt;&gt;&gt;4	byte			0x01		SAPR (Performance)
&gt;&gt;&gt;4	byte			0x02		SWAVE (Wave)
&gt;&gt;&gt;4	byte			0x03		SWTBL (Wave control table)
&gt;&gt;&gt;4	byte			0x04		SVT (Velocity Curve)
&gt;&gt;&gt;4	byte			0x05		STT (Tuning Table)
&gt;&gt;&gt;4	byte			0x06		SGLB (Global Parameters)
&gt;&gt;&gt;4	byte			0x07		SARRMAP (Performance Program Change Map)
&gt;&gt;&gt;4	byte			0x08		SBPRMAP (Sound Program Change Map)
&gt;&gt;&gt;4	byte			0x09		SBPRPAR (Sound Parameter)
&gt;&gt;&gt;4	byte			0x0A		SARRPAR (Performance Parameter)
&gt;&gt;&gt;4	byte			0x0B		SINSPAR (Instrument/External Parameter)
&gt;&gt;&gt;4	byte			0x0F		SBULK (Bulk Switch on/off)

# Japanese Group
&gt;1	byte			0x40		Kawai
&gt;&gt;3	byte			0x20		K1
&gt;&gt;3	byte			0x22		K4

&gt;1	byte			0x41		Roland
&gt;&gt;3	byte			0x14		D-50
&gt;&gt;3	byte			0x2b		U-220
&gt;&gt;3	byte			0x02		TR-707

&gt;1	byte			0x42		Korg
&gt;&gt;3	byte			0x19		M1

&gt;1	byte			0x43		Yamaha
&gt;1	byte			0x44		Casio
&gt;1	byte			0x46		Kamiya
&gt;1	byte			0x47		Akai
&gt;1	byte			0x48		Victor
&gt;1	byte			0x49		Mesosha
&gt;1	byte			0x4b		Fujitsu
&gt;1	byte			0x4c		Sony
&gt;1	byte			0x4e		Teac
&gt;1	byte			0x50		Matsushita
&gt;1	byte			0x51		Fostex
&gt;1	byte			0x52		Zoom
&gt;1	byte			0x54		Matsushita
&gt;1	byte			0x57		Acoustic tech. lab.
# http://www.midi.org/techspecs/manid.php
&gt;1	belong&amp;0xffffff00	0x00007400	Ta Horng
&gt;1	belong&amp;0xffffff00	0x00007500	e-Tek
&gt;1	belong&amp;0xffffff00	0x00007600	E-Voice
&gt;1	belong&amp;0xffffff00	0x00007700	Midisoft
&gt;1	belong&amp;0xffffff00	0x00007800	Q-Sound
&gt;1	belong&amp;0xffffff00	0x00007900	Westrex
&gt;1	belong&amp;0xffffff00	0x00007a00	Nvidia*
&gt;1	belong&amp;0xffffff00	0x00007b00	ESS
&gt;1	belong&amp;0xffffff00	0x00007c00	Mediatrix
&gt;1	belong&amp;0xffffff00	0x00007d00	Brooktree
&gt;1	belong&amp;0xffffff00	0x00007e00	Otari
&gt;1	belong&amp;0xffffff00	0x00007f00	Key Electronics
&gt;1	belong&amp;0xffffff00	0x00010000	Shure
&gt;1	belong&amp;0xffffff00	0x00010100	AuraSound
&gt;1	belong&amp;0xffffff00	0x00010200	Crystal
&gt;1	belong&amp;0xffffff00	0x00010300	Rockwell
&gt;1	belong&amp;0xffffff00	0x00010400	Silicon Graphics
&gt;1	belong&amp;0xffffff00	0x00010500	Midiman
&gt;1	belong&amp;0xffffff00	0x00010600	PreSonus
&gt;1	belong&amp;0xffffff00	0x00010800	Topaz
&gt;1	belong&amp;0xffffff00	0x00010900	Cast Lightning
&gt;1	belong&amp;0xffffff00	0x00010a00	Microsoft
&gt;1	belong&amp;0xffffff00	0x00010b00	Sonic Foundry
&gt;1	belong&amp;0xffffff00	0x00010c00	Line 6
&gt;1	belong&amp;0xffffff00	0x00010d00	Beatnik Inc.
&gt;1	belong&amp;0xffffff00	0x00010e00	Van Koerving
&gt;1	belong&amp;0xffffff00	0x00010f00	Altech Systems
&gt;1	belong&amp;0xffffff00	0x00011000	S &amp; S Research
&gt;1	belong&amp;0xffffff00	0x00011100	VLSI Technology
&gt;1	belong&amp;0xffffff00	0x00011200	Chromatic
&gt;1	belong&amp;0xffffff00	0x00011300	Sapphire
&gt;1	belong&amp;0xffffff00	0x00011400	IDRC
&gt;1	belong&amp;0xffffff00	0x00011500	Justonic Tuning
&gt;1	belong&amp;0xffffff00	0x00011600	TorComp
&gt;1	belong&amp;0xffffff00	0x00011700	Newtek Inc.
&gt;1	belong&amp;0xffffff00	0x00011800	Sound Sculpture
&gt;1	belong&amp;0xffffff00	0x00011900	Walker Technical
&gt;1	belong&amp;0xffffff00	0x00011a00	Digital Harmony
&gt;1	belong&amp;0xffffff00	0x00011b00	InVision
&gt;1	belong&amp;0xffffff00	0x00011c00	T-Square
&gt;1	belong&amp;0xffffff00	0x00011d00	Nemesys
&gt;1	belong&amp;0xffffff00	0x00011e00	DBX
&gt;1	belong&amp;0xffffff00	0x00011f00	Syndyne
&gt;1	belong&amp;0xffffff00	0x00012000	Bitheadz
&gt;1	belong&amp;0xffffff00	0x00012100	Cakewalk
&gt;1	belong&amp;0xffffff00	0x00012200	Staccato
&gt;1	belong&amp;0xffffff00	0x00012300	National Semicon.
&gt;1	belong&amp;0xffffff00	0x00012400	Boom Theory
&gt;1	belong&amp;0xffffff00	0x00012500	Virtual DSP Corp
&gt;1	belong&amp;0xffffff00	0x00012600	Antares
&gt;1	belong&amp;0xffffff00	0x00012700	Angel Software
&gt;1	belong&amp;0xffffff00	0x00012800	St Louis Music
&gt;1	belong&amp;0xffffff00	0x00012900	Lyrrus dba G-VOX
&gt;1	belong&amp;0xffffff00	0x00012a00	Ashley Audio
&gt;1	belong&amp;0xffffff00	0x00012b00	Vari-Lite
&gt;1	belong&amp;0xffffff00	0x00012c00	Summit Audio
&gt;1	belong&amp;0xffffff00	0x00012d00	Aureal Semicon.
&gt;1	belong&amp;0xffffff00	0x00012e00	SeaSound
&gt;1	belong&amp;0xffffff00	0x00012f00	U.S. Robotics
&gt;1	belong&amp;0xffffff00	0x00013000	Aurisis
&gt;1	belong&amp;0xffffff00	0x00013100	Nearfield Multimedia
&gt;1	belong&amp;0xffffff00	0x00013200	FM7 Inc.
&gt;1	belong&amp;0xffffff00	0x00013300	Swivel Systems
&gt;1	belong&amp;0xffffff00	0x00013400	Hyperactive
&gt;1	belong&amp;0xffffff00	0x00013500	MidiLite
&gt;1	belong&amp;0xffffff00	0x00013600	Radical
&gt;1	belong&amp;0xffffff00	0x00013700	Roger Linn
&gt;1	belong&amp;0xffffff00	0x00013800	Helicon
&gt;1	belong&amp;0xffffff00	0x00013900	Event
&gt;1	belong&amp;0xffffff00	0x00013a00	Sonic Network
&gt;1	belong&amp;0xffffff00	0x00013b00	Realtime Music
&gt;1	belong&amp;0xffffff00	0x00013c00	Apogee Digital

&gt;1	belong&amp;0xffffff00	0x00202b00	Medeli Electronics
&gt;1	belong&amp;0xffffff00	0x00202c00	Charlie Lab
&gt;1	belong&amp;0xffffff00	0x00202d00	Blue Chip Music
&gt;1	belong&amp;0xffffff00	0x00202e00	BEE OH Corp
&gt;1	belong&amp;0xffffff00	0x00202f00	LG Semicon America
&gt;1	belong&amp;0xffffff00	0x00203000	TESI
&gt;1	belong&amp;0xffffff00	0x00203100	EMAGIC
&gt;1	belong&amp;0xffffff00	0x00203200	Behringer
&gt;1	belong&amp;0xffffff00	0x00203300	Access Music
&gt;1	belong&amp;0xffffff00	0x00203400	Synoptic
&gt;1	belong&amp;0xffffff00	0x00203500	Hanmesoft Corp
&gt;1	belong&amp;0xffffff00	0x00203600	Terratec
&gt;1	belong&amp;0xffffff00	0x00203700	Proel SpA
&gt;1	belong&amp;0xffffff00	0x00203800	IBK MIDI
&gt;1	belong&amp;0xffffff00	0x00203900	IRCAM
&gt;1	belong&amp;0xffffff00	0x00203a00	Propellerhead Software
&gt;1	belong&amp;0xffffff00	0x00203b00	Red Sound Systems
&gt;1	belong&amp;0xffffff00	0x00203c00	Electron ESI AB
&gt;1	belong&amp;0xffffff00	0x00203d00	Sintefex Audio
&gt;1	belong&amp;0xffffff00	0x00203e00	Music and More
&gt;1	belong&amp;0xffffff00	0x00203f00	Amsaro
&gt;1	belong&amp;0xffffff00	0x00204000	CDS Advanced Technology
&gt;1	belong&amp;0xffffff00	0x00204100	Touched by Sound
&gt;1	belong&amp;0xffffff00	0x00204200	DSP Arts
&gt;1	belong&amp;0xffffff00	0x00204300	Phil Rees Music
&gt;1	belong&amp;0xffffff00	0x00204400	Stamer Musikanlagen GmbH
&gt;1	belong&amp;0xffffff00	0x00204500	Soundart
&gt;1	belong&amp;0xffffff00	0x00204600	C-Mexx Software
&gt;1	belong&amp;0xffffff00	0x00204700	Klavis Tech.
&gt;1	belong&amp;0xffffff00	0x00204800	Noteheads AB

0	string			T707		Roland TR-707 Data
#------------------------------------------------------------------------------
# file:  file(1) magic for Tcl scripting language
# URL:  http://www.tcl.tk/
# From: gustaf neumann

# Tcl scripts
0	search/1/w	#!\ /usr/bin/tcl	Tcl script text executable
!:mime	text/x-tcl
0	search/1/w	#!\ /usr/local/bin/tcl	Tcl script text executable
!:mime	text/x-tcl
0	search/1	#!/usr/bin/env\ tcl	Tcl script text executable
!:mime	text/x-tcl
0	search/1	#!\ /usr/bin/env\ tcl	Tcl script text executable
!:mime	text/x-tcl
0       string/wt       #!\ /usr/bin/jimsh      Jim TCL text executable
!:mime  text/x-tcl
0       search/1/wt      #!\ /usr/bin/tclsh     Tcl/Tk script text executable
!:mime  text/x-tcl
0	search/1/w	#!\ /usr/bin/wish	Tcl/Tk script text executable
!:mime	text/x-tcl
0	search/1/w	#!\ /usr/local/bin/wish	Tcl/Tk script text executable
!:mime	text/x-tcl
0	search/1	#!/usr/bin/env\ wish	Tcl/Tk script text executable
!:mime	text/x-tcl
0	search/1	#!\ /usr/bin/env\ wish	Tcl/Tk script text executable
!:mime	text/x-tcl

# check the first line
0	search/1	package\ req
&gt;0	regex		\^package[\ \t]+req	Tcl script
# not &#039;p&#039;, check other lines
0	search/1	!p
&gt;0	regex		\^package[\ \t]+req	Tcl script

#------------------------------------------------------------------------------
# $File: teapot,v 1.4 2009/09/19 16:28:12 christos Exp $
# teapot:  file(1) magic for &quot;teapot&quot; spreadsheet
#
0       string          #!teapot\012xdr      teapot work sheet (XDR format)

#------------------------------------------------------------------------------
# $File: terminfo,v 1.10 2018/01/21 03:26:33 christos Exp $
# terminfo:  file(1) magic for terminfo
#
# URL: http://invisible-island.net/ncurses/man/term.5.html
# URL: http://invisible-island.net/ncurses/man/scr_dump.5.html
#
# Workaround for Targa image type by Joerg Jenderek
# GRR: line below too general as it catches also
# Targa image type 1 with 26 long identification field
# and HELP.DSK
0	string		\032\001
# 5th character of terminal name list, but not Targa image pixel size (15 16 24 32)
&gt;16	ubyte		&gt;32
# namelist, if more than 1 separated by &quot;|&quot; like &quot;st|stterm| simpleterm 0.4.1&quot;
&gt;&gt;12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled terminfo entry &quot;%-s&quot;
!:mime	application/x-terminfo
# no extension
#!:ext
#
#------------------------------------------------------------------------------
# The following was added for ncurses6 development:
#------------------------------------------------------------------------------
#
0	string		\036\002
# imitate the legacy compiled-format, to get the entry-name printed
&gt;16	ubyte		&gt;32
# namelist, if more than 1 separated by &quot;|&quot; like &quot;st|stterm| simpleterm 0. 4.1&quot;
&gt;&gt;12	regex		\^[a-zA-Z0-9][a-zA-Z0-9.][^|]*	Compiled 32-bit terminfo entry &quot;%-s&quot;
!:mime	application/x-terminfo2
#
# While the compiled terminfo uses little-endian format irregardless of
# platform, SystemV screen dumps do not.  They came later, and that detail was
# overlooked.
#
# AIX and HPUX use the SVr4 big-endian format
# Solaris uses the SVr3 formats (sparc and x86 differ endian-ness)
0	beshort		0433 		SVr2 curses screen image, big-endian
0	beshort		0434		SVr3 curses screen image, big-endian
0	beshort		0435		SVr4 curses screen image, big-endian
#
0	leshort		0433		SVr2 curses screen image, little-endian
0	leshort		0434		SVr3 curses screen image, little-endian
0	leshort		0435		SVr4 curses screen image, little-endian
#
# Rather than SVr4, Solaris &quot;xcurses&quot; writes this header:
0	regex		\^MAX=[0-9]+,[0-9]+$
&gt;1	regex		\^BEG=[0-9]+,[0-9]+$
&gt;2	regex		\^SCROLL=[0-9]+,[0-9]+$
&gt;3	regex		\^VMIN=[0-9]+$
&gt;4	regex		\^VTIME=[0-9]+$
&gt;5	regex		\^FLAGS=0x[[:xdigit:]]+$
&gt;6	regex		\^FG=[0-9],[0-9]+$
&gt;7	regex		\^BG=[0-9]+,[0-9]+,	Solaris xcurses screen image
#
# ncurses5 (and before) did not use a magic number, making screen dumps &quot;data&quot;.
# ncurses6 (2015) uses this format, ignoring byte-order
0	string	\210\210\210\210ncurses	ncurses6 screen image
#
# PDCurses added this in 2005
0	string		PDC\001		PDCurses screen image

#------------------------------------------------------------------------------
# $File: tex,v 1.20 2014/03/16 02:53:03 christos Exp $
# tex:  file(1) magic for TeX files
#
# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
#
# From &lt;conklin@talisman.kaleida.com&gt;

# Although we may know the offset of certain text fields in TeX DVI
# and font files, we can&#039;t use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0	string		\367\002	TeX DVI file
!:mime	application/x-dvi
&gt;16	string		&gt;\0		(%s)
0	string		\367\203	TeX generic font data
0	string		\367\131	TeX packed font data
&gt;3	string		&gt;\0		(%s)
0	string		\367\312	TeX virtual font data
0	search/1	This\ is\ TeX,	TeX transcript text
0	search/1	This\ is\ METAFONT,	METAFONT transcript text

# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data.  The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2	string		\000\021	TeX font metric data
!:mime	application/x-tex-tfm
&gt;33	string		&gt;\0		(%s)
2	string		\000\022	TeX font metric data
!:mime	application/x-tex-tfm
&gt;33	string		&gt;\0		(%s)

# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0	search/1	\\input\ texinfo	Texinfo source text
!:mime	text/x-texinfo
0	search/1	This\ is\ Info\ file	GNU Info text
!:mime	text/x-info

# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
0	search/4096	\\input		TeX document text
!:mime	text/x-tex
!:strength + 15
0	search/4096	\\begin		LaTeX document text
!:mime	text/x-tex
!:strength + 15
0	search/4096	\\section	LaTeX document text
!:mime	text/x-tex
!:strength + 18
0	search/4096	\\setlength	LaTeX document text
!:mime	text/x-tex
!:strength + 15
0	search/4096	\\documentstyle	LaTeX document text
!:mime	text/x-tex
!:strength + 18
0	search/4096	\\chapter	LaTeX document text
!:mime	text/x-tex
!:strength + 18
0	search/4096	\\documentclass	LaTeX 2e document text
!:mime	text/x-tex
!:strength + 15
0	search/4096	\\relax		LaTeX auxiliary file
!:mime	text/x-tex
!:strength + 15
0	search/4096	\\contentsline	LaTeX table of contents
!:mime	text/x-tex
!:strength + 15
0	search/4096	%\ -*-latex-*-	LaTeX document text
!:mime	text/x-tex

# Tex document, from Hendrik Scholz &lt;hendrik@scholz.net&gt;
0   	search/1	\\ifx		TeX document text

# Index and glossary files
0	search/4096	\\indexentry	LaTeX raw index file
0	search/4096	\\begin{theindex}	LaTeX sorted index
0	search/4096	\\glossaryentry	LaTeX raw glossary
0	search/4096	\\begin{theglossary}	LaTeX sorted glossary
0	search/4096	This\ is\ makeindex	Makeindex log file

# End of TeX

#------------------------------------------------------------------------------
# file(1) magic for BibTex text files
# From Hendrik Scholz &lt;hendrik@scholz.net&gt;

0	search/1/c	@article{	BibTeX text file
0	search/1/c	@book{		BibTeX text file
0	search/1/c	@inbook{	BibTeX text file
0	search/1/c	@incollection{	BibTeX text file
0	search/1/c	@inproceedings{	BibTeX text file
0	search/1/c	@manual{	BibTeX text file
0	search/1/c	@misc{		BibTeX text file
0	search/1/c	@preamble{	BibTeX text file
0	search/1/c	@phdthesis{	BibTeX text file
0	search/1/c	@techreport{	BibTeX text file
0	search/1/c	@unpublished{	BibTeX text file

73	search/1	%%%\ \ 		BibTeX-file{ BibTex text file (with full header)

73	search/1	%%%\ \ @BibTeX-style-file{   BibTeX style text file (with full header)

0	search/1	%\ BibTeX\ standard\ bibliography\ 	BibTeX standard bibliography style text file

0	search/1	%\ BibTeX\ `	BibTeX custom bibliography style text file

0	search/1	@c\ @mapfile{	TeX font aliases text file

0	string		#LyX		LyX document text

# ConTeXt documents
#	http://wiki.contextgarden.net/
0	search/4096	\\setupcolors[		ConTeXt document text
!:strength + 15
0	search/4096	\\definecolor[		ConTeXt document text
!:strength + 15
0	search/4096	\\setupinteraction[	ConTeXt document text
!:strength + 15
0	search/4096	\\useURL[		ConTeXt document text
!:strength + 15
0	search/4096	\\setuppapersize[	ConTeXt document text
!:strength + 15
0	search/4096	\\setuplayout[		ConTeXt document text
!:strength + 15
0	search/4096	\\setupfooter[		ConTeXt document text
!:strength + 15
0	search/4096	\\setupfootertexts[	ConTeXt document text
!:strength + 15
0	search/4096	\\setuppagenumbering[	ConTeXt document text
!:strength + 15
0	search/4096	\\setupbodyfont[	ConTeXt document text
!:strength + 15
0	search/4096	\\setuphead[		ConTeXt document text
!:strength + 15
0	search/4096	\\setupitemize[		ConTeXt document text
!:strength + 15
0	search/4096	\\setupwhitespace[	ConTeXt document text
!:strength + 15
0	search/4096	\\setupindenting[	ConTeXt document text
!:strength + 15

#------------------------------------------------------------------------------
# $File: tgif,v 1.7 2010/09/20 19:03:46 rrt Exp $
# file(1) magic for tgif(1) files
# From Hendrik Scholz &lt;hendrik@scholz.net&gt;
0	string	%TGIF\ 			Tgif file version
&gt;6	string	x			%s

#------------------------------------------------------------------------------
# $File: ti-8x,v 1.7 2014/04/30 21:41:02 christos Exp $
# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
#
# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
#
# Update: Romain Lievin (roms@lpg.ticalc.org).
#
# NOTE: This list is not complete.
# Files for the TI-80 and TI-81 are pretty rare. I&#039;m not going to put the
# program/group magic numbers in here because I cannot find any.
0		string		**TI80**	TI-80 Graphing Calculator File.
0		string		**TI81**	TI-81 Graphing Calculator File.
#
# Magic Numbers for the TI-73
#
0		string		**TI73**	TI-73 Graphing Calculator
&gt;0x00003B	byte		0x00		(real number)
&gt;0x00003B	byte		0x01		(list)
&gt;0x00003B	byte		0x02		(matrix)
&gt;0x00003B	byte		0x03		(equation)
&gt;0x00003B	byte		0x04		(string)
&gt;0x00003B	byte		0x05		(program)
&gt;0x00003B	byte		0x06		(assembly program)
&gt;0x00003B	byte		0x07		(picture)
&gt;0x00003B	byte		0x08		(gdb)
&gt;0x00003B	byte		0x0C		(complex number)
&gt;0x00003B	byte		0x0F		(window settings)
&gt;0x00003B	byte		0x10		(zoom)
&gt;0x00003B	byte		0x11		(table setup)
&gt;0x00003B	byte		0x13		(backup)

# Magic Numbers for the TI-82
#
0		string		**TI82**	TI-82 Graphing Calculator
&gt;0x00003B	byte		0x00		(real)
&gt;0x00003B	byte		0x01		(list)
&gt;0x00003B	byte		0x02		(matrix)
&gt;0x00003B	byte		0x03		(Y-variable)
&gt;0x00003B	byte		0x05		(program)
&gt;0x00003B	byte		0x06		(protected prgm)
&gt;0x00003B	byte		0x07		(picture)
&gt;0x00003B	byte		0x08		(gdb)
&gt;0x00003B	byte		0x0B		(window settings)
&gt;0x00003B	byte		0x0C		(window settings)
&gt;0x00003B	byte		0x0D		(table setup)
&gt;0x00003B	byte		0x0E		(screenshot)
&gt;0x00003B	byte		0x0F		(backup)
#
# Magic Numbers for the TI-83
#
0		string		**TI83**	TI-83 Graphing Calculator
&gt;0x00003B	byte		0x00		(real)
&gt;0x00003B	byte		0x01		(list)
&gt;0x00003B	byte		0x02		(matrix)
&gt;0x00003B	byte		0x03		(Y-variable)
&gt;0x00003B	byte		0x04		(string)
&gt;0x00003B	byte		0x05		(program)
&gt;0x00003B	byte		0x06		(protected prgm)
&gt;0x00003B	byte		0x07		(picture)
&gt;0x00003B	byte		0x08		(gdb)
&gt;0x00003B	byte		0x0B		(window settings)
&gt;0x00003B	byte		0x0C		(window settings)
&gt;0x00003B	byte		0x0D		(table setup)
&gt;0x00003B	byte		0x0E		(screenshot)
&gt;0x00003B	byte		0x13		(backup)
#
# Magic Numbers for the TI-83+
#
0		string		**TI83F*	TI-83+ Graphing Calculator
&gt;0x00003B	byte		0x00		(real number)
&gt;0x00003B	byte		0x01		(list)
&gt;0x00003B	byte		0x02		(matrix)
&gt;0x00003B	byte		0x03		(equation)
&gt;0x00003B	byte		0x04		(string)
&gt;0x00003B	byte		0x05		(program)
&gt;0x00003B	byte		0x06		(assembly program)
&gt;0x00003B	byte		0x07		(picture)
&gt;0x00003B	byte		0x08		(gdb)
&gt;0x00003B	byte		0x0C		(complex number)
&gt;0x00003B	byte		0x0F		(window settings)
&gt;0x00003B	byte		0x10		(zoom)
&gt;0x00003B	byte		0x11		(table setup)
&gt;0x00003B	byte		0x13		(backup)
&gt;0x00003B	byte		0x15		(application variable)
&gt;0x00003B	byte		0x17		(group of variable)

#
# Magic Numbers for the TI-85
#
0		string		**TI85**	TI-85 Graphing Calculator
&gt;0x00003B	byte		0x00		(real number)
&gt;0x00003B	byte		0x01		(complex number)
&gt;0x00003B	byte		0x02		(real vector)
&gt;0x00003B	byte		0x03		(complex vector)
&gt;0x00003B	byte		0x04		(real list)
&gt;0x00003B	byte		0x05		(complex list)
&gt;0x00003B	byte		0x06		(real matrix)
&gt;0x00003B	byte		0x07		(complex matrix)
&gt;0x00003B	byte		0x08		(real constant)
&gt;0x00003B	byte		0x09		(complex constant)
&gt;0x00003B	byte		0x0A		(equation)
&gt;0x00003B	byte		0x0C		(string)
&gt;0x00003B	byte		0x0D		(function GDB)
&gt;0x00003B	byte		0x0E		(polar GDB)
&gt;0x00003B	byte		0x0F		(parametric GDB)
&gt;0x00003B	byte		0x10		(diffeq GDB)
&gt;0x00003B	byte		0x11		(picture)
&gt;0x00003B	byte		0x12		(program)
&gt;0x00003B	byte		0x13		(range)
&gt;0x00003B	byte		0x17		(window settings)
&gt;0x00003B	byte		0x18		(window settings)
&gt;0x00003B	byte		0x19		(window settings)
&gt;0x00003B	byte		0x1A		(window settings)
&gt;0x00003B	byte		0x1B		(zoom)
&gt;0x00003B	byte		0x1D		(backup)
&gt;0x00003B	byte		0x1E		(unknown)
&gt;0x00003B	byte		0x2A		(equation)
&gt;0x000032	string		ZS4		- ZShell Version 4 File.
&gt;0x000032	string		ZS3		- ZShell Version 3 File.
#
# Magic Numbers for the TI-86
#
0		string		**TI86**	TI-86 Graphing Calculator
&gt;0x00003B	byte		0x00		(real number)
&gt;0x00003B	byte		0x01		(complex number)
&gt;0x00003B	byte		0x02		(real vector)
&gt;0x00003B	byte		0x03		(complex vector)
&gt;0x00003B	byte		0x04		(real list)
&gt;0x00003B	byte		0x05		(complex list)
&gt;0x00003B	byte		0x06		(real matrix)
&gt;0x00003B	byte		0x07		(complex matrix)
&gt;0x00003B	byte		0x08		(real constant)
&gt;0x00003B	byte		0x09		(complex constant)
&gt;0x00003B	byte		0x0A		(equation)
&gt;0x00003B	byte		0x0C		(string)
&gt;0x00003B	byte		0x0D		(function GDB)
&gt;0x00003B	byte		0x0E		(polar GDB)
&gt;0x00003B	byte		0x0F		(parametric GDB)
&gt;0x00003B	byte		0x10		(diffeq GDB)
&gt;0x00003B	byte		0x11		(picture)
&gt;0x00003B	byte		0x12		(program)
&gt;0x00003B	byte		0x13		(range)
&gt;0x00003B	byte		0x17		(window settings)
&gt;0x00003B	byte		0x18		(window settings)
&gt;0x00003B	byte		0x19		(window settings)
&gt;0x00003B	byte		0x1A		(window settings)
&gt;0x00003B	byte		0x1B		(zoom)
&gt;0x00003B	byte		0x1D		(backup)
&gt;0x00003B	byte		0x1E		(unknown)
&gt;0x00003B	byte		0x2A		(equation)
#
# Magic Numbers for the TI-89
#
0		string		**TI89**	TI-89 Graphing Calculator
&gt;0x000048	byte		0x00		(expression)
&gt;0x000048	byte		0x04		(list)
&gt;0x000048	byte		0x06		(matrix)
&gt;0x000048	byte		0x0A		(data)
&gt;0x000048	byte		0x0B		(text)
&gt;0x000048	byte		0x0C		(string)
&gt;0x000048	byte		0x0D		(graphic data base)
&gt;0x000048	byte		0x0E		(figure)
&gt;0x000048	byte		0x10		(picture)
&gt;0x000048	byte		0x12		(program)
&gt;0x000048	byte		0x13		(function)
&gt;0x000048	byte		0x14		(macro)
&gt;0x000048	byte		0x1C		(zipped)
&gt;0x000048	byte		0x21		(assembler)
#
# Magic Numbers for the TI-92
#
0		string		**TI92**	TI-92 Graphing Calculator
&gt;0x000048	byte		0x00		(expression)
&gt;0x000048	byte		0x04		(list)
&gt;0x000048	byte		0x06		(matrix)
&gt;0x000048	byte		0x0A		(data)
&gt;0x000048	byte		0x0B		(text)
&gt;0x000048	byte		0x0C		(string)
&gt;0x000048	byte		0x0D		(graphic data base)
&gt;0x000048	byte		0x0E		(figure)
&gt;0x000048	byte		0x10		(picture)
&gt;0x000048	byte		0x12		(program)
&gt;0x000048	byte		0x13		(function)
&gt;0x000048	byte		0x14		(macro)
&gt;0x000048	byte		0x1D		(backup)
#
# Magic Numbers for the TI-92+/V200
#
0		string		**TI92P*	TI-92+/V200 Graphing Calculator
&gt;0x000048	byte		0x00		(expression)
&gt;0x000048	byte		0x04		(list)
&gt;0x000048	byte		0x06		(matrix)
&gt;0x000048	byte		0x0A		(data)
&gt;0x000048	byte		0x0B		(text)
&gt;0x000048	byte		0x0C		(string)
&gt;0x000048	byte		0x0D		(graphic data base)
&gt;0x000048	byte		0x0E		(figure)
&gt;0x000048	byte		0x10		(picture)
&gt;0x000048	byte		0x12		(program)
&gt;0x000048	byte		0x13		(function)
&gt;0x000048	byte		0x14		(macro)
&gt;0x000048	byte		0x1C		(zipped)
&gt;0x000048	byte		0x21		(assembler)
#
# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
#
0x0000016	string		Advanced	TI-XX Graphing Calculator (FLASH)
0		string		**TIFL**	TI-XX Graphing Calculator (FLASH)
&gt;8		byte		&gt;0		- Revision %d
&gt;&gt;9 		byte		x		\b.%d,
&gt;12		byte		&gt;0		Revision date %02x
&gt;&gt;13		byte		x		\b/%02x
&gt;&gt;14		beshort		x		\b/%04x,
&gt;17		string		&gt;/0		name: &#039;%s&#039;,
&gt;48		byte		0x74		device: TI-73,
&gt;48		byte		0x73		device: TI-83+,
&gt;48		byte		0x98		device: TI-89,
&gt;48		byte		0x88		device: TI-92+,
&gt;49		byte		0x23		type: OS upgrade,
&gt;49		byte		0x24		type: application,
&gt;49		byte		0x25		type: certificate,
&gt;49		byte		0x3e		type: license,
&gt;74		lelong		&gt;0		size: %d bytes

# VTi &amp; TiEmu skins (TI Graphing Calculators).
# From: Romain Lievin (roms@lpg.ticalc.org).
# Magic Numbers for the VTi skins
0               string          VTI		Virtual TI skin
&gt;3		string		v		- Version
&gt;&gt;4		byte		&gt;0		\b %c
&gt;&gt;6		byte		x		\b.%c
# Magic Numbers for the TiEmu skins
0		string		TiEmu		TiEmu skin
&gt;6              string          v               - Version
&gt;&gt;7             byte            &gt;0              \b %c
&gt;&gt;9             byte            x               \b.%c
&gt;&gt;10		byte		x		\b%c

#------------------------------------------------------------------------------
# $File: timezone,v 1.11 2009/09/19 16:28:12 christos Exp $
# timezone:  file(1) magic for timezone data
#
# from Daniel Quinlan (quinlan@yggdrasil.com)
# this should work on Linux, SunOS, and maybe others
# Added new official magic number for recent versions of the Olson code
0	string	TZif	timezone data
&gt;4	byte	0	\b, old version
&gt;4	byte	&gt;0	\b, version %c
&gt;20	belong	0	\b, no gmt time flags
&gt;20	belong	1	\b, 1 gmt time flag
&gt;20	belong	&gt;1	\b, %d gmt time flags
&gt;24	belong	0	\b, no std time flags
&gt;20	belong	1	\b, 1 std time flag
&gt;24	belong	&gt;1	\b, %d std time flags
&gt;28	belong	0	\b, no leap seconds
&gt;28	belong	1	\b, 1 leap second
&gt;28	belong  &gt;1	\b, %d leap seconds
&gt;32	belong	0	\b, no transition times
&gt;32	belong	1	\b, 1 transition time
&gt;32	belong  &gt;1	\b, %d transition times
&gt;36	belong	0	\b, no abbreviation chars
&gt;36	belong	1	\b, 1 abbreviation char
&gt;36	belong	&gt;1	\b, %d abbreviation chars
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
0	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data

#------------------------------------------------------------------------------
# $File: tplink,v 1.2 2017/12/14 05:52:56 christos Exp $
# tplink: File magic for openwrt firmware files

# URL: https://wiki.openwrt.org/doc/techref/header
# Reference: http://git.openwrt.org/?p=openwrt.git;a=blob;f=tools/firmware-utils/src/mktplinkfw.c
# From: Joerg Jenderek
# check for valid header version 1 or 2
0		ulelong		&lt;3
&gt;0		ulelong		!0
# test for header padding with nulls
&gt;&gt;0x100		long		0
&gt;&gt;&gt;0		use		firmware-tplink

0		name		firmware-tplink
&gt;0		ubyte		x		firmware
!:mime application/x-tplink-bin
!:ext	bin
# hardware id like 10430001 07410001 09410004 09410006
&gt;0x40		ubeshort	x		%x
&gt;0x42		ubeshort	x		v%x
# hardware revision like 1
&gt;0x44		ubelong		!1		(revision %u)
# vendor_name[24] like OpenWrt or TP-LINK Technologies
&gt;4		string		x		%.24s
# fw_version[36] like r49389 or ver. 1.0
&gt;0x1c		string		x		%.36s
# header version 1 or 2
&gt;0		ubyte		!1		V%X
# ver_hi.ver_mid.ver_lo
&gt;0x98		long		!0		\b, version
&gt;&gt;0x98		ubeshort	x		%u
&gt;&gt;0x9A		ubeshort	x		\b.%u
&gt;&gt;0x9C		ubeshort	x		\b.%u
# region code 0~universal 1~US
&gt;0x48		ubelong		x
#&gt;&gt;0x48		ubelong		0		(universal)
&gt;&gt;0x48		ubelong		1		(US)
&gt;&gt;0x48		ubelong		&gt;1		(region %u)
# total length of the firmware. not always true
&gt;0x7C		ubelong		x		\b, %u bytes or less
# unknown 1
&gt;0x48		ubelong		!0		\b, UNKNOWN1 0x%x
# md5sum1[16]
#&gt;0x4c		ubequad		x		\b, MD5 %llx
#&gt;&gt;0x54		ubequad		x		\b%llx
# unknown 2
&gt;0x5c		ubelong		!0		\b, UNKNOWN2 0x%x
# md5sum2[16]
#&gt;0x60		ubequad		!0		\b, 2nd MD5 %llx
#&gt;&gt;0x68		ubequad		x		\b%llx
# unknown 3
&gt;0x70		ubelong		!0		\b, UNKNOWN3 0x%x
# kernel load address
#&gt;0x74		ubelong		x		\b, 0x%x load
# kernel entry point
#&gt;0x78		ubelong		x		\b, 0x%x entry
# kernel data offset. 200h means direct after header
&gt;0x80		ubelong		x		\b, at 0x%x
# kernel data length and 1 space
&gt;0x84		ubelong		x		%u bytes 
# look for kernel type (gzip compressed vmlinux.bin by ./compress)
&gt;(0x80.L)	indirect	x
# root file system data offset
&gt;0x88		ubelong		x		\b, at 0x%x
# rootfs data length and 1 space
&gt;0x8C		ubelong		x		%u bytes 
# in 5.32 only true for offset ~&lt; FILE_BYTES_MAX=9 MB defined in ../../src/file.h 
&gt;(0x88.L)	indirect	x
#&gt;(0x88.L)	string		x		\b, file system &#039;%.4s&#039;
#&gt;(0x88.L)	ubequad		x		\b, file system 0x%llx
# bootloader data offset
&gt;0x90		ubelong		!0		\b, at 0x%x
# bootloader data length only resonable if bootloader offset not null
&gt;&gt;0x94		ubelong		!0		%u bytes
# pad[354] should be 354 null bytes.
#&gt;0x9E		ubequad		!0		\b, padding 0x%llx
# But at 0x120 18 non null bytes in examples like
# wr940nv4_eu_3_16_9_up_boot(160620).bin
# wr940nv6_us_3_18_1_up_boot(171030).bin
#&gt;0x120		ubequad		!0		\b, other padding 0x%llx

#------------------------------------------------------------------------------
# $File: troff,v 1.11 2014/06/03 19:01:34 christos Exp $
# troff:  file(1) magic for *roff
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)

# troff input
0	search/1	.\\&quot;		troff or preprocessor input text
!:mime	text/troff
0	search/1	&#039;\\&quot;		troff or preprocessor input text
!:mime	text/troff
0	search/1	&#039;.\\&quot;		troff or preprocessor input text
!:mime	text/troff
0	search/1	\\&quot;		troff or preprocessor input text
!:mime	text/troff
0	search/1	&#039;&#039;&#039;		troff or preprocessor input text
!:mime	text/troff
0	regex/20l	\^\\.[A-Za-z0-9][A-Za-z0-9][\ \t]	troff or preprocessor input text
!:mime	text/troff
0	regex/20l	\^\\.[A-Za-z0-9][A-Za-z0-9]$	troff or preprocessor input text
!:mime	text/troff

# ditroff intermediate output text
0	search/1	x\ T		ditroff output text
&gt;4	search/1	cat		for the C/A/T phototypesetter
&gt;4	search/1	ps		for PostScript
&gt;4	search/1	dvi		for DVI
&gt;4	search/1	ascii		for ASCII
&gt;4	search/1	lj4		for LaserJet 4
&gt;4	search/1	latin1		for ISO 8859-1 (Latin 1)
&gt;4	search/1	X75		for xditview at 75dpi
&gt;&gt;7	search/1	-12		(12pt)
&gt;4	search/1	X100		for xditview at 100dpi
&gt;&gt;8	search/1	-12		(12pt)

# output data formats
0	string		\100\357	very old (C/A/T) troff output data

#------------------------------------------------------------------------------
# $File: tuxedo,v 1.4 2009/09/19 16:28:13 christos Exp $
# tuxedo:	file(1) magic for BEA TUXEDO data files
#
# from Ian Springer &lt;ispringer@hotmail.com&gt;
#
0	string		\0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0	BEA TUXEDO DES mask data

#------------------------------------------------------------------------------
# $File: typeset,v 1.8 2009/09/19 16:28:13 christos Exp $
# typeset:  file(1) magic for other typesetting
#
0	string		Interpress/Xerox	Xerox InterPress data
&gt;16	string		/			(version
&gt;&gt;17	string		&gt;\0			%s)

#------------------------------------------------------------------------------
# $File: unicode,v 1.6 2010/09/20 18:55:20 rrt Exp $
# Unicode:  BOM prefixed text files - Adrian Havill &lt;havill@turbolinux.co.jp&gt;
# GRR: These types should be recognised in file_ascmagic so these
# encodings can be treated by text patterns.
# Missing types are already dealt with internally.
#
0	string	+/v8			Unicode text, UTF-7
0	string	+/v9			Unicode text, UTF-7
0	string	+/v+			Unicode text, UTF-7
0	string	+/v/			Unicode text, UTF-7
0	string	\335\163\146\163	Unicode text, UTF-8-EBCDIC
0	string	\000\000\376\377	Unicode text, UTF-32, big-endian
0	string	\377\376\000\000	Unicode text, UTF-32, little-endian
0	string	\016\376\377		Unicode text, SCSU (Standard Compression Scheme for Unicode)

#------------------------------------------------------------------------------
# $File: unknown,v 1.8 2013/01/09 22:37:24 christos Exp $
# unknown:  file(1) magic for unknown machines
#
# 0x107 is 0407, 0x108 is 0410, and 0x109 is 0411; those are all PDP-11
# (executable, pure, and split I&amp;D, respectively), but the PDP-11 version
# doesn&#039;t have the &quot;version %ld&quot;, which may be a bogus COFFism (I don&#039;t
# think there was ever COFF for the PDP-11).
#
# 0x10B is 0413; that&#039;s VAX demand-paged, but this is a short, not a
# long, as it would be on a VAX.  In any case, that could collide with
# VAX demand-paged files, as the magic number is little-endian on those
# binaries, so the first 16 bits of the file would contain 0x10B.
#
# Therefore, those entries are commented out.
#
# 0x10C is 0414 and 0x10E is 0416; those *are* unknown.
#
#0	short		0x107		unknown machine executable
#&gt;8	short		&gt;0		not stripped
#&gt;15	byte		&gt;0		- version %ld
#0	short		0x108		unknown pure executable
#&gt;8	short		&gt;0		not stripped
#&gt;15	byte		&gt;0		- version %ld
#0	short		0x109		PDP-11 separate I&amp;D
#&gt;8	short		&gt;0		not stripped
#&gt;15	byte		&gt;0		- version %ld
#0	short		0x10b		unknown pure executable
#&gt;8	short		&gt;0		not stripped
#&gt;15	byte		&gt;0		- version %ld
0	long		0x10c		unknown demand paged pure executable
&gt;16	long		&gt;0		not stripped
0	long		0x10e		unknown readable demand paged pure executable

#------------------------------------------------------------------------------
# $File: uterus,v 1.3 2014/04/30 21:41:02 christos Exp $
# file(1) magic for uterus files
# http://freecode.com/projects/uterus
#
0	string		UTE+	uterus file
&gt;4	string		v	\b, version
&gt;5	byte		x	%c
&gt;6	string		.	\b.
&gt;7	byte		x	\b%c
&gt;8	string		\&lt;\&gt;	\b, big-endian
&gt;&gt;16	belong		&gt;0	\b, slut size %u
&gt;8	string		\&gt;\&lt;	\b, litte-endian
&gt;&gt;16	lelong		&gt;0	\b, slut size %u
&gt;10	byte		&amp;8	\b, compressed

#------------------------------------------------------------------------------
# $File: uuencode,v 1.7 2009/09/19 16:28:13 christos Exp $
# uuencode:  file(1) magic for ASCII-encoded files
#

# GRR:  the first line of xxencoded files is identical to that in uuencoded
# files, but the first character in most subsequent lines is &#039;h&#039; instead of
# &#039;M&#039;.  (xxencoding uses lowercase letters in place of most of uuencode&#039;s
# punctuation and survives BITNET gateways better.)  If regular expressions
# were supported, this entry could possibly be split into two with
# &quot;begin\040\.\*\012M&quot; or &quot;begin\040\.\*\012h&quot; (where \. and \* are REs).
0	search/1	begin\ 		uuencoded or xxencoded text

# btoa(1) is an alternative to uuencode that requires less space.
0	search/1	xbtoa\ Begin	btoa&#039;d text

# ship(1) is another, much cooler alternative to uuencode.
# Greg Roelofs, newt@uchicago.edu
0	search/1	$\012ship	ship&#039;d binary text

# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
# Greg Roelofs, newt@uchicago.edu
0	search/1	Decode\ the\ following\ with\ bdeco	bencoded News text

# BinHex is the Macintosh ASCII-encoded file format (see also &quot;apple&quot;)
# Daniel Quinlan, quinlan@yggdrasil.com
11	search/1	must\ be\ converted\ with\ BinHex	BinHex binary text
&gt;41	search/1	x					\b, version %.3s

# GRR: handle BASE64

#------------------------------------------------------------------------------
# $File: vacuum-cleaner,v 1.1 2015/11/14 13:38:35 christos Exp $
# vacuum cleaner magic by Thomas M. Ott (ThMO)
#
# navigation map for LG robot vacuum cleaner models VR62xx, VR64xx, VR63xx
# file: MAPDATAyyyymmddhhmmss_xxxxxx_cc.blk
# -&gt; yyyymmdd: year, month, day of cleaning
# -&gt; hhmmss: hour, minute, second of cleaning
# -&gt; xxxxxx: 6 digits
# -&gt; cc: cleaning runs counter
# size: 136044 bytes
#
# struct maphdr {
#     int32_t  map_cnt;	     /*  0: single map */
#     int32_t  min_ceil;     /*  4: 100 mm == 10 cm == min. ceil */
#     int32_t  max_ceil;     /*  8: 10000 mm == 100 m == max. ceil */
#     int32_t  max_climb;    /* 12: 50 mm = 5 cm == max. height to climb */
#     int32_t  unknown;	     /* 16: 50000 ??? */
#     int32_t  cell_bytes;   /* 20: # of bytes for cells per block */
#     int32_t  block_max;    /* 24: 1000 == max. # of blocks */
#     int32_t  route_max;    /* 28: 1000 == max. # of routes */
#     int32_t  used_blocks;  /* 32: 5/45/33/... == # of block entries used! */
#     int32_t  cell_dim;     /* 36: 10 == cell dimension */
#     int32_t  clock_tick;   /* 40: 100 == clock ticks */
# #if	0
#     struct {		     /* 44: 1000 blocks for 10x10 cells */
#         int32_t  yoffset;
#         int32_t  xoffset;
#         int32_t  posxy;
#         int32_t  timecode;
#       }      blocks[ 1000];
#     char     cells[ 1000* 100]; /* 16044: 1000 10x10 cells */
#     int16_t  routes[ 1000* 10]; /* 116044: 1000 10-routes */
# #endif
#   };

0                lelong =1
&gt;4               lelong =100
&gt;&gt;8              lelong =10000
&gt;&gt;&gt;12            lelong =50
&gt;&gt;&gt;&gt;16           lelong =50000
&gt;&gt;&gt;&gt;&gt;20          lelong =100
&gt;&gt;&gt;&gt;&gt;&gt;24         lelong =1000
&gt;&gt;&gt;&gt;&gt;&gt;&gt;28        lelong =1000
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;36       lelong =10
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;40      lelong =100
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;32     lelong x       LG robot VR6[234]xx %dm^2 navigation
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;136040 lelong =-1     reuse map data
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;136040 lelong =0      map data
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;136040 lelong &gt;0      spurious map data
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;136040 lelong &lt;-1     spurious map data


#------------------------------------------------------------------------------
# $File: varied.out,v 1.23 2014/04/30 21:41:02 christos Exp $
# varied.out:  file(1) magic for various USG systems
#
#	Herewith many of the object file formats used by USG systems.
#	Most have been moved to files for a particular processor,
#	and deleted if they duplicate other entries.
#
0	short		0610		Perkin-Elmer executable
# AMD 29K
0	beshort		0572		amd 29k coff noprebar executable
0	beshort		01572		amd 29k coff prebar executable
0	beshort		0160007		amd 29k coff archive
# Cray
6	beshort		0407		unicos (cray) executable
# Ultrix 4.3
596	string		\130\337\377\377	Ultrix core file
&gt;600	string		&gt;\0		from &#039;%s&#039;
# BeOS and MAcOS PEF executables
# From: hplus@zilker.net (Jon Watte)
0	string		Joy!peffpwpc	header for PowerPC PEF executable
#
# ava assembler/linker Uros Platise &lt;uros.platise@ijs.si&gt;
0       string          avaobj  AVR assembler object code
&gt;7      string          &gt;\0     version &#039;%s&#039;
# gnu gmon magic From: Eugen Dedu &lt;dedu@ese-metz.fr&gt;
0	string		gmon		GNU prof performance data
&gt;4	long		x		- version %d
# From: Dave Pearson &lt;davep@davep.org&gt;
# Harbour &lt;URL:http://harbour-project.org/&gt; HRB files.
0	string		\xc0HRB		Harbour HRB file
&gt;4	leshort		x		version %d
# Harbour HBV files
0	string		\xc0HBV		Harbour variable dump file
&gt;4	leshort		x		version %d

# From: Alex Beregszaszi &lt;alex@fsn.hu&gt;
# 0	string		exec 		BugOS executable
# 0	string		pack		BugOS archive

# From: Jason Spence &lt;jspence@lightconsulting.com&gt;
# Generated by the &quot;examples&quot; in STM&#039;s ST40 devkit, and derived code.
0	lelong		0x13a9f17e	ST40 component image format
&gt;4	string		&gt;\0		\b, name &#039;%s&#039;

#------------------------------------------------------------------------------
# $File: varied.script,v 1.11 2015/03/27 17:59:39 christos Exp $
# varied.script:  file(1) magic for various interpreter scripts

0	string/t		#!\ /			a
&gt;3	string		&gt;\0			%s script text executable

0	string/b		#!\ /			a
&gt;3	string		&gt;\0			%s script executable (binary data)

0	string/t		#!\t/			a
&gt;3	string		&gt;\0			%s script text executable

0	string/b		#!\t/			a
&gt;3	string		&gt;\0			%s script executable (binary data)

0	string/t		#!/			a
&gt;2	string		&gt;\0			%s script text executable

0	string/b		#!/			a
&gt;2	string		&gt;\0			%s script executable (binary data)

0	string/t		#!\ 			script text executable
&gt;3	string		&gt;\0			for %s

0	string/b		#!\ 			script executable
&gt;3	string		&gt;\0			for %s (binary data)

# using env
0	string/t	#!/usr/bin/env		a
&gt;15	string/t	&gt;\0			%s script text executable
!:strength / 10

0	string/b	#!/usr/bin/env		a
&gt;15	string/b	&gt;\0			%s script executable (binary data)
!:strength / 10

0	string/t	#!\ /usr/bin/env	a
&gt;16	string/t	&gt;\0			%s script text executable
!:strength / 10

0	string/b	#!\ /usr/bin/env	a
&gt;16	string/b	&gt;\0			%s script executable (binary data)
!:strength / 10

# From: arno &lt;arenevier@fdn.fr&gt;
# mozilla xpconnect typelib
# see http://www.mozilla.org/scriptable/typelib_file.html
0	string 		XPCOM\nTypeLib\r\n\032		XPConnect Typelib
&gt;0x10  byte        x       version %d
&gt;&gt;0x11 byte        x      \b.%d

#------------------------------------------------------------------------------
# $File: vax,v 1.9 2014/04/30 21:41:02 christos Exp $
# vax:  file(1) magic for VAX executable/object and APL workspace
#
0	lelong		0101557		VAX single precision APL workspace
0	lelong		0101556		VAX double precision APL workspace

#
# VAX a.out (BSD; others collide with 386 and other 32-bit little-endian
# executables, and are handled in aout)
#
0	lelong		0420		a.out VAX demand paged (first page unmapped) pure executable
&gt;16	lelong		&gt;0		not stripped

#
# VAX COFF
#
# The `versions&#039; were commented out, but have been un-commented out.
# (Was the problem just one of endianness?)
#
0	leshort		0570		VAX COFF executable
&gt;12	lelong		&gt;0		not stripped
&gt;22	leshort		&gt;0		- version %d
0	leshort		0575		VAX COFF pure executable
&gt;12	lelong		&gt;0		not stripped
&gt;22	leshort		&gt;0		- version %d

#------------------------------------------------------------------------------
# $File: vicar,v 1.4 2009/09/19 16:28:13 christos Exp $
# vicar:  file(1) magic for VICAR files.
#
# From: Ossama Othman &lt;othman@astrosun.tn.cornell.edu
# VICAR is JPL&#039;s in-house spacecraft image processing program
# VICAR image
0	string	LBLSIZE=	VICAR image data
&gt;32	string	BYTE		\b, 8 bits  = VAX byte
&gt;32	string	HALF		\b, 16 bits = VAX word     = Fortran INTEGER*2
&gt;32	string	FULL		\b, 32 bits = VAX longword = Fortran INTEGER*4
&gt;32	string	REAL		\b, 32 bits = VAX longword = Fortran REAL*4
&gt;32	string	DOUB		\b, 64 bits = VAX quadword = Fortran REAL*8
&gt;32	string	COMPLEX		\b, 64 bits = VAX quadword = Fortran COMPLEX*8
# VICAR label file
43	string	SFDU_LABEL	VICAR label file

#------------------------------------------------------------------------------
# $File: virtual,v 1.6 2014/05/07 21:25:41 christos Exp $
# From: James Nobis &lt;quel@quelrod.net&gt;
# Microsoft hard disk images for:
# Virtual Server
# Virtual PC
# http://technet.microsoft.com/en-us/virtualserver/bb676673.aspx
# .vhd
0	string	conectix	Microsoft Disk Image, Virtual Server or Virtual PC

# libvirt
# From: Philipp Hahn &lt;hahn@univention.de&gt;
0	string	LibvirtQemudSave	Libvirt QEMU Suspend Image
&gt;0x10	lelong	x	\b, version %u
&gt;0x14	lelong	x	\b, XML length %u
&gt;0x18	lelong	1	\b, running
&gt;0x1c	lelong	1	\b, compressed

0	string	LibvirtQemudPart	Libvirt QEMU partial Suspend Image
# From: Alex Beregszaszi &lt;alex@fsn.hu&gt;
0	string/b	COWD		VMWare3
&gt;4	byte	3		disk image
&gt;&gt;32	lelong	x		(%d/
&gt;&gt;36	lelong	x		\b%d/
&gt;&gt;40	lelong	x		\b%d)
&gt;4	byte	2		undoable disk image
&gt;&gt;32	string	&gt;\0		(%s)

0	string/b	VMDK		 VMware4 disk image
0	string/b	KDMV		 VMware4 disk image

#--------------------------------------------------------------------
# Qemu Emulator Images
# Lines written by Friedrich Schwittay (f.schwittay@yousable.de)
# Updated by Adam Buchbinder (adam.buchbinder@gmail.com)
# Made by reading sources, reading documentation, and doing trial and error
# on existing QCOW files
0	string/b	QFI\xFB	QEMU QCOW Image

# Uncomment the following line to display Magic (only used for debugging
# this magic number)
#&gt;0	string/b	x	, Magic: %s

# There are currently 2 Versions: &quot;1&quot; and &quot;2&quot;.
# http://www.gnome.org/~markmc/qcow-image-format-version-1.html
&gt;4	belong	1	(v1)

# Using the existence of the Backing File Offset to determine whether
# to read Backing File Information
&gt;&gt;12	belong	 &gt;0	 \b, has backing file (
# Note that this isn&#039;t a null-terminated string; the length is actually
# (16.L). Assuming a null-terminated string happens to work usually, but it
# may spew junk until it reaches a \0 in some cases.
&gt;&gt;&gt;(12.L)	 string &gt;\0	\bpath %s

# Modification time of the Backing File
# Really useful if you want to know if your backing
# file is still usable together with this image
&gt;&gt;&gt;&gt;20	bedate &gt;0	\b, mtime %s)
&gt;&gt;&gt;&gt;20	default x	\b)

# Size is stored in bytes in a big-endian u64.
&gt;&gt;24	bequad	x	 \b, %lld bytes

# 1 for AES encryption, 0 for none.
&gt;&gt;36	belong	1	\b, AES-encrypted

# http://www.gnome.org/~markmc/qcow-image-format.html
&gt;4	belong	2	(v2)
# Using the existence of the Backing File Offset to determine whether
# to read Backing File Information
&gt;&gt;8	bequad  &gt;0	 \b, has backing file
# Note that this isn&#039;t a null-terminated string; the length is actually
# (16.L). Assuming a null-terminated string happens to work usually, but it
# may spew junk until it reaches a \0 in some cases. Also, since there&#039;s no
# .Q modifier, we just use the bottom four bytes as an offset. Note that if
# the file is over 4G, and the backing file path is stored after the first 4G,
# the wrong filename will be printed. (This should be (8.Q), when that syntax
# is introduced.)
&gt;&gt;&gt;(12.L)	 string &gt;\0	(path %s)
&gt;&gt;24	bequad	x	\b, %lld bytes
&gt;&gt;32	belong	1	\b, AES-encrypted

&gt;4	belong	3	(v3)
# Using the existence of the Backing File Offset to determine whether
# to read Backing File Information
&gt;&gt;8	bequad  &gt;0	 \b, has backing file
# Note that this isn&#039;t a null-terminated string; the length is actually
# (16.L). Assuming a null-terminated string happens to work usually, but it
# may spew junk until it reaches a \0 in some cases. Also, since there&#039;s no
# .Q modifier, we just use the bottom four bytes as an offset. Note that if
# the file is over 4G, and the backing file path is stored after the first 4G,
# the wrong filename will be printed. (This should be (8.Q), when that syntax
# is introduced.)
&gt;&gt;&gt;(12.L)	 string &gt;\0	(path %s)
&gt;&gt;24	bequad	x	\b, %lld bytes
&gt;&gt;32	belong	1	\b, AES-encrypted

&gt;4	default x	(unknown version)

0	string/b	QEVM		QEMU suspend to disk image

# QEMU QED Image
# http://wiki.qemu.org/Features/QED/Specification
0	string/b	QED\0		QEMU QED Image

# VDI Image
# Sun xVM VirtualBox Disk Image
# From: Richard W.M. Jones &lt;rich@annexia.org&gt;
# VirtualBox Disk Image
0x40	ulelong		0xbeda107f	VirtualBox Disk Image
&gt;0x44	uleshort	&gt;0		\b, major %u
&gt;0x46	uleshort	&gt;0		\b, minor %u
&gt;0	string		&gt;\0		(%s)
&gt;368	lequad		x		 \b, %lld bytes

0	string/b	Bochs\ Virtual\ HD\ Image	Bochs disk image,
&gt;32	string	x				type %s,
&gt;48	string	x				subtype %s

0	lelong	0x02468ace			Bochs Sparse disk image


#------------------------------------------------------------------------------
# $File: virtutech,v 1.4 2009/09/19 16:28:13 christos Exp $
# Virtutech Compressed Random Access File Format
#
# From &lt;gustav@virtutech.com&gt;
0      string          \211\277\036\203        Virtutech CRAFF
&gt;4     belong          x               v%d
&gt;20    belong          0               uncompressed
&gt;20    belong          1               bzipp2ed
&gt;20    belong          2               gzipped
&gt;24    belong          0               not clean

#------------------------------------------------------------------------------
# $File: visx,v 1.5 2009/09/19 16:28:13 christos Exp $
# visx:  file(1) magic for Visx format files
#
0	short		0x5555		VISX image file
&gt;2	byte		0		(zero)
&gt;2	byte		1		(unsigned char)
&gt;2	byte		2		(short integer)
&gt;2	byte		3		(float 32)
&gt;2	byte		4		(float 64)
&gt;2	byte		5		(signed char)
&gt;2	byte		6		(bit-plane)
&gt;2	byte		7		(classes)
&gt;2	byte		8		(statistics)
&gt;2	byte		10		(ascii text)
&gt;2	byte		15		(image segments)
&gt;2	byte		100		(image set)
&gt;2	byte		101		(unsigned char vector)
&gt;2	byte		102		(short integer vector)
&gt;2	byte		103		(float 32 vector)
&gt;2	byte		104		(float 64 vector)
&gt;2	byte		105		(signed char vector)
&gt;2	byte		106		(bit plane vector)
&gt;2	byte		121		(feature vector)
&gt;2	byte		122		(feature vector library)
&gt;2	byte		124		(chain code)
&gt;2	byte		126		(bit vector)
&gt;2	byte		130		(graph)
&gt;2	byte		131		(adjacency graph)
&gt;2	byte		132		(adjacency graph library)
&gt;2	string		.VISIX		(ascii text)

#------------------------------------------------------------------------------
# $File: vms,v 1.10 2017/03/17 21:35:28 christos Exp $
# vms:  file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)

# GRR 950122:  I&#039;m just guessing on these, based on inspection of the headers
# of three executables each for Alpha and VAX architectures.  The VAX files
# all had headers similar to this:
#
#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
#
0	string	\xb0\0\x30\0	VMS VAX executable
&gt;44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#
# The AXP files all looked like this, except that the byte at offset 0x22
# was 06 in some of them and 07 in others:
#
#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
#
# GRR this test is still too general as it catches example adressen.dbt
0	belong	0x03000000
&gt;8	ubelong	0xec020000	VMS Alpha executable
&gt;&gt;75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption

#------------------------------------------------------------------------------
# $File: vmware,v 1.8 2017/03/17 21:35:28 christos Exp $
# VMware specific files (deducted from version 1.1 and log file entries)
# Anthon van der Neut (anthon@mnt.org)
0	belong	0x4d52564e	VMware nvram

#------------------------------------------------------------------------------
# $File: vorbis,v 1.24 2018/03/14 04:38:44 christos Exp $
# vorbis:  file(1) magic for Ogg/Vorbis files
#
# From Felix von Leitner &lt;leitner@fefe.de&gt;
# Extended by Beni Cherniavsky &lt;cben@crosswinds.net&gt;
# Further extended by Greg Wooledge &lt;greg@wooledge.org&gt;
#
# Most (everything but the number of channels and bitrate) is commented
# out with `##&#039; as it&#039;s not interesting to the average user.  The most
# probable things advanced users would want to uncomment are probably
# the number of comments and the encoder version.
#
# FIXME: The first match has been made a search, so that it can skip
# over prepended ID3 tags. This will work for MIME type detection, but
# won&#039;t work for detecting other properties of the file (they all need
# to be made relative to the search). In any case, if the file has ID3
# tags, the ID3 information will be printed, not the Ogg information,
# so until that&#039;s fixed, this doesn&#039;t matter.
# FIXME[2]: Disable the above for now, since search assumes text mode.
#
# --- Ogg Framing ---
#0		search/1000	OggS		Ogg data
0		string	OggS		Ogg data
&gt;4		byte		!0		UNKNOWN REVISION %u
##&gt;4		byte		0		revision 0
&gt;4		byte		0
##&gt;&gt;14		lelong		x		(Serial %lX)
# non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
&gt;&gt;28		string		\x7fFLAC	\b, FLAC audio
# non-Vorbis content: Theora
!:mime		audio/ogg
&gt;&gt;28		string		\x80theora	\b, Theora video
!:mime		video/ogg
# non-Vorbis content: Kate
&gt;&gt;28		string		\x80kate\0\0\0\0	\b, Kate (Karaoke and Text)
!:mime		application/ogg
&gt;&gt;&gt;37		ubyte		x		v%u
&gt;&gt;&gt;38		ubyte		x		\b.%u,
&gt;&gt;&gt;40		byte		0		utf8 encoding,
&gt;&gt;&gt;40		byte		!0		unknown character encoding,
&gt;&gt;&gt;60		string		&gt;\0		language %s,
&gt;&gt;&gt;60		string		\0		no language set,
&gt;&gt;&gt;76		string		&gt;\0		category %s
&gt;&gt;&gt;76		string		\0		no category set
# non-Vorbis content: Skeleton
&gt;&gt;28		string		fishead\0	\b, Skeleton
!:mime		video/ogg
&gt;&gt;&gt;36		leshort		x		v%u
&gt;&gt;&gt;40		leshort		x		\b.%u
# non-Vorbis content: Speex
&gt;&gt;28		string		Speex\ \ \ 	\b, Speex audio
!:mime		audio/ogg
# non-Vorbis content: OGM
&gt;&gt;28		string		\x01video\0\0\0	\b, OGM video
!:mime		video/ogg
&gt;&gt;&gt;37		string/c	div3		(DivX 3)
&gt;&gt;&gt;37		string/c	divx		(DivX 4)
&gt;&gt;&gt;37		string/c	dx50		(DivX 5)
&gt;&gt;&gt;37		string/c	xvid		(XviD)
# --- First vorbis packet - general header ---
&gt;&gt;28		string		\x01vorbis	\b, Vorbis audio,
!:mime		audio/ogg
&gt;&gt;&gt;35		lelong		!0		UNKNOWN VERSION %u,
##&gt;&gt;&gt;35		lelong		0		version 0,
&gt;&gt;&gt;35		lelong		0
&gt;&gt;&gt;&gt;39		ubyte		1		mono,
&gt;&gt;&gt;&gt;39		ubyte		2		stereo,
&gt;&gt;&gt;&gt;39		ubyte		&gt;2		%u channels,
&gt;&gt;&gt;&gt;40		lelong		x		%u Hz
# Minimal, nominal and maximal bitrates specified when encoding
&gt;&gt;&gt;&gt;48		string		&lt;\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	\b,
# The above tests if at least one of these is specified:
&gt;&gt;&gt;&gt;&gt;52		lelong		!-1
# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
# instead of -1.
# Vorbis 1.0 uses 0 instead of -1.
&gt;&gt;&gt;&gt;&gt;&gt;52	lelong		!0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;52	lelong		!-1000
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;52	lelong		x		&lt;%u
&gt;&gt;&gt;&gt;&gt;48		lelong		!-1
&gt;&gt;&gt;&gt;&gt;&gt;48	lelong		x		~%u
&gt;&gt;&gt;&gt;&gt;44		lelong		!-1
&gt;&gt;&gt;&gt;&gt;&gt;44	lelong		!-1000
&gt;&gt;&gt;&gt;&gt;&gt;&gt;44	lelong		!0
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;44	lelong		x		&gt;%u
&gt;&gt;&gt;&gt;&gt;48		string		&lt;\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	bps
# -- Second vorbis header packet - the comments
# A kludge to read the vendor string.  It&#039;s a counted string, not a
# zero-terminated one, so file(1) can&#039;t read it in a generic way.
# libVorbis is the only one existing currently, so I detect specifically
# it.  The interesting value is the cvs date (8 digits decimal).
# Post-RC1 Ogg files have the second header packet (and thus the version)
# in a different place, so we must use an indirect offset.
&gt;&gt;&gt;(84.b+85)		string		\x03vorbis
&gt;&gt;&gt;&gt;(84.b+96)		string/c	Xiphophorus\ libVorbis\ I	\b, created by: Xiphophorus libVorbis I
&gt;&gt;&gt;&gt;&gt;(84.b+120)		string		&gt;00000000
# Map to beta version numbers:
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		&lt;20000508	(&lt;beta1, prepublic)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		20000508	(1.0 beta 1 or beta 2)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		&gt;20000508
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		&lt;20001031	(beta2-3)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		20001031	(1.0 beta 3)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		&gt;20001031
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		&lt;20010225	(beta3-4)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		20010225	(1.0 beta 4)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		&gt;20010225
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		&lt;20010615	(beta4-RC1)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		20010615	(1.0 RC1)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		20010813	(1.0 RC2)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		20010816	(RC2 - Garf tuned v1)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		20011014	(RC2 - Garf tuned v2)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		20011217	(1.0 RC3)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		20011231	(1.0 RC3)
# Some pre-1.0 CVS snapshots still had &quot;Xiphphorus&quot;...
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+120)	string		&gt;20011231	(pre-1.0 CVS)
# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
&gt;&gt;&gt;&gt;(84.b+96)		string/c	Xiph.Org\ libVorbis\ I	\b, created by: Xiph.Org libVorbis I
&gt;&gt;&gt;&gt;&gt;(84.b+117)		string		&gt;00000000
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		&lt;20020717	(pre-1.0 CVS)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20020717	(1.0)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20030909	(1.0.1)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20040629	(1.1.0 RC1)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20050304	(1.1.2)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20070622	(1.2.0)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20090624	(1.2.2)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20090709	(1.2.3)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20100325	(1.3.1)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20101101	(1.3.2)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20120203	(1.3.3)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20140122	(1.3.4)
&gt;&gt;&gt;&gt;&gt;&gt;(84.b+117)	string		20150105	(1.3.5)

# non-Vorbis content: Opus https://tools.ietf.org/html/draft-ietf-codec-oggopus-06#section-5
&gt;&gt;28		string		OpusHead	\b, Opus audio,
!:mime		audio/ogg
&gt;&gt;&gt;36		ubyte		&gt;0x0F		UNKNOWN VERSION %u,
&gt;&gt;&gt;36		ubyte		&amp;0x0F		version 0.%d
&gt;&gt;&gt;&gt;46		ubyte		&gt;1
&gt;&gt;&gt;&gt;&gt;46		ubyte		!255		unknown channel mapping family %u,
&gt;&gt;&gt;&gt;&gt;37		ubyte		x		%u channels
&gt;&gt;&gt;&gt;46		ubyte		0
&gt;&gt;&gt;&gt;&gt;37		ubyte		1		mono
&gt;&gt;&gt;&gt;&gt;37		ubyte		2		stereo
&gt;&gt;&gt;&gt;46		ubyte		1
&gt;&gt;&gt;&gt;&gt;37		ubyte		1		mono
&gt;&gt;&gt;&gt;&gt;37		ubyte		2		stereo
&gt;&gt;&gt;&gt;&gt;37		ubyte		3		linear surround
&gt;&gt;&gt;&gt;&gt;37		ubyte		4		quadraphonic
&gt;&gt;&gt;&gt;&gt;37		ubyte		5		5.0 surround
&gt;&gt;&gt;&gt;&gt;37		ubyte		6		5.1 surround
&gt;&gt;&gt;&gt;&gt;37		ubyte		7		6.1 surround
&gt;&gt;&gt;&gt;&gt;37		ubyte		8		7.1 surround
&gt;&gt;&gt;&gt;40		lelong		!0		\b, %u Hz

#------------------------------------------------------------------------------
# $File: vxl,v 1.4 2009/09/19 16:28:13 christos Exp $
# VXL: file(1) magic for VXL binary IO data files
#
# from Ian Scott &lt;scottim@sf.net&gt;
#
# VXL is a collection of C++ libraries for Computer Vision.
# See the vsl chapter in the VXL Book for more info
# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
# http:/vxl.sf.net

2	lelong	0x472b2c4e	VXL data file,
&gt;0	leshort	&gt;0		schema version no %d

#------------------------------------------------------------------------------
# $File: warc,v 1.3 2010/11/25 15:05:43 christos Exp $
# warc:  file(1) magic for WARC files

0	string	WARC/	WARC Archive
&gt;5	string	x	version %.4s
!:mime application/warc

#------------------------------------------------------------------------------
# Arc File Format from Internet Archive
# see http://www.archive.org/web/researcher/ArcFileFormat.php
0      string          filedesc://     Internet Archive File
!:mime application/x-ia-arc
&gt;11    search/256      \x0A    \b
&gt;&gt;&amp;0   ubyte   &gt;0      \b version %c

#------------------------------------------------------------------------------
# weak:  file(1) magic for very weak magic entries, disabled by default
#
# These entries are so weak that they might interfere identification of
# other formats. Example include:
# - Only identify for 1 or 2 bytes
# - Match against very wide range of values
# - Match against generic word in some spoken languages (e.g. English)

# Summary: Computer Graphics Metafile
# Extension: .cgm
#0	beshort&amp;0xffe0	0x0020		binary Computer Graphics Metafile
#0	beshort		0x3020		character Computer Graphics Metafile

#0	string		=!!		Bennet Yee&#039;s &quot;face&quot; format
#------------------------------------------------------------------------------
# $File: webassembly,v 1.2 2017/05/02 14:05:29 christos Exp $
# webassembly:  file(1) magic for WebAssembly modules
#
# WebAssembly is a virtual architecture developed by a W3C Community
# Group at http://webassembly.org/. The file extension is .wasm, and
# the MIME type is application/wasm.
#
# http://webassembly.org/docs/binary-encoding/ is the main
# document describing the binary format.
# From: Pip Cet &lt;pipcet@gmail.com&gt; and Joel Martin

0	string	\0asm	WebAssembly (wasm) binary module
&gt;4	lelong	=1	version %#x (MVP)
&gt;4	lelong	&gt;1	version %#x

#------------------------------------------------------------------------------
# $File: windows,v 1.22 2018/02/16 15:44:00 christos Exp $
# windows:  file(1) magic for Microsoft Windows
#
# This file is mainly reserved for files where programs
# using them are run almost always on MS Windows 3.x or
# above, or files only used exclusively in Windows OS,
# where there is no better category to allocate for.
# For example, even though WinZIP almost run on Windows
# only, it is better to treat them as &quot;archive&quot; instead.
# For format usable in DOS, such as generic executable
# format, please specify under &quot;msdos&quot; file.
#


# Summary: Outlook Express DBX file
# Extension: .dbx
# Created by: Christophe Monniez
0	string	\xCF\xAD\x12\xFE	MS Outlook Express DBX file
&gt;4	byte	=0xC5			\b, message database
&gt;4	byte	=0xC6			\b, folder database
&gt;4	byte	=0xC7			\b, account information
&gt;4	byte	=0x30			\b, offline database


# Summary: Windows crash dump
# Extension: .dmp
# Created by: Andreas Schuster (http://computer.forensikblog.de/)
# Reference (1): http://computer.forensikblog.de/en/2008/02/64bit_magic.html
# Modified by (1): Abel Cheung (Avoid match with first 4 bytes only)
0	string		PAGE
&gt;4	string		DUMP		MS Windows 32bit crash dump
&gt;&gt;0x05c	byte            0		\b, no PAE
&gt;&gt;0x05c	byte            1		\b, PAE
&gt;&gt;0xf88	lelong		1		\b, full dump
&gt;&gt;0xf88	lelong		2		\b, kernel dump
&gt;&gt;0xf88	lelong		3		\b, small dump
&gt;&gt;0x068	lelong		x		\b, %d pages
&gt;4	string		DU64		MS Windows 64bit crash dump
&gt;&gt;0xf98	lelong		1		\b, full dump
&gt;&gt;0xf98	lelong		2		\b, kernel dump
&gt;&gt;0xf98	lelong		3		\b, small dump
&gt;&gt;0x090	lequad		x		\b, %lld pages


# Summary: Vista Event Log
# Extension: .evtx
# Created by: Andreas Schuster (http://computer.forensikblog.de/)
# Reference (1): http://computer.forensikblog.de/en/2007/05/some_magic.html
0	string		ElfFile\0	MS Windows Vista Event Log
&gt;0x2a	leshort		x		\b, %d chunks
&gt;&gt;0x10	lelong		x		\b (no. %d in use)
&gt;0x18	lelong		&gt;1		\b, next record no. %d
&gt;0x18	lelong		=1		\b, empty
&gt;0x78	lelong		&amp;1		\b, DIRTY
&gt;0x78	lelong		&amp;2		\b, FULL


# Summary: Windows 3.1 group files
# Extension: .grp
# Created by: unknown
0	string		\120\115\103\103	MS Windows 3.1 group files


# Summary: Old format help files
# URL: https://en.wikipedia.org/wiki/WinHelp
# Reference: http://www.oocities.org/mwinterhoff/helpfile.htm
# Update: Joerg Jenderek
# Created by: Dirk Jagdmann &lt;doj@cubic.org&gt;
#
# check and then display version and date inside MS Windows HeLP file fragment
0	name				help-ver-date
# look for Magic of SYSTEMHEADER
&gt;0	leshort		0x036C
# version Major		1 for right file fragment
&gt;&gt;4	leshort		1		Windows
# print non empty string above to avoid error message
# Warning: Current entry does not yet have a description for adding a MIME type
!:mime	application/winhelp
!:ext	hlp
# version Minor of help file format is hint for windows version
&gt;&gt;&gt;2	leshort		0x0F		3.x
&gt;&gt;&gt;2	leshort		0x15		3.0
&gt;&gt;&gt;2	leshort		0x21		3.1
&gt;&gt;&gt;2	leshort		0x27		x.y
&gt;&gt;&gt;2	leshort		0x33		95
&gt;&gt;&gt;2	default		x		y.z
&gt;&gt;&gt;&gt;2	leshort		x		0x%x
# to complete message string like &quot;MS Windows 3.x help file&quot;
&gt;&gt;&gt;2	leshort		x		help
# GenDate often older than file creation date
&gt;&gt;&gt;6	ldate		x		\b, %s
#
# Magic for HeLP files
0	lelong		0x00035f3f
# ./windows (version 5.25) labeled the entry as &quot;MS Windows 3.x help file&quot;
# file header magic 0x293B at DirectoryStart+9
&gt;(4.l+9)	uleshort	0x293B		MS
# look for @VERSION	bmf.. like IBMAVW.ANN
&gt;&gt;0xD4		string	=\x62\x6D\x66\x01\x00	Windows help annotation
!:mime	application/x-winhelp
!:ext	ann
&gt;&gt;0xD4		string	!\x62\x6D\x66\x01\x00
# &quot;GID Help index&quot; by TrID
&gt;&gt;&gt;(4.l+0x65)	string	=|Pete			Windows help Global Index
!:mime	application/x-winhelp
!:ext	gid
# HeLP Bookmark or
# &quot;Windows HELP File&quot; by TrID
&gt;&gt;&gt;(4.l+0x65)		string		!|Pete
# maybe there exist a cleaner way to detect HeLP fragments
# brute search for Magic 0x036C with matching Major maximal 7 iterations
# discapp.hlp
&gt;&gt;&gt;&gt;16			search/0x49AF/s	\x6c\x03
&gt;&gt;&gt;&gt;&gt;&amp;0			use 		help-ver-date
&gt;&gt;&gt;&gt;&gt;&amp;4			leshort		!1
# putty.hlp
&gt;&gt;&gt;&gt;&gt;&gt;&amp;0		search/0x69AF/s	\x6c\x03
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0		use 		help-ver-date
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;4		leshort		!1
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0		search/0x49AF/s	\x6c\x03
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0		use 		help-ver-date
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;4		leshort		!1
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0		search/0x49AF/s	\x6c\x03
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0		use 		help-ver-date
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;4		leshort		!1
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0		search/0x49AF/s	\x6c\x03
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0		use 		help-ver-date
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;4		leshort		!1
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	search/0x49AF/s	\x6c\x03
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	use 		help-ver-date
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;4	leshort		!1
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	search/0x49AF/s	\x6c\x03
# GCC.HLP is detected after 7 iterations
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0	use 		help-ver-date
# this only happens if bigger hlp file is detected after used search iterations
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;4	leshort		!1		Windows y.z help
!:mime	application/winhelp
!:ext	hlp
# repeat search again or following default line does not work
&gt;&gt;&gt;&gt;16			search/0x49AF/s	\x6c\x03
# remaining files should be HeLP Bookmark WinHlp32.BMK (XP 32-bit) or WinHlp32 (Windows 8.1 64-bit)
&gt;&gt;&gt;&gt;16	default				x	Windows help Bookmark
!:mime	application/x-winhelp
!:ext	bmk
## FirstFreeBlock normally FFFFFFFFh 10h for *ANN
##&gt;&gt;8	lelong			x		\b, FirstFreeBlock 0x%8.8x
# EntireFileSize
&gt;&gt;12	lelong			x		\b, %d bytes
## ReservedSpace normally 042Fh AFh for *.ANN
#&gt;&gt;(4.l)	lelong		x		\b, ReservedSpace 0x%8.8x
## UsedSpace normally 0426h A6h for *.ANN
#&gt;&gt;(4.l+4)	lelong		x		\b, UsedSpace 0x%8.8x
## FileFlags normally 04...
#&gt;&gt;(4.l+5)	lelong		x		\b, FileFlags 0x%8.8x
## file header magic 0x293B
#&gt;&gt;(4.l+9)	uleshort	x		\b, file header magic 0x%4.4x
## file header Flags		0x0402
#&gt;&gt;(4.l+11)	uleshort	x		\b, file header Flags 0x%4.4x
## file header PageSize	0400h 80h for *.ANN
#&gt;&gt;(4.l+13)	uleshort	x		\b, PageSize 0x%4.4x
## Structure[16]		z4
#&gt;&gt;(4.l+15)	string		&gt;\0		\b, Structure_&quot;%-.16s&quot;
## MustBeZero			0
#&gt;&gt;(4.l+31)	uleshort	x		\b, MustBeZero 0x%4.4x
## PageSplits
#&gt;&gt;(4.l+33)	uleshort	x		\b, PageSplits 0x%4.4x
## RootPage
#&gt;&gt;(4.l+35)	uleshort	x		\b, RootPage 0x%4.4x
## MustBeNegOne			0xffff
#&gt;&gt;(4.l+37)	uleshort	x		\b, MustBeNegOne 0x%4.4x
## TotalPages			1
#&gt;&gt;(4.l+39)	uleshort	x		\b, TotalPages 0x%4.4x
## NLevels			0x0001
#&gt;&gt;(4.l+41)	uleshort	x		\b, NLevels 0x%4.4x
## TotalBtreeEntries
#&gt;&gt;(4.l+43)	ulelong		x		\b, TotalBtreeEntries 0x%8.8x
## pages of the B+ tree
#&gt;&gt;(4.l+47)	ubequad		x		\b, PageStart 0x%16.16llx

# start with colon or semicolon for comment line like Back2Life.cnt
0		regex		\^(:|;)
# look for first keyword Base
&gt;0		search/45	:Base
&gt;&gt;&amp;0				use 		cnt-name
# only solution to search again from beginning , because relative offsets changes when use is called
&gt;0		search/45	:Base
&gt;0		default		x
# look for other keyword Title like in putty.cnt
&gt;&gt;0		search/45	:Title
&gt;&gt;&gt;&amp;0				use 		cnt-name
#
# display mime type and name of Windows help Content source
0	name				cnt-name
# skip space at beginning
&gt;0     string		\040
# name without extension and greater character or name with hlp extension
&gt;&gt;1	regex/c		\^([^\xd&gt;]*|.*\.hlp)	MS Windows help file Content, based &quot;%s&quot;
!:mime	text/plain
!:apple	????TEXT
!:ext	cnt
#
# Windows creates an full text search from hlp file, if the user clicks the &quot;Find&quot; tab and enables keyword indexing
0	string		tfMR			MS Windows help Full Text Search index
!:mime application/x-winhelp-fts
!:ext	fts
&gt;16	string		&gt;\0			for &quot;%s&quot;

# Summary: Hyper terminal
# Extension: .ht
# Created by: unknown
0	string		HyperTerminal\040
&gt;15	string		1.0\ --\ HyperTerminal\ data\ file	MS Windows HyperTerminal profile

# http://ithreats.files.wordpress.com/2009/05/\040
# lnk_the_windows_shortcut_file_format.pdf
# Summary: Windows shortcut
# Extension: .lnk
# Created by: unknown
# &#039;L&#039; + GUUID
0	string		\114\0\0\0\001\024\002\0\0\0\0\0\300\0\0\0\0\0\0\106	MS Windows shortcut
&gt;20	lelong&amp;1	1	\b, Item id list present
&gt;20	lelong&amp;2	2	\b, Points to a file or directory
&gt;20	lelong&amp;4	4	\b, Has Description string
&gt;20	lelong&amp;8	8	\b, Has Relative path
&gt;20	lelong&amp;16	16	\b, Has Working directory
&gt;20	lelong&amp;32	32	\b, Has command line arguments
&gt;20	lelong&amp;64	64	\b, Icon
&gt;&gt;56	lelong		x	\b number=%d
&gt;24	lelong&amp;1	1	\b, Read-Only
&gt;24	lelong&amp;2	2	\b, Hidden
&gt;24	lelong&amp;4	4	\b, System
&gt;24	lelong&amp;8	8	\b, Volume Label
&gt;24	lelong&amp;16	16	\b, Directory
&gt;24	lelong&amp;32	32	\b, Archive
&gt;24	lelong&amp;64	64	\b, Encrypted
&gt;24	lelong&amp;128	128	\b, Normal
&gt;24	lelong&amp;256	256	\b, Temporary
&gt;24	lelong&amp;512	512	\b, Sparse
&gt;24	lelong&amp;1024	1024	\b, Reparse point
&gt;24	lelong&amp;2048	2048	\b, Compressed
&gt;24	lelong&amp;4096	4096	\b, Offline
&gt;28	leqwdate	x	\b, ctime=%s
&gt;36	leqwdate	x	\b, mtime=%s
&gt;44	leqwdate	x	\b, atime=%s
&gt;52	lelong		x	\b, length=%u, window=
&gt;60	lelong&amp;1	1	\bhide
&gt;60	lelong&amp;2	2	\bnormal
&gt;60	lelong&amp;4	4	\bshowminimized
&gt;60	lelong&amp;8	8	\bshowmaximized
&gt;60	lelong&amp;16	16	\bshownoactivate
&gt;60	lelong&amp;32	32	\bminimize
&gt;60	lelong&amp;64	64	\bshowminnoactive
&gt;60	lelong&amp;128	128	\bshowna
&gt;60	lelong&amp;256	256	\brestore
&gt;60	lelong&amp;512	512	\bshowdefault
#&gt;20	lelong&amp;1	0
#&gt;&gt;20	lelong&amp;2	2
#&gt;&gt;&gt;(72.l-64)	pstring/h	x	\b [%s]
#&gt;20	lelong&amp;1	1
#&gt;&gt;20	lelong&amp;2	2
#&gt;&gt;&gt;(72.s)	leshort	x
#&gt;&gt;&gt;&amp;75	pstring/h	x	\b [%s]

# Summary: Outlook Personal Folders
# Created by: unknown
0	lelong		0x4E444221	Microsoft Outlook email folder
&gt;10	leshort		0x0e		(&lt;=2002)
&gt;10	leshort		0x17		(&gt;=2003)


# Summary: Windows help cache
# Created by: unknown
0	string		\164\146\115\122\012\000\000\000\001\000\000\000	MS Windows help cache


# Summary: IE cache file
# Created by: Christophe Monniez
0	string	Client\ UrlCache\ MMF 	Internet Explorer cache file
&gt;20	string	&gt;\0			version %s


# Summary: Registry files
# Created by: unknown
# Modified by (1): Joerg Jenderek
0	string		regf		MS Windows registry file, NT/2000 or above
0	string		CREG		MS Windows 95/98/ME registry file
0	string		SHCC3		MS Windows 3.1 registry file


# Summary: Windows Registry text
# URL: https://en.wikipedia.org/wiki/Windows_Registry#.REG_files
# Reference: http://fileformats.archiveteam.org/wiki/Windows_Registry
# Submitted by: Abel Cheung &lt;abelcheung@gmail.com&gt;
# Update: Joerg Jenderek
#		Windows 3-9X variant
0	string		REGEDIT
# skip ASCII text like &quot;REGEDITor.txt&quot; but match
# L1WMAP.REG with only 1 CRNL or org.gnome.gnumeric.reg with 2 NL
&gt;7	search/3	\n			Windows Registry text
!:mime	text/x-ms-regedit
!:ext	reg
#		Windows 9X variant
&gt;&gt;0	string		REGEDIT4		(Win95 or above)
#		Windows 2K ANSI variant
0	string		Windows\ Registry\ Editor\ 
&gt;&amp;0	string		Version\ 5.00\r\n\r\n	Windows Registry text (Win2K or above)
!:mime	text/x-ms-regedit
!:ext	reg
#		Windows 2K UTF-16 variant
2	lestring16	Windows\ Registry\ Editor\ 
&gt;0x32	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
# relative offset not working
#&gt;&amp;0	lestring16	Version\ 5.00\r\n\r\n	Windows Registry little-endian text (Win2K or above)
!:mime	text/x-ms-regedit
!:ext	reg
#		WINE variant
# URL: https://en.wikipedia.org/wiki/Wine_(software)
# Reference: https://www.winehq.org/pipermail/wine-cvs/2005-October/018763.html
# Note:	WINE use text based registry (system.reg,user.reg,userdef.reg)
#	instead binary hiv structure like Windows
0	string	WINE\ REGISTRY\ Version\ 	WINE registry text
# version 2
&gt;&amp;0	string	x				\b, version %s
!:mime	text/x-wine-extension-reg
!:ext	reg

# Windows *.INF *.INI files updated by Joerg Jenderek at Apr 2013, Feb 2018
# empty ,comment , section
# PR/383: remove unicode BOM because it is not portable across regex impls
#0	regex/s		\\`(\\r\\n|;|[[])
# empty line CRLF
0	ubeshort	0x0D0A
&gt;0	use		ini-file
# comment line
0	string		;
&gt;0	use		ini-file
# section line
0	string		[
&gt;0	use		ini-file
# check and then display Windows INItialization configuration
0	name		ini-file
# look for left bracket in section line
&gt;0	search/8192	[
# http://en.wikipedia.org/wiki/Autorun.inf
# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144200.aspx
# space after right bracket
# or AutoRun.Amd64 for 64 bit systems
# or only NL separator
&gt;&gt;&amp;0	regex/c		\^(autorun)
# but sometimes total commander directory tree file &quot;treeinfo.wc&quot; with lines like
# [AUTORUN]
# [boot]
&gt;&gt;&gt;&amp;0	string		=]\r\n[					Total commander directory treeinfo.wc
!:mime text/plain
!:ext	wc
# From: Pal Tamas &lt;folti@balabit.hu&gt;
# Autorun File
&gt;&gt;&gt;&amp;0	string		!]\r\n[					Microsoft Windows Autorun file
!:mime application/x-setupscript
!:ext	inf
# http://msdn.microsoft.com/en-us/library/windows/hardware/ff549520(v=vs.85).aspx
# version strings ASCII coded case-independent for Windows setup information script file
&gt;&gt;&amp;0	regex/c		\^(version|strings)]				Windows setup INFormation
!:mime	application/x-setupscript
#!:mime application/x-wine-extension-inf
!:ext	inf
# NETCRC.INF OEMCPL.INF
&gt;&gt;&amp;0	regex/c		\^(WinsockCRCList|OEMCPL)]			Windows setup INFormation
!:mime	application/x-setupscript
!:ext	inf
# http://www.winfaq.de/faq_html/Content/tip2500/onlinefaq.php?h=tip2653.htm
# http://msdn.microsoft.com/en-us/library/windows/desktop/cc144102.aspx
# .ShellClassInfo DeleteOnCopy LocalizedFileNames ASCII coded case-independent
&gt;&gt;&amp;0	regex/c	\^(\.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)]	Windows desktop.ini
!:mime application/x-wine-extension-ini
#!:mime text/plain
# http://support.microsoft.com/kb/84709/
&gt;&gt;&amp;0	regex/c		\^(don&#039;t\ load)]				Windows CONTROL.INI
!:mime application/x-wine-extension-ini
!:ext	ini
&gt;&gt;&amp;0	regex/c		\^(ndishlp\\$|protman\\$|NETBEUI\\$)]		Windows PROTOCOL.INI
!:mime application/x-wine-extension-ini
!:ext	ini
# http://technet.microsoft.com/en-us/library/cc722567.aspx
# http://www.winfaq.de/faq_html/Content/tip0000/onlinefaq.php?h=tip0137.htm
&gt;&gt;&amp;0	regex/c		\^(windows|Compatibility|embedding)]		Windows WIN.INI
!:mime application/x-wine-extension-ini
!:ext	ini
# http://en.wikipedia.org/wiki/SYSTEM.INI
&gt;&gt;&amp;0	regex/c		\^(boot|386enh|drivers)]			Windows SYSTEM.INI
!:mime application/x-wine-extension-ini
!:ext	ini
# http://www.mdgx.com/newtip6.htm
&gt;&gt;&amp;0	regex/c		\^(SafeList)]					Windows IOS.INI
!:mime application/x-wine-extension-ini
!:ext	ini
# http://en.wikipedia.org/wiki/NTLDR	Windows Boot Loader information
&gt;&gt;&amp;0	regex/c		\^(boot\x20loader)]				Windows boot.ini
!:mime application/x-wine-extension-ini
!:ext	ini
# http://en.wikipedia.org/wiki/CONFIG.SYS
&gt;&gt;&amp;0	regex/c		\^(menu)]					MS-DOS CONFIG.SYS
# @CONFIG.UI configuration file of previous DOS version saved by Caldera OPENDOS INSTALL.EXE
# CONFIG.PSS saved version of file CONFIG.SYS created by %WINDIR%\SYTEM\MSCONFIG.EXE
# CONFIG.TSH renamed file CONFIG.SYS.BAT by %WINDIR%\SYTEM\MSCONFIG.EXE
# dos and w40 used in dual booting scene
!:ext	sys/dos/w40
# http://support.microsoft.com/kb/118579/
&gt;&gt;&amp;0	regex/c		\^(Paths)]\r\n					MS-DOS MSDOS.SYS
!:ext	sys/dos
# http://chmspec.nongnu.org/latest/INI.html#HHP
&gt;&gt;&amp;0	regex/c		\^(options)]\r\n				Microsoft HTML Help Project
!:mime text/plain
!:ext	hhp
# unknown keyword after opening bracket
&gt;&gt;&amp;0	default				x
#&gt;&gt;&gt;&amp;0	string/c			x	UNKNOWN [%s
# look for left bracket of second section
&gt;&gt;&gt;&amp;0	search/8192			[
# version Strings FileIdentification
&gt;&gt;&gt;&gt;&amp;0	string/c			version				Windows setup INFormation
!:mime application/x-setupscript
!:ext	inf
# http://en.wikipedia.org/wiki/Initialization_file	Windows Initialization File or other
&gt;&gt;&gt;&gt;&amp;0	default				x
&gt;&gt;&gt;&gt;&gt;&amp;0	ubyte				x
# characters, digits, underscore and white space followed by right bracket
# terminated by CR implies section line to skip BOOTLOG.TXT DETLOG.TXT
&gt;&gt;&gt;&gt;&gt;&gt;&amp;-1	regex			\^([A-Za-z0-9_\(\)\ ]+)\]\r	Generic INItialization configuration [%-.40s
# NETDEF.INF multiarc.ini 
#!:mime	application/x-setupscript
!:mime	application/x-wine-extension-ini
#!:mime	text/plain
!:ext	ini/inf
# UTF-16 BOM followed by CR~0D00 , comment~semicolon~3B00 , section~bracket~5B00
0	ubelong&amp;0xFFff89FF	=0xFFFE0900
# look for left bracket in section line
&gt;2	search/8192		[
# keyword without 1st letter which is maybe up-/down-case
&gt;&gt;&amp;3	lestring16		ersion]			Windows setup INFormation
!:mime	application/x-setupscript
!:ext	inf
&gt;&gt;&amp;3	lestring16		trings]			Windows setup INFormation
!:mime	application/x-setupscript
!:ext	inf
&gt;&gt;&amp;3	lestring16		ourceDisksNames]	Windows setup INFormation
!:mime	application/x-setupscript
!:ext	inf
# netnwcli.inf start with ;---[ NetNWCli.INX ]
&gt;&gt;&amp;3	default			x
# look for NL followed by left bracket
&gt;&gt;&gt;&amp;0	search/8192		\x0A\x00\x5b
&gt;&gt;&gt;&gt;&amp;3	lestring16		ersion]			Windows setup INFormation
!:mime	application/x-setupscript
!:ext	inf

# Windows Precompiled INF files *.PNF added by Joerg Jenderek at Mar 2013 of _PNF_HEADER inf.h
# http://read.pudn.com/downloads3/sourcecode/windows/248345/win2k/private/windows/setup/setupapi/inf.h__.htm
# GRR: line below too general as it catches also PDP-11 UNIX/RT ldp
0		leshort&amp;0xFeFe	0x0000
!:strength -5
# test for unused null bits in PNF_FLAGs
&gt;4	ulelong&amp;0xFCffFe00	0x00000000
# only found 58h for Offset of WinDirPath immediately after _PNF_HEADER structure
&gt;&gt;68		ulelong		&gt;0x57
# test for zero high byte of InfValueBlockSize, followed by WinDirPath like
# C:\WINDOWS (ASCII 0x433a5c.. , unicode 0x43003a005c..) or X:\MININT
&gt;&gt;&gt;(68.l-1)	ubelong&amp;0xffE0C519	=0x00400018	Windows Precompiled iNF
!:mime	application/x-pnf
# currently only found Major Version=1 and Minor Version=1
#&gt;&gt;&gt;&gt;0		uleshort	=0x0101
#&gt;&gt;&gt;&gt;&gt;1		ubyte		x		\b, version %u
#&gt;&gt;&gt;&gt;&gt;0		ubyte		x		\b.%u
&gt;&gt;&gt;&gt;0		uleshort	!0x0101
&gt;&gt;&gt;&gt;&gt;1		ubyte		x		\b, version %u
&gt;&gt;&gt;&gt;&gt;0		ubyte		x		\b.%u
# 1 ,2 (windows 98 SE)
#&gt;&gt;&gt;&gt;2		uleshort	=2		\b, InfStyle %u
&gt;&gt;&gt;&gt;2		uleshort	!2		\b, InfStyle %u
#	PNF_FLAG_IS_UNICODE		0x00000001
#	PNF_FLAG_HAS_STRINGS		0x00000002
#	PNF_FLAG_SRCPATH_IS_URL		0x00000004
#	PNF_FLAG_HAS_VOLATILE_DIRIDS	0x00000008
#	PNF_FLAG_INF_VERIFIED		0x00000010
#	PNF_FLAG_INF_DIGITALLY_SIGNED	0x00000020
#	??				0x00000100
#	??				0x01000000
#	??				0x02000000
&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	0x00000001	\b, unicoded
&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000020	0x00000020	\b, digitally signed
#&gt;&gt;&gt;&gt;8		ulelong		x		\b, InfSubstValueListOffset 0x%x
# many 0, 1 lmouusb.PNF, 2 linkfx10.PNF , f webfdr16.PNF
#&gt;&gt;&gt;&gt;12		uleshort	x		\b, InfSubstValueCount 0x%x
# only &lt; 9 found
#&gt;&gt;&gt;&gt;14		uleshort	x		\b, InfVersionDatumCount 0x%x
# only found values lower 0x0000ffff
#&gt;&gt;&gt;&gt;16		ulelong		x		\b, InfVersionDataSize 0x%x
# only found positive values lower 0x00ffFFff for InfVersionDataOffset
&gt;&gt;&gt;&gt;20		ulelong		x		\b, at 0x%x
&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	=0x00000001
# case independent: CatalogFile Class DriverVer layoutfile LayoutFile SetupClass signature Signature
&gt;&gt;&gt;&gt;&gt;(20.l)	lestring16	x		&quot;%s&quot;
&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	!0x00000001
&gt;&gt;&gt;&gt;&gt;(20.l)	string		x		&quot;%s&quot;
# FILETIME is number of 100-nanosecond intervals since 1 January 1601
#&gt;&gt;&gt;&gt;24		ulequad		x		\b, InfVersionLastWriteTime %16.16llx
# only found values lower 0x00ffFFff
#&gt;&gt;&gt;&gt;32		ulelong		x		\b, StringTableBlockOffset 0x%x
#&gt;&gt;&gt;&gt;36		ulelong		x		\b, StringTableBlockSize 0x%x
#&gt;&gt;&gt;&gt;40		ulelong		x		\b, InfSectionCount 0x%x
#&gt;&gt;&gt;&gt;44		ulelong		x		\b, InfSectionBlockOffset 0x%x
#&gt;&gt;&gt;&gt;48		ulelong		x		\b, InfSectionBlockSize 0x%x
#&gt;&gt;&gt;&gt;52		ulelong		x		\b, InfLineBlockOffset 0x%x
#&gt;&gt;&gt;&gt;56		ulelong		x		\b, InfLineBlockSize 0x%x
#&gt;&gt;&gt;&gt;60		ulelong		x		\b, InfValueBlockOffset 0x%x
#&gt;&gt;&gt;&gt;64		ulelong		x		\b, InfValueBlockSize 0x%x
# WinDirPathOffset
#&gt;&gt;&gt;&gt;68		ulelong		x		\b, at 0x%x
&gt;&gt;&gt;&gt;68		ulelong		&gt;0x57
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	=0x00000001
&gt;&gt;&gt;&gt;&gt;&gt;(68.l)	ubequad		=0x43003a005c005700
# normally unicoded C:\Windows
#&gt;&gt;&gt;&gt;&gt;&gt;&gt;(68.l)	lestring16	x		\b, WinDirPath &quot;%s&quot;
&gt;&gt;&gt;&gt;&gt;&gt;(68.l)	ubequad		!0x43003a005c005700
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(68.l)	lestring16	x		\b, WinDirPath &quot;%s&quot;
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	!0x00000001
# normally ASCII C:\WINDOWS
#&gt;&gt;&gt;&gt;&gt;&gt;(68.l)	string		=C:\\WINDOWS	\b, WinDirPath &quot;%s&quot;
&gt;&gt;&gt;&gt;&gt;&gt;(68.l)	string		!C:\\WINDOWS	\b, WinDirPath &quot;%s&quot;
# found OsLoaderPathOffset values often 0 , once 70h corelist.PNF, once 68h ASCII machine.PNF
#&gt;&gt;&gt;&gt;72		ulelong		&gt;0		\b, at 0x%x
&gt;&gt;&gt;&gt;72		ulelong		&gt;0		\b,
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	=0x00000001
&gt;&gt;&gt;&gt;&gt;&gt;(72.l)	lestring16	x		OsLoaderPath &quot;%s&quot;
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	!0x00000001
# seldom C:\ instead empty
&gt;&gt;&gt;&gt;&gt;&gt;(72.l)	string		x		OsLoaderPath &quot;%s&quot;
# 1fdh
#&gt;&gt;&gt;&gt;76		uleshort	x		\b, StringTableHashBucketCount 0x%x
&gt;&gt;&gt;&gt;78		uleshort	!0x407		\b, LanguageId %x
# only 407h found
#&gt;&gt;&gt;&gt;78		uleshort	=0x407		\b, LanguageId %x
# InfSourcePathOffset often 0
#&gt;&gt;&gt;&gt;80		ulelong		&gt;0		\b, at 0x%x
&gt;&gt;&gt;&gt;80		ulelong		&gt;0		\b,
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	=0x00000001
&gt;&gt;&gt;&gt;&gt;&gt;(80.l)	lestring16	x		SourcePath &quot;%s&quot;
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	!0x00000001
&gt;&gt;&gt;&gt;&gt;&gt;(80.l)	string		&gt;\0		SourcePath &quot;%s&quot;
# OriginalInfNameOffset often 0
#&gt;&gt;&gt;&gt;84		ulelong		&gt;0		\b, at 0x%x
&gt;&gt;&gt;&gt;84		ulelong		&gt;0		\b,
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	=0x00000001
&gt;&gt;&gt;&gt;&gt;&gt;(84.l)	lestring16	x		InfName &quot;%s&quot;
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	!0x00000001
&gt;&gt;&gt;&gt;&gt;&gt;(84.l)	string		&gt;\0		InfName &quot;%s&quot;

# Summary: backup file created with utility like NTBACKUP.EXE shipped with Windows NT/2K/XP/2003
# Extension: .bkf
# Created by: Joerg Jenderek
# URL: http://en.wikipedia.org/wiki/NTBackup
# Reference: http://laytongraphics.com/mtf/MTF_100a.PDF
# Descriptor BloCK name of Microsoft Tape Format
0	string			TAPE
# Format Logical Address is zero
&gt;20	ulequad			0
# Reserved for MBC is zero
&gt;&gt;28	uleshort		0
# Control Block ID is zero
&gt;&gt;&gt;36	ulelong			0
# BIT4-BIT15, BIT18-BIT31 of block attributes are unused
&gt;&gt;&gt;&gt;4	ulelong&amp;0xFFfcFFe0	0		Windows NTbackup archive
#!:mime application/x-ntbackup
!:ext bkf
# OS ID
&gt;&gt;&gt;&gt;&gt;10	ubyte			1		\b NetWare
&gt;&gt;&gt;&gt;&gt;10	ubyte			13		\b NetWare SMS
&gt;&gt;&gt;&gt;&gt;10	ubyte			14		\b NT
&gt;&gt;&gt;&gt;&gt;10	ubyte			24		\b 3
&gt;&gt;&gt;&gt;&gt;10	ubyte			25		\b OS/2
&gt;&gt;&gt;&gt;&gt;10	ubyte			26		\b 95
&gt;&gt;&gt;&gt;&gt;10	ubyte			27		\b Macintosh
&gt;&gt;&gt;&gt;&gt;10	ubyte			28		\b UNIX
# OS Version (2)
#&gt;&gt;&gt;&gt;&gt;11	ubyte			x		OS V=%x
# MTF_CONTINUATION	Media Sequence Number &gt; 1
#&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000001	!0		\b, continued
# MTF_COMPRESSION
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000004	!0		\b, compressed
# MTF_EOS_AT_EOM	End Of Medium was hit during end of set processing
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00000008	!0		\b, End Of Medium hit
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00020000	0
# MTF_SET_MAP_EXISTS	A Media Based Catalog Set Map may exist on tape
&gt;&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00010000	!0		\b, with catalog
# MTF_FDD_ALLOWED	However File/Directory Detail can only exist if a Set Map is also present
&gt;&gt;&gt;&gt;&gt;4	ulelong&amp;0x00020000	!0		\b, with file catalog
# Offset To First Event 238h,240h,28Ch
#&gt;&gt;&gt;&gt;&gt;8	uleshort		x		\b, event offset %4.4x
# Displayable Size (20e0230h 20e024ch 20e0224h)
#&gt;&gt;&gt;&gt;&gt;8	ulequad			x		dis. size %16.16llx
# Media Family ID (455288C4h 4570BD1Ah 45708F2Fh 4570BBF5h)
#&gt;&gt;&gt;&gt;&gt;52	ulelong			x		family ID %8.8x
# TAPE Attributes (3)
#&gt;&gt;&gt;&gt;&gt;56	ulelong			x		TAPE %8.8x
# Media Sequence Number
&gt;&gt;&gt;&gt;&gt;60	uleshort		&gt;1		\b, sequence %u
# Password Encryption Algorithm (3)
&gt;&gt;&gt;&gt;&gt;62	uleshort		&gt;0		\b, 0x%x encrypted
# Soft Filemark Block Size * 512 (2)
#&gt;&gt;&gt;&gt;&gt;64	uleshort		=2		\b, soft size %u*512
&gt;&gt;&gt;&gt;&gt;64	uleshort		!2		\b, soft size %u*512
# Media Based Catalog Type (1,2)
#&gt;&gt;&gt;&gt;&gt;66	uleshort		x		\b, catalog type %4.4x
# size of Media Name (66,68,6Eh)
&gt;&gt;&gt;&gt;&gt;68	uleshort		&gt;0
# offset of Media Name (5Eh)
&gt;&gt;&gt;&gt;&gt;&gt;70	uleshort	&gt;0
# 0~, 1~ANSI, 2~UNICODE
&gt;&gt;&gt;&gt;&gt;&gt;&gt;48	ubyte		1
# size terminated ansi coded string normally followed by &quot;MTF Media Label&quot;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(70.s)	string		&gt;\0		\b, name: %s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;48	ubyte		2
# Not null, but size terminated unicoded string
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(70.s)	lestring16	x		\b, name: %s
# size of Media Label (104h)
&gt;&gt;&gt;&gt;&gt;72	uleshort		&gt;0
# offset of Media Label (C4h,C6h,CCh)
&gt;&gt;&gt;&gt;&gt;74		uleshort	&gt;0
&gt;&gt;&gt;&gt;&gt;&gt;48	ubyte		1
#Tag|Version|Vendor|Vendor ID|Creation Time Stamp|Cartridge Label|Side|Media ID|Media Domain ID|Vendor Specific fields
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(74.s)	string		&gt;\0		\b, label: %s
&gt;&gt;&gt;&gt;&gt;&gt;48	ubyte		2
&gt;&gt;&gt;&gt;&gt;&gt;&gt;(74.s)	lestring16	x		\b, label: %s
# size of password name (0,1Ch)
#&gt;&gt;&gt;&gt;&gt;76	uleshort		&gt;0		\b, password size %4.4x
# Software Vendor ID (CBEh)
&gt;&gt;&gt;&gt;&gt;86	uleshort		x		\b, software (0x%x)
# size of Software Name (6Eh)
&gt;&gt;&gt;&gt;&gt;80	uleshort		&gt;0
# offset of Software Name (1C8h,1CAh,1D0h)
&gt;&gt;&gt;&gt;&gt;&gt;82	uleshort	&gt;0
# 1~ANSI, 2~UNICODE
&gt;&gt;&gt;&gt;&gt;&gt;&gt;48	ubyte		1
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(82.s)	string		&gt;\0		\b: %s
&gt;&gt;&gt;&gt;&gt;&gt;&gt;48	ubyte		2
# size terminated unicoded coded string normally followed by &quot;SPAD&quot;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;(82.s)	lestring16	x		\b: %s
# Format Logical Block Size (512,1024)
#&gt;&gt;&gt;&gt;&gt;84	uleshort		=1024		\b, block size %u
&gt;&gt;&gt;&gt;&gt;84	uleshort		!1024		\b, block size %u
# Media Date of MTF_DATE_TIME type with 5 bytes
#&gt;&gt;&gt;&gt;&gt;&gt;88	ubequad			x		DATE %16.16llx
# MTF Major Version (1)
#&gt;&gt;&gt;&gt;&gt;&gt;93	ubyte		x		\b, MFT version %x
#

# URL: https://en.wikipedia.org/wiki/PaintShop_Pro
# Reference: http://www.cryer.co.uk/file-types/p/pal.htm
# Created by: Joerg Jenderek
# Note: there exist other color palette formats also with .pal extension
0	string	JASC-PAL\r\n	PaintShop Pro color palette
#!:mime	text/plain
# PspPalette extension is used by newer (probably 8) PaintShopPro versions
!:ext	pal/PspPalette
# 2nd line contains palette file version. For example &quot;0100&quot;
&gt;10	string	!0100		\b, version %.4s
# third line contains the number of colours: 16 256 ...
&gt;16	string	x		\b, %.3s colors

# URL: http://en.wikipedia.org/wiki/Innosetup
# Reference: https://github.com/jrsoftware/issrc/blob/master/Projects/Undo.pas
# Created by: Joerg Jenderek
# Note:	created by like &quot;InnoSetup self-extracting archive&quot; inside ./msdos
# TrID labeles the entry as &quot;Inno Setup Uninstall Log&quot;
#	TUninstallLogID
0	string	Inno\ Setup\ Uninstall\ Log\ (b)	InnoSetup Log
!:mime	application/x-innosetup
# unins000.dat, unins001.dat, ...
!:ext	dat
# &quot; 64-bit&quot; variant
&gt;0x1c	string		&gt;\0				\b%.7s
# AppName[0x80] like &quot;Minimal SYStem&quot;, ClamWin Free Antivirus , ...
&gt;0xc0	string		x				%s
# AppId[0x80] is simliar to AppName or
# GUID like {4BB0DCDC-BC24-49EC-8937-72956C33A470} start with left brace
&gt;0x40	ubyte		0x7b
&gt;&gt;0x40	string		x				%-.38s
# do not know how this log version correlates to program version
&gt;0x140	ulelong		x				\b, version 0x%x
# NumRecs
#&gt;0x144	ulelong		x				\b, 0x%4.4x records
# EndOffset means files size
&gt;0x148	ulelong		x				\b, %u bytes
# Flags 5 25h 35h
#&gt;0x14c	ulelong		x				\b, flags %8.8x
# Reserved: array[0..26] of Longint
# the non Unicode HighestSupportedVersion may never become greater than or equal to 1000
&gt;0x140	ulelong		&lt;1000
# hostname
&gt;&gt;0x1d6	pstring		x				\b, %s
# user name
&gt;&gt;&gt;&amp;0	pstring		x				\b\%s
# directory like C:\Program Files (x86)\GnuWin32
&gt;&gt;&gt;&gt;&amp;0	pstring		x				\b, &quot;%s&quot;
# version 1000 or higher implies unicode
&gt;0x140	ulelong		&gt;999
# hostname
&gt;&gt;0x1db	lestring16	x				\b, %-.9s
# utf string variant with prepending fe??ffFFff
&gt;&gt;0x1db	search/43	\xFF\xFF\xFF			
# user name
&gt;&gt;&gt;&amp;0	lestring16	x				\b\%-.9s
&gt;&gt;&gt;&amp;0	search/43	\xFF\xFF\xFF			
# directory like C:\Program Files\GIMP 2
&gt;&gt;&gt;&gt;&amp;0	lestring16	x				\b, %-.42s


#------------------------------------------------------------------------------
# $File: wireless,v 1.2 2009/09/19 16:28:13 christos Exp $
# wireless-regdb:        file(1) magic for CRDA wireless-regdb file format
#
0	string	RGDB	CRDA wireless regulatory database file
&gt;4	belong	19	(Version 1)

#------------------------------------------------------------------------------
# $File: wordprocessors,v 1.19 2015/10/16 15:11:07 christos Exp $
# wordprocessors:  file(1) magic fo word processors.
#
####### PWP file format used on Smith Corona Personal Word Processors:
2	string	\040\040\040\040\040\040\040\040\040\040\040ML4D\040&#039;92	Smith Corona PWP
&gt;24	byte	2	\b, single spaced
&gt;24	byte	3	\b, 1.5 spaced
&gt;24	byte	4	\b, double spaced
&gt;25	byte	0x42	\b, letter
&gt;25	byte	0x54	\b, legal
&gt;26	byte	0x46	\b, A4

# Corel/WordPerfect
0	string	\xffWPC
# WordPerfect
&gt;8	byte	1
&gt;&gt;9	byte	1	WordPerfect macro
&gt;&gt;9	byte	2	WordPerfect help file
&gt;&gt;9	byte	3	WordPerfect keyboard file
&gt;&gt;9	byte	10	WordPerfect document
&gt;&gt;9	byte	11	WordPerfect dictionary
&gt;&gt;9	byte	12	WordPerfect thesaurus
&gt;&gt;9	byte	13	WordPerfect block
&gt;&gt;9	byte	14	WordPerfect rectangular block
&gt;&gt;9	byte	15	WordPerfect column block
&gt;&gt;9	byte	16	WordPerfect printer data
&gt;&gt;9	byte	19	WordPerfect printer data
&gt;&gt;9	byte	20	WordPerfect driver resource data
&gt;&gt;9	byte	22	WordPerfect graphic image
&gt;&gt;9	byte	23	WordPerfect hyphenation code
&gt;&gt;9	byte	24	WordPerfect hyphenation data
&gt;&gt;9	byte	25	WordPerfect macro resource data
&gt;&gt;9	byte	27	WordPerfect hyphenation lex
&gt;&gt;9	byte	29	WordPerfect wordlist
&gt;&gt;9	byte	30	WordPerfect equation resource data
&gt;&gt;9	byte	33	WordPerfect spell rules
&gt;&gt;9	byte	34	WordPerfect dictionary rules
&gt;&gt;9	byte	39	WordPerfect spell rules (Microlytics)
&gt;&gt;9	byte	43	WordPerfect settings file
&gt;&gt;9	byte	44	WordPerfect 3.5 document
&gt;&gt;9	byte	45	WordPerfect 4.2 document
&gt;&gt;9	byte	69	WordPerfect dialog file
&gt;&gt;9	byte	76	WordPerfect button bar
&gt;&gt;9	default x
&gt;&gt;&gt;9	byte	x	Corel WordPerfect: Unknown filetype %d
# Corel Shell
&gt;8	byte	2
&gt;&gt;9	byte	1	Corel shell macro
&gt;&gt;9	byte	10	Corel shell definition
&gt;&gt;9	default x
&gt;&gt;&gt;9	byte	x	Corel Shell: Unknown filetype %d
# Corel Notebook
&gt;8	byte	3
&gt;&gt;9	byte	1	Corel Notebook macro
&gt;&gt;9	byte	2	Corel Notebook help file
&gt;&gt;9	byte	3	Corel Notebook keyboard file
&gt;&gt;9	byte	10	Corel Notebook definition
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel Notebook: Unknown filetype %d
# Corel Calculator
&gt;8	byte	4
&gt;&gt;9	byte	2	Corel Calculator help file
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel Calculator: Unknown filetype %d
# Corel File Manager
&gt;8	byte	5
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel File Manager: Unknown filetype %d
# Corel Calendar
&gt;8	byte	6
&gt;&gt;9	byte 	2	Corel Calendar help file
&gt;&gt;9	byte 	10	Corel Calendar data file
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel Calendar: Unknown filetype %d
# Corel Program Editor/Ed Editor
&gt;8	byte	7
&gt;&gt;9	byte	1	Corel Editor macro
&gt;&gt;9	byte	2	Corel Editor help file
&gt;&gt;9	byte	3	Corel Editor keyboard file
&gt;&gt;9	byte	25	Corel Editor macro resource file
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel Program Editor/Ed Editor: Unknown filetype %d
# Corel Macro Editor
&gt;8	byte	8
&gt;&gt;9	byte 	1	Corel Macro editor macro
&gt;&gt;9	byte 	2	Corel Macro editor help file
&gt;&gt;9	byte	3	Corel Macro editor keyboard file
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel Macro Editor: Unknown filetype %d
# Corel Plan Perfect
&gt;8	byte	9
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel Plan Perfect: Unknown filetype %d
# Corel DataPerfect
&gt;8	byte	10
# CHECK: Don&#039;t these belong into product 9?
&gt;&gt;9	byte	1	Corel PlanPerfect macro
&gt;&gt;9	byte	2	Corel PlanPerfect help file
&gt;&gt;9	byte	3	Corel PlanPerfect keyboard file
&gt;&gt;9	byte	10	Corel PlanPerfect worksheet
&gt;&gt;9	byte	15	Corel PlanPerfect printer definition
&gt;&gt;9	byte	18	Corel PlanPerfect graphic definition
&gt;&gt;9	byte	19	Corel PlanPerfect data
&gt;&gt;9	byte	20	Corel PlanPerfect temporary printer
&gt;&gt;9	byte	25	Corel PlanPerfect macro resource data
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel DataPerfect: Unknown filetype %d
# Corel Mail
&gt;8	byte	11
&gt;&gt;9	byte	2	Corel Mail help file
&gt;&gt;9	byte	5	Corel Mail distribution list
&gt;&gt;9	byte	10	Corel Mail out box
&gt;&gt;9	byte	11	Corel Mail in box
&gt;&gt;9	byte	20	Corel Mail users archived mailbox
&gt;&gt;9	byte	21	Corel Mail archived message database
&gt;&gt;9	byte	22	Corel Mail archived attachments
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel Mail: Unknown filetype %d
# Corel Printer
&gt;8	byte	12
&gt;&gt;9	byte	11	Corel Printer temporary file
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel Printer: Unknown filetype %d
# Corel Scheduler
&gt;8	byte	13
&gt;&gt;9	byte	2	Corel Scheduler help file
&gt;&gt;9	byte	10	Corel Scheduler in file
&gt;&gt;9	byte	11	Corel Scheduler out file
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel Scheduler: Unknown filetype %d
# Corel WordPerfect Office
&gt;8	byte	14
&gt;&gt;9	byte	10	Corel GroupWise settings file
&gt;&gt;9	byte	17	Corel GroupWise directory services
&gt;&gt;9	byte	43	Corel GroupWise settings file
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel WordPerfect Office: Unknown filetype %d
# Corel DrawPerfect
&gt;8	byte	15
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel DrawPerfect: Unknown filetype %d
# Corel LetterPerfect
&gt;8	byte	16
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel LetterPerfect: Unknown filetype %d
# Corel Terminal
&gt;8	byte	17
&gt;&gt;9	byte	10	Corel Terminal resource data
&gt;&gt;9	byte	11	Corel Terminal resource data
&gt;&gt;9	byte	43	Corel Terminal resource data
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel Terminal: Unknown filetype %d
# Corel loadable file
&gt;8	byte	18
&gt;&gt;9	byte	10	Corel loadable file
&gt;&gt;9	byte	11	Corel GUI loadable text
&gt;&gt;9	byte	12	Corel graphics resource data
&gt;&gt;9	byte	13	Corel printer settings file
&gt;&gt;9	byte	14	Corel port definition file
&gt;&gt;9	byte	15	Corel print queue parameters
&gt;&gt;9	byte	16	Corel compressed file
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel loadable file: Unknown filetype %d
&gt;&gt;15	byte	0	\b, optimized for Intel
&gt;&gt;15	byte	1	\b, optimized for Non-Intel
# Network service
&gt;8	byte	20
&gt;&gt;9	byte	10	Corel Network service msg file
&gt;&gt;9	byte	11	Corel Network service msg file
&gt;&gt;9	byte	12	Corel Async gateway login msg
&gt;&gt;9	byte	14	Corel GroupWise message file
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	Corel Network service: Unknown filetype %d
# GroupWise
&gt;8	byte	31
&gt;&gt;9	byte	20	GroupWise admin domain database
&gt;&gt;9	byte	21	GroupWise admin host database
&gt;&gt;9	byte	23	GroupWise admin remote host database
&gt;&gt;9	byte	24	GroupWise admin ADS deferment data file
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	GroupWise: Unknown filetype %d
# IntelliTAG
&gt;8	byte	33
&gt;&gt;9	byte	10	IntelliTAG (SGML) compiled DTD
&gt;&gt;9	default	x
&gt;&gt;&gt;9	byte	x	IntelliTAG: Unknown filetype %d
# everything else
&gt;8	default x
&gt;&gt;8	byte	x	Unknown Corel/Wordperfect product %d,
&gt;&gt;&gt;9	byte	x	file type %d
&gt;10	byte	0	\b, v5.
&gt;10	byte	!0	\b, v%d.
&gt;11	byte	x	\b%d

# Hangul (Korean) Word Processor File
0	string	HWP\ Document\ File	Hangul (Korean) Word Processor File 3.0
# From: Won-Kyu Park &lt;wkpark@kldp.org&gt;
512	string		R\0o\0o\0t\0	Hangul (Korean) Word Processor File 2000
!:mime	application/x-hwp

# CosmicBook, from Benoit Rouits
0       string  CSBK    Ted Neslson&#039;s CosmicBook hypertext file

2       string  EYWR    AmigaWriter file

# chi:  file(1) magic for ChiWriter files
0       string          \\1cw\          ChiWriter file
&gt;5      string          &gt;\0             version %s
0       string          \\1cw           ChiWriter file

# Quark Express from http://www.garykessler.net/library/file_sigs.html
2	string	IIXPR3			Intel Quark Express Document (English)
2	string	IIXPRa			Intel Quark Express Document (Korean)
2	string	MMXPR3			Motorola Quark Express Document (English)
!:mime	application/x-quark-xpress-3
2	string	MMXPRa			Motorola Quark Express Document (Korean)

# adobe indesign (document, whatever...) from querkan
0	belong	0x0606edf5		Adobe InDesign
&gt;16	string	DOCUMENT		Document

#------------------------------------------------------------------------------
# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
#
# Contributor kenzo-:
# Reversed-engineered JS Ichitaro magic numbers
#

0	string		DOC
&gt;43	byte		0x14	Just System Word Processor Ichitaro v4
!:mime	application/x-ichitaro4
&gt;144	string	JDASH		application/x-ichitaro4

0	string		DOC
&gt;43	byte		0x15	Just System Word Processor Ichitaro v5
!:mime	application/x-ichitaro5

0	string		DOC
&gt;43	byte		0x16	Just System Word Processor Ichitaro v6
!:mime	application/x-ichitaro6

# Type: Freemind mindmap documents
# From: Jamie Thompson &lt;debian-bugs@jamie-thompson.co.uk&gt;
0	string/w	\&lt;map\ version	Freemind document
!:mime	application/x-freemind

# Type: Freeplane mindmap documents
# From: Felix Natter &lt;fnatter@gmx.net&gt;
0       string/w        \&lt;map\ version=&quot;freeplane  Freeplane document
!:mime  application/x-freeplane

# Type:        Scribus
# From:        Werner Fink &lt;werner@suse.de&gt;
0	string	\&lt;SCRIBUSUTF8\ Version		Scribus Document
0	string	\&lt;SCRIBUSUTF8NEW\ Version	Scribus Document
!:mime	application/x-scribus

# help files .hlp compiled from html and used by gfxboot added by Joerg Jenderek
# markups page=0x04,label=0x12, followed by strings like &quot;opt&quot; or &quot;main&quot; and title=0x14
0	ulelong&amp;0x8080FFFF	0x00001204	gfxboot compiled html help file

#------------------------------------------------------------------------------
# $File: wsdl,v 1.3 2013/02/06 14:18:52 christos Exp $
# wsdl: PHP WSDL Cache, http://www.php.net/manual/en/book.soap.php
# Cache format extracted from source:
# http://svn.php.net/viewvc/php/php-src/trunk/ext/soap/php_sdl.c?revision=HEAD&amp;view=markup
# Requires file &gt;= 5.05, see http://mx.gw.com/pipermail/file/2010/000683.html
# By Elan Ruusamae &lt;glen@delfi.ee&gt;, Patryk Zawadzki &lt;patrys@pld-linux.org&gt;, 2010-2011
0		string		wsdl		PHP WSDL cache,
&gt;4		byte		x		version 0x%02x
&gt;6		ledate		x		\b, created %s

# uri
&gt;10		lelong		&lt;0x7fffffff
&gt;&gt;10		pstring/l	x		\b, uri: &quot;%s&quot;

# source
&gt;&gt;&gt;&amp;0		lelong		&lt;0x7fffffff
&gt;&gt;&gt;&gt;&amp;-4		pstring/l	x		\b, source: &quot;%s&quot;

# target_ns
&gt;&gt;&gt;&gt;&gt;&amp;0		lelong		&lt;0x7fffffff
&gt;&gt;&gt;&gt;&gt;&gt;&amp;-4	pstring/l	x		\b, target_ns: &quot;%s&quot;
#------------------------------------------------------------------------------
# x68000:  file(1) magic for the Sharp Home Computer
# v1.0
# Fabio R. Schmidlin &lt;sd-snatcher@users.sourceforge.net&gt;

# Yanagisawa PIC picture
0	string		PIC
&gt;3	search/0x200	\x1A
&gt;&gt;&amp;0	search/0x200	\x0
&gt;&gt;&gt;&amp;0	ubyte		0		Yanagisawa PIC image file,
&gt;&gt;&gt;&gt;&amp;0	ubyte&amp;15	0		model: X68000,
&gt;&gt;&gt;&gt;&amp;0	ubyte&amp;15	1		model: PC-88VA,
&gt;&gt;&gt;&gt;&amp;0	ubyte&amp;15	2		model: FM-TOWNS,
&gt;&gt;&gt;&gt;&amp;0	ubyte&amp;15	3		model: MAC,
&gt;&gt;&gt;&gt;&amp;0	ubyte&amp;15	15		model: Generic,
&gt;&gt;&gt;&gt;&amp;3	ubeshort	x		%dx
&gt;&gt;&gt;&gt;&amp;5	ubeshort	x		\b%d,
&gt;&gt;&gt;&gt;&amp;1	ubeshort	4		colors: 16
&gt;&gt;&gt;&gt;&amp;1	ubeshort	8		colors: 256
&gt;&gt;&gt;&gt;&amp;1	ubeshort	12		colors: 4096
&gt;&gt;&gt;&gt;&amp;1	ubeshort	15		colors: 32768
&gt;&gt;&gt;&gt;&amp;1	ubeshort	16		colors: 65536
&gt;&gt;&gt;&gt;&amp;1	ubeshort	&gt;16		colors: %d-bit


#------------------------------------------------------------------------------
# $File: xdelta,v 1.5 2011/08/08 09:01:05 christos Exp $
# file(1) magic(5) data for xdelta  Josh MacDonald &lt;jmacd@CS.Berkeley.EDU&gt;
#
0	string	%XDELTA%	XDelta binary patch file 0.14
0	string	%XDZ000%	XDelta binary patch file 0.18
0	string	%XDZ001%	XDelta binary patch file 0.20
0	string	%XDZ002%	XDelta binary patch file 1.0
0	string	%XDZ003%	XDelta binary patch file 1.0.4
0	string	%XDZ004%	XDelta binary patch file 1.1

0	string \xD6\xC3\xC4\x00	VCDIFF binary diff

#------------------------------------------------------------------------------
# $File: xenix,v 1.11 2017/03/17 21:35:28 christos Exp $
# xenix:  file(1) magic for Microsoft Xenix
#
# &quot;Middle model&quot; stuff, and &quot;Xenix 8086 relocatable or 80286 small
# model&quot; lifted from &quot;magic.xenix&quot;, with comment &quot;derived empirically;
# treat as folklore until proven&quot;
#
# &quot;small model&quot;, &quot;large model&quot;, &quot;huge model&quot; stuff lifted from XXX
#
# XXX - &quot;x.out&quot; collides with PDP-11 archives
#
0	string		core		core file (Xenix)
# URL: http://www.polarhome.com/service/man/?qf=86rel&amp;tf=2&amp;of=Xenix
# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf
# Update: Joerg Jenderek
# recordtype~TranslatorHEADerRecord
0	byte		0x80
# GRR: line above is too general as it catches also Extensible storage engine DataBase
# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3
&gt;1	uleshort	&lt;1022
# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length
&gt;&gt;1	uleshort	&gt;0
# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length
&gt;&gt;&gt;3	ubyte		&gt;0
# skip examples like OMBRE.6 with &quot;UUUUUU&quot; by looking for filename like &quot;hello.c&quot;
&gt;&gt;&gt;&gt;4	regex	[a-zA-Z_/]{1,8}[.]	8086 relocatable (Microsoft)
#!:mime	application/octet-stream
!:mime	application/x-object
!:ext	o/a
&gt;&gt;&gt;&gt;&gt;3	pstring		x		\b, &quot;%s&quot;
# checksum
#&gt;&gt;&gt;&gt;&gt;(3.b+4)	ubyte	x		\b, checksum 0x%2.2x
0	leshort		0xff65		x.out
&gt;2	string		__.SYMDEF	 randomized
&gt;0	byte		x		archive
0	leshort		0x206		Microsoft a.out
&gt;8	leshort		1		Middle model
&gt;0x1e	leshort		&amp;0x10		overlay
&gt;0x1e	leshort		&amp;0x2		separate
&gt;0x1e	leshort		&amp;0x4		pure
&gt;0x1e	leshort		&amp;0x800		segmented
&gt;0x1e	leshort		&amp;0x400		standalone
&gt;0x1e	leshort		&amp;0x8		fixed-stack
&gt;0x1c	byte		&amp;0x80		byte-swapped
&gt;0x1c	byte		&amp;0x40		word-swapped
&gt;0x10	lelong		&gt;0		not-stripped
&gt;0x1e	leshort		^0xc000		pre-SysV
&gt;0x1e	leshort		&amp;0x4000		V2.3
&gt;0x1e	leshort		&amp;0x8000		V3.0
&gt;0x1c	byte		&amp;0x4		86
&gt;0x1c	byte		&amp;0xb		186
&gt;0x1c	byte		&amp;0x9		286
&gt;0x1c	byte		&amp;0xa		386
&gt;0x1f	byte		&lt;0x040		small model
&gt;0x1f	byte		=0x048		large model
&gt;0x1f	byte		=0x049		huge model
&gt;0x1e	leshort		&amp;0x1		executable
&gt;0x1e	leshort		^0x1		object file
&gt;0x1e	leshort		&amp;0x40		Large Text
&gt;0x1e	leshort		&amp;0x20		Large Data
&gt;0x1e	leshort		&amp;0x120		Huge Objects Enabled
&gt;0x10	lelong		&gt;0		not stripped

0	leshort		0x140		old Microsoft 8086 x.out
&gt;0x3	byte		&amp;0x4		separate
&gt;0x3	byte		&amp;0x2		pure
&gt;0	byte		&amp;0x1		executable
&gt;0	byte		^0x1		relocatable
&gt;0x14	lelong		&gt;0		not stripped

0	lelong		0x206		b.out
&gt;0x1e	leshort		&amp;0x10		overlay
&gt;0x1e	leshort		&amp;0x2		separate
&gt;0x1e	leshort		&amp;0x4		pure
&gt;0x1e	leshort		&amp;0x800		segmented
&gt;0x1e	leshort		&amp;0x400		standalone
&gt;0x1e	leshort		&amp;0x1		executable
&gt;0x1e	leshort		^0x1		object file
&gt;0x1e	leshort		&amp;0x4000		V2.3
&gt;0x1e	leshort		&amp;0x8000		V3.0
&gt;0x1c	byte		&amp;0x4		86
&gt;0x1c	byte		&amp;0xb		186
&gt;0x1c	byte		&amp;0x9		286
&gt;0x1c	byte		&amp;0x29		286
&gt;0x1c	byte		&amp;0xa		386
&gt;0x1e	leshort		&amp;0x4		Large Text
&gt;0x1e	leshort		&amp;0x2		Large Data
&gt;0x1e	leshort		&amp;0x102		Huge Objects Enabled

0	leshort		0x580		XENIX 8086 relocatable or 80286 small model

#------------------------------------------------------------------------------
# $File: xilinx,v 1.8 2017/03/17 21:35:28 christos Exp $
# This is Aaron&#039;s attempt at a MAGIC file for Xilinx .bit files.
# Xilinx-Magic@RevRagnarok.com
# Got the info from FPGA-FAQ 0026
#
# Rewritten to use pstring/H instead of hardcoded lengths by O. Freyermuth,
# fixes at least reading of bitfiles from Spartan 2, 3, 6.
# http://www.fpga-faq.com/FAQ_Pages/0026_Tell_me_about_bit_files.htm
#
# First there is the sync header and its length
0	beshort 0x0009
&gt;2 	belong	=0x0ff00ff0
&gt;&gt;&amp;0	belong  =0x0ff00ff0
&gt;&gt;&gt;&amp;0	byte    =0x00
&gt;&gt;&gt;&amp;1   beshort =0x0001
&gt;&gt;&gt;&amp;3	string	a	Xilinx BIT data
# Next is a Pascal-style string with the NCD name. We want to capture that.
&gt;&gt;&gt;&gt;&amp;0	   pstring/H	x	- from %s
# And then &#039;b&#039;
&gt;&gt;&gt;&gt;&gt;&amp;1    string b
# Then the model / part number:
&gt;&gt;&gt;&gt;&gt;&gt;&amp;0   pstring/H    x       - for %s
# Then &#039;c&#039;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1 string c
# Then the build-date
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0 pstring/H    x       - built %s
# Then &#039;d&#039;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1   string d
# Then the build-time
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0  pstring/H x        \b(%s)
# Then &#039;e&#039;
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;1  string e
# And length of data
&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&amp;0 belong x          - data length 0x%x

# Raw bitstream files
0      long    0xffffffff
&gt;&amp;0    belong  0xaa995566      Xilinx RAW bitstream (.BIN)

#------------------------------------------------------------------------------
# $File: xo65,v 1.4 2009/09/19 16:28:13 christos Exp $
# xo65 object files
# From: &quot;Ullrich von Bassewitz&quot; &lt;uz@cc65.org&gt;
#
0	string		\x55\x7A\x6E\x61	xo65 object,
&gt;4	leshort		x			version %d,
&gt;6	leshort&amp;0x0001 =0x0001			with debug info
&gt;6	leshort&amp;0x0001 =0x0000			no debug info

# xo65 library files
0	string		\x6E\x61\x55\x7A	xo65 library,
&gt;4	leshort		x			version %d

# o65 object files
0	string		\x01\x00\x6F\x36\x35	o65
&gt;6	leshort&amp;0x1000	=0x0000			executable,
&gt;6	leshort&amp;0x1000	=0x1000			object,
&gt;5	byte		x			version %d,
&gt;6	leshort&amp;0x8000	=0x8000			65816,
&gt;6	leshort&amp;0x8000	=0x0000			6502,
&gt;6	leshort&amp;0x2000	=0x2000			32 bit,
&gt;6	leshort&amp;0x2000	=0x0000			16 bit,
&gt;6	leshort&amp;0x4000	=0x4000			page reloc,
&gt;6	leshort&amp;0x4000	=0x0000			byte reloc,
&gt;6	leshort&amp;0x0003	=0x0000			alignment 1
&gt;6	leshort&amp;0x0003	=0x0001			alignment 2
&gt;6	leshort&amp;0x0003	=0x0002			alignment 4
&gt;6	leshort&amp;0x0003	=0x0003			alignment 256

#------------------------------------------------------------------------------
# $File: xwindows,v 1.10 2017/03/17 21:35:28 christos Exp $
# xwindows:  file(1) magic for various X/Window system file formats.

# Compiled X Keymap
# XKM (compiled X keymap) files (including version and byte ordering)
1	string	mkx				Compiled XKB Keymap: lsb,
&gt;0	byte	&gt;0				version %d
&gt;0	byte	=0				obsolete
0	string	xkm				Compiled XKB Keymap: msb,
&gt;3	byte	&gt;0				version %d
&gt;3	byte	=0				obsolete

# xfsdump archive
0	string	xFSdump0			xfsdump archive
&gt;8	belong	x	(version %d)

# Jaleo XFS files
0	long	395726				Jaleo XFS file
&gt;4	long	x				- version %d
&gt;8	long	x				- [%d -
&gt;20	long	x				\b%dx
&gt;24	long	x				\b%dx
&gt;28	long	1008				\bYUV422]
&gt;28	long	1000				\bRGB24]

# Xcursor data
# X11 mouse cursor format defined in libXcursor, see
# http://www.x.org/archive/X11R6.8.1/doc/Xcursor.3.html
# http://cgit.freedesktop.org/xorg/lib/libXcursor/tree/include/X11/Xcursor/Xcursor.h
0	string		Xcur		Xcursor data
!:mime	image/x-xcursor
&gt;10	leshort		x		version %d
&gt;&gt;8	leshort		x		\b.%d


#------------------------------------------------------------------------------
# $File: yara,v 1.2 2017/05/25 20:07:23 christos Exp $
# yara:  file(1) magic for http://virustotal.github.io/yara/
#

0	string	YARA
&gt;4	lelong	&gt;2047
&gt;8	byte	&lt;20	YARA 3.x compiled rule set
# version
&gt;&gt;8	clear	x
&gt;&gt;8	byte	6	created with version 3.3.0
&gt;&gt;8	byte	8	created with version 3.4.0
&gt;&gt;8	byte	11	created with version 3.5.0
&gt;&gt;8	default	x
&gt;&gt;&gt;8	byte	x	development version 0x%02x
#------------------------------------------------------------------------------
# zfs:	file(1) magic for ZFS dumps
#
# From &lt;rea-fbsd@codelabs.ru&gt;
# ZFS dump header has the following structure (as per zfs_ioctl.h
# in FreeBSD with drr_type is set to DRR_BEGIN)
#
#   enum {
#	DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
#	DRR_WRITE, DRR_FREE, DRR_END,
#   } drr_type;
#   uint32_t drr_pad;
#   uint64_t drr_magic;
#   uint64_t drr_version;
#   uint64_t drr_creation_time;
#   dmu_objset_type_t drr_type;
#   uint32_t drr_pad;
#   uint64_t drr_toguid;
#   uint64_t drr_fromguid;
#   char drr_toname[MAXNAMELEN];
#
# Backup magic is 0x00000002f5bacbac (quad word)
# The drr_type is defined as
#   typedef enum dmu_objset_type {
#	  DMU_OST_NONE,
#	  DMU_OST_META,
#	  DMU_OST_ZFS,
#	  DMU_OST_ZVOL,
#	  DMU_OST_OTHER,		  /* For testing only! */
#	  DMU_OST_ANY,			  /* Be careful! */
#	  DMU_OST_NUMTYPES
#  } dmu_objset_type_t;
#
# Almost all uint64_t fields are printed as the 32-bit ones (with high
# 32 bits zeroed), because there is no simple way to print them as the
# full 64-bit values.

# Big-endian values
8	string	\000\000\000\002\365\272\313\254 ZFS shapshot (big-endian machine),
&gt;20	belong	x	version %u,
&gt;32	belong	0	type: NONE,
&gt;32	belong	1	type: META,
&gt;32	belong	2	type: ZFS,
&gt;32	belong	3	type: ZVOL,
&gt;32	belong	4	type: OTHER,
&gt;32	belong	5	type: ANY,
&gt;32	belong	&gt;5	type: UNKNOWN (%u),
&gt;40	byte	x	destination GUID: %02X
&gt;41	byte	x	%02X
&gt;42	byte	x	%02X
&gt;43	byte	x	%02X
&gt;44	byte	x	%02X
&gt;45	byte	x	%02X
&gt;46	byte	x	%02X
&gt;47	byte	x	%02X,
&gt;48	ulong	&gt;0
&gt;&gt;52	ulong	&gt;0
&gt;&gt;&gt;48	byte	x	source GUID: %02X
&gt;&gt;&gt;49	byte	x	%02X
&gt;&gt;&gt;50	byte	x	%02X
&gt;&gt;&gt;51	byte	x	%02X
&gt;&gt;&gt;52	byte	x	%02X
&gt;&gt;&gt;53	byte	x	%02X
&gt;&gt;&gt;54	byte	x	%02X
&gt;&gt;&gt;55	byte	x	%02X,
&gt;56	string	&gt;\0	name: &#039;%s&#039;

# Little-endian values
8	string	\254\313\272\365\002\000\000\000	ZFS shapshot (little-endian machine),
&gt;16	lelong	x	version %u,
&gt;32	lelong	0	type: NONE,
&gt;32	lelong	1	type: META,
&gt;32	lelong	2	type: ZFS,
&gt;32	lelong	3	type: ZVOL,
&gt;32	lelong	4	type: OTHER,
&gt;32	lelong	5	type: ANY,
&gt;32	lelong	&gt;5	type: UNKNOWN (%u),
&gt;47	byte	x	destination GUID: %02X
&gt;46	byte	x	%02X
&gt;45	byte	x	%02X
&gt;44	byte	x	%02X
&gt;43	byte	x	%02X
&gt;42	byte	x	%02X
&gt;41	byte	x	%02X
&gt;40	byte	x	%02X,
&gt;48	ulong	&gt;0
&gt;&gt;52	ulong	&gt;0
&gt;&gt;&gt;55	byte	x	source GUID: %02X
&gt;&gt;&gt;54	byte	x	%02X
&gt;&gt;&gt;53	byte	x	%02X
&gt;&gt;&gt;52	byte	x	%02X
&gt;&gt;&gt;51	byte	x	%02X
&gt;&gt;&gt;50	byte	x	%02X
&gt;&gt;&gt;49	byte	x	%02X
&gt;&gt;&gt;48	byte	x	%02X,
&gt;56	string	&gt;\0	name: &#039;%s&#039;

#------------------------------------------------------------------------------
# $File: zilog,v 1.7 2009/09/19 16:28:13 christos Exp $
# zilog:  file(1) magic for Zilog Z8000.
#
# Was it big-endian or little-endian?  My Product Specification doesn&#039;t
# say.
#
0	long		0xe807		object file (z8000 a.out)
0	long		0xe808		pure object file (z8000 a.out)
0	long		0xe809		separate object file (z8000 a.out)
0	long		0xe805		overlay object file (z8000 a.out)
#------------------------------------------------------------------------------
# $File: zip,v 1.1 2017/11/03 23:36:17 christos Exp $
# zip:  file(1) magic for zip files; this is not use
# Note the version of magic in archive is currently stronger, this is
# just an example until negative offsets are supported better

# Zip Central Cirectory record
0	name		zipcd
&gt;0	string		PK\001\002
&gt;&gt;4	leshort		x		\b, made by
&gt;&gt;4	use		zipversion
&gt;&gt;6	leshort		x		\b, extract using at least
&gt;&gt;6	use		zipversion
&gt;&gt;12	ledate		x		\b, last modified %s
&gt;&gt;24	lelong		&gt;0		\b, uncompressed size %d
&gt;&gt;10	leshort		x		\b, method=
&gt;&gt;10	use		zipcompression

# Zip known compressions
0	name		zipcompression
&gt;0	leshort		0		\bstore
&gt;0	leshort		8		\bdeflate
&gt;0	leshort		9		\bdeflate64
&gt;0	leshort		12		\bbzip2
&gt;0	leshort		14		\blzma
&gt;0	leshort		94		\bMP3
&gt;0	leshort		95		\bxz
&gt;0	leshort		96		\bJpeg
&gt;0	leshort		97		\bWavPack
&gt;0	leshort		98		\bPPMd
&gt;0	leshort		99		\bAES Encrypted
&gt;0	default		x
&gt;&gt;0	leshort		x		\b[%#x]

# Zip known versions
0	name		zipversion
&gt;0	leshort		0x09		v0.9
&gt;0	leshort		0x0a		v1.0
&gt;0	leshort		0x0b		v1.1
&gt;0	leshort		0x14		v2.0
&gt;0	leshort		0x15		v2.1
&gt;0	leshort		0x19		v2.5
&gt;0	leshort		0x1b		v2.7
&gt;0	leshort		0x2d		v4.5
&gt;0	leshort		0x2e		v4.6
&gt;0	leshort		0x32		v5.0
&gt;0	leshort		0x33		v5.1
&gt;0	leshort		0x34		v5.2
&gt;0	leshort		0x3d		v6.1
&gt;0	leshort		0x3e		v6.2
&gt;0	leshort		0x3f		v6.3
&gt;0	default		x
&gt;&gt;0	leshort		x		v?[%#x]

# Zip End Of Central Directory record
-22	string		PK\005\006	Zip archive data
#&gt;4	leshort		&gt;1		\b, %d disks
#&gt;6	leshort		&gt;1		\b, central directory disk %d
#&gt;8	leshort		&gt;1		\b, %d central directories on this disk
#&gt;10	leshort		&gt;1		\b, %d central directories
#&gt;12	lelong		x		\b, %d central directory bytes
&gt;(16.l)	use		zipcd
&gt;20	pstring/l	&gt;0		\b, %s

#------------------------------------------------------------------------------
# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
# zyxel:  file(1) magic for ZyXEL modems
#
# From &lt;rob@pe1chl.ampr.org&gt;
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
# ZyXEL-defined standard)

0	string		ZyXEL\002	ZyXEL voice data
&gt;10	byte		0		- CELP encoding
&gt;10	byte&amp;0x0B	1		- ADPCM2 encoding
&gt;10	byte&amp;0x0B	2		- ADPCM3 encoding
&gt;10	byte&amp;0x0B	3		- ADPCM4 encoding
&gt;10	byte&amp;0x0B	8		- New ADPCM3 encoding
&gt;10	byte&amp;0x04	4		with resync
</textarea><br><br><input type='hidden' name='archivo_editar' value='/usr/share/file/magic'><input type='submit' value='[✓] SAVE' style='background:#00ff41; color:#0a0a0a; border:none; padding:10px 30px; font-family:monospace; cursor:pointer;'> <a href='?path=%2Fusr%2Fshare%2Ffile' style='color:#858585; text-decoration:none; padding:10px 30px; border:1px solid #858585;'>[✗] CANCEL</a></form></div><div style='color:#00ff41; font-family:monospace; text-align:center; padding:20px;'>[~] Kerym Chaeceran</div>