# Magic
#	$OpenBSD: Header,v 1.5 1997/04/03 17:39:38 kstailey Exp $

# Magic data for file(1) command.
# Machine-genererated from src/usr.bin/file/magdir/*; edit there only!
# Format is described in magic(files), where:
# files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID.
#------------------------------------------------------------------------------
# Localstuff:  file(1) magic for locally observed files
#
#	$OpenBSD: Localstuff,v 1.4 2004/06/03 03:14:19 tedu Exp $
# Add any locally observed files here.  Remember:
# text if readable, executable if runnable binary, data if unreadable.
#	$OpenBSD: OpenBSD,v 1.13 2007/02/27 21:07:10 miod Exp $

#------------------------------------------------------------------------------
# OpenBSD:  file(1) magic for OpenBSD objects
#
# All new-style magic numbers are in network byte order.
#

0	lelong			000000407	OpenBSD little-endian object file
>16	lelong			>0		not stripped
0	belong			000000407	OpenBSD big-endian object file
>16	belong			>0		not stripped

0	belong&0377777777	041400413	OpenBSD/i386 demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	041400410	OpenBSD/i386 pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	041400407	OpenBSD/i386
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	041400507	OpenBSD/i386 core
>12	string			>\0		from '%s'

0	belong&0377777777	041600413	OpenBSD/m68k demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	041600410	OpenBSD/m68k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	041600407	OpenBSD/m68k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	041600507	OpenBSD/m68k core
>12	string			>\0		from '%s'

0	belong&0377777777	046200413	OpenBSD/m88k demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	046200410	OpenBSD/m88k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	046200407	OpenBSD/m88k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	046200507	OpenBSD/m88k core
>12	string			>\0		from '%s'

0	belong&0377777777	042000413	OpenBSD/m68k4k demand paged
>0	byte			&0x80		
>>20	belong			<4096		shared library
>>20	belong			=4096		dynamically linked executable
>>20	belong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042000410	OpenBSD/m68k4k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042000407	OpenBSD/m68k4k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	042000507	OpenBSD/m68k4k core
>12	string			>\0		from '%s'

0	belong&0377777777	042200413	OpenBSD/ns32532 demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042200410	OpenBSD/ns32532 pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042200407	OpenBSD/ns32532
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	042200507	OpenBSD/ns32532 core
>12	string			>\0		from '%s'

0	belong&0377777777	042400413	OpenBSD/sparc demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042400410	OpenBSD/sparc pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042400407	OpenBSD/sparc
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	042400507	OpenBSD/sparc core
>12	string			>\0		from '%s'

0	belong&0377777777	042600413	OpenBSD/pmax demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042600410	OpenBSD/pmax pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042600407	OpenBSD/pmax
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	042600507	OpenBSD/pmax core
>12	string			>\0		from '%s'

0	belong&0377777777	043000413	OpenBSD/vax1k demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043000410	OpenBSD/vax1k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043000407	OpenBSD/vax1k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	043000507	OpenBSD/vax1k core
>12	string			>\0		from '%s'

0	belong&0377777777	045400413	OpenBSD/vax demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	045400410	OpenBSD/vax pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	045400407	OpenBSD/vax
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	045400507	OpenBSD/vax core
>12	string			>\0		from '%s'

# OpenBSD/alpha does not support (and has never supported) a.out objects,
# so no rules are provided for them.  OpenBSD/alpha ELF objects are 
# dealt with in "elf".
0	leshort		0x00070185		ECOFF OpenBSD/alpha binary
>10	leshort		0x0001			not stripped
>10	leshort		0x0000			stripped
0	belong&0377777777	043200507	OpenBSD/alpha core
>12	string			>\0		from '%s'

# OpenBSD/powerpc core files
0	belong&0377777777	045200507	OpenBSD/powerpc core
>12	string			>\0		from '%s'

# OpenBSD/sparc64 core files
0	belong&0377777777	045600507	OpenBSD/sparc64 core
>12	string			>\0		from '%s'

# OpenBSD/hppa core files
0	belong&0377777777	046400507	OpenBSD/hppa core
>12	string			>\0		from '%s'

# OpenBSD/mips64
0	belong&0377777777	047400413	OpenBSD/mips64 demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	047400410	OpenBSD/mips64 pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	047400407	OpenBSD/mips64
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	047400507	OpenBSD/mips64 core
>12	string			>\0		from '%s'

0	belong&0377777777	043600413	OpenBSD/arm demand paged
>0	byte			&0x80
>>20	lelong			<8192		shared library
>>20	lelong			=8192		dynamically linked executable
>>20	lelong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043600410	OpenBSD/arm pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043600407	OpenBSD/arm
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	043600507	OpenBSD/arm core
>12	string			>\0		from '%s'
0	belong&0377777777	047200507	OpenBSD/amd64 core
>12	string			>\0		from '%s'
0	belong&0377777777	044200507	OpenBSD/sh core
>12	string			>\0		from '%s'
#	$OpenBSD: 386bsd,v 1.2 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# 386bsd:  file(1) magic for 386BSD objects
#
0	lelong			000000413	386BSD demand paged executable
>16	lelong			>0		not stripped
#	$OpenBSD: acorn,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# acorn:  file(1) magic for files found on Acorn systems
#

# RISC OS Chunk File Format
# From RISC OS Programmer's Reference Manual, Appendix D
# We guess the file type from the type of the first chunk.
0	lelong		0xc3cbc6c5	RISC OS Chunk data
>12	string		OBJ_		\b, AOF object
>12	string		LIB_		\b, ALF library

# RISC OS AIF, contains "SWI OS_Exit" at offset 16.
16	lelong		0xef000011	RISC OS AIF executable

# RISC OS Draw files
# From RISC OS Programmer's Reference Manual, Appendix E
0	string 		Draw		RISC OS Draw file data

# RISC OS new format font files
# From RISC OS Programmer's Reference Manual, Appendix E
0	string		FONT\0		RISC OS outline font data,
>5	byte		x		version %d
0	string		FONT\1		RISC OS 1bpp font data,
>5	byte		x		version %d
0	string		FONT\4		RISC OS 4bpp font data
>5	byte		x		version %d

# RISC OS Music files
# From RISC OS Programmer's Reference Manual, Appendix E
0	string		Maestro\r	RISC OS music file
>8	byte		x		version %d

#	$OpenBSD: adi,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# adi: file(1) magic for ADi's objects
# From Gregory McGarry <g.mcgarry@ieee.org>
#
0	leshort		0x521c		COFF DSP21k
>18	lelong		&02		executable,
>18	lelong		^02
>>18	lelong		&01		static object,
>>18	lelong		^01		relocatable object,
>18	lelong		&010		stripped
>18	lelong		^010		not stripped
#	$OpenBSD: allegro,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# allegro:  file(1) magic for Allegro datafiles
# Toby Deshane <hac@shoelace.digivill.net>
#
0 belong 0x736C6821   Allegro datafile (packed)
0 belong 0x736C682E   Allegro datafile (not packed/autodetect)
0 belong 0x736C682B   Allegro datafile (appended exe data)
#	$OpenBSD: alliant,v 1.2 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# alliant:  file(1) magic for Alliant FX series a.out files
#
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".
# If it's the i860-based one, they should probably become either the
# big-endian or little-endian versions, depending on the mode they ran
# the 860 in....
#
0	short		0420		0420 Alliant virtual executable
>2	short		&0x0020		common library
>16	long		>0		not stripped
0	short		0421		0421 Alliant compact executable
>2	short		&0x0020		common library
>16	long		>0		not stripped
#	$OpenBSD: alpha,v 1.3 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# alpha architecture description
#

0	leshort		0603		COFF format alpha
>22	leshort&030000	!020000		executable
>24	leshort		0410		pure
>24	leshort		0413		paged
>22	leshort&020000	!0		dynamically linked
>16	lelong		!0		not stripped
>16	lelong		0		stripped
>22	leshort&030000	020000		shared library
>24	leshort		0407		object
>27	byte		x		- version %d
>26	byte		x		.%d
>28	byte		x		-%d

# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
#
0	string		Core\001	Alpha COFF format core dump (Digital UNIX)
>24	string		>\0		\b, from '%s'
#	$OpenBSD: amanda,v 1.4 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# amanda:  file(1) magic for amanda file format
#
0	string	AMANDA:\ 		AMANDA 
>8	string	TAPESTART\ DATE		tape header file,
>>23	string	X
>>>25	string	>\ 			Unused %s
>>23	string	>\ 			DATE %s
>8	string	FILE\ 			dump file,
>>13	string	>\ 			DATE %s
#	$OpenBSD: amigaos,v 1.4 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# amigaos:  file(1) magic for AmigaOS binary formats:

#
# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
# Some formats are still missing: AmigaOS special IFF's, e.g.: FORM....CTLG
# (the others should be separate, anyway)
#
0	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
0	belong		0x000003e7	AmigaOS object/library data
#
0	beshort		0xe310		Amiga Workbench
>2	beshort		1		
>>48	byte		1		disk icon
>>48	byte		2		drawer icon
>>48	byte		3		tool icon
>>48	byte		4		project icon
>>48	byte		5		garbage icon
>>48	byte		6		device icon
>>48	byte		7		kickstart icon
>>48	byte		8		workbench application icon
>2	beshort		>1		icon, vers. %d
#
# various sound formats from the Amiga
# G=F6tz Waschk <waschk@informatik.uni-rostock.de>
#
0	string		FC14		Future Composer 1.4 Module sound file
0	string		SMOD		Future Composer 1.3 Module sound file
0	string		AON4artofnoise	Art Of Noise Module sound file
1	string		MUGICIAN/SOFTEYES Mugician Module sound file
58	string		SIDMON\ II\ -\ THE	Sidmon 2.0 Module sound file
0	string		Synth4.0	Synthesis Module sound file
0	string		ARP.		The Holy Noise Module sound file
0	string		BeEp\0		JamCracker Module sound file
0	string		COSO\0		Hippel-COSO Module sound file
# Too simple (short, pure ASCII, deep), MPi
#26	string		V.3		Brian Postma's Soundmon Module sound file v3
#26	string		BPSM		Brian Postma's Soundmon Module sound file v3
#26	string		V.2		Brian Postma's Soundmon Module sound file v2

# The following are from: "Stefan A. Haubenthal" <polluks@web.de>
0	beshort		0x0f00		AmigaOS bitmap font
0	beshort		0x0f03		AmigaOS outline font
0	belong		0x80001001	AmigaOS outline tag
0	string		##\ version	catalog translation

0	string		FORM		IFF data
>8	string		CTLG		\b, CTLG message catalog
>8	string		PREF		\b, PREF preferences

0	string		Rar!		RAR archive data,
>44	byte		x		v%0x,
>35	byte		0		os: MS-DOS
>35	byte		1		os: OS/2
>35	byte		2		os: Win32
>35	byte		3		os: Unix

0	belong		0x000003fa	AmigaOS shared library

# Amiga disk types
# 
0	string		RDSK		Rigid Disk Block
>160	string		x		on %.24s
0	string		DOS\0		Amiga DOS disk
0	string		DOS\1		Amiga FFS disk
0	string		DOS\2		Amiga Inter DOS disk
0	string		DOS\3		Amiga Inter FFS disk
0	string		DOS\4		Amiga Fastdir DOS disk
0	string		DOS\5		Amiga Fastdir FFS disk
0	string		KICK		Kickstart disk
#	$OpenBSD: animation,v 1.3 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# animation:  file(1) magic for animation/movie formats
#
# animation formats
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)

# MPEG animation format
0	belong		0x000001b3		MPEG video stream data
#>4	beshort&0xfff0	x			(%d x
#>5	beshort&0x0fff  x			%d)
0	belong		0x000001ba		MPEG system stream data

# MPEG Audio (*.mpx)
# from dreesen@math.fu-berlin.de

# MPEG 1.0 Layer 3
0       beshort&0xfffe  =0xfffa         \bMP3
>2      byte&0xf0       =0x10           \b,  32 kBits
>2      byte&0xf0       =0x20           \b,  40 kBits
>2      byte&0xf0       =0x30           \b,  48 kBits
>2      byte&0xf0       =0x40           \b,  56 kBits
>2      byte&0xf0       =0x50           \b,  64 kBits
>2      byte&0xf0       =0x60           \b,  80 kBits
>2      byte&0xf0       =0x70           \b,  96 kBits
>2      byte&0xf0       =0x80           \b, 112 kBits
>2      byte&0xf0       =0x90           \b, 128 kBits
>2      byte&0xf0       =0xA0           \b, 160 kBits
>2      byte&0xf0       =0xB0           \b, 192 kBits
>2      byte&0xf0       =0xC0           \b, 224 kBits
>2      byte&0xf0       =0xD0           \b, 256 kBits
>2      byte&0xf0       =0xE0           \b, 320 kBits
# freq
>2      byte&0x0C       =0x00           \b, 44.1 kHz
>2      byte&0x0C       =0x04           \b, 48 kHz
>2      byte&0x0C       =0x08           \b, 32 kHz
# misc
>3      byte&0xC0       =0x00           \b, Stereo
>3      byte&0xC0       =0x40           \b, JStereo
>3      byte&0xC0       =0x80           \b, Dual-Ch
>3      byte&0xC0       =0xC0           \b, Mono
#>1     byte&0x01       =0x00           \b, Error Protection
#>2     byte&0x02       =0x02           \b, Padding
#>2     byte&0x01       =0x01           \b, Private
#>3     byte&0x08       =0x08           \b, Copyright
#>3     byte&0x04       =0x04           \b, Original
#>3     byte&0x03       1               \b, Emphasis 5
#>3     byte&0x03       3               \b, Emphasis c

# MPEG 1.0 Layer 2
0       beshort&0xfffe  =0xfffc         \bMP2
>2      byte&0xf0       =0x10           \b,  32 kBits
>2      byte&0xf0       =0x20           \b,  48 kBits
>2      byte&0xf0       =0x30           \b,  56 kBits
>2      byte&0xf0       =0x40           \b,  64 kBits
>2      byte&0xf0       =0x50           \b,  80 kBits
>2      byte&0xf0       =0x60           \b,  96 kBits
>2      byte&0xf0       =0x70           \b, 112 kBits
>2      byte&0xf0       =0x80           \b, 128 kBits
>2      byte&0xf0       =0x90           \b, 160 kBits
>2      byte&0xf0       =0xA0           \b, 192 kBits
>2      byte&0xf0       =0xB0           \b, 224 kBits
>2      byte&0xf0       =0xC0           \b, 256 kBits
>2      byte&0xf0       =0xD0           \b, 320 kBits
>2      byte&0xf0       =0xE0           \b, 384 kBits
# freq
>2      byte&0x0C       =0x00           \b, 44.1 kHz
>2      byte&0x0C       =0x04           \b, 48 kHz
>2      byte&0x0C       =0x08           \b, 32 kHz
# misc
>3      byte&0xC0       =0x00           \b, Stereo
>3      byte&0xC0       =0x40           \b, JStereo
>3      byte&0xC0       =0x80           \b, Dual-Ch
>3      byte&0xC0       =0xC0           \b, Mono
#>1     byte&0x01       =0x00           \b, Error Protection
#>2     byte&0x02       =0x02           \b, Padding
#>2     byte&0x01       =0x01           \b, Private
#>3     byte&0x08       =0x08           \b, Copyright
#>3     byte&0x04       =0x04           \b, Original
#>3     byte&0x03       1               \b, Emphasis 5
#>3     byte&0x03       3               \b, Emphasis c

# MPEG 2.0
0       beshort&0xfff8  =0xfff0         MP
# Layer 3
>1      byte            &0x02           \b3
# Layer 2
>1      byte            &0x04           \b2
>2      byte&0xf0       =0x10           \b,   8 kBits
>2      byte&0xf0       =0x20           \b,  16 kBits
>2      byte&0xf0       =0x30           \b,  24 kBits
>2      byte&0xf0       =0x40           \b,  32 kBits
>2      byte&0xf0       =0x50           \b,  40 kBits
>2      byte&0xf0       =0x60           \b,  48 kBits
>2      byte&0xf0       =0x70           \b,  56 kBits
>2      byte&0xf0       =0x80           \b,  64 kBits
>2      byte&0xf0       =0x90           \b,  80 kBits
>2      byte&0xf0       =0xA0           \b,  96 kBits
>2      byte&0xf0       =0xB0           \b, 112 kBits
>2      byte&0xf0       =0xC0           \b, 128 kBits
>2      byte&0xf0       =0xD0           \b, 144 kBits
>2      byte&0xf0       =0xE0           \b, 160 kBits
# freq
>2      byte&0x0C       =0x00           \b, 22.05 kHz
>2      byte&0x0C       =0x04           \b, 24 kHz
>2      byte&0x0C       =0x08           \b, 16 kHz
# misc
>3      byte&0xC0       =0x00           \b, Stereo
>3      byte&0xC0       =0x40           \b, JStereo
>3      byte&0xC0       =0x80           \b, Dual-Ch
>3      byte&0xC0       =0xC0           \b, Mono
#>1     byte&0x01       =0x00           \b, Error Protection
#>2     byte&0x02       =0x02           \b, Padding
#>2     byte&0x01       =0x01           \b, Private
#>3     byte&0x08       =0x08           \b, Copyright
#>3     byte&0x04       =0x04           \b, Original
#>3     byte&0x03       1               \b, Emphasis 5
#>3     byte&0x03       3               \b, Emphasis c

#From: Johan Gade <jgade@diku.dk>

# MPEG-4 Advanced Audio Coding (AAC) file (perhaps also MPEG-2 ACC?)
16	string		M4A		MPEG-4 Advanced Audio Coding file (AAC)


# FLI animation format
4	leshort		0xAF11			FLI file
>6	leshort		x			- %d frames,
>8	leshort		x			width=%d pixels,
>10	leshort		x			height=%d pixels,
>12	leshort		x			depth=%d,
>16	leshort		x			ticks/frame=%d
# FLC animation format
4	leshort		0xAF12			FLC file
>6	leshort		x			- %d frames
>8	leshort		x			width=%d pixels,
>10	leshort		x			height=%d pixels,
>12	leshort		x			depth=%d,
>16	leshort		x			ticks/frame=%d

# DL animation format
# XXX - collision with most `mips' magic
#
# I couldn't find a real magic number for these, however, this
# -appears- to work.  Note that it might catch other files, too, so be
# careful!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)!  The DL format is really bad.
#
#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
#>42	byte	x	- %d screens,
#>43	byte	x	%d commands
#0	byte	2	DL version 2
#>1	byte	1	- large format (320x200,1 image/screen),
#>1	byte	2	- medium format (160x100,4 images/screen),
#>1	byte	>2	- unknown format,
#>42	byte	x	%d screens,
#>43	byte	x	%d commands
# Based on empirical evidence, DL version 3 have several nulls following the
# \003.  Most of them start with non-null values at hex offset 0x34 or so.
#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3

# SGI formats
0	string		MOVI		Silicon Graphics movie file

# Apple Quicktime: Scan for all known top-level QT atom markers
4	string		moov		Apple QuickTime movie file (moov)
4	string		mdat		Apple QuickTime movie file (mdat)
4	string		ftyp		Apple QuickTime movie file (ftyp)
4	string		free		Apple QuickTime movie file (free)
4	string		junk		Apple QuickTime movie file (junk)
4	string		pnot		Apple QuickTime movie file (pnot)
4	string		skip		Apple QuickTime movie file (skip)
4	string		wide		Apple QuickTime movie file (wide)
4	string		pict		Apple QuickTime movie file (pict)

# iso 13818 transport stream
#
# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
# (the following is a little bit restrictive and works fine for a stream
#  that starts with PAT properly. it won't work for stream data, that is
#  cut from an input device data right in the middle, but this shouldn't
#  disturb)
# syncbyte      8 bit	0x47
# error_ind     1 bit	-
# payload_start 1 bit	1
# priority      1 bit	-
# PID          13 bit	0x0000
# scrambling    2 bit	-
# adaptfld_ctrl 2 bit	1 or 3
# conti_count   4 bit	0
0	belong&0xFF5FFF1F	0x47400010	MPEG transport stream data
>188	byte			!0x47		CORRUPTED

# DIF digital video file format <mpruett@sgi.com>
0	belong&0xffffff00	0x1f070000      DIF
>4	byte			&0x01		(DVCPRO) movie file
>4	byte			^0x01		(DV) movie file
>3	byte			&0x80		(PAL)
>3	byte			^0x80		(NTSC)

# Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
0	belong			0x3026b275	Microsoft ASF

# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
0	string			\x8aMNG		MNG video data,
>4	belong			!0x0d0a1a0a	CORRUPTED,
>4	belong			0x0d0a1a0a
>>16    belong	x				%ld x
>>20    belong	x				%ld

# JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
0	string			\x8bJNG		JNG video data,
>4	belong			!0x0d0a1a0a	CORRUPTED,
>4	belong			0x0d0a1a0a
>>16    belong	x				%ld x
>>20    belong	x				%ld

# Vivo video (Wolfram Kleff)
3	string		\x0D\x0AVersion:Vivo	Vivo video data

# VRML (Virtual Reality Modelling Language)
0       string/b        #VRML\ V1.0\ ascii	VRML 1 file
0	string/b	#VRML\ V2.0\ utf8	ISO/IEC 14772 VRML 97 file

#---------------------------------------------------------------------------
# HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
# From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
#
0	string		HVQM4		%s
>6	string		>\0		v%s
>0	byte		x		GameCube movie,
>0x34	ubeshort	x		%d x
>0x36	ubeshort	x		%d,
>0x26	ubeshort	x		%dµs,
>0x42	ubeshort	0		no audio
>0x42	ubeshort	>0		%dHz audio
#	$OpenBSD: apl,v 1.2 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
#       workspaces)
#
0	long		0100554		APL workspace (Ken's original?)
#	$OpenBSD: apple,v 1.4 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# apple:  file(1) magic for Apple file formats
#
0	string		FiLeStArTfIlEsTaRt	binscii (apple ][) text
0	string		\x0aGL			Binary II (apple ][) data
0	string		\x76\xff		Squeezed (apple ][) data
0	string		NuFile			NuFile archive (apple ][) data
0	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
0	belong		0x00051600		AppleSingle encoded Macintosh file
0	belong		0x00051607		AppleDouble encoded Macintosh file

# magic for Newton PDA package formats
# from Ruda Moura <ruda@helllabs.org>
0	string	package0	Newton package, NOS 1.x,
>12	belong	&0x80000000	AutoRemove,
>12	belong	&0x40000000	CopyProtect,
>12	belong	&0x10000000	NoCompression,
>12	belong	&0x04000000	Relocation,
>12	belong	&0x02000000	UseFasterCompression,
>16	belong	x		version %d

0	string	package1	Newton package, NOS 2.x,
>12	belong	&0x80000000	AutoRemove,
>12	belong	&0x40000000	CopyProtect,
>12	belong	&0x10000000	NoCompression,
>12	belong	&0x04000000	Relocation,
>12	belong	&0x02000000	UseFasterCompression,
>16	belong	x		version %d

0	string	package4	Newton package,
>8	byte	8		NOS 1.x,
>8	byte	9		NOS 2.x,
>12	belong	&0x80000000	AutoRemove,
>12	belong	&0x40000000	CopyProtect,
>12	belong	&0x10000000	NoCompression,

# The following entries for the Apple II are for files that have
# been transferred as raw binary data from an Apple, without having
# been encapsulated by any of the above archivers.
#
# In general, Apple II formats are hard to identify because Apple DOS
# and especially Apple ProDOS have strong typing in the file system and
# therefore programmers never felt much need to include type information
# in the files themselves.
#
# Eric Fischer <enf@pobox.com>

# AppleWorks word processor:
#
# This matches the standard tab stops for an AppleWorks file, but if
# a file has a tab stop set in the first four columns this will fail.
#
# The "O" is really the magic number, but that's so common that it's
# necessary to check the tab stops that follow it to avoid false positives.

4       string          O====   AppleWorks word processor data
>85     byte&0x01       >0      \b, zoomed
>90     byte&0x01       >0      \b, paginated
>92     byte&0x01       >0      \b, with mail merge
#>91    byte            x       \b, left margin %d

# AppleWorks database:
#
# This isn't really a magic number, but it's the closest thing to one
# that I could find.  The 1 and 2 really mean "order in which you defined
# categories" and "left to right, top to bottom," respectively; the D and R
# mean that the cursor should move either down or right when you press Return.

#30	string		\x01D	AppleWorks database data
#30	string		\x02D	AppleWorks database data
#30	string		\x01R	AppleWorks database data
#30	string		\x02R	AppleWorks database data

# AppleWorks spreadsheet:
#
# Likewise, this isn't really meant as a magic number.  The R or C means
# row- or column-order recalculation; the A or M means automatic or manual
# recalculation.

#131	string		RA	AppleWorks spreadsheet data
#131	string		RM	AppleWorks spreadsheet data
#131	string		CA	AppleWorks spreadsheet data
#131	string		CM	AppleWorks spreadsheet data

# Applesoft BASIC:
#
# This is incredibly sloppy, but will be true if the program was
# written at its usual memory location of 2048 and its first line
# number is less than 256.  Yuck.

0       belong&0xff00ff 0x80000 Applesoft BASIC program data
#>2     leshort         x       \b, first line number %d

# ORCA/EZ assembler:
# 
# This will not identify ORCA/M source files, since those have
# some sort of date code instead of the two zero bytes at 6 and 7
# XXX Conflicts with ELF
#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
#>5      byte                    x               \b, build number %d

# Broderbund Fantavision
#
# I don't know what these values really mean, but they seem to recur.
# Will they cause too many conflicts?

# Probably :-)
#2	belong&0xFF00FF		0x040008	Fantavision movie data

# Some attempts at images.
#
# These are actually just bit-for-bit dumps of the frame buffer, so
# there's really no reasonably way to distinguish them except for their
# address (if preserved) -- 8192 or 16384 -- and their length -- 8192
# or, occasionally, 8184.
#
# Nevertheless this will manage to catch a lot of images that happen
# to have a solid-colored line at the bottom of the screen.

8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background

# Beagle Bros. Apple Mechanic fonts

0	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font
#	$OpenBSD: applix,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# applix:  file(1) magic for Applixware
# From: Peter Soos <sp@osb.hu>
#
0	string		*BEGIN		Applixware
>7	string		WORDS			Words Document
>7	string		GRAPHICS		Graphic
>7	string		RASTER			Bitmap
>7	string		SPREADSHEETS		Spreadsheet
>7	string		MACRO			Macro
>7	string		BUILDER			Builder Object
#	$OpenBSD: archive,v 1.4 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# archive:  file(1) magic for archive formats (see also "msdos" for self-
#           extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are handled in the C code.

# POSIX tar archives
257	string		ustar\0		POSIX tar archive
257	string		ustar\040\040\0	GNU tar archive

# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0	short		070707		cpio archive
0	short		0143561		byte-swapped cpio archive
0	string		070707		ASCII cpio archive (pre-SVR4 or odc)
0	string		070701		ASCII cpio archive (SVR4 with no CRC)
0	string		070702		ASCII cpio archive (SVR4 with CRC)

# Debian package (needs to go before regular portable archives)
#
0	string		!<arch>\ndebian
>8	string		debian-split	part of multipart Debian package
>8	string		debian-binary	Debian binary package
>68	string		>\0		(format %s)
>81	string		bz2		\b, uses bzip2 compression
>84	string		gz		\b, uses gzip compression
#>136	ledate		x		created: %s

# other archives
0	long		0177555		very old archive
0	short		0177555		very old PDP-11 archive
0	long		0177545		old archive
0	short		0177545		old PDP-11 archive
0	long		0100554		apl workspace
0	string		=<ar>		archive

# MIPS archive (needs to go before regular portable archives)
#
0	string	!<arch>\n__________E	MIPS archive
>20	string	U			with MIPS Ucode members
>21	string	L			with MIPSEL members
>21	string	B			with MIPSEB members
>19	string	L			and an EL hash table
>19	string	B			and an EB hash table
>22	string	X			-- out of date

0	string		-h-		Software Tools format archive text

#
# XXX - why are there multiple <ar> thingies?  Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0	string		!<arch>		current ar archive
# 0	long		0x213c6172	archive file
#
# and for SVR1 archives, we have:
#
# 0	string		\<ar>		System V Release 1 ar archive
# 0	string		=<ar>		archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0	string		!<arch>		current ar archive
>8	string		__.SYMDEF	random library
>0	belong		=65538		- pre SR9.5
>0	belong		=65539		- post SR9.5
>0	beshort		2		- object archive
>0	beshort		3		- shared library module
>0	beshort		4		- debug break-pointed module
>0	beshort		5		- absolute code program module
0	string		\<ar>		System V Release 1 ar archive
0	string		=<ar>		archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
0	belong		0x65ff0000	VAX 3.0 archive
0	belong		0x3c61723e	VAX 5.0 archive
#
0	long		0x213c6172	archive file
0	lelong		0177555		very old VAX archive
0	leshort		0177555		very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0	lelong		0177545		old VAX archive
>8	string		__.SYMDEF	random library
0	leshort		0177545		old PDP-11 archive
>8	string		__.SYMDEF	random library
#
# From "pdp" (but why a 4-byte quantity?)
#
0	lelong		0x39bed		PDP-11 old archive
0	lelong		0x39bee		PDP-11 4.0 archive

# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated).  Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
0	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
0	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
0	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
0	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
0	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
0	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched

# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR:  the original entries collide with ARC, above; replaced with combined
#  version (not tested)]
#0	byte		0x1a		RISC OS archive
#>1	string		archive		(ArcFS format)
0	string		\032archive	RISC OS archive (ArcFS format)

# ARJ archiver (jason@jarthur.Claremont.EDU)
0	leshort		0xea60		ARJ archive data
>5	byte		x		\b, v%d,
>8	byte		&0x04		multi-volume,
>8	byte		&0x10		slash-switched,
>8	byte		&0x20		backup,
>34	string		x		original name: %s,
>7	byte		0		os: MS-DOS
>7	byte		1		os: PRIMOS
>7	byte		2		os: Unix
>7	byte		3		os: Amiga
>7	byte		4		os: Macintosh
>7	byte		5		os: OS/2
>7	byte		6		os: Apple ][ GS
>7	byte		7		os: Atari ST
>7	byte		8		os: NeXT
>7	byte		9		os: VAX/VMS
>3	byte		>0		%d]

# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0	string		HA		HA archive data,
#>2	leshort		=1		1 file,
#>2	leshort		>1		%u files,
#>4	byte&0x0f	=0		first is type CPY
#>4	byte&0x0f	=1		first is type ASC
#>4	byte&0x0f	=2		first is type HSC
#>4	byte&0x0f	=0x0e		first is type DIR
#>4	byte&0x0f	=0x0f		first is type SPECIAL

# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0	string		HPAK		HPACK archive data

# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0	string		\351,\001JAM\		JAM archive,
>7	string		>\0			version %.4s
>0x26	byte		=0x27			-
>>0x2b	string          >\0			label %.11s,
>>0x27	lelong		x			serial %08x,
>>0x36	string		>\0			fstype %.8s

# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2	string		-lh0-		LHarc 1.x archive data [lh0]
2	string		-lh1-		LHarc 1.x archive data [lh1]
2	string		-lz4-		LHarc 1.x archive data [lz4]
2	string		-lz5-		LHarc 1.x archive data [lz5]
#	[never seen any but the last; -lh4- reported in comp.compression:]
2	string		-lzs-		LHa 2.x? archive data [lzs]
2	string		-lh\40-		LHa 2.x? archive data [lh ]
2	string		-lhd-		LHa 2.x? archive data [lhd]
2	string		-lh2-		LHa 2.x? archive data [lh2]
2	string		-lh3-		LHa 2.x? archive data [lh3]
2	string		-lh4-		LHa (2.x) archive data [lh4]
2	string		-lh5-		LHa (2.x) archive data [lh5]
2	string		-lh6-		LHa (2.x) archive data [lh6]
2	string		-lh7-		LHa (2.x) archive data [lh7]
>20	byte		x		- header level %d

# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0	string		Rar!		RAR archive data

# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0	string		SQSH		squished archive data (Acorn RISCOS)

# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# I can't figure out the self-extracting form of these buggers...
0	string		UC2\x1a		UC2 archive data

# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0	string		PK\003\004	Zip archive data
>4	byte		0x09		\b, at least v0.9 to extract
>4	byte		0x0a		\b, at least v1.0 to extract
>4	byte		0x0b		\b, at least v1.1 to extract
>4	byte		0x14		\b, at least v2.0 to extract

# Zoo archiver
20	lelong		0xfdc4a7dc	Zoo archive data
>4	byte		>48		\b, v%c.
>>6	byte		>47		\b%c
>>>7	byte		>47		\b%c
>32	byte		>0		\b, modify: v%d
>>33	byte		x		\b.%d+
>42	lelong		0xfdc4a7dc	\b,
>>70	byte		>0		extract: v%d
>>>71	byte		x		\b.%d+

# Shell archives
10	string		#\ This\ is\ a\ shell\ archive	shell archive text

#
# LBR. NB: May conflict with the questionable 
#          "binary Computer Graphics Metafile" format.
#
0       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
#
# PMA (CP/M derivative of LHA)
#
2       string          -pm0-           PMarc archive data [pm0]
2       string          -pm1-           PMarc archive data [pm1]
2       string          -pm2-           PMarc archive data [pm2]
2       string          -pms-           PMarc SFX archive (CP/M, DOS)
5       string          -pc1-           PopCom compressed executable (CP/M)

# From Rafael Laboissiere <rafael@laboissiere.net>
# The Project Revision Control System (see
# http://prcs.sourceforge.net) generates a packaged project
# file which is recognized by the following entry: 
0	leshort		0xeb81	PRCS packaged project

# Microsoft cabinets 
# by David Necas (Yeti) <yeti@physics.muni.cz>
#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
#>25	byte	x		v%d
#>24	byte	x		\b.%d
# MPi: All CABs have version 1.3, so this is pointless.
# Better magic in debian-additions.

# GTKtalog catalogs 
# by David Necas (Yeti) <yeti@physics.muni.cz>
4	string	gtktalog\ 	GTKtalog catalog data,
>13	string	3		version 3
>>14	beshort	0x677a		(gzipped)
>>14	beshort	!0x677a		(not gzipped)
>13	string	>3		version %s

############################################################################
# Parity archive reconstruction file, the 'par' file format now used on Usenet.
0       string          PAR\0	PARity archive data
>48	leshort		=0	- Index file
>48	leshort		>0	- file number %d

# Felix von Leitner <felix-file@fefe.de>
0	string	d8:announce	BitTorrent file

# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
0       beshort 0x0e0f          Atari MSA archive data
>2      beshort x       	\b, %d sectors per track
>4      beshort 0       	\b, 1 sided
>4      beshort 1       	\b, 2 sided
>6      beshort x       	\b, starting track: %d
>8      beshort x       	\b, ending track: %d

# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
0	string	PK00PK\003\004	Zip archive data

# ACE archive (from http://www.wotsit.org/download.asp?f=ace)
# by Stefan `Sec` Zehl <sec@42.org>
7	string		**ACE**		ACE compressed archive
>15	byte	>0		version %d
>16	byte	=0x00		\b, from MS-DOS
>16	byte	=0x01		\b, from OS/2
>16	byte	=0x02		\b, from Win/32
>16	byte	=0x03		\b, from Unix
>16	byte	=0x04		\b, from MacOS
>16	byte	=0x05		\b, from WinNT
>16	byte	=0x06		\b, from Primos
>16	byte	=0x07		\b, from AppleGS
>16	byte	=0x08		\b, from Atari
>16	byte	=0x09		\b, from Vax/VMS
>16	byte	=0x0A		\b, from Amiga
>16	byte	=0x0B		\b, from Next
>14	byte	x		\b, version %d to extract
>5	leshort &0x0080		\b, multiple volumes,
>>17	byte	x		\b (part %d),
>5	leshort &0x0002		\b, contains comment
>5	leshort	&0x0200		\b, sfx
>5	leshort	&0x0400		\b, small dictionary
>5	leshort	&0x0800		\b, multi-volume
>5	leshort	&0x1000		\b, contains AV-String
>>30	string\x16*UNREGISTERED\x20VERSION*	(unregistered)
>5	leshort &0x2000		\b, with recovery record
>5	leshort &0x4000		\b, locked
>5	leshort &0x8000		\b, solid
# Date in MS-DOS format (whatever that is)
#>18	lelong	x		Created on
#	$OpenBSD: asterix,v 1.2 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
# strings as "long" - we assume they're just strings:
# From: guy@netapp.com (Guy Harris)
#
0	string		*STA		Aster*x
>7	string		WORD			Words Document
>7	string		GRAP			Graphic
>7	string		SPRE			Spreadsheet
>7	string		MACR			Macro
0	string		2278		Aster*x Version 2
>29	byte		0x36			Words Document
>29	byte		0x35			Graphic
>29	byte		0x32			Spreadsheet
>29	byte		0x38			Macro

#	$OpenBSD: att3b,v 1.2 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# att3b:  file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
# 3B20
#
# The 3B20 conflicts with SCCS.
#0	beshort		0550		3b20 COFF executable
#>12	belong		>0		not stripped
#>22	beshort		>0		- version %ld
#0	beshort		0551		3b20 COFF executable (TV)
#>12	belong		>0		not stripped
#>22	beshort		>0		- version %ld
#
# WE32K
#
0	beshort		0560		WE32000 COFF
>18	beshort		^00000020	object
>18	beshort		&00000020	executable
>12	belong		>0		not stripped
>18	beshort		^00010000	N/A on 3b2/300 w/paging
>18	beshort		&00020000	32100 required
>18	beshort		&00040000	and MAU hardware required
>20	beshort		0407		(impure)
>20	beshort		0410		(pure)
>20	beshort		0413		(demand paged)
>20	beshort		0443		(target shared library)
>22	beshort		>0		- version %ld
0	beshort		0561		WE32000 COFF executable (TV)
>12	belong		>0		not stripped
#>18	beshort		&00020000	- 32100 required
#>18	beshort		&00040000	and MAU hardware required
#>22	beshort		>0		- version %ld
#
# core file for 3b2 
0	string		\000\004\036\212\200	3b2 core file
>364	string		>\0		of '%s'
#	$OpenBSD: audio,v 1.9 2007/04/08 06:11:39 sturm Exp $

#------------------------------------------------------------------------------
# audio:  file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
# and others
#

# Sun/NeXT audio data
0	string		.snd		Sun/NeXT audio data:
>12	belong		1		8-bit ISDN u-law,
>12	belong		2		8-bit linear PCM [REF-PCM],
>12	belong		3		16-bit linear PCM,
>12	belong		4		24-bit linear PCM,
>12	belong		5		32-bit linear PCM,
>12	belong		6		32-bit IEEE floating point,
>12	belong		7		64-bit IEEE floating point,
>12	belong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>12	belong		24		compressed (8-bit G.722 ADPCM)
>12	belong		25		compressed (3-bit G.723 ADPCM),
>12	belong		26		compressed (5-bit G.723 ADPCM),
>12	belong		27		8-bit A-law,
>20	belong		1		mono,
>20	belong		2		stereo,
>20	belong		4		quad,
>16	belong		>0		%d Hz

# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
0	lelong		0x0064732E	DEC audio data:
>12	lelong		1		8-bit ISDN u-law,
>12	lelong		2		8-bit linear PCM [REF-PCM],
>12	lelong		3		16-bit linear PCM,
>12	lelong		4		24-bit linear PCM,
>12	lelong		5		32-bit linear PCM,
>12	lelong		6		32-bit IEEE floating point,
>12	lelong		7		64-bit IEEE floating point,
>12	lelong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>20	lelong		1		mono,
>20	lelong		2		stereo,
>20	lelong		4		quad,
>16	lelong		>0		%d Hz

# Creative Labs AUDIO stuff
0	string	MThd			Standard MIDI data
>9 	byte	>0			(format %d)
>11	byte	>1			using %d channels
0	string	CTMF			Creative Music (CMF) data
0	string	SBI			SoundBlaster instrument data
0	string	Creative\ Voice\ File	Creative Labs voice data
# is this next line right?  it came this way...
>19	byte	0x1A
>23	byte	>0			- version %d
>22	byte	>0			\b.%d

# first entry is also the string "NTRK"
0	belong		0x4e54524b	MultiTrack sound data
>4	belong		x		- version %ld

# Microsoft WAVE format (*.wav)
0	string		RIFF		Microsoft RIFF
>8	string		WAVE		\b, WAVE audio data
>>34	leshort		>0		\b, %d bit
>>22	leshort		=1		\b, mono
>>22	leshort		=2		\b, stereo
>>22	leshort		>2		\b, %d channels
>>24	lelong		>0		%d Hz
# AVI == Audio Video Interleave
>8	string		AVI\		\b, AVI data

# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
0	string		EMOD		Extended MOD sound data,
>4	byte&0xf0	x		version %d
>4	byte&0x0f	x		\b.%d,
>45	byte		x		%d instruments
>83	byte		0		(module)
>83	byte		1		(song)

# Real Audio (Magic .ra\0375)
0	belong		0x2e7261fd	realaudio sound file

# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
# Oct 31, 1995
#0	string		MTM		MultiTracker Module sound file
#0	string		if		Composer 669 Module sound data
#0	string		FAR		Module sound data
#0	string		MAS_U		ULT(imate) Module sound data
#0x2c	string		SCRM		ScreamTracker III Module sound data
#0	string		Extended Module	Extended Module sound data

#------------------------
# MPEG:  file(1) magic for MPEG audio.
#
# From <ckane@best.com>
# Show MPEG level, layer, kbit/s, hz, stereo/mono for an MPG audio file.
# This section is lengthy because the kbit/s rate depends on the
# level and layer, and file(1) doesn't allow math on the values.
#

####### MPEG begins with three hex 'f' nibbles.
0	beshort&0xfff0	0xfff0		MPEG
####### Level 2
>1	byte&0x08	0x00		2.0
>>1	byte&0x06	0x00		Layer Unknown,
####### Level 2, Layers I, II, and III
>>1	byte&0x06	0x02		Layer III,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		8 kbit/s,
>>>2	byte&0xf0	0x20		16 kbit/s,
>>>2	byte&0xf0	0x30		24 kbit/s,
>>>2	byte&0xf0	0x40		32 kbit/s,
>>>2	byte&0xf0	0x50		40 kbit/s,
>>>2	byte&0xf0	0x60		48 kbit/s,
>>>2	byte&0xf0	0x70		56 kbit/s,
>>>2	byte&0xf0	0x80		64 kbit/s,
>>>2	byte&0xf0	0x90		80 kbit/s,
>>>2	byte&0xf0	0xa0		96 kbit/s,
>>>2	byte&0xf0	0xb0		112 kbit/s,
>>>2	byte&0xf0	0xc0		128 kbit/s,
>>>2	byte&0xf0	0xd0		144 kbit/s,
>>>2	byte&0xf0	0xe0		160 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
>>1	byte&0x06	0x04		Layer II,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		8 kbit/s,
>>>2	byte&0xf0	0x20		16 kbit/s,
>>>2	byte&0xf0	0x30		24 kbit/s,
>>>2	byte&0xf0	0x40		32 kbit/s,
>>>2	byte&0xf0	0x50		40 kbit/s,
>>>2	byte&0xf0	0x60		48 kbit/s,
>>>2	byte&0xf0	0x70		56 kbit/s,
>>>2	byte&0xf0	0x80		64 kbit/s,
>>>2	byte&0xf0	0x90		80 kbit/s,
>>>2	byte&0xf0	0xa0		96 kbit/s,
>>>2	byte&0xf0	0xb0		112 kbit/s,
>>>2	byte&0xf0	0xc0		128 kbit/s,
>>>2	byte&0xf0	0xd0		144 kbit/s,
>>>2	byte&0xf0	0xe0		160 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
>>1	byte&0x06	0x06		Layer I,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		32 kbit/s,
>>>2	byte&0xf0	0x20		48 kbit/s,
>>>2	byte&0xf0	0x30		56 kbit/s,
>>>2	byte&0xf0	0x40		64 kbit/s,
>>>2	byte&0xf0	0x50		80 kbit/s,
>>>2	byte&0xf0	0x60		96 kbit/s,
>>>2	byte&0xf0	0x70		112 kbit/s,
>>>2	byte&0xf0	0x80		128 kbit/s,
>>>2	byte&0xf0	0x90		144 kbit/s,
>>>2	byte&0xf0	0xa0		160 kbit/s,
>>>2	byte&0xf0	0xb0		176 kbit/s,
>>>2	byte&0xf0	0xc0		192 kbit/s,
>>>2	byte&0xf0	0xd0		224 kbit/s,
>>>2	byte&0xf0	0xe0		256 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
####### Level 2, Hz
>>2	byte&0x0c	0x00		22050 Hz
>>2	byte&0x0c	0x04		24000 Hz
>>2	byte&0x0c	0x08		16000 Hz
>>2	byte&0x0c	0x0c		? Hz
####### Level 1 decoding
>1	byte&0x08	0x08		1.0
>>1	byte&0x06	0x00		Layer Unknown.
####### Level 1, Layers I, II, and III
>>1	byte&0x06	0x02		Layer III,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		32 kbit/s,
>>>2	byte&0xf0	0x20		40 kbit/s,
>>>2	byte&0xf0	0x30		48 kbit/s,
>>>2	byte&0xf0	0x40		56 kbit/s,
>>>2	byte&0xf0	0x50		64 kbit/s,
>>>2	byte&0xf0	0x60		80 kbit/s,
>>>2	byte&0xf0	0x70		96 kbit/s,
>>>2	byte&0xf0	0x80		112 kbit/s,
>>>2	byte&0xf0	0x90		128 kbit/s,
>>>2	byte&0xf0	0xa0		160 kbit/s,
>>>2	byte&0xf0	0xb0		192 kbit/s,
>>>2	byte&0xf0	0xc0		224 kbit/s,
>>>2	byte&0xf0	0xd0		256 kbit/s,
>>>2	byte&0xf0	0xe0		320 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
>>1	byte&0x06	0x04		Layer II,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		32 kbit/s,
>>>2	byte&0xf0	0x20		48 kbit/s,
>>>2	byte&0xf0	0x30		56 kbit/s,
>>>2	byte&0xf0	0x40		64 kbit/s,
>>>2	byte&0xf0	0x50		80 kbit/s,
>>>2	byte&0xf0	0x60		96 kbit/s,
>>>2	byte&0xf0	0x70		112 kbit/s,
>>>2	byte&0xf0	0x80		128 kbit/s,
>>>2	byte&0xf0	0x90		160 kbit/s,
>>>2	byte&0xf0	0xa0		192 kbit/s,
>>>2	byte&0xf0	0xb0		224 kbit/s,
>>>2	byte&0xf0	0xc0		256 kbit/s,
>>>2	byte&0xf0	0xd0		320 kbit/s,
>>>2	byte&0xf0	0xe0		384 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
>>1	byte&0x06	0x06		Layer I,
>>>2	byte&0xf0	0x00		0 kbit/s,
>>>2	byte&0xf0	0x10		32 kbit/s,
>>>2	byte&0xf0	0x20		64 kbit/s,
>>>2	byte&0xf0	0x30		96 kbit/s,
>>>2	byte&0xf0	0x40		128 kbit/s,
>>>2	byte&0xf0	0x50		160 kbit/s,
>>>2	byte&0xf0	0x60		192 kbit/s,
>>>2	byte&0xf0	0x70		224 kbit/s,
>>>2	byte&0xf0	0x80		256 kbit/s,
>>>2	byte&0xf0	0x90		288 kbit/s,
>>>2	byte&0xf0	0xa0		320 kbit/s,
>>>2	byte&0xf0	0xb0		352 kbit/s,
>>>2	byte&0xf0	0xc0		384 kbit/s,
>>>2	byte&0xf0	0xd0		416 kbit/s,
>>>2	byte&0xf0	0xe0		448 kbit/s,
>>>2	byte&0xf0	0xf0		? kbit/s,
####### Level 2, Hz
>>2	byte&0x0c	0x00		44100 Hz
>>2	byte&0x0c	0x04		48000 Hz
>>2	byte&0x0c	0x08		32000 Hz
>>2	byte&0x0c	0x0c		? Hz
####### Stereo or Mono
>3	byte&0xc0	0x00		stereo
>3	byte&0xc0	0x40		joint-stereo
>3	byte&0xc0	0x80		dual-channel
>3	byte&0xc0	0xc0		mono

# Free lossless audio codec <http://flac.sourceforge.net>
# From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
0	string			fLaC		FLAC audio bitstream data
>4	byte&0x7f		>0		\b, unknown version
>4	byte&0x7f		0		\b
# some common bits/sample values
>>20	beshort&0x1f0		0x030		\b, 4 bit
>>20	beshort&0x1f0		0x050		\b, 6 bit
>>20	beshort&0x1f0		0x070		\b, 8 bit
>>20	beshort&0x1f0		0x0b0		\b, 12 bit
>>20	beshort&0x1f0		0x0f0		\b, 16 bit
>>20	beshort&0x1f0		0x170		\b, 24 bit
>>20	byte&0xe		0x0		\b, mono
>>20	byte&0xe		0x2		\b, stereo
>>20	byte&0xe		0x4		\b, 3 channels
>>20	byte&0xe		0x6		\b, 4 channels
>>20	byte&0xe		0x8		\b, 5 channels
>>20	byte&0xe		0xa		\b, 6 channels
>>20	byte&0xe		0xc		\b, 7 channels
>>20	byte&0xe		0xe		\b, 8 channels
# some common sample rates
>>17	belong&0xfffff0		0x0ac440	\b, 44.1 kHz
>>17	belong&0xfffff0		0x0bb800	\b, 48 kHz
>>17	belong&0xfffff0		0x07d000	\b, 32 kHz
>>17	belong&0xfffff0		0x056220	\b, 22.05 kHz
>>17	belong&0xfffff0		0x05dc00	\b, 24 kHz
>>17	belong&0xfffff0		0x03e800	\b, 16 kHz
>>17	belong&0xfffff0		0x02b110	\b, 11.025 kHz
>>17	belong&0xfffff0		0x02ee00	\b, 12 kHz
>>17	belong&0xfffff0		0x01f400	\b, 8 kHz
>>17	belong&0xfffff0		0x177000	\b, 96 kHz
>>17	belong&0xfffff0		0x0fa000	\b, 64 kHz
>>21	byte&0xf		>0		\b, >4G samples
>>21	byte&0xf		0		\b
>>>22	belong			>0		\b, %u samples
>>>22	belong			0		\b, length unknown

# ID3 version 2 tags <waschk@informatik.uni-rostock.de>
0       string                  ID3             MP3 file with ID3 version 2.
>3      ubyte                   <0xff           \b%d.
>4      ubyte                   <0xff           \b%d tag
#	$OpenBSD: bFLT,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# bFLT: file(1) magic for BFLT uclinux binary files
#
# From Philippe De Muyter <phdm@macqel.be>
#
0	string		bFLT		BFLT executable
>4	belong		x		- version %ld
>4	belong		4
>>36	belong&0x1	0x1		ram
>>36	belong&0x2	0x2		gotpic
>>36	belong&0x4	0x4		gzip
>>36	belong&0x8	0x8		gzdata
#	$OpenBSD: blender,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# blender: file(1) magic for Blender 3D data files
#
# Coded by Guillermo S. Romero <gsromero@alumnos.euitt.upm.es> using the
# data from Ton Roosendaal <ton@blender.nl>. Ton or his company do not
# support the rule, so mail GSR if problems with it. Rule version: 1.1.
# You can get latest version with comments and details about the format
# at http://acd.asoc.euitt.upm.es/~gsromero/3d/blender/magic.blender

0	string	=BLENDER	Blender3D,
>7	string	=_		saved as 32-bits
>7      string	=-		saved as 64-bits
>8	string	=v		little endian
>8	string	=V		big endian
>9	byte	x		with version %c.
>10	byte	x		\b%c
>11	byte	x		\b%c
#	$OpenBSD: blit,v 1.2 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on
# little-endian machines as well?  If so, what's the deal with
# "VAX-order" and "VAX-order2"?
#
#0	long		0407		68K Blit (standalone) executable
#0	short		0407		VAX-order2 68K Blit (standalone) executable
0	short		03401		VAX-order 68K Blit (standalone) executable
0	long		0406		68k Blit mpx/mux executable
0	short		0406		VAX-order2 68k Blit mpx/mux executable
0	short		03001		VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0	short		0520		tty630 layers executable
#	$OpenBSD: bout,v 1.2 2004/06/03 03:14:19 tedu Exp $

#
# i80960 b.out objects and archives
#
0	long		0x10d		i960 b.out relocatable object
>16	long		>0		not stripped
#
# b.out archive (hp-rt on i960)
0	string		!<bout>		b.out archive
>8	string		__.SYMDEF	random library
#	$OpenBSD: bsdi,v 1.2 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
#

0	lelong		0314		386 compact demand paged pure executable
>16	lelong		>0		not stripped
>32	byte		0x6a		(uses shared libs)

0	lelong		0407		386 executable
>16	lelong		>0		not stripped
>32	byte		0x6a		(uses shared libs)

0	lelong		0410		386 pure executable
>16	lelong		>0		not stripped
>32	byte		0x6a		(uses shared libs)

0	lelong		0413		386 demand paged pure executable
>16	lelong		>0		not stripped
>32	byte		0x6a		(uses shared libs)

# same as in SunOS 4.x, except for static shared libraries
0	belong&077777777	0600413		sparc demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
>36	belong		0xb4100001	(uses shared libs)

0	belong&077777777	0600410		sparc pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
>36	belong		0xb4100001	(uses shared libs)

0	belong&077777777	0600407		sparc
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
>36	belong		0xb4100001	(uses shared libs)
#	$OpenBSD: c-lang,v 1.3 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# c-lang:  file(1) magic for C programs (or REXX)
#

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# if you uncomment "/*" for C/REXX below, also uncomment this entry
#0	string		/*\ XPM\ */	X pixmap image data

# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
#0	string		/*		C or REXX program text
#0	string		//		C++ program text

# From: Mikhail Teterin <mi@aldan.algebra.com> 
0	string		cscope		cscope reference data
>7	string		x		version %.2s
# We skip the path here, because it is often long (so file will
# truncate it) and mostly redundant.
# The inverted index functionality was added some time betwen
# versions 11 and 15, so look for -q if version is above 14:
>7	string		>14
>>10	regex		.+\ -q\		with inverted index
>10	regex		.+\ -c\		text (non-compressed)
#	$OpenBSD: c64,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# c64:  file(1) magic for various commodore 64 related files
#
# From <doj@cubic.org>

0x16500	belong		0x12014100	D64 Image
0x16500	belong		0x12014180	D71 Image
0x61800 belong		0x28034400	D81 Image
0	string		C64\40CARTRIDGE	CCS C64 Emultar Cartridge Image
0	belong		0x43154164	X64 Image

0	string		GCR-1541	GCR Image
>8	byte		x		version: $i
>9	byte		x		tracks: %i

9	string		PSUR		ARC archive (c64)
2	string		-LH1-		LHA archive (c64)

0	string		C64File		PC64 Emulator file
>8	string		>\0		"%s"
0	string		C64Image	PC64 Freezer Image

0	beshort		0x38CD		C64 PCLink Image
0	string		CBM\144\0\0	Power 64 C64 Emulator Snapshot

0	belong		0xFF424CFF	WRAptor packer (c64)
#	$OpenBSD: cad,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# autocad:  file(1) magic for cad files
#

# AutoCAD DWG versions R13/R14 (www.autodesk.com)
# Written December 01, 2003 by Lester Hightower
# Based on the DWG File Format Specifications at http://www.opendwg.org/
0	string	       \101\103\061\060\061		   AutoCAD
>5	string	       \062\000\000\000\000		   DWG ver. R13
>5	string	       \064\000\000\000\000		   DWG ver. R14

# Microstation DGN/CIT Files (www.bentley.com)
# Written October 30, 2003 by Lester Hightower
# DGN is the default file extension of Microstation/Intergraph CAD files.
# CIT is the proprietary raster format (similar to TIFF) used to attach
# raster underlays to Microstation DGN (vector) drawings.
# 
# http://www.wotsit.org/search.asp
# http://filext.com/detaillist.php?extdetail=DGN
# http://filext.com/detaillist.php?extdetail=CIT
#
# http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
# 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
# http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
# 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
0	string	       \010\011\376			   Microstation
>3	string	       \002
>>30	string	       \372\104				   DGN File
>>30	string	       \172\104				   DGN File
>>30	string	       \026\105				   DGN File
>4	string	       \030\000\000			   CIT File

# AutoCad, from Nahuel Greco
0	string AC1012	AutoCad (release 12)
0	string AC1014	AutoCad (release 14)
#	$OpenBSD: cddb,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# CDDB: file(1) magic for CDDB(tm) format CD text data files
#
# From <steve@gracenote.com>
#
# This is the /etc/magic entry to decode datafiles as used by
# CDDB-enabled CD player applications.
#

0       string/b        #\040xmcd               CDDB(tm) format CD text data
#	$OpenBSD: chi,v 1.2 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# chi:  file(1) magic for ChiWriter files
#
0       string          \\1cw\          ChiWriter file
>5      string          >\0             version %s
0       string          \\1cw           ChiWriter file
#	$OpenBSD: chord,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# chord: file(1) magic for Chord music sheet typesetting utility input files
#
# From Philippe De Muyter <phdm@macqel.be>
# File format is actually free, but many distributed files begin with `{title'
#
0	string		{title		Chord text file

#	$OpenBSD: cisco,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# cisco:  file(1) magic for cisco Systems routers
#
# Most cisco file-formats are covered by the generic elf code
#
# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
0	belong&0xffffff00	0x85011400  cisco IOS microcode
>7	string		>\0		    for '%s'
0	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
>7	string		>\0		    for '%s'
#	$OpenBSD: citrus,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# citrus locale declaration
#

0	string		RuneCT		Citrus locale declaration for LC_CTYPE

#	$OpenBSD: clipper,v 1.2 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
# >18	short		!074000,000000	C1 R1 
# >18	short		!074000,004000	C2 R1
# >18	short		!074000,010000	C3 R1
# >18	short		!074000,074000	TEST
#
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# >18	short&074000	000000		C1 R1 
# >18	short&074000	004000		C2 R1
# >18	short&074000	010000		C3 R1
# >18	short&074000	074000		TEST
#
# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
# sort, nor does SunOS 4.x, so either it's something Intergraph added
# in CLIX, or something AT&T added in SVR3.2 or later, or something
# somebody else thought was a good idea; it's not documented in the
# man page for this version of "magic", nor does it appear to be
# implemented (at least not after I blew off the bogus code to turn
# old-style "&"s into new-style "&"s, which just didn't work at all).
#
0	short		0575		CLIPPER COFF executable (VAX #)
>20	short		0407		(impure)
>20	short		0410		(5.2 compatible)
>20	short		0411		(pure)
>20	short		0413		(demand paged)
>20	short		0443		(target shared library)
>12	long		>0		not stripped
>22	short		>0		- version %ld
0	short		0577		CLIPPER COFF executable
>18	short&074000	000000		C1 R1 
>18	short&074000	004000		C2 R1
>18	short&074000	010000		C3 R1
>18	short&074000	074000		TEST
>20	short		0407		(impure)
>20	short		0410		(pure)
>20	short		0411		(separate I&D)
>20	short		0413		(paged)
>20	short		0443		(target shared library)
>12	long		>0		not stripped
>22	short		>0		- version %ld
>48	long&01		01		alignment trap enabled
>52	byte		1		-Ctnc
>52	byte		2		-Ctsw
>52	byte		3		-Ctpw
>52	byte		4		-Ctcb
>53	byte		1		-Cdnc
>53	byte		2		-Cdsw
>53	byte		3		-Cdpw
>53	byte		4		-Cdcb
>54	byte		1		-Csnc
>54	byte		2		-Cssw
>54	byte		3		-Cspw
>54	byte		4		-Cscb
4	string		pipe		CLIPPER instruction trace
4	string		prof		CLIPPER instruction profile
#	$OpenBSD: commands,v 1.3 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# commands:  file(1) magic for various shells and interpreters
#
0	string		:\ shell archive or commands for antique kernel text
0	string		#!/bin/sh		Bourne shell script text
0	string		#!\ /bin/sh		Bourne shell script text
0	string		#!/bin/csh		C shell script text
0	string		#!\ /bin/csh		C shell script text
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0	string		#!/bin/ksh		Korn shell script text
0	string		#!\ /bin/ksh		Korn shell script text
0	string	 	#!/bin/tcsh		Tenex C shell script text
0	string	 	#!\ /bin/tcsh		Tenex C shell script text
0	string		#!/usr/local/tcsh	Tenex C shell script text
0	string	 	#!\ /usr/local/tcsh	Tenex C shell script text
0	string		#!/usr/local/bin/tcsh	Tenex C shell script text
0	string		#!\ /usr/local/bin/tcsh	Tenex C shell script text
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0	string		#!/usr/local/bin/zsh	Paul Falstad's zsh
0	string		#!\ /usr/local/bin/zsh	Paul Falstad's zsh
0	string		#!/usr/local/bin/ash	Neil Brown's ash
0	string		#!\ /usr/local/bin/ash	Neil Brown's ash
0	string		#!/usr/local/bin/ae	Neil Brown's ae
0	string		#!\ /usr/local/bin/ae	Neil Brown's ae
0	string		#!/bin/nawk		new awk script text
0	string		#!\ /bin/nawk		new awk script text
0	string		#!/usr/bin/nawk		new awk script text
0	string		#!\ /usr/bin/nawk	new awk script text
0	string		#!/usr/local/bin/nawk	new awk script text
0	string		#!\ /usr/local/bin/nawk	new awk script text
0	string		#!/bin/gawk		GNU awk script text
0	string		#!\ /bin/gawk		GNU awk script text
0	string		#!/usr/bin/gawk		GNU awk script text
0	string		#!\ /usr/bin/gawk	GNU awk script text
0	string		#!/usr/local/bin/gawk	GNU awk script text
0	string		#!\ /usr/local/bin/gawk	GNU awk script text
#
0	string		#!/bin/awk		awk commands text
0	string		#!\ /bin/awk		awk commands text
0	string		#!/usr/bin/awk		awk commands text
0	string		#!\ /usr/bin/awk	awk commands text
0	string		BEGIN			awk commands text

# For Larry Wall's perl language.  The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
#				Keith Waclena <keith@cerberus.uchicago.edu>
0	string		#!/bin/perl			perl commands text
0	string		#!\ /bin/perl			perl commands text
0	string		eval\ "exec\ /bin/perl		perl commands text
0	string		#!/usr/bin/perl			perl commands text
0	string		#!\ /usr/bin/perl		perl commands text
0	string		eval\ "exec\ /usr/bin/perl	perl commands text
0	string		#!/usr/local/bin/perl		perl commands text
0	string		#!\ /usr/local/bin/perl		perl commands text
0	string		eval\ "exec\ /usr/local/bin/perl	perl commands text

# AT&T Bell Labs' Plan 9 shell
0	string		#!/bin/rc	Plan 9 rc shell script text
0	string		#!\ /bin/rc	Plan 9 rc shell script text

# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0	string		#!/bin/bash	Bourne-Again shell script text
0	string		#!\ /bin/bash	Bourne-Again shell script text
0	string		#!/usr/local/bin/bash	Bourne-Again shell script text
0	string		#!\ /usr/local/bin/bash	Bourne-Again shell script text

# generic shell magic
0	string		#!\ /			a
>3	string		>\0			%s script text
0	string		#!/			a
>2	string		>\0			%s script text
0	string		#!\ 			commands text
>3	string		>\0			for %s
#	$OpenBSD: compress,v 1.4 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# compress:  file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.

# standard unix compress
0	string		\037\235	compress'd data
>2	byte&0x80	>0		block compressed
>2	byte&0x1f	x		%d bits

# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
#   Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
#	* Original filename is only at offset 10 if "extra field" absent
#	* Produce shorter output - notably, only report compression methods
#	  other than 8 ("deflate", the only method defined in RFC 1952).
0       string          \037\213        gzip compressed data
>2	byte		<8		\b, reserved method
>2	byte		>8		\b, unknown method
>3	byte		&0x01		\b, ASCII
>3	byte		&0x02		\b, continuation
>3	byte		&0x04		\b, extra field
>3	byte&0xC	=0x08
>>10	string		x		\b, was "%s"
>9	byte		=0x00		\b, from MS-DOS
>9	byte		=0x01		\b, from Amiga
>9	byte		=0x02		\b, from VMS
>9	byte		=0x03		\b, from Unix
>9	byte		=0x05		\b, from Atari
>9	byte		=0x06		\b, from OS/2
>9	byte		=0x07		\b, from MacOS
>9	byte		=0x0A		\b, from Tops/20
>9	byte		=0x0B		\b, from Win/32
>3	byte		&0x10		\b, comment
>3	byte		&0x20		\b, encrypted
### >4	ledate		x		last modified: %s,
>8	byte		2		\b, max compression
>8	byte		4		\b, max speed

# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0	string		\037\036	packed data
>2	belong		>1		\b, %d characters originally
>2	belong		=1		\b, %d character originally
#
# This magic number is byte-order-independent.
0	short		0x1f1f		old packed data

# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0	short		0x1fff		compacted data
# This string is valid for SunOS (BE) and a matching "short" is listed
# in the Ultrix (LE) magic file.
0	string		\377\037	compacted data
0	short		0145405		huf output

# bzip2
0	string		BZh		bzip2 compressed data
>3	byte		>47		\b, block size = %c00k

# squeeze and crunch
# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
0	beshort		0x76FF		squeezed data,
>4	string		x		original name %s
0	beshort		0x76FE		crunched data,
>2	string		x		original name %s
0	beshort		0x76FD		LZH compressed data,
>2	string		x		original name %s

# Freeze
0	string		\037\237	frozen file 2.1
0	string		\037\236	frozen file 1.0 (or gzip 0.5)

# SCO compress -H (LZH)
0	string		\037\240	SCO compress -H (LZH) data

# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# There's only a magic nibble (4 bits); that nibble repeats every 33
# bytes.  This isn't suited for use, but maybe we can use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0	byte&0xF0	0xd0		data
#>33	byte&0xF0	0xd0
#>66	byte&0xF0	0xd0
#>99	byte&0xF0	0xd0
#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio

# bzip	a block-sorting file compressor
#	by Julian Seward <sewardj@cs.man.ac.uk> and others
#
0	string		BZ		bzip compressed data
>2	byte		x		\b, version: %c
>3	string		=1		\b, compression block size 100k
>3	string		=2		\b, compression block size 200k
>3	string		=3		\b, compression block size 300k
>3	string		=4		\b, compression block size 400k
>3	string		=5		\b, compression block size 500k
>3	string		=6		\b, compression block size 600k
>3	string		=7		\b, compression block size 700k
>3	string		=8		\b, compression block size 800k
>3	string		=9		\b, compression block size 900k

# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
0	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
>9	beshort		<0x0940
>>9	byte&0xf0	=0x00		- version 0.
>>9	beshort&0x0fff	x		\b%03x,
>>13	byte		1		LZO1X-1,
>>13	byte		2		LZO1X-1(15),
>>13	byte		3		LZO1X-999,
## >>22	bedate		>0		last modified: %s,
>>14	byte		=0x00		os: MS-DOS
>>14	byte		=0x01		os: Amiga
>>14	byte		=0x02		os: VMS
>>14	byte		=0x03		os: Unix
>>14	byte		=0x05		os: Atari
>>14	byte		=0x06		os: OS/2
>>14	byte		=0x07		os: MacOS
>>14	byte		=0x0A		os: Tops/20
>>14	byte		=0x0B		os: WinNT
>>14	byte		=0x0E		os: Win32
>9	beshort		>0x0939
>>9	byte&0xf0	=0x00		- version 0.
>>9	byte&0xf0	=0x10		- version 1.
>>9	byte&0xf0	=0x20		- version 2.
>>9	beshort&0x0fff	x		\b%03x,
>>15	byte		1		LZO1X-1,
>>15	byte		2		LZO1X-1(15),
>>15	byte		3		LZO1X-999,
## >>25	bedate		>0		last modified: %s,
>>17	byte		=0x00		os: MS-DOS
>>17	byte		=0x01		os: Amiga
>>17	byte		=0x02		os: VMS
>>17	byte		=0x03		os: Unix
>>17	byte		=0x05		os: Atari
>>17	byte		=0x06		os: OS/2
>>17	byte		=0x07		os: MacOS
>>17	byte		=0x0A		os: Tops/20
>>17	byte		=0x0B		os: WinNT
>>17	byte		=0x0E		os: Win32

# 4.3BSD-Quasijarus Strong Compression
# http://minnie.tuhs.org/Quasijarus/compress.html
0	string		\037\241	Quasijarus strong compressed data

# From: Cory Dikkers <cdikkers@swbell.net>
0	string		XPKF		Amiga xpkf.library compressed data
0	string		PP11		Power Packer 1.1 compressed data
0	string		PP20		Power Packer 2.0 compressed data,
>4	belong		0x09090909	fast compression
>4	belong		0x090A0A0A	mediocre compression
>4	belong		0x090A0B0B	good compression
>4	belong		0x090A0C0C	very good compression
>4	belong		0x090A0C0D	best compression

# 7z archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
# http://www.7-zip.org or DOC/7zFormat.txt 
#
0	string		7z\274\257\047\034	7z archive data,
>6	byte		x			version %d
>7	byte		x			\b.%d

# AFX compressed files (Wolfram Kleff)
2	string		-afx-		AFX compressed file data
#	$OpenBSD: console,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# Console game magic
# Toby Deshane <hac@shoelace.digivill.net>
#    ines:  file(1) magic for Marat's iNES Nintendo Entertainment System
#           ROM dump format

0 string NES\032 iNES ROM dump,
>4 byte  x     %dx16k PRG
>5 byte  x     \b, %dx8k CHR
>6 byte&0x01  =0x1  \b, [Vert.]
>6 byte&0x01  =0x0  \b, [Horiz.]
>6 byte&0x02  =0x2  \b, [SRAM]
>6 byte&0x04  =0x4  \b, [Trainer]
>6 byte&0x04  =0x8  \b, [4-Scr]

#------------------------------------------------------------------------------
# gameboy:  file(1) magic for the Nintendo (Color) Gameboy raw ROM format
#
0x104 belong 0xCEED6666 Gameboy ROM:
>0x134 string >\0 "%.16s"
>0x146 byte 0x03  \b,[SGB]
>0x147 byte 0x00  \b, [ROM ONLY]
>0x147 byte 0x01  \b, [ROM+MBC1]
>0x147 byte 0x02  \b, [ROM+MBC1+RAM]
>0x147 byte 0x03  \b, [ROM+MBC1+RAM+BATT]
>0x147 byte 0x05  \b, [ROM+MBC2]
>0x147 byte 0x06  \b, [ROM+MBC2+BATTERY]
>0x147 byte 0x08  \b, [ROM+RAM]
>0x147 byte 0x09  \b, [ROM+RAM+BATTERY]
>0x147 byte 0x0B  \b, [ROM+MMM01]
>0x147 byte 0x0C  \b, [ROM+MMM01+SRAM]
>0x147 byte 0x0D  \b, [ROM+MMM01+SRAM+BATT]
>0x147 byte 0x0F  \b, [ROM+MBC3+TIMER+BATT]
>0x147 byte 0x10  \b, [ROM+MBC3+TIMER+RAM+BATT]
>0x147 byte 0x11  \b, [ROM+MBC3]
>0x147 byte 0x12  \b, [ROM+MBC3+RAM]
>0x147 byte 0x13  \b, [ROM+MBC3+RAM+BATT]
>0x147 byte 0x19  \b, [ROM+MBC5]
>0x147 byte 0x1A  \b, [ROM+MBC5+RAM]
>0x147 byte 0x1B  \b, [ROM+MBC5+RAM+BATT]
>0x147 byte 0x1C  \b, [ROM+MBC5+RUMBLE]
>0x147 byte 0x1D  \b, [ROM+MBC5+RUMBLE+SRAM]
>0x147 byte 0x1E  \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
>0x147 byte 0x1F  \b, [Pocket Camera]
>0x147 byte 0xFD  \b, [Bandai TAMA5]
>0x147 byte 0xFE  \b, [Hudson HuC-3]
>0x147 byte 0xFF  \b, [Hudson HuC-1]

>0x148 byte 0     \b, ROM: 256Kbit
>0x148 byte 1     \b, ROM: 512Kbit
>0x148 byte 2     \b, ROM: 1Mbit
>0x148 byte 3     \b, ROM: 2Mbit
>0x148 byte 4     \b, ROM: 4Mbit
>0x148 byte 5     \b, ROM: 8Mbit
>0x148 byte 6     \b, ROM: 16Mbit
>0x148 byte 0x52  \b, ROM: 9Mbit
>0x148 byte 0x53  \b, ROM: 10Mbit
>0x148 byte 0x54  \b, ROM: 12Mbit

>0x149 byte 1     \b, RAM: 16Kbit
>0x149 byte 2     \b, RAM: 64Kbit
>0x149 byte 3     \b, RAM: 128Kbit
>0x149 byte 4     \b, RAM: 1Mbit

#>0x14e long  x     \b, CRC: %x

#------------------------------------------------------------------------------
# genesis:  file(1) magic for the Sega MegaDrive/Genesis raw ROM format
#
0x100 string SEGA  Sega MegaDrive/Genesis raw ROM dump
>0x120 string >\0 Name: "%.16s"
>0x110 string >\0 %.16s
>0x1B0 string RA with SRAM

#------------------------------------------------------------------------------
# genesis:  file(1) magic for the Super MegaDrive ROM dump format
#
0x280 string EAGN  Super MagicDrive ROM dump
>0 byte x %dx16k blocks
>2 byte 0 \b, last in series or standalone
>2 byte >0 \b, split ROM
>8 byte 0xAA
>9 byte 0xBB

#------------------------------------------------------------------------------
# genesis:  file(1) alternate magic for the Super MegaDrive ROM dump format
#
0x280 string EAMG  Super MagicDrive ROM dump
>0 byte x %dx16k blocks
>2 byte x \b, last in series or standalone
>8 byte 0xAA
>9 byte 0xBB

#------------------------------------------------------------------------------
# smsgg:  file(1) magic for Sega Master System and Game Gear ROM dumps
#
# Does not detect all images.  Very preliminary guesswork.  Need more data
# on format.
#
# FIXME: need a little more info...;P
#
#0 byte 0xF3
#>1 byte 0xED  Sega Master System/Game Gear ROM dump
#>1 byte 0x31  Sega Master System/Game Gear ROM dump
#>1 byte 0xDB  Sega Master System/Game Gear ROM dump
#>1 byte 0xAF  Sega Master System/Game Gear ROM dump
#>1 byte 0xC3  Sega Master System/Game Gear ROM dump

#------------------------------------------------------------------------------
# dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
#
0 belong 0x21068028   Sega Dreamcast VMU game image
0 string LCDi         Dream Animator file

#------------------------------------------------------------------------------
# v64: file(1) uncertain magic for the V64 format N64 ROM dumps
#
0 belong 0x37804012    V64 Nintendo 64 ROM dump

#------------------------------------------------------------------------------
# msx: file(1) magic for MSX game cartridge dumps
# Too simple - MPi
#0 beshort 0x4142 MSX game cartridge dump 

#------------------------------------------------------------------------------
# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
0	string	PS-X\ EXE	Sony Playstation executable
#  Area:
>113	string	x		(%s)

#------------------------------------------------------------------------------
# Microsoft Xbox executables .xbe (Esa Hyytiä <ehyytia@cc.hut.fi>)
0       string          XBEH            XBE, Microsoft Xbox executable
# probabilistic checks whether signed or not
>0x0004 ulelong =0x0
>>&2    ulelong =0x0
>>>&2   ulelong =0x0  \b, not signed
>0x0004 ulelong >0
>>&2    ulelong >0
>>>&2   ulelong >0    \b, signed
# expect base address of 0x10000
>0x0104               ulelong =0x10000
>>(0x0118-0x0FF60)    ulelong&0x80000007  0x80000007 \b, all regions
>>(0x0118-0x0FF60)    ulelong&0x80000007  !0x80000007
>>>(0x0118-0x0FF60)   ulelong >0           (regions:
>>>>(0x0118-0x0FF60)  ulelong &0x00000001  NA
>>>>(0x0118-0x0FF60)  ulelong &0x00000002  Japan
>>>>(0x0118-0x0FF60)  ulelong &0x00000004  Rest_of_World
>>>>(0x0118-0x0FF60)  ulelong &0x80000000  Manufacturer
>>>(0x0118-0x0FF60)   ulelong >0           \b)

# --------------------------------
# Microsoft Xbox data file formats
0       string          XIP0            XIP, Microsoft Xbox data
0       string          XTF0            XTF, Microsoft Xbox data
#	$OpenBSD: convex,v 1.4 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# convex:  file(1) magic for Convex boxes
#
# Convexes are big-endian.
#
# /*\
#  * Below are the magic numbers and tests added for Convex.
#  * Added at beginning, because they are expected to be used most.
# \*/
0	belong	0507	Convex old-style object
>16	belong	>0	not stripped
0	belong	0513	Convex old-style demand paged executable
>16	belong	>0	not stripped
0	belong	0515	Convex old-style pre-paged executable
>16	belong	>0	not stripped
0	belong	0517	Convex old-style pre-paged, non-swapped executable
>16	belong	>0	not stripped
0	belong	0x011257	Core file
#
# The following are a series of dump format magic numbers.  Each one
# corresponds to a drastically different dump format.  The first on is
# the original dump format on a 4.1 BSD or earlier file system.  The
# second marks the change between the 4.1 file system and the 4.2 file
# system.  The Third marks the changing of the block size from 1K
# to 2K to be compatible with an IDC file system.  The fourth indicates
# a dump that is dependent on Convex Storage Manager, because data in
# secondary storage is not physically contained within the dump.
# The restore program uses these number to determine how the data is
# to be extracted.
#
24	belong	=60011	dump format, 4.1 BSD or earlier
24	belong	=60012	dump format, 4.2 or 4.3 BSD without IDC
24	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
24	belong	=60014	dump format, Convex Storage Manager by-reference dump
#
# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
# If there is no `=' sign, assume just checking for whether the bit is set?
#
0	belong	0601		Convex SOFF
>88	belong&0x000f0000	=0x00000000	c1
>88	belong			&0x00010000	c2
>88	belong			&0x00020000	c2mp
>88	belong			&0x00040000	parallel
>88	belong			&0x00080000	intrinsic
>88	belong			&0x00000001	demand paged
>88	belong			&0x00000002	pre-paged
>88	belong			&0x00000004	non-swapped
>88	belong			&0x00000008	POSIX
#
>84	belong			&0x80000000	executable
>84	belong			&0x40000000	object
>84	belong&0x20000000	=0		not stripped
>84	belong&0x18000000	=0x00000000	native fpmode
>84	belong&0x18000000	=0x10000000	ieee fpmode
>84	belong&0x18000000	=0x18000000	undefined fpmode
#
0	belong			0605		Convex SOFF core
#
0	belong			0607		Convex SOFF checkpoint
>88	belong&0x000f0000	=0x00000000	c1
>88	belong			&0x00010000	c2
>88	belong			&0x00020000	c2mp
>88	belong			&0x00040000	parallel
>88	belong			&0x00080000	intrinsic
>88	belong			&0x00000008	POSIX
#
>84	belong&0x18000000	=0x00000000	native fpmode
>84	belong&0x18000000	=0x10000000	ieee fpmode
>84	belong&0x18000000	=0x18000000	undefined fpmode
#	$OpenBSD: ctags,v 1.1 2004/06/03 03:14:19 tedu Exp $

# ----------------------------------------------------------------------------
# ctags:  file (1) magic for Exuberant Ctags files
# From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
0       string  !_TAG   Exuberant Ctags tag file text
#	$OpenBSD: dact,v 1.1 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# dact:  file(1) magic for DACT compressed files
#
0	long		0x444354C3	DACT compressed data
>4	byte		>-1		(version %i.
>5	byte		>-1		$BS%i.
>6	byte		>-1		$BS%i)
>7	long		>0		$BS, original size: %i bytes
>15	long		>30		$BS, block size: %i bytes
#	$OpenBSD: database,v 1.4 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# database:  file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
#
# GDBM magic numbers
#  Will be maintained as part of the GDBM distribution in the future.
#  <downsj@teeny.org>
0	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian
0	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian
0	string	GDBM		GNU dbm 2.x database
#
# Berkeley DB
#
# Ian Darwin's file /etc/magic files: big/little-endian version.
#
# Hash 1.85/1.86 databases store metadata in network byte order.
# Btree 1.85/1.86 databases store the metadata in host byte order.
# Hash and Btree 2.X and later databases store the metadata in host byte order.

0	long	0x00061561	Berkeley DB
>8	belong	4321
>>4	belong	>2		1.86
>>4	belong	<3		1.85
>>4	belong	>0		(Hash, version %d, native byte-order)
>8	belong	1234
>>4	belong	>2		1.86
>>4	belong	<3		1.85
>>4	belong	>0		(Hash, version %d, little-endian)

0	belong	0x00061561	Berkeley DB
>8	belong	4321
>>4	belong	>2		1.86
>>4	belong	<3		1.85
>>4	belong	>0		(Hash, version %d, big-endian)
>8	belong	1234
>>4	belong	>2		1.86
>>4	belong	<3		1.85
>>4	belong	>0		(Hash, version %d, native byte-order)

0	long	0x00053162	Berkeley DB 1.85/1.86
>4	long	>0		(Btree, version %d, native byte-order)
0	belong	0x00053162	Berkeley DB 1.85/1.86
>4	belong	>0		(Btree, version %d, big-endian)
0	lelong	0x00053162	Berkeley DB 1.85/1.86
>4	lelong	>0		(Btree, version %d, little-endian)

12	long	0x00061561	Berkeley DB
>16	long	>0		(Hash, version %d, native byte-order)
12	belong	0x00061561	Berkeley DB
>16	belong	>0		(Hash, version %d, big-endian)
12	lelong	0x00061561	Berkeley DB
>16	lelong	>0		(Hash, version %d, little-endian)

12	long	0x00053162	Berkeley DB
>16	long	>0		(Btree, version %d, native byte-order)
12	belong	0x00053162	Berkeley DB
>16	belong	>0		(Btree, version %d, big-endian)
12	lelong	0x00053162	Berkeley DB
>16	lelong	>0		(Btree, version %d, little-endian)

12	long	0x00042253	Berkeley DB
>16	long	>0		(Queue, version %d, native byte-order)
12	belong	0x00042253	Berkeley DB
>16	belong	>0		(Queue, version %d, big-endian)
12	lelong	0x00042253	Berkeley DB
>16	lelong	>0		(Queue, version %d, little-endian)
#
#
# Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
0	string	RRD		RRDTool DB
>4	string	x		version %s
#----------------------------------------------------------------------
# ROOT: file(1) magic for ROOT databases
#
0       string  root\0  ROOT file
>4      belong  x       Version %d
>33     belong  x       (Compression: %d)

# XXX: Weak magic.
# Alex Ott <ott@jet.msk.su>
## Paradox file formats
#2	  leshort	0x0800	Paradox 
#>0x39	  byte		3	v. 3.0 
#>0x39	  byte		4	v. 3.5 
#>0x39	  byte		9	v. 4.x 
#>0x39	  byte		10	v. 5.x 
#>0x39	  byte		11	v. 5.x 
#>0x39	  byte		12	v. 7.x 
#>>0x04	  byte		0	indexed .DB data file 
#>>0x04	  byte		1	primary index .PX file 
#>>0x04	  byte		2	non-indexed .DB data file 
#>>0x04	  byte		3	non-incrementing secondary index .Xnn file 
#>>0x04	  byte		4	secondary index .Ynn file 
#>>0x04	  byte		5	incrementing secondary index .Xnn file 
#>>0x04	  byte		6	non-incrementing secondary index .XGn file 
#>>0x04	  byte		7	secondary index .YGn file 
#>>>0x04	  byte		8	incrementing secondary index .XGn file 
## XBase database files
#0      byte       0x02	
#>8     leshort	  >0
#>>12   leshort    0	FoxBase 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x03	
#>8     leshort	  >0
#>>12   leshort    0	FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x04	
#>8     leshort	  >0
#>>12   leshort    0	dBASE IV no memo file 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x05	
#>8     leshort	  >0
#>>12   leshort    0	dBASE V no memo file 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x30
#>8     leshort	  >0
#>>12   leshort    0	Visual FoxPro 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x43
#>8     leshort	  >0
#>>12   leshort    0	FlagShip with memo var size 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x7b
#>8     leshort	  >0
#>>12   leshort    0	dBASEIV with memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x83	
#>8     leshort	  >0
#>>12   leshort    0	FoxBase+, dBaseIII+ with memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x8b
#>8     leshort	  >0
#>>12   leshort    0	dBaseIV with memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0x8e	
#>8     leshort	  >0
#>>12   leshort    0	dBaseIV with SQL Table 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0xb3
#>8     leshort	  >0
#>>12   leshort    0	FlagShip with .dbt memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0      byte       0xf5
#>8     leshort	  >0
#>>12   leshort    0	FoxPro with memo 
#>>>0x04	lelong		0		(no records)
#>>>0x04	lelong		>0		(%ld records)
#
#0	leshort		0x0006		DBase 3 index file

# MS Access database
4	  string	Standard\ Jet\ DB	Microsoft Access Database

# TDB database from Samba et al - Martin Pool <mbp@samba.org>
0	string	TDB\ file		TDB database
>32	lelong	0x2601196D		version 6, little-endian
>>36	lelong	x			hash size %d bytes

# SE Linux policy database
0       lelong  0xf97cff8c      SE Linux policy
>16     lelong  x               v%d
>20     lelong  1      MLS
>24     lelong  x       %d symbols
>28     lelong  x       %d ocons

# ICE authority file data (Wolfram Kleff)
2	string		ICE		ICE authority data

# X11 Xauthority file (Wolfram Kleff)
10	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
11	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
12	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
13	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
14	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
15	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
16	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
17	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
18	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
#	$OpenBSD: diamond,v 1.2 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# diamond:  file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
# XXX - I think it was either renamed Slate, or replaced by Slate....
#
#	The full deal is too long...
#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
0	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document
#	$OpenBSD: diff,v 1.2 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# diff:  file(1) magic for diff(1) output
#
0	string		diff\ 	'diff' output text
0	string		***\ 		'diff' output text
0	string		Only\ in\ 	'diff' output text
0	string		Common\ subdirectories:\ 	'diff' output text
#	$OpenBSD: digital,v 1.3 2004/06/03 03:14:19 tedu Exp $

#  Digital UNIX - Info
#
0	string	!<arch>\n________64E	Alpha archive
>22	string	X			-- out of date
#
# Alpha COFF Based Executables
# The stripped stuff really needs to be an 8 byte (64 bit) compare,
# but this works
0	leshort		0x183		COFF format alpha
>22	leshort&020000	&010000		sharable library,
>22	leshort&020000	^010000		dynamically linked,
>24	leshort		0410		pure
>24	leshort		0413		demand paged
>8	lelong		>0		executable or object module, not stripped
>8	lelong		0
>>12	lelong		0		executable or object module, stripped
>>12	lelong		>0		executable or object module, not stripped
>27     byte            >0              - version %d.
>26     byte            >0              %d-
>28     leshort         >0              %d
#
# The next is incomplete, we could tell more about this format,
# but its not worth it.
0	leshort		0x188	Alpha compressed COFF
0	leshort		0x18f	Alpha u-code object
#
#
# Some other interesting Digital formats,
0	string	\377\377\177		ddis/ddif
0	string	\377\377\174		ddis/dots archive
0	string	\377\377\176		ddis/dtif table data
0	string	\033c\033		LN03 output
0	long	04553207		X image
#
0	string	!<PDF>!\n		profiling data file
#
# Locale data tables (MIPS and Alpha).
#
0	short		0x0501		locale data table
>6	short		0x24		for MIPS
>6	short		0x40		for Alpha
#	$OpenBSD: dolby,v 1.1 2004/06/03 03:14:19 tedu Exp $

# ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
# from http://www.atsc.org/standards/a_52a.pdf
# corrections, additions, etc. are always welcome!
#
# syncword
0       beshort         0x0b77  ATSC A/52 aka AC-3 aka Dolby Digital stream,
# fscod
>4      byte&0xc0       0x00    48 kHz,
>4      byte&0xc0       0x40    44.1 kHz,
>4      byte&0xc0       0x80    32 kHz,
# is this one used for 96 kHz?
>4      byte&0xc0       0xc0    reserved frequency,
#
>5	byte&7 = 0		\b, complete main (CM)
>5	byte&7 = 1		\b, music and effects (ME)
>5	byte&7 = 2		\b, visually impaired (VI)
>5	byte&7 = 3		\b, hearing impaired (HI)
>5	byte&7 = 4		\b, dialogue (D)
>5	byte&7 = 5		\b, commentary (C)
>5	byte&7 = 6		\b, emergency (E)
# acmod
>6      byte&0xe0       0x00    1+1 front,
>6      byte&0xe0       0x20    1 front/0 rear,
>6      byte&0xe0       0x40    2 front/0 rear,
>6      byte&0xe0       0x60    3 front/0 rear,
>6      byte&0xe0       0x80    2 front/1 rear,
>6      byte&0xe0       0xa0    3 front/1 rear,
>6      byte&0xe0       0xc0    2 front/2 rear,
>6      byte&0xe0       0xe0    3 front/2 rear,
# lfeon (these may be incorrect)
>7      byte&0x40       0x00    LFE off,
>7      byte&0x40       0x40    LFE on,
#
>4	byte&0x3e = 0x00	\b, 32 kbit/s
>4	byte&0x3e = 0x02        \b, 40 kbit/s
>4	byte&0x3e = 0x04        \b, 48 kbit/s
>4	byte&0x3e = 0x06        \b, 56 kbit/s
>4	byte&0x3e = 0x08        \b, 64 kbit/s
>4	byte&0x3e = 0x0a        \b, 80 kbit/s
>4	byte&0x3e = 0x0c        \b, 96 kbit/s
>4	byte&0x3e = 0x0e        \b, 112 kbit/s
>4	byte&0x3e = 0x10        \b, 128 kbit/s
>4	byte&0x3e = 0x12        \b, 160 kbit/s
>4	byte&0x3e = 0x14        \b, 192 kbit/s
>4	byte&0x3e = 0x16        \b, 224 kbit/s
>4	byte&0x3e = 0x18        \b, 256 kbit/s
>4	byte&0x3e = 0x1a        \b, 320 kbit/s
>4	byte&0x3e = 0x1c        \b, 384 kbit/s
>4	byte&0x3e = 0x1e        \b, 448 kbit/s
>4	byte&0x3e = 0x20        \b, 512 kbit/s
>4	byte&0x3e = 0x22        \b, 576 kbit/s
>4	byte&0x3e = 0x24        \b, 640 kbit/s
# dsurmod (these may be incorrect)
>6      beshort&0x0180  0x0000  Dolby Surround not indicated
>6      beshort&0x0180  0x0080  not Dolby Surround encoded
>6      beshort&0x0180  0x0100  Dolby Surround encoded
>6      beshort&0x0180  0x0180  reserved Dolby Surround mode
#	$OpenBSD: dump,v 1.3 2004/06/03 03:14:19 tedu Exp $

#------------------------------------------------------------------------------
# dump:  file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
24	belong	60012		new-fs dump file (big endian),
>4	bedate	x		Previous dump %s,
>8	bedate	x		This dump %s,
>12	belong	>0		Volume %ld,
>692	belong	0		Level zero, type:
>692	belong	>0		Level %d, type:
>0	belong	1		tape header,
>0	belong	2		beginning of file record,
>0	belong	3		map of inodes on tape,
>0	belong	4		continuation of file record,
>0	belong	5		end of volume,
>0	belong	6		map of inodes deleted,
>0	belong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	belong	>0		Flags %x

24	belong	60011		old-fs dump file (big endian),
#>4	bedate	x		Previous dump %s,
#>8	bedate	x		This dump %s,
>12	belong	>0		Volume %ld,
>692	belong	0		Level zero, type:
>692	belong	>0		Level %d, type:
>0	belong	1		tape header,
>0	belong	2		beginning of file record,
>0	belong	3		map of inodes on tape,
>0	belong	4		continuation of file record,
>0	belong	5		end of volume,
>0	belong	6		map of inodes deleted,
>0	belong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	belong	>0		Flags %x

24	lelong	60012		new-fs dump file (little endian),
>4	ledate	x		This dump %s,
>8	ledate	x		Previous dump %s,
>12	lelong	>0		Volume %ld,
>692	lelong	0		Level zero, type:
>692	lelong	>0		Level %d, type:
>0	lelong	1		tape header,
>0	lelong	2		beginning of file record,
>0	lelong	3		map of inodes on tape,
>0	lelong	4		continuation of file record,
>0	lelong	5		end of volume,
>0	lelong	6		map of inodes deleted,
>0	lelong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	lelong	>0		Flags %x

24	lelong	60011		old-fs dump file (little endian),
#>4	ledate	x		Previous dump %s,
#>8	ledate	x		This dump %s,
>12	lelong	>0		Volume %ld,
>692	lelong	0		Level zero, type:
>692	lelong	>0		Level %d, type:
>0	lelong	1		tape header,
>0	lelong	2		beginning of file record,
>0	lelong	3		map of inodes on tape,
>0	lelong	4		continuation of file record,
>0	lelong	5		end of volume,
>0	lelong	6		map of inodes deleted,
>0	lelong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	lelong	>0		Flags %x
#	$OpenBSD: dyadic,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# Dyadic: file(1) magic for Dyalog APL.
#
0 	byte	0xaa
>1	byte	<4		Dyalog APL
>>1	byte	0x00		incomplete workspace
>>1	byte	0x01		component file
>>1	byte	0x02		external variable
>>1	byte	0x03		workspace
>>2	byte	x		version %d
>>3	byte	x		.%d
#	$OpenBSD: editors,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# T602 editor documents 
# by David Necas <yeti@physics.muni.cz>
0	string	@CT\ 	T602 document data,
>4	string	0	Kamenicky
>4	string	1	CP 852
>4	string	2	KOI8-CS
>4	string	>2	unknown encoding

# Vi IMproved Encrypted file 
# by David Necas <yeti@physics.muni.cz>
0	string	VimCrypt~	Vim encrypted file data
#	$OpenBSD: elf,v 1.15 2006/10/12 03:32:32 drahn Exp $

#------------------------------------------------------------------------------
# elf:  file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# MIPS RS3000 may also be for MIPS RS2000.
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\177ELF		ELF
>4	byte		0		invalid class
>4	byte		1		32-bit
>4	byte		2		64-bit
>5	byte		0		invalid byte order
>5	byte		1		LSB
>>16	leshort		0		no file type,
>>16	leshort		1		relocatable,
>>16	leshort		2		executable,
>>16	leshort		3		shared object,
# only for MIPS
>>18	leshort		8
# only for 32-bit
>>>4	byte		1
>>>>36	lelong&0xf0000000	0x00000000	MIPS-I,
>>>>36	lelong&0xf0000000	0x10000000	MIPS-II,
>>>>36	lelong&0xf0000000	0x20000000	MIPS-III,
>>>>36	lelong&0xf0000000	0x30000000	MIPS-IV,
>>>>36	lelong&0xf0000000	0x40000000	MIPS-V,
>>>>36	lelong&0xf0000000	0x60000000	MIPS32,
>>>>36	lelong&0xf0000000	0x70000000	MIPS64,
>>>>36	lelong&0xf0000000	0x80000000	MIPS32 rel2,
>>>>36	lelong&0xf0000000	0x90000000	MIPS64 rel2,
# only for 64-bit
>>>4	byte		2
>>>>48	lelong&0xf0000000	0x00000000	MIPS-I,
>>>>48	lelong&0xf0000000	0x10000000	MIPS-II,
>>>>48	lelong&0xf0000000	0x20000000	MIPS-III,
>>>>48	lelong&0xf0000000	0x30000000	MIPS-IV,
>>>>48	lelong&0xf0000000	0x40000000	MIPS-V,
>>>>48	lelong&0xf0000000	0x60000000	MIPS32,
>>>>48	lelong&0xf0000000	0x70000000	MIPS64 ,
>>>>48	lelong&0xf0000000	0x80000000	MIPS32 rel2,
>>>>48	lelong&0xf0000000	0x90000000	MIPS64 rel2,
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
>>16	leshort		4		core file
>>>400  lelong          >0              (signal %d),
>>16	leshort		&0xff00		processor-specific,
>>18	leshort		0		no machine,
>>18	leshort		1		AT&T WE32100 - invalid byte order,
>>18	leshort		2		SPARC - invalid byte order,
>>18	leshort		3		Intel 80386,
>>18	leshort		4		Motorola 68000 - invalid byte order,
>>18	leshort		5		Motorola 88000 - invalid byte order,
>>18	leshort		6		Intel 80486,
>>18	leshort		7		Intel 80860,
# >>18	leshort		8		MIPS,
>>18	leshort		9		Amdahl - invalid byte order,
>>18	leshort		10		MIPS (deprecated),
>>18	leshort		11		RS6000 - invalid byte order,
>>18	leshort		15		PA-RISC - invalid byte order,
>>18	leshort		16		nCUBE,
>>18	leshort		17		VPP500,
>>18	leshort		18		SPARC32PLUS,
>>18	leshort		20		PowerPC,
>>18	leshort		40		ARM,
>>18	leshort		42		SH
>>18	leshort		43		SPARC64 - invalid byte order,
>>18	leshort		62		AMD64,
>>18	leshort		75		VAX,
>>18	leshort		0x9026		Alpha,
>>20	lelong		0		invalid version
>>20	lelong		1		version 1
>>36	lelong		1		MathCoPro/FPU/MAU Required
>5	byte		2		MSB
>>16	beshort		0		no file type,
>>16	beshort		1		relocatable,
>>16	beshort		2		executable,
>>16	beshort		3		shared object,
# only for MIPS
>>18	beshort		8
# only for 32-bit
>>>4	byte		1
>>>>36	belong&0xf0000000	0x00000000	MIPS-I,
>>>>36	belong&0xf0000000	0x10000000	MIPS-II,
>>>>36	belong&0xf0000000	0x20000000	MIPS-III,
>>>>36	belong&0xf0000000	0x30000000	MIPS-IV,
>>>>36	belong&0xf0000000	0x40000000	MIPS-V,
>>>>36	belong&0xf0000000	0x60000000	MIPS32,
>>>>36	belong&0xf0000000	0x70000000	MIPS64,
>>>>36	belong&0xf0000000	0x80000000	MIPS32 rel2,
>>>>36	belong&0xf0000000	0x90000000	MIPS64 rel2,
# only for 64-bit
>>>4	byte		2
>>>>48	belong&0xf0000000	0x00000000	MIPS-I,
>>>>48	belong&0xf0000000	0x10000000	MIPS-II,
>>>>48	belong&0xf0000000	0x20000000	MIPS-III,
>>>>48	belong&0xf0000000	0x30000000	MIPS-IV,
>>>>48	belong&0xf0000000	0x40000000	MIPS-V,
>>>>48	belong&0xf0000000	0x60000000	MIPS32,
>>>>48	belong&0xf0000000	0x70000000	MIPS64 ,
>>>>48	belong&0xf0000000	0x80000000	MIPS32 rel2,
>>>>48	belong&0xf0000000	0x90000000	MIPS64 rel2,
>>16	beshort		4		core file,
>>>400	lelong		>0		(signal %d),
>>16	beshort		&0xff00		processor-specific,
>>18	beshort		0		no machine,
>>18	beshort		1		AT&T WE32100,
>>18	beshort		2		SPARC,
>>18	beshort		3		Intel 80386 - invalid byte order,
>>18	beshort		4		Motorola 68000,
>>18	beshort		5		Motorola 88000,
>>18	beshort		6		Intel 80486 - invalid byte order,
>>18	beshort		7		Intel 80860,
# >>18	beshort		8		MIPS,
>>18	beshort		9		Amdahl,
>>18	beshort		10		MIPS (deprecated),
>>18	beshort		11		RS6000,
>>18	beshort		15		PA-RISC,
>>18	beshort		16		nCUBE,
>>18	beshort		17		VPP500,
>>18	beshort		18		SPARC32PLUS,
>>18	beshort		20		PowerPC,
>>18	beshort		40		ARM,
>>18	beshort		42		SH - invalid byte order,
>>18	beshort		43		SPARC64,
>>18	beshort		62		AMD64 - invalid byte order,
>>18	beshort		75		VAX - invalid byte order,
>>18	beshort		0x9026		Alpha,
>>20	belong		0		invalid version
>>20	belong		1		version 1
>>36	belong		1		MathCoPro/FPU/MAU Required
#	$OpenBSD: encore,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# encore:  file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
#
0	short		0x154		Encore
>20	short		0x107		executable
>20	short		0x108		pure executable
>20	short		0x10b		demand-paged executable
>20	short		0x10f		unsupported executable
>12	long		>0		not stripped
>22	short		>0		- version %ld
>22	short		0		-
#>4	date		x		stamp %s
0	short		0x155		Encore unsupported executable
>12	long		>0		not stripped
>22	short		>0		- version %ld
>22	short		0		-
#>4	date		x		stamp %s
#	$OpenBSD: epoc,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# Epoc 32 : file(1) magic for Epoc Documents [psion/osaris
# Stefan Praszalowicz (hpicollo@worldnet.fr)
#0	lelong		0x10000037	Epoc32
>4	lelong		0x1000006D
>>8	lelong		0x1000007F	Word
>>8	lelong		0x10000088	Sheet
>>8	lelong		0x1000007D	Sketch
>>8	lelong		0x10000085	TextEd
#	$OpenBSD: fcs,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
# From Roger Leigh <roger@whinlatter.uklinux.net>
0       string          FCS1.0          Flow Cytometry Standard (FCS) data, version 1.0
0       string          FCS2.0          Flow Cytometry Standard (FCS) data, version 2.0
0       string          FCS3.0          Flow Cytometry Standard (FCS) data, version 3.0

#	$OpenBSD: filesystems,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# filesystems:  file(1) magic for different filesystems
#
0	string	\366\366\366\366	PC formatted floppy with no filesystem
# Sun disk labels
# From /usr/include/sun/dklabel.h:
0774	beshort		0xdabe		Sun disk label
>0	string		x		'%s
>>31  	string		>\0		\b%s
>>>63  	string		>\0		\b%s
>>>>95 	string		>\0		\b%s
>0	string		x		\b'
>0734	short		>0		%d rpm,
>0736	short		>0		%d phys cys,
>0740	short		>0		%d alts/cyl,
>0746	short		>0		%d interleave,
>0750	short		>0		%d data cyls,
>0752	short		>0		%d alt cyls,
>0754	short		>0		%d heads/partition,
>0756	short		>0		%d sectors/track,
>0764	long		>0		start cyl %ld,
>0770	long		x		%ld blocks
# Is there a boot block written 1 sector in?
>512    belong&077777777	0600407	\b, boot block present
0x1FE	leshort	0xAA55			x86 boot sector
>2	string	OSBS			\b, OS/BS MBR
# J\xf6rg Jenderek <joerg.jenderek@gmx.net>
>0x8C	string	Invalid\ partition\ table	\b, MS-DOS MBR
>0x9D	string	Invalid\ partition\ table	\b, DR-DOS MBR, version 7.01 to 7.03
>0x10F	string	Ung\201ltige\ Partitionstabelle	\b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
>0x8B	string	Ung\201ltige\ Partitionstabelle	\b, MS-DOS MBR, german version 5.00 to 4.00.950
>0x145	string	Default:\ F			\b, FREE-DOS MBR
>0	string	\0\0\0\0		\b, extended partition table
# JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
# older drives may use E9 xx xx
>0		lelong&0x009000EB	0x009000EB 
>0		lelong&0x000000E9	0x000000E9 
>>1		ubyte			>37	\b, code offset 0x%x
# mtools-3.9.8/msdos.h
# usual values are marked with comments to get only informations of strange FAT systems
# valid sectorsize are from 32 to 2048
>>>11		uleshort	<2049	
>>>>11		uleshort	>31	
>>>>>3		string		>\0		\b, OEM-ID "%8.8s"
>>>>>11		uleshort	>512		\b, Bytes/sector %u
#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
>>>>>11		uleshort	<512		\b, Bytes/sector %u
>>>>>13		ubyte		>1		\b, sectors/cluster %u
#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
>>>>>14		uleshort	>32		\b, reserved sectors %u
#>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
#>>>>>14	uleshort	>1		\b, reserved sectors %u
#>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
>>>>>14		uleshort	<1		\b, reserved sectors %u
>>>>>16		ubyte		>2		\b, FATs %u
#>>>>>16	ubyte		=2		\b, FATs %u (usual)
>>>>>16		ubyte		=1		\b, FAT  %u
>>>>>16		ubyte		>0
>>>>>17		uleshort	>0		\b, root entries %u
#>>>>>17	uleshort	=0		\b, root entries %u=0 (usual Fat32)
>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB) 
#>>>>>19	uleshort	=0		\b, sectors %u=0 (usual Fat32)
>>>>>21		ubyte		>0xF0		\b, Media descriptor 0x%x
#>>>>>21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
>>>>>21		ubyte		<0xF0		\b, Media descriptor 0x%x
>>>>>22		uleshort	>0		\b, sectors/FAT %u
#>>>>>22	uleshort	=0		\b, sectors/FAT %u=0 (usual Fat32)
>>>>>26		ubyte		>2		\b, heads %u
#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
>>>>>26		ubyte		=1		\b, heads %u
>>>>>28		ulelong		>0		\b, hidden sectors %u
#>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
>>>>>32		ulelong		>0		\b, sectors %u (volumes > 32 MB) 
#>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB) 
# FAT<32 specific 
# NOT le FAT3=NOT 3TAF=0xCCABBEB9
>>>>>82		ulelong&0xCCABBEB9	>0
>>>>>>36	ubyte		>0x80		\b, physical drive 0x%x
#>>>>>>36	ubyte		=0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
>>>>>>36	ubyte&0x7F	>0		\b, physical drive 0x%x
#>>>>>>36	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
>>>>>>37	ubyte		>0		\b, reserved 0x%x
#>>>>>>37	ubyte		=0		\b, reserved 0x%x
>>>>>>38	ubyte		>0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>38	ubyte		<0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>38	ubyte		=0x29
>>>>>>>39	ulelong		x		\b, serial number 0x%x
>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
>>>>>>>43	string		=NO\ NAME	\b, unlabeled
>>>>>>54	string		FAT1		\b, FAT
>>>>>>>54	string		FAT12		\b (12 bit)
>>>>>>>54	string		FAT16		\b (16 bit)
# FAT32 specific
>>>>>82		string		FAT32		\b, FAT (32 bit)
>>>>>>36	ulelong		x		\b, sectors/FAT %u
>>>>>>40	uleshort	>0		\b, extension flags %u
#>>>>>>40	uleshort	=0		\b, extension flags %u
>>>>>>42	uleshort	>0		\b, fsVersion %u
#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
>>>>>>44	ulelong		>2		\b, rootdir cluster %u
#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
>>>>>>48	uleshort	>1		\b, infoSector %u
#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
>>>>>>48	uleshort	<1		\b, infoSector %u
>>>>>>50	uleshort	>6		\b, Backup boot sector %u
#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual) 
>>>>>>50	uleshort	<6		\b, Backup boot sector %u
>>>>>>54	ulelong		>0		\b, reserved1 0x%x
>>>>>>58	ulelong		>0		\b, reserved2 0x%x
>>>>>>62	ulelong		>0		\b, reserved3 0x%x
# same structure as FAT1X 
>>>>>>64	ubyte		>0x80		\b, physical drive 0x%x
#>>>>>>64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
>>>>>>64	ubyte&0x7F	>0		\b, physical drive 0x%x
#>>>>>>64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
>>>>>>65	ubyte		>0		\b, reserved 0x%x
>>>>>>66	ubyte		>0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>66	ubyte		<0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>66	ubyte		=0x29
>>>>>>>67	ulelong		x		\b, serial number 0x%x
>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
>>>>>>71	string		=NO\ NAME	\b, unlabeled
### FATs end
>0x200	lelong	0x82564557		\b, BSD disklabel

# Minix filesystems - Juan Cespedes <cespedes@debian.org>
0x410	leshort		0x137f		Minix filesystem
0x410	beshort		0x137f		Minix filesystem (big endian),
>0x402	beshort		!0		\b, %d zones
>0x1e	string		minix		\b, bootable
0x410	leshort		0x138f		Minix filesystem, 30 char names
0x410	leshort		0x2468		Minix filesystem, version 2
0x410	leshort		0x2478		Minix filesystem, version 2, 30 char names

# romfs filesystems - Juan Cespedes <cespedes@debian.org>
0	string		-rom1fs-\0	romfs filesystem, version 1
>8	belong	x			%d bytes,
>16	string	x			named %s.

# netboot image - Juan Cespedes <cespedes@debian.org>
0	lelong		0x1b031336L	Netboot image,
>4	lelong&0xFFFFFF00	0
>>4	lelong&0x100	0x000		mode 2
>>4	lelong&0x100	0x100		mode 3
>4	lelong&0xFFFFFF00	!0	unknown mode

0x18b	string	OS/2	OS/2 Boot Manager

9564	lelong		0x00011954	Unix Fast File system (little-endian),
>8404	string		x		last mounted on %s,
#>9504	ledate		x		last checked at %s,
>8224	ledate		x		last written at %s,
>8401	byte		x		clean flag %d,
>8228	lelong		x		number of blocks %d,
>8232	lelong		x		number of data blocks %d,
>8236	lelong		x		number of cylinder groups %d,
>8240	lelong		x		block size %d,
>8244	lelong		x		fragment size %d,
>8252	lelong		x		minimum percentage of free blocks %d,
>8256	lelong		x		rotational delay %dms,
>8260	lelong		x		disk rotational speed %drps,
>8320	lelong		0		TIME optimization
>8320	lelong		1		SPACE optimization

9564	belong		0x00011954	Unix Fast File system (big-endian),
>7168   long		0x4c41424c	Apple UFS Volume
>>7186  string		x		named %s,
>>7176  belong		x		volume label version %d,
>>7180  bedate		x		created on %s,
>8404	string		x		last mounted on %s,
#>9504	bedate		x		last checked at %s,
>8224	bedate		x		last written at %s,
>8401	byte		x		clean flag %d,
>8228	belong		x		number of blocks %d,
>8232	belong		x		number of data blocks %d,
>8236	belong		x		number of cylinder groups %d,
>8240	belong		x		block size %d,
>8244	belong		x		fragment size %d,
>8252	belong		x		minimum percentage of free blocks %d,
>8256	belong		x		rotational delay %dms,
>8260	belong		x		disk rotational speed %drps,
>8320	belong		0		TIME optimization
>8320	belong		1		SPACE optimization

# ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com>
0x438	leshort		0xEF53		Linux
>0x44c	lelong		x		rev %d
>0x43e	leshort		x		\b.%d
>0x45c	lelong		^0x0000004	ext2 filesystem data
>>0x43a	leshort		^0x0000001	(mounted or unclean)
>0x45c	lelong		&0x0000004	ext3 filesystem data
>>0x460	lelong		&0x0000004	(needs journal recovery)
>0x43a	leshort		&0x0000002	(errors)
>0x460	lelong		&0x0000001	(compressed)
#>0x460	lelong		&0x0000002	(filetype)
#>0x464	lelong		&0x0000001	(sparse_super)
>0x464	lelong		&0x0000002	(large files)

# SGI disk labels - Nathan Scott <nathans@debian.org>
0	belong		0x0BE5A941	SGI disk label (volume header)

# SGI XFS filesystem - Nathan Scott <nathans@debian.org>
0	belong		0x58465342	SGI XFS filesystem data
>0x4	belong		x		(blksz %d,
>0x68	beshort		x		inosz %d,
>0x64	beshort		^0x2004		v1 dirs)
>0x64	beshort		&0x2004		v2 dirs)

############################################################################
# Minix-ST kernel floppy
0x800	belong		0x46fc2700	Atari-ST Minix kernel image
>19	string		\240\5\371\5\0\011\0\2\0	\b, 720k floppy
>19	string		\320\2\370\5\0\011\0\1\0	\b, 360k floppy

############################################################################
# Hmmm, is this a better way of detecting _standard_ floppy images ?
19	string		\320\2\360\3\0\011\0\1\0	DOS floppy 360k
>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
19	string		\240\5\371\3\0\011\0\2\0	DOS floppy 720k
>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
19	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector

19	string		\240\5\371\5\0\011\0\2\0	DOS floppy 720k, IBM
>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
19	string		\100\013\371\5\0\011\0\2\0	DOS floppy 1440k, mkdosfs
>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector

19	string		\320\2\370\5\0\011\0\1\0	Atari-ST floppy 360k
19	string		\240\5\371\5\0\011\0\2\0	Atari-ST floppy 720k

#  Valid media descriptor bytes for MS-DOS:
#
#     Byte   Capacity   Media Size and Type
#     -------------------------------------------------
#
#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
#     F9     720K       3.5-inch, 2-sided, 9-sector
#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
#     FD     360K       5.25-inch, 2-sided, 9-sector
#     FF     320K       5.25-inch, 2-sided, 8-sector
#     FC     180K       5.25-inch, 1-sided, 9-sector
#     FE     160K       5.25-inch, 1-sided, 8-sector
#     FE     250K       8-inch, 1-sided, single-density
#     FD     500K       8-inch, 2-sided, single-density
#     FE     1.2 MB     8-inch, 2-sided, double-density
#     F8     -----      Fixed disk 
#
#     FC     xxxK       Apricot 70x1x9 boot disk.
#
# Originally a bitmap:
#  xxxxxxx0	Not two sided
#  xxxxxxx1	Double sided
#  xxxxxx0x	Not 8 SPT
#  xxxxxx1x	8 SPT
#  xxxxx0xx	Not Removable drive
#  xxxxx1xx	Removable drive
#  11111xxx	Must be one.
#
# But now it's rather random:
#  111111xx	Low density disk
#        00	SS, Not 8 SPT
#        01	DS, Not 8 SPT
#        10	SS, 8 SPT
#        11	DS, 8 SPT
#
#  11111001	Double density 3 floppy disk, high density 5
#  11110000	High density 3 floppy disk
#  11111000	Hard disk any format
#

# CDROM Filesystems
32769    string    CD001     ISO 9660 CD-ROM filesystem data
# "application id" which appears to be used as a volume label
>32808	 string    >\0       '%s'
>34816	 string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
37633    string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
32776    string    CDROM     High Sierra CD-ROM filesystem data

# cramfs filesystem - russell@coker.com.au
0       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
>4      lelong  x size %d
>8      lelong  &1 version #2
>8      lelong  &2 sorted_dirs
>8      lelong  &4 hole_support
>32     lelong  x CRC 0x%x,
>36     lelong  x edition %d,
>40     lelong  x %d blocks,
>44     lelong  x %d files

0       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
>4      belong  x size %d
>8      belong  &1 version #2
>8      belong  &2 sorted_dirs
>8      belong  &4 hole_support
>32     belong  x CRC 0x%x,
>36     belong  x edition %d,
>40     belong  x %d blocks,
>44     belong  x %d files

# reiserfs - russell@coker.com.au
0x10034		string	ReIsErFs	ReiserFS V3.5
0x10034		string	ReIsEr2Fs	ReiserFS V3.6
>0x1002c 	leshort	x		block size %d
>0x10032	leshort	&2		(mounted or unclean)
>0x10000	lelong	x		num blocks %d
>0x10040	lelong	1		tea hash
>0x10040	lelong	2		yura hash
>0x10040	lelong	3		r5 hash

# JFFS - russell@coker.com.au
0	lelong	0x34383931	Linux Journalled Flash File system, little endian
0	belong	0x34383931	Linux Journalled Flash File system, big endian

# EST flat binary format (which isn't, but anyway)
# From: Mark Brown <broonie@sirena.org.uk>
0	string	ESTFBINR	EST flat binary

# Aculab VoIP firmware
# From: Mark Brown <broonie@sirena.org.uk>
0	string	VoIP\ Startup\ and	Aculab VoIP firmware
>35	string	x	format %s

# PPCBoot image file
# From: Mark Brown <broonie@sirena.org.uk>
0	belong	0x27051956	PPCBoot image
>4	string  PPCBoot
>>12	string  x		version %s

# JFFS2 file system
0       leshort         0x1984                  Linux old jffs2 filesystem data little endian
0       lelong          0xe0011985              Linux jffs2 filesystem data little endian
#	$OpenBSD: flash,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# flash:	file(1) magic for Macromedia Flash file format
#
# See
#
#	http://www.macromedia.com/software/flash/open/
#
0	string		FWS		Macromedia Flash data,
>3	byte		x		version %d
0	string		CWS		Macromedia Flash data (compressed),
>3	byte		x		version %d
#
# From Dave Wilson
0	string AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
#	$OpenBSD: fonts,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# fonts:  file(1) magic for font data
#
0	string		FONT		ASCII vfont text
0	short		0436		Berkeley vfont data
0	short		017001		byte-swapped Berkeley vfont data

# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
0	string		%!PS-AdobeFont-1.	PostScript Type 1 font text
>20	string		>\0			(%s)
6	string		%!PS-AdobeFont-1.	PostScript Type 1 font program data

# X11 font files in SNF (Server Natural Format) format
0	belong		00000004		X11 SNF font data, MSB first
0	lelong		00000004		X11 SNF font data, LSB first

# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		STARTFONT\040		X11 BDF font text

# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
0	string		\001fcp			X11 Portable Compiled Font data
>12	byte		0x02			\b, LSB first
>12	byte		0x0a			\b, MSB first
0	string		D1.0\015		X11 Speedo font data

#------------------------------------------------------------------------------
# FIGlet fonts and controlfiles
# From figmagic supplied with Figlet version 2.2
# "David E. O'Brien" <obrien@FreeBSD.ORG>
0	string		flf		FIGlet font
>3	string		>2a		version %-2.2s
0	string		flc		FIGlet controlfile
>3	string		>2a		version %-2.2s

# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
0	belong		0x14025919	libGrx font data,
>8	leshort		x		%dx
>10	leshort		x		\b%d
>40	string		x		%s
# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
0	belong		0xff464f4e	DOS code page font data collection
7	belong		0x00454741	DOS code page font data
7	belong		0x00564944	DOS code page font data (from Linux?)
4098	string		DOSFONT		DOSFONT2 encrypted font data

# downloadable fonts for browser (prints type) anthon@mnt.org
0	string		PFR1		PFR1 font
>102	string		>0		\b: %s

# True Type fonts
0	string	\000\001\000\000\000	TrueType font data

0	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
0	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font

# Opentype font data from Avi Bercovich
0	string		OTTO		OpenType font data 

#	$OpenBSD: frame,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# frame:  file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0	string		\<MakerFile	FrameMaker document
>11	string		5.5		 (5.5
>11	string		5.0		 (5.0
>11	string		4.0		 (4.0
>11	string		3.0		 (3.0
>11	string		2.0		 (2.0
>11	string		1.0		 (1.0
>14	byte		x		  %c)
0	string		\<MIFFile	FrameMaker MIF (ASCII) file
>9	string		4.0		 (4.0)
>9	string		3.0		 (3.0)
>9	string		2.0		 (2.0)
>9	string		1.0		 (1.x)
0	string		\<MakerDictionary	FrameMaker Dictionary text
>17	string		3.0		 (3.0)
>17	string		2.0		 (2.0)
>17	string		1.0		 (1.x)
0	string		\<MakerScreenFont	FrameMaker Font file
>17	string		1.01		 (%s)
0	string		\<MML		FrameMaker MML file
0	string		\<BookFile	FrameMaker Book file
>10	string		3.0		 (3.0
>10	string		2.0		 (2.0
>10	string		1.0		 (1.0
>13	byte		x		  %c)
# XXX - this book entry should be verified, if you find one, uncomment this
#0	string		\<Book\ 	FrameMaker Book (ASCII) file
#>6	string		3.0		 (3.0)
#>6	string		2.0		 (2.0)
#>6	string		1.0		 (1.0)
0	string		\<Maker	Intermediate Print File	FrameMaker IPL file
#	$OpenBSD: freebsd,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# freebsd:  file(1) magic for FreeBSD objects
#
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
# little-endian on x86).
#
# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
# schemes for distinguishing between executable images, shared libraries,
# and object files.
#
# FreeBSD says:
#
#    Regardless of whether it's pure, demand-paged, or none of the
#    above:
#
#	if the entry point is < 4096, then it's a shared library if
#	the "has run-time loader information" bit is set, and is
#	position-independent if the "is position-independent" bit
#	is set;
#
#	if the entry point is >= 4096 (or >4095, same thing), then it's
#	an executable, and is dynamically-linked if the "has run-time
#	loader information" bit is set.
#
# On x86, NetBSD says:
#
#    If it's neither pure nor demand-paged:
#
#	if it has the "has run-time loader information" bit set, it's
#	a dynamically-linked executable;
#
#	if it doesn't have that bit set, then:
#
#	    if it has the "is position-independent" bit set, it's
#	    position-independent;
#
#	    if the entry point is non-zero, it's an executable, otherwise
#	    it's an object file.
#
#    If it's pure:
#
#	if it has the "has run-time loader information" bit set, it's
#	a dynamically-linked executable, otherwise it's just an
#	executable.
#
#    If it's demand-paged:
#
#	if it has the "has run-time loader information" bit set,
#	then:
#
#	    if the entry point is < 4096, it's a shared library;
#
#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
#	    it's a dynamically-linked executable);
#
#	if it doesn't have the "has run-time loader information" bit
#	set, then it's just an executable.
#
# (On non-x86, NetBSD does much the same thing, except that it uses
# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
# had 8K pages; dunno about MIPS.)
#
# I suspect the two will differ only in perverse and uninteresting cases
# ("shared" libraries that aren't demand-paged and whose pages probably
# won't actually be shared, executables with entry points <4096).
#
# I leave it to those more familiar with FreeBSD and NetBSD to figure out
# what the right answer is (although using ">4095", FreeBSD-style, is
# probably better than separately checking for "=4096" and ">4096",
# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
# executables using the NetBSD technique.)
#
0	lelong&0377777777	041400407	FreeBSD/i386
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400410	FreeBSD/i386 pure
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400413	FreeBSD/i386 demand paged
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

# XXX gross hack to identify core files
# cores start with a struct tss; we take advantage of the following:
# byte 7:     highest byte of the kernel stack pointer, always 0xfe
#      8/9:   kernel (ring 0) ss value, always 0x0010
#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
#      28:    low order byte of the current PTD entry, always 0 since the
#             PTD is page-aligned
#
7	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
>1039	string	>\0	from '%s'

# /var/run/ld.so.hints
# What are you laughing about?
0	lelong			011421044151	ld.so hints file (Little Endian
>4	lelong			>0		\b, version %d)
>4	belong			<=0		\b)
0	belong			011421044151	ld.so hints file (Big Endian
>4	belong			>0		\b, version %d)
>4	belong			<=0		\b)

#
# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
#
0	string	SCRSHOT_	scrshot(1) screenshot,
>8	byte	x		version %d,
>9	byte	2		%d bytes in header,
>>10	byte	x		%d chars wide by
>>11	byte	x		%d chars high
#	$OpenBSD: fsav,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# fsav:  file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@mnt.org)
0	beshort		0x1575		fsav (linux) macro virus
>8	leshort		>0		(%d-
>11	byte		>0		\b%02d-
>10	byte		>0		\b%02d)

# comment this out for now because it regognizes every file where
# the eighth character is \n
#8	byte		0x0a
#>12	byte		0x07
#>11	leshort		>0		fsav (linux) virus (%d-
#>10	byte		0		\b01-
#>10	byte		1		\b02-
#>10	byte		2		\b03-
#>10	byte		3		\b04-
#>10	byte		4		\b05-
#>10	byte		5		\b06-
#>10	byte		6		\b07-
#>10	byte		7		\b08-
#>10	byte		8		\b08-
#>10	byte		9		\b10-
#>10	byte		10		\b11-
#>10	byte		11		\b12-
#>9	byte		>0		\b%02d)
#	$OpenBSD: games,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# games:  file(1) for games

# Thomas M. Ott (ThMO)
1	string	=WAD		DOOM data,
>0	string	=I		main wad
>0	string	=P		patch wad
>0	byte	x		unknown junk

# Fabio Bonelli <fabiobonelli@libero.it>
# Quake II - III data files
0       string  IDP2        	Quake II 3D Model file,
>20     long    x               %lu skin(s),
>8      long    x               (%lu x
>12     long    x 		%lu),
>40     long    x               %lu frame(s),
>16     long    x               Frame size %lu bytes,
>24     long  	x               %lu vertices/frame,
>28     long    x            	%lu texture coordinates,
>32     long    x               %lu triangles/frame

0       string  IBSP            Quake
>4      long    0x26            II Map file (BSP)
>4      long    0x2E      	III Map file (BSP)

0       string  IDS2            Quake II SP2 sprite file

#---------------------------------------------------------------------------
# Doom and Quake
# submitted by Nicolas Patrois

# DOOM

0       string  IWAD    DOOM or DOOM ][ world
0       string  PWAD    DOOM or DOOM ][ extension world

0       string  \xcb\x1dBoom\xe6\xff\x03\x01    Boom or linuxdoom demo
# some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01

24      string  LxD\ 203        Linuxdoom save
>0      string  x       , name=%s
>44     string  x       , world=%s

# Quake

0       string  PACK    Quake I or II world or extension

#0       string  -1\x0a  Quake I demo
#>30     string  x        version %.4s
#>61     string  x        level %s       

#0       string  5\x0a   Quake I save

# The levels

# Quake 1

0	string	5\x0aIntroduction             Quake I save: start Introduction
0	string	5\x0athe_Slipgate_Complex     Quake I save: e1m1 The slipgate complex
0	string	5\x0aCastle_of_the_Damned     Quake I save: e1m2 Castle of the damned
0	string	5\x0athe_Necropolis           Quake I save: e1m3 The necropolis
0	string	5\x0athe_Grisly_Grotto        Quake I save: e1m4 The grisly grotto
0	string	5\x0aZiggurat_Vertigo         Quake I save: e1m8 Ziggurat vertigo (secret)
0	string	5\x0aGloom_Keep               Quake I save: e1m5 Gloom keep
0	string	5\x0aThe_Door_To_Chthon       Quake I save: e1m6 The door to Chthon
0	string	5\x0aThe_House_of_Chthon      Quake I save: e1m7 The house of Chthon
0	string	5\x0athe_Installation         Quake I save: e2m1 The installation
0	string	5\x0athe_Ogre_Citadel         Quake I save: e2m2 The ogre citadel
0	string	5\x0athe_Crypt_of_Decay       Quake I save: e2m3 The crypt of decay (dopefish lives!)
0	string	5\x0aUnderearth               Quake I save: e2m7 Underearth (secret)
0	string	5\x0athe_Ebon_Fortress        Quake I save: e2m4 The ebon fortress
0	string	5\x0athe_Wizard's_Manse       Quake I save: e2m5 The wizard's manse
0	string	5\x0athe_Dismal_Oubliette     Quake I save: e2m6 The dismal oubliette
0	string	5\x0aTermination_Central      Quake I save: e3m1 Termination central
0	string	5\x0aVaults_of_Zin            Quake I save: e3m2 Vaults of Zin
0	string	5\x0athe_Tomb_of_Terror       Quake I save: e3m3 The tomb of terror
0	string	5\x0aSatan's_Dark_Delight     Quake I save: e3m4 Satan's dark delight
0	string	5\x0athe_Haunted_Halls        Quake I save: e3m7 The haunted halls (secret)
0	string	5\x0aWind_Tunnels             Quake I save: e3m5 Wind tunnels
0	string	5\x0aChambers_of_Torment      Quake I save: e3m6 Chambers of torment
0	string	5\x0athe_Sewage_System        Quake I save: e4m1 The sewage system
0	string	5\x0aThe_Tower_of_Despair     Quake I save: e4m2 The tower of despair
0	string	5\x0aThe_Elder_God_Shrine     Quake I save: e4m3 The elder god shrine
0	string	5\x0athe_Palace_of_Hate       Quake I save: e4m4 The palace of hate
0	string	5\x0aHell's_Atrium            Quake I save: e4m5 Hell's atrium
0	string	5\x0athe_Nameless_City        Quake I save: e4m8 The nameless city (secret)
0	string	5\x0aThe_Pain_Maze            Quake I save: e4m6 The pain maze
0	string	5\x0aAzure_Agony              Quake I save: e4m7 Azure agony
0	string	5\x0aShub-Niggurath's_Pit     Quake I save: end Shub-Niggurath's pit

# Quake DeathMatch levels

0	string	5\x0aPlace_of_Two_Deaths	 Quake I save: dm1 Place of two deaths
0	string	5\x0aClaustrophobopolis		 Quake I save: dm2 Claustrophobopolis
0	string	5\x0aThe_Abandoned_Base		 Quake I save: dm3 The abandoned base
0	string	5\x0aThe_Bad_Place		 Quake I save: dm4 The bad place
0	string	5\x0aThe_Cistern		 Quake I save: dm5 The cistern
0	string	5\x0aThe_Dark_Zone		 Quake I save: dm6 The dark zone

# Scourge of Armagon

0	string	5\x0aCommand_HQ               Quake I save: start Command HQ
0	string	5\x0aThe_Pumping_Station      Quake I save: hip1m1 The pumping station
0	string	5\x0aStorage_Facility         Quake I save: hip1m2 Storage facility
0	string	5\x0aMilitary_Complex         Quake I save: hip1m5 Military complex (secret)
0	string	5\x0athe_Lost_Mine            Quake I save: hip1m3 The lost mine
0	string	5\x0aResearch_Facility        Quake I save: hip1m4 Research facility
0	string	5\x0aAncient_Realms           Quake I save: hip2m1 Ancient realms
0	string	5\x0aThe_Gremlin's_Domain     Quake I save: hip2m6 The gremlin's domain (secret)
0	string	5\x0aThe_Black_Cathedral      Quake I save: hip2m2 The black cathedral
0	string	5\x0aThe_Catacombs            Quake I save: hip2m3 The catacombs
0	string	5\x0athe_Crypt__              Quake I save: hip2m4 The crypt
0	string	5\x0aMortum's_Keep            Quake I save: hip2m5 Mortum's keep
0	string	5\x0aTur_Torment              Quake I save: hip3m1 Tur torment
0	string	5\x0aPandemonium              Quake I save: hip3m2 Pandemonium
0	string	5\x0aLimbo                    Quake I save: hip3m3 Limbo
0	string	5\x0athe_Edge_of_Oblivion     Quake I save: hipdm1 The edge of oblivion (secret)
0	string	5\x0aThe_Gauntlet             Quake I save: hip3m4 The gauntlet
0	string	5\x0aArmagon's_Lair           Quake I save: hipend Armagon's lair

# Malice

0	string	5\x0aThe_Academy      Quake I save: start The academy
0	string	5\x0aThe_Lab          Quake I save: d1 The lab
0	string	5\x0aArea_33          Quake I save: d1b Area 33
0	string	5\x0aSECRET_MISSIONS  Quake I save: d3b Secret missions
0	string	5\x0aThe_Hospital     Quake I save: d10 The hospital (secret)
0	string	5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
0	string	5\x0aBACK_2_MALICE    Quake I save: d4b Back to Malice
0	string	5\x0aArea44           Quake I save: d1c Area 44
0	string	5\x0aTakahiro_Towers  Quake I save: d2 Takahiro towers
0	string	5\x0aA_Rat's_Life     Quake I save: d3 A rat's life
0	string	5\x0aInto_The_Flood   Quake I save: d4 Into the flood
0	string	5\x0aThe_Flood        Quake I save: d5 The flood
0	string	5\x0aNuclear_Plant    Quake I save: d6 Nuclear plant
0	string	5\x0aThe_Incinerator_Plant    Quake I save: d7 The incinerator plant
0	string	5\x0aThe_Foundry              Quake I save: d7b The foundry
0	string	5\x0aThe_Underwater_Base      Quake I save: d8 The underwater base
0	string	5\x0aTakahiro_Base            Quake I save: d9 Takahiro base
0	string	5\x0aTakahiro_Laboratories    Quake I save: d12 Takahiro laboratories
0	string	5\x0aStayin'_Alive    Quake I save: d13 Stayin' alive
0	string	5\x0aB.O.S.S._HQ      Quake I save: d14 B.O.S.S. HQ
0	string	5\x0aSHOWDOWN!        Quake I save: d15 Showdown!

# Malice DeathMatch levels

0	string	5\x0aThe_Seventh_Precinct	 Quake I save: ddm1 The seventh precinct
0	string	5\x0aSub_Station		 Quake I save: ddm2 Sub station
0	string	5\x0aCrazy_Eights!		 Quake I save: ddm3 Crazy eights!
0	string	5\x0aEast_Side_Invertationa	 Quake I save: ddm4 East side invertationa
0	string	5\x0aSlaughterhouse		 Quake I save: ddm5 Slaughterhouse
0	string	5\x0aDOMINO			 Quake I save: ddm6 Domino
0	string	5\x0aSANDRA'S_LADDER		 Quake I save: ddm7 Sandra's ladder


0	string	MComprHD	MAME CHD compressed hard disk image,
>12	belong	x		version %lu
#	$OpenBSD: gcc,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# gcc:  file(1) magic for GCC special files
#
0	string		gpch		GCC precompiled header

# The version field is annoying.  It's 3 characters, not zero-terminated.
>5	byte		x			(version %c
>6	byte		x			\b%c
>7	byte		x			\b%c)

# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
>4	byte		67			for C
>4	byte		111			for Objective C
>4	byte		43			for C++
>4	byte		79			for Objective C++
#	$OpenBSD: gimp,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# GIMP Gradient: file(1) magic for the GIMP's gradient data files
# by Federico Mena <federico@nuclecu.unam.mx>

0       string          GIMP\ Gradient  GIMP gradient data

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the XCF image format used in the GIMP developed
#       by Spencer Kimball and Peter Mattis
#       ('Bucky' LaDieu, nega@vt.edu)

0	string		gimp\ xcf	GIMP XCF image data,
>9	string		file		version 0,
>9	string		v		version
>>10	string		>\0		%s,
>14	belong		x		%lu x
>18	belong		x		%lu,
>22     belong          0               RGB Color
>22     belong          1               Greyscale
>22     belong          2               Indexed Color
>22	belong		>2		Unknown Image Type.

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the patterns used in the GIMP, developed
#       by Spencer Kimball and Peter Mattis
#       ('Bucky' LaDieu, nega@vt.edu)

20      string          GPAT            GIMP pattern data,
>24     string          x               %s

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the brushes used in the GIMP, developed
#       by Spencer Kimball and Peter Mattis
#       ('Bucky' LaDieu, nega@vt.edu)

20      string          GIMP            GIMP brush data
#	$OpenBSD: gnu,v 1.1 2004/06/03 03:14:20 tedu Exp $

#
# GNU nlsutils message catalog file format
#
0	string		\336\22\4\225	GNU message catalog (little endian),
>4	lelong		x		revision %d,
>8	lelong		x		%d messages
0	string		\225\4\22\336	GNU message catalog (big endian),
>4	belong		x		revision %d,
>8	belong		x		%d messages
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0	string		*nazgul*	Nazgul style compiled message catalog
>8	lelong		>0		\b, version %ld
# GnuPG
# The format is very similar to pgp
0	string          \001gpg                 GPG key trust database
>4	byte            x                       version %d
0       beshort         0x9901                  GPG key public ring
# This magic is not particularly good, as the keyrings don't have true
# magic. Nevertheless, it covers many keyrings.

# Gnumeric spreadsheet
# This entry is only semi-helpful, as Gnumeric compresses its files, so
# they will ordinarily reported as "compressed", but at least -z helps
39      string          =<gmr:Workbook           Gnumeric spreadsheet

#------------------------------------------------------------------------------
# gcc:  file(1) magic for GCC special files
#
0       string          gpch            GCC precompiled header

# The version field is annoying.  It's 3 characters, not zero-terminated.
>5      byte            x                       (version %c
>6      byte            x                       \b%c
>7      byte            x                       \b%c)

# 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
>4      byte            67                      for C
>4      byte            111                     for Objective C
>4      byte            43                      for C++
>4      byte            79                      for Objective C++


#	$OpenBSD: grace,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
#
# ACE/gr binary
0	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
>39	byte	>0			- version %c
# ACE/gr ascii
0	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
0	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
0	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
# Grace projects
0	string	#\ Grace\ project\ file		Grace project file
>23	string	@version\  			(version
>>32	byte	>0 				%c
>>33	string	>\0 				\b.%.2s
>>35	string	>\0 				\b.%.2s)
# ACE/gr fit description files
0	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
# end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
#	$OpenBSD: gringotts,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# gringotts:  file(1) magic for Gringotts
# http://devel.pluto.linux.it/projects/Gringotts/
# author: Germano Rizzo <mano@pluto.linux.it>
#GRG3????Y
0	string	GRG		Gringotts data file
#file format 1
>3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
#file format 2
>3	string		2		v.2, MCRYPT S2K, 
>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
>>8	byte&0x70	0x10		SERPENT crypt,
>>8	byte&0x70	0x20		TWOFISH crypt, 
>>8	byte&0x70	0x30		CAST-256 crypt,
>>8	byte&0x70	0x40		SAFER+ crypt,
>>8	byte&0x70	0x50		LOKI97 crypt,
>>8	byte&0x70	0x60		3DES crypt,
>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
>>8	byte&0x08	0x00		SHA1 hash,
>>8	byte&0x08	0x08		RIPEMD-160 hash,
>>8	byte&0x04	0x00		ZLib
>>8	byte&0x04	0x04		BZip2
>>8	byte&0x03	0x00		lvl.0
>>8	byte&0x03	0x01		lvl.3
>>8	byte&0x03	0x02		lvl.6
>>8	byte&0x03	0x03		lvl.9
#file format 3
>3	string		3		v.3, OpenPGP S2K, 
>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
>>8	byte&0x70	0x10		SERPENT crypt,
>>8	byte&0x70	0x20		TWOFISH crypt, 
>>8	byte&0x70	0x30		CAST-256 crypt,
>>8	byte&0x70	0x40		SAFER+ crypt,
>>8	byte&0x70	0x50		LOKI97 crypt,
>>8	byte&0x70	0x60		3DES crypt,
>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
>>8	byte&0x08	0x00		SHA1 hash,
>>8	byte&0x08	0x08		RIPEMD-160 hash,
>>8	byte&0x04	0x00		ZLib
>>8	byte&0x04	0x04		BZip2
>>8	byte&0x03	0x00		lvl.0
>>8	byte&0x03	0x01		lvl.3
>>8	byte&0x03	0x02		lvl.6
>>8	byte&0x03	0x03		lvl.9
#file format >3
>3	string		>3		v.%.1s (unknown details)
#	$OpenBSD: hdf,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# Hierarchical Data Format, used to facilitate scientific data exchange
# specifications at http://hdf.ncsa.uiuc.edu/

0	belong		0x0e031301	Hierarchical Data Format (version 4) data
0	string		\211HDF\r\n\032	Hierarchical Data Format (version 5) data
#	$OpenBSD: hitachi-sh,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# hitach-sh: file(1) magic for Hitachi Super-H
#
# Super-H COFF
#
0	beshort		0x0500		Hitachi SH big-endian COFF
>18	beshort&0x0002	=0x0000		object
>18	beshort&0x0002	=0x0002		executable
>18	beshort&0x0008	=0x0008		\b, stripped
>18	beshort&0x0008	=0x0000		\b, not stripped
#
0	leshort		0x0550		Hitachi SH little-endian COFF
>18	leshort&0x0002	=0x0000		object
>18	leshort&0x0002	=0x0002		executable
>18	leshort&0x0008	=0x0008		\b, stripped
>18	leshort&0x0008	=0x0000		\b, not stripped

#	$OpenBSD: hp,v 1.5 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
# big-endian as it was mostly 68K-based.
#
# I think the 500 series was the old stack-based machines, running a
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
# HP magic is useful for reference, but using "long" magic is a better
# practice in order to avoid collisions.
#
# Guy Harris (guy@netapp.com): some additions to this list came from
# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
# "/etc/magic", though, except for the "archive file relocatable library"
# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
# used in executables, or have they just not yet updated "/etc/magic"
# completely?
#
# 0	beshort		200		hp200 (68010) BSD binary
# 0	beshort		300		hp300 (68020+68881) BSD binary
# 0	beshort		0x20c		hp200/300 HP-UX binary
# 0	beshort		0x20d		hp400 (68030) HP-UX binary
# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
# 0	beshort		0x214		PA-RISC2.0 HP-UX binary

#
# The "misc" stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0	beshort		0627		Apollo m68k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0	beshort		0624		apollo a88k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0       long            01203604016     TML 0123 byte-order format
0       long            01702407010     TML 1032 byte-order format
0       long            01003405017     TML 2301 byte-order format
0       long            01602007412     TML 3210 byte-order format
#### PA-RISC
0	belong 		0x02100106	PA-RISC1.1 relocatable object
0	belong 		0x02100107	PA-RISC1.1 executable
>168	belong		&=0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x02100108	PA-RISC1.1 shared executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x0210010b	PA-RISC1.1 demand-load executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x0210010e	PA-RISC1.1 shared library
>96	belong		>0		- not stripped

0	belong 		0x0210010d	PA-RISC1.1 dynamic load library
>96	belong		>0		- not stripped

#### 800
0	belong 		0x020b0106	PA-RISC1.0 relocatable object

0	belong 		0x020b0107	PA-RISC1.0 executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b0108	PA-RISC1.0 shared executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b010b	PA-RISC1.0 demand-load executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b010e	PA-RISC1.0 shared library
>96	belong		>0		- not stripped

0	belong 		0x020b010d	PA-RISC1.0 dynamic load library
>96	belong		>0		- not stripped

0	belong		0x213c6172	archive file
>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
>68	belong 		0x02140619	- PA-RISC2.0 relocatable library

#### 500
0	long		0x02080106	HP s500 relocatable executable
>16	long		>0		- version %ld

0	long		0x02080107	HP s500 executable
>16	long		>0		- version %ld

0	long		0x02080108	HP s500 pure executable
>16	long		>0		- version %ld

#### 200
0	belong 		0x020c0108	HP s200 pure executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0107	HP s200 executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c010b	HP s200 demand-load executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0106	HP s200 relocatable executable
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>8	belong		&0x80000000	save fp regs
>8	belong		&0x20000000	debuggable
>8	belong		&0x10000000	PIC

0	belong 		0x020a0108	HP s200 (2.x release) pure executable
>4	beshort		>0		- version %ld
>36	belong		>0		not stripped

0	belong		0x020a0107	HP s200 (2.x release) executable
>4	beshort		>0		- version %ld
>36	belong		>0		not stripped

0	belong		0x020c010e	HP s200 shared library
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>36	belong		>0		not stripped

0	belong		0x020c010d	HP s200 dynamic load library
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>36	belong		>0		not stripped

#### MISC
0	long		0x0000ff65	HP old archive
0	long		0x020aff65	HP s200 old archive
0	long		0x020cff65	HP s200 old archive
0	long		0x0208ff65	HP s500 old archive

0	long		0x015821a6	HP core file

0	long		0x4da7eee8	HP-WINDOWS font
>8	byte		>0		- version %ld
0	string		Bitmapfile	HP Bitmapfile

0	string		IMGfile	CIS 	compimg HP Bitmapfile
# XXX - see "lif"
#0	beshort		0x8000		lif file
0	long		0x020c010c	compiled Lisp

0	string		msgcat01	HP NLS message catalog,
>8	long		>0		%d messages

# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
0	string		HPHP48-		HP48 binary
>7	byte		>0		- Rev %c
>8	short		0x1129		(ADR)
>8	short		0x3329		(REAL)
>8	short		0x5529		(LREAL)
>8	short		0x7729		(COMPLX)
>8	short		0x9d29		(LCOMPLX)
>8	short		0xbf29		(CHAR)
>8	short		0xe829		(ARRAY)
>8	short		0x0a2a		(LNKARRAY)
>8	short		0x2c2a		(STRING)
>8	short		0x4e2a		(HXS)
>8	short		0x742a		(LIST)
>8	short		0x962a		(DIR)
>8	short		0xb82a		(ALG)
>8	short		0xda2a		(UNIT)
>8	short		0xfc2a		(TAGGED)
>8	short		0x1e2b		(GROB)
>8	short		0x402b		(LIB)
>8	short		0x622b		(BACKUP)
>8	short		0x882b		(LIBDATA)
>8	short		0x9d2d		(PROG)
>8	short		0xcc2d		(CODE)
>8	short		0x482e		(GNAME)
>8	short		0x6d2e		(LNAME)
>8	short		0x922e		(XLIB)
0	string		%%HP:		HP48 text
>6	string		T(0)		- T(0)
>6	string		T(1)		- T(1)
>6	string		T(2)		- T(2)
>6	string		T(3)		- T(3)
>10	string		A(D)		A(D)
>10	string		A(R)		A(R)
>10	string		A(G)		A(G)
>14	string		F(.)		F(.);
>14	string		F(,)		F(,);

# hpBSD magic numbers
0	beshort		200		hp200 (68010) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary
0	beshort		300		hp300 (68020+68881) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary

#	$OpenBSD: human68k,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# human68k:  file(1) magic for Human68k (X680x0 DOS) binary formats
# Magic too short!
#0		string	HU		Human68k
#>68		string	LZX		LZX compressed
#>>72		string	>\0		(version %s)
#>(8.L+74)	string	LZX		LZX compressed
#>>(8.L+78)	string	>\0		(version %s)
#>60		belong	>0		binded
#>(8.L+66)	string	#HUPAIR		hupair
#>0		string	HU		X executable
#>(8.L+74)	string	#LIBCV1		- linked PD LIBC ver 1
#>4		belong	>0		- base address 0x%x
#>28		belong	>0		not stripped
#>32		belong	>0		with debug information
#0		beshort	0x601a		Human68k Z executable
#0		beshort	0x6000		Human68k object file
#0		belong	0xd1000000	Human68k ar binary archive
#0		belong	0xd1010000	Human68k ar ascii archive
#0		beshort	0x0068		Human68k lib archive
#4		string	LZX		Human68k LZX compressed
#>8		string	>\0		(version %s)
#>4		string	LZX		R executable
#2		string	#HUPAIR		Human68k hupair R executable
#	$OpenBSD: ibm370,v 1.4 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# ibm370:  file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
# AIX 4.1's "/etc/magic" has
#
#	0	short		0535		370 sysV executable 
#	>12	long		>0		not stripped
#	>22	short		>0		- version %d
#	>30	long		>0		- 5.2 format
#	0	short		0530		370 sysV pure executable 
#	>12	long		>0		not stripped
#	>22	short		>0		- version %d
#	>30	long		>0		- 5.2 format
#
# instead of the "USS/370" versions of the same magic numbers.
#
0	beshort		0537		370 XA sysV executable 
>12	belong		>0		not stripped
>22	beshort		>0		- version %d
>30	belong		>0		- 5.2 format
0	beshort		0532		370 XA sysV pure executable 
>12	belong		>0		not stripped
>22	beshort		>0		- version %d
>30	belong		>0		- 5.2 format
0	beshort		054001		370 sysV pure executable
>12	belong		>0		not stripped
0	beshort		055001		370 XA sysV pure executable
>12	belong		>0		not stripped
0	beshort		056401		370 sysV executable
>12	belong		>0		not stripped
0	beshort		057401		370 XA sysV executable
>12	belong		>0		not stripped
0       beshort		0531		SVR2 executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24     belong		>0		- version %ld
0	beshort		0534		SVR2 pure executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0530		SVR2 pure executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0535		SVR2 executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
#	$OpenBSD: ibm6000,v 1.4 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# ibm6000:  file(1) magic for RS/6000 and the RT PC.
#
0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
>12	belong		>0		not stripped
# Breaks sun4 statically linked execs.
#0      beshort		0x0103		executable (RT Version 2) or obj module
#>2	byte		0x50		pure
#>28	belong		>0		not stripped
#>6	beshort		>0		- version %ld
0	beshort		0x0104		shared library
0	beshort		0x0105		ctab data
0	beshort		0xfe04		structured file
0	string		0xabcdef	AIX message catalog
0	belong		0x000001f9	AIX compiled message catalog
0	string		\<aiaff>	archive
0	string		\<bigaf>	archive (big format)

#	$OpenBSD: iff,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
# Arts for file interchange.  It has also been used by Apple, SGI, and
# especially Commodore-Amiga.
#
# IFF files begin with an 8 byte FORM header, followed by a 4 character
# FORM type, which is followed by the first chunk in the FORM.

0	string		FORM		IFF data
#>4	belong		x		\b, FORM is %d bytes long
# audio formats
>8	string		AIFF		\b, AIFF audio
>8	string		AIFC		\b, AIFF-C compressed audio
>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
>8	string		SAMP		\b, SAMP sampled audio
>8	string		DTYP		\b, DTYP datatype description
>8	string		PTCH		\b, PTCH binary patch
# image formats
>8	string		ILBMBMHD	\b, ILBM interleaved image
>>20	beshort		x		\b, %d x
>>22	beshort		x		%d
>8	string		RGBN		\b, RGBN 12-bit RGB image
>8	string		RGB8		\b, RGB8 24-bit RGB image
>8	string		DR2D		\b, DR2D 2-D object
>8	string		TDDD		\b, TDDD 3-D rendering
# other formats
>8	string		FTXT		\b, FTXT formatted text
#	$OpenBSD: images,v 1.8 2005/01/31 17:21:13 espie Exp $

#------------------------------------------------------------------------------
# images:  file(1) magic for image formats (see also "iff")
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# little magic: PCX (first byte is 0x0a)

# Targa - matches `povray', `ppmtotga' and `xv' outputs
# by Philippe De Muyter <phdm@macqel.be>
# at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
# at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
# at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
# `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
# `tgatoppm' recognizes a superset (Index may be anything)
1	belong&0xfff7ffff	0x01010000	Targa image data - Map
>2	byte&8			8		- RLE
>12	leshort			>0		%hd x
>14	leshort			>0		%hd
1	belong&0xfff7ffff	0x00020000	Targa image data - RGB
>2	byte&8			8		- RLE
>12	leshort			>0		%hd x
>14	leshort			>0		%hd
1	belong&0xfff7ffff	0x00030000	Targa image data - Mono
>2	byte&8			8		- RLE
>12	leshort			>0		%hd x
>14	leshort			>0		%hd

# PBMPLUS images
# The next byte following the magic is always whitespace.
0	string		P1		Netpbm PBM image text
0	string		P2		Netpbm PGM image text
0	string		P3		Netpbm PPM image text
0	string		P4		Netpbm PBM "rawbits" image data
0	string		P5		Netpbm PGM "rawbits" image data
0	string		P6		Netpbm PPM "rawbits" image data
0	string		P7		Netpbm PAM image file

# From: bryanh@giraffe-data.com (Bryan Henderson)
0	string		\117\072	Solitaire Image Recorder format
>4	string		\013		MGI Type 11
>4	string		\021		MGI Type 17
0	string		.MDA		MicroDesign data
>21	byte		48		version 2
>21	byte		51		version 3
0	string		.MDP		MicroDesign page data
>21	byte		48		version 2
>21	byte		51		version 3

# NIFF (Navy Interchange File Format, a modification of TIFF) images
0	string		IIN1		NIFF image data

# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
# The second word of TIFF files is the TIFF version number, 42, which has
# never changed.  The TIFF specification recommends testing for it.
0	string		MM\x00\x2a	TIFF image data, big-endian
0	string		II\x2a\x00	TIFF image data, little-endian

# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt@uchicago.edu)
# (Albert Cahalan, acahalan@cs.uml.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
#
0	string		\x89PNG		PNG image data,
>4	belong		!0x0d0a1a0a	CORRUPTED,
>4	belong		0x0d0a1a0a
>>16	belong		x		%ld x
>>20	belong		x		%ld,
>>24	byte		x		%d-bit
>>25	byte		0		grayscale,
>>25	byte		2		\b/color RGB,
>>25	byte		3		colormap,
>>25	byte		4		gray+alpha,
>>25	byte		6		\b/color RGBA,
#>>26	byte		0		deflate/32K,
>>28	byte		0		non-interlaced
>>28	byte		1		interlaced
1	string		PNG		PNG image data, CORRUPTED

# GIF
0	string		GIF8		GIF image data
>4	string		7a		\b, version 8%s,
>4	string		9a		\b, version 8%s,
>6	leshort		>0		%hd x
>8	leshort		>0		%hd
#>10	byte		&0x80		color mapped,
#>10	byte&0x07	=0x00		2 colors
#>10	byte&0x07	=0x01		4 colors
#>10	byte&0x07	=0x02		8 colors
#>10	byte&0x07	=0x03		16 colors
#>10	byte&0x07	=0x04		32 colors
#>10	byte&0x07	=0x05		64 colors
#>10	byte&0x07	=0x06		128 colors
#>10	byte&0x07	=0x07		256 colors

# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
# 1 plane, no encoding.
0	string		\361\0\100\273	CMU window manager raster image data
>4	lelong		>0		%d x
>8	lelong		>0		%d,
>12	lelong		>0		%d-bit

# Magick Image File Format
0	string		id=ImageMagick	MIFF image data

# Artisan
0	long		1123028772	Artisan image data
>4	long		1		\b, rectangular 24-bit
>4	long		2		\b, rectangular 8-bit with colormap
>4	long		3		\b, rectangular 32-bit (24-bit with matte)

# FIG (Facility for Interactive Generation of figures), an object-based format
0	string		#FIG		FIG image text
>5	string		x		\b, version %.3s

# PHIGS
0	string		ARF_BEGARF		PHIGS clear text archive
0	string		@(#)SunPHIGS		SunPHIGS
# version number follows, in the form m.n
>40	string		SunBin			binary
>32	string		archive			archive

# GKS (Graphics Kernel System)
0	string		GKSM		GKS Metafile
>24	string		SunGKS		\b, SunGKS

# CGM image files
0	string		BEGMF		clear text Computer Graphics Metafile
# XXX - questionable magic
0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
0	beshort		0x3020		character Computer Graphics Metafile

# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
0	string	yz	MGR bitmap, modern format, 8-bit aligned
0	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
0	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
0	string	yx	MGR bitmap, modern format, squeezed

# Fuzzy Bitmap (FBM) images
0	string		%bitmap\0	FBM image data
>30	long		0x31		\b, mono
>30	long		0x33		\b, color

# facsimile data
1	string		PC\ Research,\ Inc	group 3 fax data
>29	byte		0		\b, normal resolution (204x98 DPI)
>29	byte		1		\b, fine resolution (204x196 DPI)
# From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
0	string		Sfff		structured fax file


# PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
0	string		BM		PC bitmap data
>14	leshort		12		\b, OS/2 1.x format
>>18	leshort		x		\b, %d x
>>20	leshort		x		%d
>14	leshort		64		\b, OS/2 2.x format
>>18	leshort		x		\b, %d x
>>20	leshort		x		%d
>14	leshort		40		\b, Windows 3.x format
>>18	lelong		x		\b, %d x
>>22	lelong		x		%d x
>>28	leshort		x		%d
# Too simple - MPi
#0	string		IC		PC icon data
#0	string		PI		PC pointer image data
#0	string		CI		PC color icon data
#0	string		CP		PC color pointer image data
# Conflicts with other entries [BABYL]
#0	string		BA		PC bitmap array data

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# note possible collision with C/REXX entry in c-lang; currently commented out
0	string		/*\ XPM\ */	X pixmap image text

# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
0	leshort		0xcc52		RLE image data,
>6	leshort		x		%d x
>8	leshort		x		%d
>2	leshort		>0		\b, lower left corner: %d
>4	leshort		>0		\b, lower right corner: %d
>10	byte&0x1	=0x1		\b, clear first
>10	byte&0x2	=0x2		\b, no background
>10	byte&0x4	=0x4		\b, alpha channel
>10	byte&0x8	=0x8		\b, comment
>11	byte		>0		\b, %d color channels
>12	byte		>0		\b, %d bits per pixel
>13	byte		>0		\b, %d color map channels

# image file format (Robert Potter, potter@cs.rochester.edu)
0	string		Imagefile\ version-	iff image data
# this adds the whole header (inc. version number), informative but longish
>10	string		>\0		%s

# Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
0	belong		0x59a66a95	Sun raster image data
>4	belong		>0		\b, %d x
>8	belong		>0		%d,
>12	belong		>0		%d-bit,
#>16	belong		>0		%d bytes long,
>20	belong		0		old format,
#>20	belong		1		standard,
>20	belong		2		compressed,
>20	belong		3		RGB,
>20	belong		4		TIFF,
>20	belong		5		IFF,
>20	belong		0xffff		reserved for testing,
>24	belong		0		no colormap
>24	belong		1		RGB colormap
>24	belong		2		raw colormap
#>28	belong		>0		colormap is %d bytes long

# SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# See
#	http://reality.sgi.com/grafica/sgiimage.html
#
0	beshort		474		SGI image data
#>2	byte		0		\b, verbatim
>2	byte		1		\b, RLE
#>3	byte		1		\b, normal precision
>3	byte		2		\b, high precision
>4	beshort		x		\b, %d-D
>6	beshort		x		\b, %d x
>8	beshort		x		%d
>10	beshort		x		\b, %d channel
>10	beshort		!1		\bs
>80	string		>0		\b, "%s"

0	string		IT01		FIT image data
>4	belong		x		\b, %d x
>8	belong		x		%d x
>12	belong		x		%d
#
0	string		IT02		FIT image data
>4	belong		x		\b, %d x
>8	belong		x		%d x
>12	belong		x		%d
#
2048	string		PCD_IPI		Kodak Photo CD image pack file
>0xe02	byte&0x03	0x00		, landscape mode
>0xe02	byte&0x03	0x01		, portrait mode
>0xe02	byte&0x03	0x02		, landscape mode
>0xe02	byte&0x03	0x03		, portrait mode
0	string		PCD_OPA		Kodak Photo CD overview pack file

# FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
# FITS is the Flexible Image Transport System, the de facto standard for
# data and image transfer, storage, etc., for the astronomical community.
# (FITS floating point formats are big-endian.)
0	string	SIMPLE\ \ =	FITS image data
>109	string	8		\b, 8-bit, character or unsigned binary integer
>108	string	16		\b, 16-bit, two's complement binary integer
>107	string	\ 32		\b, 32-bit, two's complement binary integer
>107	string	-32		\b, 32-bit, floating point, single precision
>107	string	-64		\b, 64-bit, floating point, double precision

# other images
0	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
0	string		!!		Bennet Yee's "face" format

# From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
# stuff.
#
0	beshort		0x1010		PEX Binary Archive

# Visio drawings
03000	string	Visio\ (TM)\ Drawing	%s

# Tgif files
0	string	\%TGIF\ x 		Tgif file version %s

# DICOM medical imaging data
128	string	DICM			DICOM medical imaging data

# XWD - X Window Dump file.
#   As described in /usr/X11R6/include/X11/XWDFile.h
#   used by the xwd program.
#   Bradford Castalia, idaeim, 1/01
4	belong	7			XWD X Window Dump image data
>100	string	>\0			\b, "%s"
>16	belong	x			\b, %dx
>20	belong	x			\b%dx
>12	belong	x			\b%d

# PDS - Planetary Data System
#   These files use Parameter Value Language in the header section.
#   Unfortunately, there is no certain magic, but the following
#   strings have been found to be most likely.
0	string	NJPL1I00		PDS (JPL) image data
2	string	NJPL1I			PDS (JPL) image data
0	string	CCSD3ZF			PDS (CCSD) image data
2	string	CCSD3Z			PDS (CCSD) image data
0	string	PDS_			PDS image data
0	string	LBLSIZE=		PDS (VICAR) image data

# pM8x: ATARI STAD compressed bitmap format
#
# from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
# p M 8 5/6 xx yy zz data...
# Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
# bytes either run horizontally (pM85) or vertically (pM86). yy is the
# most frequent byte, xx and zz are runlength escape codes, where xx is
# used for runs of yy.
#
0	string	pM85		Atari ST STAD bitmap image data (hor)
>5	byte	0x00		(white background)
>5	byte	0xFF		(black background)
0	string	pM86		Atari ST STAD bitmap image data (vert)
>5	byte	0x00		(white background)
>5	byte	0xFF		(black background)

# XXX:
# This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
# magic.
# SGI RICE image file <mpruett@sgi.com>
#0	beshort	0x5249		RICE image
#>2	beshort	x		v%d
#>4	beshort	x		(%d x
#>6	beshort	x		%d)
#>8	beshort	0		8 bit
#>8	beshort	1		10 bit
#>8	beshort	2		12 bit
#>8	beshort	3		13 bit
#>10	beshort	0		4:2:2
#>10	beshort	1		4:2:2:4
#>10	beshort	2		4:4:4
#>10	beshort	3		4:4:4:4
#>12	beshort	1		RGB
#>12	beshort	2		CCIR601
#>12	beshort	3		RP175
#>12	beshort	4		YUV

#------------------------------------------------------------------------------
#
# Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image  file format
# for the EPOC operating system, which is used with PDAs like those from Psion
#
# see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description
# of various EPOC file formats

0	string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file

# PCX image files
# From: Dan Fandrich <dan@coneharvesters.com>
0	beshort		0x0a00	PCX ver. 2.5 image data
0	beshort		0x0a02	PCX ver. 2.8 image data, with palette
0	beshort		0x0a03	PCX ver. 2.8 image data, without palette
0	beshort		0x0a04	PCX for Windows image data
0	beshort		0x0a05	PCX ver. 3.0 image data
>4	leshort		x      bounding box [%hd,
>6	leshort		x      %hd] -
>8	leshort		x      [%hd,
>10	leshort		x      %hd],
>65	byte		>1	%d planes each of
>3	byte		x	%hhd-bit
>68	byte		0	image,
>68	byte		1	colour,
>68	byte		2	grayscale,
>68	byte		>2	image,
>68	byte		<0	image,
>12	leshort		>0	%hd x
>>14	leshort		x      %hd dpi,
>2	byte		0	uncompressed
>2	byte		1	RLE compressed

# Adobe Photoshop
0	string		8BPS Adobe Photoshop Image

# XV thumbnail indicator (ThMO)
0	string		P7\ 332		XV thumbnail image data

# NITF is defined by United States MIL-STD-2500A
0	string	NITF	National Imagery Transmission Format
>25	string	>\0	dated %.14s

# GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
0	belong		0x00010008	GEM Image data
>12	beshort		x		%d x
>14	beshort		x		%d,
>4	beshort		x		%d planes,
>8	beshort		x		%d x
>10	beshort		x		%d pixelsize

# GEM Metafile (Wolfram Kleff)
0	lelong		0x0018FFFF	GEM Metafile data
>4	leshort		x		version %d

#
# SMJPEG. A custom Motion JPEG format used by Loki Entertainment
# Software Torbjorn Andersson <d91tan@Update.UU.SE>.
#
0	string	\0\nSMJPEG	SMJPEG
>8	belong	x		%d.x data
# According to the specification you could find any number of _TXT
# headers here, but I can't think of any way of handling that. None of
# the SMJPEG files I tried it on used this feature. Even if such a
# file is encountered the output should still be reasonable.
>16	string	_SND		\b,
>>24	beshort	>0		%d Hz
>>26	byte	8		8-bit
>>26	byte	16		16-bit
>>28	string	NONE		uncompressed
# >>28	string	APCM		ADPCM compressed
>>27	byte	1		mono
>>28	byte	2		stereo
# Help! Isn't there any way to avoid writing this part twice?
>>32	string	_VID		\b,
# >>>48	string	JFIF		JPEG
>>>40	belong	>0		%d frames
>>>44	beshort	>0		(%d x
>>>46	beshort	>0		%d)
>16	string	_VID		\b,
# >>32	string	JFIF		JPEG
>>24	belong	>0		%d frames
>>28	beshort	>0		(%d x
>>30	beshort	>0		%d)

0	string	Paint\ Shop\ Pro\ Image\ File	Paint Shop Pro Image File

# "thumbnail file" (icon)
# descended from "xv", but in use by other applications as well (Wolfram Kleff)
0       string          P7\ 332         XV "thumbnail file" (icon) data

# taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
0       string          KiSS            KISS/GS
>4      byte            16              color
>>5     byte            x               %d bit
>>8     leshort         x               %d colors
>>10    leshort         x               %d groups
>4      byte            32              cell
>>5     byte            x               %d bit
>>8     leshort         x               %d x
>>10    leshort         x               %d
>>12    leshort         x               +%d
>>14    leshort         x               +%d

# Webshots (www.webshots.com), by John Harrison
0       string          C\253\221g\230\0\0\0 Webshots Desktop .wbz file

# Hercules DASD image files
# From Jan Jaeger <jj@septa.nl>
0       string  CKD_P370        Hercules CKD DASD image file
>8      long    x               \b, %d heads per cylinder
>12     long    x               \b, track size %d bytes
>16     byte    x               \b, device type 33%2.2X

0       string  CKD_C370        Hercules compressed CKD DASD image file
>8      long    x               \b, %d heads per cylinder
>12     long    x               \b, track size %d bytes
>16     byte    x               \b, device type 33%2.2X

0       string  CKD_S370        Hercules CKD DASD shadow file
>8      long    x               \b, %d heads per cylinder
>12     long    x               \b, track size %d bytes
>16     byte    x               \b, device type 33%2.2X

# Squeak images and - etoffi@softhome.net
0 string \146\031\0\0  Squeak image data
0 string 'From\040Squeak  Squeak program text

# partimage: file(1) magic for PartImage files (experimental, incomplete)
# Author: Hans-Joachim Baader <hjb@pro-linux.de>
0		string	PaRtImAgE-VoLuMe	PartImage
>0x0020		string	0.6.1		file version %s
>>0x0060	lelong	>-1		volume %ld
#>>0x0064 8 byte identifier
#>>0x007c reserved
>>0x0200	string	>\0		type %s
>>0x1400	string	>\0		device %s,
>>0x1600	string	>\0		original filename %s,
# Some fields omitted
>>0x2744	lelong	0		not compressed
>>0x2744	lelong	1		gzip compressed
>>0x2744	lelong	2		bzip2 compressed
>>0x2744	lelong	>2		compressed with unknown algorithm
>0x0020		string	>0.6.1		file version %s
>0x0020		string	<0.6.1		file version %s

# DCX is multi-page PCX, using a simple header of up to 1024
# offsets for the respective PCX components.
# From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
0	lelong	987654321	DCX multi-page PCX image data

# Simon Walton <simonw@matteworld.com>
# Kodak Cineon format for scanned negatives
# http://www.kodak.com/US/en/motion/support/dlad/
0	lelong  0xd75f2a80	Cineon image data
>200	belong  >0		\b, %ld x
>204	belong  >0		%ld


# Bio-Rad .PIC is an image format used by microscope control systems
# and related image processing software used by biologists.
# From: Vebjorn Ljosa <vebjorn@ljosa.com>
54	leshort 12345		Bio-Rad .PIC Image File
>0	leshort >0		%hd x
>2	leshort >0		%hd,
>4	leshort =1		1 image in file
>4	leshort >1		%hd images in file

# From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
# The description of *.mrw format can be found at
# http://www.dalibor.cz/minolta/raw_file_format.htm
0	string	\000MRM			Minolta Dimage camera raw image data

# From: stephane.loeuillet@tiscali.f
# http://www.djvuzone.org/
0	string	AT&TFORM		DjVu Image file

# From: Jason Bacon <bacon@smithers.neuro.mcw.edu>
0	beshort	0x3020			character Computer Graphics Metafile

0	lelong	20000630		OpenEXR image data
#	$OpenBSD: intel,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# intel:  file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
# Windows as well.
#
# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
# as well, if, as, and when IBM makes it portable.
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0	leshort		0502		basic-16 executable
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		0503		basic-16 executable (TV)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		0510		x86 executable
>12	lelong		>0		not stripped
0	leshort		0511		x86 executable (TV)
>12	lelong		>0		not stripped
0	leshort		=0512		iAPX 286 executable small model (COFF)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		=0522		iAPX 286 executable large model (COFF)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0	leshort		=0514		80386 COFF executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld

# rom: file(1) magic for BIOS ROM Extensions found in intel machines
#      mapped into memory between 0xC0000 and 0xFFFFF
# From Gürkan Sengün <gurkan@linuks.mine.nu>, www.linuks.mine.nu
0        beshort         0x55AA       BIOS (ia32) ROM Ext.
>5       string          USB          USB
>7       string          LDR          UNDI image
>30      string          IBM          IBM comp. Video
>26      string          Adaptec      Adaptec
>28      string          Adaptec      Adaptec
>42      string          PROMISE      Promise
>2       byte            x            (%d*512)
#	$OpenBSD: interleaf,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# interleaf:  file(1) magic for InterLeaf TPS:
#
0	string		=\210OPS	Interleaf saved data
0	string		=<!OPS		Interleaf document text
>5	string		,\ Version\ =	\b, version
>>17	string		>\0		%.3s
#	$OpenBSD: island,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
# "/etc/magic":
# From: guy@netapp.com (Guy Harris)
#
4	string		pgscriptver	IslandWrite document
13	string		DrawFile	IslandDraw document

#	$OpenBSD: ispell,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# ispell:  file(1) magic for ispell
#
# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
# will match 0x9600 through 0x9603 in *both* little endian and big endian.
# (No other current magic entries collide.)
#
# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
#
0	leshort&0xFFFC	0x9600		little endian ispell
>0	byte		0		hash file (?),
>0	byte		1		3.0 hash file,
>0	byte		2		3.1 hash file,
>0	byte		3		hash file (?),
>2	leshort		0x00		8-bit, no capitalization, 26 flags
>2	leshort		0x01		7-bit, no capitalization, 26 flags
>2	leshort		0x02		8-bit, capitalization, 26 flags
>2	leshort		0x03		7-bit, capitalization, 26 flags
>2	leshort		0x04		8-bit, no capitalization, 52 flags
>2	leshort		0x05		7-bit, no capitalization, 52 flags
>2	leshort		0x06		8-bit, capitalization, 52 flags
>2	leshort		0x07		7-bit, capitalization, 52 flags
>2	leshort		0x08		8-bit, no capitalization, 128 flags
>2	leshort		0x09		7-bit, no capitalization, 128 flags
>2	leshort		0x0A		8-bit, capitalization, 128 flags
>2	leshort		0x0B		7-bit, capitalization, 128 flags
>2	leshort		0x0C		8-bit, no capitalization, 256 flags
>2	leshort		0x0D		7-bit, no capitalization, 256 flags
>2	leshort		0x0E		8-bit, capitalization, 256 flags
>2	leshort		0x0F		7-bit, capitalization, 256 flags
>4	leshort		>0		and %d string characters
0	beshort&0xFFFC	0x9600		big endian ispell
>1	byte		0		hash file (?),
>1	byte		1		3.0 hash file,
>1	byte		2		3.1 hash file,
>1	byte		3		hash file (?),
>2	beshort		0x00		8-bit, no capitalization, 26 flags
>2	beshort		0x01		7-bit, no capitalization, 26 flags
>2	beshort		0x02		8-bit, capitalization, 26 flags
>2	beshort		0x03		7-bit, capitalization, 26 flags
>2	beshort		0x04		8-bit, no capitalization, 52 flags
>2	beshort		0x05		7-bit, no capitalization, 52 flags
>2	beshort		0x06		8-bit, capitalization, 52 flags
>2	beshort		0x07		7-bit, capitalization, 52 flags
>2	beshort		0x08		8-bit, no capitalization, 128 flags
>2	beshort		0x09		7-bit, no capitalization, 128 flags
>2	beshort		0x0A		8-bit, capitalization, 128 flags
>2	beshort		0x0B		7-bit, capitalization, 128 flags
>2	beshort		0x0C		8-bit, no capitalization, 256 flags
>2	beshort		0x0D		7-bit, no capitalization, 256 flags
>2	beshort		0x0E		8-bit, capitalization, 256 flags
>2	beshort		0x0F		7-bit, capitalization, 256 flags
>4	beshort		>0		and %d string characters
# ispell 4.0 hash files  kromJx <kromJx@crosswinds.net>
# Ispell 4.0
0       string          ISPL            ispell
>4      long            x               hash file version %d,
>8      long            x               lexletters %d,
>12     long            x               lexsize %d,
>16     long            x               hashsize %d,
>20     long            x               stblsize %d
#	$OpenBSD: java,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------
# Java ByteCode
# From Larry Schwimmer (schwim@cs.stanford.edu)
0	belong		0xcafebabe	compiled Java class data,
>6	beshort x	version %d.
>4	beshort x	\b%d
#------------------------------------------------------------
# Java serialization
# From Martin Pool (m.pool@pharos.com.au)
0	beshort		0xaced		Java serialization data
>2	beshort		>0x0004		\b, version %d
#	$OpenBSD: jpeg,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# JPEG images
# SunOS 5.5.1 had
#
#	0	string		\377\330\377\340	JPEG file
#	0	string		\377\330\377\356	JPG file
#
# both of which turn into "JPEG image data" here.
#
0	beshort		0xffd8		JPEG image data
>6	string		JFIF		\b, JFIF standard
>6	string		Exif		\b, EXIF standard
# The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
# in a vain attempt to add image size reporting for JFIF.  Note that these
# tests are not fool-proof since some perfectly valid JPEGs are currently
# impossible to specify in magic(4) format.
# First, a little JFIF version info:
>11	byte		x		\b %d.
>12	byte		x		\b%02d
# Next, the resolution or aspect ratio of the image:
#>13	byte		0		\b, aspect ratio
#>13	byte		1		\b, resolution (DPI)
#>13	byte		2		\b, resolution (DPCM)
#>4	beshort		x		\b, segment length %d
# Next, show thumbnail info, if it exists:
>18	byte		!0		\b, thumbnail %dx
>>19	byte		x		\b%d
# Here things get sticky.  We can do ONE MORE marker segment with
# indirect addressing, and that's all.  It would be great if we could
# do pointer arithemetic like in an assembler language.  Christos?
# And if there was some sort of looping construct to do searches, plus a few
# named accumulators, it would be even more effective...
# At least we can show a comment if no other segments got inserted before:
>(4.S+5)	byte		0xFE
>>(4.S+8)	string		>\0		\b, "%s"
#>(4.S+5)	byte		0xFE		\b, comment
#>>(4.S+6)	beshort		x		\b length=%d
#>>(4.S+8)	string		>\0		\b, "%s"
# Or, we can show the encoding type (I've included only the three most common)
# and image dimensions if we are lucky and the SOFn (image segment) is here:
>(4.S+5)	byte		0xC0		\b, baseline
>>(4.S+6)	byte		x		\b, precision %d
>>(4.S+7)	beshort		x		\b, %dx
>>(4.S+9)	beshort		x		\b%d
>(4.S+5)	byte		0xC1		\b, extended sequential
>>(4.S+6)	byte		x		\b, precision %d
>>(4.S+7)	beshort		x		\b, %dx
>>(4.S+9)	beshort		x		\b%d
>(4.S+5)	byte		0xC2		\b, progressive
>>(4.S+6)	byte		x		\b, precision %d
>>(4.S+7)	beshort		x		\b, %dx
>>(4.S+9)	beshort		x		\b%d
# I've commented-out quantisation table reporting.  I doubt anyone cares yet.
#>(4.S+5)	byte		0xDB		\b, quantisation table
#>>(4.S+6)	beshort		x		\b length=%d
#>14	beshort		x		\b, %d x
#>16	beshort		x		\b %d

# HSI is Handmade Software's proprietary JPEG encoding scheme
0	string		hsi1		JPEG image data, HSI proprietary

# From: David Santinoli <david@santinoli.com>
0	string		\x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A	JPEG 2000 image data
#	$OpenBSD: karma,v 1.4 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# karma:  file(1) magic for Karma data files
#
# From <rgooch@atnf.csiro.au>

0	string		KarmaRHD Version	Karma Data Structure Version
>16	belong		x		%lu
#	$OpenBSD: lecter,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# DEC SRC Virtual Paper: Lectern files
# Karl M. Hegbloom <karlheg@inetarena.com>
0	string	lect	DEC SRC Virtual Paper Lectern file
#	$OpenBSD: lex,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# lex:  file(1) magic for lex
#
#	derived empirically, your offsets may vary!
53	string		yyprevious	C program text (from lex)
>3	string		>\0		 for %s
# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
21	string		generated\ by\ flex	C program text (from flex)
# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
0	string		%{		lex description text
#	$OpenBSD: lif,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# lif:  file(1) magic for lif
#
# (Daniel Quinlan <quinlan@yggdrasil.com>)
#
0	beshort		0x8000		lif file
#	$OpenBSD: linux,v 1.4 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# linux:  file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
# The following basic Linux magic is useful for reference, but using
# "long" magic is a better practice in order to avoid collisions.
#
# 2	leshort		100		Linux/i386
# >0	leshort		0407		impure executable (OMAGIC)
# >0	leshort		0410		pure executable (NMAGIC)
# >0	leshort		0413		demand-paged executable (ZMAGIC)
# >0	leshort		0314		demand-paged executable (QMAGIC)
#
0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
>16	lelong		0		\b, stripped
#
0	string		\007\001\000	Linux/i386 object file
>20	lelong		>0x1020		\b, DLL library
# Linux-8086 stuff:
0	string		\01\03\020\04	Linux-8086 impure executable
>28	long		!0		not stripped
0	string		\01\03\040\04	Linux-8086 executable
>28	long		!0		not stripped
#
0	string		\243\206\001\0	Linux-8086 object file
#
0	string		\01\03\020\20	Minix-386 impure executable
>28	long		!0		not stripped
0	string		\01\03\040\20	Minix-386 executable
>28	long		!0		not stripped
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
216	lelong		0421		Linux/i386 core file
>220	string		>\0		of '%s'
>200	lelong		>0		(signal %d)
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
# this can be overridden by the DOS executable (COM) entry
2	string		LILO		Linux/i386 LILO boot/chain loader
#
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
0	leshort		0x0436		Linux/i386 PC Screen Font data,
>2	byte		0		256 characters, no directory,
>2	byte		1		512 characters, no directory,
>2	byte		2		256 characters, Unicode directory,
>2	byte		3		512 characters, Unicode directory,
>3	byte		>0		8x%d
# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
4086	string		SWAP-SPACE	Linux/i386 swap file
# according to man page of mkswap (8) March 1999
4086	string		SWAPSPACE2	Linux/i386 swap file (new style)
>0x400	long		x		%d (4K pages)
>0x404	long		x		size %d pages
# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
#
#	from Erik Troan (ewt@redhat.com) examining od dumps, so this
#		could be wrong
#      updated by David Mosberger (davidm@azstarnet.com) based on
#      GNU BFD and MIPS info found below.
#
0	leshort		0x0183		ECOFF alpha
>24	leshort		0407		executable
>24	leshort		0410		pure
>24	leshort		0413		demand paged
>8	long		>0		not stripped
>8	long		0		stripped
>23	leshort		>0		- version %ld.
#
# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
# and Nicols Lichtmaier <nick@debian.org>
# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
# Linux kernel boot images (i386 arch) (Wolfram Kleff)
514	string		HdrS		Linux kernel
>510	leshort		0xAA55		x86 boot executable
>>518	leshort		>=3D0x200
>>529	byte		0		zImage,
>>>529	byte		1		bzImage,
>>>(526.s+0x200) string	>\0		version %s,
>>498	leshort		1		RO-rootFS,
>>498	leshort		0		RW-rootFS,
>>508	leshort		>0		root_dev 0x%X,
>>502	leshort		>0		swap_dev 0x%X,
>>504	leshort		>0		RAMdisksize %u KB,
>>506	leshort		0xFFFF		Normal VGA
>>506	leshort		0xFFFE		Extended VGA
>>506	leshort		0xFFFD		Prompt for Videomode
>>506	leshort		>0		Video mode %d
# This also matches new kernels, which were caught above by "HdrS".
0		belong	0xb8c0078e	Linux kernel
>0x1e3		string	Loading		version 1.3.79 or older
>0x1e9		string	Loading		from prehistoric times

# System.map files - Nicols Lichtmaier <nick@debian.org>
8	string	\ A\ _text	Linux kernel symbol map text

# LSM entries - Nicols Lichtmaier <nick@debian.org>
0	string	Begin3	Linux Software Map entry text
0	string	Begin4	Linux Software Map entry text (new format)

# From Matt Zimmerman
0       belong  0x4f4f4f4d      User-mode Linux COW file
>4      belong  x               \b, version %d
>8      string  >\0             \b, backing file %s

############################################################################
# Linux kernel versions

0		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
>497		leshort		0		x86 boot sector
>>514		belong		0x8e	of a kernel from the dawn of time!
>>514		belong		0x908ed8b4	version 0.99-1.1.42
>>514		belong		0x908ed8b8	for memtest86

>497		leshort		!0		x86 kernel
>>504		leshort		>0		RAMdisksize=%u KB
>>502		leshort		>0		swap=0x%X
>>508		leshort		>0		root=0x%X
>>>498		leshort		1		\b-ro
>>>498		leshort		0		\b-rw
>>506		leshort		0xFFFF		vga=normal
>>506		leshort		0xFFFE		vga=extended
>>506		leshort		0xFFFD		vga=ask
>>506		leshort		>0		vga=%d
>>514		belong		0x908ed881	version 1.1.43-1.1.45
>>514		belong		0x15b281cd
>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
>>514		string		HdrS
>>>518		leshort		>0x1FF
>>>>529		byte		0		\b, zImage
>>>>529		byte		1		\b, bzImage
>>>>(526.s+0x200) string 	>\0		\b, version %s

# Linux boot sector thefts.
0		belong		0xb8c0078e	Linux
>0x1e6		belong		0x454c4b53	ELKS Kernel
>0x1e6		belong		!0x454c4b53	style boot sector

############################################################################
# Linux 8086 executable
0	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
>5	string		.		
>>4	string		>\0		\b, libc version %s

0	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
>2	byte&0x01	!0		\b, unmapped zero page
>2	byte&0x20	0		\b, impure
>2	byte&0x20	!0
>>2	byte&0x10	!0		\b, A_EXEC
>2	byte&0x02	!0		\b, A_PAL
>2	byte&0x04	!0		\b, A_NSYM
>2	byte&0x08	!0		\b, A_STAND
>2	byte&0x40	!0		\b, A_PURE
>2	byte&0x80	!0		\b, A_TOVLY
>28     long            !0              \b, not stripped
>37	string		.		
>>36	string		>\0		\b, libc version %s

# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable

#	$OpenBSD: lisp,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# lisp:  file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)

# This is a guess, but a good one.
0	string	;;			Lisp/Scheme program text

# Emacs 18 - this is always correct, but not very magical.
0	string	\012(			Emacs v18 byte-compiled Lisp data
# Emacs 19+ - ver. recognition added by Ian Springer
# Also applies to XEmacs 19+ .elc files; could tell them apart if we had regexp
# support or similar - Chris Chittleborough <cchittleborough@yahoo.com.au>
0	string	;ELC			
>4	byte	>19			
>4	byte    <32			Emacs/XEmacs v%d byte-compiled Lisp data

# Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
0	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program text
0	long	0x70768BD2		CLISP memory image data
0	long	0xD28B7670		CLISP memory image data, other endian

# Files produced by GNU gettext
0	long	0xDE120495		GNU-format message catalog data
0	long	0x950412DE		GNU-format message catalog data

#.com and .bin for MIT scheme 
0	string	\372\372\372\372	MIT scheme (library?)

# From: David Allouche <david@allouche.net>
0	string	\<TeXmacs|	TeXmacs document text
#	$OpenBSD: mach,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# mach file description
#
0	belong		0xcafebabe	Mach-O fat file
>4	belong		1		with 1 architecture
>4	belong		>1
>>4	belong		x		with %ld architectures		
#
0	belong		0xfeedface	Mach-O
>12	belong		1		object
>12	belong		2		executable
>12	belong		3		shared library
>12	belong		4		core
>12	belong		5		preload executable
>12	belong		6               dynamically linked shared library
>12	belong		7               dynamic linker
>12	belong		8		bundle
>12	belong		>8
>>12	belong		x		filetype=%ld
>4	belong		<0
>>4	belong		x		architecture=%ld
>4	belong		1		vax
>4	belong		2		romp
>4	belong		3		architecture=3
>4	belong		4		ns32032
>4	belong		5		ns32332
>4	belong		6		for m68k architecture
# from NeXTstep 3.0 <mach/machine.h>
# i.e. mc680x0_all, ignore
# >>8	belong		1		(mc68030)
>>8	belong		2		(mc68040)
>>8	belong		3		(mc68030 only)
>4	belong		7		i386
>4	belong		8		mips
>4	belong		9		ns32532
>4	belong		10		architecture=10
>4	belong		11		hp pa-risc
>4	belong		12		acorn
>4	belong		13		m88k
>4	belong		14		sparc
>4	belong		15		i860-big
>4	belong		16		i860
>4	belong		17		rs6000
>4	belong		18		ppc
>4	belong		>18
>>4	belong		x		architecture=%ld
#	$OpenBSD: macintosh,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# macintosh:  file(1) magic for Apple Macintosh file formats

# Stuffit archives are the de facto standard of compression for Macintosh
# files obtained from most archives. (franklsm@tuns.ca)
0	string		SIT!			StuffIt Archive (data)
>2	string		x			: %s
65	string		SIT!			StuffIt Archive (rsrc + data)
>2	string		x			: %s
0	string		SITD			StuffIt Deluxe (data)
>2	string		x			: %s
65	string		SITD			StuffIt Deluxe (rsrc + data)
>2	string		x			: %s
0	string		Seg			StuffIt Deluxe Segment (data)
>2	string		x			: %s
65	string		Seg			StuffIt Deluxe Segment (rsrc + data)
>2	string		x			: %s

# Macintosh Applications and Installation binaries (franklsm@tuns.ca)
0	string		APPL			Macintosh Application (data)
>2	string		x			: %s
65	string		APPL			Macintosh Application (rsrc + data)
>2	string		x			: %s

# Macintosh System files (franklsm@tuns.ca)
0	string		zsys			Macintosh System File (data)
65	string		zsys			Macintosh System File(rsrc + data)
0	string		FNDR			Macintosh Finder (data)
65	string		FNDR			Macintosh Finder(rsrc + data)
0	string		libr			Macintosh Library (data)
>2	string		x			: %s
65	string		libr			Macintosh Library(rsrc + data)
>2	string		x			: %s
0	string		shlb			Macintosh Shared Library (data)
>2	string		x			: %s
65	string		shlb			Macintosh Shared Library(rsrc + data)
>2	string		x			: %s
0	string		cdev			Macintosh Control Panel (data)
>2	string		x			: %s
65	string		cdev			Macintosh Control Panel(rsrc + data)
>2	string		x			: %s
0	string		INIT			Macintosh Extension (data)
>2	string		x			: %s
65	string		INIT			Macintosh Extension(rsrc + data)
>2	string		x			: %s
0	string		FFIL			Macintosh Truetype Font (data)
>2	string		x			: %s
65	string		FFIL			Macintosh Truetype Font(rsrc + data)
>2	string		x			: %s
0	string		LWFN			Macintosh Postscript Font (data)
>2	string		x			: %s
65	string		LWFN			Macintosh Postscript Font(rsrc + data)
>2	string		x			: %s

# Additional Macintosh Files (franklsm@tuns.ca)
0	string		PACT			Macintosh Compact Pro Archive (data)
>2	string		x			: %s
65	string		PACT			Macintosh Compact Pro Archive(rsrc + data)
>2	string		x			: %s
0	string		ttro			Macintosh TeachText File (data)
>2	string		x			: %s
65	string		ttro			Macintosh TeachText File(rsrc + data)
>2	string		x			: %s
0	string		TEXT			Macintosh TeachText File (data)
>2	string		x			: %s
65	string		TEXT			Macintosh TeachText File(rsrc + data)
>2	string		x			: %s
0	string		PDF			Macintosh PDF File (data)
>2	string		x			: %s
65	string		PDF			Macintosh PDF File(rsrc + data)
>2	string		x			: %s
#	$OpenBSD: magic,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# magic:  file(1) magic for magic files
#
0	string		#\ Magic	magic text file for file(1) cmd
#	$OpenBSD: mail.news,v 1.4 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# mail.news:  file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
#0	string		From 		mail text
# There are tests to ascmagic.c to cope with mail and news.
0	string		Relay-Version: 	old news text
0	string		#!\ rnews	batched news text
0	string		N#!\ rnews	mailed, batched news text
0	string		Forward\ to 	mail forwarding text
0	string		Pipe\ to 	mail piping text
0	string		Return-Path:	smtp mail text
0	string		Path:		news text
0	string		Xref:		news text
0	string		From:		news or mail text
0	string		Article 	saved news text
0	string		BABYL		Emacs RMAIL text
0	string		Received:	RFC 822 mail text
0	string		MIME-Version:	MIME entity text
#0	string		Content-	MIME entity text

# TNEF files...
0	lelong		0x223E9F78	Transport Neutral Encapsulation Format

# From: Kevin Sullivan <ksulliva@psc.edu>
0	string		*mbx*		MBX mail folder

# From: Simon Matter <simon.matter@invoca.ch>
0	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB

# JAM(mbp) Fidonet message area databases
# JHR file
0	string	JAM\0			JAM message area header file
>12	leshort >0			(%d messages)

# Squish Fidonet message area databases
# SQD file (requires at least one message in the area)
256	leshort	0xAFAE4453		Squish message area data file
>4	leshort	>0			(%d messages)
#	$OpenBSD: maple,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# maple:  file(1) magic for maple files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Maple V release 4, a multi-purpose math program
#

# maple library .lib
0	string	\000MVR4\nI	MapleVr4 library

# .ind
# no magic for these :-(
# they are compiled indexes for maple files

# .hdb 
0	string	\000\004\000\000	Maple help database

# .mhp
# this has the form <PACKAGE=name>
0	string	\<PACKAGE=	Maple help file
0	string	\<HELP\ NAME=	Maple help file
0	string	\n\<HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
#0	string	#\ Newton	Maple help file, old style
0	string	#\ daub	Maple help file, old style
#0	string	#===========	Maple help file, old style

# .mws
0	string	\000\000\001\044\000\221	Maple worksheet
#this is anomalous
0	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
# this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
# that is {VERSION major_version miunor_version computer_type version_string}
0	string	{VERSION\ 	Maple worksheet
>9	string	>\0	version %.1s.
>>10	string
>>>11	string	>\0	%.1s

# .mps
0	string	\0\0\001$	Maple something
# from byte 4 it is either 'nul E' or 'soh R'
# I think 'nul E' means a file that was saved as  a different name
# a sort of revision marking
# 'soh R' means new 
>4	string	\000\105	An old revision
>4	string	\001\122	The latest save

# .mpl
# some of these are the same as .mps above
#0000000 000 000 001 044 000 105 same as .mps
#0000000 000 000 001 044 001 122 same as .mps

0	string	#\n##\ <SHAREFILE=	Maple something
0	string	\n#\n##\ <SHAREFILE=	Maple something
0	string	##\ <SHAREFILE=	Maple something
0	string	#\r##\ <SHAREFILE=	Maple something
0	string	\r#\r##\ <SHAREFILE=	Maple something
0	string	#\ \r##\ <DESCRIBE>	Maple something anomalous.
#	$OpenBSD: mathematica,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# mathematica:  file(1) magic for mathematica files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Mathematica a multi-purpose math program
# versions 2.2 and 3.0

#mathematica .mb
0	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
0	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook

# .ma
# multiple possibilites:

0	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
#>41	string	>\0	%s

#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x

#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
#>675	string	>\0	%s #doesn't work well

# there may be 'cr' instread of 'nl' in some does this matter?

# generic:
0	string	(*^\r\r::[\011	Mathematica notebook version 2.x
0	string	\(\*\^\r\n\r\n\:\:\[\011	Mathematica notebook version 2.x
0	string	(*^\015			Mathematica notebook version 2.x
0	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
0	string	(*^\r::[\011	Mathematica notebook version 2.x
0	string	(*^\r\n::[\011	Mathematica notebook version 2.x
0	string	(*^\n\n::[\011	Mathematica notebook version 2.x
0	string	(*^\n::[\011	Mathematica notebook version 2.x


# Mathematica .mx files

#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
0	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000	
# >71... is optional
>88	string	>\0	from %s


# Mathematica files PBF:
# 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
0	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)

# .ml files  These are menu resources I think
# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 
# how to put that into a magic rule?
4	string	\ A~	MAthematica .ml file

# .nb files
#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
0	string	(***********************	Mathematica 3.0 notebook

# other (* matches it is a comment start in these langs
0	string	(*	Mathematica, or Pascal,  Modula-2 or 3 code text

#########################
# MatLab v5
0       string  MATLAB  Matlab v5 mat-file
>126    short   0x494d  (big endian)
>>124   beshort x       version 0x%04x
>126    short   0x4d49  (little endian)
>>124   leshort x       version 0x%04x

#	$OpenBSD: mcrypt,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# Mavroyanopoulos Nikos <nmav@hellug.gr>
# mcrypt:   file(1) magic for mcrypt 2.2.x;
0	string		\0m\3		mcrypt 2.5 encrypted data,
>4	string		>\0		algorithm: %s,
>>&1	leshort		>0		keysize: %d bytes,
>>>&0	string		>\0		mode: %s,

0	string		\0m\2		mcrypt 2.2 encrypted data,
>3	byte		0		algorithm: blowfish-448,
>3	byte		1		algorithm: DES,
>3	byte		2		algorithm: 3DES,
>3	byte		3		algorithm: 3-WAY,
>3	byte		4		algorithm: GOST,
>3	byte		6		algorithm: SAFER-SK64,
>3	byte		7		algorithm: SAFER-SK128,
>3	byte		8		algorithm: CAST-128,
>3	byte		9		algorithm: xTEA,
>3	byte		10		algorithm: TWOFISH-128,
>3	byte		11		algorithm: RC2,
>3	byte		12		algorithm: TWOFISH-192,
>3	byte		13		algorithm: TWOFISH-256,
>3	byte		14		algorithm: blowfish-128,
>3	byte		15		algorithm: blowfish-192,
>3	byte		16		algorithm: blowfish-256,
>3	byte		100		algorithm: RC6,
>3	byte		101		algorithm: IDEA,
>4	byte		0		mode: CBC,
>4	byte		1		mode: ECB,
>4	byte		2		mode: CFB,
>4	byte		3		mode: OFB,
>4	byte		4		mode: nOFB,
>5	byte		0		keymode: 8bit
>5	byte		1		keymode: 4bit
>5	byte		2		keymode: SHA-1 hash
>5	byte		3		keymode: MD5 hash
#	$OpenBSD: mime,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# mime:  file(1) magic for MIME encoded files
#
0	string		Content-Type:\
>14	string		>\0		%s
0	string		Content-Type:
>13	string		>\0		%s
#	$OpenBSD: mirage,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# mirage:  file(1) magic for Mirage executables
#
# XXX - byte order?
#
0	long	31415		Mirage Assembler m.out executable
#	$OpenBSD: misctools,v 1.1 2004/06/03 03:14:20 tedu Exp $

#-----------------------------------------------------------------------------
# misctools:  file(1) magic for miscelanous UNIX tools.
#
0	string		%%!!		X-Post-It-Note text
0	string          BEGIN:VCALENDAR         vCalendar calendar file
#	$OpenBSD: mkid,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# mkid:  file(1) magic for mkid(1) databases
#
# ID is the binary tags database produced by mkid(1).
#
# XXX - byte order?
#
0	string		\311\304	ID tags data
>2	short		>0		version %d
#	$OpenBSD: mlssa,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# mlssa: file(1) magic for MLSSA datafiles
#
0		lelong		0xffffabcd	MLSSA datafile,
>4		leshort		x		algorithm %d,
>10		lelong		x		%d samples
#	$OpenBSD: mmdf,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# mmdf:  file(1) magic for MMDF mail files
#
0	string	\001\001\001\001	MMDF mailbox
#	$OpenBSD: modem,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# modem:  file(1) magic for modem programs
#
# From: Florian La Roche <florian@knorke.saar.de>
4	string		Research,	Digifax-G3-File
>29	byte		1		, fine resolution
>29	byte		0		, normal resolution

0	short		0x0100		raw G3 data, byte-padded
0	short		0x1400		raw G3 data
#
# Magic data for vgetty voice formats
# (Martin Seine & Marc Eberhard)

#
# raw modem data version 1
#
0    string    RMD1      raw modem data
>4   string    >\0       (%s /
>20  short     >0        compression type 0x%04x)

#
# portable voice format 1
#
0    string    PVF1\n         portable voice format
>5   string    >\0       (binary %s)

#
# portable voice format 2
#
0    string    PVF2\n         portable voice format
>5   string >\0          (ascii %s)

#	$OpenBSD: modules,v 1.2 2001/01/29 01:57:57 niklas Exp $

# Magic file entries for several module formats
# by Claudio Matsuoka <claudio@pos.inf.ufpr.br>
#
# 4, 6 and 8 channel Protracker/Noisetracker/Fasttracker modules
#
1080	string		M.K.		Protracker module
>0	string		>\0		- "%.20s"
1080	string		M!K!		Protracker 2.3 module
>0	string		>\0		- "%.20s"
1080	string		M&K!		Noisetracker module
>0	string		>\0		- "%.20s"
1080	string		EMW3		UNIC-Tracker module
>0	string		>\0		- "%.20s"
1080	string		FLT4		Startrekker 4 channel module
>0	string		>\0		- "%.20s"
1080	string		FLT8		Startrekker 8 channel module
>0	string		>\0		- "%.20s"
1080	string		6CHN		Fasttracker 6 channel module
>0	string		>\0		- "%.20s"
1080	string		8CHN		Fasttracker 8 channel module
>0	string		>\0		- "%.20s"
1081	string		CHN		TakeTracker
>1080	string		x		"%-1.1s channel module"
>0	string		>\0		- "%.20s"
#
# Scream Tracker 2 modules
#
20	string		!Scream!	Scream Tracker
>30	byte		1		
>>31	byte		x		1.%02d module
>30	byte		2
>>31	byte		x		2.%d module
>0	string		>\0		- "%.20s"
#
# Scream Tracker 3 modules
#
44	string		SCRM		Scream Tracker
>41	byte		0x13
>>40	byte		x		3.%02x module
>0	string		>\0		- "%.28s"
#
# Poly Tracker modules
#
44	string		PTMF		Poly Tracker
>30	byte		0
>>29	byte		x		1.%02d module
>30	byte		2
>>29	byte		x		2.%02d module
>0	string		>\0		- "%.28s"
#
# Fast Tracker II extended modules
#
0	string		Extended\040Module:\040	Fasttracker II module
>59	byte		0
>>58	byte		x		v0.%02d
>59	byte		1
>>58	byte		x		v1.%02d
>59	byte		2
>>58	byte		x		v2.%02d
>17	string		>\0		- "%.20s"
#
# Real Tracker modules
#
0	string		RTMM		Real Tracker module
5	string		?\0		- "%.32s"
#
# Oktalyzer modules
#
0	string		OKTASONG	Oktalyzer module
#
# Farandole Composer modules
#
0	string		FAR\xfe
>4	string		>\0		Farandole Composer module - "%.40s"
#
# Impulse Tracker modules
#
0	string		IMPM		Impulse Tracker module
>43	byte		0		
>>42	byte		x		v0.%02d
>43	byte		1
>>42	byte		x		v1.%02d
>43	byte		2
>>42	byte		x		v2.%02d
>4	string		>\0		- "%.26s"
>44	byte		^0x04		(sample mode)
>44	byte		&0x04		(instrument mode)
#
# Powerpacked modules
#
0	string		PP20		Powerpacked module
#
# Aley Keptr's ALM module format
#
0	string		ALEY\040MOD	Aley's module version 1.0
0	string		ALEYMOD		Aley's module version 1.1 or 1.2
#
# Amusic Adlib tracker module
#
1068	string		RoR		Amusic Adlib module
>0	string		>\0		- "%.24s"
#
# Reality Adlib Tracker module
#
0	string		RAD		Reality Adlib Tracker module
#
# Multitracker modules
#
0	string		MTM
>4	string		>\0		Multitracker module - "%.20s"
#
# Composer 669 modules
#
0	string		if
>240	byte		0xff		Composer 669 module
0	string		JN
>240	byte		0xff		UNIS 669 module

#	$OpenBSD: motorola,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# motorola:  file(1) magic for Motorola 68K and 88K binaries
#
# 68K
#
0	beshort		0520		mc68k COFF
>18	beshort		^00000020	object
>18	beshort		&00000020	executable
>12	belong		>0		not stripped
>168	string		.lowmem		Apple toolbox
>20	beshort		0407		(impure)
>20	beshort		0410		(pure)
>20	beshort		0413		(demand paged)
>20	beshort		0421		(standalone)
0	beshort		0521		mc68k executable (shared)
>12	belong		>0		not stripped
0	beshort		0522		mc68k executable (shared demand paged)
>12	belong		>0		not stripped
#
# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
#
0	beshort		0554		68K BCS executable
#
# 88K
#
# Motorola/88Open BCS
#
0	beshort		0555		88K BCS executable
#
# Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
0   string      S0          Motorola S-Record; binary data in text format

# ATARI ST relocatable PRG
#
# from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
# (according to Roland Waldi, Oct 21, 1987)
# besides the magic 0x601a, the text segment size is checked to be
# not larger than 1 MB (which is a lot on ST).
# The additional 0x601b distinction I took from Doug Lee's magic.
0	belong&0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
>2	belong			x		(txt=%ld,
>6	belong			x		dat=%ld,
>10	belong			x		bss=%ld,
>14	belong			x		sym=%ld)
0	belong&0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
>2	belong			x		(txt=%ld,
>6	belong			x		dat=%ld,
>10	belong			x		bss=%ld,
>14	belong			x		sym=%ld)

# Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
0       beshort         0x601A          Atari 68xxx executable,
>2      belong          x               text len %lu,
>6      belong          x               data len %lu,
>10     belong          x               BSS len %lu,
>14     belong          x               symboltab len %lu,
>18     belong          0
>22     belong          &0x01           fastload flag,
>22     belong          &0x02           may be loaded to alternate RAM,
>22     belong          &0x04           malloc may be from alternate RAM,
>22     belong          x               flags: 0x%lX,
>26     beshort         0               no relocation tab
>26     beshort         !0              + relocation tab
>30     string          SFX             [Self-Extracting LZH SFX archive]
>38     string          SFX             [Self-Extracting LZH SFX archive]
>44     string          ZIP!            [Self-Extracting ZIP SFX archive]

0       beshort         0x0064          Atari 68xxx CPX file
>8      beshort         x               (version %04lx)
#	$OpenBSD: msdos,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# msdos:  file(1) magic for MS-DOS files
#

# .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
0	string	@echo\ off	MS-DOS batch file text

# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
0	string	MZ		MS-DOS executable (EXE)
>24	string	@		\b, OS/2 or Windows
>1638	string	-lh5-		\b, LHa SFX archive v2.13S
>7195	string	Rar!		\b, RAR self-extracting archive
#
# [GRR 950118:  file 3.15 has a buffer-size limitation; offsets bigger than
#   8161 bytes are ignored.  To make the following entries work, increase
#   HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
#   NT/Win32 and VMS.]
# [GRR:  some company sells a self-extractor/displayer for image data(!)]
#
>11696	string	PK\003\004	\b, PKZIP SFX archive v1.1
>13297	string	PK\003\004	\b, PKZIP SFX archive v1.93a
>15588	string	PK\003\004	\b, PKZIP2 SFX archive v1.09
>15770	string	PK\003\004	\b, PKZIP SFX archive v2.04g
>28374	string	PK\003\004	\b, PKZIP2 SFX archive v1.02
#
# Info-ZIP self-extractors
#    these are the DOS versions:
>25115	string	PK\003\004	\b, Info-ZIP SFX archive v5.12
>26331	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#    these are the OS/2 versions (OS/2 is flagged above):
>47031	string	PK\003\004	\b, Info-ZIP SFX archive v5.12
>49845	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#    this is the NT/Win32 version:
>69120	string	PK\003\004	\b, Info-ZIP NT SFX archive v5.12 w/decryption
#
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
>>49824	leshort		=1			\b, 1 file
>>49824	leshort		>1			\b, %u files

# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
# Uncommenting only the first two lines will cover about 2/3 of COM files,
# but it isn't feasible to match all COM files since there must be at least
# two dozen different one-byte "magics".
#0	byte		0xe9		MS-DOS executable (COM)
#0	byte		0x8c		MS-DOS executable (COM)
# 0xeb conflicts with "sequent" magic
#0	byte		0xeb		MS-DOS executable (COM)
#0	byte		0xb8		MS-DOS executable (COM)

# miscellaneous formats
0	string		LZ		MS-DOS executable (built-in)
#0	byte		0xf0		MS-DOS program library data
#

# Popular applications
2080	string	Microsoft\ Word\ 6.0\ Document	%s
#
0	belong	0x31be0000	Microsoft Word Document
#
2080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
#
0	belong	0x00001a00	Lotus 1-2-3
>4	belong	0x00100400	wk3 document
>4	belong	0x02100400	wk4 document
>4	belong	0x07800100	fm3 or fmb document
>4	belong	0x07800000	fm3 or fmb document
#
0	belong	0x00000200 	Lotus 1-2-3
>4	belong	0x06040600	wk1 document
>4	belong	0x06800200	fmt document
#	$OpenBSD: msvc,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# msvc:  file(1) magic for msvc
# "H. Nanosecond" <aldomel@ix.netcom.com>
# Microsoft visual C
# 
# I have version 1.0

# .aps
0	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file

# .ide
#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide

# .res
0	string	\000\000\000\000\040\000\000\000\377	MSVC .res
0	string	\377\003\000\377\001\000\020\020\350	MSVC .res
0	string	\377\003\000\377\001\000\060\020\350	MSVC .res

#.lib
0	string	\360\015\000\000	Microsoft Visual C library
0	string	\360\075\000\000	Microsoft Visual C library
0	string	\360\175\000\000	Microsoft Visual C library

#.pch
0	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch

# .pdb
# too long 0	string	Microsoft\ C/C++\ program\ database\ 
0	string	Microsoft\ C/C++\ 	MSVC program database
>18	string	program\ database\ 	
>33	string	>\0	ver %s

#.sbr
0	string	\000\002\000\007\000	MSVC .sbr
>5	string 	>\0	%s

#.bsc
0	string	\002\000\002\001	MSVC .bsc

#.wsp
0	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
# these seem to start with the version and contain menus
#	$OpenBSD: natinst,v 1.1 2004/06/03 03:14:20 tedu Exp $

#-----------------------------------------------------------------------------
# natinst:  file(1) magic for National Instruments Code Files

#
# From <egamez@fcfm.buap.mx> Enrique Gmez-Flores
# version 1
# Many formats still missing, we use, for the moment LabVIEW
# We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
#
0       string          RSRC            National Instruments,
# Check if it's a LabVIEW File
>8      string          LV              LabVIEW File,
# Check wich kind of file is
>>10    string          SB              Code Resource File, data
>>10    string          IN              Virtual Instrument Program, data
>>10    string          AR              VI Library, data
# This is for Menu Libraries
>8      string          LMNULBVW        Portable File Names, data
# This is for General Resources
>8      string          rsc             Resources File, data
# This is for VXI Package
0       string          VMAP            National Instruments, VXI File, data
#	$OpenBSD: ncr,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# ncr:  file(1) magic for NCR Tower objects
#
# contributed by
# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
#
0	beshort		000610	Tower/XP rel 2 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000615	Tower/XP rel 2 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000620	Tower/XP rel 3 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000625	Tower/XP rel 3 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000630	Tower32/600/400 68020 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000640	Tower32/800 68020
>18	   beshort		&020000	w/68881 object
>18	   beshort		&040000	compatible object
>18	   beshort		&~060000	object
>20	   beshort		0407	executable
>20	   beshort		0413	pure executable
>12	   belong		>0	not stripped
>22	   beshort		>0	- version %ld
0	beshort		000645	Tower32/800 68010
>18	   beshort		&040000	compatible object
>18	   beshort		&~060000 object
>20	   beshort		0407	executable
>20	   beshort		0413	pure executable
>12	   belong		>0	not stripped
>22	   beshort		>0	- version %ld
#	$OpenBSD: netscape,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# netscape:  file(1) magic for Netscape files
# "H. Nanosecond" <aldomel@ix.netcom.com>
# version 3 and 4 I think
#

# Netscape Address book  .nab
0	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book

# Netscape Communicator address book
0   string   \000\017\102\111 Netscape Communicator address book

# .snm Caches
0	string		#\ Netscape\ folder\ cache	Netscape folder cache
0	string	\000\036\204\220\000	Netscape folder cache
# .n2p 
# Net 2 Phone 
#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
0	string	SX961999	Net2phone

#
#This is files ending in .art, FIXME add more rules
0       string          JG\004\016\0\0\0\0      ART
#	$OpenBSD: news,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
#
0	string		StartFontMetrics	ASCII font metrics
0	string		StartFont	ASCII font bits
0	belong		0x137A2944	NeWS bitmap font
0	belong		0x137A2947	NeWS font family
0	belong		0x137A2950	scalable OpenFont binary
0	belong		0x137A2951	encrypted scalable OpenFont binary
8	belong		0x137A2B45	X11/NeWS bitmap font
8	belong		0x137A2B48	X11/NeWS font family
#	$OpenBSD: nitpicker,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# nitpicker:  file(1) magic for Flowfiles.
# From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
0	string	NPFF	NItpicker Flow File 
>4	byte	x	V%d.
>5	byte	x	%d
>6	bedate	x	started: %s
>10	bedate	x	stopped: %s
>14	belong	x	Bytes: %u
>18	belong	x	Bytes1: %u
>22	belong	x	Flows: %u
>26	belong	x	Pkts: %u
#	$OpenBSD: ocaml,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# ocaml: file(1) magic for Objective Caml files.
0	string	Caml1999	Objective caml
>8	string	X		exec file
>8	string	I		interface file (.cmi)
>8	string	O		object file (.cmo)
>8	string	A		library file (.cma)
>8	string	Y		native object file (.cmx)
>8	string	Z		native library file (.cmxa)
>8	string	M		abstract syntax tree implementation file
>8	string	N		abstract syntax tree interface file
>9	string	>\0		(Version %3.3s).
#	$OpenBSD: octave,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
0	string		Octave-1-L	Octave binary data (little endian)
0	string		Octave-1-B	Octave binary data (big endian)
#	$OpenBSD: olf,v 1.6 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# olf:  file(1) magic for OLF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# Byte order is probably big-endian for MIPS R3000 and Amdahl.
# MIPS R3000 may also be for MIPS R2000.
#
# Created by Erik Theisen <etheisen@openbsd.org>
# Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
0	string		\177OLF		OLF
>4	byte		0		invalid class
>4	byte		1		32-bit
>4	byte		2		64-bit
>7	byte		0		invalid os
>7	byte		1		OpenBSD
>7	byte		2		NetBSD
>7	byte		3		FreeBSD
>7	byte		4		4.4BSD
>7	byte		5		Linux
>7	byte		6		SVR4
>7	byte		7		esix
>7	byte		8		Solaris
>7	byte		9		Irix
>7	byte		10		SCO
>7	byte		11		Dell
>7	byte		12		NCR
>8	byte		1		dynamically linked
>9	byte		1		unstripped
>5	byte		0		invalid byte order
>5	byte		1		LSB
>>16	leshort		0		no file type,
>>16	leshort		1		relocatable,
>>16	leshort		2		executable,
>>16	leshort		3		shared object,
>>16	leshort		4		core file,
>>16	leshort		&0xff00		processor-specific,
>>18	leshort		0		no machine,
>>18	leshort		1		AT&T WE32100 - invalid byte order,
>>18	leshort		2		SPARC - invalid byte order,
>>18	leshort		3		Intel 80386,
>>18	leshort		4		Motorola 68000 - invalid byte order,
>>18	leshort		5		Motorola 88000 - invalid byte order,
>>18	leshort		6		Intel 80486,
>>18	leshort		7		Intel 80860,
>>18	leshort		8		MIPS R3000,
>>18	leshort		9		Amdahl,
>>18	leshort		75		VAX,
>>20	lelong		0		invalid version
>>20	lelong		1		version 1
>>36	lelong		1		MathCoPro/FPU/MAU Required
>5	byte		2		MSB
>>16	beshort		0		no file type,
>>16	beshort		1		relocatable,
>>16	beshort		2		executable,
>>16	beshort		3		shared object,
>>16	beshort		4		core file,
>>16	beshort		&0xff00		processor-specific,
>>18	beshort		0		no machine,
>>18	beshort		1		AT&T WE32100,
>>18	beshort		2		SPARC,
>>18	beshort		3		Intel 80386 - invalid byte order,
>>18	beshort		4		Motorola 68000,
>>18	beshort		5		Motorola 88000,
>>18	beshort		6		Intel 80486 - invalid byte order,
>>18	beshort		7		Intel 80860,
>>18	beshort		8		MIPS R3000,
>>18	beshort		75		VAX - invalid byte order,
>>18	leshort		9		Amdahl,
>>20	belong		0		invalid version
>>20	belong		1		version 1
>>36	belong		1		MathCoPro/FPU/MAU Required
#	$OpenBSD: os2,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# os2:  file(1) magic for OS/2 files
#

# Provided 1998/08/22 by
# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
1	string	InternetShortcut	MS Windows 95 Internet shortcut text
>24	string	>\			(URL=<%s>)

# OS/2 URL objects
# Provided 1998/08/22 by
# David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
#0	string	http:			OS/2 URL object text
#>5	string	>\			(WWW) <http:%s>
#0	string	mailto:			OS/2 URL object text
#>7	string	>\			(email) <%s>
#0	string	news:			OS/2 URL object text
#>5	string	>\			(Usenet) <%s>
#0	string	ftp:			OS/2 URL object text
#>4	string	>\			(FTP) <ftp:%s>
#0	string	file:			OS/2 URL object text
#>5	string	>\			(Local file) <%s>

# >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett ddissett@netcom.com)
# Carl Hauser (chauser.parc@xerox.com) and 
# Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
# list the following header format in inf02a.doc:
#
#  int16 ID;           // ID magic word (5348h = "HS")
#  int8  unknown1;     // unknown purpose, could be third letter of ID
#  int8  flags;        // probably a flag word...
#                      //  bit 0: set if INF style file
#                      //  bit 4: set if HLP style file
#                      // patching this byte allows reading HLP files
#                      // using the VIEW command, while help files 
#                      // seem to work with INF settings here as well.
#  int16 hdrsize;      // total size of header
#  int16 unknown2;     // unknown purpose
# 
0   string  HSP\x01\x9b\x00 OS/2 INF
>107 string >0                      (%s)
0   string  HSP\x10\x9b\x00     OS/2 HLP
>107 string >0                      (%s)

# OS/2 INI (this is a guess)
0  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI
#	$OpenBSD: os9,v 1.3 2004/06/03 03:14:20 tedu Exp $

# $NetBSD: os9,v 1.1 1996/05/06 18:24:01 is Exp $
#
# Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
# 3. All advertising materials mentioning features or use of this software
#    must display the following acknowledgement:
#      This product includes software developed by Ignatios Souvatzis for
#      the NetBSD project.
# 4. The name of the author may not be used to endorse or promote products
#    derived from this software without specific prior written permission.
#
#
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  
# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
#
# OS9/6809 module descriptions:
#
0	beshort		0x87CD	OS9/6809 module:
#
>6	byte&0x0f	0x00	non-executable
>6	byte&0x0f	0x01	machine language
>6	byte&0x0f	0x02	BASIC I-code
>6	byte&0x0f	0x03	P-code
>6	byte&0x0f	0x04	C I-code
>6	byte&0x0f	0x05	COBOL I-code
>6	byte&0x0f	0x06	FORTRAN I-code
#
>6	byte&0xf0	0x10	program executable
>6	byte&0xf0	0x20	subroutine
>6	byte&0xf0	0x30	multi-module
>6	byte&0xf0	0x40	data module
#
>6	byte&0xf0	0xC0	system module
>6	byte&0xf0	0xD0	file manager
>6	byte&0xf0	0xE0	device driver
>6	byte&0xf0	0xF0	device descriptor
#
# OS9/m68k stuff (to be continued)
#
0	beshort		0x4AFC	OS9/68K module:
#
# attr
>14	byte&0x80	0x80	re-entrant
>14	byte&0x40	0x40	ghost
>14	byte&0x20	0x20	system-state
#
# lang:
#
>13	byte		1	machine language
>13	byte		2	BASIC I-code
>13	byte		3	P-code
>13	byte		4	C I-code
>13	byte		5	COBOL I-code
>13	byte		6	Fortran I-code
#
#
# type:
#
>12	byte		1	program executable
>12	byte		2	subroutine
>12	byte		3	multi-module
>12	byte		4	data module
>12	byte		11	trap library
>12	byte		12	system module
>12	byte		13	file manager
>12	byte		14	device driver
>12	byte		15	device descriptor
#	$OpenBSD: osf1,v 1.2 2001/01/29 01:57:57 niklas Exp $

#
# Mach magic number info
#
0	long		0xefbe	OSF/Rose object
# I386 magic number info
#
0	short		0565	i386 COFF object
#	$OpenBSD: palmpilot,v 1.3 2001/01/29 01:57:57 niklas Exp $

# start kpilot.magic
# This must go at the end of $(kde_mimedir)/magic
# PalmPilot Files
>0x20   beshort&0xffe7   0              palmpilot/database
>0x20   beshort&0xffe7   1      
>>0x3c  string           appl           palmpilot/application
>>0x3c  string           HACK           palmpilot/hack
>>0x3c  string           libr           palmpilot/library  
>>0x3c  string           >\0            palmpilot/database
# stop kpilot.magic
#	$OpenBSD: parix,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
#
# Parix COFF executables
# From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
#
0	beshort&0xfff	0xACE	PARIX
>0	byte&0xf0	0x80	T800
>0	byte&0xf0	0x90	T9000
>19	byte&0x02	0x02	executable
>19	byte&0x02	0x00	object
>19	byte&0x0c	0x00	not stripped
#	$OpenBSD: pbm,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# pbm:  file(1) magic for Portable Bitmap files
#
# XXX - byte order?
#
0	short	0x2a17	"compact bitmap" format (Poskanzer)
#	$OpenBSD: pdf,v 1.3 2001/01/29 01:57:57 niklas Exp $

#------------------------------------------------------------------------------
# pdf:  file(1) magic for Portable Document Format
#

0	string		%PDF-		PDF document
>5	byte		x		\b, version %c
>7	byte		x		\b.%c
#	$OpenBSD: pdp,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
#
0	lelong		0101555		PDP-11 single precision APL workspace
0	lelong		0101554		PDP-11 double precision APL workspace
#
# PDP-11 a.out
#
0	leshort		0407		PDP-11 executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0401		PDP-11 UNIX/RT ldp
0	leshort		0405		PDP-11 old overlay

0	leshort		0410		PDP-11 pure executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0411		PDP-11 separate I&D executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0437		PDP-11 kernel overlay

# These last three are derived from 2.11BSD file(1)
0	leshort		0413		PDP-11 demand-paged pure executable
>8	leshort		>0		not stripped

0	leshort		0430		PDP-11 overlaid pure executable
>8	leshort		>0		not stripped

0	leshort		0431		PDP-11 overlaid separate executable
>8	leshort		>0		not stripped
#	$OpenBSD: pgp,v 1.4 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# pgp:  file(1) magic for Pretty Good Privacy
#
0       beshort         0x9900                  PGP key public ring
0       beshort         0x9501                  PGP key security ring
0       beshort         0x9500                  PGP key security ring
0	beshort		0xa600			PGP encrypted data
0       string          -----BEGIN\040PGP       PGP armored data
>15     string          PUBLIC\040KEY\040BLOCK- public key block
>15     string          MESSAGE-                message
>15     string          SIGNED\040MESSAGE-      signed message
>15     string          PGP\040SIGNATURE-       signature
#	$OpenBSD: pkgadd,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
#
0       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)
#	$OpenBSD: plan9,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# plan9:  file(1) magic for AT&T Bell Labs' Plan 9 executables
#
0	belong		0x000001EB	Plan 9 executable
#	$OpenBSD: plus5,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# plus5:  file(1) magic for Plus Five's UNIX MUMPS
#
# XXX - byte order?  Paging Hokey....
#
0	short		0x259		mumps avl global
>2	byte		>0		(V%d)
>6	byte		>0		with %d byte name
>7	byte		>0		and %d byte data cells
0	short		0x25a		mumps blt global
>2	byte		>0		(V%d)
>8	short		>0		- %d byte blocks
>15	byte		0x00		- P/D format
>15	byte		0x01		- P/K/D format
>15	byte		0x02		- K/D format
>15	byte		>0x02		- Bad Flags
#	$OpenBSD: printer,v 1.5 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# printer:  file(1) magic for printer-formatted files
#

# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
0	string		%!		PostScript document text
>2	string		PS-Adobe-	conforming
>>11	string		>\0		at level %.3s
>>>15	string		EPS		- type %s
>>>15	string		Query		- type %s
>>>15	string		ExitServer	- type %s
# Some PCs have the annoying habit of adding a ^D as a document separator
0	string		\004%!		PostScript document text
>3	string		PS-Adobe-	conforming
>>12	string		>\0		at level %.3s
>>>16	string		EPS		- type %s
>>>16	string		Query		- type %s
>>>16	string		ExitServer	- type %s

# HP Printer Job Language
0	string		\033%-12345X@PJL	HP Printer Job Language data
>15	string		\ ENTER\ LANGUAGE\ =
>31	string		PostScript		PostScript

# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\033E\033	HP PCL printer data
>3	string		\&l0A		- default page size
>3	string		\&l1A		- US executive page size
>3	string		\&l2A		- US letter page size
>3	string		\&l3A		- US legal page size
>3	string		\&l26A		- A4 page size
>3	string		\&l80A		- Monarch envelope size
>3	string		\&l81A		- No. 10 envelope size
>3	string		\&l90A		- Intl. DL envelope size
>3	string		\&l91A		- Intl. C5 envelope size
>3	string		\&l100A		- Intl. B5 envelope size
>3	string		\&l-81A		- No. 10 envelope size (landscape)
>3	string		\&l-90A		- Intl. DL envelope size (landscape)

# HPGL2 - Graphics for HP printers. Pavel Lisy <pali@tmapy.cz>, edited.
0	string		\033%OB;	HP HPGL printer data
# 	be nice to get the other parameters that can follow, as per PCL?

# IMAGEN printer-ready files:
0	string	@document(		Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10	string	language\ impress	(imPRESS data)
>10	string	language\ daisy		(daisywheel text)
>10	string	language\ diablo	(daisywheel text)
>10	string	language\ printer	(line printer emulation)
>10	string	language\ tektronix	(Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
#
# Now magic for IMAGEN font files...
0	string		Rast		RST-format raster font data
>45	string		>0		face %
#	$OpenBSD: project,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# project:  file(1) magic for Project management
# 
# Magic strings for ftnchek project files. Alexander Mai
0	string	FTNCHEK_\ P	project file for ftnchek
>10	string	1		version 2.7
>10	string	2		version 2.8 to 2.10
>10	string	3		version 2.11 or later
#	$OpenBSD: psdbms,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# psdbms:  file(1) magic for psdatabase
#
0	belong&0xff00ffff	0x56000000	ps database
>1	string	>\0	version %s
>4	string	>\0	from kernel %s
#	$OpenBSD: psion,v 1.2 2005/10/20 22:31:16 jmc Exp $

#------------------------------------------------------------------------------
# psion:  file(1) magic for Psion handhelds data
# from: Peter Breitenlohner <peb@mppmu.mpg.de>
#
0	lelong		0x10000037	Psion Series 5
>4	lelong		0x10000039	font file
>4	lelong		0x1000003A	printer driver
>4	lelong		0x1000003B	clipboard
>4	lelong		0x10000042	multi-bitmap image
>4	lelong		0x1000006A	application information file
>4	lelong		0x1000006D
>>8	lelong		0x1000007D	sketch image
>>8	lelong		0x1000007E	voice note
>>8	lelong		0x1000007F	word file
>>8	lelong		0x10000085	OPL program
>>8	lelong		0x10000088	sheet file
>>8	lelong		0x100001C4	EasyFax initialisation file
>4	lelong		0x10000073	OPO module
>4	lelong		0x10000074	OPL application
>4	lelong		0x1000008A	exported multi-bitmap image

0	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image

0	lelong		0x10000050	Psion Series 5
>4	lelong		0x1000006D	database
>4	lelong		0x100000E4	ini file

0	lelong		0x10000079	Psion Series 5 binary:
>4	lelong		0x00000000	DLL
>4	lelong		0x10000049	comms hardware library
>4	lelong		0x1000004A	comms protocol library
>4	lelong		0x1000005D	OPX
>4	lelong		0x1000006C	application
>4	lelong		0x1000008D	DLL
>4	lelong		0x100000AC	logical device driver
>4	lelong		0x100000AD	physical device driver
>4	lelong		0x100000E5	file transfer protocol
>4	lelong		0x100000E5	file transfer protocol
>4	lelong		0x10000140	printer definition
>4	lelong		0x10000141	printer definition

0	lelong		0x1000007A	Psion Series 5 executable
#	$OpenBSD: pulsar,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# pulsar:  file(1) magic for Pulsar POP3 daemon binary files
#
# http://pulsar.sourceforge.net
# mailto:rok.papez@lugos.si
#

0	belong	0x1ee7f11e	Pulsar POP3 daemon mailbox cache file.
>4	ubelong	x		Version: %d.
>8	ubelong	x		\b%d

#	$OpenBSD: pyramid,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# pyramid:  file(1) magic for Pyramids
#
# XXX - byte order?
#
0	long		0x50900107	Pyramid 90x family executable
0	long		0x50900108	Pyramid 90x family pure executable
>16	long		>0		not stripped
0	long		0x5090010b	Pyramid 90x family demand paged pure executable
>16	long		>0		not stripped
#	$OpenBSD: python,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# python:  file(1) magic for python
#
# From: David Necas <yeti@physics.muni.cz>
# often the module starts with a multiline string
0	string		"""	a python script text executable
# MAGIC as specified in Python/import.c (1.5 to 2.3.0a)
# 20121  ( YEAR - 1995 ) + MONTH  + DAY (little endian followed by "\r\n"
0	belong		0x994e0d0a	python 1.5/1.6 byte-compiled
0	belong		0x87c60d0a	python 2.0 byte-compiled
0	belong		0x2aeb0d0a	python 2.1 byte-compiled
0	belong		0x2ded0d0a	python 2.2 byte-compiled
0	belong		0x3bf20d0a	python 2.3 byte-compiled
#	$OpenBSD: revision,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# file(1) magic for revision control files
# From Hendrik Scholz <hendrik@scholz.net>
0   string /1\ :pserver:    cvs password text file
#	$OpenBSD: rpm,v 1.5 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
#
# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
#
0	beshort		0xedab
>2	beshort		0xeedb		RPM
>>4	byte		x		v%d
>>6	beshort		0		bin
>>6	beshort		1		src
>>8	beshort		1		i386
>>8	beshort		2		Alpha
>>8	beshort		3		Sparc
>>8	beshort		4		MIPS
>>8	beshort		5		PowerPC
>>8	beshort		6		68000
>>8	beshort		7	SGI
>>8	beshort		8		RS6000
>>8	beshort		9		IA64
>>8	beshort		10		Sparc64
>>8	beshort		11		MIPSel
>>8	beshort		12		ARM
>>10	string		x		%s
#	$OpenBSD: rtf,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# rtf:	file(1) magic for Rich Text Format (RTF)
#
# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
#
0	string		{\\rtf		Rich Text Format data,
>5	byte		x		version %c,
>6	string		\\ansi		ANSI
>6	string		\\mac		Apple Macintosh
>6	string		\\pc		IBM PC, code page 437
>6	string		\\pca		IBM PS/2, code page 850
#	$OpenBSD: sc,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# sc:  file(1) magic for "sc" spreadsheet
#
38	string		Spreadsheet	sc spreadsheet file
#	$OpenBSD: sccs,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# sccs:  file(1) magic for SCCS archives
#
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
# \001c date and time created 87/09/23 08:09:20 by ian
# \001e
# \001u
# \001U
# ... etc.
# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
# *Sigh*. And these both came from various parts of the USG.
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
# and we don't have regular expression matching yet. 
# Hence the following official kludge:
8	string		\001s\ 			SCCS archive data
#	$OpenBSD: sendmail,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# sendmail:  file(1) magic for sendmail config files
#
# XXX - byte order?
#
0	byte	046	  Sendmail frozen configuration 
>16	string	>\0	  - version %s
0	short	0x271c	  Sendmail frozen configuration
>16	string	>\0	  - version %s

#------------------------------------------------------------------------------
# sendmail:  file(1) magic for sendmail m4(1) files
#
# From Hendrik Scholz <hendrik@scholz.net>
# i.e. files in /usr/share/sendmail/cf/
#
0   string  divert(-1)\n    sendmail m4 text file

#	$OpenBSD: sequent,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# sequent:  file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# For Sequent's multiprocessor systems (incomplete).
0	lelong	0x00ea        	BALANCE NS32000 .o
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
>16	lelong  >0            	not stripped
>124	lelong	>0		version %ld
0	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
>16	lelong  >0            	not stripped
>124	lelong	>0		version %ld
0	lelong	0x30ea        	BALANCE NS32000 standalone executable
>16	lelong  >0          	not stripped
>124	lelong	>0		version %ld
#
# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
# Symmetry magic nums will not be reached if DOS COM comes before them;
# byte 0xeb is matched before these get a chance.
0	leshort	0x12eb		SYMMETRY i386 .o
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x42eb		SYMMETRY i386 standalone executable
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
#	$OpenBSD: sgi,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# sgi:  file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
#                         Dec Ultrix (MIPS)
# all of SGI's *current* machines and OSes run in big-endian mode on the
# MIPS machines, as far as I know.
#
# XXX - what is the blank "-" line?
#
# kbd file definitions
0	string	kbd!map		kbd map file
>8	byte	>0		Ver %d:
>10	short	>0		with %d table(s)
0	belong	0407		old SGI 68020 executable
0	belong	0410		old SGI 68020 pure executable
0	beshort	0x8765		disk quotas file
0	beshort	0x0506		IRIS Showcase file
>2	byte	0x49		-
>3	byte	x		- version %ld
0	beshort	0x0226		IRIS Showcase template
>2	byte	0x63		-
>3	byte	x		- version %ld
0	belong	0x5343464d	IRIS Showcase file
>4	byte	x		- version %ld
0	belong	0x5443464d	IRIS Showcase template
>4	byte	x		- version %ld
0	belong	0xdeadbabe	IRIX Parallel Arena
>8	belong	>0		- version %ld
#
0	beshort	0x0160		MIPSEB COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0162		MIPSEL COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %d
>22	byte	x		.%ld
#
0	beshort	0x6001		MIPSEB-LE COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %d
>22	byte	x		.%ld
#
0	beshort	0x6201		MIPSEL-LE COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
# MIPS 2 additions
#
0	beshort	0x0163		MIPSEB MIPS-II COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0166		MIPSEL MIPS-II COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x6301		MIPSEB-LE MIPS-II COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
0	beshort	0x6601		MIPSEL-LE MIPS-II COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
# MIPS 3 additions
#
0	beshort	0x0140		MIPSEB MIPS-III COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0142		MIPSEL MIPS-III COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x4001		MIPSEB-LE MIPS-III COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
0	beshort	0x4201		MIPSEL-LE MIPS-III COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>22	byte	x		.%ld
#
0	beshort	0x180		MIPSEB Ucode
0	beshort	0x182		MIPSEL Ucode
# 32bit core file
0	belong	0xdeadadb0	IRIX core dump
>4	belong	1		of
>16	string	>\0		'%s'
# 64bit core file
0	belong	0xdeadad40	IRIX 64-bit core dump
>4	belong	1		of
>16	string	>\0		'%s'
# New style crash dump file
0	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
>36	string	>\0					'%s'
# Trusted IRIX info
0	string	SGIAUDIT	SGI Audit file
>8	byte	x		- version %d
>9	byte	x		.%ld
# Are these three SGI-based file types or general ones?
0	string	WNGZWZSC	Wingz compiled script
0	string	WNGZWZSS	Wingz spreadsheet
0	string	WNGZWZHP	Wingz help file
#
0	string	\#Inventor V	IRIS Inventor 1.0 file
0	string	\#Inventor V2	Open Inventor 2.0 file
# XXX - I don't know what next thing is!  It is likely to be an image
# (or movie) format
0	string	glfHeadMagic();		GLF_TEXT
4	belong	0x41010000		GLF_BINARY_LSB_FIRST
4	belong	0x00000141		GLF_BINARY_MSB_FIRST
#	$OpenBSD: sgml,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# sgml:  file(1) magic for Standard Generalized Markup Language
# HyperText Markup Language (HTML) is an SGML document type,
# from Daniel Quinlan (quinlan@yggdrasil.com)
# adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
0   string/cB	\<!DOCTYPE\ html	HTML document text
0   string/cb	\<head			HTML document text
0   string/cb	\<title			HTML document text
0   string/cb	\<html			HTML document text

# Extensible markup language (XML), a subset of SGML
# from Marc Prud'hommeaux (marc@apocalypse.org)
0	string/cb	\<?xml			XML document text
0	string		\<?xml\ version "	XML
0	string		\<?xml\ version="	XML
>15	string		>\0			%.3s document text
>>23	string		\<xsl:stylesheet	(XSL stylesheet)
>>24	string		\<xsl:stylesheet	(XSL stylesheet)
0	string/b	\<?xml			XML document text
0	string/cb	\<?xml			broken XML document text


# SGML, mostly from rph@sq
0   string/cb	\<!doctype		exported SGML document text
0   string/cb	\<!subdoc		exported SGML subdocument text
0   string/cb	\<!--			exported SGML document text

# Web browser cookie files
# (Mozilla, Galeon, Netscape 4, Konqueror..)
# Ulf Harnhammar <ulfh@update.uu.se>
0	string	#\ HTTP\ Cookie\ File	Web browser cookie text
0	string	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
0	string	#\ KDE\ Cookie\ File	Konqueror cookie text
#	$OpenBSD: sharc,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------
# file(1) magic for sharc files
#
# SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 
# FutureGroove Music (dsp@futuregroove.de)

#------------------------------------------------------------------------
0	string			Draw		RiscOS Drawfile
0	string			PACK		RiscOS PackdDir archive

#------------------------------------------------------------------------
# SHARC DSP stuff (based on the FGM SHARC DSP SDK)

0	string			!		Assembler source
0	string			Analog		ADi asm listing file
0	string			.SYSTEM		SHARC architecture file
0	string			.system		SHARC architecture file

0	leshort			0x521C		SHARC COFF binary
>2	leshort			>1		, %hd sections
>>12	lelong			>0		, not stripped
#	$OpenBSD: sidfiles,v 1.3 2001/01/29 01:57:58 niklas Exp $

# sidfiles
0	string		SIDPLAY\ INFOFILE	Sidplay info file
0       string          PSID      		PlaySID v2.2+ (AMIGA) sidtune,
>4      beshort         >0                      w/ header v%d,
>14     beshort         =1              	single song,
>14     beshort         >1              	%d songs,
>16     beshort         >0              	default song: %d
#	$OpenBSD: sinclair,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# sinclair:  file(1) sinclair QL

# additions to /etc/magic by Thomas M. Ott (ThMO)

# Sinclair QL floppy disk formats (ThMO)
0	string	=QL5		QL disk dump data,
>3	string	=A		720 KB,
>3	string	=B		1.44 MB,
>3	string	=C		3.2 MB,
>4	string	>\0		label:%.10s

# Sinclair QL OS dump (ThMO)
# (NOTE: if `file' would be able to use indirect references in a endian format
#	 differing from the natural host format, this could be written more
#	 reliably and faster...)
#
# we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
# than the first 8K of a file... #-(
#
#0		belong	=0x30000
#>49124		belong	<47104
#>>49128		belong	<47104
#>>>49132	belong	<47104
#>>>>49136	belong	<47104	QL OS dump data,
#>>>>>49148	string	>\0	type %.3s,
#>>>>>49142	string	>\0	version %.4s

# Sinclair QL firmware executables (ThMO)
0	string	NqNqNq`\004	QL firmware executable (BCPL)

# Sinclair QL libraries (ThMO)
0	beshort	=0xFB01		QL library archive data

# Sinclair QL executbables (ThMO)
6	beshort	=0x4AFB		QL executable,
>10	string	=\0		un-named
>8	beshort	=1
>>10	string	>\0		named: %.1s
>8	beshort	=2
>>10	string	>\0		named: %.2s
>8	beshort	=3
>>10	string	>\0		named: %.3s
>8	beshort	=4
>>10	string	>\0		named: %.4s
>8	beshort	=5
>>10	string	>\0		named: %.5s
>8	beshort	=6
>>10	string	>\0		named: %.6s
>8	beshort	=7
>>10	string	>\0		named: %.7s
>8	beshort	=8
>>10	string	>\0		named: %.8s
>8	beshort	=9
>>10	string	>\0		named: %.9s
>8	beshort	=10
>>10	string	>\0		named: %.10s
>8	beshort	=11
>>10	string	>\0		named: %.11s
>8	beshort	=12
>>10	string	>\0		named: %.12s
>8	beshort	=13
>>10	string	>\0		named: %.13s
>8	beshort	=14
>>10	string	>\0		named: %.14s
>8	beshort	=15
>>10	string	>\0		named: %.15s
>8	beshort	=16
>>10	string	>\0		named: %.16s
>8	beshort	=17
>>10	string	>\0		named: %.17s
>8	beshort	=18
>>10	string	>\0		named: %.18s
>8	beshort	=19
>>10	string	>\0		named: %.19s
>8	beshort	=20
>>10	string	>\0		named: %.20s
>8	beshort	>20
>>10	string	>\0		(truncated) named: %.20s

# Sinclair QL rom (ThMO)
0	belong	=0x4AFB0001	QL plugin-ROM data,
>10	string	=\0		un-named
>8	beshort	=1
>>10	string	>\0		named: %.1s
>8	beshort	=2
>>10	string	>\0		named: %.2s
>8	beshort	=3
>>10	string	>\0		named: %.3s
>8	beshort	=4
>>10	string	>\0		named: %.4s
>8	beshort	=5
>>10	string	>\0		named: %.5s
>8	beshort	=6
>>10	string	>\0		named: %.6s
>8	beshort	=7
>>10	string	>\0		named: %.7s
>8	beshort	=8
>>10	string	>\0		named: %.8s
>8	beshort	=9
>>10	string	>\0		named: %.9s
>8	beshort	=10
>>10	string	>\0		named: %.10s
>8	beshort	=11
>>10	string	>\0		named: %.11s
>8	beshort	=12
>>10	string	>\0		named: %.12s
>8	beshort	=13
>>10	string	>\0		named: %.13s
>8	beshort	=14
>>10	string	>\0		named: %.14s
>8	beshort	=15
>>10	string	>\0		named: %.15s
>8	beshort	=16
>>10	string	>\0		named: %.16s
>8	beshort	=17
>>10	string	>\0		named: %.17s
>8	beshort	=18
>>10	string	>\0		named: %.18s
>8	beshort	=19
>>10	string	>\0		named: %.19s
>8	beshort	=20
>>10	string	>\0		named: %.20s
>8	beshort	>20
>>10	string	>\0		(truncated) named: %.20s
#	$OpenBSD: sketch,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# Sketch Drawings: http://sketch.sourceforge.net/ 
# From: Edwin Mons <e@ik.nu>
0	string	##Sketch	Sketch document text
#	$OpenBSD: smalltalk,v 1.1 2004/06/03 03:14:20 tedu Exp $

#-----------------------------------------------
# GNU Smalltalk image, starting at version 1.6.2
# From: catull_us@yahoo.com
#
0	string	GSTIm\0\0	GNU SmallTalk
# little-endian
>7	byte&1	=0		LE image version
>>10	byte	x		%d.
>>9	byte	x		\b%d.
>>8	byte	x		\b%d
#>>12	lelong	x		, data: %ld
#>>16	lelong	x		, table: %ld
#>>20	lelong	x		, memory: %ld
# big-endian
>7	byte&1	=1		BE image version
>>8	byte	x		%d.
>>9	byte	x		\b%d.
>>10	byte	x		\b%d
#>>12	belong	x		, data: %ld
#>>16	belong	x		, table: %ld
#>>20	belong	x		, memory: %ld


#	$OpenBSD: sniffer,v 1.4 2004/06/03 03:36:46 tedu Exp $

#------------------------------------------------------------------------------
# sniffer:  file(1) magic for packet capture files
#
# From: guy@alum.mit.edu (Guy Harris)
#

#
# Microsoft Network Monitor 1.x capture files.
#
0	string		RTSS		NetMon capture file
>5	byte		x		- version %d
>4	byte		x		\b.%d
>6	leshort		0		(Unknown)
>6	leshort		1		(Ethernet)
>6	leshort		2		(Token Ring)
>6	leshort		3		(FDDI)
>6	leshort		4		(ATM)

#
# Microsoft Network Monitor 2.x capture files.
#
0	string		GMBU		NetMon capture file
>5	byte		x		- version %d
>4	byte		x		\b.%d
>6	leshort		0		(Unknown)
>6	leshort		1		(Ethernet)
>6	leshort		2		(Token Ring)
>6	leshort		3		(FDDI)
>6	leshort		4		(ATM)

#
# Network General Sniffer capture files.
# Sorry, make that "Network Associates Sniffer capture files."
#
0	string		TRSNIFF\ data\ \ \ \ \032	Sniffer capture file
>33	byte		2		(compressed)
>23	leshort		x		- version %d
>25	leshort		x		\b.%d
>32	byte		0		(Token Ring)
>32	byte		1		(Ethernet)
>32	byte		2		(ARCNET)
>32	byte		3		(StarLAN)
>32	byte		4		(PC Network broadband)
>32	byte		5		(LocalTalk)
>32	byte		6		(Znet)
>32	byte		7		(Internetwork Analyzer)
>32	byte		9		(FDDI)
>32	byte		10		(ATM)

#
# Cinco Networks NetXRay capture files.
# Sorry, make that "Network General Sniffer Basic capture files."
# Sorry, make that "Network Associates Sniffer Basic capture files."
# Sorry, make that "Network Associates Sniffer Basic, and Windows
# Sniffer Pro", capture files."
#
0	string		XCP\0		NetXRay capture file
>4	string		>\0		- version %s
>44	leshort		0		(Ethernet)
>44	leshort		1		(Token Ring)
>44	leshort		2		(FDDI)
>44	leshort		3		(WAN)
>44	leshort		8		(ATM)
>44	leshort		9		(802.11)

#
# "libpcap" capture files.
# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
# the main program that uses that format, but there are other programs
# that use "libpcap", or that use the same capture file format.)
#
0	ubelong		0xa1b2c3d4	tcpdump capture file (big-endian)
>4	beshort		x		- version %d
>6	beshort		x		\b.%d
>20	belong		0		(No link-layer encapsulation
>20	belong		1		(Ethernet
>20	belong		2		(3Mb Ethernet
>20	belong		3		(AX.25
>20	belong		4		(ProNET
>20	belong		5		(CHAOS
>20	belong		6		(Token Ring
>20	belong		7		(BSD ARCNET
>20	belong		8		(SLIP
>20	belong		9		(PPP
>20	belong		10		(FDDI
>20	belong		11		(RFC 1483 ATM
>20	belong		12		(Loopback
>20	belong		13		(IPSec Enc
>20	belong		14		(Raw IP
>20	belong		15		(BSD/OS SLIP
>20	belong		16		(BSD/OS PPP
>20	belong		17		(Old PF Log
>20	belong		18		(PFSync
>20	belong		50		(PPP or Cisco HDLC
>20	belong		51		(PPP-over-Ethernet
>20	belong		100		(RFC 1483 ATM
>20	belong		101		(raw IP
>20	belong		102		(BSD/OS SLIP
>20	belong		103		(BSD/OS PPP
>20	belong		104		(BSD/OS Cisco HDLC
>20	belong		105		(802.11
>20	belong		106		(Linux Classical IP over ATM
>20	belong		107		(Frame Relay
>20	belong		108		(OpenBSD loopback
>20	belong		109		(OpenBSD IPsec encrypted
>20	belong		112		(Cisco HDLC
>20	belong		113		(Linux "cooked"
>20	belong		114		(LocalTalk
>20	belong		117		(OpenBSD PFLOG
>20	belong		119		(802.11 with Prism header
>20	belong		123		(SunATM
>20	belong		127		(802.11 with radiotap header
>20	belong		129		(Linux ARCNET
>20	belong		140		(MTP2
>20	belong		141		(MTP3
>20	belong		143		(DOCSIS
>20	belong		144		(IrDA
>16	belong		x		\b, capture length %d)
0	ulelong		0xa1b2c3d4	tcpdump capture file (little-endian)
>4	leshort		x		- version %d
>6	leshort		x		\b.%d
>20	lelong		0		(No link-layer encapsulation
>20	lelong		1		(Ethernet
>20	lelong		2		(3Mb Ethernet
>20	lelong		3		(AX.25
>20	lelong		4		(ProNET
>20	lelong		5		(CHAOS
>20	lelong		6		(Token Ring
>20	lelong		7		(ARCNET
>20	lelong		8		(SLIP
>20	lelong		9		(PPP
>20	lelong		10		(FDDI
>20	lelong		11		(RFC 1483 ATM
>20	lelong		12		(Loopback
>20	lelong		13		(IPSec Enc
>20	lelong		14		(Raw IP
>20	lelong		15		(BSD/OS SLIP
>20	lelong		16		(BSD/OS PPP
>20	lelong		17		(Old PF Log
>20	lelong		18		(PFSync
>20	lelong		50		(PPP or Cisco HDLC
>20	lelong		51		(PPP-over-Ethernet
>20	lelong		100		(RFC 1483 ATM
>20	lelong		101		(raw IP
>20	lelong		102		(BSD/OS SLIP
>20	lelong		103		(BSD/OS PPP
>20	lelong		104		(BSD/OS Cisco HDLC
>20	lelong		105		(802.11
>20	lelong		106		(Linux Classical IP over ATM
>20	lelong		107		(Frame Relay
>20	lelong		108		(OpenBSD loopback
>20	lelong		109		(OpenBSD IPSEC encrypted
>20	lelong		112		(Cisco HDLC
>20	lelong		113		(Linux "cooked"
>20	lelong		114		(LocalTalk
>20	lelong		117		(OpenBSD PFLOG
>20	lelong		119		(802.11 with Prism header
>20	lelong		123		(SunATM
>20	lelong		127		(802.11 with radiotap header
>20	lelong		129		(Linux ARCNET
>20	lelong		140		(MTP2
>20	lelong		141		(MTP3
>20	lelong		143		(DOCSIS
>20	lelong		144		(IrDA
>16	lelong		x		\b, capture length %d)

#
# "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
# (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
# the main program that uses that format, but there are other programs
# that use "libpcap", or that use the same capture file format.)
#
0	ubelong		0xa1b2cd34	extended tcpdump capture file (big-endian)
>4	beshort		x		- version %d
>6	beshort		x		\b.%d
>20	belong		0		(No link-layer encapsulation
>20	belong		1		(Ethernet
>20	belong		2		(3Mb Ethernet
>20	belong		3		(AX.25
>20	belong		4		(ProNET
>20	belong		5		(CHAOS
>20	belong		6		(Token Ring
>20	belong		7		(ARCNET
>20	belong		8		(SLIP
>20	belong		9		(PPP
>20	belong		10		(FDDI
>20	belong		11		(RFC 1483 ATM
>20	belong		12		(raw IP
>20	belong		13		(BSD/OS SLIP
>20	belong		14		(BSD/OS PPP
>16	belong		x		\b, capture length %d)
0	ulelong		0xa1b2cd34	extended tcpdump capture file (little-endian)
>4	leshort		x		- version %d
>6	leshort		x		\b.%d
>20	lelong		0		(No link-layer encapsulation
>20	lelong		1		(Ethernet
>20	lelong		2		(3Mb Ethernet
>20	lelong		3		(AX.25
>20	lelong		4		(ProNET
>20	lelong		5		(CHAOS
>20	lelong		6		(Token Ring
>20	lelong		7		(ARCNET
>20	lelong		8		(SLIP
>20	lelong		9		(PPP
>20	lelong		10		(FDDI
>20	lelong		11		(RFC 1483 ATM
>20	lelong		12		(raw IP
>20	lelong		13		(BSD/OS SLIP
>20	lelong		14		(BSD/OS PPP
>16	lelong		x		\b, capture length %d)

#
# AIX "iptrace" capture files.
#
0	string		iptrace\ 1.0	"iptrace" capture file
0	string		iptrace\ 2.0	"iptrace" capture file

#
# Novell LANalyzer capture files.
#
0	leshort		0x1001		LANalyzer capture file
0	leshort		0x1007		LANalyzer capture file

#
# HP-UX "nettl" capture files.
#
0	string		\x54\x52\x00\x64\x00	"nettl" capture file

#
# RADCOM WAN/LAN Analyzer capture files.
#
0	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file

#
# NetStumbler log files.  Not really packets, per se, but about as
# close as you can get.  These are log files from NetStumbler, a
# Windows program, that scans for 802.11b networks.
#
0	string		NetS		NetStumbler log file
>8	lelong		x		\b, %d stations found
#	$OpenBSD: softquad,v 1.4 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# softquad:  file(1) magic for SoftQuad Publishing Software
#
# Author/Editor and RulesBuilder
#
# XXX - byte order?
#
0	string		\<!SQ\ DTD>	Compiled SGML rules file
>9	string		>\0		 Type %s
0	string		\<!SQ\ A/E>	A/E SGML Document binary
>9	string		>\0		 Type %s
0	string		\<!SQ\ STS>	A/E SGML binary styles file
>9	string		>\0		 Type %s
0	short		0xc0de		Compiled PSI (v1) data
0	short		0xc0da		Compiled PSI (v2) data
>3	string		>\0		(%s)
# Binary sqtroff font/desc files...
0	short		0125252		SoftQuad DESC or font file binary
>2	short		>0		- version %d
# Bitmaps...
0	string		SQ\ BITMAP1	SoftQuad Raster Format text
#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
# sqtroff intermediate language (replacement for ditroff int. lang.)
0	string		X\ 		SoftQuad troff Context intermediate
>2	string		495		for AT&T 495 laser printer
>2	string		hp		for Hewlett-Packard LaserJet
>2	string		impr		for IMAGEN imPRESS
>2	string		ps		for PostScript
#	$OpenBSD: spectrum,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# spectrum:  file(1) magic for Spectrum emulator files.
#
# John Elliott <jce@seasip.demon.co.uk>

#
# Spectrum +3DOS header
#
0       string          PLUS3DOS\032    Spectrum +3 data
>15     byte            0               - BASIC program
>15     byte            1               - number array
>15     byte            2               - character array
>15     byte            3               - memory block
>>16    belong          0x001B0040      (screen)
>15     byte            4               - Tasword document
>15     string          TAPEFILE        - ZXT tapefile
#
# Tape file. This assumes the .TAP starts with a Spectrum-format header,
# which nearly all will.
#
0       string          \023\000\000    Spectrum .TAP data
>4      string          x               "%-10.10s"
>3      byte            0               - BASIC program
>3      byte            1               - number array
>3      byte            2               - character array
>3      byte            3               - memory block
>>14    belong          0x001B0040      (screen)

# The following three blocks are from pak21-spectrum@srcf.ucam.org
# TZX tape images
0      string          ZXTape!\x1a     Spectrum .TZX data
>8     byte            x               version %d
>9     byte            x               .%d

# RZX input recording files
0      string          RZX!            Spectrum .RZX data
>4     byte            x               version %d
>5     byte            x               .%d

# And three sorts of disk image
0      string          MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
0      string          MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
0      string          EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
#	$OpenBSD: sql,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# sql:  file(1) magic for SQL files
#
# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
# Recognize some MySQL files.
#
0	beshort			0xfe01		MySQL table definition file
>2	byte			x		Version %d
0	belong&0xffffff00	0xfefe0300	MySQL MISAM index file
>3	byte			x		Version %d
0	belong&0xffffff00	0xfefe0700	MySQL MISAM compressed data file
>3	byte			x		Version %d
0	belong&0xffffff00	0xfefe0500	MySQL ISAM index file
>3	byte			x		Version %d
0	belong&0xffffff00	0xfefe0600	MySQL ISAM compressed data file
>3	byte			x		Version %d
0	string		 	\376bin		MySQL replication log
#	$OpenBSD: sun,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# sun:  file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
# releases.  (5.x uses ELF.)
#
0	belong&077777777	0600413		sparc demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0600410		sparc pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0600407		sparc
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

0	belong&077777777	0400413		mc68020 demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>16	belong		>0		not stripped
0	belong&077777777	0400410		mc68020 pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0400407		mc68020
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

0	belong&077777777	0200413		mc68010 demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>16	belong		>0		not stripped
0	belong&077777777	0200410		mc68010 pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0200407		mc68010
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

# reworked these to avoid anything beginning with zero becoming "old sun-2"
0	belong		0407		old sun-2 executable
>16	belong		>0		not stripped
0	belong		0410		old sun-2 pure executable
>16	belong		>0		not stripped
0	belong		0413		old sun-2 demand paged executable
>16	belong		>0		not stripped

#
# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
# binary executed in compatibility mode under SunOS 5.x".
#
0	belong		0x080456	SunOS core file
>4	belong		432		(SPARC)
>>132	string		>\0		from '%s'
>>116	belong		=3		(quit)
>>116	belong		=4		(illegal instruction)
>>116	belong		=5		(trace trap)
>>116	belong		=6		(abort)
>>116	belong		=7		(emulator trap)
>>116	belong		=8		(arithmetic exception)
>>116	belong		=9		(kill)
>>116	belong		=10		(bus error)
>>116	belong		=11		(segmentation violation)
>>116	belong		=12		(bad argument to system call)
>>116	belong		=29		(resource lost)
>>120	belong		x		(T=%dK,
>>124	belong		x		D=%dK,
>>128	belong		x		S=%dK)
>4	belong		826		(68K)
>>128	string		>\0		from '%s'
>4	belong		456		(SPARC 4.x BCP)
>>152	string		>\0		from '%s'
# Sun SunPC
0	long		0xfa33c08e	SunPC 4.0 Hard Disk
0	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
# Sun snoop (see RFC 1761, which describes the capture file format).
#
0	string		snoop		Snoop capture file
>8	belong		>0		- version %ld
>12	belong		0		(IEEE 802.3)
>12	belong		1		(IEEE 802.4)
>12	belong		2		(IEEE 802.5)
>12	belong		3		(IEEE 802.6)
>12	belong		4		(Ethernet)
>12	belong		5		(HDLC)
>12	belong		6		(Character synchronous)
>12	belong		7		(IBM channel-to-channel adapter)
>12	belong		8		(FDDI)
>12	belong		9		(Unknown)

# Microsoft ICM color profile
36	string		acspMSFT	Microsoft ICM Color Profile
# Sun KCMS
36	string		acsp		Kodak Color Management System, ICC Profile

#---------------------------------------------------------------------------
# The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
# lead Sun/Cobalt developer) who agrees that they are good and worthy of
# inclusion.

# Boot ROM images for Sun/Cobalt Linux server appliances
0       string  Cobalt\ Networks\ Inc.\nFirmware\ v     Paged COBALT boot rom
>38     string x        V%.4s

# New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
# at the very end where file(1) can't get it.
0       string CRfs     COBALT boot rom data (Flat boot rom or file system)


#	$OpenBSD: sysex,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------
# sysex: file(1) magic for MIDI sysex files
#
# 
0	byte			0xF0		SysEx File -

# North American Group
>1	byte			0x01		Sequential
>1	byte			0x02		IDP
>1	byte			0x03		OctavePlateau
>1	byte			0x04		Moog
>1	byte			0x05		Passport
>1	byte			0x06		Lexicon
>1	byte			0x07		Kurzweil
>1	byte			0x08		Fender
>1	byte			0x09		Gulbransen
>1	byte			0x0a		AKG
>1	byte			0x0b		Voyce
>1	byte			0x0c		Waveframe
>1	byte			0x0d		ADA
>1	byte			0x0e		Garfield
>1	byte			0x0f		Ensoniq
>1	byte			0x10		Oberheim
>1	byte			0x11		Apple
>1	byte			0x12		GreyMatter
>1	byte			0x14		PalmTree
>1	byte			0x15		JLCooper
>1	byte			0x16		Lowrey
>1	byte			0x17		AdamsSmith
>1	byte			0x18		E-mu
>1	byte			0x19		Harmony
>1	byte			0x1a		ART
>1	byte			0x1b		Baldwin
>1	byte			0x1c		Eventide
>1	byte			0x1d		Inventronics
>1	byte			0x1f		Clarity

# European Group
>1	byte			0x21		SIEL
>1	byte			0x22		Synthaxe
>1	byte			0x24		Hohner
>1	byte			0x25		Twister
>1	byte			0x26		Solton
>1	byte			0x27		Jellinghaus
>1	byte			0x28		Southworth
>1	byte			0x29		PPG
>1	byte			0x2a		JEN
>1	byte			0x2b		SSL
>1	byte			0x2c		AudioVertrieb

>1	byte			0x2f		ELKA
>>3	byte			0x09		EK-44

>1	byte			0x30		Dynacord
>1	byte			0x33		Clavia
>1	byte			0x39		Soundcraft

>1	byte			0x3e		Waldorf
>>3	byte			0x7f		Microwave I

# Japanese Group
>1	byte			0x40		Kawai
>>3	byte			0x20		K1
>>3	byte			0x22		K4

>1	byte			0x41		Roland
>>3	byte			0x14		D-50
>>3	byte			0x2b		U-220
>>3	byte			0x02		TR-707

>1	byte			0x42		Korg
>>3	byte			0x19		M1

>1	byte			0x43		Yamaha
>1	byte			0x44		Casio
>1	byte			0x46		Kamiya
>1	byte			0x47		Akai
>1	byte			0x48		Victor
>1	byte			0x49		Mesosha
>1	byte			0x4b		Fujitsu
>1	byte			0x4c		Sony
>1	byte			0x4e		Teac
>1	byte			0x50		Matsushita
>1	byte			0x51		Fostex
>1	byte			0x52		Zoom
>1	byte			0x54		Matsushita
>1	byte			0x57		Acoustic tech. lab.

>1	belong&0xffffff00	0x00007400	Ta Horng
>1	belong&0xffffff00	0x00007500	e-Tek
>1	belong&0xffffff00	0x00007600	E-Voice
>1	belong&0xffffff00	0x00007700	Midisoft
>1	belong&0xffffff00	0x00007800	Q-Sound
>1	belong&0xffffff00	0x00007900	Westrex
>1	belong&0xffffff00	0x00007a00	Nvidia*
>1	belong&0xffffff00	0x00007b00	ESS
>1	belong&0xffffff00	0x00007c00	Mediatrix
>1	belong&0xffffff00	0x00007d00	Brooktree
>1	belong&0xffffff00	0x00007e00	Otari
>1	belong&0xffffff00	0x00007f00	Key Electronics
>1	belong&0xffffff00	0x00010000	Shure
>1	belong&0xffffff00	0x00010100	AuraSound
>1	belong&0xffffff00	0x00010200	Crystal
>1	belong&0xffffff00	0x00010300	Rockwell
>1	belong&0xffffff00	0x00010400	Silicon Graphics
>1	belong&0xffffff00	0x00010500	Midiman
>1	belong&0xffffff00	0x00010600	PreSonus
>1	belong&0xffffff00	0x00010800	Topaz
>1	belong&0xffffff00	0x00010900	Cast Lightning
>1	belong&0xffffff00	0x00010a00	Microsoft
>1	belong&0xffffff00	0x00010b00	Sonic Foundry
>1	belong&0xffffff00	0x00010c00	Line 6
>1	belong&0xffffff00	0x00010d00	Beatnik Inc.
>1	belong&0xffffff00	0x00010e00	Van Koerving
>1	belong&0xffffff00	0x00010f00	Altech Systems
>1	belong&0xffffff00	0x00011000	S & S Research
>1	belong&0xffffff00	0x00011100	VLSI Technology
>1	belong&0xffffff00	0x00011200	Chromatic
>1	belong&0xffffff00	0x00011300	Sapphire
>1	belong&0xffffff00	0x00011400	IDRC
>1	belong&0xffffff00	0x00011500	Justonic Tuning
>1	belong&0xffffff00	0x00011600	TorComp
>1	belong&0xffffff00	0x00011700	Newtek Inc.
>1	belong&0xffffff00	0x00011800	Sound Sculpture
>1	belong&0xffffff00	0x00011900	Walker Technical
>1	belong&0xffffff00	0x00011a00	Digital Harmony
>1	belong&0xffffff00	0x00011b00	InVision
>1	belong&0xffffff00	0x00011c00	T-Square
>1	belong&0xffffff00	0x00011d00	Nemesys
>1	belong&0xffffff00	0x00011e00	DBX
>1	belong&0xffffff00	0x00011f00	Syndyne
>1	belong&0xffffff00	0x00012000	Bitheadz	
>1	belong&0xffffff00	0x00012100	Cakewalk
>1	belong&0xffffff00	0x00012200	Staccato
>1	belong&0xffffff00	0x00012300	National Semicon.
>1	belong&0xffffff00	0x00012400	Boom Theory
>1	belong&0xffffff00	0x00012500	Virtual DSP Corp
>1	belong&0xffffff00	0x00012600	Antares
>1	belong&0xffffff00	0x00012700	Angel Software
>1	belong&0xffffff00	0x00012800	St Louis Music
>1	belong&0xffffff00	0x00012900	Lyrrus dba G-VOX
>1	belong&0xffffff00	0x00012a00	Ashley Audio
>1	belong&0xffffff00	0x00012b00	Vari-Lite
>1	belong&0xffffff00	0x00012c00	Summit Audio
>1	belong&0xffffff00	0x00012d00	Aureal Semicon.
>1	belong&0xffffff00	0x00012e00	SeaSound
>1	belong&0xffffff00	0x00012f00	U.S. Robotics
>1	belong&0xffffff00	0x00013000	Aurisis
>1	belong&0xffffff00	0x00013100	Nearfield Multimedia
>1	belong&0xffffff00	0x00013200	FM7 Inc.
>1	belong&0xffffff00	0x00013300	Swivel Systems
>1	belong&0xffffff00	0x00013400	Hyperactive
>1	belong&0xffffff00	0x00013500	MidiLite
>1	belong&0xffffff00	0x00013600	Radical
>1	belong&0xffffff00	0x00013700	Roger Linn
>1	belong&0xffffff00	0x00013800	Helicon
>1	belong&0xffffff00	0x00013900	Event
>1	belong&0xffffff00	0x00013a00	Sonic Network
>1	belong&0xffffff00	0x00013b00	Realtime Music
>1	belong&0xffffff00	0x00013c00	Apogee Digital

>1	belong&0xffffff00	0x00202b00	Medeli Electronics
>1	belong&0xffffff00	0x00202c00	Charlie Lab
>1	belong&0xffffff00	0x00202d00	Blue Chip Music
>1	belong&0xffffff00	0x00202e00	BEE OH Corp
>1	belong&0xffffff00	0x00202f00	LG Semicon America
>1	belong&0xffffff00	0x00203000	TESI
>1	belong&0xffffff00	0x00203100	EMAGIC
>1	belong&0xffffff00	0x00203200	Behringer
>1	belong&0xffffff00	0x00203300	Access Music
>1	belong&0xffffff00	0x00203400	Synoptic
>1	belong&0xffffff00	0x00203500	Hanmesoft Corp
>1	belong&0xffffff00	0x00203600	Terratec
>1	belong&0xffffff00	0x00203700	Proel SpA
>1	belong&0xffffff00	0x00203800	IBK MIDI
>1	belong&0xffffff00	0x00203900	IRCAM
>1	belong&0xffffff00	0x00203a00	Propellerhead Software
>1	belong&0xffffff00	0x00203b00	Red Sound Systems
>1	belong&0xffffff00	0x00203c00	Electron ESI AB
>1	belong&0xffffff00	0x00203d00	Sintefex Audio
>1	belong&0xffffff00	0x00203e00	Music and More
>1	belong&0xffffff00	0x00203f00	Amsaro
>1	belong&0xffffff00	0x00204000	CDS Advanced Technology
>1	belong&0xffffff00	0x00204100	Touched by Sound
>1	belong&0xffffff00	0x00204200	DSP Arts
>1	belong&0xffffff00	0x00204300	Phil Rees Music
>1	belong&0xffffff00	0x00204400	Stamer Musikanlagen GmbH
>1	belong&0xffffff00	0x00204500	Soundart
>1	belong&0xffffff00	0x00204600	C-Mexx Software
>1	belong&0xffffff00	0x00204700	Klavis Tech.
>1	belong&0xffffff00	0x00204800	Noteheads AB

0	string			T707		Roland TR-707 Data
#	$OpenBSD: teapot,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# teapot:  file(1) magic for "teapot" spreadsheet
#
0       string          #!teapot\012xdr      teapot work sheet (XDR format)
#	$OpenBSD: terminfo,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# terminfo:  file(1) magic for terminfo
#
# XXX - byte order for screen images?
#
0	string		\032\001	Compiled terminfo entry
0	short		0433		Curses screen image
0	short		0434		Curses screen image
#	$OpenBSD: tex,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# tex:  file(1) magic for TeX files
#
# From <conklin@talisman.kaleida.com>

# Although we may know the offset of certain text fields in TeX DVI
# and font files, we can't use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0	string		\367\002	TeX DVI file
>16	string		>\0		(%s)
0	string		\367\203	TeX generic font data
0	string		\367\131	TeX packed font data
>3	string		>\0		(%s)
0	string		\367\312	TeX virtual font data
0	string		This\ is\ TeX,	TeX transcript text
0	string		This\ is\ METAFONT,	METAFONT transcript text

# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data.  The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2	string		\000\021	TeX font metric data
>33	string		>\0		(%s)
2	string		\000\022	TeX font metric data
>33	string		>\0		(%s)

# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\\input\ texinfo	Texinfo source text
0	string		This\ is\ Info\ file	GNU Info text

# TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\\input		TeX document text
0	string		\\section	LaTeX document text
0	string		\\setlength	LaTeX document text
0	string		\\documentstyle	LaTeX document text
0	string		\\chapter	LaTeX document text
0	string		\\documentclass	LaTeX 2e document text
0	string		\\relax		LaTeX auxiliary file
0	string		\\contentsline	LaTeX  table of contents
0	string		%\ -*-latex-*-	LaTeX document text

# Tex document, from Hendrik Scholz <hendrik@scholz.net>
0   string      \\ifx       TeX document text

# Index and glossary files
0	string		\\indexentry	LaTeX raw index file
0	string		\\begin{theindex}	LaTeX sorted index
0	string		\\glossaryentry	LaTeX raw glossary
0	string		\\begin{theglossary}	LaTeX sorted glossary
0	string		This\ is\ makeindex	Makeindex log file

# End of TeX

#------------------------------------------------------------------------------
# file(1) magic for BibTex text files
# From Hendrik Scholz <hendrik@scholz.net>

0   string @article{          BibTex text file
0   string @book{             BibTex text file
0   string @inbook{           BibTex text file
0   string @incollection{     BibTex text file
0   string @inproceedings{    BibTex text file
0   string @manual{           BibTex text file
0   string @misc{             BibTex text file
0   string @preamble{         BibTex text file
0   string @phdthesis{        BibTex text file
0   string @techreport{       BibTex text file
0   string @unpublished{      BibTex text file

0   string @Article{          BibTex text file
0   string @Book{             BibTex text file
0   string @Inbook{           BibTex text file
0   string @Incollection{     BibTex text file
0   string @Inproceedings{    BibTex text file
0   string @Manual{           BibTex text file
0   string @Misc{             BibTex text file
0   string @Preamble{         BibTex text file
0   string @Phdthesis{        BibTex text file
0   string @Techreport{       BibTex text file
0   string @Unpublished{      BibTex text file

0   string @ARTICLE{          BibTex text file
0   string @BOOK{             BibTex text file
0   string @INBOOK{           BibTex text file
0   string @INCOLLECTION{     BibTex text file
0   string @INPROCEEDINGS{    BibTex text file
0   string @MANUAL{           BibTex text file
0   string @MISC{             BibTex text file
0   string @PREAMBLE{         BibTex text file
0   string @PHDTHESIS{        BibTex text file
0   string @TECHREPORT{       BibTex text file
0   string @UNPUBLISHED{      BibTex text file

73  string %%%\ \ BibTeX-file{ BibTex text file (with full header)

73  string %%%\ \ @BibTeX-style-file{   BibTeX style text file (with full header)

0   string %\ BibTeX\ standard\ bibliography\      BibTeX standard bibliography style text file

0   string %\ BibTeX\ `     BibTeX custom bibliography style text file

0   string  @c\ @mapfile{   TeX font aliases text file

#	$OpenBSD: ti-8x,v 1.1 2004/06/03 03:14:20 tedu Exp $

# ------------------------------------------------------------------------
# ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
#
# From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
#
# Update: Romain Lievin (roms@lpg.ticalc.org).
#
# NOTE: This list is not complete.
# Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
# program/group magic numbers in here because I cannot find any.
0		string		**TI80**	TI-80 Graphing Calculator File.
0		string		**TI81**	TI-81 Graphing Calculator File.
#
# Magic Numbers for the TI-73
#
0		string		**TI73**	TI-73 Graphing Calculator
>0x00003B	byte		0x00		(real number)
>0x00003B	byte		0x01		(list)
>0x00003B	byte		0x02		(matrix)
>0x00003B	byte		0x03		(equation)
>0x00003B	byte		0x04		(string)
>0x00003B	byte		0x05		(program)
>0x00003B	byte		0x06		(assembly program)
>0x00003B	byte		0x07		(picture)
>0x00003B	byte		0x08		(gdb)
>0x00003B	byte		0x0C		(complex number)
>0x00003B	byte		0x0F		(window settings)
>0x00003B	byte		0x10		(zoom)
>0x00003B	byte		0x11		(table setup)
>0x00003B	byte		0x13		(backup)

# Magic Numbers for the TI-82
#
0		string		**TI82**	TI-82 Graphing Calculator
>0x00003B	byte		0x00		(real)
>0x00003B	byte		0x01		(list)
>0x00003B	byte		0x02		(matrix)
>0x00003B	byte		0x03		(Y-variable)
>0x00003B	byte		0x05		(program)
>0x00003B	byte		0x06		(protected prgm)
>0x00003B	byte		0x07		(picture)
>0x00003B	byte		0x08		(gdb)
>0x00003B	byte		0x0B		(window settings)
>0x00003B	byte		0x0C		(window settings)
>0x00003B	byte		0x0D		(table setup)
>0x00003B	byte		0x0E		(screenshot)
>0x00003B	byte		0x0F		(backup)
#
# Magic Numbers for the TI-83
#
0		string		**TI83**	TI-83 Graphing Calculator
>0x00003B	byte		0x00		(real)
>0x00003B	byte		0x01		(list)
>0x00003B	byte		0x02		(matrix)
>0x00003B	byte		0x03		(Y-variable)
>0x00003B	byte		0x04		(string)
>0x00003B	byte		0x05		(program)
>0x00003B	byte		0x06		(protected prgm)
>0x00003B	byte		0x07		(picture)
>0x00003B	byte		0x08		(gdb)
>0x00003B	byte		0x0B		(window settings)
>0x00003B	byte		0x0C		(window settings)
>0x00003B	byte		0x0D		(table setup)
>0x00003B	byte		0x0E		(screenshot)
>0x00003B	byte		0x13		(backup)
#
# Magic Numbers for the TI-83+
#
0		string		**TI83F*	TI-83+ Graphing Calculator
>0x00003B	byte		0x00		(real number)
>0x00003B	byte		0x01		(list)
>0x00003B	byte		0x02		(matrix)
>0x00003B	byte		0x03		(equation)
>0x00003B	byte		0x04		(string)
>0x00003B	byte		0x05		(program)
>0x00003B	byte		0x06		(assembly program)
>0x00003B	byte		0x07		(picture)
>0x00003B	byte		0x08		(gdb)
>0x00003B	byte		0x0C		(complex number)
>0x00003B	byte		0x0F		(window settings)
>0x00003B	byte		0x10		(zoom)
>0x00003B	byte		0x11		(table setup)
>0x00003B	byte		0x13		(backup)
>0x00003B	byte		0x15		(application variable)
>0x00003B	byte		0x17		(group of variable)

#
# Magic Numbers for the TI-85
#
0		string		**TI85**	TI-85 Graphing Calculator
>0x00003B	byte		0x00		(real number)
>0x00003B	byte		0x01		(complex number)
>0x00003B	byte		0x02		(real vector)
>0x00003B	byte		0x03		(complex vector)
>0x00003B	byte		0x04		(real list)
>0x00003B	byte		0x05		(complex list)
>0x00003B	byte		0x06		(real matrix)
>0x00003B	byte		0x07		(complex matrix)
>0x00003B	byte		0x08		(real constant)
>0x00003B	byte		0x09		(complex constant)
>0x00003B	byte		0x0A		(equation)
>0x00003B	byte		0x0C		(string)
>0x00003B	byte		0x0D		(function GDB)
>0x00003B	byte		0x0E		(polar GDB)
>0x00003B	byte		0x0F		(parametric GDB)
>0x00003B	byte		0x10		(diffeq GDB)
>0x00003B	byte		0x11		(picture)
>0x00003B	byte		0x12		(program)
>0x00003B	byte		0x13		(range)
>0x00003B	byte		0x17		(window settings)
>0x00003B	byte		0x18		(window settings)
>0x00003B	byte		0x19		(window settings)
>0x00003B	byte		0x1A		(window settings)
>0x00003B	byte		0x1B		(zoom)
>0x00003B	byte		0x1D		(backup)
>0x00003B	byte		0x1E		(unknown)
>0x00003B	byte		0x2A		(equation)
>0x000032	string		ZS4		- ZShell Version 4 File.
>0x000032	string		ZS3		- ZShell Version 3 File.
#
# Magic Numbers for the TI-86
#
0		string		**TI86**	TI-86 Graphing Calculator
>0x00003B	byte		0x00		(real number)
>0x00003B	byte		0x01		(complex number)
>0x00003B	byte		0x02		(real vector)
>0x00003B	byte		0x03		(complex vector)
>0x00003B	byte		0x04		(real list)
>0x00003B	byte		0x05		(complex list)
>0x00003B	byte		0x06		(real matrix)
>0x00003B	byte		0x07		(complex matrix)
>0x00003B	byte		0x08		(real constant)
>0x00003B	byte		0x09		(complex constant)
>0x00003B	byte		0x0A		(equation)
>0x00003B	byte		0x0C		(string)
>0x00003B	byte		0x0D		(function GDB)
>0x00003B	byte		0x0E		(polar GDB)
>0x00003B	byte		0x0F		(parametric GDB)
>0x00003B	byte		0x10		(diffeq GDB)
>0x00003B	byte		0x11		(picture)
>0x00003B	byte		0x12		(program)
>0x00003B	byte		0x13		(range)
>0x00003B	byte		0x17		(window settings)
>0x00003B	byte		0x18		(window settings)
>0x00003B	byte		0x19		(window settings)
>0x00003B	byte		0x1A		(window settings)
>0x00003B	byte		0x1B		(zoom)
>0x00003B	byte		0x1D		(backup)
>0x00003B	byte		0x1E		(unknown)
>0x00003B	byte		0x2A		(equation)
#
# Magic Numbers for the TI-89
#
0		string		**TI89**	TI-89 Graphing Calculator
>0x000048	byte		0x00		(expression)
>0x000048	byte		0x04		(list)
>0x000048	byte		0x06		(matrix)
>0x000048	byte		0x0A		(data)
>0x000048	byte		0x0B		(text)
>0x000048	byte		0x0C		(string)
>0x000048	byte		0x0D		(graphic data base)
>0x000048	byte		0x0E		(figure)
>0x000048	byte		0x10		(picture)
>0x000048	byte		0x12		(program)
>0x000048	byte		0x13		(function)
>0x000048	byte		0x14		(macro)
>0x000048	byte		0x1C		(zipped)
>0x000048	byte		0x21		(assembler)
#
# Magic Numbers for the TI-92
#
0		string		**TI92**	TI-92 Graphing Calculator
>0x000048	byte		0x00		(expression)
>0x000048	byte		0x04		(list)
>0x000048	byte		0x06		(matrix)
>0x000048	byte		0x0A		(data)
>0x000048	byte		0x0B		(text)
>0x000048	byte		0x0C		(string)
>0x000048	byte		0x0D		(graphic data base)
>0x000048	byte		0x0E		(figure)
>0x000048	byte		0x10		(picture)
>0x000048	byte		0x12		(program)
>0x000048	byte		0x13		(function)
>0x000048	byte		0x14		(macro)
>0x000048	byte		0x1D		(backup)
#
# Magic Numbers for the TI-92+/V200
#
0		string		**TI92P*	TI-92+/V200 Graphing Calculator
>0x000048	byte		0x00		(expression)
>0x000048	byte		0x04		(list)
>0x000048	byte		0x06		(matrix)
>0x000048	byte		0x0A		(data)
>0x000048	byte		0x0B		(text)
>0x000048	byte		0x0C		(string)
>0x000048	byte		0x0D		(graphic data base)
>0x000048	byte		0x0E		(figure)
>0x000048	byte		0x10		(picture)
>0x000048	byte		0x12		(program)
>0x000048	byte		0x13		(function)
>0x000048	byte		0x14		(macro)
>0x000048	byte		0x1C		(zipped)
>0x000048	byte		0x21		(assembler)
#
# Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
#
0x0000016	string		Advanced	TI-XX Graphing Calculator (FLASH)
0		string		**TIFL**	TI-XX Graphing Calculator (FLASH)
>8		byte		>0		- Revision %d
>>9 		byte		x		\b.%d,
>12		byte		>0		Revision date %02x
>>13		byte		x		\b/%02x
>>14		beshort		x		\b/%04x,
>17		string		>/0		name: '%s',
>48		byte		0x74		device: TI-73,
>48		byte		0x73		device: TI-83+,
>48		byte		0x98		device: TI-89,
>48		byte		0x88		device: TI-92+,
>49		byte		0x23		type: OS upgrade,
>49		byte		0x24		type: application,
>49		byte		0x25		type: certificate,
>49		byte		0x3e		type: license,
>74		lelong		>0		size: %ld bytes

# VTi & TiEmu skins (TI Graphing Calculators).
# From: Romain Lievin (roms@lpg.ticalc.org).
# Magic Numbers for the VTi skins
0               string          VTI		Virtual TI skin
>3		string		v		- Version
>>4		byte		>0		\b %c
>>6		byte		x		\b.%c
# Magic Numbers for the TiEmu skins
0		string		TiEmu		TiEmu skin
>6              string          v               - Version
>>7             byte            >0              \b %c
>>9             byte            x               \b.%c
>>10		byte		x		\b%c
#	$OpenBSD: timezone,v 1.4 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# timezone:  file(1) magic for timezone data
#
# from Daniel Quinlan (quinlan@yggdrasil.com)
# this should work on Linux, SunOS, and maybe others
# Added new official magic number for recent versions of the Olson code
0	string	TZif	timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
0	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data
#	$OpenBSD: troff,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# troff:  file(1) magic for *roff
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)

# troff input
0	string		.\\"		troff or preprocessor input text
0	string		'\\"		troff or preprocessor input text
0	string		'.\\"		troff or preprocessor input text
0	string		\\"		troff or preprocessor input text

# ditroff intermediate output text
0	string		x\ T		ditroff text
>4	string		cat		for the C/A/T phototypesetter
>4	string		ps		for PostScript
>4	string		dvi		for DVI
>4	string		ascii		for ASCII
>4	string		lj4		for LaserJet 4
>4	string		latin1		for ISO 8859-1 (Latin 1)
>4	string		X75		for xditview at 75dpi
>>7	string		-12		(12pt)
>4	string		X100		for xditview at 100dpi
>>8	string		-12		(12pt)

# output data formats
0	string		\100\357	very old (C/A/T) troff output data
#	$OpenBSD: tuxedo,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# tuxedo:	file(1) magic for BEA TUXEDO data files
#
# from Ian Springer <ispringer@hotmail.com>
#
0	string		\0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0	BEA TUXEDO DES mask data
#	$OpenBSD: typeset,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# typeset:  file(1) magic for other typesetting
#
0	string		Interpress/Xerox	Xerox InterPress data
>16	string		/			(version
>>17	string		>\0			%s)
#	$OpenBSD: unknown,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# unknown:  file(1) magic for unknown machines
#
# XXX - this probably should be pruned, as it'll match PDP-11 and
# VAX image formats.
#
# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
# respectively).
#
# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
# have the "version %ld", which may be a bogus COFFism (I don't think
# there ever was COFF for the PDP-11).
#
# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
# long, as it would be on a VAX.
#
# 0x10C is 0414 and 0x10E is 416; those *are* unknown.
#
0	short		0x107		unknown machine executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x108		unknown pure executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x109		PDP-11 separate I&D
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x10b		unknown pure executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	long		0x10c		unknown demand paged pure executable
>16	long		>0		not stripped
0	long		0x10e		unknown readable demand paged pure executable
#	$OpenBSD: uuencode,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# uuencode:  file(1) magic for ASCII-encoded files
#

# GRR:  the first line of xxencoded files is identical to that in uuencoded
# files, but the first character in most subsequent lines is 'h' instead of
# 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
# punctuation and survives BITNET gateways better.)  If regular expressions
# were supported, this entry could possibly be split into two with
# "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
0	string		begin\040	uuencoded or xxencoded text

# btoa(1) is an alternative to uuencode that requires less space.
0	string		xbtoa\ Begin	btoa'd text

# ship(1) is another, much cooler alternative to uuencode.
# Greg Roelofs, newt@uchicago.edu
0	string		$\012ship	ship'd binary text

# bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
# Greg Roelofs, newt@uchicago.edu
0	string	Decode\ the\ following\ with\ bdeco	bencoded News text

# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
# Daniel Quinlan, quinlan@yggdrasil.com
11	string	must\ be\ converted\ with\ BinHex	BinHex binary text
>41	string	x					\b, version %.3s

# GRR:  is MIME BASE64 encoding handled somewhere?
#	$OpenBSD: varied.out,v 1.4 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# varied.out:  file(1) magic for various USG systems
#
#	Herewith many of the object file formats used by USG systems.
#	Most have been moved to files for a particular processor,
#	and deleted if they duplicate other entries.
#
0	short		0610		Perkin-Elmer executable
# AMD 29K
0	beshort		0572		amd 29k coff noprebar executable
0	beshort		01572		amd 29k coff prebar executable
0	beshort		0160007		amd 29k coff archive
# Cray
6	beshort		0407		unicos (cray) executable
# Ultrix 4.3
596	string		\130\337\377\377	Ultrix core file
>600	string		>\0		from '%s'
# BeOS and MAcOS PEF executables
# From: hplus@zilker.net (Jon Watte)
0	string		Joy!peffpwpc	header for PowerPC PEF executable
#
# ava assembler/linker Uros Platise <uros.platise@ijs.si>
0       string          avaobj  AVR assembler object code
>7      string          >\0     version '%s'
# gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
0	string		gmon		GNU prof performance data
>4	long		x		- version %ld
# From: Dave Pearson <davep@davep.org>
# Harbour <URL:http://www.harbour-project.org/> HRB files.
0	string		\xc0HRB		Harbour HRB file
>4	short		x		version %d

# From: "Stefan A. Haubenthal" <polluks@web.de>
0	belong		0x000001EB	Plan 9 executable
#	$OpenBSD: vax,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# vax:  file(1) magic for VAX executable/object and APL workspace
#
0	lelong		0101557		VAX single precision APL workspace
0	lelong		0101556		VAX double precision APL workspace

#
# VAX a.out (32V, BSD)
#
0	lelong		0407		VAX executable
>16	lelong		>0		not stripped

0	lelong		0410		VAX pure executable
>16	lelong		>0		not stripped

0	lelong		0413		VAX demand paged pure executable
>16	lelong		>0		not stripped

0	lelong		0420		VAX demand paged (first page unmapped) pure executable
>16	lelong		>0		not stripped

#
# VAX COFF
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0	leshort		0570		VAX COFF executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld
0	leshort		0575		VAX COFF pure executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld
#	$OpenBSD: visx,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# visx:  file(1) magic for Visx format files
#
0	short		0x5555		VISX image file
>2	byte		0		(zero)
>2	byte		1		(unsigned char)
>2	byte		2		(short integer)
>2	byte		3		(float 32)
>2	byte		4		(float 64)
>2	byte		5		(signed char)
>2	byte		6		(bit-plane)
>2	byte		7		(classes)
>2	byte		8		(statistics)
>2	byte		10		(ascii text)
>2	byte		15		(image segments)
>2	byte		100		(image set)
>2	byte		101		(unsigned char vector)
>2	byte		102		(short integer vector)
>2	byte		103		(float 32 vector)
>2	byte		104		(float 64 vector)
>2	byte		105		(signed char vector)
>2	byte		106		(bit plane vector)
>2	byte		121		(feature vector)
>2	byte		122		(feature vector library)
>2	byte		124		(chain code)
>2	byte		126		(bit vector)
>2	byte		130		(graph)
>2	byte		131		(adjacency graph)
>2	byte		132		(adjacency graph library)
>2	string		.VISIX		(ascii text)
#	$OpenBSD: vms,v 1.3 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# vms:  file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)

# GRR 950122:  I'm just guessing on these, based on inspection of the headers
# of three executables each for Alpha and VAX architectures.  The VAX files
# all had headers similar to this:
#
#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
#
0	string	\xb0\0\x30\0	VMS VAX executable
>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#
# The AXP files all looked like this, except that the byte at offset 0x22
# was 06 in some of them and 07 in others:
#
#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
#
0	belong	0x03000000	VMS Alpha executable
>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#	$OpenBSD: vmware,v 1.1 2004/06/03 03:14:20 tedu Exp $

# -----------------------------------------------------------
# VMware specific files (deducted from version 1.1 and log file entries)
# Anthon van der Neut (anthon@mnt.org)
0	belong	0x4d52564e	VMware nvram 
0	belong	0x434f5744	VMware
>4	byte	3	 	virtual disk 
>>32	lelong	x		(%d/
>>36	lelong	x		\b%d/
>>40	lelong	x		\b%d)
>4	byte	2	 	undoable disk
>>32	string  >\0		(%s)
#	$OpenBSD: vorbis,v 1.1 2004/06/03 03:15:24 tedu Exp $

#------------------------------------------------------------------------------
# vorbis:  file(1) magic for Ogg/Vorbis files
#
# From Felix von Leitner <leitner@fefe.de>
# Extended by Beni Cherniavsky <cben@crosswinds.net>
# Further extended by Greg Wooledge <greg@wooledge.org>
#
# Most (everything but the number of channels and bitrate) is commented
# out with `##' as it's not interesting to the average user.  The most
# probable things advanced users would want to uncomment are probably
# the number of comments and the encoder version.
#
# --- Ogg Framing ---
0		string		OggS		Ogg data
>4		byte		!0		UNKNOWN REVISION %u
##>4		byte		0		revision 0
>4		byte		0
##>>14		lelong		x		(Serial %lX)
# --- First vorbis packet - general header ---
>>28		string		\x01vorbis	\b, Vorbis audio,
>>>35		lelong		!0		UNKNOWN VERSION %lu,
##>>>35		lelong		0		version 0,
>>>35		lelong		0
>>>>39		ubyte		1		mono,
>>>>39		ubyte		2		stereo,
>>>>39		ubyte		>2		%u channels,
>>>>40		lelong		x		%lu Hz
# Minimal, nominal and maximal bitrates specified when encoding
>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	\b,
# The above tests if at least one of these is specified:
>>>>>44		lelong		!-1
# Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
# instead of -1.
# Vorbis 1.0 uses 0 instead of -1.
>>>>>>44	lelong		!-1000
>>>>>>>44	lelong		!0
>>>>>>>>44	lelong		x		>%lu
>>>>>48		lelong		!-1
>>>>>>48	lelong		x		~%lu
>>>>>52		lelong		!-1
>>>>>>52	lelong		!0
>>>>>>>52	lelong		!-1000
>>>>>>>>52	lelong		x		<%lu
>>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	bps
# -- Second vorbis header packet - the comments
# A kludge to read the vendor string.  It's a counted string, not a
# zero-terminated one, so file(1) can't read it in a generic way.
# libVorbis is the only one existing currently, so I detect specifically
# it.  The interesting value is the cvs date (8 digits decimal).
# Post-RC1 Ogg files have the second header packet (and thus the version)
# in a different place, so we must use an indirect offset.
#>>>(84.b+85)		string		\x03vorbis
#>>>>(84.b+96)		string/c	Xiphophorus\ libVorbis\ I	\b, created by: Xiphophorus libVorbis I
#>>>>>(84.b+120)		string		>00000000	%.8s
# Map to beta version numbers:
#>>>>>>(84.b+120)	string		<20000508	(<beta1 - prepublic)
#>>>>>>(84.b+120)	string		20000508	(beta1/2)
#>>>>>>(84.b+120)	string		>20000508
#>>>>>>>(84.b+120)	string		<20001031	(beta2-3)
#>>>>>>(84.b+120)	string		20001031	(beta3)
#>>>>>>(84.b+120)	string		>20001031
#>>>>>>>(84.b+120)	string		<20010225	(beta3-4)
#>>>>>>(84.b+120)	string		20010225	(beta4)
#>>>>>>(84.b+120)	string		>20010225
#>>>>>>>(84.b+120)	string		<20010615	(beta4-RC1)
#>>>>>>(84.b+120)	string		20010615	(RC1)
#>>>>>>(84.b+120)	string		20010813	(RC2)
#>>>>>>(84.b+120)	string		20010816	(RC2 - Garf tuned v1)
#>>>>>>(84.b+120)	string		20011014	(RC2 - Garf tuned v2)
#>>>>>>(84.b+120)	string		20011217	(pre-RC3 CVS)
#>>>>>>(84.b+120)	string		20011231	(RC3)
# Some pre-1.0 CVS snapshots still had "Xiphphorus"...
#>>>>>>(84.b+120)	string		>20011231	(pre-1.0 CVS)
# For the 1.0 release, Xiphophorus is replaced by Xiph.Org
#>>>>(84.b+96)		string/c	Xiph.Org\ libVorbis\ I	\b, created by: Xiph.Org libVorbis I
#>>>>>(84.b+117)		string		>00000000	%.8s
#>>>>>>(84.b+117)	string		<20020717	(pre-1.0 CVS)
#>>>>>>(84.b+117)	string		20020717	(1.0)
#	$OpenBSD: vxl,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# VXL: file(1) magic for VXL binary IO data files
#
# from Ian Scott <scottim@sf.net>
#
# VXL is a collection of C++ libraries for Computer Vision.
# See the vsl chapter in the VXL Book for more info
# http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
# http:/vxl.sf.net

2	lelong	0x472b2c4e	VXL data file,
>0	leshort	>0		schema version no %d
#	$OpenBSD: wordperfect,v 1.3 2001/01/29 01:57:58 niklas Exp $

#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
0	string	\377WPC\020\000\000\000\022\012\001\001\000\000\000\000	(WP) loadable text
>15	byte		0		Optimized for Intel
>15	byte		1		Optimized for Non-Intel
1	string		WPC		(Corel/WP)
>8	beshort		257		WordPerfect macro
>8	beshort		258		WordPerfect help file
>8	beshort		259		WordPerfect keyboard file
>8	beshort		266		WordPerfect document
>8	beshort		267		WordPerfect dictionary
>8	beshort		268		WordPerfect thesaurus
>8	beshort		269		WordPerfect block
>8	beshort		270		WordPerfect rectangular block
>8	beshort		271		WordPerfect column block
>8	beshort		272		WordPerfect printer data
>8	beshort		275		WordPerfect printer data
>8	beshort		276		WordPerfect driver resource data
>8	beshort		279		WordPerfect hyphenation code
>8	beshort		280		WordPerfect hyphenation data
>8	beshort		281		WordPerfect macro resource data
>8	beshort		283		WordPerfect hyphenation lex
>8	beshort		285		WordPerfect wordlist
>8	beshort		286		WordPerfect equation resource data
>8	beshort		289		WordPerfect spell rules
>8	beshort		290		WordPerfect dictionary rules
>8	beshort		295		WordPerfect spell rules (Microlytics)
>8	beshort		299		WordPerfect settings file
>8	beshort		301		WordPerfect 4.2 document
>8	beshort		325		WordPerfect dialog file
>8	beshort		332		WordPerfect button bar
>8	beshort		513		Shell macro
>8	beshort		522		Shell definition
>8	beshort		769		Notebook macro
>8	beshort		770		Notebook help file
>8	beshort		771		Notebook keyboard file
>8	beshort		778		Notebook definition
>8	beshort		1026	Calculator help file
>8	beshort 		1538	Calendar help file
>8	beshort 		1546	Calendar data file
>8	beshort		1793	Editor macro
>8	beshort		1794	Editor help file
>8	beshort		1795	Editor keyboard file
>8	beshort		1817	Editor macro resource file
>8	beshort 		2049	Macro editor macro
>8	beshort 		2050	Macro editor help file
>8	beshort		2051	Macro editor keyboard file
>8	beshort		2305	PlanPerfect macro
>8	beshort		2306	PlanPerfect help file
>8	beshort		2307	PlanPerfect keyboard file
>8	beshort		2314	PlanPerfect worksheet
>8	beshort		2319	PlanPerfect printer definition
>8	beshort		2322	PlanPerfect graphic definition
>8	beshort		2323	PlanPerfect data
>8	beshort		2324	PlanPerfect temporary printer
>8	beshort		2329	PlanPerfect macro resource data
>8	byte		11		Mail
>8	beshort		2818	help file
>8	beshort		2821	distribution list
>8	beshort		2826	out box
>8	beshort		2827	in box
>8	beshort		2836	users archived mailbox
>8	beshort		2837	archived message database
>8	beshort		2838	archived attachments
>8	beshort		3083	Printer temporary file
>8	beshort		3330	Scheduler help file
>8	beshort		3338	Scheduler in file
>8	beshort		3339	Scheduler out file
>8	beshort		3594	GroupWise settings file
>8	beshort		3601	GroupWise directory services
>8	beshort		3627	GroupWise settings file
>8	beshort		4362	Terminal resource data
>8	beshort		4363	Terminal resource data
>8	beshort		4395	Terminal resource data
>8	beshort		4619	GUI loadable text
>8	beshort		4620	graphics resource data
>8	beshort		4621	printer settings file
>8	beshort		4622	port definition file
>8	beshort		4623	print queue parameters
>8	beshort		4624	compressed file
>8	beshort		5130	Network service msg file
>8	beshort		5131	Network service msg file
>8	beshort		5132	Async gateway login msg
>8	beshort		5134	GroupWise message file
>8	beshort		7956	GroupWise admin domain database
>8	beshort		7957	GroupWise admin host database
>8	beshort		7959	GroupWise admin remote host database
>8	beshort		7960	GroupWise admin ADS deferment data file
>8	beshort		8458	IntelliTAG (SGML) compiled DTD
>8	belong	18219264	WordPerfect graphic image (1.0)
>8	belong	18219520	WordPerfect graphic image (2.0)
#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
#	$OpenBSD: xdelta,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# file(1) magic(5) data for xdelta  Josh MacDonald <jmacd@CS.Berkeley.EDU>
#
0	string	%XDELTA%	XDelta binary patch file 0.14
0	string	%XDZ000%	XDelta binary patch file 0.18
0	string	%XDZ001%	XDelta binary patch file 0.20
0	string	%XDZ002%	XDelta binary patch file 1.0
0	string	%XDZ003%	XDelta binary patch file 1.0.4
0	string	%XDZ004%	XDelta binary patch file 1.1
#	$OpenBSD: xenix,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# xenix:  file(1) magic for Microsoft Xenix
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
# model" lifted from "magic.xenix", with comment "derived empirically;
# treat as folklore until proven"
#
# "small model", "large model", "huge model" stuff lifted from XXX
#
# XXX - "x.out" collides with PDP-11 archives
#
0	string		core		core file (Xenix)
0	byte		0x80		8086 relocatable (Microsoft)
0	leshort		0xff65		x.out
>2	string		__.SYMDEF	 randomized
>0	byte		x		archive
0	leshort		0x206		Microsoft a.out
>8	leshort		1		Middle model
>0x1e	leshort		&0x10		overlay
>0x1e	leshort		&0x2		separate
>0x1e	leshort		&0x4		pure
>0x1e	leshort		&0x800		segmented
>0x1e	leshort		&0x400		standalone
>0x1e	leshort		&0x8		fixed-stack
>0x1c	byte		&0x80		byte-swapped
>0x1c	byte		&0x40		word-swapped
>0x10	lelong		>0		not-stripped
>0x1e	leshort		^0xc000		pre-SysV
>0x1e	leshort		&0x4000		V2.3
>0x1e	leshort		&0x8000		V3.0
>0x1c	byte		&0x4		86
>0x1c	byte		&0xb		186
>0x1c	byte		&0x9		286
>0x1c	byte		&0xa		386
>0x1f	byte		<0x040		small model
>0x1f	byte		=0x048		large model	
>0x1f	byte		=0x049		huge model 
>0x1e	leshort		&0x1		executable
>0x1e	leshort		^0x1		object file
>0x1e	leshort		&0x40		Large Text
>0x1e	leshort		&0x20		Large Data
>0x1e	leshort		&0x120		Huge Objects Enabled
>0x10	lelong		>0		not stripped

0	leshort		0x140		old Microsoft 8086 x.out
>0x3	byte		&0x4		separate
>0x3	byte		&0x2		pure
>0	byte		&0x1		executable
>0	byte		^0x1		relocatable
>0x14	lelong		>0		not stripped

0	lelong		0x206		b.out
>0x1e	leshort		&0x10		overlay
>0x1e	leshort		&0x2		separate
>0x1e	leshort		&0x4		pure
>0x1e	leshort		&0x800		segmented
>0x1e	leshort		&0x400		standalone
>0x1e	leshort		&0x1		executable
>0x1e	leshort		^0x1		object file
>0x1e	leshort		&0x4000		V2.3
>0x1e	leshort		&0x8000		V3.0
>0x1c	byte		&0x4		86
>0x1c	byte		&0xb		186
>0x1c	byte		&0x9		286
>0x1c	byte		&0x29		286
>0x1c	byte		&0xa		386
>0x1e	leshort		&0x4		Large Text
>0x1e	leshort		&0x2		Large Data
>0x1e	leshort		&0x102		Huge Objects Enabled

0	leshort		0x580		XENIX 8086 relocatable or 80286 small model
#	$OpenBSD: xwindows,v 1.1 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# xwindows:  file(1) magic for various X/Window system file formats.

# Compiled X Keymap 
# XKM (compiled X keymap) files (including version and byte ordering)
1	string	mkx				Compiled XKB Keymap: lsb,
>0	byte	>0				version %d
>0	byte	=0				obsolete
0	string	xkm				Compiled XKB Keymap: msb,
>3	byte	>0				version %d
>0	byte	=0				obsolete

# xfsdump archive
0	string	xFSdump0			xfsdump archive
>8	long	x	(version %d)

# Jaleo XFS files
0	long	395726				Jaleo XFS file
>4	long	x				- version %ld
>8	long	x				- [%ld -
>20	long	x				%ldx
>24	long	x				%ldx
>28	long	1008				YUV422]
>28	long	1000				RGB24]
#	$OpenBSD: zilog,v 1.4 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# zilog:  file(1) magic for Zilog Z8000.
#
# Was it big-endian or little-endian?  My Product Specification doesn't
# say.
#
0	long		0xe807		object file (z8000 a.out)
0	long		0xe808		pure object file (z8000 a.out)
0	long		0xe809		separate object file (z8000 a.out)
0	long		0xe805		overlay object file (z8000 a.out)
#	$OpenBSD: zyxel,v 1.2 2004/06/03 03:14:20 tedu Exp $

#------------------------------------------------------------------------------
# zyxel:  file(1) magic for ZyXEL modems
#
# From <rob@pe1chl.ampr.org>
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
# ZyXEL-defined standard)

0	string		ZyXEL\002	ZyXEL voice data
>10	byte		0		- CELP encoding
>10	byte&0x0B	1		- ADPCM2 encoding
>10	byte&0x0B	2		- ADPCM3 encoding
>10	byte&0x0B	3		- ADPCM4 encoding
>10	byte&0x0B	8		- New ADPCM3 encoding
>10	byte&0x04	4		with resync
