# $OpenBSD: java,v 1.5 2009/04/24 18:54:34 chl Exp $ #------------------------------------------------------------ # Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the # same magic number, 0xcafebabe, so they are both handled # in the entry called "cafebabe". #------------------------------------------------------------ # Java serialization # From Martin Pool (m.pool@pharos.com.au) #0 beshort 0xaced Java serialization data #>2 beshort >0x0004 \b, version %d 0 belong 0xfeedfeed Java KeyStore !:mime application/x-java-keystore # 0 belong 0xcececece Java JCE KeyStore # !:mime application/x-java-jce-keystore # Android .dex format. http://retrodev.com/android/dexformat.html # https://source.android.com/devices/tech/dalvik/dex-format.html # From "Mike Fleming" 0 string dex\n >0 regex dex\n[0-9][0-9][0-9]\0 Android DEX file >4 string >000 version %s 0 string dey\n >0 regex dey\n[0-9][0-9][0-9]\0 Android ODEX file >4 string >000 version %s # Android .oat format 0 string oat\n >0 regex oat\n[0-9][0-9][0-9]\0 Android OAT file >4 string >000 version %s # Android .vdex format. # https://android.googlesource.com/platform/art/+/master/runtime/vdex_file.h#114 # http://romainthomas.fr/post/android-vdex/ # https://github.com/anestisb/vdexExtractor/blob/master/src/vdex/vdex_common.h#L30 0 string vdex >0 regex vdex[0-9][0-9][0-9]\0 Android VDEX file >4 string >000 version %s # Android .cdex format. https://android.googlesource.com/platform/art/+/android-9.0.0_r3/libdexfile/dex/compact_dex_file.h#29 0 string cdex >0 regex cdex[0-9][0-9][0-9]\0 Android CDEX file >4 string >000 version %s # Android .art format. https://source.android.com/devices/tech/dalvik 0 string art\n >0 regex art\n[0-9][0-9][0-9]\0 Android ART file >4 string >000 version %s