257 lines
8.2 KiB
Text
257 lines
8.2 KiB
Text
# $OpenBSD: archive,v 1.6 2009/04/24 18:54:34 chl Exp $
|
|
|
|
#------------------------------------------------------------------------------
|
|
# archive: file(1) magic for archive formats (see also "msdos" for self-
|
|
# extracting compressed archives)
|
|
#
|
|
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
|
|
# pre-POSIX "tar" archives are handled in the C code.
|
|
|
|
# POSIX tar archives
|
|
257 string ustar\0 POSIX tar archive
|
|
!:mime application/x-tar # encoding: posix
|
|
257 string ustar\040\040\0 GNU tar archive
|
|
!:mime application/x-tar # encoding: gnu
|
|
|
|
# cpio archives
|
|
#
|
|
|
|
# Debian package (needs to go before regular portable archives)
|
|
#
|
|
0 string =!<arch>\ndebian
|
|
!:mime application/x-debian-package
|
|
>8 string debian-split part of multipart Debian package
|
|
>8 string debian-binary Debian binary package
|
|
>8 string !debian
|
|
>68 string >\0 (format %s)
|
|
# These next two lines do not work, because a bzip2 Debian archive
|
|
# still uses gzip for the control.tar (first in the archive). Only
|
|
# data.tar varies, and the location of its filename varies too.
|
|
# file/libmagic does not current have support for ascii-string based
|
|
# (offsets) as of 2005-09-15.
|
|
#>81 string bz2 \b, uses bzip2 compression
|
|
#>84 string gz \b, uses gzip compression
|
|
#>136 ledate x created: %s
|
|
|
|
# MIPS archive (needs to go before regular portable archives)
|
|
#
|
|
0 string =!<arch>\n__________E MIPS archive
|
|
>20 string U with MIPS Ucode members
|
|
>21 string L with MIPSEL members
|
|
>21 string B with MIPSEB members
|
|
>19 string L and an EL hash table
|
|
>19 string B and an EB hash table
|
|
>22 string X -- out of date
|
|
|
|
0 search/1 -h- Software Tools format archive text
|
|
|
|
#
|
|
# XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
|
|
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
|
|
#
|
|
# 0 string =!<arch> current ar archive
|
|
# 0 long 0x213c6172 archive file
|
|
#
|
|
# and for SVR1 archives, we have:
|
|
#
|
|
# 0 string \<ar> System V Release 1 ar archive
|
|
# 0 string =<ar> archive
|
|
#
|
|
# XXX - did Aegis really store shared libraries, breakpointed modules,
|
|
# and absolute code program modules in the same format as new-style
|
|
# "ar" archives?
|
|
#
|
|
0 string =!<arch> current ar archive
|
|
!:mime application/x-archive
|
|
>8 string __.SYMDEF random library
|
|
>0 belong =65538 - pre SR9.5
|
|
>0 belong =65539 - post SR9.5
|
|
>0 beshort 2 - object archive
|
|
>0 beshort 3 - shared library module
|
|
>0 beshort 4 - debug break-pointed module
|
|
>0 beshort 5 - absolute code program module
|
|
0 string \<ar> System V Release 1 ar archive
|
|
0 string =<ar> archive
|
|
#
|
|
|
|
# MS Compress
|
|
4 string \x88\xf0\x27 MS Compress archive data
|
|
# updated by Joerg Jenderek
|
|
>9 string \0
|
|
>>0 string KWAJ
|
|
>>>7 string \321\003 MS Compress archive data
|
|
>>>>14 ulong >0 \b, original size: %ld bytes
|
|
>>>>18 ubyte >0x65
|
|
>>>>>18 string x \b, was %.8s
|
|
>>>>>(10.b-4) string x \b.%.3s
|
|
|
|
# JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
|
|
0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
|
|
0 string JARCS JAR (ARJ Software, Inc.) archive data
|
|
|
|
# RAR archiver (Greg Roelofs, newt@uchicago.edu)
|
|
0 string Rar! RAR archive data,
|
|
!:mime application/x-rar
|
|
>44 byte x v%0x,
|
|
>10 byte >0 flags:
|
|
>>10 byte &0x01 Archive volume,
|
|
>>10 byte &0x02 Commented,
|
|
>>10 byte &0x04 Locked,
|
|
>>10 byte &0x08 Solid,
|
|
>>10 byte &0x20 Authenticated,
|
|
>35 byte 0 os: MS-DOS
|
|
>35 byte 1 os: OS/2
|
|
>35 byte 2 os: Win32
|
|
>35 byte 3 os: Unix
|
|
# some old version? idarc says:
|
|
0 string RE\x7e\x5e RAR archive data
|
|
|
|
# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
|
|
0 string SQSH squished archive data (Acorn RISCOS)
|
|
|
|
# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
|
|
# [JW] see exe section for self-extracting version
|
|
0 string UC2\x1a UC2 archive data
|
|
|
|
# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
|
|
0 string PK\003\004 ZIP
|
|
>4 byte 0x00 Zip archive data
|
|
!:mime application/zip
|
|
>4 byte 0x09 Zip archive data, at least v0.9 to extract
|
|
!:mime application/zip
|
|
>4 byte 0x0a Zip archive data, at least v1.0 to extract
|
|
!:mime application/zip
|
|
>4 byte 0x0b Zip archive data, at least v1.1 to extract
|
|
!:mime application/zip
|
|
>0x161 string WINZIP Zip archive data, WinZIP self-extracting
|
|
!:mime application/zip
|
|
>4 byte 0x14
|
|
>>30 ubelong !0x6d696d65 Zip archive data, at least v2.0 to extract
|
|
!:mime application/zip
|
|
|
|
# OpenOffice.org / KOffice / StarOffice documents
|
|
# From: Abel Cheung <abel@oaka.org>
|
|
# Listed here because they are basically zip files
|
|
>>30 string mimetype
|
|
|
|
# KOffice (1.2 or above) formats
|
|
>>>50 string vnd.kde. KOffice (>=1.2)
|
|
>>>>58 string karbon Karbon document
|
|
>>>>58 string kchart KChart document
|
|
>>>>58 string kformula KFormula document
|
|
>>>>58 string kivio Kivio document
|
|
>>>>58 string kontour Kontour document
|
|
>>>>58 string kpresenter KPresenter document
|
|
>>>>58 string kspread KSpread document
|
|
>>>>58 string kword KWord document
|
|
|
|
# OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
|
|
>>>50 string vnd.sun.xml. OpenOffice.org 1.x
|
|
>>>>62 string writer Writer
|
|
>>>>>68 byte !0x2e document
|
|
>>>>>68 string .template template
|
|
>>>>>68 string .global global document
|
|
>>>>62 string calc Calc
|
|
>>>>>66 byte !0x2e spreadsheet
|
|
>>>>>66 string .template template
|
|
>>>>62 string draw Draw
|
|
>>>>>66 byte !0x2e document
|
|
>>>>>66 string .template template
|
|
>>>>62 string impress Impress
|
|
>>>>>69 byte !0x2e presentation
|
|
>>>>>69 string .template template
|
|
>>>>62 string math Math document
|
|
|
|
# OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
|
|
# http://lists.oasis-open.org/archives/office/200505/msg00006.html
|
|
>>>50 string vnd.oasis.opendocument. OpenDocument
|
|
>>>>73 string text
|
|
>>>>>77 byte !0x2d Text
|
|
!:mime application/vnd.oasis.opendocument.text
|
|
>>>>>77 string -template Text Template
|
|
>>>>>77 string -web HTML Document Template
|
|
>>>>>77 string -master Master Document
|
|
>>>>73 string graphics Drawing
|
|
>>>>>81 string -template Template
|
|
>>>>73 string presentation Presentation
|
|
>>>>>85 string -template Template
|
|
>>>>73 string spreadsheet Spreadsheet
|
|
>>>>>84 string -template Template
|
|
>>>>73 string chart Chart
|
|
>>>>>78 string -template Template
|
|
>>>>73 string formula Formula
|
|
>>>>>80 string -template Template
|
|
>>>>73 string database Database
|
|
>>>>73 string image Image
|
|
|
|
# Zoo archiver
|
|
20 lelong 0xfdc4a7dc Zoo archive data
|
|
!:mime application/x-zoo
|
|
>4 byte >48 \b, v%c.
|
|
>>6 byte >47 \b%c
|
|
>>>7 byte >47 \b%c
|
|
>32 byte >0 \b, modify: v%d
|
|
>>33 byte x \b.%d+
|
|
>42 lelong 0xfdc4a7dc \b,
|
|
>>70 byte >0 extract: v%d
|
|
>>>71 byte x \b.%d+
|
|
|
|
# Shell archives
|
|
10 string #\ This\ is\ a\ shell\ archive shell archive text
|
|
!:mime application/octet-stream
|
|
|
|
#
|
|
# LBR. NB: May conflict with the questionable
|
|
# "binary Computer Graphics Metafile" format.
|
|
#
|
|
0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
|
|
#
|
|
# PMA (CP/M derivative of LHA)
|
|
#
|
|
2 string -pm0- PMarc archive data [pm0]
|
|
2 string -pm1- PMarc archive data [pm1]
|
|
2 string -pm2- PMarc archive data [pm2]
|
|
2 string -pms- PMarc SFX archive (CP/M, DOS)
|
|
5 string -pc1- PopCom compressed executable (CP/M)
|
|
|
|
# Microsoft cabinets
|
|
# by David Necas (Yeti) <yeti@physics.muni.cz>
|
|
#0 string MSCF\0\0\0\0 Microsoft cabinet file data,
|
|
#>25 byte x v%d
|
|
#>24 byte x \b.%d
|
|
# MPi: All CABs have version 1.3, so this is pointless.
|
|
|
|
# Felix von Leitner <felix-file@fefe.de>
|
|
0 string d8:announce BitTorrent file
|
|
!:mime application/x-bittorrent
|
|
|
|
# Alternate ZIP string (amc@arwen.cs.berkeley.edu)
|
|
0 string PK00PK\003\004 Zip archive data
|
|
|
|
# rzip archives
|
|
0 string RZIP rzip compressed data
|
|
>4 byte x - version %d
|
|
>5 byte x \b.%d
|
|
>6 belong x (%d bytes)
|
|
|
|
# From: Dirk Jagdmann <doj@cubic.org>
|
|
# xar archive format: http://code.google.com/p/xar/
|
|
0 string xar! xar archive
|
|
>6 beshort x - version %ld
|
|
|
|
# From: "Nelson A. de Oliveira" <naoliv@gmail.com>
|
|
# .kgb
|
|
0 string KGB_arch KGB Archiver file
|
|
>10 string x with compression level %.1s
|
|
|
|
# xar (eXtensible ARchiver) archive
|
|
# From: "David Remahl" <dremahl@apple.com>
|
|
0 string xar! xar archive
|
|
#>4 beshort x header size %d
|
|
>6 beshort x version %d,
|
|
#>8 quad x compressed TOC: %d,
|
|
#>16 quad x uncompressed TOC: %d,
|
|
>24 belong 0 no checksum
|
|
>24 belong 1 SHA-1 checksum
|
|
>24 belong 2 MD5 checksum
|
|
|