1 #------------------------------------------------------------------------------
2 # $File: archive,v 1.70 2011/10/26 15:44:47 christos Exp $
3 # archive: file(1) magic for archive formats (see also "msdos" for self-
4 # extracting compressed archives)
6 # cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
7 # pre-POSIX "tar" archives are handled in the C code.
10 257 string ustar\0 POSIX tar archive
11 !:mime application/x-tar # encoding: posix
12 257 string ustar\040\040\0 GNU tar archive
13 !:mime application/x-tar # encoding: gnu
15 # Incremental snapshot gnu-tar format from:
16 # http://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html
17 0 string GNU\ tar- GNU tar incremental snapshot data
18 >&0 regex [0-9]\.[0-9]+-[0-9]+ version %s
22 # Yes, the top two "cpio archive" formats *are* supposed to just be "short".
23 # The idea is to indicate archives produced on machines with the same
24 # byte order as the machine running "file" with "cpio archive", and
25 # to indicate archives produced on machines with the opposite byte order
26 # from the machine running "file" with "byte-swapped cpio archive".
28 # The SVR4 "cpio(4)" hints that there are additional formats, but they
29 # are defined as "short"s; I think all the new formats are
30 # character-header formats and thus are strings, not numbers.
31 0 short 070707 cpio archive
32 !:mime application/x-cpio
33 0 short 0143561 byte-swapped cpio archive
34 !:mime application/x-cpio # encoding: swapped
35 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
36 0 string 070701 ASCII cpio archive (SVR4 with no CRC)
37 0 string 070702 ASCII cpio archive (SVR4 with CRC)
39 # Debian package (needs to go before regular portable archives)
41 0 string =!<arch>\ndebian
42 !:mime application/x-debian-package
43 >8 string debian-split part of multipart Debian package
44 >8 string debian-binary Debian binary package
46 >68 string >\0 (format %s)
47 # These next two lines do not work, because a bzip2 Debian archive
48 # still uses gzip for the control.tar (first in the archive). Only
49 # data.tar varies, and the location of its filename varies too.
50 # file/libmagic does not current have support for ascii-string based
51 # (offsets) as of 2005-09-15.
52 #>81 string bz2 \b, uses bzip2 compression
53 #>84 string gz \b, uses gzip compression
54 #>136 ledate x created: %s
57 0 long 0177555 very old archive
58 0 short 0177555 very old PDP-11 archive
59 0 long 0177545 old archive
60 0 short 0177545 old PDP-11 archive
61 0 long 0100554 apl workspace
62 0 string =<ar> archive
63 !:mime application/x-archive
65 # MIPS archive (needs to go before regular portable archives)
67 0 string =!<arch>\n__________E MIPS archive
68 >20 string U with MIPS Ucode members
69 >21 string L with MIPSEL members
70 >21 string B with MIPSEB members
71 >19 string L and an EL hash table
72 >19 string B and an EB hash table
73 >22 string X -- out of date
75 0 search/1 -h- Software Tools format archive text
78 # XXX - why are there multiple <ar> thingies? Note that 0x213c6172 is
79 # "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
81 # 0 string =!<arch> current ar archive
82 # 0 long 0x213c6172 archive file
84 # and for SVR1 archives, we have:
86 # 0 string \<ar> System V Release 1 ar archive
87 # 0 string =<ar> archive
89 # XXX - did Aegis really store shared libraries, breakpointed modules,
90 # and absolute code program modules in the same format as new-style
93 0 string =!<arch> current ar archive
94 !:mime application/x-archive
95 >8 string __.SYMDEF random library
96 >0 belong =65538 - pre SR9.5
97 >0 belong =65539 - post SR9.5
98 >0 beshort 2 - object archive
99 >0 beshort 3 - shared library module
100 >0 beshort 4 - debug break-pointed module
101 >0 beshort 5 - absolute code program module
102 0 string \<ar> System V Release 1 ar archive
103 0 string =<ar> archive
105 # XXX - from "vax", which appears to collect a bunch of byte-swapped
106 # thingies, to help you recognize VAX files on big-endian machines;
107 # with "leshort", "lelong", and "string", that's no longer necessary....
109 0 belong 0x65ff0000 VAX 3.0 archive
110 0 belong 0x3c61723e VAX 5.0 archive
112 0 long 0x213c6172 archive file
113 0 lelong 0177555 very old VAX archive
114 0 leshort 0177555 very old PDP-11 archive
116 # XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
117 # be a random library (it said 0xff65 rather than 0177545).
119 0 lelong 0177545 old VAX archive
120 >8 string __.SYMDEF random library
121 0 leshort 0177545 old PDP-11 archive
122 >8 string __.SYMDEF random library
124 # From "pdp" (but why a 4-byte quantity?)
126 0 lelong 0x39bed PDP-11 old archive
127 0 lelong 0x39bee PDP-11 4.0 archive
129 # ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
131 # The first byte is the magic (0x1a), byte 2 is the compression type for
132 # the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
133 # filename of the first file (null terminated). Since some types collide
134 # we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
135 # 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%). 0x01 collides with terminfo.
136 0 lelong&0x8080ffff 0x0000081a ARC archive data, dynamic LZW
137 !:mime application/x-arc
138 0 lelong&0x8080ffff 0x0000091a ARC archive data, squashed
139 !:mime application/x-arc
140 0 lelong&0x8080ffff 0x0000021a ARC archive data, uncompressed
141 !:mime application/x-arc
142 0 lelong&0x8080ffff 0x0000031a ARC archive data, packed
143 !:mime application/x-arc
144 0 lelong&0x8080ffff 0x0000041a ARC archive data, squeezed
145 !:mime application/x-arc
146 0 lelong&0x8080ffff 0x0000061a ARC archive data, crunched
147 !:mime application/x-arc
148 # [JW] stuff taken from idarc, obviously ARC successors:
149 0 lelong&0x8080ffff 0x00000a1a PAK archive data
150 !:mime application/x-arc
151 0 lelong&0x8080ffff 0x0000141a ARC+ archive data
152 !:mime application/x-arc
153 0 lelong&0x8080ffff 0x0000481a HYP archive data
154 !:mime application/x-arc
156 # Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
157 # I can't create either SPARK or ArcFS archives so I have not tested this stuff
158 # [GRR: the original entries collide with ARC, above; replaced with combined
159 # version (not tested)]
160 #0 byte 0x1a RISC OS archive (spark format)
161 0 string \032archive RISC OS archive (ArcFS format)
162 0 string Archive\000 RISC OS archive (ArcFS format)
164 # All these were taken from idarc, many could not be verified. Unfortunately,
165 # there were many low-quality sigs, i.e. easy to trigger false positives.
166 # Please notify me of any real-world fishy/ambiguous signatures and I'll try
167 # to get my hands on the actual archiver and see if I find something better. [JW]
168 # probably many can be enhanced by finding some 0-byte or control char near the start
170 # idarc calls this Crush/Uncompressed... *shrug*
171 0 string CRUSH Crush archive data
173 0 string HLSQZ Squeeze It archive data
175 0 string SQWEZ SQWEZ archive data
177 0 string HPAK HPack archive data
179 0 string \x91\x33HF HAP archive data
181 0 string MDmd MDCD archive data
183 0 string LIM\x1a LIM archive data
185 3 string LH5 SAR archive data
187 0 string \212\3SB \0 BSArc/BS2 archive data
189 2 string =-ah MAR archive data
191 #0 belong&0x00f800ff 0x00800000 ACB archive data
193 # TODO, this is what idarc says: 0 string \0\0\0 CPZ archive data
195 0 string JRchive JRC archive data
197 0 string DS\0 Quantum archive data
199 0 string PK\3\6 ReSOF archive data
201 0 string 7\4 QuArk archive data
203 14 string YC YAC archive data
205 0 string X1 X1 archive data
206 0 string XhDr X1 archive data
208 0 belong&0xffffe000 0x76ff2000 CDC Codec archive data
210 0 string \xad6" AMGC archive data
212 0 string NõFélå NuLIB archive data
214 0 string LEOLZW PAKLeo archive data
216 0 string SChF ChArc archive data
218 0 string PSA PSA archive data
220 0 string DSIGDCC CrossePAC archive data
222 0 string \x1f\x9f\x4a\x10\x0a Freeze archive data
224 0 string ¨MP¨ KBoom archive data
225 # NSQ, must go after CDC Codec
226 0 string \x76\xff NSQ archive data
228 0 string Dirk\ Paehl DPA archive data
230 # TODO: idarc says "bytes 0-2 == bytes 3-5"
232 0 string \0\6 TTComp archive data
233 # ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
234 0 string ESP ESP archive data
236 0 string \1ZPK\1 ZPack archive data
238 0 string \xbc\x40 Sky archive data
240 0 string UFA UFA archive data
242 0 string =-H2O DRY archive data
244 0 string FOXSQZ FoxSQZ archive data
246 0 string ,AR7 AR7 archive data
248 0 string PPMZ PPMZ archive data
250 4 string \x88\xf0\x27 MS Compress archive data
251 # updated by Joerg Jenderek
254 >>>7 string \321\003 MS Compress archive data
255 >>>>14 ulong >0 \b, original size: %ld bytes
257 >>>>>18 string x \b, was %.8s
258 >>>>>(10.b-4) string x \b.%.3s
259 # MP3 (archiver, not lossy audio compression)
260 0 string MP3\x1a MP3-Archiver archive data
262 0 string OZÝ ZET archive data
264 0 string \x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
266 0 string gW\4\1 ARQ archive data
268 3 string OctSqu Squash archive data
270 0 string \5\1\1\0 Terse archive data
272 0 string \x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
274 0 string UHA UHarc archive data
276 0 string \2AB ABComp archive data
277 0 string \3AB2 ABComp archive data
279 0 string CO\0 CMP archive data
281 0 string \x93\xb9\x06 Splint archive data
283 0 string \x13\x5d\x65\x8c InstallShield Z archive Data
285 1 string GTH Gather archive data
287 0 string BOA BOA archive data
289 0 string ULEB\xa RAX archive data
291 0 string ULEB\0 Xtreme archive data
293 0 string @â\1\0 Pack Magic archive data
295 0 belong&0xfeffffff 0x1a034465 BTS archive data
297 0 string Ora\ ELI 5750 archive data
299 0 string \x1aFC\x1a QFC archive data
300 0 string \x1aQF\x1a QFC archive data
302 0 string RNC PRO-PACK archive data
304 0 string 777 777 archive data
306 0 string sTaC LZS221 archive data
308 0 string HPA HPA archive data
310 0 string LG Arhangel archive data
312 0 string 0123456789012345BZh EXP1 archive data
314 0 string IMP\xa IMP archive data
316 0 string \x00\x9E\x6E\x72\x76\xFF NRV archive data
318 0 string \x73\xb2\x90\xf4 Squish archive data
320 0 string PHILIPP Par archive data
321 0 string PAR Par archive data
323 0 string UB HIT archive data
325 0 belong&0xfffff000 0x53423000 SBX archive data
327 0 string NSK NaShrink archive data
329 0 string #\ CAR\ archive\ header SAPCAR archive data
330 0 string CAR\ 2.00RG SAPCAR archive data
332 0 string DST Disintegrator archive data
334 0 string ASD ASD archive data
336 0 string ISc( InstallShield CAB
338 0 string T4\x1a TOP4 archive data
339 # BatComp left out: sig looks like COM executable
340 # so TODO: get real 4dos batcomp file and find sig
342 0 string BH\5\7 BlakHole archive data
344 0 string BIX0 BIX archive data
346 0 string ChfLZ ChiefLZA archive data
348 0 string Blink Blink archive data
350 0 string \xda\xfa Logitech Compress archive data
351 # ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
352 1 string (C)\ STEPANYUK ARS-Sfx archive data
354 0 string AKT32 AKT32 archive data
355 0 string AKT AKT archive data
357 0 string MSTSM NPack archive data
359 0 string \0\x50\0\x14 PFT archive data
361 0 string SEM SemOne archive data
363 0 string \x8f\xaf\xac\x84 PPMD archive data
365 0 string FIZ FIZ archive data
367 0 belong&0xfffff0f0 0x4d530000 MSXiE archive data
369 0 belong&0xfffffff0 0x797a3030 DeepFreezer archive data
371 0 string =<DC- DC archive data
373 0 string \4TPAC\3 TPac archive data
375 0 string Ai\1\1\0 Ai archive data
376 0 string Ai\1\0\0 Ai archive data
378 0 string Ai\2\0 Ai32 archive data
379 0 string Ai\2\1 Ai32 archive data
381 0 string SBC SBC archive data
383 0 string YBS Ybs archive data
385 0 string \x9e\0\0 DitPack archive data
387 0 string DMS! DMS archive data
389 0 string \x8f\xaf\xac\x8c EPC archive data
391 0 string VS\x1a VSARC archive data
393 0 string PDZ PDZ archive data
395 0 string rdqx ReDuq archive data
397 0 string GCAX GCA archive data
399 0 string pN PPMN archive data
401 3 string WINIMAGE WinImage archive data
403 0 string CMP0CMP Compressia archive data
405 0 string UHB UHBC archive data
407 0 string \x61\x5C\x04\x05 WinHKI archive data
409 0 string WWP WWPack archive data
411 0 string \xffBSG BSN archive data
412 1 string \xffBSG BSN archive data
413 3 string \xffBSG BSN archive data
414 1 string \0\xae\2 BSN archive data
415 1 string \0\xae\3 BSN archive data
416 1 string \0\xae\7 BSN archive data
418 0 string \x33\x18 AIN archive data
419 0 string \x33\x17 AIN archive data
421 0 string xpa\0\1 XPA32 archive data
422 # SZip (TODO: doesn't catch all versions)
423 0 string SZ\x0a\4 SZip archive data
425 0 string jm XPack DiskImage archive data
427 0 string xpa XPack archive data
429 0 string Í\ jm XPack single archive data
431 # TODO: missing due to unknown magic/magic at end of file:
441 # These were inspired by idarc, but actually verified
442 # Dzip archiver (.dz)
443 0 string DZ Dzip archive data
444 >2 byte x \b, version %i
446 # ZZip archiver (.zz)
447 0 string ZZ\ \0\0 ZZip archive data
448 0 string ZZ0 ZZip archive data
449 # PAQ archiver (.paq)
450 0 string \xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
451 0 string PAQ PAQ archive data
454 # JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
455 0xe string \x1aJar\x1b JAR (ARJ Software, Inc.) archive data
456 0 string JARCS JAR (ARJ Software, Inc.) archive data
458 # ARJ archiver (jason@jarthur.Claremont.EDU)
459 0 leshort 0xea60 ARJ archive data
460 !:mime application/x-arj
462 >8 byte &0x04 multi-volume,
463 >8 byte &0x10 slash-switched,
464 >8 byte &0x20 backup,
465 >34 string x original name: %s,
470 >7 byte 4 os: Macintosh
472 >7 byte 6 os: Apple ][ GS
473 >7 byte 7 os: Atari ST
475 >7 byte 9 os: VAX/VMS
477 # [JW] idarc says this is also possible
478 2 leshort 0xea60 ARJ archive data
480 # HA archiver (Greg Roelofs, newt@uchicago.edu)
481 # This is a really bad format. A file containing HAWAII will match this...
482 #0 string HA HA archive data,
483 #>2 leshort =1 1 file,
484 #>2 leshort >1 %u files,
485 #>4 byte&0x0f =0 first is type CPY
486 #>4 byte&0x0f =1 first is type ASC
487 #>4 byte&0x0f =2 first is type HSC
488 #>4 byte&0x0f =0x0e first is type DIR
489 #>4 byte&0x0f =0x0f first is type SPECIAL
490 # suggestion: at least identify small archives (<1024 files)
491 0 belong&0xffff00fc 0x48410000 HA archive data
492 >2 leshort =1 1 file,
493 >2 leshort >1 %u files,
494 >4 byte&0x0f =0 first is type CPY
495 >4 byte&0x0f =1 first is type ASC
496 >4 byte&0x0f =2 first is type HSC
497 >4 byte&0x0f =0x0e first is type DIR
498 >4 byte&0x0f =0x0f first is type SPECIAL
500 # HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
501 0 string HPAK HPACK archive data
503 # JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
504 0 string \351,\001JAM\ JAM archive,
505 >7 string >\0 version %.4s
507 >>0x2b string >\0 label %.11s,
508 >>0x27 lelong x serial %08x,
509 >>0x36 string >\0 fstype %.8s
511 # LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
512 2 string -lh0- LHarc 1.x/ARX archive data [lh0]
513 !:mime application/x-lharc
514 2 string -lh1- LHarc 1.x/ARX archive data [lh1]
515 !:mime application/x-lharc
516 2 string -lz4- LHarc 1.x archive data [lz4]
517 !:mime application/x-lharc
518 2 string -lz5- LHarc 1.x archive data [lz5]
519 !:mime application/x-lharc
520 # [never seen any but the last; -lh4- reported in comp.compression:]
521 2 string -lzs- LHa/LZS archive data [lzs]
522 !:mime application/x-lha
523 2 string -lh\40- LHa 2.x? archive data [lh ]
524 !:mime application/x-lha
525 2 string -lhd- LHa 2.x? archive data [lhd]
526 !:mime application/x-lha
527 2 string -lh2- LHa 2.x? archive data [lh2]
528 !:mime application/x-lha
529 2 string -lh3- LHa 2.x? archive data [lh3]
530 !:mime application/x-lha
531 2 string -lh4- LHa (2.x) archive data [lh4]
532 !:mime application/x-lha
533 2 string -lh5- LHa (2.x) archive data [lh5]
534 !:mime application/x-lha
535 2 string -lh6- LHa (2.x) archive data [lh6]
536 !:mime application/x-lha
537 2 string -lh7- LHa (2.x)/LHark archive data [lh7]
538 !:mime application/x-lha
539 >20 byte x - header level %d
540 # taken from idarc [JW]
541 2 string -lZ PUT archive data
542 2 string -lz LZS archive data
543 2 string -sw1- Swag archive data
545 # RAR archiver (Greg Roelofs, newt@uchicago.edu)
546 0 string Rar! RAR archive data,
547 !:mime application/x-rar
550 >>10 byte &0x01 Archive volume,
551 >>10 byte &0x02 Commented,
552 >>10 byte &0x04 Locked,
553 >>10 byte &0x08 Solid,
554 >>10 byte &0x20 Authenticated,
555 >35 byte 0 os: MS-DOS
559 # some old version? idarc says:
560 0 string RE\x7e\x5e RAR archive data
562 # SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
563 0 string SQSH squished archive data (Acorn RISCOS)
565 # UC2 archiver (Greg Roelofs, newt@uchicago.edu)
566 # [JW] see exe section for self-extracting version
567 0 string UC2\x1a UC2 archive data
569 # PKZIP multi-volume archive
570 0 string PK\x07\x08PK\x03\x04 Zip multi-volume archive data, at least PKZIP v2.50 to extract
571 !:mime application/zip
573 # Zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
576 # Specialised zip formats which start with a member named 'mimetype'
577 # (stored uncompressed, with no 'extra field') containing the file's MIME type.
578 # Check for have 8-byte name, 0-byte extra field, name "mimetype", and
579 # contents starting with "application/":
580 >26 string \x8\0\0\0mimetypeapplication/
582 # KOffice / OpenOffice & StarOffice / OpenDocument formats
583 # From: Abel Cheung <abel@oaka.org>
585 # KOffice (1.2 or above) formats
586 # (mimetype contains "application/vnd.kde.<SUBTYPE>")
587 >>50 string vnd.kde. KOffice (>=1.2)
588 >>>58 string karbon Karbon document
589 >>>58 string kchart KChart document
590 >>>58 string kformula KFormula document
591 >>>58 string kivio Kivio document
592 >>>58 string kontour Kontour document
593 >>>58 string kpresenter KPresenter document
594 >>>58 string kspread KSpread document
595 >>>58 string kword KWord document
597 # OpenOffice formats (for OpenOffice 1.x / StarOffice 6/7)
598 # (mimetype contains "application/vnd.sun.xml.<SUBTYPE>")
599 >>50 string vnd.sun.xml. OpenOffice.org 1.x
600 >>>62 string writer Writer
601 >>>>68 byte !0x2e document
602 >>>>68 string .template template
603 >>>>68 string .global global document
604 >>>62 string calc Calc
605 >>>>66 byte !0x2e spreadsheet
606 >>>>66 string .template template
607 >>>62 string draw Draw
608 >>>>66 byte !0x2e document
609 >>>>66 string .template template
610 >>>62 string impress Impress
611 >>>>69 byte !0x2e presentation
612 >>>>69 string .template template
613 >>>62 string math Math document
614 >>>62 string base Database file
616 # OpenDocument formats (for OpenOffice 2.x / StarOffice >= 8)
617 # http://lists.oasis-open.org/archives/office/200505/msg00006.html
618 # (mimetype contains "application/vnd.oasis.opendocument.<SUBTYPE>")
619 >>50 string vnd.oasis.opendocument. OpenDocument
621 >>>>77 byte !0x2d Text
622 !:mime application/vnd.oasis.opendocument.text
623 >>>>77 string -template Text Template
624 !:mime application/vnd.oasis.opendocument.text-template
625 >>>>77 string -web HTML Document Template
626 !:mime application/vnd.oasis.opendocument.text-web
627 >>>>77 string -master Master Document
628 !:mime application/vnd.oasis.opendocument.text-master
629 >>>73 string graphics
630 >>>>81 byte !0x2d Drawing
631 !:mime application/vnd.oasis.opendocument.graphics
632 >>>>81 string -template Template
633 !:mime application/vnd.oasis.opendocument.graphics-template
634 >>>73 string presentation
635 >>>>85 byte !0x2d Presentation
636 !:mime application/vnd.oasis.opendocument.presentation
637 >>>>85 string -template Template
638 !:mime application/vnd.oasis.opendocument.presentation-template
639 >>>73 string spreadsheet
640 >>>>84 byte !0x2d Spreadsheet
641 !:mime application/vnd.oasis.opendocument.spreadsheet
642 >>>>84 string -template Template
643 !:mime application/vnd.oasis.opendocument.spreadsheet-template
645 >>>>78 byte !0x2d Chart
646 !:mime application/vnd.oasis.opendocument.chart
647 >>>>78 string -template Template
648 !:mime application/vnd.oasis.opendocument.chart-template
650 >>>>80 byte !0x2d Formula
651 !:mime application/vnd.oasis.opendocument.formula
652 >>>>80 string -template Template
653 !:mime application/vnd.oasis.opendocument.formula-template
654 >>>73 string database Database
655 !:mime application/vnd.oasis.opendocument.database
657 >>>>78 byte !0x2d Image
658 !:mime application/vnd.oasis.opendocument.image
659 >>>>78 string -template Template
660 !:mime application/vnd.oasis.opendocument.image-template
662 # EPUB (OEBPS) books using OCF (OEBPS Container Format)
663 # From: Adam Buchbinder <adam.buchbinder@gmail.com>
664 # http://www.idpf.org/ocf/ocf1.0/download/ocf10.htm, section 4.
665 # (mimetype contains "application/epub+zip")
666 >>50 string epub+zip EPUB ebook data
667 !:mime application/epub+zip
669 # Catch other ZIP-with-mimetype formats
670 # In a ZIP file, the bytes immediately after a member's contents are
671 # always "PK". The 2 regex rules here print the "mimetype" member's
672 # contents up to the first 'P'. Luckily, most MIME types don't contain
673 # any capital 'P's. This is a kludge.
674 # (mimetype contains "application/<OTHER>")
675 >>50 string !epub+zip
676 >>>50 string !vnd.oasis.opendocument.
677 >>>>50 string !vnd.sun.xml.
678 >>>>>50 string !vnd.kde.
679 >>>>>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
680 !:mime application/zip
681 # (mimetype contents other than "application/*")
682 >26 string \x8\0\0\0mimetype
683 >>38 string !application/
684 >>>38 regex [!-OQ-~]+ Zip data (MIME type "%s"?)
685 !:mime application/zip
687 # Generic zip archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
688 # Next line excludes specialized formats:
689 >26 string !\x8\0\0\0mimetype Zip archive data
690 !:mime application/zip
691 >>4 byte 0x09 \b, at least v0.9 to extract
692 >>4 byte 0x0a \b, at least v1.0 to extract
693 >>4 byte 0x0b \b, at least v1.1 to extract
694 >>4 byte 0x14 \b, at least v2.0 to extract
695 >>4 byte 0x2d \b, at least v3.0 to extract
696 >>0x161 string WINZIP \b, WinZIP self-extracting
699 # From Pierre Ducroquet <pinaraf@pinaraf.info>
700 0 string VCLMTF StarView MetaFile
701 >6 beshort x \b, version %d
702 >8 belong x \b, size %d
705 20 lelong 0xfdc4a7dc Zoo archive data
706 !:mime application/x-zoo
710 >32 byte >0 \b, modify: v%d
712 >42 lelong 0xfdc4a7dc \b,
713 >>70 byte >0 extract: v%d
717 10 string #\ This\ is\ a\ shell\ archive shell archive text
718 !:mime application/octet-stream
721 # LBR. NB: May conflict with the questionable
722 # "binary Computer Graphics Metafile" format.
724 0 string \0\ \ \ \ \ \ \ \ \ \ \ \0\0 LBR archive data
726 # PMA (CP/M derivative of LHA)
728 2 string -pm0- PMarc archive data [pm0]
729 2 string -pm1- PMarc archive data [pm1]
730 2 string -pm2- PMarc archive data [pm2]
731 2 string -pms- PMarc SFX archive (CP/M, DOS)
732 5 string -pc1- PopCom compressed executable (CP/M)
734 # From Rafael Laboissiere <rafael@laboissiere.net>
735 # The Project Revision Control System (see
736 # http://prcs.sourceforge.net) generates a packaged project
737 # file which is recognized by the following entry:
738 0 leshort 0xeb81 PRCS packaged project
741 # by David Necas (Yeti) <yeti@physics.muni.cz>
742 #0 string MSCF\0\0\0\0 Microsoft cabinet file data,
745 # MPi: All CABs have version 1.3, so this is pointless.
746 # Better magic in debian-additions.
749 # by David Necas (Yeti) <yeti@physics.muni.cz>
750 4 string gtktalog\ GTKtalog catalog data,
751 >13 string 3 version 3
752 >>14 beshort 0x677a (gzipped)
753 >>14 beshort !0x677a (not gzipped)
754 >13 string >3 version %s
756 ############################################################################
757 # Parity archive reconstruction file, the 'par' file format now used on Usenet.
758 0 string PAR\0 PARity archive data
759 >48 leshort =0 - Index file
760 >48 leshort >0 - file number %d
762 # Felix von Leitner <felix-file@fefe.de>
763 0 string d8:announce BitTorrent file
764 !:mime application/x-bittorrent
766 # Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
767 0 beshort 0x0e0f Atari MSA archive data
768 >2 beshort x \b, %d sectors per track
769 >4 beshort 0 \b, 1 sided
770 >4 beshort 1 \b, 2 sided
771 >6 beshort x \b, starting track: %d
772 >8 beshort x \b, ending track: %d
774 # Alternate ZIP string (amc@arwen.cs.berkeley.edu)
775 0 string PK00PK\003\004 Zip archive data
777 # ACE archive (from http://www.wotsit.org/download.asp?f=ace)
778 # by Stefan `Sec` Zehl <sec@42.org>
779 7 string **ACE** ACE archive data
780 >15 byte >0 version %d
781 >16 byte =0x00 \b, from MS-DOS
782 >16 byte =0x01 \b, from OS/2
783 >16 byte =0x02 \b, from Win/32
784 >16 byte =0x03 \b, from Unix
785 >16 byte =0x04 \b, from MacOS
786 >16 byte =0x05 \b, from WinNT
787 >16 byte =0x06 \b, from Primos
788 >16 byte =0x07 \b, from AppleGS
789 >16 byte =0x08 \b, from Atari
790 >16 byte =0x09 \b, from Vax/VMS
791 >16 byte =0x0A \b, from Amiga
792 >16 byte =0x0B \b, from Next
793 >14 byte x \b, version %d to extract
794 >5 leshort &0x0080 \b, multiple volumes,
795 >>17 byte x \b (part %d),
796 >5 leshort &0x0002 \b, contains comment
797 >5 leshort &0x0200 \b, sfx
798 >5 leshort &0x0400 \b, small dictionary
799 >5 leshort &0x0800 \b, multi-volume
800 >5 leshort &0x1000 \b, contains AV-String
801 >>30 string \x16*UNREGISTERED\x20VERSION* (unregistered)
802 >5 leshort &0x2000 \b, with recovery record
803 >5 leshort &0x4000 \b, locked
804 >5 leshort &0x8000 \b, solid
805 # Date in MS-DOS format (whatever that is)
806 #>18 lelong x Created on
808 # sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
810 0x1A string sfArk sfArk compressed Soundfont
812 >>0x1 string >\0 Version %s
813 >>0x2A string >\0 : %s
815 # DR-DOS 7.03 Packed File *.??_
816 0 string Packed\ File\ Personal NetWare Packed File
817 >12 string x \b, was "%.12s"
820 # From: Tilman Sauerbeck <tilman@code-monkey.de>
821 0 belong 0x1ee7ff00 EET archive
822 !:mime application/x-eet
825 0 string RZIP rzip compressed data
826 >4 byte x - version %d
828 >6 belong x (%d bytes)
830 # From: "Robert Dale" <robdale@gmail.com>
831 0 belong 123 dar archive,
832 >4 belong x label "%.8x
834 >>>12 beshort x %.4x"
835 >14 byte 0x54 end slice
836 >14 beshort 0x4e4e multi-part
837 >14 beshort 0x4e53 multi-part, with -S
839 # Symbian installation files
840 # http://www.thouky.co.uk/software/psifs/sis.html
841 # http://developer.symbian.com/main/downloads/papers/SymbianOSv91/softwareinstallsis.pdf
842 8 lelong 0x10000419 Symbian installation file
843 !:mime application/vnd.symbian.install
844 >4 lelong 0x1000006D (EPOC release 3/4/5)
845 >4 lelong 0x10003A12 (EPOC release 6)
846 0 lelong 0x10201A7A Symbian installation file (Symbian OS 9.x)
847 !:mime x-epoc/x-sisx-app
849 # From "Nelson A. de Oliveira" <naoliv@gmail.com>
850 0 string MPQ\032 MoPaQ (MPQ) archive
852 # From: Dirk Jagdmann <doj@cubic.org>
853 # xar archive format: http://code.google.com/p/xar/
854 0 string xar! xar archive
855 >6 beshort x - version %ld
857 # From: "Nelson A. de Oliveira" <naoliv@gmail.com>
859 0 string KGB_arch KGB Archiver file
860 >10 string x with compression level %.1s
862 # xar (eXtensible ARchiver) archive
863 # From: "David Remahl" <dremahl@apple.com>
864 0 string xar! xar archive
865 #>4 beshort x header size %d
866 >6 beshort x version %d,
867 #>8 quad x compressed TOC: %d,
868 #>16 quad x uncompressed TOC: %d,
869 >24 belong 0 no checksum
870 >24 belong 1 SHA-1 checksum
871 >24 belong 2 MD5 checksum
873 # Type: Parity Archive
874 # From: Daniel van Eeden <daniel_e@dds.nl>
875 0 string PAR2 Parity Archive Volume Set
877 # Bacula volume format. (Volumes always start with a block header.)
878 # URL: http://bacula.org/3.0.x-manuals/en/developers/developers/Block_Header.html
879 # From: Adam Buchbinder <adam.buchbinder@gmail.com>
880 12 string BB02 Bacula volume
881 >20 bedate x \b, started %s
883 # ePub is XHTML + XML inside a ZIP archive. The first member of the
884 # archive must be an uncompressed file called 'mimetype' with contents
885 # 'application/epub+zip'
887 # start by checking that this is a ZIP archive, then check for the
888 # proper mimetype file
889 # From: Ralf Brown <ralf.brown@gmail.com>
891 >0x1E string mimetypeapplication/epub+zip EPUB document
892 !:mime application/epub+zip
894 # From: "Michał Górny" <mgorny@gentoo.org>
895 # ZPAQ: http://mattmahoney.net/dc/zpaq.html
896 0 string zPQ ZPAQ stream
897 >3 byte x \b, level %d
899 # BBeB ebook, unencrypted (LRF format)
900 # URL: http://www.sven.de/librie/Librie/LrfFormat
901 # From: Adam Buchbinder <adam.buchbinder@gmail.com>
902 0 string L\0R\0F\0\0\0 BBeB ebook data, unencrypted
903 >8 beshort x \b, version %d
904 >36 byte 1 \b, front-to-back
905 >36 byte 16 \b, back-to-front
906 >42 beshort x \b, (%dx,