2 #------------------------------------------------------------------------------
3 # $File: gnu,v 1.20 2018/02/24 16:11:23 christos Exp $
4 # gnu: file(1) magic for various GNU tools
6 # GNU nlsutils message catalog file format
8 # GNU message catalog (.mo and .gmo files)
10 # Update: Joerg Jenderek
11 # URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html
12 # Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/
13 # gettext-0.19.8.1/gettext-runtime/intl/gmo.h
14 # Note: maybe call it like "GNU translation gettext machine object"
15 0 string \336\22\4\225 GNU message catalog (little endian),
16 #0 ulelong 0x950412DE GNU-format message catalog data
17 # TODO: write lines in such a way that code can also be called for big endian variant
18 #>0 use gettext-object
19 #0 name gettext-object
21 !:mime application/x-gettext-translation
22 # mo extension is also used for Easeus Partition Master PE32 executable module
23 # like ConvertFatToNTFS.mo
25 # only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit
27 >4 ulelong/0xFFff x %u.
29 >4 ulelong&0x0000FFff x \b%u
30 >>8 ulelong x \b, %u message
33 # size of hashing table
34 #>20 ulelong x \b, %u hash
36 #>24 ulelong x at 0x%x
37 # for revsion x.0 offset of table with originals is 1Ch if directly after header
38 >4 ulelong&0x0000FFff =0
39 >>12 ulelong !0x1C \b, at 0x%x string table
40 # but for x.1 table offset i found is 30h. That means directly after bigger header
41 >4 ulelong&0x0000FFff >0
42 >>12 ulelong !0x30 \b, at 0x%x string table
43 # The following variables are only used in .mo files with minor revision >= 1
44 # number of system dependent segments
45 #>>28 ulelong x \b, %u segment
47 # offset of table describing system dependent segments
48 #>>32 ulelong x at 0x%x
49 # number of system dependent strings pairs
50 >>36 ulelong x \b, %u sysdep message
52 # offset of table with start offsets of original sysdep strings
53 #>>40 ulelong x \b, at 0x%x sysdep strings
54 # offset of table with start offsets of translated sysdep strings
55 #>>44 ulelong x \b, at 0x%x sysdep translations
56 # >>(44.l) ulelong x 0x%x chars
57 # >>>&0 ulelong x at 0x%x
58 # >>>>(&-4) string x "%s"
59 # string table after big header
60 #>>48 ubequad x \b, string table 0x%llx
62 # 0th string length seems to be always 0
63 #>(12.l) ulelong x \b, %u chars
64 #>>&0 ulelong x at 0x%x
65 # if 1st string length positiv inspect offset and string
66 #>(12.l+8) ulelong >0 \b, %u chars
67 #>>&0 ulelong x at 0x%x
68 # if 2nd string length positiv inspect offset and string
69 # >(12.l+16) ulelong >0 \b, %u chars
70 # >>&0 ulelong x at 0x%x
75 #>>>>&-1 string x '%s'
76 # offset of table with translation strings
77 #>16 ulelong x \b, at 0x%x translation table
78 # check translation 0 length and offset
81 # translation 0 seems to be often Project-Id with name and version
82 >>>(&-4) string x \b, %s
83 # trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL
88 # 1 New Line like in tar-1.29\po\de.gmo
91 >>>>>&-1 string x '%s'
92 # 2nd New Line like in parted-3.1\po\de.gmo
96 0 string \225\4\22\336 GNU message catalog (big endian),
97 #0 ubelong 0x950412DE GNU-format message catalog data
98 !:mime application/x-gettext-translation
100 # TODO: for big endian use same code as for little endian
101 #>0 use \^gettext-object
103 #>16 ubelong x \b, at 0x%x translation table
104 #>(16.L) ubelong x 0x%x chars
105 #>>&0 ubelong x at 0x%x
106 # unexpected value HERE!
107 #>>>(&-4) ubequad x 0x%llx
109 >4 beshort x revision %d.
111 >>8 belong x %d messages,
112 >>36 belong x %d sysdep messages
114 >>8 belong x %d messages
118 # The format is very similar to pgp
119 0 string \001gpg GPG key trust database
121 # Note: magic.mime had 0x8501 for the next line instead of 0x8502
122 0 beshort 0x8502 GPG encrypted data
123 !:mime text/PGP # encoding: data
125 # Update: Joerg Jenderek
126 # Note: PGP and GPG use same data structure.
127 # So recognition is now done by ./pgp with start test for byte 0x99
128 # This magic is not particularly good, as the keyrings don't have true
129 # magic. Nevertheless, it covers many keyrings.
130 # 0 ubeshort-0x9901 <2
132 # >>4 bedate x GPG key public ring, created %s
133 # !:mime application/x-gnupg-keyring
135 # Symmetric encryption
138 >>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher)
139 >>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher)
140 >>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher)
141 >>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher)
142 >>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher)
143 >>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher)
144 >>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher)
145 >>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher)
146 >>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher)
147 >>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher)
151 # <http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
152 # From: Philipp Hahn <hahn@univention.de>
155 >>8 string KBXf GPG keybox database
156 >>>5 byte 1 version %d
157 >>>16 bedate x \b, created-at %s
158 >>>20 bedate x \b, last-maintained %s
161 # Gnumeric spreadsheet
162 # This entry is only semi-helpful, as Gnumeric compresses its files, so
163 # they will ordinarily reported as "compressed", but at least -z helps
164 39 string =<gmr:Workbook Gnumeric spreadsheet
166 # From: James Youngman <jay@gnu.org>
168 0 string \0LOCATE GNU findutils locate database data
169 >7 string >\0 \b, format %s
170 >7 string 02 \b (frcode)
172 # Files produced by GNU gettext
174 # gettext message catalogue
175 0 search/1024 \nmsgid
176 >&0 search/1024 \nmsgstr GNU gettext message catalogue text