2 #------------------------------------------------------------------------------
3 # $File: linux,v 1.68 2019/09/11 21:20:56 christos Exp $
4 # linux: file(1) magic for Linux files
6 # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
7 # The following basic Linux magic is useful for reference, but using
8 # "long" magic is a better practice in order to avoid collisions.
10 # 2 leshort 100 Linux/i386
11 # >0 leshort 0407 impure executable (OMAGIC)
12 # >0 leshort 0410 pure executable (NMAGIC)
13 # >0 leshort 0413 demand-paged executable (ZMAGIC)
14 # >0 leshort 0314 demand-paged executable (QMAGIC)
16 0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC)
17 >16 lelong 0 \b, stripped
18 0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC)
19 >16 lelong 0 \b, stripped
20 0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC)
21 >16 lelong 0 \b, stripped
22 0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC)
23 >16 lelong 0 \b, stripped
25 0 string \007\001\000 Linux/i386 object file
26 >20 lelong >0x1020 \b, DLL library
28 0 string \01\03\020\04 Linux-8086 impure executable
29 >28 long !0 not stripped
30 0 string \01\03\040\04 Linux-8086 executable
31 >28 long !0 not stripped
33 0 string \243\206\001\0 Linux-8086 object file
35 0 string \01\03\020\20 Minix-386 impure executable
36 >28 long !0 not stripped
37 0 string \01\03\040\20 Minix-386 executable
38 >28 long !0 not stripped
39 0 string \01\03\04\20 Minix-386 NSYM/GNU executable
40 >28 long !0 not stripped
41 # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
42 216 lelong 0421 Linux/i386 core file
44 >220 string >\0 of '%s'
45 >200 lelong >0 (signal %d)
47 # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
48 # this can be overridden by the DOS executable (COM) entry
49 2 string LILO Linux/i386 LILO boot/chain loader
51 # Linux make config build file, from Ole Aamot <oka@oka.no>
52 # Updated by Ken Sharp
53 28 string make\ config Linux make config build file (old)
54 49 search/70 Kernel\ Configuration Linux make config build file
57 # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
58 # Updated by Adam Buchbinder <adam.buchbinder@gmail.com>
59 # See: https://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
60 0 leshort 0x0436 Linux/i386 PC Screen Font v1 data,
61 >2 byte&0x01 0 256 characters,
62 >2 byte&0x01 !0 512 characters,
63 >2 byte&0x02 0 no directory,
64 >2 byte&0x02 !0 Unicode directory,
66 0 string \x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
67 >16 lelong x %d characters,
68 >12 lelong&0x01 0 no directory,
69 >12 lelong&0x01 !0 Unicode directory,
73 # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
74 4086 string SWAP-SPACE Linux/i386 swap file
75 # From: Jeff Bailey <jbailey@ubuntu.com>
76 # Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
77 4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image
78 # From: James Hunt <james.hunt@ubuntu.com>
79 4076 string SWAPSPACE2LINHIB0001 Linux/i386 swap file (new style) (compressed hibernate)
80 # according to man page of mkswap (8) March 1999
81 # volume label and UUID Russell Coker
82 # https://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
83 4086 string SWAPSPACE2 Linux/i386 swap file (new style),
84 >0x400 long x version %d (4K pages),
85 >0x404 long x size %d pages,
86 >1052 string \0 no label,
87 >1052 string >\0 LABEL=%s,
88 >0x40c belong x UUID=%08x
89 >0x410 beshort x \b-%04x
90 >0x412 beshort x \b-%04x
91 >0x414 beshort x \b-%04x
92 >0x416 belong x \b-%08x
93 >0x41a beshort x \b%04x
94 # From Daniel Novotny <dnovotny@redhat.com>
95 # swap file for PowerPC
96 65526 string SWAPSPACE2 Linux/ppc swap file
97 >0x400 long x version %d,
98 >0x404 long x size %d pages,
99 >1052 string \0 no label,
100 >1052 string >\0 LABEL=%s,
101 >0x40c belong x UUID=%08x
102 >0x410 beshort x \b-%04x
103 >0x412 beshort x \b-%04x
104 >0x414 beshort x \b-%04x
105 >0x416 belong x \b-%08x
106 >0x41a beshort x \b%04x
107 16374 string SWAPSPACE2 Linux/ia64 swap file
109 # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
110 # and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
111 # and Nicolas Lichtmaier <nick@debian.org>
112 # All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
113 # Linux kernel boot images (i386 arch) (Wolfram Kleff)
114 # URL: https://www.kernel.org/doc/Documentation/x86/boot.txt
115 514 string HdrS Linux kernel
117 # often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes
118 # Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin
119 # DamnSmallLinux 1.5 damnsmll.lnx
121 >510 leshort 0xAA55 x86 boot executable
123 >>>529 byte 0 zImage,
124 >>>529 byte 1 bzImage,
126 >>>>(526.s+0x200) string >\0 version %s,
127 >>498 leshort 1 RO-rootFS,
128 >>498 leshort 0 RW-rootFS,
129 >>508 leshort >0 root_dev 0x%X,
130 >>502 leshort >0 swap_dev 0x%X,
131 >>504 leshort >0 RAMdisksize %u KB,
132 >>506 leshort 0xFFFF Normal VGA
133 >>506 leshort 0xFFFE Extended VGA
134 >>506 leshort 0xFFFD Prompt for Videomode
135 >>506 leshort >0 Video mode %d
136 # This also matches new kernels, which were caught above by "HdrS".
137 0 belong 0xb8c0078e Linux kernel
138 >0x1e3 string Loading version 1.3.79 or older
139 >0x1e9 string Loading from prehistoric times
141 # System.map files - Nicolas Lichtmaier <nick@debian.org>
142 8 search/1 \ A\ _text Linux kernel symbol map text
144 # LSM entries - Nicolas Lichtmaier <nick@debian.org>
145 0 search/1 Begin3 Linux Software Map entry text
146 0 search/1 Begin4 Linux Software Map entry text (new format)
148 # From Matt Zimmerman, enhanced for v3 by Matthew Palmer
149 0 belong 0x4f4f4f4d User-mode Linux COW file
150 >4 belong <3 \b, version %d
151 >>8 string >\0 \b, backing file %s
152 >4 belong >2 \b, version %d
153 >>32 string >\0 \b, backing file %s
155 ############################################################################
156 # Linux kernel versions
158 0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux
159 >497 leshort 0 x86 boot sector
160 >>514 belong 0x8e of a kernel from the dawn of time!
161 >>514 belong 0x908ed8b4 version 0.99-1.1.42
162 >>514 belong 0x908ed8b8 for memtest86
164 >497 leshort !0 x86 kernel
165 >>504 leshort >0 RAMdisksize=%u KB
166 >>502 leshort >0 swap=0x%X
167 >>508 leshort >0 root=0x%X
168 >>>498 leshort 1 \b-ro
169 >>>498 leshort 0 \b-rw
170 >>506 leshort 0xFFFF vga=normal
171 >>506 leshort 0xFFFE vga=extended
172 >>506 leshort 0xFFFD vga=ask
173 >>506 leshort >0 vga=%d
174 >>514 belong 0x908ed881 version 1.1.43-1.1.45
175 >>514 belong 0x15b281cd
176 >>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0
177 >>>0xa99 belong 0x55AA5a5a version 1.3.1,2
178 >>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30
179 >>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41
180 >>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45
181 >>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72
183 >>>518 leshort >0x1FF
184 >>>>529 byte 0 \b, zImage
185 >>>>529 byte 1 \b, bzImage
186 >>>>(526.s+0x200) string >\0 \b, version %s
188 # Linux boot sector thefts.
189 0 belong 0xb8c0078e Linux
190 >0x1e6 belong 0x454c4b53 ELKS Kernel
191 >0x1e6 belong !0x454c4b53 style boot sector
193 ############################################################################
194 # Linux S390 kernel image
195 # Created by: Jan Kaluza <jkaluza@redhat.com>
196 8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
197 >0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
199 >>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
200 >>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
201 >>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
202 >>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
204 >>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
205 >>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
206 >>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
207 >>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
209 # Linux ARM compressed kernel image
210 # From: Kevin Cernekee <cernekee@gmail.com>
211 # Update: Joerg Jenderek
212 36 lelong 0x016f2818 Linux kernel ARM boot executable zImage (little-endian)
213 # raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin"
215 36 belong 0x016f2818 Linux kernel ARM boot executable zImage (big-endian)
217 ############################################################################
218 # Linux 8086 executable
219 0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless
221 >>4 string >\0 \b, libc version %s
223 0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable
224 >2 byte&0x01 !0 \b, unmapped zero page
225 >2 byte&0x20 0 \b, impure
227 >>2 byte&0x10 !0 \b, A_EXEC
228 >2 byte&0x02 !0 \b, A_PAL
229 >2 byte&0x04 !0 \b, A_NSYM
230 >2 byte&0x08 !0 \b, A_STAND
231 >2 byte&0x40 !0 \b, A_PURE
232 >2 byte&0x80 !0 \b, A_TOVLY
233 >28 long !0 \b, not stripped
235 >>36 string >\0 \b, libc version %s
237 # 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable
238 # 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable
239 # 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable
240 # 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable
242 # SYSLINUX boot logo files (from 'ppmtolss16' sources)
243 # https://www.syslinux.org/wiki/index.php/SYSLINUX#Display_graphic_from_filename:
244 # file extension .lss .16
245 0 lelong =0x1413f33d SYSLINUX' LSS16 image data
246 # syslinux-4.05/mime/image/x-lss16.xml
248 >4 leshort x \b, width %d
249 >6 leshort x \b, height %d
251 0 string OOOM User-Mode-Linux's Copy-On-Write disk image
252 >4 belong x version %d
254 # SE Linux policy database
255 # From: Mike Frysinger <vapier@gentoo.org>
256 0 lelong 0xf97cff8c SE Linux policy
259 >24 lelong x %d symbols
260 >28 lelong x %d ocons
262 # Linux Logical Volume Manager (LVM)
263 # Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net>
265 # System ID, UUID and volume group name are 128 bytes long
266 # but they should never be full and initialized with zeros...
270 0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1
271 >0x12c string >\0 , System ID: %s
273 0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2
274 >0x12c string >\0 , System ID: %s
278 # It seems that the label header can be in one the four first sector
279 # of the disk... (from _find_labeller in lib/label/label.c of LVM2)
281 # 0x200 seems to be the common case
283 0x218 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
284 # read the offset to add to the start of the header, and the header
286 >&(&-12.l-0x21) byte x
287 # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
288 >>&0x0 string >\x2f \b, UUID: %.6s
289 >>&0x6 string >\x2f \b-%.4s
290 >>&0xa string >\x2f \b-%.4s
291 >>&0xe string >\x2f \b-%.4s
292 >>&0x12 string >\x2f \b-%.4s
293 >>&0x16 string >\x2f \b-%.4s
294 >>&0x1a string >\x2f \b-%.6s
295 >>&0x20 lequad x \b, size: %lld
297 0x018 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
298 >&(&-12.l-0x21) byte x
299 # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
300 >>&0x0 string >\x2f \b, UUID: %.6s
301 >>&0x6 string >\x2f \b-%.4s
302 >>&0xa string >\x2f \b-%.4s
303 >>&0xe string >\x2f \b-%.4s
304 >>&0x12 string >\x2f \b-%.4s
305 >>&0x16 string >\x2f \b-%.4s
306 >>&0x1a string >\x2f \b-%.6s
307 >>&0x20 lequad x \b, size: %lld
309 0x418 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
310 >&(&-12.l-0x21) byte x
311 # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
312 >>&0x0 string >\x2f \b, UUID: %.6s
313 >>&0x6 string >\x2f \b-%.4s
314 >>&0xa string >\x2f \b-%.4s
315 >>&0xe string >\x2f \b-%.4s
316 >>&0x12 string >\x2f \b-%.4s
317 >>&0x16 string >\x2f \b-%.4s
318 >>&0x1a string >\x2f \b-%.6s
319 >>&0x20 lequad x \b, size: %lld
321 0x618 string LVM2\ 001 LVM2 PV (Linux Logical Volume Manager)
322 >&(&-12.l-0x21) byte x
323 # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
324 >>&0x0 string >\x2f \b, UUID: %.6s
325 >>&0x6 string >\x2f \b-%.4s
326 >>&0xa string >\x2f \b-%.4s
327 >>&0xe string >\x2f \b-%.4s
328 >>&0x12 string >\x2f \b-%.4s
329 >>&0x16 string >\x2f \b-%.4s
330 >>&0x1a string >\x2f \b-%.6s
331 >>&0x20 lequad x \b, size: %lld
335 0 string SnAp LVM Snapshot (CopyOnWrite store)
336 >4 lelong !0 - valid,
337 >4 lelong 0 - invalid,
338 >8 lelong x version %d,
339 >12 lelong x chunk_size %d
341 # SE Linux policy database
342 0 lelong 0xf97cff8c SE Linux policy
345 >24 lelong x %d symbols
346 >28 lelong x %d ocons
348 # LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
349 # Anthon van der Neut (anthon@mnt.org)
350 0 string LUKS\xba\xbe LUKS encrypted file,
355 >168 string x UUID: %s
358 # Summary: Xen saved domain file
359 # Created by: Radek Vokal <rvokal@redhat.com>
360 0 string LinuxGuestRecord Xen saved domain
362 >>&1 string x (name %s)
364 # Type: Xen, the virtual machine monitor
365 # From: Radek Vokal <rvokal@redhat.com>
366 0 string LinuxGuestRecord Xen saved domain
367 #>2 regex \(name\ [^)]*\) %s
368 >20 search/256 (name (name
371 # Systemd journald files
372 # See https://www.freedesktop.org/wiki/Software/systemd/journal-files/.
373 # From: Zbigniew Jedrzejewski-Szmek <zbyszek@in.waw.pl>
377 # check that state is one of known values
379 # check that each half of three unique id128s is non-zero
385 >>>>>>>64 ubequad >0 Journal file
386 !:mime application/octet-stream
388 >>>>>>>>184 leqdate 0 empty
389 >>>>>>>>16 ubyte 0 \b, offline
390 >>>>>>>>16 ubyte 1 \b, online
391 >>>>>>>>16 ubyte 2 \b, archived
392 >>>>>>>>8 ulelong&1 1 \b, sealed
393 >>>>>>>>12 ulelong&1 1 \b, compressed
395 # BCache backing and cache devices
396 # From: Gabriel de Perthuis <g2p.code@gmail.com>
398 >0x1018 string \xc6\x85\x73\xf6\x4e\x1a\x45\xca\x82\x65\xf5\x7f\x48\xba\x6d\x81 BCache
399 >>0x1010 ulequad 0 cache device
400 >>0x1010 ulequad 1 backing device
401 >>0x1010 ulequad 3 cache device
402 >>0x1010 ulequad 4 backing device
403 >>0x1048 string >0 \b, label "%.32s"
404 >>0x1028 ubelong x \b, uuid %08x
405 >>0x102c ubeshort x \b-%04x
406 >>0x102e ubeshort x \b-%04x
407 >>0x1030 ubeshort x \b-%04x
408 >>0x1032 ubelong x \b-%08x
409 >>0x1036 ubeshort x \b%04x
410 >>0x1038 ubelong x \b, set uuid %08x
411 >>0x103c ubeshort x \b-%04x
412 >>0x103e ubeshort x \b-%04x
413 >>0x1040 ubeshort x \b-%04x
414 >>0x1042 ubelong x \b-%08x
415 >>0x1046 ubeshort x \b%04x
418 # File format description can be found in the Linux kernel sources at
419 # Documentation/devicetree/booting-without-of.txt
420 # From Christoph Biedl
422 # structure and strings must be within blob
425 >>>20 belong >1 Device Tree Blob version %d
426 >>>>4 belong x \b, size=%d
428 >>>>>28 belong x \b, boot CPU=%d
430 >>>>>32 belong x \b, string block size=%d
432 >>>>>36 belong x \b, DT structure block size=%d
434 # glibc locale archive as defined in glibc locale/locarchive.h
435 0 lelong 0xde020109 locale archive
436 >24 lelong x %d strings
438 # Linux Software RAID (mdadm)
439 # Russell Coker <russell@coker.com.au>
441 >16 belong x UUID=%8x:
446 >72 lelong x level=%d
447 >92 lelong x disks=%d
449 4096 lelong 0xa92b4efc Linux Software RAID
450 >4100 lelong x version 1.2 (%d)
453 0 lelong 0xa92b4efc Linux Software RAID
454 >4 lelong x version 1.1 (%d)
457 # Summary: Database file for mlocate
458 # Description: A database file as used by mlocate, a fast implementation
459 # of locate/updatedb. It uses merging to reuse the existing
460 # database and avoid rereading most of the filesystem. It's
461 # the default version of locate on Arch Linux (and others).
462 # File path: /var/lib/mlocate/mlocate.db by default (but configurable)
463 # Site: https://fedorahosted.org/mlocate/
464 # Format docs: https://linux.die.net/man/5/mlocate.db
465 # Type: mlocate database file
466 # URL: https://fedorahosted.org/mlocate/
467 # From: Wander Nauta <info@wandernauta.nl>
468 0 string \0mlocate mlocate database
469 >12 byte x \b, version %d
470 >13 byte 1 \b, require visibility
471 >16 string x \b, root %s
473 # Dump files for iproute2 tool. Generated by the "ip r|a save" command. URL:
474 # https://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2
475 # From: Pavel Emelyanov <xemul@parallels.com>
476 0 lelong 0x45311224 iproute2 routes dump
477 0 lelong 0x47361222 iproute2 addresses dump
479 # Image and service files for CRIU tool.
480 # URL: https://criu.org
481 # From: Pavel Emelyanov <xemul@parallels.com>
482 0 lelong 0x54564319 CRIU image file v1.1
483 0 lelong 0x55105940 CRIU service file
484 0 lelong 0x58313116 CRIU inventory
486 # Kdump compressed dump files
487 # https://sourceforge.net/p/makedumpfile/code/ci/master/tree/IMPLEMENTATION
489 0 string KDUMP Kdump compressed dump
491 >12 string >\0 \b, system %s
492 >77 string >\0 \b, node %s
493 >142 string >\0 \b, release %s
494 >207 string >\0 \b, version %s
495 >272 string >\0 \b, machine %s
496 >337 string >\0 \b, domain %s
499 0 search/1024 /dts-v1/ Device Tree File (v1)