2 #------------------------------------------------------------------------------
3 # msdos: file(1) magic for MS-DOS files
6 # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
7 0 string @echo\ off MS-DOS batch file text
9 # WinNT/WinCE PE files (Warner Losh, imp@village.org)
11 128 string PE\000\000 MS Windows PE
12 >132 leshort 0x0000 Unknown CPU
13 >132 leshort 0x14c Intel 386
14 >132 leshort 0x14d Intel 486
15 >132 leshort 0x14e Intel 586
16 >132 leshort 0x162 MIPS ISA I
17 >132 leshort 0x163 MIPS ISA II
18 >132 leshort 0x166 MIPS ISA III
19 >132 leshort 0x184 Digital Alpha
20 >132 leshort 0x1a2 Hitachi SH3
21 >132 leshort 0x1a6 Hitachi SH4
22 >132 leshort 0x1c0 ARM
23 >132 leshort 0x1f0 Power PC
24 >132 leshort 0x268 Motorola 68000 series
25 >132 leshort 0x290 PA-RISC
27 >>220 leshort 0 unknown subsystem
28 >>220 leshort 1 native
30 >>220 leshort 3 console
32 >150 leshort&0x2000 =0 executable
33 #>>136 ledate x stamp %s,
34 >>150 leshort&0x0001 >0 not relocatable
35 #>>150 leshort&0x0004 =0 with line numbers,
36 #>>150 leshort&0x0008 =0 with local symbols,
37 #>>150 leshort&0x0200 =0 with debug symbols,
38 >>150 leshort&0x1000 >0 system file
40 #>>>154 byte x linker %d
43 #>>>192 leshort x requires OS %d
44 #>>>194 leshort x \b.%d,
45 #>>>196 leshort x user version %d
46 #>>>198 leshort x \b.%d,
47 #>>>200 leshort x subsystem version %d
48 #>>>202 leshort x \b.%d,
49 >150 leshort&0x2000 >0 DLL
50 #>>136 ledate x stamp %s,
51 >>150 leshort&0x0001 >0 not relocatable
52 #>>150 leshort&0x0004 =0 with line numbers,
53 #>>150 leshort&0x0008 =0 with local symbols,
54 #>>150 leshort&0x0200 =0 with debug symbols,
55 >>150 leshort&0x1000 >0 system file
57 #>>>154 byte x linker %d
60 #>>>192 leshort x requires OS %d
61 #>>>194 leshort x \b.%d,
62 #>>>196 leshort x user version %d
63 #>>>198 leshort x \b.%d,
64 #>>>200 leshort x subsystem version %d
65 #>>>202 leshort x \b.%d,
66 0 string PE\000\000 MS Windows PE (no DOS header)
67 >4 leshort 0x0000 Unknown CPU
68 >4 leshort 0x14c Intel 386
69 >4 leshort 0x14d Intel 486
70 >4 leshort 0x14e Intel 586
71 >4 leshort 0x162 MIPS ISA I
72 >4 leshort 0x163 MIPS ISA II
73 >4 leshort 0x166 MIPS ISA III
74 >4 leshort 0x184 Digital Alpha
75 >4 leshort 0x1a2 Hitachi SH3
76 >4 leshort 0x1a6 Hitachi SH4
78 >4 leshort 0x1f0 Power PC
79 >4 leshort 0x268 Motorola 68000 series
80 >4 leshort 0x290 PA-RISC
81 # It would appear that the debugger information is in basically the same
82 # format as what binutils calls PEI files.
83 0 string DI\000\000 Microsoft PE Debugger Information
84 >4 leshort 0x0000 Unknown CPU
85 >4 leshort 0x14c Intel 386
86 >4 leshort 0x14d Intel 486
87 >4 leshort 0x14e Intel 586
88 >4 leshort 0x162 MIPS ISA I
89 >4 leshort 0x163 MIPS ISA II
90 >4 leshort 0x166 MIPS ISA III
91 >4 leshort 0x184 Digital Alpha
92 >4 leshort 0x1a2 Hitachi SH3
93 >4 leshort 0x1a6 Hitachi SH4
95 >4 leshort 0x1f0 Power PC
96 >4 leshort 0x268 Motorola 68000 series
97 >4 leshort 0x290 PA-RISC
99 0 leshort 0x0000 MS Windows COFF Unknown CPU
100 0 leshort 0x14c MS Windows COFF Intel 386
101 0 leshort 0x14d MS Windows COFF Intel 486
102 0 leshort 0x14e MS Windows COFF Intel 586
103 0 leshort 0x162 MS Windows COFF MIPS ISA I
104 0 leshort 0x163 MS Windows COFF MIPS ISA II
105 0 leshort 0x166 MS Windows COFF MIPS ISA III
106 0 leshort 0x184 MS Windows COFF Digital Alpha
107 0 leshort 0x1a2 MS Windows COFF Hitachi SH3
108 0 leshort 0x1a6 MS Windows COFF Hitachi SH4
109 0 leshort 0x1c0 MS Windows COFF ARM
110 0 leshort 0x1f0 MS Windows COFF Power PC
111 0 leshort 0x268 MS Windows COFF Motorola 68000 series
112 0 leshort 0x290 MS Windows COFF PA-RISC
114 # .EXE formats (Greg Roelofs, newt@uchicago.edu)
116 0 string MZ MS-DOS executable (EXE)
117 >24 string @ \b, OS/2 or MS Windows
118 >>0xe7 string LH/2\ Self-Extract \b, %s
119 >>0xe9 string PKSFX2 \b, %s
120 >0x1c string RJSX\xff\xff \b, ARJ SFX
121 >0x1c string diet\xf9\x9c \b, diet compressed
122 >0x1e string Copyright\ 1989-1990\ PKWARE\ Inc. \b, PKSFX
123 # JM: 0x1e "PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved\7\0\0\0"
124 >0x1e string PKLITE\ Copr. \b, %.6s compressed
125 >0x24 string LHa's\ SFX \b, %.15s
126 >0x24 string LHA's\ SFX \b, %.15s
127 >1638 string -lh5- \b, LHa SFX archive v2.13S
128 >7195 string Rar! \b, RAR self-extracting archive
130 # [GRR 950118: file 3.15 has a buffer-size limitation; offsets bigger than
131 # 8161 bytes are ignored. To make the following entries work, increase
132 # HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
134 # [GRR: some company sells a self-extractor/displayer for image data(!)]
136 >11696 string PK\003\004 \b, PKZIP SFX archive v1.1
137 >13297 string PK\003\004 \b, PKZIP SFX archive v1.93a
138 >15588 string PK\003\004 \b, PKZIP2 SFX archive v1.09
139 >15770 string PK\003\004 \b, PKZIP SFX archive v2.04g
140 >28374 string PK\003\004 \b, PKZIP2 SFX archive v1.02
142 # Info-ZIP self-extractors
143 # these are the DOS versions:
144 >25115 string PK\003\004 \b, Info-ZIP SFX archive v5.12
145 >26331 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
146 # these are the OS/2 versions (OS/2 is flagged above):
147 >47031 string PK\003\004 \b, Info-ZIP SFX archive v5.12
148 >49845 string PK\003\004 \b, Info-ZIP SFX archive v5.12 w/decryption
149 # this is the NT/Win32 version:
150 >69120 string PK\003\004 \b, Info-ZIP NT SFX archive v5.12 w/decryption
152 # TELVOX Teleinformatica CODEC self-extractor for OS/2:
153 >49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
154 >>49824 leshort =1 \b, 1 file
155 >>49824 leshort >1 \b, %u files
157 # .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
158 # Uncommenting only the first two lines will cover about 2/3 of COM files,
159 # but it isn't feasible to match all COM files since there must be at least
160 # two dozen different one-byte "magics".
161 #0 byte 0xe9 MS-DOS executable (COM)
162 #>6 string SFX\ of\ LHarc (%s)
163 #0 byte 0x8c MS-DOS executable (COM)
164 # 0xeb conflicts with "sequent" magic
165 #0 byte 0xeb MS-DOS executable (COM)
166 #0 byte 0xb8 MS-DOS executable (COM)
168 # miscellaneous formats
169 0 string LZ MS-DOS executable (built-in)
170 #0 byte 0xf0 MS-DOS program library data
174 # Windows NT Registry files.
176 0 string regf Windows NT Registry file
178 # Popular applications
179 2080 string Microsoft\ Word\ 6.0\ Document %s
180 2080 string Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
181 # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
182 2112 string MSWordDoc Microsoft Word document data
184 0 belong 0x31be0000 Microsoft Word Document
186 0 string PO^Q` Microsoft Word 6.0 Document
188 2080 string Microsoft\ Excel\ 5.0\ Worksheet %s
190 # Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
191 2114 string Biff5 Microsoft Excel 5.0 Worksheet
193 0 belong 0x00001a00 Lotus 1-2-3
194 >4 belong 0x00100400 wk3 document data
195 >4 belong 0x02100400 wk4 document data
196 >4 belong 0x07800100 fm3 or fmb document data
197 >4 belong 0x07800000 fm3 or fmb document data
199 0 belong 0x00000200 Lotus 1-2-3
200 >4 belong 0x06040600 wk1 document data
201 >4 belong 0x06800200 fmt document data
203 # WordPerfect documents - Trevor Johnson <trevor@jpj.net>
205 1 string WPC WordPerfect document
208 0 string ?_\3\0 MS Windows Help Data