# Magic data for file(1) command.
# Format is described in magic(5).
# Don't edit this file, edit /etc/magic or send your suggested inclusions to
# this file to submit@bugs.debian.org with `Package: file' as the first line
# in the body of the message.

#------------------------------------------------------------------------------
# Localstuff:  file(1) magic for locally observed files
#
# $Id: Localstuff,v 1.3 1995/01/21 21:09:00 christos Exp $
# Add any locally observed files here.  Remember:
# text if readable, executable if runnable binary, data if unreadable.

#------------------------------------------------------------------------------
# alliant:  file(1) magic for Alliant FX series a.out files
#
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".
# If it's the i860-based one, they should probably become either the
# big-endian or little-endian versions, depending on the mode they ran
# the 860 in....
#
0	short		0420		0420 Alliant virtual executable
>2	short		&0x0020		common library
>16	long		>0		not stripped
0	short		0421		0421 Alliant compact executable
>2	short		&0x0020		common library
>16	long		>0		not stripped
#------------------------------------------------------------------------------
# alpha architecture description
#

0	leshort		0603		COFF format alpha
>22	leshort&030000	!020000		executable
>24	leshort		0410		pure
>24	leshort		0413		paged
>22	leshort&020000	!0		dynamically linked
>16	lelong		!0		not stripped
>16	lelong		0		stripped
>22	leshort&030000	020000		shared library
>24	leshort		0407		object
>27	byte		x		- version %d
>26	byte		x		.%d
>28	byte		x		-%d

# Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
#
0	string		Core\001	Alpha COFF format core dump (Digital UNIX)
>24	string		>\0		\b, from '%s'
#------------------------------------------------------------------------------
# amanda:  file(1) magic for amanda file format
#
0       string          AMANDA:\ TAPESTART\ DATE     AMANDA dump header file,
>23     string          X
>>25    string          >\                           Unused %s
>23     string          >\                           DATE %s
#------------------------------------------------------------------------------
# amigaos:  file(1) magic for AmigaOS binary formats:

#
# From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
# Some formats are still missing: AmigaOS special IFF's, e.g.: FORM....CTLG
# (the others should be seperate, anyway)
#
0	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
0	belong		0x000003e7	AmigaOS object/library data

#------------------------------------------------------------------------------
# animation:  file(1) magic for animation/movie formats
#
# animation formats
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)

# MPEG animation format
0	belong		0x000001b3		MPEG video stream data
#>4	beshort&0xfff0	x			(%d x
#>5	beshort&0x0fff  x			%d)
0	belong		0x000001ba		MPEG system stream data
0	beshort&0xfff0	0xfff0			MPEG audio stream data

# FLI animation format
4	leshort		0xAF11			FLI file
>6	leshort		x			- %d frames,
>8	leshort		x			width=%d pixels,
>10	leshort		x			height=%d pixels,
>12	leshort		x			depth=%d,
>16	leshort		x			ticks/frame=%d
# FLC animation format
4	leshort		0xAF12			FLC file
>6	leshort		x			- %d frames
>8	leshort		x			width=%d pixels,
>10	leshort		x			height=%d pixels,
>12	leshort		x			depth=%d,
>16	leshort		x			ticks/frame=%d

# DL animation format
# XXX - collision with most `mips' magic
#
# I couldn't find a real magic number for these, however, this
# -appears- to work.  Note that it might catch other files, too, so be
# careful!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)!  The DL format is really bad.
#
#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
#>42	byte	x	- %d screens,
#>43	byte	x	%d commands
#0	byte	2	DL version 2
#>1	byte	1	- large format (320x200,1 image/screen),
#>1	byte	2	- medium format (160x100,4 images/screen),
#>1	byte	>2	- unknown format,
#>42	byte	x	%d screens,
#>43	byte	x	%d commands
# Based on empirical evidence, DL version 3 have several nulls following the
# \003.  Most of them start with non-null values at hex offset 0x34 or so.
#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3

# SGI and Apple formats
0	string		MOVI		Silicon Graphics movie file
4	string		moov		Apple QuickTime movie file (moov)
4	string		mdat		Apple QuickTime movie file (mdat)

#------------------------------------------------------------------------------
# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
#       workspaces)
#
0	long		0100554		APL workspace (Ken's original?)

#------------------------------------------------------------------------------
# apple:  file(1) magic for Apple file formats
#
0	string		FiLeStArTfIlEsTaRt	binscii (apple ][) text
0	string		\x0aGL			Binary II (apple ][) data
0	string		\x76\xff		Squeezed (apple ][) data
0	string		NuFile			NuFile archive (apple ][) data
0	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
0	belong		0x00051600		AppleSingle encoded Macintosh file
0	belong		0x00051607		AppleDouble encoded Macintosh file


#------------------------------------------------------------------------------
# archive:  file(1) magic for archive formats (see also "msdos" for self-
#           extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are handled in the C code.

# POSIX tar archives
257	string		ustar\0		POSIX tar archive
257	string		ustar\040\040\0	GNU tar archive

# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0	short		070707		cpio archive
0	short		0143561		byte-swapped cpio archive
0	string		070707		ASCII cpio archive (pre-SVR4 or odc)
0	string		070701		ASCII cpio archive (SVR4 with no CRC)
0	string		070702		ASCII cpio archive (SVR4 with CRC)

# Debian package (needs to go before regular portable archives)
#
0	string		!<arch>\ndebian
>8	string		debian-split	part of multipart Debian package
>8	string		debian-binary	Debian binary package
>68	string		>\n		(format %s)
>136	ledate		x		created: %s

# other archives
0	long		0177555		very old archive
0	short		0177555		very old PDP-11 archive
0	long		0177545		old archive
0	short		0177545		old PDP-11 archive
0	long		0100554		apl workspace
0	string		=<ar>		archive

# MIPS archive (needs to go before regular portable archives)
#
0	string	!<arch>\n__________E	MIPS archive
>20	string	U			with MIPS Ucode members
>21	string	L			with MIPSEL members
>21	string	B			with MIPSEB members
>19	string	L			and an EL hash table
>19	string	B			and an EB hash table
>22	string	X			-- out of date

0	string		-h-		Software Tools format archive text

#
# XXX - why are there multiple <ar> thingies?  Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0	string		!<arch>		current ar archive
# 0	long		0x213c6172	archive file
#
# and for SVR1 archives, we have:
#
# 0	string		\<ar>		System V Release 1 ar archive
# 0	string		=<ar>		archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0	string		!<arch>		current ar archive
>8	string		__.SYMDEF	random library
>0	belong		=65538		- pre SR9.5
>0	belong		=65539		- post SR9.5
>0	beshort		2		- object archive
>0	beshort		3		- shared library module
>0	beshort		4		- debug break-pointed module
>0	beshort		5		- absolute code program module
0	string		\<ar>		System V Release 1 ar archive
0	string		=<ar>		archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
0	belong		0x65ff0000	VAX 3.0 archive
0	belong		0x3c61723e	VAX 5.0 archive
#
0	long		0x213c6172	archive file
0	lelong		0177555		very old VAX archive
0	leshort		0177555		very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0	lelong		0177545		old VAX archive
>8	string		__.SYMDEF	random library
0	leshort		0177545		old PDP-11 archive
>8	string		__.SYMDEF	random library
#
# From "pdp" (but why a 4-byte quantity?)
#
0	lelong		0x39bed		PDP-11 old archive
0	lelong		0x39bee		PDP-11 4.0 archive

# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated).  Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
0	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
0	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
0	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
0	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
0	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
0	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched

# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR:  the original entries collide with ARC, above; replaced with combined
#  version (not tested)]
#0	byte		0x1a		RISC OS archive
#>1	string		archive		(ArcFS format)
0	string		\032archive	RISC OS archive (ArcFS format)

# ARJ archiver (jason@jarthur.Claremont.EDU)
0	leshort		0xea60		ARJ archive data
>5	byte		x		\b, v%d,
>8	byte		&0x04		multi-volume,
>8	byte		&0x10		slash-switched,
>8	byte		&0x20		backup,
>34	string		x		original name: %s,
>7	byte		0		os: MS-DOS
>7	byte		1		os: PRIMOS
>7	byte		2		os: Unix
>7	byte		3		os: Amiga
>7	byte		4		os: Macintosh
>7	byte		5		os: OS/2
>7	byte		6		os: Apple ][ GS
>7	byte		7		os: Atari ST
>7	byte		8		os: NeXT
>7	byte		9		os: VAX/VMS
>3	byte		>0		%d]

# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0	string		HA		HA archive data,
#>2	leshort		=1		1 file,
#>2	leshort		>1		%u files,
#>4	byte&0x0f	=0		first is type CPY
#>4	byte&0x0f	=1		first is type ASC
#>4	byte&0x0f	=2		first is type HSC
#>4	byte&0x0f	=0x0e		first is type DIR
#>4	byte&0x0f	=0x0f		first is type SPECIAL

# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0	string		HPAK		HPACK archive data

# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0	string		\351,\001JAM\		JAM archive,
>7	string		>\0			version %.4s
>0x26	byte		=0x27			-
>>0x2b	string          >\0			label %.11s,
>>0x27	lelong		x			serial %08x,
>>0x36	string		>\0			fstype %.8s

# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2	string		-lh0-		LHarc 1.x archive data [lh0]
2	string		-lh1-		LHarc 1.x archive data [lh1]
2	string		-lz4-		LHarc 1.x archive data [lz4]
2	string		-lz5-		LHarc 1.x archive data [lz5]
#	[never seen any but the last; -lh4- reported in comp.compression:]
2	string		-lzs-		LHa 2.x? archive data [lzs]
2	string		-lh\40-		LHa 2.x? archive data [lh ]
2	string		-lhd-		LHa 2.x? archive data [lhd]
2	string		-lh2-		LHa 2.x? archive data [lh2]
2	string		-lh3-		LHa 2.x? archive data [lh3]
2	string		-lh4-		LHa (2.x) archive data [lh4]
2	string		-lh5-		LHa (2.x) archive data [lh5]
>20	byte		x		- header level %d

# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0	string		Rar!		RAR archive data

# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0	string		SQSH		squished archive data (Acorn RISCOS)

# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# I can't figure out the self-extracting form of these buggers...
0	string		UC2\x1a		UC2 archive data

# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0	string		PK\003\004	Zip archive data
>4	byte		0x09		\b, at least v0.9 to extract
>4	byte		0x0a		\b, at least v1.0 to extract
>4	byte		0x0b		\b, at least v1.1 to extract
>4	byte		0x14		\b, at least v2.0 to extract

# Zoo archiver
20	lelong		0xfdc4a7dc	Zoo archive data
>4	byte		>48		\b, v%c.
>>6	byte		>47		\b%c
>>>7	byte		>47		\b%c
>32	byte		>0		\b, modify: v%d
>>33	byte		x		\b.%d+
>42	lelong		0xfdc4a7dc	\b,
>>70	byte		>0		extract: v%d
>>>71	byte		x		\b.%d+

# Shell archives
10	string		#\ This\ is\ a\ shell\ archive	shell archive text

#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
#0	string		0.9
#>8	byte		0x0a		old Debian binary package
#>>3	string		>\n		(format 0.9%s)

#------------------------------------------------------------------------------
# asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
# strings as "long" - we assume they're just strings:
# From: guy@netapp.com (Guy Harris)
#
0	string		*STA		Aster*x
>7	string		WORD			Words Document
>7	string		GRAP			Graphic
>7	string		SPRE			Spreadsheet
>7	string		MACR			Macro
0	string		2278		Aster*x Version 2
>29	byte		0x36			Words Document
>29	byte		0x35			Graphic
>29	byte		0x32			Spreadsheet
>29	byte		0x38			Macro


#------------------------------------------------------------------------------
# att3b:  file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
# 3B20
#
# The 3B20 conflicts with SCCS.
#0	beshort		0550		3b20 COFF executable
#>12	belong		>0		not stripped
#>22	beshort		>0		- version %ld
#0	beshort		0551		3b20 COFF executable (TV)
#>12	belong		>0		not stripped
#>22	beshort		>0		- version %ld
#
# WE32K
#
0	beshort		0560		WE32000 COFF
>18	beshort		^00000020	object
>18	beshort		&00000020	executable
>12	belong		>0		not stripped
>18	beshort		^00010000	N/A on 3b2/300 w/paging
>18	beshort		&00020000	32100 required
>18	beshort		&00040000	and MAU hardware required
>20	beshort		0407		(impure)
>20	beshort		0410		(pure)
>20	beshort		0413		(demand paged)
>20	beshort		0443		(target shared library)
>22	beshort		>0		- version %ld
0	beshort		0561		WE32000 COFF executable (TV)
>12	belong		>0		not stripped
#>18	beshort		&00020000	- 32100 required
#>18	beshort		&00040000	and MAU hardware required
#>22	beshort		>0		- version %ld
#
# core file for 3b2 
0	string		\000\004\036\212\200	3b2 core file
>364	string		>\0		of '%s'

#------------------------------------------------------------------------------
# audio:  file(1) magic for sound formats (see also "iff")
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
# and others
#

# Sun/NeXT audio data
0	string		.snd		Sun/NeXT audio data:
>12	belong		1		8-bit ISDN u-law,
>12	belong		2		8-bit linear PCM [REF-PCM],
>12	belong		3		16-bit linear PCM,
>12	belong		4		24-bit linear PCM,
>12	belong		5		32-bit linear PCM,
>12	belong		6		32-bit IEEE floating point,
>12	belong		7		64-bit IEEE floating point,
>12	belong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>12	belong		24		compressed (8-bit G.722 ADPCM)
>12	belong		25		compressed (3-bit G.723 ADPCM),
>12	belong		26		compressed (5-bit G.723 ADPCM),
>12	belong		27		8-bit A-law,
>20	belong		1		mono,
>20	belong		2		stereo,
>20	belong		4		quad,
>16	belong		>0		%d Hz

# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
0	lelong		0x0064732E	DEC audio data:
>12	lelong		1		8-bit ISDN u-law,
>12	lelong		2		8-bit linear PCM [REF-PCM],
>12	lelong		3		16-bit linear PCM,
>12	lelong		4		24-bit linear PCM,
>12	lelong		5		32-bit linear PCM,
>12	lelong		6		32-bit IEEE floating point,
>12	lelong		7		64-bit IEEE floating point,
>12	lelong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>20	lelong		1		mono,
>20	lelong		2		stereo,
>20	lelong		4		quad,
>16	lelong		>0		%d Hz

# Creative Labs AUDIO stuff
0	string	MThd			Standard MIDI data
>9 	byte	>0			(format %d)
>11	byte	>1			using %d channels
0	string	CTMF			Creative Music (CMF) data
0	string	SBI			SoundBlaster instrument data
0	string	Creative\ Voice\ File	Creative Labs voice data
# is this next line right?  it came this way...
>19	byte	0x1A
>23	byte	>0			- version %d
>22	byte	>0			\b.%d

# first entry is also the string "NTRK"
0	belong		0x4e54524b	MultiTrack sound data
>4	belong		x		- version %ld

# Microsoft WAVE format (*.wav)
0	string		RIFF		Microsoft RIFF
>8	string		WAVE		\b, WAVE audio data
>>34	leshort		>0		\b, %d bit
>>22	leshort		=1		\b, mono
>>22	leshort		=2		\b, stereo
>>22	leshort		>2		\b, %d channels
>>24	lelong		>0		%d Hz
# AVI == Audio Video Interleave
>8      string          AVI\            \b, AVI data

# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
0	string		EMOD		Extended MOD sound data,
>4	byte&0xf0	x		version %d
>4	byte&0x0f	x		\b.%d,
>45	byte		x		%d instruments
>83	byte		0		(module)
>83	byte		1		(song)

# Real Audio (Magic .ra\0375)
0	belong		0x2e7261fd	realaudio sound file

# MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
# Oct 31, 1995
0	string		MTM		MultiTracker Module sound data
0	string		if		Composer 669 Module sound data
0	string		FAR		Module sound data
#0	string		MAS_U		ULT(imate) Module sound data
0x2c	string		SCRM		ScreamTracker III Module sound data
#0	string		Extended Module	Extended Module sound data

# Gravis UltraSound patches
# From <ache@nagual.ru>

0	string		GF1PATCH110\0ID#000002\0	GUS patch
0	string		GF1PATCH100\0ID#000002\0	Old GUS	patch

#
# Taken from loader code from mikmod version 2.14
# by Steve McIntyre (stevem@chiark.greenend.org.uk)
0	string	JN		extended 669 module data
0	string	MAS_UTrack_V00
>14	string	>/0		ultratracker V1.%.1s module sound data
0	string	UN05		MikMod UNI format module sound data
0	string	Extended\ Module: Fasttracker II module sound data
21	string	!SCREAM!	Screamtracker 2 module sound data
1080	string	M.K.		4-channel Protracker module sound data
1080	string	M!K!		4-channel Protracker module sound data
1080	string	FLT4		4-channel Startracker module sound data
1080	string	4CHN		4-channel Fasttracker module sound data
1080	string	6CHN		6-channel Fasttracker module sound data
1080	string	8CHN		8-channel Fasttracker module sound data
1080	string	CD81		8-channel Oktalyzer module sound data
1080	string	OKTA		8-channel Oktalyzer module sound data
1082	string	CH
>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
1080	string	16CN		16-channel Taketracker module sound data
1080	string	32CN		32-channel Taketracker module sound data

# TOC sound files -Trevor Johnson <trevor@jpj.net>
#
0       string          TOC             TOC sound file

#------------------------------------------------------------------------------
# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on
# little-endian machines as well?  If so, what's the deal with
# "VAX-order" and "VAX-order2"?
#
#0	long		0407		68K Blit (standalone) executable
#0	short		0407		VAX-order2 68K Blit (standalone) executable
0	short		03401		VAX-order 68K Blit (standalone) executable
0	long		0406		68k Blit mpx/mux executable
0	short		0406		VAX-order2 68k Blit mpx/mux executable
0	short		03001		VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0	short		0520		tty630 layers executable

#------------------------------------------------------------------------------
# bsdi:  file(1) magic for BSD/OS (from BSDI) objects
#
0	lelong			000000314	BSD/OS i386 compact demand paged executable
>16	lelong			>0		not stripped
>32	byte			0x6a		(uses shared libs)
#------------------------------------------------------------------------------
# c-lang:  file(1) magic for C programs (or REXX)
#

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# if you uncomment "/*" for C/REXX below, also uncomment this entry
#0	string		/*\ XPM\ */	X pixmap image data

# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
#0	string		/*		C or REXX program text
#0	string		//		C++ program text

#------------------------------------------------------------------------------
# chi:  file(1) magic for ChiWriter files
#
0       string          \\1cw\          ChiWriter file
>5      string          >\0             version %s
0       string          \\1cw           ChiWriter file
#------------------------------------------------------------------------------
# cisco:  file(1) magic for cisco Systems routers
#
# Most cisco file-formats are covered by the generic elf code
#
# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
0	belong&0xffffff00	0x85011400  cisco IOS microcode
>7	string		>\0		    for '%s'
0	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
>7	string		>\0		    for '%s'

#------------------------------------------------------------------------------
# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
# >18	short		!074000,000000	C1 R1 
# >18	short		!074000,004000	C2 R1
# >18	short		!074000,010000	C3 R1
# >18	short		!074000,074000	TEST
#
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# >18	short&074000	000000		C1 R1 
# >18	short&074000	004000		C2 R1
# >18	short&074000	010000		C3 R1
# >18	short&074000	074000		TEST
#
# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
# sort, nor does SunOS 4.x, so either it's something Intergraph added
# in CLIX, or something AT&T added in SVR3.2 or later, or something
# somebody else thought was a good idea; it's not documented in the
# man page for this version of "magic", nor does it appear to be
# implemented (at least not after I blew off the bogus code to turn
# old-style "&"s into new-style "&"s, which just didn't work at all).
#
0	short		0575		CLIPPER COFF executable (VAX #)
>20	short		0407		(impure)
>20	short		0410		(5.2 compatible)
>20	short		0411		(pure)
>20	short		0413		(demand paged)
>20	short		0443		(target shared library)
>12	long		>0		not stripped
>22	short		>0		- version %ld
0	short		0577		CLIPPER COFF executable
>18	short&074000	000000		C1 R1 
>18	short&074000	004000		C2 R1
>18	short&074000	010000		C3 R1
>18	short&074000	074000		TEST
>20	short		0407		(impure)
>20	short		0410		(pure)
>20	short		0411		(separate I&D)
>20	short		0413		(paged)
>20	short		0443		(target shared library)
>12	long		>0		not stripped
>22	short		>0		- version %ld
>48	long&01		01		alignment trap enabled
>52	byte		1		-Ctnc
>52	byte		2		-Ctsw
>52	byte		3		-Ctpw
>52	byte		4		-Ctcb
>53	byte		1		-Cdnc
>53	byte		2		-Cdsw
>53	byte		3		-Cdpw
>53	byte		4		-Cdcb
>54	byte		1		-Csnc
>54	byte		2		-Cssw
>54	byte		3		-Cspw
>54	byte		4		-Cscb
4	string		pipe		CLIPPER instruction trace
4	string		prof		CLIPPER instruction profile

#------------------------------------------------------------------------------
# commands:  file(1) magic for various shells and interpreters
#
0	string		:\ shell archive or commands for antique kernel text
0	string		#!/bin/sh		Bourne shell script text
0	string		#!\ /bin/sh		Bourne shell script text
0	string		#!\	/bin/sh		Bourne shell script text
0	string		#!/bin/csh		C shell script text
0	string		#!\ /bin/csh		C shell script text
0	string		#!\	/bin/csh	C shell script text
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0	string		#!/bin/ksh		Korn shell script text
0	string		#!\ /bin/ksh		Korn shell script text
0	string		#!\	/bin/ksh	Korn shell script text
0	string	 	#!/bin/tcsh		Tenex C shell script text
0	string	 	#!\ /bin/tcsh		Tenex C shell script text
0	string	 	#!\	/bin/tcsh	Tenex C shell script text
0	string		#!/usr/local/tcsh	Tenex C shell script text
0	string	 	#!\ /usr/local/tcsh	Tenex C shell script text
0	string		#!/usr/local/bin/tcsh	Tenex C shell script text
0	string		#!\ /usr/local/bin/tcsh	Tenex C shell script text
0	string		#!\	/usr/local/bin/tcsh	Tenex C shell script text
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0	string		#!/usr/local/bin/zsh	Paul Falstad's zsh
0	string		#!\ /usr/local/bin/zsh	Paul Falstad's zsh
0	string		#!\	/usr/local/bin/zsh	Paul Falstad's zsh
0	string		#!/usr/local/bin/ash	Neil Brown's ash
0	string		#!\ /usr/local/bin/ash	Neil Brown's ash
0	string		#!\	/usr/local/bin/ash	Neil Brown's ash
0	string		#!/usr/local/bin/ae	Neil Brown's ae
0	string		#!\ /usr/local/bin/ae	Neil Brown's ae
0	string		#!\	/usr/local/bin/ae	Neil Brown's ae
0	string		#!/bin/nawk		new awk script text
0	string		#!\ /bin/nawk		new awk script text
0	string		#!\	/bin/nawk		new awk script text
0	string		#!/usr/bin/nawk		new awk script text
0	string		#!\ /usr/bin/nawk	new awk script text
0	string		#!\	/usr/bin/nawk	new awk script text
0	string		#!/usr/local/bin/nawk	new awk script text
0	string		#!\ /usr/local/bin/nawk	new awk script text
0	string		#!\	/usr/local/bin/nawk	new awk script text
0	string		#!/bin/gawk		GNU awk script text
0	string		#!\ /bin/gawk		GNU awk script text
0	string		#!\	/bin/gawk		GNU awk script text
0	string		#!/usr/bin/gawk		GNU awk script text
0	string		#!\ /usr/bin/gawk	GNU awk script text
0	string		#!\	/usr/bin/gawk	GNU awk script text
0	string		#!/usr/local/bin/gawk	GNU awk script text
0	string		#!\ /usr/local/bin/gawk	GNU awk script text
0	string		#!\	/usr/local/bin/gawk	GNU awk script text
#
0	string		#!/bin/awk		awk script text
0	string		#!\ /bin/awk		awk script text
0	string		#!\	/bin/awk		awk script text
0	string		#!/usr/bin/awk		awk script text
0	string		#!\ /usr/bin/awk	awk script text
0	string		#!\	/usr/bin/awk	awk script text
0	string		BEGIN			awk script text

# For Larry Wall's perl language.  The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
#				Keith Waclena <keith@cerberus.uchicago.edu>
0	string		#!/bin/perl			perl script text
0	string		#!\ /bin/perl			perl script text
0	string		#!\	/bin/perl		perl script text
0	string		eval\ "exec\ /bin/perl		perl script text
0	string		#!/usr/bin/perl			perl script text
0	string		#!\ /usr/bin/perl		perl script text
0	string		#!\	/usr/bin/perl		perl script text
0	string		eval\ "exec\ /usr/bin/perl	perl script text
0	string		#!/usr/local/bin/perl		perl script text
0	string		#!\ /usr/local/bin/perl		perl script text
0	string		#!\	/usr/local/bin/perl	perl script text
0	string		eval\ "exec\ /usr/local/bin/perl	perl script text

# AT&T Bell Labs' Plan 9 shell
0	string		#!/bin/rc	Plan 9 rc shell script text
0	string		#!\ /bin/rc	Plan 9 rc shell script text
0	string		#!\	/bin/rc	Plan 9 rc shell script text

# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0	string		#!/bin/bash	Bourne-Again shell script text
0	string		#!\ /bin/bash	Bourne-Again shell script text
0	string		#!\	/bin/bash	Bourne-Again shell script text
0	string		#!/usr/local/bin/bash	Bourne-Again shell script text
0	string		#!\ /usr/local/bin/bash	Bourne-Again shell script text
0	string		#!\	/usr/local/bin/bash	Bourne-Again shell script text

# generic shell magic
0	string		#!\ /			a
>3	string		>\0			%s script text
0	string		#!\	/		a
>3	string		>\0			%s script text
0	string		#!/			a
>2	string		>\0			%s script text
0	string		#!\ 			script text
>3	string		>\0			for %s

#------------------------------------------------------------------------------
# compress:  file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.

# standard unix compress
0	string		\037\235	compress'd data
>2	byte&0x80	>0		block compressed
>2	byte&0x1f	x		%d bits

# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
0       string          \037\213        gzip compressed data
>2      byte            <8              \b, reserved method,
>2      byte            8               \b, deflated,
>3	byte		&0x01		ASCII,
>3	byte		&0x02		continuation,
>3	byte		&0x04		extra field,
>3	byte		&0x08		original filename,
>3	byte		&0x10		comment,
>3	byte		&0x20		encrypted,
>4	ledate		x		last modified: %s,
>8	byte		2		max compression,
>8	byte		4		max speed,
>9	byte		=0x00		os: MS-DOS
>9	byte		=0x01		os: Amiga
>9	byte		=0x02		os: VMS
>9	byte		=0x03		os: Unix
>9	byte		=0x05		os: Atari
>9	byte		=0x06		os: OS/2
>9	byte		=0x07		os: MacOS
>9	byte		=0x0A		os: Tops/20
>9	byte		=0x0B		os: Win/32

# packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
0	string		\037\036	packed data
>2	belong		>1		\b, %d characters originally
>2	belong		=1		\b, %d character originally
#
# This magic number is byte-order-independent.  XXX - Does that mean this
# is big-endian, little-endian, either, or that you can't tell?
# this short is valid for SunOS
0	short		017437		old packed data

# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0	short		0x1fff		compacted data
# This string is valid for SunOS (BE) and a matching "short" is listed
# in the Ultrix (LE) magic file.
0	string		\377\037	compacted data
0	short		0145405		huf output

# bzip2
0	string		BZh		bzip2 compressed data
>3	byte		>47		\b, block size = %c00k

# squeeze and crunch
# Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
0	leshort		0xFF76		squeezed data,
>4	string		x		original name %s
0	leshort		0xFE76		crunched data,
>2	string		x		original name %s
0	leshort		0xFD76		LZH compressed data,
>2	string		x		original name %s

# Freeze
0	string		\037\237	frozen file 2.1
0	string		\037\236	frozen file 1.0 (or gzip 0.5)

# SCO compress -H (LZH)
0	string		\037\240	SCO compress -H (LZH) data

# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# There's only a magic nibble (4 bits); that nibble repeats every 33
# bytes.  This isn't suited for use, but maybe we can use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0	byte&0xF0	0xd0		data
#>33	byte&0xF0	0xd0
#>66	byte&0xF0	0xd0
#>99	byte&0xF0	0xd0
#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio

# bzip	a block-sorting file compressor
#	by Julian Seward <sewardj@cs.man.ac.uk> and others
#
0	string		BZ		bzip compressed	data
>2	byte		x		\b, version: %c
>3	string		=1		\b, compression block size 100k
>3	string		=2		\b, compression block size 200k
>3	string		=3		\b, compression block size 300k
>3	string		=4		\b, compression block size 400k
>3	string		=5		\b, compression block size 500k
>3	string		=6		\b, compression block size 600k
>3	string		=7		\b, compression block size 700k
>3	string		=8		\b, compression block size 800k
>3	string		=9		\b, compression block size 900k

# lzop from <markus.oberhumer@jk.uni-linz.ac.at>
0	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
>9	beshort		<0x0940
>>9	byte&0xf0	=0x00		- version 0.
>>9	beshort&0x0fff	x		\b%03x,
>>13	byte		1		LZO1X-1,
>>13	byte		2		LZO1X-1(15),
>>13	byte		3		LZO1X-999,
## >>22	bedate		>0		last modified: %s,
>>14	byte		=0x00		os: MS-DOS
>>14	byte		=0x01		os: Amiga
>>14	byte		=0x02		os: VMS
>>14	byte		=0x03		os: Unix
>>14	byte		=0x05		os: Atari
>>14	byte		=0x06		os: OS/2
>>14	byte		=0x07		os: MacOS
>>14	byte		=0x0A		os: Tops/20
>>14	byte		=0x0B		os: WinNT
>>14	byte		=0x0E		os: Win32
>9	beshort		>0x0939
>>9	byte&0xf0	=0x00		- version 0.
>>9	byte&0xf0	=0x10		- version 1.
>>9	byte&0xf0	=0x20		- version 2.
>>9	beshort&0x0fff	x		\b%03x,
>>15	byte		1		LZO1X-1,
>>15	byte		2		LZO1X-1(15),
>>15	byte		3		LZO1X-999,
## >>25	bedate		>0		last modified: %s,
>>17	byte		=0x00		os: MS-DOS
>>17	byte		=0x01		os: Amiga
>>17	byte		=0x02		os: VMS
>>17	byte		=0x03		os: Unix
>>17	byte		=0x05		os: Atari
>>17	byte		=0x06		os: OS/2
>>17	byte		=0x07		os: MacOS
>>17	byte		=0x0A		os: Tops/20
>>17	byte		=0x0B		os: WinNT
>>17	byte		=0x0E		os: Win32
#------------------------------------------------------------------------------
# convex:  file(1) magic for Convex boxes
#
# Convexes are big-endian.
#
# /*\
#  * Below are the magic numbers and tests added for Convex.
#  * Added at beginning, because they are expected to be used most.
# \*/
0	belong	0507	Convex old-style object
>16	belong	>0	not stripped
0	belong	0513	Convex old-style demand paged executable
>16	belong	>0	not stripped
0	belong	0515	Convex old-style pre-paged executable
>16	belong	>0	not stripped
0	belong	0517	Convex old-style pre-paged, non-swapped executable
>16	belong	>0	not stripped
0	belong	0x011257	Core file
#
# The following are a series of dump format magic numbers.  Each one
# corresponds to a drastically different dump format.  The first on is
# the original dump format on a 4.1 BSD or earlier file system.  The
# second marks the change between the 4.1 file system and the 4.2 file
# system.  The Third marks the changing of the block size from 1K
# to 2K to be compatible with an IDC file system.  The fourth indicates
# a dump that is dependent on Convex Storage Manager, because data in
# secondary storage is not physically contained within the dump.
# The restore program uses these number to determine how the data is
# to be extracted.
#
24	belong	=60011	dump format, 4.1 BSD or earlier
24	belong	=60012	dump format, 4.2 or 4.3 BSD without IDC
24	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
24	belong	=60014	dump format, Convex Storage Manager by-reference dump
#
# what follows is a bunch of bit-mask checks on the flags field of the opthdr.
# If there is no `=' sign, assume just checking for whether the bit is set?
#
0	belong	0601		Convex SOFF
>88	belong&0x000f0000	=0x00000000	c1
>88	belong			&0x00010000	c2
>88	belong			&0x00020000	c2mp
>88	belong			&0x00040000	parallel
>88	belong			&0x00080000	intrinsic
>88	belong			&0x00000001	demand paged
>88	belong			&0x00000002	pre-paged
>88	belong			&0x00000004	non-swapped
>88	belong			&0x00000008	POSIX
#
>84	belong			&0x80000000	executable
>84	belong			&0x40000000	object
>84	belong&0x20000000	=0		not stripped
>84	belong&0x18000000	=0x00000000	native fpmode
>84	belong&0x18000000	=0x10000000	ieee fpmode
>84	belong&0x18000000	=0x18000000	undefined fpmode
#
0	belong			0605		Convex SOFF core
#
0	belong			0607		Convex SOFF checkpoint
>88	belong&0x000f0000	=0x00000000	c1
>88	belong			&0x00010000	c2
>88	belong			&0x00020000	c2mp
>88	belong			&0x00040000	parallel
>88	belong			&0x00080000	intrinsic
>88	belong			&0x00000008	POSIX
#
>84	belong&0x18000000	=0x00000000	native fpmode
>84	belong&0x18000000	=0x10000000	ieee fpmode
>84	belong&0x18000000	=0x18000000	undefined fpmode

#------------------------------------------------------------------------------
# database:  file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
#
# GDBM magic numbers
#  Will be maintained as part of the GDBM distribution in the future.
#  <downsj@teeny.org>
0	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian
0	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian
0	string	GDBM		GNU dbm 2.x database
#
0	belong	0x061561	Berkeley DB Hash file
>4	belong	>0		(Version %d,
>8	belong	1234		Little Endian,
>8	belong	4321		Big Endian,
>12	belong	x		Bucket Size %d,
>16	belong	x		Bucket Shift %d,
>20	belong	x		Directory Size %d,
>24	belong	x		Segment Size %d,
>28	belong	x		Segment Shift %d,
>32	belong	x		Overflow Point %d,
>36	belong	x		Last Freed %d,
>40	belong	x		Max Bucket %d,
>44	belong	x		High Mask 0x%x,
>48	belong	x		Low Mask 0x%x,
>52	belong	x		Fill Factor %d,
>56	belong	x		Number of Keys %d)
#
#
0	belong	0x053162	Berkeley DB Btree file
>4	belong	>0		(Version %d,
>8	belong	x		Page Size %d,
>12	belong	x		Free Page %d,
>16	belong	x		Number of Records %d,
>20	belong	x		Flags 0x%x)

#------------------------------------------------------------------------------
# diamond:  file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
# XXX - I think it was either renamed Slate, or replaced by Slate....
#
#	The full deal is too long...
#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
0	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document

#------------------------------------------------------------------------------
# diff:  file(1) magic for diff(1) output
#
0	string		diff\ 	'diff' output text
0	string		***\ 		'diff' output text
0	string		Only\ in\ 	'diff' output text
0	string		Common\ subdirectories:\ 	'diff' output text
#  Digital UNIX - Info
#
0	string	!<arch>\n________64E	Alpha archive
>22	string	X			-- out of date
#
# Alpha COFF Based Executables
# The stripped stuff really needs to be an 8 byte (64 bit) compare,
# but this works
0	leshort		0x183		COFF format alpha
>22	leshort&020000	&010000		sharable library,
>22	leshort&020000	^010000		dynamically linked,
>24	leshort		0410		pure
>24	leshort		0413		demand paged
>8	lelong		>0		executable or object module, not stripped
>8	lelong		0
>>12	lelong		0		executable or object module, stripped
>>12	lelong		>0		executable or object module, not stripped
>27     byte            >0              - version %d.
>26     byte            >0              %d-
>28     leshort         >0              %d
#
# The next is incomplete, we could tell more about this format,
# but its not worth it.
0	leshort		0x188	Alpha compressed COFF
0	leshort		0x18f	Alpha u-code object
#
#
# Some other interesting Digital formats,
0	string	\377\377\177		ddis/ddif
0	string	\377\377\174		ddis/dots archive
0	string	\377\377\176		ddis/dtif table data
0	string	\033c\033		LN03 output
0	long	04553207		X image
#
0	string	!<PDF>!\n		profiling data file
#
# Locale data tables (MIPS and Alpha).
#
0	short		0x0501		locale data table
>6	short		0x24		for MIPS
>6	short		0x40		for Alpha

#------------------------------------------------------------------------------
# dump:  file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
24	belong	60012		new-fs dump file (big endian),
>4	bedate	x		Previous dump %s,
>8	bedate	x		This dump %s,
>12	belong	>0		Volume %ld,
>692	belong	0		Level zero, type:
>692	belong	>0		Level %d, type:
>0	belong	1		tape header,
>0	belong	2		beginning of file record,
>0	belong	3		map of inodes on tape,
>0	belong	4		continuation of file record,
>0	belong	5		end of volume,
>0	belong	6		map of inodes deleted,
>0	belong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	belong	>0		Flags %x

24	belong	60011		old-fs dump file (big endian),
#>4	bedate	x		Previous dump %s,
#>8	bedate	x		This dump %s,
>12	belong	>0		Volume %ld,
>692	belong	0		Level zero, type:
>692	belong	>0		Level %d, type:
>0	belong	1		tape header,
>0	belong	2		beginning of file record,
>0	belong	3		map of inodes on tape,
>0	belong	4		continuation of file record,
>0	belong	5		end of volume,
>0	belong	6		map of inodes deleted,
>0	belong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	belong	>0		Flags %x

24	lelong	60012		new-fs dump file (little endian),
>4	ledate	x		This dump %s,
>8	ledate	x		Previous dump %s,
>12	lelong	>0		Volume %ld,
>692	lelong	0		Level zero, type:
>692	lelong	>0		Level %d, type:
>0	lelong	1		tape header,
>0	lelong	2		beginning of file record,
>0	lelong	3		map of inodes on tape,
>0	lelong	4		continuation of file record,
>0	lelong	5		end of volume,
>0	lelong	6		map of inodes deleted,
>0	lelong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	lelong	>0		Flags %x

24	lelong	60011		old-fs dump file (little endian),
#>4	ledate	x		Previous dump %s,
#>8	ledate	x		This dump %s,
>12	lelong	>0		Volume %ld,
>692	lelong	0		Level zero, type:
>692	lelong	>0		Level %d, type:
>0	lelong	1		tape header,
>0	lelong	2		beginning of file record,
>0	lelong	3		map of inodes on tape,
>0	lelong	4		continuation of file record,
>0	lelong	5		end of volume,
>0	lelong	6		map of inodes deleted,
>0	lelong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	lelong	>0		Flags %x

#------------------------------------------------------------------------------
# elf:  file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# MIPS R3000 may also be for MIPS R2000.
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\177ELF		ELF
>4	byte		0		invalid class
>4	byte		1		32-bit
>4	byte		2		64-bit
>5	byte		0		invalid byte order
>5	byte		1		LSB
>>16	leshort		0		no file type,
>>16	leshort		1		relocatable,
>>16	leshort		2		executable,
>>16	leshort		3		shared object,
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
>>16	leshort		4		core file
>>>(0x38+0xcc) string	>\0		of '%s'
>>>(0x38+0x10) lelong	>0		(signal %d),
>>16	leshort		&0xff00		processor-specific,
>>18	leshort		0		no machine,
>>18	leshort		1		AT&T WE32100 - invalid byte order,
>>18	leshort		2		SPARC - invalid byte order,
>>18	leshort		3		Intel 80386,
>>18	leshort		4		Motorola 68000 - invalid byte order,
>>18	leshort		5		Motorola 88000 - invalid byte order,
>>18	leshort		6		Intel 80486,
>>18	leshort		7		Intel 80860,
>>18	leshort		8		MIPS R3000_BE - invalid byte order,
>>18	leshort		9		Amdahl - invalid byte order,
>>18	leshort		10		MIPS R3000_LE,
>>18	leshort		11		RS6000 - invalid byte order,
>>18	leshort		15		PA-RISC - invalid byte order,
>>18	leshort		16		nCUBE,
>>18	leshort		17		VPP500,
>>18	leshort		18		SPARC32PLUS,
>>18	leshort		20		PowerPC,
>>18	leshort		0x9026		Alpha,
>>20	lelong		0		invalid version
>>20	lelong		1		version 1
>>36	lelong		1		MathCoPro/FPU/MAU Required
>8	string		>\0		(%s)
>5	byte		2		MSB
>>16	beshort		0		no file type,
>>16	beshort		1		relocatable,
>>16	beshort		2		executable,
>>16	beshort		3		shared object,
>>16	beshort		4		core file,
>>>(0x38+0xcc) string	>\0		of '%s'
>>>(0x38+0x10) belong	>0		(signal %d),
>>16	beshort		&0xff00		processor-specific,
>>18	beshort		0		no machine,
>>18	beshort		1		AT&T WE32100,
>>18	beshort		2		SPARC,
>>18	beshort		3		Intel 80386 - invalid byte order,
>>18	beshort		4		Motorola 68000,
>>18	beshort		5		Motorola 88000,
>>18	beshort		6		Intel 80486 - invalid byte order,
>>18	beshort		7		Intel 80860,
>>18	beshort		8		MIPS R3000_BE,
>>18	beshort		9		Amdahl,
>>18	beshort		10		MIPS R3000_LE - invalid byte order,
>>18	beshort		11		RS6000,
>>18	beshort		15		PA-RISC,
>>18	beshort		16		nCUBE,
>>18	beshort		17		VPP500,
>>18	beshort		18		SPARC32PLUS,
>>18	beshort		20		PowerPC or cisco 4500,
>>18	beshort		21		cisco 7500,
>>18	beshort		24		cisco SVIP,
>>18	beshort		25		cisco 7200,
>>18	beshort		36		cisco 12000,
>>18	beshort		0x9026		Alpha,
>>20	belong		0		invalid version
>>20	belong		1		version 1
>>36	belong		1		MathCoPro/FPU/MAU Required

#------------------------------------------------------------------------------
# encore:  file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
#
0	short		0x154		Encore
>20	short		0x107		executable
>20	short		0x108		pure executable
>20	short		0x10b		demand-paged executable
>20	short		0x10f		unsupported executable
>12	long		>0		not stripped
>22	short		>0		- version %ld
>22	short		0		-
#>4	date		x		stamp %s
0	short		0x155		Encore unsupported executable
>12	long		>0		not stripped
>22	short		>0		- version %ld
>22	short		0		-
#>4	date		x		stamp %s

#------------------------------------------------------------------------------
# filesystems:  file(1) magic for different filesystems
#
0x438	leshort	0xEF53			Linux/i386 ext2 filesystem
0	string	\366\366\366\366	PC formatted floppy with no filesystem
# Sun disk labels
# From /usr/include/sun/dklabel.h:
0774	beshort		0xdabe		Sun disk label
>0	string		x		'%s
>>31  	string		>\0		\b%s
>>>63  	string		>\0		\b%s
>>>>95 	string		>\0		\b%s
>0	string		x		\b'
>0734	short		>0		%d rpm,
>0736	short		>0		%d phys cys,
>0740	short		>0		%d alts/cyl,
>0746	short		>0		%d interleave,
>0750	short		>0		%d data cyls,
>0752	short		>0		%d alt cyls,
>0754	short		>0		%d heads/partition,
>0756	short		>0		%d sectors/track,
>0764	long		>0		start cyl %ld,
>0770	long		x		%ld blocks
# Is there a boot block written 1 sector in?
>512    belong&077777777	0600407	\b, boot block present
0x1FE	leshort	0xAA55			x86 boot sector
>2	string	OSBS			\b, OS/BS MBR
>0x8C	string	Invalid\ partition\ table	\b, MS-DOS MBR
>0	string	\0\0\0\0		\b, extended partition table
>0	leshort 0x3CEB			\b, system
>>3	string	>\0			%s
>>0x36	string	FAT			\b, %s
>>>0x39	string	12			(%s bit)
>>>0x39	string	16			(%s bit)
>>>43	string		>NO\ NAME	label: %.11s,
>>>43	string		<NO\ NAME	label: %.11s,
>>>43	string		NO\ NAME	unlabeled,
>>>19	leshort		>0		%d sectors
>>>19	leshort		0		
>>>>32	lelong		x		%d sectors
>0x200	lelong	0x82564557		\b, BSD disklabel

# Minix filesystems - Juan Cespedes <cespedes@debian.org>
0x410	leshort		0x137f		Minix filesystem
0x410	leshort		0x138f		Minix filesystem, 30 char names
0x410	leshort		0x2468		Minix filesystem, version 2
0x410	leshort		0x2478		Minix filesystem, version 2, 30 char names

# romfs filesystems - Juan Cespedes <cespedes@debian.org>
0	string		-rom1fs-\0	romfs filesystem, version 1
>8	belong	x			%d bytes,
>16	string	x			named %s.

# netboot image - Juan Cespedes <cespedes@debian.org>
0	lelong		0x1b031336L	Netboot image,
>4	lelong&0xFFFFFF00	0
>>4	lelong&0x100	0x000		mode 2
>>4	lelong&0x100	0x100		mode 3
>4	lelong&0xFFFFFF00	!0	unknown mode

0x18b	string	OS/2	OS/2 Boot Manager

#------------------------------------------------------------------------------
# fonts:  file(1) magic for font data
#
0	string		FONT		ASCII vfont text
0	short		0436		Berkeley vfont data
0	short		017001		byte-swapped Berkeley vfont data

# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
0	string		%!PS-AdobeFont-1.0	PostScript Type 1 font text
>20	string		>\0			(%s)
6	string		%!PS-AdobeFont-1.0	PostScript Type 1 font program data

# X11 font files in SNF (Server Natural Format) format
0	belong		00000004		X11 SNF font data, MSB first
0	lelong		00000004		X11 SNF font data, LSB first

# X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		STARTFONT\040		X11 BDF font text

# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
0	string		\001fcp			X11 Portable Compiled Font data
>12	byte		0x02			\b, LSB first
>12	byte		0x0a			\b, MSB first
0	string		D1.0\015		X11 Speedo font data

#------------------------------------------------------------------------------
# FIGlet fonts and controlfiles
# From figmagic supplied with Figlet version 2.2
# "David E. O'Brien" <obrien@FreeBSD.ORG>
0	string		flf		FIGlet font
>3	string		>2a		version %-2.2s
0	string		flc		FIGlet controlfile
>3	string		>2a		version %-2.2s

# libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
# Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
0	belong		0x14025919	libGrx font data,
>8	leshort		x		%dx
>10	leshort		x		\b%d
>40	string		x		%s
# Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
0	belong		0xff464f4e	DOS code page font data collection
7	belong		0x00454741	DOS code page font data
7	belong		0x00564944	DOS code page font data (from Linux?)
4098	string		DOSFONT		DOSFONT2 encrypted font data


#------------------------------------------------------------------------------
# frame:  file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0	string		\<MakerFile	FrameMaker document
>11	string		5.0		 (5.0
>11	string		4.0		 (4.0
>11	string		3.0		 (3.0
>11	string		2.0		 (2.0
>11	string		1.0		 (1.0
>14	byte		x		  %c)
0	string		\<MIFFile	FrameMaker MIF (ASCII) file
>9	string		4.0		 (4.0)
>9	string		3.0		 (3.0)
>9	string		2.0		 (2.0)
>9	string		1.0		 (1.x)
0	string		\<MakerDictionary	FrameMaker Dictionary text
>17	string		3.0		 (3.0)
>17	string		2.0		 (2.0)
>17	string		1.0		 (1.x)
0	string		\<MakerScreenFont	FrameMaker Font file
>17	string		1.01		 (%s)
0	string		\<MML		FrameMaker MML file
0	string		\<BookFile	FrameMaker Book file
>10	string		3.0		 (3.0
>10	string		2.0		 (2.0
>10	string		1.0		 (1.0
>13	byte		x		  %c)
# XXX - this book entry should be verified, if you find one, uncomment this
#0	string		\<Book\ 	FrameMaker Book (ASCII) file
#>6	string		3.0		 (3.0)
#>6	string		2.0		 (2.0)
#>6	string		1.0		 (1.0)
0	string		\<Maker	Intermediate Print File	FrameMaker IPL file

#------------------------------------------------------------------------------
# freebsd:  file(1) magic for FreeBSD objects
#
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
# little-endian on x86).
#
# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
# schemes for distinguishing between executable images, shared libraries,
# and object files.
#
# FreeBSD says:
#
#    Regardless of whether it's pure, demand-paged, or none of the
#    above:
#
#	if the entry point is < 4096, then it's a shared library if
#	the "has run-time loader information" bit is set, and is
#	position-independent if the "is position-independent" bit
#	is set;
#
#	if the entry point is >= 4096 (or >4095, same thing), then it's
#	an executable, and is dynamically-linked if the "has run-time
#	loader information" bit is set.
#
# On x86, NetBSD says:
#
#    If it's neither pure nor demand-paged:
#
#	if it has the "has run-time loader information" bit set, it's
#	a dynamically-linked executable;
#
#	if it doesn't have that bit set, then:
#
#	    if it has the "is position-independent" bit set, it's
#	    position-independent;
#
#	    if the entry point is non-zero, it's an executable, otherwise
#	    it's an object file.
#
#    If it's pure:
#
#	if it has the "has run-time loader information" bit set, it's
#	a dynamically-linked executable, otherwise it's just an
#	executable.
#
#    If it's demand-paged:
#
#	if it has the "has run-time loader information" bit set,
#	then:
#
#	    if the entry point is < 4096, it's a shared library;
#
#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
#	    it's a dynamically-linked executable);
#
#	if it doesn't have the "has run-time loader information" bit
#	set, then it's just an executable.
#
# (On non-x86, NetBSD does much the same thing, except that it uses
# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
# had 8K pages; dunno about MIPS.)
#
# I suspect the two will differ only in perverse and uninteresting cases
# ("shared" libraries that aren't demand-paged and whose pages probably
# won't actually be shared, executables with entry points <4096).
#
# I leave it to those more familiar with FreeBSD and NetBSD to figure out
# what the right answer is (although using ">4095", FreeBSD-style, is
# probably better than separately checking for "=4096" and ">4096",
# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
# executables using the NetBSD technique.)
#
0	lelong&0377777777	041400407	FreeBSD/i386
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400410	FreeBSD/i386 pure
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400413	FreeBSD/i386 demand paged
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

# XXX gross hack to identify core files
# cores start with a struct tss; we take advantage of the following:
# byte 7:     highest byte of the kernel stack pointer, always 0xfe
#      8/9:   kernel (ring 0) ss value, always 0x0010
#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
#      28:    low order byte of the current PTD entry, always 0 since the
#             PTD is page-aligned
#
7	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
>1039	string	>\0	from '%s'

# /var/run/ld.so.hints
# What are you laughing about?
0	lelong			011421044151	ld.so hints file
>4	lelong			>0		(version %d)
#------------------------------------------------------------------------------
# GIMP Gradient: file(1) magic for the GIMP's gradient data files
# by Federico Mena <federico@nuclecu.unam.mx>

0       string          GIMP\ Gradient  GIMP gradient data

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the XCF image format used in the GIMP developed
#       by Spencer Kimball and Peter Mattis
#       ('Bucky' LaDieu, nega@vt.edu)

0       string          gimp\ xcf\ file GIMP XCF image data,
>14     belong          x               %ld x
>18     belong          x               %ld,
>22     belong          0               RGB Color
>22     belong          1               Greyscale
>22     belong          2               Indexed Color

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the patterns used in the GIMP, developed
#       by Spencer Kimball and Peter Mattis
#       ('Bucky' LaDieu, nega@vt.edu)

20      string          GPAT            GIMP pattern data,
>24     string          x               %s

#------------------------------------------------------------------------------
# XCF:  file(1) magic for the brushes used in the GIMP, developed
#       by Spencer Kimball and Peter Mattis
#       ('Bucky' LaDieu, nega@vt.edu)

20      string          GIMP            GIMP brush data
#
# GNU nlsutils message catalog file format
#
0	string		\336\22\4\225	GNU message catalog (little endian),
>4	lelong		x		revision %d,
>8	lelong		x		%d messages
0	string		\225\4\22\336	GNU message catalog (big endian),
>4	belong		x		revision %d,
>8	belong		x		%d messages

#------------------------------------------------------------------------------
# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
# big-endian as it was mostly 68K-based.
#
# I think the 500 series was the old stack-based machines, running a
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
# HP magic is useful for reference, but using "long" magic is a better
# practice in order to avoid collisions.
#
# Guy Harris (guy@netapp.com): some additions to this list came from
# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
# "/etc/magic", though, except for the "archive file relocatable library"
# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
# used in executables, or have they just not yet updated "/etc/magic"
# completely?
#
# 0	beshort		200		hp200 (68010) BSD binary
# 0	beshort		300		hp300 (68020+68881) BSD binary
# 0	beshort		0x20c		hp200/300 HP-UX binary
# 0	beshort		0x20d		hp400 (68030) HP-UX binary
# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
# 0	beshort		0x214		PA-RISC2.0 HP-UX binary

#
# The "misc" stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0	beshort		0627		Apollo m68k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0	beshort		0624		apollo a88k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0       long            01203604016     TML 0123 byte-order format
0       long            01702407010     TML 1032 byte-order format
0       long            01003405017     TML 2301 byte-order format
0       long            01602007412     TML 3210 byte-order format
#### PA-RISC 1.1
0	belong 		0x02100106	PA-RISC1.1 relocatable object
0	belong 		0x02100107	PA-RISC1.1 executable
>168	belong		&=0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x02100108	PA-RISC1.1 shared executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x0210010b	PA-RISC1.1 demand-load executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x0210010e	PA-RISC1.1 shared library
>96	belong		>0		- not stripped

0	belong 		0x0210010d	PA-RISC1.1 dynamic load library
>96	belong		>0		- not stripped

#### PA-RISC 2.0
0	belong		0x02140106	PA-RISC2.0 relocatable object

0       belong		0x02140107	PA-RISC2.0 executable
>168	belong		&=0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0       belong		0x02140108	PA-RISC2.0 shared executable
>168	belong		&=0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0       belong		0x0214010b	PA-RISC2.0 demand-load executable
>168	belong		&=0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0       belong		0x0214010e	PA-RISC2.0 shared library
>96	belong		>0		- not stripped

0       belong		0x0214010d	PA-RISC2.0 dynamic load library
>96	belong		>0		- not stripped

#### 800
0	belong 		0x020b0106	PA-RISC1.0 relocatable object

0	belong 		0x020b0107	PA-RISC1.0 executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b0108	PA-RISC1.0 shared executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b010b	PA-RISC1.0 demand-load executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b010e	PA-RISC1.0 shared library
>96	belong		>0		- not stripped

0	belong 		0x020b010d	PA-RISC1.0 dynamic load library
>96	belong		>0		- not stripped

0	belong		0x213c6172	archive file
>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
>68	belong 		0x02140619	- PA-RISC2.0 relocatable library

#### 500
0	long		0x02080106	HP s500 relocatable executable
>16	long		>0		- version %ld

0	long		0x02080107	HP s500 executable
>16	long		>0		- version %ld

0	long		0x02080108	HP s500 pure executable
>16	long		>0		- version %ld

#### 200
0	belong 		0x020c0108	HP s200 pure executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0107	HP s200 executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c010b	HP s200 demand-load executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0106	HP s200 relocatable executable
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>8	belong		&0x80000000	save fp regs
>8	belong		&0x20000000	debuggable
>8	belong		&0x10000000	PIC

0	belong 		0x020a0108	HP s200 (2.x release) pure executable
>4	beshort		>0		- version %ld
>36	belong		>0		not stripped

0	belong		0x020a0107	HP s200 (2.x release) executable
>4	beshort		>0		- version %ld
>36	belong		>0		not stripped

0	belong		0x020c010e	HP s200 shared library
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>36	belong		>0		not stripped

0	belong		0x020c010d	HP s200 dynamic load library
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>36	belong		>0		not stripped

#### MISC
0	long		0x0000ff65	HP old archive
0	long		0x020aff65	HP s200 old archive
0	long		0x020cff65	HP s200 old archive
0	long		0x0208ff65	HP s500 old archive

0	long		0x015821a6	HP core file

0	long		0x4da7eee8	HP-WINDOWS font
>8	byte		>0		- version %ld
0	string		Bitmapfile	HP Bitmapfile

0	string		IMGfile	CIS 	compimg HP Bitmapfile
# XXX - see "lif"
#0	short		0x8000		lif file
0	long		0x020c010c	compiled Lisp

0	string		msgcat01	HP NLS message catalog,
>8	long		>0		%d messages

# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
0	string		HPHP48-		HP48 binary
>7	byte		>0		- Rev %c
>8	short		0x1129		(ADR)
>8	short		0x3329		(REAL)
>8	short		0x5529		(LREAL)
>8	short		0x7729		(COMPLX)
>8	short		0x9d29		(LCOMPLX)
>8	short		0xbf29		(CHAR)
>8	short		0xe829		(ARRAY)
>8	short		0x0a2a		(LNKARRAY)
>8	short		0x2c2a		(STRING)
>8	short		0x4e2a		(HXS)
>8	short		0x742a		(LIST)
>8	short		0x962a		(DIR)
>8	short		0xb82a		(ALG)
>8	short		0xda2a		(UNIT)
>8	short		0xfc2a		(TAGGED)
>8	short		0x1e2b		(GROB)
>8	short		0x402b		(LIB)
>8	short		0x622b		(BACKUP)
>8	short		0x882b		(LIBDATA)
>8	short		0x9d2d		(PROG)
>8	short		0xcc2d		(CODE)
>8	short		0x482e		(GNAME)
>8	short		0x6d2e		(LNAME)
>8	short		0x922e		(XLIB)
0	string		%%HP:		HP48 text
>6	string		T(0)		- T(0)
>6	string		T(1)		- T(1)
>6	string		T(2)		- T(2)
>6	string		T(3)		- T(3)
>10	string		A(D)		A(D)
>10	string		A(R)		A(R)
>10	string		A(G)		A(G)
>14	string		F(.)		F(.);
>14	string		F(,)		F(,);

# hpBSD magic numbers
0	beshort		200		hp200 (68010) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary
0	beshort		300		hp300 (68020+68881) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary

#------------------------------------------------------------------------------
# ibm370:  file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
# AIX 4.1's "/etc/magic" has
#
#	0	short		0535		370 sysV executable 
#	>12	long		>0		not stripped
#	>22	short		>0		- version %d
#	>30	long		>0		- 5.2 format
#	0	short		0530		370 sysV pure executable 
#	>12	long		>0		not stripped
#	>22	short		>0		- version %d
#	>30	long		>0		- 5.2 format
#
# instead of the "USS/370" versions of the same magic numbers.
#
0	beshort		0537		370 XA sysV executable 
>12	belong		>0		not stripped
>22	beshort		>0		- version %d
>30	belong		>0		- 5.2 format
0	beshort		0532		370 XA sysV pure executable 
>12	belong		>0		not stripped
>22	beshort		>0		- version %d
>30	belong		>0		- 5.2 format
0	beshort		054001		370 sysV pure executable
>12	belong		>0		not stripped
0	beshort		055001		370 XA sysV pure executable
>12	belong		>0		not stripped
0	beshort		056401		370 sysV executable
>12	belong		>0		not stripped
0	beshort		057401		370 XA sysV executable
>12	belong		>0		not stripped
0       beshort		0531		SVR2 executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24     belong		>0		- version %ld
0	beshort		0534		SVR2 pure executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0530		SVR2 pure executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0535		SVR2 executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld

#------------------------------------------------------------------------------
# ibm6000:  file(1) magic for RS/6000 and the RT PC.
#
0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
>12	belong		>0		not stripped
# Breaks sun4 statically linked execs.
#0      beshort		0x0103		executable (RT Version 2) or obj module
#>2	byte		0x50		pure
#>28	belong		>0		not stripped
#>6	beshort		>0		- version %ld
0	beshort		0x0104		shared library
0	beshort		0x0105		ctab data
0	beshort		0xfe04		structured file
0	string		0xabcdef	AIX message catalog
0	belong		0x000001f9	AIX compiled message catalog
0	string		\<aiaff>	archive

#------------------------------------------------------------------------------
# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
# Arts for file interchange.  It has also been used by Apple, SGI, and
# especially Commodore-Amiga.
#
# IFF files begin with an 8 byte FORM header, followed by a 4 character
# FORM type, which is followed by the first chunk in the FORM.

0	string		FORM		IFF data
#>4	belong		x		\b, FORM is %d bytes long
# audio formats
>8	string		AIFF		\b, AIFF audio
>8	string		AIFC		\b, AIFF-C compressed audio
>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
>8	string		SAMP		\b, SAMP sampled audio
# image formats
>8	string		ILBMBMHD	\b, ILBM interleaved image
>>20	beshort		x		\b, %d x
>>22	beshort		x		%d
>8	string		RGBN		\b, RGBN 12-bit RGB image
>8	string		RGB8		\b, RGB8 24-bit RGB image
>8	string		DR2D		\b, DR2D 2-D object
>8	string		TDDD		\b, TDDD 3-D rendering
# other formats
>8	string		FTXT		\b, FTXT formatted text

#------------------------------------------------------------------------------
# images:  file(1) magic for image formats (see also "iff")
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# little magic: PCX (first byte is 0x0a)
# no magic: Targa

# PBMPLUS images
# The next byte following the magic is always whitespace.
0	string		P1		PBM image text
0	string		P2		PGM image text
0	string		P3		PPM image text
0	string		P4		PBM "rawbits" image data
0	string		P5		PGM "rawbits" image data
0	string		P6		PPM "rawbits" image data

# NIFF (Navy Interchange File Format, a modification of TIFF) images
0	string		IIN1		NIFF image data

# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
# The second word of TIFF files is the TIFF version number, 42, which has
# never changed.  The TIFF specification recommends testing for it.
0	string		MM\x00\x2a	TIFF image data, big-endian
0	string		II\x2a\x00	TIFF image data, little-endian

# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt@uchicago.edu)
# (Albert Cahalan, acahalan@cs.uml.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
#
0	string		\x89PNG		PNG image data,
>4	belong		!0x0d0a1a0a	CORRUPTED,
>4	belong		0x0d0a1a0a
>>16	belong		x		%ld x
>>20	belong		x		%ld,
>>24	byte		x		%d-bit
>>25	byte		0		grayscale,
>>25	byte		2		\b/color RGB,
>>25	byte		3		colormap,
>>25	byte		4		gray+alpha,
>>25	byte		6		\b/color RGBA,
#>>26	byte		0		deflate/32K,
>>28	byte		0		non-interlaced
>>28	byte		1		interlaced
1	string		PNG		PNG image data, CORRUPTED

# GIF
0	string		GIF8		GIF image data
>4	string		7a		\b, version 8%s,
>4	string		9a		\b, version 8%s,
>6	leshort		>0		%hd x
>8	leshort		>0		%hd,
#>10	byte		&0x80		color mapped,
#>10	byte&0x07	=0x00		2 colors
#>10	byte&0x07	=0x01		4 colors
#>10	byte&0x07	=0x02		8 colors
#>10	byte&0x07	=0x03		16 colors
#>10	byte&0x07	=0x04		32 colors
#>10	byte&0x07	=0x05		64 colors
#>10	byte&0x07	=0x06		128 colors
#>10	byte&0x07	=0x07		256 colors

# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
# 1 plane, no encoding.
0	string		\361\0\100\273	CMU window manager raster image data
>4	lelong		>0		%d x
>8	lelong		>0		%d,
>12	lelong		>0		%d-bit

# Magick Image File Format
0	string		id=ImageMagick	MIFF image data

# Artisan
0	long		1123028772	Artisan image data
>4	long		1		\b, rectangular 24-bit
>4	long		2		\b, rectangular 8-bit with colormap
>4	long		3		\b, rectangular 32-bit (24-bit with matte)

# FIG (Facility for Interactive Generation of figures), an object-based format
0	string		#FIG		FIG image text
>5	string		x		\b, version %.3s

# PHIGS
0	string		ARF_BEGARF		PHIGS clear text archive
0	string		@(#)SunPHIGS		SunPHIGS
# version number follows, in the form m.n
>40	string		SunBin			binary
>32	string		archive			archive

# GKS (Graphics Kernel System)
0	string		GKSM		GKS Metafile
>24	string		SunGKS		\b, SunGKS

# CGM image files
0	string		BEGMF		clear text Computer Graphics Metafile
# XXX - questionable magic
0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
0	beshort		0x3020		character Computer Graphics Metafile

# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
0	string	yz	MGR bitmap, modern format, 8-bit aligned
0	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
0	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
0	string	yx	MGR bitmap, modern format, squeezed

# Fuzzy Bitmap (FBM) images
0	string		%bitmap\0	FBM image data
>30	long		0x31		\b, mono
>30	long		0x33		\b, color

# facsimile data
1	string		PC\ Research,\ Inc	group 3 fax data
>29	byte		0		\b, normal resolution (204x98 DPI)
>29	byte		1		\b, fine resolution (204x196 DPI)

# JPEG images
# SunOS 5.5.1 had
#
#	0	string		\377\330\377\340	JPEG file
#	0	string		\377\330\377\356	JPG file
#
# both of which turn into "JPEG image data" here.
#
0	beshort		0xffd8		JPEG image data
>6	string		JFIF		\b, JFIF standard
# HSI is Handmade Software's proprietary JPEG encoding scheme
0	string		hsi1		JPEG image data, HSI proprietary

# PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
0	string		BM		PC bitmap data
>14	leshort		12		\b, OS/2 1.x format
>>18	leshort		x		\b, %d x
>>20	leshort		x		%d
>14	leshort		64		\b, OS/2 2.x format
>>18	leshort		x		\b, %d x
>>20	leshort		x		%d
>14	leshort		40		\b, Windows 3.x format
>>18	lelong		x		\b, %d x
>>22	lelong		x		%d x
>>28	leshort		x		%d
0	string		IC		PC icon data
0	string		PI		PC pointer image data
0	string		CI		PC color icon data
0	string		CP		PC color pointer image data
# Conflicts with other entries [BABYL]
#0	string		BA		PC bitmap array data

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# note possible collision with C/REXX entry in c-lang; currently commented out
0	string		/*\ XPM\ */	X pixmap image text

# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
0	leshort		0xcc52		RLE image data,
>6	leshort		x		%d x
>8	leshort		x		%d
>2	leshort		>0		\b, lower left corner: %d
>4	leshort		>0		\b, lower right corner: %d
>10	byte&0x1	=0x1		\b, clear first
>10	byte&0x2	=0x2		\b, no background
>10	byte&0x4	=0x4		\b, alpha channel
>10	byte&0x8	=0x8		\b, comment
>11	byte		>0		\b, %d color channels
>12	byte		>0		\b, %d [4-b old stack-based machines, running a
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
# HP magic is useful for reference, but using "long" magic is a better
# practice in order to avoid collisions.
#
# Guy Harris (guy@netapp.com): some additions to this list came from
# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
# "/etc/magic", though, except for the "archive file relocatable library"
# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
# used in executables, or have they just not yet updated "/etc/magic"
# completely?
#
# 0	beshort		200		hp200 (68010) BSD binary
# 0	beshort		300		hp300 (68020+68881) BSD binary
# 0	beshort		0x20c		hp200/300 HP-UX binary
# 0	beshort		0x20d		hp400 (68030) HP-UX binary
# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
# 0	beshort		0x210		PA-RISC1.1 HP-UX binary
# 0	beshort		0x211		PA-RISC1.2 HP-UX binary
# 0	beshort		0x214		PA-RISC2.0 HP-UX binary

#
# The "misc" stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0	beshort		0627		Apollo m68k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0	beshort		0624		apollo a88k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0       long            01203604016     TML 0123 byte-order format
0       long            01702407010     TML 1032 byte-order format
0       long            01003405017     TML 2301 byte-order format
0       long            01602007412     TML 3210 byte-order format
#### PA-RISC 1.1
0	belong 		0x02100106	PA-RISC1.1 relocatable object
0	belong 		0x02100107	PA-RISC1.1 executable
>168	belong		&=0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x02100108	PA-RISC1.1 shared executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x0210010b	PA-RISC1.1 demand-load executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x0210010e	PA-RISC1.1 shared library
>96	belong		>0		- not stripped

0	belong 		0x0210010d	PA-RISC1.1 dynamic load library
>96	belong		>0		- not stripped

#### PA-RISC 2.0
0	belong		0x02140106	PA-RISC2.0 relocatable object

0       belong		0x02140107	PA-RISC2.0 executable
>168	belong		&=0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0       belong		0x02140108	PA-RISC2.0 shared executable
>168	belong		&=0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0       belong		0x0214010b	PA-RISC2.0 demand-load executable
>168	belong		&=0x00000004	dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0       belong		0x0214010e	PA-RISC2.0 shared library
>96	belong		>0		- not stripped

0       belong		0x0214010d	PA-RISC2.0 dynamic load library
>96	belong		>0		- not stripped

#### 800
0	belong 		0x020b0106	PA-RISC1.0 relocatable object

0	belong 		0x020b0107	PA-RISC1.0 executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b0108	PA-RISC1.0 shared executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b010b	PA-RISC1.0 demand-load executable
>168	belong&0x4	0x4		dynamically linked
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		- not stripped

0	belong 		0x020b010e	PA-RISC1.0 shared library
>96	belong		>0		- not stripped

0	belong 		0x020b010d	PA-RISC1.0 dynamic load library
>96	belong		>0		- not stripped

0	belong		0x213c6172	archive file
>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
>68	belong 		0x02140619	- PA-RISC2.0 relocatable library

#### 500
0	long		0x02080106	HP s500 relocatable executable
>16	long		>0		- version %ld

0	long		0x02080107	HP s500 executable
>16	long		>0		- version %ld

0	long		0x02080108	HP s500 pure executable
>16	long		>0		- version %ld

#### 200
0	belong 		0x020c0108	HP s200 pure executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0107	HP s200 executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c010b	HP s200 demand-load executable
>4	beshort		>0		- version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0106	HP s200 relocatable executable
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>8	belong		&0x80000000	save fp regs
>8	belong		&0x20000000	debuggable
>8	belong		&0x10000000	PIC

0	belong 		0x020a0108	HP s200 (2.x release) pure executable
>4	beshort		>0		- version %ld
>36	belong		>0		not stripped

0	belong		0x020a0107	HP s200 (2.x release) executable
>4	beshort		>0		- version %ld
>36	belong		>0		not stripped

0	belong		0x020c010e	HP s200 shared library
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>36	belong		>0		not stripped

0	belong		0x020c010d	HP s200 dynamic load library
>4	beshort		>0		- version %ld
>6	beshort		>0		- highwater %d
>36	belong		>0		not stripped

#### MISC
0	long		0x0000ff65	HP old archive
0	long		0x020aff65	HP s200 old archive
0	long		0x020cff65	HP s200 old archive
0	long		0x0208ff65	HP s500 old archive

0	long		0x015821a6	HP core file

0	long		0x4da7eee8	HP-WINDOWS font
>8	byte		>0		- version %ld
0	string		Bitmapfile	HP Bitmapfile

0	string		IMGfile	CIS 	compimg HP Bitmapfile
# XXX - see "lif"
#0	short		0x8000		lif file
0	long		0x020c010c	compiled Lisp

0	string		msgcat01	HP NLS message catalog,
>8	long		>0		%d messages

# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
0	string		HPHP48-		HP48 binary
>7	byte		>0		- Rev %c
>8	short		0x1129		(ADR)
>8	short		0x3329		(REAL)
>8	short		0x5529		(LREAL)
>8	short		0x7729		(COMPLX)
>8	short		0x9d29		(LCOMPLX)
>8	short		0xbf29		(CHAR)
>8	short		0xe829		(ARRAY)
>8	short		0x0a2a		(LNKARRAY)
>8	short		0x2c2a		(STRING)
>8	short		0x4e2a		(HXS)
>8	short		0x742a		(LIST)
>8	short		0x962a		(DIR)
>8	short		0xb82a		(ALG)
>8	short		0xda2a		(UNIT)
>8	short		0xfc2a		(TAGGED)
>8	short		0x1e2b		(GROB)
>8	short		0x402b		(LIB)
>8	short		0x622b		(BACKUP)
>8	short		0x882b		(LIBDATA)
>8	short		0x9d2d		(PROG)
>8	short		0xcc2d		(CODE)
>8	short		0x482e		(GNAME)
>8	short		0x6d2e		(LNAME)
>8	short		0x922e		(XLIB)
0	string		%%HP:		HP48 text
>6	string		T(0)		- T(0)
>6	string		T(1)		- T(1)
>6	string		T(2)		- T(2)
>6	string		T(3)		- T(3)
>10	string		A(D)		A(D)
>10	string		A(R)		A(R)
>10	string		A(G)		A(G)
>14	string		F(.)		F(.);
>14	string		F(,)		F(,);

# hpBSD magic numbers
0	beshort		200		hp200 (68010) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary
0	beshort		300		hp300 (68020+68881) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary

#------------------------------------------------------------------------------
# ibm370:  file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
# AIX 4.1's "/etc/magic" has
#
#	0	short		0535		370 sysV executable 
#	>12	long		>0		not stripped
#	>22	short		>0		- version %d
#	>30	long		>0		- 5.2 format
#	0	short		0530		370 sysV pure executable 
#	>12	long		>0		not stripped
#	>22	short		>0		- version %d
#	>30	long		>0		- 5.2 format
#
# instead of the "USS/370" versions of the same magic numbers.
#
0	beshort		0537		370 XA sysV executable 
>12	belong		>0		not stripped
>22	beshort		>0		- version %d
>30	belong		>0		- 5.2 format
0	beshort		0532		370 XA sysV pure executable 
>12	belong		>0		not stripped
>22	beshort		>0		- version %d
>30	belong		>0		- 5.2 format
0	beshort		054001		370 sysV pure executable
>12	belong		>0		not stripped
0	beshort		055001		370 XA sysV pure executable
>12	belong		>0		not stripped
0	beshort		056401		370 sysV executable
>12	belong		>0		not stripped
0	beshort		057401		370 XA sysV executable
>12	belong		>0		not stripped
0       beshort		0531		SVR2 executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24     belong		>0		- version %ld
0	beshort		0534		SVR2 pure executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0530		SVR2 pure executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0535		SVR2 executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld

#------------------------------------------------------------------------------
# ibm6000:  file(1) magic for RS/6000 and the RT PC.
#
0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
>12	belong		>0		not stripped
# Breaks sun4 statically linked execs.
#0      beshort		0x0103		executable (RT Version 2) or obj module
#>2	byte		0x50		pure
#>28	belong		>0		not stripped
#>6	beshort		>0		- version %ld
0	beshort		0x0104		shared library
0	beshort		0x0105		ctab data
0	beshort		0xfe04		structured file
0	string		0xabcdef	AIX message catalog
0	belong		0x000001f9	AIX compiled message catalog
0	string		\<aiaff>	archive

#------------------------------------------------------------------------------
# iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
#
# Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
# Arts for file interchange.  It has also been used by Apple, SGI, and
# especially Commodore-Amiga.
#
# IFF files begin with an 8 byte FORM header, followed by a 4 character
# FORM type, which is followed by the first chunk in the FORM.

0	string		FORM		IFF data
#>4	belong		x		\b, FORM is %d bytes long
# audio formats
>8	string		AIFF		\b, AIFF audio
>8	string		AIFC		\b, AIFF-C compressed audio
>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
>8	string		SAMP		\b, SAMP sampled audio
# image formats
>8	string		ILBMBMHD	\b, ILBM interleaved image
>>20	beshort		x		\b, %d x
>>22	beshort		x		%d
>8	string		RGBN		\b, RGBN 12-bit RGB image
>8	string		RGB8		\b, RGB8 24-bit RGB image
>8	string		DR2D		\b, DR2D 2-D object
>8	string		TDDD		\b, TDDD 3-D rendering
# other formats
>8	string		FTXT		\b, FTXT formatted text

#------------------------------------------------------------------------------
# images:  file(1) magic for image formats (see also "iff")
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# little magic: PCX (first byte is 0x0a)
# no magic: Targa

# PBMPLUS images
# The next byte following the magic is always whitespace.
0	string		P1		PBM image text
0	string		P2		PGM image text
0	string		P3		PPM image text
0	string		P4		PBM "rawbits" image data
0	string		P5		PGM "rawbits" image data
0	string		P6		PPM "rawbits" image data

# NIFF (Navy Interchange File Format, a modification of TIFF) images
0	string		IIN1		NIFF image data

# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
# The second word of TIFF files is the TIFF version number, 42, which has
# never changed.  The TIFF specification recommends testing for it.
0	string		MM\x00\x2a	TIFF image data, big-endian
0	string		II\x2a\x00	TIFF image data, little-endian

# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt@uchicago.edu)
# (Albert Cahalan, acahalan@cs.uml.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
#
0	string		\x89PNG		PNG image data,
>4	belong		!0x0d0a1a0a	CORRUPTED,
>4	belong		0x0d0a1a0a
>>16	belong		x		%ld x
>>20	belong		x		%ld,
>>24	byte		x		%d-bit
>>25	byte		0		grayscale,
>>25	byte		2		\b/color RGB,
>>25	byte		3		colormap,
>>25	byte		4		gray+alpha,
>>25	byte		6		\b/color RGBA,
#>>26	byte		0		deflate/32K,
>>28	byte		0		non-interlaced
>>28	byte		1		interlaced
1	string		PNG		PNG image data, CORRUPTED

# GIF
0	string		GIF8		GIF image data
>4	string		7a		\b, version 8%s,
>4	string		9a		\b, version 8%s,
>6	leshort		>0		%hd x
>8	leshort		>0		%hd,
#>10	byte		&0x80		color mapped,
#>10	byte&0x07	=0x00		2 colors
#>10	byte&0x07	=0x01		4 colors
#>10	byte&0x07	=0x02		8 colors
#>10	byte&0x07	=0x03		16 colors
#>10	byte&0x07	=0x04		32 colors
#>10	byte&0x07	=0x05		64 colors
#>10	byte&0x07	=0x06		128 colors
#>10	byte&0x07	=0x07		256 colors

# ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
# 1 plane, no encoding.
0	string		\361\0\100\273	CMU window manager raster image data
>4	lelong		>0		%d x
>8	lelong		>0		%d,
>12	lelong		>0		%d-bit

# Magick Image File Format
0	string		id=ImageMagick	MIFF image data

# Artisan
0	long		1123028772	Artisan image data
>4	long		1		\b, rectangular 24-bit
>4	long		2		\b, rectangular 8-bit with colormap
>4	long		3		\b, rectangular 32-bit (24-bit with matte)

# FIG (Facility for Interactive Generation of figures), an object-based format
0	string		#FIG		FIG image text
>5	string		x		\b, version %.3s

# PHIGS
0	string		ARF_BEGARF		PHIGS clear text archive
0	string		@(#)SunPHIGS		SunPHIGS
# version number follows, in the form m.n
>40	string		SunBin			binary
>32	string		archive			archive

# GKS (Graphics Kernel System)
0	string		GKSM		GKS Metafile
>24	string		SunGKS		\b, SunGKS

# CGM image files
0	string		BEGMF		clear text Computer Graphics Metafile
# XXX - questionable magic
0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
0	beshort		0x3020		character Computer Graphics Metafile

# MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
0	string	yz	MGR bitmap, modern format, 8-bit aligned
0	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
0	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
0	string	yx	MGR bitmap, modern format, squeezed

# Fuzzy Bitmap (FBM) images
0	string		%bitmap\0	FBM image data
>30	long		0x31		\b, mono
>30	long		0x33		\b, color

# facsimile data
1	string		PC\ Research,\ Inc	group 3 fax data
>29	byte		0		\b, normal resolution (204x98 DPI)
>29	byte		1		\b, fine resolution (204x196 DPI)

# JPEG images
# SunOS 5.5.1 had
#
#	0	string		\377\330\377\340	JPEG file
#	0	string		\377\330\377\356	JPG file
#
# both of which turn into "JPEG image data" here.
#
0	beshort		0xffd8		JPEG image data
>6	string		JFIF		\b, JFIF standard
# HSI is Handmade Software's proprietary JPEG encoding scheme
0	string		hsi1		JPEG image data, HSI proprietary

# PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
0	string		BM		PC bitmap data
>14	leshort		12		\b, OS/2 1.x format
>>18	leshort		x		\b, %d x
>>20	leshort		x		%d
>14	leshort		64		\b, OS/2 2.x format
>>18	leshort		x		\b, %d x
>>20	leshort		x		%d
>14	leshort		40		\b, Windows 3.x format
>>18	lelong		x		\b, %d x
>>22	lelong		x		%d x
>>28	leshort		x		%d
0	string		IC		PC icon data
0	string		PI		PC pointer image data
0	string		CI		PC color icon data
0	string		CP		PC color pointer image data
# Conflicts with other entries [BABYL]
#0	string		BA		PC bitmap array data

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# note possible collision with C/REXX entry in c-lang; currently commented out
0	string		/*\ XPM\ */	X pixmap image text

# Utah Raster Toolkit RLE images (janl@ifi.uio.no)
0	leshort		0xcc52		RLE image data,
>6	leshort		x		%d x
>8	leshort		x		%d
>2	leshort		>0		\b, lower left corner: %d
>4	leshort		>0		\b, lower right corner: %d
>10	byte&0x1	=0x1		\b, clear first
>10	byte&0x2	=0x2		\b, no background
>10	byte&0x4	=0x4		\b, alpha channel
>10	byte&0x8	=0x8		\b, comment
>11	byte		>0		\b, %d color channels
>12	byte		>0		\b, %d [4-b old stack-based machines, running a
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
# HP magic is useful for reference, but using "long" magic is a better
# practice in order to avoid collisions.
#
# Guy Harris (guy@netapp.com): some additions to this list came from
# HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
# 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
# "/etc/magic", though, except for the "archive file relocatable library"
# stuff, and the 68030 and 68040 stuff isn't there at all - are they not
# used in executables, or have they just not yet updated "/etc/magic"
# completely?
#
# 0	beshort		200		hp200 (68010) BSD binary
# 0	beshort		300		hp300 (68020+68881) BSD binary
# 0	beshort		0x20c		hp200/300 HP-UX binary
# 0	beshort		0x20d		hp400 (68030) HP-UX binary
# 0	beshort		0x20e		hp400 (68040?) HP-UX binary
# 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
# 0	beshort		0x210		PA-RISC1.1 HP-UX bin                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 