diff --git a/CHANGES b/CHANGES index a10af93d93..a1173284c7 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,150 @@ +3.2.0-dev.473 | 2020-05-06 10:40:09 -0700 + + * Revert addition of final modifier to JSON formatter (Tim Wojtulewicz, Corelight) + +3.2.0-dev.471 | 2020-05-06 10:00:58 -0700 + + * Fix global buffer over-read in POP3 analyzer (Justin Azoff, Corelight) + + * Fix SSL scripting error leading to access of unitialized field (Jon Siwek, Corelight) + + Reported by Justin Azoff + + * Remove outdated comment on set_to_regex. (Johanna Amann, Corelight) + + We can add patterns at runtime since 2.6. + +3.2.0-dev.467 | 2020-05-04 18:00:35 -0700 + + * GH-952: Correct spelling of DCE/RPC operation string NetrLogonSameLogonWithFlags + (Jon Siwek, Corelight) + +3.2.0-dev.466 | 2020-05-04 17:50:14 -0700 + + * Add network_time_init() event. (Jan Grashoefer) + + This event is generated upon first initialization of network_time. + +3.2.0-dev.461 | 2020-05-04 17:08:46 -0700 + + * Avoid scheduling multiple inactivity timers (Justin Azoff and Jon Siwek, Corelight) + + Also updated language.expire_subnet btest which is unduly sensitive to + timer-related changes + +3.2.0-dev.459 | 2020-05-01 17:46:20 -0700 + + * Extend CI config to cover building with libmaxminddb support (Jon Siwek, Corelight) + + * Ensure time continues moving forward if a pcap source is suspended (Tim Wojtulewicz, Corelight) + +3.2.0-dev.455 | 2020-05-01 09:44:30 -0700 + + * GH-938: fix IO loop iterations sometimes skipping offline pcap sources (Jon Siwek, Corelight) + +3.2.0-dev.451 | 2020-04-29 16:28:34 -0700 + + * Organized and added to the shipped file identification signatures. (Seth Hall, Corelight) + + - Added ISO 9660 disk image + + - Created new files for categorizing signatures better. + - executable.sig - Executable (and bytecode) files. + - java.sig - Java related files (class/jar, etc). + - programming.sig - Mostly scripting language identification + +3.2.0-dev.447 | 2020-04-29 15:55:03 -0700 + + * GH-713: Fixed misc/stats.zeek skipping a log entry on termination (Brittany Donowho) + +3.2.0-dev.445 | 2020-04-29 15:25:03 -0700 + + * Add warning message for unknown Broker statuses (Jon Siwek, Corelight) + + There's now a couple placeholder/unimplemented status values in Broker + related to upcoming routing features that we don't want to handle + explicitly for compatibility reasons, but also don't want the compiler + warning about unhandled values in the switch. + +3.2.0-dev.443 | 2020-04-28 17:10:38 -0700 + + * GH-941: Fix build when configured to use libmaxminddb (Jon Siwek, Corelight) + +3.2.0-dev.441 | 2020-04-27 13:34:22 -0700 + + * Fix a few more IntrusivePtr deprecation warnings (Tim Wojtulewicz, Corelight) + + * Fix cloning of TypeType values (Vern Paxson, Corelight) + +3.2.0-dev.437 | 2020-04-27 19:30:24 +0000 + + * GH-854: provide access to original HTTP/MIME header names + + The "http_header" event now has an "original_name" parameter that allows + access to the original header name (the "name" parameter reamins the + same as before: it's the uppercased header name). + + The "mime_header_rec" record type now also includes an "original_name" + field to similarly provide access to original header name in the + following events: "http_all_headers", "mime_one_header", and + "mime_all_headers". (Jon Siwek, Corelight) + + * Remove error message from empty bloomfilter lookups + + If a bloomfilter doesn't have a type, that just means no + bloomfilter_add() has been called yet, so seems undesirable to emit an + error for a lookup against something that's known to be empty. (Jon Siwek, Corelight) + + * unused variables found via use-def analysis (plus an indentation micro-nit) (Vern Paxson, Corelight) + +3.2.0-dev.431 | 2020-04-27 12:09:30 -0700 + + * Update various BIFs to return IntrusivePtr (Jon Siwek, Corelight) + +3.2.0-dev.428 | 2020-04-24 16:19:45 -0700 + + * Deprecate returning Val* from BIFs (Jon Siwek, Corelight) + + * Deprecate binpac::string_to_val (Jon Siwek, Corelight) + + * Deprecate binpac::bytestring_to_val, replace with binpac::to_stringval (Jon Siwek, Corelight) + + * Update deprecated BifEvent::generate_* usages (Jon Siwek, Corelight) + + * Deprecate Connection::Event and Analyzer::Event methods + + And update usages to the "EnqueueEvent" methods. (Jon Siwek, Corelight) + + * Deprecate BuildConnVal() methods and update usages to ConnVal() + + The later being a new method that returns IntrusivePtr (Jon Siwek, Corelight) + + * Update all BIFs to return IntrusivePtr instead of Val* (Jon Siwek, Corelight) + + * Update deprecated ValManager::GetPort usages (Jon Siwek, Corelight) + + * Update deprecated ValManager::GetEmptyString usages (Jon Siwek, Corelight) + + * Update deprecated ValManager::GetCount usages (Jon Siwek, Corelight) + + * Update deprecated ValManager::GetInt usages (Jon Siwek, Corelight) + + * Update deprecated ValManager::GetBool usages (Jon Siwek, Corelight) + + * Update deprecated ValManager GetTrue/GetFalse usages (Jon Siwek, Corelight) + + * Deprecate all ValManager "Get" methods + + Alternate methods that return IntrusivePtr are available in similarly + named methods that omit the "Get" prefix. (Jon Siwek, Corelight) + + * Change BIFs to return a wrapper object + + That allows returning either Val* or IntrusivePtr. The former could + eventually be deprecated, but it's used extensively at the moment. (Jon Siwek, Corelight) + + 3.2.0-dev.412 | 2020-04-22 10:43:39 -0700 * Fix buffer over-read in Ident analyzer (Max Kellermann) diff --git a/NEWS b/NEWS index 90768d0d52..b394d78d7f 100644 --- a/NEWS +++ b/NEWS @@ -37,6 +37,10 @@ New Functionality and ``udp_content_delivery_ports_orig`` options is determined. The current value keeps behavior as it was in previous versions of Zeek. +- Add a file signature to identify ISO9660 disk images (application/x-iso9660-image) + +- Add file signature to identify Python bytecode (application/x-python-bytecode) + Changed Functionality --------------------- @@ -76,6 +80,12 @@ Changed Functionality raise this event (injecting connections via broccoli) was removed a while ago; the event handler served no purpose anymore. +- Reorganize the file signatures to break them out into more groups. This may + break scripts that had been explicitly loading any signature files that moved. + +- The DCE/RPC operation string of "NetrLogonSamLogonWithFlags" has been + corrected from "NetrLogonSameLogonWithFlags". + Removed Functionality --------------------- @@ -96,7 +106,7 @@ Deprecated Functionality - The ``EventMgr::QueueEvent()`` and EventMgr::QueueEventFast()`` methods are now deprecated, use ``EventMgr::Enqueue()`` instead. -- The ``Connection::ConnectionEvent()`` and +- The ``Connection::ConnectionEvent()``, ``Connection::Event()``, and ``Connection::ConnectionEventFast()`` methods are now deprecated, use ``Connection::EnqueueEvent()`` instead. @@ -104,10 +114,25 @@ Deprecated Functionality arguments are now deprecated, use the overload that takes a ``zeek::Args`` instead. -- The ``analyzer::Analyzer::ConnectionEvent()`` and - ``analyzer::Analyzer::ConectionEventFast()`` methods are deprecated, use +- The ``analyzer::Analyzer::ConnectionEvent()``, ``analyzer::Analyzer::Event``, + and ``analyzer::Analyzer::ConectionEventFast()`` methods are deprecated, use ``analyzer::Analyzer::EnqueueConnEvent()`` instead. +- All ``val_mgr`` methods starting with "Get" are deprecated, use the new + ``val_mgr`` methods that return ``IntrusivePtr``. + +- ``Connection::BuildConnVal()`` is deprecated, use ``Connection::ConnVal()``. + +- ``Analyzer::BuildConnVal()`` is deprecated, use ``Analyzer::ConnVal()``. + +- ``BifEvent::generate_`` functions are deprecated, use ``BifEvent::enqueue_``. + +- ``binpac::bytestring_to_val()`` is deprecated, use ``binpac::to_stringval()``. + +- ``binpac::string_to_val()`` is deprecated, use ``StringVal`` constructor. + +- Returning ``Val*`` from BIFs is deprecated, return ``IntrusivePtr`` instead. + Zeek 3.1.0 ========== diff --git a/VERSION b/VERSION index 8ecb428994..c039298b41 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.2.0-dev.412 +3.2.0-dev.473 diff --git a/aux/bifcl b/aux/bifcl index 66b4b30305..e17abfe8cd 160000 --- a/aux/bifcl +++ b/aux/bifcl @@ -1 +1 @@ -Subproject commit 66b4b30305237f48535276a00a52ca304659400b +Subproject commit e17abfe8cd478fe90500a44c2081f4f97aade897 diff --git a/aux/binpac b/aux/binpac index 60681f1a7d..e1de4da6b3 160000 --- a/aux/binpac +++ b/aux/binpac @@ -1 +1 @@ -Subproject commit 60681f1a7dca89f71c4f4ca4f7424bf0484f4ee0 +Subproject commit e1de4da6b3aee300d0a034ef90d59b7adc3efe34 diff --git a/aux/broker b/aux/broker index 6ea6728218..8b2c9a9e1e 160000 --- a/aux/broker +++ b/aux/broker @@ -1 +1 @@ -Subproject commit 6ea6728218085732ebea5044fdce5b0bf5b052c5 +Subproject commit 8b2c9a9e1e67d145af442fa2175dcb18b643a317 diff --git a/aux/btest b/aux/btest index 87896050d7..0528e8bc8e 160000 --- a/aux/btest +++ b/aux/btest @@ -1 +1 @@ -Subproject commit 87896050d7ac189f0e063bb90c3fa37a6c977f83 +Subproject commit 0528e8bc8e6e0108ec2f752896b2aa8b5dd949dd diff --git a/aux/zeek-aux b/aux/zeek-aux index a98acb8f80..be04ea0e7b 160000 --- a/aux/zeek-aux +++ b/aux/zeek-aux @@ -1 +1 @@ -Subproject commit a98acb8f80390bbb89f33df483eac8f6b4b6e05d +Subproject commit be04ea0e7b2b265d65b1fac5b644ce646603bdf2 diff --git a/aux/zeekctl b/aux/zeekctl index 7e65a34905..1f6290b2b0 160000 --- a/aux/zeekctl +++ b/aux/zeekctl @@ -1 +1 @@ -Subproject commit 7e65a34905ec9684c442da5f737fe75beb94aae6 +Subproject commit 1f6290b2b05af07034354ea7621a99f708081fae diff --git a/ci/ubuntu-18.04/Dockerfile b/ci/ubuntu-18.04/Dockerfile index 64b84692d2..8aaf38701d 100644 --- a/ci/ubuntu-18.04/Dockerfile +++ b/ci/ubuntu-18.04/Dockerfile @@ -15,6 +15,7 @@ RUN apt-get update && apt-get -y install \ python3-pip\ swig \ zlib1g-dev \ + libmaxminddb-dev \ libkrb5-dev \ bsdmainutils \ sqlite3 \ diff --git a/cmake b/cmake index 861e37c504..d85153d8e0 160000 --- a/cmake +++ b/cmake @@ -1 +1 @@ -Subproject commit 861e37c50410b37d08687a691d5868bfff9694dd +Subproject commit d85153d8e0e62fbd6f1125c498b2741f4bc987dc diff --git a/doc b/doc index 7b59ef1ab8..850c5bea87 160000 --- a/doc +++ b/doc @@ -1 +1 @@ -Subproject commit 7b59ef1ab823a77dff78991b6a8808be5ba9072d +Subproject commit 850c5bea8787c315cddc9079a29a17d89db055ec diff --git a/scripts/base/frameworks/cluster/setup-connections.zeek b/scripts/base/frameworks/cluster/setup-connections.zeek index 9e9374c8b9..2abd57b142 100644 --- a/scripts/base/frameworks/cluster/setup-connections.zeek +++ b/scripts/base/frameworks/cluster/setup-connections.zeek @@ -28,7 +28,6 @@ function connect_peer(node_type: NodeType, node_name: string) function connect_peers_with_type(node_type: NodeType) { - local rval: vector of NamedNode = vector(); local nn = nodes_with_type(node_type); for ( i in nn ) diff --git a/scripts/base/frameworks/files/magic/__load__.zeek b/scripts/base/frameworks/files/magic/__load__.zeek index 34115f0a55..cb39d21d9d 100644 --- a/scripts/base/frameworks/files/magic/__load__.zeek +++ b/scripts/base/frameworks/files/magic/__load__.zeek @@ -1,9 +1,12 @@ @load-sigs ./archive @load-sigs ./audio +@load-sigs ./executable @load-sigs ./font @load-sigs ./general @load-sigs ./image -@load-sigs ./msoffice +@load-sigs ./java +@load-sigs ./office +@load-sigs ./programming @load-sigs ./video -@load-sigs ./libmagic \ No newline at end of file +@load-sigs ./libmagic diff --git a/scripts/base/frameworks/files/magic/archive.sig b/scripts/base/frameworks/files/magic/archive.sig index 2e4336a2ca..de21411eb3 100644 --- a/scripts/base/frameworks/files/magic/archive.sig +++ b/scripts/base/frameworks/files/magic/archive.sig @@ -49,11 +49,17 @@ signature file-xar { } # RPM -signature file-magic-auto352 { +signature file-rpm { file-mime "application/x-rpm", 70 file-magic /^(drpm|\xed\xab\xee\xdb)/ } +# Debian Binary Package +signature file-deb { + file-mime "application/x-debian-package", 171 + file-magic /\x21\x3carch\x3e\x0adebian/ +} + # StuffIt signature file-stuffit { file-mime "application/x-stuffit", 70 @@ -179,3 +185,9 @@ signature file-ace-archive { file-mime "application/x-ace", 100 file-magic /^.{7}\*\*ACE\*\*/ } + +# Bzip2 archive file. +signature file-bzip2 { + file-mime "application/x-bzip2", 60 + file-magic /^BZh/ +} diff --git a/scripts/base/frameworks/files/magic/executable.sig b/scripts/base/frameworks/files/magic/executable.sig new file mode 100644 index 0000000000..b1dae5db8b --- /dev/null +++ b/scripts/base/frameworks/files/magic/executable.sig @@ -0,0 +1,106 @@ +# Portable Executable +signature file-pe { + file-mime "application/x-dosexec", 51 + file-magic /MZ/ +} + +signature file-elf-object { + file-mime "application/x-object", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x01\x00|\x02.{10}\x00\x01)/ +} + +signature file-elf { + file-mime "application/x-executable", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x02\x00|\x02.{10}\x00\x02)/ +} + +signature file-elf-sharedlib { + file-mime "application/x-sharedlib", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x03\x00|\x02.{10}\x00\x03)/ +} + +signature file-elf-coredump { + file-mime "application/x-coredump", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x04\x00|\x02.{10}\x00\x04)/ +} + +# Mac OS X Mach-O executable +signature file-mach-o { + file-magic /^[\xce\xcf]\xfa\xed\xfe/ + file-mime "application/x-mach-o-executable", 100 +} + +# Mac OS X Universal Mach-O executable +signature file-mach-o-universal { + file-magic /^\xca\xfe\xba\xbe..\x00[\x01-\x14]/ + file-mime "application/x-mach-o-executable", 100 +} + +# Emacs/XEmacs byte-compiled Lisp +signature file-elc { + file-mime "application/x-elc", 10 + file-magic /\x3bELC[\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff]/ +} + +# Python 1 bytecode +signature file-pyc-1 { + file-magic /^(\xfc\xc4|\x99\x4e)\x0d\x0a/ + file-mime "application/x-python-bytecode", 80 +} + +# Python 2 bytecode +signature file-pyc-2 { + file-magic /^(\x87\xc6|[\x2a\x2d]\xed|[\x3b\x45\x59\x63\x6d\x77\x81\x8b\x8c\x95\x9f\xa9\xb3\xc7\xd1\xdb\xe5\xef\xf9]\xf2|\x03\xf3)\x0d\x0a/ + file-mime "application/x-python-bytecode", 80 +} + +# Python 3.0 bytecode +signature file-pyc-3-0 { + file-magic /^([\xb8\xc2\xcc\xd6\xe0\xea\xf4\xf5\xff]\x0b|[\x09\x13\x1d\x1f\x27\x3b]\x0c)\x0d\x0a/ + file-mime "application/x-python-bytecode", 80 +} + + +# Python 3.1 bytecode +signature file-pyc-3-1 { + file-magic /^[\x45\x4f]\x0c\x0d\x0a/ + file-mime "application/x-python-bytecode", 80 +} + + +# Python 3.2 bytecode +signature file-pyc-3-2 { + file-magic /^[\x58\x62\x6c]\x0c\x0d\x0a/ + file-mime "application/x-python-bytecode", 80 +} + +# Python 3.3 bytecode +signature file-pyc-3-3 { + file-magic /^[\x76\x80\x94\x9e]\x0c\x0d\x0a/ + file-mime "application/x-python-bytecode", 80 +} + + +# Python 3.4 bytecode +signature file-pyc-3-4 { + file-magic /^[\xb2\xcc\xc6\xd0\xda\xe4\xee]\x0c\x0d\x0a/ + file-mime "application/x-python-bytecode", 80 +} + +# Python 3.5 bytecode +signature file-pyc-3-5 { + file-magic /^(\xf8\x0c|[\x02\x0c\x16\x17]\x0d)\x0d\x0a/ + file-mime "application/x-python-bytecode", 80 +} + +# Python 3.6 bytecode +signature file-pyc-3-6 { + file-magic /^[\x20\x21\x2a-\x2d\x2f-\x33]\x0d\x0d\x0a/ + file-mime "application/x-python-bytecode", 80 +} + +# Python 3.7 bytecode +signature file-pyc-3-7 { + file-magic /^[\x3e-\x42]\x0d\x0d\x0a/ + file-mime "application/x-python-bytecode", 80 +} diff --git a/scripts/base/frameworks/files/magic/general.sig b/scripts/base/frameworks/files/magic/general.sig index 6494a2ca54..d34c3d043d 100644 --- a/scripts/base/frameworks/files/magic/general.sig +++ b/scripts/base/frameworks/files/magic/general.sig @@ -131,16 +131,6 @@ signature file-afpinfo { file-magic /^AFP/ } -signature file-jar { - file-mime "application/java-archive", 100 - file-magic /^PK\x03\x04.{1,200}\x14\x00..META-INF\/MANIFEST\.MF/ -} - -signature file-java-applet { - file-mime "application/x-java-applet", 71 - file-magic /^\xca\xfe\xba\xbe...[\x2d-\x34]/ -} - # OCSP requests over HTTP. signature file-ocsp-request { file-magic /^.{11,19}\x06\x05\x2b\x0e\x03\x02\x1a/ @@ -165,18 +155,6 @@ signature file-tnef { file-mime "application/vnd.ms-tnef", 100 } -# Mac OS X Mach-O executable -signature file-mach-o { - file-magic /^[\xce\xcf]\xfa\xed\xfe/ - file-mime "application/x-mach-o-executable", 100 -} - -# Mac OS X Universal Mach-O executable -signature file-mach-o-universal { - file-magic /^\xca\xfe\xba\xbe..\x00[\x01-\x14]/ - file-mime "application/x-mach-o-executable", 100 -} - signature file-pkcs7 { file-magic /^MIME-Version:.*protocol=\"application\/pkcs7-signature\"/ file-mime "application/pkcs7-signature", 100 @@ -188,12 +166,6 @@ signature file-pem { file-mime "application/x-pem" } -# Java Web Start file. -signature file-jnlp { - file-magic /^\[\x0d\x0a[:blank:]]*(var|function) / -} - -signature file-php { - file-mime "text/x-php", 60 - file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?php/ -} - -signature file-php2 { - file-magic /^.*<\?php/ - file-mime "text/x-php", 40 -} - # Stereolithography ASCII format signature file-stl-ascii { file-magic /^solid\x20/ @@ -390,26 +286,6 @@ signature file-msqm { file-magic /^MSQM/ } -signature file-elf-object { - file-mime "application/x-object", 50 - file-magic /\x7fELF[\x01\x02](\x01.{10}\x01\x00|\x02.{10}\x00\x01)/ -} - -signature file-elf { - file-mime "application/x-executable", 50 - file-magic /\x7fELF[\x01\x02](\x01.{10}\x02\x00|\x02.{10}\x00\x02)/ -} - -signature file-elf-sharedlib { - file-mime "application/x-sharedlib", 50 - file-magic /\x7fELF[\x01\x02](\x01.{10}\x03\x00|\x02.{10}\x00\x03)/ -} - -signature file-elf-coredump { - file-mime "application/x-coredump", 50 - file-magic /\x7fELF[\x01\x02](\x01.{10}\x04\x00|\x02.{10}\x00\x04)/ -} - signature file-vim-tmp { file-mime "application/x-vim-tmp", 100 file-magic /^b0VIM/ @@ -420,3 +296,10 @@ signature file-windows-minidump { file-mime "application/x-windows-minidump", 50 file-magic /^MDMP/ } + +# ISO 9660 disk image +signature file-iso9660 { + file-mime "application/x-iso9660-image", 99 + file-magic /CD001/ +} + diff --git a/scripts/base/frameworks/files/magic/java.sig b/scripts/base/frameworks/files/magic/java.sig new file mode 100644 index 0000000000..1306ee0c2e --- /dev/null +++ b/scripts/base/frameworks/files/magic/java.sig @@ -0,0 +1,31 @@ +signature file-jar { + file-mime "application/java-archive", 100 + file-magic /^PK\x03\x04.{1,200}\x14\x00..META-INF\/MANIFEST\.MF/ +} + +signature file-java-applet { + file-mime "application/x-java-applet", 71 + file-magic /^\xca\xfe\xba\xbe...[\x2d-\x34]/ +} + +# JAR compressed with pack200 +signature file-jar-pack200 { + file-mime "application/x-java-pack200", 1 + file-magic /^\xca\xfe\xd0\x0d./ +} + +# Java Web Start file. +signature file-jnlp { + file-magic /^\0 string,=!\ndebian (len=14), [""], swap_endian=0 -signature file-magic-auto54 { - file-mime "application/x-debian-package", 171 - file-magic /(\x21\x3carch\x3e\x0adebian)/ -} - # >0 string,=II\032\000\000\000HEAPCCDR (len=14), ["Canon CIFF raw image data"], swap_endian=0 signature file-magic-auto55 { file-mime "image/x-canon-crw", 170 @@ -609,12 +603,6 @@ signature file-magic-auto203 { # file-magic /(.{512})(.{4})(.*)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4])(.{490})([\xff])(.{1037})(\x00\x00\x00\x00\x00\x00\x00\x00)(.*)(.{8})/ #} -# >0 string,=;ELC (len=4), [""], swap_endian=0 -# >>4 byte&,<0x20, ["Emacs/XEmacs v%d byte-compiled Lisp data"], swap_endian=0 -signature file-magic-auto223 { - file-mime "application/x-elc", 10 - file-magic /(\x3bELC)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ -} # >0 string,=PK\003\004 (len=4), [""], swap_endian=0 # >>4 byte&,=0x14, [""], swap_endian=0 @@ -640,174 +628,6 @@ signature file-magic-auto226 { # file-magic /(.{4})(.{7})(.{2})(.*)(.{2})(.*)(.{2})(.{8})([\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])(.*)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf9\xfa\xfb\xfc\xfd\xfe\xff])(.{32})(FAT16)(.{4})/ #} -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=text (len=4), [""], swap_endian=0 -# >>>>>77 byte&,!0x2d, ["Text"], swap_endian=0 -signature file-magic-auto228 { - file-mime "application/vnd.oasis.opendocument.text", 110 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(text)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=text (len=4), [""], swap_endian=0 -# >>>>>77 string,=-template (len=9), ["Text Template"], swap_endian=0 -signature file-magic-auto229 { - file-mime "application/vnd.oasis.opendocument.text-template", 120 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(text)(\x2dtemplate)/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=text (len=4), [""], swap_endian=0 -# >>>>>77 string,=-web (len=4), ["HTML Document Template"], swap_endian=0 -signature file-magic-auto230 { - file-mime "application/vnd.oasis.opendocument.text-web", 70 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(text)(\x2dweb)/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=text (len=4), [""], swap_endian=0 -# >>>>>77 string,=-master (len=7), ["Master Document"], swap_endian=0 -signature file-magic-auto231 { - file-mime "application/vnd.oasis.opendocument.text-master", 100 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(text)(\x2dmaster)/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=graphics (len=8), [""], swap_endian=0 -# >>>>>81 byte&,!0x2d, ["Drawing"], swap_endian=0 -signature file-magic-auto232 { - file-mime "application/vnd.oasis.opendocument.graphics", 110 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(graphics)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=graphics (len=8), [""], swap_endian=0 -# >>>>>81 string,=-template (len=9), ["Template"], swap_endian=0 -signature file-magic-auto233 { - file-mime "application/vnd.oasis.opendocument.graphics-template", 120 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(graphics)(\x2dtemplate)/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=presentation (len=12), [""], swap_endian=0 -# >>>>>85 byte&,!0x2d, ["Presentation"], swap_endian=0 -signature file-magic-auto234 { - file-mime "application/vnd.oasis.opendocument.presentation", 110 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(presentation)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=presentation (len=12), [""], swap_endian=0 -# >>>>>85 string,=-template (len=9), ["Template"], swap_endian=0 -signature file-magic-auto235 { - file-mime "application/vnd.oasis.opendocument.presentation-template", 120 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(presentation)(\x2dtemplate)/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=spreadsheet (len=11), [""], swap_endian=0 -# >>>>>84 byte&,!0x2d, ["Spreadsheet"], swap_endian=0 -signature file-magic-auto236 { - file-mime "application/vnd.oasis.opendocument.spreadsheet", 110 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(spreadsheet)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=spreadsheet (len=11), [""], swap_endian=0 -# >>>>>84 string,=-template (len=9), ["Template"], swap_endian=0 -signature file-magic-auto237 { - file-mime "application/vnd.oasis.opendocument.spreadsheet-template", 120 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(spreadsheet)(\x2dtemplate)/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=chart (len=5), [""], swap_endian=0 -# >>>>>78 byte&,!0x2d, ["Chart"], swap_endian=0 -signature file-magic-auto238 { - file-mime "application/vnd.oasis.opendocument.chart", 110 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(chart)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=chart (len=5), [""], swap_endian=0 -# >>>>>78 string,=-template (len=9), ["Template"], swap_endian=0 -signature file-magic-auto239 { - file-mime "application/vnd.oasis.opendocument.chart-template", 120 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(chart)(\x2dtemplate)/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=formula (len=7), [""], swap_endian=0 -# >>>>>80 byte&,!0x2d, ["Formula"], swap_endian=0 -signature file-magic-auto240 { - file-mime "application/vnd.oasis.opendocument.formula", 1110 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(formula)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=formula (len=7), [""], swap_endian=0 -# >>>>>80 string,=-template (len=9), ["Template"], swap_endian=0 -signature file-magic-auto241 { - file-mime "application/vnd.oasis.opendocument.formula-template", 120 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(formula)(\x2dtemplate)/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=database (len=8), ["Database"], swap_endian=0 -signature file-magic-auto242 { - file-mime "application/vnd.oasis.opendocument.database", 110 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(database)/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=image (len=5), [""], swap_endian=0 -# >>>>>78 byte&,!0x2d, ["Image"], swap_endian=0 -signature file-magic-auto243 { - file-mime "application/vnd.oasis.opendocument.image", 110 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(image)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ -} - -# >0 string,=PK\003\004 (len=4), [""], swap_endian=0 -# >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 -# >>>50 string,=vnd.oasis.opendocument. (len=23), ["OpenDocument"], swap_endian=0 -# >>>>73 string,=image (len=5), [""], swap_endian=0 -# >>>>>78 string,=-template (len=9), ["Template"], swap_endian=0 -signature file-magic-auto244 { - file-mime "application/vnd.oasis.opendocument.image-template", 120 - file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(image)(\x2dtemplate)/ -} # >0 string,=PK\003\004 (len=4), [""], swap_endian=0 # >>26 string,=\b\000\000\000mimetypeapplication/ (len=24), [""], swap_endian=0 @@ -917,18 +737,6 @@ signature file-magic-auto293 { file-magic /(\x0e\x03\x13\x01)/ } -# >0 belong&,=-17957139 (0xfeedfeed), ["Java KeyStore"], swap_endian=0 -signature file-magic-auto302 { - file-mime "application/x-java-keystore", 70 - file-magic /(\xfe\xed\xfe\xed)/ -} - -# >0 belong&,=-825307442 (0xcececece), ["Java JCE KeyStore"], swap_endian=0 -signature file-magic-auto303 { - file-mime "application/x-java-jce-keystore", 70 - file-magic /(\xce\xce\xce\xce)/ -} - ## >1080 string,=32CN (len=4), ["32-channel Taketracker module sound data"], swap_endian=0 #signature file-magic-auto304 { # file-mime "audio/x-mod", 70 @@ -1264,21 +1072,6 @@ signature file-magic-auto385 { file-magic /(OggS)/ } - -# >0 belong&,=-889270259 (0xcafed00d), ["JAR compressed with pack200,"], swap_endian=0 -# >>4 byte&,x, ["%d"], swap_endian=0 -signature file-magic-auto387 { - file-mime "application/x-java-pack200", 1 - file-magic /(\xca\xfe\xd0\x0d)(.{1})/ -} - -# >0 belong&,=-889270259 (0xcafed00d), ["JAR compressed with pack200,"], swap_endian=0 -# >>4 byte&,x, ["%d"], swap_endian=0 -signature file-magic-auto388 { - file-mime "application/x-java-pack200", 1 - file-magic /(\xca\xfe\xd0\x0d)(.{1})/ -} - ## >0 search/4096,=\documentstyle (len=14), ["LaTeX document text"], swap_endian=0 #signature file-magic-auto390 { # file-mime "text/x-tex", 62 @@ -1332,12 +1125,6 @@ signature file-magic-auto405 { file-magic /(\x04\x25\x21)/ } -# >0 string,=BZh (len=3), ["bzip2 compressed data"], swap_endian=0 -signature file-magic-auto406 { - file-mime "application/x-bzip2", 60 - file-magic /(BZh)/ -} - ## >0 search/4096,=\documentclass (len=14), ["LaTeX 2e document text"], swap_endian=0 #signature file-magic-auto412 { # file-mime "text/x-tex", 59 @@ -1380,12 +1167,6 @@ signature file-magic-auto406 { # file-magic /(.*)(\x28custom\x2dset\x2dvariables )/ #} -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -signature file-magic-auto433 { - file-mime "application/x-dosexec", 51 - file-magic /(MZ)/ -} - # >20 string,=45 (len=2), [""], swap_endian=0 # >>0 regex/1,=(^[0-9]{5})[acdnp][^bhlnqsu-z] (len=30), ["MARC21 Bibliographic"], swap_endian=0 signature file-magic-auto460 { @@ -1620,39 +1401,6 @@ signature file-magic-auto532 { # file-magic /(.{4})(.*)([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])(.*)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f])(.*)([\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])(.{26})([\x00])(.*)(.{4})(.*)(.{4})(.*)(.{4})(.{12})([\x00\x01\x02\x03\x04\x05\x06\x07])(.*)(.{2})(.{22})([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ #} -# >0 string/t,=@ (len=1), [""], swap_endian=0 -# >>1 string/Wc,= echo off (len=9), ["DOS batch file text"], swap_endian=0 -signature file-magic-auto573 { - file-mime "text/x-msdos-batch", 120 - file-magic /(\x40)( {1,}[eE][cC][hH][oO] {1,}[oO][fF][fF])/ -} - -# >0 string/t,=@ (len=1), [""], swap_endian=0 -# >>1 string/Wc,=echo off (len=8), ["DOS batch file text"], swap_endian=0 -signature file-magic-auto574 { - file-mime "text/x-msdos-batch", 110 - file-magic /(\x40)([eE][cC][hH][oO] {1,}[oO][fF][fF])/ -} - -# >0 string/t,=@ (len=1), [""], swap_endian=0 -# >>1 string/Wc,=rem (len=3), ["DOS batch file text"], swap_endian=0 -signature file-magic-auto575 { - file-mime "text/x-msdos-batch", 60 - file-magic /(\x40)([rR][eE][mM])/ -} - -# >0 string/t,=@ (len=1), [""], swap_endian=0 -# >>1 string/Wc,=set (len=4), ["DOS batch file text"], swap_endian=0 -signature file-magic-auto576 { - file-mime "text/x-msdos-batch", 70 - file-magic /(\x40)([sS][eE][tT] {1,})/ -} - -# >0 regex,=^dnl (len=5), ["M4 macro processor script text"], swap_endian=0 -signature file-magic-auto578 { - file-mime "text/x-m4", 40 - file-magic /(^dnl )/ -} ## >0 search/4096,=(defparam (len=10), ["Lisp/Scheme program text"], swap_endian=0 #signature file-magic-auto583 { diff --git a/scripts/base/frameworks/files/magic/msoffice.sig b/scripts/base/frameworks/files/magic/msoffice.sig deleted file mode 100644 index 1c979b62bd..0000000000 --- a/scripts/base/frameworks/files/magic/msoffice.sig +++ /dev/null @@ -1,34 +0,0 @@ - -# This signature is non-specific and terrible but after -# searching for a long time there doesn't seem to be a -# better option. -signature file-msword { - file-magic /^\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1/ - file-mime "application/msword", 50 -} - -signature file-ooxml { - file-magic /^PK\x03\x04\x14\x00\x06\x00/ - file-mime "application/vnd.openxmlformats-officedocument", 50 -} - -signature file-docx { - file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|word\x2f).*PK\x03\x04.{26}word\x2f/ - file-mime "application/vnd.openxmlformats-officedocument.wordprocessingml.document", 80 -} - -signature file-xlsx { - file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|xl\x2f).*PK\x03\x04.{26}xl\x2f/ - file-mime "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", 80 -} - -signature file-pptx { - file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|ppt\x2f).*PK\x03\x04.{26}ppt\x2f/ - file-mime "application/vnd.openxmlformats-officedocument.presentationml.presentation", 80 -} - -signature file-msaccess { - file-mime "application/x-msaccess", 180 - file-magic /.{4}Standard (Jet|ACE) DB\x00/ -} - diff --git a/scripts/base/frameworks/files/magic/office.sig b/scripts/base/frameworks/files/magic/office.sig new file mode 100644 index 0000000000..3b3a264c24 --- /dev/null +++ b/scripts/base/frameworks/files/magic/office.sig @@ -0,0 +1,118 @@ + +# This signature is non-specific and terrible but after +# searching for a long time there doesn't seem to be a +# better option. +signature file-msword { + file-magic /^\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1/ + file-mime "application/msword", 50 +} + +signature file-ooxml { + file-magic /^PK\x03\x04\x14\x00\x06\x00/ + file-mime "application/vnd.openxmlformats-officedocument", 50 +} + +signature file-docx { + file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|word\x2f).*PK\x03\x04.{26}word\x2f/ + file-mime "application/vnd.openxmlformats-officedocument.wordprocessingml.document", 80 +} + +signature file-xlsx { + file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|xl\x2f).*PK\x03\x04.{26}xl\x2f/ + file-mime "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", 80 +} + +signature file-pptx { + file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|ppt\x2f).*PK\x03\x04.{26}ppt\x2f/ + file-mime "application/vnd.openxmlformats-officedocument.presentationml.presentation", 80 +} + +signature file-msaccess { + file-mime "application/x-msaccess", 180 + file-magic /.{4}Standard (Jet|ACE) DB\x00/ +} + +signature file-opendocument-text { + file-mime "application/vnd.oasis.opendocument.text", 110 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(text)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ +} + +signature file-opendocument-text-template { + file-mime "application/vnd.oasis.opendocument.text-template", 120 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(text)(\x2dtemplate)/ +} + +signature file-opendocument-text-web { + file-mime "application/vnd.oasis.opendocument.text-web", 70 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(text)(\x2dweb)/ +} + +signature file-opendocument-text-master { + file-mime "application/vnd.oasis.opendocument.text-master", 100 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(text)(\x2dmaster)/ +} + +signature file-opendocument-graphics { + file-mime "application/vnd.oasis.opendocument.graphics", 110 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(graphics)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ +} + +signature file-opendocument-graphics-template { + file-mime "application/vnd.oasis.opendocument.graphics-template", 120 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(graphics)(\x2dtemplate)/ +} + +signature file-opendocument-presentation { + file-mime "application/vnd.oasis.opendocument.presentation", 110 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(presentation)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ +} + +signature file-opendocument-presentation-template { + file-mime "application/vnd.oasis.opendocument.presentation-template", 120 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(presentation)(\x2dtemplate)/ +} + +signature file-opendocument-spreadsheet { + file-mime "application/vnd.oasis.opendocument.spreadsheet", 110 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(spreadsheet)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ +} + +signature file-opendocument-spreadsheet-template { + file-mime "application/vnd.oasis.opendocument.spreadsheet-template", 120 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(spreadsheet)(\x2dtemplate)/ +} + +signature file-opendocument-chart { + file-mime "application/vnd.oasis.opendocument.chart", 110 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(chart)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ +} + +signature file-opendocument-chart-template { + file-mime "application/vnd.oasis.opendocument.chart-template", 120 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(chart)(\x2dtemplate)/ +} + +signature file-opendocument-formula { + file-mime "application/vnd.oasis.opendocument.formula", 110 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(formula)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ +} + +signature file-opendocument-formula-template { + file-mime "application/vnd.oasis.opendocument.formula-template", 120 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(formula)(\x2dtemplate)/ +} + +signature file-opendocument-database { + file-mime "application/vnd.oasis.opendocument.database", 110 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(database)/ +} + +signature file-opendocument-image { + file-mime "application/vnd.oasis.opendocument.image", 110 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(image)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ +} + +signature file-image-template { + file-mime "application/vnd.oasis.opendocument.image-template", 120 + file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(vnd\x2eoasis\x2eopendocument\x2e)(image)(\x2dtemplate)/ +} diff --git a/scripts/base/frameworks/files/magic/programming.sig b/scripts/base/frameworks/files/magic/programming.sig new file mode 100644 index 0000000000..67fba3fc7f --- /dev/null +++ b/scripts/base/frameworks/files/magic/programming.sig @@ -0,0 +1,96 @@ +signature file-shellscript { + file-mime "text/x-shellscript", 250 + file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?(ba|tc|c|z|fa|ae|k)?sh/ +} + +signature file-perl { + file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?perl/ + file-mime "text/x-perl", 60 +} + +signature file-ruby { + file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?ruby/ + file-mime "text/x-ruby", 60 +} + +signature file-python { + file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?python/ + file-mime "text/x-python", 60 +} + +signature file-awk { + file-mime "text/x-awk", 60 + file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?(g|n)?awk/ +} + +signature file-tcl { + file-mime "text/x-tcl", 60 + file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?(wish|tcl)/ +} + +signature file-lua { + file-mime "text/x-lua", 49 + file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?lua/ +} + +signature file-javascript { + file-mime "application/javascript", 60 + file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?node(js)?/ +} + +signature file-javascript2 { + file-mime "application/javascript", 60 + file-magic /^[\x0d\x0a[:blank:]]*<[sS][cC][rR][iI][pP][tT][[:blank:]]+([tT][yY][pP][eE]|[lL][aA][nN][gG][uU][aA][gG][eE])=['"]?([tT][eE][xX][tT]\/)?[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]/ +} + +signature file-javascript3 { + file-mime "application/javascript", 60 + # This seems to be a somewhat common idiom in javascript. + file-magic /^[\x0d\x0a[:blank:]]*for \(;;\);/ +} + +signature file-javascript4 { + file-mime "application/javascript", 60 + file-magic /^[\x0d\x0a[:blank:]]*document\.write(ln)?[:blank:]?\(/ +} + +signature file-javascript5 { + file-mime "application/javascript", 60 + file-magic /^\(function\(\)[[:blank:]\n]*\{/ +} + +signature file-javascript6 { + file-mime "application/javascript", 60 + file-magic /^[\x0d\x0a[:blank:]]*