diff --git a/scripts/base/frameworks/files/magic/__load__.bro b/scripts/base/frameworks/files/magic/__load__.bro index df03616ec2..19a0090255 100644 --- a/scripts/base/frameworks/files/magic/__load__.bro +++ b/scripts/base/frameworks/files/magic/__load__.bro @@ -1,6 +1,8 @@ -@load-sigs ./general @load-sigs ./archive +@load-sigs ./audio +@load-sigs ./general @load-sigs ./image -@load-sigs ./video @load-sigs ./msoffice -@load-sigs ./libmagic +@load-sigs ./video + +@load-sigs ./libmagic \ No newline at end of file diff --git a/scripts/base/frameworks/files/magic/archive.sig b/scripts/base/frameworks/files/magic/archive.sig index d8cc727540..4b0df827e5 100644 --- a/scripts/base/frameworks/files/magic/archive.sig +++ b/scripts/base/frameworks/files/magic/archive.sig @@ -16,16 +16,19 @@ signature file-multi-zip { file-magic /^PK\x07\x08PK\x03\x04/ } +# RAR signature file-rar { file-mime "application/x-rar", 70 file-magic /^Rar!/ } +# GZIP signature file-gzip { file-mime "application/x-gzip", 100 file-magic /\x1f\x8b/ } +# Microsoft Cabinet signature file-ms-cab { file-mime "application/vnd.ms-cab-compressed", 110 file-magic /^MSCF\x00\x00\x00\x00/ @@ -50,11 +53,13 @@ signature file-magic-auto352 { file-magic /^(drpm|\xed\xab\xee\xdb)/ } +# StuffIt signature file-stuffit { file-mime "application/x-stuffit", 70 file-magic /^(SIT\x21|StuffIt)/ } +# Archived data signature file-x-archive { file-mime "application/x-archive", 70 file-magic /^!?/ @@ -63,7 +68,7 @@ signature file-x-archive { # ARC archive data signature file-arc { file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})([\x02-\x0a\x14\x48]\x1a)/ + file-magic /^[\x00-\x7f]{2}[\x02-\x0a\x14\x48]\x1a/ } # EET archive @@ -78,43 +83,34 @@ signature file-zoo { file-magic /^.{20}\xdc\xa7\xc4\xfd/ } -# >0 lelong&,=407642370 (0x184c2102), ["LZ4 compressed data, legacy format"], swap_endian=0 -signature file-magic-auto382 { +# LZ4 compressed data (legacy format) +signature file-lz4-legacy { file-mime "application/x-lz4", 70 file-magic /(\x02\x21\x4c\x18)/ } -# >0 lelong&,=407708164 (0x184d2204), ["LZ4 compressed data"], swap_endian=0 -signature file-magic-auto383 { +# LZ4 compressed data +signature file-lz4 { file-mime "application/x-lz4", 70 - file-magic /(\x04\x22\x4d\x18)/ + file-magic /^\x04\x22\x4d\x18/ } -# >0 string,=LRZI (len=4), ["LRZIP compressed data"], swap_endian=0 -# >>5 byte&,x, [".%d"], swap_endian=0 -signature file-magic-auto384 { +# LRZIP compressed data +signature file-lrzip { file-mime "application/x-lrzip", 1 - file-magic /(LRZI)(.{1})(.{1})/ + file-magic /^LRZI/ } -# >0 string,=LZIP (len=4), ["lzip compressed data"], swap_endian=0 -signature file-magic-auto386 { +# LZIP compressed data +signature file-lzip { file-mime "application/x-lzip", 70 - file-magic /(LZIP)/ + file-magic /^LZIP/ } -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>30 string,=Copyright 1989-1990 PKWARE Inc. (len=31), ["Self-extracting PKZIP archive"], swap_endian=0 +# Self-extracting PKZIP archive signature file-magic-auto434 { file-mime "application/zip", 340 - file-magic /(MZ)(.{28})(Copyright 1989\x2d1990 PKWARE Inc\x2e)/ -} - -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>30 string,=PKLITE Copr. (len=12), ["Self-extracting PKZIP archive"], swap_endian=0 -signature file-magic-auto435 { - file-mime "application/zip", 150 - file-magic /(MZ)(.{28})(PKLITE Copr\x2e)/ + file-magic /^MZ.{28}(Copyright 1989\x2d1990 PKWARE Inc|PKLITE Copr)\x2e/ } # LHA archive (LZH) @@ -123,66 +119,57 @@ signature file-lzh { file-magic /^.{2}-(lh[ abcdex0-9]|lz[s2-8]|lz[s2-8]|pm[s012]|pc1)-/ } -# >0 string,=WARC/ (len=5), ["WARC Archive"], swap_endian=0 -# >>5 string,x, ["version %.4s"], swap_endian=0 -signature file-magic-auto177 { - file-mime "application/warc", 1 - file-magic /(WARC\x2f)(.{0})/ +# WARC Archive +signature file-warc { + file-mime "application/warc", 50 + file-magic /^WARC\x2f/ } -# >0 string,=7z\274\257'\034 (len=6), ["7-zip archive data,"], swap_endian=0 -# >>7 byte&,x, [".%d"], swap_endian=0 -signature file-magic-auto150 { - file-mime "application/x-7z-compressed", 1 - file-magic /(7z\xbc\xaf\x27\x1c)(.{1})(.{1})/ +# 7-zip archive data +signature file-7zip { + file-mime "application/x-7z-compressed", 50 + file-magic /^7z\xbc\xaf\x27\x1c/ } -# >0 ustring,=\3757zXZ\000 (len=6), ["XZ compressed data"], swap_endian=0 -signature file-magic-auto151 { +# XZ compressed data +signature file-xz { file-mime "application/x-xz", 90 - file-magic /(\xfd7zXZ\x00)/ + file-magic /^\xfd7zXZ\x00/ } -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>36 string,=LHa's SFX (len=9), [", LHa self-extracting archive"], swap_endian=0 + +# LHa self-extracting archive signature file-magic-auto436 { file-mime "application/x-lha", 120 - file-magic /(MZ)(.{34})(LHa\x27s SFX)/ + file-magic /^MZ.{34}LH[aA]\x27s SFX/ } -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>36 string,=LHA's SFX (len=9), [", LHa self-extracting archive"], swap_endian=0 -signature file-magic-auto437 { - file-mime "application/x-lha", 120 - file-magic /(MZ)(.{34})(LHA\x27s SFX)/ -} - -# >0 leshort&,=-5536 (0xea60), ["ARJ archive data"], swap_endian=0 -signature file-magic-auto467 { +# ARJ archive data +signature file-arj { file-mime "application/x-arj", 50 - file-magic /(\x60\xea)/ + file-magic /^\x60\xea/ } -# >0 short&,=-14479 (0xc771), ["byte-swapped cpio archive"], swap_endian=0 -signature file-magic-auto479 { +# Byte-swapped cpio archive +signature file-bs-cpio { file-mime "application/x-cpio", 50 - file-magic /((\x71\xc7)|(\xc7\x71))/ + file-magic /(\x71\xc7|\xc7\x71)/ } -# >0 short&,=29127 (0x71c7), ["cpio archive"], swap_endian=0 -signature file-magic-auto480 { +# CPIO archive +signature file-cpio { file-mime "application/x-cpio", 50 - file-magic /((\xc7\x71)|(\x71\xc7))/ + file-magic /^(\xc7\x71|\x71\xc7)/ } -# >0 string,=\037\235 (len=2), ["compress'd data"], swap_endian=0 -signature file-magic-auto500 { +# Compress'd data +signature file-compress { file-mime "application/x-compress", 50 - file-magic /(\x1f\x9d)/ + file-magic /^\x1f\x9d/ } -# >0 lelong&00ffffff,=93 (0x0000005d), [""], swap_endian=0 -signature file-magic-auto218 { +# LZMA compressed data +signature file-lzma { file-mime "application/x-lzma", 71 - file-magic /(\x5d\x00\x00.)/ + file-magic /^\x5d\x00\x00/ } diff --git a/scripts/base/frameworks/files/magic/audio.sig b/scripts/base/frameworks/files/magic/audio.sig new file mode 100644 index 0000000000..de2de85c6e --- /dev/null +++ b/scripts/base/frameworks/files/magic/audio.sig @@ -0,0 +1,121 @@ + +# >0 beshort&fffffffffffffffe,=-30 (0xffe2), ["MPEG ADTS, layer III, v2.5"], swap_endian=0 +signature file-magic-auto487 { + file-mime "audio/mpeg", 50 + file-magic /(\xff[\xe2\xe3])/ +} + +# >0 beshort&fffffffffffffffe,=-10 (0xfff6), ["MPEG ADTS, layer I, v2"], swap_endian=0 +signature file-magic-auto488 { + file-mime "audio/mpeg", 50 + file-magic /(\xff[\xf6\xf7])/ +} + +# >0 beshort&fffffffffffffffe,=-14 (0xfff2), ["MPEG ADTS, layer III, v2"], swap_endian=0 +signature file-magic-auto489 { + file-mime "audio/mpeg", 50 + file-magic /(\xff[\xf2\xf3])/ +} + +# >0 beshort&fffffffffffffffe,=-4 (0xfffc), ["MPEG ADTS, layer II, v1"], swap_endian=0 +signature file-magic-auto490 { + file-mime "audio/mpeg", 50 + file-magic /(\xff[\xfc\xfd])/ +} +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0x10, ["MPEG ADTS, layer III, v1, 32 kbps"], swap_endian=0 +signature file-magic-auto438 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0x20, ["MPEG ADTS, layer III, v1, 40 kbps"], swap_endian=0 +signature file-magic-auto439 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0x30, ["MPEG ADTS, layer III, v1, 48 kbps"], swap_endian=0 +signature file-magic-auto440 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0x40, ["MPEG ADTS, layer III, v1, 56 kbps"], swap_endian=0 +signature file-magic-auto441 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0x50, ["MPEG ADTS, layer III, v1, 64 kbps"], swap_endian=0 +signature file-magic-auto442 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0x60, ["MPEG ADTS, layer III, v1, 80 kbps"], swap_endian=0 +signature file-magic-auto443 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0x70, ["MPEG ADTS, layer III, v1, 96 kbps"], swap_endian=0 +signature file-magic-auto444 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0x80, ["MPEG ADTS, layer III, v1, 112 kbps"], swap_endian=0 +signature file-magic-auto445 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0x90, ["MPEG ADTS, layer III, v1, 128 kbps"], swap_endian=0 +signature file-magic-auto446 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0xa0, ["MPEG ADTS, layer III, v1, 160 kbps"], swap_endian=0 +signature file-magic-auto447 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0xb0, ["MPEG ADTS, layer III, v1, 192 kbps"], swap_endian=0 +signature file-magic-auto448 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0xc0, ["MPEG ADTS, layer III, v1, 224 kbps"], swap_endian=0 +signature file-magic-auto449 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0xd0, ["MPEG ADTS, layer III, v1, 256 kbps"], swap_endian=0 +signature file-magic-auto450 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf])/ +} + +# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 +# >>2 byte&fffffffffffffff0,=0xe0, ["MPEG ADTS, layer III, v1, 320 kbps"], swap_endian=0 +signature file-magic-auto451 { + file-mime "audio/mpeg", 40 + file-magic /(\xff[\xfa\xfb])([\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef])/ +} diff --git a/scripts/base/frameworks/files/magic/general.sig b/scripts/base/frameworks/files/magic/general.sig index 63cfc9a4e0..2a2e630863 100644 --- a/scripts/base/frameworks/files/magic/general.sig +++ b/scripts/base/frameworks/files/magic/general.sig @@ -9,22 +9,32 @@ signature file-plaintext { signature file-xml { file-mime "application/xml", 10 - file-magic /^([\x0d\x0a[:blank:]]*()?)*<\?xml / + file-magic /^([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*<\?xml / } signature file-xhtml { file-mime "text/html", 100 - file-magic /^([\x0d\x0a[:blank:]]*()?)*<\?xml version[ =]['"].*<(![dD][oO][cC][tT][yY][pP][eE] {1,}[hH][tT][mM][lL]|[hH][tT][mM][lL])/ + file-magic /^([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*<(![dD][oO][cC][tT][yY][pP][eE] {1,}[hH][tT][mM][lL]|[hH][tT][mM][lL])/ } signature file-html { file-mime "text/html", 49 - file-magic /^([\x0d\x0a[:blank:]]*()?)*)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*)?)*<([hH][eE][aA][dD]|[hH][tT][mM][lL]|[tT][iI][tT][lL][eE]|[bB][oO][dD][yY])/ + file-magic /^([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*<([hH][eE][aA][dD]|[hH][tT][mM][lL]|[tT][iI][tT][lL][eE]|[bB][oO][dD][yY])/ +} + +signature file-rss { + file-mime "text/rss", 90 + file-magic /^([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*<[rR][sS][sS]/ +} + +signature file-atom { + file-mime "text/atom", 100 + file-magic /^([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*<[rR][sS][sS][^>]*xmlns:atom/ } signature file-coldfusion { @@ -34,17 +44,17 @@ signature file-coldfusion { signature file-soap { file-mime "application/soap+xml", 49 - file-magic /^([\x0d\x0a[:blank:]]*()?)*<[sS][oO][aA][pP]-[eE][nN][vV]:[eE][nN][vV][eE][lL][oO][pP][eE]/ + file-magic /^([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*<[sS][oO][aA][pP]-[eE][nN][vV]:[eE][nN][vV][eE][lL][oO][pP][eE]/ } signature file-cross-domain-policy { file-mime "text/x-cross-domain-policy", 49 - file-magic /^([\x0d\x0a[:blank:]]*()?)*(<\?xml version="1.0"\?>)?)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*)?)*<[cC][rR][oO][sS][sS]-[dD][oO][mM][aA][iI][nN]-[pP][oO][lL][iI][cC][yY]/ + file-magic /^([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*<[cC][rR][oO][sS][sS]-[dD][oO][mM][aA][iI][nN]-[pP][oO][lL][iI][cC][yY]/ } # Microsoft LNK files diff --git a/scripts/base/frameworks/files/magic/image.sig b/scripts/base/frameworks/files/magic/image.sig index ad4e7bbbe1..2977cd90ae 100644 --- a/scripts/base/frameworks/files/magic/image.sig +++ b/scripts/base/frameworks/files/magic/image.sig @@ -9,11 +9,10 @@ signature file-gif { file-magic /^GIF8/ } - -# >0 beshort&,=-40 (0xffd8), ["JPEG image data"], swap_endian=0 +# JPEG image signature file-magic-auto427 { file-mime "image/jpeg", 52 - file-magic /(\xff\xd8)/ + file-magic /^\xff\xd8/ } signature file-bmp { @@ -31,10 +30,9 @@ signature file-cur { file-mime "image/x-cursor", 70 } -# >0 string,=8BPS (len=4), ["Adobe Photoshop Image"], swap_endian=0 signature file-magic-auto289 { file-mime "image/vnd.adobe.photoshop", 70 - file-magic /(8BPS)/ + file-magic /^8BPS/ } signature file-png { @@ -66,78 +64,69 @@ signature file-jpm { file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jpm / } -# >0 string,=Xcur (len=4), ["Xcursor data"], swap_endian=0 -signature file-magic-auto271 { +# Xcursor image +signature file-x-cursor { file-mime "image/x-xcursor", 70 - file-magic /(Xcur)/ + file-magic /^Xcur/ } -# >0 string,=IIN1 (len=4), ["NIFF image data"], swap_endian=0 -signature file-magic-auto282 { +# NIFF image +signature file-niff { file-mime "image/x-niff", 70 - file-magic /(IIN1)/ + file-magic /^IIN1/ } -# >0 lelong&,=20000630 (0x01312f76), ["OpenEXR image data,"], swap_endian=0 -signature file-magic-auto291 { +# OpenEXR image +signature file-openexr { file-mime "image/x-exr", 70 - file-magic /(\x76\x2f\x31\x01)/ + file-magic /^\x76\x2f\x31\x01/ } -# >0 string,=SDPX (len=4), ["DPX image data, big-endian,"], swap_endian=0 -signature file-magic-auto292 { +# DPX image +signature file-dpx { file-mime "image/x-dpx", 70 - file-magic /(SDPX)/ + file-magic /^SDPX/ } -# >0 string,=CPC\262 (len=4), ["Cartesian Perceptual Compression image"], swap_endian=0 -signature file-magic-auto294 { +# Cartesian Perceptual Compression image +signature file-cpi { file-mime "image/x-cpi", 70 file-magic /(CPC\xb2)/ } - signature file-orf { file-mime "image/x-olympus-orf", 70 file-magic /IIR[OS]|MMOR/ } -# >0 string,=FOVb (len=4), ["Foveon X3F raw image data"], swap_endian=0 -signature file-magic-auto298 { +# Foveon X3F raw image +signature file-x3r { file-mime "image/x-x3f", 70 - file-magic /(FOVb)/ + file-magic /^FOVb/ } -# >0 string,=PDN3 (len=4), ["Paint.NET image data"], swap_endian=0 -signature file-magic-auto299 { +# Paint.NET image +signature file-paint-net { file-mime "image/x-paintnet", 70 - file-magic /(PDN3)/ + file-magic /^PDN3/ } -# >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 -# >>8 string,=CDRA (len=4), [", Corel Draw Picture"], swap_endian=0 -signature file-magic-auto355 { +# Corel Draw Picture +signature file-coreldraw { file-mime "image/x-coreldraw", 70 - file-magic /(RIFF)(.{4})(CDRA)/ + file-magic /^RIFF....CDR[A6]/ } -# >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 -# >>8 string,=CDR6 (len=4), [", Corel Draw Picture, version 6"], swap_endian=0 -signature file-magic-auto356 { - file-mime "image/x-coreldraw", 70 - file-magic /(RIFF)(.{4})(CDR6)/ -} - -# >0 string,=P7 (len=2), ["Netpbm PAM image file"], swap_endian=0 -signature file-magic-auto484 { +# Netpbm PAM image +signature file-netbpm{ file-mime "image/x-portable-pixmap", 50 - file-magic /(P7)/ + file-magic /^P7/ } -# >4 string/W,=jP (len=2), ["JPEG 2000 image"], swap_endian=0 -signature file-magic-auto497 { +# JPEG 2000 image +signature file-jpeg-2000 { file-mime "image/jp2", 50 - file-magic /(.{4})(jP)/ + file-magic /^....jP/ } # DjVU Images @@ -152,27 +141,26 @@ signature file-dwg { file-magic /^(AC[12]\.|AC10)/ } -# >0 string,=gimp xcf (len=8), ["GIMP XCF image data,"], swap_endian=0 -signature file-magic-auto115 { +# GIMP XCF image +signature file-gimp-xcf { file-mime "image/x-xcf", 110 - file-magic /(gimp xcf)/ + file-magic /^gimp xcf/ } -# >0 string/t,=[BitmapInfo2] (len=13), ["Polar Monitor Bitmap text"], swap_endian=0 -signature file-magic-auto62 { +# Polar Monitor Bitmap text +signature file-polar-monitor-bitmap { file-mime "image/x-polar-monitor-bitmap", 160 - file-magic /(\x5bBitmapInfo2\x5d)/ + file-magic /^\x5bBitmapInfo2\x5d/ } -# >0 string,=AWBM (len=4), [""], swap_endian=0 -# >>4 leshort&,<1981 (0x07bd), ["Award BIOS bitmap"], swap_endian=0 -signature file-magic-auto208 { +# Award BIOS bitmap +signature file-award-bitmap { file-mime "image/x-award-bmp", 20 - file-magic /(AWBM)(.{2})/ + file-magic /^AWBM/ } -# >0 string,=\021\006 (len=2), ["Award BIOS Logo, 136 x 84"], swap_endian=0 -signature file-magic-auto483 { +# Award BIOS Logo, 136 x 84 +signature file-award-bios-logo { file-mime "image/x-award-bioslogo", 50 file-magic /^\x11[\x06\x09]/ } diff --git a/scripts/base/frameworks/files/magic/libmagic.sig b/scripts/base/frameworks/files/magic/libmagic.sig index d18f6f01a6..5975962838 100644 --- a/scripts/base/frameworks/files/magic/libmagic.sig +++ b/scripts/base/frameworks/files/magic/libmagic.sig @@ -357,65 +357,50 @@ signature file-magic-auto104 { file-magic /(ITOLITLS)(.{4})/ } -# >4096 string,=\211HDF\r\n\032\n (len=8), ["Hierarchical Data Format (version 5) with 4k user block"], swap_endian=0 -signature file-magic-auto105 { - file-mime "application/x-hdf", 110 - file-magic /(.{4096})(\x89HDF\x0d\x0a\x1a\x0a)/ -} - -# >2048 string,=\211HDF\r\n\032\n (len=8), ["Hierarchical Data Format (version 5) with 2k user block"], swap_endian=0 -signature file-magic-auto106 { - file-mime "application/x-hdf", 110 - file-magic /(.{2048})(\x89HDF\x0d\x0a\x1a\x0a)/ -} - -# >1024 string,=\211HDF\r\n\032\n (len=8), ["Hierarchical Data Format (version 5) with 1k user block"], swap_endian=0 -signature file-magic-auto107 { - file-mime "application/x-hdf", 110 - file-magic /(.{1024})(\x89HDF\x0d\x0a\x1a\x0a)/ -} - -# >512 string,=\211HDF\r\n\032\n (len=8), ["Hierarchical Data Format (version 5) with 512 bytes user block"], swap_endian=0 -signature file-magic-auto108 { - file-mime "application/x-hdf", 110 - file-magic /(.{512})(\x89HDF\x0d\x0a\x1a\x0a)/ -} - # >0 string,=\211HDF\r\n\032\n (len=8), ["Hierarchical Data Format (version 5) data"], swap_endian=0 signature file-magic-auto109 { file-mime "application/x-hdf", 110 file-magic /(\x89HDF\x0d\x0a\x1a\x0a)/ } -# >36 string,=acspSUNW (len=8), ["Sun KCMS ICC Profile"], swap_endian=0 -signature file-magic-auto111 { - file-mime "application/vnd.iccprofile", 110 - file-magic /(.{36})(acspSUNW)/ -} +# Find a way to do the following to generically detect ICC profiles. +# An ICC parser should deal with the difference in these formats. +## >36 string,=acspSUNW (len=8), ["Sun KCMS ICC Profile"], swap_endian=0 +#signature file-magic-auto111 { +# file-mime "application/vnd.iccprofile", 110 +# file-magic /(.{36})(acspSUNW)/ +#} +# +## >36 string,=acspSGI (len=8), ["SGI ICC Profile"], swap_endian=0 +#signature file-magic-auto112 { +# file-mime "application/vnd.iccprofile", 110 +# file-magic /(.{36})(acspSGI )/ +#} +# +## >36 string,=acspMSFT (len=8), ["Microsoft ICM Color Profile"], swap_endian=0 +#signature file-magic-auto113 { +# file-mime "application/vnd.iccprofile", 110 +# file-magic /(.{36})(acspMSFT)/ +#} +# +## >36 string,=acspAPPL (len=8), ["ColorSync ICC Profile"], swap_endian=0 +#signature file-magic-auto114 { +# file-mime "application/vnd.iccprofile", 110 +# file-magic /(.{36})(acspAPPL)/ +#} +# +## >36 string,=acsp (len=4), ["ICC Profile"], swap_endian=0 +#signature file-magic-auto277 { +# file-mime "application/vnd.iccprofile", 70 +# file-magic /(.{36})(acsp)/ +#} -# >36 string,=acspSGI (len=8), ["SGI ICC Profile"], swap_endian=0 -signature file-magic-auto112 { - file-mime "application/vnd.iccprofile", 110 - file-magic /(.{36})(acspSGI )/ -} - -# >36 string,=acspMSFT (len=8), ["Microsoft ICM Color Profile"], swap_endian=0 -signature file-magic-auto113 { - file-mime "application/vnd.iccprofile", 110 - file-magic /(.{36})(acspMSFT)/ -} - -# >36 string,=acspAPPL (len=8), ["ColorSync ICC Profile"], swap_endian=0 -signature file-magic-auto114 { - file-mime "application/vnd.iccprofile", 110 - file-magic /(.{36})(acspAPPL)/ -} # >512 string,=R\000o\000o\000t\000 (len=8), ["Hangul (Korean) Word Processor File 2000"], swap_endian=0 -signature file-magic-auto116 { - file-mime "application/x-hwp", 110 - file-magic /(.{512})(R\x00o\x00o\x00t\x00)/ -} +#signature file-magic-auto116 { +# file-mime "application/x-hwp", 110 +# file-magic /(.{512})(R\x00o\x00o\x00t\x00)/ +#} # >0 string,=60 string,=RINEX (len=5), [""], swap_endian=0 -# >>80 search/256,=XXRINEXB (len=8), ["RINEX Data, GEO SBAS Broadcast"], swap_endian=0 -# >>>5 string,x, [", version %6.6s"], swap_endian=0 -signature file-magic-auto166 { - file-mime "rinex/broadcast", 1 - file-magic /(.{60})(RINEX)(.{15})(.*)(XXRINEXB)/ -} - -# >60 string,=RINEX (len=5), [""], swap_endian=0 -# >>80 search/256,=XXRINEXD (len=8), ["RINEX Data, Observation (Hatanaka comp)"], swap_endian=0 -# >>>5 string,x, [", version %6.6s"], swap_endian=0 -signature file-magic-auto167 { - file-mime "rinex/observation", 1 - file-magic /(.{60})(RINEX)(.{15})(.*)(XXRINEXD)/ -} - -# >60 string,=RINEX (len=5), [""], swap_endian=0 -# >>80 search/256,=XXRINEXC (len=8), ["RINEX Data, Clock"], swap_endian=0 -# >>>5 string,x, [", version %6.6s"], swap_endian=0 -signature file-magic-auto168 { - file-mime "rinex/clock", 1 - file-magic /(.{60})(RINEX)(.{15})(.*)(XXRINEXC)/ -} - -# >60 string,=RINEX (len=5), [""], swap_endian=0 -# >>80 search/256,=XXRINEXH (len=8), ["RINEX Data, GEO SBAS Navigation"], swap_endian=0 -# >>>5 string,x, [", version %6.6s"], swap_endian=0 -signature file-magic-auto169 { - file-mime "rinex/navigation", 1 - file-magic /(.{60})(RINEX)(.{15})(.*)(XXRINEXH)/ -} - -# >60 string,=RINEX (len=5), [""], swap_endian=0 -# >>80 search/256,=XXRINEXG (len=8), ["RINEX Data, GLONASS Navigation"], swap_endian=0 -# >>>5 string,x, [", version %6.6s"], swap_endian=0 -signature file-magic-auto170 { - file-mime "rinex/navigation", 1 - file-magic /(.{60})(RINEX)(.{15})(.*)(XXRINEXG)/ -} - -# >60 string,=RINEX (len=5), [""], swap_endian=0 -# >>80 search/256,=XXRINEXL (len=8), ["RINEX Data, Galileo Navigation"], swap_endian=0 -# >>>5 string,x, [", version %6.6s"], swap_endian=0 -signature file-magic-auto171 { - file-mime "rinex/navigation", 1 - file-magic /(.{60})(RINEX)(.{15})(.*)(XXRINEXL)/ -} - -# >60 string,=RINEX (len=5), [""], swap_endian=0 -# >>80 search/256,=XXRINEXM (len=8), ["RINEX Data, Meteorological"], swap_endian=0 -# >>>5 string,x, [", version %6.6s"], swap_endian=0 -signature file-magic-auto172 { - file-mime "rinex/meteorological", 1 - file-magic /(.{60})(RINEX)(.{15})(.*)(XXRINEXM)/ -} - -# >60 string,=RINEX (len=5), [""], swap_endian=0 -# >>80 search/256,=XXRINEXN (len=8), ["RINEX Data, Navigation "], swap_endian=0 -# >>>5 string,x, [", version %6.6s"], swap_endian=0 -signature file-magic-auto173 { - file-mime "rinex/navigation", 1 - file-magic /(.{60})(RINEX)(.{15})(.*)(XXRINEXN)/ -} - -# >60 string,=RINEX (len=5), [""], swap_endian=0 -# >>80 search/256,=XXRINEXO (len=8), ["RINEX Data, Observation"], swap_endian=0 -# >>>5 string,x, [", version %6.6s"], swap_endian=0 -signature file-magic-auto174 { - file-mime "rinex/observation", 1 - file-magic /(.{60})(RINEX)(.{15})(.*)(XXRINEXO)/ -} - # >0 string,=\000\001\000\000\000 (len=5), ["TrueType font data"], swap_endian=0 signature file-magic-auto187 { file-mime "application/x-font-ttf", 80 @@ -935,13 +848,13 @@ signature file-magic-auto245 { # >4 string,=idsc (len=4), ["Apple QuickTime image (fast start)"], swap_endian=0 signature file-magic-auto255 { file-mime "image/x-quicktime", 70 - file-magic /(.{4})(idsc)/ + file-magic /....(idsc)/ } # >4 string,=pckg (len=4), ["Apple QuickTime compressed archive"], swap_endian=0 signature file-magic-auto256 { file-mime "application/x-quicktime-player", 70 - file-magic /(.{4})(pckg)/ + file-magic /....(pckg)/ } @@ -949,21 +862,21 @@ signature file-magic-auto256 { # >>8 string/W,=M4A (len=3), [", MPEG v4 system, iTunes AAC-LC"], swap_endian=0 signature file-magic-auto268 { file-mime "audio/mp4", 60 - file-magic /(.{4})(ftyp)(M4A)/ + file-magic /....(ftyp)(M4A)/ } # >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 # >>8 string/W,=M4V (len=3), [", MPEG v4 system, iTunes AVC-LC"], swap_endian=0 signature file-magic-auto269 { file-mime "video/mp4", 60 - file-magic /(.{4})(ftyp)(M4V)/ + file-magic /....(ftyp)(M4V)/ } # >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 # >>8 string/W,=qt (len=2), [", Apple QuickTime movie"], swap_endian=0 signature file-magic-auto270 { file-mime "video/quicktime", 50 - file-magic /(.{4})(ftyp)(qt)/ + file-magic /....(ftyp)(qt)/ } # >0 string,=ADIF (len=4), ["MPEG ADIF, AAC"], swap_endian=0 @@ -985,11 +898,6 @@ signature file-magic-auto276 { file-magic /(MAC )/ } -# >36 string,=acsp (len=4), ["ICC Profile"], swap_endian=0 -signature file-magic-auto277 { - file-mime "application/vnd.iccprofile", 70 - file-magic /(.{36})(acsp)/ -} # >0 string,=FORM (len=4), ["IFF data"], swap_endian=0 # >>8 string,=AIFF (len=4), [", AIFF audio"], swap_endian=0 @@ -1048,71 +956,71 @@ signature file-magic-auto303 { file-magic /(\xce\xce\xce\xce)/ } -# >1080 string,=32CN (len=4), ["32-channel Taketracker module sound data"], swap_endian=0 -signature file-magic-auto304 { - file-mime "audio/x-mod", 70 - file-magic /(.{1080})(32CN)/ -} - -# >1080 string,=16CN (len=4), ["16-channel Taketracker module sound data"], swap_endian=0 -signature file-magic-auto305 { - file-mime "audio/x-mod", 70 - file-magic /(.{1080})(16CN)/ -} - -# >1080 string,=OKTA (len=4), ["8-channel Octalyzer module sound data"], swap_endian=0 -signature file-magic-auto306 { - file-mime "audio/x-mod", 70 - file-magic /(.{1080})(OKTA)/ -} - -# >1080 string,=CD81 (len=4), ["8-channel Octalyser module sound data"], swap_endian=0 -signature file-magic-auto307 { - file-mime "audio/x-mod", 70 - file-magic /(.{1080})(CD81)/ -} - -# >1080 string,=8CHN (len=4), ["8-channel Fasttracker module sound data"], swap_endian=0 -signature file-magic-auto308 { - file-mime "audio/x-mod", 70 - file-magic /(.{1080})(8CHN)/ -} - -# >1080 string,=6CHN (len=4), ["6-channel Fasttracker module sound data"], swap_endian=0 -signature file-magic-auto309 { - file-mime "audio/x-mod", 70 - file-magic /(.{1080})(6CHN)/ -} - -# >1080 string,=4CHN (len=4), ["4-channel Fasttracker module sound data"], swap_endian=0 -signature file-magic-auto310 { - file-mime "audio/x-mod", 70 - file-magic /(.{1080})(4CHN)/ -} - -# >1080 string,=FLT8 (len=4), ["8-channel Startracker module sound data"], swap_endian=0 -signature file-magic-auto311 { - file-mime "audio/x-mod", 70 - file-magic /(.{1080})(FLT8)/ -} - -# >1080 string,=FLT4 (len=4), ["4-channel Startracker module sound data"], swap_endian=0 -signature file-magic-auto312 { - file-mime "audio/x-mod", 70 - file-magic /(.{1080})(FLT4)/ -} - -# >1080 string,=M!K! (len=4), ["4-channel Protracker module sound data"], swap_endian=0 -signature file-magic-auto313 { - file-mime "audio/x-mod", 70 - file-magic /(.{1080})(M\x21K\x21)/ -} - -# >1080 string,=M.K. (len=4), ["4-channel Protracker module sound data"], swap_endian=0 -signature file-magic-auto314 { - file-mime "audio/x-mod", 70 - file-magic /(.{1080})(M\x2eK\x2e)/ -} +## >1080 string,=32CN (len=4), ["32-channel Taketracker module sound data"], swap_endian=0 +#signature file-magic-auto304 { +# file-mime "audio/x-mod", 70 +# file-magic /(.{1080})(32CN)/ +#} +# +## >1080 string,=16CN (len=4), ["16-channel Taketracker module sound data"], swap_endian=0 +#signature file-magic-auto305 { +# file-mime "audio/x-mod", 70 +# file-magic /(.{1080})(16CN)/ +#} +# +## >1080 string,=OKTA (len=4), ["8-channel Octalyzer module sound data"], swap_endian=0 +#signature file-magic-auto306 { +# file-mime "audio/x-mod", 70 +# file-magic /(.{1080})(OKTA)/ +#} +# +## >1080 string,=CD81 (len=4), ["8-channel Octalyser module sound data"], swap_endian=0 +#signature file-magic-auto307 { +# file-mime "audio/x-mod", 70 +# file-magic /(.{1080})(CD81)/ +#} +# +## >1080 string,=8CHN (len=4), ["8-channel Fasttracker module sound data"], swap_endian=0 +#signature file-magic-auto308 { +# file-mime "audio/x-mod", 70 +# file-magic /(.{1080})(8CHN)/ +#} +# +## >1080 string,=6CHN (len=4), ["6-channel Fasttracker module sound data"], swap_endian=0 +#signature file-magic-auto309 { +# file-mime "audio/x-mod", 70 +# file-magic /(.{1080})(6CHN)/ +#} +# +## >1080 string,=4CHN (len=4), ["4-channel Fasttracker module sound data"], swap_endian=0 +#signature file-magic-auto310 { +# file-mime "audio/x-mod", 70 +# file-magic /(.{1080})(4CHN)/ +#} +# +## >1080 string,=FLT8 (len=4), ["8-channel Startracker module sound data"], swap_endian=0 +#signature file-magic-auto311 { +# file-mime "audio/x-mod", 70 +# file-magic /(.{1080})(FLT8)/ +#} +# +## >1080 string,=FLT4 (len=4), ["4-channel Startracker module sound data"], swap_endian=0 +#signature file-magic-auto312 { +# file-mime "audio/x-mod", 70 +# file-magic /(.{1080})(FLT4)/ +#} +# +## >1080 string,=M!K! (len=4), ["4-channel Protracker module sound data"], swap_endian=0 +#signature file-magic-auto313 { +# file-mime "audio/x-mod", 70 +# file-magic /(.{1080})(M\x21K\x21)/ +#} +# +## >1080 string,=M.K. (len=4), ["4-channel Protracker module sound data"], swap_endian=0 +#signature file-magic-auto314 { +# file-mime "audio/x-mod", 70 +# file-magic /(.{1080})(M\x2eK\x2e)/ +#} # >0 lelong&,=336851773 (0x1413f33d), ["SYSLINUX' LSS16 image data"], swap_endian=0 signature file-magic-auto315 { @@ -1410,11 +1318,11 @@ signature file-magic-auto388 { file-magic /(\xca\xfe\xd0\x0d)(.{1})/ } -# >0 search/4096,=\documentstyle (len=14), ["LaTeX document text"], swap_endian=0 -signature file-magic-auto390 { - file-mime "text/x-tex", 62 - file-magic /(.*)(\x5cdocumentstyle)/ -} +## >0 search/4096,=\documentstyle (len=14), ["LaTeX document text"], swap_endian=0 +#signature file-magic-auto390 { +# file-mime "text/x-tex", 62 +# file-magic /(.*)(\x5cdocumentstyle)/ +#} # >0 string,=DOC (len=3), [""], swap_endian=0 # >>43 byte&,=0x14, ["Just System Word Processor Ichitaro v4"], swap_endian=0 @@ -1469,47 +1377,47 @@ signature file-magic-auto406 { file-magic /(BZh)/ } -# >0 search/4096,=\documentclass (len=14), ["LaTeX 2e document text"], swap_endian=0 -signature file-magic-auto412 { - file-mime "text/x-tex", 59 - file-magic /(.*)(\x5cdocumentclass)/ -} - -# >0 search/4096,=\contentsline (len=13), ["LaTeX table of contents"], swap_endian=0 -signature file-magic-auto414 { - file-mime "text/x-tex", 58 - file-magic /(.*)(\x5ccontentsline)/ -} - -# >0 search/4096,=\chapter (len=8), ["LaTeX document text"], swap_endian=0 -signature file-magic-auto415 { - file-mime "text/x-tex", 56 - file-magic /(.*)(\x5cchapter)/ -} - -# >0 search/4096,=\section (len=8), ["LaTeX document text"], swap_endian=0 -signature file-magic-auto416 { - file-mime "text/x-tex", 56 - file-magic /(.*)(\x5csection)/ -} - -# >0 search/4096,=\setlength (len=10), ["LaTeX document text"], swap_endian=0 -signature file-magic-auto419 { - file-mime "text/x-tex", 55 - file-magic /(.*)(\x5csetlength)/ -} - -# >0 search/1,=Common subdirectories: (len=23), ["diff output text"], swap_endian=0 -signature file-magic-auto422 { - file-mime "text/x-diff", 53 - file-magic /(.*)(Common subdirectories\x3a )/ -} - -# >0 search/4096,=(custom-set-variables (len=22), ["Lisp/Scheme program text"], swap_endian=0 -signature file-magic-auto426 { - file-mime "text/x-lisp", 52 - file-magic /(.*)(\x28custom\x2dset\x2dvariables )/ -} +## >0 search/4096,=\documentclass (len=14), ["LaTeX 2e document text"], swap_endian=0 +#signature file-magic-auto412 { +# file-mime "text/x-tex", 59 +# file-magic /(.*)(\x5cdocumentclass)/ +#} +# +## >0 search/4096,=\contentsline (len=13), ["LaTeX table of contents"], swap_endian=0 +#signature file-magic-auto414 { +# file-mime "text/x-tex", 58 +# file-magic /(.*)(\x5ccontentsline)/ +#} +# +## >0 search/4096,=\chapter (len=8), ["LaTeX document text"], swap_endian=0 +#signature file-magic-auto415 { +# file-mime "text/x-tex", 56 +# file-magic /(.*)(\x5cchapter)/ +#} +# +## >0 search/4096,=\section (len=8), ["LaTeX document text"], swap_endian=0 +#signature file-magic-auto416 { +# file-mime "text/x-tex", 56 +# file-magic /(.*)(\x5csection)/ +#} +# +## >0 search/4096,=\setlength (len=10), ["LaTeX document text"], swap_endian=0 +#signature file-magic-auto419 { +# file-mime "text/x-tex", 55 +# file-magic /(.*)(\x5csetlength)/ +#} +# +## >0 search/1,=Common subdirectories: (len=23), ["diff output text"], swap_endian=0 +#signature file-magic-auto422 { +# file-mime "text/x-diff", 53 +# file-magic /(.*)(Common subdirectories\x3a )/ +#} +# +## >0 search/4096,=(custom-set-variables (len=22), ["Lisp/Scheme program text"], swap_endian=0 +#signature file-magic-auto426 { +# file-mime "text/x-lisp", 52 +# file-magic /(.*)(\x28custom\x2dset\x2dvariables )/ +#} # >0 string/b,=MZ (len=2), [""], swap_endian=0 signature file-magic-auto433 { @@ -1517,104 +1425,6 @@ signature file-magic-auto433 { file-magic /(MZ)/ } -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0x10, ["MPEG ADTS, layer III, v1, 32 kbps"], swap_endian=0 -signature file-magic-auto438 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0x20, ["MPEG ADTS, layer III, v1, 40 kbps"], swap_endian=0 -signature file-magic-auto439 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0x30, ["MPEG ADTS, layer III, v1, 48 kbps"], swap_endian=0 -signature file-magic-auto440 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0x40, ["MPEG ADTS, layer III, v1, 56 kbps"], swap_endian=0 -signature file-magic-auto441 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0x50, ["MPEG ADTS, layer III, v1, 64 kbps"], swap_endian=0 -signature file-magic-auto442 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0x60, ["MPEG ADTS, layer III, v1, 80 kbps"], swap_endian=0 -signature file-magic-auto443 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0x70, ["MPEG ADTS, layer III, v1, 96 kbps"], swap_endian=0 -signature file-magic-auto444 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0x80, ["MPEG ADTS, layer III, v1, 112 kbps"], swap_endian=0 -signature file-magic-auto445 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0x90, ["MPEG ADTS, layer III, v1, 128 kbps"], swap_endian=0 -signature file-magic-auto446 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0xa0, ["MPEG ADTS, layer III, v1, 160 kbps"], swap_endian=0 -signature file-magic-auto447 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0xb0, ["MPEG ADTS, layer III, v1, 192 kbps"], swap_endian=0 -signature file-magic-auto448 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0xc0, ["MPEG ADTS, layer III, v1, 224 kbps"], swap_endian=0 -signature file-magic-auto449 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0xd0, ["MPEG ADTS, layer III, v1, 256 kbps"], swap_endian=0 -signature file-magic-auto450 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf])/ -} - -# >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 -# >>2 byte&fffffffffffffff0,=0xe0, ["MPEG ADTS, layer III, v1, 320 kbps"], swap_endian=0 -signature file-magic-auto451 { - file-mime "audio/mpeg", 40 - file-magic /(\xff[\xfa\xfb])([\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef])/ -} - # >20 string,=45 (len=2), [""], swap_endian=0 # >>0 regex/1,=(^[0-9]{5})[acdnp][^bhlnqsu-z] (len=30), ["MARC21 Bibliographic"], swap_endian=0 signature file-magic-auto460 { @@ -1636,17 +1446,17 @@ signature file-magic-auto462 { file-magic /(.{20})(45)(.*)((^[0-9]{5})[cdn][uvxy])/ } -# >0 search/4096,=\relax (len=6), ["LaTeX auxiliary file"], swap_endian=0 -signature file-magic-auto463 { - file-mime "text/x-tex", 51 - file-magic /(.*)(\x5crelax)/ -} - -# >0 search/4096,=\begin (len=6), ["LaTeX document text"], swap_endian=0 -signature file-magic-auto464 { - file-mime "text/x-tex", 51 - file-magic /.*\x5c(input|begin)/ -} +## >0 search/4096,=\relax (len=6), ["LaTeX auxiliary file"], swap_endian=0 +#signature file-magic-auto463 { +# file-mime "text/x-tex", 51 +# file-magic /(.*)(\x5crelax)/ +#} +# +## >0 search/4096,=\begin (len=6), ["LaTeX document text"], swap_endian=0 +#signature file-magic-auto464 { +# file-mime "text/x-tex", 51 +# file-magic /.*\x5c(input|begin)/ +#} # >0 beshort&,=-26368 (0x9900), ["PGP key public ring"], swap_endian=0 signature file-magic-auto470 { @@ -1710,29 +1520,6 @@ signature file-magic-auto486 { file-magic /(\xff[\xf0\xf1\xf8\xf9])/ } -# >0 beshort&fffffffffffffffe,=-30 (0xffe2), ["MPEG ADTS, layer III, v2.5"], swap_endian=0 -signature file-magic-auto487 { - file-mime "audio/mpeg", 50 - file-magic /(\xff[\xe2\xe3])/ -} - -# >0 beshort&fffffffffffffffe,=-10 (0xfff6), ["MPEG ADTS, layer I, v2"], swap_endian=0 -signature file-magic-auto488 { - file-mime "audio/mpeg", 50 - file-magic /(\xff[\xf6\xf7])/ -} - -# >0 beshort&fffffffffffffffe,=-14 (0xfff2), ["MPEG ADTS, layer III, v2"], swap_endian=0 -signature file-magic-auto489 { - file-mime "audio/mpeg", 50 - file-magic /(\xff[\xf2\xf3])/ -} - -# >0 beshort&fffffffffffffffe,=-4 (0xfffc), ["MPEG ADTS, layer II, v1"], swap_endian=0 -signature file-magic-auto490 { - file-mime "audio/mpeg", 50 - file-magic /(\xff[\xfc\xfd])/ -} # >0 beshort&,=-26367 (0x9901), ["GPG key public ring"], swap_endian=0 signature file-magic-auto492 { @@ -1764,11 +1551,11 @@ signature file-magic-auto507 { file-magic /(\x0b\x77)/ } -# >0 search/1,=This is Info file (len=17), ["GNU Info text"], swap_endian=0 -signature file-magic-auto528 { - file-mime "text/x-info", 47 - file-magic /(.*)(This is Info file)/ -} +## >0 search/1,=This is Info file (len=17), ["GNU Info text"], swap_endian=0 +#signature file-magic-auto528 { +# file-mime "text/x-info", 47 +# file-magic /(.*)(This is Info file)/ +#} # >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 # >>&0 search/8192,=[ (len=1), [""], swap_endian=0 @@ -1834,17 +1621,17 @@ signature file-magic-auto532 { file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([Ww][iI][nN][sS][oO][cC][kK][Cc][Rr][Cc][Ll][iI][sS][tT]|[Oo][Ee][Mm][Cc][Pp][Ll])])/ } -# >0 search/1,=0 search/1,=0 search/4096,=% -*-latex-*- (len=13), ["LaTeX document text"], swap_endian=0 -signature file-magic-auto558 { - file-mime "text/x-tex", 43 - file-magic /(.*)(\x25 \x2d\x2a\x2dlatex\x2d\x2a\x2d)/ -} +## >0 search/4096,=% -*-latex-*- (len=13), ["LaTeX document text"], swap_endian=0 +#signature file-magic-auto558 { +# file-mime "text/x-tex", 43 +# file-magic /(.*)(\x25 \x2d\x2a\x2dlatex\x2d\x2a\x2d)/ +#} # The use of non-sequential offsets and relational operations made the # autogenerated signature incorrrect. @@ -1912,59 +1699,59 @@ signature file-magic-auto578 { file-magic /(^dnl )/ } -# >0 search/4096,=(defparam (len=10), ["Lisp/Scheme program text"], swap_endian=0 -signature file-magic-auto583 { - file-mime "text/x-lisp", 40 - file-magic /(.*)(\x28defparam )/ -} - -# >0 search/4096,=(autoload (len=10), ["Lisp/Scheme program text"], swap_endian=0 -signature file-magic-auto584 { - file-mime "text/x-lisp", 40 - file-magic /(.*)(\x28autoload )/ -} - -# >0 search/1,=0 search/1,=/* XPM */ (len=9), ["X pixmap image text"], swap_endian=0 -signature file-magic-auto590 { - file-mime "image/x-xpmi", 39 - file-magic /(.*)(\x2f\x2a XPM \x2a\x2f)/ -} - -# >0 search/8192,="LIBHDR" (len=8), ["BCPL source text"], swap_endian=0 -signature file-magic-auto596 { - file-mime "text/x-bcpl", 38 - file-magic /(.*)(\x22LIBHDR\x22)/ -} - -# >0 search/4096,=(defvar (len=8), ["Lisp/Scheme program text"], swap_endian=0 -signature file-magic-auto598 { - file-mime "text/x-lisp", 38 - file-magic /(.*)(\x28defvar )/ -} - -# >0 search/1,=Only in (len=8), ["diff output text"], swap_endian=0 -signature file-magic-auto600 { - file-mime "text/x-diff", 38 - file-magic /(.*)(Only in )/ -} - -# >0 search/8192,="libhdr" (len=8), ["BCPL source text"], swap_endian=0 -signature file-magic-auto604 { - file-mime "text/x-bcpl", 38 - file-magic /(.*)(\x22libhdr\x22)/ -} - -# >0 search/4096,=(defun (len=7), ["Lisp/Scheme program text"], swap_endian=0 -signature file-magic-auto607 { - file-mime "text/x-lisp", 37 - file-magic /(.*)(\x28defun )/ -} +## >0 search/4096,=(defparam (len=10), ["Lisp/Scheme program text"], swap_endian=0 +#signature file-magic-auto583 { +# file-mime "text/x-lisp", 40 +# file-magic /(.*)(\x28defparam )/ +#} +# +## >0 search/4096,=(autoload (len=10), ["Lisp/Scheme program text"], swap_endian=0 +#signature file-magic-auto584 { +# file-mime "text/x-lisp", 40 +# file-magic /(.*)(\x28autoload )/ +#} +# +## >0 search/1,=0 search/1,=/* XPM */ (len=9), ["X pixmap image text"], swap_endian=0 +#signature file-magic-auto590 { +# file-mime "image/x-xpmi", 39 +# file-magic /(.*)(\x2f\x2a XPM \x2a\x2f)/ +#} +# +## >0 search/8192,="LIBHDR" (len=8), ["BCPL source text"], swap_endian=0 +#signature file-magic-auto596 { +# file-mime "text/x-bcpl", 38 +# file-magic /(.*)(\x22LIBHDR\x22)/ +#} +# +## >0 search/4096,=(defvar (len=8), ["Lisp/Scheme program text"], swap_endian=0 +#signature file-magic-auto598 { +# file-mime "text/x-lisp", 38 +# file-magic /(.*)(\x28defvar )/ +#} +# +## >0 search/1,=Only in (len=8), ["diff output text"], swap_endian=0 +#signature file-magic-auto600 { +# file-mime "text/x-diff", 38 +# file-magic /(.*)(Only in )/ +#} +# +## >0 search/8192,="libhdr" (len=8), ["BCPL source text"], swap_endian=0 +#signature file-magic-auto604 { +# file-mime "text/x-bcpl", 38 +# file-magic /(.*)(\x22libhdr\x22)/ +#} +# +## >0 search/4096,=(defun (len=7), ["Lisp/Scheme program text"], swap_endian=0 +#signature file-magic-auto607 { +# file-mime "text/x-lisp", 37 +# file-magic /(.*)(\x28defun )/ +#} # >0 regex,=^msgid (len=7), ["GNU gettext message catalogue text"], swap_endian=0 signature file-magic-auto608 { @@ -1973,7 +1760,7 @@ signature file-magic-auto608 { } # >0 search/4096,=(setq (len=6), ["Lisp/Scheme program text"], swap_endian=0 -signature file-magic-auto611 { - file-mime "text/x-lisp", 36 - file-magic /(.*)(\x28setq )/ -} +#signature file-magic-auto611 { +# file-mime "text/x-lisp", 36 +# file-magic /(.*)(\x28setq )/ +#} diff --git a/scripts/base/frameworks/files/magic/video.sig b/scripts/base/frameworks/files/magic/video.sig index 019372d687..bc0f24c46a 100644 --- a/scripts/base/frameworks/files/magic/video.sig +++ b/scripts/base/frameworks/files/magic/video.sig @@ -1,23 +1,19 @@ -# >0 string,=FLV (len=3), ["Macromedia Flash Video"], swap_endian=0 -signature file-magic-auto400 { +# Macromedia Flash Video +signature file-flv { file-mime "video/x-flv", 60 - file-magic /(FLV)/ + file-magic /^FLV/ } -# >4 leshort&,=-20719 (0xaf11), [""], swap_endian=0 -# >>8 leshort&,=320 (0x0140), [""], swap_endian=0 -# >>>10 leshort&,=200 (0x00c8), [""], swap_endian=0 -# >>>>12 leshort&,=8 (0x0008), ["FLI animation, 320x200x8"], swap_endian=0 -signature file-magic-auto452 { +# FLI animation +signature file-fli { file-mime "video/x-fli", 50 - file-magic /(.{4})(\x11\xaf)(.{2})(\x40\x01)(\xc8\x00)(\x08\x00)/ + file-magic /^.{4}\x11\xaf/ } -# >4 leshort&,=-20718 (0xaf12), [""], swap_endian=0 -# >>12 leshort&,=8 (0x0008), ["FLC animation"], swap_endian=0 -signature file-magic-auto453 { +# FLC animation +signature file-flc { file-mime "video/x-flc", 50 - file-magic /(.{4})(\x12\xaf)(.{6})(\x08\x00)/ + file-magic /^.{4}\x12\xaf/ } # Motion JPEG 2000 @@ -26,193 +22,74 @@ signature file-mj2 { file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}mjp2/ } -# >0 string,=\212MNG (len=4), ["MNG video data,"], swap_endian=0 -signature file-magic-auto274 { +# MNG video +signature file-mng { file-mime "video/x-mng", 70 - file-magic /(\x8aMNG)/ + file-magic /^\x8aMNG/ } -# >0 string,=\213JNG (len=4), ["JNG video data,"], swap_endian=0 -signature file-magic-auto275 { +# JNG video +signature file-jng { file-mime "video/x-jng", 70 - file-magic /(\x8bJNG)/ + file-magic /^\x8bJNG/ } -# >0 belong&,=443 (0x000001bb), [""], swap_endian=0 -signature file-magic-auto204 { - file-mime "video/mpeg", 71 - file-magic /(\x00\x00\x01\xbb)/ +# Generic MPEG container +signature file-mpeg { + file-mime "video/mpeg", 50 + file-magic /(\x00\x00\x01[\xb0-\xbb])/ } -# >0 belong&,=432 (0x000001b0), [""], swap_endian=0 -signature file-magic-auto206 { - file-mime "video/mp4v-es", 71 - file-magic /(\x00\x00\x01\xb0)/ -} - -# >0 belong&,=437 (0x000001b5), [""], swap_endian=0 -signature file-magic-auto207 { - file-mime "video/mp4v-es", 71 - file-magic /(\x00\x00\x01\xb5)/ -} - -# >0 belong&,=435 (0x000001b3), [""], swap_endian=0 -signature file-magic-auto209 { +# MPV +signature file-mpv { file-mime "video/mpv", 71 file-magic /(\x00\x00\x01\xb3)/ } -# >0 belong&,=1 (0x00000001), [""], swap_endian=0 -# >>4 byte&0000001f,=0x07, [""], swap_endian=0 -signature file-magic-auto211 { +# H.264 +signature file-h264 { file-mime "video/h264", 41 file-magic /(\x00\x00\x00\x01)([\x07\x27\x47\x67\x87\xa7\xc7\xe7])/ } -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xba, ["MPEG sequence"], swap_endian=0 -signature file-magic-auto213 { - file-mime "video/mpeg", 40 - file-magic /(\x00\x00\x01\xba)/ -} - -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xb0, ["MPEG sequence, v4"], swap_endian=0 -signature file-magic-auto214 { - file-mime "video/mpeg4-generic", 40 - file-magic /(\x00\x00\x01\xb0)/ -} - -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xb5, ["MPEG sequence, v4"], swap_endian=0 -signature file-magic-auto215 { - file-mime "video/mpeg4-generic", 40 - file-magic /(\x00\x00\x01\xb5)/ -} - -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xb3, ["MPEG sequence"], swap_endian=0 -signature file-magic-auto216 { - file-mime "video/mpeg", 40 - file-magic /(\x00\x00\x01\xb3)/ -} - -# >0 belong&,=442 (0x000001ba), [""], swap_endian=0 -# >>4 byte&,^0x40, [""], swap_endian=0 -signature file-magic-auto251 { - file-mime "video/mpeg", 21 - file-magic /(\x00\x00\x01\xba)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf])/ -} - -# >0 belong&,=440786851 (0x1a45dfa3), [""], swap_endian=0 -# >>4 search/4096,=B\202 (len=2), [""], swap_endian=0 -# >>>&1 string,=webm (len=4), ["WebM"], swap_endian=0 -signature file-magic-auto224 { +# WebM video +signature file-webm { file-mime "video/webm", 70 file-magic /(\x1a\x45\xdf\xa3)(.*)(B\x82)(.{1})(webm)/ } -# >0 belong&,=440786851 (0x1a45dfa3), [""], swap_endian=0 -# >>4 search/4096,=B\202 (len=2), [""], swap_endian=0 -# >>>&1 string,=matroska (len=8), ["Matroska data"], swap_endian=0 -signature file-magic-auto225 { +# Matroska video +signature file-matroska { file-mime "video/x-matroska", 110 file-magic /(\x1a\x45\xdf\xa3)(.*)(B\x82)(.{1})(matroska)/ } -# >0 belong&,=442 (0x000001ba), [""], swap_endian=0 -# >>4 byte&,&0x40, [""], swap_endian=0 -signature file-magic-auto250 { +# MP2P +signature file-mp2p { file-mime "video/mp2p", 21 - file-magic /(\x00\x00\x01\xba)([\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ + file-magic /\x00\x00\x01\xba([\x40-\x7f\xc0-\xff])/ } -# >0 string,=MOVI (len=4), ["Silicon Graphics movie file"], swap_endian=0 -signature file-magic-auto252 { +# Silicon Graphics video +signature file-sgi-movie { file-mime "video/x-sgi-movie", 70 - file-magic /(MOVI)/ + file-magic /^MOVI/ } -# >4 string,=moov (len=4), ["Apple QuickTime"], swap_endian=0 -signature file-magic-auto253 { +# Apple QuickTime movie +signature file-quicktime { file-mime "video/quicktime", 70 - file-magic /(.{4})(moov)/ + file-magic /^....(mdat|moov)/ } -# >4 string,=mdat (len=4), ["Apple QuickTime movie (unoptimized)"], swap_endian=0 -signature file-magic-auto254 { - file-mime "video/quicktime", 70 - file-magic /(.{4})(mdat)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=isom (len=4), [", MPEG v4 system, version 1"], swap_endian=0 -signature file-magic-auto257 { +# MPEG v4 video +signature file-mp4 { file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(isom)/ + file-magic /(.{4})(ftyp)(isom|mp4[12])/ } -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=mp41 (len=4), [", MPEG v4 system, version 1"], swap_endian=0 -signature file-magic-auto258 { - file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(mp41)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=mp42 (len=4), [", MPEG v4 system, version 2"], swap_endian=0 -signature file-magic-auto259 { - file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(mp42)/ -} - - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3ge (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto261 { +# 3GPP Video +signature file-3gpp { file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3ge)/ + file-magic /^....(ftyp)(3g[egps2]|avc1|mmp4)/ } - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3gg (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto262 { - file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3gg)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3gp (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto263 { - file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3gp)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3gs (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto264 { - file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3gs)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3g2 (len=3), [", MPEG v4 system, 3GPP2"], swap_endian=0 -signature file-magic-auto265 { - file-mime "video/3gpp2", 60 - file-magic /(.{4})(ftyp)(3g2)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=mmp4 (len=4), [", MPEG v4 system, 3GPP Mobile"], swap_endian=0 -signature file-magic-auto266 { - file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(mmp4)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=avc1 (len=4), [", MPEG v4 system, 3GPP JVT AVC"], swap_endian=0 -signature file-magic-auto267 { - file-mime "video/3gpp", 70 - file-magic /(.{4})(ftyp)(avc1)/ -} -