mirror of
https://github.com/zeek/zeek.git
synced 2025-10-10 02:28:21 +00:00
Merge remote-tracking branch 'origin/master' into topic/johanna/openflow
This commit is contained in:
Johanna Amann
commit
a51ee45e05
264 changed files with 7452 additions and 4927 deletions
|
|
@ -1,3 +1,9 @@
|
|||
@load-sigs ./archive
|
||||
@load-sigs ./audio
|
||||
@load-sigs ./font
|
||||
@load-sigs ./general
|
||||
@load-sigs ./image
|
||||
@load-sigs ./msoffice
|
||||
@load-sigs ./libmagic
|
||||
@load-sigs ./video
|
||||
|
||||
@load-sigs ./libmagic
|
||||
176
scripts/base/frameworks/files/magic/archive.sig
Normal file
176
scripts/base/frameworks/files/magic/archive.sig
Normal file
|
|
@ -0,0 +1,176 @@
|
|||
|
||||
signature file-tar {
|
||||
file-magic /^[[:print:]\x00]{100}([[:digit:]\x20]{7}\x00){3}([[:digit:]\x20]{11}\x00){2}([[:digit:]\x00\x20]{7}[\x20\x00])[0-7\x00]/
|
||||
file-mime "application/x-tar", 100
|
||||
}
|
||||
|
||||
# This is low priority so that files using zip as a
|
||||
# container will be identified correctly.
|
||||
signature file-zip {
|
||||
file-mime "application/zip", 10
|
||||
file-magic /^PK\x03\x04.{2}/
|
||||
}
|
||||
|
||||
# Multivolume Zip archive
|
||||
signature file-multi-zip {
|
||||
file-mime "application/zip", 10
|
||||
file-magic /^PK\x07\x08PK\x03\x04/
|
||||
}
|
||||
|
||||
# RAR
|
||||
signature file-rar {
|
||||
file-mime "application/x-rar", 70
|
||||
file-magic /^Rar!/
|
||||
}
|
||||
|
||||
# GZIP
|
||||
signature file-gzip {
|
||||
file-mime "application/x-gzip", 100
|
||||
file-magic /\x1f\x8b/
|
||||
}
|
||||
|
||||
# Microsoft Cabinet
|
||||
signature file-ms-cab {
|
||||
file-mime "application/vnd.ms-cab-compressed", 110
|
||||
file-magic /^MSCF\x00\x00\x00\x00/
|
||||
}
|
||||
|
||||
# Mac OS X DMG files
|
||||
signature file-dmg {
|
||||
file-magic /^(\x78\x01\x73\x0D\x62\x62\x60|\x78\xDA\x63\x60\x18\x05|\x78\x01\x63\x60\x18\x05|\x78\xDA\x73\x0D|\x78[\x01\xDA]\xED[\xD0-\xD9])/
|
||||
file-mime "application/x-dmg", 100
|
||||
}
|
||||
|
||||
# XAR (eXtensible ARchive) format.
|
||||
# Mac OS X uses this for the .pkg format.
|
||||
signature file-xar {
|
||||
file-magic /^xar\!/
|
||||
file-mime "application/x-xar", 100
|
||||
}
|
||||
|
||||
# RPM
|
||||
signature file-magic-auto352 {
|
||||
file-mime "application/x-rpm", 70
|
||||
file-magic /^(drpm|\xed\xab\xee\xdb)/
|
||||
}
|
||||
|
||||
# StuffIt
|
||||
signature file-stuffit {
|
||||
file-mime "application/x-stuffit", 70
|
||||
file-magic /^(SIT\x21|StuffIt)/
|
||||
}
|
||||
|
||||
# Archived data
|
||||
signature file-x-archive {
|
||||
file-mime "application/x-archive", 70
|
||||
file-magic /^!?<ar(ch)?>/
|
||||
}
|
||||
|
||||
# ARC archive data
|
||||
signature file-arc {
|
||||
file-mime "application/x-arc", 70
|
||||
file-magic /^[\x00-\x7f]{2}[\x02-\x0a\x14\x48]\x1a/
|
||||
}
|
||||
|
||||
# EET archive
|
||||
signature file-eet {
|
||||
file-mime "application/x-eet", 70
|
||||
file-magic /^\x1e\xe7\xff\x00/
|
||||
}
|
||||
|
||||
# Zoo archive
|
||||
signature file-zoo {
|
||||
file-mime "application/x-zoo", 70
|
||||
file-magic /^.{20}\xdc\xa7\xc4\xfd/
|
||||
}
|
||||
|
||||
# LZ4 compressed data (legacy format)
|
||||
signature file-lz4-legacy {
|
||||
file-mime "application/x-lz4", 70
|
||||
file-magic /(\x02\x21\x4c\x18)/
|
||||
}
|
||||
|
||||
# LZ4 compressed data
|
||||
signature file-lz4 {
|
||||
file-mime "application/x-lz4", 70
|
||||
file-magic /^\x04\x22\x4d\x18/
|
||||
}
|
||||
|
||||
# LRZIP compressed data
|
||||
signature file-lrzip {
|
||||
file-mime "application/x-lrzip", 1
|
||||
file-magic /^LRZI/
|
||||
}
|
||||
|
||||
# LZIP compressed data
|
||||
signature file-lzip {
|
||||
file-mime "application/x-lzip", 70
|
||||
file-magic /^LZIP/
|
||||
}
|
||||
|
||||
# Self-extracting PKZIP archive
|
||||
signature file-magic-auto434 {
|
||||
file-mime "application/zip", 340
|
||||
file-magic /^MZ.{28}(Copyright 1989\x2d1990 PKWARE Inc|PKLITE Copr)\x2e/
|
||||
}
|
||||
|
||||
# LHA archive (LZH)
|
||||
signature file-lzh {
|
||||
file-mime "application/x-lzh", 80
|
||||
file-magic /^.{2}-(lh[ abcdex0-9]|lz[s2-8]|lz[s2-8]|pm[s012]|pc1)-/
|
||||
}
|
||||
|
||||
# WARC Archive
|
||||
signature file-warc {
|
||||
file-mime "application/warc", 50
|
||||
file-magic /^WARC\x2f/
|
||||
}
|
||||
|
||||
# 7-zip archive data
|
||||
signature file-7zip {
|
||||
file-mime "application/x-7z-compressed", 50
|
||||
file-magic /^7z\xbc\xaf\x27\x1c/
|
||||
}
|
||||
|
||||
# XZ compressed data
|
||||
signature file-xz {
|
||||
file-mime "application/x-xz", 90
|
||||
file-magic /^\xfd7zXZ\x00/
|
||||
}
|
||||
|
||||
# LHa self-extracting archive
|
||||
signature file-magic-auto436 {
|
||||
file-mime "application/x-lha", 120
|
||||
file-magic /^MZ.{34}LH[aA]\x27s SFX/
|
||||
}
|
||||
|
||||
# ARJ archive data
|
||||
signature file-arj {
|
||||
file-mime "application/x-arj", 50
|
||||
file-magic /^\x60\xea/
|
||||
}
|
||||
|
||||
# Byte-swapped cpio archive
|
||||
signature file-bs-cpio {
|
||||
file-mime "application/x-cpio", 50
|
||||
file-magic /(\x71\xc7|\xc7\x71)/
|
||||
}
|
||||
|
||||
# CPIO archive
|
||||
signature file-cpio {
|
||||
file-mime "application/x-cpio", 50
|
||||
file-magic /^(\xc7\x71|\x71\xc7)/
|
||||
}
|
||||
|
||||
# Compress'd data
|
||||
signature file-compress {
|
||||
file-mime "application/x-compress", 50
|
||||
file-magic /^\x1f\x9d/
|
||||
}
|
||||
|
||||
# LZMA compressed data
|
||||
signature file-lzma {
|
||||
file-mime "application/x-lzma", 71
|
||||
file-magic /^\x5d\x00\x00/
|
||||
}
|
||||
|
||||
13
scripts/base/frameworks/files/magic/audio.sig
Normal file
13
scripts/base/frameworks/files/magic/audio.sig
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
|
||||
# MPEG v3 audio
|
||||
signature file-mpeg-audio {
|
||||
file-mime "audio/mpeg", 20
|
||||
file-magic /^\xff[\xe2\xe3\xf2\xf3\xf6\xf7\xfa\xfb\xfc\xfd]/
|
||||
}
|
||||
|
||||
# MPEG v4 audio
|
||||
signature file-m4a {
|
||||
file-mime "audio/m4a", 70
|
||||
file-magic /^....ftyp(m4a)/
|
||||
}
|
||||
|
||||
41
scripts/base/frameworks/files/magic/font.sig
Normal file
41
scripts/base/frameworks/files/magic/font.sig
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
|
||||
# Web Open Font Format
|
||||
signature file-woff {
|
||||
file-magic /^wOFF/
|
||||
file-mime "application/font-woff", 70
|
||||
}
|
||||
|
||||
# TrueType font
|
||||
signature file-ttf {
|
||||
file-mime "application/x-font-ttf", 80
|
||||
file-magic /^\x00\x01\x00\x00\x00/
|
||||
}
|
||||
|
||||
signature file-embedded-opentype {
|
||||
file-mime "application/vnd.ms-fontobject", 50
|
||||
file-magic /^.{34}LP/
|
||||
}
|
||||
|
||||
# X11 SNF font
|
||||
signature file-snf {
|
||||
file-mime "application/x-font-sfn", 70
|
||||
file-magic /^(\x04\x00\x00\x00|\x00\x00\x00\x04).{100}(\x04\x00\x00\x00|\x00\x00\x00\x04)/
|
||||
}
|
||||
|
||||
# OpenType font
|
||||
signature file-opentype {
|
||||
file-mime "application/vnd.ms-opentype", 70
|
||||
file-magic /^OTTO/
|
||||
}
|
||||
|
||||
# FrameMaker Font file
|
||||
signature file-maker-screen-font {
|
||||
file-mime "application/x-mif", 190
|
||||
file-magic /^\x3cMakerScreenFont/
|
||||
}
|
||||
|
||||
# >0 string,=SplineFontDB: (len=13), ["Spline Font Database "], swap_endian=0
|
||||
signature file-spline-font-db {
|
||||
file-mime "application/vnd.font-fontforge-sfd", 160
|
||||
file-magic /^SplineFontDB\x3a/
|
||||
}
|
||||
|
|
@ -1,18 +1,87 @@
|
|||
# General purpose file magic signatures.
|
||||
|
||||
# Plaintext
|
||||
# (Including BOMs for UTF-8, 16, and 32)
|
||||
signature file-plaintext {
|
||||
file-magic /^([[:print:][:space:]]{10})/
|
||||
file-mime "text/plain", -20
|
||||
file-mime "text/plain", -20
|
||||
file-magic /^(\xef\xbb\xbf|(\x00\x00)?\xfe\xff|\xff\xfe(\x00\x00)?)?[[:space:]\x20-\x7E]{10}/
|
||||
}
|
||||
|
||||
signature file-tar {
|
||||
file-magic /^[[:print:]\x00]{100}([[:digit:]\x20]{7}\x00){3}([[:digit:]\x20]{11}\x00){2}([[:digit:]\x00\x20]{7}[\x20\x00])[0-7\x00]/
|
||||
file-mime "application/x-tar", 100
|
||||
signature file-json {
|
||||
file-mime "text/json", 1
|
||||
file-magic /^(\xef\xbb\xbf)?[\x0d\x0a[:blank:]]*\{[\x0d\x0a[:blank:]]*(["][^"]{1,}["]|[a-zA-Z][a-zA-Z0-9\\_]*)[\x0d\x0a[:blank:]]*:[\x0d\x0a[:blank:]]*(["]|\[|\{|[0-9]|true|false)/
|
||||
}
|
||||
|
||||
signature file-zip {
|
||||
file-mime "application/zip", 10
|
||||
file-magic /^PK\x03\x04.{2}/
|
||||
signature file-json2 {
|
||||
file-mime "text/json", 1
|
||||
file-magic /^(\xef\xbb\xbf)?[\x0d\x0a[:blank:]]*\[[\x0d\x0a[:blank:]]*(((["][^"]{1,}["]|[0-9]{1,}(\.[0-9]{1,})?|true|false)[\x0d\x0a[:blank:]]*,)|\{|\[)[\x0d\x0a[:blank:]]*/
|
||||
}
|
||||
|
||||
# Match empty JSON documents.
|
||||
signature file-json3 {
|
||||
file-mime "text/json", 0
|
||||
file-magic /^(\xef\xbb\xbf)?[\x0d\x0a[:blank:]]*(\[\]|\{\})[\x0d\x0a[:blank:]]*$/
|
||||
}
|
||||
|
||||
signature file-xml {
|
||||
file-mime "application/xml", 10
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<\?xml /
|
||||
}
|
||||
|
||||
signature file-xhtml {
|
||||
file-mime "text/html", 100
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<(![dD][oO][cC][tT][yY][pP][eE] {1,}[hH][tT][mM][lL]|[hH][tT][mM][lL]|[mM][eE][tT][aA] {1,}[hH][tT][tT][pP]-[eE][qQ][uU][iI][vV])/
|
||||
}
|
||||
|
||||
signature file-html {
|
||||
file-mime "text/html", 49
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<![dD][oO][cC][tT][yY][pP][eE] {1,}[hH][tT][mM][lL]/
|
||||
}
|
||||
|
||||
signature file-html2 {
|
||||
file-mime "text/html", 20
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<([hH][eE][aA][dD]|[hH][tT][mM][lL]|[tT][iI][tT][lL][eE]|[bB][oO][dD][yY])/
|
||||
}
|
||||
|
||||
signature file-rss {
|
||||
file-mime "text/rss", 90
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<[rR][sS][sS]/
|
||||
}
|
||||
|
||||
signature file-atom {
|
||||
file-mime "text/atom", 100
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<([rR][sS][sS][^>]*xmlns:atom|[fF][eE][eE][dD][^>]*xmlns=["']?http:\/\/www.w3.org\/2005\/Atom["']?)/
|
||||
}
|
||||
|
||||
signature file-soap {
|
||||
file-mime "application/soap+xml", 49
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<[sS][oO][aA][pP](-[eE][nN][vV])?:[eE][nN][vV][eE][lL][oO][pP][eE]/
|
||||
}
|
||||
|
||||
signature file-cross-domain-policy {
|
||||
file-mime "text/x-cross-domain-policy", 49
|
||||
file-magic /^([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<![dD][oO][cC][tT][yY][pP][eE] {1,}[cC][rR][oO][sS][sS]-[dD][oO][mM][aA][iI][nN]-[pP][oO][lL][iI][cC][yY]/
|
||||
}
|
||||
|
||||
signature file-cross-domain-policy2 {
|
||||
file-mime "text/x-cross-domain-policy", 49
|
||||
file-magic /^([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<[cC][rR][oO][sS][sS]-[dD][oO][mM][aA][iI][nN]-[pP][oO][lL][iI][cC][yY]/
|
||||
}
|
||||
|
||||
signature file-xmlrpc {
|
||||
file-mime "application/xml-rpc", 49
|
||||
file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*(<!--.*-->)?[\x0d\x0a[:blank:]]*)*<[mM][eE][tT][hH][oO][dD][rR][eE][sS][pP][oO][nN][sS][eE]>/
|
||||
}
|
||||
|
||||
signature file-coldfusion {
|
||||
file-mime "magnus-internal/cold-fusion", 20
|
||||
file-magic /^([\x0d\x0a[:blank:]]*(<!--.*-->)?)*<(CFPARAM|CFSET|CFIF)/
|
||||
}
|
||||
|
||||
# Microsoft LNK files
|
||||
signature file-lnk {
|
||||
file-mime "application/x-ms-shortcut", 49
|
||||
file-magic /^\x4C\x00\x00\x00\x01\x14\x02\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x10\x00\x00\x00\x46/
|
||||
}
|
||||
|
||||
signature file-jar {
|
||||
|
|
@ -21,8 +90,20 @@ signature file-jar {
|
|||
}
|
||||
|
||||
signature file-java-applet {
|
||||
file-magic /^\xca\xfe\xba\xbe...[\x2e-\x34]/
|
||||
file-mime "application/x-java-applet", 71
|
||||
file-magic /^\xca\xfe\xba\xbe...[\x2d-\x34]/
|
||||
}
|
||||
|
||||
# OCSP requests over HTTP.
|
||||
signature file-ocsp-request {
|
||||
file-magic /^.{11,19}\x06\x05\x2b\x0e\x03\x02\x1a/
|
||||
file-mime "application/ocsp-request", 71
|
||||
}
|
||||
|
||||
# OCSP responses over HTTP.
|
||||
signature file-ocsp-response {
|
||||
file-magic /^.{11,19}\x06\x09\x2B\x06\x01\x05\x05\x07\x30\x01\x01/
|
||||
file-mime "application/ocsp-response", 71
|
||||
}
|
||||
|
||||
# Shockwave flash
|
||||
|
|
@ -37,12 +118,6 @@ signature file-tnef {
|
|||
file-mime "application/vnd.ms-tnef", 100
|
||||
}
|
||||
|
||||
# Mac OS X DMG files
|
||||
signature file-dmg {
|
||||
file-magic /^(\x78\x01\x73\x0D\x62\x62\x60|\x78\xDA\x63\x60\x18\x05|\x78\x01\x63\x60\x18\x05|\x78\xDA\x73\x0D|\x78[\x01\xDA]\xED[\xD0-\xD9])/
|
||||
file-mime "application/x-dmg", 100
|
||||
}
|
||||
|
||||
# Mac OS X Mach-O executable
|
||||
signature file-mach-o {
|
||||
file-magic /^[\xce\xcf]\xfa\xed\xfe/
|
||||
|
|
@ -55,13 +130,6 @@ signature file-mach-o-universal {
|
|||
file-mime "application/x-mach-o-executable", 100
|
||||
}
|
||||
|
||||
# XAR (eXtensible ARchive) format.
|
||||
# Mac OS X uses this for the .pkg format.
|
||||
signature file-xar {
|
||||
file-magic /^xar\!/
|
||||
file-mime "application/x-xar", 100
|
||||
}
|
||||
|
||||
signature file-pkcs7 {
|
||||
file-magic /^MIME-Version:.*protocol=\"application\/pkcs7-signature\"/
|
||||
file-mime "application/pkcs7-signature", 100
|
||||
|
|
@ -79,16 +147,6 @@ signature file-jnlp {
|
|||
file-mime "application/x-java-jnlp-file", 100
|
||||
}
|
||||
|
||||
signature file-ico {
|
||||
file-magic /^\x00\x00\x01\x00/
|
||||
file-mime "image/x-icon", 70
|
||||
}
|
||||
|
||||
signature file-cur {
|
||||
file-magic /^\x00\x00\x02\x00/
|
||||
file-mime "image/x-cursor", 70
|
||||
}
|
||||
|
||||
signature file-pcap {
|
||||
file-magic /^(\xa1\xb2\xc3\xd4|\xd4\xc3\xb2\xa1)/
|
||||
file-mime "application/vnd.tcpdump.pcap", 70
|
||||
|
|
@ -119,7 +177,58 @@ signature file-python {
|
|||
file-mime "text/x-python", 60
|
||||
}
|
||||
|
||||
signature file-awk {
|
||||
file-mime "text/x-awk", 60
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?(g|n)?awk/
|
||||
}
|
||||
|
||||
signature file-tcl {
|
||||
file-mime "text/x-tcl", 60
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?(wish|tcl)/
|
||||
}
|
||||
|
||||
signature file-lua {
|
||||
file-mime "text/x-lua", 49
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?lua/
|
||||
}
|
||||
|
||||
signature file-javascript {
|
||||
file-mime "application/javascript", 60
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?node(js)?/
|
||||
}
|
||||
|
||||
signature file-javascript2 {
|
||||
file-mime "application/javascript", 60
|
||||
file-magic /^[\x0d\x0a[:blank:]]*<[sS][cC][rR][iI][pP][tT][[:blank:]]+([tT][yY][pP][eE]|[lL][aA][nN][gG][uU][aA][gG][eE])=['"]?([tT][eE][xX][tT]\/)?[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]/
|
||||
}
|
||||
|
||||
signature file-javascript3 {
|
||||
file-mime "application/javascript", 60
|
||||
# This seems to be a somewhat common idiom in javascript.
|
||||
file-magic /^[\x0d\x0a[:blank:]]*for \(;;\);/
|
||||
}
|
||||
|
||||
signature file-javascript4 {
|
||||
file-mime "application/javascript", 60
|
||||
file-magic /^[\x0d\x0a[:blank:]]*document\.write(ln)?[:blank:]?\(/
|
||||
}
|
||||
|
||||
signature file-javascript5 {
|
||||
file-mime "application/javascript", 60
|
||||
file-magic /^\(function\(\)[[:blank:]\n]*\{/
|
||||
}
|
||||
|
||||
signature file-javascript6 {
|
||||
file-mime "application/javascript", 60
|
||||
file-magic /^[\x0d\x0a[:blank:]]*<script>[\x0d\x0a[:blank:]]*(var|function) /
|
||||
}
|
||||
|
||||
signature file-php {
|
||||
file-mime "text/x-php", 60
|
||||
file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?php/
|
||||
}
|
||||
|
||||
signature file-php2 {
|
||||
file-magic /^.*<\?php/
|
||||
file-mime "text/x-php", 40
|
||||
}
|
||||
|
|
@ -135,3 +244,23 @@ signature file-skp {
|
|||
file-magic /^\xFF\xFE\xFF\x0E\x53\x00\x6B\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4D\x00\x6F\x00\x64\x00\x65\x00\x6C\x00/
|
||||
file-mime "application/skp", 100
|
||||
}
|
||||
|
||||
signature file-elf-object {
|
||||
file-mime "application/x-object", 50
|
||||
file-magic /\x7fELF[\x01\x02](\x01.{10}\x01\x00|\x02.{10}\x00\x01)/
|
||||
}
|
||||
|
||||
signature file-elf {
|
||||
file-mime "application/x-executable", 50
|
||||
file-magic /\x7fELF[\x01\x02](\x01.{10}\x02\x00|\x02.{10}\x00\x02)/
|
||||
}
|
||||
|
||||
signature file-elf-sharedlib {
|
||||
file-mime "application/x-sharedlib", 50
|
||||
file-magic /\x7fELF[\x01\x02](\x01.{10}\x03\x00|\x02.{10}\x00\x03)/
|
||||
}
|
||||
|
||||
signature file-elf-coredump {
|
||||
file-mime "application/x-coredump", 50
|
||||
file-magic /\x7fELF[\x01\x02](\x01.{10}\x04\x00|\x02.{10}\x00\x04)/
|
||||
}
|
||||
|
|
|
|||
166
scripts/base/frameworks/files/magic/image.sig
Normal file
166
scripts/base/frameworks/files/magic/image.sig
Normal file
|
|
@ -0,0 +1,166 @@
|
|||
|
||||
signature file-tiff {
|
||||
file-mime "image/tiff", 70
|
||||
file-magic /^(MM\x00[\x2a\x2b]|II[\x2a\x2b]\x00)/
|
||||
}
|
||||
|
||||
signature file-gif {
|
||||
file-mime "image/gif", 70
|
||||
file-magic /^GIF8/
|
||||
}
|
||||
|
||||
# JPEG image
|
||||
signature file-jpeg {
|
||||
file-mime "image/jpeg", 52
|
||||
file-magic /^\xff\xd8/
|
||||
}
|
||||
|
||||
signature file-bmp {
|
||||
file-mime "image/x-ms-bmp", 50
|
||||
file-magic /BM.{12}[\x0c\x28\x40\x6c\x7c\x80]\x00/
|
||||
}
|
||||
|
||||
signature file-ico {
|
||||
file-magic /^\x00\x00\x01\x00/
|
||||
file-mime "image/x-icon", 70
|
||||
}
|
||||
|
||||
signature file-cur {
|
||||
file-magic /^\x00\x00\x02\x00/
|
||||
file-mime "image/x-cursor", 70
|
||||
}
|
||||
|
||||
signature file-magic-auto289 {
|
||||
file-mime "image/vnd.adobe.photoshop", 70
|
||||
file-magic /^8BPS/
|
||||
}
|
||||
|
||||
signature file-png {
|
||||
file-mime "image/png", 110
|
||||
file-magic /^\x89PNG/
|
||||
}
|
||||
|
||||
# JPEG 2000
|
||||
signature file-jp2 {
|
||||
file-mime "image/jp2", 60
|
||||
file-magic /.{4}ftypjp2/
|
||||
}
|
||||
|
||||
# JPEG 2000
|
||||
signature file-jp22 {
|
||||
file-mime "image/jp2", 70
|
||||
file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jp2 /
|
||||
}
|
||||
|
||||
# JPEG 2000
|
||||
signature file-jpx {
|
||||
file-mime "image/jpx", 70
|
||||
file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jpx /
|
||||
}
|
||||
|
||||
# JPEG 2000
|
||||
signature file-jpm {
|
||||
file-mime "image/jpm", 70
|
||||
file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jpm /
|
||||
}
|
||||
|
||||
# Xcursor image
|
||||
signature file-x-cursor {
|
||||
file-mime "image/x-xcursor", 70
|
||||
file-magic /^Xcur/
|
||||
}
|
||||
|
||||
# NIFF image
|
||||
signature file-niff {
|
||||
file-mime "image/x-niff", 70
|
||||
file-magic /^IIN1/
|
||||
}
|
||||
|
||||
# OpenEXR image
|
||||
signature file-openexr {
|
||||
file-mime "image/x-exr", 70
|
||||
file-magic /^\x76\x2f\x31\x01/
|
||||
}
|
||||
|
||||
# DPX image
|
||||
signature file-dpx {
|
||||
file-mime "image/x-dpx", 70
|
||||
file-magic /^SDPX/
|
||||
}
|
||||
|
||||
# Cartesian Perceptual Compression image
|
||||
signature file-cpi {
|
||||
file-mime "image/x-cpi", 70
|
||||
file-magic /(CPC\xb2)/
|
||||
}
|
||||
|
||||
signature file-orf {
|
||||
file-mime "image/x-olympus-orf", 70
|
||||
file-magic /IIR[OS]|MMOR/
|
||||
}
|
||||
|
||||
# Foveon X3F raw image
|
||||
signature file-x3r {
|
||||
file-mime "image/x-x3f", 70
|
||||
file-magic /^FOVb/
|
||||
}
|
||||
|
||||
# Paint.NET image
|
||||
signature file-paint-net {
|
||||
file-mime "image/x-paintnet", 70
|
||||
file-magic /^PDN3/
|
||||
}
|
||||
|
||||
# Corel Draw Picture
|
||||
signature file-coreldraw {
|
||||
file-mime "image/x-coreldraw", 70
|
||||
file-magic /^RIFF....CDR[A6]/
|
||||
}
|
||||
|
||||
# Netpbm PAM image
|
||||
signature file-netbpm{
|
||||
file-mime "image/x-portable-pixmap", 50
|
||||
file-magic /^P7/
|
||||
}
|
||||
|
||||
# JPEG 2000 image
|
||||
signature file-jpeg-2000 {
|
||||
file-mime "image/jp2", 50
|
||||
file-magic /^....jP/
|
||||
}
|
||||
|
||||
# DjVU Images
|
||||
signature file-djvu {
|
||||
file-mime "image/vnd.djvu", 70
|
||||
file-magic /AT\x26TFORM.{4}(DJV[MUI]|THUM)/
|
||||
}
|
||||
|
||||
# DWG AutoDesk AutoCAD
|
||||
signature file-dwg {
|
||||
file-mime "image/vnd.dwg", 90
|
||||
file-magic /^(AC[12]\.|AC10)/
|
||||
}
|
||||
|
||||
# GIMP XCF image
|
||||
signature file-gimp-xcf {
|
||||
file-mime "image/x-xcf", 110
|
||||
file-magic /^gimp xcf/
|
||||
}
|
||||
|
||||
# Polar Monitor Bitmap text
|
||||
signature file-polar-monitor-bitmap {
|
||||
file-mime "image/x-polar-monitor-bitmap", 160
|
||||
file-magic /^\x5bBitmapInfo2\x5d/
|
||||
}
|
||||
|
||||
# Award BIOS bitmap
|
||||
signature file-award-bitmap {
|
||||
file-mime "image/x-award-bmp", 20
|
||||
file-magic /^AWBM/
|
||||
}
|
||||
|
||||
# Award BIOS Logo, 136 x 84
|
||||
signature file-award-bios-logo {
|
||||
file-mime "image/x-award-bioslogo", 50
|
||||
file-magic /^\x11[\x06\x09]/
|
||||
}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -26,3 +26,9 @@ signature file-pptx {
|
|||
file-magic /^PK\x03\x04.{26}(\[Content_Types\]\.xml|_rels\x2f\.rels|ppt\x2f).*PK\x03\x04.{26}ppt\x2f/
|
||||
file-mime "application/vnd.openxmlformats-officedocument.presentationml.presentation", 80
|
||||
}
|
||||
|
||||
signature file-msaccess {
|
||||
file-mime "application/x-msaccess", 180
|
||||
file-magic /.{4}Standard (Jet|ACE) DB\x00/
|
||||
}
|
||||
|
||||
|
|
|
|||
96
scripts/base/frameworks/files/magic/video.sig
Normal file
96
scripts/base/frameworks/files/magic/video.sig
Normal file
|
|
@ -0,0 +1,96 @@
|
|||
|
||||
# Macromedia Flash Video
|
||||
signature file-flv {
|
||||
file-mime "video/x-flv", 60
|
||||
file-magic /^FLV/
|
||||
}
|
||||
|
||||
# FLI animation
|
||||
signature file-fli {
|
||||
file-mime "video/x-fli", 50
|
||||
file-magic /^.{4}\x11\xaf/
|
||||
}
|
||||
|
||||
# FLC animation
|
||||
signature file-flc {
|
||||
file-mime "video/x-flc", 50
|
||||
file-magic /^.{4}\x12\xaf/
|
||||
}
|
||||
|
||||
# Motion JPEG 2000
|
||||
signature file-mj2 {
|
||||
file-mime "video/mj2", 70
|
||||
file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}mjp2/
|
||||
}
|
||||
|
||||
# MNG video
|
||||
signature file-mng {
|
||||
file-mime "video/x-mng", 70
|
||||
file-magic /^\x8aMNG/
|
||||
}
|
||||
|
||||
# JNG video
|
||||
signature file-jng {
|
||||
file-mime "video/x-jng", 70
|
||||
file-magic /^\x8bJNG/
|
||||
}
|
||||
|
||||
# Generic MPEG container
|
||||
signature file-mpeg {
|
||||
file-mime "video/mpeg", 50
|
||||
file-magic /(\x00\x00\x01[\xb0-\xbb])/
|
||||
}
|
||||
|
||||
# MPV
|
||||
signature file-mpv {
|
||||
file-mime "video/mpv", 71
|
||||
file-magic /(\x00\x00\x01\xb3)/
|
||||
}
|
||||
|
||||
# H.264
|
||||
signature file-h264 {
|
||||
file-mime "video/h264", 41
|
||||
file-magic /(\x00\x00\x00\x01)([\x07\x27\x47\x67\x87\xa7\xc7\xe7])/
|
||||
}
|
||||
|
||||
# WebM video
|
||||
signature file-webm {
|
||||
file-mime "video/webm", 70
|
||||
file-magic /(\x1a\x45\xdf\xa3)(.*)(B\x82)(.{1})(webm)/
|
||||
}
|
||||
|
||||
# Matroska video
|
||||
signature file-matroska {
|
||||
file-mime "video/x-matroska", 110
|
||||
file-magic /(\x1a\x45\xdf\xa3)(.*)(B\x82)(.{1})(matroska)/
|
||||
}
|
||||
|
||||
# MP2P
|
||||
signature file-mp2p {
|
||||
file-mime "video/mp2p", 21
|
||||
file-magic /\x00\x00\x01\xba([\x40-\x7f\xc0-\xff])/
|
||||
}
|
||||
|
||||
# Silicon Graphics video
|
||||
signature file-sgi-movie {
|
||||
file-mime "video/x-sgi-movie", 70
|
||||
file-magic /^MOVI/
|
||||
}
|
||||
|
||||
# Apple QuickTime movie
|
||||
signature file-quicktime {
|
||||
file-mime "video/quicktime", 70
|
||||
file-magic /^....(mdat|moov)/
|
||||
}
|
||||
|
||||
# MPEG v4 video
|
||||
signature file-mp4 {
|
||||
file-mime "video/mp4", 70
|
||||
file-magic /^....ftyp(isom|mp4[12])/
|
||||
}
|
||||
|
||||
# 3GPP Video
|
||||
signature file-3gpp {
|
||||
file-mime "video/3gpp", 60
|
||||
file-magic /^....ftyp(3g[egps2]|avc1|mmp4)/
|
||||
}
|
||||
|
|
@ -129,12 +129,11 @@ export {
|
|||
## files based on the detected mime type of the file.
|
||||
const analyze_by_mime_type_automatically = T &redef;
|
||||
|
||||
## The default setting for if the file reassembler is enabled for
|
||||
## each file.
|
||||
## The default setting for file reassembly.
|
||||
const enable_reassembler = T &redef;
|
||||
|
||||
## The default per-file reassembly buffer size.
|
||||
const reassembly_buffer_size = 1048576 &redef;
|
||||
const reassembly_buffer_size = 524288 &redef;
|
||||
|
||||
## Allows the file reassembler to be used if it's necessary because the
|
||||
## file is transferred out of order.
|
||||
|
|
@ -484,16 +483,19 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
|
|||
add f$info$rx_hosts[f$is_orig ? cid$resp_h : cid$orig_h];
|
||||
}
|
||||
|
||||
event file_mime_type(f: fa_file, mime_type: string) &priority=10
|
||||
event file_sniff(f: fa_file, meta: fa_metadata) &priority=10
|
||||
{
|
||||
set_info(f);
|
||||
|
||||
f$info$mime_type = mime_type;
|
||||
if ( ! meta?$mime_type )
|
||||
return;
|
||||
|
||||
f$info$mime_type = meta$mime_type;
|
||||
|
||||
if ( analyze_by_mime_type_automatically &&
|
||||
mime_type in mime_type_to_analyzers )
|
||||
meta$mime_type in mime_type_to_analyzers )
|
||||
{
|
||||
local analyzers = mime_type_to_analyzers[mime_type];
|
||||
local analyzers = mime_type_to_analyzers[meta$mime_type];
|
||||
for ( a in analyzers )
|
||||
{
|
||||
add f$info$analyzers[Files::analyzer_name(a)];
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue