diff --git a/scripts/base/frameworks/files/magic/__load__.bro b/scripts/base/frameworks/files/magic/__load__.bro index 19a0090255..34115f0a55 100644 --- a/scripts/base/frameworks/files/magic/__load__.bro +++ b/scripts/base/frameworks/files/magic/__load__.bro @@ -1,5 +1,6 @@ @load-sigs ./archive @load-sigs ./audio +@load-sigs ./font @load-sigs ./general @load-sigs ./image @load-sigs ./msoffice diff --git a/scripts/base/frameworks/files/magic/font.sig b/scripts/base/frameworks/files/magic/font.sig new file mode 100644 index 0000000000..f4f7d77e48 --- /dev/null +++ b/scripts/base/frameworks/files/magic/font.sig @@ -0,0 +1,40 @@ +# Web Open Font Format +signature file-woff { + file-magic /^wOFF/ + file-mime "application/font-woff", 70 +} + +# TrueType font +signature file-ttf { + file-mime "application/x-font-ttf", 80 + file-magic /^\x00\x01\x00\x00\x00/ +} + +signature file-embedded-opentype { + file-mime "application/vnd.ms-fontobject", 50 + file-magic /^.{34}LP/ +} + +# X11 SNF font +signature file-snf { + file-mime "application/x-font-sfn", 70 + file-magic /^(\x04\x00\x00\x00|\x00\x00\x00\x04).{100}(\x04\x00\x00\x00|\x00\x00\x00\x04)/ +} + +# OpenType font +signature file-opentype { + file-mime "application/vnd.ms-opentype", 70 + file-magic /^OTTO/ +} + +# FrameMaker Font file +signature file-maker-screen-font { + file-mime "application/x-mif", 190 + file-magic /^\x3cMakerScreenFont/ +} + +# >0 string,=SplineFontDB: (len=13), ["Spline Font Database "], swap_endian=0 +signature file-spline-font-db { + file-mime "application/vnd.font-fontforge-sfd", 160 + file-magic /^SplineFontDB\x3a/ +} diff --git a/scripts/base/frameworks/files/magic/general.sig b/scripts/base/frameworks/files/magic/general.sig index e1d3cc9b03..2ef99c31fc 100644 --- a/scripts/base/frameworks/files/magic/general.sig +++ b/scripts/base/frameworks/files/magic/general.sig @@ -10,12 +10,18 @@ signature file-plaintext { # This can't go well... signature file-json { file-mime "text/json", 1 - file-magic /^(\xef\xbb\xbf)?[\x0d\x0a[:blank:]]*\{[\x0d\x0a[:blank:]]*(['"][a-zA-Z\\][a-zA-Z0-9\\]*['"]|[a-zA-Z][a-zA-Z0-9]*)[\x0d\x0a[:blank:]]*:[\x0d\x0a[:blank:]]*(['"]|\[|\{|[0-9]|true|false)/ + file-magic /^(\xef\xbb\xbf)?[\x0d\x0a[:blank:]]*\{[\x0d\x0a[:blank:]]*(["][^"]{1,}["]|[a-zA-Z][a-zA-Z0-9\\_]*)[\x0d\x0a[:blank:]]*:[\x0d\x0a[:blank:]]*(["]|\[|\{|[0-9]|true|false)/ } signature file-json2 { file-mime "text/json", 1 - file-magic /^(\xef\xbb\xbf)?[\x0d\x0a[:blank:]]*\[[\x0d\x0a[:blank:]]*(['"][a-zA-Z\\][a-zA-Z0-9\\]*['"]|[0-9]{1,})[\x0d\x0a[:blank:]]*,[\x0d\x0a[:blank:]]*(['"]|\[|\{|[0-9]|true|false)/ + file-magic /^(\xef\xbb\xbf)?[\x0d\x0a[:blank:]]*\[[\x0d\x0a[:blank:]]*(((["][^"]{1,}["]|[0-9]{1,}(\.[0-9]{1,})?|true|false)[\x0d\x0a[:blank:]]*,)|\{|\[)[\x0d\x0a[:blank:]]*/ +} + +# Match empty JSON documents. +signature file-json3 { + file-mime "text/json", 0 + file-magic /^(\xef\xbb\xbf)?[\x0d\x0a[:blank:]]*(\[\]|\{\})[\x0d\x0a[:blank:]]*$/ } signature file-xml { @@ -63,6 +69,11 @@ signature file-cross-domain-policy2 { file-magic /^([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*<[cC][rR][oO][sS][sS]-[dD][oO][mM][aA][iI][nN]-[pP][oO][lL][iI][cC][yY]/ } +signature file-xmlrpc { + file-mime "application/xml-rpc", 49 + file-magic /^(\xef\xbb\xbf)?([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*(<\?xml .*\?>)?([\x0d\x0a[:blank:]]*()?[\x0d\x0a[:blank:]]*)*<[mM][eE][tT][hH][oO][dD][rR][eE][sS][pP][oO][nN][sS][eE]>/ +} + signature file-coldfusion { file-mime "magnus-internal/cold-fusion", 20 file-magic /^([\x0d\x0a[:blank:]]*()?)*<(CFPARAM|CFSET|CFIF)/ @@ -80,21 +91,21 @@ signature file-jar { } signature file-java-applet { - file-magic /^\xca\xfe\xba\xbe...[\x2d-\x34]/ file-mime "application/x-java-applet", 71 + file-magic /^\xca\xfe\xba\xbe...[\x2d-\x34]/ } -signature file-oscp-response { +# OCSP requests over HTTP. +signature file-ocsp-request { + file-magic /^.{11,19}\x06\x05\x2b\x0e\x03\x02\x1a/ + file-mime "application/ocsp-request", 71 +} + +signature file-ocsp-response { file-magic /^.{11,19}\x06\x09\x2B\x06\x01\x05\x05\x07\x30\x01\x01/ file-mime "application/ocsp-response", 71 } -# Web Open Font Format -signature file-woff { - file-magic /^wOFF/ - file-mime "application/font-woff", 70 -} - # Shockwave flash signature file-swf { file-magic /^(F|C|Z)WS/ @@ -188,7 +199,7 @@ signature file-javascript { signature file-javascript2 { file-mime "application/javascript", 60 - file-magic /^[\x0d\x0a[:blank:]]*<[sS][cC][rR][iI][pP][tT][[:blank:]]+([tT][yY][pP][eE]|[lL][aA][nN][gG][uU][aA][gG][eE])=['"]?([tT][eE][xX][tT]\/)?[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]['"]?>/ + file-magic /^[\x0d\x0a[:blank:]]*<[sS][cC][rR][iI][pP][tT][[:blank:]]+([tT][yY][pP][eE]|[lL][aA][nN][gG][uU][aA][gG][eE])=['"]?([tT][eE][xX][tT]\/)?[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]/ } signature file-javascript3 { diff --git a/scripts/base/frameworks/files/magic/libmagic.sig b/scripts/base/frameworks/files/magic/libmagic.sig index 5975962838..80ab9bfaa9 100644 --- a/scripts/base/frameworks/files/magic/libmagic.sig +++ b/scripts/base/frameworks/files/magic/libmagic.sig @@ -99,19 +99,12 @@ signature file-magic-auto34 { file-magic /(\x23VRML ?V1\x2e0 ?ascii)/ } -# >0 string,=0 string,=Extended Module: (len=16), ["Fasttracker II module sound data"], swap_endian=0 signature file-magic-auto36 { file-mime "audio/x-mod", 190 file-magic /(Extended Module\x3a)/ } - # >0 string/t,=>20 search/wc/1000,=0 string,=SplineFontDB: (len=13), ["Spline Font Database "], swap_endian=0 -signature file-magic-auto63 { - file-mime "application/vnd.font-fontforge-sfd", 160 - file-magic /(SplineFontDB\x3a)/ -} - # >0 string/ct,=delivered-to: (len=13), ["SMTP mail text"], swap_endian=0 signature file-magic-auto64 { file-mime "message/rfc822", 160 @@ -514,12 +501,6 @@ signature file-magic-auto162 { file-magic /(\x3c\x3fxml)(.{15})(.*)( xmlns\x3d)(['"]http:\x2f\x2fwww.opengis.net\x2fkml)/ } -# >0 string,=\000\001\000\000\000 (len=5), ["TrueType font data"], swap_endian=0 -signature file-magic-auto187 { - file-mime "application/x-font-ttf", 80 - file-magic /(\x00\x01\x00\x00\x00)/ -} - # >0 string,=%PDF- (len=5), ["PDF document"], swap_endian=0 signature file-magic-auto189 { file-mime "application/pdf", 80 @@ -576,14 +557,6 @@ signature file-magic-auto203 { # file-magic /(.{4})/ #} - -# >0 lelong&,=4 (0x00000004), [""], swap_endian=0 -# >>104 lelong&,=4 (0x00000004), ["X11 SNF font data, LSB first"], swap_endian=0 -signature file-magic-auto217 { - file-mime "application/x-font-sfn", 70 - file-magic /(\x04\x00\x00\x00)(.{100})(\x04\x00\x00\x00)/ -} - # This didn't auto-generate correctly due to non-sequential offsets and # use of bitwise/relational comparisons. At a glance: may not be # that common/useful, leaving for later. @@ -1279,18 +1252,6 @@ signature file-magic-auto378 { file-magic /(\x13\x57\x9a\xce)/ } -# >0 belong&,=4 (0x00000004), ["X11 SNF font data, MSB first"], swap_endian=0 -signature file-magic-auto379 { - file-mime "application/x-font-sfn", 70 - file-magic /(\x00\x00\x00\x04)/ -} - -# >0 string,=OTTO (len=4), ["OpenType font data"], swap_endian=0 -signature file-magic-auto380 { - file-mime "application/vnd.ms-opentype", 70 - file-magic /(OTTO)/ -} - # >0 string,=34 string,=LP (len=2), ["Embedded OpenType (EOT)"], swap_endian=0 -signature file-magic-auto506 { - file-mime "application/vnd.ms-fontobject", 50 - file-magic /(.{34})(LP)/ -} - # >0 beshort&,=2935 (0x0b77), ["ATSC A/52 aka AC-3 aka Dolby Digital stream,"], swap_endian=0 signature file-magic-auto507 { file-mime "audio/vnd.dolby.dd-raw", 50 diff --git a/scripts/base/frameworks/files/magic/video.sig b/scripts/base/frameworks/files/magic/video.sig index bc0f24c46a..6df3dd5fc3 100644 --- a/scripts/base/frameworks/files/magic/video.sig +++ b/scripts/base/frameworks/files/magic/video.sig @@ -85,11 +85,11 @@ signature file-quicktime { # MPEG v4 video signature file-mp4 { file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(isom|mp4[12])/ + file-magic /^....ftyp(isom|mp4[12])/ } # 3GPP Video signature file-3gpp { file-mime "video/3gpp", 60 - file-magic /^....(ftyp)(3g[egps2]|avc1|mmp4)/ + file-magic /^....ftyp(3g[egps2]|avc1|mmp4)/ }