diff --git a/scripts/base/files/x509/main.bro b/scripts/base/files/x509/main.bro index 10445ad846..181607bf6c 100644 --- a/scripts/base/files/x509/main.bro +++ b/scripts/base/files/x509/main.bro @@ -47,6 +47,9 @@ redef record Files::Info += { event x509_certificate(f: fa_file, cert_ref: opaque of x509, cert: X509::Certificate) &priority=5 { + if ( ! f$info?$mime_type ) + f$info$mime_type = "application/pkix-cert"; + f$info$x509 = [$ts=f$info$ts, $id=f$id, $certificate=cert, $handle=cert_ref]; } diff --git a/scripts/base/frameworks/files/magic/__load__.bro b/scripts/base/frameworks/files/magic/__load__.bro index c6ee799a53..df03616ec2 100644 --- a/scripts/base/frameworks/files/magic/__load__.bro +++ b/scripts/base/frameworks/files/magic/__load__.bro @@ -1,3 +1,6 @@ @load-sigs ./general +@load-sigs ./archive +@load-sigs ./image +@load-sigs ./video @load-sigs ./msoffice @load-sigs ./libmagic diff --git a/scripts/base/frameworks/files/magic/archive.sig b/scripts/base/frameworks/files/magic/archive.sig new file mode 100644 index 0000000000..d8cc727540 --- /dev/null +++ b/scripts/base/frameworks/files/magic/archive.sig @@ -0,0 +1,188 @@ +signature file-tar { + file-magic /^[[:print:]\x00]{100}([[:digit:]\x20]{7}\x00){3}([[:digit:]\x20]{11}\x00){2}([[:digit:]\x00\x20]{7}[\x20\x00])[0-7\x00]/ + file-mime "application/x-tar", 100 +} + +# This is low priority so that files using zip as a +# container will be identified correctly. +signature file-zip { + file-mime "application/zip", 10 + file-magic /^PK\x03\x04.{2}/ +} + +# Multivolume Zip archive +signature file-multi-zip { + file-mime "application/zip", 10 + file-magic /^PK\x07\x08PK\x03\x04/ +} + +signature file-rar { + file-mime "application/x-rar", 70 + file-magic /^Rar!/ +} + +signature file-gzip { + file-mime "application/x-gzip", 100 + file-magic /\x1f\x8b/ +} + +signature file-ms-cab { + file-mime "application/vnd.ms-cab-compressed", 110 + file-magic /^MSCF\x00\x00\x00\x00/ +} + +# Mac OS X DMG files +signature file-dmg { + file-magic /^(\x78\x01\x73\x0D\x62\x62\x60|\x78\xDA\x63\x60\x18\x05|\x78\x01\x63\x60\x18\x05|\x78\xDA\x73\x0D|\x78[\x01\xDA]\xED[\xD0-\xD9])/ + file-mime "application/x-dmg", 100 +} + +# XAR (eXtensible ARchive) format. +# Mac OS X uses this for the .pkg format. +signature file-xar { + file-magic /^xar\!/ + file-mime "application/x-xar", 100 +} + +# RPM +signature file-magic-auto352 { + file-mime "application/x-rpm", 70 + file-magic /^(drpm|\xed\xab\xee\xdb)/ +} + +signature file-stuffit { + file-mime "application/x-stuffit", 70 + file-magic /^(SIT\x21|StuffIt)/ +} + +signature file-x-archive { + file-mime "application/x-archive", 70 + file-magic /^!?/ +} + +# ARC archive data +signature file-arc { + file-mime "application/x-arc", 70 + file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})([\x02-\x0a\x14\x48]\x1a)/ +} + +# EET archive +signature file-eet { + file-mime "application/x-eet", 70 + file-magic /^\x1e\xe7\xff\x00/ +} + +# Zoo archive +signature file-zoo { + file-mime "application/x-zoo", 70 + file-magic /^.{20}\xdc\xa7\xc4\xfd/ +} + +# >0 lelong&,=407642370 (0x184c2102), ["LZ4 compressed data, legacy format"], swap_endian=0 +signature file-magic-auto382 { + file-mime "application/x-lz4", 70 + file-magic /(\x02\x21\x4c\x18)/ +} + +# >0 lelong&,=407708164 (0x184d2204), ["LZ4 compressed data"], swap_endian=0 +signature file-magic-auto383 { + file-mime "application/x-lz4", 70 + file-magic /(\x04\x22\x4d\x18)/ +} + +# >0 string,=LRZI (len=4), ["LRZIP compressed data"], swap_endian=0 +# >>5 byte&,x, [".%d"], swap_endian=0 +signature file-magic-auto384 { + file-mime "application/x-lrzip", 1 + file-magic /(LRZI)(.{1})(.{1})/ +} + +# >0 string,=LZIP (len=4), ["lzip compressed data"], swap_endian=0 +signature file-magic-auto386 { + file-mime "application/x-lzip", 70 + file-magic /(LZIP)/ +} + +# >0 string/b,=MZ (len=2), [""], swap_endian=0 +# >>30 string,=Copyright 1989-1990 PKWARE Inc. (len=31), ["Self-extracting PKZIP archive"], swap_endian=0 +signature file-magic-auto434 { + file-mime "application/zip", 340 + file-magic /(MZ)(.{28})(Copyright 1989\x2d1990 PKWARE Inc\x2e)/ +} + +# >0 string/b,=MZ (len=2), [""], swap_endian=0 +# >>30 string,=PKLITE Copr. (len=12), ["Self-extracting PKZIP archive"], swap_endian=0 +signature file-magic-auto435 { + file-mime "application/zip", 150 + file-magic /(MZ)(.{28})(PKLITE Copr\x2e)/ +} + +# LHA archive (LZH) +signature file-lzh { + file-mime "application/x-lzh", 80 + file-magic /^.{2}-(lh[ abcdex0-9]|lz[s2-8]|lz[s2-8]|pm[s012]|pc1)-/ +} + +# >0 string,=WARC/ (len=5), ["WARC Archive"], swap_endian=0 +# >>5 string,x, ["version %.4s"], swap_endian=0 +signature file-magic-auto177 { + file-mime "application/warc", 1 + file-magic /(WARC\x2f)(.{0})/ +} + +# >0 string,=7z\274\257'\034 (len=6), ["7-zip archive data,"], swap_endian=0 +# >>7 byte&,x, [".%d"], swap_endian=0 +signature file-magic-auto150 { + file-mime "application/x-7z-compressed", 1 + file-magic /(7z\xbc\xaf\x27\x1c)(.{1})(.{1})/ +} + +# >0 ustring,=\3757zXZ\000 (len=6), ["XZ compressed data"], swap_endian=0 +signature file-magic-auto151 { + file-mime "application/x-xz", 90 + file-magic /(\xfd7zXZ\x00)/ +} +# >0 string/b,=MZ (len=2), [""], swap_endian=0 +# >>36 string,=LHa's SFX (len=9), [", LHa self-extracting archive"], swap_endian=0 +signature file-magic-auto436 { + file-mime "application/x-lha", 120 + file-magic /(MZ)(.{34})(LHa\x27s SFX)/ +} + +# >0 string/b,=MZ (len=2), [""], swap_endian=0 +# >>36 string,=LHA's SFX (len=9), [", LHa self-extracting archive"], swap_endian=0 +signature file-magic-auto437 { + file-mime "application/x-lha", 120 + file-magic /(MZ)(.{34})(LHA\x27s SFX)/ +} + +# >0 leshort&,=-5536 (0xea60), ["ARJ archive data"], swap_endian=0 +signature file-magic-auto467 { + file-mime "application/x-arj", 50 + file-magic /(\x60\xea)/ +} + +# >0 short&,=-14479 (0xc771), ["byte-swapped cpio archive"], swap_endian=0 +signature file-magic-auto479 { + file-mime "application/x-cpio", 50 + file-magic /((\x71\xc7)|(\xc7\x71))/ +} + +# >0 short&,=29127 (0x71c7), ["cpio archive"], swap_endian=0 +signature file-magic-auto480 { + file-mime "application/x-cpio", 50 + file-magic /((\xc7\x71)|(\x71\xc7))/ +} + +# >0 string,=\037\235 (len=2), ["compress'd data"], swap_endian=0 +signature file-magic-auto500 { + file-mime "application/x-compress", 50 + file-magic /(\x1f\x9d)/ +} + +# >0 lelong&00ffffff,=93 (0x0000005d), [""], swap_endian=0 +signature file-magic-auto218 { + file-mime "application/x-lzma", 71 + file-magic /(\x5d\x00\x00.)/ +} + diff --git a/scripts/base/frameworks/files/magic/general.sig b/scripts/base/frameworks/files/magic/general.sig index 500c4f7be0..e673fc86b6 100644 --- a/scripts/base/frameworks/files/magic/general.sig +++ b/scripts/base/frameworks/files/magic/general.sig @@ -1,18 +1,51 @@ # General purpose file magic signatures. +# Plaintext +# (Including BOMs for UTF-8, 16, and 32) signature file-plaintext { - file-magic /^([[:print:][:space:]]{10})/ - file-mime "text/plain", -20 + file-magic /^(\xef\xbb\xbf|(\x00\x00)?\xfe\xff|\xff\xfe(\x00\x00)?)?[[:space:]\x20-\x7E]{10}/ + file-mime "text/plain", -20 } -signature file-tar { - file-magic /^[[:print:]\x00]{100}([[:digit:]\x20]{7}\x00){3}([[:digit:]\x20]{11}\x00){2}([[:digit:]\x00\x20]{7}[\x20\x00])[0-7\x00]/ - file-mime "application/x-tar", 100 +signature file-xml { + file-mime "application/xml", 10 + file-magic /^[\x0d\x0a[:blank:]]*<\?xml / } -signature file-zip { - file-mime "application/zip", 10 - file-magic /^PK\x03\x04.{2}/ +signature file-xhtml { + file-mime "text/html", 100 + file-magic /^[\x0d\x0a[:blank:]]*<\?xml version[ =]['"].*<(![dD][oO][cC][tT][yY][pP][eE] {1,}[hH][tT][mM][lL]|[hH][tT][mM][lL])/ +} + +signature file-html { + file-mime "text/html", 49 + file-magic /^[\x0d\x0a[:blank:]]*)?/ +} + +signature file-javascript3 { + file-mime "application/javascript", 60 + # This seems to be a somewhat common idiom in javascript. + file-magic /^[\x0d\x0a[:blank:]]*for \(;;\);/ +} + +signature file-javascript4 { + file-mime "application/javascript", 60 + file-magic /^[\x0d\x0a[:blank:]]*document\.write(ln)?[:blank:]?\(/ +} + +signature file-javascript5 { + file-mime "application/javascript", 60 + file-magic /^\(function\(\)[[:blank:]\n]*\{/ +} + signature file-php { + file-mime "text/x-php", 60 + file-magic /^\x23\x21[^\n]{1,15}bin\/(env[[:space:]]+)?php/ +} + +signature file-php2 { file-magic /^.*<\?php/ file-mime "text/x-php", 40 } @@ -135,3 +191,23 @@ signature file-skp { file-magic /^\xFF\xFE\xFF\x0E\x53\x00\x6B\x00\x65\x00\x74\x00\x63\x00\x68\x00\x55\x00\x70\x00\x20\x00\x4D\x00\x6F\x00\x64\x00\x65\x00\x6C\x00/ file-mime "application/skp", 100 } + +signature file-elf-object { + file-mime "application/x-object", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x01\x00|\x02.{10}\x00\x01)/ +} + +signature file-elf { + file-mime "application/x-executable", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x02\x00|\x02.{10}\x00\x02)/ +} + +signature file-elf-sharedlib { + file-mime "application/x-sharedlib", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x03\x00|\x02.{10}\x00\x03)/ +} + +signature file-elf-coredump { + file-mime "application/x-coredump", 50 + file-magic /\x7fELF[\x01\x02](\x01.{10}\x04\x00|\x02.{10}\x00\x04)/ +} diff --git a/scripts/base/frameworks/files/magic/image.sig b/scripts/base/frameworks/files/magic/image.sig new file mode 100644 index 0000000000..ad4e7bbbe1 --- /dev/null +++ b/scripts/base/frameworks/files/magic/image.sig @@ -0,0 +1,178 @@ + +signature file-tiff { + file-mime "image/tiff", 70 + file-magic /^(MM\x00[\x2a\x2b]|II[\x2a\x2b]\x00)/ +} + +signature file-gif { + file-mime "image/gif", 70 + file-magic /^GIF8/ +} + + +# >0 beshort&,=-40 (0xffd8), ["JPEG image data"], swap_endian=0 +signature file-magic-auto427 { + file-mime "image/jpeg", 52 + file-magic /(\xff\xd8)/ +} + +signature file-bmp { + file-mime "image/x-ms-bmp", 50 + file-magic /BM.{12}[\x0c\x28\x40\x6c\x7c\x80]\x00/ +} + +signature file-ico { + file-magic /^\x00\x00\x01\x00/ + file-mime "image/x-icon", 70 +} + +signature file-cur { + file-magic /^\x00\x00\x02\x00/ + file-mime "image/x-cursor", 70 +} + +# >0 string,=8BPS (len=4), ["Adobe Photoshop Image"], swap_endian=0 +signature file-magic-auto289 { + file-mime "image/vnd.adobe.photoshop", 70 + file-magic /(8BPS)/ +} + +signature file-png { + file-mime "image/png", 110 + file-magic /^\x89PNG\x0d\x0a\x1a\x0a/ +} + +# JPEG 2000 +signature file-jp2 { + file-mime "image/jp2", 60 + file-magic /.{4}ftypjp2/ +} + +# JPEG 2000 +signature file-jp22 { + file-mime "image/jp2", 70 + file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jp2 / +} + +# JPEG 2000 +signature file-jpx { + file-mime "image/jpx", 70 + file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jpx / +} + +# JPEG 2000 +signature file-jpm { + file-mime "image/jpm", 70 + file-magic /\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a.{8}jpm / +} + +# >0 string,=Xcur (len=4), ["Xcursor data"], swap_endian=0 +signature file-magic-auto271 { + file-mime "image/x-xcursor", 70 + file-magic /(Xcur)/ +} + +# >0 string,=IIN1 (len=4), ["NIFF image data"], swap_endian=0 +signature file-magic-auto282 { + file-mime "image/x-niff", 70 + file-magic /(IIN1)/ +} + +# >0 lelong&,=20000630 (0x01312f76), ["OpenEXR image data,"], swap_endian=0 +signature file-magic-auto291 { + file-mime "image/x-exr", 70 + file-magic /(\x76\x2f\x31\x01)/ +} + +# >0 string,=SDPX (len=4), ["DPX image data, big-endian,"], swap_endian=0 +signature file-magic-auto292 { + file-mime "image/x-dpx", 70 + file-magic /(SDPX)/ +} + +# >0 string,=CPC\262 (len=4), ["Cartesian Perceptual Compression image"], swap_endian=0 +signature file-magic-auto294 { + file-mime "image/x-cpi", 70 + file-magic /(CPC\xb2)/ +} + + +signature file-orf { + file-mime "image/x-olympus-orf", 70 + file-magic /IIR[OS]|MMOR/ +} + +# >0 string,=FOVb (len=4), ["Foveon X3F raw image data"], swap_endian=0 +signature file-magic-auto298 { + file-mime "image/x-x3f", 70 + file-magic /(FOVb)/ +} + +# >0 string,=PDN3 (len=4), ["Paint.NET image data"], swap_endian=0 +signature file-magic-auto299 { + file-mime "image/x-paintnet", 70 + file-magic /(PDN3)/ +} + +# >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 +# >>8 string,=CDRA (len=4), [", Corel Draw Picture"], swap_endian=0 +signature file-magic-auto355 { + file-mime "image/x-coreldraw", 70 + file-magic /(RIFF)(.{4})(CDRA)/ +} + +# >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 +# >>8 string,=CDR6 (len=4), [", Corel Draw Picture, version 6"], swap_endian=0 +signature file-magic-auto356 { + file-mime "image/x-coreldraw", 70 + file-magic /(RIFF)(.{4})(CDR6)/ +} + +# >0 string,=P7 (len=2), ["Netpbm PAM image file"], swap_endian=0 +signature file-magic-auto484 { + file-mime "image/x-portable-pixmap", 50 + file-magic /(P7)/ +} + +# >4 string/W,=jP (len=2), ["JPEG 2000 image"], swap_endian=0 +signature file-magic-auto497 { + file-mime "image/jp2", 50 + file-magic /(.{4})(jP)/ +} + +# DjVU Images +signature file-djvu { + file-mime "image/vnd.djvu", 70 + file-magic /AT\x26TFORM.{4}(DJV[MUI]|THUM)/ +} + +# DWG AutoDesk AutoCAD +signature file-dwg { + file-mime "image/vnd.dwg", 90 + file-magic /^(AC[12]\.|AC10)/ +} + +# >0 string,=gimp xcf (len=8), ["GIMP XCF image data,"], swap_endian=0 +signature file-magic-auto115 { + file-mime "image/x-xcf", 110 + file-magic /(gimp xcf)/ +} + +# >0 string/t,=[BitmapInfo2] (len=13), ["Polar Monitor Bitmap text"], swap_endian=0 +signature file-magic-auto62 { + file-mime "image/x-polar-monitor-bitmap", 160 + file-magic /(\x5bBitmapInfo2\x5d)/ +} + +# >0 string,=AWBM (len=4), [""], swap_endian=0 +# >>4 leshort&,<1981 (0x07bd), ["Award BIOS bitmap"], swap_endian=0 +signature file-magic-auto208 { + file-mime "image/x-award-bmp", 20 + file-magic /(AWBM)(.{2})/ +} + +# >0 string,=\021\006 (len=2), ["Award BIOS Logo, 136 x 84"], swap_endian=0 +signature file-magic-auto483 { + file-mime "image/x-award-bioslogo", 50 + file-magic /^\x11[\x06\x09]/ +} diff --git a/scripts/base/frameworks/files/magic/libmagic.sig b/scripts/base/frameworks/files/magic/libmagic.sig index 72ec40dff8..d18f6f01a6 100644 --- a/scripts/base/frameworks/files/magic/libmagic.sig +++ b/scripts/base/frameworks/files/magic/libmagic.sig @@ -56,42 +56,18 @@ signature file-magic-auto11 { file-magic /(\x3cmap ?version\x3d\x22freeplane)/ } -# >0 string/wt,=#! /usr/local/bin/nawk (len=22), ["new awk script text executable"], swap_endian=0 -signature file-magic-auto12 { - file-mime "text/x-nawk", 250 - file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fnawk)/ -} - -# >0 string/wt,=#! /usr/local/bin/gawk (len=22), ["GNU awk script text executable"], swap_endian=0 -signature file-magic-auto13 { - file-mime "text/x-gawk", 250 - file-magic /(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fgawk)/ -} - # >0 string,=# PaCkAgE DaTaStReAm (len=20), ["pkg Datastream (SVR4)"], swap_endian=0 signature file-magic-auto19 { file-mime "application/x-svr4-package", 230 file-magic /(\x23 PaCkAgE DaTaStReAm)/ } -# >0 string,=Creative Voice File (len=19), ["Creative Labs voice data"], swap_endian=0 -signature file-magic-auto20 { - file-mime "audio/x-unknown", 220 - file-magic /(Creative Voice File)/ -} - # >0 string/t,=[KDE Desktop Entry] (len=19), ["KDE desktop entry"], swap_endian=0 signature file-magic-auto21 { file-mime "application/x-kdelnk", 220 file-magic /(\x5bKDE Desktop Entry\x5d)/ } -# >0 string,=!\n__________E (len=19), ["MIPS archive"], swap_endian=0 -signature file-magic-auto23 { - file-mime "application/x-archive", 220 - file-magic /(\x21\x3carch\x3e\x0a\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5fE)/ -} - # >0 string/t,=# KDE Config File (len=17), ["KDE config file"], swap_endian=0 signature file-magic-auto26 { file-mime "application/x-kdelnk", 200 @@ -111,18 +87,6 @@ signature file-magic-auto28 { file-magic /(riff\x2e\x91\xcf\x11\xa5\xd6\x28\xdb\x04\xc1\x00\x00)(.{8})(wave\xf3\xac\xd3\x11\x8c\xd1\x00\xc0O\x8e\xdb\x8a)/ } -# >0 string/wt,=#! /usr/bin/nawk (len=16), ["new awk script text executable"], swap_endian=0 -signature file-magic-auto29 { - file-mime "text/x-nawk", 190 - file-magic /(\x23\x21 ?\x2fusr\x2fbin\x2fnawk)/ -} - -# >0 string/wt,=#! /usr/bin/gawk (len=16), ["GNU awk script text executable"], swap_endian=0 -signature file-magic-auto31 { - file-mime "text/x-gawk", 190 - file-magic /(\x23\x21 ?\x2fusr\x2fbin\x2fgawk)/ -} - # >369 string,=MICROSOFT PIFEX\000 (len=16), ["Windows Program Information File"], swap_endian=0 signature file-magic-auto32 { file-mime "application/x-dosexec", 190 @@ -147,23 +111,6 @@ signature file-magic-auto36 { file-magic /(Extended Module\x3a)/ } -# >0 string/t,=0 string/t,=0 string,=0 string/t,=>20 search/wc/1000,=0 string/t,=>15 string,>\000 (len=1), [""], swap_endian=0 -# >>>19 search/Wctb/4096,=0 string/t,=>15 string,>\000 (len=1), [""], swap_endian=0 -# >>>19 search/Wctb/4096,=0 string/t,=>15 string,>\000 (len=1), [""], swap_endian=0 # >>>19 search/4096,=0 string/t,=>15 string,>\000 (len=1), [""], swap_endian=0 -# >>>19 search/Wctb/4096,=0 string/c,=BEGIN:VCALENDAR (len=15), ["vCalendar calendar file"], swap_endian=0 signature file-magic-auto47 { file-mime "text/calendar", 180 file-magic /(BEGIN\x3aVCALENDAR)/ } -# >4 string,=Standard Jet DB (len=15), ["Microsoft Access Database"], swap_endian=0 -signature file-magic-auto48 { - file-mime "application/x-msaccess", 180 - file-magic /(.{4})(Standard Jet DB)/ -} - -# >4 string,=Standard ACE DB (len=15), ["Microsoft Access Database"], swap_endian=0 -signature file-magic-auto49 { - file-mime "application/x-msaccess", 180 - file-magic /(.{4})(Standard ACE DB)/ -} - # >0 string/w,=#VRML V2.0 utf8 (len=15), ["ISO/IEC 14772 VRML 97 file"], swap_endian=0 signature file-magic-auto50 { file-mime "model/vrml", 180 file-magic /(\x23VRML ?V2\x2e0 ?utf8)/ } -# >0 string/wt,=#! /usr/bin/awk (len=15), ["awk script text executable"], swap_endian=0 -signature file-magic-auto51 { - file-mime "text/x-awk", 180 - file-magic /(\x23\x21 ?\x2fusr\x2fbin\x2fawk)/ -} - # >0 string,=MAS_UTrack_V00 (len=14), [""], swap_endian=0 # >>14 string,>/0 (len=2), ["ultratracker V1.%.1s module sound data"], swap_endian=0 signature file-magic-auto53 { @@ -309,12 +214,6 @@ signature file-magic-auto61 { file-magic /(.{39})(\x3cgmr\x3aWorkbook)/ } -# >0 string/t,=[BitmapInfo2] (len=13), ["Polar Monitor Bitmap text"], swap_endian=0 -signature file-magic-auto62 { - file-mime "image/x-polar-monitor-bitmap", 160 - file-magic /(\x5bBitmapInfo2\x5d)/ -} - # >0 string,=SplineFontDB: (len=13), ["Spline Font Database "], swap_endian=0 signature file-magic-auto63 { file-mime "application/vnd.font-fontforge-sfd", 160 @@ -333,33 +232,6 @@ signature file-magic-auto65 { file-magic /([rR][eE][tT][uU][rR][nN]\x2d[pP][aA][tT][hH]\x3a)/ } -# >0 string,=\000\000\000\fjP \r\n\207\n (len=12), ["JPEG 2000"], swap_endian=0 -# >>20 string,=jp2 (len=4), ["Part 1 (JP2)"], swap_endian=0 -signature file-magic-auto66 { - file-mime "image/jp2", 70 - file-magic /(\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a)(.{8})(jp2 )/ -} - -# >0 string,=\000\000\000\fjP \r\n\207\n (len=12), ["JPEG 2000"], swap_endian=0 -# >>20 string,=jpx (len=4), ["Part 2 (JPX)"], swap_endian=0 -signature file-magic-auto67 { - file-mime "image/jpx", 70 - file-magic /(\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a)(.{8})(jpx )/ -} - -# >0 string,=\000\000\000\fjP \r\n\207\n (len=12), ["JPEG 2000"], swap_endian=0 -# >>20 string,=jpm (len=4), ["Part 6 (JPM)"], swap_endian=0 -signature file-magic-auto68 { - file-mime "image/jpm", 70 - file-magic /(\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a)(.{8})(jpm )/ -} - -# >0 string,=\000\000\000\fjP \r\n\207\n (len=12), ["JPEG 2000"], swap_endian=0 -# >>20 string,=mjp2 (len=4), ["Part 3 (MJ2)"], swap_endian=0 -signature file-magic-auto69 { - file-mime "video/mj2", 70 - file-magic /(\x00\x00\x00\x0cjP \x0d\x0a\x87\x0a)(.{8})(mjp2)/ -} # >0 string/w,=0 string/wt,=#! /bin/nawk (len=12), ["new awk script text executable"], swap_endian=0 -signature file-magic-auto72 { - file-mime "text/x-nawk", 150 - file-magic /(\x23\x21 ?\x2fbin\x2fnawk)/ -} - -# >0 string/wt,=#! /bin/gawk (len=12), ["GNU awk script text executable"], swap_endian=0 -signature file-magic-auto73 { - file-mime "text/x-gawk", 150 - file-magic /(\x23\x21 ?\x2fbin\x2fgawk)/ -} - -# >0 string/wt,=#! /bin/awk (len=11), ["awk script text executable"], swap_endian=0 -signature file-magic-auto75 { - file-mime "text/x-awk", 140 - file-magic /(\x23\x21 ?\x2fbin\x2fawk)/ -} - # >0 string,=filedesc:// (len=11), ["Internet Archive File"], swap_endian=0 signature file-magic-auto76 { file-mime "application/x-ia-arc", 140 @@ -447,12 +301,6 @@ signature file-magic-auto88 { file-magic /(.*)(\x2d\x2d\x2d )(.*)(\x0a)(.*)(\x2b\x2b\x2b )(.*)(\x0a)(.*)(\x40\x40)/ } -# >0 string/t,=Received: (len=9), ["RFC 822 mail text"], swap_endian=0 -signature file-magic-auto89 { - file-mime "message/rfc822", 120 - file-magic /(Received\x3a)/ -} - # >0 string,=0 string,=AT&TFORM (len=8), [""], swap_endian=0 -# >>12 string,=DJVM (len=4), ["DjVu multiple page document"], swap_endian=0 -signature file-magic-auto95 { - file-mime "image/vnd.djvu", 70 - file-magic /(AT\x26TFORM)(.{4})(DJVM)/ -} - -# >0 string,=AT&TFORM (len=8), [""], swap_endian=0 -# >>12 string,=DJVU (len=4), ["DjVu image or single page document"], swap_endian=0 -signature file-magic-auto96 { - file-mime "image/vnd.djvu", 70 - file-magic /(AT\x26TFORM)(.{4})(DJVU)/ -} - -# >0 string,=AT&TFORM (len=8), [""], swap_endian=0 -# >>12 string,=DJVI (len=4), ["DjVu shared document"], swap_endian=0 -signature file-magic-auto97 { - file-mime "image/vnd.djvu", 70 - file-magic /(AT\x26TFORM)(.{4})(DJVI)/ -} - -# >0 string,=AT&TFORM (len=8), [""], swap_endian=0 -# >>12 string,=THUM (len=4), ["DjVu page thumbnails"], swap_endian=0 -signature file-magic-auto98 { - file-mime "image/vnd.djvu", 70 - file-magic /(AT\x26TFORM)(.{4})(THUM)/ -} - # >0 string/t,=#! rnews (len=8), ["batched news text"], swap_endian=0 signature file-magic-auto99 { file-mime "message/rfc822", 110 file-magic /(\x23\x21 rnews)/ } -# >0 string/b,=MSCF\000\000\000\000 (len=8), ["Microsoft Cabinet archive data"], swap_endian=0 -signature file-magic-auto100 { - file-mime "application/vnd.ms-cab-compressed", 110 - file-magic /(MSCF\x00\x00\x00\x00)/ -} - # >21 string/c,=!SCREAM! (len=8), ["Screamtracker 2 module sound data"], swap_endian=0 signature file-magic-auto102 { file-mime "audio/x-mod", 110 @@ -573,12 +387,6 @@ signature file-magic-auto109 { file-magic /(\x89HDF\x0d\x0a\x1a\x0a)/ } -# >0 string,=\211PNG\r\n\032\n (len=8), ["PNG image data"], swap_endian=0 -signature file-magic-auto110 { - file-mime "image/png", 110 - file-magic /(\x89PNG\x0d\x0a\x1a\x0a)/ -} - # >36 string,=acspSUNW (len=8), ["Sun KCMS ICC Profile"], swap_endian=0 signature file-magic-auto111 { file-mime "application/vnd.iccprofile", 110 @@ -603,36 +411,18 @@ signature file-magic-auto114 { file-magic /(.{36})(acspAPPL)/ } -# >0 string,=gimp xcf (len=8), ["GIMP XCF image data,"], swap_endian=0 -signature file-magic-auto115 { - file-mime "image/x-xcf", 110 - file-magic /(gimp xcf)/ -} - # >512 string,=R\000o\000o\000t\000 (len=8), ["Hangul (Korean) Word Processor File 2000"], swap_endian=0 signature file-magic-auto116 { file-mime "application/x-hwp", 110 file-magic /(.{512})(R\x00o\x00o\x00t\x00)/ } -# >257 string,=ustar \000 (len=8), ["GNU tar archive"], swap_endian=0 -#signature file-magic-auto117 { -# file-mime "application/x-tar", 110 -# file-magic /(.{257})(ustar \x00)/ -#} - # >0 string,=0 string,=PK\a\bPK\003\004 (len=8), ["Zip multi-volume archive data, at least PKZIP v2.50 to extract"], swap_endian=0 -signature file-magic-auto119 { - file-mime "application/zip", 110 - file-magic /(PK\x07\x08PK\x03\x04)/ -} - # >0 string/b,=WordPro\000 (len=8), ["Lotus WordPro"], swap_endian=0 signature file-magic-auto121 { file-mime "application/vnd.lotus-wordpro", 110 @@ -645,12 +435,6 @@ signature file-magic-auto122 { file-magic /(Article)/ } -# >0 string,=\037\213 (len=2), ["gzip compressed data"], swap_endian=0 -signature file-magic-auto123 { - file-mime "application/x-gzip", 100 - file-magic /(\x1f\x8b)/ -} - # >0 string/t,=Pipe to (len=7), ["mail piping text"], swap_endian=0 signature file-magic-auto124 { file-mime "message/rfc822", 100 @@ -663,18 +447,6 @@ signature file-magic-auto125 { file-magic /(\x2eRMF\x00\x00\x00)/ } -# >0 string,=StuffIt (len=7), ["StuffIt Archive"], swap_endian=0 -signature file-magic-auto126 { - file-mime "application/x-stuffit", 100 - file-magic /(StuffIt)/ -} - -# >0 string,=! (len=7), ["current ar archive"], swap_endian=0 -signature file-magic-auto127 { - file-mime "application/x-archive", 100 - file-magic /(\x21\x3carch\x3e)/ -} - # >0 string,=P5 (len=2), [""], swap_endian=0 # >>3 regex,=[0-9]{1,50} (len=12), [", size = %sx"], swap_endian=0 # >>>3 regex,= [0-9]{1,50} (len=12), ["%s"], swap_endian=0 @@ -699,151 +471,12 @@ signature file-magic-auto130 { file-magic /(P4)(.{1})([0-9]{1,50} )( [0-9]{1,50})/ } -# >257 string,=ustar\000 (len=6), ["POSIX tar archive"], swap_endian=0 -#signature file-magic-auto131 { -# file-mime "application/x-tar", 90 -# file-magic /(.{257})(ustar\x00)/ -#} - -# >0 string,=AC1.40 (len=6), ["DWG AutoDesk AutoCAD Release 1.40"], swap_endian=0 -signature file-magic-auto132 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1\x2e40)/ -} - -# >0 string,=AC1.50 (len=6), ["DWG AutoDesk AutoCAD Release 2.05"], swap_endian=0 -signature file-magic-auto133 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1\x2e50)/ -} - -# >0 string,=AC2.10 (len=6), ["DWG AutoDesk AutoCAD Release 2.10"], swap_endian=0 -signature file-magic-auto134 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC2\x2e10)/ -} - -# >0 string,=AC2.21 (len=6), ["DWG AutoDesk AutoCAD Release 2.21"], swap_endian=0 -signature file-magic-auto135 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC2\x2e21)/ -} - -# >0 string,=AC2.22 (len=6), ["DWG AutoDesk AutoCAD Release 2.22"], swap_endian=0 -signature file-magic-auto136 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC2\x2e22)/ -} - -# >0 string,=AC1001 (len=6), ["DWG AutoDesk AutoCAD Release 2.22"], swap_endian=0 -signature file-magic-auto137 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1001)/ -} - -# >0 string,=AC1002 (len=6), ["DWG AutoDesk AutoCAD Release 2.50"], swap_endian=0 -signature file-magic-auto138 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1002)/ -} - -# >0 string,=AC1003 (len=6), ["DWG AutoDesk AutoCAD Release 2.60"], swap_endian=0 -signature file-magic-auto139 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1003)/ -} - -# >0 string,=AC1004 (len=6), ["DWG AutoDesk AutoCAD Release 9"], swap_endian=0 -signature file-magic-auto140 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1004)/ -} - -# >0 string,=AC1006 (len=6), ["DWG AutoDesk AutoCAD Release 10"], swap_endian=0 -signature file-magic-auto141 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1006)/ -} - -# >0 string,=AC1009 (len=6), ["DWG AutoDesk AutoCAD Release 11/12"], swap_endian=0 -signature file-magic-auto142 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1009)/ -} - -# >0 string,=AC1012 (len=6), ["DWG AutoDesk AutoCAD Release 13"], swap_endian=0 -signature file-magic-auto143 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1012)/ -} - -# >0 string,=AC1014 (len=6), ["DWG AutoDesk AutoCAD Release 14"], swap_endian=0 -signature file-magic-auto144 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1014)/ -} - -# >0 string,=AC1015 (len=6), ["DWG AutoDesk AutoCAD 2000/2002"], swap_endian=0 -signature file-magic-auto145 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1015)/ -} - -# >0 string,=AC1018 (len=6), ["DWG AutoDesk AutoCAD 2004/2005/2006"], swap_endian=0 -signature file-magic-auto146 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1018)/ -} - -# >0 string,=AC1021 (len=6), ["DWG AutoDesk AutoCAD 2007/2008/2009"], swap_endian=0 -signature file-magic-auto147 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1021)/ -} - -# >0 string,=AC1024 (len=6), ["DWG AutoDesk AutoCAD 2010/2011/2012"], swap_endian=0 -signature file-magic-auto148 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1024)/ -} - -# >0 string,=AC1027 (len=6), ["DWG AutoDesk AutoCAD 2013/2014"], swap_endian=0 -signature file-magic-auto149 { - file-mime "image/vnd.dwg", 90 - file-magic /(AC1027)/ -} - -# >0 string,=7z\274\257'\034 (len=6), ["7-zip archive data,"], swap_endian=0 -# >>7 byte&,x, [".%d"], swap_endian=0 -signature file-magic-auto150 { - file-mime "application/x-7z-compressed", 1 - file-magic /(7z\xbc\xaf\x27\x1c)(.{1})(.{1})/ -} - -# >0 ustring,=\3757zXZ\000 (len=6), ["XZ compressed data"], swap_endian=0 -signature file-magic-auto151 { - file-mime "application/x-xz", 90 - file-magic /(\xfd7zXZ\x00)/ -} - # >0 string,=0 string,=GIF94z (len=6), ["ZIF image (GIF+deflate alpha)"], swap_endian=0 -signature file-magic-auto153 { - file-mime "image/x-unknown", 90 - file-magic /(GIF94z)/ -} - -# >0 string,=FGF95a (len=6), ["FGF image (GIF+deflate beta)"], swap_endian=0 -signature file-magic-auto154 { - file-mime "image/x-unknown", 90 - file-magic /(FGF95a)/ -} - # >0 string/t,=# xmcd (len=6), ["xmcd database file for kscd"], swap_endian=0 signature file-magic-auto155 { file-mime "text/x-xmcd", 90 @@ -968,81 +601,6 @@ signature file-magic-auto174 { file-magic /(.{60})(RINEX)(.{15})(.*)(XXRINEXO)/ } -# Doubt it's going to be common to have this many bytes buffered. -# >37633 string,=CD001 (len=5), ["ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)"], swap_endian=0 -#signature file-magic-auto175 { -# file-mime "application/x-iso9660-image", 80 -# file-magic /(.{37633})(CD001)/ -#} - -# >2 string,=-lhd- (len=5), ["LHa 2.x? archive data [lhd]"], swap_endian=0 -signature file-magic-auto176 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlhd\x2d)/ -} - -# >0 string,=WARC/ (len=5), ["WARC Archive"], swap_endian=0 -# >>5 string,x, ["version %.4s"], swap_endian=0 -signature file-magic-auto177 { - file-mime "application/warc", 1 - file-magic /(WARC\x2f)(.{0})/ -} - -# >0 string,=AC1.3 (len=5), ["DWG AutoDesk AutoCAD Release 1.3"], swap_endian=0 -signature file-magic-auto178 { - file-mime "image/vnd.dwg", 80 - file-magic /(AC1\x2e3)/ -} - -# >2 string,=-lh - (len=5), ["LHa 2.x? archive data [lh ]"], swap_endian=0 -signature file-magic-auto179 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh \x2d)/ -} - -# >0 string,=AC1.2 (len=5), ["DWG AutoDesk AutoCAD Release 1.2"], swap_endian=0 -signature file-magic-auto180 { - file-mime "image/vnd.dwg", 80 - file-magic /(AC1\x2e2)/ -} - -# >0 string,=MC0.0 (len=5), ["DWG AutoDesk AutoCAD Release 1.0"], swap_endian=0 -signature file-magic-auto181 { - file-mime "image/vnd.dwg", 80 - file-magic /(MC0\x2e0)/ -} - -# >2 string,=-lzs- (len=5), ["LHa/LZS archive data [lzs]"], swap_endian=0 -signature file-magic-auto182 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlzs\x2d)/ -} - -# >2 string,=-lz5- (len=5), ["LHarc 1.x archive data [lz5]"], swap_endian=0 -signature file-magic-auto183 { - file-mime "application/x-lharc", 80 - file-magic /(.{2})(\x2dlz5\x2d)/ -} - -# Doubt it's going to be common to have this many bytes buffered. -# >32769 string,=CD001 (len=5), ["#"], swap_endian=0 -#signature file-magic-auto184 { -# file-mime "application/x-iso9660-image", 80 -# file-magic /(.{32769})(CD001)/ -#} - -# >2 string,=-lh3- (len=5), ["LHa 2.x? archive data [lh3]"], swap_endian=0 -signature file-magic-auto185 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh3\x2d)/ -} - -# >2 string,=-lh2- (len=5), ["LHa 2.x? archive data [lh2]"], swap_endian=0 -signature file-magic-auto186 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh2\x2d)/ -} - # >0 string,=\000\001\000\000\000 (len=5), ["TrueType font data"], swap_endian=0 signature file-magic-auto187 { file-mime "application/x-font-ttf", 80 @@ -1073,66 +631,18 @@ signature file-magic-auto194 { file-magic /(From\x3a)/ } -# >2 string,=-lh7- (len=5), ["LHa (2.x)/LHark archive data [lh7]"], swap_endian=0 -signature file-magic-auto195 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh7\x2d)/ -} - # >0 string,={\rtf (len=5), ["Rich Text Format data,"], swap_endian=0 signature file-magic-auto196 { file-mime "text/rtf", 80 file-magic /(\x7b\x5crtf)/ } -# >2 string,=-lh6- (len=5), ["LHa (2.x) archive data [lh6]"], swap_endian=0 -signature file-magic-auto197 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh6\x2d)/ -} - -# >2 string,=-lh5- (len=5), ["LHa (2.x) archive data [lh5]"], swap_endian=0 -signature file-magic-auto198 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh5\x2d)/ -} - -# >2 string,=-lh4- (len=5), ["LHa (2.x) archive data [lh4]"], swap_endian=0 -signature file-magic-auto199 { - file-mime "application/x-lha", 80 - file-magic /(.{2})(\x2dlh4\x2d)/ -} - -# >2 string,=-lz4- (len=5), ["LHarc 1.x archive data [lz4]"], swap_endian=0 -signature file-magic-auto200 { - file-mime "application/x-lharc", 80 - file-magic /(.{2})(\x2dlz4\x2d)/ -} - -# >2 string,=-lh1- (len=5), ["LHarc 1.x/ARX archive data [lh1]"], swap_endian=0 -signature file-magic-auto201 { - file-mime "application/x-lharc", 80 - file-magic /(.{2})(\x2dlh1\x2d)/ -} - -# >2 string,=-lh0- (len=5), ["LHarc 1.x/ARX archive data [lh0]"], swap_endian=0 -signature file-magic-auto202 { - file-mime "application/x-lharc", 80 - file-magic /(.{2})(\x2dlh0\x2d)/ -} - # >0 string,=%FDF- (len=5), ["FDF document"], swap_endian=0 signature file-magic-auto203 { file-mime "application/vnd.fdf", 80 file-magic /(\x25FDF\x2d)/ } -# >0 belong&,=443 (0x000001bb), [""], swap_endian=0 -signature file-magic-auto204 { - file-mime "video/mpeg", 71 - file-magic /(\x00\x00\x01\xbb)/ -} - # The non-sequential offsets and use of bitmask and relational operators # made this difficult to autogenerate. Can see about manually creating # the correct character class later. @@ -1145,31 +655,6 @@ signature file-magic-auto204 { # file-magic /(.{4})(.*)([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])(.*)([\x00\x01\x02\x03\x04\x05])(.*)([\x00\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ #} -# >0 belong&,=432 (0x000001b0), [""], swap_endian=0 -signature file-magic-auto206 { - file-mime "video/mp4v-es", 71 - file-magic /(\x00\x00\x01\xb0)/ -} - -# >0 belong&,=437 (0x000001b5), [""], swap_endian=0 -signature file-magic-auto207 { - file-mime "video/mp4v-es", 71 - file-magic /(\x00\x00\x01\xb5)/ -} - -# >0 string,=AWBM (len=4), [""], swap_endian=0 -# >>4 leshort&,<1981 (0x07bd), ["Award BIOS bitmap"], swap_endian=0 -signature file-magic-auto208 { - file-mime "image/x-award-bmp", 20 - file-magic /(AWBM)(.{2})/ -} - -# >0 belong&,=435 (0x000001b3), [""], swap_endian=0 -signature file-magic-auto209 { - file-mime "video/mpv", 71 - file-magic /(\x00\x00\x01\xb3)/ -} - # Converting bitmask to character class might make the regex # unfriendly to humans. # >0 belong&ffffffffff5fff10,=1195376656 (0x47400010), [""], swap_endian=0 @@ -1178,40 +663,6 @@ signature file-magic-auto209 { # file-magic /(.{4})/ #} -# >0 belong&,=1 (0x00000001), [""], swap_endian=0 -# >>4 byte&0000001f,=0x07, [""], swap_endian=0 -signature file-magic-auto211 { - file-mime "video/h264", 41 - file-magic /(\x00\x00\x00\x01)([\x07\x27\x47\x67\x87\xa7\xc7\xe7])/ -} - -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xba, ["MPEG sequence"], swap_endian=0 -signature file-magic-auto213 { - file-mime "video/mpeg", 40 - file-magic /(\x00\x00\x01\xba)/ -} - -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xb0, ["MPEG sequence, v4"], swap_endian=0 -signature file-magic-auto214 { - file-mime "video/mpeg4-generic", 40 - file-magic /(\x00\x00\x01\xb0)/ -} - -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xb5, ["MPEG sequence, v4"], swap_endian=0 -signature file-magic-auto215 { - file-mime "video/mpeg4-generic", 40 - file-magic /(\x00\x00\x01\xb5)/ -} - -# >0 belong&ffffffffffffff00,=256 (0x00000100), [""], swap_endian=0 -# >>3 byte&,=0xb3, ["MPEG sequence"], swap_endian=0 -signature file-magic-auto216 { - file-mime "video/mpeg", 40 - file-magic /(\x00\x00\x01\xb3)/ -} # >0 lelong&,=4 (0x00000004), [""], swap_endian=0 # >>104 lelong&,=4 (0x00000004), ["X11 SNF font data, LSB first"], swap_endian=0 @@ -1220,12 +671,6 @@ signature file-magic-auto217 { file-magic /(\x04\x00\x00\x00)(.{100})(\x04\x00\x00\x00)/ } -# >0 lelong&00ffffff,=93 (0x0000005d), [""], swap_endian=0 -signature file-magic-auto218 { - file-mime "application/x-lzma", 71 - file-magic /(\x5d\x00\x00.)/ -} - # This didn't auto-generate correctly due to non-sequential offsets and # use of bitwise/relational comparisons. At a glance: may not be # that common/useful, leaving for later. @@ -1285,22 +730,6 @@ signature file-magic-auto223 { file-magic /(\x3bELC)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ } -# >0 belong&,=440786851 (0x1a45dfa3), [""], swap_endian=0 -# >>4 search/4096,=B\202 (len=2), [""], swap_endian=0 -# >>>&1 string,=webm (len=4), ["WebM"], swap_endian=0 -signature file-magic-auto224 { - file-mime "video/webm", 70 - file-magic /(\x1a\x45\xdf\xa3)(.*)(B\x82)(.{1})(webm)/ -} - -# >0 belong&,=440786851 (0x1a45dfa3), [""], swap_endian=0 -# >>4 search/4096,=B\202 (len=2), [""], swap_endian=0 -# >>>&1 string,=matroska (len=8), ["Matroska data"], swap_endian=0 -signature file-magic-auto225 { - file-mime "video/x-matroska", 110 - file-magic /(\x1a\x45\xdf\xa3)(.*)(B\x82)(.{1})(matroska)/ -} - # >0 string,=PK\003\004 (len=4), [""], swap_endian=0 # >>4 byte&,=0x14, [""], swap_endian=0 # >>>30 string,=doc.kml (len=7), ["Compressed Google KML Document, including resources."], swap_endian=0 @@ -1502,37 +931,6 @@ signature file-magic-auto245 { file-magic /(PK\x03\x04)(.{22})(\x08\x00\x00\x00mimetypeapplication\x2f)(epub\x2bzip)/ } -# >0 belong&,=442 (0x000001ba), [""], swap_endian=0 -# >>4 byte&,&0x40, [""], swap_endian=0 -signature file-magic-auto250 { - file-mime "video/mp2p", 21 - file-magic /(\x00\x00\x01\xba)([\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff])/ -} - -# >0 belong&,=442 (0x000001ba), [""], swap_endian=0 -# >>4 byte&,^0x40, [""], swap_endian=0 -signature file-magic-auto251 { - file-mime "video/mpeg", 21 - file-magic /(\x00\x00\x01\xba)([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf])/ -} - -# >0 string,=MOVI (len=4), ["Silicon Graphics movie file"], swap_endian=0 -signature file-magic-auto252 { - file-mime "video/x-sgi-movie", 70 - file-magic /(MOVI)/ -} - -# >4 string,=moov (len=4), ["Apple QuickTime"], swap_endian=0 -signature file-magic-auto253 { - file-mime "video/quicktime", 70 - file-magic /(.{4})(moov)/ -} - -# >4 string,=mdat (len=4), ["Apple QuickTime movie (unoptimized)"], swap_endian=0 -signature file-magic-auto254 { - file-mime "video/quicktime", 70 - file-magic /(.{4})(mdat)/ -} # >4 string,=idsc (len=4), ["Apple QuickTime image (fast start)"], swap_endian=0 signature file-magic-auto255 { @@ -1546,82 +944,6 @@ signature file-magic-auto256 { file-magic /(.{4})(pckg)/ } -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=isom (len=4), [", MPEG v4 system, version 1"], swap_endian=0 -signature file-magic-auto257 { - file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(isom)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=mp41 (len=4), [", MPEG v4 system, version 1"], swap_endian=0 -signature file-magic-auto258 { - file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(mp41)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=mp42 (len=4), [", MPEG v4 system, version 2"], swap_endian=0 -signature file-magic-auto259 { - file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(mp42)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string/W,=jp2 (len=3), [", JPEG 2000"], swap_endian=0 -signature file-magic-auto260 { - file-mime "image/jp2", 60 - file-magic /(.{4})(ftyp)(jp2)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3ge (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto261 { - file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3ge)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3gg (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto262 { - file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3gg)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3gp (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto263 { - file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3gp)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3gs (len=3), [", MPEG v4 system, 3GPP"], swap_endian=0 -signature file-magic-auto264 { - file-mime "video/3gpp", 60 - file-magic /(.{4})(ftyp)(3gs)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=3g2 (len=3), [", MPEG v4 system, 3GPP2"], swap_endian=0 -signature file-magic-auto265 { - file-mime "video/3gpp2", 60 - file-magic /(.{4})(ftyp)(3g2)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=mmp4 (len=4), [", MPEG v4 system, 3GPP Mobile"], swap_endian=0 -signature file-magic-auto266 { - file-mime "video/mp4", 70 - file-magic /(.{4})(ftyp)(mmp4)/ -} - -# >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 -# >>8 string,=avc1 (len=4), [", MPEG v4 system, 3GPP JVT AVC"], swap_endian=0 -signature file-magic-auto267 { - file-mime "video/3gpp", 70 - file-magic /(.{4})(ftyp)(avc1)/ -} # >4 string,=ftyp (len=4), ["ISO Media"], swap_endian=0 # >>8 string/W,=M4A (len=3), [", MPEG v4 system, iTunes AAC-LC"], swap_endian=0 @@ -1644,12 +966,6 @@ signature file-magic-auto270 { file-magic /(.{4})(ftyp)(qt)/ } -# >0 string,=Xcur (len=4), ["Xcursor data"], swap_endian=0 -signature file-magic-auto271 { - file-mime "image/x-xcursor", 70 - file-magic /(Xcur)/ -} - # >0 string,=ADIF (len=4), ["MPEG ADIF, AAC"], swap_endian=0 signature file-magic-auto272 { file-mime "audio/x-hx-aac-adif", 70 @@ -1662,17 +978,6 @@ signature file-magic-auto273 { file-magic /(\x30\x26\xb2\x75)/ } -# >0 string,=\212MNG (len=4), ["MNG video data,"], swap_endian=0 -signature file-magic-auto274 { - file-mime "video/x-mng", 70 - file-magic /(\x8aMNG)/ -} - -# >0 string,=\213JNG (len=4), ["JNG video data,"], swap_endian=0 -signature file-magic-auto275 { - file-mime "video/x-jng", 70 - file-magic /(\x8bJNG)/ -} # >0 string,=MAC (len=4), ["Monkey's Audio compressed format"], swap_endian=0 signature file-magic-auto276 { @@ -1713,114 +1018,24 @@ signature file-magic-auto281 { file-magic /(fLaC)/ } -# >0 string,=IIN1 (len=4), ["NIFF image data"], swap_endian=0 -signature file-magic-auto282 { - file-mime "image/x-niff", 70 - file-magic /(IIN1)/ -} - -# >0 string,=MM\000* (len=4), ["TIFF image data, big-endian"], swap_endian=0 -signature file-magic-auto283 { - file-mime "image/tiff", 70 - file-magic /(MM\x00\x2a)/ -} - -# >0 string,=II*\000 (len=4), ["TIFF image data, little-endian"], swap_endian=0 -signature file-magic-auto284 { - file-mime "image/tiff", 70 - file-magic /(II\x2a\x00)/ -} - -# >0 string,=MM\000+ (len=4), ["Big TIFF image data, big-endian"], swap_endian=0 -signature file-magic-auto285 { - file-mime "image/tiff", 70 - file-magic /(MM\x00\x2b)/ -} - -# >0 string,=II+\000 (len=4), ["Big TIFF image data, little-endian"], swap_endian=0 -signature file-magic-auto286 { - file-mime "image/tiff", 70 - file-magic /(II\x2b\x00)/ -} - -# >0 string,=GIF8 (len=4), ["GIF image data"], swap_endian=0 -signature file-magic-auto287 { - file-mime "image/gif", 70 - file-magic /(GIF8)/ -} - # >128 string,=DICM (len=4), ["DICOM medical imaging data"], swap_endian=0 signature file-magic-auto288 { file-mime "application/dicom", 70 file-magic /(.{128})(DICM)/ } -# >0 string,=8BPS (len=4), ["Adobe Photoshop Image"], swap_endian=0 -signature file-magic-auto289 { - file-mime "image/vnd.adobe.photoshop", 70 - file-magic /(8BPS)/ -} - # >0 string,=IMPM (len=4), ["Impulse Tracker module sound data -"], swap_endian=0 signature file-magic-auto290 { file-mime "audio/x-mod", 70 file-magic /(IMPM)/ } -# >0 lelong&,=20000630 (0x01312f76), ["OpenEXR image data,"], swap_endian=0 -signature file-magic-auto291 { - file-mime "image/x-exr", 70 - file-magic /(\x76\x2f\x31\x01)/ -} - -# >0 string,=SDPX (len=4), ["DPX image data, big-endian,"], swap_endian=0 -signature file-magic-auto292 { - file-mime "image/x-dpx", 70 - file-magic /(SDPX)/ -} - # >0 belong&,=235082497 (0x0e031301), ["Hierarchical Data Format (version 4) data"], swap_endian=0 signature file-magic-auto293 { file-mime "application/x-hdf", 70 file-magic /(\x0e\x03\x13\x01)/ } -# >0 string,=CPC\262 (len=4), ["Cartesian Perceptual Compression image"], swap_endian=0 -signature file-magic-auto294 { - file-mime "image/x-cpi", 70 - file-magic /(CPC\xb2)/ -} - -# >0 string,=MMOR (len=4), ["Olympus ORF raw image data, big-endian"], swap_endian=0 -signature file-magic-auto295 { - file-mime "image/x-olympus-orf", 70 - file-magic /(MMOR)/ -} - -# >0 string,=IIRO (len=4), ["Olympus ORF raw image data, little-endian"], swap_endian=0 -signature file-magic-auto296 { - file-mime "image/x-olympus-orf", 70 - file-magic /(IIRO)/ -} - -# >0 string,=IIRS (len=4), ["Olympus ORF raw image data, little-endian"], swap_endian=0 -signature file-magic-auto297 { - file-mime "image/x-olympus-orf", 70 - file-magic /(IIRS)/ -} - -# >0 string,=FOVb (len=4), ["Foveon X3F raw image data"], swap_endian=0 -signature file-magic-auto298 { - file-mime "image/x-x3f", 70 - file-magic /(FOVb)/ -} - -# >0 string,=PDN3 (len=4), ["Paint.NET image data"], swap_endian=0 -signature file-magic-auto299 { - file-mime "image/x-paintnet", 70 - file-magic /(PDN3)/ -} - # >0 belong&,=-17957139 (0xfeedfeed), ["Java KeyStore"], swap_endian=0 signature file-magic-auto302 { file-mime "application/x-java-keystore", 70 @@ -1911,12 +1126,6 @@ signature file-magic-auto316 { file-magic /(\x2e\x72\x61\xfd)/ } -# >0 string,=CTMF (len=4), ["Creative Music (CMF) data"], swap_endian=0 -signature file-magic-auto317 { - file-mime "audio/x-unknown", 70 - file-magic /(CTMF)/ -} - # >0 string,=MThd (len=4), ["Standard MIDI data"], swap_endian=0 signature file-magic-auto318 { file-mime "audio/midi", 70 @@ -2035,36 +1244,6 @@ signature file-magic-auto334 { file-magic /(\x2esnd)(.{8})(\x00\x00\x00\x17)/ } -# >0 string,=SIT! (len=4), ["StuffIt Archive (data)"], swap_endian=0 -signature file-magic-auto335 { - file-mime "application/x-stuffit", 70 - file-magic /(SIT\x21)/ -} - -# >0 string,= (len=4), ["System V Release 1 ar archive"], swap_endian=0 -signature file-magic-auto337 { - file-mime "application/x-archive", 70 - file-magic /(\x3car\x3e)/ -} - -# >0 lelong&ffffffff8080ffff,=2074 (0x0000081a), ["ARC archive data, dynamic LZW"], swap_endian=0 -signature file-magic-auto338 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x08\x1a)/ -} - -# >0 lelong&ffffffff8080ffff,=2330 (0x0000091a), ["ARC archive data, squashed"], swap_endian=0 -signature file-magic-auto339 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x09\x1a)/ -} - -# >0 lelong&ffffffff8080ffff,=538 (0x0000021a), ["ARC archive data, uncompressed"], swap_endian=0 -signature file-magic-auto340 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x02\x1a)/ -} - # >0 lelong&,=270539386 (0x10201a7a), ["Symbian installation file (Symbian OS 9.x)"], swap_endian=0 signature file-magic-auto341 { file-mime "x-epoc/x-sisx-app", 70 @@ -2077,72 +1256,6 @@ signature file-magic-auto342 { file-magic /(.{8})(\x19\x04\x00\x10)/ } -# >0 lelong&ffffffff8080ffff,=794 (0x0000031a), ["ARC archive data, packed"], swap_endian=0 -signature file-magic-auto343 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x03\x1a)/ -} - -# >0 belong&,=518520576 (0x1ee7ff00), ["EET archive"], swap_endian=0 -signature file-magic-auto344 { - file-mime "application/x-eet", 70 - file-magic /(\x1e\xe7\xff\x00)/ -} - -# >0 lelong&ffffffff8080ffff,=1050 (0x0000041a), ["ARC archive data, squeezed"], swap_endian=0 -signature file-magic-auto345 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x04\x1a)/ -} - -# >0 lelong&ffffffff8080ffff,=1562 (0x0000061a), ["ARC archive data, crunched"], swap_endian=0 -signature file-magic-auto346 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x06\x1a)/ -} - -# >0 lelong&ffffffff8080ffff,=2586 (0x00000a1a), ["PAK archive data"], swap_endian=0 -signature file-magic-auto347 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x0a\x1a)/ -} - -# >0 lelong&ffffffff8080ffff,=5146 (0x0000141a), ["ARC+ archive data"], swap_endian=0 -signature file-magic-auto348 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x14\x1a)/ -} - -# >20 lelong&,=-37443620 (0xfdc4a7dc), ["Zoo archive data"], swap_endian=0 -signature file-magic-auto349 { - file-mime "application/x-zoo", 70 - file-magic /(.{20})(\xdc\xa7\xc4\xfd)/ -} - -# >0 string,=Rar! (len=4), ["RAR archive data,"], swap_endian=0 -signature file-magic-auto350 { - file-mime "application/x-rar", 70 - file-magic /(Rar\x21)/ -} - -# >0 lelong&ffffffff8080ffff,=18458 (0x0000481a), ["HYP archive data"], swap_endian=0 -signature file-magic-auto351 { - file-mime "application/x-arc", 70 - file-magic /([\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f]{2})(\x48\x1a)/ -} - -# >0 string,=drpm (len=4), ["Delta RPM"], swap_endian=0 -signature file-magic-auto352 { - file-mime "application/x-rpm", 70 - file-magic /(drpm)/ -} - -# >0 belong&,=-307499301 (0xedabeedb), ["RPM"], swap_endian=0 -signature file-magic-auto353 { - file-mime "application/x-rpm", 70 - file-magic /(\xed\xab\xee\xdb)/ -} - # >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 # >>8 string,=WAVE (len=4), [", WAVE audio"], swap_endian=0 signature file-magic-auto354 { @@ -2150,20 +1263,6 @@ signature file-magic-auto354 { file-magic /(RIFF)(.{4})(WAVE)/ } -# >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 -# >>8 string,=CDRA (len=4), [", Corel Draw Picture"], swap_endian=0 -signature file-magic-auto355 { - file-mime "image/x-coreldraw", 70 - file-magic /(RIFF)(.{4})(CDRA)/ -} - -# >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 -# >>8 string,=CDR6 (len=4), [", Corel Draw Picture, version 6"], swap_endian=0 -signature file-magic-auto356 { - file-mime "image/x-coreldraw", 70 - file-magic /(RIFF)(.{4})(CDR6)/ -} - # >0 string,=RIFF (len=4), ["RIFF (little-endian) data"], swap_endian=0 # >>8 string,=AVI (len=4), [", AVI"], swap_endian=0 signature file-magic-auto357 { @@ -2290,36 +1389,12 @@ signature file-magic-auto381 { file-magic /(\x3cMML)/ } -# >0 lelong&,=407642370 (0x184c2102), ["LZ4 compressed data, legacy format"], swap_endian=0 -signature file-magic-auto382 { - file-mime "application/x-lz4", 70 - file-magic /(\x02\x21\x4c\x18)/ -} - -# >0 lelong&,=407708164 (0x184d2204), ["LZ4 compressed data"], swap_endian=0 -signature file-magic-auto383 { - file-mime "application/x-lz4", 70 - file-magic /(\x04\x22\x4d\x18)/ -} - -# >0 string,=LRZI (len=4), ["LRZIP compressed data"], swap_endian=0 -# >>5 byte&,x, [".%d"], swap_endian=0 -signature file-magic-auto384 { - file-mime "application/x-lrzip", 1 - file-magic /(LRZI)(.{1})(.{1})/ -} - # >0 string,=OggS (len=4), ["Ogg data"], swap_endian=0 signature file-magic-auto385 { file-mime "application/ogg", 70 file-magic /(OggS)/ } -# >0 string,=LZIP (len=4), ["lzip compressed data"], swap_endian=0 -signature file-magic-auto386 { - file-mime "application/x-lzip", 70 - file-magic /(LZIP)/ -} # >0 belong&,=-889270259 (0xcafed00d), ["JAR compressed with pack200,"], swap_endian=0 # >>4 byte&,x, ["%d"], swap_endian=0 @@ -2335,13 +1410,6 @@ signature file-magic-auto388 { file-magic /(\xca\xfe\xd0\x0d)(.{1})/ } -# >0 regex,=^( |\t){0,50}def {1,50}[a-zA-Z]{1,100} (len=38), [""], swap_endian=0 -# >>&0 regex,= {0,50}\(([a-zA-Z]|,| ){1,500}\):$ (len=34), ["Python script text executable"], swap_endian=0 -signature file-magic-auto389 { - file-mime "text/x-python", 64 - file-magic /(.*)(( |\t){0,50}def {1,50}[a-zA-Z]{1,100})( {0,50}\(([a-zA-Z]|,| ){1,500}\):$)/ -} - # >0 search/4096,=\documentstyle (len=14), ["LaTeX document text"], swap_endian=0 signature file-magic-auto390 { file-mime "text/x-tex", 62 @@ -2383,56 +1451,12 @@ signature file-magic-auto395 { file-magic /(DOC)(.{40})([\x16])/ } -# >0 search/w/1,=#! /usr/local/bin/php (len=21), ["PHP script text executable"], swap_endian=0 -signature file-magic-auto396 { - file-mime "text/x-php", 61 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fphp)/ -} - -# >0 search/1,=eval '(exit $?0)' && eval 'exec (len=31), ["Perl script text"], swap_endian=0 -signature file-magic-auto397 { - file-mime "text/x-perl", 61 - file-magic /(.*)(eval \x27\x28exit \x24\x3f0\x29\x27 \x26\x26 eval \x27exec)/ -} - -# >0 regex,=^[ \t]*require[ \t]'[A-Za-z_/]+' (len=30), [""], swap_endian=0 -# >>0 regex,=include [A-Z]|def [a-z]| do$ (len=28), [""], swap_endian=0 -# >>>0 regex,=^[ \t]*end([ \t]*[;#].*)?$ (len=24), ["Ruby script text"], swap_endian=0 -signature file-magic-auto398 { - file-mime "text/x-ruby", 54 - file-magic /(.*)([ \x09]*require[ \x09]'[A-Za-z_\x2f]+')(include [A-Z]|def [a-z]| do$)(^[ \x09]*end([ \x09]*[;#].*)?$)/ -} - -# >0 search/1,=eval "exec /usr/local/bin/perl (len=30), ["Perl script text"], swap_endian=0 -signature file-magic-auto399 { - file-mime "text/x-perl", 60 - file-magic /(.*)(eval \x22exec \x2fusr\x2flocal\x2fbin\x2fperl)/ -} - -# >0 string,=FLV (len=3), ["Macromedia Flash Video"], swap_endian=0 -signature file-magic-auto400 { - file-mime "video/x-flv", 60 - file-magic /(FLV)/ -} - # >0 string,=MP+ (len=3), ["Musepack audio"], swap_endian=0 signature file-magic-auto401 { file-mime "audio/x-musepack", 60 file-magic /(MP\x2b)/ } -# >0 string,=PBF (len=3), ["PBF image (deflate compression)"], swap_endian=0 -signature file-magic-auto402 { - file-mime "image/x-unknown", 60 - file-magic /(PBF)/ -} - -# >0 string,=SBI (len=3), ["SoundBlaster instrument data"], swap_endian=0 -signature file-magic-auto403 { - file-mime "audio/x-unknown", 60 - file-magic /(SBI)/ -} - # >0 string,=\004%! (len=3), ["PostScript document text"], swap_endian=0 signature file-magic-auto405 { file-mime "application/postscript", 60 @@ -2445,32 +1469,12 @@ signature file-magic-auto406 { file-magic /(BZh)/ } -# >0 regex,=^[ \t]*(class|module)[ \t][A-Z] (len=29), [""], swap_endian=0 -# >>0 regex,=(modul|includ)e [A-Z]|def [a-z] (len=31), [""], swap_endian=0 -# >>>0 regex,=^[ \t]*end([ \t]*[;#].*)?$ (len=24), ["Ruby module source text"], swap_endian=0 -signature file-magic-auto407 { - file-mime "text/x-ruby", 54 - file-magic /(.*)([ \x09]*(class|module)[ \x09][A-Z])((modul|includ)e [A-Z]|def [a-z])(^[ \x09]*end([ \x09]*[;#].*)?$)/ -} - -# >0 regex/20,=^\.[A-Za-z0-9][A-Za-z0-9][ \t] (len=29), ["troff or preprocessor input text"], swap_endian=0 -#signature file-magic-auto411 { -# file-mime "text/troff", 59 -# file-magic /(^\.[A-Za-z0-9][A-Za-z0-9][ \x09])/ -#} - # >0 search/4096,=\documentclass (len=14), ["LaTeX 2e document text"], swap_endian=0 signature file-magic-auto412 { file-mime "text/x-tex", 59 file-magic /(.*)(\x5cdocumentclass)/ } -# >0 regex,=^from\s+(\w|\.)+\s+import.*$ (len=28), ["Python script text executable"], swap_endian=0 -signature file-magic-auto413 { - file-mime "text/x-python", 58 - file-magic /(.*)(from\s+(\w|\.)+\s+import.*$)/ -} - # >0 search/4096,=\contentsline (len=13), ["LaTeX table of contents"], swap_endian=0 signature file-magic-auto414 { file-mime "text/x-tex", 58 @@ -2489,117 +1493,30 @@ signature file-magic-auto416 { file-magic /(.*)(\x5csection)/ } -# >0 regex/20,=^\.[A-Za-z0-9][A-Za-z0-9]$ (len=26), ["troff or preprocessor input text"], swap_endian=0 -#signature file-magic-auto417 { -# file-mime "text/troff", 56 -# file-magic /(^\.[A-Za-z0-9][A-Za-z0-9]$)/ -#} - -# >0 search/w/1,=#! /usr/bin/php (len=15), ["PHP script text executable"], swap_endian=0 -signature file-magic-auto418 { - file-mime "text/x-php", 55 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2fbin\x2fphp)/ -} - # >0 search/4096,=\setlength (len=10), ["LaTeX document text"], swap_endian=0 signature file-magic-auto419 { file-mime "text/x-tex", 55 file-magic /(.*)(\x5csetlength)/ } -# >0 search/1,=eval "exec /usr/bin/perl (len=24), ["Perl script text"], swap_endian=0 -signature file-magic-auto420 { - file-mime "text/x-perl", 54 - file-magic /(.*)(eval \x22exec \x2fusr\x2fbin\x2fperl)/ -} - # >0 search/1,=Common subdirectories: (len=23), ["diff output text"], swap_endian=0 signature file-magic-auto422 { file-mime "text/x-diff", 53 file-magic /(.*)(Common subdirectories\x3a )/ } -# >0 search/w/1,=#! /usr/local/bin/wish (len=22), ["Tcl/Tk script text executable"], swap_endian=0 -signature file-magic-auto425 { - file-mime "text/x-tcl", 52 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2fwish)/ -} - # >0 search/4096,=(custom-set-variables (len=22), ["Lisp/Scheme program text"], swap_endian=0 signature file-magic-auto426 { file-mime "text/x-lisp", 52 file-magic /(.*)(\x28custom\x2dset\x2dvariables )/ } -# >0 beshort&,=-40 (0xffd8), ["JPEG image data"], swap_endian=0 -signature file-magic-auto427 { - file-mime "image/jpeg", 52 - file-magic /(\xff\xd8)/ -} - -# >0 search/1,=#!/usr/bin/env nodejs (len=21), ["Node.js script text executable"], swap_endian=0 -signature file-magic-auto429 { - file-mime "application/javascript", 51 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv nodejs)/ -} - -# >0 search/w/1,=#! /usr/local/bin/tcl (len=21), ["Tcl script text executable"], swap_endian=0 -signature file-magic-auto430 { - file-mime "text/x-tcl", 51 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2ftcl)/ -} - -# This didn't autogenerate well due to indirect offset, bitmasking, and -# relational comparisons. -# >0 leshort&fffffffffffffefe,=0 (0x0000), [""], swap_endian=0 -# >>4 ulelong&fcfffe00,=0 (0x00000000), [""], swap_endian=0 -# >>>68 ulelong&,>87 (0x00000057), [""], swap_endian=0 -# >>>>68 (lelong,-1), ubelong&ffe0c519,=4194328 (0x00400018), ["Windows Precompiled iNF"], swap_endian=0 -#signature file-magic-auto431 { -# file-mime "application/x-pnf", 70 -# file-magic /(.{2})(.{2})(.{4})(.{60})(.{4})(.{4})/ -#} - -# >0 search/w/1,=#! /usr/local/bin/lua (len=21), ["Lua script text executable"], swap_endian=0 -signature file-magic-auto432 { - file-mime "text/x-lua", 51 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2flocal\x2fbin\x2flua)/ -} - # >0 string/b,=MZ (len=2), [""], swap_endian=0 signature file-magic-auto433 { file-mime "application/x-dosexec", 51 file-magic /(MZ)/ } -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>30 string,=Copyright 1989-1990 PKWARE Inc. (len=31), ["Self-extracting PKZIP archive"], swap_endian=0 -signature file-magic-auto434 { - file-mime "application/zip", 340 - file-magic /(MZ)(.{28})(Copyright 1989\x2d1990 PKWARE Inc\x2e)/ -} - -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>30 string,=PKLITE Copr. (len=12), ["Self-extracting PKZIP archive"], swap_endian=0 -signature file-magic-auto435 { - file-mime "application/zip", 150 - file-magic /(MZ)(.{28})(PKLITE Copr\x2e)/ -} - -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>36 string,=LHa's SFX (len=9), [", LHa self-extracting archive"], swap_endian=0 -signature file-magic-auto436 { - file-mime "application/x-lha", 120 - file-magic /(MZ)(.{34})(LHa\x27s SFX)/ -} - -# >0 string/b,=MZ (len=2), [""], swap_endian=0 -# >>36 string,=LHA's SFX (len=9), [", LHa self-extracting archive"], swap_endian=0 -signature file-magic-auto437 { - file-mime "application/x-lha", 120 - file-magic /(MZ)(.{34})(LHA\x27s SFX)/ -} - # >0 beshort&fffffffffffffffe,=-6 (0xfffa), [""], swap_endian=0 # >>2 byte&fffffffffffffff0,=0x10, ["MPEG ADTS, layer III, v1, 32 kbps"], swap_endian=0 signature file-magic-auto438 { @@ -2698,64 +1615,6 @@ signature file-magic-auto451 { file-magic /(\xff[\xfa\xfb])([\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef])/ } -# >4 leshort&,=-20719 (0xaf11), [""], swap_endian=0 -# >>8 leshort&,=320 (0x0140), [""], swap_endian=0 -# >>>10 leshort&,=200 (0x00c8), [""], swap_endian=0 -# >>>>12 leshort&,=8 (0x0008), ["FLI animation, 320x200x8"], swap_endian=0 -signature file-magic-auto452 { - file-mime "video/x-fli", 50 - file-magic /(.{4})(\x11\xaf)(.{2})(\x40\x01)(\xc8\x00)(\x08\x00)/ -} - -# >4 leshort&,=-20718 (0xaf12), [""], swap_endian=0 -# >>12 leshort&,=8 (0x0008), ["FLC animation"], swap_endian=0 -signature file-magic-auto453 { - file-mime "video/x-flc", 50 - file-magic /(.{4})(\x12\xaf)(.{6})(\x08\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=12 (0x000c), ["PC bitmap, OS/2 1.x format"], swap_endian=0 -signature file-magic-auto454 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x0c\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=64 (0x0040), ["PC bitmap, OS/2 2.x format"], swap_endian=0 -signature file-magic-auto455 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x40\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=40 (0x0028), ["PC bitmap, Windows 3.x format"], swap_endian=0 -signature file-magic-auto456 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x28\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=124 (0x007c), ["PC bitmap, Windows 98/2000 and newer format"], swap_endian=0 -signature file-magic-auto457 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x7c\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=108 (0x006c), ["PC bitmap, Windows 95/NT4 and newer format"], swap_endian=0 -signature file-magic-auto458 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x6c\x00)/ -} - -# >0 string,=BM (len=2), [""], swap_endian=0 -# >>14 leshort&,=128 (0x0080), ["PC bitmap, Windows NT/2000 format"], swap_endian=0 -signature file-magic-auto459 { - file-mime "image/x-ms-bmp", 50 - file-magic /(BM)(.{12})(\x80\x00)/ -} - # >20 string,=45 (len=2), [""], swap_endian=0 # >>0 regex/1,=(^[0-9]{5})[acdnp][^bhlnqsu-z] (len=30), ["MARC21 Bibliographic"], swap_endian=0 signature file-magic-auto460 { @@ -2786,37 +1645,7 @@ signature file-magic-auto463 { # >0 search/4096,=\begin (len=6), ["LaTeX document text"], swap_endian=0 signature file-magic-auto464 { file-mime "text/x-tex", 51 - file-magic /(.*)(\x5cbegin)/ -} - -# >0 search/4096,=\input (len=6), ["TeX document text"], swap_endian=0 -signature file-magic-auto465 { - file-mime "text/x-tex", 51 - file-magic /(.*)(\x5cinput)/ -} - -# >0 leshort&,=-24712 (0x9f78), ["TNEF"], swap_endian=0 -signature file-magic-auto466 { - file-mime "application/vnd.ms-tnef", 50 - file-magic /(\x78\x9f)/ -} - -# >0 leshort&,=-5536 (0xea60), ["ARJ archive data"], swap_endian=0 -signature file-magic-auto467 { - file-mime "application/x-arj", 50 - file-magic /(\x60\xea)/ -} - -# >0 search/1,=eval "exec /bin/perl (len=20), ["Perl script text"], swap_endian=0 -signature file-magic-auto468 { - file-mime "text/x-perl", 50 - file-magic /(.*)(eval \x22exec \x2fbin\x2fperl)/ -} - -# >0 search/1,=#! /usr/bin/env perl (len=20), ["Perl script text executable"], swap_endian=0 -signature file-magic-auto469 { - file-mime "text/x-perl", 50 - file-magic /(.*)(\x23\x21 \x2fusr\x2fbin\x2fenv perl)/ + file-magic /.*\x5c(input|begin)/ } # >0 beshort&,=-26368 (0x9900), ["PGP key public ring"], swap_endian=0 @@ -2869,42 +1698,6 @@ signature file-magic-auto478 { file-magic /((^[0-9]{5})[acdn][w])((^.{21})([^0]{2}))/ } -# >0 short&,=-14479 (0xc771), ["byte-swapped cpio archive"], swap_endian=0 -signature file-magic-auto479 { - file-mime "application/x-cpio", 50 - file-magic /((\x71\xc7)|(\xc7\x71))/ -} - -# >0 short&,=29127 (0x71c7), ["cpio archive"], swap_endian=0 -signature file-magic-auto480 { - file-mime "application/x-cpio", 50 - file-magic /((\xc7\x71)|(\x71\xc7))/ -} - -# >0 string,=\n( (len=2), ["Emacs v18 byte-compiled Lisp data"], swap_endian=0 -#signature file-magic-auto481 { -# file-mime "application/x-elc", 50 -# file-magic /(\x0a\x28)/ -#} - -# >0 string,=\021\t (len=2), ["Award BIOS Logo, 136 x 126"], swap_endian=0 -signature file-magic-auto482 { - file-mime "image/x-award-bioslogo", 50 - file-magic /(\x11\x09)/ -} - -# >0 string,=\021\006 (len=2), ["Award BIOS Logo, 136 x 84"], swap_endian=0 -signature file-magic-auto483 { - file-mime "image/x-award-bioslogo", 50 - file-magic /(\x11\x06)/ -} - -# >0 string,=P7 (len=2), ["Netpbm PAM image file"], swap_endian=0 -signature file-magic-auto484 { - file-mime "image/x-portable-pixmap", 50 - file-magic /(P7)/ -} - # >0 beshort&ffffffffffffffe0,=22240 (0x56e0), ["MPEG-4 LOAS"], swap_endian=0 signature file-magic-auto485 { file-mime "audio/x-mp4a-latm", 50 @@ -2941,12 +1734,6 @@ signature file-magic-auto490 { file-magic /(\xff[\xfc\xfd])/ } -# >0 search/1,=#! /usr/bin/env wish (len=20), ["Tcl/Tk script text executable"], swap_endian=0 -signature file-magic-auto491 { - file-mime "text/x-tcl", 50 - file-magic /(.*)(\x23\x21 \x2fusr\x2fbin\x2fenv wish)/ -} - # >0 beshort&,=-26367 (0x9901), ["GPG key public ring"], swap_endian=0 signature file-magic-auto492 { file-mime "application/x-gnupg-keyring", 50 @@ -2959,79 +1746,12 @@ signature file-magic-auto493 { file-magic /(\xf7\x02)/ } -## >2 string,=\000\021 (len=2), ["TeX font metric data"], swap_endian=0 -#signature file-magic-auto494 { -# file-mime "application/x-tex-tfm", 50 -# file-magic /(.{2})(\x00\x11)/ -#} -# -## >2 string,=\000\022 (len=2), ["TeX font metric data"], swap_endian=0 -#signature file-magic-auto495 { -# file-mime "application/x-tex-tfm", 50 -# file-magic /(.{2})(\x00\x12)/ -#} - # >0 beshort&,=-31486 (0x8502), ["GPG encrypted data"], swap_endian=0 signature file-magic-auto496 { file-mime "text/PGP", 50 file-magic /(\x85\x02)/ } -# >4 string/W,=jP (len=2), ["JPEG 2000 image"], swap_endian=0 -signature file-magic-auto497 { - file-mime "image/jp2", 50 - file-magic /(.{4})(jP)/ -} - -# Not specific enough. -# >0 regex,=^template[ \t\n]+ (len=15), ["C++ source text"], swap_endian=0 -#signature file-magic-auto498 { -# file-mime "text/x-c++", 50 -# file-magic /(.*)(template[ \x09\x0a]+)/ -#} - -# >0 search/c/1,=0 string,=\037\235 (len=2), ["compress'd data"], swap_endian=0 -signature file-magic-auto500 { - file-mime "application/x-compress", 50 - file-magic /(\x1f\x9d)/ -} - -# >0 string,=\037\036 (len=2), ["packed data"], swap_endian=0 -#signature file-magic-auto501 { -# file-mime "application/octet-stream", 50 -# file-magic /(\x1f\x1e)/ -#} - -# >0 short&,=7967 (0x1f1f), ["old packed data"], swap_endian=0 -#signature file-magic-auto502 { -# file-mime "application/octet-stream", 50 -# file-magic /((\x1f\x1f)|(\x1f\x1f))/ -#} - -# >0 short&,=8191 (0x1fff), ["compacted data"], swap_endian=0 -#signature file-magic-auto503 { -# file-mime "application/octet-stream", 50 -# file-magic /((\xff\x1f)|(\x1f\xff))/ -#} - -# >0 string,=\377\037 (len=2), ["compacted data"], swap_endian=0 -#signature file-magic-auto504 { -# file-mime "application/octet-stream", 50 -# file-magic /(\xff\x1f)/ -#} - -# >0 short&,=-13563 (0xcb05), ["huf output"], swap_endian=0 -#signature file-magic-auto505 { -# file-mime "application/octet-stream", 50 -# file-magic /((\x05\xcb)|(\xcb\x05))/ -#} - # >34 string,=LP (len=2), ["Embedded OpenType (EOT)"], swap_endian=0 signature file-magic-auto506 { file-mime "application/vnd.ms-fontobject", 50 @@ -3044,130 +1764,12 @@ signature file-magic-auto507 { file-magic /(\x0b\x77)/ } -# >0 search/1,=#!/usr/bin/env node (len=19), ["Node.js script text executable"], swap_endian=0 -signature file-magic-auto508 { - file-mime "application/javascript", 49 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv node)/ -} - -# >0 search/1,=#!/usr/bin/env wish (len=19), ["Tcl/Tk script text executable"], swap_endian=0 -signature file-magic-auto509 { - file-mime "text/x-tcl", 49 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv wish)/ -} - -# >0 regex,=^[ \t]{0,50}\.asciiz (len=19), ["assembler source text"], swap_endian=0 -signature file-magic-auto510 { - file-mime "text/x-asm", 49 - file-magic /(^[ \x09]{0,50}\.(asciiz|asciz|section|globl|align|even|byte|file|type))/ -} - -# >0 regex,=^[ \t]{0,50}\.globl (len=18), ["assembler source text"], swap_endian=0 -#signature file-magic-auto517 { -# file-mime "text/x-asm", 48 -# file-magic /(^[ \x09]{0,50}\.globl)/ -#} - -# >0 regex,=^[ \t]{0,50}\.text (len=17), ["assembler source text"], swap_endian=0 -#signature file-magic-auto523 { -# file-mime "text/x-asm", 47 -# file-magic /(^[ \x09]{0,50}\.text)/ -#} - -# >0 regex,=^[ \t]{0,50}\.even (len=17), ["assembler source text"], swap_endian=0 -#signature file-magic-auto524 { -# file-mime "text/x-asm", 47 -# file-magic /(^[ \x09]{0,50}\.even)/ -#} - -# >0 regex,=^[ \t]{0,50}\.byte (len=17), ["assembler source text"], swap_endian=0 -#signature file-magic-auto525 { -# file-mime "text/x-asm", 47 -# file-magic /(^[ \x09]{0,50}\.byte)/ -#} - -# >0 regex,=^[ \t]{0,50}\.file (len=17), ["assembler source text"], swap_endian=0 -#signature file-magic-auto526 { -# file-mime "text/x-asm", 47 -# file-magic /(^[ \x09]{0,50}\.file)/ -#} - -# >0 regex,=^[ \t]{0,50}\.type (len=17), ["assembler source text"], swap_endian=0 -#signature file-magic-auto527 { -# file-mime "text/x-asm", 47 -# file-magic /(^[ \x09]{0,50}\.type)/ -#} - - -# >0 search/1,=#!/usr/bin/env perl (len=19), ["Perl script text executable"], swap_endian=0 -signature file-magic-auto511 { - file-mime "text/x-perl", 49 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv perl)/ -} - -# >0 search/Wct/4096,=0 regex,=^virtual[ \t\n]+ (len=14), ["C++ source text"], swap_endian=0 -#signature file-magic-auto513 { -# file-mime "text/x-c++", 49 -# file-magic /(.*)(virtual[ \x09\x0a]+)/ -#} - -# >0 search/1,=#! /usr/bin/env lua (len=19), ["Lua script text executable"], swap_endian=0 -signature file-magic-auto514 { - file-mime "text/x-lua", 49 - file-magic /(.*)(\x23\x21 \x2fusr\x2fbin\x2fenv lua)/ -} - -# >0 search/1,=#! /usr/bin/env tcl (len=19), ["Tcl script text executable"], swap_endian=0 -signature file-magic-auto516 { - file-mime "text/x-tcl", 49 - file-magic /(.*)(\x23\x21 \x2fusr\x2fbin\x2fenv tcl)/ -} -# >0 search/1,=#!/usr/bin/env tcl (len=18), ["Tcl script text executable"], swap_endian=0 -signature file-magic-auto518 { - file-mime "text/x-tcl", 48 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv tcl)/ -} - -# >0 search/1,=#!/usr/bin/env lua (len=18), ["Lua script text executable"], swap_endian=0 -signature file-magic-auto519 { - file-mime "text/x-lua", 48 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fenv lua)/ -} - -# >0 search/w/1,=#!/usr/bin/nodejs (len=17), ["Node.js script text executable"], swap_endian=0 -signature file-magic-auto521 { - file-mime "application/javascript", 47 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fnodejs)/ -} - -# >0 regex,=^class[ \t\n]+ (len=12), ["C++ source text"], swap_endian=0 -#signature file-magic-auto522 { -# file-mime "text/x-c++", 47 -# file-magic /(.*)(class[ \x09\x0a]+[[:alnum:]_]+)(.*)(\x7b)(.*)(public:)/ -#} - # >0 search/1,=This is Info file (len=17), ["GNU Info text"], swap_endian=0 signature file-magic-auto528 { file-mime "text/x-info", 47 file-magic /(.*)(This is Info file)/ } -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(autorun)]\r\n (len=13), [""], swap_endian=0 -# >>>>&0 ubyte&,=0x5b, ["INItialization configuration"], swap_endian=0 -signature file-magic-auto529 { - file-mime "application/x-wine-extension-ini", 40 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([aA][uU][tT][oO][rR][uU][nN])]\x0d\x0a)([\x5b])/ -} - # >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 # >>&0 search/8192,=[ (len=1), [""], swap_endian=0 # >>>&0 regex/c,=^(autorun)]\r\n (len=13), [""], swap_endian=0 @@ -3185,70 +1787,6 @@ signature file-magic-auto531 { file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([vV][eE][rR][sS][iI][oO][nN]|[sS][tT][rR][iI][nN][gG][sS])])/ } -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(WinsockCRCList|OEMCPL)] (len=25), ["Windows setup INFormation"], swap_endian=0 -signature file-magic-auto532 { - file-mime "text/inf", 55 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([Ww][iI][nN][sS][oO][cC][kK][Cc][Rr][Cc][Ll][iI][sS][tT]|[Oo][Ee][Mm][Cc][Pp][Ll])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(.ShellClassInfo|DeleteOnCopy|LocalizedFileNames)] (len=51), ["Windows desktop.ini"], swap_endian=0 -signature file-magic-auto533 { - file-mime "application/x-wine-extension-ini", 81 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^(.[Ss][hH][eE][lL][lL][Cc][lL][aA][sS][sS][Ii][nN][fF][oO]|[Dd][eE][lL][eE][tT][eE][Oo][nN][Cc][oO][pP][yY]|[Ll][oO][cC][aA][lL][iI][zZ][eE][dD][Ff][iI][lL][eE][Nn][aA][mM][eE][sS])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(don't load)] (len=14), ["Windows CONTROL.INI"], swap_endian=0 -signature file-magic-auto534 { - file-mime "application/x-wine-extension-ini", 44 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([dD][oO][nN]'[tT] [lL][oO][aA][dD])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(ndishlp\$|protman\$|NETBEUI\$)] (len=33), ["Windows PROTOCOL.INI"], swap_endian=0 -signature file-magic-auto535 { - file-mime "application/x-wine-extension-ini", 63 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([nN][dD][iI][sS][hH][lL][pP]\$|[pP][rR][oO][tT][mM][aA][nN]\$|[Nn][Ee][Tt][Bb][Ee][Uu][Ii]\$)])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(windows|Compatibility|embedding)] (len=35), ["Windows WIN.INI"], swap_endian=0 -signature file-magic-auto536 { - file-mime "application/x-wine-extension-ini", 65 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([wW][iI][nN][dD][oO][wW][sS]|[Cc][oO][mM][pP][aA][tT][iI][bB][iI][lL][iI][tT][yY]|[eE][mM][bB][eE][dD][dD][iI][nN][gG])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(boot|386enh|drivers)] (len=23), ["Windows SYSTEM.INI"], swap_endian=0 -signature file-magic-auto537 { - file-mime "application/x-wine-extension-ini", 53 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([bB][oO][oO][tT]|386[eE][nN][hH]|[dD][rR][iI][vV][eE][rR][sS])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(SafeList)] (len=12), ["Windows IOS.INI"], swap_endian=0 -signature file-magic-auto538 { - file-mime "application/x-wine-extension-ini", 42 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([Ss][aA][fF][eE][Ll][iI][sS][tT])])/ -} - -# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 -# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 -# >>>&0 regex/c,=^(boot loader)] (len=15), ["Windows boot.ini"], swap_endian=0 -signature file-magic-auto539 { - file-mime "application/x-wine-extension-ini", 45 - file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([bB][oO][oO][tT] [lL][oO][aA][dD][eE][rR])])/ -} - # >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 # >>&0 search/8192,=[ (len=1), [""], swap_endian=0 # >>>&0 ubequad&ffdfffdfffdfffdf,=24207144355233875 (0x0056004500520053), [""], swap_endian=0 @@ -3288,138 +1826,26 @@ signature file-magic-auto543 { file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(.*)(\x5b)(\x00[\x56\x76]\x00[\x45\x65]\x00[\x52\x72]\x00[\x53\x73])(\x00[\x49\x69]\x00[\x4f\x6f]\x00[\x4e\x6e]\x00\x5d)/ } +# >0 regex/s,=\`(\r\n|;|[[]|\377\376) (len=15), [""], swap_endian=0 +# >>&0 search/8192,=[ (len=1), [""], swap_endian=0 +# >>>&0 regex/c,=^(WinsockCRCList|OEMCPL)] (len=25), ["Windows setup INFormation"], swap_endian=0 +signature file-magic-auto532 { + file-mime "text/inf", 55 + file-magic /(\`(\x0d\x0a|;|[[]|\xff\xfe))(.*)(\x5b)(^([Ww][iI][nN][sS][oO][cC][kK][Cc][Rr][Cc][Ll][iI][sS][tT]|[Oo][Ee][Mm][Cc][Pp][Ll])])/ +} + # >0 search/1,=0 search/w/1,=#! /usr/bin/wish (len=16), ["Tcl/Tk script text executable"], swap_endian=0 -signature file-magic-auto545 { - file-mime "text/x-tcl", 46 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2fbin\x2fwish)/ -} - -# >0 search/w/1,=#! /usr/bin/lua (len=15), ["Lua script text executable"], swap_endian=0 -signature file-magic-auto547 { - file-mime "text/x-lua", 45 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2fbin\x2flua)/ -} - -# >0 search/w/1,=#! /usr/bin/tcl (len=15), ["Tcl script text executable"], swap_endian=0 -signature file-magic-auto548 { - file-mime "text/x-tcl", 45 - file-magic /(.*)(\x23\x21 ?\x2fusr\x2fbin\x2ftcl)/ -} - -# >0 search/wct/4096,=0 search/wct/4096,=0 search/w/1,=#!/usr/bin/node (len=15), ["Node.js script text executable"], swap_endian=0 -signature file-magic-auto551 { - file-mime "application/javascript", 45 - file-magic /(.*)(\x23\x21\x2fusr\x2fbin\x2fnode)/ -} - -# >0 search/wct/1,=0 search/1,=\input texinfo (len=14), ["Texinfo source text"], swap_endian=0 -signature file-magic-auto553 { - file-mime "text/x-texinfo", 44 - file-magic /(.*)(\x5cinput texinfo)/ -} - -# Not specific enough. -# >0 regex,=^private: (len=9), ["C++ source text"], swap_endian=0 -#signature file-magic-auto554 { -# file-mime "text/x-c++", 44 -# file-magic /(.*)(private:)/ -#} - -# >0 search/4096,=def __init__ (len=12), [""], swap_endian=0 -# >>&0 search/64,=self (len=4), ["Python script text executable"], swap_endian=0 -signature file-magic-auto555 { - file-mime "text/x-python", 38 - file-magic /(.*)(def \x5f\x5finit\x5f\x5f)(.*)(self)/ -} - -# >0 search/wct/4096,=0 regex,=^extern[ \t\n]+ (len=13), ["C source text"], swap_endian=0 -#signature file-magic-auto557 { -# file-mime "text/x-c", 43 -# file-magic /(.*)(extern[ \x09\x0a]+)/ -#} - # >0 search/4096,=% -*-latex-*- (len=13), ["LaTeX document text"], swap_endian=0 signature file-magic-auto558 { file-mime "text/x-tex", 43 file-magic /(.*)(\x25 \x2d\x2a\x2dlatex\x2d\x2a\x2d)/ } -# Doesn't seem specific enough. -# >0 regex,=^double[ \t\n]+ (len=13), ["C source text"], swap_endian=0 -#signature file-magic-auto559 { -# file-mime "text/x-c", 43 -# file-magic /(^double[ \x09\x0a]+)/ -#} - -# >0 regex,=^struct[ \t\n]+ (len=13), ["C source text"], swap_endian=0 -#signature file-magic-auto560 { -# file-mime "text/x-c", 43 -# file-magic /(.*)(struct[ \x09\x0a]+)/ -#} - -# >0 search/w/1,=#!/bin/nodejs (len=13), ["Node.js script text executable"], swap_endian=0 -signature file-magic-auto561 { - file-mime "application/javascript", 43 - file-magic /(.*)(\x23\x21\x2fbin\x2fnodejs)/ -} - -# Not specific enough. -# >0 regex,=^public: (len=8), ["C++ source text"], swap_endian=0 -#signature file-magic-auto562 { -# file-mime "text/x-c++", 43 -# file-magic /(.*)(public:)/ -#} - -# >0 search/wct/4096,=