mirror of
https://github.com/zeek/zeek.git
synced 2025-10-04 15:48:19 +00:00
037d582b0e
- It's derived from the magic database of libmagic 5.14, but with most everything not related to mime types removed. - The custom database is always used by default for mime detection, but the more verbose file type detection will fall back on the default libmagic installation's database. The result is: mime type strings are now guaranteed to be consistent across platforms, but the verbose file type descriptions are not. - The custom database gets installed in $prefix/share/bro/magic, and should even be extensible if files with new patterns are added inside the directory. - The search path for the mime magic database can be controlled via BROMAGIC environment variable. - Remove mime_desc field from ftp.log. - Stop using the mime/file type canonifier with unit tests. - libmagic >= 5.04 is now a requirement.
255 lines
8.7 KiB
Text
255 lines
8.7 KiB
Text
# See COPYING file in this directory for original libmagic copyright.
|
|
#------------------------------------------------------------------------------
|
|
# $File: images,v 1.80 2013/02/06 14:18:52 christos Exp $
|
|
# images: file(1) magic for image formats (see also "iff", and "c-lang" for
|
|
# XPM bitmaps)
|
|
#
|
|
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
|
|
# additions by janl@ifi.uio.no as well as others. Jan also suggested
|
|
# merging several one- and two-line files into here.
|
|
#
|
|
# little magic: PCX (first byte is 0x0a)
|
|
|
|
# PBMPLUS images
|
|
# The next byte following the magic is always whitespace.
|
|
# strength is changed to try these patterns before "x86 boot sector"
|
|
0 search/1 P1
|
|
>3 regex =[0-9]*\ [0-9]* Netpbm PBM image text
|
|
>3 regex =[0-9]+\ \b, size = %sx
|
|
>>3 regex =\ [0-9]+ \b%s
|
|
!:strength + 45
|
|
!:mime image/x-portable-bitmap
|
|
0 search/1 P2
|
|
>3 regex =[0-9]*\ [0-9]* Netpbm PGM image text
|
|
>3 regex =[0-9]+\ \b, size = %sx
|
|
>>3 regex =\ [0-9]+ \b%s
|
|
!:strength + 45
|
|
!:mime image/x-portable-greymap
|
|
0 search/1 P3 Netpbm PPM image text
|
|
>3 regex =[0-9]*\ [0-9]* Netpbm PPM image text
|
|
>3 regex =[0-9]+\ \b, size = %sx
|
|
>>3 regex =\ [0-9]+ \b%s
|
|
!:strength + 45
|
|
!:mime image/x-portable-pixmap
|
|
0 string P4
|
|
>3 regex =[0-9]*\ [0-9]* Netpbm PBM "rawbits" image data
|
|
>3 regex =[0-9]+\ \b, size = %sx
|
|
>>3 regex =\ [0-9]+ \b%s
|
|
!:strength + 45
|
|
!:mime image/x-portable-bitmap
|
|
0 string P5
|
|
>3 regex =[0-9]*\ [0-9]* Netpbm PGM "rawbits" image data
|
|
>3 regex =[0-9]+\ \b, size = %sx
|
|
>>3 regex =\ [0-9]+ \b%s
|
|
!:strength + 45
|
|
!:mime image/x-portable-greymap
|
|
0 string P6
|
|
>3 regex =[0-9]*\ [0-9]* Netpbm PPM "rawbits" image data
|
|
>3 regex =[0-9]+\ \b, size = %sx
|
|
>>3 regex =\ [0-9]+ \b%s
|
|
!:strength + 45
|
|
!:mime image/x-portable-pixmap
|
|
0 string P7 Netpbm PAM image file
|
|
!:mime image/x-portable-pixmap
|
|
|
|
# NIFF (Navy Interchange File Format, a modification of TIFF) images
|
|
# [GRR: this *must* go before TIFF]
|
|
0 string IIN1 NIFF image data
|
|
!:mime image/x-niff
|
|
|
|
# Canon RAW version 1 (CRW) files are a type of Canon Image File Format
|
|
# (CIFF) file. These are apparently all little-endian.
|
|
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
|
# URL: http://www.sno.phy.queensu.ca/~phil/exiftool/canon_raw.html
|
|
0 string II\x1a\0\0\0HEAPCCDR Canon CIFF raw image data
|
|
!:mime image/x-canon-crw
|
|
|
|
# Canon RAW version 2 (CR2) files are a kind of TIFF with an extra magic
|
|
# number. Put this above the TIFF test to make sure we detect them.
|
|
# These are apparently all little-endian.
|
|
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
|
# URL: http://libopenraw.freedesktop.org/wiki/Canon_CR2
|
|
0 string II\x2a\0\x10\0\0\0CR Canon CR2 raw image data
|
|
!:mime image/x-canon-cr2
|
|
|
|
# Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
|
|
# The second word of TIFF files is the TIFF version number, 42, which has
|
|
# never changed. The TIFF specification recommends testing for it.
|
|
0 string MM\x00\x2a TIFF image data, big-endian
|
|
!:mime image/tiff
|
|
0 string II\x2a\x00 TIFF image data, little-endian
|
|
!:mime image/tiff
|
|
|
|
0 string MM\x00\x2b Big TIFF image data, big-endian
|
|
!:mime image/tiff
|
|
0 string II\x2b\x00 Big TIFF image data, little-endian
|
|
!:mime image/tiff
|
|
|
|
# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
|
|
# (Greg Roelofs, newt@uchicago.edu)
|
|
# (Albert Cahalan, acahalan@cs.uml.edu)
|
|
#
|
|
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
|
|
#
|
|
0 string \x89PNG\x0d\x0a\x1a\x0a PNG image data
|
|
!:mime image/png
|
|
|
|
# possible GIF replacements; none yet released!
|
|
# (Greg Roelofs, newt@uchicago.edu)
|
|
#
|
|
# GRR 950115: this was mine ("Zip GIF"):
|
|
0 string GIF94z ZIF image (GIF+deflate alpha)
|
|
!:mime image/x-unknown
|
|
#
|
|
# GRR 950115: this is Jeremy Wohl's Free Graphics Format (better):
|
|
#
|
|
0 string FGF95a FGF image (GIF+deflate beta)
|
|
!:mime image/x-unknown
|
|
#
|
|
# GRR 950115: this is Thomas Boutell's Portable Bitmap Format proposal
|
|
# (best; not yet implemented):
|
|
#
|
|
0 string PBF PBF image (deflate compression)
|
|
!:mime image/x-unknown
|
|
|
|
# GIF
|
|
0 string GIF8 GIF image data
|
|
!:mime image/gif
|
|
!:apple 8BIMGIFf
|
|
|
|
# From: Joerg Jenderek <joerg.jen.der.ek@gmx.net>
|
|
# most files with the extension .EPA and some with .BMP
|
|
0 string \x11\x06 Award BIOS Logo, 136 x 84
|
|
!:mime image/x-award-bioslogo
|
|
0 string \x11\x09 Award BIOS Logo, 136 x 126
|
|
!:mime image/x-award-bioslogo
|
|
#0 string \x07\x1f BIOS Logo corrupted?
|
|
# http://www.blackfiveservices.co.uk/awbmtools.shtml
|
|
# http://biosgfx.narod.ru/v3/
|
|
# http://biosgfx.narod.ru/abr-2/
|
|
0 string AWBM
|
|
>4 leshort <1981 Award BIOS bitmap
|
|
!:mime image/x-award-bmp
|
|
|
|
# PC bitmaps (OS/2, Windows BMP files) (Greg Roelofs, newt@uchicago.edu)
|
|
0 string BM
|
|
>14 leshort 12 PC bitmap, OS/2 1.x format
|
|
!:mime image/x-ms-bmp
|
|
>14 leshort 64 PC bitmap, OS/2 2.x format
|
|
!:mime image/x-ms-bmp
|
|
>14 leshort 40 PC bitmap, Windows 3.x format
|
|
!:mime image/x-ms-bmp
|
|
>14 leshort 128 PC bitmap, Windows NT/2000 format
|
|
!:mime image/x-ms-bmp
|
|
|
|
# XPM icons (Greg Roelofs, newt@uchicago.edu)
|
|
0 search/1 /*\ XPM\ */ X pixmap image text
|
|
!:mime image/x-xpmi
|
|
|
|
# DICOM medical imaging data
|
|
128 string DICM DICOM medical imaging data
|
|
!:mime application/dicom
|
|
|
|
# XWD - X Window Dump file.
|
|
# As described in /usr/X11R6/include/X11/XWDFile.h
|
|
# used by the xwd program.
|
|
# Bradford Castalia, idaeim, 1/01
|
|
# updated by Adam Buchbinder, 2/09
|
|
# The following assumes version 7 of the format; the first long is the length
|
|
# of the header, which is at least 25 4-byte longs, and the one at offset 8
|
|
# is a constant which is always either 1 or 2. Offset 12 is the pixmap depth,
|
|
# which is a maximum of 32.
|
|
0 belong >100
|
|
>8 belong <3
|
|
>>12 belong <33
|
|
>>>4 belong 7 XWD X Window Dump image data
|
|
!:mime image/x-xwindowdump
|
|
|
|
# PCX image files
|
|
# From: Dan Fandrich <dan@coneharvesters.com>
|
|
# updated by Joerg Jenderek at Feb 2013 by http://de.wikipedia.org/wiki/PCX
|
|
# http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
|
|
# GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
|
|
# test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
|
|
0 ubelong&0xffF8fe00 0x0a000000
|
|
# for PCX bit depth > 0
|
|
>3 ubyte >0
|
|
# test for valid versions
|
|
>>1 ubyte <6
|
|
>>>1 ubyte !1 PCX
|
|
!:mime image/x-pcx
|
|
|
|
# Adobe Photoshop
|
|
# From: Asbjoern Sloth Toennesen <asbjorn@lila.io>
|
|
0 string 8BPS Adobe Photoshop Image
|
|
!:mime image/vnd.adobe.photoshop
|
|
|
|
# Summary: DjVu image / document
|
|
# Extension: .djvu
|
|
# Reference: http://djvu.org/docs/DjVu3Spec.djvu
|
|
# Submitted by: Stephane Loeuillet <stephane.loeuillet@tiscali.fr>
|
|
# Modified by (1): Abel Cheung <abelcheung@gmail.com>
|
|
0 string AT&TFORM
|
|
>12 string DJVM DjVu multiple page document
|
|
!:mime image/vnd.djvu
|
|
>12 string DJVU DjVu image or single page document
|
|
!:mime image/vnd.djvu
|
|
>12 string DJVI DjVu shared document
|
|
!:mime image/vnd.djvu
|
|
>12 string THUM DjVu page thumbnails
|
|
!:mime image/vnd.djvu
|
|
|
|
# Originally by Marc Espie
|
|
# Modified by Robert Minsk <robertminsk at yahoo.com>
|
|
# http://www.openexr.com/openexrfilelayout.pdf
|
|
0 lelong 20000630 OpenEXR image data,
|
|
!:mime image/x-exr
|
|
|
|
# SMPTE Digital Picture Exchange Format, SMPTE DPX
|
|
#
|
|
# ANSI/SMPTE 268M-1994, SMPTE Standard for File Format for Digital
|
|
# Moving-Picture Exchange (DPX), v1.0, 18 February 1994
|
|
# Robert Minsk <robertminsk at yahoo.com>
|
|
0 string SDPX DPX image data, big-endian,
|
|
!:mime image/x-dpx
|
|
|
|
#-----------------------------------------------------------------------
|
|
# Hierarchical Data Format, used to facilitate scientific data exchange
|
|
# specifications at http://hdf.ncsa.uiuc.edu/
|
|
0 belong 0x0e031301 Hierarchical Data Format (version 4) data
|
|
!:mime application/x-hdf
|
|
0 string \211HDF\r\n\032\n Hierarchical Data Format (version 5) data
|
|
!:mime application/x-hdf
|
|
|
|
# http://www.cartesianinc.com/Tech/
|
|
0 string CPC\262 Cartesian Perceptual Compression image
|
|
!:mime image/x-cpi
|
|
|
|
|
|
# Polar Monitor Bitmap (.pmb) used as logo for Polar Electro watches
|
|
# From: Markus Heidelberg <markus.heidelberg at web.de>
|
|
0 string/t [BitmapInfo2] Polar Monitor Bitmap text
|
|
!:mime image/x-polar-monitor-bitmap
|
|
|
|
# Type: Olympus ORF raw images.
|
|
# URL: http://libopenraw.freedesktop.org/wiki/Olympus_ORF
|
|
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
|
0 string MMOR Olympus ORF raw image data, big-endian
|
|
!:mime image/x-olympus-orf
|
|
0 string IIRO Olympus ORF raw image data, little-endian
|
|
!:mime image/x-olympus-orf
|
|
0 string IIRS Olympus ORF raw image data, little-endian
|
|
!:mime image/x-olympus-orf
|
|
|
|
# Type: Foveon X3F
|
|
# URL: http://www.photofo.com/downloads/x3f-raw-format.pdf
|
|
# From: Adam Buchbinder <adam.buchbinder@gmail.com>
|
|
# Note that the MIME type isn't defined anywhere that I can find; if
|
|
# there's a canonical type for this format, it should replace this one.
|
|
0 string FOVb Foveon X3F raw image data
|
|
!:mime image/x-x3f
|
|
|
|
# Paint.NET file
|
|
# From Adam Buchbinder <adam.buchbinder@gmail.com>
|
|
0 string PDN3 Paint.NET image data
|
|
!:mime image/x-paintnet
|