1264 lines
25 KiB
HTML
1264 lines
25 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of MAGIC</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>MAGIC</H1>
|
|
Section: File Formats (5)<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
<BR>BSD mandoc<BR>
|
|
|
|
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
<B>magic</B>
|
|
|
|
- file command's magic pattern file
|
|
|
|
<A NAME="lbAC"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
This manual page documents the format of magic files as
|
|
used by the
|
|
<A HREF="/cgi-bin/man/man2html?1+file">file</A>(1)
|
|
|
|
|
|
command, version 5.38.
|
|
The
|
|
<A HREF="/cgi-bin/man/man2html?1+file">file</A>(1)
|
|
|
|
|
|
command identifies the type of a file using,
|
|
among other tests,
|
|
a test for whether the file contains certain
|
|
``magic patterns''
|
|
|
|
|
|
The database of these
|
|
``magic patterns''
|
|
|
|
is usually located in a binary file in
|
|
/usr/share/misc/magic.mgc
|
|
|
|
or a directory of source text magic pattern fragment files in
|
|
/usr/share/misc/magic
|
|
|
|
|
|
The database specifies what patterns are to be tested for, what message or
|
|
MIME type to print if a particular pattern is found,
|
|
and additional information to extract from the file.
|
|
<P>
|
|
|
|
The format of the source fragment files that are used to build this database
|
|
is as follows:
|
|
Each line of a fragment file specifies a test to be performed.
|
|
A test compares the data starting at a particular offset
|
|
in the file with a byte value, a string or a numeric value.
|
|
If the test succeeds, a message is printed.
|
|
The line consists of the following fields:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="1"><B>offset</B>
|
|
|
|
|
|
<DD>
|
|
A number specifying the offset (in bytes) into the file of the data
|
|
which is to be tested.
|
|
This offset can be a negative number if it is:
|
|
<UL><P>
|
|
|
|
<LI>
|
|
|
|
The first direct offset of the magic entry (at continuation level 0),
|
|
in which case it is interpreted an offset from end end of the file
|
|
going backwards.
|
|
This works only when a file descriptor to the file is available and it
|
|
is a regular file.
|
|
<LI>
|
|
|
|
A continuation offset relative to the end of the last up-level field
|
|
<B>( & )</B>
|
|
|
|
|
|
</UL><P>
|
|
|
|
<DT id="2"><B>type</B>
|
|
|
|
|
|
<DD>
|
|
The type of the data to be tested.
|
|
The possible values are:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="3"><B>byte</B>
|
|
|
|
|
|
<DD>
|
|
A one-byte value.
|
|
<DT id="4"><B>short</B>
|
|
|
|
|
|
<DD>
|
|
A two-byte value in this machine's native byte order.
|
|
<DT id="5"><B>long</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value in this machine's native byte order.
|
|
<DT id="6"><B>quad</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value in this machine's native byte order.
|
|
<DT id="7"><B>float</B>
|
|
|
|
|
|
<DD>
|
|
A 32-bit single precision IEEE floating point number in this machine's native byte order.
|
|
<DT id="8"><B>double</B>
|
|
|
|
|
|
<DD>
|
|
A 64-bit double precision IEEE floating point number in this machine's native byte order.
|
|
<DT id="9"><B>string</B>
|
|
|
|
|
|
<DD>
|
|
A string of bytes.
|
|
The string type specification can be optionally followed
|
|
by /[WwcCtbT]*.
|
|
The
|
|
``W''
|
|
|
|
flag compacts whitespace in the target, which must
|
|
contain at least one whitespace character.
|
|
If the magic has
|
|
<B>n</B>
|
|
|
|
consecutive blanks, the target needs at least
|
|
<B>n</B>
|
|
|
|
consecutive blanks to match.
|
|
The
|
|
``w''
|
|
|
|
flag treats every blank in the magic as an optional blank.
|
|
The
|
|
``c''
|
|
|
|
flag specifies case insensitive matching: lower case
|
|
characters in the magic match both lower and upper case characters in the
|
|
target, whereas upper case characters in the magic only match upper case
|
|
characters in the target.
|
|
The
|
|
``C''
|
|
|
|
flag specifies case insensitive matching: upper case
|
|
characters in the magic match both lower and upper case characters in the
|
|
target, whereas lower case characters in the magic only match upper case
|
|
characters in the target.
|
|
To do a complete case insensitive match, specify both
|
|
``c''
|
|
|
|
and
|
|
``C''
|
|
|
|
|
|
The
|
|
``t''
|
|
|
|
flag forces the test to be done for text files, while the
|
|
``b''
|
|
|
|
flag forces the test to be done for binary files.
|
|
The
|
|
``T''
|
|
|
|
flag causes the string to be trimmed, i.e. leading and trailing whitespace
|
|
is deleted before the string is printed.
|
|
<DT id="10"><B>pstring</B>
|
|
|
|
|
|
<DD>
|
|
A Pascal-style string where the first byte/short/int is interpreted as the
|
|
unsigned length.
|
|
The length defaults to byte and can be specified as a modifier.
|
|
The following modifiers are supported:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="11"><B>B</B>
|
|
<DD>
|
|
A byte length (default).
|
|
<DT id="12"><B>H</B>
|
|
<DD>
|
|
A 2 byte big endian length.
|
|
<DT id="13"><B>h</B>
|
|
<DD>
|
|
A 2 byte little endian length.
|
|
<DT id="14"><B>L</B>
|
|
<DD>
|
|
A 4 byte big endian length.
|
|
<DT id="15"><B>l</B>
|
|
<DD>
|
|
A 4 byte little endian length.
|
|
<DT id="16"><B>J</B>
|
|
<DD>
|
|
The length includes itself in its count.
|
|
</DL>
|
|
<P>
|
|
|
|
The string is not NUL terminated.
|
|
``J''
|
|
|
|
is used rather than the more
|
|
valuable
|
|
``I''
|
|
|
|
because this type of length is a feature of the JPEG
|
|
format.
|
|
<DT id="17"><B>date</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value interpreted as a UNIX date.
|
|
<DT id="18"><B>qdate</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value interpreted as a UNIX date.
|
|
<DT id="19"><B>ldate</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value interpreted as a UNIX-style date, but interpreted as
|
|
local time rather than UTC.
|
|
<DT id="20"><B>qldate</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value interpreted as a UNIX-style date, but interpreted as
|
|
local time rather than UTC.
|
|
<DT id="21"><B>qwdate</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value interpreted as a Windows-style date.
|
|
<DT id="22"><B>beid3</B>
|
|
|
|
|
|
<DD>
|
|
A 32-bit ID3 length in big-endian byte order.
|
|
<DT id="23"><B>beshort</B>
|
|
|
|
|
|
<DD>
|
|
A two-byte value in big-endian byte order.
|
|
<DT id="24"><B>belong</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value in big-endian byte order.
|
|
<DT id="25"><B>bequad</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value in big-endian byte order.
|
|
<DT id="26"><B>befloat</B>
|
|
|
|
|
|
<DD>
|
|
A 32-bit single precision IEEE floating point number in big-endian byte order.
|
|
<DT id="27"><B>bedouble</B>
|
|
|
|
|
|
<DD>
|
|
A 64-bit double precision IEEE floating point number in big-endian byte order.
|
|
<DT id="28"><B>bedate</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value in big-endian byte order,
|
|
interpreted as a Unix date.
|
|
<DT id="29"><B>beqdate</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value in big-endian byte order,
|
|
interpreted as a Unix date.
|
|
<DT id="30"><B>beldate</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value in big-endian byte order,
|
|
interpreted as a UNIX-style date, but interpreted as local time rather
|
|
than UTC.
|
|
<DT id="31"><B>beqldate</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value in big-endian byte order,
|
|
interpreted as a UNIX-style date, but interpreted as local time rather
|
|
than UTC.
|
|
<DT id="32"><B>beqwdate</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value in big-endian byte order,
|
|
interpreted as a Windows-style date.
|
|
<DT id="33"><B>bestring16</B>
|
|
|
|
|
|
<DD>
|
|
A two-byte unicode (UCS16) string in big-endian byte order.
|
|
<DT id="34"><B>leid3</B>
|
|
|
|
|
|
<DD>
|
|
A 32-bit ID3 length in little-endian byte order.
|
|
<DT id="35"><B>leshort</B>
|
|
|
|
|
|
<DD>
|
|
A two-byte value in little-endian byte order.
|
|
<DT id="36"><B>lelong</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value in little-endian byte order.
|
|
<DT id="37"><B>lequad</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value in little-endian byte order.
|
|
<DT id="38"><B>lefloat</B>
|
|
|
|
|
|
<DD>
|
|
A 32-bit single precision IEEE floating point number in little-endian byte order.
|
|
<DT id="39"><B>ledouble</B>
|
|
|
|
|
|
<DD>
|
|
A 64-bit double precision IEEE floating point number in little-endian byte order.
|
|
<DT id="40"><B>ledate</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value in little-endian byte order,
|
|
interpreted as a UNIX date.
|
|
<DT id="41"><B>leqdate</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value in little-endian byte order,
|
|
interpreted as a UNIX date.
|
|
<DT id="42"><B>leldate</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value in little-endian byte order,
|
|
interpreted as a UNIX-style date, but interpreted as local time rather
|
|
than UTC.
|
|
<DT id="43"><B>leqldate</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value in little-endian byte order,
|
|
interpreted as a UNIX-style date, but interpreted as local time rather
|
|
than UTC.
|
|
<DT id="44"><B>leqwdate</B>
|
|
|
|
|
|
<DD>
|
|
An eight-byte value in little-endian byte order,
|
|
interpreted as a Windows-style date.
|
|
<DT id="45"><B>lestring16</B>
|
|
|
|
|
|
<DD>
|
|
A two-byte unicode (UCS16) string in little-endian byte order.
|
|
<DT id="46"><B>melong</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value in middle-endian (PDP-11) byte order.
|
|
<DT id="47"><B>medate</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value in middle-endian (PDP-11) byte order,
|
|
interpreted as a UNIX date.
|
|
<DT id="48"><B>meldate</B>
|
|
|
|
|
|
<DD>
|
|
A four-byte value in middle-endian (PDP-11) byte order,
|
|
interpreted as a UNIX-style date, but interpreted as local time rather
|
|
than UTC.
|
|
<DT id="49"><B>indirect</B>
|
|
|
|
|
|
<DD>
|
|
Starting at the given offset, consult the magic database again.
|
|
The offset of the
|
|
<B>indirect</B>
|
|
|
|
magic is by default absolute in the file, but one can specify
|
|
<B>/r</B>
|
|
|
|
to indicate that the offset is relative from the beginning of the entry.
|
|
<DT id="50"><B>name</B>
|
|
|
|
|
|
<DD>
|
|
Define a
|
|
``named''
|
|
|
|
magic instance that can be called from another
|
|
<B>use</B>
|
|
|
|
magic entry, like a subroutine call.
|
|
Named instance direct magic offsets are relative to the offset of the
|
|
previous matched entry, but indirect offsets are relative to the beginning
|
|
of the file as usual.
|
|
Named magic entries always match.
|
|
<DT id="51"><B>use</B>
|
|
|
|
|
|
<DD>
|
|
Recursively call the named magic starting from the current offset.
|
|
If the name of the referenced begins with a
|
|
<B>^</B>
|
|
|
|
then the endianness of the magic is switched; if the magic mentioned
|
|
<B>leshort</B>
|
|
|
|
for example,
|
|
it is treated as
|
|
<B>beshort</B>
|
|
|
|
and vice versa.
|
|
This is useful to avoid duplicating the rules for different endianness.
|
|
<DT id="52"><B>regex</B>
|
|
|
|
|
|
<DD>
|
|
A regular expression match in extended POSIX regular expression syntax
|
|
(like egrep).
|
|
Regular expressions can take exponential time to process, and their
|
|
performance is hard to predict, so their use is discouraged.
|
|
When used in production environments, their performance
|
|
should be carefully checked.
|
|
The size of the string to search should also be limited by specifying
|
|
<B>/<length></B>
|
|
|
|
|
|
to avoid performance issues scanning long files.
|
|
The type specification can also be optionally followed by
|
|
<B>/[c][s][l]</B>
|
|
|
|
|
|
The
|
|
``c''
|
|
|
|
flag makes the match case insensitive, while the
|
|
``s''
|
|
|
|
flag update the offset to the start offset of the match, rather than the end.
|
|
The
|
|
``l''
|
|
|
|
modifier, changes the limit of length to mean number of lines instead of a
|
|
byte count.
|
|
Lines are delimited by the platforms native line delimiter.
|
|
When a line count is specified, an implicit byte count also computed assuming
|
|
each line is 80 characters long.
|
|
If neither a byte or line count is specified, the search is limited automatically
|
|
to 8KiB.
|
|
<B>^</B>
|
|
|
|
and
|
|
<B>$</B>
|
|
|
|
match the beginning and end of individual lines, respectively,
|
|
not beginning and end of file.
|
|
<DT id="53"><B>search</B>
|
|
|
|
|
|
<DD>
|
|
A literal string search starting at the given offset.
|
|
The same modifier flags can be used as for string patterns.
|
|
The search expression must contain the range in the form
|
|
<B>/number,</B>
|
|
|
|
that is the number of positions at which the match will be
|
|
attempted, starting from the start offset.
|
|
This is suitable for
|
|
searching larger binary expressions with variable offsets, using
|
|
<B>\</B>
|
|
|
|
escapes for special characters.
|
|
The order of modifier and number is not relevant.
|
|
<DT id="54"><B>default</B>
|
|
|
|
|
|
<DD>
|
|
This is intended to be used with the test
|
|
<I>x</I>
|
|
|
|
(which is always true) and it has no type.
|
|
It matches when no other test at that continuation level has matched before.
|
|
Clearing that matched tests for a continuation level, can be done using the
|
|
<B>clear</B>
|
|
|
|
test.
|
|
<DT id="55"><B>clear</B>
|
|
|
|
|
|
<DD>
|
|
This test is always true and clears the match flag for that continuation level.
|
|
It is intended to be used with the
|
|
<B>default</B>
|
|
|
|
test.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
For compatibility with the Single
|
|
UNIX
|
|
Standard, the type specifiers
|
|
<B>dC</B>
|
|
|
|
and
|
|
<B>d1</B>
|
|
|
|
are equivalent to
|
|
<B>byte</B>
|
|
|
|
|
|
the type specifiers
|
|
<B>uC</B>
|
|
|
|
and
|
|
<B>u1</B>
|
|
|
|
are equivalent to
|
|
<B>ubyte</B>
|
|
|
|
|
|
the type specifiers
|
|
<B>dS</B>
|
|
|
|
and
|
|
<B>d2</B>
|
|
|
|
are equivalent to
|
|
<B>short</B>
|
|
|
|
|
|
the type specifiers
|
|
<B>uS</B>
|
|
|
|
and
|
|
<B>u2</B>
|
|
|
|
are equivalent to
|
|
<B>ushort</B>
|
|
|
|
|
|
the type specifiers
|
|
<B>dI</B>
|
|
|
|
|
|
<B>dL</B>
|
|
|
|
|
|
and
|
|
<B>d4</B>
|
|
|
|
are equivalent to
|
|
<B>long</B>
|
|
|
|
|
|
the type specifiers
|
|
<B>uI</B>
|
|
|
|
|
|
<B>uL</B>
|
|
|
|
|
|
and
|
|
<B>u4</B>
|
|
|
|
are equivalent to
|
|
<B>ulong</B>
|
|
|
|
|
|
the type specifier
|
|
<B>d8</B>
|
|
|
|
is equivalent to
|
|
<B>quad</B>
|
|
|
|
|
|
the type specifier
|
|
<B>u8</B>
|
|
|
|
is equivalent to
|
|
<B>uquad</B>
|
|
|
|
|
|
and the type specifier
|
|
<B>s</B>
|
|
|
|
is equivalent to
|
|
<B>string</B>
|
|
|
|
|
|
In addition, the type specifier
|
|
<B>dQ</B>
|
|
|
|
is equivalent to
|
|
<B>quad</B>
|
|
|
|
and the type specifier
|
|
<B>uQ</B>
|
|
|
|
is equivalent to
|
|
<B>uquad</B>
|
|
|
|
|
|
<P>
|
|
|
|
Each top-level magic pattern (see below for an explanation of levels)
|
|
is classified as text or binary according to the types used.
|
|
Types
|
|
``regex''
|
|
|
|
and
|
|
``search''
|
|
|
|
are classified as text tests, unless non-printable characters are used
|
|
in the pattern.
|
|
All other tests are classified as binary.
|
|
A top-level
|
|
pattern is considered to be a test text when all its patterns are text
|
|
patterns; otherwise, it is considered to be a binary pattern.
|
|
When
|
|
matching a file, binary patterns are tried first; if no match is
|
|
found, and the file looks like text, then its encoding is determined
|
|
and the text patterns are tried.
|
|
<P>
|
|
|
|
The numeric types may optionally be followed by
|
|
<B>&</B>
|
|
|
|
and a numeric value,
|
|
to specify that the value is to be AND'ed with the
|
|
numeric value before any comparisons are done.
|
|
Prepending a
|
|
<B>u</B>
|
|
|
|
to the type indicates that ordered comparisons should be unsigned.
|
|
<DT id="56"><B>test</B>
|
|
|
|
|
|
<DD>
|
|
The value to be compared with the value from the file.
|
|
If the type is
|
|
numeric, this value
|
|
is specified in C form; if it is a string, it is specified as a C string
|
|
with the usual escapes permitted (e.g. \n for new-line).
|
|
<P>
|
|
|
|
Numeric values
|
|
may be preceded by a character indicating the operation to be performed.
|
|
It may be
|
|
<B>=</B>
|
|
|
|
|
|
to specify that the value from the file must equal the specified value,
|
|
<B><</B>
|
|
|
|
|
|
to specify that the value from the file must be less than the specified
|
|
value,
|
|
<B>></B>
|
|
|
|
|
|
to specify that the value from the file must be greater than the specified
|
|
value,
|
|
<B>&</B>
|
|
|
|
|
|
to specify that the value from the file must have set all of the bits
|
|
that are set in the specified value,
|
|
<B>^</B>
|
|
|
|
|
|
to specify that the value from the file must have clear any of the bits
|
|
that are set in the specified value, or
|
|
<B>~</B>
|
|
|
|
|
|
the value specified after is negated before tested.
|
|
<B>x</B>
|
|
|
|
|
|
to specify that any value will match.
|
|
If the character is omitted, it is assumed to be
|
|
<B>=</B>
|
|
|
|
|
|
Operators
|
|
<B>&</B>
|
|
|
|
|
|
<B>^</B>
|
|
|
|
|
|
and
|
|
<B>~</B>
|
|
|
|
don't work with floats and doubles.
|
|
The operator
|
|
<B>!</B>
|
|
|
|
specifies that the line matches if the test does
|
|
<I>not</I>
|
|
|
|
succeed.
|
|
<P>
|
|
|
|
Numeric values are specified in C form; e.g.
|
|
<B>13</B>
|
|
|
|
is decimal,
|
|
<B>013</B>
|
|
|
|
is octal, and
|
|
<B>0x13</B>
|
|
|
|
is hexadecimal.
|
|
<P>
|
|
|
|
Numeric operations are not performed on date types, instead the numeric
|
|
value is interpreted as an offset.
|
|
<P>
|
|
|
|
For string values, the string from the
|
|
file must match the specified string.
|
|
The operators
|
|
<B>=</B>
|
|
|
|
|
|
<B><</B>
|
|
|
|
and
|
|
<B>></B>
|
|
|
|
(but not
|
|
<B>&</B>
|
|
|
|
|
|
can be applied to strings.
|
|
The length used for matching is that of the string argument
|
|
in the magic file.
|
|
This means that a line can match any non-empty string (usually used to
|
|
then print the string), with
|
|
<I>>\0</I>
|
|
|
|
(because all non-empty strings are greater than the empty string).
|
|
<P>
|
|
|
|
Dates are treated as numerical values in the respective internal
|
|
representation.
|
|
<P>
|
|
|
|
The special test
|
|
<I>x</I>
|
|
|
|
always evaluates to true.
|
|
<DT id="57"><B>message</B>
|
|
|
|
|
|
<DD>
|
|
The message to be printed if the comparison succeeds.
|
|
If the string contains a
|
|
<A HREF="/cgi-bin/man/man2html?3+printf">printf</A>(3)
|
|
|
|
|
|
format specification, the value from the file (with any specified masking
|
|
performed) is printed using the message as the format string.
|
|
If the string begins with
|
|
``\b''
|
|
|
|
|
|
the message printed is the remainder of the string with no whitespace
|
|
added before it: multiple matches are normally separated by a single
|
|
space.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
An APPLE 4+4 character APPLE creator and type can be specified as:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
!:apple CREATYPE
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
A MIME type is given on a separate line, which must be the next
|
|
non-blank or comment line after the magic line that identifies the
|
|
file type, and has the following format:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
!:mime MIMETYPE
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
i.e. the literal string
|
|
``!:mime''
|
|
|
|
followed by the MIME type.
|
|
<P>
|
|
|
|
An optional strength can be supplied on a separate line which refers to
|
|
the current magic description using the following format:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
!:strength OP VALUE
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
The operand
|
|
<B>OP</B>
|
|
|
|
can be:
|
|
<B>+</B>
|
|
|
|
|
|
<B>-</B>
|
|
|
|
|
|
<B>*</B>
|
|
|
|
|
|
or
|
|
<B>/</B>
|
|
|
|
and
|
|
<B>VALUE</B>
|
|
|
|
is a constant between 0 and 255.
|
|
This constant is applied using the specified operand
|
|
to the currently computed default magic strength.
|
|
<P>
|
|
|
|
Some file formats contain additional information which is to be printed
|
|
along with the file type or need additional tests to determine the true
|
|
file type.
|
|
These additional tests are introduced by one or more
|
|
<I>></I>
|
|
|
|
characters preceding the offset.
|
|
The number of
|
|
<I>></I>
|
|
|
|
on the line indicates the level of the test; a line with no
|
|
<I>></I>
|
|
|
|
at the beginning is considered to be at level 0.
|
|
Tests are arranged in a tree-like hierarchy:
|
|
if the test on a line at level
|
|
<I>n</I>
|
|
|
|
succeeds, all following tests at level
|
|
<I>n+1</I>
|
|
|
|
are performed, and the messages printed if the tests succeed, until a line
|
|
with level
|
|
<I>n</I>
|
|
|
|
(or less) appears.
|
|
For more complex files, one can use empty messages to get just the
|
|
"if/then" effect, in the following way:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
0 string MZ
|
|
>0x18 leshort <0x40 MS-DOS executable
|
|
>0x18 leshort >0x3f extended PC executable (e.g., MS Windows)
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
Offsets do not need to be constant, but can also be read from the file
|
|
being examined.
|
|
If the first character following the last
|
|
<I>></I>
|
|
|
|
is a
|
|
<I>(</I>
|
|
|
|
then the string after the parenthesis is interpreted as an indirect offset.
|
|
That means that the number after the parenthesis is used as an offset in
|
|
the file.
|
|
The value at that offset is read, and is used again as an offset
|
|
in the file.
|
|
Indirect offsets are of the form:
|
|
<I>(( x [[.,][bBcCeEfFgGhHiIlmsSqQ]][+-][ y ])</I>
|
|
|
|
|
|
The value of
|
|
<I>x</I>
|
|
|
|
is used as an offset in the file.
|
|
A byte, id3 length, short or long is read at that offset depending on the
|
|
<I>[bBcCeEfFgGhHiIlmsSqQ]</I>
|
|
|
|
type specifier.
|
|
The value is treated as signed if
|
|
``,''
|
|
|
|
is specified or unsigned if
|
|
``.''
|
|
|
|
is specified.
|
|
The capitalized types interpret the number as a big endian
|
|
value, whereas the small letter versions interpret the number as a little
|
|
endian value;
|
|
the
|
|
<I>m</I>
|
|
|
|
type interprets the number as a middle endian (PDP-11) value.
|
|
To that number the value of
|
|
<I>y</I>
|
|
|
|
is added and the result is used as an offset in the file.
|
|
The default type if one is not specified is long.
|
|
The following types are recognized:
|
|
<DL COMPACT>
|
|
<P>
|
|
|
|
<DT id="58"><B>Type<TT> </TT>Mnemonic<TT> </TT>Endian<TT> </TT>Size</B>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<DD>
|
|
<DT id="59"><B>bcBc </B>Byte/Char<TT> </TT>N/A<TT> </TT>1
|
|
|
|
|
|
<DD>
|
|
<DT id="60"><B>efg<TT> </TT>Double<TT> </TT>Little8</B>
|
|
<DD>
|
|
<DT id="61"><B>EFGDoubleBig8</B>
|
|
<DD>
|
|
<DT id="62"><B>hsHalf/ShortLittle2</B>
|
|
<DD>
|
|
<DT id="63"><B>HSHalf/ShortBig2</B>
|
|
<DD>
|
|
<DT id="64"><B>iID3Little4</B>
|
|
<DD>
|
|
<DT id="65"><B>IID3Big4</B>
|
|
<DD>
|
|
<DT id="66"><B>mMiddleMiddle4</B>
|
|
<DD>
|
|
<DT id="67"><B>qQuadLittle8</B>
|
|
<DD>
|
|
<DT id="68"><B>QQuadBig8</B>
|
|
<DD>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
|
|
That way variable length structures can be examined:<BR>
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
# MS Windows executables are also valid MS-DOS executables
|
|
0 string MZ
|
|
>0x18 leshort <0x40 MZ executable (MS-DOS)
|
|
# skip the whole block below if it is not an extended executable
|
|
>0x18 leshort >0x3f
|
|
>>(0x3c.l) string PE\0\0 PE executable (MS-Windows)
|
|
>>(0x3c.l) string LX\0\0 LX executable (OS/2)
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
This strategy of examining has a drawback: you must make sure that you
|
|
eventually print something, or users may get empty output (such as when
|
|
there is neither PE\0\0 nor LE\0\0 in the above example).
|
|
<P>
|
|
|
|
If this indirect offset cannot be used directly, simple calculations are
|
|
possible: appending
|
|
<I>[+-*/%&|^]number</I>
|
|
|
|
inside parentheses allows one to modify
|
|
the value read from the file before it is used as an offset:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
# MS Windows executables are also valid MS-DOS executables
|
|
0 string MZ
|
|
# sometimes, the value at 0x18 is less that 0x40 but there's still an
|
|
# extended executable, simply appended to the file
|
|
>0x18 leshort <0x40
|
|
>>(4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP)
|
|
>>(4.s*512) leshort !0x014c MZ executable (MS-DOS)
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
Sometimes you do not know the exact offset as this depends on the length or
|
|
position (when indirection was used before) of preceding fields.
|
|
You can specify an offset relative to the end of the last up-level
|
|
field using
|
|
`&'
|
|
|
|
as a prefix to the offset:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
0 string MZ
|
|
>0x18 leshort >0x3f
|
|
>>(0x3c.l) string PE\0\0 PE executable (MS-Windows)
|
|
# immediately following the PE signature is the CPU type
|
|
>>>&0 leshort 0x14c for Intel 80386
|
|
>>>&0 leshort 0x184 for DEC Alpha
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
Indirect and relative offsets can be combined:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
0 string MZ
|
|
>0x18 leshort <0x40
|
|
>>(4.s*512) leshort !0x014c MZ executable (MS-DOS)
|
|
# if it's not COFF, go back 512 bytes and add the offset taken
|
|
# from byte 2/3, which is yet another way of finding the start
|
|
# of the extended executable
|
|
>>>&(2.s-514) string LE LE executable (MS Windows VxD driver)
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
Or the other way around:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
0 string MZ
|
|
>0x18 leshort >0x3f
|
|
>>(0x3c.l) string LE\0\0 LE executable (MS-Windows)
|
|
# at offset 0x80 (-4, since relative offsets start at the end
|
|
# of the up-level match) inside the LE header, we find the absolute
|
|
# offset to the code area, where we look for a specific signature
|
|
>>>(&0x7c.l+0x26) string UPX \b, UPX compressed
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
Or even both!
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
0 string MZ
|
|
>0x18 leshort >0x3f
|
|
>>(0x3c.l) string LE\0\0 LE executable (MS-Windows)
|
|
# at offset 0x58 inside the LE header, we find the relative offset
|
|
# to a data area where we look for a specific signature
|
|
>>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
If you have to deal with offset/length pairs in your file, even the
|
|
second value in a parenthesized expression can be taken from the file itself,
|
|
using another set of parentheses.
|
|
Note that this additional indirect offset is always relative to the
|
|
start of the main indirect offset.
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
0 string MZ
|
|
>0x18 leshort >0x3f
|
|
>>(0x3c.l) string PE\0\0 PE executable (MS-Windows)
|
|
# search for the PE section called ".idata"...
|
|
>>>&0xf4 search/0x140 .idata
|
|
# ...and go to the end of it, calculated from start+length;
|
|
# these are located 14 and 10 bytes after the section name
|
|
>>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<P>
|
|
|
|
If you have a list of known values at a particular continuation level,
|
|
and you want to provide a switch-like default case:
|
|
|
|
<BLOCKQUOTE>
|
|
<PRE>
|
|
# clear that continuation level match
|
|
>18 clear
|
|
>18 lelong 1 one
|
|
>18 lelong 2 two
|
|
>18 default x
|
|
# print default match
|
|
>>18 lelong x unmatched 0x%x
|
|
</PRE>
|
|
</BLOCKQUOTE>
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<A HREF="/cgi-bin/man/man2html?1+file">file</A>(1)
|
|
|
|
|
|
- the command that reads this file.
|
|
<A NAME="lbAE"> </A>
|
|
<H2>BUGS</H2>
|
|
|
|
The formats
|
|
<B>long</B>
|
|
|
|
|
|
<B>belong</B>
|
|
|
|
|
|
<B>lelong</B>
|
|
|
|
|
|
<B>melong</B>
|
|
|
|
|
|
<B>short</B>
|
|
|
|
|
|
<B>beshort</B>
|
|
|
|
|
|
and
|
|
<B>leshort</B>
|
|
|
|
do not depend on the length of the C data types
|
|
<B>short</B>
|
|
|
|
and
|
|
<B>long</B>
|
|
|
|
on the platform, even though the Single
|
|
UNIX
|
|
Specification implies that they do. However, as OS X Mountain Lion has
|
|
passed the Single
|
|
UNIX
|
|
Specification validation suite, and supplies a version of
|
|
<A HREF="/cgi-bin/man/man2html?1+file">file</A>(1)
|
|
|
|
|
|
in which they do not depend on the sizes of the C data types and that is
|
|
built for a 64-bit environment in which
|
|
<B>long</B>
|
|
|
|
is 8 bytes rather than 4 bytes, presumably the validation suite does not
|
|
test whether, for example
|
|
<B>long</B>
|
|
|
|
refers to an item with the same size as the C data type
|
|
<B>long</B>
|
|
|
|
|
|
There should probably be
|
|
<B>type</B>
|
|
|
|
names
|
|
<B>int8</B>
|
|
|
|
|
|
<B>uint8</B>
|
|
|
|
|
|
<B>int16</B>
|
|
|
|
|
|
<B>uint16</B>
|
|
|
|
|
|
<B>int32</B>
|
|
|
|
|
|
<B>uint32</B>
|
|
|
|
|
|
<B>int64</B>
|
|
|
|
|
|
and
|
|
<B>uint64</B>
|
|
|
|
|
|
and specified-byte-order variants of them,
|
|
to make it clearer that those types have specified widths.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="69"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="70"><A HREF="#lbAC">DESCRIPTION</A><DD>
|
|
<DT id="71"><A HREF="#lbAD">SEE ALSO</A><DD>
|
|
<DT id="72"><A HREF="#lbAE">BUGS</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:03 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|