Attachment 47164 Details for Bug 106007

from file-4.14-2.i586.rpm from 10.0 beta2

magic (text/plain), 407.13 KB, created by Vladimir Nadvornik on 2005-08-23 10:42:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Vladimir Nadvornik

Created: 2005-08-23 10:42:14 UTC

Size: 407.13 KB

patch

obsolete

># Magic
># Magic data for file(1) command.
># Format is described in magic(5).
>#
># Note: If you have edited this file you may run `file -C'
>#       to make a pre-compiled magic.mgc for faster execution
>#
>
>#------------------------------------------------------------------------------
># Localstuff:  file(1) magic for locally observed files
>#
># $Id: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
># Add any locally observed files here.  Remember:
># text if readable, executable if runnable binary, data if unreadable.
>
># XXX promoted from tex so that *.tfm is not mis-identified as mc68k file.
># There is no way to detect TeX Font Metric (*.tfm) files without
># breaking them apart and reading the data.  The following patterns
># match most *.tfm files generated by METAFONT or afm2tfm.
>2	string		\000\021	TeX font metric data
>>33	string		>\0		(%s)
>2	string		\000\022	TeX font metric data
>>33	string		>\0		(%s)
>#------------------------------------------------------------------------------
># acorn:  file(1) magic for files found on Acorn systems
>#
>
># RISC OS Chunk File Format
># From RISC OS Programmer's Reference Manual, Appendix D
># We guess the file type from the type of the first chunk.
>0	lelong		0xc3cbc6c5	RISC OS Chunk data
>>12	string		OBJ_		\b, AOF object
>>12	string		LIB_		\b, ALF library
>
># RISC OS AIF, contains "SWI OS_Exit" at offset 16.
>16	lelong		0xef000011	RISC OS AIF executable
>
># RISC OS Draw files
># From RISC OS Programmer's Reference Manual, Appendix E
>0	string 		Draw		RISC OS Draw file data
>
># RISC OS new format font files
># From RISC OS Programmer's Reference Manual, Appendix E
>0	string		FONT\0		RISC OS outline font data,
>>5	byte		x		version %d
>0	string		FONT\1		RISC OS 1bpp font data,
>>5	byte		x		version %d
>0	string		FONT\4		RISC OS 4bpp font data
>>5	byte		x		version %d
>
># RISC OS Music files
># From RISC OS Programmer's Reference Manual, Appendix E
>0	string		Maestro\r	RISC OS music file
>>8	byte		x		version %d
>
>
>#------------------------------------------------------------------------------
># adi: file(1) magic for ADi's objects
># From Gregory McGarry <g.mcgarry@ieee.org>
>#
>0	leshort		0x521c		COFF DSP21k
>>18	lelong		&02		executable,
>>18	lelong		^02
>>>18	lelong		&01		static object,
>>>18	lelong		^01		relocatable object,
>>18	lelong		&010		stripped
>>18	lelong		^010		not stripped
>
>#------------------------------------------------------------------------------
># adventure: file(1) magic for Adventure game files
>#
># from Allen Garvin <earendil@faeryland.tamu-commerce.edu>
># Edited by Dave Chapeskie <dchapes@ddm.on.ca> Jun 28, 1998
># Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
>#
># ALAN
># I assume there are other, lower versions, but these are the only ones I
># saw in the archive.
>0	beshort	0x0206	ALAN game data
>>2	byte	<10	version 2.6%d
>
>
># Infocom (see z-machine)
>#------------------------------------------------------------------------------
># Z-machine:  file(1) magic for Z-machine binaries.
>#
># This will match ${TEX_BASE}/texmf/omega/ocp/char2uni/inbig5.ocp which
># appears to be a version-0 Z-machine binary.
>#
># The (false match) message is to correct that behavior.  Perhaps it is
># not needed.
>#
>16	belong&0xfe00f0f0	0x3030	Infocom game data
>>0	ubyte			0	(false match)
>>0	ubyte			>0	(Z-machine %d,
>>>2	ubeshort		x	Release %d /
>>>18	string			>\0	Serial %.6s)
>
>#------------------------------------------------------------------------------
># Glulx:  file(1) magic for Glulx binaries.
>#
># I haven't checked for false matches yet.
>#
>0	string			Glul	Glulx game data
>>4	beshort			x	(Version %d
>>>6	byte			x	\b.%d
>>>8	byte			x	\b.%d)
>>36	string			Info	Compiled by Inform
>
>
>
># For Quetzal and blorb magic see iff
>
>
># TADS (Text Adventure Development System)
>#  All files are machine-independent (games compile to byte-code) and are tagged
>#  with a version string of the form "V2.<digit>.<digit>\0" (but TADS 3 is
>#  on the way).
>#  Game files start with "TADS2 bin\n\r\032\0" then the compiler version.
>0	string	TADS2\ bin	TADS
>>9	belong  !0x0A0D1A00	game data, CORRUPTED
>>9	belong	 0x0A0D1A00
>>>13	string	>\0		%s game data
>#  Resource files start with "TADS2 rsc\n\r\032\0" then the compiler version.
>0	string	TADS2\ rsc	TADS
>>9	belong  !0x0A0D1A00	resource data, CORRUPTED
>>9	belong	 0x0A0D1A00
>>>13	string	>\0		%s resource data
>#  Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
>#  2-byte length N, the N-char name of the game file *without* a NUL (darn!),
># "TADS2 save\n\r\032\0" and the interpreter version. 
>0	string	TADS2\ save/g	TADS
>>12	belong	!0x0A0D1A00	saved game data, CORRUPTED
>>12	belong	 0x0A0D1A00
>>>(16.s+32) string >\0		%s saved game data
>#  Other saved game files start with "TADS2 save\n\r\032\0" and the interpreter
>#  version.
>0	string	TADS2\ save	TADS
>>10	belong	!0x0A0D1A00	saved game data, CORRUPTED
>>10	belong	 0x0A0D1A00
>>>14	string	>\0		%s saved game data
>
>#------------------------------------------------------------------------------
># allegro:  file(1) magic for Allegro datafiles
># Toby Deshane <hac@shoelace.digivill.net>
>#
>0 belong 0x736C6821   Allegro datafile (packed)
>0 belong 0x736C682E   Allegro datafile (not packed/autodetect)
>0 belong 0x736C682B   Allegro datafile (appended exe data)
>
>#------------------------------------------------------------------------------
># alliant:  file(1) magic for Alliant FX series a.out files
>#
># If the FX series is the one that had a processor with a 68K-derived
># instruction set, the "short" should probably become "beshort" and the
># "long" should probably become "belong".
># If it's the i860-based one, they should probably become either the
># big-endian or little-endian versions, depending on the mode they ran
># the 860 in....
>#
>0	short		0420		0420 Alliant virtual executable
>>2	short		&0x0020		common library
>>16	long		>0		not stripped
>0	short		0421		0421 Alliant compact executable
>>2	short		&0x0020		common library
>>16	long		>0		not stripped
>#------------------------------------------------------------------------------
># alpha architecture description
>#
>
>0	leshort		0603		COFF format alpha
>>22	leshort&030000	!020000		executable
>>24	leshort		0410		pure
>>24	leshort		0413		paged
>>22	leshort&020000	!0		dynamically linked
>>16	lelong		!0		not stripped
>>16	lelong		0		stripped
>>22	leshort&030000	020000		shared library
>>24	leshort		0407		object
>>27	byte		x		- version %d
>>26	byte		x		.%d
>>28	byte		x		-%d
>
># Basic recognition of Digital UNIX core dumps - Mike Bremford <mike@opac.bl.uk>
>#
># The actual magic number is just "Core", followed by a 2-byte version
># number; however, treating any file that begins with "Core" as a Digital
># UNIX core dump file may produce too many false hits, so we include one
># byte of the version number as well; DU 5.0 appears only to be up to
># version 2.
>#
>0	string		Core\001	Alpha COFF format core dump (Digital UNIX)
>>24	string		>\0		\b, from '%s'
>0	string		Core\002	Alpha COFF format core dump (Digital UNIX)
>>24	string		>\0		\b, from '%s'
>
>#------------------------------------------------------------------------------
># amanda:  file(1) magic for amanda file format
>#
>0	string	AMANDA:\ 		AMANDA 
>>8	string	TAPESTART\ DATE		tape header file,
>>>23	string	X
>>>>25	string	>\ 			Unused %s
>>>23	string	>\ 			DATE %s
>>8	string	FILE\ 			dump file,
>>>13	string	>\ 			DATE %s
>#------------------------------------------------------------------------------
># amigaos:  file(1) magic for AmigaOS binary formats:
>
>#
># From ignatios@cs.uni-bonn.de (Ignatios Souvatzis)
>#
>0	belong		0x000003fa	AmigaOS shared library
>0	belong		0x000003f3	AmigaOS loadseg()ble executable/binary
>0	belong		0x000003e7	AmigaOS object/library data
>#
>0	beshort		0xe310		Amiga Workbench
>>2	beshort		1		
>>>48	byte		1		disk icon
>>>48	byte		2		drawer icon
>>>48	byte		3		tool icon
>>>48	byte		4		project icon
>>>48	byte		5		garbage icon
>>>48	byte		6		device icon
>>>48	byte		7		kickstart icon
>>>48	byte		8		workbench application icon
>>2	beshort		>1		icon, vers. %d
>#
># various sound formats from the Amiga
># G=F6tz Waschk <waschk@informatik.uni-rostock.de>
>#
>0	string		FC14		Future Composer 1.4 Module sound file
>0	string		SMOD		Future Composer 1.3 Module sound file
>0	string		AON4artofnoise	Art Of Noise Module sound file
>1	string		MUGICIAN/SOFTEYES Mugician Module sound file
>58	string		SIDMON\ II\ -\ THE	Sidmon 2.0 Module sound file
>0	string		Synth4.0	Synthesis Module sound file
>0	string		ARP.		The Holy Noise Module sound file
>0	string		BeEp\0		JamCracker Module sound file
>0	string		COSO\0		Hippel-COSO Module sound file
># Too simple (short, pure ASCII, deep), MPi
>#26	string		V.3		Brian Postma's Soundmon Module sound file v3
>#26	string		BPSM		Brian Postma's Soundmon Module sound file v3
>#26	string		V.2		Brian Postma's Soundmon Module sound file v2
>
># The following are from: "Stefan A. Haubenthal" <polluks@web.de>
>0	beshort		0x0f00		AmigaOS bitmap font
>0	beshort		0x0f03		AmigaOS outline font
>0	belong		0x80001001	AmigaOS outline tag
>0	string		##\ version	catalog translation
>
># Amiga disk types
># 
>0	string		RDSK		Rigid Disk Block
>>160	string		x		on %.24s
>0	string		DOS\0		Amiga DOS disk
>0	string		DOS\1		Amiga FFS disk
>0	string		DOS\2		Amiga Inter DOS disk
>0	string		DOS\3		Amiga Inter FFS disk
>0	string		DOS\4		Amiga Fastdir DOS disk
>0	string		DOS\5		Amiga Fastdir FFS disk
>0	string		KICK		Kickstart disk
>
>#------------------------------------------------------------------------------
># animation:  file(1) magic for animation/movie formats
>#
># animation formats
># MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
># FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)
>
># SGI and Apple formats
>0	string		MOVI		Silicon Graphics movie file
>4       string          moov            Apple QuickTime
>>12     string          mvhd            \b movie (fast start)
>>12     string          mdra            \b URL
>>12     string          cmov            \b movie (fast start, compressed header)
>>12     string          rmra            \b multiple URLs
>4       string          mdat            Apple QuickTime movie (unoptimized)
>4       string          wide            Apple QuickTime movie (unoptimized)
>4       string          skip            Apple QuickTime movie (modified)
>4       string          free            Apple QuickTime movie (modified)
>4       string          idsc            Apple QuickTime image (fast start)
>4       string          idat            Apple QuickTime image (unoptimized)
>4       string          pckg            Apple QuickTime compressed archive
>4	string/B	jP		JPEG 2000 image
>4	string		ftyp		ISO Media
>>8	string		isom		\b, MPEG v4 system, version 1
>>8	string		iso2		\b, MPEG v4 system, part 12 revision
>>8	string		mp41		\b, MPEG v4 system, version 1
>>8	string		mp42		\b, MPEG v4 system, version 2
>>8	string		mp7t		\b, MPEG v4 system, MPEG v7 XML
>>8	string		mp7b		\b, MPEG v4 system, MPEG v7 binary XML
>>8	string/B	jp2		\b, JPEG 2000
>>8	string		3gp		\b, MPEG v4 system, 3GPP
>>>11	byte		4		\b v4 (H.263/AMR GSM 6.10)
>>>11	byte		5		\b v5 (H.263/AMR GSM 6.10)
>>>11	byte		6		\b v6 (ITU H.264/AMR GSM 6.10)
>>8	string		mmp4		\b, MPEG v4 system, 3GPP Mobile
>>8	string		avc1		\b, MPEG v4 system, 3GPP JVT AVC
>>8	string/B	M4A		\b, MPEG v4 system, iTunes AAC-LC
>>8	string/B	M4P		\b, MPEG v4 system, iTunes AES encrypted
>>8	string/B	M4B		\b, MPEG v4 system, iTunes bookmarked
>>8	string/B	qt		\b, Apple QuickTime movie
>
># MPEG sequences
># Scans for all common MPEG header start codes
>0        belong             0x00000001     JVT NAL sequence
>>4       byte&0x1F          0x07           \b, H.264 video
>>>5      byte               66             \b, baseline
>>>5      byte               77             \b, main
>>>5      byte               88             \b, extended
>>>7      byte               x              \b @ L %u
>0        belong&0xFFFFFF00  0x00000100     MPEG sequence
>>3       byte               0xBA
>>>4      byte               &0x40          \b, v2, program multiplex
>>>4      byte               ^0x40          \b, v1, system multiplex
>>3       byte               0xBB           \b, v1/2, multiplex (missing pack header)
>>3       byte&0x1F          0x07           \b, H.264 video
>>>4      byte               66             \b, baseline
>>>4      byte               77             \b, main
>>>4      byte               88             \b, extended
>>>6      byte               x              \b @ L %u
>>3       byte               0xB0           \b, v4
>>>5      belong             0x000001B5
>>>>9     byte               &0x80
>>>>>10   byte&0xF0          16             \b, video
>>>>>10   byte&0xF0          32             \b, still texture
>>>>>10   byte&0xF0          48             \b, mesh
>>>>>10   byte&0xF0          64             \b, face
>>>>9     byte&0xF8          8              \b, video
>>>>9     byte&0xF8          16             \b, still texture
>>>>9     byte&0xF8          24             \b, mesh
>>>>9     byte&0xF8          32             \b, face
>>>4      byte               1              \b, simple @ L1
>>>4      byte               2              \b, simple @ L2
>>>4      byte               3              \b, simple @ L3
>>>4      byte               4              \b, simple @ L0
>>>4      byte               17             \b, simple scalable @ L1
>>>4      byte               18             \b, simple scalable @ L2
>>>4      byte               33             \b, core @ L1
>>>4      byte               34             \b, core @ L2
>>>4      byte               50             \b, main @ L2
>>>4      byte               51             \b, main @ L3
>>>4      byte               53             \b, main @ L4
>>>4      byte               66             \b, n-bit @ L2
>>>4      byte               81             \b, scalable texture @ L1
>>>4      byte               97             \b, simple face animation @ L1
>>>4      byte               98             \b, simple face animation @ L2
>>>4      byte               99             \b, simple face basic animation @ L1
>>>4      byte               100            \b, simple face basic animation @ L2
>>>4      byte               113            \b, basic animation text @ L1
>>>4      byte               114            \b, basic animation text @ L2
>>>4      byte               129            \b, hybrid @ L1
>>>4      byte               130            \b, hybrid @ L2
>>>4      byte               145            \b, advanced RT simple @ L!
>>>4      byte               146            \b, advanced RT simple @ L2
>>>4      byte               147            \b, advanced RT simple @ L3
>>>4      byte               148            \b, advanced RT simple @ L4
>>>4      byte               161            \b, core scalable @ L1
>>>4      byte               162            \b, core scalable @ L2
>>>4      byte               163            \b, core scalable @ L3
>>>4      byte               177            \b, advanced coding efficiency @ L1
>>>4      byte               178            \b, advanced coding efficiency @ L2
>>>4      byte               179            \b, advanced coding efficiency @ L3
>>>4      byte               180            \b, advanced coding efficiency @ L4
>>>4      byte               193            \b, advanced core @ L1
>>>4      byte               194            \b, advanced core @ L2
>>>4      byte               209            \b, advanced scalable texture @ L1
>>>4      byte               210            \b, advanced scalable texture @ L2
>>>4      byte               211            \b, advanced scalable texture @ L3
>>>4      byte               225            \b, simple studio @ L1
>>>4      byte               226            \b, simple studio @ L2
>>>4      byte               227            \b, simple studio @ L3
>>>4      byte               228            \b, simple studio @ L4
>>>4      byte               229            \b, core studio @ L1
>>>4      byte               230            \b, core studio @ L2
>>>4      byte               231            \b, core studio @ L3
>>>4      byte               232            \b, core studio @ L4
>>>4      byte               240            \b, advanced simple @ L0
>>>4      byte               241            \b, advanced simple @ L1
>>>4      byte               242            \b, advanced simple @ L2
>>>4      byte               243            \b, advanced simple @ L3
>>>4      byte               244            \b, advanced simple @ L4
>>>4      byte               245            \b, advanced simple @ L5
>>>4      byte               247            \b, advanced simple @ L3b
>>>4      byte               248            \b, FGS @ L0
>>>4      byte               249            \b, FGS @ L1
>>>4      byte               250            \b, FGS @ L2
>>>4      byte               251            \b, FGS @ L3
>>>4      byte               252            \b, FGS @ L4
>>>4      byte               253            \b, FGS @ L5
>>3       byte               0xB5           \b, v4
>>>4      byte               &0x80
>>>>5     byte&0xF0          16             \b, video (missing profile header)
>>>>5     byte&0xF0          32             \b, still texture (missing profile header)
>>>>5     byte&0xF0          48             \b, mesh (missing profile header)
>>>>5     byte&0xF0          64             \b, face (missing profile header)
>>>4      byte&0xF8          8              \b, video (missing profile header)
>>>4      byte&0xF8          16             \b, still texture (missing profile header)
>>>4      byte&0xF8          24             \b, mesh (missing profile header)
>>>4      byte&0xF8          32             \b, face (missing profile header)
>>3       byte               0xB3
>>>12     belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
>>>12     belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
>>>12     belong             0x000001B5     \b, v2,
>>>>16    byte&0x0F          1              \b HP
>>>>16    byte&0x0F          2              \b Spt
>>>>16    byte&0x0F          3              \b SNR
>>>>16    byte&0x0F          4              \b MP
>>>>16    byte&0x0F          5              \b SP
>>>>17    byte&0xF0          64             \b@HL
>>>>17    byte&0xF0          96             \b@H-14
>>>>17    byte&0xF0          128            \b@ML
>>>>17    byte&0xF0          160            \b@LL
>>>>17    byte               &0x08          \b progressive
>>>>17    byte               ^0x08          \b interlaced
>>>>17    byte&0x06          2              \b Y'CbCr 4:2:0 video
>>>>17    byte&0x06          4              \b Y'CbCr 4:2:2 video
>>>>17    byte&0x06          6              \b Y'CbCr 4:4:4 video
>>>11     byte               &0x02
>>>>75    byte               &0x01
>>>>>140  belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
>>>>>140  belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
>>>>>140  belong             0x000001B5     \b, v2,
>>>>>>144 byte&0x0F          1              \b HP
>>>>>>144 byte&0x0F          2              \b Spt
>>>>>>144 byte&0x0F          3              \b SNR
>>>>>>144 byte&0x0F          4              \b MP
>>>>>>144 byte&0x0F          5              \b SP
>>>>>>145 byte&0xF0          64             \b@HL
>>>>>>145 byte&0xF0          96             \b@H-14
>>>>>>145 byte&0xF0          128            \b@ML
>>>>>>145 byte&0xF0          160            \b@LL
>>>>>>145 byte               &0x08          \b progressive
>>>>>>145 byte               ^0x08          \b interlaced
>>>>>>145 byte&0x06          2              \b Y'CbCr 4:2:0 video
>>>>>>145 byte&0x06          4              \b Y'CbCr 4:2:2 video
>>>>>>145 byte&0x06          6              \b Y'CbCr 4:4:4 video
>>>76    belong             0x000001B8     \b, v1, progressive Y'CbCr 4:2:0 video
>>>76    belong             0x000001B2     \b, v1, progressive Y'CbCr 4:2:0 video
>>>76    belong             0x000001B5     \b, v2,
>>>>80   byte&0x0F          1              \b HP
>>>>80   byte&0x0F          2              \b Spt
>>>>80   byte&0x0F          3              \b SNR
>>>>80   byte&0x0F          4              \b MP
>>>>80   byte&0x0F          5              \b SP
>>>>81   byte&0xF0          64             \b@HL
>>>>81   byte&0xF0          96             \b@H-14
>>>>81   byte&0xF0          128            \b@ML
>>>>81   byte&0xF0          160            \b@LL
>>>>81   byte               &0x08          \b progressive
>>>>81   byte               ^0x08          \b interlaced
>>>>81   byte&0x06          2              \b Y'CbCr 4:2:0 video
>>>>81   byte&0x06          4              \b Y'CbCr 4:2:2 video
>>>>81   byte&0x06          6              \b Y'CbCr 4:4:4 video
>>>4      belong&0xFFFFFF00  0x78043800     \b, HD-TV 1920P
>>>>7     byte&0xF0          0x10           \b, 16:9
>>>4      belong&0xFFFFFF00  0x50002D00     \b, SD-TV 1280I
>>>>7     byte&0xF0          0x10           \b, 16:9
>>>4      belong&0xFFFFFF00  0x30024000     \b, PAL Capture
>>>>7     byte&0xF0          0x10           \b, 4:3
>>>4      beshort&0xFFF0     0x2C00         \b, 4CIF
>>>>5     beshort&0x0FFF     0x01E0         \b NTSC
>>>>5     beshort&0x0FFF     0x0240         \b PAL
>>>>7     byte&0xF0          0x20           \b, 4:3
>>>>7     byte&0xF0          0x30           \b, 16:9
>>>>7     byte&0xF0          0x40           \b, 11:5
>>>>7     byte&0xF0          0x80           \b, PAL 4:3
>>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
>>>4      belong&0xFFFFFF00  0x2801E000     \b, LD-TV 640P
>>>>7     byte&0xF0          0x10           \b, 4:3
>>>4      belong&0xFFFFFF00  0x1400F000     \b, 320x240
>>>>7     byte&0xF0          0x10           \b, 4:3
>>>4      belong&0xFFFFFF00  0x0F00A000     \b, 240x160
>>>>7     byte&0xF0          0x10           \b, 4:3
>>>4      belong&0xFFFFFF00  0x0A007800     \b, 160x120
>>>>7     byte&0xF0          0x10           \b, 4:3
>>>4      beshort&0xFFF0     0x1600         \b, CIF
>>>>5     beshort&0x0FFF     0x00F0         \b NTSC
>>>>5     beshort&0x0FFF     0x0120         \b PAL
>>>>7     byte&0xF0          0x20           \b, 4:3
>>>>7     byte&0xF0          0x30           \b, 16:9
>>>>7     byte&0xF0          0x40           \b, 11:5
>>>>7     byte&0xF0          0x80           \b, PAL 4:3
>>>>7     byte&0xF0          0xC0           \b, NTSC 4:3
>>>>5     beshort&0x0FFF     0x0240         \b PAL 625
>>>>>7    byte&0xF0          0x20           \b, 4:3
>>>>>7    byte&0xF0          0x30           \b, 16:9
>>>>>7    byte&0xF0          0x40           \b, 11:5
>>>4      beshort&0xFFF0     0x2D00         \b, CCIR/ITU
>>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
>>>>5     beshort&0x0FFF     0x0240         \b PAL 625
>>>>7     byte&0xF0          0x20           \b, 4:3
>>>>7     byte&0xF0          0x30           \b, 16:9
>>>>7     byte&0xF0          0x40           \b, 11:5
>>>4      beshort&0xFFF0     0x1E00         \b, SVCD
>>>>5     beshort&0x0FFF     0x01E0         \b NTSC 525
>>>>5     beshort&0x0FFF     0x0240         \b PAL 625
>>>>7     byte&0xF0          0x20           \b, 4:3
>>>>7     byte&0xF0          0x30           \b, 16:9
>>>>7     byte&0xF0          0x40           \b, 11:5
>>>7      byte&0x0F          1              \b, 23.976 fps
>>>7      byte&0x0F          2              \b, 24 fps
>>>7      byte&0x0F          3              \b, 25 fps
>>>7      byte&0x0F          4              \b, 29.97 fps
>>>7      byte&0x0F          5              \b, 30 fps
>>>7      byte&0x0F          6              \b, 50 fps
>>>7      byte&0x0F          7              \b, 59.94 fps
>>>7      byte&0x0F          8              \b, 60 fps
>>>11     byte               &0x04          \b, Constrained
>
># MPEG ADTS Audio (*.mpx/mxa/aac)
># from dreesen@math.fu-berlin.de
># modified to fully support MPEG ADTS
>
># MP3, M1A
>0       beshort&0xFFFE  0xFFFA         MPEG ADTS, layer III, v1
># rates
>>2      byte&0xF0       0x10           \b,  32 kBits
>>2      byte&0xF0       0x20           \b,  40 kBits
>>2      byte&0xF0       0x30           \b,  48 kBits
>>2      byte&0xF0       0x40           \b,  56 kBits
>>2      byte&0xF0       0x50           \b,  64 kBits
>>2      byte&0xF0       0x60           \b,  80 kBits
>>2      byte&0xF0       0x70           \b,  96 kBits
>>2      byte&0xF0       0x80           \b, 112 kBits
>>2      byte&0xF0       0x90           \b, 128 kBits
>>2      byte&0xF0       0xA0           \b, 160 kBits
>>2      byte&0xF0       0xB0           \b, 192 kBits
>>2      byte&0xF0       0xC0           \b, 224 kBits
>>2      byte&0xF0       0xD0           \b, 256 kBits
>>2      byte&0xF0       0xE0           \b, 320 kBits
># timing
>>2      byte&0x0C       0x00           \b, 44.1 kHz
>>2      byte&0x0C       0x04           \b, 48 kHz
>>2      byte&0x0C       0x08           \b, 32 kHz
># channels/options
>>3      byte&0xC0       0x00           \b, Stereo
>>3      byte&0xC0       0x40           \b, JntStereo
>>3      byte&0xC0       0x80           \b, 2x Monaural
>>3      byte&0xC0       0xC0           \b, Monaural
>#>1     byte            ^0x01          \b, Data Verify
>#>2     byte            &0x02          \b, Packet Pad
>#>2     byte            &0x01          \b, Custom Flag
>#>3     byte            &0x08          \b, Copyrighted
>#>3     byte            &0x04          \b, Original Source
>#>3     byte&0x03       1              \b, NR: 50/15 ms
>#>3     byte&0x03       3              \b, NR: CCIT J.17
>
># MP2, M1A
>0       beshort&0xFFFE  0xFFFC         MPEG ADTS, layer II, v1
># rates
>>2      byte&0xF0       0x10           \b,  32 kBits
>>2      byte&0xF0       0x20           \b,  48 kBits
>>2      byte&0xF0       0x30           \b,  56 kBits
>>2      byte&0xF0       0x40           \b,  64 kBits
>>2      byte&0xF0       0x50           \b,  80 kBits
>>2      byte&0xF0       0x60           \b,  96 kBits
>>2      byte&0xF0       0x70           \b, 112 kBits
>>2      byte&0xF0       0x80           \b, 128 kBits
>>2      byte&0xF0       0x90           \b, 160 kBits
>>2      byte&0xF0       0xA0           \b, 192 kBits
>>2      byte&0xF0       0xB0           \b, 224 kBits
>>2      byte&0xF0       0xC0           \b, 256 kBits
>>2      byte&0xF0       0xD0           \b, 320 kBits
>>2      byte&0xF0       0xE0           \b, 384 kBits
># timing
>>2      byte&0x0C       0x00           \b, 44.1 kHz
>>2      byte&0x0C       0x04           \b, 48 kHz
>>2      byte&0x0C       0x08           \b, 32 kHz
># channels/options
>>3      byte&0xC0       0x00           \b, Stereo
>>3      byte&0xC0       0x40           \b, JntStereo
>>3      byte&0xC0       0x80           \b, 2x Monaural
>>3      byte&0xC0       0xC0           \b, Monaural
>#>1     byte            ^0x01          \b, Data Verify
>#>2     byte            &0x02          \b, Packet Pad
>#>2     byte            &0x01          \b, Custom Flag
>#>3     byte            &0x08          \b, Copyrighted
>#>3     byte            &0x04          \b, Original Source
>#>3     byte&0x03       1              \b, NR: 50/15 ms
>#>3     byte&0x03       3              \b, NR: CCIT J.17
>
># MPA, M1A
>0       beshort&0xFFFE  0xFFFE         MPEG ADTS, layer I, v1
># rate
>>2      byte&0xF0       0x10           \b,  32 kBits
>>2      byte&0xF0       0x20           \b,  64 kBits
>>2      byte&0xF0       0x30           \b,  96 kBits
>>2      byte&0xF0       0x40           \b, 128 kBits
>>2      byte&0xF0       0x50           \b, 160 kBits
>>2      byte&0xF0       0x60           \b, 192 kBits
>>2      byte&0xF0       0x70           \b, 224 kBits
>>2      byte&0xF0       0x80           \b, 256 kBits
>>2      byte&0xF0       0x90           \b, 288 kBits
>>2      byte&0xF0       0xA0           \b, 320 kBits
>>2      byte&0xF0       0xB0           \b, 352 kBits
>>2      byte&0xF0       0xC0           \b, 384 kBits
>>2      byte&0xF0       0xD0           \b, 416 kBits
>>2      byte&0xF0       0xE0           \b, 448 kBits
># timing
>>2      byte&0x0C       0x00           \b, 44.1 kHz
>>2      byte&0x0C       0x04           \b, 48 kHz
>>2      byte&0x0C       0x08           \b, 32 kHz
># channels/options
>>3      byte&0xC0       0x00           \b, Stereo
>>3      byte&0xC0       0x40           \b, JntStereo
>>3      byte&0xC0       0x80           \b, 2x Monaural
>>3      byte&0xC0       0xC0           \b, Monaural
>#>1     byte            ^0x01          \b, Data Verify
>#>2     byte            &0x02          \b, Packet Pad
>#>2     byte            &0x01          \b, Custom Flag
>#>3     byte            &0x08          \b, Copyrighted
>#>3     byte            &0x04          \b, Original Source
>#>3     byte&0x03       1              \b, NR: 50/15 ms
>#>3     byte&0x03       3              \b, NR: CCIT J.17
>
># MP3, M2A
>0       beshort&0xFFFE  0xFFF2         MPEG ADTS, layer III, v2
># rate
>>2      byte&0xF0       0x10           \b,   8 kBits
>>2      byte&0xF0       0x20           \b,  16 kBits
>>2      byte&0xF0       0x30           \b,  24 kBits
>>2      byte&0xF0       0x40           \b,  32 kBits
>>2      byte&0xF0       0x50           \b,  40 kBits
>>2      byte&0xF0       0x60           \b,  48 kBits
>>2      byte&0xF0       0x70           \b,  56 kBits
>>2      byte&0xF0       0x80           \b,  64 kBits
>>2      byte&0xF0       0x90           \b,  80 kBits
>>2      byte&0xF0       0xA0           \b,  96 kBits
>>2      byte&0xF0       0xB0           \b, 112 kBits
>>2      byte&0xF0       0xC0           \b, 128 kBits
>>2      byte&0xF0       0xD0           \b, 144 kBits
>>2      byte&0xF0       0xE0           \b, 160 kBits
># timing
>>2      byte&0x0C       0x00           \b, 22.05 kHz
>>2      byte&0x0C       0x04           \b, 24 kHz
>>2      byte&0x0C       0x08           \b, 16 kHz
># channels/options
>>3      byte&0xC0       0x00           \b, Stereo
>>3      byte&0xC0       0x40           \b, JntStereo
>>3      byte&0xC0       0x80           \b, 2x Monaural
>>3      byte&0xC0       0xC0           \b, Monaural
>#>1     byte            ^0x01          \b, Data Verify
>#>2     byte            &0x02          \b, Packet Pad
>#>2     byte            &0x01          \b, Custom Flag
>#>3     byte            &0x08          \b, Copyrighted
>#>3     byte            &0x04          \b, Original Source
>#>3     byte&0x03       1              \b, NR: 50/15 ms
>#>3     byte&0x03       3              \b, NR: CCIT J.17
>
># MP2, M2A
>0       beshort&0xFFFE  0xFFF4         MPEG ADTS, layer II, v2
># rate 
>>2      byte&0xF0       0x10           \b,   8 kBits
>>2      byte&0xF0       0x20           \b,  16 kBits 
>>2      byte&0xF0       0x30           \b,  24 kBits
>>2      byte&0xF0       0x40           \b,  32 kBits
>>2      byte&0xF0       0x50           \b,  40 kBits
>>2      byte&0xF0       0x60           \b,  48 kBits
>>2      byte&0xF0       0x70           \b,  56 kBits
>>2      byte&0xF0       0x80           \b,  64 kBits
>>2      byte&0xF0       0x90           \b,  80 kBits
>>2      byte&0xF0       0xA0           \b,  96 kBits
>>2      byte&0xF0       0xB0           \b, 112 kBits
>>2      byte&0xF0       0xC0           \b, 128 kBits
>>2      byte&0xF0       0xD0           \b, 144 kBits
>>2      byte&0xF0       0xE0           \b, 160 kBits
># timing
>>2      byte&0x0C       0x00           \b, 22.05 kHz
>>2      byte&0x0C       0x04           \b, 24 kHz
>>2      byte&0x0C       0x08           \b, 16 kHz
># channels/options
>>3      byte&0xC0       0x00           \b, Stereo
>>3      byte&0xC0       0x40           \b, JntStereo
>>3      byte&0xC0       0x80           \b, 2x Monaural
>>3      byte&0xC0       0xC0           \b, Monaural
>#>1     byte            ^0x01          \b, Data Verify
>#>2     byte            &0x02          \b, Packet Pad
>#>2     byte            &0x01          \b, Custom Flag
>#>3     byte            &0x08          \b, Copyrighted
>#>3     byte            &0x04          \b, Original Source
>#>3     byte&0x03       1              \b, NR: 50/15 ms
>#>3     byte&0x03       3              \b, NR: CCIT J.17
>
># MPA, M2A
>0       beshort&0xFFFE  0xFFF6         MPEG ADTS, layer I, v2
># rate
>>2      byte&0xF0       0x10           \b,  32 kBits
>>2      byte&0xF0       0x20           \b,  48 kBits
>>2      byte&0xF0       0x30           \b,  56 kBits
>>2      byte&0xF0       0x40           \b,  64 kBits
>>2      byte&0xF0       0x50           \b,  80 kBits
>>2      byte&0xF0       0x60           \b,  96 kBits
>>2      byte&0xF0       0x70           \b, 112 kBits
>>2      byte&0xF0       0x80           \b, 128 kBits
>>2      byte&0xF0       0x90           \b, 144 kBits
>>2      byte&0xF0       0xA0           \b, 160 kBits
>>2      byte&0xF0       0xB0           \b, 176 kBits
>>2      byte&0xF0       0xC0           \b, 192 kBits
>>2      byte&0xF0       0xD0           \b, 224 kBits
>>2      byte&0xF0       0xE0           \b, 256 kBits
># timing
>>2      byte&0x0C       0x00           \b, 22.05 kHz
>>2      byte&0x0C       0x04           \b, 24 kHz
>>2      byte&0x0C       0x08           \b, 16 kHz
># channels/options
>>3      byte&0xC0       0x00           \b, Stereo
>>3      byte&0xC0       0x40           \b, JntStereo
>>3      byte&0xC0       0x80           \b, 2x Monaural
>>3      byte&0xC0       0xC0           \b, Monaural
>#>1     byte            ^0x01          \b, Data Verify
>#>2     byte            &0x02          \b, Packet Pad
>#>2     byte            &0x01          \b, Custom Flag
>#>3     byte            &0x08          \b, Copyrighted
>#>3     byte            &0x04          \b, Original Source
>#>3     byte&0x03       1              \b, NR: 50/15 ms
>#>3     byte&0x03       3              \b, NR: CCIT J.17
>
># MP3, M25A
>0       beshort&0xFFFE  0xFFE2         MPEG ADTS, layer III,  v2.5
># rate  
>>2      byte&0xF0       0x10           \b,   8 kBits
>>2      byte&0xF0       0x20           \b,  16 kBits
>>2      byte&0xF0       0x30           \b,  24 kBits
>>2      byte&0xF0       0x40           \b,  32 kBits
>>2      byte&0xF0       0x50           \b,  40 kBits
>>2      byte&0xF0       0x60           \b,  48 kBits
>>2      byte&0xF0       0x70           \b,  56 kBits
>>2      byte&0xF0       0x80           \b,  64 kBits
>>2      byte&0xF0       0x90           \b,  80 kBits
>>2      byte&0xF0       0xA0           \b,  96 kBits
>>2      byte&0xF0       0xB0           \b, 112 kBits
>>2      byte&0xF0       0xC0           \b, 128 kBits
>>2      byte&0xF0       0xD0           \b, 144 kBits
>>2      byte&0xF0       0xE0           \b, 160 kBits
># timing
>>2      byte&0x0C       0x00           \b, 11.025 kHz
>>2      byte&0x0C       0x04           \b, 12 kHz
>>2      byte&0x0C       0x08           \b, 8 kHz
># channels/options
>>3      byte&0xC0       0x00           \b, Stereo
>>3      byte&0xC0       0x40           \b, JntStereo
>>3      byte&0xC0       0x80           \b, 2x Monaural
>>3      byte&0xC0       0xC0           \b, Monaural
>#>1     byte            ^0x01          \b, Data Verify
>#>2     byte            &0x02          \b, Packet Pad
>#>2     byte            &0x01          \b, Custom Flag
>#>3     byte            &0x08          \b, Copyrighted
>#>3     byte            &0x04          \b, Original Source
>#>3     byte&0x03       1              \b, NR: 50/15 ms
>#>3     byte&0x03       3              \b, NR: CCIT J.17
>
># AAC (aka MPEG-2 NBC audio) and MPEG-4 audio
>
># Stored AAC streams (instead of the MP4 format)
>0       string          ADIF           MPEG ADIF, AAC
>>4      byte            &0x80
>>>13    byte            &0x10          \b, VBR
>>>13    byte            ^0x10          \b, CBR
>>>16    byte&0x1E       0x02           \b, single stream
>>>16    byte&0x1E       0x04           \b, 2 streams
>>>16    byte&0x1E       0x06           \b, 3 streams
>>>16    byte            &0x08          \b, 4 or more streams
>>>16    byte            &0x10          \b, 8 or more streams
>>>4    byte            &0x80          \b, Copyrighted
>>>13   byte            &0x40          \b, Original Source
>>>13   byte            &0x20          \b, Home Flag
>>4      byte            ^0x80
>>>4     byte            &0x10          \b, VBR
>>>4     byte            ^0x10          \b, CBR
>>>7     byte&0x1E       0x02           \b, single stream
>>>7     byte&0x1E       0x04           \b, 2 streams
>>>7     byte&0x1E       0x06           \b, 3 streams
>>>7     byte            &0x08          \b, 4 or more streams
>>>7     byte            &0x10          \b, 8 or more streams
>>>4    byte            &0x40          \b, Original Stream(s)
>>>4    byte            &0x20          \b, Home Source
>
># Live or stored single AAC stream (used with MPEG-2 systems)
>0       beshort&0xFFF6  0xFFF0         MPEG ADTS, AAC
>>1      byte            &0x08          \b, v2
>>1      byte            ^0x08          \b, v4
># profile
>>>2     byte            &0xC0          \b LTP
>>2      byte&0xc0       0x00           \b Main
>>2      byte&0xc0       0x40           \b LC
>>2      byte&0xc0       0x80           \b SSR
># timing
>>2      byte&0x3c       0x00           \b, 96 kHz
>>2      byte&0x3c       0x04           \b, 88.2 kHz
>>2      byte&0x3c       0x08           \b, 64 kHz
>>2      byte&0x3c       0x0c           \b, 48 kHz
>>2      byte&0x3c       0x10           \b, 44.1 kHz
>>2      byte&0x3c       0x14           \b, 32 kHz
>>2      byte&0x3c       0x18           \b, 24 kHz
>>2      byte&0x3c       0x1c           \b, 22.05 kHz
>>2      byte&0x3c       0x20           \b, 16 kHz
>>2      byte&0x3c       0x24           \b, 12 kHz
>>2      byte&0x3c       0x28           \b, 11.025 kHz
>>2      byte&0x3c       0x2c           \b, 8 kHz
># channels
>>2      beshort&0x01c0  0x0040         \b, monaural
>>2      beshort&0x01c0  0x0080         \b, stereo
>>2      beshort&0x01c0  0x00c0         \b, stereo + center
>>2      beshort&0x01c0  0x0100         \b, stereo+center+LFE
>>2      beshort&0x01c0  0x0140         \b, surround
>>2      beshort&0x01c0  0x0180         \b, surround + LFE
>>2      beshort         &0x01C0        \b, surround + side
>#>1     byte            ^0x01           \b, Data Verify
>#>2     byte            &0x02           \b, Custom Flag
>#>3     byte            &0x20           \b, Original Stream
>#>3     byte            &0x10           \b, Home Source
>#>3     byte            &0x08           \b, Copyrighted
>
># Live MPEG-4 audio streams (instead of RTP FlexMux)
>0       beshort&0xFFE0  0x56E0         MPEG-4 LOAS
>#>1     beshort&0x1FFF  x              \b, %u byte packet
>>3      byte&0xE0       0x40
>>>4     byte&0x3C       0x04           \b, single stream
>>>4     byte&0x3C       0x08           \b, 2 streams
>>>4     byte&0x3C       0x0C           \b, 3 streams
>>>4     byte            &0x08          \b, 4 or more streams
>>>4     byte            &0x20          \b, 8 or more streams
>>3      byte&0xC0       0
>>>4     byte&0x78       0x08           \b, single stream
>>>4     byte&0x78       0x10           \b, 2 streams
>>>4     byte&0x78       0x18           \b, 3 streams
>>>4     byte            &0x20          \b, 4 or more streams
>>>4     byte            &0x40          \b, 8 or more streams
>0       beshort         0x4DE1         MPEG-4 LO-EP audio stream
>
># FLI animation format
>4	leshort		0xAF11			FLI file
>>6	leshort		x			- %d frames,
>>8	leshort		x			width=%d pixels,
>>10	leshort		x			height=%d pixels,
>>12	leshort		x			depth=%d,
>>16	leshort		x			ticks/frame=%d
># FLC animation format
>4	leshort		0xAF12			FLC file
>>6	leshort		x			- %d frames
>>8	leshort		x			width=%d pixels,
>>10	leshort		x			height=%d pixels,
>>12	leshort		x			depth=%d,
>>16	leshort		x			ticks/frame=%d
>
># DL animation format
># XXX - collision with most `mips' magic
>#
># I couldn't find a real magic number for these, however, this
># -appears- to work.  Note that it might catch other files, too, so be
># careful!
>#
># Note that title and author appear in the two 20-byte chunks
># at decimal offsets 2 and 22, respectively, but they are XOR'ed with
># 255 (hex FF)!  The DL format is really bad.
>#
>#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
>#>42	byte	x	- %d screens,
>#>43	byte	x	%d commands
>#0	byte	2	DL version 2
>#>1	byte	1	- large format (320x200,1 image/screen),
>#>1	byte	2	- medium format (160x100,4 images/screen),
>#>1	byte	>2	- unknown format,
>#>42	byte	x	%d screens,
>#>43	byte	x	%d commands
># Based on empirical evidence, DL version 3 have several nulls following the
># \003.  Most of them start with non-null values at hex offset 0x34 or so.
>#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3
>
># iso 13818 transport stream
>#
># from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001 (ISO 13818.1)
># (the following is a little bit restrictive and works fine for a stream
>#  that starts with PAT properly. it won't work for stream data, that is
>#  cut from an input device data right in the middle, but this shouldn't
>#  disturb)
># syncbyte      8 bit	0x47
># error_ind     1 bit	-
># payload_start 1 bit	1
># priority      1 bit	-
># PID          13 bit	0x0000
># scrambling    2 bit	-
># adaptfld_ctrl 2 bit	1 or 3
># conti_count   4 bit	0
>0	belong&0xFF5FFF1F	0x47400010	MPEG transport stream data
>>188	byte			!0x47		CORRUPTED
>
># DIF digital video file format <mpruett@sgi.com>
>0	belong&0xffffff00	0x1f070000      DIF
>>4	byte			&0x01		(DVCPRO) movie file
>>4	byte			^0x01		(DV) movie file
>>3	byte			&0x80		(PAL)
>>3	byte			^0x80		(NTSC)
>
># Microsoft Advanced Streaming Format (ASF) <mpruett@sgi.com>
>0	belong			0x3026b275	Microsoft ASF
>
># MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
>0	string			\x8aMNG		MNG video data,
>>4	belong			!0x0d0a1a0a	CORRUPTED,
>>4	belong			0x0d0a1a0a
>>>16    belong	x				%ld x
>>>20    belong	x				%ld
>
># JNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
>0	string			\x8bJNG		JNG video data,
>>4	belong			!0x0d0a1a0a	CORRUPTED,
>>4	belong			0x0d0a1a0a
>>>16    belong	x				%ld x
>>>20    belong	x				%ld
>
># Vivo video (Wolfram Kleff)
>3	string		\x0D\x0AVersion:Vivo	Vivo video data
>
># VRML (Virtual Reality Modelling Language)
>0       string/b        #VRML\ V1.0\ ascii	VRML 1 file
>0	string/b	#VRML\ V2.0\ utf8	ISO/IEC 14772 VRML 97 file
>
>#---------------------------------------------------------------------------
># HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
># From Mark Sheppard <msheppard@climax.co.uk>, 2002-10-03
>#
>0	string		HVQM4		%s
>>6	string		>\0		v%s
>>0	byte		x		GameCube movie,
>>0x34	ubeshort	x		%d x
>>0x36	ubeshort	x		%d,
>>0x26	ubeshort	x		%dÂµs,
>>0x42	ubeshort	0		no audio
>>0x42	ubeshort	>0		%dHz audio
>
># From: "Stefan A. Haubenthal" <polluks@web.de>
>0	string		DVDVIDEO-VTS	Video title set,
>>0x21	byte		x		v%x
>0	string		DVDVIDEO-VMG	Video manager,
>>0x21	byte		x		v%x
>
>#------------------------------------------------------------------------------
># apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
>#       workspaces)
>#
>0	long		0100554		APL workspace (Ken's original?)
>
>#------------------------------------------------------------------------------
># applix:  file(1) magic for Applixware
># From: Peter Soos <sp@osb.hu>
>#
>0	string		*BEGIN		Applixware
>>7	string		WORDS			Words Document
>>7	string		GRAPHICS		Graphic
>>7	string		RASTER			Bitmap
>>7	string		SPREADSHEETS		Spreadsheet
>>7	string		MACRO			Macro
>>7	string		BUILDER			Builder Object
>
>#------------------------------------------------------------------------------
># archive:  file(1) magic for archive formats (see also "msdos" for self-
>#           extracting compressed archives)
>#
># cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
># pre-POSIX "tar" archives are handled in the C code.
>
># POSIX tar archives
>257	string		ustar\0		POSIX tar archive
>257	string		ustar\040\040\0	GNU tar archive
>
># cpio archives
>#
># Yes, the top two "cpio archive" formats *are* supposed to just be "short".
># The idea is to indicate archives produced on machines with the same
># byte order as the machine running "file" with "cpio archive", and
># to indicate archives produced on machines with the opposite byte order
># from the machine running "file" with "byte-swapped cpio archive".
>#
># The SVR4 "cpio(4)" hints that there are additional formats, but they
># are defined as "short"s; I think all the new formats are
># character-header formats and thus are strings, not numbers.
>0	short		070707		cpio archive
>0	short		0143561		byte-swapped cpio archive
>0	string		070707		ASCII cpio archive (pre-SVR4 or odc)
>0	string		070701		ASCII cpio archive (SVR4 with no CRC)
>0	string		070702		ASCII cpio archive (SVR4 with CRC)
>
># Debian package (needs to go before regular portable archives)
>#
>0	string		=!<arch>\ndebian
>>8	string		debian-split	part of multipart Debian package
>>8	string		debian-binary	Debian binary package
>>68	string		>\0		(format %s)
>>81	string		bz2		\b, uses bzip2 compression
>>84	string		gz		\b, uses gzip compression
>#>136	ledate		x		created: %s
>
># other archives
>0	long		0177555		very old archive
>0	short		0177555		very old PDP-11 archive
>0	long		0177545		old archive
>0	short		0177545		old PDP-11 archive
>0	long		0100554		apl workspace
>0	string		=<ar>		archive
>
># MIPS archive (needs to go before regular portable archives)
>#
>0	string	=!<arch>\n__________E	MIPS archive
>>20	string	U			with MIPS Ucode members
>>21	string	L			with MIPSEL members
>>21	string	B			with MIPSEB members
>>19	string	L			and an EL hash table
>>19	string	B			and an EB hash table
>>22	string	X			-- out of date
>
>0	string		-h-		Software Tools format archive text
>
>#
># XXX - why are there multiple <ar> thingies?  Note that 0x213c6172 is
># "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
>#
># 0	string		=!<arch>		current ar archive
># 0	long		0x213c6172	archive file
>#
># and for SVR1 archives, we have:
>#
># 0	string		\<ar>		System V Release 1 ar archive
># 0	string		=<ar>		archive
>#
># XXX - did Aegis really store shared libraries, breakpointed modules,
># and absolute code program modules in the same format as new-style
># "ar" archives?
>#
>0	string		=!<arch>		current ar archive
>>8	string		__.SYMDEF	random library
>>0	belong		=65538		- pre SR9.5
>>0	belong		=65539		- post SR9.5
>>0	beshort		2		- object archive
>>0	beshort		3		- shared library module
>>0	beshort		4		- debug break-pointed module
>>0	beshort		5		- absolute code program module
>0	string		\<ar>		System V Release 1 ar archive
>0	string		=<ar>		archive
>#
># XXX - from "vax", which appears to collect a bunch of byte-swapped
># thingies, to help you recognize VAX files on big-endian machines;
># with "leshort", "lelong", and "string", that's no longer necessary....
>#
>0	belong		0x65ff0000	VAX 3.0 archive
>0	belong		0x3c61723e	VAX 5.0 archive
>#
>0	long		0x213c6172	archive file
>0	lelong		0177555		very old VAX archive
>0	leshort		0177555		very old PDP-11 archive
>#
># XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
># be a random library (it said 0xff65 rather than 0177545).
>#
>0	lelong		0177545		old VAX archive
>>8	string		__.SYMDEF	random library
>0	leshort		0177545		old PDP-11 archive
>>8	string		__.SYMDEF	random library
>#
># From "pdp" (but why a 4-byte quantity?)
>#
>0	lelong		0x39bed		PDP-11 old archive
>0	lelong		0x39bee		PDP-11 4.0 archive
>
># ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
>#
># The first byte is the magic (0x1a), byte 2 is the compression type for
># the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
># filename of the first file (null terminated).  Since some types collide
># we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
># 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
>0	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
>0	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
>0	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
>0	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
>0	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
>0	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched
># [JW] stuff taken from idarc, obviously ARC successors:
>0	lelong&0x8080ffff	0x00000a1a	PAK archive data
>0	lelong&0x8080ffff	0x0000141a	ARC+ archive data
>0	lelong&0x8080ffff	0x0000481a	HYP archive data
>
># Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
># I can't create either SPARK or ArcFS archives so I have not tested this stuff
># [GRR:  the original entries collide with ARC, above; replaced with combined
>#  version (not tested)]
>#0	byte		0x1a		RISC OS archive
>#>1	string		archive		(ArcFS format)
>#0	string		\032archive	RISC OS archive (ArcFS format)
>0       string          \032            RISC OS archive (spark format)
>0       string          Archive\000     RISC OS archive (ArcFS format)
>
># All these were taken from idarc, many could not be verified. Unfortunately,
># there were many low-quality sigs, i.e. easy to trigger false positives.
># Please notify me of any real-world fishy/ambiguous signatures and I'll try
># to get my hands on the actual archiver and see if I find something better. [JW]
># probably many can be enhanced by finding some 0-byte or control char near the start
>
># idarc calls this Crush/Uncompressed... *shrug*
>0	string	CRUSH Crush archive data
># Squeeze It (.sqz)
>0	string	HLSQZ Squeeze It archive data
># SQWEZ
>0	string	SQWEZ SQWEZ archive data
># HPack (.hpk)
>0	string	HPAK HPack archive data
># HAP
>0	string	\x91\x33HF HAP archive data
># MD/MDCD
>0	string	MDmd MDCD archive data
># LIM
>0	string	LIM\x1a LIM archive data
># SAR
>3	string	LH5 SAR archive data
># BSArc/BS2
>0	string	\212\3SB \0 BSArc/BS2 archive data
># MAR
>2	string	=-ah MAR archive data
># ACB
>0	belong&0x00f800ff	0x00800000 ACB archive data
># CPZ
># TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data
># JRC
>0	string	JRchive JRC archive data
># Quantum
>0	string	DS\0 Quantum archive data
># ReSOF
>0	string	PK\3\6 ReSOF archive data
># QuArk
>0	string	7\4 QuArk archive data
># YAC
>14	string	YC YAC archive data
># X1
>0	string	X1 X1 archive data
>0	string	XhDr X1 archive data
># CDC Codec (.dqt)
>0	belong&0xffffe000	0x76ff2000 CDC Codec archive data
># AMGC
>0	string	\xad6" AMGC archive data
># NuLIB
>0	string	NÃµFÃ©lÃ¥ NuLIB archive data
># PakLeo
>0	string	LEOLZW PAKLeo archive data
># ChArc
>0	string	SChF ChArc archive data
># PSA
>0	string	PSA PSA archive data
># CrossePAC
>0	string	DSIGDCC CrossePAC archive data
># Freeze
>0	string	\x1f\x9f\x4a\x10\x0a Freeze archive data
># KBoom
>0	string	Â¨MPÂ¨ KBoom archive data
># NSQ, must go after CDC Codec
>0	string	\x76\xff NSQ archive data
># DPA
>0	string	Dirk\ Paehl DPA archive data
># BA
># TODO: idarc says "bytes 0-2 == bytes 3-5"
># TTComp
>0	string	\0\6 TTComp archive data
># ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?
>0	string	ESP ESP archive data
># ZPack
>0	string	\1ZPK\1 ZPack archive data
># Sky
>0	string	\xbc\x40 Sky archive data
># UFA
>0	string	UFA UFA archive data
># Dry
>0	string	=-H2O DRY archive data
># FoxSQZ
>0	string	FOXSQZ FoxSQZ archive data
># AR7
>0	string	,AR7 AR7 archive data
># PPMZ
>0	string	PPMZ PPMZ archive data
># MS Compress
>4	string	\x88\xf0\x27 MS Compress archive data
># MP3 (archiver, not lossy audio compression)
>0	string	MP3\x1a MP3-Archiver archive data
># ZET
>0	string	OZÃ ZET archive data
># TSComp
>0	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data
># ARQ
>0	string	gW\4\1 ARQ archive data
># Squash
>3	string	OctSqu Squash archive data
># Terse
>0	string	\5\1\1\0 Terse archive data
># PUCrunch
>0	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data
># UHarc
>0	string	UHA UHarc archive data
># ABComp
>0	string	\2AB ABComp archive data
>0	string	\3AB2 ABComp archive data
># CMP
>0	string	CO\0 CMP archive data
># Splint
>0	string	\x93\xb9\x06 Splint archive data
># InstallShield
>0	string	 \x13\x5d\x65\x8c InstallShield Z archive Data
># Gather
>1	string	GTH Gather archive data
># BOA
>0	string	BOA BOA archive data
># RAX
>0	string	ULEB\xa RAX archive data
># Xtreme
>0	string	ULEB\0 Xtreme archive data
># Pack Magic
>0	string	@Ã¢\1\0 Pack Magic archive data
># BTS
>0	belong&0xfeffffff	0x1a034465 BTS archive data
># ELI 5750
>0	string	Ora\  ELI 5750 archive data
># QFC
>0	string	\x1aFC\x1a QFC archive data
>0	string	\x1aQF\x1a QFC archive data
># PRO-PACK
>0	string	RNC PRO-PACK archive data
># 777
>0	string	777 777 archive data
># LZS221
>0	string	sTaC LZS221 archive data
># HPA
>0	string	HPA HPA archive data
># Arhangel
>0	string	LG Arhangel archive data
># EXP1, uses bzip2
>0	string	0123456789012345BZh EXP1 archive data
># IMP
>0	string	IMP\xa IMP archive data
># NRV
>0	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data
># Squish
>0	string	\x73\xb2\x90\xf4 Squish archive data
># Par
>0	string	PHILIPP Par archive data
>0	string	PAR Par archive data
># HIT
>0	string	UB HIT archive data
># SBX
>0	belong&0xfffff000	0x53423000 SBX archive data
># NaShrink
>0	string	NSK NaShrink archive data
># SAPCAR
>0	string	#\ CAR\ archive\ header SAPCAR archive data
>0	string	CAR\ 2.00RG SAPCAR archive data
># Disintegrator
>0	string	DST Disintegrator archive data
># ASD
>0	string	ASD ASD archive data
># InstallShield CAB
>0	string	ISc( InstallShield CAB
># TOP4
>0	string	T4\x1a TOP4 archive data
># BatComp left out: sig looks like COM executable
># so TODO: get real 4dos batcomp file and find sig
># BlakHole
>0	string	BH\5\7 BlakHole archive data
># BIX
>0	string	BIX0 BIX archive data
># ChiefLZA
>0	string	ChfLZ ChiefLZA archive data
># Blink
>0	string	Blink Blink archive data
># Logitech Compress
>0	string	\xda\xfa Logitech Compress archive data
># ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)
>1	string	(C)\ STEPANYUK ARS-Sfx archive data
># AKT/AKT32
>0	string	AKT32 AKT32 archive data
>0	string	AKT AKT archive data
># NPack
>0	string	MSTSM NPack archive data
># PFT
>0	string	\0\x50\0\x14 PFT archive data
># SemOne
>0	string	SEM SemOne archive data
># PPMD
>0	string	\x8f\xaf\xac\x84 PPMD archive data
># FIZ
>0	string	FIZ FIZ archive data
># MSXiE
>0	belong&0xfffff0f0	0x4d530000 MSXiE archive data
># DeepFreezer
>0	belong&0xfffffff0	0x797a3030 DeepFreezer archive data
># DC
>0	string	=<DC- DC archive data
># TPac
>0	string	\4TPAC\3 TPac archive data
># Ai
>0	string	Ai\1\1\0 Ai archive data
>0	string	Ai\1\0\0 Ai archive data
># Ai32
>0	string	Ai\2\0 Ai32 archive data
>0	string	Ai\2\1 Ai32 archive data
># SBC
>0	string	SBC SBC archive data
># Ybs
>0	string	YBS Ybs archive data
># DitPack
>0	string	\x9e\0\0 DitPack archive data
># DMS
>0	string	DMS! DMS archive data
># EPC
>0	string	\x8f\xaf\xac\x8c EPC archive data
># VSARC
>0	string	VS\x1a VSARC archive data
># PDZ
>0	string	PDZ PDZ archive data
># ReDuq
>0	string	rdqx ReDuq archive data
># GCA
>0	string	GCAX GCA archive data
># PPMN
>0	string	pN PPMN archive data
># WinImage
>3	string	WINIMAGE WinImage archive data
># Compressia
>0	string	CMP0CMP Compressia archive data
># UHBC
>0	string	UHB UHBC archive data
># WinHKI
>0	string	\x61\x5C\x04\x05 WinHKI archive data
># WWPack data file
>0	string	WWP WWPack archive data
># BSN (BSA, PTS-DOS)
>0	string	\xffBSG BSN archive data
>1	string	\xffBSG BSN archive data
>3	string	\xffBSG BSN archive data
>1	string	\0\xae\2 BSN archive data
>1	string	\0\xae\3 BSN archive data
>1	string	\0\xae\7 BSN archive data
># AIN
>0	string	\x33\x18 AIN archive data
>0	string	\x33\x17 AIN archive data
># XPA32
>0	string	xpa\0\1 XPA32 archive data
># SZip (TODO: doesn't catch all versions)
>0	string	SZ\x0a\4 SZip archive data
># XPack DiskImage
>0	string	jm XPack DiskImage archive data
># XPack Data
>0	string	xpa XPack archive data
># XPack Single Data
>0	string	Ã\ jm XPack single archive data
>
># TODO: missing due to unknown magic/magic at end of file:
>#DWC
>#ARG
>#ZAR
>#PC/3270
>#InstallIt
>#RKive
>#RK
>#XPack Diskimage
>
># These were inspired by idarc, but actually verified
># Dzip archiver (.dz)
>0	string	DZ Dzip archive data
>>2	byte	x \b, version %i
>>3	byte	x \b.%i
># ZZip archiver (.zz)
>0	string	ZZ\ \0\0 ZZip archive data
>0	string	ZZ0 ZZip archive data
># PAQ archiver (.paq)
>0	string	\xaa\x40\x5f\x77\x1f\xe5\x82\x0d PAQ archive data
>0	string	PAQ PAQ archive data
>>3	byte&0xf0	0x30
>>>3	byte	x (v%c)
># JAR archiver (.j), this is the successor to ARJ, not Java's JAR (which is essentially ZIP)
>0xe	string	\x1aJar\x1b JAR (ARJ Software, Inc.) archive data
>0	string	JARCS JAR (ARJ Software, Inc.) archive data
>
># ARJ archiver (jason@jarthur.Claremont.EDU)
>0	leshort		0xea60		ARJ archive data
>>5	byte		x		\b, v%d,
>>8	byte		&0x04		multi-volume,
>>8	byte		&0x10		slash-switched,
>>8	byte		&0x20		backup,
>>34	string		x		original name: %s,
>>7	byte		0		os: MS-DOS
>>7	byte		1		os: PRIMOS
>>7	byte		2		os: Unix
>>7	byte		3		os: Amiga
>>7	byte		4		os: Macintosh
>>7	byte		5		os: OS/2
>>7	byte		6		os: Apple ][ GS
>>7	byte		7		os: Atari ST
>>7	byte		8		os: NeXT
>>7	byte		9		os: VAX/VMS
>>3	byte		>0		%d]
># [JW] idarc says this is also possible
>2	leshort		0xea60		ARJ archive data
>
># HA archiver (Greg Roelofs, newt@uchicago.edu)
># This is a really bad format. A file containing HAWAII will match this...
>#0	string		HA		HA archive data,
>#>2	leshort		=1		1 file,
>#>2	leshort		>1		%u files,
>#>4	byte&0x0f	=0		first is type CPY
>#>4	byte&0x0f	=1		first is type ASC
>#>4	byte&0x0f	=2		first is type HSC
>#>4	byte&0x0f	=0x0e		first is type DIR
>#>4	byte&0x0f	=0x0f		first is type SPECIAL
># suggestion: at least identify small archives (<1024 files)
>0  belong&0xffff00fc 0x48410000 HA archive data
>>2	leshort		=1		1 file,
>>2	leshort		>1		%u files,
>>4	byte&0x0f	=0		first is type CPY
>>4	byte&0x0f	=1		first is type ASC
>>4	byte&0x0f	=2		first is type HSC
>>4	byte&0x0f	=0x0e		first is type DIR
>>4	byte&0x0f	=0x0f		first is type SPECIAL
>
># HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
>0	string		HPAK		HPACK archive data
>
># JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
>0	string		\351,\001JAM\		JAM archive,
>>7	string		>\0			version %.4s
>>0x26	byte		=0x27			-
>>>0x2b	string          >\0			label %.11s,
>>>0x27	lelong		x			serial %08x,
>>>0x36	string		>\0			fstype %.8s
>
># LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
>2	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
>2	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
>2	string		-lz4-		LHarc 1.x archive data [lz4]
>2	string		-lz5-		LHarc 1.x archive data [lz5]
>#	[never seen any but the last; -lh4- reported in comp.compression:]
>2	string		-lzs-		LHa/LZS archive data [lzs]
>2	string		-lh\40-		LHa 2.x? archive data [lh ]
>2	string		-lhd-		LHa 2.x? archive data [lhd]
>2	string		-lh2-		LHa 2.x? archive data [lh2]
>2	string		-lh3-		LHa 2.x? archive data [lh3]
>2	string		-lh4-		LHa (2.x) archive data [lh4]
>2	string		-lh5-		LHa (2.x) archive data [lh5]
>2	string		-lh6-		LHa (2.x) archive data [lh6]
>2	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
>>20	byte		x		- header level %d
># taken from idarc [JW]
>2   string      -lZ         PUT archive data
>2   string      -lz         LZS archive data 
>2   string      -sw1-       Swag archive data
>
># RAR archiver (Greg Roelofs, newt@uchicago.edu)
>0	string		Rar!		RAR archive data,
>>44	byte		x		v%0x,
>>35	byte		0		os: MS-DOS
>>35	byte		1		os: OS/2
>>35	byte		2		os: Win32
>>35	byte		3		os: Unix
># some old version? idarc says:
>0   string      RE\x7e\x5e  RAR archive data
>
># SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
>0	string		SQSH		squished archive data (Acorn RISCOS)
>
># UC2 archiver (Greg Roelofs, newt@uchicago.edu)
># [JW] see exe section for self-extracting version
>0	string		UC2\x1a		UC2 archive data
>
># ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
>0	string		PK\003\004	Zip archive data
>>4	byte		0x09		\b, at least v0.9 to extract
>>4	byte		0x0a		\b, at least v1.0 to extract
>>4	byte		0x0b		\b, at least v1.1 to extract
>>4	byte		0x14		\b, at least v2.0 to extract
>
># Zoo archiver
>20	lelong		0xfdc4a7dc	Zoo archive data
>>4	byte		>48		\b, v%c.
>>>6	byte		>47		\b%c
>>>>7	byte		>47		\b%c
>>32	byte		>0		\b, modify: v%d
>>>33	byte		x		\b.%d+
>>42	lelong		0xfdc4a7dc	\b,
>>>70	byte		>0		extract: v%d
>>>>71	byte		x		\b.%d+
>
># Shell archives
>10	string		#\ This\ is\ a\ shell\ archive	shell archive text
>
>#
># LBR. NB: May conflict with the questionable 
>#          "binary Computer Graphics Metafile" format.
>#
>0       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
>#
># PMA (CP/M derivative of LHA)
>#
>2       string          -pm0-           PMarc archive data [pm0]
>2       string          -pm1-           PMarc archive data [pm1]
>2       string          -pm2-           PMarc archive data [pm2]
>2       string          -pms-           PMarc SFX archive (CP/M, DOS)
>5       string          -pc1-           PopCom compressed executable (CP/M)
>
># From Rafael Laboissiere <rafael@laboissiere.net>
># The Project Revision Control System (see
># http://prcs.sourceforge.net) generates a packaged project
># file which is recognized by the following entry: 
>0	leshort		0xeb81	PRCS packaged project
>
># Microsoft cabinets 
># by David Necas (Yeti) <yeti@physics.muni.cz>
>#0	string	MSCF\0\0\0\0	Microsoft cabinet file data,
>#>25	byte	x		v%d
>#>24	byte	x		\b.%d
># MPi: All CABs have version 1.3, so this is pointless.
># Better magic in debian-additions.
>
># GTKtalog catalogs 
># by David Necas (Yeti) <yeti@physics.muni.cz>
>4	string	gtktalog\ 	GTKtalog catalog data,
>>13	string	3		version 3
>>>14	beshort	0x677a		(gzipped)
>>>14	beshort	!0x677a		(not gzipped)
>>13	string	>3		version %s
>
>############################################################################
># Parity archive reconstruction file, the 'par' file format now used on Usenet.
>0       string          PAR\0	PARity archive data
>>48	leshort		=0	- Index file
>>48	leshort		>0	- file number %d
>
># Felix von Leitner <felix-file@fefe.de>
>0	string	d8:announce	BitTorrent file
>
># Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>
>0       beshort 0x0e0f          Atari MSA archive data
>>2      beshort x       	\b, %d sectors per track
>>4      beshort 0       	\b, 1 sided
>>4      beshort 1       	\b, 2 sided
>>6      beshort x       	\b, starting track: %d
>>8      beshort x       	\b, ending track: %d
>
># Alternate ZIP string (amc@arwen.cs.berkeley.edu)
>0	string	PK00PK\003\004	Zip archive data
>
># ACE archive (from http://www.wotsit.org/download.asp?f=ace)
># by Stefan `Sec` Zehl <sec@42.org>
>7	string		**ACE**		ACE archive data
>>15	byte	>0		version %d
>>16	byte	=0x00		\b, from MS-DOS
>>16	byte	=0x01		\b, from OS/2
>>16	byte	=0x02		\b, from Win/32
>>16	byte	=0x03		\b, from Unix
>>16	byte	=0x04		\b, from MacOS
>>16	byte	=0x05		\b, from WinNT
>>16	byte	=0x06		\b, from Primos
>>16	byte	=0x07		\b, from AppleGS
>>16	byte	=0x08		\b, from Atari
>>16	byte	=0x09		\b, from Vax/VMS
>>16	byte	=0x0A		\b, from Amiga
>>16	byte	=0x0B		\b, from Next
>>14	byte	x		\b, version %d to extract
>>5	leshort &0x0080		\b, multiple volumes,
>>>17	byte	x		\b (part %d),
>>5	leshort &0x0002		\b, contains comment
>>5	leshort	&0x0200		\b, sfx
>>5	leshort	&0x0400		\b, small dictionary
>>5	leshort	&0x0800		\b, multi-volume
>>5	leshort	&0x1000		\b, contains AV-String
>>>30	string\x16*UNREGISTERED\x20VERSION*	(unregistered)
>>5	leshort &0x2000		\b, with recovery record
>>5	leshort &0x4000		\b, locked
>>5	leshort &0x8000		\b, solid
># Date in MS-DOS format (whatever that is)
>#>18	lelong	x		Created on
>
># sfArk : compression program for Soundfonts (sf2) by Dirk Jagdmann
># <doj@cubic.org>
>0x1A	string	sfArk		sfArk compressed Soundfont
>>0x15	string	2
>>>0x1	string	>\0		Version %s
>>>0x2A	string	>\0		: %s
>
># DR-DOS 7.03 Packed File *.??_
>0	string	Packed\ File\  Personal		NetWare Packed File
>>12	string	x    				\b, was "%.12s"
>
># EET archive
># From: Tilman Sauerbeck <tilman@code-monkey.de>
>0	belong	0x1ee7ff00	EET archive
>
>#------------------------------------------------------------------------------
># asterix:  file(1) magic for Aster*x; SunOS 5.5.1 gave the 4-character
># strings as "long" - we assume they're just strings:
># From: guy@netapp.com (Guy Harris)
>#
>0	string		*STA		Aster*x
>>7	string		WORD			Words Document
>>7	string		GRAP			Graphic
>>7	string		SPRE			Spreadsheet
>>7	string		MACR			Macro
>0	string		2278		Aster*x Version 2
>>29	byte		0x36			Words Document
>>29	byte		0x35			Graphic
>>29	byte		0x32			Spreadsheet
>>29	byte		0x38			Macro
>
>
>#------------------------------------------------------------------------------
># att3b:  file(1) magic for AT&T 3B machines
>#
># The `versions' should be un-commented if they work for you.
># (Was the problem just one of endianness?)
>#
># 3B20
>#
># The 3B20 conflicts with SCCS.
>#0	beshort		0550		3b20 COFF executable
>#>12	belong		>0		not stripped
>#>22	beshort		>0		- version %ld
>#0	beshort		0551		3b20 COFF executable (TV)
>#>12	belong		>0		not stripped
>#>22	beshort		>0		- version %ld
>#
># WE32K
>#
>0	beshort		0560		WE32000 COFF
>>18	beshort		^00000020	object
>>18	beshort		&00000020	executable
>>12	belong		>0		not stripped
>>18	beshort		^00010000	N/A on 3b2/300 w/paging
>>18	beshort		&00020000	32100 required
>>18	beshort		&00040000	and MAU hardware required
>>20	beshort		0407		(impure)
>>20	beshort		0410		(pure)
>>20	beshort		0413		(demand paged)
>>20	beshort		0443		(target shared library)
>>22	beshort		>0		- version %ld
>0	beshort		0561		WE32000 COFF executable (TV)
>>12	belong		>0		not stripped
>#>18	beshort		&00020000	- 32100 required
>#>18	beshort		&00040000	and MAU hardware required
>#>22	beshort		>0		- version %ld
>#
># core file for 3b2 
>0	string		\000\004\036\212\200	3b2 core file
>>364	string		>\0		of '%s'
>
>#------------------------------------------------------------------------------
># audio:  file(1) magic for sound formats (see also "iff")
>#
># Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
># and others
>#
>
># Sun/NeXT audio data
>0	string		.snd		Sun/NeXT audio data:
>>12	belong		1		8-bit ISDN mu-law,
>>12	belong		2		8-bit linear PCM [REF-PCM],
>>12	belong		3		16-bit linear PCM,
>>12	belong		4		24-bit linear PCM,
>>12	belong		5		32-bit linear PCM,
>>12	belong		6		32-bit IEEE floating point,
>>12	belong		7		64-bit IEEE floating point,
>>12	belong		8		Fragmented sample data,
>>12	belong		10		DSP program,
>>12	belong		11		8-bit fixed point,
>>12	belong		12		16-bit fixed point,
>>12	belong		13		24-bit fixed point,
>>12	belong		14		32-bit fixed point,
>>12	belong		18		16-bit linear with emphasis,
>>12	belong		19		16-bit linear compressed,
>>12	belong		20		16-bit linear with emphasis and compression,
>>12	belong		21		Music kit DSP commands,
>>12	belong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice data encoding),
>>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
>>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
>>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
>>12	belong		27		8-bit A-law (CCITT G.711),
>>20	belong		1		mono,
>>20	belong		2		stereo,
>>20	belong		4		quad,
>>16	belong		>0		%d Hz
>
># DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
># that uses little-endian encoding and has a different magic number
>0	lelong		0x0064732E	DEC audio data:
>>12	lelong		1		8-bit ISDN mu-law,
>>12	lelong		2		8-bit linear PCM [REF-PCM],
>>12	lelong		3		16-bit linear PCM,
>>12	lelong		4		24-bit linear PCM,
>>12	lelong		5		32-bit linear PCM,
>>12	lelong		6		32-bit IEEE floating point,
>>12	lelong		7		64-bit IEEE floating point,
>>12	belong		8		Fragmented sample data,
>>12	belong		10		DSP program,
>>12	belong		11		8-bit fixed point,
>>12	belong		12		16-bit fixed point,
>>12	belong		13		24-bit fixed point,
>>12	belong		14		32-bit fixed point,
>>12	belong		18		16-bit linear with emphasis,
>>12	belong		19		16-bit linear compressed,
>>12	belong		20		16-bit linear with emphasis and compression,
>>12	belong		21		Music kit DSP commands,
>>12	lelong		23		8-bit ISDN mu-law compressed (CCITT G.721 ADPCM voice data encoding),
>>12	belong		24		compressed (8-bit CCITT G.722 ADPCM)
>>12	belong		25		compressed (3-bit CCITT G.723.3 ADPCM),
>>12	belong		26		compressed (5-bit CCITT G.723.5 ADPCM),
>>12	belong		27		8-bit A-law (CCITT G.711),
>>20	lelong		1		mono,
>>20	lelong		2		stereo,
>>20	lelong		4		quad,
>>16	lelong		>0		%d Hz
>
># Creative Labs AUDIO stuff
>0	string	MThd			Standard MIDI data
>>8 	beshort	x			(format %d)
>>10	beshort	x			using %d track
>>10	beshort		>1		\bs
>>12	beshort&0x7fff	x		at 1/%d
>>12	beshort&0x8000	>0		SMPTE
>
>0	string	CTMF			Creative Music (CMF) data
>0	string	SBI			SoundBlaster instrument data
>0	string	Creative\ Voice\ File	Creative Labs voice data
># is this next line right?  it came this way...
>>19	byte	0x1A
>>23	byte	>0			- version %d
>>22	byte	>0			\b.%d
>
># first entry is also the string "NTRK"
>0	belong		0x4e54524b	MultiTrack sound data
>>4	belong		x		- version %ld
>
># Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
># [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
>0	string		EMOD		Extended MOD sound data,
>>4	byte&0xf0	x		version %d
>>4	byte&0x0f	x		\b.%d,
>>45	byte		x		%d instruments
>>83	byte		0		(module)
>>83	byte		1		(song)
>
># Real Audio (Magic .ra\0375)
>0	belong		0x2e7261fd	RealAudio sound file
>0	string		.RMF\0\0\0	RealMedia file
>
># MTM/669/FAR/S3M/ULT/XM format checking [Aaron Eppert, aeppert@dialin.ind.net]
># Oct 31, 1995
># fixed by <doj@cubic.org> 2003-06-24
># Too short...
>#0	string		MTM		MultiTracker Module sound data
>#0	string		if		Composer 669 Module sound data
>#0	string		JN		Composer 669 Module sound data (extended format)
>0	string		MAS_U		ULT(imate) Module sound data
>
>#0	string		FAR		Module sound data
>#>4	string		>\15		Title: "%s"
>
>0x2c	string		SCRM		ScreamTracker III Module sound data
>>0	string		>\0		Title: "%s"
>
># Gravis UltraSound patches
># From <ache@nagual.ru>
>
>0	string		GF1PATCH110\0ID#000002\0	GUS patch
>0	string		GF1PATCH100\0ID#000002\0	Old GUS	patch
>
>#
># Taken from loader code from mikmod version 2.14
># by Steve McIntyre (stevem@chiark.greenend.org.uk)
># <doj@cubic.org> added title printing on 2003-06-24
>0	string	MAS_UTrack_V00
>>14	string	>/0		ultratracker V1.%.1s module sound data
>
>0	string	UN05		MikMod UNI format module sound data
>
>0	string	Extended\ Module: Fasttracker II module sound data
>>17	string	>\0		Title: "%s"
>
>21	string/c	=!SCREAM!	Screamtracker 2 module sound data
>21	string	BMOD2STM	Screamtracker 2 module sound data
>1080	string	M.K.		4-channel Protracker module sound data
>>0	string	>\0		Title: "%s"
>1080	string	M!K!		4-channel Protracker module sound data
>>0	string	>\0		Title: "%s"
>1080	string	FLT4		4-channel Startracker module sound data
>>0	string	>\0		Title: "%s"
>1080	string	FLT8		8-channel Startracker module sound data
>>0	string	>\0		Title: "%s"
>1080	string	4CHN		4-channel Fasttracker module sound data
>>0	string	>\0		Title: "%s"
>1080	string	6CHN		6-channel Fasttracker module sound data
>>0	string	>\0		Title: "%s"
>1080	string	8CHN		8-channel Fasttracker module sound data
>>0	string	>\0		Title: "%s"
>1080	string	CD81		8-channel Octalyser module sound data
>>0	string	>\0		Title: "%s"
>1080	string	OKTA		8-channel Oktalyzer module sound data
>>0	string	>\0		Title: "%s"
># Not good enough.
>#1082	string	CH
>#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
>1080	string	16CN		16-channel Taketracker module sound data
>>0	string	>\0		Title: "%s"
>1080	string	32CN		32-channel Taketracker module sound data
>>0	string	>\0		Title: "%s"
>
># TOC sound files -Trevor Johnson <trevor@jpj.net>
>#
>0       string          TOC             TOC sound file
>
># sidfiles <pooka@iki.fi>
># added name,author,(c) and new RSID type by <doj@cubic.org> 2003-06-24
>0	string		SIDPLAY\ INFOFILE	Sidplay info file
>
>0	string		PSID			PlaySID v2.2+ (AMIGA) sidtune
>>4	beshort		>0			w/ header v%d,
>>14	beshort		=1			single song,
>>14	beshort		>1			%d songs,
>>16	beshort		>0			default song: %d
>>0x16	string		>\0			name: "%s"
>>0x36	string		>\0			author: "%s"
>>0x56	string		>\0			copyright: "%s"
>
>0	string		RSID			RSID sidtune PlaySID compatible
>>4	beshort		>0			w/ header v%d,
>>14	beshort		=1			single song,
>>14	beshort		>1			%d songs,
>>16	beshort		>0			default song: %d
>>0x16	string		>\0			name: "%s"
>>0x36	string		>\0			author: "%s"
>>0x56	string		>\0			copyright: "%s"
>
># IRCAM <mpruett@sgi.com>
># VAX and MIPS files are little-endian; Sun and NeXT are big-endian
>0	belong		0x64a30100		IRCAM file (VAX)
>0	belong		0x64a30200		IRCAM file (Sun)
>0	belong		0x64a30300		IRCAM file (MIPS little-endian)
>0	belong		0x64a30400		IRCAM file (NeXT)
>
># NIST SPHERE <mpruett@sgi.com>
>0	string		NIST_1A\n\ \ \ 1024\n	NIST SPHERE file
>
># Sample Vision <mpruett@sgi.com>
>0	string		SOUND\ SAMPLE\ DATA\ 	Sample Vision file
>
># Audio Visual Research <tonigonenstein@users.sourceforge.net>
>0	string		2BIT			Audio Visual Research file,
>>12	beshort		=0			mono,
>>12	beshort		=-1			stereo,
>>14	beshort		x			%d bits
>>16	beshort		=0			unsigned,
>>16	beshort		=-1			signed,
>>22	belong&0x00ffffff	x		%d Hz,
>>18	beshort		=0			no loop,
>>18	beshort		=-1			loop,
>>21	ubyte		<=127			note %d,
>>22	byte		=0			replay 5.485 KHz
>>22	byte		=1			replay 8.084 KHz
>>22	byte		=2			replay 10.971 Khz
>>22	byte		=3			replay 16.168 Khz
>>22	byte		=4			replay 21.942 KHz
>>22	byte		=5			replay 32.336 KHz
>>22	byte		=6			replay 43.885 KHz
>>22	byte		=7			replay 47.261 KHz
>
># SGI SoundTrack <mpruett@sgi.com>
>0	string		_SGI_SoundTrack		SGI SoundTrack project file
># ID3 version 2 tags <waschk@informatik.uni-rostock.de>
>0	string		ID3	MP3 file with ID3 version 2.
>>3	ubyte	<0xff	\b%d.
>>4	ubyte	<0xff	\b%d tag
>
># NSF (NES sound file) magic
>0	string		NESM\x1a	NES Sound File
>>14	string		>\0		("%s" by
>>46	string		>\0		%s, copyright
>>78	string		>\0		%s),
>>5	byte		x		version %d,
>>6	byte		x		%d tracks,
>>122	byte&0x2	=1		dual PAL/NTSC
>>122	byte&0x1	=1		PAL
>>122	byte&0x1	=0		NTSC
>
># Impuse tracker module (audio/x-it)
>0	string		IMPM		Impulse Tracker module sound data -
>>4	string		>\0		"%s"
>>40	leshort		!0		compatible w/ITv%x
>>42	leshort		!0		created w/ITv%x
>
># Imago Orpheus module (audio/x-imf)
>60	string		IM10		Imago Orpheus module sound data -
>>0	string		>\0		"%s"
>
># From <collver1@attbi.com>
># These are the /etc/magic entries to decode modules, instruments, and
># samples in Impulse Tracker's native format.
>
>0	string		IMPS		Impulse Tracker Sample
>>18	byte		&2		16 bit
>>18	byte		^2		8 bit
>>18	byte		&4		stereo
>>18	byte		^4		mono
>0	string		IMPI		Impulse Tracker Instrument
>>28	leshort		!0		ITv%x
>>30	byte		!0		%d samples
>
># Yamaha TX Wave:  file(1) magic for Yamaha TX Wave audio files
># From <collver1@attbi.com>
>0	string		LM8953		Yamaha TX Wave
>>22	byte		0x49		looped
>>22	byte		0xC9		non-looped
>>23	byte		1		33kHz
>>23	byte		2		50kHz
>>23	byte		3		16kHz
>
># scream tracker:  file(1) magic for Scream Tracker sample files
>#
># From <collver1@attbi.com>
>76	string		SCRS		Scream Tracker Sample
>>0	byte		1		sample
>>0	byte		2		adlib melody
>>0	byte		>2		adlib drum
>>31	byte		&2		stereo
>>31	byte		^2		mono
>>31	byte		&4		16bit little endian
>>31	byte		^4		8bit
>>30	byte		0		unpacked
>>30	byte		1		packed
>
># audio
># From: Cory Dikkers <cdikkers@swbell.net>
>0	string		MMD0		MED music file, version 0
>0	string		MMD1		OctaMED Pro music file, version 1
>0	string		MMD3		OctaMED Soundstudio music file, version 3
>0	string		OctaMEDCmpr	OctaMED Soundstudio compressed file
>0	string		MED		MED_Song
>0	string		SymM		Symphonie SymMOD music file
>#
>0	string		THX		AHX version
>>3	byte		=0		1 module data
>>3	byte		=1		2 module data
>#
>0	string		OKTASONG	Oktalyzer module data
>#
>0	string		DIGI\ Booster\ module\0	%s
>>20	byte		>0		%c
>>>21	byte		>0		\b%c
>>>>22	byte		>0		\b%c
>>>>>23	byte		>0		\b%c
>>610	string		>\0		\b, "%s"
>#
>0	string		DBM0	   	DIGI Booster Pro Module
>>4	byte		>0		V%X.
>>>5	byte		x		\b%02X
>>16	string		>\0		\b, "%s"
>#
>0	string		FTMN		FaceTheMusic module
>>16	string		>\0d		\b, "%s"
>
># From: <doj@cubic.org> 2003-06-24
>0	string		AMShdr\32	Velvet Studio AMS Module v2.2
>0	string		Extreme		Extreme Tracker AMS Module v1.3
>0	string		DDMF		Xtracker DMF Module
>>4	byte		x		v%i
>>0xD	string		>\0		Title: "%s"
>>0x2B	string		>\0		Composer: "%s"
>0	string		DSM\32		Dynamic Studio Module DSM
>0	string		SONG		DigiTrekker DTM Module
>0	string		DMDL		DigiTrakker MDL Module
>0	string		PSM\32		Protracker Studio PSM Module
>44	string		PTMF		Poly Tracker PTM Module
>>0	string		>\32		Title: "%s"
>0	string		MT20		MadTracker 2.0 Module MT2
>0	string		RAD\40by\40REALiTY!! RAD Adlib Tracker Module RAD
>0	string		RTMM		RTM Module
>0x426	string		MaDoKaN96	XMS Adlib Module
>>0	string		>\0		Composer: "%s"
>0	string		AMF		AMF Module
>>4	string		>\0		Title: "%s"
>0	string		MODINFO1	Open Cubic Player Module Inforation MDZ
>0	string		Extended\40Instrument: Fast Tracker II Instrument
>
># From: Takeshi Hamasaki <hma@syd.odn.ne.jp>
># NOA Nancy Codec file
>0	string		\210NOA\015\012\032	NOA Nancy Codec Movie file
># Yamaha SMAF format
>0	string		MMMD		Yamaha SMAF file
># Sharp Jisaku Melody format for PDC
>0	string		\001Sharp\040JisakuMelody	SHARP Cell-Phone ringing Melody
>>20	string		Ver01.00	Ver. 1.00
>>>32	byte		x		, %d tracks
>
># Free lossless audio codec <http://flac.sourceforge.net>
># From: Przemyslaw Augustyniak <silvathraec@rpg.pl>
>0	string			fLaC		FLAC audio bitstream data
>>4	byte&0x7f		>0		\b, unknown version
>>4	byte&0x7f		0		\b
># some common bits/sample values
>>>20	beshort&0x1f0		0x030		\b, 4 bit
>>>20	beshort&0x1f0		0x050		\b, 6 bit
>>>20	beshort&0x1f0		0x070		\b, 8 bit
>>>20	beshort&0x1f0		0x0b0		\b, 12 bit
>>>20	beshort&0x1f0		0x0f0		\b, 16 bit
>>>20	beshort&0x1f0		0x170		\b, 24 bit
>>>20	byte&0xe		0x0		\b, mono
>>>20	byte&0xe		0x2		\b, stereo
>>>20	byte&0xe		0x4		\b, 3 channels
>>>20	byte&0xe		0x6		\b, 4 channels
>>>20	byte&0xe		0x8		\b, 5 channels
>>>20	byte&0xe		0xa		\b, 6 channels
>>>20	byte&0xe		0xc		\b, 7 channels
>>>20	byte&0xe		0xe		\b, 8 channels
># some common sample rates
>>>17	belong&0xfffff0		0x0ac440	\b, 44.1 kHz
>>>17	belong&0xfffff0		0x0bb800	\b, 48 kHz
>>>17	belong&0xfffff0		0x07d000	\b, 32 kHz
>>>17	belong&0xfffff0		0x056220	\b, 22.05 kHz
>>>17	belong&0xfffff0		0x05dc00	\b, 24 kHz
>>>17	belong&0xfffff0		0x03e800	\b, 16 kHz
>>>17	belong&0xfffff0		0x02b110	\b, 11.025 kHz
>>>17	belong&0xfffff0		0x02ee00	\b, 12 kHz
>>>17	belong&0xfffff0		0x01f400	\b, 8 kHz
>>>17	belong&0xfffff0		0x177000	\b, 96 kHz
>>>17	belong&0xfffff0		0x0fa000	\b, 64 kHz
>>>21	byte&0xf		>0		\b, >4G samples
>>>21	byte&0xf		0		\b
>>>>22	belong			>0		\b, %u samples
>>>>22	belong			0		\b, length unknown
>
># (ISDN) VBOX voice message file (Wolfram Kleff)
>0       string          VBOX            VBOX voice message data
>
># ReBorn Song Files (.rbs)
># David J. Singer <doc@deadvirgins.org.uk>
>8       string          RB40             RBS Song file
>>29     string          ReBorn           created by ReBorn
>>37     string          Propellerhead    created by ReBirth
>
># Synthesizer Generator and Kimwitu share their file format
>0	string		A#S#C#S#S#L#V#3	    Synthesizer Generator or Kimwitu data
># Kimwitu++ uses a slightly different magic
>0	string		A#S#C#S#S#L#HUB	    Kimwitu++ data
>
># From "Simon Hosie
>0       string  TFMX-SONG       TFMX module sound data
>
># From danny.milo@gmx.net (Danny Milosavljevic)
># monkeysaudio for magic.mime
>0	string	MAC\	X/Monkey audio,
>>4	leshort >0	version %d,
>>6	leshort >0	compression level %d,
>>8	leshort >0	flags %x,
>>10	leshort >0	channels %d,
>>12	lelong	>0	samplerate %d,
>>24	lelong	>0	frames %d
>
># adlib sound files
># From GÃ¼rkan SengÃ¼n <gurkan@linuks.mine.nu>, http://www.linuks.mine.nu
>0    	string		RAWADATA	RdosPlay RAW
>
>1068	string		RoR		AMUSIC Adlib Tracker
>
>0	string		JCH		EdLib
>
>0	string		mpu401tr	MPU-401 Trakker
>
>0	string		SAdT		Surprise! Adlib Tracker
>>4	byte		x		Version %d
>
>0	string		XAD!		eXotic ADlib
>
>0	string		ofTAZ!		eXtra Simple Music
>#------------------------------------------------------------------------------
># bFLT: file(1) magic for BFLT uclinux binary files
>#
># From Philippe De Muyter <phdm@macqel.be>
>#
>0	string		bFLT		BFLT executable
>>4	belong		x		- version %ld
>>4	belong		4
>>>36	belong&0x1	0x1		ram
>>>36	belong&0x2	0x2		gotpic
>>>36	belong&0x4	0x4		gzip
>>>36	belong&0x8	0x8		gzdata
>#------------------------------------------------------------------------------
># blender: file(1) magic for Blender 3D data files
>#
># Coded by Guillermo S. Romero <gsromero@alumnos.euitt.upm.es> using the
># data from Ton Roosendaal <ton@blender.nl>. Ton or his company do not
># support the rule, so mail GSR if problems with it. Rule version: 1.1.
># You can get latest version with comments and details about the format
># at http://acd.asoc.euitt.upm.es/~gsromero/3d/blender/magic.blender
>
>0	string	=BLENDER	Blender3D,
>>7	string	=_		saved as 32-bits
>>7      string	=-		saved as 64-bits
>>8	string	=v		little endian
>>8	string	=V		big endian
>>9	byte	x		with version %c.
>>10	byte	x		\b%c
>>11	byte	x		\b%c
>
>#------------------------------------------------------------------------------
># blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
>#
># Note that this 0407 conflicts with several other a.out formats...
>#
># XXX - should this be redone with "be" and "le", so that it works on
># little-endian machines as well?  If so, what's the deal with
># "VAX-order" and "VAX-order2"?
>#
>#0	long		0407		68K Blit (standalone) executable
>#0	short		0407		VAX-order2 68K Blit (standalone) executable
>0	short		03401		VAX-order 68K Blit (standalone) executable
>0	long		0406		68k Blit mpx/mux executable
>0	short		0406		VAX-order2 68k Blit mpx/mux executable
>0	short		03001		VAX-order 68k Blit mpx/mux executable
># Need more values for WE32 DMD executables.
># Note that 0520 is the same as COFF
>#0	short		0520		tty630 layers executable
>#
># i80960 b.out objects and archives
>#
>0	long		0x10d		i960 b.out relocatable object
>>16	long		>0		not stripped
>#
># b.out archive (hp-rt on i960)
>0	string		=!<bout>	b.out archive
>>8	string		__.SYMDEF	random library
>#------------------------------------------------------------------------------
># bsdi:  file(1) magic for BSD/OS (from BSDI) objects
>#
>
>0	lelong		0314		386 compact demand paged pure executable
>>16	lelong		>0		not stripped
>>32	byte		0x6a		(uses shared libs)
>
>0	lelong		0407		386 executable
>>16	lelong		>0		not stripped
>>32	byte		0x6a		(uses shared libs)
>
>0	lelong		0410		386 pure executable
>>16	lelong		>0		not stripped
>>32	byte		0x6a		(uses shared libs)
>
>0	lelong		0413		386 demand paged pure executable
>>16	lelong		>0		not stripped
>>32	byte		0x6a		(uses shared libs)
>
># same as in SunOS 4.x, except for static shared libraries
>0	belong&077777777	0600413		SPARC demand paged
>>0	byte		&0x80
>>>20	belong		<4096		shared library
>>>20	belong		=4096		dynamically linked executable
>>>20	belong		>4096		dynamically linked executable
>>0	byte		^0x80		executable
>>16	belong		>0		not stripped
>>36	belong		0xb4100001	(uses shared libs)
>
>0	belong&077777777	0600410		SPARC pure
>>0	byte		&0x80		dynamically linked executable
>>0	byte		^0x80		executable
>>16	belong		>0		not stripped
>>36	belong		0xb4100001	(uses shared libs)
>
>0	belong&077777777	0600407		SPARC
>>0	byte		&0x80		dynamically linked executable
>>0	byte		^0x80		executable
>>16	belong		>0		not stripped
>>36	belong		0xb4100001	(uses shared libs)
>
>#------------------------------------------------------------------------------
># autocad:  file(1) magic for cad files
>#
>
># AutoCAD DWG versions R13/R14 (www.autodesk.com)
># Written December 01, 2003 by Lester Hightower
># Based on the DWG File Format Specifications at http://www.opendwg.org/
>0	string	       \101\103\061\060\061		   AutoCAD
>>5	string	       \062\000\000\000\000		   DWG ver. R13
>>5	string	       \064\000\000\000\000		   DWG ver. R14
>
># Microstation DGN/CIT Files (www.bentley.com)
># Written October 30, 2003 by Lester Hightower
># DGN is the default file extension of Microstation/Intergraph CAD files.
># CIT is the proprietary raster format (similar to TIFF) used to attach
># raster underlays to Microstation DGN (vector) drawings.
># 
># http://www.wotsit.org/search.asp
># http://filext.com/detaillist.php?extdetail=DGN
># http://filext.com/detaillist.php?extdetail=CIT
>#
># http://www.bentley.com/products/default.cfm?objectid=97F351F5-9C35-4E5E-89C2
># 3F86C928&method=display&p_objectid=97F351F5-9C35-4E5E-89C280A93F86C928
># http://www.bentley.com/products/default.cfm?objectid=A5C2FD43-3AC9-4C71-B682
># 721C479F&method=display&p_objectid=A5C2FD43-3AC9-4C71-B682C7BE721C479F
>0	string	       \010\011\376			   Microstation
>>3	string	       \002
>>>30	string	       \372\104				   DGN File
>>>30	string	       \172\104				   DGN File
>>>30	string	       \026\105				   DGN File
>>4	string	       \030\000\000			   CIT File
>
># AutoCad, from Nahuel Greco
>0	string AC1012	AutoCad (release 12)
>0	string AC1014	AutoCad (release 14)
>
>#------------------------------------------------------------------------------
># c-lang:  file(1) magic for C programs (or REXX)
>#
>
># XPM icons (Greg Roelofs, newt@uchicago.edu)
># if you uncomment "/*" for C/REXX below, also uncomment this entry
>#0	string		/*\ XPM\ */	X pixmap image data
>
># this first will upset you if you're a PL/1 shop...
># in which case rm it; ascmagic will catch real C programs
>#0	string		/*		C or REXX program text
>#0	string		//		C++ program text
>
># From: Mikhail Teterin <mi@aldan.algebra.com> 
>0	string		cscope		cscope reference data
>>7	string		x		version %.2s
># We skip the path here, because it is often long (so file will
># truncate it) and mostly redundant.
># The inverted index functionality was added some time betwen
># versions 11 and 15, so look for -q if version is above 14:
>>7	string		>14
>>>10	regex		.+\ -q\		with inverted index
>>10	regex		.+\ -c\		text (non-compressed)
>
>#------------------------------------------------------------------------------
># c64:  file(1) magic for various commodore 64 related files
>#
># From <doj@cubic.org>
>
>0x16500	belong		0x12014100	D64 Image
>0x16500	belong		0x12014180	D71 Image
>0x61800 belong		0x28034400	D81 Image
>0	string		C64\40CARTRIDGE	CCS C64 Emultar Cartridge Image
>0	belong		0x43154164	X64 Image
>
>0	string		GCR-1541	GCR Image
>>8	byte		x		version: $i
>>9	byte		x		tracks: %i
>
>9	string		PSUR		ARC archive (c64)
>2	string		-LH1-		LHA archive (c64)
>
>0	string		C64File		PC64 Emulator file
>>8	string		>\0		"%s"
>0	string		C64Image	PC64 Freezer Image
>
>0	beshort		0x38CD		C64 PCLink Image
>0	string		CBM\144\0\0	Power 64 C64 Emulator Snapshot
>
>0	belong		0xFF424CFF	WRAptor packer (c64)
>
>#------------------------------------------------------------------------------
># CDDB: file(1) magic for CDDB(tm) format CD text data files
>#
># From <steve@gracenote.com>
>#
># This is the /etc/magic entry to decode datafiles as used by
># CDDB-enabled CD player applications.
>#
>
>0       string/b        #\040xmcd               CDDB(tm) format CD text data
>
>#------------------------------------------------------------------------------
># chi:  file(1) magic for ChiWriter files
>#
>0       string          \\1cw\          ChiWriter file
>>5      string          >\0             version %s
>0       string          \\1cw           ChiWriter file
>
>#------------------------------------------------------------------------------
># chord: file(1) magic for Chord music sheet typesetting utility input files
>#
># From Philippe De Muyter <phdm@macqel.be>
># File format is actually free, but many distributed files begin with `{title'
>#
>0	string		{title		Chord text file
>
>#------------------------------------------------------------------------------
># cisco:  file(1) magic for cisco Systems routers
>#
># Most cisco file-formats are covered by the generic elf code
>#
># Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
>0	belong&0xffffff00	0x85011400  cisco IOS microcode
>>7	string		>\0		    for '%s'
>0	belong&0xffffff00	0x8501cb00  cisco IOS experimental microcode
>>7	string		>\0		    for '%s'
>#------------------------------------------------------------------------------
># citrus locale declaration
>#
>
>0	string		RuneCT		Citrus locale declaration for LC_CTYPE
>
>
>#------------------------------------------------------------------------------
># claris:  file(1) magic for claris
># "H. Nanosecond" <aldomel@ix.netcom.com>
># Claris Works a word processor, etc.
># Version 3.0
>
># .pct claris works clip art files
>#0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
>#*
>#0001000 #010 250 377 377 377 377 000 213 000 230 000 021 002 377 014 000
>#null to byte 1000 octal
>514	string	\377\377\377\377\000	Claris clip art?
>>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	yes.
>514	string	\377\377\377\377\001	Claris clip art?
>>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0	yes.
>
># Claris works files
># .cwk
>0	string	\002\000\210\003\102\117\102\117\000\001\206 Claris works document
># .plt
>0	string	\020\341\000\000\010\010	Claris Works pallete files .plt
>
># .msp a dictionary file I am not sure about this I have only one .msp file
>0	string	\002\271\262\000\040\002\000\164	Claris works dictionary
>
># .usp are user dictionary bits
># I am not sure about a magic header:
>#0000000 001 123 160 146 070 125 104 040 136 123 015 012 160 157 144 151
>#        soh   S   p   f   8   U   D  sp   ^   S  cr  nl   p   o   d   i
>#0000020 141 164 162 151 163 164 040 136 123 015 012 144 151 166 040 043
>#          a   t   r   i   s   t  sp   ^   S  cr  nl   d   i   v  sp   #
>
># .mth Thesaurus
># starts with \0 but no magic header
>
># .chy Hyphenation file
># I am not sure: 000 210 034 000 000
>
># other claris files
>#./windows/claris/useng.ndx: data
>#./windows/claris/xtndtran.l32: data
>#./windows/claris/xtndtran.lst: data
>#./windows/claris/clworks.lbl: data
>#./windows/claris/clworks.prf: data
>#./windows/claris/userd.spl: data
>
>#------------------------------------------------------------------------------
># clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
>#
># XXX - what byte order does the Clipper use?
>#
># XXX - what's the "!" stuff:
>#
># >18	short		!074000,000000	C1 R1 
># >18	short		!074000,004000	C2 R1
># >18	short		!074000,010000	C3 R1
># >18	short		!074000,074000	TEST
>#
># I shall assume it's ANDing the field with the first value and
># comparing it with the second, and rewrite it as:
>#
># >18	short&074000	000000		C1 R1 
># >18	short&074000	004000		C2 R1
># >18	short&074000	010000		C3 R1
># >18	short&074000	074000		TEST
>#
># as SVR3.1's "file" doesn't support anything of the "!074000,000000"
># sort, nor does SunOS 4.x, so either it's something Intergraph added
># in CLIX, or something AT&T added in SVR3.2 or later, or something
># somebody else thought was a good idea; it's not documented in the
># man page for this version of "magic", nor does it appear to be
># implemented (at least not after I blew off the bogus code to turn
># old-style "&"s into new-style "&"s, which just didn't work at all).
>#
>0	short		0575		CLIPPER COFF executable (VAX #)
>>20	short		0407		(impure)
>>20	short		0410		(5.2 compatible)
>>20	short		0411		(pure)
>>20	short		0413		(demand paged)
>>20	short		0443		(target shared library)
>>12	long		>0		not stripped
>>22	short		>0		- version %ld
>0	short		0577		CLIPPER COFF executable
>>18	short&074000	000000		C1 R1 
>>18	short&074000	004000		C2 R1
>>18	short&074000	010000		C3 R1
>>18	short&074000	074000		TEST
>>20	short		0407		(impure)
>>20	short		0410		(pure)
>>20	short		0411		(separate I&D)
>>20	short		0413		(paged)
>>20	short		0443		(target shared library)
>>12	long		>0		not stripped
>>22	short		>0		- version %ld
>>48	long&01		01		alignment trap enabled
>>52	byte		1		-Ctnc
>>52	byte		2		-Ctsw
>>52	byte		3		-Ctpw
>>52	byte		4		-Ctcb
>>53	byte		1		-Cdnc
>>53	byte		2		-Cdsw
>>53	byte		3		-Cdpw
>>53	byte		4		-Cdcb
>>54	byte		1		-Csnc
>>54	byte		2		-Cssw
>>54	byte		3		-Cspw
>>54	byte		4		-Cscb
>4	string		pipe		CLIPPER instruction trace
>4	string		prof		CLIPPER instruction profile
>
>#------------------------------------------------------------------------------
># spec:  file(1) magic for SPEC raw results (*.raw, *.rsf)
>#
># Cloyce D. Spradling <cloyce@headgear.org>
>
>0	string	spec			SPEC
>>4	string	.cpu			CPU
>>>8	string	<:			\b%.4s
>>>12	string	.			raw result text
>
>17	string	version=SPECjbb		SPECjbb
>>32	string	<:			\b%.4s
>>>37	string	<:			v%.4s raw result text
>
>0	string	BEGIN\040SPECWEB	SPECweb
>>13	string	<:			\b%.2s
>>>15	string	_SSL			\b_SSL
>>>>20	string	<:			v%.4s raw result text
>>>16	string	<:			v%.4s raw result text
>
>#------------------------------------------------------------------------------
># commands:  file(1) magic for various shells and interpreters
>#
>0	string		:			shell archive or script for antique kernel text
>0	string/b	#!\ /bin/sh		Bourne shell script text
>0	string/b	#!\ /bin/csh		C shell script text
># korn shell magic, sent by George Wu, gwu@clyde.att.com
>0	string/b	#!\ /bin/ksh		Korn shell script text
>0	string/b 	#!\ /bin/tcsh		Tenex C shell script text
>0	string/b 	#!\ /usr/bin/tcsh	Tenex C shell script text
>0	string/b 	#!\ /usr/local/tcsh	Tenex C shell script text
>0	string/b	#!\ /usr/local/bin/tcsh	Tenex C shell script text
>
>#
># zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
>0	string/b	#!\ /bin/zsh		Paul Falstad's zsh script text
>0	string/b	#!\ /usr/bin/zsh	Paul Falstad's zsh script text
>0	string/b	#!\ /usr/local/bin/zsh	Paul Falstad's zsh script text
>0	string/b	#!\ /usr/local/bin/ash	Neil Brown's ash script text
>0	string/b	#!\ /usr/local/bin/ae	Neil Brown's ae script text
>0	string/b	#!\ /bin/nawk		new awk script text
>0	string/b	#!\ /usr/bin/nawk	new awk script text
>0	string/b	#!\ /usr/local/bin/nawk	new awk script text
>0	string/b	#!\ /bin/gawk		GNU awk script text
>0	string/b	#!\ /usr/bin/gawk	GNU awk script text
>0	string/b	#!\ /usr/local/bin/gawk	GNU awk script text
>#
>0	string/b	#!\ /bin/awk		awk script text
>0	string/b	#!\ /usr/bin/awk	awk script text
>0	string		BEGIN			awk script text
>
># AT&T Bell Labs' Plan 9 shell
>0	string/b	#!\ /bin/rc	Plan 9 rc shell script text
>
># bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
>0	string/b	#!\ /bin/bash		Bourne-Again shell script text
>0	string/b	#!\ /usr/bin/bash	Bourne-Again shell script text
>0	string/b	#!\ /usr/local/bash	Bourne-Again shell script text
>0	string/b	#!\ /usr/local/bin/bash	Bourne-Again shell script text
>
># using env
>0	string		#!/usr/bin/env		a
>>15	string		>\0			%s script text
>0	string		#!\ /usr/bin/env	a
>>16	string		>\0			%s script text
>
># PHP scripts
># Ulf Harnhammar <ulfh@update.uu.se>
>0	string/c	=<?php			PHP script text
>0	string		=<?\n			PHP script text
>0	string		=<?\r			PHP script text
>0	string/b	#!\ /usr/local/bin/php	PHP script text
>0	string/b	#!\ /usr/bin/php	PHP script text
>
>0	string		Zend\x00		PHP script Zend Optimizer data
>
>#----------------------------------------------------------------------------
># communication
>
># TTCN is the Tree and Tabular Combined Notation described in ISO 9646-3.
># It is used for conformance testing of communication protocols.
># Added by W. Borgert <debacle@debian.org>.
>0	string		$Suite			TTCN Abstract Test Suite
>>&1	string		$SuiteId
>>>&1	string		>\n			%s
>>&2	string		$SuiteId
>>>&1	string		>\n			%s
>>&3	string		$SuiteId
>>>&1	string		>\n			%s
>
># MSC (message sequence charts) are a formal description technique,
># described in ITU-T Z.120, mainly used for communication protocols.
># Added by W. Borgert <debacle@debian.org>.
>0	string		mscdocument	Message Sequence Chart (document)
>0	string		msc		Message Sequence Chart (chart)
>0	string		submsc		Message Sequence Chart (subchart)
>
>#------------------------------------------------------------------------------
># compress:  file(1) magic for pure-compression formats (no archives)
>#
># compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
>#
># Formats for various forms of compressed data
># Formats for "compress" proper have been moved into "compress.c",
># because it tries to uncompress it to figure out what's inside.
>
># standard unix compress
>0	string		\037\235	compress'd data
>>2	byte&0x80	>0		block compressed
>>2	byte&0x1f	x		%d bits
>
># gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
>#   Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
>#	* Original filename is only at offset 10 if "extra field" absent
>#	* Produce shorter output - notably, only report compression methods
>#	  other than 8 ("deflate", the only method defined in RFC 1952).
>0       string          \037\213        gzip compressed data
>>2	byte		<8		\b, reserved method
>>2	byte		>8		\b, unknown method
>>3	byte		&0x01		\b, ASCII
>>3	byte		&0x02		\b, continuation
>>3	byte		&0x04		\b, extra field
>>3	byte&0xC	=0x08
>>>10	string		x		\b, was "%s"
>>9	byte		=0x00		\b, from MS-DOS
>>9	byte		=0x01		\b, from Amiga
>>9	byte		=0x02		\b, from VMS
>>9	byte		=0x03		\b, from Unix
>>9	byte		=0x05		\b, from Atari
>>9	byte		=0x06		\b, from OS/2
>>9	byte		=0x07		\b, from MacOS
>>9	byte		=0x0A		\b, from Tops/20
>>9	byte		=0x0B		\b, from Win/32
>>3	byte		&0x10		\b, comment
>>3	byte		&0x20		\b, encrypted
>### >4	ledate		x		last modified: %s,
>>8	byte		2		\b, max compression
>>8	byte		4		\b, max speed
>
># packed data, Huffman (minimum redundancy) codes on a byte-by-byte basis
>0	string		\037\036	packed data
>>2	belong		>1		\b, %d characters originally
>>2	belong		=1		\b, %d character originally
>#
># This magic number is byte-order-independent.
>0	short		0x1f1f		old packed data
>
># XXX - why *two* entries for "compacted data", one of which is
># byte-order independent, and one of which is byte-order dependent?
>#
>0	short		0x1fff		compacted data
># This string is valid for SunOS (BE) and a matching "short" is listed
># in the Ultrix (LE) magic file.
>0	string		\377\037	compacted data
>0	short		0145405		huf output
>
># bzip2
>0	string		BZh		bzip2 compressed data
>>3	byte		>47		\b, block size = %c00k
>
># squeeze and crunch
># Michael Haardt <michael@cantor.informatik.rwth-aachen.de>
>0	beshort		0x76FF		squeezed data,
>>4	string		x		original name %s
>0	beshort		0x76FE		crunched data,
>>2	string		x		original name %s
>0	beshort		0x76FD		LZH compressed data,
>>2	string		x		original name %s
>
># Freeze
>0	string		\037\237	frozen file 2.1
>0	string		\037\236	frozen file 1.0 (or gzip 0.5)
>
># SCO compress -H (LZH)
>0	string		\037\240	SCO compress -H (LZH) data
>
># European GSM 06.10 is a provisional standard for full-rate speech
># transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
># excitation/long term prediction) coding at 13 kbit/s.
>#
># There's only a magic nibble (4 bits); that nibble repeats every 33
># bytes.  This isn't suited for use, but maybe we can use it someday.
>#
># This will cause very short GSM files to be declared as data and
># mismatches to be declared as data too!
>#0	byte&0xF0	0xd0		data
>#>33	byte&0xF0	0xd0
>#>66	byte&0xF0	0xd0
>#>99	byte&0xF0	0xd0
>#>132	byte&0xF0	0xd0		GSM 06.10 compressed audio
>
># bzip	a block-sorting file compressor
>#	by Julian Seward <sewardj@cs.man.ac.uk> and others
>#
>0	string		BZ		bzip compressed data
>>2	byte		x		\b, version: %c
>>3	string		=1		\b, compression block size 100k
>>3	string		=2		\b, compression block size 200k
>>3	string		=3		\b, compression block size 300k
>>3	string		=4		\b, compression block size 400k
>>3	string		=5		\b, compression block size 500k
>>3	string		=6		\b, compression block size 600k
>>3	string		=7		\b, compression block size 700k
>>3	string		=8		\b, compression block size 800k
>>3	string		=9		\b, compression block size 900k
>
># lzop from <markus.oberhumer@jk.uni-linz.ac.at>
>0	string		\x89\x4c\x5a\x4f\x00\x0d\x0a\x1a\x0a	lzop compressed data
>>9	beshort		<0x0940
>>>9	byte&0xf0	=0x00		- version 0.
>>>9	beshort&0x0fff	x		\b%03x,
>>>13	byte		1		LZO1X-1,
>>>13	byte		2		LZO1X-1(15),
>>>13	byte		3		LZO1X-999,
>## >>22	bedate		>0		last modified: %s,
>>>14	byte		=0x00		os: MS-DOS
>>>14	byte		=0x01		os: Amiga
>>>14	byte		=0x02		os: VMS
>>>14	byte		=0x03		os: Unix
>>>14	byte		=0x05		os: Atari
>>>14	byte		=0x06		os: OS/2
>>>14	byte		=0x07		os: MacOS
>>>14	byte		=0x0A		os: Tops/20
>>>14	byte		=0x0B		os: WinNT
>>>14	byte		=0x0E		os: Win32
>>9	beshort		>0x0939
>>>9	byte&0xf0	=0x00		- version 0.
>>>9	byte&0xf0	=0x10		- version 1.
>>>9	byte&0xf0	=0x20		- version 2.
>>>9	beshort&0x0fff	x		\b%03x,
>>>15	byte		1		LZO1X-1,
>>>15	byte		2		LZO1X-1(15),
>>>15	byte		3		LZO1X-999,
>## >>25	bedate		>0		last modified: %s,
>>>17	byte		=0x00		os: MS-DOS
>>>17	byte		=0x01		os: Amiga
>>>17	byte		=0x02		os: VMS
>>>17	byte		=0x03		os: Unix
>>>17	byte		=0x05		os: Atari
>>>17	byte		=0x06		os: OS/2
>>>17	byte		=0x07		os: MacOS
>>>17	byte		=0x0A		os: Tops/20
>>>17	byte		=0x0B		os: WinNT
>>>17	byte		=0x0E		os: Win32
>
># 4.3BSD-Quasijarus Strong Compression
># http://minnie.tuhs.org/Quasijarus/compress.html
>0	string		\037\241	Quasijarus strong compressed data
>
># From: Cory Dikkers <cdikkers@swbell.net>
>0	string		XPKF		Amiga xpkf.library compressed data
>0	string		PP11		Power Packer 1.1 compressed data
>0	string		PP20		Power Packer 2.0 compressed data,
>>4	belong		0x09090909	fast compression
>>4	belong		0x090A0A0A	mediocre compression
>>4	belong		0x090A0B0B	good compression
>>4	belong		0x090A0C0C	very good compression
>>4	belong		0x090A0C0D	best compression
>
># 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
># http://www.7-zip.org or DOC/7zFormat.txt 
>#
>0	string		7z\274\257\047\034	7-zip archive data,
>>6	byte		x			version %d
>>7	byte		x			\b.%d
>
># AFX compressed files (Wolfram Kleff)
>2	string		-afx-		AFX compressed file data
>#------------------------------------------------------------------------------
># Console game magic
># Toby Deshane <hac@shoelace.digivill.net>
>#    ines:  file(1) magic for Marat's iNES Nintendo Entertainment System
>#           ROM dump format
>
>0 string NES\032 iNES ROM dump,
>>4 byte  x     %dx16k PRG
>>5 byte  x     \b, %dx8k CHR
>>6 byte&0x01  =0x1  \b, [Vert.]
>>6 byte&0x01  =0x0  \b, [Horiz.]
>>6 byte&0x02  =0x2  \b, [SRAM]
>>6 byte&0x04  =0x4  \b, [Trainer]
>>6 byte&0x04  =0x8  \b, [4-Scr]
>
>#------------------------------------------------------------------------------
># gameboy:  file(1) magic for the Nintendo (Color) Gameboy raw ROM format
>#
>0x104 belong 0xCEED6666 Gameboy ROM:
>>0x134 string >\0 "%.16s"
>>0x146 byte 0x03  \b,[SGB]
>>0x147 byte 0x00  \b, [ROM ONLY]
>>0x147 byte 0x01  \b, [ROM+MBC1]
>>0x147 byte 0x02  \b, [ROM+MBC1+RAM]
>>0x147 byte 0x03  \b, [ROM+MBC1+RAM+BATT]
>>0x147 byte 0x05  \b, [ROM+MBC2]
>>0x147 byte 0x06  \b, [ROM+MBC2+BATTERY]
>>0x147 byte 0x08  \b, [ROM+RAM]
>>0x147 byte 0x09  \b, [ROM+RAM+BATTERY]
>>0x147 byte 0x0B  \b, [ROM+MMM01]
>>0x147 byte 0x0C  \b, [ROM+MMM01+SRAM]
>>0x147 byte 0x0D  \b, [ROM+MMM01+SRAM+BATT]
>>0x147 byte 0x0F  \b, [ROM+MBC3+TIMER+BATT]
>>0x147 byte 0x10  \b, [ROM+MBC3+TIMER+RAM+BATT]
>>0x147 byte 0x11  \b, [ROM+MBC3]
>>0x147 byte 0x12  \b, [ROM+MBC3+RAM]
>>0x147 byte 0x13  \b, [ROM+MBC3+RAM+BATT]
>>0x147 byte 0x19  \b, [ROM+MBC5]
>>0x147 byte 0x1A  \b, [ROM+MBC5+RAM]
>>0x147 byte 0x1B  \b, [ROM+MBC5+RAM+BATT]
>>0x147 byte 0x1C  \b, [ROM+MBC5+RUMBLE]
>>0x147 byte 0x1D  \b, [ROM+MBC5+RUMBLE+SRAM]
>>0x147 byte 0x1E  \b, [ROM+MBC5+RUMBLE+SRAM+BATT]
>>0x147 byte 0x1F  \b, [Pocket Camera]
>>0x147 byte 0xFD  \b, [Bandai TAMA5]
>>0x147 byte 0xFE  \b, [Hudson HuC-3]
>>0x147 byte 0xFF  \b, [Hudson HuC-1]
>
>>0x148 byte 0     \b, ROM: 256Kbit
>>0x148 byte 1     \b, ROM: 512Kbit
>>0x148 byte 2     \b, ROM: 1Mbit
>>0x148 byte 3     \b, ROM: 2Mbit
>>0x148 byte 4     \b, ROM: 4Mbit
>>0x148 byte 5     \b, ROM: 8Mbit
>>0x148 byte 6     \b, ROM: 16Mbit
>>0x148 byte 0x52  \b, ROM: 9Mbit
>>0x148 byte 0x53  \b, ROM: 10Mbit
>>0x148 byte 0x54  \b, ROM: 12Mbit
>
>>0x149 byte 1     \b, RAM: 16Kbit
>>0x149 byte 2     \b, RAM: 64Kbit
>>0x149 byte 3     \b, RAM: 128Kbit
>>0x149 byte 4     \b, RAM: 1Mbit
>
>#>0x14e long  x     \b, CRC: %x
>
>#------------------------------------------------------------------------------
># genesis:  file(1) magic for the Sega MegaDrive/Genesis raw ROM format
>#
>0x100 string SEGA  Sega MegaDrive/Genesis raw ROM dump
>>0x120 string >\0 Name: "%.16s"
>>0x110 string >\0 %.16s
>>0x1B0 string RA with SRAM
>
>#------------------------------------------------------------------------------
># genesis:  file(1) magic for the Super MegaDrive ROM dump format
>#
>0x280 string EAGN  Super MagicDrive ROM dump
>>0 byte x %dx16k blocks
>>2 byte 0 \b, last in series or standalone
>>2 byte >0 \b, split ROM
>>8 byte 0xAA
>>9 byte 0xBB
>
>#------------------------------------------------------------------------------
># genesis:  file(1) alternate magic for the Super MegaDrive ROM dump format
>#
>0x280 string EAMG  Super MagicDrive ROM dump
>>0 byte x %dx16k blocks
>>2 byte x \b, last in series or standalone
>>8 byte 0xAA
>>9 byte 0xBB
>
>#------------------------------------------------------------------------------
># smsgg:  file(1) magic for Sega Master System and Game Gear ROM dumps
>#
># Does not detect all images.  Very preliminary guesswork.  Need more data
># on format.
>#
># FIXME: need a little more info...;P
>#
>#0 byte 0xF3
>#>1 byte 0xED  Sega Master System/Game Gear ROM dump
>#>1 byte 0x31  Sega Master System/Game Gear ROM dump
>#>1 byte 0xDB  Sega Master System/Game Gear ROM dump
>#>1 byte 0xAF  Sega Master System/Game Gear ROM dump
>#>1 byte 0xC3  Sega Master System/Game Gear ROM dump
>
>#------------------------------------------------------------------------------
># dreamcast:  file(1) uncertain magic for the Sega Dreamcast VMU image format
>#
>0 belong 0x21068028   Sega Dreamcast VMU game image
>0 string LCDi         Dream Animator file
>
>#------------------------------------------------------------------------------
># v64: file(1) uncertain magic for the V64 format N64 ROM dumps
>#
>0 belong 0x37804012    V64 Nintendo 64 ROM dump
>
>#------------------------------------------------------------------------------
># msx: file(1) magic for MSX game cartridge dumps
># Too simple - MPi
>#0 beshort 0x4142 MSX game cartridge dump 
>
>#------------------------------------------------------------------------------
># Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
>0	string	PS-X\ EXE	Sony Playstation executable
>#  Area:
>>113	string	x		(%s)
>
>#------------------------------------------------------------------------------
># Microsoft Xbox executables .xbe (Esa HyytiÃ¤ <ehyytia@cc.hut.fi>)
>0       string          XBEH            XBE, Microsoft Xbox executable
># probabilistic checks whether signed or not
>>0x0004 ulelong =0x0
>>>&2    ulelong =0x0
>>>>&2   ulelong =0x0  \b, not signed
>>0x0004 ulelong >0
>>>&2    ulelong >0
>>>>&2   ulelong >0    \b, signed
># expect base address of 0x10000
>>0x0104               ulelong =0x10000
>>>(0x0118-0x0FF60)    ulelong&0x80000007  0x80000007 \b, all regions
>>>(0x0118-0x0FF60)    ulelong&0x80000007  !0x80000007
>>>>(0x0118-0x0FF60)   ulelong >0           (regions:
>>>>>(0x0118-0x0FF60)  ulelong &0x00000001  NA
>>>>>(0x0118-0x0FF60)  ulelong &0x00000002  Japan
>>>>>(0x0118-0x0FF60)  ulelong &0x00000004  Rest_of_World
>>>>>(0x0118-0x0FF60)  ulelong &0x80000000  Manufacturer
>>>>(0x0118-0x0FF60)   ulelong >0           \b)
>
># --------------------------------
># Microsoft Xbox data file formats
>0       string          XIP0            XIP, Microsoft Xbox data
>0       string          XTF0            XTF, Microsoft Xbox data
>
># Atari Lynx cartridge dump (EXE/BLL header)
># From: "Stefan A. Haubenthal" <polluks@web.de>
>
>0	beshort		0x8008		Lynx cartridge,
>>2	beshort		x		RAM start $%04x
>>6	string		BS93
>
>
>
>
>#------------------------------------------------------------------------------
># convex:  file(1) magic for Convex boxes
>#
># Convexes are big-endian.
>#
># /*\
>#  * Below are the magic numbers and tests added for Convex.
>#  * Added at beginning, because they are expected to be used most.
># \*/
>0	belong	0507	Convex old-style object
>>16	belong	>0	not stripped
>0	belong	0513	Convex old-style demand paged executable
>>16	belong	>0	not stripped
>0	belong	0515	Convex old-style pre-paged executable
>>16	belong	>0	not stripped
>0	belong	0517	Convex old-style pre-paged, non-swapped executable
>>16	belong	>0	not stripped
>0	belong	0x011257	Core file
>#
># The following are a series of dump format magic numbers.  Each one
># corresponds to a drastically different dump format.  The first on is
># the original dump format on a 4.1 BSD or earlier file system.  The
># second marks the change between the 4.1 file system and the 4.2 file
># system.  The Third marks the changing of the block size from 1K
># to 2K to be compatible with an IDC file system.  The fourth indicates
># a dump that is dependent on Convex Storage Manager, because data in
># secondary storage is not physically contained within the dump.
># The restore program uses these number to determine how the data is
># to be extracted.
>#
>24	belong	=60011	dump format, 4.1 BSD or earlier
>24	belong	=60012	dump format, 4.2 or 4.3 BSD without IDC
>24	belong	=60013	dump format, 4.2 or 4.3 BSD (IDC compatible)
>24	belong	=60014	dump format, Convex Storage Manager by-reference dump
>#
># what follows is a bunch of bit-mask checks on the flags field of the opthdr.
># If there is no `=' sign, assume just checking for whether the bit is set?
>#
>0	belong	0601		Convex SOFF
>>88	belong&0x000f0000	=0x00000000	c1
>>88	belong			&0x00010000	c2
>>88	belong			&0x00020000	c2mp
>>88	belong			&0x00040000	parallel
>>88	belong			&0x00080000	intrinsic
>>88	belong			&0x00000001	demand paged
>>88	belong			&0x00000002	pre-paged
>>88	belong			&0x00000004	non-swapped
>>88	belong			&0x00000008	POSIX
>#
>>84	belong			&0x80000000	executable
>>84	belong			&0x40000000	object
>>84	belong&0x20000000	=0		not stripped
>>84	belong&0x18000000	=0x00000000	native fpmode
>>84	belong&0x18000000	=0x10000000	ieee fpmode
>>84	belong&0x18000000	=0x18000000	undefined fpmode
>#
>0	belong			0605		Convex SOFF core
>#
>0	belong			0607		Convex SOFF checkpoint
>>88	belong&0x000f0000	=0x00000000	c1
>>88	belong			&0x00010000	c2
>>88	belong			&0x00020000	c2mp
>>88	belong			&0x00040000	parallel
>>88	belong			&0x00080000	intrinsic
>>88	belong			&0x00000008	POSIX
>#
>>84	belong&0x18000000	=0x00000000	native fpmode
>>84	belong&0x18000000	=0x10000000	ieee fpmode
>>84	belong&0x18000000	=0x18000000	undefined fpmode
>
># ----------------------------------------------------------------------------
># ctags:  file (1) magic for Exuberant Ctags files
># From: Alexander Mai <mai@migdal.ikp.physik.tu-darmstadt.de>
>0       string  =!_TAG   Exuberant Ctags tag file text
>#------------------------------------------------------------------------------
># cracklib:  file (1) magic for cracklib v2.7
>
>0	lelong	0x70775631	Cracklib password index, little endian
>>4	long	>0		(%i words)
>>4	long	0		("64-bit")
>>>8	long	>-1		(%i words)
>0	belong	0x70775631	Cracklib password index, big endian
>>4	belong	>-1		(%i words)
>0	long	0
>>4	belong	0x70775631	Cracklib password index, big endian ("64-bit")
>>12	belong	>0		(%i words)
>
>#------------------------------------------------------------------------------
># dact:  file(1) magic for DACT compressed files
>#
>0	long		0x444354C3	DACT compressed data
>>4	byte		>-1		(version %i.
>>5	byte		>-1		$BS%i.
>>6	byte		>-1		$BS%i)
>>7	long		>0		$BS, original size: %i bytes
>>15	long		>30		$BS, block size: %i bytes
>
>#------------------------------------------------------------------------------
># database:  file(1) magic for various databases
>#
># extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
>#
>#
># GDBM magic numbers
>#  Will be maintained as part of the GDBM distribution in the future.
>#  <downsj@teeny.org>
>0	belong	0x13579ace	GNU dbm 1.x or ndbm database, big endian
>0	lelong	0x13579ace	GNU dbm 1.x or ndbm database, little endian
>0	string	GDBM		GNU dbm 2.x database
>#
># Berkeley DB
>#
># Ian Darwin's file /etc/magic files: big/little-endian version.
>#
># Hash 1.85/1.86 databases store metadata in network byte order.
># Btree 1.85/1.86 databases store the metadata in host byte order.
># Hash and Btree 2.X and later databases store the metadata in host byte order.
>
>0	long	0x00061561	Berkeley DB
>>8	belong	4321
>>>4	belong	>2		1.86
>>>4	belong	<3		1.85
>>>4	belong	>0		(Hash, version %d, native byte-order)
>>8	belong	1234
>>>4	belong	>2		1.86
>>>4	belong	<3		1.85
>>>4	belong	>0		(Hash, version %d, little-endian)
>
>0	belong	0x00061561	Berkeley DB
>>8	belong	4321
>>>4	belong	>2		1.86
>>>4	belong	<3		1.85
>>>4	belong	>0		(Hash, version %d, big-endian)
>>8	belong	1234
>>>4	belong	>2		1.86
>>>4	belong	<3		1.85
>>>4	belong	>0		(Hash, version %d, native byte-order)
>
>0	long	0x00053162	Berkeley DB 1.85/1.86
>>4	long	>0		(Btree, version %d, native byte-order)
>0	belong	0x00053162	Berkeley DB 1.85/1.86
>>4	belong	>0		(Btree, version %d, big-endian)
>0	lelong	0x00053162	Berkeley DB 1.85/1.86
>>4	lelong	>0		(Btree, version %d, little-endian)
>
>12	long	0x00061561	Berkeley DB
>>16	long	>0		(Hash, version %d, native byte-order)
>12	belong	0x00061561	Berkeley DB
>>16	belong	>0		(Hash, version %d, big-endian)
>12	lelong	0x00061561	Berkeley DB
>>16	lelong	>0		(Hash, version %d, little-endian)
>
>12	long	0x00053162	Berkeley DB
>>16	long	>0		(Btree, version %d, native byte-order)
>12	belong	0x00053162	Berkeley DB
>>16	belong	>0		(Btree, version %d, big-endian)
>12	lelong	0x00053162	Berkeley DB
>>16	lelong	>0		(Btree, version %d, little-endian)
>
>12	long	0x00042253	Berkeley DB
>>16	long	>0		(Queue, version %d, native byte-order)
>12	belong	0x00042253	Berkeley DB
>>16	belong	>0		(Queue, version %d, big-endian)
>12	lelong	0x00042253	Berkeley DB
>>16	lelong	>0		(Queue, version %d, little-endian)
>
># From Max Bowsher.
>12	long	0x00040988	Berkeley DB
>>16	long	>0		(Log, version %d, native byte-order)
>12	belong	0x00040988	Berkeley DB 
>>16	belong	>0		(Log, version %d, big-endian)
>12	lelong	0x00040988	Berkeley DB
>>16	lelong	>0		(Log, version %d, little-endian)
>
>#
>#
># Round Robin Database Tool by Tobias Oetiker <oetiker@ee.ethz.ch>
>0	string	RRD		RRDTool DB
>>4	string	x		version %s
>#----------------------------------------------------------------------
># ROOT: file(1) magic for ROOT databases
>#
>0       string  root\0  ROOT file
>>4      belong  x       Version %d
>>33     belong  x       (Compression: %d)
>
># XXX: Weak magic.
># Alex Ott <ott@jet.msk.su>
>## Paradox file formats
>#2	  leshort	0x0800	Paradox 
>#>0x39	  byte		3	v. 3.0 
>#>0x39	  byte		4	v. 3.5 
>#>0x39	  byte		9	v. 4.x 
>#>0x39	  byte		10	v. 5.x 
>#>0x39	  byte		11	v. 5.x 
>#>0x39	  byte		12	v. 7.x 
>#>>0x04	  byte		0	indexed .DB data file 
>#>>0x04	  byte		1	primary index .PX file 
>#>>0x04	  byte		2	non-indexed .DB data file 
>#>>0x04	  byte		3	non-incrementing secondary index .Xnn file 
>#>>0x04	  byte		4	secondary index .Ynn file 
>#>>0x04	  byte		5	incrementing secondary index .Xnn file 
>#>>0x04	  byte		6	non-incrementing secondary index .XGn file 
>#>>0x04	  byte		7	secondary index .YGn file 
>#>>>0x04	  byte		8	incrementing secondary index .XGn file 
>## XBase database files
>#0      byte       0x02	
>#>8     leshort	  >0
>#>>12   leshort    0	FoxBase 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0      byte       0x03	
>#>8     leshort	  >0
>#>>12   leshort    0	FoxBase+, FoxPro, dBaseIII+, dBaseIV, no memo 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0      byte       0x04	
>#>8     leshort	  >0
>#>>12   leshort    0	dBASE IV no memo file 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0      byte       0x05	
>#>8     leshort	  >0
>#>>12   leshort    0	dBASE V no memo file 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0      byte       0x30
>#>8     leshort	  >0
>#>>12   leshort    0	Visual FoxPro 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0      byte       0x43
>#>8     leshort	  >0
>#>>12   leshort    0	FlagShip with memo var size 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0      byte       0x7b
>#>8     leshort	  >0
>#>>12   leshort    0	dBASEIV with memo 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0      byte       0x83	
>#>8     leshort	  >0
>#>>12   leshort    0	FoxBase+, dBaseIII+ with memo 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0      byte       0x8b
>#>8     leshort	  >0
>#>>12   leshort    0	dBaseIV with memo 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0      byte       0x8e	
>#>8     leshort	  >0
>#>>12   leshort    0	dBaseIV with SQL Table 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0      byte       0xb3
>#>8     leshort	  >0
>#>>12   leshort    0	FlagShip with .dbt memo 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0      byte       0xf5
>#>8     leshort	  >0
>#>>12   leshort    0	FoxPro with memo 
>#>>>0x04	lelong		0		(no records)
>#>>>0x04	lelong		>0		(%ld records)
>#
>#0	leshort		0x0006		DBase 3 index file
>
># MS Access database
>4	  string	Standard\ Jet\ DB	Microsoft Access Database
>
># TDB database from Samba et al - Martin Pool <mbp@samba.org>
>0	string	TDB\ file		TDB database
>>32	lelong	0x2601196D		version 6, little-endian
>>>36	lelong	x			hash size %d bytes
>
># SE Linux policy database
>0       lelong  0xf97cff8c      SE Linux policy
>>16     lelong  x               v%d
>>20     lelong  1      MLS
>>24     lelong  x       %d symbols
>>28     lelong  x       %d ocons
>
># ICE authority file data (Wolfram Kleff)
>2	string		ICE		ICE authority data
>
># X11 Xauthority file (Wolfram Kleff)
>10	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
>11	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
>12	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
>13	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
>14	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
>15	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
>16	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
>17	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
>18	string		MIT-MAGIC-COOKIE-1	X11 Xauthority data
>
>#------------------------------------------------------------------------------
># diamond:  file(1) magic for Diamond system
>#
># ... diamond is a multi-media mail and electronic conferencing system....
>#
># XXX - I think it was either renamed Slate, or replaced by Slate....
>#
>#	The full deal is too long...
>#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
>0	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document
>
>#------------------------------------------------------------------------------
># diff:  file(1) magic for diff(1) output
>#
>0	string		diff\ 	'diff' output text
>0	string		***\ 		'diff' output text
>0	string		Only\ in\ 	'diff' output text
>0	string		Common\ subdirectories:\ 	'diff' output text
>#  Digital UNIX - Info
>#
>0	string	=!<arch>\n________64E	Alpha archive
>>22	string	X			-- out of date
>#
># Alpha COFF Based Executables
># The stripped stuff really needs to be an 8 byte (64 bit) compare,
># but this works
>0	leshort		0x183		COFF format alpha
>>22	leshort&020000	&010000		sharable library,
>>22	leshort&020000	^010000		dynamically linked,
>>24	leshort		0410		pure
>>24	leshort		0413		demand paged
>>8	lelong		>0		executable or object module, not stripped
>>8	lelong		0
>>>12	lelong		0		executable or object module, stripped
>>>12	lelong		>0		executable or object module, not stripped
>>27     byte            >0              - version %d.
>>26     byte            >0              %d-
>>28     leshort         >0              %d
>#
># The next is incomplete, we could tell more about this format,
># but its not worth it.
>0	leshort		0x188	Alpha compressed COFF
>0	leshort		0x18f	Alpha u-code object
>#
>#
># Some other interesting Digital formats,
>0	string	\377\377\177		ddis/ddif
>0	string	\377\377\174		ddis/dots archive
>0	string	\377\377\176		ddis/dtif table data
>0	string	\033c\033		LN03 output
>0	long	04553207		X image
>#
>0	string	=!<PDF>!\n		profiling data file
>#
># Locale data tables (MIPS and Alpha).
>#
>0	short		0x0501		locale data table
>>6	short		0x24		for MIPS
>>6	short		0x40		for Alpha
># ATSC A/53 aka AC-3 aka Dolby Digital <ashitaka@gmx.at>
># from http://www.atsc.org/standards/a_52a.pdf
># corrections, additions, etc. are always welcome!
>#
># syncword
>0       beshort         0x0b77  ATSC A/52 aka AC-3 aka Dolby Digital stream,
># fscod
>>4      byte&0xc0       0x00    48 kHz,
>>4      byte&0xc0       0x40    44.1 kHz,
>>4      byte&0xc0       0x80    32 kHz,
># is this one used for 96 kHz?
>>4      byte&0xc0       0xc0    reserved frequency,
>#
>>5	byte&7 = 0		\b, complete main (CM)
>>5	byte&7 = 1		\b, music and effects (ME)
>>5	byte&7 = 2		\b, visually impaired (VI)
>>5	byte&7 = 3		\b, hearing impaired (HI)
>>5	byte&7 = 4		\b, dialogue (D)
>>5	byte&7 = 5		\b, commentary (C)
>>5	byte&7 = 6		\b, emergency (E)
># acmod
>>6      byte&0xe0       0x00    1+1 front,
>>6      byte&0xe0       0x20    1 front/0 rear,
>>6      byte&0xe0       0x40    2 front/0 rear,
>>6      byte&0xe0       0x60    3 front/0 rear,
>>6      byte&0xe0       0x80    2 front/1 rear,
>>6      byte&0xe0       0xa0    3 front/1 rear,
>>6      byte&0xe0       0xc0    2 front/2 rear,
>>6      byte&0xe0       0xe0    3 front/2 rear,
># lfeon (these may be incorrect)
>>7      byte&0x40       0x00    LFE off,
>>7      byte&0x40       0x40    LFE on,
>#
>>4	byte&0x3e = 0x00	\b, 32 kbit/s
>>4	byte&0x3e = 0x02        \b, 40 kbit/s
>>4	byte&0x3e = 0x04        \b, 48 kbit/s
>>4	byte&0x3e = 0x06        \b, 56 kbit/s
>>4	byte&0x3e = 0x08        \b, 64 kbit/s
>>4	byte&0x3e = 0x0a        \b, 80 kbit/s
>>4	byte&0x3e = 0x0c        \b, 96 kbit/s
>>4	byte&0x3e = 0x0e        \b, 112 kbit/s
>>4	byte&0x3e = 0x10        \b, 128 kbit/s
>>4	byte&0x3e = 0x12        \b, 160 kbit/s
>>4	byte&0x3e = 0x14        \b, 192 kbit/s
>>4	byte&0x3e = 0x16        \b, 224 kbit/s
>>4	byte&0x3e = 0x18        \b, 256 kbit/s
>>4	byte&0x3e = 0x1a        \b, 320 kbit/s
>>4	byte&0x3e = 0x1c        \b, 384 kbit/s
>>4	byte&0x3e = 0x1e        \b, 448 kbit/s
>>4	byte&0x3e = 0x20        \b, 512 kbit/s
>>4	byte&0x3e = 0x22        \b, 576 kbit/s
>>4	byte&0x3e = 0x24        \b, 640 kbit/s
># dsurmod (these may be incorrect)
>>6      beshort&0x0180  0x0000  Dolby Surround not indicated
>>6      beshort&0x0180  0x0080  not Dolby Surround encoded
>>6      beshort&0x0180  0x0100  Dolby Surround encoded
>>6      beshort&0x0180  0x0180  reserved Dolby Surround mode
>
>#------------------------------------------------------------------------------
># dump:  file(1) magic for dump file format--for new and old dump filesystems
>#
># We specify both byte orders in order to recognize byte-swapped dumps.
>#
>24	belong	60012		new-fs dump file (big endian),
>>4	bedate	x		Previous dump %s,
>>8	bedate	x		This dump %s,
>>12	belong	>0		Volume %ld,
>>692	belong	0		Level zero, type:
>>692	belong	>0		Level %d, type:
>>0	belong	1		tape header,
>>0	belong	2		beginning of file record,
>>0	belong	3		map of inodes on tape,
>>0	belong	4		continuation of file record,
>>0	belong	5		end of volume,
>>0	belong	6		map of inodes deleted,
>>0	belong	7		end of medium (for floppy),
>>676	string	>\0		Label %s,
>>696	string	>\0		Filesystem %s,
>>760	string	>\0		Device %s,
>>824	string	>\0		Host %s,
>>888	belong	>0		Flags %x
>
>24	belong	60011		old-fs dump file (big endian),
>#>4	bedate	x		Previous dump %s,
>#>8	bedate	x		This dump %s,
>>12	belong	>0		Volume %ld,
>>692	belong	0		Level zero, type:
>>692	belong	>0		Level %d, type:
>>0	belong	1		tape header,
>>0	belong	2		beginning of file record,
>>0	belong	3		map of inodes on tape,
>>0	belong	4		continuation of file record,
>>0	belong	5		end of volume,
>>0	belong	6		map of inodes deleted,
>>0	belong	7		end of medium (for floppy),
>>676	string	>\0		Label %s,
>>696	string	>\0		Filesystem %s,
>>760	string	>\0		Device %s,
>>824	string	>\0		Host %s,
>>888	belong	>0		Flags %x
>
>24	lelong	60012		new-fs dump file (little endian),
>>4	ledate	x		This dump %s,
>>8	ledate	x		Previous dump %s,
>>12	lelong	>0		Volume %ld,
>>692	lelong	0		Level zero, type:
>>692	lelong	>0		Level %d, type:
>>0	lelong	1		tape header,
>>0	lelong	2		beginning of file record,
>>0	lelong	3		map of inodes on tape,
>>0	lelong	4		continuation of file record,
>>0	lelong	5		end of volume,
>>0	lelong	6		map of inodes deleted,
>>0	lelong	7		end of medium (for floppy),
>>676	string	>\0		Label %s,
>>696	string	>\0		Filesystem %s,
>>760	string	>\0		Device %s,
>>824	string	>\0		Host %s,
>>888	lelong	>0		Flags %x
>
>24	lelong	60011		old-fs dump file (little endian),
>#>4	ledate	x		Previous dump %s,
>#>8	ledate	x		This dump %s,
>>12	lelong	>0		Volume %ld,
>>692	lelong	0		Level zero, type:
>>692	lelong	>0		Level %d, type:
>>0	lelong	1		tape header,
>>0	lelong	2		beginning of file record,
>>0	lelong	3		map of inodes on tape,
>>0	lelong	4		continuation of file record,
>>0	lelong	5		end of volume,
>>0	lelong	6		map of inodes deleted,
>>0	lelong	7		end of medium (for floppy),
>>676	string	>\0		Label %s,
>>696	string	>\0		Filesystem %s,
>>760	string	>\0		Device %s,
>>824	string	>\0		Host %s,
>>888	lelong	>0		Flags %x
>
>#------------------------------------------------------------------------------
># T602 editor documents 
># by David Necas <yeti@physics.muni.cz>
>0	string	@CT\ 	T602 document data,
>>4	string	0	Kamenicky
>>4	string	1	CP 852
>>4	string	2	KOI8-CS
>>4	string	>2	unknown encoding
>
># Vi IMproved Encrypted file 
># by David Necas <yeti@physics.muni.cz>
>0	string	VimCrypt~	Vim encrypted file data
>
>#------------------------------------------------------------------------------
># elf:  file(1) magic for ELF executables
>#
># We have to check the byte order flag to see what byte order all the
># other stuff in the header is in.
>#
># What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
>#
># updated by Daniel Quinlan (quinlan@yggdrasil.com)
>0	string		\177ELF		ELF
>>4	byte		0		invalid class
>>4	byte		1		32-bit
># only for MIPS - in the future, the ABI field of e_flags should be used.
>>>18	leshort		8
>>>>36	lelong		&0x20		N32
>>>18	leshort		10
>>>>36	lelong		&0x20		N32
>>>18	beshort		8
>>>>36	belong		&0x20		N32
>>>18	beshort		10
>>>>36	belong		&0x20		N32
>>4	byte		2		64-bit
>>5	byte		0		invalid byte order
>>5	byte		1		LSB
># The official e_machine number for MIPS is now #8, regardless of endianness.
># The second number (#10) will be deprecated later. For now, we still
># say something if #10 is encountered, but only gory details for #8.
>>>18    leshort		8
># only for 32-bit
>>>>4	byte		1
>>>>>36  lelong&0xf0000000	0x00000000	MIPS-I
>>>>>36  lelong&0xf0000000	0x10000000	MIPS-II
>>>>>36  lelong&0xf0000000	0x20000000	MIPS-III
>>>>>36  lelong&0xf0000000	0x30000000	MIPS-IV
>>>>>36  lelong&0xf0000000	0x40000000	MIPS-V
>>>>>36  lelong&0xf0000000	0x60000000	MIPS32
>>>>>36  lelong&0xf0000000	0x70000000	MIPS64
>>>>>36  lelong&0xf0000000	0x80000000	MIPS32 rel2
>>>>>36  lelong&0xf0000000	0x90000000	MIPS64 rel2
># only for 64-bit
>>>>4	byte		2
>>>>>48  lelong&0xf0000000	0x00000000	MIPS-I
>>>>>48  lelong&0xf0000000	0x10000000	MIPS-II
>>>>>48  lelong&0xf0000000	0x20000000	MIPS-III
>>>>>48  lelong&0xf0000000	0x30000000	MIPS-IV
>>>>>48  lelong&0xf0000000	0x40000000	MIPS-V
>>>>>48  lelong&0xf0000000	0x60000000	MIPS32
>>>>>48  lelong&0xf0000000	0x70000000	MIPS64 
>>>>>48  lelong&0xf0000000	0x80000000	MIPS32 rel2
>>>>>48  lelong&0xf0000000	0x90000000	MIPS64 rel2
>>>16	leshort		0		no file type,
>>>16	leshort		1		relocatable,
>>>16	leshort		2		executable,
>>>16	leshort		3		shared object,
># Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
># corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
>>>16	leshort		4		core file
># Core file detection is not reliable.
>#>>>(0x38+0xcc) string	>\0		of '%s'
>#>>>(0x38+0x10) lelong	>0		(signal %d),
>>>16	leshort		&0xff00		processor-specific,
>>>18	leshort		0		no machine,
>>>18	leshort		1		AT&T WE32100 - invalid byte order,
>>>18	leshort		2		SPARC - invalid byte order,
>>>18	leshort		3		Intel 80386,
>>>18	leshort		4		Motorola
>>>>36	lelong		&0x01000000	68000 - invalid byte order,
>>>>36	lelong		&0x00810000	CPU32 - invalid byte order,
>>>>36	lelong		0		68020 - invalid byte order,
>>>18	leshort		5		Motorola 88000 - invalid byte order,
>>>18	leshort		6		Intel 80486,
>>>18	leshort		7		Intel 80860,
>>>18	leshort		8		MIPS,
>>>18	leshort		9		Amdahl - invalid byte order,
>>>18	leshort		10		MIPS (deprecated),
>>>18	leshort		11		RS6000 - invalid byte order,
>>>18	leshort		15		PA-RISC - invalid byte order,
>>>>50	leshort		0x0214		2.0
>>>>48	leshort		&0x0008		(LP64),
>>>18	leshort		16		nCUBE,
>>>18	leshort		17		Fujitsu VPP500,
>>>18	leshort		18		SPARC32PLUS,
>>>18	leshort		20		PowerPC,
>>>18	leshort		22		IBM S/390,
>>>18	leshort		36		NEC V800,
>>>18	leshort		37		Fujitsu FR20,
>>>18	leshort		38		TRW RH-32,
>>>18	leshort		39		Motorola RCE,
>>>18	leshort		40		ARM,
>>>18	leshort		41		Alpha,
>>>18	leshort		0xa390		IBM S/390 (obsolete),
>>>18	leshort		42		Hitachi SH,
>>>18	leshort		43		SPARC V9 - invalid byte order,
>>>18	leshort		44		Siemens Tricore Embedded Processor,
>>>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
>>>18	leshort		46		Hitachi H8/300,
>>>18	leshort		47		Hitachi H8/300H,
>>>18	leshort		48		Hitachi H8S,
>>>18	leshort		49		Hitachi H8/500,
>>>18	leshort		50		IA-64 (Intel 64 bit architecture),
>>>18	leshort		51		Stanford MIPS-X,
>>>18	leshort		52		Motorola Coldfire,
>>>18	leshort		53		Motorola M68HC12,
>>>18	leshort		62		AMD x86-64,
>>>18	leshort		75		Digital VAX,
>>>18	leshort		88		Renesas M32R,
>>>18	leshort		97		NatSemi 32k,
>>>18	leshort		0x9026		Alpha (unofficial),
>>>20	lelong		0		invalid version
>>>20	lelong		1		version 1
>>>36	lelong		1		MathCoPro/FPU/MAU Required
>>5	byte		2		MSB
># only for MIPS - see comment in little-endian section above.
>>>18    beshort		8
># only for 32-bit
>>>>4	byte		1
>>>>>36  belong&0xf0000000	0x00000000	MIPS-I
>>>>>36  belong&0xf0000000	0x10000000	MIPS-II
>>>>>36  belong&0xf0000000	0x20000000	MIPS-III
>>>>>36  belong&0xf0000000	0x30000000	MIPS-IV
>>>>>36  belong&0xf0000000	0x40000000	MIPS-V
>>>>>36  belong&0xf0000000	0x60000000	MIPS32
>>>>>36  belong&0xf0000000	0x70000000	MIPS64
>>>>>36  belong&0xf0000000	0x80000000	MIPS32 rel2
>>>>>36  belong&0xf0000000	0x90000000	MIPS64 rel2
># only for 64-bit
>>>>4	byte		2
>>>>>48	belong&0xf0000000	0x00000000	MIPS-I
>>>>>48	belong&0xf0000000	0x10000000	MIPS-II
>>>>>48	belong&0xf0000000	0x20000000	MIPS-III
>>>>>48	belong&0xf0000000	0x30000000	MIPS-IV
>>>>>48	belong&0xf0000000	0x40000000	MIPS-V
>>>>>48	belong&0xf0000000	0x60000000	MIPS32
>>>>>48	belong&0xf0000000	0x70000000	MIPS64 
>>>>>48	belong&0xf0000000	0x80000000	MIPS32 rel2
>>>>>48	belong&0xf0000000	0x90000000	MIPS64 rel2
>>>16	beshort		0		no file type,
>>>16	beshort		1		relocatable,
>>>16	beshort		2		executable,
>>>16	beshort		3		shared object,
>>>16	beshort		4		core file,
>#>>>(0x38+0xcc) string	>\0		of '%s'
>#>>>(0x38+0x10) belong	>0		(signal %d),
>>>16	beshort		&0xff00		processor-specific,
>>>18	beshort		0		no machine,
>>>18	beshort		1		AT&T WE32100,
>>>18	beshort		2		SPARC,
>>>18	beshort		3		Intel 80386 - invalid byte order,
>>>18	beshort		4		Motorola
>>>>36	belong		&0x01000000	68000,
>>>>36	belong		&0x00810000	CPU32,
>>>>36	belong		0		68020,
>>>18	beshort		5		Motorola 88000,
>>>18	beshort		6		Intel 80486 - invalid byte order,
>>>18	beshort		7		Intel 80860,
>>>18	beshort		8		MIPS,
>>>18	beshort		9		Amdahl,
>>>18	beshort		10		MIPS (deprecated),
>>>18	beshort		11		RS6000,
>>>18	beshort		15		PA-RISC
>>>>50	beshort		0x0214		2.0
>>>>48	beshort		&0x0008		(LP64)
>>>18	beshort		16		nCUBE,
>>>18	beshort		17		Fujitsu VPP500,
>>>18	beshort		18		SPARC32PLUS,
>>>>36	belong&0xffff00	&0x000100	V8+ Required,
>>>>36	belong&0xffff00	&0x000200	Sun UltraSPARC1 Extensions Required,
>>>>36	belong&0xffff00	&0x000400	HaL R1 Extensions Required,
>>>>36	belong&0xffff00	&0x000800	Sun UltraSPARC3 Extensions Required,
>>>18	beshort		20		PowerPC or cisco 4500,
>>>18	beshort		21		cisco 7500,
>>>18	beshort		22		IBM S/390,
>>>18	beshort		24		cisco SVIP,
>>>18	beshort		25		cisco 7200,
>>>18	beshort		36		NEC V800 or cisco 12000,
>>>18	beshort		37		Fujitsu FR20,
>>>18	beshort		38		TRW RH-32,
>>>18	beshort		39		Motorola RCE,
>>>18	beshort		40		ARM,
>>>18	beshort		41		Alpha,
>>>18	beshort		42		Hitachi SH,
>>>18	beshort		43		SPARC V9,
>>>18	beshort		44		Siemens Tricore Embedded Processor,
>>>18	beshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
>>>18	beshort		46		Hitachi H8/300,
>>>18	beshort		47		Hitachi H8/300H,
>>>18	beshort		48		Hitachi H8S,
>>>18	beshort		49		Hitachi H8/500,
>>>18	beshort		50		IA-64 (Intel 64 bit architecture),
>>>18	beshort		51		Stanford MIPS-X,
>>>18	beshort		52		Motorola Coldfire,
>>>18	beshort		53		Motorola M68HC12,
>>>18	beshort		73		Cray NV1,
>>>18	beshort		75		Digital VAX,
>>>18	beshort		88		Renesas M32R,
>>>18	beshort		97		NatSemi 32k,
>>>18	beshort		0x9026		Alpha (unofficial),
>>>18	beshort		0xa390		IBM S/390 (obsolete),
>>>20	belong		0		invalid version
>>>20	belong		1		version 1
>>>36	belong		1		MathCoPro/FPU/MAU Required
># Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
># like proper ELF, but extracting the string had bad results.
>>4      byte            <0x80
>>>8	string		>\0		(%s)
>>8	string		\0
>>>7	byte		0		(SYSV)
>>>7	byte		1		(HP-UX)
>>>7	byte		2		(NetBSD)
>>>7	byte		3		(GNU/Linux)
>>>7	byte		4		(GNU/Hurd)
>>>7	byte		5		(86Open)
>>>7	byte		6		(Solaris)
>>>7	byte		7		(Monterey)
>>>7	byte		8		(IRIX)
>>>7	byte		9		(FreeBSD)
>>>7	byte		10		(Tru64)
>>>7	byte		11		(Novell Modesto)
>>>7	byte		12		(OpenBSD)
>>>7	byte		97		(ARM)
>>>7	byte		255		(embedded)
>
>#------------------------------------------------------------------------------
># encore:  file(1) magic for Encore machines
>#
># XXX - needs to have the byte order specified (NS32K was little-endian,
># dunno whether they run the 88K in little-endian mode or not).
>#
>0	short		0x154		Encore
>>20	short		0x107		executable
>>20	short		0x108		pure executable
>>20	short		0x10b		demand-paged executable
>>20	short		0x10f		unsupported executable
>>12	long		>0		not stripped
>>22	short		>0		- version %ld
>>22	short		0		-
>#>4	date		x		stamp %s
>0	short		0x155		Encore unsupported executable
>>12	long		>0		not stripped
>>22	short		>0		- version %ld
>>22	short		0		-
>#>4	date		x		stamp %s
>
>#------------------------------------------------------------------------------
># Epoc 32 : file(1) magic for Epoc Documents [psion/osaris
># Stefan Praszalowicz (hpicollo@worldnet.fr)
>#0	lelong		0x10000037	Epoc32
>>4	lelong		0x1000006D
>>>8	lelong		0x1000007F	Word
>>>8	lelong		0x10000088	Sheet
>>>8	lelong		0x1000007D	Sketch
>>>8	lelong		0x10000085	TextEd
>
>#------------------------------------------------------------------------------
># ESRI Shapefile format (.shp .shx .dbf=DBaseIII)
># Based on info from
># <URL:http://www.esri.com/library/whitepapers/pdfs/shapefile.pdf>
>0	belong	9994	ESRI Shapefile
>>4	belong	=0
>>8	belong	=0
>>12	belong	=0
>>16	belong	=0
>>20	belong	=0
>>28	lelong	x	version %d
>>24	belong	x	length %d
>>32	lelong	=0	type Null Shape
>>32	lelong	=1	type Point
>>32	lelong	=3	type PolyLine
>>32	lelong	=5	type Polygon
>>32	lelong	=8	type MultiPoint
>>32	lelong	=11	type PointZ
>>32	lelong	=13	type PolyLineZ
>>32	lelong	=15	type PolygonZ
>>32	lelong	=18	type MultiPointZ
>>32	lelong	=21	type PointM
>>32	lelong	=23	type PolyLineM
>>32	lelong	=25	type PolygonM
>>32	lelong	=28	type MultiPointM
>>32	lelong	=31	type MultiPatch
>
>#------------------------------------------------------------------------------
># fcs: file(1) magic for FCS (Flow Cytometry Standard) data files
># From Roger Leigh <roger@whinlatter.uklinux.net>
>0       string          FCS1.0          Flow Cytometry Standard (FCS) data, version 1.0
>0       string          FCS2.0          Flow Cytometry Standard (FCS) data, version 2.0
>0       string          FCS3.0          Flow Cytometry Standard (FCS) data, version 3.0
>
>
>#------------------------------------------------------------------------------
># flash:	file(1) magic for Macromedia Flash file format
>#
># See
>#
>#	http://www.macromedia.com/software/flash/open/
>#
>0	string		FWS		Macromedia Flash data,
>>3	byte		x		version %d
>0	string		CWS		Macromedia Flash data (compressed),
>>3	byte		x		version %d
>#
># From Dave Wilson
>0	string AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
>
>#------------------------------------------------------------------------------
># fonts:  file(1) magic for font data
>#
>0	string		FONT		ASCII vfont text
>0	short		0436		Berkeley vfont data
>0	short		017001		byte-swapped Berkeley vfont data
>
># PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
>0	string		%!PS-AdobeFont-1.	PostScript Type 1 font text
>>20	string		>\0			(%s)
>6	string		%!PS-AdobeFont-1.	PostScript Type 1 font program data
>
># X11 font files in SNF (Server Natural Format) format
>0	belong		00000004		X11 SNF font data, MSB first
>0	lelong		00000004		X11 SNF font data, LSB first
>
># X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com)
>0	string		STARTFONT\040		X11 BDF font text
>
># X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
># PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
>0	string		\001fcp			X11 Portable Compiled Font data
>>12	byte		0x02			\b, LSB first
>>12	byte		0x0a			\b, MSB first
>0	string		D1.0\015		X11 Speedo font data
>
>#------------------------------------------------------------------------------
># FIGlet fonts and controlfiles
># From figmagic supplied with Figlet version 2.2
># "David E. O'Brien" <obrien@FreeBSD.ORG>
>0	string		flf		FIGlet font
>>3	string		>2a		version %-2.2s
>0	string		flc		FIGlet controlfile
>>3	string		>2a		version %-2.2s
>
># libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu)
># Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++
>0	belong		0x14025919	libGrx font data,
>>8	leshort		x		%dx
>>10	leshort		x		\b%d
>>40	string		x		%s
># Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu)
>0	belong		0xff464f4e	DOS code page font data collection
>7	belong		0x00454741	DOS code page font data
>7	belong		0x00564944	DOS code page font data (from Linux?)
>4098	string		DOSFONT		DOSFONT2 encrypted font data
>
># downloadable fonts for browser (prints type) anthon@mnt.org
>0	string		PFR1		PFR1 font
>>102	string		>0		\b: %s
>
># True Type fonts
>0	string	\000\001\000\000\000	TrueType font data
>
>0	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
>0	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
>
># Opentype font data from Avi Bercovich
>0	string		OTTO		OpenType font data 
>
>
>#------------------------------------------------------------------------------
># frame:  file(1) magic for FrameMaker files
>#
># This stuff came on a FrameMaker demo tape, most of which is
># copyright, but this file is "published" as witness the following:
>#
>0	string		\<MakerFile	FrameMaker document
>>11	string		5.5		 (5.5
>>11	string		5.0		 (5.0
>>11	string		4.0		 (4.0
>>11	string		3.0		 (3.0
>>11	string		2.0		 (2.0
>>11	string		1.0		 (1.0
>>14	byte		x		  %c)
>0	string		\<MIFFile	FrameMaker MIF (ASCII) file
>>9	string		4.0		 (4.0)
>>9	string		3.0		 (3.0)
>>9	string		2.0		 (2.0)
>>9	string		1.0		 (1.x)
>0	string		\<MakerDictionary	FrameMaker Dictionary text
>>17	string		3.0		 (3.0)
>>17	string		2.0		 (2.0)
>>17	string		1.0		 (1.x)
>0	string		\<MakerScreenFont	FrameMaker Font file
>>17	string		1.01		 (%s)
>0	string		\<MML		FrameMaker MML file
>0	string		\<BookFile	FrameMaker Book file
>>10	string		3.0		 (3.0
>>10	string		2.0		 (2.0
>>10	string		1.0		 (1.0
>>13	byte		x		  %c)
># XXX - this book entry should be verified, if you find one, uncomment this
>#0	string		\<Book\ 	FrameMaker Book (ASCII) file
>#>6	string		3.0		 (3.0)
>#>6	string		2.0		 (2.0)
>#>6	string		1.0		 (1.0)
>0	string		\<Maker	Intermediate Print File	FrameMaker IPL file
>
>#------------------------------------------------------------------------------
># freebsd:  file(1) magic for FreeBSD objects
>#
># All new-style FreeBSD magic numbers are in host byte order (i.e.,
># little-endian on x86).
>#
># XXX - this comes from the file "freebsd" in a recent FreeBSD version of
># "file"; it, and the NetBSD stuff in "netbsd", appear to use different
># schemes for distinguishing between executable images, shared libraries,
># and object files.
>#
># FreeBSD says:
>#
>#    Regardless of whether it's pure, demand-paged, or none of the
>#    above:
>#
>#	if the entry point is < 4096, then it's a shared library if
>#	the "has run-time loader information" bit is set, and is
>#	position-independent if the "is position-independent" bit
>#	is set;
>#
>#	if the entry point is >= 4096 (or >4095, same thing), then it's
>#	an executable, and is dynamically-linked if the "has run-time
>#	loader information" bit is set.
>#
># On x86, NetBSD says:
>#
>#    If it's neither pure nor demand-paged:
>#
>#	if it has the "has run-time loader information" bit set, it's
>#	a dynamically-linked executable;
>#
>#	if it doesn't have that bit set, then:
>#
>#	    if it has the "is position-independent" bit set, it's
>#	    position-independent;
>#
>#	    if the entry point is non-zero, it's an executable, otherwise
>#	    it's an object file.
>#
>#    If it's pure:
>#
>#	if it has the "has run-time loader information" bit set, it's
>#	a dynamically-linked executable, otherwise it's just an
>#	executable.
>#
>#    If it's demand-paged:
>#
>#	if it has the "has run-time loader information" bit set,
>#	then:
>#
>#	    if the entry point is < 4096, it's a shared library;
>#
>#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
>#	    it's a dynamically-linked executable);
>#
>#	if it doesn't have the "has run-time loader information" bit
>#	set, then it's just an executable.
>#
># (On non-x86, NetBSD does much the same thing, except that it uses
># 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
># pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
># had 8K pages; dunno about MIPS.)
>#
># I suspect the two will differ only in perverse and uninteresting cases
># ("shared" libraries that aren't demand-paged and whose pages probably
># won't actually be shared, executables with entry points <4096).
>#
># I leave it to those more familiar with FreeBSD and NetBSD to figure out
># what the right answer is (although using ">4095", FreeBSD-style, is
># probably better than separately checking for "=4096" and ">4096",
># NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
># executables using the NetBSD technique.)
>#
>0	lelong&0377777777	041400407	FreeBSD/i386
>>20	lelong			<4096
>>>3	byte&0xC0		&0x80		shared library
>>>3	byte&0xC0		0x40		PIC object
>>>3	byte&0xC0		0x00		object
>>20	lelong			>4095
>>>3	byte&0x80		0x80		dynamically linked executable
>>>3	byte&0x80		0x00		executable
>>16	lelong			>0		not stripped
>
>0	lelong&0377777777	041400410	FreeBSD/i386 pure
>>20	lelong			<4096
>>>3	byte&0xC0		&0x80		shared library
>>>3	byte&0xC0		0x40		PIC object
>>>3	byte&0xC0		0x00		object
>>20	lelong			>4095
>>>3	byte&0x80		0x80		dynamically linked executable
>>>3	byte&0x80		0x00		executable
>>16	lelong			>0		not stripped
>
>0	lelong&0377777777	041400413	FreeBSD/i386 demand paged
>>20	lelong			<4096
>>>3	byte&0xC0		&0x80		shared library
>>>3	byte&0xC0		0x40		PIC object
>>>3	byte&0xC0		0x00		object
>>20	lelong			>4095
>>>3	byte&0x80		0x80		dynamically linked executable
>>>3	byte&0x80		0x00		executable
>>16	lelong			>0		not stripped
>
>0	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
>>20	lelong			<4096
>>>3	byte&0xC0		&0x80		shared library
>>>3	byte&0xC0		0x40		PIC object
>>>3	byte&0xC0		0x00		object
>>20	lelong			>4095
>>>3	byte&0x80		0x80		dynamically linked executable
>>>3	byte&0x80		0x00		executable
>>16	lelong			>0		not stripped
>
># XXX gross hack to identify core files
># cores start with a struct tss; we take advantage of the following:
># byte 7:     highest byte of the kernel stack pointer, always 0xfe
>#      8/9:   kernel (ring 0) ss value, always 0x0010
>#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
>#      28:    low order byte of the current PTD entry, always 0 since the
>#             PTD is page-aligned
>#
>7	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
>>1039	string	>\0	from '%s'
>
># /var/run/ld.so.hints
># What are you laughing about?
>0	lelong			011421044151	ld.so hints file (Little Endian
>>4	lelong			>0		\b, version %d)
>>4	belong			<=0		\b)
>0	belong			011421044151	ld.so hints file (Big Endian
>>4	belong			>0		\b, version %d)
>>4	belong			<=0		\b)
>
>#
># Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
>#
>0	string	SCRSHOT_	scrshot(1) screenshot,
>>8	byte	x		version %d,
>>9	byte	2		%d bytes in header,
>>>10	byte	x		%d chars wide by
>>>11	byte	x		%d chars high
>
>#------------------------------------------------------------------------------
># fsav:  file(1) magic for datafellows fsav virus definition files
># Anthon van der Neut (anthon@mnt.org)
>0	beshort		0x1575		fsav (linux) macro virus
>>8	leshort		>0		(%d-
>>11	byte		>0		\b%02d-
>>10	byte		>0		\b%02d)
>
># comment this out for now because it regognizes every file where
># the eighth character is \n
>#8	byte		0x0a
>#>12	byte		0x07
>#>11	leshort		>0		fsav (linux) virus (%d-
>#>10	byte		0		\b01-
>#>10	byte		1		\b02-
>#>10	byte		2		\b03-
>#>10	byte		3		\b04-
>#>10	byte		4		\b05-
>#>10	byte		5		\b06-
>#>10	byte		6		\b07-
>#>10	byte		7		\b08-
>#>10	byte		8		\b08-
>#>10	byte		9		\b10-
>#>10	byte		10		\b11-
>#>10	byte		11		\b12-
>#>9	byte		>0		\b%02d)
>#------------------------------------------------------------------------------
># games:  file(1) for games
>
># Thomas M. Ott (ThMO)
>1	string	=WAD		DOOM data,
>>0	string	=I		main wad
>>0	string	=P		patch wad
>>0	byte	x		unknown junk
>
># Fabio Bonelli <fabiobonelli@libero.it>
># Quake II - III data files
>0       string  IDP2        	Quake II 3D Model file,
>>20     long    x               %lu skin(s),
>>8      long    x               (%lu x
>>12     long    x 		%lu),
>>40     long    x               %lu frame(s),
>>16     long    x               Frame size %lu bytes,
>>24     long  	x               %lu vertices/frame,
>>28     long    x            	%lu texture coordinates,
>>32     long    x               %lu triangles/frame
>
>0       string  IBSP            Quake
>>4      long    0x26            II Map file (BSP)
>>4      long    0x2E      	III Map file (BSP)
>
>0       string  IDS2            Quake II SP2 sprite file
>
>#---------------------------------------------------------------------------
># Doom and Quake
># submitted by Nicolas Patrois
>
># DOOM
>
>0       string  IWAD    DOOM or DOOM ][ world
>0       string  PWAD    DOOM or DOOM ][ extension world
>
>0       string  \xcb\x1dBoom\xe6\xff\x03\x01    Boom or linuxdoom demo
># some doom lmp files don't match, I've got one beginning with \x6d\x02\x01\x01
>
>24      string  LxD\ 203        Linuxdoom save
>>0      string  x       , name=%s
>>44     string  x       , world=%s
>
># Quake
>
>0       string  PACK    Quake I or II world or extension
>
>#0       string  -1\x0a  Quake I demo
>#>30     string  x        version %.4s
>#>61     string  x        level %s       
>
>#0       string  5\x0a   Quake I save
>
># The levels
>
># Quake 1
>
>0	string	5\x0aIntroduction             Quake I save: start Introduction
>0	string	5\x0athe_Slipgate_Complex     Quake I save: e1m1 The slipgate complex
>0	string	5\x0aCastle_of_the_Damned     Quake I save: e1m2 Castle of the damned
>0	string	5\x0athe_Necropolis           Quake I save: e1m3 The necropolis
>0	string	5\x0athe_Grisly_Grotto        Quake I save: e1m4 The grisly grotto
>0	string	5\x0aZiggurat_Vertigo         Quake I save: e1m8 Ziggurat vertigo (secret)
>0	string	5\x0aGloom_Keep               Quake I save: e1m5 Gloom keep
>0	string	5\x0aThe_Door_To_Chthon       Quake I save: e1m6 The door to Chthon
>0	string	5\x0aThe_House_of_Chthon      Quake I save: e1m7 The house of Chthon
>0	string	5\x0athe_Installation         Quake I save: e2m1 The installation
>0	string	5\x0athe_Ogre_Citadel         Quake I save: e2m2 The ogre citadel
>0	string	5\x0athe_Crypt_of_Decay       Quake I save: e2m3 The crypt of decay (dopefish lives!)
>0	string	5\x0aUnderearth               Quake I save: e2m7 Underearth (secret)
>0	string	5\x0athe_Ebon_Fortress        Quake I save: e2m4 The ebon fortress
>0	string	5\x0athe_Wizard's_Manse       Quake I save: e2m5 The wizard's manse
>0	string	5\x0athe_Dismal_Oubliette     Quake I save: e2m6 The dismal oubliette
>0	string	5\x0aTermination_Central      Quake I save: e3m1 Termination central
>0	string	5\x0aVaults_of_Zin            Quake I save: e3m2 Vaults of Zin
>0	string	5\x0athe_Tomb_of_Terror       Quake I save: e3m3 The tomb of terror
>0	string	5\x0aSatan's_Dark_Delight     Quake I save: e3m4 Satan's dark delight
>0	string	5\x0athe_Haunted_Halls        Quake I save: e3m7 The haunted halls (secret)
>0	string	5\x0aWind_Tunnels             Quake I save: e3m5 Wind tunnels
>0	string	5\x0aChambers_of_Torment      Quake I save: e3m6 Chambers of torment
>0	string	5\x0athe_Sewage_System        Quake I save: e4m1 The sewage system
>0	string	5\x0aThe_Tower_of_Despair     Quake I save: e4m2 The tower of despair
>0	string	5\x0aThe_Elder_God_Shrine     Quake I save: e4m3 The elder god shrine
>0	string	5\x0athe_Palace_of_Hate       Quake I save: e4m4 The palace of hate
>0	string	5\x0aHell's_Atrium            Quake I save: e4m5 Hell's atrium
>0	string	5\x0athe_Nameless_City        Quake I save: e4m8 The nameless city (secret)
>0	string	5\x0aThe_Pain_Maze            Quake I save: e4m6 The pain maze
>0	string	5\x0aAzure_Agony              Quake I save: e4m7 Azure agony
>0	string	5\x0aShub-Niggurath's_Pit     Quake I save: end Shub-Niggurath's pit
>
># Quake DeathMatch levels
>
>0	string	5\x0aPlace_of_Two_Deaths	 Quake I save: dm1 Place of two deaths
>0	string	5\x0aClaustrophobopolis		 Quake I save: dm2 Claustrophobopolis
>0	string	5\x0aThe_Abandoned_Base		 Quake I save: dm3 The abandoned base
>0	string	5\x0aThe_Bad_Place		 Quake I save: dm4 The bad place
>0	string	5\x0aThe_Cistern		 Quake I save: dm5 The cistern
>0	string	5\x0aThe_Dark_Zone		 Quake I save: dm6 The dark zone
>
># Scourge of Armagon
>
>0	string	5\x0aCommand_HQ               Quake I save: start Command HQ
>0	string	5\x0aThe_Pumping_Station      Quake I save: hip1m1 The pumping station
>0	string	5\x0aStorage_Facility         Quake I save: hip1m2 Storage facility
>0	string	5\x0aMilitary_Complex         Quake I save: hip1m5 Military complex (secret)
>0	string	5\x0athe_Lost_Mine            Quake I save: hip1m3 The lost mine
>0	string	5\x0aResearch_Facility        Quake I save: hip1m4 Research facility
>0	string	5\x0aAncient_Realms           Quake I save: hip2m1 Ancient realms
>0	string	5\x0aThe_Gremlin's_Domain     Quake I save: hip2m6 The gremlin's domain (secret)
>0	string	5\x0aThe_Black_Cathedral      Quake I save: hip2m2 The black cathedral
>0	string	5\x0aThe_Catacombs            Quake I save: hip2m3 The catacombs
>0	string	5\x0athe_Crypt__              Quake I save: hip2m4 The crypt
>0	string	5\x0aMortum's_Keep            Quake I save: hip2m5 Mortum's keep
>0	string	5\x0aTur_Torment              Quake I save: hip3m1 Tur torment
>0	string	5\x0aPandemonium              Quake I save: hip3m2 Pandemonium
>0	string	5\x0aLimbo                    Quake I save: hip3m3 Limbo
>0	string	5\x0athe_Edge_of_Oblivion     Quake I save: hipdm1 The edge of oblivion (secret)
>0	string	5\x0aThe_Gauntlet             Quake I save: hip3m4 The gauntlet
>0	string	5\x0aArmagon's_Lair           Quake I save: hipend Armagon's lair
>
># Malice
>
>0	string	5\x0aThe_Academy      Quake I save: start The academy
>0	string	5\x0aThe_Lab          Quake I save: d1 The lab
>0	string	5\x0aArea_33          Quake I save: d1b Area 33
>0	string	5\x0aSECRET_MISSIONS  Quake I save: d3b Secret missions
>0	string	5\x0aThe_Hospital     Quake I save: d10 The hospital (secret)
>0	string	5\x0aThe_Genetics_Lab Quake I save: d11 The genetics lab (secret)
>0	string	5\x0aBACK_2_MALICE    Quake I save: d4b Back to Malice
>0	string	5\x0aArea44           Quake I save: d1c Area 44
>0	string	5\x0aTakahiro_Towers  Quake I save: d2 Takahiro towers
>0	string	5\x0aA_Rat's_Life     Quake I save: d3 A rat's life
>0	string	5\x0aInto_The_Flood   Quake I save: d4 Into the flood
>0	string	5\x0aThe_Flood        Quake I save: d5 The flood
>0	string	5\x0aNuclear_Plant    Quake I save: d6 Nuclear plant
>0	string	5\x0aThe_Incinerator_Plant    Quake I save: d7 The incinerator plant
>0	string	5\x0aThe_Foundry              Quake I save: d7b The foundry
>0	string	5\x0aThe_Underwater_Base      Quake I save: d8 The underwater base
>0	string	5\x0aTakahiro_Base            Quake I save: d9 Takahiro base
>0	string	5\x0aTakahiro_Laboratories    Quake I save: d12 Takahiro laboratories
>0	string	5\x0aStayin'_Alive    Quake I save: d13 Stayin' alive
>0	string	5\x0aB.O.S.S._HQ      Quake I save: d14 B.O.S.S. HQ
>0	string	5\x0aSHOWDOWN!        Quake I save: d15 Showdown!
>
># Malice DeathMatch levels
>
>0	string	5\x0aThe_Seventh_Precinct	 Quake I save: ddm1 The seventh precinct
>0	string	5\x0aSub_Station		 Quake I save: ddm2 Sub station
>0	string	5\x0aCrazy_Eights!		 Quake I save: ddm3 Crazy eights!
>0	string	5\x0aEast_Side_Invertationa	 Quake I save: ddm4 East side invertationa
>0	string	5\x0aSlaughterhouse		 Quake I save: ddm5 Slaughterhouse
>0	string	5\x0aDOMINO			 Quake I save: ddm6 Domino
>0	string	5\x0aSANDRA'S_LADDER		 Quake I save: ddm7 Sandra's ladder
>
>
>0	string	MComprHD	MAME CHD compressed hard disk image,
>>12	belong	x		version %lu
>
>#------------------------------------------------------------------------------
># GEOS files (Vidar Madsen, vidar@gimp.org)
># semi-commonly used in embedded and handheld systems.
>0	belong	0xc745c153	GEOS
>>40	byte	1	executable
>>40	byte	2	VMFile
>>40	byte	3	binary
>>40	byte	4	directory label
>>40	byte	<1	unknown
>>40	byte	>4	unknown
>>4	string	>\0	\b, name "%s"
>#>44	short	x	\b, version %d
>#>46	short	x	\b.%d
>#>48	short	x	\b, rev %d
>#>50	short	x	\b.%d
>#>52	short	x	\b, proto %d
>#>54	short	x	\br%d
>#>168	string	>\0	\b, copyright "%s"
>
>#------------------------------------------------------------------------------
># gcc:  file(1) magic for GCC special files
>#
>0	string		gpch		GCC precompiled header
>
># The version field is annoying.  It's 3 characters, not zero-terminated.
>>5	byte		x			(version %c
>>6	byte		x			\b%c
>>7	byte		x			\b%c)
>
># 67 = 'C', 111 = 'o', 43 = '+', 79 = 'O'
>>4	byte		67			for C
>>4	byte		111			for Objective C
>>4	byte		43			for C++
>>4	byte		79			for Objective C++
>#------------------------------------------------------------------------------
># GIMP Gradient: file(1) magic for the GIMP's gradient data files
># by Federico Mena <federico@nuclecu.unam.mx>
>
>0       string          GIMP\ Gradient  GIMP gradient data
>
>#------------------------------------------------------------------------------
># XCF:  file(1) magic for the XCF image format used in the GIMP developed
>#       by Spencer Kimball and Peter Mattis
>#       ('Bucky' LaDieu, nega@vt.edu)
>
>0	string		gimp\ xcf	GIMP XCF image data,
>>9	string		file		version 0,
>>9	string		v		version
>>>10	string		>\0		%s,
>>14	belong		x		%lu x
>>18	belong		x		%lu,
>>22     belong          0               RGB Color
>>22     belong          1               Greyscale
>>22     belong          2               Indexed Color
>>22	belong		>2		Unknown Image Type.
>
>#------------------------------------------------------------------------------
># XCF:  file(1) magic for the patterns used in the GIMP, developed
>#       by Spencer Kimball and Peter Mattis
>#       ('Bucky' LaDieu, nega@vt.edu)
>
>20      string          GPAT            GIMP pattern data,
>>24     string          x               %s
>
>#------------------------------------------------------------------------------
># XCF:  file(1) magic for the brushes used in the GIMP, developed
>#       by Spencer Kimball and Peter Mattis
>#       ('Bucky' LaDieu, nega@vt.edu)
>
>20      string          GIMP            GIMP brush data
>#------------------------------------------------------------------------------
># gnu:  file(1) magic for various GNU tools
>#
># GNU nlsutils message catalog file format
>#
>0	string		\336\22\4\225	GNU message catalog (little endian),
>>4	lelong		x		revision %d,
>>8	lelong		x		%d messages
>0	string		\225\4\22\336	GNU message catalog (big endian),
>>4	belong		x		revision %d,
>>8	belong		x		%d messages
># message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
>0	string		*nazgul*	Nazgul style compiled message catalog
>>8	lelong		>0		\b, version %ld
>
># GnuPG
># The format is very similar to pgp
>0	string          \001gpg                 GPG key trust database
>>4	byte            x                       version %d
>0	beshort		0x8502			GPG encrypted data
># This magic is not particularly good, as the keyrings don't have true
># magic. Nevertheless, it covers many keyrings.
>0       beshort         0x9901                  GPG key public ring
>
># Gnumeric spreadsheet
># This entry is only semi-helpful, as Gnumeric compresses its files, so
># they will ordinarily reported as "compressed", but at least -z helps
>39      string          =<gmr:Workbook           Gnumeric spreadsheet
>
># From: James Youngman <jay@gnu.org> 
># gnu find magic
>0	string	\0LOCATE	GNU findutils locate database data
>>7	string	>\0		\b, format %s
>>7	string	02		\b (frcode)
>
>#------------------------------------------------------------------------------
># ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
>#
># ACE/gr binary
>0	string	\000\000\0001\000\000\0000\000\000\0000\000\000\0002\000\000\0000\000\000\0000\000\000\0003		old ACE/gr binary file
>>39	byte	>0			- version %c
># ACE/gr ascii
>0	string	#\ xvgr\ parameter\ file	ACE/gr ascii file
>0	string	#\ xmgr\ parameter\ file	ACE/gr ascii file
>0	string	#\ ACE/gr\ parameter\ file	ACE/gr ascii file
># Grace projects
>0	string	#\ Grace\ project\ file		Grace project file
>>23	string	@version\  			(version
>>>32	byte	>0 				%c
>>>33	string	>\0 				\b.%.2s
>>>35	string	>\0 				\b.%.2s)
># ACE/gr fit description files
>0	string	#\ ACE/gr\ fit\ description\ 	ACE/gr fit description file
># end of ACE/gr and Grace type files - PLEASE DO NOT REMOVE THIS LINE
>
>#------------------------------------------------------------------------------
># gringotts:  file(1) magic for Gringotts
># http://devel.pluto.linux.it/projects/Gringotts/
># author: Germano Rizzo <mano@pluto.linux.it>
>#GRG3????Y
>0	string	GRG		Gringotts data file
>#file format 1
>>3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
>#file format 2
>>3	string		2		v.2, MCRYPT S2K, 
>>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
>>>8	byte&0x70	0x10		SERPENT crypt,
>>>8	byte&0x70	0x20		TWOFISH crypt, 
>>>8	byte&0x70	0x30		CAST-256 crypt,
>>>8	byte&0x70	0x40		SAFER+ crypt,
>>>8	byte&0x70	0x50		LOKI97 crypt,
>>>8	byte&0x70	0x60		3DES crypt,
>>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
>>>8	byte&0x08	0x00		SHA1 hash,
>>>8	byte&0x08	0x08		RIPEMD-160 hash,
>>>8	byte&0x04	0x00		ZLib
>>>8	byte&0x04	0x04		BZip2
>>>8	byte&0x03	0x00		lvl.0
>>>8	byte&0x03	0x01		lvl.3
>>>8	byte&0x03	0x02		lvl.6
>>>8	byte&0x03	0x03		lvl.9
>#file format 3
>>3	string		3		v.3, OpenPGP S2K, 
>>>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
>>>8	byte&0x70	0x10		SERPENT crypt,
>>>8	byte&0x70	0x20		TWOFISH crypt, 
>>>8	byte&0x70	0x30		CAST-256 crypt,
>>>8	byte&0x70	0x40		SAFER+ crypt,
>>>8	byte&0x70	0x50		LOKI97 crypt,
>>>8	byte&0x70	0x60		3DES crypt,
>>>8	byte&0x70	0x70		RIJNDAEL-256 crypt,
>>>8	byte&0x08	0x00		SHA1 hash,
>>>8	byte&0x08	0x08		RIPEMD-160 hash,
>>>8	byte&0x04	0x00		ZLib
>>>8	byte&0x04	0x04		BZip2
>>>8	byte&0x03	0x00		lvl.0
>>>8	byte&0x03	0x01		lvl.3
>>>8	byte&0x03	0x02		lvl.6
>>>8	byte&0x03	0x03		lvl.9
>#file format >3
>>3	string		>3		v.%.1s (unknown details)
>
>#------------------------------------------------------------------------------
># Hierarchical Data Format, used to facilitate scientific data exchange
># specifications at http://hdf.ncsa.uiuc.edu/
>
>0	belong		0x0e031301	Hierarchical Data Format (version 4) data
>0	string		\211HDF\r\n\032	Hierarchical Data Format (version 5) data
>
>#------------------------------------------------------------------------------
># hitach-sh: file(1) magic for Hitachi Super-H
>#
># Super-H COFF
>#
>0	beshort		0x0500		Hitachi SH big-endian COFF
>>18	beshort&0x0002	=0x0000		object
>>18	beshort&0x0002	=0x0002		executable
>>18	beshort&0x0008	=0x0008		\b, stripped
>>18	beshort&0x0008	=0x0000		\b, not stripped
>#
>0	leshort		0x0550		Hitachi SH little-endian COFF
>>18	leshort&0x0002	=0x0000		object
>>18	leshort&0x0002	=0x0002		executable
>>18	leshort&0x0008	=0x0008		\b, stripped
>>18	leshort&0x0008	=0x0000		\b, not stripped
>
>
>#------------------------------------------------------------------------------
># hp:  file(1) magic for Hewlett Packard machines (see also "printer")
>#
># XXX - somebody should figure out whether any byte order needs to be
># applied to the "TML" stuff; I'm assuming the Apollo stuff is
># big-endian as it was mostly 68K-based.
>#
># I think the 500 series was the old stack-based machines, running a
># UNIX environment atop the "SUN kernel"; dunno whether it was
># big-endian or little-endian.
>#
># Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
># hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
># HP magic is useful for reference, but using "long" magic is a better
># practice in order to avoid collisions.
>#
># Guy Harris (guy@netapp.com): some additions to this list came from
># HP-UX 10.0's "/usr/include/sys/unistd.h" (68030, 68040, PA-RISC 1.1,
># 1.2, and 2.0).  The 1.2 and 2.0 stuff isn't in the HP-UX 10.0
># "/etc/magic", though, except for the "archive file relocatable library"
># stuff, and the 68030 and 68040 stuff isn't there at all - are they not
># used in executables, or have they just not yet updated "/etc/magic"
># completely?
>#
># 0	beshort		200		hp200 (68010) BSD binary
># 0	beshort		300		hp300 (68020+68881) BSD binary
># 0	beshort		0x20c		hp200/300 HP-UX binary
># 0	beshort		0x20d		hp400 (68030) HP-UX binary
># 0	beshort		0x20e		hp400 (68040?) HP-UX binary
># 0	beshort		0x20b		PA-RISC1.0 HP-UX binary
># 0	beshort		0x210		PA-RISC1.1 HP-UX binary
># 0	beshort		0x211		PA-RISC1.2 HP-UX binary
># 0	beshort		0x214		PA-RISC2.0 HP-UX binary
>
>#
># The "misc" stuff needs a byte order; the archives look suspiciously
># like the old 177545 archives (0xff65 = 0177545).
>#
>#### Old Apollo stuff
>0	beshort		0627		Apollo m68k COFF executable
>>18	beshort		^040000		not stripped
>>22	beshort		>0		- version %ld
>0	beshort		0624		apollo a88k COFF executable
>>18	beshort		^040000		not stripped
>>22	beshort		>0		- version %ld
>0       long            01203604016     TML 0123 byte-order format
>0       long            01702407010     TML 1032 byte-order format
>0       long            01003405017     TML 2301 byte-order format
>0       long            01602007412     TML 3210 byte-order format
>#### PA-RISC 1.1
>0	belong 		0x02100106	PA-RISC1.1 relocatable object
>0	belong 		0x02100107	PA-RISC1.1 executable
>>168	belong		&0x00000004	dynamically linked
>>(144)	belong		0x054ef630	dynamically linked
>>96	belong		>0		- not stripped
>
>0	belong 		0x02100108	PA-RISC1.1 shared executable
>>168	belong&0x4	0x4		dynamically linked
>>(144)	belong		0x054ef630	dynamically linked
>>96	belong		>0		- not stripped
>
>0	belong 		0x0210010b	PA-RISC1.1 demand-load executable
>>168	belong&0x4	0x4		dynamically linked
>>(144)	belong		0x054ef630	dynamically linked
>>96	belong		>0		- not stripped
>
>0	belong 		0x0210010e	PA-RISC1.1 shared library
>>96	belong		>0		- not stripped
>
>0	belong 		0x0210010d	PA-RISC1.1 dynamic load library
>>96	belong		>0		- not stripped
>
>#### PA-RISC 2.0
>0	belong		0x02140106	PA-RISC2.0 relocatable object
>
>0       belong		0x02140107	PA-RISC2.0 executable
>>168	belong		&0x00000004	dynamically linked
>>(144)	belong		0x054ef630	dynamically linked
>>96	belong		>0		- not stripped
>
>0       belong		0x02140108	PA-RISC2.0 shared executable
>>168	belong		&0x00000004	dynamically linked
>>(144)	belong		0x054ef630	dynamically linked
>>96	belong		>0		- not stripped
>
>0       belong		0x0214010b	PA-RISC2.0 demand-load executable
>>168	belong		&0x00000004	dynamically linked
>>(144)	belong		0x054ef630	dynamically linked
>>96	belong		>0		- not stripped
>
>0       belong		0x0214010e	PA-RISC2.0 shared library
>>96	belong		>0		- not stripped
>
>0       belong		0x0214010d	PA-RISC2.0 dynamic load library
>>96	belong		>0		- not stripped
>
>#### 800
>0	belong 		0x020b0106	PA-RISC1.0 relocatable object
>
>0	belong 		0x020b0107	PA-RISC1.0 executable
>>168	belong&0x4	0x4		dynamically linked
>>(144)	belong		0x054ef630	dynamically linked
>>96	belong		>0		- not stripped
>
>0	belong 		0x020b0108	PA-RISC1.0 shared executable
>>168	belong&0x4	0x4		dynamically linked
>>(144)	belong		0x054ef630	dynamically linked
>>96	belong		>0		- not stripped
>
>0	belong 		0x020b010b	PA-RISC1.0 demand-load executable
>>168	belong&0x4	0x4		dynamically linked
>>(144)	belong		0x054ef630	dynamically linked
>>96	belong		>0		- not stripped
>
>0	belong 		0x020b010e	PA-RISC1.0 shared library
>>96	belong		>0		- not stripped
>
>0	belong 		0x020b010d	PA-RISC1.0 dynamic load library
>>96	belong		>0		- not stripped
>
>0	belong		0x213c6172	archive file
>>68	belong 		0x020b0619	- PA-RISC1.0 relocatable library
>>68	belong	 	0x02100619	- PA-RISC1.1 relocatable library
>>68	belong 		0x02110619	- PA-RISC1.2 relocatable library
>>68	belong 		0x02140619	- PA-RISC2.0 relocatable library
>
>#### 500
>0	long		0x02080106	HP s500 relocatable executable
>>16	long		>0		- version %ld
>
>0	long		0x02080107	HP s500 executable
>>16	long		>0		- version %ld
>
>0	long		0x02080108	HP s500 pure executable
>>16	long		>0		- version %ld
>
>#### 200
>0	belong 		0x020c0108	HP s200 pure executable
>>4	beshort		>0		- version %ld
>>8	belong		&0x80000000	save fp regs
>>8	belong		&0x40000000	dynamically linked
>>8	belong		&0x20000000	debuggable
>>36	belong		>0		not stripped
>
>0	belong		0x020c0107	HP s200 executable
>>4	beshort		>0		- version %ld
>>8	belong		&0x80000000	save fp regs
>>8	belong		&0x40000000	dynamically linked
>>8	belong		&0x20000000	debuggable
>>36	belong		>0		not stripped
>
>0	belong		0x020c010b	HP s200 demand-load executable
>>4	beshort		>0		- version %ld
>>8	belong		&0x80000000	save fp regs
>>8	belong		&0x40000000	dynamically linked
>>8	belong		&0x20000000	debuggable
>>36	belong		>0		not stripped
>
>0	belong		0x020c0106	HP s200 relocatable executable
>>4	beshort		>0		- version %ld
>>6	beshort		>0		- highwater %d
>>8	belong		&0x80000000	save fp regs
>>8	belong		&0x20000000	debuggable
>>8	belong		&0x10000000	PIC
>
>0	belong 		0x020a0108	HP s200 (2.x release) pure executable
>>4	beshort		>0		- version %ld
>>36	belong		>0		not stripped
>
>0	belong		0x020a0107	HP s200 (2.x release) executable
>>4	beshort		>0		- version %ld
>>36	belong		>0		not stripped
>
>0	belong		0x020c010e	HP s200 shared library
>>4	beshort		>0		- version %ld
>>6	beshort		>0		- highwater %d
>>36	belong		>0		not stripped
>
>0	belong		0x020c010d	HP s200 dynamic load library
>>4	beshort		>0		- version %ld
>>6	beshort		>0		- highwater %d
>>36	belong		>0		not stripped
>
>#### MISC
>0	long		0x0000ff65	HP old archive
>0	long		0x020aff65	HP s200 old archive
>0	long		0x020cff65	HP s200 old archive
>0	long		0x0208ff65	HP s500 old archive
>
>0	long		0x015821a6	HP core file
>
>0	long		0x4da7eee8	HP-WINDOWS font
>>8	byte		>0		- version %ld
>0	string		Bitmapfile	HP Bitmapfile
>
>0	string		IMGfile	CIS 	compimg HP Bitmapfile
># XXX - see "lif"
>#0	short		0x8000		lif file
>0	long		0x020c010c	compiled Lisp
>
>0	string		msgcat01	HP NLS message catalog,
>>8	long		>0		%d messages
>
># addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
>0	string		HPHP48-		HP48 binary
>>7	byte		>0		- Rev %c
>>8	beshort		0x1129		(ADR)
>>8	beshort		0x3329		(REAL)
>>8	beshort		0x5529		(LREAL)
>>8	beshort		0x7729		(COMPLX)
>>8	beshort		0x9d29		(LCOMPLX)
>>8	beshort		0xbf29		(CHAR)
>>8	beshort		0xe829		(ARRAY)
>>8	beshort		0x0a2a		(LNKARRAY)
>>8	beshort		0x2c2a		(STRING)
>>8	beshort		0x4e2a		(HXS)
>>8	beshort		0x742a		(LIST)
>>8	beshort		0x962a		(DIR)
>>8	beshort		0xb82a		(ALG)
>>8	beshort		0xda2a		(UNIT)
>>8	beshort		0xfc2a		(TAGGED)
>>8	beshort		0x1e2b		(GROB)
>>8	beshort		0x402b		(LIB)
>>8	beshort		0x622b		(BACKUP)
>>8	beshort		0x882b		(LIBDATA)
>>8	beshort		0x9d2d		(PROG)
>>8	beshort		0xcc2d		(CODE)
>>8	beshort		0x482e		(GNAME)
>>8	beshort		0x6d2e		(LNAME)
>>8	beshort		0x922e		(XLIB)
>0	string		%%HP:		HP48 text
>>6	string		T(0)		- T(0)
>>6	string		T(1)		- T(1)
>>6	string		T(2)		- T(2)
>>6	string		T(3)		- T(3)
>>10	string		A(D)		A(D)
>>10	string		A(R)		A(R)
>>10	string		A(G)		A(G)
>>14	string		F(.)		F(.);
>>14	string		F(,)		F(,);
>
># hpBSD magic numbers
>0	beshort		200		hp200 (68010) BSD
>>2	beshort		0407		impure binary
>>2	beshort		0410		read-only binary
>>2	beshort		0413		demand paged binary
>0	beshort		300		hp300 (68020+68881) BSD
>>2	beshort		0407		impure binary
>>2	beshort		0410		read-only binary
>>2	beshort		0413		demand paged binary
>#
># From David Gero <dgero@nortelnetworks.com>
># HP-UX 10.20 core file format from /usr/include/sys/core.h
># Unfortunately, HP-UX uses corehead blocks without specifying the order
># There are four we care about:
>#     CORE_KERNEL, which starts with the string "HP-UX"
>#     CORE_EXEC, which contains the name of the command
>#     CORE_PROC, which contains the signal number that caused the core dump
>#     CORE_FORMAT, which contains the version of the core file format (== 1)
># The only observed order in real core files is KERNEL, EXEC, FORMAT, PROC
># but we include all 6 variations of the order of the first 3, and
># assume that PROC will always be last
># Order 1: KERNEL, EXEC, FORMAT, PROC
>0x10		string	HP-UX
>>0		belong	2
>>>0xC		belong	0x3C
>>>>0x4C		belong	0x100
>>>>>0x58	belong	0x44
>>>>>>0xA0	belong	1
>>>>>>>0xAC	belong	4
>>>>>>>>0xB0	belong	1
>>>>>>>>>0xB4	belong	4		core file
>>>>>>>>>>0x90	string	>\0		from '%s'
>>>>>>>>>>0xC4	belong	3		- received SIGQUIT
>>>>>>>>>>0xC4	belong	4		- received SIGILL
>>>>>>>>>>0xC4	belong	5		- received SIGTRAP
>>>>>>>>>>0xC4	belong	6		- received SIGABRT
>>>>>>>>>>0xC4	belong	7		- received SIGEMT
>>>>>>>>>>0xC4	belong	8		- received SIGFPE
>>>>>>>>>>0xC4	belong	10		- received SIGBUS
>>>>>>>>>>0xC4	belong	11		- received SIGSEGV
>>>>>>>>>>0xC4	belong	12		- received SIGSYS
>>>>>>>>>>0xC4	belong	33		- received SIGXCPU
>>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
># Order 2: KERNEL, FORMAT, EXEC, PROC
>>>>0x4C		belong	1
>>>>>0x58	belong	4
>>>>>>0x5C	belong	1
>>>>>>>0x60	belong	0x100
>>>>>>>>0x6C	belong	0x44
>>>>>>>>>0xB4	belong	4		core file
>>>>>>>>>>0xA4	string	>\0		from '%s'
>>>>>>>>>>0xC4	belong	3		- received SIGQUIT
>>>>>>>>>>0xC4	belong	4		- received SIGILL
>>>>>>>>>>0xC4	belong	5		- received SIGTRAP
>>>>>>>>>>0xC4	belong	6		- received SIGABRT
>>>>>>>>>>0xC4	belong	7		- received SIGEMT
>>>>>>>>>>0xC4	belong	8		- received SIGFPE
>>>>>>>>>>0xC4	belong	10		- received SIGBUS
>>>>>>>>>>0xC4	belong	11		- received SIGSEGV
>>>>>>>>>>0xC4	belong	12		- received SIGSYS
>>>>>>>>>>0xC4	belong	33		- received SIGXCPU
>>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
># Order 3: FORMAT, KERNEL, EXEC, PROC
>0x24		string	HP-UX
>>0		belong	1
>>>0xC		belong	4
>>>>0x10		belong	1
>>>>>0x14	belong	2
>>>>>>0x20	belong	0x3C
>>>>>>>0x60	belong	0x100
>>>>>>>>0x6C	belong	0x44
>>>>>>>>>0xB4	belong	4		core file
>>>>>>>>>>0xA4	string	>\0		from '%s'
>>>>>>>>>>0xC4	belong	3		- received SIGQUIT
>>>>>>>>>>0xC4	belong	4		- received SIGILL
>>>>>>>>>>0xC4	belong	5		- received SIGTRAP
>>>>>>>>>>0xC4	belong	6		- received SIGABRT
>>>>>>>>>>0xC4	belong	7		- received SIGEMT
>>>>>>>>>>0xC4	belong	8		- received SIGFPE
>>>>>>>>>>0xC4	belong	10		- received SIGBUS
>>>>>>>>>>0xC4	belong	11		- received SIGSEGV
>>>>>>>>>>0xC4	belong	12		- received SIGSYS
>>>>>>>>>>0xC4	belong	33		- received SIGXCPU
>>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
># Order 4: EXEC, KERNEL, FORMAT, PROC
>0x64		string	HP-UX
>>0		belong	0x100
>>>0xC		belong	0x44
>>>>0x54		belong	2
>>>>>0x60	belong	0x3C
>>>>>>0xA0	belong	1
>>>>>>>0xAC	belong	4
>>>>>>>>0xB0	belong	1
>>>>>>>>>0xB4	belong	4		core file
>>>>>>>>>>0x44	string	>\0		from '%s'
>>>>>>>>>>0xC4	belong	3		- received SIGQUIT
>>>>>>>>>>0xC4	belong	4		- received SIGILL
>>>>>>>>>>0xC4	belong	5		- received SIGTRAP
>>>>>>>>>>0xC4	belong	6		- received SIGABRT
>>>>>>>>>>0xC4	belong	7		- received SIGEMT
>>>>>>>>>>0xC4	belong	8		- received SIGFPE
>>>>>>>>>>0xC4	belong	10		- received SIGBUS
>>>>>>>>>>0xC4	belong	11		- received SIGSEGV
>>>>>>>>>>0xC4	belong	12		- received SIGSYS
>>>>>>>>>>0xC4	belong	33		- received SIGXCPU
>>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
># Order 5: FORMAT, EXEC, KERNEL, PROC
>0x78		string	HP-UX
>>0		belong	1
>>>0xC		belong	4
>>>>0x10		belong	1
>>>>>0x14	belong	0x100
>>>>>>0x20	belong	0x44
>>>>>>>0x68	belong	2
>>>>>>>>0x74	belong	0x3C
>>>>>>>>>0xB4	belong	4		core file
>>>>>>>>>>0x58	string	>\0		from '%s'
>>>>>>>>>>0xC4	belong	3		- received SIGQUIT
>>>>>>>>>>0xC4	belong	4		- received SIGILL
>>>>>>>>>>0xC4	belong	5		- received SIGTRAP
>>>>>>>>>>0xC4	belong	6		- received SIGABRT
>>>>>>>>>>0xC4	belong	7		- received SIGEMT
>>>>>>>>>>0xC4	belong	8		- received SIGFPE
>>>>>>>>>>0xC4	belong	10		- received SIGBUS
>>>>>>>>>>0xC4	belong	11		- received SIGSEGV
>>>>>>>>>>0xC4	belong	12		- received SIGSYS
>>>>>>>>>>0xC4	belong	33		- received SIGXCPU
>>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
># Order 6: EXEC, FORMAT, KERNEL, PROC
>>0		belong	0x100
>>>0xC		belong	0x44
>>>>0x54		belong	1
>>>>>0x60	belong	4
>>>>>>0x64	belong	1
>>>>>>>0x68	belong	2
>>>>>>>>0x74	belong	0x2C
>>>>>>>>>0xB4	belong	4		core file
>>>>>>>>>>0x44	string	>\0		from '%s'
>>>>>>>>>>0xC4	belong	3		- received SIGQUIT
>>>>>>>>>>0xC4	belong	4		- received SIGILL
>>>>>>>>>>0xC4	belong	5		- received SIGTRAP
>>>>>>>>>>0xC4	belong	6		- received SIGABRT
>>>>>>>>>>0xC4	belong	7		- received SIGEMT
>>>>>>>>>>0xC4	belong	8		- received SIGFPE
>>>>>>>>>>0xC4	belong	10		- received SIGBUS
>>>>>>>>>>0xC4	belong	11		- received SIGSEGV
>>>>>>>>>>0xC4	belong	12		- received SIGSYS
>>>>>>>>>>0xC4	belong	33		- received SIGXCPU
>>>>>>>>>>0xC4	belong	34		- received SIGXFSZ
>
># From: AMAKAWA Shuhei <sa264@cam.ac.uk>
>0	string	HPHP49-			HP49 binary
>
>
>#------------------------------------------------------------------------------
># human68k:  file(1) magic for Human68k (X680x0 DOS) binary formats
># Magic too short!
>#0		string	HU		Human68k
>#>68		string	LZX		LZX compressed
>#>>72		string	>\0		(version %s)
>#>(8.L+74)	string	LZX		LZX compressed
>#>>(8.L+78)	string	>\0		(version %s)
>#>60		belong	>0		binded
>#>(8.L+66)	string	#HUPAIR		hupair
>#>0		string	HU		X executable
>#>(8.L+74)	string	#LIBCV1		- linked PD LIBC ver 1
>#>4		belong	>0		- base address 0x%x
>#>28		belong	>0		not stripped
>#>32		belong	>0		with debug information
>#0		beshort	0x601a		Human68k Z executable
>#0		beshort	0x6000		Human68k object file
>#0		belong	0xd1000000	Human68k ar binary archive
>#0		belong	0xd1010000	Human68k ar ascii archive
>#0		beshort	0x0068		Human68k lib archive
>#4		string	LZX		Human68k LZX compressed
>#>8		string	>\0		(version %s)
>#>4		string	LZX		R executable
>#2		string	#HUPAIR		Human68k hupair R executable
>
>#------------------------------------------------------------------------------
># ibm370:  file(1) magic for IBM 370 and compatibles.
>#
># "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
># What the heck *is* "USS/370"?
># AIX 4.1's "/etc/magic" has
>#
>#	0	short		0535		370 sysV executable 
>#	>12	long		>0		not stripped
>#	>22	short		>0		- version %d
>#	>30	long		>0		- 5.2 format
>#	0	short		0530		370 sysV pure executable 
>#	>12	long		>0		not stripped
>#	>22	short		>0		- version %d
>#	>30	long		>0		- 5.2 format
>#
># instead of the "USS/370" versions of the same magic numbers.
>#
>0	beshort		0537		370 XA sysV executable 
>>12	belong		>0		not stripped
>>22	beshort		>0		- version %d
>>30	belong		>0		- 5.2 format
>0	beshort		0532		370 XA sysV pure executable 
>>12	belong		>0		not stripped
>>22	beshort		>0		- version %d
>>30	belong		>0		- 5.2 format
>0	beshort		054001		370 sysV pure executable
>>12	belong		>0		not stripped
>0	beshort		055001		370 XA sysV pure executable
>>12	belong		>0		not stripped
>0	beshort		056401		370 sysV executable
>>12	belong		>0		not stripped
>0	beshort		057401		370 XA sysV executable
>>12	belong		>0		not stripped
>0       beshort		0531		SVR2 executable (Amdahl-UTS)
>>12	belong		>0		not stripped
>>24     belong		>0		- version %ld
>0	beshort		0534		SVR2 pure executable (Amdahl-UTS)
>>12	belong		>0		not stripped
>>24	belong		>0		- version %ld
>0	beshort		0530		SVR2 pure executable (USS/370)
>>12	belong		>0		not stripped
>>24	belong		>0		- version %ld
>0	beshort		0535		SVR2 executable (USS/370)
>>12	belong		>0		not stripped
>>24	belong		>0		- version %ld
>
>#------------------------------------------------------------------------------
># ibm6000:  file(1) magic for RS/6000 and the RT PC.
>#
>0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
>>12	belong		>0		not stripped
># Breaks sun4 statically linked execs.
>#0      beshort		0x0103		executable (RT Version 2) or obj module
>#>2	byte		0x50		pure
>#>28	belong		>0		not stripped
>#>6	beshort		>0		- version %ld
>0	beshort		0x0104		shared library
>0	beshort		0x0105		ctab data
>0	beshort		0xfe04		structured file
>0	string		0xabcdef	AIX message catalog
>0	belong		0x000001f9	AIX compiled message catalog
>0	string		\<aiaff>	archive
>0	string		\<bigaf>	archive (big format)
>
>
>#------------------------------------------------------------------------------
># iff:	file(1) magic for Interchange File Format (see also "audio" & "images")
>#
># Daniel Quinlan (quinlan@yggdrasil.com) -- IFF was designed by Electronic
># Arts for file interchange.  It has also been used by Apple, SGI, and
># especially Commodore-Amiga.
>#
># IFF files begin with an 8 byte FORM header, followed by a 4 character
># FORM type, which is followed by the first chunk in the FORM.
>
>0	string		FORM		IFF data
>#>4	belong		x		\b, FORM is %d bytes long
># audio formats
>>8	string		AIFF		\b, AIFF audio
>>8	string		AIFC		\b, AIFF-C compressed audio
>>8	string		8SVX		\b, 8SVX 8-bit sampled sound voice
>>8	string		SAMP		\b, SAMP sampled audio
>>8	string		DTYP		\b, DTYP datatype description
>>8	string		PTCH		\b, PTCH binary patch
># image formats
>>8	string		ILBMBMHD	\b, ILBM interleaved image
>>>20	beshort		x		\b, %d x
>>>22	beshort		x		%d
>>8	string		RGBN		\b, RGBN 12-bit RGB image
>>8	string		RGB8		\b, RGB8 24-bit RGB image
>>8	string		DR2D		\b, DR2D 2-D object
>>8	string		TDDD		\b, TDDD 3-D rendering
># other formats
>>8	string		FTXT		\b, FTXT formatted text
>>8	string		CTLG		\b, CTLG message catalog
>>8	string		PREF		\b, PREF preferences
>
># These go at the end of the iff rules
>#
># I don't see why these might collide with anything else.
>#
># Interactive Fiction related formats
>#
>>8	string		IFRS		\b, Blorb Interactive Fiction
>>>24	string		Exec		with executable chunk
>>8	string          IFZS		\b, Z-machine or Glulx saved game file (Quetzal)
>
>#------------------------------------------------------------------------------
># images:  file(1) magic for image formats (see also "iff")
>#
># originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
># additions by janl@ifi.uio.no as well as others. Jan also suggested
># merging several one- and two-line files into here.
>#
># little magic: PCX (first byte is 0x0a)
>
># Targa - matches `povray', `ppmtotga' and `xv' outputs
># by Philippe De Muyter <phdm@macqel.be>
># at 2, byte ImgType must be 1, 2, 3, 9, 10 or 11
># at 1, byte CoMapType must be 1 if ImgType is 1 or 9, 0 otherwise
># at 3, leshort Index is 0 for povray, ppmtotga and xv outputs
># `xv' recognizes only a subset of the following (RGB with pixelsize = 24)
># `tgatoppm' recognizes a superset (Index may be anything)
>1	belong&0xfff7ffff	0x01010000	Targa image data - Map
>>2	byte&8			8		- RLE
>>12	leshort			>0		%hd x
>>14	leshort			>0		%hd
>1	belong&0xfff7ffff	0x00020000	Targa image data - RGB
>>2	byte&8			8		- RLE
>>12	leshort			>0		%hd x
>>14	leshort			>0		%hd
>1	belong&0xfff7ffff	0x00030000	Targa image data - Mono
>>2	byte&8			8		- RLE
>>12	leshort			>0		%hd x
>>14	leshort			>0		%hd
>
># PBMPLUS images
># The next byte following the magic is always whitespace.
>0	string		P1		Netpbm PBM image text
>0	string		P2		Netpbm PGM image text
>0	string		P3		Netpbm PPM image text
>0	string		P4		Netpbm PBM "rawbits" image data
>0	string		P5		Netpbm PGM "rawbits" image data
>0	string		P6		Netpbm PPM "rawbits" image data
>0	string		P7		Netpbm PAM image file
>
># From: bryanh@giraffe-data.com (Bryan Henderson)
>0	string		\117\072	Solitaire Image Recorder format
>>4	string		\013		MGI Type 11
>>4	string		\021		MGI Type 17
>0	string		.MDA		MicroDesign data
>>21	byte		48		version 2
>>21	byte		51		version 3
>0	string		.MDP		MicroDesign page data
>>21	byte		48		version 2
>>21	byte		51		version 3
>
># NIFF (Navy Interchange File Format, a modification of TIFF) images
>0	string		IIN1		NIFF image data
>
># Tag Image File Format, from Daniel Quinlan (quinlan@yggdrasil.com)
># The second word of TIFF files is the TIFF version number, 42, which has
># never changed.  The TIFF specification recommends testing for it.
>0	string		MM\x00\x2a	TIFF image data, big-endian
>0	string		II\x2a\x00	TIFF image data, little-endian
>
># PNG [Portable Network Graphics, or "PNG's Not GIF"] images
># (Greg Roelofs, newt@uchicago.edu)
># (Albert Cahalan, acahalan@cs.uml.edu)
>#
># 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
>#
>0	string		\x89PNG		PNG image data,
>>4	belong		!0x0d0a1a0a	CORRUPTED,
>>4	belong		0x0d0a1a0a
>>>16	belong		x		%ld x
>>>20	belong		x		%ld,
>>>24	byte		x		%d-bit
>>>25	byte		0		grayscale,
>>>25	byte		2		\b/color RGB,
>>>25	byte		3		colormap,
>>>25	byte		4		gray+alpha,
>>>25	byte		6		\b/color RGBA,
>#>>26	byte		0		deflate/32K,
>>>28	byte		0		non-interlaced
>>>28	byte		1		interlaced
>1	string		PNG		PNG image data, CORRUPTED
>
># GIF
>0	string		GIF8		GIF image data
>>4	string		7a		\b, version 8%s,
>>4	string		9a		\b, version 8%s,
>>6	leshort		>0		%hd x
>>8	leshort		>0		%hd
>#>10	byte		&0x80		color mapped,
>#>10	byte&0x07	=0x00		2 colors
>#>10	byte&0x07	=0x01		4 colors
>#>10	byte&0x07	=0x02		8 colors
>#>10	byte&0x07	=0x03		16 colors
>#>10	byte&0x07	=0x04		32 colors
>#>10	byte&0x07	=0x05		64 colors
>#>10	byte&0x07	=0x06		128 colors
>#>10	byte&0x07	=0x07		256 colors
>
># ITC (CMU WM) raster files.  It is essentially a byte-reversed Sun raster,
># 1 plane, no encoding.
>0	string		\361\0\100\273	CMU window manager raster image data
>>4	lelong		>0		%d x
>>8	lelong		>0		%d,
>>12	lelong		>0		%d-bit
>
># Magick Image File Format
>0	string		id=ImageMagick	MIFF image data
>
># Artisan
>0	long		1123028772	Artisan image data
>>4	long		1		\b, rectangular 24-bit
>>4	long		2		\b, rectangular 8-bit with colormap
>>4	long		3		\b, rectangular 32-bit (24-bit with matte)
>
># FIG (Facility for Interactive Generation of figures), an object-based format
>0	string		#FIG		FIG image text
>>5	string		x		\b, version %.3s
>
># PHIGS
>0	string		ARF_BEGARF		PHIGS clear text archive
>0	string		@(#)SunPHIGS		SunPHIGS
># version number follows, in the form m.n
>>40	string		SunBin			binary
>>32	string		archive			archive
>
># GKS (Graphics Kernel System)
>0	string		GKSM		GKS Metafile
>>24	string		SunGKS		\b, SunGKS
>
># CGM image files
>0	string		BEGMF		clear text Computer Graphics Metafile
># XXX - questionable magic
>0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
>0	beshort		0x3020		character Computer Graphics Metafile
>
># MGR bitmaps  (Michael Haardt, u31b3hs@pool.informatik.rwth-aachen.de)
>0	string	yz	MGR bitmap, modern format, 8-bit aligned
>0	string	zz	MGR bitmap, old format, 1-bit deep, 16-bit aligned
>0	string	xz	MGR bitmap, old format, 1-bit deep, 32-bit aligned
>0	string	yx	MGR bitmap, modern format, squeezed
>
># Fuzzy Bitmap (FBM) images
>0	string		%bitmap\0	FBM image data
>>30	long		0x31		\b, mono
>>30	long		0x33		\b, color
>
># facsimile data
>1	string		PC\ Research,\ Inc	group 3 fax data
>>29	byte		0		\b, normal resolution (204x98 DPI)
>>29	byte		1		\b, fine resolution (204x196 DPI)
># From: Herbert Rosmanith <herp@wildsau.idv.uni.linz.at>
>0	string		Sfff		structured fax file
>
>
># PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
>0	string		BM		PC bitmap data
>>14	leshort		12		\b, OS/2 1.x format
>>>18	leshort		x		\b, %d x
>>>20	leshort		x		%d
>>14	leshort		64		\b, OS/2 2.x format
>>>18	leshort		x		\b, %d x
>>>20	leshort		x		%d
>>14	leshort		40		\b, Windows 3.x format
>>>18	lelong		x		\b, %d x
>>>22	lelong		x		%d x
>>>28	leshort		x		%d
># Too simple - MPi
>#0	string		IC		PC icon data
>#0	string		PI		PC pointer image data
>#0	string		CI		PC color icon data
>#0	string		CP		PC color pointer image data
># Conflicts with other entries [BABYL]
>#0	string		BA		PC bitmap array data
>
># XPM icons (Greg Roelofs, newt@uchicago.edu)
># note possible collision with C/REXX entry in c-lang; currently commented out
>0	string		/*\ XPM\ */	X pixmap image text
>
># Utah Raster Toolkit RLE images (janl@ifi.uio.no)
>0	leshort		0xcc52		RLE image data,
>>6	leshort		x		%d x
>>8	leshort		x		%d
>>2	leshort		>0		\b, lower left corner: %d
>>4	leshort		>0		\b, lower right corner: %d
>>10	byte&0x1	=0x1		\b, clear first
>>10	byte&0x2	=0x2		\b, no background
>>10	byte&0x4	=0x4		\b, alpha channel
>>10	byte&0x8	=0x8		\b, comment
>>11	byte		>0		\b, %d color channels
>>12	byte		>0		\b, %d bits per pixel
>>13	byte		>0		\b, %d color map channels
>
># image file format (Robert Potter, potter@cs.rochester.edu)
>0	string		Imagefile\ version-	iff image data
># this adds the whole header (inc. version number), informative but longish
>>10	string		>\0		%s
>
># Sun raster images, from Daniel Quinlan (quinlan@yggdrasil.com)
>0	belong		0x59a66a95	Sun raster image data
>>4	belong		>0		\b, %d x
>>8	belong		>0		%d,
>>12	belong		>0		%d-bit,
>#>16	belong		>0		%d bytes long,
>>20	belong		0		old format,
>#>20	belong		1		standard,
>>20	belong		2		compressed,
>>20	belong		3		RGB,
>>20	belong		4		TIFF,
>>20	belong		5		IFF,
>>20	belong		0xffff		reserved for testing,
>>24	belong		0		no colormap
>>24	belong		1		RGB colormap
>>24	belong		2		raw colormap
>#>28	belong		>0		colormap is %d bytes long
>
># SGI image file format, from Daniel Quinlan (quinlan@yggdrasil.com)
>#
># See
>#	http://reality.sgi.com/grafica/sgiimage.html
>#
>0	beshort		474		SGI image data
>#>2	byte		0		\b, verbatim
>>2	byte		1		\b, RLE
>#>3	byte		1		\b, normal precision
>>3	byte		2		\b, high precision
>>4	beshort		x		\b, %d-D
>>6	beshort		x		\b, %d x
>>8	beshort		x		%d
>>10	beshort		x		\b, %d channel
>>10	beshort		!1		\bs
>>80	string		>0		\b, "%s"
>
>0	string		IT01		FIT image data
>>4	belong		x		\b, %d x
>>8	belong		x		%d x
>>12	belong		x		%d
>#
>0	string		IT02		FIT image data
>>4	belong		x		\b, %d x
>>8	belong		x		%d x
>>12	belong		x		%d
>#
>2048	string		PCD_IPI		Kodak Photo CD image pack file
>>0xe02	byte&0x03	0x00		, landscape mode
>>0xe02	byte&0x03	0x01		, portrait mode
>>0xe02	byte&0x03	0x02		, landscape mode
>>0xe02	byte&0x03	0x03		, portrait mode
>0	string		PCD_OPA		Kodak Photo CD overview pack file
>
># FITS format.  Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
># FITS is the Flexible Image Transport System, the de facto standard for
># data and image transfer, storage, etc., for the astronomical community.
># (FITS floating point formats are big-endian.)
>0	string	SIMPLE\ \ =	FITS image data
>>109	string	8		\b, 8-bit, character or unsigned binary integer
>>108	string	16		\b, 16-bit, two's complement binary integer
>>107	string	\ 32		\b, 32-bit, two's complement binary integer
>>107	string	-32		\b, 32-bit, floating point, single precision
>>107	string	-64		\b, 64-bit, floating point, double precision
>
># other images
>0	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
>0	string		=!!		Bennet Yee's "face" format
>
># From SunOS 5.5.1 "/etc/magic" - appeared right before Sun raster image
># stuff.
>#
>0	beshort		0x1010		PEX Binary Archive
>
># Visio drawings
>03000	string	Visio\ (TM)\ Drawing	%s
>
># Tgif files
>0	string	\%TGIF\ x 		Tgif file version %s
>
># DICOM medical imaging data
>128	string	DICM			DICOM medical imaging data
>
># XWD - X Window Dump file.
>#   As described in /usr/X11R6/include/X11/XWDFile.h
>#   used by the xwd program.
>#   Bradford Castalia, idaeim, 1/01
>4	belong	7			XWD X Window Dump image data
>>100	string	>\0			\b, "%s"
>>16	belong	x			\b, %dx
>>20	belong	x			\b%dx
>>12	belong	x			\b%d
>
># PDS - Planetary Data System
>#   These files use Parameter Value Language in the header section.
>#   Unfortunately, there is no certain magic, but the following
>#   strings have been found to be most likely.
>0	string	NJPL1I00		PDS (JPL) image data
>2	string	NJPL1I			PDS (JPL) image data
>0	string	CCSD3ZF			PDS (CCSD) image data
>2	string	CCSD3Z			PDS (CCSD) image data
>0	string	PDS_			PDS image data
>0	string	LBLSIZE=		PDS (VICAR) image data
>
># pM8x: ATARI STAD compressed bitmap format
>#
># from Oskar Schirmer <schirmer@scara.com> Feb 2, 2001
># p M 8 5/6 xx yy zz data...
># Atari ST STAD bitmap is always 640x400, bytewise runlength compressed.
># bytes either run horizontally (pM85) or vertically (pM86). yy is the
># most frequent byte, xx and zz are runlength escape codes, where xx is
># used for runs of yy.
>#
>0	string	pM85		Atari ST STAD bitmap image data (hor)
>>5	byte	0x00		(white background)
>>5	byte	0xFF		(black background)
>0	string	pM86		Atari ST STAD bitmap image data (vert)
>>5	byte	0x00		(white background)
>>5	byte	0xFF		(black background)
>
># XXX:
># This is bad magic 0x5249 == 'RI' conflicts with RIFF and other
># magic.
># SGI RICE image file <mpruett@sgi.com>
>#0	beshort	0x5249		RICE image
>#>2	beshort	x		v%d
>#>4	beshort	x		(%d x
>#>6	beshort	x		%d)
>#>8	beshort	0		8 bit
>#>8	beshort	1		10 bit
>#>8	beshort	2		12 bit
>#>8	beshort	3		13 bit
>#>10	beshort	0		4:2:2
>#>10	beshort	1		4:2:2:4
>#>10	beshort	2		4:4:4
>#>10	beshort	3		4:4:4:4
>#>12	beshort	1		RGB
>#>12	beshort	2		CCIR601
>#>12	beshort	3		RP175
>#>12	beshort	4		YUV
>
>#------------------------------------------------------------------------------
>#
># Marco Schmidt (marcoschmidt@users.sourceforge.net) -- an image  file format
># for the EPOC operating system, which is used with PDAs like those from Psion
>#
># see http://huizen.dds.nl/~frodol/psiconv/html/Index.html for a description
># of various EPOC file formats
>
>0	string \x37\x00\x00\x10\x42\x00\x00\x10\x00\x00\x00\x00\x39\x64\x39\x47 EPOC MBM image file
>
># PCX image files
># From: Dan Fandrich <dan@coneharvesters.com>
>0	beshort		0x0a00	PCX ver. 2.5 image data
>0	beshort		0x0a02	PCX ver. 2.8 image data, with palette
>0	beshort		0x0a03	PCX ver. 2.8 image data, without palette
>0	beshort		0x0a04	PCX for Windows image data
>0	beshort		0x0a05	PCX ver. 3.0 image data
>>4	leshort		x      bounding box [%hd,
>>6	leshort		x      %hd] -
>>8	leshort		x      [%hd,
>>10	leshort		x      %hd],
>>65	byte		>1	%d planes each of
>>3	byte		x	%hhd-bit
>>68	byte		0	image,
>>68	byte		1	colour,
>>68	byte		2	grayscale,
>>68	byte		>2	image,
>>68	byte		<0	image,
>>12	leshort		>0	%hd x
>>>14	leshort		x      %hd dpi,
>>2	byte		0	uncompressed
>>2	byte		1	RLE compressed
>
># Adobe Photoshop
>0	string		8BPS Adobe Photoshop Image
>
># XV thumbnail indicator (ThMO)
>0	string		P7\ 332		XV thumbnail image data
>
># NITF is defined by United States MIL-STD-2500A
>0	string	NITF	National Imagery Transmission Format
>>25	string	>\0	dated %.14s
>
># GEM Image: Version 1, Headerlen 8 (Wolfram Kleff)
>0	belong		0x00010008	GEM Image data
>>12	beshort		x		%d x
>>14	beshort		x		%d,
>>4	beshort		x		%d planes,
>>8	beshort		x		%d x
>>10	beshort		x		%d pixelsize
>
># GEM Metafile (Wolfram Kleff)
>0	lelong		0x0018FFFF	GEM Metafile data
>>4	leshort		x		version %d
>
>#
># SMJPEG. A custom Motion JPEG format used by Loki Entertainment
># Software Torbjorn Andersson <d91tan@Update.UU.SE>.
>#
>0	string	\0\nSMJPEG	SMJPEG
>>8	belong	x		%d.x data
># According to the specification you could find any number of _TXT
># headers here, but I can't think of any way of handling that. None of
># the SMJPEG files I tried it on used this feature. Even if such a
># file is encountered the output should still be reasonable.
>>16	string	_SND		\b,
>>>24	beshort	>0		%d Hz
>>>26	byte	8		8-bit
>>>26	byte	16		16-bit
>>>28	string	NONE		uncompressed
># >>28	string	APCM		ADPCM compressed
>>>27	byte	1		mono
>>>28	byte	2		stereo
># Help! Isn't there any way to avoid writing this part twice?
>>>32	string	_VID		\b,
># >>>48	string	JFIF		JPEG
>>>>40	belong	>0		%d frames
>>>>44	beshort	>0		(%d x
>>>>46	beshort	>0		%d)
>>16	string	_VID		\b,
># >>32	string	JFIF		JPEG
>>>24	belong	>0		%d frames
>>>28	beshort	>0		(%d x
>>>30	beshort	>0		%d)
>
>0	string	Paint\ Shop\ Pro\ Image\ File	Paint Shop Pro Image File
>
># "thumbnail file" (icon)
># descended from "xv", but in use by other applications as well (Wolfram Kleff)
>0       string          P7\ 332         XV "thumbnail file" (icon) data
>
># taken from fkiss: (<yav@mte.biglobe.ne.jp> ?)
>0       string          KiSS            KISS/GS
>>4      byte            16              color
>>>5     byte            x               %d bit
>>>8     leshort         x               %d colors
>>>10    leshort         x               %d groups
>>4      byte            32              cell
>>>5     byte            x               %d bit
>>>8     leshort         x               %d x
>>>10    leshort         x               %d
>>>12    leshort         x               +%d
>>>14    leshort         x               +%d
>
># Webshots (www.webshots.com), by John Harrison
>0       string          C\253\221g\230\0\0\0 Webshots Desktop .wbz file
>
># Hercules DASD image files
># From Jan Jaeger <jj@septa.nl>
>0       string  CKD_P370        Hercules CKD DASD image file
>>8      long    x               \b, %d heads per cylinder
>>12     long    x               \b, track size %d bytes
>>16     byte    x               \b, device type 33%2.2X
>
>0       string  CKD_C370        Hercules compressed CKD DASD image file
>>8      long    x               \b, %d heads per cylinder
>>12     long    x               \b, track size %d bytes
>>16     byte    x               \b, device type 33%2.2X
>
>0       string  CKD_S370        Hercules CKD DASD shadow file
>>8      long    x               \b, %d heads per cylinder
>>12     long    x               \b, track size %d bytes
>>16     byte    x               \b, device type 33%2.2X
>
># Squeak images and - etoffi@softhome.net
>0 string \146\031\0\0  Squeak image data
>0 string 'From\040Squeak  Squeak program text
>
># partimage: file(1) magic for PartImage files (experimental, incomplete)
># Author: Hans-Joachim Baader <hjb@pro-linux.de>
>0		string	PaRtImAgE-VoLuMe	PartImage
>>0x0020		string	0.6.1		file version %s
>>>0x0060	lelong	>-1		volume %ld
>#>>0x0064 8 byte identifier
>#>>0x007c reserved
>>>0x0200	string	>\0		type %s
>>>0x1400	string	>\0		device %s,
>>>0x1600	string	>\0		original filename %s,
># Some fields omitted
>>>0x2744	lelong	0		not compressed
>>>0x2744	lelong	1		gzip compressed
>>>0x2744	lelong	2		bzip2 compressed
>>>0x2744	lelong	>2		compressed with unknown algorithm
>>0x0020		string	>0.6.1		file version %s
>>0x0020		string	<0.6.1		file version %s
>
># DCX is multi-page PCX, using a simple header of up to 1024
># offsets for the respective PCX components.
># From: Joerg Wunsch <joerg_wunsch@uriah.heep.sax.de>
>0	lelong	987654321	DCX multi-page PCX image data
>
># Simon Walton <simonw@matteworld.com>
># Kodak Cineon format for scanned negatives
># http://www.kodak.com/US/en/motion/support/dlad/
>0	lelong  0xd75f2a80	Cineon image data
>>200	belong  >0		\b, %ld x
>>204	belong  >0		%ld
>
>
># Bio-Rad .PIC is an image format used by microscope control systems
># and related image processing software used by biologists.
># From: Vebjorn Ljosa <vebjorn@ljosa.com>
>54	leshort 12345		Bio-Rad .PIC Image File
>>0	leshort >0		%hd x
>>2	leshort >0		%hd,
>>4	leshort =1		1 image in file
>>4	leshort >1		%hd images in file
>
># From Jan "Yenya" Kasprzak <kas@fi.muni.cz>
># The description of *.mrw format can be found at
># http://www.dalibor.cz/minolta/raw_file_format.htm
>0	string	\000MRM			Minolta Dimage camera raw image data
>
># From: stephane.loeuillet@tiscali.f
># http://www.djvuzone.org/
>0	string	AT&TFORM		DjVu Image file
>
># From: Jason Bacon <bacon@smithers.neuro.mcw.edu>
>0	beshort	0x3020			character Computer Graphics Metafile
>
># From Marc Espie
>0	lelong	20000630		OpenEXR image data
>
># From: Tom Hilinski <tom.hilinski@comcast.net>
># http://www.unidata.ucar.edu/packages/netcdf/
>0	string	CDF\001			NetCDF Data Format data
>
>#-----------------------------------------------------------------------
># Hierarchical Data Format, used to facilitate scientific data exchange
># specifications at http://hdf.ncsa.uiuc.edu/
>0	belong	0x0e031301	Hierarchical Data Format (version 4) data
>0	string	\211HDF\r\n\032	Hierarchical Data Format (version 5) data
>
>#------------------------------------------------------------------------------
># intel:  file(1) magic for x86 Unix
>#
># Various flavors of x86 UNIX executable/object (other than Xenix, which
># is in "microsoft").  DOS is in "msdos"; the ambitious soul can do
># Windows as well.
>#
># Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
># whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
># as well, if, as, and when IBM makes it portable.
>#
># The `versions' should be un-commented if they work for you.
># (Was the problem just one of endianness?)
>#
>0	leshort		0502		basic-16 executable
>>12	lelong		>0		not stripped
>#>22	leshort		>0		- version %ld
>0	leshort		0503		basic-16 executable (TV)
>>12	lelong		>0		not stripped
>#>22	leshort		>0		- version %ld
>0	leshort		0510		x86 executable
>>12	lelong		>0		not stripped
>0	leshort		0511		x86 executable (TV)
>>12	lelong		>0		not stripped
>0	leshort		=0512		iAPX 286 executable small model (COFF)
>>12	lelong		>0		not stripped
>#>22	leshort		>0		- version %ld
>0	leshort		=0522		iAPX 286 executable large model (COFF)
>>12	lelong		>0		not stripped
>#>22	leshort		>0		- version %ld
># SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
>0	leshort		=0514		80386 COFF executable
>>12	lelong		>0		not stripped
>>22	leshort		>0		- version %ld
>
># rom: file(1) magic for BIOS ROM Extensions found in intel machines
>#      mapped into memory between 0xC0000 and 0xFFFFF
># From GÃ¼rkan SengÃ¼n <gurkan@linuks.mine.nu>, www.linuks.mine.nu
>0        beshort         0x55AA       BIOS (ia32) ROM Ext.
>>5       string          USB          USB
>>7       string          LDR          UNDI image
>>30      string          IBM          IBM comp. Video
>>26      string          Adaptec      Adaptec
>>28      string          Adaptec      Adaptec
>>42      string          PROMISE      Promise
>>2       byte            x            (%d*512)
>
>#------------------------------------------------------------------------------
># interleaf:  file(1) magic for InterLeaf TPS:
>#
>0	string		=\210OPS	Interleaf saved data
>0	string		=<!OPS		Interleaf document text
>>5	string		,\ Version\ =	\b, version
>>>17	string		>\0		%.3s
>
>#------------------------------------------------------------------------------
># island:  file(1) magic for IslandWite/IslandDraw, from SunOS 5.5.1
># "/etc/magic":
># From: guy@netapp.com (Guy Harris)
>#
>4	string		pgscriptver	IslandWrite document
>13	string		DrawFile	IslandDraw document
>
>
>#------------------------------------------------------------------------------
># ispell:  file(1) magic for ispell
>#
># Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
># will match 0x9600 through 0x9603 in *both* little endian and big endian.
># (No other current magic entries collide.)
>#
># Updated by Daniel Quinlan (quinlan@yggdrasil.com)
>#
>0	leshort&0xFFFC	0x9600		little endian ispell
>>0	byte		0		hash file (?),
>>0	byte		1		3.0 hash file,
>>0	byte		2		3.1 hash file,
>>0	byte		3		hash file (?),
>>2	leshort		0x00		8-bit, no capitalization, 26 flags
>>2	leshort		0x01		7-bit, no capitalization, 26 flags
>>2	leshort		0x02		8-bit, capitalization, 26 flags
>>2	leshort		0x03		7-bit, capitalization, 26 flags
>>2	leshort		0x04		8-bit, no capitalization, 52 flags
>>2	leshort		0x05		7-bit, no capitalization, 52 flags
>>2	leshort		0x06		8-bit, capitalization, 52 flags
>>2	leshort		0x07		7-bit, capitalization, 52 flags
>>2	leshort		0x08		8-bit, no capitalization, 128 flags
>>2	leshort		0x09		7-bit, no capitalization, 128 flags
>>2	leshort		0x0A		8-bit, capitalization, 128 flags
>>2	leshort		0x0B		7-bit, capitalization, 128 flags
>>2	leshort		0x0C		8-bit, no capitalization, 256 flags
>>2	leshort		0x0D		7-bit, no capitalization, 256 flags
>>2	leshort		0x0E		8-bit, capitalization, 256 flags
>>2	leshort		0x0F		7-bit, capitalization, 256 flags
>>4	leshort		>0		and %d string characters
>0	beshort&0xFFFC	0x9600		big endian ispell
>>1	byte		0		hash file (?),
>>1	byte		1		3.0 hash file,
>>1	byte		2		3.1 hash file,
>>1	byte		3		hash file (?),
>>2	beshort		0x00		8-bit, no capitalization, 26 flags
>>2	beshort		0x01		7-bit, no capitalization, 26 flags
>>2	beshort		0x02		8-bit, capitalization, 26 flags
>>2	beshort		0x03		7-bit, capitalization, 26 flags
>>2	beshort		0x04		8-bit, no capitalization, 52 flags
>>2	beshort		0x05		7-bit, no capitalization, 52 flags
>>2	beshort		0x06		8-bit, capitalization, 52 flags
>>2	beshort		0x07		7-bit, capitalization, 52 flags
>>2	beshort		0x08		8-bit, no capitalization, 128 flags
>>2	beshort		0x09		7-bit, no capitalization, 128 flags
>>2	beshort		0x0A		8-bit, capitalization, 128 flags
>>2	beshort		0x0B		7-bit, capitalization, 128 flags
>>2	beshort		0x0C		8-bit, no capitalization, 256 flags
>>2	beshort		0x0D		7-bit, no capitalization, 256 flags
>>2	beshort		0x0E		8-bit, capitalization, 256 flags
>>2	beshort		0x0F		7-bit, capitalization, 256 flags
>>4	beshort		>0		and %d string characters
># ispell 4.0 hash files  kromJx <kromJx@crosswinds.net>
># Ispell 4.0
>0       string          ISPL            ispell
>>4      long            x               hash file version %d,
>>8      long            x               lexletters %d,
>>12     long            x               lexsize %d,
>>16     long            x               hashsize %d,
>>20     long            x               stblsize %d
>#------------------------------------------------------------
># Java ByteCode
># From Larry Schwimmer (schwim@cs.stanford.edu)
># Handled in Mach now
>#0	belong		0xcafebabe	compiled Java class data,
>#>6	beshort x	version %d.
>#>4	beshort x	\b%d
>#------------------------------------------------------------
># Java serialization
># From Martin Pool (m.pool@pharos.com.au)
>0	beshort		0xaced		Java serialization data
>>2	beshort		>0x0004		\b, version %d
>
>#------------------------------------------------------------------------------
># JPEG images
># SunOS 5.5.1 had
>#
>#	0	string		\377\330\377\340	JPEG file
>#	0	string		\377\330\377\356	JPG file
>#
># both of which turn into "JPEG image data" here.
>#
>0	beshort		0xffd8		JPEG image data
>>6	string		JFIF		\b, JFIF standard
># The following added by Erik Rossen <rossen@freesurf.ch> 1999-09-06
># in a vain attempt to add image size reporting for JFIF.  Note that these
># tests are not fool-proof since some perfectly valid JPEGs are currently
># impossible to specify in magic(4) format.
># First, a little JFIF version info:
>>>11	byte		x		\b %d.
>>>12	byte		x		\b%02d
># Next, the resolution or aspect ratio of the image:
>#>>13	byte		0		\b, aspect ratio
>#>>13	byte		1		\b, resolution (DPI)
>#>>13	byte		2		\b, resolution (DPCM)
>#>>4	beshort		x		\b, segment length %d
># Next, show thumbnail info, if it exists:
>>>18	byte		!0		\b, thumbnail %dx
>>>>19	byte		x		\b%d
>
># EXIF moved down here to avoid reporting a bogus version number,
># and EXIF version number printing added.
>#   - Patrik R=E5dman <patrik+file-magic@iki.fi>
>>6	string		Exif		\b, EXIF standard
># Look for EXIF IFD offset in IFD 0, and then look for EXIF version tag in EXIF IFD.
># All possible combinations of entries have to be enumerated, since no looping
># is possible. And both endians are possible...
># The combinations included below are from real-world JPEGs.
># Little-endian
>>>12	string		II		
># IFD 0 Entry #5:
>>>>70	leshort		0x8769          
># EXIF IFD Entry #1:
>>>>>(78.l+14)	leshort	0x9000		
>>>>>>(78.l+23)	byte	x		%c
>>>>>>(78.l+24)	byte	x		\b.%c
>>>>>>(78.l+25)	byte	!0x30		\b%c
># IFD 0 Entry #9:
>>>>118	leshort		0x8769          
># EXIF IFD Entry #3:
>>>>>(126.l+38)	leshort	0x9000		
>>>>>>(126.l+47)	byte	x		%c
>>>>>>(126.l+48)	byte	x		\b.%c
>>>>>>(126.l+49)	byte	!0x30		\b%c
># IFD 0 Entry #10
>>>>130	leshort		0x8769          
># EXIF IFD Entry #3:
>>>>>(138.l+38)	leshort	0x9000		
>>>>>>(138.l+47)	byte	x		%c
>>>>>>(138.l+48)	byte	x		\b.%c
>>>>>>(138.l+49)	byte	!0x30		\b%c
># EXIF IFD Entry #4:
>>>>>(138.l+50)	leshort	0x9000		
>>>>>>(138.l+59)	byte	x		%c
>>>>>>(138.l+60)	byte	x		\b.%c
>>>>>>(138.l+61)	byte	!0x30		\b%c
># EXIF IFD Entry #5:
>>>>>(138.l+62)	leshort	0x9000		
>>>>>>(138.l+71)	byte	x		%c
>>>>>>(138.l+72)	byte	x		\b.%c
>>>>>>(138.l+73)	byte	!0x30		\b%c
># IFD 0 Entry #11
>>>>142	leshort		0x8769          
># EXIF IFD Entry #3:
>>>>>(150.l+38)	leshort	0x9000		
>>>>>>(150.l+47)	byte	x		%c
>>>>>>(150.l+48)	byte	x		\b.%c
>>>>>>(150.l+49)	byte	!0x30		\b%c
># EXIF IFD Entry #4:
>>>>>(150.l+50)	leshort	0x9000		
>>>>>>(150.l+59)	byte	x		%c
>>>>>>(150.l+60)	byte	x		\b.%c
>>>>>>(150.l+61)	byte	!0x30		\b%c
># EXIF IFD Entry #5:
>>>>>(150.l+62)	leshort	0x9000		
>>>>>>(150.l+71)	byte	x		%c
>>>>>>(150.l+72)	byte	x		\b.%c
>>>>>>(150.l+73)	byte	!0x30		\b%c
># Big-endian
>>>12	string		MM		
># IFD 0 Entry #9:
>>>>118	beshort		0x8769          
># EXIF IFD Entry #1:
>>>>>(126.L+14)	beshort	0x9000		
>>>>>>(126.L+23)	byte	x		%c
>>>>>>(126.L+24)	byte	x		\b.%c
>>>>>>(126.L+25)	byte	!0x30		\b%c
># EXIF IFD Entry #3:
>>>>>(126.L+38)	beshort	0x9000		
>>>>>>(126.L+47)	byte	x		%c
>>>>>>(126.L+48)	byte	x		\b.%c
>>>>>>(126.L+49)	byte	!0x30		\b%c
># IFD 0 Entry #10
>>>>130	beshort		0x8769          
># EXIF IFD Entry #3:
>>>>>(138.L+38)	beshort	0x9000		
>>>>>>(138.L+47)	byte	x		%c
>>>>>>(138.L+48)	byte	x		\b.%c
>>>>>>(138.L+49)	byte	!0x30		\b%c
># EXIF IFD Entry #5:
>>>>>(138.L+62)	beshort	0x9000		
>>>>>>(138.L+71)	byte	x		%c
>>>>>>(138.L+72)	byte	x		\b.%c
>>>>>>(138.L+73)	byte	!0x30		\b%c
># IFD 0 Entry #11
>>>>142	beshort		0x8769          
># EXIF IFD Entry #4:
>>>>>(150.L+50)	beshort	0x9000		
>>>>>>(150.L+59)	byte	x		%c
>>>>>>(150.L+60)	byte	x		\b.%c
>>>>>>(150.L+61)	byte	!0x30		\b%c
># Here things get sticky.  We can do ONE MORE marker segment with
># indirect addressing, and that's all.  It would be great if we could
># do pointer arithemetic like in an assembler language.  Christos?
># And if there was some sort of looping construct to do searches, plus a few
># named accumulators, it would be even more effective...
># At least we can show a comment if no other segments got inserted before:
>>(4.S+5)	byte		0xFE
>>>(4.S+8)	string		>\0		\b, comment: "%s"
>#>(4.S+5)	byte		0xFE		\b, comment
>#>>(4.S+6)	beshort		x		\b length=%d
>#>>(4.S+8)	string		>\0		\b, "%s"
># Or, we can show the encoding type (I've included only the three most common)
># and image dimensions if we are lucky and the SOFn (image segment) is here:
>>(4.S+5)	byte		0xC0		\b, baseline
>>>(4.S+6)	byte		x		\b, precision %d
>>>(4.S+7)	beshort		x		\b, %dx
>>>(4.S+9)	beshort		x		\b%d
>>(4.S+5)	byte		0xC1		\b, extended sequential
>>>(4.S+6)	byte		x		\b, precision %d
>>>(4.S+7)	beshort		x		\b, %dx
>>>(4.S+9)	beshort		x		\b%d
>>(4.S+5)	byte		0xC2		\b, progressive
>>>(4.S+6)	byte		x		\b, precision %d
>>>(4.S+7)	beshort		x		\b, %dx
>>>(4.S+9)	beshort		x		\b%d
># I've commented-out quantisation table reporting.  I doubt anyone cares yet.
>#>(4.S+5)	byte		0xDB		\b, quantisation table
>#>>(4.S+6)	beshort		x		\b length=%d
>#>14	beshort		x		\b, %d x
>#>16	beshort		x		\b %d
>
># HSI is Handmade Software's proprietary JPEG encoding scheme
>0	string		hsi1		JPEG image data, HSI proprietary
>
># From: David Santinoli <david@santinoli.com>
>0	string		\x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A	JPEG 2000 image data
>#------------------------------------------------------------------------------
># lxkernel: file(1) magic for Linux/i386 Kernel
># compiled Linux-kernel submitted by Hans Lermen lermen@elserv.ffm.fgan.de
>0x202			string		HdrS		Linux
>>0x1fe			leshort		0xAA55		\b/x86 Kernel
>>0x1fe			leshort		<0xAA55		Kernel
>>0x1fe			leshort		>0xAA55		Kernel
>>0x206			leshort		0x0105		\b, Setup Version 0x105, zImage
>>0x206			leshort		>0x0105		\b, Setup Version %#hx
>>>0x211			byte		0		\b, zImage
>>>0x211			byte		1		\b, bzImage
>>>>(0x20e.s+0x205)	byte		32
>>>>>(0x20e.s+0x200)	string		>\0		\b, Version %5.5s
>>>>(0x20e.s+0x206)	byte		32
>>>>>(0x20e.s+0x200)	string		>\0		\b, Version %6.6s
>>>>(0x20e.s+0x207)	byte		32
>>>>>(0x20e.s+0x200)	string		>\0		\b, Version %7.7s
>>>>(0x20e.s+0x205)	byte		45
>>>>>(0x20e.s+0x200)	string		>\0		\b, Version %s
>>>>(0x20e.s+0x206)	byte		45
>>>>>(0x20e.s+0x200)	string		>\0		\b, Version %s
>>>>(0x20e.s+0x207)	byte		45
>>>>>(0x20e.s+0x200)	string		>\0		\b, Version %s
>>>0x1f2			leshort		1		\b, RO-rootFS
>>>0x1f2			leshort		0		\b, RW-rootFS
>>>0x1fc			leshort		>0		\b, root_dev 0x%X
>>>0x1f6			leshort		>0		\b, swap_dev 0x%X
>>>0x1f8			leshort		>0		\b, RAMdisksize %u KB
>>>0x1fa			leshort		0xFFFF		\b, Normal VGA
>>>0x1fa			leshort		0xFFFE		\b, Extended VGA
>>>0x1fa			leshort		0xFFFD		\b, Prompt for Videomode
>>>0x1fa			leshort		>0		\b, Video mode %d
>
>0x1e3			string		Loading		Linux/i386 Kernel zImage
>
>#------------------------------------------------------------------------------
># filesystems:  file(1) magic for different filesystems
>#
>0	string	\366\366\366\366	PC formatted floppy with no filesystem
># Sun disk labels
># From /usr/include/sun/dklabel.h:
>0774	beshort		0xdabe		Sun disk label
>>0	string		x		'%s
>>>31  	string		>\0		\b%s
>>>>63  	string		>\0		\b%s
>>>>>95 	string		>\0		\b%s
>>0	string		x		\b'
>>0734	short		>0		%d rpm,
>>0736	short		>0		%d phys cys,
>>0740	short		>0		%d alts/cyl,
>>0746	short		>0		%d interleave,
>>0750	short		>0		%d data cyls,
>>0752	short		>0		%d alt cyls,
>>0754	short		>0		%d heads/partition,
>>0756	short		>0		%d sectors/track,
>>0764	long		>0		start cyl %ld,
>>0770	long		x		%ld blocks
># Is there a boot block written 1 sector in?
>>512    belong&077777777	0600407	\b, boot block present
># DOS Emulator image is 128 byte header + harddisc image
>0	string	DOSEMU\0			
>>0x27E	leshort	0xAA55			DOS Emulator image
>0x1FE	leshort	0xAA55			x86 boot sector
>>2	string	OSBS			\b, OS/BS MBR
># J\xf6rg Jenderek <joerg.jenderek@gmx.net>
>>0x8C	string	Invalid\ partition\ table	\b, MS-DOS MBR
># dr-dos with some upper-, lowercase variants
>>0x9D	string	Invalid\ partition\ table$	
>>>181	string	No\ Operating\ System$		
>>>>201	string	Operating\ System\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
>>0x9D	string	Invalid\ partition\ table$	
>>>181	string	No\ operating\ system$		
>>>>201	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, Version 7.01 to 7.03
>>342	string	Invalid\ partition\ table$	
>>>366	string	No\ operating\ system$		
>>>>386	string	Operating\ system\ load\ error$	\b, DR-DOS MBR, version 7.01 to 7.03
>>295	string	NEWLDR\0				
>>>302	string	Bad\ PT\ $				
>>>>310	string	No\ OS\ $				
>>>>>317	string	OS\ load\ err$				
>>>>>>329	string	Moved\ or\ missing\ IBMBIO.LDR\n\r	
>>>>>>>358	string	Press\ any\ key\ to\ continue.\n\r$	
>>>>>>>>387	string	Copyright\ (c)\ 1984,1998	
>>>>>>>>>411	string	Caldera\ Inc.\0		\b, DR-DOS MBR (IBMBIO.LDR)
>>0x10F	string	Ung\201ltige\ Partitionstabelle	\b, MS-DOS MBR, german version 4.10.1998, 4.10.2222
>>0x8B	string	Ung\201ltige\ Partitionstabelle	\b, MS-DOS MBR, german version 5.00 to 4.00.950
>>300	string	Invalid\ partition\ table\0	
>>>324	string	Error\ loading\ operating\ system\0
>>>>355	string	Missing\ operating\ system\0		\b, Microsoft Windows XP MBR
>#??>>>389	string	Invalid\ system\ disk		
>>300	string	Ung\201ltige\ Partitionstabelle
>#split string to avoid error: String too long
>>>328	string	Fehler\ beim\ Laden\ 	
>>>>346	string	des\ Betriebssystems	
>>>>>366	string	Betriebssystem\ nicht\ vorhanden	\b, Microsoft Windows XP MBR (german)
>>0x145	string	Default:\ F				\b, FREE-DOS MBR
>>64	string	no\ active\ partition\ found	
>>>96	string	read\ error\ while\ reading\ drive	\b, FREE-DOS Beta9 MBR
># bootloader, bootmanager
>>43	string	SMART\ BTMGRFAT12\ \ \ 		
>>>430	string	SBMK\ Bad!\r			
>>>>3	string	SBM				\b, Smart Boot Manager
>>>>>6	string	>\0                             \b, version %s
>>382	string	XOSLLOADXCF			\b, EXtended Operating System Loader
>>6	string	LILO				\b, LInux i386 boot LOader
>>>120	string	LILO				\b, version 22.3.4 SuSe
>>>172	string	LILO				\b, version 22.5.8 Debian
>>402	string	Geom\0Hard\ Disk\0Read\0\ Error\0
>>>394	string	stage1				\b, GRand Unified Bootloader (0.5.95)
>>380	string	Geom\0Hard\ Disk\0Read\0\ Error\0
>>>374	string	GRUB\ \0			\b, GRand Unified Bootloader
>>382	string	Geom\0Hard\ Disk\0Read\0\ Error\0
>>>376	string	GRUB\ \0			\b, GRand Unified Bootloader (0.93)
>>383	string	Geom\0Hard\ Disk\0Read\0\ Error\0
>>>377	string	GRUB\ \0			\b, GRand Unified Bootloader (0.94)
>>480	string	Boot\ failed\r			
>>>495	string	LDLINUX\ SYS			\b, SYSLINUX bootloader (2.06)
>>395	string	chksum\0\ ERROR!\0		\b, Gujin bootloader
>>185	string	FDBOOT\ Version\ 			
>>>204	string	\rNo\ Systemdisk.\ 			
>>>>220	string	Booting\ from\ harddisk.\n\r		
>>>>245	string	Cannot\ load\ from\ harddisk.\n\r	
>>>>>273 string	Insert\ Systemdisk\ 			
>>>>>>291 string and\ press\ any\ key.\n\r		\b, FDBOOT harddisk Bootloader
>>>>>>>200 string	>\0                             \b, version %-3s
>>242	string	Bootsector\ from\ C.H.\ Hochst\204	
>>>278	string	No\ Systemdisk.\ 			
>>>>293	string	Booting\ from\ harddisk.\n\r		
>>>>441	string	Cannot\ load\ from\ harddisk.\n\r	
>>>>>469 string	Insert\ Systemdisk\ 			
>>>>>>487 string and\ press\ any\ key.\n\r		\b, WinImage harddisk Bootloader
>>>>>>>209 string	>\0                             \b, version %-4.4s
>>(1.b+2)	ubyte		0xe			
>>>(1.b+3)	ubyte		0x1f			
>>>>(1.b+4)	ubyte		0xbe			
>>>>>(1.b+5)	ubyte		0x77			
>>>>>(1.b+6)	ubyte		0x7c			
>>>>>>(1.b+7)	ubyte		0xac			
>>>>>>>(1.b+8)	ubyte		0x22			
>>>>>>>>(1.b+9)	ubyte		0xc0			
>>>>>>>>>(1.b+10)	ubyte	0x74			
>>>>>>>>>>(1.b+11)	ubyte	0xb			
>>>>>>>>>>>(1.b+12)	ubyte	0x56			
>>>>>>>>>>>(1.b+13)	ubyte	0xb4			\b, mkdosfs boot message display
># XP
>>430	string	NTLDR\ is\ missing\xFF\r\n		
>>>449	string	Disk\ error\xFF\r\n			
>>>>462	string	Press\ any\ key\ to\ restart\r		\b, Microsoft Windows XP Bootloader
># DOS names like NTLDR,CMLDR,$LDR$ are 8 right space padded bytes+3 bytes
>>>>>417		ubyte		<0x7E 			
>>>>>>417	string		>\ 			%-.5s
>>>>>>>422	ubyte		<0x7E 			
>>>>>>>>422	string		>\ 			\b%-.3s
>>>>>>>425	string		>\ 			\b.%-.3s
>#
>>>>>368		ubyte		<0x7E 			
>>>>>>368	string		>\ 			%-.5s
>>>>>>>373	ubyte		<0x7E			
>>>>>>>>373	string		>\ 			\b%-.3s
>>>>>>>376	string		>\ 			\b.%-.3s
>#
>>430	string	NTLDR\ nicht\ gefunden\xFF\r\n		
>>>453	string	Datentr\204gerfehler\xFF\r\n		
>>>>473	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (german)
>>>>>417		ubyte		<0x7E 			
>>>>>>417	string		>\ 			%-.5s
>>>>>>>422	ubyte		<0x7E 			
>>>>>>>>422	string		>\ 			\b%-.3s
>>>>>>>425	string		>\ 			\b.%-.3s
>#
>>>>>368		ubyte		<0x7E 			
>>>>>>368	string		>\ 			%-.5s
>>>>>>>373	ubyte		<0x7E 			
>>>>>>>>373	string		>\ 			\b%-.3s
>>>>>>>376	string		>\ 			\b.%-.3s
>#
>>430	string	NTLDR\ fehlt\xFF\r\n			
>>>444	string	Datentr\204gerfehler\xFF\r\n		
>>>>464	string	Neustart\ mit\ beliebiger\ Taste\r	\b, Microsoft Windows XP Bootloader (2.german)
>>>>>417		ubyte		<0x7E 			
>>>>>>417	string		>\ 			%-.5s
>>>>>>>422	ubyte		<0x7E 			
>>>>>>>>422	string		>\ 			\b%-.3s
>>>>>>>425	string		>\ 			\b.%-.3s
>#
>>430	string	NTLDR\ fehlt\xFF\r\n			
>>>444	string	Medienfehler\xFF\r\n			
>>>>459	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (3.german)
>>>>>368		ubyte		<0x7E 			
>>>>>>368	string		>\ 			%-.5s
>>>>>>>373	ubyte		<0x7E			
>>>>>>>>373	string		>\ 			\b%-.3s
>>>>>>>376	string		>\ 			\b.%-.3s
>>>>>417		ubyte		<0x7E 			
>>>>>>417	string		>\ 			%-.5s
>>>>>>>422	ubyte		<0x7E 			
>>>>>>>>422	string		>\ 			\b%-.3s
>>>>>>>425	string		>\ 			\b.%-.3s
>#
>>430	string	Datentr\204ger\ entfernen\xFF\r\n	
>>>454	string	Medienfehler\xFF\r\n			
>>>>469	string	Neustart:\ Taste\ dr\201cken\r		\b, Microsoft Windows XP Bootloader (4.german)
>>>>>368		ubyte		<0x7E 			
>>>>>>368	string		>\ 			%-.5s
>>>>>>>373	ubyte		<0x7E			
>>>>>>>>373	string		>\ 			\b%-.3s
>>>>>>>376	string		>\ 			\b.%-.3s
>#>3	string	NTFS\ \ \ \ 				
>>389	string	Fehler\ beim\ Lesen\ 
>>>407	string	des\ Datentr\204gers
>>>>426	string	NTLDR\ fehlt				
>>>>>440	string	NTLDR\ ist\ komprimiert
>>>>>>464 string	Neustart\ mit\ Strg+Alt+Entf\r		\b, Microsoft Windows XP Bootloader NTFS (german)
>#>3	string	NTFS\ \ \ \ 				
>>313	string	A\ disk\ read\ error\ occurred.\r
>>>345	string	A\ kernel\ file\ is\ missing\ 	
>>>>370	string	from\ the\ disk.\r		
>>>>>484	string	NTLDR\ is\ compressed		
>>>>>>429 string	Insert\ a\ system\ diskette\ 	
>>>>>>>454 string and\ restart\r\nthe\ system.\r		\b, Microsoft Windows XP Bootloader NTFS
># DOS loader variants different languages,offsets
>>472	string	IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS		
>>>497	string	WINBOOT\ SYS				
>>>389	string	Invalid\ system\ disk\xFF\r\n		
>>>>411	string	Disk\ I/O\ error			
>>>>>428	string	Replace\ the\ disk,\ and\ 		
>>>>>>455 string	press\ any\ key				\b, Microsoft Windows 98 Bootloader
>#
>>>390	string	Invalid\ system\ disk\xFF\r\n		
>>>>412	string	Disk\ I/O\ error\xFF\r\n		
>>>>>429	string	Replace\ the\ disk,\ and\ 		
>>>>>>451 string	then\ press\ any\ key\r			\b, Microsoft Windows 98 Bootloader
>>>388	string	Ungueltiges\ System\ \xFF\r\n		
>>>>410	string	E/A-Fehler\ \ \ \ \xFF\r\n		
>>>>>427	string	Datentraeger\ wechseln\ und\ 		
>>>>>>453 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (german)
>#
>>>390	string	Ungueltiges\ System\ \xFF\r\n		
>>>>412	string	E/A-Fehler\ \ \ \ \xFF\r\n		
>>>>>429	string	Datentraeger\ wechseln\ und\ 		
>>>>>>455 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (German)
>#
>>>389	string	Ungueltiges\ System\ \xFF\r\n		
>>>>411	string	E/A-Fehler\ \ \ \ \xFF\r\n		
>>>>>428	string	Datentraeger\ wechseln\ und\ 		
>>>>>>454 string	Taste\ druecken\r			\b, Microsoft Windows 95/98/ME Bootloader (GERMAN)
>>479	string	IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS		
>>>416	string	Kein\ System\ oder\ 			
>>>>433	string	Laufwerksfehler				
>>>>>450	string	Wechseln\ und\ Taste\ dr\201cken	\b, Microsoft DOS Bootloader (german)
>>486	string	IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS		
>>>416	string	Non-System\ disk\ or\ 			
>>>>435	string	disk\ error\r				
>>>>>447	string	Replace\ and\ press\ any\ key\ 		
>>>>>>473 string	when\ ready\r				\b, Microsoft DOS Bootloader
>>480	string	IO\ \ \ \ \ \ SYSMSDOS\ \ \ SYS		
>>>393	string	Non-System\ disk\ or\ 			
>>>>412	string	disk\ error\r				
>>>>>424	string	Replace\ and\ press\ any\ key\ 		
>>>>>>450 string	when\ ready\r				\b, Microsoft DOS bootloader
>#>43	string	\224R-LOADER\ \ SYS			=label					
>>54	string	SYS
>>>324	string	VASKK
>>>>495	string	NEWLDR\0				\b, DR-DOS Bootloader (LOADER.SYS)
>#
>>70	string	IBMBIO\ \ COM				
>>>472	string	Cannot\ load\ DOS!\ 			
>>>>489	string	Any\ key\ to\ retry			\b, DR-DOS Bootloader
>>>471	string	Cannot\ load\ DOS\ 			
>>>487	string	press\ key\ to\ retry			\b, Open-DOS Bootloader
>>444	string	KERNEL\ \ SYS					
>>>314	string	BOOT\ error!				\b, FREE-DOS Bootloader
>>499	string	KERNEL\ \ SYS				
>>>305	string	BOOT\ err!\0				\b, Free-DOS Bootloader
>>449	string	KERNEL\ \ SYS				
>>>319	string	BOOT\ error!				\b, FREE-DOS 5.0 Bootloader
>>124	string	FreeDOS\0				
>>>331	string	\ err\0					\b, FREE-DOS BETa 9 Bootloader
># DOS names like KERNEL.SYS,KERNEL16.SYS,KERNEL32.SYS,METAKERN.SYS are 8 right space padded bytes+3 bytes
>>>>497		string		>\ 			%-.6s
>>>>>503		string		>\ 			\b%-.1s
>>>>>504		string		>\ 			\b%-.1s
>>>>505		string		>\ 			\b.%-.3s
>>>333	string	\ err\0					\b, FREE-DOS BEta 9 Bootloader
>>>>497		string		>\ 			%-.6s
>>>>>503		string		>\ 			\b%-.1s
>>>>>504		string		>\ 			\b%-.1s
>>>>505		string		>\ 			\b.%-.3s
>>>334	string	\ err\0					\b, FREE-DOS Beta 9 Bootloader
>>>>497		string		>\ 			%-.6s
>>>>>503		string		>\ 			\b%-.1s
>>>>>504		string		>\ 			\b%-.1s
>>>>505		string		>\ 			\b.%-.3s
># loader end
>>0	string	\0\0\0\0		\b, extended partition table
># JuMP short     bootcodeoffset NOP assembler instructions will usually be EB xx 90
># older drives may use E9 xx xx
>>0		lelong&0x009000EB	0x009000EB 
>>0		lelong&0x000000E9	0x000000E9 
>>>1		ubyte			>37	\b, code offset 0x%x
># mtools-3.9.8/msdos.h
># usual values are marked with comments to get only informations of strange FAT systems
># valid sectorsize are from 32 to 2048
>>>>11		uleshort	<2049	
>>>>>11		uleshort	>31	
>>>>>>3		string		>\0		\b, OEM-ID "%8.8s"
>>>>>>11		uleshort	>512		\b, Bytes/sector %u
>#>>>>>11	uleshort	=512		\b, Bytes/sector %u=512 (usual)
>>>>>>11		uleshort	<512		\b, Bytes/sector %u
>>>>>>13		ubyte		>1		\b, sectors/cluster %u
>#>>>>>13	ubyte		=1		\b, sectors/cluster %u (usual on Floppies)
>>>>>>14		uleshort	>32		\b, reserved sectors %u
>#>>>>>14	uleshort	=32		\b, reserved sectors %u (usual Fat32)
>#>>>>>14	uleshort	>1		\b, reserved sectors %u
>#>>>>>14	uleshort	=1		\b, reserved sectors %u (usual FAT12,FAT16)
>>>>>>14		uleshort	<1		\b, reserved sectors %u
>>>>>>16		ubyte		>2		\b, FATs %u
>#>>>>>16	ubyte		=2		\b, FATs %u (usual)
>>>>>>16		ubyte		=1		\b, FAT  %u
>>>>>>16		ubyte		>0
>>>>>>17		uleshort	>0		\b, root entries %u
>#>>>>>17	uleshort	=0		\b, root entries %u=0 (usual Fat32)
>>>>>>19		uleshort	>0		\b, sectors %u (volumes <=32 MB) 
>#>>>>>19	uleshort	=0		\b, sectors %u=0 (usual Fat32)
>>>>>>21		ubyte		>0xF0		\b, Media descriptor 0x%x
>#>>>>>21	ubyte		=0xF0		\b, Media descriptor 0x%x (usual floppy)
>>>>>>21		ubyte		<0xF0		\b, Media descriptor 0x%x
>>>>>>22		uleshort	>0		\b, sectors/FAT %u
>#>>>>>22	uleshort	=0		\b, sectors/FAT %u=0 (usual Fat32)
>>>>>>26		ubyte		>2		\b, heads %u
>#>>>>>26	ubyte		=2		\b, heads %u (usual floppy)
>>>>>>26		ubyte		=1		\b, heads %u
>>>>>>28		ulelong		>0		\b, hidden sectors %u
>#>>>>>28	ulelong		=0		\b, hidden sectors %u (usual floppy)
>>>>>>32		ulelong		>0		\b, sectors %u (volumes > 32 MB) 
>#>>>>>32	ulelong		=0		\b, sectors %u (volumes > 32 MB) 
># FAT<32 specific 
># NOT le FAT3=NOT 3TAF=0xCCABBEB9
>>>>>>82		ulelong&0xCCABBEB9	>0
>>>>>>>36	ubyte		>0x80		\b, physical drive 0x%x
>#>>>>>>36	ubyte		=0x80		\b, physical drive 0x%x=0x80 (usual harddisk)
>>>>>>>36	ubyte&0x7F	>0		\b, physical drive 0x%x
>#>>>>>>36	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
>>>>>>>37	ubyte		>0		\b, reserved 0x%x
>#>>>>>>37	ubyte		=0		\b, reserved 0x%x
>>>>>>>38	ubyte		>0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>>38	ubyte		<0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>>38	ubyte		=0x29
>>>>>>>>39	ulelong		x		\b, serial number 0x%x
>>>>>>>>43	string		<NO\ NAME	\b, label: "%11.11s"
>>>>>>>>43	string		>NO\ NAME	\b, label: "%11.11s"
>>>>>>>>43	string		=NO\ NAME	\b, unlabeled
>>>>>>>54	string		FAT1		\b, FAT
>>>>>>>>54	string		FAT12		\b (12 bit)
>>>>>>>>54	string		FAT16		\b (16 bit)
># FAT32 specific
>>>>>>82		string		FAT32		\b, FAT (32 bit)
>>>>>>>36	ulelong		x		\b, sectors/FAT %u
>>>>>>>40	uleshort	>0		\b, extension flags %u
>#>>>>>>40	uleshort	=0		\b, extension flags %u
>>>>>>>42	uleshort	>0		\b, fsVersion %u
>#>>>>>>42	uleshort	=0		\b, fsVersion %u (usual)
>>>>>>>44	ulelong		>2		\b, rootdir cluster %u
>#>>>>>>44	ulelong		=2		\b, rootdir cluster %u
>#>>>>>>44	ulelong		=1		\b, rootdir cluster %u
>>>>>>>48	uleshort	>1		\b, infoSector %u
>#>>>>>>48	uleshort	=1		\b, infoSector %u (usual)
>>>>>>>48	uleshort	<1		\b, infoSector %u
>>>>>>>50	uleshort	>6		\b, Backup boot sector %u
>#>>>>>>50	uleshort	=6		\b, Backup boot sector %u (usual) 
>>>>>>>50	uleshort	<6		\b, Backup boot sector %u
>>>>>>>54	ulelong		>0		\b, reserved1 0x%x
>>>>>>>58	ulelong		>0		\b, reserved2 0x%x
>>>>>>>62	ulelong		>0		\b, reserved3 0x%x
># same structure as FAT1X 
>>>>>>>64	ubyte		>0x80		\b, physical drive 0x%x
>#>>>>>>64	ubyte		=0x80		\b, physical drive 0x%x=80 (usual harddisk)
>>>>>>>64	ubyte&0x7F	>0		\b, physical drive 0x%x
>#>>>>>>64	ubyte		=0		\b, physical drive 0x%x=0 (usual floppy)
>>>>>>>65	ubyte		>0		\b, reserved 0x%x
>>>>>>>66	ubyte		>0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>>66	ubyte		<0x29		\b, dos < 4.0 BootSector (0x%x)
>>>>>>>66	ubyte		=0x29
>>>>>>>>67	ulelong		x		\b, serial number 0x%x
>>>>>>>>71	string		<NO\ NAME	\b, label: "%11.11s"
>>>>>>>71	string		>NO\ NAME	\b, label: "%11.11s"
>>>>>>>71	string		=NO\ NAME	\b, unlabeled
>### FATs end
>>0x200	lelong	0x82564557		\b, BSD disklabel
># FATX 
>0		string		FATX		FATX filesystem data
>
>
># Minix filesystems - Juan Cespedes <cespedes@debian.org>
>0x410	leshort		0x137f		Minix filesystem
>0x410	beshort		0x137f		Minix filesystem (big endian),
>>0x402	beshort		!0		\b, %d zones
>>0x1e	string		minix		\b, bootable
>0x410	leshort		0x138f		Minix filesystem, 30 char names
>0x410	leshort		0x2468		Minix filesystem, version 2
>0x410	leshort		0x2478		Minix filesystem, version 2, 30 char names
>
># romfs filesystems - Juan Cespedes <cespedes@debian.org>
>0	string		-rom1fs-\0	romfs filesystem, version 1
>>8	belong	x			%d bytes,
>>16	string	x			named %s.
>
># netboot image - Juan Cespedes <cespedes@debian.org>
>0	lelong		0x1b031336L	Netboot image,
>>4	lelong&0xFFFFFF00	0
>>>4	lelong&0x100	0x000		mode 2
>>>4	lelong&0x100	0x100		mode 3
>>4	lelong&0xFFFFFF00	!0	unknown mode
>
>0x18b	string	OS/2	OS/2 Boot Manager
>
>9564	lelong		0x00011954	Unix Fast File system (little-endian),
>>8404	string		x		last mounted on %s,
>#>9504	ledate		x		last checked at %s,
>>8224	ledate		x		last written at %s,
>>8401	byte		x		clean flag %d,
>>8228	lelong		x		number of blocks %d,
>>8232	lelong		x		number of data blocks %d,
>>8236	lelong		x		number of cylinder groups %d,
>>8240	lelong		x		block size %d,
>>8244	lelong		x		fragment size %d,
>>8252	lelong		x		minimum percentage of free blocks %d,
>>8256	lelong		x		rotational delay %dms,
>>8260	lelong		x		disk rotational speed %drps,
>>8320	lelong		0		TIME optimization
>>8320	lelong		1		SPACE optimization
>
>9564	belong		0x00011954	Unix Fast File system (big-endian),
>>7168   long		0x4c41424c	Apple UFS Volume
>>>7186  string		x		named %s,
>>>7176  belong		x		volume label version %d,
>>>7180  bedate		x		created on %s,
>>8404	string		x		last mounted on %s,
>#>9504	bedate		x		last checked at %s,
>>8224	bedate		x		last written at %s,
>>8401	byte		x		clean flag %d,
>>8228	belong		x		number of blocks %d,
>>8232	belong		x		number of data blocks %d,
>>8236	belong		x		number of cylinder groups %d,
>>8240	belong		x		block size %d,
>>8244	belong		x		fragment size %d,
>>8252	belong		x		minimum percentage of free blocks %d,
>>8256	belong		x		rotational delay %dms,
>>8260	belong		x		disk rotational speed %drps,
>>8320	belong		0		TIME optimization
>>8320	belong		1		SPACE optimization
>
># ext2/ext3 filesystems - Andreas Dilger <adilger@turbolabs.com>
>0x438	leshort		0xEF53		Linux
>>0x44c	lelong		x		rev %d
>>0x43e	leshort		x		\b.%d
>>0x45c	lelong		^0x0000004	ext2 filesystem data
>>>0x43a	leshort		^0x0000001	(mounted or unclean)
>>0x45c	lelong		&0x0000004	ext3 filesystem data
>>>0x460	lelong		&0x0000004	(needs journal recovery)
>>0x43a	leshort		&0x0000002	(errors)
>>0x460	lelong		&0x0000001	(compressed)
>#>0x460	lelong		&0x0000002	(filetype)
>#>0x464	lelong		&0x0000001	(sparse_super)
>>0x464	lelong		&0x0000002	(large files)
>
># SGI disk labels - Nathan Scott <nathans@debian.org>
>0	belong		0x0BE5A941	SGI disk label (volume header)
>
># SGI XFS filesystem - Nathan Scott <nathans@debian.org>
>0	belong		0x58465342	SGI XFS filesystem data
>>0x4	belong		x		(blksz %d,
>>0x68	beshort		x		inosz %d,
>>0x64	beshort		^0x2004		v1 dirs)
>>0x64	beshort		&0x2004		v2 dirs)
>
>############################################################################
># Minix-ST kernel floppy
>0x800	belong		0x46fc2700	Atari-ST Minix kernel image
>>19	string		\240\5\371\5\0\011\0\2\0	\b, 720k floppy
>>19	string		\320\2\370\5\0\011\0\1\0	\b, 360k floppy
>
>############################################################################
># Hmmm, is this a better way of detecting _standard_ floppy images ?
>19	string		\320\2\360\3\0\011\0\1\0	DOS floppy 360k
>>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
>19	string		\240\5\371\3\0\011\0\2\0	DOS floppy 720k
>>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
>19	string		\100\013\360\011\0\022\0\2\0	DOS floppy 1440k
>>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
>
>19	string		\240\5\371\5\0\011\0\2\0	DOS floppy 720k, IBM
>>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
>19	string		\100\013\371\5\0\011\0\2\0	DOS floppy 1440k, mkdosfs
>>0x1FE	leshort		0xAA55		\b, x86 hard disk boot sector
>
>19	string		\320\2\370\5\0\011\0\1\0	Atari-ST floppy 360k
>19	string		\240\5\371\5\0\011\0\2\0	Atari-ST floppy 720k
>
>#  Valid media descriptor bytes for MS-DOS:
>#
>#     Byte   Capacity   Media Size and Type
>#     -------------------------------------------------
>#
>#     F0     2.88 MB    3.5-inch, 2-sided, 36-sector
>#     F0     1.44 MB    3.5-inch, 2-sided, 18-sector
>#     F9     720K       3.5-inch, 2-sided, 9-sector
>#     F9     1.2 MB     5.25-inch, 2-sided, 15-sector
>#     FD     360K       5.25-inch, 2-sided, 9-sector
>#     FF     320K       5.25-inch, 2-sided, 8-sector
>#     FC     180K       5.25-inch, 1-sided, 9-sector
>#     FE     160K       5.25-inch, 1-sided, 8-sector
>#     FE     250K       8-inch, 1-sided, single-density
>#     FD     500K       8-inch, 2-sided, single-density
>#     FE     1.2 MB     8-inch, 2-sided, double-density
>#     F8     -----      Fixed disk 
>#
>#     FC     xxxK       Apricot 70x1x9 boot disk.
>#
># Originally a bitmap:
>#  xxxxxxx0	Not two sided
>#  xxxxxxx1	Double sided
>#  xxxxxx0x	Not 8 SPT
>#  xxxxxx1x	8 SPT
>#  xxxxx0xx	Not Removable drive
>#  xxxxx1xx	Removable drive
>#  11111xxx	Must be one.
>#
># But now it's rather random:
>#  111111xx	Low density disk
>#        00	SS, Not 8 SPT
>#        01	DS, Not 8 SPT
>#        10	SS, 8 SPT
>#        11	DS, 8 SPT
>#
>#  11111001	Double density 3½ floppy disk, high density 5¼
>#  11110000	High density 3½ floppy disk
>#  11111000	Hard disk any format
>#
>
># CDROM Filesystems
>32769    string    CD001     ISO 9660 CD-ROM filesystem data
># "application id" which appears to be used as a volume label
>>32808	 string    >\0       '%s'
>>34816	 string    \000CD001\001EL\ TORITO\ SPECIFICATION    (bootable)
>37633    string    CD001     ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors)
>32776    string    CDROM     High Sierra CD-ROM filesystem data
>
># cramfs filesystem - russell@coker.com.au
>0       lelong    0x28cd3d45      Linux Compressed ROM File System data, little endian
>>4      lelong  x size %d
>>8      lelong  &1 version #2
>>8      lelong  &2 sorted_dirs
>>8      lelong  &4 hole_support
>>32     lelong  x CRC 0x%x,
>>36     lelong  x edition %d,
>>40     lelong  x %d blocks,
>>44     lelong  x %d files
>
>0       belong    0x28cd3d45      Linux Compressed ROM File System data, big endian
>>4      belong  x size %d
>>8      belong  &1 version #2
>>8      belong  &2 sorted_dirs
>>8      belong  &4 hole_support
>>32     belong  x CRC 0x%x,
>>36     belong  x edition %d,
>>40     belong  x %d blocks,
>>44     belong  x %d files
>
># reiserfs - russell@coker.com.au
>0x10034		string	ReIsErFs	ReiserFS V3.5
>0x10034		string	ReIsEr2Fs	ReiserFS V3.6
>>0x1002c 	leshort	x		block size %d
>>0x10032	leshort	&2		(mounted or unclean)
>>0x10000	lelong	x		num blocks %d
>>0x10040	lelong	1		tea hash
>>0x10040	lelong	2		yura hash
>>0x10040	lelong	3		r5 hash
>
># JFFS - russell@coker.com.au
>0	lelong	0x34383931	Linux Journalled Flash File system, little endian
>0	belong	0x34383931	Linux Journalled Flash File system, big endian
>
># EST flat binary format (which isn't, but anyway)
># From: Mark Brown <broonie@sirena.org.uk>
>0	string	ESTFBINR	EST flat binary
>
># Aculab VoIP firmware
># From: Mark Brown <broonie@sirena.org.uk>
>0	string	VoIP\ Startup\ and	Aculab VoIP firmware
>>35	string	x	format %s
>
># PPCBoot image file
># From: Mark Brown <broonie@sirena.org.uk>
>0	belong	0x27051956	PPCBoot image
>>4	string  PPCBoot
>>>12	string  x		version %s
>
># JFFS2 file system
>0       leshort         0x1984                  Linux old jffs2 filesystem data little endian
>0       lelong          0xe0011985              Linux jffs2 filesystem data little endian
>
># Squashfs
>0	string	sqsh	Squashfs filesystem, big endian,
>>28	beshort	x	version %d.
>>30	beshort x	\b%d,
>>8	belong	x	%d bytes,
>>4	belong	x	%d inodes,
>>28	beshort <2
>>>32	beshort	x	blocksize: %d bytes,
>>28	beshort >1
>>>51	belong	x	blocksize: %d bytes,
>>39	bedate	x	created: %s
>0	string	hsqs	Squashfs filesystem, little endian,
>>28	leshort	x	version %d.
>>30	leshort	x	\b%d,
>>8	lelong	x	%d bytes,
>>4	lelong	x	%d inodes,
>>28	leshort <2
>>>32	leshort	x	blocksize: %d bytes,
>>28	leshort >1
>>>51	lelong	x	blocksize: %d bytes,
>>39	ledate	x	created: %s
>
>#------------------------------------------------------------------------------
># karma:  file(1) magic for Karma data files
>#
># From <rgooch@atnf.csiro.au>
>
>0	string		KarmaRHD Version	Karma Data Structure Version
>>16	belong		x		%lu
>#------------------------------------------------------------------------------
># DEC SRC Virtual Paper: Lectern files
># Karl M. Hegbloom <karlheg@inetarena.com>
>0	string	lect	DEC SRC Virtual Paper Lectern file
>
>#------------------------------------------------------------------------------
># lex:  file(1) magic for lex
>#
>#	derived empirically, your offsets may vary!
>53	string		yyprevious	C program text (from lex)
>>3	string		>\0		 for %s
># C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
>21	string		generated\ by\ flex	C program text (from flex)
># lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
>0	string		%{		lex description text
>
>#------------------------------------------------------------------------------
># lif:  file(1) magic for lif
>#
># (Daniel Quinlan <quinlan@yggdrasil.com>)
>#
>0	beshort		0x8000		lif file
>
>#------------------------------------------------------------------------------
># linux:  file(1) magic for Linux files
>#
># Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
># The following basic Linux magic is useful for reference, but using
># "long" magic is a better practice in order to avoid collisions.
>#
># 2	leshort		100		Linux/i386
># >0	leshort		0407		impure executable (OMAGIC)
># >0	leshort		0410		pure executable (NMAGIC)
># >0	leshort		0413		demand-paged executable (ZMAGIC)
># >0	leshort		0314		demand-paged executable (QMAGIC)
>#
>0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
>>16	lelong		0		\b, stripped
>0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
>>16	lelong		0		\b, stripped
>0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
>>16	lelong		0		\b, stripped
>0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
>>16	lelong		0		\b, stripped
>#
>0	string		\007\001\000	Linux/i386 object file
>>20	lelong		>0x1020		\b, DLL library
># Linux-8086 stuff:
>0	string		\01\03\020\04	Linux-8086 impure executable
>>28	long		!0		not stripped
>0	string		\01\03\040\04	Linux-8086 executable
>>28	long		!0		not stripped
>#
>0	string		\243\206\001\0	Linux-8086 object file
>#
>0	string		\01\03\020\20	Minix-386 impure executable
>>28	long		!0		not stripped
>0	string		\01\03\040\20	Minix-386 executable
>>28	long		!0		not stripped
># core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
>216	lelong		0421		Linux/i386 core file
>>220	string		>\0		of '%s'
>>200	lelong		>0		(signal %d)
>#
># LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
># this can be overridden by the DOS executable (COM) entry
>2	string		LILO		Linux/i386 LILO boot/chain loader
>#
># PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
>0	leshort		0x0436		Linux/i386 PC Screen Font data,
>>2	byte		0		256 characters, no directory,
>>2	byte		1		512 characters, no directory,
>>2	byte		2		256 characters, Unicode directory,
>>2	byte		3		512 characters, Unicode directory,
>>3	byte		>0		8x%d
># Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
>4086	string		SWAP-SPACE	Linux/i386 swap file
># From: Jeff Bailey <jbailey@ubuntu.com>
># Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com>
>4076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
># according to man page of mkswap (8) March 1999
>4086	string		SWAPSPACE2	Linux/i386 swap file (new style)
>>0x400	long		x		%d (4K pages)
>>0x404	long		x		size %d pages
># ECOFF magic for OSF/1 and Linux (only tested under Linux though)
>#
>#	from Erik Troan (ewt@redhat.com) examining od dumps, so this
>#		could be wrong
>#      updated by David Mosberger (davidm@azstarnet.com) based on
>#      GNU BFD and MIPS info found below.
>#
>0	leshort		0x0183		ECOFF alpha
>>24	leshort		0407		executable
>>24	leshort		0410		pure
>>24	leshort		0413		demand paged
>>8	long		>0		not stripped
>>8	long		0		stripped
>>23	leshort		>0		- version %ld.
>#
># Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
># and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
># and Nicolás Lichtmaier <nick@debian.org>
># All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
># Linux kernel boot images (i386 arch) (Wolfram Kleff)
>#514	string		HdrS		Linux kernel
>#>510	leshort		0xAA55		x86 boot executable
>#>>518	leshort		>=3D0x200
>#>>529	byte		0		zImage,
>#>>>529	byte		1		bzImage,
>#>>>(526.s+0x200) string	>\0		version %s,
>#>>498	leshort		1		RO-rootFS,
>#>>498	leshort		0		RW-rootFS,
>#>>508	leshort		>0		root_dev 0x%X,
>#>>502	leshort		>0		swap_dev 0x%X,
>#>>504	leshort		>0		RAMdisksize %u KB,
>#>>506	leshort		0xFFFF		Normal VGA
>#>>506	leshort		0xFFFE		Extended VGA
>#>>506	leshort		0xFFFD		Prompt for Videomode
>#>>506	leshort		>0		Video mode %d
># This also matches new kernels, which were caught above by "HdrS".
>#0		belong	0xb8c0078e	Linux kernel
>#>0x1e3		string	Loading		version 1.3.79 or older
>#>0x1e9		string	Loading		from prehistoric times
>
># System.map files - Nicolás Lichtmaier <nick@debian.org>
>8	string	\ A\ _text	Linux kernel symbol map text
>
># LSM entries - Nicolás Lichtmaier <nick@debian.org>
>0	string	Begin3	Linux Software Map entry text
>0	string	Begin4	Linux Software Map entry text (new format)
>
># From Matt Zimmerman
>0       belong  0x4f4f4f4d      User-mode Linux COW file
>>4      belong  x               \b, version %d
>>8      string  >\0             \b, backing file %s
>
>############################################################################
># Linux kernel versions
>
>0		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
>>497		leshort		0		x86 boot sector
>>>514		belong		0x8e	of a kernel from the dawn of time!
>>>514		belong		0x908ed8b4	version 0.99-1.1.42
>>>514		belong		0x908ed8b8	for memtest86
>
>>497		leshort		!0		x86 kernel
>>>504		leshort		>0		RAMdisksize=%u KB
>>>502		leshort		>0		swap=0x%X
>>>508		leshort		>0		root=0x%X
>>>>498		leshort		1		\b-ro
>>>>498		leshort		0		\b-rw
>>>506		leshort		0xFFFF		vga=normal
>>>506		leshort		0xFFFE		vga=extended
>>>506		leshort		0xFFFD		vga=ask
>>>506		leshort		>0		vga=%d
>>>514		belong		0x908ed881	version 1.1.43-1.1.45
>>>514		belong		0x15b281cd
>>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
>>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
>>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
>>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
>>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
>>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
>>>514		string		HdrS
>>>>518		leshort		>0x1FF
>>>>>529		byte		0		\b, zImage
>>>>>529		byte		1		\b, bzImage
>>>>>(526.s+0x200) string 	>\0		\b, version %s
>
># Linux boot sector thefts.
>0		belong		0xb8c0078e	Linux
>>0x1e6		belong		0x454c4b53	ELKS Kernel
>>0x1e6		belong		!0x454c4b53	style boot sector
>
>############################################################################
># Linux 8086 executable
>0	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
>>5	string		.		
>>>4	string		>\0		\b, libc version %s
>
>0	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
>>2	byte&0x01	!0		\b, unmapped zero page
>>2	byte&0x20	0		\b, impure
>>2	byte&0x20	!0
>>>2	byte&0x10	!0		\b, A_EXEC
>>2	byte&0x02	!0		\b, A_PAL
>>2	byte&0x04	!0		\b, A_NSYM
>>2	byte&0x08	!0		\b, A_STAND
>>2	byte&0x40	!0		\b, A_PURE
>>2	byte&0x80	!0		\b, A_TOVLY
>>28     long            !0              \b, not stripped
>>37	string		.		
>>>36	string		>\0		\b, libc version %s
>
># 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
># 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
># 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
># 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable
>
># SYSLINUX boot logo files (from 'ppmtolss16' sources)
># http://syslinux.zytor.com/
>#
>0	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
>>4	leshort	x			\b, width %d
>>6	leshort	x			\b, height %d
>
>#------------------------------------------------------------------------------
># lisp:  file(1) magic for lisp programs
>#
># various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
>
># This is a guess, but a good one.
>0	string	;;			Lisp/Scheme program text
>
># Emacs 18 - this is always correct, but not very magical.
>0	string	\012(			Emacs v18 byte-compiled Lisp data
># Emacs 19+ - ver. recognition added by Ian Springer
># Also applies to XEmacs 19+ .elc files; could tell them apart if we had regexp
># support or similar - Chris Chittleborough <cchittleborough@yahoo.com.au>
>0	string	;ELC			
>>4	byte	>19			
>>4	byte    <32			Emacs/XEmacs v%d byte-compiled Lisp data
>
># Files produced by CLISP Common Lisp From: Bruno Haible <haible@ilog.fr>
>0	string	(SYSTEM::VERSION\040'	CLISP byte-compiled Lisp program text
>0	long	0x70768BD2		CLISP memory image data
>0	long	0xD28B7670		CLISP memory image data, other endian
>
># Files produced by GNU gettext
>0	long	0xDE120495		GNU-format message catalog data
>0	long	0x950412DE		GNU-format message catalog data
>
>#.com and .bin for MIT scheme 
>0	string	\372\372\372\372	MIT scheme (library?)
>
># From: David Allouche <david@allouche.net>
>0	string	\<TeXmacs|	TeXmacs document text
>#------------------------------------------------------------------------------
># mach file description
>#
># Since Java bytecode and Mach-O fat-files have the same magic number the test
># must be preformed in the same "magic" sequence to get both right.  The long
># at offset 4 in a fat file tells the number of architectures.  The short at
># offset 4 in a Java bytecode file is the compiler minor version and the
># short at offset 6 is the compiler major version.  Since there are only 
># only 18 labeled Mach-O architectures at current, and the first released 
># Java class format was version 43.0, we can safely choose any number
># between 18 and 39 to test the number of architectures against
># (and use as a hack).
>#
>0	belong		0xcafebabe
>>4	belong		>19		compiled Java class data,
>>>6     beshort		x	        version %d.
>>>4     beshort		x       	\b%d
>>4	belong		1		Mach-O fat file with 1 architecture
>>4	belong		>1
># The following is necessary to support java class files.
>>>4	belong		<20		Mach-O fat file with %ld architectures
>#>>4	belong		<0xffff		Mach-O fat file with %ld architectures
>#
>0	lelong&0xfeffffff	0xfeedface	Mach-O
>>0	byte		0xcf		64-bit
>>12	lelong		1		object
>>12	lelong		2		executable
>>12	lelong		3		fixed virtual memory shared library
>>12	lelong		4		core
>>12	lelong		5		preload executable
>>12	lelong		6		dynamically linked shared library
>>12	lelong		7		dynamic linker
>>12	lelong		8		bundle
>>12	lelong		9		dynamically linked shared library stub
>>12	lelong		>9
>>>12	lelong		x		filetype=%ld
>>4	lelong		<0
>>>4	lelong		x		architecture=%ld
>>4	lelong		1		vax
>>4	lelong		2		romp
>>4	lelong		3		architecture=3
>>4	lelong		4		ns32032
>>4	lelong		5		ns32332
>>4	lelong		6		m68k
>>4	lelong		7		i386
>>4	lelong		8		mips
>>4	lelong		9		ns32532
>>4	lelong		10		architecture=10
>>4	lelong		11		hppa
>>4	lelong		12		acorn
>>4	lelong		13		m88k
>>4	lelong		14		sparc
>>4	lelong		15		i860-big
>>4	lelong		16		i860
>>4	lelong		17		rs6000
>>4	lelong		18		ppc
>>4	lelong		16777234	ppc64
>>4	lelong		>16777234
>>>4	lelong		x		architecture=%ld
>#
>0	belong&0xfffffffe	0xfeedface	Mach-O
>>3	byte		0xcf		64-bit
>>12	belong		1		object
>>12	belong		2		executable
>>12	belong		3		fixed virtual memory shared library
>>12	belong		4		core
>>12	belong		5		preload executable
>>12	belong		6               dynamically linked shared library
>>12	belong		7               dynamic linker
>>12	belong		8		bundle
>>12	belong		9		dynamically linked shared library stub
>>12	belong		>9
>>>12	belong		x		filetype=%ld
>>4	belong		<0
>>>4	belong		x		architecture=%ld
>>4	belong		1		vax
>>4	belong		2		romp
>>4	belong		3		architecture=3
>>4	belong		4		ns32032
>>4	belong		5		ns32332
>>4	belong		6		for m68k architecture
># from NeXTstep 3.0 <mach/machine.h>
># i.e. mc680x0_all, ignore
># >>8	belong		1		(mc68030)
>>>8	belong		2		(mc68040)
>>>8	belong		3		(mc68030 only)
>>4	belong		7		i386
>>4	belong		8		mips
>>4	belong		9		ns32532
>>4	belong		10		architecture=10
>>4	belong		11		hppa
>>4	belong		12		acorn
>>4	belong		13		m88k
>>4	belong		14		SPARC
>>4	belong		15		i860-big
>>4	belong		16		i860
>>4	belong		17		rs6000
>>4	belong		18		ppc
>>4	belong		16777234	ppc64
>>4	belong		>16777234
>>>4	belong		x		architecture=%ld
>
>#------------------------------------------------------------------------------
># magic:  file(1) magic for magic files
>#
>0	string		#\ Magic	magic text file for file(1) cmd
>0	lelong		0xF11E041C	magic binary file for file(1) cmd
>>4	lelong		x		(version %d) (little endian)
>0	belong		0xF11E041C	magic binary file for file(1) cmd
>>4	belong		x		(version %d) (big endian)
>
>#------------------------------------------------------------------------------
># mail.news:  file(1) magic for mail and news
>#
># Unfortunately, saved netnews also has From line added in some news software.
>#0	string		From 		mail text
># There are tests to ascmagic.c to cope with mail and news.
>0	string		Relay-Version: 	old news text
>0	string		#!\ rnews	batched news text
>0	string		N#!\ rnews	mailed, batched news text
>0	string		Forward\ to 	mail forwarding text
>0	string		Pipe\ to 	mail piping text
>0	string		Return-Path:	smtp mail text
>0	string		Path:		news text
>0	string		Xref:		news text
>0	string		From:		news or mail text
>0	string		Article 	saved news text
>0	string		BABYL		Emacs RMAIL text
>0	string		Received:	RFC 822 mail text
>0	string		MIME-Version:	MIME entity text
>#0	string		Content-	MIME entity text
>
># TNEF files...
>0	lelong		0x223E9F78	Transport Neutral Encapsulation Format
>
># From: Kevin Sullivan <ksulliva@psc.edu>
>0	string		*mbx*		MBX mail folder
>
># From: Simon Matter <simon.matter@invoca.ch>
>0	string		\241\002\213\015skiplist\ file\0\0\0	Cyrus skiplist DB
>
># JAM(mbp) Fidonet message area databases
># JHR file
>0	string	JAM\0			JAM message area header file
>>12	leshort >0			(%d messages)
>
># Squish Fidonet message area databases
># SQD file (requires at least one message in the area)
># XXX: Weak magic
>#256	leshort	0xAFAE4453		Squish message area data file
>#>4	leshort	>0			(%d messages)
>
>#------------------------------------------------------------------------------
># maple:  file(1) magic for maple files
># "H. Nanosecond" <aldomel@ix.netcom.com>
># Maple V release 4, a multi-purpose math program
>#
>
># maple library .lib
>0	string	\000MVR4\nI	MapleVr4 library
>
># .ind
># no magic for these :-(
># they are compiled indexes for maple files
>
># .hdb 
>0	string	\000\004\000\000	Maple help database
>
># .mhp
># this has the form <PACKAGE=name>
>0	string	\<PACKAGE=	Maple help file
>0	string	\<HELP\ NAME=	Maple help file
>0	string	\n\<HELP\ NAME=	Maple help file with extra carriage return at start (yuck)
>#0	string	#\ Newton	Maple help file, old style
>0	string	#\ daub	Maple help file, old style
>#0	string	#===========	Maple help file, old style
>
># .mws
>0	string	\000\000\001\044\000\221	Maple worksheet
>#this is anomalous
>0	string	WriteNow\000\002\000\001\000\000\000\000\100\000\000\000\000\000	Maple worksheet, but weird
># this has the form {VERSION 2 3 "IBM INTEL NT" "2.3" }\n
># that is {VERSION major_version miunor_version computer_type version_string}
>0	string	{VERSION\ 	Maple worksheet
>>9	string	>\0	version %.1s.
>>>10	string
>>>>11	string	>\0	%.1s
>
># .mps
>0	string	\0\0\001$	Maple something
># from byte 4 it is either 'nul E' or 'soh R'
># I think 'nul E' means a file that was saved as  a different name
># a sort of revision marking
># 'soh R' means new 
>>4	string	\000\105	An old revision
>>4	string	\001\122	The latest save
>
># .mpl
># some of these are the same as .mps above
>#0000000 000 000 001 044 000 105 same as .mps
>#0000000 000 000 001 044 001 122 same as .mps
>
>0	string	#\n##\ <SHAREFILE=	Maple something
>0	string	\n#\n##\ <SHAREFILE=	Maple something
>0	string	##\ <SHAREFILE=	Maple something
>0	string	#\r##\ <SHAREFILE=	Maple something
>0	string	\r#\r##\ <SHAREFILE=	Maple something
>0	string	#\ \r##\ <DESCRIBE>	Maple something anomalous.
>
>#------------------------------------------------------------------------------
># mathematica:  file(1) magic for mathematica files
># "H. Nanosecond" <aldomel@ix.netcom.com>
># Mathematica a multi-purpose math program
># versions 2.2 and 3.0
>
>#mathematica .mb
>0	string	\064\024\012\000\035\000\000\000	Mathematica version 2 notebook
>0	string	\064\024\011\000\035\000\000\000	Mathematica version 2 notebook
>
># .ma
># multiple possibilites:
>
>0	string	(*^\n\n::[\011frontEndVersion\ =\ 	Mathematica notebook
>#>41	string	>\0	%s
>
>#0	string	(*^\n\n::[\011palette	Mathematica notebook version 2.x
>
>#0	string	(*^\n\n::[\011Information	Mathematica notebook version 2.x
>#>675	string	>\0	%s #doesn't work well
>
># there may be 'cr' instread of 'nl' in some does this matter?
>
># generic:
>0	string	(*^\r\r::[\011	Mathematica notebook version 2.x
>0	string	\(\*\^\r\n\r\n\:\:\[\011	Mathematica notebook version 2.x
>0	string	(*^\015			Mathematica notebook version 2.x
>0	string	(*^\n\r\n\r::[\011	Mathematica notebook version 2.x
>0	string	(*^\r::[\011	Mathematica notebook version 2.x
>0	string	(*^\r\n::[\011	Mathematica notebook version 2.x
>0	string	(*^\n\n::[\011	Mathematica notebook version 2.x
>0	string	(*^\n::[\011	Mathematica notebook version 2.x
>
>
># Mathematica .mx files
>
>#0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
>0	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
>#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000	
># >71... is optional
>>88	string	>\0	from %s
>
>
># Mathematica files PBF:
># 115 115 101 120 102 106 000 001 000 000 000 203 000 001 000
>0	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)
>
># .ml files  These are menu resources I think
># these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 
># how to put that into a magic rule?
>4	string	\ A~	MAthematica .ml file
>
># .nb files
>#too long 0	string	(***********************************************************************\n\n\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ Mathematica-Compatible Notebook	Mathematica 3.0 notebook
>0	string	(***********************	Mathematica 3.0 notebook
>
># other (* matches it is a comment start in these langs
>0	string	(*	Mathematica, or Pascal,  Modula-2 or 3 code text
>
>#########################
># MatLab v5
>0       string  MATLAB  Matlab v5 mat-file
>>126    short   0x494d  (big endian)
>>>124   beshort x       version 0x%04x
>>126    short   0x4d49  (little endian)
>>>124   leshort x       version 0x%04x
>
>
>#------------------------------------------------------------------------------
># matroska:  file(1) magic for Matroska files
>#
># See http://www.matroska.org/
>#
>
># EBML id:
>0		belong		0x1a45dfa3
># DocType id:
>>5		beshort		0x4282
># DocType contents:
>>>8		string		matroska	Matroska data
>
>#------------------------------------------------------------------------------
># Mavroyanopoulos Nikos <nmav@hellug.gr>
># mcrypt:   file(1) magic for mcrypt 2.2.x;
>0	string		\0m\3		mcrypt 2.5 encrypted data,
>>4	string		>\0		algorithm: %s,
>>>&1	leshort		>0		keysize: %d bytes,
>>>>&0	string		>\0		mode: %s,
>
>0	string		\0m\2		mcrypt 2.2 encrypted data,
>>3	byte		0		algorithm: blowfish-448,
>>3	byte		1		algorithm: DES,
>>3	byte		2		algorithm: 3DES,
>>3	byte		3		algorithm: 3-WAY,
>>3	byte		4		algorithm: GOST,
>>3	byte		6		algorithm: SAFER-SK64,
>>3	byte		7		algorithm: SAFER-SK128,
>>3	byte		8		algorithm: CAST-128,
>>3	byte		9		algorithm: xTEA,
>>3	byte		10		algorithm: TWOFISH-128,
>>3	byte		11		algorithm: RC2,
>>3	byte		12		algorithm: TWOFISH-192,
>>3	byte		13		algorithm: TWOFISH-256,
>>3	byte		14		algorithm: blowfish-128,
>>3	byte		15		algorithm: blowfish-192,
>>3	byte		16		algorithm: blowfish-256,
>>3	byte		100		algorithm: RC6,
>>3	byte		101		algorithm: IDEA,
>>4	byte		0		mode: CBC,
>>4	byte		1		mode: ECB,
>>4	byte		2		mode: CFB,
>>4	byte		3		mode: OFB,
>>4	byte		4		mode: nOFB,
>>5	byte		0		keymode: 8bit
>>5	byte		1		keymode: 4bit
>>5	byte		2		keymode: SHA-1 hash
>>5	byte		3		keymode: MD5 hash
>#------------------------------------------------------------------------------
># mime:  file(1) magic for MIME encoded files
>#
>0	string		Content-Type:\
>>14	string		>\0		%s
>0	string		Content-Type:
>>13	string		>\0		%s
>
>#------------------------------------------------------------------------------
># mips:  file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
>#                         Dec Ultrix (MIPS)
># all of SGI's *current* machines and OSes run in big-endian mode on the
># MIPS machines, as far as I know.
>#
># XXX - what is the blank "-" line?
>#
># kbd file definitions
>0	string	kbd!map		kbd map file
>>8	byte	>0		Ver %d:
>>10	short	>0		with %d table(s)
>0	belong	0407		old SGI 68020 executable
>0	belong	0410		old SGI 68020 pure executable
>0	beshort	0x8765		disk quotas file
>0	beshort	0x0506		IRIS Showcase file
>>2	byte	0x49		-
>>3	byte	x		- version %ld
>0	beshort	0x0226		IRIS Showcase template
>>2	byte	0x63		-
>>3	byte	x		- version %ld
>0	belong	0x5343464d	IRIS Showcase file
>>4	byte	x		- version %ld
>0	belong	0x5443464d	IRIS Showcase template
>>4	byte	x		- version %ld
>0	belong	0xdeadbabe	IRIX Parallel Arena
>>8	belong	>0		- version %ld
>#
>0	beshort	0x0160		MIPSEB ECOFF executable
>>20	beshort	0407		(impure)
>>20	beshort	0410		(swapped)
>>20	beshort	0413		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>22	byte	x		- version %ld
>>23	byte	x		.%ld
>#
>0	beshort	0x0162		MIPSEL-BE ECOFF executable
>>20	beshort	0407		(impure)
>>20	beshort	0410		(swapped)
>>20	beshort	0413		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>23	byte	x		- version %d
>>22	byte	x		.%ld
>#
>0	beshort	0x6001		MIPSEB-LE ECOFF executable
>>20	beshort	03401		(impure)
>>20	beshort	04001		(swapped)
>>20	beshort	05401		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>23	byte	x		- version %d
>>22	byte	x		.%ld
>#
>0	beshort	0x6201		MIPSEL ECOFF executable
>>20	beshort	03401		(impure)
>>20	beshort	04001		(swapped)
>>20	beshort	05401		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>23	byte	x		- version %ld
>>22	byte	x		.%ld
>#
># MIPS 2 additions
>#
>0	beshort	0x0163		MIPSEB MIPS-II ECOFF executable
>>20	beshort	0407		(impure)
>>20	beshort	0410		(swapped)
>>20	beshort	0413		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>22	byte	x		- version %ld
>>23	byte	x		.%ld
>#
>0	beshort	0x0166		MIPSEL-BE MIPS-II ECOFF executable
>>20	beshort	0407		(impure)
>>20	beshort	0410		(swapped)
>>20	beshort	0413		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>22	byte	x		- version %ld
>>23	byte	x		.%ld
>#
>0	beshort	0x6301		MIPSEB-LE MIPS-II ECOFF executable
>>20	beshort	03401		(impure)
>>20	beshort	04001		(swapped)
>>20	beshort	05401		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>23	byte	x		- version %ld
>>22	byte	x		.%ld
>#
>0	beshort	0x6601		MIPSEL MIPS-II ECOFF executable
>>20	beshort	03401		(impure)
>>20	beshort	04001		(swapped)
>>20	beshort	05401		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>23	byte	x		- version %ld
>>22	byte	x		.%ld
>#
># MIPS 3 additions
>#
>0	beshort	0x0140		MIPSEB MIPS-III ECOFF executable
>>20	beshort	0407		(impure)
>>20	beshort	0410		(swapped)
>>20	beshort	0413		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>22	byte	x		- version %ld
>>23	byte	x		.%ld
>#
>0	beshort	0x0142		MIPSEL-BE MIPS-III ECOFF executable
>>20	beshort	0407		(impure)
>>20	beshort	0410		(swapped)
>>20	beshort	0413		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>22	byte	x		- version %ld
>>23	byte	x		.%ld
>#
>0	beshort	0x4001		MIPSEB-LE MIPS-III ECOFF executable
>>20	beshort	03401		(impure)
>>20	beshort	04001		(swapped)
>>20	beshort	05401		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>23	byte	x		- version %ld
>>22	byte	x		.%ld
>#
>0	beshort	0x4201		MIPSEL MIPS-III ECOFF executable
>>20	beshort	03401		(impure)
>>20	beshort	04001		(swapped)
>>20	beshort	05401		(paged)
>>8	belong	>0		not stripped
>>8	belong	0		stripped
>>23	byte	x		- version %ld
>>22	byte	x		.%ld
>#
>0	beshort	0x180		MIPSEB Ucode
>0	beshort	0x182		MIPSEL-BE Ucode
># 32bit core file
>0	belong	0xdeadadb0	IRIX core dump
>>4	belong	1		of
>>16	string	>\0		'%s'
># 64bit core file
>0	belong	0xdeadad40	IRIX 64-bit core dump
>>4	belong	1		of
>>16	string	>\0		'%s'
># N32bit core file
>0       belong	0xbabec0bb	IRIX N32 core dump
>>4      belong	1               of
>>16     string	>\0             '%s'
># New style crash dump file
>0	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
>>36	string	>\0					'%s'
># Trusted IRIX info
>0	string	SGIAUDIT	SGI Audit file
>>8	byte	x		- version %d
>>9	byte	x		.%ld
>#
>0	string	WNGZWZSC	Wingz compiled script
>0	string	WNGZWZSS	Wingz spreadsheet
>0	string	WNGZWZHP	Wingz help file
>#
>0	string	\#Inventor V	IRIS Inventor 1.0 file
>0	string	\#Inventor V2	Open Inventor 2.0 file
># GLF is OpenGL stream encoding
>0	string	glfHeadMagic();		GLF_TEXT
>4	belong	0x7d000000		GLF_BINARY_LSB_FIRST
>4	belong	0x0000007d		GLF_BINARY_MSB_FIRST
># GLS is OpenGL stream encoding; GLS is the successor of GLF
>0	string	glsBeginGLS(		GLS_TEXT
>4	belong	0x10000000		GLS_BINARY_LSB_FIRST
>4	belong	0x00000010		GLS_BINARY_MSB_FIRST
>
>#------------------------------------------------------------------------------
># mirage:  file(1) magic for Mirage executables
>#
># XXX - byte order?
>#
>0	long	31415		Mirage Assembler m.out executable
>#-----------------------------------------------------------------------------
># misctools:  file(1) magic for miscelanous UNIX tools.
>#
>0	string		%%!!		X-Post-It-Note text
>0	string          BEGIN:VCALENDAR         vCalendar calendar file
>
>#------------------------------------------------------------------------------
># mkid:  file(1) magic for mkid(1) databases
>#
># ID is the binary tags database produced by mkid(1).
>#
># XXX - byte order?
>#
>0	string		\311\304	ID tags data
>>2	short		>0		version %d
>
>#------------------------------------------------------------------------------
># mlssa: file(1) magic for MLSSA datafiles
>#
>0		lelong		0xffffabcd	MLSSA datafile,
>>4		leshort		x		algorithm %d,
>>10		lelong		x		%d samples
>
>#------------------------------------------------------------------------------
># mmdf:  file(1) magic for MMDF mail files
>#
>0	string	\001\001\001\001	MMDF mailbox
>#------------------------------------------------------------------------------
># msad:  file(1) magic for msad
># Microsoft visual C
># This must precede the heuristic for raw G3 data
>4	string	Standard\ Jet\ DB	Microsoft Access Database
>
>#------------------------------------------------------------------------------
># motorola:  file(1) magic for Motorola 68K and 88K binaries
>#
># 68K
>#
>0	beshort		0520		mc68k COFF
>>18	beshort		^00000020	object
>>18	beshort		&00000020	executable
>>12	belong		>0		not stripped
>>168	string		.lowmem		Apple toolbox
>>20	beshort		0407		(impure)
>>20	beshort		0410		(pure)
>>20	beshort		0413		(demand paged)
>>20	beshort		0421		(standalone)
>0	beshort		0521		mc68k executable (shared)
>>12	belong		>0		not stripped
>0	beshort		0522		mc68k executable (shared demand paged)
>>12	belong		>0		not stripped
>#
># Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
>#
>0	beshort		0554		68K BCS executable
>#
># 88K
>#
># Motorola/88Open BCS
>#
>0	beshort		0555		88K BCS executable
>#
># Motorola S-Records, from Gerd Truschinski <gt@freebsd.first.gmd.de>
>0   string      S0          Motorola S-Record; binary data in text format
>
># ATARI ST relocatable PRG
>#
># from Oskar Schirmer <schirmer@scara.com> Feb 3, 2001
># (according to Roland Waldi, Oct 21, 1987)
># besides the magic 0x601a, the text segment size is checked to be
># not larger than 1 MB (which is a lot on ST).
># The additional 0x601b distinction I took from Doug Lee's magic.
>0	belong&0xFFFFFFF0	0x601A0000	Atari ST M68K contiguous executable
>>2	belong			x		(txt=%ld,
>>6	belong			x		dat=%ld,
>>10	belong			x		bss=%ld,
>>14	belong			x		sym=%ld)
>0	belong&0xFFFFFFF0	0x601B0000	Atari ST M68K non-contig executable
>>2	belong			x		(txt=%ld,
>>6	belong			x		dat=%ld,
>>10	belong			x		bss=%ld,
>>14	belong			x		sym=%ld)
>
># Atari ST/TT... program format (sent by Wolfram Kleff <kleff@cs.uni-bonn.de>)
>0       beshort         0x601A          Atari 68xxx executable,
>>2      belong          x               text len %lu,
>>6      belong          x               data len %lu,
>>10     belong          x               BSS len %lu,
>>14     belong          x               symboltab len %lu,
>>18     belong          0
>>22     belong          &0x01           fastload flag,
>>22     belong          &0x02           may be loaded to alternate RAM,
>>22     belong          &0x04           malloc may be from alternate RAM,
>>22     belong          x               flags: 0x%lX,
>>26     beshort         0               no relocation tab
>>26     beshort         !0              + relocation tab
>>30     string          SFX             [Self-Extracting LZH SFX archive]
>>38     string          SFX             [Self-Extracting LZH SFX archive]
>>44     string          ZIP!            [Self-Extracting ZIP SFX archive]
>
>0       beshort         0x0064          Atari 68xxx CPX file
>>8      beshort         x               (version %04lx)
>
>#------------------------------------------------------------------------------
># msdos:  file(1) magic for MS-DOS files
>#
>
># .BAT files (Daniel Quinlan, quinlan@yggdrasil.com)
>0	string/c	@echo\ off	MS-DOS batch file text
>
># OS/2 batch files are REXX. the second regex is a bit generic, oh well
># the matched commands seem to be common in REXX and uncommon elsewhere
>100 regex/c =^\\s*call\s+rxfuncadd.*sysloadfu OS/2 REXX batch file text
>100 regex/c =^\\s*say\ ['"] OS/2 REXX batch file text
>
>0	leshort		0x14c	MS Windows COFF Intel 80386 object file
>#>4	ledate		x	stamp %s
>0	leshort		0x166	MS Windows COFF MIPS R4000 object file
>#>4	ledate		x	stamp %s
>0	leshort		0x184	MS Windows COFF Alpha object file
>#>4	ledate		x	stamp %s
>0	leshort		0x268	MS Windows COFF Motorola 68000 object file
>#>4	ledate		x	stamp %s
>0	leshort		0x1f0	MS Windows COFF PowerPC object file
>#>4	ledate		x	stamp %s
>0	leshort		0x290	MS Windows COFF PA-RISC object file
>#>4	ledate		x	stamp %s
>
># XXX - according to Microsoft's spec, at an offset of 0x3c in a
># PE-format executable is the offset in the file of the PE header;
># unfortunately, that's a little-endian offset, and there's no way
># to specify an indirect offset with a specified byte order.
># So, for now, we assume the standard MS-DOS stub, which puts the
># PE header at 0x80 = 128.
>#
># Required OS version and subsystem version were 4.0 on some NT 3.51
># executables built with Visual C++ 4.0, so it's not clear that
># they're interesting.  The user version was 0.0, but there's
># probably some linker directive to set it.  The linker version was
># 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
>#
># many of the compressed formats were extraced from IDARC 1.23 source code
>#
>0	string	MZ
>>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 PE executable for MS Windows
>>>&18	leshort&0x2000	>0	(DLL)
>>>&88	leshort		0	(unknown subsystem)
>>>&88	leshort		1	(native)
>>>&88	leshort		2	(GUI)
>>>&88	leshort		3	(console)
>>>&88	leshort		7	(POSIX)
>>>&0	leshort		0x0	unknown processor
>>>&0	leshort		0x14c	Intel 80386
>>>&0	leshort		0x166	MIPS R4000
>>>&0	leshort		0x184	Alpha
>>>&0	leshort		0x268	Motorola 68000
>>>&0	leshort		0x1f0	PowerPC
>>>&0	leshort		0x290	PA-RISC
>>>&18	leshort&0x0100	>0	32-bit
>>>&18	leshort&0x1000	>0	system file
>>>&0xf4 search/0x140 \x0\x40\x1\x0
>>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
>
>>0x18  leshort >0x3f
>>>(0x3c.l) string PE\0\0 PE executable
># hooray, there's a DOS extender using the PE format, with a valid PE
># executable inside (which just prints a message and exits if run in win)
>>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender
>>>>(8.s*16) string !32STUB for MS Windows
>>>>>(0x3c.l+22)	leshort&0x2000	>0	(DLL)
>>>>>(0x3c.l+92)	leshort		0	(unknown subsystem)
>>>>>(0x3c.l+92)	leshort		1	(native)
>>>>>(0x3c.l+92)	leshort		2	(GUI)
>>>>>(0x3c.l+92)	leshort		3	(console)
>>>>>(0x3c.l+92)	leshort		7	(POSIX)
>>>>>(0x3c.l+4)	leshort		0x0	unknown processor
>>>>>(0x3c.l+4)	leshort		0x14c	Intel 80386
>>>>>(0x3c.l+4)	leshort		0x166	MIPS R4000
>>>>>(0x3c.l+4)	leshort		0x184	Alpha
>>>>>(0x3c.l+4)	leshort		0x268	Motorola 68000
>>>>>(0x3c.l+4)	leshort		0x1f0	PowerPC
>>>>>(0x3c.l+4)	leshort		0x290	PA-RISC
>>>>>(0x3c.l+22)	leshort&0x0100	>0	32-bit
>>>>>(0x3c.l+22)	leshort&0x1000	>0	system file
>
>>>>>(0x3c.l+0xf8)	string		UPX0 \b, UPX compressed
>>>>>(0x3c.l+0xf8)	search/0x140	PEC2 \b, PECompact2 compressed
>>>>>(0x3c.l+0xf8)	search/0x140	UPX2
>>>>>>(&0x10.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
>>>>>(0x3c.l+0xf8)	search/0x140	.idata
>>>>>>(&0xe.l+(-4))	string		PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
>>>>>>(&0xe.l+(-4))	string		ZZ0 \b, ZZip self-extracting archive
>>>>>>(&0xe.l+(-4))	string		ZZ1 \b, ZZip self-extracting archive
>>>>>(0x3c.l+0xf8)	search/0x140	.rsrc
>>>>>>(&0x0f.l+(-4))	string		a\\\4\5 \b, WinHKI self-extracting archive
>>>>>>(&0x0f.l+(-4))	string		Rar! \b, RAR self-extracting archive
>>>>>>(&0x0f.l+(-4))	search/0x3000	MSCF \b, InstallShield self-extracting archive
>>>>>>(&0x0f.l+(-4))	search/32	Nullsoft \b, Nullsoft Installer self-extracting archive
>>>>>(0x3c.l+0xf8)	search/0x140	.data
>>>>>>(&0x0f.l)		string		WEXTRACT \b, MS CAB-Installer self-extracting archive
>>>>>(0x3c.l+0xf8)	search/0x140	.petite\0 \b, Petite compressed
>>>>>>(0x3c.l+0xf7)	byte		x
>>>>>>>(&0x104.l+(-4))	string		=!sfx! \b, ACE self-extracting archive
>>>>>(0x3c.l+0xf8)	search/0x140	.WISE \b, WISE installer self-extracting archive
>>>>>(0x3c.l+0xf8)	search/0x140	.dz\0\0\0 \b, Dzip self-extracting archive
>>>>>(0x3c.l+0xf8)	search/0x140	.reloc
>>>>>>(&0xe.l+(-4))	search/0x180	PK\3\4 \b, ZIP self-extracting archive (WinZip)
>
>>>>>&(0x3c.l+0xf8)	search/0x100	_winzip_ \b, ZIP self-extracting archive (WinZip)
>>>>>&(0x3c.l+0xf8)	search/0x100	SharedD \b, Microsoft Installer self-extracting archive
>>>>>0x30		string		Inno \b, InnoSetup self-extracting archive
>
>>>(0x3c.l)		string		NE NE executable
>>>>(0x3c.l+0x36)	byte		0 (unknown OS)
>>>>(0x3c.l+0x36)	byte		1 for OS/2 1.x
>>>>(0x3c.l+0x36)	byte		2 for MS Windows 3.x
>>>>(0x3c.l+0x36)	byte		3 for MS-DOS
>>>>(0x3c.l+0x36)	byte		>3 (unknown OS)
>>>>(0x3c.l+0x36)	byte		0x81 for MS-DOS, Phar Lap DOS extender
>>>>(0x3c.l+0x0c)	leshort&0x8003	0x8002 (DLL)
>>>>(0x3c.l+0x0c)	leshort&0x8003	0x8001 (driver)
>>>>&(&0x24.s-1)		string		ARJSFX \b, ARJ self-extracting archive
>>>>(0x3c.l+0x70)	search/0x80	WinZip(R)\ Self-Extractor \b, ZIP self-extracting archive (WinZip)
>
>>>(0x3c.l)		string		LX\0\0 LX executable
>>>>(0x3c.l+0x0a)	leshort		<1 (unknown OS)
>>>>(0x3c.l+0x0a)	leshort		1 for OS/2
>>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
>>>>(0x3c.l+0x0a)	leshort		3 for DOS
>>>>(0x3c.l+0x0a)	leshort		>3 (unknown OS)
>>>>(0x3c.l+0x10)	lelong&0x28000	=0x8000 (DLL)
>>>>(0x3c.l+0x10)	lelong&0x20000	>0 (device driver)
>>>>(0x3c.l+0x10)	lelong&0x300	0x300 (GUI)
>>>>(0x3c.l+0x10)	lelong&0x28300	<0x300 (console)
>>>>(0x3c.l+0x08)	leshort		1 i80286
>>>>(0x3c.l+0x08)	leshort		2 i80386
>>>>(0x3c.l+0x08)	leshort		3 i80486
>>>>(8.s*16)		string		emx \b, emx
>>>>>&1			string		x %s
>>>>&(&0x54.l-3)		string		arjsfx \b, ARJ self-extracting archive
>
># MS Windows system file, supposedly a collection of LE executables
>>>(0x3c.l)		string		W3 W3 executable for MS Windows
>
>>>(0x3c.l)		string		LE\0\0 LE executable
>>>>(0x3c.l+0x0a)	leshort		1
># some DOS extenders use LE files with OS/2 header
>>>>>0x240		search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
>>>>>0x240		search/0x200	WATCOM\ C/C++ for MS-DOS, DOS4GW DOS extender
>>>>>0x440		search/0x100	CauseWay\ DOS\ Extender for MS-DOS, CauseWay DOS extender
>>>>>0x40		search/0x40	PMODE/W for MS-DOS, PMODE/W DOS extender
>>>>>0x40		search/0x40	STUB/32A for MS-DOS, DOS/32A DOS extender (stub)
>>>>>0x40		search/0x80	STUB/32C for MS-DOS, DOS/32A DOS extender (configurable stub)
>>>>>0x40		search/0x80	DOS/32A for MS-DOS, DOS/32A DOS extender (embedded)
># this is a wild guess; hopefully it is a specific signature
>>>>>&0x24		lelong		<0x50
>>>>>>(&0x4c.l)		string		\xfc\xb8WATCOM
>>>>>>>&0		search/8	3\xdbf\xb9 \b, 32Lite compressed
># another wild guess: if real OS/2 LE executables exist, they probably have higher start EIP
>#>>>>(0x3c.l+0x1c)	lelong		>0x10000 for OS/2
># fails with DOS-Extenders.
>>>>(0x3c.l+0x0a)	leshort		2 for MS Windows
>>>>(0x3c.l+0x0a)	leshort		3 for MS-DOS
>>>>(0x3c.l+0x0a)	leshort		4 for MS Windows (VxD)
>>>>(&0x7c.l+0x26)	string		UPX \b, UPX compressed
>>>>&(&0x54.l-3)		string		UNACE \b, ACE self-extracting archive
>
># looks like ASCII, probably some embedded copyright message.
># and definitely not NE/LE/LX/PE
>>>0x3c		lelong	>0x20000000
>>>>(4.s*512)	leshort !0x014c MZ executable for MS-DOS
># header data too small for extended executable
>>2		long	!0
>>>0x18		leshort	<0x40
>>>>(4.s*512)	leshort !0x014c
>
>>>>>&(2.s-514)	string	!LE
>>>>>>&-2	string	!BW MZ executable for MS-DOS
>>>>>&(2.s-514)	string	LE LE executable
>>>>>>0x240	search/0x100	DOS/4G for MS-DOS, DOS4GW DOS extender
># educated guess since indirection is still not capable enough for complex offset
># calculations (next embedded executable would be at &(&2*512+&0-2)
># I suspect there are only LE executables in these multi-exe files
>>>>>&(2.s-514)	string	BW
>>>>>>0x240	search/0x100	DOS/4G LE executable for MS-DOS, DOS4GW DOS extender (embedded)
>>>>>>0x240	search/0x100	!DOS/4G BW executable collection for MS-DOS
>
># This sequence skips to the first COFF segment, usually .text
>>(4.s*512)	leshort		0x014c COFF executable
>>>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
>>>(8.s*16)	string		emx
>>>>&1		string		x for DOS, Win or OS/2, emx %s
>>>&(&0x42.l-3)	byte		x 
>>>>&0x26	string		UPX \b, UPX compressed
># and yet another guess: small .text, and after large .data is unusal, could be 32lite
>>>&0x2c		search/0xa0	.text
>>>>&0x0b	lelong		<0x2000
>>>>>&0		lelong		>0x6000 \b, 32lite compressed
>
>>(8.s*16) string $WdX \b, WDos/X DOS extender
>
># .EXE formats (Greg Roelofs, newt@uchicago.edu)
>#
>>0x35   string  \x8e\xc0\xb9\x08\x00\xf3\xa5\x4a\x75\xeb\x8e\xc3\x8e\xd8\x33\xff\xbe\x30\x00\x05 \b, aPack compressed
>>0xe7	string	LH/2\ Self-Extract \b, %s
>>0x1c	string	diet \b, diet compressed
>>0x1c	string	LZ09 \b, LZEXE v0.90 compressed
>>0x1c	string	LZ91 \b, LZEXE v0.91 compressed
>>0x1c   string  tz \b, TinyProg compressed
>>0x1e	string	PKLITE \b, %s compressed
>>0x64   string  W\ Collis\0\0 \b, Compack compressed
>>0x24	string	LHa's\ SFX \b, LHa self-extracting archive
>>0x24	string	LHA's\ SFX \b, LHa self-extracting archive
>>0x24   string  \ $ARX \b, ARX self-extracting archive
>>0x24   string  \ $LHarc \b, LHarc self-extracting archive
>>0x20   string  SFX\ by\ LARC \b, LARC self-extracting archive
>>1638	string	-lh5- \b, LHa self-extracting archive v2.13S
>>0x17888 string	Rar! \b, RAR self-extracting archive
>>0x40   string aPKG \b, aPackage self-extracting archive
>
>>32      string AIN
>>>35     string 2              \b, AIN 2.x compressed
>>>35     string <2             \b, AIN 1.x compressed
>>>35     string >2             \b, AIN 1.x compressed
>>28      string UC2X           \b, UCEXE compressed
>>28      string WWP\           \b, WWPACK compressed
>
># skip to the end of the exe
>>(4.s*512)	long	x 
>>>&(2.s-517)	byte	x 
>>>>&0	string		PK\3\4 \b, ZIP self-extracting archive
>>>>&0	string		Rar! \b, RAR self-extracting archive
>>>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
>>>>&0	string		=!\x12 \b, AIN 2.x self-extracting archive
>>>>&0	string		=!\x17 \b, AIN 1.x self-extracting archive
>>>>&0	string		=!\x18 \b, AIN 1.x self-extracting archive
>>>>&7	search/400	**ACE** \b, ACE self-extracting archive
>>>>&0	search/0x480	UC2SFX\ Header \b, UC2 self-extracting archive
>
>>0x1c	string		RJSX \b, ARJ self-extracting archive
># winarj stores a message in the stub instead of the sig in the MZ header
>>0x20	search/0xe0	aRJsfX \b, ARJ self-extracting archive
>
># a few unknown ZIP sfxes, no idea if they are needed or if they are
># already captured by the generic patterns above
>>0x7a		string		Windows\ self-extracting\ ZIP	\b, ZIP self-extracting archive
>>(8.s*16)	search/0x20	PKSFX \b, ZIP self-extracting archive (PKZIP)
># TODO: how to add this? >FileSize-34 string Windows\ Self-Installing\ Executable \b, ZIP self-extracting archive
>#
>
># TELVOX Teleinformatica CODEC self-extractor for OS/2:
>>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
>>>49824	leshort		=1			\b, 1 file
>>>49824	leshort		>1			\b, %u files
>
># .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
># Uncommenting only the first two lines will cover about 2/3 of COM files,
># but it isn't feasible to match all COM files since there must be at least
># two dozen different one-byte "magics".
>0	byte		0xe9		MS-DOS executable (COM)
>>6	string		SFX\ of\ LHarc	(%s)
>0	byte		0x8c		MS-DOS executable (COM)
># 0xeb conflicts with "sequent" magic
>0	byte		0xeb		MS-DOS executable (COM)
>>4	string		\ $ARX		\b, ARX self-extracting archive
>>4	string		\ $LHarc	\b, LHarc self-extracting archive
>>0x20e	string		SFX\ by\ LARC	\b, LARC self-extracting archive
>0	byte		0xb8		COM executable for MS-DOS
># many compressed/converted COMs start with a copy loop instead of a jump
>0x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
>0x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for MS-DOS
>>0x18	search/0x10	\x50\xa4\xff\xd5\x73	\b, aPack compressed
>0x3c	string		W\ Collis\0\0		COM executable for MS-DOS, Compack compressed
># FIXME: missing diet .com compression
>
># miscellaneous formats
>0	string		LZ		MS-DOS executable (built-in)
>#0	byte		0xf0		MS-DOS program library data
>#
>
>#
># Windows Registry files.
>#
>0	string		regf		Windows NT registry file
>0	string		CREG		Windows 95 registry file
>
>
># AAF files:
># <stuartc@rd.bbc.co.uk> Stuart Cunningham
>0	string	\320\317\021\340\241\261\032\341AAFB\015\000OM\006\016\053\064\001\001\001\377			AAF legacy file using MS Structured Storage
>>30	byte	9		(512B sectors)
>>30	byte	12		(4kB sectors)
>0	string	\320\317\021\340\241\261\032\341\001\002\001\015\000\002\000\000\006\016\053\064\003\002\001\001			AAF file using MS Structured Storage
>>30	byte	9		(512B sectors)
>>30	byte	12		(4kB sectors)
>
># Popular applications
>2080	string	Microsoft\ Word\ 6.0\ Document	%s
>2080	string	Documento\ Microsoft\ Word\ 6 Spanish Microsoft Word 6 document data
># Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Word)
>2112	string	MSWordDoc			Microsoft Word document data
>#
>0	belong	0x31be0000			Microsoft Word Document
>#
>0       string  PO^Q`				Microsoft Word 6.0 Document
>#
>0	string	\376\067\0\043			Microsoft Office Document
>0	string	\320\317\021\340\241\261\032\341	Microsoft Office Document
>0	string	\333\245-\0\0\0			Microsoft Office Document
>#
>2080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
>2080	string	Foglio\ di\ lavoro\ Microsoft\ Exce	%s
>#
># Pawel Wiecek <coven@i17linuxb.ists.pwr.wroc.pl> (for polish Excel)
>2114	string	Biff5		Microsoft Excel 5.0 Worksheet
># Italian MS-Excel
>2121	string	Biff5		Microsoft Excel 5.0 Worksheet
>0	string	\x09\x04\x06\x00\x00\x00\x10\x00	Microsoft Excel Worksheet
>#
>0	belong	0x00001a00	Lotus 1-2-3
>>4	belong	0x00100400	wk3 document data
>>4	belong	0x02100400	wk4 document data
>>4	belong	0x07800100	fm3 or fmb document data
>>4	belong	0x07800000	fm3 or fmb document data
>#
>0	belong	0x00000200 	Lotus 1-2-3
>>4	belong	0x06040600	wk1 document data
>>4	belong	0x06800200	fmt document data
>
># Help files
>0	string	?_\3\0		MS Windows Help Data
>
>#  DeIsL1.isu what this is I don't know
>0	string	\161\250\000\000\001\002	DeIsL1.isu whatever that is
>
># Winamp .avs
>#0	string	Nullsoft\ AVS\ Preset\ \060\056\061\032	A plug in for Winamp ms-windows Freeware media player
>0	string	Nullsoft\ AVS\ Preset\ 	Winamp plug in
>
># Hyper terminal:
>0	string	HyperTerminal\ 	hyperterm
>>15	string	1.0\ --\ HyperTerminal\ data\ file	MS-windows Hyperterminal
>
># Windows Metafont .WMF
>0	string	\327\315\306\232\000\000\000\000\000\000	ms-windows metafont .wmf
>
>#tz3 files whatever that is (MS Works files)
>0	string	\003\001\001\004\070\001\000\000	tz3 ms-works file
>0	string	\003\002\001\004\070\001\000\000	tz3 ms-works file
>0	string	\003\003\001\004\070\001\000\000	tz3 ms-works file
>
># PGP sig files .sig
>#0 string \211\000\077\003\005\000\063\237\127 065 to  \027\266\151\064\005\045\101\233\021\002 PGP sig
>0 string \211\000\077\003\005\000\063\237\127\065\027\266\151\064\005\045\101\233\021\002 PGP sig
>0 string \211\000\077\003\005\000\063\237\127\066\027\266\151\064\005\045\101\233\021\002 PGP sig
>0 string \211\000\077\003\005\000\063\237\127\067\027\266\151\064\005\045\101\233\021\002 PGP sig
>0 string \211\000\077\003\005\000\063\237\127\070\027\266\151\064\005\045\101\233\021\002 PGP sig
>0 string \211\000\077\003\005\000\063\237\127\071\027\266\151\064\005\045\101\233\021\002 PGP sig
>0 string \211\000\225\003\005\000\062\122\207\304\100\345\042 PGP sig
>
># windows zips files .dmf
>0	string	MDIF\032\000\010\000\000\000\372\046\100\175\001\000\001\036\001\000 MS Windows special zipped file
>
>
># Windows help file FTG FTS
>0	string	\164\146\115\122\012\000\000\000\001\000\000\000	MS Windows help cache
>
># grp old windows 3.1 group files
>0 string  \120\115\103\103	MS Windows 3.1 group files
>
>
># lnk files windows symlinks
>0	string	\114\000\000\000\001\024\002\000\000\000\000\000\300\000\000\000\000\000\000\106	MS Windows shortcut
>
>#ico files
>0	string	\102\101\050\000\000\000\056\000\000\000\000\000\000\000	Icon for MS Windows
>
># Windows icons (Ian Springer <ips@fpk.hp.com>)
>0	string	\000\000\001\000	MS Windows icon resource
>>4	byte	1			- 1 icon
>>4	byte	>1			- %d icons
>>>6	byte	>0			\b, %dx
>>>>7	byte	>0			\b%d
>>>8	byte	0			\b, 256-colors
>>>8	byte	>0			\b, %d-colors
>
>
># .chr files
>0	string	PK\010\010BGI	Borland font 
>>4	string	>\0	%s
># then there is a copyright notice
>
>
># .bgi files
>0	string	pk\010\010BGI	Borland device 
>>4	string	>\0	%s
># then there is a copyright notice
>
>
># recycled/info the windows trash bin index
>9	string	\000\000\000\030\001\000\000\000 MS Windows recycled bin info
>
>
>##### put in Either Magic/font or Magic/news
># Acroread or something  files wrongly identified as G3  .pfm
># these have the form \000 \001 any? \002 \000 \000
># or \000 \001 any? \022 \000 \000
>0	belong&0xffff00ff	0x00010012	PFM data
>>4	string			\000\000
>>6	string			>\060		- %s
>
>0	belong&0xffff00ff	0x00010002	PFM data
>>4	string			\000\000
>>6	string			>\060		- %s
>#0	string  \000\001 pfm?
>#>3	string  \022\000\000Copyright\  yes
>#>3	string  \002\000\000Copyright\  yes
>#>3	string  >\0     oops, not a font file. Cancel that.
>#it clashes with ttf files so put it lower down.
>
># From Doug Lee via a FreeBSD pr
>9	string		GERBILDOC	First Choice document
>9	string		GERBILDB	First Choice database
>9	string		GERBILCLIP	First Choice database
>0	string		GERBIL		First Choice device file
>9	string		RABBITGRAPH	RabbitGraph file
>0	string		DCU1		Borland Delphi .DCU file
>0	string		=!<spell>	MKS Spell hash list (old format)
>0	string		=!<spell2>	MKS Spell hash list
># Too simple - MPi
>#0	string		AH		Halo(TM) bitmapped font file
>0	lelong		0x08086b70	TurboC BGI file
>0	lelong		0x08084b50	TurboC Font file
>
># WARNING: below line conflicts with Infocom game data Z-machine 3
>0	byte		0x03		DBase 3 data file
>>0x04	lelong		0		(no records)
>>0x04	lelong		>0		(%ld records)
>0	byte		0x83		DBase 3 data file with memo(s)
>>0x04	lelong		0		(no records)
>>0x04	lelong		>0		(%ld records)
>0	leshort		0x0006		DBase 3 index file
>0	string		PMCC		Windows 3.x .GRP file
>1	string		RDC-meg		MegaDots 
>>8	byte		>0x2F		version %c
>>9	byte		>0x2F		\b.%c file
>0	lelong		0x4C
>>4	lelong		0x00021401	Windows shortcut file
>
># DOS EPS Binary File Header
># From: Ed Sznyter <ews@Black.Market.NET>
>0	belong		0xC5D0D3C6	DOS EPS Binary File
>>4	long		>0		Postscript starts at byte %d
>>>8	long		>0		length %d
>>>>12	long		>0		Metafile starts at byte %d
>>>>>16	long		>0		length %d
>>>>20	long		>0		TIFF starts at byte %d
>>>>>24	long		>0		length %d
>
># TNEF magic From "Joomy" <joomy@se-ed.net> 
>0	leshort		0x223e9f78	TNEF
>
># HtmlHelp files (.chm)
>0	string  ITSF\003\000\000\000\x60\000\000\000\001\000\000\000	MS Windows HtmlHelp Data
>
># GFA-BASIC (Wolfram Kleff)
>2	string		GFA-BASIC3	GFA-BASIC 3 data
>
>#------------------------------------------------------------------------------
># From Stuart Caie <kyzer@4u.net> (developer of cabextract)
># Microsoft Cabinet files
>0	string		MSCF\0\0\0\0	Microsoft Cabinet archive data
>>8	lelong		x		\b, %u bytes
>>28	leshort		1		\b, 1 file
>>28	leshort		>1		\b, %u files
>
># InstallShield Cabinet files
>0	string		ISc(		InstallShield Cabinet archive data
>>5	byte&0xf0	=0x60 		version 6,
>>5	byte&0xf0	!0x60 		version 4/5,
>>(12.l+40)	lelong	x		%u files
>
># Windows CE package files
>0	string		MSCE\0\0\0\0	Microsoft WinCE install header
>>20	lelong		0		\b, architecture-independent
>>20	lelong		103		\b, Hitachi SH3
>>20	lelong		104		\b, Hitachi SH4
>>20	lelong		0xA11		\b, StrongARM
>>20	lelong		4000		\b, MIPS R4000
>>20	lelong		10003		\b, Hitachi SH3
>>20	lelong		10004		\b, Hitachi SH3E
>>20	lelong		10005		\b, Hitachi SH4
>>20	lelong		70001		\b, ARM 7TDMI
>>52	leshort		1 		\b, 1 file
>>52	leshort		>1 		\b, %u files
>>56	leshort		1 		\b, 1 registry entry
>>56	leshort		>1 		\b, %u registry entries
>
># Outlook Personal Folders
>0	lelong	0x4E444221	Microsoft Outlook binary email folder
>
># From: Dirk Jagdmann <doj@cubic.org>
>0	lelong	0x00035f3f	Windows 3.x help file
>
># Christophe Monniez
>0	string	Client\ UrlCache\ MMF 	Microsoft Internet Explorer Cache File
>>20	string	>\0			Version %s
>0	string	\xCF\xAD\x12\xFE	Microsoft Outlook Express DBX File
>>4	byte	=0xC5			Message database
>>4	byte	=0xC6			Folder database
>>4	byte	=0xC7			Accounts informations
>>4	byte	=0x30			Offline database
>
>
># Windows Enhanced Metafile (EMF)
># See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 
># for further information. Note that "0 lelong 1" should be true i.e.
># the first double word in the file should be 1. With the extended
># syntax available by some file commands you could write:
># 0 lelong 1
># &40 ulelong 0x464D4520 Windows Enhanced Metafile (EMF) image data
>40	ulelong 0x464D4520	Windows Enhanced Metafile (EMF) image data
>>44	ulelong x		version 0x%x.
># If the description has a length greater than zero, it exists and is 
># found at offset (*64).
>>64	ulelong >0		Description available at offset 0x%x
>>>60	ulelong	>0		(length 0x%x)
># Note it would be better to print out the description, which is found 
># as below. Unfortunately the following only prints out the first couple
># of characters instead of all the "description length"
># number of characters -- indicated by the ulelong at offset 60.
>>>(64.l)  lestring16 >0 Description: %15.15s
>#------------------------------------------------------------------------------
># modem:  file(1) magic for modem programs
>#
># From: Florian La Roche <florian@knorke.saar.de>
>1	string		PC\ Research,\ Inc	Digifax-G3-File
>>29	byte		1		\b, fine resolution
>>29	byte		0		\b, normal resolution
>
>0	short		0x0100		raw G3 data, byte-padded
>0	short		0x1400		raw G3 data
>#
># Magic data for vgetty voice formats
># (Martin Seine & Marc Eberhard)
>
>#
># raw modem data version 1
>#
>0    string    RMD1      raw modem data
>>4   string    >\0       (%s /
>>20  short     >0        compression type 0x%04x)
>
>#
># portable voice format 1
>#
>0    string    PVF1\n         portable voice format
>>5   string    >\0       (binary %s)
>
>#
># portable voice format 2
>#
>0    string    PVF2\n         portable voice format
>>5   string >\0          (ascii %s)
>
>
>#------------------------------------------------------------------------------
># msvc:  file(1) magic for msvc
># "H. Nanosecond" <aldomel@ix.netcom.com>
># Microsoft visual C
># 
># I have version 1.0
>
># .aps
>0	string	HWB\000\377\001\000\000\000	Microsoft Visual C .APS file
>
># .ide
>#too long 0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157\152\145\143\164\040\106\151\154\145\012\000\032\000\002\000\262\000\272\276\372\316	MSVC .ide
>0	string	\102\157\162\154\141\156\144\040\103\053\053\040\120\162\157	MSVC .ide
>
># .res
>0	string	\000\000\000\000\040\000\000\000\377	MSVC .res
>0	string	\377\003\000\377\001\000\020\020\350	MSVC .res
>0	string	\377\003\000\377\001\000\060\020\350	MSVC .res
>
>#.lib
>0	string	\360\015\000\000	Microsoft Visual C library
>0	string	\360\075\000\000	Microsoft Visual C library
>0	string	\360\175\000\000	Microsoft Visual C library
>
>#.pch
>0	string	DTJPCH0\000\022\103\006\200	Microsoft Visual C .pch
>
># .pdb
># too long 0	string	Microsoft\ C/C++\ program\ database\ 
>0	string	Microsoft\ C/C++\ 	MSVC program database
>>18	string	program\ database\ 	
>>33	string	>\0	ver %s
>
>#.sbr
>0	string	\000\002\000\007\000	MSVC .sbr
>>5	string 	>\0	%s
>
>#.bsc
>0	string	\002\000\002\001	MSVC .bsc
>
>#.wsp
>0	string	1.00\ .0000.0000\000\003	MSVC .wsp version 1.0000.0000
># these seem to start with the version and contain menus
>
>#-----------------------------------------------------------------------------
># natinst:  file(1) magic for National Instruments Code Files
>
>#
># From <egamez@fcfm.buap.mx> Enrique Gámez-Flores
># version 1
># Many formats still missing, we use, for the moment LabVIEW
># We guess VXI format file. VISA, LabWindowsCVI, BridgeVIEW, etc, are missing
>#
>0       string          RSRC            National Instruments,
># Check if it's a LabVIEW File
>>8      string          LV              LabVIEW File,
># Check wich kind of file is
>>>10    string          SB              Code Resource File, data
>>>10    string          IN              Virtual Instrument Program, data
>>>10    string          AR              VI Library, data
># This is for Menu Libraries
>>8      string          LMNULBVW        Portable File Names, data
># This is for General Resources
>>8      string          rsc             Resources File, data
># This is for VXI Package
>0       string          VMAP            National Instruments, VXI File, data
>
>#------------------------------------------------------------------------------
># ncr:  file(1) magic for NCR Tower objects
>#
># contributed by
># Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
># uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
>#
>0	beshort		000610	Tower/XP rel 2 object
>>12	   belong		>0	not stripped
>>20	   beshort		0407	executable
>>20	   beshort		0410	pure executable
>>22	   beshort		>0	- version %ld
>0	beshort		000615	Tower/XP rel 2 object
>>12	   belong		>0	not stripped
>>20	   beshort		0407	executable
>>20	   beshort		0410	pure executable
>>22	   beshort		>0	- version %ld
>0	beshort		000620	Tower/XP rel 3 object
>>12	   belong		>0	not stripped
>>20	   beshort		0407	executable
>>20	   beshort		0410	pure executable
>>22	   beshort		>0	- version %ld
>0	beshort		000625	Tower/XP rel 3 object
>>12	   belong		>0	not stripped
>>20	   beshort		0407	executable
>>20	   beshort		0410	pure executable
>>22	   beshort		>0	- version %ld
>0	beshort		000630	Tower32/600/400 68020 object
>>12	   belong		>0	not stripped
>>20	   beshort		0407	executable
>>20	   beshort		0410	pure executable
>>22	   beshort		>0	- version %ld
>0	beshort		000640	Tower32/800 68020
>>18	   beshort		&020000	w/68881 object
>>18	   beshort		&040000	compatible object
>>18	   beshort		&~060000	object
>>20	   beshort		0407	executable
>>20	   beshort		0413	pure executable
>>12	   belong		>0	not stripped
>>22	   beshort		>0	- version %ld
>0	beshort		000645	Tower32/800 68010
>>18	   beshort		&040000	compatible object
>>18	   beshort		&~060000 object
>>20	   beshort		0407	executable
>>20	   beshort		0413	pure executable
>>12	   belong		>0	not stripped
>>22	   beshort		>0	- version %ld
>
>#------------------------------------------------------------------------------
># netbsd:  file(1) magic for NetBSD objects
>#
># All new-style magic numbers are in network byte order.
>#
>
>0	lelong			000000407	a.out NetBSD little-endian object file
>>16	lelong			>0		not stripped
>0	belong			000000407	a.out NetBSD big-endian object file
>>16	belong			>0		not stripped
>
>0	belong&0377777777	041400413	a.out NetBSD/i386 demand paged
>>0	byte			&0x80		
>>>20	lelong			<4096		shared library
>>>20	lelong			=4096		dynamically linked executable
>>>20	lelong			>4096		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	041400410	a.out NetBSD/i386 pure
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	041400407	a.out NetBSD/i386
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80
>>>0	byte			&0x40		position independent
>>>20	lelong			!0		executable
>>>20	lelong			=0		object file
>>16	lelong			>0		not stripped
>0	belong&0377777777	041400507	a.out NetBSD/i386 core
>>12	string			>\0		from '%s'
>>32	lelong			!0		(signal %d)
>
>0	belong&0377777777	041600413	a.out NetBSD/m68k demand paged
>>0	byte			&0x80		
>>>20	belong			<8192		shared library
>>>20	belong			=8192		dynamically linked executable
>>>20	belong			>8192		dynamically linked executable
>>0	byte			^0x80		executable
>>16	belong			>0		not stripped
>0	belong&0377777777	041600410	a.out NetBSD/m68k pure
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80		executable
>>16	belong			>0		not stripped
>0	belong&0377777777	041600407	a.out NetBSD/m68k
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80
>>>0	byte			&0x40		position independent
>>>20	belong			!0		executable
>>>20	belong			=0		object file
>>16	belong			>0		not stripped
>0	belong&0377777777	041600507	a.out NetBSD/m68k core
>>12	string			>\0		from '%s'
>>32	belong			!0		(signal %d)
>
>0	belong&0377777777	042000413	a.out NetBSD/m68k4k demand paged
>>0	byte			&0x80		
>>>20	belong			<4096		shared library
>>>20	belong			=4096		dynamically linked executable
>>>20	belong			>4096		dynamically linked executable
>>0	byte			^0x80		executable
>>16	belong			>0		not stripped
>0	belong&0377777777	042000410	a.out NetBSD/m68k4k pure
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80		executable
>>16	belong			>0		not stripped
>0	belong&0377777777	042000407	a.out NetBSD/m68k4k
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80
>>>0	byte			&0x40		position independent
>>>20	belong			!0		executable
>>>20	belong			=0		object file
>>16	belong			>0		not stripped
>0	belong&0377777777	042000507	a.out NetBSD/m68k4k core
>>12	string			>\0		from '%s'
>>32	belong			!0		(signal %d)
>
>0	belong&0377777777	042200413	a.out NetBSD/ns32532 demand paged
>>0	byte			&0x80		
>>>20	lelong			<4096		shared library
>>>20	lelong			=4096		dynamically linked executable
>>>20	lelong			>4096		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	042200410	a.out NetBSD/ns32532 pure
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	042200407	a.out NetBSD/ns32532
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80
>>>0	byte			&0x40		position independent
>>>20	lelong			!0		executable
>>>20	lelong			=0		object file
>>16	lelong			>0		not stripped
>0	belong&0377777777	042200507	a.out NetBSD/ns32532 core
>>12	string			>\0		from '%s'
>>32	lelong			!0		(signal %d)
>
>0	belong&0377777777	045200507	a.out NetBSD/powerpc core
>>12	string			>\0		from '%s'
>
>0	belong&0377777777	042400413	a.out NetBSD/SPARC demand paged
>>0	byte			&0x80		
>>>20	belong			<8192		shared library
>>>20	belong			=8192		dynamically linked executable
>>>20	belong			>8192		dynamically linked executable
>>0	byte			^0x80		executable
>>16	belong			>0		not stripped
>0	belong&0377777777	042400410	a.out NetBSD/SPARC pure
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80		executable
>>16	belong			>0		not stripped
>0	belong&0377777777	042400407	a.out NetBSD/SPARC
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80
>>>0	byte			&0x40		position independent
>>>20	belong			!0		executable
>>>20	belong			=0		object file
>>16	belong			>0		not stripped
>0	belong&0377777777	042400507	a.out NetBSD/SPARC core
>>12	string			>\0		from '%s'
>>32	belong			!0		(signal %d)
>
>0	belong&0377777777	042600413	a.out NetBSD/pmax demand paged
>>0	byte			&0x80		
>>>20	lelong			<4096		shared library
>>>20	lelong			=4096		dynamically linked executable
>>>20	lelong			>4096		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	042600410	a.out NetBSD/pmax pure
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	042600407	a.out NetBSD/pmax
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80
>>>0	byte			&0x40		position independent
>>>20	lelong			!0		executable
>>>20	lelong			=0		object file
>>16	lelong			>0		not stripped
>0	belong&0377777777	042600507	a.out NetBSD/pmax core
>>12	string			>\0		from '%s'
>>32	lelong			!0		(signal %d)
>
>0	belong&0377777777	043000413	a.out NetBSD/vax 1k demand paged
>>0	byte			&0x80		
>>>20	lelong			<4096		shared library
>>>20	lelong			=4096		dynamically linked executable
>>>20	lelong			>4096		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	043000410	a.out NetBSD/vax 1k pure
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	043000407	a.out NetBSD/vax 1k
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80
>>>0	byte			&0x40		position independent
>>>20	lelong			!0		executable
>>>20	lelong			=0		object file
>>16	lelong			>0		not stripped
>0	belong&0377777777	043000507	a.out NetBSD/vax 1k core
>>12	string			>\0		from '%s'
>>32	lelong			!0		(signal %d)
>
>0	belong&0377777777	045400413	a.out NetBSD/vax 4k demand paged
>>0	byte			&0x80		
>>>20	lelong			<4096		shared library
>>>20	lelong			=4096		dynamically linked executable
>>>20	lelong			>4096		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	045400410	a.out NetBSD/vax 4k pure
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	045400407	a.out NetBSD/vax 4k
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80
>>>0	byte			&0x40		position independent
>>>20	lelong			!0		executable
>>>20	lelong			=0		object file
>>16	lelong			>0		not stripped
>0	belong&0377777777	045400507	a.out NetBSD/vax 4k core
>>12	string			>\0		from '%s'
>>32	lelong			!0		(signal %d)
>
># NetBSD/alpha does not support (and has never supported) a.out objects,
># so no rules are provided for them.  NetBSD/alpha ELF objects are 
># dealt with in "elf".
>0	lelong		0x00070185		ECOFF NetBSD/alpha binary
>>10	leshort		0x0001			not stripped
>>10	leshort		0x0000			stripped
>0	belong&0377777777	043200507	a.out NetBSD/alpha core
>>12	string			>\0		from '%s'
>>32	lelong			!0		(signal %d)
>
>0	belong&0377777777	043400413	a.out NetBSD/mips demand paged
>>0	byte			&0x80		
>>>20	belong			<8192		shared library
>>>20	belong			=8192		dynamically linked executable
>>>20	belong			>8192		dynamically linked executable
>>0	byte			^0x80		executable
>>16	belong			>0		not stripped
>0	belong&0377777777	043400410	a.out NetBSD/mips pure
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80		executable
>>16	belong			>0		not stripped
>0	belong&0377777777	043400407	a.out NetBSD/mips
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80
>>>0	byte			&0x40		position independent
>>>20	belong			!0		executable
>>>20	belong			=0		object file
>>16	belong			>0		not stripped
>0	belong&0377777777	043400507	a.out NetBSD/mips core
>>12	string			>\0		from '%s'
>>32	belong			!0		(signal %d)
>
>0	belong&0377777777	043600413	a.out NetBSD/arm32 demand paged
>>0	byte			&0x80
>>>20	lelong			<4096		shared library
>>>20	lelong			=4096		dynamically linked executable
>>>20	lelong			>4096		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	043600410	a.out NetBSD/arm32 pure
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80		executable
>>16	lelong			>0		not stripped
>0	belong&0377777777	043600407	a.out NetBSD/arm32
>>0	byte			&0x80		dynamically linked executable
>>0	byte			^0x80
>>>0	byte			&0x40		position independent
>>>20	lelong			!0		executable
>>>20	lelong			=0		object file
>>16	lelong			>0		not stripped
># NetBSD/arm26 has always used ELF objects, but it shares a core file
># format with NetBSD/arm32.
>0	belong&0377777777	043600507	a.out NetBSD/arm core
>>12	string			>\0		from '%s'
>>32	lelong			!0		(signal %d)
>
>#------------------------------------------------------------------------------
># netscape:  file(1) magic for Netscape files
># "H. Nanosecond" <aldomel@ix.netcom.com>
># version 3 and 4 I think
>#
>
># Netscape Address book  .nab
>0	string \000\017\102\104\000\000\000\000\000\000\001\000\000\000\000\002\000\000\000\002\000\000\004\000 Netscape Address book
>
># Netscape Communicator address book
>0   string   \000\017\102\111 Netscape Communicator address book
>
># .snm Caches
>0	string		#\ Netscape\ folder\ cache	Netscape folder cache
>0	string	\000\036\204\220\000	Netscape folder cache
># .n2p 
># Net 2 Phone 
>#0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
>0	string	SX961999	Net2phone
>
>#
>#This is files ending in .art, FIXME add more rules
>0       string          JG\004\016\0\0\0\0      ART
>#------------------------------------------------------------------------------
># netware:  file(1) magic for NetWare Loadable Modules (NLMs)
>
>0	string	NetWare\ Loadable\ Module	NetWare Loadable Module
>
>#------------------------------------------------------------------------------
># news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
>#
>0	string		StartFontMetrics	ASCII font metrics
>0	string		StartFont	ASCII font bits
>0	belong		0x137A2944	NeWS bitmap font
>0	belong		0x137A2947	NeWS font family
>0	belong		0x137A2950	scalable OpenFont binary
>0	belong		0x137A2951	encrypted scalable OpenFont binary
>8	belong		0x137A2B45	X11/NeWS bitmap font
>8	belong		0x137A2B48	X11/NeWS font family
>#------------------------------------------------------------------------------
># nitpicker:  file(1) magic for Flowfiles.
># From: Christian Jachmann <C.Jachmann@gmx.net> http://www.nitpicker.de
>0	string	NPFF	NItpicker Flow File 
>>4	byte	x	V%d.
>>5	byte	x	%d
>>6	bedate	x	started: %s
>>10	bedate	x	stopped: %s
>>14	belong	x	Bytes: %u
>>18	belong	x	Bytes1: %u
>>22	belong	x	Flows: %u
>>26	belong	x	Pkts: %u
>
>#------------------------------------------------------------------------------
># ocaml: file(1) magic for Objective Caml files.
>0	string	Caml1999	Objective caml
>>8	string	X		exec file
>>8	string	I		interface file (.cmi)
>>8	string	O		object file (.cmo)
>>8	string	A		library file (.cma)
>>8	string	Y		native object file (.cmx)
>>8	string	Z		native library file (.cmxa)
>>8	string	M		abstract syntax tree implementation file
>>8	string	N		abstract syntax tree interface file
>>9	string	>\0		(Version %3.3s).
>#------------------------------------------------------------------------------
># octave binary data file(1) magic, from Dirk Eddelbuettel <edd@debian.org>
>0	string		Octave-1-L	Octave binary data (little endian)
>0	string		Octave-1-B	Octave binary data (big endian)
>
>#------------------------------------------------------------------------------
># olf:  file(1) magic for OLF executables
>#
># We have to check the byte order flag to see what byte order all the
># other stuff in the header is in.
>#
># MIPS R3000 may also be for MIPS R2000.
># What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
>#
># Created by Erik Theisen <etheisen@openbsd.org>
># Based on elf from Daniel Quinlan <quinlan@yggdrasil.com>
>0	string		\177OLF		OLF
>>4	byte		0		invalid class
>>4	byte		1		32-bit
>>4	byte		2		64-bit
>>7	byte		0		invalid os
>>7	byte		1		OpenBSD
>>7	byte		2		NetBSD
>>7	byte		3		FreeBSD
>>7	byte		4		4.4BSD
>>7	byte		5		Linux
>>7	byte		6		SVR4
>>7	byte		7		esix
>>7	byte		8		Solaris
>>7	byte		9		Irix
>>7	byte		10		SCO
>>7	byte		11		Dell
>>7	byte		12		NCR
>>5	byte		0		invalid byte order
>>5	byte		1		LSB
>>>16	leshort		0		no file type,
>>>16	leshort		1		relocatable,
>>>16	leshort		2		executable,
>>>16	leshort		3		shared object,
># Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
># corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
>>>16	leshort		4		core file
>>>>(0x38+0xcc) string	>\0		of '%s'
>>>>(0x38+0x10) lelong	>0		(signal %d),
>>>16	leshort		&0xff00		processor-specific,
>>>18	leshort		0		no machine,
>>>18	leshort		1		AT&T WE32100 - invalid byte order,
>>>18	leshort		2		SPARC - invalid byte order,
>>>18	leshort		3		Intel 80386,
>>>18	leshort		4		Motorola 68000 - invalid byte order,
>>>18	leshort		5		Motorola 88000 - invalid byte order,
>>>18	leshort		6		Intel 80486,
>>>18	leshort		7		Intel 80860,
>>>18	leshort		8		MIPS R3000_BE - invalid byte order,
>>>18	leshort		9		Amdahl - invalid byte order,
>>>18	leshort		10		MIPS R3000_LE,
>>>18	leshort		11		RS6000 - invalid byte order,
>>>18	leshort		15		PA-RISC - invalid byte order,
>>>18	leshort		16		nCUBE,
>>>18	leshort		17		VPP500,
>>>18	leshort		18		SPARC32PLUS,
>>>18	leshort		20		PowerPC,
>>>18	leshort		0x9026		Alpha,
>>>20	lelong		0		invalid version
>>>20	lelong		1		version 1
>>>36	lelong		1		MathCoPro/FPU/MAU Required
>>8	string		>\0		(%s)
>>5	byte		2		MSB
>>>16	beshort		0		no file type,
>>>16	beshort		1		relocatable,
>>>16	beshort		2		executable,
>>>16	beshort		3		shared object,
>>>16	beshort		4		core file,
>>>>(0x38+0xcc) string	>\0		of '%s'
>>>>(0x38+0x10) belong	>0		(signal %d),
>>>16	beshort		&0xff00		processor-specific,
>>>18	beshort		0		no machine,
>>>18	beshort		1		AT&T WE32100,
>>>18	beshort		2		SPARC,
>>>18	beshort		3		Intel 80386 - invalid byte order,
>>>18	beshort		4		Motorola 68000,
>>>18	beshort		5		Motorola 88000,
>>>18	beshort		6		Intel 80486 - invalid byte order,
>>>18	beshort		7		Intel 80860,
>>>18	beshort		8		MIPS R3000_BE,
>>>18	beshort		9		Amdahl,
>>>18	beshort		10		MIPS R3000_LE - invalid byte order,
>>>18	beshort		11		RS6000,
>>>18	beshort		15		PA-RISC,
>>>18	beshort		16		nCUBE,
>>>18	beshort		17		VPP500,
>>>18	beshort		18		SPARC32PLUS,
>>>18	beshort		20		PowerPC or cisco 4500,
>>>18	beshort		21		cisco 7500,
>>>18	beshort		24		cisco SVIP,
>>>18	beshort		25		cisco 7200,
>>>18	beshort		36		cisco 12000,
>>>18	beshort		0x9026		Alpha,
>>>20	belong		0		invalid version
>>>20	belong		1		version 1
>>>36	belong		1		MathCoPro/FPU/MAU Required
>
>#------------------------------------------------------------------------------
># os2:  file(1) magic for OS/2 files
>#
>
># Provided 1998/08/22 by
># David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
>1	string	InternetShortcut	MS Windows 95 Internet shortcut text
>>24	string	>\			(URL=<%s>)
>
># OS/2 URL objects
># Provided 1998/08/22 by
># David Mediavilla <davidme.news@REMOVEIFNOTSPAMusa.net>
>#0	string	http:			OS/2 URL object text
>#>5	string	>\			(WWW) <http:%s>
>#0	string	mailto:			OS/2 URL object text
>#>7	string	>\			(email) <%s>
>#0	string	news:			OS/2 URL object text
>#>5	string	>\			(Usenet) <%s>
>#0	string	ftp:			OS/2 URL object text
>#>4	string	>\			(FTP) <ftp:%s>
>#0	string	file:			OS/2 URL object text
>#>5	string	>\			(Local file) <%s>
>
># >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett ddissett@netcom.com)
># Carl Hauser (chauser.parc@xerox.com) and 
># Marcus Groeber (marcusg@ph-cip.uni-koeln.de)
># list the following header format in inf02a.doc:
>#
>#  int16 ID;           // ID magic word (5348h = "HS")
>#  int8  unknown1;     // unknown purpose, could be third letter of ID
>#  int8  flags;        // probably a flag word...
>#                      //  bit 0: set if INF style file
>#                      //  bit 4: set if HLP style file
>#                      // patching this byte allows reading HLP files
>#                      // using the VIEW command, while help files 
>#                      // seem to work with INF settings here as well.
>#  int16 hdrsize;      // total size of header
>#  int16 unknown2;     // unknown purpose
># 
>0   string  HSP\x01\x9b\x00 OS/2 INF
>>107 string >0                      (%s)
>0   string  HSP\x10\x9b\x00     OS/2 HLP
>>107 string >0                      (%s)
>
># OS/2 INI (this is a guess)
>0  string   \xff\xff\xff\xff\x14\0\0\0  OS/2 INI
>#
># Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
>#
># Redistribution and use in source and binary forms, with or without
># modification, are permitted provided that the following conditions
># are met:
># 1. Redistributions of source code must retain the above copyright
>#    notice, this list of conditions and the following disclaimer.
># 2. Redistributions in binary form must reproduce the above copyright
>#    notice, this list of conditions and the following disclaimer in the
>#    documentation and/or other materials provided with the distribution.
># 3. All advertising materials mentioning features or use of this software
>#    must display the following acknowledgement:
>#      This product includes software developed by Ignatios Souvatzis for
>#      the NetBSD project.
># 4. The name of the author may not be used to endorse or promote products
>#    derived from this software without specific prior written permission.
>#
>#
># THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
># IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
># OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  
># IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
># SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
># PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
># OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
># WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
># OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
># ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>#
>#
>#
># OS9/6809 module descriptions:
>#
>0	beshort		0x87CD	OS9/6809 module:
>#
>>6	byte&0x0f	0x00	non-executable
>>6	byte&0x0f	0x01	machine language
>>6	byte&0x0f	0x02	BASIC I-code
>>6	byte&0x0f	0x03	Pascal P-code
>>6	byte&0x0f	0x04	C I-code
>>6	byte&0x0f	0x05	COBOL I-code
>>6	byte&0x0f	0x06	Fortran I-code
>#
>>6	byte&0xf0	0x10	program executable
>>6	byte&0xf0	0x20	subroutine
>>6	byte&0xf0	0x30	multi-module
>>6	byte&0xf0	0x40	data module
>#
>>6	byte&0xf0	0xC0	system module
>>6	byte&0xf0	0xD0	file manager
>>6	byte&0xf0	0xE0	device driver
>>6	byte&0xf0	0xF0	device descriptor
>#
># OS9/m68k stuff (to be continued)
>#
>0	beshort		0x4AFC	OS9/68K module:
>#
># attr
>>0x14	byte&0x80	0x80	re-entrant
>>0x14	byte&0x40	0x40	ghost
>>0x14	byte&0x20	0x20	system-state
>#
># lang:
>#
>>0x13	byte		1	machine language
>>0x13	byte		2	BASIC I-code
>>0x13	byte		3	Pascal P-code
>>0x13	byte		4	C I-code
>>0x13	byte		5	COBOL I-code
>>0x13	byte		6	Fortran I-code
>#
>#
># type:
>#
>>0x12	byte		1	program executable
>>0x12	byte		2	subroutine
>>0x12	byte		3	multi-module
>>0x12	byte		4	data module
>>0x12	byte		11	trap library
>>0x12	byte		12	system module
>>0x12	byte		13	file manager
>>0x12	byte		14	device driver
>>0x12	byte		15	device descriptor
>#
># Mach magic number info
>#
>0	long		0xefbe	OSF/Rose object
># I386 magic number info
>#
>0	short		0565	i386 COFF object
>
>#------------------------------------------------------------------------------
># palm:  file(1) magic for PalmOS {.prc,.pdb}: applications, docfiles, and hacks
>#
># Brian Lalor <blalor@hcirisc.cs.binghamton.edu>
>
># appl
>60      belong                  0x6170706c      PalmOS application
>>0      string                  >\0             "%s"
># TEXt
>60      belong                  0x54455874      AportisDoc file
>>0      string                  >\0             "%s"
># HACK
>60      belong                  0x4841434b      HackMaster hack
>>0      string                  >\0             "%s"
>
># Variety of PalmOS document types
># Michael-John Turner <mj@debian.org>
># Thanks to Hasan Umit Ezerce <humit@tr-net.net.tr> for his DocType
>60	string	                BVokBDIC	BDicty PalmOS document
>>0	string                  >\0             "%s"
>60	string	                DB99DBOS	DB PalmOS document
>>0	string                  >\0             "%s"
>60	string	                vIMGView	FireViewer/ImageViewer PalmOS document
>>0	string                  >\0             "%s"
>60	string	                PmDBPmDB	HanDBase PalmOS document
>>0	string                  >\0             "%s"
>60	string	                InfoINDB	InfoView PalmOS document
>>0	string                  >\0             "%s"
>60	string	                ToGoToGo	iSilo PalmOS document
>>0	string                  >\0             "%s"
>60	string	                JfDbJBas	JFile PalmOS document
>>0	string                  >\0             "%s"
>60	string	                JfDbJFil	JFile Pro PalmOS document
>>0	string                  >\0             "%s"
>60	string	                DATALSdb	List PalmOS document
>>0	string                  >\0             "%s"
>60	string	                Mdb1Mdb1	MobileDB PalmOS document
>>0	string                  >\0             "%s"
>60	string	                PNRdPPrs	PeanutPress PalmOS document
>>0	string                  >\0             "%s"
>60	string	                DataPlkr	Plucker PalmOS document
>>0	string                  >\0             "%s"
>60	string	                DataSprd	QuickSheet PalmOS document
>>0	string                  >\0             "%s"
>60	string	                SM01SMem	SuperMemo PalmOS document
>>0	string                  >\0             "%s"
>60	string	                DataTlPt	TealDoc PalmOS document
>>0	string                  >\0             "%s"
>60	string	                InfoTlIf	TealInfo PalmOS document
>>0	string                  >\0             "%s"
>60	string	                DataTlMl	TealMeal PalmOS document
>>0	string                  >\0             "%s"
>60	string	                DataTlPt	TealPaint PalmOS document
>>0	string                  >\0             "%s"
>60	string	                dataTDBP	ThinkDB PalmOS document
>>0	string                  >\0             "%s"
>60	string	                TdatTide	Tides PalmOS document
>>0	string                  >\0             "%s"
>60	string	                ToRaTRPW	TomeRaider PalmOS document
>>0	string                  >\0             "%s"
>
># A GutenPalm zTXT etext for use on Palm Pilots (http://gutenpalm.sf.net)
># For version 1.xx zTXTs, outputs version and numbers of bookmarks and
>#   annotations.
># For other versions, just outputs version.
>#
>60		string		zTXT		A GutenPalm zTXT e-book
>>0		string		>\0		"%s"
>>(0x4E.L)	byte		0
>>>(0x4E.L+1)	byte		x		(v0.%02d)
>>(0x4E.L)	byte		1
>>>(0x4E.L+1)	byte		x		(v1.%02d)
>>>>(0x4E.L+10)	beshort		>0
>>>>>(0x4E.L+10) beshort		<2		- 1 bookmark
>>>>>(0x4E.L+10) beshort		>1		- %d bookmarks
>>>>(0x4E.L+14)	beshort		>0
>>>>>(0x4E.L+14) beshort		<2		- 1 annotation
>>>>>(0x4E.L+14) beshort		>1		- %d annotations
>>(0x4E.L)	byte		>1		(v%d.
>>>(0x4E.L+1)	byte		x		%02d)
>
># Palm OS .prc file types
>60		string		libr		Palm OS dynamic library data
>>0		string		>\0		"%s"
>60		string		ptch		Palm OS operating system patch data
>>0		string		>\0		"%s"
>
># Mobipocket (www.mobipocket.com), donated by Carl Witty
>60	string	                BOOKMOBI	Mobipocket E-book
>>0	string                  >\0             "%s"
>
>#------------------------------------------------------------------------------
>#
># Parix COFF executables
># From: Ignatios Souvatzis <ignatios@cs.uni-bonn.de>
>#
>0	beshort&0xfff	0xACE	PARIX
>>0	byte&0xf0	0x80	T800
>>0	byte&0xf0	0x90	T9000
>>19	byte&0x02	0x02	executable
>>19	byte&0x02	0x00	object
>>19	byte&0x0c	0x00	not stripped
>
>#------------------------------------------------------------------------------
># pbm:  file(1) magic for Portable Bitmap files
>#
># XXX - byte order?
>#
>0	short	0x2a17	"compact bitmap" format (Poskanzer)
>#------------------------------------------------------------------------------
># pdf:  file(1) magic for Portable Document Format
>#
>
>0	string		%PDF-		PDF document
>>5	byte		x		\b, version %c
>>7	byte		x		\b.%c
>
>#------------------------------------------------------------------------------
># pdp:  file(1) magic for PDP-11 executable/object and APL workspace
>#
>0	lelong		0101555		PDP-11 single precision APL workspace
>0	lelong		0101554		PDP-11 double precision APL workspace
>#
># PDP-11 a.out
>#
>0	leshort		0407		PDP-11 executable
>>8	leshort		>0		not stripped
>>15	byte		>0		- version %ld
>
>0	leshort		0401		PDP-11 UNIX/RT ldp
>0	leshort		0405		PDP-11 old overlay
>
>0	leshort		0410		PDP-11 pure executable
>>8	leshort		>0		not stripped
>>15	byte		>0		- version %ld
>
>0	leshort		0411		PDP-11 separate I&D executable
>>8	leshort		>0		not stripped
>>15	byte		>0		- version %ld
>
>0	leshort		0437		PDP-11 kernel overlay
>
># These last three are derived from 2.11BSD file(1)
>0	leshort		0413		PDP-11 demand-paged pure executable
>>8	leshort		>0		not stripped
>
>0	leshort		0430		PDP-11 overlaid pure executable
>>8	leshort		>0		not stripped
>
>0	leshort		0431		PDP-11 overlaid separate executable
>>8	leshort		>0		not stripped
>
>#------------------------------------------------------------------------------
># perl:  file(1) magic for Larry Wall's perl language.
>#
># The ``eval'' line recognizes an outrageously clever hack for USG systems.
># Keith Waclena <keith@cerberus.uchicago.edu>
># Send additions to <perl5-porters@perl.org>
>0	string/b	#!\ /bin/perl			perl script text
>0	string		eval\ "exec\ /bin/perl		perl script text
>0	string/b	#!\ /usr/bin/perl		perl script text
>0	string		eval\ "exec\ /usr/bin/perl	perl script text
>0	string/b	#!\ /usr/local/bin/perl		perl script text
>0	string		eval\ "exec\ /usr/local/bin/perl	perl script text
>0	string		eval\ '(exit\ $?0)'\ &&\ eval\ 'exec	perl script text
>
># a couple more, by me
># XXX: christos matches
>#0	regex		package		Perl5 module source text (via regex)
>0	string		package		Perl5 module source text
>
># Perl Storable data files.
>0	string	perl-store	perl Storable(v0.6) data
>>4	byte	>0	(net-order %d)
>>>4	byte	&01	(network-ordered)
>>>4	byte	=3	(major 1)
>>>4	byte	=2	(major 1)
>
>0	string	pst0	perl Storable(v0.7) data
>>4	byte	>0
>>>4	byte	&01	(network-ordered)
>>>4	byte	=5	(major 2)
>>>4	byte	=4	(major 2)
>>>5	byte	>0	(minor %d)
>
>#------------------------------------------------------------------------------
># pgp:  file(1) magic for Pretty Good Privacy
>#
>0       beshort         0x9900                  PGP key public ring
>0       beshort         0x9501                  PGP key security ring
>0       beshort         0x9500                  PGP key security ring
>0	beshort		0xa600			PGP encrypted data
>0       string          -----BEGIN\040PGP       PGP armored data
>>15     string          PUBLIC\040KEY\040BLOCK- public key block
>>15     string          MESSAGE-                message
>>15     string          SIGNED\040MESSAGE-      signed message
>>15     string          PGP\040SIGNATURE-       signature
>
>#------------------------------------------------------------------------------
># pkgadd:  file(1) magic for SysV R4 PKG Datastreams
>#
>0       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)
>
>#------------------------------------------------------------------------------
># plan9:  file(1) magic for AT&T Bell Labs' Plan 9 executables
># From: "Stefan A. Haubenthal" <polluks@web.de>
>#
>0	belong		0x00000107	Plan 9 executable, Motorola 68k
>0	belong		0x000001EB	Plan 9 executable, Intel 386
>0	belong		0x00000247	Plan 9 executable, Intel 960
>0	belong		0x000002AB	Plan 9 executable, SPARC
>0	belong		0x00000407	Plan 9 executable, MIPS R3000
>0	belong		0x0000048B	Plan 9 executable, AT&T DSP 3210
>0	belong		0x00000517	Plan 9 executable, MIPS R4000 BE
>0	belong		0x000005AB	Plan 9 executable, AMD 29000
>0	belong		0x00000647	Plan 9 executable, ARM 7-something
>0	belong		0x000006EB	Plan 9 executable, PowerPC
>0	belong		0x00000797	Plan 9 executable, MIPS R4000 LE
>0	belong		0x0000084B	Plan 9 executable, DEC Alpha
>
>#------------------------------------------------------------------------------
># plus5:  file(1) magic for Plus Five's UNIX MUMPS
>#
># XXX - byte order?  Paging Hokey....
>#
>0	short		0x259		mumps avl global
>>2	byte		>0		(V%d)
>>6	byte		>0		with %d byte name
>>7	byte		>0		and %d byte data cells
>0	short		0x25a		mumps blt global
>>2	byte		>0		(V%d)
>>8	short		>0		- %d byte blocks
>>15	byte		0x00		- P/D format
>>15	byte		0x01		- P/K/D format
>>15	byte		0x02		- K/D format
>>15	byte		>0x02		- Bad Flags
># SE Linux policy database
>0       lelong  0xf97cff8c      SE Linux policy
>>16     lelong  x               v%d
>>20     lelong  1 		MLS
>>24     lelong  x       	%d symbols
>>28     lelong  x       	%d ocons
>
>#------------------------------------------------------------------------------
># printer:  file(1) magic for printer-formatted files
>#
>
># PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
>0	string		%!		PostScript document text
>>2	string		PS-Adobe-	conforming
>>>11	string		>\0		at level %.3s
>>>>15	string		EPS		- type %s
>>>>15	string		Query		- type %s
>>>>15	string		ExitServer	- type %s
># Some PCs have the annoying habit of adding a ^D as a document separator
>0	string		\004%!		PostScript document text
>>3	string		PS-Adobe-	conforming
>>>12	string		>\0		at level %.3s
>>>>16	string		EPS		- type %s
>>>>16	string		Query		- type %s
>>>>16	string		ExitServer	- type %s
>0	string		\033%-12345X%!PS	PostScript document
>
>
># DOS EPS Binary File Header
># From: Ed Sznyter <ews@Black.Market.NET>
>0       belong          0xC5D0D3C6      DOS EPS Binary File
>>4      long            >0              Postscript starts at byte %d
>>>8     long            >0              length %d
>>>>12   long            >0              Metafile starts at byte %d
>>>>>16  long            >0              length %d
>>>>20   long            >0              TIFF starts at byte %d
>>>>>24  long            >0              length %d
>
># Adobe's PostScript Printer Description (PPD) files
>#       Yves Arrouye <arrouye@marin.fdn.fr>
>#
>0      string          *PPD-Adobe:    PPD file
>>13    string          x              \b, ve
>
># HP Printer Job Language
>0	string		\033%-12345X@PJL	HP Printer Job Language data
># HP Printer Job Language
># The header found on Win95 HP plot files is the "Silliest Thing possible" 
># (TM)
># Every driver puts the language at some random position, with random case
># (LANGUAGE and Language)
># For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
># From: Uwe Bonnes <bon@elektron.ikp.physik.th-darmstadt.de>
># 
>0	string		\033%-12345X@PJL	HP Printer Job Language data
>>&0	string		>\0			%s			
>>>&0	string		>\0			%s			
>>>>&0	string		>\0			%s		
>>>>>&0	string		>\0			%s		
>#>15	string		\ ENTER\ LANGUAGE\ =
>#>31	string		PostScript		PostScript
>
># HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
>0	string		\033E\033	HP PCL printer data
>>3	string		\&l0A		- default page size
>>3	string		\&l1A		- US executive page size
>>3	string		\&l2A		- US letter page size
>>3	string		\&l3A		- US legal page size
>>3	string		\&l26A		- A4 page size
>>3	string		\&l80A		- Monarch envelope size
>>3	string		\&l81A		- No. 10 envelope size
>>3	string		\&l90A		- Intl. DL envelope size
>>3	string		\&l91A		- Intl. C5 envelope size
>>3	string		\&l100A		- Intl. B5 envelope size
>>3	string		\&l-81A		- No. 10 envelope size (landscape)
>>3	string		\&l-90A		- Intl. DL envelope size (landscape)
>
># IMAGEN printer-ready files:
>0	string	@document(		Imagen printer
># this only works if "language xxx" is first item in Imagen header.
>>10	string	language\ impress	(imPRESS data)
>>10	string	language\ daisy		(daisywheel text)
>>10	string	language\ diablo	(daisywheel text)
>>10	string	language\ printer	(line printer emulation)
>>10	string	language\ tektronix	(Tektronix 4014 emulation)
># Add any other languages that your Imagen uses - remember
># to keep the word `text' if the file is human-readable.
># [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
>#
># Now magic for IMAGEN font files...
>0	string		Rast		RST-format raster font data
>>45	string		>0		face %s
># From Jukka Ukkonen
>0	string		\033[K\002\0\0\017\033(a\001\0\001\033(g	Canon Bubble Jet BJC formatted data
>
># From <mike@flyn.org>
># These are the /etc/magic entries to decode data sent to an Epson printer.
>0       string          \x1B\x40\x1B\x28\x52\x08\x00\x00REMOTE1P        Epson Stylus Color 460 data
>
>
>#------------------------------------------------------------------------------
># zenographics:  file(1) magic for Zenographics ZjStream printer data
># Rick Richardson  rickr@mn.rr.com
>0	string		JZJZ
>>0x12	string		ZZ		Zenographics ZjStream printer data (big-endian)
>0	string		ZJZJ
>>0x12	string		ZZ		Zenographics ZjStream printer data (little-endian)
>
>
>#------------------------------------------------------------------------------
># Oak Technologies printer stream
># Rick Richardson <rickr@mn.rr.com>
>0       string          OAK
>>0x07	byte		0
>>0x0b	byte		0	Oak Technologies printer stream
>
># This would otherwise be recognized as PostScript - nick@debian.org
>0	string		%!VMF 		SunClock's Vector Map Format data
>
>#------------------------------------------------------------------------------
># HP LaserJet 1000 series downloadable firmware file
>0	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware   
>
># From: Paolo <oopla@users.sf.net>
># Epson ESC/Page, ESC/PageColor 
>0	string	\x1b\x01@EJL	Epson ESC/Page language printer data
>
>#------------------------------------------------------------------------------
># project:  file(1) magic for Project management
># 
># Magic strings for ftnchek project files. Alexander Mai
>0	string	FTNCHEK_\ P	project file for ftnchek
>>10	string	1		version 2.7
>>10	string	2		version 2.8 to 2.10
>>10	string	3		version 2.11 or later
>
>#------------------------------------------------------------------------------
># psdbms:  file(1) magic for psdatabase
>#
>0	belong&0xff00ffff	0x56000000	ps database
>>1	string	>\0	version %s
>>4	string	>\0	from kernel %s
>
>#------------------------------------------------------------------------------
># psion:  file(1) magic for Psion handhelds data
># from: Peter Breitenlohner <peb@mppmu.mpg.de>
>#
>0	lelong		0x10000037	Psion Series 5
>>4	lelong		0x10000039	font file
>>4	lelong		0x1000003A	printer driver
>>4	lelong		0x1000003B	clipboard
>>4	lelong		0x10000042	multi-bitmap image
>>4	lelong		0x1000006A	application infomation file
>>4	lelong		0x1000006D
>>>8	lelong		0x1000007D	sketch image
>>>8	lelong		0x1000007E	voice note
>>>8	lelong		0x1000007F	word file
>>>8	lelong		0x10000085	OPL program
>>>8	lelong		0x10000088	sheet file
>>>8	lelong		0x100001C4	EasyFax initialisation file
>>4	lelong		0x10000073	OPO module
>>4	lelong		0x10000074	OPL application
>>4	lelong		0x1000008A	exported multi-bitmap image
>
>0	lelong		0x10000041	Psion Series 5 ROM multi-bitmap image
>
>0	lelong		0x10000050	Psion Series 5
>>4	lelong		0x1000006D	database
>>4	lelong		0x100000E4	ini file
>
>0	lelong		0x10000079	Psion Series 5 binary:
>>4	lelong		0x00000000	DLL
>>4	lelong		0x10000049	comms hardware library
>>4	lelong		0x1000004A	comms protocol library
>>4	lelong		0x1000005D	OPX
>>4	lelong		0x1000006C	application
>>4	lelong		0x1000008D	DLL
>>4	lelong		0x100000AC	logical device driver
>>4	lelong		0x100000AD	physical device driver
>>4	lelong		0x100000E5	file transfer protocol
>>4	lelong		0x100000E5	file transfer protocol
>>4	lelong		0x10000140	printer defintion
>>4	lelong		0x10000141	printer defintion
>
>0	lelong		0x1000007A	Psion Series 5 executable
>
>#------------------------------------------------------------------------------
># pulsar:  file(1) magic for Pulsar POP3 daemon binary files
>#
># http://pulsar.sourceforge.net
># mailto:rok.papez@lugos.si
>#
>
>0	belong	0x1ee7f11e	Pulsar POP3 daemon mailbox cache file.
>>4	ubelong	x		Version: %d.
>>8	ubelong	x		\b%d
>
>
>#------------------------------------------------------------------------------
># pyramid:  file(1) magic for Pyramids
>#
># XXX - byte order?
>#
>0	long		0x50900107	Pyramid 90x family executable
>0	long		0x50900108	Pyramid 90x family pure executable
>>16	long		>0		not stripped
>0	long		0x5090010b	Pyramid 90x family demand paged pure executable
>>16	long		>0		not stripped
>
>#------------------------------------------------------------------------------
># python:  file(1) magic for python
>#
># From: David Necas <yeti@physics.muni.cz>
># often the module starts with a multiline string
>0	string		"""	a python script text
># MAGIC as specified in Python/import.c (1.5 to 2.3.0a)
># 20121  ( YEAR - 1995 ) + MONTH  + DAY (little endian followed by "\r\n"
>0	belong		0x994e0d0a	python 1.5/1.6 byte-compiled
>0	belong		0x87c60d0a	python 2.0 byte-compiled
>0	belong		0x2aeb0d0a	python 2.1 byte-compiled
>0	belong		0x2ded0d0a	python 2.2 byte-compiled
>0	belong		0x3bf20d0a	python 2.3 byte-compiled
>
>#------------------------------------------------------------------------------
># file(1) magic for revision control files
># From Hendrik Scholz <hendrik@scholz.net>
>0   string /1\ :pserver:    cvs password text file
>
>#------------------------------------------------------------------------------
># riff:  file(1) magic for RIFF format
># See
>#
>#	http://www.seanet.com/users/matts/riffmci/riffmci.htm
>#
># AVI section extended by Patrik Rådman <patrik+file-magic@iki.fi>
>#
>0	string		RIFF		RIFF (little-endian) data
># RIFF Palette format
>>8	string		PAL		\b, palette
>>>16	leshort		x		\b, version %d
>>>18	leshort		x		\b, %d entries
># RIFF Device Independent Bitmap format
>>8	string		RDIB		\b, device-independent bitmap
>>>16	string		BM		
>>>>30	leshort		12		\b, OS/2 1.x format
>>>>>34	leshort		x		\b, %d x
>>>>>36	leshort		x		%d
>>>>30	leshort		64		\b, OS/2 2.x format
>>>>>34	leshort		x		\b, %d x
>>>>>36	leshort		x		%d
>>>>30	leshort		40		\b, Windows 3.x format
>>>>>34	lelong		x		\b, %d x
>>>>>38	lelong		x		%d x
>>>>>44	leshort		x		%d
># RIFF MIDI format
>>8	string		RMID		\b, MIDI
># RIFF Multimedia Movie File format
>>8	string		RMMP		\b, multimedia movie
># Microsoft WAVE format (*.wav)
>>8	string		WAVE		\b, WAVE audio
>>>20	leshort		1		\b, Microsoft PCM
>>>>34	leshort		>0		\b, %d bit
>>>20	leshort		2		\b, Microsoft ADPCM
>>>20	leshort		6		\b, ITU G.711 A-law
>>>20	leshort		7		\b, ITU G.711 mu-law
>>>20	leshort		17		\b, IMA ADPCM
>>>20	leshort		20		\b, ITU G.723 ADPCM (Yamaha)
>>>20	leshort		49		\b, GSM 6.10
>>>20	leshort		64		\b, ITU G.721 ADPCM
>>>20	leshort		80		\b, MPEG
>>>20	leshort		85		\b, MPEG Layer 3
>>>22	leshort		=1		\b, mono
>>>22	leshort		=2		\b, stereo
>>>22	leshort		>2		\b, %d channels
>>>24	lelong		>0		%d Hz
># Corel Draw Picture
>>8	string		CDRA		\b, Corel Draw Picture
># AVI == Audio Video Interleave
>>8	string		AVI\040		\b, AVI
>>>12    string          LIST
>>>>20   string          hdrlavih
>>>>>&36 lelong          x               \b, %lu x
>>>>>&40 lelong          x               %lu,
>>>>>&4  lelong          >1000000        <1 fps,
>>>>>&4  lelong          1000000         1.00 fps,
>>>>>&4  lelong          500000          2.00 fps,
>>>>>&4  lelong          333333          3.00 fps,
>>>>>&4  lelong          250000          4.00 fps,
>>>>>&4  lelong          200000          5.00 fps,
>>>>>&4  lelong          166667          6.00 fps,
>>>>>&4  lelong          142857          7.00 fps,
>>>>>&4  lelong          125000          8.00 fps,
>>>>>&4  lelong          111111          9.00 fps,
>>>>>&4  lelong          100000          10.00 fps,
># ]9.9,10.1[
>>>>>&4  lelong          <101010
>>>>>>&-4        lelong  >99010
>>>>>>>&-4       lelong  !100000         ~10 fps,
>>>>>&4  lelong          83333           12.00 fps,
># ]11.9,12.1[
>>>>>&4  lelong          <84034
>>>>>>&-4        lelong  >82645
>>>>>>>&-4       lelong  !83333          ~12 fps,
>>>>>&4  lelong          66667           15.00 fps,
># ]14.9,15.1[
>>>>>&4  lelong          <67114
>>>>>>&-4        lelong  >66225
>>>>>>>&-4       lelong  !66667          ~15 fps,
>>>>>&4  lelong          50000           20.00 fps,
>>>>>&4  lelong          41708           23.98 fps,
>>>>>&4  lelong          41667           24.00 fps,
># ]23.9,24.1[
>>>>>&4  lelong          <41841
>>>>>>&-4        lelong  >41494
>>>>>>>&-4       lelong  !41708
>>>>>>>>&-4      lelong  !41667          ~24 fps,
>>>>>&4  lelong          40000           25.00 fps,
># ]24.9,25.1[
>>>>>&4  lelong          <40161
>>>>>>&-4        lelong  >39841
>>>>>>>&-4       lelong  !40000          ~25 fps,
>>>>>&4  lelong          33367           29.97 fps,
>>>>>&4  lelong          33333           30.00 fps,
># ]29.9,30.1[
>>>>>&4  lelong          <33445
>>>>>>&-4        lelong  >33223
>>>>>>>&-4       lelong  !33367
>>>>>>>>&-4      lelong  !33333          ~30 fps,
>>>>>&4  lelong          <32224          >30 fps,
>##>>>>&4  lelong          x               (%lu)
>##>>>>&20 lelong          x               %lu frames,
># Note: The tests below assume that the AVI has 1 or 2 streams,
>#       "vids" optionally followed by "auds".
>#       (Should cover 99.9% of all AVIs.)
># assuming avih length = 56
>>>>88   string  LIST
>>>>>96  string  strlstrh
>>>>>>108        string  vids    video:
>>>>>>>&0        lelong  0               uncompressed
># skip past vids strh
>>>>>>>(104.l+108)       string  strf
>>>>>>>>(104.l+132)      lelong          1       RLE 8bpp
>>>>>>>>(104.l+132)      string/c        cvid    Cinepak
>>>>>>>>(104.l+132)      string/c        i263    Intel I.263
>>>>>>>>(104.l+132)      string/c        iv32    Indeo 3.2
>>>>>>>>(104.l+132)      string/c        iv41    Indeo 4.1
>>>>>>>>(104.l+132)      string/c        iv50    Indeo 5.0
>>>>>>>>(104.l+132)      string/c        mp42    Microsoft MPEG-4 v2
>>>>>>>>(104.l+132)      string/c        mp43    Microsoft MPEG-4 v3
>>>>>>>>(104.l+132)      string/c        mjpg    Motion JPEG
>>>>>>>>(104.l+132)      string/c        div3    DivX 3
>>>>>>>>>112             string/c        div3    Low-Motion
>>>>>>>>>112             string/c        div4    Fast-Motion
>>>>>>>>(104.l+132)      string/c        divx    DivX 4
>>>>>>>>(104.l+132)      string/c        dx50    DivX 5
>>>>>>>>(104.l+132)      string/c        xvid    XviD
>>>>>>>>(104.l+132)      string/c        h264    X.264
>>>>>>>>(104.l+132)      lelong  0
>##>>>>>>>(104.l+132)      string  x       (%.4s)
># skip past first (video) LIST
>>>>>(92.l+96)   string  LIST
>>>>>>(92.l+104) string  strlstrh
>>>>>>>(92.l+116)        string          auds    \b, audio:
># auds strh length = 56:
>>>>>>>>(92.l+172)       string          strf
>>>>>>>>>(92.l+180)      leshort 0x0001  uncompressed PCM
>>>>>>>>>(92.l+180)      leshort 0x0002  ADPCM
>>>>>>>>>(92.l+180)      leshort 0x0055  MPEG-1 Layer 3
>>>>>>>>>(92.l+180)      leshort 0x2000  Dolby AC3
>>>>>>>>>(92.l+180)      leshort 0x0161  DivX
>##>>>>>>>>(92.l+180)      leshort x       (0x%.4x)
>>>>>>>>>(92.l+182)      leshort 1       (mono,
>>>>>>>>>(92.l+182)      leshort 2       (stereo,
>>>>>>>>>(92.l+182)      leshort >2      (%d channels,
>>>>>>>>>(92.l+184)      lelong  x       %d Hz)
># auds strh length = 64:
>>>>>>>>(92.l+180)       string          strf
>>>>>>>>>(92.l+188)      leshort 0x0001  uncompressed PCM
>>>>>>>>>(92.l+188)      leshort 0x0002  ADPCM
>>>>>>>>>(92.l+188)      leshort 0x0055  MPEG-1 Layer 3
>>>>>>>>>(92.l+188)      leshort 0x2000  Dolby AC3
>>>>>>>>>(92.l+188)      leshort 0x0161  DivX
>##>>>>>>>>(92.l+188)      leshort x       (0x%.4x)
>>>>>>>>>(92.l+190)      leshort 1       (mono,
>>>>>>>>>(92.l+190)      leshort 2       (stereo,
>>>>>>>>>(92.l+190)      leshort >2      (%d channels,
>>>>>>>>>(92.l+192)      lelong  x       %d Hz)
># Animated Cursor format
>>8	string		ACON		\b, animated cursor
># SoundFont 2 <mpruett@sgi.com>
>>8	string		sfbk		SoundFont/Bank
># MPEG-1 wrapped in a RIFF, apparently
>>8      string          CDXA            \b, wrapped MPEG-1 (CDXA)
>>8	string		4XMV		\b, 4X Movie file 
>
>#
># XXX - some of the below may only appear in little-endian form.
>#
># Also "MV93" appears to be for one form of Macromedia Director
># files, and "GDMF" appears to be another multimedia format.
>#
>0	string		RIFX		RIFF (big-endian) data
># RIFF Palette format
>>8	string		PAL		\b, palette
>>>16	beshort		x		\b, version %d
>>>18	beshort		x		\b, %d entries
># RIFF Device Independent Bitmap format
>>8	string		RDIB		\b, device-independent bitmap
>>>16	string		BM		
>>>>30	beshort		12		\b, OS/2 1.x format
>>>>>34	beshort		x		\b, %d x
>>>>>36	beshort		x		%d
>>>>30	beshort		64		\b, OS/2 2.x format
>>>>>34	beshort		x		\b, %d x
>>>>>36	beshort		x		%d
>>>>30	beshort		40		\b, Windows 3.x format
>>>>>34	belong		x		\b, %d x
>>>>>38	belong		x		%d x
>>>>>44	beshort		x		%d
># RIFF MIDI format
>>8	string		RMID		\b, MIDI
># RIFF Multimedia Movie File format
>>8	string		RMMP		\b, multimedia movie
># Microsoft WAVE format (*.wav)
>>8	string		WAVE		\b, WAVE audio
>>>20	leshort		1		\b, Microsoft PCM
>>>>34	leshort		>0		\b, %d bit
>>>22	beshort		=1		\b, mono
>>>22	beshort		=2		\b, stereo
>>>22	beshort		>2		\b, %d channels
>>>24	belong		>0		%d Hz
># Corel Draw Picture
>>8	string		CDRA		\b, Corel Draw Picture
># AVI == Audio Video Interleave
>>8	string		AVI\040		\b, AVI
># Animated Cursor format
>>8	string		ACON		\b, animated cursor
># Notation Interchange File Format (big-endian only)
>>8	string		NIFF		\b, Notation Interchange File Format
># SoundFont 2 <mpruett@sgi.com>
>>8	string		sfbk		SoundFont/Bank
>
>#------------------------------------------------------------------------------
># apple:  file(1) magic for Apple file formats
>#
>0	string		FiLeStArTfIlEsTaRt	binscii (apple ][) text
>0	string		\x0aGL			Binary II (apple ][) data
>0	string		\x76\xff		Squeezed (apple ][) data
>0	string		NuFile			NuFile archive (apple ][) data
>0	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
>0	belong		0x00051600		AppleSingle encoded Macintosh file
>0	belong		0x00051607		AppleDouble encoded Macintosh file
>
># magic for Newton PDA package formats
># from Ruda Moura <ruda@helllabs.org>
>0	string	package0	Newton package, NOS 1.x,
>>12	belong	&0x80000000	AutoRemove,
>>12	belong	&0x40000000	CopyProtect,
>>12	belong	&0x10000000	NoCompression,
>>12	belong	&0x04000000	Relocation,
>>12	belong	&0x02000000	UseFasterCompression,
>>16	belong	x		version %d
>
>0	string	package1	Newton package, NOS 2.x,
>>12	belong	&0x80000000	AutoRemove,
>>12	belong	&0x40000000	CopyProtect,
>>12	belong	&0x10000000	NoCompression,
>>12	belong	&0x04000000	Relocation,
>>12	belong	&0x02000000	UseFasterCompression,
>>16	belong	x		version %d
>
>0	string	package4	Newton package,
>>8	byte	8		NOS 1.x,
>>8	byte	9		NOS 2.x,
>>12	belong	&0x80000000	AutoRemove,
>>12	belong	&0x40000000	CopyProtect,
>>12	belong	&0x10000000	NoCompression,
>
># The following entries for the Apple II are for files that have
># been transferred as raw binary data from an Apple, without having
># been encapsulated by any of the above archivers.
>#
># In general, Apple II formats are hard to identify because Apple DOS
># and especially Apple ProDOS have strong typing in the file system and
># therefore programmers never felt much need to include type information
># in the files themselves.
>#
># Eric Fischer <enf@pobox.com>
>
># AppleWorks word processor:
>#
># This matches the standard tab stops for an AppleWorks file, but if
># a file has a tab stop set in the first four columns this will fail.
>#
># The "O" is really the magic number, but that's so common that it's
># necessary to check the tab stops that follow it to avoid false positives.
>
>4       string          O====   AppleWorks word processor data
>>85     byte&0x01       >0      \b, zoomed
>>90     byte&0x01       >0      \b, paginated
>>92     byte&0x01       >0      \b, with mail merge
>#>91    byte            x       \b, left margin %d
>
># AppleWorks database:
>#
># This isn't really a magic number, but it's the closest thing to one
># that I could find.  The 1 and 2 really mean "order in which you defined
># categories" and "left to right, top to bottom," respectively; the D and R
># mean that the cursor should move either down or right when you press Return.
>
>#30	string		\x01D	AppleWorks database data
>#30	string		\x02D	AppleWorks database data
>#30	string		\x01R	AppleWorks database data
>#30	string		\x02R	AppleWorks database data
>
># AppleWorks spreadsheet:
>#
># Likewise, this isn't really meant as a magic number.  The R or C means
># row- or column-order recalculation; the A or M means automatic or manual
># recalculation.
>
>#131	string		RA	AppleWorks spreadsheet data
>#131	string		RM	AppleWorks spreadsheet data
>#131	string		CA	AppleWorks spreadsheet data
>#131	string		CM	AppleWorks spreadsheet data
>
># Applesoft BASIC:
>#
># This is incredibly sloppy, but will be true if the program was
># written at its usual memory location of 2048 and its first line
># number is less than 256.  Yuck.
>
>0       belong&0xff00ff 0x80000 Applesoft BASIC program data
>#>2     leshort         x       \b, first line number %d
>
># ORCA/EZ assembler:
># 
># This will not identify ORCA/M source files, since those have
># some sort of date code instead of the two zero bytes at 6 and 7
># XXX Conflicts with ELF
>#4       belong&0xff00ffff       0x01000000      ORCA/EZ assembler source data
>#>5      byte                    x               \b, build number %d
>
># Broderbund Fantavision
>#
># I don't know what these values really mean, but they seem to recur.
># Will they cause too many conflicts?
>
># Probably :-)
>#2	belong&0xFF00FF		0x040008	Fantavision movie data
>
># Some attempts at images.
>#
># These are actually just bit-for-bit dumps of the frame buffer, so
># there's really no reasonably way to distinguish them except for their
># address (if preserved) -- 8192 or 16384 -- and their length -- 8192
># or, occasionally, 8184.
>#
># Nevertheless this will manage to catch a lot of images that happen
># to have a solid-colored line at the bottom of the screen.
>
>8144	string	\x7F\x7F\x7F\x7F\x7F\x7F\x7F\x7F	Apple II image with white background
>8144	string	\x55\x2A\x55\x2A\x55\x2A\x55\x2A	Apple II image with purple background
>8144	string	\x2A\x55\x2A\x55\x2A\x55\x2A\x55	Apple II image with green background
>8144	string	\xD5\xAA\xD5\xAA\xD5\xAA\xD5\xAA	Apple II image with blue background
>8144	string	\xAA\xD5\xAA\xD5\xAA\xD5\xAA\xD5	Apple II image with orange background
>
># Beagle Bros. Apple Mechanic fonts
>
>0	belong&0xFF00FFFF	0x6400D000	Apple Mechanic font
>
># Apple Universal Disk Image Format (UDIF) - dmg files.
># From Johan Gade.
># These entries are disabled for now until we fix the following issues.
>#
># Note there might be some problems with the "VAX COFF executable" 
># entry. Note this entry should be placed before the mac filesystem section, 
># particularly the "Apple Partition data" entry.
>#
># The intended meaning of these tests is, that the file is only of the 
># specified type if both of the lines are correct - i.e. if the first
># line matches and the second doesn't then it is not of that type.
>#
>#0	long	0x7801730d
>#>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
>#
># Note that this entry is recognized correctly by the "Apple Partition 
># data" entry - however since this entry is more specific - this
># information seems to be more useful.
>#0	long	0x45520200
>#>0x410	string	disk\ image	UDIF read/write image (UDRW)
>
># From: Toby Peterson <toby@apple.com>
>0	string	bplist00	Apple binary property list
>
>#------------------------------------------------------------------------------
># macintosh description
>#
># BinHex is the Macintosh ASCII-encoded file format (see also "apple")
># Daniel Quinlan, quinlan@yggdrasil.com
>11	string	must\ be\ converted\ with\ BinHex	BinHex binary text
>>41	string	x					\b, version %.3s
>
># Stuffit archives are the de facto standard of compression for Macintosh
># files obtained from most archives. (franklsm@tuns.ca)
>0	string		SIT!			StuffIt Archive (data)
>>2	string		x			: %s
>0	string		SITD			StuffIt Deluxe (data)
>>2	string		x			: %s
>0	string		Seg			StuffIt Deluxe Segment (data)
>>2	string		x			: %s
>
># Newer StuffIt archives (grant@netbsd.org)
>0	string		StuffIt			StuffIt Archive
>#>162	string		>0			: %s
>
># Macintosh Applications and Installation binaries (franklsm@tuns.ca)
>0	string		APPL			Macintosh Application (data)
>>2	string		x			\b: %s
>
># Macintosh System files (franklsm@tuns.ca)
>0	string		zsys			Macintosh System File (data)
>0	string		FNDR			Macintosh Finder (data)
>0	string		libr			Macintosh Library (data)
>>2	string		x			: %s
>0	string		shlb			Macintosh Shared Library (data)
>>2	string		x			: %s
>0	string		cdev			Macintosh Control Panel (data)
>>2	string		x			: %s
>0	string		INIT			Macintosh Extension (data)
>>2	string		x			: %s
>0	string		FFIL			Macintosh Truetype Font (data)
>>2	string		x			: %s
>0	string		LWFN			Macintosh Postscript Font (data)
>>2	string		x			: %s
>
># Additional Macintosh Files (franklsm@tuns.ca)
>0	string		PACT			Macintosh Compact Pro Archive (data)
>>2	string		x			: %s
>0	string		ttro			Macintosh TeachText File (data)
>>2	string		x			: %s
>0	string		TEXT			Macintosh TeachText File (data)
>>2	string		x			: %s
>0	string		PDF			Macintosh PDF File (data)
>>2	string		x			: %s
>
># MacBinary format (Eric Fischer, enf@pobox.com)
>#
># Unfortunately MacBinary doesn't really have a magic number prior
># to the MacBinary III format.  The checksum is really the way to
># do it, but the magic file format isn't up to the challenge.
>#
># 0	byte		0
># 1	byte				# filename length
># 2	string				# filename
># 65    string				# file type
># 69	string				# file creator
># 73	byte				# Finder flags
># 74	byte		0
># 75	beshort				# vertical posn in window
># 77	beshort				# horiz posn in window
># 79	beshort				# window or folder ID
># 81    byte				# protected?
># 82	byte		0
># 83	belong				# length of data segment
># 87	belong				# length of resource segment
># 91	belong				# file creation date
># 95	belong				# file modification date
># 99	beshort				# length of comment after resource
># 101	byte				# new Finder flags
># 102	string		mBIN		# (only in MacBinary III)
># 106	byte				# char. code of file name
># 107	byte				# still more Finder flags
># 116	belong				# total file length
># 120	beshort				# length of add'l header
># 122	byte		129		# for MacBinary II
># 122	byte		130		# for MacBinary III
># 123	byte		129		# minimum version that can read fmt
># 124	beshort				# checksum
>#
># This attempts to use the version numbers as a magic number, requiring
># that the first one be 0x80, 0x81, 0x82, or 0x83, and that the second
># be 0x81.  This works for the files I have, but maybe not for everyone's.
>
># Unfortunately, this magic is quite weak - MPi
>#122	beshort&0xFCFF	0x8081		Macintosh MacBinary data
>
># MacBinary I doesn't have the version number field at all, but MacBinary II
># has been in use since 1987 so I hope there aren't many really old files
># floating around that this will miss.  The original spec calls for using
># the nulls in 0, 74, and 82 as the magic number.
>#
># Another possibility, that would also work for MacBinary I, is to use
># the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
># have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
># and that 74 will be 0.  So something like
># 
># 71 	belong&0x80804EFF 0x00000000 	Macintosh MacBinary data
># 
># >73	byte&0x01	0x01		\b, inited
># >73	byte&0x02	0x02		\b, changed
># >73	byte&0x04	0x04		\b, busy
># >73	byte&0x08	0x08		\b, bozo
># >73	byte&0x10	0x10		\b, system
># >73	byte&0x10	0x20		\b, bundle
># >73	byte&0x10	0x40		\b, invisible
># >73	byte&0x10	0x80		\b, locked
>
>#>65	string		x		\b, type "%4.4s"
>
>#>65	string		8BIM		(PhotoShop)
>#>65	string		ALB3		(PageMaker 3)
>#>65	string		ALB4		(PageMaker 4)
>#>65	string		ALT3		(PageMaker 3)
>#>65	string		APPL		(application)
>#>65	string		AWWP		(AppleWorks word processor)
>#>65	string		CIRC		(simulated circuit)
>#>65	string		DRWG		(MacDraw)
>#>65	string		EPSF		(Encapsulated PostScript)
>#>65	string		FFIL		(font suitcase)
>#>65	string		FKEY		(function key)
>#>65	string		FNDR		(Macintosh Finder)
>#>65	string		GIFf		(GIF image)
>#>65	string		Gzip		(GNU gzip)
>#>65	string		INIT		(system extension)
>#>65	string		LIB\ 		(library)
>#>65	string		LWFN		(PostScript font)
>#>65	string		MSBC		(Microsoft BASIC)
>#>65	string		PACT		(Compact Pro archive)
>#>65	string		PDF\ 		(Portable Document Format)
>#>65	string		PICT		(picture)
>#>65	string		PNTG		(MacPaint picture)
>#>65	string		PREF		(preferences)
>#>65	string		PROJ		(Think C project)
>#>65	string		QPRJ		(Think Pascal project)
>#>65	string		SCFL		(Defender scores)
>#>65	string		SCRN		(startup screen)
>#>65	string		SITD		(StuffIt Deluxe)
>#>65	string		SPn3		(SuperPaint)
>#>65	string		STAK		(HyperCard stack)
>#>65	string		Seg\ 		(StuffIt segment)
>#>65	string		TARF		(Unix tar archive)
>#>65	string		TEXT		(ASCII)
>#>65	string		TIFF		(TIFF image)
>#>65	string		TOVF		(Eudora table of contents)
>#>65	string		WDBN		(Microsoft Word word processor)
>#>65	string		WORD		(MacWrite word processor)
>#>65	string		XLS\ 		(Microsoft Excel)
>#>65	string		ZIVM		(compress (.Z))
>#>65	string		ZSYS		(Pre-System 7 system file)
>#>65	string		acf3		(Aldus FreeHand)
>#>65	string		cdev		(control panel)
>#>65	string		dfil		(Desk Acessory suitcase)
>#>65	string		libr		(library)
>#>65	string		nX^d		(WriteNow word processor)
>#>65	string		nX^w		(WriteNow dictionary)
>#>65	string		rsrc		(resource)
>#>65	string		scbk		(Scrapbook)
>#>65	string		shlb		(shared library)
>#>65	string		ttro		(SimpleText read-only)
>#>65	string		zsys		(system file)
>
>#>69	string		x		\b, creator "%4.4s"
>
># Somewhere, Apple has a repository of registered Creator IDs.  These are
># just the ones that I happened to have files from and was able to identify.
>
>#>69	string		8BIM		(Adobe Photoshop)
>#>69	string		ALD3		(PageMaker 3)
>#>69	string		ALD4		(PageMaker 4)
>#>69	string		ALFA		(Alpha editor)
>#>69	string		APLS		(Apple Scanner)
>#>69	string		APSC		(Apple Scanner)
>#>69	string		BRKL		(Brickles)
>#>69	string		BTFT		(BitFont)
>#>69	string		CCL2 		(Common Lisp 2)
>#>69	string		CCL\ 		(Common Lisp)
>#>69	string		CDmo		(The Talking Moose)
>#>69	string		CPCT		(Compact Pro)
>#>69	string		CSOm		(Eudora)
>#>69	string		DMOV		(Font/DA Mover)
>#>69	string		DSIM		(DigSim)
>#>69	string		EDIT		(Macintosh Edit)
>#>69	string		ERIK		(Macintosh Finder)
>#>69	string		EXTR		(self-extracting archive)
>#>69	string		Gzip		(GNU gzip)
>#>69	string		KAHL		(Think C)
>#>69	string		LWFU		(LaserWriter Utility)
>#>69	string		LZIV		(compress)
>#>69	string		MACA		(MacWrite)
>#>69	string		MACS		(Macintosh operating system)
>#>69	string		MAcK		(MacKnowledge terminal emulator)
>#>69	string		MLND		(Defender)
>#>69	string		MPNT		(MacPaint)
>#>69	string		MSBB		(Microsoft BASIC (binary))
>#>69	string		MSWD		(Microsoft Word)
>#>69	string		NCSA		(NCSA Telnet)
>#>69	string		PJMM		(Think Pascal)
>#>69	string		PSAL		(Hunt the Wumpus)
>#>69	string		PSI2		(Apple File Exchange)
>#>69	string		R*ch		(BBEdit)
>#>69	string		RMKR		(Resource Maker)
>#>69	string		RSED		(Resource Editor)
>#>69	string		Rich		(BBEdit)
>#>69	string		SIT!		(StuffIt)
>#>69	string		SPNT		(SuperPaint)
>#>69	string		Unix		(NeXT Mac filesystem)
>#>69	string		VIM!		(Vim editor)
>#>69	string		WILD		(HyperCard)
>#>69	string		XCEL		(Microsoft Excel)
>#>69	string		aCa2		(Fontographer)
>#>69	string		aca3		(Aldus FreeHand)
>#>69	string		dosa		(Macintosh MS-DOS file system)
>#>69	string		movr		(Font/DA Mover)
>#>69	string		nX^n		(WriteNow)
>#>69	string		pdos		(Apple ProDOS file system)
>#>69	string		scbk		(Scrapbook)
>#>69	string		ttxt		(SimpleText)
>#>69	string		ufox		(Foreign File Access)
>
># Just in case...
>
>102	string		mBIN		MacBinary III data with surprising version number
>
># sas magic from Bruce Foster (bef@nwu.edu)
>#
>#0	string		SAS		SAS
>#>8	string		x		%s
>0	string		SAS		SAS
>>24	string		DATA		data file
>>24	string		CATALOG		catalog
>>24	string		INDEX		data file index
>>24	string		VIEW		data view
># sas 7+ magic from Reinhold Koch (reinhold.koch@roche.com)
>#
>0x54    string          SAS             SAS 7+
>>0x9C   string          DATA            data file
>>0x9C   string          CATALOG         catalog
>>0x9C   string          INDEX           data file index
>>0x9C   string          VIEW            data view
>
># spss magic for SPSS system and portable files, 
>#	 from Bruce Foster (bef@nwu.edu).
>
>0	long		0xc1e2c3c9	SPSS Portable File
>>40	string 		x		%s
>
>0	string		$FL2		SPSS System File
>>24	string		x		%s
>
># Macintosh filesystem data
># From "Tom N Harris" <telliamed@mac.com>
># Fixed HFS+ and Partition map magic: Ethan Benson <erbenson@alaska.net>
># The MacOS epoch begins on 1 Jan 1904 instead of 1 Jan 1970, so these
># entries depend on the data arithmetic added after v.35
># There's also some Pascal strings in here, ditto...
>
># The boot block signature, according to IM:Files, is 
># "for HFS volumes, this field always contains the value 0x4C4B."
># But if this is true for MFS or HFS+ volumes, I don't know.
># Alternatively, the boot block is supposed to be zeroed if it's
># unused, so a simply >0 should suffice.
>
>0x400	beshort			0xD2D7		Macintosh MFS data
>>0	beshort			0x4C4B		(bootable)
>>0x40a	beshort			&0x8000		(locked)
>>0x402	beldate-0x7C25B080	x		created: %s,
>>0x406	beldate-0x7C25B080	>0		last backup: %s,
>>0x414	belong			x		block size: %d,
>>0x412	beshort			x		number of blocks: %d,
>>0x424	pstring			x		volume name: %s
>
># "BD" is has many false positives
>#0x400	beshort			0x4244		Macintosh HFS data
>#>0	beshort			0x4C4B		(bootable)
>#>0x40a	beshort			&0x8000		(locked)
>#>0x40a	beshort			^0x0100		(mounted)
>#>0x40a	beshort			&0x0200		(spared blocks)
>#>0x40a	beshort			&0x0800		(unclean)
>#>0x47C	beshort			0x482B		(Embedded HFS+ Volume)
>#>0x402	beldate-0x7C25B080	x		created: %s,
>#>0x406	beldate-0x7C25B080	x		last modified: %s,
>#>0x440	beldate-0x7C25B080	>0		last backup: %s,
>#>0x414	belong			x		block size: %d,
>#>0x412	beshort			x		number of blocks: %d,
>#>0x424	pstring			x		volume name: %s
>
>0x400	beshort			0x482B		Macintosh HFS Extended
>>&0	beshort			x		version %d data
>>0	beshort			0x4C4B		(bootable)
>>0x404	belong			^0x00000100	(mounted)
>>&2	belong			&0x00000200	(spared blocks)
>>&2	belong			&0x00000800	(unclean)
>>&2	belong			&0x00008000	(locked)
>>&6	string			x		last mounted by: '%.4s',
># really, that should be treated as a belong and we print a string
># based on the value. TN1150 only mentions '8.10' for "MacOS 8.1"
>>&14	beldate-0x7C25B080	x		created: %s,
># only the creation date is local time, all other timestamps in HFS+ are UTC.
>>&18	bedate-0x7C25B080	x		last modified: %s,
>>&22	bedate-0x7C25B080	>0		last backup: %s,
>>&26	bedate-0x7C25B080	>0		last checked: %s,
>>&38	belong			x		block size: %d,
>>&42	belong			x		number of blocks: %d,
>>&46	belong			x		free blocks: %d
>
># I don't think this is really necessary since it doesn't do much and 
># anything with a valid driver descriptor will also have a valid
># partition map
>#0		beshort		0x4552		Apple Device Driver data
>#>&24		beshort		=1		\b, MacOS
>
># Is that the partition type a cstring or a pstring? Well, IM says "strings 
># shorter than 32 bytes must be terminated with NULL" so I'll treat it as a 
># cstring. Of course, partitions can contain more than four entries, but 
># what're you gonna do?
>0x200		beshort		0x504D		Apple Partition data
>>0x2		beshort		x		block size: %d,
>>0x230		string		x		first type: %s,
>>0x210		string		x		name: %s,
>>0x254		belong		x		number of blocks: %d,
>>0x400		beshort		0x504D		
>>>0x430		string		x		second type: %s,
>>>0x410		string		x		name: %s,
>>>0x454		belong		x		number of blocks: %d,
>>>0x800		beshort		0x504D		
>>>>0x830	string		x		third type: %s,
>>>>0x810	string		x		name: %s,
>>>>0x854	belong		x		number of blocks: %d,
>>>>0xa00	beshort		0x504D		
>>>>>0xa30	string		x		fourth type: %s,
>>>>>0xa10	string		x		name: %s,
>>>>>0xa54	belong		x		number of blocks: %d
># AFAIK, only the signature is different
>0x200		beshort		0x5453		Apple Old Partition data
>>0x2		beshort		x		block size: %d,
>>0x230		string		x		first type: %s,
>>0x210		string		x		name: %s,
>>0x254		belong		x		number of blocks: %d,
>>0x400		beshort		0x504D		
>>>0x430		string		x		second type: %s,
>>>0x410		string		x		name: %s,
>>>0x454		belong		x		number of blocks: %d,
>>>0x800		beshort		0x504D		
>>>>0x830	string		x		third type: %s,
>>>>0x810	string		x		name: %s,
>>>>0x854	belong		x		number of blocks: %d,
>>>>0xa00	beshort		0x504D		
>>>>>0xa30	string		x		fourth type: %s,
>>>>>0xa10	string		x		name: %s,
>>>>>0xa54	belong		x		number of blocks: %d
>
># From: Remi Mommsen <mommsen@slac.stanford.edu>
>0		string		BOMStore	Mac OS X bill of materials (BOM) fil
>#------------------------------------------------------------------------------
>#
># RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
>#
>0	beshort		0xedab
>>2	beshort		0xeedb		RPM
>>>4	byte		x		v%d
>>>6	beshort		0		bin
>>>6	beshort		1		src
>>>8	beshort		1		i386
>>>8	beshort		2		Alpha
>>>8	beshort		3		Sparc
>>>8	beshort		4		MIPS
>>>8	beshort		5		PowerPC
>>>8	beshort		6		68000
>>>8	beshort		7	SGI
>>>8	beshort		8		RS6000
>>>8	beshort		9		IA64
>>>8	beshort		10		Sparc64
>>>8	beshort		11		MIPSel
>>>8	beshort		12		ARM
>>>10	string		x		%s
>
>#------------------------------------------------------------------------------
># rtf:	file(1) magic for Rich Text Format (RTF)
>#
># Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
>#
>0	string		{\\rtf		Rich Text Format data,
>>5	byte		x		version %c,
>>6	string		\\ansi		ANSI
>>6	string		\\mac		Apple Macintosh
>>6	string		\\pc		IBM PC, code page 437
>>6	string		\\pca		IBM PS/2, code page 850
>
>#------------------------------------------------------------------------------
># sc:  file(1) magic for "sc" spreadsheet
>#
>38	string		Spreadsheet	sc spreadsheet file
>
>#------------------------------------------------------------------------------
># sccs:  file(1) magic for SCCS archives
>#
># SCCS archive structure:
># \001h01207
># \001s 00276/00000/00000
># \001d D 1.1 87/09/23 08:09:20 ian 1 0
># \001c date and time created 87/09/23 08:09:20 by ian
># \001e
># \001u
># \001U
># ... etc.
># Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
># *Sigh*. And these both came from various parts of the USG.
># Maybe we should just switch everybody from SCCS to RCS!
># Further, you can't just say '\001h0', because the five-digit number
># is a checksum that could (presumably) have any leading digit,
># and we don't have regular expression matching yet. 
># Hence the following official kludge:
>8	string		\001s\ 			SCCS archive data
>
>#------------------------------------------------------------------------------
># sendmail:  file(1) magic for sendmail config files
>#
># XXX - byte order?
>#
>0	byte	046	  Sendmail frozen configuration 
>>16	string	>\0	  - version %s
>0	short	0x271c	  Sendmail frozen configuration
>>16	string	>\0	  - version %s
>
>#------------------------------------------------------------------------------
># sendmail:  file(1) magic for sendmail m4(1) files
>#
># From Hendrik Scholz <hendrik@scholz.net>
># i.e. files in /usr/share/sendmail/cf/
>#
>0   string  divert(-1)\n    sendmail m4 text file
>
>
>#------------------------------------------------------------------------------
># sequent:  file(1) magic for Sequent machines
>#
># Sequent information updated by Don Dwiggins <atsun!dwiggins>.
># For Sequent's multiprocessor systems (incomplete).
>0	lelong	0x00ea        	BALANCE NS32000 .o
>>16	lelong	>0		not stripped
>>124	lelong	>0		version %ld
>0	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
>>16	lelong  >0            	not stripped
>>124	lelong	>0		version %ld
>0	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
>>16	lelong  >0            	not stripped
>>124	lelong	>0		version %ld
>0	lelong	0x30ea        	BALANCE NS32000 standalone executable
>>16	lelong  >0          	not stripped
>>124	lelong	>0		version %ld
>#
># Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
># Symmetry magic nums will not be reached if DOS COM comes before them;
># byte 0xeb is matched before these get a chance.
>0	leshort	0x12eb		SYMMETRY i386 .o
>>16	lelong	>0		not stripped
>>124	lelong	>0		version %ld
>0	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
>>16	lelong	>0		not stripped
>>124	lelong	>0		version %ld
>0	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
>>16	lelong	>0		not stripped
>>124	lelong	>0		version %ld
>0	leshort	0x42eb		SYMMETRY i386 standalone executable
>>16	lelong	>0		not stripped
>>124	lelong	>0		version %ld
>
>#------------------------------------------------------------------------------
># sgi:  file(1) magic for Silicon Graphics applications
>
>#
>#
># Performance Co-Pilot file types
>0	string	PmNs				PCP compiled namespace (V.0)
>0	string	PmN				PCP compiled namespace
>>3	string	>\0				(V.%1.1s)
>3	belong	0x84500526			PCP archive
>>7	byte	x				(V.%d)
>>20	belong	-2				temporal index
>>20	belong	-1				metadata
>>20	belong	0				log volume #0
>>20	belong	>0				log volume #%ld
>>24	string	>\0				host: %s
>0	string	PCPFolio			PCP 
>>9	string	Version:			Archive Folio
>>18	string	>\0				(V.%s)
>0	string	#pmchart			PCP pmchart view
>>9	string	Version
>>17	string	>\0				(V%-3.3s)
>0	string	pmview				PCP pmview config
>>7	string	Version
>>15	string	>\0				(V%-3.3s)
>0	string	#pmlogger			PCP pmlogger config
>>10	string	Version
>>18	string	>\0				(V%1.1s)
>0	string	#pmdahotproc			PCP pmdahotproc config
>>13	string	Version
>>21	string	>\0				(V%-3.3s)
>0	string	PcPh				PCP Help 
>>4	string	1				Index
>>4	string	2				Text
>>5	string	>\0				(V.%1.1s)
>0	string	#pmieconf-rules			PCP pmieconf rules
>>16	string	>\0				(V.%1.1s)
>3	string	pmieconf-pmie			PCP pmie config
>>17	string	>\0				(V.%1.1s)
>
># SpeedShop data files
>0	lelong	0x13130303			SpeedShop data file
>
># mdbm files
>0	lelong	0x01023962			mdbm file, version 0 (obsolete)
>0	string	mdbm				mdbm file,
>>5	byte	x				version %d,
>>6	byte	x				2^%d pages,
>>7	byte	x				pagesize 2^%d,
>>17	byte	x				hash %d,
>>11	byte	x				dataformat %d
>
># Alias Maya files
>0	string	//Maya ASCII	Alias Maya Ascii File,
>>13	string	>\0	version %s
>8	string	MAYAFOR4	Alias Maya Binary File,
>>32	string	>\0	version %s scene
>8	string	MayaFOR4	Alias Maya Binary File,
>>32	string	>\0	version %s scene
>8	string	CIMG		Alias Maya Image File
>8	string	DEEP		Alias Maya Image File
>
>#------------------------------------------------------------------------------
># sgml:  file(1) magic for Standard Generalized Markup Language
># HyperText Markup Language (HTML) is an SGML document type,
># from Daniel Quinlan (quinlan@yggdrasil.com)
># adapted to string extenstions by Anthon van der Neut <anthon@mnt.org)
>0   string/cB	\<!DOCTYPE\ html	HTML document text
>0   string/cb	\<head			HTML document text
>0   string/cb	\<title			HTML document text
>0   string/cb	\<html			HTML document text
>
># Extensible markup language (XML), a subset of SGML
># from Marc Prud'hommeaux (marc@apocalypse.org)
>0	string/cb	\<?xml			XML document text
>0	string		\<?xml\ version "	XML
>0	string		\<?xml\ version="	XML
>>15	string		>\0			%.3s document text
>>>23	string		\<xsl:stylesheet	(XSL stylesheet)
>>>24	string		\<xsl:stylesheet	(XSL stylesheet)
>0	string/b	\<?xml			XML document text
>0	string/cb	\<?xml			broken XML document text
>
>
># SGML, mostly from rph@sq
>0   string/cb	\<!doctype		exported SGML document text
>0   string/cb	\<!subdoc		exported SGML subdocument text
>0   string/cb	\<!--			exported SGML document text
>
># Web browser cookie files
># (Mozilla, Galeon, Netscape 4, Konqueror..)
># Ulf Harnhammar <ulfh@update.uu.se>
>0	string	#\ HTTP\ Cookie\ File	Web browser cookie text
>0	string	#\ Netscape\ HTTP\ Cookie\ File	Netscape cookie text
>0	string	#\ KDE\ Cookie\ File	Konqueror cookie text
>
>#------------------------------------------------------------------------
># file(1) magic for sharc files
>#
># SHARC DSP, MIDI SysEx and RiscOS filetype definitions added by 
># FutureGroove Music (dsp@futuregroove.de)
>
>#------------------------------------------------------------------------
>0	string			Draw		RiscOS Drawfile
>0	string			PACK		RiscOS PackdDir archive
>
>#------------------------------------------------------------------------
># SHARC DSP stuff (based on the FGM SHARC DSP SDK)
>
>0	string			=!		Assembler source
>0	string			Analog		ADi asm listing file
>0	string			.SYSTEM		SHARC architecture file
>0	string			.system		SHARC architecture file
>
>0	leshort			0x521C		SHARC COFF binary
>>2	leshort			>1		, %hd sections
>>>12	lelong			>0		, not stripped
>
>#------------------------------------------------------------------------------
># sinclair:  file(1) sinclair QL
>
># additions to /etc/magic by Thomas M. Ott (ThMO)
>
># Sinclair QL floppy disk formats (ThMO)
>0	string	=QL5		QL disk dump data,
>>3	string	=A		720 KB,
>>3	string	=B		1.44 MB,
>>3	string	=C		3.2 MB,
>>4	string	>\0		label:%.10s
>
># Sinclair QL OS dump (ThMO)
># (NOTE: if `file' would be able to use indirect references in a endian format
>#	 differing from the natural host format, this could be written more
>#	 reliably and faster...)
>#
># we *can't* lookup QL OS code dumps, because `file' is UNABLE to read more
># than the first 8K of a file... #-(
>#
>#0		belong	=0x30000
>#>49124		belong	<47104
>#>>49128		belong	<47104
>#>>>49132	belong	<47104
>#>>>>49136	belong	<47104	QL OS dump data,
>#>>>>>49148	string	>\0	type %.3s,
>#>>>>>49142	string	>\0	version %.4s
>
># Sinclair QL firmware executables (ThMO)
>0	string	NqNqNq`\004	QL firmware executable (BCPL)
>
># Sinclair QL libraries (was ThMO)
>0	beshort	0xFB01		QDOS object
>>2	pstring	x		'%s'
>
># Sinclair QL executables (was ThMO)
>4	belong	0x4AFB		QDOS executable
>>9	pstring	x		'%s'
>
># Sinclair QL ROM (ThMO)
>0	belong	=0x4AFB0001	QL plugin-ROM data,
>>9	pstring	=\0		un-named
>>9	pstring	>\0		named: %s
>
>#------------------------------------------------------------------------------
># Sketch Drawings: http://sketch.sourceforge.net/ 
># From: Edwin Mons <e@ik.nu>
>0	string	##Sketch	Sketch document text
>
>#-----------------------------------------------
># GNU Smalltalk image, starting at version 1.6.2
># From: catull_us@yahoo.com
>#
>0	string	GSTIm\0\0	GNU SmallTalk
># little-endian
>>7	byte&1	=0		LE image version
>>>10	byte	x		%d.
>>>9	byte	x		\b%d.
>>>8	byte	x		\b%d
>#>>12	lelong	x		, data: %ld
>#>>16	lelong	x		, table: %ld
>#>>20	lelong	x		, memory: %ld
># big-endian
>>7	byte&1	=1		BE image version
>>>8	byte	x		%d.
>>>9	byte	x		\b%d.
>>>10	byte	x		\b%d
>#>>12	belong	x		, data: %ld
>#>>16	belong	x		, table: %ld
>#>>20	belong	x		, memory: %ld
>
>
>
>#------------------------------------------------------------------------------
># sniffer:  file(1) magic for packet capture files
>#
># From: guy@alum.mit.edu (Guy Harris)
>#
>
>#
># Microsoft Network Monitor 1.x capture files.
>#
>0	string		RTSS		NetMon capture file
>>5	byte		x		- version %d
>>4	byte		x		\b.%d
>>6	leshort		0		(Unknown)
>>6	leshort		1		(Ethernet)
>>6	leshort		2		(Token Ring)
>>6	leshort		3		(FDDI)
>>6	leshort		4		(ATM)
>
>#
># Microsoft Network Monitor 2.x capture files.
>#
>0	string		GMBU		NetMon capture file
>>5	byte		x		- version %d
>>4	byte		x		\b.%d
>>6	leshort		0		(Unknown)
>>6	leshort		1		(Ethernet)
>>6	leshort		2		(Token Ring)
>>6	leshort		3		(FDDI)
>>6	leshort		4		(ATM)
>
>#
># Network General Sniffer capture files.
># Sorry, make that "Network Associates Sniffer capture files."
># Sorry, make that "Network General old DOS Sniffer capture files."
>#
>0	string		TRSNIFF\ data\ \ \ \ \032	Sniffer capture file
>>33	byte		2		(compressed)
>>23	leshort		x		- version %d
>>25	leshort		x		\b.%d
>>32	byte		0		(Token Ring)
>>32	byte		1		(Ethernet)
>>32	byte		2		(ARCNET)
>>32	byte		3		(StarLAN)
>>32	byte		4		(PC Network broadband)
>>32	byte		5		(LocalTalk)
>>32	byte		6		(Znet)
>>32	byte		7		(Internetwork Analyzer)
>>32	byte		9		(FDDI)
>>32	byte		10		(ATM)
>
>#
># Cinco Networks NetXRay capture files.
># Sorry, make that "Network General Sniffer Basic capture files."
># Sorry, make that "Network Associates Sniffer Basic capture files."
># Sorry, make that "Network Associates Sniffer Basic, and Windows
># Sniffer Pro", capture files."
># Sorry, make that "Network General Sniffer capture files."
>#
>0	string		XCP\0		NetXRay capture file
>>4	string		>\0		- version %s
>>44	leshort		0		(Ethernet)
>>44	leshort		1		(Token Ring)
>>44	leshort		2		(FDDI)
>>44	leshort		3		(WAN)
>>44	leshort		8		(ATM)
>>44	leshort		9		(802.11)
>
>#
># "libpcap" capture files.
># (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
># the main program that uses that format, but there are other programs
># that use "libpcap", or that use the same capture file format.)
>#
>0	ubelong		0xa1b2c3d4	tcpdump capture file (big-endian)
>>4	beshort		x		- version %d
>>6	beshort		x		\b.%d
>>20	belong		0		(No link-layer encapsulation
>>20	belong		1		(Ethernet
>>20	belong		2		(3Mb Ethernet
>>20	belong		3		(AX.25
>>20	belong		4		(ProNET
>>20	belong		5		(CHAOS
>>20	belong		6		(Token Ring
>>20	belong		7		(BSD ARCNET
>>20	belong		8		(SLIP
>>20	belong		9		(PPP
>>20	belong		10		(FDDI
>>20	belong		11		(RFC 1483 ATM
>>20	belong		12		(raw IP
>>20	belong		13		(BSD/OS SLIP
>>20	belong		14		(BSD/OS PPP
>>20	belong		19		(Linux ATM Classical IP
>>20	belong		50		(PPP or Cisco HDLC
>>20	belong		51		(PPP-over-Ethernet
>>20	belong		99		(Symantec Enterprise Firewall
>>20	belong		100		(RFC 1483 ATM
>>20	belong		101		(raw IP
>>20	belong		102		(BSD/OS SLIP
>>20	belong		103		(BSD/OS PPP
>>20	belong		104		(BSD/OS Cisco HDLC
>>20	belong		105		(802.11
>>20	belong		106		(Linux Classical IP over ATM
>>20	belong		107		(Frame Relay
>>20	belong		108		(OpenBSD loopback
>>20	belong		109		(OpenBSD IPsec encrypted
>>20	belong		112		(Cisco HDLC
>>20	belong		113		(Linux "cooked"
>>20	belong		114		(LocalTalk
>>20	belong		117		(OpenBSD PFLOG
>>20	belong		119		(802.11 with Prism header
>>20	belong		122		(RFC 2625 IP over Fibre Channel
>>20	belong		123		(SunATM
>>20	belong		127		(802.11 with radiotap header
>>20	belong		129		(Linux ARCNET
>>20	belong		138		(Apple IP over IEEE 1394
>>20	belong		140		(MTP2
>>20	belong		141		(MTP3
>>20	belong		143		(DOCSIS
>>20	belong		144		(IrDA
>>20	belong		147		(Private use 0
>>20	belong		148		(Private use 1
>>20	belong		149		(Private use 2
>>20	belong		150		(Private use 3
>>20	belong		151		(Private use 4
>>20	belong		152		(Private use 5
>>20	belong		153		(Private use 6
>>20	belong		154		(Private use 7
>>20	belong		155		(Private use 8
>>20	belong		156		(Private use 9
>>20	belong		157		(Private use 10
>>20	belong		158		(Private use 11
>>20	belong		159		(Private use 12
>>20	belong		160		(Private use 13
>>20	belong		161		(Private use 14
>>20	belong		162		(Private use 15
>>20	belong		163		(802.11 with AVS header
>>16	belong		x		\b, capture length %d)
>0	ulelong		0xa1b2c3d4	tcpdump capture file (little-endian)
>>4	leshort		x		- version %d
>>6	leshort		x		\b.%d
>>20	lelong		0		(No link-layer encapsulation
>>20	lelong		1		(Ethernet
>>20	lelong		2		(3Mb Ethernet
>>20	lelong		3		(AX.25
>>20	lelong		4		(ProNET
>>20	lelong		5		(CHAOS
>>20	lelong		6		(Token Ring
>>20	lelong		7		(ARCNET
>>20	lelong		8		(SLIP
>>20	lelong		9		(PPP
>>20	lelong		10		(FDDI
>>20	lelong		11		(RFC 1483 ATM
>>20	lelong		12		(raw IP
>>20	lelong		13		(BSD/OS SLIP
>>20	lelong		14		(BSD/OS PPP
>>20	lelong		19		(Linux ATM Classical IP
>>20	lelong		50		(PPP or Cisco HDLC
>>20	lelong		51		(PPP-over-Ethernet
>>20	lelong		99		(Symantec Enterprise Firewall
>>20	lelong		100		(RFC 1483 ATM
>>20	lelong		101		(raw IP
>>20	lelong		102		(BSD/OS SLIP
>>20	lelong		103		(BSD/OS PPP
>>20	lelong		104		(BSD/OS Cisco HDLC
>>20	lelong		105		(802.11
>>20	lelong		106		(Linux Classical IP over ATM
>>20	lelong		107		(Frame Relay
>>20	lelong		108		(OpenBSD loopback
>>20	lelong		109		(OpenBSD IPsec encrypted
>>20	lelong		112		(Cisco HDLC
>>20	lelong		113		(Linux "cooked"
>>20	lelong		114		(LocalTalk
>>20	lelong		117		(OpenBSD PFLOG
>>20	lelong		119		(802.11 with Prism header
>>20	lelong		122		(RFC 2625 IP over Fibre Channel
>>20	lelong		123		(SunATM
>>20	lelong		127		(802.11 with radiotap header
>>20	lelong		129		(Linux ARCNET
>>20	lelong		138		(Apple IP over IEEE 1394
>>20	lelong		140		(MTP2
>>20	lelong		141		(MTP3
>>20	lelong		143		(DOCSIS
>>20	lelong		144		(IrDA
>>20	lelong		147		(Private use 0
>>20	lelong		148		(Private use 1
>>20	lelong		149		(Private use 2
>>20	lelong		150		(Private use 3
>>20	lelong		151		(Private use 4
>>20	lelong		152		(Private use 5
>>20	lelong		153		(Private use 6
>>20	lelong		154		(Private use 7
>>20	lelong		155		(Private use 8
>>20	lelong		156		(Private use 9
>>20	lelong		157		(Private use 10
>>20	lelong		158		(Private use 11
>>20	lelong		159		(Private use 12
>>20	lelong		160		(Private use 13
>>20	lelong		161		(Private use 14
>>20	lelong		162		(Private use 15
>>20	lelong		163		(802.11 with AVS header
>>16	lelong		x		\b, capture length %d)
>
>#
># "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
># (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
># the main program that uses that format, but there are other programs
># that use "libpcap", or that use the same capture file format.)
>#
>0	ubelong		0xa1b2cd34	extended tcpdump capture file (big-endian)
>>4	beshort		x		- version %d
>>6	beshort		x		\b.%d
>>20	belong		0		(No link-layer encapsulation
>>20	belong		1		(Ethernet
>>20	belong		2		(3Mb Ethernet
>>20	belong		3		(AX.25
>>20	belong		4		(ProNET
>>20	belong		5		(CHAOS
>>20	belong		6		(Token Ring
>>20	belong		7		(ARCNET
>>20	belong		8		(SLIP
>>20	belong		9		(PPP
>>20	belong		10		(FDDI
>>20	belong		11		(RFC 1483 ATM
>>20	belong		12		(raw IP
>>20	belong		13		(BSD/OS SLIP
>>20	belong		14		(BSD/OS PPP
>>16	belong		x		\b, capture length %d)
>0	ulelong		0xa1b2cd34	extended tcpdump capture file (little-endian)
>>4	leshort		x		- version %d
>>6	leshort		x		\b.%d
>>20	lelong		0		(No link-layer encapsulation
>>20	lelong		1		(Ethernet
>>20	lelong		2		(3Mb Ethernet
>>20	lelong		3		(AX.25
>>20	lelong		4		(ProNET
>>20	lelong		5		(CHAOS
>>20	lelong		6		(Token Ring
>>20	lelong		7		(ARCNET
>>20	lelong		8		(SLIP
>>20	lelong		9		(PPP
>>20	lelong		10		(FDDI
>>20	lelong		11		(RFC 1483 ATM
>>20	lelong		12		(raw IP
>>20	lelong		13		(BSD/OS SLIP
>>20	lelong		14		(BSD/OS PPP
>>16	lelong		x		\b, capture length %d)
>
>#
># AIX "iptrace" capture files.
>#
>0	string		iptrace\ 1.0	"iptrace" capture file
>0	string		iptrace\ 2.0	"iptrace" capture file
>
>#
># Novell LANalyzer capture files.
>#
>0	leshort		0x1001		LANalyzer capture file
>0	leshort		0x1007		LANalyzer capture file
>
>#
># HP-UX "nettl" capture files.
>#
>0	string		\x54\x52\x00\x64\x00	"nettl" capture file
>
>#
># RADCOM WAN/LAN Analyzer capture files.
>#
>0	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file
>
>#
># NetStumbler log files.  Not really packets, per se, but about as
># close as you can get.  These are log files from NetStumbler, a
># Windows program, that scans for 802.11b networks.
>#
>0	string		NetS		NetStumbler log file
>>8	lelong		x		\b, %d stations found
>
>#
># EtherPeek/AiroPeek "version 9" capture files.
>#
>0	string		\177ver		EtherPeek/AiroPeek capture file
>
>#
># Visual Networks traffic capture files.
>#
>0	string		\x05VNF		Visual Networks traffic capture file
>
>#
># Network Instruments Observer capture files.
>#
>0	string		ObserverPktBuffe	Network Instruments Observer capture file
>
>#
># Files from Accellent Group's 5View products.
>#
>0	string		\xaa\xaa\xaa\xaa	5View capture file
>
>#------------------------------------------------------------------------------
># Dyadic: file(1) magic for Dyalog APL.
>#
>0 	byte	0xaa
>>1	byte	<4		Dyalog APL
>>>1	byte	0x00		incomplete workspace
>>>1	byte	0x01		component file
>>>1	byte	0x02		external variable
>>>1	byte	0x03		workspace
>>>2	byte	x		version %d
>>>3	byte	x		.%d
>
>#------------------------------------------------------------------------------
># softquad:  file(1) magic for SoftQuad Publishing Software
>#
># Author/Editor and RulesBuilder
>#
># XXX - byte order?
>#
>0	string		\<!SQ\ DTD>	Compiled SGML rules file
>>9	string		>\0		 Type %s
>0	string		\<!SQ\ A/E>	A/E SGML Document binary
>>9	string		>\0		 Type %s
>0	string		\<!SQ\ STS>	A/E SGML binary styles file
>>9	string		>\0		 Type %s
>0	short		0xc0de		Compiled PSI (v1) data
>0	short		0xc0da		Compiled PSI (v2) data
>>3	string		>\0		(%s)
># Binary sqtroff font/desc files...
>0	short		0125252		SoftQuad DESC or font file binary
>>2	short		>0		- version %d
># Bitmaps...
>0	string		SQ\ BITMAP1	SoftQuad Raster Format text
>#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
># sqtroff intermediate language (replacement for ditroff int. lang.)
>0	string		X\ 		SoftQuad troff Context intermediate
>>2	string		495		for AT&T 495 laser printer
>>2	string		hp		for Hewlett-Packard LaserJet
>>2	string		impr		for IMAGEN imPRESS
>>2	string		ps		for PostScript
>
>#------------------------------------------------------------------------------
># spectrum:  file(1) magic for Spectrum emulator files.
>#
># John Elliott <jce@seasip.demon.co.uk>
>
>#
># Spectrum +3DOS header
>#
>0       string          PLUS3DOS\032    Spectrum +3 data
>>15     byte            0               - BASIC program
>>15     byte            1               - number array
>>15     byte            2               - character array
>>15     byte            3               - memory block
>>>16    belong          0x001B0040      (screen)
>>15     byte            4               - Tasword document
>>15     string          TAPEFILE        - ZXT tapefile
>#
># Tape file. This assumes the .TAP starts with a Spectrum-format header,
># which nearly all will.
>#
>0       string          \023\000\000    Spectrum .TAP data
>>4      string          x               "%-10.10s"
>>3      byte            0               - BASIC program
>>3      byte            1               - number array
>>3      byte            2               - character array
>>3      byte            3               - memory block
>>>14    belong          0x001B0040      (screen)
>
># The following three blocks are from pak21-spectrum@srcf.ucam.org
># TZX tape images
>0      string          ZXTape!\x1a     Spectrum .TZX data
>>8     byte            x               version %d
>>9     byte            x               .%d
>
># RZX input recording files
>0      string          RZX!            Spectrum .RZX data
>>4     byte            x               version %d
>>5     byte            x               .%d
>
># And three sorts of disk image
>0      string          MV\ -\ CPCEMU\ Disk-Fil Amstrad/Spectrum .DSK data
>0      string          MV\ -\ CPC\ format\ Dis Amstrad/Spectrum DU54 .DSK data
>0      string          EXTENDED\ CPC\ DSK\ Fil Amstrad/Spectrum Extended .DSK data
>
>#------------------------------------------------------------------------------
># sql:  file(1) magic for SQL files
>#
># From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
># Recognize some MySQL files.
>#
>0	beshort			0xfe01		MySQL table definition file
>>2	byte			x		Version %d
>0	belong&0xffffff00	0xfefe0300	MySQL MISAM index file
>>3	byte			x		Version %d
>0	belong&0xffffff00	0xfefe0700	MySQL MISAM compressed data file
>>3	byte			x		Version %d
>0	belong&0xffffff00	0xfefe0500	MySQL ISAM index file
>>3	byte			x		Version %d
>0	belong&0xffffff00	0xfefe0600	MySQL ISAM compressed data file
>>3	byte			x		Version %d
>0	string		 	\376bin		MySQL replication log
>
>#------------------------------------------------------------------------------
># iRiver H Series database file 
># From Ken Guest <ken@linux.ie>
># As observed from iRivNavi.iDB and unencoded firmware
>#
>0   string		iRivDB	iRiver Database file
>>11  string	>\0	Version %s
>>39  string		iHP-100	[H Series]
>
>#------------------------------------------------------------------------------
># SQLite database file 
># From Ken Guest <ken@linux.ie>
>#
>0   string  SQLite  SQLite database
>>14 string >\0  (Version %s)
>
>#------------------------------------------------------------------------------
># sun:  file(1) magic for Sun machines
>#
># Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
># releases.  (5.x uses ELF.)
>#
>0	belong&077777777	0600413		SPARC demand paged
>>0	byte		&0x80
>>>20	belong		<4096		shared library
>>>20	belong		=4096		dynamically linked executable
>>>20	belong		>4096		dynamically linked executable
>>0	byte		^0x80		executable
>>16	belong		>0		not stripped
>0	belong&077777777	0600410		SPARC pure
>>0	byte		&0x80		dynamically linked executable
>>0	byte		^0x80		executable
>>16	belong		>0		not stripped
>0	belong&077777777	0600407		SPARC
>>0	byte		&0x80		dynamically linked executable
>>0	byte		^0x80		executable
>>16	belong		>0		not stripped
>
>0	belong&077777777	0400413		mc68020 demand paged
>>0	byte		&0x80
>>>20	belong		<4096		shared library
>>>20	belong		=4096		dynamically linked executable
>>>20	belong		>4096		dynamically linked executable
>>16	belong		>0		not stripped
>0	belong&077777777	0400410		mc68020 pure
>>0	byte		&0x80		dynamically linked executable
>>0	byte		^0x80		executable
>>16	belong		>0		not stripped
>0	belong&077777777	0400407		mc68020
>>0	byte		&0x80		dynamically linked executable
>>0	byte		^0x80		executable
>>16	belong		>0		not stripped
>
>0	belong&077777777	0200413		mc68010 demand paged
>>0	byte		&0x80
>>>20	belong		<4096		shared library
>>>20	belong		=4096		dynamically linked executable
>>>20	belong		>4096		dynamically linked executable
>>16	belong		>0		not stripped
>0	belong&077777777	0200410		mc68010 pure
>>0	byte		&0x80		dynamically linked executable
>>0	byte		^0x80		executable
>>16	belong		>0		not stripped
>0	belong&077777777	0200407		mc68010
>>0	byte		&0x80		dynamically linked executable
>>0	byte		^0x80		executable
>>16	belong		>0		not stripped
>
># reworked these to avoid anything beginning with zero becoming "old sun-2"
>0	belong		0407		old sun-2 executable
>>16	belong		>0		not stripped
>0	belong		0410		old sun-2 pure executable
>>16	belong		>0		not stripped
>0	belong		0413		old sun-2 demand paged executable
>>16	belong		>0		not stripped
>
>#
># Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
># binary executed in compatibility mode under SunOS 5.x".
>#
>0	belong		0x080456	SunOS core file
>>4	belong		432		(SPARC)
>>>132	string		>\0		from '%s'
>>>116	belong		=3		(quit)
>>>116	belong		=4		(illegal instruction)
>>>116	belong		=5		(trace trap)
>>>116	belong		=6		(abort)
>>>116	belong		=7		(emulator trap)
>>>116	belong		=8		(arithmetic exception)
>>>116	belong		=9		(kill)
>>>116	belong		=10		(bus error)
>>>116	belong		=11		(segmentation violation)
>>>116	belong		=12		(bad argument to system call)
>>>116	belong		=29		(resource lost)
>>>120	belong		x		(T=%dK,
>>>124	belong		x		D=%dK,
>>>128	belong		x		S=%dK)
>>4	belong		826		(68K)
>>>128	string		>\0		from '%s'
>>4	belong		456		(SPARC 4.x BCP)
>>>152	string		>\0		from '%s'
># Sun SunPC
>0	long		0xfa33c08e	SunPC 4.0 Hard Disk
>0	string		#SUNPC_CONFIG	SunPC 4.0 Properties Values
># Sun snoop (see RFC 1761, which describes the capture file format).
>#
>0	string		snoop		Snoop capture file
>>8	belong		>0		- version %ld
>>12	belong		0		(IEEE 802.3)
>>12	belong		1		(IEEE 802.4)
>>12	belong		2		(IEEE 802.5)
>>12	belong		3		(IEEE 802.6)
>>12	belong		4		(Ethernet)
>>12	belong		5		(HDLC)
>>12	belong		6		(Character synchronous)
>>12	belong		7		(IBM channel-to-channel adapter)
>>12	belong		8		(FDDI)
>>12	belong		9		(Unknown)
>
># Microsoft ICM color profile
>36	string		acspMSFT	Microsoft ICM Color Profile
># Sun KCMS
>36	string		acsp		Kodak Color Management System, ICC Profile
>
>#---------------------------------------------------------------------------
># The following entries have been tested by Duncan Laurie <duncan@sun.com> (a
># lead Sun/Cobalt developer) who agrees that they are good and worthy of
># inclusion.
>
># Boot ROM images for Sun/Cobalt Linux server appliances
>0       string  Cobalt\ Networks\ Inc.\nFirmware\ v     Paged COBALT boot rom
>>38     string x        V%.4s
>
># New format for Sun/Cobalt boot ROMs is annoying, it stores the version code
># at the very end where file(1) can't get it.
>0       string CRfs     COBALT boot rom data (Flat boot rom or file system)
>
>
>#------------------------------------------------------------------------
># sysex: file(1) magic for MIDI sysex files
>#
># 
>0	byte			0xF0		SysEx File -
>
># North American Group
>>1	byte			0x01		Sequential
>>1	byte			0x02		IDP
>>1	byte			0x03		OctavePlateau
>>1	byte			0x04		Moog
>>1	byte			0x05		Passport
>>1	byte			0x06		Lexicon
>>1	byte			0x07		Kurzweil
>>1	byte			0x08		Fender
>>1	byte			0x09		Gulbransen
>>1	byte			0x0a		AKG
>>1	byte			0x0b		Voyce
>>1	byte			0x0c		Waveframe
>>1	byte			0x0d		ADA
>>1	byte			0x0e		Garfield
>>1	byte			0x0f		Ensoniq
>>1	byte			0x10		Oberheim
>>1	byte			0x11		Apple
>>1	byte			0x12		GreyMatter
>>1	byte			0x14		PalmTree
>>1	byte			0x15		JLCooper
>>1	byte			0x16		Lowrey
>>1	byte			0x17		AdamsSmith
>>1	byte			0x18		E-mu
>>1	byte			0x19		Harmony
>>1	byte			0x1a		ART
>>1	byte			0x1b		Baldwin
>>1	byte			0x1c		Eventide
>>1	byte			0x1d		Inventronics
>>1	byte			0x1f		Clarity
>
># European Group
>>1	byte			0x21		SIEL
>>1	byte			0x22		Synthaxe
>>1	byte			0x24		Hohner
>>1	byte			0x25		Twister
>>1	byte			0x26		Solton
>>1	byte			0x27		Jellinghaus
>>1	byte			0x28		Southworth
>>1	byte			0x29		PPG
>>1	byte			0x2a		JEN
>>1	byte			0x2b		SSL
>>1	byte			0x2c		AudioVertrieb
>
>>1	byte			0x2f		ELKA
>>>3	byte			0x09		EK-44
>
>>1	byte			0x30		Dynacord
>>1	byte			0x33		Clavia
>>1	byte			0x39		Soundcraft
>
>>1	byte			0x3e		Waldorf
>>>3	byte			0x7f		Microwave I
>
># Japanese Group
>>1	byte			0x40		Kawai
>>>3	byte			0x20		K1
>>>3	byte			0x22		K4
>
>>1	byte			0x41		Roland
>>>3	byte			0x14		D-50
>>>3	byte			0x2b		U-220
>>>3	byte			0x02		TR-707
>
>>1	byte			0x42		Korg
>>>3	byte			0x19		M1
>
>>1	byte			0x43		Yamaha
>>1	byte			0x44		Casio
>>1	byte			0x46		Kamiya
>>1	byte			0x47		Akai
>>1	byte			0x48		Victor
>>1	byte			0x49		Mesosha
>>1	byte			0x4b		Fujitsu
>>1	byte			0x4c		Sony
>>1	byte			0x4e		Teac
>>1	byte			0x50		Matsushita
>>1	byte			0x51		Fostex
>>1	byte			0x52		Zoom
>>1	byte			0x54		Matsushita
>>1	byte			0x57		Acoustic tech. lab.
>
>>1	belong&0xffffff00	0x00007400	Ta Horng
>>1	belong&0xffffff00	0x00007500	e-Tek
>>1	belong&0xffffff00	0x00007600	E-Voice
>>1	belong&0xffffff00	0x00007700	Midisoft
>>1	belong&0xffffff00	0x00007800	Q-Sound
>>1	belong&0xffffff00	0x00007900	Westrex
>>1	belong&0xffffff00	0x00007a00	Nvidia*
>>1	belong&0xffffff00	0x00007b00	ESS
>>1	belong&0xffffff00	0x00007c00	Mediatrix
>>1	belong&0xffffff00	0x00007d00	Brooktree
>>1	belong&0xffffff00	0x00007e00	Otari
>>1	belong&0xffffff00	0x00007f00	Key Electronics
>>1	belong&0xffffff00	0x00010000	Shure
>>1	belong&0xffffff00	0x00010100	AuraSound
>>1	belong&0xffffff00	0x00010200	Crystal
>>1	belong&0xffffff00	0x00010300	Rockwell
>>1	belong&0xffffff00	0x00010400	Silicon Graphics
>>1	belong&0xffffff00	0x00010500	Midiman
>>1	belong&0xffffff00	0x00010600	PreSonus
>>1	belong&0xffffff00	0x00010800	Topaz
>>1	belong&0xffffff00	0x00010900	Cast Lightning
>>1	belong&0xffffff00	0x00010a00	Microsoft
>>1	belong&0xffffff00	0x00010b00	Sonic Foundry
>>1	belong&0xffffff00	0x00010c00	Line 6
>>1	belong&0xffffff00	0x00010d00	Beatnik Inc.
>>1	belong&0xffffff00	0x00010e00	Van Koerving
>>1	belong&0xffffff00	0x00010f00	Altech Systems
>>1	belong&0xffffff00	0x00011000	S & S Research
>>1	belong&0xffffff00	0x00011100	VLSI Technology
>>1	belong&0xffffff00	0x00011200	Chromatic
>>1	belong&0xffffff00	0x00011300	Sapphire
>>1	belong&0xffffff00	0x00011400	IDRC
>>1	belong&0xffffff00	0x00011500	Justonic Tuning
>>1	belong&0xffffff00	0x00011600	TorComp
>>1	belong&0xffffff00	0x00011700	Newtek Inc.
>>1	belong&0xffffff00	0x00011800	Sound Sculpture
>>1	belong&0xffffff00	0x00011900	Walker Technical
>>1	belong&0xffffff00	0x00011a00	Digital Harmony
>>1	belong&0xffffff00	0x00011b00	InVision
>>1	belong&0xffffff00	0x00011c00	T-Square
>>1	belong&0xffffff00	0x00011d00	Nemesys
>>1	belong&0xffffff00	0x00011e00	DBX
>>1	belong&0xffffff00	0x00011f00	Syndyne
>>1	belong&0xffffff00	0x00012000	Bitheadz	
>>1	belong&0xffffff00	0x00012100	Cakewalk
>>1	belong&0xffffff00	0x00012200	Staccato
>>1	belong&0xffffff00	0x00012300	National Semicon.
>>1	belong&0xffffff00	0x00012400	Boom Theory
>>1	belong&0xffffff00	0x00012500	Virtual DSP Corp
>>1	belong&0xffffff00	0x00012600	Antares
>>1	belong&0xffffff00	0x00012700	Angel Software
>>1	belong&0xffffff00	0x00012800	St Louis Music
>>1	belong&0xffffff00	0x00012900	Lyrrus dba G-VOX
>>1	belong&0xffffff00	0x00012a00	Ashley Audio
>>1	belong&0xffffff00	0x00012b00	Vari-Lite
>>1	belong&0xffffff00	0x00012c00	Summit Audio
>>1	belong&0xffffff00	0x00012d00	Aureal Semicon.
>>1	belong&0xffffff00	0x00012e00	SeaSound
>>1	belong&0xffffff00	0x00012f00	U.S. Robotics
>>1	belong&0xffffff00	0x00013000	Aurisis
>>1	belong&0xffffff00	0x00013100	Nearfield Multimedia
>>1	belong&0xffffff00	0x00013200	FM7 Inc.
>>1	belong&0xffffff00	0x00013300	Swivel Systems
>>1	belong&0xffffff00	0x00013400	Hyperactive
>>1	belong&0xffffff00	0x00013500	MidiLite
>>1	belong&0xffffff00	0x00013600	Radical
>>1	belong&0xffffff00	0x00013700	Roger Linn
>>1	belong&0xffffff00	0x00013800	Helicon
>>1	belong&0xffffff00	0x00013900	Event
>>1	belong&0xffffff00	0x00013a00	Sonic Network
>>1	belong&0xffffff00	0x00013b00	Realtime Music
>>1	belong&0xffffff00	0x00013c00	Apogee Digital
>
>>1	belong&0xffffff00	0x00202b00	Medeli Electronics
>>1	belong&0xffffff00	0x00202c00	Charlie Lab
>>1	belong&0xffffff00	0x00202d00	Blue Chip Music
>>1	belong&0xffffff00	0x00202e00	BEE OH Corp
>>1	belong&0xffffff00	0x00202f00	LG Semicon America
>>1	belong&0xffffff00	0x00203000	TESI
>>1	belong&0xffffff00	0x00203100	EMAGIC
>>1	belong&0xffffff00	0x00203200	Behringer
>>1	belong&0xffffff00	0x00203300	Access Music
>>1	belong&0xffffff00	0x00203400	Synoptic
>>1	belong&0xffffff00	0x00203500	Hanmesoft Corp
>>1	belong&0xffffff00	0x00203600	Terratec
>>1	belong&0xffffff00	0x00203700	Proel SpA
>>1	belong&0xffffff00	0x00203800	IBK MIDI
>>1	belong&0xffffff00	0x00203900	IRCAM
>>1	belong&0xffffff00	0x00203a00	Propellerhead Software
>>1	belong&0xffffff00	0x00203b00	Red Sound Systems
>>1	belong&0xffffff00	0x00203c00	Electron ESI AB
>>1	belong&0xffffff00	0x00203d00	Sintefex Audio
>>1	belong&0xffffff00	0x00203e00	Music and More
>>1	belong&0xffffff00	0x00203f00	Amsaro
>>1	belong&0xffffff00	0x00204000	CDS Advanced Technology
>>1	belong&0xffffff00	0x00204100	Touched by Sound
>>1	belong&0xffffff00	0x00204200	DSP Arts
>>1	belong&0xffffff00	0x00204300	Phil Rees Music
>>1	belong&0xffffff00	0x00204400	Stamer Musikanlagen GmbH
>>1	belong&0xffffff00	0x00204500	Soundart
>>1	belong&0xffffff00	0x00204600	C-Mexx Software
>>1	belong&0xffffff00	0x00204700	Klavis Tech.
>>1	belong&0xffffff00	0x00204800	Noteheads AB
>
>0	string			T707		Roland TR-707 Data
>#------------------------------------------------------------------------------
># teapot:  file(1) magic for "teapot" spreadsheet
>#
>0       string          #!teapot\012xdr      teapot work sheet (XDR format)
>
>#------------------------------------------------------------------------------
># terminfo:  file(1) magic for terminfo
>#
># XXX - byte order for screen images?
>#
>0	string		\032\001	Compiled terminfo entry
>0	short		0433		Curses screen image
>0	short		0434		Curses screen image
>
>#------------------------------------------------------------------------------
># tex:  file(1) magic for TeX files
>#
># From <conklin@talisman.kaleida.com>
>
># Although we may know the offset of certain text fields in TeX DVI
># and font files, we can't use them reliably because they are not
># zero terminated. [but we do anyway, christos]
>0	string		\367\002	TeX DVI file
>>16	string		>\0		(%s)
>0	string		\367\203	TeX generic font data
>0	string		\367\131	TeX packed font data
>>3	string		>\0		(%s)
>0	string		\367\312	TeX virtual font data
>0	string		This\ is\ TeX,	TeX transcript text
>0	string		This\ is\ METAFONT,	METAFONT transcript text
>
># There is no way to detect TeX Font Metric (*.tfm) files without
># breaking them apart and reading the data.  The following patterns
># match most *.tfm files generated by METAFONT or afm2tfm.
>2	string		\000\021	TeX font metric data
>>33	string		>\0		(%s)
>2	string		\000\022	TeX font metric data
>>33	string		>\0		(%s)
>
># Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
>0	string		\\input\ texinfo	Texinfo source text
>0	string		This\ is\ Info\ file	GNU Info text
>
># TeX documents, from Daniel Quinlan (quinlan@yggdrasil.com)
>0	string		\\input		TeX document text
>0	string		\\section	LaTeX document text
>0	string		\\setlength	LaTeX document text
>0	string		\\documentstyle	LaTeX document text
>0	string		\\chapter	LaTeX document text
>0	string		\\documentclass	LaTeX 2e document text
>0	string		\\relax		LaTeX auxiliary file
>0	string		\\contentsline	LaTeX  table of contents
>0	string		%\ -*-latex-*-	LaTeX document text
>
># Tex document, from Hendrik Scholz <hendrik@scholz.net>
>0   string      \\ifx       TeX document text
>
># Index and glossary files
>0	string		\\indexentry	LaTeX raw index file
>0	string		\\begin{theindex}	LaTeX sorted index
>0	string		\\glossaryentry	LaTeX raw glossary
>0	string		\\begin{theglossary}	LaTeX sorted glossary
>0	string		This\ is\ makeindex	Makeindex log file
>
># End of TeX
>
>#------------------------------------------------------------------------------
># file(1) magic for BibTex text files
># From Hendrik Scholz <hendrik@scholz.net>
>
>0   string/c @article{        BibTeX text file
>0   string/c @book{           BibTeX text file
>0   string/c @inbook{         BibTeX text file
>0   string/c @incollection{   BibTeX text file
>0   string/c @inproceedings{  BibTeX text file
>0   string/c @manual{         BibTeX text file
>0   string/c @misc{           BibTeX text file
>0   string/c @preamble{       BibTeX text file
>0   string/c @phdthesis{      BibTeX text file
>0   string/c @techreport{     BibTeX text file
>0   string/c @unpublished{    BibTeX text file
>
>73  string %%%\ \ BibTeX-file{ BibTex text file (with full header)
>
>73  string %%%\ \ @BibTeX-style-file{   BibTeX style text file (with full header)
>
>0   string %\ BibTeX\ standard\ bibliography\      BibTeX standard bibliography style text file
>
>0   string %\ BibTeX\ `     BibTeX custom bibliography style text file
>
>0   string  @c\ @mapfile{   TeX font aliases text file
>
>#------------------------------------------------------------------------------
># file(1) magic for tgif(1) files
># From Hendrik Scholz <hendrik@scholz.net>
>
>0   string  %TGIF\ 4   tgif version 4 object file
>
># ------------------------------------------------------------------------
># ti-8x: file(1) magic for the TI-8x and TI-9x Graphing Calculators.
>#
># From: Ryan McGuire (rmcguire@freenet.columbus.oh.us).
>#
># Update: Romain Lievin (roms@lpg.ticalc.org).
>#
># NOTE: This list is not complete.
># Files for the TI-80 and TI-81 are pretty rare. I'm not going to put the
># program/group magic numbers in here because I cannot find any.
>0		string		**TI80**	TI-80 Graphing Calculator File.
>0		string		**TI81**	TI-81 Graphing Calculator File.
>#
># Magic Numbers for the TI-73
>#
>0		string		**TI73**	TI-73 Graphing Calculator
>>0x00003B	byte		0x00		(real number)
>>0x00003B	byte		0x01		(list)
>>0x00003B	byte		0x02		(matrix)
>>0x00003B	byte		0x03		(equation)
>>0x00003B	byte		0x04		(string)
>>0x00003B	byte		0x05		(program)
>>0x00003B	byte		0x06		(assembly program)
>>0x00003B	byte		0x07		(picture)
>>0x00003B	byte		0x08		(gdb)
>>0x00003B	byte		0x0C		(complex number)
>>0x00003B	byte		0x0F		(window settings)
>>0x00003B	byte		0x10		(zoom)
>>0x00003B	byte		0x11		(table setup)
>>0x00003B	byte		0x13		(backup)
>
># Magic Numbers for the TI-82
>#
>0		string		**TI82**	TI-82 Graphing Calculator
>>0x00003B	byte		0x00		(real)
>>0x00003B	byte		0x01		(list)
>>0x00003B	byte		0x02		(matrix)
>>0x00003B	byte		0x03		(Y-variable)
>>0x00003B	byte		0x05		(program)
>>0x00003B	byte		0x06		(protected prgm)
>>0x00003B	byte		0x07		(picture)
>>0x00003B	byte		0x08		(gdb)
>>0x00003B	byte		0x0B		(window settings)
>>0x00003B	byte		0x0C		(window settings)
>>0x00003B	byte		0x0D		(table setup)
>>0x00003B	byte		0x0E		(screenshot)
>>0x00003B	byte		0x0F		(backup)
>#
># Magic Numbers for the TI-83
>#
>0		string		**TI83**	TI-83 Graphing Calculator
>>0x00003B	byte		0x00		(real)
>>0x00003B	byte		0x01		(list)
>>0x00003B	byte		0x02		(matrix)
>>0x00003B	byte		0x03		(Y-variable)
>>0x00003B	byte		0x04		(string)
>>0x00003B	byte		0x05		(program)
>>0x00003B	byte		0x06		(protected prgm)
>>0x00003B	byte		0x07		(picture)
>>0x00003B	byte		0x08		(gdb)
>>0x00003B	byte		0x0B		(window settings)
>>0x00003B	byte		0x0C		(window settings)
>>0x00003B	byte		0x0D		(table setup)
>>0x00003B	byte		0x0E		(screenshot)
>>0x00003B	byte		0x13		(backup)
>#
># Magic Numbers for the TI-83+
>#
>0		string		**TI83F*	TI-83+ Graphing Calculator
>>0x00003B	byte		0x00		(real number)
>>0x00003B	byte		0x01		(list)
>>0x00003B	byte		0x02		(matrix)
>>0x00003B	byte		0x03		(equation)
>>0x00003B	byte		0x04		(string)
>>0x00003B	byte		0x05		(program)
>>0x00003B	byte		0x06		(assembly program)
>>0x00003B	byte		0x07		(picture)
>>0x00003B	byte		0x08		(gdb)
>>0x00003B	byte		0x0C		(complex number)
>>0x00003B	byte		0x0F		(window settings)
>>0x00003B	byte		0x10		(zoom)
>>0x00003B	byte		0x11		(table setup)
>>0x00003B	byte		0x13		(backup)
>>0x00003B	byte		0x15		(application variable)
>>0x00003B	byte		0x17		(group of variable)
>
>#
># Magic Numbers for the TI-85
>#
>0		string		**TI85**	TI-85 Graphing Calculator
>>0x00003B	byte		0x00		(real number)
>>0x00003B	byte		0x01		(complex number)
>>0x00003B	byte		0x02		(real vector)
>>0x00003B	byte		0x03		(complex vector)
>>0x00003B	byte		0x04		(real list)
>>0x00003B	byte		0x05		(complex list)
>>0x00003B	byte		0x06		(real matrix)
>>0x00003B	byte		0x07		(complex matrix)
>>0x00003B	byte		0x08		(real constant)
>>0x00003B	byte		0x09		(complex constant)
>>0x00003B	byte		0x0A		(equation)
>>0x00003B	byte		0x0C		(string)
>>0x00003B	byte		0x0D		(function GDB)
>>0x00003B	byte		0x0E		(polar GDB)
>>0x00003B	byte		0x0F		(parametric GDB)
>>0x00003B	byte		0x10		(diffeq GDB)
>>0x00003B	byte		0x11		(picture)
>>0x00003B	byte		0x12		(program)
>>0x00003B	byte		0x13		(range)
>>0x00003B	byte		0x17		(window settings)
>>0x00003B	byte		0x18		(window settings)
>>0x00003B	byte		0x19		(window settings)
>>0x00003B	byte		0x1A		(window settings)
>>0x00003B	byte		0x1B		(zoom)
>>0x00003B	byte		0x1D		(backup)
>>0x00003B	byte		0x1E		(unknown)
>>0x00003B	byte		0x2A		(equation)
>>0x000032	string		ZS4		- ZShell Version 4 File.
>>0x000032	string		ZS3		- ZShell Version 3 File.
>#
># Magic Numbers for the TI-86
>#
>0		string		**TI86**	TI-86 Graphing Calculator
>>0x00003B	byte		0x00		(real number)
>>0x00003B	byte		0x01		(complex number)
>>0x00003B	byte		0x02		(real vector)
>>0x00003B	byte		0x03		(complex vector)
>>0x00003B	byte		0x04		(real list)
>>0x00003B	byte		0x05		(complex list)
>>0x00003B	byte		0x06		(real matrix)
>>0x00003B	byte		0x07		(complex matrix)
>>0x00003B	byte		0x08		(real constant)
>>0x00003B	byte		0x09		(complex constant)
>>0x00003B	byte		0x0A		(equation)
>>0x00003B	byte		0x0C		(string)
>>0x00003B	byte		0x0D		(function GDB)
>>0x00003B	byte		0x0E		(polar GDB)
>>0x00003B	byte		0x0F		(parametric GDB)
>>0x00003B	byte		0x10		(diffeq GDB)
>>0x00003B	byte		0x11		(picture)
>>0x00003B	byte		0x12		(program)
>>0x00003B	byte		0x13		(range)
>>0x00003B	byte		0x17		(window settings)
>>0x00003B	byte		0x18		(window settings)
>>0x00003B	byte		0x19		(window settings)
>>0x00003B	byte		0x1A		(window settings)
>>0x00003B	byte		0x1B		(zoom)
>>0x00003B	byte		0x1D		(backup)
>>0x00003B	byte		0x1E		(unknown)
>>0x00003B	byte		0x2A		(equation)
>#
># Magic Numbers for the TI-89
>#
>0		string		**TI89**	TI-89 Graphing Calculator
>>0x000048	byte		0x00		(expression)
>>0x000048	byte		0x04		(list)
>>0x000048	byte		0x06		(matrix)
>>0x000048	byte		0x0A		(data)
>>0x000048	byte		0x0B		(text)
>>0x000048	byte		0x0C		(string)
>>0x000048	byte		0x0D		(graphic data base)
>>0x000048	byte		0x0E		(figure)
>>0x000048	byte		0x10		(picture)
>>0x000048	byte		0x12		(program)
>>0x000048	byte		0x13		(function)
>>0x000048	byte		0x14		(macro)
>>0x000048	byte		0x1C		(zipped)
>>0x000048	byte		0x21		(assembler)
>#
># Magic Numbers for the TI-92
>#
>0		string		**TI92**	TI-92 Graphing Calculator
>>0x000048	byte		0x00		(expression)
>>0x000048	byte		0x04		(list)
>>0x000048	byte		0x06		(matrix)
>>0x000048	byte		0x0A		(data)
>>0x000048	byte		0x0B		(text)
>>0x000048	byte		0x0C		(string)
>>0x000048	byte		0x0D		(graphic data base)
>>0x000048	byte		0x0E		(figure)
>>0x000048	byte		0x10		(picture)
>>0x000048	byte		0x12		(program)
>>0x000048	byte		0x13		(function)
>>0x000048	byte		0x14		(macro)
>>0x000048	byte		0x1D		(backup)
>#
># Magic Numbers for the TI-92+/V200
>#
>0		string		**TI92P*	TI-92+/V200 Graphing Calculator
>>0x000048	byte		0x00		(expression)
>>0x000048	byte		0x04		(list)
>>0x000048	byte		0x06		(matrix)
>>0x000048	byte		0x0A		(data)
>>0x000048	byte		0x0B		(text)
>>0x000048	byte		0x0C		(string)
>>0x000048	byte		0x0D		(graphic data base)
>>0x000048	byte		0x0E		(figure)
>>0x000048	byte		0x10		(picture)
>>0x000048	byte		0x12		(program)
>>0x000048	byte		0x13		(function)
>>0x000048	byte		0x14		(macro)
>>0x000048	byte		0x1C		(zipped)
>>0x000048	byte		0x21		(assembler)
>#
># Magic Numbers for the TI-73/83+/89/92+/V200 FLASH upgrades
>#
>0x0000016	string		Advanced	TI-XX Graphing Calculator (FLASH)
>0		string		**TIFL**	TI-XX Graphing Calculator (FLASH)
>>8		byte		>0		- Revision %d
>>>9 		byte		x		\b.%d,
>>12		byte		>0		Revision date %02x
>>>13		byte		x		\b/%02x
>>>14		beshort		x		\b/%04x,
>>17		string		>/0		name: '%s',
>>48		byte		0x74		device: TI-73,
>>48		byte		0x73		device: TI-83+,
>>48		byte		0x98		device: TI-89,
>>48		byte		0x88		device: TI-92+,
>>49		byte		0x23		type: OS upgrade,
>>49		byte		0x24		type: application,
>>49		byte		0x25		type: certificate,
>>49		byte		0x3e		type: license,
>>74		lelong		>0		size: %ld bytes
>
># VTi & TiEmu skins (TI Graphing Calculators).
># From: Romain Lievin (roms@lpg.ticalc.org).
># Magic Numbers for the VTi skins
>0               string          VTI		Virtual TI skin
>>3		string		v		- Version
>>>4		byte		>0		\b %c
>>>6		byte		x		\b.%c
># Magic Numbers for the TiEmu skins
>0		string		TiEmu		TiEmu skin
>>6              string          v               - Version
>>>7             byte            >0              \b %c
>>>9             byte            x               \b.%c
>>>10		byte		x		\b%c
>
>#------------------------------------------------------------------------------
># timezone:  file(1) magic for timezone data
>#
># from Daniel Quinlan (quinlan@yggdrasil.com)
># this should work on Linux, SunOS, and maybe others
># Added new official magic number for recent versions of the Olson code
>0	string	TZif	timezone data
>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	old timezone data
>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	old timezone data
>0	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	old timezone data
>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	old timezone data
>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	old timezone data
>0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0	old timezone data
>
>#------------------------------------------------------------------------------
># troff:  file(1) magic for *roff
>#
># updated by Daniel Quinlan (quinlan@yggdrasil.com)
>
># troff input
>0	string		.\\"		troff or preprocessor input text
>0	string		'\\"		troff or preprocessor input text
>0	string		'.\\"		troff or preprocessor input text
>0	string		\\"		troff or preprocessor input text
>0	string		'''		troff or preprocessor input text
>
># ditroff intermediate output text
>0	string		x\ T		ditroff output text
>>4	string		cat		for the C/A/T phototypesetter
>>4	string		ps		for PostScript
>>4	string		dvi		for DVI
>>4	string		ascii		for ASCII
>>4	string		lj4		for LaserJet 4
>>4	string		latin1		for ISO 8859-1 (Latin 1)
>>4	string		X75		for xditview at 75dpi
>>>7	string		-12		(12pt)
>>4	string		X100		for xditview at 100dpi
>>>8	string		-12		(12pt)
>
># output data formats
>0	string		\100\357	very old (C/A/T) troff output data
>#
>#------------------------------------------------------------------------------
># tuxedo:	file(1) magic for BEA TUXEDO data files
>#
># from Ian Springer <ispringer@hotmail.com>
>#
>0	string		\0\0\1\236\0\0\0\0\0\0\0\0\0\0\0\0	BEA TUXEDO DES mask data
>
>#------------------------------------------------------------------------------
># typeset:  file(1) magic for other typesetting
>#
>0	string		Interpress/Xerox	Xerox InterPress data
>>16	string		/			(version
>>>17	string		>\0			%s)
>
>#------------------------------------------------------------------------------
># unknown:  file(1) magic for unknown machines
>#
># XXX - this probably should be pruned, as it'll match PDP-11 and
># VAX image formats.
>#
># 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
># respectively).
>#
># 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
># have the "version %ld", which may be a bogus COFFism (I don't think
># there ever was COFF for the PDP-11).
>#
># 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
># long, as it would be on a VAX.
>#
># 0x10C is 0414 and 0x10E is 416; those *are* unknown.
>#
>0	short		0x107		unknown machine executable
>>8	short		>0		not stripped
>>15	byte		>0		- version %ld
>0	short		0x108		unknown pure executable
>>8	short		>0		not stripped
>>15	byte		>0		- version %ld
>0	short		0x109		PDP-11 separate I&D
>>8	short		>0		not stripped
>>15	byte		>0		- version %ld
>0	short		0x10b		unknown pure executable
>>8	short		>0		not stripped
>>15	byte		>0		- version %ld
>0	long		0x10c		unknown demand paged pure executable
>>16	long		>0		not stripped
>0	long		0x10e		unknown readable demand paged pure executable
>
>#------------------------------------------------------------------------------
># uuencode:  file(1) magic for ASCII-encoded files
>#
>
># GRR:  the first line of xxencoded files is identical to that in uuencoded
># files, but the first character in most subsequent lines is 'h' instead of
># 'M'.  (xxencoding uses lowercase letters in place of most of uuencode's
># punctuation and survives BITNET gateways better.)  If regular expressions
># were supported, this entry could possibly be split into two with
># "begin\040\.\*\012M" or "begin\040\.\*\012h" (where \. and \* are REs).
>0	string		begin\040	uuencoded or xxencoded text
>
># btoa(1) is an alternative to uuencode that requires less space.
>0	string		xbtoa\ Begin	btoa'd text
>
># ship(1) is another, much cooler alternative to uuencode.
># Greg Roelofs, newt@uchicago.edu
>0	string		$\012ship	ship'd binary text
>
># bencode(8) is used to encode compressed news batches (Bnews/Cnews only?)
># Greg Roelofs, newt@uchicago.edu
>0	string	Decode\ the\ following\ with\ bdeco	bencoded News text
>
># BinHex is the Macintosh ASCII-encoded file format (see also "apple")
># Daniel Quinlan, quinlan@yggdrasil.com
>11	string	must\ be\ converted\ with\ BinHex	BinHex binary text
>>41	string	x					\b, version %.3s
>
># GRR:  is MIME BASE64 encoding handled somewhere?
>
>#------------------------------------------------------------------------------
># varied.out:  file(1) magic for various USG systems
>#
>#	Herewith many of the object file formats used by USG systems.
>#	Most have been moved to files for a particular processor,
>#	and deleted if they duplicate other entries.
>#
>0	short		0610		Perkin-Elmer executable
># AMD 29K
>0	beshort		0572		amd 29k coff noprebar executable
>0	beshort		01572		amd 29k coff prebar executable
>0	beshort		0160007		amd 29k coff archive
># Cray
>6	beshort		0407		unicos (cray) executable
># Ultrix 4.3
>596	string		\130\337\377\377	Ultrix core file
>>600	string		>\0		from '%s'
># BeOS and MAcOS PEF executables
># From: hplus@zilker.net (Jon Watte)
>0	string		Joy!peffpwpc	header for PowerPC PEF executable
>#
># ava assembler/linker Uros Platise <uros.platise@ijs.si>
>0       string          avaobj  AVR assembler object code
>>7      string          >\0     version '%s'
># gnu gmon magic From: Eugen Dedu <dedu@ese-metz.fr>
>0	string		gmon		GNU prof performance data
>>4	long		x		- version %ld
># From: Dave Pearson <davep@davep.org>
># Harbour <URL:http://www.harbour-project.org/> HRB files.
>0	string		\xc0HRB		Harbour HRB file
>>4	short		x		version %d
>#------------------------------------------------------------------------------
># varied.script:  file(1) magic for various interpreter scripts
>
>0	string		#!\ /			a
>>3	string		>\0			%s script text
>0	string		#!\	/		a
>>3	string		>\0			%s script text
>0	string		#!/			a
>>2	string		>\0			%s script text
>0	string		#!\ 			script text
>>3	string		>\0			for %s
>
>
>#------------------------------------------------------------------------------
># vax:  file(1) magic for VAX executable/object and APL workspace
>#
>0	lelong		0101557		VAX single precision APL workspace
>0	lelong		0101556		VAX double precision APL workspace
>
>#
># VAX a.out (32V, BSD)
>#
>0	lelong		0407		VAX executable
>>16	lelong		>0		not stripped
>
>0	lelong		0410		VAX pure executable
>>16	lelong		>0		not stripped
>
>0	lelong		0413		VAX demand paged pure executable
>>16	lelong		>0		not stripped
>
>0	lelong		0420		VAX demand paged (first page unmapped) pure executable
>>16	lelong		>0		not stripped
>
>#
># VAX COFF
>#
># The `versions' should be un-commented if they work for you.
># (Was the problem just one of endianness?)
>#
>0	leshort		0570		VAX COFF executable
>>12	lelong		>0		not stripped
>>22	leshort		>0		- version %ld
>0	leshort		0575		VAX COFF pure executable
>>12	lelong		>0		not stripped
>>22	leshort		>0		- version %ld
>
>#------------------------------------------------------------------------------
># vicar:  file(1) magic for VICAR files.
>#
># From: Ossama Othman <othman@astrosun.tn.cornell.edu
># VICAR is JPL's in-house spacecraft image processing program
># VICAR image
>0	string	LBLSIZE=	VICAR image data
>>32	string	BYTE		\b, 8 bits  = VAX byte
>>32	string	HALF		\b, 16 bits = VAX word     = Fortran INTEGER*2
>>32	string	FULL		\b, 32 bits = VAX longword = Fortran INTEGER*4
>>32	string	REAL		\b, 32 bits = VAX longword = Fortran REAL*4
>>32	string	DOUB		\b, 64 bits = VAX quadword = Fortran REAL*8
>>32	string	COMPLEX		\b, 64 bits = VAX quadword = Fortran COMPLEX*8
># VICAR label file
>43	string	SFDU_LABEL	VICAR label file
>#------------------------------------------------------------------------------
># Virtutech Compressed Random Access File Format
>#
># From <gustav@virtutech.com>
>0      string          \211\277\036\203        Virtutech CRAFF
>>4     belong          x               v%d
>>20    belong          0               uncompressed
>>20    belong          1               bzipp2ed
>>20    belong          2               gzipped
>>24    belong          0               not clean
>
>#------------------------------------------------------------------------------
># visx:  file(1) magic for Visx format files
>#
>0	short		0x5555		VISX image file
>>2	byte		0		(zero)
>>2	byte		1		(unsigned char)
>>2	byte		2		(short integer)
>>2	byte		3		(float 32)
>>2	byte		4		(float 64)
>>2	byte		5		(signed char)
>>2	byte		6		(bit-plane)
>>2	byte		7		(classes)
>>2	byte		8		(statistics)
>>2	byte		10		(ascii text)
>>2	byte		15		(image segments)
>>2	byte		100		(image set)
>>2	byte		101		(unsigned char vector)
>>2	byte		102		(short integer vector)
>>2	byte		103		(float 32 vector)
>>2	byte		104		(float 64 vector)
>>2	byte		105		(signed char vector)
>>2	byte		106		(bit plane vector)
>>2	byte		121		(feature vector)
>>2	byte		122		(feature vector library)
>>2	byte		124		(chain code)
>>2	byte		126		(bit vector)
>>2	byte		130		(graph)
>>2	byte		131		(adjacency graph)
>>2	byte		132		(adjacency graph library)
>>2	string		.VISIX		(ascii text)
>
>#------------------------------------------------------------------------------
># vms:  file(1) magic for VMS executables (experimental)
>#
># VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)
>
># GRR 950122:  I'm just guessing on these, based on inspection of the headers
># of three executables each for Alpha and VAX architectures.  The VAX files
># all had headers similar to this:
>#
>#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
>#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
>#
>0	string	\xb0\0\x30\0	VMS VAX executable
>>44032	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
>#
># The AXP files all looked like this, except that the byte at offset 0x22
># was 06 in some of them and 07 in others:
>#
>#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
>#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
>#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
>#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
>#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
>#
>0	belong	0x03000000	VMS Alpha executable
>>75264	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
>
># -----------------------------------------------------------
># VMware specific files (deducted from version 1.1 and log file entries)
># Anthon van der Neut (anthon@mnt.org)
>0	belong	0x4d52564e	VMware nvram 
>0	belong	0x434f5744	VMware
>>4	byte	3	 	virtual disk 
>>>32	lelong	x		(%d/
>>>36	lelong	x		\b%d/
>>>40	lelong	x		\b%d)
>>4	byte	2	 	undoable disk
>>>32	string  >\0		(%s)
>
>#------------------------------------------------------------------------------
># vorbis:  file(1) magic for Ogg/Vorbis files
>#
># From Felix von Leitner <leitner@fefe.de>
># Extended by Beni Cherniavsky <cben@crosswinds.net>
># Further extended by Greg Wooledge <greg@wooledge.org>
>#
># Most (everything but the number of channels and bitrate) is commented
># out with `##' as it's not interesting to the average user.  The most
># probable things advanced users would want to uncomment are probably
># the number of comments and the encoder version.
>#
># --- Ogg Framing ---
>0		string		OggS		Ogg data
>>4		byte		!0		UNKNOWN REVISION %u
>##>4		byte		0		revision 0
>>4		byte		0
>##>>14		lelong		x		(Serial %lX)
># non-Vorbis content: FLAC (Free Lossless Audio Codec, http://flac.sourceforge.net)
>>>28		string		fLaC		\b, FLAC audio
># non-Vorbis content: Theora
>>>28		string		\x80theora	\b, Theora video
># non-Vorbis content: Speex
>>>28		string		Speex\ \ \ 	\b, Speex audio
># non-Vorbis content: OGM
>>>28		string		\x01video\0\0\0	\b, OGM video
>>>>37		string/c	div3		(DivX 3)
>>>>37		string/c	divx		(DivX 4)
>>>>37		string/c	dx50		(DivX 5)
>>>>37		string/c	xvid		(XviD)
># --- First vorbis packet - general header ---
>>>28		string		\x01vorbis	\b, Vorbis audio,
>>>>35		lelong		!0		UNKNOWN VERSION %lu,
>##>>>35		lelong		0		version 0,
>>>>35		lelong		0
>>>>>39		ubyte		1		mono,
>>>>>39		ubyte		2		stereo,
>>>>>39		ubyte		>2		%u channels,
>>>>>40		lelong		x		%lu Hz
># Minimal, nominal and maximal bitrates specified when encoding
>>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	\b,
># The above tests if at least one of these is specified:
>>>>>>52		lelong		!-1
># Vorbis RC2 has a bug which puts -1000 in the min/max bitrate fields
># instead of -1.
># Vorbis 1.0 uses 0 instead of -1.
>>>>>>>52	lelong		!0
>>>>>>>>52	lelong		!-1000
>>>>>>>>>52	lelong		x		<%lu
>>>>>>48		lelong		!-1
>>>>>>>48	lelong		x		~%lu
>>>>>>44		lelong		!-1
>>>>>>>44	lelong		!-1000
>>>>>>>>44	lelong		!0
>>>>>>>>>44	lelong		x		>%lu
>>>>>>48		string		<\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff	bps
># -- Second vorbis header packet - the comments
># A kludge to read the vendor string.  It's a counted string, not a
># zero-terminated one, so file(1) can't read it in a generic way.
># libVorbis is the only one existing currently, so I detect specifically
># it.  The interesting value is the cvs date (8 digits decimal).
># Post-RC1 Ogg files have the second header packet (and thus the version)
># in a different place, so we must use an indirect offset.
>>>>(84.b+85)		string		\x03vorbis
>>>>>(84.b+96)		string/c	Xiphophorus\ libVorbis\ I	\b, created by: Xiphophorus libVorbis I
>>>>>>(84.b+120)		string		>00000000	
># Map to beta version numbers:
>>>>>>>(84.b+120)	string		<20000508	(<beta1, prepublic)
>>>>>>>(84.b+120)	string		20000508	(1.0 beta 1 or beta 2)
>>>>>>>(84.b+120)	string		>20000508
>>>>>>>>(84.b+120)	string		<20001031	(beta2-3)
>>>>>>>(84.b+120)	string		20001031	(1.0 beta 3)
>>>>>>>(84.b+120)	string		>20001031
>>>>>>>>(84.b+120)	string		<20010225	(beta3-4)
>>>>>>>(84.b+120)	string		20010225	(1.0 beta 4)
>>>>>>>(84.b+120)	string		>20010225
>>>>>>>>(84.b+120)	string		<20010615	(beta4-RC1)
>>>>>>>(84.b+120)	string		20010615	(1.0 RC1)
>>>>>>>(84.b+120)	string		20010813	(1.0 RC2)
>>>>>>>(84.b+120)	string		20010816	(RC2 - Garf tuned v1)
>>>>>>>(84.b+120)	string		20011014	(RC2 - Garf tuned v2)
>>>>>>>(84.b+120)	string		20011217	(1.0 RC3)
>>>>>>>(84.b+120)	string		20011231	(1.0 RC3)
># Some pre-1.0 CVS snapshots still had "Xiphphorus"...
>>>>>>>(84.b+120)	string		>20011231	(pre-1.0 CVS)
># For the 1.0 release, Xiphophorus is replaced by Xiph.Org
>>>>>(84.b+96)		string/c	Xiph.Org\ libVorbis\ I	\b, created by: Xiph.Org libVorbis I
>>>>>>(84.b+117)		string		>00000000	
>>>>>>>(84.b+117)	string		<20020717	(pre-1.0 CVS)
>>>>>>>(84.b+117)	string		20020717	(1.0)
>>>>>>>(84.b+117)	string		20030909	(1.0.1)
>>>>>>>(84.b+117)	string		20040629	(1.1.0 RC1)
>
>#------------------------------------------------------------------------------
># VXL: file(1) magic for VXL binary IO data files
>#
># from Ian Scott <scottim@sf.net>
>#
># VXL is a collection of C++ libraries for Computer Vision.
># See the vsl chapter in the VXL Book for more info
># http://www.isbe.man.ac.uk/public_vxl_doc/books/vxl/book.html
># http:/vxl.sf.net
>
>2	lelong	0x472b2c4e	VXL data file,
>>0	leshort	>0		schema version no %d
>
>#------------------------------------------------------------------------------
># wordprocessors:  file(1) magic fo word processors.
>#
>####### PWP file format used on Smith Corona Personal Word Processors:
>2	string	\040\040\040\040\040\040\040\040\040\040\040ML4D\040\'92	Smith Corona PWP
>>24	byte	2	\b, single spaced
>>24	byte	3	\b, 1.5 spaced
>>24	byte	4	\b, double spaced
>>25	byte	0x42	\b, letter
>>25	byte	0x54	\b, legal
>>26	byte	0x46	\b, A4
>
>#WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
>0	string	\377WPC\020\000\000\000\022\012\001\001\000\000\000\000	(WP) loadable text
>>15	byte	0	Optimized for Intel
>>15	byte	1	Optimized for Non-Intel
>1	string	WPC	(Corel/WP)
>>8	short	257	WordPerfect macro
>>8	short	258	WordPerfect help file
>>8	short	259	WordPerfect keyboard file
>>8	short	266	WordPerfect document
>>8	short	267	WordPerfect dictionary
>>8	short	268	WordPerfect thesaurus
>>8	short	269	WordPerfect block
>>8	short	270	WordPerfect rectangular block
>>8	short	271	WordPerfect column block
>>8	short	272	WordPerfect printer data
>>8	short	275	WordPerfect printer data
>>8	short	276	WordPerfect driver resource data
>>8	short	279	WordPerfect hyphenation code
>>8	short	280	WordPerfect hyphenation data
>>8	short	281	WordPerfect macro resource data
>>8	short	283	WordPerfect hyphenation lex
>>8	short	285	WordPerfect wordlist
>>8	short	286	WordPerfect equation resource data
>>8	short	289	WordPerfect spell rules
>>8	short	290	WordPerfect dictionary rules
>>8	short	295	WordPerfect spell rules (Microlytics)
>>8	short	299	WordPerfect settings file
>>8	short	301	WordPerfect 4.2 document
>>8	short	325	WordPerfect dialog file
>>8	short	332	WordPerfect button bar
>>8	short	513	Shell macro
>>8	short	522	Shell definition
>>8	short	769	Notebook macro
>>8	short	770	Notebook help file
>>8	short	771	Notebook keyboard file
>>8	short	778	Notebook definition
>>8	short	1026	Calculator help file
>>8	short 	1538	Calendar help file
>>8	short 	1546	Calendar data file
>>8	short	1793	Editor macro
>>8	short	1794	Editor help file
>>8	short	1795	Editor keyboard file
>>8	short	1817	Editor macro resource file
>>8	short 	2049	Macro editor macro
>>8	short 	2050	Macro editor help file
>>8	short	2051	Macro editor keyboard file
>>8	short	2305	PlanPerfect macro
>>8	short	2306	PlanPerfect help file
>>8	short	2307	PlanPerfect keyboard file
>>8	short	2314	PlanPerfect worksheet
>>8	short	2319	PlanPerfect printer definition
>>8	short	2322	PlanPerfect graphic definition
>>8	short	2323	PlanPerfect data
>>8	short	2324	PlanPerfect temporary printer
>>8	short	2329	PlanPerfect macro resource data
>>8	byte	11	Mail
>>8	short	2818	help file
>>8	short	2821	distribution list
>>8	short	2826	out box
>>8	short	2827	in box
>>8	short	2836	users archived mailbox
>>8	short	2837	archived message database
>>8	short	2838	archived attachments
>>8	short	3083	Printer temporary file
>>8	short	3330	Scheduler help file
>>8	short	3338	Scheduler in file
>>8	short	3339	Scheduler out file
>>8	short	3594	GroupWise settings file
>>8	short	3601	GroupWise directory services
>>8	short	3627	GroupWise settings file
>>8	short	4362	Terminal resource data
>>8	short	4363	Terminal resource data
>>8	short	4395	Terminal resource data
>>8	short	4619	GUI loadable text
>>8	short	4620	graphics resource data
>>8	short	4621	printer settings file
>>8	short	4622	port definition file
>>8	short	4623	print queue parameters
>>8	short	4624	compressed file
>>8	short	5130	Network service msg file
>>8	short	5131	Network service msg file
>>8	short	5132	Async gateway login msg
>>8	short	5134	GroupWise message file
>>8	short	7956	GroupWise admin domain database
>>8	short	7957	GroupWise admin host database
>>8	short	7959	GroupWise admin remote host database
>>8	short	7960	GroupWise admin ADS deferment data file
>>8	short	8458	IntelliTAG (SGML) compiled DTD
>>8	long	18219264	WordPerfect graphic image (1.0)
>>8	long	18219520	WordPerfect graphic image (2.0)
>#end of WordPerfect type files Version 1.6 - PLEASE DO NOT REMOVE THIS LINE
>
># Hangul (Korean) Word Processor File
>0	string	HWP\ Document\ File	Hangul (Korean) Word Processor File
>
># CosmicBook, from BenoÃ®t Rouits
>0       string  CSBK    Ted Neslson's CosmicBook hypertext file
>
>
>#------------------------------------------------------------------------------
># file(1) magic(5) data for xdelta  Josh MacDonald <jmacd@CS.Berkeley.EDU>
>#
>0	string	%XDELTA%	XDelta binary patch file 0.14
>0	string	%XDZ000%	XDelta binary patch file 0.18
>0	string	%XDZ001%	XDelta binary patch file 0.20
>0	string	%XDZ002%	XDelta binary patch file 1.0
>0	string	%XDZ003%	XDelta binary patch file 1.0.4
>0	string	%XDZ004%	XDelta binary patch file 1.1
>
>#------------------------------------------------------------------------------
># xenix:  file(1) magic for Microsoft Xenix
>#
># "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
># model" lifted from "magic.xenix", with comment "derived empirically;
># treat as folklore until proven"
>#
># "small model", "large model", "huge model" stuff lifted from XXX
>#
># XXX - "x.out" collides with PDP-11 archives
>#
>0	string		core		core file (Xenix)
>0	byte		0x80		8086 relocatable (Microsoft)
>0	leshort		0xff65		x.out
>>2	string		__.SYMDEF	 randomized
>>0	byte		x		archive
>0	leshort		0x206		Microsoft a.out
>>8	leshort		1		Middle model
>>0x1e	leshort		&0x10		overlay
>>0x1e	leshort		&0x2		separate
>>0x1e	leshort		&0x4		pure
>>0x1e	leshort		&0x800		segmented
>>0x1e	leshort		&0x400		standalone
>>0x1e	leshort		&0x8		fixed-stack
>>0x1c	byte		&0x80		byte-swapped
>>0x1c	byte		&0x40		word-swapped
>>0x10	lelong		>0		not-stripped
>>0x1e	leshort		^0xc000		pre-SysV
>>0x1e	leshort		&0x4000		V2.3
>>0x1e	leshort		&0x8000		V3.0
>>0x1c	byte		&0x4		86
>>0x1c	byte		&0xb		186
>>0x1c	byte		&0x9		286
>>0x1c	byte		&0xa		386
>>0x1f	byte		<0x040		small model
>>0x1f	byte		=0x048		large model	
>>0x1f	byte		=0x049		huge model 
>>0x1e	leshort		&0x1		executable
>>0x1e	leshort		^0x1		object file
>>0x1e	leshort		&0x40		Large Text
>>0x1e	leshort		&0x20		Large Data
>>0x1e	leshort		&0x120		Huge Objects Enabled
>>0x10	lelong		>0		not stripped
>
>0	leshort		0x140		old Microsoft 8086 x.out
>>0x3	byte		&0x4		separate
>>0x3	byte		&0x2		pure
>>0	byte		&0x1		executable
>>0	byte		^0x1		relocatable
>>0x14	lelong		>0		not stripped
>
>0	lelong		0x206		b.out
>>0x1e	leshort		&0x10		overlay
>>0x1e	leshort		&0x2		separate
>>0x1e	leshort		&0x4		pure
>>0x1e	leshort		&0x800		segmented
>>0x1e	leshort		&0x400		standalone
>>0x1e	leshort		&0x1		executable
>>0x1e	leshort		^0x1		object file
>>0x1e	leshort		&0x4000		V2.3
>>0x1e	leshort		&0x8000		V3.0
>>0x1c	byte		&0x4		86
>>0x1c	byte		&0xb		186
>>0x1c	byte		&0x9		286
>>0x1c	byte		&0x29		286
>>0x1c	byte		&0xa		386
>>0x1e	leshort		&0x4		Large Text
>>0x1e	leshort		&0x2		Large Data
>>0x1e	leshort		&0x102		Huge Objects Enabled
>
>0	leshort		0x580		XENIX 8086 relocatable or 80286 small model
>
>#------------------------------------------------------------------------------
># xo65 object files
># From: "Ullrich von Bassewitz" <uz@cc65.org>
>#
>0	string		\x55\x7A\x6E\x61	xo65 object,
>>4	leshort		x			version %d,
>>6	leshort&0x0001 =0x0001			with debug info
>>6	leshort&0x0001 =0x0000			no debug info
>
># xo65 library files
>0	string		\x6E\x61\x55\x7A	xo65 library,
>>4	leshort		x			version %d
>
># o65 object files
>0	string		\x01\x00\x6F\x36\x35	o65
>>6	leshort&0x1000	=0x0000			executable,
>>6	leshort&0x1000	=0x1000			object,
>>5	byte		x			version %d,
>>6	leshort&0x8000	=0x8000			65816,
>>6	leshort&0x8000	=0x0000			6502,
>>6	leshort&0x2000	=0x2000			32 bit,
>>6	leshort&0x2000	=0x0000			16 bit,
>>6	leshort&0x4000	=0x4000			page reloc,
>>6	leshort&0x4000	=0x0000			byte reloc,
>>6	leshort&0x0003	=0x0000			alignment 1
>>6	leshort&0x0003	=0x0001			alignment 2
>>6	leshort&0x0003	=0x0002			alignment 4
>>6	leshort&0x0003	=0x0003			alignment 256
>
>#------------------------------------------------------------------------------
># xwindows:  file(1) magic for various X/Window system file formats.
>
># Compiled X Keymap 
># XKM (compiled X keymap) files (including version and byte ordering)
>1	string	mkx				Compiled XKB Keymap: lsb,
>>0	byte	>0				version %d
>>0	byte	=0				obsolete
>0	string	xkm				Compiled XKB Keymap: msb,
>>3	byte	>0				version %d
>>0	byte	=0				obsolete
>
># xfsdump archive
>0	string	xFSdump0			xfsdump archive
>>8	long	x	(version %d)
>
># Jaleo XFS files
>0	long	395726				Jaleo XFS file
>>4	long	x				- version %ld
>>8	long	x				- [%ld -
>>20	long	x				%ldx
>>24	long	x				%ldx
>>28	long	1008				YUV422]
>>28	long	1000				RGB24]
>
>#------------------------------------------------------------------------------
># zilog:  file(1) magic for Zilog Z8000.
>#
># Was it big-endian or little-endian?  My Product Specification doesn't
># say.
>#
>0	long		0xe807		object file (z8000 a.out)
>0	long		0xe808		pure object file (z8000 a.out)
>0	long		0xe809		separate object file (z8000 a.out)
>0	long		0xe805		overlay object file (z8000 a.out)
>
>#------------------------------------------------------------------------------
># zyxel:  file(1) magic for ZyXEL modems
>#
># From <rob@pe1chl.ampr.org>
># These are the /etc/magic entries to decode datafiles as used for the
># ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
># ZyXEL-defined standard)
>
>0	string		ZyXEL\002	ZyXEL voice data
>>10	byte		0		- CELP encoding
>>10	byte&0x0B	1		- ADPCM2 encoding
>>10	byte&0x0B	2		- ADPCM3 encoding
>>10	byte&0x0B	3		- ADPCM4 encoding
>>10	byte&0x0B	8		- New ADPCM3 encoding
>>10	byte&0x04	4		with resync

Actions: View

Attachments on bug 106007: 47164