#! file
# Magic data for file(1) command.
# Machine-genererated from src/cmd/file/magdir/*; edit there only!
# Format is described in magic(files), where:
# files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID.

#------------------------------------------------------------------------------
# Localstuff:  file(1) magic for locally observed files
#
# $Id: Localstuff,v 1.2 1995/03/25 22:37:25 christos Exp $
# Add any locally observed files here.  Remember:
# text if readable, executable if runnable binary, data if unreadable.
#------------------------------------------------------------------------------
# mirage:  file(1) magic for NetBSD executables
#
# All new-style magic numbers are in network byte order.
#
0	lelong			000000413	386BSD demand paged executable
>16	lelong			>0		not stripped
0	lelong			000000314	BSDI demand paged executable
>16	lelong			>0		not stripped

0	lelong			000000407	NetBSD little-endian object file
>16	lelong			>0		not stripped
0	belong			000000407	NetBSD big-endian object file
>16	belong			>0		not stripped

0	belong&0377777777	041400413	NetBSD/i386 demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	041400410	NetBSD/i386 pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	041400407	NetBSD/i386
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	041400507	NetBSD/i386 core
>12	string			>\0		from '%s'

0	belong&0377777777	041600413	NetBSD/m68k demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	041600410	NetBSD/m68k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	041600407	NetBSD/m68k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	041600507	NetBSD/m68k core
>12	string			>\0		from '%s'

0	belong&0377777777	042000413	NetBSD/m68k4k demand paged
>0	byte			&0x80		
>>20	belong			<4096		shared library
>>20	belong			=4096		dynamically linked executable
>>20	belong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042000410	NetBSD/m68k4k pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042000407	NetBSD/m68k4k
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	042000507	NetBSD/m68k4k core
>12	string			>\0		from '%s'

0	belong&0377777777	042200413	NetBSD/ns32532 demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042200410	NetBSD/ns32532 pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042200407	NetBSD/ns32532
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	042200507	NetBSD/ns32532 core
>12	string			>\0		from '%s'

0	belong&0377777777	042400413	NetBSD/sparc demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042400410	NetBSD/sparc pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	042400407	NetBSD/sparc
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	042400507	NetBSD/sparc core
>12	string			>\0		from '%s'

0	belong&0377777777	042600413	NetBSD/pmax demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042600410	NetBSD/pmax pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	042600407	NetBSD/pmax
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	042600507	NetBSD/pmax core
>12	string			>\0		from '%s'

0	belong&0377777777	043000413	NetBSD/vax demand paged
>0	byte			&0x80		
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043000410	NetBSD/vax pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	lelong			>0		not stripped
0	belong&0377777777	043000407	NetBSD/vax
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	lelong			!0		executable
>>20	lelong			=0		object file
>16	lelong			>0		not stripped
0	belong&0377777777	043000507	NetBSD/vax core
>12	string			>\0		from '%s'

0	belong&0377777777	043400413	NetBSD/mips demand paged
>0	byte			&0x80		
>>20	belong			<8192		shared library
>>20	belong			=8192		dynamically linked executable
>>20	belong			>8192		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	043400410	NetBSD/mips pure
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80		executable
>16	belong			>0		not stripped
0	belong&0377777777	043400407	NetBSD/mips
>0	byte			&0x80		dynamically linked executable
>0	byte			^0x80
>>0	byte			&0x40		position independent
>>20	belong			!0		executable
>>20	belong			=0		object file
>16	belong			>0		not stripped
0	belong&0377777777	043400507	NetBSD/mips core
>12	string			>\0		from '%s'

#------------------------------------------------------------------------------
# alliant:  file(1) magic for Alliant FX series a.out files
#
# If the FX series is the one that had a processor with a 68K-derived
# instruction set, the "short" should probably become "beshort" and the
# "long" should probably become "belong".
# If it's the i860-based one, they should probably become either the
# big-endian or little-endian versions, depending on the mode they ran
# the 860 in....
#
0	short		0420		0420 Alliant virtual executable
>2	short		&0x0020		common library
>16	long		>0		not stripped
0	short		0421		0421 Alliant compact executable
>2	short		&0x0020		common library
>16	long		>0		not stripped

#------------------------------------------------------------------------------
# animation:  file(1) magic for animation/movie formats
#
# animation formats
# MPEG, FLI, DL originally from vax@ccwf.cc.utexas.edu (VaX#n8)
# FLC, SGI, Apple originally from Daniel Quinlan (quinlan@yggdrasil.com)

# MPEG animation format
0	string		\000\000\001\263	MPEG file

# FLI animation format
4	leshort		0xAF11			FLI file
>6	leshort		x			- %d frames,
>8	leshort		x			width=%d pixels,
>10	leshort		x			height=%d pixels,
>12	leshort		x			depth=%d,
>16	leshort		x			ticks/frame=%d
# newer FLI or FLC format
4	leshort		0xAF12			newer FLI or FLC file
>6	leshort		x			- %d frames
>8	leshort		x			width=%d pixels,
>10	leshort		x			height=%d pixels,
>12	leshort		x			depth=%d,
>16	leshort		x			ticks/frame=%d

# DL animation format
# XXX - collision with most `mips' magic
#
# I couldn't find a real magic number for these, however, this
# -appears- to work.  Note that it might catch other files, too, so be
# careful!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)!  The DL format is really bad.
#
#0	byte	1	DL version 1, medium format (160x100, 4 images/screen)
#>42	byte	x	- %d screens,
#>43	byte	x	%d commands
#0	byte	2	DL version 2
#>1	byte	1	- large format (320x200,1 image/screen),
#>1	byte	2	- medium format (160x100,4 images/screen),
#>1	byte	>2	- unknown format,
#>42	byte	x	%d screens,
#>43	byte	x	%d commands
# Based on empirical evidence, DL version 3 have several nulls following the
# \003.  Most of them start with non-null values at hex offset 0x34 or so.
#0	string	\3\0\0\0\0\0\0\0\0\0\0\0	DL version 3

# SGI and Apple formats
0	string		MOVI		Silicon Graphics movie file
4	string		moov		Apple QuickTime movie file (moov)
4	string		mdat		Apple QuickTime movie file (mdat)

#------------------------------------------------------------------------------
# apl:  file(1) magic for APL (see also "pdp" and "vax" for other APL
#       workspaces)
#
0	long		0100554		APL workspace (Ken's original?)

#------------------------------------------------------------------------------
# apple:  file(1) magic for Apple II file formats
#
0	string		FiLeStArTfIlEsTaRt	binscii (apple ][) text
0	string		\x0aGL			Binary II (apple ][) data
0	string		\x76\xff		Squeezed (apple ][) data
0	string		SIT!			StuffIt (macintosh) text
0	string		NuFile			NuFile archive (apple ][) data
0	string		N\xf5F\xe9l\xe5		NuFile archive (apple ][) data
#
# "ar", for all kinds of archives.
#
# XXX - why are there multiple <ar> thingies?  Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0	string		!<arch>		current ar archive
# 0	long		0x213c6172	archive file
#
# and for SVR3.1 archives, we have:
#
# 0	string		\<ar>		System V Release 1 ar archive
# 0	string		=<ar>		archive
# 0	string		=<ar>		archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0	string		!<arch>		current ar archive
>8	string		__.SYMDEF	random library
>0	belong		=65538		- pre SR9.5
>0	belong		=65539		- post SR9.5
>0	beshort		2		- object archive
>0	beshort		3		- shared library module
>0	beshort		4		- debug break-pointed module
>0	beshort		5		- absolute code program module
0	string		\<ar>		System V Release 1 ar archive
0	string		=<ar>		archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
# 0	long		0x3c61723e	VAX 5.0 archive
#
0	long		0x213c6172	archive file
0	lelong		0177555		very old VAX archive
0	leshort		0177555		very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0	lelong		0177545		old VAX archive
>8	string		__.SYMDEF	random library
0	leshort		0177545		old PDP-11 archive
>8	string		__.SYMDEF	random library
#
0	string		=<ar>		archive
#
# From "pdp":
#
0	lelong		0x39bed		PDP-11 old archive
0	lelong		0x39bee		PDP-11 4.0 archive
#
0	string		-h-		Software Tools format archive text
# "arc" archiver
0	byte		26		'arc' archive
>1	byte		0		(empty)
>1	byte		1		(old format)
# Rahul Dhesi's zoo archive format, from keith@cerberus.uchicago.edu.
20	long		0xdca7c4fd	Rahul Dhesi's "zoo" archive
# ZIP archiver
0	string		PK		zip archive file 
>2	byte		>0		- version [%d
>3	byte		>0		%d]

#------------------------------------------------------------------------------
# archive:  file(1) magic for archive formats (see also "msdos" for self-
#           extracting compressed archives)
#
# cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.
# pre-POSIX "tar" archives are handled in the C code.

# POSIX tar archives
257	string		ustar\0		POSIX tar archive
257	string		ustar\040\040\0	GNU tar archive

# cpio archives
#
# Yes, the top two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats and thus are strings, not numbers.
0	short		070707		cpio archive
0	short		0143561		byte-swapped cpio archive
0	string		070707		ASCII cpio archive (pre-SVR4 or odc)
0	string		070701		ASCII cpio archive (SVR4 with no CRC)
0	string		070702		ASCII cpio archive (SVR4 with CRC)

# other archives
0	long		0177555		very old archive
0	short		0177555		very old PDP-11 archive
0	long		0177545		old archive
0	short		0177545		old PDP-11 archive
0	long		0100554		apl workspace
0	string		=<ar>		archive

# MIPS archive (needs to go first)
#
0	string	!<arch>\n__________E	MIPS archive
>20	string	U			with MIPS Ucode members
>21	string	L			with MIPSEL members
>21	string	B			with MIPSEB members
>19	string	L			and an EL hash table
>19	string	B			and an EB hash table
>22	string	X			-- out of date

0	string		!<arch>		archive
>8	string		__.SYMDEF	random library
0	string		-h-		Software Tools format archive text

#
# XXX - why are there multiple <ar> thingies?  Note that 0x213c6172 is
# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:
#
# 0	string		!<arch>		current ar archive
# 0	long		0x213c6172	archive file
#
# and for SVR3.1 archives, we have:
#
# 0	string		\<ar>		System V Release 1 ar archive
# 0	string		=<ar>		archive
# 0	string		=<ar>		archive
#
# XXX - did Aegis really store shared libraries, breakpointed modules,
# and absolute code program modules in the same format as new-style
# "ar" archives?
#
0	string		!<arch>		current ar archive
>8	string		__.SYMDEF	random library
>0	belong		=65538		- pre SR9.5
>0	belong		=65539		- post SR9.5
>0	beshort		2		- object archive
>0	beshort		3		- shared library module
>0	beshort		4		- debug break-pointed module
>0	beshort		5		- absolute code program module
0	string		\<ar>		System V Release 1 ar archive
0	string		=<ar>		archive
#
# XXX - from "vax", which appears to collect a bunch of byte-swapped
# thingies, to help you recognize VAX files on big-endian machines;
# with "leshort", "lelong", and "string", that's no longer necessary....
#
0	belong		0x65ff0000	VAX 3.0 archive
0	belong		0x3c61723e	VAX 5.0 archive
#
0	long		0x213c6172	archive file
0	lelong		0177555		very old VAX archive
0	leshort		0177555		very old PDP-11 archive
#
# XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus
# be a random library (it said 0xff65 rather than 0177545).
#
0	lelong		0177545		old VAX archive
>8	string		__.SYMDEF	random library
0	leshort		0177545		old PDP-11 archive
>8	string		__.SYMDEF	random library
#
0	string		=<ar>		archive
#
# From "pdp":
#
0	lelong		0x39bed		PDP-11 old archive
0	lelong		0x39bee		PDP-11 4.0 archive
#
0	string		-h-		Software Tools format archive text

# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# The first byte is the magic (0x1a), byte 2 is the compression type for
# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS
# filename of the first file (null terminated).  Since some types collide
# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),
# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.
0	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW
0	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed
0	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed
0	lelong&0x8080ffff	0x0000031a	ARC archive data, packed
0	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed
0	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched

# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# I can't create either SPARK or ArcFS archives so I have not tested this stuff
# [GRR:  the original entries collide with ARC, above; replaced with combined
#  version (not tested)]
#0	byte		0x1a		RISC OS archive
#>1	string		archive		(ArcFS format)
0	string		\032archive	RISC OS archive (ArcFS format)

# ARJ archiver (jason@jarthur.Claremont.EDU)
0	leshort		0xea60		ARJ archive data
>5	byte		x		\b, v%d,
>8	byte		&0x04		multi-volume,
>8	byte		&0x10		slash-switched,
>8	byte		&0x20		backup,
>34	string		x		original name: %s,
>7	byte		0		os: MS-DOS
>7	byte		1		os: PRIMOS
>7	byte		2		os: Unix
>7	byte		3		os: Amiga
>7	byte		4		os: Macintosh
>7	byte		5		os: OS/2
>7	byte		6		os: Apple ][ GS
>7	byte		7		os: Atari ST
>7	byte		8		os: NeXT
>7	byte		9		os: VAX/VMS
>3	byte		>0		%d]

# HA archiver (Greg Roelofs, newt@uchicago.edu)
# This is a really bad format. A file containing HAWAII will match this...
#0	string		HA		HA archive data,
#>2	leshort		=1		1 file,
#>2	leshort		>1		%u files,
#>4	byte&0x0f	=0		first is type CPY
#>4	byte&0x0f	=1		first is type ASC
#>4	byte&0x0f	=2		first is type HSC
#>4	byte&0x0f	=0x0e		first is type DIR
#>4	byte&0x0f	=0x0f		first is type SPECIAL

# HPACK archiver (Peter Gutmann, pgut1@cs.aukuni.ac.nz)
0	string		HPAK		HPACK archive data

# JAM Archive volume format, by Dmitry.Kohmanyuk@UA.net
0	string		\351,\001JAM\		JAM archive,
>7	string		>\0			version %.4s
>0x26	byte		=0x27			-
>>0x2b	string          >\0			label %.11s,
>>0x27	lelong		x			serial %08x,
>>0x36	string		>\0			fstype %.8s

# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
2	string		-lh0-		LHarc 1.x archive data [lh0]
2	string		-lh1-		LHarc 1.x archive data [lh1]
2	string		-lz4-		LHarc 1.x archive data [lz4]
2	string		-lz5-		LHarc 1.x archive data [lz5]
#	[never seen any but the last; -lh4- reported in comp.compression:]
2	string		-lzs-		LHa 2.x? archive data [lzs]
2	string		-lh -		LHa 2.x? archive data [lh ]
2	string		-lhd-		LHa 2.x? archive data [lhd]
2	string		-lh2-		LHa 2.x? archive data [lh2]
2	string		-lh3-		LHa 2.x? archive data [lh3]
2	string		-lh4-		LHa (2.x) archive data [lh4]
2	string		-lh5-		LHa (2.x) archive data [lh5]
>20	byte		x		- header level %d

# RAR archiver (Greg Roelofs, newt@uchicago.edu)
0	string		Rar!		RAR archive data

# SQUISH archiver (Greg Roelofs, newt@uchicago.edu)
0	string		SQSH		squished archive data (Acorn RISCOS)

# UC2 archiver (Greg Roelofs, newt@uchicago.edu)
# I can't figure out the self-extracting form of these buggers...
0	string		UC2\x1a		UC2 archive data

# ZIP archives (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
0	string		PK\003\004	Zip archive data
>4	byte		0x09		\b, at least v0.9 to extract
>4	byte		0x0a		\b, at least v1.0 to extract
>4	byte		0x0b		\b, at least v1.1 to extract
>4	byte		0x14		\b, at least v2.0 to extract

# Zoo archiver
20	lelong		0xfdc4a7dc	Zoo archive data
>4	byte		>48		\b, v%c.
>>6	byte		>47		\b%c
>>>7	byte		>47		\b%c
>32	byte		>0		\b, modify: v%d
>>33	byte		x		\b.%d+
>42	lelong		0xfdc4a7dc	\b,
>>70	byte		>0		extract: v%d
>>>71	byte		x		\b.%d+

# Shell archives
10	string		#\ This\ is\ a\ shell\ archive	shell archive text

#------------------------------------------------------------------------------
# att3b:  file(1) magic for AT&T 3B machines
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
# 3B20
#
0	beshort		0550		3b20 COFF executable
>12	belong		>0		not stripped
#>22	beshort		>0		- version %ld
0	beshort		0551		3b20 COFF executable (TV)
>12	belong		>0		not stripped
#>22	beshort		>0		- version %ld
#
# WE32K
#
0	beshort		0560		WE32000 COFF
>18	beshort		^00000020	object
>18	beshort		&00000020	executable
>12	belong		>0		not stripped
>18	beshort		^00010000	N/A on 3b2/300 w/paging
>18	beshort		&00020000	32100 required
>18	beshort		&00040000	and MAU hardware required
>20	beshort		0407		(impure)
>20	beshort		0410		(pure)
>20	beshort		0413		(demand paged)
>20	beshort		0443		(target shared library)
>22	beshort		>0		- version %ld
0	beshort		0561		WE32000 COFF executable (TV)
>12	belong		>0		not stripped
#>18	beshort		&00020000	- 32100 required
#>18	beshort		&00040000	and MAU hardware required
#>22	beshort		>0		- version %ld
#
# core file for 3b2 
0	string		\000\004\036\212\200	3b2 core file
>364	string		>\0		of '%s'

#------------------------------------------------------------------------------
# audio:  file(1) magic for sound formats
#
# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),
# and others
#

# Sun/NeXT audio data
0	string		.snd		Sun/NeXT audio data:
>12	belong		1		8-bit ISDN u-law,
>12	belong		2		8-bit linear PCM [REF-PCM],
>12	belong		3		16-bit linear PCM,
>12	belong		4		24-bit linear PCM,
>12	belong		5		32-bit linear PCM,
>12	belong		6		32-bit IEEE floating point,
>12	belong		7		64-bit IEEE floating point,
>12	belong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>20	belong		1		mono,
>20	belong		2		stereo,
>20	belong		4		quad,
>16	belong		>0		%d Hz

# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
0	lelong		0x0064732E	DEC audio data:
>12	lelong		1		8-bit ISDN u-law,
>12	lelong		2		8-bit linear PCM [REF-PCM],
>12	lelong		3		16-bit linear PCM,
>12	lelong		4		24-bit linear PCM,
>12	lelong		5		32-bit linear PCM,
>12	lelong		6		32-bit IEEE floating point,
>12	lelong		7		64-bit IEEE floating point,
>12	lelong		23		8-bit ISDN u-law compressed (CCITT G.721 ADPCM voice data encoding),
>20	lelong		1		mono,
>20	lelong		2		stereo,
>20	lelong		4		quad,
>16	lelong		>0		%d Hz

# Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM"
8	string		AIFF		AIFF audio data
8	string		AIFC		AIFF-C audio data
8	string		8SVX		IFF/8SVX audio data

# Creative Labs AUDIO stuff
0	string	MThd			Standard MIDI data
>9 	byte	>0			(format %d)
>11	byte	>1			using %d channels
0	string	CTMF			Creative Music (CMF) data
0	string	SBI			SoundBlaster instrument data
0	string	Creative\ Voice\ File	Creative Labs voice data
# is this next line right?  it came this way...
>19	byte	0x1A
>23	byte	>0			- version %d
>22	byte	>0			\b.%d

# first entry is also the string "NTRK"
0	belong		0x4e54524b	MultiTrack sound data
>4	belong		x		- version %ld

# Microsoft WAVE format (*.wav)
# [GRR 950115:  probably all of the shorts and longs should be leshort/lelong]
0	string		RIFF		Microsoft RIFF
>8	string		WAVE		- WAVE format
>34	short		>0		%d bit
>22	short		=1		Mono
>22	short		=2		Stereo
>22	short		>2		%d Channels
>24	long		>0		%d Hz

# Extended MOD format (*.emd) (Greg Roelofs, newt@uchicago.edu); NOT TESTED
# [based on posting 940824 by "Dirk/Elastik", husberg@lehtori.cc.tut.fi]
0	string		EMOD		Extended MOD sound data,
>4	byte&0xf0	x		version %d
>4	byte&0x0f	x		\b.%d,
>45	byte		x		%d instruments
>83	byte		0		(module)
>83	byte		1		(song)

#------------------------------------------------------------------------------
# blit:  file(1) magic for 68K Blit stuff as seen from 680x0 machine
#
# Note that this 0407 conflicts with several other a.out formats...
#
# XXX - should this be redone with "be" and "le", so that it works on
# little-endian machines as well?  If so, what's the deal with
# "VAX-order" and "VAX-order2"?
#
#0	long		0407		68K Blit (standalone) executable
#0	short		0407		VAX-order2 68K Blit (standalone) executable
0	short		03401		VAX-order 68K Blit (standalone) executable
0	long		0406		68k Blit mpx/mux executable
0	short		0406		VAX-order2 68k Blit mpx/mux executable
0	short		03001		VAX-order 68k Blit mpx/mux executable
# Need more values for WE32 DMD executables.
# Note that 0520 is the same as COFF
#0	short		0520		tty630 layers executable
# BSDI BSD/386
0	long	0314	demand paged (first page unmapped) pure executable
>16	long	>0	not stripped

#------------------------------------------------------------------------------
# c-lang:  file(1) magic for C programs (or REXX)
#

# XPM icons (Greg Roelofs, newt@uchicago.edu)
# ideally should go into "images", but entries below would tag XPM as C source
0	string		/*\ XPM		X pixmap image data

# this first will upset you if you're a PL/1 shop...
# in which case rm it; ascmagic will catch real C programs
#0	string		/*		C or REXX program text
0	string		//		C++ program text

#------------------------------------------------------------------------------
# chi:  file(1) magic for ChiWriter files
#
0       string          \\1cw\          ChiWriter file
>5      string          >\0             version %s
0       string          \\1cw           ChiWriter file

#------------------------------------------------------------------------------
# clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
#
# XXX - what byte order does the Clipper use?
#
# XXX - what's the "!" stuff:
#
# >18	short		!074000,000000	C1 R1 
# >18	short		!074000,004000	C2 R1
# >18	short		!074000,010000	C3 R1
# >18	short		!074000,074000	TEST
#
# I shall assume it's ANDing the field with the first value and
# comparing it with the second, and rewrite it as:
#
# >18	short&074000	000000		C1 R1 
# >18	short&074000	004000		C2 R1
# >18	short&074000	010000		C3 R1
# >18	short&074000	074000		TEST
#
# as SVR3.1's "file" doesn't support anything of the "!074000,000000"
# sort, nor does SunOS 4.x, so either it's something Intergraph added
# in CLIX, or something AT&T added in SVR3.2 or later, or something
# somebody else thought was a good idea; it's not documented in the
# man page for this version of "magic", nor does it appear to be
# implemented (at least not after I blew off the bogus code to turn
# old-style "&"s into new-style "&"s, which just didn't work at all).
#
0	short		0575		CLIPPER COFF executable (VAX #)
>20	short		0407		(impure)
>20	short		0410		(5.2 compatible)
>20	short		0411		(pure)
>20	short		0413		(demand paged)
>20	short		0443		(target shared library)
>12	long		>0		not stripped
>22	short		>0		- version %ld
0	short		0577		CLIPPER COFF executable
>18	short&074000	000000		C1 R1 
>18	short&074000	004000		C2 R1
>18	short&074000	010000		C3 R1
>18	short&074000	074000		TEST
>20	short		0407		(impure)
>20	short		0410		(pure)
>20	short		0411		(separate I&D)
>20	short		0413		(paged)
>20	short		0443		(target shared library)
>12	long		>0		not stripped
>22	short		>0		- version %ld
>48	long&01		01		alignment trap enabled
>52	byte		1		-Ctnc
>52	byte		2		-Ctsw
>52	byte		3		-Ctpw
>52	byte		4		-Ctcb
>53	byte		1		-Cdnc
>53	byte		2		-Cdsw
>53	byte		3		-Cdpw
>53	byte		4		-Cdcb
>54	byte		1		-Csnc
>54	byte		2		-Cssw
>54	byte		3		-Cspw
>54	byte		4		-Cscb
4	string		pipe		CLIPPER instruction trace
4	string		prof		CLIPPER instruction profile

#------------------------------------------------------------------------------
# commands:  file(1) magic for various shells and interpreters
#
0	string		:\ shell archive or commands for antique kernel text
0	string		#!/bin/sh		Bourne Shell script text
0	string		#!\ /bin/sh		Bourne Shell script text
0	string		#!/bin/csh		C Shell script text
0	string		#!\ /bin/csh		C Shell script text
# korn shell magic, sent by George Wu, gwu@clyde.att.com
0	string		#!/bin/ksh		Korn Shell script text
0	string		#!\ /bin/ksh		Korn Shell script text
0	string	 	#!/bin/tcsh		Tenex C Shell script text
0	string	 	#!\ /bin/tcsh		Tenex C Shell script text
0	string		#!/usr/local/tcsh	Tenex C Shell script text
0	string	 	#!\ /usr/local/tcsh	Tenex C Shell script text
0	string		#!/usr/local/bin/tcsh	Tenex C Shell script text
0	string		#!\ /usr/local/bin/tcsh	Tenex C Shell script text
#
# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
0	string		#!/usr/local/bin/zsh	- Paul Falstad's zsh
0	string		#!\ /usr/local/bin/zsh	- Paul Falstad's zsh
0	string		#!/usr/local/bin/ash	- NeilBrown's ash
0	string		#!\ /usr/local/bin/ash	- NeilBrown's ash
0	string		#!/usr/local/bin/ae	- NeilBrown's ae
0	string		#!\ /usr/local/bin/ae	- NeilBrown's ae
0	string		#!/bin/nawk		- New Awk script text
0	string		#!\ /bin/nawk		- New Awk script text
0	string		#!/usr/bin/nawk		- New Awk script text
0	string		#!\ /usr/bin/nawk	- New Awk script text
0	string		#!/usr/local/bin/nawk	- New Awk script text
0	string		#!\ /usr/local/bin/nawk	- New Awk script text
0	string		#!/bin/gawk		- GNU awk script text
0	string		#!\ /bin/gawk		- GNU awk script text
0	string		#!/usr/bin/gawk		- GNU awk script text
0	string		#!\ /usr/bin/gawk	- GNU awk script text
0	string		#!/usr/local/bin/gawk	- GNU awk script text
0	string		#!\ /usr/local/bin/gawk	- GNU awk script text
#
0	string		#!/bin/awk		Awk Commands text
0	string		#!\ /bin/awk		Awk Commands text
0	string		#!/usr/bin/awk		Awk Commands text
0	string		#!\ /usr/bin/awk	Awk Commands text

# For Larry Wall's perl language.  The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
#				Keith Waclena <keith@cerberus.uchicago.edu>
0	string		#!/bin/perl			perl commands text
0	string		#!\ /bin/perl			perl commands text
0	string		eval\ "exec\ /bin/perl		perl commands text
0	string		#!/usr/bin/perl			perl commands text
0	string		#!\ /usr/bin/perl		perl commands text
0	string		eval\ "exec\ /usr/bin/perl	perl commands text
0	string		#!/usr/local/bin/perl		perl commands text
0	string		#!\ /usr/local/bin/perl		perl commands text
0	string		eval\ "exec\ /usr/local/bin/perl	perl commands text

# AT&T Bell Labs' Plan 9 shell
0	string		#!/bin/rc	Plan 9 rc Shell script text
0	string		#!\ /bin/rc	Plan 9 rc Shell script text

# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
0	string		#!/bin/bash	Bourne-Again Shell script text
0	string		#!\ /bin/bash	Bourne-Again Shell script text
0	string		#!/usr/local/bin/bash	Bourne-Again Shell script text
0	string		#!\ /usr/local/bin/bash	Bourne-Again Shell script text

# generic shell magic
0	string		#!\ /			a
>3	string		>\0			%s script text
0	string		#!/			a
>2	string		>\0			%s script text
0	string		#!\ 			commands text
>3	string		>\0			for %s

#------------------------------------------------------------------------------
# compress:  file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, whap, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.

# standard unix compress
0	string		\037\235	compress'd data
>2	byte&0x80	>0		block compressed
>2	byte&0x1f	x		%d bits

# gzip (GNU zip, not to be confused with [Info-ZIP/PKWARE] zip archiver)
0       string          \037\213        gzip compressed data
>2      byte            <8              - reserved method,
>2      byte            8               - deflate method,
>3	byte		&0x01		ascii,
>3	byte		&0x02		continuation,
>3	byte		&0x04		extra field,
>3	byte		&0x08		original file name,
>3	byte		&0x10		comment,
>3	byte		&0x20		encrypted,
>4	ledate		x		last modified: %s,
>8	byte		2		max compression,
>8	byte		4		max speed,
>9	byte		=0x00		os: MS-DOS
>9	byte		=0x01		os: Amiga
>9	byte		=0x02		os: VMS
>9	byte		=0x03		os: Unix
>9	byte		=0x05		os: Atari
>9	byte		=0x06		os: OS/2
>9	byte		=0x07		os: MacOS
>9	byte		=0x0A		os: Tops/20
>9	byte		=0x0B		os: Win/32

# According to gzip.h, this is the correct byte order for packed data.
#
0	string		\037\036	packed data
>2	belong		>1		%d characters originally
>2	belong		=1		%d character originally
#
# This magic number is byte-order-independent.
# Are there two types of old packed data?  One big endian, one little endian?
#
#0	beshort		017437		old packed data, big endian
#0	leshort		017437		old packed data, little endian
0	short		017437		old packed data

# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#
0	short		0x1fff		compacted data
0	string		\377\037	compacted data
0	short		0145405		huf output

# Squeeze and Crunch...
# These numbers were gleaned from the Unix versions of the programs to
# handle these formats.  Note that I can only uncrunch, not crunch, and
# I didn't have a crunched file handy, so the crunch number is untested.
#				Keith Waclena <keith@cerberus.uchicago.edu>
0	leshort		0x76FF		squeezed data (CP/M, DOS)
0	leshort		0x76FE		crunched data (CP/M, DOS)

# Freeze
0	string		\037\237	Frozen file 2.1
0	string		\037\236	Frozen file 1.0 (or gzip 0.5)

# lzh?
0	string		\037\240	LZH compressed data

# European GSM 06.10 is a provisional standard for full-rate speech
# transcoding, prI-ETS 300 036, which uses RPE/LTP (residual pulse
# excitation/long term prediction) coding at 13 kbit/s.
#
# WEAK - There's only a magic nibble (4 bits); but that nibble repeats
# every 33 bytes.  This magic is NOT suited for use, but maybe we can
# use it someday.
#
# This will cause very short GSM files to be declared as data and
# mismatches to be declared as data too!
#0	byte&0xF0	0xd0	data
#>33	byte&0xF0	0xd0
#>66	byte&0xF0	0xd0
#>99	byte&0xF0	0xd0
#>132	byte&0xF0	0xd0	GSM 06.10 compressed audio

#------------------------------------------------------------------------------
# convex:  file(1) magic for Convex boxes
#
# Convexes are big-endian.
#
0	long		0513		Convex executable
#
# Yes, the two "cpio archive" formats *are* supposed to just be "short".
# The idea is to indicate archives produced on machines with the same
# byte order as the machine running "file" with "cpio archive", and
# to indicate archives produced on machines with the opposite byte order
# from the machine running "file" with "byte-swapped cpio archive".
#
# The SVR4 "cpio(4)" hints that there are additional formats, but they
# are defined as "short"s; I think all the new formats are
# character-header formats, and thus are strings not numbers.
#
0	short		070707		cpio archive
0	short		0143561		byte-swapped cpio archive
0	string		070707		ASCII cpio archive (pre-SVR4 or odc)
0	string		070701		ASCII cpio archive (SVR4 with no CRC)
0	string		070702		ASCII cpio archive (SVR4 with CRC)

#------------------------------------------------------------------------------
# database:  file(1) magic for various databases
#
# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)
#
0	long		0x13579ace	GNU gdbm or ndbm database
#
0	belong	0x061561	Berkeley DB Hash file
>4	belong	>0		(Version %d,
>8	belong	1234		Little Endian,
>8	belong	4321		Big Endian,
>12	belong	x		Bucket Size %d,
>16	belong	x		Directory Size %d,
>20	belong	x		Segment Size %d,
>24	belong	x		Segment Shift %d,
>28	belong	x		Overflow Point %d,
>32	belong	x		Last Freed %d,
>36	belong	x		Max Bucket %d,
>40	belong	x		High Mask 0x%x,
>44	belong	x		Low Mask 0x%x,
>48	belong	x		Fill Factor %d,
>52	belong	x		Number of Keys %d)
#
0	belong	0x053162	Berkeley DB Btree file
>4	belong	>0		(Version %d,
>8	belong	x		Page Size %d,
>12	belong	x		Free Page %d,
>16	belong	x		Number of Records %d,
>20	belong	x		Flags 0x%x)

#------------------------------------------------------------------------------
# diamond:  file(1) magic for Diamond system
#
# ... diamond is a multi-media mail and electronic conferencing system....
#
# XXX - I think it was either renamed Slate, or replaced by Slate....
#
#	The full deal is too long...
#0	string	<list>\n<protocol\ bbn-multimedia-format>	Diamond Multimedia Document
0	string	=<list>\n<protocol\ bbn-m	Diamond Multimedia Document

#------------------------------------------------------------------------------
# diff:  file(1) magic for diff(1) output
#
0	string		diff\ 	'diff' output text
0	string		***\ 		'diff' output text
0	string		Only\ in\ 	'diff' output text
0	string		Common\ subdirectories:\ 	'diff' output text
# Magic numbers for ditroff intermediate language
0	string		x\ T\ cat	titroff output for the C/A/T text
0	string		x\ T\ ps	titroff output for PostScript
0	string		x\ T 		titroff output text

#------------------------------------------------------------------------------
# dos:  file(1) magic for MS-DOS files (formerly "ms-dos")
#
# These must come before the Linux/i386 entries, with the exception of
# Linux LILO images.
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
# this can be overridden by the DOS executable (COM) entry
# XXX - this was moved from "linux"
2	string		LILO		LILO boot/chain loader
#
# .EXE formats (Greg Roelofs, newt@uchicago.edu)
# [GRR:  some company sells a self-extractor/displayer for image data(!)]
#
0	string	MZ		MS-DOS executable (EXE)
>24	string	@		(OS/2 or Windows format)
>1638	string	-lh5-		(LHa SFX archive v2.13S)
>7195	string	Rar!		(RAR self-extracting archive)
#
# [GRR 950118:  file 3.15 has a buffer-size limitation; offsets bigger than
#   8161 bytes are ignored.  To make the following entries work, increase
#   HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
#   NT/Win32 and VMS.]
#
>13297	string	PK\003\004	(PKZIP SFX archive v1.93a)
>15770	string	PK\003\004	(PKZIP SFX archive v2.04g)
# these are the DOS versions:
>25115	string	PK\003\004	(Info-ZIP SFX archive v5.12)
>26331	string	PK\003\004	(Info-ZIP SFX archive v5.12 w/decryption)
# these are the OS/2 versions (OS/2 is flagged above):
>47031	string	PK\003\004	(Info-ZIP SFX archive v5.12)
>49845	string	PK\003\004	(Info-ZIP SFX archive v5.12 w/decryption)
# this is the NT/Win32 version:
>69120	string	PK\003\004	(Info-ZIP NT SFX archive v5.12 w/decryption)

# miscellaneous formats
0	string		LZ		MS-DOS executable (built-in)
0	byte		0xe9		MS-DOS executable (COM)
0	byte		0xeb		MS-DOS executable (COM)
0	byte		0xf0		MS-DOS program library

#------------------------------------------------------------------------------
# dump:  file(1) magic for dump file format--for new and old dump filesystems
#
# We specify both byte orders in order to recognize byte-swapped dumps.
#
24	belong	60012		new-fs dump file (big endian),
>4	bedate	x		Previous dump %s,
>8	bedate	x		This dump %s,
>12	belong	>0		Volume %ld,
>692	belong	0		Level zero, type:
>692	belong	>0		Level %d, type:
>0	belong	1		tape header,
>0	belong	2		beginning of file record,
>0	belong	3		map of inodes on tape,
>0	belong	4		continuation of file record,
>0	belong	5		end of volume,
>0	belong	6		map of inodes deleted,
>0	belong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	belong	>0		Flags %x

24	belong	60011		old-fs dump file (big endian),
#>4	bedate	x		Previous dump %s,
#>8	bedate	x		This dump %s,
>12	belong	>0		Volume %ld,
>692	belong	0		Level zero, type:
>692	belong	>0		Level %d, type:
>0	belong	1		tape header,
>0	belong	2		beginning of file record,
>0	belong	3		map of inodes on tape,
>0	belong	4		continuation of file record,
>0	belong	5		end of volume,
>0	belong	6		map of inodes deleted,
>0	belong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	belong	>0		Flags %x

24	lelong	60012		new-fs dump file (little endian),
>4	ledate	x		Previous dump %s,
>8	ledate	x		This dump %s,
>12	lelong	>0		Volume %ld,
>692	lelong	0		Level zero, type:
>692	lelong	>0		Level %d, type:
>0	lelong	1		tape header,
>0	lelong	2		beginning of file record,
>0	lelong	3		map of inodes on tape,
>0	lelong	4		continuation of file record,
>0	lelong	5		end of volume,
>0	lelong	6		map of inodes deleted,
>0	lelong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	lelong	>0		Flags %x

24	lelong	60011		old-fs dump file (little endian),
#>4	ledate	x		Previous dump %s,
#>8	ledate	x		This dump %s,
>12	lelong	>0		Volume %ld,
>692	lelong	0		Level zero, type:
>692	lelong	>0		Level %d, type:
>0	lelong	1		tape header,
>0	lelong	2		beginning of file record,
>0	lelong	3		map of inodes on tape,
>0	lelong	4		continuation of file record,
>0	lelong	5		end of volume,
>0	lelong	6		map of inodes deleted,
>0	lelong	7		end of medium (for floppy),
>676	string	>\0		Label %s,
>696	string	>\0		Filesystem %s,
>760	string	>\0		Device %s,
>824	string	>\0		Host %s,
>888	lelong	>0		Flags %x

#------------------------------------------------------------------------------
# elf:  file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\177ELF		ELF
>4	byte		0		invalid class
>4	byte		1		32-bit
>4	byte		2		64-bit
>5	byte		0		invalid byte order
>5	byte		1		LSB
>>16	leshort		0		no file type,
>>16	leshort		1		relocatable,
>>16	leshort		2		executable,
>>16	leshort		3		shared object,
>>16	leshort		4		core file,
>>16	leshort		&0xff00		processor-specific,
>>18	leshort		0		no machine,
>>18	leshort		1		AT&T WE32100,
>>18	leshort		2		SPARC - invalid byte order,
>>18	leshort		3		Intel 80386,
>>18	leshort		4		Motorola 68000 - invalid byte order,
>>18	leshort		5		Motorola 88000 - invalid byte order,
>>18	leshort		6		Intel 80486,
>>18	leshort		7		Intel 80860,
>>18	leshort		8		MIPS RS3000,
>>20	lelong		0		invalid version
>>20	lelong		1		version 1
>>36	lelong		1		MathCoPro/FPU/MAU Required
>5	byte		2		MSB
>>16	beshort		0		no file type,
>>16	beshort		1		relocatable,
>>16	beshort		2		executable,
>>16	beshort		3		shared object,
>>16	beshort		4		core file,
>>16	beshort		&0xff00		processor-specific,
>>18	beshort		0		no machine,
>>18	beshort		1		AT&T WE32100,
>>18	beshort		2		SPARC,
>>18	beshort		3		Intel 80386 - invalid byte order,
>>18	beshort		4		Motorola 68000,
>>18	beshort		5		Motorola 88000,
>>18	beshort		6		Intel 80486 - invalid byte order,
>>18	beshort		7		Intel 80860,
>>18	beshort		8		MIPS RS3000,
>>20	belong		0		invalid version
>>20	belong		1		version 1
>>36	belong		1		MathCoPro/FPU/MAU Required

#------------------------------------------------------------------------------
# encore:  file(1) magic for Encore machines
#
# XXX - needs to have the byte order specified (NS32K was little-endian,
# dunno whether they run the 88K in little-endian mode or not).
#
0	short		0x154		Encore
>20	short		0x107		executable
>20	short		0x108		pure executable
>20	short		0x10b		demand-paged executable
>20	short		0x10f		unsupported executable
>12	long		>0		not stripped
>22	short		>0		- version %ld
>22	short		0		-
#>4	date		x		stamp %s
0	short		0x155		Encore unsupported executable
>12	long		>0		not stripped
>22	short		>0		- version %ld
>22	short		0		-
#>4	date		x		stamp %s

#------------------------------------------------------------------------------
# filesystems:  file(1) magic for different filesystems
#
0x438	leshort	0xEF53			Linux/i386 ext2 filesystem
0	string	\366\366\366\366	PC formatted floppy with no filesystem

#------------------------------------------------------------------------------
# floppy.raw:  file(1) magic for raw floppies (whose format?)
#
0	string	\366\366\366\366	Formatted floppy w/ no filesystem data

#------------------------------------------------------------------------------
# fonts:  file(1) magic for font data
#
0	string		FONT		ASCII vfont text
0	short		0436		Berkeley vfont data
0	short		017001		byte-swapped Berkeley vfont data

# PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com
0	string		%!PS-AdobeFont-1.0	PostScript Type 1 font text
>20	string		>\0		(%s)
6	string		%!PS-AdobeFont-1.0	PostScript Type 1 font program data

# X11 font files in SNF (Server Natural Format) format
0	belong		00000004		X11 big-endian SNF font
0	lelong		00000004		X11 little-endian SNF font

# X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com)
# PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
# (0x7063601 is "PCF" + \001 as a lelong)
0	lelong		0x70636601		X11 Portable Compiled Font data
0	string		D1.0\015		X11 Speedo font data

#------------------------------------------------------------------------------
# frame:  file(1) magic for FrameMaker files
#
# This stuff came on a FrameMaker demo tape, most of which is
# copyright, but this file is "published" as witness the following:
#
0	string		\<MakerFile	FrameMaker document
>11	string		4.0		 (4.0
>11	string		3.0		 (3.0
>11	string		2.0		 (2.0
>11	string		1.0		 (1.0
>14	byte		x		  %c)
0	string		\<MIFFile	FrameMaker MIF (ASCII) file
>9	string		4.0		 (4.0)
>9	string		3.0		 (3.0)
>9	string		2.0		 (2.0)
>9	string		1.0		 (1.x)
0	string		\<MakerDictionary	FrameMaker Dictionary text
>17	string		3.0		 (3.0)
>17	string		2.0		 (2.0)
>17	string		1.0		 (1.x)
0	string		\<MakerScreenFon	FrameMaker Font file
>17	string		1.01		 (%s)
0	string		\<MML		FrameMaker MML file
0	string		\<Book		FrameMaker Book file
>10	string		3.0		 (3.0
>10	string		2.0		 (2.0
>10	string		1.0		 (1.0
>13	byte		x		  %c)
0	string		\<Maker Intermediate Print File	FrameMaker IPL file

#------------------------------------------------------------------------------
# hp:  file(1) magic for Hewlett Packard machines (see also "printer")
#
# XXX - somebody should figure out whether any byte order needs to be
# applied to the "TML" stuff; I'm assuming the Apollo stuff is
# big-endian as it was mostly 68K-based.
#
# HP-PA is big-endian, so it (and "800", which is *also* HP-PA-based; I
# assume "HPPA-RISC1.1" really means "HP-PA Version 1.1", which first
# showed up in the 700 series, although later 800 series machines are,
# I think, based on the PA7100 which implements HP-PA 1.1) are flagged
# as big-endian.
#
# I think the 500 series was the old stack-based machines, running a
# UNIX environment atop the "SUN kernel"; dunno whether it was
# big-endian or little-endian.
#
# Daniel Quinlan (quinlan@yggdrasil.com): hp200 machines are 68010 based;
# hp300 are 68020+68881 based; hp400 are also 68k.  The following basic
# HP magic is useful for reference, but using "long" magic is a better
# practice in order to avoid collisions.
#
# 0	beshort		200		hp200 (68010) BSD binary
# 0	beshort		300		hp300 (68020+68881) BSD binary
# 0	beshort		0x20c		hp200/300 HP-UX binary
# 0	beshort		0x20b		hp800 HP-UX binary

#
# The "misc" stuff needs a byte order; the archives look suspiciously
# like the old 177545 archives (0xff65 = 0177545).
#
#### Old Apollo stuff
0	beshort		0627		Apollo m68k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0	beshort		0624		apollo a88k COFF executable
>18	beshort		^040000		not stripped
>22	beshort		>0		- version %ld
0       long            01203604016     TML 0123 byte-order format
0       long            01702407010     TML 1032 byte-order format
0       long            01003405017     TML 2301 byte-order format
0       long            01602007412     TML 3210 byte-order format
#### HPPA
0	belong 		0x02100106	HPPA-RISC1.1 relocatable object
0	belong 		0x02100107	HPPA-RISC1.1 executable
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		-not stripped

0	belong 		0x02100108	HPPA-RISC1.1 shared executable
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		-not stripped

0	belong 		0x0210010b	HPPA-RISC1.1 demand-load executable
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		-not stripped

0	belong 		0x0210010e	HPPA-RISC1.1 shared library
>96	belong		>0		-not stripped

0	belong 		0x0210010d	HPPA-RISC1.1 dynamic load library
>96	belong		>0		-not stripped

#### 800
0	belong 		0x020b0106	HP s800 relocatable object

0	belong 		0x020b0107	HP s800 executable
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		-not stripped

0	belong 		0x020b0108	HP s800 shared executable
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		-not stripped

0	belong 		0x020b010b	HP s800 demand-load executable
>(144)	belong		0x054ef630	dynamically linked
>96	belong		>0		-not stripped

0	belong 		0x020b010e	HP s800 shared library
>96	belong		>0		-not stripped

0	belong 		0x020b010d	HP s800 dynamic load library
>96	belong		>0		-not stripped

0	belong		0x213c6172	archive file
>68	belong 		0x020b0619	-HP s800 relocatable library

#### 500
0	long		0x02080106	HP s500 relocatable executable
>16	long		>0		-version %ld

0	long		0x02080107	HP s500 executable
>16	long		>0		-version %ld

0	long		0x02080108	HP s500 pure executable
>16	long		>0		-version %ld

#### 200
0	belong 		0x020c0108	HP s200 pure executable
>4	beshort		>0		-version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0107	HP s200 executable
>4	beshort		>0		-version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c010b	HP s200 demand-load executable
>4	beshort		>0		-version %ld
>8	belong		&0x80000000	save fp regs
>8	belong		&0x40000000	dynamically linked
>8	belong		&0x20000000	debuggable
>36	belong		>0		not stripped

0	belong		0x020c0106	HP s200 relocatable executable
>4	beshort		>0		-version %ld
>6	beshort		>0		-highwater %d
>8	belong		&0x80000000	save fp regs
>8	belong		&0x20000000	debuggable
>8	belong		&0x10000000	PIC

0	belong 		0x020a0108	HP s200 (2.x release) pure executable
>4	beshort		>0		-version %ld
>36	belong		>0		not stripped

0	belong		0x020a0107	HP s200 (2.x release) executable
>4	beshort		>0		-version %ld
>36	belong		>0		not stripped

0	belong		0x020c010e	HP s200 shared library
>4	beshort		>0		-version %ld
>6	beshort		>0		-highwater %d
>36	belong		>0		not stripped

0	belong		0x020c010d	HP s200 dynamic load library
>4	beshort		>0		-version %ld
>6	beshort		>0		-highwater %d
>36	belong		>0		not stripped

#### MISC
0	long		0x0000ff65	HP old archive
0	long		0x020aff65	HP s200 old archive
0	long		0x020cff65	HP s200 old archive
0	long		0x0208ff65	HP s500 old archive

0	long		0x015821a6	HP core file

0	long		0x4da7eee8	HP-WINDOWS font
>8	byte		>0		-version %ld
0	string		Bitmapfile	HP Bitmapfile

0	string		IMGfile	CIS 	compimg HP Bitmapfile
# XXX - see "lif"
0	short		0x8000		lif file
0	long		0x020c010c	compiled Lisp

0	string		msgcat01	HP NLS message catalog,
>8	long		>0		%d messages

# addendum to /etc/magic with HP-48sx file-types by phk@data.fls.dk 1jan92
0	string		HPHP48-		HP48 binary
>7	byte		>0		- Rev %c
>8	short		0x1129		(ADR)
>8	short		0x3329		(REAL)
>8	short		0x5529		(LREAL)
>8	short		0x7729		(COMPLX)
>8	short		0x9d29		(LCOMPLX)
>8	short		0xbf29		(CHAR)
>8	short		0xe829		(ARRAY)
>8	short		0x0a2a		(LNKARRAY)
>8	short		0x2c2a		(STRING)
>8	short		0x4e2a		(HXS)
>8	short		0x742a		(LIST)
>8	short		0x962a		(DIR)
>8	short		0xb82a		(ALG)
>8	short		0xda2a		(UNIT)
>8	short		0xfc2a		(TAGGED)
>8	short		0x1e2b		(GROB)
>8	short		0x402b		(LIB)
>8	short		0x622b		(BACKUP)
>8	short		0x882b		(LIBDATA)
>8	short		0x9d2d		(PROG)
>8	short		0xcc2d		(CODE)
>8	short		0x482e		(GNAME)
>8	short		0x6d2e		(LNAME)
>8	short		0x922e		(XLIB)
0	string		%%HP:		HP48 text
>6	string		T(0)		- T(0)
>6	string		T(1)		- T(1)
>6	string		T(2)		- T(2)
>6	string		T(3)		- T(3)
>10	string		A(D)		A(D)
>10	string		A(R)		A(R)
>10	string		A(G)		A(G)
>14	string		F(.)		F(.);
>14	string		F(,)		F(,);

# hpBSD magic numbers
0	beshort		200		hp200 (68010) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary
0	beshort		300		hp300 (68020+68881) BSD
>2	beshort		0407		impure binary
>2	beshort		0410		read-only binary
>2	beshort		0413		demand paged binary


#------------------------------------------------------------------------------
# html:  file(1) magic for HTML (HyperText Markup Language) docs
#
# from Daniel Quinlan <quinlan@yggdrasil.com>
#
0	string		\<HEAD		HTML document text (old type)
0	string		\<head		HTML document text (old type)
0	string		\<TITLE		HTML document text (old type)
0	string		\<title		HTML document text (old type)
0       string          \<html          HTML document text
0       string          \<HTML          HTML document text
0	string		\<!		HTML document text
0	string		\<h1		Untitled HTML document text
0	string		\<H1		Untitled HTML document text

#------------------------------------------------------------------------------
# ibm370:  file(1) magic for IBM 370 and compatibles.
#
# "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
# What the heck *is* "USS/370"?
#
0       beshort		0531		SVR2 executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24     belong		>0		- version %ld
0	beshort		0534		SVR2 pure executable (Amdahl-UTS)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0530		SVR2 pure executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld
0	beshort		0535		SVR2 executable (USS/370)
>12	belong		>0		not stripped
>24	belong		>0		- version %ld


#------------------------------------------------------------------------------
# ibm6000:  file(1) magic for RS/6000 and the RT PC.
#
0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
>12	belong		>0		not stripped
# Breaks sun4 statically linked execs.
#0      beshort		0x0103		executable (RT Version 2) or obj module
#>2	byte		0x50		pure
#>28	belong		>0		not stripped
#>6	beshort		>0		- version %ld
0	beshort		0x0104		shared library
0	beshort		0x0105		ctab data
0	beshort		0xfe04		structured file
0	string		0xabcdef	message catalog
#0	string		<aiaff>		archive
# image file format
# From Robert Potter, potter@cs.rochester.edu
0	string		Imagefile\ version-	iff image data
# this adds the whole header (inc. version number), informative but longish
>10	string		>\0		%s
# Tell file about magic for IMAGEN printer-ready files:
0	string	@document(		Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10	string	language\ impress	(imPRESS data)
>10	string	language\ daisy		(daisywheel text)
>10	string	language\ diablo		(daisywheel text)
>10	string	language\ printer	(line printer emulation)
>10	string	language\ tektronix	(Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
#
# Now magic for IMAGEN font files...
0	string		Rast		RST-format raster font data
>45	string		>0		face %

#------------------------------------------------------------------------------
# images:  file(1) magic for image formats (see also "c-lang" for XPM bitmaps)
#
# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
# additions by janl@ifi.uio.no as well as others. Jan also suggested
# merging several one- and two-line files into here.
#
# XXX - byte order for GIF and TIFF fields?
# [GRR:  TIFF allows both byte orders; GIF is little-endian]
#

# [GRR:  what the hell is this doing in here?]
0	string		xbtoa		btoa'd file

# PBMPLUS
0	string		P1		PBM file
0	string		P2		PGM file
0	string		P3		PPM file
0	string		P4		PBM "rawbits" file
0	string		P5		PGM "rawbits" file
0	string		P6		PPM "rawbits" file

# NIFF (Navy Interchange File Format, a modification of TIFF) images
# this *must* go before TIFF
0	string		IIN1		NIFF raster data

# TIFF images
0	string		MM		TIFF file, big-endian
>2	beshort		>0		- version %d
0	string		II		TIFF file, little-endian
>2	leshort		>0		- version %d

# PNG [Portable Network Graphics, or "PNG's Not GIF"] images
# (Greg Roelofs, newt@uchicago.edu)
#
# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
#
0	string		\x89PNG		PNG image,
>4	belong		!0x0d0a1a0a	CORRUPTED,
>16	belong		x		%ld x
>20	belong		x		%ld,
>24	byte		x		%d-bit
>25	byte		0		grayscale,
>25	byte		2		\b/color RGB,
>25	byte		3		colormap,
>25	byte		4		gray+alpha,
>25	byte		6		\b/color RGBA,
#>26	byte		0		deflate/32K,
>28	byte		0		non-interlaced
>28	byte		1		interlaced

# GIF
0	string		GIF		GIF image
>3	string		87a		- version %s,
>3	string		89a		- version %s,
>6	leshort		>0		%hd x
>8	leshort		>0		%hd,
#>10	byte		&0x80		color mapped,
# GRR 950330:  the following is not accurate for most GIFs:
#>10	byte		&0x40		interlaced,
>10	byte&0x07	=0x00		2 colors
>10	byte&0x07	=0x01		4 colors
>10	byte&0x07	=0x02		8 colors
>10	byte&0x07	=0x03		16 colors
>10	byte&0x07	=0x04		32 colors
>10	byte&0x07	=0x05		64 colors
>10	byte&0x07	=0x06		128 colors
>10	byte&0x07	=0x07		256 colors

# Miscellany
0	long		1123028772	Artisan image file
>4	long		1	rectangular 24-bit image
>4	long		2	rectangular 8-bit image with colormap
>4	long		3	rectangular 32-bit image (24-bit with matte)
0	string		\361\0\100\273	CMU window manager bitmap
0	string		#FIG		FIG graphics savefile text
>6	string		2.1		Version 2.1
>6	string		2.0		Version 2.0
0	string		GKSM		GKS Metafile
8	string		ILBM		IFF ILBM file
0	string		ARF_BEGARF	PHIGS clear text archive

# More miscellany from Daniel Quinlan (quinlan@yggdrasil.com)
0	string	This\ is\ a\ BitMap\ file	Lisp Machine bit-array-file
0	string		!!			Bennet Yee's "face" format
0	string		@(#)SunPHIGS		SunPHIGS
# version number follows, in the form m.n
>40	string		SunBin			binary
>32	string		archive			archive
0	string		BEGMF		clear text Computer Graphics Metafile
# these should be beshort, but not sure
0	beshort&0xffe0	0x0020		binary Computer Graphics Metafile
0	beshort		0x3020		character Computer Graphics Metafile


# From: <u31b3hs@pool.informatik.rwth-aachen.de> (Michael Haardt)
0	string          yz      MGR bitmap, modern format, 8 bit aligned
0	string          zz      MGR bitmap, old format, 1 bit deep, 16 bit aligned
0	string          xz      MGR bitmap, old format, 1 bit deep, 32 bit aligned
0	string          yx      MGR bitmap, modern format, squeezed

0	string		%bitmap		FBM pixmap
>30	long		0x31		(mono)
>30	long		0x33		(color)

4	string		Research,	Digifax-G3-File
>29	byte		1		, fine resolution
>29	byte		0		, normal resolution

# JPEG images
0	beshort		0xffd8		JPEG image
>6	string		JFIF		- JFIF standard
# from cameron@cs.unsw.oz.au (Cameron Simpson):
0	string		hsi1		JPEG image - HSI encoded (proprietary)

# PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
0	string		BM		bitmap
>14	byte		12		(OS/2 1.x format)
>14	byte		64		(OS/2 2.x format)
>14	byte		40		(Windows 3.x format)
0	string		IC		icon
0	string		PI		pointer
0	string		CI		color icon
0	string		CP		color pointer
0	string		BA		bitmap array

# Utah Raster Toolkit RLE images (two versions)
#
# From <janl@ifi.uio.no>
# I made this with the help of the man page for rle(5). Ihey missing
# from the magic numbers I have:
0	beshort		0xcc52		Utah Raster Toolkit RLE
>2	beshort		>0		lower left corner: %d
>4	beshort		>0		lower right corner: %d
>6	beshort		>0		%d x
>8	beshort		>0		%d
>10	byte&0x1	=0x1		CLEARFIRST
>10	byte&0x2	=0x2		NO_BACKGROUND
>10	byte&0x4	=0x4		ALPHA
>10	byte&0x8	=0x8		COMMENT
>11	byte		>0		%d colour channels
>12	byte		>0		%d bits per pixel
>13	byte		>0		%d colour map channels
#
# RLE images (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)
# Here's a magic file entry for rle images. 24-bit images tend to produce
# foo.rle size 42x42, 3 comps each 8 bits
# (for arbitary, prossibly different values of 42).
# freely redistribuable under the GPL
# [GRR:  which endianness?  big?]
0	short		0xcc55		RLE image data
>6	short		>0		%d x
>8	short		>0		%d,
>2	short		>0		x offset by %d,
>4	short		>0		y offset by %d,
>11	byte		=0		colour map
>11	byte		>1		%d comps each
>12	byte		=1		1 bit
>12	byte		>1		%d bits

# FBM images, culled from xli source (d. p. simpleton, m91dps@ecs.ox.ac.uk)
0       string          %bitmap         fbm image data

# image file format (Robert Potter, potter@cs.rochester.edu)
0	string		Imagefile\ version-	iff image data
# this adds the whole header (inc. version number), informative but longish
>10	string		>\0		%s

# Sun rasterfiles, from Daniel Quinlan (quinlan@yggdrasil.com)
#
# XXX - Does the Sun 386i use the same byte order?
#
0	belong		0x59a66a95	Sun raster image
>4	belong		>0		%d x
>8	belong		>0		%d,
>12	belong		>0		%d-bit,
# this is almost the same as the file length (what about compressed?)
#>16	belong		>0		%d bytes long,
>20	belong		0		old format,
# no need to complain if it is standard
#>20	belong		1		standard,
>20	belong		2		compressed,
>20	belong		3		RGB,
>20	belong		4		TIFF,
>20	belong		5		IFF,
>20	belong		0xffff		reserved for testing,
>24	belong		0		no colormap
>24	belong		1		RGB colormap
>24	belong		2		raw colormap
# this doesn't impart much useful information (or does it?)
#>28	belong		>0		colormap is %d bytes long

# Daniel Quinlan (quinlan@yggdrasil.com) -- from an SGI machine
# There may be a byte swapped version of SGI imagelib images, but
# I haven't seen any evidence of programs that support it.
0	beshort		000732		SGI imagelib image
>6	beshort		x		\b, %d x
>8	beshort		x		%d
#
0	string		IT01		FIT image file
>4	belong		x		\b, %d x
>8	belong		x		%d x
>12	belong		x		%d
#
0	string		IT02		FIT image file
>4	belong		x		\b, %d x
>8	belong		x		%d x
>12	belong		x		%d
#
2048	string		PCD_IPI		Kodak Photo CD image pack file
0	string		PCD_OPA		Kodak Photo CD overview pack file

# Jeff Uphoff <juphoff@tarsier.cv.nrao.edu>
# FITS is the Flexible Image Transport System, the de facto standard for
# data and image transfer, storage, etc., for the astronomical community.
# FITS format.
0	string	SIMPLE\ \ =	FITS
>107	string	-32		32 bits per pixel, IEEE big endian float
>107	string	\ 32		32 bits per pixel, unsigned integer
>108	string	16		16 bits per pixel, unsigned integer
>109	string	8		8 bits per pixel, unsigned integer

#------------------------------------------------------------------------------
# intel:  file(1) magic for x86 Unix
#
# Various flavors of x86 UNIX executable/object (other than Xenix, which
# is in "microsoft").  DOS is in "ms-dos"; the ambitious soul can do
# Windows as well.
#
# Windows NT belongs elsewhere, as you need x86 and MIPS and Alpha and
# whatever comes next (HP-PA Hummingbird?).  OS/2 may also go elsewhere
# as well, if, as, and when IBM makes it portable.
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0	leshort		0502		basic-16 executable
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		0503		basic-16 executable (TV)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		0510		x86 executable
>12	lelong		>0		not stripped
0	leshort		0511		x86 executable (TV)
>12	lelong		>0		not stripped
0	leshort		=0512		iAPX 286 executable small model (COFF)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
0	leshort		=0522		iAPX 286 executable large model (COFF)
>12	lelong		>0		not stripped
#>22	leshort		>0		- version %ld
# SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
0	leshort		=0514		80386 COFF executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld

#------------------------------------------------------------------------------
# interleaf:  file(1) magic for InterLeaf TPS:
#
0	string		=\210OPS	Interleaf saved data
0	string		=<!OPS		Interleaf document text
>5	string		,\ Version\ 	(version
>>14	string		>\0		%s)
#
# magic.iris: Magic for mips from an iris4d
#
# Dunno what byte-order munging is needed; all of SGI's *current*
# machines and OSes run in big-endian mode on the MIPS machines,
# as far as I know, but they do have the MIPSEB and MIPSEL stuff
# here....
#
0	short		0x0160		mipseb
>20	short		0407		executable
>20	short		0410		pure
>20	short		0413		demand paged
>8	long		>0		not stripped
>8	long		0		stripped
>22	byte		>0		- version %ld.
>23	byte		>0		%ld
0	short		0x0162		mipsel
>20	short		0407		executable
>20	short		0410		pure
>20	short		0413		demand paged
>8	long		>0		not stripped
>8	long		0		stripped
>23	byte		>0		- version %ld.
>22	byte		>0		%ld
0	short		0x6001		swapped mipseb
>20	short		03401		executable
>20	short		04001		pure
>20	short		05401		demand paged
>8	long		>0		not stripped
>8	long		0		stripped
>22	byte		>0		- version %ld.
>23	byte		>0		%ld
0	short		0x6201		swapped mipsel
>20	short		03401		executable
>20	short		04001		pure
>20	short		05401		demand paged
>8	long		>0		not stripped
>8	long		0		stripped
>22	byte		>0		- version %ld.
>23	byte		>0		%ld
0	short		0x180		mipseb ucode
0	short		0x182		mipsel ucode
#
# IRIX core format version 1 (from /usr/include/core.out.h)
0	long		0xdeadadb0	IRIX core dump
>4	long		1		of
>16	string		>\0		'%s'
#
# Archives - This handles archive subtypes
#
0	string		!<arch>\n__________E	MIPS archive
>20	string		U			with mipsucode members
>21	string		L			with mipsel members
>21	string		B			with mipseb members
>19	string		L			and a EL hash table
>19	string		B			and a EB hash table
>22	string		X			-- out of date

#------------------------------------------------------------------------------
# ispell:  file(1) magic for ispell
#
# Ispell 3.0 has a magic of 0x9601 and ispell 3.1 has 0x9602.  This magic
# will match 0x9600 through 0x9603 in *both* little endian and big endian.
# (No other current magic entries collide.)
#
# Updated by Daniel Quinlan (quinlan@yggdrasil.com)
#
0	leshort&0xFFFC	0x9600		little endian ispell
>0	byte		0		hash file (?),
>0	byte		1		3.0 hash file,
>0	byte		2		3.1 hash file,
>0	byte		3		hash file (?),
>2	leshort		0x00		8-bit, no capitalization, 26 flags
>2	leshort		0x01		7-bit, no capitalization, 26 flags
>2	leshort		0x02		8-bit, capitalization, 26 flags
>2	leshort		0x03		7-bit, capitalization, 26 flags
>2	leshort		0x04		8-bit, no capitalization, 52 flags
>2	leshort		0x05		7-bit, no capitalization, 52 flags
>2	leshort		0x06		8-bit, capitalization, 52 flags
>2	leshort		0x07		7-bit, capitalization, 52 flags
>2	leshort		0x08		8-bit, no capitalization, 128 flags
>2	leshort		0x09		7-bit, no capitalization, 128 flags
>2	leshort		0x0A		8-bit, capitalization, 128 flags
>2	leshort		0x0B		7-bit, capitalization, 128 flags
>2	leshort		0x0C		8-bit, no capitalization, 256 flags
>2	leshort		0x0D		7-bit, no capitalization, 256 flags
>2	leshort		0x0E		8-bit, capitalization, 256 flags
>2	leshort		0x0F		7-bit, capitalization, 256 flags
>4	leshort		>0		and %d string characters
0	beshort&0xFFFC	0x9600		big endian ispell
>1	byte		0		hash file (?),
>1	byte		1		3.0 hash file,
>1	byte		2		3.1 hash file,
>1	byte		3		hash file (?),
>2	beshort		0x00		8-bit, no capitalization, 26 flags
>2	beshort		0x01		7-bit, no capitalization, 26 flags
>2	beshort		0x02		8-bit, capitalization, 26 flags
>2	beshort		0x03		7-bit, capitalization, 26 flags
>2	beshort		0x04		8-bit, no capitalization, 52 flags
>2	beshort		0x05		7-bit, no capitalization, 52 flags
>2	beshort		0x06		8-bit, capitalization, 52 flags
>2	beshort		0x07		7-bit, capitalization, 52 flags
>2	beshort		0x08		8-bit, no capitalization, 128 flags
>2	beshort		0x09		7-bit, no capitalization, 128 flags
>2	beshort		0x0A		8-bit, capitalization, 128 flags
>2	beshort		0x0B		7-bit, capitalization, 128 flags
>2	beshort		0x0C		8-bit, no capitalization, 256 flags
>2	beshort		0x0D		7-bit, no capitalization, 256 flags
>2	beshort		0x0E		8-bit, capitalization, 256 flags
>2	beshort		0x0F		7-bit, capitalization, 256 flags
>4	beshort		>0		and %d string characters

#------------------------------------------------------------------------------
# karma:  file(1) magic for Karma data files
#
# From <rgooch@atnf.csiro.au>

0	string		KarmaRHD Version	Karma Data Structure Version
>16	long		x		%lu


#------------------------------------------------------------------------------
# lex:  file(1) magic for lex
#
#	derived empirically, your offsets may vary!
53	string		yyprevious	c program text (from lex)
>3	string		>\0		 for %s
# C program text from GNU flex, from Daniel Quinlan <quinlan@yggdrasil.com>
21	string		generated\ by\ flex	C program text (from flex)
# lex description file, from Daniel Quinlan <quinlan@yggdrasil.com>
0	string		%{		lex description text

#------------------------------------------------------------------------------
# lif:  file(1) magic for lif
#
# XXX - byte order?  (Probably beshort, Daniel Quinlan <quinlan@yggdrasil.com>)
#
0	short		0x8000		lif file

#------------------------------------------------------------------------------
# linux:  file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
# The following basic Linux magic is useful for reference, but using
# "long" magic is a better practice in order to avoid collisions.
#
# 2	leshort		100		Linux/i386
# >0	leshort		0407		impure executable (OMAGIC)
# >0	leshort		0410		pure executable (NMAGIC)
# >0	leshort		0413		demand-paged executable (ZMAGIC)
# >0	leshort		0314		demand-paged executable (QMAGIC)
#
0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
>16	lelong		0		- stripped
0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
>16	lelong		0		- stripped
0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
>16	lelong		0		- stripped
0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
>16	lelong		0		- stripped
#
0	string		\007\001\000	Linux/i386 object file
>20	lelong		>0x1020		- DLL library
# message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
0	string		*nazgul*	compiled message catalog
>8	lelong		>0		- version %ld
# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
216	lelong		0421		Linux/i386 core file
>220	string		>\0		of '%s'
>200	lelong		>0		(signal %d)
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
# this can be overridden by the DOS executable (COM) entry
2	string		LILO		Linux/i386 LILO boot/chain loader
#
# Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
0	string		0.9
>8	byte		0x0a		Debian Binary Package -
>>3	byte		>0		created by dpkg 0.9%c
>>4	byte		>0		pl%c
# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
0	leshort		0x0436		Linux/i386 PC Screen Font data
>2	byte		0		- 256 characters, no directory,
>2	byte		1		- 512 characters, no directory,
>2	byte		2		- 256 characters, Unicode directory,
>2	byte		3		- 512 characters, Unicode directory,
>3	byte		>0		8x%d
# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
4086	string		SWAP-SPACE	Linux/i386 swap file

#------------------------------------------------------------------------------
# lisp:  file(1) magic for lisp programs
#
# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string	;;			Lisp/Scheme program text
# Emacs 18 - this is always correct, but not very magical.
0	string	\012(			byte-compiled Emacs-Lisp program data
# Emacs 19
0	string	;ELC\023\000\000\000	byte-compiled Emacs-Lisp program data

#------------------------------------------------------------------------------
# magic:  file(1) magic for magic files
#
0	string		#\ Magic	magic text file for file(1) cmd

#------------------------------------------------------------------------------
# mail.news:  file(1) magic for mail and news
#
# Unfortunately, saved netnews also has From line added in some news software.
#0	string		From 		mail text
# There are tests to ascmagic.c to cope with mail and news.
0	string		Relay-Version: 	old news text
0	string		#!\ rnews	batched news text
0	string		N#!\ rnews	mailed, batched news text
0	string		Forward\ to 	mail forwarding text
0	string		Pipe\ to 	mail piping text
0	string		Return-Path:	smtp mail text
0	string		Path:		news text
0	string		Xref:		news text
0	string		From:		news or mail text
0	string		Article 	saved news text

#------------------------------------------------------------------------------
# microsoft:  file(1) magic for Microsoft Xenix
#
# "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small
# model" lifted from "magic.xenix", with comment "derived empirically;
# treat as folklore until proven"
#
# "small model", "large model", "huge model" stuff lifted from XXX
#
# XXX - "x.out" collides with PDP-11 archives
#
0	string		core		core file (Xenix)
0	byte		0x80		8086 relocatable (Microsoft)
0	leshort		0xff65		x.out
>2	string		__.SYMDEF	 randomized
>0	byte		x		archive
0	leshort		0x206		Microsoft a.out
>8	leshort		1		Middle model
>0x1e	leshort		&0x10		overlay
>0x1e	leshort		&0x2		separate
>0x1e	leshort		&0x4		pure
>0x1e	leshort		&0x800		segmented
>0x1e	leshort		&0x400		standalone
>0x1e	leshort		&0x8		fixed-stack
>0x1c	byte		&0x80		byte-swapped
>0x1c	byte		&0x40		word-swapped
>0x10	lelong		>0		not-stripped
>0x1e	leshort		^0xc000		pre-SysV
>0x1e	leshort		&0x4000		V2.3
>0x1e	leshort		&0x8000		V3.0
>0x1c	byte		&0x4		86
>0x1c	byte		&0xb		186
>0x1c	byte		&0x9		286
>0x1c	byte		&0xa		386
>0x1f	byte		<0x040		small model
>0x1f	byte		=0x048		large model	
>0x1f	byte		=0x049		huge model 
>0x1e	leshort		&0x1		executable
>0x1e	leshort		^0x1		object file
>0x1e	leshort		&0x40		Large Text
>0x1e	leshort		&0x20		Large Data
>0x1e	leshort		&0x120		Huge Objects Enabled
>0x10	lelong		>0		not stripped

0	leshort		0x140		old Microsoft 8086 x.out
>0x3	byte		&0x4		separate
>0x3	byte		&0x2		pure
>0	byte		&0x1		executable
>0	byte		^0x1		relocatable
>0x14	lelong		>0		not stripped

0	lelong		0x206		b.out
>0x1e	leshort		&0x10		overlay
>0x1e	leshort		&0x2		separate
>0x1e	leshort		&0x4		pure
>0x1e	leshort		&0x800		segmented
>0x1e	leshort		&0x400		standalone
>0x1e	leshort		&0x1		executable
>0x1e	leshort		^0x1		object file
>0x1e	leshort		&0x4000		V2.3
>0x1e	leshort		&0x8000		V3.0
>0x1c	byte		&0x4		86
>0x1c	byte		&0xb		186
>0x1c	byte		&0x9		286
>0x1c	byte		&0x29		286
>0x1c	byte		&0xa		386
>0x1e	leshort		&0x4		Large Text
>0x1e	leshort		&0x2		Large Data
>0x1e	leshort		&0x102		Huge Objects Enabled

0	leshort		0x580		XENIX 8086 relocatable or 80286 small model
#
# RISC MIPS decstation
# Should this be "leshort", given that DEC ran the DECstations in
# little-endian mode?
#
# Where is the non-SGI, non-DEC MIPS stuff?
#
0	short		0x6201		MIPS executable

#------------------------------------------------------------------------------
# mirage:  file(1) magic for Mirage executables
#
# XXX - byte order?
#
0	long	31415		Mirage Assembler m.out executable

#------------------------------------------------------------------------------
# mkid:  file(1) magic for mkid(1) databases
#
# ID is the binary tags database produced by mkid(1).
#
# XXX - byte order?
#
0	string		\311\304	ID tags data
>2	short		>0		version %d

#------------------------------------------------------------------------------
# mmdf:  file(1) magic for MMDF mail files
#
0	string	\001\001\001\001	MMDF mailbox

#------------------------------------------------------------------------------
# motorola:  file(1) magic for Motorola 68K and 88K binaries
#
# 68K
#
0	beshort		0520		mc68k COFF
>18	beshort		^00000020	object
>18	beshort		&00000020	executable
>12	belong		>0		not stripped
>168	string		.lowmem		Apple toolbox
>20	beshort		0407		(impure)
>20	beshort		0410		(pure)
>20	beshort		0413		(demand paged)
>20	beshort		0421		(standalone)
0	beshort		0521		mc68k executable (shared)
>12	belong		>0		not stripped
0	beshort		0522		mc68k executable (shared demand paged)
>12	belong		>0		not stripped
#
# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
#
0	beshort		0554		68K BCS executable
#
# 88K
#
# Motorola/88Open BCS
#
0	beshort		0555		88K BCS executable
#
# Various MS-DOS magic numbers
#
0	string		MZ		DOS executable (EXE)
0	string		LZ		DOS executable (built-in)
0	byte		0xe9		DOS executable (COM)
0	byte		0xeb		DOS executable (COM)
0	byte		0xf0		MS-DOS program library

#------------------------------------------------------------------------------
# msdos:  file(1) magic for MS-DOS files
#

# .EXE formats (Greg Roelofs, newt@uchicago.edu)
#
0	string	MZ		MS-DOS executable (EXE)
>24	string	@		\b, OS/2 or Windows
>1638	string	-lh5-		\b, LHa SFX archive v2.13S
>7195	string	Rar!		\b, RAR self-extracting archive
#
# [GRR 950118:  file 3.15 has a buffer-size limitation; offsets bigger than
#   8161 bytes are ignored.  To make the following entries work, increase
#   HOWMANY in file.h to 32K at least, and maybe to 70K or more for OS/2,
#   NT/Win32 and VMS.]
# [GRR:  some company sells a self-extractor/displayer for image data(!)]
#
>11696	string	PK\003\004	\b, PKZIP SFX archive v1.1
>13297	string	PK\003\004	\b, PKZIP SFX archive v1.93a
>15588	string	PK\003\004	\b, PKZIP2 SFX archive v1.09
>15770	string	PK\003\004	\b, PKZIP SFX archive v2.04g
>28374	string	PK\003\004	\b, PKZIP2 SFX archive v1.02
#
# Info-ZIP self-extractors
#    these are the DOS versions:
>25115	string	PK\003\004	\b, Info-ZIP SFX archive v5.12
>26331	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#    these are the OS/2 versions (OS/2 is flagged above):
>47031	string	PK\003\004	\b, Info-ZIP SFX archive v5.12
>49845	string	PK\003\004	\b, Info-ZIP SFX archive v5.12 w/decryption
#    this is the NT/Win32 version:
>69120	string	PK\003\004	\b, Info-ZIP NT SFX archive v5.12 w/decryption
#
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
>49801	string	\x79\xff\x80\xff\x76\xff	\b, CODEC archive v3.21
>>49824	leshort		=1			\b, 1 file
>>49824	leshort		>1			\b, %u files

# .COM formats (Daniel Quinlan, quinlan@yggdrasil.com)
# Uncommenting only the first two lines will cover about 2/3 of COM files,
# but it isn't feasible to match all COM files since there must be at least
# two dozen different one-byte "magics".
#0	byte		0xe9		MS-DOS executable (COM)
#0	byte		0x8c		MS-DOS executable (COM)
# 0xeb conflicts with "sequent" magic
#0	byte		0xeb		MS-DOS executable (COM)
#0	byte		0xb8		MS-DOS executable (COM)

# miscellaneous formats
0	string		LZ		MS-DOS executable (built-in)
#0	byte		0xf0		MS-DOS program library data
#

# Popular applications
2080	string	Microsoft\ Word\ 6.0\ Document	%s
#
0	belong	0x31be0000	Microsoft Word Document
#
2080	string	Microsoft\ Excel\ 5.0\ Worksheet	%s
#
0	belong	0x00001a00	Lotus 1-2-3
>4	belong	0x00100400	wk3 document
>4	belong	0x02100400	wk4 document
>4	belong	0x07800100	fm3 or fmb document
>4	belong	0x07800000	fm3 or fmb document
#
0	belong	0x00000200 	Lotus 1-2-3
>4	belong	0x06040600	wk1 document
>4	belong	0x06800200	fmt document

#------------------------------------------------------------------------------
# ncr:  file(1) magic for NCR Tower objects
#
# contributed by
# Michael R. Wayne  ***  TMC & Associates  ***  INTERNET: wayne@ford-vax.arpa
# uucp: {philabs | pyramid} !fmsrl7!wayne   OR   wayne@fmsrl7.UUCP
#
0	beshort		000610	Tower/XP rel 2 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000615	Tower/XP rel 2 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000620	Tower/XP rel 3 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000625	Tower/XP rel 3 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000630	Tower32/600/400 68020 object
>12	   belong		>0	not stripped
>20	   beshort		0407	executable
>20	   beshort		0410	pure executable
>22	   beshort		>0	- version %ld
0	beshort		000640	Tower32/800 68020
>18	   beshort		&020000	w/68881 object
>18	   beshort		&040000	compatible object
>18	   beshort		&~060000	object
>20	   beshort		0407	executable
>20	   beshort		0413	pure executable
>12	   belong		>0	not stripped
>22	   beshort		>0	- version %ld
0	beshort		000645	Tower32/800 68010
>18	   beshort		&040000	compatible object
>18	   beshort		&~060000 object
>20	   beshort		0407	executable
>20	   beshort		0413	pure executable
>12	   belong		>0	not stripped
>22	   beshort		>0	- version %ld

#------------------------------------------------------------------------------
# news:  file(1) magic for SunOS NeWS fonts (not "news" as in "netnews")
#
0	string		StartFontMetrics	ASCII font metrics
0	string		StartFont	ASCII font bits
0	belong		0x137A2944	NeWS bitmap font
0	belong		0x137A2947	NeWS font family
0	belong		0x137A2950	scalable OpenFont binary
0	belong		0x137A2951	encrypted scalable OpenFont binary
8	belong		0x137A2B45	X11/NeWS bitmap font
8	belong		0x137A2B48	X11/NeWS font family

#------------------------------------------------------------------------------
# pbm:  file(1) magic for Portable Bitmap files
#
# XXX - byte order?
#
0	short	0x2a17	"compact bitmap" format (Poskanzer)

#------------------------------------------------------------------------------
# pdp:  file(1) magic for PDP-11 executable/object and APL workspace
#
0	lelong		0101555		PDP-11 single precision APL workspace
0	lelong		0101554		PDP-11 double precision APL workspace
#
# PDP-11 a.out
#
0	leshort		0407		PDP-11 executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0401		PDP-11 UNIX/RT ldp
0	leshort		0405		PDP-11 old overlay

0	leshort		0410		PDP-11 pure executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0411		PDP-11 separate I&D executable
>8	leshort		>0		not stripped
>15	byte		>0		- version %ld

0	leshort		0437		PDP-11 kernel overlay

#------------------------------------------------------------------------------
# pgp:  file(1) magic for Pretty Good Privacy
#
0       beshort         0x9900                  pgp key public ring
0       beshort         0x9501                  pgp key security ring
0       beshort         0x9500                  pgp key security ring
0       string          -----BEGIN\040PGP       pgp armored data
>15     string          PUBLIC\040KEY\040BLOCK- public key blocK
>15     string          MESSAGE-                message
>15     string          SIGNED\040MESSAGE-      signed message
>15     string          PGP\040SIGNATURE-       signature

#------------------------------------------------------------------------------
# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
#
0       string          #\ PaCkAgE\ DaTaStReAm  pkg Datastream (SVR4)

#------------------------------------------------------------------------------
# plus5:  file(1) magic for Plus Five's UNIX MUMPS
#
# XXX - byte order?  Paging Hokey....
#
0	short		0x259		mumps avl global
>2	byte		>0		(V%d)
>6	byte		>0		with %d byte name
>7	byte		>0		and %d byte data cells
0	short		0x25a		mumps blt global
>2	byte		>0		(V%d)
>8	short		>0		- %d byte blocks
>15	byte		0x00		- P/D format
>15	byte		0x01		- P/K/D format
>15	byte		0x02		- K/D format
>15	byte		>0x02		- Bad Flags
#
# magic.postscript: Magic for postscript files
#
# XXX - should we match only versions 1.0 and 2.0, or should we wildcard
# it?
#
0	string		%!		PostScript text
>2	string	PS-Adobe-		conforming
>>11	string	1.0			at level %s
>>11	string	2.0			at level %s

#------------------------------------------------------------------------------
# printer:  file(1) magic for printer-formatted files
#

# PostScript, updated by Daniel Quinlan (quinlan@yggdrasil.com)
0	string		%!		PostScript document
>2	string		PS-Adobe-	conforming
>>11	string		>\0		at level %.3s
>>>15	string		EPS		- type %s
>>>15	string		Query		- type %s
>>>15	string		ExitServer	- type %s
# Some PCs have the annoying habit of adding a ^D as a document separator
0	string		\004%!		PostScript document
>3	string		PS-Adobe-	conforming
>>12	string		>\0		at level %.3s
>>>16	string		EPS		- type %s
>>>16	string		Query		- type %s
>>>16	string		ExitServer	- type %s

# HP Printer Job Language
0	string		\033%-12345X@PJL	HP Printer Job Language data

# HP Printer Control Language, Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\033E\033	HP PCL printer data
>3	string		\&l0A		- default page size
>3	string		\&l1A		- US executive page size
>3	string		\&l2A		- US letter page size
>3	string		\&l3A		- US legal page size
>3	string		\&l26A		- A4 page size
>3	string		\&l80A		- Monarch envelope size
>3	string		\&l81A		- No. 10 envelope size
>3	string		\&l90A		- Intl. DL envelope size
>3	string		\&l91A		- Intl. C5 envelope size
>3	string		\&l100A		- Intl. B5 envelope size
>3	string		\&l-81A		- No. 10 envelope size (landscape)
>3	string		\&l-90A		- Intl. DL envelope size (landscape)

# IMAGEN printer-ready files:
0	string	@document(		Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10	string	language\ impress	(imPRESS data)
>10	string	language\ daisy		(daisywheel text)
>10	string	language\ diablo	(daisywheel text)
>10	string	language\ printer	(line printer emulation)
>10	string	language\ tektronix	(Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
# [GRR 950115:  missing "postscript" or "ultrascript" (whatever it was called)]
#
# Now magic for IMAGEN font files...
0	string		Rast		RST-format raster font data
>45	string		>0		face %

#------------------------------------------------------------------------------
# psdbms:  file(1) magic for psdatabase
#
0	belong&0xff00ffff	0x56000000	ps database
>1	string	>\0	version %s
>4	string	>\0	from kernel %s

#------------------------------------------------------------------------------
# compress:  file(1) magic for Pyramids
#
# XXX - byte order?
#
0	long		0x50900107	Pyramid 90x family executable
0	long		0x50900108	Pyramid 90x family pure executable
>16	long		>0		not stripped
0	long		0x5090010b	Pyramid 90x family demand paged pure executable
>16	long		>0		not stripped
0	short		0
>6	short		>399		QNX %d
>10	short		>0		i%d executable
>42	long		>0		@ %#lx
0	string		dumpd		QNX dump file,
>10	string		>0		error %s,
>98	string		>0		machine %s,
>86	short		>0		node %d,
>236	short		<32767		user %d : 
>238	short		<32767		%d,
>322	string		>0		path %s,
>542	short		>0		at %x:
>538	long		>0		%lx
0	string		QNX		QNX ELF map file

#------------------------------------------------------------------------------
# rtf:	file(1) magic for Rich Text Format (RTF)
#
# Duncan P. Simpson, D.P.Simpson@dcs.warwick.ac.uk
#
0	string		{\\rtf		Rich Text Format data,
>5	byte		x		version %c,
>6	string		\\ansi		ANSI
>6	string		\\mac		Apple Macintosh
>6	string		\\pc		IBM PC code page 437
>6	string		\\pca		IBM PC code page 850

#------------------------------------------------------------------------------
# sc:  file(1) magic for "sc" spreadsheet
#
38	string		Spreadsheet	sc spreadsheet file

#------------------------------------------------------------------------------
# sccs:  file(1) magic for SCCS archives
#
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
# \001c date and time created 87/09/23 08:09:20 by ian
# \001e
# \001u
# \001U
# ... etc.
# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
# *Sigh*. And these both came from various parts of the USG.
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
# and we don't have regular expression matching yet. 
# Hence the following official kludge:
8	string		\001s\ 			SCCS archive.

#------------------------------------------------------------------------------
# sendmail:  file(1) magic for sendmail config files
#
# XXX - byte order?
#
0	byte	046	  Sendmail frozen configuration 
>16	string	>\0	  - version %s
0	short	0x271c	  Sendmail frozen configuration
>16	string	>\0	  - version %s

#------------------------------------------------------------------------------
# sequent:  file(1) magic for Sequent machines
#
# Sequent information updated by Don Dwiggins <atsun!dwiggins>.
# For Sequent's multiprocessor systems (incomplete).
0	lelong	0x00ea        	BALANCE NS32000 .o
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	lelong	0x10ea        	BALANCE NS32000 executable (0 @ 0)
>16	lelong  >0            	not stripped
>124	lelong	>0		version %ld
0	lelong	0x20ea        	BALANCE NS32000 executable (invalid @ 0)
>16	lelong  >0            	not stripped
>124	lelong	>0		version %ld
0	lelong	0x30ea        	BALANCE NS32000 standalone executable
>16	lelong  >0          	not stripped
>124	lelong	>0		version %ld
#
# Symmetry information added by Jason Merrill <jason@jarthur.claremont.edu>.
# Symmetry magic nums will not be reached if DOS COM comes before them;
# byte 0xeb is matched before these get a chance.
0	leshort	0x12eb		SYMMETRY i386 .o
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x22eb		SYMMETRY i386 executable (0 @ 0)
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x32eb		SYMMETRY i386 executable (invalid @ 0)
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld
0	leshort	0x42eb		SYMMETRY i386 standalone executable
>16	lelong	>0		not stripped
>124	lelong	>0		version %ld

#------------------------------------------------------------------------------
# sgi:  file(1) magic for Silicon Graphics (MIPS, IRIS, IRIX, etc.)
#
# all of SGI's *current* machines and OSes run in big-endian mode on the
# MIPS machines, as far as I know.
#
# XXX - what is the blank "-" line?
#
0	belong	0407		old SGI 68020 executable
0	belong	0410		old SGI 68020 pure executable
0	beshort	0x8765		disk quotas file
0	beshort	0x0506		IRIS Showcase file
>2	byte	0x49		-
>3	byte	x		- version %ld
0	beshort	0x0226		IRIS Showcase template
>2	byte	0x63		-
>3	byte	x		- version %ld
0	belong	0x5343464d	IRIS Showcase file
>4	byte	x		- version %ld
0	belong	0x5443464d	IRIS Showcase template
>4	byte	x		- version %ld
0	belong	0xdeadbabe	IRIX Parallel Arena
>8	belong	>0		- version %ld
#
0	beshort	0x0160		MIPSEB COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0162		MIPSEL COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %d
>22	byte	x		.%ld
#
0	beshort	0x6001		MIPSEB-LE COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %d
>23	byte	x		.%ld
#
0	beshort	0x6201		MIPSEL-LE COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
# MIPS 2 additions
#
0	beshort	0x0163		MIPSEB MIPS-II COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0166		MIPSEL MIPS-II COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x6301		MIPSEB-LE MIPS-II COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x6601		MIPSEL-LE MIPS-II COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>23	byte	x		.%ld
#
# MIPS 3 additions
#
0	beshort	0x0140		MIPSEB MIPS-III COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x0142		MIPSEL MIPS-III COFF executable
>20	beshort	0407		(impure)
>20	beshort	0410		(swapped)
>20	beshort	0413		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>22	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x4001		MIPSEB-LE MIPS-III COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x4201		MIPSEL-LE MIPS-III COFF executable
>20	beshort	03401		(impure)
>20	beshort	04001		(swapped)
>20	beshort	05401		(paged)
>8	belong	>0		not stripped
>8	belong	0		stripped
>23	byte	x		- version %ld
>23	byte	x		.%ld
#
0	beshort	0x180		MIPSEB Ucode
0	beshort	0x182		MIPSEL Ucode
# 32bit core file
0	belong	0xdeadadb0	IRIX core dump
>4	belong	1		of
>16	string	>\0		'%s'
# 64bit core file
0	belong	0xdeadad40	IRIX 64-bit core dump
>4	belong	1		of
>16	string	>\0		'%s'
# New style crash dump file
0	string	\x43\x72\x73\x68\x44\x75\x6d\x70	IRIX vmcore dump of
>36	string	>\0					'%s'
# Trusted IRIX info
0	string	SGIAUDIT	SGI Audit file
>8	byte	x		- version %d
>9	byte	x		.%ld
# Are these three SGI-based file types or general ones?
0	string	WNGZWZSC	Wingz compiled script
0	string	WNGZWZSS	Wingz spreadsheet
0	string	WNGZWZHP	Wingz help file
#
0	string	\#Inventor V	IRIS Inventor file
# XXX - I don't know what next thing is!  It is likely to be an image
# (or movie) format
0	string	glfHeadMagic();		GLF_TEXT
4	belong	0x41010000		GLF_BINARY_LSB_FIRST
4	belong	0x00000141		GLF_BINARY_MSB_FIRST

#------------------------------------------------------------------------------
# sgml:  file(1) magic for Standard(?) Generalized Mark-up Language
#
# $Id: sgml,v 1.3 1995/04/28 19:24:37 christos Exp $
# SGML goop, mostly from rph@sq.
0	string		\<!DOCTYPE	Exported SGML document
0	string		\<!doctype	Exported SGML document
0	string		\<!SUBDOC	Exported SGML subdocument
0	string		\<!subdoc	Exported SGML subdocument
0	string		\<!--		Exported SGML document

#------------------------------------------------------------------------------
# softquad:  file(1) magic for SoftQuad Publishing Software
#
# $Id: softquad,v 1.4 1995/04/28 19:24:38 christos Exp $
# Author/Editor and RulesBuilder
#
# XXX - byte order?
#
0	string		\<!SQ\ DTD>	Compiled SGML rules file
>9	string		>\0		 Type %s
0	string		\<!SQ\ A/E>	A/E SGML Document binary
>9	string		>\0		 Type %s
0	string		\<!SQ\ STS>	A/E SGML binary styles file
>9	string		>\0		 Type %s
0	short		0xc0de		Compiled PSI (v1) data
0	short		0xc0da		Compiled PSI (v2) data
>3	string		>\0		(%s)
# Binary sqtroff font/desc files...
0	short		0125252		SoftQuad DESC or font file binary
>2	short		>0		- version %d
# Bitmaps...
0	string		SQ\ BITMAP1	SoftQuad Raster Format text
#0	string		SQ\ BITMAP2	SoftQuad Raster Format data
# sqtroff intermediate language (replacement for ditroff int. lang.)
0	string		X\ 		SoftQuad troff Context intermediate
>2	string		495		for AT&T 495 laser printer
>2	string		hp		for Hewlett-Packard LaserJet
>2	string		impr		for IMAGEN imPRESS
>2	string		ps		for PostScript

#------------------------------------------------------------------------------
# sun:  file(1) magic for Sun machines
#
# Values for big-endian Sun (MC680x0, SPARC) binaries on pre-5.x
# releases.  (5.x uses ELF.)
#
0	belong&077777777	0600413		sparc demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0600410		sparc pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0600407		sparc
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

0	belong&077777777	0400413		mc68020 demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>16	belong		>0		not stripped
0	belong&077777777	0400410		mc68020 pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0400407		mc68020
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

0	belong&077777777	0200413		mc68010 demand paged
>0	byte		&0x80
>>20	belong		<4096		shared library
>>20	belong		=4096		dynamically linked executable
>>20	belong		>4096		dynamically linked executable
>16	belong		>0		not stripped
0	belong&077777777	0200410		mc68010 pure
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped
0	belong&077777777	0200407		mc68010
>0	byte		&0x80		dynamically linked executable
>0	byte		^0x80		executable
>16	belong		>0		not stripped

# reworked these to avoid anything beginning with zero becoming "old sun-2"
0	belong		0407		old sun-2 executable
>16	belong		>0		not stripped
0	belong		0410		old sun-2 pure executable
>16	belong		>0		not stripped
0	belong		0413		old sun-2 demand paged executable
>16	belong		>0		not stripped

#
# Core files.  "SPARC 4.x BCP" means "core file from a SunOS 4.x SPARC
# binary executed in compatibility mode under SunOS 5.x".
#
0	belong		0x080456	SunOS core file
>4	belong		432		(SPARC)
>>132	string		>\0		from '%s'
>>116	belong		=3		(quit)
>>116	belong		=4		(illegal instruction)
>>116	belong		=5		(trace trap)
>>116	belong		=6		(abort)
>>116	belong		=7		(emulator trap)
>>116	belong		=8		(arithmetic exception)
>>116	belong		=9		(kill)
>>116	belong		=10		(bus error)
>>116	belong		=11		(segmentation violation)
>>116	belong		=12		(bad argument to system call)
>>116	belong		=29		(resource lost)
>>120	belong		x		(T=%dK,
>>124	belong		x		D=%dK,
>>128	belong		x		S=%dK)
>4	belong		826		(68K)
>>128	string		>\0		from '%s'
>4	belong		456		(SPARC 4.x BCP)
>>152	string		>\0		from '%s'
#
# Sun rasterfiles
#
0	string	\x59\xa6\x6a\x95	rasterfile
>4	belong	x		%ld x
>8	belong	x		%ld x
>12	belong	x		%ld
>20	belong	0		old format image
>20	belong	1		standard format image
>20	belong	2		run-length byte encoded image
>20	belong	0xffff		experimental format image
>24	belong	1		with color map

#------------------------------------------------------------------------------
# terminfo:  file(1) magic for terminfo
#
# XXX - byte order for screen images?
#
0	string		\032\001	Compiled terminfo entry
0	short		0433		Curses screen image
0	short		0434		Curses screen image

#------------------------------------------------------------------------------
# tex:  file(1) magic for TeX files
#
# From <conklin@talisman.kaleida.com>

# Although we may know the offset of certain text fields in TeX DVI
# and font files, we can't use them reliably because they are not
# zero terminated. [but we do anyway, christos]
0	string		\367\002	TeX DVI file
>16	string		>\0		(%s)
0	string		\367\203	TeX generic font data
0	string		\367\131	TeX packed font data
>3	string		>\0		(%s)
0	string		\367\312	TeX virtual font data
0	string		This\ is\ TeX,	TeX transcript text
0	string		This\ is\ METAFONT,	METAFONT transcript text

# There is no way to detect TeX Font Metric (*.tfm) files without
# breaking them apart and reading the data.  The following patterns
# match most *.tfm files generated by METAFONT or afm2tfm.
2	string		\000\021	TeX font metric data
2	string		\000\022	TeX font metric data
>33	string		>\0		(%s)

# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\\input\ texinfo	Texinfo source text
0	string		This\ is\ Info\ file	GNU Info text

# TeX document additions from Daniel Quinlan, quinlan@yggdrasil.com
0	string		\\input		TeX or TeX-derivative document text
0	string		\\chapter	TeX or TeX-derivative document text
0	string		\\documentstyle	TeX or TeX-derivative document text
0	string		\\section	TeX or TeX-derivative document text
0	string		\\setlength	TeX or TeX-derivative document text

#------------------------------------------------------------------------------
# timezone:  file(1) magic for timezone data
#
# from Daniel Quinlan (quinlan@yggdrasil.com)
# this should work on Linux, SunOS, and maybe others
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0	timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0	timezone data
0	string  \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0	timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0	timezone data
0	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0	timezone data

#------------------------------------------------------------------------------
# troff:  file(1) magic for *roff
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)

# troff input
0	string		.\\"		troff or preprocessor input text
0	string		'\\"		troff or preprocessor input text
0	string		'.\\"		troff or preprocessor input text
0	string		\\"		troff or preprocessor input text

# ditroff intermediate output text
0	string		x\ T		ditroff text
>4	string		cat		for the C/A/T phototypesetter
>4	string		ps		for PostScript
>4	string		dvi		for DVI
>4	string		ascii		for ASCII
>4	string		lj4		for LaserJet 4
>4	string		latin1		for ISO 8859-1 (Latin 1)
>4	string		X75		for xditview at 75dpi
>>7	string		-12		(12pt)
>4	string		X100		for xditview at 100dpi
>>8	string		-12		(12pt)

# output data formats
0	string		\100\357	very old (C/A/T) troff output data

#------------------------------------------------------------------------------
# typeset:  file(1) magic for other typesetting
#
0	string		Interpress/Xerox	Xerox InterPress data
>16	string		/			(version
>>17	string		>\0			%s)

#------------------------------------------------------------------------------
# unknown:  file(1) magic for unknown machines
#
# XXX - this probably should be pruned, as it'll match PDP-11 and
# VAX image formats.
#
# 0x107 is 0407; 0x108 is 0410; both are PDP-11 (executable and pure,
# respectively).
#
# 0x109 is 0411; that's PDP-11 split I&D, but the PDP-11 version doesn't
# have the "version %ld", which may be a bogus COFFism (I don't think
# there ever was COFF for the PDP-11).
#
# 0x10B is 0413; that's VAX demand-paged, but this is a short, not a
# long, as it would be on a VAX.
#
# 0x10C is 0414, 0x10D is 0415, and 0x10E is 416; those *are* unknown.
#
0	short		0x107		unknown machine executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x108		unknown pure executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x109		PDP-11 separate I&D
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	short		0x10b		unknown pure executable
>8	short		>0		not stripped
>15	byte		>0		- version %ld
0	long		0x10c		unknown demand paged pure executable
>16	long		>0		not stripped
0	long		0x10d		unknown demand paged pure executable
>16	long		>0		not stripped
0	long		0x10e		unknown readable demand paged pure executable

#------------------------------------------------------------------------------
# uuencoded:  file(1) magic for ASCII-encoded files
#
0	string		begin 		uuencoded mail text
# Btoa(1) is an alternative to uuencode that requires less space.
0	string		xbtoa\ Begin	btoa'd text

#------------------------------------------------------------------------------
# varied.out:  file(1) magic for various USG systems
#
#	Herewith many of the object file formats used by USG systems.
#	Most have been moved to files for a particular processor,
#	and deleted if they duplicate other entries.
#
0	short		0610		Perkin-Elmer executable
# AMD 29K
0	beshort		0572		amd 29k coff noprebar executable
0	beshort		01572		amd 29k coff prebar executable
0	beshort		0160007		amd 29k coff archive
# Cray
6	beshort		0407		unicos (cray) executable


#------------------------------------------------------------------------------
# vax:  file(1) magic for VAX executable/object and APL workspace
#
0	lelong		0101557		VAX single precision APL workspace
0	lelong		0101556		VAX double precision APL workspace

#
# VAX a.out (32V, BSD)
#
0	lelong		0407		VAX executable
>16	lelong		>0		not stripped

0	lelong		0410		VAX pure executable
>16	lelong		>0		not stripped

0	lelong		0413		VAX demand paged pure executable
>16	lelong		>0		not stripped

0	lelong		0420		VAX demand paged (first page unmapped) pure executable
>16	lelong		>0		not stripped

#
# VAX COFF
#
# The `versions' should be un-commented if they work for you.
# (Was the problem just one of endianness?)
#
0	leshort		0570		VAX COFF executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld
0	leshort		0575		VAX COFF pure executable
>12	lelong		>0		not stripped
>22	leshort		>0		- version %ld

#------------------------------------------------------------------------------
# visx:  file(1) magic for Visx format files
#
0	short		0x5555		VISX image file
>2	byte		0		(zero)
>2	byte		1		(unsigned char)
>2	byte		2		(short integer)
>2	byte		3		(float 32)
>2	byte		4		(float 64)
>2	byte		5		(signed char)
>2	byte		6		(bit-plane)
>2	byte		7		(classes)
>2	byte		8		(statistics)
>2	byte		10		(ascii text)
>2	byte		15		(image segments)
>2	byte		100		(image set)
>2	byte		101		(unsigned char vector)
>2	byte		102		(short integer vector)
>2	byte		103		(float 32 vector)
>2	byte		104		(float 64 vector)
>2	byte		105		(signed char vector)
>2	byte		106		(bit plane vector)
>2	byte		121		(feature vector)
>2	byte		122		(feature vector library)
>2	byte		124		(chain code)
>2	byte		126		(bit vector)
>2	byte		130		(graph)
>2	byte		131		(adjacency graph)
>2	byte		132		(adjacency graph library)
>2	string		.VISIX		(ascii text)

#------------------------------------------------------------------------------
# vms:  file(1) magic for VMS executables (experimental)
#
# VMS .exe formats, both VAX and AXP (Greg Roelofs, newt@uchicago.edu)

# GRR 950122:  I'm just guessing on these, based on inspection of the headers
# of three executables each for Alpha and VAX architectures.  The VAX files
# all had headers similar to this:
#
#   00000  b0 00 30 00 44 00 60 00  00 00 00 00 30 32 30 35  ..0.D.`.....0205
#   00010  01 01 00 00 ff ff ff ff  ff ff ff ff 00 00 00 00  ................
#
0	string	\xb0\x00\x30\x00	VMS VAX executable
>44032	string	PK\003\004		(Info-ZIP SFX archive v5.12 w/decryption)
#
# The AXP files all looked like this, except that the byte at offset 0x22
# was 06 in some of them and 07 in others:
#
#   00000  03 00 00 00 00 00 00 00  ec 02 00 00 10 01 00 00  ................
#   00010  68 00 00 00 98 00 00 00  b8 00 00 00 00 00 00 00  h...............
#   00020  00 00 07 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
#   00030  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  ................
#   00040  00 00 00 00 ff ff ff ff  ff ff ff ff 02 00 00 00  ................
#
0	belong	0x03000000	VMS Alpha executable
>75264	string	PK\003\004	(Info-ZIP SFX archive v5.12 w/decryption)
#
# magic.x11
#
# I think this is byte-order-dependent; if so, it should become:
#
# 0	belong	00000004	X11 big-endian snf font
# 0	lelong	00000004	X11 little-endian snf font
#
0	long	00000004	X11 snf font

#------------------------------------------------------------------------------
# zilog:  file(1) magic for Zilog Z8000.
#
# Was it big-endian or little-endian?  My Product Specification doesn't
# say.
#
0	long		0xe807		object file (z8000 a.out)
0	long		0xe808		pure object file (z8000 a.out)
0	long		0xe809		separate object file (z8000 a.out)
0	long		0xe805		overlay object file (z8000 a.out)


#------------------------------------------------------------------------------
# zyxel:  file(1) magic for ZyXEL modems
#
# From <rob@pe1chl.ampr.org>
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems.  (This header conforms to a
# ZyXEL-defined standard)

0	string		ZyXEL\002	ZyXEL voice data
>10	byte		0		- CELP encoding
>10	byte&0x0B	1		- ADPCM2 encoding
>10	byte&0x0B	2		- ADPCM3 encoding
>10	byte&0x0B	3		- ADPCM4 encoding
>10	byte&0x0B	8		- New ADPCM3 encoding
>10	byte&0x04	4		with resync
