[apple/file_cmds.git] / file / magdir / freebsd


#------------------------------------------------------------------------------
# freebsd:  file(1) magic for FreeBSD objects
#
# All new-style FreeBSD magic numbers are in host byte order (i.e.,
# little-endian on x86).
#
# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
# schemes for distinguishing between executable images, shared libraries,
# and object files.
#
# FreeBSD says:
#
#    Regardless of whether it's pure, demand-paged, or none of the
#    above:
#
#	if the entry point is < 4096, then it's a shared library if
#	the "has run-time loader information" bit is set, and is
#	position-independent if the "is position-independent" bit
#	is set;
#
#	if the entry point is >= 4096 (or >4095, same thing), then it's
#	an executable, and is dynamically-linked if the "has run-time
#	loader information" bit is set.
#
# On x86, NetBSD says:
#
#    If it's neither pure nor demand-paged:
#
#	if it has the "has run-time loader information" bit set, it's
#	a dynamically-linked executable;
#
#	if it doesn't have that bit set, then:
#
#	    if it has the "is position-independent" bit set, it's
#	    position-independent;
#
#	    if the entry point is non-zero, it's an executable, otherwise
#	    it's an object file.
#
#    If it's pure:
#
#	if it has the "has run-time loader information" bit set, it's
#	a dynamically-linked executable, otherwise it's just an
#	executable.
#
#    If it's demand-paged:
#
#	if it has the "has run-time loader information" bit set,
#	then:
#
#	    if the entry point is < 4096, it's a shared library;
#
#	    if the entry point is = 4096 or > 4096 (i.e., >= 4096),
#	    it's a dynamically-linked executable);
#
#	if it doesn't have the "has run-time loader information" bit
#	set, then it's just an executable.
#
# (On non-x86, NetBSD does much the same thing, except that it uses
# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
# had 8K pages; dunno about MIPS.)
#
# I suspect the two will differ only in perverse and uninteresting cases
# ("shared" libraries that aren't demand-paged and whose pages probably
# won't actually be shared, executables with entry points <4096).
#
# I leave it to those more familiar with FreeBSD and NetBSD to figure out
# what the right answer is (although using ">4095", FreeBSD-style, is
# probably better than separately checking for "=4096" and ">4096",
# NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
# executables using the NetBSD technique.)
#
0	lelong&0377777777	041400407	FreeBSD/i386
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400410	FreeBSD/i386 pure
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400413	FreeBSD/i386 demand paged
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

0	lelong&0377777777	041400314	FreeBSD/i386 compact demand paged
>20	lelong			<4096
>>3	byte&0xC0		&0x80		shared library
>>3	byte&0xC0		0x40		PIC object
>>3	byte&0xC0		0x00		object
>20	lelong			>4095
>>3	byte&0x80		0x80		dynamically linked executable
>>3	byte&0x80		0x00		executable
>16	lelong			>0		not stripped

# XXX gross hack to identify core files
# cores start with a struct tss; we take advantage of the following:
# byte 7:     highest byte of the kernel stack pointer, always 0xfe
#      8/9:   kernel (ring 0) ss value, always 0x0010
#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
#      28:    low order byte of the current PTD entry, always 0 since the
#             PTD is page-aligned
#
7	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	FreeBSD/i386 a.out core file
>1039	string	>\0	from '%s'

# /var/run/ld.so.hints
# What are you laughing about?
0	lelong			011421044151	ld.so hints file
>4	lelong			>0		(version %d)
Commit	Line	Data
440bd198 A	1
	2	#------------------------------------------------------------------------------
	3	# freebsd: file(1) magic for FreeBSD objects
	4	#
	5	# All new-style FreeBSD magic numbers are in host byte order (i.e.,
	6	# little-endian on x86).
	7	#
	8	# XXX - this comes from the file "freebsd" in a recent FreeBSD version of
	9	# "file"; it, and the NetBSD stuff in "netbsd", appear to use different
	10	# schemes for distinguishing between executable images, shared libraries,
	11	# and object files.
	12	#
	13	# FreeBSD says:
	14	#
	15	# Regardless of whether it's pure, demand-paged, or none of the
	16	# above:
	17	#
	18	# if the entry point is < 4096, then it's a shared library if
	19	# the "has run-time loader information" bit is set, and is
	20	# position-independent if the "is position-independent" bit
	21	# is set;
	22	#
	23	# if the entry point is >= 4096 (or >4095, same thing), then it's
	24	# an executable, and is dynamically-linked if the "has run-time
	25	# loader information" bit is set.
	26	#
	27	# On x86, NetBSD says:
	28	#
	29	# If it's neither pure nor demand-paged:
	30	#
	31	# if it has the "has run-time loader information" bit set, it's
	32	# a dynamically-linked executable;
	33	#
	34	# if it doesn't have that bit set, then:
	35	#
	36	# if it has the "is position-independent" bit set, it's
	37	# position-independent;
	38	#
	39	# if the entry point is non-zero, it's an executable, otherwise
	40	# it's an object file.
	41	#
	42	# If it's pure:
	43	#
	44	# if it has the "has run-time loader information" bit set, it's
	45	# a dynamically-linked executable, otherwise it's just an
	46	# executable.
	47	#
	48	# If it's demand-paged:
	49	#
	50	# if it has the "has run-time loader information" bit set,
	51	# then:
	52	#
	53	# if the entry point is < 4096, it's a shared library;
	54	#
	55	# if the entry point is = 4096 or > 4096 (i.e., >= 4096),
	56	# it's a dynamically-linked executable);
	57	#
	58	# if it doesn't have the "has run-time loader information" bit
	59	# set, then it's just an executable.
	60	#
	61	# (On non-x86, NetBSD does much the same thing, except that it uses
	62	# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
	63	# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
	64	# had 8K pages; dunno about MIPS.)
65	#
66	# I suspect the two will differ only in perverse and uninteresting cases
67	# ("shared" libraries that aren't demand-paged and whose pages probably
68	# won't actually be shared, executables with entry points <4096).
69	#
70	# I leave it to those more familiar with FreeBSD and NetBSD to figure out
71	# what the right answer is (although using ">4095", FreeBSD-style, is
72	# probably better than separately checking for "=4096" and ">4096",
73	# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
74	# executables using the NetBSD technique.)
75	#
76	0 lelong&0377777777 041400407 FreeBSD/i386
77	>20 lelong <4096
78	>>3 byte&0xC0 &0x80 shared library
79	>>3 byte&0xC0 0x40 PIC object
80	>>3 byte&0xC0 0x00 object
81	>20 lelong >4095
82	>>3 byte&0x80 0x80 dynamically linked executable
83	>>3 byte&0x80 0x00 executable
84	>16 lelong >0 not stripped
85
86	0 lelong&0377777777 041400410 FreeBSD/i386 pure
87	>20 lelong <4096
88	>>3 byte&0xC0 &0x80 shared library
89	>>3 byte&0xC0 0x40 PIC object
90	>>3 byte&0xC0 0x00 object
91	>20 lelong >4095
92	>>3 byte&0x80 0x80 dynamically linked executable
93	>>3 byte&0x80 0x00 executable
94	>16 lelong >0 not stripped
95
96	0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
97	>20 lelong <4096
98	>>3 byte&0xC0 &0x80 shared library
99	>>3 byte&0xC0 0x40 PIC object
100	>>3 byte&0xC0 0x00 object
101	>20 lelong >4095
102	>>3 byte&0x80 0x80 dynamically linked executable
103	>>3 byte&0x80 0x00 executable
104	>16 lelong >0 not stripped
105
106	0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
107	>20 lelong <4096
108	>>3 byte&0xC0 &0x80 shared library
109	>>3 byte&0xC0 0x40 PIC object
110	>>3 byte&0xC0 0x00 object
111	>20 lelong >4095
112	>>3 byte&0x80 0x80 dynamically linked executable
113	>>3 byte&0x80 0x00 executable
114	>16 lelong >0 not stripped
115
116	# XXX gross hack to identify core files
117	# cores start with a struct tss; we take advantage of the following:
118	# byte 7: highest byte of the kernel stack pointer, always 0xfe
119	# 8/9: kernel (ring 0) ss value, always 0x0010
120	# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
121	# 28: low order byte of the current PTD entry, always 0 since the
122	# PTD is page-aligned
123	#
124	7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
125	>1039 string >\0 from '%s'
126
127	# /var/run/ld.so.hints
128	# What are you laughing about?
129	0 lelong 011421044151 ld.so hints file
130	>4 lelong >0 (version %d)