file/magdir/freebsd

   1
   2 #------------------------------------------------------------------------------
   3 # freebsd:  file(1) magic for FreeBSD objects
   4 #
   5 # All new-style FreeBSD magic numbers are in host byte order (i.e.,
   6 # little-endian on x86).
   7 #
   8 # XXX - this comes from the file "freebsd" in a recent FreeBSD version of
   9 # "file"; it, and the NetBSD stuff in "netbsd", appear to use different
  10 # schemes for distinguishing between executable images, shared libraries,
  11 # and object files.
  12 #
  13 # FreeBSD says:
  14 #
  15 #    Regardless of whether it's pure, demand-paged, or none of the
  16 #    above:
  17 #
  18 #       if the entry point is < 4096, then it's a shared library if
  19 #       the "has run-time loader information" bit is set, and is
  20 #       position-independent if the "is position-independent" bit
  21 #       is set;
  22 #
  23 #       if the entry point is >= 4096 (or >4095, same thing), then it's
  24 #       an executable, and is dynamically-linked if the "has run-time
  25 #       loader information" bit is set.
  26 #
  27 # On x86, NetBSD says:
  28 #
  29 #    If it's neither pure nor demand-paged:
  30 #
  31 #       if it has the "has run-time loader information" bit set, it's
  32 #       a dynamically-linked executable;
  33 #
  34 #       if it doesn't have that bit set, then:
  35 #
  36 #           if it has the "is position-independent" bit set, it's
  37 #           position-independent;
  38 #
  39 #           if the entry point is non-zero, it's an executable, otherwise
  40 #           it's an object file.
  41 #
  42 #    If it's pure:
  43 #
  44 #       if it has the "has run-time loader information" bit set, it's
  45 #       a dynamically-linked executable, otherwise it's just an
  46 #       executable.
  47 #
  48 #    If it's demand-paged:
  49 #
  50 #       if it has the "has run-time loader information" bit set,
  51 #       then:
  52 #
  53 #           if the entry point is < 4096, it's a shared library;
  54 #
  55 #           if the entry point is = 4096 or > 4096 (i.e., >= 4096),
  56 #           it's a dynamically-linked executable);
  57 #
  58 #       if it doesn't have the "has run-time loader information" bit
  59 #       set, then it's just an executable.
  60 #
  61 # (On non-x86, NetBSD does much the same thing, except that it uses
  62 # 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
  63 # pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
  64 # had 8K pages; dunno about MIPS.)
  65 #
  66 # I suspect the two will differ only in perverse and uninteresting cases
  67 # ("shared" libraries that aren't demand-paged and whose pages probably
  68 # won't actually be shared, executables with entry points <4096).
  69 #
  70 # I leave it to those more familiar with FreeBSD and NetBSD to figure out
  71 # what the right answer is (although using ">4095", FreeBSD-style, is
  72 # probably better than separately checking for "=4096" and ">4096",
  73 # NetBSD-style).  (The old "netbsd" file analyzed FreeBSD demand paged
  74 # executables using the NetBSD technique.)
  75 #
  76 0       lelong&0377777777       041400407       FreeBSD/i386
  77 >20     lelong                  <4096
  78 >>3     byte&0xC0               &0x80           shared library
  79 >>3     byte&0xC0               0x40            PIC object
  80 >>3     byte&0xC0               0x00            object
  81 >20     lelong                  >4095
  82 >>3     byte&0x80               0x80            dynamically linked executable
  83 >>3     byte&0x80               0x00            executable
  84 >16     lelong                  >0              not stripped
  85
  86 0       lelong&0377777777       041400410       FreeBSD/i386 pure
  87 >20     lelong                  <4096
  88 >>3     byte&0xC0               &0x80           shared library
  89 >>3     byte&0xC0               0x40            PIC object
  90 >>3     byte&0xC0               0x00            object
  91 >20     lelong                  >4095
  92 >>3     byte&0x80               0x80            dynamically linked executable
  93 >>3     byte&0x80               0x00            executable
  94 >16     lelong                  >0              not stripped
  95
  96 0       lelong&0377777777       041400413       FreeBSD/i386 demand paged
  97 >20     lelong                  <4096
  98 >>3     byte&0xC0               &0x80           shared library
  99 >>3     byte&0xC0               0x40            PIC object
 100 >>3     byte&0xC0               0x00            object
 101 >20     lelong                  >4095
 102 >>3     byte&0x80               0x80            dynamically linked executable
 103 >>3     byte&0x80               0x00            executable
 104 >16     lelong                  >0              not stripped
 105
 106 0       lelong&0377777777       041400314       FreeBSD/i386 compact demand paged
 107 >20     lelong                  <4096
 108 >>3     byte&0xC0               &0x80           shared library
 109 >>3     byte&0xC0               0x40            PIC object
 110 >>3     byte&0xC0               0x00            object
 111 >20     lelong                  >4095
 112 >>3     byte&0x80               0x80            dynamically linked executable
 113 >>3     byte&0x80               0x00            executable
 114 >16     lelong                  >0              not stripped
 115
 116 # XXX gross hack to identify core files
 117 # cores start with a struct tss; we take advantage of the following:
 118 # byte 7:     highest byte of the kernel stack pointer, always 0xfe
 119 #      8/9:   kernel (ring 0) ss value, always 0x0010
 120 #      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
 121 #      28:    low order byte of the current PTD entry, always 0 since the
 122 #             PTD is page-aligned
 123 #
 124 7       string  \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0        FreeBSD/i386 a.out core file
 125 >1039   string  >\0     from '%s'
 126
 127 # /var/run/ld.so.hints
 128 # What are you laughing about?
 129 0       lelong                  011421044151    ld.so hints file
 130 >4      lelong                  >0              (version %d)