file/magdir/linux

   1
   2 #------------------------------------------------------------------------------
   3 # linux:  file(1) magic for Linux files
   4 #
   5 # Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>
   6 # The following basic Linux magic is useful for reference, but using
   7 # "long" magic is a better practice in order to avoid collisions.
   8 #
   9 # 2     leshort         100             Linux/i386
  10 # >0    leshort         0407            impure executable (OMAGIC)
  11 # >0    leshort         0410            pure executable (NMAGIC)
  12 # >0    leshort         0413            demand-paged executable (ZMAGIC)
  13 # >0    leshort         0314            demand-paged executable (QMAGIC)
  14 #
  15 0       lelong          0x00640107      Linux/i386 impure executable (OMAGIC)
  16 >16     lelong          0               \b, stripped
  17 0       lelong          0x00640108      Linux/i386 pure executable (NMAGIC)
  18 >16     lelong          0               \b, stripped
  19 0       lelong          0x0064010b      Linux/i386 demand-paged executable (ZMAGIC)
  20 >16     lelong          0               \b, stripped
  21 0       lelong          0x006400cc      Linux/i386 demand-paged executable (QMAGIC)
  22 >16     lelong          0               \b, stripped
  23 #
  24 0       string          \007\001\000    Linux/i386 object file
  25 >20     lelong          >0x1020         \b, DLL library
  26 # message catalogs, from Mitchum DSouza <m.dsouza@mrc-apu.cam.ac.uk>
  27 0       string          *nazgul*        Linux compiled message catalog
  28 >8      lelong          >0              \b, version %ld
  29 # core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>
  30 216     lelong          0421            Linux/i386 core file
  31 >220    string          >\0             of '%s'
  32 >200    lelong          >0              (signal %d)
  33 #
  34 # LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com>
  35 # this can be overridden by the DOS executable (COM) entry
  36 2       string          LILO            Linux/i386 LILO boot/chain loader
  37 #
  38 # Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>
  39 0       string          0.9
  40 >8      byte            0x0a            Debian Binary Package
  41 >>3     byte            >0              \b, created by dpkg 0.9%c
  42 >>4     byte            >0              pl%c
  43 # PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>
  44 0       leshort         0x0436          Linux/i386 PC Screen Font data,
  45 >2      byte            0               256 characters, no directory,
  46 >2      byte            1               512 characters, no directory,
  47 >2      byte            2               256 characters, Unicode directory,
  48 >2      byte            3               512 characters, Unicode directory,
  49 >3      byte            >0              8x%d
  50 # Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>
  51 4086    string          SWAP-SPACE      Linux/i386 swap file
  52 # ECOFF magic for OSF/1 and Linux (only tested under Linux though)
  53 #
  54 #       from Erik Troan (ewt@redhat.com) examining od dumps, so this
  55 #               could be wrong
  56 #      updated by David Mosberger (davidm@azstarnet.com) based on
  57 #      GNU BFD and MIPS info found below.
  58 #
  59 0       leshort         0x0183          ECOFF alpha
  60 >24     leshort         0407            executable
  61 >24     leshort         0410            pure
  62 >24     leshort         0413            demand paged
  63 >8      long            >0              not stripped
  64 >8      long            0               stripped
  65 >23     leshort         >0              - version %ld.
  66 # linux Kernel images version 1.3.80 - ?
  67 # from Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de>
  68 0       belong          0xb8c0078e      Linux/x86 kernel image,
  69 >0x048c byte            0x31
  70 >>0x048c string         x               version %s
  71 >0x0493 byte            0x31
  72 >>0x0493 string         x               version %s
  73 #