magic.mime

sleuthit-2.09 一个磁盘的工具集

# Magic data for KMimeMagic (originally for file(1) command)
#
# The format is 4-5 columns:
#    Column #1: byte number to begin checking from, ">" indicates continuation
#    Column #2: type of data to match
#    Column #3: contents of data to match
#    Column #4: MIME type of result
#    Column #5: MIME encoding of result (optional)

#------------------------------------------------------------------------------
# Localstuff:  file(1) magic for locally observed files
# Add any locally observed files here.

# Real Audio (Magic .ra\0375)
0	belong		0x2e7261fd	audio/x-pn-realaudio
0	string		.RMF		application/vnd.rn-realmedia

#video/x-pn-realvideo
#video/vnd.rn-realvideo
#application/vnd.rn-realmedia
#	sigh, there are many mimes for that but the above are the most common.

# Taken from magic, converted to magic.mime
# mime types according to http://www.geocities.com/nevilo/mod.htm:
#	audio/it	.it
#	audio/x-zipped-it	.itz
#	audio/xm	fasttracker modules
#	audio/x-s3m	screamtracker modules
#	audio/s3m	screamtracker modules
#	audio/x-zipped-mod	mdz
#	audio/mod	mod
#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)

# Taken from loader code from mikmod version 2.14
# by Steve McIntyre ([e-mail])
# <[e-mail]> added title printing on 2003-06-24
0	string	MAS_UTrack_V00
>14	string	>/0		audio/x-mod
#audio/x-tracker-module

#0	string	UN05		MikMod UNI format module sound data

0	string	Extended\ Module: audio/x-mod
#audio/x-tracker-module
##>17	string	>\0		Title: "%s"

21	string/c	\!SCREAM!	audio/x-mod
#audio/x-screamtracker-module
21	string	BMOD2STM	audio/x-mod
#audio/x-screamtracker-module
1080	string	M.K.		audio/x-mod
#audio/x-protracker-module
#>0	string	>\0		Title: "%s"
1080	string	M!K!		audio/x-mod
#audio/x-protracker-module
#>0	string	>\0		Title: "%s"
1080	string	FLT4		audio/x-mod
#audio/x-startracker-module
#>0	string	>\0		Title: "%s"
1080	string	FLT8		audio/x-mod
#audio/x-startracker-module
#>0	string	>\0		Title: "%s"
1080	string	4CHN		audio/x-mod
#audio/x-fasttracker-module
#>0	string	>\0		Title: "%s"
1080	string	6CHN		audio/x-mod
#audio/x-fasttracker-module
#>0	string	>\0		Title: "%s"
1080	string	8CHN		audio/x-mod
#audio/x-fasttracker-module
#>0	string	>\0		Title: "%s"
1080	string	CD81		audio/x-mod
#audio/x-oktalyzer-tracker-module
#>0	string	>\0		Title: "%s"
1080	string	OKTA		audio/x-mod
#audio/x-oktalyzer-tracker-module
#>0	string	>\0		Title: "%s"
# Not good enough.
#1082	string	CH
#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
1080	string	16CN		audio/x-mod
#audio/x-taketracker-module
#>0	string	>\0		Title: "%s"
1080	string	32CN		audio/x-mod
#audio/x-taketracker-module
#>0	string	>\0		Title: "%s"

# Impuse tracker module (it)
0	string		IMPM		audio/x-mod
#>4	string		>\0		"%s"
#>40	leshort		!0		compatible w/ITv%x
#>42	leshort		!0		created w/ITv%x

#------------------------------------------------------------------------------
# end local stuff
#------------------------------------------------------------------------------

# xml based formats!

# svg

38	string		\<\!DOCTYPE\040svg	image/svg+xml


# xml
0	string		\<?xml			text/xml


#------------------------------------------------------------------------------
# Java

0	beshort		0xcafe
>2	beshort		0xbabe		application/java

#------------------------------------------------------------------------------
# audio:  file(1) magic for sound formats
#
# from Jan Nicolai Langfeldt <[e-mail]>,
#

# Sun/NeXT audio data
0	string		.snd
>12	belong		1		audio/basic
>12	belong		2		audio/basic
>12	belong		3		audio/basic
>12	belong		4		audio/basic
>12	belong		5		audio/basic
>12	belong		6		audio/basic
>12	belong		7		audio/basic

>12	belong		23		audio/x-adpcm

# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
# that uses little-endian encoding and has a different magic number
# (0x0064732E in little-endian encoding).
0	lelong		0x0064732E
>12	lelong		1		audio/x-dec-basic
>12	lelong		2		audio/x-dec-basic
>12	lelong		3		audio/x-dec-basic
>12	lelong		4		audio/x-dec-basic
>12	lelong		5		audio/x-dec-basic
>12	lelong		6		audio/x-dec-basic
>12	lelong		7		audio/x-dec-basic
#                                       compressed (G.721 ADPCM)
>12	lelong		23		audio/x-dec-adpcm

# Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM"
#					AIFF audio data
8	string		AIFF		audio/x-aiff
#					AIFF-C audio data
8	string		AIFC		audio/x-aiff
#					IFF/8SVX audio data
8	string		8SVX		audio/x-aiff



# Creative Labs AUDIO stuff
#					Standard MIDI data
0	string	MThd			audio/unknown
#>9 	byte	>0			(format %d)
#>11	byte	>1			using %d channels
#					Creative Music (CMF) data
0	string	CTMF			audio/unknown
#					SoundBlaster instrument data
0	string	SBI			audio/unknown
#					Creative Labs voice data
0	string	Creative\ Voice\ File	audio/unknown
## is this next line right?  it came this way...
#>19	byte	0x1A
#>23	byte	>0			- version %d
#>22	byte	>0			\b.%d

# [GRR 950115:  is this also Creative Labs?  Guessing that first line
#  should be string instead of unknown-endian long...]
#0	long		0x4e54524b	MultiTrack sound data
#0	string		NTRK		MultiTrack sound data
#>4	long		x		- version %ld

# Microsoft WAVE format (*.wav)
# [GRR 950115:  probably all of the shorts and longs should be leshort/lelong]
#					Microsoft RIFF
0	string		RIFF
#					- WAVE format
>8	string		WAVE		audio/x-wav
>8	string/B	AVI		video/x-msvideo
#
>8 	string		CDRA		image/x-coreldraw

# AAC (aka MPEG-2 NBC)
0       beshort&0xfff6    0xfff0          audio/X-HX-AAC-ADTS
0       string          ADIF            audio/X-HX-AAC-ADIF
0       beshort&0xffe0  0x56e0          audio/MP4A-LATM
0       beshort         0x4De1          audio/MP4A-LATM

# MPEG Layer 3 sound files
# modified by Joerg Jenderek
# GRR the original test are too common for many DOS files
# so test 1 <= kbits nibble <= E
0       beshort		&0xffe0		
>2	ubyte&0xF0	>0x0F		
>>2	ubyte&0xF0	<0xE1		audio/mpeg
#MP3 with ID3 tag
0	string		ID3		audio/mpeg
# Ogg/Vorbis
0	string		OggS		application/ogg

#------------------------------------------------------------------------------
# c-lang:  file(1) magic for C programs or various scripts
#

# XPM icons (Greg Roelofs, [e-mail])
# ideally should go into "images", but entries below would tag XPM as C source
0	string		/*\ XPM		image/x-xpmi 7bit

# 3DS (3d Studio files) Conflicts with diff output 0x3d '='
#16	beshort		0x3d3d		image/x-3ds

# this first will upset you if you're a PL/1 shop... (are there any left?)
# in which case rm it; ascmagic will catch real C programs
#					C or REXX program text
#0	string		/*		text/x-c
#					C++ program text
#0	string		//		text/x-c++

#------------------------------------------------------------------------------
# commands:  file(1) magic for various shells and interpreters
#
#0       string          :\ shell archive or commands for antique kernel text
0       string          #!/bin/sh               application/x-shellscript
0       string          #!\ /bin/sh             application/x-shellscript
0       string          #!/bin/csh              application/x-shellscript
0       string          #!\ /bin/csh            application/x-shellscript
# korn shell magic, sent by George Wu, [e-mail]
0       string          #!/bin/ksh              application/x-shellscript
0       string          #!\ /bin/ksh            application/x-shellscript
0       string          #!/bin/tcsh             application/x-shellscript
0       string          #!\ /bin/tcsh           application/x-shellscript
0       string          #!/usr/local/tcsh       application/x-shellscript
0       string          #!\ /usr/local/tcsh     application/x-shellscript
0       string          #!/usr/local/bin/tcsh   application/x-shellscript
0       string          #!\ /usr/local/bin/tcsh application/x-shellscript
# bash shell magic, from Peter Tobias ([e-mail])
0       string          #!/bin/bash     		application/x-shellscript
0       string          #!\ /bin/bash           application/x-shellscript
0       string          #!/usr/local/bin/bash   application/x-shellscript
0       string          #!\ /usr/local/bin/bash application/x-shellscript

#
# zsh/ash/ae/nawk/gawk magic from [e-mail] (Cameron Simpson)
0       string          #!/bin/zsh	        application/x-shellscript
0       string          #!/usr/bin/zsh	        application/x-shellscript
0       string          #!/usr/local/bin/zsh    application/x-shellscript
0       string          #!\ /usr/local/bin/zsh  application/x-shellscript
0       string          #!/usr/local/bin/ash    application/x-shellscript
0       string          #!\ /usr/local/bin/ash  application/x-shellscript
#0       string          #!/usr/local/bin/ae     Neil Brown's ae
#0       string          #!\ /usr/local/bin/ae   Neil Brown's ae
0       string          #!/bin/nawk             application/x-nawk
0       string          #!\ /bin/nawk           application/x-nawk
0       string          #!/usr/bin/nawk         application/x-nawk
0       string          #!\ /usr/bin/nawk       application/x-nawk
0       string          #!/usr/local/bin/nawk   application/x-nawk
0       string          #!\ /usr/local/bin/nawk application/x-nawk
0       string          #!/bin/gawk             application/x-gawk
0       string          #!\ /bin/gawk           application/x-gawk
0       string          #!/usr/bin/gawk         application/x-gawk
0       string          #!\ /usr/bin/gawk       application/x-gawk
0       string          #!/usr/local/bin/gawk   application/x-gawk
0       string          #!\ /usr/local/bin/gawk application/x-gawk
#
0       string          #!/bin/awk              application/x-awk
0       string          #!\ /bin/awk            application/x-awk
0       string          #!/usr/bin/awk          application/x-awk
0       string          #!\ /usr/bin/awk        application/x-awk
# update to distinguish from *.vcf files by Joerg Jenderek: joerg dot jenderek at web dot de
0	regex		BEGIN[[:space:]]*[{]	application/x-awk

# For Larry Wall's perl language.  The ``eval'' line recognizes an
# outrageously clever hack for USG systems.
#                               Keith Waclena <[e-mail]>
0       string          #!/bin/perl                     application/x-perl
0       string          #!\ /bin/perl                   application/x-perl
0       string          eval\ "exec\ /bin/perl          application/x-perl
0       string          #!/usr/bin/perl                 application/x-perl
0       string          #!\ /usr/bin/perl               application/x-perl
0       string          eval\ "exec\ /usr/bin/perl      application/x-perl
0       string          #!/usr/local/bin/perl           application/x-perl
0       string          #!\ /usr/local/bin/perl         application/x-perl
0       string          eval\ "exec\ /usr/local/bin/perl application/x-perl

#------------------------------------------------------------------------------
# compress:  file(1) magic for pure-compression formats (no archives)
#
# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, whap, etc.
#
# Formats for various forms of compressed data
# Formats for "compress" proper have been moved into "compress.c",
# because it tries to uncompress it to figure out what's inside.

# standard unix compress
0	string		\037\235	application/x-compress

# gzip (GNU zip, not to be confused with [Info-ZIP/PKWARE] zip archiver)
0       string          \037\213        application/x-gzip

0		string			PK\003\004		application/x-zip

# RAR archiver (Greg Roelofs, [e-mail])
0	string		Rar!		application/x-rar

# According to gzip.h, this is the correct byte order for packed data.
0	string		\037\036	application/octet-stream
#
# This magic number is byte-order-independent.
#
0	short		017437		application/octet-stream

# XXX - why *two* entries for "compacted data", one of which is
# byte-order independent, and one of which is byte-order dependent?
#