magic.mime

sleuthit-2.09 一个磁盘的工具集

>8	string/B	jp2	      image/jp2
>8	string		3gp	      video/3gpp
>8      string          avc1          video/3gpp
>8	string		mmp4	      video/mp4
>8	string/B	M4A	      audio/mp4
>8	string/B	qt	      video/quicktime
# The contributor claims:
#   I couldn't find a real magic number for these, however, this
#   -appears- to work.  Note that it might catch other files, too,
#   so BE CAREFUL!
#
# Note that title and author appear in the two 20-byte chunks
# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
# 255 (hex FF)! DL format SUCKS BIG ROCKS.
#
#						DL file version 1 , medium format (160x100, 4 images/screen)
0	byte		1			video/unknown
0	byte		2			video/unknown
#
# Databases
#
# GDBM magic numbers
#  Will be maintained as part of the GDBM distribution in the future.
#  <[e-mail]>
0       belong  0x13579ace      application/x-gdbm
0       lelong  0x13579ace      application/x-gdbm
0       string  GDBM            application/x-gdbm
#
0       belong  0x061561        application/x-dbm
#
# Executables
#
0	string		\177ELF
>16	leshort		0		application/octet-stream
>16	leshort		1		application/x-object
>16	leshort		2		application/x-executable
>16	leshort		3		application/x-sharedlib
>16	leshort		4		application/x-coredump
>16	beshort		0		application/octet-stream
>16	beshort		1		application/x-object
>16	beshort		2		application/x-executable
>16	beshort		3		application/x-sharedlib
>16	beshort		4		application/x-coredump
#
# DOS
0		string			MZ				application/x-dosexec
#
# KDE
0		string	[KDE\ Desktop\ Entry]	application/x-kdelnk
0		string	#\ KDE\ Config\ File	application/x-kdelnk
# xmcd database file for kscd
0		string	#\ xmcd                text/xmcd

#------------------------------------------------------------------------------
# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
#
0       string          #\ PaCkAgE\ DaTaStReAm  application/x-svr4-package

#PNG Image Format
0	string		\x89PNG			image/png

# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
0	string		\x8aMNG			video/x-mng
0	string		\x8aJNG			video/x-jng

#------------------------------------------------------------------------------
# Hierarchical Data Format, used to facilitate scientific data exchange
# specifications at http://hdf.ncsa.uiuc.edu/
0	belong		0x0e031301	Hierarchical Data Format (version 4) data
0	string		\211HDF\r\n\032	Hierarchical Data Format (version 5) data

# Adobe Photoshop
0	string		8BPS			image/x-photoshop

# Felix von Leitner <[e-mail]>
0	string		d8:announce		application/x-bittorrent


# lotus 1-2-3 document
0	belong	0x00001a00	application/x-123
0	belong	0x00000200 	application/x-123

# MS Access database
4	string	Standard\ Jet\ DB	application/msaccess

## magic for XBase files
#0      byte       0x02
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x03
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x04
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x05
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x30
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x43
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x7b
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x83
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x8b
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0x8e
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0xb3
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0      byte       0xf5
#>8     leshort	  >0
#>>12   leshort    0	application/x-dbf
#
#0	leshort		0x0006		application/x-dbt

# Debian has entries for the old PGP formats:
# pgp:  file(1) magic for Pretty Good Privacy
# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
0       beshort         0x9900                  text/PGP key public ring
0       beshort         0x9501                  text/PGP key security ring
0       beshort         0x9500                  text/PGP key security ring
0       beshort         0xa600                  text/PGP encrypted data
0       string          -----BEGIN\040PGP       text/PGP armored data
>15     string          PUBLIC\040KEY\040BLOCK- public key block
>15     string          MESSAGE-                message
>15     string          SIGNED\040MESSAGE-      signed message
>15     string          PGP\040SIGNATURE-       signature
0       beshort         0x8501                  data
#
# GnuPG Magic:
#
0       beshort         0x9901                  text/GnuPG key public ring
0       beshort         0x8501                  text/OpenPGP data

# flash:        file(1) magic for Macromedia Flash file format
#
# See
#
#       http://www.macromedia.com/software/flash/open/
#
0	string		FWS
>3	byte		x			application/x-shockwave-flash

# The following paramaters are created for Namazu.
# <http://www.namazu.org/>
#
# 1999/08/13
#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc
0	string		BZh			application/x-bzip2

# 1999/09/09
# VRML (suggested by Masao Takaku)
0	string		#VRML\ V1.0\ ascii	model/vrml
0	string		#VRML\ V2.0\ utf8	model/vrml

#------------------------------------------------------------------------------
# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
#
# Contributor kenzo-:
# Reversed-engineered JS Ichitaro magic numbers
#

0	string		DOC
>43	byte		0x14		application/ichitaro4
>144	string	JDASH		application/ichitaro4

0	string		DOC
>43	byte		0x15		application/ichitaro5

0	string		DOC
>43	byte		0x16		application/ichitaro6

#------------------------------------------------------------------------------
# office97: file(1) magic for MicroSoft Office files
#
# Contributor kenzo-:
# Reversed-engineered MS Office magic numbers
#

#0       string          \320\317\021\340\241\261\032\341
#>48     byte            0x1B            application/excel

2080	string	Microsoft\ Excel\ 5.0\ Worksheet	application/excel
2114	string	Biff5					application/excel

0       string	\224\246\056		application/msword

0	belong	0x31be0000		application/msword

0	string	PO^Q`			application/msword

0	string	\320\317\021\340\241\261\032\341
>546	string	bjbj			application/msword
>546	string	jbjb			application/msword

512	string	R\0o\0o\0t\0\ \0E\0n\0t\0r\0y	application/msword

2080	string	Microsoft\ Word\ 6.0\ Document	application/msword
2080	string	Documento\ Microsoft\ Word\ 6	application/msword
2112	string	MSWordDoc			application/msword

#0	string	\320\317\021\340\241\261\032\341	application/powerpoint
0	string	\320\317\021\340\241\261\032\341	application/msword

0       string  #\ PaCkAgE\ DaTaStReAm  application/x-svr4-package


# WinNT/WinCE PE files (Warner Losh, [e-mail])
#
128		string	PE\000\000	application/octet-stream
0		string	PE\000\000	application/octet-stream

# miscellaneous formats
0		string	LZ		application/octet-stream

# DOS device drivers by Joerg Jenderek
0	belong		0xffffffff	application/octet-stream

# .EXE formats (Greg Roelofs, [e-mail])
#
0		string	MZ
>24		string	@		application/octet-stream

0		string	MZ
>30		string	Copyright\ 1989-1990\ PKWARE\ Inc.	application/x-zip

0		string	MZ
>30		string	PKLITE\ Copr.	application/x-zip

0		string	MZ
>36		string	LHa's\ SFX	application/x-lha

0		string	MZ		application/octet-stream

# LHA archiver
2		string	-lh
>6		string	-		application/x-lha


# Zoo archiver
20		lelong	0xfdc4a7dc	application/x-zoo

# ARC archiver
0       	lelong&0x8080ffff	0x0000081a	application/x-arc
0		lelong&0x8080ffff	0x0000091a	application/x-arc
0		lelong&0x8080ffff	0x0000021a	application/x-arc
0		lelong&0x8080ffff	0x0000031a	application/x-arc
0		lelong&0x8080ffff	0x0000041a	application/x-arc
0		lelong&0x8080ffff	0x0000061a	application/x-arc

# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
0		lelong	0x223e9f78	application/ms-tnef

# From: stephane.loeuillet@tiscali.f
# http://www.djvuzone.org/
0	string		AT&TFORM	image/x.djvu

# Danny Milosavljevic <[e-mail]>
# this are adrift (adventure game standard) game files, extension .taf
# depending on version magic continues with 0x93453E6139FA (V 4.0)
# 0x9445376139FA (V 3.90)
# 0x9445366139FA (V 3.80)
# this is from source (http://www.adrift.org.uk/) and I have some taf
# files, and checked them.
#0	belong	0x3C423FC9
#>4	belong	0x6A87C2CF	application/x-adrift
#0	string	\000\000\001\000	image/x-ico

# Quark Xpress 3 Files:
# (made the mimetype up)
0	string	\0\0MMXPR3\0	application/x-quark-xpress-3

# EET archive
# From: Tilman Sauerbeck <[e-mail]>
0	belong	0x1ee7ff00	application/x-eet

# From: Denis Knauf, via gentoo.
0	string	fLaC		audio/x-flac
0	string	CWS		application/x-shockwave-flash

# Hangul Document Files:
# Reversed-engineered HWP magic numbers
# From: Won-Kyu Park <[e-mail]>
512	string		R\0o\0o\0t\0	application/x-hwp

0	string/c	BEGIN:VCARD	text/x-vcard
0	string		WordPro\0	application/vnd.lotus-wordpro
0	string		WordPro\r\373	application/vnd.lotus-wordpro
0	string		CPC\262		image/cpi

# 
128	string		DICM		application/dicom

# Symbian installation files
8	lelong	0x10000419	application/vnd.symbian.install
0	lelong	0x10201A7A	x-epoc/x-sisx-app