head	1.4;
access;
symbols
	RELENG_8_4:1.4.0.2
	RELENG_9_1_0_RELEASE:1.3.10.1
	RELENG_9_1:1.3.10.1.0.2
	RELENG_9_1_BP:1.3.10.1
	RELENG_8_3_0_RELEASE:1.3
	RELENG_8_3:1.3.0.14
	RELENG_8_3_BP:1.3
	RELENG_9_0_0_RELEASE:1.3
	RELENG_9_0:1.3.0.12
	RELENG_9_0_BP:1.3
	RELENG_9:1.3.0.10
	RELENG_9_BP:1.3
	RELENG_7_4_0_RELEASE:1.1.1.7
	RELENG_8_2_0_RELEASE:1.3
	RELENG_7_4:1.1.1.7.0.12
	RELENG_7_4_BP:1.1.1.7
	RELENG_8_2:1.3.0.8
	RELENG_8_2_BP:1.3
	RELENG_8_1_0_RELEASE:1.3
	RELENG_8_1:1.3.0.6
	RELENG_8_1_BP:1.3
	RELENG_7_3_0_RELEASE:1.1.1.7
	RELENG_7_3:1.1.1.7.0.10
	RELENG_7_3_BP:1.1.1.7
	RELENG_8_0_0_RELEASE:1.3
	RELENG_8_0:1.3.0.4
	RELENG_8_0_BP:1.3
	RELENG_8:1.3.0.2
	RELENG_8_BP:1.3
	RELENG_7_2_0_RELEASE:1.1.1.7
	RELENG_7_2:1.1.1.7.0.8
	RELENG_7_2_BP:1.1.1.7
	RELENG_7_1_0_RELEASE:1.1.1.7
	RELENG_6_4_0_RELEASE:1.1.1.4.2.1
	RELENG_7_1:1.1.1.7.0.6
	RELENG_7_1_BP:1.1.1.7
	RELENG_6_4:1.1.1.4.2.1.0.2
	RELENG_6_4_BP:1.1.1.4.2.1
	RELENG_7_0_0_RELEASE:1.1.1.7
	file_4_23__r1_46:1.1.1.7
	RELENG_6_3_0_RELEASE:1.1.1.4
	file_4_23:1.1.1.7
	RELENG_7_0:1.1.1.7.0.4
	RELENG_7_0_BP:1.1.1.7
	RELENG_6_3:1.1.1.4.0.10
	RELENG_6_3_BP:1.1.1.4
	RELENG_7:1.1.1.7.0.2
	RELENG_7_BP:1.1.1.7
	file_4_21:1.1.1.7
	file_4_19:1.1.1.6
	RELENG_6_2_0_RELEASE:1.1.1.4
	RELENG_6_2:1.1.1.4.0.8
	RELENG_6_2_BP:1.1.1.4
	file_4_17_A:1.1
	file_4_17:1.1.1.5
	RELENG_5_5_0_RELEASE:1.1.1.3
	RELENG_5_5:1.1.1.3.0.8
	RELENG_5_5_BP:1.1.1.3
	RELENG_6_1_0_RELEASE:1.1.1.4
	RELENG_6_1:1.1.1.4.0.6
	RELENG_6_1_BP:1.1.1.4
	RELENG_6_0_0_RELEASE:1.1.1.4
	RELENG_6_0:1.1.1.4.0.4
	RELENG_6_0_BP:1.1.1.4
	RELENG_6:1.1.1.4.0.2
	RELENG_6_BP:1.1.1.4
	RELENG_5_4_0_RELEASE:1.1.1.3
	RELENG_5_4:1.1.1.3.0.6
	RELENG_5_4_BP:1.1.1.3
	RELENG_4_11_0_RELEASE:1.1.1.1.2.2
	file_4_12:1.1.1.4
	RELENG_4_11:1.1.1.1.2.2.0.8
	RELENG_4_11_BP:1.1.1.1.2.2
	RELENG_5_3_0_RELEASE:1.1.1.3
	RELENG_5_3:1.1.1.3.0.4
	RELENG_5_3_BP:1.1.1.3
	RELENG_5:1.1.1.3.0.2
	RELENG_5_BP:1.1.1.3
	file_4_10:1.1.1.3
	RELENG_4_10_0_RELEASE:1.1.1.1.2.2
	RELENG_4_10:1.1.1.1.2.2.0.6
	RELENG_4_10_BP:1.1.1.1.2.2
	RELENG_5_2_1_RELEASE:1.1.1.2
	RELENG_5_2_0_RELEASE:1.1.1.2
	RELENG_5_2:1.1.1.2.0.6
	RELENG_5_2_BP:1.1.1.2
	RELENG_4_9_0_RELEASE:1.1.1.1.2.2
	RELENG_4_9:1.1.1.1.2.2.0.4
	RELENG_4_9_BP:1.1.1.1.2.2
	RELENG_5_1_0_RELEASE:1.1.1.2
	RELENG_5_1:1.1.1.2.0.4
	RELENG_5_1_BP:1.1.1.2
	RELENG_4_8_0_RELEASE:1.1.1.1.2.2
	RELENG_4_8:1.1.1.1.2.2.0.2
	RELENG_4_8_BP:1.1.1.1.2.2
	file_3_41:1.1.1.2
	file_3_40:1.1.1.2
	RELENG_5_0_0_RELEASE:1.1.1.2
	RELENG_5_0:1.1.1.2.0.2
	RELENG_5_0_BP:1.1.1.2
	RELENG_4_7_0_RELEASE:1.1.1.1.2.1
	RELENG_4_7:1.1.1.1.2.1.0.10
	RELENG_4_7_BP:1.1.1.1.2.1
	file_3_39:1.1.1.2
	RELENG_4_6_2_RELEASE:1.1.1.1.2.1
	RELENG_4_6_1_RELEASE:1.1.1.1.2.1
	RELENG_4_6_0_RELEASE:1.1.1.1.2.1
	RELENG_4_6:1.1.1.1.2.1.0.8
	RELENG_4_6_BP:1.1.1.1.2.1
	RELENG_4_5_0_RELEASE:1.1.1.1.2.1
	RELENG_4_5:1.1.1.1.2.1.0.6
	RELENG_4_5_BP:1.1.1.1.2.1
	file_3_37:1.1.1.1
	RELENG_4_4_0_RELEASE:1.1.1.1.2.1
	RELENG_4_4:1.1.1.1.2.1.0.4
	RELENG_4_4_BP:1.1.1.1.2.1
	file_3_36:1.1.1.1
	file_3_35:1.1.1.1
	RELENG_4_3_0_RELEASE:1.1.1.1.2.1
	RELENG_4_3:1.1.1.1.2.1.0.2
	RELENG_4_3_BP:1.1.1.1.2.1
	file_3_34:1.1.1.1
	RELENG_4:1.1.1.1.0.2
	file_3_33:1.1.1.1
	file_3_32:1.1.1.1
	ZOULAS:1.1.1;
locks; strict;
comment	@# @;


1.4
date	2012.04.19.03.20.13;	author obrien;	state Exp;
branches
	1.4.2.1;
next	1.3;

1.3
date	2009.05.18.22.34.33;	author delphij;	state Exp;
branches
	1.3.10.1;
next	1.2;

1.2
date	2009.01.02.03.10.55;	author obrien;	state Exp;
branches;
next	1.1;

1.1
date	2000.11.05.08.33.54;	author obrien;	state Exp;
branches
	1.1.1.1;
next	;

1.4.2.1
date	2012.04.19.03.20.13;	author svnexp;	state dead;
branches;
next	1.4.2.2;

1.4.2.2
date	2013.03.28.13.00.45;	author svnexp;	state Exp;
branches;
next	;

1.3.10.1
date	2012.07.02.08.48.58;	author obrien;	state Exp;
branches;
next	;

1.1.1.1
date	2000.11.05.08.33.54;	author obrien;	state Exp;
branches
	1.1.1.1.2.1;
next	1.1.1.2;

1.1.1.2
date	2002.09.16.05.54.25;	author obrien;	state Exp;
branches;
next	1.1.1.3;

1.1.1.3
date	2004.08.09.08.45.41;	author obrien;	state Exp;
branches;
next	1.1.1.4;

1.1.1.4
date	2004.12.28.04.31.46;	author obrien;	state Exp;
branches
	1.1.1.4.2.1;
next	1.1.1.5;

1.1.1.5
date	2006.06.19.07.52.14;	author obrien;	state Exp;
branches;
next	1.1.1.6;

1.1.1.6
date	2007.05.24.16.12.23;	author obrien;	state Exp;
branches;
next	1.1.1.7;

1.1.1.7
date	2007.05.24.21.59.37;	author obrien;	state Exp;
branches;
next	;

1.1.1.1.2.1
date	2000.11.26.21.37.23;	author obrien;	state Exp;
branches;
next	1.1.1.1.2.2;

1.1.1.1.2.2
date	2003.03.16.04.44.56;	author obrien;	state Exp;
branches;
next	;

1.1.1.4.2.1
date	2008.01.24.15.47.31;	author rafan;	state Exp;
branches;
next	;


desc
@@


1.4
log
@SVN rev 234449 on 2012-04-19 03:20:13Z by obrien

Update file(1) to version 5.11.
@
text
@
#------------------------------------------------------------------------------
# $File: linux,v 1.42 2012/02/07 21:35:03 christos Exp $
# linux:  file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@@yggdrasil.com>
# The following basic Linux magic is useful for reference, but using
# "long" magic is a better practice in order to avoid collisions.
#
# 2	leshort		100		Linux/i386
# >0	leshort		0407		impure executable (OMAGIC)
# >0	leshort		0410		pure executable (NMAGIC)
# >0	leshort		0413		demand-paged executable (ZMAGIC)
# >0	leshort		0314		demand-paged executable (QMAGIC)
#
0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
>16	lelong		0		\b, stripped
#
0	string		\007\001\000	Linux/i386 object file
>20	lelong		>0x1020		\b, DLL library
# Linux-8086 stuff:
0	string		\01\03\020\04	Linux-8086 impure executable
>28	long		!0		not stripped
0	string		\01\03\040\04	Linux-8086 executable
>28	long		!0		not stripped
#
0	string		\243\206\001\0	Linux-8086 object file
#
0	string		\01\03\020\20	Minix-386 impure executable
>28	long		!0		not stripped
0	string		\01\03\040\20	Minix-386 executable
>28	long		!0		not stripped
# core dump file, from Bill Reynolds <bill@@goshawk.lanl.gov>
216	lelong		0421		Linux/i386 core file
>220	string		>\0		of '%s'
>200	lelong		>0		(signal %d)
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@@yggdrasil.com>
# this can be overridden by the DOS executable (COM) entry
2	string		LILO		Linux/i386 LILO boot/chain loader
#
# Linux make config build file, from Ole Aamot <oka@@oka.no>
28 	string		make\ config	Linux make config build file
#
# PSF fonts, from H. Peter Anvin <hpa@@yggdrasil.com>
# Updated by Adam Buchbinder <adam.buchbinder@@gmail.com>
# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
0	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
>2	byte&0x01	0		256 characters,
>2	byte&0x01	!0		512 characters,
>2	byte&0x02	0		no directory,
>2	byte&0x02	!0		Unicode directory,
>3	byte		>0		8x%d
0	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
>16	lelong		x		%d characters,
>12	lelong&0x01	0		no directory,
>12	lelong&0x01	!0		Unicode directory,
>24	lelong		x		%d
>28	lelong		x		\bx%d

# Linux swap file, from Daniel Quinlan <quinlan@@yggdrasil.com>
4086	string		SWAP-SPACE	Linux/i386 swap file
# From: Jeff Bailey <jbailey@@ubuntu.com>
# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@@ubuntu.com>
4076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
# From: James Hunt <james.hunt@@ubuntu.com>
4076    string          SWAPSPACE2LINHIB0001    Linux/i386 swap file (new style) (compressed hibernate)
# according to man page of mkswap (8) March 1999
# volume label and UUID Russell Coker
# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
4086	string		SWAPSPACE2	Linux/i386 swap file (new style),
>0x400	long		x		version %d (4K pages),
>0x404	long		x		size %d pages,
>1052	string		\0		no label,
>1052	string		>\0		LABEL=%s,
>0x40c	belong		x		UUID=%08x
>0x410	beshort		x		\b-%04x
>0x412	beshort		x		\b-%04x
>0x414	beshort		x		\b-%04x
>0x416	belong		x		\b-%08x
>0x41a	beshort		x		\b%04x
# From Daniel Novotny <dnovotny@@redhat.com>
# swap file for PowerPC
65526	string		SWAPSPACE2	Linux/ppc swap file
#
# Linux kernel boot images, from Albert Cahalan <acahalan@@cs.uml.edu>
# and others such as Axel Kohlmeyer <akohlmey@@rincewind.chemie.uni-ulm.de>
# and Nicols Lichtmaier <nick@@debian.org>
# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
# Linux kernel boot images (i386 arch) (Wolfram Kleff)
514	string		HdrS		Linux kernel
>510	leshort		0xAA55		x86 boot executable
>>518	leshort		>0x1ff
>>>529	byte		0		zImage,
>>>529	byte		1		bzImage,
>>>(526.s+0x200) string	>\0		version %s,
>>498	leshort		1		RO-rootFS,
>>498	leshort		0		RW-rootFS,
>>508	leshort		>0		root_dev 0x%X,
>>502	leshort		>0		swap_dev 0x%X,
>>504	leshort		>0		RAMdisksize %u KB,
>>506	leshort		0xFFFF		Normal VGA
>>506	leshort		0xFFFE		Extended VGA
>>506	leshort		0xFFFD		Prompt for Videomode
>>506	leshort		>0		Video mode %d
# This also matches new kernels, which were caught above by "HdrS".
0		belong	0xb8c0078e	Linux kernel
>0x1e3		string	Loading		version 1.3.79 or older
>0x1e9		string	Loading		from prehistoric times

# System.map files - Nicols Lichtmaier <nick@@debian.org>
8	search/1	\ A\ _text	Linux kernel symbol map text

# LSM entries - Nicols Lichtmaier <nick@@debian.org>
0	search/1	Begin3	Linux Software Map entry text
0	search/1	Begin4	Linux Software Map entry text (new format)

# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
0	belong	0x4f4f4f4d	User-mode Linux COW file
>4	belong	<3		\b, version %d
>>8	string	>\0		\b, backing file %s
>4	belong	>2		\b, version %d
>>32	string	>\0		\b, backing file %s

############################################################################
# Linux kernel versions

0		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
>497		leshort		0		x86 boot sector
>>514		belong		0x8e	of a kernel from the dawn of time!
>>514		belong		0x908ed8b4	version 0.99-1.1.42
>>514		belong		0x908ed8b8	for memtest86

>497		leshort		!0		x86 kernel
>>504		leshort		>0		RAMdisksize=%u KB
>>502		leshort		>0		swap=0x%X
>>508		leshort		>0		root=0x%X
>>>498		leshort		1		\b-ro
>>>498		leshort		0		\b-rw
>>506		leshort		0xFFFF		vga=normal
>>506		leshort		0xFFFE		vga=extended
>>506		leshort		0xFFFD		vga=ask
>>506		leshort		>0		vga=%d
>>514		belong		0x908ed881	version 1.1.43-1.1.45
>>514		belong		0x15b281cd
>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
>>514		string		HdrS
>>>518		leshort		>0x1FF
>>>>529		byte		0		\b, zImage
>>>>529		byte		1		\b, bzImage
>>>>(526.s+0x200) string 	>\0		\b, version %s

# Linux boot sector thefts.
0		belong		0xb8c0078e	Linux
>0x1e6		belong		0x454c4b53	ELKS Kernel
>0x1e6		belong		!0x454c4b53	style boot sector

############################################################################
# Linux S390 kernel image
# Created by: Jan Kaluza <jkaluza@@redhat.com>
8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
# 64bit
>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
# 32bit
>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel

# Linux ARM compressed kernel image
# From: Kevin Cernekee <cernekee@@gmail.com>
36	lelong	0x016f2818	Linux kernel ARM boot executable zImage (little-endian)
36	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)

############################################################################
# Linux 8086 executable
0	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
>5	string		.		
>>4	string		>\0		\b, libc version %s

0	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
>2	byte&0x01	!0		\b, unmapped zero page
>2	byte&0x20	0		\b, impure
>2	byte&0x20	!0
>>2	byte&0x10	!0		\b, A_EXEC
>2	byte&0x02	!0		\b, A_PAL
>2	byte&0x04	!0		\b, A_NSYM
>2	byte&0x08	!0		\b, A_STAND
>2	byte&0x40	!0		\b, A_PURE
>2	byte&0x80	!0		\b, A_TOVLY
>28     long            !0              \b, not stripped
>37	string		.		
>>36	string		>\0		\b, libc version %s

# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable

# SYSLINUX boot logo files (from 'ppmtolss16' sources)
# http://syslinux.zytor.com/
#
0	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
>4	leshort	x			\b, width %d
>6	leshort	x			\b, height %d

0	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
>4	belong	x			version %d

# SE Linux policy database
# From: Mike Frysinger <vapier@@gentoo.org>
0	lelong	0xf97cff8c		SE Linux policy
>16	lelong	x			v%d
>20	lelong	1			MLS
>24	lelong	x			%d symbols
>28	lelong	x			%d ocons

# Linux Logical Volume Manager (LVM) 
# Emmanuel VARAGNAT <emmanuel.varagnat@@guzu.net>
#
# System ID, UUID and volume group name are 128 bytes long
# but they should never be full and initialized with zeros...
#
# LVM1
#
0x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
>0x12c	string	>\0		, System ID: %s

0x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
>0x12c	string	>\0		, System ID: %s

#  LVM2
#
# It seems that the label header can be in one the four first sector
# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
#
# 0x200 seems to be the common case

0x218           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
# read the offset to add to the start of the header, and the header
# start in 0x200
>&(&-12.l-0x21) byte    x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
>>&0x0          string  >\x2f          \b, UUID: %.6s
>>&0x6          string  >\x2f          \b-%.4s
>>&0xa          string  >\x2f          \b-%.4s
>>&0xe          string  >\x2f          \b-%.4s
>>&0x12         string  >\x2f          \b-%.4s
>>&0x16         string  >\x2f          \b-%.4s
>>&0x1a         string  >\x2f          \b-%.6s
>>&0x20         lequad  x              \b, size: %lld

0x018           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
>&(&-12.l-0x21) byte    x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
>>&0x0          string  >\x2f          \b, UUID: %.6s
>>&0x6          string  >\x2f          \b-%.4s
>>&0xa          string  >\x2f          \b-%.4s
>>&0xe          string  >\x2f          \b-%.4s
>>&0x12         string  >\x2f          \b-%.4s
>>&0x16         string  >\x2f          \b-%.4s
>>&0x1a         string  >\x2f          \b-%.6s
>>&0x20         lequad  x              \b, size: %lld

0x418           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
>&(&-12.l-0x21) byte    x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
>>&0x0          string  >\x2f          \b, UUID: %.6s
>>&0x6          string  >\x2f          \b-%.4s
>>&0xa          string  >\x2f          \b-%.4s
>>&0xe          string  >\x2f          \b-%.4s
>>&0x12         string  >\x2f          \b-%.4s
>>&0x16         string  >\x2f          \b-%.4s
>>&0x1a         string  >\x2f          \b-%.6s
>>&0x20         lequad  x              \b, size: %lld

0x618           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
>&(&-12.l-0x21) byte    x              
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
>>&0x0          string  >\x2f          \b, UUID: %.6s
>>&0x6          string  >\x2f          \b-%.4s
>>&0xa          string  >\x2f          \b-%.4s
>>&0xe          string  >\x2f          \b-%.4s
>>&0x12         string  >\x2f          \b-%.4s
>>&0x16         string  >\x2f          \b-%.4s
>>&0x1a         string  >\x2f          \b-%.6s
>>&0x20         lequad  x              \b, size: %lld

# LVM snapshot
# from Jason Farrel
0	string	SnAp	LVM Snapshot (CopyOnWrite store)
>4	lelong	!0	- valid,
>4	lelong	0	- invalid,
>8	lelong	x	version %d,
>12	lelong	x	chunk_size %d

# SE Linux policy database
0	lelong	0xf97cff8c		SE Linux policy
>16	lelong	x			v%d
>20	lelong	1			MLS
>24	lelong	x			%d symbols
>28	lelong	x			%d ocons

# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
# Anthon van der Neut (anthon@@mnt.org)
0	string	LUKS\xba\xbe	LUKS encrypted file,
>6	beshort x		ver %d
>8	string	x		[%s,
>40	string	x		%s,
>72	string	x		%s]
>168	string	x		UUID: %s


# Summary: Xen saved domain file
# Created by: Radek Vokal <rvokal@@redhat.com>
0	string		LinuxGuestRecord	Xen saved domain
>20	search/256	(name			
>>&1	string		x			(name %s)

# Type: Xen, the virtual machine monitor
# From: Radek Vokal <rvokal@@redhat.com>
0	string		LinuxGuestRecord	Xen saved domain
#>2	regex		\(name\ [^)]*\)		%s
>20	search/256	(name			(name
>>&1	string		x			%s...)
@


1.4.2.1
log
@file linux was added on branch RELENG_8_4 on 2013-03-28 13:00:45 +0000
@
text
@d1 340
@


1.4.2.2
log
@## SVN ## Exported commit - http://svnweb.freebsd.org/changeset/base/248810
## SVN ## CVS IS DEPRECATED: http://wiki.freebsd.org/CvsIsDeprecated
@
text
@a0 264
#------------------------------------------------------------------------------
# linux:  file(1) magic for Linux files
#
# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@@yggdrasil.com>
# The following basic Linux magic is useful for reference, but using
# "long" magic is a better practice in order to avoid collisions.
#
# 2	leshort		100		Linux/i386
# >0	leshort		0407		impure executable (OMAGIC)
# >0	leshort		0410		pure executable (NMAGIC)
# >0	leshort		0413		demand-paged executable (ZMAGIC)
# >0	leshort		0314		demand-paged executable (QMAGIC)
#
0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)
>16	lelong		0		\b, stripped
0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)
>16	lelong		0		\b, stripped
#
0	string		\007\001\000	Linux/i386 object file
>20	lelong		>0x1020		\b, DLL library
# Linux-8086 stuff:
0	string		\01\03\020\04	Linux-8086 impure executable
>28	long		!0		not stripped
0	string		\01\03\040\04	Linux-8086 executable
>28	long		!0		not stripped
#
0	string		\243\206\001\0	Linux-8086 object file
#
0	string		\01\03\020\20	Minix-386 impure executable
>28	long		!0		not stripped
0	string		\01\03\040\20	Minix-386 executable
>28	long		!0		not stripped
# core dump file, from Bill Reynolds <bill@@goshawk.lanl.gov>
216	lelong		0421		Linux/i386 core file
>220	string		>\0		of '%s'
>200	lelong		>0		(signal %d)
#
# LILO boot/chain loaders, from Daniel Quinlan <quinlan@@yggdrasil.com>
# this can be overridden by the DOS executable (COM) entry
2	string		LILO		Linux/i386 LILO boot/chain loader
#
# PSF fonts, from H. Peter Anvin <hpa@@yggdrasil.com>
0	leshort		0x0436		Linux/i386 PC Screen Font data,
>2	byte		0		256 characters, no directory,
>2	byte		1		512 characters, no directory,
>2	byte		2		256 characters, Unicode directory,
>2	byte		3		512 characters, Unicode directory,
>3	byte		>0		8x%d
# Linux swap file, from Daniel Quinlan <quinlan@@yggdrasil.com>
4086	string		SWAP-SPACE	Linux/i386 swap file
# From: Jeff Bailey <jbailey@@ubuntu.com>
# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@@ubuntu.com>
4076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
# according to man page of mkswap (8) March 1999
4086	string		SWAPSPACE2	Linux/i386 swap file (new style)
>0x400	long		x		%d (4K pages)
>0x404	long		x		size %d pages
>>4086	string		SWAPSPACE2	
>>>1052	string		>\0		Label %s
# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
#
#	from Erik Troan (ewt@@redhat.com) examining od dumps, so this
#		could be wrong
#      updated by David Mosberger (davidm@@azstarnet.com) based on
#      GNU BFD and MIPS info found below.
#
0	leshort		0x0183		ECOFF alpha
>24	leshort		0407		executable
>24	leshort		0410		pure
>24	leshort		0413		demand paged
>8	long		>0		not stripped
>8	long		0		stripped
>23	leshort		>0		- version %ld.
#
# Linux kernel boot images, from Albert Cahalan <acahalan@@cs.uml.edu>
# and others such as Axel Kohlmeyer <akohlmey@@rincewind.chemie.uni-ulm.de>
# and Nicols Lichtmaier <nick@@debian.org>
# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29
# Linux kernel boot images (i386 arch) (Wolfram Kleff)
514	string		HdrS		Linux kernel
>510	leshort		0xAA55		x86 boot executable
>>518	leshort		>0x1ff
>>>529	byte		0		zImage,
>>>529	byte		1		bzImage,
>>>(526.s+0x200) string	>\0		version %s,
>>498	leshort		1		RO-rootFS,
>>498	leshort		0		RW-rootFS,
>>508	leshort		>0		root_dev 0x%X,
>>502	leshort		>0		swap_dev 0x%X,
>>504	leshort		>0		RAMdisksize %u KB,
>>506	leshort		0xFFFF		Normal VGA
>>506	leshort		0xFFFE		Extended VGA
>>506	leshort		0xFFFD		Prompt for Videomode
>>506	leshort		>0		Video mode %d
# This also matches new kernels, which were caught above by "HdrS".
0		belong	0xb8c0078e	Linux kernel
>0x1e3		string	Loading		version 1.3.79 or older
>0x1e9		string	Loading		from prehistoric times

# System.map files - Nicols Lichtmaier <nick@@debian.org>
8	search/1	\ A\ _text	Linux kernel symbol map text

# LSM entries - Nicols Lichtmaier <nick@@debian.org>
0	search/1	Begin3	Linux Software Map entry text
0	search/1	Begin4	Linux Software Map entry text (new format)

# From Matt Zimmerman, enhanced for v3 by Matthew Palmer
0	belong	0x4f4f4f4d	User-mode Linux COW file
>4	belong	<3		\b, version %d
>>8	string	>\0		\b, backing file %s
>4	belong	>2		\b, version %d
>>32	string	>\0		\b, backing file %s

############################################################################
# Linux kernel versions

0		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
>497		leshort		0		x86 boot sector
>>514		belong		0x8e	of a kernel from the dawn of time!
>>514		belong		0x908ed8b4	version 0.99-1.1.42
>>514		belong		0x908ed8b8	for memtest86

>497		leshort		!0		x86 kernel
>>504		leshort		>0		RAMdisksize=%u KB
>>502		leshort		>0		swap=0x%X
>>508		leshort		>0		root=0x%X
>>>498		leshort		1		\b-ro
>>>498		leshort		0		\b-rw
>>506		leshort		0xFFFF		vga=normal
>>506		leshort		0xFFFE		vga=extended
>>506		leshort		0xFFFD		vga=ask
>>506		leshort		>0		vga=%d
>>514		belong		0x908ed881	version 1.1.43-1.1.45
>>514		belong		0x15b281cd
>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
>>514		string		HdrS
>>>518		leshort		>0x1FF
>>>>529		byte		0		\b, zImage
>>>>529		byte		1		\b, bzImage
>>>>(526.s+0x200) string 	>\0		\b, version %s

# Linux boot sector thefts.
0		belong		0xb8c0078e	Linux
>0x1e6		belong		0x454c4b53	ELKS Kernel
>0x1e6		belong		!0x454c4b53	style boot sector

############################################################################
# Linux 8086 executable
0	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
>5	string		.		
>>4	string		>\0		\b, libc version %s

0	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
>2	byte&0x01	!0		\b, unmapped zero page
>2	byte&0x20	0		\b, impure
>2	byte&0x20	!0
>>2	byte&0x10	!0		\b, A_EXEC
>2	byte&0x02	!0		\b, A_PAL
>2	byte&0x04	!0		\b, A_NSYM
>2	byte&0x08	!0		\b, A_STAND
>2	byte&0x40	!0		\b, A_PURE
>2	byte&0x80	!0		\b, A_TOVLY
>28     long            !0              \b, not stripped
>37	string		.		
>>36	string		>\0		\b, libc version %s

# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable

# SYSLINUX boot logo files (from 'ppmtolss16' sources)
# http://syslinux.zytor.com/
#
0	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
>4	leshort	x			\b, width %d
>6	leshort	x			\b, height %d

0	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
>4	belong	x			version %d

# SE Linux policy database
# From: Mike Frysinger <vapier@@gentoo.org>
0	lelong	0xf97cff8c		SE Linux policy
>16	lelong	x			v%d
>20	lelong	1			MLS
>24	lelong	x			%d symbols
>28	lelong	x			%d ocons

# Linux Logical Volume Manager (LVM) 
# Emmanuel VARAGNAT <emmanuel.varagnat@@guzu.net>
#
# System ID, UUID and volume group name are 128 bytes long
# but they should never be full and initialized with zeros...
#
# LVM1
#
0x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
>0x12c	string	>\0		, System ID: %s

0x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
>0x12c	string	>\0		, System ID: %s

#  LVM2
#
# It seems that the label header can be in one the four first sector
# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
#
# 0x200 seems to be the common case

0x218		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
# read the offset to add to the start of the header, and the header
# start in 0x200
>(0x214.l+0x200) string	>\0		, UUID: %s

0x018		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x014.l)	 string	>\0		, UUID: %s

0x418		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x414.l+0x400) string	>\0		, UUID: %s

0x618		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x614.l+0x600) string	>\0		, UUID: %s

# LVM snapshot
# from Jason Farrel
0	string	SnAp	LVM Snapshot (CopyOnWrite store)
>4	lelong	!0	- valid,
>4	lelong	0	- invalid,
>8	lelong	x	version %d,
>12	lelong	x	chunk_size %d

# SE Linux policy database
0	lelong	0xf97cff8c		SE Linux policy
>16	lelong	x			v%d
>20	lelong	1			MLS
>24	lelong	x			%d symbols
>28	lelong	x			%d ocons

# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
# Anthon van der Neut (anthon@@mnt.org)
0	string	LUKS\xba\xbe	LUKS encrypted file,
>6	beshort x		ver %d
>8	string	x		[%s,
>40	string	x		%s,
>72	string	x		%s]
>168	string	x		UUID: %s


# Summary: Xen saved domain file
# Created by: Radek Vokal <rvokal@@redhat.com>
0	string		LinuxGuestRecord	Xen saved domain
>20	search/256	(name			
>>&1	string		x			(name %s)

@


1.3
log
@SVN rev 192350 on 2009-05-18 22:34:33Z by delphij

Merge vendor/file/dist@@192348, bringing FILE 5.03 to 8-CURRENT.

Security:	CVE-2009-1515
@
text
@d1 1
d3 1
d48 3
d52 7
a58 5
0	leshort		0x0436		Linux/i386 PC Screen Font data,
>2	byte		0		256 characters, no directory,
>2	byte		1		512 characters, no directory,
>2	byte		2		256 characters, Unicode directory,
>2	byte		3		512 characters, Unicode directory,
d60 7
d72 2
d75 16
a90 19
4086	string		SWAPSPACE2	Linux/i386 swap file (new style)
>0x400	long		x		%d (4K pages)
>0x404	long		x		size %d pages
>>4086	string		SWAPSPACE2	
>>>1052	string		>\0		Label %s
# ECOFF magic for OSF/1 and Linux (only tested under Linux though)
#
#	from Erik Troan (ewt@@redhat.com) examining od dumps, so this
#		could be wrong
#      updated by David Mosberger (davidm@@azstarnet.com) based on
#      GNU BFD and MIPS info found below.
#
0	leshort		0x0183		ECOFF alpha
>24	leshort		0407		executable
>24	leshort		0410		pure
>24	leshort		0413		demand paged
>8	long		>0		not stripped
>8	long		0		stripped
>23	leshort		>0		- version %ld.
d170 21
d254 1
a254 1
0x218		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
d257 46
a302 10
>(0x214.l+0x200) string	>\0		, UUID: %s

0x018		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x014.l)	 string	>\0		, UUID: %s

0x418		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x414.l+0x400) string	>\0		, UUID: %s

0x618		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x614.l+0x600) string	>\0		, UUID: %s
d335 6
@


1.3.10.1
log
@SVN rev 237983 on 2012-07-02 08:48:58Z by obrien

MFC: r234449: update file(1) to version 5.11.
@
text
@a0 1

a1 1
# $File: linux,v 1.42 2012/02/07 21:35:03 christos Exp $
a45 3
# Linux make config build file, from Ole Aamot <oka@@oka.no>
28 	string		make\ config	Linux make config build file
#
d47 5
a51 7
# Updated by Adam Buchbinder <adam.buchbinder@@gmail.com>
# See: http://www.win.tue.nl/~aeb/linux/kbd/font-formats-1.html
0	leshort		0x0436		Linux/i386 PC Screen Font v1 data,
>2	byte&0x01	0		256 characters,
>2	byte&0x01	!0		512 characters,
>2	byte&0x02	0		no directory,
>2	byte&0x02	!0		Unicode directory,
a52 7
0	string		\x72\xb5\x4a\x86\x00\x00 Linux/i386 PC Screen Font v2 data,
>16	lelong		x		%d characters,
>12	lelong&0x01	0		no directory,
>12	lelong&0x01	!0		Unicode directory,
>24	lelong		x		%d
>28	lelong		x		\bx%d

a57 2
# From: James Hunt <james.hunt@@ubuntu.com>
4076    string          SWAPSPACE2LINHIB0001    Linux/i386 swap file (new style) (compressed hibernate)
d59 19
a77 16
# volume label and UUID Russell Coker
# http://etbe.coker.com.au/2008/07/08/label-vs-uuid-vs-device/
4086	string		SWAPSPACE2	Linux/i386 swap file (new style),
>0x400	long		x		version %d (4K pages),
>0x404	long		x		size %d pages,
>1052	string		\0		no label,
>1052	string		>\0		LABEL=%s,
>0x40c	belong		x		UUID=%08x
>0x410	beshort		x		\b-%04x
>0x412	beshort		x		\b-%04x
>0x414	beshort		x		\b-%04x
>0x416	belong		x		\b-%08x
>0x41a	beshort		x		\b%04x
# From Daniel Novotny <dnovotny@@redhat.com>
# swap file for PowerPC
65526	string		SWAPSPACE2	Linux/ppc swap file
a156 21
# Linux S390 kernel image
# Created by: Jan Kaluza <jkaluza@@redhat.com>
8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
>0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
# 64bit
>>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
>>&0 string \xc1\x00\xef\xc3\x00\x00\x00\x00 Z9-109 64bit kernel
>>&0 string \xc0\x00\x20\x00\x00\x00\x00\x00 Z990 64bit kernel
>>&0 string \x00\x00\x00\x00\x00\x00\x00\x00 Z900 64bit kernel
# 32bit
>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z10 32bit kernel
>>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
>>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
>>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel

# Linux ARM compressed kernel image
# From: Kevin Cernekee <cernekee@@gmail.com>
36	lelong	0x016f2818	Linux kernel ARM boot executable zImage (little-endian)
36	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)

############################################################################
d220 1
a220 1
0x218           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
d223 10
a232 46
>&(&-12.l-0x21) byte    x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
>>&0x0          string  >\x2f          \b, UUID: %.6s
>>&0x6          string  >\x2f          \b-%.4s
>>&0xa          string  >\x2f          \b-%.4s
>>&0xe          string  >\x2f          \b-%.4s
>>&0x12         string  >\x2f          \b-%.4s
>>&0x16         string  >\x2f          \b-%.4s
>>&0x1a         string  >\x2f          \b-%.6s
>>&0x20         lequad  x              \b, size: %lld

0x018           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
>&(&-12.l-0x21) byte    x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
>>&0x0          string  >\x2f          \b, UUID: %.6s
>>&0x6          string  >\x2f          \b-%.4s
>>&0xa          string  >\x2f          \b-%.4s
>>&0xe          string  >\x2f          \b-%.4s
>>&0x12         string  >\x2f          \b-%.4s
>>&0x16         string  >\x2f          \b-%.4s
>>&0x1a         string  >\x2f          \b-%.6s
>>&0x20         lequad  x              \b, size: %lld

0x418           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
>&(&-12.l-0x21) byte    x
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
>>&0x0          string  >\x2f          \b, UUID: %.6s
>>&0x6          string  >\x2f          \b-%.4s
>>&0xa          string  >\x2f          \b-%.4s
>>&0xe          string  >\x2f          \b-%.4s
>>&0x12         string  >\x2f          \b-%.4s
>>&0x16         string  >\x2f          \b-%.4s
>>&0x1a         string  >\x2f          \b-%.6s
>>&0x20         lequad  x              \b, size: %lld

0x618           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
>&(&-12.l-0x21) byte    x              
# display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
>>&0x0          string  >\x2f          \b, UUID: %.6s
>>&0x6          string  >\x2f          \b-%.4s
>>&0xa          string  >\x2f          \b-%.4s
>>&0xe          string  >\x2f          \b-%.4s
>>&0x12         string  >\x2f          \b-%.4s
>>&0x16         string  >\x2f          \b-%.4s
>>&0x1a         string  >\x2f          \b-%.6s
>>&0x20         lequad  x              \b, size: %lld
a264 6
# Type: Xen, the virtual machine monitor
# From: Radek Vokal <rvokal@@redhat.com>
0	string		LinuxGuestRecord	Xen saved domain
#>2	regex		\(name\ [^)]*\)		%s
>20	search/256	(name			(name
>>&1	string		x			%s...)
@


1.2
log
@SVN rev 186691 on 2009-01-02 03:10:55Z by obrien

Record that base/vendor/file/dist@@186675 was merged.
Merge base/vendor/file/dist@@186675@@186690, bringing FILE 4.26 to 8-CURRENT.
@
text
@d87 1
a87 1
>>529	byte		0		zImage,
@


1.1
log
@Initial revision
@
text
@a0 1

a45 5
# Debian Packages, from Peter Tobias <tobias@@server.et-inf.fho-emden.de>
0	string		0.9
>8	byte		0x0a		old Debian Binary Package
>>3	byte		>0		\b, created by dpkg 0.9%c
>>4	byte		>0		pl%c
d55 9
d83 16
a98 16
514		string	HdrS		Linux kernel
>518		leshort	>0
>>529		byte	0		zImage data,
>>529		byte	1		bzImage data,
>0x048c		byte	0x31
>>0x048c	string	x		version %s
>0x0493		byte	0x31
>>0x0493	string	x		version %s
>0x048c		byte	0x32
>>0x048c	string	x		version %s
>0x0493		byte	0x32
>>0x0493	string	x		version %s
>0x04df		byte	0x32
>>0x04df	string	x		version %s
>0x04fb		byte	0x32
>>0x04fb	string	x		version %s
d103 162
a264 2
# LSM entries - Nicols Lichtmaier <nick@@feedback.net.ar>
0	string	Begin3	Linux Software Map entry text
@


1.1.1.1
log
@Virgin import of FILE 3.32
@
text
@@


1.1.1.2
log
@Virgin import of Christos Zoulas's FILE 3.39.
@
text
@a60 2
# according to man page of mkswap (8) March 1999
4086	string		SWAPSPACE2	Linux/i386 swap file (new style)
a101 64

############################################################################
# Linux kernel versions

0		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
>497		leshort		0		x86 boot sector
>>514		belong		0x8e	of a kernel from the dawn of time!
>>514		belong		0x908ed8b4	version 0.99-1.1.42
>>514		belong		0x908ed8b8	for memtest86

>497		leshort		!0		x86 kernel
>>504		leshort		>0		RAMdisksize=%u KB
>>502		leshort		>0		swap=0x%X
>>508		leshort		>0		root=0x%X
>>>498		leshort		1		\b-ro
>>>498		leshort		0		\b-rw
>>506		leshort		0xFFFF		vga=normal
>>506		leshort		0xFFFE		vga=extended
>>506		leshort		0xFFFD		vga=ask
>>506		leshort		>0		vga=%d
>>514		belong		0x908ed881	version 1.1.43-1.1.45
>>514		belong		0x15b281cd
>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
>>514		string		HdrS
>>>518		leshort		>0x1FF
>>>>529		byte		0		\b, zImage
>>>>529		byte		1		\b, bzImage
>>>>(526.s+0x200) string 	>\0		\b, version %s

# Linux boot sector thefts.
0		belong		0xb8c0078e	Linux
>0x1e6		belong		0x454c4b53	ELKS Kernel
>0x1e6		belong		!0x454c4b53	style boot sector

############################################################################
# Linux 8086 executable
0	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
>5	string		.		
>>4	string		>\0		\b, libc version %s

0	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
>2	byte&0x01	!0		\b, unmapped zero page
>2	byte&0x20	0		\b, impure
>2	byte&0x20	!0
>>2	byte&0x10	!0		\b, A_EXEC
>2	byte&0x02	!0		\b, A_PAL
>2	byte&0x04	!0		\b, A_NSYM
>2	byte&0x08	!0		\b, A_STAND
>2	byte&0x40	!0		\b, A_PURE
>2	byte&0x80	!0		\b, A_TOVLY
>28     long            !0              \b, not stripped
>37	string		.		
>>36	string		>\0		\b, libc version %s

# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable

@


1.1.1.3
log
@Virgin import of Christos Zoulas's FILE 4.10.
*- file is now broken into a library containing and processing the magic
   and a consumer binary.
@
text
@d47 5
a62 2
>0x400	long		x		%d (4K pages)
>0x404	long		x		size %d pages
d82 16
a97 16
# Linux kernel boot images (i386 arch) (Wolfram Kleff)
514	string		HdrS		Linux kernel
>510	leshort		0xAA55		x86 boot executable
>>518	leshort		>=3D0x200
>>529	byte		0		zImage,
>>>529	byte		1		bzImage,
>>>(526.s+0x200) string	>\0		version %s,
>>498	leshort		1		RO-rootFS,
>>498	leshort		0		RW-rootFS,
>>508	leshort		>0		root_dev 0x%X,
>>502	leshort		>0		swap_dev 0x%X,
>>504	leshort		>0		RAMdisksize %u KB,
>>506	leshort		0xFFFF		Normal VGA
>>506	leshort		0xFFFE		Extended VGA
>>506	leshort		0xFFFD		Prompt for Videomode
>>506	leshort		>0		Video mode %d
d102 1
a102 5

# System.map files - Nicols Lichtmaier <nick@@debian.org>
8	string	\ A\ _text	Linux kernel symbol map text

# LSM entries - Nicols Lichtmaier <nick@@debian.org>
a103 6
0	string	Begin4	Linux Software Map entry text (new format)

# From Matt Zimmerman
0       belong  0x4f4f4f4d      User-mode Linux COW file
>4      belong  x               \b, version %d
>8      string  >\0             \b, backing file %s
@


1.1.1.4
log
@Virgin import of Christos Zoulas's FILE 4.12.
@
text
@a174 6
# SYSLINUX boot logo files (from 'ppmtolss16' sources)
# http://syslinux.zytor.com/
#
0	lelong	=0x1413f33d		SYSLINUX' LSS16 image data
>4	leshort	x			\b, width %d
>6	leshort	x			\b, height %d
@


1.1.1.4.2.1
log
@MFC file 4.21
@
text
@a55 3
# From: Jeff Bailey <jbailey@@ubuntu.com>
# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@@ubuntu.com>
4076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
a59 2
>>4086	string		SWAPSPACE2	
>>>1052	string		>\0		Label %s
d82 1
a82 1
>>518	leshort		>=0x200
a180 63

0	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
>4	belong	x			version %d

# SE Linux policy database
# From: Mike Frysinger <vapier@@gentoo.org>
0	lelong	0xf97cff8c		SE Linux policy
>16	lelong	x			v%d
>20	lelong	1			MLS
>24	lelong	x			%d symbols
>28	lelong	x			%d ocons

# Linux Logical Volume Manager (LVM) 
# Emmanuel VARAGNAT <emmanuel.varagnat@@guzu.net>
#
# System ID, UUID and volume group name are 128 bytes long
# but they should never be full and initialized with zeros...
#
# LVM1
#
0x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
>0x12c	string	>\0		, System ID: %s

0x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
>0x12c	string	>\0		, System ID: %s

#  LVM2
#
# It seems that the label header can be in one the four first sector
# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
#
# 0x200 seems to be the common case

0x218		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
# read the offset to add to the start of the header, and the header
# start in 0x200
>(0x214.l+0x200) string	>\0		, UUID: %s

0x018		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x014.l)	 string	>\0		, UUID: %s

0x418		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x414.l+0x400) string	>\0		, UUID: %s

0x618		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x614.l+0x600) string	>\0		, UUID: %s

# SE Linux policy database
0	lelong	0xf97cff8c		SE Linux policy
>16	lelong	x			v%d
>20	lelong	1			MLS
>24	lelong	x			%d symbols
>28	lelong	x			%d ocons

# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
# Anthon van der Neut (anthon@@mnt.org)
0	string	LUKS\xba\xbe	LUKS encrypted file,
>6	beshort x		ver %d
>8	string	x		[%s,
>40	string	x		%s,
>72	string	x		%s]
>168	string	x		UUID: %s

@


1.1.1.5
log
@Virgin import of Christos Zoulas's FILE 4.17.
@
text
@a55 3
# From: Jeff Bailey <jbailey@@ubuntu.com>
# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@@ubuntu.com>
4076	string		SWAPSPACE2S1SUSPEND	Linux/i386 swap file (new style) with SWSUSP1 image
a59 2
>>4086	string		SWAPSPACE2	
>>>1052	string		>\0		Label %s
d82 1
a82 1
>>518	leshort		>=0x200
a180 46

0	string	OOOM			User-Mode-Linux's Copy-On-Write disk image
>4	belong	x			version %d

# SE Linux policy database
# From: Mike Frysinger <vapier@@gentoo.org>
0	lelong	0xf97cff8c		SE Linux policy
>16	lelong	x			v%d
>20	lelong	1			MLS
>24	lelong	x			%d symbols
>28	lelong	x			%d ocons

# Linux Logical Volume Manager (LVM) 
# Emmanuel VARAGNAT <emmanuel.varagnat@@guzu.net>
#
# System ID, UUID and volume group name are 128 bytes long
# but they should never be full and initialized with zeros...
#
# LVM1
#
0x0	string	HM\001		LVM1 (Linux Logical Volume Manager), version 1
>0x12c	string	>\0		, System ID: %s

0x0	string	HM\002		LVM1 (Linux Logical Volume Manager), version 2
>0x12c	string	>\0		, System ID: %s

#  LVM2
#
# It seems that the label header can be in one the four first sector
# of the disk... (from _find_labeller in lib/label/label.c of LVM2)
#
# 0x200 seems to be the common case

0x218		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
# read the offset to add to the start of the header, and the header
# start in 0x200
>(0x214.l+0x200) string	>\0		, UUID: %s

0x018		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x014.l)	 string	>\0		, UUID: %s

0x418		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x414.l+0x400) string	>\0		, UUID: %s

0x618		 string	LVM2\ 001	LVM2 (Linux Logical Volume Manager)
>(0x614.l+0x600) string	>\0		, UUID: %s
@


1.1.1.6
log
@Virgin import of Christos Zoulas's FILE 4.19.
@
text
@a231 7

# SE Linux policy database
0	lelong	0xf97cff8c		SE Linux policy
>16	lelong	x			v%d
>20	lelong	1			MLS
>24	lelong	x			%d symbols
>28	lelong	x			%d ocons
@


1.1.1.7
log
@Virgin import of Christos Zoulas's FILE 4.21.
@
text
@a238 10

# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec
# Anthon van der Neut (anthon@@mnt.org)
0	string	LUKS\xba\xbe	LUKS encrypted file,
>6	beshort x		ver %d
>8	string	x		[%s,
>40	string	x		%s,
>72	string	x		%s]
>168	string	x		UUID: %s

@


1.1.1.1.2.1
log
@MFC:  Christos Zoulas's FILE 3.33
@
text
@@


1.1.1.1.2.2
log
@MFC: file version 3.41

Approved by:	murray(re)
Desired by:		nectar(so)
@
text
@a60 2
# according to man page of mkswap (8) March 1999
4086	string		SWAPSPACE2	Linux/i386 swap file (new style)
a101 64

############################################################################
# Linux kernel versions

0		string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90	Linux
>497		leshort		0		x86 boot sector
>>514		belong		0x8e	of a kernel from the dawn of time!
>>514		belong		0x908ed8b4	version 0.99-1.1.42
>>514		belong		0x908ed8b8	for memtest86

>497		leshort		!0		x86 kernel
>>504		leshort		>0		RAMdisksize=%u KB
>>502		leshort		>0		swap=0x%X
>>508		leshort		>0		root=0x%X
>>>498		leshort		1		\b-ro
>>>498		leshort		0		\b-rw
>>506		leshort		0xFFFF		vga=normal
>>506		leshort		0xFFFE		vga=extended
>>506		leshort		0xFFFD		vga=ask
>>506		leshort		>0		vga=%d
>>514		belong		0x908ed881	version 1.1.43-1.1.45
>>514		belong		0x15b281cd
>>>0xa8e	belong		0x55AA5a5a	version 1.1.46-1.2.13,1.3.0
>>>0xa99	belong		0x55AA5a5a	version 1.3.1,2
>>>0xaa3	belong		0x55AA5a5a	version 1.3.3-1.3.30
>>>0xaa6	belong		0x55AA5a5a	version 1.3.31-1.3.41
>>>0xb2b	belong		0x55AA5a5a	version 1.3.42-1.3.45
>>>0xaf7	belong		0x55AA5a5a	version 1.3.46-1.3.72
>>514		string		HdrS
>>>518		leshort		>0x1FF
>>>>529		byte		0		\b, zImage
>>>>529		byte		1		\b, bzImage
>>>>(526.s+0x200) string 	>\0		\b, version %s

# Linux boot sector thefts.
0		belong		0xb8c0078e	Linux
>0x1e6		belong		0x454c4b53	ELKS Kernel
>0x1e6		belong		!0x454c4b53	style boot sector

############################################################################
# Linux 8086 executable
0	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
>5	string		.		
>>4	string		>\0		\b, libc version %s

0	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
>2	byte&0x01	!0		\b, unmapped zero page
>2	byte&0x20	0		\b, impure
>2	byte&0x20	!0
>>2	byte&0x10	!0		\b, A_EXEC
>2	byte&0x02	!0		\b, A_PAL
>2	byte&0x04	!0		\b, A_NSYM
>2	byte&0x08	!0		\b, A_STAND
>2	byte&0x40	!0		\b, A_PURE
>2	byte&0x80	!0		\b, A_TOVLY
>28     long            !0              \b, not stripped
>37	string		.		
>>36	string		>\0		\b, libc version %s

# 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
# 0	lelong&0xFF00FFFF 0xB000301	ld86 M68K executable
# 0	lelong&0xFF00FFFF 0xC000301	ld86 NS16K executable
# 0	lelong&0xFF00FFFF 0x17000301	ld86 SPARC executable

@


