src - FreeBSD source tree

diff options


context:
space:
mode:

author	Xin LI <delphij@FreeBSD.org>	2022-09-24 04:20:34 +0000
committer	Xin LI <delphij@FreeBSD.org>	2022-09-24 04:20:34 +0000
commit	ac33800609941e32486585331e2d4af9ecdd554b (patch)
tree	d643ef47f63c6734de36c5d0ee5fa380d35502da /magic
parent	5457a3f25818dc2a14ec8a58c6f27dc42a50cdd4 (diff)
download	src-vendor/file/5.43.tar.gz src-vendor/file/5.43.zip

Vendor import of file 5.43.vendor/file/5.43

Diffstat (limited to 'magic')

-rw-r--r--

magic/Magdir/animation

-rw-r--r--

magic/Magdir/archive

-rw-r--r--

magic/Magdir/audio

176

-rw-r--r--

magic/Magdir/burp

-rw-r--r--

magic/Magdir/cafebabe

-rw-r--r--

magic/Magdir/compress

-rw-r--r--

magic/Magdir/database

-rw-r--r--

magic/Magdir/der

-rw-r--r--

magic/Magdir/filesystems

-rw-r--r--

magic/Magdir/fonts

-rw-r--r--

magic/Magdir/gentoo

-rw-r--r--

magic/Magdir/images

133

-rw-r--r--

magic/Magdir/javascript

101

-rw-r--r--

magic/Magdir/jpeg

119

-rw-r--r--

magic/Magdir/linux

-rw-r--r--

magic/Magdir/luks

117

-rw-r--r--

magic/Magdir/mail.news

-rw-r--r--

magic/Magdir/msdos

223

-rw-r--r--

magic/Magdir/msooxml

-rw-r--r--

magic/Magdir/ole2compounddocs

-rw-r--r--

magic/Magdir/pascal

-rw-r--r--

magic/Magdir/python

118

-rw-r--r--

magic/Magdir/riff

-rw-r--r--

magic/Magdir/ringdove

-rw-r--r--

magic/Magdir/sgml

-rw-r--r--

magic/Magdir/sniffer

-rw-r--r--

magic/Magdir/sql

-rw-r--r--

magic/Magdir/subtitle

-rw-r--r--

magic/Magdir/virtual

-rw-r--r--

magic/Magdir/webassembly

-rw-r--r--

magic/Magdir/windows

176

-rw-r--r--

magic/Magdir/wordprocessors

174

-rw-r--r--

magic/Magdir/xo65

-rw-r--r--

magic/Makefile.am

-rw-r--r--

magic/Makefile.in

35 files changed, 1617 insertions, 205 deletions

diff --git a/magic/Magdir/animation b/magic/Magdir/animation
index 28a0f2d217aa..057346518193 100644
--- a/magic/Magdir/animation
+++ b/magic/Magdir/animation

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: animation,v 1.88 2022/05/14 22:06:04 christos Exp $

+# $File: animation,v 1.90 2022/08/16 11:16:39 christos Exp $

# animation: file(1) magic for animation/movie formats

# animation formats

@@ -30,8 +30,6 @@

#!:mime image/x-quicktime

4 string pckg Apple QuickTime compressed archive

!:mime application/x-quicktime-player

-4 string/W jP JPEG 2000 image

-!:mime image/jp2

#### MP4 ####

# https://www.ftyps.com/ with local additions

@@ -168,6 +166,7 @@

# ?/enc-isoff-generic

>8 string iso \b, MP4 Base Media

!:mime video/mp4

+!:ext mp4

>>11 string m v1 [ISO 14496-12:2003]

>>11 string 2 v2 [ISO 14496-12:2005]

>>11 string 4 v4

@@ -937,6 +936,7 @@

0 belong&0xFF5FFF10 0x47400010

>188 byte 0x47 MPEG transport stream data

!:mime video/MP2T

+!:ext ts

# DIF digital video file format <mpruett@sgi.com>

0 belong&0xffffff00 0x1f070000 DIF

diff --git a/magic/Magdir/archive b/magic/Magdir/archive
index fb535ac0ff26..758c93ef8e17 100644
--- a/magic/Magdir/archive
+++ b/magic/Magdir/archive

@@ -1,5 +1,5 @@

#------------------------------------------------------------------------------

-# $File: archive,v 1.162 2022/05/27 21:27:59 christos Exp $

+# $File: archive,v 1.169 2022/09/12 13:13:28 christos Exp $

# archive: file(1) magic for archive formats (see also "msdos" for self-

# extracting compressed archives)

@@ -25,7 +25,16 @@

>>>>>>155 ubyte&0xDF =0

# space or ascii digit 0 at start of check sum

>>>>>>>148 ubyte&0xEF =0x20

->>>>>>>>0 use tar-file

+# FOR DEBUGGING:

+#>>>>>>>>0 regex \^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp) NAME "%s"

+# check for 1st image main name with digits used for sorting

+# and for name extension case insensitive like: PNG JPG JPEG TIF TIFF GIF BMP

+>>>>>>>>0 regex \^[0-9]{2,4}[.](png|jpg|jpeg|tif|tiff|gif|bmp)

+#foo

+>>>>>>>>>0 use tar-cbt

+# if 1st member name without digits and without used image suffix then it is a TAR archive

+>>>>>>>>0 default x

+>>>>>>>>>0 use tar-file

# minimal check and then display tar archive information which can also be

# embedded inside others like Android Backup, Clam AntiVirus database

0 name tar-file

@@ -146,6 +155,19 @@

>>508 default x

# padding[255] in old tar sometimes comment field

>>>257 string >\0 \b, comment: %-.40s

+# Summary: Comic Book Archive *.CBT with TAR format

+# URL: https://en.wikipedia.org/wiki/Comic_book_archive

+# http://fileformats.archiveteam.org/wiki/Comic_Book_Archive

+# Note: there exist also RAR, ZIP, ACE and 7Z packed variants

+0 name tar-cbt

+>0 string x Comic Book archive, tar archive

+#!:mime application/x-tar

+!:mime application/vnd.comicbook

+#!:mime application/vnd.comicbook+tar

+!:ext cbt

+# name[100] probably like: 19.jpg 0001.png 0002.png

+# or maybe like ComicInfo.xml

+>0 string >\0 \b, 1st image %-.60s

# Incremental snapshot gnu-tar format from:

# https://www.gnu.org/software/tar/manual/html_node/Snapshot-Files.html

@@ -1724,13 +1746,17 @@

# Felix von Leitner <felix-file@fefe.de>

0 string d8:announce BitTorrent file

!:mime application/x-bittorrent

+!:ext torrent

# Durval Menezes, <jmgthbfile at durval dot com>

0 string d13:announce-list BitTorrent file

!:mime application/x-bittorrent

+!:ext torrent

0 string d7:comment BitTorrent file

!:mime application/x-bittorrent

+!:ext torrent

0 string d4:info BitTorrent file

!:mime application/x-bittorrent

+!:ext torrent

# Atari MSA archive - Teemu Hukkanen <tjhukkan@iki.fi>

# URL: http://fileformats.archiveteam.org/wiki/MSA_(Magic_Shadow_Archiver)

@@ -2081,3 +2107,6 @@

# URL: http://mattmahoney.net/dc/#paq9a

# Note: Line 1186 of paq9a.cpp gives the magic bytes

0 string pQ9\001 PAQ9A archive

+# From wof (wof@stachelkaktus.net)

+0 string Unison\ archive\ format Unison archive format

diff --git a/magic/Magdir/audio b/magic/Magdir/audio
index c85c2952336f..0328f7ba5e44 100644
--- a/magic/Magdir/audio
+++ b/magic/Magdir/audio

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: audio,v 1.121 2021/04/26 15:56:00 christos Exp $

+# $File: audio,v 1.124 2022/08/28 08:58:20 christos Exp $

# audio: file(1) magic for sound formats (see also "iff")

# Jan Nicolai Langfeldt (janl@ifi.uio.no), Dan Quinlan (quinlan@yggdrasil.com),

@@ -403,10 +403,26 @@

0 string THX AHX version

>3 byte =0 1 module data

>3 byte =1 2 module data

->10 byte x TRL: %u

->11 byte x TRK: %u

->12 byte x SMP: %u

->13 byte x SS: %u

+>11 ubyte x TRK: %u

+>10 ubyte x TRL: %u

+>12 ubyte x SMP: %u

+>13 ubyte x SS: %u

+>(4.H) string x Title: "%.128s"

+# header is mostly AHX format

+0 string HVL

+>3 byte <2 Hively Tracker Song

+>3 byte =0 v1 module data

+>3 byte =1 v2 module data

+>11 ubyte x TRK: %u

+>10 ubyte x TRL: %u

+>12 ubyte x SMP: %u

+>13 ubyte x SS: %u

+>8 ubyte/4 =0 CHN: 4

+>8 ubyte/4 >0 CHN: 4+%u

+#>-0 offset <0xffff

+>(4.H) string x Title: "%.128s"

0 string OKTASONG Oktalyzer module data

@@ -548,15 +564,13 @@

# From: Alex Myczko <alex@aiei.ch>

# https://github.com/rerrahkr/BambooTracker

-0 string BambooTrackerMod BambooTracker module

->22 byte x \b, version %u

->21 byte x \b.%u

->20 byte x \b.%u

-0 string BambooTrackerIst BambooTracker instrument

->22 byte x \b, version %u

->21 byte x \b.%u

->20 byte x \b.%u

+0 string BambooTracker BambooTracker

+>13 string Mod Module

+>13 string Ist Instrument

+>13 string Bnk Bank

+>22 byte x \b, version %u

+>21 byte x \b.%u

+>20 byte x \b.%u

0 string CC2x CheeseCutter 2 song

@@ -894,11 +908,6 @@

>0x3 byte&0x0F x \b%02d

>>0x4 string >\0 title: "%s"

-0 string HVL

->3 byte <2 Hively Tracker Song

->3 byte 0 1 module data

->3 byte 1 2 module data

0 string MO3

>3 ubyte <6 MOdule with MP3

>>3 byte 0 Version 0 (With MP3 and lossless)

@@ -1136,3 +1145,132 @@

>>0 use nintendo-3ds-bcwav-fields

>4 beshort 0xFEFF

>>0 use \^nintendo-3ds-bcwav-fields

+# Philips DSDIFF audio format (Direct Stream Digital Interchange File Format)

+# Used for DSD audio recordings and Super Audio CD (SACD) mastering annotations

+# https://dsd-guide.com/sites/default/files/white-papers/DSDIFF_1.5_Spec.pdf

+# From: Toni Ruottu <toni.ruottu@iki.fi>

+0 string FRM8

+12 string DSD\x20 DSDIFF audio bitstream data

+!:mime audio/x-dff

+!:ext dff

+# format version chunk

+>&0 string FVER

+# version 1

+>>&8 byte 1

+# v1 / sampling resolution ( 1 bit PDM only )

+>>>&0 string x \b, 1 bit

+# v1 / sound property chunk

+>>>&0 search/0xff PROP

+>>>>&8 string SND

+# v1 / sound property chunk / channel configuration chunk

+>>>>>&0 search/0xff CHNL

+>>>>>>&8 ubeshort 1 \b, mono

+>>>>>>&8 ubeshort 2

+>>>>>>>&0 string SLFTSRGT \b, stereo

+>>>>>>>&0 default x \b, 2 channels

+>>>>>>&8 ubeshort 3

+>>>>>>>&0 string SLFTSRGTLFE\x20 \b, 2.1 stereo

+>>>>>>>&0 string SLFTSRGTC\x20\x20\x20 \b, 3.0 stereo

+>>>>>>>&0 default x \b, 3 channels

+>>>>>>&8 ubeshort 4

+>>>>>>>&0 string MLFTMRGTLS\x20\x20RS\x20\x20 \b, 4.0 surround

+>>>>>>>&0 string SLFTSRGTC\x20\x20\x20LFE\x20 \b, 3.1 stereo

+>>>>>>>&0 default x \b, 4 channels

+>>>>>>&8 ubeshort 5

+>>>>>>>&0 string MLFTMRGTC\x20\x20\x20LS\x20\x20RS\x20\x20 \b, 5.0 surround

+>>>>>>>&0 string MLFTMRGTLFE\x20LS\x20\x20RS\x20\x20 \b, 4.1 surround

+>>>>>>>&0 default x \b, 5 channels

+>>>>>>&8 ubeshort 6

+>>>>>>>&0 string MLFTMRGTC\x20\x20\x20LFE\x20LS\x20\x20RS\x20\x20 \b, 5.1 surround

+>>>>>>>&0 default x \b, 6 channels

+>>>>>>&8 ubeshort >6 \b, %u channels

+# v1 / sound property chunk / sample rate chunk

+>>>>>&0 search/0xff FS\x20\x20

+>>>>>>&0 string x \b,

+>>>>>>&8 ubelong%44100 0

+>>>>>>>&-4 ubelong/44100 x "DSD %u"

+>>>>>>>&-4 ubelong x %u Hz

+# v1 / sound property chunk / compression type chunk

+>>>>>&0 search/0xff CMPR

+>>>>>>&8 string DSD\x20 \b, no compression

+>>>>>>&8 string DST\x20 \b, DST compression

+>>>>>>&8 default x \b, unknown compression

+# v1 / quest for metadata

+>>>&0 string x

+# v1 / quest for metadata / edited master information chunk

+>>>>&0 search DIIN

+>>>>>&0 ubequad >0 \b, "edited master" metadata

+# v1 / quest for metadata / ID3 chunk ( defacto standard )

+>>>>&0 search ID3\x20

+>>>>>&8 string ID3 \b, ID3 version 2

+>>>>>&0 byte x \b.%u

+>>>>>&1 byte x \b.%u

+# v1 / quest for metadata / failure ( possibly due to -P bytes=... being too low )

+>>>>&0 default x \b, ID3 missing (or unreachable)

+# version > 1 or 0

+>>&0 default x \b, unknown version

+# Sony DSF audio format (Direct Stream Digital Stream File)

+# Used for lossless digital storage of songs produced as DSD audio

+# Portable analog of a track stored on a Super Audio CD (SACD)

+# https://dsd-guide.com/sites/default/files/white-papers/DSFFileFormatSpec_E.pdf

+# From: Toni Ruottu <toni.ruottu@iki.fi>

+0 string DSD\x20 DSF audio bitstream data

+!:mime audio/x-dsf

+!:ext dsf

+# format chunk

+>28 string fmt\x20

+# version 1

+>>&8 ulelong 1

+# v1 / sampling resolution ( 1 bit PDM only )

+# NOTE: the spec incorrectly uses "bits per sample" instead of "bits per byte"

+>>>&0 string x \b, 1 bit

+# v1 / channel configuration

+>>>>&4 ulelong 1 \b, mono

+>>>>&4 ulelong 2 \b, stereo

+>>>>&4 ulelong 3 \b, 3.0 stereo

+>>>>&4 ulelong 4 \b, 4.0 surround

+>>>>&4 ulelong 5 \b, 3.1 stereo

+>>>>&4 ulelong 6 \b, 5.0 surround

+>>>>&4 ulelong 7 \b, 5.1 surround

+>>>>&0 default x

+>>>>>&4 ulelong x \b, %u channels

+# v1 / sample rate chunk

+>>>>&0 string x \b,

+>>>>&12 ulelong%44100 0

+>>>>>&-4 ulelong/44100 x "DSD %u"

+>>>>&12 ulelong x %u Hz

+# v1 / compression

+>>>>&0 string x

+>>>>>&0 ulelong 0 \b, no compression

+>>>>>&0 default x \b, unknown compression

+# v1 / embedded ID3v2 metadata

+>>>0 string x \b, ID3

+>>>>20 ulequad !0

+>>>>>(20.q) string ID3 version 2

+>>>>>>&0 byte x \b.%u

+>>>>>>&1 byte x \b.%u

+# unable to verify ID3 ( possibly due to -P bytes=... being too low )

+>>>>>&0 default x unreachable

+>>>>&0 default x missing

+# version > 1 or 0

+>>&0 default x \b, unknown version

diff --git a/magic/Magdir/burp b/magic/Magdir/burp
new file mode 100644
index 000000000000..460d18c4c27f
--- /dev/null
+++ b/magic/Magdir/burp

@@ -0,0 +1,7 @@

+#------------------------------------------------------------

+# $File: burp,v 1.1 2022/07/04 17:15:09 christos Exp $

+# Burp file, I don't know the version

+#------------------------------------------------------------

+# From wof (wof@stachelkaktus.net)

+0 bequad 0x6685828000000001 Burp project save file

diff --git a/magic/Magdir/cafebabe b/magic/Magdir/cafebabe
index 8cc0902b4cd5..4f97cc0345eb 100644
--- a/magic/Magdir/cafebabe
+++ b/magic/Magdir/cafebabe

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: cafebabe,v 1.27 2021/04/26 15:56:00 christos Exp $

+# $File: cafebabe,v 1.28 2022/07/01 23:24:47 christos Exp $

# Cafe Babes unite!

# Since Java bytecode and Mach-O universal binaries have the same magic number,

@@ -44,6 +44,12 @@

>>4 belong 0x0038 (Java SE 12)

>>4 belong 0x0039 (Java SE 13)

>>4 belong 0x003A (Java SE 14)

+>>4 belong 0x003B (Java SE 15)

+>>4 belong 0x003C (Java SE 16)

+>>4 belong 0x003D (Java SE 17)

+>>4 belong 0x003E (Java SE 18)

+>>4 belong 0x003F (Java SE 19)

+>>4 belong 0x0040 (Java SE 20)

# pool count unequal zero

#>>8 beshort x \b, pool count %#x

# pool table

diff --git a/magic/Magdir/compress b/magic/Magdir/compress
index 8c368db58cd6..a3dde1c1e33d 100644
--- a/magic/Magdir/compress
+++ b/magic/Magdir/compress

@@ -1,5 +1,5 @@

#------------------------------------------------------------------------------

-# $File: compress,v 1.82 2021/06/30 08:11:29 christos Exp $

+# $File: compress,v 1.83 2022/08/16 11:16:39 christos Exp $

# compress: file(1) magic for pure-compression formats (no archives)

# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.

@@ -147,6 +147,7 @@

# bzip2

0 string BZh bzip2 compressed data

!:mime application/x-bzip2

+!:ext bz2

>3 byte >47 \b, block size = %c00k

# bzip a block-sorting file compressor

diff --git a/magic/Magdir/database b/magic/Magdir/database
index ee4b1cb98f9d..171f7eb26353 100644
--- a/magic/Magdir/database
+++ b/magic/Magdir/database

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: database,v 1.66 2022/02/26 17:42:21 christos Exp $

+# $File: database,v 1.67 2022/07/12 18:57:42 christos Exp $

# database: file(1) magic for various databases

# extracted from header/code files by Graeme Wilford (eep2gw@ee.surrey.ac.uk)

@@ -408,8 +408,10 @@

>>>>>>>>>0 ulelong <0x400000

# skip WinStore.App.exe by looking for printable 2nd character of 1st memo item

>>>>>>>>>>513 ubyte >037

+# skip DOS executables CPQ0TD.DRV E30ODI.COM IBM0MONO.DRV by looking for printable 1st character of 1st memo item

+>>>>>>>>>>>512 ubyte >037

# unusual dBASE III DBT like adressen.dbt

->>>>>>>>>>>0 use dbase3-memo-print

+>>>>>>>>>>>>0 use dbase3-memo-print

# dBASE III DBT like angest.dbt, or garbage PCX DBF

>>>>>>>>8 ubelong !0

# skip PCX and some DBF by test for for reserved NULL bytes

diff --git a/magic/Magdir/der b/magic/Magdir/der
index d8a21cd57ef7..e84282b5ca1a 100644
--- a/magic/Magdir/der
+++ b/magic/Magdir/der

@@ -1,5 +1,5 @@

#------------------------------------------------------------------------------

-# $File: der,v 1.4 2021/03/14 17:12:04 christos Exp $

+# $File: der,v 1.5 2022/07/30 18:07:34 christos Exp $

# der: file(1) magic for DER encoded files

@@ -110,9 +110,9 @@

>>>>&0 der seq

>>>>>&0 der obj_id9=2a864886f70d010901

>>>>>&0 der ia5_str=x \b, emailAddress=%s

->>&0 der seq

->>>&0 der utc_time=x \b, utcTime=%s

+#>>&0 der seq

+#>>>&0 der utc_time=x \b, utcTime=%s

>>&0 use certinfo

0 der seq

@@ -129,9 +129,9 @@

>>>>&0 der seq

>>>>>&0 der obj_id3=550403

>>>>>&0 der utf8_str=x \b, Issuer=%s

->>&0 der seq

->>>&0 der utc_time=x \b, not-valid-before=%s

->>>&0 der utc_time=x \b, not-valid-after=%s

+#>>&0 der seq

+#>>>&0 der utc_time=x \b, not-valid-before=%s

+#>>>&0 der utc_time=x \b, not-valid-after=%s

>>&0 der seq

>>>&0 der set

>>>>&0 der seq

diff --git a/magic/Magdir/filesystems b/magic/Magdir/filesystems
index dee053b0a812..dad00db79570 100644
--- a/magic/Magdir/filesystems
+++ b/magic/Magdir/filesystems

@@ -1,5 +1,5 @@

#------------------------------------------------------------------------------

-# $File: filesystems,v 1.149 2022/05/21 22:50:28 christos Exp $

+# $File: filesystems,v 1.150 2022/07/04 16:40:33 christos Exp $

# filesystems: file(1) magic for different filesystems

0 name partid

@@ -2661,3 +2661,29 @@

>>>&(0x107a.b*56) use bcachefs-uuid

>>0x107b byte x \b, %d devices

>>0x1090 byte ^0x02 \b (unclean)

+# EROFS

+# https://kernel.googlesource.com/pub/scm/linux/kernel/git/xiang/erofs-utils/\

+# +/refs/heads/experimental/include/erofs_fs.h#12

+1024 lelong 0xE0F5E1E2 EROFS filesystem

+#>1028 lelong x \b, checksum=%#x

+>1032 lelong >0 \b, compat:

+>>1032 lelong &1 SB_CHKSUM

+>>1032 lelong &2 MTIME

+>1036 byte x \b, blocksize=%u

+>1037 byte x \b, exslots=%u

+#>1038 leshort x \b, root_nid=%d

+#>1040 lequad x \b, inodes=%ld

+#>1048 leldate x \b, build_time=%s

+#>1056 lelong x \b.%d

+#>1060 lelong x \b, blocks=%d

+#>1064 lelong x \b, metadata@%#x

+#>1068 lelong x \b, xattr@%#x

+>1072 guid x \b, uuid=%s

+>1088 string >0 \b, name=%s

+>1104 lelong >0 \b, incompat:

+>>1104 lelong &1 LZ4_0PADDING

+>>1104 lelong &2 BIG_PCLUSTER

+>>1104 lelong &4 CHUNKED_FILE

+>>1104 lelong &8 DEVICE_TABLE

+>>1104 lelong &16 ZTAILPACKING

diff --git a/magic/Magdir/fonts b/magic/Magdir/fonts
index de3e5354c785..17373b5a580c 100644
--- a/magic/Magdir/fonts
+++ b/magic/Magdir/fonts

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: fonts,v 1.50 2022/03/21 21:28:13 christos Exp $

+# $File: fonts,v 1.51 2022/08/16 11:16:39 christos Exp $

# fonts: file(1) magic for font data

0 search/1 FONT ASCII vfont text

@@ -442,6 +442,7 @@

# https://www.w3.org/TR/WOFF2/

0 string wOF2 Web Open Font Format (Version 2)

!:mime font/woff2

+!:ext woff2

>0 use woff

#>20 belong x \b, totalCompressedSize %d

>24 beshort x \b, version %d

diff --git a/magic/Magdir/gentoo b/magic/Magdir/gentoo
new file mode 100644
index 000000000000..f1a91acfedc1
--- /dev/null
+++ b/magic/Magdir/gentoo

@@ -0,0 +1,80 @@

+#------------------------------------------------------------------------------

+# $File: gentoo,v 1.2 2022/09/12 13:13:28 christos Exp $

+# gentoo: file(1) magic for gentoo specific formats

+# Summary: Gentoo ebuild Manifest files (GLEP 74)

+# Reference: https://www.gentoo.org/glep/glep-0074.html

+# Submitted by: Michal Gorny <mgorny@gentoo.org>

+# Start by doing a fast check for the most common tags.

+0 string AUX

+>0 use gentoo-manifest

+0 string DATA

+>0 use gentoo-manifest

+0 string DIST

+>0 use gentoo-manifest

+0 string EBUILD

+>0 use gentoo-manifest

+0 string MANIFEST

+>0 use gentoo-manifest

+# Manifest can be PGP-signed.

+0 string -----BEGIN\040PGP\040SIGNED\040MESSAGE-----

+>34 search/32 \n\n

+>>&0 string AUX

+>>>&0 use gentoo-manifest

+>>&0 string DATA

+>>>&0 use gentoo-manifest

+>>&0 string DIST

+>>>&0 use gentoo-manifest

+>>&0 string EBUILD

+>>>&0 use gentoo-manifest

+>>&0 string MANIFEST

+>>>&0 use gentoo-manifest

+# Use a more detailed regex to verify that we were correct.

+# <tag> <filename> <size> <hash-name> <hash-value>...

+# (<tag>'s already been matched prior to calling)

+0 name gentoo-manifest

+>&0 regex [[:space:]]+[[:print:]]+[[:space:]]+[[:digit:]]+[[:space:]]+[[:alnum:]]+[[:space:]]+[[:xdigit:]]{32} Gentoo Manifest (GLEP 74)

+# Summary: Gentoo ebuild and eclass files

+# Reference: https://projects.gentoo.org/pms/8/pms.html

+# Submitted by: Michal Gorny <mgorny@gentoo.org>

+0 search/512 EAPI=

+>0 regex .*\n[\040\t]*EAPI=["']? Gentoo ebuild

+>>&0 regex [[:alnum:]+_.-]+ \b, EAPI %s

+0 search/512 @ECLASS:\040 Gentoo eclass

+>&0 string x %s

+# Summary: Gentoo supplementary package and category metadata files

+# Reference: https://www.gentoo.org/glep/glep-0068.html

+# Submitted by: Michal Gorny <mgorny@gentoo.org>

+0 string \<?xml

+>0 search/512 \<catmetadata Gentoo category metadata file

+>0 search/512 \<pkgmetadata Gentoo package metadata file

+# Summary: Gentoo GLEP 78 binary package

+# Reference: https://www.gentoo.org/glep/glep-0078.html

+# Note: assumes the strict format

+# Submitted by: Michal Gorny <mgorny@gentoo.org>

+# GPKG uses ustar (or ustar-compatible GNU format) that starts with

+# a <directory>/gpkg-1 file

+257 string ustar

+>0 search/100 /gpkg-1\0

+>>0 regex [^/]+ Gentoo GLEP 78 (GPKG) binary package for "%s"

+!:mime application/x-tar

+!:ext tar

+# the logic below requires the gpkg-1 file to be empty

+>>>124 string 00000000000\0

+# determine the compression used by looking at the second member name

+>>>>512 search/100 .tar.

+>>>>>&0 string gz\0 using gzip compression

+>>>>>&0 string bz2\0 using bzip2 compression

+>>>>>&0 string lz\0 using lzip compression

+>>>>>&0 string lz4\0 using lz4 compression

+>>>>>&0 string lzo\0 using lzo compression

+>>>>>&0 string xz\0 using xz compression

+>>>>>&0 string zst\0 using zstd compression

+>>>>(636.o+1024) search/611 .sig\0 \b, signed

diff --git a/magic/Magdir/images b/magic/Magdir/images
index 95004d1d9f47..904a6a93856d 100644
--- a/magic/Magdir/images
+++ b/magic/Magdir/images

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: images,v 1.223 2022/05/14 20:05:09 christos Exp $

+# $File: images,v 1.227 2022/09/11 20:58:52 christos Exp $

# images: file(1) magic for image formats (see also "iff", and "c-lang" for

# XPM bitmaps)

@@ -365,7 +365,7 @@

>>>8 default x

>>>>8 uleshort x \b(unknown %#x)

>>>12 use tiff_entry

->0 uleshort 0x106 \b, PhotometricIntepretation=

+>0 uleshort 0x106 \b, PhotometricInterpretation=

>>8 clear x

>>8 uleshort 0 \bWhiteIsZero

>>8 uleshort 1 \bBlackIsZero

@@ -1458,7 +1458,25 @@

>2 quad !0

# skip g3test.g3 by test for unused bits of 2nd color entry

>>4 ubeshort&0xF000 0

->>>0 use degas-bitmap

+#>>>0 beshort x 1ST_VALUE=%x

+>>>-0 offset x FILE_SIZE=%lld

+# standard DEGAS low-res uncompressed bitmap *.pi1 with file size 32034

+>>>-0 offset =32034 VARIANT_STANDARD

+#>>>>0 beshort x 1st_VALUE=%x

+# like: 8ball.pi1 teddy.pi1 sonic01.pi1

+>>>>0 use degas-bitmap

+# about 61 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 32066

+>>>-0 offset =32066 VARIANT_ELITE

+# like: spider.pi1 pinkgirl.pi1 frog3.pi1

+>>>>0 use degas-bitmap

+# about 55 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 32128

+>>>-0 offset =32128 VARIANT_3

+# like: mountain.pi1 bigspid.pi1 alf33.pi1

+>>>>0 use degas-bitmap

+# 1 DEGAS Elite low-res uncompressed bitmap *.pi1 with file size 44834

+>>>-0 offset =44834 VARIANT_4

+# like: kenshin.pi1

+>>>>0 use degas-bitmap

# DEGAS mid-res uncompressed bitmap *.pi2 (strength=50) after GEM Images like:

# BEETHVEN.IMG CHURCH.IMG GAMEOVR4.IMG TURKEY.IMG clinton.img

0 beshort 0x0001

@@ -2210,10 +2228,104 @@

# height (80,90)

>>0x53 uleshort x \b%d

+# From: Joerg Jenderek

+# URL: http://fileformats.archiveteam.org/wiki/Imageiio/imaginfo_(Ulead)

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pe3.trid.xml

+# Note: called "Ulead Imageiio/Imaginfo thumbnail" by TrID

+0 string IIO1$ Ulead Photo Explorer 3

+#!:mime application/octet-stream

+!:mime image/x-ulead-pe3

+# IMAGEIIO.PE3

+!:ext pe3

+# look for DOS/Windows drive letter

+>5 search/192/s :\\

+# directory or full name of corresponding imaginfo.pe3 like: "T:\SAMPLES\TEXTURES\SKY_SNOW\IIOE371.TMP "S:\PI3\PIMPACT3\PROGRAMS\PATTERNS\imaginfo.pe3"

+>>&-1 string x "%s"

+# look for DOS/Windows network path if no drive letter part

+>5 default x

+>>5 search/192/s \x5c\x5c

+# full name of corresponding imaginfo.pe3 like: "\\Lionking\upi\SAMPLES\IMAGES\ANIMALS\imaginfo.pe3"

+>>>&0 string x "%s"

# Type: Ulead Photo Explorer5 (.pe5)

-# URL: http://www.jisyo.com/cgibin/view.cgi?EXT=pe5 (Japanese)

+# URL: http://fileformats.archiveteam.org/wiki/Imageiio/imaginfo_(Ulead)

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pe4.trid.xml

# From: Simon Horman <horms@debian.org>

-0 string IIO2H Ulead Photo Explorer5

+# Update: Joerg Jenderek

+# Note: some called "Ulead Imageiio/Imaginfo thumbnail" by TrID

+# and used in various Ulead applications

+0 string IIO2H Ulead Photo Explorer 4 or 5

+#!:mime application/octet-stream

+!:mime image/x-ulead-pe4

+# IMAGEIIO.PE4

+!:ext pe4/pe5

+# look in most samples for JPEG signature like: SAMPLES/IMAGES/SCENES/IMAGINFO.PE4

+>0x4c2 search/0xE02/s JFIF with JPEG image data

+>>&-6 use jpeg

+# near the end list of image names like: Img0001.pcd 1116012L.JPG NCARD4.TPL

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pe3-imaginfo.trid.xml

+11 string \001\0\0\0\0

+# check for version 3 part

+>19 string \0\001\0\003\0

+>>0 use ulead-imaginfo

+# From: Joerg Jenderek

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pe4-imaginfo.trid.xml

+11 string \001\0\0\0\0

+# check for version 4 part

+>19 string \0\0\0\004\0

+>>0 use ulead-imaginfo

+# display information about Ulead Imaginfo thumbnail (version, directory, image extension)

+0 name ulead-imaginfo

+>22 ubyte x Ulead Imaginfo thumbnail

+#!:mime application/octet-stream

+!:mime image/x-ulead-imaginfo

+>22 ubyte =3 \b, version 3

+# IMAGINFO.PE3

+!:ext pe3

+>22 ubyte =4 \b, version 4

+# IMAGINFO.PE4

+!:ext pe4

+# MAYBE ALSO VERSION 5 ?

+#>22 ubyte =5 \b, version 5

+#!:ext pe5

+>22 ubyte x

+# look for DOS/Windows driver letter

+>>4 search/192/s :\x5c

+# skip f:\Programme\iPhoto Plus 4\Template\Business Cards\IMAGINFO.PE4

+# by looking for driver letter in range A-Z

+>>>&-1 ubyte >0x40

+# directory path like: "E:\iPE\CDSample\Images\Scenes" "D:\XmasCard\Samples" "C:\TEMP\PLANTS"

+>>>>&-5 pstring/l >0 \b, "%s"

+# look for DOS/Windows network path if no valid drive letter part

+>>>&-1 default x

+>>>>4 search/192/s \x5c\x5c

+# directory path like: "\\FSX\SYS\OPPS\IPE.ENG\TEMPLATE\BUSINESS" "\\Lionking\upi\SAMPLES\IMAGES\ANIMALS"

+>>>>>&-4 pstring/l >0 \b, "%s"

+# look for DOS/Windows network path if no drive letter part

+>>4 default x

+>>>4 search/192/s \x5c\x5c

+# directory path like: "\\FSX\SYS\opps\ipe.eng\samples" "\\DANIEL\IPE_CD\IPE.ITA"

+>>>>&-4 pstring/l >0 \b, "%s"

+# look for point character inside image names

+>56 search/38/s .

+# image name extension like: bmp jpg pcd tpl

+>>&1 string x with %-.3s images

+# Summary: Ulead Pattern image (Corel Corporation)

+# URL: https://en.wikipedia.org/wiki/Ulead_Systems

+# https://www.file-extensions.org/pst-file-extension-ulead-pattern-image-format

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/p/pst-ulead.trid.xml

+# From: Joerg Jenderek

+# Note: used also by CorelDraw Essentials 3 version 13.0.0.800

+# there seems to exist other versions

+0 ubelong 0xFFFF0100

+>8 search/21 PresetInfo Ulead pattern image

+#!:mime application/octet-stream

+!:mime image/x-ulead-pst

+!:ext pst

+# string length like: 16 18 19 21 24

+#>>4 uleshort x n=%u

+# like: BlendPresetInfo DropShadowPresetInfo FileNewPresetInfo VectorExtrudePresetInfo EnvelopePresetInfo ContourPresetInfo DistortionPresetInfo

+>>4 pstring/h x "%s"

# Type: X11 cursor

# URL: http://webcvs.freedesktop.org/mime/shared-mime-info/freedesktop.org.xml.in?view=markup

@@ -3814,3 +3926,14 @@

>0x24 ulelong 1 \b, embedded PNG image

>0x24 ulelong 2 \b, embedded WebP image

>0x24 ulelong 3 \b, Basis Universal

+# Summary: iCEDraw graphic *.IDF

+# URL: http://fileformats.archiveteam.org/wiki/ICEDraw

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/i/idf-icedraw.trid.xml

+# From: Joerg Jenderek

+# Note: called "iCEDraw graphic" by TrID, "iCEDraw text" by FFmpeg and "iCE Draw" by Ansilove

+# verified by FFmpeg command `ffprobe ICE-9605.IDF` and `ansilove -s SQ-FORCE.IDF`

+0 string \0041.4\0\0\0\0O\0 iCEDraw graphic

+#!:mime application/octet-stream

+!:mime image/x-idf

+!:ext idf

diff --git a/magic/Magdir/javascript b/magic/Magdir/javascript
index 1e29c5e8e875..dcb5a93767fc 100644
--- a/magic/Magdir/javascript
+++ b/magic/Magdir/javascript

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: javascript,v 1.3 2021/12/08 13:42:00 christos Exp $

+# $File: javascript,v 1.4 2022/09/02 08:08:17 christos Exp $

# javascript: magic for javascript and node.js scripts.

0 string/w #!/bin/node Node.js script text executable

@@ -20,3 +20,102 @@

# BCGen/HBC/BytecodeFileFormat.h#L24

0 lequad 0x1F1903C103BC1FC6 Hermes JavaScript bytecode

>8 lelong x \b, version %d

+# v8 JavaScript engine bytecode

+# From: Alexandre Iooss <erdnaxe@crans.org>

+# URL: https://v8.dev/docs/ignition

+# Note: used in bytenode and NW.js protected source code

+# V8 bytecode extraction was added in NodeJS v5.7.0 (V8 4.6.85.31).

+# Version information is provided for some v8 versions found in NodeJS releases.

+2 uleshort =0xC0DE

+>0 ulelong^0xC0DE0000 >0

+# Reservation table starts at 40

+>>40 ulelong&0xFFFFFF00 =0x80000000

+# Stub keys present

+>>>24 ulelong >0

+>>>>0 ulelong^0xC0DE0000 x v8 bytecode, external reference table size: %u bytes,

+>>>>4 ulelong =0xEE4BF478 version 5.1.281.111,

+>>>>4 ulelong =0xC4A0100C version 5.5.372.43,

+>>>>8 ulelong x source size: %u bytes,

+>>>>12 ulelong x cpu features: %#08X,

+>>>>16 ulelong x flag hash: %#08X,

+>>>>20 ulelong x %u reservations,

+>>>>28 ulelong x payload size: %u bytes,

+>>>>32 ulelong x checksum1: %#08X,

+>>>>36 ulelong x checksum2: %#08X

+# No stub keys

+>>>24 ulelong =0

+>>>>0 ulelong^0xC0DE0000 x v8 bytecode, external reference table size: %u bytes,

+>>>>4 ulelong =0x54F0AD81 version 6.2.414.46,

+>>>>4 ulelong =0X7D1BF182 version 6.2.414.54,

+>>>>4 ulelong =0x35BA122E version 6.2.414.77,

+>>>>4 ulelong =0X9319F9C2 version 6.2.414.78,

+>>>>4 ulelong =0xB1240060 version 6.6.346.32,

+>>>>4 ulelong =0x2B757060 version 6.7.288.46,

+>>>>4 ulelong =0x09D147AA version 6.7.288.49,

+>>>>4 ulelong =0xF4D4F48A version 6.8.275.32,

+>>>>4 ulelong =0xD3961326 version 7.0.276.38,

+>>>>8 ulelong x source size: %u bytes,

+>>>>12 ulelong x cpu features: %#08X,

+>>>>16 ulelong x flag hash: %#08X,

+>>>>20 ulelong x %u reservations,

+>>>>28 ulelong x payload size: %u bytes,

+>>>>32 ulelong x checksum1: %#08X,

+>>>>36 ulelong x checksum2: %#08X

+# Reservation table starts at 32

+>>32 ulelong&0xFFFFFF00 =0x80000000

+# Second checksum present

+>>>28 ulelong >0

+>>>>0 ulelong^0xC0DE0000 x v8 bytecode, external reference table size: %u bytes,

+>>>>4 ulelong =0x21DDF627 version 7.4.288.21,

+>>>>4 ulelong =0x1FC9FE84 version 7.4.288.27,

+>>>>4 ulelong =0x60A99E8B version 7.5.288.22,

+>>>>4 ulelong =0x4F665E90 version 7.6.303.29,

+>>>>4 ulelong =0xC7ACFCDE version 7.7.299.11,

+>>>>4 ulelong =0x7F641D8F version 7.7.299.13,

+>>>>4 ulelong =0xFD9A4F2E version 7.8.279.17,

+>>>>4 ulelong =0x3A845324 version 7.8.279.23,

+>>>>4 ulelong =0xFF52FEAF version 7.9.317.25,

+>>>>8 ulelong x source size: %u bytes,

+>>>>12 ulelong x flag hash: %#08X,

+>>>>16 ulelong x %u reservations,

+>>>>20 ulelong x payload size: %u bytes,

+>>>>24 ulelong x checksum1: %#08X,

+>>>>28 ulelong x checksum2: %#08X

+# No second checksum

+>>>28 ulelong =0

+>>>>0 ulelong^0xC0DE0000 x v8 bytecode, external reference table size: %u bytes,

+>>>>4 ulelong =0x8725E0F8 version 8.1.307.30,

+>>>>4 ulelong =0x09ED1289 version 8.1.307.31,

+>>>>4 ulelong =0xA5728C87 version 8.3.110.9,

+>>>>4 ulelong =0xB45C5D30 version 8.4.371.23,

+>>>>4 ulelong =0xED9C278B version 8.4.371.19,

+>>>>4 ulelong =0xD27BFF42 version 8.6.395.16,

+>>>>8 ulelong x source size: %u bytes,

+>>>>12 ulelong x flag hash: %#08X,

+>>>>16 ulelong x %u reservations,

+>>>>20 ulelong x payload size: %u bytes,

+>>>>24 ulelong x payload checksum: %#08X

+# No reservation table and code starts at 24

+>>32 ulelong =0

+>>>0 ulelong^0xC0DE0000 x v8 bytecode, external reference table size: %u bytes,

+>>>4 ulelong =0x9A6F0B0F version 9.0.257.17,

+>>>4 ulelong =0x271D5D1E version 9.0.257.24,

+>>>4 ulelong =0x4EEA75DF version 9.0.257.25,

+>>>4 ulelong =0x80809479 version 9.1.269.36,

+>>>4 ulelong =0x55C46F65 version 9.1.269.38,

+>>>4 ulelong =0x8A9C758A version 9.2.230.21,

+>>>4 ulelong =0x9712F0E1 version 9.3.345.16,

+>>>4 ulelong =0x29593715 version 9.4.146.19,

+>>>4 ulelong =0xCD991825 version 9.4.146.24,

+>>>4 ulelong =0xACDD64EE version 9.4.146.26,

+>>>4 ulelong =0xC96B4CD5 version 9.5.172.21,

+>>>4 ulelong =0xBCCE4578 version 9.5.172.25,

+>>>4 ulelong =0xA2EEA077 version 9.6.180.15,

+>>>4 ulelong =0xFD350011 version 10.1.124.8,

+>>>4 ulelong =0xBEF4028F version 10.2.154.13,

+>>>4 ulelong =0xAF632352 version 10.2.154.4,

+>>>8 ulelong x source size: %u bytes,

+>>>12 ulelong x flag hash: %#08X,

+>>>16 ulelong x payload size: %u bytes,

+>>>20 ulelong x payload checksum: %#08X

diff --git a/magic/Magdir/jpeg b/magic/Magdir/jpeg
index 522f8d34f07a..2a34a5fd347b 100644
--- a/magic/Magdir/jpeg
+++ b/magic/Magdir/jpeg

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: jpeg,v 1.36 2021/08/28 12:30:52 christos Exp $

+# $File: jpeg,v 1.37 2022/06/17 18:03:35 christos Exp $

# JPEG images

# SunOS 5.5.1 had

@@ -103,43 +103,152 @@

#>>(2.S+2) use jpeg_segment

# HSI is Handmade Software's proprietary JPEG encoding scheme

+# Update: Joerg Jenderek

+# URL: http://fileformats.archiveteam.org/wiki/HSI_JPEG

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-hsi1.trid.xml

+# Note: called by TrID "HSI JPEG bitmap"

0 string hsi1 JPEG image data, HSI proprietary

+#!:mime application/octet-stream

+!:mime image/x-hsi

+!:ext hsi/jpg

# From: David Santinoli <david@santinoli.com>

0 string \x00\x00\x00\x0C\x6A\x50\x20\x20\x0D\x0A\x87\x0A JPEG 2000

+# delete from ./animation (version 1.87) with jP (=6A50h) magic at offset 4

# From: Johan van der Knijff <johan.vanderknijff@kb.nl>

# Added sub-entries for JP2, JPX, JPM and MJ2 formats; added mimetypes

# https://github.com/bitsgalore/jp2kMagic

# Now read value of 'Brand' field, which yields a few possibilities:

+# Update: Joerg Jenderek

+# URL: http://fileformats.archiveteam.org/wiki/JP2

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpeg2k.trid.xml

+# Note: called by TrID "JPEG 2000 bitmap"

>20 string \x6a\x70\x32\x20 Part 1 (JP2)

+# aliases image/jpeg2000, image/jpeg2000-image, image/x-jpeg2000-image

!:mime image/jp2

+!:ext jp2

+# URL: http://fileformats.archiveteam.org/wiki/JPX

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpx.trid.xml

+# Note: called by TrID "JPEG 2000 eXtended bitmap"

>20 string \x6a\x70\x78\x20 Part 2 (JPX)

!:mime image/jpx

+!:ext jpf/jpx

+# URL: http://fileformats.archiveteam.org/wiki/JPM

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpm.trid.xml

+# Note: called by TrID "JPEG 2000 eXtended bitmap"

>20 string \x6a\x70\x6d\x20 Part 6 (JPM)

!:mime image/jpm

+!:ext jpm

+# URL: http://fileformats.archiveteam.org/wiki/MJ2

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/v/video-mj2.trid.xml

+# Note: called by TrID "Motion JPEG 2000 video"

>20 string \x6d\x6a\x70\x32 Part 3 (MJ2)

!:mime video/mj2

+!:ext mj2/mjp2

# Type: JPEG 2000 codesream

# From: Mathieu Malaterre <mathieu.malaterre@gmail.com>

+# Update: Joerg Jenderek

+# URL: http://fileformats.archiveteam.org/wiki/JPEG_2000_codestream

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jpc.trid.xml

+# Note: called by TrID "JPEG-2000 Code Stream bitmap"

0 belong 0xff4fff51 JPEG 2000 codestream

-45 beshort 0xff52

+# value like: 0701h FF50h

+#>45 ubeshort x \b, at 45 %#4.4x

+#!:mime application/octet-stream

+# https://reposcope.com/mimetype/image/x-jp2-codestream

+!:mime image/x-jp2-codestream

+!:ext jpc/j2c/j2k

+# MAYBE also JHC like in byte_causal.jhc ?

+# WHAT IS THAT? DEAD ENTRY?

+#45 beshort 0xff52

# JPEG extended range

+# URL: http://fileformats.archiveteam.org/wiki/JPEG_XR

+# Reference: https://www.itu.int/rec/T-REC-T.832

+# http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-wmp.trid.xml

+# Note: called by TrID "JPEG XR bitmap"

0 string \x49\x49\xbc

+# FILE_VERSION_ID; shall be equal to 1; other values are reserved for future use

>3 byte 1

+# FIRST_IFD_OFFSET; shall be an integer multiple of 2; so skip DROID fmt-590-signature-id-931.wdp

>>4 lelong%2 0 JPEG-XR

+#!:mime image/vnd.ms-photo

!:mime image/jxr

-!:ext jxr

+# NO example for HDP !

+!:ext jxr/wdp/hdp

+# MAYBE also WMP ?

+#!:ext jxr/wdp/hdp/wmp

+# moved from ./images (version 1.205 ), merged and

+# partly verified by XnView `nconvert -info abydos.jxr FLOWER.wdp`

+# example: https://web.archive.org/web/20160403012904/

+# http://shikino.co.jp/solution/upfile/FLOWER.wdp.zip

+>90 bequad 0x574D50484F544F00

+>>98 byte&0x08 =0x08 \b, hard tiling

+>>99 byte&0x80 =0x80 \b, tiling present

+>>99 byte&0x40 =0x40 \b, codestream present

+>>99 byte&0x38 x \b, spatial xform=

+>>99 byte&0x38 0x00 \bTL

+>>99 byte&0x38 0x08 \bBL

+>>99 byte&0x38 0x10 \bTR

+>>99 byte&0x38 0x18 \bBR

+>>99 byte&0x38 0x20 \bBT

+>>99 byte&0x38 0x28 \bRB

+>>99 byte&0x38 0x30 \bLT

+>>99 byte&0x38 0x38 \bLB

+>>100 byte&0x80 =0x80 \b, short header

+>>>102 beshort+1 x \b, %d

+>>>104 beshort+1 x \bx%d

+>>100 byte&0x80 =0x00 \b, long header

+>>>102 belong+1 x \b, %x

+>>>106 belong+1 x \bx%x

+>>101 beshort&0xf x \b, bitdepth=

+>>>101 beshort&0xf 0x0 \b1-WHITE=1

+>>>101 beshort&0xf 0x1 \b8

+>>>101 beshort&0xf 0x2 \b16

+>>>101 beshort&0xf 0x3 \b16-SIGNED

+>>>101 beshort&0xf 0x4 \b16-FLOAT

+>>>101 beshort&0xf 0x5 \b(reserved 5)

+>>>101 beshort&0xf 0x6 \b32-SIGNED

+>>>101 beshort&0xf 0x7 \b32-FLOAT

+>>>101 beshort&0xf 0x8 \b5

+>>>101 beshort&0xf 0x9 \b10

+>>>101 beshort&0xf 0xa \b5-6-5

+>>>101 beshort&0xf 0xb \b(reserved %d)

+>>>101 beshort&0xf 0xc \b(reserved %d)

+>>>101 beshort&0xf 0xd \b(reserved %d)

+>>>101 beshort&0xf 0xe \b(reserved %d)

+>>>101 beshort&0xf 0xf \b1-BLACK=1

+>>101 beshort&0xf0 x \b, colorfmt=

+>>>101 beshort&0xf0 0x00 \bYONLY

+>>>101 beshort&0xf0 0x10 \bYUV240

+>>>101 beshort&0xf0 0x20 \bYWV422

+>>>101 beshort&0xf0 0x30 \bYWV444

+>>>101 beshort&0xf0 0x40 \bCMYK

+>>>101 beshort&0xf0 0x50 \bCMYKDIRECT

+>>>101 beshort&0xf0 0x60 \bNCOMPONENT

+>>>101 beshort&0xf0 0x70 \bRGB

+>>>101 beshort&0xf0 0x80 \bRGBE

+>>>101 beshort&0xf0 >0x80 \b(reserved %#x)

# JPEG XL

# From: Ian Tester

+# Update: Joerg Jenderek

+# URL: http://fileformats.archiveteam.org/wiki/JPEG_XL

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jxl.trid.xml

+# Note: called by TrID "JPEG XL bitmap"

0 string \xff\x0a JPEG XL codestream

-!:mime image/jxl

+#!:mime image/jxl

+!:mime image/x-jxl

!:ext jxl

# JPEG XL (transcoded JPEG file)

+# Update: Joerg Jenderek

+# URL: http://fileformats.archiveteam.org/wiki/JPEG_XL

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/b/bitmap-jxl-iso.trid.xml

+# Note: called by TrID "JPEG XL bitmap (ISOBMFF)"

0 string \x00\x00\x00\x0cJXL\x20\x0d\x0a\x87\x0a JPEG XL container

-!:mime image/jxl

+#!:mime image/jxl

+!:mime image/x-jxl

!:ext jxl

diff --git a/magic/Magdir/linux b/magic/Magdir/linux
index 0405f778aa35..c715de61b1b6 100644
--- a/magic/Magdir/linux
+++ b/magic/Magdir/linux

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: linux,v 1.80 2022/03/24 15:48:58 christos Exp $

+# $File: linux,v 1.82 2022/09/07 11:23:44 christos Exp $

# linux: file(1) magic for Linux files

# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com>

@@ -364,16 +364,6 @@

>24 lelong x %d symbols

>28 lelong x %d ocons

-# LUKS: Linux Unified Key Setup, On-Disk Format, http://luks.endorphin.org/spec

-# Anthon van der Neut (anthon@mnt.org)

-0 string LUKS\xba\xbe LUKS encrypted file,

->6 beshort x ver %d

->8 string x [%s,

->40 string x %s,

->72 string x %s]

->168 string x UUID: %s

# Summary: Xen saved domain file

# Created by: Radek Vokal <rvokal@redhat.com>

0 string LinuxGuestRecord Xen saved domain

@@ -535,3 +525,24 @@

>&0 regex [0-9]+\\.[0-9]+ \b, version %s

>>&0 string ;

>>>&0 regex [A-Z0-9]+ \b, encryption %s

+# From: Joerg Jenderek

+# URL: https://www.gnu.org/software/grub

+# Reference: https://ftp.gnu.org/gnu/grub/grub-2.06.tar.gz

+# grub-2.06/include/grub/keyboard_layouts.h

+# grub-2.06/grub-core/commands/keylayouts.c

+# GRUB_KEYBOARD_LAYOUTS_FILEMAGIC

+0 string GRUBLAYO GRUB Keyboard

+!:mime application/x-grub-keyboard

+!:ext gkb

+# GRUB_KEYBOARD_LAYOUTS_VERSION like: 10

+>8 ulelong !10 \b, version %u

+# 4 grub_uint32_t grub_keyboard_layout[160]

+# for normal french keyboard this is letter a

+>92 ubyte !0x71

+>>92 ubyte >0x40 \b, english q is %c

+#>732 ubyte x \b, english Q is %c

+# for normal german keyboard this is letter z

+>124 ubyte !0x79

+>>124 ubyte >0x40 \b, english y is %c

+#>764 ubyte x \b, english Y is %c

diff --git a/magic/Magdir/luks b/magic/Magdir/luks
index 6ecc40aff19a..16042517a332 100644
--- a/magic/Magdir/luks
+++ b/magic/Magdir/luks

@@ -1,13 +1,126 @@

#------------------------------------------------------------------------------

-# $File: luks,v 1.4 2009/09/19 16:28:10 christos Exp $

+# $File: luks,v 1.5 2022/09/07 11:23:44 christos Exp $

# luks: file(1) magic for Linux Unified Key Setup

-# URL: http://luks.endorphin.org/spec

+# URL: https://en.wikipedia.org/wiki/Linux_Unified_Key_Setup

+# http://fileformats.archiveteam.org/wiki/LUKS

# From: Anthon van der Neut <anthon@mnt.org>

+# Update: Joerg Jenderek

+# Note: verfied by command like `cryptsetup luksDump /dev/sda3`

0 string LUKS\xba\xbe LUKS encrypted file,

+# https://reposcope.com/mimetype/application/x-raw-disk-image

+!:mime application/x-raw-disk-image

+#!:mime application/x-luks-volume

+# img is the generic extension; no suffix for partitions; luksVolumeHeaderBackUp via zuluCrypt

+!:ext /luks/img/luksVolumeHeaderBackUp

+# version like: 1 2

>6 beshort x ver %d

+# test for version 1 variant

+>6 beshort 1

+>>0 use luks-v1

+# test for version 2 variant

+>6 beshort >1

+>>0 use luks-v2

+# Reference: https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf

+# http://mark0.net/download/triddefs_xml.7z/defs/l/luks.trid.xml

+# display information about LUKS version 1

+0 name luks-v1

+# cipher-name like: aes twofish

>8 string x [%s,

+# cipher-mode like: xts-plain64 cbc-essiv

>40 string x %s,

+# hash specification like: sha256 sha1 ripemd160

>72 string x %s]

>168 string x UUID: %s

+# NEW PART!

+# payload-offset; start offset of the bulk data

+>104 ubelong x \b, at %#x data

+# key-bytes; number of key bytes; key-bytes*8=MK-bits

+>108 ubelong x \b, %u key bytes

+# mk-digest[20]; master key checksum from PBKDF2

+>112 ubequad x \b, MK digest %#16.16llx

+>>120 ubequad x \b%16.16llx

+>>128 ubelong x \b%8.8x

+# mk-digest-salt[32]; salt parameter for master key PBKDF2

+>132 ubequad x \b, MK salt %#16.16llx

+>>140 ubequad x \b%16.16llx

+>>148 ubequad x \b%16.16llx

+>>156 ubequad x \b%16.16llx

+# mk-digest-iter; iterations parameter for master key PBKDF2

+>164 ubelong x \b, %u MK iterations

+# key slot 1

+>208 ubelong =0x00AC71F3 \b; slot #0

+>>208 use luks-slot

+# key slot 2

+>256 ubelong =0x00AC71F3 \b; slot #1

+>>256 use luks-slot

+# key slot 3

+>304 ubelong =0x00AC71F3 \b; slot #2

+>>304 use luks-slot

+# key slot 4

+>352 ubelong =0x00AC71F3 \b; slot #3

+>>352 use luks-slot

+# key slot 5

+>400 ubelong =0x00AC71F3 \b; slot #4

+>>400 use luks-slot

+# key slot 6

+>448 ubelong =0x00AC71F3 \b; slot #5

+>>448 use luks-slot

+# key slot 7

+>496 ubelong =0x00AC71F3 \b; slot #6

+>>496 use luks-slot

+# key slot 8

+>544 ubelong =0x00AC71F3 \b; slot #7

+>>544 use luks-slot

+# Reference: https://gitlab.com/cryptsetup/LUKS2-docs/-/raw/master/luks2_doc_wip.pdf

+# http://mark0.net/download/triddefs_xml.7z/defs/l/luks2.trid.xml

+# display information about LUKS version 2

+0 name luks-v2

+# hdr_size; size including JSON area called Metadata area by cryptsetup with value like: 16384

+>8 ubequad x \b, header size %llu

+# possible check for MAGIC_2ND after header

+#>(8.Q) string SKUL\xba\xbe \b, 2nd_HEADER_OK

+# seqid; sequence ID, increased on update; called Epoch by cryptsetup with value like: 3 4 8 10

+>16 ubequad x \b, ID %llu

+# label[48]; optional ASCII label or empty; called Label by cryptsetup with value like: "LUKS2_EXT4_ROOT"

+>24 string >\0 \b, label %s

+# csum_alg[32]; checksum algorithm like: sha256 sha1 sha512 wirlpool ripemd160

+>72 string x \b, algo %s

+# salt[64]; salt , unique for every header

+>104 ubequad x \b, salt %#llx...

+# uuid[40]; UID of device as string like: 242256c6-396e-4a35-af5f-5b70cb7af9a7

+>168 string x \b, UUID: %-.40s

+# subsystem[48]; optional owner subsystem label or empty

+>208 string >\0 \b, sub label %-.48s

+# hdr_offset; offset from device start [ bytes ] like: 0

+>256 ubequad !0 \b, offset %llx

+# char _padding [184]; must be zeroed

+#>264 ubequad x \b, padding %#16.16llx

+#>440 ubequad x \b...%16.16llx

+# csum[64]; header checksum

+>448 ubequad x \b, crc %#llx...

+# char _padding4096 [7*512]; Padding , must be zeroed

+#>512 ubequad x \b, more padding %#16.16llx

+#>4088 ubequad x \b...%16.16llx

+# JSON text data terminated by the zero character; unused remainder empty and filled with zeroes like:

+# {"keyslots":{"0":{"type":"luks2","key_size":64,"af":{"type":"luks1","stripes":4000,"hash":"sha256"},"area":{"type":"raw","offse"

+>0x1000 string x \b, at 0x1000 %s

+#>0x1000 indirect x

+# display information (like active) about LUKS1 slot

+0 name luks-slot

+# state of keyslot; 0x00AC71F3~active 0x0000DEAD~inactive

+#>0 ubelong x \b, status %#8.8x

+>0 ubelong =0x00AC71F3 active

+>0 ubelong =0x0000DEAD inactive

+# iteration parameter for PBKDF2

+#>4 ubelong x \b, %u iterations

+# salt parameter for PBKDF2

+#>8 ubequad x \b, salt %#16.16llx

+#>>16 ubequad x \b%16.16llx

+#>>24 ubequad x \b%16.16llx

+#>>32 ubequad x \b%16.16llx

+# start sector of key material like: 8 0x200 0x3f8 0x5f0 0xdd0

+>40 ubelong x \b, %#x material offset

+# number of anti-forensic stripes like: 4000

+>44 ubelong !4000 \b, %u stripes

diff --git a/magic/Magdir/mail.news b/magic/Magdir/mail.news
index 074cfb191456..ed6e7a6c4927 100644
--- a/magic/Magdir/mail.news
+++ b/magic/Magdir/mail.news

@@ -1,5 +1,5 @@

#------------------------------------------------------------------------------

-# $File: mail.news,v 1.28 2021/09/11 19:20:15 christos Exp $

+# $File: mail.news,v 1.29 2022/06/17 18:02:19 christos Exp $

# mail.news: file(1) magic for mail and news

# Unfortunately, saved netnews also has From line added in some news software.

@@ -44,8 +44,54 @@

#0 string/t Content- MIME entity text

# TNEF files...

-0 lelong 0x223E9F78 Transport Neutral Encapsulation Format

+# URL: http://fileformats.archiveteam.org/wiki/Transport_Neutral_Encapsulation_Format

+# https://en.wikipedia.org/wiki/Transport_Neutral_Encapsulation_Format

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tnef.trid.xml

+# https://interoperability.blob.core.windows.net/files/MS-OXTNEF/%5bMS-OXTNEF%5d-210817.pdf

+# Update: Joerg Jenderek

+# Note: moved and merged from ./msdos (version 1.154) there just called "TNEF"

+# partly verified by `tnef --list -v -f voice.tnef` and `ytnef -v triples.tnef`

+# TNEF magic From "Joomy" <joomy@se-ed.net>

+# TNEF_SIGNATURE

+0 lelong 0x223E9F78 Transport Neutral Encapsulation Format (TNEF)

!:mime application/vnd.ms-tnef

+# winmail.dat or win.dat by Microsoft Outlook

+!:ext tnef/dat

+# https://docs.microsoft.com/en-us/openspecs/exchange_server_protocols/ms-oxtnef/7fdb64ee-7f63-4d95-9af1-c672e7475c3a

+# LegacyKey

+#>4 uleshort x \b, key %#4.4x

+# attrLevelMessage; Level where attribute applies like: 1~attrLevelMessage 2~attrLevelAttachment

+>6 ubyte !1 \b, 1st level %#2.2x

+# other ID (like 02900000h) or TnefVersion ID (idTnefVersion=06900800h)

+>7 ubelong !0x06900800 \b, 1st id %#8.8x

+>7 ubelong =0x06900800

+# TnefVersion lenght like: 4

+>>11 ulelong !4 \b, TnefVersion length %x

+# TNEFVersionData; TnefVersion data like: 00010000h

+>>15 ulelong !0x00010000h \b, version %#8.8x

+# Checksum like: 1

+>>19 uleshort !1 \b, checksum %#4.4x

+# attrLevelMessage; level of attOemCodepage like: 1

+>>21 ubyte !1 \b, level %#2.2x

+# idOEMCodePage; OEMCodePage ID like: 07900600h

+>>22 ubelong =0x07900600 \b, OEM codepage

+# OEMCodePage length like: 8

+>>>26 ulelong =8

+# OEMCodePageData; PrimaryCodePage like: 1251 1252

+>>>>30 ulelong x %u

+# OEMCodePageData; SecondaryCodePage; unused and SHOULD contain zero

+>>>>34 ulelong !0 and %u

+# OEMCodePageData Checksum like: E7h E8h

+>>>>38 uleshort x (checksum %#x)

+# attrLevelMessage of attMessageClass like: 1

+>>40 ubyte !1 \b, level %u

+# idMessageClass; ID of attMessageClass like: 08800700h

+>>41 ubelong =0x08800700 \b, MessageAttribute

+# attMessageClass length like: 16 24 25

+#>>>45 ulelong x (length %u)

+# attMessageClass data like: "IPM.Microsoft Mail.Note" "IPM.Note.Portada Newseum"

+# "IPM.Appointment" "IPM.Note.Microsoft.Voicemail.UM.CA"

+>>>45 pstring/l x "%s"

# From: Kevin Sullivan <ksulliva@psc.edu>

0 string *mbx* MBX mail folder

diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos
index a8d6d0f43e3e..b9ed3439cea6 100644
--- a/magic/Magdir/msdos
+++ b/magic/Magdir/msdos

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: msdos,v 1.154 2022/03/21 21:25:50 christos Exp $

+# $File: msdos,v 1.158 2022/09/07 11:17:31 christos Exp $

# msdos: file(1) magic for MS-DOS files

@@ -587,7 +587,8 @@

# skip "GPG symmetrically encrypted data" ./gnu

# skip "PGP symmetric key encrypted data" ./pgp

# openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type

->>>4 ubyte >13 DOS executable (COM, 0x8C-variant)

+>>>4 ubyte >13

+>>>>0 use msdos-com

# the remaining files should be DOS *.COM executables

# dosshell.COM 8cc0 2ea35f07 e85211 e88a11 b80058 cd

# hmload.COM 8cc8 8ec0 bbc02b 89dc 83c30f c1eb04 b4

@@ -597,48 +598,164 @@

# SHARE.COM 8cca 2e8916 d602 b430 cd21 8b 2e0200 8b

# validchr.COM 8cca 2e8916 9603 b430 cd21 8b 2e028b1e

# devload.COM 8cca 8916ad01 b430 cd21 8b2e0200 892e

-!:mime application/x-dosexec

-!:ext com

-# updated by Joerg Jenderek at Oct 2008

-0 ulelong 0xffff10eb DR-DOS executable (COM)

-# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb

-0 ubeshort&0xeb8d >0xeb00

-# DR-DOS STACKER.COM SCREATE.SYS missed

0 name msdos-com

->0 byte x DOS executable (COM)

-!:mime application/x-dosexec

-!:ext com

+# URL: http://fileformats.archiveteam.org/wiki/DOS_executable_(.com)

+>0 byte x DOS executable (

+# DOS execuable with JuMP 16-bit instruction

+>0 byte =0xE9

+# check for probably nil padding til offset 64 of Lotus driver name

+>>56 quad =0

+# check for "long" alpabetical Lotus driver name like:

+# Diablo "COMPAQ Text Display" "IBM Monochrome Display" "Plantronics ColorPlus"

+>>>24 regex =^[A-Z][A-Za-z\040]{5,21} \bLotus driver) %s

+!:mime application/x-dosexec

+# like: CPQ0TD.DRV IBM0MONO.DRV (Lotus 123 10a) SDIAB4.DRV SPL0CPLS.DRV (Lotus Symphony 2)

+!:ext drv

+# COM with nils like MODE.COM IBMDOS.COM (pcdos 3.31 ru Compaq) RSSTUB.COM (PC-DOS 2000 de) ACCESS.COM (Lotus Symphony 1)

+>>>24 default x \bCOM)

+!:mime application/x-dosexec

+!:ext com

+# DOS excutable with JuMP 16-bit and without nil padding

+>>56 quad !0

+# https://wiki.syslinux.org/wiki/index.php?title=Doc/comboot

+# TODO: HOWTO distinguish COMboot from pure DOS executables?

+# look for unreliable Syslinux specific api call INTerrupt 22h for 16-bit COMBOOT program

+>>>1 search/0xc088 \xcd\x22 \bCOM or COMBOOT 16-bit)

+!:mime application/x-dosexec

+# like: sbm.cbt command.com (Windows XP) UNI2ASCI.COM (FreeDOS 1.2)

+!:ext com/cbt

+>>>1 default x \bCOM)

+!:mime application/x-dosexec

+!:ext com

+# DOS executable without JuMP 16-bit instruction

+>0 byte !0xE9

+# SCREATE.SYS https://en.wikipedia.org/wiki/Stac_Electronics

+>>10 string =?STACVOL \bSCREATE.SYS)

+!:mime application/x-dosexec

+!:ext sys

+# COM executable without JuMP 16-bit instruction and not SCREATE.SYS

+>>10 string !?STACVOL \bCOM)

+!:mime application/x-dosexec

+!:ext com

>6 string SFX\ of\ LHarc \b, %s

>0x1FE leshort 0xAA55 \b, boot code

>85 string UPX \b, UPX compressed

>4 string \ $ARX \b, ARX self-extracting archive

>4 string \ $LHarc \b, LHarc self-extracting archive

>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive

+# like: E30ODI.COM MADGEODI.COM UNI2ASCI.COM RECOVER.COM (DOS 2) COMMAND.COM (DOS 2)

+>1 search/0xc088 \xcd\x22 \b, maybe with interrupt 22h

+>0 ubelong x \b, start instruction %#8.8x

+# show more instructions but not in samples like: rem.com (DJGPP)

+>4 ubelong x %8.8x

# JMP 8bit

0 byte 0xeb

+# byte 0xeb conflicts with magic leshort 0xn2eb of "SYMMETRY i386" handled by ./sequent

# allow forward jumps only

>1 byte >-1

# that offset must be accessible

+# with hexadecimal values like: 0e 2e 50 8c 8d ba bc bd be e8 fb fc

>>(1.b+2) byte x

->>>0 use msdos-com

+# if look like COM executable with x86 boot signature then this

+# implies FAT volume with x86 real mode code already handled by ./filesystems

+# No x86 boot signature implies often DOS executable

+# check for unrealistic high number of FATs. Then it is an unusual disk image or often a DOS executable

+# like: FIXBIOS.COM (50 bytes)

+>>>16 ubyte >3

+# https://www.drivedroid.io/

+# skip MBR disk image drivedroid.img version 12 July 2013 by start message

+>>>>2 string !DriveDroid

+# ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/

+# skip unusual floppy image disk1.img of MS-DOS 1.25 (Corona Data Systems OEM)

+# by check for characteristic message text near the beginning

+>>>>>15 string !Non\040System\040disk

+# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 4.0.rar"

+# skip BeOS 4 bootfloppy.img done as "Linux kernel x86 boot executable" by ./linux

+# by check for characteristic message text near the beginning

+>>>>>>6 string !read\040error\015

+# https://github.com/ventoy/Ventoy/releases/download/v1.0.78/ventoy-1.0.78-windows.zip

+# skip ventoy 1.0.78 boot_hybrid.img

+>>>>>>>24 string !\220\220\353I$\022\017

+# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/PC-DOS 1.0 (5.25).rar"

+# skip unusual floppy image PCDOS100.IMG of DOS 1.0

+# by check for characteristic message text near the beginning

+>>>>>>>>9 string !7-May-81

+# "ftp://old-dos.ru/OSCollect/OS/BeOS/BeOS 5.0 Personal (BA).rar"

+# skip BeOS 5 floppy_1.44.00.ima done as "DOS/MBR boot sector" by ./filesystems

+# by check for characteristic message near the beginning

+>>>>>>>>>3 string !\370sdfS\270

+# like: FIXBIOS.COM (50 bytes)

+>>>>>>>>>>0 use msdos-com

+# check for unrealistic low number of FATs. Then it is an unusual FAT disk image or often a DOS executable

+# like: DEVICE.COM INSTALL.COM (GAG 4.10) WORD.COM (Word 1.15)

+>>>16 ubyte =0

+# if low FATs with x86 boot signature it can be unusual disk image like: boot.img (Ventoy 1.0.27) geodspms.img (Syslinux)

+>>>>0x1FE leshort =0xAA55

+>>>>0x1FE default x

+# https://thestarman.pcministry.com/tool/hxd/dimtut.htm

+# skip unusual floppy image TK-DOS11.img IBMDOS11.img of IBM DOS 1.10

+# by check for characteristic bootloader names near end of boot sector

+>>>>>395 string !ibmbio\040\040com

+>>>>>>0 use msdos-com

+# 8-bit jump with valid number of FAT implies FAT volume already handled by ./filesystems

+# like: balder.img

+>>>16 default x

+# skip disk images with boot signature at end of 1st sector

+# like: TDSK-64b.img

+>>>>(11.s-2) uleshort !0xAA55

+# skip unusual floppy image without boot signature like 360k-256.img (mtools 4.0.18)

+# by check for characteristic file system type text for FAT (12 bit or 16 bit)

+>>>>>54 string !FAT

+# "ftp://old-dos.ru/OSCollect/OS/MS-DOS/Final Releases/Microsoft MS-DOS 3.31 (Compaq OEM) (3.5).rar"

+# skip unusual floppy image Disk4.img without boot signature and file system type text

+# by check for characteristic OEM-ID text

+>>>>>>3 string !COMPAQ\040\040

+# no such DOS COM executables found

+>>>>>>>0 use msdos-com

# JMP 16bit

0 byte 0xe9

+# 16-bit offset; for DEBUGGING!; can be negative like: USBDRIVE.COM

+#>1 leshort x \b, OFFSET %d

# forward jumps

->1 short >-1

+>1 leshort >-1

# that offset must be accessible

+# with hexadecimal values like: 06 1e 0e 2e 60 8c 8d b4 ba be e8 fc

>>(1.s+3) byte x

->>>0 use msdos-com

+# check for unrealistic high number of FATs. Then it is not a disk image and it is a DOS executable

+# like: CALLVER.COM CPUCACHE.COM K437_EUR.COM SHSUCDX.COM UMBFILL.COM (183 bytes)

+>>>16 ubyte >3

+>>>>0 use msdos-com

+# check for unrealistic low number of FATs. Then it is not a disk image and it is a DOS executable

+# like: GAG.COM DRMOUSE.COM NDN.COM CPQ0TD.DRV

+>>>16 ubyte =0

+>>>>0 use msdos-com

+# maybe disc image with valid number of FATs or DOS executable

+# like: IPXODI.COM PERUSE.COM TASKID.COM

+>>>16 default x

+# invalid low media descriptor. Then it is not a disk image and it is a DOS executable

+>>>>21 ubyte <0xE5

+>>>>>0 use msdos-com

+# valid media descriptor. Then it is maybe disk image or DOS executable

+>>>>21 ubyte >0xE4

+# invalid sectorsize not a power of 2 from 32-32768. Then it is not a disk image and it must be DOS executable

+# like: LEARN.COM (Word 1.15)

+>>>>>11 uleshort&0x001f !0

+>>>>>>0 use msdos-com

# negative offset, must not lead into PSP

->1 short <-259

+# like: BASICA.COM (PC dos 3.20) FORMAT.COM SMC8100.COM WORD.COM (word4)

+# HIDSUPT1.COM USBDRIVE.COM USBSUPT1.COM USBUHCI.COM (FreeDOS USBDOS)

+>1 leshort <-259

# that offset must be accessible

+# add 10000h to jump at end of 64 KiB segment, add 1 for jump instruction and 2 for 16-bit offset

>>(1,s+65539) byte x

+# after jump next instruction for DEBUGGING!

+#>>>&-1 ubelong x \b, NEXT instruction %#8.8x

>>>0 use msdos-com

-# updated by Joerg Jenderek at Oct 2008,2015

+# updated by Joerg Jenderek at Oct 2008,2015,2022

# following line is too general

0 ubyte 0xb8

# skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux

@@ -661,19 +778,49 @@

# syslinux version (4.x)

# "COM executable (COM32R)" or "Syslinux COM32 module" by TrID

>>>1 lelong 0x21CD4CFe \b, relocatable)

-# Hajin Jang <hajin_jang@worksmobile.com>:

-# Disable simplest COM signature to prevent false positive on some EUC-KR text files.

-## remaining are DOS COM executables starting with assembler instruction MOV

-## like FreeDOS BANNER*.COM FINDDISK.COM GIF2RAW.COM WINCHK.COM

-## MS-DOS SYS.COM RESTART.COM

-## SYSLINUX.COM (version 1.40 - 2.13)

-## GFXBOOT.COM (version 3.75)

-## COPYBS.COM POWEROFF.COM INT18.COM

->>1 default x COM executable for DOS

-!:mime application/x-dosexec

-##!:mime application/x-ms-dos-executable

-##!:mime application/x-msdos-program

-!:ext com

+>>1 default x

+# look for interrupt instruction like in rem.com (DJGPP) LOADER.COM (DR-DOS 7.x)

+>>>3 search/118 \xCD

+# FOR DEBUGGING; possible hexadecimal interupt number like: 10~BANNER.COM 13~bcdw_cl.com 15~poweroff.com (Syslinux)

+# 1A~BERNDPCI.COM 20~SETENHKB.COM 21~mostly 22~gfxboot.com (Syslinux) 2F~SHUTDOWN.COM (GEMSYS)

+#>>>>&0 ubyte x \b, INTERUPT %#x

+# few examples with interrupt 0x13 instruction

+>>>>&0 ubyte =0x13

+# FOR DEBUGGING!

+#>>>>>3 ubequad x \b, 2nd INSTRUCTION %#16.16llx

+# skip Gpt.com Mbr.com (edk2-UDK2018 bootsector) described as "DOS/MBR boot sector" by ./filesystems

+# by check for assembler instructions: mov es,ax ; mov ax,07c0h ; mov ds,ax

+>>>>>3 ubequad !0x8ec0b8c0078ed88d

+# few COM exectables with interrupt 0x13 instruction like: Bootable CD Wizard executables bcdw_cl.com fdemuoff.com

+# http://bootcd.narod.ru/bcdw150z_en.zip

+>>>>>>0 use msdos-com

+# few examples with interrupt 0x16 instruction like flashimg.img

+>>>>&0 ubyte =0x16

+# skip Syslinux 3.71 flashimg.img done as "DOS/MBR boot sector" by ./filesystems

+# by check for assembler instructions: cmp ax 0xE4E4 (magic); jnz

+>>>>>8 ubelong !0x3DE4E475

+# no DOS executable with interrupt 0x16 found

+>>>>>>0 use msdos-com

+# most examples with interrupt instruction unequal 0x13 and 0x16

+>>>>&0 default x

+#>>>>>&-1 ubyte x \b, INTERUPT %#x

+# like: LOADER.COM SETENHKB.COM banner.com copybs.com gif2raw.com poweroff.com rem.com

+>>>>>0 use msdos-com

+# few COM executables without interupt instruction like RESTART.COM (DOS 7.10) REBOOT.COM

+# or some EUC-KR text files or one Ulead Imaginfo thumbnail

+>>>3 default x

+# FOR DEBUGGING; 2nd instruction like 0x50 (RESTART.COM) 0x8e (REBOOT.COM)

+# or random like: 0x0 (IMAGINFO.PE3 sky_snow) 0xb1 (euckr_.txt)

+#>>>>3 ubyte x \b, 2nd INSTRUCTION %#x

+# skip 1 Ulead Imaginfo thumbnail (IMAGINFO.PE3 sky_snow)

+# inside SAMPLES/TEXTURES/SKY_SNOW

+# from https://archive.org/download/PI3CANON/PI3CANON.iso

+>>>>3 ubyte !0x0

+# skip some EUC-KR text files like: euckr_falsepositive.txt

+# https://bugs.astron.com/view.php?id=186

+>>>>>3 ubyte !0xb1

+# like: RESTART.COM (DOS 7.10) REBOOT.COM

+>>>>>>0 use msdos-com

# URL: https://en.wikipedia.org/wiki/UPX

# Reference: https://github.com/upx/upx/archive/v3.96.zip/upx-3.96/

@@ -1275,11 +1422,6 @@

>>>20 long >0 TIFF starts at byte %d

>>>>24 long >0 length %d

-# TNEF magic From "Joomy" <joomy@se-ed.net>

-# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)

-0 lelong 0x223e9f78 TNEF

-!:mime application/vnd.ms-tnef

# Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C

# of http://www.davep.org/norton-guides/ng2h-105.tgz

# https://en.wikipedia.org/wiki/Norton_Guides

@@ -1477,6 +1619,13 @@

>>>>>>(16.l+16) string !Panoram 7 or 8

!:ext themepack/deskthemepack

>>>>>>(16.l+16) ubyte x Theme Pack

+# URL: https://en.wikipedia.org/wiki/Microsoft_OneNote#File_format

+# http://fileformats.archiveteam.org/wiki/OneNote

+# Reference: https://mark0.net/download/triddefs_xml.7z/defs/o/onepkg.trid.xml

+# 1st member name like: "Class Notes.one" "test-onenote.one" "Open Notebook.onetoc2" "Editor �ffnen.onetoc2"

+>>>>>&0 string/c one \b, OneNote Package

+!:mime application/msonenote

+!:ext onepkg

>>>>>&0 default x

# look for null terminator of 1st member name

>>>>>>&0 search/255 \0

diff --git a/magic/Magdir/msooxml b/magic/Magdir/msooxml
index 9303411f6356..2fc3a5640196 100644
--- a/magic/Magdir/msooxml
+++ b/magic/Magdir/msooxml

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: msooxml,v 1.17 2021/11/08 13:53:43 christos Exp $

+# $File: msooxml,v 1.18 2022/08/16 11:16:39 christos Exp $

# msooxml: file(1) magic for Microsoft Office XML

# From: Ralf Brown <ralf.brown@gmail.com>

@@ -15,10 +15,13 @@

0 name msooxml

>0 string word/ Microsoft Word 2007+

!:mime application/vnd.openxmlformats-officedocument.wordprocessingml.document

+!:ext docx

>0 string ppt/ Microsoft PowerPoint 2007+

!:mime application/vnd.openxmlformats-officedocument.presentationml.presentation

+!:ext pptx

>0 string xl/ Microsoft Excel 2007+

!:mime application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

+!:ext xlsx

>0 string visio/ Microsoft Visio 2013+

!:mime application/vnd.ms-visio.drawing.main+xml

>0 string AppManifest.xaml Microsoft Silverlight Application

diff --git a/magic/Magdir/ole2compounddocs b/magic/Magdir/ole2compounddocs
index 1379e569e122..d52578128a5d 100644
--- a/magic/Magdir/ole2compounddocs
+++ b/magic/Magdir/ole2compounddocs

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: ole2compounddocs,v 1.18 2022/05/31 17:38:36 christos Exp $

+# $File: ole2compounddocs,v 1.19 2022/09/11 20:52:40 christos Exp $

# Microsoft OLE 2 Compound Documents : file(1) magic for Microsoft Structured

# storage (https://en.wikipedia.org/wiki/Compound_File_Binary_Format)

# Additional tests for OLE 2 Compound Documents should be under this recipe.

@@ -236,6 +236,18 @@

!:mime application/x-corel-gal

!:ext gal

+# From: Joerg Jenderek

+# URL: https://archive.org/details/iPhoto-Plus-4

+# https://filext.com/file-extension/TPL

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/t/tpl-ulead.trid.xml

+# Note: found in Template sub directory in program directory of software iPhoto Plus version 4

+# second, third and fourth directory entry name like TplHeader TplMainImage TplPreview

+>>>>128 lestring16 TplHeader : Ulead iPhoto Template

+#!:mime application/x-ole-storage

+!:mime image/x-ulead-tpl

+# https://www.file-extensions.org/tpl-file-extension-ulead-photo-express-template

+!:ext tpl

# URL: https://en.wikipedia.org/wiki/Hangul_(word_processor)

# Note: "HWP Document File" signature found in FileHeader

# Second directory entry name FileHeader hint for Thinkfree Office document

diff --git a/magic/Magdir/pascal b/magic/Magdir/pascal
index ddb93b0c54f6..61688024560f 100644
--- a/magic/Magdir/pascal
+++ b/magic/Magdir/pascal

@@ -1,5 +1,5 @@

#------------------------------------------------------------------------------

-# $File: pascal,v 1.3 2020/06/07 18:10:26 christos Exp $

+# $File: pascal,v 1.4 2022/07/30 16:53:06 christos Exp $

# pascal: file(1) magic for Pascal source

0 search/8192 (input, Pascal source text

@@ -12,3 +12,28 @@

# Free Pascal

0 string PPU Pascal unit

>3 string x \b, version %s

+# From: Joerg Jenderek

+# URL: https://en.wikipedia.org/wiki/Dan_Bricklin

+0 string/b Type

+# URL: https://dl.winworldpc.com/Dan%20Bricklins%20Demo%20II%20Version%202%20Manual.7z

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dbd-v2.trid.xml

+>4 string D2 Dan Bricklin's Demo 2 demo

+#!:mime application/octet-stream

+!:ext dbd

+# URL: https://muhaz.org/turbo-pascal-download-details.html

+# From: Joerg Jenderek

+# Note: used by Turbo Pascal 5.5 TOUR.EXE

+>4 string T2 Turbo Pascal TOUR data

+#!:mime application/octet-stream

+!:mime application/x-borland-cbt

+!:ext cbt

+# WHAT iS THAT?

+#>4 string \040P Dan Bricklin's Demo 2 foo

+#!:mime application/octet-stream

+# _PPRINT.SG2 _PASCII.SG2

+#!:ext sg2

+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/d/dbd-gen.trid.xml

+>4 default x Dan Bricklin's Demo demo (generic)

+#!:mime application/octet-stream

+!:ext dbd

diff --git a/magic/Magdir/python b/magic/Magdir/python
index ed5888591aae..00d90d123882 100644
--- a/magic/Magdir/python
+++ b/magic/Magdir/python

@@ -1,6 +1,6 @@

#------------------------------------------------------------------------------

-# $File: python,v 1.44 2021/10/20 11:15:35 christos Exp $

+# $File: python,v 1.45 2022/07/24 23:59:37 christos Exp $

# python: file(1) magic for python

# Outlook puts """ too for urgent messages

@@ -86,6 +86,8 @@

!:mime application/x-bytecode.python

0 belong 0x04f30d0a python 2.7 byte-compiled

!:mime application/x-bytecode.python

+0 belong 0x0af30d0a PyPy2.7 byte-compiled

+!:mime application/x-bytecode.python

0 belong 0xb80b0d0a python 3.0 byte-compiled

!:mime application/x-bytecode.python

0 belong 0xc20b0d0a python 3.0 byte-compiled

@@ -186,80 +188,46 @@

!:mime application/x-bytecode.python

0 belong 0x3f0d0d0a python 3.7 byte-compiled

!:mime application/x-bytecode.python

-0 belong 0x400d0d0a python 3.7 byte-compiled