Penguin
Recent Changes
Annotated edit history of magic(5) version 1, including all changes. View license author blame.
Rev Author # Line
1 perry 1 MAGIC
2 !!!MAGIC
3 NAME
4 DESCRIPTION
5 BUGS
6 SEE ALSO
7 ----
8 !!NAME
9
10
11 magic - file command's magic number file
12 !!DESCRIPTION
13
14
15 This manual page documents the format of the magic file as
16 used by the file(1) command, version 3.37-3.1. The
17 file(1) command identifies the type of a file using,
18 among other tests, a test for whether the file begins with a
19 certain ''magic number''. The file
20 ''/usr/share/misc/magic'' specifies what magic numbers
21 are to be tested for, what message to print if a particular
22 magic number is found, and additional information to extract
23 from the file.
24
25
26 Each line of the file specifies a test to be performed. A
27 test compares the data starting at a particular offset in
28 the file with a 1-byte, 2-byte, or 4-byte numeric value or a
29 string. If the test succeeds, a message is printed. The line
30 consists of the following fields:
31
32
33 offset
34
35
36 A number specifying the offset, in bytes, into the file of
37 the data which is to be tested.
38
39
40 type
41
42
43 The type of the data to be tested. The possible values
44 are:
45
46
47 byte
48
49
50 A one-byte value.
51
52
53 short
54
55
56 A two-byte value (on most systems) in this machine's native
57 byte order.
58
59
60 long
61
62
63 A four-byte value (on most systems) in this machine's native
64 byte order.
65
66
67 string
68
69
70 A string of bytes. The string type specification can be
71 optionally followed by /[[Bbc]*. The ``B'' flag compacts
72 whitespace in the target, which must contain at least one
73 whitespace character. If the magic has
74
75
76 date
77
78
79 A four-byte value interpreted as a UNIX date.
80
81
82 ldate
83
84
85 A four-byte value interpreted as a UNIX-style date, but
86 interpreted as local time rather than UTC.
87
88
89 beshort
90
91
92 A two-byte value (on most systems) in big-endian byte
93 order.
94
95
96 belong
97
98
99 A four-byte value (on most systems) in big-endian byte
100 order.
101
102
103 bedate
104
105
106 A four-byte value (on most systems) in big-endian byte
107 order, interpreted as a unix date.
108
109
110 leshort
111
112
113 A two-byte value (on most systems) in little-endian byte
114 order.
115
116
117 lelong
118
119
120 A four-byte value (on most systems) in little-endian byte
121 order.
122
123
124 ledate
125
126
127 A four-byte value (on most systems) in little-endian byte
128 order, interpreted as a UNIX date.
129
130
131 leldate
132
133
134 A four-byte value (on most systems) in little-endian byte
135 order, interpreted as a UNIX-style date, but interpreted as
136 local time rather than UTC.
137
138
139 The numeric types may optionally be followed by ____
140 and a numeric value, to specify that the value is to be
141 AND'ed with the numeric value before any comparisons are
142 done. Prepending a __u__ to the type indicates that
143 ordered comparisons should be unsigned.
144
145
146 test
147
148
149 The value to be compared with the value from the file. If
150 the type is numeric, this value is specified in C form; if
151 it is a string, it is specified as a C string with the usual
152 escapes permitted (e.g. n for new-line).
153
154
155 Numeric values may be preceded by a character indicating the
156 operation to be performed. It may be __=__, to specify
157 that the value from the file must equal the specified value,
158 ____, to specify that the value from the file must be
159 less than the specified value, ____, to specify that
160 the value from the file must be greater than the specified
161 value, ____, to specify that the value from the file
162 must have set all of the bits that are set in the specified
163 value, __^__, to specify that the value from the file
164 must have clear any of the bits that are set in the
165 specified value, or __x__, to specify that any value will
166 match. If the character is omitted, it is assumed to be
167 __=__.
168
169
170 Numeric values are specified in C form; e.g. __13__ is
171 decimal, __013__ is octal, and __0x13__ is
172 hexadecimal.
173
174
175 For string values, the byte string from the file must match
176 the specified byte string. The operators __=__,
177 ____ and ____ (but not ____) can be
178 applied to strings. The length used for matching is that of
179 the string argument in the magic file. This means that a
180 line can match any string, and then presumably print that
181 string, by doing ____ (because all strings are
182 greater than the null string).
183
184
185 message
186
187
188 The message to be printed if the comparison succeeds. If the
189 string contains a printf(3) format specification, the
190 value from the file (with any specified masking performed)
191 is printed using the message as the format
192 string.
193
194
195 Some file formats contain additional information which is to
196 be printed along with the file type. A line which begins
197 with the character ____ indicates additional tests
198 and messages to be printed. The number of ____ on the
199 line indicates the level of the test; a line with no
200 ____ at the beginning is considered to be at level 0.
201 Each line at level ''n''__+1__ is under the control of
202 the line at level ''n'' most closely preceding it in the
203 magic file. If the test on a line at level ''n''
204 succeeds, the tests specified in all the subsequent lines at
205 level ''n''__+1__ are performed, and the messages
206 printed if the tests succeed. The next line at level
207 ''n'' terminates this. If the first character following
208 the last ____ is a __(__ then the string after the
209 parenthesis is interpreted as an indirect offset. That means
210 that the number after the parenthesis is used as an offset
211 in the file. The value at that offset is read, and is used
212 again as an offset in the file. Indirect offsets are of the
213 form:
214 __((__''x''__[[.[[bslBSL]][[+-][[__''y''__]).__
215 The value of ''x'' is used as an offset in the file. A
216 byte, short or long is read at that offset depending on the
217 __[[bslBSL]__ type specifier. The capitalized types
218 interpret the number as a big endian value, whereas the
219 small letter versions interpet the number as a little endian
220 value. To that number the value of ''y'' is added and the
221 result is used as an offset in the file. The default type if
222 one is not specified is long.
223
224
225 Sometimes you do not know the exact offset as this depends
226 on the length of preceding fields. You can specify an offset
227 relative to the end of the last uplevel field (of course
228 this may only be done for sublevel tests, i.e. test
229 beginning with ____ ). Such a relative offset is
230 specified using ____ as a prefix to the
231 offset.
232 !!BUGS
233
234
235 The formats ''long'', ''belong'', ''lelong'',
236 ''short'', ''beshort'', ''leshort'', ''date'',
237 ''bedate'', and ''ledate'' are system-dependent;
238 perhaps they should be specified as a number of bytes (2B,
239 4B, etc), since the files being recognized typically come
240 from a system on which the lengths are
241 invariant.
242
243
244 There is (currently) no support for specified-endian data to
245 be used in indirect offsets.
246 !!SEE ALSO
247
248
249 file(1) - the command that reads this
250 file.
251 ----
This page is a man page (or other imported legacy content). We are unable to automatically determine the license status of this page.