# /etc/magic
# Magic data for file(1) command.
# Hand edited.
# files is 4 on V7 and BSD, 4 on SV, and ?? in the SVID.
#	Add any locally-observed files here.  Remember:
#	text if readable, executable if runnable binary, data if unreadable.
# 22	short	023000		core dump data
0	short		070707		cpio archive
0	string		070707		ASCII cpio archive
0	string		=<ar>		archive
0	string		!<arch>		archive
>8	string		__.SYMDEF	random library
0	string		/*		c program text
53	string		yyprevious	c program text (from lex)
0	string		#!\ /bin/sh	commands text
0	string		#!/bin/sh	commands text
0	string		#!\ /bin/csh	C shell commands text
0	string		#!/bin/csh	C shell commands text
0	string		#!\ /bin/bash	bash commands text
0	string		#!/bin/bash	bash commands text
0	string		#!\ /bin/awk	awk commands text
0	string		#!/bin/awk	awk commands text
0	string		#!\ /		some kinda commands text
0	string		#!/		some kinda commands text
0	string		#!\ 		commands text
>3	string		>\0		 for %s
#	An "antique" kernel is either unmodified early V7,
#	without DMR's 1979 mod for #!, or any kernel
#	derived from a pre-v7 kernel (i.e., System V)
0	string		:\ 		shell archive or commands for antique kernel text
0	short		017037		packed data
# CPL 	- added pack to /etc/magic
0	short		017436		packed data
0	short		0145405		huf output

0	string		\037\235	compressed data
# non block compressed
>2	byte		12		- with 12 bits
>2	byte		13		- with 13 bits
>2	byte		14		- with 14 bits
>2	byte		15		- with 15 bits
>2	byte		16		- with 16 bits
# block compressed
>2	byte		140		- with 12 bits
>2	byte		141		- with 13 bits
>2	byte		142		- with 14 bits
>2	byte		143		- with 15 bits
>2	byte		144		- with 16 bits
#
# magic file lines for output from "diff"...
0	string		diff\ 	'diff' output text
0	string		***\ 		'diff' output text
0	string		Only\ in\ 	'diff' output text
0	string		Common\ subdirectories:\ 	'diff' output text
# Magic numbers for ditroff intermediate language
0	string		x\ T\ cat	titroff output for the C/A/T text
0	string		x\ T\ ps	titroff output for PostScript
0	string		x\ T 		titroff output text
0	string	FONT	ASCII vfont text
0	short	0436	Berkeley vfont data
0	short	017001	byte-swapped Berkeley vfont data
# Magic number for FrameMaker files
# Thanks to Berry Kercheval
#
0	string		\<MakerFile	FrameMaker document
# Tell file about magic for IMAGEN printer-ready files:
0	string	@document(		Imagen printer
# this only works if "language xxx" is first item in Imagen header.
>10	string	language\ impress	(imPRESS data)
>10	string	language\ daisy		(daisywheel text)
>10	string	language\ diablo		(daisywheel text)
>10	string	language\ printer	(line printer emulation)
>10	string	language\ tektronix	(Tektronix 4014 emulation)
# Add any other languages that your Imagen uses - remember
# to keep the word `text' if the file is human-readable.
#
# Now magic for IMAGEN font files...
0	string		Rast		RST-format raster font data
>45	string		>0		face %
# various intel-CPU magic numbers
0	short		01006		80286 executable (STL)
>31	byte		<0x040		small model
>31	byte		=0x048		large model	
>31	byte		=0x049		huge model 
>16	long		>0		not stripped
0	string		MZ		DOS executable (EXE)
0	string		LZ		DOS executable (built-in)
0	byte		0xe9		DOS executable (COM)
0	byte		0xeb		DOS executable (COM)
0	short		=0512		80286 executable small model (COFF)
>12	long		>0		not stripped
>22	short		>0		- version %ld
0	short		=0522		80286 executable large model (COFF)
>12	long		>0		not stripped
>22	short		>0		- version %ld
0	short		=0514		80386 executable
>12	long		>0		not stripped
>22	short		>0		- version %ld

0	string		#/etc/magic	magic text file for file(1) cmd
0	string		#\ /etc/magic	magic text file for file(1) cmd
# Unfortunately, saved netnews also has From line added in some news software.
#0	string		From 		mail text
# There are tests to ascmagic.c to cope with mail and news.
0	string		Relay-Version: 	old news text
0	string		#!\ rnews	batched news text
0	string		N#!\ rnews	mailed, batched news text
0	string		Forward\ to 	mail forwarding text
0	string		Pipe\ to 	mail piping text
0	string		Return-Path:	smtp mail text
0	string		Path:		news text
0	string		Xref:		news text
0	string		From:		news or mail text
0	string		Article 	saved news text
0	string		begin 		uuencoded mail text
#	derived empirically, your offsets may vary!
1	string		/*\ \ A\ Bison\ parser	C program text (from bison)
53	string		yyprevious	C program text (from lex)
0	short		0407		impure executable or object
>16	short		>0		not stripped
0	long		0407		old object
>16	long		>0		not stripped
#>2	short		>0		- version %ld
0	long		0410		pure executable
>16	long		>0		not stripped
#>2	short		>0		- version %ld
0	short		0410		PDP-11 pure executable
>8	short		>0		not stripped
#>2	short		>0		- version %ld
0	short		0411		PDP-11 separate I&D executable
>8	short		>0		not stripped
#>2	short		>0		- version %ld
0	short		0413		demand paged pure executable
>16	short		>0		not stripped
0	long		0413		old demand paged pure executable
>16	long		>0		not stripped
#>2	short		>0		- version %ld
0	long		0420		demand paged (first page unmapped) pure executable
>16	long		>0		not stripped
#>2	short		>0		- version %ld
0	short		0437		pdp11 kernel overlay
#
# Let us not forget PostScript
0	string	%!			PostScript text
>2	string	PS-Adobe-		conforming
>11	string	1.0			at level %s
# Sun rasterfiles
0	string	\x59\xa6\x6a\x95	rasterfile
>4	long	>0		%d
>8	long	>0		x %d
>12	long	>0		x %d
>20	long	0		old format
>20	long	2		compressed
>24	long	1		with color map
# SCCS archive structure:
# \001h01207
# \001s 00276/00000/00000
# \001d D 1.1 87/09/23 08:09:20 ian 1 0
# \001c date and time created 87/09/23 08:09:20 by ian
# \001e
# \001u
# \001U
# ... etc.
# Now '\001h' happens to be the same as the 3B20's a.out magic number (0550).
# *Sigh*. And these both came from various parts of the USG.
# Maybe we should just switch everybody from SCCS to RCS!
# Further, you can't just say '\001h0', because the five-digit number
# is a checksum that could (presumably) have any leading digit,
# and we don't have regular expression matching yet. 
# Hence the following official kludge:
8	string		\001s\ 			SCCS archive.
# gzip stuff
0       short           0x8b1f          gzip compressed data
>2      byte            8               - deflate method
>3      byte            &0x1            , ascii
>3      byte            &0x2            , continuation
>3      byte            &0x4            , extra field
>3      byte            &0x8            , original file name
>3      byte            &0x10           , comment
>3      byte            &0x20           , encrypted

