############################################################################
#
# jmason additions to file(1)'s /etc/magic file. Also includes some
# other entries from the net at large, credited where credit's due.
#
############################################################################
#
0	string		%!			PostScript document
0	string		GIF87A			GIF file, v87
0	string		GIF89A			GIF file, v89
# PBMPLUS auxiliary magic numbers file
0	string		begin			uuencoded file
0	string		xbtoa			btoa'd file
0	string		P1			PBM file
0	string		P2			PGM file
0	string		P3			PPM file
0	string		P4			PBM "rawbits" file
0	string		P5			PGM "rawbits" file
0	string		P6			PPM "rawbits" file
0	string		\361\0\100\273		CMU window manager bitmap
0	string		\131\246\152\225	Sun rasterfile
0	string		yz			MGR bitmap
0	string		\115\115		TIFF file, big-endian
0	string		\111\111		TIFF file, little-endian
0	string		This\040is\040a\040BitMap\040file	Lisp Machine bit-array-file
0	string		!!			Bennet Yee's "face" format
# Larry Virden <lvirden@cas.org>:
0	string		FORM			Amiga IFF sound file
0	string		Creative Voice File	VOC sound file
0	string		begin\040[0-7]		uuencoded text file
0	string		Relay-Version:		old USENET news text
0	string		#! rnews		batched USENET news text
0	string		N#! rnews		mailed, batched USENET news text
0	string		Forward to		forwarding mailbox
0	string		Pipe to			piping mailbox
0	string		Return-Path:		SMTP mail text
0	string		Path:			USENET news text
0	string		Xref:			USENET news text
0	string		From:			USENET news or mail text
0	string		From\040		saved USENET news text
0	string		Article\040		saved USENET news text
#
0	string		\377\330\377		JPEG
>3	string		\340\000\020JFIF\000	(JFIF)
>3	string		\356\000\016Adobe\000	(Adobe)
>11	byte		>=0			%d.
>12	byte		>=0			%d file
# 
7	byte		7			XWD file,
>16	long		>0			%d x
>20	long		>0			%d x
>12	long		>0			%d
>8	long		2			ZPixmap
>8	long		1			XYPixmap
>8	long		0			XYBitmap
#
0	string		hsi1			HSI1 image (wrapper for JPEG?)
# Justin Mason <jmason@iona.ie>:
# this seems to cover both "Paris" and XING formats.
0	long		0x000001b3		MPEG movie file
# XFig.
0	string		#FIG			XFig File
>5	string		2.1			(version 2.1 format)
#
# PGP hacks (from SurfPunk e-list)
0	short		0x9900			PGP key public ring
0	short		0x9501			PGP key security ring
0	string		-----BEGIN\040PGP	PGP armored data
>15	string		PUBLIC\040KEY\040BLOCK- public key block
>15	string		MESSAGE-		message
>15	string		SIGNED\040MESSAGE-	signed message
>15	string		PGP\040SIGNATURE-	signature
#
# .arj hack (from observation)
0	short		0x60ea			ARJ compressed archive
#
# gzip archives (from gzip-1.1.1 dist)
0	short		0x1f8b		gzip compressed data
>2	byte		8		- deflate method
>3	byte		&0x1		, ascii
>3	byte		&0x2		, continuation
>3	byte		&0x4		, extra field
>3	byte		&0x8		, original file name
>3	byte		&0x10		, comment
>3	byte		&0x20		, encrypted
>8	byte		2		, max compression
>8	byte		4		, max speed
#
# Windows NT .exe files (from observation)
#
0	long		0x4d5a9000	Windows NT .EXE file
0	long		0x4d5a9a01	MS-DOS .EXE file
#
# PostScript
#
0	string		%!		PostScript document
>2	string		PS-Adobe-	conforming
>11	string		1.0		at level %s
>11	string		2.0		at level %s
#
# DVI
#
0	short		0173402		DVI File
>16	string		>\0		(%s)
0	short		0173531		Packed TeX Font
>4	string		>\0		(%s)
2	short		0000022		Metafont Font Metric
>34	string		>\0		(%s)
0	long		0xfa33c08e	SunPC 3.0 Hard Disk
0	string		#SUNPC_CONFIG	SunPC 3.0 Properties Values
#
# Newtware Specials:  compressed or PC-based files (also zsh and TIFF, bottom).
# Greg Roelofs, 15 May 92.  Most recent revisions:  29 Jul 94.
#
0	string		MZ			MS-DOS executable
>24	string		@			(OS/2 or Windows format)
#
# >>>>> ARC <<<<<
#
0	string		\032\010		ARC archive
# [stupid "file" programs, big-endian]
# 0	short		0x1a08			ARC archive
# [stupid "file" programs, little-endian]
# 0	short		0x081a			ARC archive
#
# >>>>> ARJ <<<<<
#
0	string		\140\352		ARJ archive
# [stupid "file" programs, big-endian]
# 0	short		0x60ea			ARJ archive
# [stupid "file" programs, little-endian]   [from file 3.9-OS/2 magic file]
# 0	short		0xea60			ARJ archive
#
# >>>>> BMP, etc. <<<<<
#
0	string		BM			bitmap
>14	byte		12			(OS/2 1.x format)
>14	byte		64			(OS/2 2.x format)
>14	byte		40			(Windows 3.x format)
0	string		IC			icon
0	string		PI			pointer
0	string		CI			color icon
0	string		CP			color pointer
0	string		BA			bitmap array
#
# >>>>> COMPRESS <<<<<
#
# [newer, smarter "file" programs]
# 0	string		\037\235		compress'd file
# [stupid "file" programs, big-endian]
0	short		0x1f9d			compress'd file
# [stupid "file" programs, little-endian]
# 0	short		0x9d1f			compress'd file
# [GRR:	 are the upper three bits (block size) ever different from 100?]
>2	byte		0x89			(9 bits)
>2	byte		0x8a			(10 bits)
>2	byte		0x8b			(11 bits)
>2	byte		0x8c			(12 bits)
>2	byte		0x8d			(13 bits)
>2	byte		0x8e			(14 bits)
>2	byte		0x8f			(15 bits)
>2	byte		0x90			(16 bits)
#
# >>>>> GZIP <<<<<
#
# [newer, smarter "file" programs]
0	string		\037\213		gzip'd file
# [stupid "file" programs, big-endian]
# 0	short		0x1f8b			gzip'd file
# [stupid "file" programs, little-endian]
# 0	short		0x8b1f			gzip'd file
#
# >>>>> HPACK <<<<<   [from Peter Gutmann, pgut1@cs.aukuni.ac.nz]
#
0	string		HPAK			HPACK archive
#
# >>>>> LHARC/LHA <<<<<
#
2	string		-lh0-			Lharc 1.x archive [lh0]
2	string		-lh1-			Lharc 1.x archive [lh1]
2	string		-lz4-			Lharc 1.x archive [lz4]
2	string		-lz5-			Lharc 1.x archive [lz5]
#	[never seen any but the last; -lh4- reported in comp.compression:]
2	string		-lzs-			LHa 2.x? archive [lzs]
2	string		-lh -			LHa 2.x? archive [lh ]
2	string		-lhd-			LHa 2.x? archive [lhd]
2	string		-lh2-			Lha 2.x? archive [lh2]
2	string		-lh3-			LHa 2.x? archive [lh3]
2	string		-lh4-			LHa (2.x) archive [lh4]
2	string		-lh5-			LHa (2.x) archive [lh5]
#
#
# >>>>> SQUISH <<<<<
#
0	string		SQSH			squished archive (Acorn RISCOS)
#
# >>>>> ZIP <<<<<
#
# [newer, smarter "file" programs]
0	string		PK\003\004		Zip archive
# [stupid "file" programs, big-endian]
# 0	long		0x504b0304		Zip archive
# [stupid "file" programs, little-endian]
# 0	long		0x04034b50		Zip archive
# [everybody:]
>4	byte		0x09			(at least v0.9 to extract)
>4	byte		0x0a			(at least v1.0 to extract)
>4	byte		0x0b			(at least v1.1 to extract)
>4	byte		0x14			(at least v2.0 to extract)
#
# >>>>> ZOO <<<<<
#
# [GRR:	 don't know if all of these versions exist, or if some are missing...]
0	string		ZOO			Zoo archive
>4	string		1.00			(v%4s)
>4	string		1.10			(v%4s)
>4	string		1.20			(v%4s)
>4	string		1.30			(v%4s)
>4	string		1.40			(v%4s)
>4	string		1.50			(v%4s)
>4	string		1.60			(v%4s)
>4	string		1.70			(v%4s)
>4	string		1.71			(v%4s)
>4	string		2.00			(v%4s)
>4	string		2.01			(v%4s)
>4	string		2.10			(v%4s)
# [newer, smarter "file" programs]
>32	string		\001\000		(modify: v1.0+)
>32	string		\001\004		(modify: v1.4+)
>32	string		\002\000		(modify: v2.0+)
>70	string		\001\000		(extract: v1.0+)
>70	string		\002\001		(extract: v2.1+)
# [stupid "file" programs, big-endian]
# >32	short		0x0100			(modify: v1.0+)
# >32	short		0x0104			(modify: v1.4+)
# >32	short		0x0200			(modify: v2.0+)
# >70	short		0x0100			(extract: v1.0+)
# >70	short		0x0201			(extract: v2.1+)
# [stupid "file" programs, little-endian]
# >32	short		0x0001			(modify: v1.0+)
# >32	short		0x0401			(modify: v1.4+)
# >32	short		0x0002			(modify: v2.0+)
# >70	short		0x0001			(extract: v1.0+)
# >70	short		0x0102			(extract: v2.1+)
# [GRR:	 the following are alternate identifiers]
#20	long		0xdca7c4fd		Zoo archive
#20	long		0xc4fddca7		Zoo archive
#
#
# From: cameron@spectrum.cs.unsw.oz.au (Cameron Simpson)
# Newsgroups: alt.sources,comp.unix.programming
# Subject: some useful additions to your magic file ...
# Message-ID: <1992Mar21.055523.27025@usage.csd.unsw.OZ.AU>
# Date: 21 Mar 92 05:55:23 GMT
# Sender: news@usage.csd.unsw.OZ.AU
# Organization: CS&E Computing Facility, Uni Of NSW, Oz
#
# This is simply a list of a few entries which seem missing from most systems'
# magic files. The first 10 or so entries recognise and classify executable
# scripts, which otherwise tend to be called C source etc. The last few entries
# recognise a couple of common image formats, always useful when trolling for
# users who are wasting disc space when things are tight.
#	- Cameron Simpson
#	  cameron@cs.unsw.oz.au
#
0	string		#!			exec()able script 
>2	string		/bin/sh			- Bourne shell
>2	string		/bin/ksh		- Korn shell
>2	string		/usr/local/bin/zsh	- Paul Falstad's zsh
>2	string		/usr/local/bin/ash	- NeilBrown's ash
>2	string		/usr/local/bin/ae	- NeilBrown's ae
>2	string		/usr/local/bin/perl	- Perl
>2	string		/usr/bin/perl		- Perl
>2	string		/bin/awk		- AWK
>2	string		/bin/nawk		- new AWK
>2	string		/usr/bin/nawk		- new AWK
>2	string		/usr/local/bin/nawk	- new AWK
>2	string		/bin/gawk		- GNU AWK
>2	string		/usr/local/bin/gawk	- GNU AWK
>2	string		/bin/csh		- C shell
0	string		GIF			GIF image archive 
>3	string		87a			(version 87a)
>3	string		87A			(version 87a)
>3	string		89a			(version 89a)
>3	string		89A			(version 89a)
# GRR:	can also use "short 0x4949" and "short 0x4d4d":
0	string		II			TIFF image, little-endian
0	string		MM			TIFF image, big-endian
# GRR:	one of these should probably be commented out...
0	long		0xe0ffd8ff		JPEG image, little-endian
0	long		0xffd8ffe0		JPEG image, big-endian
0	string		hsi1			HSI1 image (wrapper for JPEG?)
#
