1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
|
Patches applied to file 5.17 sources tree before generating magic.mgc
and before running create_data_file.php to create data_file.c.
diff -u magic/Magdir.orig.0/cafebabe magic/Magdir/cafebabe
--- magic/Magdir.orig.0/cafebabe 2015-10-16 00:54:18.000000000 +0000
+++ magic/Magdir/cafebabe 2016-11-24 15:59:25.553060242 +0000
@@ -15,22 +15,6 @@
# might add another one or two as time goes by...
#
### JAVA START ###
-0 belong 0xcafebabe
->4 belong >30 compiled Java class data,
-!:mime application/x-java-applet
->>6 beshort x version %d.
->>4 beshort x \b%d
-# Which is which?
-#>>4 belong 0x032d (Java 1.0)
-#>>4 belong 0x032d (Java 1.1)
->>4 belong 0x002e (Java 1.2)
->>4 belong 0x002f (Java 1.3)
->>4 belong 0x0030 (Java 1.4)
->>4 belong 0x0031 (Java 1.5)
->>4 belong 0x0032 (Java 1.6)
->>4 belong 0x0033 (Java 1.7)
->>4 belong 0x0034 (Java 1.8)
-
0 belong 0xcafed00d JAR compressed with pack200,
>5 byte x version %d.
>4 byte x \b%d
@@ -52,15 +36,28 @@
0 belong 0xcafebabe
>4 belong 1 Mach-O universal binary with 1 architecture:
-!:mime application/x-mach-binary
>>8 use mach-o \b
+0 belong 0xcafebabe
+>4 belong >30 compiled Java class data,
+!:mime application/x-java-applet
+>>6 beshort x version %d.
+>>4 beshort x \b%d
+# Which is which?
+#>>4 belong 0x032d (Java 1.0)
+#>>4 belong 0x032d (Java 1.1)
+>>4 belong 0x002e (Java 1.2)
+>>4 belong 0x002f (Java 1.3)
+>>4 belong 0x0030 (Java 1.4)
+>>4 belong 0x0031 (Java 1.5)
+>>4 belong 0x0032 (Java 1.6)
+>>4 belong 0x0033 (Java 1.7)
+>>4 belong 0x0034 (Java 1.8)
>4 belong >1
>>4 belong <20 Mach-O universal binary with %d architectures:
-!:mime application/x-mach-binary
>>>8 use mach-o \b
->>4 belong 2
+>>4 belong >2
>>>28 use mach-o \b
->>4 belong 3
+>>4 belong >3
>>>48 use mach-o \b
>>4 belong 4
>>>68 use mach-o \b
diff -u magic/Magdir.orig.0/commands magic/Magdir/commands
--- magic/Magdir.orig.0/commands 2016-07-14 19:01:12.000000000 +0000
+++ magic/Magdir/commands 2016-11-24 15:59:25.557060441 +0000
@@ -56,7 +56,7 @@
!:mime text/x-awk
0 string/wt #!\ /usr/bin/awk awk script text executable
!:mime text/x-awk
-0 regex/4096 =^\\s{0,100}BEGIN\\s{0,100}[{] awk or perl script text
+0 regex/4096 =^\\s{0,100}BEGIN\\s{0,100}[{] awk script text
# AT&T Bell Labs' Plan 9 shell
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
diff -u magic/Magdir.orig.0/filesystems magic/Magdir/filesystems
--- magic/Magdir.orig.0/filesystems 2016-09-05 08:34:25.000000000 +0000
+++ magic/Magdir/filesystems 2016-11-24 15:59:25.553060242 +0000
@@ -254,7 +254,7 @@
30 search/481 \x55\xAA
# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
# DOS BPB information (70) and after DOS floppy (120) like in previous file version
-!:strength +65
+!:strength +0
# for sector sizes < 512 Bytes
>11 uleshort <512
>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector
@@ -266,7 +266,7 @@
0x1FE leshort 0xAA55 DOS/MBR boot sector
#
# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
-!:strength +65
+!:strength +0
>2 string OSBS OS/BS MBR
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
# and http://en.wikipedia.org/wiki/Master_Boot_Record
diff -u magic/Magdir.orig.0/msdos magic/Magdir/msdos
--- magic/Magdir.orig.0/msdos 2016-09-14 01:26:26.000000000 +0000
+++ magic/Magdir/msdos 2016-11-24 15:58:56.327609010 +0000
@@ -404,7 +404,7 @@
# GRR: line below too general as it catches also
# rt.lib DYADISKS.PIC and many more
# start with assembler instruction MOV
-0 ubyte 0x8c
+#0 ubyte 0x8c
# skip "AppleWorks word processor data" like ARTICLE.1 ./apple
>4 string !O====
# skip some unknown basic binaries like RocketRnger.SHR
@@ -428,17 +428,17 @@
# updated by Joerg Jenderek at Oct 2008
0 ulelong 0xffff10eb DR-DOS executable (COM)
# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
-0 ubeshort&0xeb8d >0xeb00
+#0 ubeshort&0xeb8d >0xeb00
# DR-DOS STACKER.COM SCREATE.SYS missed
0 name msdos-com
>0 byte x DOS executable (COM)
>6 string SFX\ of\ LHarc \b, %s
->0x1FE leshort 0xAA55 \b, boot code
->85 string UPX \b, UPX compressed
->4 string \ $ARX \b, ARX self-extracting archive
->4 string \ $LHarc \b, LHarc self-extracting archive
->0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
+#>0x1FE leshort 0xAA55 \b, boot code
+#>85 string UPX \b, UPX compressed
+#>4 string \ $ARX \b, ARX self-extracting archive
+#>4 string \ $LHarc \b, LHarc self-extracting archive
+#>0x20e string SFX\ by\ LARC \b, LARC self-extracting archive
# JMP 8bit
0 byte 0xeb
@@ -508,27 +508,27 @@
# GRR search is not working
#2 search/28 \xcd\x21 COM executable for MS-DOS
#WHICHFAT.cOM
-2 string \xcd\x21 COM executable for DOS
+#2 string \xcd\x21 COM executable for DOS
#DELTREE.cOM DELTREE2.cOM
-4 string \xcd\x21 COM executable for DOS
+#4 string \xcd\x21 COM executable for DOS
#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
-5 string \xcd\x21 COM executable for DOS
+#5 string \xcd\x21 COM executable for DOS
#DELTMP.COm HASFAT32.cOM
-7 string \xcd\x21
->0 byte !0xb8 COM executable for DOS
+#7 string \xcd\x21
+#>0 byte !0xb8 COM executable for DOS
#COMP.cOM MORE.COm
-10 string \xcd\x21
->5 string !\xcd\x21 COM executable for DOS
+#10 string \xcd\x21
+#>5 string !\xcd\x21 COM executable for DOS
#comecho.com
-13 string \xcd\x21 COM executable for DOS
+#13 string \xcd\x21 COM executable for DOS
#HELP.COm EDIT.coM
-18 string \xcd\x21 COM executable for MS-DOS
+#18 string \xcd\x21 COM executable for MS-DOS
#NWRPLTRM.COm
-23 string \xcd\x21 COM executable for MS-DOS
+#23 string \xcd\x21 COM executable for MS-DOS
#LOADFIX.cOm LOADFIX.cOm
-30 string \xcd\x21 COM executable for MS-DOS
+#30 string \xcd\x21 COM executable for MS-DOS
#syslinux.com 3.11
-70 string \xcd\x21 COM executable for DOS
+#70 string \xcd\x21 COM executable for DOS
# many compressed/converted COMs start with a copy loop instead of a jump
0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS
diff -u magic/Magdir.orig.0/perl magic/Magdir/perl
--- magic/Magdir.orig.0/perl 2016-06-12 16:50:16.000000000 +0000
+++ magic/Magdir/perl 2016-11-24 15:59:25.553060242 +0000
@@ -7,40 +7,54 @@
# Send additions to <perl5-porters@perl.org>
0 search/1024 eval\ "exec\ perl Perl script text
!:mime text/x-perl
+!:strength + 30
0 search/1024 eval\ "exec\ /bin/perl Perl script text
!:mime text/x-perl
+!:strength + 30
0 search/1024 eval\ "exec\ /usr/bin/perl Perl script text
!:mime text/x-perl
+!:strength + 30
0 search/1024 eval\ "exec\ /usr/local/bin/perl Perl script text
!:mime text/x-perl
+!:strength + 30
0 search/1024 eval\ 'exec\ perl Perl script text
!:mime text/x-perl
+!:strength + 30
0 search/1024 eval\ 'exec\ /bin/perl Perl script text
!:mime text/x-perl
+!:strength + 30
0 search/1024 eval\ 'exec\ /usr/bin/perl Perl script text
!:mime text/x-perl
+!:strength + 30
0 search/1024 eval\ 'exec\ /usr/local/bin/perl Perl script text
!:mime text/x-perl
+!:strength + 30
0 search/1024 eval\ '(exit\ $?0)'\ &&\ eval\ 'exec Perl script text
!:mime text/x-perl
+!:strength + 1
0 string #!/usr/bin/env\ perl Perl script text executable
!:mime text/x-perl
+!:strength + 30
0 string #!\ /usr/bin/env\ perl Perl script text executable
!:mime text/x-perl
+!:strength + 30
0 string #!
>0 regex \^#!.*/bin/perl([[:space:]].*)*$ Perl script text executable
!:mime text/x-perl
+!:strength + 30
# by Dmitry V. Levin and Alexey Tourbin
# check the first line
0 search/1024 package
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *; Perl5 module source text
+!:mime text/x-perl
!:strength + 10
# not 'p', check other lines
0 search/1024 !p
>0 regex \^package[\ \t]+[0-9A-Za-z_:]+\ *;
>>0 regex \^1\ *;|\^(use|sub|my)\ .*[(;{=] Perl5 module source text
-!:strength + 10
+!:mime text/x-perl
+!:strength + 40
# Perl POD documents
# From: Tom Hukins <tom@eborcom.com>
diff -u magic/Magdir.orig.0/python magic/Magdir/python
--- magic/Magdir.orig.0/python 2016-09-16 12:06:13.000000000 +0000
+++ magic/Magdir/python 2016-11-24 15:59:25.549060044 +0000
@@ -43,20 +43,24 @@
# from module.submodule import func1, func2
0 regex \^from\\s+(\\w|\\.)+\\s+import.*$ Python script text executable
!:mime text/x-python
+!:strength + 15
# def __init__ (self, ...):
0 search/4096 def\ __init__
>&0 search/64 self Python script text executable
!:mime text/x-python
+!:strength + 15
# comments
-#0 search/4096 '''
-#>&0 regex .*'''$ Python script text executable
-#!:mime text/x-python
+0 search/4096 '''
+>&0 regex .*'''$ Python script text executable
+!:mime text/x-python
+!:strength + 15
-#0 search/4096 """
-#>&0 regex .*"""$ Python script text executable
-#!:mime text/x-python
+0 search/4096 """
+>&0 regex .*"""$ Python script text executable
+!:mime text/x-python
+!:strength + 15
# try:
# except: or finally:
@@ -66,8 +70,10 @@
!:mime text/x-python
>&0 search/4096 finally: Python script text executable
!:mime text/x-python
+!:strength + 15
# def name(args, args):
-0 regex \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100}
->&0 regex \ {0,50}\\(([a-zA-Z]|,|\ ){1,255}\\):$ Python script text executable
+0 regex \^(\ |\\t)*def\ +[a-zA-Z]+
+>&0 regex \ *\\(([a-zA-Z]|,|\ )*\\):$ Python script text executable
!:mime text/x-python
+!:strength + 15
diff -u magic/Magdir.orig.0/rpm magic/Magdir/rpm
--- magic/Magdir.orig.0/rpm 2014-09-11 15:03:07.000000000 +0000
+++ magic/Magdir/rpm 2016-11-24 15:58:28.458225125 +0000
@@ -29,6 +29,7 @@
>>8 beshort 17 SuperH
>>8 beshort 18 Xtensa
>>8 beshort 255 noarch
+>>10 string x %s
#delta RPM Daniel Novotny (dnovotny@redhat.com)
0 string drpm Delta RPM
diff -u magic/Magdir.orig.0/securitycerts magic/Magdir/securitycerts
--- magic/Magdir.orig.0/securitycerts 2014-09-11 15:03:07.000000000 +0000
+++ magic/Magdir/securitycerts 2016-11-24 15:59:25.549060044 +0000
@@ -4,3 +4,5 @@
0 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text
0 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text
0 belong 0xedfeedfe Sun 'jks' Java Keystore File data
+
+0 string \0volume_key volume_key escrow packet
diff -u magic/Magdir.orig.0/varied.script magic/Magdir/varied.script
--- magic/Magdir.orig.0/varied.script 2015-03-27 17:59:39.000000000 +0000
+++ magic/Magdir/varied.script 2016-11-24 15:59:25.557060441 +0000
@@ -4,27 +4,35 @@
0 string/t #!\ / a
>3 string >\0 %s script text executable
+!:strength / 10
0 string/b #!\ / a
>3 string >\0 %s script executable (binary data)
+!:strength / 10
0 string/t #!\t/ a
>3 string >\0 %s script text executable
+!:strength / 10
0 string/b #!\t/ a
>3 string >\0 %s script executable (binary data)
+!:strength / 10
0 string/t #!/ a
>2 string >\0 %s script text executable
+!:strength / 10
0 string/b #!/ a
>2 string >\0 %s script executable (binary data)
+!:strength / 10
0 string/t #!\ script text executable
>3 string >\0 for %s
+!:strength / 10
0 string/b #!\ script executable
>3 string >\0 for %s (binary data)
+!:strength / 10
# using env
0 string/t #!/usr/bin/env a
|
