1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
|
diff -u file-5.31.orig/magic/Magdir/cafebabe file-5.31/magic/Magdir/cafebabe
--- file-5.31.orig/magic/Magdir/cafebabe 2017-03-17 21:35:28.000000000 +0000
+++ file-5.31/magic/Magdir/cafebabe 2017-10-11 14:30:57.476077825 +0000
@@ -15,22 +15,6 @@
# might add another one or two as time goes by...
#
### JAVA START ###
-0 belong 0xcafebabe
->4 belong >30 compiled Java class data,
-!:mime application/x-java-applet
->>6 beshort x version %d.
->>4 beshort x \b%d
-# Which is which?
-#>>4 belong 0x032d (Java 1.0)
-#>>4 belong 0x032d (Java 1.1)
->>4 belong 0x002e (Java 1.2)
->>4 belong 0x002f (Java 1.3)
->>4 belong 0x0030 (Java 1.4)
->>4 belong 0x0031 (Java 1.5)
->>4 belong 0x0032 (Java 1.6)
->>4 belong 0x0033 (Java 1.7)
->>4 belong 0x0034 (Java 1.8)
-
0 belong 0xcafed00d JAR compressed with pack200,
>5 byte x version %d.
>4 byte x \b%d
@@ -52,15 +36,28 @@
0 belong 0xcafebabe
>4 belong 1 Mach-O universal binary with 1 architecture:
-!:mime application/x-mach-binary
>>8 use mach-o \b
+0 belong 0xcafebabe
+>4 belong >30 compiled Java class data,
+!:mime application/x-java-applet
+>>6 beshort x version %d.
+>>4 beshort x \b%d
+# Which is which?
+#>>4 belong 0x032d (Java 1.0)
+#>>4 belong 0x032d (Java 1.1)
+>>4 belong 0x002e (Java 1.2)
+>>4 belong 0x002f (Java 1.3)
+>>4 belong 0x0030 (Java 1.4)
+>>4 belong 0x0031 (Java 1.5)
+>>4 belong 0x0032 (Java 1.6)
+>>4 belong 0x0033 (Java 1.7)
+>>4 belong 0x0034 (Java 1.8)
>4 belong >1
>>4 belong <20 Mach-O universal binary with %d architectures:
-!:mime application/x-mach-binary
>>>8 use mach-o \b
->>4 belong 2
+>>4 belong >2
>>>28 use mach-o \b
->>4 belong 3
+>>4 belong >3
>>>48 use mach-o \b
>>4 belong 4
>>>68 use mach-o \b
diff -u file-5.31.orig/magic/Magdir/commands file-5.31/magic/Magdir/commands
--- file-5.31.orig/magic/Magdir/commands 2017-04-04 20:34:24.000000000 +0000
+++ file-5.31/magic/Magdir/commands 2017-10-11 14:29:57.653552987 +0000
@@ -56,7 +56,7 @@
!:mime text/x-awk
0 string/wt #!\ /usr/bin/awk awk script text executable
!:mime text/x-awk
-0 regex/4096 =^[A-Za-z0-9_]{0,100}BEGIN[A-Za-z0-9_]{0,100}[{] awk or perl script text
+0 regex/4096 =^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{] awk or perl script text
# AT&T Bell Labs' Plan 9 shell
0 string/wt #!\ /bin/rc Plan 9 rc shell script text executable
diff -u file-5.31.orig/magic/Magdir/dump file-5.31/magic/Magdir/dump
--- file-5.31.orig/magic/Magdir/dump 2017-03-17 21:35:28.000000000 +0000
+++ file-5.31/magic/Magdir/dump 2017-10-11 14:30:09.622057792 +0000
@@ -69,6 +69,8 @@
>0 use old-dump-be
24 lelong 60012 new-fs dump file (little endian),
+# to correctly recognize '*.mo' GNU message catalog (little endian)
+!:strength - 15
>0 use \^new-dump-be
24 lelong 60011 old-fs dump file (little endian),
diff -u file-5.31.orig/magic/Magdir/filesystems file-5.31/magic/Magdir/filesystems
--- file-5.31.orig/magic/Magdir/filesystems 2017-03-24 19:29:26.000000000 +0000
+++ file-5.31/magic/Magdir/filesystems 2017-10-11 14:30:57.476077825 +0000
@@ -254,7 +254,7 @@
30 search/481 \x55\xAA
# to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
# DOS BPB information (70) and after DOS floppy (120) like in previous file version
-!:strength +65
+!:strength +0
# for sector sizes < 512 Bytes
>11 uleshort <512
>>(11.s-2) uleshort 0xAA55 DOS/MBR boot sector
@@ -266,7 +266,7 @@
0x1FE leshort 0xAA55 DOS/MBR boot sector
#
# to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
-!:strength +65
+!:strength +0
>2 string OSBS OS/BS MBR
# added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
# and http://en.wikipedia.org/wiki/Master_Boot_Record
Only in file-5.31/magic/Magdir/: gconv
diff -u file-5.31.orig/magic/Magdir/images file-5.31/magic/Magdir/images
--- file-5.31.orig/magic/Magdir/images 2017-04-04 20:34:24.000000000 +0000
+++ file-5.31/magic/Magdir/images 2017-10-11 14:29:57.653552987 +0000
@@ -175,42 +175,42 @@
>>>&0 regex =[0-9]{1,50} \b %s
0 search/1 P1
->0 regex/4 P1[A-Za-z0-9_]
+>0 regex/4 P1[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, bitmap
!:strength + 45
!:mime image/x-portable-bitmap
0 search/1 P2
->0 regex/4 P2[A-Za-z0-9_]
+>0 regex/4 P2[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, greymap
!:strength + 45
!:mime image/x-portable-greymap
0 search/1 P3
->0 regex/4 P3[A-Za-z0-9_]
+>0 regex/4 P3[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, pixmap
!:strength + 45
!:mime image/x-portable-pixmap
0 string P4
->0 regex/4 P4[A-Za-z0-9_]
+>0 regex/4 P4[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, rawbits, bitmap
!:strength + 45
!:mime image/x-portable-bitmap
0 string P5
->0 regex/4 P5[A-Za-z0-9_]
+>0 regex/4 P5[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, rawbits, greymap
!:strength + 45
!:mime image/x-portable-greymap
0 string P6
->0 regex/4 P6[A-Za-z0-9_]
+>0 regex/4 P6[\040\t\f\r\n]
>>0 use netpbm
>>>0 string x \b, rawbits, pixmap
!:strength + 45
diff -u file-5.31.orig/magic/Magdir/python file-5.31/magic/Magdir/python
--- file-5.31.orig/magic/Magdir/python 2017-05-08 18:10:13.000000000 +0000
+++ file-5.31/magic/Magdir/python 2017-10-11 14:29:57.653552987 +0000
@@ -64,7 +64,7 @@
# except: or finally:
# block
0 search/4096 try:
->&0 regex \^[A-Za-z0-9_]*except.*: Python script text executable
+>&0 regex \^[\040\t\f\r\n]*except.*: Python script text executable
!:strength + 15
!:mime text/x-python
>&0 search/4096 finally: Python script text executable
diff -u file-5.31.orig/magic/Magdir/rpm file-5.31/magic/Magdir/rpm
--- file-5.31.orig/magic/Magdir/rpm 2017-03-17 21:34:26.000000000 +0000
+++ file-5.31/magic/Magdir/rpm 2017-10-11 14:30:57.480078009 +0000
@@ -29,6 +29,7 @@
>>8 beshort 17 SuperH
>>8 beshort 18 Xtensa
>>8 beshort 255 noarch
+>>10 string x %s
#delta RPM Daniel Novotny (dnovotny@redhat.com)
0 string drpm Delta RPM
diff -u file-5.31.orig/magic/Magdir/ruby file-5.31/magic/Magdir/ruby
--- file-5.31.orig/magic/Magdir/ruby 2017-03-17 21:34:26.000000000 +0000
+++ file-5.31/magic/Magdir/ruby 2017-10-11 14:30:24.410682267 +0000
@@ -6,27 +6,46 @@
# From: Reuben Thomas <rrt@sc3d.org>
# Ruby scripts
-0 search/1/w #!\ /usr/bin/ruby Ruby script text executable
+0 search/1/w #!\ /usr/bin/ruby Ruby script text executable
!:strength + 15
!:mime text/x-ruby
0 search/1/w #!\ /usr/local/bin/ruby Ruby script text executable
!:strength + 15
!:mime text/x-ruby
-0 search/1 #!/usr/bin/env\ ruby Ruby script text executable
+0 search/1 #!/usr/bin/env\ ruby Ruby script text executable
!:strength + 15
!:mime text/x-ruby
-0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable
+0 search/1 #!\ /usr/bin/env\ ruby Ruby script text executable
!:strength + 15
!:mime text/x-ruby
# What looks like ruby, but does not have a shebang
# (modules and such)
# From: Lubomir Rintel <lkundrak@v3.sk>
-0 regex \^[\ \t]*require[\ \t]'[A-Za-z_/]+'
->0 regex include\ [A-Z]|def\ [a-z]|\ do$
->>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby script text
+0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
+>0 regex def\ [a-z]|\ do$
+>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text
+!:strength + 30
!:mime text/x-ruby
-0 regex \^[\ \t]*(class|module)[\ \t][A-Z]
+0 regex \^[[:space:]]*(class|module)[[:space:]][A-Z]
>0 regex (modul|includ)e\ [A-Z]|def\ [a-z]
->>0 regex \^[\ \t]*end([\ \t]*[;#].*)?$ Ruby module source text
+>>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text
+!:strength + 30
+!:mime text/x-ruby
+# Classes with no modules or defs, beats simple ASCII
+0 regex \^[[:space:]]*(class|module)[[:space:]][A-Z]
+>&0 regex \^[[:space:]]*end([[:space:]]+[;#if].*)?$ Ruby script text
+!:strength + 10
+!:mime text/x-ruby
+# Looks for function definiton to balance python magic
+# def name (args)
+# end
+0 regex \^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
+>&0 regex \^[[:space:]]*end([[:space:]]+[;#].*)?$ Ruby script text
+!:strength + 10
+!:mime text/x-ruby
+
+0 regex \^[[:space:]]*require[[:space:]]'[A-Za-z_/]+' Ruby script text
+!:mime text/x-ruby
+0 regex \^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+ Ruby script text
!:mime text/x-ruby
diff -u file-5.31.orig/magic/Magdir/securitycerts file-5.31/magic/Magdir/securitycerts
--- file-5.31.orig/magic/Magdir/securitycerts 2017-03-17 21:34:26.000000000 +0000
+++ file-5.31/magic/Magdir/securitycerts 2017-10-11 14:30:57.480078009 +0000
@@ -4,3 +4,5 @@
0 search/1 -----BEGIN\ CERTIFICATE------ RFC1421 Security Certificate text
0 search/1 -----BEGIN\ NEW\ CERTIFICATE RFC1421 Security Certificate Signing Request text
0 belong 0xedfeedfe Sun 'jks' Java Keystore File data
+
+0 string \0volume_key volume_key escrow packet
diff -u file-5.31.orig/magic/Magdir/varied.script file-5.31/magic/Magdir/varied.script
--- file-5.31.orig/magic/Magdir/varied.script 2017-03-17 21:34:26.000000000 +0000
+++ file-5.31/magic/Magdir/varied.script 2017-10-11 14:30:57.480078009 +0000
@@ -4,27 +4,35 @@
0 string/t #!\ / a
>3 string >\0 %s script text executable
+!:strength / 10
0 string/b #!\ / a
>3 string >\0 %s script executable (binary data)
+!:strength / 10
0 string/t #!\t/ a
>3 string >\0 %s script text executable
+!:strength / 10
0 string/b #!\t/ a
>3 string >\0 %s script executable (binary data)
+!:strength / 10
0 string/t #!/ a
>2 string >\0 %s script text executable
+!:strength / 10
0 string/b #!/ a
>2 string >\0 %s script executable (binary data)
+!:strength / 10
0 string/t #!\ script text executable
>3 string >\0 for %s
+!:strength / 10
0 string/b #!\ script executable
>3 string >\0 for %s (binary data)
+!:strength / 10
# using env
0 string/t #!/usr/bin/env a
|
