Subject: magic/file(1) entries for compressed archives
From: Cave Newt <[email-masked]>
Date: 30 Jul 1994 02:05:59 +0300
Newsgroups: comp.os.linux.announce

I was surprised to see that the magic file distributed with Slackware 1.2
(last March, I think) is not only missing a number of popular archive
formats but is also just plain wrong on one which is near and dear to my
heart (zip).  Perhaps this has been rectified in more recent versions,
but just in case, here's my collection.  Note that I'm missing "uc2" and
"rar" info, and the gzip entry could be expanded greatly.  Haven't had
time to mess with all that...

I've also appended a bunch which were originally posted to alt.sources a
long time ago.  Many of them are already in the distributed magic file,
but I didn't have time to cull out the duplicates (it's not exactly well-
organized, ahem).

Greg Roelofs
(Info-ZIP)

# Newtware Specials:  compressed or PC-based files (also zsh and TIFF, bottom).
# Greg Roelofs, 15 May 92.  Most recent revisions:  29 Jul 94.
#
0	string		MZ			MS-DOS executable
>24	string		@			(OS/2 or Windows format)
#
# >>>>> ARC <<<<<
#
0	string		\032\010		ARC archive
# [stupid "file" programs, big-endian]
# 0	short		0x1a08			ARC archive
# [stupid "file" programs, little-endian]
# 0	short		0x081a			ARC archive
#
# >>>>> ARJ <<<<<
#
0	string		\140\352		ARJ archive
# [stupid "file" programs, big-endian]
# 0	short		0x60ea			ARJ archive
# [stupid "file" programs, little-endian]   [from file 3.9-OS/2 magic file]
# 0	short		0xea60			ARJ archive
#
# >>>>> BMP, etc. <<<<<
#
0	string		BM			bitmap
>14	byte		12			(OS/2 1.x format)
>14	byte		64			(OS/2 2.x format)
>14	byte		40			(Windows 3.x format)
0	string		IC			icon
0	string		PI			pointer
0	string		CI			color icon
0	string		CP			color pointer
0	string		BA			bitmap array
#
# >>>>> COMPRESS <<<<<
#
# [newer, smarter "file" programs]
0	string		\037\235		compress'd file
# [stupid "file" programs, big-endian]
# 0	short		0x1f9d			compress'd file
# [stupid "file" programs, little-endian]
# 0	short		0x9d1f			compress'd file
# [GRR:  are the upper three bits (block size) ever different from 100?]
>2	byte		0x89			(9 bits)
>2	byte		0x8a			(10 bits)
>2	byte		0x8b			(11 bits)
>2	byte		0x8c			(12 bits)
>2	byte		0x8d			(13 bits)
>2	byte		0x8e			(14 bits)
>2	byte		0x8f			(15 bits)
>2	byte		0x90			(16 bits)
#
# >>>>> GZIP <<<<<
#
# [newer, smarter "file" programs]
0	string		\037\213		gzip'd file
# [stupid "file" programs, big-endian]
# 0	short		0x1f8b			gzip'd file
# [stupid "file" programs, little-endian]
# 0	short		0x8b1f			gzip'd file
#
# >>>>> HPACK <<<<<   [from Peter Gutmann, [email-masked]]
#
0	string		HPAK			HPACK archive
#
# >>>>> LHARC/LHA <<<<<
#
2	string		-lh0-			Lharc 1.x archive [lh0]
2	string		-lh1-			Lharc 1.x archive [lh1]
2	string		-lz4-			Lharc 1.x archive [lz4]
2	string		-lz5-			Lharc 1.x archive [lz5]
#	[never seen any but the last; -lh4- reported in comp.compression:]
2	string		-lzs-			LHa 2.x? archive [lzs]
2	string		-lh -			LHa 2.x? archive [lh ]
2	string		-lhd-			LHa 2.x? archive [lhd]
2	string		-lh2-			Lha 2.x? archive [lh2]
2	string		-lh3-			LHa 2.x? archive [lh3]
2	string		-lh4-			LHa (2.x) archive [lh4]
2	string		-lh5-			LHa (2.x) archive [lh5]
#
# >>>>> SQUISH <<<<<
#
0	string		SQSH			squished archive (Acorn RISCOS)
#
# >>>>> ZIP <<<<<
#
# [newer, smarter "file" programs]
0	string		PK\003\004		Zip archive
# [stupid "file" programs, big-endian]
# 0	long    	0x504b0304		Zip archive
# [stupid "file" programs, little-endian]
# 0	long    	0x04034b50		Zip archive
# [everybody:]
>4	byte		0x09			(at least v0.9 to extract)
>4	byte		0x0a			(at least v1.0 to extract)
>4	byte		0x0b			(at least v1.1 to extract)
>4	byte		0x14			(at least v2.0 to extract)
#
# >>>>> ZOO <<<<<
#
# [GRR:  don't know if all of these versions exist, or if some are missing...]
0	string		ZOO 			Zoo archive
>4	string		1.00			(v%4s)
>4	string		1.10			(v%4s)
>4	string		1.20			(v%4s)
>4	string		1.30			(v%4s)
>4	string		1.40			(v%4s)
>4	string		1.50			(v%4s)
>4	string		1.60			(v%4s)
>4	string		1.70			(v%4s)
>4	string		1.71			(v%4s)
>4	string		2.00			(v%4s)
>4	string		2.01			(v%4s)
>4	string		2.10			(v%4s)
# [newer, smarter "file" programs]
>32	string		\001\000		(modify: v1.0+)
>32	string		\001\004		(modify: v1.4+)
>32	string		\002\000		(modify: v2.0+)
>70	string		\001\000		(extract: v1.0+)
>70	string		\002\001		(extract: v2.1+)
# [stupid "file" programs, big-endian]
# >32	short		0x0100			(modify: v1.0+)
# >32	short		0x0104			(modify: v1.4+)
# >32	short		0x0200			(modify: v2.0+)
# >70	short		0x0100			(extract: v1.0+)
# >70	short		0x0201			(extract: v2.1+)
# [stupid "file" programs, little-endian]
# >32	short		0x0001			(modify: v1.0+)
# >32	short		0x0401			(modify: v1.4+)
# >32	short		0x0002			(modify: v2.0+)
# >70	short		0x0001			(extract: v1.0+)
# >70	short		0x0102			(extract: v2.1+)
# [GRR:  the following are alternate identifiers]
#20	long		0xdca7c4fd		Zoo archive
#20	long		0xc4fddca7		Zoo archive
#
#
# From: [email-masked] (Cameron Simpson)
# Newsgroups: alt.sources,comp.unix.programming
# Subject: some useful additions to your magic file ...
# Message-ID: <[email-masked]>
# Date: 21 Mar 92 05:55:23 GMT
# Sender: [email-masked]
# Organization: CS&E Computing Facility, Uni Of NSW, Oz
#
# This is simply a list of a few entries which seem missing from most systems'
# magic files. The first 10 or so entries recognise and classify executable
# scripts, which otherwise tend to be called C source etc. The last few entries
# recognise a couple of common image formats, always useful when trolling for
# users who are wasting disc space when things are tight.
#	- Cameron Simpson
#	  [email-masked]
#
0	string		#!			exec()able script 
>2	string		/bin/sh			- Bourne shell
>2	string		/bin/ksh		- Korn shell
>2	string		/usr/local/bin/zsh	- Paul Falstad's zsh
>2	string		/usr/local/bin/ash	- NeilBrown's ash
>2	string		/usr/local/bin/ae	- NeilBrown's ae
>2	string		/usr/local/bin/perl	- Perl
>2	string		/usr/bin/perl		- Perl
>2	string		/bin/awk		- AWK
>2	string		/bin/nawk		- new AWK
>2	string		/usr/bin/nawk		- new AWK
>2	string		/usr/local/bin/nawk	- new AWK
>2	string		/bin/gawk		- GNU AWK
>2	string		/usr/local/bin/gawk	- GNU AWK
>2	string		/bin/csh		- C shell
0	string		GIF			GIF image archive 
>3	string		87a			(version 87a)
>3	string		87A			(version 87a)
>3	string		89a			(version 89a)
>3	string		89A			(version 89a)
# GRR:  can also use "short 0x4949" and "short 0x4d4d":
0	string		II			TIFF image, little-endian
0	string		MM			TIFF image, big-endian
# GRR:  one of these should probably be commented out...
0	long		0xe0ffd8ff		JPEG image, little-endian
0	long		0xffd8ffe0		JPEG image, big-endian
0	string		hsi1			HSI1 image (wrapper for JPEG?)
#

--
Send submissions for comp.os.linux.announce to: [email-masked]
PLEASE remember Keywords: and a short description of the software.