168349Sobrien 268349Sobrien#------------------------------------------------------------------------------ 3226048Sobrien# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 468349Sobrien# freebsd: file(1) magic for FreeBSD objects 568349Sobrien# 668349Sobrien# All new-style FreeBSD magic numbers are in host byte order (i.e., 768349Sobrien# little-endian on x86). 868349Sobrien# 968349Sobrien# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 1068349Sobrien# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 1168349Sobrien# schemes for distinguishing between executable images, shared libraries, 1268349Sobrien# and object files. 1368349Sobrien# 1468349Sobrien# FreeBSD says: 1568349Sobrien# 1668349Sobrien# Regardless of whether it's pure, demand-paged, or none of the 1768349Sobrien# above: 1868349Sobrien# 1968349Sobrien# if the entry point is < 4096, then it's a shared library if 2068349Sobrien# the "has run-time loader information" bit is set, and is 2168349Sobrien# position-independent if the "is position-independent" bit 2268349Sobrien# is set; 2368349Sobrien# 2468349Sobrien# if the entry point is >= 4096 (or >4095, same thing), then it's 2568349Sobrien# an executable, and is dynamically-linked if the "has run-time 2668349Sobrien# loader information" bit is set. 2768349Sobrien# 2868349Sobrien# On x86, NetBSD says: 2968349Sobrien# 3068349Sobrien# If it's neither pure nor demand-paged: 3168349Sobrien# 3268349Sobrien# if it has the "has run-time loader information" bit set, it's 3368349Sobrien# a dynamically-linked executable; 3468349Sobrien# 3568349Sobrien# if it doesn't have that bit set, then: 3668349Sobrien# 3768349Sobrien# if it has the "is position-independent" bit set, it's 3868349Sobrien# position-independent; 3968349Sobrien# 4068349Sobrien# if the entry point is non-zero, it's an executable, otherwise 4168349Sobrien# it's an object file. 4268349Sobrien# 4368349Sobrien# If it's pure: 4468349Sobrien# 4568349Sobrien# if it has the "has run-time loader information" bit set, it's 4668349Sobrien# a dynamically-linked executable, otherwise it's just an 4768349Sobrien# executable. 4868349Sobrien# 4968349Sobrien# If it's demand-paged: 5068349Sobrien# 5168349Sobrien# if it has the "has run-time loader information" bit set, 5268349Sobrien# then: 5368349Sobrien# 5468349Sobrien# if the entry point is < 4096, it's a shared library; 5568349Sobrien# 5668349Sobrien# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 5768349Sobrien# it's a dynamically-linked executable); 5868349Sobrien# 5968349Sobrien# if it doesn't have the "has run-time loader information" bit 6068349Sobrien# set, then it's just an executable. 6168349Sobrien# 6268349Sobrien# (On non-x86, NetBSD does much the same thing, except that it uses 6368349Sobrien# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 6468349Sobrien# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 6568349Sobrien# had 8K pages; dunno about MIPS.) 6668349Sobrien# 6768349Sobrien# I suspect the two will differ only in perverse and uninteresting cases 6868349Sobrien# ("shared" libraries that aren't demand-paged and whose pages probably 6968349Sobrien# won't actually be shared, executables with entry points <4096). 7068349Sobrien# 7168349Sobrien# I leave it to those more familiar with FreeBSD and NetBSD to figure out 7268349Sobrien# what the right answer is (although using ">4095", FreeBSD-style, is 7368349Sobrien# probably better than separately checking for "=4096" and ">4096", 7468349Sobrien# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 7568349Sobrien# executables using the NetBSD technique.) 7668349Sobrien# 7768349Sobrien0 lelong&0377777777 041400407 FreeBSD/i386 7868349Sobrien>20 lelong <4096 7968349Sobrien>>3 byte&0xC0 &0x80 shared library 8068349Sobrien>>3 byte&0xC0 0x40 PIC object 8168349Sobrien>>3 byte&0xC0 0x00 object 8268349Sobrien>20 lelong >4095 8368349Sobrien>>3 byte&0x80 0x80 dynamically linked executable 8468349Sobrien>>3 byte&0x80 0x00 executable 8568349Sobrien>16 lelong >0 not stripped 8668349Sobrien 8768349Sobrien0 lelong&0377777777 041400410 FreeBSD/i386 pure 8868349Sobrien>20 lelong <4096 8968349Sobrien>>3 byte&0xC0 &0x80 shared library 9068349Sobrien>>3 byte&0xC0 0x40 PIC object 9168349Sobrien>>3 byte&0xC0 0x00 object 9268349Sobrien>20 lelong >4095 9368349Sobrien>>3 byte&0x80 0x80 dynamically linked executable 9468349Sobrien>>3 byte&0x80 0x00 executable 9568349Sobrien>16 lelong >0 not stripped 9668349Sobrien 9768349Sobrien0 lelong&0377777777 041400413 FreeBSD/i386 demand paged 9868349Sobrien>20 lelong <4096 9968349Sobrien>>3 byte&0xC0 &0x80 shared library 10068349Sobrien>>3 byte&0xC0 0x40 PIC object 10168349Sobrien>>3 byte&0xC0 0x00 object 10268349Sobrien>20 lelong >4095 10368349Sobrien>>3 byte&0x80 0x80 dynamically linked executable 10468349Sobrien>>3 byte&0x80 0x00 executable 10568349Sobrien>16 lelong >0 not stripped 10668349Sobrien 10768349Sobrien0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 10868349Sobrien>20 lelong <4096 10968349Sobrien>>3 byte&0xC0 &0x80 shared library 11068349Sobrien>>3 byte&0xC0 0x40 PIC object 11168349Sobrien>>3 byte&0xC0 0x00 object 11268349Sobrien>20 lelong >4095 11368349Sobrien>>3 byte&0x80 0x80 dynamically linked executable 11468349Sobrien>>3 byte&0x80 0x00 executable 11568349Sobrien>16 lelong >0 not stripped 11668349Sobrien 11768349Sobrien# XXX gross hack to identify core files 11868349Sobrien# cores start with a struct tss; we take advantage of the following: 11968349Sobrien# byte 7: highest byte of the kernel stack pointer, always 0xfe 12068349Sobrien# 8/9: kernel (ring 0) ss value, always 0x0010 12168349Sobrien# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 12268349Sobrien# 28: low order byte of the current PTD entry, always 0 since the 12368349Sobrien# PTD is page-aligned 12468349Sobrien# 12568349Sobrien7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 12668349Sobrien>1039 string >\0 from '%s' 12768349Sobrien 12868349Sobrien# /var/run/ld.so.hints 12968349Sobrien# What are you laughing about? 13075937Sobrien0 lelong 011421044151 ld.so hints file (Little Endian 13175937Sobrien>4 lelong >0 \b, version %d) 132186690Sobrien>4 belong <1 \b) 13375937Sobrien0 belong 011421044151 ld.so hints file (Big Endian 13475937Sobrien>4 belong >0 \b, version %d) 135186690Sobrien>4 belong <1 \b) 13680588Sobrien 13780588Sobrien# 13880588Sobrien# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 13980588Sobrien# 14080588Sobrien0 string SCRSHOT_ scrshot(1) screenshot, 14180588Sobrien>8 byte x version %d, 14280588Sobrien>9 byte 2 %d bytes in header, 14380588Sobrien>>10 byte x %d chars wide by 14480588Sobrien>>11 byte x %d chars high 145