linux revision 169942
150276Speter 250276Speter#------------------------------------------------------------------------------ 397049Speter# linux: file(1) magic for Linux files 450276Speter# 550276Speter# Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com> 650276Speter# The following basic Linux magic is useful for reference, but using 756639Speter# "long" magic is a better practice in order to avoid collisions. 850276Speter# 950276Speter# 2 leshort 100 Linux/i386 1050276Speter# >0 leshort 0407 impure executable (OMAGIC) 1150276Speter# >0 leshort 0410 pure executable (NMAGIC) 1250276Speter# >0 leshort 0413 demand-paged executable (ZMAGIC) 1350276Speter# >0 leshort 0314 demand-paged executable (QMAGIC) 1450276Speter# 1550276Speter0 lelong 0x00640107 Linux/i386 impure executable (OMAGIC) 1656639Speter>16 lelong 0 \b, stripped 1750276Speter0 lelong 0x00640108 Linux/i386 pure executable (NMAGIC) 1850276Speter>16 lelong 0 \b, stripped 1950276Speter0 lelong 0x0064010b Linux/i386 demand-paged executable (ZMAGIC) 2050276Speter>16 lelong 0 \b, stripped 2150276Speter0 lelong 0x006400cc Linux/i386 demand-paged executable (QMAGIC) 2250276Speter>16 lelong 0 \b, stripped 2350276Speter# 2450276Speter0 string \007\001\000 Linux/i386 object file 2550276Speter>20 lelong >0x1020 \b, DLL library 2650276Speter# Linux-8086 stuff: 2750276Speter0 string \01\03\020\04 Linux-8086 impure executable 2850276Speter>28 long !0 not stripped 2950276Speter0 string \01\03\040\04 Linux-8086 executable 3050276Speter>28 long !0 not stripped 3150276Speter# 3250276Speter0 string \243\206\001\0 Linux-8086 object file 3350276Speter# 3450276Speter0 string \01\03\020\20 Minix-386 impure executable 3597049Speter>28 long !0 not stripped 3650276Speter0 string \01\03\040\20 Minix-386 executable 3750276Speter>28 long !0 not stripped 3850276Speter# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov> 3950276Speter216 lelong 0421 Linux/i386 core file 4050276Speter>220 string >\0 of '%s' 4176726Speter>200 lelong >0 (signal %d) 4276726Speter# 4350276Speter# LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com> 4450276Speter# this can be overridden by the DOS executable (COM) entry 4550276Speter2 string LILO Linux/i386 LILO boot/chain loader 4650276Speter# 4776726Speter# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com> 4876726Speter0 leshort 0x0436 Linux/i386 PC Screen Font data, 4950276Speter>2 byte 0 256 characters, no directory, 5050276Speter>2 byte 1 512 characters, no directory, 5150276Speter>2 byte 2 256 characters, Unicode directory, 5250276Speter>2 byte 3 512 characters, Unicode directory, 5350276Speter>3 byte >0 8x%d 5497049Speter# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com> 5550276Speter4086 string SWAP-SPACE Linux/i386 swap file 5650276Speter# From: Jeff Bailey <jbailey@ubuntu.com> 5750276Speter# Linux swap file with swsusp1 image, from Jeff Bailey <jbailey@ubuntu.com> 5850276Speter4076 string SWAPSPACE2S1SUSPEND Linux/i386 swap file (new style) with SWSUSP1 image 5950276Speter# according to man page of mkswap (8) March 1999 6050276Speter4086 string SWAPSPACE2 Linux/i386 swap file (new style) 6150276Speter>0x400 long x %d (4K pages) 6250276Speter>0x404 long x size %d pages 6350276Speter>>4086 string SWAPSPACE2 6450276Speter>>>1052 string >\0 Label %s 6550276Speter# ECOFF magic for OSF/1 and Linux (only tested under Linux though) 6650276Speter# 6750276Speter# from Erik Troan (ewt@redhat.com) examining od dumps, so this 6850276Speter# could be wrong 6950276Speter# updated by David Mosberger (davidm@azstarnet.com) based on 7050276Speter# GNU BFD and MIPS info found below. 7150276Speter# 7250276Speter0 leshort 0x0183 ECOFF alpha 7350276Speter>24 leshort 0407 executable 7450276Speter>24 leshort 0410 pure 7550276Speter>24 leshort 0413 demand paged 7697049Speter>8 long >0 not stripped 7750276Speter>8 long 0 stripped 7850276Speter>23 leshort >0 - version %ld. 7950276Speter# 8050276Speter# Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu> 8150276Speter# and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de> 8250276Speter# and Nicol�s Lichtmaier <nick@debian.org> 8350276Speter# All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29 8450276Speter# Linux kernel boot images (i386 arch) (Wolfram Kleff) 8550276Speter514 string HdrS Linux kernel 8650276Speter>510 leshort 0xAA55 x86 boot executable 8750276Speter>>518 leshort >=0x200 8850276Speter>>529 byte 0 zImage, 8950276Speter>>>529 byte 1 bzImage, 9050276Speter>>>(526.s+0x200) string >\0 version %s, 9150276Speter>>498 leshort 1 RO-rootFS, 9250276Speter>>498 leshort 0 RW-rootFS, 9350276Speter>>508 leshort >0 root_dev 0x%X, 9450276Speter>>502 leshort >0 swap_dev 0x%X, 9550276Speter>>504 leshort >0 RAMdisksize %u KB, 9650276Speter>>506 leshort 0xFFFF Normal VGA 9750276Speter>>506 leshort 0xFFFE Extended VGA 9850276Speter>>506 leshort 0xFFFD Prompt for Videomode 9950276Speter>>506 leshort >0 Video mode %d 10050276Speter# This also matches new kernels, which were caught above by "HdrS". 10150276Speter0 belong 0xb8c0078e Linux kernel 10250276Speter>0x1e3 string Loading version 1.3.79 or older 10350276Speter>0x1e9 string Loading from prehistoric times 10450276Speter 10550276Speter# System.map files - Nicol�s Lichtmaier <nick@debian.org> 10650276Speter8 string \ A\ _text Linux kernel symbol map text 10750276Speter 10850276Speter# LSM entries - Nicol�s Lichtmaier <nick@debian.org> 10950276Speter0 string Begin3 Linux Software Map entry text 11050276Speter0 string Begin4 Linux Software Map entry text (new format) 11150276Speter 11250276Speter# From Matt Zimmerman 11350276Speter0 belong 0x4f4f4f4d User-mode Linux COW file 11450276Speter>4 belong x \b, version %d 11550276Speter>8 string >\0 \b, backing file %s 11650276Speter 11750276Speter############################################################################ 11850276Speter# Linux kernel versions 11950276Speter 12050276Speter0 string \xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux 12150276Speter>497 leshort 0 x86 boot sector 12250276Speter>>514 belong 0x8e of a kernel from the dawn of time! 12350276Speter>>514 belong 0x908ed8b4 version 0.99-1.1.42 12450276Speter>>514 belong 0x908ed8b8 for memtest86 12550276Speter 12650276Speter>497 leshort !0 x86 kernel 12750276Speter>>504 leshort >0 RAMdisksize=%u KB 12850276Speter>>502 leshort >0 swap=0x%X 12950276Speter>>508 leshort >0 root=0x%X 13050276Speter>>>498 leshort 1 \b-ro 13150276Speter>>>498 leshort 0 \b-rw 13250276Speter>>506 leshort 0xFFFF vga=normal 13350276Speter>>506 leshort 0xFFFE vga=extended 13450276Speter>>506 leshort 0xFFFD vga=ask 13550276Speter>>506 leshort >0 vga=%d 13650276Speter>>514 belong 0x908ed881 version 1.1.43-1.1.45 13750276Speter>>514 belong 0x15b281cd 13850276Speter>>>0xa8e belong 0x55AA5a5a version 1.1.46-1.2.13,1.3.0 13950276Speter>>>0xa99 belong 0x55AA5a5a version 1.3.1,2 14050276Speter>>>0xaa3 belong 0x55AA5a5a version 1.3.3-1.3.30 14150276Speter>>>0xaa6 belong 0x55AA5a5a version 1.3.31-1.3.41 14250276Speter>>>0xb2b belong 0x55AA5a5a version 1.3.42-1.3.45 14350276Speter>>>0xaf7 belong 0x55AA5a5a version 1.3.46-1.3.72 14450276Speter>>514 string HdrS 14550276Speter>>>518 leshort >0x1FF 14650276Speter>>>>529 byte 0 \b, zImage 14750276Speter>>>>529 byte 1 \b, bzImage 14850276Speter>>>>(526.s+0x200) string >\0 \b, version %s 14950276Speter 15050276Speter# Linux boot sector thefts. 15150276Speter0 belong 0xb8c0078e Linux 15250276Speter>0x1e6 belong 0x454c4b53 ELKS Kernel 15350276Speter>0x1e6 belong !0x454c4b53 style boot sector 15450276Speter 15550276Speter############################################################################ 15650276Speter# Linux 8086 executable 15750276Speter0 lelong&0xFF0000FF 0xC30000E9 Linux-Dev86 executable, headerless 15850276Speter>5 string . 15950276Speter>>4 string >\0 \b, libc version %s 16050276Speter 16150276Speter0 lelong&0xFF00FFFF 0x4000301 Linux-8086 executable 16250276Speter>2 byte&0x01 !0 \b, unmapped zero page 16350276Speter>2 byte&0x20 0 \b, impure 16450276Speter>2 byte&0x20 !0 16550276Speter>>2 byte&0x10 !0 \b, A_EXEC 16650276Speter>2 byte&0x02 !0 \b, A_PAL 16750276Speter>2 byte&0x04 !0 \b, A_NSYM 16850276Speter>2 byte&0x08 !0 \b, A_STAND 16950276Speter>2 byte&0x40 !0 \b, A_PURE 17050276Speter>2 byte&0x80 !0 \b, A_TOVLY 17162449Speter>28 long !0 \b, not stripped 17262449Speter>37 string . 17350276Speter>>36 string >\0 \b, libc version %s 17450276Speter 17550276Speter# 0 lelong&0xFF00FFFF 0x10000301 ld86 I80386 executable 17650276Speter# 0 lelong&0xFF00FFFF 0xB000301 ld86 M68K executable 17750276Speter# 0 lelong&0xFF00FFFF 0xC000301 ld86 NS16K executable 17850276Speter# 0 lelong&0xFF00FFFF 0x17000301 ld86 SPARC executable 17950276Speter 18050276Speter# SYSLINUX boot logo files (from 'ppmtolss16' sources) 18150276Speter# http://syslinux.zytor.com/ 18250276Speter# 18350276Speter0 lelong =0x1413f33d SYSLINUX' LSS16 image data 18450276Speter>4 leshort x \b, width %d 18550276Speter>6 leshort x \b, height %d 18650276Speter 18750276Speter0 string OOOM User-Mode-Linux's Copy-On-Write disk image 18850276Speter>4 belong x version %d 18950276Speter 19050276Speter# SE Linux policy database 19150276Speter# From: Mike Frysinger <vapier@gentoo.org> 19250276Speter0 lelong 0xf97cff8c SE Linux policy 19350276Speter>16 lelong x v%d 19450276Speter>20 lelong 1 MLS 19550276Speter>24 lelong x %d symbols 19662449Speter>28 lelong x %d ocons 19762449Speter 19862449Speter# Linux Logical Volume Manager (LVM) 19950276Speter# Emmanuel VARAGNAT <emmanuel.varagnat@guzu.net> 20050276Speter# 20150276Speter# System ID, UUID and volume group name are 128 bytes long 20250276Speter# but they should never be full and initialized with zeros... 20350276Speter# 20450276Speter# LVM1 20550276Speter# 20650276Speter0x0 string HM\001 LVM1 (Linux Logical Volume Manager), version 1 20750276Speter>0x12c string >\0 , System ID: %s 20850276Speter 20950276Speter0x0 string HM\002 LVM1 (Linux Logical Volume Manager), version 2 21050276Speter>0x12c string >\0 , System ID: %s 21150276Speter 21250276Speter# LVM2 21350276Speter# 21450276Speter# It seems that the label header can be in one the four first sector 21550276Speter# of the disk... (from _find_labeller in lib/label/label.c of LVM2) 21650276Speter# 21750276Speter# 0x200 seems to be the common case 21850276Speter 21950276Speter0x218 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 22050276Speter# read the offset to add to the start of the header, and the header 22150276Speter# start in 0x200 22250276Speter>(0x214.l+0x200) string >\0 , UUID: %s 22397049Speter 22450276Speter0x018 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 22550276Speter>(0x014.l) string >\0 , UUID: %s 22650276Speter 22750276Speter0x418 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 22850276Speter>(0x414.l+0x400) string >\0 , UUID: %s 22976726Speter 23050276Speter0x618 string LVM2\ 001 LVM2 (Linux Logical Volume Manager) 23150276Speter>(0x614.l+0x600) string >\0 , UUID: %s 23250276Speter 23350276Speter# SE Linux policy database 23450276Speter0 lelong 0xf97cff8c SE Linux policy 23550276Speter>16 lelong x v%d 23650276Speter>20 lelong 1 MLS 23750276Speter>24 lelong x %d symbols 23850276Speter>28 lelong x %d ocons 23950276Speter