1226048Sobrien 268349Sobrien#------------------------------------------------------------ 3354939Sdelphij# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $ 4169942Sobrien# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 5169942Sobrien# same magic number, 0xcafebabe, so they are both handled 6169942Sobrien# in the entry called "cafebabe". 768349Sobrien#------------------------------------------------------------ 868349Sobrien# Java serialization 968349Sobrien# From Martin Pool (m.pool@pharos.com.au) 1068349Sobrien0 beshort 0xaced Java serialization data 1168349Sobrien>2 beshort >0x0004 \b, version %d 12175296Sobrien 13175296Sobrien0 belong 0xfeedfeed Java KeyStore 14186690Sobrien!:mime application/x-java-keystore 15175296Sobrien0 belong 0xcececece Java JCE KeyStore 16186690Sobrien!:mime application/x-java-jce-keystore 17175296Sobrien 18234250Sobrien# Java source 19298192Sdelphij0 regex \^import.*;$ Java source 20234250Sobrien!:mime text/x-java 21298192Sdelphij 22298192Sdelphij# Java HPROF dumps 23298192Sdelphij# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 24298192Sdelphij0 string JAVA\x20PROFILE\x201.0. 25354939Sdelphij>0x12 byte 0 26354939Sdelphij>>0x11 ubyte-0x31 <2 Java HPROF dump, 27354939Sdelphij>>>0x17 beqdate/1000 x created %s 28354939Sdelphij 29354939Sdelphij# Java jmod module 30354939Sdelphij# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java 31354939Sdelphij# Grr. 2 byte magic "JM", really? In 2019? 32354939Sdelphij0 belong 0x4a4d0100 Java jmod module version 1.0 33354939Sdelphij!:mime application/x-java-jmod 34354939Sdelphij 35354939Sdelphij# Java jlinked image 36354939Sdelphij# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp 37354939Sdelphij0 belong 0xcafedada Java module image (big endian) 38354939Sdelphij>4 beshort >0x00 \b, version %d 39354939Sdelphij>6 beshort x \b.%d 40354939Sdelphij!:mime application/x-java-image 41354939Sdelphij 42354939Sdelphij0 lelong 0xcafedada Java module image (little endian) 43354939Sdelphij>6 leshort >0x00 \b, version %d 44354939Sdelphij>4 leshort x \b.%d 45354939Sdelphij!:mime application/x-java-image 46