1284194Sdelphij 2284194Sdelphij#------------------------------------------------------------------------------ 3284194Sdelphij# $File: freebsd,v 1.7 2009/09/19 16:28:09 christos Exp $ 4284194Sdelphij# freebsd: file(1) magic for FreeBSD objects 5284194Sdelphij# 6284194Sdelphij# All new-style FreeBSD magic numbers are in host byte order (i.e., 7284194Sdelphij# little-endian on x86). 8284194Sdelphij# 9284194Sdelphij# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 10284194Sdelphij# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 11284194Sdelphij# schemes for distinguishing between executable images, shared libraries, 12284194Sdelphij# and object files. 13284194Sdelphij# 14284194Sdelphij# FreeBSD says: 15284194Sdelphij# 16284194Sdelphij# Regardless of whether it's pure, demand-paged, or none of the 17284194Sdelphij# above: 18284194Sdelphij# 19284194Sdelphij# if the entry point is < 4096, then it's a shared library if 20284194Sdelphij# the "has run-time loader information" bit is set, and is 21284194Sdelphij# position-independent if the "is position-independent" bit 22284194Sdelphij# is set; 23284194Sdelphij# 24284194Sdelphij# if the entry point is >= 4096 (or >4095, same thing), then it's 25284194Sdelphij# an executable, and is dynamically-linked if the "has run-time 26284194Sdelphij# loader information" bit is set. 27284194Sdelphij# 28284194Sdelphij# On x86, NetBSD says: 29284194Sdelphij# 30284194Sdelphij# If it's neither pure nor demand-paged: 31284194Sdelphij# 32284194Sdelphij# if it has the "has run-time loader information" bit set, it's 33284194Sdelphij# a dynamically-linked executable; 34284194Sdelphij# 35284194Sdelphij# if it doesn't have that bit set, then: 36284194Sdelphij# 37284194Sdelphij# if it has the "is position-independent" bit set, it's 38284194Sdelphij# position-independent; 39284194Sdelphij# 40284194Sdelphij# if the entry point is non-zero, it's an executable, otherwise 41284194Sdelphij# it's an object file. 42284194Sdelphij# 43284194Sdelphij# If it's pure: 44284194Sdelphij# 45284194Sdelphij# if it has the "has run-time loader information" bit set, it's 46284194Sdelphij# a dynamically-linked executable, otherwise it's just an 47284194Sdelphij# executable. 48284194Sdelphij# 49284194Sdelphij# If it's demand-paged: 50284194Sdelphij# 51284194Sdelphij# if it has the "has run-time loader information" bit set, 52284194Sdelphij# then: 53284194Sdelphij# 54284194Sdelphij# if the entry point is < 4096, it's a shared library; 55284194Sdelphij# 56284194Sdelphij# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 57284194Sdelphij# it's a dynamically-linked executable); 58284194Sdelphij# 59284194Sdelphij# if it doesn't have the "has run-time loader information" bit 60284194Sdelphij# set, then it's just an executable. 61284194Sdelphij# 62284194Sdelphij# (On non-x86, NetBSD does much the same thing, except that it uses 63284194Sdelphij# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 64284194Sdelphij# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 65284194Sdelphij# had 8K pages; dunno about MIPS.) 66284194Sdelphij# 67284194Sdelphij# I suspect the two will differ only in perverse and uninteresting cases 68284194Sdelphij# ("shared" libraries that aren't demand-paged and whose pages probably 69284194Sdelphij# won't actually be shared, executables with entry points <4096). 70284194Sdelphij# 71284194Sdelphij# I leave it to those more familiar with FreeBSD and NetBSD to figure out 72284194Sdelphij# what the right answer is (although using ">4095", FreeBSD-style, is 73284194Sdelphij# probably better than separately checking for "=4096" and ">4096", 74284194Sdelphij# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 75284194Sdelphij# executables using the NetBSD technique.) 76284194Sdelphij# 77284194Sdelphij0 lelong&0377777777 041400407 FreeBSD/i386 78284194Sdelphij>20 lelong <4096 79284194Sdelphij>>3 byte&0xC0 &0x80 shared library 80284194Sdelphij>>3 byte&0xC0 0x40 PIC object 81284194Sdelphij>>3 byte&0xC0 0x00 object 82284194Sdelphij>20 lelong >4095 83284194Sdelphij>>3 byte&0x80 0x80 dynamically linked executable 84284194Sdelphij>>3 byte&0x80 0x00 executable 85284194Sdelphij>16 lelong >0 not stripped 86284194Sdelphij 87284194Sdelphij0 lelong&0377777777 041400410 FreeBSD/i386 pure 88284194Sdelphij>20 lelong <4096 89284194Sdelphij>>3 byte&0xC0 &0x80 shared library 90284194Sdelphij>>3 byte&0xC0 0x40 PIC object 91284194Sdelphij>>3 byte&0xC0 0x00 object 92284194Sdelphij>20 lelong >4095 93284194Sdelphij>>3 byte&0x80 0x80 dynamically linked executable 94284194Sdelphij>>3 byte&0x80 0x00 executable 95284194Sdelphij>16 lelong >0 not stripped 96284194Sdelphij 97284194Sdelphij0 lelong&0377777777 041400413 FreeBSD/i386 demand paged 98284194Sdelphij>20 lelong <4096 99284194Sdelphij>>3 byte&0xC0 &0x80 shared library 100284194Sdelphij>>3 byte&0xC0 0x40 PIC object 101284194Sdelphij>>3 byte&0xC0 0x00 object 102284194Sdelphij>20 lelong >4095 103284194Sdelphij>>3 byte&0x80 0x80 dynamically linked executable 104284194Sdelphij>>3 byte&0x80 0x00 executable 105284194Sdelphij>16 lelong >0 not stripped 106284194Sdelphij 107284194Sdelphij0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 108284194Sdelphij>20 lelong <4096 109284194Sdelphij>>3 byte&0xC0 &0x80 shared library 110284194Sdelphij>>3 byte&0xC0 0x40 PIC object 111284194Sdelphij>>3 byte&0xC0 0x00 object 112284194Sdelphij>20 lelong >4095 113284194Sdelphij>>3 byte&0x80 0x80 dynamically linked executable 114284194Sdelphij>>3 byte&0x80 0x00 executable 115284194Sdelphij>16 lelong >0 not stripped 116284194Sdelphij 117284194Sdelphij# XXX gross hack to identify core files 118284194Sdelphij# cores start with a struct tss; we take advantage of the following: 119284194Sdelphij# byte 7: highest byte of the kernel stack pointer, always 0xfe 120284194Sdelphij# 8/9: kernel (ring 0) ss value, always 0x0010 121284194Sdelphij# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 122284194Sdelphij# 28: low order byte of the current PTD entry, always 0 since the 123284194Sdelphij# PTD is page-aligned 124284194Sdelphij# 125284194Sdelphij7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 126284194Sdelphij>1039 string >\0 from '%s' 127284194Sdelphij 128284194Sdelphij# /var/run/ld.so.hints 129284194Sdelphij# What are you laughing about? 130284194Sdelphij0 lelong 011421044151 ld.so hints file (Little Endian 131284194Sdelphij>4 lelong >0 \b, version %d) 132284194Sdelphij>4 belong <1 \b) 133284194Sdelphij0 belong 011421044151 ld.so hints file (Big Endian 134284194Sdelphij>4 belong >0 \b, version %d) 135284194Sdelphij>4 belong <1 \b) 136284194Sdelphij 137284194Sdelphij# 138284194Sdelphij# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 139284194Sdelphij# 140284194Sdelphij0 string SCRSHOT_ scrshot(1) screenshot, 141284194Sdelphij>8 byte x version %d, 142284194Sdelphij>9 byte 2 %d bytes in header, 143284194Sdelphij>>10 byte x %d chars wide by 144284194Sdelphij>>11 byte x %d chars high 145