1 files changed, 303 insertions, 0 deletions
diff --git a/magic/Magdir/mach b/magic/Magdir/mach
new file mode 100644
index 0000000..7eb98ff
--- /dev/null
+++ b/magic/Magdir/mach
@@ -0,0 +1,303 @@
+
+#------------------------------------------------------------
+# $File: mach,v 1.29 2021/04/26 15:56:00 christos Exp $
+# Mach has two magic numbers, 0xcafebabe and 0xfeedface.
+# Unfortunately the first, cafebabe, is shared with
+# Java ByteCode, so they are both handled in the file "cafebabe".
+# The "feedface" ones are handled herein.
+#------------------------------------------------------------
+# if set, it's for the 64-bit version of the architecture
+# yes, this is separate from the low-order magic number bit
+# it's also separate from the "64-bit libraries" bit in the
+# upper 8 bits of the CPU subtype
+
+# Reference:	https://opensource.apple.com/source/cctools/cctools-949.0.1/
+#               include/mach-o/loader.h
+# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
+0	name	mach-o-cpu
+>0	belong&0xff000000	0
+#
+# 32-bit ABIs.
+#
+#				1	vax
+>>0	belong&0x00ffffff	1
+>>>4		belong&0x00ffffff	0	vax
+>>>4		belong&0x00ffffff	1	vax11/780
+>>>4		belong&0x00ffffff	2	vax11/785
+>>>4		belong&0x00ffffff	3	vax11/750
+>>>4		belong&0x00ffffff	4	vax11/730
+>>>4		belong&0x00ffffff	5	uvaxI
+>>>4		belong&0x00ffffff	6	uvaxII
+>>>4		belong&0x00ffffff	7	vax8200
+>>>4		belong&0x00ffffff	8	vax8500
+>>>4		belong&0x00ffffff	9	vax8600
+>>>4		belong&0x00ffffff	10	vax8650
+>>>4		belong&0x00ffffff	11	vax8800
+>>>4		belong&0x00ffffff	12	uvaxIII
+>>>4		belong&0x00ffffff	>12	vax subarchitecture=%d
+>>0	belong&0x00ffffff	2	romp
+>>0	belong&0x00ffffff	3	architecture=3
+>>0	belong&0x00ffffff	4	ns32032
+>>0	belong&0x00ffffff	5	ns32332
+>>0	belong&0x00ffffff	6	m68k
+#				7	x86
+>>0	belong&0x00ffffff	7
+>>>4	belong&0x0000000f	3		i386
+>>>4	belong&0x0000000f	4		i486
+>>>>4	belong&0x00fffff0	0
+>>>>4	belong&0x00fffff0	0x80		\bsx
+>>>4	belong&0x0000000f	5		i586
+>>>4	belong&0x0000000f	6
+>>>>4	belong&0x00fffff0	0		p6
+>>>>4	belong&0x00fffff0	0x10		pentium_pro
+>>>>4	belong&0x00fffff0	0x20		pentium_2_m0x20
+>>>>4	belong&0x00fffff0	0x30		pentium_2_m3
+>>>>4	belong&0x00fffff0	0x40		pentium_2_m0x40
+>>>>4	belong&0x00fffff0	0x50		pentium_2_m5
+>>>>4	belong&0x00fffff0	>0x50		pentium_2_m%#x
+>>>4	belong&0x0000000f	7		celeron
+>>>>4	belong&0x00fffff0	0x00		\b_m%#x
+>>>>4	belong&0x00fffff0	0x10		\b_m%#x
+>>>>4	belong&0x00fffff0	0x20		\b_m%#x
+>>>>4	belong&0x00fffff0	0x30		\b_m%#x
+>>>>4	belong&0x00fffff0	0x40		\b_m%#x
+>>>>4	belong&0x00fffff0	0x50		\b_m%#x
+>>>>4	belong&0x00fffff0	0x60
+>>>>4	belong&0x00fffff0	0x70		\b_mobile
+>>>>4	belong&0x00fffff0	>0x70		\b_m%#x
+>>>4	belong&0x0000000f	8		pentium_3
+>>>>4	belong&0x00fffff0	0x00
+>>>>4	belong&0x00fffff0	0x10		\b_m
+>>>>4	belong&0x00fffff0	0x20		\b_xeon
+>>>>4	belong&0x00fffff0	>0x20		\b_m%#x
+>>>4	belong&0x0000000f	9		pentiumM
+>>>>4	belong&0x00fffff0	0x00
+>>>>4	belong&0x00fffff0	>0x00		\b_m%#x
+>>>4	belong&0x0000000f	10		pentium_4
+>>>>4	belong&0x00fffff0	0x00
+>>>>4	belong&0x00fffff0	0x10		\b_m
+>>>>4	belong&0x00fffff0	>0x10		\b_m%#x
+>>>4	belong&0x0000000f	11		itanium
+>>>>4	belong&0x00fffff0	0x00
+>>>>4	belong&0x00fffff0	0x10		\b_2
+>>>>4	belong&0x00fffff0	>0x10		\b_m%#x
+>>>4	belong&0x0000000f	12		xeon
+>>>>4	belong&0x00fffff0	0x00
+>>>>4	belong&0x00fffff0	0x10		\b_mp
+>>>>4	belong&0x00fffff0	>0x10		\b_m%#x
+>>>4	belong&0x0000000f	>12		ia32 family=%d
+>>>>4	belong&0x00fffff0	0x00
+>>>>4	belong&0x00fffff0	>0x00		model=%x
+>>0	belong&0x00ffffff	8	mips
+>>>4		belong&0x00ffffff	1	R2300
+>>>4		belong&0x00ffffff	2	R2600
+>>>4		belong&0x00ffffff	3	R2800
+>>>4		belong&0x00ffffff	4	R2000a
+>>>4		belong&0x00ffffff	5	R2000
+>>>4		belong&0x00ffffff	6	R3000a
+>>>4		belong&0x00ffffff	7	R3000
+>>>4		belong&0x00ffffff	>7	subarchitecture=%d
+>>0	belong&0x00ffffff	9	ns32532
+>>0	belong&0x00ffffff	10	mc98000
+>>0	belong&0x00ffffff	11	hppa
+>>>4		belong&0x00ffffff	0	7100
+>>>4		belong&0x00ffffff	1	7100LC
+>>>4		belong&0x00ffffff	>1	subarchitecture=%d
+>>0	belong&0x00ffffff	12	arm
+>>>4		belong&0x00ffffff	0
+>>>4		belong&0x00ffffff	1	subarchitecture=%d
+>>>4		belong&0x00ffffff	2	subarchitecture=%d
+>>>4		belong&0x00ffffff	3	subarchitecture=%d
+>>>4		belong&0x00ffffff	4	subarchitecture=%d
+>>>4		belong&0x00ffffff	5	\bv4t
+>>>4		belong&0x00ffffff	6	\bv6
+>>>4		belong&0x00ffffff	7	\bv5tej
+>>>4		belong&0x00ffffff	8	\bxscale
+>>>4		belong&0x00ffffff	9	\bv7
+>>>4		belong&0x00ffffff	10	\bv7f
+>>>4		belong&0x00ffffff	11	\bv7s
+>>>4		belong&0x00ffffff	12	\bv7k
+>>>4		belong&0x00ffffff	13	\bv8
+>>>4		belong&0x00ffffff	14	\bv6m
+>>>4		belong&0x00ffffff	15	\bv7m
+>>>4		belong&0x00ffffff	16	\bv7em
+>>>4		belong&0x00ffffff	>16	subarchitecture=%d
+#				13	m88k
+>>0	belong&0x00ffffff	13
+>>>4		belong&0x00ffffff	0	mc88000
+>>>4		belong&0x00ffffff	1	mc88100
+>>>4		belong&0x00ffffff	2	mc88110
+>>>4		belong&0x00ffffff	>2	mc88000 subarchitecture=%d
+>>0	belong&0x00ffffff	14	SPARC
+>>0	belong&0x00ffffff	15	i860g
+>>0	belong&0x00ffffff	16	alpha
+>>0	belong&0x00ffffff	17	rs6000
+>>0	belong&0x00ffffff	18	ppc
+>>>4		belong&0x00ffffff	0
+>>>4		belong&0x00ffffff	1	\b_601
+>>>4		belong&0x00ffffff	2	\b_602
+>>>4		belong&0x00ffffff	3	\b_603
+>>>4		belong&0x00ffffff	4	\b_603e
+>>>4		belong&0x00ffffff	5	\b_603ev
+>>>4		belong&0x00ffffff	6	\b_604
+>>>4		belong&0x00ffffff	7	\b_604e
+>>>4		belong&0x00ffffff	8	\b_620
+>>>4		belong&0x00ffffff	9	\b_750
+>>>4		belong&0x00ffffff	10	\b_7400
+>>>4		belong&0x00ffffff	11	\b_7450
+>>>4		belong&0x00ffffff	100	\b_970
+>>>4		belong&0x00ffffff	>100	subarchitecture=%d
+>>0	belong&0x00ffffff	>18	architecture=%d
+>0	belong&0xff000000	0x01000000
+#
+# 64-bit ABIs.
+#
+>>0	belong&0x00ffffff	0	64-bit architecture=%d
+>>0	belong&0x00ffffff	1	64-bit architecture=%d
+>>0	belong&0x00ffffff	2	64-bit architecture=%d
+>>0	belong&0x00ffffff	3	64-bit architecture=%d
+>>0	belong&0x00ffffff	4	64-bit architecture=%d
+>>0	belong&0x00ffffff	5	64-bit architecture=%d
+>>0	belong&0x00ffffff	6	64-bit architecture=%d
+>>0	belong&0x00ffffff	7	x86_64
+>>>4		belong&0x00ffffff	0	subarchitecture=%d
+>>>4		belong&0x00ffffff	1	subarchitecture=%d
+>>>4		belong&0x00ffffff	2	subarchitecture=%d
+>>>4		belong&0x00ffffff	3
+>>>4		belong&0x00ffffff	4	\b_arch1
+>>>4		belong&0x00ffffff	8	\b_haswell
+>>>4		belong&0x00ffffff	>4	subarchitecture=%d
+>>0	belong&0x00ffffff	8	64-bit architecture=%d
+>>0	belong&0x00ffffff	9	64-bit architecture=%d
+>>0	belong&0x00ffffff	10	64-bit architecture=%d
+>>0	belong&0x00ffffff	11	64-bit architecture=%d
+>>0	belong&0x00ffffff	12	arm64
+>>>4		belong&0x00ffffff	0
+>>>4		belong&0x00ffffff	1	\bv8
+>>>4		belong&0x00ffffff	2	\be
+>>>>7		ubyte&0xff		>0	(caps:
+>>>>7		ubyte&0xff		<0x80	%#02x
+>>>>7		ubyte&0xc0		0x80	PAC
+>>>>>7		ubyte&0x3f		x	\b%02d
+>>>>7		ubyte&0xc0		0xc0	PAK
+>>>>>7		ubyte&0x3f		x	\b%02d
+>>>>7		ubyte&0xff		x	\b)
+>>>4		belong&0x00ffffff	>2	subarchitecture=%d
+>>0	belong&0x00ffffff	13	64-bit architecture=%d
+>>0	belong&0x00ffffff	14	64-bit architecture=%d
+>>0	belong&0x00ffffff	15	64-bit architecture=%d
+>>0	belong&0x00ffffff	16	64-bit architecture=%d
+>>0	belong&0x00ffffff	17	64-bit architecture=%d
+>>0	belong&0x00ffffff	18	ppc64
+>>>4		belong&0x00ffffff	0
+>>>4		belong&0x00ffffff	1		\b_601
+>>>4		belong&0x00ffffff	2		\b_602
+>>>4		belong&0x00ffffff	3		\b_603
+>>>4		belong&0x00ffffff	4		\b_603e
+>>>4		belong&0x00ffffff	5		\b_603ev
+>>>4		belong&0x00ffffff	6		\b_604
+>>>4		belong&0x00ffffff	7		\b_604e
+>>>4		belong&0x00ffffff	8		\b_620
+>>>4		belong&0x00ffffff	9		\b_650
+>>>4		belong&0x00ffffff	10		\b_7400
+>>>4		belong&0x00ffffff	11		\b_7450
+>>>4		belong&0x00ffffff	100		\b_970
+>>>4		belong&0x00ffffff	>100		subarchitecture=%d
+>>0	belong&0x00ffffff	>18	64-bit architecture=%d
+>0	belong&0xff000000	0x02000000
+#
+# 64_32-bit ABIs.
+#
+>>0	belong&0x00ffffff	0	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	1	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	2	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	3	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	4	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	5	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	6	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	7	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	8	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	9	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	10	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	11	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	12	64_32-bit arm
+>>>4		belong&0x00ffffff	0
+>>>4		belong&0x00ffffff	1	\bv8
+>>>4		belong&0x00ffffff	>1	subarchitecture=%d
+>>0	belong&0x00ffffff	13	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	14	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	15	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	16	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	17	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	18	64_32-bit architecture=%d
+>>0	belong&0x00ffffff	>18	64_32-bit architecture=%d
+
+0	name		mach-o-be
+>0	byte		0xcf		64-bit
+>4	use		mach-o-cpu
+>12	belong		1		object
+# GRR: Does not work for Mach-O with 2 architectures; instead display oo
+#!:ext	o
+!:ext	o/
+>12	belong		2		executable
+# the executables normally have no file extension like perl,
+# but exceptions like perl5.18 perl5.16
+!:ext	16/18/
+>12	belong		3		fixed virtual memory shared library
+>12	belong		4		core
+>12	belong		5		preload executable
+>12	belong		6		dynamically linked shared library
+# GRR: Does not work for Mach-O with 2 architectures; instead display dylibdylib
+#!:ext	dylib
+!:ext	dylib/
+>12	belong		7		dynamic linker
+>12	belong		8		bundle
+# normally name extension bundle; but exceptions like: AMDil_r700.dylib 
+!:ext	bundle/dylib/
+>12	belong		9		dynamically linked shared library stub
+>12	belong		10		dSYM companion file
+>12	belong		11		kext bundle
+>12	belong		>11
+>>12	belong		x		filetype=%d
+>24	belong		>0		\b, flags:<
+>>24	belong		&0x00000001	\bNOUNDEFS
+>>24	belong		&0x00000002	\b|INCRLINK
+>>24	belong		&0x00000004	\b|DYLDLINK
+>>24	belong		&0x00000008	\b|BINDATLOAD
+>>24	belong		&0x00000010	\b|PREBOUND
+>>24	belong		&0x00000020	\b|SPLIT_SEGS
+>>24	belong		&0x00000040	\b|LAZY_INIT
+>>24	belong		&0x00000080	\b|TWOLEVEL
+>>24	belong		&0x00000100	\b|FORCE_FLAT
+>>24	belong		&0x00000200	\b|NOMULTIDEFS
+>>24	belong		&0x00000400	\b|NOFIXPREBINDING
+>>24	belong		&0x00000800	\b|PREBINDABLE
+>>24	belong		&0x00001000	\b|ALLMODSBOUND
+>>24	belong		&0x00002000	\b|SUBSECTIONS_VIA_SYMBOLS
+>>24	belong		&0x00004000	\b|CANONICAL
+>>24	belong		&0x00008000	\b|WEAK_DEFINES
+>>24	belong		&0x00010000	\b|BINDS_TO_WEAK
+>>24	belong		&0x00020000	\b|ALLOW_STACK_EXECUTION
+>>24	belong		&0x00040000	\b|ROOT_SAFE
+>>24	belong		&0x00080000	\b|SETUID_SAFE
+>>24	belong		&0x00100000	\b|NO_REEXPORTED_DYLIBS
+>>24	belong		&0x00200000	\b|PIE
+>>24	belong		&0x00400000	\b|DEAD_STRIPPABLE_DYLIB
+>>24	belong		&0x00800000	\b|HAS_TLV_DESCRIPTORS
+>>24	belong		&0x01000000	\b|NO_HEAP_EXECUTION
+>>24	belong		&0x02000000	\b|APP_EXTENSION_SAFE
+>>24	belong		&0x04000000	\b|NLIST_OUTOFSYNC_WITH_DYLDINFO
+>>24	belong		&0x08000000	\b|SIM_SUPPORT
+>>24	belong		&0x80000000	\b|DYLIB_IN_CACHE
+>>24	belong		x		\b>
+
+#
+0	lelong&0xfffffffe	0xfeedface	Mach-O
+!:strength +1
+!:mime application/x-mach-binary
+>0	use	\^mach-o-be
+
+0	belong&0xfffffffe	0xfeedface	Mach-O
+!:strength +1
+!:mime application/x-mach-binary
+>0	use	mach-o-be