diff options
Diffstat (limited to 'magic/Magdir/sql')
| -rw-r--r-- | magic/Magdir/sql | 225 |
1 files changed, 225 insertions, 0 deletions
diff --git a/magic/Magdir/sql b/magic/Magdir/sql new file mode 100644 index 0000000..caa670d --- /dev/null +++ b/magic/Magdir/sql @@ -0,0 +1,225 @@ + +#------------------------------------------------------------------------------ +# $File: sql,v 1.24 2022/07/17 15:32:48 christos Exp $ +# sql: file(1) magic for SQL files +# +# From: "Marty Leisner" <mleisner@eng.mc.xerox.com> +# Recognize some MySQL files. +# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures +# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic +# +0 beshort 0xfe01 MySQL table definition file +>2 byte x Version %d +>3 byte 0 \b, type UNKNOWN +>3 byte 1 \b, type DIAM_ISAM +>3 byte 2 \b, type HASH +>3 byte 3 \b, type MISAM +>3 byte 4 \b, type PISAM +>3 byte 5 \b, type RMS_ISAM +>3 byte 6 \b, type HEAP +>3 byte 7 \b, type ISAM +>3 byte 8 \b, type MRG_ISAM +>3 byte 9 \b, type MYISAM +>3 byte 10 \b, type MRG_MYISAM +>3 byte 11 \b, type BERKELEY_DB +>3 byte 12 \b, type INNODB +>3 byte 13 \b, type GEMINI +>3 byte 14 \b, type NDBCLUSTER +>3 byte 15 \b, type EXAMPLE_DB +>3 byte 16 \b, type CSV_DB +>3 byte 17 \b, type FEDERATED_DB +>3 byte 18 \b, type BLACKHOLE_DB +>3 byte 19 \b, type PARTITION_DB +>3 byte 20 \b, type BINLOG +>3 byte 21 \b, type SOLID +>3 byte 22 \b, type PBXT +>3 byte 23 \b, type TABLE_FUNCTION +>3 byte 24 \b, type MEMCACHE +>3 byte 25 \b, type FALCON +>3 byte 26 \b, type MARIA +>3 byte 27 \b, type PERFORMANCE_SCHEMA +>3 byte 127 \b, type DEFAULT +>0x0033 ulong x \b, MySQL version %d +0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file +>3 byte x Version %d +0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file +>3 byte x Version %d +0 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file +>3 byte x Version %d +>14 beshort x \b, %d key parts +>16 beshort x \b, %d unique key parts +>18 byte x \b, %d keys +>28 bequad x \b, %lld records +>36 bequad x \b, %lld deleted records +0 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file +>3 byte x Version %d +0 belong&0xffffff00 0xfefe0900 MySQL Maria index file +>3 byte x Version %d +0 belong&0xffffff00 0xfefe0a00 MySQL Maria compressed data file +>3 byte x Version %d +0 belong&0xffffff00 0xfefe0c00 +>4 string MACF MySQL Maria control file +>>3 byte x Version %d +0 string \376bin MySQL replication log, +>9 long x server id %d +>8 byte 1 +>>13 long 69 \b, MySQL V3.2.3 +>>>19 string x \b, server version %s +>>13 long 75 \b, MySQL V4.0.2-V4.1 +>>>25 string x \b, server version %s +>8 byte 15 MySQL V5+, +>>25 string x server version %s +>4 string MARIALOG MySQL Maria transaction log file +>>3 byte x Version %d + +#------------------------------------------------------------------------------ +# iRiver H Series database file +# From Ken Guest <ken@linux.ie> +# As observed from iRivNavi.iDB and unencoded firmware +# +0 string iRivDB iRiver Database file +>11 string >\0 Version %s +>39 string iHP-100 [H Series] + +#------------------------------------------------------------------------------ +# SQLite database files +# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg +# +# Version 1 used GDBM internally; its files cannot be distinguished +# from other GDBM files. +# +# Version 2 used this format: +0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database + +# URL: https://en.wikipedia.org/wiki/SQLite +# Reference: https://www.sqlite.org/fileformat.html +# Update: Joerg Jenderek +# Version 3 of SQLite allows applications to embed their own "user version" +# number in the database at offset 60. Later, SQLite added an "application id" +# at offset 68 that is preferred over "user version" for indicating the +# associated application. +# +0 string SQLite\ format\ 3 +# skip DROID fmt-729-signature-id-1053.sqlite by checking for valid page size +>16 ubeshort >0 SQLite 3.x +# deprecated +#!:mime application/x-sqlite3 +!:mime application/vnd.sqlite3 +# seldom found extension sqlite3 like in SyncData.sqlite3 +# db +# db3 like: AddrBook.db3 cgipcrvp.db3 +# https://www.maplesoft.com/support/help/Maple/view.aspx?path=worksheet%2freference%2fhelpdatabase +# help is used for newer Maple help database +# SQLite database weewx.sdb used by weather software weewx +# https://www.weewx.com/docs/usersguide.htm +# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe +# Unfortunately extension sqlite also used for other databases starting with string +# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite +# and with string "ZV-zlib" in like extra.sqlite +>>68 belong !0x5CDE09EF database +!:ext sqlite/sqlite3/db/db3/dbe/sdb/help +>>68 belong =0x5CDE09EF database +# maple is used for Maple Workbook +!:ext maple +>>60 belong =0x5f4d544e (Monotone source repository) +# if no known user version then check for Application IDs with default clause +>>60 belong !0x5f4d544e +# The "Application ID" set by PRAGMA application_id +>>>68 belong =0x0f055112 (Fossil checkout) +>>>68 belong =0x0f055113 (Fossil global configuration) +>>>68 belong =0x0f055111 (Fossil repository) +>>>68 belong =0x42654462 (Bentley Systems BeSQLite Database) +>>>68 belong =0x42654c6e (Bentley Systems Localization File) +>>>68 belong =0x47504b47 (OGC GeoPackage file) +# https://www.sqlite.org/src/artifact?ci=trunk&filename=magic.txt +>>>68 belong =0x47503130 (OGC GeoPackage version 1.0 file) +>>>68 belong =0x45737269 (Esri Spatially-Enabled Database) +>>>68 belong =0x4d504258 (MBTiles tileset) +# https://www.maplesoft.com/support/help/errors/view.aspx?path=Formats/Maple +>>>68 belong =0x5CDE09EF (Maple Workbook) +# unknown application ID +>>>68 default x +>>>>68 belong !0 \b, application id %u +# The "user version" as read and set by the user_version pragma like: +# 1 2 4 5 7 9 10 25 36 43 53 400 416 131073 131074 131075 +>>60 belong !0 \b, user version %d +# SQLITE_VERSION_NUMBER like: 0 3008011 3016002 3007014 3017000 3022000 3028000 3031001 +>>96 belong x \b, last written using SQLite version %d +# database page size in bytes; a power of two between 512 and 32768, or 1 for 65536 +# like: 512 1024 often 4096 32768 +>>16 ubeshort !4096 \b, page size %u +# File format write version. 1 for legacy; 2 for WAL; 0 for corruptDB.sqlite +>>18 ubyte !1 \b, writer version %u +# File format read version. 1 for legacy; 2 for WAL; 4 for corruptDB.sqlite +>>19 ubyte !1 \b, read version %u +# Bytes of unused "reserved" space at the end of each page. Usually 0 +>>20 ubyte !0 \b, unused bytes %u +# maximum embedded payload fraction. Must be 64; 1 for corruptDB.sqlite +>>21 ubyte !64 \b, maximum payload %u +# Minimum embedded payload fraction. Must be 32; 1 for corruptDB.sqlite +>>22 ubyte !32 \b, minimum payload %u +# Leaf payload fraction. Must be 32; 0 for corruptDB.sqlite +>>23 ubyte !32 \b, leaf payload %u +# file change counter +>>24 ubelong x \b, file counter %u +# Size of the database file in pages +>>28 ubelong x \b, database pages %u +# page number of the first freelist trunk page like: 0 2 3 4 5 9 +# 10 13 14 15 16 17 18 19 23 36 39 46 50 136 190 217 307 505 516 561 883 1659 +>>32 ubelong !0 \b, 1st free page %u +# total number of freelist pages +>>36 ubelong !0 \b, free pages %u +# The schema cookie like: 2 3 4 6 7 9 A D E F 13 14 1C 25 2A 2F 33 44 4B 53 5A 5F 62 86 87 8F 91 A8 +>>40 ubelong x \b, cookie %#x +# the schema format number. Supported formats are 1 2 3 and often 4 +# 3328 for corruptDB.sqlite and 0 for 512 byte storage.sqlite (TorBrowser Firefox Thunderbird) +>>44 ubelong x \b, schema %u +# Suggested cache size like: 0 2000 +>>48 ubelong !0 \b, cache page size %u +# The page number of the largest root b-tree page when in auto-vacuum or incremental-vacuum modes, or zero otherwise. +>>52 ubelong !0 \b, largest root page %u +# The database text encoding; a value of 1 means UTF-8; 2 means UTF-16le; 3 means UTF-16be +#>>56 ubelong x \b, encoding %u +>>56 ubelong x +>>>56 ubelong =1 \b, UTF-8 +>>>56 ubelong =2 \b, UTF-16 little endian +>>>56 ubelong =3 \b, UTF-16 big endian +# 0 for corruptDB.sqlite and for storage.sqlite with database pages 1 (TorBrowser Firefox Thunderbird) +# https://mozilla.github.io/firefox-browser-architecture/text/0010-firefox-data-stores.html +>>>56 default x +>>>>56 ubelong x \b, unknown %#x encoding +# True (non-zero) for incremental-vacuum mode; false (zero) otherwiseqy +>>64 ubelong !0 \b, vacuum mode %u +# Reserved for expansion. Must be zero +>>72 uquad !0 \b, reserved %#llx +# The version-valid-for number like: +# 1 2 3 4 C F 68h 95h 266h A99h 3DCDh B7CEh +>>92 ubelong x \b, version-valid-for %u + +# SQLite Write-Ahead Log from SQLite version >= 3.7.0 +# https://www.sqlite.org/fileformat.html#walformat +0 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log, +!:ext sqlite-wal/db-wal +>4 belong x version %d + +# SQLite Rollback Journal +# https://www.sqlite.org/fileformat.html#rollbackjournal +0 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal + +# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek +# https://github.com/PredatH0r/ChanSort +0 string PSDB\0 Panasonic channel list DataBase +!:ext db/bin +#!:mime application/x-db-svl-panasonic +>126 string SQLite\ format\ 3 +#!:mime application/x-panasonic-sqlite3 +>>&-15 indirect x \b; contains + +# H2 Database from https://www.h2database.com/ +0 string --\ H2\ 0.5/B\ --\ \n H2 Database file + +# DuckDB database file from https://duckdb.org +8 string DUCK DuckDB database file +>12 lequad x \b, version %lld +#>20 lequad x \b, flags %#llx +#>28 lequad x \b, flags %#llx |