blob: b9854e54c159b57ac33c2cba8e690867b2c96aa6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
#------------------------------------------------------------
# $File: java,v 1.21 2019/02/18 17:58:50 christos Exp $
# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the
# same magic number, 0xcafebabe, so they are both handled
# in the entry called "cafebabe".
#------------------------------------------------------------
# Java serialization
# From Martin Pool (m.pool@pharos.com.au)
0 beshort 0xaced Java serialization data
>2 beshort >0x0004 \b, version %d
0 belong 0xfeedfeed Java KeyStore
!:mime application/x-java-keystore
0 belong 0xcececece Java JCE KeyStore
!:mime application/x-java-jce-keystore
# Java source
0 regex \^import.*;$ Java source
!:mime text/x-java
# Java HPROF dumps
# https://java.net/downloads/heap-snapshot/hprof-binary-format.html
0 string JAVA\x20PROFILE\x201.0.
>0x12 byte 0
>>0x11 ubyte-0x31 <2 Java HPROF dump,
>>>0x17 beqdate/1000 x created %s
# Java jmod module
# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java
# Grr. 2 byte magic "JM", really? In 2019?
0 belong 0x4a4d0100 Java jmod module version 1.0
!:mime application/x-java-jmod
# Java jlinked image
# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp
0 belong 0xcafedada Java module image (big endian)
>4 beshort >0x00 \b, version %d
>6 beshort x \b.%d
!:mime application/x-java-image
0 lelong 0xcafedada Java module image (little endian)
>6 leshort >0x00 \b, version %d
>4 leshort x \b.%d
!:mime application/x-java-image
|
