summaryrefslogtreecommitdiffstats
path: root/magic/Magdir/cafebabe
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--magic/Magdir/cafebabe107
1 files changed, 107 insertions, 0 deletions
diff --git a/magic/Magdir/cafebabe b/magic/Magdir/cafebabe
new file mode 100644
index 0000000..4f97cc0
--- /dev/null
+++ b/magic/Magdir/cafebabe
@@ -0,0 +1,107 @@
+
+#------------------------------------------------------------------------------
+# $File: cafebabe,v 1.28 2022/07/01 23:24:47 christos Exp $
+# Cafe Babes unite!
+#
+# Since Java bytecode and Mach-O universal binaries have the same magic number,
+# the test must be performed in the same "magic" sequence to get both right.
+# The long at offset 4 in a Mach-O universal binary tells the number of
+# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
+# version and the short at offset 6 is the JVM major version. Since there are only
+# only 18 labeled Mach-O architectures at current, and the first released
+# Java class format was version 43.0, we can safely choose any number
+# between 18 and 39 to test the number of architectures against
+# (and use as a hack). Let's not use 18, because the Mach-O people
+# might add another one or two as time goes by...
+#
+### JAVA START ###
+# Reference: http://en.wikipedia.org/wiki/Java_class_file
+# Update: Joerg Jenderek
+0 belong 0xcafebabe
+>4 ubelong >30 compiled Java class data,
+!:mime application/x-java-applet
+#!:mime application/java-byte-code
+!:ext class
+>>6 ubeshort x version %d.
+>>4 ubeshort x \b%d
+# for debugging purpose version as hexadecimal to compare with Mach-O universal binary
+#>>4 ubelong x (%#8.8x)
+# Which is which?
+# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html
+#>>4 belong 0x002b (Java 0.?)
+#>>4 belong 0x032d (Java 1.0)
+#>>4 belong 0x032d (Java 1.1)
+>>4 belong 0x002e (Java 1.2)
+>>4 belong 0x002f (Java 1.3)
+>>4 belong 0x0030 (Java 1.4)
+>>4 belong 0x0031 (Java 1.5)
+>>4 belong 0x0032 (Java 1.6)
+>>4 belong 0x0033 (Java 1.7)
+>>4 belong 0x0034 (Java 1.8)
+>>4 belong 0x0035 (Java SE 9)
+>>4 belong 0x0036 (Java SE 10)
+>>4 belong 0x0037 (Java SE 11)
+>>4 belong 0x0038 (Java SE 12)
+>>4 belong 0x0039 (Java SE 13)
+>>4 belong 0x003A (Java SE 14)
+>>4 belong 0x003B (Java SE 15)
+>>4 belong 0x003C (Java SE 16)
+>>4 belong 0x003D (Java SE 17)
+>>4 belong 0x003E (Java SE 18)
+>>4 belong 0x003F (Java SE 19)
+>>4 belong 0x0040 (Java SE 20)
+# pool count unequal zero
+#>>8 beshort x \b, pool count %#x
+# pool table
+#>>10 ubequad x \b, pool %#16.16llx...
+
+0 belong 0xcafed00d JAR compressed with pack200,
+>5 byte x version %d.
+>4 byte x \b%d
+!:mime application/x-java-pack200
+
+
+0 belong 0xcafed00d JAR compressed with pack200,
+>5 byte x version %d.
+>4 byte x \b%d
+!:mime application/x-java-pack200
+
+### JAVA END ###
+### MACH-O START ###
+# URL: https://en.wikipedia.org/wiki/Mach-O
+
+0 name mach-o \b [
+# for debugging purpose CPU type as hexadecimal
+#>0 ubequad x CPU=%16.16llx
+# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
+>0 use mach-o-cpu \b
+# for debugging purpose print offset to 1st mach_header like:
+# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
+#>8 ubelong x at %#x offset
+>(8.L) indirect x \b:
+>0 belong x \b]
+
+# Reference: https://opensource.apple.com/source/cctools/cctools-949.0.1/
+# include/mach-o/fat.h
+# include/mach/machine.h
+0 belong 0xcafebabe
+>4 belong 1 Mach-O universal binary with 1 architecture:
+!:mime application/x-mach-binary
+>>8 use mach-o \b
+# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
+>4 ubelong >1
+>>4 ubelong <20 Mach-O universal binary with %d architectures:
+!:mime application/x-mach-binary
+>>>8 use mach-o \b
+>>>4 ubelong >1
+>>>>28 use mach-o \b
+>>>4 ubelong >2
+>>>>48 use mach-o \b
+>>>4 ubelong >3
+>>>>68 use mach-o \b
+>>>4 ubelong >4
+>>>>88 use mach-o \b
+>>>4 ubelong >5
+>>>>108 use mach-o \b
+
+### MACH-O END ###