summaryrefslogtreecommitdiffstats
path: root/magic/Magdir/gnu
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--magic/Magdir/gnu173
-rw-r--r--magic/Magdir/gnumeric8
2 files changed, 181 insertions, 0 deletions
diff --git a/magic/Magdir/gnu b/magic/Magdir/gnu
new file mode 100644
index 0000000..761d657
--- /dev/null
+++ b/magic/Magdir/gnu
@@ -0,0 +1,173 @@
+
+#------------------------------------------------------------------------------
+# $File: gnu,v 1.24 2021/04/26 15:56:00 christos Exp $
+# gnu: file(1) magic for various GNU tools
+#
+# GNU nlsutils message catalog file format
+#
+# GNU message catalog (.mo and .gmo files)
+
+# Update: Joerg Jenderek
+# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html
+# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/
+# gettext-0.19.8.1/gettext-runtime/intl/gmo.h
+# Note: maybe call it like "GNU translation gettext machine object"
+0 string \336\22\4\225 GNU message catalog (little endian),
+#0 ulelong 0x950412DE GNU-format message catalog data
+# TODO: write lines in such a way that code can also be called for big endian variant
+#>0 use gettext-object
+#0 name gettext-object
+>4 ulelong x revision
+!:mime application/x-gettext-translation
+# mo extension is also used for Easeus Partition Master PE32 executable module
+# like ConvertFatToNTFS.mo
+!:ext gmo/mo
+# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit
+# major revision
+>4 ulelong/0xFFff x %u.
+# minor revision
+>4 ulelong&0x0000FFff x \b%u
+>>8 ulelong x \b, %u message
+# plural s
+>>8 ulelong >1 \bs
+# size of hashing table
+#>20 ulelong x \b, %u hash
+#>20 ulelong >1 \bes
+#>24 ulelong x at %#x
+# for revision x.0 offset of table with originals is 1Ch if directly after header
+>4 ulelong&0x0000FFff =0
+>>12 ulelong !0x1C \b, at %#x string table
+# but for x.1 table offset i found is 30h. That means directly after bigger header
+>4 ulelong&0x0000FFff >0
+>>12 ulelong !0x30 \b, at %#x string table
+# The following variables are only used in .mo files with minor revision >= 1
+# number of system dependent segments
+#>>28 ulelong x \b, %u segment
+#>>28 ulelong >1 \bs
+# offset of table describing system dependent segments
+#>>32 ulelong x at %#x
+# number of system dependent strings pairs
+>>36 ulelong x \b, %u sysdep message
+>>36 ulelong >1 \bs
+# offset of table with start offsets of original sysdep strings
+#>>40 ulelong x \b, at %#x sysdep strings
+# offset of table with start offsets of translated sysdep strings
+#>>44 ulelong x \b, at %#x sysdep translations
+# >>(44.l) ulelong x %#x chars
+# >>>&0 ulelong x at %#x
+# >>>>(&-4) string x "%s"
+# string table after big header
+#>>48 ubequad x \b, string table %#llx
+#
+# 0th string length seems to be always 0
+#>(12.l) ulelong x \b, %u chars
+#>>&0 ulelong x at %#x
+# if 1st string length positive inspect offset and string
+#>(12.l+8) ulelong >0 \b, %u chars
+#>>&0 ulelong x at %#x
+# if 2nd string length positive inspect offset and string
+# >(12.l+16) ulelong >0 \b, %u chars
+# >>&0 ulelong x at %#x
+# skip newline byte
+#>>>(&-4) ubyte =0x0A
+#>>>>&0 string x "%s"
+#>>>(&-4) ubyte !0x0A
+#>>>>&-1 string x '%s'
+# offset of table with translation strings
+#>16 ulelong x \b, at %#x translation table
+# check translation 0 length and offset
+>(16.l) ulelong >0
+>>&0 ulelong x
+# translation 0 seems to be often Project-Id with name and version
+>>>(&-4) string x \b, %s
+# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL
+>(16.l+8) ulelong >1
+>>&0 ulelong x
+>>>(&-4) ubyte !0x0A
+>>>>&-1 string x '%s'
+# 1 New Line like in tar-1.29\po\de.gmo
+>>>(&-4) ubyte =0x0A
+>>>>&0 ubyte !0x0A
+>>>>>&-1 string x '%s'
+# 2nd New Line like in parted-3.1\po\de.gmo
+>>>>&0 ubyte =0x0A
+>>>>>&0 string x '%s'
+
+0 string \225\4\22\336 GNU message catalog (big endian),
+#0 ubelong 0x950412DE GNU-format message catalog data
+!:mime application/x-gettext-translation
+!:ext gmo/mo
+# TODO: for big endian use same code as for little endian
+#>0 use \^gettext-object
+# DEBUG code
+#>16 ubelong x \b, at %#x translation table
+#>(16.L) ubelong x %#x chars
+#>>&0 ubelong x at %#x
+# unexpected value HERE!
+#>>>(&-4) ubequad x %#llx
+#
+>4 beshort x revision %d.
+>6 beshort >0 \b%d,
+>>8 belong x %d messages,
+>>36 belong x %d sysdep messages
+>6 beshort =0 \b%d,
+>>8 belong x %d messages
+
+
+# GnuPG
+# The format is very similar to pgp
+0 string \001gpg GPG key trust database
+>4 byte x version %d
+# Note: magic.mime had 0x8501 for the next line instead of 0x8502
+0 beshort 0x8502 GPG encrypted data
+!:mime text/PGP # encoding: data
+
+# Update: Joerg Jenderek
+# Note: PGP and GPG use same data structure.
+# So recognition is now done by ./pgp with start test for byte 0x99
+# This magic is not particularly good, as the keyrings don't have true
+# magic. Nevertheless, it covers many keyrings.
+# 0 ubeshort-0x9901 <2
+# >3 byte 4
+# >>4 bedate x GPG key public ring, created %s
+# !:mime application/x-gnupg-keyring
+
+# Symmetric encryption
+0 leshort 0x0d8c
+>4 leshort 0x0203
+>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher)
+>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher)
+>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher)
+>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher)
+>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher)
+>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher)
+>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher)
+>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher)
+>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher)
+>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher)
+
+
+# GnuPG Keybox file
+# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
+# From: Philipp Hahn <hahn@univention.de>
+0 belong 32
+>4 byte 1
+>>8 string KBXf GPG keybox database
+>>>5 byte 1 version %d
+>>>16 bedate x \b, created-at %s
+>>>20 bedate x \b, last-maintained %s
+
+
+# From: James Youngman <jay@gnu.org>
+# gnu find magic
+0 string \0LOCATE GNU findutils locate database data
+>7 string >\0 \b, format %s
+>7 string 02 \b (frcode)
+
+# Files produced by GNU gettext
+
+# gettext message catalogue
+0 search/1024 \nmsgid
+>&0 search/1024 \nmsgstr GNU gettext message catalogue text
+!:strength +100
+!:mime text/x-po
diff --git a/magic/Magdir/gnumeric b/magic/Magdir/gnumeric
new file mode 100644
index 0000000..928ad3e
--- /dev/null
+++ b/magic/Magdir/gnumeric
@@ -0,0 +1,8 @@
+
+#------------------------------------------------------------------------------
+# $File: gnumeric,v 1.4 2009/09/19 16:28:09 christos Exp $
+# gnumeric: file(1) magic for Gnumeric spreadsheet
+# This entry is only semi-helpful, as Gnumeric compresses its files, so
+# they will ordinarily reported as "compressed", but at least -z helps
+39 string =<gmr:Workbook Gnumeric spreadsheet
+!:mime application/x-gnumeric