summaryrefslogtreecommitdiffstats
path: root/magic/Magdir/misctools
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--magic/Magdir/misctools140
1 files changed, 140 insertions, 0 deletions
diff --git a/magic/Magdir/misctools b/magic/Magdir/misctools
new file mode 100644
index 0000000..dc1542a
--- /dev/null
+++ b/magic/Magdir/misctools
@@ -0,0 +1,140 @@
+
+#-----------------------------------------------------------------------------
+# $File: misctools,v 1.21 2023/02/03 20:43:48 christos Exp $
+# misctools: file(1) magic for miscellaneous UNIX tools.
+#
+0 search/1 %%!! X-Post-It-Note text
+# URL: http://fileformats.archiveteam.org/wiki/ICalendar
+# https://en.wikipedia.org/wiki/ICalendar
+# Update: Joerg Jenderek
+# Reference: https://www.rfc-editor.org/rfc/rfc5545
+# http://mark0.net/download/triddefs_xml.7z/defs/v/vcs.trid.xml
+# Note: called "iCalendar - vCalendar" by TrID
+0 string/c BEGIN:vcalendar
+# skip DROID fmt-387-signature-id-572.vcs fmt-388-signature-id-573.ics
+# with invalid separator 0x0 or 0xAB instead of CarriageReturn (0x0D) or LineFeed (0x0A)
+>15 ubyte&0xF8 =0x08
+# look for VERSION keyword often on second line but sometimes later as in holidays_NRW_2014.ics
+>>0 search/188 VERSION
+# after VERSION keword :1.0 or often :2.0 but sometimes also ;VALUE=TEXT:2.0 like in Jewish religious Juish.ics
+# http://www.webcal.guru/de-DE/kalender_herunterladen?calendar_instance_id=217
+# \n\040:2.0 like in import-real-world-2004-11-19.ics found at
+# https://ftp.gnu.org/gnu/emacs/emacs-28.1.tar.xz
+# emacs-28.1/test/lisp/calendar/icalendar-resources/import-real-world-2004-11-19.ics
+#>>>&0 string x AFTER_VERSION=%.15s
+# Note: called "Internet Calendar and Scheduling format" by DROID via PUID fmt/388
+# skip optional verparam=;other-param like ;VALUE=TEXT and look for version 2.0 that implies iCalendar variant
+>>>&0 search/81 :2.0 iCalendar calendar
+# look for Free/Busy component
+>>>>15 search/278 :VFREEBUSY file, with Free/Busy component
+!:mime text/calendar
+!:apple ????iFBf
+# no real examples found but only example on Wikipedia page
+!:ext ifb
+# iCalendar calendar without Free/Busy component
+>>>>15 default x
+# look for ALARM component
+>>>>>15 search/154 :VALARM file, with ALARM component
+!:mime text/calendar
+!:apple ????iCal
+# found on macOS beneath /Users/$USER/Library/Calendars/ as EventAllDayAlarms.icsalarm or EventTimedAlarms.icsalarm
+# no isc examples found
+!:ext icsalarm/ics
+# iCalendar calendar without Free/Busy component and ALARM component
+>>>>>15 default x file
+!:mime text/calendar
+!:apple ????iCal
+# no examples found with .ical .icalender suffix
+!:ext ics
+# if no VERSION 2.0 is found then assume it is VERSION 1.0, that is older vCalendar
+# URL: http://fileformats.archiveteam.org/wiki/VCalendar
+# Note: called "VCalendar format" by DROID via fmt/387
+>>>&0 default x vCalendar calendar file
+# deprecated
+!:mime text/x-vcalendar
+!:ext vcs
+# GRR: without VERSION keyword violates specification but accepted by Thunderbird like
+# https://ftp.gnu.org/gnu/emacs/emacs-28.1.tar.xz
+# emacs-28.1/test/lisp/calendar/icalendar-resources/import-with-timezone.ics
+>>0 default x vCalendar calendar file, without VERSION
+!:mime text/x-vcalendar
+#!:mime text/calendar
+# no vcs example found
+!:ext ics/vcs
+# GRR: According to newest specification CarriageReturn (0xD) and LineFeed (0xA) should be used as separator but others accepted by Thunderbird
+# like CRLF,LF in Sport Today.vcs created by calendar plugin of TV-Browser https://enwiki.tvbrowser.org/index.php/Calendar_Export
+# or LF like https://www.schulferien.org/media/ical/deutschland/ferien_nordrhein-westfalen_2023.ics?k=foo
+>>15 ubeshort !0x0D0A \b, without CRLF
+
+# updated by Joerg Jenderek at Apr 2015, May 2021
+# https://en.wikipedia.org/wiki/VCard
+# URL: http://fileformats.archiveteam.org/wiki/VCard
+# https://datatracker.ietf.org/doc/html/rfc6350
+# the value is case-insensitive
+0 string/c begin:vcard
+# skip DROID fmt-395-signature-id-634.vcf
+>13 string !VERSION:END vCard visiting card
+# deprecated
+#!:mime text/x-vcard
+!:mime text/vcard
+!:apple ????vCrd
+!:ext vcf/vcard
+# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
+# Joerg_Jenderek_67.vcf
+>>12 search/0x113b4/c version:
+# VERSION 2.1 , 3.0 or 4.0
+>>>&0 string x \b, version %-.3s
+>>>&0 string !2.1
+>>>>13 string !VERSION: \b, 2nd line does not start with VERSION:
+# downcase violates RFC 6350, but some "bad" software produce such vcards
+>>0 string !BEGIN \b, not up case
+# http://ftp.mozilla.org/pub/thunderbird/candidates/
+# 78.10.1-candidates/build1/source/thunderbird-78.10.1.source.tar.xz
+# thunderbird-78.10.1/comm/mailnews/import/test/unit/resources/basic_vcard_addressbook.vcf
+>>11 beshort !0x0D0A \b, lines not separated by CRLF
+
+# Summary: Libtool library file
+# Extension: .la
+# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
+0 search/80 .la\ -\ a\ libtool\ library\ file libtool library file
+
+# Summary: Libtool object file
+# Extension: .lo
+# Submitted by: Abel Cheung <abelcheung@gmail.com>
+0 search/80 .lo\ -\ a\ libtool\ object\ file libtool object file
+
+# From: Daniel Novotny <dnovotny@redhat.com>
+# Update: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps
+# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx
+#
+# "Windows Minidump" by TrID
+# ./misctools (version 5.25) labeled the entry as "MDMP crash report data"
+0 string MDMP Mini DuMP crash report
+# https://filext.com/file-extension/DMP
+!:mime application/x-dmp
+!:ext dmp/mdmp
+# The high-order word is an internal value that is implementation specific.
+# The low-order word is MINIDUMP_VERSION 0xA793
+>4 ulelong&0x0000FFFF !0xA793 \b, version %#4.4x
+# NumberOfStreams 8,9,10,13
+>8 ulelong x \b, %d streams
+# StreamDirectoryRva 0x20
+>12 ulelong !0x20 \b, %#8.8x RVA
+# CheckSum 0
+>16 ulelong !0 \b, CheckSum %#8.8x
+# Reserved or TimeDateStamp
+>20 ledate x \b, %s
+# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
+# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
+>24 ulelong x \b, %#x type
+# >24 ulelong >0 \b; include
+# >>24 ulelong &0x00000001 \b data sections,
+# >>24 ulelong &0x00000020 \b list of unloaded modules,
+# >>24 ulelong &0x00000100 \b process and thread information,
+# >>24 ulelong &0x00000800 \b memory information,
+
+# Summary: abook addressbook file
+# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu>
+0 string #\x20abook\x20addressbook\x20file abook address book
+!:mime application/x-abook-addressbook