summaryrefslogtreecommitdiffstats
path: root/magic/Magdir/sql
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--magic/Magdir/sql288
1 files changed, 288 insertions, 0 deletions
diff --git a/magic/Magdir/sql b/magic/Magdir/sql
new file mode 100644
index 0000000..00f3617
--- /dev/null
+++ b/magic/Magdir/sql
@@ -0,0 +1,288 @@
+
+#------------------------------------------------------------------------------
+# $File: sql,v 1.26 2023/04/29 17:26:58 christos Exp $
+# sql: file(1) magic for SQL files
+#
+# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
+# Recognize some MySQL files.
+# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
+# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
+#
+0 beshort 0xfe01 MySQL table definition file
+>2 byte x Version %d
+>3 byte 0 \b, type UNKNOWN
+>3 byte 1 \b, type DIAM_ISAM
+>3 byte 2 \b, type HASH
+>3 byte 3 \b, type MISAM
+>3 byte 4 \b, type PISAM
+>3 byte 5 \b, type RMS_ISAM
+>3 byte 6 \b, type HEAP
+>3 byte 7 \b, type ISAM
+>3 byte 8 \b, type MRG_ISAM
+>3 byte 9 \b, type MYISAM
+>3 byte 10 \b, type MRG_MYISAM
+>3 byte 11 \b, type BERKELEY_DB
+>3 byte 12 \b, type INNODB
+>3 byte 13 \b, type GEMINI
+>3 byte 14 \b, type NDBCLUSTER
+>3 byte 15 \b, type EXAMPLE_DB
+>3 byte 16 \b, type CSV_DB
+>3 byte 17 \b, type FEDERATED_DB
+>3 byte 18 \b, type BLACKHOLE_DB
+>3 byte 19 \b, type PARTITION_DB
+>3 byte 20 \b, type BINLOG
+>3 byte 21 \b, type SOLID
+>3 byte 22 \b, type PBXT
+>3 byte 23 \b, type TABLE_FUNCTION
+>3 byte 24 \b, type MEMCACHE
+>3 byte 25 \b, type FALCON
+>3 byte 26 \b, type MARIA
+>3 byte 27 \b, type PERFORMANCE_SCHEMA
+>3 byte 127 \b, type DEFAULT
+>0x0033 ulong x \b, MySQL version %d
+0 belong&0xffffff00 0xfefe0500 MySQL ISAM index file
+>3 byte x Version %d
+0 belong&0xffffff00 0xfefe0600 MySQL ISAM compressed data file
+>3 byte x Version %d
+0 belong&0xffffff00 0xfefe0700 MySQL MyISAM index file
+>3 byte x Version %d
+>14 beshort x \b, %d key parts
+>16 beshort x \b, %d unique key parts
+>18 byte x \b, %d keys
+>28 bequad x \b, %lld records
+>36 bequad x \b, %lld deleted records
+0 belong&0xffffff00 0xfefe0800 MySQL MyISAM compressed data file
+>3 byte x Version %d
+0 belong&0xffffff00 0xfefe0900 MySQL Maria index file
+>3 byte x Version %d
+0 belong&0xffffff00 0xfefe0a00 MySQL Maria compressed data file
+>3 byte x Version %d
+0 belong&0xffffff00 0xfefe0c00
+>4 string MACF MySQL Maria control file
+>>3 byte x Version %d
+0 string \376bin MySQL replication log,
+>9 long x server id %d
+>8 byte 1
+>>13 long 69 \b, MySQL V3.2.3
+>>>19 string x \b, server version %s
+>>13 long 75 \b, MySQL V4.0.2-V4.1
+>>>25 string x \b, server version %s
+>8 byte 15 MySQL V5+,
+>>25 string x server version %s
+>4 string MARIALOG MySQL Maria transaction log file
+>>3 byte x Version %d
+
+#------------------------------------------------------------------------------
+# iRiver H Series database file
+# From Ken Guest <ken@linux.ie>
+# As observed from iRivNavi.iDB and unencoded firmware
+#
+0 string iRivDB iRiver Database file
+>11 string >\0 Version %s
+>39 string iHP-100 [H Series]
+
+#------------------------------------------------------------------------------
+# SQLite database files
+# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
+#
+# Version 1 used GDBM internally; its files cannot be distinguished
+# from other GDBM files.
+#
+# Update: Joerg Jenderek
+# Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/sqlite-2x.trid.xml
+# Note: called "SQLite 2.x database" by TrID and "SQLite Database File Format" version 2 by DROID via PUID fmt/1135
+# Version 2 used this format:
+0 string **\ This\ file\ contains\ an\ SQLite SQLite 2.x database
+!:mime application/x-sqlite2
+# FileAttributesStore.db test.sqlite2
+!:ext sqlite/sqlite2/db
+
+# URL: https://en.wikipedia.org/wiki/SQLite
+# Reference: https://www.sqlite.org/fileformat.html
+# Update: Joerg Jenderek
+# Version 3 of SQLite allows applications to embed their own "user version"
+# number in the database at offset 60. Later, SQLite added an "application id"
+# at offset 68 that is preferred over "user version" for indicating the
+# associated application.
+#
+0 string SQLite\ format\ 3
+# skip DROID fmt-729-signature-id-1053.sqlite by checking for valid page size
+>16 ubeshort >0 SQLite 3.x
+# deprecated
+#!:mime application/x-sqlite3
+!:mime application/vnd.sqlite3
+# seldom found extension sqlite3 like in SyncData.sqlite3
+# db
+# db3 like: AddrBook.db3 cgipcrvp.db3
+# https://www.maplesoft.com/support/help/Maple/view.aspx?path=worksheet%2freference%2fhelpdatabase
+# help is used for newer Maple help database
+# SQLite database weewx.sdb used by weather software weewx
+# https://www.weewx.com/docs/usersguide.htm
+# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
+# Unfortunately extension sqlite also used for other databases starting with string
+# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
+# and with string "ZV-zlib" in like extra.sqlite
+>>68 belong !0x5CDE09EF database
+!:ext sqlite/sqlite3/db/db3/dbe/sdb/help
+>>68 belong =0x5CDE09EF database
+# maple is used for Maple Workbook
+!:ext maple
+>>60 belong =0x5f4d544e (Monotone source repository)
+# if no known user version then check for Application IDs with default clause
+>>60 belong !0x5f4d544e
+# The "Application ID" set by PRAGMA application_id
+>>>68 belong =0x0f055112 (Fossil checkout)
+>>>68 belong =0x0f055113 (Fossil global configuration)
+>>>68 belong =0x0f055111 (Fossil repository)
+>>>68 belong =0x42654462 (Bentley Systems BeSQLite Database)
+>>>68 belong =0x42654c6e (Bentley Systems Localization File)
+>>>68 belong =0x47504b47 (OGC GeoPackage file)
+# https://www.sqlite.org/src/artifact?ci=trunk&filename=magic.txt
+>>>68 belong =0x47503130 (OGC GeoPackage version 1.0 file)
+>>>68 belong =0x45737269 (Esri Spatially-Enabled Database)
+>>>68 belong =0x4d504258 (MBTiles tileset)
+# https://www.maplesoft.com/support/help/errors/view.aspx?path=Formats/Maple
+>>>68 belong =0x5CDE09EF (Maple Workbook)
+# unknown application ID
+>>>68 default x
+>>>>68 belong !0 \b, application id %u
+# The "user version" as read and set by the user_version pragma like:
+# 1 2 4 5 7 9 10 25 36 43 53 400 416 131073 131074 131075
+>>60 belong !0 \b, user version %d
+# SQLITE_VERSION_NUMBER like: 0 3008011 3016002 3007014 3017000 3022000 3028000 3031001
+>>96 belong x \b, last written using SQLite version %d
+# database page size in bytes; a power of two between 512 and 32768, or 1 for 65536
+# like: 512 1024 often 4096 32768
+>>16 ubeshort !4096 \b, page size %u
+# File format write version. 1 for legacy; 2 for WAL; 0 for corruptDB.sqlite
+>>18 ubyte !1 \b, writer version %u
+# File format read version. 1 for legacy; 2 for WAL; 4 for corruptDB.sqlite
+>>19 ubyte !1 \b, read version %u
+# Bytes of unused "reserved" space at the end of each page. Usually 0
+>>20 ubyte !0 \b, unused bytes %u
+# maximum embedded payload fraction. Must be 64; 1 for corruptDB.sqlite
+>>21 ubyte !64 \b, maximum payload %u
+# Minimum embedded payload fraction. Must be 32; 1 for corruptDB.sqlite
+>>22 ubyte !32 \b, minimum payload %u
+# Leaf payload fraction. Must be 32; 0 for corruptDB.sqlite
+>>23 ubyte !32 \b, leaf payload %u
+# file change counter
+>>24 ubelong x \b, file counter %u
+# Size of the database file in pages
+>>28 ubelong x \b, database pages %u
+# page number of the first freelist trunk page like: 0 2 3 4 5 9
+# 10 13 14 15 16 17 18 19 23 36 39 46 50 136 190 217 307 505 516 561 883 1659
+>>32 ubelong !0 \b, 1st free page %u
+# total number of freelist pages
+>>36 ubelong !0 \b, free pages %u
+# The schema cookie like: 2 3 4 6 7 9 A D E F 13 14 1C 25 2A 2F 33 44 4B 53 5A 5F 62 86 87 8F 91 A8
+>>40 ubelong x \b, cookie %#x
+# the schema format number. Supported formats are 1 2 3 and often 4
+# 3328 for corruptDB.sqlite and 0 for 512 byte storage.sqlite (TorBrowser Firefox Thunderbird)
+>>44 ubelong x \b, schema %u
+# Suggested cache size like: 0 2000
+>>48 ubelong !0 \b, cache page size %u
+# The page number of the largest root b-tree page when in auto-vacuum or incremental-vacuum modes, or zero otherwise.
+>>52 ubelong !0 \b, largest root page %u
+# The database text encoding; a value of 1 means UTF-8; 2 means UTF-16le; 3 means UTF-16be
+#>>56 ubelong x \b, encoding %u
+>>56 ubelong x
+>>>56 ubelong =1 \b, UTF-8
+>>>56 ubelong =2 \b, UTF-16 little endian
+>>>56 ubelong =3 \b, UTF-16 big endian
+# 0 for corruptDB.sqlite and for storage.sqlite with database pages 1 (TorBrowser Firefox Thunderbird)
+# https://mozilla.github.io/firefox-browser-architecture/text/0010-firefox-data-stores.html
+>>>56 default x
+>>>>56 ubelong x \b, unknown %#x encoding
+# True (non-zero) for incremental-vacuum mode; false (zero) otherwiseqy
+>>64 ubelong !0 \b, vacuum mode %u
+# Reserved for expansion. Must be zero
+>>72 uquad !0 \b, reserved %#llx
+# The version-valid-for number like:
+# 1 2 3 4 C F 68h 95h 266h A99h 3DCDh B7CEh
+>>92 ubelong x \b, version-valid-for %u
+
+# SQLite Write-Ahead Log from SQLite version >= 3.7.0
+# https://www.sqlite.org/fileformat.html#walformat
+0 belong&0xfffffffe 0x377f0682 SQLite Write-Ahead Log,
+!:ext sqlite-wal/db-wal
+>4 belong x version %d
+# Summary: SQLite Write-Ahead-Log index (shared memory)
+# From: Joerg Jenderek
+# URL: http://fileformats.archiveteam.org/wiki/SQLite
+# Reference: http://www.sqlite.org/draft/walformat.html#walidxfmt
+# iVersion; WAL-index format version number; always 3007000=2DE218h
+0 ulelong 0x002DE218
+>0 use shm-le
+# big endian variant not tested
+0 ubelong 0x002DE218
+>0 use \^shm-le
+# show information about SQLite Write-Ahead-Log shared memory
+0 name shm-le
+>0 ulelong x SQLite Write-Ahead Log shared memory
+#!:mime application/octet-stream
+!:mime application/vnd.sqlite3
+# db3-shm Acronis BackupAndRecovery F4CEEE47-042C-4828-95A0-DE44EC267A28.db3-shm
+# dbx-shm probably Dropbox filecache.dbx-shm
+# aup3-shm Audacity project tada.aup3-shm
+# srd-shm Microsoft Windows StateRepository service StateRepository-Deployment.srd-shm StateRepository-Machine.srd-shm:
+!:ext sqlite-shm/db-shm/db3-shm/dbx-shm/aup3-shm/srd-shm
+# unused padding space; must be zero
+>4 ulelong !0 \b, unused %x
+# iChange; unsigned integer counter, incremented with each transaction
+>8 ulelong x \b, counter %u
+# isInit; the "isInit" flag; 1 when the shm file has been initialized
+>12 ubyte !1 \b, not initialized %u
+# bigEndCksum; true if the WAL file uses big-ending checksums; 0 if the WAL uses little-endian checksums
+>13 ubyte !0 \b, checksum type %u
+# szPage; database page size in bytes, or 1 if the page size is 65536
+>14 uleshort !1 \b, page size %u
+>14 uleshort =1 \b, page size 65536
+# mxFrame; number of valid and committed frames in the WAL file
+>16 ulelong x \b, %u frames
+# nPage; size of the database file in pages
+>20 ulelong x \b, %u pages
+# aFrameCksum; checksum of the last frame in the WAL file
+>24 ulelong x \b, frame checksum %#x
+# aSalt; two salt value copied from the WAL file header in the byte-order of the WAL file; might be different from machine byte-order
+>32 ulequad x \b, salt %#llx
+# aCksum; checksum over bytes 0 through 39 of this header
+>40 ulelong x \b, header checksum %#x
+# a copy of bytes 0 through 47 of header
+>48 ulelong !3007000 \b, iversion %u
+# nBackfill; number of WAL frames that have already been backfilled into the database by prior checkpoints
+>96 ulelong !0 \b, %u backfilled
+# nBackfillAttempted; number of WAL frames that have attempted to be backfilled
+>>128 ulelong x (%u attempts)
+# read-mark[0..4]; five "read marks"; each read mark is a 32-bit unsigned integer
+>100 ulelong !0 \b, read-mark[0] %#x
+>104 ulelong x \b, read-mark[1] %#x
+>108 ulelong !0xffffffff \b, read-mark[2] %#x
+>112 ulelong !0xffffffff \b, read-mark[3] %#x
+>116 ulelong !0xffffffff \b, read-mark[4] %#x
+# unused space set aside for 8 file locks
+>120 ulequad !0 \b, space %#llx
+# unused space reserved for further expansion
+>132 ulelong !0 \b, reserved %#x
+
+# SQLite Rollback Journal
+# https://www.sqlite.org/fileformat.html#rollbackjournal
+0 string \xd9\xd5\x05\xf9\x20\xa1\x63\xd7 SQLite Rollback Journal
+
+# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
+# https://github.com/PredatH0r/ChanSort
+0 string PSDB\0 Panasonic channel list DataBase
+!:ext db/bin
+#!:mime application/x-db-svl-panasonic
+>126 string SQLite\ format\ 3
+#!:mime application/x-panasonic-sqlite3
+>>&-15 indirect x \b; contains
+
+# H2 Database from https://www.h2database.com/
+0 string --\ H2\ 0.5/B\ --\ \n H2 Database file
+
+# DuckDB database file from https://duckdb.org
+8 string DUCK DuckDB database file
+>12 lequad x \b, version %lld
+#>20 lequad x \b, flags %#llx
+#>28 lequad x \b, flags %#llx