summaryrefslogtreecommitdiffstats
path: root/magic/Magdir/misctools
blob: dc1542adacd7d1dd48ddf818d8b97aee9206df71 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
#-----------------------------------------------------------------------------
# $File: misctools,v 1.21 2023/02/03 20:43:48 christos Exp $
# misctools:  file(1) magic for miscellaneous UNIX tools.
#
0	search/1	%%!!			X-Post-It-Note text
# URL:		http://fileformats.archiveteam.org/wiki/ICalendar
#		https://en.wikipedia.org/wiki/ICalendar
# Update:	Joerg Jenderek
# Reference:	https://www.rfc-editor.org/rfc/rfc5545
#		http://mark0.net/download/triddefs_xml.7z/defs/v/vcs.trid.xml
# Note:		called "iCalendar - vCalendar" by TrID
0	string/c			BEGIN:vcalendar
# skip DROID fmt-387-signature-id-572.vcs fmt-388-signature-id-573.ics
# with invalid separator 0x0 or 0xAB instead of CarriageReturn (0x0D) or LineFeed (0x0A)
>15	ubyte&0xF8			=0x08
# look for VERSION keyword often on second line but sometimes later as in holidays_NRW_2014.ics
>>0	search/188			VERSION
# after VERSION keword :1.0 or often :2.0 but sometimes also ;VALUE=TEXT:2.0 like in Jewish religious Juish.ics
# http://www.webcal.guru/de-DE/kalender_herunterladen?calendar_instance_id=217
# \n\040:2.0 like in import-real-world-2004-11-19.ics found at
# https://ftp.gnu.org/gnu/emacs/emacs-28.1.tar.xz
# emacs-28.1/test/lisp/calendar/icalendar-resources/import-real-world-2004-11-19.ics
#>>>&0		string			x		AFTER_VERSION=%.15s
# Note:		called "Internet Calendar and Scheduling format" by DROID via PUID fmt/388
# skip optional verparam=;other-param like ;VALUE=TEXT and look for version 2.0 that implies iCalendar variant
>>>&0		search/81		:2.0		iCalendar calendar
# look for Free/Busy component
>>>>15			search/278	:VFREEBUSY	file, with Free/Busy component
!:mime							text/calendar
!:apple							????iFBf
# no real examples found but only example on Wikipedia page
!:ext							ifb
# iCalendar calendar without Free/Busy component
>>>>15			default		x
# look for ALARM component
>>>>>15				search/154 	:VALARM	file, with ALARM component
!:mime							text/calendar
!:apple							????iCal
# found on macOS beneath /Users/$USER/Library/Calendars/ as EventAllDayAlarms.icsalarm or EventTimedAlarms.icsalarm
# no isc examples found
!:ext							icsalarm/ics
# iCalendar calendar without Free/Busy component and ALARM component
>>>>>15				default		x	file
!:mime							text/calendar
!:apple							????iCal
# no examples found with .ical .icalender suffix
!:ext							ics
# if no VERSION 2.0 is found then assume it is VERSION 1.0, that is older vCalendar
# URL:		http://fileformats.archiveteam.org/wiki/VCalendar
# Note:		called "VCalendar format" by DROID via fmt/387
>>>&0		default			x		vCalendar calendar file
# deprecated
!:mime							text/x-vcalendar
!:ext							vcs
# GRR: without VERSION keyword violates specification but accepted by Thunderbird like
# https://ftp.gnu.org/gnu/emacs/emacs-28.1.tar.xz
# emacs-28.1/test/lisp/calendar/icalendar-resources/import-with-timezone.ics
>>0	default				x		vCalendar calendar file, without VERSION
!:mime							text/x-vcalendar
#!:mime							text/calendar
# no vcs example found
!:ext							ics/vcs
# GRR: According to newest specification CarriageReturn (0xD) and LineFeed (0xA) should be used as separator but others accepted by Thunderbird
# like CRLF,LF in Sport Today.vcs created by calendar plugin of TV-Browser https://enwiki.tvbrowser.org/index.php/Calendar_Export
# or LF like https://www.schulferien.org/media/ical/deutschland/ferien_nordrhein-westfalen_2023.ics?k=foo
>>15	ubeshort			!0x0D0A		\b, without CRLF

# updated by Joerg Jenderek at Apr 2015, May 2021
# https://en.wikipedia.org/wiki/VCard
# URL: 	http://fileformats.archiveteam.org/wiki/VCard
# https://datatracker.ietf.org/doc/html/rfc6350
# the value is case-insensitive
0	string/c	begin:vcard
# skip DROID fmt-395-signature-id-634.vcf
>13	string		!VERSION:END		vCard visiting card
# deprecated
#!:mime	text/x-vcard
!:mime	text/vcard
!:apple	????vCrd
!:ext	vcf/vcard
# VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
# Joerg_Jenderek_67.vcf
>>12	search/0x113b4/c	version:
# VERSION 2.1 , 3.0 or 4.0
>>>&0	string		x			\b, version %-.3s
>>>&0	string		!2.1
>>>>13	string		!VERSION:		\b, 2nd line does not start with VERSION:
# downcase violates RFC 6350, but some "bad" software produce such vcards
>>0	string		!BEGIN			\b, not up case
# http://ftp.mozilla.org/pub/thunderbird/candidates/
# 78.10.1-candidates/build1/source/thunderbird-78.10.1.source.tar.xz
# thunderbird-78.10.1/comm/mailnews/import/test/unit/resources/basic_vcard_addressbook.vcf
>>11	beshort		!0x0D0A			\b, lines not separated by CRLF

# Summary: Libtool library file
# Extension: .la
# Submitted by: Tomasz Trojanowski <tomek@uninet.com.pl>
0	search/80	.la\ -\ a\ libtool\ library\ file	libtool library file

# Summary: Libtool object file
# Extension: .lo
# Submitted by: Abel Cheung <abelcheung@gmail.com>
0	search/80	.lo\ -\ a\ libtool\ object\ file	libtool object file

# From: Daniel Novotny <dnovotny@redhat.com>
# Update: Joerg Jenderek
# URL: https://en.wikipedia.org/wiki/Core_dump#User-mode_memory_dumps
# Reference: https://msdn.microsoft.com/en-us/library/ms680378%28VS.85%29.aspx
#
# "Windows Minidump" by TrID
# ./misctools (version 5.25) labeled the entry as "MDMP crash report data"
0	string		MDMP					Mini DuMP crash report
# https://filext.com/file-extension/DMP
!:mime	application/x-dmp
!:ext	dmp/mdmp
# The high-order word is an internal value that is implementation specific.
# The low-order word is MINIDUMP_VERSION 0xA793
>4	ulelong&0x0000FFFF	!0xA793				\b, version %#4.4x
# NumberOfStreams 8,9,10,13
>8	ulelong			x				\b, %d streams
# StreamDirectoryRva 0x20
>12	ulelong			!0x20				\b, %#8.8x RVA
# CheckSum 0
>16	ulelong			!0				\b, CheckSum %#8.8x
# Reserved or TimeDateStamp
>20	ledate			x				\b, %s
# https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
# Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
>24	ulelong			x				\b, %#x type
# >24	ulelong			>0				\b; include
# >>24	ulelong			&0x00000001			\b data sections,
# >>24	ulelong			&0x00000020			\b list of unloaded modules,
# >>24	ulelong			&0x00000100			\b process and thread information,
# >>24	ulelong			&0x00000800			\b memory information,

# Summary: abook addressbook file
# Submitted by: Mark Schreiber <mark7@alumni.cmu.edu>
0	string	#\x20abook\x20addressbook\x20file abook address book
!:mime application/x-abook-addressbook