summaryrefslogtreecommitdiffstats
path: root/magic/Magdir/sql
blob: 00f36179f8a59ad8ba87148f16b25c8cdeae631d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
#------------------------------------------------------------------------------
# $File: sql,v 1.26 2023/04/29 17:26:58 christos Exp $
# sql:  file(1) magic for SQL files
#
# From: "Marty Leisner" <mleisner@eng.mc.xerox.com>
# Recognize some MySQL files.
# Elan Ruusamae <glen@delfi.ee>, added MariaDB signatures
# from https://bazaar.launchpad.net/~maria-captains/maria/5.5/view/head:/support-files/magic
#
0	beshort			0xfe01		MySQL table definition file
>2	byte			x		Version %d
>3	byte			0		\b, type UNKNOWN
>3	byte			1		\b, type DIAM_ISAM
>3	byte			2		\b, type HASH
>3	byte			3		\b, type MISAM
>3	byte			4		\b, type PISAM
>3	byte			5		\b, type RMS_ISAM
>3	byte			6		\b, type HEAP
>3	byte			7		\b, type ISAM
>3	byte			8		\b, type MRG_ISAM
>3	byte			9		\b, type MYISAM
>3	byte			10		\b, type MRG_MYISAM
>3	byte			11		\b, type BERKELEY_DB
>3	byte			12		\b, type INNODB
>3	byte			13		\b, type GEMINI
>3	byte			14		\b, type NDBCLUSTER
>3	byte			15		\b, type EXAMPLE_DB
>3	byte			16		\b, type CSV_DB
>3	byte			17		\b, type FEDERATED_DB
>3	byte			18		\b, type BLACKHOLE_DB
>3	byte			19		\b, type PARTITION_DB
>3	byte			20		\b, type BINLOG
>3	byte			21		\b, type SOLID
>3	byte			22		\b, type PBXT
>3	byte			23		\b, type TABLE_FUNCTION
>3	byte			24		\b, type MEMCACHE
>3	byte			25		\b, type FALCON
>3	byte			26		\b, type MARIA
>3	byte			27		\b, type PERFORMANCE_SCHEMA
>3	byte			127		\b, type DEFAULT
>0x0033	ulong			x		\b, MySQL version %d
0	belong&0xffffff00	0xfefe0500	MySQL ISAM index file
>3	byte			x		Version %d
0	belong&0xffffff00	0xfefe0600	MySQL ISAM compressed data file
>3	byte			x		Version %d
0	belong&0xffffff00	0xfefe0700	MySQL MyISAM index file
>3	byte			x		Version %d
>14	beshort			x		\b, %d key parts
>16	beshort			x		\b, %d unique key parts
>18	byte			x		\b, %d keys
>28	bequad			x		\b, %lld records
>36	bequad			x		\b, %lld deleted records
0	belong&0xffffff00	0xfefe0800	MySQL MyISAM compressed data file
>3	byte			x		Version %d
0	belong&0xffffff00	0xfefe0900	MySQL Maria index file
>3	byte			x		Version %d
0	belong&0xffffff00	0xfefe0a00	MySQL Maria compressed data file
>3	byte			x		Version %d
0	belong&0xffffff00	0xfefe0c00
>4	string			MACF		MySQL Maria control file
>>3	byte			x		Version %d
0	string			\376bin	MySQL replication log,
>9	long			x		server id %d
>8	byte			1
>>13	long			69		\b, MySQL V3.2.3
>>>19	string			x		\b, server version %s
>>13	long			75		\b, MySQL V4.0.2-V4.1
>>>25	string			x		\b, server version %s
>8	byte			15		MySQL V5+,
>>25	string			x		server version %s
>4	string			MARIALOG	MySQL Maria transaction log file
>>3	byte			x		Version %d

#------------------------------------------------------------------------------
# iRiver H Series database file
# From Ken Guest <ken@linux.ie>
# As observed from iRivNavi.iDB and unencoded firmware
#
0   string		iRivDB	iRiver Database file
>11  string	>\0	Version %s
>39  string		iHP-100	[H Series]

#------------------------------------------------------------------------------
# SQLite database files
# Ken Guest <ken@linux.ie>, Ty Sarna, Zack Weinberg
#
# Version 1 used GDBM internally; its files cannot be distinguished
# from other GDBM files.
#
# Update:	Joerg Jenderek
# Reference:	http://mark0.net/download/triddefs_xml.7z/defs/s/sqlite-2x.trid.xml
# Note:		called "SQLite 2.x database" by TrID and "SQLite Database File Format" version 2 by DROID via PUID fmt/1135
# Version 2 used this format:
0	string	**\ This\ file\ contains\ an\ SQLite  SQLite 2.x database
!:mime	application/x-sqlite2
# FileAttributesStore.db test.sqlite2
!:ext	sqlite/sqlite2/db

# URL:		https://en.wikipedia.org/wiki/SQLite
# Reference:	https://www.sqlite.org/fileformat.html
# Update:	Joerg Jenderek
# Version 3 of SQLite allows applications to embed their own "user version"
# number in the database at offset 60.  Later, SQLite added an "application id"
# at offset 68 that is preferred over "user version" for indicating the
# associated application.
#
0   string  SQLite\ format\ 3
# skip DROID fmt-729-signature-id-1053.sqlite by checking for valid page size
>16 ubeshort >0                 SQLite 3.x
# deprecated
#!:mime	application/x-sqlite3
!:mime	application/vnd.sqlite3
# seldom found extension sqlite3 like in SyncData.sqlite3
# db
# db3 like: AddrBook.db3 cgipcrvp.db3
# https://www.maplesoft.com/support/help/Maple/view.aspx?path=worksheet%2freference%2fhelpdatabase
# help is used for newer Maple help database
# SQLite database weewx.sdb used by weather software weewx
# https://www.weewx.com/docs/usersguide.htm
# Avira Antivir use extension "dbe" like in avevtdb.dbe, avguard_tchk.dbe
# Unfortunately extension sqlite also used for other databases starting with string
# "TTCONTAINER" like in tracks.sqlite contentconsumer.sqlite contentproducerrepository.sqlite
# and with string "ZV-zlib" in like extra.sqlite
>>68 belong !0x5CDE09EF	database
!:ext sqlite/sqlite3/db/db3/dbe/sdb/help
>>68 belong =0x5CDE09EF  database
# maple is used for Maple Workbook
!:ext maple
>>60 belong =0x5f4d544e  (Monotone source repository)
# if no known user version then check for Application IDs with default clause
>>60 belong !0x5f4d544e
# The "Application ID" set by PRAGMA application_id
>>>68 belong =0x0f055112 (Fossil checkout)
>>>68 belong =0x0f055113 (Fossil global configuration)
>>>68 belong =0x0f055111 (Fossil repository)
>>>68 belong =0x42654462 (Bentley Systems BeSQLite Database)
>>>68 belong =0x42654c6e (Bentley Systems Localization File)
>>>68 belong =0x47504b47 (OGC GeoPackage file)
#	https://www.sqlite.org/src/artifact?ci=trunk&filename=magic.txt
>>>68 belong =0x47503130 (OGC GeoPackage version 1.0 file)
>>>68 belong =0x45737269 (Esri Spatially-Enabled Database)
>>>68 belong =0x4d504258 (MBTiles tileset)
#	https://www.maplesoft.com/support/help/errors/view.aspx?path=Formats/Maple
>>>68 belong =0x5CDE09EF (Maple Workbook)
# unknown application ID
>>>68 default x
>>>>68 belong !0         \b, application id %u
# The "user version" as read and set by the user_version pragma like:
# 1 2 4 5 7 9 10 25 36 43 53 400 416 131073 131074 131075
>>60 belong !0          \b, user version %d
# SQLITE_VERSION_NUMBER like: 0 3008011 3016002 3007014 3017000 3022000 3028000 3031001
>>96 belong  x           \b, last written using SQLite version %d
# database page size in bytes; a power of two between 512 and 32768, or 1 for 65536
# like: 512 1024 often 4096 32768
>>16 ubeshort !4096      \b, page size %u
# File format write version. 1 for legacy; 2 for WAL; 0 for corruptDB.sqlite
>>18 ubyte   !1          \b, writer version %u
# File format read version. 1 for legacy; 2 for WAL; 4 for corruptDB.sqlite
>>19 ubyte   !1          \b, read version %u
# Bytes of unused "reserved" space at the end of each page. Usually 0
>>20 ubyte   !0          \b, unused bytes %u
# maximum embedded payload fraction. Must be 64; 1 for corruptDB.sqlite
>>21 ubyte   !64         \b, maximum payload %u
# Minimum embedded payload fraction. Must be 32; 1 for corruptDB.sqlite
>>22 ubyte   !32         \b, minimum payload %u
# Leaf payload fraction. Must be 32; 0 for corruptDB.sqlite
>>23 ubyte   !32         \b, leaf payload %u
# file change counter
>>24 ubelong x           \b, file counter %u
# Size of the database file in pages
>>28 ubelong x           \b, database pages %u
# page number of the first freelist trunk page like: 0 2 3 4 5 9
# 10 13 14 15 16 17 18 19 23 36 39 46 50 136 190 217 307 505 516 561 883 1659
>>32 ubelong !0          \b, 1st free page %u
# total number of freelist pages
>>36 ubelong !0          \b, free pages %u
# The schema cookie like: 2 3 4 6 7 9 A D E F 13 14 1C 25 2A 2F 33 44 4B 53 5A 5F 62 86 87 8F 91 A8
>>40 ubelong x           \b, cookie %#x
# the schema format number. Supported formats are 1 2 3 and often 4
# 3328 for corruptDB.sqlite and 0 for 512 byte storage.sqlite (TorBrowser Firefox Thunderbird)
>>44 ubelong x           \b, schema %u
# Suggested cache size  like: 0 2000
>>48 ubelong !0          \b, cache page size %u
# The page number of the largest root b-tree page when in auto-vacuum or incremental-vacuum modes, or zero otherwise. 
>>52 ubelong !0          \b, largest root page %u
# The database text encoding; a value of 1 means UTF-8; 2 means UTF-16le; 3 means UTF-16be
#>>56 ubelong x           \b, encoding %u
>>56 ubelong x
>>>56 ubelong =1         \b, UTF-8
>>>56 ubelong =2         \b, UTF-16 little endian
>>>56 ubelong =3         \b, UTF-16 big endian
# 0 for corruptDB.sqlite and for storage.sqlite with database pages 1 (TorBrowser Firefox Thunderbird)
# https://mozilla.github.io/firefox-browser-architecture/text/0010-firefox-data-stores.html
>>>56 default x
>>>>56 ubelong x         \b, unknown %#x encoding
# True (non-zero) for incremental-vacuum mode; false (zero) otherwiseqy
>>64 ubelong !0           \b, vacuum mode %u
# Reserved for expansion. Must be zero
>>72 uquad !0             \b, reserved %#llx
# The version-valid-for number like:
# 1 2 3 4 C F 68h 95h 266h A99h 3DCDh B7CEh
>>92 ubelong x            \b, version-valid-for %u

# SQLite Write-Ahead Log from SQLite version >= 3.7.0
# https://www.sqlite.org/fileformat.html#walformat
0	belong&0xfffffffe	0x377f0682	SQLite Write-Ahead Log,
!:ext sqlite-wal/db-wal
>4	belong	x	version %d
# Summary:	SQLite Write-Ahead-Log index (shared memory)
# From: 	Joerg Jenderek
# URL:		http://fileformats.archiveteam.org/wiki/SQLite
# Reference:	http://www.sqlite.org/draft/walformat.html#walidxfmt
# iVersion; WAL-index format version number; always 3007000=2DE218h
0	ulelong		0x002DE218
>0	use	shm-le
# big endian variant not tested
0	ubelong		0x002DE218
>0	use	\^shm-le
# show information about SQLite Write-Ahead-Log shared memory
0	name	shm-le
>0	ulelong		x		SQLite Write-Ahead Log shared memory
#!:mime	application/octet-stream
!:mime	application/vnd.sqlite3
# db3-shm	Acronis	BackupAndRecovery			F4CEEE47-042C-4828-95A0-DE44EC267A28.db3-shm
# dbx-shm	probably Dropbox				filecache.dbx-shm
# aup3-shm	Audacity project				tada.aup3-shm
# srd-shm	Microsoft Windows StateRepository service	StateRepository-Deployment.srd-shm StateRepository-Machine.srd-shm:
!:ext	sqlite-shm/db-shm/db3-shm/dbx-shm/aup3-shm/srd-shm 
# unused padding space; must be zero
>4	ulelong		!0		\b, unused %x
# iChange; unsigned integer counter, incremented with each transaction
>8	ulelong		x		\b, counter %u
# isInit; the "isInit" flag; 1 when the shm file has been initialized
>12	ubyte		!1		\b, not initialized %u
# bigEndCksum; true if the WAL file uses big-ending checksums; 0 if the WAL uses little-endian checksums
>13	ubyte		!0		\b, checksum type %u
# szPage; database page size in bytes, or 1 if the page size is 65536
>14	uleshort	!1		\b, page size %u
>14	uleshort	=1		\b, page size 65536
# mxFrame; number of valid and committed frames in the WAL file
>16	ulelong		x		\b, %u frames
# nPage; size of the database file in pages
>20	ulelong		x		\b, %u pages
# aFrameCksum; checksum of the last frame in the WAL file
>24	ulelong		x		\b, frame checksum %#x
# aSalt; two salt value copied from the WAL file header in the byte-order of the WAL file; might be different from machine byte-order
>32	ulequad		x		\b, salt %#llx
# aCksum; checksum over bytes 0 through 39 of this header
>40	ulelong		x		\b, header checksum %#x
# a copy of bytes 0 through 47 of header
>48	ulelong		!3007000	\b, iversion %u
# nBackfill; number of WAL frames that have already been backfilled into the database by prior checkpoints
>96	ulelong		!0		\b, %u backfilled
# nBackfillAttempted; number of WAL frames that have attempted to be backfilled
>>128	ulelong		x		(%u attempts)
# read-mark[0..4]; five "read marks"; each read mark is a 32-bit unsigned integer
>100	ulelong		!0		\b, read-mark[0] %#x
>104	ulelong		x		\b, read-mark[1] %#x
>108	ulelong		!0xffffffff	\b, read-mark[2] %#x
>112	ulelong		!0xffffffff	\b, read-mark[3] %#x
>116	ulelong		!0xffffffff	\b, read-mark[4] %#x
# unused space set aside for 8 file locks
>120	ulequad		!0		\b, space %#llx
# unused space reserved for further expansion
>132	ulelong		!0		\b, reserved %#x

# SQLite Rollback Journal
# https://www.sqlite.org/fileformat.html#rollbackjournal
0	string	\xd9\xd5\x05\xf9\x20\xa1\x63\xd7	SQLite Rollback Journal

# Panasonic channel list database svl.bin or svl.db added by Joerg Jenderek
# https://github.com/PredatH0r/ChanSort
0	string		PSDB\0			Panasonic channel list DataBase
!:ext db/bin
#!:mime	application/x-db-svl-panasonic
>126	string		SQLite\ format\ 3
#!:mime	application/x-panasonic-sqlite3
>>&-15	indirect	x			\b; contains

# H2 Database from https://www.h2database.com/
0	string		--\ H2\ 0.5/B\ --\ \n	H2 Database file

# DuckDB database file from https://duckdb.org
8	string	DUCK    DuckDB database file
>12	lequad	x	\b, version %lld
#>20	lequad	x	\b, flags %#llx
#>28	lequad	x	\b, flags %#llx