# SOME DESCRIPTIVE TITLE # Copyright (C) YEAR Free Software Foundation, Inc. # This file is distributed under the same license as the PACKAGE package. # FIRST AUTHOR , YEAR. # #, fuzzy msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "POT-Creation-Date: 2023-10-02 12:08+0200\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME \n" "Language-Team: LANGUAGE \n" "Language: \n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" "Content-Transfer-Encoding: 8bit\n" #. type: Dd #: archlinux debian-unstable #, no-wrap msgid "Arpil 18, 2023" msgstr "" #. type: Dt #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "MAGIC 5" msgstr "" #. install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems. #. type: Sh #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "NAME" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "E<.Nm magic>" msgstr "" #. type: Nd #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "file command's magic pattern file" msgstr "" #. type: Sh #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "DESCRIPTION" msgstr "" #. type: Plain text #: archlinux msgid "" "This manual page documents the format of magic files as used by the E<.Xr " "file 1> command, version 5.45. The E<.Xr file 1> command identifies the " "type of a file using, among other tests, a test for whether the file " "contains certain E<.Dq \"magic patterns\">. The database of these E<.Dq " "\"magic patterns\"> is usually located in a binary file in E<.Pa /usr/share/" "file/misc/magic.mgc> or a directory of source text magic pattern fragment " "files in E<.Pa /usr/share/file/misc/magic>. The database specifies what " "patterns are to be tested for, what message or MIME type to print if a " "particular pattern is found, and additional information to extract from the " "file." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "The format of the source fragment files that are used to build this database " "is as follows: Each line of a fragment file specifies a test to be " "performed. A test compares the data starting at a particular offset in the " "file with a byte value, a string or a numeric value. If the test succeeds, " "a message is printed. The line consists of the following fields:" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv offset" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A number specifying the offset (in bytes) into the file of the data which is " "to be tested. This offset can be a negative number if it is:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "The first direct offset of the magic entry (at continuation level 0), in " "which case it is interpreted an offset from end end of the file going " "backwards. This works only when a file descriptor to the file is available " "and it is a regular file." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A continuation offset relative to the end of the last up-level field E<.Dv " "( \\*[Am]>)." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv type" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "The type of the data to be tested. The possible values are:" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv byte" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A one-byte value." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv short" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A two-byte value in this machine's native byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv long" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A four-byte value in this machine's native byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv quad" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "An eight-byte value in this machine's native byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv float" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A 32-bit single precision IEEE floating point number in this machine's " "native byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv double" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A 64-bit double precision IEEE floating point number in this machine's " "native byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv string" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A string of bytes. The string type specification can be optionally followed " "by a /EwidthE option and optionally followed by a set of flags /" "[bCcftTtWw]*. The width limits the number of characters to be copied. Zero " "means all characters. The following flags are supported:" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "b" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "Force binary file test." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "C" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Use upper case insensitive matching: upper case characters in the magic " "match both lower and upper case characters in the target, whereas lower case " "characters in the magic only match upper case characters in the target." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "c" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Use lower case insensitive matching: lower case characters in the magic " "match both lower and upper case characters in the target, whereas upper case " "characters in the magic only match upper case characters in the target. To " "do a complete case insensitive match, specify both E<.Dq c> and E<.Dq C>." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "f" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Require that the matched string is a full word, not a partial word match." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "T" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "Trim the string, i.e. leading and trailing whitespace" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "t" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "Force text file test." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "W" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Compact whitespace in the target, which must contain at least one whitespace " "character. If the magic has E<.Dv n> consecutive blanks, the target needs " "at least E<.Dv n> consecutive blanks to match." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "w" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Treat every blank in the magic as an optional blank. is deleted before the " "string is printed." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv pstring" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A Pascal-style string where the first byte/short/int is interpreted as the " "unsigned length. The length defaults to byte and can be specified as a " "modifier. The following modifiers are supported:" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "B" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A byte length (default)." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "H" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A 2 byte big endian length." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "h" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A 2 byte little endian length." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "L" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A 4 byte big endian length." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "l" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A 4 byte little endian length." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "J" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "The length includes itself in its count." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "The string is not NUL terminated. E<.Dq J> is used rather than the more " "valuable E<.Dq I> because this type of length is a feature of the JPEG " "format." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv date" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A four-byte value interpreted as a UNIX date." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv qdate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "An eight-byte value interpreted as a UNIX date." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv ldate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A four-byte value interpreted as a UNIX-style date, but interpreted as local " "time rather than UTC." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv qldate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "An eight-byte value interpreted as a UNIX-style date, but interpreted as " "local time rather than UTC." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv qwdate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "An eight-byte value interpreted as a Windows-style date." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv beid3" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A 32-bit ID3 length in big-endian byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv beshort" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A two-byte value in big-endian byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv belong" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A four-byte value in big-endian byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv bequad" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "An eight-byte value in big-endian byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv befloat" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A 32-bit single precision IEEE floating point number in big-endian byte " "order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv bedouble" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A 64-bit double precision IEEE floating point number in big-endian byte " "order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv bedate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A four-byte value in big-endian byte order, interpreted as a Unix date." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv beqdate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "An eight-byte value in big-endian byte order, interpreted as a Unix date." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv beldate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A four-byte value in big-endian byte order, interpreted as a UNIX-style " "date, but interpreted as local time rather than UTC." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv beqldate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "An eight-byte value in big-endian byte order, interpreted as a UNIX-style " "date, but interpreted as local time rather than UTC." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv beqwdate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "An eight-byte value in big-endian byte order, interpreted as a Windows-style " "date." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv bestring16" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A two-byte unicode (UCS16) string in big-endian byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv leid3" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A 32-bit ID3 length in little-endian byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv leshort" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A two-byte value in little-endian byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv lelong" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A four-byte value in little-endian byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv lequad" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "An eight-byte value in little-endian byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv lefloat" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A 32-bit single precision IEEE floating point number in little-endian byte " "order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv ledouble" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A 64-bit double precision IEEE floating point number in little-endian byte " "order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv ledate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A four-byte value in little-endian byte order, interpreted as a UNIX date." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv leqdate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "An eight-byte value in little-endian byte order, interpreted as a UNIX date." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv leldate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A four-byte value in little-endian byte order, interpreted as a UNIX-style " "date, but interpreted as local time rather than UTC." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv leqldate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "An eight-byte value in little-endian byte order, interpreted as a UNIX-style " "date, but interpreted as local time rather than UTC." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv leqwdate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "An eight-byte value in little-endian byte order, interpreted as a Windows-" "style date." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv lestring16" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A two-byte unicode (UCS16) string in little-endian byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv melong" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A four-byte value in middle-endian (PDP-11) byte order." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv medate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A four-byte value in middle-endian (PDP-11) byte order, interpreted as a " "UNIX date." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv meldate" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A four-byte value in middle-endian (PDP-11) byte order, interpreted as a " "UNIX-style date, but interpreted as local time rather than UTC." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv indirect" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Starting at the given offset, consult the magic database again. The offset " "of the E<.Dv indirect> magic is by default absolute in the file, but one can " "specify E<.Dv /r> to indicate that the offset is relative from the beginning " "of the entry." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv name" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Define a E<.Dq named> magic instance that can be called from another E<.Dv " "use> magic entry, like a subroutine call. Named instance direct magic " "offsets are relative to the offset of the previous matched entry, but " "indirect offsets are relative to the beginning of the file as usual. Named " "magic entries always match." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv use" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Recursively call the named magic starting from the current offset. If the " "name of the referenced begins with a E<.Dv ^> then the endianness of the " "magic is switched; if the magic mentioned E<.Dv leshort> for example, it is " "treated as E<.Dv beshort> and vice versa. This is useful to avoid " "duplicating the rules for different endianness." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv regex" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A regular expression match in extended POSIX regular expression syntax (like " "egrep). Regular expressions can take exponential time to process, and their " "performance is hard to predict, so their use is discouraged. When used in " "production environments, their performance should be carefully checked. The " "size of the string to search should also be limited by specifying E<.Dv /" "ElengthE>, to avoid performance issues scanning long files. The " "type specification can also be optionally followed by E<.Dv /[c][s][l]>. " "The E<.Dq c> flag makes the match case insensitive, while the E<.Dq s> flag " "update the offset to the start offset of the match, rather than the end. " "The E<.Dq l> modifier, changes the limit of length to mean number of lines " "instead of a byte count. Lines are delimited by the platforms native line " "delimiter. When a line count is specified, an implicit byte count also " "computed assuming each line is 80 characters long. If neither a byte or " "line count is specified, the search is limited automatically to 8KiB. E<.Dv " "^> and E<.Dv $> match the beginning and end of individual lines, " "respectively, not beginning and end of file." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv search" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A literal string search starting at the given offset. The same modifier " "flags can be used as for string patterns. The search expression must " "contain the range in the form E<.Dv /number,> that is the number of " "positions at which the match will be attempted, starting from the start " "offset. This is suitable for searching larger binary expressions with " "variable offsets, using E<.Dv \\e> escapes for special characters. The " "order of modifier and number is not relevant." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv default" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "This is intended to be used with the test E<.Em x> (which is always true) " "and it has no type. It matches when no other test at that continuation " "level has matched before. Clearing that matched tests for a continuation " "level, can be done using the E<.Dv clear> test." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv clear" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "This test is always true and clears the match flag for that continuation " "level. It is intended to be used with the E<.Dv default> test." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv der" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Parse the file as a DER Certificate file. The test field is used as a der " "type that needs to be matched. The DER types are: E<.Dv eoc>, E<.Dv bool>, " "E<.Dv int>, E<.Dv bit_str>, E<.Dv octet_str>, E<.Dv null>, E<.Dv obj_id>, E<." "Dv obj_desc>, E<.Dv ext>, E<.Dv real>, E<.Dv enum>, E<.Dv embed>, E<.Dv " "utf8_str>, E<.Dv rel_oid>, E<.Dv time>, E<.Dv res2>, E<.Dv seq>, E<.Dv set>, " "E<.Dv num_str>, E<.Dv prt_str>, E<.Dv t61_str>, E<.Dv vid_str>, E<.Dv " "ia5_str>, E<.Dv utc_time>, E<.Dv gen_time>, E<.Dv gr_str>, E<.Dv vis_str>, " "E<.Dv gen_str>, E<.Dv univ_str>, E<.Dv char_str>, E<.Dv bmp_str>, E<.Dv " "date>, E<.Dv tod>, E<.Dv datetime>, E<.Dv duration>, E<.Dv oid-iri>, E<.Dv " "rel-oid-iri>. These types can be followed by an optional numeric size, " "which indicates the field width in bytes." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv guid" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A Globally Unique Identifier, parsed and printed as XXXXXXXX-XXXX-XXXX-XXXX-" "XXXXXXXXXXXX. It's format is a string." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "This is a quad value indicating the current offset of the file. It can be " "used to determine the size of the file or the magic buffer. For example the " "magic entries:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "" "-0\toffset\tx\tthis file is %lld bytes\n" "-0\toffset\tE=100\tmust be more than 100 \\e\n" " bytes and is only %lld\n" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv octal" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "A string representing an octal number." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "For compatibility with the Single E<.Ux> Standard, the type specifiers E<.Dv " "dC> and E<.Dv d1> are equivalent to E<.Dv byte>, the type specifiers E<.Dv " "uC> and E<.Dv u1> are equivalent to E<.Dv ubyte>, the type specifiers E<.Dv " "dS> and E<.Dv d2> are equivalent to E<.Dv short>, the type specifiers E<.Dv " "uS> and E<.Dv u2> are equivalent to E<.Dv ushort>, the type specifiers E<.Dv " "dI>, E<.Dv dL>, and E<.Dv d4> are equivalent to E<.Dv long>, the type " "specifiers E<.Dv uI>, E<.Dv uL>, and E<.Dv u4> are equivalent to E<.Dv " "ulong>, the type specifier E<.Dv d8> is equivalent to E<.Dv quad>, the type " "specifier E<.Dv u8> is equivalent to E<.Dv uquad>, and the type specifier E<." "Dv s> is equivalent to E<.Dv string>. In addition, the type specifier E<.Dv " "dQ> is equivalent to E<.Dv quad> and the type specifier E<.Dv uQ> is " "equivalent to E<.Dv uquad>." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Each top-level magic pattern (see below for an explanation of levels) is " "classified as text or binary according to the types used. Types E<.Dq " "regex> and E<.Dq search> are classified as text tests, unless non-printable " "characters are used in the pattern. All other tests are classified as " "binary. A top-level pattern is considered to be a test text when all its " "patterns are text patterns; otherwise, it is considered to be a binary " "pattern. When matching a file, binary patterns are tried first; if no match " "is found, and the file looks like text, then its encoding is determined and " "the text patterns are tried." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "The numeric types may optionally be followed by E<.Dv \\*[Am]> and a numeric " "value, to specify that the value is to be AND'ed with the numeric value " "before any comparisons are done. Prepending a E<.Dv u> to the type " "indicates that ordered comparisons should be unsigned." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv test" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "The value to be compared with the value from the file. If the type is " "numeric, this value is specified in C form; if it is a string, it is " "specified as a C string with the usual escapes permitted (e.g. \\en for new-" "line)." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Numeric values may be preceded by a character indicating the operation to be " "performed. It may be E<.Dv =>, to specify that the value from the file must " "equal the specified value, E<.Dv \\*[Lt]>, to specify that the value from " "the file must be less than the specified value, E<.Dv \\*[Gt]>, to specify " "that the value from the file must be greater than the specified value, E<.Dv " "\\*[Am]>, to specify that the value from the file must have set all of the " "bits that are set in the specified value, E<.Dv ^>, to specify that the " "value from the file must have clear any of the bits that are set in the " "specified value, or E<.Dv ~>, the value specified after is negated before " "tested. E<.Dv x>, to specify that any value will match. If the character " "is omitted, it is assumed to be E<.Dv =>. Operators E<.Dv \\*[Am]>, E<.Dv " "^>, and E<.Dv ~> don't work with floats and doubles. The operator E<.Dv !" "\\&> specifies that the line matches if the test does E<.Em not> succeed." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Numeric values are specified in C form; e.g. E<.Dv 13> is decimal, E<.Dv " "013> is octal, and E<.Dv 0x13> is hexadecimal." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Numeric operations are not performed on date types, instead the numeric " "value is interpreted as an offset." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "For string values, the string from the file must match the specified " "string. The operators E<.Dv =>, E<.Dv \\*[Lt]> and E<.Dv \\*[Gt]> (but not " "E<.Dv \\*[Am]>) can be applied to strings. The length used for matching is " "that of the string argument in the magic file. This means that a line can " "match any non-empty string (usually used to then print the string), with E<." "Em \\*[Gt]\\e0> (because all non-empty strings are greater than the empty " "string)." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Dates are treated as numerical values in the respective internal " "representation." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "The special test E<.Em x> always evaluates to true." msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Dv message" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "The message to be printed if the comparison succeeds. If the string " "contains a E<.Xr printf 3> format specification, the value from the file " "(with any specified masking performed) is printed using the message as the " "format string. If the string begins with E<.Dq \\eb>, the message printed " "is the remainder of the string with no whitespace added before it: multiple " "matches are normally separated by a single space." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "An APPLE 4+4 character APPLE creator and type can be specified as:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "!:apple\tCREATYPE\n" msgstr "" #. type: Plain text #: archlinux debian-unstable msgid "" "A slash-separated list of commonly found filename extensions can be " "specified as:" msgstr "" #. type: Plain text #: archlinux debian-unstable #, no-wrap msgid "!:ext\text[/ext...]\n" msgstr "" #. type: Plain text #: archlinux debian-unstable msgid "" "i.e. the literal string E<.Dq !:ext> followed by a slash-separated list of " "commonly found extensions; for example for JPEG images:" msgstr "" #. type: Plain text #: archlinux debian-unstable #, no-wrap msgid "!:ext jpeg/jpg/jpe/jfif\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "A MIME type is given on a separate line, which must be the next non-blank or " "comment line after the magic line that identifies the file type, and has the " "following format:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "!:mime\tMIMETYPE\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "i.e. the literal string E<.Dq !:mime> followed by the MIME type." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "An optional strength can be supplied on a separate line which refers to the " "current magic description using the following format:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "!:strength OP VALUE\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "The operand E<.Dv OP> can be: E<.Dv +>, E<.Dv ->, E<.Dv *>, or E<.Dv /> and " "E<.Dv VALUE> is a constant between 0 and 255. This constant is applied " "using the specified operand to the currently computed default magic strength." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Some file formats contain additional information which is to be printed " "along with the file type or need additional tests to determine the true file " "type. These additional tests are introduced by one or more E<.Em \\*[Gt]> " "characters preceding the offset. The number of E<.Em \\*[Gt]> on the line " "indicates the level of the test; a line with no E<.Em \\*[Gt]> at the " "beginning is considered to be at level 0. Tests are arranged in a tree-like " "hierarchy: if the test on a line at level E<.Em n> succeeds, all following " "tests at level E<.Em n+1> are performed, and the messages printed if the " "tests succeed, until a line with level E<.Em n> (or less) appears. For more " "complex files, one can use empty messages to get just the \"if/then\" " "effect, in the following way:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "" "0 string MZ\n" "\\*[Gt]0x18 leshort \\*[Lt]0x40 MS-DOS executable\n" "\\*[Gt]0x18 leshort \\*[Gt]0x3f extended PC executable (e.g., MS Windows)\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Offsets do not need to be constant, but can also be read from the file being " "examined. If the first character following the last E<.Em \\*[Gt]> is a E<." "Em \\&(> then the string after the parenthesis is interpreted as an indirect " "offset. That means that the number after the parenthesis is used as an " "offset in the file. The value at that offset is read, and is used again as " "an offset in the file. Indirect offsets are of the form: E<.Em (( x [[.,]" "[bBcCeEfFgGhHiIlmsSqQ]][+\\-][ y ])>. The value of E<.Em x> is used as an " "offset in the file. A byte, id3 length, short or long is read at that " "offset depending on the E<.Em [bBcCeEfFgGhHiIlmsSqQ]> type specifier. The " "value is treated as signed if E<.Dq>, is specified or unsigned if E<.Dq>. " "is specified. The capitalized types interpret the number as a big endian " "value, whereas the small letter versions interpret the number as a little " "endian value; the E<.Em m> type interprets the number as a middle endian " "(PDP-11) value. To that number the value of E<.Em y> is added and the " "result is used as an offset in the file. The default type if one is not " "specified is long. The following types are recognized:" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Sy \"Type\tSy\" \"Mnemonic\tSy\" \"Endian\tSy\" Size" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "bcBc\tByte/Char\tN/A\t1" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "efg\tDouble\tLittle\t8" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "EFG\tDouble\tBig\t8" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "hs\tHalf/Short\tLittle\t2" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "HS\tHalf/Short\tBig\t2" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "i\tID3\tLittle\t4" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "I\tID3\tBig\t4" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "m\tMiddle\tMiddle\t4" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "o\tOctal\tTextual\tVariable" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "q\tQuad\tLittle\t8" msgstr "" #. type: It #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "Q\tQuad\tBig\t8" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "That way variable length structures can be examined:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "" "# MS Windows executables are also valid MS-DOS executables\n" "0 string MZ\n" "\\*[Gt]0x18 leshort \\*[Lt]0x40 MZ executable (MS-DOS)\n" "# skip the whole block below if it is not an extended executable\n" "\\*[Gt]0x18 leshort \\*[Gt]0x3f\n" "\\*[Gt]\\*[Gt](0x3c.l) string PE\\e0\\e0 PE executable (MS-Windows)\n" "\\*[Gt]\\*[Gt](0x3c.l) string LX\\e0\\e0 LX executable (OS/2)\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "This strategy of examining has a drawback: you must make sure that you " "eventually print something, or users may get empty output (such as when " "there is neither PE\\e0\\e0 nor LE\\e0\\e0 in the above example)." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "If this indirect offset cannot be used directly, simple calculations are " "possible: appending E<.Em [+-*/%\\*[Am]|^]number> inside parentheses allows " "one to modify the value read from the file before it is used as an offset:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "" "# MS Windows executables are also valid MS-DOS executables\n" "0 string MZ\n" "# sometimes, the value at 0x18 is less that 0x40 but there's still an\n" "# extended executable, simply appended to the file\n" "\\*[Gt]0x18 leshort \\*[Lt]0x40\n" "\\*[Gt]\\*[Gt](4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP)\n" "\\*[Gt]\\*[Gt](4.s*512) leshort !0x014c MZ executable (MS-DOS)\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "Sometimes you do not know the exact offset as this depends on the length or " "position (when indirection was used before) of preceding fields. You can " "specify an offset relative to the end of the last up-level field using E<.Sq " "\\*[Am]> as a prefix to the offset:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "" "0 string MZ\n" "\\*[Gt]0x18 leshort \\*[Gt]0x3f\n" "\\*[Gt]\\*[Gt](0x3c.l) string PE\\e0\\e0 PE executable (MS-Windows)\n" "# immediately following the PE signature is the CPU type\n" "\\*[Gt]\\*[Gt]\\*[Gt]\\*[Am]0 leshort 0x14c for Intel 80386\n" "\\*[Gt]\\*[Gt]\\*[Gt]\\*[Am]0 leshort 0x184 for DEC Alpha\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "Indirect and relative offsets can be combined:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "" "0 string MZ\n" "\\*[Gt]0x18 leshort \\*[Lt]0x40\n" "\\*[Gt]\\*[Gt](4.s*512) leshort !0x014c MZ executable (MS-DOS)\n" "# if it's not COFF, go back 512 bytes and add the offset taken\n" "# from byte 2/3, which is yet another way of finding the start\n" "# of the extended executable\n" "\\*[Gt]\\*[Gt]\\*[Gt]\\*[Am](2.s-514) string LE LE executable (MS Windows VxD driver)\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "Or the other way around:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "" "0 string MZ\n" "\\*[Gt]0x18 leshort \\*[Gt]0x3f\n" "\\*[Gt]\\*[Gt](0x3c.l) string LE\\e0\\e0 LE executable (MS-Windows)\n" "# at offset 0x80 (-4, since relative offsets start at the end\n" "# of the up-level match) inside the LE header, we find the absolute\n" "# offset to the code area, where we look for a specific signature\n" "\\*[Gt]\\*[Gt]\\*[Gt](\\*[Am]0x7c.l+0x26) string UPX \\eb, UPX compressed\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "Or even both!" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "" "0 string MZ\n" "\\*[Gt]0x18 leshort \\*[Gt]0x3f\n" "\\*[Gt]\\*[Gt](0x3c.l) string LE\\e0\\e0 LE executable (MS-Windows)\n" "# at offset 0x58 inside the LE header, we find the relative offset\n" "# to a data area where we look for a specific signature\n" "\\*[Gt]\\*[Gt]\\*[Gt]\\*[Am](\\*[Am]0x54.l-3) string UNACE \\eb, ACE self-extracting archive\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "If you have to deal with offset/length pairs in your file, even the second " "value in a parenthesized expression can be taken from the file itself, using " "another set of parentheses. Note that this additional indirect offset is " "always relative to the start of the main indirect offset." msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "" "0 string MZ\n" "\\*[Gt]0x18 leshort \\*[Gt]0x3f\n" "\\*[Gt]\\*[Gt](0x3c.l) string PE\\e0\\e0 PE executable (MS-Windows)\n" "# search for the PE section called \".idata\"...\n" "\\*[Gt]\\*[Gt]\\*[Gt]\\*[Am]0xf4 search/0x140 .idata\n" "# ...and go to the end of it, calculated from start+length;\n" "# these are located 14 and 10 bytes after the section name\n" "\\*[Gt]\\*[Gt]\\*[Gt]\\*[Gt](\\*[Am]0xe.l+(-4)) string PK\\e3\\e4 \\eb, ZIP self-extracting archive\n" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "If you have a list of known values at a particular continuation level, and " "you want to provide a switch-like default case:" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "" "# clear that continuation level match\n" "\\*[Gt]18\tclear\n" "\\*[Gt]18\tlelong\t1\tone\n" "\\*[Gt]18\tlelong\t2\ttwo\n" "\\*[Gt]18\tdefault\tx\n" "# print default match\n" "\\*[Gt]\\*[Gt]18\tlelong\tx\tunmatched 0x%x\n" msgstr "" #. type: Sh #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "SEE ALSO" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "E<.Xr file 1> \\- the command that reads this file." msgstr "" #. type: Sh #: archlinux debian-bookworm debian-unstable #, no-wrap msgid "BUGS" msgstr "" #. type: Plain text #: archlinux debian-bookworm debian-unstable msgid "" "The formats E<.Dv long>, E<.Dv belong>, E<.Dv lelong>, E<.Dv melong>, E<.Dv " "short>, E<.Dv beshort>, and E<.Dv leshort> do not depend on the length of " "the C data types E<.Dv short> and E<.Dv long> on the platform, even though " "the Single E<.Ux> Specification implies that they do. However, as OS X " "Mountain Lion has passed the Single E<.Ux> Specification validation suite, " "and supplies a version of E<.Xr file 1> in which they do not depend on the " "sizes of the C data types and that is built for a 64-bit environment in " "which E<.Dv long> is 8 bytes rather than 4 bytes, presumably the validation " "suite does not test whether, for example E<.Dv long> refers to an item with " "the same size as the C data type E<.Dv long>. There should probably be E<." "Dv type> names E<.Dv int8>, E<.Dv uint8>, E<.Dv int16>, E<.Dv uint16>, E<.Dv " "int32>, E<.Dv uint32>, E<.Dv int64>, and E<.Dv uint64>, and specified-byte-" "order variants of them, to make it clearer that those types have specified " "widths." msgstr "" #. type: Dd #: debian-bookworm #, no-wrap msgid "October 9, 2022" msgstr "" #. type: Plain text #: debian-bookworm msgid "" "This manual page documents the format of magic files as used by the E<.Xr " "file 1> command, version 5.44. The E<.Xr file 1> command identifies the " "type of a file using, among other tests, a test for whether the file " "contains certain E<.Dq \"magic patterns\">. The database of these E<.Dq " "\"magic patterns\"> is usually located in a binary file in E<.Pa /usr/share/" "misc/magic.mgc> or a directory of source text magic pattern fragment files " "in E<.Pa /usr/share/misc/magic>. The database specifies what patterns are " "to be tested for, what message or MIME type to print if a particular pattern " "is found, and additional information to extract from the file." msgstr "" #. type: Plain text #: debian-unstable msgid "" "This manual page documents the format of magic files as used by the E<.Xr " "file 1> command, version 5.45. The E<.Xr file 1> command identifies the " "type of a file using, among other tests, a test for whether the file " "contains certain E<.Dq \"magic patterns\">. The database of these E<.Dq " "\"magic patterns\"> is usually located in a binary file in E<.Pa /usr/share/" "misc/magic.mgc> or a directory of source text magic pattern fragment files " "in E<.Pa /usr/share/misc/magic>. The database specifies what patterns are " "to be tested for, what message or MIME type to print if a particular pattern " "is found, and additional information to extract from the file." msgstr ""