magic(5)

NAME

magic − magic file for the file command

SYNTAX

/usr/lib/file/magic

DESCRIPTION

The magic file is used by the file command to identify files that have some sort of magic number. A magic number is any numeric or string constant that identifies the file containing the constant.

The magic file is formatted as follows:

Byte offset
The byte offset is where magic information is found in the file. This is the number of bytes from the beginning of the file to the first byte of the magic number or string. This may, optionally, be preceded by a ’>’ to indicate a continuation line to supply extra information in the printed message.

Value type
The value type is the type of the information to be found at the specified byte offset. The file data is interpreted as the following valid types:

byte     unsigned char type.
short    unsigned short type.
long     long type.
string   character (byte) string

Optional operator
Describes how the value specified here should be compared with the data at the desired offset. Valid operator characters are: =, >, and <. If none is specified, = is assumed.

ValueThe value to match. Numeric values may be decimal, octal, or hex. Strings values are defined as regular expressions here. The regular expressions used here are extended in two ways from regular expression definition in ed(1).

1.Normally unprintable characters may be escaped with ’\’. The special characters \n, \b, \r, and \f are allowed. An octal representation can also be used to insert any desired byte value (except 0). Normally, regular expression can not handle such character values. Because the backslash is used as an escape character while the regular expression is being read in, normal occurances of a backslash in a regular expression must be escaped with a second backslash. As an example, \( must be written as \\( and \. must be written as \\.

2.Text found in a file can also be inserted in the printed string with the use of the \\% delimiter. All text found between these delimiters is substituted into the print string.

NOTE: This regular expression search never terminates until a match is explicitly found or rejected. \n is a valid character in the patterns. Therefore, the pattern .* should never be used here.

major, minor type
The major and minor file type numbers are not used by the file(1) command. They will be used in a future release of Ultrix. Any small integers may be put in this field.

String to print
Any desired text string. Data from the file may be included with the use of continuation lines beginning with a ’>’. Two types of continuation lines are possible, depending on the sign of the byte offset entry.

If the byte offset is positive, the specified data may be printed in the string when requested with an appropriate printf() format.

If the offset is a negative number, an internal routine will be called to test if a particular string is necessary and if so, to return it.

The byte offset number is an index to an internal table of routines available for use. Two such routines are currently defined, both for a.out images:

Byte offset String(s) returned by routine if appropriate

-1: ["old version 7 style symbol table"]
-2: ["setuid "]["setgid "]["sticky "]

EXAMPLES

The following is an example of a script. The second line adds setuid, setgid text, if appropriate.

0 string ^#![ ]*\%[^ 0*\% 7,4 %s
>-2 long 0 7,4 %sscript

The following is an example of an executable image.

>-1 long     0                    12,3   %s
0    short    0413                 12,4   demand paged pure
>2   short    02                   12,4   POSIX
>2   short    01                   12,4   SVID
>-2 long     0                    12,4   %sexecutable
>16 long     >0                   12,4   not stripped

The following is an example of a text file.

0 string ^ 1h[0-9][0-9][0-9][0-9][0-9] 7,1 sccsfile

FILES