
#------------------Standard file formats------------------------------------

#------------------------------------------------------------------------------
# elf:  file(1) magic for ELF executables
#
# We have to check the byte order flag to see what byte order all the
# other stuff in the header is in.
#
# What're the correct byte orders for the nCUBE and the Fujitsu VPP500?
#
# updated by Daniel Quinlan (quinlan@yggdrasil.com)
0	string		\177ELF		ELF
>4	byte		0		invalid class
>4	byte		1		32-bit
# only for MIPS - in the future, the ABI field of e_flags should be used.
>>18	leshort		8
>>>36	lelong		&0x20		N32
>>18	leshort		10
>>>36	lelong		&0x20		N32
>>18	beshort		8
>>>36	belong		&0x20		N32
>>18	beshort		10
>>>36	belong		&0x20		N32
>4	byte		2		64-bit
>5	byte		0		invalid byte order
>5	byte		1		LSB
# The official e_machine number for MIPS is now #8, regardless of endianness.
# The second number (#10) will be deprecated later. For now, we still
# say something if #10 is encountered, but only gory details for #8.
>>18    leshort		8
# only for 32-bit
>>>4	byte		1
>>>>36  lelong&0xf0000000	0x00000000	MIPS-I
>>>>36  lelong&0xf0000000	0x10000000	MIPS-II
>>>>36  lelong&0xf0000000	0x20000000	MIPS-III
>>>>36  lelong&0xf0000000	0x30000000	MIPS-IV
>>>>36  lelong&0xf0000000	0x40000000	MIPS-V
>>>>36  lelong&0xf0000000	0x60000000	MIPS32
>>>>36  lelong&0xf0000000	0x70000000	MIPS64
>>>>36  lelong&0xf0000000	0x80000000	MIPS32 rel2
>>>>36  lelong&0xf0000000	0x90000000	MIPS64 rel2
# only for 64-bit
>>>4	byte		2
>>>>48  lelong&0xf0000000	0x00000000	MIPS-I
>>>>48  lelong&0xf0000000	0x10000000	MIPS-II
>>>>48  lelong&0xf0000000	0x20000000	MIPS-III
>>>>48  lelong&0xf0000000	0x30000000	MIPS-IV
>>>>48  lelong&0xf0000000	0x40000000	MIPS-V
>>>>48  lelong&0xf0000000	0x60000000	MIPS32
>>>>48  lelong&0xf0000000	0x70000000	MIPS64 
>>>>48  lelong&0xf0000000	0x80000000	MIPS32 rel2
>>>>48  lelong&0xf0000000	0x90000000	MIPS64 rel2
>>16	leshort		0		no file type,
>>16	leshort		1		relocatable,
>>16	leshort		2		executable,
>>16	leshort		3		shared object,
# Core handling from Peter Tobias <tobias@server.et-inf.fho-emden.de>
# corrections by Christian 'Dr. Disk' Hechelmann <drdisk@ds9.au.s.shuttle.de>
>>16	leshort		4		core file
# Core file detection is not reliable.
#>>>(0x38+0xcc) string	>\0		of '%s'
#>>>(0x38+0x10) lelong	>0		(signal %d),
>>16	leshort		&0xff00		processor-specific,
>>18	leshort		0		no machine,
>>18	leshort		1		AT&T WE32100 - invalid byte order,
>>18	leshort		2		SPARC - invalid byte order,
>>18	leshort		3		Intel 80386,
>>18	leshort		4		Motorola
>>>36	lelong		&0x01000000	68000 - invalid byte order,
>>>36	lelong		&0x00810000	CPU32 - invalid byte order,
>>>36	lelong		0		68020 - invalid byte order,
>>18	leshort		5		Motorola 88000 - invalid byte order,
>>18	leshort		6		Intel 80486,
>>18	leshort		7		Intel 80860,
>>18	leshort		8		MIPS,
>>18	leshort		9		Amdahl - invalid byte order,
>>18	leshort		10		MIPS (deprecated),
>>18	leshort		11		RS6000 - invalid byte order,
>>18	leshort		15		PA-RISC - invalid byte order,
>>>50	leshort		0x0214		2.0
>>>48	leshort		&0x0008		(LP64),
>>18	leshort		16		nCUBE,
>>18	leshort		17		Fujitsu VPP500,
>>18	leshort		18		SPARC32PLUS,
>>18	leshort		20		PowerPC,
>>18	leshort		22		IBM S/390,
>>18	leshort		36		NEC V800,
>>18	leshort		37		Fujitsu FR20,
>>18	leshort		38		TRW RH-32,
>>18	leshort		39		Motorola RCE,
>>18	leshort		40		ARM,
>>18	leshort		41		Alpha,
>>18	leshort		0xa390		IBM S/390 (obsolete),
>>18	leshort		42		Hitachi SH,
>>18	leshort		43		SPARC V9 - invalid byte order,
>>18	leshort		44		Siemens Tricore Embedded Processor,
>>18	leshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
>>18	leshort		46		Hitachi H8/300,
>>18	leshort		47		Hitachi H8/300H,
>>18	leshort		48		Hitachi H8S,
>>18	leshort		49		Hitachi H8/500,
>>18	leshort		50		IA-64 (Intel 64 bit architecture)
>>18	leshort		51		Stanford MIPS-X,
>>18	leshort		52		Motorola Coldfire,
>>18	leshort		53		Motorola M68HC12,
>>18	leshort		62		AMD x86-64,
>>18	leshort		75		Digital VAX,
>>18	leshort		97		NatSemi 32k,
>>18	leshort		0x9026		Alpha (unofficial),
>>20	lelong		0		invalid version
>>20	lelong		1		version 1
>>36	lelong		1		MathCoPro/FPU/MAU Required
>5	byte		2		MSB
# only for MIPS - see comment in little-endian section above.
>>18    beshort		8
# only for 32-bit
>>>4	byte		1
>>>>36  belong&0xf0000000	0x00000000	MIPS-I
>>>>36  belong&0xf0000000	0x10000000	MIPS-II
>>>>36  belong&0xf0000000	0x20000000	MIPS-III
>>>>36  belong&0xf0000000	0x30000000	MIPS-IV
>>>>36  belong&0xf0000000	0x40000000	MIPS-V
>>>>36  belong&0xf0000000	0x60000000	MIPS32
>>>>36  belong&0xf0000000	0x70000000	MIPS64
>>>>36  belong&0xf0000000	0x80000000	MIPS32 rel2
>>>>36  belong&0xf0000000	0x90000000	MIPS64 rel2
# only for 64-bit
>>>4	byte		2
>>>>48	belong&0xf0000000	0x00000000	MIPS-I
>>>>48	belong&0xf0000000	0x10000000	MIPS-II
>>>>48	belong&0xf0000000	0x20000000	MIPS-III
>>>>48	belong&0xf0000000	0x30000000	MIPS-IV
>>>>48	belong&0xf0000000	0x40000000	MIPS-V
>>>>48	belong&0xf0000000	0x60000000	MIPS32
>>>>48	belong&0xf0000000	0x70000000	MIPS64 
>>>>48	belong&0xf0000000	0x80000000	MIPS32 rel2
>>>>48	belong&0xf0000000	0x90000000	MIPS64 rel2
>>16	beshort		0		no file type,
>>16	beshort		1		relocatable,
>>16	beshort		2		executable,
>>16	beshort		3		shared object,
>>16	beshort		4		core file,
#>>>(0x38+0xcc) string	>\0		of '%s'
#>>>(0x38+0x10) belong	>0		(signal %d),
>>16	beshort		&0xff00		processor-specific,
>>18	beshort		0		no machine,
>>18	beshort		1		AT&T WE32100,
>>18	beshort		2		SPARC,
>>18	beshort		3		Intel 80386 - invalid byte order,
>>18	beshort		4		Motorola
>>>36	belong		&0x01000000	68000,
>>>36	belong		&0x00810000	CPU32,
>>>36	belong		0		68020,
>>18	beshort		5		Motorola 88000,
>>18	beshort		6		Intel 80486 - invalid byte order,
>>18	beshort		7		Intel 80860,
>>18	beshort		8		MIPS,
>>18	beshort		9		Amdahl,
>>18	beshort		10		MIPS (deprecated),
>>18	beshort		11		RS6000,
>>18	beshort		15		PA-RISC
>>>50	beshort		0x0214		2.0
>>>48	beshort		&0x0008		(LP64)
>>18	beshort		16		nCUBE,
>>18	beshort		17		Fujitsu VPP500,
>>18	beshort		18		SPARC32PLUS,
>>>36	belong&0xffff00	&0x000100	V8+ Required,
>>>36	belong&0xffff00	&0x000200	Sun UltraSPARC1 Extensions Required,
>>>36	belong&0xffff00	&0x000400	HaL R1 Extensions Required,
>>>36	belong&0xffff00	&0x000800	Sun UltraSPARC3 Extensions Required,
>>18	beshort		20		PowerPC or cisco 4500,
>>18	beshort		21		cisco 7500,
>>18	beshort		22		IBM S/390,
>>18	beshort		24		cisco SVIP,
>>18	beshort		25		cisco 7200,
>>18	beshort		36		NEC V800 or cisco 12000,
>>18	beshort		37		Fujitsu FR20,
>>18	beshort		38		TRW RH-32,
>>18	beshort		39		Motorola RCE,
>>18	beshort		40		ARM,
>>18	beshort		41		Alpha,
>>18	beshort		42		Hitachi SH,
>>18	beshort		43		SPARC V9,
>>18	beshort		44		Siemens Tricore Embedded Processor,
>>18	beshort		45		Argonaut RISC Core, Argonaut Technologies Inc.,
>>18	beshort		46		Hitachi H8/300,
>>18	beshort		47		Hitachi H8/300H,
>>18	beshort		48		Hitachi H8S,
>>18	beshort		49		Hitachi H8/500,
>>18	beshort		50		Intel Merced Processor,
>>18	beshort		51		Stanford MIPS-X,
>>18	beshort		52		Motorola Coldfire,
>>18	beshort		53		Motorola M68HC12,
>>18	beshort		73		Cray NV1,
>>18	beshort		75		Digital VAX,
>>18	beshort		97		NatSemi 32k,
>>18	beshort		0x9026		Alpha (unofficial),
>>18	beshort		0xa390		IBM S/390 (obsolete),
>>18    beshort         0xde3d          Ubicom32,
>>20	belong		0		invalid version
>>20	belong		1		version 1
>>36	belong		1		MathCoPro/FPU/MAU Required
# Up to now only 0, 1 and 2 are defined; I've seen a file with 0x83, it seemed
# like proper ELF, but extracting the string had bad results.
>4      byte            <0x80
>>8	string		>\0		("%s")
>8	string		\0
>>7	byte		0		(SYSV)
>>7	byte		1		(HP-UX)
>>7	byte		2		(NetBSD)
>>7	byte		3		(GNU/Linux)
>>7	byte		4		(GNU/Hurd)
>>7	byte		5		(86Open)
>>7	byte		6		(Solaris)
>>7	byte		7		(Monterey)
>>7	byte		8		(IRIX)
>>7	byte		9		(FreeBSD)
>>7	byte		10		(Tru64)
>>7	byte		11		(Novell Modesto)
>>7	byte		12		(OpenBSD)
>>7	byte		97		(ARM)
>>7	byte		255		(embedded)

# XXX - according to Microsoft's spec, at an offset of 0x3c in a
# PE-format executable is the offset in the file of the PE header;
# unfortunately, that's a little-endian offset, and there's no way
# to specify an indirect offset with a specified byte order.
# So, for now, we assume the standard MS-DOS stub, which puts the
# PE header at 0x80 = 128.
#
# Required OS version and subsystem version were 4.0 on some NT 3.51
# executables built with Visual C++ 4.0, so it's not clear that
# they're interesting.  The user version was 0.0, but there's
# probably some linker directive to set it.  The linker version was
# 3.0, except for one ".exe" which had it as 4.20 (same damn linker!).
#
# many of the compressed formats were extraced from IDARC 1.23 source code
#
0       string  MZ	Microsoft
>0x18  leshort <0x40 MS-DOS executable
>0 string MZ\0\0\0\0\0\0\0\0\0\0PE\0\0 \b, PE for MS Windows
>>&18   leshort&0x2000  >0      (DLL)
>>&88   leshort         0       (unknown subsystem)
>>&88   leshort         1       (native)
>>&88   leshort         2       (GUI)
>>&88   leshort         3       (console)
>>&88   leshort         7       (POSIX)
>>&0    leshort         0x0     unknown processor
>>&0    leshort         0x14c   Intel 80386
>>&0    leshort         0x166   MIPS R4000
>>&0    leshort         0x184   Alpha
>>&0    leshort         0x268   Motorola 68000
>>&0    leshort         0x1f0   PowerPC
>>&0    leshort         0x290   PA-RISC
>>&18   leshort&0x0100  >0      32-bit
>>&18   leshort&0x1000  >0      system file
>>&228  lelong          >0      \b, Mono/.Net assembly
>>&0xf4 search/0x140 \x0\x40\x1\x0
>>>(&0.l+(4)) string MSCF \b, WinHKI CAB self-extracting archive
>30             string  Copyright\x201989-1990\x20PKWARE\x20Inc.      Self-extracting PKZIP archive
# Is next line correct? One might expect "Corp." not "Copr." If it is right, add a note to that effect.
>30             string  PKLITE\x20Copr.   Self-extracting PKZIP archive

>0x18  leshort >0x3f
>>(0x3c.l) string PE\0\0 PE
>>>(0x3c.l+25) byte             1 \b32 executable
>>>(0x3c.l+25) byte             2 \b32+ executable
# hooray, there's a DOS extender using the PE format, with a valid PE
# executable inside (which just prints a message and exits if run in win)
>>>(0x3c.l+92)  leshort         <10
>>>>(8.s*16) string 32STUB for MS-DOS, 32rtm DOS extender
>>>>(8.s*16) string !32STUB for MS Windows
>>>>>(0x3c.l+22)        leshort&0x2000  >0      (DLL)
>>>>>(0x3c.l+92)        leshort         0       (unknown subsystem)
>>>>>(0x3c.l+92)        leshort         1       (native)
>>>>>(0x3c.l+92)        leshort         2       (GUI)
>>>>>(0x3c.l+92)        leshort         3       (console)
>>>>>(0x3c.l+92)        leshort         7       (POSIX)
>>>(0x3c.l+92)  leshort         10      (EFI application)
>>>(0x3c.l+92)  leshort         11      (EFI boot service driver)
>>>(0x3c.l+92)  leshort         12      (EFI runtime driver)
>>>(0x3c.l+92)  leshort         13      (XBOX)
>>>(0x3c.l+4)   leshort         0x0     unknown processor
>>>(0x3c.l+4)   leshort         0x14c   Intel 80386
>>>(0x3c.l+4)   leshort         0x166   MIPS R4000
>>>(0x3c.l+4)   leshort         0x184   Alpha
>>>(0x3c.l+4)   leshort         0x268   Motorola 68000
>>>(0x3c.l+4)   leshort         0x1f0   PowerPC
>>>(0x3c.l+4)   leshort         0x290   PA-RISC
>>>(0x3c.l+4)   leshort         0x200   Intel Itanium
>>>(0x3c.l+22)  leshort&0x0100  >0      32-bit
>>>(0x3c.l+22)  leshort&0x1000  >0      system file
>>>(0x3c.l+232) lelong  >0      Mono/.Net assembly
>>>>(0x3c.l+0xf8)       string          UPX0 \b, UPX compressed
>>>>(0x3c.l+0xf8)       search/0x140    PEC2 \b, PECompact2 compressed
>>>>(0x3c.l+0xf8)       search/0x140    UPX2
>>>>>(&0x10.l+(-4))     string          PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
>>>>(0x3c.l+0xf8)       search/0x140    .idata
>>>>>(&0xe.l+(-4))      string          PK\3\4 \b, ZIP self-extracting archive (Info-Zip)
>>>>>(&0xe.l+(-4))      string          ZZ0 \b, ZZip self-extracting archive
>>>>>(&0xe.l+(-4))      string          ZZ1 \b, ZZip self-extracting archive
>>>>(0x3c.l+0xf8)       search/0x140    .rsrc
>>>>>(&0x0f.l+(-4))     string          a\\\4\5 \b, WinHKI self-extracting archive
>>>>>(&0x0f.l+(-4))     string          Rar! \b, RAR self-extracting archive
>>>>>(&0x0f.l+(-4))     search/0x3000   MSCF \b, InstallShield self-extracting archive
>>>>>(&0x0f.l+(-4))     search/32       Nullsoft \b, Nullsoft Installer self-extracting archive
>>>>(0x3c.l+0xf8)       search/0x140    .data
>>>>>(&0x0f.l)          string          WEXTRACT \b, MS CAB-Installer self-extracting archive
>>>>(0x3c.l+0xf8)       search/0x140    .petite\0 \b, Petite compressed
>>>>>(0x3c.l+0xf7)      byte            x
>>>>>>(&0x104.l+(-4))   string          =!sfx! \b, ACE self-extracting archive
>>>>(0x3c.l+0xf8)       search/0x140    .WISE \b, WISE installer self-extracting archive
>>>>(0x3c.l+0xf8)       search/0x140    .dz\0\0\0 \b, Dzip self-extracting archive
>>>>(0x3c.l+0xf8)       search/0x140    .reloc
>>>>>(&0xe.l+(-4))      search/0x180    PK\3\4 \b, ZIP self-extracting archive (WinZip)

>>>>&(0x3c.l+0xf8)      search/0x100    _winzip_ \b, ZIP self-extracting archive (WinZip)
>>>>&(0x3c.l+0xf8)      search/0x100    SharedD \b, Microsoft Installer self-extracting archive
>>>>0x30                string          Inno \b, InnoSetup self-extracting archive

>>(0x3c.l) string !PE\0\0 MS-DOS executable

>>(0x3c.l)              string          NE \b, NE
>>>(0x3c.l+0x36)        byte            0 (unknown OS)
>>>(0x3c.l+0x36)        byte            1 for OS/2 1.x
>>>(0x3c.l+0x36)        byte            2 for MS Windows 3.x
>>>(0x3c.l+0x36)        byte            3 for MS-DOS
>>>(0x3c.l+0x36)        byte            >3 (unknown OS)
>>>(0x3c.l+0x36)        byte            0x81 for MS-DOS, Phar Lap DOS extender
>>>(0x3c.l+0x0c)        leshort&0x8003  0x8002 (DLL)
>>>(0x3c.l+0x0c)        leshort&0x8003  0x8001 (driver)
>>>&(&0x24.s-1)         string          ARJSFX \b, ARJ self-extracting archive
>>>(0x3c.l+0x70)        search/0x80     WinZip(R)\x20Self-Extractor \b, ZIP self-extracting archive (WinZip)

>>(0x3c.l)              string          LX\0\0 \b, LX
>>>(0x3c.l+0x0a)        leshort         <1 (unknown OS)
>>>(0x3c.l+0x0a)        leshort         1 for OS/2
>>>(0x3c.l+0x0a)        leshort         2 for MS Windows
>>>(0x3c.l+0x0a)        leshort         3 for DOS
>>>(0x3c.l+0x0a)        leshort         >3 (unknown OS)
>>>(0x3c.l+0x10)        lelong&0x28000  =0x8000 (DLL)
>>>(0x3c.l+0x10)        lelong&0x20000  >0 (device driver)
>>>(0x3c.l+0x10)        lelong&0x300    0x300 (GUI)
>>>(0x3c.l+0x10)        lelong&0x28300  <0x300 (console)
>>>(0x3c.l+0x08)        leshort         1 i80286
>>>(0x3c.l+0x08)        leshort         2 i80386
>>>(0x3c.l+0x08)        leshort         3 i80486
>>>(8.s*16)             string          emx \b, emx
>>>>&1                  string          x "%s"
>>>&(&0x54.l-3)         string          arjsfx \b, ARJ self-extracting archive



#------------------------------------------------------------------------------
# bFLT: file(1) magic for BFLT uclinux binary files
#
# From Philippe De Muyter <phdm@macqel.be>
# 
# Additional fields added by Craig Heffner
#
0       string          bFLT            BFLT executable 
>4      belong          x               version %ld, 
>4      belong          4
>8	belong		x		code offset: 0x%.8X, 
>12	belong		x		data segment starts at: 0x%.8X, 
>16	belong		x		bss segment starts at: 0x%.8X, 
>20	belong		x		bss segment ends at: 0x%.8X, 
>24	belong		x		stack size: %d bytes, 
>28	belong 		x		relocation records start at: 0x%.8X, 
>32	belong		x		number of reolcation records: %d, 
>>36    belong&0x1      0x1             ram
>>36    belong&0x2      0x2             gotpic
>>36    belong&0x4      0x4             gzip
>>36    belong&0x8      0x8             gzdata


#-----------------------------------------------------------------
# MIPS COFF file formats
#
0       beshort 0x0160          MIPSEB ECOFF executable
>20     beshort 0407            (impure)
>20     beshort 0410            (swapped)
>20     beshort 0413            (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>22     byte    x               - version %ld
>23     byte    x               \b.%ld
#
0       beshort 0x0162          MIPSEL-BE ECOFF executable
>20     beshort 0407            (impure)
>20     beshort 0410            (swapped)
>20     beshort 0413            (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>23     byte    x               - version %d
>22     byte    x               \b.%ld
#
0       beshort 0x6001          MIPSEB-LE ECOFF executable
>20     beshort 03401           (impure)
>20     beshort 04001           (swapped)
>20     beshort 05401           (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>23     byte    x               - version %d
>22     byte    x               \b.%ld
#
0       beshort 0x6201          MIPSEL ECOFF executable
>20     beshort 03401           (impure)
>20     beshort 04001           (swapped)
>20     beshort 05401           (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>23     byte    x               - version %ld
>22     byte    x               \b.%ld
# MIPS 2 additions
#
0       beshort 0x0163          MIPSEB MIPS-II ECOFF executable
>20     beshort 0407            (impure)
>20     beshort 0410            (swapped)
>20     beshort 0413            (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>22     byte    x               - version %ld
>23     byte    x               \b.%ld
#
0       beshort 0x0166          MIPSEL-BE MIPS-II ECOFF executable
>20     beshort 0407            (impure)
>20     beshort 0410            (swapped)
>20     beshort 0413            (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>22     byte    x               - version %ld
>23     byte    x               \b.%ld
#
0       beshort 0x6301          MIPSEB-LE MIPS-II ECOFF executable
>20     beshort 03401           (impure)
>20     beshort 04001           (swapped)
>20     beshort 05401           (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>23     byte    x               - version %ld
>22     byte    x               \b.%ld
#
0       beshort 0x6601          MIPSEL MIPS-II ECOFF executable
>20     beshort 03401           (impure)
>20     beshort 04001           (swapped)
>20     beshort 05401           (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>23     byte    x               - version %ld
>22     byte    x               \b.%ld
# MIPS 3 additions
#
0       beshort 0x0140          MIPSEB MIPS-III ECOFF executable
>20     beshort 0407            (impure)
>20     beshort 0410            (swapped)
>20     beshort 0413            (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>22     byte    x               - version %ld
>23     byte    x               \b.%ld
#
0       beshort 0x0142          MIPSEL-BE MIPS-III ECOFF executable
>20     beshort 0407            (impure)
>20     beshort 0410            (swapped)
>20     beshort 0413            (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>22     byte    x               - version %ld
>23     byte    x               \b.%ld
#
0       beshort 0x4001          MIPSEB-LE MIPS-III ECOFF executable
>20     beshort 03401           (impure)
>20     beshort 04001           (swapped)
>20     beshort 05401           (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>23     byte    x               - version %ld
>22     byte    x               \b.%ld
#
0       beshort 0x4201          MIPSEL MIPS-III ECOFF executable
>20     beshort 03401           (impure)
>20     beshort 04001           (swapped)
>20     beshort 05401           (paged)
>8      belong  >0              not stripped
>8      belong  0               stripped
>23     byte    x               - version %ld
>22     byte    x               \b.%ld
#
0       beshort 0x180           MIPSEB Ucode
0       beshort 0x182           MIPSEL-BE Ucode


# Windows CE package files
0       string          MSCE\0\0\0\0    Microsoft WinCE installer
>20     lelong          0               \b, architecture-independent
>20     lelong          103             \b, Hitachi SH3
>20     lelong          104             \b, Hitachi SH4
>20     lelong          0xA11           \b, StrongARM
>20     lelong          4000            \b, MIPS R4000
>20     lelong          10003           \b, Hitachi SH3
>20     lelong          10004           \b, Hitachi SH3E
>20     lelong          10005           \b, Hitachi SH4
>20     lelong          70001           \b, ARM 7TDMI
>52     leshort         1               \b, 1 file
>52     leshort         >1              \b, %u files
>56     leshort         1               \b, 1 registry entry
>56     leshort         >1              \b, %u registry entries

#------------------------------------------------------------------------------
# Microsoft Xbox executables .xbe (Esa HyytiÃ¤ <ehyytia@cc.hut.fi>)
0       string          XBEH            XBE, Microsoft Xbox executable
# probabilistic checks whether signed or not
>0x0004 ulelong =0x0
>>&2    ulelong =0x0
>>>&2   ulelong =0x0  \b, not signed
>0x0004 ulelong >0
>>&2    ulelong >0
>>>&2   ulelong >0    \b, signed
# expect base address of 0x10000
>0x0104               ulelong =0x10000
>>(0x0118-0x0FF60)    ulelong&0x80000007  0x80000007 \b, all regions
>>(0x0118-0x0FF60)    ulelong&0x80000007  !0x80000007
>>>(0x0118-0x0FF60)   ulelong >0           (regions:
>>>>(0x0118-0x0FF60)  ulelong &0x00000001  NA
>>>>(0x0118-0x0FF60)  ulelong &0x00000002  Japan
>>>>(0x0118-0x0FF60)  ulelong &0x00000004  Rest_of_World
>>>>(0x0118-0x0FF60)  ulelong &0x80000000  Manufacturer
>>>(0x0118-0x0FF60)   ulelong >0           \b)

#------------------------------------------------------------------------------
# motorola:  file(1) magic for Motorola 68K and 88K binaries
#
# 68K
#
0       beshort         0x0208          mc68k COFF
>18     beshort         ^00000020       object
>18     beshort         &00000020       executable
>12     belong          >0              not stripped
>168    string          .lowmem         Apple toolbox
>20     beshort         0407            (impure)
>20     beshort         0410            (pure)
>20     beshort         0413            (demand paged)
>20     beshort         0421            (standalone)
0       beshort         0x0209          mc68k executable (shared)
>12     belong          >0              not stripped
0       beshort         0x020A          mc68k executable (shared demand paged)
>12     belong          >0              not stripped


#
# Motorola/UniSoft 68K Binary Compatibility Standard (BCS)
#
0       beshort         0x022A            68K BCS executable
#
# 88K
#
# Motorola/88Open BCS
#
0       beshort         0x022B            88K BCS executable

#------------------------------------------------------------------------------
# Sony Playstation executables (Adam Sjoegren <asjo@diku.dk>) :
0       string  PS-X\x20EXE       Sony Playstation executable
#  Area:
>113    string  x               ("%s")

#------------------------------------------------------------------------------
# cisco:  file(1) magic for cisco Systems routers
#
# Most cisco file-formats are covered by the generic elf code
#
# Microcode files are non-ELF, 0x8501 conflicts with NetBSD/alpha.
0	beshort			0x8501	    cisco IOS
>0      belong&0xffffff00       0x85011400  microcode
>0      belong&0xffffff00       0x8501cb00  experimental microcode
>7      string          	>\0         for "%s"

# EST flat binary format (which isn't, but anyway)
# From: Mark Brown <broonie@sirena.org.uk>
0	string	ESTFBINR	EST flat binary

# These are not the binaries themselves, but string references to them
# are a strong indication that they exist elsewhere...
#0	string	/bin/busybox	Busybox string reference: "%s"{one-of-many}
#0	string /bin/sh		Shell string reference: "%s"{one-of-many}

