View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
349 [file] General minor always 2022-05-24 06:24 2022-05-24 06:24
Reporter: Farknay Platform:  
Assigned To: OS:  
Priority: normal OS Version:  
Status: new Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Any text file content starting with PR is detected as RAGE Package Format (RPF)
Description: Since the addition of GTA file formats in the games magic file, any text file starting with the string PR is detected as RAGE Package Format (RPF).

I've only been able to test this in Git Bash on windows, all the Linux boxes I work on are using older versions of file, and I'm not allowed to upgrade them.

Tags:
Steps To Reproduce: echo 'PROMPT Hello' > sample.sql

file sample.sql
sample: RAGE Package Format (RPF),

Additional Information:
Attached Files:
There are no notes attached to this issue.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
348 [file] General minor always 2022-05-24 06:14 2022-05-24 06:14
Reporter: frokaikan Platform:  
Assigned To: OS:  
Priority: normal OS Version:  
Status: new Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Can the "-m" parameter take anything as its value?
Description: `./file -m ./bad_magic ./file`
The file `bad_magic` was attached.
Then the program throws SIGABRT.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: bad_magic (1,378 bytes) 2022-05-24 06:14
https://bugs.astron.com/file_download.php?file_id=276&type=bug
There are no notes attached to this issue.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
337 [file] General major always 2022-04-05 19:06 2022-05-22 20:01
Reporter: jmp3r Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: feedback Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Data files identified as text, text as data
Description: new bug, based on previous tickets
0000319, 0000334

I used the latest sources (HEAD) from github

I understand that it could be complicated to realize correct identifying text files but hope that its possible.

Attached more files for test.

Folders in archive:
data - binaries (files encrypted with ransomware) detected as `Unicode text, UTF-16, big-endian text, with no line terminators`
text - correct text files detected as data
CORRECT_DETECTED_AS_DATA - one file similar to the others (in data folder) but identified correctly.

If you need I can provide more files.
Tags: bug
Steps To Reproduce: Scan files from attach with `file` version latest sources (HEAD)
Additional Information:
Attached Files: bug_new.zip (166,197 bytes) 2022-04-05 19:06
https://bugs.astron.com/file_download.php?file_id=272&type=bug
Notes
(0003748)
christos   
2022-05-22 20:01   
It all has to do with the ucs16 detection in looks_ucs16 in encoding.c. if you change https://github.com/file/file/blob/master/src/encoding.c#L480 to 'return 0;', i.e. ignoring all ucs16 files that don't have BOM, then the text files mis-detected will get fixed (but then we'll miss usc16 files without BOM).
The Estonian and Hebrew files have invalid low surrogate pair characters (dc00 and de05 respectively). If you comment out https://github.com/file/file/blob/master/src/encoding.c#L516, they succeed.

The English.tr file has 2 0x13 (^S) characters, that is why it fails. The rest have some 0x7f DEL characters that is why they fail. If you comment out https://github.com/file/file/blob/master/src/encoding.c#L511, they all succeed.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
343 [file] General feature have not tried 2022-05-09 20:56 2022-05-21 22:51
Reporter: jstein Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: btrfs send image (new file format)
Description: btrfs send can dump a filesystem in a structured file system image file. This file can be imported by btrfs receive.
The dump starts with
btrfs-stream

Tags:
Steps To Reproduce:
Additional Information: see also
https://btrfs.wiki.kernel.org/index.php/Design_notes_on_Send/Receive
Attached Files:
Notes
(0003747)
christos   
2022-05-21 22:51   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
344 [file] General major always 2022-05-11 06:13 2022-05-21 22:47
Reporter: rven Platform:  
Assigned To: christos OS:  
Priority: high OS Version: Ubuntu 20.04.4 L  
Status: feedback Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: image/svg+xml not correctly guessed from buffer
Description: When a svg needs to be parsed with the from_buffer method, it returns an incorrect mimetype when the <?xml version='1.0' encoding='UTF-8' ?> tag is included on top of the xml declaration
Tags:
Steps To Reproduce: import magic
a = b"<svg height='180' width='180' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink'><rect fill='hsl(349, 60%, 45%)' height='180' width='180'/><text fill='#ffffff' font-size='96' text-anchor='middle' x='90' y='125' font-family='sans-serif'>M</text></svg>"
magic.from_buffer(a, mime=True)

=> 'image/svg+xml'

import magic
a = b"<?xml version='1.0' encoding='UTF-8' ?><svg height='180' width='180' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink'><rect fill='hsl(349, 60%, 45%)' height='180' width='180'/><text fill='#ffffff' font-size='96' text-anchor='middle' x='90' y='125' font-family='sans-serif'>M</text></svg>"
magic.from_buffer(a, mime=True)

=> 'text/xml'
Additional Information:
Attached Files:
Notes
(0003746)
christos   
2022-05-21 22:47   
should be fixed in HEAD.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
345 [file] General minor always 2022-05-12 18:20 2022-05-21 22:30
Reporter: Almalixia Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: feedback Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: mime_content_type result gets duplicated for xlsx
Description: When calling mime_content_type() on a file of type xlsx, it's returning 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheetapplication/vnd.openxmlformats-officedocument.spreadsheetml.sheet'.
Tags:
Steps To Reproduce: echo mime_content_type('file_name.xlsx');
Additional Information:
Attached Files:
Notes
(0003745)
christos   
2022-05-21 22:30   
I don't maintain the php bindings for libmagic; I just tried it on my machine and it works:
[6:09pm] 370>php
<?php
echo mime_content_type('foo.xlsx') . "\n";
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

[6:10pm] 371>php -v
PHP 7.4.27 (cli) (built: Apr 25 2022 13:02:57) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
346 [file] General minor always 2022-05-13 12:09 2022-05-20 11:12
Reporter: jukuisma Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: feedback Product Version: 5.41  
Product Build: Resolution: reopened  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Incorrect video/dv mimetype
Description: `file` identifies DV files correctly, but returns `application/octet-stream` as the mimetype. No mimetype has been defined for DV files: https://github.com/file/file/blob/22209154702032e9b7f2e96eb7eab174f8e87af9/magic/Magdir/animation#L944.
Tags:
Steps To Reproduce: $ wget https://github.com/Digital-Preservation-Finland/file-scraper/raw/c9facae6df774544e4ef8f7a039a926796ef57b8/tests/data/video_dv/valid__pal_lossy.dv
$ file valid__pal_lossy.dv
$ file --mime-type valid__pal_lossy.dv
Additional Information: https://www.iana.org/assignments/media-types/video/DV
Attached Files:
Notes
(0003743)
christos   
2022-05-14 22:06   
Fixed, thanks
(0003744)
jukuisma   
2022-05-20 11:12   
Shouldn't this be "video/DV" or "video/dv" instead of "video/x-dv"? MIME type "video/DV" is registered in IANA, see the RFC of the registration:

https://www.rfc-editor.org/rfc/rfc6469.html

As we understand, MIME types with "x-" prefix should be avoided:

https://www.rfc-editor.org/rfc/rfc6838.html#section-3.4 (last paragraph of section 3.4)

which refers to:

https://www.rfc-editor.org/rfc/rfc6648.html

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
347 [file] General feature N/A 2022-05-14 18:04 2022-05-14 20:36
Reporter: GerbilSoft Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Detect Godot textures; improvements for NGPC, Mega Drive, others
Description: The attached patches add the following:
* Detect Godot STEX textures from Godot 3 and Godot 4. This includes image size, codec, and rescale value (if applicable).
* Neo Geo Pocket Color: Print the NEOPxxxx serial number.
* riff: Print calling metadata from RecorderGear TR500 call recordings. The metadata indicates if it was an incoming or outgoing call, and the dialed/received phone number.
* DDS: Print DXGI formats.
* Mega Drive: Improve system type detection; add more variants for Sega Pico, including a few that don't start with "SEGA".
* c64: Expand CBM cartridge image detection for VICE 3.0, which now includes C128, CBM-II, VIC-20, and Plus/4.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: file.2022-05-14.ngpc.TR500.DXGI.godot.c64-cart.tar.gz (9,486 bytes) 2022-05-14 18:04
https://bugs.astron.com/file_download.php?file_id=275&type=bug
Notes
(0003742)
christos   
2022-05-14 20:36   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
341 [file] General minor have not tried 2022-04-23 11:00 2022-04-25 17:34
Reporter: blacktav Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: feedback Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: "file -z" breaks on zipped files with "Bad system call"
Description: When testing a zip archive, "file" breaks reporting "Bad system call"

Testing a dump from Google Photos
$ file Photos-001.zip
Photos-001.zip: Zip archive data, at least v2.0 to extract, compression method=deflate

$ file -z Photos-001.zip
Photos-001.zip: Bad system call

Testing a zip archive
$ file mc-test-pass.zip
mc-test-pass.zip: Zip archive data, at least v1.0 to extract, compression method=store

$ file -z mc-test-pass.zip
mc-test-pass.zip: Bad system call

OS is ArchLinux
Tags:
Steps To Reproduce: 1. download a bundle from Google Photos
2. test download with "file -z <filename>"

or

1. create an archive using zip (Zip 3.0 (July 5th 2008), by Info-ZIP)
2. test download with "file -z <filename>"
Additional Information: $ file --version
file-5.41
magic file from /usr/share/file/misc/magic
seccomp support included
Attached Files: mc-test-pass.zip (16,836 bytes) 2022-04-23 11:00
https://bugs.astron.com/file_download.php?file_id=274&type=bug
Notes
(0003736)
blacktav   
2022-04-23 11:10   
Sorry, inappropriate report
Solution being to use -S switch as in "file -S -z <filename>"

Maybe the error response could be more useful though
(0003741)
christos   
2022-04-25 17:34   
Yes, we could install a bad system call handler, but it is ugly. I prefer to leave it as is.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
340 [file] General minor always 2022-04-12 20:47 2022-04-25 17:33
Reporter: ESultanik Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: The ASF_JFIF_Media guid definition is missing two bytes
Description: Line 91 of `magic/Magdir/asf` contains this GUID: `B61BE100-5B4E-11CF-A8FD-00805F5C44`. That GUID is missing its last two bytes. I believe it should actually be `B61BE100-5B4E-11CF-A8FD-00805F5C442B`.

https://github.com/file/file/blob/961e193e4519d40983322ed853cea6511d4b6494/magic/Magdir/asf#L91
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003740)
christos   
2022-04-25 17:33   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
339 [file] General feature always 2022-04-10 14:53 2022-04-25 17:31
Reporter: jmaynard Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Add more Hercules DASD image types
Description: The attached .magic file can be used to replace lines 1696-1711 of magic/Magdir/images . It adds recognition of CKD64/CCKD64 DASD, and for compressed DASD, it will report the number of cylinders on the volume and the compression algorithm.
Tags: magic
Steps To Reproduce:
Additional Information:
Attached Files: .magic (1,942 bytes) 2022-04-10 14:53
https://bugs.astron.com/file_download.php?file_id=273&type=bug
Notes
(0003739)
christos   
2022-04-25 17:31   
Replaced, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
338 [file] General feature N/A 2022-04-09 09:15 2022-04-25 17:28
Reporter: polluks Platform: MacBook Pro  
Assigned To: christos OS: macOS  
Priority: normal OS Version: 12.3  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Added more Oric
Description: diff --git a/magic/Magdir/oric b/magic/Magdir/oric
index 79e264ea..678ba770 100644
--- a/magic/Magdir/oric
+++ b/magic/Magdir/oric
@@ -5,8 +5,12 @@
 # From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
 # References:
 # http://fileformats.archiveteam.org/wiki/TAP_(Oric)
+# http://fileformats.archiveteam.org/wiki/DSK_(Oric)
 0 string \x16\x16\x16\x24 Oric tape,
 >6 byte =0x00 BASIC,
 >6 byte =0x80 memory block,
 >7 byte >0x00 autorun,
 >13 string x "%.15s"
+
+0 string ORICDISK Oric Image
+0 string MFM_DISK Oric Image
Tags: magic
Steps To Reproduce:
Additional Information:
System Description Apple M1
Attached Files:
Notes
(0003738)
christos   
2022-04-25 17:28   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
342 [file] General minor always 2022-04-25 06:34 2022-04-25 06:34
Reporter: jayvdb Platform:  
Assigned To: OS:  
Priority: normal OS Version:  
Status: new Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: jar files with POSIX shell script header do not mention they are JAR files
Description: https://github.com/pinterest/ktlint/releases/download/0.45.2/ktlint is an example of a JAR file with a POSIX shell script header, which looks like

---
#!/bin/sh

JV=$(java -version 2>&1 | head -1 | cut -d'"' -f2 | sed '/^1\./s///' | cut -d'.' -f1)

X=$( [ "$JV" -ge "16" ] && echo "--add-opens java.base/java.lang=ALL-UNNAMED" || echo "")

exec java $X -Xmx512m -jar "$0" "$@"

PK...
```

The java executable can run it as a jar file directly. i.e. the following prints the help on all platforms

java -jar /path/to/ktlint --help

The file command says it is "POSIX shell script executable (binary data)"

When I manually remove the script header, file then reports it as "Zip archive data, at least v1.0 to extract, compression method=deflate"

It would be great if it could mention that it is a JAR or ZIP file, perhaps like

"POSIX shell script executable (JAR ..)" or "POSIX shell script executable (Zip archive data, ...)"
Tags:
Steps To Reproduce: 1. Download https://github.com/pinterest/ktlint/releases/download/0.45.2/ktlint
2. `file ktlint`
Additional Information:
Attached Files:
There are no notes attached to this issue.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
282 [tcsh] General minor always 2021-08-15 13:51 2022-04-23 12:21
Reporter: kato Platform: GNU/Linux x86_64  
Assigned To: christos OS: Open SuSE Leap  
Priority: normal OS Version: 15.3  
Status: confirmed Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: tcsh 6.20.00 : shell variable "anyerror" does not work as described in the tcsh man page
Description: If "anyerror" is set, the exit status of a non-simple command should be non-zero if any subcommand fails. However, this does not hold in any case.
Tags:
Steps To Reproduce: /home/test> tcsh --version
tcsh 6.20.00 (Astron) 2016-11-24 (x86_64-unknown-linux) options wide,nls,lf,dl,al,kan,sm,color,filec
/home/test> cat non-existent-file|cat
cat: non-existent-file: No such file or directory
Exit 1
/home/test> set variable=`cat non-existent-file`
cat: non-existent-file: No such file or directory
Exit 1
/home/test> set variable=`cat non-existent-file|cat`
cat: non-existent-file: No such file or directory
/home/test> echo $?
0
Additional Information:
Attached Files:
Notes
(0003676)
christos   
2021-11-14 17:35   
set x=`cat /does/not/exist`
should set status to 1 and does not.
(0003737)
kato   
2022-04-23 12:21   
The bug persists with tcsh 6.24.00 with Open SuSE Leap 15.3:

/home/test> echo $version
tcsh 6.24.00 (Astron) 2022-02-02 (x86_64-suse-linux-suse-linux) options wide,nls,lf,dl,al,kan,sm,color,filec
/home/test> set anyerror
/home/test> set x=`cat /does/not/exist`
cat: /does/not/exist: No such file or directory
/home/test> echo $status
1
/home/test> set x=`cat /does/not/exist|less`
cat: /does/not/exist: No such file or directory
/home/test> echo $status
0

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
186 [file] General minor always 2020-08-24 02:14 2022-04-13 07:16
Reporter: joveler Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: confirmed Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Korean text file misidentified as 'COM executable for DOS'
Description: [Summary]
Some Korean text file encoded as EUC-KR (aka CP949 on Windows) is misidentified as 'COM executable for DOS'.
Part of the COM signatures should be disabled to fix it.

[Technical Detail]
EUC-KR encodes 4% of Korean characters as 'B8xx' ('륫/B8A0' ~ '뫼/B8FE').
In libmagic, the simplest COM signature only checks for 0xB8 at offset 0.
As a result, libmagic causes false positive on EUC-KR text which starts with some Korean characters.

Windows notepad (prior to Windows 10 v19H1) used ANSI encoding as default.
It means almost every text file produced in Korean Windows is encoded as EUC-KR.
Therefore it is a critical issue on Korean text files, as much Korean text files are misidentified as executable.

[Fix]
To reduce the negative impact, I propose to disable the simplest COM file signature.
I have attached the diff file.

Tags:
Steps To Reproduce: Run file command with attached euckr_falsepositive.txt.

$ file euckr_falsepositive.txt
euckr_falsepositive.txt: COM executable for DOS

$ file euckr_falsepositive.txt --mime-type
euckr_falsepositive.txt: application/x-dosexec
Additional Information:
Attached Files: 0001-Disable-simplest-COM-signature-to-avoid-FP.patch (1,869 bytes) 2020-08-24 02:14
https://bugs.astron.com/file_download.php?file_id=155&type=bug
euckr_falsepositive.txt (293 bytes) 2020-08-24 02:14
https://bugs.astron.com/file_download.php?file_id=154&type=bug
Notes
(0003482)
christos   
2020-09-06 15:14   
Patched, thanks!
(0003648)
christos   
2021-10-12 18:24   
Will revert for now and revisit. Breaks too many com executables. Perhaps we can limit it on what follows b8?
(0003734)
joveler   
2022-04-13 06:54   
> Perhaps we can limit it on what follows b8?

I have tried, but it is impossible.

In 8086 opcode, 0xB8 is 'MOV AX, [IMM]' command.
Since the IMM is any arbitrary two bytes, we cannot limit the followings.
- B8 0A 16 -> MOV AX, 0x16A0
- B8 40 00 -> MOV AX, 0x0040
(0003735)
joveler   
2022-04-13 07:16   
Every Extended Unix Code charset, such as EUC-JP, shares the same address space as EUC-KR. (Bytes of 0xA0-0xFF range, except 0x80)
Keeping 0xB8 COM signature may also cause problems in every EUC charset.

One idea is the use text/binary detection on buffers since the EUC charset tries to avoid ASCII control characters.
I do not know how libmagic's text detection works yet, isn't it involve code patching?

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
335 [file] General feature N/A 2022-04-01 15:09 2022-04-09 09:13
Reporter: polluks Platform: MacBook Pro  
Assigned To: christos OS: macOS  
Priority: normal OS Version: 12.3  
Status: assigned Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Added mib
Description: magic for Management Information Base
Tags: magic
Steps To Reproduce:
Additional Information:
System Description Apple M1
Attached Files: mib (213 bytes) 2022-04-01 15:09
https://bugs.astron.com/file_download.php?file_id=271&type=bug
Notes
(0003729)
christos   
2022-04-04 16:14   
I have a feeling this will end up with too many false positives.
(0003732)
polluks   
2022-04-08 13:49   
Indeed, it's a bit weak magic.
See also https://datatracker.ietf.org/doc/html/rfc1213#section-6
(0003733)
polluks   
2022-04-09 09:13   
How this assignment operator is pretty unique.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
332 [file] General minor always 2022-03-22 09:49 2022-04-04 17:48
Reporter: vinc17 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: misdetects "[number] text" files as JSON data
Description: Some non-JSON text files have a form like "[number] text". For instance, Xorg.0.log log files start with something like

[ 48.187]
X.Org X Server 1.21.1.3

where "[number]" is a timestamp. Because "[number]" looks like a JSON object, "file" detects such files as JSON data, even though the object is followed by garbage when interpreted as JSON.
Tags:
Steps To Reproduce: $ echo "[1] foo" | file -
/dev/stdin: JSON data
Additional Information: I don't know whether this is related, but I can see in the src/is_json.c source:

/*
 * if JSON_COUNT != 0:
 * count all the objects, require that we have the whole data file
 * otherwise:
 * stop if we find an object or an array
 */
[...]
#if JSON_COUNT
        /* bail quickly if not counting */
        if (lvl > 1 && (st[JSON_OBJECT] || st[JSON_ARRAYN]))
                return 1;
#endif

The "#if JSON_COUNT" and "bail quickly if not counting" comment seem contradictory (if JSON_COUNT != 0, then it is counting), so I'm wondering what is expected.
Attached Files: PR332.patch (1,061 bytes) 2022-03-25 09:30
https://bugs.astron.com/file_download.php?file_id=269&type=bug
Notes
(0003721)
vinc17   
2022-03-22 09:59   
See also commit 479e0995523c42b83a055781d27a0c651dc286e2, whose intent was to fix PR/69 (the same bug I had reported in the past).
(0003722)
wgh   
2022-03-25 03:51   
PR/165 reported that some json files are recognized as ASCII text, so the conditions for json file recognition were relaxed, resulting in some files being mistakenly recognized as json again。 I think that should be the reason。
(0003723)
vinc17   
2022-03-25 08:58   
Note that in PR/165, all the examples consisted in one JSON object, with no "garbage" following it. If rules are relaxed to allow very simple objects like some of the PR/165 examples, then garbage detection becomes important to avoid many false positives. Anyway, I suppose that the fix of PR/69 was wrong: the solution was not to discard simple JSON objects; instead, it should have detected garbage (i.e. any non-whitespace character) after a JSON object has been parsed. Examples with json_pp:

$ echo '[]' | json_pp
[]
$ echo '[] ' | json_pp
[]
$ echo '[] 1' | json_pp
garbage after JSON object, at character offset 4 (before "\n") at /usr/bin/json_pp line 59.
(0003724)
vinc17   
2022-03-25 09:16   
I'm going to provide a very simple patch, with testcases.
(0003725)
vinc17   
2022-03-25 09:30   
In json_parse for the end of the recursion (lvl == 0), return 0 (failure) if the end of the file has not been reached (whitespace has been skipped just before).

Two testcases are provided:
1. A simple JSON array followed by whitespace (a newline character), which should be recognized as JSON data.
2. Ditto followed by a non-whitespace character (a digit); this is not a valid JSON file, thus should be recognized as ASCII text.
(0003726)
vinc17   
2022-03-25 11:01   
FYI, I've also reported the bug in the Debian BTS and put a simplified patch there (no testcases, 2 lines of context removed) so that it can also be applied on the current Debian package: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1008247
(0003731)
christos   
2022-04-04 17:48   
Committed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
334 [file] General major always 2022-03-30 13:51 2022-04-04 16:46
Reporter: jmp3r Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Binary data files detected as Unicode text
Description: After fixing this: https://bugs.astron.com/view.php?id=319 new bug appeared

Now the inverse situation for some files:
the encrypted binary files detected as text

I used the latest sources (HEAD) from github
Tags:
Steps To Reproduce: Scan files from attach with `file` version latest sources (HEAD)
I attached only two files, but there are thousands of such files.
Additional Information:
Attached Files: bin.zip (23,800 bytes) 2022-03-30 13:51
https://bugs.astron.com/file_download.php?file_id=270&type=bug
Notes
(0003730)
christos   
2022-04-04 16:46   
Detect invalid UTF16 and surrogate pairs.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
336 [file] General minor always 2022-04-04 08:29 2022-04-04 16:13
Reporter: stefanwascoding Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: using `env` breaks detection of zsh scripts (shown as plain text)
Description: Scripts using `#!/usr/bin/env zsh` as shebang are detected as text/plain mime type.

Both default detection as well as using "--mime" are broken; `#!/usr/bin/zsh` shows up as "Paul Falstad's zsh script text executable" & "text/x-shellscript", env version shows up as "a /usr/bin/env zsh script text executable" or "text/plain".
Works as expected when using bash in place of zsh.

This might be a regression of https://bugs.astron.com/view.php?id=114
Tags:
Steps To Reproduce: echo '#!/usr/bin/env zsh' > myzshscript && chmod +x myzshscript && file --mime-type myzshscript
Additional Information:
Attached Files:
Notes
(0003727)
polluks   
2022-04-04 13:04   
Indeed
$ grep usr/bin/env magic/Magdir/commands
0 search/1 #!/usr/bin/env\ zsh Paul Falstad's zsh script text executable
0 string/fwt #!\ /usr/bin/env\ bash Bourne-Again shell script text executable
0 string/fwt #!\ /usr/bin/env\ fish fish shell script text executable
0 string/fwt #!\ /usr/bin/env\ execlineb execline script text executable
(0003728)
christos   
2022-04-04 16:13   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
333 [file] General feature N/A 2022-03-24 08:26 2022-03-24 08:26
Reporter: evyatar Platform:  
Assigned To: OS:  
Priority: none OS Version:  
Status: new Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Introduce a magic_file_at() function
Description: I suggest introducing a new libmagic API function: magic_file_at which will have the signature:
const char *magic_file_at(magic_t cookie, int dirfd, const char *path)
It behaves exactly like magic_file() except that if path is relative then it is interpreted as a relative path to the directory referred to by dirfd except if dirfd is negative in which case path is interpreted as a relative path to the current working directory.
This is analogous to the openat() family of syscalls (except that AT_FDCWD is changed with any negative value).
The rationale behind this addition is laid out in the Linux mapage for open(2) but also, in my personal experience, it simplifies the use of readdir() greatly as no string copying needs to take place to call magic_file().
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
There are no notes attached to this issue.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
283 [file] General feature N/A 2021-08-17 06:03 2022-03-21 23:34
Reporter: polluks Platform: PowerBook5,8  
Assigned To: christos OS: MorphOS  
Priority: normal OS Version: 3.15  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: More X11
Description: Please use official name
Added bitmap
Tags:
Steps To Reproduce: --- xwindows.bak 2020-06-19 14:19:13 +0200
+++ xwindow 2021-08-17 00:57:25 +0200
@@ -1,7 +1,7 @@
 
 #------------------------------------------------------------------------------
 # $File: xwindows,v 1.11 2019/04/19 00:42:27 christos Exp $
-# xwindows: file(1) magic for various X/Window system file formats.
+# xwindow: file(1) magic for various X Window System file formats.
 
 # Compiled X Keymap
 # XKM (compiled X keymap) files (including version and byte ordering)
@@ -33,3 +33,7 @@
 !:mime image/x-xcursor
 >10 leshort x version %d
 >>8 leshort x \b.%d
+
+# X bitmap https://en.wikipedia.org/wiki/X_BitMap
+0 string #define\
+>8 regex [a-zA-Z0-9]+_width xbm image
Additional Information:
System Description
Attached Files:
There are no notes attached to this issue.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
330 [file] General minor have not tried 2022-03-19 15:41 2022-03-21 23:28
Reporter: polluks Platform: MacBook Pro  
Assigned To: christos OS: macOS  
Priority: normal OS Version: 12.1  
Status: assigned Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: msdos: ZIP self-extracting archive
Description: file did not recognize the ZIP, unzip worked fine
Tags: magic, zip
Steps To Reproduce: IFAZE475.EXE: MS-DOS executable, NE for MS Windows 3.x (EXE)

│00003E60 4D 00 DD 0A 00 00 4C 9F 00 00 9E 03 CF 06 50 4B │◆│......L.......PK│
│00003E70 03 04 14 00 00 80 08 00 F3 80 73 20 59 59 74 17 │▒│..........s YYt.│
Additional Information: http://cd.textfiles.com/psl/pslv5nv05/WIN/GRAPHICS/IFAZE475.ZIP
System Description Apple M1
Attached Files:
Notes
(0003719)
christos   
2022-03-21 21:42   
It is a self-extracting zip (even unzip says so)... What would you have file say?
(0003720)
polluks   
2022-03-21 23:28   
File should say: This is not a plain NE exe but a ZIP.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
326 [file] General feature always 2022-03-04 00:59 2022-03-21 21:37
Reporter: aichingm Platform: amd64  
Assigned To: christos OS: Linux  
Priority: normal OS Version: 5.16  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: add support for QGis files which are currently identified as HTML document
Description: QGIS: A Free and Open Source Geographic Information System

File format descriptions: https://github.com/qgis/QGIS/blob/master/rpm/sources/qgis-mime.xml
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: qgis-project.qgs (3,709 bytes) 2022-03-04 00:59
https://bugs.astron.com/file_download.php?file_id=266&type=bug
Notes
(0003718)
christos   
2022-03-21 21:37   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
325 [file] General trivial always 2022-02-28 14:20 2022-03-21 21:28
Reporter: wolfgangwalther Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: WOFF / WOFF2 fonts have no mimetype associated
Description: WOFF / WOFF2 files are correctly identified as such, but the returned mimetype is application/octet-stream, even though RFC8081 [1] defines font/woff and font/woff2 as mimetypes for those files types.

[1]: https://www.rfc-editor.org/rfc/rfc8081#section-4.4.5
Tags: magic
Steps To Reproduce: Using any example woff/woff2 file (e.g. https://filesamples.com/formats/woff):

% file fontawesome-webfont.woff
fontawesome-webfont.woff: Web Open Font Format, TrueType, length 98164, version 4.7

% file --mime-type fontawesome-webfont.woff
fontawesome-webfont.woff: application/octet-stream
Additional Information:
Attached Files:
Notes
(0003717)
christos   
2022-03-21 21:28   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
328 [file] General minor always 2022-03-15 10:49 2022-03-21 21:26
Reporter: adepasquale Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Add various missing MIME-Types
Description: Add missing MIME-Types for:
- ACE archives
- Windows CHM
- Windows URL
- Windows LNK
Tags: magic
Steps To Reproduce:
Additional Information:
Attached Files: mimetypes.FILE5_41.patch (1,674 bytes) 2022-03-15 10:49
https://bugs.astron.com/file_download.php?file_id=268&type=bug
Notes
(0003716)
christos   
2022-03-21 21:26   
Committed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
327 [file] General minor always 2022-03-15 00:28 2022-03-21 21:24
Reporter: vinc17 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: fails to detect a json file as JSON data
Description: file 5.41 fails to detect the attached json file as JSON data.
Tags:
Steps To Reproduce: $ file Q3235109.json
Q3235109.json: ASCII text, with very long lines (2409), with no line terminators

And with the -d option, I can see: "[try json 0]".
Additional Information: The json_pp utility doesn't detect any issue on this file.
Attached Files: Q3235109.json (2,409 bytes) 2022-03-15 00:28
https://bugs.astron.com/file_download.php?file_id=267&type=bug
Notes
(0003711)
polluks   
2022-03-21 14:04   
By the way "cc -DTEST is_json.c" and "cc -DTEST is_tar.c" are broken, "cc -DTEST is_csv.c" still works.
(0003712)
polluks   
2022-03-21 14:19   
--- is_json.c.bak 2022-03-21 15:13:15.933289900 +0100
+++ is_json.c 2022-03-21 15:14:48.814366000 +0100
@@ -37,6 +37,8 @@

 #include <string.h>
 #include "magic.h"
+#else
+#include <stddef.h>
 #endif

 #ifdef DEBUG
(0003715)
christos   
2022-03-21 21:24   
Bumped recursion limit.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
331 [file] General minor have not tried 2022-03-20 23:48 2022-03-21 19:58
Reporter: polluks Platform: MacBook Pro  
Assigned To: christos OS: macOS  
Priority: normal OS Version: 12.3  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: macOS: check fails
Description: Running test: ../tests/CVE-2014-1943.testfile
../tests/CVE-2014-1943.testfile: Apple Driver Map, blocksize 0
Running test: ../tests/JW07022A.mp3.testfile
../tests/JW07022A.mp3.testfile: Audio file with ID3 version 2.2.0, contains: MPEG ADTS, layer III, v1, 96 kbps, 44.1 kHz, Monaural
Running test: ../tests/android-vdex-1.testfile
../tests/android-vdex-1.testfile: Android vdex file, verifier deps version: 021, dex section version: 002, number of dex files: 4, verifier deps size: 106328
Running test: ../tests/android-vdex-2.testfile
../tests/android-vdex-2.testfile: Android vdex file, being processed by dex2oat, verifier deps version: 019, dex section version: 002, number of dex files: 1, verifier deps size: 1016
Running test: ../tests/arj.testfile
../tests/arj.testfile: ARJ archive data, v11, slash-switched, created 5 1980+48, original name: example_m0.arj, os: Unix
test: ERROR: result was (len 97)
ARJ archive data, v11, slash-switched, created 5 1980+48, original name: example_m0.arj, os: Unix
expected (len 79)
ARJ archive data, v11, slash-switched, original name: example_m0.arj, OS: Unix
make[2]: *** [check-local] Error 1
make[1]: *** [check-am] Error 2
make: *** [check-recursive] Error 1
Tags: build
Steps To Reproduce:
Additional Information:
System Description Apple M1
Attached Files:
Notes
(0003714)
christos   
2022-03-21 19:58   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
329 [file] General feature N/A 2022-03-17 14:35 2022-03-21 19:57
Reporter: polluks Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Another IFF format
Description: --- iff.bak 2021-12-06 12:05:46.956819300 +0100
+++ iff 2022-03-17 15:32:22.461280200 +0100
@@ -45,6 +45,7 @@
 >8 string ACBM \b, ACBM continuous image
 >8 string FAXX \b, FAXX fax image
 >8 string STFX \b, ST-Fax image
+>8 string IMAGIHDR \b, CD-i image
 # other formats
 >8 string FTXT \b, FTXT formatted text
 >8 string CTLG \b, CTLG message catalog
Tags: magic
Steps To Reproduce:
Additional Information: See also https://github.com/jsummers/deark/issues/40
Attached Files:
Notes
(0003713)
christos   
2022-03-21 19:57   
Thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
323 [file] General minor always 2022-02-27 13:30 2022-03-21 19:55
Reporter: vmurashev Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: assigned Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: 2 test samples are broken
Description: If to fix issue 0000322 it becomes clear
that 2 test samples are broken
  - fit-map-data
  - regex-eol

---

/mnt/c/yr/file/tests/regex-eol.testfile: Ansible Vault, version 1.1, encryption AES256
file_test: ERROR: result was (len 45)
Ansible Vault, version 1.1, encryption AES256
expected (len 57)
Ansible Vault text, version 1.1, using AES256 encryption

---

/mnt/c/yr/file/tests/fit-map-data.testfile: FIT Map data, unit id 65536, serial 3879446968, Sat May 31 13:00:34 2014, manufacturer 1 (garmin), product 1632, type 4 (Activity)
file_test: ERROR: result was (len 130)
FIT Map data, unit id 65536, serial 3879446968, Sat May 31 13:00:34 2014, manufacturer 1 (garmin), product 1632, type 4 (Activity)
expected (len 131)
FIT Map data, unit id 65536, serial 3879446968, Sat May 31 10:00:34 2014, manufacturer 1 (garmin), product 1632, type 4 (Activity)
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
There are no notes attached to this issue.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
322 [file] General major always 2022-02-27 13:22 2022-03-16 12:03
Reporter: vmurashev Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: test should not skip underlying OS errors (e.g. file not found)
Description: Please take a look at tests/test.c

magic cookie is opened with flag MAGIC_NONE

as result test exits with zero exit code even if input file for testing is not found

I believe that for testing magic cookie should be opened with flag MAGIC_ERROR
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003709)
christos   
2022-03-16 12:03   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
321 [file] General minor have not tried 2022-02-27 13:12 2022-03-16 11:59
Reporter: vmurashev Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: memory double free if to invoke test with unexpected count of arguments
Description: Please take a looks at test/test.c

    if (argc != 3) {
        (void)fprintf(stderr, "Usage: %s TEST-FILE RESULT\n", prog);
        magic_close(ms);
        goto bad;
    }
...
bad:
    free(desired);
    magic_close(ms);
    return e;

You can see that magic_close(ms) is called twice in such case
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003708)
christos   
2022-03-16 11:59   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
217 [file] General tweak always 2020-12-21 12:02 2022-03-09 17:14
Reporter: Helge Kreutzmann Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: assigned Product Version: 5.39  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Issues in file man pages
Description: Dear file maintainer,
the manpage-l10n project maintains a large number of translations of
man pages both from a large variety of sources (including file) as
well for a large variety of target languages.

During their work translators notice different possible issues in the
original (english) man pages. Sometimes this is a straightforward
typo, sometimes a hard to read sentence, sometimes this is a
convention not held up and sometimes we simply do not understand the
original.

We use several distributions as sources and update regularly (at
least every 2 month). This means we are fairly recent (some
distributions like archlinux also update frequently) but might miss
the latest upstream version once in a while, so the error might be
already fixed. We apologize and ask you to close the issue immediately
if this should be the case, but given the huge volume of projects and
the very limited number of volunteers we are not able to double check
each and every issue.

Secondly we translators see the manpages in the neutral po format,
i.e. converted and harmonized, but not the original source (be it man,
groff, xml or other). So we cannot provide a true patch (where
possible), but only an approximation which you need to convert into
your source format.

Finally the issues I'm reporting have accumulated over time and are
not always discovered by me, so sometimes my description of the
problem my be a bit limited - do not hesitate to ask so we can clarify
them.

I'm now reporting the errors for your project. If future reports
should use another channel, please let me know.

Man page: file.1
Issue: What ist "E<.Bk -words>"?

"E<.Nm> E<.Bk -words> E<.Op Fl bcdEhiklLNnprsSvzZ0> E<.Op Fl Fl apple> E<.Op "
"Fl Fl exclude-quiet> E<.Op Fl Fl extension> E<.Op Fl Fl mime-encoding> E<.Op "
"Fl Fl mime-type> E<.Op Fl e Ar testname> E<.Op Fl F Ar separator> E<.Op Fl f "
"Ar namefile> E<.Op Fl m Ar magicfiles> E<.Op Fl P Ar name=value> E<.Ar> E<."
"Ek> E<.Nm> E<.Fl C> E<.Op Fl m Ar magicfiles> E<.Nm> E<.Op Fl Fl help>"
--
Man page: file.1
Issue: Two quote signs around magic / magic numbers does not make sense

"in the standard include directory. These files have a E<.Dq \"magic number"
"\"> stored in a particular place near the beginning of the file that tells "
"the E<.Tn UNIX> operating system that the file is a binary executable, and "
"which of several types thereof. The concept of a E<.Dq \"magic\"> has been "
"applied by extension to data files. Any file with some invariant identifier "
"at a small fixed offset into the file can usually be described in this way. "
"The information identifying these files is read from the compiled magic file "
"E<.Pa /usr/share/file/misc/magic.mgc>, or the files in the directory E<.Pa /"
"usr/share/file/misc/magic> if the compiled file does not exist. In "
"addition, if E<.Pa $HOME/.magic.mgc> or E<.Pa $HOME/.magic> exists, it will "
"be used in preference to the system magic files."
--
Man page: file.1
Issue: the file command â the command <.Nm>

"Causes the file command to output the file type and creator code as used by "
"older MacOS versions. The code consists of eight letters, the first "
"describing the file type, the latter the creator. This option works "
"properly only for file formats that have the apple-style output defined."
--
Man page: file.1
Issue: option â (This) option

"option causes symlinks not to be followed (on systems that support symbolic "
"links). This is the default if the environment variable E<.Dv "
"POSIXLY_CORRECT> is not defined."

"option causes symlinks to be followed, as the like-named option in E<.Xr ls "
"1> (on systems that support symbolic links). This is the default if the "
"environment variable E<.Ev POSIXLY_CORRECT> is defined."
--
Man page: file.1
Issue: file â E<.Nm>

"Causes the file command to output mime type strings rather than the more "
"traditional human readable ones. Thus it may say E<.Sq text/plain; "
"charset=us-ascii> rather than E<.Dq ASCII text>."

"On systems where libseccomp E<.Pa ( https://github.com/seccomp/libseccomp>) "
"is available, the E<.Fl S> flag disables sandboxing which is enabled by "
"default. This option is needed for file to execute external decompressing "
"programs, i.e. when the E<.Fl z> flag is specified and the built-in "
"decompressors are not available. On systems where sandboxing is not "
"available, this option has no effect."

"The magic file entries have been collected from various sources, mainly "
"USENET, and contributed by various authors. Christos Zoulas (address below) "
"will collect additional or corrected magic file entries. A consolidation of "
"magic file entries will be distributed periodically."

"John Gilmore revised the code extensively, making it better than the first "
"version. Geoff Collyer found several inadequacies and provided some magic "
"file entries. Contributions of the E<.Sq \\*[Am]> operator by Rob McMahon, "
"E<.Aq cudcv@warwick.ac.uk>, 1989."

"E<.Em Note:> This Debian version of file was built without seccomp support, "
"so this option has no effect."
--
Man page: file.1
Issue: option â flag?

"On systems where libseccomp E<.Pa ( https://github.com/seccomp/libseccomp>) "
"is available, E<.Nm> is enforces limiting system calls to only the ones "
"necessary for the operation of the program. This enforcement does not "
"provide any security benefit when E<.Nm> is asked to decompress input files "
"running external programs with the E<.Fl z> option. To enable execution of "
"external decompressors, one needs to disable sandboxing using the E<.Fl S> "
"flag."
--
Man page: file.1
Issue: Missing full stop.

"Some of the encoding logic is hard-coded in encoding.c and can be moved to "
"the magic files if we had a !:charset annotation"
--
Man page: file.1
Issue: This bug was closed in 2008?

"Store arbitrarily long strings, for example for %s patterns, so that they "
"can be printed out. Fixes Debian bug #271672. This can be done by "
"allocating strings in a string pool, storing the string pool at the end of "
"the magic file and converting all the string pointers to relative offsets "
"from the string pool."
--
Man page: file.1
Issue 1: security considerations) â security) considerations
Issue 2: so move around the file â to move around in the file

"If the offsets specified internally in the file exceed the buffer size ( E<."
"Dv HOWMANY> variable in file.h), then we don't seek to that offset, but we "
"give up. It would be better if buffer managements was done when the file "
"descriptor is available so move around the file. One must be careful though "
"because this has performance (and thus security considerations)."
--
Man page: file.1
Issue: is E<.Ek> â file? This long string is difficult to review for translation

"E<.Nm> E<.Bk -words> E<.Op Fl bcdEhiklLNnprsSvzZ0> E<.Op Fl Fl apple> E<.Op "
"Fl Fl extension> E<.Op Fl Fl mime-encoding> E<.Op Fl Fl mime-type> E<.Op Fl "
"e Ar testname> E<.Op Fl F Ar separator> E<.Op Fl f Ar namefile> E<.Op Fl m "
"Ar magicfiles> E<.Op Fl P Ar name=value> E<.Ar> E<.Ek> E<.Nm> E<.Fl C> E<.Op "
"Fl m Ar magicfiles> E<.Nm> E<.Op Fl Fl help>"
--
Man page: file.1
Issue: Two quote signs around magic / magic numbers does not make sense

"in the standard include directory. These files have a E<.Dq \"magic number"
"\"> stored in a particular place near the beginning of the file that tells "
"the E<.Tn UNIX> operating system that the file is a binary executable, and "
"which of several types thereof. The concept of a E<.Dq \"magic\"> has been "
"applied by extension to data files. Any file with some invariant identifier "
"at a small fixed offset into the file can usually be described in this way. "
"The information identifying these files is read from /etc/magic and the "
"compiled magic file E<.Pa /usr/share/misc/magic.mgc>, or the files in the "
"directory E<.Pa /usr/share/misc/magic> if the compiled file does not exist. "
"In addition, if E<.Pa $HOME/.magic.mgc> or E<.Pa $HOME/.magic> exists, it "
"will be used in preference to the system magic files."
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003517)
christos   
2021-01-03 20:45   
Issue: What ist "E<.Bk -words>"?
- See the "Keep" macro https://www.freebsd.org/cgi/man.cgi?query=mdoc&sektion=7

Issue: Two quote signs around magic / magic numbers does not make sense
- Removed, don't make a difference

Issue: the file command â the command <.Nm>
- Use .Nm

Issue: option â (This) option
- Added "This"

Issue: file â E<.Nm>
- fixed .Nm

Issue: option â flag?
- changed all to option

Issue: Missing full stop.
- fixed.

Issue: This bug was closed in 2008?
- No it is still broken (string limits in magic descriptions)

Issue 1: security considerations) â security) considerations
Issue 2: so move around the file â to move around in the file
- Rewrote and clarified.

Issue: is E<.Ek> â file? This long string is difficult to review for translation
- This is the list of flags. .Ek is the closing of .Bk macro.

Issue: Two quote signs around magic / magic numbers does not make sense
- duplicate, fixed.
(0003524)
Helge Kreutzmann   
2021-01-05 15:39   
Thanks for the swift handling, no more comments from my side.
(0003707)
Helge Kreutzmann   
2022-03-09 17:14   
Has this already landed in some kind of release? I wonder because I still see some issues in file(1) in all our upstream distributions.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
320 [file] General tweak always 2022-02-21 16:38 2022-02-21 19:21
Reporter: BEEDELLROKEJULIANLOCKHART Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: feedback Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: 'file' reports encodement as merely 'ISO-8859' rather than specifically 'ISO-8859-1' or 'ISO-8859-15' or 'ISO-8859-14'.
Description: 'file' reports encodement as merely 'ISO-8859' rather than specifically 'ISO-8859-1' or 'ISO-8859-15' or 'ISO-8859-14', which means that the informqation is not useful for me, because I must know more specifically the current encodement to be able to configure utilities that are similar to 'http://invent.kde.org/utilities/kate' to
Tags:
Steps To Reproduce: Install Windows 10.
Create one '.deskthemepack'-file by exporting the current theme.
Install 'http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Server/x86_64/iso'.
Install 'http://src.fedoraproject.org/rpms/file'.
Utilise 'http://invent.kde.org/utilities/ark' to extract the '.theme'-file from the '.deskthemepack'-archive-file.
Invoke '/usr/bin/file' with the path of the '.theme'-file of text as the sole argument as '/usr/bin/file 'file.theme''.

Alternatively, or conclusively, utilise 'file' to provide the encodement of any file that contains text whose encodement is 'ISO-8859'.
Additional Information:
Attached Files:
Notes
(0003706)
christos   
2022-02-21 19:21   
The question is how to tell the difference? For example while you can probably tell the difference between 8859-1 and 8859-14 by using a Celtic dictionary, it would be nearly impossible to tell the difference between 8859-1 and 8859-15.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
309 [file] General minor always 2022-01-20 14:52 2022-02-21 07:52
Reporter: malat Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: assigned Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Add support for JPEG-XL
Description: It would be nice to add support for JPEG-XL :

```
% convert -size 512x512 -depth 8 xc:black black.pgm
% cjxl black.pgm black.jxl
% file black.jxl
black.jxl: data
```
Tags:
Steps To Reproduce:
Additional Information: Here is the typical bits to check:

* https://github.com/libjxl/libjxl/blob/main/plugins/mime/image-jxl.xml

```
<?xml version="1.0" encoding="UTF-8"?>
<mime-info xmlns="http://www.freedesktop.org/standards/shared-mime-info">
  <mime-type type="image/jxl">
    <comment>JPEG XL image</comment>
    <comment xml:lang="fr">image JPEG XL</comment>
    <comment xml:lang="nl">JPEG XL afbeelding</comment>
    <magic priority="50">
      <match type="string" offset="0" value="\xFF\x0A"/>
      <match type="string" offset="0" value="\0\0\0\x0CJXL \x0D\x0A\x87\x0A"/>
    </magic>
    <glob pattern="*.jxl"/>
  </mime-type>
</mime-info>
```
Attached Files:
Notes
(0003703)
christos   
2022-02-20 18:28   
What version of file are you using? The magic seems to be there in HEAD:
# fgrep -i JPEG * | fgrep -i xl
jpeg:# JPEG XL
jpeg:0 string \xff\x0a JPEG XL codestream
jpeg:# JPEG XL (transcoded JPEG file)
jpeg:0 string \x00\x00\x00\x0cJXL\x20\x0d\x0a\x87\x0a JPEG XL container

(0003704)
malat   
2022-02-21 07:51   
Indeed, I was using file from Debian/bullseye. Closing.
(0003705)
malat   
2022-02-21 07:52   
For reference: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1004081

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
319 [file] General major always 2022-02-17 11:19 2022-02-19 22:49
Reporter: jmp3r Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Text files are identified as data
Description: Some text files could not be identified correctly, tested with 5.39, 5.41

wise_lang - 3 language ini files
log_data - samples log files
Tags:
Steps To Reproduce: Scan any file from attached archives and check that the output of file utility will "data" but these files are simple text files.
Additional Information:
Attached Files: log_data.zip (97,149 bytes) 2022-02-17 11:19
https://bugs.astron.com/file_download.php?file_id=265&type=bug
wise_lang.zip (6,079 bytes) 2022-02-17 11:19
https://bugs.astron.com/file_download.php?file_id=264&type=bug
Notes
(0003702)
christos   
2022-02-19 22:49   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
316 [file] General minor always 2022-01-31 14:59 2022-02-19 22:36
Reporter: karagian Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: .dbf files misidentified as "amd 29k coff prebar executable"
Description: file identifies .dbf files as "amd 29k coff prebar executable".

Tags:
Steps To Reproduce: you can test file on attached file
Additional Information: amd 29k coff prebar executable checks for the first two bytes, according to Magdir/varied.out and expected octal 01572

0 beshort 01572 amd 29k coff prebar executable

According to dbf specification (found in this link https://www.dbase.com/Knowledgebase/INT/db7_file_fmt.htm ) a DBASE level 5 file, last updated in 2022 (makes second byte 122, that's 122 years after 1900 :P ), matches the above 2-byte signature, so it gets misidentified as executable
Attached Files: DiorthPolykastrou062.dbf (2,574 bytes) 2022-01-31 14:59
https://bugs.astron.com/file_download.php?file_id=261&type=bug
Notes
(0003692)
polluks   
2022-02-02 12:13   
Raise priority of Magdir/database and check two more bytes...
"12-13 2 bytes Reserved; filled with zeros."
(0003701)
christos   
2022-02-19 22:36   
Bumped version of dbf.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
317 [file] General major always 2022-02-02 11:18 2022-02-15 13:57
Reporter: ssaschaa Platform: MacBook Pro M1 arm64  
Assigned To: christos OS: MacOS  
Priority: normal OS Version: 12.2 Darwin 21.3  
Status: assigned Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: OOXML mime-type fails with "application/x-decompression-error-gzip-Unknown-compression-format"
Description: When trying to get the mime-type of e.g. Excel OOXML file at MacOS decompression fails and MimeType "application/x-decompression-error-gzip-Unknown-compression-format" is returned instead of "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet".

Tried both: compilation and test as ARM64 and X86_64 binary

Tags: bug, compression
Steps To Reproduce: git clone https://github.com/file/file
cd ./file
autoreconf -i
./configure
make check
./src/file -m ./magic/magic.mgc --mime-type /tmp/Excel_Test.xlsx
Additional Information: Tried both: compilation and test as ARM64 and X86_64 binary
Attached Files: Excel_Test.xlsx (8,460 bytes) 2022-02-02 11:18
https://bugs.astron.com/file_download.php?file_id=262&type=bug
Notes
(0003699)
christos   
2022-02-15 13:32   
Tried to reproduce it, but could not:
[8:32am] 1761>./file -m ../magic/magic.mgc --mime-type Excel_Test.xlsx
Excel_Test.xlsx: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
[8:32am] 1762>uname -a
Darwin vpn1-1.astron.com 21.2.0 Darwin Kernel Version 21.2.0: Sun Nov 28 20:29:10 PST 2021; root:xnu-8019.61.5~1/RELEASE_ARM64_T8101 arm64
(0003700)
ssaschaa   
2022-02-15 13:57   
Sorry, I forgot to add the CLI switch "-z" for decompression attempts.
On Linux I get (as expected): /tmp/Excel_Test.xlsx: text/xml; charset=us-ascii compressed-encoding=application/vnd.openxmlformats-officedocument.spreadsheetml.sheet; charset=binary
But on MacOS I get: /tmp/Excel_Test.xlsx: application/x-decompression-error-gzip-Unknown-compression-format

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
318 [file] General feature N/A 2022-02-04 23:55 2022-02-15 13:01
Reporter: polluks Platform: PowerBook5,8  
Assigned To: christos OS: MorphOS  
Priority: normal OS Version: 3.15  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Added Oric
Description: See http://fileformats.archiveteam.org/wiki/TAP_(Oric)
Tags:
Steps To Reproduce:
Additional Information:
System Description
Attached Files: oric (374 bytes) 2022-02-04 23:55
https://bugs.astron.com/file_download.php?file_id=263&type=bug
Notes
(0003698)
christos   
2022-02-15 13:01   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
314 [file] General minor always 2022-01-29 19:10 2022-02-15 12:58
Reporter: gms Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Add magic for Pronto CCF files
Description: I've attached a small magic section for identifying Philips Pronto IR remote control CCF exchange format files.

Example:

file -m ccf_magic Panasonic.ccf
Panasonic.ccf: Philips Pronto IR remote control CCF

Remote control databases such as remote central carry a lot of CCF files, cf. e.g. http://files.remotecentral.com/download/45/pan-air-csakr.zip.html for the above example file.

I've also tested it with other CCF files.

I couldn't find real documentation for the CCF file format, but there are some open source utilities which use these magic bytes.

See for example my extract utility:

https://github.com/gsauthof/pronto-ccf/blob/78084a46109356d2bbf6e8d86eeb2f051d4e6022/ccf2pulse.py#L150

Tags: magic
Steps To Reproduce:
Additional Information:
Attached Files: ccf_magic (294 bytes) 2022-01-29 19:10
https://bugs.astron.com/file_download.php?file_id=259&type=bug
Notes
(0003697)
christos   
2022-02-15 12:58   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
315 [file] General minor always 2022-01-31 00:25 2022-02-14 23:57
Reporter: polluks Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Fixed console
Description: Fixed my newer Atari Lynx cartridge dump
Tags: bug
Steps To Reproduce: $ file -m console *.lnx
Solitaire_[AtariGamer.Com](Homebrew).lnx: Lynx cartridge, bank 0 256k, bank 1 256k, "Solitare pack for Lynx ", "Karris project "
a.lnx: Lynx cartridge, bank 0 256k, "Cart name ", "Manufacturer "
cart.lnx: Lynx cartridge, bank 0 512k, bank 1 512k, "Cart name ", "Manufacturer "
Additional Information:
Attached Files: console (38,975 bytes) 2022-01-31 00:25
https://bugs.astron.com/file_download.php?file_id=260&type=bug
Notes
(0003696)
christos   
2022-02-14 23:57   
Added thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
311 [file] General feature N/A 2022-01-21 16:28 2022-02-14 16:51
Reporter: ylep Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: New magic for the NIfTI neuroimaging file format
Description: I would like to propose the attached magic rules for inclusion, which are for identifying files in NIfTI format. NIfTI is a widely used format for image storage and exchange in the neuroimaging community, see https://nifti.nimh.nih.gov/.

I went beyond mere identification of the file type, and implemented rules for printing some high-level metadata (image size, resolution, datatype, etc.) which I find really useful, but I would understand if you think it is too much to include in the main database.

Test files can be found at the links below:
https://nifti.nimh.nih.gov/nifti-1/data/
https://nifti.nimh.nih.gov/pub/dist/data/nifti2
Tags: magic
Steps To Reproduce:
Additional Information:
Attached Files: nifti.magic (4,992 bytes) 2022-01-21 16:28
https://bugs.astron.com/file_download.php?file_id=258&type=bug
Notes
(0003695)
christos   
2022-02-14 16:51   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
308 [file] General minor always 2022-01-18 10:39 2022-02-14 16:47
Reporter: adepasquale Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Fix and improve ARJ file information
Description: Current file 5.41 has an issue parsing the "original filename" from ARJ archive headers (wrong offset).

I updated the offset, as well as added more information based on open source documentation:
https://fossies.org/linux/unarj/unarj.c
https://www.fileformat.info/format/arj/corion.htm
http://hmelnov.icc.ru/geos/scripts/WWWBinV.dll/ShowR?ARJ.rfh

See the attached patch and hexdump of a sample file header (use xxd -r to restore).

Output before/after applying the patch:
test.arj: ARJ archive data, v11, slash-switched, original name: , os: Unix
test.arj: ARJ archive data, v11, slash-switched, original name: example_m0.arj, OS: Unix
Tags: magic
Steps To Reproduce:
Additional Information:
Attached Files: test_arj.hex (262 bytes) 2022-01-18 10:39
https://bugs.astron.com/file_download.php?file_id=256&type=bug
arj.patch (1,335 bytes) 2022-01-18 10:39
https://bugs.astron.com/file_download.php?file_id=255&type=bug
Notes
(0003694)
christos   
2022-02-14 16:47   
Committed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
310 [file] General major always 2022-01-21 14:50 2022-02-14 16:39
Reporter: p870613 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: AddressSanitizer: stack-buffer-overflow on address 0x7ffc1ece1ae0 at pc 0x00000050bb19 bp 0x7ffc1ecdf090 sp 0x7ffc1ecdf088
Description: - version
    ```
    ➜ src ./file --version
    file-5.41
    magic file from /usr/local/share/misc/magic
    ```
    - at branch 4c94d085
- environment
    ```
    ➜ release git:(master) uname -a
    Linux lin-System-Product-Name 5.11.0-40-generic 00000440000018:0000020.04.2-Ubuntu SMP Tue Oct 26 18:07:44 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
    ➜ release git:(master) lsb_release -r
    Release: 20.04
    ```
- reproduce
    ```
    git clone https://github.com/file/file.git
    cd file
    autoreconf -i
    ./configure CC=gcc CXX=g++ CFLAGS="-g -fsanitize=address" --disable-shared
    make V=1 all
    ./src/file -m ./magic/magic.mgc ./poc
    ```

- asan
```
=================================================================
==1321923==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd284ba010 at pc 0x56188a508267 bp 0x7ffd284b75f0 sp 0x7ffd284b75e0
READ of size 1 at 0x7ffd284ba010 thread T0
    #0 0x56188a508266 in strlcpy /home/lin/file/src/strlcpy.c:49
    0000001 0x56188a4fec64 in file_copystr /home/lin/file/src/funcs.c:59
    0000002 0x56188a521563 in do_core_note /home/lin/file/src/readelf.c:918
    0000003 0x56188a523610 in donote /home/lin/file/src/readelf.c:1236
    0000004 0x56188a51e0be in dophn_core /home/lin/file/src/readelf.c:412
    0000005 0x56188a52753c in file_tryelf /home/lin/file/src/elfclass.h:43
    0000006 0x56188a50113e in file_buffer /home/lin/file/src/funcs.c:433
    0000007 0x56188a4e0a33 in file_or_fd /home/lin/file/src/magic.c:533
    0000008 0x56188a4e0376 in magic_file /home/lin/file/src/magic.c:417
    #9 0x56188a4dd9d4 in process /home/lin/file/src/file.c:555
    0000010 0x56188a4dce13 in main /home/lin/file/src/file.c:428
    0000011 0x7f4a175d40b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    0000012 0x56188a4dc28d in _start (/home/lin/file/src/file+0x1728d)

Address 0x7ffd284ba010 is located in stack of thread T0 at offset 8384 in frame
    #0 0x56188a51d977 in dophn_core /home/lin/file/src/readelf.c:351

  This frame has 3 object(s):
    [32, 64) 'ph32' (line 352)
    [96, 152) 'ph64' (line 353)
    [192, 8384) 'nbuf' (line 355) <== Memory access at offset 8384 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/lin/file/src/strlcpy.c:49 in strlcpy
Shadow bytes around the buggy address:
  0x10002508f3b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002508f3c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002508f3d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002508f3e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002508f3f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x10002508f400: 00 00[f3]f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
  0x10002508f410: f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3 f3
  0x10002508f420: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x10002508f430: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  0x10002508f440: 02 f2 04 f2 04 f2 00 00 00 00 00 00 04 f2 f2 f2
  0x10002508f450: f2 f2 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable: 00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone: fa
  Freed heap region: fd
  Stack left redzone: f1
  Stack mid redzone: f2
  Stack right redzone: f3
  Stack after return: f5
  Stack use after scope: f8
  Global redzone: f9
  Global init order: f6
  Poisoned by user: f7
  Container overflow: fc
  Array cookie: ac
  Intra object redzone: bb
  ASan internal: fe
  Left alloca redzone: ca
  Right alloca redzone: cb
  Shadow gap: cc
==1321923==ABORTING

```
Tags:
Steps To Reproduce:  git clone https://github.com/file/file.git
 cd file
 autoreconf -i
./configure CC=gcc CXX=g++ CFLAGS="-g -fsanitize=address" --disable-shared
 make V=1 all
 ./src/file -m ./magic/magic.mgc ./poc
Additional Information:
Attached Files: poc (28,105 bytes) 2022-01-21 14:50
https://bugs.astron.com/file_download.php?file_id=257&type=bug
Notes
(0003693)
christos   
2022-02-14 16:39   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
313 [tcsh] General minor always 2022-01-22 15:10 2022-01-22 15:10
Reporter: dgusev Platform: AMD64  
Assigned To: OS: FreeBSD  
Priority: normal OS Version: 13.0  
Status: new Product Version: 6.21.00  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: On exit history file is overwitten without merging
Description: Settings:
set history = 65535
set savehist = ( 65535 merge )

According to the tcsh manual page (description section of the "history -S|-L|-M [filename]"):
"If the second word of savehist is set to `merge', the history list is merged with
the existing history file instead of replacing it"

But actually it overwrites the history file without merging.
I get the same results using "history -S" or on exit from tcsh session.

Also tried to set lower history number to 1000 etc. Same results.
Tags:
Steps To Reproduce: 1. Set history options in "~/.cshrc" or "/etc/csh.cshrc":
set history = 65535
set savehist = ( 65535 merge )

2. Open 2 tcsh sessions.

3. Enter some commands in the first session and then save the history by using "history -S" command or by exiting from the session.

4. Save history the same way in the second session. History file will be overwritten, the new commands from 1st session will be lost.
Additional Information:
Attached Files:
There are no notes attached to this issue.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
306 [file] General minor always 2021-12-27 18:26 2022-01-10 20:12
Reporter: es20490446e Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: assigned Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Not recognized: MPEG-2 transport stream
Description: "MPEG-2 transport stream" is recognized as "application/octet-stream".

Mime spec at:
/usr/share/mime/video/mp2t.xml
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003687)
christos   
2022-01-10 16:19   
This is a data container format with no particular magic identifier. https://en.wikipedia.org/wiki/MPEG_transport_stream
(0003690)
es20490446e   
2022-01-10 20:12   
Do you mean it is okay as it is now?

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
305 [file] General major always 2021-12-23 15:18 2022-01-10 19:32
Reporter: felixsch Platform: linux  
Assigned To: christos OS: ubuntu  
Priority: normal OS Version: impish  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: file utility fails on a simple binary file with ERROR: (null)
Description: The file utility fails on the attached simple binary file with output

    tmp.bin: ERROR: (null)

It turns out that the first 4 bytes trigger this issue, in fact the error occurs if the binary file starts with
0x02020100 or 0x02020200

file-5.38 gives the expected result

    tmp.bin: data
Tags:
Steps To Reproduce: Run the command
    `file tmp.bin`
on the attached file
Additional Information: I encountered the problem on ubuntu impish with file utility version 5.39. The attached file is just the head of a large binary file.
After cloning the repository and doing a `git bisect` it turned out that the problematic commit is

commit 2ca292bcdf217bfddeeeaad1adc38c716ffab181 (HEAD, refs/bisect/bad)
Author: Christos Zoulas <christos@zoulas.com>
Date: Sun Mar 15 16:44:37 2020 +0000

    Improve on Windoes Precompiled INFO files (Joerg Jenderek)

PS: I used the github repo to reproduce and bisect, but with the commit message above it should be possible to find the corresponding commit in the original repo.

The issue is still present in the actual master (commit message)

    PR/304: zachs18: Allow whitespace in netpbm sizes.
Attached Files: tmp.bin (32 bytes) 2021-12-23 15:18
https://bugs.astron.com/file_download.php?file_id=252&type=bug
tmp2.bin (32 bytes) 2022-01-10 19:00
https://bugs.astron.com/file_download.php?file_id=254&type=bug
Notes
(0003686)
christos   
2022-01-10 15:04   
Thanks, but the problem seems to be fixed; I can't reproduce this file 5.41...
(0003688)
felixsch   
2022-01-10 19:00   
Oh sorry, I must be in idiot.
When playing around with starting signature of the file I tried different signatures to narrow the bug, and then I attached the wrong file.
In fact tmp.bin starts with 0x02020300, and this is working.
Please try the newly attached file tmp2.bin, which should start with 0x02020200, if you are patient enough.
I get the issue with file-5.41 in the latest ubuntu:jammy docker container.
(0003689)
christos   
2022-01-10 19:32   
Spurious mprint() return value.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
307 [file] General minor always 2022-01-02 20:01 2022-01-10 14:15
Reporter: Fabrice Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Build failure with gcc 4.8
Description: We have the following build failure on buildroot with file 5.41 and gcc 4.8

readelf.c: In function 'do_auxv_note':
readelf.c:1046:2: error: 'for' loop initial declarations are only allowed in C99 mode
  for (size_t off = 0; off + elsize <= descsz; off += elsize) {
  ^

funcs.c:93:2: error: 'for' loop initial declarations are only allowed in C99 mode
  for (const char *p = fmt; *p; p++) {
  ^

Please find a patch below

Full build log:
 - http://autobuild.buildroot.org/results/31c/31cbc313fceb84c0cbb1969fca5ac44244871dbc/build-end.log
Tags: build
Steps To Reproduce:
Additional Information:
Attached Files: 0001-fix-build-with-gcc-4.8.patch (3,086 bytes) 2022-01-02 20:01
https://bugs.astron.com/file_download.php?file_id=253&type=bug
Notes
(0003685)
christos   
2022-01-10 14:15   
fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
304 [file] General tweak always 2021-12-06 06:32 2021-12-17 14:43
Reporter: zachs18 Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Netpbm format does not correctly parse size for some images
Description: The Netpbm image formats allow any amount of any whitespace between the width, height, and (if given) maxval fields in the header (it is only after the last field that exactly one whitespace character is allowed).
The format specification in magic/Magdir/images, however, assumes that there is exactly one space character (\ ) between width and height. This leads file to not correctly parse the width and height in files where the width and height are separated by other whitespace, e.g. a newline, two spaces, or a tab.
Tags: magic
Steps To Reproduce: Place the below into a file (not including quotes):
"P2
2
2
255
0 1 2 3"
`file` will report the file as `Netpbm image data, size = 0 x 1, greymap, ASCII text`, instead of `Netpbm image data, size = 2 x 2, greymap, ASCII text`
Additional Information: I believe this can be fixed by changing the regular expression on line 182 of magic/Magdir/images from "[0-9]{1,50}\ [0-9]{1,50}" to "[0-9]{1,50}[\040\t\f\r\n]+[0-9]{1,50}"

Attached files are reported as:
test1.pgm: `Netpbm image data, size = 0 x 0, greymap, ASCII text`
test2.pgm: `, rawbits, greymap`
but should be reported as:
test1.pgm: `Netpbm image data, size = 2 x 2, greymap, ASCII text`
test2.pgm: `Netpbm image data, size = 2 x 2, rawbits, greymap`
Attached Files: test1.pgm (19 bytes) 2021-12-06 06:32
https://bugs.astron.com/file_download.php?file_id=251&type=bug
pgm

test2.pgm (15 bytes) 2021-12-06 06:32
https://bugs.astron.com/file_download.php?file_id=250&type=bug
pgm
Notes
(0003684)
christos   
2021-12-17 14:43   
Fixed as suggested, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
302 [file] General minor have not tried 2021-12-04 03:35 2021-12-06 22:13
Reporter: calestyo Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: assigned Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: GPT not correctly detected as such, because of it's protective MBR
Description: Hey.

A file that contains a GPT (GUID Partition Table) is nonetheless detected as MBR, which is probably because every GPT contains a protective MBR just at the position where the regular MBR would be.

E.g.:
# gdisk -l example.img
GPT fdisk (gdisk) version 1.0.6

Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with protective MBR; using GPT.
Disk example.img: 16777216 sectors, 8.0 GiB
Sector size (logical): 512 bytes
Disk identifier (GUID): C93252EC-C2A3-41C8-9A12-ECF030C66D7E
Partition table holds up to 128 entries
Main partition table begins at sector 2 and ends at sector 33
First usable sector is 34, last usable sector is 16777182
Partitions will be aligned on 2048-sector boundaries
Total free space is 2014 sectors (1007.0 KiB)

Number Start (sector) End (sector) Size Code Name
   1 2048 67583 32.0 MiB EF00 EFI system partition
   2 67584 16777182 8.0 GiB 8300 Linux filesystem


whereas file only detects the MBR:
# file example.img
example.img: DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x0,0,2), end-CHS (0x3ff,255,63), startsector 1, 16777215 sectors, extended partition table (last)


Not really sure how one should (safely) detect a GPT.

The protective MBR always looks like this:
Expert command (? for help): o

Disk size is 16777216 sectors (8.0 GiB)
MBR disk identifier: 0x00000000
MBR partitions:

Number Boot Start Sector End Sector Status Code
   1 1 16777215 primary 0xEE

i.e. always type 0xEE ... but that alone is AFAIU not enough to say there's a GPT... furthermore, GPTs may not use a protective MBR at all.


The best is perhaps to just rely on the GPT signature, which is:
EFI PART at 0x0 (and I think with respect to the endianess)
(see https://en.wikipedia.org/wiki/GUID_Partition_Table#Partition_table_header_(LBA_1) )


Not sure if it makes sense to check for the backup GPT, probably not.

Cheers,
Chris.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003682)
christos   
2021-12-06 20:07   
file just does not look after the MBR for the GPT information... It could be made to look, but currently it does not.
(0003683)
calestyo   
2021-12-06 22:13   
Guess that would make sense... just like it looks deeper into various container formats to find out what's actually inside.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
301 [file] General minor N/A 2021-11-24 23:48 2021-12-06 19:59
Reporter: rowlap Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: feedback Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: sysstat magic
Description: Please find attached magic rules to recognise data files generated by sysstat.

Discussion thread
https://github.com/sysstat/sysstat/discussions/297
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: sysstat.magic (288 bytes) 2021-11-24 23:48
https://bugs.astron.com/file_download.php?file_id=248&type=bug
Notes
(0003681)
christos   
2021-12-06 19:59   
Have you read "new magic guidelines" in https://github.com/file/file? It is strongly recommended to not submit magic with an initial prefix of <= 16 bits.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
303 [file] General minor have not tried 2021-12-05 15:15 2021-12-06 19:33
Reporter: polluks Platform: PowerBook5,8  
Assigned To: christos OS: MorphOS  
Priority: normal OS Version: 3.15  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: False positive PCP
Description: Because it's a 3DS...
Tags:
Steps To Reproduce: > file *
ball.3ds: 3D Studio model
myAdder.3DS: 3D Studio model
myAnaconda.3ds: 3D Studio model
myCoriolis.3DS: 3D Studio model
myMissile.3DS: PCP memory mapped values (V.512)
myThargoid.3ds: 3D Studio model
Additional Information:
System Description
Attached Files: myMissile.3DS (1,366 bytes) 2021-12-05 15:15
https://bugs.astron.com/file_download.php?file_id=249&type=bug
Notes
(0003679)
polluks   
2021-12-06 12:22   
5.41 says "PCP memory mapped values (V.131072)" because of sgi vs cad
(0003680)
christos   
2021-12-06 19:33   
bumped strength

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
300 [file] General minor always 2021-11-20 08:45 2021-11-21 19:40
Reporter: JoshuaFern Platform: Linux  
Assigned To: christos OS: NixOS  
Priority: normal OS Version: 21.11  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Long GIF image doesn't show correct resolution
Description: I have a very long GIF, 630 x 52337. When running file the larger resolution is blank.
Tags:
Steps To Reproduce: Run the following:

file acidshowcase.gif
acidshowcase.gif: GIF image data, version 89a, 630 x
Additional Information: I'm new to file, hopefully this bug report is valid and useful. I will upload the file in question upon request, it's too large to upload to this bugtracker.
Attached Files:
Notes
(0003678)
christos   
2021-11-20 13:34   
No need, I can reproduce with:
$ pbmmake 630 52337 | pamtogif > /tmp/foo.gif

Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
293 [file] General minor always 2021-10-20 13:01 2021-11-19 16:49
Reporter: Yardanico Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: feedback Product Version: 5.40  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: file is too strict with Nim file detection
Description: https://bugs.astron.com/view.php?id=273 reported that Nim wasn't in the file database and Nim magic was subsequently added to the `file`, but it's too strict - the current magic definition was clearly written for `koch.nim` specifically, but Nim is a programming language with a lot of possible code.

I think checking for `import` and `let` is enough for some minimal level of detection (if no other language matches that), and then for more accurate checking you can also check for the existence of `proc` or `echo`. I'm aware that quite a lot of languages have both`import` and `let` as keywords, but I think that file's magics would be enough to differentiate between them?
Tags: bug, magic, nim-lang
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003660)
christos   
2021-10-28 15:49   
Well, you know the language better, why don't you propose a patch?

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
291 [file] General minor have not tried 2021-09-24 14:09 2021-11-16 19:35
Reporter: rootkea Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: assigned Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: scan-build reports multiple logic errors
Description: Hello!

On latest master, scan-build[0] reports multiple logical errors. Please see the scan-build report here: https://rootkea.gitlab.io/file/scan-build/

Here's the .gitlab-ci.yml which generated this scan-build report: https://gitlab.com/rootkea/file/-/raw/gitlab-scan-build/.gitlab-ci.yml

Thanks!

[0] https://clang-analyzer.llvm.org/scan-build
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003664)
christos   
2021-10-28 16:37   
Fixed all but the vfork() ones. Yes, lseek(2)/close(2) are not strictly legal to call after vfork(2), but if you follow the strict rules, then the number of cases you can use vfork(2) become close to 0.
(0003667)
rootkea   
2021-10-29 05:11   
Can we replace `vfork()` with safer `posix_spawn()` as suggested by scan-build?
(0003677)
christos   
2021-11-16 19:35   
We can, and perhaps we should. It is a bit of work though... We'd also want to keep the old vfork code (or change it to use fork) for systems that don't have posix_spawn

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
271 [file] General minor always 2021-06-13 06:11 2021-11-14 12:21
Reporter: DaarkWel Platform:  
Assigned To: administrator OS:  
Priority: normal OS Version:  
Status: assigned Product Version: 5.40  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: MIME type for .nef needs to be image/x-nikon-nef
Description: MIME type for .nef files is "image/tiff" but it needs to be "image/x-nikon-nef". Mimetype from perl-file-mimeinfo shows it right.

file --mime-type /tmp/DSC_1234.nef
/tmp/DSC_1234.nef: image/tiff

mimetype /tmp/DSC_1234.nef
/tmp/DSC_1234.nef: image/x-nikon-nef
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003614)
administrator   
2021-06-30 09:46   
Do you have an example .nef file I can test with?
(0003629)
DaarkWel   
2021-07-14 08:24   
Sorry for delay. Yes.

https://mega.nz/file/4MsXkKJJ#kH1v5XHPXkWReCJBFFh-RKJW_1aTGCVm9N6wpAFZkbY
(0003640)
maxicarlos0   
2021-08-30 11:42   
Same issue here, this causes a lot if image viewing programs to fail opening raw images (NEF, ARW tested)
(0003674)
Tamaranch   
2021-11-14 12:20   
Attached is another example of a NEF file recognized as TIFF.
It comes from https://filesamples.com/categories/image where you can also find examples of PEF and DNG files recognized as TIFF.
(0003675)
Tamaranch   
2021-11-14 12:21   
Not possible to attach the file in fact: too big.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
298 [file] General minor always 2021-11-08 07:53 2021-11-14 12:12
Reporter: Tamaranch Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: SVGZ compressed image files created by Inkscape are identified as application/gzip
Description: Inkscape can create two types of SVGZ formats: lossy and lossless.
Both are identified by `file` or `magic_file()` as application/gzip, while a library like librsvg is able to recognize them and allow their loading via gdk-pixbuf.
Tags: magic
Steps To Reproduce: Open an SVG image file in Inkscape and save it as SVGZ.
Additional Information:
Attached Files: splash.svg (11,867 bytes) 2021-11-13 18:22
https://bugs.astron.com/file_download.php?file_id=245&type=bug
svg

org.xfce.ristretto_inkscape_simple.svgz (4,530 bytes) 2021-11-13 18:22
https://bugs.astron.com/file_download.php?file_id=244&type=bug
svgz

org.xfce.ristretto_inkscape.svgz (5,246 bytes) 2021-11-13 18:22
https://bugs.astron.com/file_download.php?file_id=243&type=bug
svgz

org.xfce.ristretto.svg (30,221 bytes) 2021-11-13 18:22
https://bugs.astron.com/file_download.php?file_id=242&type=bug
svg

org.xfce.mousepad_inkscape_simple.svgz (8,650 bytes) 2021-11-13 18:22
https://bugs.astron.com/file_download.php?file_id=241&type=bug
svgz

org.xfce.mousepad_inkscape.svgz (9,394 bytes) 2021-11-13 18:22
https://bugs.astron.com/file_download.php?file_id=240&type=bug
svgz

org.xfce.mousepad.svg (98,088 bytes) 2021-11-13 18:22
https://bugs.astron.com/file_download.php?file_id=239&type=bug
svg

splash_inkscape_simple.svgz (4,510 bytes) 2021-11-13 18:22
https://bugs.astron.com/file_download.php?file_id=247&type=bug
svgz

splash_inkscape.svgz (4,838 bytes) 2021-11-13 18:22
https://bugs.astron.com/file_download.php?file_id=246&type=bug
svgz
Notes
(0003669)
christos   
2021-11-13 17:49   
Can you please attach a couple of sample files?
(0003670)
Tamaranch   
2021-11-13 18:22   
Here are three file: original (*.svg), Inkscape lossly (*_inkscape_simple.svgz), Inkscape lossless (*_inkscape.svgz).
(0003671)
christos   
2021-11-14 01:08   
Thanks, these are just compressed files; use file -z to see what's inside.
(0003672)
Tamaranch   
2021-11-14 11:38   
Oh right, and so the `MAGIC_COMPRESS` flag for libmagic.
I was misled by the fact that the .svgz (or .svg.gz) files produced by `convert file.svg file.svgz` were recognized directly.
But they are actually still SVG files in this case, unlike the files linked here.

I'll try to push my tests a bit further and read the documentation better before reporting a bug next time, sorry ^^'.
Thanks!
(0003673)
christos   
2021-11-14 12:12   
No fix necessary, files are just compressed.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
286 [file] General minor always 2021-09-04 15:53 2021-11-14 11:57
Reporter: maxicarlos0 Platform: 64 Bit  
Assigned To: christos OS: Arch Linux  
Priority: normal OS Version: up to date  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: MIME of raw images detected as image/tiff
Description: Recently, `file` started to detect raw images (NEF and ARW tested) as image/tiff.
This breaks a lot of image viewing programs such as Gwenview, lximage, Okular, and many more.

This wasn't like that always, I remember being able to correctly detect raw images a month ago or so.

Thanks in advance.
Tags:
Steps To Reproduce: Get a raw image (eg. http://www.luminescentphoto.com/nx2/nefs.html)
run `file RAW_IMAGE` or `file --mime-type RAW_IMAGE`
The output will say that it's a image/tiff image when it should be image/x-nikon-nef
Additional Information: `mimetype` recognizes the MIME correctly...
System Description
Attached Files:
Notes
(0003643)
christos   
2021-09-11 19:33   
I don't think that file(1) ever reported anything else but tiff for these files. They are tiff files after all...
(0003644)
maxicarlos0   
2021-09-11 20:48   
you might be right, I just checked and the last time file got updated was something around May, way before this problem started happening (in KDE)
(0003653)
christos   
2021-10-28 15:33   
Feedback timeout.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
299 [file] General minor always 2021-11-12 08:24 2021-11-13 17:48
Reporter: adepasquale Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.41  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Separate magic for uuencode and xxencode
Description: Current file 5.41 doesn't distinguish between uuencode and xxencode.

I have updated the magic files based on existing comments, see attached patch.

Note that some archivers (e.g. https://wiki.powerarchiver.com/en:help:main:tools:uuencode_xxencode_mime_base64_yenc) do not have the "begin " keyword at zero, so I had to use a regex/1024.
Tags: magic
Steps To Reproduce:
Additional Information:
Attached Files: uuencode.patch (1,276 bytes) 2021-11-12 08:24
https://bugs.astron.com/file_download.php?file_id=238&type=bug
Notes
(0003668)
christos   
2021-11-13 17:48   
Applied, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
292 [file] General minor always 2021-10-18 11:00 2021-10-28 16:41
Reporter: mikewalrus Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: HTML files with LaTeX keywords are identified as LaTeX files.
Description: An HTML file containing magic entries like `\begin' is identified as a "LaTeX document".
Tags: magic
Steps To Reproduce: Save the following to a.html, and run file on it.

<!doctype html>
<html>
<head>
<title>title</title>
</head>
<body>


\begin{a}


</body>
</html>
Additional Information:
Attached Files:
Notes
(0003666)
christos   
2021-10-28 16:41   
Bumped the strength of HTML to beat LaTeX, but it is unclear if this is a win considering the opposite case :-)

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
296 [file] General major always 2021-10-24 10:21 2021-10-28 16:39
Reporter: eliz Platform: MinGW  
Assigned To: christos OS: MS-Windows  
Priority: normal OS Version: XPSP3  
Status: assigned Product Version: 5.40  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Problems building file-5.41 with MinGW on MS-Windows
Description: I've built the latest version 5.41 of file natively on MS-Windows using MinGW tools. (Yes, version 5.41; the bug tracker doesn't allow to select that version when reporting an issue.)

I've found several problems while building, described below. Let me know if you want me to attach proposed patches for any of those.

First, there are multiple compilation warnings due to C99 formatted output features, like the '#' flag and the %z or %j descriptors. (file.h has portability macros for taking care of that, but they are not used everywhere, and don't cover the '#' flag, for example.)

Next, compress.c triggers several warnings because variables and functions used only if HAVE_FORK are declared or defined without that conditional, so they are unused in a build without HAVE_FORK.

The function 'sread' uses 'ioctl' for sockets and pipes, but that cannot compile on Windows, and won't work even if tweaked (e.g., 'select' doesn't work on Windows pipes). So this needs to be #ifdef'ed away. Same for calls to 'fcntl' in funcs.c.

In magic.c, I added support for the HOME environment variable on MS-Windows. While this variable is not normally set on Windows, many users of ported Unix software have it set, so it is useful to support that.

The function 'unreadable_info' in magic.c calls 'access' with X_OK, which doesn't work well, or not at all, on MS-Windows, so I replaced it with a simple test of the file's extension to detect executables based on that.

Thanks for developing this package.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: DIFFS.mingw (12,033 bytes) 2021-10-28 16:39
https://bugs.astron.com/file_download.php?file_id=237&type=bug
Notes
(0003657)
christos   
2021-10-28 15:36   
Sure, please send patches.
(0003665)
eliz   
2021-10-28 16:39   
I attach patches for MinGW-related issues.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
297 [file] General major always 2021-10-24 13:52 2021-10-28 16:34
Reporter: eliz Platform: MinGW  
Assigned To: christos OS: MS-Windows  
Priority: normal OS Version: XPSP3  
Status: assigned Product Version: 5.40  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Looking inside compressed files disabled in builds which don't define HAVE_FORK
Description: Building version 5.41 on a system that doesn't have 'fork' disables built-in support for accessing compressed files, even if decompression libraries (zlib, liblzma, etc.) are available and enabled during configure run. For example 'file_zmagic' isn't even called if HAVE_FORK is not defined to a non-zero value.

I've reshuffled the various #define's and made some minor changes to the code to enable built-in decompression support when HAVE_FORK is not available. let me know if you are interested in the patch to do that.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: DIFFS.fork (6,155 bytes) 2021-10-28 16:34
https://bugs.astron.com/file_download.php?file_id=236&type=bug
Notes
(0003651)
christos   
2021-10-28 15:31   
Sure, please send me the patch.
(0003663)
eliz   
2021-10-28 16:34   
I attach the patches for the 'fork' problem.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
295 [file] General minor always 2021-10-23 17:31 2021-10-28 16:20
Reporter: eliz Platform: MS-Windows  
Assigned To: christos OS: XP  
Priority: normal OS Version: SP3  
Status: assigned Product Version: 5.41  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: pgp-binary-key-v4-dsa test fails due to incorrect expected result
Description: This test fails:

     Running test: ../tests/pgp-binary-key-v4-dsa.testfile
     ../tests/pgp-binary-key-v4-dsa.testfile: OpenPGP Public Key Version 4, Created Mon Apr 07 22:23:01 1997, DSA (1024 bits); User ID; Signature; OpenPGP Certificate
     test.exe: ERROR: result was (len 120)
     OpenPGP Public Key Version 4, Created Mon Apr 07 22:23:01 1997, DSA (1024 bits); User ID; Signature; OpenPGP Certificate
     expected (len 121)

This is because the expected result says "Mon Apr 7" instead of "Mon Apr 07" (2 spaces instead of a space an zero). Correcting the expected result makes the test succeed.
Tags:
Steps To Reproduce: make check
Additional Information:
Attached Files:
Notes
(0003650)
eliz   
2021-10-24 05:56   
By the way, this is for version 5.41, not 5.40; but the bug tracker doesn't allow to select 5.41 as the version for the bug.
(0003658)
christos   
2021-10-28 15:43   
Your libc is broken: file(1) just uses ctime/asctime: https://pubs.opengroup.org/onlinepubs/9699919799/
(0003659)
christos   
2021-10-28 15:47   
Added 5.41 to the list of releases.
(0003662)
eliz   
2021-10-28 16:20   
That broken libc is MSVCRT. the C runtime used by MinGW builds on MS-Windows. So I guess this means that test will fail for any MinGW build, unless the expected results are manually "fixed".

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
294 [file] General feature always 2021-10-21 21:06 2021-10-28 15:53
Reporter: Jamie Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: HEAD  
    Target Version:  
Summary: Magic bytes c64 .dfi format
Description: Hello everyone,

attached is a patch for recognizing the c64 .dfi file format.

Currently such files are reported as data:

    $ file --version
    file-5.40
    magic file from /usr/share/file/misc/magic
    seccomp support included

    $ file --keep-going 10_Years_HVSC.dfi
    10_Years_HVSC.dfi: data

I got the structure from https://www.lemon64.com/forum/viewtopic.php?t=37415&sid=494dc2ca91289e05dadf80a7f8a968fe (at the bottom).
More general information about the format can be found at https://www.c64-wiki.com/wiki/DreamLoad.

An example file can be found in the HVSC Commodore 64 music collection, for example at https://kohina.duckdns.org/HVSC/C64Music/10_Years_HVSC.dfi.

Do you think it makes sense to include this?

Best,
Jamie
Tags: magic
Steps To Reproduce:
Additional Information:
Attached Files: c64.patch (476 bytes) 2021-10-21 21:06
https://bugs.astron.com/file_download.php?file_id=235&type=bug
Notes
(0003649)
Jamie   
2021-10-21 21:09   
With the patch applied, the output is as follows:

    $ file --magic-file tmp.magic 10_Years_HVSC.dfi
    10_Years_HVSC.dfi: DFI Image version: 1.0 tracks: 4
(0003661)
christos   
2021-10-28 15:53   
Added!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
276 [file] General minor always 2021-07-26 15:24 2021-10-28 15:33
Reporter: abathur Platform: intel/x86_64  
Assigned To: christos OS: macOS  
Priority: normal OS Version: 10.15  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: between 5.37 and 5.39, file starts identifying bin/sh script with patched shebang as awk/perl
Description: I noticed a patched copy of esh 0.1.1 getting identified as an "awk or perl script" by newer versions of file (confirmed I see this in file 5.39 from nixpkgs and file 5.40 from homebrew).

I've attached an unpatched copy named `esh` and a patched copy named `nix_esh`, but I assume the salient part is the fact that it has had its shebang patched from /bin/sh to /nix/store/pcjan45rssdn01cxx3sjg70avjg6c3ni-bash-4.4-p23/bin/sh

Output here is captured on macOS, but I've confirmed the same behavior with file 5.39 in Linux (NixOS).
Tags:
Steps To Reproduce: # system/macOS file
$ file --version
file-5.37
magic file from /usr/share/file/magic

# unpatched /bin/sh shebang
$ file esh
esh: POSIX shell script text executable, ASCII text

# shebang patched by Nix to /nix/store/pcjan45rssdn01cxx3sjg70avjg6c3ni-bash-4.4-p23/bin/sh
$ file nix_esh
nix_esh: a /nix/store/pcjan45rssdn01cxx3sjg70avjg6c3ni-bash-4.4-p23/bin/sh script text executable, ASCII text

# file from nixpkgs
$ file --version
file-5.39
magic file from /nix/store/77p3lid93i5xjgdi9vkj3zqcpf2zddlw-file-5.39/share/misc/magic

# unpatched /bin/sh shebang
$ file esh
esh: POSIX shell script, ASCII text executable

# shebang patched by Nix to /nix/store/pcjan45rssdn01cxx3sjg70avjg6c3ni-bash-4.4-p23/bin/sh
$ file nix_esh
nix_esh: awk or perl script, ASCII text

# file from homebrew
$ file --version
file-5.40
magic file from /usr/local/Cellar/libmagic/5.40/share/misc/magic

# unpatched /bin/sh shebang
$ file esh
esh: POSIX shell script, ASCII text executable

# shebang patched by Nix to /nix/store/pcjan45rssdn01cxx3sjg70avjg6c3ni-bash-4.4-p23/bin/sh
$ file nix_esh
nix_esh: awk or perl script, ASCII text
Additional Information:
Attached Files: nix_esh (4,710 bytes) 2021-07-26 15:24
https://bugs.astron.com/file_download.php?file_id=232&type=bug
esh (4,302 bytes) 2021-07-26 15:24
https://bugs.astron.com/file_download.php?file_id=231&type=bug
Notes
(0003630)
christos   
2021-07-30 08:44   
With the HEAD of the file code this reports:
$ ./file -m ../magic/magic.mgc ~/nix_esh
/Users/christos/nix_esh: a /nix/store/pcjan45rssdn01cxx3sjg70avjg6c3ni-bash-4.4-p23/bin/sh script, ASCII text executable
(0003633)
abathur   
2021-07-31 22:28   
Thanks--I'll keep an eye out for the next release.

(I do see the same after figuring out how to rebuild the Nix package from the latest commit on the GH mirror).
(0003654)
christos   
2021-10-28 15:33   
Release has been out.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
290 [file] General minor always 2021-09-20 13:34 2021-10-28 15:32
Reporter: ChaoticRoman Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Wrong installation instructions in both INSTALL and README.DEVELOPER files
Description: In the INSTALL, there are generic "./configure; make; make install" instructions but it seems that correct process is

autoreconf -f -i
./configure --disable-silent-rules
make
make install

In the README.DEVELOPER, there is

    autoreconf -f -i
    make distclean
    ./configure --disable-silent-rules
    make -j4
    make -C tests check

but "make distclean" would complain "make: *** No rule to make target distclean'".

Tested on Ubuntu 20.04 by myself.

Original report: https://stackoverflow.com/questions/69222631/46-regex-error-17-for-dryad-bibo-v0-9-0-9-match-failed
Tags:
Steps To Reproduce: ./configure
autoreconf -f -i
make distclean
Additional Information:
Attached Files:
Notes
(0003645)
christos   
2021-09-20 14:05   
I added a comment that it can fail in README.DEVELOPER. The INSTALL file is fine because it instructs you to use 'make distclean' to cleanup after a previous build.
(0003652)
christos   
2021-10-28 15:32   
Feedback timeout.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
288 [file] General minor always 2021-09-13 07:18 2021-09-20 17:46
Reporter: Cirn09 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: Naming conflict when compiling libmagic as Windows static library
Description: hello,
I want build `libmagic` as static library for Windows. But `libmagic` define the `DllMain` in `magic.c`:
```
/* Placate GCC by offering a sacrificial previous prototype */
BOOL WINAPI DllMain(HINSTANCE, DWORD, LPVOID);

BOOL WINAPI
DllMain(HINSTANCE hinstDLL, DWORD fdwReason,
    LPVOID lpvReserved __attribute__((__unused__)))
{
    if (fdwReason == DLL_PROCESS_ATTACH)
        _w32_dll_instance = hinstDLL;
    return 1;
}
```
This causes naming conflicts when linking libmagic to a dynamic library:
> `libmagic.lib(magic.obj) : error LNK2005: DllMain already defined in dllmain.obj`

`DllMain` is only used to initialize `_w32_dll_instance`.
In fact, for static libraries, `_w32_dll_instance` is not needed.
`_w32_dll_instance` only used in `get_default_magic`

```
private const char *
get_default_magic(void)
{
...
    /* Fourth, try to get magic file relative to exe location */
        _w32_get_magic_relative_to(&hmagicpath, NULL);

    /* Fifth, try to get magic file relative to dll location */
        _w32_get_magic_relative_to(&hmagicpath, _w32_dll_instance);
    /* Fifth, try to get magic file relative to dll location */
        _w32_get_magic_relative_to(&hmagicpath, _w32_dll_instance);
...
static void
_w32_get_magic_relative_to(char **hmagicpath, HINSTANCE module)
{
...
    if (!GetModuleFileNameA(module, dllpath, MAX_PATH))
...
```
> Parameters
> hModule
> A handle to the loaded module whose path is being requested. If this parameter is **NULL**,
> GetModuleFileName retrieves the path of the executable file of the current process.
> https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulefilenamea

I think to solve this problem need to add a new macro judgment, like:
```
#ifndef BUILD_AS_WINDOWS_STATIC_LIBARAY
BOOL WINAPI DllMain(HINSTANCE, DWORD, LPVOID)
...
#endif
```
Tags: build
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003646)
christos   
2021-09-20 17:46   
Added as suggested, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
287 [file] General minor always 2021-09-09 17:23 2021-09-11 19:20
Reporter: alealbonico Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: MIME of message/rfc822 detected as text/plain
Description: Email files with MIME message/rfc822 are being detected as text/plain because said file's header starts with "Date:" instead of "From:" or "Received:".

I checked the documentation for the standard way to write a rfc822 message and it looks like date is actually allowed to be on the first line, too.

Thanks in advance.
Tags:
Steps To Reproduce: Get a rfc822 file and place the header date as the first line in it.

Example of file:
-------

Date: Fri, 07 Aug 2020 02:09:32 +0100
From: "xxxx" <xxxx@gmail.com>
To: "yyyy" <yyyy@gmail.com>
Subject: zzzzzzzz
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--464994466596adLKMdfn3566452152"
X-Rejection-Reason: zzzzzz

----464994466596adLKMdfn3566452152
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

[redacted]
----464994466596adLKMdfn3566452152
Content-Type: application/msword; name="xxxx"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="xxxx"

xyz

----464994466596adLKMdfn3566452152--

-------

Try to get the MIME type.
Output: text/plain

Notice that removing date and leaving "from" on top instead will return the correct output.
Additional Information:
Attached Files:
Notes
(0003642)
christos   
2021-09-11 19:20   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
285 [file] General block always 2021-08-26 09:25 2021-09-09 17:49
Reporter: Benjamin Platform: Linux  
Assigned To: christos OS: Ubuntu  
Priority: normal OS Version: Ubuntu 18.04.5  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: Python biding of libmagic crash when trying to detect encoding in multithread
Description: Hello,

When i use the following code in a multithreaded environment (some django workers using Huey or Dramatiq)

magic.detect_from_content(
            bytes_file.read(MAX_BYTES)
        ).encoding

I got some:

  File "/home/benjamin/.cache/pypoetry/virtualenvs/qvNem8AN-py3.9/lib/python3.9/site-packages/magic.py", line 284, in detect_from_content
    return _create_filemagic(mime_magic.buffer(byte_content),
  File "/home/benjamin/.cache/pypoetry/virtualenvs/qvNem8AN-py3.9/lib/python3.9/site-packages/magic.py", line 251, in _create_filemagic
    mime_type, mime_encoding = mime_detected.split('; ')
ValueError: too many values to unpack (expected 2)

With the reproductible code given in this ticket errors can be differents ("munmap_chunk(): invalid pointer", "free(): invalid size", "double free or corruption (fasttop)")


It works correctly on a single thread.

Tags: magic
Steps To Reproduce:

import threading

import magic

MAX_BYTES = 4096


def thread_function():
    with open("/tmp/foo.csv", "rb") as bytes_file:
        print(magic.detect_from_content(
            bytes_file.read(MAX_BYTES)
        ).encoding)


if __name__ == '__main__':
    threads = list()
    for index in range(3):
        thread = threading.Thread(target=thread_function)
        threads.append(thread)
        thread.start()

    for index, thread in enumerate(threads):
        thread.join()
Additional Information:
My ubuntu libmagic1 version is: 1:5.32-2ubuntu0.4
My file-magic python packaque is 0.4.0
Attached Files:
Notes
(0003641)
christos   
2021-09-09 17:49   
Thanks, fixed in HEAD. Will release as 0.4.1 when I release the next version of file(1).

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
284 [file] General feature always 2021-08-18 23:35 2021-08-24 09:25
Reporter: ntavares Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: New file format - SER video sequence
Description: Hi there,

I found it strange that there was no magic for SER files, please add it. This is a very popular video format among astrophotographers.

It's a video file, so I'm not attaching a sample. I could provide the header from a real file, though, if it's useful.

Just let me know.
-NT
Tags:
Steps To Reproduce: # SER file format - simple uncompressed video format for astronomical use
# Initially developed by Lucam Recorder, as of 2021 maintained by Heiko Wilkens, Grischa Hahn
# Typical extensions: .SER
# V3 - http://www.grischa-hahn.homepage.t-online.de/astro/ser/SER%20Doc%20V3b.pdf

0 string LUCAM-RECORDER SER video sequence
>18 lelong 0 \b, bayer: mono
>18 lelong 8 \b, bayer: RGGB
>18 lelong 9 \b, bayer: GRBG
>18 lelong 10 \b, bayer: GBRG
>18 lelong 11 \b, bayer: BGGR
>18 lelong 16 \b, bayer: CYYM
>18 lelong 17 \b, bayer: YCMY
>18 lelong 18 \b, bayer: YMCY
>18 lelong 19 \b, bayer: MYYC
>18 lelong 100 \b, bayer: RGB
>18 lelong 101 \b, bayer: BGR
>22 lelong 0 \b, big-endian
>22 lelong 1 \b, little-endian
>26 lelong x \b, width: %d
>30 lelong x \b, height: %d
>34 lelong x \b, %d bit
>38 lelong x \b, frames: %d
Additional Information:
Attached Files:
Notes
(0003639)
christos   
2021-08-24 09:25   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
281 [file] General trivial always 2021-08-11 16:08 2021-08-16 10:20
Reporter: pwinckles Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: epub files report duplicate format names
Description: When you execute file on an epub file the output contains a duplicate format name: EPUB document EPUB document
Tags:
Steps To Reproduce: 1. Get an epub file (example: https://github.com/openpreserve/format-corpus/blob/master/ebooks/calibre%200.9.0/lorem-ipsum.epub)
2. Execute file on the file
3. See output like: lorem-ipsum.epub: EPUB document EPUB document
Additional Information:
Attached Files:
Notes
(0003637)
christos   
2021-08-16 10:20   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
279 [file] General major always 2021-08-05 03:20 2021-08-16 10:13
Reporter: Jayc3Ca0 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: Java source code is reported as C source file
Description: Java source code file is reported as C source file by file command.
Tags: magic
Steps To Reproduce: Write the following Java sample code (TestJava.java):

public class TestJava {
    public static void main(String[] args) {
        System.out.println("Hello Java");
    }
}

Use file command of the latest version to check its type:

$ file TestJava.java
TestJava.java: C source, ASCII text


Additional Information: Tested on macOS 11.3.1 with version 5.40, which is installed by homebrew.
Also tested on CentOS 7 with version 5.11.37, which is installed by yum.
Attached Files:
Notes
(0003636)
christos   
2021-08-16 10:13   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
280 [file] General trivial always 2021-08-09 21:55 2021-08-16 10:07
Reporter: rouca Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: Detect silverlight
Description: Hi,

Just send a mail to mailing list copy paste here:
In order to remove problematic source from debian we want to detect
silverlight compiled program

Some example:
http://cespage.com/silverlight/tutorials/sl4tut1.xap
https://www.microsoft.com/silverlight/new-controls/demo/System.Windows.Controls.Samples.xap

It seems that AppManifest.xaml string is present in the zip file
(uncompressed)...

Thanks

Bastien
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003635)
christos   
2021-08-16 10:07   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
277 [file] General feature N/A 2021-07-26 18:07 2021-07-30 12:25
Reporter: polluks Platform: PowerBook5,8  
Assigned To: christos OS: MorphOS  
Priority: normal OS Version: 3.15  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: More Plan 9
Description: Added object files
Tags: magic
Steps To Reproduce:
Additional Information:
System Description
Attached Files: plan9 (1,146 bytes) 2021-07-26 18:07
https://bugs.astron.com/file_download.php?file_id=233&type=bug
Notes
(0003632)
christos   
2021-07-30 12:25   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
275 [file] General minor always 2021-07-19 13:50 2021-07-30 11:47
Reporter: pwinckles Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: PDFs with /Filter/FlateDecode streams are incorrectly marked as "password protected"
Description: This commit[1] introduces a change that appears to label PDFs containing /Filter/FlateDecode streams as "password protected". I'm no PDF expert, but this designation seems incorrect as it just indicates that the stream is compressed. It may or may not be encrypted.


[1] https://github.com/file/file/commit/629972a91e05fcad8a1b5d906344838539b5f7ab#diff-1d80c89187edc2a2fab5b3ef59fadc199e03d7c8319e7e41e2bd1f329c00fee7
Tags:
Steps To Reproduce: 1. Download the following example PDF: https://github.com/harvard-lts/fits/blob/dev/testfiles/PDF_embedded_resources.pdf
2. Execute: file PDF_embedded_resources.pdf
3. See the following output, even though the file is not password protected: PDF_embedded_resources.pdf: PDF document, version 1.6 (password protected)
Additional Information:
Attached Files:
Notes
(0003631)
christos   
2021-07-30 11:47   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
239 [file] General feature N/A 2021-02-18 22:57 2021-07-27 22:20
Reporter: polluks Platform: PowerBook5,8  
Assigned To: christos OS: MorphOS  
Priority: normal OS Version: 3.15  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: More IFF magic again
Description: --- iff.bak 2020-10-27 00:41:15 +0100
+++ iff 2021-02-18 22:41:57 +0100
@@ -44,6 +44,7 @@
 >8 string FANT \b, Fantavision animation
 >8 string ACBM \b, ACBM continuous image
 >8 string FAXX \b, FAXX fax image
+>8 string STFX \b, ST-Fax image
 # other formats
 >8 string FTXT \b, FTXT formatted text
 >8 string CTLG \b, CTLG message catalog
Tags: magic
Steps To Reproduce:
Additional Information:
System Description
Attached Files:
Notes
(0003554)
polluks   
2021-02-20 17:34   
Update
--- iff.bak 2020-10-27 00:41:15 +0100
+++ iff 2021-02-20 18:28:42 +0100
@@ -44,6 +44,7 @@
 >8 string FANT \b, Fantavision animation
 >8 string ACBM \b, ACBM continuous image
 >8 string FAXX \b, FAXX fax image
+>8 string STFX \b, ST-Fax image
 # other formats
 >8 string FTXT \b, FTXT formatted text
 >8 string CTLG \b, CTLG message catalog
@@ -54,6 +55,7 @@
 >8 string WZRD \b, WZRD StormWIZARD resource
 >8 string DOC\ \b, DOC desktop publishing document
 >8 string SWRT \b, SWRT Final Copy/Writer document
+>8 string WORD \b, ProWrite document
 >8 string WTXT \b, WTXT Wordworth document
 >8 string WOWO \b, WOWO Wordworth document
 >8 string WVQA \b, Westwood Studios VQA Multimedia,
(0003556)
christos   
2021-02-23 01:07   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
274 [tcsh] General minor always 2021-07-09 12:04 2021-07-09 16:10
Reporter: polarnik Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 6.23.00  
    Target Version:  
Summary: Regression: slashes dropped on directory tab completion
Description: A commit on 2021-07-05 introduced a regression, in that terminal slashes are now dropped on directory tab completion.
Tags:
Steps To Reproduce: $ cd /bin/<tab>

expected: dir1/ dir2/ ...
actual: dir1 dir2
Additional Information: The last known working version is ed9ba69fe360d5b1110e4b1e71995ccf3eb72925.

The regression was introduced by one of two commits on 2021-07-05:

b5160d8de71e29c7cfa29efd26bcf149863ac544 -or- 9ad196ca789236217a9d7d330bc08a4e0b38bd57


----------

A subset of my settings:

set autoexpand
set autolist
set filec
complete cd 'p/1/d/'
Attached Files:
Notes
(0003627)
polarnik   
2021-07-09 12:08   
Minor correction: in steps to repro, it should have been a directory with subdirs: e.g. cd /<tab>
(0003628)
christos   
2021-07-09 16:10   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
273 [file] General minor have not tried 2021-07-04 18:25 2021-07-05 11:56
Reporter: timothee Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: nim files reported as ASCII text
Description: nim files reported as ASCII text
eg: this file https://github.com/nim-lang/Nim/blob/devel/koch.nim
should be reported as
nim program text, ASCII text
instead of: ASCII text


Tags:
Steps To Reproduce: create a file koch.nim with a nim extension (or download https://github.com/nim-lang/Nim/blob/devel/koch.nim)
type `file koch.nim`
shows:
koch.nim: ASCII text
Additional Information:
Attached Files:
Notes
(0003625)
christos   
2021-07-05 09:49   
Committed some magic.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
258 [tcsh] General feature always 2021-04-10 17:08 2021-07-05 10:41
Reporter: ajr Platform: Mac  
Assigned To: christos OS: macOS Big Sur  
Priority: normal OS Version: 11.2.3  
Status: resolved Product Version: 6.22.03  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 6.23.00  
    Target Version:  
Summary: ls-F and file expansion do not support 'ln=target' in LS_COLORS
Description: GNU ls and bash allow for 'ln=target' in LS_COLORS. This sets the color to that of the file pointed to while maintaining the '@' suffix. In tcsh it comes out as "argetm" since it assembles the color string as "\e[targetm".

Changes to tw.decls.h, tw.color.c, and tw.parse.c (attached) implements support for ln=target
Tags:
Steps To Reproduce:
Additional Information: Diffs can be seen at https://github.com/ajrosen/tcsh/commit/b516f30f4849267a1e953c4f3fa613805415bf82
Attached Files: tw.parse.c (58,277 bytes) 2021-04-10 17:08
https://bugs.astron.com/file_download.php?file_id=219&type=bug
tw.decls.h (5,030 bytes) 2021-04-10 17:08
https://bugs.astron.com/file_download.php?file_id=218&type=bug
tw.color.c (13,267 bytes) 2021-04-10 17:08
https://bugs.astron.com/file_download.php?file_id=217&type=bug
Notes
(0003626)
christos   
2021-07-05 10:41   
committed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
272 [file] General minor always 2021-06-28 09:27 2021-07-01 07:52
Reporter: kiefermat Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: Missing separator in multiple mimetypes for some files
Description: When getting the mimetype of an mp3 file (e.g. https://filesamples.com/samples/audio/mp3/sample1.mp3) using the -k flag ("file -k --mime-type sample1.mp3"), file 5.40 reports the following mimetype:
audio/mpegapplication/octet-stream

Version 5.39 reports it as
audio/mpeg
- application/octet-stream
Tags:
Steps To Reproduce: file -k --mime-type sample1.mp3
Additional Information:
Attached Files:
Notes
(0003623)
christos   
2021-07-01 07:52   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
268 [file] General feature N/A 2021-06-03 12:04 2021-06-30 12:01
Reporter: benedikt Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: reopened  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: Magic number and MIME type registration for Resilient Logic
Description: To whom I may concern,

I have just registered the MIME-type application/vnd.resilient.logic for my company.
The official entry at IANA can be found here: https://www.iana.org/assignments/media-types/application/vnd.resilient.logic

I'd like to have it included in the list of magic numbers that file includes.
The magic number sequence of this file format is 0x07, 0x52, 0x4c, 0x4d.


Best regards,
Benedikt Muessig
Resilient TechEd GmbH
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: resilient_logic_test.rlm (87 bytes) 2021-06-30 10:40
https://bugs.astron.com/file_download.php?file_id=230&type=bug
Notes
(0003617)
christos   
2021-06-30 10:23   
Thanks, added magic, but without an example file, I can't test.
(0003619)
benedikt   
2021-06-30 10:39   
Hello Christos,

thank you for taking care of adding the magic number.
I am sorry for not providing you with an example file.

I've just uploaded one here: https://c.gmx.net/@702592736817053755/K7lhZLD2Rqujc5BS-bbm0w


Best regards,
Benedikt
(0003620)
benedikt   
2021-06-30 10:40   
For some reason the file upload section did not show up earlier. This is a re-upload of the other file.

BR,
Benedikt
(0003621)
benedikt   
2021-06-30 11:37   
I've got two more questions, if you don't mind:

In the updated mime file, it says ">4 beshort x \b, version %d".
I suppose that beshort means 16 bit, big endian.
The file version though is just one 8-bit byte, where the high 4 bits are the major and the low 4 bits the minor version.

The other question is, if it is possible to add the mime-type, so that it works with `file --mime-type`?

Best regards and thanks,
Benedikt
(0003622)
christos   
2021-06-30 12:01   
Should be all better now.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
267 [file] General major always 2021-05-31 17:15 2021-06-30 10:25
Reporter: xexaxo Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: File detects CPIO files as "application/octet-stream"
Description: Using --mime with CPIO files made by bsdtar, seems to detected incorrectly.

In particular:
 file --mime foo.cpio
 foo.cpio: application/octet-stream; charset=binary

On the other hand, when omitting the --mime it is detected properly:
 file foo.cpio
 foo.cpio: ASCII cpio archive (SVR4 with no CRC)

The file foo.cpio was created using the following:
 echo test > test-file
 LANG=C bsdtar --uid 0 --gid 0 --null -cf - --format=newc test-file > foo.cpio
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003609)
xexaxo   
2021-05-31 17:19   
In case it matters, xdg-mime correctly detects the file:
 xdg-mime query filetype foo.cpio
 application/x-cpio
(0003610)
polluks   
2021-06-03 21:45   
--- archive.bak 2021-04-26 09:54:42 +0200
+++ archive 2021-06-03 23:43:29 +0200
@@ -169,6 +169,7 @@
 !:mime application/x-cpio # encoding: swapped
 0 string 070707 ASCII cpio archive (pre-SVR4 or odc)
 0 string 070701 ASCII cpio archive (SVR4 with no CRC)
+!:mime application/x-cpio
 0 string 070702 ASCII cpio archive (SVR4 with CRC)
 
 #
(0003611)
xexaxo   
2021-06-04 15:10   
Thanks polluks - your suggestion works like a charm.
Now if I can figure out how this fix can get merged into the official tree...
(0003618)
christos   
2021-06-30 10:25   
Fixed, thanks

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
269 [file] General crash always 2021-06-07 16:40 2021-06-30 10:12
Reporter: roneyth Platform:  
Assigned To: christos OS:  
Priority: high OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: Undefined Behavior: applying zero offset to null pointer
Description: Enabling Undefined Behavior Sanitizer (UBSAN) check for pointer overflow(-fsanitize=pointer-overflow) causes the below error to be detected in file/src/apprentice.c.

/src/apprentice.c:567:43: runtime error: applying zero offset to null pointer
    #0 0x7f9c571ef541 in apprentice_unmap src/apprentice.c:567:43
    0000001 0x7f9c571ef34b in mlist_free_one src/apprentice.c:611:3
    0000002 0x7f9c571ed261 in mlist_free src/apprentice.c:625:3
    0000003 0x7f9c571ed147 in file_ms_free src/apprentice.c:504:3
    0000004 0x7f9c572172ae in magic_close src/magic.c:291:2
    0000005 0x2f16d5 in main tests/test.c
    0000006 0x7f9c56008674 in __libc_start_main libc-start.c
    0000007 0x24aeb8 in _start elfstart.S

The code where error observed
    
                CAST(char *, b) <= CAST(char *, p) + map->len)

Tags:
Steps To Reproduce: clang++ -fsanitize=pointer-overflow sourcefile
Additional Information: FWIW. we have thought of a fix as :
CAST(char *, b) <= (p ? CAST(char *, p) + map->len : CAST(char *, map->len)))
I wonder if there isn't a more elegant solution . Please do check the issue and make a fix ASAP.
Attached Files:
Notes
(0003616)
christos   
2021-06-30 10:12   
Fixed, thanks.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
270 [file] General trivial always 2021-06-08 03:41 2021-06-30 10:09
Reporter: ContronThePanda Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: When printing with %c from magic file, some characters are still escaped as \ooo in output even with -r option
Description: Basically exactly what the title says, I came across this while trying to see if I could use a custom magic file to print a terminal bell. However, even if I pass the -r flag, file still escapes the terminal bell as \007 as long as I print it using %s. It's worth noting that it actually prints the bell character when I use the %c pattern. This only applies to %s, for some reason.
Tags: magic
Steps To Reproduce: I've attached both the custom magic file and a file containing a bell character to test it on. You can reproduce this by running `file -rm bell-magic bell-file`.
Additional Information:
Attached Files: bell-magic (15 bytes) 2021-06-08 03:41
https://bugs.astron.com/file_download.php?file_id=227&type=bug
bell-file (2 bytes) 2021-06-08 03:41
https://bugs.astron.com/file_download.php?file_id=226&type=bug
Notes
(0003615)
christos   
2021-06-30 10:09   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
266 [file] General minor always 2021-05-20 22:01 2021-06-08 18:13
Reporter: j2j Platform:  
Assigned To: OS:  
Priority: normal OS Version:  
Status: new Product Version: 5.40  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: False hits by Magdir/pgp-binary-keys
Description: when i run file command version 5.40 on some files with -k option i
often get also misidentification messages starting with "OpenPGP". See
appended output OpenPGP-bad-k.txt.

When looking inside sources i see that such messages are triggered by
magic lines inside Magdir/pgp-binary-keys. These magic lines should
identify OpenPGP files.

The above mentioned examples are handled by starting lines like
 0 ubyte&0xFC =0x94 OpenPGP Secret Key
 >&-1 use primary_key_length_old

After inspecting just one byte print a message starting with "OpenPGP
Secret Key" and then do some additional check by calling sub routine
like primary_key_length_old. Obviously checking only 1 byte is not
sufficient. So non PGP examples with starting byte 95h like
mathemusic, PEDE and samples starting with 97h like Event.Tdf,
RIRE6.SPL, Rx.GS and Welcome.Snd are misidentified.

The consistence check is done later by sub routine
pgp_binary_key_pk_check which checks for valid versions range (2-7)
and valid time stamps (after 1990).

The correct way would be to check some possible PGP packets for valid
version and time stamp. If this succeeds then afterwards display some
message text.

Furthermore the samples starting with 97h are also described inside
Magdir/pgp in a more unreliable way by line starting with
 0 byte 0x97 PGP Secret Sub-key -

So when check and describing part is done by Magdir/pgp-binary-keys
then remove the lines from Magdir/pgp.

Furthermore with --extension option the 31 byte string pgp/gpg/pkr/asd
is shown. For public "foo" extension pkr is used whereas for secret
"foo" the extension "skr" is used. So skr file is missing in the
following magic line: !:ext pgp/gpg/pkr/asd And when doing effort in
inspecting PGP packet for "OpenPGP Public Key" and "OpenPGP Secret
Key" then it would be a good thing to display afterwards the right
file name extension ( pkr or skr).

Furthermore the extension asd is listed as a possibility. As far as i
know i no PGP or related file exist with that extension.

My misidentified examples are stored in appended archive
OpenPGP-bad.zip.
Tags: PGP
Steps To Reproduce:
Additional Information:
Attached Files: OpenPGP-bad.zip (66,795 bytes) 2021-05-20 22:01
https://bugs.astron.com/file_download.php?file_id=225&type=bug
OpenPGP-bad-k.txt (578 bytes) 2021-05-20 22:01
https://bugs.astron.com/file_download.php?file_id=224&type=bug
0002-For-binary-PGP-keys-only-use-the-pgp-and-gpg-extensi.patch (792 bytes) 2021-06-08 18:12
https://bugs.astron.com/file_download.php?file_id=229&type=bug
0001-Show-information-about-a-PGP-key-only-if-we-have-a-s.patch (2,356 bytes) 2021-06-08 18:12
https://bugs.astron.com/file_download.php?file_id=228&type=bug
Notes
(0003608)
neal   
2021-05-29 21:27   
(I wrote pgp-binary-keys.)

Thanks for the thorough report. I tested a lot of true positives (a large portion of the SKS dump), but it seems I failed to test enough false positives. The code checks a lot of bits, so it should be unambiguous. I suspect the problem is that I just emit "OpenPGP Secret Key" too early.

As for the file extensions, I'm only aware of .pgp and .gpg. The other variants existed in the old version of the code, so I kept them assuming that they used to be used.

I'll take a look in the next few days.
(0003612)
neal   
2021-06-08 18:12   
The issue identifies three problems:

  1. Descriptions in pgp-binary-key are printed too eagerly.

  2. Descriptions in pgp (PGP Secret Sub-key) are printed too eagerly.

  3. The extensions listed in pgp-binary-key are wrong.

I've fixed one as j2j suggested. Unfortunately, I can't figure out how to distinguish public and secret keys anymore, because the first byte of the file is not accessible from a function ("use").

The other patch fixes 3. I've changed it to only report pgp and gpg as valid extensions. I've never actually seen srk, prk or adf used in practice and I've been doing PGP stuff for nearly a decade.
(0003613)
neal   
2021-06-08 18:13   
(I'll take a look at pgp and prune the secret subkey detection and some other stuff that is not actually useful in practice.)

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
196 [file] General minor have not tried 2020-09-01 14:02 2021-05-29 19:09
Reporter: neal Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Improve pgp binary key detection support
Description: The pgp binary key detection support is broken in numerous ways:

  - It only deals with old-style CTBs (new-style CTBs were introduced in RFC 2440 released in 1998)

  - It only deals with two byte length encoding. With small keys (thanks to ECC), 1 byte length encoding is typical for new keys.

  - It's not terribly robust.

  - It prints the MPI prefix, which is completely meaningless to all users (the fingerprint is more interesting, but it is the hash of the public key, which we can't compute using magic).

The new version checks more data. It checks that the first three packets are sane before emitting a mime type. And, it standardizes the terminology (PGP/GPG key public ring is... unusual).
Tags:
Steps To Reproduce: Do test, I downloaded the SKS dump and extracted the first 262753 public keys.

$ cd /tmp
$ GNUPGHOME=$(mktemp -d)
$ for i in `seq 0 100`; do wget https://pgp.key-server.io/dump/current/sks-dump-$(printf %04d $i).pgp; gpg --import sks-dump-$(printf %04d $i).pgp; done
$ mkdir /tmp/keys
$ gpg -k --with-colons | grep '^pub' | awk -F: '{ print $5 }' | while read k; do gpg --export $k > keys/$k.pgp; done

Then I did:

~/src/file$ make && find /tmp/keys/ | xargs src/file -m magic/Magdir/pgp-binary-keys 2>&1 > /tmp/normal-detection.txt; find /tmp/keys/ | xargs src/file --mime-type -m magic/Magdir/pgp-binary-keys 2>&1 > /tmp/mime-detection.txt

I did this using the new version and the version installed in Debian.

My patched version detects all certificates and correctly prints the mime type for all certificates. The original version misses: 12095 certificates.
Additional Information:
Attached Files: 0006-Improve-detection-of-OpenPGP-binary-keys.patch (49,321 bytes) 2020-09-01 14:02
https://bugs.astron.com/file_download.php?file_id=176&type=bug
0001-Improve-detection-of-OpenPGP-binary-keys.patch (63,243 bytes) 2020-10-14 12:10
https://bugs.astron.com/file_download.php?file_id=184&type=bug
Notes
(0003472)
neal   
2020-09-01 14:03   
Note: this requires the fixes that I submitted to work.
(0003479)
christos   
2020-09-05 17:27   
The pgp-binary-keys file is missing from the patch?
(0003494)
neal   
2020-10-14 12:10   
Sorry about the delay. I've added pgp-binary-keys file.
(0003495)
christos   
2020-10-14 21:11   
Thanks!
(0003607)
christos   
2021-05-29 19:09   
It appears that we mis-identify many files as pgp keys: see https://bugs.astron.com/view.php?id=266. Is there any way to make the detection stronger?

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
264 [file] General feature have not tried 2021-05-09 22:47 2021-05-10 01:11
Reporter: jbosboom Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: assigned Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Magic for Python pickle serialization format
Description: Pickle is a Python serialization format. Starting with version 2, pickles have a 2-byte protocol header, and starting with version 4, pickles have a frame opcode that provides a length hint (for that frame, not necessarily for the whole pickle). All versions end with a period. Version 0 is an ASCII text format and version 1 adds some binary opcodes, but as neither has a version header, they are not definable with magic. Pickles that have been modified by removing the header/framing or adding trailing garbage can still be deserialized, but are also not definable by magic.

0 string \x80\x02
>-1 byte 0x2e Python pickle data, protocol version 2
0 string \x80\x03
>-1 byte 0x2e Python pickle data, protocol version 3
0 string \x80\x04\x95
>-1 byte 0x2e Python pickle data, protocol version 4
0 string \x80\x05\x95
>-1 byte 0x2e Python pickle data, protocol version 5

Pickle is defined by the reference implementation; see https://docs.python.org/3/library/pickle.html#data-stream-format and the PEPs linked from that section. For testing, https://gist.github.com/jbosboom/1438dcbc304b7325802c36257f5dede9 is a Python script that creates pickles of each version containing the same data. `python -m pickletools <file>` can be used to disassemble a pickle.


According to `man magic`, negative offsets (as used in the magic definitions above) can only appear at the top level or as a continuation offset (with &), but this is evidently not a limitation, and in fact my initial attempt to write pickle magic given below does not seem to work:

-1 byte 0x2e
>0 string \x80\x02 Python pickle data, protocol version 2
>0 string \x80\x03 Python pickle data, protocol version 3
>0 string \x80\x04\x95 Python pickle data, protocol version 4
>0 string \x80\x05\x95 Python pickle data, protocol version 5

You may wish to bring the implementation and the documentation into alignment.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
There are no notes attached to this issue.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
15 [file] General feature N/A 2018-07-24 15:19 2021-05-10 01:09
Reporter: eschwartz Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: Try to acquire the "magic" name on the Python Package Index
Description: Per https://www.python.org/dev/peps/pep-0541/ an abandoned project can be deleted by the PyPI maintainers to clear the way for reusing the name.

The current "magic" package on https://pypi.org/project/magic/ is unmaintained since initial upload in 2003, it cannot even be installed as there is no code uploaded to PyPI, the "Project links: Download" points at a website that no longer exists (according to web.archive.org it disappeared sometime between 20121203 and 20130103), and I cannot find the original uploader on the internet more recently than 2003.

I suspect it would not be difficult to convince the PyPI maintainers of the validity of a claim by the official project. :)
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0000016)
christos   
2018-07-25 06:55   
I'll send mail to jp-py@jsnp.net who owns the project first.
(0000017)
christos   
2018-07-25 06:59   
I've sent mail, waiting for a response.
(0000021)
christos   
2018-08-01 09:02   
Sent mail to infrastructure-stuff@python.org to ask what to do next.
(0000046)
christos   
2018-08-11 11:27   
No answer there, opened: https://github.com/pypa/pypi-legacy/issues/802
(0003421)
christos   
2020-06-01 19:49   
Re-filed under: https://github.com/pypa/pypi-support/issues/429
(0003584)
eschwartz   
2021-04-14 14:34   
The ticket has been processed by PyPI support and transferred over.

So this can be closed as implemented.
(0003606)
christos   
2021-05-10 01:09   
We have it now.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
263 [file] General minor always 2021-05-02 19:52 2021-05-09 22:39
Reporter: peoro Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: Shebang patterns only match the beginning of the command, rather than the whole word
Description: Currently, magic patterns that detect files using a shebang only test the beginning of the command string.

A file starting with e.g. `#!/usr/bin/env basher` is detected as "Bourne-Again shell script", even though "basher" is not bash.
The same issue affects every shebang pattern I tried (sh, bash, node, python, perl etc).
Tags:
Steps To Reproduce: $ echo '#!/bin/shawarma' > script
$ file script
script: POSIX shell script, ASCII text executable
Additional Information:
Attached Files:
Notes
(0003605)
christos   
2021-05-09 22:39   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
262 [file] General minor sometimes 2021-04-27 15:52 2021-04-27 20:36
Reporter: polluks Platform: PowerBook5,8  
Assigned To: christos OS: MorphOS  
Priority: normal OS Version: 3.15  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: better sinclair
Description: --- sinclair.bak 2019-02-22 14:06:34 +0100
+++ sinclair 2021-04-11 02:00:00 +0200
@@ -31,6 +31,8 @@
 # Sinclair QL executables (was ThMO)
 4 belong 0x4AFB QDOS executable
 >9 pstring x '%s'
+6 beshort 0x4AFB QDOS executable
+>9 pstring x '%s'
 
 # Sinclair QL ROM (ThMO)
 0 belong =0x4AFB0001 QL plugin-ROM data,
Tags:
Steps To Reproduce:
Additional Information:
System Description
Attached Files: config (7,280 bytes) 2021-04-27 15:52
https://bugs.astron.com/file_download.php?file_id=223&type=bug
Notes
(0003604)
christos   
2021-04-27 20:36   
applied, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
261 [file] General minor always 2021-04-20 11:24 2021-04-27 19:39
Reporter: bitstreamout Platform: x86_64  
Assigned To: christos OS: openSUSE  
Priority: normal OS Version: Tumbleweed  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: New version breaks subversion tests
Description: Currently subversion build breaks at several points ... many of the breaks are caused by behaviour change of file in detecting ASCII text without newlines.
Tags:
Steps To Reproduce: With version 4.30

echo xx | file -
/dev/stdin: ASCII text, with no line terminators

with version 5.40

echo -n xx | file -
/dev/stdin: data
Additional Information:
Attached Files: fails.log (18,188 bytes) 2021-04-22 15:47
https://bugs.astron.com/file_download.php?file_id=221&type=bug
file-5.50-ascii.patch (699 bytes) 2021-04-23 07:36
https://bugs.astron.com/file_download.php?file_id=222&type=bug
Notes
(0003593)
bitstreamout   
2021-04-21 05:58   
Just to correct typo ... the 'With version 4.30' should be 'With version 5.39'

```
/suse/werner> file --version
file-5.39
magic file from /etc/magic:/usr/share/misc/magic
/suse/werner> echo -n xx | file -
/dev/stdin: ASCII text, with no line terminators
/suse/werner>
```
(0003594)
bitstreamout   
2021-04-21 08:38   
Could it be that the condition

if (u < 3)

within the LOOKS_ macro should be

if (u < 2)

at least for ASCII and latin1
(0003595)
bitstreamout   
2021-04-22 12:56   
Duplicate of https://bugs.astron.com/view.php?id=256
(0003596)
bitstreamout   
2021-04-22 15:25   
Hmmm ... still problems with files without last newline

```
abuild@noether:~/rpmbuild/BUILD/subversion-1.14.1> wc -c /dev/shm/svn-test-work/working_copies/merge_tests-2/A/B/F/foo
3 /dev/shm/svn-test-work/working_copies/merge_tests-2/A/B/F/foo
abuild@noether:~/rpmbuild/BUILD/subversion-1.14.1> file /dev/shm/svn-test-work/working_copies/merge_tests-2/A/B/F/foo
/dev/shm/svn-test-work/working_copies/merge_tests-2/A/B/F/foo: data
abuild@noether:~/rpmbuild/BUILD/subversion-1.14.1> cat /dev/shm/svn-test-work/working_copies/merge_tests-2/A/B/F/foo && echo
foo
```
(0003597)
bitstreamout   
2021-04-22 15:27   
Test with file 5.39
```
file /abuild/oscbuild/openSUSE_Tumbleweed/dev/shm/svn-test-work/working_copies/merge_tests-2/A/B/F/foo
/abuild/oscbuild/openSUSE_Tumbleweed/dev/shm/svn-test-work/working_copies/merge_tests-2/A/B/F/foo: ASCII text, with no line terminators
```
(0003598)
bitstreamout   
2021-04-22 15:47   
The fails.log of subversion with file 5.40
(0003599)
bitstreamout   
2021-04-23 06:58   
Something goes wrong even with those commits for bug PR/256
```
abuild@noether:~/rpmbuild/BUILD/file-5.40> echo -e "fo" | $PWD/src/.libs/file -m $PWD/magic/magic -
/dev/stdin: ASCII text
abuild@noether:~/rpmbuild/BUILD/file-5.40> echo -e "xx" | $PWD/src/.libs/file -m $PWD/magic/magic -
/dev/stdin: data
abuild@noether:~/rpmbuild/BUILD/file-5.40> echo -e "hi" | $PWD/src/.libs/file -m $PWD/magic/magic -
/dev/stdin: ASCII text
abuild@noether:~/rpmbuild/BUILD/file-5.40> echo -en "hi" | $PWD/src/.libs/file -m $PWD/magic/magic -
/dev/stdin: ASCII text, with no line terminators
abuild@noether:~/rpmbuild/BUILD/file-5.40> echo -en "foo" | $PWD/src/.libs/file -m $PWD/magic/magic -
/dev/stdin: data
abuild@noether:~/rpmbuild/BUILD/file-5.40> echo -e "foo" | $PWD/src/.libs/file -m $PWD/magic/magic -
/dev/stdin: ASCII text
abuild@noether:~/rpmbuild/BUILD/file-5.40> echo -e "xxx" | $PWD/src/.libs/file -m $PWD/magic/magic -
/dev/stdin: data
```
(0003600)
bitstreamout   
2021-04-23 07:36   
I suggest the attached patch to count every ASCII character even if it appears several times
(0003601)
bitstreamout   
2021-04-23 11:07   
I see that commit 3096f87f823e1e936139e48d6a3bae9a95557861 had introduced the `if (dist[i]) u++` which misdetect smaller ASCII files with and without newlines
(0003603)
christos   
2021-04-27 19:39   
The whole character count/distribution approach leads to more confusion as it tries to solve some corner cases. It is not worth using heuristics to resolve the corner cases. I've reverted the fix to PR/180 and that should bring back the original behavior.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
180 [file] General trivial always 2020-08-15 05:30 2021-04-27 19:35
Reporter: EuphCat Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: A file filled with 0xFF gets reported to be ISO-8859
Description: * I don't know how the parser works, or how file types are managed. I'm okay with NOTABUG

A file filled with 0xFF gets reported to be ISO-8859. I find this misleading.
Tags:
Steps To Reproduce: $ dd if=/dev/zero ibs=1k count=1 | tr "\000" "\377" > 0xFFfile.bin
1+0 records in
2+0 records out
1024 bytes (1.0 kB, 1.0 KiB) copied, 0.000256375 s, 4.0 MB/s
$ xxd ./0xFFfile.bin | head
00000000: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000010: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000020: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000030: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000040: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000050: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000060: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000070: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000080: ffff ffff ffff ffff ffff ffff ffff ffff ................
00000090: ffff ffff ffff ffff ffff ffff ffff ffff ................
$ file 0xFFfile.bin
0xFFfile.bin: ISO-8859 text, with very long lines, with no line terminators
Additional Information: Because of this issue, mkfs.ext4 reports false positive on file validity confirmation.
"/dev/sda2 contains `ISO-8859 text, with very long lines, with no line terminators`
Proceed anyway? (y,N)"
Attached Files:
Notes
(0003447)
christos   
2020-08-15 12:06   
Fixed by requiring at least 3 distinct character values.
(0003602)
christos   
2021-04-27 19:35   
Reverted the fix. Breaks other tests. A file can have the same character repeated many times and that should not change how file detects it. Heuristics just add confusion to the behavior.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
253 [file] General minor always 2021-03-31 11:46 2021-04-19 19:04
Reporter: rwmjones Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: file 5.40 can no longer print ext4 filesystem UUIDs correctly.
Description: file 5.40 can no longer print ext4 filesystem UUIDs correctly.

Reported in Fedora:
file-5.40-1.fc35.x86_64

Downstream bug report:
https://bugzilla.redhat.com/show_bug.cgi?id=1945122
Tags:
Steps To Reproduce: 1. Prepare a disk image in a file:

  $ rm /var/tmp/test.img
  $ truncate -s 1G /var/tmp/test.img
  $ mkfs.ext4 /var/tmp/test.img

2. Run 'file' against it to display the UUID.

With the previous version of file it would display the UUID correcctly, eg:

  $ file /var/tmp/test.img
  /var/tmp/test.img: Linux rev 1.0 ext4 filesystem data, UUID=b1bc22cc-7392-4780-8b50-77dac556236d (extents) (64bit) (large files) (huge files)

With the current version of file it displays it incorrectly, eg:

  $ file /var/tmp/test.img
  /var/tmp/test.img: Linux rev 1.0 ext4 filesystem data, UUID=b1bc22cc-7392-4780-ffff8b50-77dac556236d (extents) (64bit) (large files) (huge files)

Notice that some parts of the UUID are sign-extended.
Additional Information: I bisected this to the following upstream commit:

  0478d9251abafd0876cdb3121ef2c07af6c99513 is the first bad commit
  commit 0478d9251abafd0876cdb3121ef2c07af6c99513
  Author: Christos Zoulas <christos@zoulas.com>
  Date: Sat Aug 22 18:27:42 2020 +0000

    Treat printf numbers as signed.

   src/softmagic.c | 28 ++++++++++++++--------------
   1 file changed, 14 insertions(+), 14 deletions(-)
Attached Files:
Notes
(0003580)
rwmjones   
2021-03-31 11:57   
The magic entry (magic/Magdir/filesystems) specifies %08x and %04x for the fields of the UUID. Normally %x would be unsigned (eg. the printf(3) man page documents this). So I think this is a regression in "file" itself, not a bug in the magic data.
(0003592)
christos   
2021-04-19 19:04   
Thanks! The type and sign-ness of argument is determined by the magic type field and this has been fixed to be unsigned now.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
252 [file] General minor always 2021-03-31 07:40 2021-04-19 18:58
Reporter: malat Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.38  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: mime-type: image/jpeg instead of image/jls
Description: It would be nice to disambiguate 'image/jpeg' vs 'image/jls' mime type as seen in the example attached.

$ file --mime-type filelogo.jls
filelogo.jls: image/jpeg

with:

$ file --version
file-5.38
magic file from /etc/magic:/usr/share/misc/magic


For reference:

* https://www.iana.org/assignments/media-types/image/jls

Implementation used to generate this JPEG-LS file is at:

* https://github.com/team-charls/charls
Tags:
Steps To Reproduce: $ file --mime-type filelogo.jls
filelogo.jls: image/jpeg
Additional Information:
Attached Files: filelogo.jls (16,386 bytes) 2021-03-31 07:40
https://bugs.astron.com/file_download.php?file_id=214&type=bug
Notes
(0003591)
christos   
2021-04-19 18:58   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
256 [file] General major always 2021-04-02 18:41 2021-04-19 18:38
Reporter: mutableVoid Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: Wrong file type for file with one-bit char before new-line
Description:
When I execute `file` on a file that contains only a single (one-byte) character before the newline which terminates the file, the reported file type is binary instead of Unicode text (see section: Steps to reproduce).

This messes which programs like `more`, which therefore refuse to print the file's content, as the reported file type is binary.

I encountered this in the following scenario:

```bash
> printf 'h\n' > file2
> more file2
 
******** file2: Not a text file ********

> od -x file2
0000000 0a68
0000002
```

When I fill the file with a character that takes more than a single byte in Unicode, the problem does not occur:
```bash
printf 'ä\n' > new_file
file new_file
new_file: Unicode text, UTF-8 text
```
 
Tags:
Steps To Reproduce: ```bash
printf 'h\n' > new_file
file new_file
```
prints
`new_file: data` instead of the expected `new_file: Unicode text, UTF-8 text`
Additional Information:
Attached Files:
Notes
(0003582)
mutableVoid   
2021-04-02 19:03   
Might be related to the fix of bugs.astron.com/view.php?id=180 , printing the same character multiple times also reports `binary` instead of UTF-8 text:

printf 'aa\n' > new_file
file new_file
new_file: data
(0003590)
christos   
2021-04-19 18:38   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
257 [file] General major always 2021-04-03 17:05 2021-04-19 17:02
Reporter: cuihao Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: file -i doesn't recognize xz files
Description: file -i doesn't recognize xz files possibly because the stock magic file is broken.
Tags:
Steps To Reproduce: $ file -i xxx.xz

With file 5.39, I got:
xxx.xz: application/x-xz; charset=binary

With newest file 5.40, I got:
xxx.xz: application/octet-stream; charset=binary
Additional Information: I did git-bisect and found commit 3ebd747d (Add checksum for XZ) introduced the bug. I don't know the format so IDK how to fix it.

OS: Arch Linux, latest packages
Kernel: 5.11.11-zen1-1-zen
Attached Files:
Notes
(0003583)
sgallagh   
2021-04-12 14:02   
Additional downstream bug in Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1947317
(0003589)
christos   
2021-04-19 17:02   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
255 [file] General block always 2021-04-02 04:49 2021-04-19 16:51
Reporter: joveler Platform:  
Assigned To: christos OS:  
Priority: high OS Version:  
Status: feedback Product Version: 5.40  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: file 5.40 compile error on MinGW/MSYS2
Description: file 5.40 cannot be compiled on MinGW/MSYS2, due to ioctl / fnctl calls.

[*] fnctl calls
In funcs.c and magic.c, file calls fcntl with F_SETFD.

fcntl(fds[1], F_SETFD, FD_CLOEXEC);

MinGW does not support F_SETFD, thus fails to compile the code.

[*] ioctl calls
This issue had been already described in 0000163 (https://bugs.astron.com/view.php?id=163).

MinGW does not support ioctl call and produce compile error.

If the library is configured with `--disable-xzlib --disable-bzlib`, the code is excluded and does not block the build.

[*] Solution
I attached the diff file which excludes these code paths on MinGW build.
Tags: build, patch
Steps To Reproduce:
Additional Information:
Attached Files: MinGW_ioctl_fix.diff (648 bytes) 2021-04-02 04:49
https://bugs.astron.com/file_download.php?file_id=216&type=bug
MinGW_fnctl_fix.diff (1,055 bytes) 2021-04-02 04:49
https://bugs.astron.com/file_download.php?file_id=215&type=bug
Notes
(0003581)
joveler   
2021-04-02 11:04   
[*] Additional info of compile environment

- Platform: Windows 10 with MSYS2
- Tested Target Arch : I686, x86_64, aarch64
- Shell: MINGW32(i686) / MINGW64(x86_64, aarch64) shell of MSYS2
- Toolchain: (1) MinGW-w64 of MSYS2 (i686/x86_64) (2) llvm-mingw (aarch64)
(0003587)
administrator   
2021-04-19 16:51   
Better use __MINGW32__?

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
259 [file] General minor always 2021-04-16 09:43 2021-04-19 16:47
Reporter: aleksandr.v.novichkov Platform:  
Assigned To: administrator OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.40  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.41  
    Target Version:  
Summary: Glueing mime types into one
Description: New version of file (5.40) glue mime types for mp3 files.
Tags:
Steps To Reproduce: 1. download attached file
2. run command:
```
file --mime-type attachments_audio.mp3
```
Additional Information: Actual type is:
```
audio/mpegapplication/octet-stream
```

Expected type is:
```
audio/mpeg
```
Attached Files: attachments_audio.mp3 (10,493 bytes) 2021-04-16 09:43
https://bugs.astron.com/file_download.php?file_id=220&type=bug
Notes
(0003586)
administrator   
2021-04-19 16:47   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
260 [file] General feature always 2021-04-16 10:04 2021-04-19 15:57
Reporter: aleksandr.v.novichkov Platform:  
Assigned To: administrator OS:  
Priority: high OS Version:  
Status: feedback Product Version: 5.40  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Create tests
Description: Our project uses a libmagic to content file defining.
We often find bugs that have already been fixed.
It would be a good idea to create tests.

We have tests are written in go language, which we can adapt to your project.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003585)
administrator   
2021-04-19 15:57   
There is a tests subdirectory in the file distribution, and a test framework on https://github.com/file/file-tests. Can you convert your test to use either? I don't think that adding a 3rd framework is a good idea :-)

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
213 [file] General feature N/A 2020-11-30 14:52 2021-03-28 19:03
Reporter: Mikhail.Kovalev Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: reopened  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Chiasmus encrypted files (.xia)
Description: Chiasmus (https://www.bsi.bund.de/EN/Topics/OtherTopics/Chiasmus/Chiasmus_node.html) is encryption software used by many public authorities in Germany. It would be great if file library could detect .xia files.
Tags:
Steps To Reproduce:
Additional Information: Detection should be easy: the first characters in the file are always "XIA". An example file is attached.
Attached Files: example.xia (338 bytes) 2020-11-30 16:50
https://bugs.astron.com/file_download.php?file_id=190&type=bug
Notes
(0003510)
christos   
2020-12-17 00:04   
Added, thanks!
(0003574)
Mikhail.Kovalev   
2021-03-25 11:43   
I am really sorry, but this turned out to be a duplicate. Detection of Chiasmus files was already implemented in https://github.com/file/file/blob/master/magic/Magdir/bsi
So the newly added file https://github.com/file/file/blob/master/magic/Magdir/crypto should be removed.

The problem is that it's only the "textual description" which gets set if the file type is detected. But the MIME-type remains "application/octet-stream". Which indeed should be the case according to https://datatypes.net/open-xia-files
However, in the past there were some attempts to introduce special MIME types for Chiasmus files, e.g. from https://bugs.freedesktop.org/show_bug.cgi?id=23255:
- application/x-chiasmus-key Chiasmus key
- application/x-chiasmus-encrypted Chiasmus encrypted data

Would it be possible to add such MIME types to the File library?
(0003579)
christos   
2021-03-28 19:03   
removed contents from crypto

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
251 [file] General trivial always 2021-03-25 22:47 2021-03-27 20:18
Reporter: vineetg76 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: elf files for Synopsys ARC are not identified correctly
Description: There are 3 variants of Synopsys ARC ISA: ARCompact, ARCv2 and ARCv3 and processors based on them
However current implementation of file is not identifying them ideally:

1. ARCompact based elf is incorrectly identified as legacy ARC Tangent A5 which don't exist.
2. ARCv2 is not even listed
3. ARCv3 is incorrectly identified as ARCv2.3

Tags:
Steps To Reproduce:
Additional Information: I'm attaching a patch which addresses the above.
Attached Files: 0001-Fix-names-for-Synopsys-ARC-cores.patch (1,858 bytes) 2021-03-25 22:47
https://bugs.astron.com/file_download.php?file_id=213&type=bug
Notes
(0003578)
christos   
2021-03-27 20:18   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
235 [file] General tweak always 2021-02-08 15:26 2021-03-14 17:13
Reporter: jschleus Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: 5.39 reports "Certificate" instead of "ASCII text" for the PHP project NEWS file
Description: file 5.39 (but not 5.38) reports incorrectly "Certificate" instead of "ASCII text" for the NEWS file of the PHP tarballs (e.g. viewable at https://raw.githubusercontent.com/php/php-src/master/NEWS).

Probably that is related to an addition in 5.39 to the file magic/Magdir/der (handling DER encoded files).

Unfortunately I'm not able to analyze the reason but just for curiosity I created some one-liner files starting with the first line of the mentioned NEWS file and got the following results
Tags:
Steps To Reproduce:
Additional Information: Unfortunately I'm not able to analyze the reason but just for curiosity I created some one-liner files starting with the first line of the mentioned NEWS file and got the following results:

"Certificate":
PHP NEWS
PHP xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx NEWS
PHP xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
pHP xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
pHp xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

"ASCII text":
PHA xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
php xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PHP xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PHP xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Unfortunately the text here seems not to use a monospaced font (e.g. the first two example lines have both 79 chars).
 
Attached Files: file-5.39_CERTIFICATE_bug.tests.txt (714 bytes) 2021-02-08 15:26
https://bugs.astron.com/file_download.php?file_id=202&type=bug
Notes
(0003560)
christos   
2021-02-24 22:52   
I can't reproduce this with the version from HEAD.
(0003562)
jschleus   
2021-02-25 10:17   
Hmm, I just compiled the GitHub R/O master version and could reproduce the described behavior.

Perhaps I have expressed myself somewhat imprecisely, for tests with the attached file you have to put only one of the given lines into a test file.

But file 5.38 outputs for the NEWS file of the originally mentioned URL "UTF-8 Unicode text", but for the NEWS file of the last PHP 8.0.2 release (https://raw.githubusercontent.com/php/php-src/PHP-8.0.2/NEWS) the mentioned "ASCII text". But the current file 5.39 and the HEAD version output both "Certificate".

By the way my tests are done under Linux openSUSE Leap 15.2.
(0003572)
christos   
2021-03-14 17:13   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
241 [file] General minor unable to reproduce 2021-03-02 05:03 2021-03-14 17:03
Reporter: thesamesam Platform: Linux  
Assigned To: christos OS: Gentoo GNU/Linux  
Priority: normal OS Version: amd64 (stable)  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: file is killed by seccomp filter when executing futex syscall
Description: A user reported to us in Gentoo that all file invocations, when built with seccomp, resulted in "bad system call" (i.e. killed by the seccomp filter).

They were able to produce strace output showing futex() was the problematic syscall, although it's not clear why futex() is being used here. I've attached their system information and strace output.

Currently, src/seccomp.c has:
>#ifdef XZLIBSUPPORT
> ALLOW_RULE(futex);
>#endif

So, clearly we expect futex in some cases. In this case, the user had not built file with LZMA support, but when they were asked to enable it, the issue disappeared (as expected).

Do you have any suggestions as to why this syscall was being used (and if it is problematic - seems not), or does the filter simply need updating to allow it unconditionally?
Tags:
Steps To Reproduce: Not been able to reproduce, but often these changes are quite sensitive to glibc version and other factors in the system environment.

The user's glibc version appeared to be the main version in deployment in Gentoo and has not been visible on any of my systems. This is the only report I've seen of this issue, although in the past we've occasionally seen this style of problem with other syscalls that was resolved by filter updates upstream in file.

I am happy to try pass on questions to the user downstream.
Additional Information: Downstream report in Gentoo: https://bugs.gentoo.org/771096
Attached Files: strace.txt (15,549 bytes) 2021-03-02 05:03
https://bugs.astron.com/file_download.php?file_id=206&type=bug
emerge_info.txt (7,876 bytes) 2021-03-02 05:03
https://bugs.astron.com/file_download.php?file_id=205&type=bug
Notes
(0003571)
christos   
2021-03-14 17:03   
I enabled futexes unconditionally. They are used for threaded programs and it is possible that newer glibc does some thread initialization unconditionally. It would be interesting to find the stack trace of the futex call though.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
242 [file] General minor have not tried 2021-03-02 15:31 2021-03-14 16:57
Reporter: catull Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Follow-up to 000226, now the marker is 4 bytes long
Description: The Birtual Machine file marker was originally introduced as a 2-byte marker.

Now the implementor has adopted a larger marker.
The diff attached to this ticket accounts for the most recent change.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: bm.diff (676 bytes) 2021-03-02 15:31
https://bugs.astron.com/file_download.php?file_id=207&type=bug
Notes
(0003570)
christos   
2021-03-14 16:57   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
243 [file] General minor have not tried 2021-03-02 15:45 2021-03-14 16:54
Reporter: catull Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Add libmagic.pc to .gitignore
Description: When developing under git, the generated file above appears as "untracked file", see below.

With the patch applied, it will be duely ignored by git.
Tags:
Steps To Reproduce: git clone git@github.com:file/file.git
cd file
autoreconf -f -i
./configure
make
git status -b
Additional Information: The last command shows:

➜ file.git git:(master) git status -b
On branch master
Your branch is up to date with 'origin/master'.

Untracked files:
  (use "git add <file>..." to include in what will be committed)
    libmagic.pc

nothing added to commit but untracked files present (use "git add" to track)
Attached Files: gitignore.diff (213 bytes) 2021-03-02 15:45
https://bugs.astron.com/file_download.php?file_id=208&type=bug
Notes
(0003569)
christos   
2021-03-14 16:54   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
244 [file] General feature always 2021-03-08 17:23 2021-03-14 16:52
Reporter: mainframed767 Platform: 64  
Assigned To: christos OS: Linux  
Priority: normal OS Version: Ubuntu 20.04  
Status: resolved Product Version: 5.38  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Detect NETDATA (z/OS and CMS XMI) files
Description: NETDATA (https://en.wikipedia.org/wiki/NETDATA) is a simple file format used to move files between mainframes, oftentimes referred to as XMI or XMIT. More information and test files here: http://planetmvs.com/unxmit/

NETDATA files are stored in EBCDIC. The first two bytes are a size and a flag, which varies, followed by 'INMR01' in ebcdic followed by IBM text unit INMLRECL whic is always the same:

00000002 c9 d5 d4 d9 f0 f1 00 42 00 01 00 01 50 10 11 00

It would be great if detection for this format could be added. At the moment it is just reported as "data".

Attached is a sample: seq.xmi
Tags:
Steps To Reproduce: 1) Generate XMI file using TSO TRANSMIT: https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.2.0/com.ibm.zos.v2r2.ikjc500/transmi.htm
2) Transfer file to local machine
3) Run 'file' against the downloaded file
Additional Information:
Attached Files: seq.xmi (560 bytes) 2021-03-08 17:23
https://bugs.astron.com/file_download.php?file_id=209&type=bug
Notes
(0003568)
christos   
2021-03-14 16:52   
Added a simple detection for now. We can get more elaborate and extract the fields if needed.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
246 [file] General minor always 2021-03-13 11:56 2021-03-14 16:37
Reporter: Kid Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: video/mp4 identified as application/octet-stream
Description: The only thing possibly unusual I see is ftypiso4 instead of ftypisom. Thank you for maintaining this essential utility.

The OS is Arch Linux.
Tags: magic
Steps To Reproduce:
Additional Information:
Attached Files: 2KiB.mp4 (2,048 bytes) 2021-03-13 11:56
https://bugs.astron.com/file_download.php?file_id=211&type=bug
Notes
(0003567)
christos   
2021-03-14 16:37   
Fixed in HEAD, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
247 [file] General feature N/A 2021-03-14 10:18 2021-03-14 16:24
Reporter: akohlmey Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.38  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Magic file patterns for the LAMMPS MD code
Description: The LAMMPS MD simulation code ( https://lammps.sandia.gov/ ) produces several binary and text mode files that can be easily recognized with the additional patterns in the file attached to this issue.
Tags: magic
Steps To Reproduce: Example output (tested on a Fedora Linux, and MacOS 11):

$ file *.*
dihedral-quadratic.restart: LAMMPS binary restart file (rev 2), Version 10 Mar 2021, Little Endian
mol-pair-wf_cut.restart: LAMMPS binary restart file (rev 2), Version 24 Dec 2020, Little Endian
atom.bin: LAMMPS atom style binary dump (rev 2), Little Endian, First time step: 445570
custom.bin: LAMMPS custom style binary dump (rev 2), Little Endian, First time step: 100
bn1.lammpstrj: LAMMPS text mode dump, First time step: 5000
data.fourmol: LAMMPS data file written by LAMMPS
pnc.data: LAMMPS data file written by msi2lmp
data.spce: LAMMPS data file written by TopoTools
B.data: LAMMPS data file written by OVITO
log.lammps: LAMMPS log file written by version 10 Feb 2021
Additional Information:
Attached Files: magic.lammps (2,329 bytes) 2021-03-14 10:18
https://bugs.astron.com/file_download.php?file_id=212&type=bug
Notes
(0003566)
christos   
2021-03-14 16:24   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
245 [file] General minor have not tried 2021-03-11 16:04 2021-03-14 16:22
Reporter: pamelawardtx2021 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: problems with javascript
Description: problems with javascript
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: payforresearchpaperonline_a2.docx.pdf (31,104 bytes) 2021-03-11 16:04
https://bugs.astron.com/file_download.php?file_id=210&type=bug
Notes
(0003565)
christos   
2021-03-14 16:22   
spam

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
214 [tcsh] General minor always 2020-12-05 00:40 2021-02-27 01:02
Reporter: andrew@ugh.net.au Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: assigned Product Version: 6.22.03  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Can't escape delimiters in :s modifier
Description: the man page, under "History substitution" for the s modifier says:

> Any character may be used as the delimiter in place of `/'; a `\' can be used to quote the delimiter inside l and r.

\ does not quote the delimiter currently. I didn't go back to see if it used to work.
Tags: patch
Steps To Reproduce: ```
>set a='a/b'
>echo $a
a/b
>echo $a:s/\//#/
a/b
```

The output should have been `a#b`
Additional Information: Patch attached
Attached Files: sh.dol.c.patch (2,458 bytes) 2020-12-05 00:40
https://bugs.astron.com/file_download.php?file_id=191&type=bug
sh.dol.c-2.patch (2,097 bytes) 2020-12-05 00:43
https://bugs.astron.com/file_download.php?file_id=192&type=bug
delim.diff (1,412 bytes) 2021-02-27 01:02
https://bugs.astron.com/file_download.php?file_id=204&type=bug
Notes
(0003499)
andrew@ugh.net.au   
2020-12-05 00:43   
This replaces the previous patch which somehow had some misplaced comments in it.
(0003563)
christos   
2021-02-26 14:33   
I am wondering if that ever worked and we broke it, or if it never worked and this patch is needed. I need to take a more careful look.
(0003564)
christos   
2021-02-27 01:02   
I think we need to parse both at the lexical level and at dollar evaluation like below.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
237 [file] General feature always 2021-02-11 09:17 2021-02-24 23:56
Reporter: pxeger Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Detect Ansible Vault files
Description: Ansible Vault (https://docs.ansible.com/ansible/latest/user_guide/vault.html) is a simple AES-based file encryption system for Ansible.

The exact file format is documented at https://docs.ansible.com/ansible/latest/user_guide/vault.html#format-of-files-encrypted-with-ansible-vault, but essentially the magic bytes are (hexdump):

00000000: 2441 4e53 4942 4c45 5f56 4155 4c54 3b $ANSIBLE_VAULT;

It would be great if detection for this format could be added. At the moment it is just reported as "ASCII text".

Attached is an example file which contains the content "this is an example file" with the password "123"
Tags: magic
Steps To Reproduce: 1. Create a file using `ansible-vault create myfile`
2. Enter some content in your editor and save the file
3. Use `file myfile`
Additional Information:
Attached Files: example_file (419 bytes) 2021-02-11 09:17
https://bugs.astron.com/file_download.php?file_id=203&type=bug
Notes
(0003561)
christos   
2021-02-24 23:56   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
238 [file] General text N/A 2021-02-15 18:16 2021-02-24 22:35
Reporter: lu3 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: MP4 Base Media v1 has the typo "IS0" (0 as the number zero) instead of "ISO" (O as the letter)
Description: --- /etc/share/misc/magic/animation.orig 2021-01-19 12:12:37.274757489 +0100
+++ /etc/share/misc/magic/animation 2021-02-15 19:05:48.250105805 +0100
@@ -112,7 +112,7 @@
 # ?/enc-isoff-generic
 >8 string iso2 \b, MP4 Base Media v2 [ISO 14496-12:2005]
 !:mime video/mp4
->8 string isom \b, MP4 Base Media v1 [IS0 14496-12:2003]
+>8 string isom \b, MP4 Base Media v1 [ISO 14496-12:2003]
 !:mime video/mp4
 >8 string/W jp2 \b, JPEG 2000
 !:mime image/jp2
Tags: magic
Steps To Reproduce: # file -b movie1.mp4
ISO Media, MP4 v2 [ISO 14496-14]
# file -b movie2.mp4
ISO Media, MP4 Base Media v1 [IS0 14496-12:2003]
Additional Information: For completeness: this is the standard installation on Gentoo Linux, version sys-apps/file-5.39-r3, found in /etc/share/misc/magic/animation.
Attached Files:
Notes
(0003559)
christos   
2021-02-24 22:35   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
240 [file] General minor always 2021-02-19 02:42 2021-02-23 05:27
Reporter: aodaki Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: assigned Product Version: 5.39  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: PE files are reported as "for MS Windows" even though they are not
Description: Today PE files are not just for MS Windows. Especially .NET assemblies and UEFI programs are so common and it is not correct to assume PE files are for MS Windows.
I suggest to remove "for MS Windows" from PE file reports, but I would like to hear other opinions if any.
Tags: magic
Steps To Reproduce: Download a NuGet package (for example: https://www.nuget.org/packages/Newtonsoft.Json/13.0.1-beta1), extract it, and feed DLLs contained in them.
Additional Information:
Attached Files:
Notes
(0003557)
christos   
2021-02-23 01:14   
This needs windows to extract... Can you paste the first few K of a dll or supply a patch?
Thanks!
(0003558)
aodaki   
2021-02-23 05:27   
NuGet tools which can extract the file run anywhere Mono or .NET Core runs, so you don't need Windows and that is the point of this ticket.

However, it may be still troublesome to set up a .NET environment if you do not have one now. Fortunately, the file is just a ZIP file as described here:
https://docs.microsoft.com/en-us/nuget/what-is-nuget

You may just use a ZIP extractor and find files whose name end with .dll.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
236 [file] General trivial have not tried 2021-02-08 15:48 2021-02-23 00:52
Reporter: jschleus Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Codespell report for "file" (on fossies.org)
Description: I am the administrator of the FOSS server fossies.org that supports (and uses !) also the "file" project and offers among others a feature named "Source code misspelling reports":

 https://fossies.org/features.html#codespell

Such reports are normally only generated on request, but as Fossies administrator I have just created (animated by another "file" issue I have just opened) such an analysis also for the "file" project:

 https://fossies.org/linux/misc/file/codespell.html

That version-independent (not linked) URL should redirect always to the last report (if available), so currently to

 https://fossies.org/linux/misc/file-5.39.tar.gz/codespell.html

Although after a first review obviously wrong matches ("false positives") are already filtered out (ignored)
please inform me if you find more of them so that I can force a new improved check if applicable.

Although the correction of misspellings and typos has probably not a top priority, I hope that the report can
nevertheless be a little bit useful.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003555)
christos   
2021-02-23 00:52   
Ran the following on all the files, thanks!

#!/bin/sh
sed -E -i \
-e 's/\<intput\>/input/g' \
-e 's/\<enought\>/enough/g' \
-e 's/\<reachs\>/reaches/g' \
-e 's/\<whitch\>/which/g' \
-e 's/\<serie\>/series/g' \
-e 's/\<Unparseable\>/Unparsable/g' \
-e 's/\<colums\>/columns/g' \
-e 's/\<extenstions\>/extensions/g' \
-e 's/\<carrige\>/carriage/g' \
-e 's/\<irregardless\>/regardless/g' \
-e 's/\<resonable\>/reasonable/g' \
-e 's/\<conectix\>/connectix/g' \
-e 's/\<conectix\>/connectix/g' \
-e 's/\<conectix\>/connectix/g' \
-e 's/\<splitted\>/split/g' \
-e 's/\<splitted\>/split/g' \
-e 's/\<positiv\>/positive/g' \
-e 's/\<positiv\>/positive/g' \
-e 's/\<KENREl\>/kernel/g' \
-e 's/\<splitted\>/split/g' \
-e 's/\<splitted\>/split/g' \
-e 's/\<unusal\>/unusual/g' \
-e 's/\<Inforation\>/Information/g' \
-e 's/\<fomrat\>/format/g' \
-e 's/\<libray\>/library/g' \
-e 's/\<annoted\>/annotated/g' \
-e 's/\<positiv\>/positive/g' \
-e 's/\<coresponding\>/corresponding/g' \
-e 's/\<informations\>/information/g' \
-e 's/\<assember\>/assembler/g' \
-e 's/\<assember\>/assembler/g' \
-e 's/\<informations\>/information/g' \
-e 's/\<informations\>/information/g' \
-e 's/\<signatur\>/signature/g' \
-e 's/\<environent\>/environment/g' \
-e 's/\<temporily\>/temporarily/g' \
-e 's/\<gziped\>/gzipped/g' \
-e 's/\<Versio\>/Version/g' \
-e 's/\<revsion\>/revision/g' \
-e 's/\<positiv\>/positive/g' \
-e 's/\<positiv\>/positive/g' \
-e 's/\<partiton\>/partition/g' \
-e 's/\<formated\>/formatted/g' \
-e 's/\<formated\>/formatted/g' \
-e 's/\<formated\>/formatted/g' \
-e 's/\<posible\>/possible/g' \
-e 's/\<splitted\>/split/g' \
-e 's/\<possibilites\>/possibilities/g' \
-e 's/\<instread\>/instead/g' \
-e 's/\<programm\>/program/g' \
-e 's/\<extraced\>/extracted/g' \
-e 's/\<unusal\>/unusual/g' \
-e 's/\<positiv\>/positive/g' \
-e 's/\<3nd\>/3rd/g' \
-e 's/\<charcter\>/character/g' \
-e 's/\<nane\>/name/g' \
-e 's/\<3nd\>/3rd/g' \
-e 's/\<CYMK\>/CMYK/g' \
-e 's/\<explict\>/explicit/g' \
"$@"

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
229 [file] General block always 2021-01-15 13:58 2021-02-09 11:26
Reporter: JoergS Platform: VirtualBox image  
Assigned To: christos OS: Ubuntu (Linux)  
Priority: normal OS Version: 16.04  
Status: assigned Product Version: 5.39  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: fit-map-data.testfile does not match fit-map-data.result, thus file-5.39 compilation (Yocto 3.2.1) always fails!
Description: when building "file-5.39" in a Yocto-3.2.1 environment, its recipe always fails with the following error (excerpt):
| Running test: ../../git/tests/fit-map-data.testfile
| Error: result was
| FIT Map data, unit id 65536, serial 3879446968, Sat May 31 12:00:34 2014, manufacturer 1 (garmin), product 1632, type 4 (Activity)
| expected:
| FIT Map data, unit id 65536, serial 3879446968, Sat May 31 10:00:34 2014, manufacturer 1 (garmin), product 1632, type 4 (Activity)
| ../../git/tests/fit-map-data.testfile: FIT Map data, unit id 65536, serial 3879446968, Sat May 31 12:00:34 2014, manufacturer 1 (garmin), product 1632, type 4 (Activity)

I have tested "file" with the provided fit testdata (git/tests/fit-map-data.testfile) with two other versions of "file" (5.25 and 5.32) and both give the same result as in the Yocto build!
(i.e. NOT the expected result: the timestamp differs for 2 hours!)

please fix the expected result for the fit test.
Tags:
Steps To Reproduce: just execute: (in the file repo)
file tests/fit-map-data.testfile

this will produce:
fit-map-data.testfile: FIT Map data, unit id 65536, serial 3879446968, Sat May 31 12:00:34 2014, manufacturer 1 (garmin), product 1632, type 4 (Activity)

while the expected result for the automated test expects the timestamp to be "Sat May 31 10:00:34 2014" - 2 hours earlier
Additional Information: I don't know-if(/think-that) this is related to the virtual box I am running Ubuntu-16.04 in, I have no other machine to test that;
but the current time (output of the "time" command) is correct...
Attached Files:
Notes
(0003528)
JoergS   
2021-01-15 14:10   
the used commit for the file repo is: 87731415de945660b00f02207d8e9d986ef9b82e
(poky/meta/recipes-devtools/file/file_5.39.bb)
(0003529)
polluks   
2021-01-22 14:42   
Exactly two hours? Smells like GMT vs local time conflict...
(0003530)
JoergS   
2021-01-25 07:43   
Yeah - some timezone problem in our virtual-machine setup or alike - I meanwhile had the chance to run the "file" testsuite on a native Linux server, and there it worked!

BUT: why is the timezone even considered? shouldn't "file" simply read the absolute timestamp stored in that test-file and just display it?
I mean, if the local timezone is taken into consideration, wouldn't that require many "expected result" files then? one for every existing timezone in the world...
(0003537)
christos   
2021-02-05 22:03   
The formats use FILE_T_LOCAL so they use localtime instead of gmtime. Perhaps they should not?
(0003538)
christos   
2021-02-05 22:04   
It is a timezone issue. Changing FILE_T_LOCAL to 0 in softmagic.c should fix it, but is this better (to print times in GMT by default)?
(0003551)
JoergS   
2021-02-07 08:40   
Well, that file was generated at the displayed time, but in the timezone of the creator of the file, correct?
So when I look at the output, without any timezone information, it looks as if it was created in my local timezone...

Maybe show the timestamp converted to the local timezone - but in that case, testing would be horrible;
probably the better aproach: also show the timezone of the creator (if that info is available) or the timestamp relative to GMT as you suggested!
(0003552)
christos   
2021-02-08 14:52   
It appears that the magic for the maps is written on purpose to use leldate (local) instead of ledate (UTC). I think the easiest way is to stick a TZ=UTC before running the tests.
(0003553)
JoergS   
2021-02-09 11:26   
export TZ=UTC
before running the test works for me, thank you very much!!!

I think you can close this ticket now, and sorry for even raising this - wasn't a "file" problem at all in the end...

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
205 [file] General feature N/A 2020-10-23 12:27 2021-02-06 21:45
Reporter: utoddl Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: assigned Product Version: 5.38  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: option to indicate whether txt files have terminating line ending
Description: It would be nice to have an option to indicate whether the last line of a text file, or really any file that's made of lines of text, has a terminator on it's last line.

This could be off by default since it would involve a seek to the end and thus could impact performance and backward compatibility in the output. Or not, if that's not a big deal.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003545)
christos   
2021-02-05 23:03   
That's not easy because we don't always read the whole file.
(0003548)
utoddl   
2021-02-05 23:27   
Exactly why I suggested it would have to be an off-by-default option. (Although now I'm having second thoughts...)

It would only apply to inputs which had already been determined to be some sort of "text" in a seekable file, and not from some exotic source like a pipe.

Only then would it be reasonable to seek to the end (certainly not reading all the data -- that could be huge) and check the last couple of bytes for some combination of CR and LF, at which point an appropriate string could be added to that file's output.
(0003549)
christos   
2021-02-06 13:08   
All this is doable, but the cost-benefit (from both the code complexity and performance perspective) leans heavily on the cost and not the benefit..
(0003550)
utoddl   
2021-02-06 21:45   
I just crawled around through the code, and, yeah, I have to agree with you. :( It seems such a simple ask, but the existing code would have to be significantly reworked to wedge it in. I'm sorry to say we can let this one go until the next extreme makeover, because that's what it would take.

If you ever get the ./TODO list knocked out, particularly such that struct buffer becomes a thing that you can query, reload different parts of, etc., then implementing tests at the tail end of files would be much more straightforward. You'd still have to deal with piped data which may be very large or even unending. It would be neat if it could say for example how many pages are in a .pdf or how many YAML bodies are in a .yaml or whether a text file is terminated. It would also be neat if `file` could produce its output in a format more consumable by scripts, maybe json. But that a different RFQ altogether.

Thanks anway.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
231 [file] General minor always 2021-01-24 01:23 2021-02-05 23:21
Reporter: jidanni Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: assigned Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Empty file, or Empty directory?
Description: $ touch AA
$ file AA
AA: empty
# Empty file, or Empty directory?

$ mkdir BB
$ file BB
BB: directory
# Well, you told us if a file is empty or not, you should also on
directories too.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003539)
christos   
2021-02-05 22:07   
It is doable, but then you need to deal with errors (what if permission denied etc.). More trouble than worth.
(0003547)
jidanni   
2021-02-05 23:21   
OK. Too bad.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
224 [file] General minor have not tried 2021-01-04 12:59 2021-02-05 23:04
Reporter: jidanni Platform:  
Assigned To: christos OS:  
Priority: none OS Version:  
Status: feedback Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Move to GitHub
Description: Gosh, this Mantis stuff is unfamiliar.
Everybody is moving to GitHub.
Perhaps get on the bandwagon.

(Yes, a terrible bug report.)
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003546)
christos   
2021-02-05 23:04   
Yes, it is in the plans, but no time yet.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
223 [file] General trivial have not tried 2021-01-04 12:56 2021-02-05 23:02
Reporter: jidanni Platform:  
Assigned To: christos OS:  
Priority: low OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: there should be an option to tell the user just how long long lines are
Description: $ file www.youtube.com.har
www.youtube.com.har: UTF-8 Unicode text, with very long lines

OK, but there should be an option to tell the user just how long. 1234 chars?
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003544)
christos   
2021-02-05 23:02   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
228 [file] General minor always 2021-01-13 19:04 2021-02-05 22:56
Reporter: ahupp Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: 5.39 reports incorrect mime type for zip v2.0 files
Description: file 5.39 reports the mime type of a zip v2.0 file as "applicaction/octet-stream", while 5.38 correctly reports application/zip.
This was reproduced on archlinux.

Full details to reproduce the problem (creating the zip file, specific versions of arch) can be found here:

https://github.com/destream-py/destream/pull/20
Tags:
Steps To Reproduce: See https://github.com/destream-py/destream/pull/20#issuecomment-759650829, and the instructions above that comment to create the zip file.
Additional Information:
Attached Files:
Notes
(0003543)
christos   
2021-02-05 22:56   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
230 [file] General minor sometimes 2021-01-22 14:30 2021-02-05 22:29
Reporter: polluks Platform: PowerBook5,8  
Assigned To: christos OS: MorphOS  
Priority: normal OS Version: 3.15  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: INI: extra CR
Description: extra CR of a DOS INI file is not suppressed
Tags:
Steps To Reproduce: > file dict.ini
dict.ini: Generic INItialization configuration [LocaleInfo]\015
Additional Information:
System Description
Attached Files: dict.ini (79 bytes) 2021-01-22 14:30
https://bugs.astron.com/file_download.php?file_id=200&type=bug
Notes
(0003541)
christos   
2021-02-05 22:17   
Can you change the magic from "regex" to "regex/T" and see if that works?
(0003542)
christos   
2021-02-05 22:29   
Since you supplied an example, you also get a fix :-)

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
227 [file] General text always 2021-01-13 16:08 2021-02-05 22:08
Reporter: mb720 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Missing word in man page
Description: In the "Description" part of the man page it reads:

>The concept of a “magic” has been applied by extension to data files.

I think it should read:

>The concept of a “magic number” has been applied by extension to data files.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: file.man.patch (534 bytes) 2021-01-13 17:25
https://bugs.astron.com/file_download.php?file_id=199&type=bug
Notes
(0003525)
catull   
2021-01-13 17:14   
Rather than "magic number", I would use "magic marker" here.

There are not always numbers, but alpha-numeric instances.
(0003526)
catull   
2021-01-13 17:25   
Here's a simple patch
(0003527)
polluks   
2021-01-14 12:52   
Well, magic number is a technical term
https://en.wikipedia.org/wiki/Magic_number_(programming)
At machine level everything is a number ;-)
(0003540)
christos   
2021-02-05 22:08   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
232 [file] General minor always 2021-01-27 23:38 2021-02-05 21:58
Reporter: ratschance Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Devicetrees with a structure section larger than 1MB are not correctly identified
Description: The current implementation for the detection of Linux devicetree files does two checks to see whether the structure and strings sections are within the device tree blob. It seems like `file` only reads 1MB of the devicetree into its in memory buf, and so when the structure section is larger than 1MB, the check for the strings section becomes an out of bounds index into that buf and results in the devicetree not being identified. I have attached a patch of a potential fix.
Tags: magic
Steps To Reproduce: This becomes easy to reproduce when using U-Boot's Flattened Image Tree (FIT) format, which uses the device tree compiler to build a device tree blob containing boot images (kernel, rootfs, DTBs) and configurations. More info: https://gitlab.denx.de/u-boot/u-boot/-/blob/master/doc/uImage.FIT/source_file_format.txt

The following uses the `mkimage` command from the u-boot-tools package on Ubuntu:

# dd if=/dev/zero of=test-900K.bin bs=900K count=1
# mkimage -f auto -A arm -O linux -T ramdisk -C none -e 0 -d test-900K.bin 900k.itb
# file 900k.itb
900k.itb: Device Tree Blob version 17, size=923172, boot CPU=0, string block size=102, DT structure block size=922016

# dd if=/dev/zero of=test-1M.bin bs=1M count=1
# mkimage -f auto -A arm -O linux -T ramdisk -C none -e 0 -d test-1M.bin 1m.itb
# file 1m.itb
1m.itb: data


Expected output:
1m.itb: Device Tree Blob version 17, size=1050148, boot CPU=0, string block size=102, DT structure block size=1048992
Additional Information:
Attached Files: devicetree_1m_support.patch (1,054 bytes) 2021-01-27 23:38
https://bugs.astron.com/file_download.php?file_id=201&type=bug
Notes
(0003536)
christos   
2021-02-05 21:58   
Applied, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
226 [file] General feature have not tried 2021-01-08 17:59 2021-02-05 21:55
Reporter: catull Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Add support for "Birtual Machine" (not a typo)
Description: There is a stack-based VM called "Birtual Machine" being developed.
It comes with its own assembly language (BASM) and compiled image.

The image file has a header with magic marker 'bm', a version number and some size numbers.

This issue implements the magdir entries for reporting the meta information of Birtual Machine images.

More details are available here: https://github.com/tsoding/bm.
Tags: magic, patch
Steps To Reproduce:
Additional Information:
Attached Files: bm.patch (1,127 bytes) 2021-01-08 17:59
https://bugs.astron.com/file_download.php?file_id=198&type=bug
Notes
(0003535)
christos   
2021-02-05 21:55   
I added it, but the magic is really weak. It is 2021 and we are making 2 byte magic entries? Please let the developers know that they should have at least a 4 byte magic. If there are conflicts/complaints in the future it will be removed.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
233 [file] General trivial always 2021-01-31 01:31 2021-02-05 21:51
Reporter: endrift Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: magic/console: Game Boy ROM Image RAM size is wrong for byte 03
Description: For Game Boy ROM images where the RAM size byte is 03, libmagic/file says the RAM is 128 Kbits, but it is in fact 256 Kbits, as documented here: https://gbdev.io/pandocs/#_0149-ram-size and plenty of other places, including just looking at photos of cartridges like Link's Awakening DX (https://gbhwdb.gekkio.fi/static/DMG-AZLP-0/gekkio-1_02_pcb_front.jpg) which explicitly says the RAM chip is 256 Kbits on the PCB and chip. Seems like a pretty trivial fix.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003534)
christos   
2021-02-05 21:51   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
234 [file] General major have not tried 2021-02-03 12:13 2021-02-05 21:34
Reporter: halaei Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.38  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Memory problems running finfo::buffer with PHP_CLI
Description: PHP internally uses libmagic for getting information about files. This sample php code consumes 483 MB of RAM for detecting mimetype of a 48 MB MP3 file using php7.4 but it uses only 56 MB with php7.2.

    $finfo = new finfo(FILEINFO_MIME_TYPE, '');
    $contents = file_get_contents('file.mp3');
    echo($finfo->buffer($contents));

The bug is reported to php as well. They say it should be reported to libmagic. See https://bugs.php.net/bug.php?id=79263

The PHP bug is over 1 year old.
I reported the bug here as well: https://bugs.launchpad.net/ubuntu/+bug/1914401 .Maybe it wasn't the right place
Tags:
Steps To Reproduce: Having a large file.mp3 file. Run the following using php 7.4:

<?php
    $finfo = new finfo(FILEINFO_MIME_TYPE, '');
    $contents = file_get_contents('file.mp3');
    echo($finfo->buffer($contents));
    echo(memory_get_peak_usage(true)/1024/1024);
Additional Information:
Attached Files:
Notes
(0003533)
christos   
2021-02-05 21:34   
file_buffer(3) passed the full size of the buffer to the encoding
determination function. If the file was too large, we ended up
allocating (2 * size + 4 * size) buffers to scan for encoding. Now
we limit size to 64K.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
77 [file] General minor always 2019-04-29 13:35 2021-02-01 17:33
Reporter: yarikoptic Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: feedback Product Version: 5.35  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: -k, --keep-going does not list other hits - the other one might come out empty
Description: Detected while trying to workaround recently added detection of .json as application/json and not as text/plain. I thought that I would obtain both new application/json and text/plain if I use --keep-going . But the 2nd entry comes out to be blank.

As you can see below it is not happening for some other files, and is not unique to json
Tags:
Steps To Reproduce: /tmp > file --version
file-5.35
magic file from /etc/magic:/usr/share/misc/magic

/tmp > echo '{"a": 1}' >| file.json

/tmp > file --mime-type file.json
file.json: application/json

/tmp > file --mime-type -k file.json
file.json: application/json\012- \012-

/tmp > file --mime-type -k /usr/bin/* | head
/usr/bin/[: application/x-pie-executable\012- application/octet-stream
/usr/bin/0alias: application/x-pie-executable\012- application/octet-stream
/usr/bin/0desktop: application/x-pie-executable\012- application/octet-stream
/usr/bin/0install: application/x-pie-executable\012- application/octet-stream
/usr/bin/0launch: application/x-pie-executable\012- application/octet-stream
/usr/bin/0store: application/x-pie-executable\012- application/octet-stream
/usr/bin/0store-secure-add: application/x-pie-executable\012- application/octet-stream
/usr/bin/2to3: text/x-python\012-
/usr/bin/2to3-2.7: text/x-python\012-
/usr/bin/2to3-3.4: text/x-python\012-


/tmp > file --mime-type -k /usr/bin/* > /tmp/usr-bin-mime-types
/tmp > grep '\012- .*\012' /tmp/usr-bin-mime-types | head
/usr/bin/ack: text/x-perl\012- text/x-c\012-
/usr/bin/aclocal-1.16: text/x-perl\012- \012-
/usr/bin/afmtodit: text/x-perl\012- \012-
/usr/bin/apt-file: text/x-perl\012- \012-
/usr/bin/apt-rdepends: text/x-perl\012- \012-
/usr/bin/apxs: text/x-perl\012- \012-
/usr/bin/aspell-import: text/x-perl\012- \012-
/usr/bin/autoheader: text/x-perl\012- \012-
/usr/bin/autom4te: text/x-perl\012- \012-
/usr/bin/automake-1.16: text/x-perl\012- \012-
Additional Information:
Attached Files:
Notes
(0003243)
christos   
2019-05-06 21:24   
Fixed on HEAD.
(0003531)
sr-verde   
2021-02-01 08:50   
Can confirm that issue for version 5.39. Any progress here?

$ file -v
file-5.39
magic file from /usr/share/file/misc/magic
seccomp support included

$ file -k --mime-type /tmp/some.json
/tmp/some.json: application/json\012-

$ file -k --mime-type /tmp/some.csv
/tmp/some.csv: application/csv\012-
(0003532)
christos   
2021-02-01 17:33   
I committed a change to HEAD. Please try again.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
222 [file] General minor have not tried 2021-01-04 09:57 2021-01-04 19:48
Reporter: ryoon Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Add more Citrus locale database file support
Description: Citrus LC_CTYPE is detected currently, however the other types are not detected.
Add more types.

See:
LC_MONETARY: Citrus locale declaration for LC_MONETARY
LC_NUMERIC: Citrus locale declaration for LC_NUMERIC
LC_TIME: Citrus locale declaration for LC_TIME
SYS_LC_MESSAGES: Citrus locale declaration for LC_MESSAGES
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: file-more-citrus-db-files.diff (459 bytes) 2021-01-04 09:57
https://bugs.astron.com/file_download.php?file_id=197&type=bug
Notes
(0003523)
christos   
2021-01-04 19:48   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
225 [file] General major N/A 2021-01-04 14:14 2021-01-04 19:45
Reporter: brian Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.38  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Any way to set parameters with python bindings?
Description: I can't see any way to do the equivalent of:

file -Pelf_phnum=10000 core

with the python bindings. Am I just not seeing it?
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003522)
christos   
2021-01-04 19:45   
Added getparam/setparam in HEAD.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
221 [file] General minor have not tried 2020-12-31 08:25 2021-01-03 21:01
Reporter: ryoon Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Add font name for PostScript Printer Font Binary
Description: Please add font name for .pfb file.

For example:
0510A___.PFB: PostScript Type 1 font program data (AmeliaBT-Regular 003.001)
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: pfb-font-name.diff (510 bytes) 2020-12-31 08:25
https://bugs.astron.com/file_download.php?file_id=196&type=bug
Notes
(0003521)
christos   
2021-01-03 21:01   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
220 [file] General minor have not tried 2020-12-31 08:19 2021-01-03 20:59
Reporter: ryoon Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Add compression method for ZIP archive file
Description: Please include compression method to the output for ZIP archives.

For example:
deflate.zip: Zip archive data, at least v2.0 to extract, compression method=deflate
bzip2.zip: Zip archive data, at least v4.6 to extract, compression method=bzip2
lzma.zip: Zip archive data, at least v6.3 to extract, compression method=lzma
aes-256.zip: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: zip-comp-method.diff (400 bytes) 2020-12-31 08:19
https://bugs.astron.com/file_download.php?file_id=195&type=bug
Notes
(0003520)
christos   
2021-01-03 20:59   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
219 [file] General feature N/A 2020-12-28 17:24 2021-01-03 20:56
Reporter: jtn Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Add support for identifying LocoScript documents
Description: The attached patch adds magic for documents created by LocoScript, a word-processor from the 1980s/1990s.

More information about LocoScript: http://fileformats.archiveteam.org/wiki/LocoScript
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: 0001-Add-magic-for-LocoScript-documents.patch (1,030 bytes) 2020-12-28 17:24
https://bugs.astron.com/file_download.php?file_id=194&type=bug
Notes
(0003519)
christos   
2021-01-03 20:56   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
218 [file] General feature always 2020-12-23 22:19 2021-01-03 20:54
Reporter: dgilman Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Add support for e2fsck undo files
Description: e2fsck supports writing an undo file. Attached is a patch that adds support to libmagic for these files.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: 0001-Add-support-for-e2fsck-undo-files.patch (871 bytes) 2020-12-23 22:19
https://bugs.astron.com/file_download.php?file_id=193&type=bug
Notes
(0003518)
christos   
2021-01-03 20:54   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
208 [file] General feature N/A 2020-11-08 20:26 2020-12-21 15:21
Reporter: polluks Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: assigned Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Support for RISC OS filetypes
Description: Like "--apple", see https://en.wikipedia.org/wiki/List_of_RISC_OS_filetypes
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003504)
christos   
2020-12-16 23:35   
I am not sure if this is such a good idea. It will make the magic structure grow and I am not sure that many people will use it. Someone will also need to populate the magic entries...
(0003515)
polluks   
2020-12-21 14:19   
I know what you mean... https://riscosopen.org/forum/forums/5/topics/3933
However every Raspberry Pi user is potentially waiting for `--riscos`
and there should be not much overhead. Someone = myself? ;-)
(0003516)
christos   
2020-12-21 15:21   
It is not that hard to add it... But isn't RiskOS dead?

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
216 [file] General feature N/A 2020-12-20 00:12 2020-12-20 16:18
Reporter: polluks Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: CBM BASIC support
Description: --- c64.bak 2020-10-08 01:28:46 +0200
+++ c64 2020-12-20 00:58:42 +0100
@@ -58,3 +58,9 @@
 
 # bm bitmap
 0 string BM\xCB\x02 VDC bitmap
+
+# CBM BASIC (cc65 compiled)
+0 leshort 0x0801
+>2 leshort 0x080b
+>6 string \x9e CBM BASIC
+>7 string >\0 \b, SYS %s
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003514)
christos   
2020-12-20 16:18   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
211 [file] General minor always 2020-11-17 08:13 2020-12-17 20:45
Reporter: Albrecht Platform: Linux  
Assigned To: christos OS: Debian  
Priority: normal OS Version: Bullseye  
Status: resolved Product Version: 5.38  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: running file terminates with “ERROR: error reading”
Description: Running file on the attached sample file terminates with

albrecht@deneb:/tmp$ file file-error-sample ; echo $?
file-error-sample: ERROR: error reading (Invalid argument)
1

Guessing the MIME type is successful, though:

albrecht@deneb:/tmp$ file --mime-type file-error-sample ; echo $?
file-error-sample: application/x-executable
0
Tags:
Steps To Reproduce: 1. extract the attached archive
2. run commands as above
Additional Information:
Attached Files: file-error-sample.zip (1,415 bytes) 2020-11-17 08:13
https://bugs.astron.com/file_download.php?file_id=187&type=bug
Notes
(0003507)
christos   
2020-12-16 23:50   
I can't reproduce it:

[6:46pm] 109>./file -m ../magic/magic.mgc error_sample.zip
error_sample.zip: Zip archive data, at least v2.0 to extract
[6:46pm] 110>./file -v
file-5.39
magic file from /usr/local/share/misc/magic
[6:49pm] 115>/usr/bin/file -v
file-5.38
magic file from /etc/magic:/usr/share/misc/magic
[6:49pm] 116>/usr/bin/file error_sample.zip
error_sample.zip: Zip archive data, at least v2.0 to extract
[6:49pm] 117>uname -a
Linux uranus 5.4.0-56-generic 0000062-Ubuntu SMP Mon Nov 23 19:20:19 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
(0003512)
Albrecht   
2020-12-17 08:01   
Umm, sorry, please do not use the ZIP itself, but its extracted contents – I didn't want to post an executable as plain file. I.e. something like:

albrecht@deneb:/tmp$ unzip file-error-sample.zip
Archive: file-error-sample.zip
  inflating: file-error-sample
albrecht@deneb:/tmp$ file file-error-sample
file-error-sample: ERROR: error reading (Invalid argument)
(0003513)
christos   
2020-12-17 20:45   
Fixed in HEAD: ./file -m ../magic/magic.mgc file-error-sample
file-error-sample: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), can't read section at -1, missing section headers at 7136


View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
215 [file] General minor always 2020-12-16 06:19 2020-12-17 00:11
Reporter: davide Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: identify NeXT filesystems
Description: NeXT systems use a dedicated filesystem format based on UFS, it'd be useful for file to identify it properly. There's a straightforward magic string right at the beginning: "NeXT" for v1, "dlV2" for v2 and "dlV3" for v3.

The format is documented in a few places:
http://homepages.cs.ncl.ac.uk/nick.cook/csc2025/minix/3.2.1/usr/src/sys/sys/bootblock.h (search for "next68k")
https://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-44.3/IONeXTPartitionScheme.h (search for "dl_version")
Tags: file system, magic
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003511)
christos   
2020-12-17 00:11   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
212 [file] General feature always 2020-11-25 02:59 2020-12-16 23:57
Reporter: adalava Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Add PowerPC/OpenPOWER ABI descriptions
Description: I would like to share/upstream this patch I contributed to FreeBSD project to make "file" print description of witch ABI a binary is using.

Here's the link with the patch:

https://github.com/freebsd/freebsd/commit/313a7febbb346c95212db22a930e16b6c8552ce1#diff-56081bbe590d5b9526e1bdb87ba72927069ffde7ec9742e6e519a3ca5e8ddd7a
Tags:
Steps To Reproduce:
Additional Information: Output examples:

$ file teste-elfv1
teste-elfv1: ELF 64-bit MSB relocatable, 64-bit PowerPC or cisco 7500, Unspecified or Power ELF V1 ABI, version 1 (FreeBSD), not stripped

$ file teste-elfv2
teste-elfv2: ELF 64-bit MSB relocatable, 64-bit PowerPC or cisco 7500, OpenPOWER ELF V2 ABI, version 1 (FreeBSD), not stripped
Attached Files:
Notes
(0003509)
christos   
2020-12-16 23:57   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
207 [file] General feature have not tried 2020-10-31 15:44 2020-12-16 23:54
Reporter: rurban Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: More AutoCAD DWG/DXF
Description: See the patch.
dwg 2020+2021
dxf 2013-2021
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: 0001-Add-more-AutoCAD.patch (1,454 bytes) 2020-10-31 15:44
https://bugs.astron.com/file_download.php?file_id=185&type=bug
0001-Add-more-AutoCAD-2.patch (1,876 bytes) 2020-11-24 18:55
https://bugs.astron.com/file_download.php?file_id=188&type=bug
Notes
(0003498)
rurban   
2020-11-24 18:55   
Revised patch which also includes r13c3 detection. These files are unfortunately also in the wild.
Replaces the original 0001-Add-more-AutoCAD.patch
(0003508)
christos   
2020-12-16 23:54   
Applied, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
210 [file] General trivial always 2020-11-16 12:27 2020-12-16 23:42
Reporter: Helflym Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Wrong define for strndup workaround on AIX
Description: Hi,

In softmagic.c (https://github.com/file/file/blob/master/src/softmagic.c#L501), there is a workaround in order to provide strndup if it doesn't exist on the target or on AIX as strndup isn't working as expected.
However, the define used for AIX "__aiws__" is unknown to me. It should be "_AIX". Does anyone remember if it's a mistake or if it was intended ?
In both case, "defined(_AIX)" should be added in order to make it work in all AIX versions or with all AIX compilers.

Thanks,
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003506)
christos   
2020-12-16 23:42   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
209 [file] General crash always 2020-11-13 10:44 2020-12-16 23:38
Reporter: Helflym Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: apprentice.c:coalesce_entries can call malloc with a 0 size
Description: Hi,

When running "regex-eol", it happens that coalesce_entries is called with "nme = 0". Thus, "mentrycount" will be 0 and the malloc for "**ma" will be called with "slen = 0".
In most of the OSes, it does work and will return a pointer, but on AIX, it's not allowed and will raise a ENOMEM error.

I've made a patch to avoid calling coalesce_entries if there is no entries and it seems to work fine (all tests are OK).
It seems the logical approach to me. But I want to be sure that it's the correct way to fix it or if it would be better to still allocate a pointer even when there is no entries, as it's done right now on Linux.

Thanks,
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: file-5.39-avoid-coalesce_entries-when-there-is-no-entries.patch (457 bytes) 2020-11-13 10:44
https://bugs.astron.com/file_download.php?file_id=186&type=bug
Notes
(0003505)
christos   
2020-12-16 23:38   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
206 [file] General feature N/A 2020-10-27 19:25 2020-12-16 22:36
Reporter: polluks Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: More IFF magic
Description: --- iff.bak 2020-09-25 12:12:07 +0200
+++ iff 2020-10-27 00:41:15 +0100
@@ -53,6 +53,9 @@
 >8 string AMFF \b, AMFF AmigaMetaFile format
 >8 string WZRD \b, WZRD StormWIZARD resource
 >8 string DOC\ \b, DOC desktop publishing document
+>8 string SWRT \b, SWRT Final Copy/Writer document
+>8 string WTXT \b, WTXT Wordworth document
+>8 string WOWO \b, WOWO Wordworth document
 >8 string WVQA \b, Westwood Studios VQA Multimedia,
 >>24 leshort x %d video frames,
 >>26 leshort x %d x
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003503)
christos   
2020-12-16 22:36   
Applied, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
198 [file] General block always 2020-09-20 10:00 2020-12-15 23:58
Reporter: Thomas Platform: Intel64  
Assigned To: christos OS: Ubuntu  
Priority: normal OS Version: 18.04  
Status: feedback Product Version: 5.39  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Compiling with emscripten to WebAssembly fails
Description: I'm trying to compile libmagic to WebAssembly by using the emscripten toolchain to be able to use it in a WebExtension. It would be sufficient to get a static library. Unfortunately, the build of the library requires the execution of another target (e. g. file, to compile the magic list). This is a show stopper for emscripten, because executable targets will be WASM/JS (instead of a binary) and for sure not be executable on any build system.

According to the comment in 'magic/Makefile.am' line 333 (https://github.com/file/file/blob/master/magic/Makefile.am#L333), you might already be aware of this problem. It would be nice to have a fix for this soon. If you know any workaround for this, I would appreciate it to let me know.

Thanks for looking into it!
Tags: build
Steps To Reproduce: # setup emscripten first: https://emscripten.org/docs/getting_started/downloads.html#installation-instructions
cd /tmp
git clone https://github.com/file/file
cd file
autoreconf -i
emconfigure ./configure --prefix=/tmp/file --enable-static=yes --disable-shared
emmake make
Additional Information: Error log:
Making all in magic
make[2]: Entering directory '/tmp/file/magic'
../src/file -C -m magic
/bin/bash: ../src/file: Permission denied
Makefile:831: recipe for target 'magic.mgc' failed
make[2]: *** [magic.mgc] Error 126
make[2]: Leaving directory '/tmp/file/magic'
Makefile:460: recipe for target 'all-recursive' failed
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory '/tmp/file'
Makefile:369: recipe for target 'all' failed
make: *** [all] Error 2
Attached Files:
Notes
(0003487)
christos   
2020-10-11 20:05   
The file binary is built before it is being used to compile the magic database. So you are fine, you have a file binary and libmagic. Building magic.mgc can be done using a native build (and the same file will be produced). I don't really have the time to figure out the autoconf magic to make it build a native version of file in a cross-compile environment.
(0003493)
Thomas   
2020-10-12 04:53   
Do you have a target that allows to only build libmagic (without the file binary and especially without magic.mgc)? And do you have a target or two to only build the file binary and magic.mgc?
(0003496)
christos   
2020-10-14 21:13   
cd src && make libmagic.la
cd magic && make magic.mgc
cd src && make file

Like that?
(0003497)
Thomas   
2020-10-17 17:35   
Sounds promising, thank you! I cannot test it right now, but I'll give you feedback on that in several weeks and I will also post a solution for emscripten, if found.
(0003502)
christos   
2020-12-15 23:58   
Waiting on feedback.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
203 [file] General minor always 2020-10-19 22:55 2020-12-15 23:57
Reporter: vinc17 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.38  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: diff files starting with "--- prof" or "--- pipe" misidentified as CLIPPER instruction profile/trace
Description: It seems that all files starting with "--- prof" or "--- pipe" are regarded as CLIPPER instruction profile/trace files. But such files can actually be diff files.
Tags:
Steps To Reproduce: Consider the following file text.diff:

--- profession-a 2020-10-19 11:56:36 +0000
+++ profession-b 2020-10-19 22:23:01 +0000
@@ -1,5 +1,4 @@
 a
-b
 c
 d
 e

$ file text.diff
text.diff: CLIPPER instruction profile
Additional Information: The issue seems to come from the fact that magic/Magdir/clipper contains:

4 string pipe CLIPPER instruction trace
4 string prof CLIPPER instruction profile
Attached Files:
Notes
(0003501)
christos   
2020-12-15 23:57   
Commented out, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
204 [file] General major always 2020-10-21 03:15 2020-12-15 23:55
Reporter: hardboy_du Platform:  
Assigned To: christos OS:  
Priority: high OS Version:  
Status: feedback Product Version: 5.39  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: visio file is recognized as application/octet-stream
Description: > file -i test.vsdx ─╯
test.vsdx: application/octet-stream; charset=binary
Tags:
Steps To Reproduce: visio 2019
Additional Information:
Attached Files:
Notes
(0003500)
christos   
2020-12-15 23:55   
Do you have a sample file you can attach?

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
202 [file] General tweak always 2020-10-11 16:33 2020-10-11 20:28
Reporter: osmans Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.37  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Support Vim encryption modes
Description: The Magic file for Vim encrypted files (i.e. /file/magic/Magdir/editors) currently only reads the first 9 bytes and not the full 12 bytes used by Vim to define its encrypted files magic numbers[1]. This issue is to request that file should read the full 12 bytes so as to identify which of the three currently supported encryption modes were used to encrypt the file. I know this doesn't meet the 16byte bar, but it's what is authoritative for Vim.

Possible modes of Vim's built-in encryption are the following with their corresponding magic numbers as of Vim 8.2[2]:
* zip: VimCrypt~01!
* blowfish: VimCrypt~02!
* blowfish2: VimCrypt~03!

[1] https://github.com/vim/vim/blob/c667da5185ce5dce914d2006d62da2be0cedb384/src/crypt.c#L133
[2] https://github.com/vim/vim/blob/c667da5185ce5dce914d2006d62da2be0cedb384/src/crypt.c#L78-L131
Tags:
Steps To Reproduce: 1. Open up Vim with encryption enabled:
$ vim -x hello_world.encrypted

2. Specify which encryption method to use:
:set cryptmethod=blowfish2

3. Set password on the file:
:set key=hunter2

4. Save and exit:
:wq

5. Repeat for each supported cryptmethod and observe results of magic numbers used:
$ xxd -l 12 hello_world.encrypted
00000000: 5669 6d43 7279 7074 7e30 3121 VimCrypt~01!
$ xxd -l 12 hello_world2.encrypted
00000000: 5669 6d43 7279 7074 7e30 3221 VimCrypt~02!
$ xxd -l 12 hello_world3.encrypted
00000000: 5669 6d43 7279 7074 7e30 3321 VimCrypt~03!

I've done the reproduction in some dummy files which you can find attached to this report. All files are encrypted with the literal password "password"
Additional Information: Here is my proposed patch:

diff --git a/magic/Magdir/editors b/magic/Magdir/editors
index 78f3a840..93ad2955 100644
--- a/magic/Magdir/editors
+++ b/magic/Magdir/editors
@@ -11,7 +11,11 @@

 # Vi IMproved Encrypted file
 # by David Necas <yeti@physics.muni.cz>
+# updated by Osman Surkatty
 0 string VimCrypt~ Vim encrypted file data
+>9 string 01! with zip cryptmethod
+>9 string 02! with blowfish cryptmethod
+>9 string 03! with blowfish2 cryptmethod

 0 name vimnanoswap
 >67 byte 0
Attached Files: hello_world.encrypted (25 bytes) 2020-10-11 16:33
https://bugs.astron.com/file_download.php?file_id=182&type=bug
hello_world2.encrypted (41 bytes) 2020-10-11 16:33
https://bugs.astron.com/file_download.php?file_id=181&type=bug
hello_world3.encrypted (41 bytes) 2020-10-11 16:33
https://bugs.astron.com/file_download.php?file_id=180&type=bug
vim_magic.patch (461 bytes) 2020-10-11 16:36
https://bugs.astron.com/file_download.php?file_id=183&type=bug
Notes
(0003486)
osmans   
2020-10-11 16:36   
Attaching patch file.
(0003492)
christos   
2020-10-11 20:28   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
197 [file] General minor N/A 2020-09-11 04:49 2020-10-11 20:26
Reporter: factoreal Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Be File System (bfs) file recognition
Description: Hi all,

I don't know here is the right place for suggesting a new file type, but I do it and I hope it's useful.
When I was working on some file systems in the forensics lab, I noticed that the BFS file system has not been detected by file. According to the [Wikipedia] page:

>> The Be File System (BFS) is the native file system for the BeOS. In the Linux kernel, it is referred to as "BeFS" to avoid confusion with Boot File System.

So I decided to report this as an issue. Generating a BFS file image is very easy:

$ sudo dd if=/dev/random of=my_bfs.img bs=1M count=50
$ sudo mkfs.bfs my_bfs.img

Again reviewing the BFS file structure [here], we can find that the magic number is `1BADFACE'.
Hence adding the BFS file type to the file magic header list is very straightforward.

Regards

[Wikipedia]:https://en.wikipedia.org/wiki/Be_File_System
[here]:http://martin.hinner.info/fs/bfs/bfs-structure.html
Tags: bfs, file system
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003485)
polluks   
2020-10-09 08:28   
Attention!
You mixed two different file systems, please read your own quote!

BEFS_SUPER_MAGIC1 = 0x42465331, /* BFS1 */
BEFS_SUPER_MAGIC2 = 0xdd121031,
BEFS_SUPER_MAGIC3 = 0x15b6830e,
(0003491)
christos   
2020-10-11 20:26   
Added both.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
201 [file] General text always 2020-10-04 11:50 2020-10-11 20:14
Reporter: ferivoz Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Typo in manual page
Description: compatibility instead of compatilibity
---
 doc/file.man | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/file.man b/doc/file.man
index afba71e..c90e3ac 100644
--- a/doc/file.man
+++ b/doc/file.man
@@ -236,7 +236,7 @@ Like
 but ignore tests that
 .Nm
 does not know about.
-This is intended for compatilibity with older versions of
+This is intended for compatibility with older versions of
 .Nm .
 .It Fl Fl extension
 Print a slash-separated list of valid extensions for the file type found.
--
2.28.0
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003490)
christos   
2020-10-11 20:14   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
199 [file] General feature N/A 2020-09-25 07:58 2020-10-11 20:12
Reporter: polluks Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: MovieSetter support
Description: --- g:file/magic/Magdir/animation 2020-06-19 14:19:13 +0200
+++ animation 2020-09-25 02:35:30 +0200
@@ -905,12 +905,16 @@
 >0x42 ubeshort 0 no audio
 >0x42 ubeshort >0 %dHz audio
 
-# From: "Stefan A. Haubenthal" <polluks@web.de>
+# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
 0 string DVDVIDEO-VTS Video title set,
 >0x21 byte x v%x
 0 string DVDVIDEO-VMG Video manager,
 >0x21 byte x v%x
 
+# From: Stefan A. Haubenthal <polluks@sdf.lonestar.org>
+0 string xMovieSetter MovieSetter movie
+0 string xSceneEditor MovieSetter movie
+
 # From: Behan Webster <behanw@websterwood.com>
 # NuppelVideo used by Mythtv (*.nuv)
 # Note: there are two identical stanzas here differing only in the
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003489)
christos   
2020-10-11 20:12   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
200 [file] General feature N/A 2020-09-25 10:17 2020-10-11 20:07
Reporter: polluks Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Fantavision support
Description: --- iff.bak 2020-06-19 14:19:13 +0200
+++ iff 2020-09-25 12:12:07 +0200
@@ -41,6 +41,7 @@
 >8 string ANIM \b, ANIM animation
 >8 string YAFA \b, YAFA animation
 >8 string SSA\ \b, SSA super smooth animation
+>8 string FANT \b, Fantavision animation
 >8 string ACBM \b, ACBM continuous image
 >8 string FAXX \b, FAXX fax image
 # other formats
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003488)
christos   
2020-10-11 20:07   
added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
191 [file] General feature N/A 2020-08-26 13:37 2020-09-09 23:22
Reporter: vinc17 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: assigned Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: differentiate git commits and git commit logs
Description: A file starting with "commit " followed by a hash can be one of the various kinds of Git files. In particular, it can be:
1. a single commit with diff output, e.g. what "git show" outputs;
2. a git commit log, e.g. what "git log" outputs (there may also be various kinds of stats, such as with --stat);
3. a git commit log with diff output, e.g. what "git log --patch" outputs.

(1) and (2) are common. (3), which consists of a sequence of commits like in (2), but each one (except merge commits) with a diff like in (1), is possible, but I think that I've never seen it in practice.

For all of them, "file" outputs a description of the form "Git commit <hash>". This is particularly misleading for commit log files (2) as such files almost always contain several commits (thus several hashes). It should at least differentiate (1) and (2). Differentiating (3) from (1) is possible by reading a sufficient number of bytes, and I think that this is OK as this can be controlled by the end user with option -P (--parameter).

In the case the first line has the form "commit <hash>", I suggest to change the tests to output (depending on what one wishes for a single commit with no diff output):

1. If there are no lines starting with "diff ", output "Git commit log".
2. If there is another line of the form "commit <hash>", output "Git commit log with diff output".
3. Otherwise output "Git commit <hash>".

or

1. If there isn't another line of the form "commit <hash>", output "Git commit <hash>".
2. If there are no lines starting with "diff ", output "Git commit log".
3. Otherwise output "Git commit log with diff output".

where <hash> in the output is the hash obtained in the first line (which is what "file" currently gives).

Note: I think that if there is a diff, a "diff " line will occur in the first non-merge commit, so that there is room for optimization.
Tags:
Steps To Reproduce: On a git repository, check the output with:
$ git show
$ git log
$ git log --patch
Additional Information:
Attached Files: single-commit.txt (261 bytes) 2020-09-09 23:22
https://bugs.astron.com/file_download.php?file_id=179&type=bug
commit-log-with-diff.txt (523 bytes) 2020-09-09 23:22
https://bugs.astron.com/file_download.php?file_id=178&type=bug
commit-log.txt (289 bytes) 2020-09-09 23:22
https://bugs.astron.com/file_download.php?file_id=177&type=bug
Notes
(0003481)
christos   
2020-09-06 14:54   
I don't see any such files, can you post some examples?
(0003484)
vinc17   
2020-09-09 23:22   
I have added the 3 cases:
1. single-commit.txt (a single commit with diff output: what "git show" outputs)
2. commit-log.txt (a git commit log: what "git log" outputs)
3. commit-log-with-diff.txt (a git commit log with diff output: what "git log --patch" outputs)

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
187 [file] General feature have not tried 2020-08-24 02:36 2020-09-06 15:17
Reporter: joveler Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Support ALZ, EGG archive format
Description: Please include the ALZ/EGG archive format signature.

ALZ and EGG archive format was created by ESTSoft, Inc. ESTSoft's ALZip* software was a de-facto archive tool in Korea, making ALZ/EGG format somewhat prevalent on the Korean web.
*: https://en.wikipedia.org/wiki/ALZip

I have attached the diff file which contains a signature of ALZ and EGG archive format, and sample files for test.

Tags:
Steps To Reproduce:
Additional Information:
Attached Files: Samples.zip (2,049 bytes) 2020-08-24 02:36
https://bugs.astron.com/file_download.php?file_id=159&type=bug
Samples.egg (1,417 bytes) 2020-08-24 02:36
https://bugs.astron.com/file_download.php?file_id=158&type=bug
Samples.alz (999 bytes) 2020-08-24 02:36
https://bugs.astron.com/file_download.php?file_id=157&type=bug
0001-Add-ALZ-EGG-archive-signature.patch (898 bytes) 2020-08-24 02:36
https://bugs.astron.com/file_download.php?file_id=156&type=bug
0001-Add-ALZ-EGG-archive-signature-2.patch (1,221 bytes) 2020-08-31 02:43
https://bugs.astron.com/file_download.php?file_id=171&type=bug
Notes
(0003469)
neal   
2020-08-28 15:12   
I took a brief look at the patch and the signature is surprisingly small (3 bytes for alz files and 4 bytes for egg files). Is there no other relatively fixed data available? Perhaps a field with a version number?
(0003470)
joveler   
2020-08-31 02:43   
@neal
I have updated the EGG format signature by adding a version and split/solid archive detection.

The ALZ format, however, does not have any official file format document. As such, it is only possible by the reading the source of unalz (thrid party decompressor), which would take some time. In the meantime, I have changed its magic to `ALZ\001` from `ALZ` to avoid misidentification of text files.
(0003483)
christos   
2020-09-06 15:17   
Added, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
195 [file] General minor have not tried 2020-09-01 10:19 2020-09-05 17:39
Reporter: neal Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Different execution depending on whether or not --mime-type is given
Description: Consider the following magic file:

0 byte x
>0 use foo
>>0 byte x 1
>>0 use bar

0 name foo
>0 byte x 2

0 name bar
>0 byte x 3
!:mime application/3


When I run it (using file 5.35 from Debian or the latest from github.com/file/file), I see the following:

$ file -m /tmp/mime.magic /tmp/byte.bin
/tmp/byte.bin: 2 1 3
us@grit:~/neal/src/file$ file --mime-type -m /tmp/mime.magic /tmp/byte.bin
/tmp/byte.bin: application/octet-stream

What I'd expect is the following:

$ src/file --mime-type -m /tmp/mime.magic /tmp/byte.bin
/tmp/byte.bin: application/3
$ src/file -m /tmp/mime.magic /tmp/byte.bin
/tmp/byte.bin: 2 1 3

The problem is that after executing foo, match sets *returnval to 0 when --mime-type is specified and 1 when it is not. AIUI, *returnval basically means: "we printed something." When --mime-type is specified, the magic entries in foo don't have any mime information, so nothing is printed and *returnvalue is 0. When --mime-type is not specified, the descriptions are printed, so something is printed and *returnval is 1. This causes mget to behave differently: for FILE_USE, it returns *return_value.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: byte.bin (256 bytes) 2020-09-01 10:19
https://bugs.astron.com/file_download.php?file_id=174&type=bug
mime.magic (116 bytes) 2020-09-01 10:19
https://bugs.astron.com/file_download.php?file_id=173&type=bug
0005-Change-mget-to-return-whether-a-USE-execute-not-whet.patch (1,716 bytes) 2020-09-01 12:19
https://bugs.astron.com/file_download.php?file_id=175&type=bug
Notes
(0003471)
neal   
2020-09-01 11:53   
I've spent some time studying the code and I think the correct solution is to change mget so that FILE_USE behaves like the other entry types.

Reading mget, it appears that -1 is returned if there is an error, 0 is returned if the accessed data is not buffered, and 1 is returned if the data could be read.

I've tried to figure out what match's return type means, but it seems to depend on many conditions. I think it does the following: If match returns -1, then an error occured. If an annotation was handled, it returns 1. If cont_level is 0 and an offset is used (OFFADD), it returns 0. Otherwise, it returns *returnval. *returnval can be set by mget or set directly. When set directly, it is set to 1. This is done if mget returns 1 and type is FILE_INDIRECT, if handle_annotation returns an error (-1) or success (1), or if something is displayed. mget only changes returnval insofar as it passes returnval to match when the magic entry's type is FILE_USE.

As a first approximation, it seems that mget with FILE_USE is returning whether the procedure matched whereas in other cases, mget is only returning whether the data could be loaded. The match case should actually be handled by magiccheck, and, to align FILE_USE's behavior with other types, this should only return whether the use "executed." My attached patch changes the behavior of mget. In issue 0000190 (https://bugs.astron.com/view.php?id=190), I fixed magiccheck.
(0003480)
christos   
2020-09-05 17:39   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
194 [file] General minor always 2020-08-31 10:10 2020-09-05 17:20
Reporter: puchuu Platform: *-linux-musl  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Missing seccomp whitelist entries for musl libc
Description: Musl libc uses system calls different from whitelisted in seccomp.c.
Please test file on musl system too.
Tags:
Steps To Reproduce: Compile file and try to launch it.
Additional Information: Please visit https://bugs.gentoo.org/730540
Attached Files: seccomp.patch (750 bytes) 2020-08-31 10:10
https://bugs.astron.com/file_download.php?file_id=172&type=bug
Notes
(0003478)
christos   
2020-09-05 17:20   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
193 [file] General minor have not tried 2020-08-27 19:47 2020-09-05 17:17
Reporter: neal Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: use incorrectly resets the offset
Description: Consider the following magic file:

0 byte x
>&10 byte x 1:%d
>>&10 byte x 2:%d
>&20 use foo
>>&10 byte x 3:%d

0 name foo
>&200 byte x 4:%d

I would expect it to print:

/tmp/byte.bin: 1:11 2:22 4:221 3:31

but it actually prints:

/tmp/byte.bin: 1:11 2:22 4:221 3:10

It appears that when a 'use' returns, it does not reset ms->offset to the parent continuation's offset.
Tags:
Steps To Reproduce: $ file -d -m /tmp/offset.magic /tmp/byte.bin
unknown, 0: Warning: using regular magic file `/tmp/offset.magic'
(no description): binary
(no description): text
[try zmagic 0]
[try tar 0]
[try json 0]
[try cdf 0]
[try elf 0]
bb=[0x7f3ab19bb010,256], 0 [b=0x7f3ab19bb010,256], [o=0, c=0]
mget(type=1, flag=0x20, offset=0, o=0, nbytes=256, il=0, nc=0)
mget/96 @0: \000\001\002\003\004\005\006\a\b\t\n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_

1: > 0 byte&,x,""]
0 == *any* = 1
bb=[0x7f3ab19bb010,256], 10 [b=0x7f3ab19bb010,256], [o=0xa, c=1]
mget(type=1, flag=0x2, offset=11, o=0, nbytes=256, il=0, nc=0)
mget/96 @11: \v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghij

2: >> 10 byte&,x,"1:%d"]
11 == *any* = 1
bb=[0x7f3ab19bb010,256], 10 [b=0x7f3ab19bb010,256], [o=0xa, c=2]
mget(type=1, flag=0x2, offset=22, o=0, nbytes=256, il=0, nc=0)
mget/96 @22: \026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstu

3: >>> 10 byte&,x,"2:%d"]
22 == *any* = 1
bb=[0x7f3ab19bb010,256], 20 [b=0x7f3ab19bb010,256], [o=0x14, c=1]
mget(type=46, flag=0x2, offset=21, o=0, nbytes=256, il=0, nc=0)
mget/96 @21: \025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrst

4: >> 20 use,='foo',""]
bb=[0x7f3ab19bb010,256], 0 [b=0x7f3ab19bb010,256], [o=0, c=0]
mget(type=45, flag=0, offset=0, o=21, nbytes=256, il=0, nc=1)
mget/96 @0: \025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrst

7: > 0 name,='foo',""]
bb=[0x7f3ab19bb010,256], 200 [b=0x7f3ab19bb010,256], [o=0xc8, c=1]
mget(type=1, flag=0x2, offset=200, o=21, nbytes=256, il=0, nc=1)
mget/96 @200: \335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000

8: >> 200 byte&,x,"4:%d"]
18446744073709551581 == *any* = 1
bb=[0x7f3ab19bb010,256], 10 [b=0x7f3ab19bb010,256], [o=0xa, c=2]
mget(type=1, flag=0x2, offset=10, o=0, nbytes=256, il=0, nc=0)
mget/96 @10: \n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghi

5: >>> 10 byte&,x,"3:%d"]
10 == *any* = 1
[try softmagic 1]
/tmp/byte.bin: 1:11 2:22 4:221 3:10
Additional Information:
Attached Files: byte.bin (256 bytes) 2020-08-27 19:47
https://bugs.astron.com/file_download.php?file_id=169&type=bug
offset.magic (105 bytes) 2020-08-27 19:47
https://bugs.astron.com/file_download.php?file_id=168&type=bug
0004-Save-ms-offset-around-calls-to-use.patch (1,505 bytes) 2020-08-28 13:01
https://bugs.astron.com/file_download.php?file_id=170&type=bug
Notes
(0003467)
neal   
2020-08-27 20:27   
Another example:

0 byte x
>&10 byte x 1:%d
>>&10 byte x 2:%d
>&10 byte x 3:%d
>>&20 use foo
>>>&10 byte x 4:%d
>&10 byte x 5:%d

0 name foo
>&200 byte x 6:%d

$ file -m /tmp/offset.magic /tmp/byte.bin
/tmp/byte.bin: 1:11 2:22 3:11 6:232 4:10 5:10

Since we have "4:10", it appears that not only is the parent continuation's offset ignored, but the offset is reset to 0.
(0003468)
neal   
2020-08-28 13:01   
The attached patch appears to fix the problem:

$ src/file -d -m /tmp/offset.magic /tmp/byte.bin
unknown, 0: Warning: using regular magic file `/tmp/offset.magic'
(no description): binary
(no description): text
[try zmagic 0]
[try tar 0]
[try json 0]
[try csv 0]
[try cdf 0]
[try elf 0]
bb=[0x7f6d3cd7c010,256,0], 0 [b=0x7f6d3cd7c010,256,0], [o=0, c=0]
mget(type=1, flag=0x20, offset=0, o=0, nbytes=256, il=0, nc=0)
mget/128 @0: \000\001\002\003\004\005\006\a\b\t\n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~\177

1: > 0 byte&,x,""]
0 == *any* = 1
bb=[0x7f6d3cd7c010,256,0], 10 [b=0x7f6d3cd7c010,256,0], [o=0xa, c=1]
mget(type=1, flag=0x2, offset=11, o=0, nbytes=256, il=0, nc=0)
mget/128 @11: \v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~\177\200\201\202\203\204\205\206\207\210\211\212

2: >> 10 byte&,x,"1:%d"]
11 == *any* = 1
bb=[0x7f6d3cd7c010,256,0], 10 [b=0x7f6d3cd7c010,256,0], [o=0xa, c=2]
mget(type=1, flag=0x2, offset=22, o=0, nbytes=256, il=0, nc=0)
mget/128 @22: \026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225

3: >>> 10 byte&,x,"2:%d"]
22 == *any* = 1
bb=[0x7f6d3cd7c010,256,0], 10 [b=0x7f6d3cd7c010,256,0], [o=0xa, c=1]
mget(type=1, flag=0x2, offset=11, o=0, nbytes=256, il=0, nc=0)
mget/128 @11: \v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~\177\200\201\202\203\204\205\206\207\210\211\212

4: >> 10 byte&,x,"3:%d"]
11 == *any* = 1
bb=[0x7f6d3cd7c010,256,0], 20 [b=0x7f6d3cd7c010,256,0], [o=0x14, c=2]
mget(type=46, flag=0x2, offset=32, o=0, nbytes=256, il=0, nc=0)
mget/128 @32: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237

5: >>> 20 use,='foo',""]
bb=[0x7f6d3cd7c010,256,0], 0 [b=0x7f6d3cd7c010,256,0], [o=0, c=0]
mget(type=45, flag=0, offset=0, o=32, nbytes=256, il=0, nc=1)
mget/128 @0: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237

9: > 0 name,='foo',""]
bb=[0x7f6d3cd7c010,256,0], 200 [b=0x7f6d3cd7c010,256,0], [o=0xc8, c=1]
mget(type=1, flag=0x2, offset=200, o=32, nbytes=256, il=0, nc=1)
mget/128 @200: \350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000

10: >> 200 byte&,x,"6:%d"]
18446744073709551592 == *any* = 1
bb=[0x7f6d3cd7c010,256,0], 10 [b=0x7f6d3cd7c010,256,0], [o=0xa, c=3]
mget(type=1, flag=0x2, offset=42, o=0, nbytes=256, il=0, nc=0)
mget/128 @42: *+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251

6: >>>> 10 byte&,x,"4:%d"]
42 == *any* = 1
bb=[0x7f6d3cd7c010,256,0], 10 [b=0x7f6d3cd7c010,256,0], [o=0xa, c=1]
mget(type=1, flag=0x2, offset=11, o=0, nbytes=256, il=0, nc=0)
mget/128 @11: \v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~\177\200\201\202\203\204\205\206\207\210\211\212

7: >> 10 byte&,x,"5:%d"]
11 == *any* = 1
[try softmagic 1]
/tmp/byte.bin: 1:11 2:22 3:11 6:232 4:42 5:11



Also, it fixes the value of line 7 (which I had overlooked): it should be 5:11, not 5:10.
(0003477)
christos   
2020-09-05 17:17   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
190 [file] General minor have not tried 2020-08-26 13:02 2020-09-05 14:58
Reporter: neal Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: use always matches
Description: Consider the following:

0 byte x 1
>0 use foo
>>0 byte x 2

0 name foo
>0 byte =1 3

I would expect this to print:

$ src/file -m /tmp/use.magic /tmp/byte.bin
/tmp/byte.bin: 1

But, it does the following:

$ src/file -m /tmp/use.magic /tmp/byte.bin
/tmp/byte.bin: 1 2

This is because magiccheck (softmagic.c:2240) always returns 1 when determining whether a USE or NAME matched.

I have some magic code that finds the start of a block of data and then checks whether the data has the required signature. I wanted to use a 'use foo' to check the data. But, that doesn't work, because the 'use foo' doesn't fail.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: byte.bin (256 bytes) 2020-08-26 13:02
https://bugs.astron.com/file_download.php?file_id=165&type=bug
use.magic (61 bytes) 2020-08-26 13:02
https://bugs.astron.com/file_download.php?file_id=164&type=bug
0002-Change-use-to-only-return-true-if-its-sub-continuati.patch (4,008 bytes) 2020-08-26 20:30
https://bugs.astron.com/file_download.php?file_id=166&type=bug
Notes
(0003465)
neal   
2020-08-26 20:30   
The attached patch fixes the above issue.

It changes 'use' to act like the body of the named continuation were pasted in its place.
(0003466)
neal   
2020-08-26 20:31   
The above patch should probably only be applied if https://bugs.astron.com/view.php?id=189 is also applied.
(0003476)
christos   
2020-09-05 14:58   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
192 [file] General minor have not tried 2020-08-26 20:45 2020-09-05 14:31
Reporter: neal Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Typo in magic file
Description: msooxml contains a pretty obvious typo: like the other formats, the visio match should be a subcontinuation, not a top-level continuation. (Note: I haven't tested this.)
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: 0003-Fix-magic.patch (885 bytes) 2020-08-26 20:45
https://bugs.astron.com/file_download.php?file_id=167&type=bug
Notes
(0003475)
christos   
2020-09-05 14:31   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
188 [file] General minor always 2020-08-26 08:37 2020-09-05 14:28
Reporter: neal Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: nested use of name is unexpected
Description: file doesn't handle non-top level "name" directives well.
Tags:
Steps To Reproduce: Consider the following magic file (also attached):

0 byte x 1
>0 name foo
>>0 byte x in foo
>0 byte x 2
>0 use foo

If this successfully parses, then I'd expect the 'use foo' to succeed. Instead, it executes from top to bottom *including the body of foo*, and then fails at the 'use foo' line. See the trace below.

I can understand not wanting the complexity that non-top level named continuations would introduce. But, in that case, I think the parse should reject files that have named continuations that are not at the top level.
Additional Information: $ file -d -m /tmp/nested-name.magic /tmp/byte.bin
unknown, 0: Warning: using regular magic file `/tmp/nest-name.magic'
1: binary
[try zmagic 0]
[try tar 0]
[try json 0]
[try cdf 0]
[try elf 0]
bb=[0x7f227cca8010,256], 0 [b=0x7f227cca8010,256], [o=0, c=0]
mget(type=1, flag=0x20, offset=0, o=0, nbytes=256, il=0, nc=0)
mget/96 @0: \000\001\002\003\004\005\006\a\b\t\n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_

1: > 0 byte&,x,"1"]
0 == *any* = 1
bb=[0x7f227cca8010,256], 0 [b=0x7f227cca8010,256], [o=0, c=1]
mget(type=45, flag=0, offset=0, o=0, nbytes=256, il=0, nc=0)
mget/96 @0: \000\001\002\003\004\005\006\a\b\t\n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_

2: >> 0 name,='foo',""]
bb=[0x7f227cca8010,256], 0 [b=0x7f227cca8010,256], [o=0, c=2]
mget(type=1, flag=0, offset=0, o=0, nbytes=256, il=0, nc=0)
mget/96 @0: \000\001\002\003\004\005\006\a\b\t\n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_

3: >>> 0 byte&,x,"in foo"]
0 == *any* = 1
bb=[0x7f227cca8010,256], 0 [b=0x7f227cca8010,256], [o=0, c=1]
mget(type=1, flag=0, offset=0, o=0, nbytes=256, il=0, nc=0)
mget/96 @0: \000\001\002\003\004\005\006\a\b\t\n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_

4: >> 0 byte&,x,"2"]
0 == *any* = 1
bb=[0x7f227cca8010,256], 0 [b=0x7f227cca8010,256], [o=0, c=1]
mget(type=46, flag=0, offset=0, o=0, nbytes=256, il=0, nc=0)
mget/96 @0: \000\001\002\003\004\005\006\a\b\t\n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_

4: >> 0 use,='foo',""]
[try softmagic -1]
/tmp/byte.bin: ERROR: 1 in foo 2 cannot find entry `foo'
Attached Files: nested-name.magic (63 bytes) 2020-08-26 08:37
https://bugs.astron.com/file_download.php?file_id=160&type=bug
0001-Fix-use.patch (10,365 bytes) 2020-08-26 12:12
https://bugs.astron.com/file_download.php?file_id=163&type=bug
Notes
(0003464)
neal   
2020-08-26 12:12   
This fixes the issue for me. I've tried to make the changes as non-invasive as possible.
(0003474)
christos   
2020-09-05 14:28   
Fixed, thanks!
mag2, 2: Warning: `name foo' entries can only be declared at top level

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
189 [file] General minor have not tried 2020-08-26 10:44 2020-09-05 14:17
Reporter: neal Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version:  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: 'use' corrupts 'ms->c'
Description: Consider the following magic file:

10 byte x
>&0 byte x 1:%d
>&0 use foo
>&0 byte x 2:%d

20 name foo
>&30 byte x 3:%d

I would expect this to output:

/tmp/byte.bin: 1:11 3:41 2:11

instead, it outputs

/tmp/byte.bin: 1:11 3:41 2:0

Commenting out line 3 ('use foo') causes line 4 to correctly output 2:11.


According to my analysis, this happens, because when mget handles a FILE_USE entry (around line 'softmagic.c:1890') , it recursively calls 'match' with the same magic_set ('ms'). 'match' sets 'cont_level' to 0, and initializes 'ms->c[0]'. Unfortunately, and 'match' doesn't restore it before returning. (In fact, it has to restore the whole continuation level.)

I suspect that the easiest fix would be to turn 'ms->c' into a stack and each time 'match' is used, a new continuation array is pushed. Then before 'match' returns, it pops off the top continuation array.
Tags:
Steps To Reproduce: $ file -d -m /tmp/cont_level.magic /tmp/byte.bin
unknown, 0: Warning: using regular magic file `/tmp/cont_level.magic'
(no description): binary
(no description): text
[try zmagic 0]
[try tar 0]
[try json 0]
[try cdf 0]
[try elf 0]
bb=[0x7f1ab5c42010,256], 10 [b=0x7f1ab5c42010,256], [o=0xa, c=0]
mget(type=1, flag=0x20, offset=10, o=0, nbytes=256, il=0, nc=0)
mget/96 @10: \n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghi

1: > 10 byte&,x,""]
10 == *any* = 1
bb=[0x7f1ab5c42010,256], 0 [b=0x7f1ab5c42010,256], [o=0, c=1]
mget(type=1, flag=0x2, offset=11, o=0, nbytes=256, il=0, nc=0)
mget/96 @11: \v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghij

2: >> 0 byte&,x,"1:%d"]
11 == *any* = 1
bb=[0x7f1ab5c42010,256], 0 [b=0x7f1ab5c42010,256], [o=0, c=1]
mget(type=46, flag=0x2, offset=11, o=0, nbytes=256, il=0, nc=0)
mget/96 @11: \v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghij

3: >> 0 use,='foo',""]
bb=[0x7f1ab5c42010,256], 20 [b=0x7f1ab5c42010,256], [o=0x14, c=0]
mget(type=45, flag=0, offset=20, o=11, nbytes=256, il=0, nc=1)
mget/96 @20: \037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~

6: > 20 name,='foo',""]
bb=[0x7f1ab5c42010,256], 30 [b=0x7f1ab5c42010,256], [o=0x1e, c=1]
mget(type=1, flag=0x2, offset=30, o=11, nbytes=256, il=0, nc=1)
mget/96 @30: )*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~\177\200\201\202\203\204\205\206\207\210

7: >> 30 byte&,x,"3:%d"]
41 == *any* = 1
bb=[0x7f1ab5c42010,256], 0 [b=0x7f1ab5c42010,256], [o=0, c=1]
mget(type=1, flag=0x2, offset=0, o=0, nbytes=256, il=0, nc=0)
mget/96 @0: \000\001\002\003\004\005\006\a\b\t\n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_

4: >> 0 byte&,x,"2:%d"]
0 == *any* = 1
[try softmagic 1]
/tmp/byte.bin: 1:11 3:41 2:0
Additional Information:
Attached Files: byte.bin (256 bytes) 2020-08-26 10:44
https://bugs.astron.com/file_download.php?file_id=162&type=bug
cont_level.magic (84 bytes) 2020-08-26 10:44
https://bugs.astron.com/file_download.php?file_id=161&type=bug
Notes
(0003473)
christos   
2020-09-05 14:17   
Nice catch! Thanks.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
137 [file] General minor always 2020-02-02 04:02 2020-08-25 01:29
Reporter: Kid Platform: x86_64  
Assigned To: christos OS: Linux (Arch)  
Priority: normal OS Version: 5.4.2  
Status: feedback Product Version: 5.37  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: MP4 Video File Incorrectly Identified as Audio
Description: ■ xxd 2020-01-22.mp4 | head
00000000: 0000 001c 6674 7970 4d53 4e56 0100 2500 ....ftypMSNV..%.
00000010: 4d53 4e56 6973 6f6d 6d70 3432 0000 0008 MSNVisommp42....
00000020: 6672 6565 3c0f b333 6d64 6174 0001 a2fd free<..3mdat....
00000030: 65b8 0400 2fec 2ddd ec5c d873 95cc 4bcf e.../.-..\.s..K.
00000040: 9fec c7a1 dca9 43a1 0271 55e5 28cc 0390 ......C..qU.(...
00000050: f052 bed2 5546 08ce e157 00bb 48c8 effc .R..UF...W..H...
00000060: d3ef d4ec 9de9 ae80 b81d 6eee 01ca 9888 ..........n.....
00000070: 92a2 197e c781 1e86 49d9 d9af 70aa c58a ...~....I...p...
00000080: 2987 184d 017c 2a01 b058 bde5 4780 3abb )..M.|*..X..G.:.
00000090: d3e2 332a 96f4 da91 8236 7ece 5334 4c6e ..3*.....6~.S4Ln
■ ffprobe -hide_banner 2020-01-22.mp4
Input #0, mov,mp4,m4a,3gp,3g2,mj2, from '2020-01-22.mp4':
  Metadata:
    major_brand : MSNV
    minor_version : 16786688
    compatible_brands: MSNVisommp42
    creation_time : 2020-01-22T13:59:53.000000Z
    title :
    artist :
    album :
    date :
    track : 0
    genre :
    comment :
  Duration: 00:43:10.96, start: 0.033356, bitrate: 3115 kb/s
    Stream #0:0(eng): Video: h264 (High) (avc1 / 0x31637661), yuv420p, 1280x720 [SAR 1:1 DAR 16:9], 2983 kb/s, 29.97 fps, 29.97 tbr, 30k tbn, 59.94 tbc (default)
    Metadata:
      creation_time : 2020-01-22T13:59:53.000000Z
      handler_name : Video Media Handler
      encoder : AVC Coding
    Stream #0:1(eng): Audio: aac (LC) (mp4a / 0x6134706D), 44100 Hz, stereo, fltp, 127 kb/s (default)
    Metadata:
      creation_time : 2020-01-22T13:59:53.000000Z
      handler_name : Sound Media Handler
■ file --mime-type -Lb 2020-01-22.mp4
audio/mp4
■ file --mime-type -l 2020-01-22.mp4
Set 0:
Binary patterns:
Strength = 500@47: Biosig/Brainvision Marker file [biosig/brainvision]
Strength = 490@122: Biosig/TMSiLOG [biosig/tmsilog]
Strength = 461@127: Biosig/SYNERGY [biosig/synergy]
Strength = 460@46: Biosig/Brainvision V-Amp file []
Strength = 410@45: Biosig/Brainvision data file []
Strength = 380@6: OpenSSH private key []
Strength = 361@107: EICAR virus test files []
Strength = 360@19: Biosig/ATES MEDICA SOFT. EEG for Windows [biosig/ates]
Strength = 350@188: SketchUp Model [application/vnd.sketchup.skp]
Strength = 340@618: sc68 Atari ST music []
Strength = 340@35: T64 tape Image []
Strength = 340@40: T64 tape Image []
Strength = 340@19: Erlang JAM file - version 4.3 []
Strength = 340@51: Mathematica binary file []
Strength = 340@695: %s [application/vnd.ms-excel]
Strength = 340@66: Bazaar merge directive []
Strength = 340@92: SQLite 2.x database []
Strength = 340@136: Paged COBALT boot rom []
Strength = 331@280: NetImmerse game engine file []
Strength = 330@1540: LyNX archive []
Strength = 330@49: FrameMaker IPL file [application/x-mif]
Strength = 330@267: Gamebryo game engine file []
Strength = 330@61: PGP public key block [application/pgp-keys]
Strength = 320@361: %s []
Strength = 320@333: SNES SPC700 sound file []
Strength = 320@8: BinHex binary text [application/mac-binhex40]
Strength = 320@689: %s [application/vnd.ms-excel]
Strength = 320@27: old timezone data []
Strength = 320@28: old timezone data []
Strength = 320@29: old timezone data []
Strength = 320@30: old timezone data []
Strength = 320@31: old timezone data []
Strength = 320@32: old timezone data []
Strength = 310@16: Erlang JAM file - version 4.2 []
Strength = 310@17: Erlang JAM file - version 4.2 []
Strength = 310@16: PostScript Type 1 font text []
Strength = 310@83: Caris ASCII project summary []
Strength = 310@7: old ACE/gr binary file []
Strength = 310@752: InnoSetup Log [application/x-innosetup]
Strength = 300@273: Gamebryo game engine animation File []
Strength = 300@18: Mathematica notebook []
Strength = 300@650: %s [application/msword]
Strength = 300@59: Subversion dumpfile []
Strength = 300@9: PEM certificate []
Strength = 290@203: %s []
Strength = 290@20: FGDC ASCII metadata []
Strength = 290@652: Spanish Microsoft Word 6 document data [application/msword]
Strength = 290@65: Bazaar Bundle []
Strength = 290@10: PEM certificate request []
Strength = 280@994: NUT multimedia container []
Strength = 280@1230: shell archive text [application/octet-stream]
Strength = 280@12: Clojure script text executable [text/x-clojure]
Strength = 280@104: AVG 7 Antivirus vault file data []
Strength = 280@20: ACE/gr fit description file []
Strength = 280@950: Paint Shop Pro Image File []
Strength = 280@69: PGP signature [application/pgp-signature]
Strength = 271@382: Windows Registry text (Win2K or above) [text/x-ms-regedit]
Strength = 270@119: Biosig/TMS32 [biosig/tms32]
Strength = 270@2389: floppy image data (ApriDisk) []
Strength = 270@178: Quake I save: ddm4 East side invertationa []
Strength = 270@196: Linux S390 []
Strength = 270@68: Mathematica 3.0 notebook []
Strength = 270@64: abook address book [application/x-abook-addressbook]
Strength = 270@642: AAF legacy file using MS Structured Storage []
Strength = 270@645: AAF file using MS Structured Storage []
Strength = 270@58: Microsoft Roslyn C# debugging symbols version 1.0 []
Strength = 270@10: Netscape Address book []
Strength = 270@14: PEM ECDSA private key []
Strength = 261@61: GCOV coverage report []
Strength = 260@667: Guitar Pro Ver. 3 Tablature []
Strength = 260@950: Junglevision instrument data []
Strength = 260@20: Clojure script text executable [text/x-clojure]
Strength = 260@645: Mozilla Mork database []
Strength = 260@39: Kate swap file []
Strength = 260@164: Quake I save: d7 The incinerator plant []
Strength = 260@168: Quake I save: d12 Takahiro laboratories []
Strength = 260@12: ACE/gr ascii file []
Strength = 260@7: NASA SPICE file (transfer format) []
Strength = 260@16: Netscape folder cache []
Strength = 260@7: NetWare Loadable Module []
Strength = 260@65: PGP message [application/pgp]
Strength = 260@251: Freeplane document [application/x-freeplane]
Strength = 260@257: Scribus Document [application/x-scribus]
Strength = 250@146: GUS patch []
Strength = 250@147: Old GUS patch []
Strength = 250@603: %s []
Strength = 250@84: Biosig/Galileo [biosig/galileo]
Strength = 250@147: Biosig/File exchange format (FEF) [biosig/fef]
Strength = 250@16: Clojure script text executable [text/x-clojure]
Strength = 250@79: Bourne-Again shell script executable (binary data) [text/x-shellscript]
Strength = 250@12: Diamond Multimedia Document []
Strength = 250@125: FreeBSD/i386 a.out core file []
Strength = 250@87: Quake I save: e1m1 The slipgate complex []
Strength = 250@88: Quake I save: e1m2 Castle of the damned []
Strength = 250@101: Quake I save: e2m6 The dismal oubliette []
Strength = 250@105: Quake I save: e3m4 Satan's dark delight []
Strength = 250@110: Quake I save: e4m2 The tower of despair []
Strength = 250@111: Quake I save: e4m3 The elder god shrine []
Strength = 250@117: Quake I save: end Shub-Niggurath's pit []
Strength = 250@137: Quake I save: hip2m6 The gremlin's domain (secret) []
Strength = 250@145: Quake I save: hipdm1 The edge of oblivion (secret) []
Strength = 250@175: Quake I save: ddm1 The seventh precinct []
Strength = 250@65: CLISP byte-compiled Lisp program text []
Strength = 250@31: Maple worksheet, but weird []
Strength = 250@11: PEM RSA private key []
Strength = 250@12: PEM DSA private key []
Strength = 250@302: Bochs disk image, []
Strength = 250@397: WINE registry text []
Strength = 240@8: Clojure script text executable [text/x-clojure]
Strength = 240@305: Adobe Multiple Master font []
Strength = 240@306: Adobe Multiple Master font []
Strength = 240@94: Quake I save: e1m7 The house of Chthon []
Strength = 240@102: Quake I save: e3m1 Termination central []
Strength = 240@108: Quake I save: e3m6 Chambers of torment []
Strength = 240@121: Quake I save: dm1 Place of two deaths []
Strength = 240@131: Quake I save: hip1m1 The pumping station []
Strength = 240@138: Quake I save: hip2m2 The black cathedral []
Strength = 240@166: Quake I save: d8 The underwater base []
Strength = 240@10: ACE/gr ascii file []
Strength = 240@11: ACE/gr ascii file []
Strength = 240@701: Lisp Machine bit-array-file []
Strength = 240@566: DR-DOS executable (COM) [application/x-dosexec]
Strength = 240@13: PEM EC private key []
Strength = 230@638: SAPCAR archive data []
Strength = 230@408: %s []
Strength = 230@444: Fast Tracker II Instrument []
Strength = 230@93: Quake I save: e1m6 The door to Chthon []
Strength = 230@97: Quake I save: e2m3 The crypt of decay (dopefish lives!) []
Strength = 230@100: Quake I save: e2m5 The wizard's manse []
Strength = 230@104: Quake I save: e3m3 The tomb of terror []
Strength = 230@112: Quake I save: e4m4 The palace of hate []
Strength = 230@122: Quake I save: dm2 Claustrophobopolis []
Strength = 230@123: Quake I save: dm3 The abandoned base []
Strength = 230@14: Grace project file []
Strength = 230@79: Linux/i386 swap file (new style) (compressed hibernate) []
Strength = 230@43: Cyrus skiplist DB []
Strength = 230@44: Cyrus twoskip DB []
Strength = 230@874: Winamp plug in []
Strength = 230@894: PGP sig []
Strength = 230@895: PGP sig []
Strength = 230@896: PGP sig []
Strength = 230@897: PGP sig []
Strength = 230@898: PGP sig []
Strength = 230@902: MS Windows special zipped file []
Strength = 230@28: Perl script text executable [text/x-perl]
Strength = 230@6: pkg Datastream (SVR4) [application/x-svr4-package]
Strength = 230@47: Amstrad/Spectrum .DSK data []
Strength = 230@49: Amstrad/Spectrum Extended .DSK data []
Strength = 230@296: MS Windows shortcut []
Strength = 230@256: Scribus Document []
Strength = 220@1019: Interplay MVE Movie []
Strength = 220@278: MIPS archive [application/x-archive]
Strength = 220@621: EXP1 archive data []
Strength = 220@98: Creative Labs voice data [audio/x-unknown]
Strength = 220@452: SHARP Cell-Phone ringing Melody []
Strength = 220@30: Biosig/alpha trace [biosig/alpha]
Strength = 220@10: Clojure script text executable [text/x-clojure]
Strength = 220@18: Clojure script text executable [text/x-clojure]
Strength = 220@6: Alpha archive []
Strength = 220@90: Quake I save: e1m4 The grisly grotto []
Strength = 220@99: Quake I save: e2m4 The ebon fortress []
Strength = 220@106: Quake I save: e3m7 The haunted halls (secret) []
Strength = 220@109: Quake I save: e4m1 The sewage system []
Strength = 220@114: Quake I save: e4m8 The nameless city (secret) []
Strength = 220@135: Quake I save: hip1m4 Research facility []
Strength = 220@51: KiCad Footprint (Legacy) []
Strength = 220@77: Linux/i386 swap file (new style) with SWSUSP1 image []
Strength = 220@1400: Microsoft Word Document [application/msword]
Strength = 220@26: Perl script text executable [text/x-perl]
Strength = 220@48: Amstrad/Spectrum DU54 .DSK data []
Strength = 220@10: OpenSSH ECDSA public key []
Strength = 220@11: OpenSSH ECDSA public key []
Strength = 220@12: OpenSSH ECDSA public key []
Strength = 220@354: Internet Explorer cache file []
Strength = 220@7: Smith Corona PWP []
Strength = 211@152: Biosig/FIFF [biosig/fiff]
Strength = 210@271: Sample Vision file []
Strength = 210@608: XMMS equalizer preset []
Strength = 210@14: Clojure script text executable [text/x-clojure]
Strength = 210@75: Bourne-Again shell script executable (binary data) [text/x-shellscript]
Strength = 210@474: Neo Geo Pocket [application/x-neo-geo-pocket-rom]
Strength = 210@525: X11 Xauthority data []
Strength = 210@526: X11 Xauthority data []
Strength = 210@527: X11 Xauthority data []
Strength = 210@528: X11 Xauthority data []
Strength = 210@529: X11 Xauthority data []
Strength = 210@530: X11 Xauthority data []
Strength = 210@531: X11 Xauthority data []
Strength = 210@532: X11 Xauthority data []
Strength = 210@533: X11 Xauthority data []
Strength = 210@2439: %s []
Strength = 210@91: Quake I save: e1m8 Ziggurat vertigo (secret) []
Strength = 210@95: Quake I save: e2m1 The installation []
Strength = 210@96: Quake I save: e2m2 The ogre citadel []
Strength = 210@132: Quake I save: hip1m2 Storage facility []
Strength = 210@133: Quake I save: hip1m5 Military complex (secret) []
Strength = 210@156: Quake I save: d11 The genetics lab (secret) []
Strength = 210@47: GIMP curve file []
Strength = 210@251: Canon CR2 raw image data [image/x-canon-cr2]
Strength = 210@631: iff image data []
Strength = 210@64: CLISP byte-compiled Lisp program (pre 2004-03-27) []
Strength = 210@290: MSX ExecROM patchfile []
Strength = 201@449: PNG image data (CgBI) [image/png]
Strength = 201@26: Java HPROF dump, []
Strength = 200@31: Mugician Module sound file []
Strength = 200@1291: BitTorrent file [application/x-bittorrent]
Strength = 200@114: Pdmenu configuration file text []
Strength = 200@11: PostScript Type 1 font text []
Strength = 200@13: PostScript Type 1 font program data []
Strength = 200@154: Quake I save: d3b Secret missions []
Strength = 200@159: Quake I save: d2 Takahiro towers []
Strength = 200@181: Quake I save: ddm7 Sandra's ladder []
Strength = 200@441: PNG image data [image/png]
Strength = 200@53: Maple something []
Strength = 200@56: Maple something []
Strength = 200@68: MSVC .wsp version 1.0000.0000 []
Strength = 200@45: Sniffer capture file []
Strength = 200@198: Hangul (Korean) Word Processor File 3.0 []
Strength = 191@142: Biosig/Sigma [biosig/sigma]
Strength = 191@353: Embedded OpenType (EOT) []
Strength = 191@23: KiCad Symbol Library []
Strength = 191@38: MSVC program database [application/x-ms-pdb]
Strength = 191@184: MSX Kanji Font []
Strength = 190@891: VRML 1 file [model/vrml]
Strength = 190@170: Fasttracker II module sound data [audio/x-mod]
Strength = 190@235: Sidplay info file []
Strength = 190@268: NIST SPHERE file []
Strength = 190@437: RAD Adlib Tracker Module RAD []
Strength = 190@546: BambooTracker module []
Strength = 190@551: BambooTracker instrument []
Strength = 190@130: Biosig/UNIPRO [biosig/unipro]
Strength = 190@145: Biosig/File exchange format (FEF) [biosig/fef]
Strength = 190@71: Bourne-Again shell script executable (binary data) [text/x-shellscript]
Strength = 190@210: Sega Mega CD disc image [application/x-sega-cd-rom]
Strength = 190@214: Sega Mega CD disc image [application/x-sega-cd-rom]
Strength = 190@219: Sega Mega CD disc image [application/x-sega-cd-rom]
Strength = 190@223: Sega Mega CD disc image [application/x-sega-cd-rom]
Strength = 190@349: Sega Saturn disc image [application/x-saturn-rom]
Strength = 190@354: Sega Saturn disc image [application/x-saturn-rom]
Strength = 190@375: Sega Dreamcast disc image [application/x-dc-rom]
Strength = 190@380: Sega Dreamcast disc image [application/x-dc-rom]
Strength = 190@547: CGNS Advanced Data Format []
Strength = 190@1579: ntfsclone image, []
Strength = 190@2070: Aculab VoIP firmware []
Strength = 190@32: FrameMaker Font file [application/x-mif]
Strength = 190@89: Quake I save: e1m3 The necropolis []
Strength = 190@136: Quake I save: hip2m1 Ancient realms []
Strength = 190@147: Quake I save: hipend Armagon's lair []
Strength = 190@161: Quake I save: d4 Into the flood []
Strength = 190@179: Quake I save: ddm5 Slaughterhouse []
Strength = 190@79: mbsystem info cache []
Strength = 190@8: GNOME keyring []
Strength = 190@55: G-IR binary database []
Strength = 190@539: group 3 fax data []
Strength = 190@995: PartImage []
Strength = 190@1214: Garmin Bitmap file []
Strength = 190@8: Karma Data Structure Version []
Strength = 190@360: Xen saved domain []
Strength = 190@366: Xen saved domain []
Strength = 190@7: MacOS Alias file []
Strength = 190@52: Maple something []
Strength = 190@55: Maple something []
Strength = 190@57: Maple something anomalous. []
Strength = 190@7: Digifax-G3-File []
Strength = 190@9: Mozilla XUL fastload data []
Strength = 190@1047: Windows Program Information File [application/x-dosexec]
Strength = 190@6: ASCII font metrics []
Strength = 190@118: Canon Bubble Jet BJC formatted data []
Strength = 190@122: Epson Stylus Color 460 data []
Strength = 190@14: Git bundle []
Strength = 190@311: Sony Wave64 RIFF data []
Strength = 190@326: MBWF/RF64 audio [audio/x-wav]
Strength = 190@28: CNS ASCII electron density map []
Strength = 190@56: MAR Area Detector Image, []
Strength = 190@352: Network Instruments Observer capture file []
Strength = 190@141: H2 Database file []
Strength = 190@8: BEA TUXEDO DES mask data []
Strength = 190@6: Xerox InterPress data []
Strength = 190@49: XPConnect Typelib []
Strength = 190@197: Libvirt QEMU Suspend Image []
Strength = 190@203: Libvirt QEMU partial Suspend Image []
Strength = 185@112: XML [text/xml]
Strength = 181@31: KiCad Symbol Library Documentation []
Strength = 180@32: Sidmon 2.0 Module sound file []
Strength = 180@47: Android Backup [application/x-google-ab]
Strength = 180@893: ISO/IEC 14772 VRML 97 file [model/vrml]
Strength = 180@294: SGI SoundTrack project file []
Strength = 180@511: Synthesizer Generator or Kimwitu data []
Strength = 180@513: Kimwitu++ data []
Strength = 180@78: Biosig/Embla [biosig/embla]
Strength = 180@6: Clojure script text executable [text/x-clojure]
Strength = 180@263: XZ compressed data [application/x-xz]
Strength = 180@458: Microsoft Access Database [application/x-msaccess]
Strength = 180@460: Microsoft Access Database [application/x-msaccess]
Strength = 180@103: Quake I save: e3m2 Vaults of Zin []
Strength = 180@113: Quake I save: e4m5 Hell's atrium []
Strength = 180@115: Quake I save: e4m6 The pain maze []
Strength = 180@124: Quake I save: dm4 The bad place []
Strength = 180@126: Quake I save: dm6 The dark zone []
Strength = 180@134: Quake I save: hip1m3 The lost mine []
Strength = 180@139: Quake I save: hip2m3 The catacombs []
Strength = 180@141: Quake I save: hip2m5 Mortum's keep []
Strength = 180@157: Quake I save: d4b Back to Malice []
Strength = 180@163: Quake I save: d6 Nuclear plant []
Strength = 180@167: Quake I save: d9 Takahiro base []
Strength = 180@169: Quake I save: d13 Stayin' alive []
Strength = 180@177: Quake I save: ddm3 Crazy eights! []
Strength = 180@59: Mathematica PBF (fonts I think) []
Strength = 180@7: vCalendar calendar file [text/calendar]
Strength = 180@15: MSVC .ide []
Strength = 180@61: GLF_TEXT []
Strength = 180@111: PCP pmieconf rules []
Strength = 180@13: SPECjbb []
Strength = 180@99: SQLite 3.x database [application/x-sqlite3]
Strength = 180@4: OpenSSH RSA1 private key, []
Strength = 176@902: X3D (Extensible 3D) model xml text [model/x3d+xml]
Strength = 171@233: part of multipart Debian package [application/vnd.debian.binary-package]
Strength = 171@164: ultratracker V1.%.1s module sound data [audio/x-mod]
Strength = 171@61: KiCad Symbol Library Table []
Strength = 171@8: SVG Scalable Vector Graphics image [image/svg+xml]
Strength = 171@26: OpenStreetMap XML data []
Strength = 171@144: Portable Embosser Format [application/x-pef+xml]
Strength = 171@288: MS Windows HyperTerminal profile []
Strength = 170@30: Art Of Noise Module sound file []
Strength = 170@888: Vivo video data []
Strength = 170@1058: Material exchange container format [application/mxf]
Strength = 170@1237: LBR archive data []
Strength = 170@30: T64 tape Image []
Strength = 170@93: Famicom Disk System disk image: [application/x-fds-disk]
Strength = 170@551: Tokyo Cabinet []
Strength = 170@582: TokyoCabinet database []
Strength = 170@86: Quake I save: start Introduction []
Strength = 170@107: Quake I save: e3m5 Wind tunnels []
Strength = 170@146: Quake I save: hip3m4 The gauntlet []
Strength = 170@155: Quake I save: d10 The hospital (secret) []
Strength = 170@160: Quake I save: d3 A rat's life []
Strength = 170@241: Canon CIFF raw image data [image/x-canon-crw]
Strength = 170@501: MIFF image data []
Strength = 170@54: Maple something []
Strength = 170@906: Icon for MS Windows []
Strength = 170@7: Qt Resource Collection file []
Strength = 170@72: GEDCOM data []
Strength = 170@73: GEDCOM data []
Strength = 170@17: SE Linux policy module source []
Strength = 170@18: SE Linux policy module source []
Strength = 161@67: KiCad Footprint Library Table []
Strength = 161@69: PJL encapsulated PostScript document text []
Strength = 160@661: ARS-Sfx archive data []
Strength = 160@575: CFF Song []
Strength = 160@663: iMelody Ringtone Format []
Strength = 160@8: BlockHashLoc recovery info, []
Strength = 160@133: Biosig/WCP [biosig/wcp]
Strength = 160@11: CCS C64 Emultar Cartridge Image []
Strength = 160@347: Spline Font Database [application/vnd.font-fontforge-sfd]
Strength = 160@116: Quake I save: e4m7 Azure agony []
Strength = 160@125: Quake I save: dm5 The cistern []
Strength = 160@140: Quake I save: hip2m4 The crypt []
Strength = 160@142: Quake I save: hip3m1 Tur torment []
Strength = 160@143: Quake I save: hip3m2 Pandemonium []
Strength = 160@151: Quake I save: start The academy []
Strength = 160@165: Quake I save: d7b The foundry []
Strength = 160@170: Quake I save: d14 B.O.S.S. HQ []
Strength = 160@176: Quake I save: ddm2 Sub station []
Strength = 160@164: Gnumeric spreadsheet []
Strength = 160@7: Gnumeric spreadsheet [application/x-gnumeric]
Strength = 160@899: PGP sig []
Strength = 160@12: OASIS Stream file []
Strength = 160@29: PostScript document []
Strength = 160@50: HP Printer Job Language data []
Strength = 160@59: HP Printer Job Language data []
Strength = 160@78: HP Printer Job Language data []
Strength = 160@113: PCP pmie config []
Strength = 160@17: SPECweb []
Strength = 160@93: SunPC 4.0 Properties Values []
Strength = 151@374: MS-DOS KEYBoard Layout file []
Strength = 151@387: Windows Registry little-endian text (Win2K or above) [text/x-ms-regedit]
Strength = 150@83: TADS []
Strength = 150@919: Video title set, []
Strength = 150@921: Video manager, []
Strength = 150@1346: Personal NetWare Packed File []
Strength = 150@595: VQF data []
Strength = 150@81: Version Biosig/ETG4000 [biosig/etg4000]
Strength = 150@47: C64 Raw Tape File (.tap), []
Strength = 150@67: Bourne-Again shell script executable (binary data) [text/x-shellscript]
Strength = 150@1171: SYSLINUX loader []
Strength = 150@2281: Marvell Libertas firmware []
Strength = 150@2311: dvdisaster error correction file []
Strength = 150@92: Quake I save: e1m5 Gloom keep []
Strength = 150@98: Quake I save: e2m7 Underearth (secret) []
Strength = 150@130: Quake I save: start Command HQ []
Strength = 150@197: Build engine group file []
Strength = 150@475: GIF image data [image/gif]
Strength = 150@515: SunPHIGS []
Strength = 150@1707: Khronos KTX texture []
Strength = 150@12: JPEG image data [image/jpeg]
Strength = 150@101: JPEG 2000 []
Strength = 150@65: Cyrus sieve bytecode data, []
Strength = 150@23: Maple help file with extra carriage return at start (yuck) []
Strength = 150@1118: MS Windows HtmlHelp Data []
Strength = 150@28: Microsoft Visual C .pch []
Strength = 150@13: PDF document [application/pdf]
Strength = 150@46: PPD file []
Strength = 150@70: GEDCOM data []
Strength = 150@71: GEDCOM data []
Strength = 150@20: SE Linux policy interface source []
Strength = 150@59: Open Inventor 2.0 file []
Strength = 150@67: GLS_TEXT []
Strength = 150@104: PCP pmdahotproc config []
Strength = 150@6: teapot work sheet (XDR format) []
Strength = 150@22: header for PowerPC PEF executable []
Strength = 150@349: MS Windows help cache []
Strength = 150@246: Freemind document [application/x-freemind]
Strength = 141@99: TADS 3 game data (format version %d) []
Strength = 141@12: Public Suffix List data (optimized) []
Strength = 140@72: AMOS Basic source code []
Strength = 140@929: MythTV NuppelVideo []
Strength = 140@311: NeXT/Apple typedstream data, big endian []
Strength = 140@316: NeXT/Apple typedstream data, little endian []
Strength = 140@581: PUCrunch archive data []
Strength = 140@1288: BitTorrent file [application/x-bittorrent]
Strength = 140@392: OctaMED Soundstudio compressed file []
Strength = 140@943: WOPL instrument []
Strength = 140@945: WOPL instrument bank []
Strength = 140@18: Korn shell script executable (binary data) [text/x-shellscript]
Strength = 140@20: Message Sequence Chart (document) []
Strength = 140@576: Quick Database Manager, little endian []
Strength = 140@577: Quick Database Manager, big endian []
Strength = 140@303: ELF []
Strength = 140@1173: SYSLINUX loader []
Strength = 140@14: PostScript Type 1 font program data []
Strength = 140@15: PostScript Type 1 font program data []
Strength = 140@49: Clam AntiVirus []
Strength = 140@113: Avira AntiVir quarantined [application/x-avira-qua]
Strength = 140@162: Quake I save: d5 The flood []
Strength = 140@171: Quake I save: d15 Showdown! []
Strength = 140@260: TIFF image data, big-endian [image/tiff]
Strength = 140@264: TIFF image data, little-endian [image/tiff]
Strength = 140@1257: Radiance HDR image data []
Strength = 140@8: IslandWrite document []
Strength = 140@53: Linux make config build file (old) []
Strength = 140@22: Maple help file []
Strength = 140@32: Mathematica notebook version 2.x []
Strength = 140@36: Mathematica notebook version 2.x []
Strength = 140@12: vCard visiting card [text/vcard]
Strength = 140@1021: RabbitGraph file []
Strength = 140@7: PDF document [application/pdf]
Strength = 140@21: FDF document [application/vnd.fdf]
Strength = 140@6: sc spreadsheet file [application/x-sc]
Strength = 140@36: sendmail m4 text file []
Strength = 140@58: IRIS Inventor 1.0 file []
Strength = 140@312: AIX iptrace capture file []
Strength = 140@313: AIX iptrace capture file []
Strength = 140@13: OpenSSH ED25519 public key []
Strength = 140@59: ncurses6 screen image []
Strength = 140@13: Internet Archive File [application/x-ia-arc]
Strength = 131@103: TADS 3 saved game data (format version []
Strength = 131@1367: DOS/MBR boot sector []
Strength = 131@1813: reMarkable tablet notebook lines, 1404 x 1872, %x page(s) []
Strength = 131@1820: reMarkable tablet page (v%c), 1404 x 1872, []
Strength = 131@39: KiCad Board Layout []
Strength = 131@97: Protein Data Bank data, ID Code %s [chemical/x-pdb]
Strength = 130@90: TADS []
Strength = 130@46: catalog translation []
Strength = 130@413: NuLIB archive data []
Strength = 130@429: DPA archive data []
Strength = 130@639: SAPCAR archive data []
Strength = 130@590: LockStream Embedded file (mostly MP3 on old Nokia phones) []
Strength = 130@37: Biosig/BCI2000 []
Strength = 130@66: Biosig/CED SMR [biosig/ced-smr]
Strength = 130@161: MegaCAD 2D/3D drawing []
Strength = 130@9: POSIX shell script executable (binary data) [text/x-shellscript]
Strength = 130@363: snappy framed data [application/x-snappy-framed]
Strength = 130@2395: disk image data (YAZE) []
Strength = 130@12: FrameMaker document [application/x-mif]
Strength = 130@28: Boom or linuxdoom demo []
Strength = 130@92: IVS Fledermaus TDR file []
Strength = 130@190: HP Bitmapfile []
Strength = 130@514: PHIGS clear text archive []
Strength = 130@74: Linux/i386 swap file []
Strength = 130@83: Linux/i386 swap file (new style), []
Strength = 130@96: Linux/ppc swap file []
Strength = 130@107: Linux/ia64 swap file []
Strength = 130@7: Metastore data file, []
Strength = 130@630: COM executable for MS-DOS, Compack compressed [application/x-dosexec]
Strength = 130@1019: First Choice database []
Strength = 130@1121: GFA-BASIC 3 data []
Strength = 130@5: Octave binary data (little endian) []
Strength = 130@6: Octave binary data (big endian) []
Strength = 130@58: perl Storable (v0.6) data []
Strength = 130@103: Imagen printer []
Strength = 130@146: HP LaserJet 1000 series downloadable firmware []
Strength = 130@7: project file for ftnchek []
Strength = 130@22: BRIX Electron Density Map []
Strength = 130@27: XPLOR ASCII Electron Density Map []
Strength = 130@39: R-Axis Area Detector Image: []
Strength = 130@47: R-Axis Area Detector Image, Win32: []
Strength = 130@20: openssl enc'd data with salted password, base64 encoded []
Strength = 130@17: VICAR label file []
Strength = 130@737: PaintShop Pro color palette []
Strength = 125@115: Linux kernel []
Strength = 121@55: Apple DOS 3.3 Image []
Strength = 121@74: Apple Pascal Image []
Strength = 120@69: TADS []
Strength = 120@75: TADS []
Strength = 120@49: AmigaGuide file []
Strength = 120@476: Apple Desktop Services Store []
Strength = 120@1275: GTKtalog catalog data, []
Strength = 120@439: XMS Adlib Module []
Strength = 120@516: TFMX module sound data []
Strength = 120@577: A2M Song []
Strength = 120@191: lzop compressed data []
Strength = 120@14: Vim encrypted file data []
Strength = 120@214: Smart Boot Manager backup file []
Strength = 120@244: Norton Utilities disc image data []
Strength = 120@1832: DOS floppy 360k []
Strength = 120@1834: DOS floppy 720k []
Strength = 120@1836: DOS floppy 1440k []
Strength = 120@1839: DOS floppy 720k, IBM []
Strength = 120@1841: DOS floppy 1440k, mkdosfs []
Strength = 120@1844: Atari-ST floppy 360k []
Strength = 120@1845: Atari-ST floppy 720k []
Strength = 120@2051: ReiserFS V3.6 []
Strength = 120@2052: ReiserFS V3.6.19 []
Strength = 120@2213: Delta ISO data []
Strength = 120@2230: Oracle Clustered Filesystem, []
Strength = 120@2244: Oracle Clustered Filesystem, []
Strength = 120@2265: Files-11 On-Disk Structure []
Strength = 120@59: Macromedia Freehand 7 Document []
Strength = 120@60: Macromedia Freehand 8 Document []
Strength = 120@62: Macromedia Freehand 9 Document []
Strength = 120@37: FrameMaker Book file [application/x-mif]
Strength = 120@152: Quake I save: d1 The lab []
Strength = 120@153: Quake I save: d1b Area 33 []
Strength = 120@691: FITS image data [image/fits]
Strength = 120@21: Maple help file []
Strength = 120@34: Maple worksheet []
Strength = 120@30: Mathematica notebook version 2.x []
Strength = 120@40: Mathematica notebook version 2.x []
Strength = 120@42: Mathematica notebook version 2.x []
Strength = 120@655: Microsoft Word document data [application/msword]
Strength = 120@861: Lotus WordPro [application/vnd.lotus-wordpro]
Strength = 120@1017: First Choice document []
Strength = 120@1024: MKS Spell hash list []
Strength = 120@11: Microsoft Visual C .APS file []
Strength = 120@18: MSVC .res []
Strength = 120@19: MSVC .res []
Strength = 120@20: MSVC .res []
Strength = 120@7: ASCII font bits []
Strength = 120@101: PCP pmlogger config []
Strength = 120@10: Compiled SGML rules file []
Strength = 120@12: A/E SGML Document binary []
Strength = 120@14: A/E SGML binary styles file []
Strength = 120@11: Spectrum +3 data []
Strength = 116@200: , rawbits, bitmap [image/x-portable-bitmap]
Strength = 116@207: , rawbits, greymap [image/x-portable-greymap]
Strength = 116@214: , rawbits, pixmap [image/x-portable-pixmap]
Strength = 115@266: DOS/MBR boot sector []
Strength = 115@1998: []
Strength = 111@60: Digital Symphony sequence (RISC OS), []
Strength = 111@1026: Windows Television DVR Media []
Strength = 111@29: APT cache data, version %u []
Strength = 111@34: APT cache data, version %u []
Strength = 111@328: []
Strength = 111@330: []
Strength = 111@332: []
Strength = 111@765: Nintendo GameCube disc image (WDFv1 format): [application/x-gamecube-rom]
Strength = 111@1161: isolinux Loader []
Strength = 111@1215: NetBSD mbr []
Strength = 111@1250: AdvanceMAME mbr []
Strength = 111@1259: Turton mbr ( []
Strength = 111@10: EDID data, version %u. []
Strength = 111@48: []
Strength = 111@1049: DjVu multiple page document [image/vnd.djvu]
Strength = 111@15: KiCad Schematic Document []
Strength = 111@385: Journal file [application/octet-stream]
Strength = 111@398: BCache []
Strength = 111@379: []
Strength = 111@449: []
Strength = 111@452: []
Strength = 111@454: []
Strength = 111@456: []
Strength = 111@459: []
Strength = 111@461: []
Strength = 111@1499: DOS 3.3 backup control file, sequence %d []
Strength = 111@19: Qt Translation file []
Strength = 111@84: Microsoft Disk Image eXtended []
Strength = 111@800: []
Strength = 111@803: []
Strength = 110@32: RISC OS music file []
Strength = 110@39: Digital Symphony sound sample (RISC OS), []
Strength = 110@50: Digital Symphony song (RISC OS), []
Strength = 110@6: AMANDA []
Strength = 110@33: Synthesis Module sound file []
Strength = 110@75: AMOS Basic source code []
Strength = 110@21: Android bootimg []
Strength = 110@1014: ARMovie []
Strength = 110@108: Newton package, NOS 1.x, []
Strength = 110@116: Newton package, NOS 2.x, []
Strength = 110@124: Newton package, []
Strength = 110@282: Apple binary property list []
Strength = 110@523: MacPaint image data []
Strength = 110@7: Pebble application []
Strength = 110@152: GNU tar incremental snapshot data []
Strength = 110@297: current ar archive [application/x-archive]
Strength = 110@320: thin archive with []
Strength = 110@359: RISC OS archive (ArcFS format) []
Strength = 110@360: RISC OS archive (ArcFS format) []
Strength = 110@573: TSComp archive data []
Strength = 110@710: WinImage archive data []
Strength = 110@787: PAQ archive data []
Strength = 110@1046: RAR archive data, v5 [application/x-rar]
Strength = 110@1064: Zip multi-volume archive data, at least PKZIP v2.50 to extract [application/zip]
Strength = 110@1303: Zip archive data [application/zip]
Strength = 110@1366: Foxit add-on/update [application/x-fzip]
Strength = 110@1394: KGB Archiver file []
Strength = 110@1486: BBeB ebook data, unencrypted []
Strength = 110@1546: Acronis True Image backup [application/x-acronis-tib]
Strength = 110@175: Screamtracker 2 module sound data [audio/x-mod]
Strength = 110@178: Screamtracker 2 module sound data [audio/x-mod]
Strength = 110@406: Oktalyzer module data []
Strength = 110@443: Open Cubic Player Module Inforation MDZ []
Strength = 110@556: RdosPlay RAW []
Strength = 110@562: MPU-401 Trakker []
Strength = 110@581: Spectrum 128 tune []
Strength = 110@859: Garmin Voice Processing Module (encrypted) [audio/x-vpm-garmin]
Strength = 110@895: AProSys module []
Strength = 110@918: Klystrack song []
Strength = 110@938: Klystrack instrument []
Strength = 110@951: DMX OP2 instrument data []
Strength = 110@38: Biosig/BCI2000 [biosig/bci2000]
Strength = 110@42: Biosig/Biosemi data format [biosig/bdf]
Strength = 110@54: Biosig/EDF: European Data format [biosig/edf]
Strength = 110@61: Biosig/Heka Patchmaster []
Strength = 110@62: Biosig/Heka Patchmaster []
Strength = 110@63: Biosig/Heka Patchmaster [biosig/heka]
Strength = 110@69: Biosig/CFWB [biosig/cfwb]
Strength = 110@75: Biosig/EBS [biosig/ebs]
Strength = 110@91: Biosig/ISHNE [biosig/ishne]
Strength = 110@95: Biosig/MFER []
Strength = 110@99: Biosig/NEV []
Strength = 110@113: Biosig/SCP-ECG format CEN 1064:2005/ISO 11073:91064 [biosig/scpecg]
Strength = 110@3: BLCR []
Strength = 110@14: BLCR []
Strength = 110@7: BTSnoop []
Strength = 110@14: GCR Image []
Strength = 110@23: PC64 Freezer Image []
Strength = 110@167: OpenHSF (Hoops Stream Format) []
Strength = 110@27: Claris works dictionary []
Strength = 110@367: qpress compressed data [application/x-qpress]
Strength = 110@382: UCL compressed data []
Strength = 110@118: Game Boy ROM image [application/x-gameboy-rom]
Strength = 110@396: Nintendo 64 ROM image [application/x-n64-rom]
Strength = 110@406: Nintendo 64 ROM image (V64) [application/x-n64-rom]
Strength = 110@413: Nintendo 64 ROM image (wordswapped) [application/x-n64-rom]
Strength = 110@420: Nintendo 64 ROM image (32-bit byteswapped) [application/x-n64-rom]
Strength = 110@430: Game Boy Advance ROM image [application/x-gba-rom]
Strength = 110@443: Nintendo DS ROM image [application/x-nintendo-ds-rom]
Strength = 110@464: Nintendo DS Slot-2 ROM image (PassMe) [application/x-nintendo-ds-rom]
Strength = 110@488: Sony Playstation executable []
Strength = 110@71: LLVM raw profile data, []
Strength = 110@75: LLVM raw profile data, []
Strength = 110@85: LLVM indexed profile data, []
Strength = 110@89: LLVM indexed profile data, []
Strength = 110@510: TDB database []
Strength = 110@597: Hopper database []
Strength = 110@19: bsdiff(1) patch file []
Strength = 110@52: profiling data file []
Strength = 110@6: Extended display identification data dump [application/x-edid-dump]
Strength = 110@21: Erlang DETS file []
Strength = 110@249: Norton Disk Doctor UnDo file []
Strength = 110@1143: romfs filesystem, version 1 []
Strength = 110@1703: HAMMER filesystem (little-endian), []
Strength = 110@2050: ReiserFS V3.5 []
Strength = 110@2066: EST flat binary []
Strength = 110@2238: Oracle ASM Volume, []
Strength = 110@2240: Oracle ASM Volume (cleared), []
Strength = 110@2251: Oracle ASM Volume, []
Strength = 110@2253: Oracle ASM Volume (cleared), []
Strength = 110@2258: Compaq/HP RILOE floppy image []
Strength = 110@2276: PowerISO Direct-Access-Archive []
Strength = 110@2294: BTRFS Filesystem []
Strength = 110@2399: ReFS filesystem image []
Strength = 110@2404: EWF/Expert Witness/EnCase image file format []
Strength = 110@21: FrameMaker MIF (ASCII) file [application/x-mif]
Strength = 110@140: scrshot(1) screenshot, []
Strength = 110@158: Quake I save: d1c Area 44 []
Strength = 110@180: Quake I save: ddm6 Domino []
Strength = 110@184: MAME CHD compressed hard disk image, []
Strength = 110@63: SeaBeam 2100 DR multibeam sonar []
Strength = 110@64: SeaBeam 2100 PR multibeam sonar []
Strength = 110@18: GIMP XCF image data, [image/x-xcf]
Strength = 110@30: GNOME Catalogue (gtktalog) []
Strength = 110@46: GVariant Database file, []
Strength = 110@236: GPT data structure (nonstandard: at LBA 0) []
Strength = 110@24: Vulkan trace file, little-endian []
Strength = 110@27: Vulkan trace file, big-endian []
Strength = 110@8: Guile Object []
Strength = 110@197: HP NLS message catalog, []
Strength = 110@16: AIX message catalog []
Strength = 110@534: FBM image data []
Strength = 110@739: PDS (JPL) image data []
Strength = 110@744: PDS (VICAR) image data []
Strength = 110@924: SMJPEG []
Strength = 110@970: Webshots Desktop .wbz file []
Strength = 110@974: Hercules CKD DASD image file []
Strength = 110@979: Hercules compressed CKD DASD image file []
Strength = 110@984: Hercules CKD DASD shadow file []
Strength = 110@1132: Hierarchical Data Format (version 5) data [application/x-hdf]
Strength = 110@1134: Hierarchical Data Format (version 5) with 512 bytes user block [application/x-hdf]
Strength = 110@1136: Hierarchical Data Format (version 5) with 1k user block [application/x-hdf]
Strength = 110@1138: Hierarchical Data Format (version 5) with 2k user block [application/x-hdf]
Strength = 110@1140: Hierarchical Data Format (version 5) with 4k user block [application/x-hdf]
Strength = 110@1252: AVCHD Clip Information []
Strength = 110@1293: JPEG-XR Image []
Strength = 110@1402: farbfeld image data, []
Strength = 110@1512: Microsoft DirectDraw Surface (DDS): []
Strength = 110@9: IslandDraw document []
Strength = 110@158: Linux []
Strength = 110@283: LVM2 PV (Linux Logical Volume Manager) []
Strength = 110@297: LVM2 PV (Linux Logical Volume Manager) []
Strength = 110@309: LVM2 PV (Linux Logical Volume Manager) []
Strength = 110@321: LVM2 PV (Linux Logical Volume Manager) []
Strength = 110@468: mlocate database []
Strength = 110@458: Mac OS X bill of materials (BOM) file []
Strength = 110@10: Mathematica version 2 notebook []
Strength = 110@12: Mathematica version 2 notebook []
Strength = 110@38: Mathematica notebook version 2.x []
Strength = 110@44: Mathematica notebook version 2.x []
Strength = 110@18: Mozilla lz4 compressed data [application/x-lz4+json]
Strength = 110@704: Microsoft Excel Worksheet [application/vnd.ms-excel]
Strength = 110@859: Lotus WordPro [application/vnd.lotus-wordpro]
Strength = 110@888: tz3 ms-works file []
Strength = 110@889: tz3 ms-works file []
Strength = 110@890: tz3 ms-works file []
Strength = 110@1018: First Choice database []
Strength = 110@1023: MKS Spell hash list (old format) []
Strength = 110@1115: MS Advisor help file []
Strength = 110@1130: Microsoft Cabinet archive data []
Strength = 110@1373: Microsoft WinCE install header []
Strength = 110@1422: Microsoft Reader eBook Data []
Strength = 110@281: MSX cassette archive []
Strength = 110@21: Net2phone []
Strength = 110@25: AOL ART image []
Strength = 110@26: AOL ART image []
Strength = 110@5: OCaml []
Strength = 110@8: OLE 2 Compound Document []
Strength = 110@49: OS/2 INI []
Strength = 110@52: iSiloX E-book []
Strength = 110@57: Mobipocket E-book []
Strength = 110@73: AportisDoc/PalmDOC E-book []
Strength = 110@80: BDicty PalmOS document []
Strength = 110@82: DB PalmOS document []
Strength = 110@84: FireViewer/ImageViewer PalmOS document []
Strength = 110@86: HanDBase PalmOS document []
Strength = 110@88: InfoView PalmOS document []
Strength = 110@90: iSilo PalmOS document []
Strength = 110@92: JFile PalmOS document []
Strength = 110@94: JFile Pro PalmOS document []
Strength = 110@96: List PalmOS document []
Strength = 110@98: MobileDB PalmOS document []
Strength = 110@100: PeanutPress PalmOS document []
Strength = 110@102: Plucker PalmOS document []
Strength = 110@104: QuickSheet PalmOS document []
Strength = 110@106: SuperMemo PalmOS document []
Strength = 110@108: TealDoc PalmOS document []
Strength = 110@110: TealInfo PalmOS document []
Strength = 110@112: TealMeal PalmOS document []
Strength = 110@114: TealPaint PalmOS document []
Strength = 110@116: ThinkDB PalmOS document []
Strength = 110@118: Tides PalmOS document []
Strength = 110@120: TomeRaider PalmOS document []
Strength = 110@154: Mobipocket E-book []
Strength = 110@8: Parrot bytecode []
Strength = 110@26: Maki-chan v2 image, []
Strength = 110@77: Hash::SharedMem master file, big-endian []
Strength = 110@83: Hash::SharedMem master file, little-endian []
Strength = 110@89: Hash::SharedMem data file, big-endian []
Strength = 110@95: Hash::SharedMem data file, little-endian []
Strength = 110@19: Poly/ML saved state []
Strength = 110@22: Poly/ML saved module []
Strength = 110@7: rpmsg Restricted Permission Message []
Strength = 110@12: Plot84 plotting file []
Strength = 110@46: IRIX vmcore dump of []
Strength = 110@50: SGI Audit file []
Strength = 110@54: Wingz compiled script []
Strength = 110@55: Wingz spreadsheet []
Strength = 110@56: Wingz help file []
Strength = 110@89: PCP []
Strength = 110@92: PCP pmchart view []
Strength = 110@95: PCP kmchart view []
Strength = 110@133: Alias Maya Binary File, []
Strength = 110@135: Alias Maya Binary File, []
Strength = 110@25: QL firmware executable (BCPL) []
Strength = 110@329: RADCOM WAN/LAN Analyzer capture file []
Strength = 110@37: Spectrum .TZX data []
Strength = 110@50: Spectrum .SCL Betadisk image []
Strength = 110@129: SQLite Rollback Journal []
Strength = 110@8: OpenSSH DSA public key []
Strength = 110@9: OpenSSH RSA public key []
Strength = 110@18: openssl enc'd data with salted password []
Strength = 110@13: TI-80 Graphing Calculator File. []
Strength = 110@14: TI-81 Graphing Calculator File. []
Strength = 110@18: TI-73 Graphing Calculator []
Strength = 110@36: TI-82 Graphing Calculator []
Strength = 110@53: TI-83 Graphing Calculator []
Strength = 110@71: TI-83+ Graphing Calculator []
Strength = 110@92: TI-85 Graphing Calculator []
Strength = 110@125: TI-86 Graphing Calculator []
Strength = 110@156: TI-89 Graphing Calculator []
Strength = 110@174: TI-92 Graphing Calculator []
Strength = 110@191: TI-92+/V200 Graphing Calculator []
Strength = 110@209: TI-XX Graphing Calculator (FLASH) []
Strength = 110@210: TI-XX Graphing Calculator (FLASH) []
Strength = 110@9: VICAR image data []
Strength = 110@12: Microsoft Disk Image, Virtual Server or Virtual PC [application/x-virtualbox-vhd]
Strength = 110@51: MS Windows Vista Event Log []
Strength = 110@200: Hangul (Korean) Word Processor File 2000 [application/x-hwp]
Strength = 110@6: XDelta binary patch file 0.14 []
Strength = 110@7: XDelta binary patch file 0.18 []
Strength = 110@8: XDelta binary patch file 0.20 []
Strength = 110@9: XDelta binary patch file 1.0 []
Strength = 110@10: XDelta binary patch file 1.0.4 []
Strength = 110@11: XDelta binary patch file 1.1 []
Strength = 110@16: xfsdump archive []
Strength = 110@39: ZFS shapshot (big-endian machine), []
Strength = 110@69: ZFS shapshot (little-endian machine), []
Strength = 106@260: DOS/MBR boot sector []
Strength = 105@21: Common Trace Format (CTF) plain text metadata []
Strength = 101@965: CRI ADX ADPCM audio [audio/x-adx]
Strength = 101@235: DOS Emulator image []
Strength = 101@47: KiCad Footprint []
Strength = 101@56: KiCad Netlist []
Strength = 101@190: Garmin map, []
Strength = 101@375: Windows Registry text [text/x-ms-regedit]
Strength = 100@487: AppleScript compiled []
Strength = 100@396: JRC archive data []
Strength = 100@421: CrossePAC archive data []
Strength = 100@629: Par archive data []
Strength = 100@712: Compressia archive data []
Strength = 100@841: JAM archive, []
Strength = 100@1034: RAR archive data [application/x-rar]
Strength = 100@1309: ACE archive data []
Strength = 100@121: RealMedia file [application/vnd.rn-realmedia]
Strength = 100@424: Velvet Studio AMS Module v2.2 []
Strength = 100@425: Extreme Tracker AMS Module v1.3 []
Strength = 100@448: NOA Nancy Codec Movie file []
Strength = 100@8: BBx []
Strength = 100@7: Beetle VM object file []
Strength = 100@50: Biosig/CFS: Cambridge Electronic devices File format [biosig/ced]
Strength = 100@10: Blender3D, []
Strength = 100@10: b.out archive []
Strength = 100@21: PC64 Emulator file []
Strength = 100@584: 3DO "Opera" file system []
Strength = 100@618: askSam DB []
Strength = 100@8: Old Erlang BEAM file []
Strength = 100@129: DOSFONT2 encrypted font data []
Strength = 100@31: Linuxdoom save []
Strength = 100@144: Quake I save: hip3m3 Limbo []
Strength = 100@58: GeoSwatch auf text file []
Strength = 100@105: elog journal entry []
Strength = 100@168: GNU findutils locate database data []
Strength = 100@192: CIS compimg HP Bitmapfile []
Strength = 100@18: archive []
Strength = 100@19: archive (big format) []
Strength = 100@680: Kodak Photo CD image pack file []
Strength = 100@685: Kodak Photo CD overview pack file []
Strength = 100@741: PDS (CCSD) image data []
Strength = 100@24: StuffIt Archive [application/x-stuffit]
Strength = 100@10: MapleVr4 library []
Strength = 100@11: Mozilla lz4 compressed bookmark data []
Strength = 100@993: Borland font []
Strength = 100@999: Borland device []
Strength = 100@1039: MegaDots []
Strength = 100@1428: Windows Embedded CE binary image []
Strength = 100@1439: Mallard BASIC Jetsam index data []
Strength = 100@8: Bagpipe []
Strength = 100@6: NASA SPICE file (binary format) []
Strength = 100@19: NEWEZD Electron Density Map []
Strength = 100@12: kbd map file []
Strength = 100@18: SHARC architecture file []
Strength = 100@19: SHARC architecture file []
Strength = 100@7: GNU SmallTalk []
Strength = 100@53: Spectrum .HDF hard disk image []
Strength = 91@290: CoreFoundation binary property list data, version 0x%c []
Strength = 91@813: Garmin Voice Processing Module [audio/x-vpm-wav-garmin]
Strength = 91@46: https://datadryad.org/profile/v3.1 [text/xml]
Strength = 91@2221: OpenVMS backup saveset data []
Strength = 91@877: []
Strength = 91@870: InstallShield Uninstall Script []
Strength = 91@215: MSX device BIOS []
Strength = 91@245: []
Strength = 90@937: MythTV NuppelVideo []
Strength = 90@9: NuFile archive (apple ][) data []
Strength = 90@10: NuFile archive (apple ][) data []
Strength = 90@7: Applixware []
Strength = 90@170: ASCII cpio archive (pre-SVR4 or odc) []
Strength = 90@171: ASCII cpio archive (SVR4 with no CRC) []
Strength = 90@172: ASCII cpio archive (SVR4 with CRC) []
Strength = 90@385: BSArc/BS2 archive data []
Strength = 90@415: PAKLeo archive data []
Strength = 90@425: KBoom archive data []
Strength = 90@453: FoxSQZ archive data []
Strength = 90@577: Squash archive data []
Strength = 90@625: NRV archive data []
Strength = 90@682: TPac archive data []
Strength = 90@1213: StarView MetaFile []
Strength = 90@366: Yamaha TX Wave []
Strength = 90@569: eXtra Simple Music []
Strength = 90@614: LICQ configuration file []
Strength = 90@955: AdLib instrument data []
Strength = 90@16: Biosig/Axon Binary format [biosig/abf2]
Strength = 90@96: Biosig/MFER [biosig/mfer]
Strength = 90@100: Biosig/NEV [biosig/nev]
Strength = 90@107: Biosig/Plexon v2.0 [biosig/plexon]
Strength = 90@116: Biosig/SIGIF [biosig/sigif]
Strength = 90@99: cscope reference data []
Strength = 90@26: Power 64 C64 Emulator Snapshot []
Strength = 90@54: DWG AutoDesk AutoCAD Release 1.40 [image/vnd.dwg]
Strength = 90@56: DWG AutoDesk AutoCAD Release 2.05 [image/vnd.dwg]
Strength = 90@58: DWG AutoDesk AutoCAD Release 2.10 [image/vnd.dwg]
Strength = 90@60: DWG AutoDesk AutoCAD Release 2.21 [image/vnd.dwg]
Strength = 90@62: DWG AutoDesk AutoCAD Release 2.22 [image/vnd.dwg]
Strength = 90@64: DWG AutoDesk AutoCAD Release 2.22 [image/vnd.dwg]
Strength = 90@66: DWG AutoDesk AutoCAD Release 2.50 [image/vnd.dwg]
Strength = 90@68: DWG AutoDesk AutoCAD Release 2.60 [image/vnd.dwg]
Strength = 90@70: DWG AutoDesk AutoCAD Release 9 [image/vnd.dwg]
Strength = 90@72: DWG AutoDesk AutoCAD Release 10 [image/vnd.dwg]
Strength = 90@74: DWG AutoDesk AutoCAD Release 11/12 [image/vnd.dwg]
Strength = 90@81: DWG AutoDesk AutoCAD Release 13 [image/vnd.dwg]
Strength = 90@83: DWG AutoDesk AutoCAD Release 14 [image/vnd.dwg]
Strength = 90@85: DWG AutoDesk AutoCAD 2000/2002 [image/vnd.dwg]
Strength = 90@93: DWG AutoDesk AutoCAD 2004/2005/2006 [image/vnd.dwg]
Strength = 90@95: DWG AutoDesk AutoCAD 2007/2008/2009 [image/vnd.dwg]
Strength = 90@97: DWG AutoDesk AutoCAD 2010/2011/2012 [image/vnd.dwg]
Strength = 90@99: DWG AutoDesk AutoCAD 2013/2014 [image/vnd.dwg]
Strength = 90@9: Chord text file []
Strength = 90@14: Power-Tab v3 Tablature File []
Strength = 90@15: Power-Tab v4 Tablature File []
Strength = 90@7: Citrus locale declaration for LC_CTYPE []
Strength = 90@24: Claris Works palette files .plt []
Strength = 90@9: TTCN Abstract Test Suite []
Strength = 90@22: Message Sequence Chart (subchart) []
Strength = 90@246: 7-zip archive data, []
Strength = 90@623: MUIbase DB []
Strength = 90@628: NetBSD Constant Database []
Strength = 90@28: Vim swap file []
Strength = 90@35: Nano swap file []
Strength = 90@6: Flow Cytometry Standard (FCS) data, version 1.0 []
Strength = 90@7: Flow Cytometry Standard (FCS) data, version 2.0 []
Strength = 90@8: Flow Cytometry Standard (FCS) data, version 3.0 []
Strength = 90@2321: CROMFS []
Strength = 90@62: SeaBeam 2100 multibeam sonar []
Strength = 90@130: Point Cloud Data []
Strength = 90@459: ZIF image (GIF+deflate alpha) [image/x-unknown]
Strength = 90@464: FGF image (GIF+deflate beta) [image/x-unknown]
Strength = 90@740: PDS (JPL) image data []
Strength = 90@742: PDS (CCSD) image data []
Strength = 90@846: XV thumbnail image data []
Strength = 90@954: XV "thumbnail file" (icon) data []
Strength = 90@1147: Xara graphics file []
Strength = 90@66: Linux/i386 PC Screen Font v2 data, []
Strength = 90@350: LUKS encrypted file, []
Strength = 90@8: LUKS encrypted file, []
Strength = 90@25: Maple help file, old style []
Strength = 90@29: Maple worksheet []
Strength = 90@8: Mathcad document []
Strength = 90@76: Matlab v5 mat-file []
Strength = 90@678: Microsoft Word 2.0 Document [application/msword]
Strength = 90@1020: First Choice device file []
Strength = 90@1438: Mallard BASIC Jetsam data []
Strength = 90@6: NumPy array, []
Strength = 90@43: OS/2 INF []
Strength = 90@45: OS/2 HLP []
Strength = 90@9: Maki-chan v1. []
Strength = 90@150: Epson ESC/Page language printer data []
Strength = 90@12: Qt Binary Resource file []
Strength = 90@98: PCP pmview config []
Strength = 90@36: SoftQuad troff Context intermediate for IMAGEN imPRESS []
Strength = 90@80: iRiver Database file []
Strength = 90@8: SymbOS executable []
Strength = 90@14: SymbOS DOX document []
Strength = 90@33: SymbOS video []
Strength = 90@6: Tgif file version []
Strength = 90@25: AVR assembler object code []
Strength = 90@214: Intel Quark Express Document (English) []
Strength = 90@215: Intel Quark Express Document (Korean) []
Strength = 90@216: Motorola Quark Express Document (English) [application/x-quark-xpress-3]
Strength = 90@218: Motorola Quark Express Document (Korean) []
Strength = 90@11: ZyXEL voice data []
Strength = 81@81: PackDir archive (RISC OS) []
Strength = 81@941: []
Strength = 81@945: []
Strength = 81@948: []
Strength = 81@950: []
Strength = 81@952: []
Strength = 81@954: []
Strength = 81@956: []
Strength = 81@958: []
Strength = 81@962: []
Strength = 81@967: []
Strength = 81@970: []
Strength = 81@973: []
Strength = 81@976: []
Strength = 81@979: []
Strength = 81@982: []
Strength = 81@987: []
Strength = 81@990: []
Strength = 81@992: []
Strength = 81@994: []
Strength = 81@996: []
Strength = 81@998: []
Strength = 81@1000: []
Strength = 81@1002: []
Strength = 81@1245: []
Strength = 81@1248: []
Strength = 81@1251: []
Strength = 81@15: Claris clip art []
Strength = 81@17: Claris clip art []
Strength = 81@103: Smarty compiled template []
Strength = 81@313: core file []
Strength = 81@354: core file []
Strength = 81@376: core file []
Strength = 81@398: core file []
Strength = 81@874: []
Strength = 81@880: []
Strength = 81@9: RINEX Data, GEO SBAS Broadcast []
Strength = 81@44: Microsoft OOXML []
Strength = 81@247: []
Strength = 81@249: []
Strength = 80@23: RISC OS outline font data, []
Strength = 80@25: RISC OS 1bpp font data, []
Strength = 80@27: RISC OS 4bpp font data []
Strength = 80@35: JamCracker Module sound file []
Strength = 80@36: Hippel-COSO Module sound file []
Strength = 80@47: Amiga E module []
Strength = 80@48: ECX module []
Strength = 80@909: %s []
Strength = 80@41: Apple ProDOS Image []
Strength = 80@369: Crush archive data []
Strength = 80@371: Squeeze It archive data []
Strength = 80@373: SQWEZ archive data []
Strength = 80@423: Freeze archive data []
Strength = 80@445: ZPack archive data []
Strength = 80@598: RAX archive data []
Strength = 80@600: Xtreme archive data []
Strength = 80@602: Pack Magic archive data []
Strength = 80@655: ChiefLZA archive data []
Strength = 80@657: Blink archive data []
Strength = 80@663: AKT32 archive data []
Strength = 80@666: NPack archive data []
Strength = 80@684: Ai archive data []
Strength = 80@685: Ai archive data []
Strength = 80@784: ZZip archive data []
Strength = 80@792: JAR (ARJ Software, Inc.) archive data []
Strength = 80@793: JAR (ARJ Software, Inc.) archive data []
Strength = 80@1008: Swag archive data []
Strength = 80@1252: PMarc SFX archive (CP/M, DOS) []
Strength = 80@1255: PopCom compressed executable (CP/M) []
Strength = 80@1340: sfArk compressed Soundfont []
Strength = 80@40: 3b2 core file []
Strength = 80@135: ULT(imate) Module sound data []
Strength = 80@306: NES Sound File []
Strength = 80@583: BONK, []
Strength = 80@675: Adaptive Multi-Rate Codec (GSM telephony) [audio/amr]
Strength = 80@1011: Atari 8-bit SAP audio file [audio/x-sap]
Strength = 80@89: Binary Call Format (BCF) version 2.1 []
Strength = 80@102: Binary Call Format (BCF) version 2.2 []
Strength = 80@39: Blender3D BPython script []
Strength = 80@19: LHA archive (c64) []
Strength = 80@48: DWG AutoDesk AutoCAD Release 1.0 [image/vnd.dwg]
Strength = 80@50: DWG AutoDesk AutoCAD Release 1.2 [image/vnd.dwg]
Strength = 80@52: DWG AutoDesk AutoCAD Release 1.3 [image/vnd.dwg]
Strength = 80@107: PHP script Zend Optimizer data []
Strength = 80@333: AFX compressed file data []
Strength = 80@602: IPS patch file []
Strength = 80@605: Playstation Patch File version 3.0 []
Strength = 80@617: Playstation Patch File version 2.0 []
Strength = 80@623: Playstation Patch File version 1.0 []
Strength = 80@935: Vectrex ROM image []
Strength = 80@8: Map file for the Blood Frontier/Red Eclipse FPS games []
Strength = 80@124: ROOT file []
Strength = 80@537: PostgreSQL custom database dump []
Strength = 80@638: Redis RDB file, []
Strength = 80@34: Alpha COFF format core dump (Digital UNIX) []
Strength = 80@36: Alpha COFF format core dump (Digital UNIX) []
Strength = 80@1985: ISO 9660 CD-ROM filesystem data (raw 2352 byte sectors) [application/x-iso9660-image]
Strength = 80@1987: High Sierra CD-ROM filesystem data []
Strength = 80@2005: Nero CD image at 0x4B000 [application/x-nrg]
Strength = 80@2199: AFS Dump []
Strength = 80@108: X11 Speedo font data []
Strength = 80@71: SAIC generic sensor format (GSF) sonar data, []
Strength = 80@76: MGD77 Header, Marine Geophysical Data Exchange Format []
Strength = 80@233: HP text []
Strength = 80@525: clear text Computer Graphics Metafile []
Strength = 80@1176: Wavelet Scalar Quantization image data []
Strength = 80@1232: Ulead Photo Explorer5 []
Strength = 80@1265: PFS HDR image data []
Strength = 80@7: Interleaf document text []
Strength = 80@489: Kdump compressed dump []
Strength = 80@9: LLVM byte-codes, null compression []
Strength = 80@10: LLVM byte-codes, gzip compression []
Strength = 80@11: LLVM byte-codes, bzip2 compression []
Strength = 80@40: MBX mail folder []
Strength = 80@67: portable voice format []
Strength = 80@73: portable voice format []
Strength = 80@661: Microsoft Word 6.0 Document [application/msword]
Strength = 80@699: Microsoft Excel 5.0 Worksheet [application/vnd.ms-excel]
Strength = 80@702: Microsoft Excel 5.0 Worksheet [application/vnd.ms-excel]
Strength = 80@61: MSVC .sbr []
Strength = 80@17: MSX Gigamix MGSDRV2 music file []
Strength = 80@17: Netscape folder cache []
Strength = 80@56: XLD4(Q4) picture []
Strength = 80@142: SunClock's Vector Map Format data []
Strength = 80@8: Rich Text Format data, [text/rtf]
Strength = 80@20: Old EZD Electron Density Map []
Strength = 80@32: Sereal data packet, UTF-8 encoded [application/sereal]
Strength = 80@324: HP/UX nettl capture file []
Strength = 80@34: SoftQuad troff Context intermediate for AT&T 495 laser printer []
Strength = 80@133: Panasonic channel list DataBase []
Strength = 80@99: Snoop capture file []
Strength = 80@235: TiEmu skin []
Strength = 80@6: WARC Archive []
Strength = 80@363: MS Windows 3.1 registry file []
Strength = 80@209: ChiWriter file []
Strength = 80@17: o65 []
Strength = 73@1195: SYSLINUX MBR []
Strength = 72@1087: KOffice (>=1.2) []
Strength = 71@116: Adrift game file version []
Strength = 71@12: Dalvik dex file []
Strength = 71@15: Dalvik dex file (optimized for host) []
Strength = 71@103: Partition Information Table for Samsung smartphone []
Strength = 71@229: JVT NAL sequence, H.264 video []
Strength = 71@235: MPEG sequence [video/mpeg]
Strength = 71@857: MPEG transport stream data [video/MP2T]
Strength = 71@1065: LucasArts Smush Animation Format (SAN) video []
Strength = 71@1067: LucasArts Smush v2 (SANM) video []
Strength = 71@1074: Scaleform video []
Strength = 71@22: Apple ][ WOZ 1.0 Disk Image []
Strength = 71@30: Apple ][ WOZ 2.0 Disk Image []
Strength = 71@220: Applesoft BASIC program data, first line number %d []
Strength = 71@440: []
Strength = 71@484: Apple HFS/HFS+ resource fork []
Strength = 71@508: []
Strength = 71@518: iTunes cover art []
Strength = 71@39: APT cache data, version %u []
Strength = 71@47: APT cache data, version %u []
Strength = 71@1069: Zip archive data (empty) [application/zip]
Strength = 71@1572: Gentoo binary package (XPAK) []
Strength = 71@1581: XBMC texture package [application/x-xbmc-xbt]
Strength = 71@697: VGM Video Game Music dump v [audio/x-vgm]
Strength = 71@800: GVOX Encore music, version 5.0 or above []
Strength = 71@804: GVOX Encore music, version < 5.0 []
Strength = 71@76: SAMtools BCF (Binary Call Format) []
Strength = 71@150: Sequence Alignment/Map (SAM), with header []
Strength = 71@7: BlackBerry RIM ETP file []
Strength = 71@19: compiled Java class data, [application/x-java-applet]
Strength = 71@54: Mach-O universal binary with 1 architecture: [application/x-mach-binary]
Strength = 71@118: ksh byte-code version %d []
Strength = 71@254: LZMA compressed data, [application/x-lzma]
Strength = 71@285: []
Strength = 71@67: NES ROM image (UNIF v%d format) [application/x-nes-rom]
Strength = 71@86: Famicom Disk System disk image: [application/x-fds-disk]
Strength = 71@230: Sega 32X ROM image [application/x-genesis-32x-rom]
Strength = 71@257: Sega Mega Drive / Genesis ROM image (SMD format): [application/x-genesis-rom]
Strength = 71@263: Sega Mega Drive / Genesis ROM image (SMD format): [application/x-genesis-rom]
Strength = 71@717: Nintendo GameCube embedded disc image: [application/x-gamecube-rom]
Strength = 71@731: Nintendo Wii disc image (WBFS format): [application/x-wii-rom]
Strength = 71@745: Nintendo GameCube disc image (CISO format): [application/x-wii-rom]
Strength = 71@755: Nintendo GameCube disc image (GCZ format) [application/x-gamecube-rom]
Strength = 71@796: Nintendo Wii SDK disc image: [application/x-wii-rom]
Strength = 71@811: Nintendo 3DS Game Card image []
Strength = 71@472: Extensible storage engine [application/x-ms-ese]
Strength = 71@503: Windows application compatibility Shim DataBase [application/x-ms-sdb]
Strength = 71@7: Universal EFI binary with 1 architecture []
Strength = 71@13: Erlang BEAM file []
Strength = 71@1181: Syslinux bootloader (version 2.13 or older) []
Strength = 71@2026: Compressed ISO CD image []
Strength = 71@2286: GFS1 Filesystem []
Strength = 71@2317: XFS filesystem metadump image []
Strength = 71@2336: XFS filesystem metadump image []
Strength = 71@2350: JFS2 filesystem image []
Strength = 71@2409: UBIfs image []
Strength = 71@2418: UBI image, version %u []
Strength = 71@2429: NEC PC-88 disk image, name=%s []
Strength = 71@76: X11 SNF font data, LSB first [application/x-font-sfn]
Strength = 71@93: GRUB2 font [application/x-font-pf2]
Strength = 71@137: []
Strength = 71@148: []
Strength = 71@198: []
Strength = 71@202: []
Strength = 71@207: []
Strength = 71@317: TrueType [font/ttf]
Strength = 71@49: Quake I or II world or extension [application/x-dzip]
Strength = 71@155: GPG keybox database []
Strength = 71@212: []
Strength = 71@556: Award BIOS bitmap [image/x-award-bmp]
Strength = 71@798: PCX [image/x-pcx]
Strength = 71@1552: Sega PVR (Xbox) image: []
Strength = 71@1560: Sega PVR (Xbox) image: []
Strength = 71@1588: Sega GVR image: []
Strength = 71@1594: Sega GVR image: []
Strength = 71@1604: Lytro Light Field Picture []
Strength = 71@33: Compressed Google KML Document, including resources. [application/vnd.google-earth.kmz]
Strength = 71@425: Device Tree Blob version %d []
Strength = 71@56: Emacs/XEmacs v%d byte-compiled Lisp data [application/x-elc]
Strength = 71@243: Mach-O [application/x-mach-binary]
Strength = 71@248: Mach-O [application/x-mach-binary]
Strength = 71@467: Mac OSX datafork font, TrueType []
Strength = 71@14: WebM [video/webm]
Strength = 71@48: Gridded binary (GRIB) version 1 []
Strength = 71@12: Micro Focus File with Header (DAT) [application/octet-stream]
Strength = 71@16: Micro Focus File with Header (DAT) [application/octet-stream]
Strength = 71@665: Microsoft Word for Macintosh 1.0 [application/msword]
Strength = 71@717: Lotus 1-2-3 [application/vnd.lotus-1-2-3]
Strength = 71@918: []
Strength = 71@990: []
Strength = 71@1011: Windows Recycle Bin INFO2 file (Win98 or below) []
Strength = 71@1014: Windows Recycle Bin INFO2 file (Win2k - WinXP) []
Strength = 71@1034: Delphi compiled form '%s' []
Strength = 71@1043: Windows shortcut file []
Strength = 71@1100: Norton Guide []
Strength = 71@1393: Windows Enhanced Metafile (EMF) image data []
Strength = 71@1407: %s system BIOS []
Strength = 71@46: MSX Moonblaster for MoonSound music []
Strength = 71@74: MSX SCMD Music file []
Strength = 71@207: MSX-BASIC extension ROM []
Strength = 71@251: []
Strength = 71@149: Palm OS dynamic library data "%s" []
Strength = 71@11: OpenStreetMap Protocolbuffer Binary Format []
Strength = 71@14: NEC PC-88 disk image, name=%s []
Strength = 71@129: Zenographics ZjStream printer data (big-endian) []
Strength = 71@131: Zenographics ZjStream printer data (little-endian) []
Strength = 71@11: ps database []
Strength = 71@33: Git pack [application/x-git]
Strength = 71@15: Raspberry PI kernel image []
Strength = 71@20: QL OS dump data, []
Strength = 71@301: pcapng capture file []
Strength = 71@305: pcapng capture file []
Strength = 71@61: MySQL Maria control file []
Strength = 71@48: LG robot VR6[234]xx %dm^2 navigation []
Strength = 71@230: QEMU QCOW2 Image []
Strength = 71@29: VMS Alpha executable []
Strength = 71@33: MS Windows 32bit crash dump []
Strength = 71@64: System Deployment Image [application/x-ms-sdi]
Strength = 71@129: Windows Error Report [text/plain]
Strength = 71@173: MS []
Strength = 71@516: Windows setup INFormation [application/x-setupscript]
Strength = 71@648: Windows NTbackup archive []
Strength = 71@19: WordPerfect macro []
Strength = 71@40: Xilinx RAW bitstream (.BIN) []
Strength = 71@10: YARA 3.x compiled rule set []
Strength = 71@63: , %s []
Strength = 70@10: RISC OS Chunk data []
Strength = 70@15: RISC OS AIF executable []
Strength = 70@19: RISC OS Draw file data []
Strength = 70@54: Glulx game data []
Strength = 70@7: Allegro datafile (packed) []
Strength = 70@8: Allegro datafile (not packed/autodetect) []
Strength = 70@9: Allegro datafile (appended exe data) []
Strength = 70@9: AmigaOS shared library []
Strength = 70@10: AmigaOS loadseg()ble executable/binary []
Strength = 70@11: AmigaOS object/library data []
Strength = 70@28: Future Composer 1.4 Module sound file []
Strength = 70@29: Future Composer 1.3 Module sound file []
Strength = 70@34: The Holy Noise Module sound file []
Strength = 70@45: AmigaOS outline tag []
Strength = 70@53: Rigid Disk Block []
Strength = 70@55: Amiga DOS disk []
Strength = 70@56: Amiga FFS disk []
Strength = 70@57: Amiga Inter DOS disk []
Strength = 70@58: Amiga Inter FFS disk []
Strength = 70@59: Amiga Fastdir DOS disk []
Strength = 70@60: Amiga Fastdir FFS disk []
Strength = 70@61: Kickstart disk []
Strength = 70@67: AmigaDOS script []
Strength = 70@68: AmigaDOS script []
Strength = 70@78: AMOS Basic sprite bank []
Strength = 70@80: AMOS Basic icon bank []
Strength = 70@82: AMOS Basic memory bank []
Strength = 70@86: AMOS Basic memory banks []
Strength = 70@169: Android sparse image []
Strength = 70@180: Android binary XML []
Strength = 70@11: Silicon Graphics movie file [video/x-sgi-movie]
Strength = 70@13: Apple QuickTime [video/quicktime]
Strength = 70@19: Apple QuickTime movie (unoptimized) [video/quicktime]
Strength = 70@27: Apple QuickTime image (fast start) [image/x-quicktime]
Strength = 70@31: Apple QuickTime compressed archive [application/x-quicktime-player]
Strength = 70@36: ISO Media []
Strength = 70@713: MPEG ADIF, AAC [audio/x-hx-aac-adif]
Strength = 70@861: DIF []
Strength = 70@868: Microsoft ASF [video/x-ms-asf]
Strength = 70@872: MNG video data, [video/x-mng]
Strength = 70@880: JNG video data, [video/x-jng]
Strength = 70@999: Nullsoft Video []
Strength = 70@1004: REDCode Video []
Strength = 70@1009: MTV Multimedia File []
Strength = 70@1031: Sega FILM/CPK Multimedia, []
Strength = 70@1038: Nintendo THP Multimedia []
Strength = 70@1043: BBC Dirac Video []
Strength = 70@18: a.out little-endian 32-bit executable []
Strength = 70@22: a.out little-endian 32-bit pure executable []
Strength = 70@26: a.out little-endian 32-bit demand paged pure executable []
Strength = 70@38: a.out big-endian 32-bit executable []
Strength = 70@41: a.out big-endian 32-bit pure executable []
Strength = 70@44: a.out big-endian 32-bit demand paged executable []
Strength = 70@15: Apache Parquet []
Strength = 70@7: APL workspace (Ken's original?) []
Strength = 70@11: AppleSingle encoded Macintosh file []
Strength = 70@12: AppleDouble encoded Macintosh file []
Strength = 70@82: Apple ][ 2IMG Disk Image []
Strength = 70@258: Apple Mechanic font []
Strength = 70@328: CoreAudio Format audio file []
Strength = 70@335: Mac OS X Keychain File []
Strength = 70@339: Mac OS X Code Requirement []
Strength = 70@343: Mac OS X Code Requirement Set []
Strength = 70@347: Mac OS X Code Directory []
Strength = 70@352: Mac OS X Detached Code Signature (non-executable) []
Strength = 70@355: Mac OS X Detached Code Signature []
Strength = 70@512: Apple File System (APFS) []
Strength = 70@192: very old 32-bit-int little-endian archive []
Strength = 70@193: very old 32-bit-int big-endian archive []
Strength = 70@199: old 32-bit-int little-endian archive []
Strength = 70@201: old 32-bit-int big-endian archive []
Strength = 70@207: PDP-11 old archive []
Strength = 70@208: PDP-11 4.0 archive []
Strength = 70@215: apl workspace []
Strength = 70@220: System V Release 1 ar archive [application/x-archive]
Strength = 70@334: ARC archive data, dynamic LZW [application/x-arc]
Strength = 70@336: ARC archive data, squashed [application/x-arc]
Strength = 70@338: ARC archive data, uncompressed [application/x-arc]
Strength = 70@340: ARC archive data, packed [application/x-arc]
Strength = 70@342: ARC archive data, squeezed [application/x-arc]
Strength = 70@344: ARC archive data, crunched [application/x-arc]
Strength = 70@347: PAK archive data [application/x-arc]
Strength = 70@349: ARC+ archive data [application/x-arc]
Strength = 70@351: HYP archive data [application/x-arc]
Strength = 70@375: HPack archive data []
Strength = 70@377: HAP archive data []
Strength = 70@379: MDCD archive data []
Strength = 70@381: LIM archive data []
Strength = 70@387: BSArc archive data []
Strength = 70@400: ReSOF archive data []
Strength = 70@407: X1 archive data []
Strength = 70@409: CDC Codec archive data []
Strength = 70@417: ChArc archive data []
Strength = 70@451: DRY archive data []
Strength = 70@455: AR7 archive data []
Strength = 70@457: PPMZ archive data []
Strength = 70@569: MP3-Archiver archive data []
Strength = 70@571: ZET archive data []
Strength = 70@575: ARQ archive data []
Strength = 70@579: Terse archive data []
Strength = 70@586: ABComp archive data []
Strength = 70@592: InstallShield Z archive Data []
Strength = 70@604: BTS archive data []
Strength = 70@606: ELI 5750 archive data []
Strength = 70@608: QFC archive data []
Strength = 70@609: QFC archive data []
Strength = 70@615: LZS221 archive data []
Strength = 70@623: IMP archive data []
Strength = 70@627: Squish archive data []
Strength = 70@634: SBX archive data []
Strength = 70@645: InstallShield CAB []
Strength = 70@651: BlakHole archive data []
Strength = 70@653: BIX archive data []
Strength = 70@668: PFT archive data []
Strength = 70@672: PPMD archive data []
Strength = 70@676: MSXiE archive data []
Strength = 70@678: DeepFreezer archive data []
Strength = 70@680: DC archive data []
Strength = 70@687: Ai32 archive data []
Strength = 70@688: Ai32 archive data []
Strength = 70@696: DMS archive data []
Strength = 70@698: EPC archive data []
Strength = 70@704: ReDuq archive data []
Strength = 70@706: GCA archive data []
Strength = 70@716: WinHKI archive data []
Strength = 70@720: BSN archive data []
Strength = 70@721: BSN archive data []
Strength = 70@722: BSN archive data []
Strength = 70@731: SZip archive data []
Strength = 70@754: Xpack single archive data []
Strength = 70@828: HA archive data []
Strength = 70@838: HPACK archive data []
Strength = 70@1052: RAR archive data (<v1.5) [application/x-rar]
Strength = 70@1057: squished archive data (Acorn RISCOS) []
Strength = 70@1061: UC2 archive data []
Strength = 70@1218: Zoo archive data [application/x-zoo]
Strength = 70@1283: PARity archive data []
Strength = 70@1351: EET archive [application/x-eet]
Strength = 70@1355: rzip compressed data []
Strength = 70@1371: dar archive, []
Strength = 70@1382: Symbian installation file [application/vnd.symbian.install]
Strength = 70@1386: Symbian installation file (Symbian OS 9.x) [x-epoc/x-sisx-app]
Strength = 70@1390: MoPaQ (MPQ) archive []
Strength = 70@1405: xar archive [application/x-xar]
Strength = 70@1462: Parity Archive Volume Set []
Strength = 70@1467: Bacula volume []
Strength = 70@1481: ZPAQ file []
Strength = 70@1496: Norton GHost image []
Strength = 70@1528: Google Chrome extension [application/x-chrome-extension]
Strength = 70@8: Aster*x []
Strength = 70@13: Aster*x Version 2 []
Strength = 70@11: Sun/NeXT audio data: []
Strength = 70@49: DEC audio data: []
Strength = 70@86: Standard MIDI data [audio/midi]
Strength = 70@94: Creative Music (CMF) data [audio/x-unknown]
Strength = 70@106: MultiTrack sound data []
Strength = 70@111: Extended MOD sound data, []
Strength = 70@119: RealAudio sound file [audio/x-pn-realaudio]
Strength = 70@140: ScreamTracker III Module sound data []
Strength = 70@168: MikMod UNI format module sound data []
Strength = 70@181: 4-channel Protracker module sound data [audio/x-mod]
Strength = 70@185: 4-channel Protracker module sound data [audio/x-mod]
Strength = 70@189: 4-channel Startracker module sound data [audio/x-mod]
Strength = 70@193: 8-channel Startracker module sound data [audio/x-mod]
Strength = 70@197: 4-channel Fasttracker module sound data [audio/x-mod]
Strength = 70@201: 6-channel Fasttracker module sound data [audio/x-mod]
Strength = 70@205: 8-channel Fasttracker module sound data [audio/x-mod]
Strength = 70@209: 8-channel Octalyser module sound data [audio/x-mod]
Strength = 70@213: 8-channel Octalyzer module sound data [audio/x-mod]
Strength = 70@220: 16-channel Taketracker module sound data [audio/x-mod]
Strength = 70@224: 32-channel Taketracker module sound data [audio/x-mod]
Strength = 70@237: PlaySID v2.2+ (AMIGA) sidtune []
Strength = 70@246: RSID sidtune PlaySID compatible []
Strength = 70@257: IRCAM file (VAX little-endian) []
Strength = 70@258: IRCAM file (VAX big-endian) []
Strength = 70@259: IRCAM file (Sun big-endian) []
Strength = 70@260: IRCAM file (Sun little-endian) []
Strength = 70@261: IRCAM file (MIPS little-endian) []
Strength = 70@262: IRCAM file (MIPS big-endian) []
Strength = 70@263: IRCAM file (NeXT big-endian) []
Strength = 70@264: IRCAM file (NeXT big-endian) []
Strength = 70@265: IRCAM file (NeXT little-endian) []
Strength = 70@274: Audio Visual Research file, []
Strength = 70@319: Extended NES Sound File []
Strength = 70@341: Impulse Tracker module sound data - [audio/x-mod]
Strength = 70@348: Imago Orpheus module sound data - []
Strength = 70@355: Impulse Tracker Sample []
Strength = 70@360: Impulse Tracker Instrument []
Strength = 70@376: Scream Tracker Sample []
Strength = 70@389: MED music file, version 0 []
Strength = 70@390: OctaMED Pro music file, version 1 []
Strength = 70@391: OctaMED Soundstudio music file, version 3 []
Strength = 70@394: Symphonie SymMOD music file []
Strength = 70@415: DIGI Booster Pro Module []
Strength = 70@420: FaceTheMusic module []
Strength = 70@426: Xtracker DMF Module []
Strength = 70@430: Dynamic Studio Module DSM []
Strength = 70@431: DigiTrekker DTM Module []
Strength = 70@432: DigiTrakker MDL Module []
Strength = 70@433: Protracker Studio PSM Module []
Strength = 70@434: Poly Tracker PTM Module []
Strength = 70@436: MadTracker 2.0 Module MT2 []
Strength = 70@438: RTM Module []
Strength = 70@450: Yamaha SMAF file []
Strength = 70@458: FLAC audio bitstream data [audio/flac]
Strength = 70@502: VBOX voice message data []
Strength = 70@506: RBS Song file []
Strength = 70@521: Monkey's Audio compressed format [audio/x-ape]
Strength = 70@564: Surprise! Adlib Tracker []
Strength = 70@567: eXotic ADlib []
Strength = 70@571: FM Kingtracker Song []
Strength = 70@617: SNDH Atari ST music []
Strength = 70@655: Musepack audio (MPCK) [audio/x-musepack]
Strength = 70@670: SoundFX Module sound file []
Strength = 70@681: SuperCollider3 Synth Definition file, []
Strength = 70@687: True Audio Lossless Audio []
Strength = 70@692: WavPack Lossless Audio []
Strength = 70@952: IBK instrument data []
Strength = 70@953: IBK instrument data, 2 operators []
Strength = 70@954: IBK instrument data, 4 operators []
Strength = 70@1040: Nintendo Wii BRSTM audio file [audio/x-brstm]
Strength = 70@1068: Nintendo 3DS BCSTM audio file [audio/x-bcstm]
Strength = 70@1081: Nintendo Wii U BFSTM audio file [audio/x-bfstm]
Strength = 70@1106: Nintendo 3DS BCWAV audio file [audio/x-bcwav]
Strength = 70@8: BFLT executable []
Strength = 70@22: SAMtools TBI (Tabix index format) []
Strength = 70@43: SAMtools BAM (Binary Sequence Alignment/Map) []
Strength = 70@54: SAMtools BAI (BAM indexing format) []
Strength = 70@61: CRAM []
Strength = 70@14: Biosig/Axon Binary format [biosig/abf2]
Strength = 70@22: Biosig/Axon Text fomrat [biosig/atf]
Strength = 70@25: Biosig/Axona file format [biosig/axona]
Strength = 70@27: Biosig/Axona file format [biosig/axona]
Strength = 70@33: Biosig/AXG []
Strength = 70@34: Biosig/AXG [biosig/axg]
Strength = 70@72: Biosig/DEMG [biosig/demg]
Strength = 70@87: Biosig/IgorPro ITX file [biosig/igorpro]
Strength = 70@103: Biosig/NEX [biosig/nex1]
Strength = 70@106: Biosig/Plexon v1.0 []
Strength = 70@110: Biosig/RHD2000: Intan RHD2000 format []
Strength = 70@136: Biosig/Walter Graphtek []
Strength = 70@137: Biosig/Walter Graphtek []
Strength = 70@138: Biosig/Walter Graphtek [biosig/walter-graphtek]
Strength = 70@15: 68k Blit mpx/mux executable []
Strength = 70@6: i960 b.out relocatable object []
Strength = 70@9: 386 compact demand paged pure executable []
Strength = 70@14: SPARC demand paged []
Strength = 70@23: SPARC pure []
Strength = 70@29: SPARC []
Strength = 70@6: Chiasmus encrypted data []
Strength = 70@8: D64 Image []
Strength = 70@9: D71 Image []
Strength = 70@10: D81 Image []
Strength = 70@12: X64 Image []
Strength = 70@18: ARC archive (c64) []
Strength = 70@28: WRAptor packer (c64) []
Strength = 70@53: GoatTracker 2 song []
Strength = 70@143: Bentley/Intergraph MicroStation DGN cell library []
Strength = 70@144: Bentley/Intergraph MicroStation DGN vector CAD []
Strength = 70@145: Bentley/Intergraph MicroStation DGN vector CAD []
Strength = 70@34: JAR compressed with pack200, []
Strength = 70@40: JAR compressed with pack200, []
Strength = 70@9: cisco IOS microcode []
Strength = 70@11: cisco IOS experimental microcode []
Strength = 70@64: CLIPPER instruction trace []
Strength = 70@65: CLIPPER instruction profile []
Strength = 70@155: lzip compressed data [application/x-lzip]
Strength = 70@234: Amiga xpkf.library compressed data []
Strength = 70@235: Power Packer 1.1 compressed data []
Strength = 70@236: Power Packer 2.0 compressed data, []
Strength = 70@268: LRZIP compressed data []
Strength = 70@274: LZ4 compressed data (v1.4+) [application/x-lz4]
Strength = 70@277: LZ4 compressed data (v1.0-v1.3) [application/x-lz4]
Strength = 70@279: LZ4 compressed data (v0.1-v0.9) [application/x-lz4]
Strength = 70@310: Zstandard compressed data (v0.2) [application/x-zstd]
Strength = 70@312: Zstandard compressed data (v0.3) [application/x-zstd]
Strength = 70@314: Zstandard compressed data (v0.4) [application/x-zstd]
Strength = 70@316: Zstandard compressed data (v0.5) [application/x-zstd]
Strength = 70@318: Zstandard compressed data (v0.6) [application/x-zstd]
Strength = 70@320: Zstandard compressed data (v0.7) [application/x-zstd]
Strength = 70@323: Zstandard compressed data (v0.8+) [application/x-zstd]
Strength = 70@328: Zstandard dictionary [application/x-zstd-dictionary]
Strength = 70@341: rzip compressed data []
Strength = 70@346: FreeArc archive <http://freearc.org> []
Strength = 70@349: DACT compressed data []
Strength = 70@357: Valve Pak file []
Strength = 70@385: Softlib archive []
Strength = 70@391: lzfse encoded, no compression []
Strength = 70@392: lzfse compressed, uncompressed tables []
Strength = 70@393: lzfse compressed, compressed tables []
Strength = 70@394: lzfse encoded, lzvn compressed []
Strength = 70@49: NES ROM image (iNES) [application/x-nes-rom]
Strength = 70@54: NES ROM image (Wii U Virtual Console) [application/x-nes-rom]
Strength = 70@102: NES ROM image (Nintendo 3DS Virtual Console) [application/x-nes-rom]
Strength = 70@388: Sega Dreamcast VMU game image []
Strength = 70@389: Dream Animator file []
Strength = 70@510: Microsoft Xbox executable []
Strength = 70@535: XIP, Microsoft Xbox data []
Strength = 70@536: XTF, Microsoft Xbox data []
Strength = 70@551: Microsoft Xbox 360 executable []
Strength = 70@629: SNES9x input recording []
Strength = 70@683: ScummVM savegame []
Strength = 70@707: Nintendo GameCube disc image: [application/x-gamecube-rom]
Strength = 70@724: Nintendo Wii disc image: []
Strength = 70@781: Nintendo []
Strength = 70@873: Nintendo 3DS []
Strength = 70@895: Nintendo 3DS SMDH file []
Strength = 70@909: Nintendo 3DS Homebrew Application (3DSX) []
Strength = 70@12: Convex old-style object []
Strength = 70@14: Convex old-style demand paged executable []
Strength = 70@16: Convex old-style pre-paged executable []
Strength = 70@18: Convex old-style pre-paged, non-swapped executable []
Strength = 70@20: Core file []
Strength = 70@33: dump format, 4.2 or 4.3 BSD (IDC compatible) []
Strength = 70@34: dump format, Convex Storage Manager by-reference dump []
Strength = 70@39: Convex SOFF []
Strength = 70@57: Convex SOFF core []
Strength = 70@59: Convex SOFF checkpoint []
Strength = 70@29: GCC gcno coverage (-ftest-coverage), []
Strength = 70@34: GCC gcno coverage (-ftest-coverage), []
Strength = 70@41: GCC gcda coverage (-fprofile-arcs), []
Strength = 70@46: GCC gcda coverage (-fprofile-arcs), []
Strength = 70@6: Cracklib password index, little endian []
Strength = 70@10: Cracklib password index, big endian []
Strength = 70@9: Common Trace Format (CTF) trace data (LE) []
Strength = 70@10: Common Trace Format (CTF) trace data (BE) []
Strength = 70@13: Common Trace Format (CTF) packetized metadata (LE) []
Strength = 70@16: Common Trace Format (CTF) packetized metadata (BE) []
Strength = 70@6: Map file for the AssaultCube FPS game []
Strength = 70@7: Map file for cube and cube2 engine games []
Strength = 70@6: DACT compressed data []
Strength = 70@12: GNU dbm 1.x or ndbm database, big endian, 32-bit [application/x-gdbm]
Strength = 70@14: GNU dbm 1.x or ndbm database, big endian, old [application/x-gdbm]
Strength = 70@16: GNU dbm 1.x or ndbm database, big endian, 64-bit [application/x-gdbm]
Strength = 70@18: GNU dbm 1.x or ndbm database, little endian, 32-bit [application/x-gdbm]
Strength = 70@20: GNU dbm 1.x or ndbm database, little endian, old [application/x-gdbm]
Strength = 70@22: GNU dbm 1.x or ndbm database, little endian, 64-bit [application/x-gdbm]
Strength = 70@24: GNU dbm 2.x database [application/x-gdbm]
Strength = 70@35: Berkeley DB [application/x-dbm]
Strength = 70@46: Berkeley DB []
Strength = 70@56: Berkeley DB 1.85/1.86 []
Strength = 70@58: Berkeley DB 1.85/1.86 []
Strength = 70@60: Berkeley DB 1.85/1.86 []
Strength = 70@63: Berkeley DB []
Strength = 70@65: Berkeley DB []
Strength = 70@67: Berkeley DB []
Strength = 70@70: Berkeley DB []
Strength = 70@72: Berkeley DB []
Strength = 70@74: Berkeley DB []
Strength = 70@77: Berkeley DB []
Strength = 70@79: Berkeley DB []
Strength = 70@81: Berkeley DB []
Strength = 70@85: Berkeley DB []
Strength = 70@87: Berkeley DB []
Strength = 70@89: Berkeley DB []
Strength = 70@95: RRDTool DB []
Strength = 70@515: SE Linux policy []
Strength = 70@587: Zope Object Database File Storage v3 (data) []
Strength = 70@588: Zope Object Database File Storage v4 (data) []
Strength = 70@591: Zope Object Database Client Cache File (data) []
Strength = 70@594: IDA (Interactive Disassembler) database []
Strength = 70@8: Maxis Database Packed File []
Strength = 70@36: rdiff network-delta data []
Strength = 70@38: rdiff network-delta signature data []
Strength = 70@50: X image []
Strength = 70@65: new-fs dump file (big endian), []
Strength = 70@68: old-fs dump file (big endian), []
Strength = 70@76: old-fs dump file (little endian), []
Strength = 70@80: new-fs dump file (ufs2, big endian), []
Strength = 70@83: new-fs dump file (ufs2, little endian), []
Strength = 70@6: EBML file []
Strength = 70@6: T602 document data, []
Strength = 70@9: Psion Series 5 []
Strength = 70@36: Psion Series 5 ROM multi-bitmap image []
Strength = 70@38: Psion Series 5 []
Strength = 70@48: Psion Series 5 binary: []
Strength = 70@62: Psion Series 5 executable []
Strength = 70@7: ESRI Shapefile []
Strength = 70@187: PC formatted floppy with no filesystem []
Strength = 70@1140: FATX filesystem data []
Strength = 70@1148: Netboot image, []
Strength = 70@1154: OS/2 Boot Manager []
Strength = 70@1165: pxelinux loader (version 2.13 or older) []
Strength = 70@1167: pxelinux loader []
Strength = 70@1169: pxelinux loader (version 3.70 or newer) []
Strength = 70@1554: NTFS []
Strength = 70@1560: NTFS []
Strength = 70@1587: Unix Fast File system [v1] (little-endian), []
Strength = 70@1603: Unix Fast File system [v2] (little-endian) []
Strength = 70@1623: Unix Fast File system [v2] (little-endian) []
Strength = 70@1643: Unix Fast File system [v1] (big-endian), []
Strength = 70@1663: Unix Fast File system [v2] (big-endian) []
Strength = 70@1683: Unix Fast File system [v2] (big-endian) []
Strength = 70@1757: F2FS filesystem []
Strength = 70@1813: SGI disk label (volume header) []
Strength = 70@1816: SGI XFS filesystem data []
Strength = 70@1824: Atari-ST Minix kernel image []
Strength = 70@2029: Linux Compressed ROM File System data, little endian []
Strength = 70@2039: Linux Compressed ROM File System data, big endian []
Strength = 70@2061: Linux Journalled Flash File system, little endian []
Strength = 70@2062: Linux Journalled Flash File system, big endian []
Strength = 70@2075: u-boot legacy uImage, []
Strength = 70@2150: Squashfs filesystem, big endian, []
Strength = 70@2173: Squashfs filesystem, little endian, []
Strength = 70@2340: Delta ISO data, []
Strength = 70@2360: LFS filesystem image []
Strength = 70@54: Macromedia Flash Video [video/x-flv]
Strength = 70@7: FLIF []
Strength = 70@71: X11 SNF font data, MSB first [application/x-font-sfn]
Strength = 70@103: X11 Portable Compiled Font data, []
Strength = 70@121: libGrx font data, []
Strength = 70@126: DOS code page font data collection []
Strength = 70@127: DOS code page font data []
Strength = 70@128: DOS code page font data (from Linux?) []
Strength = 70@185: Portable Font Resource font data (new) []
Strength = 70@187: Portable Font Resource font data (old) []
Strength = 70@343: OpenType font data [application/vnd.ms-opentype]
Strength = 70@373: Web Open Font Format []
Strength = 70@378: Web Open Font Format (Version 2) []
Strength = 70@35: FrameMaker MML file [application/x-mif]
Strength = 70@77: FreeBSD/i386 []
Strength = 70@87: FreeBSD/i386 pure []
Strength = 70@97: FreeBSD/i386 demand paged []
Strength = 70@107: FreeBSD/i386 compact demand paged []
Strength = 70@130: ld.so hints file (Little Endian []
Strength = 70@133: ld.so hints file (Big Endian []
Strength = 70@8: Quake II 3D Model file, []
Strength = 70@18: Quake []
Strength = 70@22: Quake II SP2 sprite file []
Strength = 70@189: doom main IWAD data []
Strength = 70@191: doom patch PWAD data []
Strength = 70@209: Warcraft III map file []
Strength = 70@297: Unreal Engine Package, []
Strength = 70@6: GCC precompiled header []
Strength = 70@10: gconv module configuration cache data []
Strength = 70@30: Knudsen seismic KEL binary (KEB) - []
Strength = 70@68: XSE multibeam []
Strength = 70@82: Caris multibeam sonar related data []
Strength = 70@108: Surfer 6 binary grid file []
Strength = 70@121: LIDAR point data records []
Strength = 70@6: GEOS []
Strength = 70@35: GIMP pattern data, []
Strength = 70@43: GIMP brush data []
Strength = 70@8: glibc locale file LC_CTYPE []
Strength = 70@9: glibc locale file LC_NUMERIC []
Strength = 70@10: glibc locale file LC_TIME []
Strength = 70@11: glibc locale file LC_COLLATE []
Strength = 70@12: glibc locale file LC_MONETARY []
Strength = 70@13: glibc locale file LC_MESSAGES []
Strength = 70@14: glibc locale file LC_ALL []
Strength = 70@15: glibc locale file LC_PAPER []
Strength = 70@16: glibc locale file LC_NAME []
Strength = 70@17: glibc locale file LC_ADDRESS []
Strength = 70@18: glibc locale file LC_TELEPHONE []
Strength = 70@19: glibc locale file LC_MEASUREMENT []
Strength = 70@20: glibc locale file LC_IDENTIFICATION []
Strength = 70@36: GStreamer binary registry []
Strength = 70@15: GNU message catalog (little endian), []
Strength = 70@96: GNU message catalog (big endian), [application/x-gettext-translation]
Strength = 70@119: GPG key trust database []
Strength = 70@10: Khronos SPIR-V binary, big-endian []
Strength = 70@14: Khronos SPIR-V binary, little-endian []
Strength = 70@48: TML 0123 byte-order format []
Strength = 70@49: TML 1032 byte-order format []
Strength = 70@50: TML 2301 byte-order format []
Strength = 70@51: TML 3210 byte-order format []
Strength = 70@53: PA-RISC1.1 relocatable object []
Strength = 70@54: PA-RISC1.1 executable []
Strength = 70@59: PA-RISC1.1 shared executable []
Strength = 70@64: PA-RISC1.1 demand-load executable []
Strength = 70@69: PA-RISC1.1 shared library []
Strength = 70@72: PA-RISC1.1 dynamic load library []
Strength = 70@76: PA-RISC2.0 relocatable object []
Strength = 70@78: PA-RISC2.0 executable []
Strength = 70@83: PA-RISC2.0 shared executable []
Strength = 70@88: PA-RISC2.0 demand-load executable []
Strength = 70@93: PA-RISC2.0 shared library []
Strength = 70@96: PA-RISC2.0 dynamic load library []
Strength = 70@100: PA-RISC1.0 relocatable object []
Strength = 70@102: PA-RISC1.0 executable []
Strength = 70@107: PA-RISC1.0 shared executable []
Strength = 70@112: PA-RISC1.0 demand-load executable []
Strength = 70@117: PA-RISC1.0 shared library []
Strength = 70@120: PA-RISC1.0 dynamic load library []
Strength = 70@124: HP s500 relocatable executable []
Strength = 70@127: HP s500 executable []
Strength = 70@130: HP s500 pure executable []
Strength = 70@134: HP s200 pure executable []
Strength = 70@141: HP s200 executable []
Strength = 70@148: HP s200 demand-load executable []
Strength = 70@155: HP s200 relocatable executable []
Strength = 70@162: HP s200 (2.x release) pure executable []
Strength = 70@166: HP s200 (2.x release) executable []
Strength = 70@170: HP s200 shared library []
Strength = 70@175: HP s200 dynamic load library []
Strength = 70@181: HP old archive []
Strength = 70@182: HP s200 old archive []
Strength = 70@183: HP s200 old archive []
Strength = 70@184: HP s500 old archive []
Strength = 70@186: HP core file []
Strength = 70@188: HP-WINDOWS font []
Strength = 70@195: compiled Lisp []
Strength = 70@204: HP []
Strength = 70@17: AIX compiled message catalog []
Strength = 70@20: AIX backup/restore format file []
Strength = 70@21: AIX backup/restore format file []
Strength = 70@13: IFF data []
Strength = 70@225: MicroDesign data []
Strength = 70@228: MicroDesign page data []
Strength = 70@234: NIFF image data [image/x-niff]
Strength = 70@414: Big TIFF image data, big-endian [image/tiff]
Strength = 70@416: Big TIFF image data, little-endian [image/tiff]
Strength = 70@495: CMU window manager raster image data []
Strength = 70@504: Artisan image data []
Strength = 70@521: GKS Metafile []
Strength = 70@543: structured fax file []
Strength = 70@636: Sun raster image data []
Strength = 70@670: FIT image data []
Strength = 70@675: FIT image data []
Strength = 70@712: DICOM medical imaging data [application/dicom]
Strength = 70@743: PDS image data []
Strength = 70@755: Atari ST STAD bitmap image data (hor) []
Strength = 70@758: Atari ST STAD bitmap image data (vert) []
Strength = 70@823: Adobe Photoshop Image [image/vnd.adobe.photoshop]
Strength = 70@849: National Imagery Transmission Format []
Strength = 70@917: GEM Metafile data []
Strength = 70@957: KISS/GS []
Strength = 70@990: Squeak image data []
Strength = 70@1014: DCX multi-page PCX image data []
Strength = 70@1019: Cineon image data []
Strength = 70@1041: Minolta Dimage camera raw image data []
Strength = 70@1061: OpenEXR image data, [image/x-exr]
Strength = 70@1100: DPX image data, big-endian, [image/x-dpx]
Strength = 70@1103: DPX image data, little-endian, [image/x-dpx]
Strength = 70@1125: NetCDF Data Format data []
Strength = 70@1130: Hierarchical Data Format (version 4) data [application/x-hdf]
Strength = 70@1150: Cartesian Perceptual Compression image [image/x-cpi]
Strength = 70@1161: OLPC firmware icon image data []
Strength = 70@1167: Cytovision Metaphases file []
Strength = 70@1168: Cytovision Karyotype file []
Strength = 70@1169: Cytovision FISH Probe file []
Strength = 70@1170: Cytovision FLEX file []
Strength = 70@1171: Cytovision FLEX file []
Strength = 70@1172: Cytovision RATS file []
Strength = 70@1186: PCO B16 image data []
Strength = 70@1237: X11 cursor []
Strength = 70@1242: Olympus ORF raw image data, big-endian [image/x-olympus-orf]
Strength = 70@1244: Olympus ORF raw image data, little-endian [image/x-olympus-orf]
Strength = 70@1246: Olympus ORF raw image data, little-endian [image/x-olympus-orf]
Strength = 70@1275: Foveon X3F raw image data [image/x-x3f]
Strength = 70@1284: Paint.NET image data [image/x-paintnet]
Strength = 70@1289: ISO/IEC 19794-2 Format Minutiae Record (FMR) []
Strength = 70@1347: BPG (Better Portable Graphics) [image/bpg]
Strength = 70@1352: Mac OS X icon [image/x-icns]
Strength = 70@1363: TIM image, []
Strength = 70@1384: MDEC video stream, []
Strength = 70@1583: Sega GVR image: []
Strength = 70@1627: ARRI ARI image data, []
Strength = 70@1749: Valve Texture Format []
Strength = 70@1763: Valve Texture Format (PS3) []
Strength = 70@1774: ASTC []
Strength = 70@1795: icrosoft Paint image data (version 1.x) []
Strength = 70@1798: Microsoft Paint image data (version 2.0) []
Strength = 70@1888: PVR 3.0 texture: []
Strength = 70@1960: Microsoft Xbox XPR0 texture []
Strength = 70@68: Intel serial flash for ICH/PCH ROM <= 5 or 3400 series A-step []
Strength = 70@69: Intel serial flash for PCH ROM []
Strength = 70@6: Interleaf saved data []
Strength = 70@58: ispell []
Strength = 70@6: ISO Zipped file []
Strength = 70@13: Java KeyStore [application/x-java-keystore]
Strength = 70@15: Java JCE KeyStore [application/x-java-jce-keystore]
Strength = 70@32: Java jmod module version 1.0 [application/x-java-jmod]
Strength = 70@37: Java module image (big endian) []
Strength = 70@42: Java module image (little endian) []
Strength = 70@98: JPEG image data, HSI proprietary []
Strength = 70@118: JPEG 2000 codestream []
Strength = 70@11: Keepass password database []
Strength = 70@44: Kerberos Keytab file []
Strength = 70@6: DEC SRC Virtual Paper Lectern file []
Strength = 70@16: Linux/i386 impure executable (OMAGIC) []
Strength = 70@18: Linux/i386 pure executable (NMAGIC) []
Strength = 70@20: Linux/i386 demand-paged executable (ZMAGIC) []
Strength = 70@22: Linux/i386 demand-paged executable (QMAGIC) []
Strength = 70@28: Linux-8086 impure executable []
Strength = 70@30: Linux-8086 executable []
Strength = 70@33: Linux-8086 object file []
Strength = 70@35: Minix-386 impure executable []
Strength = 70@37: Minix-386 executable []
Strength = 70@39: Minix-386 NSYM/GNU executable []
Strength = 70@49: Linux/i386 LILO boot/chain loader []
Strength = 70@137: Linux kernel []
Strength = 70@149: User-mode Linux COW file []
Strength = 70@189: Linux []
Strength = 70@212: Linux kernel ARM boot executable zImage (little-endian) []
Strength = 70@215: Linux kernel ARM boot executable zImage (big-endian) []
Strength = 70@219: Linux-Dev86 executable, headerless []
Strength = 70@223: Linux-8086 executable []
Strength = 70@245: SYSLINUX' LSS16 image data [image/x-lss16]
Strength = 70@251: User-Mode-Linux's Copy-On-Write disk image []
Strength = 70@256: SE Linux policy []
Strength = 70@335: LVM Snapshot (CopyOnWrite store) []
Strength = 70@342: SE Linux policy []
Strength = 70@435: locale archive []
Strength = 70@449: Linux Software RAID []
Strength = 70@453: Linux Software RAID []
Strength = 70@476: iproute2 routes dump []
Strength = 70@477: iproute2 addresses dump []
Strength = 70@482: CRIU image file v1.1 []
Strength = 70@483: CRIU service file []
Strength = 70@484: CRIU inventory []
Strength = 70@67: CLISP memory image data []
Strength = 70@68: CLISP memory image data, other endian []
Strength = 70@71: MIT scheme (library?) []
Strength = 70@8: LLVM byte-codes, uncompressed []
Strength = 70@13: LLVM bitcode, wrapper []
Strength = 70@21: LLVM IR bitcode []
Strength = 70@19: Lua bytecode, []
Strength = 70@14: StuffIt Archive (data) [application/x-stuffit]
Strength = 70@18: StuffIt Deluxe (data) []
Strength = 70@350: SPSS Portable File []
Strength = 70@353: SPSS System File []
Strength = 70@356: SPSS System File []
Strength = 70@7: magic binary file for file(1) cmd []
Strength = 70@9: magic binary file for file(1) cmd []
Strength = 70@36: Transport Neutral Encapsulation Format [application/vnd.ms-tnef]
Strength = 70@48: JAM message area header file []
Strength = 70@9: FIT Map data []
Strength = 70@17: Maple help database []
Strength = 70@39: Maple something []
Strength = 70@34: Mathematica notebook version 2.x []
Strength = 70@10: Mercurial changeset bundle []
Strength = 70@8: Mirage Assembler m.out executable []
Strength = 70@38: Mini DuMP crash report [application/x-dmp]
Strength = 70@6: MLSSA datafile, []
Strength = 70@6: MMDF mailbox []
Strength = 70@60: raw modem data []
Strength = 70@42: Atari ST M68K contiguous executable []
Strength = 70@47: Atari ST M68K non-contig executable []
Strength = 70@33: Mozilla archive omni.ja [application/x-zip]
Strength = 70@489: DR-DOS executable (COM) []
Strength = 70@572: FREE-DOS executable (COM), UPX compressed [application/x-dosexec]
Strength = 70@575: FREE-DOS executable (COM), UPX compressed [application/x-dosexec]
Strength = 70@658: Microsoft Word Document [application/msword]
Strength = 70@686: Microsoft WinWord 2.0 Document [application/msword]
Strength = 70@692: Microsoft WinWord 2.0 Document [application/msword]
Strength = 70@787: Lotus [application/vnd.lotus-1-2-3]
Strength = 70@877: Windows metafile [image/wmf]
Strength = 70@880: Windows metafile [image/wmf]
Strength = 70@883: Windows metafile [image/wmf]
Strength = 70@1022: Borland Delphi .DCU file []
Strength = 70@1027: TurboC BGI file []
Strength = 70@1028: TurboC Font file []
Strength = 70@1038: Windows 3.x .GRP file []
Strength = 70@1081: DOS EPS Binary File [image/x-eps]
Strength = 70@1092: TNEF [application/vnd.ms-tnef]
Strength = 70@1111: 4DOS help file []
Strength = 70@1367: InstallShield Cabinet archive data []
Strength = 70@23: Microsoft Visual C library []
Strength = 70@24: Microsoft Visual C library []
Strength = 70@25: Microsoft Visual C library []
Strength = 70@65: MSVC .bsc []
Strength = 70@23: KSS music file v1.03 []
Strength = 70@31: KSS music file v1.20 []
Strength = 70@12: National Instruments, []
Strength = 70@24: National Instruments, VXI File, data []
Strength = 70@7: NekoVM bytecode []
Strength = 70@57: a.out NetBSD/i386 demand paged []
Strength = 70@60: a.out NetBSD/i386 pure []
Strength = 70@63: a.out NetBSD/i386 []
Strength = 70@66: a.out NetBSD/i386 core []
Strength = 70@69: a.out NetBSD/m68k demand paged []
Strength = 70@72: a.out NetBSD/m68k pure []
Strength = 70@75: a.out NetBSD/m68k []
Strength = 70@78: a.out NetBSD/m68k core []
Strength = 70@81: a.out NetBSD/m68k4k demand paged []
Strength = 70@84: a.out NetBSD/m68k4k pure []
Strength = 70@87: a.out NetBSD/m68k4k []
Strength = 70@90: a.out NetBSD/m68k4k core []
Strength = 70@93: a.out NetBSD/ns32532 demand paged []
Strength = 70@96: a.out NetBSD/ns32532 pure []
Strength = 70@99: a.out NetBSD/ns32532 []
Strength = 70@102: a.out NetBSD/ns32532 core []
Strength = 70@105: a.out NetBSD/powerpc core []
Strength = 70@108: a.out NetBSD/SPARC demand paged []
Strength = 70@111: a.out NetBSD/SPARC pure []
Strength = 70@114: a.out NetBSD/SPARC []
Strength = 70@117: a.out NetBSD/SPARC core []
Strength = 70@120: a.out NetBSD/pmax demand paged []
Strength = 70@123: a.out NetBSD/pmax pure []
Strength = 70@126: a.out NetBSD/pmax []
Strength = 70@129: a.out NetBSD/pmax core []
Strength = 70@132: a.out NetBSD/vax 1k demand paged []
Strength = 70@135: a.out NetBSD/vax 1k pure []
Strength = 70@138: a.out NetBSD/vax 1k []
Strength = 70@141: a.out NetBSD/vax 1k core []
Strength = 70@144: a.out NetBSD/vax 4k demand paged []
Strength = 70@147: a.out NetBSD/vax 4k pure []
Strength = 70@150: a.out NetBSD/vax 4k []
Strength = 70@153: a.out NetBSD/vax 4k core []
Strength = 70@159: ECOFF NetBSD/alpha binary []
Strength = 70@162: a.out NetBSD/alpha core []
Strength = 70@166: a.out NetBSD/mips demand paged []
Strength = 70@170: a.out NetBSD/mips pure []
Strength = 70@173: a.out NetBSD/mips []
Strength = 70@176: a.out NetBSD/mips core []
Strength = 70@179: a.out NetBSD/arm32 demand paged []
Strength = 70@182: a.out NetBSD/arm32 pure []
Strength = 70@185: a.out NetBSD/arm32 []
Strength = 70@190: a.out NetBSD/arm core []
Strength = 70@194: NetBSD kernel core file []
Strength = 70@13: Netscape Communicator address book []
Strength = 70@8: NeWS bitmap font []
Strength = 70@9: NeWS font family []
Strength = 70@10: scalable OpenFont binary []
Strength = 70@11: encrypted scalable OpenFont binary []
Strength = 70@12: X11/NeWS bitmap font []
Strength = 70@13: X11/NeWS font family []
Strength = 70@6: NItpicker Flow File []
Strength = 70@14: OLF []
Strength = 70@7: OSF/Rose object []
Strength = 70@128: A GutenPalm zTXT e-book []
Strength = 70@150: Palm OS operating system patch data []
Strength = 70@6: PDP-11 single precision APL workspace []
Strength = 70@7: PDP-11 double precision APL workspace []
Strength = 70@64: perl Storable (v0.7) data []
Strength = 70@146: PGP RSA encrypted session key - []
Strength = 70@163: PGP RSA encrypted session key - []
Strength = 70@180: PGP RSA encrypted session key - []
Strength = 70@197: PGP RSA encrypted session key - []
Strength = 70@7: Plan 9 executable, Motorola 68k []
Strength = 70@8: Plan 9 executable, Intel 386 []
Strength = 70@9: Plan 9 executable, Intel 960 []
Strength = 70@10: Plan 9 executable, SPARC []
Strength = 70@11: Plan 9 executable, MIPS R3000 []
Strength = 70@12: Plan 9 executable, AT&T DSP 3210 []
Strength = 70@13: Plan 9 executable, MIPS R4000 BE []
Strength = 70@14: Plan 9 executable, AMD 29000 []
Strength = 70@15: Plan 9 executable, ARM 7-something []
Strength = 70@16: Plan 9 executable, PowerPC []
Strength = 70@17: Plan 9 executable, MIPS R4000 LE []
Strength = 70@18: Plan 9 executable, DEC Alpha []
Strength = 70@33: DOS EPS Binary File []
Strength = 70@115: RST-format raster font data []
Strength = 70@10: Pulsar POP3 daemon mailbox cache file. []
Strength = 70@14: Password Safe V3 database []
Strength = 70@8: Pyramid 90x family executable []
Strength = 70@9: Pyramid 90x family pure executable []
Strength = 70@11: Pyramid 90x family demand paged pure executable []
Strength = 70@13: python 1.5/1.6 byte-compiled []
Strength = 70@14: python 2.0 byte-compiled []
Strength = 70@15: python 2.1 byte-compiled []
Strength = 70@16: python 2.2 byte-compiled []
Strength = 70@17: python 2.3 byte-compiled []
Strength = 70@18: python 2.4 byte-compiled []
Strength = 70@19: python 2.5 byte-compiled []
Strength = 70@20: python 2.6 byte-compiled []
Strength = 70@21: python 2.7 byte-compiled []
Strength = 70@22: python 3.0 byte-compiled []
Strength = 70@23: python 3.1 byte-compiled []
Strength = 70@24: python 3.2 byte-compiled []
Strength = 70@25: python 3.3 byte-compiled []
Strength = 70@26: python 3.4 byte-compiled []
Strength = 70@27: python 3.5.1- byte-compiled []
Strength = 70@28: python 3.5.2+ byte-compiled []
Strength = 70@29: python 3.6 byte-compiled []
Strength = 70@30: python 3.7 byte-compiled []
Strength = 70@10: Conary changeset data []
Strength = 70@42: Git pack index []
Strength = 70@47: Git index []
Strength = 70@53: Mercurial bundle, []
Strength = 70@72: RIFF (little-endian) data []
Strength = 70@265: RIFF (big-endian) data []
Strength = 70@7: RPM [application/x-rpm]
Strength = 70@34: Delta RPM [application/x-rpm]
Strength = 70@10: MTZ reflection file []
Strength = 70@30: CCP4 Electron Density Map []
Strength = 70@102: GDSII Stream file []
Strength = 70@6: Sun 'jks' Java Keystore File data []
Strength = 70@6: SE Linux modular policy []
Strength = 70@8: BALANCE NS32000 .o []
Strength = 70@11: BALANCE NS32000 executable (0 @ 0) []
Strength = 70@14: BALANCE NS32000 executable (invalid @ 0) []
Strength = 70@17: BALANCE NS32000 standalone executable []
Strength = 70@26: Sereal data packet [application/sereal]
Strength = 70@29: Sereal data packet [application/sereal]
Strength = 70@24: IRIS Showcase file []
Strength = 70@26: IRIS Showcase template []
Strength = 70@28: IRIX Parallel Arena []
Strength = 70@34: IRIX core dump []
Strength = 70@38: IRIX 64-bit core dump []
Strength = 70@42: IRIX N32 core dump []
Strength = 70@74: PCP compiled namespace (V.0) []
Strength = 70@78: PCP archive []
Strength = 70@107: PCP Help []
Strength = 70@119: SpeedShop data file []
Strength = 70@122: mdbm file, version 0 (obsolete) []
Strength = 70@123: mdbm file, []
Strength = 70@137: Alias Maya Image File []
Strength = 70@138: Alias Maya Image File []
Strength = 70@12: SVG Scalable Vector Graphics image [image/svg]
Strength = 70@32: QDOS executable []
Strength = 70@36: QL plugin-ROM data, []
Strength = 70@12: NetMon capture file []
Strength = 70@25: NetMon capture file []
Strength = 70@69: NetXRay capture file []
Strength = 70@271: pcap capture file, microseconds ts (big-endian) [application/vnd.tcpdump.pcap]
Strength = 70@274: pcap capture file, microsecond ts (little-endian) [application/vnd.tcpdump.pcap]
Strength = 70@279: pcap capture file, nanosecond ts (big-endian) [application/vnd.tcpdump.pcap]
Strength = 70@282: pcap capture file, nanosecond ts (little-endian) [application/vnd.tcpdump.pcap]
Strength = 70@289: pcap capture file, microsecond ts, extensions (big-endian) []
Strength = 70@291: pcap capture file, microsecond ts, extensions (little-endian) []
Strength = 70@336: NetStumbler log file []
Strength = 70@342: EtherPeek/AiroPeek/OmniPeek capture file []
Strength = 70@347: Visual Networks traffic capture file []
Strength = 70@357: 5View capture file []
Strength = 70@35: SoftQuad troff Context intermediate for HP LaserJet []
Strength = 70@37: SoftQuad troff Context intermediate for PostScript []
Strength = 70@8: SPEC []
Strength = 70@42: Spectrum .RZX data []
Strength = 70@60: zx-state snapshot []
Strength = 70@43: MySQL ISAM index file []
Strength = 70@45: MySQL ISAM compressed data file []
Strength = 70@47: MySQL MyISAM index file []
Strength = 70@54: MySQL MyISAM compressed data file []
Strength = 70@56: MySQL Maria index file []
Strength = 70@58: MySQL Maria compressed data file []
Strength = 70@63: MySQL replication log, []
Strength = 70@123: SQLite Write-Ahead Log, []
Strength = 70@12: a.out SunOS SPARC demand paged []
Strength = 70@20: a.out SunOS SPARC pure []
Strength = 70@25: a.out SunOS SPARC []
Strength = 70@30: a.out SunOS mc68020 demand paged []
Strength = 70@38: a.out SunOS mc68020 pure []
Strength = 70@43: a.out SunOS mc68020 []
Strength = 70@48: a.out SunOS mc68010 demand paged []
Strength = 70@56: a.out SunOS mc68010 pure []
Strength = 70@61: a.out SunOS mc68010 []
Strength = 70@70: SunOS core file []
Strength = 70@92: SunPC 4.0 Hard Disk []
Strength = 70@141: COBALT boot rom data (Flat boot rom or file system) []
Strength = 70@17: SymbOS driver []
Strength = 70@320: Roland TR-707 Data []
Strength = 70@62: PDCurses screen image []
Strength = 70@108: LyX document text []
Strength = 70@9: timezone data []
Strength = 70@8: Unicode text, UTF-7 []
Strength = 70@9: Unicode text, UTF-7 []
Strength = 70@10: Unicode text, UTF-7 []
Strength = 70@11: Unicode text, UTF-7 []
Strength = 70@12: Unicode text, UTF-8-EBCDIC []
Strength = 70@13: Unicode text, UTF-32, big-endian []
Strength = 70@14: Unicode text, UTF-32, little-endian []
Strength = 70@32: unknown demand paged pure executable []
Strength = 70@34: unknown readable demand paged pure executable []
Strength = 70@7: uterus file []
Strength = 70@18: Ultrix core file []
Strength = 70@28: GNU prof performance data []
Strength = 70@32: Harbour HRB file []
Strength = 70@35: Harbour variable dump file []
Strength = 70@44: ST40 component image format []
Strength = 70@8: a []
Strength = 70@14: a []
Strength = 70@6: VAX single precision APL workspace []
Strength = 70@7: VAX double precision APL workspace []
Strength = 70@13: a.out VAX demand paged (first page unmapped) pure executable []
Strength = 70@205: VMWare3 []
Strength = 70@213: VMware4 disk image []
Strength = 70@214: VMware4 disk image []
Strength = 70@286: QEMU suspend to disk image []
Strength = 70@290: QEMU QED Image []
Strength = 70@296: VirtualBox Disk Image []
Strength = 70@306: Bochs Sparse disk image []
Strength = 70@7: Virtutech CRAFF []
Strength = 70@15: VMS VAX executable []
Strength = 70@6: VMware nvram []
Strength = 70@25: Ogg data []
Strength = 70@13: VXL data file, []
Strength = 70@13: WebAssembly (wasm) binary module []
Strength = 70@20: MS Outlook Express DBX file []
Strength = 70@137: MS Windows 3.1 group files []
Strength = 70@279: MS Windows help Full Text Search index [application/x-winhelp-fts]
Strength = 70@342: Microsoft Outlook email folder []
Strength = 70@361: MS Windows registry file, NT/2000 or above []
Strength = 70@362: MS Windows 95/98/ME registry file []
Strength = 70@6: CRDA wireless regulatory database file []
Strength = 70@204: Ted Neslson's CosmicBook hypertext file []
Strength = 70@206: AmigaWriter file []
Strength = 70@211: ChiWriter file []
Strength = 70@221: Adobe InDesign []
Strength = 70@262: gfxboot compiled html help file []
Strength = 70@9: PHP WSDL cache, []
Strength = 70@13: VCDIFF binary diff []
Strength = 70@14: core file (Xenix) []
Strength = 70@73: b.out []
Strength = 70@7: xo65 object, []
Strength = 70@13: xo65 library, []
Strength = 70@20: Jaleo XFS file []
Strength = 70@32: Xcursor data [image/x-xcursor]
Strength = 70@9: object file (z8000 a.out) []
Strength = 70@10: pure object file (z8000 a.out) []
Strength = 70@11: separate object file (z8000 a.out) []
Strength = 70@12: overlay object file (z8000 a.out) []
Strength = 61@24: Apache Hadoop Sequence file version %d []
Strength = 61@465: MS Compress archive data, KWAJ variant [application/x-ms-compress-kwaj]
Strength = 61@563: MS Compress archive data, QBasic variant [application/x-ms-compress-sz]
Strength = 61@865: General Digital Music. []
Strength = 61@883: Hively Tracker Song []
Strength = 61@888: MOdule with MP3 []
Strength = 61@900: by Bastian Spiegel(twice/lego)" []
Strength = 61@911: Farandole Tracker Song []
Strength = 61@59: RAP 1.%d Batch (TD.32, Returned Account Procedure), []
Strength = 61@65: RAP Acknowledgement (TD.32, Returned Account Procedure) []
Strength = 61@379: BWC compressed data []
Strength = 61@54: LCOV coverage tracefile []
Strength = 61@43: Cups Raster version 1, Big Endian []
Strength = 61@52: Cups Raster version 1, Little Endian []
Strength = 61@248: HP 38 []
Strength = 61@267: HP 38 []
Strength = 61@124: JPEG-XR [image/jxr]
Strength = 61@106: MSX G9B image, depth=%d []
Strength = 61@139: Oak Technologies printer stream []
Strength = 61@28: Spectrum .TAP data "%-10.10s" []
Strength = 61@232: Just System Word Processor Ichitaro v4 [application/x-ichitaro4]
Strength = 61@237: Just System Word Processor Ichitaro v5 [application/x-ichitaro5]
Strength = 61@241: Just System Word Processor Ichitaro v6 [application/x-ichitaro6]
Strength = 61@10: Yanagisawa PIC image file, []
Strength = 60@64: LZX compressed archive (Amiga) []
Strength = 60@973: Bink Video []
Strength = 60@1048: RAD Game Tools Smacker Multimedia []
Strength = 60@7: Apache Avro []
Strength = 60@12: Apache ORC []
Strength = 60@18: Apache Hive RC file []
Strength = 60@7: Binary II (apple ][) data []
Strength = 60@383: SAR archive data []
Strength = 60@390: MAR archive data []
Strength = 60@398: Quantum archive data []
Strength = 60@411: AMGC archive data []
Strength = 60@419: PSA archive data []
Strength = 60@443: ESP archive data []
Strength = 60@449: UFA archive data []
Strength = 60@583: UHarc archive data []
Strength = 60@585: ABComp archive data []
Strength = 60@588: CMP archive data []
Strength = 60@590: Splint archive data []
Strength = 60@594: Gather archive data []
Strength = 60@596: BOA archive data []
Strength = 60@611: PRO-PACK archive data []
Strength = 60@613: 777 archive data []
Strength = 60@617: HPA archive data []
Strength = 60@630: Par archive data []
Strength = 60@636: NaShrink archive data []
Strength = 60@641: Disintegrator archive data []
Strength = 60@643: ASD archive data []
Strength = 60@647: TOP4 archive data []
Strength = 60@664: AKT archive data []
Strength = 60@670: SemOne archive data []
Strength = 60@674: FIZ archive data []
Strength = 60@690: SBC archive data []
Strength = 60@692: Ybs archive data []
Strength = 60@694: DitPack archive data []
Strength = 60@700: VSARC archive data []
Strength = 60@702: PDZ archive data []
Strength = 60@714: UHBC archive data []
Strength = 60@718: WWPack archive data []
Strength = 60@723: BSN archive data []
Strength = 60@724: BSN archive data []
Strength = 60@725: BSN archive data []
Strength = 60@743: XPA []
Strength = 60@785: ZZip archive data []
Strength = 60@788: PAQ archive data []
Strength = 60@1004: PUT archive data []
Strength = 60@1477: ZPAQ stream []
Strength = 60@1536: SeqBox, []
Strength = 60@96: SoundBlaster instrument data [audio/x-unknown]
Strength = 60@231: TOC sound file []
Strength = 60@296: Audio file with ID3 version 2 []
Strength = 60@393: MED_Song []
Strength = 60@398: AHX version []
Strength = 60@441: AMF Module []
Strength = 60@558: AMUSIC Adlib Tracker []
Strength = 60@560: EdLib []
Strength = 60@573: DFM Song []
Strength = 60@621: Musepack audio (MP+) [audio/x-musepack]
Strength = 60@877: Multitracker []
Strength = 60@996: Portable Sound Format [audio/x-psf]
Strength = 60@58: Biosig/GDF: General data format for biosignals [biosig/gdf]
Strength = 60@9: Chiasmus key []
Strength = 60@21: Microstation []
Strength = 60@6: Concise Binary Object Representation (CBOR) container [application/cbor]
Strength = 60@21: Message Sequence Chart (chart) []
Strength = 60@144: bzip2 compressed data [application/x-bzip2]
Strength = 60@150: bzip compressed data [application/x-bzip]
Strength = 60@505: CPE executable []
Strength = 60@592: Nintendo Gameboy Music/Audio Data []
Strength = 60@522: ICE authority data []
Strength = 60@46: ddis/ddif []
Strength = 60@47: ddis/dots archive []
Strength = 60@48: ddis/dtif table data []
Strength = 60@49: LN03 output []
Strength = 60@2382: floppy image data (TeleDisk, compressed) []
Strength = 60@2383: floppy image data (TeleDisk) []
Strength = 60@2385: floppy image data (CopyQM, []
Strength = 60@10: libfprint fingerprint data V1 []
Strength = 60@14: libfprint fingerprint data V2 []
Strength = 60@114: FIGlet font []
Strength = 60@116: FIGlet controlfile []
Strength = 60@5: FuseCompress(ed) data []
Strength = 60@42: LADS Caris Ascii Format (CAF) bathymetric lidar []
Strength = 60@45: LADS Caris Binary Format (CBF) bathymetric lidar waveform data []
Strength = 60@96: ECMA-363, Universal 3D []
Strength = 60@8: Gringotts data file []
Strength = 60@470: PBF image (deflate compression) [image/x-unknown]
Strength = 60@25: Linux/i386 object file []
Strength = 60@270: LVM1 (Linux Logical Volume Manager), version 1 []
Strength = 60@273: LVM1 (Linux Logical Volume Manager), version 2 []
Strength = 60@20: StuffIt Deluxe Segment (data) []
Strength = 60@334: SAS []
Strength = 60@341: SAS 7+ []
Strength = 60@64: MAthematica .ml file []
Strength = 60@6: mcrypt 2.5 encrypted data, []
Strength = 60@11: mcrypt 2.2 encrypted data, []
Strength = 60@356: FreeDOS KEYBoard Layout collection []
Strength = 60@367: FreeDOS KEYBoard Layout file []
Strength = 60@1397: Microsoft Word Document [application/msword]
Strength = 60@1433: Mallard BASIC program data (v1.11) []
Strength = 60@1434: Mallard BASIC program data (v1.29+) []
Strength = 60@1435: Mallard BASIC protected program data (v1.11) []
Strength = 60@1436: Mallard BASIC protected program data (v1.29+) []
Strength = 60@10: MSX Gigamix MGSDRV3 music file, []
Strength = 60@49: MSX Music Player K-kaz song []
Strength = 60@8: Progressive Graphics image data, [image/x-pgf]
Strength = 60@129: PGP RSA encrypted session key - []
Strength = 60@19: PostScript document text [application/postscript]
Strength = 60@88: HP PCL printer data []
Strength = 60@22: SCCS archive data []
Strength = 60@75: PCP compiled namespace []
Strength = 60@115: PCP memory mapped values []
Strength = 60@9: QL disk dump data, []
Strength = 60@22: Smile binary data []
Strength = 60@230: Virtual TI skin []
Strength = 60@15: Unicode text, SCSU (Standard Compression Scheme for Unicode) []
Strength = 60@20: a []
Strength = 60@26: script executable []
Strength = 60@8: Compiled XKB Keymap: lsb, []
Strength = 60@11: Compiled XKB Keymap: msb, []
Strength = 56@28: []
Strength = 55@71: new-fs dump file (little endian), []
Strength = 51@41: Infocom (Z-machine %d []
Strength = 51@450: MPEG ADTS, layer III, v1, 32 kbps [audio/mpeg]
Strength = 51@801: FLI animation, 320x200x8 [video/x-fli]
Strength = 51@812: FLC animation [video/x-flc]
Strength = 51@372: Apple Driver Map [application/x-apple-diskimage]
Strength = 51@440: TTComp archive, binary, 4K dictionary []
Strength = 51@738: Xpack DiskImage archive data []
Strength = 51@776: Dzip archive data [application/x-dzip]
Strength = 51@986: Lossless audio version 0.3 []
Strength = 51@13: Blocked GNU Zip Format (BGZF; gzip compatible) []
Strength = 51@114: Kompas drawing 12.0 SP1 []
Strength = 51@154: 3D Studio model [image/x-3ds]
Strength = 51@41: Monu-Cad Drawing, Component or Font []
Strength = 51@575: Lynx homebrew cartridge [application/x-atari-lynx-rom]
Strength = 51@11: COFF format alpha pure []
Strength = 51@17: Dyalog APL []
Strength = 51@12: configuration of Tasmota firmware (ESP8266) [application/x-tasmota-dmp]
Strength = 51@193: Sun disk label []
Strength = 51@1308: GRand Unified Bootloader []
Strength = 51@51: []
Strength = 51@34: Printer Font Metrics [application/x-font-pfm]
Strength = 51@138: GPG symmetrically encrypted data (3DES cipher) []
Strength = 51@36: GPT partition table []
Strength = 51@28: AIX core file []
Strength = 51@576: PC bitmap, OS/2 1.x format [image/x-ms-bmp]
Strength = 51@872: []
Strength = 51@1615: Vision Research CINE Video, []
Strength = 51@41: []
Strength = 51@46: []
Strength = 51@48: []
Strength = 51@119: []
Strength = 51@37: Emacs v18 byte-compiled Lisp data [application/x-elc]
Strength = 51@389: Macintosh HFS data [application/x-apple-diskimage]
Strength = 51@38: []
Strength = 51@17: MARC21 Bibliographic [application/marc]
Strength = 51@35: raw G3 (Group 3) FAX, byte-padded [image/g3fax]
Strength = 51@46: raw G3 (Group 3) FAX [image/g3fax]
Strength = 51@80: Brooktrout 301 fax image, []
Strength = 51@54: MS-DOS executable [application/x-dosexec]
Strength = 51@563: FREE-DOS executable (COM), UPX compressed [application/x-dosexec]
Strength = 51@594: COM executable for DOS [application/x-dosexec]
Strength = 51@599: COM executable for DOS [application/x-dosexec]
Strength = 51@66: MSX OPX Music file []
Strength = 51@136: MSX BIOS+BASIC []
Strength = 51@176: MSX2/2+/TR SubROM []
Strength = 51@190: MSX ROM []
Strength = 51@226: MSX ROM []
Strength = 51@247: MSX ROM with nonstandard page order []
Strength = 51@255: MSX ROM with nonstandard page order []
Strength = 51@263: MSX MegaROM with nonstandard page order []
Strength = 51@303: Konami King's Valley-2 custom stage, title: "%-8.8s" []
Strength = 51@64: Yanagisawa Pi 16 color picture, []
Strength = 51@19: PDP-11 UNIX/RT ldp []
Strength = 51@31: Perl script text executable [text/x-perl]
Strength = 51@26: Sendmail frozen configuration []
Strength = 51@40: SYMMETRY i386 standalone executable []
Strength = 51@17: Compiled terminfo entry "%-s" [application/x-terminfo]
Strength = 51@30: Compiled 32-bit terminfo entry "%-s" [application/x-terminfo2]
Strength = 51@409: []
Strength = 51@18: Xilinx BIT data []
Strength = 50@7: COFF DSP21k []
Strength = 50@13: ALAN game data []
Strength = 50@13: 0420 Alliant virtual executable []
Strength = 50@16: 0421 Alliant compact executable []
Strength = 50@13: Amiga Workbench []
Strength = 50@43: AmigaOS bitmap font []
Strength = 50@44: AmigaOS outline font []
Strength = 50@33: JPEG 2000 image [image/jp2]
Strength = 50@496: MPEG ADTS, layer II, v1 [audio/mpeg]
Strength = 50@571: MPEG ADTS, layer III, v2 [audio/mpeg]
Strength = 50@606: MPEG ADTS, layer II, v2 [audio/mpeg]
Strength = 50@641: MPEG ADTS, layer I, v2 [audio/mpeg]
Strength = 50@676: MPEG ADTS, layer III, v2.5 [audio/mpeg]
Strength = 50@738: MPEG ADTS, AAC [audio/x-hx-aac-adts]
Strength = 50@775: MPEG-4 LOAS [audio/x-mp4a-latm]
Strength = 50@8: Squeezed (apple ][) data []
Strength = 50@166: cpio archive [application/x-cpio]
Strength = 50@168: byte-swapped cpio archive [application/x-cpio]
Strength = 50@190: very old 16-bit-int little-endian archive []
Strength = 50@191: very old 16-bit-int big-endian archive []
Strength = 50@195: old 16-bit-int little-endian archive []
Strength = 50@197: old 16-bit-int big-endian archive []
Strength = 50@402: QuArk archive data []
Strength = 50@404: YAC archive data []
Strength = 50@406: X1 archive data []
Strength = 50@427: NSQ archive data []
Strength = 50@447: Sky archive data []
Strength = 50@619: Arhangel archive data []
Strength = 50@632: HIT archive data []
Strength = 50@659: Logitech Compress archive data []
Strength = 50@708: PPMN archive data []
Strength = 50@727: AIN archive data []
Strength = 50@728: AIN archive data []
Strength = 50@796: ARJ archive data [application/x-arj]
Strength = 50@815: ARJ archive data []
Strength = 50@1263: PRCS packaged project []
Strength = 50@1295: Atari MSA archive data []
Strength = 50@21: WE32000 COFF []
Strength = 50@33: WE32000 COFF executable (TV) []
Strength = 50@990: Sony PlayStation Audio []
Strength = 50@14: VAX-order 68K Blit (standalone) executable []
Strength = 50@16: VAX-order2 68k Blit mpx/mux executable []
Strength = 50@17: VAX-order 68k Blit mpx/mux executable []
Strength = 50@25: C64 PCLink Image []
Strength = 50@146: Bentley/Intergraph MicroStation []
Strength = 50@10: Clarion Developer (v2 and above) data file []
Strength = 50@21: Clarion Developer (v2 and above) memo data []
Strength = 50@27: Clarion Developer (v2 and above) help data []
Strength = 50@31: CLIPPER COFF executable (VAX #) []
Strength = 50@39: CLIPPER COFF executable []
Strength = 50@12: compress'd data [application/x-compress]
Strength = 50@122: packed data [application/octet-stream]
Strength = 50@128: old packed data [application/octet-stream]
Strength = 50@134: compacted data [application/octet-stream]
Strength = 50@138: compacted data [application/octet-stream]
Strength = 50@140: huf output [application/octet-stream]
Strength = 50@161: squeezed data, []
Strength = 50@163: crunched data, []
Strength = 50@165: LZH compressed data, []
Strength = 50@169: frozen file 2.1 []
Strength = 50@170: frozen file 1.0 (or gzip 0.5) []
Strength = 50@173: SCO compress -H (LZH) data []
Strength = 50@231: Quasijarus strong compressed data []
Strength = 50@41: Alpha compressed COFF []
Strength = 50@42: Alpha u-code object []
Strength = 50@56: locale data table []
Strength = 50@9: ATSC A/52 aka AC-3 aka Dolby Digital stream, [audio/vnd.dolby.dd-raw]
Strength = 50@86: old-fs dump file (16-bit, assuming PDP-11 endianness), []
Strength = 50@61: Dyalog APL transfer []
Strength = 50@9: Encore []
Strength = 50@18: Encore unsupported executable []
Strength = 50@1714: Linux []
Strength = 50@2146: Linux old jffs2 filesystem data little endian []
Strength = 50@2147: Linux jffs2 filesystem data little endian []
Strength = 50@2391: floppy image data (IBM SaveDskF, old) []
Strength = 50@2392: floppy image data (IBM SaveDskF) []
Strength = 50@2393: floppy image data (IBM SaveDskF, compressed) []
Strength = 50@7: Berkeley vfont data []
Strength = 50@8: byte-swapped Berkeley vfont data []
Strength = 50@8: fsav macro virus signatures []
Strength = 50@12: RDI Acoustic Doppler Current Profiler (ADCP) []
Strength = 50@57: GeoSwath RDF []
Strength = 50@122: GPG encrypted data [text/PGP]
Strength = 50@42: Apollo m68k COFF executable []
Strength = 50@45: apollo a88k COFF executable []
Strength = 50@284: hp200 (68010) BSD []
Strength = 50@288: hp300 (68020+68881) BSD []
Strength = 50@21: 370 XA sysV executable []
Strength = 50@25: 370 XA sysV pure executable []
Strength = 50@29: 370 sysV pure executable []
Strength = 50@31: 370 XA sysV pure executable []
Strength = 50@33: 370 sysV executable []
Strength = 50@35: 370 XA sysV executable []
Strength = 50@37: SVR2 executable (Amdahl-UTS) []
Strength = 50@40: SVR2 pure executable (Amdahl-UTS) []
Strength = 50@43: SVR2 pure executable (USS/370) []
Strength = 50@46: SVR2 executable (USS/370) []
Strength = 50@6: executable (RISC System/6000 V3.1) or obj module []
Strength = 50@13: shared library []
Strength = 50@14: ctab data []
Strength = 50@15: structured file []
Strength = 50@23: 64-bit XCOFF executable or object module []
Strength = 50@218: Netpbm PAM image file [image/x-portable-pixmap]
Strength = 50@222: Solitaire Image Recorder format []
Strength = 50@528: MGR bitmap, modern format, 8-bit aligned []
Strength = 50@529: MGR bitmap, old format, 1-bit deep, 16-bit aligned []
Strength = 50@530: MGR bitmap, old format, 1-bit deep, 32-bit aligned []
Strength = 50@531: MGR bitmap, modern format, squeezed []
Strength = 50@547: Award BIOS Logo, 136 x 84 [image/x-award-bioslogo]
Strength = 50@549: Award BIOS Logo, 136 x 126 [image/x-award-bioslogo]
Strength = 50@617: RLE image data, []
Strength = 50@658: SGI image data []
Strength = 50@706: PEX Binary Archive []
Strength = 50@764: Atari ATR image []
Strength = 50@1393: BS image, []
Strength = 50@1786: Zebra Metafile graphic []
Strength = 50@17: basic-16 executable []
Strength = 50@20: basic-16 executable (TV) []
Strength = 50@23: x86 executable []
Strength = 50@25: x86 executable (TV) []
Strength = 50@27: iAPX 286 executable small model (COFF) []
Strength = 50@30: iAPX 286 executable large model (COFF) []
Strength = 50@55: BIOS (ia32) ROM Ext. [application/octet-stream]
Strength = 50@12: little endian ispell []
Strength = 50@34: big endian ispell []
Strength = 50@10: Java serialization data []
Strength = 50@8: lif file []
Strength = 50@60: Linux/i386 PC Screen Font v1 data, []
Strength = 50@372: Macintosh MFS data []
Strength = 50@417: Macintosh HFS Extended []
Strength = 50@7: MIPSEB ECOFF executable []
Strength = 50@16: MIPSEL-BE ECOFF executable []
Strength = 50@25: MIPSEB-LE ECOFF executable []
Strength = 50@34: MIPSEL ECOFF executable []
Strength = 50@45: MIPSEB MIPS-II ECOFF executable []
Strength = 50@54: MIPSEL-BE MIPS-II ECOFF executable []
Strength = 50@63: MIPSEB-LE MIPS-II ECOFF executable []
Strength = 50@72: MIPSEL MIPS-II ECOFF executable []
Strength = 50@83: MIPSEB MIPS-III ECOFF executable []
Strength = 50@92: MIPSEL-BE MIPS-III ECOFF executable []
Strength = 50@101: MIPSEB-LE MIPS-III ECOFF executable []
Strength = 50@110: MIPSEL MIPS-III ECOFF executable []
Strength = 50@119: MIPSEB Ucode []
Strength = 50@120: MIPSEL-BE Ucode []
Strength = 50@10: ID tags data []
Strength = 50@8: mc68k COFF []
Strength = 50@17: mc68k executable (shared) []
Strength = 50@19: mc68k executable (shared demand paged) []
Strength = 50@24: 68K BCS executable []
Strength = 50@30: 88K BCS executable []
Strength = 50@33: Motorola S-Record; binary data in text format []
Strength = 50@54: Atari 68xxx executable, []
Strength = 50@70: Atari 68xxx CPX file []
Strength = 50@37: MS Windows COFF MIPS R4000 object file []
Strength = 50@39: MS Windows COFF Alpha object file []
Strength = 50@41: MS Windows COFF Motorola 68000 object file []
Strength = 50@43: MS Windows COFF PowerPC object file []
Strength = 50@45: MS Windows COFF PA-RISC object file []
Strength = 50@581: COM executable for DOS [application/x-dosexec]
Strength = 50@585: COM executable for DOS [application/x-dosexec]
Strength = 50@589: COM executable for DOS [application/x-dosexec]
Strength = 50@603: COM executable for DOS [application/x-dosexec]
Strength = 50@607: COM executable for MS-DOS [application/x-dosexec]
Strength = 50@611: COM executable for MS-DOS [application/x-dosexec]
Strength = 50@615: COM executable for MS-DOS [application/x-dosexec]
Strength = 50@619: COM executable for DOS [application/x-dosexec]
Strength = 50@636: MS-DOS executable (built-in) []
Strength = 50@10: Tower/XP rel 2 object []
Strength = 50@15: Tower/XP rel 2 object []
Strength = 50@20: Tower/XP rel 3 object []
Strength = 50@25: Tower/XP rel 3 object []
Strength = 50@30: Tower32/600/400 68020 object []
Strength = 50@35: Tower32/800 68020 []
Strength = 50@43: Tower32/800 68010 []
Strength = 50@31: OS9/6809 module: []
Strength = 50@53: OS9/68K module: []
Strength = 50@10: i386 COFF object []
Strength = 50@8: PARIX []
Strength = 50@8: "compact bitmap" format (Poskanzer) []
Strength = 50@11: PDP-11 executable []
Strength = 50@22: PDP-11 old overlay []
Strength = 50@24: PDP-11 pure executable []
Strength = 50@28: PDP-11 separate I&D executable []
Strength = 50@32: PDP-11 kernel overlay []
Strength = 50@35: PDP-11 demand-paged pure executable []
Strength = 50@38: PDP-11 overlaid pure executable []
Strength = 50@41: PDP-11 overlaid separate executable []
Strength = 50@48: PGP key security ring [application/x-pgp-keyring]
Strength = 50@50: PGP key security ring [application/x-pgp-keyring]
Strength = 50@52: PGP encrypted data [text/PGP]
Strength = 50@8: mumps avl global []
Strength = 50@12: mumps blt global []
Strength = 50@8: PostScript document text [application/postscript]
Strength = 50@110: interLaced eXtensible Trace (LXT) file []
Strength = 50@24: SYMMETRY i386 .o []
Strength = 50@27: SYMMETRY i386 executable (0 @ 0) []
Strength = 50@30: SYMMETRY i386 executable (invalid @ 0) []
Strength = 50@16: disk quotas file []
Strength = 50@18: IRIS Showcase file []
Strength = 50@21: IRIS Showcase template []
Strength = 50@21: SHARC COFF binary []
Strength = 50@28: QDOS object []
Strength = 50@318: Novell LANalyzer capture file []
Strength = 50@319: Novell LANalyzer capture file []
Strength = 50@16: Compiled PSI (v1) data []
Strength = 50@17: Compiled PSI (v2) data []
Strength = 50@20: SoftQuad DESC or font file binary []
Strength = 50@26: SoftQuad troff Context intermediate []
Strength = 50@11: MySQL table definition file []
Strength = 50@9: SysEx File - []
Strength = 50@39: SVr2 curses screen image, big-endian []
Strength = 50@40: SVr3 curses screen image, big-endian []
Strength = 50@41: SVr4 curses screen image, big-endian []
Strength = 50@43: SVr2 curses screen image, little-endian []
Strength = 50@44: SVr3 curses screen image, little-endian []
Strength = 50@45: SVr4 curses screen image, little-endian []
Strength = 50@13: TeX DVI file [application/x-dvi]
Strength = 50@16: TeX generic font data []
Strength = 50@17: TeX packed font data []
Strength = 50@19: TeX virtual font data []
Strength = 50@26: TeX font metric data [application/x-tex-tfm]
Strength = 50@29: TeX font metric data [application/x-tex-tfm]
Strength = 50@38: very old (C/A/T) troff output data []
Strength = 50@10: Perkin-Elmer executable []
Strength = 50@12: amd 29k coff noprebar executable []
Strength = 50@13: amd 29k coff prebar executable []
Strength = 50@14: amd 29k coff archive []
Strength = 50@16: unicos (cray) executable []
Strength = 50@22: VAX COFF executable []
Strength = 50@25: VAX COFF pure executable []
Strength = 50@6: VISX image file []
Strength = 50@35: x.out []
Strength = 50@38: Microsoft a.out []
Strength = 50@66: old Microsoft 8086 x.out []
Strength = 50@92: XENIX 8086 relocatable or 80286 small model []
Strength = 48@53: SVG XML document [image/svg+xml]
Strength = 46@544: Windows Precompiled iNF [application/x-pnf]
Strength = 41@158: AppleWorks Word Processor [application/x-appleworks3]
Strength = 41@31: TAP 3.%d Batch (TD.57, Transferred Account) []
Strength = 41@39: TAP 3.%d Notification (TD.57, Transferred Account) []
Strength = 41@47: NRT 2.%d (TD.35, Near Real Time Roaming Data Exchange) []
Strength = 41@949: Nintendo amiibo NFC dump - amiibo ID: %08X- []
Strength = 41@185: DBF []
Strength = 41@13: eml://ecoinformatics.org/%s []
Strength = 41@40: https://www.openarchives.org/ore/terms [application/rdf+xml]
Strength = 41@30: DER Encoded Certificate request []
Strength = 41@37: DER Encoded Key Pair, 512 bits []
Strength = 41@42: DER Encoded Key Pair, 1024 bits []
Strength = 41@47: DER Encoded Key Pair, 2048 bits []
Strength = 41@52: DER Encoded Key Pair, 4096 bits []
Strength = 41@57: DER Encoded Key Pair, 8192 bits []
Strength = 41@62: DER Encoded Key Pair, 16k bits []
Strength = 41@67: DER Encoded Key Pair, 32k bits []
Strength = 41@72: DER Encoded Certificate, 512 bits []
Strength = 41@20: []
Strength = 41@28: []
Strength = 41@728: XWD X Window Dump image data [image/x-xwindowdump]
Strength = 41@96: []
Strength = 41@325: TomTom activity file, v7 []
Strength = 41@20: Micro Focus Index File (IDX) [application/octet-stream]
Strength = 41@475: DOS executable (COM, 0x8C-variant) [application/x-dosexec]
Strength = 41@511: []
Strength = 41@524: []
Strength = 41@533: COM executable (32-bit COMBOOT [application/x-c32-comboot-syslinux-exec]
Strength = 41@1479: DOS 2.0-3.2 backed up []
Strength = 41@88: MSX SC2/GRP raw image []
Strength = 41@100: MSX Graph Saurus compressed image []
Strength = 41@278: MSX-BASIC program []
Strength = 41@287: MSX Mega-Assembler source []
Strength = 41@24: PGP key public ring (v%u) [application/pgp-keys]
Strength = 41@535: PGP Secret Sub-key []
Strength = 41@20: Sendmail frozen configuration []
Strength = 41@39: Soundtrakker 128 ST2 music, []
Strength = 41@16: []
Strength = 41@412: []
Strength = 41@415: []
Strength = 41@28: 8086 relocatable (Microsoft) [application/x-object]
Strength = 40@175: AutoCAD Drawing Exchange Format [application/x-dxf]
Strength = 40@623: COM executable for MS-DOS [application/x-dosexec]
Strength = 40@626: COM executable for DOS [application/x-dosexec]
Strength = 40@15: IBM OS/400 save file data []
Strength = 40@255: PGP symmetric key encrypted data - []
Strength = 40@520: PGP Secret Key - []
Strength = 40@522: PGP Secret Sub-key - []
Strength = 40@62: GLF_BINARY_LSB_FIRST []
Strength = 40@64: GLF_BINARY_MSB_FIRST []
Strength = 40@68: GLS_BINARY_LSB_FIRST []
Strength = 40@70: GLS_BINARY_MSB_FIRST []
Strength = 38@13: Cracklib password index, big endian ("64-bit") []
Strength = 35@42: Linux/i386 core file []
Strength = 26@1770: Minix filesystem, V1, 14 char names, %d zones []
Strength = 26@1775: Minix filesystem, V1 (big endian), %d zones []
Strength = 26@1780: Minix filesystem, V1, 30 char names, %d zones []
Strength = 26@1785: Minix filesystem, V1, 30 char names (big endian), %d zones []
Strength = 21@1032: Bio-Rad .PIC Image File []
Strength = 21@491: []
Strength = 21@1451: DOS 2.0 backup id file, sequence %d []
Strength = 18@42: a []
Strength = 17@34: a []
Strength = 11@918: Atari 7800 ROM image [application/x-atari-7800-rom]
Strength = 11@383: []
Strength = 11@608: Panorama database []
Strength = 11@31: (Lepton 3.x), []
Strength = 11@37: (Lepton 2.x), []
Strength = 2@374: zlib compressed data [application/zlib]
Text patterns:
Strength = 250@27: Tenex C shell script text executable [text/x-shellscript]
Strength = 250@46: new awk script text executable [text/x-nawk]
Strength = 250@52: GNU awk script text executable [text/x-gawk]
Strength = 250@77: Bourne-Again shell script text executable [text/x-shellscript]
Strength = 240@36: Paul Falstad's zsh script text executable [text/x-shellscript]
Strength = 240@38: Neil Brown's ash script text executable [text/x-shellscript]
Strength = 230@40: Neil Brown's ae script text executable [text/x-shellscript]
Strength = 230@81: Bourne-Again shell script text executable [text/x-shellscript]
Strength = 220@6: KDE desktop entry [application/x-kdelnk]
Strength = 210@25: Tenex C shell script text executable [text/x-shellscript]
Strength = 210@73: Bourne-Again shell script text executable [text/x-shellscript]
Strength = 200@8: KDE config file [application/x-kdelnk]
Strength = 190@23: Tenex C shell script text executable [text/x-shellscript]
Strength = 190@44: new awk script text executable [text/x-nawk]
Strength = 190@50: GNU awk script text executable [text/x-gawk]
Strength = 190@69: Bourne-Again shell script text executable [text/x-shellscript]
Strength = 185@103: XML [text/xml]
Strength = 185@106: XML [text/xml]
Strength = 181@30: XHTML document text []
Strength = 181@34: XHTML document text []
Strength = 181@38: broken XHTML document text []
Strength = 180@34: Paul Falstad's zsh script text executable [text/x-shellscript]
Strength = 180@57: awk script text executable [text/x-awk]
Strength = 171@7: %s []
Strength = 171@18: XML Sitemap document text [application/xml-sitemap]
Strength = 170@7: old news text [message/rfc822]
Strength = 161@9: %s []
Strength = 160@7: GIMP gradient data []
Strength = 160@1208: Polar Monitor Bitmap text [image/x-polar-monitor-bitmap]
Strength = 160@17: SMTP mail text [message/rfc822]
Strength = 160@32: MIME entity text []
Strength = 150@21: Tenex C shell script text executable [text/x-shellscript]
Strength = 150@42: new awk script text executable [text/x-nawk]
Strength = 150@48: GNU awk script text executable [text/x-gawk]
Strength = 150@65: Bourne-Again shell script text executable [text/x-shellscript]
Strength = 150@11: GIMP palette data []
Strength = 150@19: SMTP mail text [message/rfc822]
Strength = 150@6: cvs password text file []
Strength = 150@131: Alias Maya Ascii File, []
Strength = 140@12: C shell script text executable [text/x-shellscript]
Strength = 140@16: Korn shell script text executable [text/x-shellscript]
Strength = 140@32: Paul Falstad's zsh script text executable [text/x-shellscript]
Strength = 140@55: awk script text executable [text/x-awk]
Strength = 137@176: GNU gettext message catalogue text [text/x-po]
Strength = 130@7: POSIX shell script text executable [text/x-shellscript]
Strength = 130@62: Plan 9 rc shell script text executable []
Strength = 130@13: mail forwarding text [message/rfc822]
Strength = 129@27: unified diff output text [text/x-diff]
Strength = 120@11: mailed, batched news text [message/rfc822]
Strength = 120@30: RFC 822 mail text [message/rfc822]
Strength = 110@9: batched news text [message/rfc822]
Strength = 106@179: , bitmap [image/x-portable-bitmap]
Strength = 106@186: , greymap [image/x-portable-greymap]
Strength = 106@193: , pixmap [image/x-portable-pixmap]
Strength = 100@6: magic text file for file(1) cmd []
Strength = 100@15: mail piping text [message/rfc822]
Strength = 100@27: saved news text [message/news]
Strength = 100@27: PDF document [application/pdf]
Strength = 90@10: xmcd database file for kscd [text/x-xmcd]
Strength = 81@11: Google KML document [application/vnd.google-earth.kml+xml]
Strength = 80@21: news text [message/news]
Strength = 80@23: news text [message/news]
Strength = 80@25: news or mail text [message/rfc822]
Strength = 80@29: Emacs RMAIL text []
Strength = 80@33: Ruby script text [text/x-ruby]
Strength = 78@37: Perl5 module source text []
Strength = 76@42: Perl5 module source text []
Strength = 71@63: C++ source text [text/x-c++]
Strength = 70@58: C++ source text [text/x-c++]
Strength = 70@88: C++ source text [text/x-c++]
Strength = 70@86: PHP script text [text/x-php]
Strength = 70@5: a []
Strength = 70@11: a []
Strength = 69@67: C++ source text [text/x-c++]
Strength = 69@36: Python script text executable [text/x-python]
Strength = 68@71: C++ source text [text/x-c++]
Strength = 68@84: C++ source text [text/x-c++]
Strength = 68@28: Ruby script text [text/x-ruby]
Strength = 67@80: C++ source text [text/x-c++]
Strength = 67@42: Python script text executable [text/x-python]
Strength = 67@12: Ruby script text executable [text/x-ruby]
Strength = 66@39: Python script text executable [text/x-python]
Strength = 65@18: Ruby script text executable [text/x-ruby]
Strength = 65@128: ConTeXt document text []
Strength = 64@15: Ruby script text executable [text/x-ruby]
Strength = 63@94: Objective-C source text [text/x-objective-c]
Strength = 63@33: Python script text executable [text/x-python]
Strength = 63@116: ConTeXt document text []
Strength = 63@126: ConTeXt document text []
Strength = 62@9: Public Suffix List data []
Strength = 62@52: LaTeX document text [text/x-tex]
Strength = 62@136: ConTeXt document text []
Strength = 61@93: PHP script text executable [text/x-php]
Strength = 61@24: Perl script text [text/x-perl]
Strength = 61@9: Ruby script text executable [text/x-ruby]
Strength = 61@102: BibTeX standard bibliography style text file []
Strength = 61@120: ConTeXt document text []
Strength = 61@138: ConTeXt document text []
Strength = 61@24: bencoded News text []
Strength = 60@14: Perl script text [text/x-perl]
Strength = 60@22: Perl script text [text/x-perl]
Strength = 60@9: Python script text executable []
Strength = 60@38: Ruby script text [text/x-ruby]
Strength = 60@130: ConTeXt document text []
Strength = 60@17: a []
Strength = 60@23: script text executable []
Strength = 59@58: LaTeX 2e document text [text/x-tex]
Strength = 59@134: ConTeXt document text []
Strength = 59@28: BinHex binary text []
Strength = 58@24: libtool library file []
Strength = 58@55: Python script text executable [text/x-python]
Strength = 58@13: Qt C-code resource file []
Strength = 58@4: RFC1421 Security Certificate text []
Strength = 58@64: LaTeX table of contents [text/x-tex]
Strength = 58@112: ConTeXt document text []
Strength = 58@114: ConTeXt document text []
Strength = 58@122: ConTeXt document text []
Strength = 58@124: ConTeXt document text []
Strength = 57@29: libtool object file []
Strength = 57@61: Python script text executable []
Strength = 57@133: Netscape cookie text []
Strength = 56@92: Python script text executable [text/x-python]
Strength = 56@5: RFC1421 Security Certificate Signing Request text []
Strength = 56@46: LaTeX document text [text/x-tex]
Strength = 56@55: LaTeX document text [text/x-tex]
Strength = 56@132: ConTeXt document text []
Strength = 55@96: PHP script text executable [text/x-php]
Strength = 55@49: LaTeX document text [text/x-tex]
Strength = 54@76: C++ source text [text/x-c++]
Strength = 54@9: M4 macro processor script text [text/x-m4]
Strength = 54@12: Perl script text [text/x-perl]
Strength = 54@20: Perl script text [text/x-perl]
Strength = 54@84: Python script text executable [text/x-python]
Strength = 54@99: Python script text executable [text/x-python]
Strength = 54@100: BibTeX style text file (with full header) []
Strength = 53@12: diff output text [text/x-diff]
Strength = 53@118: ConTeXt document text []
Strength = 52@16: C []
Strength = 52@26: Lisp/Scheme program text [text/x-lisp]
Strength = 52@49: Python script text executable [text/x-python]
Strength = 52@17: Tcl/Tk script text executable [text/x-tcl]
Strength = 51@16: Node.js script text executable [application/javascript]
Strength = 51@11: Lua script text executable [text/x-lua]
Strength = 51@9: Tcl script text executable [text/x-tcl]
Strength = 51@40: TeX document text [text/x-tex]
Strength = 51@43: LaTeX document text [text/x-tex]
Strength = 51@61: LaTeX auxiliary file [text/x-tex]
Strength = 50@109: DCL command file []
Strength = 50@54: Linux make config build file []
Strength = 50@10: Perl script text [text/x-perl]
Strength = 50@18: Perl script text [text/x-perl]
Strength = 50@21: Tcl/Tk script text executable [text/x-tcl]
Strength = 49@14: Node.js script text executable [application/javascript]
Strength = 49@15: Lua script text executable [text/x-lua]
Strength = 49@46: Ruby script text [text/x-ruby]
Strength = 49@47: HTML document text [text/html]
Strength = 49@13: Tcl script text executable [text/x-tcl]
Strength = 49@19: Tcl/Tk script text executable [text/x-tcl]
Strength = 49@77: LaTeX sorted glossary []
Strength = 48@6: binscii (apple ][) text []
Strength = 48@13: Lua script text executable [text/x-lua]
Strength = 48@26: BSD makefile script text [text/x-makefile]
Strength = 48@53: SVG XML document [image/svg+xml]
Strength = 48@132: Web browser cookie text []
Strength = 48@11: Tcl script text executable [text/x-tcl]
Strength = 47@113: Variant Call Format (VCF) []
Strength = 47@12: Node.js script text executable [application/javascript]
Strength = 47@10: C program text (from flex) []
Strength = 47@34: automake makefile script text [text/x-makefile]
Strength = 47@134: Konqueror cookie text []
Strength = 47@21: METAFONT transcript text []
Strength = 47@36: GNU Info text [text/x-info]
Strength = 47@78: Makeindex log file []
Strength = 46@27: FrameMaker Dictionary text [application/x-mif]
Strength = 46@20: BSD makefile script text [text/x-makefile]
Strength = 46@30: BSD makefile script text [text/x-makefile]
Strength = 46@9: MS Windows 95 Internet shortcut text []
Strength = 46@15: Tcl/Tk script text executable [text/x-tcl]
Strength = 46@75: LaTeX sorted index []
Strength = 45@8: Node.js script text executable [application/javascript]
Strength = 45@9: Lua script text executable [text/x-lua]
Strength = 45@8: Perl script text [text/x-perl]
Strength = 45@16: Perl script text [text/x-perl]
Strength = 45@100: XML document text [text/xml]
Strength = 45@7: Tcl script text executable [text/x-tcl]
Strength = 45@90: BibTeX text file []
Strength = 44@9: Inform source text []
Strength = 44@34: Texinfo source text [text/x-texinfo]
Strength = 44@76: LaTeX raw glossary []
Strength = 44@89: BibTeX text file []
Strength = 43@10: Node.js script text executable [application/javascript]
Strength = 43@75: HTML document text [text/html]
Strength = 43@78: HTML document text [text/html]
Strength = 43@94: HTML document text [text/html]
Strength = 43@5: SiSU text insert []
Strength = 43@8: SiSU text master []
Strength = 43@67: LaTeX document text [text/x-tex]
Strength = 43@96: BibTeX text file []
Strength = 42@991: Squeak program text []
Strength = 42@63: HTML document text [text/html]
Strength = 42@66: HTML document text [text/html]
Strength = 42@81: HTML document text [text/html]
Strength = 42@84: HTML document text [text/html]
Strength = 42@87: HTML document text [text/html]
Strength = 42@90: HTML document text [text/html]
Strength = 42@26: Tcl script []
Strength = 42@20: TeX transcript text []
Strength = 42@95: BibTeX text file []
Strength = 42@106: TeX font aliases text file []
Strength = 41@176: Sequence Alignment/Map (SAM) []
Strength = 41@27: C source text [text/x-c]
Strength = 41@43: C source text [text/x-c]
Strength = 41@49: C source text [text/x-c]
Strength = 41@52: C source text [text/x-c]
Strength = 41@6: Node.js script text executable [application/javascript]
Strength = 41@10: DOS batch file text [text/x-msdos-batch]
Strength = 41@54: Perl POD document text []
Strength = 41@57: HTML document text [text/html]
Strength = 41@60: HTML document text [text/html]
Strength = 41@69: HTML document text [text/html]
Strength = 41@72: HTML document text [text/html]
Strength = 41@11: SiSU text []
Strength = 41@74: LaTeX raw index file []
Strength = 41@94: BibTeX text file []
Strength = 41@16: btoa'd text []
Strength = 41@266: []
Strength = 40@12: Algol 68 source text [text/x-Algol68]
Strength = 40@612: PLS playlist text []
Strength = 40@6: Exuberant Ctags tag file text []
Strength = 40@6: diff output text [text/x-diff]
Strength = 40@80: X11 BDF font text []
Strength = 40@7: C program text (from lex) []
Strength = 40@12: lex description text []
Strength = 40@20: Lisp/Scheme program text [text/x-lisp]
Strength = 40@24: Lisp/Scheme program text [text/x-lisp]
Strength = 40@6: M4 macro processor script text [text/x-m4]
Strength = 40@8: makefile script text [text/x-makefile]
Strength = 40@27: OS/2 REXX batch file text []
Strength = 40@29: OS/2 REXX batch file text []
Strength = 40@47: Perl POD document text []
Strength = 40@53: Perl POD document text []
Strength = 40@23: SoftQuad Raster Format text []
Strength = 40@93: BibTeX text file []
Strength = 40@98: BibTeX-file{ BibTex text file (with full header) []
Strength = 40@104: BibTeX custom bibliography style text file []
Strength = 40@15: troff or preprocessor input text [text/troff]
Strength = 39@325: Software Tools format archive text []
Strength = 39@34: C source text [text/x-c]
Strength = 39@89: PHP script text [text/x-php]
Strength = 39@91: PHP script text [text/x-php]
Strength = 39@613: X pixmap image text [image/x-xpmi]
Strength = 39@74: TeXmacs document text [text/texmacs]
Strength = 39@14: makefile script text [text/x-makefile]
Strength = 39@79: MSX SCMD source MML file []
Strength = 39@124: exported SGML document text []
Strength = 39@86: BibTeX text file []
Strength = 39@9: troff or preprocessor input text [text/troff]
Strength = 39@11: troff or preprocessor input text [text/troff]
Strength = 39@17: troff or preprocessor input text [text/troff]
Strength = 39@21: troff or preprocessor input text [text/troff]
Strength = 39@25: ditroff output text []
Strength = 38@8: Algol 68 source text [text/x-Algol68]
Strength = 38@5: assembler source text [text/x-asm]
Strength = 38@8: BCPL source text [text/x-bcpl]
Strength = 38@10: BCPL source text [text/x-bcpl]
Strength = 38@26: Clojure module source text [text/x-clojure]
Strength = 38@29: Clojure module source text [text/x-clojure]
Strength = 38@59: awk or perl script text []
Strength = 38@8: diff output text [text/x-diff]
Strength = 38@10: diff output text [text/x-diff]
Strength = 38@6: ASCII vfont text []
Strength = 38@510: FIG image text []
Strength = 38@142: Linux kernel symbol map text []
Strength = 38@18: Lisp/Scheme program text [text/x-lisp]
Strength = 38@12: makefile script text [text/x-makefile]
Strength = 38@6: X-Post-It-Note text []
Strength = 38@50: Perl POD document text []
Strength = 38@52: Perl POD document text []
Strength = 38@51: Ruby script text [text/x-ruby]
Strength = 38@54: Ruby script text [text/x-ruby]
Strength = 38@125: exported SGML subdocument text []
Strength = 38@14: SiSU text []
Strength = 38@17: SiSU text []
Strength = 38@6: Sketch document text []
Strength = 38@55: Solaris xcurses screen image []
Strength = 38@71: TeX document text []
Strength = 38@88: BibTeX text file []
Strength = 38@91: BibTeX text file []
Strength = 38@13: troff or preprocessor input text [text/troff]
Strength = 38@19: troff or preprocessor input text [text/troff]
Strength = 37@6: Algol 68 source text [text/x-Algol68]
Strength = 37@14: Algol 68 source text [text/x-Algol68]
Strength = 37@11: assembler source text [text/x-asm]
Strength = 37@610: M3U playlist text []
Strength = 37@23: C source text [text/x-c]
Strength = 37@31: C source text [text/x-c]
Strength = 37@37: C source text [text/x-c]
Strength = 37@40: C source text [text/x-c]
Strength = 37@46: C source text [text/x-c]
Strength = 37@218: Smart Game Format []
Strength = 37@286: Smart Game Format []
Strength = 37@19: Java source [text/x-java]
Strength = 37@22: Lisp/Scheme program text [text/x-lisp]
Strength = 37@10: makefile script text [text/x-makefile]
Strength = 37@5: Pascal source text [text/x-pascal]
Strength = 37@49: Perl POD document text []
Strength = 37@51: Perl POD document text []
Strength = 37@68: Python script text executable [text/x-python]
Strength = 36@10: Algol 68 source text [text/x-Algol68]
Strength = 36@7: assembler source text [text/x-asm]
Strength = 36@9: assembler source text [text/x-asm]
Strength = 36@13: assembler source text [text/x-asm]
Strength = 36@15: assembler source text [text/x-asm]
Strength = 36@17: assembler source text [text/x-asm]
Strength = 36@12: CDDB(tm) format CD text data []
Strength = 36@23: Clojure module source text [text/x-clojure]
Strength = 36@15: RCS/CVS diff output text [text/x-diff]
Strength = 36@145: Linux Software Map entry text []
Strength = 36@146: Linux Software Map entry text (new format) []
Strength = 36@16: Lisp/Scheme program text [text/x-lisp]
Strength = 36@6: makefile script text [text/x-makefile]
Strength = 36@13: Mup music publication program input text []
Strength = 36@48: Perl POD document text []
Strength = 36@65: GEDCOM genealogy text []
Strength = 36@87: BibTeX text file []
Strength = 36@92: BibTeX text file []
Strength = 36@13: uuencoded or xxencoded text []
Strength = 36@20: ship'd binary text []
Strength = 30@118: broken XML document text [text/xml]
Strength = 28@126: exported SGML document text []
Strength = 18@38: a []
Strength = 17@30: a []
Strength = 2@7: FORTRAN program text [text/x-fortran]
Strength = 2@29: Tcl script []
Set 1:
Binary patterns:
Text patterns:
Tags:
Steps To Reproduce:
Additional Information: ■ file --version
file-5.37
magic file from /usr/share/file/misc/magic
■ uname -srvmo
Linux 5.4.2-arch1-1 0000001 SMP PREEMPT Thu, 05 Dec 2019 12:29:40 +0000 x86_64 GNU/Linux

Thank you for maintaining this essential utility.
Attached Files: 2020-01-15.mp4.8k (8,192 bytes) 2020-02-14 01:56
https://bugs.astron.com/file_download.php?file_id=117&type=bug
2019-12-25.mp4.8k (8,192 bytes) 2020-02-14 01:56
https://bugs.astron.com/file_download.php?file_id=116&type=bug
2019-12-11.mp4.8k (8,192 bytes) 2020-02-14 01:56
https://bugs.astron.com/file_download.php?file_id=115&type=bug
2020-01-22.mp4.8k (8,192 bytes) 2020-02-14 01:56
https://bugs.astron.com/file_download.php?file_id=118&type=bug
Bonus.mp4.8k (8,192 bytes) 2020-02-14 01:58
https://bugs.astron.com/file_download.php?file_id=119&type=bug
Notes
(0003354)
christos   
2020-02-12 22:33   
Can you attatch the first few K of this file?
(0003360)
Kid   
2020-02-14 01:56   
Certainly. Here are four samples, identical in their misidentification.
(0003361)
Kid   
2020-02-14 01:58   
And here is a bonus MP4 sample that is misidentified as application/octet-stream. Should I report a second bug?
(0003462)
christos   
2020-08-25 00:47   
The first four are fixed. The last one I am looking into.
(0003463)
christos   
2020-08-25 01:29   
Bonus.pm4 is not an mp4 file but: https://en.wikipedia.org/wiki/MPEG_transport_stream
This really does not have any magic (yes it starts with a G)... But that's not enough.

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
87 [file] General feature N/A 2019-06-12 17:56 2020-08-24 12:56
Reporter: dbrezack Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: feedback Product Version:  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Support for Flattened Device Tree files (fdt)
Description: I think it would be helpful if the file command supported Flattened Device Tree files (fdt).

The file magic is "d0 0d fe ed"

These resources may be helpful
https://wiki.freebsd.org/FlattenedDeviceTree
https://github.com/superna9999/pyfdt

Thanks
Data Brezack
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003254)
christos   
2019-06-16 00:08   
You mean dtb and it already does:

sun50i-h5-nanopi-neo-plus2.dtb: Device Tree Blob version 17, size=25978, boot CPU=0, string block size=1870, DT structure block size=23028
(0003439)
yegorich   
2020-08-03 07:59   
Yes, file detects dtb files. But what about itb files that are composed using its source files? This way you can package several images like Linux kernel, related DTB files in one image. It also has "d0 0d fe ed" as magic, but the other fields seem to be different.

See this PDF for more information: https://elinux.org/images/f/f4/Elc2013_Fernandes.pdf
(0003456)
christos   
2020-08-23 19:27   
I looked quite a bit for fdt examples, even at the uboot source and I could not make sense of it. Do you have example files?
(0003461)
yegorich   
2020-08-24 12:56   
This deb package [1] has kernel-fit.itb file in CONTENTS/boot folder. kernel-fit.itb holds zImage and a number of DTB files. The source file (ITS) can be found here [2].

[1] ftp://ftp.visionsystems.de/pub/multiio/OnRISC/Baltos/deb/stretch/kernel_3.18.32-3.deb
[2] https://github.com/visionsystemsgmbh/onrisc_br_bsp/blob/master/board/vscom/baltos/kernel-fit-intree.its

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
135 [file] General minor always 2020-01-30 18:17 2020-08-23 19:31
Reporter: jj05 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: feedback Product Version: 5.38  
Product Build: Resolution: open  
Projection: none      
ETA: none Fixed in Version:  
    Target Version:  
Summary: Misdetection text/troff instead of text/plain for MT940 files
Description: This isn't a troff file, so shouldn't be detected as one
Tags:
Steps To Reproduce: $ file mt940-troff-bug.txt
mt940-troff-bug.txt: troff or preprocessor input, UTF-8 Unicode (with BOM) text, with CRLF, LF line terminators
Additional Information:
Attached Files: mt940-troff-bug.txt (639 bytes) 2020-01-30 18:17
https://bugs.astron.com/file_download.php?file_id=101&type=bug
Notes
(0003349)
jj05   
2020-01-30 18:20   
More information about MT940 format: http://martin.hinner.info/bankconvert/swift_mt940_942.pdf
(0003352)
christos   
2020-02-12 22:25   
Restricted troff not to match .[0-9]
(0003405)
jj05   
2020-05-12 11:53   
This is available to test?
(0003457)
christos   
2020-08-23 19:31   
The fix should be available on HEAD

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
104 [file] General minor have not tried 2019-09-10 21:04 2020-08-23 19:26
Reporter: Ilrandar Platform:  
Assigned To: christos OS: ArchLinux  
Priority: normal OS Version:  
Status: resolved Product Version: 5.37  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: pdf file incorrectly reported as `data`
Description: Some pdf files downloaded from the internet are incorrectly reported as `data` by file. Their associated mime-type is `application/octet-stream` and not `application/pdf`. I join such a pdf to this report.
Tags:
Steps To Reproduce:
Additional Information:
Attached Files: certificat_scolarité_l2_eco.pdf (1,184,843 bytes) 2019-09-10 21:04
https://bugs.astron.com/file_download.php?file_id=77&type=bug
Notes
(0003288)
christos   
2019-09-11 14:42   
These are the first few lines of the file:

HTTP/1.1 200 OK
Date: Tue, 10 Sep 2019 08:38:20 GMT
Server: Apache/2.4.38 (Debian)
Content-Disposition: attachment; filename="21808995-2019-certificat-scolarite.pdf"
Cache-Control: no-cache, private
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 58
Content-Length: 1184531
Content-Type: application/pdf

Here's where the pdf file starts:

%PDF-1.3

The tool you used to download it or the original file has junk in front. Of course some browsers ignore the junk and process it as a pdf file (because users want things to just work), but this is just crappy behavior. Most application will not open it properly, and it is also a security issue since you can masquerade files this way. It is also fragile. How many lines does it try to parse? 10? 1K of data? Who knows. Depends on the implementation. Of course file can also be modified to mimick this behavior at the loss of efficiency and encouraging people to produce junk...
(0003295)
Ilrandar   
2019-09-11 17:07   
Oh, I didn’t know I could open pdf files with a text editor.
I don’t think you should ignore junk in front of file. I just needed some way to get this file (and a few other) to be recognized as pdf files, but if I can just open them and get rid of the leading incorrect lines, I will just do it.
Thank you for your answer.
As far as I’m concerned, you can consider this issue closed.
(0003432)
holmesmr.pf   
2020-06-29 16:21   
I've noticed a similar issue with other technically-malformed PDF files, but it appears almost every PDF reader and tool not using libmagic supports these.

As an aside, it does appear a rule to implement this is actually in place [1]. However it appears that due to a longstanding issue, searching for text strings in files detected as binary doesn't work[2], so this rule is never successfully hit (this can be verified by the fact that a single line text file with the string '%PDF-1.7' at the end will be detected as 'PDF document, version 1.7, ASCII text'. Presumably this rule should either be removed or a workaround or fix for the search issue is required.

[1]: https://github.com/file/file/blob/FILE5_39/magic/Magdir/pdf#L39
[2]: https://github.com/file/file/blob/FILE5_39/magic/Magdir/vorbis#L21
(0003433)
christos   
2020-06-29 16:50   
Actually there is a simple fix to make search work for binary data (add /b). I will do that and it will probably fix your problem.
(0003434)
holmesmr.pf   
2020-06-29 16:56   
My apologies - I was apparently looking at an old manpage that didn't have documentation on this. Having tested locally with a custom magic file this does appear to work correctly.
(0003455)
christos   
2020-08-23 19:26   
Confirmed fixed

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
185 [file] General minor have not tried 2020-08-20 16:08 2020-08-22 18:46
Reporter: marius851000 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: file doesn't know the extension of GIF/TIFF/PSD file
Description: running ``file --extension`` on either a gif, a tiff or a pdf file result to giving the extension ??? (unknown)
Tags:
Steps To Reproduce: download a GIF file (for example, https://i.imgur.com/DfQqM.gif), a TIFF file (for example, https://www.fileformat.info/format/tiff/sample/3794038f08df403bb446a97f897c578d/download , from https://www.fileformat.info/format/tiff/sample/index.htm) and a PSD file (for example, here: https://www.deviantart.com/edowaado/art/Doctor-Whooves-Epilogue-Pt-2-410825994 (click on download)).
Then run ``file --extension`` on the downloaded file, and it should result in ``<filename> : ???`` rather than ``<filename> : gif/tiff/psd``
Additional Information: Here is a patch to solve this, based on the github mirror.
Attached Files: add_extension_gif_psd_tiff.diff (819 bytes) 2020-08-20 16:08
https://bugs.astron.com/file_download.php?file_id=153&type=bug
Notes
(0003454)
christos   
2020-08-22 18:46   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
181 [file] General minor N/A 2020-08-15 23:06 2020-08-22 18:31
Reporter: abon Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: Minor Opus Tweaks
Description: Thanks for fixing the Opus output. I've included a diff (opus.diff) that makes the following small changes:

1. Update the Opus specification link to the final version.
2. Add a comma and change %d -> %u in the version string.
3. Specify that the sample rate detected is only the _input_ sample rate, as per the 5th item of https://tools.ietf.org/html/rfc7845#section-5.1
Tags:
Steps To Reproduce:
Additional Information: Additionally, I wanted to add the Output Gain field as well, but I had some issues with using the leshort type on the field, which is a Q7.8 number:

Using (as a first try): >>>>44 leshort !0 \b, %d Output Gain

The above (falsely?) converts the two-byte LE short (#xF1) to an unsigned short instead of what I believe should be a signed short.
FWIW, the attached cast.diff makes `file' produce the result expected (-3840).

Using: >>>>44 leshort/256 !0 \b, %d Output Gain

The above appears to convert the LE short to unsigned before getting to the `mprint' function,
as even with cast.diff applied I get 241 instead of the expected -15.

This is also the case when using the short type, as (>>>>44 short !0 \b, %d Output Gain) yields -3840 (expected),
but (>>>>44 short/256 !0 \b, %d Output Gain) yields 241.

Perhaps it's too much effort for a single field like this, but to fully convert the Q7.8 number there would likely need to be support for this form:

>>>>44 leshort/256.0 !0 \b, %g Output Gain

Where it converts the LE short to a floating point to print the fractional part as well. That or adding a new type, which seems excessive.
Attached Files: cast.diff (358 bytes) 2020-08-15 23:06
https://bugs.astron.com/file_download.php?file_id=152&type=bug
opus.diff (929 bytes) 2020-08-15 23:06
https://bugs.astron.com/file_download.php?file_id=151&type=bug
Notes
(0003453)
christos   
2020-08-22 18:31   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
182 [file] General minor always 2020-08-16 22:55 2020-08-22 18:18
Reporter: jpalus Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: ELF shared object without dynamic section considered dynamically linked
Description: VirtualBox creates a shared object:

    $ readelf -h VBoxDDR0.debug|grep Type
      Type: DYN (Shared object file)

which lacks dynamic section and therefore does not have any linked libraries, nor has interpreter:

    $ readelf -d VBoxDDR0.debug
    
    There is no dynamic section in this file.

Yet file started to recognize it as dynamically linked:

    $ file VBoxDDR0.debug
    VBoxDDR0.debug: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=52d7486748cc2a8387793008f2fdbdb1761f65e3, stripped

I guess it is a result of:
https://github.com/file/file/commit/028a15617a7f2c9172e3ac2d903af0f03010c8b4

Perhaps it would be better to judge if object is "dynamically linked" based on dynamic section existence?
Tags:
Steps To Reproduce:
Additional Information:
Attached Files:
Notes
(0003452)
christos   
2020-08-22 18:18   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
184 [file] General minor always 2020-08-19 16:31 2020-08-22 18:17
Reporter: vinc17 Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.38  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.39  
    Target Version:  
Summary: files starting with "*** " misidentified as diff
Description: Files starting with "*** " are misidentified as diff.
Tags:
Steps To Reproduce: $ echo '*** Title' | file -
/dev/stdin: diff output, ASCII text
Additional Information: The use of "***" is quite general in text files and allows one to highlight text, thus it should not be used alone to detect diff output.

I had reported this bug 6 years ago in the Debian BTS (for file 5.17):
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744924
Attached Files:
Notes
(0003451)
christos   
2020-08-22 18:17   
Fixed, thanks!

View Issue Details
ID: Category: Severity: Reproducibility: Date Submitted: Last Update:
183 [file] General minor always 2020-08-18 09:37 2020-08-22 18:04
Reporter: liuzhiqiang Platform:  
Assigned To: christos OS:  
Priority: normal OS Version:  
Status: resolved Product Version: 5.39  
Product Build: Resolution: fixed  
Projection: none      
ETA: none Fixed in Version: 5.40  
    Target Version:  
Summary: “PR 93:file incorrectly recognizes -static-pie binaries” should be reopened.
Description: “PR 93:file incorrectly recognizes -static-pie binaries”should be reopened.

To solve “PR 93:file incorrectly recognizes -static-pie binaries”, one patch (24c9c086cd7c5) is introduced in v5.38.

However, the patch will lead to a new problem, "file incorrectly recognizes shared objects" problem. So, patch (028a15617a7f)
is created to undo the patch (24c9c086cd7c5) to solve "file incorrectly recognizes shared objects" problem.

Finally, "file incorrectly recognizes shared objects" problem is solved, while “PR 93:file incorrectly recognizes -static-pie binaries”problem
occurs again. So we need to solve it.

“PR 93:file incorrectly recognizes -static-pie binaries”: https://bugs.astron.com/view.php?id=93
Tags:
Steps To Reproduce: file version: v5.39
details can be found in https://bugs.astron.com/view.php?id=93.


    1. Create a simple hello word C program
2. Compile it using gcc -fPIE -static-pie -o test test.c
3. Run file on the resulting binary