magic - Magic file for the file command
/etc/magic
The magic file is used by the file command to identify
files that have some sort of magic number. A magic number
is any numeric or string constant that identifies the file
containing the constant.
The format for the magic file is as follows:
offset type operator,value string
The fields should be separated by tabs. Each record must
be contained on one line.
The fields contain the following data: This field contains
the number of bytes from the beginning of the file on
which you are running the file command to the first byte
of the magic number of character string you want to identify.
Use a right angle bracket (>) to indicate a continuation
line that supplies additional information describing
the file. This field contains information about the
data type of the magic number or character string at the
specified byte offset. Valid data types for this field
are: Unsigned character type Unsigned short type Long type
Character (byte) string This field contains instructions
for the file command on how to compare the value read from
the file being checked with the value stored in the Value
Type field of the magic file. The valid comparison operators
are: The two values are equal. The value in the file
being checked is greater than the value in the magic file.
The value in the file being checked is less than the value
in the magic file. All the bits in the magic file value
must be set in the value from the file being checked.
Note that the Comparison Operator field is
optional. If you do not specify the operator, the
values are expected to be equal. This field contains
the value used to compare what is read from
the file being checked by the file command. You
can use decimal, hex, or octal numbers in this
field or character strings in the form of regular
expressions.
Precede all hex numbers with the characters zero
and x (for example, 0x80). To specify an octal number,
precede it with a zero (for example, 0200).
Decimal numbers require no special representation
and should be written as integers (for example,
128).
The rules for specifying character strings follow
those of the ed editor (see ed(1)) for regular
expressions, with two extensions: You use the backslash
(\) to escape an unprintable character. The
string can contain all special character such as
\n, \b, \r, and \f. If a backslash appears in the
string, it must be escaped with a second backslash
(\\). You can use octal representation to specify
any byte value other than zero (0). Text found in
the file can be inserted into the printed string if
it is preceded and followed by \\% delimiters. All
text found between these delimiters is displayed as
the print string.
This regular expression search never terminates
until a match is explicitly found or rejected. The
special character \n is a valid character in the
patterns. Therefore, the pattern .* should never
be used here. This field contains the string to
print. The string provides information about the
file. The string can include text found in the file
when requested with an appropriate printf() format.
The following is an example of a script: string ^#!{
}*\\%[^ \n]*\\% %s
The following are examples of executable images: >2
short 02 POSIX >2 short 01
SVID >16 long >0 not stripped
The following are examples of text and data files: 0
string ^\01h[0-9][0-9][0-9][0-9][0-9] sccsfile 0
string ^#ifndef c program 0
string ^070707 ASCII cpio
archive
/etc/magic
Commands: file(1) delim off
magic(4)
[ Back ] |
