magic(5)magic(5)Namemagic - magic file for the file command
Syntax
/usr/lib/file/magic
Description
The magic file is used by the command to identify files that have some
sort of magic number. A magic number is any numeric or string constant
that identifies the file containing the constant.
The file is formatted as follows:
Byte offset
The byte offset is where information is found in the file. This is
the number of bytes from the beginning of the file to the first
byte of the magic number or string. This may, optionally, be pre‐
ceded by a right angle bracket (>) to indicate a continuation line
to supply extra information in the printed message.
Value type
The value type is the type of the information to be found at the
specified byte offset. The file data is interpreted as the fol‐
lowing valid types:
byte Unsigned char type
short Unsigned short type
long Long type
string Character (byte) string
Optional operator
Describes how the value specified here should be compared with the
data at the desired offset. Valid operator characters are: an
equal sign, a right angle bracket, and a left angle bracket (=, >,
<). If none is specified, = is assumed.
Value
The value to match. Numeric values may be decimal, octal, or hexa‐
decimal. String values are defined as regular expressions here.
The regular expressions used here are extended in two ways from
regular expression definition in ed(1).
1. Normally unprintable characters may be escaped with a
backslash (\). The special characters \n, \b, \r, and \f
are allowed. An octal representation can also be used to
insert any desired byte value, except 0. Normally, regu‐
lar expression cannot handle such character values.
Because the backslash is used as an escape character
while the regular expression is being read in, normal
occurrences of a backslash in a regular expression must
be escaped with a second backslash. As an example, \(
must be written as \\( and \. must be written as \\.
2. Text found in a file can also be inserted in the printed
string with the use of the \\% delimiter. All text found
between these delimiters is substituted into the print
string.
This regular expression search never terminates until a
match is explicitly found or rejected. The special char‐
acter \n is a valid character in the patterns. There‐
fore, the pattern .* should never be used here.
major, minor type
The major and minor file type numbers are not used by the command.
String to print
Any desired text string. Data from the file can be included with
the use of continuation lines beginning with a right angle bracket
(>). Two types of continuation lines are possible, depending on
the sign of the byte offset entry.
If the byte offset is positive, the specified data can be printed
in the string when requested with an appropriate format.
If the offset is a negative number, an internal routine will be
called to test if a particular string is necessary and, if so, to
return it.
The byte offset number is an index to an internal table of rou‐
tines available for use. Two such routines are currently defined,
both for a.out images:
Byte Offset Returned String(s)
-1: ["old version 7 style symbol table"]
-2: ["setuid "]["setgid "]["sticky "]
Examples
The following is an example of a script. The second line adds setuid,
setgid text, if appropriate:
0 string ^#![ ]*\%[^ 0*\% 7,4 %s
>-2 long 0 7,4 %sscript
The following is an example of an executable image:
>-1 long 0 12,3 %s
0 short 0413 12,4 demand paged pure
>2 short 02 12,4 POSIX
>2 short 01 12,4 SVID
>-2 long 0 12,4 %sexecutable
>16 long >0 12,4 not stripped
The following is an example of a text file:
0 string ^ 1h[0-9][0-9][0-9][0-9][0-9] 7,1 sccsfile
FilesSee Alsofile(1)magic(5)