]>
Commit | Line | Data |
---|---|---|
b06f6b62 JB |
1 | --- file-4.19/magic/Magdir/msdos.orig 2006-11-17 16:56:05.000000000 +0100 |
2 | +++ file-4.19/magic/Magdir/msdos 2006-12-20 19:48:05.070673271 +0100 | |
a1878704 JB |
3 | @@ -5,11 +5,10 @@ |
4 | ||
5 | # .BAT files (Daniel Quinlan, quinlan@yggdrasil.com) | |
6 | # updated by Joerg Jenderek | |
7 | -0 string @ | |
8 | ->1 string/cB \ echo\ off MS-DOS batch file text | |
9 | ->1 string/cB echo\ off MS-DOS batch file text | |
10 | ->1 string/cB rem\ MS-DOS batch file text | |
11 | ->1 string/cB set\ MS-DOS batch file text | |
12 | +0 string/cB @\ echo\ off MS-DOS batch file text | |
13 | +0 string/cB @echo\ off MS-DOS batch file text | |
14 | +0 string/cB @rem\ MS-DOS batch file text | |
15 | +0 string/cB @set\ MS-DOS batch file text | |
16 | ||
17 | ||
18 | # OS/2 batch files are REXX. the second regex is a bit generic, oh well | |
b06f6b62 | 19 | @@ -262,9 +261,9 @@ |
a1878704 JB |
20 | # Uncommenting only the first two lines will cover about 2/3 of COM files, |
21 | # but it isn't feasible to match all COM files since there must be at least | |
22 | # two dozen different one-byte "magics". | |
23 | -0 byte 0xe9 DOS executable (COM) | |
24 | ->0x1FE leshort 0xAA55 \b, boot code | |
25 | ->6 string SFX\ of\ LHarc (%s) | |
26 | +#0 byte 0xe9 | |
27 | +#>0x1FE leshort 0xAA55 DOS executable (COM), boot code | |
28 | +#>6 string SFX\ of\ LHarc DOS executable (COM) (%s) | |
29 | 0 belong 0xffffffff DOS executable (device driver) | |
30 | #CMD640X2.SYS | |
31 | >10 string >\x23 | |
b06f6b62 | 32 | @@ -286,49 +285,48 @@ |
a1878704 JB |
33 | >>77 string >\x40 |
34 | >>>77 string <\x5B | |
35 | >>>>77 string x \b, name: %.8s | |
36 | -0 byte 0x8c DOS executable (COM) | |
37 | # 0xeb conflicts with "sequent" magic | |
38 | -0 byte 0xeb DOS executable (COM) | |
39 | ->0x1FE leshort 0xAA55 \b, boot code | |
40 | ->85 string UPX \b, UPX compressed | |
41 | ->4 string \ $ARX \b, ARX self-extracting archive | |
42 | ->4 string \ $LHarc \b, LHarc self-extracting archive | |
43 | ->0x20e string SFX\ by\ LARC \b, LARC self-extracting archive | |
44 | -0 byte 0xb8 COM executable | |
45 | +#0 byte 0xeb | |
46 | +#>0x1FE leshort 0xAA55 DOS executable (COM), boot code | |
47 | +#>85 string UPX DOS executable (COM), UPX compressed | |
48 | +#>4 string \ $ARX DOS executable (COM), ARX self-extracting archive | |
49 | +#>4 string \ $LHarc DOS executable (COM), LHarc self-extracting archive | |
50 | +#>0x20e string SFX\ by\ LARC DOS executable (COM), LARC self-extracting archive | |
51 | +#0 byte 0xb8 | |
52 | # modified by Joerg Jenderek | |
53 | ->1 lelong !0x21cd4cff for DOS | |
54 | +#>1 lelong !0x21cd4cff COM executale for DOS | |
55 | # http://syslinux.zytor.com/comboot.php | |
56 | # (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode | |
57 | # start with assembler instructions mov eax,21cd4cffh | |
58 | ->1 lelong 0x21cd4cff (32-bit COMBOOT) | |
59 | +#>1 lelong 0x21cd4cff COM executable (32-bit COMBOOT) | |
60 | 0 string \x81\xfc | |
61 | >4 string \x77\x02\xcd\x20\xb9 | |
62 | >>36 string UPX! FREE-DOS executable (COM), UPX compressed | |
63 | 252 string Must\ have\ DOS\ version DR-DOS executable (COM) | |
64 | # GRR search is not working | |
65 | #2 search/28 \xcd\x21 COM executable for MS-DOS | |
66 | -#WHICHFAT.cOM | |
67 | -2 string \xcd\x21 COM executable for DOS | |
68 | -#DELTREE.cOM DELTREE2.cOM | |
69 | -4 string \xcd\x21 COM executable for DOS | |
70 | -#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM | |
71 | -5 string \xcd\x21 COM executable for DOS | |
72 | +##WHICHFAT.cOM | |
73 | +#2 string \xcd\x21 COM executable for DOS | |
74 | +##DELTREE.cOM DELTREE2.cOM | |
75 | +#4 string \xcd\x21 COM executable for DOS | |
76 | +##IFMEMDSK.cOM ASSIGN.cOM COMP.cOM | |
77 | +#5 string \xcd\x21 COM executable for DOS | |
78 | #DELTMP.COm HASFAT32.cOM | |
79 | -7 string \xcd\x21 | |
80 | ->0 byte !0xb8 COM executable for DOS | |
81 | +#7 string \xcd\x21 | |
82 | +#>0 byte !0xb8 COM executable for DOS | |
83 | #COMP.cOM MORE.COm | |
84 | -10 string \xcd\x21 | |
85 | ->5 string !\xcd\x21 COM executable for DOS | |
86 | +#10 string \xcd\x21 | |
87 | +#>5 string !\xcd\x21 COM executable for DOS | |
88 | #comecho.com | |
89 | -13 string \xcd\x21 COM executable for DOS | |
90 | +#13 string \xcd\x21 COM executable for DOS | |
91 | #HELP.COm EDIT.coM | |
92 | -18 string \xcd\x21 COM executable for MS-DOS | |
93 | +#18 string \xcd\x21 COM executable for MS-DOS | |
94 | #NWRPLTRM.COm | |
95 | -23 string \xcd\x21 COM executable for MS-DOS | |
96 | +#23 string \xcd\x21 COM executable for MS-DOS | |
97 | #LOADFIX.cOm LOADFIX.cOm | |
98 | -30 string \xcd\x21 COM executable for MS-DOS | |
99 | +#30 string \xcd\x21 COM executable for MS-DOS | |
100 | #syslinux.com 3.11 | |
101 | -70 string \xcd\x21 COM executable for DOS | |
102 | +#70 string \xcd\x21 COM executable for DOS | |
103 | # many compressed/converted COMs start with a copy loop instead of a jump | |
104 | 0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS | |
105 | 0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS | |
b06f6b62 JB |
106 | @@ -617,5 +615,6 @@ |
107 | 0 lelong 0x02468ace Bochs Sparse disk image | |
108 | ||
109 | # from http://filext.com by Derek M Jones <derek@knosof.co.uk> | |
110 | -0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer | |
111 | +# already noted as "false positive" above - it matches most of XLS/DOC files! | |
112 | +#0 string \xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x3E\x00\x03\x00\xFE\xFF Microsoft Installer | |
113 | 0 string \320\317\021\340\241\261\032\341 Microsoft Office Document |