#------------------------------------------------------------------------------# linux:  file(1) magic for Linux files## Values for Linux/i386 binaries, from Daniel Quinlan <quinlan@yggdrasil.com># The following basic Linux magic is useful for reference, but using# "long" magic is a better practice in order to avoid collisions.## 2	leshort		100		Linux/i386# >0	leshort		0407		impure executable (OMAGIC)# >0	leshort		0410		pure executable (NMAGIC)# >0	leshort		0413		demand-paged executable (ZMAGIC)# >0	leshort		0314		demand-paged executable (QMAGIC)#0	lelong		0x00640107	Linux/i386 impure executable (OMAGIC)>16	lelong		0		\b, stripped0	lelong		0x00640108	Linux/i386 pure executable (NMAGIC)>16	lelong		0		\b, stripped0	lelong		0x0064010b	Linux/i386 demand-paged executable (ZMAGIC)>16	lelong		0		\b, stripped0	lelong		0x006400cc	Linux/i386 demand-paged executable (QMAGIC)>16	lelong		0		\b, stripped#0	string		\007\001\000	Linux/i386 object file>20	lelong		>0x1020		\b, DLL library# Linux-8086 stuff:0	string		\01\03\020\04	Linux-8086 impure executable>28	long		!0		not stripped0	string		\01\03\040\04	Linux-8086 executable>28	long		!0		not stripped#0	string		\243\206\001\0	Linux-8086 object file#0	string		\01\03\020\20	Minix-386 impure executable>28	long		!0		not stripped0	string		\01\03\040\20	Minix-386 executable>28	long		!0		not stripped# core dump file, from Bill Reynolds <bill@goshawk.lanl.gov>216	lelong		0421		Linux/i386 core file>220	string		>\0		of '%s'>200	lelong		>0		(signal %d)## LILO boot/chain loaders, from Daniel Quinlan <quinlan@yggdrasil.com># this can be overridden by the DOS executable (COM) entry2	string		LILO		Linux/i386 LILO boot/chain loader## Debian Packages, from Peter Tobias <tobias@server.et-inf.fho-emden.de>0	string		0.9>8	byte		0x0a		old Debian Binary Package>>3	byte		>0		\b, created by dpkg 0.9%c>>4	byte		>0		pl%c# PSF fonts, from H. Peter Anvin <hpa@yggdrasil.com>0	leshort		0x0436		Linux/i386 PC Screen Font data,>2	byte		0		256 characters, no directory,>2	byte		1		512 characters, no directory,>2	byte		2		256 characters, Unicode directory,>2	byte		3		512 characters, Unicode directory,>3	byte		>0		8x%d# Linux swap file, from Daniel Quinlan <quinlan@yggdrasil.com>4086	string		SWAP-SPACE	Linux/i386 swap file# ECOFF magic for OSF/1 and Linux (only tested under Linux though)##	from Erik Troan (ewt@redhat.com) examining od dumps, so this#		could be wrong#      updated by David Mosberger (davidm@azstarnet.com) based on#      GNU BFD and MIPS info found below.#0	leshort		0x0183		ECOFF alpha>24	leshort		0407		executable>24	leshort		0410		pure>24	leshort		0413		demand paged>8	long		>0		not stripped>8	long		0		stripped>23	leshort		>0		- version %ld.## Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu># and others such as Axel Kohlmeyer <akohlmey@rincewind.chemie.uni-ulm.de># and Nicol醩 Lichtmaier <nick@debian.org># All known start with: b8 c0 07 8e d8 b8 00 90 8e c0 b9 00 01 29 f6 29514		string	HdrS		Linux kernel>518		leshort	>0>>529		byte	0		zImage data,>>529		byte	1		bzImage data,>0x048c		byte	0x31>>0x048c	string	x		version %s>0x0493		byte	0x31>>0x0493	string	x		version %s>0x048c		byte	0x32>>0x048c	string	x		version %s>0x0493		byte	0x32>>0x0493	string	x		version %s>0x04df		byte	0x32>>0x04df	string	x		version %s>0x04fb		byte	0x32>>0x04fb	string	x		version %s# This also matches new kernels, which were caught above by "HdrS".0		belong	0xb8c0078e	Linux kernel>0x1e3		string	Loading		version 1.3.79 or older>0x1e9		string	Loading		from prehistoric times# LSM entries - Nicol醩 Lichtmaier <nick@feedback.net.ar>0	string	Begin3	Linux Software Map entry text