#------------------------------------------------------------------------------# archive:  file(1) magic for archive formats (see also "msdos" for self-#           extracting compressed archives)## cpio, ar, arc, arj, hpack, lha/lharc, rar, squish, uc2, zip, zoo, etc.# pre-POSIX "tar" archives are handled in the C code.# POSIX tar archives257	string		ustar\0		POSIX tar archive257	string		ustar\040\040\0	GNU tar archive# cpio archives## Yes, the top two "cpio archive" formats *are* supposed to just be "short".# The idea is to indicate archives produced on machines with the same# byte order as the machine running "file" with "cpio archive", and# to indicate archives produced on machines with the opposite byte order# from the machine running "file" with "byte-swapped cpio archive".## The SVR4 "cpio(4)" hints that there are additional formats, but they# are defined as "short"s; I think all the new formats are# character-header formats and thus are strings, not numbers.0	short		070707		cpio archive0	short		0143561		byte-swapped cpio archive0	string		070707		ASCII cpio archive (pre-SVR4 or odc)0	string		070701		ASCII cpio archive (SVR4 with no CRC)0	string		070702		ASCII cpio archive (SVR4 with CRC)# Debian package (needs to go before regular portable archives)#0	string		=!<arch>\ndebian>8	string		debian-split	part of multipart Debian package>8	string		debian-binary	Debian binary package>68	string		>\0		(format %s)# These next two lines do not work, because a bzip2 Debian archive# still uses gzip for the control.tar (first in the archive).  Only# data.tar varies, and the location of its filename varies too.# file/libmagic does not current have support for ascii-string based# (offsets) as of 2005-09-15.#>81	string		bz2		\b, uses bzip2 compression#>84	string		gz		\b, uses gzip compression#>136	ledate		x		created: %s# other archives0	long		0177555		very old archive0	short		0177555		very old PDP-11 archive0	long		0177545		old archive0	short		0177545		old PDP-11 archive0	long		0100554		apl workspace0	string		=<ar>		archive# MIPS archive (needs to go before regular portable archives)#0	string	=!<arch>\n__________E	MIPS archive>20	string	U			with MIPS Ucode members>21	string	L			with MIPSEL members>21	string	B			with MIPSEB members>19	string	L			and an EL hash table>19	string	B			and an EB hash table>22	string	X			-- out of date0	string		-h-		Software Tools format archive text## XXX - why are there multiple <ar> thingies?  Note that 0x213c6172 is# "!<ar", so, for new-style (4.xBSD/SVR2andup) archives, we have:## 0	string		=!<arch>		current ar archive# 0	long		0x213c6172	archive file## and for SVR1 archives, we have:## 0	string		\<ar>		System V Release 1 ar archive# 0	string		=<ar>		archive## XXX - did Aegis really store shared libraries, breakpointed modules,# and absolute code program modules in the same format as new-style# "ar" archives?#0	string		=!<arch>		current ar archive>8	string		__.SYMDEF	random library>0	belong		=65538		- pre SR9.5>0	belong		=65539		- post SR9.5>0	beshort		2		- object archive>0	beshort		3		- shared library module>0	beshort		4		- debug break-pointed module>0	beshort		5		- absolute code program module0	string		\<ar>		System V Release 1 ar archive0	string		=<ar>		archive## XXX - from "vax", which appears to collect a bunch of byte-swapped# thingies, to help you recognize VAX files on big-endian machines;# with "leshort", "lelong", and "string", that's no longer necessary....#0	belong		0x65ff0000	VAX 3.0 archive0	belong		0x3c61723e	VAX 5.0 archive#0	long		0x213c6172	archive file0	lelong		0177555		very old VAX archive0	leshort		0177555		very old PDP-11 archive## XXX - "pdp" claims that 0177545 can have an __.SYMDEF member and thus# be a random library (it said 0xff65 rather than 0177545).#0	lelong		0177545		old VAX archive>8	string		__.SYMDEF	random library0	leshort		0177545		old PDP-11 archive>8	string		__.SYMDEF	random library## From "pdp" (but why a 4-byte quantity?)#0	lelong		0x39bed		PDP-11 old archive0	lelong		0x39bee		PDP-11 4.0 archive# ARC archiver, from Daniel Quinlan (quinlan@yggdrasil.com)## The first byte is the magic (0x1a), byte 2 is the compression type for# the first file (0x01 through 0x09), and bytes 3 to 15 are the MS-DOS# filename of the first file (null terminated).  Since some types collide# we only test some types on basis of frequency: 0x08 (83%), 0x09 (5%),# 0x02 (5%), 0x03 (3%), 0x04 (2%), 0x06 (2%).  0x01 collides with terminfo.0	lelong&0x8080ffff	0x0000081a	ARC archive data, dynamic LZW0	lelong&0x8080ffff	0x0000091a	ARC archive data, squashed0	lelong&0x8080ffff	0x0000021a	ARC archive data, uncompressed0	lelong&0x8080ffff	0x0000031a	ARC archive data, packed0	lelong&0x8080ffff	0x0000041a	ARC archive data, squeezed0	lelong&0x8080ffff	0x0000061a	ARC archive data, crunched# [JW] stuff taken from idarc, obviously ARC successors:0	lelong&0x8080ffff	0x00000a1a	PAK archive data0	lelong&0x8080ffff	0x0000141a	ARC+ archive data0	lelong&0x8080ffff	0x0000481a	HYP archive data# Acorn archive formats (Disaster prone simpleton, m91dps@ecs.ox.ac.uk)# I can't create either SPARK or ArcFS archives so I have not tested this stuff# [GRR:  the original entries collide with ARC, above; replaced with combined#  version (not tested)]#0	byte		0x1a		RISC OS archive (spark format)0	string		\032archive	RISC OS archive (ArcFS format)0       string          Archive\000     RISC OS archive (ArcFS format)# All these were taken from idarc, many could not be verified. Unfortunately,# there were many low-quality sigs, i.e. easy to trigger false positives.# Please notify me of any real-world fishy/ambiguous signatures and I'll try# to get my hands on the actual archiver and see if I find something better. [JW]# probably many can be enhanced by finding some 0-byte or control char near the start# idarc calls this Crush/Uncompressed... *shrug*0	string	CRUSH Crush archive data# Squeeze It (.sqz)0	string	HLSQZ Squeeze It archive data# SQWEZ0	string	SQWEZ SQWEZ archive data# HPack (.hpk)0	string	HPAK HPack archive data# HAP0	string	\x91\x33HF HAP archive data# MD/MDCD0	string	MDmd MDCD archive data# LIM0	string	LIM\x1a LIM archive data# SAR3	string	LH5 SAR archive data# BSArc/BS20	string	\212\3SB \0 BSArc/BS2 archive data# MAR2	string	=-ah MAR archive data# ACB0	belong&0x00f800ff	0x00800000 ACB archive data# CPZ# TODO, this is what idarc says: 0	string	\0\0\0 CPZ archive data# JRC0	string	JRchive JRC archive data# Quantum0	string	DS\0 Quantum archive data# ReSOF0	string	PK\3\6 ReSOF archive data# QuArk0	string	7\4 QuArk archive data# YAC14	string	YC YAC archive data# X10	string	X1 X1 archive data0	string	XhDr X1 archive data# CDC Codec (.dqt)0	belong&0xffffe000	0x76ff2000 CDC Codec archive data# AMGC0	string	\xad6" AMGC archive data# NuLIB0	string	N?Fél? NuLIB archive data# PakLeo0	string	LEOLZW PAKLeo archive data# ChArc0	string	SChF ChArc archive data# PSA0	string	PSA PSA archive data# CrossePAC0	string	DSIGDCC CrossePAC archive data# Freeze0	string	\x1f\x9f\x4a\x10\x0a Freeze archive data# KBoom0	string	¨MP¨ KBoom archive data# NSQ, must go after CDC Codec0	string	\x76\xff NSQ archive data# DPA0	string	Dirk\ Paehl DPA archive data# BA# TODO: idarc says "bytes 0-2 == bytes 3-5"# TTComp0	string	\0\6 TTComp archive data# ESP, could this conflict with Easy Software Products' (e.g.ESP ghostscript) documentation?0	string	ESP ESP archive data# ZPack0	string	\1ZPK\1 ZPack archive data# Sky0	string	\xbc\x40 Sky archive data# UFA0	string	UFA UFA archive data# Dry0	string	=-H2O DRY archive data# FoxSQZ0	string	FOXSQZ FoxSQZ archive data# AR70	string	,AR7 AR7 archive data# PPMZ0	string	PPMZ PPMZ archive data# MS Compress4	string	\x88\xf0\x27 MS Compress archive data# updated by Joerg Jenderek>9	string	\0		>>0	string	KWAJ		>>>7	string	\321\003	MS Compress archive data>>>>14	ulong	>0		\b, original size: %ld bytes>>>>18		ubyte	>0x65  	>>>>>18		string	x    	\b, was %.8s>>>>>(10.b-4)	string	x    	\b.%.3s# MP3 (archiver, not lossy audio compression)0	string	MP3\x1a MP3-Archiver archive data# ZET0	string	OZY ZET archive data# TSComp0	string	\x65\x5d\x13\x8c\x08\x01\x03\x00 TSComp archive data# ARQ0	string	gW\4\1 ARQ archive data# Squash3	string	OctSqu Squash archive data# Terse0	string	\5\1\1\0 Terse archive data# PUCrunch0	string	\x01\x08\x0b\x08\xef\x00\x9e\x32\x30\x36\x31 PUCrunch archive data# UHarc0	string	UHA UHarc archive data# ABComp0	string	\2AB ABComp archive data0	string	\3AB2 ABComp archive data# CMP0	string	CO\0 CMP archive data# Splint0	string	\x93\xb9\x06 Splint archive data# InstallShield0	string	 \x13\x5d\x65\x8c InstallShield Z archive Data# Gather1	string	GTH Gather archive data# BOA0	string	BOA BOA archive data# RAX0	string	ULEB\xa RAX archive data# Xtreme0	string	ULEB\0 Xtreme archive data# Pack Magic0	string	@a\1\0 Pack Magic archive data# BTS0	belong&0xfeffffff	0x1a034465 BTS archive data# ELI 57500	string	Ora\  ELI 5750 archive data# QFC0	string	\x1aFC\x1a QFC archive data0	string	\x1aQF\x1a QFC archive data# PRO-PACK0	string	RNC PRO-PACK archive data# 7770	string	777 777 archive data# LZS2210	string	sTaC LZS221 archive data# HPA0	string	HPA HPA archive data# Arhangel0	string	LG Arhangel archive data# EXP1, uses bzip20	string	0123456789012345BZh EXP1 archive data# IMP0	string	IMP\xa IMP archive data# NRV0	string	\x00\x9E\x6E\x72\x76\xFF NRV archive data# Squish0	string	\x73\xb2\x90\xf4 Squish archive data# Par0	string	PHILIPP Par archive data0	string	PAR Par archive data# HIT0	string	UB HIT archive data# SBX0	belong&0xfffff000	0x53423000 SBX archive data# NaShrink0	string	NSK NaShrink archive data# SAPCAR0	string	#\ CAR\ archive\ header SAPCAR archive data0	string	CAR\ 2.00RG SAPCAR archive data# Disintegrator0	string	DST Disintegrator archive data# ASD0	string	ASD ASD archive data# InstallShield CAB0	string	ISc( InstallShield CAB# TOP40	string	T4\x1a TOP4 archive data# BatComp left out: sig looks like COM executable# so TODO: get real 4dos batcomp file and find sig# BlakHole0	string	BH\5\7 BlakHole archive data# BIX0	string	BIX0 BIX archive data# ChiefLZA0	string	ChfLZ ChiefLZA archive data# Blink0	string	Blink Blink archive data# Logitech Compress0	string	\xda\xfa Logitech Compress archive data# ARS-Sfx (FIXME: really a SFX? then goto COM/EXE)1	string	(C)\ STEPANYUK ARS-Sfx archive data# AKT/AKT320	string	AKT32 AKT32 archive data0	string	AKT AKT archive data# NPack0	string	MSTSM NPack archive data# PFT0	string	\0\x50\0\x14 PFT archive data# SemOne0	string	SEM SemOne archive data# PPMD0	string	\x8f\xaf\xac\x84 PPMD archive data# FIZ0	string	FIZ FIZ archive data# MSXiE0	belong&0xfffff0f0	0x4d530000 MSXiE archive data# DeepFreezer0	belong&0xfffffff0	0x797a3030 DeepFreezer archive data# DC0	string	=<DC- DC archive data# TPac0	string	\4TPAC\3 TPac archive data# Ai0	string	Ai\1\1\0 Ai archive data0	string	Ai\1\0\0 Ai archive data# Ai320	string	Ai\2\0 Ai32 archive data0	string	Ai\2\1 Ai32 archive data# SBC0	string	SBC SBC archive data# Ybs0	string	YBS Ybs archive data# DitPack0	string	\x9e\0\0 DitPack archive data# DMS0	string	DMS! DMS archive data# EPC0	string	\x8f\xaf\xac\x8c EPC archive data