magic(4) Kernel Interfaces Manual magic(4)
NAME
magic - Magic file for the file command
SYNOPSIS
/etc/magic
DESCRIPTION
The magic file is used by the file command to identify files that have some sort of magic number. A magic number is any numeric or string
constant that identifies the file containing the constant.
The format for the magic file is as follows:
offset type operator,value string
The fields should be separated by tabs. Each record must be contained on one line.
The fields contain the following data: This field contains the number of bytes from the beginning of the file on which you are running the
file command to the first byte of the magic number of character string you want to identify. Use a right angle bracket (>) to indicate a
continuation line that supplies additional information describing the file. This field contains information about the data type of the
magic number or character string at the specified byte offset. Valid data types for this field are: Unsigned character type Unsigned short
type Long type Character (byte) string This field contains instructions for the file command on how to compare the value read from the file
being checked with the value stored in the Value Type field of the magic file. The valid comparison operators are: The two values are
equal. The value in the file being checked is greater than the value in the magic file. The value in the file being checked is less than
the value in the magic file. All the bits in the magic file value must be set in the value from the file being checked.
Note that the Comparison Operator field is optional. If you do not specify the operator, the values are expected to be equal. This
field contains the value used to compare what is read from the file being checked by the file command. You can use decimal, hex, or
octal numbers in this field or character strings in the form of regular expressions.
Precede all hex numbers with the characters zero and x (for example, 0x80). To specify an octal number, precede it with a zero (for
example, 0200). Decimal numbers require no special representation and should be written as integers (for example, 128).
The rules for specifying character strings follow those of the ed editor (see ed(1)) for regular expressions, with two extensions:
You use the backslash () to escape an unprintable character. The string can contain all special character such as
, ,
, and
f. If a backslash appears in the string, it must be escaped with a second backslash (\). You can use octal representation to
specify any byte value other than zero (0). Text found in the file can be inserted into the printed string if it is preceded and
followed by \% delimiters. All text found between these delimiters is displayed as the print string.
This regular expression search never terminates until a match is explicitly found or rejected. The special character
is a valid
character in the patterns. Therefore, the pattern .* should never be used here. This field contains the string to print. The
string provides information about the file. The string can include text found in the file when requested with an appropriate
printf() format.
EXAMPLES
The following is an example of a script: string ^#!{ }*\%[^
]*\% %s
The following are examples of executable images: >2 short 02 POSIX >2 short 01 SVID
>16 long >0 not stripped
The following are examples of text and data files: 0 string ^ 1h[0-9][0-9][0-9][0-9][0-9] sccsfile 0 string ^#ifndef
c program 0 string ^070707 ASCII cpio archive
FILES
/etc/magic
RELATED INFORMATION
Commands: file(1) delim off
magic(4)