magic(5) File Formats Manual magic(5)
Name
magic - magic file for the file command
Syntax
/usr/lib/file/magic
Description
The magic file is used by the command to identify files that have some sort of magic number. A magic number is any numeric or string con-
stant that identifies the file containing the constant.
The file is formatted as follows:
Byte offset
The byte offset is where information is found in the file. This is the number of bytes from the beginning of the file to the first
byte of the magic number or string. This may, optionally, be preceded by a right angle bracket (>) to indicate a continuation line to
supply extra information in the printed message.
Value type
The value type is the type of the information to be found at the specified byte offset. The file data is interpreted as the following
valid types:
byte Unsigned char type
short Unsigned short type
long Long type
string Character (byte) string
Optional operator
Describes how the value specified here should be compared with the data at the desired offset. Valid operator characters are: an
equal sign, a right angle bracket, and a left angle bracket (=, >, <). If none is specified, = is assumed.
Value
The value to match. Numeric values may be decimal, octal, or hexadecimal. String values are defined as regular expressions here. The
regular expressions used here are extended in two ways from regular expression definition in ed(1).
1. Normally unprintable characters may be escaped with a backslash (). The special characters
, ,
, and f are allowed.
An octal representation can also be used to insert any desired byte value, except 0. Normally, regular expression cannot
handle such character values. Because the backslash is used as an escape character while the regular expression is being
read in, normal occurrences of a backslash in a regular expression must be escaped with a second backslash. As an example, (
must be written as \( and . must be written as \.
2. Text found in a file can also be inserted in the printed string with the use of the \% delimiter. All text found between
these delimiters is substituted into the print string.
This regular expression search never terminates until a match is explicitly found or rejected. The special character
is a
valid character in the patterns. Therefore, the pattern .* should never be used here.
major, minor type
The major and minor file type numbers are not used by the command.
String to print
Any desired text string. Data from the file can be included with the use of continuation lines beginning with a right angle bracket
(>). Two types of continuation lines are possible, depending on the sign of the byte offset entry.
If the byte offset is positive, the specified data can be printed in the string when requested with an appropriate format.
If the offset is a negative number, an internal routine will be called to test if a particular string is necessary and, if so, to
return it.
The byte offset number is an index to an internal table of routines available for use. Two such routines are currently defined, both
for a.out images:
Byte Offset Returned String(s)
-1: ["old version 7 style symbol table"]
-2: ["setuid "]["setgid "]["sticky "]
Examples
The following is an example of a script. The second line adds setuid, setgid text, if appropriate:
0 string ^#![ ]*\%[^ 0*\% 7,4 %s
>-2 long 0 7,4 %sscript
The following is an example of an executable image:
>-1 long 0 12,3 %s
0 short 0413 12,4 demand paged pure
>2 short 02 12,4 POSIX
>2 short 01 12,4 SVID
>-2 long 0 12,4 %sexecutable
>16 long >0 12,4 not stripped
The following is an example of a text file:
0 string ^ 1h[0-9][0-9][0-9][0-9][0-9] 7,1 sccsfile
Files
See Also
file(1)
magic(5)