MAGIC(5) MAGIC(5) (NAME) magic - file (DESCRIPTION) (magic files) file . file(1) << >> (magic patterns) . << >> /usr/share/misc/magic.mgc /usr/share/misc/magic . MIME . : . . . : offset ( ) . : o ( ) . (file descriptor) (regular file) . o (&). type . : byte . short (native byte order). long . quad . float IEEE . double IEEE . string . string /width /[bCcftTtWw]* . (width) . . : b (). C : . c : . c C . f . T (Trim) . t . W . n n . w . pstring (Pascal- style string) /short/int . . : B (). H (big- endian). h (little- endian). L (big- endian). l (little- endian). J . NUL . J I JPEG . date (UNIX date) . qdate . ldate UTC . qldate UTC . qwdate (Windows-style date) . beid3 ID3 (big-endian). beshort (big-endian). belong (big- endian). bequad (big-endian). befloat IEEE . bedouble IEEE . bedate . beqdate . beldate UTC. beqldate UTC. beqwdate . bestring16 (UCS16) . leid3 ID3 (little- endian). leshort (little- endian). lelong (little- endian). lequad (little- endian). lefloat IEEE . ledouble IEEE . ledate . leqdate . leldate UTC. leqldate UTC. leqwdate . lestring16 (UCS16) . melong (middle-endian PDP-11). medate (PDP-11) . meldate (PDP-11) UTC. indirect . indirect /r . name <<>> (named magic) (subroutine) use . . . use . ^ (endianness) leshort beshort . . regex POSIX ( egrep). . . /length . /[c][s][l] . c s . l . . . 8KiB . ^ $ . search . . /number . \ . . default x ( ) . . clear . clear . default . der DER. der . DER : eoc bool int bit_str octet_str null obj_id obj_desc ext real enum embed utf8_str rel_oid time res2 seq set num_str prt_str t61_str vid_str ia5_str utc_time gen_time gr_str vis_str gen_str univ_str char_str bmp_str date tod datetime duration oid-iri rel-oid-iri. . guid (Globally Unique Identifier) XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX . . offset quad ( ) . . : -0 offset x this file is %lld bytes -0 offset <=100 must be more than 100 \ bytes and is only %lld octal (octal) . Single UNIX Standard dC d1 byte uC u1 ubyte dS d2 short uS u2 ushort dI dL d4 long uI uL u4 ulong d8 quad u8 uquad s string . dQ quad uQ uquad . ( ) () . regex search . . . . & AND . u (unsigned) . test . C C ( \n ) . : = . < . > . & () . ^ () . ~ ( ) . x . = . & ^ ~ (float double) . ! C 13 (decimal) 013 (octal) 0x13 (hexadecimal) . . . = < > ( &) . . ( ) >\0 ( ). . x (true) . message . printf(3) ( ) . \b : . + (APPLE creator and type) : !:apple CREATYPE MIME magic : !:mime MIMETYPE !:mime MIME . (strength) : !:strength OP VALUE OP + - * / VALUE 0 255 . . . > . > > . : n n+1 n ( ) . <</>> : 0 string MZ >0x18 leshort <0x40 MS-DOS executable >0x18 leshort >0x3f extended PC executable (e.g., MS Windows) . > ( . . . : (( x [[.,][bBcCeEfFgGhHiIlmsSqQ]][+-][ y ]) x . [bBcCeEfFgGhHiIlmsSqQ] id3 short long . , (signed) . (unsigned) . (big-endian) (little-endian) m (middle-endian PDP-11) . y . long . : (Type) (Mnemonic) (Endian) (Size) bcBc Byte/Char N/A 1 efg Double Little 8 EFG Double Big 8 hs Half/Short Little 2 HS Half/Short Big 2 i ID3 Little 4 I ID3 Big 4 m Middle Middle 4 o Octal Textual q Quad Little 8 Q Quad Big 8 : # 0 string MZ >0x18 leshort <0x40 MZ executable (MS-DOS) # >0x18 leshort >0x3f >>(0x3c.l) string PE\0\0 PE executable (MS-Windows) >>(0x3c.l) string LX\0\0 LX executable (OS/2) : ( PE\0\0 LE\0\0 ). : [+-*/%&|^]number : # 0 string MZ # 0x18 0x40 # >0x18 leshort <0x40 >>(4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP) >>(4.s*512) leshort !0x014c MZ executable (MS-DOS) ( ) . & : 0 string MZ >0x18 leshort >0x3f >>(0x3c.l) string PE\0\0 PE executable (MS-Windows) # PE >>>&0 leshort 0x14c for Intel 80386 >>>&0 leshort 0x184 for DEC Alpha : 0 string MZ >0x18 leshort <0x40 >>(4.s*512) leshort !0x014c MZ executable (MS-DOS) # COFF # # >>>&(2.s-514) string LE LE executable (MS Windows VxD driver) : 0 string MZ >0x18 leshort >0x3f >>(0x3c.l) string LE\0\0 LE executable (MS-Windows) # 0x80 ( # ) LE # >>>(&0x7c.l+0x26) string UPX \b, UPX compressed ! 0 string MZ >0x18 leshort >0x3f >>(0x3c.l) string LE\0\0 LE executable (MS-Windows) # 0x58 LE # >>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive / . . 0 string MZ >0x18 leshort >0x3f >>(0x3c.l) string PE\0\0 PE executable (MS-Windows) # PE ".idata"... >>>&0xf4 search/0x140 .idata # ... + # >>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive switch : # >18 clear >18 lelong 1 one >18 lelong 2 two >18 default x # >>18 lelong x unmatched 0x%x (SEE ALSO) file(1) - . (BUGS) long belong lelong melong short beshort leshort C short long Single UNIX Specification . OS X Mountain Lion Single UNIX Specification file(1) C long long C long . int8 uint8 int16 uint16 int32 uint32 int64 uint64 . file MAGIC(5)