1N/A.fp 5 CW
1N/A.de Af
1N/A.ds ;G \\*(;G\\f\\$1\\$3\\f\\$2
1N/A.if !\\$4 .Af \\$2 \\$1 "\\$4" "\\$5" "\\$6" "\\$7" "\\$8" "\\$9"
1N/A..
1N/A.de aF
1N/A.ie \\$3 .ft \\$1
1N/A.el \{\
1N/A.ds ;G \&
1N/A.nr ;G \\n(.f
1N/A.Af "\\$1" "\\$2" "\\$3" "\\$4" "\\$5" "\\$6" "\\$7" "\\$8" "\\$9"
1N/A\\*(;G
1N/A.ft \\n(;G \}
1N/A..
1N/A.de L
1N/A.aF 5 \\n(.f "\\$1" "\\$2" "\\$3" "\\$4" "\\$5" "\\$6" "\\$7"
1N/A..
1N/A.de LR
1N/A.aF 5 1 "\\$1" "\\$2" "\\$3" "\\$4" "\\$5" "\\$6" "\\$7"
1N/A..
1N/A.de RL
1N/A.aF 1 5 "\\$1" "\\$2" "\\$3" "\\$4" "\\$5" "\\$6" "\\$7"
1N/A..
1N/A.de EX \" start example
1N/A.ta 1i 2i 3i 4i 5i 6i
1N/A.PP
1N/A.RS
1N/A.PD 0
1N/A.ft 5
1N/A.nf
1N/A..
1N/A.de EE \" end example
1N/A.fi
1N/A.ft
1N/A.PD
1N/A.RE
1N/A.PP
1N/A..
1N/A.TH MAGIC 3
1N/A.SH NAME
1N/Amagic \- magic file interface
1N/A.SH SYNOPSIS
1N/A.EX
1N/A#include <magic.h>
1N/A
1N/AMagic_t
1N/A{
1N/A unsigned long flags;
1N/A};
1N/A
1N/AMagic_t* magicopen(unsigned long \fIflags\fP);
1N/Avoid magicclose(Magic_t* \fImagic\fP);
1N/A
1N/Aint magicload(Magic_t* \fImagic\fP, const char* \fIpath\fP, unsigned long \fIflags\fP);
1N/Aint magiclist(Magic_t* \fImagic\fP, Sfio_t* \fIsp\fP);
1N/A
1N/Achar* magictype(Magic_t* \fImagic\fP, const char* \fIpath\fP, struct stat* \fIst\fP);
1N/A.EE
1N/A.SH DESCRIPTION
1N/AThese routines provide an interface to the
1N/A.IR file (1)
1N/Acommand magic file.
1N/A.L magicopen
1N/Areturns a magic session handle that is passed to all of the other routines.
1N/A.I flags
1N/Amay be
1N/A.TP
1N/A.L MAGIC_MIME
1N/AReturn the MIME type string rather than the magic file description.
1N/A.TP
1N/A.L MAGIC_PHYSICAL
1N/ADon't follow symbolic links.
1N/A.TP
1N/A.L MAGIC_STAT
1N/AThe stat structure
1N/A.I st
1N/Apassed to
1N/A.I magictype
1N/Awill contain valid
1N/A.I stat (2)
1N/Ainformation.
1N/ASee
1N/A.L magictype
1N/Abelow.
1N/A.TP
1N/A.L MAGIC_VERBOSE
1N/AEnable verbose error messages.
1N/A.PP
1N/A.L magicclose
1N/Acloses the magic session.
1N/A.PP
1N/A.L magicload
1N/Aloads the magic file named by
1N/A.I path
1N/Ainto the magic session.
1N/A.I flags
1N/Aare the same as with
1N/A.LR magicopen .
1N/AMore than one magic file can be loaded into a session;
1N/Athe files are searched in load order.
1N/AIf
1N/A.I path
1N/Ais
1N/A.L 0
1N/Athen the default magic file is loaded.
1N/A.PP
1N/A.L magiclist
1N/Alists the magic file contents on the
1N/A.IR sfio (3)
1N/Astream
1N/A.IR sp .
1N/AThis is used for debugging magic entries.
1N/A.PP
1N/A.L magictype
1N/Areturns the type string for
1N/A.I path
1N/Awith optional
1N/A.IR stat (2)
1N/Ainformation
1N/A.IR st .
1N/AIf
1N/A.I "st == 0"
1N/Athen
1N/A.L magictype
1N/Acalls
1N/A.L stat
1N/Aon a private stat buffer,
1N/Aelse if
1N/A.L magicopen
1N/Awas called with the
1N/A.L MAGIC_STAT
1N/Aflag then
1N/A.I st
1N/Ais assumed to contain valid stat information, otherwise
1N/A.L magictype
1N/Acalls
1N/A.L stat
1N/Aon
1N/A.IR st .
1N/A.L magictype
1N/Aalways returns a non-null string.
1N/AIf errors are encounterd on
1N/A.I path
1N/Athen the return value will contain information on those errors, e.g.,
1N/A.LR "cannot stat" .
1N/A.SH FORMAT
1N/AThe magic file format is a backwards compatible extension of an
1N/Aancient System V file implementation.
1N/AHowever, with the extended format it is possible to write a single
1N/Amagic file that works on all platforms.
1N/AMost of the net magic files floating around work with
1N/A.LR magic ,
1N/Abut they usually double up on
1N/A.I le
1N/Aand
1N/A.I be
1N/Aentries that are automatically handled by
1N/A.LR magic .
1N/A.PP
1N/AA magic file entry describes a procedure for determining a single file type
1N/Abased on the file pathname,
1N/A.I stat (2)
1N/Ainformation, and the file data.
1N/AAn entry is a sequence of lines, each line being a record of
1N/A.I space
1N/Aseparated fields.
1N/AThe general record format is:
1N/A.EX
1N/A[op]offset type [mask]expression description [mimetype]
1N/A.EE
1N/A.L #
1N/Ain the first column introduces a comment.
1N/AThe first record in an entry contains no
1N/A.LR op ;
1N/Athe remaining records for an entry contain an
1N/A.LR op .
1N/AInteger constants are as in C:
1N/A.L 0x*
1N/Aor
1N/A.L 0X*
1N/Afor hexadecimal,
1N/A.L 0*
1N/Afor octal and decimal otherwise.
1N/A.PP
1N/AThe
1N/A.L op
1N/Afield may be one of:
1N/A.TP
1N/A.L +
1N/AThe previous records must match but the current record is optional.
1N/A.L >
1N/Ais an old-style synonym for
1N/A.LR + .
1N/A.TP
1N/A.L &
1N/AThe previous and current records must match.
1N/A.TP
1N/A.L {
1N/AStarts a nesting block that is terminated by
1N/A.LR } .
1N/AA nesting block pushes a new context for the
1N/A.L +
1N/Aand
1N/A.L &
1N/Aops.
1N/AThe
1N/A.L {
1N/Aand
1N/A.L }
1N/Arecords have no other fields.
1N/A.TP
1N/A\fIid\f5{\fR
1N/AA function declaration and call for the single character identifier
1N/A.IR id .
1N/AThe function return is a nesting block end record
1N/A.LR } .
1N/AFunction may be redefined.
1N/AFunctions have no arguments or return value.
1N/A.TP
1N/A\fIid\f5()\fR
1N/AA call to the function
1N/A.IR id .
1N/A.PP
1N/AThe
1N/A.L offset
1N/Afield is either the offset into the data upon which the current entry operates
1N/Aor a file metadata identifier.
1N/AOffsets are either integer constants or offset expressions.
1N/AAn offset expression is contained in (...) and is a combination of
1N/Aintegral arithmetic operators and the
1N/A.L @
1N/Aindirection operator.
1N/AIndirections take the form
1N/A.LI @ integer
1N/Awhere integer is the data offset for the indirection value.
1N/AThe size of the indirection value is taken either from one of the suffixes
1N/A.LR B (byte, 1 char),
1N/A.LR H (short, 2 chars),
1N/A.LR L (long, 4 chars),
1N/Apr
1N/A.LR Q (quead, 8 chars),
1N/Aor from the
1N/A.L type
1N/Afield.
1N/AValid file metadata identifiers are:
1N/A.TP
1N/A.L atime
1N/AThe string representation of
1N/A.LR stat.st_atime .
1N/A.TP
1N/A.L blocks
1N/A.LR stat.st_blocks .
1N/A.TP
1N/A.L ctime
1N/AThe string representation of
1N/A.LR stat.st_ctime .
1N/A.TP
1N/A.L fstype
1N/AThe string representation of
1N/A.LR stat.st_fstype .
1N/A.TP
1N/A.L gid
1N/AThe string representation of
1N/A.LR stat.st_gid .
1N/A.TP
1N/AThe
1N/A.L stat.st_mode
1N/Afile mode bits in
1N/A.IR modecanon (3)
1N/Acanonical representation (i.e., the good old octal values).
1N/A.TP
1N/A.L mtime
1N/AThe string representation of
1N/A.LR stat.st_mtime .
1N/A.TP
1N/A.L nlink
1N/A.LR stat.st_nlink .
1N/A.TP
1N/A.L size
1N/A.LR stat.st_size .
1N/A.TP
1N/A.L name
1N/AThe file path name sans directory.
1N/A.TP
1N/A.L uid
1N/AThe string representation of
1N/A.LR stat.st_uid .
1N/A.PP
1N/AThe
1N/A.L type
1N/Afield specifies the type of the data at
1N/A.LR offset .
1N/AIntegral types may be prefixed by
1N/A.L le
1N/Aor
1N/A.L be
1N/Afor specifying exact little-endian or big-endian representation,
1N/Abut the internal algorithm automatically loops through the
1N/Astandard representations to find integral matches,
1N/Aso representation prefixes are rarely used.
1N/AHowever, this looping may cause some magic entry conflicts; use the
1N/A.L le
1N/Aor
1N/A.L be
1N/Aprefix in these cases.
1N/AOnly one representation is used for all the records in an entry.
1N/AValid types are:
1N/A.TP
1N/A.L byte
1N/AA 1 byte integer.
1N/A.TP
1N/A.L short
1N/AA 2 byte integer.
1N/A.TP
1N/A.L long
1N/AA 4 byte integer.
1N/A.TP
1N/A.L quad
1N/AAn 8 byte integer.
1N/ATests on this type may fail is the local compiler does not support
1N/Aan 8 byte integral type and the corresponding value overflows 4 bytes.
1N/A.TP
1N/A.L date
1N/AThe data at
1N/A.L offset
1N/Ais interpreted as a 4 byte seconds-since-the-epoch date and
1N/Aconverted to a string.
1N/A.TP
1N/A.L edit
1N/AThe
1N/A.L expression
1N/Afield is an
1N/A.IR ed (1)
1N/Astyle substitution expression
1N/A\fIdel old del new del \fP [ \fI flags \fP ]
1N/Awhere the substituted value is made available to the
1N/A.L description
1N/Afield
1N/A.L %s
1N/Aformat.
1N/AIn addition to the
1N/A.I flags
1N/Asupported by
1N/A.IR ed (3)
1N/Aare
1N/A.L l
1N/Athat converts the substituted value to lower case and
1N/A.L u
1N/Athat converts the substituted value to upper case.
1N/AIf
1N/A.I old
1N/Adoes not match the string data at
1N/A.L offset
1N/Athen the entry record fails.
1N/A.TP
1N/A.L match
1N/A.L expression
1N/Afield is a
1N/A.IR strmatch (3)
1N/Apattern that is matched against the string data at
1N/A.LR offset .
1N/A.TP
1N/A.L string
1N/AThe
1N/A.L expression
1N/Afield is a string that is compared with the string data at
1N/A.LR offset .
1N/A.PP
1N/AThe optional
1N/A.L mask
1N/Afield takes the form
1N/A.LI & number
1N/Awhere
1N/A.I number
1N/Ais
1N/A.I anded
1N/Awith the integral value at
1N/A.L offset
1N/Abefore the
1N/A.L expression
1N/Ais applied.
1N/A.PP
1N/AThe contents of the expression field depends on the
1N/A.LR type .
1N/AString type expression are described in the
1N/A.L type
1N/Afield entries above.
1N/A.L *
1N/Ameans any value and applies to all types.
1N/AIntegral
1N/A.L type
1N/Aexpression take the form [\fIoperator\fP] \fIoperand\P where
1N/A.I operand
1N/Ais compared with the data value at
1N/A.L offset
1N/Ausing
1N/A.IR operator .
1N/A.I operator
1N/Amay be one of
1N/A.LR < .
1N/A.LR <= ,
1N/A.LR == ,
1N/A.LR >=
1N/Aor
1N/A.LR > .
1N/A.I operator
1N/Adefaults to
1N/A.L ==
1N/Aif omitted.
1N/A.I operand
1N/Amay be an integral constant or one of the following builtin function calls:
1N/A.TP
1N/A.L magic()
1N/AA recursive call to the magic algorithm starting with the data at
1N/A.LR offset .
1N/A.TP
1N/A\f5loop(\fIfunction\fP,\fIoffset\fP,\fIincrement\fP)\fR
1N/ACall
1N/A.I function
1N/Astarting at
1N/A.I offset
1N/Aand increment
1N/A.I offset
1N/Aby
1N/A.I increment
1N/Aafter each iteration.
1N/AIteration continues until the description text does not change.
1N/A.PP
1N/AThe
1N/A.L description
1N/Afield is the most important because it is this field that is presented
1N/Ato the outside world.
1N/AWhen constructing description
1N/Afields one must be very careful to follow the style layed out in the
1N/Amagic file, lest yet another layer of inconsistency creep into the system.
1N/AThe description for each matching record in an entry are concatenated
1N/Ato form the complete magic type.
1N/AIf the previous matching description in the current entry does not end with
1N/A.I space
1N/Aand the current description is not empty and does not start with
1N/A.I comma ,
1N/A.I dot
1N/Aor
1N/A.I backspace
1N/Athen a
1N/A.I space
1N/Ais placed between the descriptions
1N/A(most optional descriptions start with
1N/A.IR comma .)
1N/AThe data value at
1N/A.L offset
1N/Acan be referenced in the description using
1N/A.L %s
1N/Afor the string types and
1N/A.L %ld
1N/Aor
1N/A.L %lu
1N/Afor the integral types.
1N/A.PP
1N/AThe
1N/A.L mimetype
1N/Afield specifies the MIME type, usually in the form
1N/A.IR a / b .
1N/A.SH FILES
1N/A.L ../lib/file/magic
1N/Alocated on
1N/A.L $PATH
1N/A.SH EXAMPLES
1N/A.EX
1N/A0 long 0x020c0108 hp s200 executable, pure
1N/Ao{
1N/A+36 long >0 , not stripped
1N/A+4 short >0 , version %ld
1N/A}
1N/A
1N/A0 long 0x020c0107 hp s200 executable
1N/Ao()
1N/A
1N/A0 long 0x020c010b hp s200 executable, demand-load
1N/Ao()
1N/A.EE
1N/AThe function
1N/A.LR o() ,
1N/Ashared by 3 entries,
1N/Adetermines if the executable is stripped and also extracts the version number.
1N/A.EX
1N/A0 long 0407 bsd 386 executable
1N/A&mode long &0111!=0
1N/A+16 long >0 , not stripped
1N/A.EE
1N/AThis entry requires that the file also has execute permission.
1N/A.SH "SEE ALSO"
1N/Afile(1), mime(4), tw(1), modecanon(3)