2 #------------------------------------------------------------------------------
3 # freebsd: file(1) magic for FreeBSD objects
5 # All new-style FreeBSD magic numbers are in host byte order (i.e.,
6 # little-endian on x86).
8 # XXX - this comes from the file "freebsd" in a recent FreeBSD version of
9 # "file"; it, and the NetBSD stuff in "netbsd", appear to use different
10 # schemes for distinguishing between executable images, shared libraries,
15 # Regardless of whether it's pure, demand-paged, or none of the
18 # if the entry point is < 4096, then it's a shared library if
19 # the "has run-time loader information" bit is set, and is
20 # position-independent if the "is position-independent" bit
23 # if the entry point is >= 4096 (or >4095, same thing), then it's
24 # an executable, and is dynamically-linked if the "has run-time
25 # loader information" bit is set.
27 # On x86, NetBSD says:
29 # If it's neither pure nor demand-paged:
31 # if it has the "has run-time loader information" bit set, it's
32 # a dynamically-linked executable;
34 # if it doesn't have that bit set, then:
36 # if it has the "is position-independent" bit set, it's
37 # position-independent;
39 # if the entry point is non-zero, it's an executable, otherwise
40 # it's an object file.
44 # if it has the "has run-time loader information" bit set, it's
45 # a dynamically-linked executable, otherwise it's just an
48 # If it's demand-paged:
50 # if it has the "has run-time loader information" bit set,
53 # if the entry point is < 4096, it's a shared library;
55 # if the entry point is = 4096 or > 4096 (i.e., >= 4096),
56 # it's a dynamically-linked executable);
58 # if it doesn't have the "has run-time loader information" bit
59 # set, then it's just an executable.
61 # (On non-x86, NetBSD does much the same thing, except that it uses
62 # 8192 on 68K - except for "68k4k", which is presumably "68K with 4K
63 # pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's
64 # had 8K pages; dunno about MIPS.)
66 # I suspect the two will differ only in perverse and uninteresting cases
67 # ("shared" libraries that aren't demand-paged and whose pages probably
68 # won't actually be shared, executables with entry points <4096).
70 # I leave it to those more familiar with FreeBSD and NetBSD to figure out
71 # what the right answer is (although using ">4095", FreeBSD-style, is
72 # probably better than separately checking for "=4096" and ">4096",
73 # NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged
74 # executables using the NetBSD technique.)
76 0 lelong&0377777777 041400407 FreeBSD/i386
78 >>3 byte&0xC0 &0x80 shared library
79 >>3 byte&0xC0 0x40 PIC object
80 >>3 byte&0xC0 0x00 object
82 >>3 byte&0x80 0x80 dynamically linked executable
83 >>3 byte&0x80 0x00 executable
84 >16 lelong >0 not stripped
86 0 lelong&0377777777 041400410 FreeBSD/i386 pure
88 >>3 byte&0xC0 &0x80 shared library
89 >>3 byte&0xC0 0x40 PIC object
90 >>3 byte&0xC0 0x00 object
92 >>3 byte&0x80 0x80 dynamically linked executable
93 >>3 byte&0x80 0x00 executable
94 >16 lelong >0 not stripped
96 0 lelong&0377777777 041400413 FreeBSD/i386 demand paged
98 >>3 byte&0xC0 &0x80 shared library
99 >>3 byte&0xC0 0x40 PIC object
100 >>3 byte&0xC0 0x00 object
102 >>3 byte&0x80 0x80 dynamically linked executable
103 >>3 byte&0x80 0x00 executable
104 >16 lelong >0 not stripped
106 0 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged
108 >>3 byte&0xC0 &0x80 shared library
109 >>3 byte&0xC0 0x40 PIC object
110 >>3 byte&0xC0 0x00 object
112 >>3 byte&0x80 0x80 dynamically linked executable
113 >>3 byte&0x80 0x00 executable
114 >16 lelong >0 not stripped
116 # XXX gross hack to identify core files
117 # cores start with a struct tss; we take advantage of the following:
118 # byte 7: highest byte of the kernel stack pointer, always 0xfe
119 # 8/9: kernel (ring 0) ss value, always 0x0010
120 # 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
121 # 28: low order byte of the current PTD entry, always 0 since the
122 # PTD is page-aligned
124 7 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file
125 >1039 string >\0 from '%s'
127 # /var/run/ld.so.hints
128 # What are you laughing about?
129 0 lelong 011421044151 ld.so hints file (Little Endian
130 >4 lelong >0 \b, version %d)
132 0 belong 011421044151 ld.so hints file (Big Endian
133 >4 belong >0 \b, version %d)
137 # Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities
139 0 string SCRSHOT_ scrshot(1) screenshot,
140 >8 byte x version %d,
141 >9 byte 2 %d bytes in header,
142 >>10 byte x %d chars wide by
143 >>11 byte x %d chars high