magic

 

---

 
 
 
 File Formats                                             magic(4)
 
 
 


NAME
      magic - file command's magic number file
 


SYNOPSIS
      /etc/magic
 


DESCRIPTION
      The file(1) command identifies the type  of  a  file  using,
      among other tests, a test for whether the file begins with a
      certain magic number.  The /etc/magic  file  specifies  what
      magic numbers are to be tested for, what message to print if
      a particular magic number is found, and additional  informa-
      tion to extract from the file.
 
      Each line of the file specifies a test to perform.   A  test
      compares  the   data  starting at a particular offset in the
      file with a 1-byte, 2-byte,
       or 4-byte numeric value or a string.  If the test succeeds,
      a message is
       printed.  The  line  consists  of  the   following   fields
      (separated by tabs):
 
 
      offset type value message
 
      offset
            A number specifying the offset,  in  bytes,  into  the
            file of the data which is to be tested.
 
      type  The type of the data to be tested. The possible values
            are:
 
      byte  A one-byte value.
 
      short A two-byte value.
 
      long  A four-byte value.
 
      string
            A string of bytes.
 
 
      The types byte, short, and long may optionally  be  followed
      by a mask specifier of the form &number. If a mask specifier
      is given, the value is AND'ed with  the  number  before  any
      comparisons  are  done.   The number is specified in C form.
      For instance, 13 is decimal, 013 is octal, and 0x13 is hexa-
      decimal.
 
      value The value to be compared with the value from the file.
            If  the  type is numeric, this value is specified in C
            form. If it is a string, it is specified as a C string
 
 
 
 SunOS 5.8            Last change: 8 May 1995                    1
 
 
 
 
 
 
 File Formats                                             magic(4)
 
 
 
            with the usual escapes permitted (for instance, \n for
            NEWLINE).
 
            Numeric values may be preceded by a character indicat-
            ing the operation to be performed.
             It may be `=', to specify that  the  value  from  the
            file  must  equal the specified value, `<', to specify
            that the value from the file must  be  less  than  the
            specified  value,  `>', to specify that the value from
            the file must be greater  than  the  specified  value,
            `&',  to  specify  that  all the bits in the specified
            value must be set in the value from the file, `^',  to
            specify that at least one of the bits in the specified
            value must not be set in the value from the file, or x
            to specify that any value will match. If the character
            is omitted, it is assumed to be `='.
 
            For string values, the byte string from the file  must
            match  the specified byte string. The byte string from
            the file which is matched is the same  length  as  the
            specified byte string.
 
      message
            The message to be printed if the comparison  succeeds.
            If  the string contains a printf(3C) format specifica-
            tion, the value from  the  file  (with  any  specified
            masking performed) is printed using the message as the
            format string.
 
      Some file formats contain additional information which is to
      be  printed  along  with  the file type. A line which begins
      with the character `>' indicates additional tests  and  mes-
      sages  to be printed.  If the test on the line preceding the
      first line with a `>' succeeds, the tests specified  in  all
      the  subsequent  lines beginning with `>' are performed, and
      the messages printed if the tests succeed.   The  next  line
      which does not begin with a `>' terminates this.
 


FILES
      /etc/magic
 


SEE ALSO
      file(1), file(1B), printf(3C)
 
 BUGS
      There should be more than one level of  subtests,  with  the
      level indicated by the number of `>' at the beginning of the
      line.
 
 
 
 
 
 
 
 SunOS 5.8            Last change: 8 May 1995                    2
 
 
 

---