MAGIC(5) File Formats Manual MAGIC(5) magic - file file(1) 5.47. file(1) " " . " " /usr/share/file/misc/magic.mgc /usr/share/file/misc/magic. MIME . : . . . : offset () . : o ( 0) . . o (&). "+" ( ). type . : byte . short . long 4 . quad 8 . float 32- IEEE . double 64- IEEE . string . / [bCcftTtWw]*. . (width) . . : b . C : . ( regex) c : . ( regex). "c" "C". f . s . ( regex) T . t . W . ( regex). n n . w . ( regex) pstring (Pascal-style) / / . . : B (). H (big endian). h (little endian). L 4 (big endian). l 4 (little endian). J . NUL. "J" "I" JPEG. date 4 . qdate 8 . ldate 4 (UTC). qldate 8 (UTC). qwdate 8 . msdosdate FAT/DOS. msdostime FAT/DOS. beid3 ID3 32- (big-endian). beshort (big-endian). belong 4 (big-endian). bequad 8 (big-endian). befloat 32- IEEE (big-endian). bedouble 64- IEEE (big-endian). bedate 4 (big-endian) . beqdate 8 (big-endian) . beldate 4 (big-endian) (UTC). beqldate 8 (big-endian) (UTC). beqwdate 8 (big-endian) . bemsdosdate (big-endian) FAT/DOS. bemsdostime (big-endian) FAT/DOS. bestring16 (UCS16) (big-endian). leid3 ID3 32- (little-endian). leshort (little-endian). lelong 4 (little-endian). lequad 8 (little-endian). lefloat 32- IEEE (little-endian). ledouble IEEE 64 little-endian. ledate little-endian UNIX. leqdate little-endian UNIX. leldate little-endian UNIX (UTC). leqldate little-endian UNIX (UTC). leqwdate little-endian Windows. lemsdosdate little-endian FAT/DOS. lemsdostime little-endian FAT/DOS. lestring16 (UCS16) little-endian. melong middle-endian ( PDP-11). medate middle-endian ( PDP-11) UNIX. meldate middle-endian ( PDP-11) UNIX (UTC). indirect magic . magic indirect /r . name magic "named" magic use . magic . magic . use magic . ^ (endianness) magic magic leshort beshort . . regex POSIX ( egrep). . . / . /[c][s][l]. "c" "s" . "l" . . 80 . 8 . ^ $ . search . . /number, . \ . . default x ( ) . . clear. clear . default. der DER. der . DER : eoc bool int bit_str octet_str null obj_id obj_desc ext real enum embed utf8_str rel_oid time res2 seq set num_str prt_str t61_str vid_str ia5_str utc_time gen_time gr_str vis_str gen_str univ_str char_str bmp_str date tod datetime duration oid-iri rel-oid-iri. . guid (GUID) XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX. . offset . . : -0 offset x this file is %lld bytes -0 offset <=100 must be more than 100 \ bytes and is only %lld octal . UNIX dC d1 byte uC u1 ubyte dS d2 short uS u2 ushort dI dL d4 long uI uL u4 ulong d8 quad u8 uquad s string. dQ quad uQ uquad. ( ) . "regex" "search" . . . . . : &, |, ^, +, -, *, /, %. u . test . C C ( \n ). . = < > & ^ ~ . x . =. & ^ ~ . ! . C : 13 013 0x13 . . . = < > ( &) . . ( ) >\0 ( ). . x (true). message . printf(3) ( ) . "\b" : . APPLE 4+4 : !:apple CREATYPE : !:ext ext[/ext...] "!:ext" JPEG: !:ext jpeg/jpg/jpe/jfif MIME : !:mime MIMETYPE "!:mime" MIME. : !:strength OP VALUE OP: + - * / VALUE 0 255. . . > . > > 0. : n n+1 n ( ). "/" : 0 string MZ >0x18 uleshort <0x40 MS-DOS executable >0x18 uleshort >0x3f extended PC executable (e.g., MS Windows) . > ( . . . : (x [[.,][bBcCeEfFgGhHiIlmosSqQ]][+-][ y ]). x . id3 short long [bBcCeEfFgGhHiIlLmsSqQ]. "," ".". (big endian) (little endian) m (PDP-11). y . long. : Type Sy Mnemonic Sy Endian Sy Size bcBC Byte/Char N/A 1 efg Double Little 8 EFG Double Big 8 hs Half/Short Little 2 HS Half/Short Big 2 i ID3 Little 4 I ID3 Big 4 l Long Little 4 L Long Big 4 m Middle Middle 4 o Octal Textual Variable q Quad Little 8 Q Quad Big 8 : # MS Windows executables are also valid MS-DOS executables 0 string MZ >0x18 uleshort <0x40 MZ executable (MS-DOS) # skip the whole block below if it is not an extended executable >0x18 uleshort >0x3f >>(0x3c.l) string PE\0\0 PE executable (MS-Windows) >>(0x3c.l) string LX\0\0 LX executable (OS/2) : ( PE\0\0 LE\0\0 ). : [+-*/%&|^]number : # MS Windows executables are also valid MS-DOS executables 0 string MZ # sometimes, the value at 0x18 is less that 0x40 but there's still an # extended executable, simply appended to the file >0x18 uleshort <0x40 >>(4.s*512) leshort 0x014c COFF executable (MS-DOS, DJGPP) >>(4.s*512) leshort !0x014c MZ executable (MS-DOS) ( ) . `&' : 0 string MZ >0x18 uleshort >0x3f >>(0x3c.l) string PE\0\0 PE executable (MS-Windows) # immediately following the PE signature is the CPU type >>>&0 leshort 0x14c for Intel 80386 >>>&0 leshort 0x8664 for x86-64 >>>&0 leshort 0x184 for DEC Alpha : 0 string MZ >0x18 uleshort <0x40 >>(4.s*512) leshort !0x014c MZ executable (MS-DOS) # if it's not COFF, go back 512 bytes and add the offset taken # from byte 2/3, which is yet another way of finding the start # of the extended executable >>>&(2.s-514) string LE LE executable (MS Windows VxD driver) : 0 string MZ >0x18 uleshort >0x3f >>(0x3c.l) string LE\0\0 LE executable (MS-Windows) # at offset 0x80 (-4, since relative offsets start at the end # of the up-level match) inside the LE header, we find the absolute # offset to the code area, where we look for a specific signature >>>(&0x7c.l+0x26) string UPX \b, UPX compressed ! 0 string MZ >0x18 uleshort >0x3f >>(0x3c.l) string LE\0\0 LE executable (MS-Windows) # at offset 0x58 inside the LE header, we find the relative offset # to a data area where we look for a specific signature >>>&(&0x54.l-3) string UNACE \b, ACE self-extracting archive / . . 0 string MZ >0x18 uleshort >0x3f >>(0x3c.l) string PE\0\0 PE executable (MS-Windows) # search for the PE section called ".idata"... >>>&0xf4 search/0x140 .idata # ...and go to the end of it, calculated from start+length; # these are located 14 and 10 bytes after the section name >>>>(&0xe.l+(-4)) string PK\3\4 \b, ZIP self-extracting archive (switch-like default case): # clear that continuation level match >18 clear x >18 lelong 1 one >18 lelong 2 two >18 default x # print default match >>18 lelong x unmatched 0x%x file(1) - . long belong lelong melong short beshort leshort C short long UNIX . OS X Mountain Lion UNIX file(1) C 64 long 8 4 long C long. type int8 uint8 int16 uint16 int32 uint32 int64 uint64 . 3: https://www.gnu.org/licenses/gpl-3.0.html . . : kde-l10n-ar@kde.org Linux 6.12.107+deb13-amd64 24 2025 Linux 6.12.107+deb13-amd64