1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
#------------------------------------------------------------------------------
# $File: pdf,v 1.6 2009/09/19 16:28:11 christos Exp $
# pdf: file(1) magic for Portable Document Format
#
0 string %PDF- PDF document,
>6 byte !0x2e invalid
>5 string x version: "%3s"
#------------------------------------------------------------------------------
# $File: zyxel,v 1.6 2009/09/19 16:28:13 christos Exp $
# zyxel: file(1) magic for ZyXEL modems
#
# From <rob@pe1chl.ampr.org>
# These are the /etc/magic entries to decode datafiles as used for the
# ZyXEL U-1496E DATA/FAX/VOICE modems. (This header conforms to a
# ZyXEL-defined standard)
0 string ZyXEL\002 ZyXEL voice data
>10 byte 0 \b, CELP encoding
>10 byte&0x0B 1 \b, ADPCM2 encoding
>10 byte&0x0B 2 \b, ADPCM3 encoding
>10 byte&0x0B 3 \b, ADPCM4 encoding
>10 byte&0x0B 8 \b, New ADPCM3 encoding
>10 byte&0x04 4 \b,with resync
0 string LinuxGuestRecord Xen saved domain file
0 string \x3chtml HTML document header{extract-delay:HTML document footer}
>5 byte !0x20
>>5 byte !0x3e \b, invalid
0 string \x3cHTML HTML document header{extract-delay:HTML document footer}
>5 byte !0x20
>>5 byte !0x3e \b, invalid
0 string \x3c/html\x3e HTML document footer{offset-adjust:7}
0 string \x3c/HTML\x3e HTML document footer{offset-adjust:7}
0 string \x3c?xml\x20version XML document,
>15 string x version: "%.3s"
# CodeGate 2011 http://nopsrus.blogspot.com/2013/05/codegate-ctf-2011-binary-100-points.html
0 string \x23\x40\x7e\x5e Windows Script Encoded Data (screnc.exe)
0 string /home/ Unix home path string:
>0 string x "%s"
0 string neighbor Neighborly text,
>0 string x "%s
>63 string x \b%s"
0 string Neighbor Neighborly text,
>0 string x "%s
>63 string x \b%s"
0 string neighborly Neighborly text, best guess: Goodspeed,
>0 string x "%s
>63 string x \b%s"
0 string begin\x20 uuencoded data,
>9 byte !0x20 invalid format,
>6 byte <0x30 invalid permissions,
>6 byte >0x39 invalid permissions,
>7 byte <0x30 invalid permissions,
>7 byte >0x39 invalid permissions,
>8 byte <0x30 invalid permissions,
>8 byte >0x39 invalid permissions,
>10 string x file name: "%s",
>6 string x file permissions: "%.3s"