Imported Upstream version 1.2.1
[packages/binwalk.git] / magic / compressed
index b718faa..debcfe6 100644 (file)
 # http://www.7-zip.org or DOC/7zFormat.txt 
 #
 0       string          7z\274\257\047\034      7-zip archive data,
+>6     byte            <0                      invalid
+>6     byte            0                       invalid
+>6     byte            >20                     invalid
 >6      byte            x                       version %d
 >7      byte            x                       \b.%d
 
 # standard unix compress
-0       beshort                0x1f9d          compress'd data
->2      byte&0x80       >0              block compressed
->2     byte&0x1f       !16             invalid
->2      byte&0x1f       x               %d bits
+#0       beshort               0x1f9d          compress'd data
+#>2      byte&0x80       >0              block compressed
+#>2    byte&0x1f       !16             invalid
+#>2      byte&0x1f       x               %d bits
 
 # http://tukaani.org/xz/xz-file-format.txt
 0      string          \xFD\x37\x7a\x58\x5a\x00        xz compressed data
@@ -82,7 +85,8 @@
 #       * Original filename is only at offset 10 if "extra field" absent
 #       * Produce shorter output - notably, only report compression methods
 #         other than 8 ("deflate", the only method defined in RFC 1952).
-0       string          \037\213\x08    gzip compressed data
+#0       string          \037\213\x08    gzip compressed data
+0      string          \x1f\x8b\x08    gzip compressed data
 >3      byte            &0x01           \b, ASCII
 >3      byte            &0x02           \b, has CRC
 >3      byte            &0x04           \b, extra field
 >9      byte            =0x0B           \b, from NTFS filesystem (NT)
 >9      byte            =0x0C           \b, from QDOS
 >9      byte            =0x0D           \b, from Acorn RISCOS
->9     byte            >0x0D           \b, invalid source
->9     byte            <0              \b, invalid source
+#>9    byte            =0xFF           \b, from ZyNOS
+#>9    byte            >0x0D           \b, invalid
+#>>9   byte            x               source: 0x%.2X
+#>9    byte            <0              \b, invalid
+#>>9   byte            x               source: 0x%.2X
 >3      byte            &0x20           \b, encrypted (invalid)
 # Dates before 1992 are invalid, unless of course you're DD-WRT in which
 # case you don't know how to set a date in your gzip files. Brilliant.
 >8      byte            4               \b, max speed
 
 # Zlib signatures
-0      beshort         0x789C          zlib compressed data
-0      beshort         0x78DA          zlib compressed data
-0      beshort         0x7801          zlib compressed data
+# Useless until they can be further improved.
+#0     beshort         0x789C          zlib compressed data
+#0     beshort         0x78DA          zlib compressed data
+#0     beshort         0x7801          zlib compressed data
 
 # Supplementary magic data for the file(1) command to support
 # rzip(1).  The format is described in magic(5).
 >5      byte            x               \b.%d
 >6      belong          x               (%d bytes)
 
-# ZIP compression (Greg Roelofs, c/o zip-bugs@wkuvx1.wku.edu)
-0       string          PK\003\004      Zip archive data,
->4      byte            0x00            v0.0
->4      byte            0x09            at least v0.9 to extract,
->4      byte            0x0a            at least v1.0 to extract,
->4      byte            0x0b            at least v1.1 to extract,
->0x161  string          WINZIP          WinZIP self-extracting,
->4      byte            0x14
->>30    ubelong         !0x6d696d65     at least v2.0 to extract,
->18    lelong          !0
->>18   lelong          <0              invalid
->>18   lelong          x               compressed size: %d,
->22    lelong          !0
->>22   lelong          <0              invalid
->>22   lelong          x               uncompressed size: %d,{extract-delay:end of zip archive}
->30    string          x               {file-name:{raw-replace}}name: {raw-replace}
->26    leshort         x               {raw-string-length:%d}
->30    string          x               {raw-string:%s
->61    string          x               \b%s
->92    string          x               \b%s
->123   string          x               \b%s
->154   string          x               \b%s}
-
-# ZIP footer
-0      string          PK\x05\x06      End of Zip archive
->20    leshort         x               {offset-adjust:22+%d}
->20    leshort         >0
->>20   leshort         x               \b, comment: {raw-replace}
->>20   leshort         x               {raw-string-length:%d}
->>22   string          x               {raw-string:%s}
-
 # New LZMA format signature
 0      string          \xFFLZMA\x00    LZMA compressed data (new),
 >6     byte&0x10       0               single-block stream