1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
|
#------------------------------------------------------------------------------
# $File: gnu,v 1.24 2021/04/26 15:56:00 christos Exp $
# gnu: file(1) magic for various GNU tools
#
# GNU nlsutils message catalog file format
#
# GNU message catalog (.mo and .gmo files)
# Update: Joerg Jenderek
# URL: https://www.gnu.org/software/gettext/manual/html_node/MO-Files.html
# Reference: ftp://ftp.gnu.org/pub/gnu/gettext/gettext-0.19.8.tar.gz/
# gettext-0.19.8.1/gettext-runtime/intl/gmo.h
# Note: maybe call it like "GNU translation gettext machine object"
0 string \336\22\4\225 GNU message catalog (little endian),
#0 ulelong 0x950412DE GNU-format message catalog data
# TODO: write lines in such a way that code can also be called for big endian variant
#>0 use gettext-object
#0 name gettext-object
>4 ulelong x revision
!:mime application/x-gettext-translation
# mo extension is also used for Easeus Partition Master PE32 executable module
# like ConvertFatToNTFS.mo
!:ext gmo/mo
# only found three revision combinations 0.0 0.1 1.1 as unsigned 32-bit
# major revision
>4 ulelong/0xFFff x %u.
# minor revision
>4 ulelong&0x0000FFff x \b%u
>>8 ulelong x \b, %u message
# plural s
>>8 ulelong >1 \bs
# size of hashing table
#>20 ulelong x \b, %u hash
#>20 ulelong >1 \bes
#>24 ulelong x at %#x
# for revision x.0 offset of table with originals is 1Ch if directly after header
>4 ulelong&0x0000FFff =0
>>12 ulelong !0x1C \b, at %#x string table
# but for x.1 table offset i found is 30h. That means directly after bigger header
>4 ulelong&0x0000FFff >0
>>12 ulelong !0x30 \b, at %#x string table
# The following variables are only used in .mo files with minor revision >= 1
# number of system dependent segments
#>>28 ulelong x \b, %u segment
#>>28 ulelong >1 \bs
# offset of table describing system dependent segments
#>>32 ulelong x at %#x
# number of system dependent strings pairs
>>36 ulelong x \b, %u sysdep message
>>36 ulelong >1 \bs
# offset of table with start offsets of original sysdep strings
#>>40 ulelong x \b, at %#x sysdep strings
# offset of table with start offsets of translated sysdep strings
#>>44 ulelong x \b, at %#x sysdep translations
# >>(44.l) ulelong x %#x chars
# >>>&0 ulelong x at %#x
# >>>>(&-4) string x "%s"
# string table after big header
#>>48 ubequad x \b, string table %#llx
#
# 0th string length seems to be always 0
#>(12.l) ulelong x \b, %u chars
#>>&0 ulelong x at %#x
# if 1st string length positive inspect offset and string
#>(12.l+8) ulelong >0 \b, %u chars
#>>&0 ulelong x at %#x
# if 2nd string length positive inspect offset and string
# >(12.l+16) ulelong >0 \b, %u chars
# >>&0 ulelong x at %#x
# skip newline byte
#>>>(&-4) ubyte =0x0A
#>>>>&0 string x "%s"
#>>>(&-4) ubyte !0x0A
#>>>>&-1 string x '%s'
# offset of table with translation strings
#>16 ulelong x \b, at %#x translation table
# check translation 0 length and offset
>(16.l) ulelong >0
>>&0 ulelong x
# translation 0 seems to be often Project-Id with name and version
>>>(&-4) string x \b, %s
# trans. 1 with bytes >= 1 unlike icoutils-0.31.0\po\en@boldquot.gmo with 1 NL
>(16.l+8) ulelong >1
>>&0 ulelong x
>>>(&-4) ubyte !0x0A
>>>>&-1 string x '%s'
# 1 New Line like in tar-1.29\po\de.gmo
>>>(&-4) ubyte =0x0A
>>>>&0 ubyte !0x0A
>>>>>&-1 string x '%s'
# 2nd New Line like in parted-3.1\po\de.gmo
>>>>&0 ubyte =0x0A
>>>>>&0 string x '%s'
0 string \225\4\22\336 GNU message catalog (big endian),
#0 ubelong 0x950412DE GNU-format message catalog data
!:mime application/x-gettext-translation
!:ext gmo/mo
# TODO: for big endian use same code as for little endian
#>0 use \^gettext-object
# DEBUG code
#>16 ubelong x \b, at %#x translation table
#>(16.L) ubelong x %#x chars
#>>&0 ubelong x at %#x
# unexpected value HERE!
#>>>(&-4) ubequad x %#llx
#
>4 beshort x revision %d.
>6 beshort >0 \b%d,
>>8 belong x %d messages,
>>36 belong x %d sysdep messages
>6 beshort =0 \b%d,
>>8 belong x %d messages
# GnuPG
# The format is very similar to pgp
0 string \001gpg GPG key trust database
>4 byte x version %d
# Note: magic.mime had 0x8501 for the next line instead of 0x8502
0 beshort 0x8502 GPG encrypted data
!:mime text/PGP # encoding: data
# Update: Joerg Jenderek
# Note: PGP and GPG use same data structure.
# So recognition is now done by ./pgp with start test for byte 0x99
# This magic is not particularly good, as the keyrings don't have true
# magic. Nevertheless, it covers many keyrings.
# 0 ubeshort-0x9901 <2
# >3 byte 4
# >>4 bedate x GPG key public ring, created %s
# !:mime application/x-gnupg-keyring
# Symmetric encryption
0 leshort 0x0d8c
>4 leshort 0x0203
>>2 leshort 0x0204 GPG symmetrically encrypted data (3DES cipher)
>>2 leshort 0x0304 GPG symmetrically encrypted data (CAST5 cipher)
>>2 leshort 0x0404 GPG symmetrically encrypted data (BLOWFISH cipher)
>>2 leshort 0x0704 GPG symmetrically encrypted data (AES cipher)
>>2 leshort 0x0804 GPG symmetrically encrypted data (AES192 cipher)
>>2 leshort 0x0904 GPG symmetrically encrypted data (AES256 cipher)
>>2 leshort 0x0a04 GPG symmetrically encrypted data (TWOFISH cipher)
>>2 leshort 0x0b04 GPG symmetrically encrypted data (CAMELLIA128 cipher)
>>2 leshort 0x0c04 GPG symmetrically encrypted data (CAMELLIA192 cipher)
>>2 leshort 0x0d04 GPG symmetrically encrypted data (CAMELLIA256 cipher)
# GnuPG Keybox file
# <https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=kbx/keybox-blob.c;hb=HEAD>
# From: Philipp Hahn <hahn@univention.de>
0 belong 32
>4 byte 1
>>8 string KBXf GPG keybox database
>>>5 byte 1 version %d
>>>16 bedate x \b, created-at %s
>>>20 bedate x \b, last-maintained %s
# From: James Youngman <jay@gnu.org>
# gnu find magic
0 string \0LOCATE GNU findutils locate database data
>7 string >\0 \b, format %s
>7 string 02 \b (frcode)
# Files produced by GNU gettext
# gettext message catalogue
0 search/1024 \nmsgid
>&0 search/1024 \nmsgstr GNU gettext message catalogue text
!:strength +100
!:mime text/x-po
|
