1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
|
#------------------------------------------------------------------------------
# $File: python,v 1.47 2024/08/27 18:50:57 christos Exp $
# python: file(1) magic for python
#
# Outlook puts """ too for urgent messages
# From: David Necas <yeti@physics.muni.cz>
# often the module starts with a multiline string
0 string/t """ Python script text executable
# MAGIC as specified in Python/import.c (1.0 to 3.7)
# and in Lib/importlib/_bootstrap_external.py (3.5+)
# two bytes of magic followed by "\r\n" in little endian order
0 belong 0x02099900 python 1.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x03099900 python 1.1/1.2 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x892e0d0a python 1.3 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x04170d0a python 1.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x994e0d0a python 1.5 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xfcc40d0a python 1.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xfdc40d0a python 1.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x87c60d0a python 2.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x88c60d0a python 2.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x2aeb0d0a python 2.1 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x2beb0d0a python 2.1 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x2ded0d0a python 2.2 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x2eed0d0a python 2.2 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x3bf20d0a python 2.3 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x3cf20d0a python 2.3 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x45f20d0a python 2.3 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x59f20d0a python 2.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x63f20d0a python 2.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x6df20d0a python 2.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x6ef20d0a python 2.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x77f20d0a python 2.5 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x81f20d0a python 2.5 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x8bf20d0a python 2.5 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x8cf20d0a python 2.5 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x95f20d0a python 2.5 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x9ff20d0a python 2.5 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xa9f20d0a python 2.5 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xb3f20d0a python 2.5 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xb4f20d0a python 2.5 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xc7f20d0a python 2.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xd1f20d0a python 2.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xd2f20d0a python 2.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xdbf20d0a python 2.7 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xe5f20d0a python 2.7 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xeff20d0a python 2.7 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xf9f20d0a python 2.7 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x03f30d0a python 2.7 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x04f30d0a python 2.7 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x0af30d0a PyPy2.7 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xb80b0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xc20b0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xcc0b0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xd60b0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xe00b0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xea0b0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xf40b0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xf50b0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xff0b0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x090c0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x130c0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x1d0c0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x1f0c0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x270c0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x3b0c0d0a python 3.0 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x450c0d0a python 3.1 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x4f0c0d0a python 3.1 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x580c0d0a python 3.2 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x620c0d0a python 3.2 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x6c0c0d0a python 3.2 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x760c0d0a python 3.3 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x800c0d0a python 3.3 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x8a0c0d0a python 3.3 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x940c0d0a python 3.3 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x9e0c0d0a python 3.3 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xb20c0d0a python 3.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xbc0c0d0a python 3.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xc60c0d0a python 3.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xd00c0d0a python 3.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xda0c0d0a python 3.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xe40c0d0a python 3.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xee0c0d0a python 3.4 byte-compiled
!:mime application/x-bytecode.python
0 belong 0xf80c0d0a python 3.5.1- byte-compiled
!:mime application/x-bytecode.python
0 belong 0x020d0d0a python 3.5.1- byte-compiled
!:mime application/x-bytecode.python
0 belong 0x0c0d0d0a python 3.5.1- byte-compiled
!:mime application/x-bytecode.python
0 belong 0x160d0d0a python 3.5.1- byte-compiled
!:mime application/x-bytecode.python
0 belong 0x170d0d0a python 3.5.2+ byte-compiled
!:mime application/x-bytecode.python
0 belong 0x200d0d0a python 3.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x210d0d0a python 3.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x2a0d0d0a python 3.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x2b0d0d0a python 3.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x2c0d0d0a python 3.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x2d0d0d0a python 3.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x2f0d0d0a python 3.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x300d0d0a python 3.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x310d0d0a python 3.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x320d0d0a python 3.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x330d0d0a python 3.6 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x3e0d0d0a python 3.7 byte-compiled
!:mime application/x-bytecode.python
0 belong 0x3f0d0d0a python 3.7 byte-compiled
!:mime application/x-bytecode.python
# magic 3392+ implements PEP 552: Deterministic pycs
0 name pyc-pep552
>0 uleshort x (magic: %04d),
# the flag field determines how .pyc validity is checked
>4 ulelong&1 0 timestamp-based,
>>8 uledate x .py timestamp: %s UTC,
>>12 ulelong x .py size: %d bytes
>4 ulelong&1 !0 hash-based, check-source flag
>>4 ulelong&2 0 unset,
>>4 ulelong&2 !0 set,
>>8 ulequad x hash: 0x%llx
# uleshort magic followed by \x0d\0xa
2 string \x0d\x0a
# extra check: only two bits of flag field are currently used
>4 ulelong <0x4
# \x0d as part of magic should suffice till Python 3.14 (magic 3600)
>>1 ubyte 0x0d Byte-compiled Python module for
!:mime application/x-bytecode.python
# now look at the magic number to determine the version
>>>0 uleshort <3400 CPython 3.7
>>>0 default x
>>>>0 uleshort <3420 CPython 3.8
>>>>0 default x
>>>>>0 uleshort <3430 CPython 3.9
>>>>>0 default x
>>>>>>0 uleshort <3450 CPython 3.10
>>>>>>0 default x
>>>>>>>0 uleshort <3500 CPython 3.11
>>>>>>>0 default x
>>>>>>>>0 uleshort <3550 CPython 3.12
>>>>>>>>0 default x
>>>>>>>>>0 uleshort <3600 CPython 3.13
>>>>>>>>>0 default x CPython 3.14 or newer
>>>0 use pyc-pep552
>>0 uleshort 240 Byte-compiled Python module for PyPy3.7
!:mime application/x-bytecode.python
>>>0 use pyc-pep552
>>0 uleshort 256 Byte-compiled Python module for PyPy3.8
!:mime application/x-bytecode.python
>>>0 use pyc-pep552
>>0 uleshort 336 Byte-compiled Python module for PyPy3.9
!:mime application/x-bytecode.python
>>>0 use pyc-pep552
0 search/1/w #!\040/usr/bin/python Python script text executable
!:strength + 15
!:mime text/x-script.python
0 search/1/w #!\040/usr/local/bin/python Python script text executable
!:strength + 15
!:mime text/x-script.python
0 search/10/w #!\040/usr/bin/env\040python Python script text executable
!:strength + 15
!:mime text/x-script.python
# from module.submodule import func1, func2
0 search/8192 import
>0 regex \^from[\040\t]+([A-Za-z0-9_]|\\.)+[\040\t]+import.*$ Python script text executable
!:strength + 15
!:mime text/x-script.python
>0 regex \^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
!:mime text/x-script.python
# def __init__ (self, ...):
0 search/4096 def\ __init__
>&0 search/64 self Python script text executable
!:strength + 15
!:mime text/x-script.python
# if __name__ == "__main__":
0 search/4096 if\ __name__
>&0 search/64 '__main__' Python script text executable
>&0 search/64 "__main__" Python script text executable
!:strength + 15
!:mime text/x-script.python
# comments
#0 search/4096 '''
#>&0 regex .*'''$ Python script text executable
#!:mime text/x-script.python
#0 search/4096 """
#>&0 regex .*"""$ Python script text executable
#!:mime text/x-script.python
# try:
# except: or finally:
# block
0 search/4096 try:
>&0 regex \^[[:space:]]*except.*:$ Python script text executable
!:strength + 15
!:mime text/x-script.python
>&0 search/4096 finally: Python script text executable
!:mime text/x-script.python
# class name[(base classes,)]: [pass]
0 search/8192 class
>0 regex \^class\ [_[:alpha:]]+(\\(.*\\))?(\ )*:([\ \t]+pass)?$ Python script text executable
!:strength + 15
!:mime text/x-script.python
# def name(*args, **kwargs):
0 search/8192 def\
>0 regex \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100}
>>&0 regex \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable
!:strength + 15
!:mime text/x-script.python
# https://numpy.org/devdocs/reference/generated/numpy.lib.format.html
0 string \223NUMPY NumPy data file
!:mime application/x-numpy-data
>6 byte x \b, version %d
>7 byte x \b.%d
#>8 leshort x \b, header length=%d
>10 string x \b, description %s
|
