Fix small kernel memory disclosures. [EN-18:12.mem]

Reported by: Thomas Barabosch, Fraunhofer FKIE Approved by: so Security: FreeBSD-EN-18:12.mem Security: CVE-2018-17155
Fix DoS in listen syscall over IPv6 socket. [EN-18:11.listen]
2026-10-30 20:35:03 +01:00 · 2018-09-27 18:36:30 +00:00 · 2018-09-27 18:34:42 +00:00 · 2018-09-27 18:32:14 +00:00 · 2018-09-27 18:29:55 +00:00 · 2018-09-12 05:08:49 +00:00
654 changed files with 44034 additions and 17243 deletions
@@ -16,6 +16,129 @@ from older versions of FreeBSD, try WITHOUT_CLANG and WITH_GCC to bootstrap to
 the tip of head, and then rebuild without this option. The bootstrap process
 from older version of current across the gcc/clang cutover is a bit fragile.

+20180927	p15	FreeBSD-EN-18:09.ip
+			FreeBSD-EN-18:10.syscall
+			FreeBSD-EN-18:11.listen
+			FreeBSD-EN-18:12.mem
+
+	Fix regression in IPv6 fragment reassembly. [EN-18:09.ip]
+
+	Fix NULL pointer dereference in freebsd4_getfsstat. [EN-18:10.syscall]
+
+	Fix DoS in listen syscall over IPv6 socket. [EN-18:11.listen]
+
+	Fix small kernel memory disclosures. [EN-18:12.mem]
+
+20180912	p14	FreeBSD-SA-18:12.elf
+			FreeBSD-EN-18:08.lazyfpu
+
+	Fix improper elf header parsing. [SA-18:12.elf]
+
+	Fix regression in Lazy FPU remediation. [EN-18:08.lazyfpu]
+
+20180814	p13	FreeBSD-SA-18:08.tcp [revised]
+			FreeBSD-SA-18:09.l1tf
+			FreeBSD-SA-18:10.ip
+			FreeBSD-SA-18:11.hostapd
+
+	Revise manual pages. [SA-18:08.tcp]
+
+	Fix L1 Terminal Fault (L1TF) kernel information disclosure.
+	[SA-18:09.l1tf]
+
+	Fix resource exhaustion in IP fragment reassembly. [SA-18:10.ip]
+
+	Fix unauthenticated EAPOL-Key decryption vulnerability.
+	[SA-18:11.hostapd]
+
+20180806	p12	FreeBSD-SA-18:08.tcp
+
+	Fix resource exhaustion in TCP reassembly.
+
+20180621	p11	FreeBSD-SA-18:07.lazyfpu
+			FreeBSD-EN-18:07.pmap
+
+	Fix Lazy FPU information disclosure. [SA-18:07.lazyfpu]
+
+	Fix TLB shootdown for Xen based guests. [EN-18:07.pmap]
+
+20180508	p10	FreeBSD-SA-18:06.debugreg
+			FreeBSD-EN-18:05.mem
+			FreeBSD-EN-18:06.tzdata
+
+	Fix mishandling of x86 debug exceptions. [SA-18:06.debugreg]
+
+	Fix multiple small kernel memory disclosures. [EN-18:05.mem]
+
+	Update timezone database information. [EN-18:06.tzdata]
+
+20180404	p9	FreeBSD-SA-18:04.vt
+			FreeBSD-SA-18:05.ipsec
+			FreeBSD-EN-18:03.tzdata
+			FreeBSD-EN-18:04.mem
+
+	Fix vt console memory disclosure. [SA-18:04.vt]
+
+	Fix ipsec crash or denial of service. [SA-18:05.ipsec]
+
+	Update timezone database information. [EN-18:03.tzdata]
+
+	Fix multiple small kernel memory disclosures. [EN-18:04.mem]
+
+20180314	p8	FreeBSD-SA-18:03.speculative_execution
+
+	Add mitigations for two classes of speculative execution vulnerabilities
+	on amd64.
+
+20180307	p7	FreeBSD-SA-18:01.ipsec
+			FreeBSD-SA-18:02.ntp
+			FreeBSD-EN-18:01.tzdata
+			FreeBSD-EN-18:02.file
+
+	Fix ipsec validation and use-after-free. [SA-18:01.ipsec]
+
+	Fix multiple vulnerabilities in ntp. [SA-18:02.ntp]
+
+	Update timezone database information. [EN-18:01.tzdata]
+
+	Update file(1) to new version with security update. [EN-18:02.file]
+
+20171209	p6	FreeBSD-SA-17:12.openssl
+
+	Fix multiple vulnerabilities of OpenSSL.
+
+20171129	p5	FreeBSD-SA-17:11.openssl
+
+	Fix multiple vulnerabilities of OpenSSL.
+
+20171115	p4	FreeBSD-SA-17:08.ptrace
+			FreeBSD-SA-17:10.kldstat
+
+	Fix ptrace(2) vulnerability. [SA-17:08.ptrace]
+
+	Fix kldstat(2) vulnerability. [SA-17:10.kldstat]
+
+20171102	p3	FreeBSD-EN-17:09.tzdata
+
+	Update timezone database information. [EN-17:09]
+
+20171017	p2	FreeBSD-SA-17:07.wpa
+
+	Fix WPA2 protocol vulnerability. [SA-17:07]
+
+20170810	p1	FreeBSD-SA-17:06.openssh
+			FreeBSD-EN-17:07.vnet
+			FreeBSD-EN-17:08.pf
+
+	Fix OpenSSH Denial of Service vulnerability. [SA-17:06]
+
+	Fix VNET kernel panic with asynchronous I/O. [EN-17:07]
+
+	Fix pf(4) housekeeping thread causes kernel panic. [EN-17:08]
+
+20170725:
+	11.1-RELEASE.
+
 20170518:
 	arm64 builds now use the base system LLD 4.0.0 linker by default,
 	instead of requiring that the aarch64-binutils port or package be
@@ -29,7 +29,7 @@
 .\"	@(#)rcp.1	8.1 (Berkeley) 5/31/93
 .\" $FreeBSD$
 .\"
-.Dd October 16, 2002
+.Dd July 3, 2017
 .Dt RCP 1
 .Os
 .Sh NAME
@@ -43,6 +43,15 @@
 .Op Fl 46pr
 .Ar
 .Ar directory
+.Sh DEPRECATION NOTICE
+.Nm
+is deprecated and will be removed from future versions of the
+.Fx
+base system.
+If
+.Nm
+is still required, it can be installed from ports or packages
+(net/bsdrcmds).
 .Sh DESCRIPTION
 The
 .Nm
@@ -50,7 +50,7 @@

 #include "_elftc.h"

-ELFTC_VCSID("$Id: elfdump.c 3497 2016-10-17 20:57:22Z emaste $");
+ELFTC_VCSID("$Id: elfdump.c 3521 2017-06-04 20:07:09Z jkoshy $");

 #if defined(ELFTC_NEED_ELF_NOTE_DEFINITION)
 #include "native-elf-format.h"
@@ -2226,8 +2226,8 @@ elf_print_svr4_hash64(struct elfdump *ed, struct section *s)
 	uint64_t	*buf;
 	uint64_t	*bucket, *chain;
 	uint64_t	 nbucket, nchain;
-	uint64_t	*bl, *c, maxl, total;
-	uint64_t	 i, j;
+	uint64_t	*bl, *c, j, maxl, total;
+	size_t		 i;
 	int		 elferr, first;
 	char		 idx[10];

@@ -24,7 +24,7 @@
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
- * $Id: _libelftc.h 3174 2015-03-27 17:13:41Z emaste $
+ * $Id: _libelftc.h 3531 2017-06-05 05:08:43Z kaiwang27 $
 */

 #ifndef	__LIBELFTC_H_
@@ -82,6 +82,8 @@ bool	vector_str_init(struct vector_str *_vs);
 bool	vector_str_pop(struct vector_str *_vs);
 bool	vector_str_push(struct vector_str *_vs, const char *_str,
    size_t _len);
+bool	vector_str_push_vector(struct vector_str *_dst,
+    struct vector_str *_org);
 bool	vector_str_push_vector_head(struct vector_str *_dst,
    struct vector_str *_org);
 char	*vector_str_substr(const struct vector_str *_vs, size_t _begin,
@@ -33,7 +33,7 @@

 #include "_libelftc.h"

-ELFTC_VCSID("$Id: libelftc_vstr.c 2065 2011-10-26 15:24:47Z jkoshy $");
+ELFTC_VCSID("$Id: libelftc_vstr.c 3531 2017-06-05 05:08:43Z kaiwang27 $");

 /**
 * @file vector_str.c
@@ -280,6 +280,47 @@ vector_str_push_vector_head(struct vector_str *dst, struct vector_str *org)
 	return (true);
 }

+/**
+ * @brief Push org vector to the tail of det vector.
+ * @return false at failed, true at success.
+ */
+bool
+vector_str_push_vector(struct vector_str *dst, struct vector_str *org)
+{
+	size_t i, j, tmp_cap;
+	char **tmp_ctn;
+
+	if (dst == NULL || org == NULL)
+		return (false);
+
+	tmp_cap = (dst->size + org->size) * BUFFER_GROWFACTOR;
+
+	if ((tmp_ctn = malloc(sizeof(char *) * tmp_cap)) == NULL)
+		return (false);
+
+	for (i = 0; i < dst->size; ++i)
+		tmp_ctn[i] = dst->container[i];
+
+	for (i = 0; i < org->size; ++i)
+		if ((tmp_ctn[i + dst->size] = strdup(org->container[i])) ==
+		    NULL) {
+			for (j = 0; j < i + dst->size; ++j)
+				free(tmp_ctn[j]);
+
+			free(tmp_ctn);
+
+			return (false);
+		}
+
+	free(dst->container);
+
+	dst->container = tmp_ctn;
+	dst->capacity = tmp_cap;
+	dst->size += org->size;
+
+	return (true);
+}
+
 /**
 * @brief Get new allocated flat string from vector between begin and end.
 *
@@ -1,6 +1,60 @@
+2017-09-02  11:53  Christos Zoulas <[email protected]>
+
+	* release 5.32
+
+2017-08-28  16:37  Christos Zoulas <[email protected]>
+
+	* Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
+
+2017-08-27  03:55  Christos Zoulas <[email protected]>
+
+	* Fix always true condition (Thomas Jarosch)
+
+2017-05-24  17:30  Christos Zoulas <[email protected]>
+
+	* pickier parsing of numeric values in magic files.
+
+2017-05-23  17:55  Christos Zoulas <[email protected]>
+
+	* PR/615 add magic_getflags()
+
+2017-05-23  13:55  Christos Zoulas <[email protected]>
+
+	* release 5.31
+
+2017-03-17  20:32  Christos Zoulas <[email protected]>
+
+	* remove trailing spaces from magic files
+	* refactor is_tar
+	* better bounds checks for cdf
+
+2017-02-10  12:24  Christos Zoulas <[email protected]>
+
+	* release 5.30
+
+2017-02-07  23:27  Christos Zoulas <[email protected]>
+
+	* If we exceeded the offset in a search return no match
+	  (Christoph Biedl)
+	* Be more lenient on corrupt CDF files (Christoph Biedl)
+
+2017-02-04  16:46  Christos Zoulas <[email protected]>
+
+	* pacify ubsan sign extension (oss-fuzz/524)
+
+2017-02-01  12:42  Christos Zoulas <[email protected]>
+
+	* off by one in cdf parsing (PR/593)
+	* report debugging sections in elf (PR/591)
+
+2016-11-06  10:52  Christos Zoulas <[email protected]>
+
+	* Allow @@@ in extensions
+	* Add missing overflow check in der magic (Jonas Wagner)
+
 2016-10-25  10:40  Christos Zoulas <[email protected]>
 	
-	* release 5.28
+	* release 5.29

 2016-10-24  11:20  Christos Zoulas <[email protected]>

@@ -387,7 +441,7 @@
 		`
 2013-11-06  14:40  Christos Zoulas <[email protected]>

-	* fix erroneous non-zero exit code from non-existant file and message
+	* fix erroneous non-zero exit code from non-existent file and message

 2013-10-29  14:25  Christos Zoulas <[email protected]>

@@ -21,7 +21,7 @@ If you have problems, you may need to regenerate the build system entirely.
 To do so, use the procedure documented by the package, typically 'autoreconf'.])])

 # visibility.m4 serial 5 (gettext-0.18.2)
-dnl Copyright (C) 2005, 2008, 2010-2014 Free Software Foundation, Inc.
+dnl Copyright (C) 2005, 2008, 2010-2016 Free Software Foundation, Inc.
 dnl This file is free software; the Free Software Foundation
 dnl gives unlimited permission to copy and/or distribute it,
 dnl with or without modifications, as long as this notice is preserved.
@@ -1,8 +1,8 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright 1992-2015 Free Software Foundation, Inc.
+#   Copyright 1992-2017 Free Software Foundation, Inc.

-timestamp='2015-03-04'
+timestamp='2017-01-01'

 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -27,7 +27,7 @@ timestamp='2015-03-04'
 # Originally written by Per Bothner; maintained since 2000 by Ben Elliston.
 #
 # You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
 #
 # Please send patches to <[email protected]>.

@@ -50,7 +50,7 @@ version="\
 GNU config.guess ($timestamp)

 Originally written by Per Bothner.
-Copyright 1992-2015 Free Software Foundation, Inc.
+Copyright 1992-2017 Free Software Foundation, Inc.

 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -186,9 +186,12 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	    *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
 	esac
 	# The Operating System including object format, if it has switched
-	# to ELF recently, or will in the future.
+	# to ELF recently (or will in the future) and ABI.
 	case "${UNAME_MACHINE_ARCH}" in
-	    arm*|earm*|i386|m68k|ns32k|sh3*|sparc|vax)
+	    earm*)
+		os=netbsdelf
+		;;
+	    arm*|i386|m68k|ns32k|sh3*|sparc|vax)
 		eval $set_cc_for_build
 		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
 			| grep -q __ELF__
@@ -221,7 +224,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 		release='-gnu'
 		;;
 	    *)
-		release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
+		release=`echo ${UNAME_RELEASE} | sed -e 's/[-_].*//' | cut -d. -f1,2`
 		;;
 	esac
 	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
@@ -237,6 +240,10 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
 	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
 	exit ;;
+    *:LibertyBSD:*:*)
+	UNAME_MACHINE_ARCH=`arch | sed 's/^.*BSD\.//'`
+	echo ${UNAME_MACHINE_ARCH}-unknown-libertybsd${UNAME_RELEASE}
+	exit ;;
    *:ekkoBSD:*:*)
 	echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
 	exit ;;
@@ -249,6 +256,9 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
    *:MirBSD:*:*)
 	echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
 	exit ;;
+    *:Sortix:*:*)
+	echo ${UNAME_MACHINE}-unknown-sortix
+	exit ;;
    alpha:OSF1:*:*)
 	case $UNAME_RELEASE in
 	*4.0)
@@ -265,42 +275,42 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^  The alpha \(.*\) processor.*$/\1/p' | head -n 1`
 	case "$ALPHA_CPU_TYPE" in
 	    "EV4 (21064)")
-		UNAME_MACHINE="alpha" ;;
+		UNAME_MACHINE=alpha ;;
 	    "EV4.5 (21064)")
-		UNAME_MACHINE="alpha" ;;
+		UNAME_MACHINE=alpha ;;
 	    "LCA4 (21066/21068)")
-		UNAME_MACHINE="alpha" ;;
+		UNAME_MACHINE=alpha ;;
 	    "EV5 (21164)")
-		UNAME_MACHINE="alphaev5" ;;
+		UNAME_MACHINE=alphaev5 ;;
 	    "EV5.6 (21164A)")
-		UNAME_MACHINE="alphaev56" ;;
+		UNAME_MACHINE=alphaev56 ;;
 	    "EV5.6 (21164PC)")
-		UNAME_MACHINE="alphapca56" ;;
+		UNAME_MACHINE=alphapca56 ;;
 	    "EV5.7 (21164PC)")
-		UNAME_MACHINE="alphapca57" ;;
+		UNAME_MACHINE=alphapca57 ;;
 	    "EV6 (21264)")
-		UNAME_MACHINE="alphaev6" ;;
+		UNAME_MACHINE=alphaev6 ;;
 	    "EV6.7 (21264A)")
-		UNAME_MACHINE="alphaev67" ;;
+		UNAME_MACHINE=alphaev67 ;;
 	    "EV6.8CB (21264C)")
-		UNAME_MACHINE="alphaev68" ;;
+		UNAME_MACHINE=alphaev68 ;;
 	    "EV6.8AL (21264B)")
-		UNAME_MACHINE="alphaev68" ;;
+		UNAME_MACHINE=alphaev68 ;;
 	    "EV6.8CX (21264D)")
-		UNAME_MACHINE="alphaev68" ;;
+		UNAME_MACHINE=alphaev68 ;;
 	    "EV6.9A (21264/EV69A)")
-		UNAME_MACHINE="alphaev69" ;;
+		UNAME_MACHINE=alphaev69 ;;
 	    "EV7 (21364)")
-		UNAME_MACHINE="alphaev7" ;;
+		UNAME_MACHINE=alphaev7 ;;
 	    "EV7.9 (21364A)")
-		UNAME_MACHINE="alphaev79" ;;
+		UNAME_MACHINE=alphaev79 ;;
 	esac
 	# A Pn.n version is a patched version.
 	# A Vn.n version is a released version.
 	# A Tn.n version is a released field test version.
 	# A Xn.n version is an unreleased experimental baselevel.
 	# 1.2 uses "1.2" for uname -r.
-	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
+	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
 	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
 	exitcode=$?
 	trap '' 0
@@ -373,16 +383,16 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	exit ;;
    i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
 	eval $set_cc_for_build
-	SUN_ARCH="i386"
+	SUN_ARCH=i386
 	# If there is a compiler, see if it is configured for 64-bit objects.
 	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
 	# This test works for both compilers.
-	if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+	if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
 	    if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
-		(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		(CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
 		grep IS_64BIT_ARCH >/dev/null
 	    then
-		SUN_ARCH="x86_64"
+		SUN_ARCH=x86_64
 	    fi
 	fi
 	echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
@@ -407,7 +417,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	exit ;;
    sun*:*:4.2BSD:*)
 	UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
-	test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3
+	test "x${UNAME_RELEASE}" = x && UNAME_RELEASE=3
 	case "`/bin/arch`" in
 	    sun3)
 		echo m68k-sun-sunos${UNAME_RELEASE}
@@ -632,13 +642,13 @@ EOF
 		    sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
 		    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
 		    case "${sc_cpu_version}" in
-		      523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0
-		      528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1
+		      523) HP_ARCH=hppa1.0 ;; # CPU_PA_RISC1_0
+		      528) HP_ARCH=hppa1.1 ;; # CPU_PA_RISC1_1
 		      532)                      # CPU_PA_RISC2_0
 			case "${sc_kernel_bits}" in
-			  32) HP_ARCH="hppa2.0n" ;;
-			  64) HP_ARCH="hppa2.0w" ;;
-			  '') HP_ARCH="hppa2.0" ;;   # HP-UX 10.20
+			  32) HP_ARCH=hppa2.0n ;;
+			  64) HP_ARCH=hppa2.0w ;;
+			  '') HP_ARCH=hppa2.0 ;;   # HP-UX 10.20
 			esac ;;
 		    esac
 		fi
@@ -677,11 +687,11 @@ EOF
 		    exit (0);
 		}
 EOF
-		    (CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
+		    (CCOPTS="" $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
 		    test -z "$HP_ARCH" && HP_ARCH=hppa
 		fi ;;
 	esac
-	if [ ${HP_ARCH} = "hppa2.0w" ]
+	if [ ${HP_ARCH} = hppa2.0w ]
 	then
 	    eval $set_cc_for_build

@@ -694,12 +704,12 @@ EOF
 	    # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess
 	    # => hppa64-hp-hpux11.23

-	    if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) |
+	    if echo __LP64__ | (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) |
 		grep -q __LP64__
 	    then
-		HP_ARCH="hppa2.0w"
+		HP_ARCH=hppa2.0w
 	    else
-		HP_ARCH="hppa64"
+		HP_ARCH=hppa64
 	    fi
 	fi
 	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
@@ -804,14 +814,14 @@ EOF
 	echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
 	exit ;;
    F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
-	FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
-	FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
+	FUJITSU_PROC=`uname -m | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz`
+	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
 	FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
 	echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
 	exit ;;
    5000:UNIX_System_V:4.*:*)
-	FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
-	FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'`
+	FUJITSU_SYS=`uname -p | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/\///'`
+	FUJITSU_REL=`echo ${UNAME_RELEASE} | tr ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz | sed -e 's/ /_/'`
 	echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
 	exit ;;
    i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
@@ -893,7 +903,7 @@ EOF
 	exit ;;
    *:GNU/*:*:*)
 	# other systems with GNU libc and userland
-	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
+	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr "[:upper:]" "[:lower:]"``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
 	exit ;;
    i*86:Minix:*:*)
 	echo ${UNAME_MACHINE}-pc-minix
@@ -916,7 +926,7 @@ EOF
 	  EV68*) UNAME_MACHINE=alphaev68 ;;
 	esac
 	objdump --private-headers /bin/sh | grep -q ld.so.1
-	if test "$?" = 0 ; then LIBC="gnulibc1" ; fi
+	if test "$?" = 0 ; then LIBC=gnulibc1 ; fi
 	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
    arc:Linux:*:* | arceb:Linux:*:*)
@@ -962,6 +972,9 @@ EOF
    ia64:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
+    k1om:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
    m32r*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
 	exit ;;
@@ -987,6 +1000,9 @@ EOF
 	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
 	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
 	;;
+    mips64el:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
    openrisc*:Linux:*:*)
 	echo or1k-unknown-linux-${LIBC}
 	exit ;;
@@ -1019,6 +1035,9 @@ EOF
    ppcle:Linux:*:*)
 	echo powerpcle-unknown-linux-${LIBC}
 	exit ;;
+    riscv32:Linux:*:* | riscv64:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
    s390:Linux:*:* | s390x:Linux:*:*)
 	echo ${UNAME_MACHINE}-ibm-linux-${LIBC}
 	exit ;;
@@ -1038,7 +1057,7 @@ EOF
 	echo ${UNAME_MACHINE}-dec-linux-${LIBC}
 	exit ;;
    x86_64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
 	exit ;;
    xtensa*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
@@ -1117,7 +1136,7 @@ EOF
 	# uname -m prints for DJGPP always 'pc', but it prints nothing about
 	# the processor, so we play safe by assuming i586.
 	# Note: whatever this is, it MUST be the same as what config.sub
-	# prints for the "djgpp" host, or else GDB configury will decide that
+	# prints for the "djgpp" host, or else GDB configure will decide that
 	# this is a cross-build.
 	echo i586-pc-msdosdjgpp
 	exit ;;
@@ -1266,6 +1285,9 @@ EOF
    SX-8R:SUPER-UX:*:*)
 	echo sx8r-nec-superux${UNAME_RELEASE}
 	exit ;;
+    SX-ACE:SUPER-UX:*:*)
+	echo sxace-nec-superux${UNAME_RELEASE}
+	exit ;;
    Power*:Rhapsody:*:*)
 	echo powerpc-apple-rhapsody${UNAME_RELEASE}
 	exit ;;
@@ -1279,9 +1301,9 @@ EOF
 	    UNAME_PROCESSOR=powerpc
 	fi
 	if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
-	    if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+	    if [ "$CC_FOR_BUILD" != no_compiler_found ]; then
 		if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
-		    (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		    (CCOPTS="" $CC_FOR_BUILD -E - 2>/dev/null) | \
 		    grep IS_64BIT_ARCH >/dev/null
 		then
 		    case $UNAME_PROCESSOR in
@@ -1303,7 +1325,7 @@ EOF
 	exit ;;
    *:procnto*:*:* | *:QNX:[0123456789]*:*)
 	UNAME_PROCESSOR=`uname -p`
-	if test "$UNAME_PROCESSOR" = "x86"; then
+	if test "$UNAME_PROCESSOR" = x86; then
 		UNAME_PROCESSOR=i386
 		UNAME_MACHINE=pc
 	fi
@@ -1334,7 +1356,7 @@ EOF
 	# "uname -m" is not consistent, so use $cputype instead. 386
 	# is converted to i386 for consistency with other x86
 	# operating systems.
-	if test "$cputype" = "386"; then
+	if test "$cputype" = 386; then
 	    UNAME_MACHINE=i386
 	else
 	    UNAME_MACHINE="$cputype"
@@ -1376,7 +1398,7 @@ EOF
 	echo i386-pc-xenix
 	exit ;;
    i*86:skyos:*:*)
-	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//'
+	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE} | sed -e 's/ .*$//'`
 	exit ;;
    i*86:rdos:*:*)
 	echo ${UNAME_MACHINE}-pc-rdos
@@ -1387,23 +1409,25 @@ EOF
    x86_64:VMkernel:*:*)
 	echo ${UNAME_MACHINE}-unknown-esx
 	exit ;;
+    amd64:Isilon\ OneFS:*:*)
+	echo x86_64-unknown-onefs
+	exit ;;
 esac

 cat >&2 <<EOF
 $0: unable to guess system type

-This script, last modified $timestamp, has failed to recognize
-the operating system you are using. It is advised that you
-download the most up to date version of the config scripts from
+This script (version $timestamp), has failed to recognize the
+operating system you are using. If your script is old, overwrite
+config.guess and config.sub with the latest versions from:

-  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess
 and
-  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub

-If the version you run ($0) is already up to date, please
-send the following data and any information you think might be
-pertinent to <[email protected]> in order to provide the needed
-information to handle your system.
+If $0 has already been updated, send the following data and any
+information you think might be pertinent to [email protected] to
+provide the necessary information to handle your system.

 config.guess timestamp = $timestamp

@@ -1,8 +1,8 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2015 Free Software Foundation, Inc.
+#   Copyright 1992-2017 Free Software Foundation, Inc.

-timestamp='2015-03-08'
+timestamp='2017-01-01'

 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -33,7 +33,7 @@ timestamp='2015-03-08'
 # Otherwise, we print the canonical config type on stdout and succeed.

 # You can get the latest version of this script from:
-# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub

 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
@@ -53,8 +53,7 @@ timestamp='2015-03-08'
 me=`echo "$0" | sed -e 's,.*/,,'`

 usage="\
-Usage: $0 [OPTION] CPU-MFR-OPSYS
-       $0 [OPTION] ALIAS
+Usage: $0 [OPTION] CPU-MFR-OPSYS or ALIAS

 Canonicalize a configuration name.

@@ -68,7 +67,7 @@ Report bugs and patches to <[email protected]>."
 version="\
 GNU config.sub ($timestamp)

-Copyright 1992-2015 Free Software Foundation, Inc.
+Copyright 1992-2017 Free Software Foundation, Inc.

 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -118,7 +117,7 @@ case $maybe_os in
  nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
  linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
  knetbsd*-gnu* | netbsd*-gnu* | netbsd*-eabi* | \
-  kopensolaris*-gnu* | \
+  kopensolaris*-gnu* | cloudabi*-eabi* | \
  storm-chaos* | os2-emx* | rtmk-nova*)
    os=-$maybe_os
    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
@@ -255,6 +254,7 @@ case $basic_machine in
 	| arc | arceb \
 	| arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \
 	| avr | avr32 \
+	| ba \
 	| be32 | be64 \
 	| bfin \
 	| c4x | c8051 | clipper \
@@ -301,11 +301,12 @@ case $basic_machine in
 	| open8 | or1k | or1knd | or32 \
 	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle \
+	| pru \
 	| pyramid \
 	| riscv32 | riscv64 \
 	| rl78 | rx \
 	| score \
-	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
+	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[234]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
 	| sh64 | sh64le \
 	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
 	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
@@ -376,6 +377,7 @@ case $basic_machine in
 	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \
 	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
 	| avr-* | avr32-* \
+	| ba-* \
 	| be32-* | be64-* \
 	| bfin-* | bs2000-* \
 	| c[123]* | c30-* | [cjt]90-* | c4x-* \
@@ -427,13 +429,15 @@ case $basic_machine in
 	| orion-* \
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
+	| pru-* \
 	| pyramid-* \
+	| riscv32-* | riscv64-* \
 	| rl78-* | romp-* | rs6000-* | rx-* \
 	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
 	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
 	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
 	| sparclite-* \
-	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx?-* \
+	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx*-* \
 	| tahoe-* \
 	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
 	| tile*-* \
@@ -518,7 +522,7 @@ case $basic_machine in
 		basic_machine=i386-pc
 		os=-aros
 		;;
-        asmjs)
+	asmjs)
 		basic_machine=asmjs-unknown
 		;;
 	aux)
@@ -641,6 +645,14 @@ case $basic_machine in
 		basic_machine=m68k-bull
 		os=-sysv3
 		;;
+	e500v[12])
+		basic_machine=powerpc-unknown
+		os=$os"spe"
+		;;
+	e500v[12]-*)
+		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
+		os=$os"spe"
+		;;
 	ebmon29k)
 		basic_machine=a29k-amd
 		os=-ebmon
@@ -1020,7 +1032,7 @@ case $basic_machine in
 	ppc-* | ppcbe-*)
 		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
-	ppcle | powerpclittle | ppc-le | powerpc-little)
+	ppcle | powerpclittle)
 		basic_machine=powerpcle-unknown
 		;;
 	ppcle-* | powerpclittle-*)
@@ -1030,7 +1042,7 @@ case $basic_machine in
 		;;
 	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
-	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
+	ppc64le | powerpc64little)
 		basic_machine=powerpc64le-unknown
 		;;
 	ppc64le-* | powerpc64little-*)
@@ -1376,18 +1388,18 @@ case $os in
 	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
 	      | -sym* | -kopensolaris* | -plan9* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
-	      | -aos* | -aros* | -cloudabi* \
+	      | -aos* | -aros* | -cloudabi* | -sortix* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
 	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
-	      | -bitrig* | -openbsd* | -solidbsd* \
+	      | -bitrig* | -openbsd* | -solidbsd* | -libertybsd* \
 	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* | -cegcc* \
+	      | -chorusos* | -chorusrdb* | -cegcc* | -glidix* \
 	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
+	      | -midipix* | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
 	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
 	      | -uxpv* | -beos* | -mpeix* | -udk* | -moxiebox* \
 	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
@@ -1396,7 +1408,8 @@ case $os in
 	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
 	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
 	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
-	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* | -tirtos*)
+	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es* \
+	      | -onefs* | -tirtos* | -phoenix* | -fuchsia* | -redox*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1528,6 +1541,8 @@ case $os in
 		;;
 	-nacl*)
 		;;
+	-ios)
+		;;
 	-none)
 		;;
 	*)
@@ -1623,6 +1638,9 @@ case $basic_machine in
 	sparc-* | *-sun)
 		os=-sunos4.1.1
 		;;
+	pru-*)
+		os=-elf
+		;;
 	*-be)
 		os=-beos
 		;;
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for file 5.29.
+# Generated by GNU Autoconf 2.69 for file 5.32.
 #
 # Report bugs to <[email protected]>.
 #
@@ -590,8 +590,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='file'
 PACKAGE_TARNAME='file'
-PACKAGE_VERSION='5.29'
-PACKAGE_STRING='file 5.29'
+PACKAGE_VERSION='5.32'
+PACKAGE_STRING='file 5.32'
 PACKAGE_BUGREPORT='[email protected]'
 PACKAGE_URL=''

@@ -1328,7 +1328,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures file 5.29 to adapt to many kinds of systems.
+\`configure' configures file 5.32 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1398,7 +1398,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of file 5.29:";;
+     short | recursive ) echo "Configuration of file 5.32:";;
   esac
  cat <<\_ACEOF

@@ -1509,7 +1509,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-file configure 5.29
+file configure 5.32
 generated by GNU Autoconf 2.69

 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2165,7 +2165,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by file $as_me 5.29, which was
+It was created by file $as_me 5.32, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  $ $0 $@
@@ -3031,7 +3031,7 @@ fi

 # Define the identity of the package.
 PACKAGE='file'
- VERSION='5.29'
+ VERSION='5.32'


 cat >>confdefs.h <<_ACEOF
@@ -15075,7 +15075,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by file $as_me 5.29, which was
+This file was extended by file $as_me 5.32, which was
 generated by GNU Autoconf 2.69.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -15141,7 +15141,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-file config.status 5.29
+file config.status 5.32
 configured by $0, generated by GNU Autoconf 2.69,
  with options \\"\$ac_cs_config\\"

@@ -1,5 +1,5 @@
 dnl Process this file with autoconf to produce a configure script.
-AC_INIT([file],[5.29],[[email protected]])
+AC_INIT([file],[5.32],[[email protected]])
 AM_INIT_AUTOMAKE([subdir-objects foreign])
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])

@@ -1,4 +1,4 @@
-.\" $File: file.man,v 1.124 2016/10/19 20:52:45 christos Exp $
+.\" $File: file.man,v 1.125 2017/01/03 11:24:46 christos Exp $
 .Dd October 19, 2016
 .Dt FILE __CSECTION__
 .Os
@@ -238,8 +238,8 @@ or at least one filename argument must be present;
 to test the standard input, use
 .Sq -
 as a filename argument.
-Please note that 
-.Ar namefile 
+Please note that
+.Ar namefile
 is unwrapped and the enclosed filenames are processed when this option is
 encountered and before any further options processing is done.
 This allows one to process multiple lists of files with different command line
@@ -411,10 +411,10 @@ and
 .Fl h
 options.
 .Sh SEE ALSO
-.Xr magic __FSECTION__ ,
 .Xr hexdump 1 ,
 .Xr od 1 ,
 .Xr strings 1 ,
+.Xr magic __FSECTION__ ,
 .Xr fstyp 8
 .Sh STANDARDS CONFORMANCE
 This program is believed to exceed the System V Interface Definition
@@ -531,16 +531,15 @@ John Gilmore revised the code extensively, making it better than
 the first version.
 Geoff Collyer found several inadequacies
 and provided some magic file entries.
-Contributions by the
+Contributions of the
 .Sq \*[Am]
 operator by Rob McMahon, 
 .Aq [email protected] ,
 1989.
 .Pp
-Guy Harris, 
+Guy Harris,
 .Aq [email protected] ,
 made many changes from 1993 to the present.
-1989.
 .Pp
 Primary development and maintenance from 1990 to the present by
 Christos Zoulas
@@ -588,7 +587,6 @@ program, and are not covered by the above license.
 .Nm
 returns 0 on success, and non-zero on error.
 .Sh BUGS
-.Pp
 Please report bugs and send patches to the bug tracker at
 .Pa http://bugs.gw.com/
 or the mailing list at
@@ -597,7 +595,6 @@ or the mailing list at
 .Pa http://mx.gw.com/mailman/listinfo/file
 first to subscribe).
 .Sh TODO
-.Pp
 Fix output so that tests for MIME and APPLE flags are not needed all
 over the place, and actual output is only done in one place.
 This needs a design.
@@ -646,16 +643,16 @@ Fix
 .Dq name
 and
 .Dq use
-to check for consistency at compile time (duplicate 
+to check for consistency at compile time (duplicate
 .Dq name ,
 .Dq use
 pointing to undefined
 .Dq name
 ).
-Make 
+Make
 .Dq name
 /
-.Dq use 
+.Dq use
 more efficient by keeping a sorted list of names.
 Special-case ^ to flip endianness in the parser so that it does not
 have to be escaped, and document it.
@@ -1,4 +1,4 @@
-.\" $File: libmagic.man,v 1.40 2016/03/31 17:51:12 christos Exp $
+.\" $File: libmagic.man,v 1.41 2017/05/23 21:54:07 christos Exp $
 .\"
 .\" Copyright (c) Christos Zoulas 2003.
 .\" All Rights Reserved.
@@ -25,7 +25,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd September 11, 2015
+.Dd May 23, 2017
 .Dt LIBMAGIC 3
 .Os
 .Sh NAME
@@ -35,6 +35,7 @@
 .Nm magic_errno ,
 .Nm magic_descriptor ,
 .Nm magic_buffer ,
+.Nm magic_getflags ,
 .Nm magic_setflags ,
 .Nm magic_check ,
 .Nm magic_compile ,
@@ -64,6 +65,8 @@
 .Ft const char *
 .Fn magic_buffer "magic_t cookie" "const void *buffer" "size_t length"
 .Ft int
+.Fn magic_getflags "magic_t cookie"
+.Ft int
 .Fn magic_setflags "magic_t cookie" "int flags"
 .Ft int
 .Fn magic_check "magic_t cookie" "const char *filename"
@@ -206,6 +209,12 @@ argument with
 bytes size.
 .Pp
 The
+.Fn magic_getflags
+functions returns a value representing current
+.Ar flags
+set.
+.Pp
+The
 .Fn magic_setflags
 function sets the
 .Ar flags
@@ -1,5 +1,5 @@
-.\" $File: magic.man,v 1.88 2016/07/27 09:42:49 rrt Exp $
-.Dd July 20, 2016
+.\" $File: magic.man,v 1.91 2017/02/12 15:30:08 christos Exp $
+.Dd February 12, 2017
 .Dt MAGIC __FSECTION__
 .Os
 .\" install as magic.4 on USG, magic.5 on V7, Berkeley and Linux systems.
@@ -7,7 +7,7 @@
 .Nm magic
 .Nd file command's magic pattern file
 .Sh DESCRIPTION
-This manual page documents the format of the magic file as
+This manual page documents the format of magic files as
 used by the
 .Xr file __CSECTION__
 command, version __VERSION__.
@@ -17,13 +17,19 @@ command identifies the type of a file using,
 among other tests,
 a test for whether the file contains certain
 .Dq "magic patterns" .
-The file
-.Pa __MAGIC__
-specifies what patterns are to be tested for, what message or
+The database of these
+.Dq "magic patterns"
+is usually located in a binary file in
+.Pa __MAGIC__.mgc
+or a directory of source text magic pattern fragment files in
+.Pa __MAGIC__ .
+The database specifies what patterns are to be tested for, what message or
 MIME type to print if a particular pattern is found,
 and additional information to extract from the file.
 .Pp
-Each line of the file specifies a test to be performed.
+The format of the source fragment files that are used to build this database
+is as follows:
+Each line of a fragment file specifies a test to be performed.
 A test compares the data starting at a particular offset
 in the file with a byte value, a string or a numeric value.
 If the test succeeds, a message is printed.
@@ -98,13 +104,13 @@ The following modifiers are supported:
 .It B
 A byte length (default).
 .It H
-A 2 byte big endian length.
-.It h
-A 2 byte big little length.
-.It L
 A 4 byte big endian length.
+.It h
+A 2 byte big endian length.
+.It L
+A 4 byte little endian length.
 .It l
-A 4 byte big little length.
+A 2 byte little endian length.
 .It J
 The length includes itself in its count.
 .El
@@ -651,7 +657,7 @@ start of the main indirect offset.
 \*[Gt]\*[Gt]\*[Gt]\*[Gt](\*[Am]0xe.l+(-4)) string       PK\e3\e4 \eb, ZIP self-extracting archive
 .Ed
 .Pp
-If you have a list of known avalues at a particular continuation level,
+If you have a list of known values at a particular continuation level,
 and you want to provide a switch-like default case:
 .Bd -literal -offset indent
 # clear that continuation level match
@@ -2,6 +2,6 @@
 #------------------------------------------------------------------------------
 # Localstuff:  file(1) magic for locally observed files
 #
-# $File: Localstuff,v 1.4 2003/03/23 04:17:27 christos Exp $
+# $File: Localstuff,v 1.5 2007/01/12 17:38:27 christos Exp $
 # Add any locally observed files here.  Remember:
 # text if readable, executable if runnable binary, data if unreadable.
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: adventure,v 1.15 2015/09/07 10:03:21 christos Exp $
+# $File: adventure,v 1.17 2017/07/03 16:03:40 christos Exp $
 # adventure: file(1) magic for Adventure game files
 #
 # from Allen Garvin <[email protected]>
@@ -36,11 +36,12 @@
 >0	ubyte			<9
 >>16	belong&0xfe00f0f0	0x3030
 >>>0	ubyte			< 10
->>>>2	ubeshort		< 10
+>>>>2	ubeshort		x
 >>>>>18	regex			[0-9][0-9][0-9][0-9][0-9][0-9]
->>>>>>0	ubyte			< 10	Infocom (Z-machine %d,
->>>>>>>2	ubeshort	< 10 	Release %d /
->>>>>>>>18	string		>\0	Serial %.6s)
+>>>>>>0	ubyte			< 10	Infocom (Z-machine %d
+>>>>>>>2	ubeshort	x 	\b, Release %d
+>>>>>>>>18	string		>\0	\b, Serial %.6s
+>>>>>>>>18	string		x	\b)
 !:strength + 40
 !:mime	application/x-zmachine

@@ -78,7 +79,7 @@
 !:mime	application/x-tads
 #  Some saved game files start with "TADS2 save/g\n\r\032\0", a little-endian
 #  2-byte length N, the N-char name of the game file *without* a NUL (darn!),
-# "TADS2 save\n\r\032\0" and the interpreter version. 
+# "TADS2 save\n\r\032\0" and the interpreter version.
 0	string	TADS2\ save/g	TADS
 >12	belong	!0x0A0D1A00	saved game data, CORRUPTED
 >12	belong	 0x0A0D1A00
@@ -109,7 +110,7 @@
 # edited by David Griffith <[email protected]>
 # Danny Milosavljevic <[email protected]>
 # These are ADRIFT (adventure game standard) game files, extension .taf
-# Checked from source at (http://www.adrift.co/) and various taf files 
+# Checked from source at (http://www.adrift.co/) and various taf files
 # found at the Interactive Fiction Archive (http://ifarchive.org/)
 0	belong  0x3C423FC9
 >4	belong  0x6A87C2CF	Adrift game file version
@@ -1,9 +1,9 @@

 #------------------------------------------------------------------------------
-# $File: amanda,v 1.5 2009/09/19 16:28:07 christos Exp $
+# $File: amanda,v 1.6 2017/03/17 21:35:28 christos Exp $
 # amanda:  file(1) magic for amanda file format
 #
-0	string	AMANDA:\ 		AMANDA 
+0	string	AMANDA:\ 		AMANDA
 >8	string	TAPESTART\ DATE		tape header file,
 >>23	string	X
 >>>25	string	>\ 			Unused %s
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: amigaos,v 1.15 2012/06/21 01:13:59 christos Exp $
+# $File: amigaos,v 1.16 2017/03/17 21:35:28 christos Exp $
 # amigaos:  file(1) magic for AmigaOS binary formats:

 #
@@ -11,7 +11,7 @@
 0	belong		0x000003e7	AmigaOS object/library data
 #
 0	beshort		0xe310		Amiga Workbench
->2	beshort		1		
+>2	beshort		1
 >>48	byte		1		disk icon
 >>48	byte		2		drawer icon
 >>48	byte		3		tool icon
@@ -49,7 +49,7 @@
 0	string/c	@database	AmigaGuide file

 # Amiga disk types
-# 
+#
 0	string		RDSK		Rigid Disk Block
 >160	string		x		on %.24s
 0	string		DOS\0		Amiga DOS disk
@@ -1,6 +1,6 @@

 #------------------------------------------------------------
-# $File: android,v 1.9 2016/01/11 21:19:18 christos Exp $
+# $File: android,v 1.10 2017/03/17 21:35:28 christos Exp $
 # Various android related magic entries
 #------------------------------------------------------------

@@ -61,9 +61,9 @@
 # http://forum.xda-developers.com/showthread.php?t=816449
 # Partition Information Table for Samsung's smartphone with Android
 # used by flash software Odin
-0		ulelong			0x12349876	
+0		ulelong			0x12349876
 # 1st pit entry marker
->0x01C	ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000	
+>0x01C	ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
 # minimal 13 and maximal 18 PIT entries found
 >>4		ulelong			<128	Partition Information Table for Samsung smartphone
 >>>4		ulelong			x	\b, %d entries
@@ -109,9 +109,9 @@

 0	name			PIT-entry
 # garbage value implies end of pit entries
->0x00		ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000	
+>0x00		ulequad&0xFFFFFFFCFFFFFFFC	=0x0000000000000000
 # skip empty partition name
->>0x24		ubyte				!0			
+>>0x24		ubyte				!0
 # partition name
 >>>0x24		string				>\0			%-.32s
 # flags
@@ -122,7 +122,7 @@
 >>>0x08	ulelong		x			(0x%x)
 # filename
 >>>0x44		string				>\0			"%-.64s"
-#>>>0x18	ulelong				>0			
+#>>>0x18	ulelong				>0
 # blocksize in 512 byte units ?
 #>>>>0x18	ulelong				x			\b, %db
 # partition size in blocks ?
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: animation,v 1.58 2016/07/03 14:13:11 christos Exp $
+# $File: animation,v 1.63 2017/05/26 14:33:07 christos Exp $
 # animation:  file(1) magic for animation/movie formats
 #
 # animation formats
@@ -34,14 +34,23 @@
 !:mime	image/jp2
 # http://www.ftyps.com/ with local additions
 4	string		ftyp		ISO Media
+# http://aeroquartet.com/wordpress/2016/03/05/3-xavc-s/
+>8	string		XAVC		\b, MPEG v4 system, Sony XAVC Codec
+>>96	string		x		\b, Audio "%.4s"
+>>118	beshort		x		at %dHz
+>>140	string		x		\b, Video "%.4s"
+>>168	beshort		x		%d
+>>170	beshort		x		\bx%d
 >8	string		3g2		\b, MPEG v4 system, 3GPP2
 !:mime	video/3gpp2
 >>11	byte		4		\b v4 (H.263/AMR GSM 6.10)
 >>11	byte		5		\b v5 (H.263/AMR GSM 6.10)
 >>11	byte		6		\b v6 (ITU H.264/AMR GSM 6.10)
->>11	byte		a		\b C.S0050-0 V1.0
->>11	byte		b		\b C.S0050-0-A V1.0.0
->>11	byte		c		\b C.S0050-0-B V1.0
+# http://www.3gpp2.org/Public_html/Specs/C.S0050-B_v1.0_070521.pdf
+# Section 8.1.1, corresponds to a, b, c
+>>11	byte		0x61		\b C.S0050-0 V1.0
+>>11	byte		0x62		\b C.S0050-0-A V1.0.0
+>>11	byte		0x63		\b C.S0050-0-B V1.0
 >8	string		3ge		\b, MPEG v4 system, 3GPP
 !:mime	video/3gpp
 >>11	byte		6		\b, Release 6 MBMS Extended Presentations
@@ -186,13 +195,13 @@

 # MPEG sequences
 # Scans for all common MPEG header start codes
-0	 belong		    0x00000001     
+0	 belong		    0x00000001
 >4	 byte&0x1F	    0x07	   JVT NAL sequence, H.264 video
 >>5      byte               66             \b, baseline
 >>5      byte               77             \b, main
 >>5      byte               88             \b, extended
 >>7      byte               x              \b @ L %u
-0        belong&0xFFFFFF00  0x00000100     
+0        belong&0xFFFFFF00  0x00000100
 >3       byte               0xBA           MPEG sequence
 !:mime  video/mpeg
 >>4      byte               &0x40          \b, v2, program multiplex
@@ -493,8 +502,8 @@
 # GRR the original test are too common for many DOS files, so test 32 <= kbits <= 448
 # GRR this test is still too general as it catches a BOM of UTF-16 files (0xFFFE)
 # FIXME: Almost all little endian UTF-16 text with BOM are clobbered by these entries
-#0	beshort&0xFFFE		0xFFFE	
-#>2	ubyte&0xF0	>0x0F		
+#0	beshort&0xFFFE		0xFFFE
+#>2	ubyte&0xF0	>0x0F
 #>>2	ubyte&0xF0	<0xE1		MPEG ADTS, layer I, v1
 ## rate
 #>>>2      byte&0xF0       0x10           \b,  32 kbps
@@ -566,9 +575,9 @@
 # MP2, M2A
 0       beshort&0xFFFE  0xFFF4         MPEG ADTS, layer II, v2
 !:mime	audio/mpeg
-# rate 
+# rate
 >2      byte&0xF0       0x10           \b,   8 kbps
->2      byte&0xF0       0x20           \b,  16 kbps 
+>2      byte&0xF0       0x20           \b,  16 kbps
 >2      byte&0xF0       0x30           \b,  24 kbps
 >2      byte&0xF0       0x40           \b,  32 kbps
 >2      byte&0xF0       0x50           \b,  40 kbps
@@ -636,7 +645,7 @@
 # MP3, M25A
 0       beshort&0xFFFE  0xFFE2         MPEG ADTS, layer III,  v2.5
 !:mime	audio/mpeg
-# rate  
+# rate
 >2      byte&0xF0       0x10           \b,   8 kbps
 >2      byte&0xF0       0x20           \b,  16 kbps
 >2      byte&0xF0       0x30           \b,  24 kbps
@@ -855,10 +864,12 @@

 # X3D (Extensible 3D) [http://www.web3d.org/specifications/x3d-3.0.dtd]
 # From Michel Briand <[email protected]>
-0	string/t		\<?xml\ version="
-!:strength +1
->20	search/1000/cw  \<!DOCTYPE\ X3D		X3D (Extensible 3D) model xml text
-!:mime model/x3d
+# mimetype from https://www.iana.org/assignments/media-types/model/x3d+xml
+# Example http://www.web3d.org/x3d/content/examples/Basic/course/CreateX3DFromStringRandomSpheres.x3d
+0	string/w	\<?xml\ version=
+!:strength + 5
+>20	search/1000/w	\<!DOCTYPE\ X3D		X3D (Extensible 3D) model xml text
+!:mime model/x3d+xml

 #---------------------------------------------------------------------------
 # HVQM4: compressed movie format designed by Hudson for Nintendo GameCube
@@ -0,0 +1,28 @@
+
+#------------------------------------------------------------------------------
+# $File: apache,v 1.1 2017/04/11 14:52:15 christos Exp $
+# apache: file(1) magic for Apache Big Data formats
+
+# Avro files
+0	string		Obj		Apache Avro
+>3	byte		x		version %d
+
+# ORC files
+# Important information is in file footer, which we can't index to :(
+0	string		ORC		Apache ORC
+
+# Parquet files
+0	string		PAR1		Apache Parquet
+
+# Hive RC files
+0	string		RCF		Apache Hive RC file
+>3	byte		x		version %d
+
+# Sequence files (and the careless first version of RC file)
+
+0	string		SEQ
+>3	byte		<6		Apache Hadoop Sequence file version %d
+>3	byte		>6		Apache Hadoop Sequence file version %d
+>3	byte		=6
+>>5	string		org.apache.hadoop.hive.ql.io.RCFile$KeyBuffer  Apache Hive RC file version 0
+>>3	default		x		Apache Hadoop Sequence file version 6
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: apple,v 1.35 2016/08/17 09:45:13 christos Exp $
+# $File: apple,v 1.36 2017/03/17 21:35:28 christos Exp $
 # apple:  file(1) magic for Apple file formats
 #
 0	search/1/t	FiLeStArTfIlEsTaRt	binscii (apple ][) text
@@ -67,15 +67,15 @@
 # AppleWorks word processor:
 # URL: https://en.wikipedia.org/wiki/AppleWorks
 # Reference: http://www.gno.org/pub/apple2/doc/apple/filetypes/ftn.1a.xxxx
-# Update: Joerg Jenderek 
+# Update: Joerg Jenderek
 # NOTE:
 # The "O" is really the magic number, but that's so common that it's
 # necessary to check the tab stops that follow it to avoid false positives.
 # and/or look for unused bits of booleans bytes like zoom, paginated, mail merge
 # the newer AppleWorks is from claris with extension CWK
-4	string		O	
+4	string		O
 # test for unused bits of zoom- , paginated-boolean bytes
->84	ubequad		^0x00Fe00000000Fe00		
+>84	ubequad		^0x00Fe00000000Fe00
 # look for tabstop definitions "=" no tab, "|" no tab
 # "<" left tab,"^" center tab,">" right tab, "." decimal tab,
 # unofficial "!" other , "\x8a" other
@@ -92,9 +92,9 @@
 !:ext awp
 # minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
 >>>183	ubyte		30	3.0
->>>183	ubyte		!30	
+>>>183	ubyte		!30
 >>>>183	ubyte		!0	0x%x
-# usual tabstop start sequence "=====<" 
+# usual tabstop start sequence "=====<"
 >>>5	string		x	\b, tabstop ruler "%6.6s"
 # tabstop ruler
 #>>>5	string		>\0	\b, tabstops "%-79s"
@@ -105,7 +105,7 @@
 # contains any mail-merge commands
 >>>92	  byte&0x01	>0	\b, with mail merge
 # left margin in 1/10 inches ( normally 0 or 10 )
->>>91	ubyte		>0	
+>>>91	ubyte		>0
 >>>>91	ubyte		x	\b, %d/10 inch left margin

 # AppleWorks database:
@@ -140,13 +140,13 @@

 # GRR: this test is still too general as it catches also Gujin BOOT144.SYS (0xfa080000)
 #0       belong&0xff00ff 0x80000 Applesoft BASIC program data
-0	belong&0x00ff00ff	0x00080000	
+0	belong&0x00ff00ff	0x00080000
 # assuming that line number must be positive
 >2	leshort			>0		Applesoft BASIC program data, first line number %d
 #>2     leshort         x       \b, first line number %d

 # ORCA/EZ assembler:
-# 
+#
 # This will not identify ORCA/M source files, since those have
 # some sort of date code instead of the two zero bytes at 6 and 7
 # XXX Conflicts with ELF
@@ -186,18 +186,18 @@
 # From Johan Gade.
 # These entries are disabled for now until we fix the following issues.
 #
-# Note there might be some problems with the "VAX COFF executable" 
-# entry. Note this entry should be placed before the mac filesystem section, 
+# Note there might be some problems with the "VAX COFF executable"
+# entry. Note this entry should be placed before the mac filesystem section,
 # particularly the "Apple Partition data" entry.
 #
-# The intended meaning of these tests is, that the file is only of the 
+# The intended meaning of these tests is, that the file is only of the
 # specified type if both of the lines are correct - i.e. if the first
 # line matches and the second doesn't then it is not of that type.
 #
 #0	long	0x7801730d
 #>4	long	0x62626060	UDIF read-only zlib-compressed image (UDZO)
 #
-# Note that this entry is recognized correctly by the "Apple Partition 
+# Note that this entry is recognized correctly by the "Apple Partition
 # data" entry - however since this entry is more specific - this
 # information seems to be more useful.
 #0	long	0x45520200
@@ -288,7 +288,7 @@
 # Apple disk partition stuff
 # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
 # Reference: https://ftp.netbsd.org/pub/NetBSD/NetBSD-current/src/sys/sys/bootblock.h
-# Update: Joerg Jenderek 
+# Update: Joerg Jenderek
 # "ER" is APPLE_DRVR_MAP_MAGIC signature
 0	beshort	0x4552
 # display Apple Driver Map (strength=50) after Syslinux bootloader (71)
@@ -315,7 +315,7 @@
 # device id 0 1 (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
 >>10	ubeshort	x		\b, devid %u
 # driver data 0 (2425393296 garbage for super_grub2_disk_hybrid_2.02s3.iso)
->>12	ubelong		>0		
+>>12	ubelong		>0
 >>>12	ubelong		x		\b, driver data %u
 # number of driver descriptors sbDrvrCount <= 61
 # (37008 garbage for super_grub2_disk_hybrid_2.02s3.iso)
@@ -327,26 +327,26 @@
 # >>500	use		apple-driver-map
 # number of partitions is always same in every partition (map block count)
 #>>0x0204	ubelong		x	\b, %u partitions
->>0x0204	ubelong		>0	\b, contains[@0x200]: 
+>>0x0204	ubelong		>0	\b, contains[@0x200]:
 >>>0x0200	use		apple-apm
->>0x0204	ubelong		>1	\b, contains[@0x400]: 
+>>0x0204	ubelong		>1	\b, contains[@0x400]:
 >>>0x0400	use		apple-apm
->>0x0204	ubelong		>2	\b, contains[@0x600]: 
+>>0x0204	ubelong		>2	\b, contains[@0x600]:
 >>>0x0600	use		apple-apm
->>0x0204	ubelong		>3	\b, contains[@0x800]: 
+>>0x0204	ubelong		>3	\b, contains[@0x800]:
 >>>0x0800	use		apple-apm
->>0x0204	ubelong		>4	\b, contains[@0xA00]: 
+>>0x0204	ubelong		>4	\b, contains[@0xA00]:
 >>>0x0A00	use		apple-apm
->>0x0204	ubelong		>5	\b, contains[@0xC00]: 
+>>0x0204	ubelong		>5	\b, contains[@0xC00]:
 >>>0x0C00	use		apple-apm
->>0x0204	ubelong		>6	\b, contains[@0xE00]: 
+>>0x0204	ubelong		>6	\b, contains[@0xE00]:
 >>>0x0E00	use		apple-apm
->>0x0204	ubelong		>7	\b, contains[@0x1000]: 
+>>0x0204	ubelong		>7	\b, contains[@0x1000]:
 >>>0x1000	use		apple-apm
 #	display apple driver descriptor map (start-block, # blocks in sbBlkSize sizes, type)
 0	name				apple-driver-map
->0	ubequad		!0		
-# descBlock first block of driver 
+>0	ubequad		!0
+# descBlock first block of driver
 >>0	ubelong	x			\b, driver start block %u
 # descSize driver size in blocks
 >>4	ubeshort	x		\b, size %u
@@ -355,11 +355,11 @@

 # URL: https://en.wikipedia.org/wiki/Apple_Partition_Map
 # Reference: http://opensource.apple.com/source/IOStorageFamily/IOStorageFamily-116/IOApplePartitionScheme.h
-# Update: Joerg Jenderek 
+# Update: Joerg Jenderek
 # Yes, the 3rd and 4th bytes pmSigPad are reserved, but we use them to make the
 # magic stronger.
 # for apple partition map stored as a single file
-0	belong	0x504d0000		
+0	belong	0x504d0000
 # to display Apple Partition Map (strength=70) after Syslinux bootloader (71)
 #!:strength +0
 >0	use		apple-apm
@@ -417,7 +417,7 @@
 0	name			appleworks
 >0	belong&0x00ffffff	0x07e100	AppleWorks CWK Document
 >0	belong&0x00ffffff	0x008803	ClarisWorks CWK Document
->0	default			x	
+>0	default			x
 >>0	belong			x		AppleWorks/ClarisWorks CWK Document
 >0	byte			x		\b, version %d
 >30	beshort			x		\b, %d
@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: archive,v 1.103 2016/05/05 17:07:40 christos Exp $
+# $File: archive,v 1.108 2017/08/30 13:45:10 christos Exp $
 # archive:  file(1) magic for archive formats (see also "msdos" for self-
 #           extracting compressed archives)
 #
@@ -249,9 +249,9 @@
 # URL: http://fileformats.archiveteam.org/wiki/TTComp_archive
 # Update: Joerg Jenderek
 # GRR: line below is too general as it matches also Panorama database "TCDB 2003-10 demo.pan", others
-0	string	\0\6 
+0	string	\0\6
 # look for first keyword of Panorama database *.pan
->12	search/261	DESIGN	
+>12	search/261	DESIGN
 # skip keyword with low entropy
 >12	default		x	TTComp archive, binary, 4K dictionary
 # (version 5.25) labeled the above entry as "TTComp archive data"
@@ -447,9 +447,9 @@
 0	string	SZ\x0a\4 SZip archive data
 # XPack DiskImage
 # *.XDI updated by Joerg Jenderek Sep 2015
-# ftp://ftp.sac.sk/pub/sac/pack/0index.txt 
+# ftp://ftp.sac.sk/pub/sac/pack/0index.txt
 # GRR: this test is still too general as it catches also text files starting with jm
-0	string	jm	
+0	string	jm
 # only found examples with this additional characteristic 2 bytes
 >2	string	\x2\x4	Xpack DiskImage archive data
 #!:ext xdi
@@ -462,7 +462,7 @@
 # ftp://ftp.elf.stuba.sk/pub/pc/pack/xpa32.zip
 # created by XPA32.EXE version 1.0.2 for Windows
 >0	string	xpa\0\1 \b32 archive data
-# created by XPACK.COM version 1.67m or 1.67r with short 0x1800 
+# created by XPACK.COM version 1.67m or 1.67r with short 0x1800
 >3	ubeshort	!0x0001	\bck archive data
 # XPack Single Data
 # changed by Joerg Jenderek Sep 2015 back to like in version 5.12
@@ -552,7 +552,7 @@
 >>0x36	string		>\0			fstype %.8s

 # LHARC/LHA archiver (Greg Roelofs, [email protected])
-# Update: Joerg Jenderek 
+# Update: Joerg Jenderek
 # URL: https://en.wikipedia.org/wiki/LHA_(file_format)
 # Reference: http://web.archive.org/web/20021005080911/http://www.osirusoft.com/joejared/lzhformat.html
 #
@@ -561,14 +561,14 @@
 # check 1st character of method id like -lz4- -lh5- or -pm2-
 >2	string		-
 # check 5th character of method id
->>6	string		-		
+>>6	string		-
 # check header level 0 1 2 3
->>>20	ubyte		<4		
+>>>20	ubyte		<4
 # check 2nd, 3th and 4th character of method id
 >>>>3	regex		\^(lh[0-9a-ex]|lz[s2-8]|pm[012]|pc1)		\b 
 !:mime	application/x-lzh-compressed
 # creator type "LHA "
-!:apple	????LHA 
+!:apple	????LHA
 # display archive type name like "LHa/LZS archive data" or "LArc archive"
 >>>>>2	string		-lz		\b 
 !:ext	lzs
@@ -578,7 +578,7 @@
 # missing -lz?- with wikipedia names
 >>>>>>3	regex	\^lz[2378]	LArc archive
 # display archive type name like "LHa (2.x) archive data"
->>>>>2	string		-lh		\b 
+>>>>>2	string		-lh		\b
 # already known -lh0- -lh1- -lh2- -lh3-  -lh4- -lh5- -lh6- -lh7- -lhd- variants with old names
 >>>>>>3	regex		\^lh[01]	LHarc 1.x/ARX archive data
 # LHice archiver use ".ICE" as name extension instead usual one ".lzh"
@@ -614,28 +614,28 @@
 #	check and display information of lharc header
 0	name				lharc-header
 # header size 0x4 , 0x1b-0x61
->0	ubyte		x		
+>0	ubyte		x
 # compressed data size != compressed file size
 #>7	ulelong		x		\b, data size %d
-# attribute: 0x2~?? 0x10~symlink|target 0x20~normal 
+# attribute: 0x2~?? 0x10~symlink|target 0x20~normal
 #>19	ubyte		x		\b, 19_0x%x
 # level identifier 0 1 2 3
 #>20	ubyte		x		\b, level %d
 # time stamp
 #>15		ubelong	x		DATE 0x%8.8x
 # OS ID for level 1
->20	ubyte		1		
+>20	ubyte		1
 # 0x20 types find for *.rom files
 >>(21.b+24)	ubyte	<0x21		\b, 0x%x OS
 # ascii type like M for MSDOS
 >>(21.b+24)	ubyte	>0x20		\b, '%c' OS
 # OS ID for level 2
->20	ubyte		2		
+>20	ubyte		2
 #>>23	ubyte		x		\b, OS ID 0x%x
 >>23	ubyte		<0x21		\b, 0x%x OS
 >>23	ubyte		>0x20		\b, '%c' OS
 # filename only for level 0 and 1
->20	ubyte		<2		
+>20	ubyte		<2
 # length of filename
 >>21		ubyte	>0		\b, with
 # filename
@@ -643,73 +643,73 @@
 #
 #2	string		-lh0-		LHarc 1.x/ARX archive data [lh0]
 #!:mime	application/x-lharc
-2	string		-lh0-		
+2	string		-lh0-
 >0	use	lharc-file
 #2	string		-lh1-		LHarc 1.x/ARX archive data [lh1]
 #!:mime	application/x-lharc
-2	string		-lh1-		
+2	string		-lh1-
 >0	use	lharc-file
 # NEW -lz2- ... -lz8-
-2	string		-lz2-		
+2	string		-lz2-
 >0	use	lharc-file
-2	string		-lz3-		
+2	string		-lz3-
 >0	use	lharc-file
-2	string		-lz4-		
+2	string		-lz4-
 >0	use	lharc-file
-2	string		-lz5-		
+2	string		-lz5-
 >0	use	lharc-file
-2	string		-lz7-		
+2	string		-lz7-
 >0	use	lharc-file
-2	string		-lz8-		
+2	string		-lz8-
 >0	use	lharc-file
 #	[never seen any but the last; -lh4- reported in comp.compression:]
 #2	string		-lzs-		LHa/LZS archive data [lzs]
-2	string		-lzs-		
+2	string		-lzs-
 >0	use	lharc-file
 # According to wikipedia and others such a version does not exist
 #2	string		-lh\40-		LHa 2.x? archive data [lh ]
 #2	string		-lhd-		LHa 2.x? archive data [lhd]
-2	string		-lhd-		
+2	string		-lhd-
 >0	use	lharc-file
 #2	string		-lh2-		LHa 2.x? archive data [lh2]
-2	string		-lh2-		
+2	string		-lh2-
 >0	use	lharc-file
 #2	string		-lh3-		LHa 2.x? archive data [lh3]
-2	string		-lh3-		
+2	string		-lh3-
 >0	use	lharc-file
 #2	string		-lh4-		LHa (2.x) archive data [lh4]
-2	string		-lh4-		
+2	string		-lh4-
 >0	use	lharc-file
 #2	string		-lh5-		LHa (2.x) archive data [lh5]
-2	string		-lh5-		
+2	string		-lh5-
 >0	use	lharc-file
 #2	string		-lh6-		LHa (2.x) archive data [lh6]
-2	string		-lh6-		
+2	string		-lh6-
 >0	use	lharc-file
 #2	string		-lh7-		LHa (2.x)/LHark archive data [lh7]
-2	string		-lh7-		
+2	string		-lh7-
 # !:mime	application/x-lha
 # >20	byte		x		- header level %d
 >0	use	lharc-file
 # NEW -lh8- ... -lhe- , -lhx-
-2	string		-lh8-		
+2	string		-lh8-
 >0	use	lharc-file
-2	string		-lh9-		
+2	string		-lh9-
 >0	use	lharc-file
-2	string		-lha-		
+2	string		-lha-
 >0	use	lharc-file
-2	string		-lhb-		
+2	string		-lhb-
 >0	use	lharc-file
-2	string		-lhc-		
+2	string		-lhc-
 >0	use	lharc-file
-2	string		-lhe-		
+2	string		-lhe-
 >0	use	lharc-file
-2	string		-lhx-		
+2	string		-lhx-
 >0	use	lharc-file
 # taken from idarc [JW]
 2   string      -lZ         PUT archive data
 # already done by LHarc magics
-# this should never happen if all sub types of LZS archive are identified 
+# this should never happen if all sub types of LZS archive are identified
 #2   string      -lz         LZS archive data
 2   string      -sw1-       Swag archive data

@@ -908,7 +908,17 @@
 >>>4	byte		0x0a		\b, at least v1.0 to extract
 >>>4	byte		0x0b		\b, at least v1.1 to extract
 >>>4	byte		0x14		\b, at least v2.0 to extract
+>>>4	byte		0x15		\b, at least v2.1 to extract
+>>>4	byte		0x19		\b, at least v2.5 to extract
+>>>4	byte		0x1b		\b, at least v2.7 to extract
 >>>4	byte		0x2d		\b, at least v4.5 to extract
+>>>4	byte		0x2e		\b, at least v4.6 to extract
+>>>4	byte		0x32		\b, at least v5.0 to extract
+>>>4	byte		0x33		\b, at least v5.1 to extract
+>>>4	byte		0x34		\b, at least v5.2 to extract
+>>>4	byte		0x3d		\b, at least v6.1 to extract
+>>>4	byte		0x3e		\b, at least v6.2 to extract
+>>>4	byte		0x3f		\b, at least v6.3 to extract
 >>>0x161	string		WINZIP		\b, WinZIP self-extracting

 # StarView Metafile
@@ -940,17 +950,17 @@
 0       string  \0\ \ \ \ \ \ \ \ \ \ \ \0\0    LBR archive data
 #
 # PMA (CP/M derivative of LHA)
-# Update: Joerg Jenderek 
+# Update: Joerg Jenderek
 # URL: https://en.wikipedia.org/wiki/LHA_(file_format)
 #
 #2       string          -pm0-           PMarc archive data [pm0]
-2	string		-pm0-		
+2	string		-pm0-
 >0	use	lharc-file
 #2       string          -pm1-           PMarc archive data [pm1]
-2	string		-pm1-		
+2	string		-pm1-
 >0	use	lharc-file
 #2       string          -pm2-           PMarc archive data [pm2]
-2	string		-pm2-		
+2	string		-pm2-
 >0	use	lharc-file
 2       string          -pms-           PMarc SFX archive (CP/M, DOS)
 #!:mime	application/x-foobar-exec
@@ -1145,12 +1155,12 @@
 >3		ubyte			0		\b, no compression
 >3		ubyte			2		\b, fast compression (Z1)
 >3		ubyte			3		\b, medium compression (Z2)
->3		ubyte			>3		
+>3		ubyte			>3
 >>3		ubyte			<11		\b, compression (Z%d-1)
->2		ubyte&0x08		0x00		
+>2		ubyte&0x08		0x00
 # ~ 30 byte password field only for *.gho
 >>12		ubequad			!0		\b, password protected
->>44		ubyte			!1		
+>>44		ubyte			!1
 # 1~Image All, sector-by-sector only for *.gho
 >>>10		ubyte			1		\b, sector copy
 # 1~Image Boot track only for *.gho
@@ -1160,8 +1170,8 @@
 # optional image description only *.gho
 >>0xff		string			>\0		"%-.254s"
 # look for DOS sector end sequence
->0xE08	search/7776		\x55\xAA	
->>&-512	indirect		x		\b; contains 
+>0xE08	search/7776		\x55\xAA
+>>&-512	indirect		x		\b; contains

 # Google Chrome extensions
 # https://developer.chrome.com/extensions/crx
@@ -1169,3 +1179,10 @@
 0	string	Cr24	Google Chrome extension
 !:mime	application/x-chrome-extension
 >4	ulong	x	\b, version %u
+
+# SeqBox - Sequenced container
+# ext: sbx, seqbox
+# Marco Pontello [email protected]
+# reference: https://github.com/MarcoPon/SeqBox
+0	string	SBx	SeqBox,
+>3	byte	x	version %d
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: att3b,v 1.9 2014/04/30 21:41:02 christos Exp $
+# $File: att3b,v 1.10 2017/03/17 21:35:28 christos Exp $
 # att3b:  file(1) magic for AT&T 3B machines
 #
 # The `versions' should be un-commented if they work for you.
@@ -36,6 +36,6 @@
 #>18	beshort		&00040000	and MAU hardware required
 #>22	beshort		>0		- version %d
 #
-# core file for 3b2 
+# core file for 3b2
 0	string		\000\004\036\212\200	3b2 core file
 >364	string		>\0		of '%s'
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: audio,v 1.75 2016/02/08 17:30:11 christos Exp $
+# $File: audio,v 1.80 2017/08/13 00:21:47 christos Exp $
 # audio:  file(1) magic for sound formats (see also "iff")
 #
 # Jan Nicolai Langfeldt ([email protected]), Dan Quinlan ([email protected]),
@@ -300,7 +300,7 @@
 >>5	byte		&0x40	\b, extended header
 >>5	byte		&0x20	\b, experimental
 >>5	byte		&0x10	\b, footer present
->(6.I+10)	indirect	x	\b, contains: 
+>(6.I+10)	indirect	x	\b, contains:

 # NSF (NES sound file) magic
 0	string		NESM\x1a	NES Sound File
@@ -314,7 +314,7 @@
 >122	byte&0x1	=0		NTSC

 # NSFE (Extended NES sound file) magic
-# http://slickproductions.org/docs/NSF/nsfespec.txt 
+# http://slickproductions.org/docs/NSF/nsfespec.txt
 # From: David Pflug <[email protected]>
 0	string		NSFE		Extended NES Sound File
 >48	search/0x1000	auth
@@ -469,6 +469,8 @@
 >>20	byte&0xe		0xc		\b, 7 channels
 >>20	byte&0xe		0xe		\b, 8 channels
 # some common sample rates
+>>17	belong&0xfffff0		0x2ee000	\b, 192 kHz
+>>17	belong&0xfffff0		0x158880	\b, 88.2 kHz
 >>17	belong&0xfffff0		0x0ac440	\b, 44.1 kHz
 >>17	belong&0xfffff0		0x0bb800	\b, 48 kHz
 >>17	belong&0xfffff0		0x07d000	\b, 32 kHz
@@ -658,7 +660,7 @@

 # From Fabio R. Schmidlin <[email protected]>
 # VGM music file
-0	string		Vgm\ 
+0	string		Vgm\040
 >9	ubyte		>0	VGM Video Game Music dump v
 >>9	ubyte/16	>0	\b%d
 >>9	ubyte&0x0F	x	\b%d
@@ -723,7 +725,7 @@
 # URL:		http://www.garmin.com/
 # Reference:	http://turboccc.wikispaces.com/share/view/28622555
 # NOTE:		there exist 2 other Garmin VPM formats
-0		string	AUDIMG		
+0		string	AUDIMG
 # skip text files starting with string "AUDIMG"
 >13		ubyte		<13	Garmin Voice Processing Module
 !:mime	audio/x-vpm-wav-garmin
@@ -743,16 +745,68 @@
 # second of release (0-59)
 >>9		ubyte		x	\b:%.2d
 # if you select a language like german on your garmin device
-# you can only select voice modules with correponding language byte ID like 1 
+# you can only select voice modules with corresponding language byte ID like 1
 >>18		ubyte		x	\b, language ID %d
 # pointer to 1st audio WAV sample
->>16		uleshort	>0	
+>>16		uleshort	>0
 >>>(16.s)	ulelong		>0	\b, at offset 0x%x
 # WAV length
 >>>>(16.s+4)	ulelong		>0	%d Bytes
 # look for magic
->>>>>(&-8.l)	string		RIFF	
+>>>>>(&-8.l)	string		RIFF
 # determine type by ./riff
->>>>>>&-4	indirect	x	\b 
+>>>>>>&-4	indirect	x	\b
 # 2 - ~ 131 WAV samples following same way

+# From Martin Mueller Skarbiniks Pedersen
+0		string		GDM
+>0x3		byte		0xFE	General Digital Music.
+>0x4		string		>\0	title: "%s"
+>0x24		string		>\0	musician: "%s"
+>>0x44		beshort		0x0D0A
+>>>0x46		byte		0x1A
+>>>>0x47	string		GMFS	Version
+>>>>0x4B	byte		x	%d.
+>>>>0x4C	byte		x	\b%02d
+>>>>0x4D	beshort		0x000	(2GDM v
+>>>>0x4F	byte		x	\b%d.
+>>>>>0x50	byte		x	\b%d)
+
+0		string		MTM	Multitracker
+>0x3		byte/16		x	Version %d.
+>0x3		byte&0x0F	x	\b%02d
+>>0x4		string		>\0	title: "%s"
+
+0		string		HVL
+>3		byte		<2	Hively Tracker Song
+>3		byte		0	1 module data
+>3		byte		1	2 module data
+
+0		string		MO3
+>3		ubyte		<6	MOdule with MP3
+>>3		byte		0	Version	0	(With MP3 and lossless)
+>>3		byte		1	Version	1	(With ogg and lossless)
+>>3		byte		3	Version 2.2
+>>3		byte		4	(With no LAME header)
+>>3		byte		5	Version 2.4
+
+0		string		ADRVPACK	AProSys	module
+
+# ftp://ftp.modland.com/pub/documents/format_documentation/\
+# Art%20Of%20Noise%20(.aon).txt
+0		string		AON
+>4		string		"ArtOfNoise by Bastian Spiegel(twice/lego)"
+>0x2e		string		NAME	Art of Noise Tracker Song
+>3		string		<9
+>3		string		4	(4 voices)
+>3		string		8	(8 voices)
+>>0x36		string		>\0	Title: "%s"
+
+0		string		FAR
+>0x2c		byte		0x0d
+>0x2d		byte		0x0a
+>0x2e		byte		0x1a
+>>0x3		byte		0xFE	Farandole Tracker Song
+>>>0x31		byte/16		x	Version %d.
+>>>0x31		byte&0x0F	x	\b%02d
+>>>>0x4		string		>\0	\b, title: "%s"
@@ -0,0 +1,10 @@
+
+#------------------------------------------------------------------------------
+# $File: bhl,v 1.1 2017/06/11 22:20:02 christos Exp $
+# BlockHashLoc
+# ext: bhl
+# Marco Pontello [email protected]
+# reference: https://github.com/MarcoPon/BlockHashLoc
+0	string	BlockHashLoc\x1a	BlockHashLoc recovery info,
+>13	byte	x			version %d
+!:ext   bhl
@@ -1,8 +1,8 @@

 #------------------------------------------------------------------------------
-# $File: blackberry,v 1.1 2014/01/31 01:51:32 christos Exp $
+# $File: blackberry,v 1.2 2017/03/17 21:35:28 christos Exp $
 # blackberry:  file(1) magic for BlackBerry file formats
 #
-5	belong	0		
+5	belong	0
 >8	belong  010010010	BlackBerry RIM ETP file
 >>22	string	x		\b for %s
@@ -1,11 +1,11 @@

 #------------------------------------------------------------------------------
-# $File: blender,v 1.6 2014/08/30 08:34:17 christos Exp $
+# $File: blender,v 1.7 2017/03/17 21:35:28 christos Exp $
 # blender: file(1) magic for Blender 3D related files
 #
-# Native format rule v1.2. For questions use the developers list 
+# Native format rule v1.2. For questions use the developers list
 # http://lists.blender.org/mailman/listinfo/bf-committers
-# GLOB chunk was moved near start and provides subversion info since 2.42 
+# GLOB chunk was moved near start and provides subversion info since 2.42

 0		string	=BLENDER	Blender3D,
 >7		string	=_		saved as 32-bits
@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: c-lang,v 1.24 2016/07/01 23:31:13 christos Exp $
+# $File: c-lang,v 1.26 2017/08/14 07:40:38 christos Exp $
 # c-lang:  file(1) magic for C and related languages programs
 #
 # The strength is to beat standard HTML
@@ -11,49 +11,72 @@
 !:mime	text/x-bcpl

 # C
-0	regex	\^#include	C source text
-!:strength +25
+# Check for class if include is found, otherwise class is beaten by include becouse of lowered strength
+0	regex	\^#include			C
+>0	regex	\^class[[:space:]]+
+>>&0	regex 	\\{[\.\*]\\}(;)?$			\b++
+>&0	clear	x				source text
+!:strength + 13
 !:mime	text/x-c
-0	regex	\^char[\ \t\n]+	C source text
+0	regex	\^#[[:space:]]*pragma	C source text
 !:mime	text/x-c
-0	regex	\^double[\ \t\n]+		C source text
+0	regex	\^#[[:space:]]*(if\|ifn)def
+>&0	regex	\^#[[:space:]]*endif$	C source text
 !:mime	text/x-c
-0	regex	\^extern[\ \t\n]+		C source text
+0	regex	\^#[[:space:]]*(if\|ifn)def
+>&0	regex	\^#[[:space:]]*define	C source text
 !:mime	text/x-c
-0	regex	\^float[\ \t\n]+		C source text
+0	regex	\^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
 !:mime	text/x-c
-0	regex	\^struct[\ \t\n]+		C source text
+0	regex	\^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
 !:mime	text/x-c
-0	regex	\^union[\ \t\n]+		C source text
+0	regex	\^[[:space:]]*extern[[:space:]]+		C source text
 !:mime	text/x-c
-0	search/8192	main(		C source text
+0	regex	\^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
+!:mime	text/x-c
+0	regex	\^struct[[:space:]]+		C source text
+!:mime	text/x-c
+0	regex	\^union[[:space:]]+		C source text
+!:mime	text/x-c
+0	search/8192	main(
+>&0 regex	\\)[[:space:]]*\\{		C source text
 !:mime	text/x-c

 # C++
 # The strength of these rules is increased so they beat the C rules above
-0	regex	\^template[\ \t]+<.*>[\ \t\n]+	C++ source text
+0	regex	\^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{	C++ source text
 !:strength + 30
 !:mime	text/x-c++
-0	regex	\^virtual[\ \t\n]+		C++ source text
+# using namespace [namespace] or using std::[lib]
+0	regex	\^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*;		C++ source text
 !:strength + 30
 !:mime	text/x-c++
-0	regex	\^class[\ \t\n]+		C++ source text
-# But class is reduced to avoid beating php (Jens Schleusener)
+0	regex	\^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$	C++ source text
+!:strength + 30
+!:mime	text/x-c++
+0	regex	\^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$		C++ source text
+!:strength + 30
+!:mime	text/x-c++
+# But class alone is reduced to avoid beating php (Jens Schleusener)
+0	regex	\^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$		C++ source text
 !:strength + 13
 !:mime	text/x-c++
-0	regex	\^public:		C++ source text
+0	regex	\^[[:space:]]*public:		C++ source text
 !:strength + 30
 !:mime	text/x-c++
-0	regex	\^private:		C++ source text
+0	regex	\^[[:space:]]*private:		C++ source text
+!:strength + 30
+!:mime	text/x-c++
+0	regex	\^[[:space:]]*protected:		C++ source text
 !:strength + 30
 !:mime	text/x-c++

 # Objective-C
-0	regex	\^#import	Objective-C source text
-!:strength +25
+0	regex	\^#import			Objective-C source text
+!:strength + 25
 !:mime	text/x-objective-c

-# From: Mikhail Teterin <[email protected]> 
+# From: Mikhail Teterin <[email protected]>
 0	string		cscope		cscope reference data
 >7	string		x		version %.2s
 # We skip the path here, because it is often long (so file will
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: cad,v 1.13 2014/03/23 18:05:38 christos Exp $
+# $File: cad,v 1.15 2017/06/24 15:24:56 christos Exp $
 # autocad:  file(1) magic for cad files
 #

@@ -9,7 +9,7 @@
 # DGN is the default file extension of Microstation/Intergraph CAD files.
 # CIT is the proprietary raster format (similar to TIFF) used to attach
 # raster underlays to Microstation DGN (vector) drawings.
-# 
+#
 # http://www.wotsit.org/search.asp
 # http://filext.com/detaillist.php?extdetail=DGN
 # http://filext.com/detaillist.php?extdetail=CIT
@@ -42,7 +42,7 @@
 >4	string	\030\000\000			CITFile
 >4	string	\030\000\003			CITFile

-# AutoCAD 
+# AutoCAD
 # Merge of the different contributions and updates from http://en.wikipedia.org/wiki/Dwg
 # and http://www.iana.org/assignments/media-types/image/vnd.dwg
 0	string	MC0.0	DWG AutoDesk AutoCAD Release 1.0
@@ -99,42 +99,42 @@
 0	string	AC1027	DWG AutoDesk AutoCAD 2013/2014
 !:mime image/vnd.dwg

-# KOMPAS 2D drawing from ASCON 
+# KOMPAS 2D drawing from ASCON
 # This is KOMPAS 2D drawing or fragment of drawing but is not detailed nor
 # gathered nor specification
 # ASCON http://ascon.net/main/ in English,
 #	http://ascon.ru/ main site in Russian
-# Extension is CDW for drawing and FRW for fragment of drawing 
+# Extension is CDW for drawing and FRW for fragment of drawing
 # Sergey Zaykov ([email protected], [email protected],
 # ICQ 358572321, http://vkontakte.ru/id16076543)
 # From:
 # http://sd.ascon.ru/otrs/customer.pl?Action=CustomerFAQ&CategoryID=4&ItemID=292
 # (in russian) and my experiments
 0	string	KF
->2	belong	0x4E00000C	Kompas drawing 12.0 SP1 
->2	belong	0x4D00000C	Kompas drawing 12.0 
->2	belong	0x3200000B	Kompas drawing 11.0 SP1 
->2	belong	0x3100000B	Kompas drawing 11.0 
->2	belong	0x2310000A	Kompas drawing 10.0 SP1 
->2	belong	0x2110000A	Kompas drawing 10.0 
->2	belong	0x08000009	Kompas drawing 9.0 SP1 
->2	belong	0x05000009	Kompas drawing 9.0 
->2	belong	0x33010008	Kompas drawing 8+ 
->2	belong	0x1A000008	Kompas drawing 8.0 
->2	belong	0x2C010107	Kompas drawing 7+ 
->2	belong	0x05000007	Kompas drawing 7.0 
->2	belong	0x32000006	Kompas drawing 6+ 
->2	belong	0x09000006	Kompas drawing 6.0 
->2	belong	0x5C009005	Kompas drawing 5.11R03 
->2	belong	0x54009005	Kompas drawing 5.11R02 
->2	belong	0x51009005	Kompas drawing 5.11R01 
->2	belong	0x22009005	Kompas drawing 5.10R03 
->2	belong	0x22009005	Kompas drawing 5.10R02 mar 
->2	belong	0x21009005	Kompas drawing 5.10R02 febr 
->2	belong	0x19009005	Kompas drawing 5.10R01 
->2	belong	0xF4008005	Kompas drawing 5.9R01.003 
->2	belong	0x1C008005	Kompas drawing 5.9R01.002 
->2	belong	0x11008005	Kompas drawing 5.8R01.003 
+>2	belong	0x4E00000C	Kompas drawing 12.0 SP1
+>2	belong	0x4D00000C	Kompas drawing 12.0
+>2	belong	0x3200000B	Kompas drawing 11.0 SP1
+>2	belong	0x3100000B	Kompas drawing 11.0
+>2	belong	0x2310000A	Kompas drawing 10.0 SP1
+>2	belong	0x2110000A	Kompas drawing 10.0
+>2	belong	0x08000009	Kompas drawing 9.0 SP1
+>2	belong	0x05000009	Kompas drawing 9.0
+>2	belong	0x33010008	Kompas drawing 8+
+>2	belong	0x1A000008	Kompas drawing 8.0
+>2	belong	0x2C010107	Kompas drawing 7+
+>2	belong	0x05000007	Kompas drawing 7.0
+>2	belong	0x32000006	Kompas drawing 6+
+>2	belong	0x09000006	Kompas drawing 6.0
+>2	belong	0x5C009005	Kompas drawing 5.11R03
+>2	belong	0x54009005	Kompas drawing 5.11R02
+>2	belong	0x51009005	Kompas drawing 5.11R01
+>2	belong	0x22009005	Kompas drawing 5.10R03
+>2	belong	0x22009005	Kompas drawing 5.10R02 mar
+>2	belong	0x21009005	Kompas drawing 5.10R02 febr
+>2	belong	0x19009005	Kompas drawing 5.10R01
+>2	belong	0xF4008005	Kompas drawing 5.9R01.003
+>2	belong	0x1C008005	Kompas drawing 5.9R01.002
+>2	belong	0x11008005	Kompas drawing 5.8R01.003

 # CAD: file(1) magic for computer aided design files
 # Phillip Griffith <phillip dot griffith at gmail dot com>
@@ -147,8 +147,13 @@
 >0x02	byte	0xfe
 >>0x04	beshort	0x1800		CIT raster CAD

-# 3DS (3d Studio files) Conflicts with diff output 0x3d '='
-#16	beshort		0x3d3d		image/x-3ds
+# 3DS (3d Studio files)
+0	leshort		0x4d4d
+>6	leshort		0x2
+>>8	lelong		0xa
+>>>16	leshort		0x3d3d	3D Studio model
+!:mime	image/x-3ds
+!:extension 3ds

 # MegaCAD 2D/3D drawing (.prt)
 # http://megacad.de/
@@ -1,14 +1,14 @@

 #------------------------------------------------------------------------------
-# $File: cafebabe,v 1.21 2015/10/15 20:56:51 christos Exp $
+# $File: cafebabe,v 1.23 2017/05/25 20:07:23 christos Exp $
 # Cafe Babes unite!
 #
 # Since Java bytecode and Mach-O universal binaries have the same magic number,
 # the test must be performed in the same "magic" sequence to get both right.
 # The long at offset 4 in a Mach-O universal binary tells the number of
 # architectures; the short at offset 4 in a Java bytecode file is the JVM minor
-# version and the short at offset 6 is the JVM major version.  Since there are only 
-# only 18 labeled Mach-O architectures at current, and the first released 
+# version and the short at offset 6 is the JVM major version.  Since there are only
+# only 18 labeled Mach-O architectures at current, and the first released
 # Java class format was version 43.0, we can safely choose any number
 # between 18 and 39 to test the number of architectures against
 # (and use as a hack). Let's not use 18, because the Mach-O people
@@ -47,7 +47,7 @@

 0	name		mach-o		\b [
 >0	use		mach-o-cpu	\b
->(8.L)	indirect			\b: 
+>(8.L)	indirect	x		\b:
 >0	belong		x		\b]

 0	belong		0xcafebabe
@@ -1,13 +1,13 @@

 #------------------------------------------------------------------------------
-# $File: clipper,v 1.7 2014/04/30 21:41:02 christos Exp $
+# $File: clipper,v 1.8 2017/03/17 21:35:28 christos Exp $
 # clipper:  file(1) magic for Intergraph (formerly Fairchild) Clipper.
 #
 # XXX - what byte order does the Clipper use?
 #
 # XXX - what's the "!" stuff:
 #
-# >18	short		!074000,000000	C1 R1 
+# >18	short		!074000,000000	C1 R1
 # >18	short		!074000,004000	C2 R1
 # >18	short		!074000,010000	C3 R1
 # >18	short		!074000,074000	TEST
@@ -15,7 +15,7 @@
 # I shall assume it's ANDing the field with the first value and
 # comparing it with the second, and rewrite it as:
 #
-# >18	short&074000	000000		C1 R1 
+# >18	short&074000	000000		C1 R1
 # >18	short&074000	004000		C2 R1
 # >18	short&074000	010000		C3 R1
 # >18	short&074000	074000		TEST
@@ -37,7 +37,7 @@
 >12	long		>0		not stripped
 >22	short		>0		- version %d
 0	short		0577		CLIPPER COFF executable
->18	short&074000	000000		C1 R1 
+>18	short&074000	000000		C1 R1
 >18	short&074000	004000		C2 R1
 >18	short&074000	010000		C3 R1
 >18	short&074000	074000		TEST
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: coff,v 1.1 2015/09/30 20:32:35 christos Exp $
+# $File: coff,v 1.2 2017/03/17 21:35:28 christos Exp $
 # coff: file(1) magic for Common Object Files not specific to known cpu types or manufactures
 #
 # COFF
@@ -15,7 +15,7 @@
 # mips,motorola,msdos,osf1,sharc,varied.out,vax
 0	name				display-coff
 # test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
->18	uleshort&0x8E80	0		
+>18	uleshort&0x8E80	0
 >>0	clear		x
 # f_magic - magic number
 # DJGPP, 80386 COFF executable, MS Windows COFF Intel 80386 object file (./intel)
@@ -25,7 +25,7 @@
 # Hitachi SH little-endian COFF (./hitachi-sh)
 >>0	uleshort	0x0550		Hitachi SH little-endian
 # executable (RISC System/6000 V3.1) or obj module (./ibm6000)
-#>>0	uleshort	0x01DF		
+#>>0	uleshort	0x01DF
 # TODO for other COFFs
 #>>0	uleshort	0xABCD		COFF_TEMPLATE
 >>0	default		x
@@ -45,12 +45,12 @@
 >>18	leshort		&0x0008		\b, stripped
 >>18	leshort		^0x0008		\b, not stripped
 # flags in other COFF versions
-#0x0010    F_FDPR_PROF 
+#0x0010    F_FDPR_PROF
 #0x0020    F_FDPR_OPTI
 #0x0040    F_DSA
 # F_AR32WR flag bit
 #>>>18	leshort		&0x0100		\b, 32 bit little endian
-#0x1000    F_DYNLOAD 
+#0x1000    F_DYNLOAD
 #0x2000    F_SHROBJ
 #0x4000    F_LOADONLY
 # f_nscns - number of sections
@@ -62,7 +62,7 @@
 >>8	ulelong		>0		\b, symbol offset=0x%x
 # f_nsyms - number of symbols, only for not stripped
 >>12	ulelong		>0		\b, %d symbols
-# f_opthdr - optional header size 
+# f_opthdr - optional header size
 >>16	uleshort	>0		\b, optional header size %d
 # at offset 20 can be optional header, extra bytes FILHSZ-20 because
 # do not rely on sizeof(FILHDR) to give the correct size for header.
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: commands,v 1.56 2016/07/14 19:01:12 christos Exp $
+# $File: commands,v 1.59 2017/08/14 07:40:38 christos Exp $
 # commands:  file(1) magic for various shells and interpreters
 #
 #0	string/w	:			shell archive or script for antique kernel text
@@ -56,7 +56,7 @@
 !:mime	text/x-awk
 0	string/wt	#!\ /usr/bin/awk	awk script text executable
 !:mime	text/x-awk
-0	regex/4096	=^\\s{0,100}BEGIN\\s{0,100}[{]	awk or perl script text
+0	regex/4096	=^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{]	awk or perl script text

 # AT&T Bell Labs' Plan 9 shell
 0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
@@ -84,7 +84,7 @@
 # PHP scripts
 # Ulf Harnhammar <[email protected]>
 0	search/1/c	=<?php			PHP script text
-!:strength + 10
+!:strength + 30
 !:mime	text/x-php
 0	search/1	=<?\n			PHP script text
 !:mime	text/x-php
@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: compress,v 1.66 2016/09/16 12:12:05 christos Exp $
+# $File: compress,v 1.68 2017/05/25 20:07:23 christos Exp $
 # compress:  file(1) magic for pure-compression formats (no archives)
 #
 # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
@@ -223,7 +223,7 @@
 # Zstandard/LZ4 skippable frames
 # https://github.com/facebook/zstd/blob/dev/zstd_compression_format.md
 0         lelong&0xFFFFFFF0  0x184D2A50
->(4.l+8)  indirect
+>(4.l+8)  indirect	x

 # Zstandard Dictionary ID subroutine
 0     name        zstd-dictionary-id
@@ -310,7 +310,7 @@

 # Zlib https://www.ietf.org/rfc/rfc6713.txt
 0	string/b	x
->0	beshort%31	=0	
+>0	beshort%31	=0
 >>0	byte&0xf	=8
 >>>0	byte&0x80 	=0	zlib compressed data
 !:mime	application/zlib
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: console,v 1.26 2016/06/12 15:20:37 christos Exp $
+# $File: console,v 1.32 2017/08/13 00:21:47 christos Exp $
 # Console game magic
 # Toby Deshane <[email protected]>

@@ -9,17 +9,19 @@
 # References:
 # - http://wiki.nesdev.com/w/index.php/INES
 # - http://wiki.nesdev.com/w/index.php/NES_2.0
-0	string		NES\x1A		iNES ROM image
+
+# Common header for iNES, NES 2.0, and Wii U iNES.
+0	name		nes-rom-image-ines
 >7	byte&0x0C	=0x8		(NES 2.0)
 >4	byte		x		\b: %ux16k PRG
->5	byte		x		\b, %ux16k CHR
+>5	byte		x		\b, %ux8k CHR
 >6	byte&0x08	=0x8		[4-Scr]
 >6	byte&0x09	=0x0		[H-mirror]
 >6	byte&0x09	=0x1		[V-mirror]
 >6	byte&0x02	=0x2		[SRAM]
 >6	byte&0x04	=0x4		[Trainer]
 >7	byte&0x03	=0x2		[PC10]
->7	byte&0x03	=0x1		[VS
+>7	byte&0x03	=0x1		[VS]
 >>7	byte&0x0C	=0x8
 # NES 2.0: VS PPU
 >>>13	byte&0x0F	=0x0		\b, RP2C03B
@@ -43,17 +45,24 @@
 >>12	byte&0x03	=0x1		[PAL]
 >>12	byte&0x02	=0x2		[NTSC+PAL]

+# Standard iNES ROM header.
+0	string		NES\x1A		NES ROM image (iNES)
+>0	use		nes-rom-image-ines
+
+# Wii U Virtual Console iNES ROM header.
+0	belong		0x4E455300	NES ROM image (Wii U Virtual Console)
+>0	use		nes-rom-image-ines
+
 #------------------------------------------------------------------------------
 # unif: file(1) magic for UNIF-format Nintendo Entertainment System ROM images
 # Reference: http://wiki.nesdev.com/w/index.php/UNIF
 # From: David Korth <[email protected]>
-# TODO commit on 2016/03/21
 #
 # NOTE: The UNIF format uses chunks instead of a fixed header,
 # so most of the data isn't easily parseable.
 #
 0	string	UNIF
->4	lelong	<16	UNIF v%d format NES ROM image
+>4	lelong	<16	NES ROM image (UNIF v%d format)

 #------------------------------------------------------------------------------
 # fds: file(1) magic for Famciom Disk System disk images
@@ -63,24 +72,39 @@

 # Disk info block. (block 1)
 0	name	nintendo-fds-disk-info-block
->1	string	*NINTENDO-HVC*	Famicom Disk System disk image:
 >23	byte	!1		FMC-
 >23	byte	1		FSC-
 >16	string	x		\b%.3s
->15	byte	x		\b, mfr 0x%02X
+>15	byte	x		\b, mfr %02X
 >20	byte	x		(Rev.%02u)

 # Headered version.
 0	string	FDS\x1A
->0x11	string	*NINTENDO-HVC*
+>0x11	string	*NINTENDO-HVC*	Famicom Disk System disk image:
 >>0x10	use	nintendo-fds-disk-info-block
 >4	byte	1	(%u side)
 >4	byte	!1	(%u sides)

 # Unheadered version.
-1	string	*NINTENDO-HVC*
+1	string	*NINTENDO-HVC*	Famicom Disk System disk image:
 >0	use	nintendo-fds-disk-info-block

+#------------------------------------------------------------------------------
+# tnes: file(1) magic for TNES-format Nintendo Entertainment System ROM images
+# Used by Nintendo 3DS NES Virtual Console games.
+# From: David Korth <[email protected]>
+#
+0		string	TNES	NES ROM image (Nintendo 3DS Virtual Console)
+>4		byte	100	\b: FDS,
+>>0x2010	use	nintendo-fds-disk-info-block
+>4		byte	!100	\b: TNES mapper %u
+>>5	byte		x		\b, %ux8k PRG
+>>6	byte		x		\b, %ux8k CHR
+>>7	byte&0x08	=1		[WRAM]
+>>8	byte&0x09	=1		[H-mirror]
+>>8	byte&0x09	=2		[V-mirror]
+>>8	byte&0x02	=3		[VRAM]
+
 #------------------------------------------------------------------------------
 # gameboy: file(1) magic for the Nintendo (Color) Gameboy raw ROM format
 # Reference: http://gbdev.gg8.se/wiki/articles/The_Cartridge_Header
@@ -389,6 +413,15 @@
 >0x1E	byte	x		\b, Rev.%02u)
 >0x12	byte	2		(DSi enhanced)
 >0x12	byte	3		(DSi only)
+# Secure Area check.
+>0x20		lelong	<0x4000		(homebrew)
+>0x20		lelong	>0x3FFF
+>>0x4000	lequad	0x0000000000000000	(multiboot)
+>>0x4000	lequad	!0x0000000000000000
+>>>0x4000	lequad	0xE7FFDEFFE7FFDEFF	(decrypted)
+>>>0x4000	lequad	!0xE7FFDEFFE7FFDEFF
+>>>>0x1000	lequad	0x0000000000000000	(encrypted)
+>>>>0x1000	lequad	!0x0000000000000000	(mask ROM)

 #------------------------------------------------------------------------------
 # nds_passme: file(1) magic for Nintendo DS ROM images for GBA cartridge boot.
@@ -412,7 +445,7 @@
 #------------------------------------------------------------------------------
 # msx: file(1) magic for MSX game cartridge dumps
 # Too simple - MPi
-#0 beshort 0x4142 MSX game cartridge dump 
+#0 beshort 0x4142 MSX game cartridge dump

 #------------------------------------------------------------------------------
 # Sony Playstation executables (Adam Sjoegren <[email protected]>) :
@@ -467,7 +500,7 @@

 # Double-check that the image type matches too, 0x8008 conflicts with
 # 8 character OMF-86 object file headers.
-0	beshort		0x8008		
+0	beshort		0x8008
 >6	string		BS93		Lynx homebrew cartridge
 >>2	beshort		x		\b, RAM start $%04x
 >6	string		LYNX		Lynx cartridge
@@ -482,7 +515,7 @@
 # is the offset 12 or the offset 16 correct?
 # GBS (Game Boy Sound) magic
 # ftp://ftp.modland.com/pub/documents/format_documentation/\
-# Gameboy%20Sound%20System%20(.gbs).txt 
+# Gameboy%20Sound%20System%20(.gbs).txt
 0	string		GBS		Nintendo Gameboy Music/Audio Data
 #12	string		GameBoy\ Music\ Module	Nintendo Gameboy Music Module
 >16	string		>\0	("%s" by
@@ -491,6 +524,10 @@
 >3	byte		x	version %d,
 >4	byte		x	%d tracks

+# IPS Patch Files from: From: Thomas Klausner <[email protected]>
+# see http://zerosoft.zophar.net/ips.php
+0	string	PATCH			IPS patch file
+
 # Playstations Patch Files from: From: Thomas Klausner <[email protected]>
 0	string	PPF30			Playstation Patch File version 3.0
 >5	byte	0			\b, PPF 1.0 patch
@@ -518,7 +555,7 @@
 # SNES9x .smv "movie" file format.
 0		string		SMV\x1A	SNES9x input recording
 >0x4		lelong		x	\b, version %d
-# version 4 is latest so far 
+# version 4 is latest so far
 >0x4		lelong		<5
 >>0x8		ledate		x	\b, recorded at %s
 >>0xc		lelong		>0	\b, rerecorded %d times
@@ -617,6 +654,52 @@
 >0x218	belong	0x5D1C9EA3	Nintendo Wii disc image (WBFS format):
 >>0x200	use	nintendo-gcn-disc-common

+# Type: Nintendo GameCube/Wii disc image (CISO format)
+# NOTE: This is NOT the same as Compact ISO or PSP CISO,
+# though it has the same magic number.
+0		string	CISO
+# Other fields are used to determine what type of CISO this is:
+# - 0x04 == 0x00200000: GameCube/Wii CISO (block_size)
+# - 0x10 == 0x00000800: PSP CISO (ISO-9660 sector size)
+# - None of the above: Compact ISO.
+>4		lelong	0x200000
+>>8		byte	1
+>>>0x801C	belong	0xC2339F3D	Nintendo GameCube disc image (CISO format):
+>>>>0x8000	use	nintendo-gcn-disc-common
+>>>0x8018	belong	0x5D1C9EA3	Nintendo Wii disc image (CISO format):
+>>>>0x8000	use	nintendo-gcn-disc-common
+
+# Type: Nintendo GameCube/Wii disc image (GCZ format)
+# Due to zlib compression, we can't get the actual disc information.
+0	lelong	0xB10BC001
+>4	lelong	0		Nintendo GameCube disc image (GCZ format)
+>4	lelong	1		Nintendo Wii disc image (GCZ format)
+>4	lelong	>1		Nintendo GameCube/Wii disc image (GCZ format)
+
+# Type: Nintendo GameCube/Wii disc image (WDF format)
+0		string	WII\001DISC
+>8		belong	1
+# WDFv1
+>>0x54		belong	0xC2339F3D	Nintendo GameCube disc image (WDFv1 format):
+>>>0x38		use	nintendo-gcn-disc-common
+>>0x58		belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv1 format):
+>>>0x38		use	nintendo-gcn-disc-common
+>8		belong	2
+# WDFv2
+>>(12.L+0x1C)	belong	0xC2339F3D	Nintendo GameCube disc image (WDFv2 format):
+>>>(12.L)	use	nintendo-gcn-disc-common
+>>(12.L+0x18)	belong	0x5D1C9EA3	Nintendo Wii disc image (WDFv2 format):
+>>>(12.L)	use	nintendo-gcn-disc-common
+
+# Type: Nintendo GameCube/Wii disc image (WIA format)
+0	string	WIA\001	Nintendo
+>0x48	belong	0	GameCube/Wii
+>0x48	belong	1	GameCube
+>0x48	belong	2	Wii
+>0x48	belong	>2	GameCube/Wii
+>0x48	belong	x	disc image (WIA format):
+>>0x58	use	nintendo-gcn-disc-common
+
 #------------------------------------------------------------------------------
 # Nintendo 3DS file formats.
 #
@@ -722,7 +805,7 @@

 # Type: Nintendo 3DS Homebrew Application.
 # From: David Korth <[email protected]>
-# Refernece: https://3dbrew.org/wiki/3DSX_Format
+# Reference: https://3dbrew.org/wiki/3DSX_Format
 0	string	3DSX	Nintendo 3DS Homebrew Application (3DSX)

 #------------------------------------------------------------------------------
@@ -750,3 +833,17 @@
 #
 0	string	g\ GCE	Vectrex ROM image
 >0x11	string	>\0	\b: "%.16s"
+
+#------------------------------------------------------------------------------
+# amiibo: file(1) magic for Nintendo amiibo NFC dumps.
+# From: David Korth <[email protected]>
+# Reference: https://www.3dbrew.org/wiki/Amiibo
+0x00		byte	0x04
+>0x0A		beshort	0x0FE0
+>>0x0C		belong	0xF110FFEE
+>>>0x208	beshort	0x0100
+>>>>0x020A	byte	0x0F
+>>>>>0x020C	bequad	0x000000045F000000
+>>>>>>0x5B	byte	0x02
+>>>>>>>0x54	belong	x	Nintendo amiibo NFC dump - amiibo ID: %08X-
+>>>>>>>0x58	belong	x	\b%08X
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: cups,v 1.4 2016/10/17 18:51:02 christos Exp $
+# $File: cups,v 1.5 2017/03/17 21:35:28 christos Exp $
 # Cups: file(1) magic for the cups raster file format
 # From: Laurent Martelli <[email protected]>
 # http://www.cups.org/documentation.php/spec-raster.html
@@ -39,7 +39,7 @@
 >404	lelong		20		ColorSpace=AdobeRGB

 # Cups Raster image format, Big Endian
-0	string		RaS		
+0	string		RaS
 >3	string		t		Cups Raster version 1, Big Endian
 >3	string		2		Cups Raster version 2, Big Endian
 >3	string		3		Cups Raster version 3, Big Endian
@@ -48,7 +48,7 @@


 # Cups Raster image format, Little Endian
-1	string		SaR		
+1	string		SaR
 >0	string		t		Cups Raster version 1, Little Endian
 >0	string		2		Cups Raster version 2, Little Endian
 >0	string		3		Cups Raster version 3, Little Endian
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: database,v 1.49 2016/06/11 17:01:51 christos Exp $
+# $File: database,v 1.52 2017/08/13 00:21:47 christos Exp $
 # database:  file(1) magic for various databases
 #
 # extracted from header/code files by Graeme Wilford ([email protected])
@@ -84,7 +84,7 @@
 # From Max Bowsher.
 12	long	0x00040988	Berkeley DB
 >16	long	>0		(Log, version %d, native byte-order)
-12	belong	0x00040988	Berkeley DB 
+12	belong	0x00040988	Berkeley DB
 >16	belong	>0		(Log, version %d, big-endian)
 12	lelong	0x00040988	Berkeley DB
 >16	lelong	>0		(Log, version %d, little-endian)
@@ -103,7 +103,7 @@
 >>>12	long		!0		32bit aligned
 >>>>12	bedouble	8.642135e+130	big-endian
 >>>>>20 long		0		64bit long
->>>>>20 long		!0		32bit long  
+>>>>>20 long		!0		32bit long
 >>>>12	ledouble	8.642135e+130	little-endian
 >>>>>24 long		0		64bit long
 >>>>>24 long		!0		32bit long (i386)
@@ -128,22 +128,22 @@
 # XXX: Weak magic.
 # Alex Ott <[email protected]>
 ## Paradox file formats
-#2	  leshort	0x0800	Paradox 
-#>0x39	  byte		3	v. 3.0 
-#>0x39	  byte		4	v. 3.5 
-#>0x39	  byte		9	v. 4.x 
-#>0x39	  byte		10	v. 5.x 
-#>0x39	  byte		11	v. 5.x 
-#>0x39	  byte		12	v. 7.x 
-#>>0x04	  byte		0	indexed .DB data file 
-#>>0x04	  byte		1	primary index .PX file 
-#>>0x04	  byte		2	non-indexed .DB data file 
-#>>0x04	  byte		3	non-incrementing secondary index .Xnn file 
-#>>0x04	  byte		4	secondary index .Ynn file 
-#>>0x04	  byte		5	incrementing secondary index .Xnn file 
-#>>0x04	  byte		6	non-incrementing secondary index .XGn file 
-#>>0x04	  byte		7	secondary index .YGn file 
-#>>>0x04	  byte		8	incrementing secondary index .XGn file 
+#2	  leshort	0x0800	Paradox
+#>0x39	  byte		3	v. 3.0
+#>0x39	  byte		4	v. 3.5
+#>0x39	  byte		9	v. 4.x
+#>0x39	  byte		10	v. 5.x
+#>0x39	  byte		11	v. 5.x
+#>0x39	  byte		12	v. 7.x
+#>>0x04	  byte		0	indexed .DB data file
+#>>0x04	  byte		1	primary index .PX file
+#>>0x04	  byte		2	non-indexed .DB data file
+#>>0x04	  byte		3	non-incrementing secondary index .Xnn file
+#>>0x04	  byte		4	secondary index .Ynn file
+#>>0x04	  byte		5	incrementing secondary index .Xnn file
+#>>0x04	  byte		6	non-incrementing secondary index .XGn file
+#>>0x04	  byte		7	secondary index .YGn file
+#>>>0x04	  byte		8	incrementing secondary index .XGn file

 ## XBase database files
 # updated by Joerg Jenderek at Feb 2013
@@ -151,33 +151,33 @@
 # http://www.clicketyclick.dk/databases/xbase/format/dbf.html
 # http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
 # inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
-0	ubelong&0x0000FFFF		<0x00000C20	
+0	ubelong&0x0000FFFF		<0x00000C20
 # skip Infocom game Z-machine
->2		ubyte			>0		
+>2		ubyte			>0
 # skip Androids *.xml
->>3		ubyte			>0		
->>>3		ubyte			<32		
+>>3		ubyte			>0
+>>>3		ubyte			<32
 # 1 < version VV
->>>>0		ubyte			>1		
+>>>>0		ubyte			>1
 # skip HELP.CA3 by test for reserved byte ( NULL )
->>>>>27		ubyte			0		
+>>>>>27		ubyte			0
 # reserved bytes not always 0 ; also found 0x3901 (T4.DBF) ,0x7101 (T5.DBF,T6.DBF)
 #>>>>>30		ubeshort     		x		30NULL?%x
-# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL) 
->>>>>>24	ubelong&0xffFFFFff	>0x01302000	
+# possible production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
+>>>>>>24	ubelong&0xffFFFFff	>0x01302000
 # .DBF or .MDX
->>>>>>24	ubelong&0xffFFFFff	<0x01302001	
+>>>>>>24	ubelong&0xffFFFFff	<0x01302001
 # for Xbase Database file (*.DBF) reserved (NULL) for multi-user
->>>>>>>24	ubelong&0xffFFFFff	=0		
+>>>>>>>24	ubelong&0xffFFFFff	=0
 # test for 2 reserved NULL bytes,transaction and encryption byte flag
->>>>>>>>12	ubelong&0xFFFFfEfE	0		
+>>>>>>>>12	ubelong&0xFFFFfEfE	0
 # test for MDX flag
->>>>>>>>>28	ubyte			x		
->>>>>>>>>28	ubyte&0xf8		0		
+>>>>>>>>>28	ubyte			x
+>>>>>>>>>28	ubyte&0xf8		0
 # header size >= 32
->>>>>>>>>>8	uleshort		>31		
+>>>>>>>>>>8	uleshort		>31
 # skip PIC15736.PCX by test for language driver name or field name
->>>>>>>>>>>32	ubyte			>0		
+>>>>>>>>>>>32	ubyte			>0
 #!:mime	application/x-dbf; charset=unknown-8bit ??
 #!:mime	application/x-dbase
 >>>>>>>>>>>>0	use			xbase-type
@@ -202,22 +202,22 @@
 >>>>>>>>>>>>28	ubyte&0x02		2		\b, with memo .FPT
 >>>>>>>>>>>>28	ubyte&0x04		4		\b, DataBaseContainer
 # 1st record offset + 1 = header size
->>>>>>>>>>>>8	uleshort		>0		
->>>>>>>>>>>>(8.s+1)	ubyte		>0		
+>>>>>>>>>>>>8	uleshort		>0
+>>>>>>>>>>>>(8.s+1)	ubyte		>0
 >>>>>>>>>>>>>8		uleshort	>0		\b, at offset %d
->>>>>>>>>>>>>(8.s+1)	ubyte		>0		
+>>>>>>>>>>>>>(8.s+1)	ubyte		>0
 >>>>>>>>>>>>>>&-1	string		>\0		1st record "%s"
-# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserverd (NULL) 
->>>>>>>24	ubelong&0x0133f7ff	>0		
+# for multiple index files (*.MDX) Production flag,tag numbers(<=0x30),tag length(<=0x20), reserved (NULL)
+>>>>>>>24	ubelong&0x0133f7ff	>0
 # test for reserved NULL byte
->>>>>>>>47	ubyte			0		
+>>>>>>>>47	ubyte			0
 # test for valid TAG key format (0x10 or 0)
->>>>>>>>>559	ubyte&0xeF		0		
+>>>>>>>>>559	ubyte&0xeF		0
 # test MM <= 12
->>>>>>>>>>45	ubeshort		<0x0C20		
->>>>>>>>>>>45	ubyte			>0		
->>>>>>>>>>>>46	ubyte			<32		
->>>>>>>>>>>>>46	ubyte			>0		
+>>>>>>>>>>45	ubeshort		<0x0C20
+>>>>>>>>>>>45	ubyte			>0
+>>>>>>>>>>>>46	ubyte			<32
+>>>>>>>>>>>>>46	ubyte			>0
 #!:mime	application/x-mdx
 >>>>>>>>>>>>>>0		use		xbase-type
 >>>>>>>>>>>>>>0		ubyte		x		\b MDX
@@ -236,11 +236,11 @@
 # 2nd tag name
 #>>>>>>>>>>>>(26.b+548)	string		x		\b, 2nd tag "%.11s"
 #
-#		Print the xBase names of different version variants 
+#		Print the xBase names of different version variants
 0	name				xbase-type
->0	ubyte		<2		
+>0	ubyte		<2
 # 1 < version
->0	ubyte		>1		
+>0	ubyte		>1
 >>0	ubyte		0x02		FoxBase
 # FoxBase+/dBaseIII+, no memo
 >>0	ubyte		0x03		FoxBase+/dBase III
@@ -293,7 +293,7 @@
 # dBASE IV with SQL table, with memo .DBT
 >>0	ubyte		0xCB		dBase IV with SQL table, with memo .DBT
 !:mime	application/x-dbf
-# HiPer-Six format;Clipper SIX, with SMT memo file		
+# HiPer-Six format;Clipper SIX, with SMT memo file
 >>0	ubyte		0xE5		Clipper SIX with memo
 !:mime	application/x-dbf
 # http://msdn.microsoft.com/en-US/library/st4a0s68(v=vs.80).aspx
@@ -318,12 +318,12 @@
 #		test and print the date of xBase .DBF .MDX
 0	name				xbase-date
 # inspect YYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
->0	ubelong		x		
->1	ubyte		<13		
->>1	ubyte		>0		
->>>2	ubyte		>0		
->>>>2	ubyte		<32		
->>>>>0	ubyte		x		
+>0	ubelong		x
+>1	ubyte		<13
+>>1	ubyte		>0
+>>>2	ubyte		>0
+>>>>2	ubyte		<32
+>>>>>0	ubyte		x
 # YY is interpreted as 20YY or 19YY
 >>>>>>0	ubyte		<100		\b %.2d
 # YY is interpreted 1900+YY; TODO: display yy or 20yy instead 1YY
@@ -333,56 +333,56 @@

 #	dBase memo files .DBT or .FPT
 # http://msdn.microsoft.com/en-us/library/8599s21w(v=vs.80).aspx
-16		ubyte		<4		
->16		ubyte		!2		
->>16		ubyte		!1		
+16		ubyte		<4
+>16		ubyte		!2
+>>16		ubyte		!1
 # next free block index is positive
->>>0		ulelong		>0		
+>>>0		ulelong		>0
 # skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
->>>>17		ubelong&0xFFfdFE00	0x00000000	
+>>>>17		ubelong&0xFFfdFE00	0x00000000
 # skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
->>>>>20		ubelong&0xFF01209B	0x00000000	
+>>>>>20		ubelong&0xFF01209B	0x00000000
 # dBASE III
->>>>>>16	ubyte		3		
+>>>>>>16	ubyte		3
 # dBASE III DBT
 >>>>>>>0	use		dbase3-memo-print
 # dBASE III DBT without version, dBASE IV DBT , FoxPro FPT , or many ZIP , DBF garbage
->>>>>>16	ubyte		0		
+>>>>>>16	ubyte		0
 # unusual dBASE III DBT like angest.dbt, dBASE IV DBT with block size 0 , FoxPro FPT ,  or garbage PCX DBF
->>>>>>>20	uleshort	0		
+>>>>>>>20	uleshort	0
 # FoxPro FPT , unusual dBASE III DBT like biblio.dbt or garbage
->>>>>>>>8	ulong		=0		
->>>>>>>>>6	ubeshort	>0		
+>>>>>>>>8	ulong		=0
+>>>>>>>>>6	ubeshort	>0
 # skip emacs.PIF
->>>>>>>>>>4	ushort		0		
+>>>>>>>>>>4	ushort		0
 >>>>>>>>>>>0	use		foxpro-memo-print
 # dBASE III DBT , garbage
->>>>>>>>>6	ubeshort	0		
+>>>>>>>>>6	ubeshort	0
 # skip MM*DD*.bin by test for for reserved NULL byte
->>>>>>>>>>510	ubeshort	0		
+>>>>>>>>>>510	ubeshort	0
 # skip TK-DOS11.img image by looking for memo text
->>>>>>>>>>>512	ubelong		<0xfeffff03	
+>>>>>>>>>>>512	ubelong		<0xfeffff03
 # skip EFI executables by looking for memo text
->>>>>>>>>>>>512	ubelong		>0x1F202020	
->>>>>>>>>>>>>513 ubyte		>0		
+>>>>>>>>>>>>512	ubelong		>0x1F202020
+>>>>>>>>>>>>>513 ubyte		>0
 # unusual dBASE III DBT like adressen.dbt
 >>>>>>>>>>>>>>0	use		dbase3-memo-print
 # dBASE III DBT like angest.dbt, or garbage PCX DBF
->>>>>>>>8	ubelong		!0		
+>>>>>>>>8	ubelong		!0
 # skip PCX and some DBF by test for for reserved NULL bytes
->>>>>>>>>510	ubeshort	0		
+>>>>>>>>>510	ubeshort	0
 # skip some DBF by test of invalid version
->>>>>>>>>>0	ubyte		>5		
->>>>>>>>>>>0	ubyte		<48		
+>>>>>>>>>>0	ubyte		>5
+>>>>>>>>>>>0	ubyte		<48
 >>>>>>>>>>>>0	use		dbase3-memo-print
 # dBASE IV DBT with positive block size
->>>>>>>20	uleshort	>0		
-# dBASE IV DBT with valid block length like 512, 1024 
+>>>>>>>20	uleshort	>0
+# dBASE IV DBT with valid block length like 512, 1024
 # multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
->>>>>>>>20	uleshort&0x800f	0		
+>>>>>>>>20	uleshort&0x800f	0
 >>>>>>>>>0	use		dbase4-memo-print

-#		Print the information of dBase III DBT memo file 
+#		Print the information of dBase III DBT memo file
 0	name				dbase3-memo-print
 >0	ubyte			x		dBase III DBT
 # instead 3 as version number 0 for unusual examples like biblio.dbt
@@ -395,45 +395,45 @@
 >20	uleshort		!0		\b, block length %u
 # dBase III memo field terminated by \032\032
 >512	string			>\0		\b, 1st item "%s"
-#		Print the information of dBase IV DBT memo file 
+#		Print the information of dBase IV DBT memo file
 0	name				dbase4-memo-print
 >0		lelong		x		dBase IV DBT
 !:mime	application/x-dbt
 !:ext dbt
 # 8 character shorted main name of coresponding dBASE IV DBF file
->8		ubelong		>0x20000000	
+>8		ubelong		>0x20000000
 # skip unusual like for angest.dbt
->>20		uleshort	>0	
+>>20		uleshort	>0
 >>>8		string		>\0		\b of %-.8s.DBF
 # value 0 implies 512 as size
 #>4		ulelong		=0		\b, blocks size %u
 # size of blocks not reliable like 0x2020204C in angest.dbt
->4		ulelong		!0		
+>4		ulelong		!0
 >>4		ulelong&0x0000003f	0	\b, blocks size %u
 # dBase IV DBT with positive block length (found 512 , 1024)
 >20		uleshort	>0		\b, block length %u
 # next available block
 #>0		lelong		=0		\b, next free block index %u
 >0		lelong		!0		\b, next free block index %u
->20		uleshort	>0		
->>(20.s)	ubelong		x		
+>20		uleshort	>0
+>>(20.s)	ubelong		x
 >>>&-4		use		dbase4-memofield-print
 # unusual dBase IV DBT without block length (implies 512 as length)
->20		uleshort	=0		
->>512		ubelong		x		
+>20		uleshort	=0
+>>512		ubelong		x
 >>>&-4		use				dbase4-memofield-print
-#		Print the information of dBase IV memo field 
+#		Print the information of dBase IV memo field
 0	name			dbase4-memofield-print
 # free dBase IV memo field
->0		ubelong		!0xFFFF0800	
+>0		ubelong		!0xFFFF0800
 >>0		lelong		x		\b, next free block %u
 >>4		lelong		x		\b, next used block %u
 # used dBase IV memo field
->0		ubelong		=0xFFFF0800	
+>0		ubelong		=0xFFFF0800
 # length of memo field
 >>4		lelong		x		\b, field length %d
 >>>8		string		>\0		\b, 1st used item "%s"
-#		Print the information of FoxPro FPT memo file 
+#		Print the information of FoxPro FPT memo file
 0	name				foxpro-memo-print
 >0		belong		x		FoxPro FPT
 # Size of blocks for FoxPro ( 64,256 )
@@ -441,14 +441,14 @@
 # next available block
 #>0		belong		=0		\b, next free block index %u
 >0		belong		!0		\b, next free block index %u
-# field type ( 0~picture, 1~memo, 2~object ) 
+# field type ( 0~picture, 1~memo, 2~object )
 >512		ubelong		<3		\b, field type %u
 # length of memo field
->512		ubelong		1		
+>512		ubelong		1
 >>516		belong		>0		\b, field length %d
 >>>520		string		>\0		\b, 1st item "%s"

-# TODO: 
+# TODO:
 # DBASE index file *.NDX
 # DBASE Compound Index file *.CDX
 # dBASE IV Printer Driver *.PRF
@@ -465,9 +465,9 @@
 # Reference: https://github.com/libyal/libesedb/archive/master.zip
 #	libesedb-master/documentation/
 #	Extensible Storage Engine (ESE) Database File (EDB) format.asciidoc
-# Note: also known as "JET Blue". Used by numerous Windows components such as 
+# Note: also known as "JET Blue". Used by numerous Windows components such as
 # Windows Search, Mail, Exchange and Active Directory.
-4	ubelong		0xefcdab89	
+4	ubelong		0xefcdab89
 # unknown1
 >132	ubelong		0		Extensible storage engine
 !:mime	application/x-ms-ese
@@ -497,8 +497,8 @@
 # From: Joerg Jenderek
 # URL: http://forensicswiki.org/wiki/Windows_Application_Compatibility
 # Note: files contain application compatibility fixes, application compatibility modes and application help messages.
-8	string		sdbf		
->7	ubyte		0		
+8	string		sdbf
+>7	ubyte		0
 # TAG_TYPE_LIST+TAG_INDEXES
 >>12	uleshort	0x7802		Windows application compatibility Shim DataBase
 # version? 2 3
@@ -600,10 +600,10 @@
 # Reference: http://www.provue.com/Panorama/
 # From: Joerg Jenderek
 # NOTE: test only versions 4 and 6.0 with Windows
-# length of Panorama database name 
-5	ubyte				>0		
+# length of Panorama database name
+5	ubyte				>0
 # look after database name for "some" null bits
->(5.B+7)	ubelong&0xF3ffF000	0		
+>(5.B+7)	ubelong&0xF3ffF000	0
 # look for first keyword
 >>&1		search/2		DESIGN		Panorama database
 #!:mime	application/x-panorama-database
@@ -622,3 +622,13 @@
 # MUIbase Database Tool by Stefan A. Haubenthal <[email protected]>
 0	string	MBSTV\040	MUIbase DB
 >6	string	x		version %s
+
+#
+# CDB database
+0	string	NBCDB\012	NetBSD Constant Database
+>7	byte	x		\b, version %d
+>8	string	x		\b, for '%s'
+>24	lelong	x		\b, datasize %d
+>28	lelong	x		\b, entries %d
+>32	lelong	x		\b, index %d
+>36	lelong	x		\b, seed %#x
@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: der,v 1.1 2016/01/19 15:07:45 christos Exp $
+# $File: der,v 1.2 2017/03/17 21:35:28 christos Exp $
 # der: file(1) magic for DER encoded files
 #

@@ -32,37 +32,37 @@

 # Key Pairs
 0	der	seq
->&0	der	int1=00	
+>&0	der	int1=00
 >&0	der	int65=x
 >&0	der	int3=010001	DER Encoded Key Pair, 512 bits

 0	der	seq
->&0	der	int1=00	
+>&0	der	int1=00
 >&0	der	int129=x
 >&0	der	int3=010001	DER Encoded Key Pair, 1024 bits

 0	der	seq
->&0	der	int1=00	
+>&0	der	int1=00
 >&0	der	int257=x
 >&0	der	int3=010001	DER Encoded Key Pair, 2048 bits

 0	der	seq
->&0	der	int1=00	
+>&0	der	int1=00
 >&0	der	int513=x
 >&0	der	int3=010001	DER Encoded Key Pair, 4096 bits

 0	der	seq
->&0	der	int1=00	
+>&0	der	int1=00
 >&0	der	int1025=x
 >&0	der	int3=010001	DER Encoded Key Pair, 8192 bits

 0	der	seq
->&0	der	int1=00	
+>&0	der	int1=00
 >&0	der	int2049=x
 >&0	der	int3=010001	DER Encoded Key Pair, 16k bits

 0	der	seq
->&0	der	int1=00	
+>&0	der	int1=00
 >&0	der	int4097=x
 >&0	der	int3=010001	DER Encoded Key Pair, 32k bits

@@ -1,15 +1,15 @@

 #------------------------------------------------------------------------------
-# $File: diff,v 1.14 2012/09/16 23:08:54 christos Exp $
+# $File: diff,v 1.16 2017/03/17 22:20:22 christos Exp $
 # diff:  file(1) magic for diff(1) output
 #
-0	search/1	diff\ 		diff output text
+0	search/1	diff\040	diff output text
 !:mime	text/x-diff
-0	search/1	***\ 		diff output text
+0	search/1	***\040 	diff output text
 !:mime	text/x-diff
-0	search/1	Only\ in\ 	diff output text
+0	search/1	Only\040in\040 	diff output text
 !:mime	text/x-diff
-0	search/1	Common\ subdirectories:\ 	diff output text
+0	search/1	Common\040subdirectories:\040 	diff output text
 !:mime	text/x-diff

 0	search/1	Index:		RCS/CVS diff output text
@@ -20,9 +20,9 @@


 # unified diff
-0	search/4096	---\ 
+0	search/4096	---\040
 >&0	search/1024 \n
->>&0	search/1 +++\ 
+>>&0	search/1 +++\040
 >>>&0	search/1024 \n
 >>>>&0	search/1 @@	unified diff output text
 !:mime	text/x-diff
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: dolby,v 1.7 2014/01/08 22:37:23 christos Exp $
+# $File: dolby,v 1.8 2017/03/17 21:35:28 christos Exp $
 # ATSC A/53 aka AC-3 aka Dolby Digital <[email protected]>
 # from http://www.atsc.org/standards/a_52a.pdf
 # corrections, additions, etc. are always welcome!
@@ -23,7 +23,7 @@
 >5	byte&0x07 = 0x04	\b, dialogue (D)
 >5	byte&0x07 = 0x05	\b, commentary (C)
 >5	byte&0x07 = 0x06	\b, emergency (E)
->5	beshort&0x07e0  0x0720	\b, voiceover (VO) 
+>5	beshort&0x07e0  0x0720	\b, voiceover (VO)
 >5	beshort&0x07e0 >0x0720	\b, karaoke
 # acmod
 >6	byte&0xe0 = 0x00	1+1 front,
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: dump,v 1.13 2014/04/30 21:41:02 christos Exp $
+# $File: dump,v 1.16 2017/07/22 19:21:02 christos Exp $
 # dump:  file(1) magic for dump file format--for new and old dump filesystems
 #
 # We specify both byte orders in order to recognize byte-swapped dumps.
@@ -62,23 +62,25 @@
 >824	string	>\0		Host %s,
 >888	belong	>0		Flags %x

-24	belong	60012		new-fs dump file (big endian), 
+24	belong	60012		new-fs dump file (big endian),
 >0	use	new-dump-be

-24	belong	60011		old-fs dump file (big endian), 
+24	belong	60011		old-fs dump file (big endian),
 >0	use	old-dump-be

-24	lelong	60012		new-fs dump file (little endian), 
+24	lelong	60012		new-fs dump file (little endian),
+# to correctly recognize '*.mo' GNU message catalog (little endian)
+!:strength - 15
 >0	use	\^new-dump-be

-24	lelong	60011		old-fs dump file (little endian), 
+24	lelong	60011		old-fs dump file (little endian),
 >0	use	\^old-dump-be


-24	belong	0x19540119	new-fs dump file (ufs2, big endian), 
+24	belong	0x19540119	new-fs dump file (ufs2, big endian),
 >0	use	ufs2-dump-be

-24	lelong	0x19540119	new-fs dump file (ufs2, little endian), 
+24	lelong	0x19540119	new-fs dump file (ufs2, little endian),
 >0	use	\^ufs2-dump-be

 18	leshort	60011		old-fs dump file (16-bit, assuming PDP-11 endianness),
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: dyadic,v 1.7 2015/05/27 18:02:48 christos Exp $
+# $File: dyadic,v 1.8 2017/03/17 21:35:28 christos Exp $
 # Dyadic: file(1) magic for Dyalog APL.
 #
 # updated by Joerg Jenderek at Oct 2013
@@ -10,9 +10,9 @@
 # .DIN Dyalog APL Input Table
 # .DOT Dyalog APL Output Table
 # .DFT Dyalog APL Format File
-0	ubeshort&0xFF60	0xaa00		
+0	ubeshort&0xFF60	0xaa00
 # skip biblio.dbt
->1	byte		!4		
+>1	byte		!4
 # real Dyalog APL have non zero version numbers like 7.3 or 13.4
 >>2	ubeshort	>0x0000		Dyalog APL
 >>>1	byte		0x00		aplcore
@@ -1,7 +1,7 @@

 #------------------------------------------------------------------------------
-# $File: editors,v 1.10 2016/07/18 17:44:49 christos Exp $
-# T602 editor documents 
+# $File: editors,v 1.11 2017/03/17 21:35:28 christos Exp $
+# T602 editor documents
 # by David Necas <[email protected]>
 0	string	@CT\ 	T602 document data,
 >4	string	0	Kamenicky
@@ -9,7 +9,7 @@
 >4	string	2	KOI8-CS
 >4	string	>2	unknown encoding

-# Vi IMproved Encrypted file 
+# Vi IMproved Encrypted file
 # by David Necas <[email protected]>
 0	string	VimCrypt~	Vim encrypted file data

@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: flash,v 1.11 2014/05/02 00:26:49 christos Exp $
+# $File: flash,v 1.14 2017/05/25 20:09:55 christos Exp $
 # flash:	file(1) magic for Macromedia Flash file format
 #
 # See
@@ -10,23 +10,45 @@
 #	en/devnet/swf/pdf/swf-file-format-spec.pdf page 27
 #

-0   name        swf-details
->0	string		F		Macromedia Flash data
-!:mime	application/x-shockwave-flash
->0	string		C		Macromedia Flash data (compressed)
-!:mime	application/x-shockwave-flash
->0	string		Z		Macromedia Flash data (lzma compressed)
-!:mime	application/x-shockwave-flash
->3   byte        x      \b, version %d
+0   name	swf-details

-1   string      WS
->4  lelong      !0
->>3 byte        255 Suspicious
->>>0    use     swf-details
+>0	string		F
+>>8	byte&0xfd	0x08		Macromedia Flash data
+!:mime	application/x-shockwave-flash
+>>>3	byte		x		\b, version %d
+>>8	byte&0xfe	0x10		Macromedia Flash data
+!:mime	application/x-shockwave-flash
+>>>3	byte		x		\b, version %d
+>>8	byte		0x18		Macromedia Flash data
+!:mime	application/x-shockwave-flash
+>>>3	byte		x		\b, version %d
+>>8	beshort&0xff87	0x2000		Macromedia Flash data
+!:mime	application/x-shockwave-flash
+>>>3	byte		x		\b, version %d
+>>8	beshort&0xffe0	0x3000		Macromedia Flash data
+!:mime	application/x-shockwave-flash
+>>>3	byte		x		\b, version %d
+>>8	byte&0x7	0
+>>>8	ubyte		>0x2f
+>>>>9	ubyte		<0x20		Macromedia Flash data
+!:mime	application/x-shockwave-flash
+>>>>>3	byte		x		\b, version %d

->>3 ubyte       <32
->>>3 ubyte      !0
->>>>0   use     swf-details
+>0	string		C
+>>8	byte		0x78		Macromedia Flash data (compressed)
+!:mime	application/x-shockwave-flash
+>>>3	byte		x		\b, version %d
+
+>0	string		Z
+>>8	byte		0x5d		Macromedia Flash data (lzma compressed)
+!:mime	application/x-shockwave-flash
+>>>3	byte		x		\b, version %d
+
+
+1	string		WS
+>4	ulelong		>14
+>>3	ubyte		!0
+>>>0	use		swf-details

 # From: Cal Peake <[email protected]>
 0	string		FLV\x01		Macromedia Flash Video
@@ -34,7 +56,7 @@

 #
 # Yosu Gomez
-0       string AGD2\xbe\xb8\xbb\xcd\x00 Macromedia Freehand 7 Document
-0       string AGD3\xbe\xb8\xbb\xcc\x00 Macromedia Freehand 8 Document
+0	string	AGD2\xbe\xb8\xbb\xcd\x00	Macromedia Freehand 7 Document
+0	string	AGD3\xbe\xb8\xbb\xcc\x00	Macromedia Freehand 8 Document
 # From Dave Wilson
-0	string AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
+0	string	AGD4\xbe\xb8\xbb\xcb\x00	Macromedia Freehand 9 Document
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: fonts,v 1.33 2016/09/14 01:26:26 christos Exp $
+# $File: fonts,v 1.37 2017/06/24 00:39:00 christos Exp $
 # fonts:  file(1) magic for font data
 #
 0	search/1	FONT		ASCII vfont text
@@ -19,17 +19,17 @@
 # URL:		https://en.wikipedia.org/wiki/PostScript_fonts
 # Reference:	http://partners.adobe.com/public/developer/en/font/5178.PFM.pdf
 # Modified by:	Joerg Jenderek
-# Note:		moved from ./msdos magic 
-# dfVersion 256=0100h 
-0		uleshort	0x0100		
+# Note:		moved from ./msdos magic
+# dfVersion 256=0100h
+0		uleshort	0x0100
 # GRR: line above is too general as it catches also TrueType font,
 # raw G3 data FAX, WhatsApp encrypted and Panorama database
 # dfType 129=0081h
->66		uleshort	0x0081		
+>66		uleshort	0x0081
 # dfVertRes 300=012Ch not needed as additional test
-#>>70		uleshort	0x012c		
+#>>70		uleshort	0x012c
 # dfHorizRes 300=012Ch
-#>>>72		uleshort	0x012c		
+#>>>72		uleshort	0x012c
 # dfDriverInfo points to postscript information section
 >>(101.l)	string/c	Postscript	Printer Font Metrics
 # above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID
@@ -40,13 +40,13 @@
 # dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking
 #>>>6		string		>\060		- %-.60s
 # dfDriverInfo
->>>139		ulelong		>0		
+>>>139		ulelong		>0
 # often abbreviated and same as filename
 >>>>(139.l)	string		x		%s
 # dfSize
 >>>2		ulelong		x		\b, %d bytes
 # dfFace 210=D2h 9Eh
->>>105		ulelong		>0		
+>>>105		ulelong		>0
 # Windows font name
 >>>>(105.l)	string		x		\b, %s
 # dfItalic
@@ -72,7 +72,7 @@
 #>104	belong		00000004		X11 SNF font data, MSB first
 !:mime	application/x-font-sfn
 # GRR: line below too general as it catches also Xbase index file t3-CHAR.NDX
-0	lelong		00000004		
+0	lelong		00000004
 >104	lelong		00000004		X11 SNF font data, LSB first
 !:mime	application/x-font-sfn

@@ -82,27 +82,29 @@
 # From: Joerg Jenderek
 # URL: http://grub.gibibit.com/New_font_format
 # Reference: util/grub-mkfont.c
-#		include/grub/fontformat.h 
+#		include/grub/fontformat.h
 # FONT_FORMAT_SECTION_NAMES_FILE
-0			string		FILE		
+0			string		FILE
 # FONT_FORMAT_PFF2_MAGIC
->8			string		PFF2		
+>8			string		PFF2
 # leng 4 only at the moment
->>4			ubelong		4		
+>>4			ubelong		4
 # FONT_FORMAT_SECTION_NAMES_FONT_NAME
 >>>12			string		NAME		GRUB2 font
 !:mime			application/x-font-pf2
 !:ext			pf2
 # length of font_name
->>>>16			ubelong		>0		
+>>>>16			ubelong		>0
 # font_name
 >>>>>20			string		>\0		"%-s"

 # X11 fonts, from Daniel Quinlan ([email protected])
 # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides)
-0	string		\001fcp			X11 Portable Compiled Font data
->12	byte		0x02			\b, LSB first
->12	byte		0x0a			\b, MSB first
+0	string		\001fcp			X11 Portable Compiled Font data,
+>12	lelong		^0x08			bit: LSB,
+>12	lelong		&0x08			bit: MSB,
+>12	lelong		^0x04			byte: LSB first
+>12	lelong		&0x04			byte: MSB first
 0	string		D1.0\015		X11 Speedo font data

 #------------------------------------------------------------------------------
@@ -134,28 +136,166 @@
 >4	beshort		>0		version %d

 # True Type fonts
-0	string	\000\001\000\000\000	TrueType font data
-!:mime application/x-font-ttf
+# Modified by: Joerg Jenderek
+# URL: https://en.wikipedia.org/wiki/TrueType
+# Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/
+#
+# sfnt version "typ1" used by some Apple, but no example found
+0	string	typ1
+>0	use		sfnt-font
+>0	use		sfnt-names
+# sfnt version "true" used by some Apple
+0	string	true
+>0	use		sfnt-font
+>0	use		sfnt-names
+# GRR: below test is too general
+# sfnt version often 0x00010000
+0	string	\000\001\000\000
+>0	use		sfnt-font
+>0	use		sfnt-names
+#	validate and display sfnt font data like number of tables
+0	name		sfnt-font
+# file 5.30 version assumes 00FFh as maximal number of tables
+#>4	ubeshort	<0x0100		
+# maximal 27 tables found like in Skia.ttf
+# 46 different table names mentioned on Apple specification
+# skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number
+>4	ubeshort	<47		
+# skip bad examples with garbage table names like in a5.show HYPERC MAC
+# tag names consist of up to four characters padded with spaces at end like
+# BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ...
+>>12	regex/4l	\^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ]	
+#>>>0	ubelong	x	\b, sfnt version 0x%x
+>>>0	ubelong	!0x4f54544f	TrueType
+!:mime	application/font-sfnt
+#!:mime	font/ttf
+!:apple	????tfil
+# .ttf for TrueType font
+# EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe
+!:ext	ttf/tte
+# sfnt version 4F54544Fh~OTTO
+>>>0	ubelong	=0x4f54544f	OpenType
+!:mime	application/font-sfnt
+#!:mime	font/otf
+!:apple	????OTTO
+!:ext	otf
+>>>0	ubelong	x		Font data
+# DSIG=44454947h table name implies a digitally signed font
+# search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432
+>>>12	search/432	DSIG		\b, digitally signed
+>>>4	ubeshort	x		\b, %d tables
+# minimal 9 tables found like in NISC18030.ttf
+#>>>4	ubeshort	<10		TMIN
+#>>>4	ubeshort	>24		TBIG
+# table directory entries
+>>>12	string		x		\b, 1st "%4.4s"
+
+#	search and display 1st name in sfnt font which is often copyright text
+#	does not work inside font collections
+0	name		sfnt-names
+# search for naming table
+>12	search/432/s	name		
+# biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf
+#>>>>&8	ubelong		>0x0100bd27	BIGGEST OFFSET
+>>&8	ubelong		>0x00100000	
+# offset of name table
+>>>&-4	ubelong		x		\b, name offset 0x%x
+# GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h
+>>&8	ubelong		<0x00100000	
+>>>&-16	ubelong		x		
+# name table
+>>>>(&8.L)	ubequad	x		
+# invalid format selector 
+#>>>>>&-8	ubeshort	!0	\b, invalid selector %x
+# minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf
+# maximal 1227 name records found like in Apple Chancery.ttf
+#>>>>>&-6	ubeshort	<0x4	mincount
+#>>>>>&-6	ubeshort	>130	maxcount
+>>>>>&-6	ubeshort	x	\b, %d names
+# offset to start of string storage from start of table
+#>>>>>&-4	ubeshort	x	\b, record offset %d
+# 1st name record
+# string offset from start of storage area 
+#>>>>>&8		ubeshort	x	\b, string offset %d
+# string length
+#>>>>>&6		ubeshort	x	\b, string length %d
+# minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf
+# also found 0 like in SWZCONLN.TTF
+#>>>>>&6		ubeshort	<8	MIN STRING
+# maximal name string 806 like in c:\Windows\Fonts\palabi.ttf
+#>>>>>&6		ubeshort	>805	MAX STRING
+# platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft
+#>>>>>&-2	ubeshort	>3	BAD PLATFORM
+>>>>>&-2	ubeshort	0	\b, Unicode
+>>>>>&-2	ubeshort	1	\b, Macintosh
+>>>>>&-2	ubeshort	3	\b, Microsoft
+# languageID (0~english Macintosh, 0409h~english Microsoft, ...)
+>>>>>&2		ubeshort	>0	\b, language 0x%x
+# name identifiers
+# often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ...
+>>>>>&4		ubeshort	>0	\b, type %d string
+# platform specific encoding:
+# 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0
+#>>>>>&0		ubeshort	x	\b, %d encoding
+>>>>>&0		ubeshort	0	
+# handle only name string offset 0 because do not know how to add 2 relative offsets
+>>>>>>&6		ubeshort	0	
+>>>>>>>&(&-14.S-18)	ubyte		!0	
+# GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h
+# often copyright string that starts like \251 2006 The Monotype Corporation
+>>>>>>>>&-1		string		x	\b, %-11.96s
+# test for unicode string
+>>>>>>>&(&-14.S-18)	ubyte		0	
+>>>>>>>>&0		lestring16	x	\b, %-11.96s
+# unicode encoding
+>>>>>&0		ubeshort	>0	
+>>>>>>&6		ubeshort	0	
+>>>>>>>&(&-14.S-17)	lestring16	x	\b, %-11.96s

 0	string		\007\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font
 0	string		\012\001\001\000Copyright\ (c)\ 199	Adobe Multiple Master font

 # TrueType/OpenType font collections (.ttc)
+# URL: https://en.wikipedia.org/wiki/OpenType
 # http://www.microsoft.com/typography/otspec/otff.htm
-0	string		ttcf		TrueType font collection data
->4	belong		0x00010000	\b, 1.0
->>8	belong		>0		\b, %d fonts
->4	belong		0x00020000	\b, 2.0
->>8	belong		>0		\b, %d fonts
+# Modified by: Joerg Jenderek
+# Note:	container for TrueType, OpenType font
+0	string		ttcf
+# skip ASCII text
+>4	ubyte		0		
+# sfnt version often 0x00010000 of 1st table is TrueType
+>>(12.L)	ubelong	!0x4f54544f	TrueType
+#!:mime	font/ttf
+!:apple	????tfil
+!:ext	ttc
+# sfnt version 4F54544Fh~OTTO of 1st table is OpenType font 
+>>(12.L)	ubelong	=0x4f54544f	OpenType
+#!:mime	font/otf
+!:apple	????OTTO
+# no example found for otc
+!:ext	ttc/otc
+>>4	ubyte		x		font collection data
+!:mime	application/font-sfnt
+#!:mime	font/collection
+# TCC version
+>>4	belong		0x00010000	\b, 1.0
+>>4	belong		0x00020000	\b, 2.0
+>>8	ubelong		>0		\b, %d fonts
+# array offset size = fonts * offsetsize = fonts * 4
+>>(8.L*4) ubequad	x		
 # 0x44454947 = 'DSIG'
->>>16	belong		0x44534947	\b, digitally signed
+>>>&4	belong		0x44534947	\b, digitally signed
+# offset to 1st font
+>>12	ubelong		x		\b, at 0x%x
+# point to 1st font that starts with sfnt version
+>>(12.L) use		sfnt-font

 # Opentype font data from Avi Bercovich
 0	string		OTTO		OpenType font data
 !:mime application/vnd.ms-opentype

-# Gurkan Sengun <[email protected]>, www.linuks.mine.nu 
-0	string		SplineFontDB:	Spline Font Database 
+# Gurkan Sengun <[email protected]>, www.linuks.mine.nu
+0	string		SplineFontDB:	Spline Font Database
 !:mime application/vnd.font-fontforge-sfd
 >14	string		x		version %s

@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: fsav,v 1.13 2013/03/25 17:18:47 christos Exp $
+# $File: fsav,v 1.14 2017/03/17 21:35:28 christos Exp $
 # fsav:  file(1) magic for datafellows fsav virus definition files
 # Anthon van der Neut ([email protected])

@@ -29,11 +29,11 @@
 #>>>>10	byte		11		\b12-
 #>>>>9	ubyte		>0		\b%02d)
 # ftp://ftp.f-prot.com/pub/sign2.zip
-#0	ubyte		0x62		
-#>1	ubyte		0xF5		
-#>>2	ubyte		0x1		
-#>>>3	ubyte		0x1		
-#>>>>4	ubyte		0x0e		
+#0	ubyte		0x62
+#>1	ubyte		0xF5
+#>>2	ubyte		0x1
+#>>>3	ubyte		0x1
+#>>>>4	ubyte		0x0e
 #>>>>>13		ubyte	>0		fsav virus signatures
 #>>>>>>11	ubyte	x		size 0x%02x
 #>>>>>>12	ubyte	x		\b%02x
@@ -44,16 +44,16 @@
 # .cvd files start with a 512 bytes colon separated header
 # ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
 # + gzipped tarball files
-0	string		ClamAV-VDB:	
+0	string		ClamAV-VDB:
 >11	string		>\0		Clam AntiVirus database %-.23s
->>34	string		:		
->>>35		string		!:	\b, version 
+>>34	string		:
+>>>35		string		!:	\b, version
 >>>>35		string		x 	\b%-.1s
->>>>>36		string 		!:	
+>>>>>36		string 		!:
 >>>>>>36	string		x 	\b%-.1s
->>>>>>>37	string		!:	
+>>>>>>>37	string		!:
 >>>>>>>>37	string		x 	\b%-.1s
->>>>>>>>>38	string		!:	
+>>>>>>>>>38	string		!:
 >>>>>>>>>>38	string		x 	\b%-.1s
 >512	string		\037\213	\b, gzipped
 >769	string		ustar\0		\b, tarred
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: games,v 1.14 2014/04/30 21:41:02 christos Exp $
+# $File: games,v 1.15 2017/03/17 21:35:28 christos Exp $
 # games:  file(1) for games

 # Fabio Bonelli <[email protected]>
@@ -39,7 +39,7 @@

 #0       string  -1\x0a  Quake I demo
 #>30     string  x        version %.4s
-#>61     string  x        level %s       
+#>61     string  x        level %s

 #0       string  5\x0a   Quake I save

@@ -240,7 +240,7 @@
 # Summary: NetImmerse game engine file
 # Extension .nif
 # Created by: Abel Cheung <[email protected]>
-0		string		NetImmerse\ File\ Format,\ Versio		
+0		string		NetImmerse\ File\ Format,\ Versio
 >&0		string		n\ 					NetImmerse game engine file
 >>&0		regex		[0-9a-z.]+				\b, version %s

@@ -0,0 +1,10 @@
+
+#------------------------------------------------------------------------------
+# $File: gconv
+# gconv: file(1) magic for iconv/gconv module configuration cache
+#
+# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC
+#
+# From: Marek Cermak <[email protected]>
+#
+0		lelong		0x20010324 	gconv module configuration cache data
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: geo,v 1.3 2013/01/04 00:47:02 christos Exp $
+# $File: geo,v 1.4 2017/03/17 21:35:28 christos Exp $
 # Geo- files from Kurt Schwehr <[email protected]>

 ######################################################################
@@ -57,7 +57,7 @@
 4	beshort	0x2002	GeoSwath RDF
 0	string	Start:-	GeoSwatch auf text file

-# Seabeam 2100 
+# Seabeam 2100
 # mbsystem code mb41
 0	string SB2100	SeaBeam 2100 multibeam sonar
 0	string SB2100DR	SeaBeam 2100 DR multibeam sonar
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: gnu,v 1.17 2016/07/16 22:17:04 christos Exp $
+# $File: gnu,v 1.18 2017/03/17 21:35:28 christos Exp $
 # gnu:  file(1) magic for various GNU tools
 #
 # GNU nlsutils message catalog file format
@@ -71,7 +71,7 @@
 # they will ordinarily reported as "compressed", but at least -z helps
 39      string          =<gmr:Workbook           Gnumeric spreadsheet

-# From: James Youngman <[email protected]> 
+# From: James Youngman <[email protected]>
 # gnu find magic
 0	string	\0LOCATE	GNU findutils locate database data
 >7	string	>\0		\b, format %s
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: gpt,v 1.3 2014/04/30 21:41:02 christos Exp $
+# $File: gpt,v 1.4 2017/03/17 21:35:28 christos Exp $
 #
 # GPT Partition table patterns.
 # Author: Rogier Goossens ([email protected])
@@ -36,7 +36,7 @@
 >>>>>>>>>>>>>(454.l*8192)	string		EFI\ PART	GPT partition table
 >>>>>>>>>>>>>>0			use		gpt-mbr-type
 >>>>>>>>>>>>>>&-8		use		gpt-table
->>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes		
+>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
 >>>>>>>>>>>>>(454.l*8192)	string		!EFI\ PART
 >>>>>>>>>>>>>>(454.l*4096)	string		EFI\ PART	GPT partition table
 >>>>>>>>>>>>>>>0		use		gpt-mbr-type
@@ -66,7 +66,7 @@
 >>>>>>>>>>>>>(470.l*8192)	string		EFI\ PART	GPT partition table
 >>>>>>>>>>>>>>0			use		gpt-mbr-type
 >>>>>>>>>>>>>>&-8		use		gpt-table
->>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes		
+>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
 >>>>>>>>>>>>>(470.l*8192)	string		!EFI\ PART
 >>>>>>>>>>>>>>(470.l*4096)	string		EFI\ PART	GPT partition table
 >>>>>>>>>>>>>>>0		use		gpt-mbr-type
@@ -96,7 +96,7 @@
 >>>>>>>>>>>>>(486.l*8192)	string		EFI\ PART	GPT partition table
 >>>>>>>>>>>>>>0			use		gpt-mbr-type
 >>>>>>>>>>>>>>&-8		use		gpt-table
->>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes		
+>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
 >>>>>>>>>>>>>(486.l*8192)	string		!EFI\ PART
 >>>>>>>>>>>>>>(486.l*4096)	string		EFI\ PART	GPT partition table
 >>>>>>>>>>>>>>>0		use		gpt-mbr-type
@@ -126,7 +126,7 @@
 >>>>>>>>>>>>>(502.l*8192)	string		EFI\ PART	GPT partition table
 >>>>>>>>>>>>>>0			use		gpt-mbr-type
 >>>>>>>>>>>>>>&-8		use		gpt-table
->>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes		
+>>>>>>>>>>>>>>0			ubyte		x		of 8192 bytes
 >>>>>>>>>>>>>(502.l*8192)	string		!EFI\ PART
 >>>>>>>>>>>>>>(502.l*4096)	string		EFI\ PART	GPT partition table
 >>>>>>>>>>>>>>>0		use		gpt-mbr-type
@@ -166,7 +166,7 @@
 ##>(8.l*8192)	string		EFI\ PART
 ##>>(8.l*8192)	use		gpt-mbr-type
 ##>>&-8		use		gpt-table
-##>>0		ubyte		x		of 8192 bytes		
+##>>0		ubyte		x		of 8192 bytes
 ##>(8.l*8192)	string		!EFI\ PART
 ##>>(8.l*4096)	string		EFI\ PART	GPT partition table
 ##>>>0		use		gpt-mbr-type
@@ -212,7 +212,7 @@
 >>486		ulelong		!1									\b (nonstandard: not at LBA 1)
 # GPT with protective MBR entry in partition 4
 >498		ubyte		0xee
->>502		ulelong		1		
+>>502		ulelong		1
 >>>446		string		!\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	\b (with hybrid MBR)
 >>502		ulelong		!1													\b (nonstandard: not at LBA 1)

@@ -0,0 +1,28 @@
+
+#------------------------------------------------------------------------------
+# $File: gpu,v 1.2 2017/03/23 22:11:53 christos Exp $
+# gpu: file(1) magic for GPU input files
+
+# Standard Portable Intermediate Representation (SPIR)
+# Documentation: https://www.khronos.org/spir
+# Typical file extension: .spv
+
+0	belong	0x07230203	Khronos SPIR-V binary, big-endian
+>4	belong	x		\b, version 0x%08x
+>8	belong	x		\b, generator 0x%08x
+
+0	lelong	0x07230203      Khronos SPIR-V binary, little-endian
+>4	lelong	x		\b, version 0x%08x
+>8	lelong	x		\b, generator 0x%08x
+
+# Vulkan Trace file
+# Documentation:
+# https://github.com/LunarG/VulkanTools/blob/master/vktrace/vktrace_common/\
+# vktrace_trace_packet_identifiers.h
+# Typical file extension: .vktrace
+
+8	lequad  0xABADD068ADEAFD0C	Vulkan trace file, little-endian
+>0	leshort	x			\b, version %d
+
+8	bequad  0xABADD068ADEAFD0C	Vulkan trace file, big-endian
+>0	beshort	x			\b, version %d
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: gringotts,v 1.5 2009/09/19 16:28:09 christos Exp $
+# $File: gringotts,v 1.6 2017/03/17 21:35:28 christos Exp $
 # gringotts:  file(1) magic for Gringotts
 # http://devel.pluto.linux.it/projects/Gringotts/
 # author: Germano Rizzo <[email protected]>
@@ -9,10 +9,10 @@
 #file format 1
 >3	string		1		v.1, MCRYPT S2K, SERPENT crypt, SHA-256 hash, ZLib lvl.9
 #file format 2
->3	string		2		v.2, MCRYPT S2K, 
+>3	string		2		v.2, MCRYPT S2K,
 >>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
 >>8	byte&0x70	0x10		SERPENT crypt,
->>8	byte&0x70	0x20		TWOFISH crypt, 
+>>8	byte&0x70	0x20		TWOFISH crypt,
 >>8	byte&0x70	0x30		CAST-256 crypt,
 >>8	byte&0x70	0x40		SAFER+ crypt,
 >>8	byte&0x70	0x50		LOKI97 crypt,
@@ -27,10 +27,10 @@
 >>8	byte&0x03	0x02		lvl.6
 >>8	byte&0x03	0x03		lvl.9
 #file format 3
->3	string		3		v.3, OpenPGP S2K, 
+>3	string		3		v.3, OpenPGP S2K,
 >>8	byte&0x70	0x00		RIJNDAEL-128 crypt,
 >>8	byte&0x70	0x10		SERPENT crypt,
->>8	byte&0x70	0x20		TWOFISH crypt, 
+>>8	byte&0x70	0x20		TWOFISH crypt,
 >>8	byte&0x70	0x30		CAST-256 crypt,
 >>8	byte&0x70	0x40		SAFER+ crypt,
 >>8	byte&0x70	0x50		LOKI97 crypt,
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: hitachi-sh,v 1.7 2015/09/30 20:32:35 christos Exp $
+# $File: hitachi-sh,v 1.8 2017/03/17 21:35:28 christos Exp $
 # hitach-sh: file(1) magic for Hitachi Super-H
 #
 # Super-H COFF
@@ -9,20 +9,20 @@
 # https://en.wikipedia.org/wiki/COFF
 # https://de.wikipedia.org/wiki/Common_Object_File_Format
 # http://www.delorie.com/djgpp/doc/coff/filhdr.html
-# below test line conflicts with 2nd NTFS filesystem sector 
+# below test line conflicts with 2nd NTFS filesystem sector
 # 2nd NTFS filesystem sector often starts with 0x05004e00 for unicode string 5 NTLDR
 # and Portable Gaming Notation Compressed format (*.WID http://pgn.freeservers.com/)
-0	beshort		0x0500		
+0	beshort		0x0500
 # test for unused flag bits (0x8000,0x0800,0x0400,0x0200,x0080) in f_flags
->18	ubeshort&0x8E80	0		
+>18	ubeshort&0x8E80	0
 # use big endian variant of subroutine to display name+variables+flags
-# for common object formated files 
+# for common object formated files
 >>0	use				\^display-coff

-0	leshort		0x0550		
+0	leshort		0x0550
 # test for unused flag bits in f_flags
->18	uleshort&0x8E80	0		
-# use little endian variant of subroutine to 
-# display name+variables+flags for common object formated files 
+>18	uleshort&0x8E80	0
+# use little endian variant of subroutine to
+# display name+variables+flags for common object formated files
 >>0	use				display-coff

@@ -1,28 +1,28 @@

 #------------------------------------------------------------------------------
-# $File: ibm370,v 1.9 2014/04/30 21:41:02 christos Exp $
+# $File: ibm370,v 1.10 2017/03/17 21:35:28 christos Exp $
 # ibm370:  file(1) magic for IBM 370 and compatibles.
 #
 # "ibm370" said that 0x15d == 0535 was "ibm 370 pure executable".
 # What the heck *is* "USS/370"?
 # AIX 4.1's "/etc/magic" has
 #
-#	0	short		0535		370 sysV executable 
+#	0	short		0535		370 sysV executable
 #	>12	long		>0		not stripped
 #	>22	short		>0		- version %d
 #	>30	long		>0		- 5.2 format
-#	0	short		0530		370 sysV pure executable 
+#	0	short		0530		370 sysV pure executable
 #	>12	long		>0		not stripped
 #	>22	short		>0		- version %d
 #	>30	long		>0		- 5.2 format
 #
 # instead of the "USS/370" versions of the same magic numbers.
 #
-0	beshort		0537		370 XA sysV executable 
+0	beshort		0537		370 XA sysV executable
 >12	belong		>0		not stripped
 >22	beshort		>0		- version %d
 >30	belong		>0		- 5.2 format
-0	beshort		0532		370 XA sysV pure executable 
+0	beshort		0532		370 XA sysV pure executable
 >12	belong		>0		not stripped
 >22	beshort		>0		- version %d
 >30	belong		>0		- 5.2 format
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: ibm6000,v 1.12 2013/09/16 15:12:42 christos Exp $
+# $File: ibm6000,v 1.13 2017/03/17 21:35:28 christos Exp $
 # ibm6000:  file(1) magic for RS/6000 and the RT PC.
 #
 0	beshort		0x01df		executable (RISC System/6000 V3.1) or obj module
@@ -21,7 +21,7 @@
 0	beshort		0x01f7		64-bit XCOFF executable or object module
 >20	belong		0		not stripped
 # GRR: this test is still too general as it catches also many FATs of DOS filesystems
-4	belong		&0x0feeddb0	
+4	belong		&0x0feeddb0
 # real core dump could not be 32-bit and 64-bit together
 >7	byte&0x03	!3		AIX core file
 >>1	byte		&0x01		fulldump
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: icc,v 1.1 2013/01/08 01:43:18 christos Exp $
+# $File: icc,v 1.5 2017/08/13 00:21:47 christos Exp $
 # icc:  file(1) magic for International Color Consortium file formats

 #
@@ -11,41 +11,204 @@
 #	http://www.color.org/specification/ICC1v43_2010-12.pdf
 #
 # for Specification ICC.1:2010 (Profile version 4.3.0.0).
+# URL: http://fileformats.archiveteam.org/wiki/ICC_profile
+# Reference: http://www.color.org/iccmax/ICC.2-2016-7.pdf
+# Update: Joerg Jenderek
 #
 # Bytes 36 to 39 contain a generic profile file signature of "acsp";
 # bytes 40 to 43 "may be used to identify the primary platform/operating
 # system framework for which the profile was created".
 #
-# There are other fields that might be worth dumping as well.
-#
+#	check and display ICC/ICM color profile
+0	name	color-profile
+>36	string		acsp
+# skip ASCII like Cognacspirit.txt by month <= 12
+>>26	ubeshort	<13
+# platform/operating system. Only 5 mentioned

+#
 # This appears to be what's used for Apple ColorSync profiles.
 # Instead of adding that, Apple just changed the generic "acsp" entry
 # to be for "ColorSync ICC Color Profile" rather than "Kodak Color
 # Management System, ICC Profile".
 # Yes, it's "APPL", not "AAPL"; see the spec.
-36	string		acspAPPL	ColorSync ICC Profile
-!:mime	application/vnd.iccprofile
+>>>40	string		APPL		ColorSync

 # Microsoft ICM color profile
-36	string		acspMSFT	Microsoft ICM Color Profile
-!:mime	application/vnd.iccprofile
+>>>40	string		MSFT		Microsoft

 # Yes, that's a blank after "SGI".
-36	string		acspSGI\ 	SGI ICC Profile
-!:mime	application/vnd.iccprofile
+>>>40	string		SGI\ 		SGI

 # XXX - is this what's used for the Sun KCMS or not?  The standard file
 # uses just "acsp" for that, but Apple's file uses it for "ColorSync",
 # and there *is* an identified "primary platform" value of SUNW.
-36	string		acspSUNW	Sun KCMS ICC Profile
+>>>40	string		SUNW		Sun KCMS
+
+# 5th platform
+>>>40	string		TGNT		Taligent
+
+# remaining "l" "e" of "color profile" printed later to avoid error
+>>>40	string		x 		color profi
+#>>>40	string		x		(%.4s)
 !:mime	application/vnd.iccprofile
+# for "ICM" extension only versions 2.x and for Kodak "CC" 2.0 is found
+>>>8	ubyte		=2
+# do not use empty message text to a avoid error like
+# icc, 82: Warning: Current entry does not yet have a description for adding a EXTENSION type
+# file.exe: could not find any valid magic files!
+>>>>9	ubyte		!0		\ble
+!:ext	icc/icm
+# minor version
+>>>>9	ubyte		=0		\bl
+# Kodak colour management system
+>>>>>4	string		=KCMS		\be
+!:ext	icc/icm/cc
+>>>>>4	string		!KCMS		\be
+!:ext	icc/icm
+>>>8	ubyte		!2		\ble
+!:ext	icc
+# Profile version major.4bit-minor.sub1.sub2 like 4.3.0.0 (04300000h)
+>>>8	ubyte		x		%u
+>>>9	ubyte/16	x		\b.%u
+# reserved and shall be null but 205.205 in umx1220u.icm
+>>>10	ubyte		>0		\b.%u
+>>>>11	ubyte		>0		\b.%u
+# preferred colour management module like appl CCMS KCMS Lino UCCM "Win " "FF  "
+# skip space like in brmsl08f.icm and null like in brmsl09f.icm, brmsl07f.icm
+>>>4	string		>\ 		\b, type %.2s
+>>>>6	string		>\  		\b%.1s
+>>>>>7	string		>\  		\b%.1s
+# colour space "XYZ " "Lab " "RGB " CMYK GRAY ...
+>>>16	string		x		\b, %.3s
+>>>19	string		>\  		\b%.1s
+# Profile Connection Space (PCS) field usually "XYZ " or "Lab " but sometimes
+# null or CMYK like in ISOcoated_v2_to_PSOcoated_v3_DeviceLink.icc
+>>>20	string		>\0		\b/%.3s
+>>>>23	string		>\ 		\b%.1s
+# eleven device classes
+>>>12	string		x		\b-%.4s device
+# skip 00001964h in hpf69000.icc or 0h in XRDC50Q.ICM or " ROT" in brmsl05f.icm
+>>>52	string		>\040
+# skip "none" model like in "Trinitron Compatible 9300K G2.2.icm"
+>>>>52	ubelong		!0x6e6f6e65
+# device manufacturer field like "HP  " "IBM " EPSO
+>>>>>48	string		x		\b, %.2s
+>>>>>50	string		>\  		\b%.1s
+>>>>>51	string		>\  		\b%.1s
+# model like "ADI " "A265" and skip 20000404h in IS330.icm for RICOH RUSSIAN-SC
+>>>>>52	string		>\ \  		\b/%.3s
+>>>>>>55 string		>\  		\b%.1s
+>>>>>52	string		x		model
+# creator (often same as manufacture) like HP SONY XROX or null like in A925A.icm
+>>>80	string		>\0		by %.2s
+>>>>82	string		>\  		\b%.1s
+>>>>>83	string		>\  		\b%.1s
+# profile size
+>>>0	ubelong		x		\b, %u bytes
+# skip invalid date 0 like in linearSRGB.icc
+>>>24	ubequad		!0
+# datetime dd-mm-yyyy hh:mm:ss
+>>>>28	ubeshort	x		\b, %u
+# month <= 12
+>>>>26	ubeshort	x		\b-%u
+# year
+>>>>24	ubeshort	x		\b-%u
+# do not display midnight time like in CNHP8308.ICC
+>>>>30	ubequad&0xFFffFFffFFff0000	!0
+# hour <= 24
+>>>>>30	ubeshort	x		%u
+# minutes <= 59
+>>>>>32	ubeshort	x		\b:%.2u
+# seconds <= 59
+>>>>>34	ubeshort	x		\b:%.2u
+# vendor specific flags like 2 in HPCLJ5.ICM
+>>>44	ubeshort	>0		\b, 0x%x vendor flags
+# profile flags bits 0-2 of least 16 used by ICC
+#>>>44	ubelong		>0		\b, 0x%x flags
+# icEmbeddedProfileTrue
+>>>44	ubelong		&1		\b, embedded
+# icEmbeddedProfileFalse
+#>>>44	ubelong		^1		\b, not embedded
+# icUseWithEmbeddedDataOnly
+>>>44	ubelong		&2		\b, dependently
+# icUseAnywhere
+#>>>44	ubelong		^2		\b, independently
+>>>44	ubelong		&4		\b, MCS
+#>>>44	ubelong		^4		\b, no MCS
+# vendor specific device attributes 1~srgb.icc
+# E000D00h~CNB7QEDA.ICM C000A00h~CNB5FCAA.ICM 01040401h~CNB25PE3.ICM
+>>>56	ubelong		>0		\b, 0x%x vendor attribute
+# ICC device attributes bits 0-7 used
+#>>>60	ubelong		x		\b, 0x%x attribute
+# http://www.color.org/icc34.h
+>>>60	ubelong		&0x01		\b, transparent
+#>>>60	ubelong		^0x01		\b, reflective
+>>>60	ubelong		&0x02		\b, matte
+#>>>60	ubelong		^0x02		\b, glossy
+>>>60	ubelong		&0x04		\b, negative
+#>>>60	ubelong		^0x04		\b, positive
+>>>60	ubelong		&0x08		\b, black&white
+#>>>60	ubelong		^0x08		\b, colour
+>>>60	ubelong		&0x10		\b, non-paper
+#>>>60	ubelong		^0x10		\b, paper
+>>>60	ubelong		&0x20		\b, non-textured
+#>>>60	ubelong		^0x20		\b, textured
+>>>60	ubelong		&0x40		\b, non-isotropic
+#>>>60	ubelong		^0x40		\b, isotropic
+>>>60	ubelong		&0x80		\b, self-luminous
+#>>>60	ubelong		^0x80		\b, non-self-luminous
+# rendering intent 0-3 but 7AEA5027h in EE051__1.ICM 6CB1BCh in EE061__1.ICM
+>>>64	ubelong		>3		\b, 0x%x rendering intent
+#>>>64	ubelong		=0		\b, perceptual
+>>>64	ubelong		=1		\b, relative colorimetric
+>>>64	ubelong		=2		\b, saturation
+>>>64	ubelong		=3		\b, absolute colorimetric
+# PCS illuminant (3*s15Fixed16Numbers) often 0000f6d6 00010000 0000d32d
+>>>71	ubequad		!0xd6000100000000d3	\b, PCS
+# usually X~0.9642*65536=63189.8112~63190=F6D5h ; but also found
+# often F6D6 in gt5000r.icm, F6B8 in kodakce.icm, F6CA in RSWOP.icm
+>>>>68	ubelong			!0x0000f6d5	X=0x%x
+# usually Y=1.0~00010000h but Y=0 in brmsl07f.icm
+>>>>72	ubelong			!0x00010000	Y=0x%x
+# usually Z~0.8249*65536=54060.6464~54061=D32Dh ; but also found
+# D2F7 in hp1200c.icm, often D32C in A925A.icm, D309 in RSWOP.icm , D2F8 in kodak_dc.icm
+>>>>76	ubelong			!0x0000d32d	Z=0x%x
+# Profile ID. MD5 fingerprinting method as defined in Internet RFC 1321.
+>>>84	ubequad		>0		\b, 0x%llx MD5
+# reserved in older versions should be zero but also found CDCDCDCDCDCDCDCD
+#>>100	ubequad		x		\b 0x%llx reserved
+# tag table
+# 6 <= tags count <= 43
+#>>>128	ubelong		>43		\b, %u tags
+>>>128	ubelong		x
+# shall contain the profileDescriptionTag "desc" , copyrightTag "cprt"
+# search range = tags count * 12 -8=< maximal tag count * 12 -8= 43 * 12 -8= 508
+>>>>132	search/508	cprt
+# but no copyright tag in linearSRGB.icc
+# beneath /System/Library/Frameworks/WebKit.framework/
+# Versions/A/Frameworks/WebCore.framework/Versions/A/Resources
+>>>>132	default		x		\b, no copyright tag
+# 1st tag
+#>>>132	string		x		\b, 1st tag %.4s
+#>>>136	ubelong		x		0x%x offset
+#>>>140	ubelong		x		0x%x len
+# 2nd tag,...
+# look also for profileDescriptionTag "desc"
+>>>132	search/508	desc
+# look further for TextDescriptionType "desc" signature
+>>>>(&0.L)	string		=desc
+>>>>>&4		pstring/l	x	"%s"
+# look alternative for multiLocalizedUnicodeType "mluc" signature like in VideoPAL.icc
+>>>>(&0.L)	string		=mluc
+>>>>>&(&8.L)	ubequad		x
+>>>>>>&4	bestring16	x	'%s'

 # Any other profile.
 # XXX - should we use "acsp\0\0\0\0" for "no primary platform" profiles,
 # and use "acsp" for everything else and dump the "primary platform"
 # string in those cases?
-36	string		acsp		ICC Profile
-!:mime	application/vnd.iccprofile
+36	string		acsp
+>0	use		color-profile


@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: images,v 1.117 2016/07/05 19:12:21 christos Exp $
+# $File: images,v 1.126 2017/06/11 22:25:44 christos Exp $
 # images:  file(1) magic for image formats (see also "iff", and "c-lang" for
 # XPM bitmaps)
 #
@@ -26,23 +26,28 @@
 # test of Color Map Type 0~no 1~color map
 # and Image Type 1 2 3 9 10 11 32 33
 # and Color Map Entry Size 0 15 16 24 32
-0	ubequad&0x00FeC400000000C0	0	
+0	ubequad&0x00FeC400000000C0	0
 # skip more garbage by looking for positive image type
->2	ubyte			>0		
+>2	ubyte			>0
 # skip some compiled terminfo by looking for image type less equal 33
->>2	ubyte			<34		
+>>2	ubyte			<34
 # skip arches.3200 , Finder.Root , Slp.1 by looking for low pixel sizes 15 16 24 32
->>>16	ubyte			<33		
+>>>16	ubyte			<33
 # skip more by looking for pixel size 0Fh 10h 18h 20h
->>>>16	ubyte&0xC0		0x00	
-# skip 260-16.ico by looking for no color map
->>>>>1	ubyte			0	
-# implies no first map entry
->>>>>>3	uleshort		0	
->>>>>>>0	use		tga-image
+>>>>16	ubyte&0xC0		0x00
 # Color Map
->>>>>1	ubyte			>0	
+>>>>>1	belong&0xfff7ffff	0x01010000
 >>>>>>0		use		tga-image
+>>>>>1	belong&0xfff7ffff	0x00020000
+>>>>>>0		use		tga-image
+>>>>>1	belong&0xfff7ffff	0x00030000
+>>>>>>0		use		tga-image
+>>>>>1	default			x
+# skip 260-16.ico by looking for no color map
+>>>>>>1	ubyte			0
+# implies no first map entry
+>>>>>>>3	uleshort		0
+>>>>>>>>0	use		tga-image
 #	display tga bitmap image information
 0	name				tga-image
 >2	ubyte		<34		Targa image data
@@ -78,7 +83,7 @@
 >14	uleshort	=0		65536
 # Image Pixel Size 15 16 24 32
 >16	ubyte		x		x %d
-# X origin of image. 0 normal 
+# X origin of image. 0 normal
 >8	uleshort	>0		+%d
 # Y origin of image. 0 normal; positive for top
 >10	uleshort	>0		+%d
@@ -90,27 +95,27 @@
 >17	ubyte		&0x10		- right
 #>17	ubyte		^0x10		- left
 # some info say other bits 6-7 should be zero
-# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm 
+# but data storage interleave by http://www.fileformat.info/format/tga/corion.htm
 # 00 - no interleave;01 - even/odd interleave; 10 - four way interleave; 11 - reserved
 #>17	ubyte&0xC0	0x00		- no interleave
 >17	ubyte&0xC0	0x40		- interleave
 >17	ubyte&0xC0	0x80		- four way interleave
 >17	ubyte&0xC0	0xC0		- reserved
-# positive length implies identification field 
->0	ubyte		>0		
+# positive length implies identification field
+>0	ubyte		>0
 >>18	string		x		"%s"
 # last 18 bytes of newer tga file footer signature
->18	search/4261301/s	TRUEVISION-XFILE.\0	
+>18	search/4261301/s	TRUEVISION-XFILE.\0
 # extension area offset if not 0
->>&-8		ulelong			>0			
+>>&-8		ulelong			>0
 # length of the extension area. normal 495 for version 2.0
->>>(&-4.l)	uleshort		0x01EF		
+>>>(&-4.l)	uleshort		0x01EF
 # AuthorName[41]
 >>>>&0		string			>\0		- author "%-.40s"
 # Comment[324]=4 * 80 null terminated
 >>>>&41		string			>\0		- comment "%-.80s"
 # date
->>>>&365	ubequad&0xffffFFFFffff0000	!0		
+>>>>&365	ubequad&0xffffFFFFffff0000	!0
 # Day
 >>>>>&-6		uleshort		x		%d
 # Month
@@ -118,7 +123,7 @@
 # Year
 >>>>>&-4		uleshort		x		\b-%d
 # time
->>>>&371	ubequad&0xffffFFFFffff0000	!0		
+>>>>&371	ubequad&0xffffFFFFffff0000	!0
 # hour
 >>>>>&-8		uleshort		x		%d
 # minutes
@@ -128,14 +133,14 @@
 # JobName[41]
 >>>>&377		string			>\0		- job "%-.40s"
 # JobHour Jobminute Jobsecond
->>>>&418	ubequad&0xffffFFFFffff0000	!0		
+>>>>&418	ubequad&0xffffFFFFffff0000	!0
 >>>>>&-8		uleshort		x		%d
 >>>>>&-6		uleshort		x		\b:%.2d
 >>>>>&-4		uleshort		x		\b:%.2d
 # SoftwareId[41]
 >>>>&424		string			>\0		- %-.40s
 # SoftwareVersionNumber
->>>>&424	ubyte				>0		
+>>>>&424	ubyte				>0
 >>>>>&40		uleshort/100		x		%d
 >>>>>&40		uleshort%100		x		\b.%d
 # VersionLetter
@@ -143,16 +148,16 @@
 # KeyColor
 >>>>&468		ulelong			>0		- keycolor 0x%8.8x
 # Denominator of Pixel ratio. 0~no pixel aspect
->>>>&474	uleshort			>0			
+>>>>&474	uleshort			>0
 # Numerator
 >>>>>&-4		uleshort		>0		- aspect %d
 >>>>>&-2		uleshort		x		\b/%d
 # Denominator of Gamma ratio. 0~no Gamma value
->>>>&478	uleshort			>0		
+>>>>&478	uleshort			>0
 # Numerator
 >>>>>&-4		uleshort		>0		- gamma %d
 >>>>>&-2		uleshort		x		\b/%d
-# ColorOffset 
+# ColorOffset
 #>>>>&480	ulelong			x		- col offset 0x%8.8x
 # StampOffset
 #>>>>&484	ulelong			x		- stamp offset 0x%8.8x
@@ -170,43 +175,43 @@
 >>&0	regex		=[0-9]{1,50} 			\b, size = %s x
 >>>&0	regex		=[0-9]{1,50}			\b %s

-0	search/1	P1		
->0	regex/4		P1\\s
+0	search/1	P1
+>0	regex/4		P1[\040\t\f\r\n]
 >>0	use		netpbm
 >>>0	string		x	\b, bitmap
 !:strength + 45
 !:mime	image/x-portable-bitmap

-0	search/1	P2		
->0	regex/4		P2\\s
+0	search/1	P2
+>0	regex/4		P2[\040\t\f\r\n]
 >>0	use		netpbm
 >>>0	string		x	\b, greymap
 !:strength + 45
 !:mime	image/x-portable-greymap

 0	search/1	P3
->0	regex/4		P3\\s
+>0	regex/4		P3[\040\t\f\r\n]
 >>0	use		netpbm
 >>>0	string		x	\b, pixmap
 !:strength + 45
 !:mime	image/x-portable-pixmap

-0	string		P4		
->0	regex/4		P4\\s
+0	string		P4
+>0	regex/4		P4[\040\t\f\r\n]
 >>0	use		netpbm
 >>>0	string		x	\b, rawbits, bitmap
 !:strength + 45
 !:mime	image/x-portable-bitmap

-0	string		P5		
->0	regex/4		P5\\s
+0	string		P5
+>0	regex/4		P5[\040\t\f\r\n]
 >>0	use		netpbm
 >>>0	string		x	\b, rawbits, greymap
 !:strength + 45
 !:mime	image/x-portable-greymap

-0	string		P6		
->0	regex/4		P6\\s
+0	string		P6
+>0	regex/4		P6[\040\t\f\r\n]
 >>0	use		netpbm
 >>>0	string		x	\b, rawbits, pixmap
 !:strength + 45
@@ -303,7 +308,7 @@
 >>>8	leshort		0x8765		\bJBIG
 >>>8	leshort		0x8798		\bJPEG2000
 >>>8	leshort		0x8799		\bNikon NEF Compressed
->>>8	default		x	
+>>>8	default		x
 >>>>8	leshort		x		\b(unknown 0x%x)
 >>>12	use		tiff_entry
 >0	leshort		0x106		\b, PhotometricIntepretation=
@@ -414,21 +419,35 @@
 # (Greg Roelofs, [email protected])
 # (Albert Cahalan, [email protected])
 #
-# 137 P N G \r \n ^Z \n [4-byte length] H E A D [HEAD data] [HEAD crc] ...
+# 137 P N G \r \n ^Z \n [4-byte length] I H D R [HEAD data] [HEAD crc] ...
 #
-0	string		\x89PNG\x0d\x0a\x1a\x0a		PNG image data
+
+# IHDR parser
+0	name		png-ihdr
+>0	belong		x		\b, %d x
+>4	belong		x		%d,
+>8	byte		x		%d-bit
+>9	byte		0		grayscale,
+>9	byte		2		\b/color RGB,
+>9	byte		3		colormap,
+>9	byte		4		gray+alpha,
+>9	byte		6		\b/color RGBA,
+#>10	byte		0		deflate/32K,
+>12	byte		0		non-interlaced
+>12	byte		1		interlaced
+
+# Standard PNG image.
+0	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0DIHDR	PNG image data
 !:mime	image/png
->16	belong		x		\b, %d x
->20	belong		x		%d,
->24	byte		x		%d-bit
->25	byte		0		grayscale,
->25	byte		2		\b/color RGB,
->25	byte		3		colormap,
->25	byte		4		gray+alpha,
->25	byte		6		\b/color RGBA,
-#>26	byte		0		deflate/32K,
->28	byte		0		non-interlaced
->28	byte		1		interlaced
+!:strength +10
+>16	use		png-ihdr
+
+# Apple CgBI PNG image.
+0	string		\x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x04CgBI
+>24	string  	\x00\x00\x00\x0DIHDR	PNG image data (CgBI)
+!:mime	image/png
+!:strength +10
+>>32	use		png-ihdr

 # possible GIF replacements; none yet released!
 # (Greg Roelofs, [email protected])
@@ -438,13 +457,13 @@
 !:mime	image/x-unknown
 #
 # GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
-#					
+#
 0	string		FGF95a		FGF image (GIF+deflate beta)
 !:mime	image/x-unknown
 #
 # GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
 # (best; not yet implemented):
-#					
+#
 0	string		PBF		PBF image (deflate compression)
 !:mime	image/x-unknown

@@ -528,19 +547,19 @@
 # http://www.blackfiveservices.co.uk/awbmtools.shtml
 # http://biosgfx.narod.ru/v3/
 # http://biosgfx.narod.ru/abr-2/
-0	string		AWBM		
+0	string		AWBM
 >4	leshort		<1981		Award BIOS bitmap
 !:mime	image/x-award-bmp
 # image width is a multiple of 4
->>4	leshort&0x0003	0		
+>>4	leshort&0x0003	0
 >>>4		leshort	x		\b, %d
 >>>6		leshort	x		x %d
 >>4	leshort&0x0003	>0		\b,
->>>4	leshort&0x0003	=1		
+>>>4	leshort&0x0003	=1
 >>>>4		leshort	x		%d+3
->>>4	leshort&0x0003	=2		
+>>>4	leshort&0x0003	=2
 >>>>4		leshort	x		%d+2
->>>4	leshort&0x0003	=3		
+>>>4	leshort&0x0003	=3
 >>>>4		leshort	x		%d+1
 >>>6		leshort	x		x %d
 # at offset 8 starts imagedata followed by "RGB " marker
@@ -764,11 +783,11 @@
 # http://web.archive.org/web/20100206055706/http://www.qzx.com/pc-gpe/pcx.txt
 # GRR: original test was still too general as it catches xbase examples T5.DBT,T6.DBT with 0xa000000
 # test for bytes 0x0a,version byte (0,2,3,4,5),compression byte flag(0,1), bit depth (>0) of PCX or T5.DBT,T6.DBT
-0	ubelong&0xffF8fe00	0x0a000000	
-# for PCX bit depth > 0 
->3	ubyte		>0	
+0	ubelong&0xffF8fe00	0x0a000000
+# for PCX bit depth > 0
+>3	ubyte		>0
 # test for valid versions
->>1	ubyte		<6	
+>>1	ubyte		<6
 >>>1	ubyte		!1	PCX
 !:mime	image/x-pcx
 #!:mime	image/pcx
@@ -828,29 +847,29 @@
 # Update: Joerg Jenderek
 # See http://fileformats.archiveteam.org/wiki/GEM_Raster
 # For variations, also see:
-#    http://www.seasip.info/Gem/ff_img.html (Ventura) 
+#    http://www.seasip.info/Gem/ff_img.html (Ventura)
 #    http://www.atari-wiki.com/?title=IMG_file (XIMG, STTT)
 #    http://www.fileformat.info/format/gemraster/spec/index.htm (XIMG, STTT)
 #    http://sylvana.net/1stguide/1STGUIDE.ENG (TIMG)
 0       beshort     0x0001
 # header_size
->2      beshort     0x0008      
+>2      beshort     0x0008
 >>0     use gem_info
->2      beshort     0x0009      
+>2      beshort     0x0009
 >>0     use gem_info
 # no example for NOSIG
->2      beshort     24      
+>2      beshort     24
 >>0     use gem_info
 # no example for HYPERPAINT
->2      beshort     25      
+>2      beshort     25
 >>0     use gem_info
-16      string      XIMG\0      
+16      string      XIMG\0
 >0      use gem_info
 # no example
-16      string      STTT\0\x10  
+16      string      STTT\0\x10
 >0      use gem_info
 # no example or description
-16      string      TIMG\0      
+16      string      TIMG\0
 >0      use gem_info

 0   name        gem_info
@@ -859,15 +878,15 @@
 # http://www.snowstone.org.uk/riscos/mimeman/mimemap.txt
 !:mime	image/x-gem
 # header_size 24 25 27 59 779 words for colored bitmaps
->>2	beshort		>9		
+>>2	beshort		>9
 >>>16	string		STTT\0\x10	STTT
 >>>16	string		TIMG\0		TIMG
 # HYPERPAINT or NOSIG variant
->>>16	string		\0\x80		
+>>>16	string		\0\x80
 >>>>2	beshort		=24		NOSIG
 >>>>2	beshort		!24		HYPERPAINT
 # NOSIG or XIMG variant
->>>16	default		x		
+>>>16	default		x
 >>>>16	string		!XIMG\0		NOSIG
 >>16	string		=XIMG\0		XIMG Image data
 !:ext	img/ximg
@@ -1177,7 +1196,7 @@
 # updated by: Joerg Jenderek
 # URL: http://techmods.net/nuvi/
 0	string	GARMIN\ BITMAP\ 01	Garmin Bitmap file
-# extension is also used for 
+# extension is also used for
 # Sony SRF raw image (image/x-sony-srf)
 # SRF map
 # Terragen Surface Map (http://www.planetside.co.uk/terragen)
@@ -1318,7 +1337,7 @@
 !:mime	image/x-icns
 !:apple	????icns
 !:ext icns
->4	ubelong		>0		
+>4	ubelong		>0
 # file size
 >>4	ubelong		x		\b, %d bytes
 # icon type
@@ -1451,3 +1470,12 @@
 >0x10	string	GVRT	Sega GVR image:
 >>0x10	use	sega-gvr-image-header
 >>0x08	belong	x	\b, global index = %u
+
+# Light Field Picture
+# Documentation: http://optics.miloush.net/lytro/TheFileFormat.aspx
+# Typical file extensions: .lfp .lfr .lfx
+
+0	belong	0x894C4650
+>4	belong	0x0D0A1A0A
+>12	belong	0x00000000	Lytro Light Field Picture
+>8	belong	x		\b, version %d
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: intel,v 1.14 2015/11/10 00:13:27 christos Exp $
+# $File: intel,v 1.15 2017/03/17 21:35:28 christos Exp $
 # intel:  file(1) magic for x86 Unix
 #
 # Various flavors of x86 UNIX executable/object (other than Xenix, which
@@ -36,8 +36,8 @@
 # ./msdos (version 5.25) labeled the next entry as "MS Windows COFF Intel 80386 object file"
 # ./intel (version 5.25) label labeled the next entry as "80386 COFF executable"
 # SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan
-0	leshort		=0514		
-# use subroutine to display name+flags+variables for common object formated files 
+0	leshort		=0514
+# use subroutine to display name+flags+variables for common object formated files
 >0	use				display-coff
 #>12	lelong		>0		not stripped
 # no hint found, that at offset 22 is version
@@ -1,7 +1,7 @@

 #------------------------------------------------------------------------------
-# $File: isz,v 1.3 2014/04/30 21:41:02 christos Exp $
-# ISO Zipped file format 
+# $File: isz,v 1.4 2017/03/17 21:35:28 christos Exp $
+# ISO Zipped file format
 # http://www.ezbsystems.com/isz/iszspec.txt
 0	string	IsZ!	ISO Zipped file
 >4	byte	x	\b, header size %u
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: jpeg,v 1.30 2016/07/04 15:18:23 christos Exp $
+# $File: jpeg,v 1.31 2017/03/17 21:35:28 christos Exp $
 # JPEG images
 # SunOS 5.5.1 had
 #
@@ -53,14 +53,14 @@
 >>5	beshort		x		\b%d
 >>9	byte		x		\b, frames %d

->0	beshort		0xFFC1		
+>0	beshort		0xFFC1
 >>(2.S+2)	use			jpeg_segment
 >>4	byte		x		\b, extended sequential, precision %d
 >>7	beshort		x		\b, %dx
 >>5	beshort		x		\b%d
 >>9	byte		x		\b, frames %d

->0	beshort		0xFFC2		
+>0	beshort		0xFFC2
 >>(2.S+2)	use			jpeg_segment
 >>4	byte		x		\b, progressive, precision %d
 >>7	beshort		x		\b, %dx
@@ -71,11 +71,11 @@
 >0	beshort		0xFFC4
 >>(2.S+2)	use			jpeg_segment

->0	beshort		0xFFE1		
+>0	beshort		0xFFE1
 # Recursion handled by FFE0
 #>>(2.S+2)	use			jpeg_segment
 >>4	string		Exif		\b, Exif Standard: [
->>>10	indirect/r	x		
+>>>10	indirect/r	x
 >>>10	string		x		\b]

 # Application specific markers
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: kerberos,v 1.1 2014/12/10 18:45:43 christos Exp $
+# $File: kerberos,v 1.2 2017/03/17 21:35:28 christos Exp $
 # kerberos: MIT kerberos file binary formats
 #

@@ -38,7 +38,7 @@
 >>>>>&0		bedate		x		\b, date=%s
 >>>>>>&0	byte		x		\b, kvno=%u
 #>>>>>>>&0	pstring/H	x
-#>>>>>>>>&0	belong		x	
+#>>>>>>>>&0	belong		x
 #>>>>>>>>>>&0	use		keytab_entry

 0		belong		0x05020000	Kerberos Keytab file
@@ -1,13 +1,13 @@

 #------------------------------------------------------------------------------
-# $File: kml,v 1.3 2010/11/25 15:00:12 christos Exp $
+# $File: kml,v 1.4 2017/03/17 21:35:28 christos Exp $
 # Type: Google KML, formerly Keyhole Markup Language
 # Future development of this format has been handed
 # over to the Open Geospatial Consortium.
 # http://www.opengeospatial.org/standards/kml/
 # From: Asbjoern Sloth Toennesen <[email protected]>
 0 string/t    \<?xml
->20  search/400 \ xmlns= 
+>20  search/400 \ xmlns=
 >>&0 regex ['"]http://earth.google.com/kml Google KML document
 !:mime application/vnd.google-earth.kml+xml
 >>>&1 string 2.0' \b, version 2.0
@@ -25,7 +25,7 @@
 >>>&1 string/t 2.2 \b, version 2.2

 #------------------------------------------------------------------------------
-# Type: Google KML Archive (ZIP based) 
+# Type: Google KML Archive (ZIP based)
 # http://code.google.com/apis/kml/documentation/kml_tut.html
 # From: Asbjoern Sloth Toennesen <[email protected]>
 0 string    PK\003\004
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: linux,v 1.63 2015/08/24 05:16:11 christos Exp $
+# $File: linux,v 1.64 2017/03/17 21:35:28 christos Exp $
 # linux:  file(1) magic for Linux files
 #
 # Values for Linux/i386 binaries, from Daniel Quinlan <[email protected]>
@@ -199,7 +199,7 @@
 ############################################################################
 # Linux 8086 executable
 0	lelong&0xFF0000FF 0xC30000E9	Linux-Dev86 executable, headerless
->5	string		.		
+>5	string		.
 >>4	string		>\0		\b, libc version %s

 0	lelong&0xFF00FFFF 0x4000301	Linux-8086 executable
@@ -213,7 +213,7 @@
 >2	byte&0x40	!0		\b, A_PURE
 >2	byte&0x80	!0		\b, A_TOVLY
 >28     long            !0              \b, not stripped
->37	string		.		
+>37	string		.
 >>36	string		>\0		\b, libc version %s

 # 0	lelong&0xFF00FFFF 0x10000301	ld86 I80386 executable
@@ -241,7 +241,7 @@
 >24	lelong	x			%d symbols
 >28	lelong	x			%d ocons

-# Linux Logical Volume Manager (LVM) 
+# Linux Logical Volume Manager (LVM)
 # Emmanuel VARAGNAT <[email protected]>
 #
 # System ID, UUID and volume group name are 128 bytes long
@@ -301,7 +301,7 @@
 >>&0x20         lequad  x              \b, size: %lld

 0x618           string  LVM2\ 001      LVM2 PV (Linux Logical Volume Manager)
->&(&-12.l-0x21) byte    x              
+>&(&-12.l-0x21) byte    x
 # display UUID in LVM format + display all 32 bytes (instead of max string length: 31)
 >>&0x0          string  >\x2f          \b, UUID: %.6s
 >>&0x6          string  >\x2f          \b-%.4s
@@ -340,7 +340,7 @@
 # Summary: Xen saved domain file
 # Created by: Radek Vokal <[email protected]>
 0	string		LinuxGuestRecord	Xen saved domain
->20	search/256	(name			
+>20	search/256	(name
 >>&1	string		x			(name %s)

 # Type: Xen, the virtual machine monitor
@@ -397,7 +397,7 @@
 >>0x1046	ubeshort	x	\b%04x

 # Linux device tree:
-# File format description can be found in the Linux kernel sources at 
+# File format description can be found in the Linux kernel sources at
 # Documentation/devicetree/booting-without-of.txt
 # From Christoph Biedl
 0		belong		0xd00dfeed
@@ -1,13 +1,13 @@

 #------------------------------------------------------------------------------
-# $File: lisp,v 1.24 2015/11/30 20:54:26 christos Exp $
+# $File: lisp,v 1.25 2017/03/17 21:35:28 christos Exp $
 # lisp:  file(1) magic for lisp programs
 #
 # various lisp types, from Daniel Quinlan ([email protected])

 # updated by Joerg Jenderek
 # GRR: This lot is too weak
-#0	string	;;			
+#0	string	;;
 # windows INF files often begin with semicolon and use CRLF as line end
 # lisp files are mainly created on unix system with LF as line end
 #>2	search/4096	!\r		Lisp/Scheme program text
@@ -28,9 +28,9 @@

 # URL: https://en.wikipedia.org/wiki/Emacs_Lisp
 # Reference: http://ftp.gnu.org/old-gnu/emacs/elisp-manual-18-1.03.tar.gz
-# Update: Joerg Jenderek 
+# Update: Joerg Jenderek
 # Emacs 18 - this is always correct, but not very magical.
-0	string	\012(			
+0	string	\012(
 # look for emacs lisp keywords
 # GRR: split regex because it is too long or get error like
 # lisp, 36: Warning: cannot get string from `^(defun|defvar|defconst|defmacro|setq|fset|put|provide|require|'
@@ -50,13 +50,13 @@
 # Emacs 19+ - ver. recognition added by Ian Springer
 # Also applies to XEmacs 19+ .elc files; could tell them apart with regexs
 # - Chris Chittleborough <[email protected]>
-# Update: Joerg Jenderek 
-0	string	;ELC	
+# Update: Joerg Jenderek
+0	string	;ELC
 # version\0\0\0
 >4	byte	>18			Emacs/XEmacs v%d byte-compiled Lisp data
 # why less than 32 ? does not make sense to me. GNU Emacs version is 24.5 at April 2015
 #>4	byte    <32			Emacs/XEmacs v%d byte-compiled Lisp data
-!:mime	application/x-elc		
+!:mime	application/x-elc
 !:apple	EMAxTEXT
 !:ext elc

@@ -67,7 +67,7 @@
 0	long	0x70768BD2		CLISP memory image data
 0	long	0xD28B7670		CLISP memory image data, other endian

-#.com and .bin for MIT scheme 
+#.com and .bin for MIT scheme
 0	string	\372\372\372\372	MIT scheme (library?)

 # From: David Allouche <[email protected]>
@@ -1,6 +1,9 @@
 #------------------------------------------------------------------------------
-# $File: m4,v 1.1 2011/12/08 12:12:46 rrt Exp $
+# $File: m4,v 1.2 2017/08/14 07:40:38 christos Exp $
 # make:  file(1) magic for M4 scripts
 #
 0	regex	\^dnl\ 		M4 macro processor script text
 !:mime	text/x-m4
+0	regex	\^AC_DEFUN\\(\\[	M4 macro processor script text
+!:strength + 15
+!:mime	text/x-m4
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: macintosh,v 1.26 2015/11/25 00:36:02 christos Exp $
+# $File: macintosh,v 1.27 2017/03/17 21:35:28 christos Exp $
 # macintosh description
 #
 # BinHex is the Macintosh ASCII-encoded file format (see also "apple")
@@ -109,9 +109,9 @@
 # the assumption that 65-72 will all be ASCII (0x20-0x7F), that 73 will
 # have bits 1 (changed), 2 (busy), 3 (bozo), and 6 (invisible) unset,
 # and that 74 will be 0.  So something like
-# 
+#
 # 71 	belong&0x80804EFF 0x00000000 	Macintosh MacBinary data
-# 
+#
 # >73	byte&0x01	0x01		\b, inited
 # >73	byte&0x02	0x02		\b, changed
 # >73	byte&0x04	0x04		\b, busy
@@ -254,7 +254,7 @@
 >0x9C   string          INDEX           data file index
 >0x9C   string          VIEW            data view

-# spss magic for SPSS system and portable files, 
+# spss magic for SPSS system and portable files,
 #	 from Bruce Foster ([email protected]).

 0	long		0xc1e2c3c9	SPSS Portable File
@@ -273,7 +273,7 @@
 # entries depend on the data arithmetic added after v.35
 # There's also some Pascal strings in here, ditto...

-# The boot block signature, according to IM:Files, is 
+# The boot block signature, according to IM:Files, is
 # "for HFS volumes, this field always contains the value 0x4C4B."
 # But if this is true for MFS or HFS+ volumes, I don't know.
 # Alternatively, the boot block is supposed to be zeroed if it's
@@ -291,10 +291,10 @@
 # *.hfs updated by Joerg Jenderek
 # http://en.wikipedia.org/wiki/Hierarchical_File_System
 # "BD" gives many false positives
-0x400	beshort			0x4244		
+0x400	beshort			0x4244
 # ftp://ftp.mars.org/pub/hfs/hfsutils-3.2.6.tar.gz/hfsutils-3.2.6/libhfs/apple.h
 # first block of volume bit map (always 3)
->0x40e	ubeshort		0x0003		
+>0x40e	ubeshort		0x0003
 # maximal length of volume name is 27
 >>0x424		ubyte			<28	Macintosh HFS data
 !:mime	application/x-apple-diskimage
@@ -351,15 +351,15 @@
 #>0x230		string		x		first type: %s,
 #>0x210		string		x		name: %s,
 #>0x254		belong		x		number of blocks: %d,
-#>0x400		beshort		0x504D		
+#>0x400		beshort		0x504D
 #>>0x430		string		x		second type: %s,
 #>>0x410		string		x		name: %s,
 #>>0x454		belong		x		number of blocks: %d,
-#>>0x800		beshort		0x504D		
+#>>0x800		beshort		0x504D
 #>>>0x830	string		x		third type: %s,
 #>>>0x810	string		x		name: %s,
 #>>>0x854	belong		x		number of blocks: %d,
-#>>>0xa00	beshort		0x504D		
+#>>>0xa00	beshort		0x504D
 #>>>>0xa30	string		x		fourth type: %s,
 #>>>>0xa10	string		x		name: %s,
 #>>>>0xa54	belong		x		number of blocks: %d
@@ -1,7 +1,8 @@
 #------------------------------------------------------------------------------
-# $File: make,v 1.2 2015/08/25 07:34:06 christos Exp $
+# $File: make,v 1.3 2016/12/10 14:21:29 christos Exp $
 # make:  file(1) magic for makefiles
 #
+# URL: https://en.wikipedia.org/wiki/Make_(software)
 0	regex/100l	\^CFLAGS	makefile script text
 !:mime	text/x-makefile
 0	regex/100l	\^VPATH		makefile script text
@@ -10,12 +11,19 @@
 !:mime	text/x-makefile
 0	regex/100l	\^all:		makefile script text
 !:mime	text/x-makefile
-0	regex/100l	\^\.PRECIOUS	makefile script text
+0	regex/100l	\^\\.PRECIOUS	makefile script text
 !:mime	text/x-makefile
-0	regex/100l	\^\.BEGIN	BSD makefile script text
+# Update: Joerg Jenderek
+# Reference: https://www.freebsd.org/cgi/man.cgi?make(1)
+# exclude grub-core\lib\libgcrypt\mpi\Makefile.am with "#BEGIN_ASM_LIST"
+# by additional escaping point character
+0	regex/100l	\^\\.BEGIN	BSD makefile script text with "%s"
 !:mime	text/x-makefile
-0	regex/100l	\^\.include	BSD makefile script text
+!:ext	/mk
+# exclude MS Windows help file CoNtenT with ":include FOOBAR.CNT"
+# and NSIS script with "!include" by additional escaping point character
+0	regex/100l	\^\\.include	BSD makefile script text with "%s"
 !:mime	text/x-makefile
-
+!:ext	/mk
 0	regex/100l	\^SUBDIRS	automake makefile script text
 !:mime	text/x-makefile
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: maple,v 1.7 2013/01/11 16:45:23 christos Exp $
+# $File: maple,v 1.8 2017/03/17 21:35:28 christos Exp $
 # maple:  file(1) magic for maple files
 # "H. Nanosecond" <[email protected]>
 # Maple V release 4, a multi-purpose math program
@@ -13,7 +13,7 @@
 # no magic for these :-(
 # they are compiled indexes for maple files

-# .hdb 
+# .hdb
 0	string	\000\004\000\000	Maple help database

 # .mhp
@@ -40,7 +40,7 @@
 # from byte 4 it is either 'nul E' or 'soh R'
 # I think 'nul E' means a file that was saved as  a different name
 # a sort of revision marking
-# 'soh R' means new 
+# 'soh R' means new
 >4	string	\000\105	An old revision
 >4	string	\001\122	The latest save

@@ -2,27 +2,29 @@
 # marc21: file(1) magic for MARC 21 Format
 #
 # Kevin Ford ([email protected])
-# 
+#
 # MARC21 formats are for the representation and communication
 # of bibliographic and related information in machine-readable
 # form.  For more info, see http://www.loc.gov/marc/


 # leader position 20-21 must be 45
-20	string	45	
+# and 22-23 also 00 so far, but we check that later.
+20	string		45
+>0	search/2048	\x1e

 # leader starts with 5 digits, followed by codes specific to MARC format
->0	regex/1l	(^[0-9]{5})[acdnp][^bhlnqsu-z]	MARC21 Bibliographic
+>>0	regex/1l	(^[0-9]{5})[acdnp][^bhlnqsu-z]	MARC21 Bibliographic
 !:mime	application/marc
->0	regex/1l	(^[0-9]{5})[acdnosx][z]	MARC21 Authority
+>>0	regex/1l	(^[0-9]{5})[acdnosx][z]	MARC21 Authority
 !:mime	application/marc
->0	regex/1l	(^[0-9]{5})[cdn][uvxy]	MARC21 Holdings
+>>0	regex/1l	(^[0-9]{5})[cdn][uvxy]	MARC21 Holdings
 !:mime	application/marc
-0	regex/1l	(^[0-9]{5})[acdn][w]	MARC21 Classification
+>>0	regex/1l	(^[0-9]{5})[acdn][w]	MARC21 Classification
 !:mime	application/marc
->0	regex/1l	(^[0-9]{5})[cdn][q]	MARC21 Community
+>>0	regex/1l	(^[0-9]{5})[cdn][q]	MARC21 Community
 !:mime	application/marc

 # leader position 22-23, should be "00" but is it?
->0	regex/1l	(^.{21})([^0]{2})	(non-conforming)
+>>0	regex/1l	(^.{21})([^0]{2})	(non-conforming)
 !:mime	application/marc
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: mathematica,v 1.8 2015/04/09 20:01:40 christos Exp $
+# $File: mathematica,v 1.9 2017/03/17 21:35:28 christos Exp $
 # mathematica:  file(1) magic for mathematica files
 # "H. Nanosecond" <[email protected]>
 # Mathematica a multi-purpose math program
@@ -49,7 +49,7 @@

 #0	string	(*This\ is\ a\ Mathematica\ binary\ dump\ file.\ It\ can\ be\ loaded\ with\ Get.*)	Mathematica binary file
 0	string	(*This\ is\ a\ Mathematica\ binary\ 	Mathematica binary file
-#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000	
+#>71	string \000\010\010\010\010\000\000\000\000\000\000\010\100\010\000\000\000
 # >71... is optional
 >88	string	>\0	from %s

@@ -59,7 +59,7 @@
 0	string	MMAPBF\000\001\000\000\000\203\000\001\000	Mathematica PBF (fonts I think)

 # .ml files  These are menu resources I think
-# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\ 
+# these start with "[0-9][0-9][0-9]\ A~[0-9][0-9][0-9]\
 # how to put that into a magic rule?
 4	string	\ A~	MAthematica .ml file

@@ -1,8 +1,8 @@

 #------------------------------------------------------------------------------
-# $File: metastore,v 1.1 2011/04/06 12:37:44 christos Exp $
+# $File: metastore,v 1.2 2017/03/17 21:35:28 christos Exp $
 # metastore:  file(1) magic for metastore files
 # From: Thomas Wissen
 # see http://david.hardeman.nu/software.php#metastore
-0	string		MeTaSt00r3	Metastore data file, 
+0	string		MeTaSt00r3	Metastore data file,
 >10	bequad		x		version %0llx
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: meteorological,v 1.1 2014/08/04 06:26:16 christos Exp $
+# $File: meteorological,v 1.2 2017/03/17 21:35:28 christos Exp $
 # rinex:  file(1) magic for RINEX files
 # http://igscb.jpl.nasa.gov/igscb/data/format/rinex210.txt
 # ftp://cddis.gsfc.nasa.gov/pub/reports/formats/rinex300.pdf
@@ -34,7 +34,7 @@
 >>&32	string		x		\b, date %15.15s
 >>5	string		x		\b, version %6.6s
 !:mime	rinex/meteorological
->80	search/256	XXRINEXN	RINEX Data, Navigation	
+>80	search/256	XXRINEXN	RINEX Data, Navigation
 >>&32	string		x		\b, date %15.15s
 >>5	string		x		\b, version %6.6s
 !:mime	rinex/navigation
@@ -1,7 +1,7 @@

 #------------------------------------------------------------------------------
-# $File: microfocus,v 1.1 2016/02/09 01:22:49 christos Exp $
-# Micro Focus COBOL data files. 
+# $File: microfocus,v 1.2 2017/03/17 21:35:28 christos Exp $
+# Micro Focus COBOL data files.

 # http://documentation.microfocus.com/help/index.jsp?topic=\
 # %2FGUID-0E0191D8-C39A-44D1-BA4C-D67107BAF784%2FHRFLRHFILE05.html
@@ -1,9 +1,9 @@

 #------------------------------------------------------------------------------
-# $File: mime,v 1.6 2010/11/25 15:00:12 christos Exp $
+# $File: mime,v 1.8 2017/03/17 22:20:22 christos Exp $
 # mime:  file(1) magic for MIME encoded files
 #
-0	string/t		Content-Type:\ 
+0	string/t		Content-Type:\040
 >14	string		>\0		%s
 0	string/t		Content-Type:
 >13	string		>\0		%s
@@ -1,6 +1,6 @@

 #-----------------------------------------------------------------------------
-# $File: misctools,v 1.16 2016/02/14 15:46:52 christos Exp $
+# $File: misctools,v 1.17 2017/03/17 21:35:28 christos Exp $
 # misctools:  file(1) magic for miscellaneous UNIX tools.
 #
 0	search/1	%%!!			X-Post-It-Note text
@@ -14,7 +14,7 @@
 #!:mime	text/x-vcard
 !:mime	text/vcard
 # VERSION must come right after BEGIN for 3.0 or 4.0 except in 2.1 , where it can be anywhere
->12	search/14000/c	VERSION:		
+>12	search/14000/c	VERSION:
 # VERSION 2.1 , 3.0 or 4.0
 >>&0	string		x			\b, version %-.3s

@@ -48,7 +48,7 @@
 >12	ulelong			!0x20				\b, 0x%8.8x RVA
 # CheckSum 0
 >16	ulelong			!0				\b, CheckSum 0x%8.8x
-# Reserved or TimeDateStamp 
+# Reserved or TimeDateStamp
 >20	ledate			x				\b, %s
 # https://msdn.microsoft.com/en-us/library/windows/desktop/ms680519%28v=vs.85%29.aspx
 # Flags MINIDUMP_TYPE enumeration type 0 0x121 0x800
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: modem,v 1.7 2016/01/08 00:56:42 christos Exp $
+# $File: modem,v 1.8 2017/03/17 21:35:28 christos Exp $
 # modem:  file(1) magic for modem programs
 #
 # From: Florian La Roche <[email protected]>
@@ -13,24 +13,24 @@
 # URL: https://de.wikipedia.org/wiki/Fax
 # Reference: http://web.archive.org/web/20020628195336/http://www.netnam.vn/unescocourse/computervision/104.htm
 # GRR: EOL of G3 is too general as it catches also TrueType fonts, Postscript PrinterFontMetric, others
-0	short		0x0100		
+0	short		0x0100
 # 16 0-bits near beginning like True Type fonts *.ttf, Postscript PrinterFontMetric *.pfm, FTYPE.HYPERCARD, XFER
->2	search/9	\0\0		
+>2	search/9	\0\0
 # maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
->2	default		x		
+>2	default		x
 # skip IRCAM file (VAX big-endian)	./audio
->>0	belong		!0x0001a364	
+>>0	belong		!0x0001a364
 # skip GEM Image data			./images
->>>2	beshort		!0x0008		
+>>>2	beshort		!0x0008
 # look for first keyword of Panorama database *.pan
->>>>11	search/262	\x06DESIGN	
+>>>>11	search/262	\x06DESIGN
 # skip Panorama database
->>>>11	default		x		
+>>>>11	default		x
 # old Apple DreamWorld DreamGrafix *.3200 with keyword at end of g3 looking files
->>>>>27118	search/1864	DreamWorld	
->>>>>27118	default		x		
+>>>>>27118	search/1864	DreamWorld
+>>>>>27118	default		x
 # skip MouseTrap/Mt.Defaults with file size 16 found on Golden Orchard Apple II CD Rom
->>>>>>8		ubequad		!0x2e01010454010203	
+>>>>>>8		ubequad		!0x2e01010454010203
 # skip PICTUREH.SML found on Golden Orchard Apple II CD Rom
 >>>>>>>8	ubequad		!0x5dee74ad1aa56394	raw G3 (Group 3) FAX, byte-padded
 # version 5.25 labeled the entry above "raw G3 data, byte-padded"
@@ -39,9 +39,9 @@
 !:ext	g3
 # unusual image starting with black pixel
 #0	short		0x1300		raw G3 (Group 3) FAX
-0	short		0x1400		
+0	short		0x1400
 # 16 0-bits near beginning like PicturePuzzler found on Golden Orchard Apple CD Rom
->2	search/9	\0\0		
+>2	search/9	\0\0
 # maximal 7 0-bits for pixel sequences or 11 0-bits for EOL in G3
 >2	default		x		raw G3 (Group 3) FAX
 # version 5.25 labeled the above entry as "raw G3 data"
@@ -1,7 +1,7 @@

 #------------------------------------------------------------------------------
-# $File: mozilla,v 1.6 2015/01/25 16:20:46 christos Exp $
-# mozilla:  file(1) magic for Mozilla XUL fastload files 
+# $File: mozilla,v 1.7 2017/03/17 21:35:28 christos Exp $
+# mozilla:  file(1) magic for Mozilla XUL fastload files
 # (XUL.mfasl and XPC.mfasl)
 # URL:	http://www.mozilla.org/
 # From:	Josh Triplett <[email protected]>
@@ -1,12 +1,12 @@

 #------------------------------------------------------------------------------
-# $File: msdos,v 1.111 2016/09/14 01:26:26 christos Exp $
+# $File: msdos,v 1.120 2017/08/13 00:21:47 christos Exp $
 # msdos:  file(1) magic for MS-DOS files
 #

 # .BAT files (Daniel Quinlan, [email protected])
 # updated by Joerg Jenderek at Oct 2008,Apr 2011
-0	string/t	@			
+0	string/t	@
 >1	string/cW	\ echo\ off	DOS batch file text
 !:mime	text/x-msdos-batch
 >1	string/cW	echo\ off	DOS batch file text
@@ -230,7 +230,7 @@
 >>(8.s*16)	string		go32stub for MS-DOS, DJGPP go32 DOS extender
 >>(8.s*16)	string		emx
 >>>&1		string		x for DOS, Win or OS/2, emx %s
->>&(&0x42.l-3)	byte		x 
+>>&(&0x42.l-3)	byte		x
 >>>&0x26	string		UPX \b, UPX compressed
 # and yet another guess: small .text, and after large .data is unusal, could be 32lite
 >>&0x2c		search/0xa0	.text
@@ -240,8 +240,8 @@
 >(8.s*16) string $WdX \b, WDos/X DOS extender

 # By now an executable type should have been printed out.  The executable
-# may be a self-uncompressing archive, so look for evidence of that and 
-# print it out.  
+# may be a self-uncompressing archive, so look for evidence of that and
+# print it out.
 #
 # Some signatures below from Greg Roelofs, [email protected].
 #
@@ -283,8 +283,8 @@
 # Skip to the end of the EXE.  This will usually work fine in the PE case
 # because the MZ image is hardcoded into the toolchain and almost certainly
 # won't match any of these signatures.
->(4.s*512)	long	x 
->>&(2.s-517)	byte	x 
+>(4.s*512)	long	x
+>>&(2.s-517)	byte	x
 >>>&0	string		PK\3\4 \b, ZIP self-extracting archive
 >>>&0	string		Rar! \b, RAR self-extracting archive
 >>>&0	string		=!\x11 \b, AIN 2.x self-extracting archive
@@ -312,71 +312,77 @@
 # only version=0x100 found
 >3	uleshort	x		\b, version 0x%x
 # length of string containing author,info and special characters
->6	ubyte		>0		
+>6	ubyte		>0
 #>>6	pstring		x		\b, name=%s
 >>7	string		>\0		\b, author=%-.14s
 >>7	search/254	\xff		\b, info=
 #>>>&0	string		x		\b%-s
 >>>&0	string		x		\b%-.15s
-# for FreeDOS *.KL files 
+# for FreeDOS *.KL files
 0	string/b	KLF		FreeDOS KEYBoard Layout file
 # only version=0x100 or 0x101 found
 >3	uleshort	x		\b, version 0x%x
 # stringlength
->5	ubyte		>0		
+>5	ubyte		>0
 >>8	string		x		\b, name=%-.2s
-0	string	\xffKEYB\ \ \ \0\0\0\0	
+0	string	\xffKEYB\ \ \ \0\0\0\0
 >12	string	\0\0\0\0`\004\360	MS-DOS KEYBoard Layout file

-# DOS device driver updated by Joerg Jenderek at May 2011
-# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
-0	ulequad&0x07a0ffffffff		0xffffffff		DOS executable (
->40	search/7			UPX!			\bUPX compressed 
+# DOS device driver updated by Joerg Jenderek at May 2011,Mar 2017
+# https://amaus.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
+0	ulequad&0x07a0ffffffff		0xffffffff
+>0	use				msdos-driver
+0       name    			msdos-driver		DOS executable (
+#!:mime	application/octet-stream
+!:mime	application/x-dosdriver
+# also found FreeDOS print driver SPOOL.DEV and disc compression driver STACLOAD.BIN
+!:ext	sys/dev/bin
+>40	search/7			UPX!			\bUPX compressed
 # DOS device driver attributes
 >4	uleshort&0x8000			0x0000			\bblock device driver
 # character device
 >4	uleshort&0x8000			0x8000			\b
->>4	uleshort&0x0008			0x0008			\bclock 
+>>4	uleshort&0x0008			0x0008			\bclock
 # fast video output by int 29h
->>4	uleshort&0x0010			0x0010			\bfast 
+>>4	uleshort&0x0010			0x0010			\bfast
 # standard input/output device
->>4	uleshort&0x0003			>0			\bstandard 
+>>4	uleshort&0x0003			>0			\bstandard
 >>>4	uleshort&0x0001			0x0001			\binput
 >>>4	uleshort&0x0003			0x0003			\b/
->>>4	uleshort&0x0002			0x0002			\boutput 
+>>>4	uleshort&0x0002			0x0002			\boutput
 >>4	uleshort&0x8000			0x8000			\bcharacter device driver
->0	ubyte				x			
+>0	ubyte				x
 # upx compressed device driver has garbage instead of real in name field of header
->>40	search/7			UPX!			
->>40	default				x			
+>>40	search/7			UPX!
+>>40	default				x
 # leading/trailing nulls, zeros or non ASCII characters in 8-byte name field at offset 10 are skipped
->>>12		ubyte			>0x27			\b 
->>>>10		ubyte			>0x20			
->>>>>10		ubyte			!0x2E			
+>>>12		ubyte			>0x2E			\b
+>>>>10		ubyte			>0x20
+>>>>>10		ubyte			!0x2E
 >>>>>>10	ubyte			!0x2A			\b%c
->>>>11		ubyte			>0x20			
+>>>>11		ubyte			>0x20
 >>>>>11		ubyte			!0x2E			\b%c
->>>>12		ubyte			>0x20			
->>>>>12		ubyte			!0x39			
+>>>>12		ubyte			>0x20
+>>>>>12		ubyte			!0x39
 >>>>>>12	ubyte			!0x2E			\b%c
->>>13		ubyte			>0x20			
+>>>13		ubyte			>0x20
 >>>>13		ubyte			!0x2E			\b%c
->>>>14		ubyte			>0x20			
+>>>>14		ubyte			>0x20
 >>>>>14		ubyte			!0x2E			\b%c
->>>>15		ubyte			>0x20			
+>>>>15		ubyte			>0x20
 >>>>>15		ubyte			!0x2E			\b%c
->>>>16		ubyte			>0x20			
->>>>>16		ubyte			!0x2E			
+>>>>16		ubyte			>0x20
+>>>>>16		ubyte			!0x2E
 >>>>>>16	ubyte			<0xCB			\b%c
->>>>17		ubyte			>0x20			
->>>>>17		ubyte			!0x2E			
+>>>>17		ubyte			>0x20
+>>>>>17		ubyte			!0x2E
 >>>>>>17	ubyte			<0x90			\b%c
 # some character device drivers like ASPICD.SYS, btcdrom.sys and Cr_atapi.sys contain only spaces or points in name field
->>>4		uleshort&0x8000		0x8000			
->>>>12		ubyte			<0x2F			
+>>>12		ubyte			<0x2F
 # they have their real name at offset 22
->>>>>22		string			>\0			\b%-.5s
->4	uleshort&0x8000			0x0000			
+# also block device drivers like DUMBDRV.SYS
+>>>>22		string			>\056			%-.6s
+>4	uleshort&0x8000			0x0000
 # 32 bit sector addressing ( > 32 MB) for block devices
 >>4	uleshort&0x0002			0x0002			\b,32-bit sector-
 # support by driver functions 13h, 17h, 18h
@@ -384,33 +390,42 @@
 # open, close, removable media support by driver functions 0Dh, 0Eh, 0Fh
 >4	uleshort&0x0800			0x0800			\b,close media-
 # output until busy support by int 10h for character device driver
->4	uleshort&0x8000			0x8000			
+>4	uleshort&0x8000			0x8000
 >>4	uleshort&0x2000			0x2000			\b,until busy-
 # direct read/write support by driver functions 03h,0Ch
 >4	uleshort&0x4000			0x4000			\b,control strings-
->4	uleshort&0x8000			0x8000			
+>4	uleshort&0x8000			0x8000
 >>4	uleshort&0x6840			>0			\bsupport
->4	uleshort&0x8000			0x0000			
+>4	uleshort&0x8000			0x0000
 >>4	uleshort&0x4842			>0			\bsupport
 >0	ubyte				x			\b)
-# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header 
-# Too weak, matches files that only contain 0's
-#0	ulequad&0x000007a0ffffffed	0x0000000000000000	DOS-executable (
-#>4	uleshort&0x8000			0x8000			\bcharacter device driver
-#>>10	string				x			%-.8s
-#>4	uleshort&0x4000			0x4000			\b,control strings-support)
+# DOS driver cmd640x.sys has 0x12 instead of 0xffffffff for pointer field to next device header
+0	ulequad				0x0513c00000000012
+>0	use				msdos-driver
+# DOS drivers DC2975.SYS, DUMBDRV.SYS, ECHO.SYS has also none 0xffffffff for pointer field
+0	ulequad				0x32f28000ffff0016
+>0	use				msdos-driver
+0	ulequad				0x007f00000000ffff
+>0	use				msdos-driver
+0	ulequad				0x001600000000ffff
+>0	use				msdos-driver
+# DOS drivers LS120.SYS, MKELS120.SYS use reserved bits of attribute field
+0	ulequad				0x0bf708c2ffffffff
+>0	use				msdos-driver
+0	ulequad				0x07bd08c2ffffffff
+>0	use				msdos-driver

 # updated by Joerg Jenderek
-# GRR: line below too general as it catches also 
+# GRR: line below too general as it catches also
 # rt.lib DYADISKS.PIC and many more
 # start with assembler instruction MOV
-0	ubyte		0x8c		
+0	ubyte		0x8c
 # skip "AppleWorks word processor data" like ARTICLE.1 ./apple
->4	string			!O====	
+>4	string			!O====
 # skip some unknown basic binaries like RocketRnger.SHR
->>5	string			!MAIN	
+>>5	string			!MAIN
 # skip "GPG symmetrically encrypted data" ./gnu
-# skip "PGP symmetric key encrypted data" ./pgp 
+# skip "PGP symmetric key encrypted data" ./pgp
 # openpgpdefs.h: fourth byte < 14 indicate cipher algorithm type
 >>>4	ubyte			>13	DOS executable (COM, 0x8C-variant)
 # the remaining files should be DOS *.COM executables
@@ -428,7 +443,7 @@
 # updated by Joerg Jenderek at Oct 2008
 0	ulelong		0xffff10eb	DR-DOS executable (COM)
 # byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
-0	ubeshort&0xeb8d	>0xeb00		
+0	ubeshort&0xeb8d	>0xeb00
 # DR-DOS STACKER.COM SCREATE.SYS missed

 0       name    msdos-com
@@ -463,9 +478,9 @@

 # updated by Joerg Jenderek at Oct 2008,2015
 # following line is too general
-0	ubyte		0xb8		
+0	ubyte		0xb8
 # skip 2 linux kernels like memtest.bin with "\xb8\xc0\x07\x8e" in ./linux
->0	string		!\xb8\xc0\x07\x8e	
+>0	string		!\xb8\xc0\x07\x8e
 # modified by Joerg Jenderek
 # syslinux COM32 or COM32R executable
 >>1	lelong&0xFFFFFFFe 0x21CD4CFe	COM executable (32-bit COMBOOT
@@ -496,8 +511,8 @@
 #!:mime	application/x-msdos-program
 !:ext com

-0	string/b	\x81\xfc		
->4	string	\x77\x02\xcd\x20\xb9	
+0	string/b	\x81\xfc
+>4	string	\x77\x02\xcd\x20\xb9
 >>36	string	UPX!			FREE-DOS executable (COM), UPX compressed
 252	string Must\ have\ DOS\ version DR-DOS executable (COM)
 # added by Joerg Jenderek at Oct 2008
@@ -514,10 +529,10 @@
 #IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
 5	string	\xcd\x21		COM executable for DOS
 #DELTMP.COm HASFAT32.cOM
-7	string	\xcd\x21		
+7	string	\xcd\x21
 >0	byte	!0xb8			COM executable for DOS
 #COMP.cOM MORE.COm
-10	string	\xcd\x21		
+10	string	\xcd\x21
 >5	string	!\xcd\x21		COM executable for DOS
 #comecho.com
 13	string	\xcd\x21		COM executable for DOS
@@ -565,10 +580,23 @@
 0	string/b	PO^Q`				Microsoft Word 6.0 Document
 !:mime	application/msword
 #
-0	string/b	\376\067\0\043			Microsoft Office Document
+4   long        0
+>0  belong      0xfe320000      Microsoft Word for Macintosh 1.0
 !:mime	application/msword
-0	string/b	\333\245-\0\0\0			Microsoft Office Document
+!:ext   mcw
+>0  belong      0xfe340000      Microsoft Word for Macintosh 3.0
 !:mime	application/msword
+!:ext   mcw
+>0  belong      0xfe37001c      Microsoft Word for Macintosh 4.0
+!:mime	application/msword
+!:ext   mcw
+>0  belong      0xfe370023      Microsoft Word for Macintosh 5.0
+!:mime	application/msword
+!:ext   mcw
+
+0	string/b	\333\245-\0\0\0			Microsoft Word 2.0 Document
+!:mime	application/msword
+!:ext   doc
 512	string/b	\354\245\301			Microsoft Word Document
 !:mime	application/msword

@@ -599,11 +627,11 @@
 # Reference: http://www.aboutvb.de/bas/formate/pdf/wk3.pdf
 # Note: newer Lotus versions >2 use longer BOF record
 # record type (BeginningOfFile=0000h) + length (001Ah)
-0	belong	0x00001a00	
+0	belong	0x00001a00
 # reserved should be 0h but 8c0dh for TUTMAC.WK3, 5h for SAMPADNS.WK3, 1h for a_readme.wk3, 1eh for K&G86.WK3
-#>18	uleshort&0x73E0	0	
+#>18	uleshort&0x73E0	0
 # Lotus Multi Byte Character Set (LMBCS=1-31)
->20	ubyte		>0	
+>20	ubyte		>0
 >>20	ubyte		<32	Lotus 1-2-3
 #!:mime	application/x-123
 !:mime	application/vnd.lotus-1-2-3
@@ -640,10 +668,10 @@
 !:ext	fXX
 # main revision number
 >>>>4	uleshort	x	\b, revision 0x%x
->>>6	uleshort	=0x0004	\b, cell range 
+>>>6	uleshort	=0x0004	\b, cell range
 # active cellcoord range (start row, page,column ; end row, page, column)
 # start values normally 0~1st sheet A1
->>>>8	ulelong		!0	
+>>>>8	ulelong		!0
 >>>>>10	ubyte		>0	\b%d*
 >>>>>8	uleshort	x	\b%d,
 >>>>>11	ubyte		x	\b%d-
@@ -656,9 +684,9 @@
 >>>>20	ubyte		>1	\b, character set 0x%x
 # flags
 >>>>21	ubyte		x	\b, flags 0x%x
->>>6	uleshort	!0x0004	
+>>>6	uleshort	!0x0004
 # record type (FONTNAME=00AEh)
->>>>30	search/29	\0\xAE	
+>>>>30	search/29	\0\xAE
 # variable length m (2) + entries (1) + ?? (1) + LCMBS string (n)
 >>>>>&4	string		>\0	\b, 1st font "%s"
 #
@@ -667,12 +695,12 @@
 # Reference: http://www.schnarff.com/file-formats/lotus-1-2-3/WSFF2.TXT
 # Note: Used by both old Lotus 1-2-3 and Lotus Symphony (DOS) til version 2.x
 # record type (BeginningOfFile=0000h) + length (0002h)
-0	belong	0x00000200	
+0	belong	0x00000200
 # GRR: line above is too general as it catches also MS Windows CURsor
 # to display MS Windows cursor (strength=70) before Lotus 1-2-3 (strength=70-1)
 !:strength -1
 # skip Windows cursors with image height <256 and keep Lotus with low opcode 0001-0083h
->7	ubyte		0	
+>7	ubyte		0
 # skip Windows cursors with image width 256 and keep Lotus with positiv opcode
 >>6	ubyte		>0	Lotus
 # !:mime	application/x-123
@@ -737,9 +765,9 @@
 #	check and then display Lotus worksheet cells range
 0	name		lotus-cells
 # look for type (RANGE=0006h) + length (0008h) at record begin
->0	ubelong	0x06000800	\b, cell range 
+>0	ubelong	0x06000800	\b, cell range
 # cell range (start column, row, end column, row) start values normally 0,0~A1 cell
->>4	ulong		!0	
+>>4	ulong		!0
 >>>4	uleshort	x	\b%d,
 >>>6	uleshort	x	\b%d-
 # end of cell range
@@ -792,19 +820,19 @@
 # Windows icons
 # Update: Joerg Jenderek
 # URL: https://en.wikipedia.org/wiki/CUR_(file_format)
-# Note: similiar to Windows CURsor. container for BMP (only DIB part) or PNG
+# Note: similar to Windows CURsor. container for BMP (only DIB part) or PNG
 0   belong  0x00000100
 >9  byte    0
->>0 byte    x           
+>>0 byte    x
 >>0 use     cur-ico-dir
 >9  ubyte   0xff
->>0 byte    x           
+>>0 byte    x
 >>0 use     cur-ico-dir
 #	displays number of icons and information for icon or cursor
 0	name		cur-ico-dir
 # skip some Lotus 1-2-3 worksheets, CYCLE.PIC and keep Windows cursors with
 # 1st data offset = dir header size + n * dir entry size = 6 + n * 10h = ?6h
->18		ulelong		&0x00000006	
+>18		ulelong		&0x00000006
 # skip remaining worksheets, because valid only for DIB image (40) or PNG image (\x89PNG)
 >>(18.l)	ulelong		x		MS Windows
 >>>0		ubelong		0x00000100	icon resource
@@ -817,7 +845,7 @@
 # 1st icon
 >>>>0x06	use		ico-entry
 # 2nd icon
->>>>4 		uleshort	>1		
+>>>>4 		uleshort	>1
 >>>>>0x16	use		ico-entry
 >>>0		ubelong		0x00000200	cursor resource
 #!:mime		image/x-cur
@@ -854,16 +882,16 @@
 # offset of PNG or DIB image
 #>12		ulelong		x		\b, offset 0x%x
 # PNG header (\x89PNG)
->(12.l)		ubelong		=0x89504e47	
->>&-4		indirect	x	\b with 
+>(12.l)		ubelong		=0x89504e47
+>>&-4		indirect	x	\b with
 # DIB image
->(12.l)		ubelong		!0x89504e47	
+>(12.l)		ubelong		!0x89504e47
 #>>&-4		use     	dib-image

 # Windows non-animated cursors
 # Update: Joerg Jenderek
 # URL: https://en.wikipedia.org/wiki/CUR_(file_format)
-# Note: similiar to Windows ICOn. container for BMP ( only DIB part)
+# Note: similar to Windows ICOn. container for BMP ( only DIB part)
 # GRR: line below is too general as it catches also Lotus 1-2-3 files
 0   belong  0x00000200
 >9  byte    0
@@ -872,13 +900,13 @@
 >>0 use     cur-ico-dir

 # .chr files
-0	string/b	PK\010\010BGI	Borland font 
+0	string/b	PK\010\010BGI	Borland font
 >4	string	>\0	%s
 # then there is a copyright notice


 # .bgi files
-0	string/b	pk\010\010BGI	Borland device 
+0	string/b	pk\010\010BGI	Borland device
 >4	string	>\0	%s
 # then there is a copyright notice

@@ -909,7 +937,7 @@
 0	lelong		0x08086b70	TurboC BGI file
 0	lelong		0x08084b50	TurboC Font file

-# Debian#712046: The magic below identifies "Delphi compiled form data". 
+# Debian#712046: The magic below identifies "Delphi compiled form data".
 # An additional source of information is available at:
 # http://www.woodmann.com/fravia/dafix_t1.htm
 0	string		TPF0
@@ -918,7 +946,7 @@
 # tests for DBase files moved, updated and merged to database

 0	string		PMCC		Windows 3.x .GRP file
-1	string		RDC-meg		MegaDots 
+1	string		RDC-meg		MegaDots
 >8	byte		>0x2F		version %c
 >9	byte		>0x2F		\b.%c file
 0	lelong		0x4C
@@ -935,16 +963,16 @@
 #>0x181	leshort	x	\b, offset %x
 #>0x183	leshort	x	\b, offsetdata %x
 #>0x185	leshort	x	\b, section length %x
->0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0	
->>&0x5e		ubyte	>0			
+>0x187	search/0xB55	WINDOWS\ VMM\ 4.0\0
+>>&0x5e		ubyte	>0
 >>>&-1		string	<PIFMGR.DLL		\b, icon=%s
 #>>>&-1		string	PIFMGR.DLL		\b, icon=%s
 >>>&-1		string	>PIFMGR.DLL		\b, icon=%s
->>&0xF0		ubyte	>0			
+>>&0xF0		ubyte	>0
 >>>&-1		string	<Terminal		\b, font=%.32s
 #>>>&-1		string	=Terminal		\b, font=%.32s
 >>>&-1		string	>Terminal		\b, font=%.32s
->>&0x110	ubyte	>0			
+>>&0x110	ubyte	>0
 >>>&-1		string	<Lucida\ Console	\b, TrueTypeFont=%.32s
 #>>>&-1		string	=Lucida\ Console	\b, TrueTypeFont=%.32s
 >>>&-1		string	>Lucida\ Console	\b, TrueTypeFont=%.32s
@@ -960,6 +988,7 @@
 # DOS EPS Binary File Header
 # From: Ed Sznyter <[email protected]>
 0	belong		0xC5D0D3C6	DOS EPS Binary File
+!:mime	image/x-eps
 >4	long		>0		Postscript starts at byte %d
 >>8	long		>0		length %d
 >>>12	long		>0		Metafile starts at byte %d
@@ -967,15 +996,15 @@
 >>>20	long		>0		TIFF starts at byte %d
 >>>>24	long		>0		length %d

-# TNEF magic From "Joomy" <[email protected]> 
+# TNEF magic From "Joomy" <[email protected]>
 # Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
-0	leshort		0x223e9f78	TNEF
+0	lelong		0x223e9f78	TNEF
 !:mime	application/vnd.ms-tnef

 # Norton Guide (.NG , .HLP) files added by Joerg Jenderek from source NG2HTML.C
 # of http://www.davep.org/norton-guides/ng2h-105.tgz
 # http://en.wikipedia.org/wiki/Norton_Guides
-0	string		NG\0\001	
+0	string		NG\0\001
 # only value 0x100 found at offset 2
 >2	ulelong		0x00000100	Norton Guide
 # Title[40]
@@ -985,7 +1014,7 @@
 >>48	string		>\0		\b, %-.66s
 >>114	string		>\0		%-.66s

-# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS 
+# 4DOS help (.HLP) files added by Joerg Jenderek from source TPHELP.PAS
 # of http://www.4dos.info/
 # pointer,HelpID[8]=4DHnnnmm
 0	ulelong	0x48443408		4DOS help file
@@ -1033,7 +1062,7 @@


 # Windows Enhanced Metafile (EMF)
-# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp 
+# See msdn.microsoft.com/archive/en-us/dnargdi/html/msdn_enhmeta.asp
 # for further information.
 0	ulelong 1
 >40	string	\ EMF		Windows Enhanced Metafile (EMF) image data
@@ -1095,7 +1124,7 @@
 0	string/b	MSWIM\000\000\000	Windows imaging (WIM) image
 0	string/b	WLPWM\000\000\000	Windows imaging (WIM) image, wimlib pipable format

-# The second byte of these signatures is a file version; I don't know what, 
+# The second byte of these signatures is a file version; I don't know what,
 # if anything, produced files with version numbers 0-2.
 # From: John Elliott <[email protected]>
 0	string	\xfc\x03\x00	Mallard BASIC program data (v1.11)
@@ -1106,3 +1135,66 @@
 0	string	MIOPEN		Mallard BASIC Jetsam data
 0	string	Jetsam0		Mallard BASIC Jetsam index data

+# DOS backup 2.0 to 3.2
+
+# backupid.@@@
+
+# plausibility check for date
+0x3	ushort	>1979
+>0x5	ubyte-1 <31
+>>0x6	ubyte-1 <12
+# actually 121 nul bytes
+>>>0x7	string	\0\0\0\0\0\0\0\0
+>>>>0x1 ubyte	x	DOS 2.0 backup id file, sequence %d
+!:ext @@@
+>>>>0x0 ubyte	0xff	\b, last disk
+
+# backed up file
+
+# skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
+# by looking for trailing nul of maximal file name string
+0x52	ubyte	0	
+# test for flag byte: FFh~complete file, 00h~split file
+# FFh -127 =	-1 -127 =	-128
+# 00h -127 =	 0 -127 =	-127
+>0	byte-127	<-126
+# plausibility check for file name length
+>>0x53	ubyte-1	<78	
+# looking for terminating nul of file name string
+>>>(0x53.b+4)	ubyte	0	
+# looking if last char of string is valid DOS file name
+>>>>(0x53.b+3)	ubyte	>0x1F	
+# actually 44 nul bytes
+# but sometimes garbage according to Ralf Quint. So can not be used as test
+#>0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
+# first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
+# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 
+>>>>>5	ubyte&0x8C	0x0C	
+# ./msdos (version 5.30) labeled the entry as
+# "DOS 2.0 backed up file %s, split file, sequence %d" or
+# "DOS 2.0 backed up file %s, complete file"
+>>>>>>0	ubyte	x	DOS 2.0-3.2 backed up
+#>>>>>>0	ubyte	0xff	complete
+>>>>>>0	ubyte	0
+>>>>>>>1 uleshort	x	sequence %d of
+# full file name with path but without drive letter and colon stored from 0x05 til 0x52
+>>>>>>0x5	string	x	file %s
+# backup name is original filename
+#!:ext	*
+# magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *' has bad char '*'
+# file: line 1169: Bad magic entry '  *'
+# after header original file content
+>>>>>>128	indirect x	\b; 
+
+
+# DOS backup 3.3 to 5.x
+
+# CONTROL.nnn files
+0	string	\x8bBACKUP\x20
+# actually 128 nul bytes
+>0xa	string	\0\0\0\0\0\0\0\0
+>>0x9	ubyte	x	DOS 3.3 backup control file, sequence %d
+>>0x8a	ubyte	0xff	\b, last disk
+
+# NB: The BACKUP.nnn files consist of the files backed up,
+# concatenated.
@@ -1,10 +1,10 @@

 #------------------------------------------------------------------------------
-# $File: msvc,v 1.6 2016/01/26 00:03:19 christos Exp $
+# $File: msvc,v 1.9 2017/08/02 08:15:20 christos Exp $
 # msvc:  file(1) magic for msvc
 # "H. Nanosecond" <[email protected]>
 # Microsoft visual C
-# 
+#
 # I have version 1.0

 # .aps
@@ -30,10 +30,10 @@
 # Summary: Symbol Table / Debug info used by Microsoft compilers
 # URL: https://en.wikipedia.org/wiki/Program_database
 # Reference: https://code.google.com/p/pdbparser/wiki/MSF_Format
-# Update: Joerg Jenderek 
+# Update: Joerg Jenderek
 # Note:	test only for Windows XP+SP3 x86 , 8.1 x64 arm and 10.1 x86
 #	info does only applies partly for older files like msvbvm50.pdb about year 2001
-0	string	Microsoft\ C/C++\ 	
+0	string	Microsoft\ C/C++\040
 # "Microsoft Program DataBase" by TrID
 >24	search/14	\r\n\x1A	MSVC program database
 !:mime	application/x-ms-pdb
@@ -42,18 +42,21 @@
 >>16	regex	\([0-9.]+\)	ver %s
 #>>>0x38	search/128123456	/LinkInfo	\b with linkinfo
 # "MSF 7.00" variant
->>0x1e	leshort	0	
+>>0x1e	leshort	0
 # PageSize 400h 1000h
 >>>0x20	lelong	x	\b, %d
 # Page Count
 >>>0x28	lelong	x	\b*%d bytes
 # "program database 2.00"  variant
->>0x1e	leshort	!0	
+>>0x1e	leshort	!0
 # PageSize 400h
 >>>0x2c	lelong	x	\b, %d
 # Page Count for msoo-dll.pdb 4379h
 >>>0x32	leshort	x	\b*%d bytes

+# Reference: https://github.com/Microsoft/vstest/pull/856/commits/fdc7a9f074ca5a8dfeec83b1be9162bf0cf4000d
+0       string/c bsjb\001\000\001\000\000\000\000\000\f\000\000\000pdb\ v1.0     Microsoft Rosyln C# debugging symbols version 1.0
+
 #.sbr
 0	string	\000\002\000\007\000	MSVC .sbr
 >5	string 	>\0	%s
@@ -7,7 +7,7 @@
 ############## MSX Music file formats ##############

 # Gigamix MGSDRV music file
-0	string/b		MGS	MSX Gigamix MGSDRV3 music file, 
+0	string/b		MGS	MSX Gigamix MGSDRV3 music file,
 >6	ubeshort	0x0D0A
 >>3	byte		x	\bv%c
 >>4	byte		x	\b.%c
@@ -35,7 +35,7 @@
 >>0xF	byte&0x02	0	\b, soundchips: AY-3-8910, SCC(+)
 >>0xF	byte&0x02	0x02	\b, soundchips: SN76489
 >>>0xF	byte&0x04	0x04	stereo
->>0xF	byte&0x01	0x01	\b, 
+>>0xF	byte&0x01	0x01	\b,
 >>>0xF	byte&0x18	0x00	\bYM2413
 >>>0xF	byte&0x18	0x08	\bYM2413, Y8950
 >>>0xF	byte&0x18	0x18	\bYM2413+Y8950 pseudostereo
@@ -245,18 +245,18 @@
 0x4000	string/b		AB
 >0x4002	uleshort	>0x400F
 >>0x400A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
->>0x4002	uleshort	x			\b, init=0x%04x
->>0x4004	uleshort	>0			\b, stahdl=0x%04x
->>0x4006	uleshort	>0			\b, devhdl=0x%04x
->>0x4008	uleshort	>0			\b, bas=0x%04x
+>>>0x4002	uleshort	x			\b, init=0x%04x
+>>>0x4004	uleshort	>0			\b, stahdl=0x%04x
+>>>0x4006	uleshort	>0			\b, devhdl=0x%04x
+>>>0x4008	uleshort	>0			\b, bas=0x%04x

 0x8000	string/b		AB
 >0x8002	uleshort	>0x400F
 >>0x800A	string		\0\0\0\0\0\0	MSX ROM with nonstandard page order
->>0x8002	uleshort	x			\b, init=0x%04x
->>0x8004	uleshort	>0			\b, stahdl=0x%04x
->>0x8006	uleshort	>0			\b, devhdl=0x%04x
->>0x8008	uleshort	>0			\b, bas=0x%04x
+>>>0x8002	uleshort	x			\b, init=0x%04x
+>>>0x8004	uleshort	>0			\b, stahdl=0x%04x
+>>>0x8006	uleshort	>0			\b, devhdl=0x%04x
+>>>0x8008	uleshort	>0			\b, bas=0x%04x


 0x3C000	string/b		AB
@@ -296,7 +296,7 @@
 4	uleshort	0x0900
 >0xF	byte		1
 >>0x14	byte		0
->>>0x1E	string		\ \ \ 
+>>>0x1E	string		\040\040\040
 >>>>0x23	byte	1
 >>>>>0x25	byte	0
 >>>>>>0x15	string	>\x30
@@ -1,6 +1,6 @@

 # ------------------------------------------------------------------------
-# $File: mup,v 1.4 2009/09/19 16:28:11 christos Exp $
+# $File: mup,v 1.5 2017/03/17 21:35:28 christos Exp $
 # mup: file(1) magic for Mup (Music Publisher) input file.
 #
 # From: Abel Cheung <abel (@) oaka.org>
@@ -12,13 +12,13 @@
 #
 0		search/1	//!Mup		Mup music publication program input text
 >6		string		-Arkkra		(Arkkra)
->>13		string		-		
->>>16		string		.		
+>>13		string		-
+>>>16		string		.
 >>>>14		string		x		\b, need V%.4s
->>>15		string		.		
+>>>15		string		.
 >>>>14		string		x		\b, need V%.3s
->6		string		-		
->>9		string		.		
+>6		string		-
+>>9		string		.
 >>>7		string		x		\b, need V%.4s
->>8		string		.		
+>>8		string		.
 >>>7		string		x		\b, need V%.3s
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# nasa:	file(1) magic 
+# nasa:	file(1) magic

 # From: Barry Carter <[email protected]>
 0	string	DAF/SPK				NASA SPICE file (binary format)
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: netbsd,v 1.23 2015/11/29 01:55:14 christos Exp $
+# $File: netbsd,v 1.24 2017/03/17 21:35:28 christos Exp $
 # netbsd:  file(1) magic for NetBSD objects
 #
 # All new-style magic numbers are in network byte order.
@@ -10,7 +10,7 @@
 #

 0	belong&0377777777	041400413	a.out NetBSD/i386 demand paged
->0	byte			&0x80		
+>0	byte			&0x80
 >>20	lelong			<4096		shared library
 >>20	lelong			=4096		dynamically linked executable
 >>20	lelong			>4096		dynamically linked executable
@@ -32,7 +32,7 @@
 >32	lelong			!0		(signal %d)

 0	belong&0377777777	041600413	a.out NetBSD/m68k demand paged
->0	byte			&0x80		
+>0	byte			&0x80
 >>20	belong			<8192		shared library
 >>20	belong			=8192		dynamically linked executable
 >>20	belong			>8192		dynamically linked executable
@@ -54,7 +54,7 @@
 >32	belong			!0		(signal %d)

 0	belong&0377777777	042000413	a.out NetBSD/m68k4k demand paged
->0	byte			&0x80		
+>0	byte			&0x80
 >>20	belong			<4096		shared library
 >>20	belong			=4096		dynamically linked executable
 >>20	belong			>4096		dynamically linked executable
@@ -76,7 +76,7 @@
 >32	belong			!0		(signal %d)

 0	belong&0377777777	042200413	a.out NetBSD/ns32532 demand paged
->0	byte			&0x80		
+>0	byte			&0x80
 >>20	lelong			<4096		shared library
 >>20	lelong			=4096		dynamically linked executable
 >>20	lelong			>4096		dynamically linked executable
@@ -101,7 +101,7 @@
 >12	string			>\0		from '%s'

 0	belong&0377777777	042400413	a.out NetBSD/SPARC demand paged
->0	byte			&0x80		
+>0	byte			&0x80
 >>20	belong			<8192		shared library
 >>20	belong			=8192		dynamically linked executable
 >>20	belong			>8192		dynamically linked executable
@@ -123,7 +123,7 @@
 >32	belong			!0		(signal %d)

 0	belong&0377777777	042600413	a.out NetBSD/pmax demand paged
->0	byte			&0x80		
+>0	byte			&0x80
 >>20	lelong			<4096		shared library
 >>20	lelong			=4096		dynamically linked executable
 >>20	lelong			>4096		dynamically linked executable
@@ -145,7 +145,7 @@
 >32	lelong			!0		(signal %d)

 0	belong&0377777777	043000413	a.out NetBSD/vax 1k demand paged
->0	byte			&0x80		
+>0	byte			&0x80
 >>20	lelong			<4096		shared library
 >>20	lelong			=4096		dynamically linked executable
 >>20	lelong			>4096		dynamically linked executable
@@ -167,7 +167,7 @@
 >32	lelong			!0		(signal %d)

 0	belong&0377777777	045400413	a.out NetBSD/vax 4k demand paged
->0	byte			&0x80		
+>0	byte			&0x80
 >>20	lelong			<4096		shared library
 >>20	lelong			=4096		dynamically linked executable
 >>20	lelong			>4096		dynamically linked executable
@@ -189,7 +189,7 @@
 >32	lelong			!0		(signal %d)

 # NetBSD/alpha does not support (and has never supported) a.out objects,
-# so no rules are provided for them.  NetBSD/alpha ELF objects are 
+# so no rules are provided for them.  NetBSD/alpha ELF objects are
 # dealt with in "elf".
 0	lelong		0x00070185		ECOFF NetBSD/alpha binary
 >10	leshort		0x0001			not stripped
@@ -199,7 +199,7 @@
 >32	lelong			!0		(signal %d)

 0	belong&0377777777	043400413	a.out NetBSD/mips demand paged
->0	byte			&0x80		
+>0	byte			&0x80
 >>20	belong			<8192		shared library
 >>20	belong			=8192		dynamically linked executable
 >>20	belong			>8192		dynamically linked executable
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: netscape,v 1.7 2015/08/24 05:20:52 christos Exp $
+# $File: netscape,v 1.8 2017/03/17 21:35:28 christos Exp $
 # netscape:  file(1) magic for Netscape files
 # "H. Nanosecond" <[email protected]>
 # version 3 and 4 I think
@@ -15,8 +15,8 @@
 # .snm Caches
 0	string		#\ Netscape\ folder\ cache	Netscape folder cache
 0	string	\000\036\204\220\000	Netscape folder cache
-# .n2p 
-# Net 2 Phone 
+# .n2p
+# Net 2 Phone
 #0	string	123\130\071\066\061\071\071\071\060\070\061\060\061\063\060
 0	string	SX961999	Net2phone

@@ -1,9 +1,9 @@

 #------------------------------------------------------------------------------
-# $File: nitpicker,v 1.6 2014/04/30 21:41:02 christos Exp $
+# $File: nitpicker,v 1.7 2017/03/17 21:35:28 christos Exp $
 # nitpicker:  file(1) magic for Flowfiles.
 # From: Christian Jachmann <[email protected]> http://www.nitpicker.de
-0	string	NPFF	NItpicker Flow File 
+0	string	NPFF	NItpicker Flow File
 >4	byte	x	V%d.
 >5	byte	x	%d
 >6	bedate	x	started: %s
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: os2,v 1.9 2016/05/11 15:51:57 christos Exp $
+# $File: os2,v 1.10 2017/03/17 21:35:28 christos Exp $
 # os2:  file(1) magic for OS/2 files
 #

@@ -25,7 +25,7 @@
 #>5	string	>\			(Local file) <%s>

 # >>>>> OS/2 INF/HLP <<<<<  (source: Daniel Dissett [email protected])
-# Carl Hauser ([email protected]) and 
+# Carl Hauser ([email protected]) and
 # Marcus Groeber ([email protected])
 # list the following header format in inf02a.doc:
 #
@@ -35,11 +35,11 @@
 #                      //  bit 0: set if INF style file
 #                      //  bit 4: set if HLP style file
 #                      // patching this byte allows reading HLP files
-#                      // using the VIEW command, while help files 
+#                      // using the VIEW command, while help files
 #                      // seem to work with INF settings here as well.
 #  int16 hdrsize;      // total size of header
 #  int16 unknown2;     // unknown purpose
-# 
+#
 0   string  HSP\x01\x9b\x00 OS/2 INF
 >107 string >0                      (%s)
 0   string  HSP\x10\x9b\x00     OS/2 HLP
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: os9,v 1.7 2011/05/13 22:15:54 christos Exp $
+# $File: os9,v 1.8 2017/03/17 21:35:28 christos Exp $
 #
 # Copyright (c) 1996 Ignatios Souvatzis. All rights reserved.
 #
@@ -15,7 +15,7 @@
 #
 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 # IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  
+# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 # IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 # PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
@@ -1,11 +1,11 @@

 #------------------------------------------------------------------------------
-# $File: pbf,v 1.1 2013/12/21 14:27:24 christos Exp $
+# $File: pbf,v 1.2 2017/01/18 16:16:21 christos Exp $
 # file(1) magic(5) data for OpenStreetMap

 # OpenStreetMap Protocolbuffer Binary Format (.osm.pbf)
 # http://wiki.openstreetmap.org/wiki/PBF_Format
 # From: Markus Heidelberg <[email protected]>
-0	belong		0x0000000D
->4	beshort		0x0A09
->>6	string		OSMHeader	OpenStreetMap Protocolbuffer Binary Format
+0	belong&0xfffffff0	0
+>4	beshort			0x0A09
+>>6	string			OSMHeader	OpenStreetMap Protocolbuffer Binary Format
@@ -9,7 +9,7 @@
 >>0x280		string		\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
 >>>0x1A		ubyte&0xEF	0
 >>>>0x1B	ubyte&0x8F	0
->>>>>0x1B	ubyte&70	<0x40	
+>>>>>0x1B	ubyte&70	<0x40
 >>>>>>0x1C	ulelong	>0x21
 >>>>>>>0		regex	[[:print:]]*	NEC PC-88 disk image, name=%s
 >>>>>>>>0x1B	ubyte	0	\b, media=2D
@@ -8,7 +8,7 @@
 # http://www.jisyo.com/viewer/faq/maki_tech.htm
 0	string/b		MAKI01 	Maki-chan v1.
 >6	ubyte|0x20	x		\b%c image
->8	ubelong		>0x40404040	\b, system ID: 
+>8	ubelong		>0x40404040	\b, system ID:
 >>8	byte		x		%c
 >>9	byte		x		\b%c
 >>10	byte		x		\b%c
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: pdf,v 1.8 2015/01/11 18:19:18 christos Exp $
+# $File: pdf,v 1.9 2017/05/24 17:35:20 christos Exp $
 # pdf:  file(1) magic for Portable Document Format
 #

@@ -20,3 +20,8 @@
 !:mime application/vnd.fdf
 >5      byte            x               \b, version %c
 >7      byte            x               \b.%c
+
+0	search/256	%PDF-		PDF document
+!:mime	application/pdf
+>&0	byte		x		\b, version %c
+>&2	byte		x		\b.%c
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: pdp,v 1.10 2014/04/30 21:41:02 christos Exp $
+# $File: pdp,v 1.11 2017/03/17 21:35:28 christos Exp $
 # pdp:  file(1) magic for PDP-11 executable/object and APL workspace
 #
 0	lelong		0101555		PDP-11 single precision APL workspace
@@ -14,8 +14,8 @@

 # updated by Joerg Jenderek at Mar 2013
 # GRR: line below too general as it catches also Windows precompiled setup information *.PNF
-0	leshort		0401		
-# skip *.PNF with WinDirPathOffset 58h 
+0	leshort		0401
+# skip *.PNF with WinDirPathOffset 58h
 >68	ulelong		!0x00000058	PDP-11 UNIX/RT ldp
 # skip *.PNF with high byte of InfVersionDatumCount zero
 #>>15	byte		!0		PDP-11 UNIX/RT ldp
@@ -1,5 +1,5 @@
 #------------------------------------------------------------------------------
-# $File: perl,v 1.25 2016/06/07 23:28:37 rrt Exp $
+# $File: perl,v 1.26 2017/02/21 18:34:55 christos Exp $
 # perl:  file(1) magic for Larry Wall's perl language.
 #
 # The `eval' lines recognizes an outrageously clever hack.
@@ -33,14 +33,14 @@

 # by Dmitry V. Levin and Alexey Tourbin
 # check the first line
-0	search/1024	package
+0	search/8192	package
 >0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;	Perl5 module source text
-!:strength + 10
+!:strength + 40
 # not 'p', check other lines
-0	search/1024	!p
+0	search/8192	!p
 >0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;
 >>0	regex		\^1\ *;|\^(use|sub|my)\ .*[(;{=]	Perl5 module source text
-!:strength + 10
+!:strength + 75

 # Perl POD documents
 # From: Tom Hukins <[email protected]>
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: pgf,v 1.1 2013/04/22 15:19:49 christos Exp $
+# $File: pgf,v 1.2 2017/03/17 21:35:28 christos Exp $
 # pgf: file(1) magic for Progressive Graphics File (PGF)
 #
 # <http://www.libpgf.org/uploads/media/PGF_Details_01.pdf>
@@ -42,7 +42,7 @@
 >>20	byte	19	RGB color 12,
 >>20	byte	20	RGB color 16,
 >>20	byte	255	unknown format,
->>20	default	x	format 
+>>20	default	x	format
 >>>20	byte	x	\b %d,
 >>21	byte	x	%d bpc
 #	PGFPostHeader
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: pgp,v 1.12 2016/10/07 20:22:12 christos Exp $
+# $File: pgp,v 1.14 2017/03/17 21:35:28 christos Exp $
 # pgp:  file(1) magic for Pretty Good Privacy
 # see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
 #
@@ -19,15 +19,15 @@
 #>15	string	SIGNED\040MESSAGE-	signed message
 #>15	string	PGP\040SIGNATURE-	signature

-2	string	---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK-	PGP public key block
+2	string	---BEGIN\040PGP\040PUBLIC\040KEY\040BLOCK-	PGP public key block
 !:mime	application/pgp-keys
 >10	search/100	\n\n
 >>&0	use		pgp
-0	string	-----BEGIN\040PGP\40MESSAGE-		PGP message
+0	string	-----BEGIN\040PGP\040MESSAGE-		PGP message
 !:mime	application/pgp
 >10	search/100	\n\n
 >>&0	use		pgp
-0	string	-----BEGIN\040PGP\40SIGNATURE-		PGP signature
+0	string	-----BEGIN\040PGP\040SIGNATURE-		PGP signature
 !:mime	application/pgp-signature
 >10	search/100	\n\n
 >>&0	use		pgp
@@ -77,7 +77,7 @@
 >0	byte		0x30
 >>1	byte&0xc0	0x00		Unused [0%x]
 >>1	byte&0xc0	0x40		User Attribute
->>1	byte&0xc0	0x80		Sym. Encrypted and Integrity Protected Data 
+>>1	byte&0xc0	0x80		Sym. Encrypted and Integrity Protected Data
 >>1	byte&0xc0	0xc0		Modification Detection Code

 # magic signatures to detect PGP crypto material (from stef)
@@ -206,7 +206,7 @@
 >0	byte	19			ECDSA
 >0	byte	20			ElGamal (Encrypt or Sign)
 >0	byte	21			Diffie-Hellman
->0	default	x			
+>0	default	x
 >>0	ubyte	<22			unknown (pub %d)
 # this should never happen
 >>0	ubyte	>21			invalid (%d)
@@ -482,16 +482,16 @@
 >1	use	pgpkey
 0	byte	0x97			PGP	Secret Sub-key -
 >1	use	pgpkey
-0	byte	0x9d			
+0	byte	0x9d
 # Update: Joerg Jenderek
 # secret subkey packet (tag 7) with same structure as secret key packet (tag 5)
 # skip Fetus.Sys16 CALIBUS.MAIN OrbFix.Sys16.Ex by looking for positive len
->1	ubeshort	>0		
+>1	ubeshort	>0
 #>1	ubeshort	x		\b, body length 0x%x
 # next packet type often 88h,89h~(tag 2)~Signature Packet
 #>>(1.S+3)	ubyte	x		\b, next packet type 0x%x
 # skip Dragon.SHR DEMO.INIT by looking for positive version
->>3	ubyte		>0	
+>>3	ubyte		>0
 # skip BUISSON.13 GUITAR1 by looking for low version number
 >>>3	ubyte		<5		PGP Secret Sub-key
 # sub-key are normally part of secret key. So it does not occur as standalone file
@@ -500,7 +500,7 @@
 >>>>3	ubyte		x		(v%d)
 >>>>3	ubyte		x		-
 # old versions 2 or 3 but no real example found
->>>>3	ubyte		<4		
+>>>>3	ubyte		<4
 # 2 byte for key bits in version 5.28 look
 >>>>>11		ubeshort	x	%db
 >>>>>4		beldate		x	created on %s -
@@ -508,15 +508,15 @@
 #>>>>>8		ubeshort	x	0x%x
 # display key algorithm 1~RSA Encrypt|Sign - 21~Diffie-Hellman
 >>>>>10	  	use		key_algo
->>>>>(11.S/8)	ubequad		x	
+>>>>>(11.S/8)	ubequad		x
 # look after first key
 >>>>>>&5	use		keyend
 # new version
->>>>3	ubyte		>3		
+>>>>3	ubyte		>3
 >>>>>9		ubeshort	x	%db
 >>>>>4		beldate		x	created on %s -
 # display key algorithm
 >>>>>8		use		key_algo
->>>>>(9.S/8)	ubequad		x	
+>>>>>(9.S/8)	ubequad		x
 # look after first key for something like s2k
 >>>>>>&3	use		keyend
@@ -1,6 +1,6 @@

 #------------------------------------------------------------------------------
-# $File: printer,v 1.26 2014/04/12 14:51:52 christos Exp $
+# $File: printer,v 1.28 2017/03/17 22:20:22 christos Exp $
 # printer:  file(1) magic for printer-formatted files
 #

@@ -13,7 +13,7 @@
 >>>15	string		EPS		\b, type %s
 >>>15	string		Query		\b, type %s
 >>>15	string		ExitServer	\b, type %s
->>>15   search/1000		%%LanguageLevel:\ 
+>>>15   search/1000		%%LanguageLevel:\040
 >>>>&0	string		>\0		\b, Level %s
 # Some PCs have the annoying habit of adding a ^D as a document separator
 0	string		\004%!		PostScript document text
@@ -24,7 +24,7 @@
 >>>16	string		EPS		\b, type %s
 >>>16	string		Query		\b, type %s
 >>>16	string		ExitServer	\b, type %s
->>>16   search/1000		%%LanguageLevel:\ 
+>>>16   search/1000		%%LanguageLevel:\040
 >>>>&0	string		>\0		\b, Level %s
 0	string		\033%-12345X%!PS	PostScript document

@@ -49,18 +49,18 @@
 # HP Printer Job Language
 0	string		\033%-12345X@PJL	HP Printer Job Language data
 # HP Printer Job Language
-# The header found on Win95 HP plot files is the "Silliest Thing possible" 
+# The header found on Win95 HP plot files is the "Silliest Thing possible"
 # (TM)
 # Every driver puts the language at some random position, with random case
 # (LANGUAGE and Language)
 # For example the LaserJet 5L driver puts the "PJL ENTER LANGUAGE" in line 10
 # From: Uwe Bonnes <[email protected]>
-# 
+#
 0	string		\033%-12345X@PJL	HP Printer Job Language data
->&0	string		>\0			%s			
->>&0	string		>\0			%s			
->>>&0	string		>\0			%s		
->>>>&0	string		>\0			%s		
+>&0	string		>\0			%s
+>>&0	string		>\0			%s
+>>>&0	string		>\0			%s
+>>>>&0	string		>\0			%s
 #>15	string		\ ENTER\ LANGUAGE\ =
 #>31	string		PostScript		PostScript

@@ -143,8 +143,8 @@

 #------------------------------------------------------------------------------
 # HP LaserJet 1000 series downloadable firmware file
-0	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware   
+0	string	\xbe\xefABCDEFGH	HP LaserJet 1000 series downloadable firmware

 # From: Paolo <[email protected]>
-# Epson ESC/Page, ESC/PageColor 
+# Epson ESC/Page, ESC/PageColor
 0	string	\x1b\x01@EJL	Epson ESC/Page language printer data