1 2#------------------------------------------------------------------------------ 3# $File: freebsd,v 1.9 2022/01/19 12:44:13 christos Exp $ 4# freebsd: file(1) magic for FreeBSD objects 5# 6# All new-style FreeBSD magic numbers are in host byte order (i.e., 7# little-endian on x86). 8# 9# XXX - this comes from the file "freebsd" in a recent FreeBSD version of 10# "file"; it, and the NetBSD stuff in "netbsd", appear to use different 11# schemes for distinguishing between executable images, shared libraries, 12# and object files. 13# 14# FreeBSD says: 15# 16# Regardless of whether it's pure, demand-paged, or none of the 17# above: 18# 19# if the entry point is < 4096, then it's a shared library if 20# the "has run-time loader information" bit is set, and is 21# position-independent if the "is position-independent" bit 22# is set; 23# 24# if the entry point is >= 4096 (or >4095, same thing), then it's 25# an executable, and is dynamically-linked if the "has run-time 26# loader information" bit is set. 27# 28# On x86, NetBSD says: 29# 30# If it's neither pure nor demand-paged: 31# 32# if it has the "has run-time loader information" bit set, it's 33# a dynamically-linked executable; 34# 35# if it doesn't have that bit set, then: 36# 37# if it has the "is position-independent" bit set, it's 38# position-independent; 39# 40# if the entry point is non-zero, it's an executable, otherwise 41# it's an object file. 42# 43# If it's pure: 44# 45# if it has the "has run-time loader information" bit set, it's 46# a dynamically-linked executable, otherwise it's just an 47# executable. 48# 49# If it's demand-paged: 50# 51# if it has the "has run-time loader information" bit set, 52# then: 53# 54# if the entry point is < 4096, it's a shared library; 55# 56# if the entry point is = 4096 or > 4096 (i.e., >= 4096), 57# it's a dynamically-linked executable); 58# 59# if it doesn't have the "has run-time loader information" bit 60# set, then it's just an executable. 61# 62# (On non-x86, NetBSD does much the same thing, except that it uses 63# 8192 on 68K - except for "68k4k", which is presumably "68K with 4K 64# pages - SPARC, and MIPS, presumably because Sun-3's and Sun-4's 65# had 8K pages; dunno about MIPS.) 66# 67# I suspect the two will differ only in perverse and uninteresting cases 68# ("shared" libraries that aren't demand-paged and whose pages probably 69# won't actually be shared, executables with entry points <4096). 70# 71# I leave it to those more familiar with FreeBSD and NetBSD to figure out 72# what the right answer is (although using ">4095", FreeBSD-style, is 73# probably better than separately checking for "=4096" and ">4096", 74# NetBSD-style). (The old "netbsd" file analyzed FreeBSD demand paged 75# executables using the NetBSD technique.) 76# 770 lelong&0377777777 041400407 FreeBSD/i386 78>20 lelong <4096 79>>3 byte&0xC0 &0x80 shared library 80>>3 byte&0xC0 0x40 PIC object 81>>3 byte&0xC0 0x00 object 82>20 lelong >4095 83>>3 byte&0x80 0x80 dynamically linked executable 84>>3 byte&0x80 0x00 executable 85>16 lelong >0 not stripped 86 870 lelong&0377777777 041400410 FreeBSD/i386 pure 88>20 lelong <4096 89>>3 byte&0xC0 &0x80 shared library 90>>3 byte&0xC0 0x40 PIC object 91>>3 byte&0xC0 0x00 object 92>20 lelong >4095 93>>3 byte&0x80 0x80 dynamically linked executable 94>>3 byte&0x80 0x00 executable 95>16 lelong >0 not stripped 96 970 lelong&0377777777 041400413 FreeBSD/i386 demand paged 98>20 lelong <4096 99>>3 byte&0xC0 &0x80 shared library 100>>3 byte&0xC0 0x40 PIC object 101>>3 byte&0xC0 0x00 object 102>20 lelong >4095 103>>3 byte&0x80 0x80 dynamically linked executable 104>>3 byte&0x80 0x00 executable 105>16 lelong >0 not stripped 106 1070 lelong&0377777777 041400314 FreeBSD/i386 compact demand paged 108>20 lelong <4096 109>>3 byte&0xC0 &0x80 shared library 110>>3 byte&0xC0 0x40 PIC object 111>>3 byte&0xC0 0x00 object 112>20 lelong >4095 113>>3 byte&0x80 0x80 dynamically linked executable 114>>3 byte&0x80 0x00 executable 115>16 lelong >0 not stripped 116 117# XXX gross hack to identify core files 118# cores start with a struct tss; we take advantage of the following: 119# byte 7: highest byte of the kernel stack pointer, always 0xfe 120# 8/9: kernel (ring 0) ss value, always 0x0010 121# 10 - 27: ring 1 and 2 ss/esp, unused, thus always 0 122# 28: low order byte of the current PTD entry, always 0 since the 123# PTD is page-aligned 124# 1257 string \357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 FreeBSD/i386 a.out core file 126>1039 string >\0 from '%s' 127 128# /var/run/ld.so.hints 129# What are you laughing about? 1300 lelong 011421044151 ld.so hints file (Little Endian 131>4 lelong >0 \b, version %d) 132>4 belong <1 \b) 1330 belong 011421044151 ld.so hints file (Big Endian 134>4 belong >0 \b, version %d) 135>4 belong <1 \b) 136 137# 138# Files generated by FreeBSD scrshot(1)/vidcontrol(1) utilities 139# 1400 string SCRSHOT_ scrshot(1) screenshot, 141>8 byte x version %d, 142>9 byte 2 %d bytes in header, 143>>10 byte x %d chars wide by 144>>11 byte x %d chars high 145 146# 147# FreeBSD kernel minidumps 148# 1490 string minidump\040FreeBSD/ FreeBSD kernel minidump 150# powerpc uses 32-byte magic, followed by 32-byte mmu kind, then version 151>17 string powerpc 152>>17 string >\0 for %s, 153>>>32 string >\0 %s, 154>>>>64 byte 0 big endian, 155>>>>>64 belong x version %d 156>>>>64 default x little endian, 157>>>>>64 lelong x version %d 158# all other architectures use 24-byte magic, followed by version 159>17 default x 160>>17 string >\0 for %s, 161>>>24 byte 0 big endian, 162>>>>24 belong x version %d 163>>>24 default x little endian, 164>>>>24 lelong x version %d 165