1
2#------------------------------------------------------------------------------
3# $File: crypto,v 1.4 2023/07/17 16:41:48 christos Exp $
4# crypto:  file(1) magic for crypto formats
5#
6# Bitcoin block files
70                   lelong                        0xD9B4BEF9          Bitcoin
8>(4.l+40) lelong                        0xD9B4BEF9          reverse block
9>>4                 lelong                        x                   \b, size %u
10# normal block below
11>0                  default                       x                   block
12>>4                 lelong                        x                   \b, size %u
13>>8                 lelong&0xE0000000   0x20000000
14>>>8                lelong                        x                   \b, BIP9 0x%x
15>>8                 lelong&0xE0000000   !0x20000000
16>>>8                lelong                        x                   \b, version 0x%x
17>>76                ledate                        x                   \b, %s UTC
18# VarInt counter
19>>88                ubyte                         <0xfd               \b, txcount %u
20>>88                ubyte                         0xfd
21>>>89               leshort                       x                   \b, txcount %u
22>>88                ubyte                         0xfe
23>>>89               lelong                        x                   \b, txcount %u
24>>88                ubyte                         0xff
25>>>89               lequad                        x                   \b, txcount %llu
26!:ext     dat
27# option to find more blocks in the file
28#>>(4.l+8)          indirect  x                             ;
29
30# LevelDB
31-8                  lequad              0xdb4775248b80fb57  LevelDB table data
32
33# http://www.tarsnap.com/scrypt.html
34# see scryptenc_setup() in lib/scryptenc/scryptenc.c
350         string              scrypt\0  scrypt encrypted file
36>7        byte                x                   \b, N=2**%d
37>8        belong              x                   \b, r=%d
38>12       belong              x                   \b, p=%d
39
40# https://age-encryption.org/
41# Only the first recipient is printed in detail to prevent repetitive output
42# in extreme cases ("ssh-rsa, ssh-rsa, ssh-rsa, ...").
430         string              age-encryption.org/v1\n age encrypted file
44>25       regex/128 \^[^\040]+          \b, %s recipient
45>>25      string              scrypt
46>>>&0 regex/64                [0-9]+\$  (N=2**%s)
47>>&0      search/256          \n->\040  \b, among others
48
490         string              -----BEGIN\040AGE\040ENCRYPTED\040FILE-----       age encrypted file, ASCII armored
50