magic/Magdir/cafebabe - master - githubmirror/file

magic/Magdir/cafebabe
105 строк4 KB
Christos Zoulas
merge more duplicate magic (Alexandre IOOSS)
30 авг 2024, 19:53
30 авг 2024, 19:533d5ebef

#------------------------------------------------------------------------------
# $File: cafebabe,v 1.31 2024/08/30 16:53:22 christos Exp $
# Cafe Babes unite!
#
# Since Java bytecode and Mach-O universal binaries have the same magic number,
# the test must be performed in the same "magic" sequence to get both right.
# The long at offset 4 in a Mach-O universal binary tells the number of
# architectures; the short at offset 4 in a Java bytecode file is the JVM minor
# version and the short at offset 6 is the JVM major version.  Since there are only
# only 18 labeled Mach-O architectures at current, and the first released
# Java class format was version 43.0, we can safely choose any number
# between 18 and 39 to test the number of architectures against
# (and use as a hack). Let's not use 18, because the Mach-O people
# might add another one or two as time goes by...
#

### MACH-O START ###
# URL:		https://en.wikipedia.org/wiki/Mach-O

0	name		mach-o		\b [
# for debugging purpose CPU type as hexadecimal
#>0	ubequad		x		CPU=%16.16llx
# display CPU type as string like: i386 x86_64 ... armv7 armv7k ...
>0	use		mach-o-cpu	\b
# for debugging purpose print offset to 1st mach_header like:
# 1000h 4000h seldom 2d000h 88000h 5b000h 10e000 h
#>8	ubelong		x		at %#x offset
>(8.L)	indirect	x		\b:
>0	belong		x		\b]

# Reference:	https://opensource.apple.com/source/cctools/cctools-949.0.1/
#		include/mach-o/fat.h
#		include/mach/machine.h
0	belong		0xcafebabe
>4	belong		1		Mach-O universal binary with 1 architecture:
!:mime application/x-mach-binary
>>8	use		mach-o		\b
# nfat_arch; number of CPU architectures; highest is 18 for CPU_TYPE_POWERPC in 2020
>4	ubelong		>1
>>4	ubelong		<20		Mach-O universal binary with %d architectures:
!:mime application/x-mach-binary
>>>8	use		mach-o		\b
>>>4	ubelong		>1
>>>>28	use		mach-o		\b
>>>4	ubelong		>2
>>>>48	use		mach-o		\b
>>>4	ubelong		>3
>>>>68	use		mach-o		\b
>>>4	ubelong		>4
>>>>88	use		mach-o		\b
>>>4	ubelong		>5
>>>>108	use		mach-o		\b
### MACH-O END ###
### JAVA START ###
# Reference:	http://en.wikipedia.org/wiki/Java_class_file
# Update:	Joerg Jenderek
>4	ubelong		>30		compiled Java class data,
!:mime	application/x-java-applet
#!:mime	application/java-byte-code
!:ext	class
>>6	ubeshort	x	        version %d.
>>4	ubeshort	x       	\b%d
# for debugging purpose version as hexadecimal to compare with Mach-O universal binary
#>>4	ubelong		x       	(%#8.8x)
# Which is which?
# https://docs.oracle.com/javase/specs/jvms/se6/html/ClassFile.doc.html
#>>4	belong		0x002b		(Java 0.?)
#>>4	belong		0x032d		(Java 1.0)
#>>4	belong		0x032d		(Java 1.1)
>>4	belong		0x002e		(Java 1.2)
>>4	belong		0x002f		(Java 1.3)
>>4	belong		0x0030		(Java 1.4)
>>4	belong		0x0031		(Java 1.5)
>>4	belong		0x0032		(Java 1.6)
>>4	belong		0x0033		(Java 1.7)
>>4	belong		0x0034		(Java 1.8)
>>4	belong		0x0035		(Java SE 9)
>>4	belong		0x0036		(Java SE 10)
>>4	belong		0x0037		(Java SE 11)
>>4	belong		0x0038		(Java SE 12)
>>4	belong		0x0039		(Java SE 13)
>>4	belong		0x003A		(Java SE 14)
>>4	belong		0x003B		(Java SE 15)
>>4	belong		0x003C		(Java SE 16)
>>4	belong		0x003D		(Java SE 17)
>>4	belong		0x003E		(Java SE 18)
>>4	belong		0x003F		(Java SE 19)
>>4	belong		0x0040		(Java SE 20)
>>4	belong		0x0041		(Java SE 21)
>>4	belong		0x0042		(Java SE 22)
>>4	belong		0x0043		(Java SE 23)
>>4	belong		0x0044		(Java SE 24)
>>4	belong		0x0045		(Java SE 25)
>>4	belong		0x0046		(Java SE 26)
# pool count unequal zero
#>>8	beshort		x	        \b, pool count %#x
# pool table
#>>10	ubequad		x	        \b, pool %#16.16llx...

0	belong		0xcafed00d	JAR compressed with pack200,
>5	byte		x		version %d.
>4	byte		x		\b%d
!:mime	application/x-java-pack200

### JAVA END ###