NAME

magic − the magic number file for the file command. 

DESCRIPTION

Among other tests, file(1) examines the magic number to determine the file type. The magic number is nomally located at the beginning of files and consists of a numerical value or string of characters that specifies the file type. 

(Example)
Shell program#!/bin/sh
Boss script%!
MIPS endian big0x0160 (short)

/etc/magic contains the magic numbers and the messages which are displayed when each magic number is found. Each line of /etc/magic takes the following format. 

offsettype    valuemessage

offset The location in number of bytes from the top of the file where the comparison data (magic number) is located. 

type The comparison data type. 

byte1-byte value
short2-byte value
long4-byte value
stringCharacter string

value value is compared with the data located in the position indicated by offset. If type is byte, short or long, C arithmetic operators and comparison commands may be used. 

> valueData is greater than value.
< valueData is less than value.
! valueNot equal.
& value(value & data)
^ value! (value & data)

If there are no comparison commands or if the type is string , ‘=’ is interpreted and value and the data are compared. 
value is expressed in C format. For example, 13 is decimal, 013 is octal and 0x13 is hexadecimal.  If value is ‘x’, any numerical value or character string is a match. 

message
If the data in the file satisfies the comparison conditions, message is displayed.  The message character string contains printf(3S) format data, the data in the offset position is printed in the specified format. 

For some files, additional data may be displayed after the file type.  A comparison for the purpose of displaying additional data takes place if the data on a line which does not begin with a ‘>’ satisfies the comparison conditions, and the following line starts with a ‘>’.  This comparison processing continues until a line beginning with a ‘>’ is encountered. 

EXAMPLE

0short0x0160MIPS endian big
>20short0407  executable
>20short0410  pure
>20short0413  demand paged
>8long!0    not stripped
>8long0     stripped
>22bytex     - version %ld.
>23bytex     ^H%ld

1) “MIPS endian big” is displayed on the first line if there is a short hexadecimal 160 at byte 0 of the file. 
2) If there is an octal 0413 at byte 20 of the file, “demand page” is displayed.
3) If there is no long 0 at byte 8 of the file, “not stripped” is displayed. 
4) The byte at byte 22 is read and displayed in %ld format following - version. 
5) The byte at byte 23 is read and displayed in %ld format.  A space is inserted when byte 23 is displayed, so ^H (Ctrl-H) is used to remove it. 
The result is output such as the following.
/usr/bin/file :    MIPS endian big demand paged not stripped - version 2.0

FILES

/etc/magic

SEE ALSO

file(1), printf(3S)

BUGS

It would be advisable to perform a second check when a line beginning with ‘>’ is encountered to identify the file. 

NEWS-OSRelease 4.2.1R