From 2f62d5544d13ca32dc09504ec70358db581e9e65 Mon Sep 17 00:00:00 2001 From: Christos Zoulas Date: Wed, 31 Mar 2021 19:51:14 +0000 Subject: [PATCH] Improve 8086 relocatable detection (Joerg Jenderek) --- magic/Magdir/xenix | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/magic/Magdir/xenix b/magic/Magdir/xenix index 3e248de26..d5ab69e5d 100644 --- a/magic/Magdir/xenix +++ b/magic/Magdir/xenix @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: xenix,v 1.12 2021/02/23 00:51:10 christos Exp $ +# $File: xenix,v 1.13 2021/03/31 19:51:14 christos Exp $ # xenix: file(1) magic for Microsoft Xenix # # "Middle model" stuff, and "Xenix 8086 relocatable or 80286 small @@ -13,25 +13,35 @@ # 0 string core core file (Xenix) # URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix +# http://fileformats.archiveteam.org/wiki/OMF # Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf # Update: Joerg Jenderek # recordtype~TranslatorHEADerRecord 0 byte 0x80 -# GRR: line above is too general as it catches also Extensible storage engine DataBase +# GRR: line above is too general as it catches also Extensible storage engine DataBase, +# all lif files like forth.lif hpcc88.lif lex90b.lif ( See ./lif) +# and all compressed DEGAS low-res bitmaps like: MUNCHIE.PC1 PIDER1.PC1 # skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3 >1 uleshort <1022 # skip examples like GAME.PICTURE Strange.Pic by looking for positive record length >>1 uleshort >0 # skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positive string length >>>3 ubyte >0 -# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c" ->>>>4 regex [a-zA-Z_/]{1,8}[.] 8086 relocatable (Microsoft) +# skip examples like OMBRE.6 with "UUUUUU" name by looking for valid high second record type +>>>>(1.s+3) ubyte >0x6D 8086 relocatable (Microsoft) #!:mime application/octet-stream !:mime application/x-object -!:ext o/a +!:ext obj/o/a +# T-module name often source name like "hello.c" or "jmppm32.asm" in JMPPM32.OBJ or +# "kbhit" in KBHITS.OBJ or "CAUSEWAY_KERNAL" in CWAPI.OBJ >>>>>3 pstring x \b, "%s" +# data length probably lower 256 according to TrID obj_omf.trid.xml +>>>>>1 uleshort x \b, 1st record data length %u # checksum #>>>>>(3.b+4) ubyte x \b, checksum 0x%2.2x +# second recordtype: 96h~LNAMES 88h~COMENT 8CH~EXTDEF +>>>>>(1.s+3) ubyte x \b, 2nd record type 0x%x +>>>>>(1.s+4) uleshort x \b, 2nd record data length %u 0 leshort 0xff65 x.out >2 string __.SYMDEF randomized >0 byte x archive