From 84609201fbbd9074f5426b991c5242a08ed78712 Mon Sep 17 00:00:00 2001 From: Christos Zoulas Date: Tue, 19 Apr 2016 18:14:19 +0000 Subject: [PATCH] Strengthen the magic of relocatable microsoft objects to avoid spurious matches (Joerg Jenderek) --- magic/Magdir/xenix | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/magic/Magdir/xenix b/magic/Magdir/xenix index 38e1e3c..ca5eaae 100644 --- a/magic/Magdir/xenix +++ b/magic/Magdir/xenix @@ -12,7 +12,26 @@ # XXX - "x.out" collides with PDP-11 archives # 0 string core core file (Xenix) -0 byte 0x80 8086 relocatable (Microsoft) +# URL: http://www.polarhome.com/service/man/?qf=86rel&tf=2&of=Xenix +# Reference: http://www.azillionmonkeys.com/qed/Omfg.pdf +# Update: Joerg Jenderek +# recordtype~TranslatorHEADerRecord +0 byte 0x80 +# GRR: line above is too general as it catches also Extensible storage engine DataBase +# skip examples like GENA.SND Switch.Snd by looking for record length maximal 1024-3 +>1 uleshort <1022 +# skip examples like GAME.PICTURE Strange.Pic by looking for positiv record length +>>1 uleshort >0 +# skip examples like Xtable.Data FRACTAL.GEN SHR.VIEW by looking for positiv string length +>>>3 ubyte >0 +# skip examples like OMBRE.6 with "UUUUUU" by looking for filename like "hello.c" +>>>>4 regex [a-zA-Z_/]{1,8}[.] 8086 relocatable (Microsoft) +#!:mime application/octet-stream +!:mime application/x-object +!:ext o/a +>>>>>3 pstring x \b, "%s" +# checksum +#>>>>>(3.b+4) ubyte x \b, checksum 0x%2.2x 0 leshort 0xff65 x.out >2 string __.SYMDEF randomized >0 byte x archive -- 2.7.4