|
 |
435ea7 |
diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos
|
|
|
435ea7 |
index d1a19a6..9e89f11 100644
|
|
|
435ea7 |
--- a/magic/Magdir/msdos
|
|
|
435ea7 |
+++ b/magic/Magdir/msdos
|
|
|
435ea7 |
@@ -319,9 +319,9 @@
|
|
|
435ea7 |
# but it isn't feasible to match all COM files since there must be at least
|
|
|
435ea7 |
# two dozen different one-byte "magics".
|
|
|
435ea7 |
# test too generic ?
|
|
|
435ea7 |
-0 byte 0xe9 DOS executable (COM)
|
|
|
435ea7 |
->0x1FE leshort 0xAA55 \b, boot code
|
|
|
435ea7 |
->6 string SFX\ of\ LHarc (%s)
|
|
|
435ea7 |
+#0 byte 0xe9 DOS executable (COM)
|
|
|
435ea7 |
+#>0x1FE leshort 0xAA55 \b, boot code
|
|
|
435ea7 |
+#>6 string SFX\ of\ LHarc (%s)
|
|
|
435ea7 |
|
|
|
435ea7 |
# DOS device driver updated by Joerg Jenderek at May 2011
|
|
|
435ea7 |
# http://maben.homeip.net/static/S100/IBM/software/DOS/DOS%20techref/CHAPTER.009
|
|
|
435ea7 |
@@ -396,28 +396,28 @@
|
|
|
435ea7 |
#>4 uleshort&0x4000 0x4000 \b,control strings-support)
|
|
|
435ea7 |
|
|
|
435ea7 |
# test too generic ?
|
|
|
435ea7 |
-0 byte 0x8c DOS executable (COM)
|
|
|
435ea7 |
+#0 byte 0x8c DOS executable (COM)
|
|
|
435ea7 |
# updated by Joerg Jenderek at Oct 2008
|
|
|
435ea7 |
0 ulelong 0xffff10eb DR-DOS executable (COM)
|
|
|
435ea7 |
# byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
|
|
|
435ea7 |
-0 ubeshort&0xeb8d >0xeb00
|
|
|
435ea7 |
+#0 ubeshort&0xeb8d >0xeb00
|
|
|
435ea7 |
# DR-DOS STACKER.COM SCREATE.SYS missed
|
|
|
435ea7 |
->0 byte 0xeb
|
|
|
435ea7 |
->>0x1FE leshort 0xAA55 DOS executable (COM), boot code
|
|
|
435ea7 |
->>85 string UPX DOS executable (COM), UPX compressed
|
|
|
435ea7 |
->>4 string \ $ARX DOS executable (COM), ARX self-extracting archive
|
|
|
435ea7 |
->>4 string \ $LHarc DOS executable (COM), LHarc self-extracting archive
|
|
|
435ea7 |
->>0x20e string SFX\ by\ LARC DOS executable (COM), LARC self-extracting archive
|
|
|
435ea7 |
+#>0 byte 0xeb
|
|
|
435ea7 |
+#>>0x1FE leshort 0xAA55 DOS executable (COM), boot code
|
|
|
435ea7 |
+#>>85 string UPX DOS executable (COM), UPX compressed
|
|
|
435ea7 |
+#>>4 string \ $ARX DOS executable (COM), ARX self-extracting archive
|
|
|
435ea7 |
+#>>4 string \ $LHarc DOS executable (COM), LHarc self-extracting archive
|
|
|
435ea7 |
+#>>0x20e string SFX\ by\ LARC DOS executable (COM), LARC self-extracting archive
|
|
|
435ea7 |
# updated by Joerg Jenderek at Oct 2008
|
|
|
435ea7 |
#0 byte 0xb8 COM executable
|
|
|
435ea7 |
-0 uleshort&0x80ff 0x00b8
|
|
|
435ea7 |
+#0 uleshort&0x80ff 0x00b8
|
|
|
435ea7 |
# modified by Joerg Jenderek
|
|
|
435ea7 |
->1 lelong !0x21cd4cff COM executable for DOS
|
|
|
435ea7 |
+#>1 lelong !0x21cd4cff COM executable for DOS
|
|
|
435ea7 |
# http://syslinux.zytor.com/comboot.php
|
|
|
435ea7 |
# (32-bit COMBOOT) programs *.C32 contain 32-bit code and run in flat-memory 32-bit protected mode
|
|
|
435ea7 |
# start with assembler instructions mov eax,21cd4cffh
|
|
|
435ea7 |
-0 uleshort&0xc0ff 0xc0b8
|
|
|
435ea7 |
->1 lelong 0x21cd4cff COM executable (32-bit COMBOOT)
|
|
|
435ea7 |
+#0 uleshort&0xc0ff 0xc0b8
|
|
|
435ea7 |
+#>1 lelong 0x21cd4cff COM executable (32-bit COMBOOT)
|
|
|
435ea7 |
# syslinux:doc/comboot.txt
|
|
|
435ea7 |
# A COM32R program must start with the byte sequence B8 FE 4C CD 21 (mov
|
|
|
435ea7 |
# eax,21cd4cfeh) as a magic number.
|
|
|
435ea7 |
@@ -437,27 +437,27 @@
|
|
|
435ea7 |
# GRR search is not working
|
|
|
435ea7 |
#2 search/28 \xcd\x21 COM executable for MS-DOS
|
|
|
435ea7 |
#WHICHFAT.cOM
|
|
|
435ea7 |
-2 string \xcd\x21 COM executable for DOS
|
|
|
435ea7 |
+#2 string \xcd\x21 COM executable for DOS
|
|
|
435ea7 |
#DELTREE.cOM DELTREE2.cOM
|
|
|
435ea7 |
-4 string \xcd\x21 COM executable for DOS
|
|
|
435ea7 |
+#4 string \xcd\x21 COM executable for DOS
|
|
|
435ea7 |
#IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
|
|
|
435ea7 |
-5 string \xcd\x21 COM executable for DOS
|
|
|
435ea7 |
+#5 string \xcd\x21 COM executable for DOS
|
|
|
435ea7 |
#DELTMP.COm HASFAT32.cOM
|
|
|
435ea7 |
-7 string \xcd\x21
|
|
|
435ea7 |
->0 byte !0xb8 COM executable for DOS
|
|
|
435ea7 |
+#7 string \xcd\x21
|
|
|
435ea7 |
+#>0 byte !0xb8 COM executable for DOS
|
|
|
435ea7 |
#COMP.cOM MORE.COm
|
|
|
435ea7 |
-10 string \xcd\x21
|
|
|
435ea7 |
->5 string !\xcd\x21 COM executable for DOS
|
|
|
435ea7 |
+#10 string \xcd\x21
|
|
|
435ea7 |
+#>5 string !\xcd\x21 COM executable for DOS
|
|
|
435ea7 |
#comecho.com
|
|
|
435ea7 |
-13 string \xcd\x21 COM executable for DOS
|
|
|
435ea7 |
+#13 string \xcd\x21 COM executable for DOS
|
|
|
435ea7 |
#HELP.COm EDIT.coM
|
|
|
435ea7 |
-18 string \xcd\x21 COM executable for MS-DOS
|
|
|
435ea7 |
+#18 string \xcd\x21 COM executable for MS-DOS
|
|
|
435ea7 |
#NWRPLTRM.COm
|
|
|
435ea7 |
-23 string \xcd\x21 COM executable for MS-DOS
|
|
|
435ea7 |
+#23 string \xcd\x21 COM executable for MS-DOS
|
|
|
435ea7 |
#LOADFIX.cOm LOADFIX.cOm
|
|
|
435ea7 |
-30 string \xcd\x21 COM executable for MS-DOS
|
|
|
435ea7 |
+#30 string \xcd\x21 COM executable for MS-DOS
|
|
|
435ea7 |
#syslinux.com 3.11
|
|
|
435ea7 |
-70 string \xcd\x21 COM executable for DOS
|
|
|
435ea7 |
+#70 string \xcd\x21 COM executable for DOS
|
|
|
435ea7 |
# many compressed/converted COMs start with a copy loop instead of a jump
|
|
|
435ea7 |
0x6 search/0xa \xfc\x57\xf3\xa5\xc3 COM executable for MS-DOS
|
|
|
435ea7 |
0x6 search/0xa \xfc\x57\xf3\xa4\xc3 COM executable for DOS
|