Blame SOURCES/file-5.11-qcow3.patch
|
 |
fa5e7e |
diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos
|
|
|
fa5e7e |
index 8f3e532..21f055d 100644
|
|
|
fa5e7e |
--- a/magic/Magdir/msdos
|
|
|
fa5e7e |
+++ b/magic/Magdir/msdos
|
|
|
fa5e7e |
@@ -820,6 +820,21 @@
|
|
|
fa5e7e |
>>24 bequad x \b, %lld bytes
|
|
|
fa5e7e |
>>32 belong 1 \b, AES-encrypted
|
|
|
fa5e7e |
|
|
|
fa5e7e |
+>4 belong 3 (v3)
|
|
|
fa5e7e |
+# Using the existence of the Backing File Offset to determine whether
|
|
|
fa5e7e |
+# to read Backing File Information
|
|
|
fa5e7e |
+>>8 bequad >0 \b, has backing file
|
|
|
fa5e7e |
+# Note that this isn't a null-terminated string; the length is actually
|
|
|
fa5e7e |
+# (16.L). Assuming a null-terminated string happens to work usually, but it
|
|
|
fa5e7e |
+# may spew junk until it reaches a \0 in some cases. Also, since there's no
|
|
|
fa5e7e |
+# .Q modifier, we just use the bottom four bytes as an offset. Note that if
|
|
|
fa5e7e |
+# the file is over 4G, and the backing file path is stored after the first 4G,
|
|
|
fa5e7e |
+# the wrong filename will be printed. (This should be (8.Q), when that syntax
|
|
|
fa5e7e |
+# is introduced.)
|
|
|
fa5e7e |
+>>>(12.L) string >\0 (path %s)
|
|
|
fa5e7e |
+>>24 bequad x \b, %lld bytes
|
|
|
fa5e7e |
+>>32 belong 1 \b, AES-encrypted
|
|
|
fa5e7e |
+
|
|
|
fa5e7e |
>4 default x (unknown version)
|
|
|
fa5e7e |
|
|
|
fa5e7e |
0 string/b QEVM QEMU suspend to disk image
|