diff options
Diffstat (limited to 'contrib/file/magic/Magdir/intel')
| -rw-r--r-- | contrib/file/magic/Magdir/intel | 208 |
1 files changed, 196 insertions, 12 deletions
diff --git a/contrib/file/magic/Magdir/intel b/contrib/file/magic/Magdir/intel index ba25d983411a..5177fea45785 100644 --- a/contrib/file/magic/Magdir/intel +++ b/contrib/file/magic/Magdir/intel @@ -1,6 +1,6 @@ #------------------------------------------------------------------------------ -# $File: intel,v 1.18 2020/04/18 16:19:03 christos Exp $ +# $File: intel,v 1.23 2022/10/31 13:22:26 christos Exp $ # intel: file(1) magic for x86 Unix # # Various flavors of x86 UNIX executable/object (other than Xenix, which @@ -37,13 +37,22 @@ # ./intel (version 5.25) label labeled the next entry as "80386 COFF executable" # SGI labeled the next entry as "iAPX 386 executable" --Dan Quinlan 0 leshort =0514 -# use subroutine to display name+flags+variables for common object formated files +# use subroutine to display name+flags+variables for common object formatted files >0 use display-coff #>12 lelong >0 not stripped # no hint found, that at offset 22 is version #>22 leshort >0 - version %d 0 leshort 0x0200 ->0 use display-coff +# no F_EXEC flag bit implies Intel ia64 COFF object file without optional header +>18 leshort ^0x0002 +# skip some DEGAS high-res uncompressed bitmap *.pi3 handled by ./images like +# GEMINI03.PI3 MODEM2.PI3 POWERFIX.PI3 sigirl1.pi3 vanna5.pi3 +# by test for valid starting character (often point 0x2E) of 1st section name +>>20 ubyte >0x1F +>>>0 use display-coff +# F_EXEC flag bit implies Intel ia64 COFF executable +>18 leshort &0x0002 +>>0 use display-coff 0 leshort 0x8664 >0 use display-coff @@ -52,16 +61,191 @@ # From: Alex Myczko <alex@aiei.ch> # updated by Joerg Jenderek # https://en.wikipedia.org/wiki/Option_ROM -0 beshort 0x55AA BIOS (ia32) ROM Ext. -!:mime application/octet-stream +# URL: http://fileformats.archiveteam.org/wiki/BIOS +# Reference: http://www.lejabeach.com/sisubb/BIOS_Disassembly_Ninjutsu_Uncovered.pdf +0 beshort 0x55AA +# skip misidentified raspberry pi pieeprom-*.bin by check for +# unlikely high ROM size (0xF0*512=240*512) and not observed start instruction 0x0F +>2 ubeshort !0xF00F +# skip 2 byte sized eof.bin with start magic +>>0 use rom-x86 +0 name rom-x86 +>0 beshort x BIOS (ia32) ROM Ext. +#!:mime application/octet-stream +!:mime application/x-ibm-rom !:ext rom/bin ->5 string USB USB ->7 string LDR UNDI image +################################################################################ +# not Plug aNd Play ($PnP) like 00000000 (ide_xtp.bin kvmvapic.bin V7VGA.ROM) 000000fc (MCT-VGA.bin) +# 55aaf00f (pieeprom-*.bin) 55aa40e9 (Trm3x5.bin) 24506f4f (sgabios-bin.rom) +# 55aa4be9 (vgabios-stdvga.rom vgabios-cirrus-bin.rom vgabios-vmware-bin.rom) +>(26.s) ubelong !0x24506e50 +#>(26.s) ubelong !0x24506e50 NOT PNP=%8.8x +# also not PCI (PCIR) implies "old" ISA cards or foo like: 8a168404 (MCT-VGA.bin) +# 55aaf00f (pieeprom*.bin) +>>(24.s) ubelong !0x50434952 +#>>(24.s) ubelong !0x50434952 ISA CARD=%8.8x +# "old" identification strings used in file version 5.41 and earlier +# probably an USB controller +>>>5 string USB USB +# probably https://en.wikipedia.org/wiki/Preboot_Execution_Environment +>>>7 string LDR UNDI image +# probably another Adaptec SCSI controller +>>>26 string Adaptec Adaptec +# http://minuszerodegrees.net/rom/bin/adaptec_aha1542cp_bios_908501-00.bin +# already done by PNP variant +#>>>28 string Adaptec Adaptec +# probably Promise SCSI controller +>>>42 string PROMISE Promise +# old test for IBM compatible Video cards; INTERNAL FACTS WHY IS THIS WORKING? >30 string IBM IBM comp. Video ->26 string Adaptec Adaptec ->28 string Adaptec Adaptec ->42 string PROMISE Promise ->2 byte x (%d*512) +# display exact text for IBM compatible Video cards with longer text +>>33 ubyte !0 +>>>30 string x "%s" +# http://minuszerodegrees.net/rom/bin/unknown/MCT-VGA-16%20-%20TDVGA%203588%20BIOS%20Version%20V1.04A.zip +# "IBM COMPATIBLETDVGA 3588 BIOS Version V1.04A2+" "MCT-VGA-16 - TDVGA 3588 BIOS Version V1.04A.bin" +# "IBM VGA Compatible\001" NVidia44.bin +# "IBM EGA ROM Video Seven BIOS Code, Version 1.04" V7VGA.ROM +# "IBM" vgabios-stdvga.rom +# "IBM" vgabios-vmware-bin.rom: +# "IBM" vgabios-cirrus-bin.rom +# "IBM" vgabios-virtio-bin.rom +################################################################################ +# ROM size in 512B blocks must be interpreted as unsigned for ROM of network cards +# like: efi-eepro100.rom efi-rtl8139.rom pxe-e1000.rom +>2 ubyte x (%u*512) +# file name file size calculated size remark +# eof.bin 2 - with start magic nothing is shown here +# orchid.bin 188 0 =0*512 on window 95 CD in Drivers\audio\orchid3d +# multiboot.bin 1024 1024 =2*512 QEMU emulator +# loader1.bin 512 2048 =4*512 +# ide_xtp.bin 8192 8192 =16*512 +# kvmvapic.bin 9216 9216 =18*512 +# V7VGA.ROM 18832 16384 =32*512 +# adaptec1542.bin 32768 16384 =32*512 +# MCT-VGA.bin 32768 24576 =48*512 +# 2975BIOS.BIN 32768 32256 =63*512 +# efi-e1000.rom 196608 64000 =125*512 +# efi-rtl8139.rom 176640 66048 =129*512 +# pieeprom*.bin 524288 122880 =240*512 +################################################################################ +# initialization vector with executable code; often near JuMP instruction E9 yy zz +>3 ubyte =0xE9 jmp +# jmp offset like: 008fh 0093h 009fh 00afh 0143h 3ad7h 5417h 54ech 594dh 895fh +>>4 uleshort x %#4.4x +# for initialization vector samples without 3 byte jump instruction +>3 ubyte !0xE9 instruction +# eb4b3734h NVidia44.bin +# 00003234h V7VGA.ROM +# 060e0731h kvmvapic.bin +# cb000000h linuxboot-bin.rom +# e80d0fcbh PXE-Intel.rom +# b8004875h orchid.bin +>>3 ubelong x %#8.8x +# For misidentified raspberry pi pieeprom-*.bin like: 0xf00f +#>2 ubeshort x \b, AT 2 %#4.4x +################################################################################ +# new sections for BIOS (ia32) ROM Extension +# 4 bytes ASCII Signature "$PnP" for Plug aNd Play expansion header +>(26.s) string =$PnP \b; +#>(26.s) string =$PnP FOUND $PnP +# at 1Ah possible offset to expansion header structure; new for Plug aNd Play +>>26 uleshort x at %#x PNP +# Plug and Play vendor+device ID like: 0 0x000f1000 (2975BIOS.BIN) 0x31121095 (4243.bin) 0x04904215 (adaptec1542.bin) +#>>(26.s+0x0A) ulelong !0 NOT-nullID=%8.8x +>>(26.s+0x0A) uleshort !0 +# show PnP Vendor identification in human readable text form instead of numeric +# For adaptec_ava1515_bios_585201-00.bin reverted endian! BUT IS THIS ALWAYS TRUE? +>>>(26.s+0x0C) use \^PCI-vendor +>>>(26.s+0x0A) ubeshort x device=%#4.4x +# 3 byte Device type code; probably the same meaning as in PCI section? +# OK for storage controller SCSI (2975BIOS.BIN adaptec1542.bin) +# and network controller ethernet (efi-e1000.rom efi-rtl8139.rom) +>>(26.s+0x12) use PCI-class +# structure revision like: 01h +>>(26.s+4) ubyte !1 \b, revision %u +# PnP Header structure length in multiple of 16 bytes like: 2 +>>(26.s+5) uleshort !2 \b, length %u*16 +# offset to next header; 0 if none +>>(26.s+7) uleshort !0 \b, at %#x next header +# reserved byte; seems to be zero +>>(26.s+8) ubyte !0 \b, reserved %#x +# 8-bit checksum for this header; calculated and patched by patch2pnprom +>>(26.s+9) ubyte !0 \b, CRC %#x +# pointer to optional manufacturer string; like: 0 (4243.bin) 59h 5ch 60h c7h 14eh 27ch 296h 324h 3662h +>>(26.s+0x0E) uleshort >0 \b, at %#x +>>>(26.s+0x0C) uleshort x +# manufacturer ASCII-Z string like "http://ipxe.org" "Plop - Elmar Hanlhofer www.plop.at" "QEMU" +>>>>(&0.s) string x "%s" +# pointer to optional product string; like: 0 (2975BIOS.BIN) 6ch 70h 7ch d9h 160h 281h 29bh 329h +>>(26.s+0x10) uleshort >0 \b, at %#x +>>>(26.s+0x0E) uleshort x +# often human readable product ASCII-Z string like "iPXE" "Plop Boot Manager" +# "multiboot loader" "Intel UNDI, PXE-2.0 (build 082)" +>>>>(&0.s) string x "%s" +# PnP Device indicators; contains bits that identify the device as being capable of bootable +#>>(26.s+0x15) ubyte x \b, INDICATORS %#x +# device is a display device +>>(26.s+0x15) ubyte &0x01 \b, display +# device is an input device +>>(26.s+0x15) ubyte &0x02 \b, input +# device is an IPL device +>>(26.s+0x15) ubyte &0x04 \b, IPL +#>>(26.s+0x15) ubyte &0x08 reserved +# ROM is only required if this device is selected as a boot device +>>(26.s+0x15) ubyte &0x10 \b, bootable +# indicates ROM is read cacheable +>>(26.s+0x15) ubyte &0x20 \b, cacheable +# ROM may be shadowed in RAM +>>(26.s+0x15) ubyte &0x40 \b, shadowable +# ROM supports the device driver initialization model +>>(26.s+0x15) ubyte &0x80 \b, InitialModel +# boot connection vector; an offset to a routine that hook into INT 9h, INT 10h, or INT 13h +# 0 means disabled 0x0429 (4650_sr5.bin) 0x0072 (adaptec1542.bin) +>>(26.s+0x16) uleshort !0 \b, boot vector offset %#x +# disconnect vector; offset to routine that do cleanup from an unsuccessful boot attempt +>>(26.s+0x18) uleshort !0 \b, disconnect offset %#x +# bootstrap entry point/vector (BEV); offset to a routine (like RPL) that hook into INT 19h +# 0 means disabled 0x3c (multiboot.bin) 0x358 (efi-rtl8139.rom) 0xae7 (PXE-Intel.rom) +>>(26.s+0x1A) uleshort !0 \b, bootstrap offset %#x +# 2nd reserved area; seems to be zero +>>(26.s+0x1C) uleshort !0 \b, 2nd reserved %#x +# static resource information vector; 0 means disabled +>>(26.s+0x1E) uleshort !0 \b, static offset %#4.4x +################################################################################ +# 4 bytes ASCII Signature "PCIR" for PCI Data Structure +#>(24.s) string =PCIR FOUND PCIR +>(24.s) string =PCIR \b; +# pointer to PCI data structure like: 1Ch 38h 104h 8E44h +>>24 uleshort x at %#x PCI +# Vendor identification (ID) https://pci-ids.ucw.cz/v2.2/pci.ids +#>>(24.s+4) uleshort x ID=%4.4x +# show Vendor identification in human readable text form instead of numeric +>>(24.s+4) use PCI-vendor +# device identification (ID) +>>(24.s+6) uleshort x device=%#4.4x +# Base+sub class code https://wiki.osdev.org/PCI +>>(24.s+0x0D) use PCI-class +# pointer to vital product data (VPD); 0 indicates no VPD; WHAT EXACTLY iS VPD? +>>(24.s+8) uleshort !0 \b, at %#x VPD +# PCI data structure length like: 24h 28h +>>(24.s+0xA) uleshort >0x28 \b, length %u +# PCI data structure revision like: 0 3 +>>(24.s+0xC) ubyte >0 \b, revision %u +# image length (hexadecimal) in multiple of 512 bytes like: 54 56 68 6a 76 78 7c 7d 7e 7f 80 81 83 +# Apparently this gives the same information as given by byte at offset 2 but as 16-bit +#>>(24.s+0x10) uleshort x \b, length %u*512 +# revision level of code/data like: 0 1 201h 502h +>>(24.s+0xC) ubyte >1 \b, code revision %#x +# code type: 0~Intel x86/PC-AT compatible 1~Open firmware standard for PCI42 FF~Reserved +>>(24.s+0x14) ubyte >0 \b, code type %#x +# last image indicator; bit 7 indicates "last image"; bits 0-6 are reserved +>>(24.s+0x15) ubyte >0 +>>>(24.s+0x15) ubyte =0x80 \b, last ROM +# THIS SHOULD NOT HAPPEN! +>>>(24.s+0x15) ubyte !0x80 \b, indicator %x +# 3rd reserved area; seems to be zero in most cases but not for +# efi-e1000.rom efi-rtl8139.rom +>>(24.s+0x16) ubeshort !0 \b, 3rd reserved %#x # Flash descriptors for Intel SPI flash roms. # From Dr. Jesus <j@hug.gs> @@ -118,7 +302,7 @@ # length, in bytes, of the entire DSDT (including the header) >>4 ulelong x \b, %u bytes # entire table must sum to zero -#>>9 ubyte x \b, checksum 0x%x +#>>9 ubyte x \b, checksum %#x # vendor ID for the ASL Compiler like: INTL MSFT ... >>28 string >\0 \b, created by %.4s # revision number of the ASL Compiler like: 20051117 20140724 20190703 20200110 ... |