8

Can I use file and magic ( http://linux.die.net/man/5/magic ) to override the description of some other known formats ?

for example, I would like to describe the following formats:

that are 'just' text file

Or

that is 'just' a gzipped-file starting with the magic-number BAM\1

?

do you know any example ?

Is it possible to provide a custom C code to test the file instead of using the magic format ?

8

You can use the -m option to specify an alternate list of magic files, and if you include your own before the compiled magic file (/usr/share/file/magic.mgc on my system) in that list, those patterns will be tested before the "global" ones. You can create a function, or an alias, to transparently always transparently use that option by just issuing the file command.

The language used in magic file is quite powerful, so there is seldom a need to revert to custom C coding. The only time I felt inclined to do so was in the 90's when matching HTML and XML files was difficult because there was no way (at that time) to have the flexible casing and offset matching necessary to be able to parse <HTML and < Html and < html with one pattern. I implemented that in C as modifier to the 'string' pattern, allowing the ignoring of case and compacting of (optional) blanks.

These changes in C required adaptation of the magic files as well. And unless the file source code has significantly changed since then, you will always need to modify (or provide extra) rules in magic files that match those C code changes. So you might as well start out trying to do it with changes to the magic files only, and fall back to changing the C code if that really doesn't work out.

  • Thank you, the github repo with the examples was very useful. – Pierre Sep 5 '14 at 19:57
1

For the next $(user_searchengine)user finding this:

Simple rules like the BAM one are looking like this:
OFFSET TYPE [OPERAND]FLAG MESSAGE
In the case of BAM:
0 string BAM\1 BAM
This would print the string BAM when finding the header.

For more information this IBM sites information seem to be a bit outdated, but should still be enough for simple use cases. man also has a bunch of information about the format.

0

You don't need to always use the -m option; as documentend in its manpage file(1) will also read by default the ~/.magic file (or a compiled version of it: ~/.magic.mgc), so you could add your definitions there; no need to mess with the system-wide /usr/share/magic* or /etc/magic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.