[File] [PATCH] of Magdir/database for xBase memo files (*.dbt *.fpt)
Jörg Jenderek
joerg.jen.der.ek at gmx.net
Wed Jun 12 01:33:42 UTC 2019
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello,
some times ago i send magic lines to recognize xbase memo files with
file name extension dbt or fpt. Unfortunately from time to time also
other files are misidentified as such xbase memos when i run
file command version 5.37. The output with -k options looks like:
AI070GEP.EPS: GEM GDOS font Dutch 7, ID 0x000e
dBase III DBT, version number 0,
next free block index 458766
Defanged.Virus: dBase III DBT, version number 0,
next free block index 320996940,
1st item "L\310!\356\356@ X\377\272\275"
H1KLIN48.FNT: GEM GDOS font KLINGON 48, ID 0x001f
dBase III DBT, version number 0,
next free block index 3145759
Highs: dBase III DBT, version number 0,
next free block index 1935756559
HScores: dBase IV DBT of k.DBF, block length 25600,
next free block index 1767326216
Microsoft Mail.image: dBase III DBT, version number 0,
next free block index 1667845390
mw1859.tmp: Microsoft Word for Macintosh 4.0
dBase III DBT, version number 0,
next free block index 469776382, 1st item "works 3.0"
PICTURES.3Fx: dBase III DBT, version number 0,
next free block index 1816264721
sg15.sdg: dBase IV DBT, block length 13824,
next free block index 859916115,
next free block 1363307037,
next used block 2468861770\012-
(Lepton 3.x), scale 0-10240, spot sensor temperature 0.000000,
unit celsius, color scheme 0,
calibration: offset 0.000000, slope 0.000000
sg9.sdg: dBase IV DBT, block length 15872,
next free block index 859916115
SHAPE.FIGHT: dBase III DBT, version number 0,
next free block index 237240320,
1st item "\330\377\333\361\377\377\377"
WINWORD1.DOC: FoxPro FPT, blocks size 512,
next free block index 2611290368
WORDMAC4.DOC: Microsoft Word for Macintosh 5.0
dBase III DBT, version number 0,
next free block index 587216894, 1st item "test"
So i add/change lines in Magdir/database. Unfortunately there exist
no real magic pattern for xbase memo files. But luckily identifying
lines and displaying code are separated. So only more or stricter
test lines are needed. For FoxPro FPT memo files show information by
calling a subroutine, which starts by line
0 name foxpro-memo-print
>0 belong x FoxPro FPT
Afterward now also show a user defined mime type and file name
extension by lines
!:mime application/x-fpt
!:ext fpt
Later the type of memo field is show by line like
>512 ubelong <3 \b, field type %u
Valid values are 0 for picture, 1 for memo and 2 for object. So add
additional test line to check for valid FoxPro field type before
displaying informative lines, which now looks like
>>>>>>>>>>>512 ubelong <3
>>>>>>>>>>>>0 use foxpro-memo-print
For dBase III DBT memo file information is shown by subroutine
which starts like
0 name dbase3-memo-print
>0 ubyte x dBase III DBT
Afterward now also show a user defined mime type and file name
extension by lines
!:mime application/x-dbt
!:ext dbt
The Number of next available block for appending data is shown by
line like
>0 lelong !0 \b, next free block index %u
For real such memo files i found low values like 1, 11 or 16.
For misidentified files unrealistic high values are shown.
So remove last unspecific test lines and check for not so high free
block indices.
So now skip WORD1XW.DOC by lines
>>>>>>>>>0 lelong <2205083
>>>>>>>>>>0 use dbase3-memo-print
And also skip in other branch AI070GEP.EPS by lines
>>>>>>>>>>0 lelong <458766
>>>>>>>>>>>0 use dbase3-memo-print
The information of dBase IV DBT memo file is shown by subroutine
starting like
0 name dbase4-memo-print
>0 lelong x dBase IV DBT
Later the block length is displayed by line like
>20 uleshort >0 \b, block length %u
For real memo files i found values like 512, 1024. It is not
explicitly mentioned but for performance reasons only multiple of 2
in between 16 and 16 K should occur. This implies upper and lower
bits are zero. This was expressed by line like
>>>>>>>>20 uleshort&0x800f 0
To skip misidentified examples with improbably 3600h 3E00h size
restrict this test which now becomes
>>>>>>>>20 uleshort&0xE00f 0
After applying the above mentioned modifications by patch
file-5.37-database-xbase-memo.diff then observed misidentification
vanish and xbase memo files are still identified.
I hope my diff file can be applied in future version of
file utility.
With best wishes
Jörg Jenderek
- --
Jörg Jenderek
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
iF0EARECAB0WIQS5/qNWKD4ASGOJGL+v8rHJQhrU1gUCXQBWbgAKCRCv8rHJQhrU
1nDQAJ99c5sQYjKkPqxLv+9ZKXvNI0afLQCdFm3kS+qlaWgoRUMl6HX9XEuTww0=
=ZZz9
-----END PGP SIGNATURE-----
-------------- next part --------------
--- file-5.37/magic/Magdir/database.old 2019-04-19 00:42:27 +0000
+++ file-5.37/magic/Magdir/database 2019-06-11 22:03:57 +0000
@@ -151,3 +151,2 @@
# https://www.clicketyclick.dk/databases/xbase/format/dbf.html
-# http://home.f1.htw-berlin.de/scheibl/db/intern/dBase.htm
# inspect VVYYMMDD , where 1<= MM <= 12 and 1<= DD <= 31
@@ -341,3 +340,3 @@
# skip many JPG. ZIP, BZ2 by test for reserved bytes NULL , 0|2 , 0|1 , low byte of block size
->>>>17 ubelong&0xFFfdFE00 0x00000000
+>>>>17 ubelong&0xFFfdFEff 0x00000000
# skip many RAR by test for low byte 0 ,high byte 0|2|even of block size, 0|a|e|d7 , 0|64h
@@ -357,14 +356,10 @@
>>>>>>>>>>4 ushort 0
->>>>>>>>>>>0 use foxpro-memo-print
+# check for valid FoxPro field type
+>>>>>>>>>>>512 ubelong <3
+>>>>>>>>>>>>0 use foxpro-memo-print
# dBASE III DBT , garbage
->>>>>>>>>6 ubeshort 0
-# skip MM*DD*.bin by test for for reserved NULL byte
->>>>>>>>>>510 ubeshort 0
-# skip TK-DOS11.img image by looking for memo text
->>>>>>>>>>>512 ubelong <0xfeffff03
-# skip EFI executables by looking for memo text
->>>>>>>>>>>>512 ubelong >0x1F202020
->>>>>>>>>>>>>513 ubyte >0
+# skip WORD1XW.DOC with improbably high free block index
+>>>>>>>>>0 lelong <2205083
# unusual dBASE III DBT like adressen.dbt
->>>>>>>>>>>>>>0 use dbase3-memo-print
+>>>>>>>>>>0 use dbase3-memo-print
# dBASE III DBT like angest.dbt, or garbage PCX DBF
@@ -373,6 +368,5 @@
>>>>>>>>>510 ubeshort 0
-# skip some DBF by test of invalid version
->>>>>>>>>>0 ubyte >5
->>>>>>>>>>>0 ubyte <48
->>>>>>>>>>>>0 use dbase3-memo-print
+# skip AI070GEP.EPS with improbably high free block index
+>>>>>>>>>>0 lelong <458766
+>>>>>>>>>>>0 use dbase3-memo-print
# dBASE IV DBT with positive block size
@@ -381,3 +375,4 @@
# multiple of 2 in between 16 and 16 K ,implies upper and lower bits are zero
->>>>>>>>20 uleshort&0x800f 0
+# skip also 3600h 3E00h size
+>>>>>>>>20 uleshort&0xE00f 0
>>>>>>>>>0 use dbase4-memo-print
@@ -387,2 +382,4 @@
>0 ubyte x dBase III DBT
+!:mime application/x-dbt
+!:ext dbt
# instead 3 as version number 0 for unusual examples like biblio.dbt
@@ -397,2 +394,3 @@
>512 string >\0 \b, 1st item "%s"
+# https://www.clicketyclick.dk/databases/xbase/format/dbt.html
# Print the information of dBase IV DBT memo file
@@ -435,2 +433,3 @@
>>>8 string >\0 \b, 1st used item "%s"
+# http://www.dbfree.org/webdocs/1-documentation/0018-developers_stuff_(advanced)/os_related_stuff/xbase_file_format.htm
# Print the information of FoxPro FPT memo file
@@ -438,2 +437,4 @@
>0 belong x FoxPro FPT
+!:mime application/x-fpt
+!:ext fpt
# Size of blocks for FoxPro ( 64,256 )
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.37-database-xbase-memo.diff.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20190612/aaf05cb5/attachment.obj>
More information about the File
mailing list