[File] [PATCH] of Magdir/linux for Linux kernel (extensions; URL)

[Jörg Jenderek]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,
some days ago i run file command version 5.36 on some Linux kernels with
options --extension and --keep-going. For most examples no extension is
found ("???" displayed) or wrong extension "com" by Magdir/msdos is show
n.
The examples are identified by Magdir/linux correctly as "Linux
kernel" like
damnsmll.lnx:    Linux kernel x86 boot executable bzImage,
	version 2.4.26 (root at Knoppix)
	#1 SMP Sa Apr 17 19:33:42 CEST 2004,
	RO-rootFS, root_dev 0x301, Normal VGA
kernel64.dat:    Linux kernel x86 boot executable bzImage,
	version 3.11.6-acronis-b313-x86_64 (rnd at acronis)
	#1 SMP Mon Feb 10 05:13:59 PST 2014,
	RO-rootFS, swap_dev 0x2, Normal VGA
kernel7.img:     Linux kernel ARM boot executable zImage (little-endian)
kernel_auto.bin: Linux kernel ARM boot executable zImage (little-endian)
memdisk:         Linux kernel x86 boot executable bzImage,
	version MEMDISK 3.71 Debian-2008-09-06,
	RW-rootFS,
memdisk16.bin:   Linux kernel x86 boot executable bzImage,
	version MEMDISK 4.05 0x4ee25341,
	RW-rootFS,
plpbtrom.bin:    Linux kernel x86 boot executable zImage,
	RW-rootFS,
So i add lines to that magic file.
Normally Linux kernel have names without extension like bzimage, vmlinuz
or memdisk. But some manufactures use other names like kernel64.dat for
Acronis Recovery medium, plpbtrom.bin for the Plop Boot Manager or
damnsmll.lnx for DamnSmallLinux 1.5.
This is now expressed by additional line
 !:ext	/dat/bin/lnx
The above applies mainly to x86 boot executable. For x86 kernel more
information fields like version, video mode, etc. is displayed. These
fields of such kernel headers are explained in "THE LINUX/x86 BOOT
PROTOCOL" in the linux kernel documentation. This is now expressed by
additional remark line
 # URL: https://www.kernel.org/doc/Documentation/x86/boot.txt

There are other patterns for kernels on other architectures. So
for Linux kernel ARM boot executable zImage (little-endian) i found
"kernel7.img" on raspian distribution and "kernel_auto.bin" on tv
receiver with brand Vu+. This is now expressed by additional line
 !:ext	img/bin

After applying the above mentioned modifications by patch
file-5.36-linux-kernel-extension.diff then all inspected examples are
described with --extension option like
damnsmll.lnx:    /dat/bin/lnx
kernel64.dat:    /dat/bin/lnx
kernel7.img:     img/bin
kernel_auto.bin: img/bin
memdisk:         /dat/bin/lnx
memdisk16.bin:   /dat/bin/lnx
plpbtrom.bin:    /dat/bin/lnx
I hope my diff file can be applied in future version of file utility.

Furthermore i saw that the Linux kernel field information is shown in a
non logical way. For one branch information is shown by lines like
 >>498	leshort		1		RO-rootFS,
 >>498	leshort		0		RW-rootFS,
 >>508	leshort		>0		root_dev 0x%X,
 >>502	leshort		>0		swap_dev 0x%X,
For another Linux kernel branch the same field information is shown but
using other phrases and line order like
 >>502	leshort		>0		swap=0x%X
 >>508	leshort		>0		root=0x%X
 >>>498	leshort		1		\b-ro
 >>>498	leshort		0		\b-rw
Furthermore so such magic lines information is redundant.

Or with --keep-going option i get 3 message for the same kernel by 3
magic lines
 0	string		\xb8\xc0\x07\x8e\xd8\xb8\x00\x90 Linux
 0	belong		0xb8c0078e			 Linux
 0	belong		0xb8c0078e			 Linux kernel
So a cleanup and unification makes sense to me. Unfortunately my
knowledge about Linux kernel and non x86 architectures is limited to do
that.

With best wishes
Jörg Jenderek
- -- 
Jörg Jenderek
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iF0EARECAB0WIQS5/qNWKD4ASGOJGL+v8rHJQhrU1gUCXIRXwwAKCRCv8rHJQhrU
1uMdAKCiOus87xJ1dk7Igh3h1ppyFzwfqwCdFa0ETbCAuNJUmZwwx4VBMPIQKuo=
=sLIl
-----END PGP SIGNATURE-----
-------------- next part --------------
--- file-5.36/magic/Magdir/linux.old	2018-07-16 13:32:08 +0000
+++ file-5.36/magic/Magdir/linux	2019-03-09 20:57:10 +0000
@@ -113,4 +113,9 @@
 # Linux kernel boot images (i386 arch) (Wolfram Kleff)
+# URL: https://www.kernel.org/doc/Documentation/x86/boot.txt
 514	string		HdrS		Linux kernel
 !:strength + 55
+# often no extension like in linux, vmlinuz, bzimage or memdisk but sometimes
+# Acronis Recovery kernel64.dat and Plop Boot Manager plpbtrom.bin
+# DamnSmallLinux 1.5 damnsmll.lnx 
+!:ext	/dat/bin/lnx
 >510	leshort		0xAA55		x86 boot executable
@@ -205,3 +210,6 @@
 # From: Kevin Cernekee <cernekee at gmail.com>
+# Update: Joerg Jenderek
 36	lelong	0x016f2818	Linux kernel ARM boot executable zImage (little-endian)
+# raspian "kernel7.img", Vu+ Ultimo4K "kernel_auto.bin"
+!:ext	img/bin
 36	belong	0x016f2818	Linux kernel ARM boot executable zImage (big-endian)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.36-linux-kernel-extension.diff.sig
Type: application/octet-stream
Size: 95 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20190310/9f6edd71/attachment.obj>