[File] Extend PE (msdos) magic with new architectures

Michał Janiszewski janisozaur at gmail.com
Thu Oct 17 10:08:17 UTC 2019


In case the attachment is in invalid format, here's the plain diff:

diff --git a/magic/Magdir/msdos b/magic/Magdir/msdos
index 5ed6d633..ad66785a 100644
--- a/magic/Magdir/msdos
+++ b/magic/Magdir/msdos
@@ -114,13 +114,18 @@
 >>>(0x3c.l+4)    leshort        0x14c    Intel 80386
 >>>(0x3c.l+4)    leshort        0x166    MIPS R4000
 >>>(0x3c.l+4)    leshort        0x168    MIPS R10000
+>>>(0x3c.l+4)    leshort        0x169    MIPS WCE v2
 >>>(0x3c.l+4)    leshort        0x184    Alpha
 >>>(0x3c.l+4)    leshort        0x1a2    Hitachi SH3
+>>>(0x3c.l+4)    leshort        0x1a2    Hitachi SH3 DSP
 >>>(0x3c.l+4)    leshort        0x1a6    Hitachi SH4
+>>>(0x3c.l+4)    leshort        0x1a8    Hitachi SH5
 >>>(0x3c.l+4)    leshort        0x1c0    ARM
 >>>(0x3c.l+4)    leshort        0x1c2    ARM Thumb
 >>>(0x3c.l+4)    leshort        0x1c4    ARMv7 Thumb
+>>>(0x3c.l+4)    leshort        0x1d3    Matsushita AM33
 >>>(0x3c.l+4)    leshort        0x1f0    PowerPC
+>>>(0x3c.l+4)    leshort        0x1f1    PowerPC with FPU
 >>>(0x3c.l+4)    leshort        0x200    Intel Itanium
 >>>(0x3c.l+4)    leshort        0x266    MIPS16
 >>>(0x3c.l+4)    leshort        0x268    Motorola 68000
@@ -128,7 +133,12 @@
 >>>(0x3c.l+4)    leshort        0x366    MIPSIV
 >>>(0x3c.l+4)    leshort        0x466    MIPS16 with FPU
 >>>(0x3c.l+4)    leshort        0xebc    EFI byte code
+>>>(0x3c.l+4)    leshort        0x5032    RISC-V 32-bit
+>>>(0x3c.l+4)    leshort        0x5064    RISC-V 64-bit
+>>>(0x3c.l+4)    leshort        0x5128    RISC-V 128-bit
+>>>(0x3c.l+4)    leshort        0x9041    Mitsubishi M32R
 >>>(0x3c.l+4)    leshort        0x8664    x86-64
+>>>(0x3c.l+4)    leshort        0xaa64    Aarch64
 >>>(0x3c.l+4)    leshort        0xc0ee    MSIL
 >>>(0x3c.l+4)    default        x    Unknown processor type
 >>>>&0        leshort        x    0x%x

On Thu, 17 Oct 2019 at 11:57, Michał Janiszewski <janisozaur at gmail.com> wrote:
>
> Based on current version of
> https://docs.microsoft.com/en-us/windows/win32/debug/pe-format
>
> --
> Michal Janiszewski



-- 
Michal Janiszewski


More information about the File mailing list