[File] Add ExFAT filesystem detection

[Martin Hicks]

Hi,

The following adds detection for the ExFAT filesystem.

I'm not sure I understand all the subleties of the ordering in the
'filesystems' magic snippet, but with this patch I am able to detect
ExFAT and I was still able to detect NTFS, vfat, and ext4.

Thanks,
mh


>From 8f0f7c8ecbee2026b1097cb1def60dbde0293a7f Mon Sep 17 00:00:00 2001
From: Martin Hicks <mort at bork.org>
Date: Thu, 26 Nov 2020 08:39:37 -0500
Subject: [PATCH] Add ExFAT filesystem detection

---
 magic/Magdir/filesystems | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/magic/Magdir/filesystems b/magic/Magdir/filesystems
index 82cb1a7..c2970aa 100644
--- a/magic/Magdir/filesystems
+++ b/magic/Magdir/filesystems
@@ -261,6 +261,19 @@
 # for sector sizes with 512 or more Bytes
 >0x1FE		leshort		0xAA55		DOS/MBR boot sector
 
+# ExFAT
+3               string/w        =EXFAT
+!:strength +65
+>0x1FE          leshort         0xAA55
+>>0x6E          ubyte           1
+>>>0x6F         ubyte           0x80
+>>>0            ubyte           0xEB    DOS/MBR boot sector,
+>>>0x69         ubyte           x       ExFAT Filesystem version %d.
+>>>0x68         ubyte           x       \b%d
+>>>0x6d         ubyte           x       \b, (1<<%d) sectors per cluster
+>>>0x48         ulequad         x       \b, sectors %lld
+>>>0x64         ulelong         x       \b, serial number 0x%x
+
 # keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
 # only for sector sizes with 512 or more Bytes
 0x1FE          leshort         0xAA55         	DOS/MBR boot sector
-- 
1.9.1


-- 
Martin Hicks P.Eng.    |      mort at bork.org
Bork Consulting Inc.   |  +1 (613) 266-2296