[File] [PATCH] of Magdir/msdos for OS/2 LX executables *.dll *.sys without DOS stub
Jörg Jenderek
joerg.jen.der.ek at gmx.net
Tue Apr 6 16:01:35 UTC 2021
Hello,
some days ago i handled some OS/2 disks. When running file command
version 5.40 on some OS/2 libraries (*.dll) and some device drivers
(*.sys) i get an output like:
GCC335.DLL: data
libexslt.dll: MS-DOS executable, LX for OS/2 (DLL) i80386
PMDD.SYS: MS-DOS executable, LX for OS/2 (device driver) i80386
SBLIVE32.SYS: data
SECURIT2.DLL: data
UNIAUD32.SYS: data
WPDRIVE2.DLL: data
Some are not recognised. For comparison reason i run the file format
identification utility TrID ( See
https://mark0.net/soft-trid-e.html). This list the used file name
extension and with -v option the related URL pointing to used file
format information (See appended lx-trid-v.txt.gz)
Luckily TrID tool identifies the undetected libraries as "OS/2
Dynamic Link Library (no DOS stub)" by definition
dll-os2-no-dos-stub.trid.xml and displays related URL. This is now
expressed inside Magdir/msdos by additional comment line like
# URL: http://en.wikipedia.org/wiki/EXE
More information about that file format can be found in header file
exeflat.h of Open Watcom compiler suite. This is now expressed by
additional comment line like:
# https://github.com/
# open-watcom/open-watcom-v2/blob/master/bld/watcom/h/exeflat.h
Another Linear eXecutable Module Format Description can be found as
text file lxexe.txt. This is now expressed by additional comment line
like:
# http://www.textfiles.com/programming/FORMATS/lxexe.txt
The variants with DOS stub header (MZ magic) are already described by
file command Magdir/msdos. So i add magic lines for the other variant
without DOS header afterwards. According to documentation also big
endian variant exist, but my inspected examples are all little
endian. Further more LX and LE executables are nearly the same file
format. So i write the magic lines in a general way and try to get
the similar looking like for variant with MS-DOS stub.
This is done by sub routine lx-executable which start with lines like
0 name lx-executable
>0x00 uleshort =0x584c LX
>0x00 uleshort =0x454C LE
>0x00 uleshort x executable
!:mime application/x-lx-executable
#>0x02 ubyte =0 (little-endian)
>0x02 ubyte !0 (big-endian)
#>0x03 ubyte =0 \b, little-endian word order
#>0x03 ubyte !0 \b, big-endian word order
At the beginning is a 2 byte signature which is LX for my inspected
examples or maybe LE for others. On Windows systems mime type
application/x-msdownload is registered for DLL, but such OS/2
libraries are not made for Windows systems. So i choose another user
defined mime type application/x-lx-executable. The typical byte and
word order is little endian (Value 0). So show this information only
for big endian case (non zero value 1).
The 4 starting bytes are probably now unique enough for
identification. This is done by lines like:
0 string/b LX
>2 ushort =0
>>0 use lx-executable
>2 ushort =0x0101
>>0 use \^lx-executable
The later case with value 0x0101 is for big endian case with inverted
program logic.
For debugging purpose i display some values mentioned in
documentation. Later i changed such lines to comment lines like:
#>0x08 uleshort x \b, CPU %u
All my examples have value 2. That means 386 CPU. To get look of DOS
stub variant this information is shown at the end by lines like
>0x08 uleshort 1 i80286
>0x08 uleshort 2 i80386
>0x08 uleshort 3 i80486
>0x08 uleshort 4 i80586
I added all x86 architecture CPU types, but according to
documentation also 21h CPU value for Intel "N11" exist. And also non
intel CPU type exist with values 40h for MIPS Mark I ( R2000, R3000)
and 41h for MIPS Mark II ( R6000 ). But i do not know if OS/2 ports
for these higher values exist. So i mention these higher CPU type
values in comment lines.
The target operating system is shown by line like
#>0x0A leshort x \b, OS %u
This value is 1 for OS/2, 2 for Window, 3 for DOS and 4 for Windows
386. All my inspected examples belong to OS/2 systems. On Windows
system so far as i know executables have DOS stub part. Maybe that
there exist DOS extender parts. So this information is shown at the
beginning by lines like:
>0x0a leshort 1 for OS/2
>0x0a leshort 3 for DOS
The module type flags are shown by line like:
#>0x10 ulelong x \b, FLAGS 0x%8.8x
According to documentation the bits 8-10 must be considered as a
group. The flag value 100h=OSF_NOT_PM_COMPATIBLE is described as
"incompatible with PM windowing". The flag value
200h=OSF_PM_COMPATIBLE is described "Compatible with PM windowing".
And if both bits are set, then flag value 300h=OSF_PM_APP is
described by "Uses PM windowing API". When i understand documentation
text right, this value means example like SECURIT2.DLL is for
Graphical User Interface (GUI). Then vice versa means library or
driver is for console. This is shown by lines like:
>0x10 ulelong&0x00000300 =0x00000300 (GUI)
>0x10 ulelong&0x00000300 !0x00000300 (console)
The bits 15-17 must considered as group. The module type mask has
value 00038000h. I no bit is set, then it is program module.
On OS/2 and Windows system program executables have a DOS stub. So
maybe only some DOS extender programs possibly appear here.
If a bit is set then it is a library (DLL) or a device driver (With
typical file name extension SYS). If bit 17 (flag value
20000h=OSF_PHYS_DEVICE) is set then it is a device drive and not an
ordinary library. These informations are shown by lines like:
>0x10 ulelong&0x00038000 =0x00000000 (program)
>0x10 ulelong&0x00038000 >0x00000000
>>0x10 ulelong&0x00020000 >0 (device driver)
!:ext sys
>>0x10 ulelong&0x00020000 =0 (library)
!:ext dll
After applying the above mentioned modifications by patch
file-5.40-msdos-lx.diff then also LX executables without DOS stub
are no described like:
GCC335.DLL: LX executable for OS/2 (library) (console) i80386
libexslt.dll: MS-DOS executable, LX for OS/2 (DLL) i80386
PMDD.SYS: MS-DOS executable, LX for OS/2 (device driver) i80386
SBLIVE32.SYS: LX executable for OS/2 (device driver) (console) i80386
SECURIT2.DLL: LX executable for OS/2 (library) (GUI) i80386
UNIAUD32.SYS: LX executable for OS/2 (device driver) (console) i80386
WPDRIVE2.DLL: LX executable for OS/2 (library) (console) i80386
Maybe a unifying process with DOS stub variant should be done. This
would give a lower redundancy and a more unique output.
I hope my diff file can be applied in future version of
file utility.
With best wishes
Jörg Jenderek
--
Jörg Jenderek
-------------- next part --------------
A non-text attachment was scrubbed...
Name: lx-trid-v.txt.gz
Type: application/x-gzip
Size: 679 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20210406/ba413f05/attachment-0001.bin>
-------------- next part --------------
--- file-5.40/magic/Magdir/msdos.old 2021-02-22 23:51:10 +0000
+++ file-5.40/magic/Magdir/msdos 2021-04-06 15:45:37 +0000
@@ -362,10 +362,91 @@
# TELVOX Teleinformatica CODEC self-extractor for OS/2:
>49801 string \x79\xff\x80\xff\x76\xff \b, CODEC archive v3.21
>>49824 leshort =1 \b, 1 file
>>49824 leshort >1 \b, %u files
+# Summary: OS/2 LX Library and device driver (no DOS stub)
+# From: Joerg Jenderek
+# URL: http://en.wikipedia.org/wiki/EXE
+# Reference: http://www.textfiles.com/programming/FORMATS/lxexe.txt
+# https://github.com/open-watcom/open-watcom-v2/blob/master/bld/watcom/h/exeflat.h
+# Note: by dll-os2-no-dos-stub.trid.xml called "OS/2 Dynamic Link Library (no DOS stub)"
+# TODO: unify with DOS stub variant (MZ magic)
+0 string/b LX
+>2 ushort =0
+>>0 use lx-executable
+# no examples found for big endian variant
+>2 ushort =0x0101
+>>0 use \^lx-executable
+0 name lx-executable
+# similar looking like variant with MS-DOS stub (MZ magic): "MS-DOS executable, LX"
+#>0x00 uleshort x executable,
+# signature OSF_FLAT_LX_SIGNATURE~0x584C~LX OSF_FLAT_SIGNATURE~0x454C~LE
+>0x00 uleshort =0x584c LX
+>0x00 uleshort =0x454C LE
+>0x00 uleshort x executable
+#!:mime application/x-msdownload
+!:mime application/x-lx-executable
+# byte order: 00h~little-endian non-zero=1~big-endian
+#>0x02 ubyte =0 (little-endian)
+>0x02 ubyte !0 (big-endian)
+# FOR DEBUGGING!
+# word order: 00h~little-endian non-zero=1~big-endian
+#>0x03 ubyte =0 \b, little-endian word order
+#>0x03 ubyte !0 \b, big-endian word order
+# cpu_type; CPU type like: 1~286 2~386 3~486 4 20h~i860 21h~Intel N11 40h~MIPS R2000,R3000 41h~MIPS R6000 42h~MIPS R4000
+#>0x08 uleshort x \b, CPU %u
+# os_type; target operating system like: 0~unknown 1~OS/2 2~Windows 3~DOS 4.x 4~Windows 386
+#>0x0A leshort x \b, OS %u
+# flags; module type flags
+#>0x10 ulelong x \b, FLAGS 0x%8.8x
+# 00000002h ~Reserved for system use
+#>0x10 ulelong &0x00000002 \b, 2h reserved
+# OSF_INIT_INSTANCE=00000004h ~Per-Process Library Initialization; setting this bit for EXE file is invalid
+#>0x10 ulelong &0x00000004 \b, per-process library Initialization
+# OSF_INTERNAL_FIXUPS_DONE=00000010h ~Internal fixups for the module have been applied
+#>0x10 ulelong &0x00000010 \b, int. fixup
+# OSF_EXTERNAL_FIXUPS_DONE=00000020h ~External fixups for the module have been applied
+#>0x10 ulelong &0x00000020 \b, ext. fixup
+# OSF_NOT_PM_COMPATIBLE=00000100h ~Incompatible with PM windowing
+#>0x10 ulelong&0x00000100 =0x00000100 \b, incompatible with PM windowing
+# OSF_PM_COMPATIBLE=00000200h ~Compatible with PM windowing
+#>0x10 ulelong&0x00000200 =0x00000200 \b, compatible with PM windowing
+# bit 17; device driver
+#>0x10 ulelong&0x00020000 >0 \b, device driver
+# Per-process Library Termination; setting this bit for EXE file is invalid
+#>0x10 ulelong&0x40000000 =0x40000000 \b, per-process library termination
+>0x0a leshort 1 for OS/2
+# no example found
+>0x0a leshort 3 for DOS
+# http://www.ctyme.com/intr/rb-2939.htm#Table1610
+# library by module type mask 00038000h (bits 15-17);
+# 0h ~exectable Program module
+>0x10 ulelong&0x00038000 =0x00000000 (program)
+#!:ext exe
+# OSF_IS_DLL=8000h ~Library module (DLL)
+>0x10 ulelong&0x00038000 >0x00000000
+# OSF_PHYS_DEVICE=00020000h ~device driver
+>>0x10 ulelong&0x00020000 >0 (device driver)
+!:ext sys
+# if not device driver it is library (DLL)
+>>0x10 ulelong&0x00020000 =0 (library)
+!:ext dll
+# bits 8-10; OSF_PM_APP=300h in flags ~Uses PM windowing API; either it is GUI or console
+>0x10msd ulelong&0x00000300 =0x00000300 (GUI)
+>0x10 ulelong&0x00000300 !0x00000300 (console)
+# CPU type
+>0x08 uleshort 1 i80286
+# all inspected examples
+>0x08 uleshort 2 i80386
+>0x08 uleshort 3 i80486
+>0x08 uleshort 4 i80586
+# 21h Intel "N11" or compatible
+# 40h MIPS Mark I ( R2000, R3000) or compatible
+# 41h MIPS Mark II ( R6000 ) or compatible
+# 42h MIPS Mark III ( R4000 ) or compatible
+
# added by Joerg Jenderek of https://www.freedos.org/software/?prog=kc
# and https://www.freedos.org/software/?prog=kpdos
# for FreeDOS files like KEYBOARD.SYS, KEYBRD2.SYS, KEYBRD3.SYS, *.KBD
0 string/b KCF FreeDOS KEYBoard Layout collection
# only version=0x100 found
-------------- next part --------------
A non-text attachment was scrubbed...
Name: file-5.40-msdos-lx.diff.sig
Type: application/octet-stream
Size: 94 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20210406/ba413f05/attachment-0001.obj>
More information about the File
mailing list