[File] Matching metadata near the end of a large file

[Christos Zoulas]

File only inspects the first 1048576 bytes in the file which can be changed with -p bytes=XXXX.  If the data is close to the end of the file you can use a negative offset (from the end of file) and file will start looking backwards if it can seek.

Best,

christos

> On Aug 3, 2022, at 2:35 PM, Toni Ruottu <toni.ruottu at iki.fi> wrote:
> 
> 
> 
>   Hi!
> 
> 
> 
> I'm trying to create magic for a file format that stores some metadata close to the end of the file. There is a pointer to the metadata near the beginning, so I do know the offset where the metadata is located. However, the file command seems to give up around offset 0x100000 refusing to match any data past that point. The debug mode shows only zeros instead of the actual data.
> 
> 
> 
> Have I encountered a bug or is this a known limitation? What would be a good approach to take? Should I test my magic with a tiny file and ignore the potential failure due to file size? The files I'm trying to process are quite large and would typically not fit entirely within the first 0x100000 bytes.
> 
> 
> 
>   --Toni
> 
> 
> 
> 
> --
> File mailing list
> File at astron.com
> https://mailman.astron.com/mailman/listinfo/file
> <sanitizer.log>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.astron.com/pipermail/file/attachments/20220803/70ddb616/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 235 bytes
Desc: Message signed with OpenPGP
URL: <https://mailman.astron.com/pipermail/file/attachments/20220803/70ddb616/attachment.asc>