[File] [PATCH v2] Improve FreeBSD kernel minidump recognition

[Michał Górny]

- add explicit support for powerpc which is the only "special case"
  right now

- use the version field to guess endianness

Example output:

minidumps/amd64:   FreeBSD kernel minidump for amd64, little endian, version 3
minidumps/arm64:   FreeBSD kernel minidump for arm64, little endian, version 2
minidumps/i386:    FreeBSD kernel minidump for i386, little endian, version 2
minidumps/ppc64be: FreeBSD kernel minidump for powerpc64, mmu_radix, big endian, version 2
minidumps/ppc64le: FreeBSD kernel minidump for powerpc64, mmu_radix, little endian, version 2
---
 magic/Magdir/freebsd | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

Changed in v2:
- removed unnecessary nesting in ppc rule

diff --git a/magic/Magdir/freebsd b/magic/Magdir/freebsd
index 69a07970..1582d99a 100644
--- a/magic/Magdir/freebsd
+++ b/magic/Magdir/freebsd
@@ -147,11 +147,18 @@
 # FreeBSD kernel minidumps
 #
 0	string	minidump\040FreeBSD/	FreeBSD kernel minidump
->17	string	amd64			for %s,
->>24	lelong	x			version %d
->17	string	arm			for %s,
->>24	lelong	x			version %d
->17	string	i386			for %s,
->>24	lelong	x			version %d
+# powerpc uses 32-byte magic, followed by 32-byte mmu kind, then version
+>17	string	powerpc
+>>17	string	>\0			for %s,
+>>32	string	>\0			%s,
+>>>64	byte	0			big endian,
+>>>>64	belong	x			version %d
+>>>64	default	x			little endian,
+>>>>64	lelong	x			version %d
+# all other architectures use 24-byte magic, followed by version
 >17	default	x
->>17	string >\0			for %s
+>>17	string	>\0			for %s,
+>>>24	byte	0			big endian,
+>>>>24	belong	x			version %d
+>>>24	default	x			little endian,
+>>>>24	lelong	x			version %d
-- 
2.34.1