[File] [PATCH v2] Improve FreeBSD kernel minidump recognition

[Christos Zoulas]

No problem, committed!

christos

> On Jan 19, 2022, at 7:20 AM, Michał Górny <mgorny at gentoo.org> wrote:
> 
> - add explicit support for powerpc which is the only "special case"
>  right now
> 
> - use the version field to guess endianness
> 
> Example output:
> 
> minidumps/amd64:   FreeBSD kernel minidump for amd64, little endian, version 3
> minidumps/arm64:   FreeBSD kernel minidump for arm64, little endian, version 2
> minidumps/i386:    FreeBSD kernel minidump for i386, little endian, version 2
> minidumps/ppc64be: FreeBSD kernel minidump for powerpc64, mmu_radix, big endian, version 2
> minidumps/ppc64le: FreeBSD kernel minidump for powerpc64, mmu_radix, little endian, version 2
> ---
> magic/Magdir/freebsd | 21 ++++++++++++++-------
> 1 file changed, 14 insertions(+), 7 deletions(-)
> 
> Changed in v2:
> - removed unnecessary nesting in ppc rule
> 
> diff --git a/magic/Magdir/freebsd b/magic/Magdir/freebsd
> index 69a07970..1582d99a 100644
> --- a/magic/Magdir/freebsd
> +++ b/magic/Magdir/freebsd
> @@ -147,11 +147,18 @@
> # FreeBSD kernel minidumps
> #
> 0	string	minidump\040FreeBSD/	FreeBSD kernel minidump
> ->17	string	amd64			for %s,
> ->>24	lelong	x			version %d
> ->17	string	arm			for %s,
> ->>24	lelong	x			version %d
> ->17	string	i386			for %s,
> ->>24	lelong	x			version %d
> +# powerpc uses 32-byte magic, followed by 32-byte mmu kind, then version
> +>17	string	powerpc
> +>>17	string	>\0			for %s,
> +>>32	string	>\0			%s,
> +>>>64	byte	0			big endian,
> +>>>>64	belong	x			version %d
> +>>>64	default	x			little endian,
> +>>>>64	lelong	x			version %d
> +# all other architectures use 24-byte magic, followed by version
>> 17	default	x
> ->>17	string >\0			for %s
> +>>17	string	>\0			for %s,
> +>>>24	byte	0			big endian,
> +>>>>24	belong	x			version %d
> +>>>24	default	x			little endian,
> +>>>>24	lelong	x			version %d
> --
> 2.34.1
> 
> --
> File mailing list
> File at astron.com
> https://mailman.astron.com/mailman/listinfo/file

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 235 bytes
Desc: Message signed with OpenPGP
URL: <https://mailman.astron.com/pipermail/file/attachments/20220119/9dcda354/attachment.asc>