From greg at rhobard.com  Thu Apr  3 15:24:57 2025
From: greg at rhobard.com (Gregory Lepore)
Date: Thu, 3 Apr 2025 11:24:57 -0400
Subject: [File] PRONOM signature conversions
Message-ID: <CAPrLS5_DnqVu5oyCGtmpYMMEZfzdGn9yiP0opkbLauzuEYSMGw@mail.gmail.com>

Greetings - for the past 5 years I have been working with the UK National
Archives to develop file format signatures for the PRONOM database. Those
signatures are very similar to those used by file. I have converted the
roughly 1,600 format signatures I've created to the 'file' format and
posted those signatures on my GitHub site at:

https://github.com/gleporeNARA/pronom-research/tree/master

The vast majority of these signatures are not currently being used by
'file'.

https://github.com/gleporeNARA/pronom-research/blob/master/formats.txt

lists an older set of formats that I have produced signatures for.

https://github.com/gleporeNARA/pronom-research/blob/master/'file'%20magic%20file%20from%20PRONOM%20sigs

is my collection of PRONOM signatures converted to 'file' format

https://github.com/gleporeNARA/pronom-research/blob/master/PRONOM%20to%20'file'%20test%20files

are the results of running file against my test corpus. As you can see,
most of the formats are not recognized.

In addition to the format signature I have sample files and a brief
writeup on each format.

I'm looking for help on how best to get these signatures into file.

Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.astron.com/pipermail/file/attachments/20250403/b25222a0/attachment.htm>

From erdnaxe at crans.org  Sun Apr  6 17:58:37 2025
From: erdnaxe at crans.org (A. IOOSS)
Date: Sun, 6 Apr 2025 19:58:37 +0200
Subject: [File] [PATCH] Magdir/firmware ESP8266/ESP32 and NXP i.MX RT
 firmware images
Message-ID: <284f755a-b0e8-417b-8367-a48cf788bff5@crans.org>

Hello,

I'm back with a few more improvements regarding firmware detection in file.

Attached you may find a patch that:
- fixes a small printing issue on ESP-IDP signature,
- enables file to recognize ESP8266 and ESP32 flash dumps,
- enables file to recognize NXP i.MX RT firmware image dumps.

To test ESP32/NXP images, I highly recommend using MicroPython builds 
(MIT licensed).
These open-source firmware images can be easily downloaded using the 
following script: 
https://github.com/erdnaxe/firmware-samples/blob/main/micropython.sh

Thanks a lot,
Best regards,
-- 
erdnaxe
-------------- next part --------------
A non-text attachment was scrubbed...
Name: esp_nxp.patch
Type: text/x-patch
Size: 3193 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20250406/4c9fedb1/attachment.bin>

From christos at zoulas.com  Sun Apr  6 18:37:52 2025
From: christos at zoulas.com (Christos Zoulas)
Date: Sun, 6 Apr 2025 14:37:52 -0400
Subject: [File] [PATCH] Magdir/firmware ESP8266/ESP32 and NXP i.MX RT
 firmware images
In-Reply-To: <284f755a-b0e8-417b-8367-a48cf788bff5@crans.org>
References: <284f755a-b0e8-417b-8367-a48cf788bff5@crans.org>
Message-ID: <4D8B4A51-B30A-4D8D-935E-46C16588CA32@zoulas.com>

Committed, thanks!

christos

> On Apr 6, 2025, at 1:58?PM, A. IOOSS <erdnaxe at crans.org> wrote:
> 
> Hello,
> 
> I'm back with a few more improvements regarding firmware detection in file.
> 
> Attached you may find a patch that:
> - fixes a small printing issue on ESP-IDP signature,
> - enables file to recognize ESP8266 and ESP32 flash dumps,
> - enables file to recognize NXP i.MX RT firmware image dumps.
> 
> To test ESP32/NXP images, I highly recommend using MicroPython builds (MIT licensed).
> These open-source firmware images can be easily downloaded using the following script: https://github.com/erdnaxe/firmware-samples/blob/main/micropython.sh
> 
> Thanks a lot,
> Best regards,
> -- 
> erdnaxe
> <esp_nxp.patch>-- 
> File mailing list
> File at astron.com
> https://mailman.astron.com/mailman/listinfo/file

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 235 bytes
Desc: Message signed with OpenPGP
URL: <https://mailman.astron.com/pipermail/file/attachments/20250406/2fbb128c/attachment.asc>

From christos at zoulas.com  Sun Apr  6 18:43:31 2025
From: christos at zoulas.com (Christos Zoulas)
Date: Sun, 6 Apr 2025 14:43:31 -0400
Subject: [File] [PATCH] Magdir/linux S390 kernel image; Show version
In-Reply-To: <f8670d62-6218-4b26-8d3b-56a4b23d6495@linux.ibm.com>
References: <20250317135228.1812146-1-jremus@linux.ibm.com>
 <f8670d62-6218-4b26-8d3b-56a4b23d6495@linux.ibm.com>
Message-ID: <B218A05F-0281-49EF-9BB0-6D169B25A7B5@zoulas.com>

Committed, I kept the word "kernel" in the name.

christos

> On Mar 17, 2025, at 12:10?PM, Jens Remus <jremus at linux.ibm.com> wrote:
> 
> On 17.03.2025 14:52, Jens Remus wrote:
>> Linux kernel S390 boot executable images have the magic string "S390EP"
>> at 0x10008 (since v3.2). [1]  The parameter area has a pointer to the
>> kernel version at 0x10428 (since v5.3, which has been 0 since v3.2) [2]
>> Based on Vasily's implementation from his commit message of his Linux
>> kernel commit 6abe28197024 ("s390: enable detection of kernel version
>> from bzImage").
>> While at it update the identifier to "Linux kernel S390 boot executable
>> Image", to align it to the other architectures.
> 
> Marc brought up (offline), that changing the identifier from "Linux
> S390" to "Linux kernel S390 boot executable Image" might break existing
> scripts that grep for "Linux S390".  He suggested that a compromise
> might be to change it to "Linux S390 kernel boot executable Image",
> which only appends to the existing identifier.
> 
>> [1]: Linux kernel, arch/s390/boot/head.S, EP_OFFSET and EP_STRING.
>> [2]: Linux kernel, arch/s390/include/asm/setup.h, struct parmarea,
>>      kernel_version.
>> Co-authored-by: Vasily Gorbik <gor at linux.ibm.com>
>> Signed-off-by: Jens Remus <jremus at linux.ibm.com>
>> ---
>>  magic/Magdir/linux | 9 ++++++++-
>>  1 file changed, 8 insertions(+), 1 deletion(-)
>> diff --git a/magic/Magdir/linux b/magic/Magdir/linux
>> index d2e3aaa1d68c..4afcc0736707 100644
>> --- a/magic/Magdir/linux
>> +++ b/magic/Magdir/linux
>> @@ -456,7 +456,9 @@
>>  ############################################################################
>>  # Linux S390 kernel image
>>  # Created by: Jan Kaluza <jkaluza at redhat.com>
>> -8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux S390
>> +# Update: Jens Remus <jremus at linux.ibm.com> based on Vasily Gorbik <gor at linux.ibm.com>
>> +# Linux kernel: arch/s390/boot/head.S and arch/s390/include/asm/setup.h
>> +8 string \x02\x00\x00\x18\x60\x00\x00\x50\x02\x00\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40\x40\x40\x40\x40 Linux kernel S390 boot executable Image
>>  >0x00010000 search/b/4096 \x00\x0a\x00\x00\x8b\xad\xcc\xcc
>>  # 64bit
>>  >>&0 string \xc1\x00\xef\xe3\xf0\x68\x00\x00 Z10 64bit kernel
>> @@ -468,6 +470,11 @@
>>  >>&0 string \x81\x00\xc8\x80\x00\x00\x00\x00 Z9-109 32bit kernel
>>  >>&0 string \x80\x00\x20\x00\x00\x00\x00\x00 Z990 32bit kernel
>>  >>&0 string \x80\x00\x00\x00\x00\x00\x00\x00 Z900 32bit kernel
>> +# Linux kernel v3.2+
>> +>0x10008		string		S390EP
>> +# Linux kernel v5.3+
>> +>>0x10428		ubequad		>0
>> +>>>(0x10428.Q)		string		>\0	\b, version %s
>>    ############################################################################
>>  # Linux ARM compressed kernel image
> 
> Regards,
> Jens
> -- 
> Jens Remus
> Linux on Z Development (D3303)
> +49-7031-16-1128 Office
> jremus at de.ibm.com <mailto:jremus at de.ibm.com>
> 
> IBM
> 
> IBM Deutschland Research & Development GmbH; Vorsitzender des Aufsichtsrats: Wolfgang Wendt; Gesch?ftsf?hrung: David Faller; Sitz der Gesellschaft: B?blingen; Registergericht: Amtsgericht Stuttgart, HRB 243294
> IBM Data Privacy Statement: https://www.ibm.com/privacy/
> 
> -- 
> File mailing list
> File at astron.com <mailto:File at astron.com>
> https://mailman.astron.com/mailman/listinfo/file

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mailman.astron.com/pipermail/file/attachments/20250406/099ba6c5/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 235 bytes
Desc: Message signed with OpenPGP
URL: <https://mailman.astron.com/pipermail/file/attachments/20250406/099ba6c5/attachment-0001.asc>