[File] [PATCH] filesystems magic: fix exFAT filesystem detection
David Timber
dxdt at dev.snart.me
Tue May 12 19:59:21 EDT 2026
Detection of exFAT volume magic was broken due to the confusion in the
DOS/MBR magic detecion logic caused by the MBR disk signature
magic(AA55) in exFAT volume headers. This patch fixes the issue by
nesting the exFAT volume magic in the existing DOS/MBR chain.
Also, print information on MBR partition table, including:
- Disk signature(aka. "serial")
- Whether it contains a recursive partition
Signed-off-by: David Timber <dxdt at dev.snart.me>
---
magic/Magdir/filesystems | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
diff --git a/magic/Magdir/filesystems b/magic/Magdir/filesystems
index 43528b3a..06f66327 100644
--- a/magic/Magdir/filesystems
+++ b/magic/Magdir/filesystems
@@ -261,18 +261,6 @@
# for sector sizes with 512 or more Bytes
>0x1FE leshort 0xAA55 DOS/MBR boot sector
-# ExFAT
-3 string/w =EXFAT
->0x1FE leshort 0xAA55
->>0x6E ubyte 1
->>>0x6F ubyte 0x80
->>>0 ubyte 0xEB DOS/MBR boot sector,
->>>0x69 ubyte x ExFAT Filesystem version %d.
->>>0x68 ubyte x \b%d
->>>0x6d ubyte x \b, (1<<%d) sectors per cluster
->>>0x48 ulequad x \b, sectors %lld
->>>0x64 ulelong x \b, serial number %#x
-
# keep old DOS/MBR boot sector as dummy for mbr and bootloader displaying
# only for sector sizes with 512 or more Bytes
0x1FE leshort 0xAA55 DOS/MBR boot sector
@@ -1058,6 +1046,20 @@
>>>>>>>466 ubyte 0x0F \b, extended partition table (LBA)
>>>>>>>466 ubyte 0x0 \b, extended partition table (last)
+# exFAT
+# x86 real mode relative jump followed by string "EXFAT "
+>0 string \xEB\x76\x90EXFAT\ \ \ \b, ExFAT Filesystem
+>>0x6E ubyte <3 \b, numer of FATs %d
+>>>0x69 ubyte x \b, revision %d.
+>>>0x68 ubyte x \b%d
+>>>0x6C ubyte x \b, (1<<%d) bytes per sector
+>>>0x6D ubyte x \b, (1<<%d) sectors per cluster
+>>>0x48 ulequad x \b, sectors %lld
+>>>0x64 ulelong x \b, serial number %#x
+# MS Windows compat, SD association SDXC spec part 2
+>>>0x1B8 ulelong >0 \b, with MBR disk signature %#-.4x
+>>>>0x1C6 ulelong 0 \b, recursive partition
+
# DOS x86 sector separated and moved from "DOS/MBR boot sector" by Joerg Jenderek at May 2011
>0x200 lelong 0x82564557 \b, BSD disklabel
--
2.53.0.1.ga224b40d3f.dirty
More information about the File
mailing list