>Number:         1719
>Category:       bin
>Synopsis:       add FreeBSD executables to /etc/magic
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Fri Nov  3 02:35:01 1995
>Last-Modified:
>Originator:     Tom Pavel
>Organization:
>Release:        NetBSD-current(1.1_Alpha) Oct 27 1995
>Environment:
System: NetBSD bozon 1.1_ALPHA NetBSD 1.1_ALPHA (BOZON) #54: Wed Oct 25 23:16:38 PDT 1995 tom@bozon:/usr/src/sys/arch/i386/compile/BOZON i386


>Description:
	Now that we have COMPAT_FREEBSD, we ought to be able to
	recognize their exectutables...

>How-To-Repeat:

>Fix:
	Here is the file /usr/src/usr.bin/file/magdir/freebsd that I
	grabbed from FreeBSD-current.  I commented out some things
	that I thought were dicey (but I left the little-endian
	NMAGIC, because they currently say "PDP-11 pure executable).
	People more expert may have better opinions...  In any event,
	we ought to be able to recognize the standard FreeBSD
	exectutables, which are just little-endian QMAGIC a.out
	format with a machine id.
-------------------------
# the following are for 386BSD/FreeBSD

0	lelong			0410		pure executable
#0	lelong			0413		demand paged executable
0	lelong&077777777	041400314	FreeBSD/i386 demand paged
>Audit-Trail:
>Unformatted:
>3	byte			&0x80
>>20	lelong			<4096		shared library
>>20	lelong			=4096		dynamically linked executable
>>20	lelong			>4096		dynamically linked executable
>3	byte			^0x80		executable
>16	lelong			>0		not stripped

# This covers object files, and is better than "PDP-11 executable"
#0	lelong			000000407	impure format
#>16	lelong			>0		not stripped

# XXX gross hack to identify core files
# cores start with a struct tss; we take advantage of the following:
# byte 7:     highest byte of the kernel stack pointer, always 0xfe
#      8/9:   kernel (ring 0) ss value, always 0x0010
#      10 - 27: ring 1 and 2 ss/esp, unused, thus always 0
#      28:    low order byte of the current PTD entry, always 0 since the
#             PTD is page-aligned
#
#7	string	\357\020\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0	i386 a.out core file
#>1047	string	>\0	from "%s"
-------------------------


Tom Pavel

Stanford Linear Accelerator Center
pavel@slac.stanford.edu