head	1.4;
access;
symbols
	file-4_20:1.3
	rpm-4_4_8-release:1.1.6.1
	rpm-4_4_7-release:1.1.6.1
	rpm-4_4_6-release:1.1.6.1
	rpm-4_4_5-release:1.1.6.1
	rpm-4_4_4-release:1.1.6.1
	rpm-4_4_3-release:1.1.6.1
	file-4_16:1.2
	jbj_before_tklcpatches:1.1
	rpm-4_4_2-release:1.1
	file-4_14:1.1
	pjones-sparse-experiment:1.1.0.8
	rpm-4_4_1-release:1.1
	file-4_12:1.1
	rpm-4_4-release:1.1
	rpm-4_4:1.1.0.6
	file-4_10:1.1
	file-4_09:1.1
	rpm-file-before:1.1
	rpm42-file-before:1.1
	rpm43-file-before:1.1
	rpm-4_3_1-start:1.1
	rpm-4_3:1.1.0.4
	rpm-4_2:1.1.0.2;
locks; strict;
comment	@# @;


1.4
date	2007.05.09.20.00.32;	author jbj;	state Exp;
branches;
next	1.3;

1.3
date	2007.05.09.19.38.34;	author jbj;	state Exp;
branches;
next	1.2;

1.2
date	2005.10.31.19.48.57;	author jbj;	state Exp;
branches;
next	1.1;

1.1
date	2003.04.15.16.58.35;	author jbj;	state Exp;
branches
	1.1.2.1
	1.1.6.1;
next	;

1.1.2.1
date	2003.12.01.21.20.02;	author jbj;	state Exp;
branches;
next	;

1.1.6.1
date	2005.11.01.00.58.40;	author jbj;	state Exp;
branches;
next	1.1.6.2;

1.1.6.2
date	2007.05.10.17.39.22;	author jbj;	state Exp;
branches;
next	;


desc
@@


1.4
log
@Patches from FC7 file-4.20-1.
@
text
@
#------------------------------------------------------------------------------
# fsav:  file(1) magic for datafellows fsav virus definition files
# Anthon van der Neut (anthon@@mnt.org)

# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
0	beshort		0x1575		fsav macro virus signatures
>8	leshort		>0		(%d-
>11	byte		>0		\b%02d-
>10	byte		>0		\b%02d)
# ftp://ftp.f-prot.com/pub/sign.zip
#10	ubyte		<12
#>9	ubyte		<32
#>>8	ubyte		0x0a
#>>>12	ubyte		0x07
#>>>>11	uleshort	>0		fsav DOS/Windows virus signatures (%d-
#>>>>10	byte		0		\b01-
#>>>>10	byte		1		\b02-
#>>>>10	byte		2		\b03-
#>>>>10	byte		3		\b04-
#>>>>10	byte		4		\b05-
#>>>>10	byte		5		\b06-
#>>>>10	byte		6		\b07-
#>>>>10	byte		7		\b08-
#>>>>10	byte		8		\b09-
#>>>>10	byte		9		\b10-
#>>>>10	byte		10		\b11-
#>>>>10	byte		11		\b12-
#>>>>9	ubyte		>0		\b%02d)
# ftp://ftp.f-prot.com/pub/sign2.zip
#0	ubyte		0x62		
#>1	ubyte		0xF5		
#>>2	ubyte		0x1		
#>>>3	ubyte		0x1		
#>>>>4	ubyte		0x0e		
#>>>>>13		ubyte	>0		fsav virus signatures
#>>>>>>11	ubyte	x		size 0x%02x
#>>>>>>12	ubyte	x		\b%02x
#>>>>>>13	ubyte	x		\b%02x bytes

# Joerg Jenderek: joerg dot jenderek at web dot de
# http://www.clamav.net/doc/latest/html/node45.html
# .cvd files start with a 512 bytes colon separated header
# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
# + gzipped tarball files
0	string		ClamAV-VDB:	
>11	string		>\0		Clam AntiVirus database %-.23s
>>34	string		:		
>>>35	regex		[^:]+		\b, version 
>>>>35		string		x 	\b%-.1s
>>>>>36		string 		!:	
>>>>>>36	string		x 	\b%-.1s
>>>>>>>37	string		!:	
>>>>>>>>37	string		x 	\b%-.1s
>>>>>>>>>38	string		!:	
>>>>>>>>>>38	string		x 	\b%-.1s
>512	string		\037\213	\b, gzipped
>769	string		ustar\0		\b, tared
@


1.3
log
@Virgin file-4.20.
@
text
@a56 2
>>>>512	string		\037\213	\b, gzipped
>>>>769	string		ustar\0		\b, tared
@


1.2
log
@Update to virgin file-4.16.
@
text
@d40 21
@


1.1
log
@Move magic creation to sub-directory.
@
text
@d5 3
a7 1
0	beshort		0x1575		fsav (linux) macro virus
d11 29
a39 19

# comment this out for now because it regognizes every file where
# the eighth character is \n
#8	byte		0x0a
#>12	byte		0x07
#>11	leshort		>0		fsav (linux) virus (%d-
#>10	byte		0		\b01-
#>10	byte		1		\b02-
#>10	byte		2		\b03-
#>10	byte		3		\b04-
#>10	byte		4		\b05-
#>10	byte		5		\b06-
#>10	byte		6		\b07-
#>10	byte		7		\b08-
#>10	byte		8		\b08-
#>10	byte		9		\b10-
#>10	byte		10		\b11-
#>10	byte		11		\b12-
#>9	byte		>0		\b%02d)
@


1.1.6.1
log
@- update to file-4.16 internal.
@
text
@d5 1
a5 3

# ftp://ftp.f-prot.com/pub/{macrdef2.zip,nomacro.def}
0	beshort		0x1575		fsav macro virus signatures
d9 19
a27 29
# ftp://ftp.f-prot.com/pub/sign.zip
#10	ubyte		<12
#>9	ubyte		<32
#>>8	ubyte		0x0a
#>>>12	ubyte		0x07
#>>>>11	uleshort	>0		fsav DOS/Windows virus signatures (%d-
#>>>>10	byte		0		\b01-
#>>>>10	byte		1		\b02-
#>>>>10	byte		2		\b03-
#>>>>10	byte		3		\b04-
#>>>>10	byte		4		\b05-
#>>>>10	byte		5		\b06-
#>>>>10	byte		6		\b07-
#>>>>10	byte		7		\b08-
#>>>>10	byte		8		\b09-
#>>>>10	byte		9		\b10-
#>>>>10	byte		10		\b11-
#>>>>10	byte		11		\b12-
#>>>>9	ubyte		>0		\b%02d)
# ftp://ftp.f-prot.com/pub/sign2.zip
#0	ubyte		0x62		
#>1	ubyte		0xF5		
#>>2	ubyte		0x1		
#>>>3	ubyte		0x1		
#>>>>4	ubyte		0x0e		
#>>>>>13		ubyte	>0		fsav virus signatures
#>>>>>>11	ubyte	x		size 0x%02x
#>>>>>>12	ubyte	x		\b%02x
#>>>>>>13	ubyte	x		\b%02x bytes
@


1.1.6.2
log
@Upgrade to file-4.20 internal.
@
text
@a39 19

# Joerg Jenderek: joerg dot jenderek at web dot de
# http://www.clamav.net/doc/latest/html/node45.html
# .cvd files start with a 512 bytes colon separated header
# ClamAV-VDB:buildDate:version:signaturesNumbers:functionalityLevelRequired:MD5:Signature:builder:buildTime
# + gzipped tarball files
0	string		ClamAV-VDB:	
>11	string		>\0		Clam AntiVirus database %-.23s
>>34	string		:		
>>>35	regex		[^:]+		\b, version 
>>>>35		string		x 	\b%-.1s
>>>>>36		string 		!:	
>>>>>>36	string		x 	\b%-.1s
>>>>>>>37	string		!:	
>>>>>>>>37	string		x 	\b%-.1s
>>>>>>>>>38	string		!:	
>>>>>>>>>>38	string		x 	\b%-.1s
>512	string		\037\213	\b, gzipped
>769	string		ustar\0		\b, tared
@


1.1.2.1
log
@Merge from top-of-stack.
@
text
@@

