zoo magic

[Thaddeus P. Floryan]

In article <378 at unx-pc.UUCP> steve at unx-pc.UUCP (Stephen Hess) writes:
>[...]
>Here is a line to add to /etc/magic so that when you type file *
>it identifies those zoo files.
>
>20 	long 	0xdcatc4fd	zoo archive
>[...]
                     ^
                     |
(BTW, should be a   "7"  here instead of the "t")

Another (more obvious? :-) way to determine an archive's ZOO-ness is based on
the fact the first 16 bytes in a ZOO archive will be a string of the form:

	"ZOO d.dd Archive"

where each "d" corresponds to a decimal digit of the creating ZOO's version
number (i.e. "1.50", "2.00", "2.01", etc.) which suggests the following
magic entry may be more useful:

	0       string          ZOO             %s
	>4      string          1               V1
	>4      string          2               V2
	>9      string          Archive         %s

per:

	thadlabs ksh 13827/14006> file *
	zoo1v50.zoo:	ZOO V1 Archive 
	zoo2v00.zoo:	ZOO V2 Archive 
	thadlabs ksh 13827/14006> 

It appears the string comparison performed by file(1) uses strncmp(3C) so any
attempt to extract out the other digits of the version is tedious, besides
which a "bug" (or at least an idiosyncracy) causes a space to be output after
every displayed string which would cause, for example, "1 . 5 0" to be shown
as the version number if one attempted to match digit positions explicitly
using something like the following in the /etc/magic entry:

	>6	string		0	%s
	>6	string		1	%s
[...]
	>6	string		8	%s
	>6	string		9	%s
	>7	string		0	%s
	>7	string		1	%s
[...]
	>7	string		8	%s
	>7	string		9	%s

BTW, here's another entry that you may find useful in the event a compressed
file copied from another system loses its ".Z" due to SysV 14-char filename
limits:

	0	short		&0xFFFF 0x1F9D	compressed file
	>2	short		&0x8000 0x8000	block compressed
	>2	short		&0x1F00 0x0C00	12 bit LZW
	>2	short		&0x1F00 0x0D00	13 bit LZW
	>2	short		&0x1F00 0x0E00	14 bit LZW
	>2	short		&0x1F00 0x0F00	15 bit LZW
	>2	short		&0x1F00 0x1000	16 bit LZW


Thad Floryan [ thad at btr.com (OR) {decwrl, mips, fernwood}!btr!thad ]