# Sophos WSA mime magic

# Microsoft Office documents
0       string          \376\067\0\043                  application/x-msoffice-doc
0       string          \333\245-\0\0\0                 application/x-msoffice-doc
0       string          \320\317\021\340\241\261        application/x-msoffice-doc

# Rich Text Format (rtf)
0	string		{\\rtf		text/rtf

# PDF
0       string          %PDF-           application/x-pdf

# Word Perfect
1       string          WPC             application/vnd.wordperfect

# MIDI audio files
0	string	MThd			audio/midi

#SketchUp Files: This has to happen before audio/mpeg because they start with the same bytes
0       beshort         0xfffe
>2      beshort         0xff0e
>>4     beshort         0x5300
>>>6    beshort         0x6b00
>>>>8   beshort         0x6500          application/x-skp

#Unicode UTF-16.  BOM = 0xfeff, written in big- or little-endian
#little-endian:
0	leshort		0xfeff
>2	byte		>0
>>3	byte		0
>>>4	byte		>0
>>>>5	byte		0		text/plain; charset=utf-16-le
# UTF-16-LE can get confused with audio/mpeg frame header:
>0      beshort&0xfff0  0xfff0          audio/mpeg

#big-endian:
0	beshort		0xfeff		
>2	byte		0
>>3	byte		>0
>>>4	byte		0	
>>>>5	byte		>0		text/plain; charset=utf-16-be
#end vs20061101

# Audio MPEG
0       byte           0xff          
# DOS device drivers look like MP3s, but not quite:
>1      belong&0xffffff00 0xffffff00 application/x-executable-file
>1      byte&0xf0      0xf0          audio/mpeg
0       string          ICY             audio/mpeg
0       belong          0x49443303      audio/x-mp3

# vs20061101
# RIFF container types
0	string		RIFF
# .wav files
>8	string		WAVE            audio/x-wav
>8	string		WAV\            audio/x-wav
# Animated Icon
>8 	string		ACON		image/x-ani
# AVI container
>8      string          AVI\            video/x-msvideo
# end vs20061101

# Real Networks Audio
0	string		.ra\375		audio/x-realaudio
0	belong		0x2e7261fd	audio/x-realaudio

# Windows WMA
0       belong          0x3026B275      audio/x-ms-wma

# Video MPEG
0	belong		0x000001b3		video/mpeg
0	belong		0x000001ba		video/mpeg
64	belong		0x000001b3		video/mpeg
64	belong		0x000001ba		video/mpeg


# Quicktime/Apple Formats
4	string		moov		video/quicktime
4	string		mdat		video/quicktime
4       string		ftyp
>8	string		qt\ \ 	        video/quicktime
>8      string          mp4             video/mpeg
>8      string          M4V             video/mpeg
>8      string          isom            video/mpeg
>8      string          avc1            video/x-flv

# Video WebM
0       belong          0x1a45dfa3
>31     string          webm            video/webm

# Windows WMV
# no unique signature, recognized as audio/x-ms-wma

# Real Networks Video
0       string          .RMF            video/vnd.rn-realvideo

# Windows Media Stream
12      string          playlist-gen-id application/x-mms-framed
2092    string          playlist-gen-id application/x-mms-framed

# Ogg Vorbis
0       string          OggS            audio/mpeg

# Executables
128	string		PE\0\0	application/x-ms-dos-executable
0	leshort         0x5DE9	application/x-ms-dos-executable
0	string		MZ	application/x-ms-dos-executable
0	string		LZ	application/x-ms-dos-executable

# JAVA
0       string          \312\376\272\276\000    application/x-java-class

# MAR - Firefox update files
0       string          MAR1            application/mar

# ZIP
0	string		PK\003\004	application/zip

# JAVA JAR
# no unique signature, recognized as application/zip

# TAR
257	string		ustar\0		application/x-tar
257	string		ustar\040\040\0	application/x-gtar

# StuffIt
0       string          StuffIt         application/x-stuffit
0       string          SIT!            application/x-stuffit

# RAR
0	string		Rar!		application/x-rar

# UNIX Archives
0	string		\037\235	application/compress
0	string		\037\213	application/x-gzip
0	string		BZh		application/x-bzip2
2       beshort         0xeedb          application/x-rpm-file

# Microsoft Cabinet files
0	string		MSCF\0\0\0\0	application/cab

# InstallShield Cabinet files
0	string		ISc(		application/cab
    
# HTML
0	string		\<!DOCTYPE\ HTML	text/html
0	string		\<!doctype\ HTML	text/html
0	string		\<!doctype\ html	text/html
0	string		\<!DOCTYPE\ html	text/html
0	string		\<HEAD		        text/html
0	string		\<head		        text/html
0	string		\<TITLE		        text/html
0	string		\<title		        text/html
0	string		\<html		        text/html
0	string		\<HTML		        text/html

# Images
0	long	04553207		image/x11
0	string		IIN1		image/tiff
0	string		MM\x00\x2a	image/tiff
0	string		II\x2a\x00	image/tiff
0	string		\x89PNG		image/png
1	string		PNG		image/png
0	string		GIF8		image/gif
0	beshort		0xffd8		image/jpeg
0	string		hsi1		image/x-jpeg-proprietary
0	string		BM		image/x-bmp

# Flash animation and video files
0       string          FWS             image/vnd.rn-realflash
0       string          CWS             image/vnd.rn-realflash
0       string          FLV\x01         video/x-flv

# Executable Files (mostly unknown origin, lifted from Ubuntu's MIME mapper)
0     short           0420            application/x-executable-file
0     short           0421            application/x-executable-file
0     leshort         0603            application/x-executable-file
0     string          Core\001        application/x-executable-file
0     belong          0x000003f3      application/x-executable-file
0     beshort         0560            application/x-executable-file
0     beshort         0561            application/x-executable-file
0     short           03401           application/x-executable-file
0     long            0406            application/x-executable-file
0     short           0406            application/x-executable-file
0     short           03001           application/x-executable-file
0     lelong                  000000314       application/x-executable-file
0     short           0575            application/x-executable-file
0     short           0577            application/x-executable-file
0     belong  0513    application/x-executable-file
0     belong  0515    application/x-executable-file
0     belong  0517    application/x-executable-file
0     leshort         0x183           application/x-executable-file
0     leshort         0x188   application/x-executable-file
0     string          \177ELF         application/x-executable-file
0     short           0x155           application/x-executable-file
0     lelong&0377777777       041400407       application/x-executable-file
0     lelong&0377777777       041400410       application/x-executable-file
0     lelong&0377777777       041400413       application/x-executable-file
0     lelong&0377777777       041400314       application/x-executable-file
0     beshort         0627            application/x-executable-file
0     beshort         0624            application/x-executable-file
0     belong          0x02100107      application/x-executable-file
0     belong          0x02100108      application/x-executable-file
0     belong          0x0210010b      application/x-executable-file
0       belong                0x02140107      application/x-executable-file
0       belong                0x02140108      application/x-executable-file
0       belong                0x0214010b      application/x-executable-file
0     belong          0x020b0107      application/x-executable-file
0     belong          0x020b0108      application/x-executable-file
0     belong          0x020b010b      application/x-executable-file
0     long            0x02080106      application/x-executable-file
0     long            0x02080107      application/x-executable-file
0     long            0x02080108      application/x-executable-file
0     belong          0x020c0108      application/x-executable-file
0     belong          0x020c0107      application/x-executable-file
0     belong          0x020c010b      application/x-executable-file
0     belong          0x020c0106      application/x-executable-file
0     belong          0x020a0108      application/x-executable-file
0     belong          0x020a0107      application/x-executable-file
0     leshort         0510            application/x-executable-file
0     leshort         0511            application/x-executable-file
0     leshort         =0512           application/x-executable-file
0     leshort         =0522           application/x-executable-file
0     leshort         =0514           application/x-executable-file