How do you write a magic file test pattern to fit the end of the file?

Question

I am starting to wonder if this is possible, since multiple searches on SO, Google, Bing and linuxquestions.org do not cause anything.

I am interested in expanding the magic patterns located in /usr/share/magic (used by the file(1) utility) to recognize files based on data at or near the end of the file. I was able to do this for the beginning of the file, as well as for arbitrary offsets to the file from the very beginning.

The personal page illustrates very well some standard use cases; Unfortunately, there seems to be a way to index from the end, not the beginning. The only workaround I could come up with was to accept a script using tac and / or lreverse , but consider this to be binary-unfriendly.

In addition, I wanted to avoid any other script processing - I feel that this should be doable with the correct file magic. Any ideas?

Answer 1

It's impossible. file(1) designed to work with pipes. You cannot use lseek(2) on pipes to get to the end of the file. Reading the entire file to the end will be very slow (and file(1) tries to be fast), and if it really reads from the pipe, it may never collide with the end of the file, which will be even worse.

In terms of documentation, in the case of open source software, the source code itself is the final documentation. If you are stuck in such a case, it is always a good idea. The file_or_fd() function in src/magic.c gives the key. Use Source, Luke !; -)

In your particular case, I would look a second time at the specified file format, and if it really cannot be analyzed using file(1) , then a short Perl or Python script trick should do the trick. Good luck