#------------------------------------------------------------------------------ # $File: fonts,v 1.52 2024/11/09 23:52:53 christos Exp $ # fonts: file(1) magic for font data # 0 search/1 FONT ASCII vfont text 0 short 0436 Berkeley vfont data 0 short 017001 byte-swapped Berkeley vfont data # PostScript fonts (must precede "printer" entries), quinlan@yggdrasil.com # Modified by: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/PostScript_fonts # http://fileformats.archiveteam.org/wiki/Adobe_Type_1 # Reference: http://mark0.net/download/triddefs_xml.7z # defs/p/pfb.trid.xml # Note: PFB stands for Printer Font Binary 0 string %!PS-AdobeFont-1. PostScript Type 1 font text #!:mime font/x-postscript-pfb #!:ext pfb >20 string >\0 (%s) # http://www.nationalarchives.gov.uk/pronom/fmt/525 6 string %!PS-AdobeFont-1. # skip DROID fmt-525-signature-id-816.pfb by checking for content after header >24 ubyte x PostScript Type 1 font program data #!:mime application/octet-stream !:mime font/x-postscript-pfb !:ext pfb # often followed by colon (3Ah) and space (20h) and font name like: DarkGardenMK LetterGothic >>24 ubyte =0x3A >>>26 string >\0 (%s) # some times instead of colon %%CreationDate: and "font name" later >>24 ubyte !0x3A # font name directive followed by def like: c0633bt_.pfb >>>25 search/1247 /FontName\040/ # show font name in parentheses like: Frankfurt Lithos CharterBT-BoldItalic Courier10PitchBT-Bold >>>>&0 regex [A-Za-z0-9-]+ (%s) # http://cd.textfiles.com/maxfonts/ATM/M/MIRROR__.PFB 6 string %PS-AdobeFont-1. PostScript Type 1 font program data !:mime font/x-postscript-pfb !:ext pfb # font name like: Times-Mirror >25 string >\0 (%s) 0 string %!FontType1 PostScript Type 1 font program data #!:mime font/x-postscript-pfb #!:ext pfb 6 string %!FontType1 PostScript Type 1 font program data #!:mime application/octet-stream !:mime font/x-postscript-pfb !:ext pfb # font name like: CaslonOpenFace FetteFraktur Kaufmann Linotext MesozoicGothic Old-Town >23 string >\0 (%s) # http://cd.textfiles.com/maxfonts/ATM/P/PLAYBI.PFB 230 string %!FontType1 PostScript Type 1 font program data !:mime font/x-postscript-pfb !:ext pfb # font name like: Playbill >247 string >\0 (%s) 0 string %!PS-Adobe-3.0\ Resource-Font PostScript Type 1 font text #!:mime font/x-postscript-pfb #!:ext pfb # Summary: PostScript Type 1 Printer Font Metrics # URL: https://en.wikipedia.org/wiki/PostScript_fonts # Reference: https://partners.adobe.com/public/developer/en/font/5178.PFM.pdf # Modified by: Joerg Jenderek # Note: moved from ./msdos magic # dfVersion 256=0100h 0 uleshort 0x0100 # GRR: line above is too general as it catches also TrueType font, # raw G3 data FAX, WhatsApp encrypted and Panorama database # dfType 129=0081h >66 uleshort 0x0081 # dfVertRes 300=012Ch not needed as additional test #>>70 uleshort 0x012c # dfHorizRes 300=012Ch #>>>72 uleshort 0x012c # dfDriverInfo points to postscript information section >>(101.l) string/c Postscript Printer Font Metrics # above labeled "PFM data" by ./msdos (version 5.28) or "Adobe Printer Font Metrics" by TrID !:mime application/x-font-pfm # AppleShare Print Server #!:apple ASPS???? !:ext pfm # dfCopyright 60 byte null padded Copyright string. uncomment it to get old looking #>>>6 string >\060 - %-.60s # dfDriverInfo >>>139 ulelong >0 # often abbreviated and same as filename >>>>(139.l) string x %s # dfSize >>>2 ulelong x \b, %d bytes # dfFace 210=D2h 9Eh >>>105 ulelong >0 # Windows font name >>>>(105.l) string x \b, %s # dfItalic >>>80 ubyte 1 italic # dfUnderline >>>81 ubyte 1 underline # dfStrikeOut >>>82 ubyte 1 strikeout # dfWeight 400=0x0190 300=0x012c 500=0x01f4 600=0x0258 700=0x02bc >>>83 uleshort >699 bold # dfPitchAndFamily 16 17 48 49 64 65 >>>90 ubyte 16 serif >>>90 ubyte 17 serif proportional #>>>90 ubyte 48 other >>>90 ubyte 49 proportional >>>90 ubyte 64 script >>>90 ubyte 65 script proportional # X11 font files in SNF (Server Natural Format) format # updated by Joerg Jenderek at Feb 2013 and Nov 2021 # http://computer-programming-forum.com/51-perl/8f22fb96d2e34bab.htm # URL: http://fileformats.archiveteam.org/wiki/SNF # Reference: https://cgit.freedesktop.org/xorg/lib/libXfont/tree/src/bitmap/snfstr.h 0 belong 00000004 # version2 same as version1 in struct _snfFontInfo >104 belong 00000004 X11 SNF font data, MSB first # GRR: line above is too general as it catches also DEGAS low-res bitmap like: # http://cd.textfiles.com/geminiatari/FILES/GRAPHICS/ANIMAT/SPID_PAT/BIGSPID.PI1 !:mime application/x-font-sfn !:ext snf # GRR: line below is too general as it catches also Xbase index file t3-CHAR.NDX 0 lelong 00000004 >104 lelong 00000004 X11 SNF font data, LSB first !:mime application/x-font-sfn # Reference: http://mark0.net/download/triddefs_xml.7z/defs/s/snf-x11-lsb.trid.xml !:ext snf # X11 Bitmap Distribution Format, from Daniel Quinlan (quinlan@yggdrasil.com) 0 search/1 STARTFONT\ X11 BDF font text # From: Joerg Jenderek # URL: https://grub.gibibit.com/New_font_format # Reference: util/grub-mkfont.c # include/grub/fontformat.h # FONT_FORMAT_SECTION_NAMES_FILE 0 string FILE # FONT_FORMAT_PFF2_MAGIC >8 string PFF2 # leng 4 only at the moment >>4 ubelong 4 # FONT_FORMAT_SECTION_NAMES_FONT_NAME >>>12 string NAME GRUB2 font !:mime application/x-font-pf2 !:ext pf2 # length of font_name >>>>16 ubelong >0 # font_name >>>>>20 string >\0 "%-s" # X11 fonts, from Daniel Quinlan (quinlan@yggdrasil.com) # PCF must come before SGI additions ("MIPSEL MIPS-II COFF" collides) 0 string \001fcp X11 Portable Compiled Font data, >12 lelong ^0x08 bit: LSB, >12 lelong &0x08 bit: MSB, >12 lelong ^0x04 byte: LSB first >12 lelong &0x04 byte: MSB first 0 string D1.0\015 X11 Speedo font data #------------------------------------------------------------------------------ # FIGlet fonts and controlfiles # From figmagic supplied with Figlet version 2.2 # "David E. O'Brien" 0 string flf FIGlet font >3 string >2a version %-2.2s 0 string flc FIGlet controlfile >3 string >2a version %-2.2s # libGrx graphics lib fonts, from Albert Cahalan (acahalan@cs.uml.edu) # Used with djgpp (DOS Gnu C++), sometimes Linux or Turbo C++ 0 belong 0x14025919 libGrx font data, >8 leshort x %dx >10 leshort x \b%d >40 string x %s # Misc. DOS VGA fonts, from Albert Cahalan (acahalan@cs.uml.edu) # Update: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/CPI # Reference: http://www.delorie.com/djgpp/doc/rbinter/it/58/17.html 0 belong 0xff464f4e DOS code page font data collection !:mime font/x-dos-cpi !:ext cpi 0 string \x7fDRFONT DR-DOS code page font data collection !:mime font/x-drdos-cpi !:ext cpi 7 belong 0x00454741 DOS code page font data 7 belong 0x00564944 DOS code page font data (from Linux?) 4098 string DOSFONT DOSFONT2 encrypted font data # From: Joerg Jenderek # URL: http://fileformats.archiveteam.org/wiki/GEM_bitmap_font # Reference: http://cd.textfiles.com/ataricompendium/BOOK/HTML/APPENDC.HTM#cnt # # usual case with lightening mask and skewing mask 5555h~UU #62 ulelong 0x55555555 # skip cl8m8ocofedso.testfile by looking for face size lower/equal 72 #>2 uleshort <73 #>>0 use gdos-font # BOX18.GFT COWBOY30.GFT ROYALK30.GFT #62 ulelong 0 # skip ISO 9660 CD-ROM ./filesystem by looking for low positive face size #>2 uleshort >2 # skip DOS 2.0 backup id file ./msdos by looking for face size lower/equal 72 #>>2 uleshort <73 # skip MS oem.hlp, some Windows ICO ./msdos by looking for valid long name like WYE #>>>4 ulelong >0x001F1f1F # skip Microsoft WinWord 2.0 ./msdos by looking for positive offset to font data #>>>>76 ulelong >83 #>>>>>0 use gdos-font 0 name gdos-font >0 uleshort x GEM GDOS font !:mime application/x-font-gdos # also .eps found like AA070GEP.EPS AI360GEP.EPS !:ext fnt/gtf # font name like Big&Tall, Celtic #s, Courier, University Bold, WYE >4 string x %.32s # face size in points 3-72 SLSS03CG.FNT H1CELT72.FNT >2 uleshort x %u # face ID (must be unique) >0 uleshort x \b, ID %#4.4x # lowest character index in face (4 but usually 32 for disk-loaded fonts) #>36 uleshort !32 \b, unusual character index %u # width of the widest character like 0 8 10 12 16 24 32 #>50 uleshort x \b, %u char width # width of the widest character cell like 8 11 12 14 15 16 33 67 #>52 uleshort x \b, %u cell width # thickening size in pixel like 0 1 2 3 4 5 6 7 8 #>58 uleshort x \b, %u thick # lightening mask to eliminate pixels, usually 5555h >62 uleshort !0x5555 \b, lightening mask %#x # skewing mask to determine when to perform additional rotation when skewing, usually 5555h >64 uleshort !0x5555 \b, skewing mask %#x # offset to optional horizontal offset table 0 58h~88 5eh 252h #>68 ulelong x \b, %#x horizontal table offset # offset of character offset table 54h for many *.GFT 55h 58h 5Eh 120h 1D4h 202h 220h #>72 ulelong x \b, %#x coffset # offset to font data like 116h 118h 158 20Ah 20Eh >76 ulelong x \b, %#x foffset # form width in bytes like 58 67 156 190 227 317 345 #>80 uleshort x \b, %u fwidth # form height in bytes like 4 8 11 17 26 56 70 90 120 146 150 #>82 uleshort x \b, %u fheight # pointer to the next font like 0 10000h 20000h 30000h 40000h 60000h 80000h E0000h D0000h #>84 ulelong x \b, %#x noffset # downloadable fonts for browser (prints type) anthon@mnt.org # https://tools.ietf.org/html/rfc3073 0 string PFR1 Portable Font Resource font data (new) >102 string >0 \b: %s 0 string PFR0 Portable Font Resource font data (old) >4 beshort >0 version %d # True Type fonts # Modified by: Joerg Jenderek # URL: https://en.wikipedia.org/wiki/TrueType # Reference: https://developer.apple.com/fonts/TrueType-Reference-Manual/ # # sfnt version "typ1" used by some Apple, but no example found 0 string typ1 >0 use sfnt-font >0 use sfnt-names # sfnt version "true" used by some Apple 0 string true >0 use sfnt-font >0 use sfnt-names # GRR: below test is too general # sfnt version often 0x00010000 0 string \000\001\000\000 >0 use sfnt-font >0 use sfnt-names # validate and display sfnt font data like number of tables 0 name sfnt-font # file 5.30 version assumes 00FFh as maximal number of tables #>4 ubeshort <0x0100 # maximal 27 tables found like in Skia.ttf # 46 different table names mentioned on Apple specification # skip 1st sequence of DOS 2 backup with path separator (\~92 or /~47) misinterpreted as table number >4 ubeshort <47 # skip bad examples with garbage table names like in a5.show HYPERC MAC # tag names consist of up to four characters padded with spaces at end like # BASE DSIG OS/2 Zapf acnt glyf cvt vmtx xref ... >>12 regex/4l \^[A-Za-z][A-Za-z][A-Za-z/][A-Za-z2\ ] #>>>0 ubelong x \b, sfnt version %#x >>>0 ubelong !0x4f54544f TrueType !:mime font/sfnt !:apple ????tfil # .ttf for TrueType font # EUDC.tte created by privat character editor %WINDIR%\system32\eudcedit.exe !:ext ttf/tte # sfnt version 4F54544Fh~OTTO >>>0 ubelong =0x4f54544f OpenType !:mime font/otf !:apple ????OTTO !:ext otf >>>0 ubelong x Font data # DSIG=44454947h table name implies a digitally signed font # search range = number of tables * 16 =< maximal number of tables * 16 = 27 * 16 = 432 >>>12 search/432 DSIG \b, digitally signed >>>4 ubeshort x \b, %d tables # minimal 9 tables found like in NISC18030.ttf #>>>4 ubeshort <10 TMIN #>>>4 ubeshort >24 TBIG # table directory entries >>>12 string x \b, 1st "%4.4s" # search and display 1st name in sfnt font which is often copyright text # does not work inside font collections 0 name sfnt-names # search for naming table >12 search/432/s name # biggest offset 0x0100bd28 like Windows10 Fonts\simsunb.ttf #>>>>&8 ubelong >0x0100bd27 BIGGEST OFFSET >>&8 ubelong >0x00100000 # offset of name table >>>&-4 ubelong x \b, name offset %#x # GRR: pointer to name table only works if offset ~< FILE_BYTES_MAX = 100000h defined in src\file.h >>&8 ubelong <0x00100000 >>>&-16 ubelong x # name table >>>>(&8.L) ubequad x # invalid format selector #>>>>>&-8 ubeshort !0 \b, invalid selector %x # minimal 3 name records found like in c:\Program Files (x86)\Tesseract-OCR\tessdata\pdf.ttf # maximal 1227 name records found like in Apple Chancery.ttf #>>>>>&-6 ubeshort <0x4 mincount #>>>>>&-6 ubeshort >130 maxcount >>>>>&-6 ubeshort x \b, %d names # offset to start of string storage from start of table #>>>>>&-4 ubeshort x \b, record offset %d # 1st name record # string offset from start of storage area #>>>>>&8 ubeshort x \b, string offset %d # string length #>>>>>&6 ubeshort x \b, string length %d # minimal name string 7 like in c:\Program Files (x86)\Kodi\addons\webinterface.default\lib\video-js\font\VideoJS.ttf # also found 0 like in SWZCONLN.TTF #>>>>>&6 ubeshort <8 MIN STRING # maximal name string 806 like in c:\Windows\Fonts\palabi.ttf #>>>>>&6 ubeshort >805 MAX STRING # platform identifier: 0~Apple Unicode, 1~Macintosh, 3~Microsoft #>>>>>&-2 ubeshort >3 BAD PLATFORM >>>>>&-2 ubeshort 0 \b, Unicode >>>>>&-2 ubeshort 1 \b, Macintosh >>>>>&-2 ubeshort 3 \b, Microsoft # languageID (0~english Macintosh, 0409h~english Microsoft, ...) >>>>>&2 ubeshort >0 \b, language %#x # name identifiers # often 0~copyright, 1~font, 2~font subfamily, 5~version, 13~license, 19~sample, ... >>>>>&4 ubeshort >0 \b, type %d string # platform specific encoding: # 0~undefined character set, 1~UGL set with Unicode, 3~Unicode 2.0 BMP only, 4~Unicode 2.0 #>>>>>&0 ubeshort x \b, %d encoding >>>>>&0 ubeshort 0 # handle only name string offset 0 because do not know how to add 2 relative offsets >>>>>>&6 ubeshort 0 >>>>>>>&(&-14.S-18) ubyte !0 # GRR: instead 806 only first MAXstring = 96 characters are displayed as defined in src\file.h # often copyright string that starts like \251 2006 The Monotype Corporation >>>>>>>>&-1 string x \b, %-11.96s # test for unicode string >>>>>>>&(&-14.S-18) ubyte 0 >>>>>>>>&0 lestring16 x \b, %-11.96s # unicode encoding >>>>>&0 ubeshort >0 >>>>>>&6 ubeshort 0 >>>>>>>&(&-14.S-17) lestring16 x \b, %-11.96s 0 string \007\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font 0 string \012\001\001\000Copyright\ (c)\ 199 Adobe Multiple Master font # TrueType/OpenType font collections (.ttc) # URL: https://en.wikipedia.org/wiki/OpenType # https://www.microsoft.com/typography/otspec/otff.htm # Modified by: Joerg Jenderek # Note: container for TrueType, OpenType font 0 string ttcf # skip ASCII text >4 ubyte 0 # sfnt version often 0x00010000 of 1st table is TrueType >>(12.L) ubelong !0x4f54544f TrueType !:mime font/ttf !:apple ????tfil !:ext ttc # sfnt version 4F54544Fh~OTTO of 1st table is OpenType font >>(12.L) ubelong =0x4f54544f OpenType !:mime font/otf !:apple ????OTTO # no example found for otc !:ext ttc/otc >>4 ubyte x font collection data #!:mime font/collection # TCC version >>4 belong 0x00010000 \b, 1.0 >>4 belong 0x00020000 \b, 2.0 >>8 ubelong >0 \b, %d fonts # array offset size = fonts * offsetsize = fonts * 4 >>(8.L*4) ubequad x # 0x44454947 = 'DSIG' >>>&4 belong 0x44534947 \b, digitally signed # offset to 1st font >>12 ubelong x \b, at %#x # point to 1st font that starts with sfnt version >>(12.L) use sfnt-font # Opentype font data from Avi Bercovich 0 string OTTO OpenType font data !:mime application/vnd.ms-opentype # From: Alex Myczko 0 string SplineFontDB: Spline Font Database !:mime application/vnd.font-fontforge-sfd >14 string x version %s # EOT 0x40 string \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 >0x22 string LP Embedded OpenType (EOT) # workaround until there's lepstring16 # >>0x52 lepstring16/h >\0 \b, %s family >>0x52 short !0 >>>0x54 lestring16 x \b, %s family !:mime application/vnd.ms-fontobject # Web Open Font Format (.woff) 0 name woff >4 belong 0x00010000 \b, TrueType >4 belong 0x4F54544F \b, CFF >4 belong 0x74727565 \b, TrueType >4 default x >>4 belong x \b, flavor %d >8 belong x \b, length %d #>12 beshort x \b, numTables %d #>14 beshort x \b, reserved %d #>16 belong x \b, totalSfntSize %d # https://www.w3.org/TR/WOFF/ 0 string wOFF Web Open Font Format !:mime font/woff >0 use woff >20 beshort x \b, version %d >22 beshort x \b.%d # https://www.w3.org/TR/WOFF2/ 0 string wOF2 Web Open Font Format (Version 2) !:mime font/woff2 !:ext woff2 >0 use woff #>20 belong x \b, totalCompressedSize %d >24 beshort x \b, version %d >26 beshort x \b.%d ### fontconfig cache files # fontconfig cache files: little-endian 0 name fc-cache-le # size is at offset 8, and is intptr_t # hence, if offset 12 is zero, this is likely 64-bit # NOTE: cannot determine double alignment here >12 ulelong 0 le64 >12 ulelong !0 le32 # version number >4 lelong x \b-%d # fontconfig cache files: big-endian 0 name fc-cache-be # size is at offset 8, and is intptr_t # hence, if offset 12 is zero, this is likely 64-bit # NOTE: cannot determine double alignment here >12 ubelong 0 be64 >12 ubelong !0 be32 # version number >4 belong x \b-%d # fontconfig cache files # https://gitlab.freedesktop.org/fontconfig/fontconfig # https://www.microsoft.com/typography/otspec/otff.htm 0 ulelong 0xFC02FC04 fontconfig cache file: >0 use fc-cache-le 0 ulelong 0xFC02FC05 fontconfig cache file (mmap): >0 use fc-cache-le 0 ubelong 0xFC02FC04 fontconfig cache file: >0 use fc-cache-be 0 ubelong 0xFC02FC05 fontconfig cache file (mmap): >0 use fc-cache-be