1dacc26abSDavid E. O'Brien 275a6cdb3SDavid E. O'Brien#------------------------------------------------------------ 372d4668cSXin LI# $File: java,v 1.22 2023/01/11 23:59:49 christos Exp $ 4d1d50c78SDavid E. O'Brien# Java ByteCode and Mach-O binaries (e.g., Mac OS X) use the 5d1d50c78SDavid E. O'Brien# same magic number, 0xcafebabe, so they are both handled 6d1d50c78SDavid E. O'Brien# in the entry called "cafebabe". 775a6cdb3SDavid E. O'Brien#------------------------------------------------------------ 875a6cdb3SDavid E. O'Brien# Java serialization 975a6cdb3SDavid E. O'Brien# From Martin Pool (m.pool@pharos.com.au) 1075a6cdb3SDavid E. O'Brien0 beshort 0xaced Java serialization data 1175a6cdb3SDavid E. O'Brien>2 beshort >0x0004 \b, version %d 12974b70c4SDavid E. O'Brien 13974b70c4SDavid E. O'Brien0 belong 0xfeedfeed Java KeyStore 14c0610278SDavid E. O'Brien!:mime application/x-java-keystore 15974b70c4SDavid E. O'Brien0 belong 0xcececece Java JCE KeyStore 16c0610278SDavid E. O'Brien!:mime application/x-java-jce-keystore 17974b70c4SDavid E. O'Brien 18b60a4870SDavid E. O'Brien# Java source 19196a3809SXin LI0 regex \^import.*;$ Java source 20b60a4870SDavid E. O'Brien!:mime text/x-java 21196a3809SXin LI 22196a3809SXin LI# Java HPROF dumps 23196a3809SXin LI# https://java.net/downloads/heap-snapshot/hprof-binary-format.html 24196a3809SXin LI0 string JAVA\x20PROFILE\x201.0. 254ef4bf01SXin LI>0x12 byte 0 264ef4bf01SXin LI>>0x11 ubyte-0x31 <2 Java HPROF dump, 274ef4bf01SXin LI>>>0x17 beqdate/1000 x created %s 284ef4bf01SXin LI 294ef4bf01SXin LI# Java jmod module 304ef4bf01SXin LI# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java 314ef4bf01SXin LI# Grr. 2 byte magic "JM", really? In 2019? 324ef4bf01SXin LI0 belong 0x4a4d0100 Java jmod module version 1.0 334ef4bf01SXin LI!:mime application/x-java-jmod 344ef4bf01SXin LI 354ef4bf01SXin LI# Java jlinked image 364ef4bf01SXin LI# See https://hg.openjdk.java.net/jdk9/jdk9/jdk/file/tip/src/java.base/share/native/libjimage/imageFile.hpp 374ef4bf01SXin LI0 belong 0xcafedada Java module image (big endian) 384ef4bf01SXin LI>4 beshort >0x00 \b, version %d 394ef4bf01SXin LI>6 beshort x \b.%d 404ef4bf01SXin LI!:mime application/x-java-image 414ef4bf01SXin LI 424ef4bf01SXin LI0 lelong 0xcafedada Java module image (little endian) 434ef4bf01SXin LI>6 leshort >0x00 \b, version %d 444ef4bf01SXin LI>4 leshort x \b.%d 454ef4bf01SXin LI!:mime application/x-java-image 4672d4668cSXin LI 4772d4668cSXin LI# JAR Manifest & Signature File 4872d4668cSXin LI# Reference: https://docs.oracle.com/javase/8/docs/technotes/guides/jar/jar.html 4972d4668cSXin LI0 string/t Manifest-Version:\x201.0 JAR Manifest 5072d4668cSXin LI!:ext MF 5172d4668cSXin LI0 string/t Signature-Version:\x201.0 JAR Signature File 5272d4668cSXin LI!:ext SF 53