Re: 'file' Command Giving False Positives

2010-07-03 Thread Andy Balholm
One thing I noticed about the file command's output might be useful: For the file in question, it says MS-DOS executable (built-in) For real Windows programs, it gives more information. One that I tried said PE32 executable for MS Windows (GUI) Intel 80386 32-bit. I remember that some others

'file' Command Giving False Positives

2010-07-02 Thread Tim Daneliuk
I have a data file with the content: LZasdadqjwjqwjqwjeqwe 'file' (incorrectly) reports this as an MS-DOS executable. Does anyone happen to know the proper changes to 'magic' that would fix this? Thanks, -- Tim

Re: 'file' Command Giving False Positives

2010-07-02 Thread Dan Nelson
In the last episode (Jul 02), Tim Daneliuk said: I have a data file with the content: LZasdadqjwjqwjqwjeqwe 'file' (incorrectly) reports this as an MS-DOS executable. I dunno; if I create a file a.exe on my XP system with those contents, I can run it from a cmd prompt, and it doesn't

Re: 'file' Command Giving False Positives

2010-07-02 Thread Lowell Gilbert
Tim Daneliuk tun...@tundraware.com writes: I have a data file with the content: LZasdadqjwjqwjqwjeqwe 'file' (incorrectly) reports this as an MS-DOS executable. Why is it incorrect? LZ as the first two bytes in a file is (unless my memory is badly mistaken) exactly what the old

Re: 'file' Command Giving False Positives

2010-07-02 Thread Polytropon
On Fri, 02 Jul 2010 11:25:20 -0400, Lowell Gilbert freebsd-questions-lo...@be-well.ilk.org wrote: Why is it incorrect? LZ as the first two bytes in a file is (unless my memory is badly mistaken) exactly what the old command.com looked for as the flag of an executable. If I ask *my* memory,

Re: 'file' Command Giving False Positives

2010-07-02 Thread Tim Daneliuk
On 7/2/2010 10:35 AM, Polytropon wrote: On Fri, 02 Jul 2010 11:25:20 -0400, Lowell Gilbertfreebsd-questions-lo...@be-well.ilk.org wrote: Why is it incorrect? LZ as the first two bytes in a file is (unless my memory is badly mistaken) exactly what the old command.com looked for as the flag of

Re: 'file' Command Giving False Positives

2010-07-02 Thread Erik Trulsson
On Fri, Jul 02, 2010 at 05:35:04PM +0200, Polytropon wrote: On Fri, 02 Jul 2010 11:25:20 -0400, Lowell Gilbert freebsd-questions-lo...@be-well.ilk.org wrote: Why is it incorrect? LZ as the first two bytes in a file is (unless my memory is badly mistaken) exactly what the old command.com

Re: 'file' Command Giving False Positives

2010-07-02 Thread Lowell Gilbert
Polytropon free...@edvax.de writes: On Fri, 02 Jul 2010 11:25:20 -0400, Lowell Gilbert freebsd-questions-lo...@be-well.ilk.org wrote: Why is it incorrect? LZ as the first two bytes in a file is (unless my memory is badly mistaken) exactly what the old command.com looked for as the flag of

Re: 'file' Command Giving False Positives

2010-07-02 Thread Polytropon
On Fri, 02 Jul 2010 14:23:24 -0400, Lowell Gilbert freebsd-questions-lo...@be-well.ilk.org wrote: Apparently, your memory is better than mine, because that was indeed what I was thinking of. Which leads to the question of why magic(5) lists LZ as representing MS-DOS executable (built-in).

Re: 'file' Command Giving False Positives

2010-07-02 Thread Tim Daneliuk
On 7/2/2010 1:42 PM, Polytropon wrote: On Fri, 02 Jul 2010 14:23:24 -0400, Lowell Gilbertfreebsd-questions-lo...@be-well.ilk.org wrote: Apparently, your memory is better than mine, because that was indeed what I was thinking of. Which leads to the question of why magic(5) lists LZ as

Re: 'file' Command Giving False Positives

2010-07-02 Thread Lowell Gilbert
Tim Daneliuk tun...@tundraware.com writes: At this point, I'm inclined to believe that 'file' alone is insufficient to do this and, at best - even with more tools - it's going to be a probabilities game - i.e. What percentage of false positives is acceptable? file(1) is only intended to be a