Re: 'file' Command Giving False Positives

2010-07-03 Thread Andy Balholm
One thing I noticed about the file command's output might be useful: For the file in question, it says "MS-DOS executable (built-in)" For real Windows programs, it gives more information. One that I tried said "PE32 executable for MS Windows (GUI) Intel 80386 32-bit". I remember that some other

Re: 'file' Command Giving False Positives

2010-07-02 Thread Lowell Gilbert
Tim Daneliuk writes: > At this point, I'm inclined to believe that 'file' alone is > insufficient to do this and, at best - even with more tools - > it's going to be a probabilities game - i.e. "What percentage > of false positives is acceptable?" file(1) is only intended to be a set of heuristi

Re: 'file' Command Giving False Positives

2010-07-02 Thread Tim Daneliuk
On 7/2/2010 1:42 PM, Polytropon wrote: On Fri, 02 Jul 2010 14:23:24 -0400, Lowell Gilbert wrote: Apparently, your memory is better than mine, because that was indeed what I was thinking of. Which leads to the question of why magic(5) lists LZ as representing "MS-DOS executable (built-in)". I

Re: 'file' Command Giving False Positives

2010-07-02 Thread Polytropon
On Fri, 02 Jul 2010 14:23:24 -0400, Lowell Gilbert wrote: > Apparently, your memory is better than mine, because that was indeed > what I was thinking of. Which leads to the question of why magic(5) > lists LZ as representing "MS-DOS executable (built-in)". I'd be > hesitant to change that unle

Re: 'file' Command Giving False Positives

2010-07-02 Thread Lowell Gilbert
Polytropon writes: > On Fri, 02 Jul 2010 11:25:20 -0400, Lowell Gilbert > wrote: >> Why is it incorrect? "LZ" as the first two bytes in a file is (unless >> my memory is badly mistaken) exactly what the old command.com looked for >> as the flag of an executable. > > If I ask *my* memory, it te

Re: 'file' Command Giving False Positives

2010-07-02 Thread Erik Trulsson
On Fri, Jul 02, 2010 at 05:35:04PM +0200, Polytropon wrote: > On Fri, 02 Jul 2010 11:25:20 -0400, Lowell Gilbert > wrote: > > Why is it incorrect? "LZ" as the first two bytes in a file is (unless > > my memory is badly mistaken) exactly what the old command.com looked for > > as the flag of an e

Re: 'file' Command Giving False Positives

2010-07-02 Thread Tim Daneliuk
On 7/2/2010 10:35 AM, Polytropon wrote: On Fri, 02 Jul 2010 11:25:20 -0400, Lowell Gilbert wrote: Why is it incorrect? "LZ" as the first two bytes in a file is (unless my memory is badly mistaken) exactly what the old command.com looked for as the flag of an executable. If I ask *my* memory

Re: 'file' Command Giving False Positives

2010-07-02 Thread Polytropon
On Fri, 02 Jul 2010 11:25:20 -0400, Lowell Gilbert wrote: > Why is it incorrect? "LZ" as the first two bytes in a file is (unless > my memory is badly mistaken) exactly what the old command.com looked for > as the flag of an executable. If I ask *my* memory, it tells me that what you mean is "M

Re: 'file' Command Giving False Positives

2010-07-02 Thread Lowell Gilbert
Tim Daneliuk writes: > I have a data file with the content: > >LZasdadqjwjqwjqwjeqwe > > > 'file' (incorrectly) reports this as an MS-DOS executable. Why is it incorrect? "LZ" as the first two bytes in a file is (unless my memory is badly mistaken) exactly what the old command.com looked fo

Re: 'file' Command Giving False Positives

2010-07-02 Thread Dan Nelson
In the last episode (Jul 02), Tim Daneliuk said: > I have a data file with the content: > > LZasdadqjwjqwjqwjeqwe > > 'file' (incorrectly) reports this as an MS-DOS executable. I dunno; if I create a file "a.exe" on my XP system with those contents, I can run it from a cmd prompt, and it doe

'file' Command Giving False Positives

2010-07-02 Thread Tim Daneliuk
I have a data file with the content: LZasdadqjwjqwjqwjeqwe 'file' (incorrectly) reports this as an MS-DOS executable. Does anyone happen to know the proper changes to 'magic' that would fix this? Thanks, -- Tim Daneli