Magic numbers

So Magic numbers eh whats that ???? these are file signatures used to identify or verify the content of a file these are the first bytes in the file. Below is a list of hex values for common file types. These can be viewed or edited in a Hex editor such as the “hexeditor” command in Linux. Below is a list of some common formats

Image Files

NameHEXASCII
JPEG, JPG RAW Format FF D8 FF DB
FF D8 FF EE
ÿØÿÛ
ÿØÿî
JPEG JIFF FormatFF D8 FF E0 00 10 4A 46 49 46 00 01ÿØÿà..JFIF..
JPEG EXIF FormatFF D8 FF E1 ?? ?? 45 78 69 66 00 00ÿØÿá..Exif..
GIF Format47 49 46 38 37 61
47 49 46 38 39 61
GIF87a
GIF89a
PNG Format89 50 4E 47 0D 0A 1A 0A.PNG….

Executables

NameHEXASCII
DOS MZ executable file .EXE or .dll4D 5AMZ
Shebang Shell Script examples:
#!/bin/sh
#!/bin/bash
#!/usr/bin/env python
23 21 #!
linux debian package file 21 3C 61 72 63 68 3E!<arch>.
RedHat RPM Packageed ab ee dbí«îÛ

Documents

NameHEXASCII
PDF document25 50 44 46 2d%PDF-
Compound File Binary Format, a container format used for document by older versions of Microsoft Office.( doc xls ppt msg)D0 CF 11 E0 A1 B1 1A E1
eXtensible Markup Language (XML)3c 3f 78 6d 6c 20<?xml

Compressed Formats

NameHEXASCII
zip file format and formats based on it, such as EPUB, JAR, ODF, OOXML (zip, aar, apk, docx, epub, ipa,jar, kmz, maff, odp, ods, odt, pk3, pk4, pptx, usdz, vsdx, xlsx, xpi)50 4B 03 04

50 4B 05 06
(empty archive)
50 4B 07 08
(spanned archive)
PK..
Tar Archive75 73 74 61 72 00 30 30
75 73 74 61 72 20 20 00
ustar.00
ustar .
GZIP File1F 8B ..
RAR V5 + 52 61 72 21 1A 07 01 00Rar!….
7-Zip 37 7A BC AF 27 1C7z¼¯’

Media

NameHEXASCII
WAV52 49 46 46 ?? ?? ?? ?? 57 41 56 45RIFF….
WAVE
AVI52 49 46 46 ?? ?? ?? ?? 41 56 49 20RIFF….
AVI.
OGG4F 67 67 530ggS
MIDI4D 54 68 64MThd
FLAC66 4C 61 43fLaC
mp3 file without an ID3 tagFF FB ÿû
mp3 file with ID3 tag49 44 33ID3
mkv1A 45 DF A3
.Eߣ
mpg
mpeg
00 00 01 BA
47
00 00 01 B3
….
G
….
Scroll Up