Magic numbers – Screwtop Kittens

So Magic numbers eh whats that ???? these are file signatures used to identify or verify the content of a file these are the first bytes in the file. Below is a list of hex values for common file types. These can be viewed or edited in a Hex editor such as the “hexeditor” command in Linux. Below is a list of some common formats

Image Files

Name	HEX	ASCII
JPEG, JPG RAW Format	FF D8 FF DB `FF D8 FF EE`	ÿØÿÛ `ÿØÿî`
JPEG JIFF Format	FF D8 FF E0 00 10 4A 46 49 46 00 01	ÿØÿà..JFIF..
JPEG EXIF Format	FF D8 FF E1 ?? ?? 45 78 69 66 00 00	ÿØÿá..Exif..
GIF Format	47 49 46 38 37 61 47 49 46 38 39 61	GIF87a GIF89a
PNG Format	89 50 4E 47 0D 0A 1A 0A	.PNG….

Executables

Name	HEX	ASCII
DOS MZ executable file .EXE or .dll	4D 5A	MZ
Shebang Shell Script examples: `#!/bin/sh` `#!/bin/bash` `#!/usr/bin/env python`	23 21	#!
linux debian package file	21 3C 61 72 63 68 3E	!<arch>.
RedHat RPM Package	ed ab ee db	í«îÛ

Documents

Name	HEX	ASCII
PDF document	25 50 44 46 2d	%PDF-
Compound File Binary Format, a container format used for document by older versions of Microsoft Office.( doc xls ppt msg)	D0 CF 11 E0 A1 B1 1A E1
eXtensible Markup Language (XML)	3c 3f 78 6d 6c 20	<?xml

Compressed Formats

Name	HEX	ASCII
zip file format and formats based on it, such as EPUB, JAR, ODF, OOXML (zip, aar, apk, docx, epub, ipa,jar, kmz, maff, odp, ods, odt, pk3, pk4, pptx, usdz, vsdx, xlsx, xpi)	50 4B 03 04 50 4B 05 06 (empty archive) 50 4B 07 08 (spanned archive)	PK..
Tar Archive	75 73 74 61 72 00 30 30 75 73 74 61 72 20 20 00	ustar.00 ustar .
GZIP File	1F 8B	..
RAR V5 +	52 61 72 21 1A 07 01 00	Rar!….
7-Zip	37 7A BC AF 27 1C	7z¼¯’

Media

Name	HEX	ASCII
WAV	52 49 46 46 ?? ?? ?? ?? 57 41 56 45	RIFF…. WAVE
AVI	52 49 46 46 ?? ?? ?? ?? 41 56 49 20	RIFF…. AVI.
OGG	4F 67 67 53	0ggS
MIDI	4D 54 68 64	MThd
FLAC	66 4C 61 43	fLaC
mp3 file without an ID3 tag	FF FB	ÿû
mp3 file with ID3 tag	49 44 33	ID3
mkv	1A 45 DF A3	.Eß£
mpg mpeg	00 00 01 BA 47 00 00 01 B3	…. G ….