Add executable and object file signatures - #2
Merged
Conversation
Detect ELF, Mach-O (thin and universal, both byte orders), PE/COFF, WebAssembly, ar, and zstd. PE follows e_lfanew within the 512-byte sniff window. Universal Mach-O is gated on a plausible architecture count so Java class files sharing the CA FE BA BE prefix are not misclassified. Export the Format* constants so callers can switch on Result.Format without string literals. Closes #1
There was a problem hiding this comment.
Pull request overview
Adds native executable/object and additional archive/compression signatures to the magic detector, and exposes exported Format* constants so downstream callers can switch on Result.Format without string literals.
Changes:
- Exported
Format*constants and updated all internal/tests to use them. - Added binary signatures for zstd, ELF, Mach-O (thin + universal with Java-class disambiguation), WASM, ar, and PE/COFF (bounded
e_lfanewindirection). - Expanded tests and documentation to cover the new formats and edge cases (PE bounds, Mach-O vs Java class files).
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| magic.go | Exports Format* constants and adds MIME types for new formats; updates default text format assignment to FormatText. |
| signatures.go | Adds new binary signatures and implements Mach-O fat header and PE header detection (bounded to sniffLength). |
| signatures_test.go | Adds/updates registry tests for new formats plus targeted tests for PE bounds and Mach-O-vs-Java-class behavior. |
| text_test.go | Updates expectations to use exported FormatText. |
| magic_test.go | Updates expectations to use exported format constants. |
| README.md | Documents the expanded format registry, exported constants usage, and the Mach-O/PE edge-case behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Per mach-o/fat.h the fat header is always big-endian on disk; FAT_CIGAM and FAT_CIGAM_64 are memory-order constants for LE readers, not alternative on-disk byte sequences. Keep FAT_MAGIC and FAT_MAGIC_64 gated on the big-endian nfat_arch check and add a negative test for the swapped prefix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds ELF, Mach-O, PE/COFF, WebAssembly, ar, and zstd to the binary signature registry, and exports the
Format*constants so callers can switch onResult.Formatwithout string literals.Mach-O covers the four thin magics plus universal (
FAT_MAGICandFAT_MAGIC_64; the fat header is always big-endian on disk so the byte-swappedFAT_CIGAMconstants are not on-disk signatures). The universal case checks thatnfat_archis in a plausible range so Java class files, which share theCA FE BA BEprefix, fall through unclassified rather than matching as Mach-O.PE follows the
e_lfanewoffset from the DOS header to thePE\0\0signature, bounded to the 512-byte sniff window soprefixResultCanChangestays correct. Files with a larger DOS stub are not recognised.encoding/binaryis now imported for the two uint32 field reads.Closes #1.