Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
71 lines (68 sloc) 6.15 KB
// Copyright (c) 2017 Mark K Mueller, (markmueller.com), All rights reserved.
package magic
// Signature table. Most of these signatures were horked from
// http://www.garykessler.net/library/file_sigs.html
//
var signatureTable st = st{
fs{"DOS Executable", sa{"exe", "dll"}, 0, ba{0x4D, 0x5A}},
fs{"Mach-O Executable 32-bit", sa{"o", "dylib", "bundle"}, 0, ba{0xFE, 0xED, 0xFA, 0xCE}},
fs{"Mach-O Executable 64-bit", sa{"o", "dylib", "bundle"}, 0, ba{0xFE, 0xED, 0xFA, 0xCF}},
fs{"Linux ELF Executable", sa{"axf", "bin", "elf", "o", "prx", "puff", "ko", "mod", "so"}, 0, ba{0x7F, 0x45, 0x4C, 0x46}},
fs{"PKZIP Archive", sa{"zip"}, 0, ba{0x50, 0x4B, 0x03, 0x04}},
fs{"RAR v4 Compressed Archive", sa{"rar"}, 0, ba{0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00, 0x00}},
fs{"RAR v5 Compressed Archive", sa{"rar"}, 0, ba{0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x01, 0x00}},
fs{"Ogg Container", sa{"ogg"}, 0, ba{0x4F, 0x67, 0x67, 0x53, 0x00, 0x02}},
fs{"PNG Portable Network Graphics file", sa{"png"}, 0, ba{0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A}},
fs{"BMP Image", sa{"bmp"}, 0, ba{0x42, 0x4D}},
fs{"GIF87a Image", sa{"gif"}, 0, ba{0x47, 0x49, 0x46, 0x38, 0x37, 0x61}},
fs{"GIF89a Image", sa{"gif"}, 0, ba{0x47, 0x49, 0x46, 0x38, 0x39, 0x61}},
fs{"MPEG-4 video", sa{"mp4"}, 4, ba{0x66, 0x74, 0x79, 0x70, 0x33, 0x67, 0x70, 0x35}},
fs{"Apple Lossless Audio Codec file", sa{"m4a"}, 4, ba{0x66, 0x74, 0x79, 0x70, 0x4D, 0x34, 0x41, 0x20}},
fs{"ISO Base Media file (MPEG-4) v1", sa{"mp4"}, 4, ba{0x66, 0x74, 0x79, 0x70, 0x69, 0x73, 0x6F, 0x6D}},
fs{"MPEG-4 video file", sa{"mp4"}, 4, ba{0x66, 0x74, 0x79, 0x70, 0x4D, 0x53, 0x4E, 0x56}},
fs{"MPEG-4 video|QuickTime file", sa{"m4v"}, 4, ba{0x66, 0x74, 0x79, 0x70, 0x6D, 0x70, 0x34, 0x32}},
fs{"MPEG v4 system, or iTunes AVC-LC", sa{"m4v", "flv", "m4v"}, 0, ba{0x00, 0x00, 0x00, 0x20, 0x66, 0x74, 0x79, 0x70, 0x4D, 0x34, 0x56, 0x20}},
fs{"QuickTime movie file", sa{"mov"}, 4, ba{0x66, 0x74, 0x79, 0x70, 0x71, 0x74, 0x20, 0x20}},
fs{"Windows icon file", sa{"ico"}, 0, ba{0x00, 0x00, 0x01, 0x00}},
fs{"TrueType font file", sa{"ttf"}, 0, ba{0x00, 0x01, 0x00, 0x00, 0x00}},
fs{"Microsoft Access file", sa{"mdb"}, 0, ba{0x00, 0x01, 0x00, 0x00, 0x53, 0x74, 0x61, 0x6E, 0x64, 0x61, 0x72, 0x64, 0x20, 0x4A, 0x65, 0x74, 0x20, 0x44, 0x42}},
fs{"WebM video file", sa{"mkv", "webm"}, 0, ba{0x1A, 0x45, 0xDF, 0xA3}},
fs{"GZIP archive file", sa{"gz", "tgz"}, 0, ba{0x1F, 0x8B, 0x08}},
fs{"bzip2 compressed archive", sa{"bz2"}, 0, ba{0x42, 0x5A, 0x68}},
fs{"VMware 3 Virtual Disk", sa{"vmdk"}, 0, ba{0x43, 0x4F, 0x57, 0x44}},
fs{"VMware 4 Virtual Disk (portion of a split disk) file", sa{"vmdk"}, 0, ba{0x4B, 0x44, 0x4D}},
fs{"VMware 4 Virtual Disk (monolitic disk) file", sa{"vmdk"}, 0, ba{0x4B, 0x44, 0x4D, 0x56}},
fs{"Macromedia Shockwave Flash player file", sa{"swf"}, 0, ba{0x43, 0x57, 0x53}},
fs{"Macromedia Shockwave Flash player file", sa{"swf"}, 0, ba{0x46, 0x57, 0x53}},
fs{"Macromedia Shockwave Flash player file", sa{"swf"}, 0, ba{0x5A, 0x57, 0x53}},
fs{"VMware 4 Virtual Disk description file", sa{"vmdk"}, 0, ba{0x23, 0x20, 0x44, 0x69, 0x73, 0x6B, 0x20, 0x44, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6F}},
fs{"MultiBit Bitcoin wallet file", sa{"wallet"}, 0, ba{0x0A, 0x16, 0x6F, 0x72, 0x67, 0x2E, 0x62, 0x69, 0x74, 0x63, 0x6F, 0x69, 0x6E, 0x2E, 0x70, 0x72}},
fs{"Microsoft SQL Server 2000 database", sa{"mdf"}, 0, ba{0x01, 0x0F, 0x00, 0x00}},
fs{"Adobe Portable Document Format", sa{"pdf"}, 0, ba{0x25, 0x50, 0x44, 0x46}},
fs{"RealAudio file", sa{"ra"}, 0, ba{0x2E, 0x52, 0x4D, 0x46, 0x00, 0x00, 0x00, 0x12, 0x00}},
fs{"RealAudio streaming media file", sa{"ra"}, 0, ba{0x2E, 0x72, 0x61, 0xFD, 0x00}},
fs{"Windows Event Viewer file", sa{"evt"}, 0, ba{0x30, 0x00, 0x00, 0x00, 0x4C, 0x66, 0x4C, 0x65}},
fs{"Microsoft Windows Media Audio/Video File", sa{"asf", "wma", "wmv"}, 0, ba{0x30, 0x26, 0xB2, 0x75, 0x8E, 0x66, 0xCF, 0x11, 0xA6, 0xD9, 0x00, 0xAA, 0x00, 0x62, 0xCE, 0x6C}},
fs{"Photoshop image file", sa{"psd"}, 0, ba{0x38, 0x42, 0x50, 0x53}},
fs{"Extensible Markup Language (XML)", sa{"xml", "xul"}, 0, ba{0x3C, 0x3F, 0x78, 0x6D, 0x6C, 0x20, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6F, 0x6E, 0x3D, 0x22, 0x31, 0x2E, 0x30, 0x22, 0x3F, 0x3E}},
fs{"Windows Help file", sa{"hlp"}, 0, ba{0x3F, 0x5F, 0x03, 0x00}},
fs{"AES Crypt file format", sa{"aes"}, 0, ba{0x41, 0x45, 0x53}},
fs{"Flash video file", sa{"flv"}, 0, ba{0x46, 0x4C, 0x56, 0x01}},
fs{"MPEG-1 Audio Layer 3 (MP3) audio file", sa{"mp3"}, 0, ba{0x49, 0x44, 0x33}},
fs{"Tagged Image File Format file", sa{"tif", "tiff"}, 0, ba{0x49, 0x20, 0x49}},
fs{"Tagged Image File Format file", sa{"tif", "tiff"}, 0, ba{0x49, 0x49, 0x2A, 0x00}},
fs{"Tagged Image File Format file", sa{"tif", "tiff"}, 0, ba{0x4D, 0x4D, 0x00, 0x2A}},
fs{"Tagged Image File Format file", sa{"tif", "tiff"}, 0, ba{0x4D, 0x4D, 0x00, 0x2B}},
fs{"Microsoft cabinet file", sa{"cab"}, 0, ba{0x4D, 0x53, 0x43, 0x46}},
fs{"Musical Instrument Digital Interface (MIDI) sound file", sa{"mid", "midi"}, 0, ba{0x4D, 0x54, 0x68, 0x64}},
fs{"Microsoft Office Open XML Format (OOXML) Document", sa{"docx", "pptx", "xlsx"}, 0, ba{0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x06, 0x00}},
fs{"Java archive", sa{"jar"}, 0, ba{0x50, 0x4B, 0x03, 0x04, 0x14, 0x00, 0x08, 0x00, 0x08, 0x00}},
fs{"Windows Audio Video Interleave file,", sa{"avi"}, 8, ba{0x41, 0x56, 0x49, 0x20, 0x4C, 0x49, 0x53, 0x54}},
fs{"Audio for Windows file", sa{"wav"}, 0, ba{0x57, 0x41, 0x56, 0x45, 0x66, 0x6D, 0x74, 0x20}},
fs{"MultiBit Bitcoin wallet information file", sa{"info"}, 0, ba{0x6D, 0x75, 0x6C, 0x74, 0x69, 0x42, 0x69, 0x74, 0x2E, 0x69, 0x6E, 0x66, 0x6F}},
fs{"TrueType font file", sa{"ttf"}, 0, ba{0x74, 0x72, 0x75, 0x65, 0x00}},
fs{"Rich text format word processing file", sa{"rtf"}, 0, ba{0x7B, 0x5C, 0x72, 0x74, 0x66, 0x31}},
fs{"Bitcoin Core wallet.dat file", sa{"dat"}, 8, ba{0x00, 0x00, 0x00, 0x00, 0x62, 0x31, 0x05, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
fs{"3rd Generation Partnership Project 3GPP multimedia files", sa{"3gg", "3gp", "3g2"}, 0, ba{0x00, 0x00, 0x00, 0x14, 0x66, 0x74, 0x79, 0x70, 0x33, 0x67, 0x70}},
fs{"Microsoft Compound Binary File format", sa{"doc", "msc", "msi", "xls"}, 0, ba{0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}},
}