-
Notifications
You must be signed in to change notification settings - Fork 2
/
magic.h
398 lines (396 loc) · 17 KB
/
magic.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
#ifndef FILE_MAGIC_NUMBERS_H
#define FILE_MAGIC_NUMBERS_H
#include <map>
#include <string>
const std::map<std::string, std::string> FileMagicNumbers = {
{"AOL parameter|info files", "41435344"},
{"Binary property list (plist)", "62706C697374"},
{"BIOS details in RAM", "001400000102"},
{"cpio archive", "3037303730"},
{"ELF executable", "7F454C46"},
{"Extended tcpdump (libpcap) capture file", "A1B2CD34"},
{"INFO2 Windows recycle bin_1", "04000000"},
{"INFO2 Windows recycle bin_2", "05000000"},
{"Java serialization data", "ACED"},
{"KWAJ (compressed) file", "4B57414A88F027D1"},
{"NAV quarantined virus file", "CD20AAAA02000000"},
{"QBASIC SZDD file", "535A2088F02733D1"},
{"SMS text (SIM)", "6F3C"},
{"SZDD file format", "535A444488F02733"},
{"tcpdump (libpcap) capture file", "A1B2C3D4"},
{"Tcpdump capture file", "34CDB2A1"},
{"UTF8 file", "EFBBBF"},
{"UTF-16|UCS-2 file", "FEFF"},
{"UTF-32|UCS-4 file", "FFFE0000"},
{"UUencoded file", "626567696E"},
{"WinDump (winpcap) capture file", "D4C3B2A1"},
{"zisofs compressed file", "37E45396C9DBD607"},
{"Lotus 1-2-3 (v9)", "00001A00051004"},
{"Windows virtual device drivers", "4D5A"},
{"3GPP multimedia files", "0000001466747970"},
{"3GPP2 multimedia files", "0000002066747970"},
{"MPEG-4 video files", "0000001866747970"},
{"4X Movie video", "52494646"},
{"7-Zip compressed file", "377ABCAF271C"},
{"Palm Address Book Archive", "00014241"},
{"ABD | QSD Quicken data file", "5157205665722E20"},
{"AOL address book index", "414F4C494E444558"},
{"AOL config files", "414F4C"},
{"AOL address book", "414F4C4442"},
{"Sonic Foundry Acid Music File", "72696666"},
{"Microsoft Access 2007", "000100005374616E6461726420414345204442"},
{"MS Agent Character file", "C3ABCDAB"},
{"CaseWare Working Papers", "D0CF11E0A1B11AE1"},
{"Antenna data file", "5245564E554D3A2C"},
{"Amiga disk file", "444F53"},
{"Approach index file", "0300000041505052"},
{"Dreamcast audio", "80000020031204"},
{"Audio Interchange File", "464F524D00"},
{"AIN Compressed Archive", "2112"},
{"Adaptive Multi-Rate ACELP Codec (GSM)", "2321414D52"},
{"Acrobat plug-in", "4D5A900003000000"},
{"FreeArc compressed file", "41724301"},
{"LH archive (old vers.|type 1)", "1A02"},
{"LH archive (old vers.|type 2)", "1A03"},
{"LH archive (old vers.|type 3)", "1A04"},
{"LH archive (old vers.|type 4)", "1A08"},
{"LH archive (old vers.|type 5)", "1A09"},
{"ARJ Compressed archive file", "60EA"},
{"AOL history|typed URL files", "D42A"},
{"Windows Media Audio|Video File", "3026B2758E66CF11"},
{"Underground Audio", "5343486C"},
{"Advanced Stream Redirector", "3C"},
{"Audacity audio file", "646E732E"},
{"NeXT|Sun Microsystems audio file", "2E736E64"},
{"MS Answer Wizard", "8A0109000000E108"},
{"AOL and AIM buddy list", "414F4C2046656564"},
{"MS Publisher", "5854"},
{"Speedtouch router firmware", "424C4932323351"},
{"Bitmap image", "424D"},
{"bzip2 compressed archive", "425A68"},
{"Install Shield compressed file", "49536328"},
{"Microsoft cabinet file", "4D534346"},
{"CALS raster bitmap", "737263646F636964"},
{"SuperCalc worksheet", "537570657243616C"},
{"Windows calendar", "B5A2B0B3B3B0A5B5"},
{"Packet sniffer files", "58435000"},
{"WinNT Netmon capture file", "52545353"},
{"EnCase case file", "5F434153455F"},
{"MS security catalog file", "30"},
{"WordPerfect dictionary", "434246494C45"},
{"Elite Plus Commander game file", "454C49544520436F"},
{"Sony Compressed Voice File", "4D535F564F494345"},
{"Flight Simulator Aircraft Configuration", "5B666C7473696D2E"},
{"MS Compiled HTML Help File", "49545346"},
{"Java bytecode", "CAFEBABE"},
{"COM+ Catalog", "434F4D2B"},
{"Corel Binary metafile", "434D5831"},
{"DB2 conversion file", "53514C4F434F4E56"},
{"Agent newsreader character map", "4E616D653A20"},
{"Windows executable file_1", "E8"},
{"Windows executable file_2", "E9"},
{"Windows executable file_3", "EB"},
{"MS Fax Cover Sheet", "464158434F564552"},
{"Sietronics CPI XRD document", "53494554524F4E49"},
{"Windows international code page", "FF464F4E54"},
{"Corel color palette", "DCDC"},
{"Corel Photopaint file_1", "4350543746494C45"},
{"Corel Photopaint file_2", "43505446494C45"},
{"Microsoft Code Page Translation file", "5B57696E646F7773"},
{"Crush compressed archive", "43525553482076"},
{"Canon RAW file", "49491A0000004845"},
{"Photoshop Custom Shape", "6375736800000002"},
{"WhereIsIt Catalog", "436174616C6F6720"},
{"Visual Basic User-defined Control file", "56455253494F4E20"},
{"Customization files", "504B0304"},
{"Windows cursor", "00000200"},
{"Access Data FTK evidence", "A90D000000000000"},
{"Allegro Generic Packfile (compressed)", "736C6821"},
{"Allegro Generic Packfile (uncompressed)", "736C682E"},
{"AVG6 Integrity database", "415647365F496E74"},
{"MapInfo Native Data Format", "03"},
{"EasyRecovery Saved State file", "4552465353415645"},
{"IE History file", "436C69656E742055"},
{"Inno Setup Uninstall Log", "496E6E6F20536574"},
{"Norton Disk Doctor undo file", "504E4349554E444F"},
{"PestPatrol data|scan strings", "50455354"},
{"Runtime Software disk image", "1A52545320434F4D"},
{"Shareaza (P2P) thumbnail", "52415A4154444231"},
{"TomTom traffic data", "4E41565452414646"},
{"UFO Capture map file", "55464F4F72626974"},
{"Walkman MP3 file", "574D4D50"},
{"Win9x registry hive", "43524547"},
{"WinNT registry file", "72656766"},
{"dBASE IV or dBFast configuration file", "08"},
{"Netscape Navigator (v4) database", "0006156100000002000004D200001000"},
{"Palm Zire photo database", "44424648"},
{"SQLite database file", "53514C69746520666F726D6174203300"},
{"Thumbs.db subheader", "FDFFFFFF"},
{"dBASE IV file", "04"},
{"Palm DateBook Archive", "00014244"},
{"Skype user data file", "6C33336C"},
{"Psion Series 3 Database", "4F504C4461746162"},
{"Outlook Express e-mail folder", "CFAD12FE"},
{"AOL HTML mail", "3C21646F63747970"},
{"PCX bitmap", "B168DE3A"},
{"Dalvik (Android) executable file", "6465780A30303900"},
{"MacOS X image file", "78"},
{"Windows dump file", "4D444D5093A7"},
{"Windows memory dump", "504147454455"},
{"Amiga DiskMasher compressed archive", "444D5321"},
{"DeskMate Document", "0D444F43"},
{"Perfect Office document", "CF11E0A1B11AE100"},
{"Word 2.0 file", "DBA52D00"},
{"Word document subheader", "ECA5C100"},
{"MS Office 2007 documents", "504B030414000600"},
{"Generic drawing programs", "07"},
{"Micrografx vector graphic file", "01FF02040302"},
{"CD Stomper Pro label file", "4D56"},
{"MS Developer Studio project file", "23204D6963726F73"},
{"Digital Speech Standard file", "02647373"},
{"MS Visual Studio workspace file", "64737766696C65"},
{"DesignTools 2D Design file", "0764743264647464"},
{"Dial-up networking file", "5B50686F6E655D"},
{"DVR-Studio stream file", "445644"},
{"Visio|DisplayWrite 4 text file", "4F7B"},
{"Generic AutoCAD drawing", "41433130"},
{"Expert Witness Compression Format", "455646090D0AFF00"},
{"Logical File Evidence Format", "4C5646090D0AFF00"},
{"MS Exchange configuration file", "5B47656E6572616C"},
{"eFax file", "DCFE"},
{"Exchange e-mail", "582D"},
{"Generic e-mail_1", "52657475726E2D50"},
{"Generic e-mail_2", "46726F6D"},
{"EndNote Library File", "40404020000040404040"},
{"Adobe encapsulated PostScript", "C5D0D3C6"},
{"Encapsulated PostScript file", "252150532D41646F"},
{"WinPharoah capture file", "1A350100"},
{"Windows Event Viewer file", "300000004C664C65"},
{"Windows Vista event log", "456C6646696C6500"},
{"PDF file", "25504446"},
{"Free Lossless Audio Codec file", "664C614300000022"},
{"FLIC animation", "0011"},
{"Qimage filter", "76323030332E3130"},
{"Flash video file", "464C56"},
{"Adobe FrameMaker", "3C4D616B65724669"},
{"WinPharoah filter file", "D20A0000"},
{"Symantex Ghost image file", "FEEF"},
{"Windows Help file_2", "3F5F0300"},
{"Windows help file_3", "4C4E0200"},
{"GIF file", "47494638"},
{"GPG public keyring", "99"},
{"Windows Program Manager group file", "504D4343"},
{"Show Partner graphics file", "475832"},
{"GZIP archive file", "1F8B08"},
{"Hamarsoft compressed archive", "91334846"},
{"Radiance High Dynamic Range image file", "233F52414449414E"},
{"Houdini image file. Three-dimensional modeling and animation", "48695021"},
{"Windows Help file_1", "0000FFFFFFFF"},
{"BinHex 4 Compressed Archive", "2854686973206669"},
{"Windows icon|printer spool file", "00000100"},
{"Quicken QuickFinder Information File", "5000000020000000"},
{"ChromaGraph Graphics Card Bitmap", "504943540008"},
{"GEM Raster file", "EB3C902A"},
{"Img Software Bitmap", "53434D49"},
{"AOL client preferences|settings file", "414F4C494458"},
{"Amiga icon", "E310000100000000"},
{"GNU Info Reader file", "5468697320697320"},
{"ZoomBrowser Image Index", "7A626578"},
{"ISO-9660 CD Disc Image", "4344303031"},
{"RealPlayer video file (V11+)", "2E524543"},
{"Jar archive", "5F27A889"},
{"JARCS compressed archive", "4A4152435300"},
{"Java archive_2", "504B030414000800"},
{"JPEG IMAGE", "FFD8FFE0"},
{"AOL ART file_1", "4A47030E"},
{"AOL ART file_2", "4A47040E"},
{"MS Windows journal", "4E422A00"},
{"JPEG2000 image files", "0000000C6A502020"},
{"CANNON EOS JPEG FILE", "FFD8FFE2"},
{"SAMSUNG D500 JPEG FILE", "FFD8FFE3"},
{"Digital camera JPG using Exchangeable Image File Format (EXIF)", "FFD8FFE1"},
{"Still Picture Interchange File Format (SPIFF)", "FFD8FFE8"},
{"KGB archive", "4B47425F61726368"},
{"Sprint Music Store audio", "49443303000000"},
{"Jeppesen FliteLog file", "C8007900"},
{"Windows application log", "7B0D0A6F20"},
{"Compressed archive", "2D6C68"},
{"Unix archiver (ar)|MS Program Library Common Object File Format (COFF)", "213C617263683E0A"},
{"MS Reader eBook", "49544F4C49544C53"},
{"Windows shortcut file", "4C00000001140200"},
{"Symantec Wise Installer log", "2A2A2A2020496E73"},
{"Lotus WordPro file", "576F726450726F"},
{"Apple audio and video files", "00000020667479704D3441"},
{"Windows Visual Stylesheet", "3C3F786D6C2076657273696F6E3D"},
{"MAr compressed archive", "4D41723000"},
{"Microsoft|MSN MARC archive", "4D415243"},
{"Mozilla archive", "4D41523100"},
{"Microsoft Access", "000100005374616E64617264204A6574204442"},
{"SQL Data Base", "010F0000"},
{"MS Document Imaging file", "4550"},
{"MIDI sound file", "4D546864"},
{"MapInfo Interchange Format file", "56657273696F6E20"},
{"Matroska stream file", "1A45DFA393428288"},
{"Milestones project management file", "4D494C4553"},
{"Milestones project management file_1", "4D56323134"},
{"Milestones project management file_2", "4D563243"},
{"Skype localization data file", "4D4C5357"},
{"Yamaha Synthetic music Mobile Application Format", "4D4D4D440000"},
{"Microsoft Money file", "000100004D534953414D204461746162617365"},
{"MSinfo file", "FFFE23006C006900"},
{"QuickTime movie_1", "6D6F6F76"},
{"QuickTime movie_2", "66726565"},
{"QuickTime movie_3", "6D646174"},
{"QuickTime movie_4", "77696465"},
{"QuickTime movie_5", "706E6F74"},
{"QuickTime movie_6", "736B6970"},
{"Monochrome Picture TIFF bitmap", "0CED"},
{"MP3 audio file", "494433"},
{"DVD video file", "000001BA"},
{"MPEG video file", "000001B3"},
{"MMC Snap-in Control file", "3C3F786D6C2076657273696F6E3D22312E30223F3E0D0A3C4D4D435F436F6E736F6C6546696C6520436F6E736F6C65566572"},
{"Cerius2 file", "2320"},
{"Nero CD compilation", "0E4E65726F49534F"},
{"Lotus Notes database", "1A0000040000"},
{"NES Sound file", "4E45534D1A01"},
{"Lotus Notes database template", "1A0000"},
{"National Imagery Transmission Format file", "4E49544630"},
{"National Transfer Format Map", "30314F52444E414E"},
{"VMware BIOS state file", "4D52564E"},
{"MS COFF relocatable object code", "4C01"},
{"Relocatable object code", "80"},
{"Ogg Vorbis Codec compressed file", "4F67675300020000"},
{"MS OneNote note", "E4525C7B8CD8A74D"},
{"Developer Studio subheader", "FDFFFFFF20"},
{"AOL personal file cabinet", "414F4C564D313030"},
{"Intel PROset|Wireless Profile", "64000000"},
{"PAK Compressed archive file", "1A0B"},
{"Quake archive file", "5041434B"},
{"GIMP pattern file", "47504154"},
{"PAX password protected bitmap", "504158"},
{"Visual C PreCompiled header", "564350434830"},
{"ZSOFT Paintbrush file_3", "0A050101"},
{"ZSOFT Paintbrush file_2", "0A030101"},
{"ZSOFT Paintbrush file_1", "0A020101"},
{"MS C++ debugging symbols file", "4D6963726F736F667420432F432B2B20"},
{"Merriam-Webster Pocket Dictionary", "4D2D5720506F636B"},
{"BGBlitz position database file", "ACED000573720012"},
{"PowerBASIC Debugger Symbols", "737A657A"},
{"PalmOS SuperMemo", "736D5F"},
{"Windows prefetch file", "1100000053434341"},
{"PGP disk image", "504750644D41494E"},
{"Portable Graymap Graphic", "50350A"},
{"PGP public keyring", "9901"},
{"PNG image", "89504E470D0A1A0A"},
{"PowerPoint presentation subheader_6", "FDFFFFFF43000000"},
{"PowerPoint presentation subheader_5", "FDFFFFFF1C000000"},
{"PowerPoint presentation subheader_4", "FDFFFFFF0E000000"},
{"PowerPoint presentation subheader_3", "A0461DF0"},
{"PowerPoint presentation subheader_2", "0F00E803"},
{"PowerPoint presentation subheader_1", "006E1EF0"},
{"PathWay Map file", "74424D504B6E5772"},
{"Palmpilot resource file", "424F4F4B4D4F4249"},
{"Photoshop image", "38425053"},
{"Corel Paint Shop Pro image", "7E424B00"},
{"MS WinMobile personal note", "7B5C707769"},
{"Win98 password file", "E3828596"},
{"Win95 password file", "B04D4643"},
{"QuickBooks backup", "458600000600"},
{"QDF Quicken data", "AC9EBD8F0000"},
{"QDL Quicken data", "51454C20"},
{"Qcow Disk Image", "514649"},
{"Quicken price history", "03000000"},
{"Quark Express (Motorola)", "00004D4D585052"},
{"Quark Express (Intel)", "00004949585052"},
{"RealAudio streaming media", "2E7261FD00"},
{"RealAudio file", "2E524D4600000012"},
{"RealMedia metafile", "727473703A2F2F"},
{"WinRAR compressed archive", "526172211A0700"},
{"WinNT Registry|Registry Undo files", "52454745444954"},
{"Windows Registry file", "FFFE"},
{"Silicon Graphics RGB Bitmap", "01DA01010003"},
{"RealMedia streaming media", "2E524D46"},
{"RedHat Package Manager", "EDABEEDB"},
{"RagTime document", "43232B44A4434DA5"},
{"RTF file", "7B5C72746631"},
{"Lotus AMI Pro document_2", "5B7665725D"},
{"Lotus AMI Pro document_1", "5B5645525D"},
{"SPSS Data file", "24464C3240282329"},
{"SmartDraw Drawing file", "534D415254445257"},
{"Harvard Graphics presentation file", "4848474231"},
{"Win2000|XP printer spool file", "67490000"},
{"Win9x printer spool file", "4B490000"},
{"WinNT printer spool file", "66490000"},
{"Win Server 2003 printer spool file", "68490000"},
{"Harvard Graphics presentation", "53484F57"},
{"StuffIt compressed archive", "5374756666497420"},
{"StuffIt archive", "5349542100"},
{"SkinCrafter skin", "07534B46"},
{"PGP secret keyring_2", "9501"},
{"PGP secret keyring_1", "9500"},
{"Surfplan kite project file", "3A56455253494F4E"},
{"Steganos virtual secure drive", "414376"},
{"Visual Studio .NET file", "4D6963726F736F66742056697375616C"},
{"Netscape Communicator (v4) mail folder", "001E849000000000"},
{"Visual Studio Solution subheader", "FDFFFFFF04"},
{"Shockwave Flash player", "465753"},
{"Shockwave Flash file", "435753"},
{"Windows executable", "FF"},
{"Keyboard driver file", "FF4B455942202020"},
{"DOS system driver", "FFFFFFFF"},
{"Harvard Graphics symbol graphic", "414D594F"},
{"Tape Archive", "7573746172"},
{"Compressed tape archive_2", "1FA0"},
{"Compressed tape archive_1", "1F9D90"},
{"Acronis True Image", "B46E6844"},
{"TIFF file_3", "4D4D002A"},
{"TIFF file_2", "49492A00"},
{"TIFF file_1", "492049"},
{"TIFF file_4", "4D4D002B"},
{"OLE|SPSS|Visual C++ library file", "4D53465402000100"},
{"Novell LANalyzer capture file", "0110"},
{"Unicode extensions", "55434558"},
{"UFA compressed archive", "554641C6D2C1"},
{"VideoVCD|VCDImager file", "454E545259564344"},
{"vCard", "424547494E3A5643"},
{"Visual C++ Workbench Info File", "5B4D535643"},
{"Virtual PC HD image", "636F6E6563746978"},
{"VMware 4 Virtual Disk", "4B444D"},
{"VMware 4 Virtual Disk description", "23204469736B2044"},
{"VMware 3 Virtual Disk", "434F5744"},
{"Outlook Express address book (Win95)", "813284C18505D011"},
{"Outlook address file", "9CCBCB8D1375D211"},
{"Quatro Pro for Windows 7.0", "3E000300FEFF090006"},
{"Lotus 1-2-3 (v1)", "0000020006040600"},
{"Lotus 1-2-3 (v3)", "00001A0000100400"},
{"Lotus 1-2-3 (v4|v5)", "00001A0002100400"},
{"DeskMate Worksheet", "0E574B53"},
{"Works for Windows spreadsheet", "FF00020004040554"},
{"Windows graphics metafile", "D7CDC69A"},
{"WordPerfect text and graphics", "FF575043"},
{"WordPerfect text", "81CDAB"},
{"Windows Media Player playlist", "4D6963726F736F66742057696E646F7773204D6564696120506C61796572202D2D20"},
{"MS Write file_3", "BE000000AB"},
{"MS Write file_2", "32BE"},
{"MS Write file_1", "31BE"},
{"WordStar Version 5.0|6.0 document", "1D7D"},
{"WordStar for Windows file", "575332303030"},
{"Excel spreadsheet subheader_2", "FDFFFFFF10"},
{"Excel spreadsheet subheader_1", "0908100000060500"},
{"Excel spreadsheet subheader_7", "FDFFFFFF29"},
{"Excel spreadsheet subheader_6", "FDFFFFFF28"},
{"Excel spreadsheet subheader_5", "FDFFFFFF23"},
{"Excel spreadsheet subheader_4", "FDFFFFFF22"},
{"Excel spreadsheet subheader_3", "FDFFFFFF1F"},
{"User Interface Language", "3C3F786D6C2076657273696F6E3D22312E30223F3E"},
{"XPCOM libraries", "5850434F4D0A5479"},
{"ZoneAlam data file", "4D5A90000300000004000000FFFF"},
{"ZLock Pro encrypted ZIP", "504B030414000100"},
{"PKZIP archive_3", "504B0708"},
{"PKZIP archive_2", "504B0506"},
{"PKSFX self-extracting archive", "504B537058"},
{"PKLITE archive", "504B4C495445"},
{"WinZip compressed archive", "57696E5A6970"},
{"ZOO compressed archive", "5A4F4F20"}
};
#endif