Tip: Identifying file types

Tip: Identifying file types

Suppose you have a good chunk of binary and you are not sure what it is. The bits could be an executable, an image, a sound file, or simply random ones and zeroes. How do you identify the file?

One means is by opening the file in a hex editor and inspecting the first few bytes for a magic number. These characters indicate to the operating system and applications how to treat the files. Some common ones are 0xCAFEBAB for Java, MZ (0x4D5A) for Windows apps, and ELF (0x7F454C) for Linux executables. So there you go. Memorize a few dozen magic numbers and get quick with the hex editor.

There is a slightly easier method. Check out the File cmd in Unix, Linux, and Cygwin. “File tests each argument in an attempt to classify it. There are three sets of tests, performed in this order: filesystem tests, magic number tests, and language tests. The first test that succeeds causes the file type to be printed.” File is rather handy and does not require memorization.

For example:

Administrator@myhome ~
$ file windows.exe
regedit.exe: PE32+ executable (GUI) x86-64, for MS Windows

Administrator@myhome ~
$ file linux.app
linux.app: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, BuildID[sha1]=0x8ac30d36c853cf70fdfb9eb8182305e4ee68a609, stripped

Posted by