Skip to content
forked from schlerp/pyfsig

python file signature identifier - Use this to identify files from their headers

License

Notifications You must be signed in to change notification settings

conitrade-as/pyfsig

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

31 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

pyfsig

A python library for identifying files by headers (magic bytes).

based on info from: 'Wikipedia - List of file signatures'

Still alpha, but code should be easy enough to follow and expand upon.

Thanks to all contributors!!

GitHub Contributors Image

Example use:

# returns a Match object (list of signatures) that match the file 'f'
with open(f_name, "rb") as f:
    derp = get_from_file(f)

# returns Match object (list of signatures) that match the file at this file path
herp = get_from_path(f_name)

# this can be a string or a bytestring, will raise exception if no matching headers found.
Matches(header="%PDF")

file_signatures.compare(header, test_hex_string)

A method that compares a two file headers, the first one directly read from a file, the second is a a string containing space delimited hexidecimal byte codes. its a string becuase 'nn' is used to represent a wildcard byte.

header

This is the first x bytes of a file, this can be obtained by opening the file using open(file_name, 'rb') mode.

To obtain only the first few bytes use the following:

with open(file_name, 'rb') as f:
    header = f.read(32)

test_hex_string

This is the string of space delimited hexidecimal byte codes representing the file signature.

'nn' is used to represent a wildcard byte

example:

# for example, "%PDF"
test_hex_string = "25 50 44 46"

# showing wildcards, %P**DF
test_hex_string = "25 50 nn nn 44 46"

get_from_file(f, max_header=32)

Return a Match object of all the matching Signatures for this file

f

'f' is the open file object.

Note: you can use textIO to get a file like object from a string

max_header

This is the length in bytes read from the start of the file used as the file header.

get_from_path(path, max_header=32)

Return a Match object of all the matching signatures for this file, using the path rather than a file object now.

path

'path' is the path to a file, it is passed into open() so it can be relative if you like.

max_header

This is the length in bytes read from the start of the file used as the file header.

file_signatures.Signature

A class that reimplements a dictionary. These are initialised and returned as part of the Match class when a Byte signature is tested using the file_signatures.compare() function.

file_extension

A suggested file extension for this type of file

description

A brief description of the file type taken from 'List of file signatures'.

offset

Not implemented yet...

ascii

ASCII interpretation of the file signature eg. '%PDF'

hex

The space delimited hexidecimal byte codes representing the file signature.

example:

# for example, "%PDF"
test_hex_string = "25 50 44 46"

(see above test_hex_string)

file_signatures.Match

This is a list reimplemented, it is returned by get_from_file and get_from_path defs. It holds a list Signature objects.

file_signatures.NoMatchException

This is a basic exception used when a match cannot be found.

Use try: except: statements in your code if you dont like this.

file_signatures.signatures

a list of dictionary items representing a file signature class. Used to check against and initialise new Signatures.

example:

# example entry from file_signatures.signatures list
{'ascii': 'v/1.',
 'description': 'OpenEXR image',
 'file_extension': 'exr',
 'hex': '76 2F 31 01',
 'offset': '0'}

Current List

# Wikipedia License
# -----------------
# 
# This Library uses material from the Wikipedia article 
# https://en.wikipedia.org/wiki/List_of_file_signatures, which is released 
# under the Creative Commons Attribution-Share-Alike License 3.0


signatures = [{'ascii': '....',
               'description': 'RedHat Package Manager (RPM) package',
               'file_extension': 'rpm',
               'hex': 'ed ab ee db',
               'offset': '0'},
              {'ascii': 'SP01',
               'description': 'Amazon Kindle Update Package',
               'file_extension': 'bin',
               'hex': '53 50 30 31',
               'offset': '0'},
              {'ascii': '.',
               'description': 'WindowsProgram Information File',
               'file_extension': 'PIF',
               'hex': '00 nn',
               'offset': '0'},
              {'ascii': '.',
               'description': 'MacStuffit Self-Extracting Archive',
               'file_extension': 'SEA',
               'hex': '00 nn',
               'offset': '0'},
              {'ascii': '.',
               'description': 'IRISOCR data file',
               'file_extension': 'YTR',
               'hex': '00 nn',
               'offset': '0'},
              {'ascii': '.',
               'description': 'IBM Storyboard bitmap file',
               'file_extension': 'PIC',
               'hex': '00 nn',
               'offset': '0'},
              {'ascii': '........ ........ ........',
               'description': 'PalmPilot Database/Document File',
               'file_extension': 'PDB',
               'hex': '00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00'
               '00',
                      'offset': '11'},
              {'ascii': '...',
               'description': 'Palm Desktop Calendar Archive',
               'file_extension': 'DBA',
               'hex': 'BE BA FE CA',
               'offset': '0'},
              {'ascii': '..BD',
               'description': 'Palm Desktop To Do Archive',
               'file_extension': 'DBA',
               'hex': '00 01 42 44',
               'offset': '0'},
              {'ascii': '..DT',
               'description': 'Palm Desktop Calendar Archive',
               'file_extension': 'TDA',
               'hex': '00 01 44 54',
               'offset': '0'},
              {'ascii': '...',
               'description': 'Palm Desktop Data File (Access format)',
               'file_extension': '',
               'hex': '00 01 00 00',
               'offset': '0'},
              {'ascii': '....',
               'description': 'Computer icon encoded inICO file format',
               'file_extension': 'ico',
               'hex': '00 00 01 00',
               'offset': '0'},
              {'ascii': 'ftyp 3g',
               'description': '3rd Generation Partnership Project3GPP',
               'file_extension': '3gp',
               'hex': '66 74 79 70 33 67',
               'offset': '4'},
              {'ascii': 'ftyp 3g',
               'description': '3GPP2 multimedia files',
               'file_extension': '3g2',
               'hex': '66 74 79 70 33 67',
               'offset': '4'},
              {'ascii': '..',
               'description': 'compressed file (often tar zip)',
               'file_extension': 'z',
               'hex': '1F 9D',
               'offset': '0'},
              {'ascii': '..',
               'description': 'usingLempel-Ziv-Welch algorithm',
               'file_extension': 'tar.z',
               'hex': '1F 9D',
               'offset': '0'},
              {'ascii': '..',
               'description': 'Compressed file (often tar zip)',
               'file_extension': 'z',
               'hex': '1F A0',
               'offset': '0'},
              {'ascii': '..',
               'description': 'usingLZH algorithm',
               'file_extension': 'tar.z',
               'hex': '1F A0',
               'offset': '0'},
              {'ascii': 'BACKMIKE DISK',
               'description': 'File ortape containing abackup done withAmiBack on an Amiga. '
               'It typically is paired with an index file (idx) with the '
                              'table of contents.',
                              'file_extension': 'bac',
               'hex': '42 41 43 4B 4D 49 4B 45 44 49 53 4B',
               'offset': '0'},
              {'ascii': 'BZh',
               'description': 'Compressed file usingBzip2 algorithm',
               'file_extension': 'bz2',
               'hex': '42 5A 68',
               'offset': '0'},
              {'ascii': 'GIF87aGIF89a',
               'description': 'Image file encoded in theGraphics Interchange Format (GIF)',
               'file_extension': 'gif',
               'hex': '47 49 46 38 37 61 47 49 46 38 39 61',
               'offset': '0'},
              {'ascii': 'II*.MM.*',
               'description': 'Tagged Image File Format (little endian format)',
               'file_extension': 'tif',
               'hex': '49 49 2A 00',
               'offset': '0'},
              {'ascii': 'II*.MM.*',
               'description': 'Tagged Image File Format (little endian format)',
               'file_extension': 'tiff',
               'hex': '49 49 2A 00',
               'offset': '0'},
              {'ascii': 'II*.MM.*',
               'description': 'Tagged Image File Format (big endian format)',
               'file_extension': 'tif',
               'hex': '4D 4D 00 2A',
               'offset': '0'},
              {'ascii': 'II*.MM.*',
               'description': 'Tagged Image File Format (big endian format)',
               'file_extension': 'tiff',
               'hex': '4D 4D 00 2A',
               'offset': '0'},
              {'ascii': 'II*..... CR',
               'description': "Canon's RAW format is based on the TIFF file format",
               'file_extension': 'cr2',
               'hex': '49 49 2A 00 10 00 00 00 43 52',
               'offset': '0'},
              {'ascii': 'II*..... CR',
               'description': 'Canon RAW Format Version 2',
               'file_extension': 'cr2',
               'hex': '49 49 2A 00 10 00 00 00 43 52',
               'offset': '0'},
              {'ascii': '.*_.',
               'description': 'KodakCineon image',
               'file_extension': 'cin',
               'hex': '80 2A 5F D7',
               'offset': '0'},
              {'ascii': 'RNC.',
               'description': 'Compressed file usingRob Northen Compression (version 1 and '
               '2) algorithm',
                              'file_extension': '',
               'hex': '52 4E 43 01 52 4E 43 02',
               'offset': '0'},
              {'ascii': 'SDPXXPDS',
               'description': 'SMPTEDPX image (big endian format)',
               'file_extension': 'dpx',
               'hex': '53 44 50 58',
               'offset': '0'},
              {'ascii': 'SDPXXPDS',
               'description': 'SMPTEDPX image (little endian format)',
               'file_extension': 'dpx',
               'hex': '58 50 44 53',
               'offset': '0'},
              {'ascii': 'v/1.',
               'description': 'OpenEXR image',
               'file_extension': 'exr',
               'hex': '76 2F 31 01',
               'offset': '0'},
              {'ascii': 'BPGû',
               'description': 'Better Portable Graphics format',
               'file_extension': 'bpg',
               'hex': '42 50 47 FB',
               'offset': '0'},
              {'ascii': 'ÿØÿÛ',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpg',
               'hex': 'FF D8 FF DB',
               'offset': '0'},
              {'ascii': 'ÿØÿÛ',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpeg',
               'hex': 'FF D8 FF DB',
               'offset': '0'},
              {'ascii': 'ÿØÿà ..J F IF..',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpg',
               'hex': 'FF D8 FF E0 nn nn 4A 46 49 46 00 01',
               'offset': '0'},
              {'ascii': 'ÿØÿà ..J F IF..',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpeg',
               'hex': 'FF D8 FF E0 nn nn 4A 46 49 46 00 01',
               'offset': '0'},
              {'ascii': 'ÿØÿá ..E x if..',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpg',
               'hex': 'FF D8 FF E1 nn nn 45 78 69 66 00 00',
               'offset': '0'},
              {'ascii': 'ÿØÿá ..E x if..',
               'description': 'JPEG raw or in theJFIF orExif file format',
               'file_extension': 'jpeg',
               'hex': 'FF D8 FF E1 nn nn 45 78 69 66 00 00',
               'offset': '0'},
              {'ascii': 'FORM.... ILBM',
               'description': 'IFFInterleaved Bitmap Image',
               'file_extension': 'ilbm',
               'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ILBM',
               'description': 'IFFInterleaved Bitmap Image',
               'file_extension': 'lbm',
               'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ILBM',
               'description': 'IFFInterleaved Bitmap Image',
               'file_extension': 'ibm',
               'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ILBM',
               'description': 'IFFInterleaved Bitmap Image',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 49 4C 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... 8SVX',
               'description': 'IFF8-Bit Sampled Voice',
               'file_extension': '8svx',
               'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
               'offset': 'any'},
              {'ascii': 'FORM.... 8SVX',
               'description': 'IFF8-Bit Sampled Voice',
               'file_extension': '8sv',
               'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
               'offset': 'any'},
              {'ascii': 'FORM.... 8SVX',
               'description': 'IFF8-Bit Sampled Voice',
               'file_extension': 'svx',
               'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
               'offset': 'any'},
              {'ascii': 'FORM.... 8SVX',
               'description': 'IFF8-Bit Sampled Voice',
               'file_extension': 'snd',
               'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
               'offset': 'any'},
              {'ascii': 'FORM.... 8SVX',
               'description': 'IFF8-Bit Sampled Voice',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 38 53 56 58',
               'offset': 'any'},
              {'ascii': 'FORM.... ACBM',
               'description': 'Amiga Contiguous Bitmap',
               'file_extension': 'acbm',
               'hex': '46 4F 52 4D nn nn nn nn 41 43 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ACBM',
               'description': 'Amiga Contiguous Bitmap',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 41 43 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ANBM',
               'description': 'IFFAnimated Bitmap',
               'file_extension': 'anbm',
               'hex': '46 4F 52 4D nn nn nn nn 41 4E 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ANBM',
               'description': 'IFFAnimated Bitmap',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 41 4E 42 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ANIM',
               'description': 'IFFCEL Animation',
               'file_extension': 'anim',
               'hex': '46 4F 52 4D nn nn nn nn 41 4E 49 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... ANIM',
               'description': 'IFFCEL Animation',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 41 4E 49 4D',
               'offset': 'any'},
              {'ascii': 'FORM.... FAXX',
               'description': 'IFFFacsimile Image',
               'file_extension': 'faxx',
               'hex': '46 4F 52 4D nn nn nn nn 46 41 58 58',
               'offset': 'any'},
              {'ascii': 'FORM.... FAXX',
               'description': 'IFFFacsimile Image',
               'file_extension': 'faxx',
               'hex': '46 4F 52 4D nn nn nn nn 46 41 58 58',
               'offset': 'any'},
              {'ascii': 'FORM.... FAXX',
               'description': 'IFFFacsimile Image',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 46 41 58 58',
               'offset': 'any'},
              {'ascii': 'FORM.... FTXT',
               'description': 'IFFFormatted Text',
               'file_extension': 'ftxt',
               'hex': '46 4F 52 4D nn nn nn nn 46 54 58 54',
               'offset': 'any'},
              {'ascii': 'FORM.... FTXT',
               'description': 'IFFFormatted Text',
               'file_extension': 'txt',
               'hex': '46 4F 52 4D nn nn nn nn 46 54 58 54',
               'offset': 'any'},
              {'ascii': 'FORM.... FTXT',
               'description': 'IFFFormatted Text',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 46 54 58 54',
               'offset': 'any'},
              {'ascii': 'FORM.... SMUS',
               'description': 'IFFSimple Musical Score',
               'file_extension': 'smus',
               'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... SMUS',
               'description': 'IFFSimple Musical Score',
               'file_extension': 'smu',
               'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... SMUS',
               'description': 'IFFSimple Musical Score',
               'file_extension': 'mus',
               'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... SMUS',
               'description': 'IFFSimple Musical Score',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 53 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... CMUS',
               'description': 'IFFMusical Score',
               'file_extension': 'cmus',
               'hex': '46 4F 52 4D nn nn nn nn 43 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... CMUS',
               'description': 'IFFMusical Score',
               'file_extension': 'mus',
               'hex': '46 4F 52 4D nn nn nn nn 43 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... CMUS',
               'description': 'IFFMusical Score',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 43 4D 55 53',
               'offset': 'any'},
              {'ascii': 'FORM.... YUVN',
               'description': 'IFFYUV Image',
               'file_extension': 'yuvn',
               'hex': '46 4F 52 4D nn nn nn nn 59 55 56 4E',
               'offset': 'any'},
              {'ascii': 'FORM.... YUVN',
               'description': 'IFFYUV Image',
               'file_extension': 'yuv',
               'hex': '46 4F 52 4D nn nn nn nn 59 55 56 4E',
               'offset': 'any'},
              {'ascii': 'FORM.... YUVN',
               'description': 'IFFYUV Image',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 59 55 56 4E',
               'offset': 'any'},
              {'ascii': 'FORM.... FANT',
               'description': 'AmigaFantavision Movie',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 46 41 4E 54',
               'offset': 'any'},
              {'ascii': 'FORM.... AIFF',
               'description': 'Audio Interchange File Format',
               'file_extension': 'aiff',
               'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
               'offset': 'any'},
              {'ascii': 'FORM.... AIFF',
               'description': 'Audio Interchange File Format',
               'file_extension': 'aif',
               'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
               'offset': 'any'},
              {'ascii': 'FORM.... AIFF',
               'description': 'Audio Interchange File Format',
               'file_extension': 'aifc',
               'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
               'offset': 'any'},
              {'ascii': 'FORM.... AIFF',
               'description': 'Audio Interchange File Format',
               'file_extension': 'snd',
               'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
               'offset': 'any'},
              {'ascii': 'FORM.... AIFF',
               'description': 'Audio Interchange File Format',
               'file_extension': 'iff',
               'hex': '46 4F 52 4D nn nn nn nn 41 49 46 46',
               'offset': 'any'},
              {'ascii': 'INDX',
               'description': 'Index file to a file ortape containing abackup done '
               'withAmiBack on anAmiga.',
                              'file_extension': 'idx',
               'hex': '49 4E 44 58',
               'offset': '0'},
              {'ascii': 'LZIP',
               'description': 'lzip compressed file',
               'file_extension': 'lz',
               'hex': '4C 5A 49 50',
               'offset': '0'},
              {'ascii': 'MZ',
               'description': 'DOS MZ executable file format and its descendants '
               '(includingNE andPE)',
                              'file_extension': 'exe',
               'hex': '4D 5A',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'zip',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'jar',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'odt',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'ods',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'odp',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'docx',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'xlsx',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'pptx',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'vsdx',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML',
               'file_extension': 'apk',
               'hex': '50 4B 03 04',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'zip',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'jar',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'odt',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'ods',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'odp',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'docx',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'xlsx',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'pptx',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'vsdx',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(empty archive)',
                              'file_extension': 'apk',
               'hex': '50 4B 05 06',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'zip',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'jar',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'odt',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'ods',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'odp',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'docx',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'xlsx',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'pptx',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'vsdx',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'PK..',
               'description': 'zip file format and formats based on it, such asJAR,ODF,OOXML '
               '(spanned archive)',
                              'file_extension': 'apk',
               'hex': '50 4B 07 08',
               'offset': '0'},
              {'ascii': 'Rar!...',
               'description': 'RAR archive version 1.50 onwards',
               'file_extension': 'rar',
               'hex': '52 61 72 21 1A 07 00',
               'offset': '0'},
              {'ascii': 'Rar!....',
               'description': 'RAR archive version 5.0 onwards',
               'file_extension': 'rar',
               'hex': '52 61 72 21 1A 07 01 00',
               'offset': '0'},
              {'ascii': '.ELF',
               'description': 'Executable and Linkable Format',
               'file_extension': '',
               'hex': '7F 45 4C 46',
               'offset': '0'},
              {'ascii': '.PNG....',
               'description': 'Image encoded in thePortable Network Graphics format',
               'file_extension': 'png',
               'hex': '89 50 4E 47 0D 0A 1A 0A',
               'offset': '0'},
              {'ascii': 'Êþº¾',
               'description': 'Java class file,Mach-O Fat Binary',
               'file_extension': 'class',
               'hex': 'CA FE BA BE',
               'offset': '0'},
              {'ascii': '',
               'description': 'UTF-8 encodedUnicodebyte order mark, commonly seen in text '
               'files.',
                              'file_extension': '',
               'hex': 'EF BB BF',
               'offset': '0'},
              {'ascii': '........',
               'description': 'Mach-O binary (32-bit)',
               'file_extension': '',
               'hex': 'FE ED FA CE',
               'offset': '0'},
              {'ascii': '........',
               'description': 'Mach-O binary (32-bit)',
               'file_extension': '',
               'hex': 'FE ED FA CE',
               'offset': '0x1000'},
              {'ascii': '........',
               'description': 'Mach-O binary (64-bit)',
               'file_extension': '',
               'hex': 'FE ED FA CF',
               'offset': '0'},
              {'ascii': '........',
               'description': 'Mach-O binary (64-bit)',
               'file_extension': '',
               'hex': 'FE ED FA CF',
               'offset': '0x1000'},
              {'ascii': '........',
               'description': 'Mach-O binary (reverse byte ordering scheme, 32-bit)',
               'file_extension': '',
               'hex': 'CE FA ED FE',
               'offset': '0'},
              {'ascii': '........',
               'description': 'Mach-O binary (reverse byte ordering scheme, 64-bit)',
               'file_extension': '',
               'hex': 'CF FA ED FE',
               'offset': '0'},
              {'ascii': '..',
               'description': 'Byte-order mark for text file encoded inlittle-endian16-bit '
               'Unicode Transfer Format',
                              'file_extension': '',
               'hex': 'FF FE',
               'offset': '0'},
              {'ascii': '....',
               'description': 'Byte-order mark for text file encoded in little-endian32-bit '
               'Unicode Transfer Format',
                              'file_extension': '',
               'hex': 'FF FE 00 00',
               'offset': '0'},
              {'ascii': '%!PS',
               'description': 'PostScript document',
               'file_extension': 'ps',
               'hex': '25 21 50 53',
               'offset': '0'},
              {'ascii': '%PDF',
               'description': 'PDF document',
               'file_extension': 'pdf',
               'hex': '25 50 44 46',
               'offset': '0'},
              {'ascii': '0&²u.fÏ .¦Ù.ª.bÎl',
               'description': 'Advanced Systems Format',
               'file_extension': 'asf',
               'hex': '30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C',
               'offset': '0'},
              {'ascii': '0&²u.fÏ .¦Ù.ª.bÎl',
               'description': 'Advanced Systems Format',
               'file_extension': 'wma',
               'hex': '30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C',
               'offset': '0'},
              {'ascii': '0&²u.fÏ .¦Ù.ª.bÎl',
               'description': 'Advanced Systems Format',
               'file_extension': 'wmv',
               'hex': '30 26 B2 75 8E 66 CF 11 A6 D9 00 AA 00 62 CE 6C',
               'offset': '0'},
              {'ascii': '$SDI0001',
               'description': 'System Deployment Image, a disk image format used byMicrosoft',
               'file_extension': '',
               'hex': '24 53 44 49 30 30 30 31',
               'offset': '0'},
              {'ascii': 'OggS',
               'description': 'Ogg, anopen source media container format',
               'file_extension': 'ogg',
               'hex': '4F 67 67 53',
               'offset': '0'},
              {'ascii': 'OggS',
               'description': 'Ogg, anopen source media container format',
               'file_extension': 'oga',
               'hex': '4F 67 67 53',
               'offset': '0'},
              {'ascii': 'OggS',
               'description': 'Ogg, anopen source media container format',
               'file_extension': 'ogv',
               'hex': '4F 67 67 53',
               'offset': '0'},
              {'ascii': '8BPS',
               'description': "Photoshop Document file,Adobe Photoshop's native file format",
               'file_extension': 'psd',
               'hex': '38 42 50 53',
               'offset': '0'},
              {'ascii': 'RIFF.... WAVE',
               'description': 'Waveform Audio File Format',
               'file_extension': 'wav',
               'hex': '52 49 46 46 nn nn nn nn 57 41 56 45',
               'offset': '0'},
              {'ascii': 'RIFF.... AVI.',
               'description': 'Audio Video Interleave video format',
               'file_extension': 'avi',
               'hex': '52 49 46 46 nn nn nn nn 41 56 49 20',
               'offset': '0'},
              {'ascii': 'ÿû',
               'description': 'MPEG-1 Layer 3 file without anID3 tag or with anID3v1 tag '
               "(which's appended at the end of the file)",
                              'file_extension': 'mp3',
               'hex': 'FF FB',
               'offset': '0'},
              {'ascii': 'ID3',
               'description': 'MP3 file with an ID3v2 container',
               'file_extension': 'mp3',
               'hex': '49 44 33',
               'offset': '0'},
              {'ascii': 'BM',
               'description': 'BMP file, abitmap format used mostly in theWindows world',
               'file_extension': 'bmp',
               'hex': '42 4D',
               'offset': '0'},
              {'ascii': 'BM',
               'description': 'BMP file, abitmap format used mostly in theWindows world',
               'file_extension': 'dib',
               'hex': '42 4D',
               'offset': '0'},
              {'ascii': 'BM',
               'description': 'BMP file, abitmap format used mostly in theWindows world',
               'file_extension': 'bmp',
               'hex': '42 4D',
               'offset': '0'},
              {'ascii': 'BM',
               'description': 'BMP file, abitmap format used mostly in theWindows world',
               'file_extension': 'dib',
               'hex': '42 4D',
               'offset': '0'},
              {'ascii': 'CD001',
               'description': 'ISO9660 CD/DVD image file',
               'file_extension': 'iso',
               'hex': '43 44 30 30 31',
               'offset': '0x8001'},
              {'ascii': 'CD001',
               'description': 'ISO9660 CD/DVD image file',
               'file_extension': 'iso',
               'hex': '43 44 30 30 31',
               'offset': '0x8801'},
              {'ascii': 'CD001',
               'description': 'ISO9660 CD/DVD image file',
               'file_extension': 'iso',
               'hex': '43 44 30 30 31',
               'offset': '0x9001'},
              {'ascii': 'SIMPLE   =         T',
               'description': 'Flexible Image Transport System (FITS)',
               'file_extension': 'fits',
               'hex': '53 49 4D 50 4C 45 20 20 3D 20 20 20 20 20 20 20 20 20 20 20 20 20 20'
               '20 20 20 20 20 20 54',
                      'offset': '0'},
              {'ascii': 'fLaC',
               'description': 'Free Lossless Audio Codec',
               'file_extension': 'flac',
               'hex': '66 4C 61 43',
               'offset': '0'},
              {'ascii': 'MThd',
               'description': 'MIDI sound file',
               'file_extension': 'mid',
               'hex': '4D 54 68 64',
               'offset': '0'},
              {'ascii': 'MThd',
               'description': 'MIDI sound file',
               'file_extension': 'midi',
               'hex': '4D 54 68 64',
               'offset': '0'},
              {'ascii': '',
               'description': 'Compound File Binary Format, a container format used for '
               'document by older versions ofMicrosoft Office.It is however '
                              'an open format used by other programs as well.',
                              'file_extension': 'doc',
               'hex': 'D0 CF 11 E0 A1 B1 1A E1',
               'offset': ''},
              {'ascii': '',
               'description': 'Compound File Binary Format, a container format used for '
               'document by older versions ofMicrosoft Office.It is however '
                              'an open format used by other programs as well.',
                              'file_extension': 'xls',
               'hex': 'D0 CF 11 E0 A1 B1 1A E1',
               'offset': ''},
              {'ascii': '',
               'description': 'Compound File Binary Format, a container format used for '
               'document by older versions ofMicrosoft Office.It is however '
                              'an open format used by other programs as well.',
                              'file_extension': 'ppt',
               'hex': 'D0 CF 11 E0 A1 B1 1A E1',
               'offset': ''},
              {'ascii': '',
               'description': 'Compound File Binary Format, a container format used for '
               'document by older versions ofMicrosoft Office.It is however '
                              'an open format used by other programs as well.',
                              'file_extension': 'msg',
               'hex': 'D0 CF 11 E0 A1 B1 1A E1',
               'offset': ''},
              {'ascii': 'dex.035.',
               'description': 'Dalvik Executable',
               'file_extension': 'dex',
               'hex': '64 65 78 0A 30 33 35 00',
               'offset': '0'},
              {'ascii': 'KDM',
               'description': 'VMDK files',
               'file_extension': 'vmdk',
               'hex': '4B 44 4D',
               'offset': '0'},
              {'ascii': 'Cr24',
               'description': 'Google Chrome extensionor packaged app',
               'file_extension': 'crx',
               'hex': '43 72 32 34',
               'offset': '0'},
              {'ascii': 'AGD3',
               'description': 'FreeHand 8 document',
               'file_extension': 'fh8',
               'hex': '41 47 44 33',
               'offset': '0'},
              {'ascii': '....BOBO ........ ....',
               'description': 'AppleWorks 5 document',
               'file_extension': 'cwk',
               'hex': '05 07 00 00 42 4F 42 4F 05 07 00 00 00 00 00 00 00 00 00 00 00 01',
               'offset': '0'},
              {'ascii': '....BOBO ........ ....',
               'description': 'AppleWorks 6 document',
               'file_extension': 'cwk',
               'hex': '06 07 E1 00 42 4F 42 4F 06 07 E1 00 00 00 00 00 00 00 00 00 00 01',
               'offset': '0'},
              {'ascii': 'ER....ãER....',
               'description': 'RoxioToast disc image file, also some .dmg-files begin with '
               'same bytes',
                              'file_extension': 'toast',
               'hex': '45 52 02 00 00 00 8B 45 52 02 00 00 00',
               'offset': '0'},
              {'ascii': 'x.s.bb`',
               'description': 'Apple Disk Image file',
               'file_extension': 'dmg',
               'hex': '78 01 73 0D 62 62 60',
               'offset': '0'},
              {'ascii': 'xar!',
               'description': 'eXtensible Archive format',
               'file_extension': 'xar',
               'hex': '78 61 72 21',
               'offset': '0'},
              {'ascii': 'PMOCCMOC',
               'description': 'Windows Files And Settings Transfer Repository, See also USMT '
               '3.0 (Win XP) and USMT 4.0 (Win 7) User Guides',
                              'file_extension': 'dat',
               'hex': '50 4D 4F 43 43 4D 4F 43',
               'offset': '0'},
              {'ascii': 'NES',
               'description': 'Nintendo Entertainment System ROM file',
               'file_extension': 'nes',
               'hex': '4E 45 53 1A',
               'offset': '0'},
              {'ascii': 'ustar.00ustar  .',
               'description': 'tar archive',
               'file_extension': 'tar',
               'hex': '75 73 74 61 72 00 30 30 75 73 74 61 72 20 20 00',
               'offset': '0x101'},
              {'ascii': 'TOX',
               'description': 'Open source portable voxel file',
               'file_extension': 'tox',
               'hex': '74 6F 78 33',
               'offset': '0'},
              {'ascii': 'MLVI',
               'description': 'Magic Lantern Video file',
               'file_extension': 'MLV',
               'hex': '4D 4C 56 49',
               'offset': '0'},
              {'ascii': 'DCM PA30',
               'description': 'Windows UpdateBinary Delta Compression',
               'file_extension': '',
               'hex': '44 43 4D 01 50 41 33 30',
               'offset': '0'},
              {'ascii': "7z¼¯'",
               'description': '7-Zip File Format',
               'file_extension': '7z',
               'hex': '37 7A BC AF 27 1C',
               'offset': '0'},
              {'ascii': '..',
               'description': 'GZIP',
               'file_extension': 'gz',
               'hex': '1F 8B',
               'offset': '0'},
              {'ascii': '..',
               'description': 'GZIP',
               'file_extension': 'tar.gz',
               'hex': '1F 8B',
               'offset': '0'},
              {'ascii': '."M.',
               'description': 'LZ4 Frame Format, LZ4 block format does not offer any magic '
               'bytes.',
                              'file_extension': 'lz4',
               'hex': '04 22 4D 18',
               'offset': '0'},
              {'ascii': 'MSCF',
               'description': 'Microsoft Cabinet file',
               'file_extension': 'cab',
               'hex': '4D 53 43 46',
               'offset': '0'},
              {'ascii': 'FLIF',
               'description': 'Free Lossless Image Format',
               'file_extension': 'flif',
               'hex': '46 4C 49 46',
               'offset': '0'},
              {'ascii': '.Eߣ',
               'description': 'Matroska media container, includingWebM',
               'file_extension': 'mkv',
               'hex': '1A 45 DF A3',
               'offset': '0'},
              {'ascii': '.Eߣ',
               'description': 'Matroska media container, includingWebM',
               'file_extension': 'mka',
               'hex': '1A 45 DF A3',
               'offset': '0'},
              {'ascii': '.Eߣ',
               'description': 'Matroska media container, includingWebM',
               'file_extension': 'mks',
               'hex': '1A 45 DF A3',
               'offset': '0'},
              {'ascii': '.Eߣ',
               'description': 'Matroska media container, includingWebM',
               'file_extension': 'mk3d',
               'hex': '1A 45 DF A3',
               'offset': '0'},
              {'ascii': '.Eߣ',
               'description': 'Matroska media container, includingWebM',
               'file_extension': 'webm',
               'hex': '1A 45 DF A3',
               'offset': '0'},
              {'ascii': 'MIL',
               'description': '"SEAN\xa0: Session Analysis" Training file. Also used in '
               'compatible software "Rpw\xa0:Rowperfect for Windows" and '
                              '"RP3W\xa0: ROWPERFECT3 for Windows".',
                              'file_extension': 'stg',
               'hex': '4D 49 4C 20',
               'offset': '0'},
              {'ascii': 'AT&TFORM....DJV',
               'description': 'DjVu document. The following byte is either55 (U) for '
               'single-page or4D (M) for multi-page documents.',
                              'file_extension': "['djvu', 'djv']",
               'hex': '41 54 26 54 46 4F 52 4D nn nn nn nn 44 4A 56',
               'offset': '0'},
              {'ascii': 'AT&TFORM....DJV',
               'description': 'DjVu document. The following byte is either55 (U) for '
               'single-page or4D (M) for multi-page documents.',
                              'file_extension': 'djvu',
               'hex': '41 54 26 54 46 4F 52 4D nn nn nn nn 44 4A 56',
               'offset': '0'},
              {'ascii': 'AT&TFORM....DJV',
               'description': 'DjVu document. The following byte is either55 (U) for '
               'single-page or4D (M) for multi-page documents.',
                              'file_extension': 'djv',
               'hex': '41 54 26 54 46 4F 52 4D nn nn nn nn 44 4A 56',
               'offset': '0'},
              {'ascii': '0.',
               'description': 'DER encoded X.509 certificate',
               'file_extension': 'der',
               'hex': '30 82',
               'offset': '0'},
              {'ascii': 'DICM',
               'description': 'DICOM Medical File Format',
               'file_extension': 'dcm',
               'hex': '44 49 43 4D',
               'offset': '0x80'},
              {'ascii': 'wOFF',
               'description': 'WOFF File Format 1.0',
               'file_extension': 'woff',
               'hex': '77 4F 46 46',
               'offset': '0'},
              {'ascii': 'wOF2',
               'description': 'WOFF File Format 2.0',
               'file_extension': 'woff2',
               'hex': '77 4F 46 32',
               'offset': '0'},
              {'ascii': '<?xml',
               'description': 'eXtensible Markup Language when using theASCII character '
               'encoding',
                              'file_extension': 'XML',
               'hex': '3c 3f 78 6d 6c 20',
               'offset': '0'},
              {'ascii': '\\0asm',
               'description': 'WebAssembly binary format',
               'file_extension': 'wasm',
               'hex': '6d 73 61 00',
               'offset': '0'},
              {'ascii': '',
               'description': 'Lepton compressed JPEG image',
               'file_extension': 'lep',
               'hex': 'cf 84 01',
               'offset': '0'},
              {'ascii': 'CWS',
               'description': 'flash .swf',
               'file_extension': 'swf',
               'hex': '43 57 53',
               'offset': '0'},
              {'ascii': 'EWS',
               'description': 'flash .swf',
               'file_extension': 'swf',
               'hex': '46 57 53',
               'offset': '0'},
              {'ascii': '!<arch>.',
               'description': 'linux deb file',
               'file_extension': 'deb',
               'hex': '21 3C 61 72 63 68 3E',
               'offset': '0'},
              {'ascii': 'RIFF....',
               'description': 'Google WebP image file',
               'file_extension': 'webp',
               'hex': '52 49 46 46 nn nn nn nn',
               'offset': '0'},
              {'ascii': 'WEBP',
               'description': '',
               'file_extension': '',
               'hex': '57 45 42 50',
               'offset': ''},
              {'ascii': "'..V",
               'description': 'U-Boot / uImage.Das_U-Boot Universal Boot Loader.',
               'file_extension': '',
               'hex': '27 05 19 56',
               'offset': '0'}]

About

python file signature identifier - Use this to identify files from their headers

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 100.0%