通过文件头标识判断图片格式
通过文件头标识判断图片格式
用Delphi从内存流中通过文件头标识判断图片格式
文件头标识大全:
http://www.garykessler.net/library/file_sigs.html
http://filext.com/index.php
图片的格式很多，一个图片文件的后缀名并不能说明这个图片的真正格式什么，那么如何获取图片的格式呢？我想到了几个简单但有效的方法，那就是读取图片文件的文件头标识。我们知道各种格式的图片的文件头标识识不同的，因此我们可以通过判断文件头的标识来识别图片格式。
我对各种格式的图片文件头标识进行了分析，不仅查找资料，也用十六进制编辑器察看过图片的文件头，以下是我收集、分析的结果，供大家参考。
1.JPEG
- 文件头标识 (2 bytes): $ff, $d8 (SOI) (JPEG 文件标识)
- 文件结束标识 (2 bytes): $ff, $d9 (EOI)
2.TGA
- 未压缩的前5字节 00 00 02 00 00
- RLE压缩的前5字节 00 00 10 00 00
3.PNG
- 文件头标识 (8 bytes) 89 50 4E 47 0D 0A 1A 0A
4.GIF
- 文件头标识 (6 bytes) 47 49 46 38 39(37) 61
G I F 8 9 (7) a
5.BMP
- 文件头标识 (2 bytes) 42 4D
B M
6.PCX
- 文件头标识 (1 bytes) 0A
7.TIFF
- 文件头标识 (2 bytes) 4D 4D 或 49 49
8.ICO
- 文件头标识 (8 bytes) 00 00 01 00 01 00 20 20
9.CUR
- 文件头标识 (8 bytes) 00 00 02 00 01 00 20 20
10.IFF
- 文件头标识 (4 bytes) 46 4F 52 4D
F O R M
11.ANI
- 文件头标识 (4 bytes) 52 49 46 46
R I F F
根据这些文件头标识的收集，我可以写一个识别图像格式的模块了。但是在写这个模块之前可以对收集到的文件头标识进行优化，使得程序中字符串比对次数尽量的少。
1.JPEG我们知需要比对文件头的$ff, $d8这两个字符，而不用读取最后的两个结束标识了。
2.TGA，ICO，CUR只需比对第三个与第五个字符即可。
3.PNG比对[89][50]这两个字符。
4.GIF比对[47][49][46]与第五个字符。
废话不多说了，利用内存流来判断文件的格式，其实判断文件的前几个字节就可以简单的判断这个文件是什么类型的文件，例如
jpg文件 是 FFD8 (从低位到高位就要反过来 D8FF 下面都是一样)
BMP文件 是 424D ---4D42
其他的我就不一一列举了，想知道跟多文件类型分别是用什么字符作为文件的开头的话，下载个C32asm或者UE等这类16进制编辑器就可以看到了。
procedure TForm1.Button1Click(Sender: TObject); //Button1的单击事件
var //声明变量
MyImage:TMemoryStream; //内存流对象
Buffer:Word;
i:integer;
begin
if OpenDialog1.Execute then //OpenDialog1是一个文件打开对话框，在Delphi组件面版的Dialog页中可以找到。
begin
MyImage:=TMemoryStream.Create; //建立内存流对象
try
MyImage.LoadFromFile(OpenDialog1.FileName); //把刚刚用户选择的文件载入到内存流中
MyImage.Position := 0; //移动指针到最开头的位置
if MyImage.Size = 0 then //如果文件大小等于0，那么
begin
//错误
ShowMessage('错误');
Exit;
end;
MyImage.ReadBuffer(Buffer,2); //读取文件的前２个字节，放到Buffer里面
if Buffer=$4D42 then //如果前两个字节是以4D42[低位到高位]
begin
ShowMessage('BMP'); //那么这个是BMP格式的文件
end
else if Buffer=$D8FF then //如果前两个字节是以D8FF[低位到高位]
begin
//JPEG
ShowMessage('JPEG'); //........一样 下面不注释了
end
else if Buffer=$4947 then
begin
//GIF
ShowMessage('GIF');
end
else if Buffer=$050A then
begin
//PCX
ShowMessage('PCX');
end
else if Buffer=$5089 then
begin
//PNG
ShowMessage('PNG');
end
else if Buffer=$4238 then
begin
//PSD
ShowMessage('PSD');
end
else if Buffer=$A659 then
begin
//RAS
ShowMessage('RAS');
end
else if Buffer=$DA01 then
begin
//SGI
ShowMessage('SGI');
end
else if Buffer=$4949 then
begin
//TIFF
ShowMessage('TIFF');
end
else //如是其他类型的文件的话，直接显示错误
begin
//ERR
ShowMessage('ERR');
end; //if
end; //if
finally
MyImage.Free; //释放内存流对象
end;
end;
上面的过程只是简单的判断文件的前2个字节，如果想更加精确一点的话，可以把文件最后2个字节也判断上。
摘自:
http://hi.baidu.com/txbzpfwl/blog/item/fd9b42441a222a8bb2b7dc03.html
http://blog.chinaunix.net/u2/64377/showart_511450.html
**************************************************************************************
各种格式图片文件头标识分析
图片的格式很多，一个图片文件的后缀名并不能说明这个图片的真正格式什么，那么如何获取图片的格式呢？我想到了几个简单但有效的方法，那就是读取图片文件的文件头标识。我们知道各种格式的图片的文件头标识识不同的，因此我们可以通过判断文件头的标识来识别图片格式。
我对各种格式的图片文件头标识进行了分析，不仅查找资料，也用十六进制编辑器察看过图片的文件头，以下是我收集、分析的结果，供大家参考。
1.JPEG
- 文件头标识 (2 bytes): $ff, $d8 (SOI) (JPEG 文件标识)
- 文件结束标识 (2 bytes): $ff, $d9 (EOI)
2.TGA
- 未压缩的前5字节 00 00 02 00 00
- RLE压缩的前5字节 00 00 10 00 00
3.PNG
- 文件头标识 (8 bytes) 89 50 4E 47 0D 0A 1A 0A
4.GIF
- 文件头标识 (6 bytes) 47 49 46 38 39(37) 61
G I F 8 9 (7) a
5.BMP
- 文件头标识 (2 bytes) 42 4D
B M
6.PCX
- 文件头标识 (1 bytes) 0A
7.TIFF
- 文件头标识 (2 bytes) 4D 4D 或 49 49
8.ICO
- 文件头标识 (8 bytes) 00 00 01 00 01 00 20 20
9.CUR
- 文件头标识 (8 bytes) 00 00 02 00 01 00 20 20
10.IFF
- 文件头标识 (4 bytes) 46 4F 52 4D
F O R M
11.ANI
- 文件头标识 (4 bytes) 52 49 46 46
R I F F
根据这些文件头标识的收集，我可以写一个识别图像格式的模块了。但是在写这个模块之前可以对收集到的文件头标识进行优化，使得程序中字符串比对次数尽量的少。
1.JPEG我们知需要比对文件头的$ff, $d8这两个字符，而不用读取最后的两个结束标识了。
2.TGA，ICO，CUR只需比对第三个与第五个字符即可。
3.PNG比对[89][50]这两个字符。
4.GIF比对[47][49][46]与第五个字符。
到这里，我想代码是不难写的，但是为了方便大家我还是把代码贴出来了，如果这代码写的不好，可以与我讨论。您可采用下面的代码，但请保留版权，谢谢！
模块代码如下：
'枚举图片格式种类
Public Enum ImageForm
[BMP] = 0
[JPEG] = 1
[GIF87] = 2
[GIF89] = 3
[PNG] = 4
[TGA Normal] = 5 'TGA未压缩
[TGA RLE] = 6 'TGA经过RLE压缩后的
[PCX] = 7
[TIFF] = 8
[ICO] = 9
[CUR] = 10
[IFF] = 11
[ANI] = 12
[Other] = 13
[FileError] = 14
End Enum
'-----------------------------------------------------------------------
'-----------------------------------------------------------------------
'-- 标题：获取图片的格式
'-- 作者：BEAR-BEN
'-- 制作日期：2007-8-5
'-- 支持的格式：BMP,JPEG,GIF,PNG,TGA,PCX,TIFF,
' ICO,CUR,IFF,ANI 共11种格式
'-- 版本：1.0
'-- 使用者请保留版权，谢谢！
'-----------------------------------------------------------------------
'-----------------------------------------------------------------------
Public Function GetImageFileForm(ImageFilePath As String) As ImageForm
Dim FileHeader(5) As Byte, FileNumber As Integer
GetImageFileForm = FileError
If Dir(ImageFilePath) <> "" Then '判断图片文件是否存在
FileNumber = FreeFile
Open ImageFilePath For Binary As #FileNumber
Get FileNumber, , FileHeader() '二进制流读取图片前5个字符
Close FileNumber
GetImageFileForm = Other
'文件头标识识别
If (FileHeader(0) = 66) And (FileHeader(1) = 77) Then
GetImageFileForm = BMP
Exit Function
End If
If (FileHeader(0) = 255) And (FileHeader(1) = 216) Then
GetImageFileForm = JPEG
Exit Function
End If
If (FileHeader(0) = 71) And (FileHeader(1) = 73) And (FileHeader(2) = 70) And (FileHeader(4) = 57) Then
GetImageFileForm = GIF89
Exit Function
End If
If (FileHeader(0) = 71) And (FileHeader(1) = 73) And (FileHeader(2) = 70) And (FileHeader(4) = 55) Then
GetImageFileForm = GIF87
Exit Function
End If
If (FileHeader(0) = 137) And (FileHeader(1) = 80) Then
GetImageFileForm = PNG
Exit Function
End If
If (FileHeader(0) = 73) And (FileHeader(1) = 73) Then
GetImageFileForm = TIFF 'TIFF 摩托罗拉
Exit Function
End If
If (FileHeader(0) = 77) And (FileHeader(1) = 77) Then
GetImageFileForm = TIFF 'TIFF Intel
Exit Function
End If
If (FileHeader(2) = 1) And (FileHeader(4) = 1) Then
GetImageFileForm = ICO
Exit Function
End If
If (FileHeader(2) = 2) And (FileHeader(4) = 1) Then
GetImageFileForm = CUR
Exit Function
End If
If (FileHeader(0) = 82) And (FileHeader(1) = 73) And (FileHeader(2) = 70) And (FileHeader(3) = 70) Then
GetImageFileForm = ANI
Exit Function
End If
If (FileHeader(2) = 2) And (FileHeader(4) = 0) Then
GetImageFileForm = [TGA Normal]
Exit Function
End If
If (FileHeader(2) = 16) And (FileHeader(4) = 0) Then
GetImageFileForm = [TGA RLE]
Exit Function
End If
If (FileHeader(0) = 10) Then
GetImageFileForm = PCX
Exit Function
End If
End If
End Function
摘自: http://hi.baidu.com/qq625576032/blog/item/a7044a98c02432016e068c35.html
**************************************************************************************
文件头标识大全:
http://www.garykessler.net/library/file_sigs.html
FILE SIGNATURES TABLE
1/27/2010
This table of file signatures (aka "magic numbers") is a continuing work-in-progress. I have found little information on this in a single place, with the exception of the table in Forensic Computing: A Practitioner's Guide by T. Sammes & B. Jenkinson (Springer, 2000); that was my inspiration to start this list. Comments, additions, and queries can be sent to Gary Kessler at gck@garykessler.net.
This list is not exhaustive. Interpret the table as the magic number generally indicating the file type rather than the file type always having the given magic number. If you want to know to what a particular file extension refers, check out some of these sites:
FILExt: The File Extension Source
File Extension Seeker: Metasearch engine for file extensions
fileinfo.net
Wotsit.org, The Programmer's File and Data Format Resource
Dot What!?, The net's #1 file extension website
Other useful and reasonably current sources for file signatures include:
C.E. Codere's File Format site
ProDiscover's headersig.txt file
A magic file commonly available with Unix and Linux systems
You might also want to check out Tim Coakley's Filesig.co.uk site, with Filesig Manager and Simple Carver. Take a look also at Marco Pontello's TrID - File Identifier, a utility designed to identify file types from their binary signatures.
Details on graphics file formats can be found at The Graphics File Formats Page.
The following individuals have given me updates or suggestions for this list over the last couple of years: Devon Ackerman, Vladimir Benko, Sam Brothers, Per Christensson, Jeffrey Duggan, George Harpur, Brian High, Eric Huber, Axel Kesseler, Bill Kuhns, Anand Mani, Kevin Mansell, Michal, Bruce Modick, Lee Nelson, Jorge Paulhiac, Mike Sutton, Franklin Webber, and David Wright. I thank them and apologize if I have missed anyone.
I would like to give particular thanks to Danny Mares of Mares and Company, author of the MaresWare Suite (primarily for the "subheaders" for many of the file types here), and the people at X-Ways Forensicsfor their permission to use their lists of file signatures.
Hex Signature ASCII Signature
File Extension File Description
TGA Truevision Targa Graphic file
Trailer:
54 52 55 45 56 49 53 49 TRUEVISI
4F 4E 2D 58 46 49 4C 45 ON-XFILE
2E 00 ..
00 .
PIC IBM Storyboard bitmap file
PIF Windows Program Information File
SEA Mac Stuffit Self-Extracting Archive
YTR IRIS OCR data file
[11 byte offset]
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 [11 byte offset]
........
........
........
PDB Palmpilot Database/Document File
00 00 00 nn 66 74 79 70
33 67 70 ....ftyp
3gp
3GG, 3GP, 3G2 3rd Generation Partnership Project 3GPP (nn=0x14)
and 3GPP2 (nn=0x20) multimedia files
00 00 00 18 66 74 79 70
33 67 70 35 ....ftyp
3gp5
MP4 MPEG-4 video files
00 00 00 20 66 74 79 70
4D 34 41 20 00 00 00 00 ....ftyp
M4A ....
M4A Apple Lossless Audio Codec file
M4A, M4V QuickTime M4A/M4V file
00 00 01 00 ....
ICO Windows icon file
SPL Windows NT/2000/XP printer spool file
00 00 01 Bx ....
MPEG, MPG MPEG video file
00 00 01 BA ....o
VOB DVD Video Movie File (video/dvd, video/mpeg)
00 00 02 00 ......
CUR Windows cursor file
WB2 QuattroPro for Windows Spreadsheet file
00 00 02 00 06 04 06 00
08 00 00 00 00 00 ........
......
WK1 Lotus 1-2-3 spreadsheet (v1) file
00 00 1A 00 00 10 04 00
00 00 00 00 ........
....
WK3 Lotus 1-2-3 spreadsheet (v3) file
00 00 1A 00 02 10 04 00
00 00 00 00 ........
....
WK4, WK5 Lotus 1-2-3 spreadsheet (v4, v5) file
00 00 1A 00 05 10 04 .......
123 Lotus 1-2-3 spreadsheet (v9) file
00 00 49 49 58 50 52 or ..IIXPR
00 00 4D 4D 58 50 52 ..MMXPR
QXD Quark Express document (Intel & Motorola, respectively)
NOTE: It appears that the byte following the 0x52 ("R") is
the language indicator; 0x33 ("3") seems to indicate English
and 0x61 ("a") reportedly indicates Korean.
00 00 FE FF ..t?
n/a Byte-order mark for 32-bit Unicode Transformation Format/
4-octet Universal Character Set (UTF-32/UCS-4), big-endian files.
(See the Unicode Home Page.)
[7 byte offset]
00 00 FF FF FF FF [7 byte offset]
..????
HLP Windows Help file
00 01 00 00 4D 53 49 53
41 4D 20 44 61 74 61 62
61 73 65 ....MSIS
AM Datab
ase
MNY Microsoft Money file
00 01 00 00 53 74 61 6E
64 61 72 64 20 41 43 45
20 44 42 ....Stan
dard ACE
DB
ACCDB Microsoft Access 2007 file
00 01 00 00 53 74 61 6E
64 61 72 64 20 4A 65 74
20 44 42 ....Stan
dard Jet
DB
MDB Microsoft Access file
00 01 00 08 00 01 00 01
01 ........
.
IMG Ventura Publisher/GEM VDI Image Format Bitmap file
00 01 01 ...
FLT OpenFlight 3D file
00 01 42 41 ..BA
ABA Palm Address Book Archive file
00 01 42 44 ..BD
DBA Palm DateBook Archive file
00 06 15 61 00 00 00 02
00 00 04 D2 00 00 10 00 ...a....
...ò....
DB Netscape Navigator (v4) database file
00 11 AF ..ˉ
FLI FLIC Animation file
00 1E 84 90 00 00 00 00 ..?.....
SNM Netscape Communicator (v4) mail folder
00 5C 41 B1 FF .\A±?
ENC Mujahideen Secrets 2 encrypted file
00 BF .?
SOL Adobe Flash shared object file (e.g., Flash cookies)
[512 byte offset]
00 6E 1E F0 [512 byte offset]
.n.e
PPT PowerPoint presentation subheader (MS Office)
00 FF FF FF FF FF FF FF
FF FF FF 00 00 02 00 01 .???????
???.....
MDF Alcohol 120% CD image
01 00 00 00 ....
EMF Extended (Enhanced) Windows Metafile Format, printer spool file
(0x18-17 & 0xC4-36 is Win2K/NT; 0x5C0-1 is WinXP)
01 00 00 00 01 .....
PIC Unknown type picture file
01 00 09 00 00 03 ......
WMF Windows Metadata file (Win 3.x format)
01 0F 00 00 ....
MDF Microsoft SQL Server 2000 database
01 10 ..
TR1 Novell LANalyzer capture file
01 DA 01 01 00 03 .ú....
RGB Silicon Graphics RGB Bitmap
01 FF 02 04 03 02 .?....
DRW Micrografx vector graphic file
02 64 73 73 .dss
DSS Digital Speech Standard (Olympus, Grundig, & Phillips)
03 .
DAT MapInfo Native Data Format
DB3 dBASE III file
03 00 00 00 ....
QPH Quicken price history file
03 00 00 00 41 50 50 52 ....APPR
ADX Approach index file
04 .
DB4 dBASE IV data file
05 00 00 00 00 00 00 00
08 00 00 00 20 03 00 00 ........
.... ...
n/a INFO2 Windows recycle bin file. NOTE: Bytes 13-14
(0x20-03) indicate the size of each INFO2 record
(0x0320 = 800 bytes).
07 .
DRW A common signature and file extension for many drawing
programs.
07 64 74 32 64 64 74 64 .dt2ddtd
DTD DesignTools 2D Design file
08 .
DB dBASE IV or dBFast configuration file
[512 byte offset]
09 08 10 00 00 06 05 00 [512 byte offset]
........
XLS Excel spreadsheet subheader (MS Office)
0A nn 01 01 ....
PCX ZSOFT Paintbrush file
(where nn = 0x02, 0x03, or 0x05)
0C ED .í
MP Monochrome Picture TIFF bitmap file (unconfirmed)
0D 44 4F 43 .DOC
DOC DeskMate Document file
0E 4E 65 72 6F 49 53 4F .NeroISO
NRI Nero CD Compilation
0E 57 4B 53 .WKS
WKS DeskMate Worksheet
[512 byte offset]
0F 00 E8 03 [512 byte offset]
..è.
PPT PowerPoint presentation subheader (MS Office)
11 00 00 00 53 43 43 41 ....SCCA
PF Windows prefetch file
1A 00 00 ...
NTF Lotus Notes database template
1A 00 00 04 00 00 ......
NSF Lotus Notes database
1A 0x ..
ARC LH archive file, old version
(where x = 0x2, 0x3, 0x4, 0x8 or 0x9
for types 1-5, respectively)
1A 0B ..
PAK Compressed archive file
(often associated with Quake Engine games)
1A 35 01 00 .5..
ETH GN Nettest WinPharoah capture file
1A 45 DF A3 93 42 82 88
6D 61 74 72 6F 73 6B 61 .E?￡“B??
matroska
MKV Matroska stream file
1A 52 54 53 20 43 4F 4D
50 52 45 53 53 45 44 20
49 4D 41 47 45 20 56 31
2E 30 1A .RTS COM
PRESSED
IMAGE V1
.0.
DAT Runtime Software disk image
1D 7D .}
WS WordStar Version 5.0/6.0 document
1F 8B 08 .?.
GZ, TGZ GZIP archive file
1F 9D 90 ...
TAR.Z Compressed tape archive file
21 12 !.
AIN AIN Compressed Archive
21 3C 61 72 63 68 3E 0A !<arch>.
LIB Unix archiver (ar) files and Microsoft Program Library
Common Object File Format (COFF)
21 42 44 4E !BDN
PST Microsoft Outlook Personal Folder file
23 20 #
MSI Cerius2 file
23 20 4D 69 63 72 6F 73
6F 66 74 20 44 65 76 65
6C 6F 70 65 72 20 53 74
75 64 69 6F # Micros
oft Deve
loper St
udio
DSP Microsoft Developer Studio project file
23 21 41 4D 52 #!AMR
AMR Adaptive Multi-Rate ACELP (Algebraic Code Excited Linear Prediction)
Codec, commonly audio format with GSM cell phones
23 3F 52 41 44 49 41 4E
43 45 0A #?RADIAN
CE.
HDR 蔙adiance High Dynamic Range image file
24 46 4C 32 40 28 23 29
20 53 50 53 53 20 44 41
54 41 20 46 49 4C 45 $FL2@(#)
SPSS DA
TA FILE
SAV SPSS Data file
25 21 50 53 2D 41 64 6F
62 65 2D 33 2E 30 20 45
50 53 46 2D 33 20 30 %!PS-Ado
be-3.0 E
PSF-3.0
EPS Adobe encapsulated PostScript file
(If this signature is not at the immediate
beginning of the file, it will occur early
in the file, commonly at byte offset 30)
25 50 44 46 %PDF
PDF, FDF Adobe Portable Document Format and Forms Document file
Trailers:
0A 25 25 45 4F 46 0A (.%%EOF.)
0D 0A 25 25 45 4F 46 0D 0A (..%%EOF..)
0D 25 25 45 4F 46 0D (.%%EOF.)
28 54 68 69 73 20 66 69
6C 65 20 6D 75 73 74 20
62 65 20 63 6F 6E 76 65
72 74 65 64 20 77 69 74
68 20 42 69 6E 48 65 78
20 (This fi
le must
be conve
rted wit
h BinHex
HQX Macintosh BinHex 4 Compressed Archive
2A 2A 2A 20 20 49 6E 73
74 61 6C 6C 61 74 69 6F
6E 20 53 74 61 72 74 65
64 20 *** Ins
tallatio
n Starte
d
LOG Symantec Wise Installer log file
[2 byte offset]
2D 6C 68 [2 byte offset]
-lh
LHA, LZH Compressed archive file
2E 52 45 43 .REC
IVR RealPlayer video file (V11 and later)
2E 52 4D 46 .RMF
RM, RMVB RealMedia streaming media file
2E 52 4D 46 00 00 00 12
00 .RMF....
.
RA RealAudio file
2E 72 61 FD 00 .ray.
RA RealAudio streaming media file
2E 73 6E 64 .snd
AU NeXT/Sun Microsystems μ-Law audio file
30 0
CAT Microsoft security catalog file
30 00 00 00 4C 66 4C 65 0...LfLe
EVT Windows Event Viewer file
30 26 B2 75 8E 66 CF 11
A6 D9 00 AA 00 62 CE 6C 0&2u.f?.
|ù.a.b?l
ASF, WMA, WMV Microsoft Windows Media Audio/Video File
(Advanced Streaming Format)
30 31 4F 52 44 4E 41 4E
43 45 20 53 55 52 56 45
59 20 20 20 20 20 20 20 01ORDNAN
CE SURVE
Y
NTF National Transfer Format Map File
30 37 30 37 30 nn 07070.
n/a Archive created with the cpio utility (where nn
values 0x37 ("7"), 0x31 ("1"), and 0x32 ("2") refer to the
standard ASCII format, new ASCII (aka SVR4) format, and CRC
format, respectively. (The swpackage(8) page has additional
information.) (Thanks to F. Webber for this....)
31 BE or 1?
32 BE 2?
WRI Microsoft Write file
34 CD B2 A1 4í2?
n/a Extended tcpdump (libpcap) capture file (Linux/Unix)
37 7A BC AF 27 1C 7z?ˉ'.
7Z 7-Zip compressed file
38 42 50 53 8BPS
PSD Photoshop image file
3A 56 45 52 53 49 4F 4E :VERSION
SLE Surfplan kite project file
3C <
ASX Advanced Stream redirector file
XDR BizTalk XML-Data Reduced Schema file
3C 21 64 6F 63 74 79 70 <!doctyp
DCI AOL HTML mail file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D <?xml ve
rsion=
MANIFEST Windows Visual Stylesheet XML file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D 22 31
2E 30 22 3F 3E <?xml ve
rsion="1
.0"?>
XUL XML User Interface Language file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D 22 31
2E 30 22 3F 3E 0D 0A 3C
4D 4D 43 5F 43 6F 6E 73
6F 6C 65 46 69 6C 65 20
43 6F 6E 73 6F 6C 65 56
65 72 73 69 6F 6E 3D 22 <?xml ve
rsion="1
.0"?>..<
MMC_Cons
oleFile
ConsoleV
ersion="
MSC Microsoft Management Console Snap-in Control file
3C 4D 61 6B 65 72 46 69
6C 65 20 <MakerFi
le
FM Adobe FrameMaker file
[24 byte offset]
3E 00 03 00 FE FF 09 00
06 [24 byte offset]
>...t?..
.
WB3 Quatro Pro for Windows 7.0 Notebook file
3F 5F 03 00 ?_..
GID Windows Help index file
HLP Windows Help file
[32 byte offset]
40 40 40 20 00 00 40 40
40 40 [32 byte offset]
@@@ ..@@
@@
ENL EndNote Library File
41 43 31 30 AC10
DWG Generic AutoCAD drawing
NOTES on AutoCAD file headers: The 0x41-43-31-30 (AC10) is a generic header, occupying the first
four bytes in the file. The next two bytes give further indication about the version or subtype:
0x30-32 (02) — AutoCAD R2.5
0x30-33 (03) — AutoCAD R2.6
0x30-34 (04) — AutoCAD R9
0x30-36 (06) — AutoCAD R10
0x30-39 (09) — AutoCAD R11/R12
0x31-30 (10) — AutoCAD R13 (subtype 10)
0x31-31 (11) — AutoCAD R13 (subtype 11)
0x31-32 (12) — AutoCAD R13 (subtype 12)
0x31-33 (13) — AutoCAD R14 (subtype 13)
0x31-34 (14) — AutoCAD R14 (subtype 14)
0x31-35 (15) — AutoCAD R2000
0x31-38 (18) — AutoCAD R2004
0x32-31 (21) — AutoCAD R2007
41 43 76 ACL
SLE 蔛teganos Security Suite virtual secure drive
41 43 53 44 ACSD
n/a Miscellaneous AOL parameter and information files
41 4D 59 4F AMYO
SYW Harvard Graphics symbol graphic
41 4F 4C 20 46 65 65 64
62 61 67 AOL Feed
bag
BAG AOL and AIM buddy list file
41 4F 4C 44 42 AOLDB
ABY, IDX AOL database files: address book (ABY) and user configuration
data (MAIN.IDX)
41 4F 4C 49 44 58 AOLIDX
IND AOL client preferences/settings file (MAIN.IND)
41 4F 4C 49 4E 44 45 58 AOLINDEX
ABI AOL address book index file
41 56 47 36 5F 49 6E 74
65 67 72 69 74 79 5F 44
61 74 61 62 61 73 65 AVG6_Int
egrity_D
atabase
DAT AVG6 Integrity database file
41 4F 4C 56 4D 31 30 30 AOLVM100
ORG, PFC AOL personal file cabinet (PFC) file
41 72 43 01 ArC.
ARC FreeArc compressed file
42 45 47 49 4E 3A 56 43
41 52 44 0D 0A BEGIN:VC
ARD..
VCF vCard file
42 4C 49 32 32 33 51 BLI223Q
BIN Thomson Speedtouch series WLAN router firmware
42 4D BM
BMP, DIB Windows (or device-independent) bitmap image
42 4F 4F 4B 4D 4F 42 49 BOOKMOBI
PRC Palmpilot resource file
42 5A 68 BZh
BZ2, TAR.BZ2, TBZ2, TB2 bzip2 compressed archive
43 23 2B 44 A4 43 4D A5
48 64 72 C#+D¤CM￥
Hdr
RTD RagTime document file
43 42 46 49 4C 45 CBFILE
CBD WordPerfect dictionary file (unconfirmed)
43 44 30 30 31 CD001
ISO ISO-9660 CD Disc Image
(This signature usually occurs at byte 8001, 8801, or 9001.)
43 4D 58 31 CMX1
CLB Corel Binary metafile
43 4F 4D 2B COM+
CLB COM+ Catalog file
43 50 54 37 46 49 4C 45 CPT7FILE
CPT Corel Photopaint file
43 50 54 46 49 4C 45 CPTFILE
CPT Corel Photopaint file
43 52 45 47 CREG
DAT Windows 9x registry hive
43 52 55 53 48 20 76 CRUSH v
CRU Crush compressed archive
43 57 53 CWS
SWF Shockwave Flash file (v5+)
43 61 74 61 6C 6F 67 20
33 2E 30 30 00 Catalog
3.00.
CTF WhereIsIt Catalog file
43 6C 69 65 6E 74 20 55
72 6C 43 61 63 68 65 20
4D 4D 46 20 56 65 72 20 Client U
rlCache
MMF Ver
DAT IE History DAT file
44 42 46 48 DBFH
DB Palm Zire photo database
44 4D 53 21 DMS!
DMS Amiga DiskMasher compressed archive
44 4F 53 DOS
ADF Amiga disk file
44 56 44 DVD
DVR DVR-Studio stream file
IFO DVD info file
45 4C 49 54 45 20 43 6F
6D 6D 61 6E 64 65 72 20 ELITE Co
mmander
CDR Elite Plus Commander saved game file
45 4E 54 52 59 56 43 44
02 00 00 01 02 00 18 58 ENTRYVCD
.......X
VCD VideoVCD (GNU VCDImager) file
45 52 46 53 53 41 56 45
44 41 54 41 46 49 4C 45 ERFSSAVE
DATAFILE
DAT Kroll EasyRecovery Saved Recovery State file
45 50 EP
MDI Microsoft Document Imaging file
45 56 46 EVF
Enn (where nn are numbers) EnCase evidence file
45 6C 66 46 69 6C 65 00 ElfFile.
EVTX Windows Vista event log file
45 86 00 00 06 00 E?....
QBB Intuit QuickBooks backup file
46 41 58 43 4F 56 45 52
2D 56 45 52 FAXCOVER
-VER
CPE Microsoft Fax Cover Sheet
46 45 44 46 FEDF
SBV (Unknown file type)
46 4C 56 01 FLV.
FLV Flash video file
46 4F 52 4D 00 FORM.
AIFF Audio Interchange File
46 57 53 FWS
SWF Macromedia Shockwave Flash player file
46 72 6F 6D 20 20 20 or From
46 72 6F 6D 20 3F 3F 3F or From ???
46 72 6F 6D 3A 20 From:
EML A commmon file extension for e-mail files. Signatures shown here
are for Netscape, Eudora, and a generic signature, respectively.
EML is also used by Outlook Express and QuickMail.
47 46 31 50 41 54 43 48 GF1PATCH
PAT Advanced Gravis Ultrasound patch file
47 49 46 38 37 61 or GIF87a
47 49 46 38 39 61 GIF89a
GIF Graphics interchange format file
Trailer: 00 3B (.;)
47 50 41 54 GPAT
PAT GIMP (GNU Image Manipulation Program) pattern file
47 58 32 GX2
GX2 Show Partner graphics file (not confirmed)
48 48 47 42 31 HHGB1
SH3 Harvard Graphics presentation file
49 20 49 I I
TIF, TIFF Tagged Image File Format file
49 44 33 ID3
MP3 MPEG-1 Audio Layer 3 (MP3) audio file
49 44 33 03 00 00 00 ID3....
KOZ Sprint Music Store audio file (for mobile devices)
49 49 2A 00 II*.
TIF, TIFF Tagged Image File Format file (little
endian, i.e., LSB first in the byte; Intel)
49 49 1A 00 00 00 48 45
41 50 43 43 44 52 02 00 II....HE
APCCDR..
CRW Canon digital camera RAW file
49 53 63 28 ISc(
CAB, HDR Install Shield v5.x or 6.x compressed file
49 54 4F 4C 49 54 4C 53 ITOLITLS
LIT Microsoft Reader eBook file
49 54 53 46 ITSF
CHI, CHM Microsoft Compiled HTML Help File
49 6E 6E 6F 20 53 65 74
75 70 20 55 6E 69 6E 73
74 61 6C 6C 20 4C 6F 67
20 28 62 29 Inno Set
up Unins
tall Log
(b)
DAT Inno Setup Uninstall Log file
4A 41 52 43 53 00 JARCS.
JAR JARCS compressed archive
4A 47 03 0E 00 00 00 or JG.....
4A 47 04 0E 00 00 00 JG.....
ART AOL ART file
4B 47 42 5F 61 72 63 68
20 2D KGB_arch
-
KGB KGB archive
4B 49 00 00 KI..
-
SHD Windows 9x printer spool file
4C 00 00 00 01 14 02 00 L.......
LNK Windows shortcut file
4C 01 L.
OBJ Microsoft Common Object File Format (COFF) relocatable
object code file for an Intel 386 or later/compatible processors
4C 4E 02 00 LN..
GID Windows Help index file
HLP Windows Help file
4D 41 52 31 00 MAR1.
MAR Mozilla archive
4D 41 52 43 MARC
MAR Microsoft/MSN MARC archive
4D 41 72 30 00 MAr0.
MAR MAr compressed archive
4D 44 4D 50 93 A7 MDMPҤ
HDMP Windows heap dump file
DMP Windows minidump file
4D 49 4C 45 53 MILES
MLS Milestones v1.0 project management and scheduling software
(Also see "MV2C" and "MV214" signatures)
4D 4C 53 57 MLSW
MLS Skype localization data file
4D 4D 00 2A MM.*
TIF, TIFF Tagged Image File Format file (big
endian, i.e., LSB last in the byte; Motorola)
4D 4D 00 2B MM.+
TIF, TIFF BigTIFF files; Tagged Image File Format files >4 GB
4D 4D 4D 44 00 00 MMMD..
MMF Yamaha Corp. Synthetic music Mobile Application Format (SMAF)
for multimedia files that can be played on hand-held devices.
4D 53 43 46 MSCF
CAB Microsoft cabinet file
PPZ Powerpoint Packaged Presentation
SNP Microsoft Access Snapshot Viewer file
4D 53 46 54 02 00 01 00 MSFT....
TLB OLE, SPSS, or Visual C++ type library file
4D 53 5F 56 4F 49 43 45 MS_VOICE
CDR, DVF Sony Compressed Voice File
MSV Sony Memory Stick Compressed Voice file
4D 54 68 64 MThd
MID, MIDI Musical Instrument Digital Interface (MIDI) sound file
4D 56 MV
DSN CD Stomper Pro label file
4D 56 32 31 34 MV214
MLS Milestones v2.1b project management and scheduling software
(Also see "MILES" and "MV2C" signatures)
4D 56 32 43 MV2C
MLS Milestones v2.1a project management and scheduling software
(Also see "MILES" and "MV214" signatures)
4D 5A MZ
COM, DLL, DRV, EXE, PIF, QTS, QTX, SYS Windows/DOS executable file
ACM MS audio compression manager driver
AX Library cache file
CPL Control panel application
FON Font file
OCX ActiveX or OLE Custom Control
OLB OLE object library
SCR Screen saver
VBX VisualBASIC application
VXD, 386 Windows virtual device drivers
4D 5A 90 00 03 00 00 00 MZ......
API Acrobat plug-in
AX DirectShow filter
FLT Audition graphic filter file (Adobe)
4D 5A 90 00 03 00 00 00
04 00 00 00 FF FF MZ......
....
URL: http://delphi.cjcsoft.net/viewthread.php?tid=2503
文件头标识大全:
http://www.garykessler.net/library/file_sigs.html
http://filext.com/index.php
图片的格式很多，一个图片文件的后缀名并不能说明这个图片的真正格式什么，那么如何获取图片的格式呢？我想到了几个简单但有效的方法，那就是读取图片文件的文件头标识。我们知道各种格式的图片的文件头标识识不同的，因此我们可以通过判断文件头的标识来识别图片格式。
我对各种格式的图片文件头标识进行了分析，不仅查找资料，也用十六进制编辑器察看过图片的文件头，以下是我收集、分析的结果，供大家参考。
1.JPEG
- 文件头标识 (2 bytes): $ff, $d8 (SOI) (JPEG 文件标识)
- 文件结束标识 (2 bytes): $ff, $d9 (EOI)
2.TGA
- 未压缩的前5字节 00 00 02 00 00
- RLE压缩的前5字节 00 00 10 00 00
3.PNG
- 文件头标识 (8 bytes) 89 50 4E 47 0D 0A 1A 0A
4.GIF
- 文件头标识 (6 bytes) 47 49 46 38 39(37) 61
G I F 8 9 (7) a
5.BMP
- 文件头标识 (2 bytes) 42 4D
B M
6.PCX
- 文件头标识 (1 bytes) 0A
7.TIFF
- 文件头标识 (2 bytes) 4D 4D 或 49 49
8.ICO
- 文件头标识 (8 bytes) 00 00 01 00 01 00 20 20
9.CUR
- 文件头标识 (8 bytes) 00 00 02 00 01 00 20 20
10.IFF
- 文件头标识 (4 bytes) 46 4F 52 4D
F O R M
11.ANI
- 文件头标识 (4 bytes) 52 49 46 46
R I F F
根据这些文件头标识的收集，我可以写一个识别图像格式的模块了。但是在写这个模块之前可以对收集到的文件头标识进行优化，使得程序中字符串比对次数尽量的少。
1.JPEG我们知需要比对文件头的$ff, $d8这两个字符，而不用读取最后的两个结束标识了。
2.TGA，ICO，CUR只需比对第三个与第五个字符即可。
3.PNG比对[89][50]这两个字符。
4.GIF比对[47][49][46]与第五个字符。
废话不多说了，利用内存流来判断文件的格式，其实判断文件的前几个字节就可以简单的判断这个文件是什么类型的文件，例如
jpg文件 是 FFD8 (从低位到高位就要反过来 D8FF 下面都是一样)
BMP文件 是 424D ---4D42
其他的我就不一一列举了，想知道跟多文件类型分别是用什么字符作为文件的开头的话，下载个C32asm或者UE等这类16进制编辑器就可以看到了。
procedure TForm1.Button1Click(Sender: TObject); //Button1的单击事件
var //声明变量
MyImage:TMemoryStream; //内存流对象
Buffer:Word;
i:integer;
begin
if OpenDialog1.Execute then //OpenDialog1是一个文件打开对话框，在Delphi组件面版的Dialog页中可以找到。
begin
MyImage:=TMemoryStream.Create; //建立内存流对象
try
MyImage.LoadFromFile(OpenDialog1.FileName); //把刚刚用户选择的文件载入到内存流中
MyImage.Position := 0; //移动指针到最开头的位置
if MyImage.Size = 0 then //如果文件大小等于0，那么
begin
//错误
ShowMessage('错误');
Exit;
end;
MyImage.ReadBuffer(Buffer,2); //读取文件的前２个字节，放到Buffer里面
if Buffer=$4D42 then //如果前两个字节是以4D42[低位到高位]
begin
ShowMessage('BMP'); //那么这个是BMP格式的文件
end
else if Buffer=$D8FF then //如果前两个字节是以D8FF[低位到高位]
begin
//JPEG
ShowMessage('JPEG'); //........一样 下面不注释了
end
else if Buffer=$4947 then
begin
//GIF
ShowMessage('GIF');
end
else if Buffer=$050A then
begin
//PCX
ShowMessage('PCX');
end
else if Buffer=$5089 then
begin
//PNG
ShowMessage('PNG');
end
else if Buffer=$4238 then
begin
//PSD
ShowMessage('PSD');
end
else if Buffer=$A659 then
begin
//RAS
ShowMessage('RAS');
end
else if Buffer=$DA01 then
begin
//SGI
ShowMessage('SGI');
end
else if Buffer=$4949 then
begin
//TIFF
ShowMessage('TIFF');
end
else //如是其他类型的文件的话，直接显示错误
begin
//ERR
ShowMessage('ERR');
end; //if
end; //if
finally
MyImage.Free; //释放内存流对象
end;
end;
上面的过程只是简单的判断文件的前2个字节，如果想更加精确一点的话，可以把文件最后2个字节也判断上。
摘自:
http://hi.baidu.com/txbzpfwl/blog/item/fd9b42441a222a8bb2b7dc03.html
http://blog.chinaunix.net/u2/64377/showart_511450.html
**************************************************************************************
各种格式图片文件头标识分析
图片的格式很多，一个图片文件的后缀名并不能说明这个图片的真正格式什么，那么如何获取图片的格式呢？我想到了几个简单但有效的方法，那就是读取图片文件的文件头标识。我们知道各种格式的图片的文件头标识识不同的，因此我们可以通过判断文件头的标识来识别图片格式。
我对各种格式的图片文件头标识进行了分析，不仅查找资料，也用十六进制编辑器察看过图片的文件头，以下是我收集、分析的结果，供大家参考。
1.JPEG
- 文件头标识 (2 bytes): $ff, $d8 (SOI) (JPEG 文件标识)
- 文件结束标识 (2 bytes): $ff, $d9 (EOI)
2.TGA
- 未压缩的前5字节 00 00 02 00 00
- RLE压缩的前5字节 00 00 10 00 00
3.PNG
- 文件头标识 (8 bytes) 89 50 4E 47 0D 0A 1A 0A
4.GIF
- 文件头标识 (6 bytes) 47 49 46 38 39(37) 61
G I F 8 9 (7) a
5.BMP
- 文件头标识 (2 bytes) 42 4D
B M
6.PCX
- 文件头标识 (1 bytes) 0A
7.TIFF
- 文件头标识 (2 bytes) 4D 4D 或 49 49
8.ICO
- 文件头标识 (8 bytes) 00 00 01 00 01 00 20 20
9.CUR
- 文件头标识 (8 bytes) 00 00 02 00 01 00 20 20
10.IFF
- 文件头标识 (4 bytes) 46 4F 52 4D
F O R M
11.ANI
- 文件头标识 (4 bytes) 52 49 46 46
R I F F
根据这些文件头标识的收集，我可以写一个识别图像格式的模块了。但是在写这个模块之前可以对收集到的文件头标识进行优化，使得程序中字符串比对次数尽量的少。
1.JPEG我们知需要比对文件头的$ff, $d8这两个字符，而不用读取最后的两个结束标识了。
2.TGA，ICO，CUR只需比对第三个与第五个字符即可。
3.PNG比对[89][50]这两个字符。
4.GIF比对[47][49][46]与第五个字符。
到这里，我想代码是不难写的，但是为了方便大家我还是把代码贴出来了，如果这代码写的不好，可以与我讨论。您可采用下面的代码，但请保留版权，谢谢！
模块代码如下：
'枚举图片格式种类
Public Enum ImageForm
[BMP] = 0
[JPEG] = 1
[GIF87] = 2
[GIF89] = 3
[PNG] = 4
[TGA Normal] = 5 'TGA未压缩
[TGA RLE] = 6 'TGA经过RLE压缩后的
[PCX] = 7
[TIFF] = 8
[ICO] = 9
[CUR] = 10
[IFF] = 11
[ANI] = 12
[Other] = 13
[FileError] = 14
End Enum
'-----------------------------------------------------------------------
'-----------------------------------------------------------------------
'-- 标题：获取图片的格式
'-- 作者：BEAR-BEN
'-- 制作日期：2007-8-5
'-- 支持的格式：BMP,JPEG,GIF,PNG,TGA,PCX,TIFF,
' ICO,CUR,IFF,ANI 共11种格式
'-- 版本：1.0
'-- 使用者请保留版权，谢谢！
'-----------------------------------------------------------------------
'-----------------------------------------------------------------------
Public Function GetImageFileForm(ImageFilePath As String) As ImageForm
Dim FileHeader(5) As Byte, FileNumber As Integer
GetImageFileForm = FileError
If Dir(ImageFilePath) <> "" Then '判断图片文件是否存在
FileNumber = FreeFile
Open ImageFilePath For Binary As #FileNumber
Get FileNumber, , FileHeader() '二进制流读取图片前5个字符
Close FileNumber
GetImageFileForm = Other
'文件头标识识别
If (FileHeader(0) = 66) And (FileHeader(1) = 77) Then
GetImageFileForm = BMP
Exit Function
End If
If (FileHeader(0) = 255) And (FileHeader(1) = 216) Then
GetImageFileForm = JPEG
Exit Function
End If
If (FileHeader(0) = 71) And (FileHeader(1) = 73) And (FileHeader(2) = 70) And (FileHeader(4) = 57) Then
GetImageFileForm = GIF89
Exit Function
End If
If (FileHeader(0) = 71) And (FileHeader(1) = 73) And (FileHeader(2) = 70) And (FileHeader(4) = 55) Then
GetImageFileForm = GIF87
Exit Function
End If
If (FileHeader(0) = 137) And (FileHeader(1) = 80) Then
GetImageFileForm = PNG
Exit Function
End If
If (FileHeader(0) = 73) And (FileHeader(1) = 73) Then
GetImageFileForm = TIFF 'TIFF 摩托罗拉
Exit Function
End If
If (FileHeader(0) = 77) And (FileHeader(1) = 77) Then
GetImageFileForm = TIFF 'TIFF Intel
Exit Function
End If
If (FileHeader(2) = 1) And (FileHeader(4) = 1) Then
GetImageFileForm = ICO
Exit Function
End If
If (FileHeader(2) = 2) And (FileHeader(4) = 1) Then
GetImageFileForm = CUR
Exit Function
End If
If (FileHeader(0) = 82) And (FileHeader(1) = 73) And (FileHeader(2) = 70) And (FileHeader(3) = 70) Then
GetImageFileForm = ANI
Exit Function
End If
If (FileHeader(2) = 2) And (FileHeader(4) = 0) Then
GetImageFileForm = [TGA Normal]
Exit Function
End If
If (FileHeader(2) = 16) And (FileHeader(4) = 0) Then
GetImageFileForm = [TGA RLE]
Exit Function
End If
If (FileHeader(0) = 10) Then
GetImageFileForm = PCX
Exit Function
End If
End If
End Function
摘自: http://hi.baidu.com/qq625576032/blog/item/a7044a98c02432016e068c35.html
**************************************************************************************
文件头标识大全:
http://www.garykessler.net/library/file_sigs.html
FILE SIGNATURES TABLE
1/27/2010
This table of file signatures (aka "magic numbers") is a continuing work-in-progress. I have found little information on this in a single place, with the exception of the table in Forensic Computing: A Practitioner's Guide by T. Sammes & B. Jenkinson (Springer, 2000); that was my inspiration to start this list. Comments, additions, and queries can be sent to Gary Kessler at gck@garykessler.net.
This list is not exhaustive. Interpret the table as the magic number generally indicating the file type rather than the file type always having the given magic number. If you want to know to what a particular file extension refers, check out some of these sites:
FILExt: The File Extension Source
File Extension Seeker: Metasearch engine for file extensions
fileinfo.net
Wotsit.org, The Programmer's File and Data Format Resource
Dot What!?, The net's #1 file extension website
Other useful and reasonably current sources for file signatures include:
C.E. Codere's File Format site
ProDiscover's headersig.txt file
A magic file commonly available with Unix and Linux systems
You might also want to check out Tim Coakley's Filesig.co.uk site, with Filesig Manager and Simple Carver. Take a look also at Marco Pontello's TrID - File Identifier, a utility designed to identify file types from their binary signatures.
Details on graphics file formats can be found at The Graphics File Formats Page.
The following individuals have given me updates or suggestions for this list over the last couple of years: Devon Ackerman, Vladimir Benko, Sam Brothers, Per Christensson, Jeffrey Duggan, George Harpur, Brian High, Eric Huber, Axel Kesseler, Bill Kuhns, Anand Mani, Kevin Mansell, Michal, Bruce Modick, Lee Nelson, Jorge Paulhiac, Mike Sutton, Franklin Webber, and David Wright. I thank them and apologize if I have missed anyone.
I would like to give particular thanks to Danny Mares of Mares and Company, author of the MaresWare Suite (primarily for the "subheaders" for many of the file types here), and the people at X-Ways Forensicsfor their permission to use their lists of file signatures.
Hex Signature ASCII Signature
File Extension File Description
TGA Truevision Targa Graphic file
Trailer:
54 52 55 45 56 49 53 49 TRUEVISI
4F 4E 2D 58 46 49 4C 45 ON-XFILE
2E 00 ..
00 .
PIC IBM Storyboard bitmap file
PIF Windows Program Information File
SEA Mac Stuffit Self-Extracting Archive
YTR IRIS OCR data file
[11 byte offset]
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 [11 byte offset]
........
........
........
PDB Palmpilot Database/Document File
00 00 00 nn 66 74 79 70
33 67 70 ....ftyp
3gp
3GG, 3GP, 3G2 3rd Generation Partnership Project 3GPP (nn=0x14)
and 3GPP2 (nn=0x20) multimedia files
00 00 00 18 66 74 79 70
33 67 70 35 ....ftyp
3gp5
MP4 MPEG-4 video files
00 00 00 20 66 74 79 70
4D 34 41 20 00 00 00 00 ....ftyp
M4A ....
M4A Apple Lossless Audio Codec file
M4A, M4V QuickTime M4A/M4V file
00 00 01 00 ....
ICO Windows icon file
SPL Windows NT/2000/XP printer spool file
00 00 01 Bx ....
MPEG, MPG MPEG video file
00 00 01 BA ....o
VOB DVD Video Movie File (video/dvd, video/mpeg)
00 00 02 00 ......
CUR Windows cursor file
WB2 QuattroPro for Windows Spreadsheet file
00 00 02 00 06 04 06 00
08 00 00 00 00 00 ........
......
WK1 Lotus 1-2-3 spreadsheet (v1) file
00 00 1A 00 00 10 04 00
00 00 00 00 ........
....
WK3 Lotus 1-2-3 spreadsheet (v3) file
00 00 1A 00 02 10 04 00
00 00 00 00 ........
....
WK4, WK5 Lotus 1-2-3 spreadsheet (v4, v5) file
00 00 1A 00 05 10 04 .......
123 Lotus 1-2-3 spreadsheet (v9) file
00 00 49 49 58 50 52 or ..IIXPR
00 00 4D 4D 58 50 52 ..MMXPR
QXD Quark Express document (Intel & Motorola, respectively)
NOTE: It appears that the byte following the 0x52 ("R") is
the language indicator; 0x33 ("3") seems to indicate English
and 0x61 ("a") reportedly indicates Korean.
00 00 FE FF ..t?
n/a Byte-order mark for 32-bit Unicode Transformation Format/
4-octet Universal Character Set (UTF-32/UCS-4), big-endian files.
(See the Unicode Home Page.)
[7 byte offset]
00 00 FF FF FF FF [7 byte offset]
..????
HLP Windows Help file
00 01 00 00 4D 53 49 53
41 4D 20 44 61 74 61 62
61 73 65 ....MSIS
AM Datab
ase
MNY Microsoft Money file
00 01 00 00 53 74 61 6E
64 61 72 64 20 41 43 45
20 44 42 ....Stan
dard ACE
DB
ACCDB Microsoft Access 2007 file
00 01 00 00 53 74 61 6E
64 61 72 64 20 4A 65 74
20 44 42 ....Stan
dard Jet
DB
MDB Microsoft Access file
00 01 00 08 00 01 00 01
01 ........
.
IMG Ventura Publisher/GEM VDI Image Format Bitmap file
00 01 01 ...
FLT OpenFlight 3D file
00 01 42 41 ..BA
ABA Palm Address Book Archive file
00 01 42 44 ..BD
DBA Palm DateBook Archive file
00 06 15 61 00 00 00 02
00 00 04 D2 00 00 10 00 ...a....
...ò....
DB Netscape Navigator (v4) database file
00 11 AF ..ˉ
FLI FLIC Animation file
00 1E 84 90 00 00 00 00 ..?.....
SNM Netscape Communicator (v4) mail folder
00 5C 41 B1 FF .\A±?
ENC Mujahideen Secrets 2 encrypted file
00 BF .?
SOL Adobe Flash shared object file (e.g., Flash cookies)
[512 byte offset]
00 6E 1E F0 [512 byte offset]
.n.e
PPT PowerPoint presentation subheader (MS Office)
00 FF FF FF FF FF FF FF
FF FF FF 00 00 02 00 01 .???????
???.....
MDF Alcohol 120% CD image
01 00 00 00 ....
EMF Extended (Enhanced) Windows Metafile Format, printer spool file
(0x18-17 & 0xC4-36 is Win2K/NT; 0x5C0-1 is WinXP)
01 00 00 00 01 .....
PIC Unknown type picture file
01 00 09 00 00 03 ......
WMF Windows Metadata file (Win 3.x format)
01 0F 00 00 ....
MDF Microsoft SQL Server 2000 database
01 10 ..
TR1 Novell LANalyzer capture file
01 DA 01 01 00 03 .ú....
RGB Silicon Graphics RGB Bitmap
01 FF 02 04 03 02 .?....
DRW Micrografx vector graphic file
02 64 73 73 .dss
DSS Digital Speech Standard (Olympus, Grundig, & Phillips)
03 .
DAT MapInfo Native Data Format
DB3 dBASE III file
03 00 00 00 ....
QPH Quicken price history file
03 00 00 00 41 50 50 52 ....APPR
ADX Approach index file
04 .
DB4 dBASE IV data file
05 00 00 00 00 00 00 00
08 00 00 00 20 03 00 00 ........
.... ...
n/a INFO2 Windows recycle bin file. NOTE: Bytes 13-14
(0x20-03) indicate the size of each INFO2 record
(0x0320 = 800 bytes).
07 .
DRW A common signature and file extension for many drawing
programs.
07 64 74 32 64 64 74 64 .dt2ddtd
DTD DesignTools 2D Design file
08 .
DB dBASE IV or dBFast configuration file
[512 byte offset]
09 08 10 00 00 06 05 00 [512 byte offset]
........
XLS Excel spreadsheet subheader (MS Office)
0A nn 01 01 ....
PCX ZSOFT Paintbrush file
(where nn = 0x02, 0x03, or 0x05)
0C ED .í
MP Monochrome Picture TIFF bitmap file (unconfirmed)
0D 44 4F 43 .DOC
DOC DeskMate Document file
0E 4E 65 72 6F 49 53 4F .NeroISO
NRI Nero CD Compilation
0E 57 4B 53 .WKS
WKS DeskMate Worksheet
[512 byte offset]
0F 00 E8 03 [512 byte offset]
..è.
PPT PowerPoint presentation subheader (MS Office)
11 00 00 00 53 43 43 41 ....SCCA
PF Windows prefetch file
1A 00 00 ...
NTF Lotus Notes database template
1A 00 00 04 00 00 ......
NSF Lotus Notes database
1A 0x ..
ARC LH archive file, old version
(where x = 0x2, 0x3, 0x4, 0x8 or 0x9
for types 1-5, respectively)
1A 0B ..
PAK Compressed archive file
(often associated with Quake Engine games)
1A 35 01 00 .5..
ETH GN Nettest WinPharoah capture file
1A 45 DF A3 93 42 82 88
6D 61 74 72 6F 73 6B 61 .E?￡“B??
matroska
MKV Matroska stream file
1A 52 54 53 20 43 4F 4D
50 52 45 53 53 45 44 20
49 4D 41 47 45 20 56 31
2E 30 1A .RTS COM
PRESSED
IMAGE V1
.0.
DAT Runtime Software disk image
1D 7D .}
WS WordStar Version 5.0/6.0 document
1F 8B 08 .?.
GZ, TGZ GZIP archive file
1F 9D 90 ...
TAR.Z Compressed tape archive file
21 12 !.
AIN AIN Compressed Archive
21 3C 61 72 63 68 3E 0A !<arch>.
LIB Unix archiver (ar) files and Microsoft Program Library
Common Object File Format (COFF)
21 42 44 4E !BDN
PST Microsoft Outlook Personal Folder file
23 20 #
MSI Cerius2 file
23 20 4D 69 63 72 6F 73
6F 66 74 20 44 65 76 65
6C 6F 70 65 72 20 53 74
75 64 69 6F # Micros
oft Deve
loper St
udio
DSP Microsoft Developer Studio project file
23 21 41 4D 52 #!AMR
AMR Adaptive Multi-Rate ACELP (Algebraic Code Excited Linear Prediction)
Codec, commonly audio format with GSM cell phones
23 3F 52 41 44 49 41 4E
43 45 0A #?RADIAN
CE.
HDR 蔙adiance High Dynamic Range image file
24 46 4C 32 40 28 23 29
20 53 50 53 53 20 44 41
54 41 20 46 49 4C 45 $FL2@(#)
SPSS DA
TA FILE
SAV SPSS Data file
25 21 50 53 2D 41 64 6F
62 65 2D 33 2E 30 20 45
50 53 46 2D 33 20 30 %!PS-Ado
be-3.0 E
PSF-3.0
EPS Adobe encapsulated PostScript file
(If this signature is not at the immediate
beginning of the file, it will occur early
in the file, commonly at byte offset 30)
25 50 44 46 %PDF
PDF, FDF Adobe Portable Document Format and Forms Document file
Trailers:
0A 25 25 45 4F 46 0A (.%%EOF.)
0D 0A 25 25 45 4F 46 0D 0A (..%%EOF..)
0D 25 25 45 4F 46 0D (.%%EOF.)
28 54 68 69 73 20 66 69
6C 65 20 6D 75 73 74 20
62 65 20 63 6F 6E 76 65
72 74 65 64 20 77 69 74
68 20 42 69 6E 48 65 78
20 (This fi
le must
be conve
rted wit
h BinHex
HQX Macintosh BinHex 4 Compressed Archive
2A 2A 2A 20 20 49 6E 73
74 61 6C 6C 61 74 69 6F
6E 20 53 74 61 72 74 65
64 20 *** Ins
tallatio
n Starte
d
LOG Symantec Wise Installer log file
[2 byte offset]
2D 6C 68 [2 byte offset]
-lh
LHA, LZH Compressed archive file
2E 52 45 43 .REC
IVR RealPlayer video file (V11 and later)
2E 52 4D 46 .RMF
RM, RMVB RealMedia streaming media file
2E 52 4D 46 00 00 00 12
00 .RMF....
.
RA RealAudio file
2E 72 61 FD 00 .ray.
RA RealAudio streaming media file
2E 73 6E 64 .snd
AU NeXT/Sun Microsystems μ-Law audio file
30 0
CAT Microsoft security catalog file
30 00 00 00 4C 66 4C 65 0...LfLe
EVT Windows Event Viewer file
30 26 B2 75 8E 66 CF 11
A6 D9 00 AA 00 62 CE 6C 0&2u.f?.
|ù.a.b?l
ASF, WMA, WMV Microsoft Windows Media Audio/Video File
(Advanced Streaming Format)
30 31 4F 52 44 4E 41 4E
43 45 20 53 55 52 56 45
59 20 20 20 20 20 20 20 01ORDNAN
CE SURVE
Y
NTF National Transfer Format Map File
30 37 30 37 30 nn 07070.
n/a Archive created with the cpio utility (where nn
values 0x37 ("7"), 0x31 ("1"), and 0x32 ("2") refer to the
standard ASCII format, new ASCII (aka SVR4) format, and CRC
format, respectively. (The swpackage(8) page has additional
information.) (Thanks to F. Webber for this....)
31 BE or 1?
32 BE 2?
WRI Microsoft Write file
34 CD B2 A1 4í2?
n/a Extended tcpdump (libpcap) capture file (Linux/Unix)
37 7A BC AF 27 1C 7z?ˉ'.
7Z 7-Zip compressed file
38 42 50 53 8BPS
PSD Photoshop image file
3A 56 45 52 53 49 4F 4E :VERSION
SLE Surfplan kite project file
3C <
ASX Advanced Stream redirector file
XDR BizTalk XML-Data Reduced Schema file
3C 21 64 6F 63 74 79 70 <!doctyp
DCI AOL HTML mail file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D <?xml ve
rsion=
MANIFEST Windows Visual Stylesheet XML file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D 22 31
2E 30 22 3F 3E <?xml ve
rsion="1
.0"?>
XUL XML User Interface Language file
3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D 22 31
2E 30 22 3F 3E 0D 0A 3C
4D 4D 43 5F 43 6F 6E 73
6F 6C 65 46 69 6C 65 20
43 6F 6E 73 6F 6C 65 56
65 72 73 69 6F 6E 3D 22 <?xml ve
rsion="1
.0"?>..<
MMC_Cons
oleFile
ConsoleV
ersion="
MSC Microsoft Management Console Snap-in Control file
3C 4D 61 6B 65 72 46 69
6C 65 20 <MakerFi
le
FM Adobe FrameMaker file
[24 byte offset]
3E 00 03 00 FE FF 09 00
06 [24 byte offset]
>...t?..
.
WB3 Quatro Pro for Windows 7.0 Notebook file
3F 5F 03 00 ?_..
GID Windows Help index file
HLP Windows Help file
[32 byte offset]
40 40 40 20 00 00 40 40
40 40 [32 byte offset]
@@@ ..@@
@@
ENL EndNote Library File
41 43 31 30 AC10
DWG Generic AutoCAD drawing
NOTES on AutoCAD file headers: The 0x41-43-31-30 (AC10) is a generic header, occupying the first
four bytes in the file. The next two bytes give further indication about the version or subtype:
0x30-32 (02) — AutoCAD R2.5
0x30-33 (03) — AutoCAD R2.6
0x30-34 (04) — AutoCAD R9
0x30-36 (06) — AutoCAD R10
0x30-39 (09) — AutoCAD R11/R12
0x31-30 (10) — AutoCAD R13 (subtype 10)
0x31-31 (11) — AutoCAD R13 (subtype 11)
0x31-32 (12) — AutoCAD R13 (subtype 12)
0x31-33 (13) — AutoCAD R14 (subtype 13)
0x31-34 (14) — AutoCAD R14 (subtype 14)
0x31-35 (15) — AutoCAD R2000
0x31-38 (18) — AutoCAD R2004
0x32-31 (21) — AutoCAD R2007
41 43 76 ACL
SLE 蔛teganos Security Suite virtual secure drive
41 43 53 44 ACSD
n/a Miscellaneous AOL parameter and information files
41 4D 59 4F AMYO
SYW Harvard Graphics symbol graphic
41 4F 4C 20 46 65 65 64
62 61 67 AOL Feed
bag
BAG AOL and AIM buddy list file
41 4F 4C 44 42 AOLDB
ABY, IDX AOL database files: address book (ABY) and user configuration
data (MAIN.IDX)
41 4F 4C 49 44 58 AOLIDX
IND AOL client preferences/settings file (MAIN.IND)
41 4F 4C 49 4E 44 45 58 AOLINDEX
ABI AOL address book index file
41 56 47 36 5F 49 6E 74
65 67 72 69 74 79 5F 44
61 74 61 62 61 73 65 AVG6_Int
egrity_D
atabase
DAT AVG6 Integrity database file
41 4F 4C 56 4D 31 30 30 AOLVM100
ORG, PFC AOL personal file cabinet (PFC) file
41 72 43 01 ArC.
ARC FreeArc compressed file
42 45 47 49 4E 3A 56 43
41 52 44 0D 0A BEGIN:VC
ARD..
VCF vCard file
42 4C 49 32 32 33 51 BLI223Q
BIN Thomson Speedtouch series WLAN router firmware
42 4D BM
BMP, DIB Windows (or device-independent) bitmap image
42 4F 4F 4B 4D 4F 42 49 BOOKMOBI
PRC Palmpilot resource file
42 5A 68 BZh
BZ2, TAR.BZ2, TBZ2, TB2 bzip2 compressed archive
43 23 2B 44 A4 43 4D A5
48 64 72 C#+D¤CM￥
Hdr
RTD RagTime document file
43 42 46 49 4C 45 CBFILE
CBD WordPerfect dictionary file (unconfirmed)
43 44 30 30 31 CD001
ISO ISO-9660 CD Disc Image
(This signature usually occurs at byte 8001, 8801, or 9001.)
43 4D 58 31 CMX1
CLB Corel Binary metafile
43 4F 4D 2B COM+
CLB COM+ Catalog file
43 50 54 37 46 49 4C 45 CPT7FILE
CPT Corel Photopaint file
43 50 54 46 49 4C 45 CPTFILE
CPT Corel Photopaint file
43 52 45 47 CREG
DAT Windows 9x registry hive
43 52 55 53 48 20 76 CRUSH v
CRU Crush compressed archive
43 57 53 CWS
SWF Shockwave Flash file (v5+)
43 61 74 61 6C 6F 67 20
33 2E 30 30 00 Catalog
3.00.
CTF WhereIsIt Catalog file
43 6C 69 65 6E 74 20 55
72 6C 43 61 63 68 65 20
4D 4D 46 20 56 65 72 20 Client U
rlCache
MMF Ver
DAT IE History DAT file
44 42 46 48 DBFH
DB Palm Zire photo database
44 4D 53 21 DMS!
DMS Amiga DiskMasher compressed archive
44 4F 53 DOS
ADF Amiga disk file
44 56 44 DVD
DVR DVR-Studio stream file
IFO DVD info file
45 4C 49 54 45 20 43 6F
6D 6D 61 6E 64 65 72 20 ELITE Co
mmander
CDR Elite Plus Commander saved game file
45 4E 54 52 59 56 43 44
02 00 00 01 02 00 18 58 ENTRYVCD
.......X
VCD VideoVCD (GNU VCDImager) file
45 52 46 53 53 41 56 45
44 41 54 41 46 49 4C 45 ERFSSAVE
DATAFILE
DAT Kroll EasyRecovery Saved Recovery State file
45 50 EP
MDI Microsoft Document Imaging file
45 56 46 EVF
Enn (where nn are numbers) EnCase evidence file
45 6C 66 46 69 6C 65 00 ElfFile.
EVTX Windows Vista event log file
45 86 00 00 06 00 E?....
QBB Intuit QuickBooks backup file
46 41 58 43 4F 56 45 52
2D 56 45 52 FAXCOVER
-VER
CPE Microsoft Fax Cover Sheet
46 45 44 46 FEDF
SBV (Unknown file type)
46 4C 56 01 FLV.
FLV Flash video file
46 4F 52 4D 00 FORM.
AIFF Audio Interchange File
46 57 53 FWS
SWF Macromedia Shockwave Flash player file
46 72 6F 6D 20 20 20 or From
46 72 6F 6D 20 3F 3F 3F or From ???
46 72 6F 6D 3A 20 From:
EML A commmon file extension for e-mail files. Signatures shown here
are for Netscape, Eudora, and a generic signature, respectively.
EML is also used by Outlook Express and QuickMail.
47 46 31 50 41 54 43 48 GF1PATCH
PAT Advanced Gravis Ultrasound patch file
47 49 46 38 37 61 or GIF87a
47 49 46 38 39 61 GIF89a
GIF Graphics interchange format file
Trailer: 00 3B (.;)
47 50 41 54 GPAT
PAT GIMP (GNU Image Manipulation Program) pattern file
47 58 32 GX2
GX2 Show Partner graphics file (not confirmed)
48 48 47 42 31 HHGB1
SH3 Harvard Graphics presentation file
49 20 49 I I
TIF, TIFF Tagged Image File Format file
49 44 33 ID3
MP3 MPEG-1 Audio Layer 3 (MP3) audio file
49 44 33 03 00 00 00 ID3....
KOZ Sprint Music Store audio file (for mobile devices)
49 49 2A 00 II*.
TIF, TIFF Tagged Image File Format file (little
endian, i.e., LSB first in the byte; Intel)
49 49 1A 00 00 00 48 45
41 50 43 43 44 52 02 00 II....HE
APCCDR..
CRW Canon digital camera RAW file
49 53 63 28 ISc(
CAB, HDR Install Shield v5.x or 6.x compressed file
49 54 4F 4C 49 54 4C 53 ITOLITLS
LIT Microsoft Reader eBook file
49 54 53 46 ITSF
CHI, CHM Microsoft Compiled HTML Help File
49 6E 6E 6F 20 53 65 74
75 70 20 55 6E 69 6E 73
74 61 6C 6C 20 4C 6F 67
20 28 62 29 Inno Set
up Unins
tall Log
(b)
DAT Inno Setup Uninstall Log file
4A 41 52 43 53 00 JARCS.
JAR JARCS compressed archive
4A 47 03 0E 00 00 00 or JG.....
4A 47 04 0E 00 00 00 JG.....
ART AOL ART file
4B 47 42 5F 61 72 63 68
20 2D KGB_arch
-
KGB KGB archive
4B 49 00 00 KI..
-
SHD Windows 9x printer spool file
4C 00 00 00 01 14 02 00 L.......
LNK Windows shortcut file
4C 01 L.
OBJ Microsoft Common Object File Format (COFF) relocatable
object code file for an Intel 386 or later/compatible processors
4C 4E 02 00 LN..
GID Windows Help index file
HLP Windows Help file
4D 41 52 31 00 MAR1.
MAR Mozilla archive
4D 41 52 43 MARC
MAR Microsoft/MSN MARC archive
4D 41 72 30 00 MAr0.
MAR MAr compressed archive
4D 44 4D 50 93 A7 MDMPҤ
HDMP Windows heap dump file
DMP Windows minidump file
4D 49 4C 45 53 MILES
MLS Milestones v1.0 project management and scheduling software
(Also see "MV2C" and "MV214" signatures)
4D 4C 53 57 MLSW
MLS Skype localization data file
4D 4D 00 2A MM.*
TIF, TIFF Tagged Image File Format file (big
endian, i.e., LSB last in the byte; Motorola)
4D 4D 00 2B MM.+
TIF, TIFF BigTIFF files; Tagged Image File Format files >4 GB
4D 4D 4D 44 00 00 MMMD..
MMF Yamaha Corp. Synthetic music Mobile Application Format (SMAF)
for multimedia files that can be played on hand-held devices.
4D 53 43 46 MSCF
CAB Microsoft cabinet file
PPZ Powerpoint Packaged Presentation
SNP Microsoft Access Snapshot Viewer file
4D 53 46 54 02 00 01 00 MSFT....
TLB OLE, SPSS, or Visual C++ type library file
4D 53 5F 56 4F 49 43 45 MS_VOICE
CDR, DVF Sony Compressed Voice File
MSV Sony Memory Stick Compressed Voice file
4D 54 68 64 MThd
MID, MIDI Musical Instrument Digital Interface (MIDI) sound file
4D 56 MV
DSN CD Stomper Pro label file
4D 56 32 31 34 MV214
MLS Milestones v2.1b project management and scheduling software
(Also see "MILES" and "MV2C" signatures)
4D 56 32 43 MV2C
MLS Milestones v2.1a project management and scheduling software
(Also see "MILES" and "MV214" signatures)
4D 5A MZ
COM, DLL, DRV, EXE, PIF, QTS, QTX, SYS Windows/DOS executable file
ACM MS audio compression manager driver
AX Library cache file
CPL Control panel application
FON Font file
OCX ActiveX or OLE Custom Control
OLB OLE object library
SCR Screen saver
VBX VisualBASIC application
VXD, 386 Windows virtual device drivers
4D 5A 90 00 03 00 00 00 MZ......
API Acrobat plug-in
AX DirectShow filter
FLT Audition graphic filter file (Adobe)
4D 5A 90 00 03 00 00 00
04 00 00 00 FF FF MZ......
....
URL: http://delphi.cjcsoft.net/viewthread.php?tid=2503
