punctuation 0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z (all)
©1996-2012 2012-01-01 Roedy Green, Canadian Mind Products
punctuation 0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z (all)
©1996-2012 2012-01-01 Roedy Green, Canadian Mind ProductsA hex constant embedded usually at a fixed offset in a file that identifies what format it is. Since identifiers are arbitrary and not assigned by any authority, they are sometimes called magic numbers, e.g. CA FE BA BE at the head of every Java class file. File signature are usully specified in hex, or sometimes ASCII (American Standard Code for Information Interchange). I have never seen any other encoding. These have to be kept simple for low level debugging.
| File Signatures for Common Image File Formats | ||||||
|---|---|---|---|---|---|---|
| File Type | Magic Number
Offset in hex |
Magic Number
in hex |
Magic Number
in ASCII |
Offset of Width | Offset of Height | Format |
| *.png | 0 | 89504e470d0a1a0a | ·PNG | 10 | 14 | 32-bit, big endian |
| *.jpg | 0 | FBD8 | ·F | 1a | ac | 16-bit, little endian, sometimes at other offsets. See ImageInfo source code. |
| 6 | 4a464946 | JFIF | ||||
| *.gif | 0 | 474946396132 | GIF89a | 06 | 08 | 16-bit, little endian |
| File Signatures for Windows Executables | |||
|---|---|---|---|
| File Type | Offset in hex | Magic Number
in hex |
Magic Number
in ASCII |
| 16-bit DOS (Disk Operating System) exe | 0 | 4d5a | MZ |
| 3c | 0000 | ·· | |
| 16-bit Win3.1 exe | 0 | 4d5a | MZ |
| 4*(3c) | 4e45 | NE | |
| 32-bit Windows95+ exe | 0 | 4d5a | MZ |
| 4*(3c) | 50450000 | PE·· | |
| +4 | 4c01 | L· | |
| 32-bit Jet Windows exe | 0 | 4d5a | MZ |
| 4*(3c) | 50450000 | PE·· | |
| +4 | 4c01 | L· | |
| 4*(2f4) | 43504200 | CPB· | |
| 64-bit Windows amd64 exe | 0 | 4d5a | MZ |
| 4*(3c) | 50450000 | PE·· | |
| +4 | 6486 | d· | |
| 64-bit Jet Windows amd64 exe | 0 | 4d5a | MZ |
| 4*(3c) | 50450000 | PE·· | |
| +4 | 6486 | d· | |
| 4*(2f4) | 43504200 | CPB· | |
| 64-bit Windows ia64 exe (Itanium) | 0 | 4d5a | MZ |
| 4*(3c) | 50450000 | PE·· | |
| +4 | 0002 | ·· | |
4*(3c) means go to offset 003c. Look at the following 4 bytes. That gives you the little-endian offset to the magic number.
Because Windows machines are little endian, magic numbers are often quoted in reverse order in other sources. I have quoted them in the same order they appear in RAM (Random Access Memory). This works even when the number is not an even number of bytes.
 |
You can get the freshest copy of this page from: | or possibly from your local J: drive (Java virtual drive/mindprod.com website mirror) |
| http://mindprod.com/jgloss/filesignature.html | J:\mindprod\jgloss\filesignature.html | |
 | Please email your feedback for publication,
letters to the editor, errors, omissions, typos, formatting errors, ambiguities, unclear wording,
broken/redirected link reports, suggestions to improve this page or comments to
Roedy Green :
 .
If you want your message, your name or email kept confidential, not considered for public posting, please explicitly specify that.
Unless you state otherwise, I will treat your message as a letter to the editor that I may or may not publish in the feedback section. After that, it will be too late to retract it.
If you disagree with something I said, please quote it and cite the web page where you found it, tell me why you think it is wrong,
and, if possible, provide some supporting evidence. Threatening to kill me or spouting obscenities has yet to persuade me to change my mind. | |
| Canadian Mind Products | ||
| mindprod.com IP:[65.110.21.43] | ||
| view Blog | Your face IP:[38.107.179.212] | |
| Feedback | You are visitor number 1. | |