cyberchef
Version:
The Cyber Swiss Army Knife for encryption, encoding, compression and data analysis.
1,870 lines (1,867 loc) • 114 kB
JavaScript
/**
* File signatures and extractor functions
*
* @author n1474335 [n1474335@gmail.com]
* @copyright Crown Copyright 2018
* @license Apache-2.0
*
*/
import Stream from "./Stream.mjs";
/**
* A categorised table of file types, including signatures to identify them and functions
* to extract them where possible.
*/
export const FILE_SIGNATURES = {
"Images": [
{
name: "Joint Photographic Experts Group image",
extension: "jpg,jpeg,jpe,thm,mpo",
mime: "image/jpeg",
description: "",
signature: {
0: 0xff,
1: 0xd8,
2: 0xff,
3: [0xc0, 0xc4, 0xdb, 0xdd, 0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe7, 0xe8, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xfe]
},
extractor: extractJPEG
},
{
name: "Graphics Interchange Format image",
extension: "gif",
mime: "image/gif",
description: "",
signature: {
0: 0x47, // GIF
1: 0x49,
2: 0x46,
3: 0x38, // 8
4: [0x37, 0x39], // 7|9
5: 0x61 // a
},
extractor: extractGIF
},
{
name: "Portable Network Graphics image",
extension: "png",
mime: "image/png",
description: "",
signature: {
0: 0x89,
1: 0x50, // PNG
2: 0x4e,
3: 0x47,
4: 0x0d,
5: 0x0a,
6: 0x1a,
7: 0x0a
},
extractor: extractPNG
},
{
name: "WEBP Image",
extension: "webp",
mime: "image/webp",
description: "",
signature: {
8: 0x57,
9: 0x45,
10: 0x42,
11: 0x50
},
extractor: extractWEBP
},
{
name: "Camera Image File Format",
extension: "crw",
mime: "image/x-canon-crw",
description: "",
signature: {
6: 0x48, // HEAPCCDR
7: 0x45,
8: 0x41,
9: 0x50,
10: 0x43,
11: 0x43,
12: 0x44,
13: 0x52
},
extractor: null
},
{ // Place before tiff check
name: "Canon CR2 raw image",
extension: "cr2",
mime: "image/x-canon-cr2",
description: "",
signature: [
{
0: 0x49,
1: 0x49,
2: 0x2a,
3: 0x0,
8: 0x43,
9: 0x52
},
{
0: 0x4d,
1: 0x4d,
2: 0x0,
3: 0x2a,
8: 0x43,
9: 0x52
}
],
extractor: null
},
{
name: "Tagged Image File Format image",
extension: "tif",
mime: "image/tiff",
description: "",
signature: [
{
0: 0x49,
1: 0x49,
2: 0x2a,
3: 0x0
},
{
0: 0x4d,
1: 0x4d,
2: 0x0,
3: 0x2a
}
],
extractor: null
},
{
name: "Bitmap image",
extension: "bmp",
mime: "image/bmp",
description: "",
signature: {
0: 0x42,
1: 0x4d,
7: 0x0,
9: 0x0,
14: [0x0c, 0x28, 0x38, 0x40, 0x6c, 0x7c],
15: 0x0,
16: 0x0,
17: 0x0
},
extractor: extractBMP
},
{
name: "JPEG Extended Range image",
extension: "jxr",
mime: "image/vnd.ms-photo",
description: "",
signature: {
0: 0x49,
1: 0x49,
2: 0xbc
},
extractor: null
},
{
name: "Photoshop image",
extension: "psd",
mime: "image/vnd.adobe.photoshop",
description: "",
signature: {
0: 0x38, // 8BPS
1: 0x42,
2: 0x50,
3: 0x53,
4: 0x0,
5: 0x1,
6: 0x0,
7: 0x0,
8: 0x0,
9: 0x0,
10: 0x0,
11: 0x0
},
extractor: null
},
{
name: "Photoshop Large Document",
extension: "psb",
mime: "application/x-photoshop",
description: "",
signature: {
0: 0x38, // 8BPS
1: 0x42,
2: 0x50,
3: 0x53,
4: 0x0,
5: 0x2,
6: 0x0,
7: 0x0,
8: 0x0,
9: 0x0,
10: 0x0,
11: 0x0,
12: 0x0
},
extractor: null
},
{
name: "Paint Shop Pro image",
extension: "psp",
mime: "image/psp",
description: "",
signature: [
{
0: 0x50, // Paint Shop Pro Im
1: 0x61,
2: 0x69,
3: 0x6e,
4: 0x74,
5: 0x20,
6: 0x53,
7: 0x68,
8: 0x6f,
9: 0x70,
10: 0x20,
11: 0x50,
12: 0x72,
13: 0x6f,
14: 0x20,
15: 0x49,
16: 0x6d
},
{
0: 0x7e,
1: 0x42,
2: 0x4b,
3: 0x0
}
],
extractor: null
},
{
name: "The GIMP image",
extension: "xcf",
mime: "image/x-xcf",
description: "",
signature: {
0: 0x67, // gimp xcf
1: 0x69,
2: 0x6d,
3: 0x70,
4: 0x20,
5: 0x78,
6: 0x63,
7: 0x66,
8: 0x20,
9: [0x66, 0x76],
10: [0x69, 0x30],
11: [0x6c, 0x30],
12: [0x65, 0x31, 0x32, 0x33]
},
extractor: null
},
{
name: "Icon image",
extension: "ico",
mime: "image/x-icon",
description: "",
signature: {
0: 0x0,
1: 0x0,
2: 0x1,
3: 0x0,
4: [0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, 0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15],
5: 0x0,
6: [0x10, 0x20, 0x30, 0x40, 0x80],
7: [0x10, 0x20, 0x30, 0x40, 0x80],
9: 0x0,
10: [0x0, 0x1]
},
extractor: extractICO
},
{
name: "Radiance High Dynamic Range image",
extension: "hdr",
mime: "image/vnd.radiance",
description: "",
signature: {
0: 0x23, // #?RADIANCE
1: 0x3f,
2: 0x52,
3: 0x41,
4: 0x44,
5: 0x49,
6: 0x41,
7: 0x4e,
8: 0x43,
9: 0x45,
10: 0x0a
},
extractor: null
},
{
name: "Sony ARW image",
extension: "arw",
mime: "image/x-raw",
description: "",
signature: {
0: 0x05,
1: 0x0,
2: 0x0,
3: 0x0,
4: 0x41,
5: 0x57,
6: 0x31,
7: 0x2e
},
extractor: null
},
{
name: "Fujifilm Raw Image",
extension: "raf",
mime: "image/x-raw",
description: "",
signature: {
0: 0x46, // FUJIFILMCCD-RAW
1: 0x55,
2: 0x4a,
3: 0x49,
4: 0x46,
5: 0x49,
6: 0x4c,
7: 0x4d,
8: 0x43,
9: 0x43,
10: 0x44,
11: 0x2d,
12: 0x52,
13: 0x41,
14: 0x57
},
extractor: null
},
{
name: "Minolta RAW image",
extension: "mrw",
mime: "image/x-raw",
description: "",
signature: {
0: 0x0,
1: 0x4d, // MRM
2: 0x52,
3: 0x4d
},
extractor: null
},
{
name: "Adobe Bridge Thumbnail Cache",
extension: "bct",
mime: "application/octet-stream",
description: "",
signature: {
0: 0x6c,
1: 0x6e,
2: 0x62,
3: 0x74,
4: 0x02,
5: 0x0,
6: 0x0,
7: 0x0
},
extractor: null
},
{
name: "Microsoft Document Imaging",
extension: "mdi",
mime: "image/vnd.ms-modi",
description: "",
signature: {
0: 0x45,
1: 0x50,
2: 0x2a,
3: 0x00
},
extractor: null
},
{
name: "Joint Photographic Experts Group image (under Base64)",
extension: "B64",
mime: "application/octet-stream",
description: "",
signature: {
0: 0x2f,
1: 0x39,
2: 0x6a,
3: 0x2f,
4: 0x34
},
extractor: null
},
{
name: "Portable Network Graphics image (under Base64)",
extension: "B64",
mime: "application/octet-stream",
description: "",
signature: {
0: 0x69,
1: 0x56,
2: 0x42,
3: 0x4f,
4: 0x52,
5: 0x77,
6: 0x30
},
extractor: null
},
{
name: "AutoCAD Drawing",
extension: "dwg,123d",
mime: "application/acad",
description: "",
signature: {
0: 0x41,
1: 0x43,
2: 0x31,
3: 0x30,
4: [0x30, 0x31],
5: [0x30, 0x31, 0x32, 0x33, 0x34, 0x35],
6: 0x00
},
extractor: null
},
{
name: "AutoCAD Drawing",
extension: "dwg,dwt",
mime: "application/acad",
description: "",
signature: [
{
0: 0x41,
1: 0x43,
2: 0x31,
3: 0x30,
4: 0x31,
5: 0x38,
6: 0x00
},
{
0: 0x41,
1: 0x43,
2: 0x31,
3: 0x30,
4: 0x32,
5: 0x34,
6: 0x00
},
{
0: 0x41,
1: 0x43,
2: 0x31,
3: 0x30,
4: 0x32,
5: 0x37,
6: 0x00
}
],
extractor: null
},
{
name: "Targa Image",
extension: "tga",
mime: "image/x-targa",
description: "",
signature: [
{ // This signature is not at the beginning of the file. The extractor works backwards.
0: 0x54,
1: 0x52,
2: 0x55,
3: 0x45,
4: 0x56,
5: 0x49,
6: 0x53,
7: 0x49,
8: 0x4f,
9: 0x4e,
10: 0x2d,
11: 0x58,
12: 0x46,
13: 0x49,
14: 0x4c,
15: 0x45,
16: 0x2e
}
],
extractor: extractTARGA
}
],
"Video": [
{ // Place before webm
name: "Matroska Multimedia Container",
extension: "mkv",
mime: "video/x-matroska",
description: "",
signature: {
31: 0x6d,
32: 0x61,
33: 0x74,
34: 0x72,
35: 0x6f,
36: 0x73,
37: 0x6b,
38: 0x61
},
extractor: null
},
{
name: "WEBM video",
extension: "webm",
mime: "video/webm",
description: "",
signature: {
0: 0x1a,
1: 0x45,
2: 0xdf,
3: 0xa3
},
extractor: null
},
{ // Place before MPEG-4
name: "Flash MP4 video",
extension: "f4v",
mime: "video/mp4",
description: "",
signature: {
4: 0x66,
5: 0x74,
6: 0x79,
7: 0x70,
8: [0x66, 0x46],
9: 0x34,
10: [0x76, 0x56],
11: 0x20
},
extractor: null
},
{
name: "MPEG-4 video",
extension: "mp4",
mime: "video/mp4",
description: "",
signature: [
{
0: 0x0,
1: 0x0,
2: 0x0,
3: [0x18, 0x20],
4: 0x66,
5: 0x74,
6: 0x79,
7: 0x70
},
{
0: 0x33, // 3gp5
1: 0x67,
2: 0x70,
3: 0x35
},
{
0: 0x0,
1: 0x0,
2: 0x0,
3: 0x1c,
4: 0x66,
5: 0x74,
6: 0x79,
7: 0x70,
8: 0x6d,
9: 0x70,
10: 0x34,
11: 0x32,
16: 0x6d, // mp41mp42isom
17: 0x70,
18: 0x34,
19: 0x31,
20: 0x6d,
21: 0x70,
22: 0x34,
23: 0x32,
24: 0x69,
25: 0x73,
26: 0x6f,
27: 0x6d
}
],
extractor: null
},
{
name: "M4V video",
extension: "m4v",
mime: "video/x-m4v",
description: "",
signature: {
0: 0x0,
1: 0x0,
2: 0x0,
3: 0x1c,
4: 0x66,
5: 0x74,
6: 0x79,
7: 0x70,
8: 0x4d,
9: 0x34,
10: 0x56
},
extractor: null
},
{
name: "Quicktime video",
extension: "mov",
mime: "video/quicktime",
description: "",
signature: {
0: 0x0,
1: 0x0,
2: 0x0,
3: 0x14,
4: 0x66,
5: 0x74,
6: 0x79,
7: 0x70
},
extractor: null
},
{
name: "Audio Video Interleave",
extension: "avi",
mime: "video/x-msvideo",
description: "",
signature: {
0: 0x52,
1: 0x49,
2: 0x46,
3: 0x46,
8: 0x41,
9: 0x56,
10: 0x49
},
extractor: null
},
{
name: "Windows Media Video",
extension: "wmv",
mime: "video/x-ms-wmv",
description: "",
signature: {
0: 0x30,
1: 0x26,
2: 0xb2,
3: 0x75,
4: 0x8e,
5: 0x66,
6: 0xcf,
7: 0x11,
8: 0xa6,
9: 0xd9
},
extractor: null
},
{
name: "MPEG video",
extension: "mpg",
mime: "video/mpeg",
description: "",
signature: {
0: 0x0,
1: 0x0,
2: 0x1,
3: 0xba
},
extractor: null
},
{
name: "Flash Video",
extension: "flv",
mime: "video/x-flv",
description: "",
signature: {
0: 0x46,
1: 0x4c,
2: 0x56,
3: 0x1
},
extractor: extractFLV
},
{
name: "OGG Video",
extension: "ogv,ogm,opus,ogx",
mime: "video/ogg",
description: "",
signature: [
{
0: 0x4f, // OggS
1: 0x67,
2: 0x67,
3: 0x53,
4: 0x00,
5: 0x02,
28: 0x01,
29: 0x76, // video
30: 0x69,
31: 0x64,
32: 0x65,
33: 0x6f
},
{
0: 0x4f, // OggS
1: 0x67,
2: 0x67,
3: 0x53,
4: 0x00,
5: 0x02,
28: 0x80,
29: 0x74, // theora
30: 0x68,
31: 0x65,
32: 0x6f,
33: 0x72,
34: 0x61
},
{
0: 0x4f, // OggS
1: 0x67,
2: 0x67,
3: 0x53,
4: 0x00,
5: 0x02,
28: 0x66, // fishead
29: 0x69,
30: 0x73,
31: 0x68,
32: 0x65,
33: 0x61,
34: 0x64
}
],
extractor: null
},
],
"Audio": [
{
name: "Waveform Audio",
extension: "wav",
mime: "audio/x-wav",
description: "",
signature: {
0: 0x52,
1: 0x49,
2: 0x46,
3: 0x46,
8: 0x57,
9: 0x41,
10: 0x56,
11: 0x45
},
extractor: extractWAV
},
{
name: "OGG audio",
extension: "ogg",
mime: "audio/ogg",
description: "",
signature: {
0: 0x4f,
1: 0x67,
2: 0x67,
3: 0x53
},
extractor: null
},
{
name: "Musical Instrument Digital Interface audio",
extension: "midi",
mime: "audio/midi",
description: "",
signature: {
0: 0x4d,
1: 0x54,
2: 0x68,
3: 0x64
},
extractor: null
},
{
name: "MPEG-3 audio",
extension: "mp3",
mime: "audio/mpeg",
description: "",
signature: [
{
0: 0x49,
1: 0x44,
2: 0x33
},
{
0: 0xff,
1: 0xfb
}
],
extractor: extractMP3
},
{
name: "MPEG-4 Part 14 audio",
extension: "m4a",
mime: "audio/m4a",
description: "",
signature: [
{
4: 0x66,
5: 0x74,
6: 0x79,
7: 0x70,
8: 0x4d,
9: 0x34,
10: 0x41
},
{
0: 0x4d,
1: 0x34,
2: 0x41,
3: 0x20
}
],
extractor: null
},
{
name: "Free Lossless Audio Codec",
extension: "flac",
mime: "audio/x-flac",
description: "",
signature: {
0: 0x66,
1: 0x4c,
2: 0x61,
3: 0x43
},
extractor: null
},
{
name: "Adaptive Multi-Rate audio codec",
extension: "amr",
mime: "audio/amr",
description: "",
signature: {
0: 0x23,
1: 0x21,
2: 0x41,
3: 0x4d,
4: 0x52,
5: 0x0a
},
extractor: null
},
{
name: "Audacity",
extension: "au",
mime: "audio/x-au",
description: "",
signature: {
0: 0x64, // dns.
1: 0x6e,
2: 0x73,
3: 0x2e,
24: 0x41, // AudacityBlockFile
25: 0x75,
26: 0x64,
27: 0x61,
28: 0x63,
29: 0x69,
30: 0x74,
31: 0x79,
32: 0x42,
33: 0x6c,
34: 0x6f,
35: 0x63,
36: 0x6b,
37: 0x46,
38: 0x69,
39: 0x6c,
40: 0x65
},
extractor: null
},
{
name: "Audacity Block",
extension: "auf",
mime: "application/octet-stream",
description: "",
signature: {
0: 0x41, // AudacityBlockFile
1: 0x75,
2: 0x64,
3: 0x61,
4: 0x63,
5: 0x69,
6: 0x74,
7: 0x79,
8: 0x42,
9: 0x6c,
10: 0x6f,
11: 0x63,
12: 0x6b,
13: 0x46,
14: 0x69,
15: 0x6c,
16: 0x65
},
extractor: null
},
{
name: "Audio Interchange File",
extension: "aif",
mime: "audio/x-aiff",
description: "",
signature: {
0: 0x46, // FORM
1: 0x4f,
2: 0x52,
3: 0x4d,
8: 0x41, // AIFF
9: 0x49,
10: 0x46,
11: 0x46
},
extractor: null
},
{
name: "Audio Interchange File (compressed)",
extension: "aifc",
mime: "audio/x-aifc",
description: "",
signature: {
0: 0x46, // FORM
1: 0x4f,
2: 0x52,
3: 0x4d,
8: 0x41, // AIFC
9: 0x49,
10: 0x46,
11: 0x43
},
extractor: null
}
],
"Documents": [
{
name: "Portable Document Format",
extension: "pdf",
mime: "application/pdf",
description: "",
signature: {
0: 0x25,
1: 0x50,
2: 0x44,
3: 0x46
},
extractor: extractPDF
},
{
name: "Portable Document Format (under Base64)",
extension: "B64",
mime: "application/octet-stream",
description: "",
signature: {
0: 0x41,
1: 0x4a,
2: 0x56,
3: 0x42,
4: 0x45,
5: 0x52,
6: 0x69
},
extractor: null
},
{ // Place before PostScript
name: "Adobe PostScript",
extension: "ps,eps,ai,pfa",
mime: "application/postscript",
description: "",
signature: {
0: 0x25,
1: 0x21,
2: 0x50,
3: 0x53,
4: 0x2d,
5: 0x41,
6: 0x64,
7: 0x6f,
8: 0x62,
9: 0x65
},
extractor: null
},
{
name: "PostScript",
extension: "ps",
mime: "application/postscript",
description: "",
signature: {
0: 0x25,
1: 0x21
},
extractor: null
},
{
name: "Encapsulated PostScript",
extension: "eps,ai",
mime: "application/eps",
description: "",
signature: {
0: 0xc5,
1: 0xd0,
2: 0xd3,
3: 0xc6
},
extractor: null
},
{
name: "Rich Text Format",
extension: "rtf",
mime: "application/rtf",
description: "",
signature: {
0: 0x7b,
1: 0x5c,
2: 0x72,
3: 0x74
},
extractor: extractRTF
},
{
name: "Microsoft Office document/OLE2",
extension: "ole2,doc,xls,dot,ppt,xla,ppa,pps,pot,msi,sdw,db,vsd,msg",
mime: "application/msword,application/vnd.ms-excel,application/vnd.ms-powerpoint",
description: "Microsoft Office documents",
signature: {
0: 0xd0,
1: 0xcf,
2: 0x11,
3: 0xe0,
4: 0xa1,
5: 0xb1,
6: 0x1a,
7: 0xe1
},
extractor: null
},
{
name: "Microsoft Office document/OLE2 (under Base64)",
extension: "B64",
mime: "application/octet-stream",
description: "",
signature: {
0: 0x30,
1: 0x4d,
2: 0x38,
3: 0x52,
4: 0x34,
5: 0x4b,
6: 0x47,
7: 0x78
},
extractor: null
},
{
name: "Microsoft Office 2007+ document",
extension: "docx,xlsx,pptx",
mime: "application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,application/vnd.openxmlformats-officedocument.presentationml.presentation",
description: "",
signature: {
38: 0x5f, // _Types].xml
39: 0x54,
40: 0x79,
41: 0x70,
42: 0x65,
43: 0x73,
44: 0x5d,
45: 0x2e,
46: 0x78,
47: 0x6d,
48: 0x6c
},
extractor: extractZIP
},
{
name: "Microsoft Access database",
extension: "mdb,mda,mde,mdt,fdb,psa",
mime: "application/msaccess",
description: "",
signature: {
0: 0x00,
1: 0x01,
2: 0x00,
3: 0x00,
4: 0x53, // Standard Jet
5: 0x74,
6: 0x61,
7: 0x6e,
8: 0x64,
9: 0x61,
10: 0x72,
11: 0x64,
12: 0x20,
13: 0x4a,
14: 0x65,
15: 0x74
},
extractor: null
},
{
name: "Microsoft Access 2007+ database",
extension: "accdb,accde,accda,accdu",
mime: "application/msaccess",
description: "",
signature: {
0: 0x00,
1: 0x01,
2: 0x00,
3: 0x00,
4: 0x53, // Standard ACE DB
5: 0x74,
6: 0x61,
7: 0x6e,
8: 0x64,
9: 0x61,
10: 0x72,
11: 0x64,
12: 0x20,
13: 0x41,
14: 0x43,
15: 0x45,
16: 0x20
},
extractor: null
},
{
name: "Microsoft OneNote document",
extension: "one",
mime: "application/onenote",
description: "",
signature: {
0: 0xe4,
1: 0x52,
2: 0x5c,
3: 0x7b,
4: 0x8c,
5: 0xd8,
6: 0xa7,
7: 0x4d,
8: 0xae,
9: 0xb1,
10: 0x53,
11: 0x78,
12: 0xd0,
13: 0x29,
14: 0x96,
15: 0xd3
},
extractor: null
},
{
name: "Outlook Express database",
extension: "dbx",
mime: "application/octet-stream",
description: "",
signature: {
0: 0xcf,
1: 0xad,
2: 0x12,
3: 0xfe,
4: [0x30, 0xc5, 0xc6, 0xc7],
11: 0x11
},
extractor: null
},
{
name: "Personal Storage Table (Outlook)",
extension: "pst,ost,fdb,pab",
mime: "application/octet-stream",
description: "",
signature: {
0: 0x21, // !BDN
1: 0x42,
2: 0x44,
3: 0x4e
},
extractor: null
},
{
name: "Microsoft Exchange Database",
extension: "edb",
mime: "application/octet-stream",
description: "",
signature: {
4: 0xef,
5: 0xcd,
6: 0xab,
7: 0x89,
8: [0x20, 0x23],
9: 0x06,
10: 0x00,
11: 0x00,
12: [0x00, 0x01],
13: 0x00,
14: 0x00,
15: 0x00
},
extractor: null
},
{
name: "WordPerfect document",
extension: "wpd,wp,wp5,wp6,wpp,bk!,wcm",
mime: "application/wordperfect",
description: "",
signature: {
0: 0xff,
1: 0x57,
2: 0x50,
3: 0x43,
7: [0x00, 0x01, 0x02],
8: 0x01,
9: 0x0a
},
extractor: null
},
{
name: "EPUB e-book",
extension: "epub",
mime: "application/epub+zip",
description: "",
signature: {
0: 0x50,
1: 0x4b,
2: 0x3,
3: 0x4,
30: 0x6d, // mimetypeapplication/epub_zip
31: 0x69,
32: 0x6d,
33: 0x65,
34: 0x74,
35: 0x79,
36: 0x70,
37: 0x65,
38: 0x61,
39: 0x70,
40: 0x70,
41: 0x6c,
42: 0x69,
43: 0x63,
44: 0x61,
45: 0x74,
46: 0x69,
47: 0x6f,
48: 0x6e,
49: 0x2f,
50: 0x65,
51: 0x70,
52: 0x75,
53: 0x62,
54: 0x2b,
55: 0x7a,
56: 0x69,
57: 0x70
},
extractor: extractZIP
},
],
"Applications": [
{
name: "Windows Portable Executable",
extension: "exe,dll,drv,vxd,sys,ocx,vbx,com,fon,scr",
mime: "application/vnd.microsoft.portable-executable",
description: "",
signature: {
0: 0x4d,
1: 0x5a,
3: [0x0, 0x1, 0x2],
5: [0x0, 0x1, 0x2]
},
extractor: extractMZPE
},
{
name: "Executable and Linkable Format",
extension: "elf,bin,axf,o,prx,so",
mime: "application/x-executable",
description: "Executable and Linkable Format file. No standard file extension.",
signature: {
0: 0x7f,
1: 0x45,
2: 0x4c,
3: 0x46
},
extractor: extractELF
},
{
name: "MacOS Mach-O object",
extension: "dylib",
mime: "application/octet-stream",
description: "",
signature: [
{
0: 0xca,
1: 0xfe,
2: 0xba,
3: 0xbe,
4: 0x00,
5: 0x00,
6: 0x00,
7: [0x01, 0x02, 0x03]
},
{
0: 0xce,
1: 0xfa,
2: 0xed,
3: 0xfe,
4: 0x07,
5: 0x00,
6: 0x00,
7: 0x00,
8: [0x01, 0x02, 0x03]
}
],
extractor: extractMACHO
},
{
name: "MacOS Mach-O 64-bit object",
extension: "dylib",
mime: "application/octet-stream",
description: "",
signature: {
0: 0xcf,
1: 0xfa,
2: 0xed,
3: 0xfe
},
extractor: extractMACHO
},
{
name: "Adobe Flash",
extension: "swf",
mime: "application/x-shockwave-flash",
description: "",
signature: {
0: [0x43, 0x46],
1: 0x57,
2: 0x53,
},
extractor: null
},
{
name: "Java Class",
extension: "class",
mime: "application/java-vm",
description: "",
signature: {
0: 0xca,
1: 0xfe,
2: 0xba,
3: 0xbe
},
extractor: null
},
{
name: "Dalvik Executable",
extension: "dex",
mime: "application/octet-stream",
description: "Dalvik Executable as used by Android",
signature: {
0: 0x64,
1: 0x65,
2: 0x78,
3: 0x0a,
4: 0x30,
5: 0x33,
6: 0x35,
7: 0x0
},
extractor: null
},
{
name: "Google Chrome Extension",
extension: "crx",
mime: "application/crx",
description: "Google Chrome extension or packaged app",
signature: {
0: 0x43,
1: 0x72,
2: 0x32,
3: 0x34
},
extractor: null
},
],
"Archives": [
{
name: "PKZIP archive",
extension: "zip",
mime: "application/zip",
description: "",
signature: {
0: 0x50,
1: 0x4b,
2: [0x3, 0x5, 0x7],
3: [0x4, 0x6, 0x8]
},
extractor: extractZIP
},
{
name: "PKZIP archive (under Base64)",
extension: "B64",
mime: "application/octet-stream",
description: "",
signature: {
0: 0x55,
1: 0x45,
2: 0x73,
3: 0x44,
4: 0x42,
5: 0x42
},
extractor: null
},
{
name: "TAR archive",
extension: "tar",
mime: "application/x-tar",
description: "",
signature: {
257: 0x75, // ustar
258: 0x73,
259: 0x74,
260: 0x61,
261: 0x72
},
extractor: extractTAR
},
{
name: "Roshal Archive",
extension: "rar",
mime: "application/x-rar-compressed",
description: "",
signature: {
0: 0x52,
1: 0x61,
2: 0x72,
3: 0x21,
4: 0x1a,
5: 0x7,
6: [0x0, 0x1]
},
extractor: null
},
{
name: "Gzip",
extension: "gz",
mime: "application/gzip",
description: "",
signature: {
0: 0x1f,
1: 0x8b,
2: 0x8
},
extractor: extractGZIP
},
{
name: "Bzip2",
extension: "bz2",
mime: "application/x-bzip2",
description: "",
signature: {
0: 0x42,
1: 0x5a,
2: 0x68
},
extractor: extractBZIP2
},
{
name: "7zip",
extension: "7z",
mime: "application/x-7z-compressed",
description: "",
signature: {
0: 0x37,
1: 0x7a,
2: 0xbc,
3: 0xaf,
4: 0x27,
5: 0x1c
},
extractor: null
},
{
name: "Zlib Deflate",
extension: "zlib",
mime: "application/x-deflate",
description: "",
signature: {
0: 0x78,
1: [0x1, 0x9c, 0xda, 0x5e]
},
extractor: extractZlib
},
{
name: "xz compression",
extension: "xz",
mime: "application/x-xz",
description: "",
signature: {
0: 0xfd,
1: 0x37,
2: 0x7a,
3: 0x58,
4: 0x5a,
5: 0x0
},
extractor: extractXZ
},
{
name: "Tarball",
extension: "tar.z",
mime: "application/x-gtar",
description: "",
signature: {
0: 0x1f,
1: [0x9d, 0xa0]
},
extractor: null
},
{
name: "ISO disk image",
extension: "iso",
mime: "application/octet-stream",
description: "ISO 9660 CD/DVD image file",
signature: [
{
0x8001: 0x43,
0x8002: 0x44,
0x8003: 0x30,
0x8004: 0x30,
0x8005: 0x31
},
{
0x8801: 0x43,
0x8802: 0x44,
0x8803: 0x30,
0x8804: 0x30,
0x8805: 0x31
},
{
0x9001: 0x43,
0x9002: 0x44,
0x9003: 0x30,
0x9004: 0x30,
0x9005: 0x31
}
],
extractor: null
},
{
name: "Virtual Machine Disk",
extension: "vmdk",
mime: "application/vmdk,application/x-virtualbox-vmdk",
description: "",
signature: {
0: 0x4b,
1: 0x44,
2: 0x4d,
3: 0x56,
5: 0x00,
6: 0x00,
7: 0x00
},
extractor: null
},
{
name: "Virtual Hard Drive",
extension: "vhd",
mime: "application/x-vhd",
description: "",
signature: {
0: 0x63, // conectix
1: 0x6f,
2: 0x6e,
3: 0x65,
4: 0x63,
5: 0x74,
6: 0x69,
7: 0x78
},
extractor: null
},
{
name: "Macintosh disk image",
extension: "dmf,dmg",
mime: "application/octet-stream",
description: "",
signature: {
0: 0x78,
1: 0x01,
2: 0x73,
3: 0x0d,
4: 0x62,
5: 0x62,
6: 0x60,
7: 0x60
},
extractor: null
},
{
name: "ARJ Archive",
extension: "arj",
mime: "application/x-arj-compressed",
description: "",
signature: {
0: 0x60,
1: 0xea,
8: [0x0, 0x10, 0x14],
9: 0x0,
10: 0x2
},
extractor: null
},
{
name: "WinAce Archive",
extension: "ace",
mime: "application/x-ace-compressed",
description: "",
signature: {
7: 0x2a, // **ACE**
8: 0x2a,
9: 0x41,
10: 0x43,
11: 0x45,
12: 0x2a,
13: 0x2a
},
extractor: null
},
{
name: "Macintosh BinHex Encoded File",
extension: "hqx",
mime: "application/mac-binhex",
description: "",
signature: {
11: 0x6d, // must be converted with BinHex
12: 0x75,
13: 0x73,
14: 0x74,
15: 0x20,
16: 0x62,
17: 0x65,
18: 0x20,
19: 0x63,
20: 0x6f,
21: 0x6e,
22: 0x76,
23: 0x65,
24: 0x72,
25: 0x74,
26: 0x65,
27: 0x64,
28: 0x20,
29: 0x77,
30: 0x69,
31: 0x74,
32: 0x68,
33: 0x20,
34: 0x42,
35: 0x69,
36: 0x6e,
37: 0x48,
38: 0x65,
39: 0x78
},
extractor: null
},
{
name: "ALZip Archive",
extension: "alz",
mime: "application/octet-stream",
description: "",
signature: {
0: 0x41, // ALZ
1: 0x4c,
2: 0x5a,
3: 0x01,
4: 0x0a,
5: 0x0,
6: 0x0,
7: 0x0
},
extractor: null
},
{
name: "KGB Compressed Archive",
extension: "kgb",
mime: "application/x-kgb-compressed",
description: "",
signature: {
0: 0x4b, // KGB_arch -
1: 0x47,
2: 0x42,
3: 0x5f,
4: 0x61,
5: 0x72,
6: 0x63,
7: 0x68,
8: 0x20,
9: 0x2d
},
extractor: null
},
{
name: "Microsoft Cabinet",
extension: "cab",
mime: "vnd.ms-cab-compressed",
description: "",
signature: {
0: 0x4d,
1: 0x53,
2: 0x43,
3: 0x46,
4: 0x00,
5: 0x00,
6: 0x00,
7: 0x00
},
extractor: null
},
{
name: "Jar Archive",
extension: "jar",
mime: "application/java-archive",
description: "",
signature: {
0: 0x5f,
1: 0x27,
2: 0xa8,
3: 0x89
},
extractor: null
},
{
name: "Jar Archive",
extension: "jar",
mime: "application/java-archive",
description: "",
signature: {
0: 0x50,
1: 0x4B,
2: 0x03,
3: 0x04,
4: 0x14,
5: 0x00,
6: 0x08,
7: 0x00,
8: 0x08,
9: 0x00
},
extractor: extractZIP
},
{
name: "lzop compressed",
extension: "lzop,lzo",
mime: "application/x-lzop",
description: "",
signature: {
0: 0x89,
1: 0x4c, // LZO
2: 0x5a,
3: 0x4f,
4: 0x00,
5: 0x0d,
6: 0x0a,
7: 0x1a
},
extractor: extractLZOP
},
{
name: "Linux deb package",
extension: "deb",
mime: "application/vnd.debian.binary-package",
description: "",
signature: {
0: 0x21,
1: 0x3C,
2: 0x61,
3: 0x72,
4: 0x63,
5: 0x68,
6: 0x3e
},
extractor: extractDEB
},
{
name: "Apple Disk Image",
extension: "dmg",
mime: "application/x-apple-diskimage",
description: "",
signature: {
0: 0x78,
1: 0x01,
2: 0x73,
3: 0x0d,
4: 0x62,
5: 0x62,
6: 0x60
},
extractor: null
}
],
"Miscellaneous": [
{
name: "UTF-8 text",
extension: "txt",
mime: "text/plain",
description: "UTF-8 encoded Unicode byte order mark, commonly but not exclusively seen in text files.",
signature: {
0: 0xef,
1: 0xbb,
2: 0xbf
},
extractor: null
},
{ // Place before UTF-16 LE text
name: "UTF-32 LE text",
extension: "utf32le",
mime: "charset/utf32le",
description: "Little-endian UTF-32 encoded Unicode byte order mark.",
signature: {
0: 0xff,
1: 0xfe,
2: 0x00,
3: 0x00
},
extractor: null
},
{
name: "UTF-16 LE text",
extension: "utf16le",
mime: "charset/utf16le",
description: "Little-endian UTF-16 encoded Unicode byte order mark.",
signature: {
0: 0xff,
1: 0xfe
},
extractor: null
},
{
name: "Web Open Font Format",
extension: "woff",
mime: "application/font-woff",
description: "",
signature: {
0: 0x77,
1: 0x4f,
2: 0x46,