yams/data/magic_numbers.json
2025-08-13 19:25:31 -04:00

1007 lines
23 KiB
JSON

{
"version": "1.0",
"description": "File type detection patterns based on magic numbers",
"source": "Compiled from file command database and Wikipedia",
"patterns": [
{
"hex": "FFD8FF",
"offset": 0,
"type": "image",
"mime": "image/jpeg",
"description": "JPEG image",
"confidence": 1.0
},
{
"hex": "FFD8FFE0",
"offset": 0,
"type": "image",
"mime": "image/jpeg",
"description": "JPEG/JFIF image",
"confidence": 1.0
},
{
"hex": "FFD8FFE1",
"offset": 0,
"type": "image",
"mime": "image/jpeg",
"description": "JPEG/Exif image",
"confidence": 1.0
},
{
"hex": "89504E470D0A1A0A",
"offset": 0,
"type": "image",
"mime": "image/png",
"description": "Portable Network Graphics",
"confidence": 1.0
},
{
"hex": "474946383761",
"offset": 0,
"type": "image",
"mime": "image/gif",
"description": "GIF87a image",
"confidence": 1.0
},
{
"hex": "474946383961",
"offset": 0,
"type": "image",
"mime": "image/gif",
"description": "GIF89a image",
"confidence": 1.0
},
{
"hex": "424D",
"offset": 0,
"type": "image",
"mime": "image/bmp",
"description": "Windows bitmap image",
"confidence": 1.0
},
{
"hex": "49492A00",
"offset": 0,
"type": "image",
"mime": "image/tiff",
"description": "TIFF image (little-endian)",
"confidence": 1.0
},
{
"hex": "4D4D002A",
"offset": 0,
"type": "image",
"mime": "image/tiff",
"description": "TIFF image (big-endian)",
"confidence": 1.0
},
{
"hex": "52494646",
"offset": 0,
"type": "multimedia",
"mime": "various",
"description": "RIFF container (WAV, AVI, WebP, etc.)",
"confidence": 0.8
},
{
"hex": "255044462D",
"offset": 0,
"type": "document",
"mime": "application/pdf",
"description": "PDF document",
"confidence": 1.0
},
{
"hex": "D0CF11E0A1B11AE1",
"offset": 0,
"type": "document",
"mime": "application/vnd.ms-office",
"description": "Microsoft Office document (doc, xls, ppt)",
"confidence": 1.0
},
{
"hex": "504B0304",
"offset": 0,
"type": "archive",
"mime": "application/zip",
"description": "ZIP archive (also docx, xlsx, jar, etc.)",
"confidence": 0.9
},
{
"hex": "504B0506",
"offset": 0,
"type": "archive",
"mime": "application/zip",
"description": "ZIP archive (empty)",
"confidence": 1.0
},
{
"hex": "504B0708",
"offset": 0,
"type": "archive",
"mime": "application/zip",
"description": "ZIP archive (spanned)",
"confidence": 1.0
},
{
"hex": "1F8B",
"offset": 0,
"type": "archive",
"mime": "application/gzip",
"description": "GZIP compressed data",
"confidence": 1.0
},
{
"hex": "425A68",
"offset": 0,
"type": "archive",
"mime": "application/x-bzip2",
"description": "BZIP2 compressed data",
"confidence": 1.0
},
{
"hex": "377ABCAF271C",
"offset": 0,
"type": "archive",
"mime": "application/x-7z-compressed",
"description": "7-Zip archive",
"confidence": 1.0
},
{
"hex": "526172211A0700",
"offset": 0,
"type": "archive",
"mime": "application/x-rar-compressed",
"description": "RAR archive v1.50+",
"confidence": 1.0
},
{
"hex": "526172211A070100",
"offset": 0,
"type": "archive",
"mime": "application/x-rar-compressed",
"description": "RAR archive v5.0+",
"confidence": 1.0
},
{
"hex": "7573746172",
"offset": 257,
"type": "archive",
"mime": "application/x-tar",
"description": "POSIX tar archive",
"confidence": 1.0
},
{
"hex": "FD377A585A00",
"offset": 0,
"type": "archive",
"mime": "application/x-xz",
"description": "XZ compressed data",
"confidence": 1.0
},
{
"hex": "4D5A",
"offset": 0,
"type": "executable",
"mime": "application/x-msdownload",
"description": "DOS MZ executable (EXE, DLL)",
"confidence": 1.0
},
{
"hex": "7F454C46",
"offset": 0,
"type": "executable",
"mime": "application/x-executable",
"description": "ELF executable",
"confidence": 1.0
},
{
"hex": "CAFEBABE",
"offset": 0,
"type": "executable",
"mime": "application/java-vm",
"description": "Java class file",
"confidence": 1.0
},
{
"hex": "FEEDFACE",
"offset": 0,
"type": "executable",
"mime": "application/x-mach-binary",
"description": "Mach-O binary (32-bit)",
"confidence": 1.0
},
{
"hex": "FEEDFACF",
"offset": 0,
"type": "executable",
"mime": "application/x-mach-binary",
"description": "Mach-O binary (64-bit)",
"confidence": 1.0
},
{
"hex": "CEFAEDFE",
"offset": 0,
"type": "executable",
"mime": "application/x-mach-binary",
"description": "Mach-O binary (reverse byte order)",
"confidence": 1.0
},
{
"hex": "CFFAEDFE",
"offset": 0,
"type": "executable",
"mime": "application/x-mach-binary",
"description": "Mach-O binary (64-bit reverse)",
"confidence": 1.0
},
{
"hex": "213C617263683E",
"offset": 0,
"type": "archive",
"mime": "application/x-archive",
"description": "Unix archive",
"confidence": 1.0
},
{
"hex": "494433",
"offset": 0,
"type": "audio",
"mime": "audio/mpeg",
"description": "MP3 with ID3v2 tag",
"confidence": 1.0
},
{
"hex": "FFFB",
"offset": 0,
"type": "audio",
"mime": "audio/mpeg",
"description": "MP3 audio (MPEG-1 Layer 3)",
"confidence": 0.9
},
{
"hex": "FFF3",
"offset": 0,
"type": "audio",
"mime": "audio/mpeg",
"description": "MP3 audio (MPEG-2 Layer 3)",
"confidence": 0.9
},
{
"hex": "FFF2",
"offset": 0,
"type": "audio",
"mime": "audio/mpeg",
"description": "MP3 audio (MPEG-2.5 Layer 3)",
"confidence": 0.9
},
{
"hex": "4F676753",
"offset": 0,
"type": "multimedia",
"mime": "application/ogg",
"description": "OGG container",
"confidence": 1.0
},
{
"hex": "664C6143",
"offset": 0,
"type": "audio",
"mime": "audio/flac",
"description": "FLAC audio",
"confidence": 1.0
},
{
"hex": "4D546864",
"offset": 0,
"type": "audio",
"mime": "audio/midi",
"description": "MIDI sound file",
"confidence": 1.0
},
{
"hex": "0000001466747970",
"offset": 4,
"type": "video",
"mime": "video/mp4",
"description": "MP4 video",
"confidence": 1.0
},
{
"hex": "0000001866747970",
"offset": 4,
"type": "video",
"mime": "video/mp4",
"description": "MP4 video",
"confidence": 1.0
},
{
"hex": "0000002066747970",
"offset": 4,
"type": "video",
"mime": "video/mp4",
"description": "MP4 video",
"confidence": 1.0
},
{
"hex": "1A45DFA3",
"offset": 0,
"type": "video",
"mime": "video/x-matroska",
"description": "Matroska video (MKV)",
"confidence": 1.0
},
{
"hex": "000001BA",
"offset": 0,
"type": "video",
"mime": "video/mpeg",
"description": "MPEG video",
"confidence": 0.9
},
{
"hex": "000001B3",
"offset": 0,
"type": "video",
"mime": "video/mpeg",
"description": "MPEG video",
"confidence": 0.9
},
{
"hex": "464C56",
"offset": 0,
"type": "video",
"mime": "video/x-flv",
"description": "Flash video",
"confidence": 1.0
},
{
"hex": "3C3F786D6C20",
"offset": 0,
"type": "text",
"mime": "application/xml",
"description": "XML document",
"confidence": 0.9
},
{
"hex": "EFBBBF",
"offset": 0,
"type": "text",
"mime": "text/plain",
"description": "UTF-8 text with BOM",
"confidence": 0.8
},
{
"hex": "FFFE",
"offset": 0,
"type": "text",
"mime": "text/plain",
"description": "UTF-16 LE text with BOM",
"confidence": 0.8
},
{
"hex": "FEFF",
"offset": 0,
"type": "text",
"mime": "text/plain",
"description": "UTF-16 BE text with BOM",
"confidence": 0.8
},
{
"hex": "FFFE0000",
"offset": 0,
"type": "text",
"mime": "text/plain",
"description": "UTF-32 LE text with BOM",
"confidence": 0.8
},
{
"hex": "0000FEFF",
"offset": 0,
"type": "text",
"mime": "text/plain",
"description": "UTF-32 BE text with BOM",
"confidence": 0.8
},
{
"hex": "2321",
"offset": 0,
"type": "text",
"mime": "text/x-shellscript",
"description": "Shell script (shebang)",
"confidence": 0.9
},
{
"hex": "7B5C727466",
"offset": 0,
"type": "document",
"mime": "text/rtf",
"description": "Rich Text Format",
"confidence": 1.0
},
{
"hex": "38425053",
"offset": 0,
"type": "image",
"mime": "image/vnd.adobe.photoshop",
"description": "Adobe Photoshop",
"confidence": 1.0
},
{
"hex": "25215053",
"offset": 0,
"type": "document",
"mime": "application/postscript",
"description": "PostScript",
"confidence": 1.0
},
{
"hex": "00010000",
"offset": 0,
"type": "font",
"mime": "font/ttf",
"description": "TrueType font",
"confidence": 1.0
},
{
"hex": "774F4646",
"offset": 0,
"type": "font",
"mime": "font/woff",
"description": "Web Open Font Format",
"confidence": 1.0
},
{
"hex": "774F4632",
"offset": 0,
"type": "font",
"mime": "font/woff2",
"description": "Web Open Font Format 2",
"confidence": 1.0
},
{
"hex": "4F54544F",
"offset": 0,
"type": "font",
"mime": "font/otf",
"description": "OpenType font",
"confidence": 1.0
},
{
"hex": "53514C69746520666F726D6174203300",
"offset": 0,
"type": "database",
"mime": "application/x-sqlite3",
"description": "SQLite database version 3",
"confidence": 1.0
},
{
"hex": "EDABEEDB",
"offset": 0,
"type": "package",
"mime": "application/x-rpm",
"description": "RPM package",
"confidence": 1.0
},
{
"hex": "213C617263683E0A",
"offset": 0,
"type": "archive",
"mime": "application/x-archive",
"description": "Unix ar archive",
"confidence": 1.0
},
{
"hex": "4449434D",
"offset": 128,
"type": "medical",
"mime": "application/dicom",
"description": "DICOM medical image",
"confidence": 1.0
},
{
"hex": "0A0D0D0A",
"offset": 0,
"type": "network",
"mime": "application/x-pcapng",
"description": "PCAP-NG network capture",
"confidence": 1.0
},
{
"hex": "D4C3B2A1",
"offset": 0,
"type": "network",
"mime": "application/vnd.tcpdump.pcap",
"description": "PCAP capture (little-endian)",
"confidence": 1.0
},
{
"hex": "A1B2C3D4",
"offset": 0,
"type": "network",
"mime": "application/vnd.tcpdump.pcap",
"description": "PCAP capture (big-endian)",
"confidence": 1.0
},
{
"hex": "4C5A4950",
"offset": 0,
"type": "archive",
"mime": "application/x-lzip",
"description": "LZIP compressed",
"confidence": 1.0
},
{
"hex": "303730373031",
"offset": 0,
"type": "archive",
"mime": "application/x-cpio",
"description": "CPIO archive",
"confidence": 1.0
},
{
"hex": "4D534346",
"offset": 0,
"type": "archive",
"mime": "application/vnd.ms-cab-compressed",
"description": "Microsoft Cabinet file",
"confidence": 1.0
},
{
"hex": "49545346",
"offset": 0,
"type": "installer",
"mime": "application/x-chm",
"description": "Microsoft Compiled HTML Help",
"confidence": 1.0
},
{
"hex": "3F5F",
"offset": 0,
"type": "help",
"mime": "application/x-winhelp",
"description": "Windows Help File",
"confidence": 0.9
},
{
"hex": "4C01",
"offset": 0,
"type": "object",
"mime": "application/x-object",
"description": "Object file",
"confidence": 0.8
},
{
"hex": "2142444E",
"offset": 0,
"type": "mail",
"mime": "application/vnd.ms-outlook",
"description": "Outlook PST file",
"confidence": 1.0
},
{
"hex": "CFAD12FE",
"offset": 0,
"type": "mail",
"mime": "application/vnd.ms-outlook",
"description": "Outlook OST file",
"confidence": 1.0
},
{
"hex": "46726F6D20",
"offset": 0,
"type": "mail",
"mime": "message/rfc822",
"description": "Email message (mbox)",
"confidence": 0.6
},
{
"hex": "52657475726E2D50617468",
"offset": 0,
"type": "mail",
"mime": "message/rfc822",
"description": "Email bounce message",
"confidence": 0.8
},
{
"hex": "789C",
"offset": 0,
"type": "archive",
"mime": "application/zlib",
"description": "Zlib compressed data",
"confidence": 0.9
},
{
"hex": "1F9D",
"offset": 0,
"type": "archive",
"mime": "application/x-compress",
"description": "Compressed file (LZW)",
"confidence": 0.9
},
{
"hex": "1FA0",
"offset": 0,
"type": "archive",
"mime": "application/x-pack",
"description": "Unix pack compressed data",
"confidence": 0.7
},
{
"hex": "4C48",
"offset": 2,
"type": "archive",
"mime": "application/x-lha",
"description": "LHA archive",
"confidence": 0.8
},
{
"hex": "00000100",
"offset": 0,
"type": "image",
"mime": "image/x-icon",
"description": "Icon file",
"confidence": 0.8
},
{
"hex": "00000200",
"offset": 0,
"type": "image",
"mime": "image/x-icon",
"description": "Cursor file",
"confidence": 0.8
},
{
"hex": "4344303031",
"offset": 32769,
"type": "archive",
"mime": "application/x-iso9660-image",
"description": "ISO 9660 CD image",
"confidence": 1.0
},
{
"hex": "4E45531A",
"offset": 0,
"type": "rom",
"mime": "application/x-nintendo-nes-rom",
"description": "Nintendo NES ROM",
"confidence": 1.0
},
{
"hex": "FEEDFEED",
"offset": 0,
"type": "swap",
"mime": "application/x-swap",
"description": "Swap file",
"confidence": 0.9
},
{
"hex": "00000002",
"offset": 0,
"type": "database",
"mime": "application/x-tdb",
"description": "TDB database",
"confidence": 0.7
},
{
"hex": "01DA0101",
"offset": 0,
"type": "database",
"mime": "application/x-gdbm",
"description": "GDBM database",
"confidence": 0.8
},
{
"hex": "00014244",
"offset": 0,
"type": "database",
"mime": "application/x-berkeley-db",
"description": "Berkeley DB",
"confidence": 0.8
},
{
"hex": "DEADBEEF",
"offset": 0,
"type": "debug",
"mime": "application/octet-stream",
"description": "Debug/test pattern",
"confidence": 0.5
},
{
"hex": "2F2A",
"offset": 0,
"type": "code",
"mime": "text/x-c",
"description": "C/C++ source with comment",
"confidence": 0.6
},
{
"hex": "23696E636C756465",
"offset": 0,
"type": "code",
"mime": "text/x-c",
"description": "C/C++ source with #include",
"confidence": 0.8
},
{
"hex": "23646566696E65",
"offset": 0,
"type": "code",
"mime": "text/x-c",
"description": "C/C++ source with #define",
"confidence": 0.7
},
{
"hex": "696D706F7274",
"offset": 0,
"type": "code",
"mime": "text/javascript",
"description": "JavaScript with import",
"confidence": 0.7
},
{
"hex": "636F6E737420",
"offset": 0,
"type": "code",
"mime": "text/javascript",
"description": "JavaScript with const",
"confidence": 0.6
},
{
"hex": "66756E6374696F6E20",
"offset": 0,
"type": "code",
"mime": "text/javascript",
"description": "JavaScript with function",
"confidence": 0.7
},
{
"hex": "696D706F727420",
"offset": 0,
"type": "code",
"mime": "text/x-python",
"description": "Python with import",
"confidence": 0.7
},
{
"hex": "66726F6D20",
"offset": 0,
"type": "code",
"mime": "text/x-python",
"description": "Python with from import",
"confidence": 0.6
},
{
"hex": "646566",
"offset": 0,
"type": "code",
"mime": "text/x-python",
"description": "Python with def",
"confidence": 0.8
},
{
"hex": "636C617373",
"offset": 0,
"type": "code",
"mime": "text/x-python",
"description": "Python with class",
"confidence": 0.7
},
{
"hex": "7075626C696320636C617373",
"offset": 0,
"type": "code",
"mime": "text/x-java-source",
"description": "Java with public class",
"confidence": 0.9
},
{
"hex": "7061636B616765",
"offset": 0,
"type": "code",
"mime": "text/x-java-source",
"description": "Java with package",
"confidence": 0.8
},
{
"hex": "696D706F7274206A617661",
"offset": 0,
"type": "code",
"mime": "text/x-java-source",
"description": "Java with import java",
"confidence": 0.9
},
{
"hex": "666E",
"offset": 0,
"type": "code",
"mime": "text/x-rust",
"description": "Rust with fn",
"confidence": 0.7
},
{
"hex": "75736520",
"offset": 0,
"type": "code",
"mime": "text/x-rust",
"description": "Rust with use",
"confidence": 0.8
},
{
"hex": "6D6F6420",
"offset": 0,
"type": "code",
"mime": "text/x-rust",
"description": "Rust with mod",
"confidence": 0.7
},
{
"hex": "7374727563742020",
"offset": 0,
"type": "code",
"mime": "text/x-rust",
"description": "Rust with struct",
"confidence": 0.8
},
{
"hex": "7061636B616765206D61696E",
"offset": 0,
"type": "code",
"mime": "text/x-go",
"description": "Go with package main",
"confidence": 0.9
},
{
"hex": "696D706F727420",
"offset": 0,
"type": "code",
"mime": "text/x-go",
"description": "Go with import",
"confidence": 0.6
},
{
"hex": "66756E63",
"offset": 0,
"type": "code",
"mime": "text/x-go",
"description": "Go with func",
"confidence": 0.7
},
{
"hex": "7661722020",
"offset": 0,
"type": "code",
"mime": "text/x-go",
"description": "Go with var",
"confidence": 0.6
},
{
"hex": "3C3F706870",
"offset": 0,
"type": "code",
"mime": "text/x-php",
"description": "PHP opening tag",
"confidence": 0.9
},
{
"hex": "24",
"offset": 0,
"type": "code",
"mime": "text/x-php",
"description": "PHP variable",
"confidence": 0.4
},
{
"hex": "3C21444F435459504520",
"offset": 0,
"type": "code",
"mime": "text/html",
"description": "HTML with DOCTYPE",
"confidence": 0.9
},
{
"hex": "3C68746D6C",
"offset": 0,
"type": "code",
"mime": "text/html",
"description": "HTML opening tag",
"confidence": 0.8
},
{
"hex": "3C21402D2D20",
"offset": 0,
"type": "code",
"mime": "text/html",
"description": "HTML comment start",
"confidence": 0.7
},
{
"hex": "24736368656D61",
"offset": 0,
"type": "data",
"mime": "application/json",
"description": "JSON Schema",
"confidence": 0.8
},
{
"hex": "7B",
"offset": 0,
"type": "data",
"mime": "application/json",
"description": "JSON object start",
"confidence": 0.5
},
{
"hex": "5B",
"offset": 0,
"type": "data",
"mime": "application/json",
"description": "JSON array start",
"confidence": 0.4
},
{
"hex": "2D2D2D0A",
"offset": 0,
"type": "data",
"mime": "text/yaml",
"description": "YAML document start",
"confidence": 0.8
},
{
"hex": "6170692D76657273696F6E",
"offset": 0,
"type": "config",
"mime": "text/x-yaml",
"description": "Kubernetes YAML",
"confidence": 0.9
},
{
"hex": "5C646F63756D656E74636C617373",
"offset": 0,
"type": "document",
"mime": "text/x-tex",
"description": "LaTeX document",
"confidence": 0.9
},
{
"hex": "5C626567696E",
"offset": 0,
"type": "document",
"mime": "text/x-tex",
"description": "LaTeX with begin",
"confidence": 0.7
},
{
"hex": "23212F62696E2F",
"offset": 0,
"type": "script",
"mime": "text/x-shellscript",
"description": "Shell script shebang",
"confidence": 0.9
},
{
"hex": "23212F7573722F62696E2F",
"offset": 0,
"type": "script",
"mime": "text/x-shellscript",
"description": "Shell script shebang",
"confidence": 0.9
},
{
"hex": "23212F7573722F62696E2F707974686F6E",
"offset": 0,
"type": "script",
"mime": "text/x-python",
"description": "Python script shebang",
"confidence": 0.95
},
{
"hex": "23212F7573722F62696E2F656E76207079",
"offset": 0,
"type": "script",
"mime": "text/x-python",
"description": "Python script env shebang",
"confidence": 0.95
}
]
}