What is a magic number?

Resolving The Problem

QUESTION: What is a magic number?

ANSWER: A magic number is a numeric or string constant that indicates the file type. This number is in the first 512 bytes of the file. By default the localized magic file /usr/lib/locale/locale/LC_MESSAGES/magic is used to identify files that have a magic number. If a localized magic file does not exist, the /etc/magic file is utilized. From the command line a user can do the following command, "File script", which will result in the output, "script: executable shell script".

Appended below is the contents of the file /etc/magic.

#ident "@(#)magic 1.36 98/03/03 SMI" /* SVr4.0 1.30 */

# file cmd's magic file
#
#
# Basically, the fields of this file are as follows:
# byte offset, value type, optional operator (= by default), value
# to match (numeric or string), and string to be printed. Numeric
# values may be decimal, octal, or hex. Also note that the last
# string may have 1 printf format spec.
# The '>' in occassional column 1's is magic: it forces file to
# continue scanning and matching additional lines. The first line
# afterwards not so marked terminates the search.
#
#
# The entry for ELF is not needed anymore, as file now uses the elf(3e)
# routines to look at ELF files. It remains here, commented out, in case
# someone really needs it.
#0 string \177ELF ELF
#>4 byte 1 32-bit
#>5 byte 1 LSB
#>5 byte 2 MSB
#>16 short 0 unknown type
#>16 short 1 relocatable
#>16 short 2 executable
#>16 short 3 dynamic lib
#>16 short 4 core file
#>18 short 0 unknown machine
#>18 short 1 WE32100
#>18 short 2 SPARC
#>18 short 3 80386
#>18 short 4 M68000
#>18 short 5 M88000
#>18 short 6 i80486
#>18 short 7 i860
#>18 short 8 RS3000_BE
#>18 short 9 UNKNOWN
#>18 short 10 RS3000_LE
#>18 short 11 RS6000
#>18 short 12 UNKNOWN
#>18 short 13 UNKNOWN
#>18 short 14 UNKNOWN
#>18 short 15 PA_RISC
#>18 short 16 nCUBE
#>18 short 17 VPP500
#>18 short 18 SPARC32PLUS
#>18 short 19 UNKNOWN
#>18 short 20 PowerPC
#>20 long 1 Version 1
#>36 long 1 MAU Required
257 string ustar USTAR tar archive
>156 byte 88 extended format
0 short 070701 cpio archive
0 string 070701 ASCII cpio archive
0 short 070702 cpio archive - CRC header
0 string 070702 ASCII cpio archive - CRC header
0 short 070707 cpio archive - CHR (-c) header
0 string 070707 ASCII cpio archive - CHR (-c) header
0 long 0177555 obsolete ar archive
0 short 0177545 pdp11/pre System V ar archive
0 long 0100554 apl workspace
0 short 017037 packed data
0 string <ar> System V Release 1 ar archive
0 string !<arch> current ar archive
0 short 0407 pdp11/pre System V vax executable
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 0401 unix-rt ldp
0 short 0405 pdp11 overlay
0 short 0410 pdp11/pre System V vax pure executable
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 0411 pdp11 separate I&D
>8 short >0 not stripped
>15 byte >0 - version %ld
0 short 015001 Compiled Terminfo Entry
0 short 0433 Curses screen image
0 short 0434 Curses screen image
0 short 0437 pdp11 kernel overlay
0 short 0570 vax executable
>12 long >0 not stripped
>22 short >0 - version %ld
0 short 0575 vax pure executable
>12 long >0 not stripped
>22 short >0 - version %ld
0 short 0502 basic-16 executable
>12 long >0 not stripped
>22 short >0 - version %ld
0 short 0503 basic-16 executable (TV)
>12 long >0 not stripped
>22 short >0 - version %ld
0 short 0510 x86 executable
>12 long >0 not stripped
0 short 0511 x86 executable (TV)
>12 long >0 not stripped
0 short 0550 3b20 executable
>12 long >0 not stripped
>22 short >0 - version %ld
0 short 0551 3b20 executable (TV)
>12 long >0 not stripped
>22 short >0 - version %ld
0 short 0560 WE32000 executable
>12 long >0 not stripped
>18 short ^00010000 - N/A on 3b2/300 w/paging
>18 short &00020000 - 32100 required
>18 short &00040000 and mau hardware required
>20 short 0443 (target shared library)
>20 short 0410 (swapped)
>20 short 0413 (paged)
>22 short >0 - version %ld
0 short 0561 WE32000 executable (TV)
>12 long >0 not stripped
>18 short &00020000 - 32100 required
>18 short &00040000 and mau hardware required
>22 short >0 - version %ld
0 short =0512 iAPX 286 executable small model (COFF)
>12 long >0 not stripped
>22 short >0 - version %ld
0 short =0522 iAPX 286 executable large model (COFF)
>12 long >0 not stripped
>22 short >0 - version %ld
0 short 0514 iAPX 386 executable (COFF) (deprecated)
>12 long >0 not stripped
>22 short >0 - version %ld
0 short 0520 mc68k executable
>12 long >0 not stripped
0 short 0521 mc68k executable (shared)
>12 long >0 not stripped
0 short 0522 mc68k executable (shared demand paged)
>12 long >0 not stripped
2 short 0410 pure
>1 byte 0 sun2 executable
>1 byte 1 mc68010 executable
>1 byte 2 mc68020 executable
>1 byte 3 SPARC executable
>0 byte >077 dynamically linked
2 short 0407 impure
>1 byte 0 sun2 executable
>1 byte 1 mc68010 executable
>1 byte 2 mc68020 executable
>1 byte 3 SPARC executable
>0 byte >077 dynamically linked
2 short 0413 Sun demand paged
>1 byte 0 sun2 executable
>1 byte 1 mc68010 executable
>1 byte 2 mc68020 executable
>1 byte 3 SPARC executable
>0 byte >077 dynamically linked
0 short 0x8001 Adobe PostScript Type 1 binary font (PFB)
0 long 0x00010000 TrueType font file version 1.0 (TTF)
0 byte 0x80 8086 relocatable (Microsoft)
0 byte 0xf0 MS-DOS library
0 short 0xff65 x.out
>2 string __.SYMDEF randomized
>0 byte x archive
0 short 0x206 Microsoft a.out
>0x1e short &0x10 overlay
>0x1e short &0x2 separate
>0x1e short &0x4 pure
>0x1e short &0x800 segmented
>0x1e short &0x400 standalone
>0x1e short &0x8 fixed-stack
>0x1c byte &0x80 byte-swapped
>0x1c byte &0x40 word-swapped
>0x10 long >0 not-stripped
>0x1e short ^0xc000 pre-SysV
>0x1c byte &0x4 86
>0x1c byte &0x9 286
>0x1c byte &0xa 386
>0x1e short &0x1 executable
>0x1e short ^0x1 object file
>0x1e short &0x40 Large Text
>0x1e short &0x20 Large Data
>0x1e short &0x120 Huge Objects Enabled
0 short 0x10b VAX demand load format a.out object file
>0x10 long >0 not stripped
0 short 0x140 old Microsoft 8086 x.out
>0x3 byte &0x4 separate
>0x3 byte &0x2 pure
>0 byte &0x1 executable
>0 byte ^0x1 relocatable
>0x14 long >0 not stripped
0 long 0x10b VAX demand load format a.out object file
>0x10 long >0 not stripped
0 long 0x140 old Microsoft 8086 x.out
>0x3 byte &0x4 separate
>0x3 byte &0x2 pure
>0 byte &0x1 executable
>0 byte ^0x1 relocatable
>0x14 long >0 not stripped
0 long 0xe807 object file (z8000 a.out)
0 long 0xe808 pure object file (z8000 a.out)
0 long 0xe809 separate object file (z8000 a.out)
0 long 0xe805 overlay object file (z8000 a.out)
0 long 0x178 Bell 5.0 executable
2 short 0410 Sun read-only text executable
>2 short 0407 Sun old executable
>1 char 3 (SPARC)
>1 char 2 (68020)
>1 char 1 (68010)
>1 char 0 (Sun2)
# The following are from SunOS 4.1
0 short 0143561 byte-swapped cpio archive
0 long 0101555 PDP-11 single precision APL workspace
0 long 0101554 PDP-11 double precision APL workspace
0 long 0101557 VAX single precision APL workspace
0 long 0101556 VAX double precision APL workspace
0 short 017437 old packed data
0 string \037\036 packed data
0 string \377\037 compacted data
0 string \037\235 compressed data
>2 byte&0x80 >0 block compressed
>2 byte&0x1f x %d bits
0 string \037\213 gzip compressed data
>2 byte 8 - deflate method
>3 byte &0x1 , ascii
>3 byte &0x2 , continuation
>3 byte &0x4 , extra field
>3 byte &0x8 , original file name
>3 byte &0x10 , comment
>3 byte &0x20 , encrypted
>8 byte 2 , max compression
>8 byte 4 , max speed
0 string !<arch>\n__.SYMDEF archive random library
0 long 0x1010101 MMDF mailbox
0 string <!OPS Interleaf ASCII document
24 string SunGKS SunGKS
# version number follows, in the form m.n
>0 string GKSM Metafile
0 string GKSM GKS Metafile
# version number follows, in the form <!OPS, Version n.n>
0 string %!PS-AdobeFont Adobe PostScript ASCII font (PFA)
0 string %! PostScript document
# version ID follows, in the form PS-Adobe-nn
0 string Interpress/Xerox Interpress document

# version ID follows, in the form /n.n
0 string StartFontMetrics Adobe font metrics
0 string StartFont Adobe font bits
0 long 0x137A2944 NeWS bitmap font
0 long 0x137A2947 NeWS font family
8 long 0x137A2B45 X11/NeWS bitmap font
8 long 0x137A2B48 X11/NeWS font family
0 string snoop Snoop capture file
>8 long >0 - version %ld
0 short 0436 vfont definition
0 string <MakerFile Frame Maker document
0 string <MIFFile Frame Maker MIF file
0 string <MML Frame Maker MML file
0 string .snd audio data:
>12 long 1 8-bit u-law,
>12 long 2 8-bit linear PCM,
>12 long 3 16-bit linear PCM,
>12 long 4 24-bit linear PCM,
>12 long 5 32-bit linear PCM,
>12 long 6 32-bit floating point,
>12 long 7 64-bit floating point,
>12 long 23 compressed (4-bit G.721 ADPCM),
>12 long 24 compressed (8-bit G.722 ADPCM),
>12 long 25 compressed (3-bit G.723 ADPCM),
>12 long 26 compressed (5-bit G.723 ADPCM),
>12 long 27 8-bit A-law,
>20 long 1 mono,
>20 long 2 stereo,
>20 long 4 quad,
>16 long x %d Hz
0 short 0x1010 PEX Binary Archive
0 long 0x59a66a95 rasterfile,
>4 long >0 %ld x
>8 long >0 %ld x
>12 long >0 %ld
>20 long 0 old format image
>20 long 1 standard format image
>20 long 2 run-length byte encoded image
>20 long 3 XRGB or RGB format image
>20 long 4 tiff format image
>20 long 5 iff (TAAC format) image
>20 long 0xffff experimental format image
0 long 0x884f5053 Interleaf fast-saved document
0 long 0x2a535441 Aster*x
>7 long 0x574f5244 Words Document
>7 long 0x47524150 Graphic
>7 long 0x53505245 Spreadsheet
>7 long 0x4d414352 Macro
0 long 0x32323738 Aster*x Version 2
>29 byte 0x36 Words Document
>29 byte 0x35 Graphic
>29 byte 0x32 Spreadsheet
>29 byte 0x38 Macro
4 string pgscriptver IslandWrite document
13 string DrawFile IslandDraw document
0 string P1 PBM ascii file
0 string P2 PGM ascii file
0 string P3 PPM ascii file
0 string P4 PBM raw file
0 string P5 PGM raw file
0 string P6 PPM raw file
0 string \115\115 TIFF file, big-endian
0 string \111\111 TIFF file, little-endian
0 string GIF87a GIF file, v87
0 string GIF89a GIF file, v89
0 string \377\330\377\340 JPEG file
0 string \377\330\377\356 JPG file
8 string ILBM IFF ILBM file
0 string \312\376\272\276 java class file
# Magic number to identify profiles related to the Kodak ColorManagement
# System. (KCMS). KCMS uses the ICC format identified by "acsp" at byte 36.
36 string acsp Kodak Color Management System, ICC Profile
0 string %PDF-1.0 Adobe Portable Document Format (PDF) v1.0
0 string %PDF-1.1 Adobe Portable Document Format (PDF) v1.1
0 string %PDF-1.2 Adobe Portable Document Format (PDF) v1.2
0 string PK\003\004 ZIP archive
0 string MZ DOS executable (EXE)
0 string LZ DOS built-in
0 byte 0xe9 DOS executable (COM)
0 byte 0xeb DOS executable (COM)