Re: [OT] Magic numbers
On Sun, Feb 06, 2011 at 09:13:59PM +0000, Lisi wrote:
> On Sunday 06 February 2011 20:35:17 Eduardo M KALINOWSKI wrote:
> > On 02/06/2011 06:27 PM, Lisi wrote:
> > > I need to find out:
> > > a)What the magic number should be for certain types of file and
> > > b)Whether a specific file of that type has the correct magic number.
> > >
> > > Here is my one, so far futile, effort - in addition to googling until I
> > > can see magic numbered smoke coming out of my ears. :-(
> > >
> > > lisi@Tux:~$ cat /usr/share/misc/magic.mgc | grep gzip
> > > Binary file (standard input) matches
> > > lisi@Tux:~$
> > >
> > > I realise that this is more specific to UNIX than specific to Debian -
> > > but it applies to all the UNIX family, and Debian is part of that family.
> > > ;-)
> > That's a binary file, it won't help you much.
> > See the corresponding source package, you should find the same
> > information in that file in a more readable way.
> > --
> > "We shall reach greater and greater platitudes of achievement."
> > -- Richard J. Daley
> > Eduardo M KALINOWSKI
> > email@example.com
> Source code failed because I couldn't find the source code. The gzip that I
> have is a Debian package, and no source code is offered. BUT
> lisi@Tux:~$ cat /usr/share/misc/magic | grep gzip
> # still uses gzip for the control.tar (first in the archive). Only
> #>84 string gz \b, uses gzip compression
> >>14 beshort 0x677a (gzipped)
> >>14 beshort !0x677a (not gzipped)
> >>36 belong&0x4 0x4 gzip
> # compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, etc.
> # gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
> 0 string \037\213 gzip compressed data
> !:mime application/x-gzip
> 0 string \037\236 frozen file 1.0 (or gzip 0.5)
> # + gzipped tarball files
> >512 string \037\213 \b, gzipped
> >>0x2744 lelong 1 gzip compressed
> 0 string llvc1 LLVM byte-codes, gzip compression
> #>65 string Gzip (GNU gzip)
> #>69 string Gzip (GNU gzip)
> >4 string GZ (gzip compressed)
> >20 belong 2 gzipped
> So all I have to do now is a) interpret it and b) find the, hopefully
> matching, code in a specific file!
> Thanks for your help.
> To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact firstname.lastname@example.org
> Archive: email@example.com">http://firstname.lastname@example.org
I find that running "file" on an unknown file may give me more or less usable information.
GNU implementation of file "knows" some magic numbers and applies them to give a best
guess as to what an unkown file is.
Hope this helps,
All the best