[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [OT] Magic numbers

Lisi wrote:
> Thanks, Andy - yes, it told me what the files were, and its best guess was 
> good.  (I should know - I created the files!) 
> But no actual magic numbers. :-(

Help us out.  Can you phrase an example of what you want?  Otherwise
the only magic number anyone can give you is 42.

"Magic" is relative here.  The file program simply looks at parts here
and parts there of the file and then makes a best-guess about it.  The
magic file database in libmagic1 is a documentation of that best guess
effort.  See the man page for information about the format of the
information there.

  man magic

So for example most files don't have a single magic number.  Most types
of files have many possible combinations.  And when files are layered
it is more difficult such as a tar of script, or a gzip'd file that is
a tar of a script.  The file program will quickly try to undo those
layers and make a guess.  It isn't perfect.

Since the file program tries to work across any possibility in the
universe it has a very hard task.  If you have a more restricted set
of input files you might be able to do better.

For example '#!/' and #! /' denote scripts.  Any file that starts with
the binary data 23 21 20 2f or 23 21 2f is almost certainly a shell
script.  What type?  For that you need to look further and see what
characters follow.

Note that in Squeeze /usr/share/misc/magic is now an empty directory
instead of a file.  The source isn't installed anymore.  That is a
shame.  For squeeze you will need to install the source package to get
to raw data that you can look at.

  apt-get source libmagic1
  cd file-5.04
  ls -log magic/Magdir/


Attachment: signature.asc
Description: Digital signature

Reply to: