Executable Binaries

Mnemonic

Magic Bytes Signature

DOS Executable

“MZ”

0x4D 0x5A

PE32 Executable

“MZ””PE..”

0x4D 0x5A … 0x50 0x45 0x00 0x00

Mach-O Executable (32 bit)

“FEEDFACE”

0xFE 0xED 0xFA 0xCE

Mach-O Executable (64 bit)

“FEEDFACF”

0xFE 0xED 0xFA 0xCF

ELF Executable

”.ELF”

0x7F 0x45 0x4C 0x46

Compressed Archives

Mnemonic

Signature

Zip Archive

“PK..”

0x50 0x4B 0x03 0x04

Rar Archive

“Rar!…”

0x52 0x61 0x72 0x21 0x1A 0x07 0x01 0x00

Ogg Container

“OggS”

0x4F 0x67 0x67 0x53

Matroska/EBML Container

N/A

0x45 0x1A 0xA3 0xDF

Image File Formats

Mnemonic

Signature

PNG Image

”.PNG…”

0x89 0x50 0x4E 0x47 0x0D 0x0A 0x1A 0x0A

BMP Image

“BM”

0x42 0x4D

GIF Image

“GIF87a”

0x47 0x49 0x46 0x38 0x37 0x61

“GIF89a”

0x47 0x49 0x46 0x38 0x39 0x61