通过文件头标识判断图片格式

创建时间：2017-04-01 投稿人：浏览次数：149

通过文件头标识判断图片格式

用Delphi从内存流中通过文件头标识判断图片格式

文件头标识大全:
http://www.garykessler.net/library/file_sigs.html

http://filext.com/index.php

图片的格式很多，一个图片文件的后缀名并不能说明这个图片的真正格式什么，那么如何获取图片的格式呢？我想到了几个简单但有效的方法，那就是读取图片文件的文件头标识。我们知道各种格式的图片的文件头标识识不同的，因此我们可以通过判断文件头的标识来识别图片格式。
   我对各种格式的图片文件头标识进行了分析，不仅查找资料，也用十六进制编辑器察看过图片的文件头，以下是我收集、分析的结果，供大家参考。

1.JPEG
- 文件头标识 (2 bytes): $ff, $d8 (SOI) (JPEG 文件标识)
- 文件结束标识 (2 bytes): $ff, $d9 (EOI)

2.TGA
- 未压缩的前5字节 00 00 02 00 00
- RLE压缩的前5字节 00 00 10 00 00

3.PNG
- 文件头标识 (8 bytes) 89 50 4E 47 0D 0A 1A 0A

4.GIF
- 文件头标识 (6 bytes) 47 49 46 38 39(37) 61
                                 G I F    8 9 (7)    a

5.BMP
- 文件头标识 (2 bytes) 42 4D
                                 B M

6.PCX
- 文件头标识 (1 bytes) 0A

7.TIFF
- 文件头标识 (2 bytes) 4D 4D 或 49 49

8.ICO
- 文件头标识 (8 bytes) 00 00 01 00 01 00 20 20

9.CUR
- 文件头标识 (8 bytes) 00 00 02 00 01 00 20 20

10.IFF
- 文件头标识 (4 bytes) 46 4F 52 4D
                                 F O R M

11.ANI
- 文件头标识 (4 bytes) 52 49 46 46
                                 R    I    F F

   根据这些文件头标识的收集，我可以写一个识别图像格式的模块了。但是在写这个模块之前可以对收集到的文件头标识进行优化，使得程序中字符串比对次数尽量的少。
1.JPEG我们知需要比对文件头的$ff, $d8这两个字符，而不用读取最后的两个结束标识了。
2.TGA，ICO，CUR只需比对第三个与第五个字符即可。
3.PNG比对[89][50]这两个字符。
4.GIF比对[47][49][46]与第五个字符。

废话不多说了，利用内存流来判断文件的格式，其实判断文件的前几个字节就可以简单的判断这个文件是什么类型的文件，例如

jpg文件是 FFD8 (从低位到高位就要反过来 D8FF 下面都是一样)

BMP文件是 424D ---4D42

其他的我就不一一列举了，想知道跟多文件类型分别是用什么字符作为文件的开头的话，下载个C32asm或者UE等这类16进制编辑器就可以看到了。

procedure TForm1.Button1Click(Sender: TObject); //Button1的单击事件
var //声明变量
MyImage:TMemoryStream; //内存流对象
Buffer:Word;
i:integer;
begin
if OpenDialog1.Execute then //OpenDialog1是一个文件打开对话框，在Delphi组件面版的Dialog页中可以找到。
begin
   MyImage:=TMemoryStream.Create; //建立内存流对象

try
   MyImage.LoadFromFile(OpenDialog1.FileName); //把刚刚用户选择的文件载入到内存流中
   MyImage.Position := 0; //移动指针到最开头的位置
   if MyImage.Size = 0 then //如果文件大小等于0，那么
   begin
   //错误
   ShowMessage("错误");
   Exit;
   end;
   MyImage.ReadBuffer(Buffer,2); //读取文件的前２个字节，放到Buffer里面

   if Buffer=$4D42 then //如果前两个字节是以4D42[低位到高位]
   begin
   ShowMessage("BMP"); //那么这个是BMP格式的文件
   end
   else if Buffer=$D8FF then //如果前两个字节是以D8FF[低位到高位]
  begin
      //JPEG
   ShowMessage("JPEG"); //........一样　下面不注释了
   end
   else if Buffer=$4947 then
   begin
      //GIF
   ShowMessage("GIF");
   end
   else if Buffer=$050A then
   begin
      //PCX
   ShowMessage("PCX");
   end
   else if Buffer=$5089 then
   begin
      //PNG
   ShowMessage("PNG");
   end
   else if Buffer=$4238 then
   begin
      //PSD
   ShowMessage("PSD");
   end
   else if Buffer=$A659 then
   begin
      //RAS
   ShowMessage("RAS");
   end
   else if Buffer=$DA01 then
   begin
      //SGI
   ShowMessage("SGI");
   end
   else if Buffer=$4949 then
   begin
      //TIFF
   ShowMessage("TIFF");
   end
   else //如是其他类型的文件的话，直接显示错误
   begin
      //ERR
   ShowMessage("ERR");
   end; //if
end; //if

finally

MyImage.Free; //释放内存流对象

end;
end;

上面的过程只是简单的判断文件的前2个字节，如果想更加精确一点的话，可以把文件最后2个字节也判断上。

摘自:

http://hi.baidu.com/txbzpfwl/blog/item/fd9b42441a222a8bb2b7dc03.html

http://blog.chinaunix.net/u2/64377/showart_511450.html

**************************************************************************************

各种格式图片文件头标识分析

图片的格式很多，一个图片文件的后缀名并不能说明这个图片的真正格式什么，那么如何获取图片的格式呢？我想到了几个简单但有效的方法，那就是读取图片文件的文件头标识。我们知道各种格式的图片的文件头标识识不同的，因此我们可以通过判断文件头的标识来识别图片格式。
   我对各种格式的图片文件头标识进行了分析，不仅查找资料，也用十六进制编辑器察看过图片的文件头，以下是我收集、分析的结果，供大家参考。

1.JPEG
- 文件头标识 (2 bytes): $ff, $d8 (SOI) (JPEG 文件标识)
- 文件结束标识 (2 bytes): $ff, $d9 (EOI)

2.TGA
- 未压缩的前5字节 00 00 02 00 00
- RLE压缩的前5字节 00 00 10 00 00

3.PNG
- 文件头标识 (8 bytes) 89 50 4E 47 0D 0A 1A 0A

4.GIF
- 文件头标识 (6 bytes) 47 49 46 38 39(37) 61
                     G  I F  8  9 (7)  a

5.BMP
- 文件头标识 (2 bytes) 42 4D
                     B  M

6.PCX
- 文件头标识 (1 bytes) 0A

7.TIFF
- 文件头标识 (2 bytes) 4D 4D 或 49 49

8.ICO
- 文件头标识 (8 bytes) 00 00 01 00 01 00 20 20

9.CUR
- 文件头标识 (8 bytes) 00 00 02 00 01 00 20 20

10.IFF
- 文件头标识 (4 bytes) 46 4F 52 4D
                     F  O  R  M

11.ANI
- 文件头标识 (4 bytes) 52 49 46 46
                           R  I  F F

   根据这些文件头标识的收集，我可以写一个识别图像格式的模块了。但是在写这个模块之前可以对收集到的文件头标识进行优化，使得程序中字符串比对次数尽量的少。
1.JPEG我们知需要比对文件头的$ff, $d8这两个字符，而不用读取最后的两个结束标识了。
2.TGA，ICO，CUR只需比对第三个与第五个字符即可。
3.PNG比对[89][50]这两个字符。
4.GIF比对[47][49][46]与第五个字符。

   到这里，我想代码是不难写的，但是为了方便大家我还是把代码贴出来了，如果这代码写的不好，可以与我讨论。您可采用下面的代码，但请保留版权，谢谢！

模块代码如下：

"枚举图片格式种类
Public Enum ImageForm
[BMP] = 0
[JPEG] = 1
[GIF87] = 2
[GIF89] = 3
[PNG] = 4
[TGA Normal] = 5 "TGA未压缩
[TGA RLE] = 6    "TGA经过RLE压缩后的
[PCX] = 7
[TIFF] = 8
[ICO] = 9
[CUR] = 10
[IFF] = 11
[ANI] = 12
[Other] = 13
[FileError] = 14
End Enum

"-----------------------------------------------------------------------
"-----------------------------------------------------------------------
"-- 标题：获取图片的格式
"-- 作者：BEAR-BEN
"-- 制作日期：2007-8-5
"-- 支持的格式：BMP,JPEG,GIF,PNG,TGA,PCX,TIFF,
"                            ICO,CUR,IFF,ANI 共11种格式
"-- 版本：1.0
"-- 使用者请保留版权，谢谢！
"-----------------------------------------------------------------------
"-----------------------------------------------------------------------
Public Function GetImageFileForm(ImageFilePath As String) As ImageForm
Dim FileHeader(5) As Byte, FileNumber As Integer

GetImageFileForm = FileError

If Dir(ImageFilePath) <> "" Then "判断图片文件是否存在
   FileNumber = FreeFile
   Open ImageFilePath For Binary As #FileNumber
   Get FileNumber, , FileHeader() "二进制流读取图片前5个字符
   Close FileNumber

   GetImageFileForm = Other


"文件头标识识别
   If (FileHeader(0) = 66) And (FileHeader(1) = 77) Then
   GetImageFileForm = BMP
   Exit Function
   End If
   If (FileHeader(0) = 255) And (FileHeader(1) = 216) Then
   GetImageFileForm = JPEG
   Exit Function
   End If
   If (FileHeader(0) = 71) And (FileHeader(1) = 73) And (FileHeader(2) = 70) And (FileHeader(4) = 57) Then
   GetImageFileForm = GIF89
   Exit Function
   End If
   If (FileHeader(0) = 71) And (FileHeader(1) = 73) And (FileHeader(2) = 70) And (FileHeader(4) = 55) Then
   GetImageFileForm = GIF87
   Exit Function
   End If
   If (FileHeader(0) = 137) And (FileHeader(1) = 80) Then
   GetImageFileForm = PNG
   Exit Function
   End If
   If (FileHeader(0) = 73) And (FileHeader(1) = 73) Then
   GetImageFileForm = TIFF  "TIFF 摩托罗拉
   Exit Function
   End If
   If (FileHeader(0) = 77) And (FileHeader(1) = 77) Then
   GetImageFileForm = TIFF  "TIFF Intel
   Exit Function
   End If
   If (FileHeader(2) = 1) And (FileHeader(4) = 1) Then
   GetImageFileForm = ICO
   Exit Function
   End If
   If (FileHeader(2) = 2) And (FileHeader(4) = 1) Then
   GetImageFileForm = CUR
   Exit Function
   End If
   If (FileHeader(0) = 82) And (FileHeader(1) = 73) And (FileHeader(2) = 70) And (FileHeader(3) = 70) Then
   GetImageFileForm = ANI
   Exit Function
   End If
   If (FileHeader(2) = 2) And (FileHeader(4) = 0) Then
   GetImageFileForm = [TGA Normal]
   Exit Function
   End If
   If (FileHeader(2) = 16) And (FileHeader(4) = 0) Then
   GetImageFileForm = [TGA RLE]
   Exit Function
   End If
   If (FileHeader(0) = 10) Then
   GetImageFileForm = PCX
   Exit Function
   End If
End If
End Function

摘自: http://hi.baidu.com/qq625576032/blog/item/a7044a98c02432016e068c35.html

**************************************************************************************

文件头标识大全:
http://www.garykessler.net/library/file_sigs.html

FILE SIGNATURES TABLE

1/27/2010

This table of file signatures (aka "magic numbers") is a continuing work-in-progress. I have found little information on this in a single place, with the exception of the table in Forensic Computing: A Practitioner"s Guide by T. Sammes & B. Jenkinson (Springer, 2000); that was my inspiration to start this list. Comments, additions, and queries can be sent to Gary Kessler at gck@garykessler.net.

This list is not exhaustive. Interpret the table as the magic number generally indicating the file type rather than the file type always having the given magic number. If you want to know to what a particular file extension refers, check out some of these sites:

FILExt: The File Extension Source
File Extension Seeker: Metasearch engine for file extensions
fileinfo.net
Wotsit.org, The Programmer"s File and Data Format Resource
Dot What!?, The net"s #1 file extension website
Other useful and reasonably current sources for file signatures include:

C.E. Codere"s File Format site
ProDiscover"s headersig.txt file
A magic file commonly available with Unix and Linux systems
You might also want to check out Tim Coakley"s Filesig.co.uk site, with Filesig Manager and Simple Carver. Take a look also at Marco Pontello"s TrID - File Identifier, a utility designed to identify file types from their binary signatures.

Details on graphics file formats can be found at The Graphics File Formats Page.

The following individuals have given me updates or suggestions for this list over the last couple of years: Devon Ackerman, Vladimir Benko, Sam Brothers, Per Christensson, Jeffrey Duggan, George Harpur, Brian High, Eric Huber, Axel Kesseler, Bill Kuhns, Anand Mani, Kevin Mansell, Michal, Bruce Modick, Lee Nelson, Jorge Paulhiac, Mike Sutton, Franklin Webber, and David Wright. I thank them and apologize if I have missed anyone.

I would like to give particular thanks to Danny Mares of Mares and Company, author of the MaresWare Suite (primarily for the "subheaders" for many of the file types here), and the people at X-Ways Forensicsfor their permission to use their lists of file signatures.

Hex Signature    ASCII Signature
File Extension      File Description

TGA      Truevision Targa Graphic file
Trailer:
54 52 55 45 56 49 53 49 TRUEVISI
4F 4E 2D 58 46 49 4C 45 ON-XFILE
2E 00                   ..

00      .
PIC      IBM Storyboard bitmap file
PIF      Windows Program Information File
SEA      Mac Stuffit Self-Extracting Archive
YTR      IRIS OCR data file

[11 byte offset]
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00      [11 byte offset]
........
........
........
PDB      Palmpilot Database/Document File

00 00 00 nn 66 74 79 70
33 67 70      ....ftyp
3gp
3GG, 3GP, 3G2      3rd Generation Partnership Project 3GPP (nn=0x14)
and 3GPP2 (nn=0x20) multimedia files

00 00 00 18 66 74 79 70
33 67 70 35      ....ftyp
3gp5
MP4      MPEG-4 video files

00 00 00 20 66 74 79 70
4D 34 41 20 00 00 00 00      ....ftyp
M4A ....
M4A      Apple Lossless Audio Codec file

M4A, M4V      QuickTime M4A/M4V file

00 00 01 00      ....
ICO      Windows icon file
SPL      Windows NT/2000/XP printer spool file

00 00 01 Bx      ....
MPEG, MPG      MPEG video file

00 00 01 BA      ....o
VOB      DVD Video Movie File (video/dvd, video/mpeg)

00 00 02 00      ......
CUR      Windows cursor file
WB2      QuattroPro for Windows Spreadsheet file

00 00 02 00 06 04 06 00
08 00 00 00 00 00      ........
......
WK1      Lotus 1-2-3 spreadsheet (v1) file

00 00 1A 00 00 10 04 00
00 00 00 00      ........
....
WK3      Lotus 1-2-3 spreadsheet (v3) file

00 00 1A 00 02 10 04 00
00 00 00 00      ........
....
WK4, WK5      Lotus 1-2-3 spreadsheet (v4, v5) file

00 00 1A 00 05 10 04      .......
123      Lotus 1-2-3 spreadsheet (v9) file

00 00 49 49 58 50 52 or      ..IIXPR
00 00 4D 4D 58 50 52      ..MMXPR
QXD      Quark Express document (Intel & Motorola, respectively)
NOTE: It appears that the byte following the 0x52 ("R") is
the language indicator; 0x33 ("3") seems to indicate English
and 0x61 ("a") reportedly indicates Korean.

00 00 FE FF      ..t?
n/a      Byte-order mark for 32-bit Unicode Transformation Format/
4-octet Universal Character Set (UTF-32/UCS-4), big-endian files.
(See the Unicode Home Page.)

[7 byte offset]
00 00 FF FF FF FF      [7 byte offset]
..????
HLP      Windows Help file

00 01 00 00 4D 53 49 53
41 4D 20 44 61 74 61 62
61 73 65      ....MSIS
AM Datab
ase
MNY      Microsoft Money file

00 01 00 00 53 74 61 6E
64 61 72 64 20 41 43 45
20 44 42      ....Stan
dard ACE
DB
ACCDB      Microsoft Access 2007 file

00 01 00 00 53 74 61 6E
64 61 72 64 20 4A 65 74
20 44 42      ....Stan
dard Jet
DB
MDB      Microsoft Access file

00 01 00 08 00 01 00 01
01      ........
.
IMG      Ventura Publisher/GEM VDI Image Format Bitmap file

00 01 01      ...
FLT      OpenFlight 3D file

00 01 42 41      ..BA
ABA      Palm Address Book Archive file

00 01 42 44      ..BD
DBA      Palm DateBook Archive file

00 06 15 61 00 00 00 02
00 00 04 D2 00 00 10 00      ...a....
...ò....
DB      Netscape Navigator (v4) database file

00 11 AF      ..ˉ
FLI      FLIC Animation file

00 1E 84 90 00 00 00 00      ..?.....
SNM      Netscape Communicator (v4) mail folder

00 5C 41 B1 FF      .A±?
ENC      Mujahideen Secrets 2 encrypted file

00 BF      .?
SOL      Adobe Flash shared object file (e.g., Flash cookies)

[512 byte offset]
00 6E 1E F0      [512 byte offset]
.n.e
PPT      PowerPoint presentation subheader (MS Office)

00 FF FF FF FF FF FF FF
FF FF FF 00 00 02 00 01      .???????
???.....
MDF      Alcohol 120% CD image

01 00 00 00      ....
EMF      Extended (Enhanced) Windows Metafile Format, printer spool file
(0x18-17 & 0xC4-36 is Win2K/NT; 0x5C0-1 is WinXP)

01 00 00 00 01      .....
PIC      Unknown type picture file

01 00 09 00 00 03      ......
WMF      Windows Metadata file (Win 3.x format)

01 0F 00 00      ....
MDF      Microsoft SQL Server 2000 database

01 10      ..
TR1      Novell LANalyzer capture file

01 DA 01 01 00 03      .ú....
RGB      Silicon Graphics RGB Bitmap

01 FF 02 04 03 02      .?....
DRW      Micrografx vector graphic file

02 64 73 73      .dss
DSS      Digital Speech Standard (Olympus, Grundig, & Phillips)

03      .
DAT      MapInfo Native Data Format
DB3      dBASE III file

03 00 00 00      ....
QPH      Quicken price history file

03 00 00 00 41 50 50 52      ....APPR
ADX      Approach index file

04      .
DB4      dBASE IV data file

05 00 00 00 00 00 00 00
08 00 00 00 20 03 00 00      ........
.... ...
n/a      INFO2 Windows recycle bin file. NOTE: Bytes 13-14
(0x20-03) indicate the size of each INFO2 record
(0x0320 = 800 bytes).

07      .
DRW      A common signature and file extension for many drawing
programs.

07 64 74 32 64 64 74 64      .dt2ddtd
DTD      DesignTools 2D Design file

08      .
DB      dBASE IV or dBFast configuration file

[512 byte offset]
09 08 10 00 00 06 05 00      [512 byte offset]
........
XLS      Excel spreadsheet subheader (MS Office)

0A nn 01 01      ....
PCX      ZSOFT Paintbrush file
(where nn = 0x02, 0x03, or 0x05)

0C ED      .í
MP      Monochrome Picture TIFF bitmap file (unconfirmed)

0D 44 4F 43      .DOC
DOC      DeskMate Document file

0E 4E 65 72 6F 49 53 4F      .NeroISO
NRI      Nero CD Compilation

0E 57 4B 53      .WKS
WKS      DeskMate Worksheet

[512 byte offset]
0F 00 E8 03      [512 byte offset]
..è.
PPT      PowerPoint presentation subheader (MS Office)

11 00 00 00 53 43 43 41      ....SCCA
PF      Windows prefetch file

1A 00 00      ...
NTF      Lotus Notes database template

1A 00 00 04 00 00      ......
NSF      Lotus Notes database

1A 0x      ..
ARC      LH archive file, old version
(where x = 0x2, 0x3, 0x4, 0x8 or 0x9
for types 1-5, respectively)

1A 0B      ..
PAK      Compressed archive file
(often associated with Quake Engine games)

1A 35 01 00      .5..
ETH      GN Nettest WinPharoah capture file

1A 45 DF A3 93 42 82 88
6D 61 74 72 6F 73 6B 61      .E?￡“B??
matroska
MKV      Matroska stream file

1A 52 54 53 20 43 4F 4D
50 52 45 53 53 45 44 20
49 4D 41 47 45 20 56 31
2E 30 1A      .RTS COM
PRESSED
IMAGE V1
.0.
DAT      Runtime Software disk image

1D 7D      .}
WS      WordStar Version 5.0/6.0 document

1F 8B 08      .?.
GZ, TGZ      GZIP archive file

1F 9D 90      ...
TAR.Z      Compressed tape archive file

21 12      !.
AIN      AIN Compressed Archive

21 3C 61 72 63 68 3E 0A      !<arch>.
LIB      Unix archiver (ar) files and Microsoft Program Library
Common Object File Format (COFF)

21 42 44 4E      !BDN
PST      Microsoft Outlook Personal Folder file

23 20      #
MSI      Cerius2 file

23 20 4D 69 63 72 6F 73
6F 66 74 20 44 65 76 65
6C 6F 70 65 72 20 53 74
75 64 69 6F      # Micros
oft Deve
loper St
udio
DSP      Microsoft Developer Studio project file

23 21 41 4D 52      #!AMR
AMR      Adaptive Multi-Rate ACELP (Algebraic Code Excited Linear Prediction)
Codec, commonly audio format with GSM cell phones

23 3F 52 41 44 49 41 4E
43 45 0A      #?RADIAN
CE.
HDR      蔙adiance High Dynamic Range image file

24 46 4C 32 40 28 23 29
20 53 50 53 53 20 44 41
54 41 20 46 49 4C 45      $FL2@(#)
SPSS DA
TA FILE
SAV      SPSS Data file

25 21 50 53 2D 41 64 6F
62 65 2D 33 2E 30 20 45
50 53 46 2D 33 20 30      %!PS-Ado
be-3.0 E
PSF-3.0
EPS      Adobe encapsulated PostScript file
(If this signature is not at the immediate
beginning of the file, it will occur early
in the file, commonly at byte offset 30)

25 50 44 46      %PDF
PDF, FDF      Adobe Portable Document Format and Forms Document file
Trailers:
0A 25 25 45 4F 46 0A (.%%EOF.)
0D 0A 25 25 45 4F 46 0D 0A (..%%EOF..)
0D 25 25 45 4F 46 0D (.%%EOF.)

28 54 68 69 73 20 66 69
6C 65 20 6D 75 73 74 20
62 65 20 63 6F 6E 76 65
72 74 65 64 20 77 69 74
68 20 42 69 6E 48 65 78
20      (This fi
le must
be conve
rted wit
h BinHex

HQX      Macintosh BinHex 4 Compressed Archive

2A 2A 2A 20 20 49 6E 73
74 61 6C 6C 61 74 69 6F
6E 20 53 74 61 72 74 65
64 20      ***  Ins
tallatio
n Starte
d
LOG      Symantec Wise Installer log file

[2 byte offset]
2D 6C 68      [2 byte offset]
-lh
LHA, LZH      Compressed archive file

2E 52 45 43      .REC
IVR      RealPlayer video file (V11 and later)

2E 52 4D 46      .RMF
RM, RMVB      RealMedia streaming media file

2E 52 4D 46 00 00 00 12
00      .RMF....
.
RA      RealAudio file

2E 72 61 FD 00      .ray.
RA      RealAudio streaming media file

2E 73 6E 64      .snd
AU      NeXT/Sun Microsystems μ-Law audio file

30      0
CAT      Microsoft security catalog file

30 00 00 00 4C 66 4C 65      0...LfLe
EVT      Windows Event Viewer file

30 26 B2 75 8E 66 CF 11
A6 D9 00 AA 00 62 CE 6C      0&2u.f?.
|ù.a.b?l
ASF, WMA, WMV      Microsoft Windows Media Audio/Video File
(Advanced Streaming Format)

30 31 4F 52 44 4E 41 4E
43 45 20 53 55 52 56 45
59 20 20 20 20 20 20 20      01ORDNAN
CE SURVE
Y
NTF      National Transfer Format Map File

30 37 30 37 30 nn      07070.
n/a      Archive created with the cpio utility (where nn
values 0x37 ("7"), 0x31 ("1"), and 0x32 ("2") refer to the
standard ASCII format, new ASCII (aka SVR4) format, and CRC
format, respectively. (The swpackage(8) page has additional
information.) (Thanks to F. Webber for this....)

31 BE or      1?
32 BE      2?
WRI      Microsoft Write file

34 CD B2 A1      4í2?
n/a      Extended tcpdump (libpcap) capture file (Linux/Unix)

37 7A BC AF 27 1C      7z?ˉ".
7Z      7-Zip compressed file

38 42 50 53      8BPS
PSD      Photoshop image file

3A 56 45 52 53 49 4F 4E      :VERSION
SLE      Surfplan kite project file

3C      <
ASX      Advanced Stream redirector file
XDR      BizTalk XML-Data Reduced Schema file

3C 21 64 6F 63 74 79 70      <!doctyp
DCI      AOL HTML mail file

3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D      <?xml ve
rsion=
MANIFEST      Windows Visual Stylesheet XML file

3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D 22 31
2E 30 22 3F 3E      <?xml ve
rsion="1
.0"?>
XUL      XML User Interface Language file

3C 3F 78 6D 6C 20 76 65
72 73 69 6F 6E 3D 22 31
2E 30 22 3F 3E 0D 0A 3C
4D 4D 43 5F 43 6F 6E 73
6F 6C 65 46 69 6C 65 20
43 6F 6E 73 6F 6C 65 56
65 72 73 69 6F 6E 3D 22      <?xml ve
rsion="1
.0"?>..<
MMC_Cons
oleFile
ConsoleV
ersion="
MSC      Microsoft Management Console Snap-in Control file

3C 4D 61 6B 65 72 46 69
6

声明：该文观点仅代表作者本人，牛骨文系教育信息发布平台，牛骨文仅提供信息存储空间服务。

热门文章: CTF writeup 2_南邮网络攻防训...; SSM框架——详细整合教程（...; Linux Shell脚本编程－－curl命...; HttpClient使用详解; Java面试题全集（上）; JAVA设计模式之单例模式; java.lang.OutOfMemoryError: PermGen ...; TCP协议中的三次握手和四次...; form表单的两种提交方式，su...; String,StringBuffer与StringBuilder...

最新文章: Java之品优购课程讲义_day20（7）; 剑指 Offer - 8：跳台阶; Netty权威指南_札记02_NIO编程; mysql时间属性之时间戳和datetime之...; 虚拟现实或许可以拯救古埃及的“...; spring cloud服务注册中心eureka---集群...; Java SE 第六章; HTTP请求+数据库; HIDL学习笔记之HIDL C++（第二天）; ubuntu系统下指定tomcat运行时为JDK1.8...