Magic numbers help verify true file types and detect malicious files masquerading as safe formats.
Common signatures
- PDF: %PDF (25 50 44 46).
- PNG: \x89PNG (89 50 4E 47).
- JPEG: \xFF\xD8\xFF (FF D8 FF).
- ZIP: PK (50 4B).
- EXE: MZ (4D 5A).
Security uses
- Detect files with mismatched extensions (.jpg that's really .exe).
- Bypass upload filters that only check file extensions.
- Verify file integrity after download or transfer.
- Identify malware hidden in document files.
Validation
- Check first few bytes against known signatures.
- Compare extension with actual file type.
- Reject uploads with extension/signature mismatches.
Related Articles
View all articlesUnderstanding PE, ELF, and Mach-O: Executable File Format Deep Dive
A comprehensive guide to the three major executable file formats - PE (Windows), ELF (Linux/Unix), and Mach-O (macOS). Learn their structure, security implications, and analysis techniques for malware research and reverse engineering.
Read article →Why Doesn't Magic Number Detection Work for Plain Text Files?
Understand why CSV, TXT, and other plain text files cannot be identified through magic numbers, and learn alternative methods for validating these common file formats.
Read article →What Are File Magic Numbers and Why Are They Important?
Learn about file magic numbers (file signatures) - unique byte sequences that identify true file formats regardless of extensions, and why they
Read article →Why Hash Lookup Fails Against Polymorphic Malware: Understanding Detection Gaps
Discover why hash-based malware detection cannot catch polymorphic and metamorphic malware that changes its code with each infection, and learn what detection techniques fill these critical security gaps.
Read article →