跳至主要內容

常见的文件头和文件尾

星火燎原@vxhly大约 2 分钟windowsWindowsPentest

前言

文件头是位于文件开头的一段承担一定任务的数据, 一般都在开头的部分。而文件尾对应的就在 文件的结束部分, 本篇将介绍常见的文件头和文件尾的十六进制数, 这些文件的文件头和文件尾几乎多是一样的。

从 Ultraedit 提取的文件头信息

文件类型文件头文件尾
JPEG (jpg)FF D8 FFFF D9
PNG (png)89 50 4E 47AE 42 60 82
GIF (gif)47 49 46 3800 3B
TIFF (tif)49 49 2A 00
Windows Bitmap (bmp)42 4D
ZIP Archive (zip)50 4B 03 0450 4B
RAR Archive (rar)52 61 72 2107 00
CAD (dwg)41 43 31 30
Adobe Photoshop (psd)38 42 50 53
Rich Text Format (rtf)7B 5C 72 74 66
XML (xml)3C 3F 78 6D 6C
HTML (html)3C 68 74 6D 6C3C 2F 68 74 6D 6C 3E
Email thorough only (eml)44 65 6C 69 76 65 72 79 2D 64 61 74 65 3A
Outlook Express (dbx)CF AD 12 FE C5 FD 74 6F
Outlook (pst)21 42 44 4E
MS Word/Excel (xls or doc)D0 CF 11 E0
MS Access (mdb)53 74 61 6E 64 61 72 64 20 4A
WordPerfect (wpd)FF 57 50 43
Postscript (eps or ps)25 21 50 53 2D 41 64 6F 62 65
Adobe Acrobat (pdf)25 50 44 46 2D 31 2E
Quicken (qdf)AC 9E BD 8F
Windows Password (pwl)AC 9E BD 8F
Wave (wav)57 41 56 45
AVI (avi)41 56 49 20
AVI (avi)41 56 49 20
Real Audio (ram)2E 72 61 FD
Real Media (rm)2E 52 4D 46
MPEG (mpg)00 00 01 BA
MPEG (mpg)00 00 01 B3
Quicktime (mov)6D 6F 6F 76
Windows Media (asf)30 26 B2 75 8E 66 CF 11
MIDI (mid)4D 54 68 64

从 winhex 提取的文件头信息

文件文件后缀文件头
JPEGjpg ; jpeg0xFFD8FF
PNGpng0x89504E470D0A1A0A
GIFgifGIF8
TIFFtif ; tiff0x49492A00
Bit mapbmpBM
AOL ARTart0x4A47040E000000
PC Paintbrushpcx0x0A050108
Graphics Metafilewmf0xD7CDC69A
Enhanced Metafileemf0x0100000058000000
Corel DrawcdrCDR
CADdwg0x41433130
Adobe Photoshoppsd8BPS
Rich Text Formatrtfrtf
XMLxml
HTMLhtml ; htm ; phptype
EmailemlDelivery-date:
Outlook Expressdbx0xCFAD12FE
MS Office/OLE2doc ; xls ; dot ; ppt ; db0xD0CF11E0A1B11AE1
MS Accessmdb ; mda ; mde ; mdtStandard J
WordPerfectwpd0xFF575043
OpenOffice Writersxwwriter
OpenOffice Calcsxccalc
WordPerfectwpd0xFF575043
OpenOffice Writersxwwriter
OpenOffice Calcsxccalc
OpenOffice Mathsxmmath
Windows Passwordpwl0xE3828596
ZIP Archivezip ; jar0x504B0304
ZIP Archive (outdated)zip0x504B3030
RAR ArchiverarRar!
GZ Archivegz ; tgz0x1F8B08
BZIP Archivebz2BZh
ARJ Archivearj0x60EA
7-ZIP Archive7z7z 集'
WavewavWAVE
AVIaviAVI
Real Audioram ; ra.ra?0
Real Mediarm. RMF
MPEGmpg ; mpeg0x000001BA
MPEGmpg ; mpeg0x000001B3
F575043
OpenOffice Writersxwwriter
OpenOffice Calcsxccalc
OpenOffice Mathsxmmath
Windows Passwordpwl0xE3828596
ZIP Archivezip ; jar0x504B0304
ZIP Archive (outdated)zip0x504B3030
RAR ArchiverarRar!
GZ Archivegz ; tgz0x1F8B08
BZIP Archivebz2BZh
ARJ Archivearj0x60EA
7-ZIP Archive7z7z 集'
WavewavWAVE
AVIaviAVI
Real Audioram ; ra.ra?0
Real Mediarm. RMF
MPEGmpg ; mpeg0x000001BA
MPEGmpg ; mpeg0x000001B3
F575043
OpenOffice Writersxwwriter
OpenOffice Calcsxccalc
OpenOffice Mathsxmmath
Windows Passwordpwl0xE3828596
ZIP Archivezip ; jar0x504B0304
ZIP Archive (outdated)zip0x504B3030
RAR ArchiverarRar!
GZ Archivegz ; tgz0x1F8B08
BZIP Archivebz2BZh
ARJ Archivearj0x60EA
7-ZIP Archive7z7z 集'
WavewavWAVE
AVIaviAVI
Real Audioram ; ra.ra?0
Real Mediarm. RMF
MPEGmpg ; mpeg0x000001BA
MPEGmpg ; mpeg0x000001B3
打赏
给作者赏一杯咖啡吧
您的支持将是我继续更新下去的动力
微信微信
支付宝支付宝