跳至主要內容

常见的文件头和文件尾

星火燎原@vxhly大约 2 分钟windowsWindowsPentest

前言

文件头是位于文件开头的一段承担一定任务的数据, 一般都在开头的部分。而文件尾对应的就在 文件的结束部分, 本篇将介绍常见的文件头和文件尾的十六进制数, 这些文件的文件头和文件尾几乎多是一样的。

从 Ultraedit 提取的文件头信息

文件类型文件头文件尾
JPEG ( jpg )FF D8 FFFF D9
PNG ( png )89 50 4E 47AE 42 60 82
GIF ( gif )47 49 46 3800 3B
TIFF ( tif )49 49 2A 00
Windows Bitmap ( bmp )42 4D
ZIP Archive ( zip )50 4B 03 0450 4B
RAR Archive ( rar )52 61 72 2107 00
CAD ( dwg )41 43 31 30
Adobe Photoshop ( psd )38 42 50 53
Rich Text Format ( rtf )7B 5C 72 74 66
XML ( xml )3C 3F 78 6D 6C
HTML ( html )3C 68 74 6D 6C3C 2F 68 74 6D 6C 3E
Email thorough only ( eml )44 65 6C 69 76 65 72 79 2D 64 61 74 65 3A
Outlook Express ( dbx )CF AD 12 FE C5 FD 74 6F
Outlook ( pst )21 42 44 4E
MS Word/Excel ( xls or doc )D0 CF 11 E0
MS Access ( mdb )53 74 61 6E 64 61 72 64 20 4A
WordPerfect ( wpd )FF 57 50 43
Postscript ( eps or ps )25 21 50 53 2D 41 64 6F 62 65
Adobe Acrobat ( pdf )25 50 44 46 2D 31 2E
Quicken ( qdf )AC 9E BD 8F
Windows Password ( pwl )AC 9E BD 8F
Wave ( wav )57 41 56 45
AVI ( avi )41 56 49 20
AVI ( avi )41 56 49 20
Real Audio ( ram )2E 72 61 FD
Real Media ( rm )2E 52 4D 46
MPEG ( mpg )00 00 01 BA
MPEG ( mpg )00 00 01 B3
Quicktime ( mov )6D 6F 6F 76
Windows Media ( asf )30 26 B2 75 8E 66 CF 11
MIDI ( mid )4D 54 68 64

从 winhex 提取的文件头信息

文件文件后缀文件头
JPEGjpg ; jpeg0xFFD8FF
PNGpng0x89504E470D0A1A0A
GIFgifGIF8
TIFFtif ; tiff0x49492A00
Bit mapbmpBM
AOL ARTart0x4A47040E000000
PC Paintbrushpcx0x0A050108
Graphics Metafilewmf0xD7CDC69A
Enhanced Metafileemf0x0100000058000000
Corel DrawcdrCDR
CADdwg0x41433130
Adobe Photoshoppsd8BPS
Rich Text Formatrtfrtf
XMLxml
HTMLhtml ; htm ; phptype
EmailemlDelivery-date:
Outlook Expressdbx0xCFAD12FE
MS Office/OLE2doc ; xls ; dot ; ppt ; db0xD0CF11E0A1B11AE1
MS Accessmdb ; mda ; mde ; mdtStandard J
WordPerfectwpd0xFF575043
OpenOffice Writersxwwriter
OpenOffice Calcsxccalc
WordPerfectwpd0xFF575043
OpenOffice Writersxwwriter
OpenOffice Calcsxccalc
OpenOffice Mathsxmmath
Windows Passwordpwl0xE3828596
ZIP Archivezip ; jar0x504B0304
ZIP Archive (outdated)zip0x504B3030
RAR ArchiverarRar!
GZ Archivegz ; tgz0x1F8B08
BZIP Archivebz2BZh
ARJ Archivearj0x60EA
7-ZIP Archive7z7z 集'
WavewavWAVE
AVIaviAVI
Real Audioram ; ra.ra?0
Real Mediarm. RMF
MPEGmpg ; mpeg0x000001BA
MPEGmpg ; mpeg0x000001B3
F575043
OpenOffice Writersxwwriter
OpenOffice Calcsxccalc
OpenOffice Mathsxmmath
Windows Passwordpwl0xE3828596
ZIP Archivezip ; jar0x504B0304
ZIP Archive (outdated)zip0x504B3030
RAR ArchiverarRar!
GZ Archivegz ; tgz0x1F8B08
BZIP Archivebz2BZh
ARJ Archivearj0x60EA
7-ZIP Archive7z7z 集'
WavewavWAVE
AVIaviAVI
Real Audioram ; ra.ra?0
Real Mediarm. RMF
MPEGmpg ; mpeg0x000001BA
MPEGmpg ; mpeg0x000001B3
F575043
OpenOffice Writersxwwriter
OpenOffice Calcsxccalc
OpenOffice Mathsxmmath
Windows Passwordpwl0xE3828596
ZIP Archivezip ; jar0x504B0304
ZIP Archive (outdated)zip0x504B3030
RAR ArchiverarRar!
GZ Archivegz ; tgz0x1F8B08
BZIP Archivebz2BZh
ARJ Archivearj0x60EA
7-ZIP Archive7z7z 集'
WavewavWAVE
AVIaviAVI
Real Audioram ; ra.ra?0
Real Mediarm. RMF
MPEGmpg ; mpeg0x000001BA
MPEGmpg ; mpeg0x000001B3
打赏
给作者赏一杯咖啡吧
您的支持将是我继续更新下去的动力
微信微信
支付宝支付宝