Editing Magic number (programming) (section)

=== In files {{anchor|Magic numbers in files}} === <!-- Courtesy note per [[MOS:LINK2SECT]]: [[File format#Magic number]] links here. -->
{{Main|File format#Magic number}}
{{See also|List of file signatures}}

Magic numbers are common in programs across many operating systems. Magic numbers implement [[strongly typed]] data and are a form of [[in-band signaling]] to the controlling program that reads the data type(s) at program run-time. Many files have such constants that identify the contained data. Detecting such constants in files is a simple and effective way of distinguishing between many [[file format]]s and can yield further run-time [[information]].

;Examples
* [[Compiler|Compiled]] [[Java class file]]s ([[Java bytecode|bytecode]]) and [[Mach (kernel)|Mach-O]] binaries start with hex <code>CAFEBABE</code>. When compressed with [[Pack200]] the bytes are changed to <code>CAFED00D</code>.
* [[GIF]] image files have the [[ASCII]] code for "GIF89a" (<code>47</code>&nbsp;<code>49</code>&nbsp;<code>46</code>&nbsp;<code>38</code>&nbsp;<code>39</code>&nbsp;<code>61</code>) or "GIF87a" (<code>47</code>&nbsp;<code>49</code>&nbsp;<code>46</code>&nbsp;<code>38</code>&nbsp;<code>37</code>&nbsp;<code>61</code>)
* [[JPEG]] image files begin with <code>FF</code>&nbsp;<code>D8</code> and end with <code>FF</code>&nbsp;<code>D9</code>. JPEG/[[JFIF]] files contain the [[Null-terminated string|null terminated string]] "JFIF" (<code>4A</code>&nbsp;<code>46</code>&nbsp;<code>49</code>&nbsp;<code>46</code>&nbsp;<code>00</code>). JPEG/[[Exif]] files contain the [[Null-terminated string|null terminated string]] "Exif" (<code>45</code>&nbsp;<code>78</code>&nbsp;<code>69</code>&nbsp;<code>66</code>&nbsp;<code>00</code>), followed by more [[Metadata (computing)|metadata]] about the file.
* [[PNG]] image files begin with an 8-[[byte]] signature which identifies the file as a PNG file and allows detection of common file transfer problems: "\211PNG\r\n\032\n" (<code>89</code>&nbsp;<code>50</code>&nbsp;<code>4E</code>&nbsp;<code>47</code>&nbsp;<code>0D</code>&nbsp;<code>0A</code>&nbsp;<code>1A</code>&nbsp;<code>0A</code>). That signature contains various [[newline]] characters to permit detecting unwarranted automated newline conversions, such as transferring the file using [[File Transfer Protocol|FTP]] with the ''ASCII'' [[File Transfer Protocol#Protocol overview|transfer mode]] instead of the ''binary'' mode.<ref>{{cite web |url=http://www.libpng.org/pub/png/spec/1.0/PNG-Rationale.html#R.PNG-file-signature |title=PNG (Portable Network Graphics) Specification Version 1.0: 12.11. PNG file signature |date=1 October 1996 |work=MIT |archive-url=https://web.archive.org/web/20230326024630/http://www.libpng.org/pub/png/spec/1.0/PNG-Rationale.html#R.PNG-file-signature |archive-date=26 March 2023 |url-status=live }}</ref>
* Standard [[MIDI]] audio files have the [[ASCII]] code for "MThd" ('''M'''IDI '''T'''rack '''h'''ea'''d'''er, <code>4D</code>&nbsp;<code>54</code>&nbsp;<code>68</code>&nbsp;<code>64</code>) followed by more metadata.
* [[Unix]] or [[Linux]] scripts may start with a [[shebang (Unix)|shebang]] ("#!",  <code>23</code>&nbsp;<code>21</code>) followed by the path to an [[interpreter directive|interpreter]], if the interpreter is likely to be different from the one from which the script was invoked.
* [[Executable and Linkable Format|ELF]] executables start with the byte <code>7F</code> followed by "ELF" (<code>7F</code>&nbsp;<code>45</code>&nbsp;<code>4C</code>&nbsp;<code>46</code>).
* [[PostScript]] files and programs start with "%!" (<code>25</code>&nbsp;<code>21</code>).
* [[PDF]] files start with "%PDF" (hex <code>25</code>&nbsp;<code>50</code>&nbsp;<code>44</code>&nbsp;<code>46</code>).
* [[DOS MZ executable]] files and the [[EXE#Other|EXE stub]] of the [[Microsoft Windows]] [[Portable Executable|PE]] (Portable Executable) files start with the characters "MZ" (<code>4D</code>&nbsp;<code>5A</code>), the initials of the designer of the file format, [[Mark Zbikowski]]. The definition allows the uncommon "ZM" (<code>5A</code>&nbsp;<code>4D</code>) as well for dosZMXP, a non-PE EXE.<ref name="doszmxp">{{cite web |url=https://blogs.msdn.microsoft.com/oldnewthing/20080324-00/?p=23033 |title=What's the difference between the COM and EXE extensions? |first=Raymond |last=Chen |date=24 March 2008 |work=The Old New Thing |url-status=dead |archive-url=https://web.archive.org/web/20190218083526/https://blogs.msdn.microsoft.com/oldnewthing/20080324-00/?p=23033 |archive-date=18 February 2019}}</ref>
* The [[Berkeley Fast File System]] superblock format is identified as either <code>19</code>&nbsp;<code>54</code>&nbsp;<code>01</code>&nbsp;<code>19</code> or <code>01</code>&nbsp;<code>19</code>&nbsp;<code>54</code> depending on version; both represent the birthday of the author, [[Marshall Kirk McKusick]].
* The [[Master Boot Record]] of bootable storage devices on almost all [[IA-32]] [[IBM PC compatible]]s has a code of <code>55</code>&nbsp;<code>AA</code> as its last two bytes.
* Executables for the [[Game Boy]] and [[Game Boy Advance]] handheld video game systems have a 48-byte or 156-byte magic number, respectively, at a fixed spot in the header. This magic number encodes a bitmap of the [[Nintendo]] logo.
* [[Amiga]] software executable [[Amiga Hunk|Hunk]] files running on Amiga classic [[68000]] machines all started with the hexadecimal number $000003f3, nicknamed the "Magic Cookie."
* In the Amiga, the only absolute address in the system is hex $0000 0004 (memory location 4), which contains the start location called SysBase, a pointer to exec.library, the so-called [[kernel (operating system)|kernel]] of Amiga.
* [[Preferred Executable Format|PEF]] files, used by the [[classic Mac OS]] and [[BeOS]] for [[PowerPC]] executables, contain the [[ASCII]] code for "Joy!" (<code>4A</code>&nbsp;<code>6F</code>&nbsp;<code>79</code>&nbsp;<code>21</code>) as a prefix.
* [[TIFF]] files begin with either "II" or "MM" followed by [[Answer to Life, the Universe, and Everything|42]] as a two-byte integer in little or big [[endianness|endian]] byte ordering. "II" is for Intel, which uses [[Endianness|little endian]] byte ordering, so the magic number is <code>49</code>&nbsp;<code>49</code>&nbsp;<code>2A</code>&nbsp;<code>00</code>. "MM" is for Motorola, which uses [[Endianness|big endian]] byte ordering, so the magic number is <code>4D</code>&nbsp;<code>4D</code>&nbsp;<code>00</code>&nbsp;<code>2A</code>.
* [[Unicode]] text files encoded in [[UTF-16]] often start with the [[Byte Order Mark]] to detect [[endianness]] (<code>FE</code>&nbsp;<code>FF</code> for big endian and <code>FF</code>&nbsp;<code>FE</code> for little endian). And on [[Microsoft Windows]], [[UTF-8]] text files often start with the UTF-8 encoding of the same character, <code>EF</code>&nbsp;<code>BB</code>&nbsp;<code>BF</code>.
* [[LLVM]] Bitcode files start with "BC" (<code>42</code>&nbsp;<code>43</code>).
* [[Doom WAD|WAD]] files start with "IWAD" or "PWAD" (for ''[[Doom (1993 video game)|Doom]]''), "WAD2" (for ''[[Quake (video game)|Quake]]'') and "WAD3" (for ''[[Half-Life (video game)|Half-Life]]'').
* Microsoft [[Compound File Binary Format]] (mostly known as one of the older formats of [[Microsoft Office]] documents) files start with <code>D0</code>&nbsp;<code>CF</code>&nbsp;<code>11</code>&nbsp;<code>E0</code>, which is visually suggestive of the word "DOCFILE0".
* Headers in [[ZIP (file format)|ZIP]] files often show up in text editors as "PK♥♦" (<code>50</code>&nbsp;<code>4B</code>&nbsp;<code>03</code>&nbsp;<code>04</code>), where "PK" are the initials of [[Phil Katz]], author of [[DOS]] compression utility [[PKZIP]].
* Headers in [[7z]] files begin with "7z" (full magic number: <code>37</code>&nbsp;<code>7A</code>&nbsp;<code>BC</code>&nbsp;<code>AF</code>&nbsp;<code>27</code>&nbsp;<code>1C</code>).

;Detection
The Unix utility program <code>[[File (command)|file]]</code> can read and interpret magic numbers from files, and the file which is used to parse the information is called ''magic''. The Windows utility TrID has a similar purpose.