Editing Magic number (programming) (section)

=== In protocols {{anchor|Magic numbers in protocols}} ===
;Examples
* The [[OSCAR protocol]], used in [[AOL Instant Messenger|AIM]]/[[ICQ]], prefixes requests with <code>2A</code>.
* In the [[RFB protocol]] used by [[VNC]], a client starts its conversation with a server by sending "RFB" (<code>52</code> <code>46</code> <code>42</code>, for "Remote Frame Buffer") followed by the client's protocol version number.
* In the [[Server Message Block|SMB]] protocol used by Microsoft Windows, each SMB request or server reply begins with '<code>FF</code> <code>53</code> <code>4D</code> <code>42</code>', or <code>"\xFFSMB"</code> at the start of the SMB request.
* In the [[MSRPC]] protocol used by Microsoft Windows, each TCP-based request begins with <code>05</code> at the start of the request (representing Microsoft DCE/RPC Version 5), followed immediately by a <code>00</code> or <code>01</code> for the minor version.   In UDP-based MSRPC requests the first byte is always <code>04</code>.
* In [[Component Object Model|COM]] and [[Distributed Component Object Model|DCOM]] marshalled interfaces, called [[OBJREF]]s, always start with the byte sequence "MEOW" (<code>4D</code> <code>45</code> <code>4F</code> <code>57</code>). Debugging extensions (used for DCOM channel hooking) are prefaced with the byte sequence "MARB" (<code>4D</code> <code>41</code> <code>52</code> <code>42</code>).
* Unencrypted [[BitTorrent tracker]] requests begin with a single byte containing the value <code>19</code> representing the header length, followed immediately by the phrase "BitTorrent protocol" at byte position 1.
* [[eDonkey2000]]/[[eMule]] traffic begins with a single byte representing the client version.  Currently <code>E3</code> represents an eDonkey client, <code>C5</code> represents eMule, and <code>D4</code> represents compressed eMule.
* The first 4 bytes of a block in the [[Bitcoin]] Blockchain contains a magic number which serves as the network identifier. The value is a constant <code>0xD9B4BEF9</code>, which indicates the main network, while the constant <code> 0xDAB5BFFA</code> indicates the testnet.
* [[Secure Sockets Layer|SSL]] transactions always begin with a "client hello" message.  The record encapsulation scheme used to prefix all SSL packets consists of two- and three- byte header forms.  Typically an SSL version 2 client hello message is prefixed with an <code>80</code> and an SSLv3 server response to a client hello begins with <code>16</code> (though this may vary).
* [[DHCP]] packets use a "magic cookie" value of '<code>0x63</code> <code>0x82</code> <code>0x53</code> <code>0x63</code>' at the start of the options section of the packet. This value is included in all DHCP packet types.
* [[HTTP/2]] connections are opened with the preface '<code>0x505249202a20485454502f322e300d0a0d0a534d0d0a0d0a</code>', or "<code>PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n</code>". The preface is designed to avoid the processing of frames by servers and intermediaries which support earlier versions of HTTP but not 2.0.
* The [[WebSocket#Opening handshake|WebSocket opening handshake]] uses the string <code>''258EAFA5-E914-47DA-95CA-C5AB0DC85B11''</code>.