Missing magic bytes from previous python version

Author: clark-jaCreated Feb 22, 2025Updated Aug 9, 2026

As I noted that some of the previously recognized magic bytes are no longer detected with the current rust version, I created the following list, comparing the magic files at tag v2.3.4 with the current master to keep track which signatures have already been ported and which ones have not (yet) been. This list does not include the many signatures added after the rewrite to rust. This list could help others (and me) to create PRs for them.

BTW, Thank you for your awesome work!

animation

MPEG transport stream data
Uncompressed Adobe Flash SWF file

binarch

MIPSEL instructions, function prologue
MIPS instructions, function prologue
MIPS instructions, function epilogue
MIPSEL instructions, function epilogue
MIPS16e instructions, function prologue
MIPS16e instructions, function epilogue
MIPSEL16e instructions, function epilogue
MIPS16e instructions, function epilogue
MIPSEL16e instructions, function epilogue
PowerPC big endian instructions, function prologue
PowerPC little endian instructions, function prologue
PowerPC big endian instructions, function epilogue
PowerPC little endian instructions, function epilogue
ARMEB instructions, function prologue
ARM instructions, function prologue{adjust:-2}
ARMEB instructions, function epilogue
ARM instructions, function epilogue{adjust:-2}
Ubicom32 instructions, function prologue
Ubicom32 instructions, function epilogue
AVR8 instructions, function prologue
AVR32 instructions, function prologue
SPARC instructions, function epilogue
Intel x86 instructions, function prologue
Intel x86 instructions, nops{jump:8}{overlap}
Motorola Coldfire instructions, function prologue/epilogue
SuperH instructions, little endian, function epilogue (gcc)
SuperH instructions, big endian, function epilogue (gcc)
AArch64 instructions, function epilogue
AArch64 instructions, nop

bootloaders

CFE boot loader
U-Boot version string

compressed

StuffIt Archive (data)
StuffIt Deluxe (data)
StuffIt Deluxe Segment (data)
StuffIt Archive
AFX compressed file data
bzip2 compressed data, block size = 900k
bzip2 compressed data, block size = 800k
bzip2 compressed data, block size = 700k
bzip2 compressed data, block size = 600k
bzip2 compressed data, block size = 500k
bzip2 compressed data, block size = 400k
bzip2 compressed data, block size = 300k
bzip2 compressed data, block size = 200k
bzip2 compressed data, block size = 100k
lzop compressed data
lzip compressed data
lrzip compressed data
LZO compressed data
7-zip archive data
compress'd data
xz compressed data
gzip compressed data
rzip compressed data
JAR compressed with pack200
LZMA compressed data (new)
Snappy compression, stream identifier
KGB archive
Zlib compressed data, default compression
Zlib compressed data, best compression
Zlib compressed data, compressed
LZ4 compressed data
LZ4 compressed data, legacy

console

Gameboy ROM
Sega MegaDrive/Genesis raw ROM dump
Nintendo DS Game ROM Image
Nintendo Game Boy Advance ROM Image
Microsoft Xbox executable (XBE)
XIP, Microsoft Xbox data
XTF, Microsoft Xbox data

crypto

PEM certificate
PEM certificate request
PEM RSA private key
PEM DSA private key
PEM EC private key
OpenSSH RSA1 private key
OpenSSH DSA public key
OpenSSH RSA public key
OpenSSH ECDSA (Curve P-256) public key
OpenSSH ECDSA (Curve P-384) public key
OpenSSH ECDSA (Curve P-521) public key
Private key in DER format (PKCS#8)
Certificate in DER format (x509 v3)
Object signature in DER format (PKCS#7)
GPG key trust database
mcrypt 2.5 encrypted data
mcrypt 2.2 encrypted data
PGP armored data
OpenSSL encryption, salted
LUKS_MAGIC
Nagra PK
Nagra Constant_KEY
AES S-Box
AES Inverse S-Box
PGP RSA encrypted session key
DES PC1 table
DES PC2 table
DES SP1, big endian
DES SP1, little endian{overlap}
DES SP2, big endian
DES SP2, little endian

ebml

EMBL file

ecos

eCos RTOS string reference
eCos kernel exception handler, architecture: MIPSEL
eCos kernel exception handler, architecture: MIPS,

efi

UEFI PI Firmware Volume
EFI capsule v0.9
UEFI capsule
AMI Aptio extended EFI capsule
AMI Aptio unsigned EFI capsule
Toshiba EFI capsule

encoding

Base64 standard index table
Base64 SerComm index table

executables

ELF
Microsoft executable
BFLT executable
Microsoft WinCE installer
Sony Playstation executable
Cisco IOS microcode
Cisco IOS experimental microcode
EST flat binary
Mach-O universal binary with 1 architecture
Mach-O universal binary with 2 architectures
Mach-O universal binary with 3 architectures
Mach-O universal binary with 4 architectures
Mach-O universal binary with 5 architectures
Mach-O universal binary with 6 architectures
Mach-O universal binary with 7 architectures
Mach-O universal binary with 8 architectures
Mach-O universal binary with 9 architectures
Mach-O universal binary with 10 architectures
Mach-O universal binary with 11 architectures
Mach-O universal binary with 12 architectures
Mach-O universal binary with 13 architectures
Mach-O universal binary with 14 architectures
Mach-O universal binary with 15 architectures
Mach-O universal binary with 16 architectures
Mach-O universal binary with 17 architectures
Mach-O universal binary with 18 architectures
Compiled Java class data
HP 38 binary
HP 39 binary
HP 38 ASCII
HP 39 ASCII
HP 48 binary
HP 49 binary
Executable script
Executable script

filesystems

Minix filesystem, V1, little endian
Minix filesystem, V1, big endian
Minix filesystem, V1, little endian, 30 char names
Minix filesystem, V1, big endian, 30 char names
YAFFS filesystem, little endian
YAFFS filesystem, big endian
EFS2 Qualcomm filesystem super block, little endian
EFS2 Qualcomm filesystem super block, big endian
TROC filesystem
PFS filesystem
MPFS filesystem, Microchip
CramFS filesystem, little endian
CramFS filesystem, big endian
UBI volume ID header
UBI erase count header
UBIFS filesystem
JFFS2 filesystem, little endian
JFFS2 filesystem, big endian
Squashfs filesystem, big endian
Squashfs filesystem, little endian
Squashfs filesystem, big endian, lzma compression
Squashfs filesystem, big endian, lzma signature
Squashfs filesystem, big endian, DD-WRT signature
Squashfs filesystem, little endian, DD-WRT signature
Squashfs filesystem, little endian, non-standard signature
Linux EXT filesystem
romfs filesystem, version 1
D-Link ROMFS filesystem
Wind River management filesystem
ISO 9660 Boot Record
ISO 9660 Primary Volume
Netboot image
WDK file system, version 2.0
ISO{end}
DOS Emulator image
VMWare3 disk image
VMWare3 undoable disk image
VMware4 disk image
QEMU QCOW Image
BSD 2.x filesystems
Foscam WebUI filesystem
QNX4 Boot Block
QNX6 Super Block
QNX IFS

firmware

uImage header
Encrypted Hilink uImage firmware header
IMG0 (VxWorks) header
Mediatek bootloader
CSR (XAP2) DFU firmware update header
CSR Bluecore firmware segment
CSYS header, little endian,
CSYS header, big endian
WRGG firmware header
TRX firmware header, little endian
BIN-Header
Ubicom firmware header
Realtek firmware header, ROME bootloader
Realtek firmware header, ROME bootloader
PackImg section delimiter tag
Broadcom header
BLCR
BLCR
Aculab VoIP firmware
HP LaserJet 1000 series downloadable firmware
Marvell Libertas firmware
Paged COBALT boot rom
COBALT boot rom data (Flat boot rom or file system)
Motorola S-Record
Windows CE image header
Windows CE memory segment header
ZynOS header, header size: 48 bytes
Cisco VxWorks firmware header
ZBOOT firmware header, header size: 32 bytes
DLOB firmware header
TP-Link firmware header
Broadcom 96345 firmware header, header size: 256
Xerox DLM firmware start of header
Xerox DLM firmware name:
Xerox DLM firmware version:
Xerox DLM firmware end of header
Copyright string
Sercomm firmware signature
NPK firmware header
Ubiquiti firmware header, header size: 264 bytes
Ubiquiti firmware header, header size: 264 bytes
Ubiquiti firmware header, third party
Ubiquiti partition header
Ubiquiti end header, header size: 12 bytes
Signed Ubiquiti end header, RSA 2048 bit, header size: 264 bytes
Ubiquiti firmware additional data
AIH0 firmware header, header size: 48
SEAMA firmware header, big endian
SEAMA firmware header, little endian
NSP firmware header, big endian
NSP firmware header, little endian
Beyonwiz firmware header
Thompson/Alcatel encoded firmware
Android Backup
TWRP Backup
Roku aimage SB
Networks\ Inc.\nFirmware\ v Paged Sun/COBALT boot rom
ZyXEL rom-0 configuration block, name: "%s"
ZyXEL rom-0 configuration block, name: "%s"
ZyXEL rom-0 configuration block, name: "%s"
Obfuscated Arcadyan firmware
Digi International firmware
LANCOM firmware header
LANCOM OEM file
LANCOM firmware loader
LANCOM WWAN firmware
LANCOM file entry
Broadcom firmware header
QNAP encrypted firmware footer
Mediatek Serial Flash Image
Mediatek EMMC Flash Image
Mediatek NOR Flash Image
Mediatek Boot Header
Boot section{overlap}
Mediatek File Info
Android bootimg
Qualcomm device tree container
Nexus bootloader image
Nexus IMGDATA
Motorola bootlogo container
Motorola RLE bootlogo
Motorola UTAGS
Qualcomm splash screen
Qualcomm SBL1
Intel HEX data{many}, record type:
ATAGs msm parition table (msmptbl)
Amino MCastFS2 (.mcfs)
Intel x86 or x64 microcode
Flattened device tree
Toshiba SSD Firmware Update
bix header, header size: 64 bytes
Autel EVO Upgrade Transfer{overlap}

hashing

CRC32 polynomial table, big endian
CRC32 polynomial table, little endian
SHA256 hash constants, big endian
SHA256 hash constants, little endian

images

TIFF image data, big-endian
TIFF image data, little-endian
PNG image
GIF image data
PC bitmap
JPEG image data, JFIF standard
JPEG image data, EXIF standard

linux

Linux kernel boot image
Linux kernel version
Linux kernel ARM boot executable zImage (little-endian)
Linux kernel ARM boot executable zImage (big-endian)
Linux kernel ARM64 image

lzma

LZMA compressed data, properties: 0x51
LZMA compressed data, properties: 0x5A
LZMA compressed data, properties: 0x5B
LZMA compressed data, properties: 0x5C
LZMA compressed data, properties: 0x5D
LZMA compressed data, properties: 0x5E
LZMA compressed data, properties: 0x63
LZMA compressed data, properties: 0x64
LZMA compressed data, properties: 0x65
LZMA compressed data, properties: 0x66
LZMA compressed data, properties: 0x6C
LZMA compressed data, properties: 0x6D
LZMA compressed data, properties: 0x6E
LZMA compressed data, properties: 0x75
LZMA compressed data, properties: 0x76
LZMA compressed data, properties: 0x7E
LZMA compressed data, properties: 0x87
LZMA compressed data, properties: 0x88
LZMA compressed data, properties: 0x89
LZMA compressed data, properties: 0x8A
LZMA compressed data, properties: 0x8B
LZMA compressed data, properties: 0x90
LZMA compressed data, properties: 0x91
LZMA compressed data, properties: 0x92
LZMA compressed data, properties: 0x93
LZMA compressed data, properties: 0x99
LZMA compressed data, properties: 0x9A
LZMA compressed data, properties: 0x9B
LZMA compressed data, properties: 0xA2
LZMA compressed data, properties: 0xA3
LZMA compressed data, properties: 0xAB
LZMA compressed data, properties: 0xB4
LZMA compressed data, properties: 0xB5
LZMA compressed data, properties: 0xB6
LZMA compressed data, properties: 0xB7
LZMA compressed data, properties: 0xB8
LZMA compressed data, properties: 0xBD
LZMA compressed data, properties: 0xBE
LZMA compressed data, properties: 0xBF
LZMA compressed data, properties: 0xC0
LZMA compressed data, properties: 0xC6
LZMA compressed data, properties: 0xC7
LZMA compressed data, properties: 0xC8
LZMA compressed data, properties: 0xCF
LZMA compressed data, properties: 0xD0
LZMA compressed data, properties: 0xD8

misc

PDF document
ZyXEL voice data
Xen saved domain file
HTML document header
HTML document header
HTML document footer
HTML document footer
XML document
Windows Script Encoded Data (screnc.exe)
Unix path:
Neighborly text
Neighborly text
Neighborly text, best guess: Goodspeed,
uuencoded data
OSX DMG image
Xilinx Virtex/Spartan FPGA bitstream dummy + sync word

network

Pcap-ng capture file, big-endian
Pcap-ng capture file, little-endian
Libpcap capture file, big-endian
Libpcap capture file, little-endian

phones

Samsung modem TOC index

sql

MySQL table definition file
MySQL MISAM index file
MySQL MISAM compressed data file
MySQL ISAM index file
MySQL ISAM compressed data file
iRiver Database file
SQLite 2.x database
SQLite 3.x database

vxworks

VxWorks symbol table, big endian
VxWorks symbol table, little endian
VxWorks WIND kernel version
VxWorks operating system version

P.S. It can very well be that I overlooked something in either the python version or the rust rewrite

Source: ReFirmLabs/binwalk

View original on GitHub View discussion on GitHub