SteganographyFile Steganography
File Magic Bytes & Format Analysis
steganographybeginner
Identify files by their magic bytes, detect corrupted headers, and find hidden data in file structures.
steganographyforensicsmagic-bytesfile-formathexxxdbinwalk
File Magic Bytes & Format Analysis
Every file format begins with a magic number — signature bytes that identify its type, independent of the file extension. CTF challenges routinely corrupt, swap, or hide these bytes to obscure what a file really is. Your first job is always to check the magic bytes with file and xxd.
Analysis Workflow
Common Magic Bytes Reference
JPEG: FF D8 FF ends: FF D9
PNG: 89 50 4E 47 0D 0A 1A 0A ends: 49 45 4E 44 AE 42 60 82
GIF87: 47 49 46 38 37 61 ("GIF87a")
GIF89: 47 49 46 38 39 61 ("GIF89a")
BMP: 42 4D ("BM")
ZIP: 50 4B 03 04 ("PK\x03\x04")
RAR: 52 61 72 21 ("Rar!")
7-Zip: 37 7A BC AF 27 1C
GZIP: 1F 8B
BZIP2: 42 5A 68 ("BZh")
PDF: 25 50 44 46 ("%PDF")
ELF: 7F 45 4C 46 ("\x7fELF")
PE/DLL: 4D 5A ("MZ")
MP3: FF FB or 49 44 33 ("ID3")
WAV: 52 49 46 46 ... 57 41 56 45 ("RIFF...WAVE")
SQLite: 53 51 4C 69 74 65
Pcap: D4 C3 B2 A1 (little-endian)Analysis Steps
Identify the file
file mystery.bin # identifies by magic bytes, ignores extension
xxd mystery.bin | head -5 # view raw hex
hexdump -C mystery.bin | head -5Fix corrupted header (if extension doesn't match content)
data = bytearray(open('mystery.bin', 'rb').read())
# Fix PNG header (first 8 bytes):
data[0:8] = b'\x89PNG\r\n\x1a\n'
# Fix JPEG header:
data[0:3] = b'\xff\xd8\xff'
open('fixed.png', 'wb').write(data)Check for embedded files
binwalk mystery.bin
binwalk -e mystery.binCheck for appended data after EOF
data = open('suspicious.jpg','rb').read()
eof = data.rfind(b'\xff\xd9') # JPEG EOF marker
if eof != -1:
appended = data[eof+2:]
if appended:
print(f"Data after JPEG EOF: {len(appended)} bytes")
open('appended.bin','wb').write(appended)Format-Specific Analysis
PNG is structured as chunks: [4-byte length][4-byte type][data][4-byte CRC]. Flags can be hidden in tEXt, iTXt, zTXt chunks or after IEND. See PNG Analysis for full details.
Checklist
-
file+xxd/hexdumpon every unknown file - Compare magic bytes against reference table
- If extension doesn't match magic bytes → fix header and retry
-
binwalk -efor embedded files - Check for data appended after EOF
- PNG: check chunk types for
tEXt/iTXt/zTXtflags - Try
unzip -lon PNG/JPEG (polyglot files)
Last updated on