> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/magic-bytes-cheat-sheet.md).

# Magic Bytes Cheat Sheet

<table data-header-hidden><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td><strong>Executable Binaries</strong></td><td><strong>Mnemonic</strong></td><td><strong>Signature</strong></td></tr><tr><td><pre><code>DOS Executable
</code></pre></td><td><pre><code>"MZ"
</code></pre></td><td><pre><code>0x4D 0x5A
</code></pre></td></tr><tr><td><pre><code>PE32 Executable
</code></pre></td><td><pre><code>"MZ"...."PE.."
</code></pre></td><td><pre><code>0x4D 0x5A ... 0x50 0x45 0x00 0x00
</code></pre></td></tr><tr><td><pre><code>Mach-O Executable (32 bit)
</code></pre></td><td><pre><code>"FEEDFACE"
</code></pre></td><td><pre><code>0xFE 0xED 0xFA 0xCE
</code></pre></td></tr><tr><td><pre><code>Mach-O Executable (64 bit)
</code></pre></td><td><pre><code>"FEEDFACF"
</code></pre></td><td><pre><code>0xFE 0xED 0xFA 0xCF
</code></pre></td></tr><tr><td><pre><code>ELF Executable
</code></pre></td><td><pre><code>".ELF"
</code></pre></td><td><pre><code>0x7F 0x45 0x4C 0x46
</code></pre></td></tr><tr><td><strong>Compressed Archives</strong></td><td><strong>Mnemonic</strong></td><td><strong>Signature</strong></td></tr><tr><td><pre><code>Zip Archive
</code></pre></td><td><pre><code>"PK.."
</code></pre></td><td><pre><code>0x50 0x4B 0x03 0x04
</code></pre></td></tr><tr><td><pre><code>Rar Archive
</code></pre></td><td><pre><code>"Rar!...."
</code></pre></td><td><pre><code>0x52 0x61 0x72 0x21 0x1A 0x07 0x01 0x00
</code></pre></td></tr><tr><td><pre><code>Ogg Container
</code></pre></td><td><pre><code>"OggS"
</code></pre></td><td><pre><code>0x4F 0x67 0x67 0x53
</code></pre></td></tr><tr><td><pre><code>Matroska/EBML Container
</code></pre></td><td><pre><code>N/A
</code></pre></td><td><pre><code>0x45 0x1A 0xA3 0xDF
</code></pre></td></tr><tr><td><strong>Image File Formats</strong></td><td><strong>Mnemonic</strong></td><td><strong>Signature</strong></td></tr><tr><td><pre><code>PNG Image
</code></pre></td><td><pre><code>".PNG...."
</code></pre></td><td><pre><code>0x89 0x50 0x4E 0x47 0x0D 0x0A 0x1A 0x0A
</code></pre></td></tr><tr><td><pre><code>BMP Image
</code></pre></td><td><pre><code>"BM"
</code></pre></td><td><pre><code>0x42 0x4D
</code></pre></td></tr><tr><td><pre><code>GIF Image
</code></pre></td><td><pre><code>"GIF87a"
</code></pre></td><td><pre><code>0x47 0x49 0x46 0x38 0x37 0x61
</code></pre></td></tr><tr><td> </td><td><pre><code>"GIF89a"
</code></pre></td><td><pre><code>0x47 0x49 0x46 0x38 0x39 0x61
</code></pre></td></tr></tbody></table>