File format starts with pk

When assessing an application, one may run into files that have strange or unknown extensions or files not readily consumed by applications associated with those extensions. In these cases it can be helpful to look for tell-tale file format signatures and inferring how the application is using them based on these signatures, as well as how these formats may be abused to provoke undefined behavior within the application.

To identify these common file format signatures one typically only need look as far as the first few bytes of the file in question. The easiest way to inspect the file in question will be to examine it with a hex editor.

Personally for this task I prefer HxD for windows or hexdump under Linux, but really any hex editor should do just fine. With a few exceptions file format signatures are located at offset zero and generally occupy the first two to four bytes starting from the offset. OneNote Package file. Milestones v2. Microsof t Visual Studio Solution File. OpenOffice spreadsheet Calc , drawing Draw , presentation Impress , and word processing Writer files, respectively.

Open Publication Structure eBook file. Trailer: Look for 50 4B 05 06 PK.. USMT 3. Puffer encrypted archive. Resource Interchange File Format -- Audio for Windows file , where xx xx xx xx is the file size little endian.

Google WebP image file , where xx xx xx xx is the file size. RAR v5 compressed archive file. Windows prefetch file. Unconfirmed file type. Likely type is Harvard Graphics Version 2. See this uuencode page for more information. Apple Core Audio File. MOV files have a complicated file signature.

For more information, see the QuickTime File Format page. Thanks to D. Wright for getting me started on this! ADX lossy compressed audio file. Possibly, maybe, might be a fragment of an Ethernet frame carrying an IPv6 packet. JBOG2 image file Trailer: 03 33 00 01 00 00 00 Sign up or log in Sign up using Google. Sign up using Facebook. Sign up using Email and Password. Post as a guest Name. Email Required, but never shown. The Overflow Blog. Podcast Making Agile work for data science.

Stack Gives Back The component needs to read this binary stream and create a file on the filesystem with the right extension.

If all you have access to is the byte stream of the file, then you would need to handle each file type independently. Many file formats have the same signature at the start of the file, or have the same header format.

This signature is refered to as a magic number as described by me on this post. A good place to get started is to go to www. It contains the file format specifications searchable by file type. You could look at the important file types that you want to handle and see if you can find some identifying factor in those file formats.

You could also search Google to try and find a library that does this classification, or look at the source code of the file command. This seems to be the best list around, with all sorts of file formats - it is the main reference on wikipedia.

It doesn't give complete details on the new Office format, so this is from my own examples. Most binary formats contain a magic number at their beginning.

If you only have to recognize a certain set of formats, it should be easy to check the first few bytes of a new incoming file and guess the appropriate file extension correctly. On linux, there is a command called file. Given an arbitrary file, it attempts to determine what kind of file it is. For instance:.

See file.