Magic byte and file signature table

A reference for the bytes that identify a format, in both directions: given bytes, what is it; given a format, what should its bytes be. The second direction matters when a challenge has corrupted a header and you need to repair it.

Repairing a broken header

A common challenge shape is a file whose first few bytes have been zeroed or altered so nothing will open it. If the rest of the structure is intact - a PNG with valid IHDR and IDAT chunks but a mangled signature - writing the correct magic bytes back restores it completely. Knowing what those bytes should be is the whole puzzle.

• PNG starts 89 50 4E 47 0D 0A 1A 0A and ends with the IEND chunk plus its CRC.
• JPEG starts FF D8 FF and ends FF D9.
• ZIP starts 50 4B 03 04; its central directory at the end starts 50 4B 01 02, and the end-of-central-directory record starts 50 4B 05 06.
• GIF starts GIF87a or GIF89a - the version is literal ASCII.
• PDF starts %PDF- and should end %%EOF.