为什么文件格式有幻数?
例如,Portable Executable就有好几个,包括著名的开头的“MZ”,以及PE头开头的“PE\0\0”。 Rar 文件格式具有“Rar!”头在开头,其他几个在文件中也有类似的“魔法值”。
这些神奇的价值观有什么用呢?
For example, Portable Executable has several, including the famous "MZ" at the beginning, as well as the "PE\0\0" at the start of the PE header. The Rar file format has the "Rar!" header at the beginning, and several others have similar "magic values" in the file.
What purpose do such magic values serve?
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(5)
由于用户更改了文件扩展名,或者其他程序窃取了文件扩展名,因此它允许应用程序取消对未知格式的文件的处理,而不是尽最大努力然后失败。
Because users change the file extension, or other programs steal the file extension, it allows the application to cancel processing of a file in an unknown format instead of trying its best and then failing anyway.
幻数的概念可以追溯到 UNIX 并早于文件扩展名的使用。
shell 的最初想法是所有“可执行文件”看起来都一样 - 文件是如何创建的或者应该使用什么程序来评估它并不重要。 shell 将查看文件的内容并确定适当的文件。微软出现并选择了不同的方法,文件扩展的时代诞生了。然后,为了让用户变得“更好”,微软选择“隐藏”这些扩展名,木马文件的时代诞生了,这些文件看起来像是一种类型,但实际上具有不同的扩展名,并由不同的文件处理。
the concept of magic numbers goes back to unix and pre-dates the use of file extensions.
The original idea of the shell was that all 'executable' would look the same - it didn't matter how the file had been created or what program should be used to evaluate it. The shell would look at the contents of the file and determine the appropriate file. Microsoft came along and chose a different approach and the era of file extensions was born. Then to make things 'nicer' for users microsoft chose to 'hide' these extensions and the era of trojan files which look like they are of one type but really have a different extension and are processed by a different file was born.
如果两个应用程序以不同的方式存储数据,但其构造方式使得一个应用程序的文件也可能是另一个应用程序的有效(但无意义)文件,则可能会发生非常糟糕的情况。程序可能认为它已成功加载文件(不知道数据毫无意义),然后写回一个文件,该文件在语义上与它相同,但写入该文件的应用程序(或其他任何内容)将不再能够有意义地读取该文件就此而言)。
使用幻数并不能完全防止这种情况,但至少可以在一定程度上有所帮助。
顺便说一句,尝试猜测数据的格式通常是非常危险的。例如,假设有一个可能是日期的列表,格式为 nn-nn-nn。如果不知道日期的格式,可能有足够的信息来很好地猜测格式(例如,如果其中一条记录是 12-31-99,那么如果没有相反的信息,日期可能是 mm -dd-yy),但如果所有日期都在每月的前 12 天内,则数据很容易被误解。不过,假设数据前面有“MM-DD-YY”字样。这样就可以减少误解的风险。
If two applications store data differently, but are constructed such that a file for one might possibly also be a valid (but meaningless) file for the other, very bad things can happen. A program may think it has successfully loaded the file (unaware that the data is meaningless) and then write back a file which to it would be semantically identical, but which would no longer be meaningfully readable by the application that wrote it (or anything else for that matter).
Using magic numbers doesn't entirely prevent this, but it can help at least somewhat.
BTW, trying to guess about the format of data is often very dangerous. For example, suppose one has a list of what are probably dates in the format nn-nn-nn. If one doesn't know what format the dates are in, there may be enough information to pretty well guess the format (e.g. if one of the records is 12-31-99, then absent information to the contrary, the dates are probably mm-dd-yy) but if all dates are within the first 12 days of a month, the data could easily be misinterpreted. Suppose, though, the data were preceded by something saying "MM-DD-YY". Then the risks of misinterpretation could be reduced.
快速识别文件的类型或文件中的位置。
To quickly identify the type of the file, or the positions within it.
你的问题不应该是“为什么文件格式有幻数”,而应该是“有幻数的文件格式有什么优点”!
建议:
file
这样的程序可以检测您的文件是什么Your question should not be “why do file formats have magic number”, but rather “what are the advantages of file formats having magic number”!
Suggestions:
file
can detect what your files are