在日常生活中我们接触到很多软件，如QQ和微信等，这些软件都会对一些文件加密如图片加密成dat文件，这其中多数是利用文件的16进制编码进行异或运算进行加密。此处我们具体介绍一些常见的文件未进行加密前的文件头进行列举：

 

扩展名 文件头标识（HEX） 文件描述
123 00001A00051004 Lotus1-2-3spreadsheet(v9)file
3gg;3gp;3g2 000000nn66747970336770 3rdGenerationPartnershipProject3GPP(nn=0x14)and3GPP2(nn=0x20)multimediafiles
7z 377ABCAF271C 7-ZIPcompressedfile
aba 00014241 PalmAddressBookArchivefile
abi 414F4C494E444558 AOLaddressbookindexfile
aby;idx 414F4C4442 AOLdatabasefiles:addressbook(ABY)anduserconfigurationdata(MAIN.IDX)
accdb 000100005374616E6461726420414345204442 MicrosoftAccess2007file
ACM 4D5A MSaudiocompressionmanagerdriver
ADF 444F53 Amigadiskfile
adx 0300000041505052 LotusApproachADXfile
AIFF 464F524D00 AudioInterchangeFile
ain 2112 AINCompressedArchiveFile
ami 5B7665725D LotusAmiPro
amr 2321414D52 AdaptiveMulti-RateACELP(AlgebraicCodeExcitedLinearPrediction)Codec,commonlyaudioformatwithGSMcellphones
ANI 52494646
API 4D5A900003000000 Acrobatplug-in
arc 1A0x LHarchivefile,oldversion(wherex=0x2,0x3,0x4,0x8or0x9fortypes1-5,respectively)
arc 41724301 FreeArccompressedfile
arj 60EA ARJCompressedArchive
ARJ 60EA27
ART 4A47030E000000 AOLARTfile
ART 4A47040E000000 AOLARTfile
asf 3026B2758E66CF11 WindowsMedia
asf;wma;wmv 3026B2758E66CF11A6D900AA0062CE6C MicrosoftWindowsMediaAudio/VideoFile(AdvancedStreamingFormat)
asx 3C AdvancedStreamredirectorfile
au 2E736E64 SoundMachineAudioFile
NeXT/SunMicrosystemsμ-Lawaudiofile
avi 41564920 AudioVideoInterleave(AVI)
AX 4D5A Librarycachefile
AX 4D5A900003000000 DirectShowfilter
bag 414F4C2046656564626167 AOLandAIMbuddylistfile
BAS 202020
bin 424C4932323351 ThomsonSpeedtouchseriesWLANrouterfirmware
bmp 424D WindowsBitmap
BMP 424D3E
bz;bz2 425A68 BZIPArchive
BZ2;TAR.BZ2;TBZ2;TB2 425A68 bzip2compressedarchive
CAB 495363
CAB;HDR 49536328 InstallShieldv5.xor6.xcompressedfile
CAB 4D534346 MicrosoftCABFileFormat
cat 30 Microsoftsecuritycatalogfile
CBD 434246494C45 WordPerfectdictionaryfile(unconfirmed)
CCD 5B436C
cdr CDR CorelDraw
CDR 454C49544520436F6D6D616E64657220 ElitePlusCommandersavedgamefile
CDR,DVF 4D535F564F494345 SonyCompressedVoiceFile
CHI;CHM 49545346 MicrosoftCompiledHTMLHelpFile
CHM 495453
CLB 434D5831 CorelBinarymetafile
CLB 434F4D2B COM+Catalogfile
cnt 3A42617365
COM,DLL,DRV,EXE,PIF,QTS,QTX,SYS 4D5A Windows/DOSexecutablefile
COM 4D5AEE
COM E93B03
CPE 464158434F5645522D564552 MicrosoftFaxCoverSheet
CPL 4D5A Controlpanelapplication
CPT 4350543746494C45 CorelPhotopaintfile
CPT 43505446494C45 CorelPhotopaintfile
CPX 5B5769
cru;crush 4352555348 CRUSHArchiveFile
CRU 43525553482076 Crushcompressedarchive
CRW 49491A00000048454150434344520200 CanondigitalcameraRAWfile
CTF 436174616C6F6720332E303000 WhereIsItCatalogfile
CUR 0000020001002020 Windowscursorfile
dat 3 MapInfoNativeDataFormat
dat 1A52545320434F4D5052455353454420494D4147452056312E301A RuntimeSoftwarediskimage
dat 415647365F496E746567726974795F4461746162617365 AVG6Integritydatabasefile
DAT 43524547 Windows9xregistryhive
DAT 436C69656E742055726C4361636865204D4D462056657220 IEHistoryDATfile
DAT 45524653534156454441544146494C45 KrollEasyRecoverySavedRecoveryStatefile
DAT 496E6E6F20536574757020556E696E7374616C6C204C6F6720286229 InnoSetupUninstallLogfile
db 0006156100000002000004D200001000 NetscapeNavigator(v4)databasefile
DB 44424648 PalmZirephotodatabase
db 8 dBASEIVordBFastconfigurationfile
db3 3 dBASEIIIfile
db4 4 dBASEIVdatafile
dba 00014244 PalmDateBookArchivefile
dbx CFAD12FE
dbx CFAD12FEC5FD746F OutlookExpress
dci 3C21646F63747970 AOLHTMLmailfile
dcx 3ADE68B1 DCXGraphicFile
DDB 000100
dib 424D device-independentbitmapimage
DLL 4D5A90
DMP 4D444D5093A7 Windowsminidumpfile
DMS 444D5321 AmigaDiskMashercompressedarchive
doc 0D444F43 DeskMateDocumentfile
doc 1234567890FF MSWord6.0
doc 31BE000000AB0000 MSWordforDOS6.0
doc 7FFE340A MSWord
dot;ppt;xla;ppa;pps;pot;msi;sdw;db D0CF11E0 MSOffice/OLE2
doc;dot;xls;xlt;xla;ppt;apr;ppa;pps;pot;msi;sdw;db D0CF11E0A1B11AE1 MSCompoundDocumentv1orLotusApproachAPRfile
DPL 4D5A50
DRV 4D5A16
drw 7 Acommonsignatureandfileextensionformanydrawingprograms.
drw 01FF02040302 Micrografxvectorgraphicfile
ds4 4D47582069747064 MicrografixDesigner4
DSN 4D56 CDStomperProlabelfile
dsp 23204D6963726F736F667420446576656C6F7065722053747564696F MicrosoftDeveloperStudioprojectfile
dss 02647373 DigitalSpeechStandard(Olympus,Grundig,&Phillips)
dtd 0764743264647464 DesignTools2DDesignfile
dtd 3C21454E54495459 XMLDTD
DVR 445644 DVR-Studiostreamfile
dwg 414331
41433130 GenericAutoCADdrawing
NOTESonAutoCADfileheaders:The0x41-43-31-30(AC10)isagenericheader,occupyingthefirstfourbytesinthefile.Thenexttwobytesgivefurtherindicationabouttheversionorsubtype:
0x30-32(02)—AutoCADR2.5
0x30-33(03)—AutoCADR2.6
0x30-34(04)—AutoCADR9
0x30-36(06)—AutoCADR10
0x30-39(09)—AutoCADR11/R12
0x31-30(10)—AutoCADR13(subtype10)
0x31-31(11)—AutoCADR13(subtype11)
0x31-32(12)—AutoCADR13(subtype12)
0x31-33(13)—AutoCADR14(subtype13)
0x31-34(14)—AutoCADR14(subtype14)
0x31-35(15)—AutoCADR2000
0x31-38(18)—AutoCADR2004
0x32-31(21)—AutoCADR2007
Enn(wherennarenumbers) 455646 EnCaseevidencefile
ECO 2A5052
elf 7F454C4601010100 ELFExecutable
emf 0100000058000000 Extended(Enhanced)WindowsMetafileFormat,printerspoolfile
eml 44656C69766572792D646174653A Email
EML 46726F6D202020 Acommmonfileextensionfore-mailfiles.SignaturesshownhereareforNetscape,Eudora,andagenericsignature,respectively.EMLisalsousedbyOutlookExpressandQuickMail.
EML 46726F6D203F3F3F Acommmonfileextensionfore-mailfiles.SignaturesshownhereareforNetscape,Eudora,andagenericsignature,respectively.EMLisalsousedbyOutlookExpressandQuickMail.
EML 46726F6D3A20 Acommmonfileextensionfore-mailfiles.SignaturesshownhereareforNetscape,Eudora,andagenericsignature,respectively.EMLisalsousedbyOutlookExpressandQuickMail.
EML 526563
enc 005C41B1FF MujahideenSecrets2encryptedfile
 "enl"  "[32byteoffset] 40   40 40 20 00 00 40 40 40 40"  "EndNote Library   File"
eps 25215053 AdobeEPSFile
eps 252150532D41646F6265 Postscript
eps 252150532D41646F62652D332E3020455053462D332030 AdobeencapsulatedPostScriptfile(Ifthissignatureisnotattheimmediatebeginningofthefile,itwilloccurearlyinthefile,commonlyatbyteoffset30)
EPS C5D0D3
eth 1A350100 GNNettestWinPharoahcapturefile
evt 300000004C664C65 WindowsEventViewerfile
evt 03000000C466C456
EVTX 456C6646696C6500 WindowsVistaeventlogfile
exe;dll;drv;vxd;sys;ocx;vbx 4D5A Win32Executable
exe;dll;drv;vxd;sys;ocx;vbx 4D5A Win16Executable
exe;com;386;ax;acm;sys;dll;drv;flt;fon;ocx;scr;lrc;vxd;cpl;x32 4D5A ExecutableFile
EXE,DLL,OCX,OLB,IMM,IME 4D5A90
fli 0011AF FLICAnimationfile
flt 000101 OpenFlight3Dfile
FLT 4D5A900003000000 Auditiongraphicfilterfile(Adobe)
FLV 464C5601 Flashvideofile
fm 3C4D616B657246696C6520 AdobeFrameMakerfile
fm3 00001A0007800100 Lotus123v3FMTfile
fmt 20006800200 Lotus123v4FMTfile
FNT 434841
FON 4D5A Fontfile
GBC 87F53E
gid 3F5F0300 WindowsHelpIndexFile
GID 4C4E0200 WindowsHelpindexfile
GIF 47494638
gif 474946383761 Graphicsinterchangeformatfile(GIF87A)
gif 474946383961 Graphicsinterchangeformatfile(GIF89A)
GTD 7B5072
GX2 475832 ShowPartnergraphicsfile(notconfirmed)
gz;tar;tgz 1F8B GzipArchiveFile
gz;tgz 1F8B08 GZCompressedFile
hap 91334846 HAPArchiveFile
HDMP 4D444D5093A7 Windowsheapdumpfile
hdr 233F52414449414E43450A adianceHighDynamicRangeimagefile
HLP 3F5F03
hlp 3F5F0300 WindowsHelpfile
HLP 4C4E0200 WindowsHelpfile
 "hlp"  "[7byteoffset] 00   00 FF FF FF FF"  "Windows Help   file"
hqx 28546869732066696C65 MacintoshBinHex4CompressedArchive
hqx 28546869732066696C65206D75737420626520636F6E76657274656420776974682042696E48657820 MacintoshBinHex4CompressedArchive
HTM 3C2144
htm;html 3C21444F4354 HyperTextMarkupLanguage3
htm;html 3C48544D4C3E HyperTextMarkupLanguage2
htm;html 3C68746D6C3E HyperTextMarkupLanguage1
html 68746D6C3E HTML
ico 0000010000 IconFile
ico 0000010001002020 IconFile
IFF 464F524D
IFO 445644 DVDinfofile
IME 4D5A90
img 000100080001000101 VenturaPublisher/GEMVDIImageFormatBitmapfile
IMG 00FFFF
IMM 4D5A90
ind 414F4C494458 AOLclientpreferences/settingsfile(MAIN.IND)
ISO 4344303031 ISO-9660CDDiscImage(Thissignatureusuallyoccursatbyte8001,8801,or9001.)
ivr 2E524543 RealPlayervideofile(V11andlater)
JAR 4A4152435300 JARCScompressedarchive
jar 5F27A889 JARArchiveFile
jpg;jpeg FFD8FF
jpg;jpe;jpeg FFD8FFE000 JPGGraphicFile
jpg;jpe;jpeg FFD8FFFE00 JPGGraphicFile
KGB 4B47425F61726368202D KGBarchive
KOZ 49443303000000 SprintMusicStoreaudiofile(formobiledevices)
LDB 42494C
lha 2D6C68352D LHACompressed
 "lha; lzh"  "[2byteoffset] 2D   6C 68"  "Compressed   archive file"
LHP 3F5F03
lhp 3F5F0300 WindowsHelpFile
lib 213C617263683E0A Unixarchiver(ar)filesandMicrosoftProgramLibraryCommonObjectFileFormat(COFF)
LIB 2A2420
LIT 49544F4C49544C53 MicrosoftReadereBookfile
LNK 4C0000
lnk 4C000000 WindowsShortcut(LinkFile)
lnk 4C000000011402 WindowsLinkFile
LNK 4C00000001140200 Windowsshortcutfile
log 2A2A2A2020496E7374616C6C6174696F6E205374617274656420 SymantecWiseInstallerlogfile
lzh lh Lzcompressionfile
lwp 576F726450726F LotusWordProv9
m3u 234558
m4a 00000020667479704D34412000000000 AppleLosslessAudioCodecfile
m4a;m4v 00000020667479704D34412000000000 QuickTimeM4A/M4Vfile
manifest 3C3F786D6C2076657273696F6E3D WindowsVisualStylesheetXMLfile
MAR 4D41523100 Mozillaarchive
MAR 4D415243 Microsoft/MSNMARCarchive
MAR 4D41723000 MArcompressedarchive
max D0CF11
mdb 000100005374616E64617264204A6574204442 MicrosoftAccessfile
mdb;mda;mde;mdt 5374616E64617264204A MSAccess
MDF 00FFFF
mdf 00FFFFFFFFFFFFFFFFFFFF0000020001 Alcohol120%CDimage
mdf 010F0000 MicrosoftSQLServer2000database
MDI 4550 MicrosoftDocumentImagingfile
MDS 4D4544
MID;MIDI 4D546864 MusicalInstrumentDigitalInterface(MIDI)soundfile
mkv 1A45DFA3934282886D6174726F736B61 Matroskastreamfile
MLS 4D494C4553 Milestonesv1.0projectmanagementandschedulingsoftware(Alsosee\MV2C\"and\"MV214\"signatures)"
MLS 4D4C5357 Skypelocalizationdatafile
MLS 4D56323134 Milestonesv2.1bprojectmanagementandschedulingsoftware(Alsosee\MILES\"and\"MV2C\"signatures)"
MLS 4D563243 Milestonesv2.1aprojectmanagementandschedulingsoftware(Alsosee\MILES\"and\"MV214\"signatures)"
MMF 4D4D4D440000 YamahaCorp.SyntheticmusicMobileApplicationFormat(SMAF)formultimediafilesthatcanbeplayedonhand-helddevices.
mny 000100004D534953414D204461746162617365 MicrosoftMoneyfile
MOV 00000F
MOV 000077
mov 6D6F6F76 Quicktime
mov 6D646174 QuickTimeMovie
mp 0CED MonochromePictureTIFFbitmapfile(unconfirmed)
MP3 494433 MPEG-1AudioLayer3(MP3)audiofile
MP3 FFFB50
mp4 000000186674797033677035 MPEG-4videofiles
MPA 000001
mpg;mpeg 000001B3 MPEGMovie
mpg 000001BA MPEG
MSC 3C3F78
msc 3C3F786D6C2076657273696F6E3D22312E30223F3E0D0A3C4D4D435F436F6E736F6C6546696C6520436F6E736F6C6556657273696F6E3D22 MicrosoftManagementConsoleSnap-inControlfile
msi 2320 Cerius2file
MSV 4D535F564F494345 SonyMemoryStickCompressedVoicefile
NES 4E4553
NLS C22020
nri 0E4E65726F49534F NeroCDCompilation
ntf 1A0000 LotusNotesdatabasetemplate
nsf;ntf 1A0000030000 LotusNotesDatabase/Template
nsf 1A00000300001100 NotesDatabase
nsf 1A0000040000 LotusNotesdatabase
ntf 30314F52444E414E43452053555256455920202020202020 NationalTransferFormatMapFile
obj 4C01 MicrosoftCommonObjectFileFormat(COFF)relocatableobjectcodefileforanIntel386orlater/compatibleprocessors
OCX 4D5A ActiveXorOLECustomControl
OCX 4D5A90
OLB 4D5A OLEobjectlibrary
OLB 4D5A90
org;pfc 414F4C564D313030 AOLpersonalfilecabinet(PFC)file
pak 1A0B Compressedarchivefile
PAT 4746315041544348 AdvancedGravisUltrasoundpatchfile
PAT 47504154 GIMP(GNUImageManipulationProgram)patternfile
PBK 5B4144
PCB 17A150
PCS 0A0501
pcx 0Ann0101 ZSOFTPaintbrushfile(wherenn=0x02,0x03,or0x05)
pcx 0A050108 PCPaintbrush(oftenassociatedwithQuakeEnginegames)
 "pdb"  "[11byteoffset] 00   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"  "Palmpilot   Database/Document File"
PDF 255044
pdf;fdf 25504446 AdobePortableDocumentFormatandFormsDocumentfile
pdf 255044462D312E AdobeAcrobat
PDG 484802
pf 1100000053434341 Windowsprefetchfile
pic 0100000001 Unknowntypepicturefile
PJT 000007
PLL 24536F
PNG 89504E
PNG 89504E47
png 89504E470D0A PNGImageFile
png 89504E470D0A1A0A PNGImageFile
PPC 526563
PPT D0CF11
 "ppt"  "[512byteoffset]   00 6E 1E F0"  "PowerPoint   presentation subheader (MS Office)"
 "ppt"  "[512byteoffset]   0F 00 E8 03"  "PowerPoint   presentation subheader (MS Office)"
PPZ 4D534346 PowerpointPackagedPresentation
prc 424F4F4B4D4F4249 Palmpilotresourcefile
PRG 234445
ps 252150532D41646F6265 Postscript
PSD 384250
psd 38425053 AdobePhotoshopimagefile
psp 7E424B00 PaintShopProImageFile
pst 2142444E MicrosoftOutlookPersonalFolderfile
pwl E3828596 WindowsPassword
qbb 458600000600 IntuitQuickBooksBackupfile
qdf AC9EBD8F Quicken
qph 03000000 Quickenpricehistoryfile
qt 6D646174 QuicktimeMovieFile
qxd 00004949585052 QuarkExpressdocument(Intel&Motorola,respectively)
qxd 00004D4D585052
ra 2E524D460000001200 RealAudiofile
ra;ram 2E7261FD RealAudioFile
ra 2E7261FD00 RealAudiostreamingmediafile
RAR 526172
rar 52617221 RARArchiveFile
RAW 060500
reg 5245474544495434
rgb 01DA01010003 SiliconGraphicsRGBBitmap
RM 2E524D
rm;rmvb 2E524D46 RealMediastreamingmediafile
rpm EDABEEDB RPMArchiveFile
RTD 43232B44A4434DA5486472 RagTimedocumentfile
RTF 7B5C72
rtf 7B5C727466 RichTextFormatFile
sav 24464C3240282329205350535320444154412046494C45 SPSSDatafile
SBV 46454446 (Unknownfiletype)
SCH 2A7665
scm 805343
SH3 4848474231 HarvardGraphicspresentationfile
SHD 4B490000 Windows9xprinterspoolfile
sit 53495421 Stuffitv1ArchiveFile
sit 53747566664974 Stuffitv5ArchiveFile
sle 3A56455253494F4E Surfplankiteprojectfile
sle 414376 teganosSecuritySuitevirtualsecuredrive
sly;srt;slt 53520100 Sagesly.or.srt.or.slt
SMD 00FFFF
snm 001E849000000000 NetscapeCommunicator(v4)mailfolder
SNP 4D534346 MicrosoftAccessSnapshotViewerfile
sol 00BF AdobeFlashsharedobjectfile(e.g.,Flashcookies)
spl 00000100 WindowsNT/2000/XPprinterspoolfile
SCR 4D5A Screensaver
SUB FFFFFF
SWF 435753 ShockwaveFlashfile(v5+)
SWF 465753 MacromediaShockwaveFlashplayerfile
sxc calc OpenOfficeCalc
sxd draw OpenOfficeDraw
sxi impress OpenOfficeImpress
sxm math OpenOfficeMath
sxw writer OpenOfficeWriter
syw 414D594F HarvardGraphicssymbolgraphic
TAG 000002
tar;cpio 303730373037 CPIOArchiveFile
tar.z 1F9D90 Compressedtapearchivefile
tga 0000100000 RLE压缩的前5字节
TGA 000002
tga 0000020000 未压缩的前5字节
TIF;TIFF 492049 TaggedImageFileFormatfile
tif;tiff 49492A TIFF(Intel)
tif;tiff 49492A00 TaggedImageFileFormatfile(littleendian,i.e.,LSBfirstinthebyte;Intel)
TIF;TIFF 4D4D002A TaggedImageFileFormatfile(bigendian,i.e.,LSBlastinthebyte;Motorola)
tif;tiff 4D4D2A TIFF(Motorola)
TIF;TIFF 4D4D002B BigTIFFfiles;TaggedImageFileFormatfiles>4GB
TLB 4D53465402000100 OLE,SPSS,orVisualC++typelibraryfile
tr1 0110 NovellLANalyzercapturefile
TST 000100
TTF 000100
ufa 554641 UFAArchiveFile
VBX 4D5A VisualBASICapplication
VCD 454E5452595643440200000102001858 VideoVCD(GNUVCDImager)file
vcf 424547494E3A56434152440D0A vCardfile
vob 000001BA DVDVideoMovieFile(video/dvd,video/mpeg)
VXD,386 4D5A Windowsvirtualdevicedrivers
WAV 524946
WAV 52494646 Wave
wav 57415645 Wave
wav 57415645666D74 WaveFiles
wb2 00000200 QuattroProforWindowsSpreadsheetfile
 "wb3"  "[24byteoffset] 3E   00 03 00 FE FF 09 00 06"  "Quatro Pro for   Windows 7.0 Notebook file"
wk1;wks 2000604060 Lotus123v1Worksheet
wk1 0000020006040600080000000000 Lotus1-2-3spreadsheet(v1)file
wk3 00001A0000100400 Lotus123spreadsheet(v3)file
wk4;wk5 00001A0002100400 Lotus1-2-3spreadsheet(v4,v5)file
wks 0E574B53 DeskMateWorksheet
WMA 3026B2
wmf 01000900 GraphicsMetafile
wmf 010009000003 WindowsMetadatafile(Win3.xformat)
wmf 02000900 GraphicsMetafile
wmf D7CDC69A WindowsMetaFile
WMV 3026B2
wp FF575043 WordPerfectv5orv6
wpd FF575043 WordPerfect
wpg FF575047 WordPerfectGraphics
wri 31BE MicrosoftWritefile
WRI 31BE00
wri 32BE MicrosoftWritefile
ws 1D7D WordStarVersion5.0/6.0document
XBE 584245
xdr 3C BizTalkXML-DataReducedSchemafile
xls 0902060000001000B9045C00 MSExcelv2
xls 0904060000001000F6055C00 MSExcelv4
XLS D0CF11
xls D0CF11E0 MSExcel
xls  "[512byteoffset]   09 08 10 00 00 06 05 00"  "Excel spreadsheet   subheader (MS Office)"
XML 3C3F78
xml 3C3F786D6C XMLDocument
xml FFFE3C0052004F004F0054005300540055004200 XMLDocument(ROOTSTUB)
XMV 005001
XSL FFFE3C
xul 7273696F6E3D22313C3F786D6C2076652E30223F3E XMLUserInterfaceLanguagefile
z 1F9D TARCompressedArchiveFile
Z 1F9D8C
ZIP 504B03
zip;jar;zipx 504B0304 ZIPArchive
zip 504B3030 ZIPArchive(outdated)
Zip 504B3030504B0304 WINZIPCompressed
zoo 5A4F4F20 ZOOArchiveFile

 

来自 <https://goyasha.com/post/2d34n9vp/>