search

h2non / filetype

Fast, dependency-free Go package to infer binary file types based on the magic numbers header signature
https://pkg.go.dev/github.com/h2non/filetype?tab=doc
MIT License
2.05k stars 178 forks source link

add dll support #103

Open ZhangMengRou opened 3 years ago

ZhangMengRou commented 3 years ago

Both exe and dll are PE files. []byte{0x4D, 0x5A} is PE's magic number

Differentiation:

> IMAGE_FILE_DLL
> 0x2000
> The  image  is  a  DLL  file.  While  it  is  an  executable  file,  it  cannot  be  run  directly

Thanks.

Source: https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-image_file_header?redirectedfrom=MSDN https://docs.microsoft.com/en-us/previous-versions/ms809762(v=msdn.10)?redirectedfrom=MSDN

LordNoteworthy commented 3 years ago

would be nice to get this one merged, though I would like to have a unified type called PE, and then additional input like dll, exe or driver would be extra information.