3 ms·
Interesting .. looks like *nix 'file' command reads from start to end, so it detects it as JPG. [09:55:38] jliew@ssdstrdev1:~/malcode $ file some.jpg some.jpg
by jayliew 17y ago
Interesting .. looks like *nix 'file' command reads from start to end, so it detects it as JPG.
[09:55:38] jliew@ssdstrdev1:~/malcode
$ file some.jpg
some.jpg: JPEG image data, JFIF standard 1.01
[09:55:45] jliew@ssdstrdev1:~/malcode
$ file some.zip
some.zip: Zip archive data, at least v2.0 to extract
[09:55:47] jliew@ssdstrdev1:~/malcode
$ cat some.jpg some.zip > concat
[09:57:14] jliew@ssdstrdev1:~/malcode
$ file concat
concat: JPEG image data, JFIF standard 1.01
[09:57:21] jliew@ssdstrdev1:~/malcode
$ whatis file
file (1) - determine file type
- NikkiA 17y ago'file' doesn't really read in any specific direction, it just uses a set of rules defined in /etc/magic or /usr/share/file/magic.* (there are compiled binary forms too, now) The rules can specify any offset for a magic file identifier, or set of identifiers. What determines what file will report, in cases like this, is really more a case of which order the rules are checked in.