Identify a File by Its Magic Bytes

What Are Magic Bytes?

Nearly every binary file format begins with a fixed signature called magic bytes that identifies the format before any parsing happens. ELF executables start with 0x7F followed by the ASCII letters E, L, F. PNG images start with 0x89 P N G. The Linux file command identifies thousands of formats this way.

Why Loaders Check Magic First

When the kernel executes a file, the very first thing binfmt_elf does is compare the first four bytes against the ELF magic. If they do not match, the kernel tries other handlers (scripts via #!, for example). This cheap check prevents the loader from misinterpreting garbage as a program header.

Common magic signatures you will see in this track:

• ELF: 7f 45 4c 46
• PE/DOS: 4d 5a (MZ)
• ZIP: 50 4b 03 04

For This Exercise

You will read four byte values from stdin and decide whether they form the ELF magic. This mirrors the first check every binary loader performs, and it is the foundation for parsing ELF headers in the next task. Getting comfortable comparing raw bytes against a known signature is a skill you will use in every subsequent binary analysis exercise.