[-AI-] 檔案hex表頭

作者: GodIsland (搞不定嗎用C4就對了)   2019-05-24 00:34:04
https://www.autoitscript.com/forum/topic/188773-solved-read-file-hex-mode-help/
#include <FileConstants.au3>
ConsoleWrite(_ReadOffSet("1.txt",0,8) & @CRLF)
Func _ReadOffSet($sFilePath,$iOffset,$iLen=1)
Local $sRet=""
Local $hFile=FileOpen($sFilePath,$FO_BINARY)
FileSetPos($hFile,$iOffset,$FILE_BEGIN)
$sRet=FileRead($hFile,$iLen)
FileClose($hFile)
Return $sRet
EndFunc
原文有2個func,第一個如果檔案太大好像會爆掉,我試成功的是第二個func,
讀出來的值是0xD0CF11E0A1B11AE1,就代表是Microsoft Office document,
可能是 doc; dot; xls; xlt; xla; ppt; apr ;ppa; pps; pot; msi; sdw; db
參考
https://www.datadoctor.biz/data_recovery_programming_book_chapter14-page2.html
如果要確認是那種檔案則還要配合Footer (Hex),目前還沒搞定Footer (Hex)這段。
https://deurus.info/2017/10/list-of-file-signatures/
https://www.filesignatures.net/index.php?search=FFD8FFE1&mode=SIG
https://www.filesignatures.net/index.php?search=JPEG&mode=EXT
Extension Signature Description
JPG FF D8 FF E1 Digital camera JPG using
Exchangeable Image File Format (EXIF)
JPEG FF D8 FF E0 JPEG IMAGE
JPEG FF D8 FF E2 CANNON EOS JPEG FILE
JPEG FF D8 FF E3 SAMSUNG D500 JPEG FILE
PNG 89 50 4E 47 0D 0A 1A 0A PNG image

Links booklink

Contact Us: admin [ a t ] ucptt.com