Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail
From: Thad Floryan <thad@thadlabs.com>
Newsgroups: comp.os.linux.misc
Subject: Re: magic number for mcrypt
Date: Sat, 15 Nov 2014 18:27:14 -0800
Organization: ThadLABS
Lines: 25
Message-ID: <54680B82.3000700@thadlabs.com>
References: <m48nlr$2ja$1@speranza.aioe.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Injection-Info: mx02.eternal-september.org; posting-host="8c9e5db8d01ced79e92159efa406567d"; logging-data="17309"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX19F0hWK1q5mh1eI9IAejICNTJPe5bhQFJ0="
User-Agent: Thunderbird 2.0.0.24 (Windows/20100228)
In-Reply-To: <m48nlr$2ja$1@speranza.aioe.org>
Cancel-Lock: sha1:/YfZ4iTcnBXeaq06AxYwohRCLUA=
Xref: csiph.com comp.os.linux.misc:12712

On 11/15/2014 3:30 PM, Bill Cunningham wrote:
> The 'file' command recognizes an encrypted file from mcrypt but I can't 
> find anywhere online the hex "magic number" that identifies the format. It 
> could be a long series of hex numbers or short. Does anyone know mcrypt's 
> signature?

$ man file | grep 'default magic' | head -1
/usr/share/misc/magic  Directory containing default magic files.

$ cd /usr/share/misc

$ ll
total 2336
-rw-r--r-- 1 root root  600570 Mar 15  2012 magic
-rw-r--r-- 1 root root 1786200 Mar 15  2012 magic.mgc

$ grep mcrypt *
magic:# $File: mcrypt,v 1.5 2009/09/19 16:28:10 christos Exp $
magic:# mcrypt:   file(1) magic for mcrypt 2.2.x;
magic:0 string            \0m\3     mcrypt 2.5 encrypted data,
magic:0 string            \0m\2     mcrypt 2.2 encrypted data,
Binary file magic.mgc matches


Thad