C# File signature

C# File signature

• JayZee

  Do you mean using a technique other than opening the file as a byte stream and reading the first 20 of them
  
  FileStream fs = File.Open(path, FileMode.Open);
  Byte[] b = new byte[20];
  fs.Read(b, 0, 20);
  
  Bruce Johnson [C# MVP]
  http://www.objectsharp.com/blogs/bruce
  
  
  

• Konigmann

  It sounds like you're talking about a hash calculation of a file. A hash calculation gives you an almost unique ID of a array of bytes. The chances of two files having the same hash calculation is very low. Although, don't use object.GetHashCode(). You will get duplicates with it.
  

• LinCar

  I imageine the following is what you are referring to.

  Example: X5O!P%@AP[4\PZX54(P^)7CC)7$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
  If you copy these lines in a text file and save it as an executable with a .com extension, your antivirus will detect it as a virus, because these codes are stored in its database.
  

  No, this is not a checksum. This is just a specific set of bytes in a file that Norton says they commonly look for.

  A checksum is usually calculated on the file as a whole. Since I don't know the inner workings of Antivirus I can't really say if they do it the same way. I'm sure they take an approach where the use several different methods.

  
  

• jmsigler2

  Kaiser, you are confusing two different uses of the term "File Signature".
  
  These are:
  
  (1) Signature bytes written to a file header so that an application can quickly determine if its being asked to open a file of the correct type.
  
  The Windows Bitmap File example falls into this category, as do many other application data files. It is up to the application to write such data into the file's header. You access the header by reading the data from the file using a normal read operation. There is no special operating system function for handling these kinds of File Signatures.
  
  There is no standard for storing signature bytes in a file header. Each application can (and usually does) do it differently. The only way to know where such header bytes exist is to have some specific documentation for the application that creates the file.
  
  (2) Checksum values computed from all the bytes in a file. These are commonly used to ensure that a file has not changed, or - in the case of a virus checker - to quickly look up files in a virus list.
  
  There is no operating system function to compute checksum values of a file in this way. You must do it yourself by reading the entire file. You must also know the algorithm used to compute the checksum value.
  
  

• donaldg

  Thx for the reply.
  
  That is not what i need though, that just opens the file and reads the first 20 byte characters written in the file. The file signature is only read by the computer itself and is not visible to users i think. Its more complicated to do.
  
  any suggestions
  
  
  
  
  
  

• SSCIT

  Thx for all of you guys that replied.
  
  I read an article located here http://www.symantec.com/region/reg_eu/resources/antivirus.html
  
  So regarding the file signatures does the site example fall under the checksum values
  
  
  
  
  
  
• C# File signature