Thread: distinguishing executable files

  1. #1
    Registered User
    Join Date
    Sep 2008
    Posts
    12

    Unhappy distinguishing executable files

    Hi all,

    How can i identify a file-type ?
    well actually ..i need 2 identify executable files amongst other files.
    extension is not an option..since it can vary in different os.

    is dere a file header which indicates the type of file ...
    plsssss reply.. dis is perplexing nd m not gettin any answers..

  2. #2
    and the hat of sweating
    Join Date
    Aug 2007
    Location
    Toronto, ON
    Posts
    3,545
    On Windows, use: GetBinaryType()
    On UNIX check the man pages to see if there's anything similar, or open some executables in a hex editor and see if there's anything common (like in Windows most of the executables I looked at start with "MZ")...
    "I am probably the laziest programmer on the planet, a fact with which anyone who has ever seen my code will agree." - esbo, 11/15/2008

    "the internet is a scary place to be thats why i dont use it much." - billet, 03/17/2010

  3. #3
    Registered User
    Join Date
    Sep 2008
    Posts
    12
    hi cp..

    thanx 4 d help..
    one doubt.. GetBinaryType is from the Win32 ApI.. ??
    will it work in VC++ or MFC or standard C programs..

  4. #4
    Kernel hacker
    Join Date
    Jul 2007
    Location
    Farncombe, Surrey, England
    Posts
    15,677
    There isn't a generic way to detect if something is an executable file, as that does vary from OS to OS. The only possible action is to read parts of the file to determine what type it is. However, that is not NECESSARILY enough, as for example .com files are just identified by extension - the content is a plain binary file loaded into memory and then executed from the loaded address (0x100, where address 0..0xFF contains information from the OS, such as the command line). There is absolutely no way to tell what this file is, other than it's extension.

    --
    Mats
    Compilers can produce warnings - make the compiler programmers happy: Use them!
    Please don't PM me for help - and no, I don't do help over instant messengers.

  5. #5
    and the hat of sweating
    Join Date
    Aug 2007
    Location
    Toronto, ON
    Posts
    3,545
    Quote Originally Posted by smooth View Post
    hi cp..

    thanx 4 d help..
    one doubt.. GetBinaryType is from the Win32 ApI.. ??
    will it work in VC++ or MFC or standard C programs..
    ALL functions on Windows (stdlib, MFC or anything else) that do more than move things around in memory must use the Windows API. There's just no other way for them to do anything useful.
    If you look at the implementation of malloc(), printf(), fopen()... you will see calls to Win32 API functions.
    "I am probably the laziest programmer on the planet, a fact with which anyone who has ever seen my code will agree." - esbo, 11/15/2008

    "the internet is a scary place to be thats why i dont use it much." - billet, 03/17/2010

  6. #6
    Registered User
    Join Date
    Sep 2008
    Posts
    12
    hi all..

    m back wid anoder one..

    i searched and found dat dere is a file header in every file which contains file info ...

    does dat header contain the file-type or some bytes which indicate if its an executable..

    i think dis will b interesting ...

    help me !!

  7. #7
    and the hat of sweating
    Join Date
    Aug 2007
    Location
    Toronto, ON
    Posts
    3,545
    Yes usually, but unless you're an expert in those file formats, you'd probably just be guessing. One of my previous companies tried to create a file type identification program with partial success.
    "I am probably the laziest programmer on the planet, a fact with which anyone who has ever seen my code will agree." - esbo, 11/15/2008

    "the internet is a scary place to be thats why i dont use it much." - billet, 03/17/2010

  8. #8
    Technical Lead QuantumPete's Avatar
    Join Date
    Aug 2007
    Location
    London, UK
    Posts
    894
    Quote Originally Posted by smooth View Post
    m back wid anoder one..
    Is there a reason you type like that? I'm sure no-one here will be offended at proper punctuation and spelling...

    QuantumPete
    "No-one else has reported this problem, you're either crazy or a liar" - Dogbert Technical Support
    "Have you tried turning it off and on again?" - The IT Crowd

  9. #9
    and the hat of sweating
    Join Date
    Aug 2007
    Location
    Toronto, ON
    Posts
    3,545
    Quote Originally Posted by QuantumPete View Post
    Is there a reason you type like that? I'm sure no-one here will be offended at proper punctuation and spelling...

    QuantumPete
    Yeah, I'm thinking of changing my signature to a link to www.dictionary.com
    "I am probably the laziest programmer on the planet, a fact with which anyone who has ever seen my code will agree." - esbo, 11/15/2008

    "the internet is a scary place to be thats why i dont use it much." - billet, 03/17/2010

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Create Copies of Files
    By Kanshu in forum C++ Programming
    Replies: 13
    Last Post: 05-09-2009, 07:53 AM
  2. Reading .dat files from a folder in current directory...
    By porsche911nfs in forum C++ Programming
    Replies: 7
    Last Post: 04-04-2009, 09:52 PM
  3. CreateProcess with Resource of executable, not the Filename
    By Ktulu in forum Windows Programming
    Replies: 4
    Last Post: 11-04-2006, 01:07 AM
  4. Folding@Home Cboard team?
    By jverkoey in forum A Brief History of Cprogramming.com
    Replies: 398
    Last Post: 10-11-2005, 08:44 AM
  5. Batch file programming
    By year2038bug in forum Tech Board
    Replies: 10
    Last Post: 09-05-2005, 03:30 PM