Whatype

Whatype is an independent file type identification python library.
Whatype was originally developed for CapTipper

The magic bytes signatures are stored in magics.csv, with the format of:

File Description, Magic bytes (Offset 0), Extenstion, Obligatory strings

Usage

Load Whatype library

from whatype import Whatype
WTlib = Whatype() # Uses default magics.csv shipped with the library

Identify file from FileSystem

print WTlib.identify_file("file.ext")

Identify file from Buffer

with open("file.ext",'rb') as f:
  data = f.read()
print WTlib.identify_buffer(data)

Results returns in the form of a tuple:

(File Description, File Extenstion)

Example

>>> from whatype import Whatype
>>> WTlib = Whatype()
>>> WTlib.identify_file("C:\\BinaryFile.exe")
('Windows executable file', 'EXE')

>>> with open(r"C:\\java-archive.jar",'rb') as f:
...     cont = f.read()
...
>>> WTlib.identify_buffer(cont)
('Java archive', 'JAR')

Installation

setup.py install

Info

Written by Omri Herscovici (@omriher)
[email protected]
omriher.com