MZ, BSJB, and the Joys of "Magic" Constants in Managed Assemblies.
2008-12-01 10:51
507 查看
[原文链接:http://www.moserware.com/2007/11/mz-bsjb-and-joys-of-magic-constants-in.html]
![](http://bp0.blogger.com/_Zfbv3mHcYrc/R0N5abOqhDI/AAAAAAAAAEs/uGDuss30n_k/s400/MZ.png)
When I was 10 or so, I thought you could open up a .EXE in a text editor and do meaningful work with it if you only knew some magical secret. I noticed that all EXEs started with the letters "MZ" as in the CMD.EXE example above, but that's as far as I got.
A few years later, I read this article in the special 20th anniversary edition of Byte Magazine that let me know that "MZ" stood for the initials of Mark Zbikowski who designed the MS-DOS executable file format. Needing some magic number to identify bits as an executable, what better choice than your own initials (in Mark's case 0x4D5A)? This is actually very common knowledge that won't get you points at your next nerd dinner.
However, today I will share a point generating piece of knowledge (well for at least a year or so)... Without further ado:
![](http://bp1.blogger.com/_Zfbv3mHcYrc/R0NeOrOqhCI/AAAAAAAAAEk/Fd_iqnTPTzw/s400/BSJB.png)
In every piece of managed code, you'll find the four bytes (little-endian DWORD) of 0x42534A42, (of course, in big-endian 0x424A534A). This corresponds to the start of the "General Metadata Header" of an assembly.
The initials correspond to Brian Harry, Susan Radke-Sproull, Jason Zander, and Bill Evans who were part of the team in 1998 that worked on the CLR.
I discovered this gem while reading page 76 of Expert .NET 2.0 IL Assembler. After googling for it though it appears that it's been covered elsewhere too.
With this knowledge, you could write a very simple program that checked to see if a file was a .NET assembly by looking for a start of "MZ" that also contained "BSJB." It looks like the first "virus" that targeted .NET took advantage of this fact.
Now, where can I put "JDM"?
-------------------------------------
"When I was 10 or so, I thought you could open up a .EXE in a text editor and do meaningful work with it if you only knew some magical secret."
I was thinking exactly the same when I was first introduced to computers. I was opening any file (text or binary) with a text editor and fiddling around.
Btw the compiled .java files, .class files, start with these 4 bytes: 0xCA 0xFE 0xBA 0xBE aka Cafe Babe and ZIP files start with PK.
-------------------------------------
Huseyin: Good point on 0xCAFEBABE and PK. Similar things can be said for WAV, GIF, and other files. I think that Apache's Mimemagic module (and similar modules) looks for these to determine the real file type.
![](http://bp0.blogger.com/_Zfbv3mHcYrc/R0N5abOqhDI/AAAAAAAAAEs/uGDuss30n_k/s400/MZ.png)
When I was 10 or so, I thought you could open up a .EXE in a text editor and do meaningful work with it if you only knew some magical secret. I noticed that all EXEs started with the letters "MZ" as in the CMD.EXE example above, but that's as far as I got.
A few years later, I read this article in the special 20th anniversary edition of Byte Magazine that let me know that "MZ" stood for the initials of Mark Zbikowski who designed the MS-DOS executable file format. Needing some magic number to identify bits as an executable, what better choice than your own initials (in Mark's case 0x4D5A)? This is actually very common knowledge that won't get you points at your next nerd dinner.
However, today I will share a point generating piece of knowledge (well for at least a year or so)... Without further ado:
![](http://bp1.blogger.com/_Zfbv3mHcYrc/R0NeOrOqhCI/AAAAAAAAAEk/Fd_iqnTPTzw/s400/BSJB.png)
In every piece of managed code, you'll find the four bytes (little-endian DWORD) of 0x42534A42, (of course, in big-endian 0x424A534A). This corresponds to the start of the "General Metadata Header" of an assembly.
The initials correspond to Brian Harry, Susan Radke-Sproull, Jason Zander, and Bill Evans who were part of the team in 1998 that worked on the CLR.
I discovered this gem while reading page 76 of Expert .NET 2.0 IL Assembler. After googling for it though it appears that it's been covered elsewhere too.
With this knowledge, you could write a very simple program that checked to see if a file was a .NET assembly by looking for a start of "MZ" that also contained "BSJB." It looks like the first "virus" that targeted .NET took advantage of this fact.
Now, where can I put "JDM"?
-------------------------------------
"When I was 10 or so, I thought you could open up a .EXE in a text editor and do meaningful work with it if you only knew some magical secret."
I was thinking exactly the same when I was first introduced to computers. I was opening any file (text or binary) with a text editor and fiddling around.
Btw the compiled .java files, .class files, start with these 4 bytes: 0xCA 0xFE 0xBA 0xBE aka Cafe Babe and ZIP files start with PK.
-------------------------------------
Huseyin: Good point on 0xCAFEBABE and PK. Similar things can be said for WAV, GIF, and other files. I think that Apache's Mimemagic module (and similar modules) looks for these to determine the real file type.
相关文章推荐
- How to invoke the method of managed bean and render view in JSF when we are outside the lifecycle of JSF
- The article discusses a couple of new features introduced for assemblies and versioning in Visual Studio 2005.
- Ray-ban Sunglasses: The Ultimate Name in the World of Sunglasses and Eyewear
- 106.Examine the data in the LIST_PRICE and MIN_PRICE columns of the PRODUCTS table:
- Teddy's Aspect Weaver Version 0.3 with Great Updating and Fixing, Especially the Implementing of Getting Runtime Method Context Info and Method Arguments in MSIL Level
- django1.8 提示(1_8.W001) The standalone TEMPLATE_* settings were deprecated in Django 1.8 and the TEMPLATES dictionary takes precedence. You must put the values of the following settings into your defau
- The tag of<o:p> and the <?xml:namespace prefix = o /> in the html
- The Research and Development of SCADA in Petroleum Industry
- The run order about Loaded event and OnApplyTemplate in custom control of Silverlight 2 beta 2
- UISearchController Attempting to load the view of a view controller while it is deallocating is not allowed and may result in undefined behavior
- The Proccess of Loading and Executing a Specific Program in Linux Kernel
- 译《Time, Clocks, and the Ordering of Events in a Distributed System》
- 《The Frontiers of Memory and Attention in Deep Learning》 图文结合详解深度学习Memory & Attention
- Design and Usability of Digital Libraries: Case Studies in the Asia Pacific
- What's the difference of name scope and a variable scope in tensorflow?
- How to collect TrustZone debug logs and check the meaning of error code in the logs
- Effective C++ Item 16 Use the same form in corresponding uses of new and delete
- 评论数据库Win A Free Copy of Packt’s Managing Multimedia and Unstructured Data in the Oracle Database e-book
- What is the purpose of @SmallTest, @MediumTest, and @LargeTest annotations in Android?
- SCIENCE IN THE NEWS - Ocean Storms and the Science of Nature's Power