Skip to content

A signature engine that makes it possible to recognize a file type based on a template. Can be used by antiviruses

License

Notifications You must be signed in to change notification settings

DosX-dev/Zeus-File-Identifier

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 
 
 

Repository files navigation

🔮 Zeus File Identifier (ZFI)

This program is designed to determine the file type using signatures according to certain rules. Can be used by antiviruses.

📑 About

This console program takes an argument --file which specifies the path to the file that needs to be examined. The output will contain the resulting format, description and some technical data (for example, the presence of compressed entropy data)

💼 Database rules format

{STRING_NAME}|{STRING_FILE_TYPE}|{STRING_DESCRIPTION}|{MASK_SIGNATURE}
  • Use ".."/"??" to indicate an unknown byte (like "0000..29..11...00")
  • Use the ' character to wrap an ASCII string (like "000000'String in the file!'000029")

The signature is read only from the beginning of the file.

Example of rule:

Lua Bytecode|Script|Lua machine code|1B'Lua'..00

🐧 Run on Linux

Use the mono-complete package to use the program on Linux:

mono Zeus_File_Identifier.app --file "application.exe"

✨ What about...

Detect It Easy will soon support Zeus File Identifier formats

About

A signature engine that makes it possible to recognize a file type based on a template. Can be used by antiviruses

Topics

Resources

License

Stars

Watchers

Forks

Packages

No packages published