FILE TYPE

[amos-coder]

Hi, I want to know how the file type is detected in DIE. If anyone can help please do.

[horsicq]

https://github.com/horsicq/Formats/blob/master/xbinary.cpp#L4454

[Kaens]

That answer above may be a bit out-of-date, and it seems that you expected a slightly more general answer, since that one's not marked as one!

So, how about this? :)
For starters, file formats mostly have identifying sequences in them. Like a PNG image starts with the bytes ''89h 'PNG' 0Dh 0Ah 00h ? ? ? 'IHDR'", or a 7-Zip archive with "'7z' BC AF 27 1C". Those are called "signatures", and they provide the first (and usually good) idea about what this file is for.

Then there are formats whose signatures are just not enough. Like a Windows .EXE file starts with the text "MZ" or a Microsoft .BMP image with the text "BM" (or other), but any text file at all can begin with two Latin characters! You can kinda tell just by looking at them if the rest of the file looks like gibberish in some text viewer. Or you're a computer program called Detect-It-Easy and can't quite rely on that; so you also check if the rest of the file structure corresponds to your expectations.
For example, if you check the 32-bit value held in the .BMP at offset 2, right after the signature, that'll be the expected filesize, so if your file's at least this big and also >= the 32-bit value at offset 0Ah (points at the start of image payload which itself must be at least as big as 0A + the size of the following subheader), you probably have a valid .BMP. Further checks may be good for this, too.
Or take a .docx file; that's just a renamed .ZIP that you first have to unpack to understand it's not just any archive, but a MS Office document.

And of course, there are tons of happy fun formats that don't have any signatures at all! Then either the detector will ignore it, or it will match one of the many detectors that feature a complex but very reasonable bunch of programmatic checks to ensure the tiny properties of the format each individual detector expects will all come together nicely. An example would be, yeah, let's take a .PCX file. It has a 1-byte signature (that's totally useless), but you can delve deeper and become reasonably sure that it's that. I've made an article with lots of details on this one, and it's still one of the very popular formats most people have seen and can effortlessly create in 2025, so grab a hex editor and take a look!

Hopefully this answers it!