--- title: "Magic number (programming)" type: "antipattern" slug: "magic-number" url: "http://localhost:3000/en/antipatterns/magic-number.md" description: "Numeric value with an unclear meaning" --- # Magic number (programming) > Numeric value with an unclear meaning In [computer programming](https://en.wikipedia.org/wiki/Computer%5Fprogramming "Computer programming"), a **magic number** or **file signature** is a [numeric](https://en.wikipedia.org/wiki/Numeric "Numeric") [literal](https://en.wikipedia.org/wiki/Literal%5F%28computer%5Fprogramming%29 "Literal (computer programming)") in [source code](https://en.wikipedia.org/wiki/Source%5Fcode "Source code") that has a special, particular meaning that is less than clear to the reader. Also in [computing](https://en.wikipedia.org/wiki/Computing "Computing"), but not limited to programming, the term is used for a number that identifies a particular concept but without additional knowledge its meaning is less than clear. For example, some [file formats](https://en.wikipedia.org/wiki/File%5Fformat "File format") are identified by an embedded magic number in the [file](https://en.wikipedia.org/wiki/Computer%5Ffile "Computer file") ). Also, a number that is relatively uniquely associated with a particular concept, such as a [universally unique identifier](https://en.wikipedia.org/wiki/Universally%5Funique%5Fidentifier "Universally unique identifier"), might be classified as a magic number. ## Numeric literal A **magic number** or **magic constant** is a numeric [literal](https://en.wikipedia.org/wiki/Literal%5F%28computer%5Fprogramming%29 "Literal (computer programming)") in source code which has a special meaning that is less than clear in context. This is considered an [anti-pattern](https://en.wikipedia.org/wiki/Anti-pattern "Anti-pattern") and breaks one of the oldest rules of programming, dating back to the [COBOL](https://en.wikipedia.org/wiki/COBOL "COBOL"), [FORTRAN](https://en.wikipedia.org/wiki/FORTRAN "FORTRAN") and [PL/1](https://en.wikipedia.org/wiki/PL/1 "PL/1") manuals of the 1960s. For example, in the following code that computes a price after tax, `1.05` is a magic number since the value encodes the sales tax rate, 5%, in a way that is less than obvious. price_after_tax = 1.05 * price The use of magic numbers in code obscures the developers' intent in choosing that number, increases opportunities for subtle errors, and makes it more difficult for the program to be adapted and extended in the future. As an example, it is difficult to tell whether every digit in `3.14159265358979323846` is correctly typed, or if this constant for [pi](https://en.wikipedia.org/wiki/Pi "Pi") can be [truncated](https://en.wikipedia.org/wiki/Truncation "Truncation") to `3.14159` without affecting the functionality of the program with its reduced precision. Replacing all significant magic numbers with named [constants](https://en.wikipedia.org/wiki/Constant%5F%28programming%29 "Constant (programming)") (also called explanatory variables) makes programs easier to read, understand and maintain. The example above can be improved by adding a descriptively named variable: TAX = 0.05 price_after_tax = (1.0 + TAX) * price A good name can result in code that is more easily understood by a maintainer who is not the original author and even the original author after a period of time. An example of an uninformatively named constant is `int SIXTEEN = 16`, while `int NUMBER_OF_BITS = 16` might be more useful. Non-numeric data can have the same magical properties, and therefore, the same issues as magic numbers. Thus, declaring `const string testUserName = "John"` and using `testUserName` might be better than using the literal `"John"` directly. ### Example For example, if it is required to randomly shuffle the values in an array representing a standard pack of [playing cards](https://en.wikipedia.org/wiki/Playing%5Fcards "Playing cards"), this [pseudocode](https://en.wikipedia.org/wiki/Pseudocode "Pseudocode") does the job using the [Fisher–Yates shuffle](https://en.wikipedia.org/wiki/Fisher%E2%80%93Yates%5Fshuffle "Fisher–Yates shuffle") algorithm: **for** i **from** 1 **to** 52 j := i + randomInt(53 - i) - 1 a.swapEntries(i, j) where `a` is an array object, the function `randomInt(x)` chooses a random integer between 1 and _x_, inclusive, and `swapEntries(i, j)` swaps the _i_th and _j_th entries in the array. In the preceding example, `52` and `53` are magic numbers, also not clearly related to each other. It is considered better programming style to write the following: _int_ deckSize:= 52 **for** i **from** 1 **to** deckSize j := i + randomInt(deckSize + 1 - i) - 1 a.swapEntries(i, j) This is preferable for several reasons: * **Better readability**. A programmer reading the first example might wonder, _What does the number 52 mean here? Why 52?_ The programmer might infer the meaning after reading the code carefully, but it is not obvious. Magic numbers become particularly confusing when the same number is used for different purposes in one section of code. * **Easier to maintain**. It is easier to alter the value of the number, as it is not duplicated. Changing the value of a magic number is error-prone, because the same value is often used several times in different places within a program. Also, when two semantically distinct variables or numbers have the same value they may be accidentally both edited together. To modify the first example to shuffle a [Tarot](https://en.wikipedia.org/wiki/Tarot "Tarot") deck, which has 78 cards, a programmer might naively replace every instance of 52 in the program with 78\. This would cause two problems. First, it would miss the value 53 on the second line of the example, which would cause the algorithm to fail in a subtle way. Second, it would likely replace the characters "52" everywhere, regardless of whether they refer to the deck size or to something else entirely, such as the number of weeks in a Gregorian calendar year, or more insidiously, are part of a number like "1523", all of which would introduce bugs. By contrast, changing the value of the `deckSize` variable in the second example would be a simple, one-line change. * **Encourages documentation**. The single place where the named variable is declared makes a good place to document what the value means and why it has the value it does. Having the same value in a plethora of places either leads to duplicate comments (and attendant problems when updating some but missing some) or leaves no _one_ place where it's both natural for the author to explain the value and likely the reader shall look for an explanation. * **Coalesces information**. The declarations of "magic number" variables can be placed together, usually at the top of a function or file, facilitating their review and change. * **Detects [typos](https://en.wikipedia.org/wiki/Typo "Typo")**. Using a variable (instead of a literal) takes advantage of a compiler's checking. Accidentally typing "62" instead of "52" would go undetected, whereas typing "`dekSize`" instead of "`deckSize`" would result in the compiler's warning that `dekSize` is undeclared. * **Reduces typing**. If a [IDE](https://en.wikipedia.org/wiki/Integrated%5Fdevelopment%5Fenvironment "Integrated development environment") supports [code completion](https://en.wikipedia.org/wiki/Code%5Fcompletion "Code completion"), it will fill in most of the variable's name from the first few letters. * **Facilitates parameterization**. For example, to generalize the above example into a procedure that shuffles a deck of any number of cards, it would be sufficient to turn `deckSize` into a parameter of that procedure, whereas the first example would require several changes. **function** shuffle (**int** deckSize) **for** i **from** 1 **to** deckSize j := i + randomInt(deckSize + 1 - i) - 1 a.swapEntries(i, j) Disadvantages are: * **Breaks locality**. When the named constant is not defined near its use, it hurts the locality, and thus comprehensibility, of the code. Putting the 52 in a possibly distant place means that, to understand the workings of the "for" loop completely (for example to estimate the run-time of the loop), one must track down the definition and verify that it is the expected number. This is easy to avoid (by relocating the declaration) when the constant is only used in one portion of the code. When the named constant is used in disparate portions, on the other hand, the remote location is a clue to the reader that the same value appears in other places in the code, which may also be worth looking into. * **Causes verbosity**. The declaration of the constant adds a line. When the constant's name is longer than the value's, particularly if several such constants appear in one line, it may make it necessary to split one logical statement of the code across several lines. An increase in verbosity may be justified when there is some likelihood of confusion about the constant, or when there is a likelihood the constant may need to be changed, such as [reuse](https://en.wikipedia.org/wiki/Code%5Freuse "Code reuse") of a shuffling routine for other card games. It may equally be justified as an increase in expressiveness. * **Performance considerations**. It may be slower to process the expression `deckSize + 1` at run-time than the value "53". That being said, most modern compilers will use techniques like [constant folding](https://en.wikipedia.org/wiki/Constant%5Ffolding "Constant folding") and [loop optimization](https://en.wikipedia.org/wiki/Loop%5Foptimization "Loop optimization") to resolve the addition during compilation, so there is usually no or negligible speed penalty compared to using magic numbers in code. Especially the cost of debugging and the time needed trying to understand non-explanatory code must be held against the tiny calculation cost. ### Accepted use When a numeric literal lacks special meaning, then its use is not classified as magic, although what constitutes special is subjective. Examples of literals that are often not considered magic include: * Use of 0 and 1 as initial or incremental values in a [for loop](https://en.wikipedia.org/wiki/For%5Floop "For loop"), such as `for (int i = 0; i < max; i += 1)` * Use of 2 to check whether a number is even or odd, as in `isEven = (x % 2 == 0)`, where `%` is the [modulo](https://en.wikipedia.org/wiki/Modulo "Modulo") operator * Use of simple literals, e.g., in expressions such as `circumference = 2 * Math.PI * radius`, or for calculating the [discriminant](https://en.wikipedia.org/wiki/Discriminant "Discriminant") of a [quadratic equation](https://en.wikipedia.org/wiki/Quadratic%5Fequation "Quadratic equation") as `d = b^2 − 4*a*c` * Use of powers of 10 to convert metric values (e.g. between grams and kilograms) or to calculate percentage and [per mille](https://en.wikipedia.org/wiki/Per%5Fmille "Per mille") values * Exponents in expressions such as `(f(x) ** 2 + f(y) ** 2) ** 0.5` for f ( x ) 2 + f ( y ) 2 {\\displaystyle {\\sqrt {f(x)^{2}+f(y)^{2}}}} * The literals 1 and 0 are sometimes used to represent the [Boolean](https://en.wikipedia.org/wiki/Boolean%5Fdata%5Ftype "Boolean data type") values true and false. Arguably, assigning these values to names such as TRUE and FALSE might be better. * In C and C++, 0 is often used to mean [null pointer](https://en.wikipedia.org/wiki/Null%5Fpointer "Null pointer") even though the C standard library defines a macro `NULL` and modern C++ includes a keyword `nullptr`. ## Format indicator ### Origin Format indicators were first used in early [Version 7 Unix](https://en.wikipedia.org/wiki/Version%5F7%5FUnix "Version 7 Unix") source code. [Unix](https://en.wikipedia.org/wiki/Unix "Unix") was ported to one of the first [DEC](https://en.wikipedia.org/wiki/Digital%5FEquipment%5FCorporation "Digital Equipment Corporation") [PDP-11](https://en.wikipedia.org/wiki/PDP-11 "PDP-11")/20s, which did not have [memory protection](https://en.wikipedia.org/wiki/Memory%5Fprotection "Memory protection"). So early versions of Unix used the [relocatable memory reference](https://en.wikipedia.org/wiki/Position-independent%5Fcode "Position-independent code") model. Pre-[Sixth Edition Unix](https://en.wikipedia.org/wiki/Sixth%5FEdition%5FUnix "Sixth Edition Unix") versions read an executable file into [memory](https://en.wikipedia.org/wiki/Magnetic-core%5Fmemory "Magnetic-core memory") and jumped to the first low memory address of the program, [relative address](https://en.wikipedia.org/wiki/Relative%5Faddress "Relative address") zero. With the development of [paged](https://en.wikipedia.org/wiki/Memory%5Fpage "Memory page") versions of Unix, a [header](https://en.wikipedia.org/wiki/Header%5F%28computing%29 "Header (computing)") was created to describe the [executable image](https://en.wikipedia.org/wiki/Executable "Executable") components. Also, a [branch instruction](https://en.wikipedia.org/wiki/Branch%5Finstruction "Branch instruction") was inserted as the first word of the header to skip the header and start the program. In this way a program could be run in the older relocatable memory reference (regular) mode or in paged mode. As more executable formats were developed, new constants were added by incrementing the branch [offset](https://en.wikipedia.org/wiki/Offset%5F%28computer%5Fscience%29 "Offset (computer science)"). In the [Sixth Edition](https://en.wikipedia.org/wiki/Version%5F6%5FUnix "Version 6 Unix") [source code](https://en.wikipedia.org/wiki/Lions%27%5FCommentary%5Fon%5FUNIX%5F6th%5FEdition,%5Fwith%5FSource%5FCode "Lions' Commentary on UNIX 6th Edition, with Source Code") of the Unix program loader, the exec() function read the executable ([binary](https://en.wikipedia.org/wiki/Binary%5Fnumeral%5Fsystem "Binary numeral system")) image from the file system. The first 8 [bytes](https://en.wikipedia.org/wiki/Byte "Byte") of the file was a [header](https://en.wikipedia.org/wiki/Header%5F%28computing%29 "Header (computing)") containing the sizes of the program (text) and initialized (global) data areas. Also, the first 16-bit word of the header was compared to two [constants](https://en.wikipedia.org/wiki/Constant%5F%28programming%29 "Constant (programming)") to determine if the [executable image](https://en.wikipedia.org/wiki/Executable "Executable") contained [relocatable memory references](https://en.wikipedia.org/wiki/Position-independent%5Fcode "Position-independent code") (normal), the newly implemented [paged](https://en.wikipedia.org/wiki/Memory%5Fpage "Memory page") read-only executable image, or the separated instruction and data paged image. There was no mention of the dual role of the header constant, but the high order byte of the constant was, in fact, the [operation code](https://en.wikipedia.org/wiki/Operation%5Fcode "Operation code") for the PDP-11 branch instruction ([octal](https://en.wikipedia.org/wiki/Octal "Octal") 000407 or [hex](https://en.wikipedia.org/wiki/Hexadecimal "Hexadecimal") 0107). Adding seven to the program counter showed that if this constant was executed, it would branch the Unix exec() service over the executable image eight byte header and start the program. Since the Sixth and Seventh Editions of Unix employed paging code, the dual role of the header constant was hidden. That is, the exec() service read the executable file header ([meta](https://en.wikipedia.org/wiki/Meta%5F%28prefix%29 "Meta (prefix)")) data into a [kernel space](https://en.wikipedia.org/wiki/Kernel%5Fspace "Kernel space") buffer, but read the executable image into [user space](https://en.wikipedia.org/wiki/User%5Fspace "User space"), thereby not using the constant's branching feature. Magic number creation was implemented in the Unix [linker](https://en.wikipedia.org/wiki/Linker%5F%28computing%29 "Linker (computing)") and [loader](https://en.wikipedia.org/wiki/Loader%5F%28computing%29 "Loader (computing)") and magic number branching was probably still used in the suite of [stand-alone](https://en.wikipedia.org/wiki/Standalone%5Fprogram "Standalone program") [diagnostic programs](https://en.wikipedia.org/wiki/Diagnostic%5Fprogram "Diagnostic program") that came with the Sixth and Seventh Editions. Thus, the header constant did provide an illusion and met the criteria for [magic](https://en.wikipedia.org/wiki/Magic%5F%28programming%29 "Magic (programming)"). In Version Seven Unix, the header constant was not tested directly, but assigned to a variable labeled **ux\_mag** and subsequently referred to as the **magic number**. Probably because of its uniqueness, the term **magic number** came to mean executable format type, then expanded to mean file system type, and expanded again to mean any type of file. ### In files Magic numbers are common in programs across many operating systems. Magic numbers implement [strongly typed](https://en.wikipedia.org/wiki/Strongly%5Ftyped "Strongly typed") data and are a form of [in-band signaling](https://en.wikipedia.org/wiki/In-band%5Fsignaling "In-band signaling") to the controlling program that reads the data type(s) at program run-time. Many files have such constants that identify the contained data. Detecting such constants in files is a simple and effective way of distinguishing between many [file formats](https://en.wikipedia.org/wiki/File%5Fformat "File format") and can yield further run-time [information](https://en.wikipedia.org/wiki/Information "Information"). Examples * [Compiled](https://en.wikipedia.org/wiki/Compiler "Compiler") [Java class files](https://en.wikipedia.org/wiki/Java%5Fclass%5Ffile "Java class file") ([bytecode](https://en.wikipedia.org/wiki/Java%5Fbytecode "Java bytecode")) and [Mach-O](https://en.wikipedia.org/wiki/Mach%5F%28kernel%29 "Mach (kernel)") binaries start with hex `CA FE BA BE`. When compressed with [Pack200](https://en.wikipedia.org/wiki/Pack200 "Pack200") the bytes are changed to `CA FE D0 0D`. * [GIF](https://en.wikipedia.org/wiki/GIF "GIF") image files have the [ASCII](https://en.wikipedia.org/wiki/ASCII "ASCII") code for "GIF89a" (`47 49 46 38 39 61`) or "GIF87a" (`47 49 46 38 37 61`) * [JPEG](https://en.wikipedia.org/wiki/JPEG "JPEG") image files begin with `FF D8` and end with `FF D9`. JPEG/[JFIF](https://en.wikipedia.org/wiki/JFIF "JFIF") files contain the [null terminated string](https://en.wikipedia.org/wiki/Null-terminated%5Fstring "Null-terminated string") "JFIF" (`4A 46 49 46 00`). JPEG/[Exif](https://en.wikipedia.org/wiki/Exif "Exif") files contain the [null terminated string](https://en.wikipedia.org/wiki/Null-terminated%5Fstring "Null-terminated string") "Exif" (`45 78 69 66 00`), followed by more [metadata](https://en.wikipedia.org/wiki/Metadata%5F%28computing%29 "Metadata (computing)") about the file. * [PNG](https://en.wikipedia.org/wiki/PNG "PNG") image files begin with an 8-[byte](https://en.wikipedia.org/wiki/Byte "Byte") signature which identifies the file as a PNG file and allows detection of common file transfer problems: "\\211PNG\\r\\n\\032\\n" (`89 50 4E 47 0D 0A 1A 0A`). That signature contains various [newline](https://en.wikipedia.org/wiki/Newline "Newline") characters to permit detecting unwarranted automated newline conversions, such as transferring the file using [FTP](https://en.wikipedia.org/wiki/File%5FTransfer%5FProtocol "File Transfer Protocol") with the _ASCII_ [transfer mode](https://en.wikipedia.org/wiki/File%5FTransfer%5FProtocol#Protocol%5Foverview "File Transfer Protocol") instead of the _binary_ mode. * Standard [MIDI](https://en.wikipedia.org/wiki/MIDI "MIDI") audio files have the [ASCII](https://en.wikipedia.org/wiki/ASCII "ASCII") code for "MThd" (**M**IDI **T**rack **h**ea**d**er, `4D 54 68 64`) followed by more metadata. * [Unix](https://en.wikipedia.org/wiki/Unix "Unix") or [Linux](https://en.wikipedia.org/wiki/Linux "Linux") scripts may start with a [shebang](https://en.wikipedia.org/wiki/Shebang%5F%28Unix%29 "Shebang (Unix)") ("#!", `23 21`) followed by the path to an [interpreter](https://en.wikipedia.org/wiki/Interpreter%5Fdirective "Interpreter directive"), if the interpreter is likely to be different from the one from which the script was invoked. * [ELF](https://en.wikipedia.org/wiki/Executable%5Fand%5FLinkable%5FFormat "Executable and Linkable Format") executables start with the byte `7F` followed by "ELF" (`7F 45 4C 46`). * [PostScript](https://en.wikipedia.org/wiki/PostScript "PostScript") files and programs start with "%!" (`25 21`). * [PDF](https://en.wikipedia.org/wiki/PDF "PDF") files start with "%PDF" (hex `25 50 44 46`). * [DOS MZ executable](https://en.wikipedia.org/wiki/DOS%5FMZ%5Fexecutable "DOS MZ executable") files and the [EXE stub](https://en.wikipedia.org/wiki/EXE#Other "EXE") of the [Microsoft Windows](https://en.wikipedia.org/wiki/Microsoft%5FWindows "Microsoft Windows") [PE](https://en.wikipedia.org/wiki/Portable%5FExecutable "Portable Executable") (Portable Executable) files start with the characters "MZ" (`4D 5A`), the initials of the designer of the file format, [Mark Zbikowski](https://en.wikipedia.org/wiki/Mark%5FZbikowski "Mark Zbikowski"). The definition allows the uncommon "ZM" (`5A 4D`) as well for dosZMXP, a non-PE EXE. * The [Berkeley Fast File System](https://en.wikipedia.org/wiki/Berkeley%5FFast%5FFile%5FSystem "Berkeley Fast File System") superblock format is identified as either `19 54 01 19` or `01 19 54` depending on version; both represent the birthday of the author, [Marshall Kirk McKusick](https://en.wikipedia.org/wiki/Marshall%5FKirk%5FMcKusick "Marshall Kirk McKusick"). * The [Master Boot Record](https://en.wikipedia.org/wiki/Master%5FBoot%5FRecord "Master Boot Record") of bootable storage devices on almost all [IA-32](https://en.wikipedia.org/wiki/IA-32 "IA-32") [IBM PC compatibles](https://en.wikipedia.org/wiki/IBM%5FPC%5Fcompatible "IBM PC compatible") has a code of `55 AA` as its last two bytes. * Executables for the [Game Boy](https://en.wikipedia.org/wiki/Game%5FBoy "Game Boy") and [Game Boy Advance](https://en.wikipedia.org/wiki/Game%5FBoy%5FAdvance "Game Boy Advance") handheld video game systems have a 48-byte or 156-byte magic number, respectively, at a fixed spot in the header. This magic number encodes a bitmap of the [Nintendo](https://en.wikipedia.org/wiki/Nintendo "Nintendo") logo. * [Amiga](https://en.wikipedia.org/wiki/Amiga "Amiga") software executable [Hunk](https://en.wikipedia.org/wiki/Amiga%5FHunk "Amiga Hunk") files running on Amiga classic [68000](https://en.wikipedia.org/wiki/68000 "68000") machines all started with the hexadecimal number $000003f3, nicknamed the "Magic Cookie." * In the Amiga, the only absolute address in the system is hex $0000 0004 (memory location 4), which contains the start location called SysBase, a pointer to exec.library, the so-called [kernel](https://en.wikipedia.org/wiki/Kernel%5F%28operating%5Fsystem%29 "Kernel (operating system)") of Amiga. * [PEF](https://en.wikipedia.org/wiki/Preferred%5FExecutable%5FFormat "Preferred Executable Format") files, used by the [classic Mac OS](https://en.wikipedia.org/wiki/Classic%5FMac%5FOS "Classic Mac OS") and [BeOS](https://en.wikipedia.org/wiki/BeOS "BeOS") for [PowerPC](https://en.wikipedia.org/wiki/PowerPC "PowerPC") executables, contain the [ASCII](https://en.wikipedia.org/wiki/ASCII "ASCII") code for "Joy!" (`4A 6F 79 21`) as a prefix. * [TIFF](https://en.wikipedia.org/wiki/TIFF "TIFF") files begin with either "II" or "MM" followed by [42](https://en.wikipedia.org/wiki/Answer%5Fto%5FLife,%5Fthe%5FUniverse,%5Fand%5FEverything "Answer to Life, the Universe, and Everything") as a two-byte integer in little or big [endian](https://en.wikipedia.org/wiki/Endianness "Endianness") byte ordering. "II" is for Intel, which uses [little endian](https://en.wikipedia.org/wiki/Endianness "Endianness") byte ordering, so the magic number is `49 49 2A 00`. "MM" is for Motorola, which uses [big endian](https://en.wikipedia.org/wiki/Endianness "Endianness") byte ordering, so the magic number is `4D 4D 00 2A`. * [Unicode](https://en.wikipedia.org/wiki/Unicode "Unicode") text files encoded in [UTF-16](https://en.wikipedia.org/wiki/UTF-16 "UTF-16") often start with the [Byte Order Mark](https://en.wikipedia.org/wiki/Byte%5FOrder%5FMark "Byte Order Mark") to detect [endianness](https://en.wikipedia.org/wiki/Endianness "Endianness") (`FE FF` for big endian and `FF FE` for little endian). And on [Microsoft Windows](https://en.wikipedia.org/wiki/Microsoft%5FWindows "Microsoft Windows"), [UTF-8](https://en.wikipedia.org/wiki/UTF-8 "UTF-8") text files often start with the UTF-8 encoding of the same character, `EF BB BF`. * [LLVM](https://en.wikipedia.org/wiki/LLVM "LLVM") Bitcode files start with "BC" (`42 43`). * [WAD](https://en.wikipedia.org/wiki/Doom%5FWAD "Doom WAD") files start with "IWAD" or "PWAD" (for _[Doom](https://en.wikipedia.org/wiki/Doom%5F%281993%5Fvideo%5Fgame%29 "Doom (1993 video game)")_), "WAD2" (for _[Quake](https://en.wikipedia.org/wiki/Quake%5F%28video%5Fgame%29 "Quake (video game)")_) and "WAD3" (for _[Half-Life](https://en.wikipedia.org/wiki/Half-Life%5F%28video%5Fgame%29 "Half-Life (video game)")_). * Microsoft [Compound File Binary Format](https://en.wikipedia.org/wiki/Compound%5FFile%5FBinary%5FFormat "Compound File Binary Format") (mostly known as one of the older formats of [Microsoft Office](https://en.wikipedia.org/wiki/Microsoft%5FOffice "Microsoft Office") documents) files start with `D0 CF 11 E0`, which is visually suggestive of the word "DOCFILE0". * Headers in [ZIP](https://en.wikipedia.org/wiki/ZIP%5F%28file%5Fformat%29 "ZIP (file format)") files often show up in text editors as "PK♥♦" (`50 4B 03 04`), where "PK" are the initials of [Phil Katz](https://en.wikipedia.org/wiki/Phil%5FKatz "Phil Katz"), author of [DOS](https://en.wikipedia.org/wiki/DOS "DOS") compression utility [PKZIP](https://en.wikipedia.org/wiki/PKZIP "PKZIP"). * Headers in [7z](https://en.wikipedia.org/wiki/7z "7z") files begin with "7z" (full magic number: `37 7A BC AF 27 1C`). Detection The Unix utility program `[file](https://en.wikipedia.org/wiki/File%5F%28command%29 "File (command)")` can read and interpret magic numbers from files, and the file which is used to parse the information is called _magic_. The Windows utility TrID has a similar purpose. ### In protocols Examples * The [OSCAR protocol](https://en.wikipedia.org/wiki/OSCAR%5Fprotocol "OSCAR protocol"), used in [AIM](https://en.wikipedia.org/wiki/AOL%5FInstant%5FMessenger "AOL Instant Messenger")/[ICQ](https://en.wikipedia.org/wiki/ICQ "ICQ"), prefixes requests with `2A`. * In the [RFB protocol](https://en.wikipedia.org/wiki/RFB%5Fprotocol "RFB protocol") used by [VNC](https://en.wikipedia.org/wiki/VNC "VNC"), a client starts its conversation with a server by sending "RFB" (`52 46 42`, for "Remote Frame Buffer") followed by the client's protocol version number. * In the [SMB](https://en.wikipedia.org/wiki/Server%5FMessage%5FBlock "Server Message Block") protocol used by Microsoft Windows, each SMB request or server reply begins with `FF 53 4D 42`, or `\xFFSMB` at the start of the SMB request. * In the [MSRPC](https://en.wikipedia.org/wiki/MSRPC "MSRPC") protocol used by Microsoft Windows, each TCP-based request begins with `05` at the start of the request (representing Microsoft DCE/RPC Version 5), followed immediately by a `00` or `01` for the minor version. In UDP-based MSRPC requests the first byte is always `04`. * In [COM](https://en.wikipedia.org/wiki/Component%5FObject%5FModel "Component Object Model") and [DCOM](https://en.wikipedia.org/wiki/Distributed%5FComponent%5FObject%5FModel "Distributed Component Object Model") marshalled interfaces, called [OBJREFs](https://en.wikipedia.org/wiki/OBJREF "OBJREF"), always start with the byte sequence "MEOW" (`4D 45 4F 57`). Debugging extensions (used for DCOM channel hooking) are prefaced with the byte sequence "MARB" (`4D 41 52 42`). * Unencrypted [BitTorrent tracker](https://en.wikipedia.org/wiki/BitTorrent%5Ftracker "BitTorrent tracker") requests begin with a single byte containing the value `19` representing the header length, followed immediately by the phrase "BitTorrent protocol" at byte position 1. * [eDonkey2000](https://en.wikipedia.org/wiki/EDonkey2000 "EDonkey2000")/[eMule](https://en.wikipedia.org/wiki/EMule "EMule") traffic begins with a single byte representing the client version. Currently `E3` represents an eDonkey client, `C5` represents eMule, and `D4` represents compressed eMule. * The first 4 bytes of a block in the [Bitcoin](https://en.wikipedia.org/wiki/Bitcoin "Bitcoin") Blockchain contains a magic number which serves as the network identifier. The value is `D9 B4 BE F9`, which indicates the main network, while `DA B5 BF FA` indicates the testnet. * [SSL](https://en.wikipedia.org/wiki/Secure%5FSockets%5FLayer "Secure Sockets Layer") transactions always begin with a "client hello" message. The record encapsulation scheme used to prefix all SSL packets consists of two- and three- byte header forms. Typically an SSL version 2 client hello message is prefixed with an `80` and an SSLv3 server response to a client hello begins with `16` (though this may vary). * [DHCP](https://en.wikipedia.org/wiki/DHCP "DHCP") packets use a "magic cookie" value of `63 82 53 63` at the start of the options section of the packet. This value is included in all DHCP packet types. * [HTTP/2](https://en.wikipedia.org/wiki/HTTP/2 "HTTP/2") connections start with the 24-character string `PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n`. It is designed to avoid the processing of frames by servers and intermediaries which support earlier versions of HTTP but not 2.0. * The [WebSocket opening handshake](https://en.wikipedia.org/wiki/WebSocket#Opening%5Fhandshake "WebSocket") uses a string containing the [UUIDv4](https://en.wikipedia.org/wiki/UUIDv4 "UUIDv4") `258EAFA5-E914-47DA-95CA-C5AB0DC85B11`. ### In interfaces Magic numbers are common in [API functions](https://en.wikipedia.org/wiki/API%5Ffunction "API function") and [interfaces](https://en.wikipedia.org/wiki/Interface%5F%28computing%29 "Interface (computing)") across many [operating systems](https://en.wikipedia.org/wiki/Operating%5Fsystem "Operating system"), including [DOS](https://en.wikipedia.org/wiki/DOS "DOS"), [Windows](https://en.wikipedia.org/wiki/Windows "Windows") and [NetWare](https://en.wikipedia.org/wiki/NetWare "NetWare"): Examples * [IBM PC](https://en.wikipedia.org/wiki/IBM%5FPC "IBM PC")\-compatible [BIOSes](https://en.wikipedia.org/wiki/BIOS "BIOS") use magic values `00 00` and `12 34` to decide if the system should count up memory or not on reboot, thereby performing a cold or a warm boot. Theses values are also used by [EMM386](https://en.wikipedia.org/wiki/EMM386 "EMM386") memory managers intercepting boot requests. BIOSes also use magic values `55 AA` to determine if a disk is bootable. * The [MS-DOS](https://en.wikipedia.org/wiki/MS-DOS "MS-DOS") disk cache [SMARTDRV](https://en.wikipedia.org/wiki/SMARTDRV "SMARTDRV") (codenamed "Bambi") uses magic values `BA BE` and `EB AB` in API functions. * Many [DR-DOS](https://en.wikipedia.org/wiki/DR-DOS "DR-DOS"), [Novell DOS](https://en.wikipedia.org/wiki/Novell%5FDOS "Novell DOS") and [OpenDOS](https://en.wikipedia.org/wiki/OpenDOS "OpenDOS") drivers developed in the former _European Development Centre_ in the UK use the value `0E DC` as magic token when invoking or providing additional functionality sitting on top of the (emulated) standard DOS functions, NWCACHE being one example. ### Other uses Examples * The default [MAC address](https://en.wikipedia.org/wiki/MAC%5Faddress "MAC address") on Texas Instruments [SOCs](https://en.wikipedia.org/wiki/System%5Fon%5Fa%5Fchip "System on a chip") is `DE:AD:BE:EF:00:00`. ## GUID It is possible to create or alter [globally unique identifiers](https://en.wikipedia.org/wiki/Globally%5Funique%5Fidentifier "Globally unique identifier") (GUIDs) so that they are memorable, but this is highly discouraged as it compromises their strength as near-unique identifiers. The specifications for generating GUIDs and UUIDs are quite complex, which is what leads to them being virtually unique, if properly implemented. Microsoft Windows product ID numbers for [Microsoft Office](https://en.wikipedia.org/wiki/Microsoft%5FOffice "Microsoft Office") products sometimes end with `0000-0000-0000000FF1CE` ("OFFICE"), such as `90160000-008C-0000-0000-0000000FF1CE`, the product ID for the "Office 16 Click-to-Run Extensibility Component". Java uses several GUIDs starting with `CAFEEFAC`. In the [GUID Partition Table](https://en.wikipedia.org/wiki/GUID%5FPartition%5FTable "GUID Partition Table") of the GPT partitioning scheme, [BIOS Boot partitions](https://en.wikipedia.org/wiki/BIOS%5FBoot%5Fpartition "BIOS Boot partition") use the special GUID `21686148-6449-6E6F-744E-656564454649` which does not follow the GUID definition; instead, it is formed by using the [ASCII](https://en.wikipedia.org/wiki/ASCII "ASCII") codes for the string `Hah!IdontNeedEFI` partially in [little endian](https://en.wikipedia.org/wiki/Little%5Fendian "Little endian") order. ## Debug value **Magic debug values** are specific values written to [memory](https://en.wikipedia.org/wiki/Random-access%5Fmemory "Random-access memory") during [allocation](https://en.wikipedia.org/wiki/Memory%5Fallocation "Memory allocation") or deallocation, so that it will later be possible to tell whether or not they have become corrupted, and to make it obvious when values taken from uninitialized memory are being used. Memory is usually viewed in hexadecimal, so memorable repeating or [hexspeak](https://en.wikipedia.org/wiki/Hexspeak "Hexspeak") values are common. Numerically odd values may be preferred so that processors without byte addressing will fault when attempting to use them as pointers (which must fall at even addresses). Values should be chosen that are away from likely addresses (the program code, static data, heap data, or the stack). Similarly, they may be chosen so that they are not valid codes in the instruction set for the given architecture. Since it is very unlikely, although possible, that a 32-bit integer would take this specific value, the appearance of such a number in a [debugger](https://en.wikipedia.org/wiki/Debugger "Debugger") or [memory dump](https://en.wikipedia.org/wiki/Memory%5Fdump "Memory dump") most likely indicates an error such as a buffer overflow or an [uninitialized variable](https://en.wikipedia.org/wiki/Uninitialized%5Fvariable "Uninitialized variable"). Famous and common examples include: | Code | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | 00008123 | Used in MS Visual C++. Deleted pointers are set to this value, so they throw an exception, when they are used after; it is a more recognizable alias for the zero address. It is activated with the Security Development Lifecycle (/sdl) option. | | ..FACADE | _"Facade"_, Used by a number of [RTOSes](https://en.wikipedia.org/wiki/Real-time%5Foperating%5Fsystem "Real-time operating system"). | | 1BADB002 | _"1 bad boot"_, [Multiboot](https://en.wikipedia.org/wiki/Multiboot%5FSpecification "Multiboot Specification") header magic number. | | 8BADF00D | _"Ate bad food"_, Indicates that an [Apple](https://en.wikipedia.org/wiki/Apple%5FInc. "Apple Inc.") [iOS](https://en.wikipedia.org/wiki/IOS "IOS") application has been terminated because a watchdog timeout occurred. | | A5A5A5A5 | Used in embedded development because the alternating bit pattern (1010 0101) creates an easily recognized pattern on [oscilloscopes](https://en.wikipedia.org/wiki/Oscilloscope "Oscilloscope") and [logic analyzers](https://en.wikipedia.org/wiki/Logic%5Fanalyzer "Logic analyzer"). | | A5 | Used in [FreeBSD](https://en.wikipedia.org/wiki/FreeBSD "FreeBSD")'s PHK [malloc(3)](https://en.wikipedia.org/wiki/Malloc "Malloc") for debugging when /etc/malloc.conf is symlinked to "-J" to initialize all newly allocated memory as this value is not a NULL pointer or ASCII NUL character. | | ABABABAB | Used by [Microsoft](https://en.wikipedia.org/wiki/Microsoft "Microsoft")'s debug HeapAlloc() to mark "no man's land" [guard bytes](https://en.wikipedia.org/wiki/Guard%5Fbyte "Guard byte") after allocated heap memory. | | ABADBABE | _"A bad babe"_, Used by [Apple](https://en.wikipedia.org/wiki/Apple%5FInc. "Apple Inc.") as the "Boot Zero Block" magic number. | | ABBABABE | _"[ABBA](https://en.wikipedia.org/wiki/ABBA "ABBA") babe"_, used by _[Driver: Parallel Lines](https://en.wikipedia.org/wiki/Driver:%5FParallel%5FLines "Driver: Parallel Lines")_ memory heap. | | ABADCAFE | _"A bad cafe"_, Used to initialize all unallocated memory (Mungwall, [AmigaOS](https://en.wikipedia.org/wiki/AmigaOS "AmigaOS")). | | B16B00B5 | _"Big Boobs"_, Formerly required by [Microsoft](https://en.wikipedia.org/wiki/Microsoft "Microsoft")'s [Hyper-V](https://en.wikipedia.org/wiki/Hyper-V "Hyper-V") hypervisor to be used by Linux guests as the upper half of their "guest id". | | BAADF00D | _"Bad food"_, Used by [Microsoft](https://en.wikipedia.org/wiki/Microsoft "Microsoft")'s debug HeapAlloc() to mark uninitialized allocated heap memory. | | BAAAAAAD | _"Baaaaaad"_, Indicates that the [Apple](https://en.wikipedia.org/wiki/Apple%5FInc. "Apple Inc.") [iOS](https://en.wikipedia.org/wiki/IOS "IOS") log is a stackshot of the entire system, not a crash report. | | BAD22222 | _"Bad too repeatedly"_, Indicates that an [Apple](https://en.wikipedia.org/wiki/Apple%5FInc. "Apple Inc.") [iOS](https://en.wikipedia.org/wiki/IOS "IOS") VoIP application has been terminated because it resumed too frequently. | | BADBADBADBAD | _"Bad bad bad bad"_, [Burroughs Large Systems](https://en.wikipedia.org/wiki/Burroughs%5FLarge%5FSystems "Burroughs Large Systems") "uninitialized" memory (48-bit words). | | BADC0FFEE0DDF00D | _"Bad coffee odd food"_, Used on [IBM](https://en.wikipedia.org/wiki/IBM "IBM") [RS/6000](https://en.wikipedia.org/wiki/RS/6000 "RS/6000") 64-bit systems to indicate uninitialized CPU registers. | | BADDCAFE | _"Bad cafe"_, On [Sun Microsystems](https://en.wikipedia.org/wiki/Sun%5FMicrosystems "Sun Microsystems")' [Solaris](https://en.wikipedia.org/wiki/Solaris%5F%28operating%5Fsystem%29 "Solaris (operating system)"), marks uninitialized kernel memory (KMEM\_UNINITIALIZED\_PATTERN). | | BBADBEEF | _"Bad beef"_, Used in [WebKit](https://en.wikipedia.org/wiki/WebKit "WebKit"), for particularly unrecoverable errors. | | BEBEBEBE | Used by [AddressSanitizer](https://en.wikipedia.org/wiki/AddressSanitizer "AddressSanitizer") to fill allocated but not initialized memory. | | BEEFCACE | _"Beef cake"_, Used by [Microsoft .NET](https://en.wikipedia.org/wiki/Microsoft%5F.NET "Microsoft .NET") as a magic number in resource files. | | C00010FF | _"Cool off"_, Indicates [Apple](https://en.wikipedia.org/wiki/Apple%5FInc. "Apple Inc.") [iOS](https://en.wikipedia.org/wiki/IOS "IOS") app was killed by the operating system in response to a thermal event. | | CAFEBABE | _"Cafe babe"_, Used by [Java](https://en.wikipedia.org/wiki/Java%5F%28programming%5Flanguage%29 "Java (programming language)") for class files. Used in multi-architecture [Mach-O](https://en.wikipedia.org/wiki/Mach-O "Mach-O") binaries. | | CAFED00D | _"Cafe dude"_, Used by [Java](https://en.wikipedia.org/wiki/Java%5F%28programming%5Flanguage%29 "Java (programming language)") for their [pack200](https://en.wikipedia.org/wiki/Pack200 "Pack200") compression. | | CAFEFEED | _"Cafe feed"_, Used by [Sun Microsystems](https://en.wikipedia.org/wiki/Sun%5FMicrosystems "Sun Microsystems")' [Solaris](https://en.wikipedia.org/wiki/Solaris%5F%28operating%5Fsystem%29 "Solaris (operating system)") debugging kernel to mark kmemfree() memory. | | CCCCCCCC | Used by [Microsoft](https://en.wikipedia.org/wiki/Microsoft "Microsoft")'s C++ debugging runtime library and many DOS environments to mark uninitialized [stack](https://en.wikipedia.org/wiki/Stack-based%5Fmemory%5Fallocation "Stack-based memory allocation") memory. CC is the opcode of the [INT 3](https://en.wikipedia.org/wiki/INT%5F3 "INT 3") debug breakpoint interrupt on x86 processors. | | CDCDCDCD | Used by [Microsoft](https://en.wikipedia.org/wiki/Microsoft "Microsoft")'s C/C++ debug malloc() function to mark uninitialized heap memory, usually returned from HeapAlloc. | | 0D15EA5E | _"Zero Disease"_, Used as a flag to indicate regular boot on the [GameCube](https://en.wikipedia.org/wiki/GameCube "GameCube") and [Wii](https://en.wikipedia.org/wiki/Wii "Wii") consoles. | | DDDDDDDD | Used by MicroQuill's SmartHeap and Microsoft's C/C++ debug free() function to mark freed heap memory. | | DEAD10CC | _"Dead lock"_, Indicates that an [Apple](https://en.wikipedia.org/wiki/Apple%5FInc. "Apple Inc.") [iOS](https://en.wikipedia.org/wiki/IOS "IOS") application has been terminated because it held on to a system resource while running in the background. | | DEADBABE | _"Dead babe"_, Used at the start of [Silicon Graphics](https://en.wikipedia.org/wiki/Silicon%5FGraphics "Silicon Graphics")' [IRIX](https://en.wikipedia.org/wiki/IRIX "IRIX") arena files. | | DEADBEEF | _"Dead beef"_, Famously used on [IBM](https://en.wikipedia.org/wiki/IBM "IBM") systems such as the [RS/6000](https://en.wikipedia.org/wiki/RS/6000 "RS/6000"), also used in the [classic Mac OS](https://en.wikipedia.org/wiki/Classic%5FMac%5FOS "Classic Mac OS") [operating systems](https://en.wikipedia.org/wiki/Operating%5Fsystem "Operating system"), [OPENSTEP Enterprise](https://en.wikipedia.org/wiki/OPENSTEP%5FEnterprise "OPENSTEP Enterprise"), and the [Commodore](https://en.wikipedia.org/wiki/Commodore%5FInternational "Commodore International") [Amiga](https://en.wikipedia.org/wiki/Amiga "Amiga"). On [Sun Microsystems](https://en.wikipedia.org/wiki/Sun%5FMicrosystems "Sun Microsystems")' [Solaris](https://en.wikipedia.org/wiki/Solaris%5F%28operating%5Fsystem%29 "Solaris (operating system)"), marks freed kernel memory (KMEM\_FREE\_PATTERN). | | DEADCAFE | _"Dead cafe"_, Used by [Microsoft .NET](https://en.wikipedia.org/wiki/Microsoft%5F.NET "Microsoft .NET") as an error number in [DLLs](https://en.wikipedia.org/wiki/Dynamic-link%5Flibrary "Dynamic-link library"). | | DEADC0DE | _"Dead code"_, Used as a marker in [OpenWRT](https://en.wikipedia.org/wiki/OpenWRT "OpenWRT") firmware to signify the beginning of the to-be created jffs2 file system at the end of the static firmware. | | DEADFA11 | _"Dead fail"_, Indicates that an [Apple](https://en.wikipedia.org/wiki/Apple%5FInc. "Apple Inc.") [iOS](https://en.wikipedia.org/wiki/IOS "IOS") application has been force quit by the user. | | DEADF00D | _"Dead food"_, Used by Mungwall on the [Commodore](https://en.wikipedia.org/wiki/Commodore%5FInternational "Commodore International") [Amiga](https://en.wikipedia.org/wiki/Amiga "Amiga") to mark allocated but uninitialized memory. | | DEFEC8ED | _"Defecated"_, Used for [OpenSolaris](https://en.wikipedia.org/wiki/OpenSolaris "OpenSolaris") [core dumps](https://en.wikipedia.org/wiki/Core%5Fdump "Core dump"). | | DEADDEAD | _"Dead Dead"_ indicates that the user deliberately initiated a crash dump from either the kernel debugger or the keyboard under Microsoft Windows. | | D00D2BAD | _"Dude, Too Bad",_ Used by Safari crashes on macOS Big Sur. | | D00DF33D | _"Dude feed",_ Used by the [devicetree](https://en.wikipedia.org/wiki/Devicetree "Devicetree") to mark the start of headers. | | EBEBEBEB | From MicroQuill's SmartHeap. | | FADEDEAD | _"Fade dead"_, Comes at the end to identify every [AppleScript](https://en.wikipedia.org/wiki/AppleScript "AppleScript") script. | | FDFDFDFD | Used by [Microsoft](https://en.wikipedia.org/wiki/Microsoft "Microsoft")'s C/C++ debug malloc() function to mark "no man's land" [guard bytes](https://en.wikipedia.org/wiki/Guard%5Fbyte "Guard byte") before and after allocated heap memory, and some debug Secure [C-Runtime](https://en.wikipedia.org/wiki/C%5Fstandard%5Flibrary "C standard library") functions implemented by Microsoft (e.g. strncat\_s). | | FEE1DEAD | _"Feel dead"_, Used by [Linux](https://en.wikipedia.org/wiki/Linux "Linux") reboot() syscall. | | FEEDFACE | _"Feed face"_, Seen in [Mach-O](https://en.wikipedia.org/wiki/Mach-O "Mach-O") binaries on [Apple Inc.](https://en.wikipedia.org/wiki/Apple%5FInc. "Apple Inc.")'s Mac OSX platform. On [Sun Microsystems](https://en.wikipedia.org/wiki/Sun%5FMicrosystems "Sun Microsystems")' [Solaris](https://en.wikipedia.org/wiki/Solaris%5F%28operating%5Fsystem%29 "Solaris (operating system)"), marks the red zone (KMEM\_REDZONE\_PATTERN). Used by [VLC player](https://en.wikipedia.org/wiki/VLC%5Fplayer "VLC player") and some [IP cameras](https://en.wikipedia.org/wiki/IP%5Fcamera "IP camera") in [RTP](https://en.wikipedia.org/wiki/Real-time%5FTransport%5FProtocol "Real-time Transport Protocol")/[RTCP](https://en.wikipedia.org/wiki/RTCP "RTCP") protocol, VLC player sends four bytes in the order of the [endianness](https://en.wikipedia.org/wiki/Endianness "Endianness") of the system. Some IP cameras expect the player to send this magic number and do not start the stream if it is not received. | | FEEEFEEE | _"Fee fee"_, Used by [Microsoft](https://en.wikipedia.org/wiki/Microsoft "Microsoft")'s debug HeapFree() to mark freed heap memory. Some nearby internal bookkeeping values may have the high word set to FEEE as well. | Most of these are 32 [bits](https://en.wikipedia.org/wiki/Bit "Bit") long – the [word size](https://en.wikipedia.org/wiki/Word%5Fsize "Word size") of most 32-bit architecture computers. The prevalence of these values in Microsoft technology is no coincidence; they are discussed in detail in [Steve Maguire](https://en.wikipedia.org/wiki/Steve%5FMaguire "Steve Maguire")'s book _Writing Solid Code_ from [Microsoft Press](https://en.wikipedia.org/wiki/Microsoft%5FPress "Microsoft Press"). He gives a variety of criteria for these values, such as: * They should not be useful; that is, most algorithms that operate on them should be expected to do something unusual. Numbers like zero don't fit this criterion. * They should be easily recognized by the programmer as invalid values in the debugger. * On machines that don't have [byte alignment](https://en.wikipedia.org/wiki/Byte%5Falignment "Byte alignment"), they should be [odd numbers](https://en.wikipedia.org/wiki/Odd%5Fnumber "Odd number"), so that dereferencing them as addresses causes an exception. * They should cause an exception, or perhaps even a debugger break, if executed as code. Since they were often used to mark areas of memory that were essentially empty, some of these terms came to be used in phrases meaning "gone, aborted, flushed from memory"; e.g. "Your program is DEADBEEF".