How To Better Identify (Weaponized) File Formats With Ftguess

Philippe Lagadec opens with a guessing game: finding someone's nationality by asking questions or by checking a passport. He uses the comparison to argue that file identification should lean on the extension, since operating systems choose the application that opens a file based on it. A quick demo on Linux shows the same bytes opening in a text editor, a browser or a PDF viewer depending only on the file name.

The middle of the talk reviews common identification tools: libmagic-based file, TrID, YARA rules and Google's Magika. Libmagic matches binary signatures well but misses scripts, while Magika samples the start and end of a file and classifies it with a neural network. Examples include PDFs with leading junk bytes that fool both tools, a PDF with macros disguised as a Word document, and a signed MSI with an appended Java archive. He also shows Magika mistaking Base64 text for PowerShell, and padding a script with whitespace so Magika reports plain text.

In the final part he outlines an algorithm: check whether the extension is known, run a small parser for each candidate format, and grade confidence by whether content and extension agree, falling back to content tools otherwise. He presents FTGuess, his experimental prototype. His takeaways are to check both extension and content, and to keep original file names when handling suspicious samples.