SDB
application/octet-stream
Magic Bytes
Offset: 8
73 64 62 66
The SDB format, or Shim Database, is a proprietary binary container created and maintained by Microsoft for the Windows Application Compatibility Infrastructure. It is primarily used to store compatibility fixes, or "shims," which allow legacy software to function correctly on newer versions of the operating system. Although these files are passive data stores and generally safe, they have historically been leveraged by malware for persistence or to bypass operating system security features.
Validation Code
How to validate .sdb files in Python
Python
def is_sdb(file_path: str) -> bool:
"""
Check if file is a valid SDB by magic bytes.
Signature offset: 8 bytes
"""
signature = bytes([0x73, 0x64, 0x62, 0x66])
with open(file_path, "rb") as f:
f.seek(8)
return f.read(4) == signatureHow to validate .sdb files in Node.js
Node.js
function isSDB(buffer: Buffer): boolean {
// Signature offset: 8 bytes
const signature = Buffer.from([0x73, 0x64, 0x62, 0x66]);
if (buffer.length < 12) return false;
return buffer.subarray(8, 12).equals(signature);
}
Go
func IsSDB(data []byte) bool {
// Signature offset: 8 bytes
signature := []byte{0x73, 0x64, 0x62, 0x66}
if len(data) < 12 {
return false
}
return bytes.Equal(data[8:12], signature)
}API Endpoint
GET
/api/v1/sdb
curl https://filesignature.org/api/v1/sdb