Incomputer programming, amagic number is anumericliteral insource code that has a special, particular meaning that is less than clear to the reader. Also incomputing, but not limited to programming, the term is used for a number that identifies a particular concept but without additional knowledge its meaning is less than clear. For example, somefile formats are identified by an embedded magic number in thefile(seelist of file signatures). Also, a number that is relatively uniquely associated with a particular concept, such as auniversally unique identifier, might be classified as a magic number.
Amagic number ormagic constant, considered ananti-pattern, is using a numeric literal in source code that has a special meaning that is less than clear. This breaks one of the oldest rules of programming, dating back to theCOBOL,FORTRAN andPL/1 manuals of the 1960s.[1]
In the following code that computes a price after tax,1.05 is a magic number since the value encodes the sales tax rate, 5%, in a way that is less than obvious.
price_after_tax = 1.05 * price
The use of magic numbers in code obscures the developers' intent in choosing that number,[2] increases opportunities for subtle errors, and makes it more difficult for the program to be adapted and extended in the future.[3] As an example, it is difficult to tell whether every digit in3.14159265358979323846 is correctly typed, or if this constant forpi can betruncated to3.14159 without affecting the functionality of the program with its reduced precision. Replacing all significant magic numbers with namedconstants (also called explanatory variables) makes programs easier to read, understand and maintain.[4]
The example above can be improved by adding a descriptively named variable:
TAX = 0.05price_after_tax = (1.0 + TAX) * price
A good name can result in code that is more easily understood by a maintainer who is not the original author and even the original author after a period of time.[5] An example of an uninformatively named constant isint SIXTEEN = 16, whileint NUMBER_OF_BITS = 16 might be more useful.
Non-numeric data can have the same magical properties, and therefore, the same issues as magic numbers.[1] Thus, declaringconst string testUserName = "John" and usingtestUserName might be better than using the literal"John" directly.
For example, if it is required to randomly shuffle the values in an array representing a standard pack ofplaying cards, thispseudocode does the job using theFisher–Yates shuffle algorithm:
for ifrom 1to 52 j := i + randomInt(53 - i) - 1 a.swapEntries(i, j)
wherea is an array object, the functionrandomInt(x) chooses a random integer between 1 andx, inclusive, andswapEntries(i, j) swaps theith andjth entries in the array. In the preceding example,52 and53 are magic numbers, also not clearly related to each other. It is considered better programming style to write the following:
int deckSize:= 52for ifrom 1to deckSize j := i + randomInt(deckSize + 1 - i) - 1 a.swapEntries(i, j)
This is preferable for several reasons:
deckSize variable in the second example would be a simple, one-line change.dekSize" instead of "deckSize" would result in the compiler's warning thatdekSize is undeclared.deckSize into a parameter of that procedure, whereas the first example would require several changes.function shuffle (int deckSize)for ifrom 1to deckSize j := i + randomInt(deckSize + 1 - i) - 1 a.swapEntries(i, j)
Disadvantages are:
deckSize + 1 at run-time than the value "53". That being said, most modern compilers will use techniques likeconstant folding andloop optimization to resolve the addition during compilation, so there is usually no or negligible speed penalty compared to using magic numbers in code. Especially the cost of debugging and the time needed trying to understand non-explanatory code must be held against the tiny calculation cost.This sectionneeds additional citations forverification. Please helpimprove this article byadding citations to reliable sources in this section. Unsourced material may be challenged and removed.(March 2010) (Learn how and when to remove this message) |
When a numeric literal lacks special meaning, then its use is not classified as magic; although what constitutes special is subjective. Examples of literals that are often not considered magic include:
for(inti=0;i<max;i+=1)isEven = (x % 2 == 0), where% is themodulo operatorcircumference = 2 * Math.PI * radius,[1] or for calculating thediscriminant of aquadratic equation asd = b^2 − 4*a*c(f(x) ** 2 + f(y) ** 2) ** 0.5 forNULL and modern C++ includes a keywordnullptr.Format indicators were first used in earlyVersion 7 Unix source code.[citation needed]
Unix was ported to one of the firstDECPDP-11/20s, which did not havememory protection. So early versions of Unix used therelocatable memory reference model.[6] Pre-Sixth Edition Unix versions read an executable file intomemory and jumped to the first low memory address of the program,relative address zero. With the development ofpaged versions of Unix, aheader was created to describe theexecutable image components. Also, abranch instruction was inserted as the first word of the header to skip the header and start the program. In this way a program could be run in the older relocatable memory reference (regular) mode or in paged mode. As more executable formats were developed, new constants were added by incrementing the branchoffset.[7]
In theSixth Editionsource code of the Unix program loader, the exec() function read the executable (binary) image from the file system. The first 8bytes of the file was aheader containing the sizes of the program (text) and initialized (global) data areas. Also, the first 16-bit word of the header was compared to twoconstants to determine if theexecutable image containedrelocatable memory references (normal), the newly implementedpaged read-only executable image, or the separated instruction and data paged image.[8] There was no mention of the dual role of the header constant, but the high order byte of the constant was, in fact, theoperation code for the PDP-11 branch instruction (octal 000407 orhex 0107). Adding seven to the program counter showed that if this constant wasexecuted, it would branch the Unix exec() service over the executable image eight byte header and start the program.
Since the Sixth and Seventh Editions of Unix employed paging code, the dual role of the header constant was hidden. That is, the exec() service read the executable file header (meta) data into akernel space buffer, but read the executable image intouser space, thereby not using the constant's branching feature. Magic number creation was implemented in the Unixlinker andloader and magic number branching was probably still used in the suite ofstand-alonediagnostic programs that came with the Sixth and Seventh Editions. Thus, the header constant did provide an illusion and met the criteria formagic.
In Version Seven Unix, the header constant was not tested directly, but assigned to a variable labeledux_mag[9] and subsequently referred to as themagic number. Probably because of its uniqueness, the termmagic number came to mean executable format type, then expanded to mean file system type, and expanded again to mean any type of file.
Magic numbers are common in programs across many operating systems. Magic numbers implementstrongly typed data and are a form ofin-band signaling to the controlling program that reads the data type(s) at program run-time. Many files have such constants that identify the contained data. Detecting such constants in files is a simple and effective way of distinguishing between manyfile formats and can yield further run-timeinformation.
CA FE BA BE. When compressed withPack200 the bytes are changed toCA FE D0 0D.47 49 46 38 39 61) or "GIF87a" (47 49 46 38 37 61)FF D8 and end withFF D9. JPEG/JFIF files contain thenull terminated string "JFIF" (4A 46 49 46 00). JPEG/Exif files contain thenull terminated string "Exif" (45 78 69 66 00), followed by moremetadata about the file.89 50 4E 47 0D 0A 1A 0A). That signature contains variousnewline characters to permit detecting unwarranted automated newline conversions, such as transferring the file usingFTP with theASCIItransfer mode instead of thebinary mode.[10]4D 54 68 64) followed by more metadata.23 21) followed by the path to aninterpreter, if the interpreter is likely to be different from the one from which the script was invoked.7F followed by "ELF" (7F 45 4C 46).25 21).25 50 44 46).4D 5A), the initials of the designer of the file format,Mark Zbikowski. The definition allows the uncommon "ZM" (5A 4D) as well for dosZMXP, a non-PE EXE.[11]19 54 01 19 or01 19 54 depending on version; both represent the birthday of the author,Marshall Kirk McKusick.55 AA as its last two bytes.4A 6F 79 21) as a prefix.49 49 2A 00. "MM" is for Motorola, which usesbig endian byte ordering, so the magic number is4D 4D 00 2A.FE FF for big endian andFF FE for little endian). And onMicrosoft Windows,UTF-8 text files often start with the UTF-8 encoding of the same character,EF BB BF.42 43).D0 CF 11 E0, which is visually suggestive of the word "DOCFILE0".50 4B 03 04), where "PK" are the initials ofPhil Katz, author ofDOS compression utilityPKZIP.37 7A BC AF 27 1C).The Unix utility programfile can read and interpret magic numbers from files, and the file which is used to parse the information is calledmagic. The Windows utility TrID has a similar purpose.
2A.52 46 42, for "Remote Frame Buffer") followed by the client's protocol version number.FF 53 4D 42, or\xFFSMB at the start of the SMB request.05 at the start of the request (representing Microsoft DCE/RPC Version 5), followed immediately by a00 or01 for the minor version. In UDP-based MSRPC requests the first byte is always04.4D 45 4F 57). Debugging extensions (used for DCOM channel hooking) are prefaced with the byte sequence "MARB" (4D 41 52 42).19 representing the header length, followed immediately by the phrase "BitTorrent protocol" at byte position 1.E3 represents an eDonkey client,C5 represents eMule, andD4 represents compressed eMule.D9 B4 BE F9, which indicates the main network, whileDA B5 BF FA indicates the testnet.80 and an SSLv3 server response to a client hello begins with16 (though this may vary).63 82 53 63 at the start of the options section of the packet. This value is included in all DHCP packet types.PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n. It is designed to avoid the processing of frames by servers and intermediaries which support earlier versions of HTTP but not 2.0.258EAFA5-E914-47DA-95CA-C5AB0DC85B11.Magic numbers are common inAPI functions andinterfaces across manyoperating systems, includingDOS,Windows andNetWare:
00 00 and12 34 to decide if the system should count up memory or not on reboot, thereby performing a cold or a warm boot. Theses values are also used byEMM386 memory managers intercepting boot requests.[12] BIOSes also use magic values55 AA to determine if a disk is bootable.[13]BA BE andEB AB in API functions.[12]0E DC as magic token when invoking or providing additional functionality sitting on top of the (emulated) standard DOS functions, NWCACHE being one example.[12]DE:AD:BE:EF:00:00.[14]It is possible to create or alterglobally unique identifiers (GUIDs) so that they are memorable, but this is highly discouraged as it compromises their strength as near-unique identifiers.[15][16] The specifications for generating GUIDs and UUIDs are quite complex, which is what leads to them being virtually unique, if properly implemented.[17]
Microsoft Windows product ID numbers forMicrosoft Office products sometimes end with0000-0000-0000000FF1CE ("OFFICE"), such as90160000-008C-0000-0000-0000000FF1CE, the product ID for the "Office 16 Click-to-Run Extensibility Component".
Java uses several GUIDs starting withCAFEEFAC.[18]
In theGUID Partition Table of the GPT partitioning scheme,BIOS Boot partitions use the special GUID21686148-6449-6E6F-744E-656564454649[19] which does not follow the GUID definition; instead, it is formed by using theASCII codes for the stringHah!IdontNeedEFI partially inlittle endian order.[20]
Magic debug values are specific values written tomemory duringallocation or deallocation, so that it will later be possible to tell whether or not they have become corrupted, and to make it obvious when values taken from uninitialized memory are being used. Memory is usually viewed in hexadecimal, so memorable repeating orhexspeak values are common. Numerically odd values may be preferred so that processors without byte addressing will fault when attempting to use them as pointers (which must fall at even addresses). Values should be chosen that are away from likely addresses (the program code, static data, heap data, or the stack). Similarly, they may be chosen so that they are not valid codes in the instruction set for the given architecture.
Since it is very unlikely, although possible, that a 32-bit integer would take this specific value, the appearance of such a number in adebugger ormemory dump most likely indicates an error such as a buffer overflow or anuninitialized variable.
Famous and common examples include:
| Code | Description |
|---|---|
00008123 | Used in MS Visual C++. Deleted pointers are set to this value, so they throw an exception, when they are used after; it is a more recognizable alias for the zero address. It is activated with the Security Development Lifecycle (/sdl) option.[21] |
..FACADE | "Facade", Used by a number ofRTOSes. |
1BADB002 | "1 bad boot",Multiboot header magic number.[22] |
8BADF00D | "Ate bad food", Indicates that anAppleiOS application has been terminated because a watchdog timeout occurred.[23] |
A5A5A5A5 | Used in embedded development because the alternating bit pattern (1010 0101) creates an easily recognized pattern onoscilloscopes andlogic analyzers. |
A5 | Used inFreeBSD's PHKmalloc(3) for debugging when /etc/malloc.conf is symlinked to "-J" to initialize all newly allocated memory as this value is not a NULL pointer or ASCII NUL character.[citation needed] |
ABABABAB | Used byMicrosoft's debug HeapAlloc() to mark "no man's land"guard bytes after allocated heap memory.[24] |
ABADBABE | "A bad babe", Used byApple as the "Boot Zero Block" magic number. |
ABBABABE | "ABBA babe", used byDriver: Parallel Lines memory heap. |
ABADCAFE | "A bad cafe", Used to initialize all unallocated memory (Mungwall,AmigaOS). |
B16B00B5 | "Big Boobs", Formerly required byMicrosoft'sHyper-V hypervisor to be used by Linux guests as the upper half of their "guest id".[25] |
BAADF00D | "Bad food", Used byMicrosoft's debug HeapAlloc() to mark uninitialized allocated heap memory.[24] |
BAAAAAAD | "Baaaaaad", Indicates that theAppleiOS log is a stackshot of the entire system, not a crash report.[23] |
BAD22222 | "Bad too repeatedly", Indicates that anAppleiOS VoIP application has been terminated because it resumed too frequently.[23] |
BADBADBADBAD | "Bad bad bad bad",Burroughs large systems "uninitialized" memory (48-bit words). |
BADC0FFEE0DDF00D | "Bad coffee odd food", Used onIBMRS/6000 64-bit systems to indicate uninitialized CPU registers. |
BADDCAFE | "Bad cafe", OnSun Microsystems'Solaris, marks uninitialized kernel memory (KMEM_UNINITIALIZED_PATTERN). |
BBADBEEF | "Bad beef", Used inWebKit, for particularly unrecoverable errors.[26] |
BEBEBEBE | Used byAddressSanitizer to fill allocated but not initialized memory.[27] |
BEEFCACE | "Beef cake", Used byMicrosoft .NET as a magic number in resource files. |
C00010FF | "Cool off", IndicatesAppleiOS app was killed by the operating system in response to a thermal event.[23] |
CAFEBABE | "Cafe babe", Used byJava for class files. Used in multi-architectureMach-O binaries. |
CAFED00D | "Cafe dude", Used byJava for theirpack200 compression. |
CAFEFEED | "Cafe feed", Used bySun Microsystems'Solaris debugging kernel to mark kmemfree() memory. |
CCCCCCCC | Used byMicrosoft's C++ debugging runtime library and many DOS environments to mark uninitializedstack memory.CC is the opcode of theINT 3 debug breakpoint interrupt on x86 processors.[28] |
CDCDCDCD | Used byMicrosoft's C/C++ debug malloc() function to mark uninitialized heap memory, usually returned fromHeapAlloc.[24] |
0D15EA5E | "Zero Disease", Used as a flag to indicate regular boot on theGameCube andWii consoles. |
DDDDDDDD | Used by MicroQuill's SmartHeap and Microsoft's C/C++ debug free() function to mark freed heap memory.[24] |
DEAD10CC | "Dead lock", Indicates that anAppleiOS application has been terminated because it held on to a system resource while running in the background.[23] |
DEADBABE | "Dead babe", Used at the start ofSilicon Graphics'IRIX arena files. |
DEADBEEF | "Dead beef", Famously used onIBM systems such as theRS/6000, also used in theclassic Mac OSoperating systems,OPENSTEP Enterprise, and theCommodoreAmiga. OnSun Microsystems'Solaris, marks freed kernel memory (KMEM_FREE_PATTERN). |
DEADCAFE | "Dead cafe", Used byMicrosoft .NET as an error number inDLLs. |
DEADC0DE | "Dead code", Used as a marker inOpenWRT firmware to signify the beginning of the to-be created jffs2 file system at the end of the static firmware. |
DEADFA11 | "Dead fail", Indicates that anAppleiOS application has been force quit by the user.[23] |
DEADF00D | "Dead food", Used by Mungwall on theCommodoreAmiga to mark allocated but uninitialized memory.[29] |
DEFEC8ED | "Defecated", Used forOpenSolariscore dumps. |
DEADDEAD | "Dead Dead" indicates that the user deliberately initiated a crash dump from either the kernel debugger or the keyboard under Microsoft Windows.[30] |
D00D2BAD | "Dude, Too Bad", Used by Safari crashes on macOS Big Sur.[31] |
D00DF33D | "Dude feed", Used by thedevicetree to mark the start of headers.[32] |
EBEBEBEB | From MicroQuill's SmartHeap. |
FADEDEAD | "Fade dead", Comes at the end to identify everyAppleScript script. |
FDFDFDFD | Used byMicrosoft's C/C++ debug malloc() function to mark "no man's land"guard bytes before and after allocated heap memory,[24] and some debug SecureC-Runtime functions implemented by Microsoft (e.g. strncat_s).[33] |
FEE1DEAD | "Feel dead", Used byLinux reboot() syscall. |
FEEDFACE | "Feed face", Seen inMach-O binaries onApple Inc.'s Mac OSX platform. OnSun Microsystems'Solaris, marks the red zone (KMEM_REDZONE_PATTERN). Used byVLC player and someIP cameras inRTP/RTCP protocol, VLC player sends four bytes in the order of theendianness of the system. Some IP cameras expect the player to send this magic number and do not start the stream if it is not received. |
FEEEFEEE | "Fee fee", Used byMicrosoft's debug HeapFree() to mark freed heap memory. Some nearby internal bookkeeping values may have the high word set to FEEE as well.[24] |
Most of these are 32bits long – theword size of most 32-bit architecture computers.
The prevalence of these values in Microsoft technology is no coincidence; they are discussed in detail inSteve Maguire's bookWriting Solid Code fromMicrosoft Press. He gives a variety of criteria for these values, such as:
Since they were often used to mark areas of memory that were essentially empty, some of these terms came to be used in phrases meaning "gone, aborted, flushed from memory"; e.g. "Your program is DEADBEEF".[citation needed]