Windows icon signature (00 00 01 00)

A Windows ICO icon file begins with a 6-byte ICONDIR header: a 2-byte reserved zero field, a 2-byte little-endian type field (0x0001 = icon, 0x0002 = cursor), then a 2-byte image count. So an icon starts 00 00 01 00.

file signature

magic: 00 00 01 00 @ offset 0

ascii: \x00\x00\x01\x00

.ico image/x-icon

spec: Microsoft ICO/CUR Icon Image Format

Bytes 0-1: reserved, always 0.
Bytes 2-3: type, little-endian: 0x0001 = icon (.ico), 0x0002 = cursor (.cur), giving 00 00 02 00.
Bytes 4-5: number of images in the file.
Individual images inside may be BMP (DIB) or PNG encoded (Vista+).

provenance

source: https://learn.microsoft.com/en-us/previous-versions/ms997538(v=msdn.10)
version: Microsoft Icon Image Format (ICONDIR: idReserved=0, idType=1 icon / 2 cursor, idCount)
retrieved: 2026-05-29 · updated: 2026-05-29T00:00:00Z

per-fact attribution:

ext.magic_hex — https://learn.microsoft.com/en-us/previous-versions/ms997538(v=msdn.10) ICONDIR header: idReserved (must be 0), idType (1 = icon resource), idCount; gives 00 00 01 00 for an icon.
ext.notes — https://en.wikipedia.org/wiki/ICO_(file_format) Corroborates 00 00 01 00 (icon) and 00 00 02 00 (cursor) headers.

agent: curl -H 'accept: application/json' wire.phall.io/magic/ico or /magic/ico.json

Windows icon signature (00 00 01 00)

file signature

provenance

see also