dll files compared to gzip files

Okay, the title isn't very clear.

Given a byte array (read from a database blob) that represents EITHER the sequence of bytes contained in a .dll or the sequence of bytes representing the gzip'd version of that dll, is there a (relatively) simple signature that I can look for to differentiate between the two?

I'm trying to puzzle this 开发者_如何学运维out on my own, but I've discovered I can save a lot of time by asking for help. Thanks in advance.

Check if it's first two bytes are the gzip magic number 0x1f8b (see RFC 1952). Or just try to gunzip it, the operation will fail if the DLL is not gzip'd.

A gzip file should be fairly straight forward to determine as it ought to consist of a header, footer and some other distinguishable elements in between.

From Wikipedia:

"gzip" is often also used to refer to the gzip file format, which is:

• a 10-byte header, containing a magic number, a version number and a time stamp

• optional extra headers, such as the original file name

• a body, containing a DEFLATE-compressed payload

• an 8-byte footer, containing a CRC-32 checksum and the length of the original uncompressed data

You might also try determining if the gzip contains any records/entries as each will also have their own header.

You can find specific information on this file format (specifically the member header which is linked) here.