ddotlic

Convention: Byte array notation as it would appear in a hexeditor.

= Layout=

KDBX files, the keepass database files, are layout as follows:

1) Bytes 0-3: Primary identifier, common across all kdbx versions: 
  private static $sigByte1=[0x03,0xD9,0xA2,0x9A];

2) Bytes 4-7: Secondary identifier. Byte 4 can be used to identify the file version (0x67 is latest, 0x66 is the KeePass 2 pre-release format and 0x55 is KeePass 1)