Thread: Getting data appended to a file and searching

Hi all,

In continuation, albeit a different task, I am trying to get data that has been appended to the end of an image. The delimiter is "Test" and I was trying to use strstr and shift the pointer. It isn't working and I tried all sorts of methods. I clearly am missing something - the image should fit in an array of 1000. If I took this image: http://www.pacificsimplicity.ca/site...stDateIcon.png

and appended to the image (no \n) TestWhatIWouldLike Sans quotes, I want the "WhatIWouldLike"

Here is the console output:

Code:

./decrypt-tool.o
BUFFER:<��B�PNG

 
PTR_B:<��B�PNG

 
ANS:

Code:

void decrypt(){

	//Initializing the encryption KEY
	AES_set_encrypt_key(ckey, 128, &key);

	init_ctr(&state, iv);
	
	char buffer[1000];
	char path[1000];
	char *ptr_b[1000];
	
	op=fopen(ENCIMAGENAME,"r");
	if (op==NULL) { fputs ("File error",stderr); }
	
	/* Read the output a line at a time */
	while (fgets(path, 1000, op) != NULL) {
		strcat(buffer,path);
	}
	close(op);

	printf("BUFFER:%s \n",buffer);

	memcpy(ptr_b,buffer,sizeof(buffer));
	printf("PTR_B:%s \n",ptr_b);

	char *ans;
	ans = strstr((char *)ptr_b,"Test");
	
	ans = &ans + sizeof("Test");
	printf("ANS:%s \n",ans);


	fp=fopen(TMPFILE,"wb");
	fwrite(ans,strlen(ans),1,fp);
	fclose(fp);


	rp=fopen(OUTCMD,"wb");
	fp=fopen(TMPFILE,"rb");
	//Decrypt blocks of 16 bytes and write to decrypted.txt
	while (1) {
		bytes_read = fread(indata, 1, AES_BLOCK_SIZE, fp);
		AES_ctr128_encrypt(indata, outdata, bytes_read, &key, state.ivec, state.ecount, &state.num);
		bytes_written = fwrite(outdata, 1, bytes_read, rp);
		if (bytes_read < AES_BLOCK_SIZE)
			break;
	}
	fclose (fp);
	fclose (rp);
}

Pretty please with a cherry on top help please?

Well that seems to be working, but if I go to far back it gets into the image and can't find "Test" - here is what I have:

Code:

	char buffer[50];
	
	op=fopen(ENCIMAGENAME,"rb");
	fseek(op, -12, SEEK_END);
	
	bzero(buffer,50);
	fread(buffer, 1, 50, op);
	fclose(op);
    printf("BUFFER:%s \n",buffer);
    
    char *ans;
    ans = strstr((char *)buffer,"Test");
    printf("FOUND:%s \n",ans);
    ans = ans + sizeof("Test");
    printf("ANS:%s \n",ans);

It's likely you are finding null (0) bytes in the image that are terminating your string operations. If you have control of the text insertion you could remedy that by appending a fixed number of bytes. This gives you an exact location to seek to every time... fseek(op, -MESSAGE_SIZE,SEEK_END);... in fact I would suggest this because it is likely an image could contain a whole lot of 0s.

Code:

// top of file
#define MSG_SIZE 128


    char Message[MSG_SIZE] = 0;

    // add the message as a fixed size block
    fwrite(Message,MSG_SIZE,1,tf);
    fclose(tf);

Extracting the message now becomes a matter for...

Code:

    fseek(tf,-MSG_SIZE,SEEK_END);
    fread(Message,MSG_SIZE,1,tf);

Ooooh thanks!! well you got me up and running Tater. Code Karma.

From your code to writing a nasty little mystrstr which checks for the \x89 start of the PNG, I have arrived at the bottom.

Code:

char *mystrstr(char input[], char pat[])
{
	/* x89 is the start of a PNG;) */
	char *start, *p1, *p2;
	for(start = &input[0]; *start != '\x89'; start++) 
		{		/* for each position in input string... */
		p1 = pat;	/* prepare to check for pattern string there */
		p2 = start;
		while(*p1 != '\0')
			{
			if(*p1 != *p2)	/* characters differ */
				break;
			p1++;
			p2++;
			}
		if(*p1 == '\0')		/* found match */
			return start;
		}

	return NULL;
}

void decrypt(){
	// Initializing the encryption KEY
	AES_set_encrypt_key(ckey, 128, &key);

	init_ctr(&state, iv);
	
	// Find and shift
	char buffer[50]; // If you want to go back 50 chars
	
	op=fopen(ENCIMAGENAME,"r");
	fseek(op, -49, SEEK_END); //Same as buff -1 because it counts 0
	
	bzero(buffer,50);
	fread((char *)&buffer, 1, 50, op);
	
	fclose(op);
        printf("BUFFER:%s \n",buffer);
    
        char *ans;
        ans = mystrstr((char *)buffer,"Test");
 
        printf("FOUND:%s \n",ans);
        ans = ans + strlen("Test");
        printf("SHIFT:%s \n",ans);

	fp=fopen(TMPFILE,"w");
	fwrite(ans,strlen(ans),1,fp);
	fclose(fp);
	
	//Decrypt blocks of 16 bytes and write to OUTPUT

	rp=fopen(OUTCMD,"wb");
	if (rp==NULL) { fputs ("File error",stderr); }
	fp=fopen(TMPFILE,"rb");
	
	while (1) {
		bytes_read = fread(indata, 1, AES_BLOCK_SIZE, fp);
		AES_ctr128_encrypt(indata, outdata, bytes_read, &key, state.ivec, state.ecount, &state.num);
		bytes_written = fwrite(outdata, 1, bytes_read, rp);
		if (bytes_read < AES_BLOCK_SIZE)
			break;
	}
	fclose (fp);
	fclose (rp);
}