Getting data appended to a file and searching

Hi all,

In continuation, albeit a different task, I am trying to get data that has been appended to the end of an image. The delimiter is "Test" and I was trying to use strstr and shift the pointer. It isn't working and I tried all sorts of methods. I clearly am missing something - the image should fit in an array of 1000. If I took this image: http://www.pacificsimplicity.ca/site...stDateIcon.png

and appended to the image (no \n) TestWhatIWouldLike Sans quotes, I want the "WhatIWouldLike"

Here is the console output:

Code:

---

./decrypt-tool.o
BUFFER:<��B�PNG

 
PTR_B:<��B�PNG

 
ANS:

---

Code:

---

void decrypt(){

        //Initializing the encryption KEY
        AES_set_encrypt_key(ckey, 128, &key);

        init_ctr(&state, iv);
       
        char buffer[1000];
        char path[1000];
        char *ptr_b[1000];
       
        op=fopen(ENCIMAGENAME,"r");
        if (op==NULL) { fputs ("File error",stderr); }
       
        /* Read the output a line at a time */
        while (fgets(path, 1000, op) != NULL) {
                strcat(buffer,path);
        }
        close(op);

        printf("BUFFER:%s \n",buffer);

        memcpy(ptr_b,buffer,sizeof(buffer));
        printf("PTR_B:%s \n",ptr_b);

        char *ans;
        ans = strstr((char *)ptr_b,"Test");
       
        ans = &ans + sizeof("Test");
        printf("ANS:%s \n",ans);


        fp=fopen(TMPFILE,"wb");
        fwrite(ans,strlen(ans),1,fp);
        fclose(fp);


        rp=fopen(OUTCMD,"wb");
        fp=fopen(TMPFILE,"rb");
        //Decrypt blocks of 16 bytes and write to decrypted.txt
        while (1) {
                bytes_read = fread(indata, 1, AES_BLOCK_SIZE, fp);
                AES_ctr128_encrypt(indata, outdata, bytes_read, &key, state.ivec, state.ecount, &state.num);
                bytes_written = fwrite(outdata, 1, bytes_read, rp);
                if (bytes_read < AES_BLOCK_SIZE)
                        break;
        }
        fclose (fp);
        fclose (rp);
}

---

Pretty please with a cherry on top help please?

1) open the file...
2) seek to it's end
3) seek in reverse by 1 buffer size (512 bytes should be enough)
4) use fread() to read the tail end of the file into a char buffer
5) use strstr() to locate the word test in the buffer
6) increment the pointer by 4 characters
6) read the string from the buffer with strcpy()

7) all done.

However... you should know that many file formats such as png, jpg etc, contain embedded filesize information and sticking stuff on the end of the file could corrupt it.

Well that seems to be working, but if I go to far back it gets into the image and can't find "Test" - here is what I have:

Code:

---

        char buffer[50];
       
        op=fopen(ENCIMAGENAME,"rb");
        fseek(op, -12, SEEK_END);
       
        bzero(buffer,50);
        fread(buffer, 1, 50, op);
        fclose(op);
    printf("BUFFER:%s \n",buffer);
   
    char *ans;
    ans = strstr((char *)buffer,"Test");
    printf("FOUND:%s \n",ans);
    ans = ans + sizeof("Test");
    printf("ANS:%s \n",ans);

---

It's likely you are finding null (0) bytes in the image that are terminating your string operations. If you have control of the text insertion you could remedy that by appending a fixed number of bytes. This gives you an exact location to seek to every time... fseek(op, -MESSAGE_SIZE,SEEK_END);... in fact I would suggest this because it is likely an image could contain a whole lot of 0s.

Code:

---

// top of file
#define MSG_SIZE 128


    char Message[MSG_SIZE] = 0;

    // add the message as a fixed size block
    fwrite(Message,MSG_SIZE,1,tf);
    fclose(tf);

---

Extracting the message now becomes a matter for...

Code:

---

    fseek(tf,-MSG_SIZE,SEEK_END);
    fread(Message,MSG_SIZE,1,tf);

---

Ooooh thanks!! well you got me up and running Tater. Code Karma.

From your code to writing a nasty little mystrstr which checks for the \x89 start of the PNG, I have arrived at the bottom.

Code:

---

char *mystrstr(char input[], char pat[])
{
        /* x89 is the start of a PNG;) */
        char *start, *p1, *p2;
        for(start = &input[0]; *start != '\x89'; start++)
                {                /* for each position in input string... */
                p1 = pat;        /* prepare to check for pattern string there */
                p2 = start;
                while(*p1 != '\0')
                        {
                        if(*p1 != *p2)        /* characters differ */
                                break;
                        p1++;
                        p2++;
                        }
                if(*p1 == '\0')                /* found match */
                        return start;
                }

        return NULL;
}

void decrypt(){
        // Initializing the encryption KEY
        AES_set_encrypt_key(ckey, 128, &key);

        init_ctr(&state, iv);
       
        // Find and shift
        char buffer[50]; // If you want to go back 50 chars
       
        op=fopen(ENCIMAGENAME,"r");
        fseek(op, -49, SEEK_END); //Same as buff -1 because it counts 0
       
        bzero(buffer,50);
        fread((char *)&buffer, 1, 50, op);
       
        fclose(op);
        printf("BUFFER:%s \n",buffer);
   
        char *ans;
        ans = mystrstr((char *)buffer,"Test");
 
        printf("FOUND:%s \n",ans);
        ans = ans + strlen("Test");
        printf("SHIFT:%s \n",ans);

        fp=fopen(TMPFILE,"w");
        fwrite(ans,strlen(ans),1,fp);
        fclose(fp);
       
        //Decrypt blocks of 16 bytes and write to OUTPUT

        rp=fopen(OUTCMD,"wb");
        if (rp==NULL) { fputs ("File error",stderr); }
        fp=fopen(TMPFILE,"rb");
       
        while (1) {
                bytes_read = fread(indata, 1, AES_BLOCK_SIZE, fp);
                AES_ctr128_encrypt(indata, outdata, bytes_read, &key, state.ivec, state.ecount, &state.num);
                bytes_written = fwrite(outdata, 1, bytes_read, rp);
                if (bytes_read < AES_BLOCK_SIZE)
                        break;
        }
        fclose (fp);
        fclose (rp);
}

---