Quote Originally Posted by Salem View Post
I think the clue is in the filename, and your 'friend' is winding you up.

$ ( cat a.out small.jpg a.out unspecified.jpeg a.out ) > five_catted.wav
$ ./a.out five_catted.wav
SOI at 0xdfc 3580
Filled buffer to 234 bytes
SOI at 0xfba 4026
Filled buffer to 567 bytes
SOI at 0x44eb 17643
Filled buffer to 234 bytes
SOI at 0x46a9 18089
Filled buffer to 373570 bytes
SOI at 0x62ce5 404709
Filled buffer to 234 bytes
SOI at 0x62ea3 405155
$ ls -l small.jpg unspecified.jpeg
-rw-rw-r-- 1 sc sc    567 Jul 19 09:40 small.jpg
-rw-rw-r-- 1 sc sc 373570 Jul 18 16:07 unspecified.jpeg
$ ls -l ngo_test_image_00*
-rw-rw-r-- 1 sc sc    234 Jul 19 10:58 ngo_test_image_000.jpg
-rw-rw-r-- 1 sc sc    567 Jul 19 10:58 ngo_test_image_001.jpg
-rw-rw-r-- 1 sc sc    234 Jul 19 10:58 ngo_test_image_002.jpg
-rw-rw-r-- 1 sc sc 373570 Jul 19 10:58 ngo_test_image_003.jpg
-rw-rw-r-- 1 sc sc    234 Jul 19 10:58 ngo_test_image_004.jpg
$ cmp ngo_test_image_001.jpg small.jpg
$ cmp ngo_test_image_003.jpg unspecified.jpeg
This program saves everything between matching pairs of 0xffd8(SOI) and 0xffd9(EOI)

I do the same with your file, and get a whole bunch of broken images.

> There are 2 images that have been stripped and added to it.
What does this even mean?
The only meaningful thing you can strip from a JPG file are comments (COM).
You might get away without APP blocks as well.

If an individual jpg is fragmented such that there is arbitrary garbage between SOI and EOI, then you really do have your work cut out.

Perhaps it's hidden in the LSBit of each audio sample.
Steganography - Wikipedia
Been looking into it but I can't identify anything. 2 people have completed it thus far.