I noticed a thread here
How to extract a jpg from a hex file without using EOF
After looking through it, I still couldn't figure out what I needed to do as I was having issues and am completely new to C programming.
There are apparently 2 hidden jpegs inside a .WAV files hex and I am having issues extracting them both.
Is anyone here experienced in that sort of ordeal?
Uploadfiles.io - nevergonnagiveyouup.wav
(the .wav file)
A good practice program is the good old fashioned hex dump.
When you're experienced at reading files one byte a time, then you can start looking for jpeg magic sequences.Code:$ hd nevergonnagiveyouup.wav | head -10 00000000 52 49 46 46 24 c5 1e 01 57 41 56 45 66 6d 74 20 |RIFF$...WAVEfmt | 00000010 10 00 00 00 01 00 01 00 44 ac 00 00 88 58 01 00 |........D....X..| 00000020 02 00 10 00 64 61 74 61 00 c5 1e 01 01 00 01 00 |....data........| 00000030 01 00 01 00 ff ff 03 00 fd ff 05 00 fd ff 05 00 |................| 00000040 fc ff 03 00 ff ff 02 00 fc ff 04 00 fd ff 05 00 |................| 00000050 fd ff 03 00 fd ff 03 00 01 00 ff ff 03 00 fd ff |................| 00000060 07 00 f8 ff 08 00 f8 ff 04 00 01 00 fc ff 04 00 |................| 00000070 fa ff 06 00 fa ff 04 00 fc ff 02 00 fe ff 02 00 |................| 00000080 fc ff 05 00 fc ff 05 00 fd ff 02 00 fe ff 01 00 |................| 00000090 02 00 fa ff 04 00 fb ff 06 00 fb ff 02 00 ff ff |................|
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
If at first you don't succeed, try writing your phone number on the exam paper.
Originally Posted by Salem
Hey I appreciate the quick response, do you think you could assist me in identify the start and end of the jpg sequence? Previously I was using hexed.it
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
If at first you don't succeed, try writing your phone number on the exam paper.
Haha if only it were that easy, with over 3,000 results on each of those it's not quite.
So try and decode a bit more then.
Code:$ hd nevergonnagiveyouup.wav | grep 'ff d8 ff c0' 01180f00 b6 ff 88 ff 70 ff 86 ff ba ff d8 ff c0 ff ac ff |....p...........| 011987a0 36 00 24 00 12 00 fa ff e2 ff d8 ff c0 ff e0 ff |6.$.............| 011a9ce0 ac ff ac ff de ff f6 ff e4 ff d0 ff d8 ff c0 ff |................| 011abbf0 0a 00 0e 00 fa ff fa ff f2 ff ea ff d8 ff c0 ff |................| 011b0df0 e8 ff ea ff de ff e0 ff e6 ff d8 ff c0 ff b8 ff |................| 011b1460 fa ff f2 ff ea ff d8 ff e8 ff d8 ff c0 ff ac ff |................| 011b2940 44 00 36 00 20 00 0a 00 fa ff d8 ff c0 ff a0 ff |D.6. ...........| 011b4ab0 14 00 f8 ff fc ff e8 ff ea ff d8 ff c0 ff 9c ff |................|
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
If at first you don't succeed, try writing your phone number on the exam paper.
Unfortunately I don't know how to extract from start to finish or eliminate possibilities on each.
Why do you think that's the case? If there is a webpage describing this, post the link so we can read it ourselves.
It was made by a friend for practice.
Then ask him how to do it (and let us know!).
I can't find any "jpegs" in the wav file. Are you sure that's what he meant? The way I would hide an image in a wav file would be to spread the bits of the image across the low bit(s) of the sample data of the wav file. Are you sure that's not what he did?
Just asked for more info and he just replied saying there are 2 images hidden within the hex of the audio, you will need to find and extract the 2 images and then join them together to create a QR code to scan.
So it's no longer a "jpeg" (why did you say that in the first place???), but just an "image". And it's "hidden" in the "audio", which sounds like my interpretation may be correct.
So you need to know how to find the audio data of the wave file. I assume you've read the entire wiki article on wave files. Where are you stuck?
If you read my above post the file is hidden in the HEX of the .wav file. That's it, simple as that.
There are 2 images that have been stripped and added to it.
Last edited by MattJunior; 07-18-2017 at 09:17 AM.
I don't know what "hidden in the HEX" means, so it's not "simple" to me.
I'd like to know the answer to this, so please let us know when you figure it out.
I think the clue is in the filename, and your 'friend' is winding you up.
This program saves everything between matching pairs of 0xffd8(SOI) and 0xffd9(EOI)Code:$ ( cat a.out small.jpg a.out unspecified.jpeg a.out ) > five_catted.wav $ ./a.out five_catted.wav SOI at 0xdfc 3580 Filled buffer to 234 bytes SOI at 0xfba 4026 Filled buffer to 567 bytes SOI at 0x44eb 17643 Filled buffer to 234 bytes SOI at 0x46a9 18089 Filled buffer to 373570 bytes SOI at 0x62ce5 404709 Filled buffer to 234 bytes SOI at 0x62ea3 405155 $ ls -l small.jpg unspecified.jpeg -rw-rw-r-- 1 sc sc 567 Jul 19 09:40 small.jpg -rw-rw-r-- 1 sc sc 373570 Jul 18 16:07 unspecified.jpeg $ ls -l ngo_test_image_00* -rw-rw-r-- 1 sc sc 234 Jul 19 10:58 ngo_test_image_000.jpg -rw-rw-r-- 1 sc sc 567 Jul 19 10:58 ngo_test_image_001.jpg -rw-rw-r-- 1 sc sc 234 Jul 19 10:58 ngo_test_image_002.jpg -rw-rw-r-- 1 sc sc 373570 Jul 19 10:58 ngo_test_image_003.jpg -rw-rw-r-- 1 sc sc 234 Jul 19 10:58 ngo_test_image_004.jpg $ cmp ngo_test_image_001.jpg small.jpg $ cmp ngo_test_image_003.jpg unspecified.jpeg
I do the same with your file, and get a whole bunch of broken images.
> There are 2 images that have been stripped and added to it.
What does this even mean?
The only meaningful thing you can strip from a JPG file are comments (COM).
You might get away without APP blocks as well.
If an individual jpg is fragmented such that there is arbitrary garbage between SOI and EOI, then you really do have your work cut out.
Perhaps it's hidden in the LSBit of each audio sample.
Steganography - Wikipedia
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
If at first you don't succeed, try writing your phone number on the exam paper.
