Thread: Help extracting JPG from .WAV file

  1. #1
    Registered User
    Join Date
    Jul 2017
    Posts
    8

    Help extracting JPG from .WAV file

    I noticed a thread here
    How to extract a jpg from a hex file without using EOF

    After looking through it, I still couldn't figure out what I needed to do as I was having issues and am completely new to C programming.

    There are apparently 2 hidden jpegs inside a .WAV files hex and I am having issues extracting them both.

    Is anyone here experienced in that sort of ordeal?
    Uploadfiles.io - nevergonnagiveyouup.wav
    (the .wav file)

  2. #2
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    39,154
    A good practice program is the good old fashioned hex dump.
    Code:
    $ hd nevergonnagiveyouup.wav | head -10
    00000000  52 49 46 46 24 c5 1e 01  57 41 56 45 66 6d 74 20  |RIFF$...WAVEfmt |
    00000010  10 00 00 00 01 00 01 00  44 ac 00 00 88 58 01 00  |........D....X..|
    00000020  02 00 10 00 64 61 74 61  00 c5 1e 01 01 00 01 00  |....data........|
    00000030  01 00 01 00 ff ff 03 00  fd ff 05 00 fd ff 05 00  |................|
    00000040  fc ff 03 00 ff ff 02 00  fc ff 04 00 fd ff 05 00  |................|
    00000050  fd ff 03 00 fd ff 03 00  01 00 ff ff 03 00 fd ff  |................|
    00000060  07 00 f8 ff 08 00 f8 ff  04 00 01 00 fc ff 04 00  |................|
    00000070  fa ff 06 00 fa ff 04 00  fc ff 02 00 fe ff 02 00  |................|
    00000080  fc ff 05 00 fc ff 05 00  fd ff 02 00 fe ff 01 00  |................|
    00000090  02 00 fa ff 04 00 fb ff  06 00 fb ff 02 00 ff ff  |................|
    When you're experienced at reading files one byte a time, then you can start looking for jpeg magic sequences.
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  3. #3
    Registered User
    Join Date
    Jul 2017
    Posts
    8
    Quote Originally Posted by Salem View Post
    A good practice program is the good old fashioned hex dump.
    Code:
    $ hd nevergonnagiveyouup.wav | head -10
    00000000  52 49 46 46 24 c5 1e 01  57 41 56 45 66 6d 74 20  |RIFF$...WAVEfmt |
    00000010  10 00 00 00 01 00 01 00  44 ac 00 00 88 58 01 00  |........D....X..|
    00000020  02 00 10 00 64 61 74 61  00 c5 1e 01 01 00 01 00  |....data........|
    00000030  01 00 01 00 ff ff 03 00  fd ff 05 00 fd ff 05 00  |................|
    00000040  fc ff 03 00 ff ff 02 00  fc ff 04 00 fd ff 05 00  |................|
    00000050  fd ff 03 00 fd ff 03 00  01 00 ff ff 03 00 fd ff  |................|
    00000060  07 00 f8 ff 08 00 f8 ff  04 00 01 00 fc ff 04 00  |................|
    00000070  fa ff 06 00 fa ff 04 00  fc ff 02 00 fe ff 02 00  |................|
    00000080  fc ff 05 00 fc ff 05 00  fd ff 02 00 fe ff 01 00  |................|
    00000090  02 00 fa ff 04 00 fb ff  06 00 fb ff 02 00 ff ff  |................|
    When you're experienced at reading files one byte a time, then you can start looking for jpeg magic sequences.

    Hey I appreciate the quick response, do you think you could assist me in identify the start and end of the jpg sequence? Previously I was using hexed.it

  4. #4
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    39,154
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  5. #5
    Registered User
    Join Date
    Jul 2017
    Posts
    8
    Quote Originally Posted by Salem View Post
    Haha if only it were that easy, with over 3,000 results on each of those it's not quite.

  6. #6
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    39,154
    So try and decode a bit more then.

    Code:
    $ hd nevergonnagiveyouup.wav | grep 'ff d8 ff c0'
    01180f00  b6 ff 88 ff 70 ff 86 ff  ba ff d8 ff c0 ff ac ff  |....p...........|
    011987a0  36 00 24 00 12 00 fa ff  e2 ff d8 ff c0 ff e0 ff  |6.$.............|
    011a9ce0  ac ff ac ff de ff f6 ff  e4 ff d0 ff d8 ff c0 ff  |................|
    011abbf0  0a 00 0e 00 fa ff fa ff  f2 ff ea ff d8 ff c0 ff  |................|
    011b0df0  e8 ff ea ff de ff e0 ff  e6 ff d8 ff c0 ff b8 ff  |................|
    011b1460  fa ff f2 ff ea ff d8 ff  e8 ff d8 ff c0 ff ac ff  |................|
    011b2940  44 00 36 00 20 00 0a 00  fa ff d8 ff c0 ff a0 ff  |D.6. ...........|
    011b4ab0  14 00 f8 ff fc ff e8 ff  ea ff d8 ff c0 ff 9c ff  |................|
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  7. #7
    Registered User
    Join Date
    Jul 2017
    Posts
    8
    Quote Originally Posted by Salem View Post
    So try and decode a bit more then.

    Code:
    $ hd nevergonnagiveyouup.wav | grep 'ff d8 ff c0'
    01180f00  b6 ff 88 ff 70 ff 86 ff  ba ff d8 ff c0 ff ac ff  |....p...........|
    011987a0  36 00 24 00 12 00 fa ff  e2 ff d8 ff c0 ff e0 ff  |6.$.............|
    011a9ce0  ac ff ac ff de ff f6 ff  e4 ff d0 ff d8 ff c0 ff  |................|
    011abbf0  0a 00 0e 00 fa ff fa ff  f2 ff ea ff d8 ff c0 ff  |................|
    011b0df0  e8 ff ea ff de ff e0 ff  e6 ff d8 ff c0 ff b8 ff  |................|
    011b1460  fa ff f2 ff ea ff d8 ff  e8 ff d8 ff c0 ff ac ff  |................|
    011b2940  44 00 36 00 20 00 0a 00  fa ff d8 ff c0 ff a0 ff  |D.6. ...........|
    011b4ab0  14 00 f8 ff fc ff e8 ff  ea ff d8 ff c0 ff 9c ff  |................|
    Unfortunately I don't know how to extract from start to finish or eliminate possibilities on each.

  8. #8
    Registered User
    Join Date
    Jun 2015
    Posts
    1,643
    Quote Originally Posted by MattJunior View Post
    There are apparently 2 hidden jpegs inside a .WAV files hex
    Why do you think that's the case? If there is a webpage describing this, post the link so we can read it ourselves.

  9. #9
    Registered User
    Join Date
    Jul 2017
    Posts
    8
    Quote Originally Posted by algorism View Post
    Why do you think that's the case? If there is a webpage describing this, post the link so we can read it ourselves.
    It was made by a friend for practice.

  10. #10
    Registered User
    Join Date
    Jun 2015
    Posts
    1,643
    Then ask him how to do it (and let us know!).

    I can't find any "jpegs" in the wav file. Are you sure that's what he meant? The way I would hide an image in a wav file would be to spread the bits of the image across the low bit(s) of the sample data of the wav file. Are you sure that's not what he did?

  11. #11
    Registered User
    Join Date
    Jul 2017
    Posts
    8
    Quote Originally Posted by algorism View Post
    Then ask him how to do it (and let us know!).

    I can't find any "jpegs" in the wav file. Are you sure that's what he meant? The way I would hide an image in a wav file would be to spread the bits of the image across the low bit(s) of the sample data of the wav file. Are you sure that's not what he did?
    Just asked for more info and he just replied saying there are 2 images hidden within the hex of the audio, you will need to find and extract the 2 images and then join them together to create a QR code to scan.

  12. #12
    Registered User
    Join Date
    Jun 2015
    Posts
    1,643
    So it's no longer a "jpeg" (why did you say that in the first place???), but just an "image". And it's "hidden" in the "audio", which sounds like my interpretation may be correct.

    So you need to know how to find the audio data of the wave file. I assume you've read the entire wiki article on wave files. Where are you stuck?

  13. #13
    Registered User
    Join Date
    Jul 2017
    Posts
    8
    Quote Originally Posted by algorism View Post
    So it's no longer a "jpeg" (why did you say that in the first place???), but just an "image". And it's "hidden" in the "audio", which sounds like my interpretation may be correct.

    So you need to know how to find the audio data of the wave file. I assume you've read the entire wiki article on wave files. Where are you stuck?

    If you read my above post the file is hidden in the HEX of the .wav file. That's it, simple as that.

    There are 2 images that have been stripped and added to it.
    Last edited by MattJunior; 07-18-2017 at 09:17 AM.

  14. #14
    Registered User
    Join Date
    Jun 2015
    Posts
    1,643
    I don't know what "hidden in the HEX" means, so it's not "simple" to me.

    I'd like to know the answer to this, so please let us know when you figure it out.

  15. #15
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    39,154
    I think the clue is in the filename, and your 'friend' is winding you up.

    Code:
    $ ( cat a.out small.jpg a.out unspecified.jpeg a.out ) > five_catted.wav
    $ ./a.out five_catted.wav
    SOI at 0xdfc 3580
    Filled buffer to 234 bytes
    SOI at 0xfba 4026
    Filled buffer to 567 bytes
    SOI at 0x44eb 17643
    Filled buffer to 234 bytes
    SOI at 0x46a9 18089
    Filled buffer to 373570 bytes
    SOI at 0x62ce5 404709
    Filled buffer to 234 bytes
    SOI at 0x62ea3 405155
    $ ls -l small.jpg unspecified.jpeg
    -rw-rw-r-- 1 sc sc    567 Jul 19 09:40 small.jpg
    -rw-rw-r-- 1 sc sc 373570 Jul 18 16:07 unspecified.jpeg
    $ ls -l ngo_test_image_00*
    -rw-rw-r-- 1 sc sc    234 Jul 19 10:58 ngo_test_image_000.jpg
    -rw-rw-r-- 1 sc sc    567 Jul 19 10:58 ngo_test_image_001.jpg
    -rw-rw-r-- 1 sc sc    234 Jul 19 10:58 ngo_test_image_002.jpg
    -rw-rw-r-- 1 sc sc 373570 Jul 19 10:58 ngo_test_image_003.jpg
    -rw-rw-r-- 1 sc sc    234 Jul 19 10:58 ngo_test_image_004.jpg
    $ cmp ngo_test_image_001.jpg small.jpg
    $ cmp ngo_test_image_003.jpg unspecified.jpeg
    This program saves everything between matching pairs of 0xffd8(SOI) and 0xffd9(EOI)

    I do the same with your file, and get a whole bunch of broken images.

    > There are 2 images that have been stripped and added to it.
    What does this even mean?
    The only meaningful thing you can strip from a JPG file are comments (COM).
    You might get away without APP blocks as well.

    If an individual jpg is fragmented such that there is arbitrary garbage between SOI and EOI, then you really do have your work cut out.

    Perhaps it's hidden in the LSBit of each audio sample.
    Steganography - Wikipedia
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Extracting Data from txt File
    By BonaviaFx in forum C Programming
    Replies: 1
    Last Post: 01-13-2015, 05:10 AM
  2. Extracting info from file
    By trillykins in forum C Programming
    Replies: 3
    Last Post: 11-18-2010, 01:58 PM
  3. extracting words from a file
    By rahulsk1947 in forum C Programming
    Replies: 8
    Last Post: 08-24-2006, 01:15 PM
  4. extracting file names
    By cathal in forum C Programming
    Replies: 1
    Last Post: 08-19-2004, 08:57 AM

Tags for this Thread