似乎如果我将二进制数据追加到png文件的末尾,该png文件仍然可以查看。因此,该png文件仍然是一个有效的文件。有没有办法从未记录原始文件大小的png文件中自动提取这样的尾随数据?
似乎如果我将二进制数据追加到png文件的末尾,该png文件仍然可以查看。因此,该png文件仍然是一个有效的文件。有没有办法从未记录原始文件大小的png文件中自动提取这样的尾随数据?
PNG文件以"IEND"块结束。最后的12个字节总是相同的。因此,您可以尝试使用以下内容:
dd if=appended.png of=extracted.png bs=1 count=$((($(od -t x1 appended.png | awk '{$1=""}1' | tr -d \\n | sed "s/00 00 00 00 49 45 4e 44 ae 42 60 82/XMATCHX/" | tr X \\n | grep -b MATCH | cut -f1 -d:)-2)/3+12))
grep -b
的方式与GNU grep不同。其要点如下:
appended.png
的开头提取count字节MATCH
替换grep -b
和cut
获取MATCH的偏移量pngcheck -v YOURFILE.png
命令,它会告诉你文件末尾是否有额外的字节,并以错误状态 2
退出。# Generate legitimate PNG with ImageMagick
convert -size 300x400 gradient:yellow-red orig.png
# Check its size
ls -l orig.png
-rw-r--r-- 1 mark staff 2509 3 May 17:47 orig.png
# Check it with `pngcheck` - exit status = 0, i.e. all ok
File: orig.png (2509 bytes)
chunk IHDR at offset 0x0000c, length 13
300 x 400 image, 48-bit RGB, non-interlaced
chunk gAMA at offset 0x00025, length 4: 0.45455
chunk cHRM at offset 0x00035, length 32
White x = 0.3127 y = 0.329, Red x = 0.64 y = 0.33
Green x = 0.3 y = 0.6, Blue x = 0.15 y = 0.06
chunk bKGD at offset 0x00061, length 6
red = 0xffff, green = 0xffff, blue = 0xffff
chunk IDAT at offset 0x00073, length 2276
zlib: deflated, 32K window, maximum compression
chunk tEXt at offset 0x00963, length 37, keyword: date:create
chunk tEXt at offset 0x00994, length 37, keyword: date:modify
chunk IEND at offset 0x009c5, length 0
No errors detected in orig.png (8 chunks, 99.7% compression).
现在在末尾添加一些无用的内容:
ls -l >> orig.png
# Check the size again
ls -l orig.png
-rw-r--r-- 1 mark staff 8398 3 May 17:53 orig.png
# And check again - exit status =2
pngcheck -v orig.png
File: orig.png (8398 bytes)
chunk IHDR at offset 0x0000c, length 13
300 x 400 image, 48-bit RGB, non-interlaced
chunk gAMA at offset 0x00025, length 4: 0.45455
chunk cHRM at offset 0x00035, length 32
White x = 0.3127 y = 0.329, Red x = 0.64 y = 0.33
Green x = 0.3 y = 0.6, Blue x = 0.15 y = 0.06
chunk bKGD at offset 0x00061, length 6
red = 0xffff, green = 0xffff, blue = 0xffff
chunk IDAT at offset 0x00073, length 2276
zlib: deflated, 32K window, maximum compression
chunk tEXt at offset 0x00963, length 37, keyword: date:create
chunk tEXt at offset 0x00994, length 37, keyword: date:modify
chunk IEND at offset 0x009c5, length 0
additional data after IEND chunk
ERRORS DETECTED in orig.png
brew install pngcheck