这是一道ctf题目给的附件，题目描述：We captured a suspicious file t...

python
import re, pathlib, math, base64, binascii, textwrap, hashlib, zlib, gzip, lzma, io, json
p = pathlib.Path("/mnt/data/SuspiciousFile")
data = p.read_bytes()
len(data), data[:20]

(110548, b'1112mVTzdnz2dSRiefjb')

python
s = data.decode('ascii')
chars = sorted(set(s))
len(chars), chars[:50], chars[-20:]

(58,
 ['1',
  '2',
  '3',
  '4',
  '5',
  '6',
  '7',
  '8',
  '9',
  'A',
  'B',
  'C',
  'D',
  'E',
  'F',
  'G',
  'H',
  'J',
  'K',
  'L',
  'M',
  'N',
  'P',
  'Q',
  'R',
  'S',
  'T',
  'U',
  'V',
  'W',
  'X',
  'Y',
  'Z',
  'a',
  'b',
  'c',
  'd',
  'e',
  'f',
  'g',
  'h',
  'i',
  'j',
  'k',
  'm',
  'n',
  'o',
  'p',
  'q',
  'r'],
 ['f',
  'g',
  'h',
  'i',
  'j',
  'k',
  'm',
  'n',
  'o',
  'p',
  'q',
  'r',
  's',
  't',
  'u',
  'v',
  'w',
  'x',
  'y',
  'z'])

python
import string
digits=set(string.digits)
upper=set(string.ascii_uppercase)
lower=set(string.ascii_lowercase)
present=set(s)
missing_digits=sorted(digits-present)
missing_upper=sorted(upper-present)
missing_lower=sorted(lower-present)
missing_digits, missing_upper, missing_lower[:10], len(missing_lower)

(['0'], ['I', 'O'], ['l'], 1)

python
alphabet = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
alpha_idx = {c:i for i,c in enumerate(alphabet)}
def b58decode(b58: str) -> bytes:
    n=0
    for ch in b58:
        n = n*58 + alpha_idx[ch]
    # convert to bytes
    h = n.to_bytes((n.bit_length()+7)//8, 'big') if n>0 else b''
    # add leading zeros for leading '1's
    pad = len(b58) - len(b58.lstrip('1'))
    return b'\x00'*pad + h
decoded = b58decode(s)
len(decoded), decoded[:20]

(80949, b'\x00\x00\x00,ftypavis\x00\x00\x00\x00avif')

python
out_path="/mnt/data/decoded.avif"
pathlib.Path(out_path).write_bytes(decoded)


80949

python
from PIL import Image, PngImagePlugin
img = Image.open("/mnt/data/decoded.png")
img.mode, img.size

('RGB', (700, 700))

python
import numpy as np, re
arr = np.array(img)
arr.shape

(700, 700, 3)

python
def bits_to_bytes(bits):
    # bits is 1D array/list of 0/1
    n = len(bits)//8
    bits = bits[:n*8]
    b = np.packbits(np.array(bits, dtype=np.uint8).reshape(-1,8), axis=1, bitorder='big')
    return b.flatten().tobytes()

def search_in_bytes(b, pattern=b"hkcert25{"):
    idx = b.find(pattern)
    return idx

def try_bitplanes(arr):
    results=[]
    for ch,name in enumerate(['R','G','B']):
        for bit in range(8):
            bits = ((arr[:,:,ch] >> bit) & 1).flatten()
            b = bits_to_bytes(bits)
            idx = search_in_bytes(b)
            if idx!=-1:
                results.append((name,bit,idx))
    # combined

([], 0)

python
def bits_to_bytes_order(bits, order='big'):
    n=len(bits)//8
    bits=bits[:n*8]
    a=np.array(bits,dtype=np.uint8).reshape(-1,8)
    if order=='big':
        b=np.packbits(a, axis=1, bitorder='big')
    else:
        b=np.packbits(a, axis=1, bitorder='little')
    return b.flatten().tobytes()

def try_bitplanes_orders(arr):
    res=[]
    for order in ['big','little']:
        for ch,name in enumerate(['R','G','B']):
            for bit in range(8):
                bits = ((arr[:,:,ch] >> bit) & 1).flatten()
                b=bits_to_bytes_order(bits, order)
                idx=b.find(b"hkcert25{")
                if idx!=-1:
                    res.append((order,name,bit,'plane',idx))
        for bit in range(8):
            bits = ((arr >> bit) & 1).reshape(-1,3).flatten()
            b=bits_to_bytes_order(bits, order)
            idx=b.find(b"hkcert25{")
            if idx!=-1:
                res.append((order,'RGB',bit,'inter',idx))
    return res

res = try_bitplanes_orders(arr)
res

[]

python
import struct
avif = decoded
def parse_boxes(data, start=0, end=None, depth=0, max_depth=6):
    if end is None: end=len(data)
    i=start
    boxes=[]
    while i+8<=end:
        size = struct.unpack(">I", data[i:i+4])[0]
        typ = data[i+4:i+8].decode('latin-1')
        header=8
        if size==1:
            if i+16>end: break
            size = struct.unpack(">Q", data[i+8:i+16])[0]
            header=16
        elif size==0:
            size = end - i
        if size<8 or i+size>end: 
            break
        box={'type':typ,'start':i,'size':size,'header':header,'depth':depth}
        boxes.append(box)
        # container types
        if typ in ('meta','moov','trak','mdia','minf','stbl','dinf','iprp','ipco','iinf','iloc','ipma','pitm','iref','mfra','mvex'):
            # for meta, full box has 4 bytes version/flags after header
            inner_start=i+header
            if typ=='meta':
                inner_start += 4
            if depth<max_depth:
                boxes.extend(parse_boxes(data, inner_start, i+size, depth+1, max_depth))
        i += size
    return boxes

boxes=parse_boxes(avif)
len(boxes), boxes[:10]

(36,
 [{'type': 'ftyp', 'start': 0, 'size': 44, 'header': 8, 'depth': 0},
  {'type': 'meta', 'start': 44, 'size': 235, 'header': 8, 'depth': 0},
  {'type': 'hdlr', 'start': 56, 'size': 33, 'header': 8, 'depth': 1},
  {'type': 'pitm', 'start': 89, 'size': 14, 'header': 8, 'depth': 1},
  {'type': 'iloc', 'start': 103, 'size': 30, 'header': 8, 'depth': 1},
  {'type': 'D\x00\x00\x01', 'start': 111, 'size': 22, 'header': 8, 'depth': 2},
  {'type': 'iinf', 'start': 133, 'size': 40, 'header': 8, 'depth': 1},
  {'type': '\x00\x01\x00\x00',
   'start': 141,
   'size': 32,
   'header': 8,
   'depth': 2},
  {'type': 'iprp', 'start': 173, 'size': 106, 'header': 8, 'depth': 1},
  {'type': 'ipco', 'start': 181, 'size': 75, 'header': 8, 'depth': 2}])

python
top=[]
i=0
while i+8<=len(avif):
    size=struct.unpack(">I", avif[i:i+4])[0]
    typ=avif[i+4:i+8].decode('latin-1')
    header=8
    if size==1:
        size=struct.unpack(">Q", avif[i+8:i+16])[0]
        header=16
    elif size==0:
        size=len(avif)-i
    top.append((typ,i,size))
    i+=size
top

[('ftyp', 0, 44),
 ('meta', 44, 235),
 ('moov', 279, 2902),
 ('mdat', 3181, 77768)]

python
png_bytes = pathlib.Path("/mnt/data/decoded.png").read_bytes()
def parse_png_chunks(data):
    assert data[:8]==b'\x89PNG\r\n\x1a\n'
    i=8
    chunks=[]
    while i+8<=len(data):
        length=struct.unpack(">I", data[i:i+4])[0]
        typ=data[i+4:i+8].decode('latin-1')
        chunk_data=data[i+8:i+8+length]
        crc=data[i+8+length:i+12+length]
        chunks.append((typ,length,i))
        i = i+12+length
        if typ=='IEND': break
    return chunks

chunks=parse_png_chunks(png_bytes)
chunks[:20], chunks[-5:], len(chunks), len(png_bytes)

([('IHDR', 13, 8),
  ('pHYs', 9, 33),
  ('IDAT', 4096, 54),
  ('IDAT', 4096, 4162),
  ('IDAT', 4096, 8270),
  ('IDAT', 4096, 12378),
  ('IDAT', 4096, 16486),
  ('IDAT', 4096, 20594),
  ('IDAT', 4096, 24702),
  ('IDAT', 4096, 28810),
  ('IDAT', 4096, 32918),
  ('IDAT', 4096, 37026),
  ('IDAT', 4096, 41134),
  ('IDAT', 4096, 45242),
  ('IDAT', 4096, 49350),
  ('IDAT', 4096, 53458),
  ('IDAT', 4096, 57566),
  ('IDAT', 436, 61674),
  ('IEND', 0, 62122)],
 [('IDAT', 4096, 49350),
  ('IDAT', 4096, 53458),
  ('IDAT', 4096, 57566),
  ('IDAT', 436, 61674),
  ('IEND', 0, 62122)],
 19,
 62134)

python
from PIL import Image
import numpy as np, pathlib, itertools, os, math
arr=np.array(img)
out_dir=pathlib.Path("/mnt/data/lsb_planes")
out_dir.mkdir(exist_ok=True)
paths=[]
for ch,name in enumerate(['R','G','B']):
    for bit in range(2):  # try first two bits
        plane=((arr[:,:,ch]>>bit)&1)*255
        im=Image.fromarray(plane.astype(np.uint8), mode='L')
        path=out_dir/f"{name}_bit{bit}.png"
        im.save(path)
        paths.append(str(path))
paths

['/mnt/data/lsb_planes/R_bit0.png',
 '/mnt/data/lsb_planes/R_bit1.png',
 '/mnt/data/lsb_planes/G_bit0.png',
 '/mnt/data/lsb_planes/G_bit1.png',
 '/mnt/data/lsb_planes/B_bit0.png',
 '/mnt/data/lsb_planes/B_bit1.png']

python
# compute combined LSBs
lsb0 = arr & 1
# possibilities: take one channel; take xor; take majority; take sum
comb_sum = lsb0.sum(axis=2)  # 0..3
# make grayscale mapping 0->0,3->255
sum_img = (comb_sum*85).astype(np.uint8)
Image.fromarray(sum_img).save("/mnt/data/lsb_planes/sum_rgb_bit0.png")
xor_img = (lsb0[:,:,0] ^ lsb0[:,:,1] ^ lsb0[:,:,2]).astype(np.uint8)*255
Image.fromarray(xor_img).save("/mnt/data/lsb_planes/xor_rgb_bit0.png")
maj = ((comb_sum>=2).astype(np.uint8)*255)
Image.fromarray(maj).save("/mnt/data/lsb_planes/maj_rgb_bit0.png")


<<ImageDisplayed>>

python
import binascii
def extract_bits(arr, bits=[0], channels=[0,1,2], interleave=True):
    # bits: list of bit positions to extract for each channel.
    # if interleave True: per pixel, per channel, per bit in bits order; else sequential planes.
    h,w,c=arr.shape
    if interleave:
        bit_list=[]
        flat=arr.reshape(-1,c)
        for b in bits:
            for ch in channels:
                bit_list.append(((flat[:,ch]>>b)&1))
        bits_arr=np.stack(bit_list, axis=1).reshape(-1)  # interleave bits by our order per pixel? Wait: stacking yields pixel-major? Actually columns.
        # We want per pixel: for each pixel, for each (b

(183750,
 183750,
 b'\xff\xff\xff\xfe\xdb\xef\xbf\xffo\xff\xff\xff\xbf\xfb\xfd\xb7',
 b'\xff\xff\xff\x7f\xdb\xf7\xfd\xff\xf6\xff\xff\xff\xfd\xdf\xbf\xed')

python
def find_magic(b):
    magics = {
        b'PK\x03\x04': 'zip',
        b'\x1f\x8b\x08': 'gzip',
        b'BZh': 'bzip2',
        b'\xfd7zXZ\x00': 'xz',
        b'\x89PNG\r\n\x1a\n':'png',
        b'\xff\xd8\xff':'jpg',
        b'7z\xbc\xaf\x27\x1c':'7z',
        b'Rar!\x1a\x07\x00':'rar',
        b'GIF89a':'gif',
        b'%PDF-':'pdf',
        b'ID3':'mp3',
        b'RIFF':'riff',
    }
    hits=[]
    for sig,name in magics.items():
        idx=b.find(sig)
        if idx!=-1:
            hits.append((name, idx))
    return sorted(hits, key=lambda x:x[1])
find_magic(b_big)[:10]

[]

python
inv = bytes([x^0xFF for x in b_big[:100000]])  # sample
find_magic(inv)

[]

python
# Save channel grayscale images
for ch,name in enumerate(['R','G','B']):
    ch_img=Image.fromarray(arr[:,:,ch])
    ch_img.save(f"/mnt/data/{name}_channel.png")


<<ImageDisplayed>>

python
from PIL import Image
import numpy as np, pathlib
im0=np.array(Image.open("/mnt/data/two/f001.png"))
im1=np.array(Image.open("/mnt/data/two/f002.png"))
diff = np.abs(im0.astype(int)-im1.astype(int))
diff.max(), diff.sum(), np.count_nonzero(diff)

(0, 0, 0)

python
import subprocess, shlex, pandas as pd, numpy as np, re, os, textwrap, math, statistics
cmd = "ffprobe -v error -select_streams v:0 -show_frames -show_entries frame=pkt_duration_time -of csv=p=0 /mnt/data/decoded.avif"
out = subprocess.check_output(cmd, shell=True, text=True)
lines=[l.strip() for l in out.splitlines() if l.strip()!='']
len(lines), lines[:10], lines[-5:]

(272,
 ['3.333333',
  '6.666667',
  '6.666667',
  '3.333333',
  '6.666667',
  '6.666667',
  '3.333333',
  '3.333333',
  '3.333333',
  '6.666667'],
 ['6.666667', '6.666667', '6.666667', '3.333333', '6.666667'])

python
vals=sorted(set(lines))
vals

['3.333333', '6.666667']

python
bits = [0 if v=='3.333333' else 1 for v in lines]
len(bits), sum(bits)

(272, 132)

python
def bits_to_bytes_simple(bits, msb_first=True):
    b=[]
    for i in range(0,len(bits),8):
        byte_bits=bits[i:i+8]
        if not msb_first:
            byte_bits = byte_bits[::-1]
        val=0
        for bit in byte_bits:
            val=(val<<1)|bit
        b.append(val)
    return bytes(b)
b1=bits_to_bytes_simple(bits, msb_first=True)
b2=bits_to_bytes_simple(bits, msb_first=False)
b1[:50], b2[:50]

(b'last part: Future_0f_Im4ge_F0rm4t}',
 b'6\x86\xce.\x04\x0e\x86N.\\\x04b\xae.\xaeN\xa6\xfa\x0cf\xfa\x92\xb6,\xe6\xa6\xfab\x0cN\xb6,.\xbe')

python
b1, b1.decode('ascii')

(b'last part: Future_0f_Im4ge_F0rm4t}', 'last part: Future_0f_Im4ge_F0rm4t}')

python
decoded_str = b1.decode('ascii')
decoded_str

'last part: Future_0f_Im4ge_F0rm4t}'