Points: 100

Tags: forensics 

Poll rating:

Writeups

ActionRatingAuthor team
Read writeup
5.0
N0Named
You need to authenticate and join a team to post writeups evandrixFeb. 23, 2021, 3:58 p.m.

import struct

def u32(b):
return struct.unpack('>I', b)[0]

with open('fixme.png', 'rb') as f:
data = f.read()

def parse_chunk(data, pos):
length = u32(data[pos:pos+4])
name = data[pos+4:pos+8]
print(f'{pos:08x} {name.decode()}')
pos += 8 # length and name
pos += length # data
pos += 4 # checksum
return pos

# skip header
pos = 8

# skip 4 chunks
for _ in range(4):
pos = parse_chunk(data, pos)

while (idat:=data.find(b'IDAT', pos)) > 0:
data = data[:pos] + data[idat-4:]
pos = parse_chunk(data, pos)

with open('fixed.png', 'wb') as f:
f.write(data)