[CTF-MISC] [Image steganography] How to determine the width and height of the picture has been modified

Analyzing image editing width and height

Image steganography problem modify the width and height of the picture is one of very common means, how to quickly modify the width and height of the picture judge it?

1. Use windows to view the image properties, you will find the aspect of data attributes in height and hexadecimal software (010Editor, winhex, hxd) in providing not the same, this time we can suspect that the width and height is modified.
   Note: Sometimes the same, so the same does not mean not being modified

2. Pictures into 010Editor, loaded automatically comes Template, you will be prompted CRC does not match the lower left corner, this is because the amendment to the aspect, but did not modify the CRC, leading to read error.
   See this prompt, indicating that the picture aspect is likely to be modified.
   

3. pngcheck, tweakpng check images will find, it will prompt CRC errors.
   
   

4. Modify high or wide, and then view the picture will find pictures of the accident, it does not display, which shows the width or height can not be changed, and if the normal display, indicating the width and height is modified, just to big to repair.
   

---

Frequently Asked Questions treatment

1. Modify the width and height, you can directly see the flag, there is no need to do other work.
2. Modify the width and height, and will not see the flag, and you need into stegsolve in or do other further processing.
   A problem arises here, and that is too broad to modify high picture stegsolve can not open, suggesting IO error.
   This is because the IHDR segment png image aspect is modified, resulting in calculated CRC is not correct, it can not be read correctly.
   There are two ways to process:

• Use script blasting through brute force way, blasting a modified width and height
  png CRC check errors in analysis
  Arnhem 2019-07 real CTFer in the script
  direct reference here to the script written by others, python2 run.
  By means of collision, calculate the real width and height, and then modify the width and height of the image real width and height.

#!/usr/bin/env python
# encoding: utf-8

# -*- coding: utf-8 -*-
import binascii
import struct

#这段数据就是png图中IHDR段的16进制数据，不包括开始的length和最后CRC
#\x49\x48\x44\x52\x00\x00\x05\x1C\x00\x00\x05\x00\x08\x06\x00\x00\x00
#其中\x00\x00\x05\x1C表示宽度，\x00\x00\x05\x00表示高度

crc32key = 0x6F03AD71#IHDR段中CRC值
for i in range(0, 65535):
	height = struct.pack('>i', i)#将整数转化成16进制
	#compute height
	data = '\x49\x48\x44\x52\x00\x00\x05\x1c'+height+'\x08\x06\x00\x00\x00'
	#compute width
	#data = '\x49\x48\x44\x52'+height+'\x00\x00\x09\xe4\x08\x06\x00\x00\x00'

	crc32result = binascii.crc32(data) & 0xffffffff

	if crc32result == crc32key:
		print ''.join(map(lambda c: "%02X" % ord(c), height))

• The second method is more simple, the modified picture, right-click Edit under the windows, and then save it.