1. Problem solving environment
windows7
2. Test point: the use of TweakPNG
You can read the article I wrote before for the MISC general problem-solving steps of PNG
Three, misc11 problem-solving steps
1. Unzip the zip file, open misc11.png with winhex
2. Determine whether the file format has been tampered with, check the header and tail of the png file, the file format is normal
PNG file header (hex): 89 50 4e 47 0d 0a 1a 0a
PNG file tail (hex): 00 00 00 00 49 45 4E 44 AE 42 60 82
3. Determine whether there is a file binary merge, search the png file header 8950, and find that there is only one, and the binary merge file is not used
4. Determine whether to modify the width and height of the png image, Open it with TweakPNG and find that the width and height of the picture are normal, but the length of the first IDAT is smaller than the length of the second IDAT, that is to say, the first data block is not fully covered and the second data block is started, and the traces of artificial modification are obvious 5
. Select the first IDAT, press the [delete] key, and then press the [F7] key to preview the picture to get the flag
6. Use qq screenshots to extract text content, see previous articles for specific operations
Four, misc12 problem-solving steps
1. Unzip the zip file, open misc11.png with winhex
2. Determine whether the file format has been tampered with, check the header and tail of the png file, the file format is normal
PNG file header (hex): 89 50 4e 47 0d 0a 1a 0a
PNG file tail (hex): 00 00 00 00 49 45 4E 44 AE 42 60 82
3. Determine whether there is a file binary merge, search the png file header 8950, and find that there is only one, and the binary merge file is not used
4. Determine whether to modify the width and height of the png image, Use TweakPNG to open it, and find that the width and height of the picture are normal, but the size of the IDAT is not covered block by block, and the traces of artificial modification are large
. , you can see the flag
6. Use the qq screenshot to extract the text content, the specific operation can be found in previous articles