1. Problem solving environment
windows7
2. Test points: the use of binwalk
Discovery of test sites and problem-solving process (this can be done for misc questions of png images):
1. Unzip the zip file, open misc10.png with winhex
2. Determine whether the file format has been tampered with, check the header and tail of the png file, the file format is normal
PNG file header (hex): 89 50 4e 47 0d 0a 1a 0a
PNG file Tail (hex): 00 00 00 00 49 45 4E 44 AE 42 60 82
3. Determine whether there is a file binary merge, search the png file header 8950, and find that there is only one, and the binary merge file is not used
4. Determine whether to modify the width and height of the png image , using crc verification tools such as TweakPNG or pngcheck, it is found that the width and height of the picture are normal.
5. Use Stegsolve.jar to check whether the picture has changed background color and hidden color blocks, and found that misc10.png is normal.
6. Finally, use binwalk to execute python -m binwalk -e misc10.pngand find that there is a situation (if you are familiar with zlib file analysis, you can also write python scripts for analysis by yourself ~)
7. Open the 10E5 file with winhex to see the flag
3. Difficulties: Install binwalk under windows!!!
The binwalk installation steps are as follows:
1. Install python environment
Refer to my article [1. Install python environment]
2. Download binwalk
In the binwalk github address,一定要选2.3.2
click [+8 releases] to find the historical version [Binwalk 2.3.2]. The latest version of binwalk (Binwalk2.3.3) can only run under linux. If you dislike the slow download speed of github, you can use the following method
a) Right-click the download link, [Copy Link]
b) Open the github file download acceleration website and paste the link into it
3. Unzip the zip package and install binwalk
a). Execute in the zip package decompression directorypython setup.py build
b). Execute after successful buildpython setup.py install
4. Execute in the image directory that needs to be analyzedpython -m binwalk -e misc10.png