And a picture, it is also simply
thought a:
JPG change the width and height, where the segment is beginning FFC0 fixed width and height, look directly into the winhex FF
It is strange that no APP0 segments, namely FF E0
. 1 0000 - 0001 : the FF D8 (Header) 2 . 3 0002 - 0013 : the APP0 segment (JFIF application data block) where: . 4 0002 - 0003 : the FF E0 (segment marker) . 5 0004 - 0005 : 00 10 (length = 16 byte) . 6 0006 -000A:. 4A 46 is 49 46 is 00 ( "the JFIF" ASCII code) . 7 000B-000C: 01 01 (major and minor version number = 1.01 ) . 8 000D: 01 (density in dots / inch) . 9 000E - 0011 : 00 60 00 60 (both horizontal and vertical density of 96 pixels per inch) 10 0012 - 0013 : 00 00 (no thumbnail) . 11 12 is 0014 - 0058 : DQT segment, wherein: 13 is 0014 - 0015 : the FF DB (segment marker) 14 0016 - 0017 : 00 43 is (length = 67 bytes) 15 0018 : 00 (QT number = 0 , QT precision 8bit =) 16 0019 - 0058 : QT . 17 18 is 0059 - 009D: DQT segment, wherein: . 19 0059 -005A: FF DB (segment marker) 20 is 005B-005C: 00 43 is (length = 67 bytes) 21 is 005D: 01 (No. QT = . 1 , QT precision 8bit =) 22 is 005E-009D : QT 23 is 24 009E- 00B0: SOF0 section, wherein: 25 009E-009F : the FF C0 (segment marker) 26 is 00A0-00A1: 00 . 11 (length = 17 bytes) 27 00A2: 08 (sample precision 8bit =) 28 00A3-00A6: 00 18 is 00 20 is (image height = 24 , the image width = 32 ) 29 00A7: 03 (= the number of components. 3 , the YCbCr color image) 30 00A8: 01 (ID number = 1 , which is the luminance component Y) 31 is 00A9: 22 is (= into binary 00100010 , indicating that both the vertical and horizontal sampling factor = 2 ) 32 00AA: 00 (using QT quantization table number = 0) 33 is 00AB: 02 (ID number = 2 , which is the chrominance component Cb) 34 is 00AC: . 11 (into binary = 00010001 , shows that both the vertical and horizontal sampling factor = . 1 ) 35 00AD: 01 ( QT = number using the quantization table 1) 36 00AE: 03 (ID number = 3 , which is the chrominance component Cr) 37 [ 00AF:11 (= into binary 00010001 , indicating both the vertical and horizontal sampling factor = 1 ) 38 is 00B0: 01 (QT using quantization table number = 1) 39 40 00B1- 00D1: the DHT segment, wherein: 41 is 00B1- 00B2: the FF C4 (segment marker) 42 is 00B3-00B4: 00 1F (length = 31 bytes) 43 is 00B5: 00 (HT number = 0 , the DC table) 44 is 00B6-00C5: it = 16 figures and 12 , described below HT value table length = 12 bytes) 45 00C6- 00D1: HT value table 46 is 47 00D2- 0188 : the DHT segment, which is an AC HT table number = 0, with reference to the above analysis 48 0189 -01A9: DHT segment, which is a DC HT table number = 1, with reference to the above analysis 49 01AA- 0260 : the DHT segment, which is the number of HT = AC Table 1, with reference to the above analysis 50 51 is 0261 - 026E: the SOS section, wherein: 52 is 0261 - 0262 : the FF the DA (segment marker) 53 is 0263 - 0264 : 00 0C (length = 12 bytes) 54 is 0265 : 03 (= the number of component 3 ) 55 0266 - 0267 : 01 00 (= component ID . 1 , the Y assembly, using the HT table No. = AC 0) 56 is 0268 - 0269 : 02 . 11 (= component ID 2, Cb component, using the HT No. = DC Table 1) 57 is 026A-026B: 03 . 11 (component ID = . 3 , of Cr component, using the HT No. = DC Table 1) 58 026C-026E: 00 3F 00 (almost each file JPG this 3-byte values are the same, but the use of unknown) 59 60 026F- 0282 : compressing image data 61 is 62 is 0283 - 0284 : the FF D9 (end of file)
He did not succeed.
Two ideas
appear after linux under binwalk:
Pictures wrapped inside three images: cut out
The first (original): 
Picture content:
Second, almost a third operation, but they are thumbnails, see:
There is a rdf, what the hell?
Search of the investigation seems to be the knowledge spectrum, similar to the one kind of xml file format is the format used to store information
After cutting out pictures from the inside to open with vim:
Shows some of the formatting information of the picture.
Guess
see this picture I think, the picture is missing, we have to change the height to see the full face
WinHex thrown, as shown, the structure of the file header (13 bytes total, width and height of each of four, five months after a byte):
Modify the height, right: following completion of the above head is not shown.
Exchange ideas: Baidu knowledge map, appears directly result: fairy sister - Liu Yifei
Original from: https://blog.csdn.net/changer_WE/article/details/85758845