png-zip: pack/unpack files inside PNG images
Supports three packing modes: - append (default) — data after IEND marker - chunk — private pnZp PNG chunk - lsb — least significant bits of pixels Includes Python (pack.py/unpack.py) and PowerShell (pack.ps1/unpack.ps1) implementations with full cross-compatibility. Features: self-extract bootstrap, metadata one-liners (eXIf/tEXt), CRC32 integrity check, PNG clean mode.
This commit is contained in:
Struchkov Mark
3
.gitignore
vendored
Normal file
3
.gitignore
vendored
Normal file
@@ -0,0 +1,3 @@
|
|||||||
|
__pycache__/
|
||||||
|
.DS_Store
|
||||||
|
*.pyc
|
||||||
80
POWERSHELL.md
Normal file
80
POWERSHELL.md
Normal file
@@ -0,0 +1,80 @@
|
|||||||
|
# png-zip: PowerShell версия
|
||||||
|
|
||||||
|
Упаковка и распаковка файлов внутри PNG без Python. Только PowerShell 5.1+ (встроен в Windows 10/11).
|
||||||
|
|
||||||
|
## Упаковка
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
powershell -File pack.ps1 cover.png secret.txt -Output packed.png
|
||||||
|
```
|
||||||
|
|
||||||
|
### Self-extract
|
||||||
|
|
||||||
|
Встраивает `unpack.ps1` внутрь PNG — на целевой машине не нужны никакие скрипты:
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
powershell -File pack.ps1 cover.png secret.txt -Output bootstrap.png -SelfExtract
|
||||||
|
```
|
||||||
|
|
||||||
|
Внутри `bootstrap.png`: `unpack.ps1` + `secret.txt`. Извлечение на целевой машине — см. раздел «Bootstrap».
|
||||||
|
|
||||||
|
При `-SelfExtract` все bootstrap-однострочники (Python, Python CMD, PowerShell, PowerShell CMD) автоматически сохраняются в метаданных PNG — eXIf (EXIF UserComment) и tEXt (Comment). Их видно в свойствах файла:
|
||||||
|
|
||||||
|
- **Windows**: правый клик → Свойства → Details → Comments
|
||||||
|
- **PowerShell**: `exiftool bootstrap.png`
|
||||||
|
|
||||||
|
> Base64/EncodedCommand варианты генерируются динамически с реальным именем выходного файла.
|
||||||
|
|
||||||
|
## Распаковка
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
powershell -File unpack.ps1 packed.png
|
||||||
|
powershell -File unpack.ps1 packed.png -OutDir .\out
|
||||||
|
powershell -File unpack.ps1 packed.png -List
|
||||||
|
powershell -File unpack.ps1 packed.png -All
|
||||||
|
```
|
||||||
|
|
||||||
|
## Bootstrap: доставка без ничего
|
||||||
|
|
||||||
|
На целевой машине есть только `bootstrap.png` (созданный с `-SelfExtract`) и PowerShell.
|
||||||
|
|
||||||
|
### 1. Извлечь unpack.ps1 однострочником
|
||||||
|
|
||||||
|
Замените `IMG` на имя вашего файла:
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
$d=[IO.File]::ReadAllBytes('IMG');$t=[Text.Encoding]::GetEncoding(28591).GetString($d);$s='PNGZIP';$i=-1;do{$i=$t.IndexOf($s,$i+1,[StringComparison]::Ordinal)}while($i-ge0-and($d[$i+6]-ne0-or$d[$i+7]-ne1));$p=$i+8;$nl=$d[$p]*256+$d[$p+1];$p+=2;$n=[Text.Encoding]::UTF8.GetString($d,$p,$nl);$p+=$nl;$pl=[uint64]0;for($k=0;$k-lt8;$k++){$pl=$pl*256+$d[$p+$k]};$p+=8;$ms=New-Object IO.MemoryStream;$ms.Write($d,$p+2,$pl-6);[void]$ms.Seek(0,0);$ds=New-Object IO.Compression.DeflateStream($ms,[IO.Compression.CompressionMode]::Decompress);$os=New-Object IO.MemoryStream;$ds.CopyTo($os);[IO.File]::WriteAllBytes($n,$os.ToArray());Write-Host "Extracted: $n"
|
||||||
|
```
|
||||||
|
|
||||||
|
Ищет первый `PNGZIP` с байтами `\x00\x01` после — это встроенный `unpack.ps1`.
|
||||||
|
|
||||||
|
**Windows CMD** — готовый EncodedCommand-однострочник (с уже подставленным именем файла) выводится при паковке и сохраняется в метаданных PNG. Скопируйте из консоли или из свойств файла (Details → Comments).
|
||||||
|
|
||||||
|
### 2. Извлечь основной файл
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
powershell -File unpack.ps1 bootstrap.png
|
||||||
|
```
|
||||||
|
|
||||||
|
### Однострочник (без bootstrap)
|
||||||
|
|
||||||
|
Извлечь последний payload напрямую (если self-extract не использовался). Замените `IMG` на имя файла:
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
$d=[IO.File]::ReadAllBytes('IMG');$t=[Text.Encoding]::GetEncoding(28591).GetString($d);$s='PNGZIP';$i=$d.Length;do{$i=$t.LastIndexOf($s,$i-1,[StringComparison]::Ordinal)}while($i-ge0-and($d[$i+6]-ne0-or$d[$i+7]-ne1));$p=$i+8;$nl=$d[$p]*256+$d[$p+1];$p+=2;$n=[Text.Encoding]::UTF8.GetString($d,$p,$nl);$p+=$nl;$pl=[uint64]0;for($k=0;$k-lt8;$k++){$pl=$pl*256+$d[$p+$k]};$p+=8;$ms=New-Object IO.MemoryStream;$ms.Write($d,$p+2,$pl-6);[void]$ms.Seek(0,0);$ds=New-Object IO.Compression.DeflateStream($ms,[IO.Compression.CompressionMode]::Decompress);$os=New-Object IO.MemoryStream;$ds.CopyTo($os);[IO.File]::WriteAllBytes($n,$os.ToArray());Write-Host "Extracted: $n"
|
||||||
|
```
|
||||||
|
|
||||||
|
## Очистка PNG
|
||||||
|
|
||||||
|
Удалить все встроенные данные (payload, bootstrap-метаданные eXIf/tEXt):
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
powershell -File pack.ps1 packed.png -Clean -Output clean.png
|
||||||
|
```
|
||||||
|
|
||||||
|
## Ограничения
|
||||||
|
|
||||||
|
- Только append-режим. Для chunk и lsb используйте Python-версию (`pack.py` / `unpack.py`).
|
||||||
|
- CRC32 и Adler32 реализованы через inline C# (`Add-Type`), первый запуск чуть медленнее из-за компиляции.
|
||||||
|
- Для файлов > 100 MB может быть медленнее Python-версии.
|
||||||
|
- Формат payload полностью совместим с Python-версией — можно паковать на одной ОС, распаковывать на другой.
|
||||||
193
README.md
Normal file
193
README.md
Normal file
@@ -0,0 +1,193 @@
|
|||||||
|
# png-zip
|
||||||
|
|
||||||
|
Утилита для упаковки произвольных файлов внутрь PNG-изображений. Выходной файл — валидный PNG, который открывается в любом просмотрщике как обычная картинка.
|
||||||
|
|
||||||
|
Зависимости: Python 3.6+ (только стандартная библиотека).
|
||||||
|
|
||||||
|
## Режимы упаковки
|
||||||
|
|
||||||
|
| Режим | Флаг | Где хранится payload | Устойчивость |
|
||||||
|
|-------|------|---------------------|-------------|
|
||||||
|
| **append** (по умолчанию) | `-m append` | После IEND маркера | Базовые проверки `file`, imagemagick |
|
||||||
|
| **chunk** | `-m chunk` | Приватный PNG-чанк `pnZp` | Строгая PNG-валидация (libpng, pngcheck) |
|
||||||
|
| **lsb** | `-m lsb` | Младшие биты пикселей | CDR, re-encode, строгие валидаторы |
|
||||||
|
|
||||||
|
### append (по умолчанию)
|
||||||
|
PNG-файлы заканчиваются маркером IEND. Все PNG-декодеры игнорируют данные после него. Утилита дописывает сжатый payload после IEND.
|
||||||
|
|
||||||
|
```
|
||||||
|
[PNG: signature + chunks + IEND] [magic + имя файла + zlib-payload + CRC32]
|
||||||
|
```
|
||||||
|
|
||||||
|
### chunk
|
||||||
|
Payload упаковывается в приватный PNG-чанк `pnZp` перед IEND. Файл полностью валиден по спецификации PNG — приватные чанки разрешены и игнорируются декодерами. Если payload > 2 MB, разбивается на несколько чанков с sequence number.
|
||||||
|
|
||||||
|
```
|
||||||
|
[signature] [IHDR] ... [pnZp: payload] [IEND]
|
||||||
|
```
|
||||||
|
|
||||||
|
### lsb
|
||||||
|
Payload записывается в младшие биты (LSB) каждого байта пикселей. Визуально изображение неотличимо от оригинала (изменение ±1 в каждом канале). Поддерживаются 8-bit RGB и RGBA PNG без interlacing.
|
||||||
|
|
||||||
|
Ёмкость: `width × height × channels / 8` байт. Например, 1000×1000 RGB = ~375 KB.
|
||||||
|
|
||||||
|
## Использование
|
||||||
|
|
||||||
|
### Упаковка
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Append mode (по умолчанию)
|
||||||
|
python3 pack.py cover.png secret.tar.gz -o output.png
|
||||||
|
|
||||||
|
# Chunk mode — проходит строгую PNG-валидацию
|
||||||
|
python3 pack.py -m chunk cover.png secret.tar.gz -o output.png
|
||||||
|
|
||||||
|
# LSB mode — выживает CDR и re-encode
|
||||||
|
python3 pack.py -m lsb cover.png secret.tar.gz -o output.png
|
||||||
|
```
|
||||||
|
|
||||||
|
`output.png` выглядит как `cover.png`, но содержит `secret.tar.gz` внутри.
|
||||||
|
|
||||||
|
### Распаковка
|
||||||
|
|
||||||
|
```bash
|
||||||
|
python3 unpack.py output.png
|
||||||
|
```
|
||||||
|
|
||||||
|
Извлекает файл с оригинальным именем в текущую директорию. Режим определяется автоматически.
|
||||||
|
|
||||||
|
### Распаковка в заданную директорию
|
||||||
|
|
||||||
|
```bash
|
||||||
|
python3 unpack.py output.png -o ./extracted/
|
||||||
|
```
|
||||||
|
|
||||||
|
### Просмотр содержимого
|
||||||
|
|
||||||
|
```bash
|
||||||
|
python3 unpack.py output.png -l
|
||||||
|
```
|
||||||
|
|
||||||
|
```
|
||||||
|
secret.tar.gz (148230 bytes)
|
||||||
|
```
|
||||||
|
|
||||||
|
### Извлечь все вложенные файлы
|
||||||
|
|
||||||
|
```bash
|
||||||
|
python3 unpack.py output.png -a
|
||||||
|
```
|
||||||
|
|
||||||
|
Полезно для self-extract образов, где внутри несколько файлов (unpack.py + payload).
|
||||||
|
|
||||||
|
## Bootstrap: доставка на VM без ничего
|
||||||
|
|
||||||
|
Если на целевой машине нет `unpack.py` и передать можно только картинки:
|
||||||
|
|
||||||
|
### 1. На хосте — создаём bootstrap-образ
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Встроить unpack.py (для машин с Python)
|
||||||
|
python3 pack.py --self-extract cover.png secret.tar.gz -o bootstrap.png
|
||||||
|
|
||||||
|
# Встроить unpack.ps1 (для Windows без Python)
|
||||||
|
python3 pack.py --self-extract-ps cover.png secret.tar.gz -o bootstrap.png
|
||||||
|
|
||||||
|
# Встроить оба распаковщика
|
||||||
|
python3 pack.py --self-extract --self-extract-ps cover.png secret.tar.gz -o bootstrap.png
|
||||||
|
```
|
||||||
|
|
||||||
|
> `--self-extract` / `--self-extract-ps` работают только с append режимом.
|
||||||
|
|
||||||
|
При использовании любого `--self-extract` флага bootstrap-однострочники автоматически сохраняются в метаданных PNG — в eXIf (EXIF UserComment) и tEXt (Comment) чанках. Их можно посмотреть:
|
||||||
|
|
||||||
|
- **Windows**: правый клик → Свойства → Details → Comments (читает eXIf)
|
||||||
|
- **macOS/Linux**: `identify -verbose bootstrap.png | grep -A 20 Comment`
|
||||||
|
- **Любая ОС**: `exiftool bootstrap.png`
|
||||||
|
|
||||||
|
> Base64/EncodedCommand варианты генерируются динамически — в метаданных будет реальное имя выходного файла, а не `bootstrap.png`. Примеры ниже приведены для имени `bootstrap.png`.
|
||||||
|
|
||||||
|
### 2. Передаём `bootstrap.png` на VM
|
||||||
|
|
||||||
|
Это валидный PNG — пройдёт любую проверку на изображение.
|
||||||
|
|
||||||
|
### 3. На VM — извлекаем распаковщик однострочником
|
||||||
|
|
||||||
|
Однострочник извлекает **первый** встроенный файл (распаковщик). Замените `IMG` на имя вашего файла:
|
||||||
|
|
||||||
|
**Python (Linux / macOS / PowerShell):**
|
||||||
|
|
||||||
|
```bash
|
||||||
|
python3 -c "d=open('IMG','rb').read();i=d.find(b'PNGZIP\x00\x01');nl=int.from_bytes(d[i+8:i+10],'big');n=d[i+10:i+10+nl].decode();pl=int.from_bytes(d[i+10+nl:i+18+nl],'big');import zlib;open(n,'wb').write(zlib.decompress(d[i+18+nl:i+18+nl+pl]));print('Extracted:',n)"
|
||||||
|
```
|
||||||
|
|
||||||
|
**PowerShell (без Python):**
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
$d=[IO.File]::ReadAllBytes('IMG');$t=[Text.Encoding]::GetEncoding(28591).GetString($d);$s='PNGZIP';$i=-1;do{$i=$t.IndexOf($s,$i+1,[StringComparison]::Ordinal)}while($i-ge0-and($d[$i+6]-ne0-or$d[$i+7]-ne1));$p=$i+8;$nl=$d[$p]*256+$d[$p+1];$p+=2;$n=[Text.Encoding]::UTF8.GetString($d,$p,$nl);$p+=$nl;$pl=[uint64]0;for($k=0;$k-lt8;$k++){$pl=$pl*256+$d[$p+$k]};$p+=8;$ms=New-Object IO.MemoryStream;$ms.Write($d,$p+2,$pl-6);[void]$ms.Seek(0,0);$ds=New-Object IO.Compression.DeflateStream($ms,[IO.Compression.CompressionMode]::Decompress);$os=New-Object IO.MemoryStream;$ds.CopyTo($os);[IO.File]::WriteAllBytes($n,$os.ToArray());Write-Host "Extracted: $n"
|
||||||
|
```
|
||||||
|
|
||||||
|
**Windows CMD** — готовые однострочники с base64/EncodedCommand (не нужно менять имя файла) выводятся при паковке и сохраняются в метаданных PNG. Скопируйте из:
|
||||||
|
- Вывода `pack.py` / `pack.ps1` в консоли
|
||||||
|
- Свойств файла: правый клик → Свойства → Details → Comments
|
||||||
|
|
||||||
|
### 4. Извлекаем основной файл
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Python
|
||||||
|
python3 unpack.py bootstrap.png
|
||||||
|
|
||||||
|
# PowerShell
|
||||||
|
powershell -File unpack.ps1 bootstrap.png
|
||||||
|
```
|
||||||
|
|
||||||
|
Дальше распаковщик уже есть на VM и можно передавать обычные packed-образы.
|
||||||
|
|
||||||
|
### Очистка PNG от встроенных данных
|
||||||
|
|
||||||
|
Удалить все payload'ы (append, chunk) и bootstrap-метаданные (eXIf, tEXt) из PNG:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
python3 pack.py --clean packed.png -o clean.png
|
||||||
|
```
|
||||||
|
|
||||||
|
После очистки PNG возвращается к исходному виду (без trailing data, без pnZp-чанков, без bootstrap-комментариев).
|
||||||
|
|
||||||
|
## Советы
|
||||||
|
|
||||||
|
**Упаковка нескольких файлов** — сначала создайте архив:
|
||||||
|
```bash
|
||||||
|
tar czf bundle.tar.gz file1.txt file2.bin dir/
|
||||||
|
python3 pack.py cover.png bundle.tar.gz -o output.png
|
||||||
|
```
|
||||||
|
|
||||||
|
**Выбор обложки** — используйте любой PNG. Чем крупнее картинка, тем естественнее выглядит увеличение размера файла. Для LSB режима нужна достаточно большая картинка (ёмкость ≈ `W×H×channels/8` байт).
|
||||||
|
|
||||||
|
**Проверка целостности** — при распаковке автоматически проверяется CRC32. Если файл повреждён при передаче, будет предупреждение.
|
||||||
|
|
||||||
|
## PowerShell версия
|
||||||
|
|
||||||
|
Для Windows без Python есть полная PowerShell-реализация (`pack.ps1` / `unpack.ps1`) — см. [POWERSHELL.md](POWERSHELL.md).
|
||||||
|
|
||||||
|
Формат payload полностью совместим — можно паковать Python'ом, распаковывать PowerShell'ом и наоборот:
|
||||||
|
|
||||||
|
| Упаковка | Распаковка | |
|
||||||
|
|----------|-----------|---|
|
||||||
|
| `pack.py` | `unpack.ps1` | да |
|
||||||
|
| `pack.ps1` | `unpack.py` | да |
|
||||||
|
| `pack.py --self-extract` | Python однострочник | да |
|
||||||
|
| `pack.py --self-extract-ps` | PS однострочник | да |
|
||||||
|
| `pack.ps1 -SelfExtract` | PS однострочник | да |
|
||||||
|
|
||||||
|
> PowerShell версия поддерживает только append-режим. Для chunk и lsb нужен Python.
|
||||||
|
|
||||||
|
## Ограничения
|
||||||
|
|
||||||
|
- **append/chunk**: если система передачи пережимает PNG (ресайз, re-encode) — данные будут потеряны. Для file-based трансферов (SCP, cloud storage, вложения в email, передача «как файл» в мессенджерах) проблем нет.
|
||||||
|
- **lsb**: выживает re-encode без потерь (PNG→PNG), но не выживает lossy конвертацию (PNG→JPEG). Ёмкость ограничена размером изображения. Поддерживаются только 8-bit RGB/RGBA PNG без interlacing.
|
||||||
|
- Payload загружается в память целиком. Для файлов > 500 MB может потребоваться много RAM.
|
||||||
|
- Данные не шифруются. Для конфиденциальности — зашифруйте файл перед упаковкой:
|
||||||
|
```bash
|
||||||
|
gpg -c secret.tar.gz # создаст secret.tar.gz.gpg
|
||||||
|
python3 pack.py cover.png secret.tar.gz.gpg -o output.png
|
||||||
|
```
|
||||||
271
pack.ps1
Normal file
271
pack.ps1
Normal file
@@ -0,0 +1,271 @@
|
|||||||
|
# pack.ps1 — Pack a file inside a PNG image (append after IEND)
|
||||||
|
# Usage: powershell -File pack.ps1 cover.png secret.txt [-Output packed.png] [-SelfExtract]
|
||||||
|
# powershell -File pack.ps1 packed.png -Clean [-Output clean.png]
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory, Position=0)][string]$Cover,
|
||||||
|
[Parameter(Position=1)][string]$Payload,
|
||||||
|
[string]$Output = "packed.png",
|
||||||
|
[switch]$SelfExtract,
|
||||||
|
[switch]$Clean
|
||||||
|
)
|
||||||
|
|
||||||
|
Add-Type -TypeDefinition @"
|
||||||
|
using System;
|
||||||
|
public static class PngZipHelper {
|
||||||
|
static readonly uint[] crcTable;
|
||||||
|
static PngZipHelper() {
|
||||||
|
crcTable = new uint[256];
|
||||||
|
for (uint i = 0; i < 256; i++) {
|
||||||
|
uint c = i;
|
||||||
|
for (int j = 0; j < 8; j++)
|
||||||
|
c = (c & 1) != 0 ? 0xEDB88320u ^ (c >> 1) : c >> 1;
|
||||||
|
crcTable[i] = c;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
public static uint Crc32(byte[] data) {
|
||||||
|
uint crc = 0xFFFFFFFF;
|
||||||
|
foreach (byte b in data) crc = crcTable[(crc ^ b) & 0xFF] ^ (crc >> 8);
|
||||||
|
return crc ^ 0xFFFFFFFF;
|
||||||
|
}
|
||||||
|
public static uint Adler32(byte[] data) {
|
||||||
|
uint a = 1, b = 0;
|
||||||
|
foreach (byte d in data) { a = (a + d) % 65521; b = (b + a) % 65521; }
|
||||||
|
return (b << 16) | a;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
"@
|
||||||
|
|
||||||
|
function Write-BE16([System.IO.Stream]$s, [uint16]$v) {
|
||||||
|
$s.WriteByte(($v -shr 8) -band 0xFF)
|
||||||
|
$s.WriteByte($v -band 0xFF)
|
||||||
|
}
|
||||||
|
function Write-BE32([System.IO.Stream]$s, [uint32]$v) {
|
||||||
|
$s.WriteByte(($v -shr 24) -band 0xFF)
|
||||||
|
$s.WriteByte(($v -shr 16) -band 0xFF)
|
||||||
|
$s.WriteByte(($v -shr 8) -band 0xFF)
|
||||||
|
$s.WriteByte($v -band 0xFF)
|
||||||
|
}
|
||||||
|
function Write-BE64([System.IO.Stream]$s, [uint64]$v) {
|
||||||
|
for ($i = 56; $i -ge 0; $i -= 8) { $s.WriteByte(($v -shr $i) -band 0xFF) }
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Read cover PNG ──
|
||||||
|
$coverData = [IO.File]::ReadAllBytes((Resolve-Path $Cover))
|
||||||
|
$sig = [byte[]](0x89,0x50,0x4E,0x47,0x0D,0x0A,0x1A,0x0A)
|
||||||
|
for ($i = 0; $i -lt 8; $i++) {
|
||||||
|
if ($coverData[$i] -ne $sig[$i]) { Write-Error "Not a valid PNG"; exit 1 }
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Clean PNG: strip pnZp chunks + bootstrap comments + trailing data after IEND ──
|
||||||
|
function Get-CleanPng([byte[]]$Data) {
|
||||||
|
$ms = New-Object IO.MemoryStream
|
||||||
|
$ms.Write($sig, 0, 8)
|
||||||
|
$pos = 8
|
||||||
|
while ($pos + 8 -le $Data.Length) {
|
||||||
|
$cLen = $Data[$pos]*16777216 + $Data[$pos+1]*65536 + $Data[$pos+2]*256 + $Data[$pos+3]
|
||||||
|
$cType = [Text.Encoding]::ASCII.GetString($Data, $pos+4, 4)
|
||||||
|
$cSize = 4 + 4 + $cLen + 4 # len + type + data + crc
|
||||||
|
$skip = $false
|
||||||
|
if ($cType -eq "pnZp") { $skip = $true }
|
||||||
|
if ($cType -eq "tEXt" -and $cLen -gt 0) {
|
||||||
|
$chunkText = [Text.Encoding]::GetEncoding(28591).GetString($Data, $pos+8, $cLen)
|
||||||
|
if ($chunkText.Contains("png-zip bootstrap")) { $skip = $true }
|
||||||
|
}
|
||||||
|
if ($cType -eq "eXIf" -and $cLen -gt 0) {
|
||||||
|
$chunkText = [Text.Encoding]::GetEncoding(28591).GetString($Data, $pos+8, $cLen)
|
||||||
|
if ($chunkText.Contains("png-zip bootstrap")) { $skip = $true }
|
||||||
|
}
|
||||||
|
if (-not $skip) {
|
||||||
|
$ms.Write($Data, $pos, $cSize)
|
||||||
|
}
|
||||||
|
$pos += $cSize
|
||||||
|
if ($cType -eq "IEND") { break }
|
||||||
|
}
|
||||||
|
return $ms.ToArray()
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Build a raw PNG chunk: len(4) + type(4) + data + crc(4) ──
|
||||||
|
function Build-PngChunk([string]$Type, [byte[]]$ChunkData) {
|
||||||
|
$typeBytes = [Text.Encoding]::ASCII.GetBytes($Type)
|
||||||
|
$crcMs = New-Object IO.MemoryStream
|
||||||
|
$crcMs.Write($typeBytes, 0, 4)
|
||||||
|
$crcMs.Write($ChunkData, 0, $ChunkData.Length)
|
||||||
|
$crc = [PngZipHelper]::Crc32($crcMs.ToArray())
|
||||||
|
$ms = New-Object IO.MemoryStream
|
||||||
|
Write-BE32 $ms ([uint32]$ChunkData.Length)
|
||||||
|
$ms.Write($typeBytes, 0, 4)
|
||||||
|
$ms.Write($ChunkData, 0, $ChunkData.Length)
|
||||||
|
Write-BE32 $ms $crc
|
||||||
|
return $ms.ToArray()
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Insert chunk(s) into PNG after IHDR ──
|
||||||
|
function Add-ChunksAfterIHDR([byte[]]$Data, [byte[][]]$Chunks) {
|
||||||
|
$ms = New-Object IO.MemoryStream
|
||||||
|
$ms.Write($Data, 0, 8) # PNG signature
|
||||||
|
$pos = 8
|
||||||
|
while ($pos + 8 -le $Data.Length) {
|
||||||
|
$cLen = $Data[$pos]*16777216 + $Data[$pos+1]*65536 + $Data[$pos+2]*256 + $Data[$pos+3]
|
||||||
|
$cType = [Text.Encoding]::ASCII.GetString($Data, $pos+4, 4)
|
||||||
|
$cSize = 4 + 4 + $cLen + 4
|
||||||
|
$ms.Write($Data, $pos, $cSize)
|
||||||
|
if ($cType -eq "IHDR") {
|
||||||
|
foreach ($chunk in $Chunks) { $ms.Write($chunk, 0, $chunk.Length) }
|
||||||
|
}
|
||||||
|
$pos += $cSize
|
||||||
|
if ($cType -eq "IEND") { break }
|
||||||
|
}
|
||||||
|
return $ms.ToArray()
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Build minimal eXIf chunk data with UserComment ──
|
||||||
|
function Build-ExifUserComment([string]$Text) {
|
||||||
|
$ucPrefix = [Text.Encoding]::ASCII.GetBytes("ASCII")
|
||||||
|
$ucText = [Text.Encoding]::ASCII.GetBytes($Text)
|
||||||
|
# UserComment = "ASCII\x00\x00\x00" + text
|
||||||
|
$ucMs = New-Object IO.MemoryStream
|
||||||
|
$ucMs.Write($ucPrefix, 0, 5)
|
||||||
|
$ucMs.WriteByte(0); $ucMs.WriteByte(0); $ucMs.WriteByte(0)
|
||||||
|
$ucMs.Write($ucText, 0, $ucText.Length)
|
||||||
|
$uc = $ucMs.ToArray()
|
||||||
|
$ucLen = $uc.Length
|
||||||
|
# TIFF big-endian header + IFD0 (1 entry: ExifIFD ptr) + ExifIFD (1 entry: UserComment)
|
||||||
|
$exifIfdOffset = 26
|
||||||
|
$ucDataOffset = 44
|
||||||
|
$ms = New-Object IO.MemoryStream
|
||||||
|
# TIFF header
|
||||||
|
$ms.WriteByte(0x4D); $ms.WriteByte(0x4D) # "MM" big-endian
|
||||||
|
Write-BE16 $ms ([uint16]42)
|
||||||
|
Write-BE32 $ms ([uint32]8) # IFD0 offset
|
||||||
|
# IFD0: 1 entry
|
||||||
|
Write-BE16 $ms ([uint16]1)
|
||||||
|
Write-BE16 $ms ([uint16]0x8769) # ExifIFD tag
|
||||||
|
Write-BE16 $ms ([uint16]4) # type LONG
|
||||||
|
Write-BE32 $ms ([uint32]1) # count
|
||||||
|
Write-BE32 $ms ([uint32]$exifIfdOffset) # value
|
||||||
|
Write-BE32 $ms ([uint32]0) # next IFD
|
||||||
|
# ExifIFD: 1 entry
|
||||||
|
Write-BE16 $ms ([uint16]1)
|
||||||
|
Write-BE16 $ms ([uint16]0x9286) # UserComment tag
|
||||||
|
Write-BE16 $ms ([uint16]7) # type UNDEFINED
|
||||||
|
Write-BE32 $ms ([uint32]$ucLen) # count
|
||||||
|
Write-BE32 $ms ([uint32]$ucDataOffset) # value offset
|
||||||
|
Write-BE32 $ms ([uint32]0) # next IFD
|
||||||
|
# UserComment data
|
||||||
|
$ms.Write($uc, 0, $uc.Length)
|
||||||
|
return $ms.ToArray()
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Helper: write one payload block to stream ──
|
||||||
|
$magic = [byte[]](0x50,0x4E,0x47,0x5A,0x49,0x50,0x00,0x01) # PNGZIP\x00\x01
|
||||||
|
|
||||||
|
function Write-PayloadBlock([System.IO.Stream]$s, [string]$Name, [byte[]]$Raw) {
|
||||||
|
# Compress
|
||||||
|
$ms = New-Object IO.MemoryStream
|
||||||
|
$ds = New-Object IO.Compression.DeflateStream($ms, [IO.Compression.CompressionMode]::Compress)
|
||||||
|
$ds.Write($Raw, 0, $Raw.Length)
|
||||||
|
$ds.Close()
|
||||||
|
$deflated = $ms.ToArray()
|
||||||
|
|
||||||
|
# Build zlib stream: header(2) + deflate + adler32(4)
|
||||||
|
$adler = [PngZipHelper]::Adler32($Raw)
|
||||||
|
$zlibMs = New-Object IO.MemoryStream
|
||||||
|
$zlibMs.WriteByte(0x78); $zlibMs.WriteByte(0x9C)
|
||||||
|
$zlibMs.Write($deflated, 0, $deflated.Length)
|
||||||
|
Write-BE32 $zlibMs $adler
|
||||||
|
$compressed = $zlibMs.ToArray()
|
||||||
|
|
||||||
|
$crc = [PngZipHelper]::Crc32($Raw)
|
||||||
|
$nameBytes = [Text.Encoding]::UTF8.GetBytes($Name)
|
||||||
|
|
||||||
|
$s.Write($magic, 0, 8)
|
||||||
|
Write-BE16 $s ([uint16]$nameBytes.Length)
|
||||||
|
$s.Write($nameBytes, 0, $nameBytes.Length)
|
||||||
|
Write-BE64 $s ([uint64]$compressed.Length)
|
||||||
|
$s.Write($compressed, 0, $compressed.Length)
|
||||||
|
Write-BE32 $s $crc
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Clean mode ──
|
||||||
|
if ($Clean) {
|
||||||
|
$cleaned = Get-CleanPng $coverData
|
||||||
|
[IO.File]::WriteAllBytes($Output, $cleaned)
|
||||||
|
$beforeKB = [math]::Round($coverData.Length / 1024, 1)
|
||||||
|
$afterKB = [math]::Round($cleaned.Length / 1024, 1)
|
||||||
|
Write-Host "Cleaned: $Output ($afterKB KB, was $beforeKB KB)"
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
# ── Pack mode — payload required ──
|
||||||
|
if (-not $Payload) { Write-Error "Payload argument is required (unless -Clean)"; exit 1 }
|
||||||
|
|
||||||
|
# Auto-clean: strip existing payloads (append + pnZp) before packing
|
||||||
|
$cleanCover = Get-CleanPng $coverData
|
||||||
|
|
||||||
|
# Embed all bootstrap one-liners in PNG metadata (tEXt Comment) for self-extract
|
||||||
|
if ($SelfExtract) {
|
||||||
|
$outName = [IO.Path]::GetFileName($Output)
|
||||||
|
# Common tails
|
||||||
|
$pyTail = 'nl=int.from_bytes(d[i+8:i+10],''big'');n=d[i+10:i+10+nl].decode();pl=int.from_bytes(d[i+10+nl:i+18+nl],''big'');import zlib;open(n,''wb'').write(zlib.decompress(d[i+18+nl:i+18+nl+pl]));print(''Extracted:'',n)"'
|
||||||
|
$psTail = '$p=$i+8;$nl=$d[$p]*256+$d[$p+1];$p+=2;$n=[Text.Encoding]::UTF8.GetString($d,$p,$nl);$p+=$nl;$pl=[uint64]0;for($k=0;$k-lt8;$k++){$pl=$pl*256+$d[$p+$k]};$p+=8;$ms=New-Object IO.MemoryStream;$ms.Write($d,$p+2,$pl-6);[void]$ms.Seek(0,0);$ds=New-Object IO.Compression.DeflateStream($ms,[IO.Compression.CompressionMode]::Decompress);$os=New-Object IO.MemoryStream;$ds.CopyTo($os);[IO.File]::WriteAllBytes($n,$os.ToArray());Write-Host "Extracted: $n"'
|
||||||
|
$psHead = '$d=[IO.File]::ReadAllBytes(''IMG'');$t=[Text.Encoding]::GetEncoding(28591).GetString($d);'
|
||||||
|
$psHead = $psHead.Replace('IMG', $outName)
|
||||||
|
$psFindFirst = '$s=''PNGZIP'';$i=-1;do{$i=$t.IndexOf($s,$i+1,[StringComparison]::Ordinal)}while($i-ge0-and($d[$i+6]-ne0-or$d[$i+7]-ne1));'
|
||||||
|
$psFindLast = '$s=''PNGZIP'';$i=$d.Length;do{$i=$t.LastIndexOf($s,$i-1,[StringComparison]::Ordinal)}while($i-ge0-and($d[$i+6]-ne0-or$d[$i+7]-ne1));'
|
||||||
|
# --- First payload (extract unpacker) ---
|
||||||
|
$pyCmd = ('python3 -c "d=open(''IMG'',''rb'').read();i=d.find(b''PNGZIP\x00\x01'');' + $pyTail).Replace('IMG', $outName)
|
||||||
|
$pyScript = "import zlib`nd=open('$outName','rb').read()`nm=b'PNGZIP'+bytes([0,1])`ni=d.find(m)`nnl=int.from_bytes(d[i+8:i+10],'big')`nn=d[i+10:i+10+nl].decode()`npl=int.from_bytes(d[i+10+nl:i+18+nl],'big')`nopen(n,'wb').write(zlib.decompress(d[i+18+nl:i+18+nl+pl]))`nprint('Extracted:',n)"
|
||||||
|
$pyB64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($pyScript))
|
||||||
|
$pyCmdB64 = 'python -c "import base64;exec(base64.b64decode(''' + $pyB64 + '''))"'
|
||||||
|
$psCmd = $psHead + $psFindFirst + $psTail
|
||||||
|
$psB64 = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($psCmd))
|
||||||
|
$psCmdB64 = 'powershell -EncodedCommand ' + $psB64
|
||||||
|
# --- Last payload (extract file directly) ---
|
||||||
|
$pyCmdLast = ('python3 -c "d=open(''IMG'',''rb'').read();i=d.rfind(b''PNGZIP\x00\x01'');' + $pyTail).Replace('IMG', $outName)
|
||||||
|
$pyScriptLast = "import zlib`nd=open('$outName','rb').read()`nm=b'PNGZIP'+bytes([0,1])`ni=d.rfind(m)`nnl=int.from_bytes(d[i+8:i+10],'big')`nn=d[i+10:i+10+nl].decode()`npl=int.from_bytes(d[i+10+nl:i+18+nl],'big')`nopen(n,'wb').write(zlib.decompress(d[i+18+nl:i+18+nl+pl]))`nprint('Extracted:',n)"
|
||||||
|
$pyB64Last = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($pyScriptLast))
|
||||||
|
$pyCmdB64Last = 'python -c "import base64;exec(base64.b64decode(''' + $pyB64Last + '''))"'
|
||||||
|
$psCmdLast = $psHead + $psFindLast + $psTail
|
||||||
|
$psB64Last = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($psCmdLast))
|
||||||
|
$psCmdB64Last = 'powershell -EncodedCommand ' + $psB64Last
|
||||||
|
# --- Build bootstrap text ---
|
||||||
|
$bsText = "png-zip bootstrap`n`n=== Extract unpacker (first payload) ===`n`nPython:`n" + $pyCmd + "`n`nPython (Windows CMD):`n" + $pyCmdB64 + "`n`nPowerShell:`n" + $psCmd + "`n`nPowerShell (Windows CMD):`n" + $psCmdB64
|
||||||
|
$bsText += "`n`n=== Extract file (last payload) ===`n`nPython:`n" + $pyCmdLast + "`n`nPython (Windows CMD):`n" + $pyCmdB64Last + "`n`nPowerShell:`n" + $psCmdLast + "`n`nPowerShell (Windows CMD):`n" + $psCmdB64Last
|
||||||
|
# Build tEXt chunk
|
||||||
|
$kwBytes = [Text.Encoding]::GetEncoding(28591).GetBytes("Comment")
|
||||||
|
$txtBytes = [Text.Encoding]::GetEncoding(28591).GetBytes($bsText)
|
||||||
|
$textCdMs = New-Object IO.MemoryStream
|
||||||
|
$textCdMs.Write($kwBytes, 0, $kwBytes.Length)
|
||||||
|
$textCdMs.WriteByte(0)
|
||||||
|
$textCdMs.Write($txtBytes, 0, $txtBytes.Length)
|
||||||
|
$textChunk = Build-PngChunk "tEXt" $textCdMs.ToArray()
|
||||||
|
# Build eXIf chunk (Windows reads UserComment from EXIF)
|
||||||
|
$exifData = Build-ExifUserComment $bsText
|
||||||
|
$exifChunk = Build-PngChunk "eXIf" $exifData
|
||||||
|
$cleanCover = Add-ChunksAfterIHDR $cleanCover @($exifChunk, $textChunk)
|
||||||
|
}
|
||||||
|
|
||||||
|
$fs = [IO.File]::Create($Output)
|
||||||
|
$fs.Write($cleanCover, 0, $cleanCover.Length) # clean cover up to IEND
|
||||||
|
|
||||||
|
# Self-extract: embed unpack.ps1 first
|
||||||
|
if ($SelfExtract) {
|
||||||
|
$unpackPath = Join-Path $PSScriptRoot "unpack.ps1"
|
||||||
|
if (-not (Test-Path $unpackPath)) { Write-Error "unpack.ps1 not found next to pack.ps1"; exit 1 }
|
||||||
|
$unpackRaw = [IO.File]::ReadAllBytes($unpackPath)
|
||||||
|
Write-PayloadBlock $fs "unpack.ps1" $unpackRaw
|
||||||
|
}
|
||||||
|
|
||||||
|
# Main payload
|
||||||
|
$raw = [IO.File]::ReadAllBytes((Resolve-Path $Payload))
|
||||||
|
Write-PayloadBlock $fs ([IO.Path]::GetFileName($Payload)) $raw
|
||||||
|
$fs.Close()
|
||||||
|
|
||||||
|
$coverKB = [math]::Round($cleanCover.Length / 1024, 1)
|
||||||
|
$totalKB = [math]::Round((Get-Item $Output).Length / 1024, 1)
|
||||||
|
Write-Host "Packed: $Output ($totalKB KB, cover $coverKB KB)"
|
||||||
|
if ($SelfExtract) {
|
||||||
|
Write-Host "Self-extract: unpack.ps1 embedded"
|
||||||
|
$displayText = $bsText.Replace("png-zip bootstrap`n", "Bootstrap one-liners:`n")
|
||||||
|
Write-Host "`n$displayText"
|
||||||
|
}
|
||||||
462
pack.py
Normal file
462
pack.py
Normal file
@@ -0,0 +1,462 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
"""Pack a file inside a PNG image.
|
||||||
|
|
||||||
|
Modes:
|
||||||
|
append (default) — data after IEND
|
||||||
|
chunk — data in private pnZp PNG chunk
|
||||||
|
lsb — data in least-significant bits of pixels
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
python3 pack.py cover.png payload [-o output.png] [-m mode] [--self-extract]
|
||||||
|
"""
|
||||||
|
import argparse
|
||||||
|
import os
|
||||||
|
import struct
|
||||||
|
import sys
|
||||||
|
import zlib
|
||||||
|
|
||||||
|
MAGIC = b"PNGZIP\x00\x01"
|
||||||
|
PNG_SIG = b"\x89PNG\r\n\x1a\n"
|
||||||
|
CHUNK_MAX = 2 * 1024 * 1024 # 2 MB per pnZp chunk
|
||||||
|
BOOTSTRAP_MARKER = "png-zip bootstrap"
|
||||||
|
|
||||||
|
|
||||||
|
def find_iend(data: bytes) -> int:
|
||||||
|
"""Return offset of the first byte AFTER the IEND chunk, or -1."""
|
||||||
|
idx = data.rfind(b"IEND")
|
||||||
|
if idx == -1:
|
||||||
|
return -1
|
||||||
|
chunk_start = idx - 4 # length field before "IEND"
|
||||||
|
length = struct.unpack(">I", data[chunk_start:chunk_start + 4])[0]
|
||||||
|
return chunk_start + 4 + 4 + length + 4 # len + type + data + crc
|
||||||
|
|
||||||
|
|
||||||
|
def make_payload_block(filename: str, raw: bytes) -> bytes:
|
||||||
|
compressed = zlib.compress(raw, 6)
|
||||||
|
name_bytes = os.path.basename(filename).encode("utf-8")
|
||||||
|
header = MAGIC
|
||||||
|
header += struct.pack(">H", len(name_bytes))
|
||||||
|
header += name_bytes
|
||||||
|
header += struct.pack(">Q", len(compressed))
|
||||||
|
crc = struct.pack(">I", zlib.crc32(raw) & 0xFFFFFFFF)
|
||||||
|
return header + compressed + crc
|
||||||
|
|
||||||
|
|
||||||
|
# ── PNG chunk helpers ─────────────────────────────────────────────
|
||||||
|
|
||||||
|
def parse_chunks(data: bytes):
|
||||||
|
"""Parse PNG data into list of (chunk_type, chunk_data)."""
|
||||||
|
if data[:8] != PNG_SIG:
|
||||||
|
raise ValueError("Not a valid PNG")
|
||||||
|
pos = 8
|
||||||
|
chunks = []
|
||||||
|
while pos + 8 <= len(data):
|
||||||
|
length = struct.unpack(">I", data[pos:pos + 4])[0]
|
||||||
|
chunk_type = data[pos + 4:pos + 8]
|
||||||
|
chunk_data = data[pos + 8:pos + 8 + length]
|
||||||
|
pos += 4 + 4 + length + 4 # len + type + data + crc
|
||||||
|
chunks.append((chunk_type, chunk_data))
|
||||||
|
return chunks
|
||||||
|
|
||||||
|
|
||||||
|
def make_png_chunk(chunk_type: bytes, chunk_data: bytes) -> bytes:
|
||||||
|
"""Build a valid PNG chunk: length + type + data + CRC32."""
|
||||||
|
length = struct.pack(">I", len(chunk_data))
|
||||||
|
crc = struct.pack(">I", zlib.crc32(chunk_type + chunk_data) & 0xFFFFFFFF)
|
||||||
|
return length + chunk_type + chunk_data + crc
|
||||||
|
|
||||||
|
|
||||||
|
def assemble_png(chunks) -> bytes:
|
||||||
|
"""Reassemble PNG from list of (type, data) tuples."""
|
||||||
|
result = bytearray(PNG_SIG)
|
||||||
|
for chunk_type, chunk_data in chunks:
|
||||||
|
result += make_png_chunk(chunk_type, chunk_data)
|
||||||
|
return bytes(result)
|
||||||
|
|
||||||
|
|
||||||
|
# ── Chunk mode ────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def pack_chunk(cover_bytes: bytes, payload_block: bytes) -> bytes:
|
||||||
|
chunks = parse_chunks(cover_bytes)
|
||||||
|
|
||||||
|
# Split payload into ≤ 2 MB fragments
|
||||||
|
pnzp_chunks = []
|
||||||
|
for seq, offset in enumerate(range(0, len(payload_block), CHUNK_MAX)):
|
||||||
|
fragment = payload_block[offset:offset + CHUNK_MAX]
|
||||||
|
pnzp_chunks.append((b"pnZp", struct.pack("B", seq) + fragment))
|
||||||
|
|
||||||
|
# Insert pnZp chunk(s) before IEND
|
||||||
|
result = []
|
||||||
|
for ct, cd in chunks:
|
||||||
|
if ct == b"IEND":
|
||||||
|
result.extend(pnzp_chunks)
|
||||||
|
result.append((ct, cd))
|
||||||
|
|
||||||
|
return assemble_png(result)
|
||||||
|
|
||||||
|
|
||||||
|
# ── LSB mode ──────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def _paeth(a, b, c):
|
||||||
|
p = a + b - c
|
||||||
|
pa, pb, pc = abs(p - a), abs(p - b), abs(p - c)
|
||||||
|
if pa <= pb and pa <= pc:
|
||||||
|
return a
|
||||||
|
return b if pb <= pc else c
|
||||||
|
|
||||||
|
|
||||||
|
def _unfilter_row(ftype, row, prev, bpp):
|
||||||
|
out = bytearray(len(row))
|
||||||
|
for i in range(len(row)):
|
||||||
|
x = row[i]
|
||||||
|
a = out[i - bpp] if i >= bpp else 0
|
||||||
|
b = prev[i]
|
||||||
|
c = prev[i - bpp] if i >= bpp else 0
|
||||||
|
if ftype == 0:
|
||||||
|
out[i] = x
|
||||||
|
elif ftype == 1:
|
||||||
|
out[i] = (x + a) & 0xFF
|
||||||
|
elif ftype == 2:
|
||||||
|
out[i] = (x + b) & 0xFF
|
||||||
|
elif ftype == 3:
|
||||||
|
out[i] = (x + (a + b) // 2) & 0xFF
|
||||||
|
elif ftype == 4:
|
||||||
|
out[i] = (x + _paeth(a, b, c)) & 0xFF
|
||||||
|
else:
|
||||||
|
raise ValueError(f"Unknown PNG filter type {ftype}")
|
||||||
|
return out
|
||||||
|
|
||||||
|
|
||||||
|
def pack_lsb(cover_bytes: bytes, payload_block: bytes) -> bytes:
|
||||||
|
chunks = parse_chunks(cover_bytes)
|
||||||
|
|
||||||
|
# ── IHDR ──
|
||||||
|
ihdr = next(cd for ct, cd in chunks if ct == b"IHDR")
|
||||||
|
width, height = struct.unpack(">II", ihdr[:8])
|
||||||
|
bit_depth, color_type = ihdr[8], ihdr[9]
|
||||||
|
interlace = ihdr[12]
|
||||||
|
if bit_depth != 8 or color_type not in (2, 6):
|
||||||
|
print("Error: LSB mode requires 8-bit RGB or RGBA PNG", file=sys.stderr)
|
||||||
|
sys.exit(1)
|
||||||
|
if interlace != 0:
|
||||||
|
print("Error: LSB mode does not support interlaced PNG", file=sys.stderr)
|
||||||
|
sys.exit(1)
|
||||||
|
channels = 3 if color_type == 2 else 4
|
||||||
|
bpp = channels
|
||||||
|
|
||||||
|
# ── Collect & decompress IDAT ──
|
||||||
|
idat_data = b"".join(cd for ct, cd in chunks if ct == b"IDAT")
|
||||||
|
raw = zlib.decompress(idat_data)
|
||||||
|
|
||||||
|
# ── Unfilter ──
|
||||||
|
stride = width * bpp
|
||||||
|
pixels = bytearray()
|
||||||
|
prev = bytearray(stride)
|
||||||
|
pos = 0
|
||||||
|
for _ in range(height):
|
||||||
|
ftype = raw[pos]; pos += 1
|
||||||
|
row = raw[pos:pos + stride]; pos += stride
|
||||||
|
prev = _unfilter_row(ftype, row, prev, bpp)
|
||||||
|
pixels.extend(prev)
|
||||||
|
|
||||||
|
# ── Capacity check ──
|
||||||
|
capacity = len(pixels) # 1 bit per byte
|
||||||
|
needed = len(payload_block) * 8
|
||||||
|
if needed > capacity:
|
||||||
|
cap_kb = capacity // 8 // 1024
|
||||||
|
need_kb = len(payload_block) // 1024
|
||||||
|
print(f"Error: payload ({need_kb} KB) exceeds LSB capacity ({cap_kb} KB)",
|
||||||
|
file=sys.stderr)
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
# ── Embed bits into LSB ──
|
||||||
|
bit_idx = 0
|
||||||
|
for byte in payload_block:
|
||||||
|
for shift in range(7, -1, -1):
|
||||||
|
pixels[bit_idx] = (pixels[bit_idx] & 0xFE) | ((byte >> shift) & 1)
|
||||||
|
bit_idx += 1
|
||||||
|
|
||||||
|
# ── Re-filter (type 0 = None) & compress ──
|
||||||
|
filtered = bytearray()
|
||||||
|
for y in range(height):
|
||||||
|
filtered.append(0)
|
||||||
|
filtered.extend(pixels[y * stride:(y + 1) * stride])
|
||||||
|
compressed = zlib.compress(bytes(filtered), 6)
|
||||||
|
|
||||||
|
# ── Reassemble PNG ──
|
||||||
|
result = []
|
||||||
|
idat_done = False
|
||||||
|
for ct, cd in chunks:
|
||||||
|
if ct == b"IDAT":
|
||||||
|
if not idat_done:
|
||||||
|
result.append((b"IDAT", compressed))
|
||||||
|
idat_done = True
|
||||||
|
else:
|
||||||
|
result.append((ct, cd))
|
||||||
|
return assemble_png(result)
|
||||||
|
|
||||||
|
|
||||||
|
# ── Clean mode ────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def clean_png(data: bytes) -> bytes:
|
||||||
|
"""Strip all embedded payloads (append + chunk) and bootstrap metadata from a PNG."""
|
||||||
|
marker = BOOTSTRAP_MARKER.encode("latin-1")
|
||||||
|
chunks = parse_chunks(data)
|
||||||
|
cleaned = []
|
||||||
|
for ct, cd in chunks:
|
||||||
|
if ct == b"pnZp":
|
||||||
|
continue # strip chunk-mode payloads
|
||||||
|
if ct == b"tEXt" and cd.startswith(b"Comment\x00") and marker in cd:
|
||||||
|
continue # strip old bootstrap tEXt comment
|
||||||
|
if ct == b"eXIf" and b"ASCII\x00\x00\x00" + marker in cd:
|
||||||
|
continue # strip old bootstrap eXIf
|
||||||
|
cleaned.append((ct, cd))
|
||||||
|
if ct == b"IEND":
|
||||||
|
break # stop here — strips append-mode trailing data
|
||||||
|
return assemble_png(cleaned)
|
||||||
|
|
||||||
|
|
||||||
|
def build_exif_user_comment(text: str) -> bytes:
|
||||||
|
"""Build minimal eXIf chunk data with UserComment field."""
|
||||||
|
user_comment = b"ASCII\x00\x00\x00" + text.encode("ascii")
|
||||||
|
uc_len = len(user_comment)
|
||||||
|
# TIFF header (8) + IFD0: count(2) + entry(12) + next(4) = 18
|
||||||
|
# ExifIFD: count(2) + entry(12) + next(4) = 18
|
||||||
|
# Total fixed = 8 + 18 + 18 = 44, then UserComment data
|
||||||
|
exif_ifd_offset = 26
|
||||||
|
uc_data_offset = 44
|
||||||
|
buf = bytearray()
|
||||||
|
buf += b"MM"
|
||||||
|
buf += struct.pack(">H", 42)
|
||||||
|
buf += struct.pack(">I", 8) # IFD0 offset
|
||||||
|
buf += struct.pack(">H", 1) # IFD0: 1 entry
|
||||||
|
buf += struct.pack(">HHI", 0x8769, 4, 1) # ExifIFD pointer tag
|
||||||
|
buf += struct.pack(">I", exif_ifd_offset)
|
||||||
|
buf += struct.pack(">I", 0) # next IFD = none
|
||||||
|
buf += struct.pack(">H", 1) # ExifIFD: 1 entry
|
||||||
|
buf += struct.pack(">HHI", 0x9286, 7, uc_len) # UserComment tag
|
||||||
|
buf += struct.pack(">I", uc_data_offset)
|
||||||
|
buf += struct.pack(">I", 0) # next IFD = none
|
||||||
|
buf += user_comment
|
||||||
|
return bytes(buf)
|
||||||
|
|
||||||
|
|
||||||
|
def _make_py_b64(fname: str, last: bool = False) -> str:
|
||||||
|
"""Generate base64-encoded Python bootstrap script for CMD."""
|
||||||
|
import base64
|
||||||
|
find = "d.rfind(m)" if last else "d.find(m)"
|
||||||
|
script = (
|
||||||
|
"import zlib\n"
|
||||||
|
"d=open('" + fname + "','rb').read()\n"
|
||||||
|
"m=b'PNGZIP'+bytes([0,1])\n"
|
||||||
|
"i=" + find + "\n"
|
||||||
|
"nl=int.from_bytes(d[i+8:i+10],'big')\n"
|
||||||
|
"n=d[i+10:i+10+nl].decode()\n"
|
||||||
|
"pl=int.from_bytes(d[i+10+nl:i+18+nl],'big')\n"
|
||||||
|
"open(n,'wb').write(zlib.decompress(d[i+18+nl:i+18+nl+pl]))\n"
|
||||||
|
"print('Extracted:',n)"
|
||||||
|
)
|
||||||
|
return base64.b64encode(script.encode()).decode()
|
||||||
|
|
||||||
|
|
||||||
|
# Common PowerShell payload-extraction tail (after $i is set to MAGIC position)
|
||||||
|
_PS_EXTRACT_TAIL = (
|
||||||
|
"$p=$i+8;"
|
||||||
|
"$nl=$d[$p]*256+$d[$p+1];$p+=2;"
|
||||||
|
"$n=[Text.Encoding]::UTF8.GetString($d,$p,$nl);$p+=$nl;"
|
||||||
|
"$pl=[uint64]0;for($k=0;$k-lt8;$k++){$pl=$pl*256+$d[$p+$k]};$p+=8;"
|
||||||
|
"$ms=New-Object IO.MemoryStream;$ms.Write($d,$p+2,$pl-6);"
|
||||||
|
"[void]$ms.Seek(0,0);"
|
||||||
|
"$ds=New-Object IO.Compression.DeflateStream($ms,"
|
||||||
|
"[IO.Compression.CompressionMode]::Decompress);"
|
||||||
|
"$os=New-Object IO.MemoryStream;$ds.CopyTo($os);"
|
||||||
|
"[IO.File]::WriteAllBytes($n,$os.ToArray());"
|
||||||
|
'Write-Host "Extracted: $n"'
|
||||||
|
)
|
||||||
|
|
||||||
|
# PowerShell: find FIRST MAGIC (for bootstrap — extracts unpacker)
|
||||||
|
_PS_FIND_FIRST = (
|
||||||
|
"$s='PNGZIP';$i=-1;"
|
||||||
|
"do{$i=$t.IndexOf($s,$i+1,[StringComparison]::Ordinal)}"
|
||||||
|
"while($i-ge0-and($d[$i+6]-ne0-or$d[$i+7]-ne1));"
|
||||||
|
)
|
||||||
|
|
||||||
|
# PowerShell: find LAST MAGIC (for direct extraction — extracts payload)
|
||||||
|
_PS_FIND_LAST = (
|
||||||
|
"$s='PNGZIP';$i=$d.Length;"
|
||||||
|
"do{$i=$t.LastIndexOf($s,$i-1,[StringComparison]::Ordinal)}"
|
||||||
|
"while($i-ge0-and($d[$i+6]-ne0-or$d[$i+7]-ne1));"
|
||||||
|
)
|
||||||
|
|
||||||
|
_PS_READ_HEAD = (
|
||||||
|
"$d=[IO.File]::ReadAllBytes('IMG');"
|
||||||
|
"$t=[Text.Encoding]::GetEncoding(28591).GetString($d);"
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
def _make_ps_encoded(fname: str, last: bool = False) -> str:
|
||||||
|
"""Generate base64-encoded PowerShell bootstrap script for CMD."""
|
||||||
|
import base64
|
||||||
|
find = _PS_FIND_LAST if last else _PS_FIND_FIRST
|
||||||
|
script = _PS_READ_HEAD.replace("IMG", fname) + find + _PS_EXTRACT_TAIL
|
||||||
|
return base64.b64encode(script.encode("utf-16-le")).decode()
|
||||||
|
|
||||||
|
|
||||||
|
def _py_oneliner(fname: str, last: bool = False) -> str:
|
||||||
|
"""Python one-liner for shell (Linux/macOS/PowerShell)."""
|
||||||
|
find = "d.rfind" if last else "d.find"
|
||||||
|
return (
|
||||||
|
"python3 -c \"d=open('IMG','rb').read();"
|
||||||
|
"i=" + find + "(b'PNGZIP\\x00\\x01');"
|
||||||
|
"nl=int.from_bytes(d[i+8:i+10],'big');"
|
||||||
|
"n=d[i+10:i+10+nl].decode();"
|
||||||
|
"pl=int.from_bytes(d[i+10+nl:i+18+nl],'big');"
|
||||||
|
"import zlib;"
|
||||||
|
"open(n,'wb').write(zlib.decompress(d[i+18+nl:i+18+nl+pl]));"
|
||||||
|
"print('Extracted:',n)\""
|
||||||
|
).replace("IMG", fname)
|
||||||
|
|
||||||
|
|
||||||
|
def _ps_oneliner(fname: str, last: bool = False) -> str:
|
||||||
|
"""PowerShell one-liner."""
|
||||||
|
find = _PS_FIND_LAST if last else _PS_FIND_FIRST
|
||||||
|
return (_PS_READ_HEAD + find + _PS_EXTRACT_TAIL).replace("IMG", fname)
|
||||||
|
|
||||||
|
|
||||||
|
def _add_oneliner_block(parts: list, fname: str, last: bool, label: str):
|
||||||
|
"""Append a full set of 4 one-liners to parts list."""
|
||||||
|
parts.append("")
|
||||||
|
parts.append(f"=== {label} ===")
|
||||||
|
parts.append("")
|
||||||
|
parts.append("Python:")
|
||||||
|
parts.append(_py_oneliner(fname, last))
|
||||||
|
parts.append("")
|
||||||
|
parts.append("Python (Windows CMD):")
|
||||||
|
parts.append(
|
||||||
|
'python -c "import base64;exec(base64.b64decode(\''
|
||||||
|
+ _make_py_b64(fname, last) + '\'))"')
|
||||||
|
parts.append("")
|
||||||
|
parts.append("PowerShell:")
|
||||||
|
parts.append(_ps_oneliner(fname, last))
|
||||||
|
parts.append("")
|
||||||
|
parts.append("PowerShell (Windows CMD):")
|
||||||
|
parts.append("powershell -EncodedCommand " + _make_ps_encoded(fname, last))
|
||||||
|
|
||||||
|
|
||||||
|
def build_bootstrap_comment(output_name: str, has_self_extract: bool = True) -> bytes:
|
||||||
|
"""Build tEXt chunk data with all bootstrap one-liners for PNG metadata."""
|
||||||
|
fname = os.path.basename(output_name)
|
||||||
|
parts = [BOOTSTRAP_MARKER]
|
||||||
|
if has_self_extract:
|
||||||
|
_add_oneliner_block(parts, fname, last=False,
|
||||||
|
label="Extract unpacker (first payload)")
|
||||||
|
_add_oneliner_block(parts, fname, last=True,
|
||||||
|
label="Extract file (last payload)")
|
||||||
|
text = "\n".join(parts)
|
||||||
|
return b"Comment\x00" + text.encode("latin-1")
|
||||||
|
|
||||||
|
|
||||||
|
# ── Main ──────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def main():
|
||||||
|
ap = argparse.ArgumentParser(description="Pack file into PNG")
|
||||||
|
ap.add_argument("cover", help="Cover PNG image")
|
||||||
|
ap.add_argument("payload", nargs="?", help="File to hide")
|
||||||
|
ap.add_argument("-o", "--output", default="packed.png", help="Output PNG")
|
||||||
|
ap.add_argument("-m", "--mode", choices=("append", "chunk", "lsb"),
|
||||||
|
default="append", help="Embedding mode (default: append)")
|
||||||
|
ap.add_argument("--clean", action="store_true",
|
||||||
|
help="Strip all embedded payloads from PNG")
|
||||||
|
ap.add_argument("--self-extract", action="store_true",
|
||||||
|
help="Embed unpack.py for bootstrap (append mode only)")
|
||||||
|
ap.add_argument("--self-extract-ps", action="store_true",
|
||||||
|
help="Embed unpack.ps1 for PowerShell bootstrap (append mode only)")
|
||||||
|
args = ap.parse_args()
|
||||||
|
|
||||||
|
with open(args.cover, "rb") as f:
|
||||||
|
cover = f.read()
|
||||||
|
|
||||||
|
if cover[:8] != PNG_SIG:
|
||||||
|
print("Error: not a valid PNG", file=sys.stderr)
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
# ── Clean mode ──
|
||||||
|
if args.clean:
|
||||||
|
result = clean_png(cover)
|
||||||
|
out = args.output if args.payload is None else args.output
|
||||||
|
with open(out, "wb") as f:
|
||||||
|
f.write(result)
|
||||||
|
before_kb = len(cover) / 1024
|
||||||
|
after_kb = len(result) / 1024
|
||||||
|
print(f"Cleaned: {out} ({after_kb:.1f} KB, was {before_kb:.1f} KB)")
|
||||||
|
return
|
||||||
|
|
||||||
|
# ── Pack mode — payload required ──
|
||||||
|
if args.payload is None:
|
||||||
|
print("Error: payload argument is required (unless --clean)", file=sys.stderr)
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
if (args.self_extract or args.self_extract_ps) and args.mode != "append":
|
||||||
|
print("Error: --self-extract/--self-extract-ps works only with append mode",
|
||||||
|
file=sys.stderr)
|
||||||
|
sys.exit(1)
|
||||||
|
|
||||||
|
# Strip any existing payloads (append + chunk) before packing
|
||||||
|
cover = clean_png(cover)
|
||||||
|
|
||||||
|
with open(args.payload, "rb") as f:
|
||||||
|
raw = f.read()
|
||||||
|
|
||||||
|
block = make_payload_block(args.payload, raw)
|
||||||
|
|
||||||
|
if args.mode == "chunk":
|
||||||
|
result = pack_chunk(cover, block)
|
||||||
|
elif args.mode == "lsb":
|
||||||
|
result = pack_lsb(cover, block)
|
||||||
|
else: # append
|
||||||
|
se_blocks = b""
|
||||||
|
for flag, name in [
|
||||||
|
(args.self_extract, "unpack.py"),
|
||||||
|
(args.self_extract_ps, "unpack.ps1"),
|
||||||
|
]:
|
||||||
|
if flag:
|
||||||
|
path = os.path.join(os.path.dirname(__file__), name)
|
||||||
|
if not os.path.exists(path):
|
||||||
|
print(f"Error: {name} not found next to pack.py", file=sys.stderr)
|
||||||
|
sys.exit(1)
|
||||||
|
with open(path, "rb") as f:
|
||||||
|
se_blocks += make_payload_block(name, f.read())
|
||||||
|
# Embed bootstrap one-liners in PNG metadata (eXIf + tEXt)
|
||||||
|
if args.self_extract or args.self_extract_ps:
|
||||||
|
comment_text = build_bootstrap_comment(
|
||||||
|
args.output,
|
||||||
|
has_self_extract=args.self_extract or args.self_extract_ps)
|
||||||
|
exif_data = build_exif_user_comment(
|
||||||
|
comment_text.split(b"\x00", 1)[1].decode("latin-1"))
|
||||||
|
chunks = parse_chunks(cover)
|
||||||
|
new_chunks = []
|
||||||
|
for ct, cd in chunks:
|
||||||
|
new_chunks.append((ct, cd))
|
||||||
|
if ct == b"IHDR":
|
||||||
|
new_chunks.append((b"eXIf", exif_data))
|
||||||
|
new_chunks.append((b"tEXt", comment_text))
|
||||||
|
cover = assemble_png(new_chunks)
|
||||||
|
result = cover + se_blocks + block
|
||||||
|
|
||||||
|
with open(args.output, "wb") as f:
|
||||||
|
f.write(result)
|
||||||
|
|
||||||
|
cover_kb = len(cover) / 1024
|
||||||
|
total_kb = len(result) / 1024
|
||||||
|
print(f"Packed [{args.mode}]: {args.output} ({total_kb:.1f} KB, cover {cover_kb:.1f} KB)")
|
||||||
|
if args.self_extract:
|
||||||
|
print("Self-extract: unpack.py embedded")
|
||||||
|
if args.self_extract_ps:
|
||||||
|
print("Self-extract: unpack.ps1 embedded")
|
||||||
|
if args.self_extract or args.self_extract_ps:
|
||||||
|
text = comment_text.split(b"\x00", 1)[1].decode("latin-1")
|
||||||
|
print("\n" + text.replace(BOOTSTRAP_MARKER + "\n", "Bootstrap one-liners:\n", 1))
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
90
unpack.ps1
Normal file
90
unpack.ps1
Normal file
@@ -0,0 +1,90 @@
|
|||||||
|
# unpack.ps1 — Extract file(s) hidden inside a PNG image
|
||||||
|
# Usage: powershell -File unpack.ps1 packed.png [-OutDir .] [-List]
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory, Position=0)][string]$Image,
|
||||||
|
[string]$OutDir = ".",
|
||||||
|
[switch]$List,
|
||||||
|
[switch]$All
|
||||||
|
)
|
||||||
|
|
||||||
|
Add-Type -TypeDefinition @"
|
||||||
|
using System;
|
||||||
|
public static class PngZipHelper2 {
|
||||||
|
static readonly uint[] crcTable;
|
||||||
|
static PngZipHelper2() {
|
||||||
|
crcTable = new uint[256];
|
||||||
|
for (uint i = 0; i < 256; i++) {
|
||||||
|
uint c = i;
|
||||||
|
for (int j = 0; j < 8; j++)
|
||||||
|
c = (c & 1) != 0 ? 0xEDB88320u ^ (c >> 1) : c >> 1;
|
||||||
|
crcTable[i] = c;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
public static uint Crc32(byte[] data) {
|
||||||
|
uint crc = 0xFFFFFFFF;
|
||||||
|
foreach (byte b in data) crc = crcTable[(crc ^ b) & 0xFF] ^ (crc >> 8);
|
||||||
|
return crc ^ 0xFFFFFFFF;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
"@
|
||||||
|
|
||||||
|
$d = [IO.File]::ReadAllBytes((Resolve-Path $Image))
|
||||||
|
$text = [Text.Encoding]::GetEncoding(28591).GetString($d)
|
||||||
|
$sig = 'PNGZIP'
|
||||||
|
|
||||||
|
$payloads = @()
|
||||||
|
$offset = 0
|
||||||
|
while ($true) {
|
||||||
|
# Find next 'PNGZIP' and validate \x00\x01 suffix via byte array
|
||||||
|
$i = $offset
|
||||||
|
while (($i = $text.IndexOf($sig, $i, [StringComparison]::Ordinal)) -ge 0) {
|
||||||
|
if ($d[$i+6] -eq 0 -and $d[$i+7] -eq 1) { break }
|
||||||
|
$i++
|
||||||
|
}
|
||||||
|
if ($i -lt 0) { break }
|
||||||
|
$p = $i + 8
|
||||||
|
|
||||||
|
# name
|
||||||
|
$nl = $d[$p] * 256 + $d[$p+1]; $p += 2
|
||||||
|
$name = [Text.Encoding]::UTF8.GetString($d, $p, $nl); $p += $nl
|
||||||
|
|
||||||
|
# compressed length (big-endian uint64)
|
||||||
|
[uint64]$pl = 0
|
||||||
|
for ($k = 0; $k -lt 8; $k++) { $pl = $pl * 256 + $d[$p+$k] }; $p += 8
|
||||||
|
|
||||||
|
# decompress zlib: skip 2-byte header, exclude 4-byte adler32
|
||||||
|
$ms = New-Object IO.MemoryStream
|
||||||
|
$ms.Write($d, $p + 2, $pl - 6)
|
||||||
|
[void]$ms.Seek(0, 0)
|
||||||
|
$ds = New-Object IO.Compression.DeflateStream($ms, [IO.Compression.CompressionMode]::Decompress)
|
||||||
|
$os = New-Object IO.MemoryStream
|
||||||
|
$ds.CopyTo($os)
|
||||||
|
$raw = $os.ToArray()
|
||||||
|
$p += $pl
|
||||||
|
|
||||||
|
# CRC check
|
||||||
|
[uint32]$storedCrc = $d[$p]*16777216 + $d[$p+1]*65536 + $d[$p+2]*256 + $d[$p+3]
|
||||||
|
$p += 4
|
||||||
|
$actualCrc = [PngZipHelper2]::Crc32($raw)
|
||||||
|
if ($actualCrc -ne $storedCrc) { Write-Warning "CRC mismatch for $name" }
|
||||||
|
|
||||||
|
$payloads += @{ Name = $name; Data = $raw }
|
||||||
|
$offset = $p
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($payloads.Count -eq 0) { Write-Error "No payload found"; exit 3 }
|
||||||
|
|
||||||
|
if ($List) {
|
||||||
|
foreach ($p in $payloads) { Write-Host " $($p.Name) ($($p.Data.Length) bytes)" }
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
$toExtract = if ($All) { $payloads } else { @($payloads[-1]) }
|
||||||
|
$null = New-Item -ItemType Directory -Force -Path $OutDir
|
||||||
|
|
||||||
|
foreach ($entry in $toExtract) {
|
||||||
|
$safeName = [IO.Path]::GetFileName($entry.Name)
|
||||||
|
$outPath = Join-Path $OutDir $safeName
|
||||||
|
[IO.File]::WriteAllBytes($outPath, $entry.Data)
|
||||||
|
Write-Host "Extracted: $outPath ($($entry.Data.Length) bytes)"
|
||||||
|
}
|
||||||
282
unpack.py
Normal file
282
unpack.py
Normal file
@@ -0,0 +1,282 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
"""Extract file(s) hidden inside a PNG image.
|
||||||
|
|
||||||
|
Supports three embedding modes (auto-detected):
|
||||||
|
append — data after IEND
|
||||||
|
chunk — data in private pnZp PNG chunk
|
||||||
|
lsb — data in least-significant bits of pixels
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
python3 unpack.py packed.png [-o output_dir] [-a]
|
||||||
|
"""
|
||||||
|
import argparse
|
||||||
|
import os
|
||||||
|
import struct
|
||||||
|
import sys
|
||||||
|
import zlib
|
||||||
|
|
||||||
|
MAGIC = b"PNGZIP\x00\x01"
|
||||||
|
PNG_SIG = b"\x89PNG\r\n\x1a\n"
|
||||||
|
|
||||||
|
|
||||||
|
# ── Shared helpers ────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def find_iend(data: bytes) -> int:
|
||||||
|
"""Return offset of the first byte AFTER the IEND chunk, or -1."""
|
||||||
|
idx = data.rfind(b"IEND")
|
||||||
|
if idx == -1:
|
||||||
|
return -1
|
||||||
|
chunk_start = idx - 4
|
||||||
|
length = struct.unpack(">I", data[chunk_start:chunk_start + 4])[0]
|
||||||
|
return chunk_start + 4 + 4 + length + 4
|
||||||
|
|
||||||
|
|
||||||
|
def parse_chunks(data: bytes):
|
||||||
|
"""Parse PNG data into list of (chunk_type, chunk_data)."""
|
||||||
|
pos = 8 # skip PNG signature
|
||||||
|
chunks = []
|
||||||
|
while pos + 8 <= len(data):
|
||||||
|
length = struct.unpack(">I", data[pos:pos + 4])[0]
|
||||||
|
chunk_type = data[pos + 4:pos + 8]
|
||||||
|
chunk_data = data[pos + 8:pos + 8 + length]
|
||||||
|
pos += 4 + 4 + length + 4
|
||||||
|
chunks.append((chunk_type, chunk_data))
|
||||||
|
return chunks
|
||||||
|
|
||||||
|
|
||||||
|
def parse_payload_blocks(data: bytes):
|
||||||
|
"""Yield (filename, raw_bytes) for each payload block in data."""
|
||||||
|
offset = 0
|
||||||
|
while True:
|
||||||
|
idx = data.find(MAGIC, offset)
|
||||||
|
if idx == -1:
|
||||||
|
break
|
||||||
|
pos = idx + len(MAGIC)
|
||||||
|
|
||||||
|
if pos + 2 > len(data):
|
||||||
|
break
|
||||||
|
name_len = struct.unpack(">H", data[pos:pos + 2])[0]
|
||||||
|
pos += 2
|
||||||
|
|
||||||
|
if pos + name_len > len(data):
|
||||||
|
break
|
||||||
|
filename = data[pos:pos + name_len].decode("utf-8")
|
||||||
|
pos += name_len
|
||||||
|
|
||||||
|
if pos + 8 > len(data):
|
||||||
|
break
|
||||||
|
payload_len = struct.unpack(">Q", data[pos:pos + 8])[0]
|
||||||
|
pos += 8
|
||||||
|
|
||||||
|
if pos + payload_len > len(data):
|
||||||
|
break
|
||||||
|
compressed = data[pos:pos + payload_len]
|
||||||
|
pos += payload_len
|
||||||
|
|
||||||
|
if pos + 4 > len(data):
|
||||||
|
break
|
||||||
|
stored_crc = struct.unpack(">I", data[pos:pos + 4])[0]
|
||||||
|
pos += 4
|
||||||
|
|
||||||
|
raw = zlib.decompress(compressed)
|
||||||
|
actual_crc = zlib.crc32(raw) & 0xFFFFFFFF
|
||||||
|
if actual_crc != stored_crc:
|
||||||
|
print(f"Warning: CRC mismatch for {filename}", file=sys.stderr)
|
||||||
|
|
||||||
|
yield filename, raw
|
||||||
|
offset = pos
|
||||||
|
|
||||||
|
|
||||||
|
# ── Append mode ───────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def find_append_payloads(data: bytes):
|
||||||
|
"""Find payloads appended after IEND."""
|
||||||
|
iend = find_iend(data)
|
||||||
|
if iend == -1 or iend >= len(data):
|
||||||
|
return []
|
||||||
|
return list(parse_payload_blocks(data[iend:]))
|
||||||
|
|
||||||
|
|
||||||
|
# ── Chunk mode ────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def find_chunk_payloads(data: bytes):
|
||||||
|
"""Find payloads stored in pnZp chunks."""
|
||||||
|
if data[:8] != PNG_SIG:
|
||||||
|
return []
|
||||||
|
chunks = parse_chunks(data)
|
||||||
|
pnzp = [(cd[0], cd[1:]) for ct, cd in chunks if ct == b"pnZp" and len(cd) > 0]
|
||||||
|
if not pnzp:
|
||||||
|
return []
|
||||||
|
pnzp.sort(key=lambda x: x[0])
|
||||||
|
combined = b"".join(frag for _, frag in pnzp)
|
||||||
|
return list(parse_payload_blocks(combined))
|
||||||
|
|
||||||
|
|
||||||
|
# ── LSB mode ──────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def _paeth(a, b, c):
|
||||||
|
p = a + b - c
|
||||||
|
pa, pb, pc = abs(p - a), abs(p - b), abs(p - c)
|
||||||
|
if pa <= pb and pa <= pc:
|
||||||
|
return a
|
||||||
|
return b if pb <= pc else c
|
||||||
|
|
||||||
|
|
||||||
|
def _unfilter_row(ftype, row, prev, bpp):
|
||||||
|
out = bytearray(len(row))
|
||||||
|
for i in range(len(row)):
|
||||||
|
x = row[i]
|
||||||
|
a = out[i - bpp] if i >= bpp else 0
|
||||||
|
b = prev[i]
|
||||||
|
c = prev[i - bpp] if i >= bpp else 0
|
||||||
|
if ftype == 0:
|
||||||
|
out[i] = x
|
||||||
|
elif ftype == 1:
|
||||||
|
out[i] = (x + a) & 0xFF
|
||||||
|
elif ftype == 2:
|
||||||
|
out[i] = (x + b) & 0xFF
|
||||||
|
elif ftype == 3:
|
||||||
|
out[i] = (x + (a + b) // 2) & 0xFF
|
||||||
|
elif ftype == 4:
|
||||||
|
out[i] = (x + _paeth(a, b, c)) & 0xFF
|
||||||
|
else:
|
||||||
|
raise ValueError(f"Unknown PNG filter type {ftype}")
|
||||||
|
return out
|
||||||
|
|
||||||
|
|
||||||
|
def find_lsb_payloads(data: bytes):
|
||||||
|
"""Find payloads encoded in LSB of pixel data."""
|
||||||
|
if data[:8] != PNG_SIG:
|
||||||
|
return []
|
||||||
|
try:
|
||||||
|
chunks = parse_chunks(data)
|
||||||
|
except Exception:
|
||||||
|
return []
|
||||||
|
|
||||||
|
# Parse IHDR
|
||||||
|
ihdr = None
|
||||||
|
for ct, cd in chunks:
|
||||||
|
if ct == b"IHDR":
|
||||||
|
ihdr = cd
|
||||||
|
break
|
||||||
|
if ihdr is None or len(ihdr) < 13:
|
||||||
|
return []
|
||||||
|
|
||||||
|
width, height = struct.unpack(">II", ihdr[:8])
|
||||||
|
bit_depth, color_type = ihdr[8], ihdr[9]
|
||||||
|
interlace = ihdr[12]
|
||||||
|
if bit_depth != 8 or color_type not in (2, 6) or interlace != 0:
|
||||||
|
return []
|
||||||
|
channels = 3 if color_type == 2 else 4
|
||||||
|
bpp = channels
|
||||||
|
|
||||||
|
# Decompress IDAT
|
||||||
|
idat_data = b"".join(cd for ct, cd in chunks if ct == b"IDAT")
|
||||||
|
if not idat_data:
|
||||||
|
return []
|
||||||
|
try:
|
||||||
|
raw = zlib.decompress(idat_data)
|
||||||
|
except zlib.error:
|
||||||
|
return []
|
||||||
|
|
||||||
|
# Unfilter
|
||||||
|
stride = width * bpp
|
||||||
|
pixels = bytearray()
|
||||||
|
prev = bytearray(stride)
|
||||||
|
pos = 0
|
||||||
|
for _ in range(height):
|
||||||
|
if pos >= len(raw):
|
||||||
|
return []
|
||||||
|
ftype = raw[pos]; pos += 1
|
||||||
|
if pos + stride > len(raw):
|
||||||
|
return []
|
||||||
|
row = raw[pos:pos + stride]; pos += stride
|
||||||
|
prev = _unfilter_row(ftype, row, prev, bpp)
|
||||||
|
pixels.extend(prev)
|
||||||
|
|
||||||
|
# Quick check: extract MAGIC-length bytes first
|
||||||
|
total_pixels = len(pixels)
|
||||||
|
magic_len = len(MAGIC)
|
||||||
|
if total_pixels < magic_len * 8:
|
||||||
|
return []
|
||||||
|
|
||||||
|
quick = bytearray(magic_len)
|
||||||
|
for i in range(magic_len):
|
||||||
|
b = 0
|
||||||
|
base = i * 8
|
||||||
|
for bit in range(8):
|
||||||
|
b = (b << 1) | (pixels[base + bit] & 1)
|
||||||
|
quick[i] = b
|
||||||
|
|
||||||
|
if quick != bytearray(MAGIC):
|
||||||
|
return []
|
||||||
|
|
||||||
|
# MAGIC found — extract all available bytes
|
||||||
|
total_bytes = total_pixels // 8
|
||||||
|
extracted = bytearray(total_bytes)
|
||||||
|
for i in range(total_bytes):
|
||||||
|
b = 0
|
||||||
|
base = i * 8
|
||||||
|
for bit in range(8):
|
||||||
|
b = (b << 1) | (pixels[base + bit] & 1)
|
||||||
|
extracted[i] = b
|
||||||
|
|
||||||
|
return list(parse_payload_blocks(bytes(extracted)))
|
||||||
|
|
||||||
|
|
||||||
|
# ── Auto-detect all modes ────────────────────────────────────────
|
||||||
|
|
||||||
|
def find_all_payloads(data: bytes):
|
||||||
|
"""Try all detection methods: append → chunk → lsb."""
|
||||||
|
results = find_append_payloads(data)
|
||||||
|
if results:
|
||||||
|
return results
|
||||||
|
results = find_chunk_payloads(data)
|
||||||
|
if results:
|
||||||
|
return results
|
||||||
|
results = find_lsb_payloads(data)
|
||||||
|
if results:
|
||||||
|
return results
|
||||||
|
return []
|
||||||
|
|
||||||
|
|
||||||
|
# ── Main ──────────────────────────────────────────────────────────
|
||||||
|
|
||||||
|
def main():
|
||||||
|
ap = argparse.ArgumentParser(description="Extract file from PNG")
|
||||||
|
ap.add_argument("image", help="PNG with hidden payload")
|
||||||
|
ap.add_argument("-o", "--outdir", default=".", help="Output directory")
|
||||||
|
ap.add_argument("-a", "--all", action="store_true",
|
||||||
|
help="Extract all payloads (including embedded unpack.py)")
|
||||||
|
ap.add_argument("-l", "--list", action="store_true",
|
||||||
|
help="List payloads without extracting")
|
||||||
|
args = ap.parse_args()
|
||||||
|
|
||||||
|
with open(args.image, "rb") as f:
|
||||||
|
data = f.read()
|
||||||
|
|
||||||
|
payloads = list(find_all_payloads(data))
|
||||||
|
if not payloads:
|
||||||
|
print("No payload found in this PNG.", file=sys.stderr)
|
||||||
|
sys.exit(3)
|
||||||
|
|
||||||
|
if args.list:
|
||||||
|
for name, raw in payloads:
|
||||||
|
print(f" {name} ({len(raw)} bytes)")
|
||||||
|
return
|
||||||
|
|
||||||
|
# By default extract only the last payload (the main one).
|
||||||
|
# With --all, extract everything.
|
||||||
|
to_extract = payloads if args.all else [payloads[-1]]
|
||||||
|
|
||||||
|
os.makedirs(args.outdir, exist_ok=True)
|
||||||
|
for filename, raw in to_extract:
|
||||||
|
safe_name = os.path.basename(filename) # path traversal protection
|
||||||
|
out_path = os.path.join(args.outdir, safe_name)
|
||||||
|
with open(out_path, "wb") as f:
|
||||||
|
f.write(raw)
|
||||||
|
print(f"Extracted: {out_path} ({len(raw)} bytes)")
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
Reference in New Issue
Block a user