archive file in image

[galaxyAbstractor]

I made an app in java to hide an zip/rar in a jpg/png image. Now I want to reverse it, but then I need to find out if there is an archive in the image the user inputs.

Any ideas on how I could check this?

 

[ichwar]

Ohoh. Are you taking to planting trojans in people's PCs?

 

[galaxyAbstractor]

Ohoh. Are you taking to planting trojans in people's PCs?

No :eek4:. A zip/rar archive can't be run

 

[ichwar]

No :eek4:. A zip/rar archive can't be run

Of course not, but it can contain several MB of data that can be run by a 5k .exe

I was teasing you though. I know you wouldn't be doing that. :hahano:

 

[xav0989]

well there's some auto-extract archives...

 

[galaxyAbstractor]

well there's some auto-extract archives...

but you can't place that in an image xD. Only normal rar/zip files works, otherwise the file gets broken

 

[misson]

I need to find out if there is an archive in the image the user inputs.

Are you talking about steganography detection? Check out stegdetect or StegAlyzerSS.

 

[galaxyAbstractor]

Are you talking about steganography detection? Check out stegdetect or StegAlyzerSS.

Maybe.

The first only works with JPEG images, the other isn't free

 

[xav0989]

Maybe.

The first only works with JPEG images, the other isn't free

Looks like you'll have to code it yourself! have fun!

 

[marshian]

I think it would be of a lot of use if you mentioned how you stored that archive in that image
If you want to reverse it you'll probably be basing yourself on the original encryption code too...
(I'll subscribe to this topic so it won't take over a week to get response this time (a))

 

[galaxyAbstractor]

I think it would be of a lot of use if you mentioned how you stored that archive in that image
If you want to reverse it you'll probably be basing yourself on the original encryption code too...
(I'll subscribe to this topic so it won't take over a week to get response this time (a))

Process p = Runtime.getRuntime().exec("cmd /C copy /b "+ image +" + "+ file +" "+ output);

I'm lazy so I use CMD to do it xD. It just puts the archive at the bottom of the image.

 

[marshian]

I don't like your code

The problem is you don't know where the image ends and the archive starts. You could search for the signature of a zip/rar archive in the image file, but who says those can't occur in the body of an image? Therefore you can't be sure it's actually going to work.
If I were you I'd get the hell rid of that cmd command and start using real Java code and attach some more to that file...

Say this is your current method:
<image (?? bytes)><archive (?? bytes)>
You don't know where the image ends and the archive starts, nor can you distinguish a normal image from an image containing an archive.
What I would do is something like this:
<image (x bytes)><archive (?? bytes)><4 byte integer x><4 byte number>
In this case you'll add 8 byte (which is almost nothing) to the image but you can easily solve your problems. The 4 byte number on the end should be the same for each image, allowing you to distinguish an edited image from a normal one. (Pick a number and add it to each image so you can identify the images.)
The 4 bytes in front of that should represent an integer which contains the size of the image. (Before you packed an archive in it.)

So what you should do is:

Image a (size: x bytes)
Archive b (size: y bytes)
Output f (size: x+y+8 bytes)

Me-code:
f.write(a);
f.write(b);
f.write(a.size());
f.write(0x58);
f.write(0x59);
f.write(0x12);
f.write(0xA2);

 

[galaxyAbstractor]

I don't like your code

The problem is you don't know where the image ends and the archive starts. You could search for the signature of a zip/rar archive in the image file, but who says those can't occur in the body of an image? Therefore you can't be sure it's actually going to work.
If I were you I'd get the hell rid of that cmd command and start using real Java code and attach some more to that file...

Say this is your current method:
<image (?? bytes)><archive (?? bytes)>
You don't know where the image ends and the archive starts, nor can you distinguish a normal image from an image containing an archive.
What I would do is something like this:
<image (x bytes)><archive (?? bytes)><4 byte integer x><4 byte number>
In this case you'll add 8 byte (which is almost nothing) to the image but you can easily solve your problems. The 4 byte number on the end should be the same for each image, allowing you to distinguish an edited image from a normal one. (Pick a number and add it to each image so you can identify the images.)
The 4 bytes in front of that should represent an integer which contains the size of the image. (Before you packed an archive in it.)

So what you should do is:

Image a (size: x bytes)
Archive b (size: y bytes)
Output f (size: x+y+8 bytes)

Me-code:
f.write(a);
f.write(b);
f.write(a.size());
f.write(0x58);
f.write(0x59);
f.write(0x12);
f.write(0xA2);

but wouldn't that destroy the file? I.e it can't be opened anymore?

 

[marshian]

Your method is basically the same, if your method works then adding another 8 byte shouldn't destroy the image.
Your method just copies the archive behind the image, doesn't it?

 

[galaxyAbstractor]

Your method is basically the same, if your method works then adding another 8 byte shouldn't destroy the image.
Your method just copies the archive behind the image, doesn't it?

I'll try it and check if it works. Then I can make a linux compatible version too xD

 

[marshian]

If you use pure Java it'll work on any OS with Java
It's not hard, if you want I'll write example code.
Edit:
I tried adding some random data to a gif, png and jpeg image and in all 3 cases the images were still valid. It's not a guarantee, but it might indicate your method of just appending data will work. And therefore, my edit of your method should work too.

 

[galaxyAbstractor]

I don't like your code

The problem is you don't know where the image ends and the archive starts. You could search for the signature of a zip/rar archive in the image file, but who says those can't occur in the body of an image? Therefore you can't be sure it's actually going to work.
If I were you I'd get the hell rid of that cmd command and start using real Java code and attach some more to that file...

Say this is your current method:
<image (?? bytes)><archive (?? bytes)>
You don't know where the image ends and the archive starts, nor can you distinguish a normal image from an image containing an archive.
What I would do is something like this:
<image (x bytes)><archive (?? bytes)><4 byte integer x><4 byte number>
In this case you'll add 8 byte (which is almost nothing) to the image but you can easily solve your problems. The 4 byte number on the end should be the same for each image, allowing you to distinguish an edited image from a normal one. (Pick a number and add it to each image so you can identify the images.)
The 4 bytes in front of that should represent an integer which contains the size of the image. (Before you packed an archive in it.)

So what you should do is:

Image a (size: x bytes)
Archive b (size: y bytes)
Output f (size: x+y+8 bytes)

Me-code:
f.write(a);
f.write(b);
f.write(a.size());
f.write(0x58);
f.write(0x59);
f.write(0x12);
f.write(0xA2);

How would I read the files into a and b?

 

[marshian]

Reading back in very basic me-code:

File input = new File("input.jpg");
if(input.lastFourBytes() == '\u58' + '\u59' + '\u12' + '\uA2') {
//valid input
int imagesize = input.readInt(input.size()-8 till input.size()-4);
byte[] archive = input.read(imagesize till input.size()-8);
} else {
//invalid input
}

 

[galaxyAbstractor]

Reading back in very basic me-code:

File input = new File("input.jpg");
if(input.lastFourBytes() == '\u58' + '\u59' + '\u12' + '\uA2') {
//valid input
int imagesize = input.readInt(input.size()-8 till input.size()-4);
byte[] archive = input.read(imagesize till input.size()-8);
} else {
//invalid input
}

Well, I mean, how do I read in the image and the archive and putting them together to an image file? Sun has removed the JDK6 tutorial and replaced everything with JDK7, so they removed the docs for it :/

Edit: nvm got it here: http://www.java-examples.com/read-file-using-fileinputstream

Now how do I write a and b + the other things to a file?

(http://pastebin.ca/1598646 I know of the error but how do I go from there?)

 

[marshian]

That's going to be a hefty piece of memory required to get a copy action done...
How about you read the image byte by byte and immediately write it out to the output file?
Repeat the same for the archive.
Then write with an ObjectOutputStream an integer containing the size of the image file to the output and finally the 4 'fingerprint' characters.