C:\CTF\GASLIGHT\LAYERED.EXE _□X

LAYERED-PAGES

forensics 108 solves by riyc

Challenge

my desk is a mess! help me sort it out!

File given: gassy.zip.

Approach

You can just put as many images into one file as you like: JPEG and PNG are both self-delimiting formats, every JPEG starts with an SOI marker (FF D8) and ends with EOI (FF D9), every PNG starts with its 8-byte signature and ends with an IEND chunk, and nothing stops multiple complete images from being concatenated back to back under one extension. A normal viewer just decodes the first one and ignores the rest. Scanning the raw bytes for every SOI/EOI and PNG-signature/IEND pair, not just the first, pulls all of them out:

JPEG_SOI = b"\xff\xd8"
JPEG_EOI = b"\xff\xd9"
PNG_SIG = b"\x89PNG\r\n\x1a\n"
PNG_IEND = b"IEND\xae\x42\x60\x82"

fragments = []
i = 0
while True:
    start = data.find(JPEG_SOI, i)
    if start == -1: break
    end = data.find(JPEG_EOI, start)
    if end != -1: fragments.append((start, end + len(JPEG_EOI), "jpg"))
    i = start + 2

i = 0
while True:
    start = data.find(PNG_SIG, i)
    if start == -1: break
    end = data.find(PNG_IEND, start)
    if end != -1: fragments.append((start, end + len(PNG_IEND), "png"))
    i = start + 1

def decodes(chunk):
    return cv2.imdecode(np.frombuffer(chunk, dtype=np.uint8), cv2.IMREAD_COLOR) is not None

fragments = [f for f in fragments if decodes(data[f[0]:f[1]])]
fragments.sort(key=lambda f: f[0])
filtered = []
last_end = -1
for start, end, ext in fragments:
    if start < last_end: continue
    filtered.append((start, end, ext))
    last_end = end
fragments = filtered

The overlap filter matters. JPEG's compressed data can coincidentally contain byte sequences that look like a PNG signature or another SOI marker, so raw scanning turns up false positives nested inside real fragments. Rejecting anything that starts before the previous accepted fragment ends clears those out.

That turns up 9 valid, back-to-back images (a mix of .jpg and .png) hiding inside the one 250×250 file, each a hand-drawn snippet of a few characters:

Nine extracted image fragments laid out side by side, each containing a few hand-drawn characters