Readable Artefacts

file only names the container. The next commands read the bytes: strings for printable runs, hexdump for the raw hex, grep for a pattern you already have.

strings

strings walks a file and prints runs of printable characters. Its default minimum length is four characters.

$ file sample.png
sample.png: PNG image data, 1 x 1, 8-bit/color RGB, non-interlaced

$ strings -t d sample.png
    12 IHDR
    37 IDATx
    61 IEND
    69 bitctf{{example}}

-t d prints the byte offset in decimal. IHDR, IDAT, and IEND are PNG chunk names. They belong in a PNG. bitctf{{example}} does not — it is leftover text at offset 69.

file still said "PNG image data". It reports the header. It does not mention bytes after IEND.

hexdump

Those offsets are ordinary bytes. hexdump -C prints offset, hex, and ASCII:

$ hexdump -C sample.png
00000000  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|
00000010  00 00 00 01 00 00 00 01  08 02 00 00 00 90 77 53  |..............wS|
00000020  de 00 00 00 0c 49 44 41  54 78 9c 63 f8 cf c0 00  |.....IDATx.c....|
00000030  00 03 01 01 00 c9 fe 92  ef 00 00 00 00 49 45 4e  |.............IEN|
00000040  44 ae 42 60 82 62 69 74  63 74 66 7b 7b 65 78 61  |D.B`.bitctf{{exa|
00000050  6d 70 6c 65 7d 7d 0a                              |mple}}.|

89 50 4e 47 is the PNG signature (see man file, or Wikipedia's list of file signatures). 49 48 44 52 at offset 0x0c (12) is IHDR — the same offset strings -t d printed. After IEND (49 45 4e 44) the extra ASCII starts: 62 69 74 63 74 66 is bitctf.

xxd is the same kind of dump if you do not have hexdump.

grep

grep searches text line by line and prints the lines containing a pattern.

Flags in this course start with bitctf. Search for that prefix:

$ grep -n bitctf notes.txt
2:submit bitctf{{example}} here

-n prefixes the line number.

On a binary, pipe strings into grep:

$ strings sample.png | grep bitctf
bitctf{{example}}

When file already says text

If the type is ASCII text, HTML, XML, or SVG Scalable Vector Graphics image, the whole file is text. cat, less, or an editor is enough. strings still works; you do not need it.

SVG is XML. XML comments are <!-- … -->. A browser draws the elements and skips the comments.

$ file sample.svg
sample.svg: SVG Scalable Vector Graphics image

$ cat sample.svg
<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10">
  <!-- generator: inkscape 1.2 -->
  <rect width="10" height="10" fill="#000"/>
</svg>

$ grep -n '<!--' sample.svg
2:  <!-- generator: inkscape 1.2 -->

HTML uses the same comment markers.

Interpreting what you find

Tools and resources

• file and libmagic project for file-type identification
• GNU strings documentation
• xxd manual and hexdump manual
• GNU grep manual
• W3C PNG file structure and chunk reference for IHDR, IDAT, and IEND
• MDN SVG guide and HTML/XML comment reference

Self-check

strings prints IHDR, IDAT, IEND, and backup-password.txt from a PNG. Which result deserves a follow-up?

backup-password.txt. The chunk names are expected PNG structure; the filename is a clue that does not naturally belong there.

Next

Next challenge: Polaroid Printer Whisper