plaidctf2015 uncorrupt png

  代码的执行时间挺长的,好囧!

  参考了https://13c5.wordpress.com/2015/04/20/plaidctf-2015-png-uncorrupt/的代码

  通过这个题目,也对Png文件格式更深入地理解了!

  使用这个代码的前提是将png signature里面的0x0a修改为0x0d0a

 from itertools import combinations
import binascii
import os def find_all(source,aim):
start=
while True:
start=source.find(aim,start)
if start==-:
return
yield start
start +=len(aim) def repair(source,aim,filedes,num,crc):
matchlist=list(find_all(source,'\x0a')) for subnet in combinations(matchlist,num):
subnet=sorted(subnet)
temp=''
if(num==):
temp=source[:subnet[]]+'\x0d\x0a'+source[subnet[]+:subnet[]]+'\x0d\x0a'+source[subnet[]+:subnet[]]+'\x0d\x0a'+source[subnet[]+:]
if(num==):
temp=source[:subnet[]]+'\x0d\x0a'+source[subnet[]+:subnet[]]+'\x0d\x0a'+source[subnet[]+:]
if(num==):
temp=source[:subnet[]]+'\x0d\x0a'+source[subnet[]+:]
if "%08x" % (binascii.crc32(temp)&0xFFFFFFFF)==crc:
filedes.write(temp)
filedes.write(binascii.a2b_hex(crc))
filedes.flush()
print "success"
break;
print "fail" uncfile=open("corrupt_735acee15fa4f3be8ecd0c6bcf294fd4.png","rb")
cocfile=open("correct.png","wb")
#first write
correct=uncfile.read(0x6d)
cocfile.write(correct)
cocfile.flush() correct=uncfile.read(0x4)#length
cocfile.write(correct)
cocfile.flush() uncorrect=uncfile.read(0x20000-0x1+0x4)
crc=uncfile.read(0x4)
crc=binascii.hexlify(crc)
print crc
repair(uncorrect,'\x0a',cocfile,,crc)#
#second write
correct=uncfile.read(0x4)#length
cocfile.write(correct)
cocfile.flush()
uncorrect=uncfile.read(0x20000-0x3+0x4)
crc=uncfile.read(0x4)
crc=binascii.hexlify(crc)
print crc
repair(uncorrect,'\x0a',cocfile,,crc)#
#third write
correct=uncfile.read(0x4)#length
cocfile.write(correct)
cocfile.flush()
uncorrect=uncfile.read(0x20000-0x1+0x4)
crc=uncfile.read(0x4)
crc=binascii.hexlify(crc)
print crc
repair(uncorrect,'\x0a',cocfile,,crc)#
#fourth write
correct=uncfile.read(0x4+0x4+0x20000+0x4)
cocfile.write(correct)
cocfile.flush()
#fifth write
correct=uncfile.read(0x4)#length
cocfile.write(correct)
cocfile.flush()
uncorrect=uncfile.read(0x20000-0x3+0x4)
crc=uncfile.read(0x4)
crc=binascii.hexlify(crc)
print crc
repair(uncorrect,'\x0a',cocfile,,crc)#
#6th
correct=uncfile.read(0x4)#length
cocfile.write(correct)
cocfile.flush()
uncorrect=uncfile.read(0x20000-0x1+0x4)
crc=uncfile.read(0x4)
crc=binascii.hexlify(crc)
print crc
repair(uncorrect,'\x0a',cocfile,,crc)#
#7th
correct=uncfile.read(0x4)
cocfile.write(correct)
cocfile.flush()
uncorrect=uncfile.read(0x20000-0x2+0x4)
crc=uncfile.read(0x4)
crc=binascii.hexlify(crc)
print crc
repair(uncorrect,'\x0a',cocfile,,crc)#
#8th
correct=uncfile.read(0x4+0x4+0x20000+0x4)
cocfile.write(correct)
cocfile.flush()
#9th
correct=uncfile.read(0x4)
cocfile.write(correct)
cocfile.flush()
uncorrect=uncfile.read(0x20000-0x1+0x4)
crc=uncfile.read(0x4)
crc=binascii.hexlify(crc)
print crc
repair(uncorrect,'\x0a',cocfile,,crc)#
#10th
correct=uncfile.read(0x4+0x4+0x216f)
cocfile.write(correct)
cocfile.flush() uncfile.close()
cocfile.close()

  

  结果:

plaidctf2015 uncorrupt png

参考文献:

  http://blog.csdn.net/gogor/article/details/5265710

  http://www.libpng.org/pub/png/apps/pngcheck.html

  http://www.libpng.org/pub/png/book/chapter08.html

  http://*.com/questions/27238021/png-images-not-loaded

  https://13c5.wordpress.com/2015/04/20/plaidctf-2015-png-uncorrupt/

上一篇:LightOJ1326 Race(DP)


下一篇:文件操作I