Advertisement
Guest User

Untitled

a guest
Mar 6th, 2011
878
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.59 KB | None | 0 0
  1. sing foremost there is a jpeg of a notepad with the text "The key", followed by corruption. This is because the jpeg was fragmented in the original filesystem. At offset 0x9000 is the start of the Webdings font. To find the other part, the following Python script finds compressed data and end-of-jpeg markers:
  2.  
  3. Python:
  4.  
  5. #!/usr/bin/python
  6. import io
  7.  
  8. def meanstdv(x):
  9. from math import sqrt
  10. n, mean, std = len(x), 0, 0
  11. for a in x:
  12. mean = mean + a
  13. mean = mean / float(n)
  14. for a in x:
  15. std = std + (a - mean)**2
  16. std = sqrt(std / float(n-1))
  17. return mean, std
  18.  
  19. f = io.open("for200", "rb")
  20. data = f.read()
  21. f.close()
  22.  
  23. for i in range(0, len(data), 4096):
  24. cluster = data[i:i+4096]
  25. dist = [0] * 256
  26. for j in range(0, 4096):
  27. dist[ord(cluster[j])] += 1
  28. mean, std = meanstdv(dist)
  29. if std < 20:
  30. print "Possible compressed data at %x" % i
  31. idx = cluster.rfind("\xff\xd9")
  32. if idx != -1:
  33. rest = cluster[idx+2:].strip("\x00")
  34. if len(rest) == 0:
  35. print "End of JPEG at %x" % i
  36. if cluster[6:10] == "JFIF":
  37. print "Start of JPEG at %x" % i
  38. if len(cluster.strip("\x00")) < 3000:
  39. print "Possible end of file at %x" % i
  40. At offset 0x1427000 in the original file is compressed data followed by an end-of-jpeg marker, but without a start-of-jpeg marker before it. Appending it to the first jpeg gives an image with the following URL, which is the key:
  41.  
  42. www.youtube.com/watch?v=uLQokDjcivU
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement